flowdular 0.2.4 → 0.3.1

package/dist/distribution.js

@@ -534,7 +534,7 @@ var require_inc = __commonJS({
   "../../node_modules/.pnpm/semver@7.7.4/node_modules/semver/functions/inc.js"(exports, module) {
     "use strict";
     var SemVer = require_semver();
-    var inc = (version, release, options, identifier2, identifierBase) => {
+    var inc2 = (version, release, options, identifier2, identifierBase) => {
       if (typeof options === "string") {
         identifierBase = identifier2;
         identifier2 = options;
@@ -549,7 +549,7 @@ var require_inc = __commonJS({
         return null;
       }
     };
-    module.exports = inc;
+    module.exports = inc2;
   }
 });
 
@@ -1874,7 +1874,7 @@ var require_semver2 = __commonJS({
     var parse = require_parse();
     var valid2 = require_valid();
     var clean = require_clean();
-    var inc = require_inc();
+    var inc2 = require_inc();
     var diff = require_diff();
     var major = require_major();
     var minor = require_minor();
@@ -1912,7 +1912,7 @@ var require_semver2 = __commonJS({
       parse,
       valid: valid2,
       clean,
-      inc,
+      inc: inc2,
       diff,
       major,
       minor,
@@ -1974,132 +1974,12 @@ var RegistryError = class extends Error {
   }
 };
 
+// ../kernel/src/acl.ts
+var ALLOWED = Object.freeze({ allowed: true });
+var NO_POLICIES = Object.freeze([]);
+
 // ../kernel/src/module-compatibility.ts
 var import_semver = __toESM(require_semver2(), 1);
-var PLATFORM_API_VERSION = "0.1.0";
-function satisfiesModuleVersion(version, range) {
-  return (0, import_semver.valid)(version) !== null && (0, import_semver.validRange)(range) !== null && (0, import_semver.satisfies)(version, range);
-}
-function compareModuleVersions(left, right) {
-  return (0, import_semver.rcompare)(left, right);
-}
-function assertModuleCompatibility(manifest, platformVersion = PLATFORM_API_VERSION) {
-  if (!(0, import_semver.valid)(manifest.version))
-    throw new RegistryError(
-      "MODULE_VERSION_INVALID",
-      `Invalid version for ${manifest.id}: ${manifest.version}`
-    );
-  if (manifest.platformApi !== void 0 && (!(0, import_semver.validRange)(manifest.platformApi) || platformVersion !== null && !satisfiesModuleVersion(platformVersion, manifest.platformApi))) {
-    throw new RegistryError(
-      "MODULE_PLATFORM_INCOMPATIBLE",
-      `${manifest.id} requires platform API ${manifest.platformApi}; available ${PLATFORM_API_VERSION}.`
-    );
-  }
-  const ids = /* @__PURE__ */ new Set();
-  for (const dependency of manifest.dependencies) {
-    if (!dependency.range.trim() || !(0, import_semver.validRange)(dependency.range))
-      throw new RegistryError(
-        "MODULE_RANGE_INVALID",
-        `${manifest.id} declares an invalid range for ${dependency.id}: ${dependency.range}`
-      );
-    if (ids.has(dependency.id))
-      throw new RegistryError(
-        "MODULE_DEPENDENCY_DUPLICATE",
-        `${manifest.id} declares ${dependency.id} more than once.`
-      );
-    ids.add(dependency.id);
-  }
-}
-function assertModuleDependency(consumer, dependency, version) {
-  if (!satisfiesModuleVersion(version, dependency.range)) {
-    throw new RegistryError(
-      "MODULE_DEPENDENCY_INCOMPATIBLE",
-      `${consumer} requires ${dependency.id} ${dependency.range}; available ${version}.`
-    );
-  }
-}
-
-// ../kernel/src/module-registry.ts
-function compareModules(left, right) {
-  return left.manifest.id.localeCompare(right.manifest.id);
-}
-function visitModule(id, modules, visiting, visited, ordered) {
-  if (visited.has(id)) return;
-  if (visiting.has(id)) {
-    throw new RegistryError(
-      "MODULE_DEPENDENCY_CYCLE",
-      `Dependency cycle detected at "${id}".`
-    );
-  }
-  const current = modules.get(id);
-  if (!current) {
