@datanimbus/dnio-mcp 1.0.0

package/src/tools/data-pipes.js

@@ -0,0 +1,1305 @@
+'use strict';
+
+const {z} = require('zod');
+const {toolError} = require('./_helpers');
+
+// ─── Domain helpers ─────────────────────────────────────────────────────────
+
+const TRIGGER_PLUGIN_SELECT = '-code';
+const PROCESS_PLUGIN_SELECT = '-code';
+
+// Reused in every tool that lets the LLM author a CODEBLOCK, a mapping expression,
+// or a branch condition. These globals are provided by the DNIO runtime — keep this
+// description in lockstep with what the platform actually exposes.
+const EXPRESSION_GLOBALS = `
+
+RUNTIME GLOBALS (available in CODEBLOCK code, mapping 'expression.value', and branch onSuccess.condition):
+  • Every node in the flow is reachable by its _id. Outputs always live under '.data'.
+        {{fetch_transactions['data']}}                       — full output of node 'fetch_transactions'
+        {{route['data']['outputFormat']['_id']}}             — nested path inside another node's output
+        node['parse_body'].data.records.length               — same access from inside CODEBLOCK code
+    Top-level bare variables also work in {{ }} expressions: {{<nodeId>['data']...}}.
+  • CONSTANTS — flow-level constants configured on the flow document (e.g. {{CONSTANTS.TOKEN}}).
+  • ENV — deployment environment variables (e.g. {{ENV.SOME_VAR}}).
+
+Templating uses lodash-style {{ }} interpolation. Examples that are valid wherever expressions are accepted:
+  • {{CONSTANTS.TOKEN}}
+  • {{fetch_transactions['data']}}
+  • JSON.stringify({"fileFormatCode._id": {{route['data']['outputFormat']['_id']}}})
+  • _.isNull({{prev.data.content}})                          — branch condition
+  • {{fetch_transactions['data']['status']}} == "SUCCESS"    — branch condition with equality
+
+CODEBLOCK RETURN CONTRACT:
+V1_CODEBLOCK MUST return { data: <whatever you want downstream> }. Returning a bare object, undefined, or anything not wrapped in .data loses the output — the platform reads outputSchema.data only.`;
+
+const PLUGIN_SUMMARY_KEYS = [
+    '_id', 'nodeId', 'type', 'label', 'group', 'category',
+    'icon', 'connectorType', 'inputSchema', 'outputSchema', 'errorSchema', 'version'
+];
+
+function pickPluginSummary(p) {
+    const out = {};
+    for (const k of PLUGIN_SUMMARY_KEYS) if (k in p) out[k] = p[k];
+    return out;
+}
+
+function slugify(name) {
+    return String(name)
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '_')
+        .replace(/^_|_$/g, '') || 'node';
+}
+
+function dedupeId(slug, existingIds) {
+    if (!existingIds.has(slug)) return slug;
+    let n = 2;
+    while (existingIds.has(`${slug}_${n}`)) n++;
+    return `${slug}_${n}`;
+}
+
+function collectFlowIds(flow) {
+    const ids = new Set();
+    if (flow.inputNode?._id) ids.add(flow.inputNode._id);
+    for (const n of flow.nodes || []) if (n._id) ids.add(n._id);
+    return ids;
+}
+
+function findNodeRef(flow, nodeId) {
+    if (flow.inputNode?._id === nodeId) return {node: flow.inputNode, isInput: true};
+    const idx = (flow.nodes || []).findIndex(n => n._id === nodeId);
+    if (idx >= 0) return {node: flow.nodes[idx], isInput: false, idx};
+    return null;
+}
+
+function maxX(flow) {
+    let m = flow.inputNode?.coordinates?.x ?? 0;
+    for (const n of flow.nodes || []) {
+        const x = n.coordinates?.x;
+        if (typeof x === 'number' && x > m) m = x;
+    }
+    return m;
+}
+
+function defaultNodeOptions(plugin) {
+    if (plugin?.type === 'V1_CODEBLOCK') {
+        // CODEBLOCK has its own (smaller) options shape — no nodeId, no values, no retry.
