@miragon/design-iq-mcp 5.0.0-rc.0

package/dist/tools-V_22sqM1.js

@@ -0,0 +1,1890 @@
+import { readFileSync, statSync } from "node:fs";
+import { dirname, join, posix, relative } from "node:path";
+import { readdir } from "node:fs/promises";
+import { parse } from "yaml";
+import { XMLParser } from "fast-xml-parser";
+import { fileURLToPath } from "node:url";
+import { McpServer } from "@modelcontextprotocol/server";
+import { z } from "zod";
+//#region ../notations/bpmn-kinds.ts
+const BPMN_ELEMENT_KIND = /* @__PURE__ */ new Map([
+	["task", "activity"],
+	["userTask", "activity"],
+	["serviceTask", "activity"],
+	["scriptTask", "activity"],
+	["businessRuleTask", "activity"],
+	["manualTask", "activity"],
+	["sendTask", "activity"],
+	["receiveTask", "activity"],
+	["callActivity", "activity"],
+	["subProcess", "activity"],
+	["adHocSubProcess", "activity"],
+	["transaction", "activity"],
+	["startEvent", "event"],
+	["endEvent", "event"],
+	["intermediateThrowEvent", "event"],
+	["intermediateCatchEvent", "event"],
+	["boundaryEvent", "event"],
+	["exclusiveGateway", "gateway"],
+	["parallelGateway", "gateway"],
+	["inclusiveGateway", "gateway"],
+	["eventBasedGateway", "gateway"],
+	["complexGateway", "gateway"]
+]);
+/** the kind of a flow-node tag; undefined = not a flow node (artifact, lane, …) */
+const kindOf = (tag) => BPMN_ELEMENT_KIND.get(tag);
+/** every flow-node tag — everything else (textAnnotation, dataObject, …) is a
+*  legal artifact but NOT a flow node; treating it as one produces false
+*  "unreachable"/"dead end" errors on perfectly valid models */
+const BPMN_FLOW_NODE_TAGS = new Set(BPMN_ELEMENT_KIND.keys());
+/** container tags whose children form their own flow graph */
+const BPMN_SUB_CONTAINER_TAGS = /* @__PURE__ */ new Set([
+	"subProcess",
+	"adHocSubProcess",
+	"transaction"
+]);
+/** non-flow-node artifacts that still need a BPMNDI shape/edge to render.
+*  Exactly these five: plain `dataObject` is deliberately ABSENT — bpmn-js
+*  draws the dataObjectReference, not the dataObject; requiring DI for the
+*  latter would false-error every model with one. */
+const BPMN_DI_ARTIFACT_TAGS = /* @__PURE__ */ new Set([
+	"textAnnotation",
+	"association",
+	"dataObjectReference",
+	"dataStoreReference",
+	"group"
+]);
+//#endregion
+//#region ../notations/index.ts
+const NOTATIONS = [
+	{
+		id: "bpmn",
+		label: "BPMN 2.0",
+		noun: {
+			singular: "process",
+			plural: "processes"
+		},
+		extensions: [".bpmn"],
+		mediaKind: "xml",
+		docShape: "text",
+		monacoLanguage: "xml",
+		graphHints: {
+			flowEdgeKinds: ["sequenceFlow"],
+			entryNodeTypes: ["startEvent"]
+		}
+	},
+	{
+		id: "dmn",
+		label: "DMN",
+		noun: {
+			singular: "decision",
+			plural: "decisions"
+		},
+		extensions: [".dmn"],
+		mediaKind: "xml",
+		docShape: "text",
+		monacoLanguage: "xml",
+		graphHints: {
+			flowEdgeKinds: ["informationRequirement"],
+			entryNodeTypes: []
+		}
+	},
+	{
+		id: "wardley",
+		label: "Wardley Map",
+		noun: {
+			singular: "wardley map",
+			plural: "wardley maps"
+		},
+		extensions: [".owm", ".wmap"],
+		mediaKind: "dsl",
+		docShape: "text",
+		monacoLanguage: "plaintext",
+		graphHints: {
+			flowEdgeKinds: ["dependency"],
+			entryNodeTypes: []
+		}
+	},
+	{
+		id: "team-topology",
+		label: "Team Topology",
+		noun: {
+			singular: "team topology",
+			plural: "team topologies"
+		},
+		extensions: [".tt", ".ttm.json"],
+		mediaKind: "json",
+		docShape: "text",
+		monacoLanguage: "json"
+	},
+	{
+		id: "event-storming",
+		label: "Event Storming",
+		noun: {
+			singular: "event storming board",
+			plural: "event storming boards"
+		},
+		extensions: [".storm"],
+		mediaKind: "dsl",
+		docShape: "text",
+		monacoLanguage: "plaintext",
+		graphHints: {
+			flowEdgeKinds: ["arrow"],
+			entryNodeTypes: []
+		}
+	},
+	{
+		id: "context-map",
+		label: "Context Map",
+		noun: {
+			singular: "context map",
+			plural: "context maps"
+		},
+		extensions: [".cm.json"],
+		mediaKind: "json",
+		docShape: "text",
+		monacoLanguage: "json",
+		graphHints: {
+			flowEdgeKinds: [
+				"partnership",
+				"shared-kernel",
+				"customer-supplier",
+				"upstream-downstream",
+				"separate-ways"
+			],
+			entryNodeTypes: []
+		}
+	},
+	{
+		id: "value-chain",
+		label: "Value Chain",
+		noun: {
+			singular: "value chain",
+			plural: "value chains"
+		},
+		extensions: [".vc.json"],
+		mediaKind: "json",
+		docShape: "text",
+		monacoLanguage: "json"
+	},
+	{
+		id: "markdown",
+		label: "Markdown",
+		noun: {
+			singular: "document",
+			plural: "documents"
+		},
+		extensions: [".md"],
+		mediaKind: "markdown",
+		docShape: "text",
+		monacoLanguage: "markdown"
+	}
+];
+function byId(id) {
+	return NOTATIONS.find((n) => n.id === id);
+}
+/** longest-suffix winner across every registered extension, so ".vc.json"
+*  beats a hypothetical ".json" — shared by byExtension and modelStem */
+function longestMatch(path) {
+	let best;
+	for (const n of NOTATIONS) for (const ext of n.extensions) if (path.endsWith(ext) && ext.length > (best?.ext.length ?? 0)) best = {
+		notation: n,
+		ext
+	};
+	return best;
+}
+function byExtension(path) {
+	return longestMatch(path)?.notation;
+}
+/**
+* The file stem that IS a model's id (the content contract: a process is its
+* .bpmn file, a decision its .dmn file). Strips the FULL registered extension,
+* so compound suffixes resolve correctly ("a.vc.json" → "a", never "a.vc");
+* unknown extensions fall back to stripping the final dot-suffix.
+*/
+function modelStem(path) {
+	const base = path.split("/").pop() ?? path;
+	const ext = longestMatch(base)?.ext;
+	return ext ? base.slice(0, -ext.length) : base.replace(/\.[^.]+$/, "");
+}
+[...NOTATIONS.flatMap((n) => n.extensions)];
+//#endregion
+//#region ../notations/extract.ts
+/**
+* extract(raw) => ModelGraph — the analysis seam of the notation registry.
+*
+* Every notation knows how to turn its raw file content into ONE generic
+* graph shape. Analyses (MCP tools, future dashboards) are written against
+* ModelGraph and automatically cover every notation that implements extract —
+* instead of one parser per tool per notation.
+*
+* Node-safe: fast-xml-parser + JSON + regex only, no DOM, no editor libraries.
+*/
+const xml = new XMLParser({
+	ignoreAttributes: false,
+	attributeNamePrefix: "@_",
+	removeNSPrefix: true
+});
+/** the ONE fast-xml-parser configuration (the validator used to carry a
+*  byte-identical copy — that is how the two BPMN walks drifted) */
+const parseXml = (raw) => xml.parse(raw);
+const asArray = (v) => v === void 0 ? [] : Array.isArray(v) ? v : [v];
+/**
+* The decision a businessRuleTask delegates to. BPMN 2.0 has no standard
+* attribute for it, so every engine invented its own — all of them are read
+* here (namespace prefixes are already stripped by the parser):
+*
+*   decisionRef="x"                              Camunda 7
+*   <extensionElements><calledDecision decisionId="x"/>   Camunda 8 / Zeebe
+*   calledDecision="x" / calledElement="x"       hand-written models
+*
+* The platform contract is the same as for callActivity: the value names the
+* DECISION FILE STEM, so the link resolves against the repo's .dmn files.
+*
+* Exported as THE spelling list: the validator's link-integrity check must
+* read exactly what the platform follows, or a spelling becomes a link that
+* get_process reports and no check ever verifies (that drift shipped once).