-    throw new RegistryError(
-      "MODULE_NOT_FOUND",
-      `Module "${id}" is not registered.`
-    );
-  }
-  visiting.add(id);
-  for (const dependency of [...current.manifest.dependencies].sort(
-    (a, b) => a.id.localeCompare(b.id)
-  )) {
-    if (!modules.has(dependency.id)) {
-      throw new RegistryError(
-        "MODULE_DEPENDENCY_MISSING",
-        `Module "${id}" requires missing module "${dependency.id}".`
-      );
-    }
-    assertModuleDependency(
-      id,
-      dependency,
-      modules.get(dependency.id).manifest.version
-    );
-    visitModule(dependency.id, modules, visiting, visited, ordered);
-  }
-  visiting.delete(id);
-  visited.add(id);
-  ordered.push(current);
-}
-function createModuleRegistry(input) {
-  const byId = /* @__PURE__ */ new Map();
-  const navigationIds = /* @__PURE__ */ new Set();
-  for (const module of input) {
-    assertModuleCompatibility(module.manifest);
-    if (byId.has(module.manifest.id)) {
-      throw new RegistryError(
-        "MODULE_DUPLICATE",
-        `Module "${module.manifest.id}" is registered more than once.`
-      );
-    }
-    byId.set(module.manifest.id, module);
-    for (const item of module.navigation ?? []) {
-      if (navigationIds.has(item.id)) {
-        throw new RegistryError(
-          "NAVIGATION_DUPLICATE",
-          `Navigation contribution "${item.id}" is registered more than once.`
-        );
-      }
-      navigationIds.add(item.id);
-    }
-  }
-  const ordered = [];
-  const visiting = /* @__PURE__ */ new Set();
-  const visited = /* @__PURE__ */ new Set();
-  for (const module of [...input].sort(compareModules)) {
-    visitModule(module.manifest.id, byId, visiting, visited, ordered);
-  }
-  return Object.freeze({
-    modules: Object.freeze(ordered),
-    get: (id) => byId.get(id),
-    has: (id) => byId.has(id),
-    navigation: (permissions) => Object.freeze(
-      ordered.flatMap((module) => module.navigation ?? []).filter(
-        (item) => !item.permission || permissions?.has(item.permission)
-      ).sort(
-        (left, right) => (left.order ?? 1e3) - (right.order ?? 1e3) || left.id.localeCompare(right.id)
-      )
-    )
-  });
-}
 
 // ../contracts/schemas/blueprint.schema.json
 var blueprint_schema_default = {
@@ -2315,6 +2195,31 @@ var module_schema_default = {
         }
       }
     },
+    provides: {
+      type: "array",
+      items: {
+        type: "string",
+        pattern: "^[a-z][a-z0-9-]*(\\.[a-z][a-z0-9-]*)+$"
+      },
+      uniqueItems: true
+    },
+    requires: {
+      type: "array",
+      items: {
+        type: "object",
+        additionalProperties: false,
+        required: ["id"],
+        properties: {
+          id: {
+            type: "string",
+            pattern: "^[a-z][a-z0-9-]*(\\.[a-z][a-z0-9-]*)+$"
+          },
+          optional: {
+            type: "boolean"
+          }
+        }
+      }
+    },
     tenancy: {
       enum: ["required", "optional", "none"]
     },
@@ -2422,7 +2327,7 @@ var module_spec_schema_default = {
   ],
   properties: {
     $schema: { type: "string" },
-    schemaVersion: { const: 1 },
+    schemaVersion: { enum: [1, 2] },
     id: {
       type: "string",
       pattern: "^[a-z][a-z0-9-]*(\\.[a-z][a-z0-9-]*)+$"
@@ -2463,6 +2368,29 @@ var module_spec_schema_default = {
         }
       }
     },
+    provides: {
+      type: "array",
+      items: {
+        type: "string",
+        pattern: "^[a-z][a-z0-9-]*(\\.[a-z][a-z0-9-]*)+$"
+      },
+      uniqueItems: true
+    },
+    requires: {
+      type: "array",
+      items: {
+        type: "object",
+        additionalProperties: false,
+        required: ["id"],
+        properties: {
+          id: {
+            type: "string",
+            pattern: "^[a-z][a-z0-9-]*(\\.[a-z][a-z0-9-]*)+$"
