@software-dlc/cli 0.157.2

package/dist/mcp/graph-to-code.js

@@ -0,0 +1,1624 @@
+// The Graph-to-Code reads leave Variant Set nodes out for a client that does not offer their
+// version (graph-variants C1). Tool results go to an agent as JSON text, which reads any node
+// type, so every such request offers version 1, as graph-schema's graphVariantSetVersionsQuery().
+const GRAPH_VARIANT_SET_VERSIONS_QUERY = 'graph_variant_set_versions=1';
+const MCP_PROTOCOL_VERSION = '2025-06-18';
+export const MAX_HOSTED_GRAPH_TO_CODE_MCP_REQUEST_BYTES = 64 * 1024;
+const MCP_RESPONSE_HEADERS = {
+    'Content-Type': 'application/json',
+    'MCP-Protocol-Version': MCP_PROTOCOL_VERSION
+};
+export class HostedMcpRequestTooLargeError extends Error {
+}
+export async function readHostedGraphToCodeMcpRequestBody(request) {
+    const declared_length = request.headers.get('content-length');
+    if (declared_length !== null &&
+        (!/^\d+$/.test(declared_length) ||
+            Number(declared_length) > MAX_HOSTED_GRAPH_TO_CODE_MCP_REQUEST_BYTES)) {
+        throw new HostedMcpRequestTooLargeError();
+    }
+    if (!request.body)
+        return new Uint8Array();
+    const reader = request.body.getReader();
+    const chunks = [];
+    let byte_length = 0;
+    while (true) {
+        const result = await reader.read();
+        if (result.done)
+            break;
+        byte_length += result.value.byteLength;
+        if (byte_length > MAX_HOSTED_GRAPH_TO_CODE_MCP_REQUEST_BYTES) {
+            await reader.cancel();
+            throw new HostedMcpRequestTooLargeError();
+        }
+        chunks.push(result.value);
+    }
+    const bytes = new Uint8Array(byte_length);
+    let offset = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return bytes;
+}
+export function buildHostedGraphToCodeMcpRequestTooLargeResponse() {
+    return Response.json({
+        jsonrpc: '2.0',
+        id: null,
+        error: {
+            code: -32005,
+            message: 'MCP request body exceeds the 64 KiB byte budget.'
+        }
+    }, {
+        status: 413,
+        headers: MCP_RESPONSE_HEADERS
+    });
+}
+const graph_to_code_target_schema = {
+    type: 'object',
+    additionalProperties: false,
+    properties: {
+        branch_id: {
+            type: 'string',
+            format: 'uuid',
+            description: 'Pull or search the current graph for this branch.'
+        },
+        pull_request_id: {
+            type: 'string',
+            format: 'uuid',
+            description: 'Pull or search the pull request source graph and include active diff/session metadata.'
+        },
+        commit_id: {
+            type: 'string',
+            format: 'uuid',
+            description: 'Pull or search an immutable commit graph snapshot.'
+        },
+        worktree_id: {
+            type: 'string',
+            format: 'uuid',
+            description: 'Read an exact provisional AI worktree proposal.'
+        },
+        worktree_revision: {
+            type: 'integer',
+            minimum: 0,
+            description: 'Required exact revision for a worktree target.'
+        },
+        worktree_root_hash: {
+            type: 'string',
+            pattern: '^sha256:[0-9a-f]{64}$',
+            description: 'Required exact sync root hash for a worktree target.'
+        }
+    },
+    description: 'Provide exactly one target id. If omitted, the MCP wrapper uses exactly one configured SDLC_BRANCH_ID, SDLC_PULL_REQUEST_ID, or SDLC_COMMIT_ID.'
+};
+const sdlc_compare_graph_subgraphs_input_schema = {
+    type: 'object',
+    additionalProperties: false,
+    required: ['target', 'source', 'seed_entity_ids'],
+    properties: {
+        target: graph_to_code_target_schema,
+        source: graph_to_code_target_schema,
+        seed_entity_ids: {
+            type: 'array',
+            minItems: 1,
+            maxItems: 24,
+            items: { type: 'string', minLength: 1, maxLength: 200 }
+        },
+        projection: {
+            type: 'object',
+            additionalProperties: false,
+            properties: {
+                connection_hops: { type: 'integer', minimum: 0, maximum: 3 },
+                connection_direction: {
+                    type: 'string',
+                    enum: ['incoming', 'outgoing', 'both']
+                },
+                descendants: { type: 'string', enum: ['none', 'direct', 'all'] },
+                include_intersecting_paths: { type: 'boolean' },
+                related_path_hops: { type: 'integer', minimum: 0, maximum: 1 },
+                include_internal_edges: { type: 'boolean' }
+            }
+        },
+        max_nodes: { type: 'integer', minimum: 1, maximum: 240 },
+        max_edges: { type: 'integer', minimum: 0, maximum: 480 },
+        max_paths: { type: 'integer', minimum: 0, maximum: 240 },
+        max_path_relations: { type: 'integer', minimum: 0, maximum: 240 }
+    }
+};
+const graph_aggregate_comparison_source_schema = {
+    type: 'object',
+    additionalProperties: false,
+    required: [
+        'organization_id',
+        'project_id',
+        'source_kind',
+        'source_id',
+        'semantic_revision',
+        'semantic_root_hash',
+        'presentation_revision'
+    ],
+    properties: {
+        organization_id: { type: 'string', minLength: 1 },
+        project_id: { type: 'string', minLength: 1 },
+        source_kind: {
+            type: 'string',
+            enum: ['branch', 'commit', 'snapshot', 'worktree']
+        },
+        source_id: { type: 'string', minLength: 1 },
+        semantic_revision: { type: 'string', minLength: 1 },
+        semantic_root_hash: {
+            type: 'string',
+            pattern: '^sha256:[0-9a-f]{64}$'
+        },
+        presentation_revision: { type: 'string', minLength: 1 }
+    }
+};
+const graph_scope_recipe_input_schema = {
+    type: 'object',
+    additionalProperties: false,
+    required: ['schema_version', 'selectors'],
+    properties: {
+        schema_version: { type: 'integer', const: 1 },
+        selectors: {
+            type: 'object',
+            additionalProperties: false,
+            properties: {
+                path_ids: { type: 'array', items: { type: 'string' } },
+                path_tree_root_ids: { type: 'array', items: { type: 'string' } },
+                node_ids: { type: 'array', items: { type: 'string' } },
+                edge_ids: { type: 'array', items: { type: 'string' } }
+            }
+        }
+    }
+};
+const sdlc_compare_path_aggregates_input_schema = {
+    type: 'object',
+    additionalProperties: false,
+    required: [
+        'schema_version',
+        'algorithm_version',
+        'target',
+        'source',
+        'merge_base',
+        'max_paths',
+        'max_response_bytes',
+        'page_cursor'
+    ],
+    properties: {
+        schema_version: { type: 'integer', const: 1 },
+        algorithm_version: { type: 'integer', const: 1 },
+        target: graph_aggregate_comparison_source_schema,
+        source: graph_aggregate_comparison_source_schema,
+        merge_base: {
+            anyOf: [graph_aggregate_comparison_source_schema, { type: 'null' }]
+        },
+        max_paths: { type: 'integer', minimum: 1, maximum: 100 },
+        max_response_bytes: {
+            type: 'integer',
+            minimum: 1024,
+            maximum: 262144
+        },
+        page_cursor: { type: ['string', 'null'], maxLength: 512 },
+        contributor_path_id: { type: 'string', minLength: 1, maxLength: 200 },
+        max_contributors: { type: 'integer', minimum: 1, maximum: 100 },