+*/
+function decisionRefOf(task) {
+	const called = task.extensionElements?.calledDecision;
+	const fromExtension = asArray(called)[0]?.["@_decisionId"];
+	const ref = task["@_decisionRef"] ?? fromExtension ?? task["@_calledDecision"] ?? task["@_calledElement"] ?? void 0;
+	const text = ref === void 0 || ref === null ? "" : String(ref).trim();
+	return text === "" ? void 0 : text;
+}
+/** parse-tree in (parseXml(raw).definitions), the shared model out */
+function readBpmn(defs) {
+	const model = {
+		containers: [],
+		nodes: [],
+		flows: [],
+		diRequired: /* @__PURE__ */ new Set(),
+		lanes: [],
+		collaborations: []
+	};
+	const walk = (el, label, id, isSubProcess) => {
+		const container = {
+			label,
+			id,
+			isSubProcess,
+			triggeredByEvent: String(el["@_triggeredByEvent"]) === "true",
+			nodes: /* @__PURE__ */ new Map(),
+			flows: []
+		};
+		model.containers.push(container);
+		for (const [tag, value] of Object.entries(el)) {
+			if (tag.startsWith("@_")) continue;
+			if (tag === "sequenceFlow") {
+				for (const f of asArray(value)) {
+					const flow = {
+						id: f["@_id"] ?? "",
+						from: f["@_sourceRef"] ?? "",
+						to: f["@_targetRef"] ?? "",
+						name: f["@_name"]
+					};
+					container.flows.push(flow);
+					model.flows.push(flow);
+					if (f["@_id"]) model.diRequired.add(f["@_id"]);
+				}
+				continue;
+			}
+			if (BPMN_FLOW_NODE_TAGS.has(tag)) {
+				for (const node of asArray(value)) {
+					const rec = node;
+					const nodeId = rec["@_id"];
+					if (!nodeId) continue;
+					const decisionRef = tag === "businessRuleTask" ? decisionRefOf(node) : void 0;
+					const entry = {
+						id: nodeId,
+						tag,
+						name: rec["@_name"],
+						...rec["@_attachedToRef"] !== void 0 ? { attachedTo: rec["@_attachedToRef"] } : {},
+						...rec["@_calledElement"] !== void 0 ? { calledElement: rec["@_calledElement"] } : {},
+						...decisionRef ? { decisionRef } : {},
+						container
+					};
+					model.nodes.push(entry);
+					container.nodes.set(nodeId, entry);
+					model.diRequired.add(nodeId);
+					if (BPMN_SUB_CONTAINER_TAGS.has(tag)) walk(node, `${tag} ${nodeId}`, nodeId, true);
+				}
+				continue;
+			}
+			if (BPMN_DI_ARTIFACT_TAGS.has(tag)) {
+				for (const node of asArray(value)) if (node["@_id"]) model.diRequired.add(node["@_id"]);
+			}
+		}
+	};
+	let processIndex = 0;
+	for (const proc of asArray(defs.process)) {
+		const rec = proc;
+		const pid = rec["@_id"];
+		walk(proc, `process ${pid ?? "(anonymous)"}`, pid, false);
+		for (const lane of asArray(rec.laneSet?.lane)) model.lanes.push({
+			id: lane["@_id"],
+			name: lane["@_name"],
+			nodeIds: asArray(lane.flowNodeRef).map(String),
+			processIndex
+		});
+		processIndex++;
+	}
+	for (const collab of asArray(defs.collaboration)) {
+		const rec = collab;
+		model.collaborations.push({
+			pools: asArray(rec.participant).map((pl) => ({
+				id: pl["@_id"],
+				name: pl["@_name"],
+				processRef: pl["@_processRef"]
+			})),
+			messageFlows: asArray(rec.messageFlow).map((mf) => ({
+				id: mf["@_id"],
+				from: mf["@_sourceRef"],
+				to: mf["@_targetRef"],
+				name: mf["@_name"]
+			}))
+		});
+	}
+	return model;
+}
+function extractBpmn(raw) {
+	const model = readBpmn(parseXml(raw).definitions ?? {});
+	const nodes = model.nodes.map((n) => ({
+		id: n.id,
+		type: n.tag,
+		name: n.name,
+		extra: {
+			...n.container.isSubProcess && n.container.id ? { parent: n.container.id } : {},
+			...n.calledElement ? { calledElement: n.calledElement } : {},
+			...n.attachedTo ? { attachedTo: n.attachedTo } : {},
+			...n.decisionRef ? { decisionRef: n.decisionRef } : {}
+		}
+	}));
+	const edges = model.flows.map((f) => ({
+		id: f.id,
+		from: f.from,
+		to: f.to,
+		kind: "sequenceFlow",
+		name: f.name
+	}));
+	for (const collab of model.collaborations) for (const mf of collab.messageFlows) edges.push({
+		id: mf.id ?? "",
+		from: mf.from ?? "",
+		to: mf.to ?? "",
+		kind: "messageFlow",
+		name: mf.name
+	});
+	return {
+		notation: "bpmn",
+		nodes,
+		edges,
+		meta: {
+			lanes: model.lanes.map((l) => ({
+				id: l.id,
+				name: l.name,
+				nodeIds: l.nodeIds
+			})),
+			pools: model.collaborations.flatMap((c) => c.pools.map((pl) => ({
+				id: pl.id ?? "",
+				name: pl.name ?? "",
+				processRef: pl.processRef ?? ""
+			})))
+		}
+	};
+}
+/**
+* A tag's text content as a STRING. fast-xml-parser coerces tag values
+* ("42" → 42, "true" → true), but every DMN entry is FEEL SOURCE TEXT — a
+* rule entry `1` must stay the literal "1", never the number. Empty and
+* self-closing tags collapse to "" (an empty entry means "any" in DMN).
+*/
+function textOf(value) {
+	if (value === void 0 || value === null) return "";
+	if (typeof value === "object") return textOf(value["#text"]);
+	return String(value);
+}
+/**
+* The target of an informationRequirement — requiredInput/requiredDecision,
+* in that lookup order. THE spelling pair (it was byte-identical in the
+* validator, the decisionRefOf duplication class): `local` means same-file
+* ("#id"); a namespace-qualified href ("other.dmn#id") is NOT local — the
+* validator's dangling check skips it, and extractDmn currently passes it
+* through verbatim (known inconsistency vs analyze_decision, tracked in #86).
+*/
+function requirementHref(req) {
+	const href = req.requiredInput?.["@_href"] ?? req.requiredDecision?.["@_href"];
+	if (href === void 0) return void 0;
+	return {
+		href,
+		local: href.startsWith("#")
+	};
+}
+/**
+* DMN: decisions (with their full decision-table logic), input data and the
+* information requirements between them. The table detail rides in
+* node.extra — deriveDecision (derive.ts) turns it into the decision view,
+* and the simulator (@designiq/decisions) into its evaluation model, so this is
+* the ONE DMN parser on the server side.
+*/
+function extractDmn(raw) {
+	const defs = parseXml(raw).definitions ?? {};
+	const nodes = [];
+	const edges = [];
+	for (const input of asArray(defs.inputData)) nodes.push({
+		id: input["@_id"] ?? "",
+		type: "inputData",
+		name: input["@_name"] ?? "",
+		extra: {
+			variable: input.variable?.["@_name"] ?? input["@_name"] ?? "",
+			typeRef: input.variable?.["@_typeRef"] ?? "string"
+		}
+	});
+	for (const decision of asArray(defs.decision)) {
+		const table = decision.decisionTable;
+		const literal = decision.literalExpression;
+		nodes.push({
+			id: decision["@_id"],
+			type: "decision",
+			name: decision["@_name"],
+			extra: {
+				variable: decision.variable?.["@_name"] ?? decision["@_name"] ?? decision["@_id"],
+				typeRef: decision.variable?.["@_typeRef"] ?? "string",
+				...table ? {
+					kind: "decisionTable",
+					hitPolicy: table["@_hitPolicy"] ?? "UNIQUE",
+					...table["@_aggregation"] ? { aggregation: table["@_aggregation"] } : {},
+					inputs: asArray(table.input).map((i, n) => ({
+						id: i["@_id"] ?? `Input_${n + 1}`,
+						label: i["@_label"] ?? textOf(i.inputExpression?.text),
+						expression: textOf(i.inputExpression?.text),
+						typeRef: i.inputExpression?.["@_typeRef"] ?? "string",
+						inputValues: splitFeelList(textOf(i.inputValues?.text))
+					})),
+					outputs: asArray(table.output).map((o, n) => ({
+						id: o["@_id"] ?? `Output_${n + 1}`,
+						name: o["@_name"] ?? o["@_label"] ?? "",
+						label: o["@_label"] ?? o["@_name"] ?? "",
+						typeRef: o["@_typeRef"] ?? "string",
+						outputValues: splitFeelList(textOf(o.outputValues?.text))
+					})),
+					rules: asArray(table.rule).map((r, n) => ({
+						id: r["@_id"] ?? `Rule_${n + 1}`,
+						description: textOf(r.description) || void 0,
+						inputEntries: asArray(r.inputEntry).map((e) => textOf(e.text)),
+						outputEntries: asArray(r.outputEntry).map((e) => textOf(e.text))
+					}))
+				} : literal ? {
+					kind: "literalExpression",
+					expression: textOf(literal.text)
+				} : { kind: "none" }
+			}
+		});
+		for (const req of asArray(decision.informationRequirement)) {
+			const target = requirementHref(req);
+			if (target && target.href) edges.push({
+				id: req["@_id"] ?? `req-${edges.length}`,
+				from: target.href.replace(/^#/, ""),
+				to: decision["@_id"],
+				kind: "informationRequirement"
+			});
+		}
+	}
+	return {
+		notation: "dmn",
+		nodes,
+		edges,
+		meta: {
+			name: defs["@_name"] ?? null,
+			namespace: defs["@_namespace"] ?? null
+		}
+	};
+}
+/** `"a","b"` (a DMN inputValues/outputValues list) → the raw FEEL items */
+function splitFeelList(raw) {
+	const trimmed = raw.trim();
+	if (trimmed === "") return [];
+	return trimmed.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+}
+/** OWM DSL: `component Name [y, x]`, `Name -> Other`, `evolve Name x` */
+function extractWardley(raw) {
+	const nodes = [];
+	const edges = [];
+	for (const m of raw.matchAll(/^component\s+([^[\n]+?)\s*\[\s*([\d.]+)\s*,\s*([\d.]+)\s*\]/gm)) {
+		const evolution = Number(m[3]);
+		nodes.push({
+			id: m[1] ?? "",
+			type: "component",
+			name: m[1],
+			extra: {