+          },
+          optional: { type: "boolean" }
+        }
+      }
+    },
     tenancy: { enum: ["required", "optional", "none"] },
     locales: {
       type: "array",
@@ -2510,6 +2438,269 @@ var module_spec_schema_default = {
         }
       },
       uniqueItems: true
+    },
+    entities: {
+      type: "array",
+      items: { $ref: "#/$defs/entity" },
+      uniqueItems: true
+    },
+    screens: {
+      type: "array",
+      items: { $ref: "#/$defs/screen" },
+      uniqueItems: true
+    },
+    actions: {
+      type: "array",
+      items: { $ref: "#/$defs/action" },
+      uniqueItems: true
+    },
+    widgets: {
+      type: "array",
+      items: { $ref: "#/$defs/widget" },
+      uniqueItems: true
+    },
+    settings: {
+      type: "array",
+      items: { $ref: "#/$defs/setting" },
+      uniqueItems: true
+    },
+    agentTools: {
+      type: "array",
+      items: { $ref: "#/$defs/agentTool" },
+      uniqueItems: true
+    },
+    outOfScope: {
+      type: "array",
+      items: { type: "string", minLength: 1 },
+      uniqueItems: true
+    },
+    decisions: {
+      type: "array",
+      items: { $ref: "#/$defs/decision" },
+      uniqueItems: true
+    }
+  },
+  allOf: [
+    {
+      if: {
+        required: ["schemaVersion"],
+        properties: { schemaVersion: { const: 1 } }
+      },
+      then: {
+        properties: {
+          entities: false,
+          screens: false,
+          actions: false,
+          widgets: false,
+          settings: false,
+          agentTools: false,
+          outOfScope: false,
+          decisions: false
+        }
+      }
+    }
+  ],
+  $defs: {
+    entityId: { type: "string", pattern: "^[a-z][a-z0-9-]*$" },
+    fieldId: { type: "string", pattern: "^[a-z][a-zA-Z0-9]*$" },
+    enumValue: { type: "string", pattern: "^[a-z][a-z0-9_-]*$" },
+    entity: {
+      type: "object",
+      additionalProperties: false,
+      required: ["id", "name", "fields"],
+      properties: {
+        id: { $ref: "#/$defs/entityId" },
+        name: { type: "string", minLength: 1 },
+        description: { type: "string", minLength: 1 },
+        fields: {
+          type: "array",
+          minItems: 1,
+          items: { $ref: "#/$defs/field" },
+          uniqueItems: true
+        },
+        states: {
+          type: "object",
+          additionalProperties: false,
+          required: ["field", "values"],
+          properties: {
+            field: { $ref: "#/$defs/fieldId" },
+            values: {
+              type: "array",
+              minItems: 1,
+              items: { $ref: "#/$defs/enumValue" },
+              uniqueItems: true
+            },
+            transitions: {
+              type: "array",
+              items: {
+                type: "object",
+                additionalProperties: false,
+                required: ["from", "to"],
+                properties: {
+                  from: { type: "string", minLength: 1 },
+                  to: { type: "string", minLength: 1 },
+                  permission: { type: "string", minLength: 1 }
+                }
+              },
+              uniqueItems: true
+            }
+          }
+        }
+      }
+    },
+    field: {
+      type: "object",
+      additionalProperties: false,
+      required: ["id", "type"],
+      properties: {
+        id: { $ref: "#/$defs/fieldId" },
+        type: {
+          enum: [
+            "string",
+            "text",
+            "integer",
+            "decimal",
+            "boolean",
+            "date",
+            "datetime",
+            "enum",
+            "reference",
+            "json"
+          ]
+        },
+        required: { type: "boolean" },
+        unique: { enum: ["tenant", "none"] },