+        contributor_cursor: { type: ['string', 'null'], maxLength: 512 }
+    }
+};
+const sdlc_compare_scope_aggregates_input_schema = {
+    type: 'object',
+    additionalProperties: false,
+    required: [
+        'schema_version',
+        'algorithm_version',
+        'target',
+        'source',
+        'merge_base',
+        'scope_recipe',
+        'page_kind',
+        'max_entities',
+        'max_response_bytes',
+        'page_cursor'
+    ],
+    properties: {
+        schema_version: { type: 'integer', const: 1 },
+        algorithm_version: { type: 'integer', const: 1 },
+        target: graph_aggregate_comparison_source_schema,
+        source: graph_aggregate_comparison_source_schema,
+        merge_base: {
+            anyOf: [graph_aggregate_comparison_source_schema, { type: 'null' }]
+        },
+        scope_recipe: graph_scope_recipe_input_schema,
+        page_kind: { type: 'string', enum: ['entities', 'path_tree'] },
+        max_entities: { type: 'integer', minimum: 1, maximum: 100 },
+        max_response_bytes: {
+            type: 'integer',
+            minimum: 1024,
+            maximum: 262144
+        },
+        page_cursor: { type: ['string', 'null'], maxLength: 512 }
+    }
+};
+const sdlc_scope_impact_input_schema = {
+    type: 'object',
+    additionalProperties: false,
+    required: ['scope_recipe', 'impact_entity', 'page_kind'],
+    properties: {
+        schema_version: { type: 'integer', const: 1, default: 1 },
+        target: graph_to_code_target_schema,
+        scope_recipe: graph_scope_recipe_input_schema,
+        impact_entity: {
+            type: 'object',
+            additionalProperties: false,
+            required: ['entity_kind', 'entity_id'],
+            properties: {
+                entity_kind: { type: 'string', enum: ['node', 'edge'] },
+                entity_id: { type: 'string', minLength: 1, maxLength: 200 }
+            }
+        },
+        page_kind: {
+            type: 'string',
+            enum: [
+                'impact_summary',
+                'impact_graph_boundary',
+                'impact_path_reuse',
+                'impact_ownership'
+            ]
+        },
+        page_cursor: { type: ['string', 'null'], maxLength: 500 },
+        source_pin: {
+            type: 'object',
+            additionalProperties: false,
+            required: ['semantic_revision', 'semantic_root_hash'],
+            properties: {
+                semantic_revision: { type: 'string', minLength: 1, maxLength: 200 },
+                semantic_root_hash: {
+                    type: 'string',
+                    pattern: '^sha256:[0-9a-f]{64}$'
+                }
+            }
+        }
+    }
+};
+const sdlc_graph_search_input_schema = {
+    type: 'object',
+    additionalProperties: false,
+    properties: {
+        target: graph_to_code_target_schema,
+        mode: {
+            type: 'string',
+            enum: ['search', 'page'],
+            default: 'search',
+            description: 'Use search for focused retrieval. Use page to list graph entities without terms using cursor pagination.'
+        },
+        terms: {
+            type: 'array',
+            items: { type: 'string', minLength: 1, maxLength: 160 },
+            maxItems: 24,
+            description: 'Search terms for labels, descriptions, relationship labels, and graph entity data.'
+        },
+        entity_ids: {
+            type: 'array',
+            items: { type: 'string', minLength: 1, maxLength: 200 },
+            maxItems: 200,
+            description: 'Exact graph entity ids to return or expand after an initial search.'
+        },
+        page_cursor: {
+            type: 'string',
+            maxLength: 1000,
+            description: 'Opaque cursor from pagination.next_cursor. Use only with mode page.'
+        },
+        page_size: {
+            type: 'integer',
+            minimum: 1,
+            maximum: 240,
+            default: 80,
+            description: 'Maximum nodes returned in page mode.'
+        },
+        adjacency_hops: {
+            type: 'integer',
+            minimum: 0,
+            maximum: 3,
+            default: 1
+        },
+        include_children: { type: 'boolean', default: false },
+        include_parents: { type: 'boolean', default: true },
+        include_paths: { type: 'boolean', default: true },
+        projection: {
+            type: 'object',
+            additionalProperties: false,
+            description: 'Composable deterministic subgraph projection rules shared with the SDLC editor and hosted AI.',
+            properties: {
+                connection_hops: { type: 'integer', minimum: 0, maximum: 3 },
+                connection_direction: {
+                    type: 'string',
+                    enum: ['incoming', 'outgoing', 'both']
+                },
+                descendants: {
+                    type: 'string',
+                    enum: ['none', 'direct', 'all']
+                },
+                include_intersecting_paths: { type: 'boolean' },
+                related_path_hops: { type: 'integer', minimum: 0, maximum: 1 },
+                include_internal_edges: { type: 'boolean' }
+            }
+        },
+        max_nodes: {
+            type: 'integer',
+            minimum: 1,
+            maximum: 240,
+            default: 80
+        },
+        max_edges: {
+            type: 'integer',
+            minimum: 0,
+            maximum: 480,
+            default: 160
+        },
+        max_paths: {
+            type: 'integer',
+            minimum: 0,
+            maximum: 240,
+            default: 80
+        },
+        max_path_relations: {
+            type: 'integer',
+            minimum: 0,
+            maximum: 240,
+            default: 80
+        },
+        include_graph_context: {
+            type: 'boolean',
+            default: false,
+            description: 'When true, also returns graph_context as a compact prompt string.'
+        },
+        format: {
+            type: 'string',
+            enum: [
+                'compact_json',
+                'graph_tile_first_class',
+                'graph_tile_embedded_edges',
+                'graph_tile_embedded_typed_details'
+            ],
+            default: 'compact_json'
+        },
+        tile_delimiter: {
+            type: 'string',
+            enum: ['tab', 'comma', 'pipe', 'space'],
+            default: 'pipe'
+        }
+    }
+};
+const sdlc_empty_input_schema = {
+    type: 'object',
+    additionalProperties: false,
+    properties: {}
+};
+const sdlc_graph_pull_input_schema = {
+    type: 'object',
+    additionalProperties: false,
+    properties: {
+        target: graph_to_code_target_schema,
+        include_graph_context: {
+            type: 'boolean',
+            default: false,
+            description: 'When true, also returns graph_context as a compact prompt string.'
+        },
+        format: {
+            type: 'string',
+            enum: [
+                'compact_json',
+                'graph_tile_first_class',
+                'graph_tile_embedded_edges',
+                'graph_tile_embedded_typed_details'
+            ],
+            default: 'compact_json'
+        },
+        tile_delimiter: {
+            type: 'string',
+            enum: ['tab', 'comma', 'pipe', 'space'],
+            default: 'pipe'
+        }
+    },
+    description: 'Download the full stripped graph snapshot for a branch, pull request, or commit target. If target is omitted, the MCP wrapper uses exactly one configured default target.'