+				visibility: Number(m[2]),
+				evolution,
+				stage: evolution < .25 ? "genesis" : evolution < .5 ? "custom-built" : evolution < .75 ? "product" : "commodity"
+			}
+		});
+	}
+	const directive = /^(title|component|anchor|market|note|annotation|annotations|style|evolution|submap|url|pipeline)\b/;
+	let i = 0;
+	for (const m of raw.matchAll(/^([^\s>[\n][^>[\n]*?)\s*->\s*([^\n;]+)$/gm)) {
+		if (directive.test(m[0] ?? "")) continue;
+		edges.push({
+			id: `dep-${i++}`,
+			from: m[1]?.trim() ?? "",
+			to: m[2]?.trim() ?? "",
+			kind: "dependency"
+		});
+	}
+	return {
+		notation: "wardley",
+		nodes,
+		edges
+	};
+}
+function extractTeamTopology(raw) {
+	const data = JSON.parse(raw);
+	return {
+		notation: "team-topology",
+		nodes: (data.nodes ?? []).map((n) => ({
+			id: n.id,
+			type: n.type ?? "team",
+			name: n.label ?? n.name,
+			extra: n.description ? { description: n.description } : void 0
+		})),
+		edges: (data.edges ?? []).map((e, i) => ({
+			id: e.id ?? `edge-${i}`,
+			from: e.source ?? e.from,
+			to: e.target ?? e.to,
+			kind: e.interaction ?? e.type ?? "interaction"
+		}))
+	};
+}
+const STORM_ID_PREFIX = {
+	event: "event",
+	command: "cmd",
+	actor: "actor",
+	aggregate: "agg",
+	policy: "policy",
+	readmodel: "read",
+	external: "ext",
+	hotspot: "hot"
+};
+/** stickies that can carry a pinned actor/hotspot/note — `(on <Host>)` */
+const STORM_HOST_KINDS = /* @__PURE__ */ new Set([
+	"event",
+	"command",
+	"aggregate",
+	"policy",
+	"readmodel",
+	"external"
+]);
+const STORM_ATTACHABLE_KINDS = /* @__PURE__ */ new Set([
+	"actor",
+	"hotspot",
+	"note"
+]);
+const STORM_COORDS = /\[\s*(-?[\d.]+)\s*,\s*(-?[\d.]+)\s*\]/;
+const STORM_POINTS = /\[\s*(\[[^[\]]*\](?:\s*,\s*\[[^[\]]*\])+)\s*\]/;
+const stormSlug = (label) => label.trim().toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_/, "").replace(/_$/, "") || "x";
+/** the `(on <Host>)` / `(id <id>)` / `(color <c>)` suffixes of a sticky line;
+*  `rest` is the text with EVERY parenthesised suffix removed (size/align are
+*  note layout — irrelevant to the graph) */
+function stormSuffixes(text) {
+	let host;
+	let rest = text;
+	const on = /\(\s*on\s+/i.exec(text);
+	if (on) {
+		const start = on.index + on[0].length;
+		const close = text.lastIndexOf(")");
+		if (close >= start && text.slice(start, close).trim()) {
+			host = text.slice(start, close).trim();
+			rest = `${text.slice(0, on.index)} ${text.slice(close + 1)}`;
+		}
+	}
+	const id = /\(\s*id\s+([A-Za-z0-9_-]+)\s*\)/i.exec(rest)?.[1];
+	const color = /\(\s*color\s+(#[0-9a-fA-F]{3,8}|[a-zA-Z][\w-]*)\s*\)/i.exec(rest)?.[1];
+	return {
+		host,
+		id,
+		color,
+		rest: rest.replace(/\([^)]*\)/g, " ")
+	};
+}
+function extractEventStorming(raw) {
+	const nodes = [];
+	const edges = [];
+	let title = null;
+	let level = null;
+	const used = /* @__PURE__ */ new Set();
+	const nameToId = /* @__PURE__ */ new Map();
+	const claim = (id) => {
+		if (!id || used.has(id)) return void 0;
+		used.add(id);
+		return id;
+	};
+	const alloc = (prefix, label) => {
+		const base = `${prefix}_${stormSlug(label)}`;
+		let id = base;
+		for (let i = 2; used.has(id); i++) id = `${base}_${i}`;
+		used.add(id);
+		return id;
+	};
+	const decode = (name) => name.replace(/\\n/g, "\n");
+	const arrows = [];
+	const pins = [];
+	for (const source of raw.replace(/\/\*[\s\S]*?\*\//g, " ").split(/\r?\n/)) {
+		const line = source.replace(/(?<!:)\/\/.*$/, "").trim();
+		if (!line) continue;
+		const kw = (/^[A-Za-z][\w-]*/.exec(line)?.[0] ?? "").toLowerCase();
+		const after = line.slice(kw.length).trim();
+		const semi = line.indexOf(";");
+		const core = (semi >= 0 ? line.slice(0, semi) : line).trim();
+		const arrowAt = core.indexOf("->");
+		if (arrowAt > 0 && !STORM_COORDS.test(core)) {
+			const from = core.slice(0, arrowAt).trim();
+			const to = core.slice(arrowAt + 2).trim();
+			if (from && to && (kw !== "title" || nameToId.has(decode(from)))) {
+				const label = semi >= 0 ? line.slice(semi + 1).trim() : "";
+				arrows.push({
+					from,
+					to,
+					...label ? { label } : {}
+				});
+				continue;
+			}
+		}
+		if (kw === "title") title = after;
+		else if (kw === "level") {
+			const value = after.toLowerCase();
+			if ([
+				"big-picture",
+				"process",
+				"design"
+			].includes(value)) level = value;
+		} else if (Object.hasOwn(STORM_ID_PREFIX, kw) || kw === "note") {
+			const at = STORM_COORDS.exec(after);
+			if (!at && after.includes("[")) continue;
+			const x = at ? Number(at[1]) : 0;
+			const y = at ? Number(at[2]) : 0;
+			if (Number.isNaN(x) || Number.isNaN(y)) continue;
+			const name = decode(at ? after.slice(0, at.index).trim() : stormSuffixes(after).rest.trim());
+			const { host, id: explicit, color } = stormSuffixes(at ? after.slice(at.index + at[0].length) : after);
+			if (kw !== "note" && !name) continue;
+			const id = kw === "note" ? alloc("note", name || "note") : claim(explicit) ?? alloc(STORM_ID_PREFIX[kw], name);
+			const node = {
+				id,
+				type: kw,
+				name,
+				extra: {
+					x,
+					y,
+					...color ? { color } : {}
+				}
+			};
+			nodes.push(node);
+			if (kw !== "note" && !nameToId.has(name)) nameToId.set(name, id);
+			if (host && STORM_ATTACHABLE_KINDS.has(kw)) pins.push({
+				node,
+				host
+			});
+		} else if (kw === "line") {
+			const points = STORM_POINTS.exec(after)?.[1];
+			const tuples = points ? [...points.matchAll(/\[\s*(-?[\d.]+)\s*,\s*(-?[\d.]+)\s*\]/g)] : [];
+			if (tuples.length < 2) continue;
+			nodes.push({
+				id: alloc("draw", "line"),
+				type: "drawing",
+				extra: {
+					x: Number(tuples[0][1]),
+					y: Number(tuples[0][2]),
+					points: tuples.length
+				}
+			});
+		}
+	}
+	const resolve = (token) => {
+		const id = token.startsWith("#") ? token.slice(1) : nameToId.get(decode(token));
+		return id === void 0 ? void 0 : nodes.find((n) => n.id === id);
+	};
+	for (const { node, host } of pins) {
+		const target = resolve(host);
+		if (target && STORM_HOST_KINDS.has(target.type)) node.extra = {
+			...node.extra,
+			attachedTo: target.id
+		};
+	}
+	let n = 0;
+	for (const arrow of arrows) {
+		const from = resolve(arrow.from);
+		const to = resolve(arrow.to);
+		if (!from || !to || !Object.hasOwn(STORM_ID_PREFIX, from.type) || !Object.hasOwn(STORM_ID_PREFIX, to.type)) continue;
+		let id = `arrow_${++n}`;
+		while (used.has(id)) id = `arrow_${++n}`;
+		edges.push({
+			id,
+			from: from.id,
+			to: to.id,
+			kind: "arrow",
+			name: arrow.label
+		});
+	}
+	return {
+		notation: "event-storming",
+		nodes,
+		edges,
+		meta: {
+			title,
+			level
+		}
+	};
+}
+const CM_SUBDOMAIN_TYPES$1 = /* @__PURE__ */ new Set([
+	"core",
+	"supporting",
+	"generic"
+]);
+function extractContextMap(raw) {
+	const parsed = JSON.parse(raw);
+	const data = parsed !== null && typeof parsed === "object" ? parsed : {};
+	const contexts = Array.isArray(data.contexts) ? data.contexts : [];
+	const relationships = Array.isArray(data.relationships) ? data.relationships : [];
+	const text = (v) => typeof v === "string" && v !== "" ? v : void 0;
+	const num = (v) => typeof v === "number" && Number.isFinite(v) ? v : void 0;
+	const roles = (v) => Array.isArray(v) ? v.filter((r) => typeof r === "string") : [];
+	const nodes = [];
+	for (const c of contexts) {
+		if (c === null || typeof c !== "object" || typeof c.id !== "string" || c.id === "") continue;
+		const subdomainType = text(c.subdomainType);
+		const team = text(c.team);
+		const description = text(c.description);
+		nodes.push({
+			id: c.id,
+			type: subdomainType && CM_SUBDOMAIN_TYPES$1.has(subdomainType) ? subdomainType : "context",
+			name: text(c.label),
+			extra: {
+				...team ? { team } : {},
+				...description ? { description } : {},
+				x: num(c.position?.x) ?? 0,
+				y: num(c.position?.y) ?? 0,
+				width: num(c.size?.width) ?? 0,
+				height: num(c.size?.height) ?? 0
+			}
+		});
+	}
+	const edges = [];
+	for (const [i, r] of relationships.entries()) {
+		if (r === null || typeof r !== "object") continue;
+		const upstreamRoles = roles(r.upstreamRoles);
+		const downstreamRoles = roles(r.downstreamRoles);
+		const implementationTechnology = text(r.implementationTechnology);
+		const description = text(r.description);
+		const extra = {
+			...upstreamRoles.length > 0 ? { upstreamRoles } : {},
+			...downstreamRoles.length > 0 ? { downstreamRoles } : {},
+			...implementationTechnology ? { implementationTechnology } : {},
+			...description ? { description } : {}
+		};
+		edges.push({
+			id: text(r.id) ?? `rel-${i}`,
+			from: text(r.from) ?? "",
+			to: text(r.to) ?? "",
+			kind: text(r.pattern) ?? "relationship",
+			name: text(r.label),
+			...Object.keys(extra).length > 0 ? { extra } : {}
+		});
+	}
+	return {
+		notation: "context-map",
+		nodes,
+		edges,
+		meta: { title: text(data.title) ?? null }
+	};
+}
+function extractValueChain(raw) {
+	const data = JSON.parse(raw);
+	return {
+		notation: "value-chain",
+		nodes: (data.elements ?? []).map((el) => ({