+        maxLength: { type: "integer", minimum: 1 },
+        values: {
+          type: "array",
+          minItems: 1,
+          items: { $ref: "#/$defs/enumValue" },
+          uniqueItems: true
+        },
+        reference: {
+          type: "string",
+          pattern: "^[a-z][a-z0-9-]*(\\.[a-z][a-z0-9-]*)*$"
+        },
+        description: { type: "string", minLength: 1 }
+      }
+    },
+    screen: {
+      type: "object",
+      additionalProperties: false,
+      required: ["id", "kind"],
+      properties: {
+        id: { $ref: "#/$defs/entityId" },
+        kind: { enum: ["list", "record", "form", "dashboard"] },
+        entity: { $ref: "#/$defs/entityId" },
+        title: { type: "string", minLength: 1 },
+        columns: {
+          type: "array",
+          items: { $ref: "#/$defs/fieldId" },
+          uniqueItems: true
+        },
+        filters: {
+          type: "array",
+          items: { $ref: "#/$defs/fieldId" },
+          uniqueItems: true
+        },
+        navigationGroup: { type: "string", minLength: 1 }
+      }
+    },
+    action: {
+      type: "object",
+      additionalProperties: false,
+      required: [
+        "id",
+        "permission",
+        "kind",
+        "risk",
+        "idempotent",
+        "description"
+      ],
+      properties: {
+        id: { $ref: "#/$defs/entityId" },
+        entity: { $ref: "#/$defs/entityId" },
+        permission: {
+          type: "string",
+          pattern: "^[a-z][a-z0-9-]*(\\.[a-z][a-z0-9-]*)+$"
+        },
+        kind: { enum: ["create", "update", "delete", "custom"] },
+        risk: {
+          enum: ["read", "workspace-write", "external", "destructive"]
+        },
+        idempotent: { type: "boolean" },
+        description: { type: "string", minLength: 1 }
+      }
+    },
+    widget: {
+      type: "object",
+      additionalProperties: false,
+      required: ["id", "slot", "description"],
+      properties: {
+        id: { $ref: "#/$defs/entityId" },
+        slot: {
+          enum: [
+            "dashboard.metrics",
+            "dashboard.main",
+            "dashboard.aside",
+            "topbar.actions"
+          ]
+        },
+        entity: { $ref: "#/$defs/entityId" },
+        description: { type: "string", minLength: 1 }
+      }
+    },
+    setting: {
+      type: "object",
+      additionalProperties: false,
+      required: ["key", "type", "scope", "description"],
+      properties: {
+        key: { $ref: "#/$defs/fieldId" },
+        type: { enum: ["string", "integer", "boolean", "enum"] },
+        scope: { enum: ["tenant", "platform"] },
+        default: {
+          oneOf: [
+            { type: "string" },
+            { type: "integer" },
+            { type: "boolean" }
+          ]
+        },
+        values: {
+          type: "array",
+          minItems: 1,
+          items: { type: "string", minLength: 1 },
+          uniqueItems: true
+        },
+        description: { type: "string", minLength: 1 }
+      }
+    },
+    agentTool: {
+      type: "object",
+      additionalProperties: false,
+      required: ["id", "permission", "description", "risk"],
+      properties: {
+        id: {
+          type: "string",
+          pattern: "^[a-z][a-z0-9-]*(\\.[a-z][a-z0-9-]*)+$"
+        },
+        permission: {
+          type: "string",
+          pattern: "^[a-z][a-z0-9-]*(\\.[a-z][a-z0-9-]*)+$"
+        },
+        description: { type: "string", minLength: 1 },
+        risk: { enum: ["read", "workspace-write"] }
+      }
+    },
+    decision: {
+      type: "object",
+      additionalProperties: false,
+      required: ["id", "question", "answer", "decidedBy"],
+      properties: {
+        id: { type: "string", pattern: "^[A-Z][A-Z0-9-]+$" },
+        question: { type: "string", minLength: 1 },