+        return {
+            rejectUnauthorized: true,
+            conditionType: 'ifElse',
+            contentType: 'application/json',
+            code: DEFAULT_CODEBLOCK_CODE
+        };
+    }
+    return {
+        nodeId: plugin.nodeId,
+        values: {},
+        rejectUnauthorized: true,
+        retry: {},
+        conditionType: 'ifElse',
+        uniqueRemoteTransactionOptions: {},
+        contentType: 'application/json'
+    };
+}
+
+// Build a process-node entry from a plugin object. Caller wires _id, onSuccess, mappings.
+function buildProcessNode(plugin, name, {options, mappings, connector, coordinates, app}) {
+    const node = {
+        _id: name,
+        name,
+        onSuccess: [],
+        onError: [],
+        dataStructure: {outgoing: {}},
+        options: {...defaultNodeOptions(plugin), ...(options || {})},
+        app,
+        type: plugin.type,
+        category: plugin.category,
+        group: plugin.group,
+        icon: plugin.icon,
+        label: plugin.label,
+        version: plugin.version,
+        inputSchema: plugin.inputSchema || [],
+        outputSchema: plugin.outputSchema || [],
+        errorSchema: plugin.errorSchema || [],
+        connectorType: plugin.connectorType || 'NONE',
+        coordinates: coordinates || {x: 0, y: 0},
+        nodeType: 'customNewNode'
+    };
+    if (Array.isArray(mappings) && mappings.length > 0) node.mappings = mappings;
+    if (connector?._id) node.options.connector = {_id: connector._id};
+    return node;
+}
+
+// Build a trigger inputNode from a plugin object. Caller wires _id and onSuccess.
+function buildInputNode(plugin, options) {
+    return {
+        type: plugin.type,
+        options: {...(options || {}), nodeId: plugin.nodeId},
+        _id: slugify(plugin.label || plugin.type),
+        name: slugify(plugin.label || plugin.type),
+        icon: plugin.icon,
+        inputSchema: plugin.inputSchema || [],
+        outputSchema: plugin.outputSchema || [],
+        errorSchema: plugin.errorSchema || [],
+        connectorType: plugin.connectorType || 'NONE',
+        onSuccess: []
+    };
+}
+
+function validateConnectorRequirement(plugin, connector) {
+    if ((plugin.connectorType || 'NONE') !== 'NONE' && !connector?._id) {
+        throw new Error(`Plugin '${plugin.label || plugin.type}' requires a connector (connectorType=${plugin.connectorType}) — pass connector: { _id: '<connectorId>' }.`);
+    }
+}
+
+// V1_CODEBLOCK is a platform built-in — it does NOT live in /my-node, can't be
+// installed from the marketplace, and has no nodeId. Use this baseline whenever
+// the LLM asks for V1_CODEBLOCK.
+const BUILTIN_CODEBLOCK = {
+    type: 'V1_CODEBLOCK',
+    category: 'PROCESS',
+    group: 'Misc',
+    icon: 'ni ni-console',
+    label: 'Code Block',
+    version: 1,
+    inputSchema: [{key: 'data', type: 'Schema'}],
+    outputSchema: [{key: 'data', type: 'Schema'}],
+    errorSchema: [
+        {key: 'code', type: 'Number'},
+        {key: 'message', type: 'String'},
+        {key: 'stackTrace', type: 'String'}
+    ],
+    connectorType: 'NONE'
+};
+
+const DEFAULT_CODEBLOCK_CODE = `//use logger for logging
+async function executeCode(inputData, node, connectorConfig) {
+  try {
+    let data = {};
+    //Write Your code here
+
+    return data;
+  } catch(err) {
+    logger.error(err);
+    throw err;
+  }
+}`;
+
+function _isCodeblock(plugin) {
+    return plugin?.type === 'V1_CODEBLOCK' || plugin?._id === 'V1_CODEBLOCK';
+}
+
+// Build the PUBLIC invocation URL for an HTTP-triggered flow.
+// Pattern: {DNIO_BASE_URL}/b2b/pipes/{appName}/{path}
+// IMPORTANT: this is the only URL the LLM should give the user. The flow document
+// itself contains internal Kubernetes references (e.g. 'gateway.<ns>.svc/api/b2b/...',
+// 'host', 'port', 'deploymentName', 'yaml', or any 'url' field on the flow). Those
+// resolve only inside the cluster and are NOT publicly callable.
+// Returns null for non-HTTP triggers (Timer, Timer Multiple) where there is no URL.
