@totemsdk/mcp-server 0.3.0 → 0.5.0

package/dist/tools.js

@@ -5,6 +5,8 @@ exports.handleToolCall = handleToolCall;
 const template_catalog_js_1 = require("./template-catalog.js");
 const indexer_js_1 = require("./indexer.js");
 const index_store_js_1 = require("./index-store.js");
+const composition_js_1 = require("./composition.js");
+const contracts_js_1 = require("./contracts.js");
 /**
  * The single source of truth for the MCP tool catalog. `index.ts` advertises
  * these and `handleToolCall` dispatches them; the `mcp.test.ts` drift guard
@@ -13,8 +15,8 @@ const index_store_js_1 = require("./index-store.js");
 exports.TOOL_DEFINITIONS = [
     { name: 'search-symbol', description: 'Search for a symbol (function, type, class) across all packages', inputSchema: { type: 'object', properties: { query: { type: 'string', description: 'Partial symbol name to search' } }, required: ['query'] } },
     { name: 'find-type', description: 'Find type definitions (interfaces, classes, type aliases) matching a pattern', inputSchema: { type: 'object', properties: { pattern: { type: 'string', description: 'Type name pattern to search' } }, required: ['pattern'] } },
-    { name: 'dependency-graph', description: 'Get dependency graph for a package — inbound dependents or outbound dependencies', inputSchema: { type: 'object', properties: { package: { type: 'string', description: 'Package name (e.g. @totemsdk/edge-opcua)' }, direction: { type: 'string', enum: ['in', 'out', 'all'], description: 'Dependency direction' } }, required: ['package'] } },
-    { name: 'validate-import', description: 'Check whether a cross-package import is valid', inputSchema: { type: 'object', properties: { from: { type: 'string', description: 'Source package name' }, to: { type: 'string', description: 'Target package name' }, symbol: { type: 'string', description: 'Optional: specific symbol to check' } }, required: ['from', 'to'] } },
+    { name: 'dependency-graph', description: 'Get dependency graph for a package — inbound dependents, outbound dependencies, typed edge kinds/ranges, cycles and SCCs', inputSchema: { type: 'object', properties: { package: { type: 'string', description: 'Package name (e.g. @totemsdk/edge-opcua)' }, direction: { type: 'string', enum: ['in', 'out', 'all'], description: 'Dependency direction' }, format: { type: 'string', enum: ['text', 'json'], description: 'Output format (default text)' } }, required: ['package'] } },
+    { name: 'validate-import', description: 'Check whether a cross-package import is valid, including dependency kind, export subpath and condition', inputSchema: { type: 'object', properties: { from: { type: 'string', description: 'Source package name' }, to: { type: 'string', description: 'Target package name' }, symbol: { type: 'string', description: 'Optional: specific symbol to check' }, subpath: { type: 'string', description: 'Optional export subpath (e.g. ./artifacts)' }, condition: { type: 'string', description: 'Optional runtime condition (e.g. import, require, types)' } }, required: ['from', 'to'] } },
     { name: 'scaffold-adapter', description: 'Generate boilerplate for a new edge protocol adapter', inputSchema: { type: 'object', properties: { name: { type: 'string', description: 'Package name suffix' }, protocol: { type: 'string', description: 'Protocol name (PascalCase)' }, commands: { type: 'array', items: { type: 'string' }, description: 'Transport port methods' } }, required: ['name', 'protocol'] } },
     { name: 'scaffold-package', description: 'Generate boilerplate for a new @totemsdk package', inputSchema: { type: 'object', properties: { name: { type: 'string', description: 'Package name (without @totemsdk/ prefix)' }, deps: { type: 'array', items: { type: 'string' }, description: 'Dependency package names' } }, required: ['name'] } },
     { name: 'package-stats', description: 'Get statistics about a package — export counts, Rust/Go, tests, deps', inputSchema: { type: 'object', properties: { name: { type: 'string', description: 'Package name' } }, required: ['name'] } },