+};
+const sdlc_developer_skills_input_schema = {
+    type: 'object',
+    additionalProperties: false,
+    properties: {
+        skill_id: {
+            type: 'string',
+            description: 'Optional skill id. When omitted, returns the full developer skill catalog.'
+        }
+    }
+};
+const sdlc_package_search_input_schema = {
+    type: 'object',
+    additionalProperties: false,
+    properties: {
+        query: { type: 'string', maxLength: 160 },
+        project_id: { type: 'string', format: 'uuid' }
+    }
+};
+const sdlc_package_get_input_schema = {
+    type: 'object',
+    additionalProperties: false,
+    required: ['package_id'],
+    properties: { package_id: { type: 'string', format: 'uuid' } }
+};
+const sdlc_package_compare_input_schema = {
+    type: 'object',
+    additionalProperties: false,
+    required: ['package_id', 'branch_id'],
+    properties: {
+        package_id: { type: 'string', format: 'uuid' },
+        branch_id: { type: 'string', format: 'uuid' }
+    }
+};
+const sdlc_package_proposal_list_input_schema = {
+    type: 'object',
+    additionalProperties: false,
+    required: ['organization_id', 'project_id'],
+    properties: {
+        organization_id: { type: 'string', format: 'uuid' },
+        project_id: { type: 'string', format: 'uuid' }
+    }
+};
+const sdlc_package_proposal_create_input_schema = {
+    type: 'object',
+    additionalProperties: false,
+    required: ['organization_id', 'project_id', 'branch_id', 'title'],
+    properties: {
+        organization_id: { type: 'string', format: 'uuid' },
+        project_id: { type: 'string', format: 'uuid' },
+        branch_id: { type: 'string', format: 'uuid' },
+        source_workspace_id: { type: 'string', format: 'uuid' },
+        title: { type: 'string', minLength: 1, maxLength: 200 },
+        summary: { type: 'string', maxLength: 1000 },
+        rationale: { type: 'string', maxLength: 2000 },
+        package_name: { type: 'string', minLength: 1 },
+        package_display_name: { type: 'string', minLength: 1 },
+        asset_id: { type: 'string', minLength: 1 },
+        package_version: {
+            type: 'string',
+            pattern: '^[0-9]+\\.[0-9]+\\.[0-9]+(?:-[0-9A-Za-z.-]+)?(?:\\+[0-9A-Za-z.-]+)?$'
+        },
+        asset_version: { type: 'string', minLength: 1 },
+        branch_node_ids: {
+            type: 'array',
+            minItems: 1,
+            items: { type: 'string', format: 'uuid' }
+        },
+        branch_path_id: { type: 'string', format: 'uuid' },
+        evidence: { type: 'object', additionalProperties: true }
+    }
+};
+const SDLC_GRAPH_TO_CODE_MCP_TOOLS = [
+    {
+        name: 'sdlc_graph_pull',
+        title: 'Pull SDLC Graph',
+        description: 'Read-only full graph pull for local coding agents. Thin wrapper over POST /api/v1/graph-to-code/pull.',
+        inputSchema: sdlc_graph_pull_input_schema
+    },
+    {
+        name: 'sdlc_graph_search',
+        title: 'Search SDLC Graph',
+        description: 'Read-only graph search for coding agents. Thin wrapper over /api/v1/graph/{branch,commit}/{id}/search and /api/v1/pull-request/{id}/search.',
+        inputSchema: sdlc_graph_search_input_schema
+    },
+    {
+        name: 'sdlc_compare_graph_subgraphs',
+        title: 'Compare SDLC Graph Subgraphs',
+        description: 'Project the same seeded semantic subgraph from two exact graph targets and compare content hashes.',
+        inputSchema: sdlc_compare_graph_subgraphs_input_schema
+    },
+    {
+        name: 'sdlc_compare_path_aggregates',
+        title: 'Compare SDLC Path Aggregates',
+        description: 'Compare Path definitions, membership, retained-member content, and result roots across exact graph sources.',
+        inputSchema: sdlc_compare_path_aggregates_input_schema
+    },
+    {
+        name: 'sdlc_compare_scope_aggregates',
+        title: 'Compare SDLC Scope Aggregates',
+        description: 'Compare one Scope recipe and its member impact across exact graph sources.',
+        inputSchema: sdlc_compare_scope_aggregates_input_schema
+    },
+    {
+        name: 'sdlc_scope_impact',
+        title: 'Read SDLC Scope Impact',
+        description: 'Read bounded exact-member Scope Graph boundary, Path reuse, attribution, and ownership evidence without expanding the scope.',
+        inputSchema: sdlc_scope_impact_input_schema
+    },
+    {
+        name: 'sdlc_graph_to_code_schema',
+        title: 'Read Graph to Code Schema',
+        description: 'Fetch the live Graph to Code Developer API schema index and MCP metadata.',
+        inputSchema: sdlc_empty_input_schema
+    },
+    {
+        name: 'sdlc_developer_skills',
+        title: 'Read SDLC Developer Skills',
+        description: 'Fetch generic SDLC development skills and Graph to Code repeat-run guidance.',
+        inputSchema: sdlc_developer_skills_input_schema
+    },
+    {
+        name: 'sdlc_package_search',
+        title: 'Search SDLC Packages',
+        description: 'Discover readable graph packages without importing or mutating them.',
+        inputSchema: sdlc_package_search_input_schema
+    },
+    {
+        name: 'sdlc_package_get',
+        title: 'Read SDLC Package',
+        description: 'Read immutable package versions, asset content, and package-local manifests. Committed source provenance is included only when you can read the package source project.',
+        inputSchema: sdlc_package_get_input_schema
+    },
+    {
+        name: 'sdlc_package_compare',
+        title: 'Compare SDLC Package Source',
+        description: 'Classify a package source as current, ahead, behind, or diverged from a branch head.',
+        inputSchema: sdlc_package_compare_input_schema
+    },
+    {
+        name: 'sdlc_package_proposal_list',
+        title: 'List Graph Package Proposals',
+        description: 'List AI/user package proposals and their commit-readiness for one project. This does not publish a package.',
+        inputSchema: sdlc_package_proposal_list_input_schema
+    },
+    {
+        name: 'sdlc_package_proposal_create',
+        title: 'Suggest Graph Package Candidate',
+        description: 'Suggest exact graph nodes or one path for user-controlled package promotion. Include the exact current package version when repository manifest evidence provides one. Working content is accepted but remains blocked until the exact scope is committed.',
+        inputSchema: sdlc_package_proposal_create_input_schema
+    }
+];
+// Platform Task Core: the ordinary Task commands a user API key may run, each
+// with its own scope (tasks:write; queues:manage to configure and run a
+// queue). The commands that change access are never offered here.