+function _flowInvocationUrl(dnioClient, appName, flow) {
+    const inputNode = flow?.inputNode;
+    if (!inputNode || inputNode.type !== 'V1_HTTP_SERVER') return null;
+    const rawPath = inputNode.options?.path;
+    if (!rawPath) return null;
+    const base = (dnioClient.baseUrl || '').replace(/\/$/, '');
+    const cleanPath = String(rawPath).replace(/^\/+/, '');
+    return {
+        method: inputNode.options?.method || 'POST',
+        url: `${base}/b2b/pipes/${appName}/${cleanPath}`,
+        warning: "Use this URL for HTTP calls. IGNORE any other url / host / gateway / deploymentName / yaml fields elsewhere in the flow document — those are internal Kubernetes service references (e.g. 'gateway.<namespace>.svc/api/...') and are NOT reachable from outside the cluster."
+    };
+}
+
+// Plugin objects shuttled through MCP tool calls often arrive missing inputSchema /
+// outputSchema / errorSchema / nodeId — the LLM trims them. Re-fetch from /my-node
+// whenever any of those critical fields is missing so the persisted node always
+// carries the canonical schemas. Idempotent: returns the input as-is when complete.
+async function _resolvePlugin(dnioClient, appName, plugin) {
+    // V1_CODEBLOCK is built-in — short-circuit; never look it up in /my-node.
+    if (_isCodeblock(plugin)) return BUILTIN_CODEBLOCK;
+
+    const isComplete = (p) =>
+        p && p.type && p.nodeId &&
+        Array.isArray(p.inputSchema) &&
+        Array.isArray(p.outputSchema) &&
+        Array.isArray(p.errorSchema);
+
+    if (isComplete(plugin)) return plugin;
+
+    const filter = plugin?._id ? {_id: plugin._id}
+        : plugin?.type ? {type: plugin.type}
+        : null;
+    if (!filter) {
+        throw new Error('plugin must include either _id or type so the tool can resolve schemas from /my-node');
+    }
+
+    const result = await dnioClient.plugins.listInstalled(appName, {
+        filter,
+        select: '_id,app,nodeId,version,category,group,type,label,icon,connectorType,inputSchema,outputSchema,errorSchema'
+    });
+    const list = Array.isArray(result) ? result : [];
+    if (list.length === 0) {
+        const ref = plugin?._id || plugin?.type || JSON.stringify(plugin);
+        throw new Error(`Plugin not installed in app '${appName}': ${ref}. Use list_marketplace_plugins → install_plugins first.`);
+    }
+    return list[0];
+}
+
+// Walk a DNIO schema array (each entry: {key, type, subType?, schema?}) by dot-path segments.
+function _walkSchema(schema, segments) {
+    if (!Array.isArray(schema) || segments.length === 0) return null;
+    let cur = schema;
+    let field = null;
+    for (const seg of segments) {
+        if (!Array.isArray(cur)) return null;
+        field = cur.find(f => f.key === seg);
+        if (!field) return null;
+        cur = field.schema || [];
+    }
+    return field;
+}
+
+function _expressionFor(nodeId, segments) {
+    const path = segments.map(s => `['${s}']`).join('');
+    return ` {{${nodeId}${path}}}`;
+}
+
+// True when the entry already has the full DNIO mapping shape (target as object + source array).
+function _isFullMapping(m) {
+    return !!m && typeof m.target === 'object' && m.target !== null && Array.isArray(m.source);
+}
+
+// Convert a simple {from, to, expression?} mapping to the full DNIO shape, walking
+// the flow's existing nodes and the current node's inputSchema for type info.
+// Full-shape entries pass through untouched.
+function _buildMappingEntry(flow, currentInputSchema, simple) {
+    if (_isFullMapping(simple)) return simple;
+    const {from, to, expression: customExpr} = simple || {};
+    if (!to) {
+        throw new Error('mapping entry needs "to" (the target field name on the current node)');
+    }
+
+    const targetField = _walkSchema(currentInputSchema, [to]);
+    const rawTargetType = targetField?.type;
+    // Schema / SchemaFree / unknown → Object (matches platform's canonical target.type).
+    const targetType = (!rawTargetType || rawTargetType === 'Schema' || rawTargetType === 'SchemaFree')
+        ? 'Object'
+        : rawTargetType;
+
+    const target = {_id: to, type: targetType, dataPath: to, dataPathSegs: [to]};
+
+    // Hardcoded expression with no source (e.g. {{CONSTANTS.TOKEN}}).