@@ -23,6 +25,9 @@ exports.TOOL_DEFINITIONS = [
     { name: 'read-source', description: "Read a source file from a package's src/ directory (e.g. package '@totemsdk/core', path 'treekey.ts')", inputSchema: { type: 'object', properties: { package: { type: 'string', description: 'Package name (e.g. @totemsdk/core)' }, path: { type: 'string', description: 'Path relative to the package src/ directory' } }, required: ['package', 'path'] } },
     { name: 'list-packages', description: 'List SDK packages, optionally filtered by domain or name substring', inputSchema: { type: 'object', properties: { domain: { type: 'string', description: 'Optional domain filter (e.g. edge/runtime... see totemsdk://domain-map)' }, filter: { type: 'string', description: 'Optional package-name substring filter' } } } },
     { name: 'search-packages', description: 'Search packages by keyword across name, description, keywords and exports (e.g. "wots lease coordination")', inputSchema: { type: 'object', properties: { query: { type: 'string', description: 'Free-text query' }, domain: { type: 'string', description: 'Optional domain filter' }, limit: { type: 'number', description: 'Max results (default 15)' } }, required: ['query'] } },
+    { name: 'inspect-contract', description: 'Inspect bounded package contract metadata by package, export subpath and symbol', inputSchema: { type: 'object', properties: { package: { type: 'string' }, subpath: { type: 'string', description: 'Export subpath, default "."' }, symbol: { type: 'string', description: 'Exact symbol name' }, offset: { type: 'number' }, limit: { type: 'number', description: 'Max 100' }, includeDocs: { type: 'boolean' } }, required: ['package'] } },
+    { name: 'plan-composition', description: 'Plan a justified SDK composition across the full catalogue, with per-package dispositions, dependency closure, capability map, maturity and warnings', inputSchema: { type: 'object', properties: { brief: { type: 'string' }, runtime: { type: 'string', enum: ['node-cjs', 'node-esm', 'bare', 'browser', 'unknown'] }, requiredPackages: { type: 'array', items: { type: 'string' } }, suggestedPackages: { type: 'array', items: { type: 'string' } }, optionalPackages: { type: 'array', items: { type: 'string' } }, excludedPackages: { type: 'array', items: { type: 'string' } }, requiredCapabilities: { type: 'array', items: { type: 'string' } } } } },
+    { name: 'scaffold-app', description: 'Generate a structured application file map from a composition plan (generator only; no writes or installs)', inputSchema: { type: 'object', properties: { appName: { type: 'string' }, runtime: { type: 'string', enum: ['node-cjs', 'node-esm'] }, plan: { type: 'object' } }, required: ['plan'] } },
     { name: 'refresh-index', description: 'Rebuild the SDK index from the filesystem (development convenience) and report counts', inputSchema: { type: 'object', properties: {} } },
 ];
 function handleToolCall(name, args, index) {
@@ -36,13 +41,23 @@ function handleToolCall(name, args, index) {
         case 'package-stats': return packageStats(args, index);
         case 'list-exports': return listExports(args, index);
         case 'suggest-template': return suggestTemplate(args);
-        case 'read-source': return readSource(args);
+        case 'read-source': return readSource(args, index);
         case 'list-packages': return listPackages(args, index);
         case 'search-packages': return searchPackages(args, index);
+        case 'inspect-contract': return (0, contracts_js_1.inspectContract)(args, index);
+        case 'plan-composition': return jsonResult((0, composition_js_1.planComposition)(args, index));
+        case 'scaffold-app':
+            if (!args.plan || typeof args.plan !== 'object') {
+                return { content: [{ type: 'text', text: 'plan is required (call plan-composition first)' }], isError: true };
+            }
+            return jsonResult((0, composition_js_1.scaffoldApp)(args, index));
         case 'refresh-index': return refreshIndexTool();