+const SDLC_TASK_COMMANDS = [
+    'create_task',
+    'update_task',
+    'set_contributor',
+    'checklist',
+    'reorder',
+    'reparent',
+    'set_relation',
+    'set_project_link',
+    'archive_task',
+    'restore_task',
+    'publish_schema_revision',
+    'create_workflow',
+    'update_workflow',
+    'create_list',
+    'configure_list',
+    'open_hold',
+    'release_hold',
+    'resolve_hold',
+    'claim_task',
+    'renew_claim',
+    'end_claim',
+    'create_queue',
+    'configure_queue',
+    'archive_queue',
+    'join_queue',
+    'leave_queue',
+    'start_turn',
+    'renew_turn',
+    'end_turn',
+    'reorder_queue_entry',
+    'release_queue_create',
+    'release_queue_configure',
+    'release_queue_join',
+    'release_queue_leave',
+    'release_queue_end_turn',
+    'release_queue_run_stalled_turn',
+    'release_queue_freeze',
+    'release_queue_thaw',
+    'release_queue_stall_hold',
+    'release_queue_stall_unhold',
+    'implement_queue_create',
+    'implement_queue_configure',
+    'implement_queue_join',
+    'implement_queue_set_change_request',
+    'implement_queue_take_manager',
+    'implement_queue_renew_manager',
+    'implement_queue_end_manager',
+    'implement_queue_open_batch',
+    'implement_queue_batch_member',
+    'implement_queue_end_batch',
+    'implement_queue_release_entry'
+];
+const sdlc_task_organization_property = {
+    type: 'string',
+    format: 'uuid',
+    description: 'The Organization. Defaults to SDLC_ORGANIZATION_ID when the server has it.'
+};
+const sdlc_task_page_properties = {
+    cursor: { type: 'string', maxLength: 4096 },
+    limit: { type: 'integer', minimum: 1, maximum: 100 }
+};
+const SDLC_TASK_MCP_TOOLS = [
+    {
+        name: 'sdlc_tasks_configuration',
+        title: 'Read Task Configuration',
+        description: 'Read the Workspaces, Lists, Workflows, Statuses, Priorities and schemas you may use, with every id and revision the Task commands take. Needs a key with tasks:read.',
+        inputSchema: {
+            type: 'object',
+            additionalProperties: false,
+            properties: { organization_id: sdlc_task_organization_property }
+        }
+    },
+    {
+        name: 'sdlc_tasks_list',
+        title: 'List Tasks',
+        description: "Read one page of a List's Tasks in queue order. Needs tasks:read.",
+        inputSchema: {
+            type: 'object',
+            additionalProperties: false,
+            required: ['list_id'],
+            properties: {
+                organization_id: sdlc_task_organization_property,
+                list_id: { type: 'string', format: 'uuid' },
+                state: { type: 'string', enum: ['active', 'archived'] },
+                status_ids: {
+                    type: 'array',
+                    minItems: 1,
+                    maxItems: 50,
+                    items: { type: 'string', format: 'uuid' }
+                },
+                assigned_to_me: { type: 'boolean' },
+                ...sdlc_task_page_properties
+            }
+        }
+    },
+    {
+        name: 'sdlc_tasks_get',
+        title: 'Read Task',
+        description: 'Read one Task with its contributors, checklist, open Holds, its open claim (who is working on it), relations, children and Project links. Needs tasks:read.',
+        inputSchema: {
+            type: 'object',
+            additionalProperties: false,
+            required: ['task_id'],
+            properties: {
+                organization_id: sdlc_task_organization_property,
+                task_id: { type: 'string', format: 'uuid' }
+            }
+        }
+    },
+    {
+        name: 'sdlc_tasks_activity',
+        title: 'Read Task Activity',
+        description: "Read one page of a Task's Activity (task_id), of every Task in a List (list_id) or of a queue (queue_id), the cursor an agent polls for changes. Give exactly one. Needs tasks:read.",
+        inputSchema: {
+            type: 'object',
+            additionalProperties: false,
+            properties: {
+                organization_id: sdlc_task_organization_property,
+                task_id: { type: 'string', format: 'uuid' },
+                list_id: { type: 'string', format: 'uuid' },
+                queue_id: { type: 'string', format: 'uuid' },
+                ...sdlc_task_page_properties
+            }
+        }
+    },
+    {
+        name: 'sdlc_tasks_queues',
+        title: 'List Queues',
+        description: "Read the queues the key's user can read, in one Workspace (workspace_id) or all of the Organization's; archived: true lists archived queues instead. Needs tasks:read.",
+        inputSchema: {
+            type: 'object',
+            additionalProperties: false,
+            properties: {
+                organization_id: sdlc_task_organization_property,
+                workspace_id: { type: 'string', format: 'uuid' },
+                archived: { type: 'boolean' }
+            }
+        }
+    },
+    {
+        name: 'sdlc_tasks_queue',
+        title: 'Read Queue',
+        description: "Read one queue: its configuration, its layer's, and its state (queue-state/v1): the running turn, the waiting entries in order, and what each waits on. Needs tasks:read.",
+        inputSchema: {
+            type: 'object',
+            additionalProperties: false,
+            required: ['queue_id'],
+            properties: {
+                organization_id: sdlc_task_organization_property,
+                queue_id: { type: 'string', format: 'uuid' }
+            }
+        }
+    },
+    {
+        name: 'sdlc_tasks_operation',
+        title: 'Read Task Command Receipt',
+        description: 'Read the committed result of one of your Task commands by its operation_key, for a reply that was lost. Needs tasks:read.',
+        inputSchema: {
+            type: 'object',
+            additionalProperties: false,
+            required: ['operation_key'],
+            properties: {
+                organization_id: sdlc_task_organization_property,
+                operation_key: { type: 'string', format: 'uuid' }
+            }
+        }
+    },
+    {
+        name: 'sdlc_tasks_waiting_on_you',
+        title: 'List Holds Waiting On You',
+        description: "Read one page of the open Holds that wait on the key's user: Holds whose target is you, or a Task you are primary on or hold a live claim on. Poll it at each coordination checkpoint; release a Hold with the release_hold command once you have done what it waits for. Needs tasks:read.",
+        inputSchema: {
+            type: 'object',
+            additionalProperties: false,
+            properties: {
+                organization_id: sdlc_task_organization_property,
+                ...sdlc_task_page_properties
+            }
+        }
+    },
+    {
+        name: 'sdlc_tasks_command',
+        title: 'Run Task Command',
+        description: "Run one Task command as the key's user, with its strict version 1 request (the same fields as POST /api/v1/organizations/{organization_id}/tasks/commands/{command}). version and a fresh operation_key are added when absent; a lost reply is retried once with the same key, and the answer includes the operation_key, which sdlc_tasks_operation reads. Needs tasks:write; creating, configuring, archiving or reordering a queue, freezing or stall-holding a release queue, and an implement queue's manager and batch commands need queues:manage.",
+        inputSchema: {
+            type: 'object',
+            additionalProperties: false,
+            required: ['command', 'request'],
+            properties: {
+                organization_id: sdlc_task_organization_property,
+                command: { type: 'string', enum: [...SDLC_TASK_COMMANDS] },
+                request: { type: 'object', additionalProperties: true }
+            }
+        }
+    }
+];
+function isJsonObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function getStringField(record, key) {
+    const value = record[key];
+    return typeof value === 'string' && value.trim().length > 0
+        ? value.trim()
+        : null;
+}
+function trimTrailingSlash(value) {