+        answer: { type: "string", minLength: 1 },
+        decidedBy: { enum: ["user", "default"] }
+      }
     }
   }
 };
@@ -2923,6 +3114,172 @@ var projectSchema = project_schema_default;
 var moduleCatalogSchema = module_catalog_schema_default;
 var moduleArtifactSchema = module_artifact_schema_default;
 
+// ../contracts/src/index.ts
+var PLATFORM_API_VERSION = "0.1.8";
+
+// ../kernel/src/module-compatibility.ts
+function satisfiesModuleVersion(version, range) {
+  return (0, import_semver.valid)(version) !== null && (0, import_semver.validRange)(range) !== null && (0, import_semver.satisfies)(version, range);
+}
+function compareModuleVersions(left, right) {
+  return (0, import_semver.rcompare)(left, right);
+}
+function assertModuleCompatibility(manifest, platformVersion = PLATFORM_API_VERSION) {
+  if (!(0, import_semver.valid)(manifest.version))
+    throw new RegistryError(
+      "MODULE_VERSION_INVALID",
+      `Invalid version for ${manifest.id}: ${manifest.version}`
+    );
+  if (manifest.platformApi !== void 0 && (!(0, import_semver.validRange)(manifest.platformApi) || platformVersion !== null && !satisfiesModuleVersion(platformVersion, manifest.platformApi))) {
+    throw new RegistryError(
+      "MODULE_PLATFORM_INCOMPATIBLE",
+      `${manifest.id} requires platform API ${manifest.platformApi}; available ${PLATFORM_API_VERSION}.`
+    );
+  }
+  const ids = /* @__PURE__ */ new Set();
+  for (const dependency of manifest.dependencies) {
+    if (!dependency.range.trim() || !(0, import_semver.validRange)(dependency.range))
+      throw new RegistryError(
+        "MODULE_RANGE_INVALID",
+        `${manifest.id} declares an invalid range for ${dependency.id}: ${dependency.range}`
+      );
+    if (ids.has(dependency.id))
+      throw new RegistryError(
+        "MODULE_DEPENDENCY_DUPLICATE",
+        `${manifest.id} declares ${dependency.id} more than once.`
+      );
+    ids.add(dependency.id);
+  }
+}
+function assertModuleDependency(consumer, dependency, version) {
+  if (!satisfiesModuleVersion(version, dependency.range)) {
+    throw new RegistryError(
+      "MODULE_DEPENDENCY_INCOMPATIBLE",
+      `${consumer} requires ${dependency.id} ${dependency.range}; available ${version}.`
+    );
+  }
+}
+
+// ../kernel/src/module-registry.ts
+function compareModules(left, right) {
+  return left.manifest.id.localeCompare(right.manifest.id);
+}
+function capabilityProviders(modules) {
+  const providers = /* @__PURE__ */ new Map();
+  for (const module of modules) {
+    for (const capability of module.manifest.provides ?? []) {
+      const existing = providers.get(capability);
+      if (existing && existing !== module.manifest.id) {
+        throw new RegistryError(
+          "MODULE_CAPABILITY_DUPLICATE",
+          `Capability "${capability}" is provided by both "${existing}" and "${module.manifest.id}".`
+        );
+      }
+      providers.set(capability, module.manifest.id);
+    }
+  }
+  return providers;
+}
+function visitModule(id, modules, providers, visiting, visited, ordered) {
+  if (visited.has(id)) return;
+  if (visiting.has(id)) {
+    throw new RegistryError(
+      "MODULE_DEPENDENCY_CYCLE",
+      `Dependency cycle detected at "${id}".`
+    );
+  }
+  const current = modules.get(id);
+  if (!current) {
+    throw new RegistryError(
+      "MODULE_NOT_FOUND",
+      `Module "${id}" is not registered.`
+    );
+  }
+  visiting.add(id);
+  for (const dependency of [...current.manifest.dependencies].sort(
+    (a, b) => a.id.localeCompare(b.id)
+  )) {
+    if (!modules.has(dependency.id)) {
+      throw new RegistryError(
+        "MODULE_DEPENDENCY_MISSING",
+        `Module "${id}" requires missing module "${dependency.id}".`
+      );
+    }
+    assertModuleDependency(
+      id,