         default: return { content: [{ type: 'text', text: `Unknown tool: ${name}` }], isError: true };
     }
 }
+function jsonResult(value) {
+    return { content: [{ type: 'text', text: JSON.stringify(value, null, 2) }] };
+}
 function refreshIndexTool() {
     const idx = (0, index_store_js_1.refreshIndex)();
     return {
@@ -95,14 +110,25 @@ function searchPackages(args, index) {
             }],
     };
 }
-function readSource(args) {
+function readSource(args, index) {
     const pkg = args.package;
     const file = args.path;
     if (!pkg || !file)
         return { content: [{ type: 'text', text: 'package and path are required' }], isError: true };
     const content = (0, indexer_js_1.readSourceFile)(pkg, file);
     if (content === null) {
-        return { content: [{ type: 'text', text: `Source not found: ${pkg}/src/${file}` }], isError: true };
+        const indexed = index.packages?.[pkg];
+        const contractUri = `totemsdk://packages/${encodeURIComponent(pkg)}/contracts`;
+        return {
+            content: [{
+                    type: 'text',
+                    text: `Source unavailable: ${pkg}/src/${file}. `
+                        + (indexed
+                            ? `This build does not ship implementation source; read the exact contracts at ${contractUri}.`
+                            : `Package '${pkg}' is not in the selected SDK index.`),
+                }],
+            isError: true,
+        };
     }
     return { content: [{ type: 'text', text: content }] };
 }
@@ -207,43 +233,133 @@ function typeEntries(pkg) {
         ...pkg.exports.classes.map(n => ({ name: n, kind: 'class' })),
     ];
 }
+function dependencyEdges(index, name, direction) {
+    const edges = [];
+    const kinds = ['runtime', 'peer', 'optional', 'dev'];
+    if (direction === 'out' || direction === 'all') {
+        const pkg = index.packages[name];
+        for (const kind of kinds) {
+            for (const [to, range] of Object.entries(pkg?.dependencyGroups?.[kind] ?? {})) {
+                edges.push({ from: name, to, kind, range: String(range) });
+            }
+        }
+    }
+    if (direction === 'in' || direction === 'all') {
+        for (const [from, pkg] of Object.entries(index.packages)) {
+            for (const kind of kinds) {
+                const range = pkg.dependencyGroups?.[kind]?.[name];
+                if (range !== undefined)
+                    edges.push({ from, to: name, kind, range: String(range) });
+            }
+        }
+    }
+    return edges;
+}
+function stronglyConnected(index) {
+    const nodes = Object.keys(index.packages);
+    const adjacency = new Map();
+    for (const name of nodes) {
+        const out = new Set();
+        for (const kind of ['runtime', 'peer', 'optional']) {
+            for (const dep of Object.keys(index.packages[name]?.dependencyGroups?.[kind] ?? {})) {
+                if (index.packages[dep])
+                    out.add(dep);
+            }
+        }
+        adjacency.set(name, [...out]);
+    }
+    let counter = 0;
+    const indices = new Map();
+    const low = new Map();
+    const stack = [];
+    const onStack = new Set();
+    const components = [];
+    const visit = (node) => {
+        indices.set(node, counter);
+        low.set(node, counter);
+        counter++;
+        stack.push(node);
+        onStack.add(node);
+        for (const next of adjacency.get(node) ?? []) {
+            if (!indices.has(next)) {
+                visit(next);
+                low.set(node, Math.min(low.get(node), low.get(next)));
+            }
+            else if (onStack.has(next))
+                low.set(node, Math.min(low.get(node), indices.get(next)));
+        }
+        if (low.get(node) === indices.get(node)) {
+            const component = [];
+            let current;
+            do {
+                current = stack.pop();
+                onStack.delete(current);
+                component.push(current);
+            } while (current !== node);
+            if (component.length > 1 || (adjacency.get(node) ?? []).includes(node))