+    return value.replace(/\/+$/, '');
+}
+function readEnvironmentValue(env, candidates) {
+    for (const candidate of candidates) {
+        const value = env[candidate]?.trim();
+        if (value) {
+            return value;
+        }
+    }
+    return null;
+}
+function resolveDefaultTargetFromPairs(candidates) {
+    const configured_targets = candidates.flatMap(([key, value]) => typeof value === 'string' && value.trim().length > 0
+        ? [{ key, value: value.trim() }]
+        : []);
+    if (configured_targets.length !== 1) {
+        return null;
+    }
+    const target = configured_targets[0];
+    return { [target.key]: target.value };
+}
+function resolveDefaultTarget(env) {
+    return resolveDefaultTargetFromPairs([
+        ['branch_id', env.SDLC_BRANCH_ID],
+        ['pull_request_id', env.SDLC_PULL_REQUEST_ID],
+        ['commit_id', env.SDLC_COMMIT_ID]
+    ]);
+}
+function resolveDefaultTargetFromUrl(url) {
+    return resolveDefaultTargetFromPairs([
+        ['branch_id', url.searchParams.get('branch_id')],
+        ['pull_request_id', url.searchParams.get('pull_request_id')],
+        ['commit_id', url.searchParams.get('commit_id')]
+    ]);
+}
+export function resolveGraphToCodeMcpEnvironment(env) {
+    const base_url = readEnvironmentValue(env, [
+        'SDLC_BASE_URL',
+        'SDLC_APP_URL',
+        'NGROK_SITE_URL',
+        'NEXT_PUBLIC_SITE_URL'
+    ]);
+    const api_key = readEnvironmentValue(env, [
+        'SDLC_API_KEY',
+        'SOFTWAREDLC_API_KEY'
+    ]);
+    if (!base_url) {
+        throw new Error('Set SDLC_BASE_URL, SDLC_APP_URL, or NGROK_SITE_URL before starting the MCP server.');
+    }
+    if (!api_key) {
+        throw new Error('Set SDLC_API_KEY before starting the MCP server.');
+    }
+    const default_organization_id = readEnvironmentValue(env, [
+        'SDLC_ORGANIZATION_ID'
+    ]);
+    return {
+        base_url: trimTrailingSlash(base_url),
+        api_key,
+        default_target: resolveDefaultTarget(env),
+        ...(default_organization_id ? { default_organization_id } : {})
+    };
+}
+export function resolveHostedGraphToCodeMcpEnvironment(request) {
+    const authorization_header = request.headers.get('authorization');
+    const match = authorization_header?.match(/^Bearer\s+(.+)$/i);
+    const api_key = match?.[1]?.trim();
+    if (!api_key) {
+        return null;
+    }
+    const url = new URL(request.url);
+    return {
+        base_url: url.origin,
+        api_key,
+        default_target: resolveDefaultTargetFromUrl(url)
+    };
+}
+function isAllowedHostedOrigin(request) {
+    const origin = request.headers.get('origin');
+    if (!origin) {
+        return true;
+    }
+    try {
+        return new URL(origin).origin === new URL(request.url).origin;
+    }
+    catch {
+        return false;
+    }
+}
+function buildSuccessResponse(id, result) {
+    return {
+        jsonrpc: '2.0',
+        id,
+        result
+    };
+}
+function buildErrorResponse(input) {
+    return {
+        jsonrpc: '2.0',
+        id: input.id,
+        error: {
+            code: input.code,
+            message: input.message,
+            ...(typeof input.data === 'undefined' ? {} : { data: input.data })
+        }
+    };
+}
+function buildToolResult(value) {
+    return {
+        content: [
+            {
+                type: 'text',
+                text: JSON.stringify(value, null, 2)
+            }
+        ]
+    };
+}
+function buildToolError(error) {
+    return {
+        isError: true,
+        content: [
+            {
+                type: 'text',
+                text: error instanceof Error ? error.message : 'Tool call failed.'
+            }
+        ]
+    };
+}
+function makeUrl(environment, path) {
+    return `${environment.base_url}${path}`;
+}
+/** A refusal from the SDLC API, with its HTTP status and body. */
+class SdlcApiError extends Error {
+    status;
+    payload;
+    constructor(message, status, payload) {
+        super(message);
+        this.status = status;
+        this.payload = payload;
+    }
+}
+async function fetchJson(input) {
+    const response = await input.fetch_impl(makeUrl(input.environment, input.path), {
+        method: input.method,
+        headers: {
+            Authorization: `Bearer ${input.environment.api_key}`,
+            Accept: 'application/json',
+            ...(input.body
+                ? {
+                    'Content-Type': 'application/json'
+                }
+                : {})
+        },
+        body: input.body ? JSON.stringify(input.body) : undefined
+    });
+    const payload = (await response.json());
+    if (!response.ok) {
+        const message = isJsonObject(payload) && typeof payload.error === 'string'
+            ? payload.error
+            : response.statusText || 'SDLC API request failed.';
+        throw new SdlcApiError(`SDLC API ${response.status}: ${message}`, response.status, payload);
+    }
+    return payload;
+}
+function readToolArguments(params) {
+    if (!isJsonObject(params)) {
+        return {
+            name: null,
+            arguments_object: {}
+        };
+    }
+    const name = getStringField(params, 'name');
+    const raw_arguments = params.arguments;
+    return {
+        name,
+        arguments_object: isJsonObject(raw_arguments) ? raw_arguments : {}
+    };
+}
+function resolveGraphTarget(input) {
+    const explicit_target = input.arguments_object.target;
+    const target = isJsonObject(explicit_target)
+        ? explicit_target
+        : input.environment.default_target;
+    if (!target) {
+        throw new Error('Provide target.branch_id, target.pull_request_id, or target.commit_id, or configure exactly one SDLC_BRANCH_ID, SDLC_PULL_REQUEST_ID, or SDLC_COMMIT_ID.');
+    }
+    return target;
+}
+function buildSearchRequest(input) {
+    const target = resolveGraphTarget(input);
+    const branch_id = getStringField(target, 'branch_id');
+    const pull_request_id = getStringField(target, 'pull_request_id');
+    const commit_id = getStringField(target, 'commit_id');
+    const ids = [branch_id, pull_request_id, commit_id].filter(Boolean);
+    if (ids.length !== 1) {
+        throw new Error('Provide exactly one target id: branch_id, pull_request_id, or commit_id.');
+    }
+    const body = {};
+    for (const [key, value] of Object.entries(input.arguments_object)) {
+        if (key !== 'target') {
+            body[key] = value;
+        }
+    }
+    if (branch_id) {
+        return {
+            path: `/api/v1/graph/branch/${encodeURIComponent(branch_id)}/search?${GRAPH_VARIANT_SET_VERSIONS_QUERY}`,
+            body
+        };
+    }
+    if (commit_id) {
+        return {
+            path: `/api/v1/graph/commit/${encodeURIComponent(commit_id)}/search?${GRAPH_VARIANT_SET_VERSIONS_QUERY}`,
+            body
+        };
+    }
+    return {
+        path: `/api/v1/pull-request/${encodeURIComponent(pull_request_id)}/search?${GRAPH_VARIANT_SET_VERSIONS_QUERY}`,
+        body
+    };
+}
+function buildPullBody(input) {
+    const explicit_target = input.arguments_object.target;
+    const target = isJsonObject(explicit_target)
+        ? explicit_target
+        : input.environment.default_target;
+    if (!target) {
+        throw new Error('Provide target.branch_id, target.pull_request_id, or target.commit_id, or configure exactly one SDLC_BRANCH_ID, SDLC_PULL_REQUEST_ID, or SDLC_COMMIT_ID.');
+    }
+    return {
+        ...input.arguments_object,
+        target
+    };
+}
+function buildScopeImpactBody(input) {
+    const target = resolveGraphTarget(input);
+    const branch_id = getStringField(target, 'branch_id');
+    if (!branch_id || Object.keys(target).length !== 1) {
+        throw new Error('Scope impact requires exactly one branch target.');
+    }
+    const body = {
+        ...input.arguments_object,
+        schema_version: 1,
+        target: { branch_id }
+    };
+    return body;
+}
+// A Task route refuses with {code, error} and what says how to fix it: issues
+// (the schema), issue (the body reader), detail (the function), or
+// retry_after_seconds (the key's rate limit). The message keeps them all.