+			id: el.id,
+			type: el.elementType ?? "element",
+			name: el.label ?? el.name
+		})),
+		edges: (data.connections ?? []).map((c, i) => ({
+			id: c.id ?? `conn-${i}`,
+			from: c.source,
+			to: c.target,
+			kind: c.connectionType ?? "connection"
+		}))
+	};
+}
+const EXTRACTORS = {
+	bpmn: extractBpmn,
+	dmn: extractDmn,
+	wardley: extractWardley,
+	"team-topology": extractTeamTopology,
+	"event-storming": extractEventStorming,
+	"context-map": extractContextMap,
+	"value-chain": extractValueChain
+};
+/** notation id or file path in, ModelGraph out; undefined = no extractor registered */
+function extractModelGraph(notationOrPath, raw) {
+	const notation = byId(notationOrPath) ?? byExtension(notationOrPath);
+	const extractor = notation && EXTRACTORS[notation.id];
+	return extractor ? extractor(raw) : void 0;
+}
+//#endregion
+//#region ../notations/refs.ts
+const REF_EMITTERS = { bpmn: (graph) => {
+	const refs = [];
+	for (const n of graph.nodes) {
+		const calls = n.extra?.calledElement;
+		if (n.type === "callActivity" && typeof calls === "string" && calls) refs.push({
+			fromElement: n.id,
+			rel: "calls",
+			to: {
+				id: calls,
+				notation: "bpmn"
+			},
+			strength: "required"
+		});
+	}
+	for (const n of graph.nodes) {
+		const decides = n.extra?.decisionRef;
+		if (n.type === "businessRuleTask" && typeof decides === "string" && decides) refs.push({
+			fromElement: n.id,
+			rel: "decides",
+			to: {
+				id: decides,
+				notation: "dmn"
+			},
+			strength: "required"
+		});
+	}
+	return refs;
+} };
+/**
+* THE generic refs dispatch: every outgoing cross-model reference of the
+* graph; [] when the notation emits none. Registering a notation's emitter
+* here is the whole integration — resolver, index, validation and the
+* release PR section pick it up with zero consumer changes.
+*/
+function refsOf(graph) {
+	return REF_EMITTERS[graph.notation]?.(graph) ?? [];
+}
+/**
+* Every name the contract file is accepted under, in precedence order. The
+* second one is the legacy name and stays readable permanently: customer
+* repos, the starter template and every released image <= 4.2.0 carry it.
+*/
+const CONTENT_CONFIG_FILES = ["designiq.yml", "bpmiq.yml"];
+/**
+* The NAME of the contract file at `root`: the first of CONTENT_CONFIG_FILES
+* that exists. By existence ONLY — whether it parses is loadContentConfig's
+* business. A present-but-broken first choice must NOT fall through to the
+* next name: the file is plausibly mid-edit in a live session, and a fallback
+* would silently flip the room-containment folder to a different one.
+*/
+function resolveContentConfigFile(root) {
+	return CONTENT_CONFIG_FILES.find((name) => isContractFile(root, name));
+}
+/** a regular FILE of that name — a folder that merely carries a contract name
+*  (anyone may create one in a repo whose models live at the root) must not
+*  shadow the real contract file under the other name */
+function isContractFile(root, name) {
+	try {
+		return statSync(join(root, name)).isFile();
+	} catch {
+		return false;
+	}
+}
+`${CONTENT_CONFIG_FILES[1]}`;
+/**
+* The folder ONE contract file names — `models:`, the legacy `processes:` key
+* stays a full alias (existing repos remain valid unchanged). `undefined` for
+* an unreadable/unparseable/ill-typed file.
+*/
+function readContentFolder(root, name) {
+	let parsed;
+	try {
+		parsed = parse(readFileSync(join(root, name), "utf8"));
+	} catch {
+		return;
+	}
+	const raw = parsed;
+	const folder = raw?.models ?? raw?.processes;
+	if (typeof folder !== "string" || folder.trim().length === 0) return void 0;
+	const normalized = posix.normalize(folder.trim()).replace(/\/+$/, "");
+	if (normalized === "" || normalized === ".") return ".";
+	if (normalized.startsWith("/") || normalized.split("/").includes("..")) return void 0;
+	return normalized;
+}
+/**
+* Read + validate the root contract file (resolveContentConfigFile picks which
+* name). `undefined` means "not a content repo" — an unreadable/unparseable/
+* ill-typed config must degrade to that, never crash a listing (the file is
+* plausibly mid-edit in a live session).
+*/
+function loadContentConfig(root) {
+	const name = resolveContentConfigFile(root);
+	const folder = name === void 0 ? void 0 : readContentFolder(root, name);
+	return folder === void 0 ? void 0 : {
+		models: folder,
+		processes: folder
+	};
+}
+/**
+* Every file with a registered notation extension under the configured folder
+* (recursive, sorted by path). The id is the file stem (modelStem) so it stays
+* a single URL segment; ids are unique PER NOTATION (order.bpmn and order.dmn
+* are legal separate namespaces) — a second same-notation file with the same
+* stem elsewhere in the tree is skipped + logged rather than shadowing the
+* first.
+*/
+async function discoverModels(root, cfg) {
+	const dir = join(root, cfg.models);
+	let entries;
+	try {
+		entries = await readdir(dir, {
+			withFileTypes: true,
+			recursive: true
+		});
+	} catch {
+		return [];
+	}
+	const paths = entries.filter((e) => e.isFile()).map((e) => join(cfg.models, relative(dir, join(e.parentPath, e.name)))).filter((p) => !p.split("/").some((s) => s.startsWith(".") || s === "node_modules")).sort();
+	const out = [];
+	const seen = /* @__PURE__ */ new Map();
+	for (const path of paths) {
+		const notation = byExtension(path);
+		if (!notation) continue;
+		const id = modelStem(path);
+		const key = `${notation.id}/${id}`;
+		const first = seen.get(key);
+		if (first) {
+			console.log(`content: duplicate ${notation.id} id '${id}' (${path}) — keeping ${first}`);
+			continue;
+		}
+		seen.set(key, path);
+		out.push({
+			id,
+			path,
+			notation: notation.id
+		});
+	}
+	return out;
+}
+/**
+* Build the reference index of a checkout: discover every model, run its
+* extract + refs capabilities, resolve each reference against the discovered
+* artifacts. Degrades per file (an unreadable/broken model simply emits no
+* refs) — an index build must never fail a listing or a release.
+*/
+async function buildRepoIndex(root, cfg) {
+	const artifacts = await discoverModels(root, cfg);
+	const byKey = /* @__PURE__ */ new Map();
+	for (const a of artifacts) byKey.set(`${a.notation}/${a.id}`, a);
+	const byId = (id, notation) => notation ? byKey.get(`${notation}/${id}`) : artifacts.find((a) => a.id === id);
+	const refs = [];
+	for (const artifact of artifacts) {
+		let emitted;
+		try {
+			const raw = readFileSync(join(root, artifact.path), "utf8");
+			const graph = extractModelGraph(artifact.path, raw);
+			emitted = graph ? refsOf(graph) : [];
+		} catch {
+			continue;
+		}
+		for (const ref of emitted) refs.push({
+			from: {
+				path: artifact.path,
+				notation: artifact.notation,
+				...ref.fromElement ? { element: ref.fromElement } : {}
+			},
+			rel: ref.rel,
+			to: ref.to,
+			strength: ref.strength,
+			resolved: byId(ref.to.id, ref.to.notation)
+		});
+	}
+	return {
+		artifacts,
+		refs,
+		byId,
+		outgoing: (path) => refs.filter((r) => r.from.path === path),
+		incoming: (path) => refs.filter((r) => r.resolved?.path === path)
+	};
+}
+/** every .bpmn under the configured folder — a process IS its BPMN file */
+async function discoverProcesses(root, cfg) {
+	return (await discoverModels(root, cfg)).filter((m) => m.notation === "bpmn").map(({ id, path }) => ({
+		id,
+		path
+	}));
+}
+//#endregion
+//#region ../contracts/src/todo-anchor.ts
+const OPEN = "<!-- bpmiq:todo v1";
+const CLOSE = "-->";
+function parseAnchor(text) {
+	const start = text.indexOf(OPEN);
+	if (start === -1) return null;
+	const end = text.indexOf(CLOSE, start);
+	if (end === -1) return null;
+	const anchor = {
+		process: "",
+		file: null,
+		elements: [],
+		processVersion: null
+	};
+	for (const raw of text.slice(start + 18, end).split("\n")) {
+		const line = raw.trim();
+		const sep = line.indexOf(": ");
+		if (sep === -1) continue;
+		const key = line.slice(0, sep);
+		const value = line.slice(sep + 2).trim();
+		if (key === "process") anchor.process = value;
+		else if (key === "file") anchor.file = value;
+		else if (key === "version") anchor.processVersion = value;
+		else if (key === "element") {
+			const pipe = value.indexOf(" | ");
+			if (pipe === -1) anchor.elements.push({
+				id: value.replace(/ \|$/, "").trim(),
+				name: null
+			});
+			else anchor.elements.push({
+				id: value.slice(0, pipe).trim(),
+				name: value.slice(pipe + 3).trim() || null
+			});
+		}
+	}
+	return anchor.process ? anchor : null;
+}
+//#endregion
+//#region ../github-app/src/todos.ts
+/**
+* The GitHub-side todo vocabulary: labels and the issues-list row shape. This
+* is TRACKER vocabulary, not platform wire types — ports/issue-tracker.ts
+* deliberately assumes no numbers, labels or markdown (Jira has neither), so
+* this lives with the GitHub plumbing, not in @designiq/contracts. The body
+* MARKUP (anchor block, attribution line) stays adapter-owned per that port.