+                components.push(component.sort());
+        }
+    };
+    for (const node of nodes)
+        if (!indices.has(node))
+            visit(node);
+    return components.sort((a, b) => a[0].localeCompare(b[0]));
+}
 function dependencyGraph(args, index) {
     const pkgName = args.package;
     const direction = args.direction || 'out';
     if (!pkgName || !index.packages[pkgName]) {
         return { content: [{ type: 'text', text: `Package '${pkgName}' not found` }], isError: true };
     }
-    const pkg = index.packages[pkgName];
-    if (direction === 'out' || direction === 'all') {
-        const totemDeps = pkg.dependencies.filter(d => d.startsWith('@totemsdk/'));
-        const externalDeps = pkg.dependencies.filter(d => !d.startsWith('@totemsdk/'));
-        return {
-            content: [{
-                    type: 'text',
-                    text: `# ${pkgName} — Outbound Dependencies\n\n` +
-                        (totemDeps.length ? `**@totemsdk/* deps:**\n${totemDeps.map(d => `  - ${d}`).join('\n')}\n\n` : '') +
-                        (externalDeps.length ? `**External deps:**\n${externalDeps.map(d => `  - ${d}`).join('\n')}\n` : '_(no external deps)_'),
-                }],
-        };
+    if (!['in', 'out', 'all'].includes(direction)) {
+        return { content: [{ type: 'text', text: 'Invalid direction. Use "in", "out", or "all".' }], isError: true };
     }
-    if (direction === 'in' || direction === 'all') {
-        const dependents = [];
-        for (const [name, other] of Object.entries(index.packages)) {
-            if (other.dependencies.includes(pkgName))
-                dependents.push(name);
-        }
-        return {
-            content: [{
-                    type: 'text',
-                    text: `# ${pkgName} — Inbound Dependents\n\n` +
-                        (dependents.length ? dependents.map(d => `  - ${d}`).join('\n') : '_(no dependents)_'),
-                }],
-        };
+    const edges = dependencyEdges(index, pkgName, direction);
+    if (args.format === 'json') {
+        return { content: [{ type: 'text', text: JSON.stringify({
+                        package: pkgName,
+                        direction,
+                        edges,
+                        nodes: [...new Set(edges.flatMap((edge) => [edge.from, edge.to]))].sort(),
+                        stronglyConnectedComponents: stronglyConnected(index),
+                    }, null, 2) }] };
     }
-    return { content: [{ type: 'text', text: 'Invalid direction. Use "in", "out", or "all".' }], isError: true };
+    const group = (kind) => {
+        const list = edges.filter((edge) => edge.kind === kind);
+        if (list.length === 0)
+            return '';
+        const heading = direction === 'in' && kind === 'runtime'
+            ? 'Inbound runtime'
+            : `${kind[0].toUpperCase()}${kind.slice(1)}`;
+        return `**${heading}:**\n${list.map((edge) => `  - ${edge.from} → ${edge.to} (${edge.range})`).join('\n')}\n`;
+    };
+    return { content: [{ type: 'text', text: `# ${pkgName} — Dependencies (${direction})\n\n` +
+                    (['runtime', 'peer', 'optional', 'dev'].map(group).filter(Boolean).join('\n') || '_(none)_') }] };
+}
+function hasExportPath(exportsMap, subpath, condition) {
+    if (!exportsMap)
+        return subpath === '.';
+    const value = exportsMap[subpath];
+    if (value === undefined)
+        return false;
+    if (condition === undefined)
+        return true;
+    const visit = (node) => {
+        if (typeof node === 'string' || node === null)
+            return true;
+        if (Array.isArray(node))
+            return node.some(visit);
+        if (typeof node !== 'object')
+            return false;
+        const record = node;
+        if (record[condition] !== undefined)
+            return true;
+        return false;
+    };
+    return visit(value);
 }
 function validateImport(args, index) {
-    const { from: fromPkg, to: toPkg, symbol } = args;
+    const { from: fromPkg, to: toPkg, symbol, subpath, condition } = args;