+    if (!from && customExpr) {
+        return {
+            target,
+            source: [],
+            expression: {type: 'simple', value: customExpr},
+            children: [],
+            key: to,
+            name: to,
+            derivedFrom: null
+        };
+    }
+    if (!from) {
+        throw new Error(`mapping for "${to}" needs either "from" (e.g. "fetch_students.data") or "expression"`);
+    }
+
+    const [sourceNodeId, ...path] = String(from).split('.');
+    if (path.length === 0) {
+        throw new Error(`mapping "from" must be "<nodeId>.<field>[.<nested>...]" — got "${from}"`);
+    }
+
+    const sourceRef = findNodeRef(flow, sourceNodeId);
+    if (!sourceRef) {
+        throw new Error(`mapping source node "${sourceNodeId}" not found in flow (check inputNode._id and nodes[]._id)`);
+    }
+
+    const sourceField = _walkSchema(sourceRef.node.outputSchema, path);
+    const sourceType = sourceField?.type || 'Schema';
+    const sourceSubType = sourceField?.subType;
+    const lastSeg = path[path.length - 1];
+
+    const sourceEntry = {
+        key: lastSeg,
+        type: sourceType,
+        nodeId: sourceNodeId,
+        name: lastSeg,
+        dataPath: path.join('.'),
+        dataPathSegs: path,
+        _id: `${sourceNodeId}.${path.join('.')}`
+    };
+    if (sourceSubType) sourceEntry.subType = sourceSubType;
+
+    return {
+        target,
+        source: [sourceEntry],
+        expression: {
+            type: 'simple',
+            value: customExpr || _expressionFor(sourceNodeId, path)
+        },
+        children: [],
+        key: to,
+        name: to,
+        derivedFrom: null
+    };
+}
+
+function _buildMappings(flow, currentInputSchema, mappings) {
+    if (!Array.isArray(mappings)) return undefined;
+    return mappings.map(m => _buildMappingEntry(flow, currentInputSchema, m));
+}
+
+// Auto-derive simple mappings by matching field keys between the upstream node's
+// outputSchema and the current node's inputSchema. Only top-level keys are matched —
+// nested fields and renames must be specified explicitly.
+function _autoMappings(flow, sourceNodeId, currentInputSchema) {
+    const sourceRef = findNodeRef(flow, sourceNodeId);
+    if (!sourceRef) return [];
+    const sourceOutputs = sourceRef.node.outputSchema || [];
+    const out = [];
+    for (const targetField of (currentInputSchema || [])) {
+        if (!targetField?.key) continue;
+        const match = sourceOutputs.find(s => s?.key === targetField.key);
+        if (match) {
+            out.push({from: `${sourceNodeId}.${match.key}`, to: targetField.key});
+        }
+    }
+    return out;
+}
+
+// Return the list of inputSchema field keys that aren't covered by the given mappings.
+// Used to nudge the LLM to ask the user (or pass explicit mappings) for the remainder.
+function _unmappedFields(currentInputSchema, mappings) {
+    const mapped = new Set();
+    for (const m of (mappings || [])) {
+        const k = m?.target?._id || m?.target?.dataPath || m?.to || m?.key;
+        if (k) mapped.add(k);
+    }
+    return (currentInputSchema || [])
+        .filter(f => f?.key && !mapped.has(f.key))
+        .map(f => ({key: f.key, type: f.type, subType: f.subType}));
+}
+
+// Helper used by add_node_to_flow + create_flow.initialNodes[] to decide mappings.
+// Returns {mappings, autoMapped: boolean}.
+//   - If userMappings is undefined  → auto-derive from the upstream node by key-match.
+//   - If userMappings === []        → explicit "no mappings" (returns undefined).
+//   - Otherwise                     → use userMappings as-is (still goes through _buildMappings
+//                                     so simple {from,to} entries get expanded).
+function _resolveMappings(flow, sourceNodeId, currentInputSchema, userMappings) {
+    if (Array.isArray(userMappings)) {
+        if (userMappings.length === 0) return {mappings: undefined, autoMapped: false};
+        return {mappings: _buildMappings(flow, currentInputSchema, userMappings), autoMapped: false};
+    }
+    const auto = _autoMappings(flow, sourceNodeId, currentInputSchema);
+    if (auto.length === 0) return {mappings: undefined, autoMapped: false};
+    return {mappings: _buildMappings(flow, currentInputSchema, auto), autoMapped: true};
+}
+
+// ─── Schema overlay (refFormatType / refFormatId / refData) ─────────────────
+// A node's inputSchema or outputSchema field can be pinned to a specific data
+// format (currently: a data service) so the platform UI shows typed fields
+// instead of the plugin's generic 'Schema'. The overlay lives on a single
+// field by `key`; other fields keep the plugin's default shape.