+*
+* Zero imports — the read-only MCP server can adopt this without pulling the
+* App/JWT half of the package into its published bundle.
+*/
+/** the label every platform-managed todo carries */
+const TODO_LABEL = "todo";
+/** the per-process label that makes the tracker-side filter cheap */
+const processLabel = (processId) => `process:${processId}`;
+/** the `labels=` filter for listing: every todo, or one process's */
+const todoLabelQuery = (processId) => processId ? `${TODO_LABEL},${processLabel(processId)}` : TODO_LABEL;
+const isPullRequestRow = (row) => row.pull_request !== void 0;
+//#endregion
+//#region ../mcp-kit/index.ts
+/** a successful tool result: strings pass through, everything else is
+*  pretty-printed JSON in the first text block */
+const ok = (value) => ({ content: [{
+	type: "text",
+	text: typeof value === "string" ? value : JSON.stringify(value, null, 2)
+}] });
+/** an errored tool result — `message` must be agent-actionable text */
+const fail = (message) => ({
+	content: [{
+		type: "text",
+		text: message
+	}],
+	isError: true
+});
+/**
+* Wrap a tool handler: thrown errors become `fail(...)` results. The prefix is
+* a deliberate per-server policy, not an accident of the old copies: the Live
+* Host passes none (its AppErrors carry actionable, agent-readable messages —
+* validation findings, conflict guidance, authz denials), the read-only server
+* marks everything unexpected.
+*/
+const safe$1 = (fn, opts = {}) => async (args) => {
+	try {
+		return await fn(args ?? {});
+	} catch (err) {
+		return fail(`${opts.prefix ?? ""}${err.message}`);
+	}
+};
+/** tool annotations: repo-local read */
+const READ = {
+	readOnlyHint: true,
+	openWorldHint: false
+};
+//#endregion
+//#region ../notations/derive.ts
+/**
+* The derive capability: ModelGraph → human/agent-readable views.
+*
+* deriveView(graph) is the GENERIC dispatch — one common core (name, summary,
+* stats, rich payload in `detail`) for every notation with a registered
+* deriver; consumers that want "a view of whatever this model is" (listings,
+* get_view) call it and never gate on the notation.
+*
+* deriveProcess(graph) => DerivedProcess is the rich BPMN view — the
+* "process.yaml on-the-fly": the slim content contract has NO hand-written
+* process metadata, so this turns the generic ModelGraph (extract.ts) into
+* name, roles (BPMN lanes), steps/events/gateways, flow and sub-process calls.
+* deriveDecision(graph) is its DMN sibling (decision table + DRD wiring).
+* Consumers that need those FIELDS keep calling them directly.
+*
+* Pure + browser-safe: operates on the already-parsed ModelGraph, no fs, no
+* XML — this module is imported eagerly by the web SPA
+* (CI: notations-index-and-derive-stay-browser-safe).
+*/
+/**
+* Derive the process view from a BPMN ModelGraph. Non-BPMN graphs yield an empty
+* process (only BPMN carries process semantics); callers gate on graph.notation.
+*/
+function deriveProcess(graph) {
+	const meta = graph.meta ?? {};
+	const lanes = meta.lanes ?? [];
+	const pools = (meta.pools ?? []).map((p) => ({
+		id: p.id,
+		name: p.name || null
+	}));
+	const roleOf = /* @__PURE__ */ new Map();
+	for (const lane of lanes) for (const nodeId of lane.nodeIds) roleOf.set(nodeId, lane.name ?? null);
+	const element = (n) => {
+		const calls = n.extra?.calledElement ?? void 0;
+		const decides = n.extra?.decisionRef ?? void 0;
+		return {
+			id: n.id,
+			name: n.name ?? null,
+			type: n.type,
+			...roleOf.has(n.id) ? { role: roleOf.get(n.id) ?? null } : {},
+			...calls ? { calls } : {},
+			...decides ? { decides } : {}
+		};
+	};
+	const steps = graph.nodes.filter((n) => kindOf(n.type) === "activity").map(element);
+	const events = graph.nodes.filter((n) => kindOf(n.type) === "event").map(element);
+	const gateways = graph.nodes.filter((n) => kindOf(n.type) === "gateway").map(element);
+	const flows = graph.edges.map((e) => ({
+		id: e.id,
+		from: e.from,
+		to: e.to,
+		name: e.name ?? null,
+		kind: e.kind
+	}));
+	const calls = graph.nodes.filter((n) => n.type === "callActivity" && n.extra?.calledElement).map((n) => ({
+		id: n.id,
+		name: n.name ?? null,
+		calledElement: String(n.extra?.calledElement)
+	}));
+	const decisions = graph.nodes.filter((n) => n.extra?.decisionRef).map((n) => ({
+		id: n.id,
+		name: n.name ?? null,
+		decisionRef: String(n.extra?.decisionRef)
+	}));
+	const roles = lanes.map((l) => ({
+		id: l.id,
+		name: l.name ?? null,
+		stepIds: l.nodeIds
+	}));
+	return {
+		name: pools.length === 1 ? pools[0]?.name || null : null,
+		pools,
+		roles,
+		steps,
+		events,
+		gateways,
+		flows,
+		calls,
+		decisions,
+		stats: {
+			steps: steps.length,
+			events: events.length,
+			gateways: gateways.length,
+			flows: flows.length,
+			roles: roles.length
+		}
+	};
+}
+const HIT_POLICIES = /* @__PURE__ */ new Set([
+	"UNIQUE",
+	"FIRST",
+	"ANY",
+	"PRIORITY",
+	"COLLECT",
+	"RULE ORDER",
+	"OUTPUT ORDER"
+]);
+const AGGREGATIONS = /* @__PURE__ */ new Set([
+	"SUM",
+	"MIN",
+	"MAX",
+	"COUNT"
+]);
+/**
+* Derive the decision view from a DMN ModelGraph. Non-DMN graphs yield an
+* empty decision (only DMN carries decision semantics); callers gate on
+* graph.notation, exactly like deriveProcess.