     if (!fromPkg || !toPkg) {
         return { content: [{ type: 'text', text: 'from and to package names are required' }], isError: true };
     }
@@ -253,33 +369,43 @@ function validateImport(args, index) {
         return { content: [{ type: 'text', text: `Source package '${fromPkg}' not found` }], isError: true };
     if (!toPkgData)
         return { content: [{ type: 'text', text: `Target package '${toPkg}' not found` }], isError: true };
-    const hasDep = fromPkgData.dependencies.includes(toPkg);
-    const result = { valid: hasDep, importPath: toPkg, symbolFound: false };
-    if (hasDep) {
-        if (symbol) {
-            const allExports = [
-                ...toPkgData.exports.functions,
-                ...toPkgData.exports.types,
-                ...toPkgData.exports.classes,
-                ...toPkgData.exports.interfaces,
-                ...toPkgData.exports.consts,
-            ];
-            result.symbolFound = allExports.includes(symbol);
-            if (!result.symbolFound) {
-                result.valid = false;
-                result.reason = `'${toPkg}' does not export '${symbol}'`;
-            }
+    let dependencyKind = 'none';
+    for (const kind of ['runtime', 'peer', 'optional', 'dev']) {
+        if (fromPkgData.dependencyGroups?.[kind]?.[toPkg] !== undefined) {
+            dependencyKind = kind;
+            break;
         }
     }
-    else {
+    const result = {
+        valid: dependencyKind !== 'none' && dependencyKind !== 'dev',
+        importPath: subpath ? `${toPkg}/${subpath.replace(/^\.\//, '')}` : toPkg,
+        symbolFound: false,
+        dependencyKind,
+        ...(subpath ? { subpath } : {}),
+        ...(condition ? { condition } : {}),
+    };
+    if (dependencyKind === 'none')
         result.reason = `'${fromPkg}' does not depend on '${toPkg}'`;
+    else if (dependencyKind === 'dev')
+        result.reason = `'${toPkg}' is a development-only dependency of '${fromPkg}'`;
+    if (result.valid && subpath) {
+        if (!hasExportPath(toPkgData.exportsMap, subpath, condition)) {
+            result.valid = false;
+            result.reason = `'${toPkg}' does not export subpath '${subpath}'${condition ? ` under condition '${condition}'` : ''}`;
+        }
     }
-    return {
-        content: [{
-                type: 'text',
-                text: JSON.stringify(result, null, 2),
-            }],
-    };
+    if (result.valid && symbol) {
+        const allExports = [
+            ...toPkgData.exports.functions, ...toPkgData.exports.types, ...toPkgData.exports.classes,
+            ...toPkgData.exports.interfaces, ...toPkgData.exports.consts,
+        ];
+        result.symbolFound = allExports.includes(symbol);
+        if (!result.symbolFound) {
+            result.valid = false;
+            result.reason = `'${toPkg}' does not export '${symbol}'`;
+        }
+    }
+    return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] };
 }
 function scaffoldAdapter(args) {
     const { name, protocol, commands } = args;
@@ -399,7 +525,7 @@ function scaffoldPackage(args) {
                 },
             },
             scripts: { build: 'tsc', clean: 'rm -rf dist', test: 'jest --passWithNoTests' },
-            files: ['dist', 'README.md', 'LICENSE'],
+            files: ['dist', 'README.md', 'LICENSE', 'NOTICE'],
             dependencies: Object.fromEntries(depList.map(d => [d, '^0.1.0'])),
             devDependencies: {
                 '@types/jest': '^30.0.0',
@@ -408,9 +534,20 @@ function scaffoldPackage(args) {
                 typescript: '^7.0.2',
             },
             publishConfig: { access: 'public' },
-            license: 'MIT',
+            license: 'Apache-2.0',
         }, null, 2),
     });
+    files.push({
+        path: `NOTICE`,
+        content: [
+            `Totem SDK`,
+            `Copyright 2024-2026 Totem SDK Contributors`,
+            ``,
+            `This package is licensed under the Apache License, Version 2.0.`,