+
+async function _fetchRefData(dnioClient, appName, refFormatType, refFormatId) {
+    if (refFormatType === 'service') {
+        const svc = await dnioClient.services.get(appName, refFormatId, {
+            select: '_id,name,definition,attributeCount'
+        });
+        if (!svc || !svc._id) {
+            throw new Error(`Data service '${refFormatId}' not found in app '${appName}'`);
+        }
+        return {
+            _id: svc._id,
+            name: svc.name,
+            definition: svc.definition || [],
+            attributeCount: svc.attributeCount ?? (Array.isArray(svc.definition) ? svc.definition.length : 0),
+            type: 'Object',
+            formatType: 'JSON',
+            _selected: true,
+            dataType: 'Object'
+        };
+    }
+    throw new Error(`Unsupported refFormatType '${refFormatType}'. Currently supported: 'service'.`);
+}
+
+// Apply per-field schema overrides to a plugin schema array, returning a new array.
+// Each override: { key, refFormatType, refFormatId } — the matching field's
+// existing properties are preserved; refFormatType/refFormatId/refData are merged in.
+async function _applySchemaOverrides(dnioClient, appName, schema, overrides) {
+    if (!Array.isArray(overrides) || overrides.length === 0) return schema;
+    const result = (schema || []).map(f => ({...f}));
+    for (const o of overrides) {
+        if (!o?.key) throw new Error('schemaOverrides entry missing "key"');
+        if (!o.refFormatType) throw new Error(`schemaOverrides["${o.key}"] missing "refFormatType"`);
+        if (!o.refFormatId) throw new Error(`schemaOverrides["${o.key}"] missing "refFormatId"`);
+        const idx = result.findIndex(f => f.key === o.key);
+        if (idx < 0) {
+            const present = result.map(f => f.key).join(', ') || '(empty)';
+            throw new Error(`schemaOverrides references unknown field "${o.key}" — plugin schema has: ${present}`);
+        }
+        const refData = await _fetchRefData(dnioClient, appName, o.refFormatType, o.refFormatId);
+        result[idx] = {
+            ...result[idx],
+            refFormatType: o.refFormatType,
+            refFormatId: o.refFormatId,
+            refData
+        };
+    }
+    return result;
+}
+
+// Apply both inputSchema and outputSchema overrides onto a plugin (mutates a clone).
+async function _applyAllSchemaOverrides(dnioClient, appName, plugin, schemaOverrides) {
+    if (!schemaOverrides) return plugin;
+    const out = {...plugin};
+    if (schemaOverrides.inputSchema) {
+        out.inputSchema = await _applySchemaOverrides(dnioClient, appName, plugin.inputSchema, schemaOverrides.inputSchema);
+    }
+    if (schemaOverrides.outputSchema) {
+        out.outputSchema = await _applySchemaOverrides(dnioClient, appName, plugin.outputSchema, schemaOverrides.outputSchema);
+    }
+    return out;
+}
+
+// ─── Tool registrations ─────────────────────────────────────────────────────
+
+module.exports = function registerDataPipesTools({server, dnioClient, registry, userContext}) {
+    const requireApp = () => {
+        if (!registry.selectedApp) {
+            return {content: [{type: 'text', text: 'No app selected. Use list_apps → select_app first.'}], isError: true};
+        }
+        return null;
+    };
+
+    // ─── Plugin discovery ───────────────────────────────────────────────────
+
+    server.registerTool(
+        'list_trigger_plugins',
+        {
+            title: 'List Trigger Plugins (Flow Starters)',
+            description: `List installed plugins with category=TRIGGER for the selected app. These are the starter nodes for a new flow (HTTP server, Timer, Timer Multiple, etc.).