+function taskRefusal(error) {
+    const payload = isJsonObject(error.payload) ? error.payload : {};
+    const code = typeof payload.code === 'string' ? ` ${payload.code}` : '';
+    const text = typeof payload.error === 'string' ? payload.error : 'Task request failed.';
+    const detail = typeof payload.detail === 'string' ? ` (${payload.detail})` : '';
+    const issue = typeof payload.issue === 'string' ? ` (${payload.issue})` : '';
+    const retry = typeof payload.retry_after_seconds === 'number'
+        ? ` Retry after ${payload.retry_after_seconds} s.`
+        : '';
+    const issues = payload.issues === undefined ? '' : ` ${JSON.stringify(payload.issues)}`;
+    return new SdlcApiError(`SDLC API ${error.status}${code}: ${text}${detail}${issue}${issues}${retry}`, error.status, error.payload);
+}
+// The tool's own input schema decides what an argument may be, so a mistake
+// is refused here instead of being dropped and widening the request.
+function checkTaskArguments(name, args) {
+    const tool = SDLC_TASK_MCP_TOOLS.find((t) => t.name === name);
+    const schema = tool && isJsonObject(tool.inputSchema) ? tool.inputSchema : {};
+    const properties = isJsonObject(schema.properties) ? schema.properties : {};
+    const required = Array.isArray(schema.required) ? schema.required : [];
+    for (const key of required) {
+        if (typeof key === 'string' && args[key] === undefined) {
+            throw new Error(`${key} is required.`);
+        }
+    }
+    for (const [key, value] of Object.entries(args)) {
+        const rule = properties[key];
+        if (!isJsonObject(rule)) {
+            throw new Error(`Unknown argument ${key} for ${name}.`);
+        }
+        const fits = rule.type === 'string'
+            ? typeof value === 'string'
+            : rule.type === 'integer'
+                ? Number.isInteger(value)
+                : rule.type === 'boolean'
+                    ? typeof value === 'boolean'
+                    : rule.type === 'object'
+                        ? isJsonObject(value)
+                        : rule.type === 'array'
+                            ? Array.isArray(value) &&
+                                value.length >= Number(rule.minItems ?? 0) &&
+                                value.every((item) => typeof item === 'string')
+                            : true;
+        if (!fits) {
+            throw new Error(`${key} is not a valid ${String(rule.type)} for ${name}.`);
+        }
+        if (Array.isArray(rule.enum) &&
+            !rule.enum.includes(value)) {
+            throw new Error(`${key} must be one of: ${rule.enum.join(', ')}.`);
+        }
+    }
+}
+async function fetchTaskJson(input) {
+    try {
+        return await fetchJson({
+            environment: input.environment,
+            fetch_impl: input.fetch_impl,
+            path: `/api/v1/organizations/${encodeURIComponent(input.organization_id)}/tasks${input.path}`,
+            method: input.method,
+            body: input.body
+        });
+    }
+    catch (error) {
+        throw error instanceof SdlcApiError ? taskRefusal(error) : error;
+    }
+}
+function taskOrganization(input) {
+    const organization_id = getStringField(input.arguments_object, 'organization_id') ??
+        input.environment.default_organization_id;
+    if (!organization_id) {
+        throw new Error('Provide organization_id, or start the server with SDLC_ORGANIZATION_ID.');
+    }
+    return organization_id;
+}
+function taskPageQuery(arguments_object) {
+    const params = new URLSearchParams();
+    const cursor = getStringField(arguments_object, 'cursor');
+    if (cursor)
+        params.set('cursor', cursor);
+    if (typeof arguments_object.limit === 'number') {
+        params.set('limit', String(arguments_object.limit));
+    }
+    return params;
+}
+function withQuery(path, params) {
+    return params.size ? `${path}?${params.toString()}` : path;
+}
+function requiredTaskId(arguments_object, key) {
+    const value = getStringField(arguments_object, key);
+    if (!value)
+        throw new Error(`${key} is required.`);
+    return encodeURIComponent(value);
+}
+// A reply that never came (the request failed to arrive or the server failed)
+// may still have committed; the same operation_key makes a retry safe.
+function isLostReply(error) {
+    return !(error instanceof SdlcApiError) || error.status >= 500;
+}
+/** The Task tools: thin wrappers over the Task key routes. */
+async function callTaskTool(input) {
+    const args = input.arguments_object;
+    checkTaskArguments(input.name, args);
+    const request = {
+        environment: input.environment,
+        fetch_impl: input.fetch_impl,
+        organization_id: taskOrganization(input)
+    };
+    if (input.name === 'sdlc_tasks_configuration') {
+        return fetchTaskJson({ ...request, path: '/configuration', method: 'GET' });
+    }
+    if (input.name === 'sdlc_tasks_list') {
+        const list_id = requiredTaskId(args, 'list_id');
+        const params = taskPageQuery(args);
+        const state = getStringField(args, 'state');
+        if (state)
+            params.set('state', state);
+        if (Array.isArray(args.status_ids)) {
+            params.set('status_ids', args.status_ids.map(String).join(','));
+        }
+        if (typeof args.assigned_to_me === 'boolean') {
+            params.set('assigned_to_me', String(args.assigned_to_me));
+        }
+        return fetchTaskJson({
+            ...request,
+            path: withQuery(`/lists/${list_id}/tasks`, params),
+            method: 'GET'
+        });
+    }
+    if (input.name === 'sdlc_tasks_get') {
+        const task_id = requiredTaskId(args, 'task_id');
+        return fetchTaskJson({
+            ...request,
+            path: `/tasks/${task_id}`,
+            method: 'GET'
+        });
+    }
+    if (input.name === 'sdlc_tasks_activity') {
+        const subjects = ['task_id', 'list_id', 'queue_id'].flatMap((key) => {
+            const id = getStringField(args, key);
+            return id ? [{ key, id }] : [];
+        });
+        if (subjects.length !== 1) {
+            throw new Error('Provide exactly one of task_id, list_id or queue_id.');
+        }
+        const { key, id } = subjects[0];
+        const collection = key === 'task_id' ? 'tasks' : key === 'list_id' ? 'lists' : 'queues';
+        return fetchTaskJson({
+            ...request,
+            path: withQuery(`/${collection}/${encodeURIComponent(id)}/activity`, taskPageQuery(args)),
+            method: 'GET'
+        });
+    }
+    if (input.name === 'sdlc_tasks_queues') {
+        const params = new URLSearchParams();
+        // Sent as given, so the route refuses a blank one instead of the read
+        // widening to the whole Organization.