+            `See LICENSE and the repository NOTICE for third-party attributions.`,
+            ``,
+        ].join('\n'),
+    });
     files.push({
         path: `tsconfig.json`,
         content: JSON.stringify({

package/dist/types.d.ts

@@ -1,3 +1,10 @@
+export type DependencyKind = 'runtime' | 'peer' | 'optional' | 'dev';
+export interface DependencyEdge {
+    from: string;
+    to: string;
+    kind: DependencyKind;
+    range: string;
+}
 export interface PackageIndex {
     name: string;
     dir: string;
@@ -6,6 +13,10 @@ export interface PackageIndex {
     keywords?: string[];
     dependencies: string[];
     devDependencies: string[];
+    /** Declared dependency groups with ranges, when known. */
+    dependencyGroups?: Partial<Record<DependencyKind, Record<string, string>>>;
+    /** Package.json export subpaths and their runtime conditions. */
+    exportsMap?: Record<string, unknown>;
     hasRust: boolean;
     hasGo: boolean;
     hasTests: boolean;
@@ -15,6 +26,8 @@ export interface PackageIndex {
         [name: string]: SymbolMeta;
     };
     domain: string;
+    /** Sourced maturity label from the workspace gate, when known. */
+    maturity?: string;
 }
 export interface PackageExports {
     functions: string[];
@@ -43,7 +56,25 @@ export interface SymbolEntry {
 export interface DomainMap {
     [domain: string]: string[];
 }
+export interface IndexCoverage {
+    /** Entries in the selected catalogue (SDK_MANIFEST.json). */
+    manifestCount: number;
+    /** Package directories discovered in the workspace. */
+    discoveredCount: number;
+    /** Catalogue entries with no indexed package. */
+    missingFromIndex: string[];
+    /** Indexed packages not declared in the catalogue. */
+    extraInIndex: string[];
+}
 export interface SdkIndex {
+    /** Index schema version; bump when consumers must adapt. */
+    schemaVersion?: number;
+    /** Where this index came from. */
+    source?: 'monorepo' | 'bundled';
+    /** Git revision of the scanned workspace, when known. */
+    sourceRevision?: string;
+    /** Catalogue/index coverage reconciliation. */
+    coverage?: IndexCoverage;
     generatedAt: number;
     packages: {
         [name: string]: PackageIndex;
@@ -69,6 +100,9 @@ export interface ValidImportResult {
     valid: boolean;
     importPath?: string;
     symbolFound?: boolean;
+    dependencyKind?: 'runtime' | 'peer' | 'optional' | 'dev' | 'none';
+    subpath?: string;
+    condition?: string;
     reason?: string;
 }
 export interface ScaffoldResult {

package/dist/workflow.d.ts

@@ -0,0 +1,36 @@
+/** Verified workflow assembly for generated applications. */
+import type { SdkIndex } from './types.js';
+export type WorkflowStepKind = 'code' | 'host-port' | 'unresolved';
+export interface WorkflowStep {
+    id: string;
+    capability: string;
+    package: string;
+    contract: string;
+    kind: WorkflowStepKind;
+    authority: 'none' | 'signature' | 'policy' | 'human' | 'provider';
+    fixture?: string;
+    dependsOn?: string[];
+    limitations?: string[];
+}
+export interface WorkflowPlan {
+    steps: WorkflowStep[];
+    hostPorts: string[];
+    fixtures: string[];
+    acceptance: string[];
+    unresolved: string[];
+}
+export interface AdapterTemplate {
+    capability: string;
+    contract: string;
+    imports: string[];
+    body: string[];
+    authority?: WorkflowStep['authority'];
+    fixture?: string;
+}
+export declare function getWorkflowAdapter(packageName: string): AdapterTemplate | null;
+export declare function buildWorkflow(input: {
+    directDependencies: string[];
+    maturity: Record<string, string>;
+    requiredCapabilities: string[];
+    index: SdkIndex;
+}): WorkflowPlan;

package/dist/workflow.js

@@ -0,0 +1,200 @@
+"use strict";
+/** Verified workflow assembly for generated applications. */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getWorkflowAdapter = getWorkflowAdapter;
+exports.buildWorkflow = buildWorkflow;
+const ADAPTERS = {
+    '@totemsdk/core': {
+        capability: 'hashing',
+        contract: '@totemsdk/core#sha3_256',