+      dependency,
+      modules.get(dependency.id).manifest.version
+    );
+    visitModule(dependency.id, modules, providers, visiting, visited, ordered);
+  }
+  for (const requirement of [...current.manifest.requires ?? []].sort(
+    (a, b) => a.id.localeCompare(b.id)
+  )) {
+    if (requirement.optional) continue;
+    const provider = providers.get(requirement.id);
+    if (!provider) {
+      throw new RegistryError(
+        "MODULE_CAPABILITY_MISSING",
+        `Module "${id}" requires capability "${requirement.id}" and no registered module provides it.`
+      );
+    }
+    if (provider === id) continue;
+    visitModule(provider, modules, providers, visiting, visited, ordered);
+  }
+  visiting.delete(id);
+  visited.add(id);
+  ordered.push(current);
+}
+function createModuleRegistry(input) {
+  const byId = /* @__PURE__ */ new Map();
+  const navigationIds = /* @__PURE__ */ new Set();
+  for (const module of input) {
+    assertModuleCompatibility(module.manifest);
+    if (byId.has(module.manifest.id)) {
+      throw new RegistryError(
+        "MODULE_DUPLICATE",
+        `Module "${module.manifest.id}" is registered more than once.`
+      );
+    }
+    byId.set(module.manifest.id, module);
+    for (const item of module.navigation ?? []) {
+      if (navigationIds.has(item.id)) {
+        throw new RegistryError(
+          "NAVIGATION_DUPLICATE",
+          `Navigation contribution "${item.id}" is registered more than once.`
+        );
+      }
+      navigationIds.add(item.id);
+    }
+  }
+  const providers = capabilityProviders(byId.values());
+  const ordered = [];
+  const visiting = /* @__PURE__ */ new Set();
+  const visited = /* @__PURE__ */ new Set();
+  for (const module of [...input].sort(compareModules)) {
+    visitModule(
+      module.manifest.id,
+      byId,
+      providers,
+      visiting,
+      visited,
+      ordered
+    );
+  }
+  return Object.freeze({
+    modules: Object.freeze(ordered),
+    get: (id) => byId.get(id),
+    has: (id) => byId.has(id),
+    navigation: (permissions) => Object.freeze(
+      ordered.flatMap((module) => module.navigation ?? []).filter(
+        (item) => !item.permission || permissions?.has(item.permission)
+      ).sort(
+        (left, right) => (left.order ?? 1e3) - (right.order ?? 1e3) || left.id.localeCompare(right.id)
+      )
+    )
+  });
+}
+
 // src/validation.ts
 import { readdir, readFile } from "node:fs/promises";
 import { basename, dirname, join, relative } from "node:path";
@@ -3339,6 +3696,26 @@ function resolveModuleReleases(catalog, target, installed) {
     entries.sort(
       (a, b) => compareModuleVersions(a.manifest.version, b.manifest.version)
     );
+  const providers = /* @__PURE__ */ new Map();
+  for (const entries of candidates.values())
+    for (const release of entries)
+      for (const capability of release.manifest.provides ?? []) {
+        const list = providers.get(capability) ?? [];
+        list.push(release);
+        providers.set(capability, list);
+      }
+  function wanted(manifest) {
+    return [
+      ...manifest.dependencies,
+      ...(manifest.requires ?? []).filter((requirement) => !requirement.optional).map((requirement) => ({ capability: requirement.id }))
+    ];
+  }
+  function platformCompatible(candidate) {
+    return satisfiesModuleVersion(
+      PLATFORM_API_VERSION,
+      candidate.manifest.platformApi
+    );
+  }
   let attempts = 0;
   function search(selected2, pending) {
     distributionAssert(
@@ -3348,17 +3725,31 @@ function resolveModuleReleases(catalog, target, installed) {
     );
     const [next, ...rest] = pending;
     if (!next) return selected2;
+    if ("capability" in next) {
+      const provided = [
+        ...installed,
+        ...[...selected2.values()].map((release) => release.manifest)