+        if (typeof args.workspace_id === 'string') {
+            params.set('workspace_id', args.workspace_id);
+        }
+        if (typeof args.archived === 'boolean') {
+            params.set('archived', String(args.archived));
+        }
+        return fetchTaskJson({
+            ...request,
+            path: withQuery('/queues', params),
+            method: 'GET'
+        });
+    }
+    if (input.name === 'sdlc_tasks_queue') {
+        const queue_id = requiredTaskId(args, 'queue_id');
+        return fetchTaskJson({
+            ...request,
+            path: `/queues/${queue_id}`,
+            method: 'GET'
+        });
+    }
+    if (input.name === 'sdlc_tasks_operation') {
+        const operation_key = requiredTaskId(args, 'operation_key');
+        return fetchTaskJson({
+            ...request,
+            path: `/operations/${operation_key}`,
+            method: 'GET'
+        });
+    }
+    if (input.name === 'sdlc_tasks_waiting_on_you') {
+        return fetchTaskJson({
+            ...request,
+            path: withQuery('/waiting-on-you', taskPageQuery(args)),
+            method: 'GET'
+        });
+    }
+    if (input.name === 'sdlc_tasks_command') {
+        const command = getStringField(args, 'command');
+        if (!command ||
+            !SDLC_TASK_COMMANDS.includes(command)) {
+            throw new Error(`command must be one of: ${SDLC_TASK_COMMANDS.join(', ')}.`);
+        }
+        if (!isJsonObject(args.request)) {
+            throw new Error('request must be the command’s request object.');
+        }
+        // Only an absent operation_key is filled in; one the caller gave goes to
+        // the route as it is, which refuses a malformed key.
+        const body = {
+            version: 1,
+            ...('operation_key' in args.request
+                ? {}
+                : { operation_key: globalThis.crypto.randomUUID() }),
+            ...args.request
+        };
+        const operation_key = body.operation_key;
+        const send = () => fetchTaskJson({
+            ...request,
+            path: `/commands/${encodeURIComponent(command)}`,
+            method: 'POST',
+            body
+        });
+        let result;
+        try {
+            result = await send();
+        }
+        catch (error) {
+            if (!isLostReply(error))
+                throw error;
+            try {
+                result = await send();
+            }
+            catch (again) {
+                const message = again instanceof Error ? again.message : 'No reply.';
+                throw new Error(`${message} The command may have committed: read it with sdlc_tasks_operation and operation_key ${operation_key}.`);
+            }
+        }
+        return { operation_key, result };
+    }
+    throw new Error(`Unknown tool: ${input.name}`);
+}
+async function callTool(input) {
+    try {
+        if (input.name.startsWith('sdlc_tasks_')) {
+            return buildToolResult(await callTaskTool(input));
+        }
+        if (input.name === 'sdlc_graph_search') {
+            const request = buildSearchRequest({
+                arguments_object: input.arguments_object,
+                environment: input.environment
+            });
+            const payload = await fetchJson({
+                environment: input.environment,
+                fetch_impl: input.fetch_impl,
+                path: request.path,
+                method: 'POST',
+                body: request.body
+            });
+            return buildToolResult(payload);
+        }
+        if (input.name === 'sdlc_graph_pull') {
+            const body = buildPullBody({
+                arguments_object: input.arguments_object,
+                environment: input.environment
+            });
+            const payload = await fetchJson({
+                environment: input.environment,
+                fetch_impl: input.fetch_impl,
+                path: `/api/v1/graph-to-code/pull?${GRAPH_VARIANT_SET_VERSIONS_QUERY}`,
+                method: 'POST',
+                body
+            });
+            return buildToolResult(payload);
+        }
+        if (input.name === 'sdlc_compare_graph_subgraphs') {
+            const payload = await fetchJson({
+                environment: input.environment,
+                fetch_impl: input.fetch_impl,
+                path: `/api/graph-to-code/compare-subgraph?${GRAPH_VARIANT_SET_VERSIONS_QUERY}`,
+                method: 'POST',
+                body: input.arguments_object
+            });
+            return buildToolResult(payload);
+        }
+        if (input.name === 'sdlc_compare_path_aggregates') {
+            const payload = await fetchJson({
+                environment: input.environment,
+                fetch_impl: input.fetch_impl,
+                path: '/api/v1/graph/comparison/path-aggregates',
+                method: 'POST',
+                body: input.arguments_object
+            });
+            return buildToolResult(payload);
+        }
+        if (input.name === 'sdlc_compare_scope_aggregates') {
+            const payload = await fetchJson({
+                environment: input.environment,
+                fetch_impl: input.fetch_impl,
+                path: '/api/v1/graph/comparison/scopes',
+                method: 'POST',
+                body: input.arguments_object
+            });
+            return buildToolResult(payload);
+        }
+        if (input.name === 'sdlc_scope_impact') {
+            const payload = await fetchJson({
+                environment: input.environment,
+                fetch_impl: input.fetch_impl,
+                path: '/api/v1/graph-to-code/scope-impact',
+                method: 'POST',
+                body: buildScopeImpactBody({
+                    arguments_object: input.arguments_object,
+                    environment: input.environment
+                })
+            });
+            return buildToolResult(payload);
+        }
+        if (input.name === 'sdlc_graph_to_code_schema') {
+            const payload = await fetchJson({
+                environment: input.environment,
+                fetch_impl: input.fetch_impl,
+                path: '/api/developer/graph-to-code',
+                method: 'GET'
+            });
+            return buildToolResult(payload);
+        }
+        if (input.name === 'sdlc_developer_skills') {
+            const skill_id = getStringField(input.arguments_object, 'skill_id');
+            const payload = await fetchJson({
+                environment: input.environment,
+                fetch_impl: input.fetch_impl,
+                path: skill_id
+                    ? `/api/developer/skills/${encodeURIComponent(skill_id)}`
+                    : '/api/developer/skills',
+                method: 'GET'
+            });
+            return buildToolResult(payload);
+        }
+        if (input.name === 'sdlc_package_search') {
+            const params = new URLSearchParams();
+            const query = getStringField(input.arguments_object, 'query');
+            const project_id = getStringField(input.arguments_object, 'project_id');
+            if (query)
+                params.set('query', query);
+            if (project_id)
+                params.set('project_id', project_id);
+            const payload = await fetchJson({
+                environment: input.environment,
+                fetch_impl: input.fetch_impl,
+                path: `/api/v1/packages${params.size ? `?${params.toString()}` : ''}`,
+                method: 'GET'
+            });
+            return buildToolResult(payload);
+        }
+        if (input.name === 'sdlc_package_get') {
+            const package_id = getStringField(input.arguments_object, 'package_id');
+            if (!package_id)
+                throw new Error('package_id is required.');
+            const payload = await fetchJson({
+                environment: input.environment,
+                fetch_impl: input.fetch_impl,
+                path: `/api/v1/packages/${encodeURIComponent(package_id)}`,
+                method: 'GET'
+            });
+            return buildToolResult(payload);
+        }
+        if (input.name === 'sdlc_package_compare') {
+            const package_id = getStringField(input.arguments_object, 'package_id');
+            const branch_id = getStringField(input.arguments_object, 'branch_id');
+            if (!package_id || !branch_id) {
+                throw new Error('package_id and branch_id are required.');
+            }
+            const payload = await fetchJson({
+                environment: input.environment,
+                fetch_impl: input.fetch_impl,
+                path: `/api/v1/packages/${encodeURIComponent(package_id)}/compare?branch_id=${encodeURIComponent(branch_id)}`,
+                method: 'GET'
+            });
+            return buildToolResult(payload);
+        }
+        if (input.name === 'sdlc_package_proposal_list') {
+            const organization_id = getStringField(input.arguments_object, 'organization_id');
+            const project_id = getStringField(input.arguments_object, 'project_id');
+            if (!organization_id || !project_id) {
+                throw new Error('organization_id and project_id are required.');
+            }
+            const params = new URLSearchParams({ organization_id, project_id });
+            const payload = await fetchJson({
+                environment: input.environment,
+                fetch_impl: input.fetch_impl,
+                path: `/api/v1/package-proposals?${params.toString()}`,
+                method: 'GET'
+            });
+            return buildToolResult(payload);
+        }
+        if (input.name === 'sdlc_package_proposal_create') {
+            const payload = await fetchJson({
+                environment: input.environment,
+                fetch_impl: input.fetch_impl,
+                path: '/api/v1/package-proposals',
+                method: 'POST',
+                body: input.arguments_object
+            });
+            return buildToolResult(payload);
+        }
+        return buildToolError(new Error(`Unknown tool: ${input.name}`));
+    }
+    catch (error) {
+        return buildToolError(error);
+    }
+}
+async function listGraphToCodeMcpTools(input) {
+    try {
+        await fetchJson({
+            environment: input.environment,
+            fetch_impl: input.fetch_impl,
+            path: '/api/developer/graph-to-code',
+            method: 'GET'
+        });
+    }
+    catch (error) {
+        // A key with only Task scopes cannot read the graph schema index; it
+        // still gets the Task tools, whose routes check its scopes themselves.