+        imports: ["const { sha3_256, toHex } = await import('@totemsdk/core');"],
+        body: ["return toHex(sha3_256(new TextEncoder().encode('workflow-step')));"],
+    },
+    '@totemsdk/edge': {
+        capability: 'edge device',
+        contract: '@totemsdk/edge#createEdgeDevice',
+        imports: ["const { createEdgeDevice } = await import('@totemsdk/edge');"],
+        body: ["return createEdgeDevice({ kind: 'device' }).deviceId;"],
+        fixture: 'edge-device fixture',
+    },
+    '@totemsdk/proofgraph': {
+        capability: 'evidence graph',
+        contract: '@totemsdk/proofgraph#createProofGraph',
+        imports: ["const { createProofGraph } = await import('@totemsdk/proofgraph');"],
+        body: ["return createProofGraph({ workflow: true }).graphId;"],
+        authority: 'signature',
+    },
+    '@totemsdk/storage': {
+        capability: 'artifact storage',
+        contract: '@totemsdk/storage/artifacts#ArtifactStore.put',
+        imports: [
+            "const { ArtifactStore } = await import('@totemsdk/storage/artifacts');",
+            "const { LocalFileBackend } = await import('@totemsdk/storage/artifacts/local-fs-backend');",
+        ],
+        body: [
+            "const store = new ArtifactStore(new LocalFileBackend('./artifacts'));",
+            "const receipt = await store.put('workflow', new TextEncoder().encode('artifact'));",
+            "return receipt.ref.digest;",
+        ],
+    },
+    '@totemsdk/replication': {
+        capability: 'replica freshness',
+        contract: '@totemsdk/replication#readReplicated',
+        imports: ["const { readReplicated } = await import('@totemsdk/replication');"],
+        body: [
+            "const result = await readReplicated('workflow', {",
+            "  readReplica: async () => ({ value: 'replica', complete: true, observedAt: Date.now() }),",
+            '});',
+            'return `${result.source}:${result.freshness}`;',
+        ],
+    },
+    '@totemsdk/manifest': {
+        capability: 'signed manifest',
+        contract: '@totemsdk/manifest#createAnnouncement',
+        imports: ["const { createAnnouncement } = await import('@totemsdk/manifest');"],
+        body: [
+            'const announcement = createAnnouncement({',
+            "  kind: 'service',",
+            "  subjectId: 'workflow',",
+            "  subjectHash: '0x' + '11'.repeat(32),",
+            "  publisher: 'MxWorkflowPublisher',",
+            '  sequence: 1,',
+            '  createdAt: Date.now(),',
+            '  expiresAt: Date.now() + 86_400_000,',
+            "  topics: ['totemsdk:workflow'],",
+            "  nonce: 'workflow',",
+            '});',
+            'return announcement.announcementId;',
+        ],
+        authority: 'signature',
+    },
+    '@totemsdk/identity': {
+        capability: 'identity binding',
+        contract: '@totemsdk/identity#createIdentityDocument',
+        imports: ["const { createIdentityDocument } = await import('@totemsdk/identity');"],
+        body: [
+            'const document = createIdentityDocument({',
+            "  kind: 'service',",
+            "  rootAddress: 'MxWorkflowRoot',",
+            "  controllerAddress: 'MxWorkflowRoot',",
+            '});',
+            'return document.id;',
+        ],
+        authority: 'signature',
+    },
+    '@totemsdk/governance': {
+        capability: 'governance decision',
+        contract: '@totemsdk/governance#createGovernanceConfig',
+        imports: ["const { createGovernanceConfig } = await import('@totemsdk/governance');"],
+        body: [
+            'const config = createGovernanceConfig({',
+            "  daoId: 'workflow',",
+            "  name: 'workflow',",
+            "  voting: { algorithm: 'linear', quorumBps: 5000, passThresholdBps: 5000, votingPeriodMs: 86_400_000 },",
+            '  membership: {},',
+            "  authorityScope: 'workflow',",
+            "  authorityResolver: 'workflow',",
+            '});',
+            'return config.daoId;',
+        ],
+        authority: 'policy',