+*/
+function deriveDecision(graph) {
+	const meta = graph.meta ?? {};
+	const inputData = graph.nodes.filter((n) => n.type === "inputData").map((n) => ({
+		id: n.id,
+		name: n.name || null,
+		variable: String(n.extra?.variable ?? n.name ?? n.id),
+		typeRef: String(n.extra?.typeRef ?? "string")
+	}));
+	const inputDataIds = new Set(inputData.map((i) => i.id));
+	const decisions = graph.nodes.filter((n) => n.type === "decision").map((n) => {
+		const extra = n.extra ?? {};
+		const sources = graph.edges.filter((e) => e.kind === "informationRequirement" && e.to === n.id);
+		const hitPolicy = String(extra.hitPolicy ?? "");
+		const aggregation = String(extra.aggregation ?? "");
+		const rules = extra.rules ?? [];
+		return {
+			id: n.id,
+			name: n.name || null,
+			variable: String(extra.variable ?? n.name ?? n.id),
+			typeRef: String(extra.typeRef ?? "string"),
+			kind: extra.kind ?? "none",
+			...HIT_POLICIES.has(hitPolicy) ? { hitPolicy } : {},
+			...AGGREGATIONS.has(aggregation) ? { aggregation } : {},
+			inputs: (extra.inputs ?? []).map((i) => ({ ...i })),
+			outputs: (extra.outputs ?? []).map((o) => ({ ...o })),
+			rules: rules.map((r) => ({
+				id: String(r.id ?? ""),
+				when: r.inputEntries ?? [],
+				then: r.outputEntries ?? [],
+				...r.description ? { description: String(r.description) } : {}
+			})),
+			...extra.expression ? { expression: String(extra.expression) } : {},
+			requires: {
+				inputData: sources.filter((e) => inputDataIds.has(e.from)).map((e) => e.from),
+				decisions: sources.filter((e) => !inputDataIds.has(e.from)).map((e) => e.from)
+			}
+		};
+	});
+	return {
+		name: meta.name || null,
+		decisions,
+		inputData,
+		stats: {
+			decisions: decisions.length,
+			inputData: inputData.length,
+			rules: decisions.reduce((sum, d) => sum + d.rules.length, 0)
+		}
+	};
+}
+/** "3 steps, 1 gateway" — deterministic stats prose for the summary line */
+const counted = (stats) => Object.entries(stats).map(([k, v]) => `${v} ${v === 1 ? k.replace(/ies$/, "y").replace(/s$/, "") : k}`).join(", ");
+/** the sticky kinds of an event storming board — the nodes with a place on
+*  the timeline (notes and drawings are annotations). The .storm vocabulary,
+*  mirrored here so this eager module stays free of extract.ts values */
+const STORM_STICKY_KINDS = /* @__PURE__ */ new Set([
+	"event",
+	"command",
+	"actor",
+	"aggregate",
+	"policy",
+	"readmodel",
+	"external",
+	"hotspot"
+]);
+/** the board read the way a facilitator reads it — stickies left to right
+*  (x, then y, then id: the schema-model's own sortByTimeline rule) */
+function stormTimeline(graph) {
+	const pos = (n) => [Number(n.extra?.x ?? 0), Number(n.extra?.y ?? 0)];
+	return graph.nodes.filter((n) => STORM_STICKY_KINDS.has(n.type)).sort((a, b) => {
+		const [ax, ay] = pos(a);
+		const [bx, by] = pos(b);
+		return ax - bx || ay - by || (a.id < b.id ? -1 : a.id > b.id ? 1 : 0);
+	}).map((n) => ({
+		id: n.id,
+		type: n.type,
+		name: n.name ?? null
+	}));
+}
+/** the context-map vocabulary (@miragon/context-maps-schema-model
+*  SUBDOMAIN_TYPES / RELATIONSHIP_PATTERNS), in the notation's own order —
+*  mirrored here like the storm kinds so this eager module stays zero-dep */
+const CM_SUBDOMAIN_TYPES = [
+	"core",
+	"supporting",
+	"generic"
+];
+const CM_RELATIONSHIP_PATTERNS = [
+	"partnership",
+	"shared-kernel",
+	"customer-supplier",
+	"upstream-downstream",
+	"separate-ways"
+];
+const DERIVERS = {
+	bpmn: (graph) => {
+		const d = deriveProcess(graph);
+		return {
+			notation: "bpmn",
+			name: d.name,
+			summary: `Process with ${counted(d.stats)}`,
+			stats: { ...d.stats },
+			detail: d
+		};
+	},
+	dmn: (graph) => {
+		const d = deriveDecision(graph);
+		return {
+			notation: "dmn",
+			name: d.name,
+			summary: `Decision model with ${counted(d.stats)}`,
+			stats: { ...d.stats },
+			detail: d
+		};
+	},
+	wardley: (graph) => {
+		const stats = {
+			components: graph.nodes.length,
+			dependencies: graph.edges.length
+		};
+		return {
+			notation: "wardley",
+			name: null,
+			summary: `Wardley map with ${counted(stats)}`,
+			stats
+		};
+	},
+	"team-topology": (graph) => {
+		const stats = {
+			teams: graph.nodes.length,
+			interactions: graph.edges.length
+		};
+		return {
+			notation: "team-topology",
+			name: null,
+			summary: `Team topology with ${counted(stats)}`,
+			stats
+		};
+	},
+	"event-storming": (graph) => {
+		const count = (type) => graph.nodes.filter((n) => n.type === type).length;
+		const stats = {
+			events: count("event"),
+			commands: count("command"),
+			actors: count("actor"),
+			aggregates: count("aggregate"),
+			policies: count("policy"),
+			readmodels: count("readmodel"),
+			externals: count("external"),
+			hotspots: count("hotspot"),
+			notes: count("note"),
+			drawings: count("drawing"),
+			arrows: graph.edges.length
+		};
+		const present = Object.fromEntries(Object.entries(stats).filter(([, v]) => v > 0));
+		const title = graph.meta?.title;
+		return {
+			notation: "event-storming",
+			name: typeof title === "string" ? title : null,
+			summary: `Event storming board with ${Object.keys(present).length > 0 ? counted(present) : "no elements"}`,
+			stats,
+			detail: {
+				level: graph.meta?.level ?? null,
+				timeline: stormTimeline(graph)
+			}
+		};
+	},
+	"context-map": (graph) => {
+		const stats = {
+			contexts: graph.nodes.length,
+			relationships: graph.edges.length
+		};
+		for (const t of CM_SUBDOMAIN_TYPES) stats[t] = graph.nodes.filter((n) => n.type === t).length;
+		for (const p of CM_RELATIONSHIP_PATTERNS) stats[p] = graph.edges.filter((e) => e.kind === p).length;
+		const breakdown = (keys) => {
+			const present = keys.filter((k) => (stats[k] ?? 0) > 0).map((k) => `${stats[k]} ${k}`);
+			return present.length > 0 ? ` (${present.join(", ")})` : "";
+		};
+		const title = graph.meta?.title;
+		return {
+			notation: "context-map",
+			name: typeof title === "string" ? title : null,
+			summary: `Context map with ${counted({ contexts: stats.contexts })}${breakdown(CM_SUBDOMAIN_TYPES)}, ${counted({ relationships: stats.relationships })}${breakdown(CM_RELATIONSHIP_PATTERNS)}`,
+			stats,
+			detail: {
+				contexts: graph.nodes.map((n) => ({
+					id: n.id,
+					name: n.name ?? null,
+					subdomainType: CM_SUBDOMAIN_TYPES.includes(n.type) ? n.type : null,
+					team: n.extra?.team ?? null,
+					description: n.extra?.description ?? null
+				})),
+				relationships: graph.edges.map((e) => ({
+					id: e.id,
+					from: e.from,
+					to: e.to,
+					pattern: e.kind,
+					upstreamRoles: e.extra?.upstreamRoles ?? [],
+					downstreamRoles: e.extra?.downstreamRoles ?? [],
+					label: e.name ?? null,
+					implementationTechnology: e.extra?.implementationTechnology ?? null
+				}))
+			}
+		};
+	},
+	"value-chain": (graph) => {
+		const stats = {
+			elements: graph.nodes.length,
+			connections: graph.edges.length
+		};
+		return {
+			notation: "value-chain",
+			name: null,
+			summary: `Value chain with ${counted(stats)}`,
+			stats
+		};
+	}
+};
+/**
+* THE generic derive dispatch: the view of whatever notation `graph` carries;
+* `undefined` when no deriver is registered (the caller falls back to the
+* bare listing row). Registering a notation's deriver here is the whole
+* integration — no consumer changes.
+*/
+function deriveView(graph) {
+	return DERIVERS[graph.notation]?.(graph);
+}
+/** whether a notation has a registered deriver — lets tool copy and
+*  capability listings stay registry-driven instead of hand-enumerated */
+function hasDeriver(notation) {
+	return notation in DERIVERS;
+}
+//#endregion
+//#region tools.ts
+/**
+* designiq-mcp-server — tool definitions, shared by both transports:
+*   server.ts  → stdio (local: Claude Code picks it up via .mcp.json)
+*   http.ts    → Streamable HTTP (remote: fly.io, any MCP client via URL)
+*
+* Read-only by construction: only readFileSync + the content-repo discovery,
+* no write path. All tools carry readOnlyHint so clients may auto-approve them.
+* The one opt-in exception to "repo-local" is list_todos (registered ONLY when
+* DESIGNIQ_TODOS_REPO + DESIGNIQ_TODOS_TOKEN are set — also read under the
+* legacy BPM_TODOS_* names): a read-only GET against the content // legacy-name-ok
+* repo's issue tracker — the zero-auth default stays untouched.
+*
+* The content contract is minimal (@designiq/notations/content): a repo is a
+* content repo iff it has a root designiq.yml (legacy name: bpmiq.yml) naming // legacy-name-ok
+* its models folder; a process IS a .bpmn file there. There is NO hand-written
+* process.yaml — the process view (name, roles, steps, flow, sub-process calls)
+* is DERIVED from the BPMN on the fly (@designiq/notations/derive). A new
+* notation with an extractor is automatically analyzable here.
+*
+* Content root: pass --root <dir> (server.ts) or DESIGNIQ_CONTENT_ROOT (the
+* legacy BPM_CONTENT_ROOT is still read) — any content repo works, the bundled // legacy-name-ok
+* process-documentation is only the default.