+        if (error instanceof SdlcApiError &&
+            (error.status === 401 || error.status === 403)) {
+            return SDLC_TASK_MCP_TOOLS;
+        }
+        throw error;
+    }
+    return [...SDLC_GRAPH_TO_CODE_MCP_TOOLS, ...SDLC_TASK_MCP_TOOLS];
+}
+export async function handleGraphToCodeMcpMessage(message, options) {
+    if (!isJsonObject(message)) {
+        return buildErrorResponse({
+            id: null,
+            code: -32600,
+            message: 'Invalid JSON-RPC message.'
+        });
+    }
+    const request = message;
+    const id = request.id ?? null;
+    const method = typeof request.method === 'string' ? request.method : undefined;
+    if (!method) {
+        if ('result' in request || 'error' in request) {
+            return null;
+        }
+        return buildErrorResponse({
+            id,
+            code: -32600,
+            message: 'JSON-RPC method is required.'
+        });
+    }
+    if (method.startsWith('notifications/')) {
+        return null;
+    }
+    const fetch_impl = options.fetch_impl ?? fetch;
+    if (method === 'initialize') {
+        return buildSuccessResponse(id, {
+            protocolVersion: MCP_PROTOCOL_VERSION,
+            capabilities: {
+                tools: {
+                    listChanged: false
+                }
+            },
+            serverInfo: {
+                name: 'sdlc-graph-to-code-mcp',
+                version: options.server_version ?? 'unknown'
+            },
+            instructions: 'Use sdlc_graph_search for read-only SDLC graph context. This MCP server is a thin wrapper over the SDLC Developer API and never writes graph state. The sdlc_tasks_* tools read and run Tasks and queues as the API key’s user (tasks:read, tasks:write, queues:manage).'
+        });
+    }
+    if (method === 'ping') {
+        return buildSuccessResponse(id, {});
+    }
+    if (method === 'tools/list') {
+        try {
+            const tools = await listGraphToCodeMcpTools({
+                environment: options.environment,
+                fetch_impl
+            });
+            return buildSuccessResponse(id, {
+                tools
+            });
+        }
+        catch (error) {
+            return buildErrorResponse({
+                id,
+                code: -32002,
+                message: error instanceof Error ? error.message : 'Failed to list MCP tools.'
+            });
+        }
+    }
+    if (method === 'tools/call') {
+        const { name, arguments_object } = readToolArguments(request.params);
+        if (!name) {
+            return buildErrorResponse({
+                id,
+                code: -32602,
+                message: 'Tool name is required.'
+            });
+        }
+        const result = await callTool({
+            name,
+            arguments_object,
+            environment: options.environment,
+            fetch_impl
+        });
+        return buildSuccessResponse(id, result);
+    }
+    return buildErrorResponse({
+        id,
+        code: -32601,
+        message: `Unsupported MCP method: ${method}`
+    });
+}
+export function buildHostedGraphToCodeMcpGetResponse() {
+    return Response.json({
+        error: 'This MCP endpoint supports POST Streamable HTTP JSON-RPC messages. SSE GET streams are not enabled.'
+    }, {
+        status: 405,
+        headers: {
+            Allow: 'POST',
+            ...MCP_RESPONSE_HEADERS
+        }
+    });
+}
+export async function handleHostedGraphToCodeMcpRequest(request, options) {
+    if (request.method !== 'POST') {
+        return buildHostedGraphToCodeMcpGetResponse();
+    }
+    if (!isAllowedHostedOrigin(request)) {
+        return Response.json({
+            jsonrpc: '2.0',
+            id: null,
+            error: {
+                code: -32003,
+                message: 'Origin is not allowed for this MCP endpoint.'
+            }
+        }, {
+            status: 403,
+            headers: MCP_RESPONSE_HEADERS
+        });
+    }
+    const environment = resolveHostedGraphToCodeMcpEnvironment(request);
+    if (!environment) {
+        return Response.json({
+            jsonrpc: '2.0',
+            id: null,
+            error: {
+                code: -32001,
+                message: 'Bearer credential is required.'
+            }
+        }, {
+            status: 401,
+            headers: {
+                ...MCP_RESPONSE_HEADERS,
+                ...options?.unauthorized_headers
+            }
+        });
+    }
+    let message;
+    try {
+        const body = options?.bounded_request_body ??
+            (await readHostedGraphToCodeMcpRequestBody(request));
+        message = JSON.parse(new TextDecoder().decode(body));
+    }
+    catch (error) {
+        if (error instanceof HostedMcpRequestTooLargeError) {
+            return buildHostedGraphToCodeMcpRequestTooLargeResponse();
+        }
+        return Response.json({
+            jsonrpc: '2.0',
+            id: null,
+            error: {
+                code: -32700,
+                message: 'Invalid JSON body.'
+            }
+        }, {
+            status: 400,
+            headers: MCP_RESPONSE_HEADERS
+        });
+    }
+    const response = await handleGraphToCodeMcpMessage(message, {
+        environment,
+        fetch_impl: options?.fetch_impl,
+        server_version: options?.server_version
+    });
+    if (!response) {
+        return new Response(null, {
+            status: 202,
+            headers: MCP_RESPONSE_HEADERS
+        });
+    }
+    return Response.json(response, {
+        status: 200,
+        headers: MCP_RESPONSE_HEADERS
+    });
+}
+//# sourceMappingURL=graph-to-code.js.map