+    },
+    '@totemsdk/omnia': {
+        capability: 'payment channel',
+        contract: '@totemsdk/omnia#buildEltooScript',
+        imports: ["const { buildEltooScript } = await import('@totemsdk/omnia');"],
+        body: [
+            'return buildEltooScript([',
+            "  { partyId: 'a', publicKeyDigest: '11'.repeat(32), addressIndex: 0 },",
+            "  { partyId: 'b', publicKeyDigest: '22'.repeat(32), addressIndex: 0 },",
+            ']);',
+        ],
+        authority: 'policy',
+        fixture: 'channel participants fixture',
+    },
+};
+const HOST_PORTS = {
+    '@totemsdk/agent-policy': 'wallet policy/approval port',
+    '@totemsdk/authority': 'authority verification port',
+    '@totemsdk/proof': 'proof verification port',
+    '@totemsdk/qvac': 'QVAC runtime/model host',
+    '@totemsdk/edge-mqtt': 'MQTT broker',
+    '@totemsdk/edge-modbus': 'Modbus endpoint',
+    '@totemsdk/edge-opcua': 'OPC-UA endpoint',
+    '@totemsdk/edge-bacnet': 'BACnet endpoint',
+    '@totemsdk/edge-lorawan': 'LoRaWAN gateway',
+    '@totemsdk/edge-ble': 'BLE host',
+    '@totemsdk/edge-ros2': 'ROS 2 host',
+    '@totemsdk/omnia-relay': 'Omnia relay URL',
+    '@totemsdk/lookup-client': 'lookup node endpoint',
+};
+function getWorkflowAdapter(packageName) {
+    return ADAPTERS[packageName] ?? null;
+}
+function buildWorkflow(input) {
+    const steps = [];
+    const hostPorts = new Set();
+    const fixtures = new Set();
+    const unresolved = new Set();
+    for (const [index, pkg] of input.directDependencies.entries()) {
+        const adapter = ADAPTERS[pkg];
+        if (adapter) {
+            steps.push({
+                id: `step-${index + 1}`,
+                capability: adapter.capability,
+                package: pkg,
+                contract: adapter.contract,
+                kind: 'code',
+                authority: adapter.authority ?? 'none',
+                ...(adapter.fixture ? { fixture: adapter.fixture } : {}),
+                ...(index > 0 ? { dependsOn: [`step-${index}`] } : {}),
+            });
+            if (adapter.fixture)
+                fixtures.add(adapter.fixture);
+            continue;
+        }
+        if (HOST_PORTS[pkg]) {
+            hostPorts.add(`${pkg}: ${HOST_PORTS[pkg]}`);
+            steps.push({
+                id: `step-${index + 1}`,
+                capability: HOST_PORTS[pkg],
+                package: pkg,
+                contract: 'host-supplied port',
+                kind: 'host-port',
+                authority: 'provider',
+                ...(index > 0 ? { dependsOn: [`step-${index}`] } : {}),
+            });
+            continue;
+        }
+        unresolved.add(pkg);
+        steps.push({
+            id: `step-${index + 1}`,
+            capability: 'unresolved package workflow',
+            package: pkg,
+            contract: 'no verified adapter in the MCP catalogue',
+            kind: 'unresolved',
+            authority: 'none',
+            limitations: ['No verified workflow adapter for this package.'],
+        });
+    }
+    if (steps.length === 0) {
+        steps.push({
+            id: 'step-1',
+            capability: 'composition',
+            package: 'none',
+            contract: 'no direct packages selected',
+            kind: 'unresolved',
+            authority: 'none',
+            limitations: ['Select a composition before generating a workflow.'],
+        });
+    }
+    const acceptance = [
+        'Generated app installs and typechecks with the pinned dependency set.',
+        'The workflow executes every code step and reports fixture/host-port steps explicitly.',
+        'At least one negative or unauthorized input is rejected by the selected policy boundary.',
+    ];
+    if (input.requiredCapabilities.some((capability) => /evidence|proof/i.test(capability))) {
+        acceptance.push('Tampered evidence is rejected, not treated as a valid attestation.');
+    }
+    return { steps, hostPorts: [...hostPorts], fixtures: [...fixtures], acceptance, unresolved: [...unresolved] };
+}