+*/
+/** The content root the environment names — undefined when it names none. Read
+* under two names: DESIGNIQ_CONTENT_ROOT wins, BPM_CONTENT_ROOT keeps working. // legacy-name-ok
+* An EMPTY new name must not shadow a set old one (compose passes "" for an
+* unset variable). An empty value with nothing behind it stays what it always
+* was — "" (the cwd), NOT the bundled example — under either name, so swapping
+* one name for the other never moves the root. */
+function contentRootFromEnv(env) {
+	return env.DESIGNIQ_CONTENT_ROOT || (env.BPM_CONTENT_ROOT ?? env.DESIGNIQ_CONTENT_ROOT);
+}
+/** This file lives at packages/mcp/; the example content repo is process-documentation/. */
+const DEFAULT_ROOT = contentRootFromEnv(process.env) ?? join(dirname(fileURLToPath(import.meta.url)), "..", "..", "process-documentation");
+const readText = (path) => {
+	try {
+		return readFileSync(path, "utf8");
+	} catch {
+		return null;
+	}
+};
+const safe = (fn) => safe$1(fn, { prefix: "Unexpected error: " });
+/** every tool here is read-only and repo-local */
+const READ_ONLY = READ;
+/** what "flow" means in this graph's notation — undefined = no flow semantics */
+function flowKindsOf(graph) {
+	const kinds = byId(graph.notation)?.graphHints?.flowEdgeKinds;
+	return kinds && kinds.length > 0 ? kinds : void 0;
+}
+/** node -> outgoing flow-edge targets, per the notation's graphHints */
+function flowTargets(graph, kinds) {
+	const out = /* @__PURE__ */ new Map();
+	for (const e of graph.edges) {
+		if (!kinds.includes(e.kind)) continue;
+		(out.get(e.from) ?? out.set(e.from, []).get(e.from)).push(e.to);
+	}
+	return out;
+}
+/** all simple start→end paths through the notation's flow edges, cycle-cut, capped */
+function enumeratePaths(graph, kinds, max) {
+	const out = flowTargets(graph, kinds);
+	const label = new Map(graph.nodes.map((n) => [n.id, n.name ? `${n.name} (${n.type})` : `${n.id} (${n.type})`]));
+	const entryTypes = byId(graph.notation)?.graphHints?.entryNodeTypes ?? [];
+	const hasIncoming = new Set([...out.values()].flat());
+	const starts = entryTypes.length > 0 ? graph.nodes.filter((n) => entryTypes.includes(n.type) && !n.extra?.parent) : graph.nodes.filter((n) => !hasIncoming.has(n.id) && (out.get(n.id)?.length ?? 0) > 0);
+	const paths = [];
+	let truncated = false;
+	const walk = (node, seen, path) => {
+		if (paths.length >= max) {
+			truncated = true;
+			return;
+		}
+		const next = out.get(node) ?? [];
+		if (next.length === 0) {
+			paths.push(path);
+			return;
+		}
+		for (const target of next) {
+			if (seen.has(target)) continue;
+			walk(target, new Set(seen).add(target), [...path, label.get(target) ?? target]);
+		}
+	};
+	for (const s of starts) walk(s.id, /* @__PURE__ */ new Set([s.id]), [label.get(s.id) ?? s.id]);
+	return {
+		paths,
+		truncated
+	};
+}
+/** cycles over the notation's flow edges (DFS back-edge detection) */
+function findCycles(graph, kinds) {
+	const out = flowTargets(graph, kinds);
+	const label = new Map(graph.nodes.map((n) => [n.id, n.name ?? n.id]));
+	const cycles = [];
+	const seenCycles = /* @__PURE__ */ new Set();
+	const visit = (node, stack) => {
+		const at = stack.indexOf(node);
+		if (at >= 0) {
+			const cycle = stack.slice(at);
+			const key = [...cycle].sort().join("|");
+			if (!seenCycles.has(key)) {
+				seenCycles.add(key);
+				cycles.push([...cycle, node].map((id) => label.get(id) ?? id));
+			}
+			return;
+		}
+		for (const next of out.get(node) ?? []) visit(next, [...stack, node]);
+	};
+	for (const n of graph.nodes) visit(n.id, []);
+	return cycles;
+}
+/** The list_todos gate, used by BOTH entry points (server.ts, http.ts — the
+* composition roots read env, this module doesn't): undefined unless BOTH a
+* tracker repo (DESIGNIQ_TODOS_REPO) and a token (DESIGNIQ_TODOS_TOKEN) are
+* set — the server stays zero-auth by default, the tool simply does not exist
+* without the opt-in.
+*
+* Each of the two is also read under its legacy BPM_TODOS_* name (the new name // legacy-name-ok
+* wins) and resolved on its own: a half-migrated environment (repo under one
+* name, token under the other) still opts in rather than silently losing the
+* tool. Empty counts as unset (compose passes "" for an unset variable), so an
+* empty new name never shadows a set old one. */
+function todosConfigFromEnv(env) {
+	const repo = env.DESIGNIQ_TODOS_REPO || env.BPM_TODOS_REPO;
+	const token = env.DESIGNIQ_TODOS_TOKEN || env.BPM_TODOS_TOKEN;
+	return repo && token ? {
+		repo,
+		token,
+		apiUrl: env.GITHUB_API_URL
+	} : void 0;
+}
+/** Build a fully configured, read-only MCP server over the repo at `root`. */
+function createMcpServer(root = DEFAULT_ROOT, todos, contributions = []) {
+	const config = () => loadContentConfig(root);
+	const processes = async () => {
+		const cfg = config();
+		return cfg ? discoverProcesses(root, cfg) : [];
+	};
+	const findProcess = async (id) => (await processes()).find((p) => p.id === id) ?? null;
+	/** any-notation lookup; a stem shared across notations resolves bpmn-first
+	*  (back-compat: process ids keep meaning what they always meant) */
+	const findModel = async (id, notation) => {
+		const cfg = config();
+		if (!cfg) return null;
+		const matches = (await discoverModels(root, cfg)).filter((m) => m.id === id && (!notation || m.notation === notation));
+		return matches.find((m) => m.notation === "bpmn") ?? matches[0] ?? null;
+	};
+	const unknownModel = async (id, notation) => {
+		const cfg = config();
+		const listed = (cfg ? await discoverModels(root, cfg) : []).filter((m) => !notation || m.notation === notation).map((m) => `${m.id} (${m.notation})`).join(", ") || "(none)";
+		const what = notation ? byId(notation)?.noun.singular ?? notation : "model";
+		return fail(`Unknown ${what} '${id}'. Available: ${listed}.`);
+	};
+	/** parse a discovered process's .bpmn into a ModelGraph, or a failure result */
+	const graphOf = (proc) => {
+		const raw = readText(join(root, proc.path));
+		if (raw === null) return fail(`No such model file: ${proc.path}.`);
+		const graph = extractModelGraph(proc.path, raw);
+		if (!graph) return fail(`No extractor for '${proc.path}'.`);
+		return graph;
+	};
+	const isGraph = (g) => !("content" in g);
+	/** the registry nouns for user-facing copy ("wardley map" / "team topologies") */
+	const nounOf = (notation) => byId(notation)?.noun.singular ?? notation;
+	const pluralOf = (notation) => byId(notation)?.noun.plural ?? notation;
+	const notAContentRepo = () => fail(`No usable designiq.yml (or legacy bpmiq.yml) at the content root — not a content repo. Expected a root designiq.yml naming the models folder.`);
+	const unknownProcess = async (id) => fail(`Unknown process '${id}'. Available: ${(await processes()).map((p) => p.id).join(", ") || "(none)"}.`);
+	const server = new McpServer({
+		name: "designiq-mcp",
+		version: "0.2.0"
+	});
+	server.registerTool("list_models", {
+		description: "List EVERY model file of the repository, grouped by notation (bpmn, dmn, wardley, team-topology, …) — the registry-wide superset of list_processes. Each row: id (file stem), path, and — for notations with a registered deriver — the model's own name, summary and stats. Use to see which notations a repo contains before reaching for the notation-specific tools.",
+		annotations: READ_ONLY
+	}, safe(async () => {
+		const cfg = config();
+		if (!cfg) return notAContentRepo();
+		const models = await discoverModels(root, cfg);
+		if (models.length === 0) return ok("No model files found under the configured models folder.");
+		const grouped = {};
+		for (const m of models) {
+			let view;
+			try {
+				const raw = readText(join(root, m.path));
+				const graph = raw === null ? void 0 : extractModelGraph(m.path, raw);
+				view = graph ? deriveView(graph) : void 0;
+			} catch {
+				view = void 0;
+			}
+			(grouped[m.notation] ??= []).push({
+				id: m.id,
+				path: m.path,
+				...view?.name ? { name: view.name } : {},
+				...view ? {
+					summary: view.summary,
+					stats: view.stats
+				} : {}
+			});
+		}
+		return ok({ models: grouped });
+	}));
+	server.registerTool("list_processes", {
+		description: "List all modeled business processes — every .bpmn file under the repo's designiq.yml models folder. Each row: id (file name without extension), derived name, the file path, and a count of steps/events/gateways/roles. Use to get a portfolio overview or to find a process id before calling get_process, get_model, who_owns or enumerate_paths.",
+		annotations: READ_ONLY
+	}, safe(async () => {
+		if (!config()) return notAContentRepo();
+		const procs = await processes();
+		if (procs.length === 0) return ok("No processes found — no .bpmn files under the configured processes folder.");
+		return ok(procs.map((p) => {
+			const graph = graphOf(p);
+			if (!isGraph(graph)) return {
+				id: p.id,
+				path: p.path,
+				error: "could not parse BPMN"
+			};
+			const d = deriveProcess(graph);
+			return {
+				id: p.id,
+				name: d.name ?? p.id,
+				path: p.path,
+				...d.stats
+			};
+		}));
+	}));
+	server.registerTool("get_process", {
+		description: "Get one process in full: the process view DERIVED from its BPMN — name, roles (BPMN lanes = owning teams), steps (activities with their role), events, gateways, the sequence/message flow, and the sub-processes it calls (callActivity → calledElement). Use for walkthroughs and any deep question about a single process.",
+		inputSchema: z.object({ id: z.string().describe("Process id = the .bpmn file name without extension, e.g. order-to-cash") }),
+		annotations: READ_ONLY
+	}, safe(async ({ id }) => {
+		if (!config()) return notAContentRepo();
+		const proc = await findProcess(id);
+		if (!proc) return unknownProcess(id);
+		const graph = graphOf(proc);
+		if (!isGraph(graph)) return graph;
+		return ok({
+			id: proc.id,
+			path: proc.path,
+			...deriveProcess(graph)
+		});
+	}));
+	server.registerTool("get_model", {
+		description: "Parse ANY model file into its generic graph: nodes (id, type, name), edges and meta — BPMN flows and lanes, DMN requirements, Wardley components/dependencies, … Use to see the raw structure, or to ground any 'how does X work' answer in the actual model.",