+      ].some((manifest) => manifest.provides?.includes(next.capability));
+      if (provided) return search(selected2, rest);
+      for (const candidate of providers.get(next.capability) ?? []) {
+        if (selected2.has(candidate.manifest.id) || existing.has(candidate.manifest.id) || !platformCompatible(candidate))
+          continue;
+        const found = search(
+          new Map([...selected2, [candidate.manifest.id, candidate]]),
+          [...wanted(candidate.manifest), ...rest]
+        );
+        if (found) return found;
+      }
+      return void 0;
+    }
     const fixed = selected2.get(next.id)?.manifest ?? existing.get(next.id);
     if (fixed)
       return satisfiesModuleVersion(fixed.version, next.range) ? search(selected2, rest) : void 0;
     for (const candidate of candidates.get(next.id) ?? []) {
-      if (!satisfiesModuleVersion(candidate.manifest.version, next.range) || !satisfiesModuleVersion(
-        PLATFORM_API_VERSION,
-        candidate.manifest.platformApi
-      ))
+      if (!satisfiesModuleVersion(candidate.manifest.version, next.range) || !platformCompatible(candidate))
         continue;
       const found = search(new Map([...selected2, [next.id, candidate]]), [
-        ...candidate.manifest.dependencies,
+        ...wanted(candidate.manifest),
         ...rest
       ]);
       if (found) return found;
@@ -3405,7 +3796,7 @@ import { dirname as dirname6, join as join6, relative as relative5 } from "node:
 import { createRequire } from "node:module";
 import { readFile as readFile5 } from "node:fs/promises";
 import { dirname as dirname4, join as join3 } from "node:path";
-var SDK_VERSION = "0.2.3";
+var SDK_VERSION = "0.3.1";
 function npmPackage(specifier) {
   return specifier.startsWith("@") ? specifier.split("/").slice(0, 2).join("/") : specifier.split("/")[0];
 }
@@ -3560,6 +3951,15 @@ async function platformIssues(moduleRoot, manifest) {
       )
     );
   }
+  if (manifest.platformApi === void 0) {
+    issues.push(
+      issue(
+        "PLATFORM_API_MISSING",
+        `module.json declares no platformApi; add "platformApi": "^${PLATFORM_API_VERSION}" so the platform contract the module was built against is checked.`,
+        "module.json"
+      )
+    );
+  }
   if (packageVersion !== manifest.version) {
     issues.push(
       issue(
@@ -3648,6 +4048,26 @@ async function specIssues(moduleRoot, manifest, specDirectory) {
       )
     );
   }
+  if (Array.isArray(spec.dependencies)) {
+    const declared = spec.dependencies.map((entry) => `${String(entry.id)}@${String(entry.range)}`);
+    const actual = manifest.dependencies.map(
+      (entry) => `${entry.id}@${entry.range}`
+    );
+    const drift = [
+      ...declared.filter((entry) => !actual.includes(entry)),
+      ...actual.filter((entry) => !declared.includes(entry))
+    ];
+    if (drift.length > 0) {
+      issues.push(
+        issue(
+          "SPEC_DEPENDENCY_DRIFT",
+          `Specification dependencies differ from module.json: ${drift.join(", ")}. Run module version bump or align the ranges by hand.`,
+          specPath,
+          "warning"
+        )
+      );
+    }
+  }
   return issues;
 }
 async function translationIssues(moduleRoot, manifest, projectLocales) {
@@ -4258,13 +4678,23 @@ function platformImport(id, pkg, entry) {
 function clientImport(id, pkg) {
   return `import { createClientContribution as ${identifier(id)} } from '${pkg}/client';`;
 }
+function capabilityScope(module) {
+  if (!module.manifest) return "";
+  const declaration = JSON.stringify({
+    provides: module.manifest.provides ?? [],
+    requires: module.manifest.requires ?? []
+  });
+  return `			capabilities: context.capabilities.forModule('${module.id}', ${declaration}),
+`;
+}