+		inputSchema: z.object({
+			id: z.string().describe("Model id = file stem (from list_models), e.g. order-to-cash"),
+			notation: z.string().optional().describe("registry notation id — disambiguates a stem shared across notations")
+		}),
+		annotations: READ_ONLY
+	}, safe(async ({ id, notation }) => {
+		if (!config()) return notAContentRepo();
+		const m = await findModel(id, notation);
+		if (!m) return unknownModel(id, notation);
+		const graph = graphOf(m);
+		return isGraph(graph) ? ok({
+			id: m.id,
+			file: m.path,
+			...graph
+		}) : graph;
+	}));
+	server.registerTool("get_view", {
+		description: `The derived view of ANY model — its own name, a one-line summary, stats, and the rich notation payload in \`detail\` where one exists (process view, decision tables, …). The notation-agnostic sibling of get_process: works for every notation with extract+derive capabilities (${NOTATIONS.filter((n) => hasDeriver(n.id)).map((n) => n.id).join(", ")}).`,
+		inputSchema: z.object({
+			id: z.string().describe("Model id = file stem (from list_models), e.g. tea-shop"),
+			notation: z.string().optional().describe("registry notation id — disambiguates a stem shared across notations")
+		}),
+		annotations: READ_ONLY
+	}, safe(async ({ id, notation }) => {
+		if (!config()) return notAContentRepo();
+		const m = await findModel(id, notation);
+		if (!m) return unknownModel(id, notation);
+		const graph = graphOf(m);
+		if (!isGraph(graph)) return graph;
+		const view = deriveView(graph);
+		if (!view) return fail(`a ${nounOf(m.notation)} has no registered deriver — get_view needs the derive capability.`);
+		return ok({
+			id: m.id,
+			path: m.path,
+			...view
+		});
+	}));
+	server.registerTool("enumerate_paths", {
+		description: "Enumerate the possible start→end paths through a model's flow (cycle-safe, capped) — BPMN sequence flows, Wardley dependencies, … per the notation's graph hints. Each path is the ordered list of element names. Use for walkthroughs ('what are the ways an order can go?'), test-case derivation, and spotting unexpected shortcuts or dead branches.",
+		inputSchema: z.object({
+			id: z.string().describe("Model id = file stem, e.g. order-to-cash"),
+			notation: z.string().optional().describe("registry notation id — disambiguates a stem shared across notations"),
+			max: z.number().int().min(1).max(100).optional().describe("Maximum number of paths to return (default 20)")
+		}),
+		annotations: READ_ONLY
+	}, safe(async ({ id, notation, max }) => {
+		if (!config()) return notAContentRepo();
+		const m = await findModel(id, notation);
+		if (!m) return unknownModel(id, notation);
+		const graph = graphOf(m);
+		if (!isGraph(graph)) return graph;
+		const kinds = flowKindsOf(graph);
+		if (!kinds) return ok(`${pluralOf(m.notation)} have no flow semantics (no graphHints) — nothing to enumerate.`);
+		const { paths, truncated } = enumeratePaths(graph, kinds, max ?? 20);
+		return ok({
+			id: m.id,
+			pathCount: paths.length,
+			truncated,
+			paths,
+			...paths.length === 0 ? { note: "no start→end chains over the notation's flow edges — isolated or cyclic-only elements are not paths" } : {}
+		});
+	}));
+	server.registerTool("find_cycles", {
+		description: "Detect cycles (loops) in a model's flow — BPMN rework/retry loops, circular Wardley dependencies, circular DMN requirements — per the notation's graph hints. Returns each cycle as the ordered list of element names. Use when analyzing complexity, rework cost, or 'why does this case never finish'.",
+		inputSchema: z.object({
+			id: z.string().describe("Model id = file stem, e.g. order-to-cash"),
+			notation: z.string().optional().describe("registry notation id — disambiguates a stem shared across notations")
+		}),
+		annotations: READ_ONLY
+	}, safe(async ({ id, notation }) => {
+		if (!config()) return notAContentRepo();
+		const m = await findModel(id, notation);
+		if (!m) return unknownModel(id, notation);
+		const graph = graphOf(m);
+		if (!isGraph(graph)) return graph;
+		const kinds = flowKindsOf(graph);
+		if (!kinds) return ok(`${pluralOf(m.notation)} have no flow semantics (no graphHints) — nothing to check.`);
+		const cycles = findCycles(graph, kinds);
+		return ok(cycles.length === 0 ? `No cycles in ${m.id}'s flow.` : {
+			id: m.id,
+			cycles
+		});
+	}));
+	server.registerTool("who_owns", {
+		description: "Resolve ownership of a process from its BPMN lanes — the roles/teams that own its steps (each lane, with the steps it contains) plus the pools (participants). Use for 'who owns X', 'who does what in X', or handoff questions. Note: on the slim contract ownership is whatever the model's lanes say; a process with no lanes has no modeled owner.",
+		inputSchema: z.object({ id: z.string().describe("Process id, e.g. order-to-cash") }),
+		annotations: READ_ONLY
+	}, safe(async ({ id }) => {
+		if (!config()) return notAContentRepo();
+		const proc = await findProcess(id);
+		if (!proc) return unknownProcess(id);
+		const graph = graphOf(proc);
+		if (!isGraph(graph)) return graph;
+		const d = deriveProcess(graph);
+		if (d.roles.length === 0 && d.pools.length === 0) return ok(`Process '${proc.id}' has no lanes or pools — no owning team is modeled in the BPMN.`);
+		const byId = new Map(graph.nodes.map((n) => [n.id, n.name ?? n.id]));
+		return ok({
+			id: proc.id,
+			pools: d.pools,
+			roles: d.roles.map((r) => ({
+				role: r.name,
+				steps: r.stepIds.map((s) => byId.get(s) ?? s)
+			}))
+		});
+	}));
+	server.registerTool("which_processes_use", {
+		description: "Impact analysis across the portfolio: find processes whose id, derived name, role/lane names, step names, or sub-process calls (calledElement) match a query — case-insensitive substring. Use for 'what calls invoice-handling', 'which processes have a Billing lane', 'what touches the credit check'.",
+		inputSchema: z.object({ query: z.string().describe("Case-insensitive substring, e.g. 'invoice-handling', 'Billing', 'credit'") }),
+		annotations: READ_ONLY
+	}, safe(async ({ query }) => {
+		if (!config()) return notAContentRepo();
+		const q = query.toLowerCase();
+		const procs = await processes();
+		const hits = [];
+		for (const proc of procs) {
+			const graph = graphOf(proc);
+			if (!isGraph(graph)) continue;
+			const d = deriveProcess(graph);
+			const matches = [];
+			const check = (field, value) => {
+				if (typeof value === "string" && value.toLowerCase().includes(q)) matches.push({
+					field,
+					value
+				});
+			};
+			check("id", proc.id);
+			check("name", d.name);
+			for (const r of d.roles) check("role", r.name);
+			for (const s of d.steps) check("step", s.name);
+			for (const c of d.calls) check("calls", c.calledElement);
+			if (matches.length > 0) hits.push({
+				id: proc.id,
+				name: d.name ?? proc.id,
+				matches
+			});
+		}
+		if (hits.length === 0) return ok(`No process references '${query}' in its id, name, roles, steps or sub-process calls (checked ${procs.length} process(es)).`);
+		return ok(hits);
+	}));
+	server.registerTool("which_models_use", {
+		description: "Reference-level impact analysis across EVERY notation: all models whose typed cross-model references (callActivity calls, businessRuleTask decides, …) point at the given model id (file stem, exact match) — the repo-wide reference index behind it also flags dangling references. The registry-wide sibling of which_processes_use; use for 'what breaks if I change or delete this model?'.",
+		inputSchema: z.object({ id: z.string().describe("Target model id = file stem (from list_models), e.g. 'credit-check'") }),
+		annotations: READ_ONLY
+	}, safe(async ({ id }) => {
+		const cfg = config();
+		if (!cfg) return notAContentRepo();
+		const index = await buildRepoIndex(root, cfg);
+		const hits = index.refs.filter((r) => r.to.id === id).map((r) => ({
+			from: r.from.path,
+			notation: r.from.notation,
+			...r.from.element ? { element: r.from.element } : {},
+			rel: r.rel,
+			resolved: r.resolved !== void 0
+		}));
+		if (hits.length === 0) return ok(`No model references '${id}' (checked ${index.refs.length} reference(s) across the repo).`);
+		return ok({
+			target: id,
+			referencedBy: hits
+		});
+	}));
+	if (todos) {
+		const { repo: todosRepo, token: todosToken } = todos;
+		const api = (todos.apiUrl ?? "https://api.github.com").replace(/\/$/, "");
+		server.registerTool("list_todos", {
+			description: "List the OPEN model-anchored todos of this content repo — work items filed from the live model into the repo's issue tracker (label 'todo'). Each row carries the tracker id and URL, title, assignees, createdAt and the parsed anchor (process, model file, anchored BPMN elements). Optional filter on one process. Use for 'what is open on process X' or to cross-check a model answer against known open discrepancies.",
+			inputSchema: z.object({ process: z.string().optional().describe("Only todos anchored to this process id, e.g. order-to-cash") }),
+			annotations: {
+				readOnlyHint: true,
+				openWorldHint: true
+			}
+		}, safe(async ({ process: processId }) => {
+			const res = await fetch(`${api}/repos/${todosRepo}/issues?state=open&labels=${encodeURIComponent(todoLabelQuery(processId))}&per_page=100`, { headers: {
+				accept: "application/vnd.github+json",
+				authorization: `Bearer ${todosToken}`,
+				"user-agent": "designiq-mcp"
+			} });
+			if (!res.ok) return fail(`Tracker query on ${todosRepo} failed: ${res.status} ${await res.text()}`);
+			const todos = (await res.json()).filter((row) => !isPullRequestRow(row)).map((row) => ({
+				id: String(row.number),
+				url: row.html_url,
+				title: row.title,
+				anchor: parseAnchor(row.body ?? ""),
+				assignees: (row.assignees ?? []).map((a) => a.login),
+				createdAt: row.created_at
+			}));
+			if (todos.length === 0) return ok(`No open todos${processId ? ` for process '${processId}'` : ""} in ${todosRepo}.`);
+			return ok(todos);
+		}));
+	}
+	for (const contribute of contributions) contribute(server, root);
+	return server;
+}
+//#endregion
+export { createMcpServer as n, todosConfigFromEnv as r, DEFAULT_ROOT as t };