 function generateServerComposition(modules, sdk = false, mounts = [], applicationPath = "/app") {
   const server = modules.filter((module) => module.server);
+  const serverPackage = sdk ? "@flowdular/sdk/server" : "@flowdular/server";
   const typeImport = `import type {
 	PlatformServerComposition,
 	PlatformServerContext,
 } from '${sdk ? "@flowdular/sdk/modules/auth" : "@flowdular/module-auth"}/server';
-import type { WebMount } from '${sdk ? "@flowdular/sdk/server" : "@flowdular/server"}';
+import type { WebMount } from '${serverPackage}';
 `;
   if (server.length === 0) {
     return GENERATED_HEADER + typeImport + "\nexport function composeModuleServer(\n	_context: PlatformServerContext,\n): readonly PlatformServerComposition[] {\n	return [];\n}\n\nexport const moduleWebMounts: readonly WebMount[] = " + JSON.stringify(mounts) + " as const;\nexport const applicationBasePath = " + JSON.stringify(applicationPath) + ";\n";
@@ -4276,9 +4706,12 @@ import type { WebMount } from '${sdk ? "@flowdular/sdk/server" : "@flowdular/ser
     (module) => `		{ ...${identifier(module.id)}({
 			...context,
 			agentDefinitions: context.agentDefinitions.forModule('${module.id}'),
+			dataClasses: context.dataClasses.forModule('${module.id}'),
+` + capabilityScope(module) + `			metrics: createModuleMetrics('${module.id}'),
 		}), moduleId: '${module.id}' },`
   ).join("\n");
-  return GENERATED_HEADER + typeImport + imports + "\n\nexport function composeModuleServer(\n	context: PlatformServerContext,\n): readonly PlatformServerComposition[] {\n	return [\n" + calls + "\n	];\n}\n\nexport const moduleWebMounts: readonly WebMount[] = " + JSON.stringify(mounts) + " as const;\nexport const applicationBasePath = " + JSON.stringify(applicationPath) + ";\n";
+  return GENERATED_HEADER + typeImport + `import { createModuleMetrics } from '${serverPackage}';
+` + imports + "\n\nexport function composeModuleServer(\n	context: PlatformServerContext,\n): readonly PlatformServerComposition[] {\n	return [\n" + calls + "\n	];\n}\n\nexport const moduleWebMounts: readonly WebMount[] = " + JSON.stringify(mounts) + " as const;\nexport const applicationBasePath = " + JSON.stringify(applicationPath) + ";\n";
 }
 function generateClientComposition(modules, sdk = false, applicationPath = "/app") {
   const client = modules.filter((module) => module.client);
@@ -4324,6 +4757,11 @@ function moduleOrder(manifests, roots, includeDependencies) {
   const visiting = [];
   const visited = /* @__PURE__ */ new Set();
   const ordered = [];
+  const providers = capabilityProviders(
+    [...manifests.values()].flatMap(
+      (descriptor) => descriptor.manifest ? [{ manifest: descriptor.manifest }] : []
+    )
+  );
   const visit = (id, requiredBy) => {
     if (visited.has(id)) return;
     const cycleStart = visiting.indexOf(id);
@@ -4357,6 +4795,24 @@ function moduleOrder(manifests, roots, includeDependencies) {
         assertModuleDependency(id, constraint, version);
       visit(dependency, id);
     }
+    for (const requirement of [...current.manifest?.requires ?? []].sort(
+      (left, right) => left.id.localeCompare(right.id)
+    )) {
+      if (requirement.optional) continue;
+      const provider = providers.get(requirement.id);
+      if (!provider) {
+        throw new Error(
+          `Module "${id}" requires capability "${requirement.id}" and no module provides it.`
+        );
+      }
+      if (provider === id) continue;
+      if (!includeDependencies && !requested.has(provider)) {
+        throw new Error(
+          `Enabled module "${id}" requires capability "${requirement.id}" from disabled module "${provider}". Enable the provider first.`
+        );
+      }
+      visit(provider, id);
+    }
     visiting.pop();
     visited.add(id);
     ordered.push(current);