+
+Call this BEFORE create_flow — pass the chosen plugin object as 'triggerPlugin'.`,
+            inputSchema: {},
+            annotations: {readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false}
+        },
+        async () => {
+            const guard = requireApp();
+            if (guard) return guard;
+            try {
+                dnioClient.setToken(userContext.token);
+                const result = await dnioClient.plugins.listInstalled(registry.selectedApp, {
+                    filter: {category: 'TRIGGER'},
+                    select: TRIGGER_PLUGIN_SELECT
+                });
+                const items = (Array.isArray(result) ? result : []).map(pickPluginSummary);
+                return {
+                    content: [{
+                        type: 'text',
+                        text: JSON.stringify({
+                            app: registry.selectedApp,
+                            count: items.length,
+                            plugins: items,
+                            usage: 'Pass the chosen plugin object as triggerPlugin to create_flow.'
+                        }, null, 2)
+                    }]
+                };
+            } catch (error) {
+                return toolError('Failed to list trigger plugins', error);
+            }
+        }
+    );
+
+    server.registerTool(
+        'list_process_plugins',
+        {
+            title: 'List Process Plugins (Downstream Nodes)',
+            description: `List installed plugins with category=PROCESS for the selected app. These are the downstream nodes used after the trigger (parsing, data service calls, file ops, code blocks, V1_RESPONSE, etc.).
+
+Call this BEFORE add_node_to_flow — pass the chosen plugin object as 'pluginObject'.
+
+PLUGIN SELECTION STRATEGY (when building a flow from a user requirement):
+  1. Search for an installed first-class plugin that matches the task (e.g. 'Save File' → V1_SAVE_FILE, 'Parse JSON' → V1_PARSE_JSON, a data service call → V1_DATASERVICE_*).
+  2. If nothing matches but the marketplace has it, call list_marketplace_plugins → install_plugins → re-list.
+  3. ONLY if no built-in covers the task and the logic is trivial / glue / one-off transformation, fall back to V1_CODEBLOCK with custom code in options.code (see add_node_to_flow for the code function signature).
+Prefer first-class plugins over CODEBLOCK whenever possible — they get UI affordances, schema introspection, and version upgrades automatically.
+
+V1_CODEBLOCK NOTE: V1_CODEBLOCK is a PLATFORM BUILT-IN — it does NOT appear in this list and cannot be installed. To use it, skip list_*_plugins / install_plugins entirely and call add_node_to_flow directly with pluginObject: { type: 'V1_CODEBLOCK' }. The tool resolves the schemas and seeds a default executeCode template; pass your real code via options.code.
+
+V1_RESPONSE NOTE: For ANY flow triggered by V1_HTTP_Sokay,ERVER that needs to return data to the HTTP caller, the LAST node in the chain MUST be V1_RESPONSE. Unlike V1_CODEBLOCK, V1_RESPONSE is a regular marketplace plugin — search for it here, install_plugins if missing, then add it. Its inputSchema has three fields: 'data' (Buffer — the response body, normally mapped from the previous node's data), 'statusCode' (Number — typically the literal expression "200"), and 'headers' (KeyValPair — usually left unmapped). Flows without V1_RESPONSE simply don't return a body, which is fine for fire-and-forget endpoints but breaks anything the caller waits on.
+
+Args:
+  - group (optional): Filter by group, e.g. 'DataService', 'HTTP', 'Misc', 'File'.
+  - search (optional): Substring match against label or type.`,
+            inputSchema: {
+                group: z.string().optional().describe("Filter by group, e.g. 'DataService', 'HTTP', 'Misc'."),
+                search: z.string().optional().describe('Substring match against label or type.')
+            },
+            annotations: {readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false}
+        },
+        async (params) => {
+            const guard = requireApp();
+            if (guard) return guard;
+            try {
+                dnioClient.setToken(userContext.token);
+                const result = await dnioClient.plugins.listInstalled(registry.selectedApp, {
+                    filter: {category: 'PROCESS'},
+                    select: PROCESS_PLUGIN_SELECT
+                });
+                const installed = Array.isArray(result) ? result : [];
+
+                // Prepend platform built-ins (e.g. V1_CODEBLOCK) so the LLM's natural
+                // search/filter flow surfaces them — they don't live in /my-node.
+                const codeblockEntry = {
+                    ...BUILTIN_CODEBLOCK,
+                    _id: 'V1_CODEBLOCK',
+                    nodeId: null,
+                    builtIn: true
+                };
+                let items = [codeblockEntry, ...installed];
+
+                if (params.group) {
+                    items = items.filter(i => (i.group || '') === params.group);
+                }
+                if (params.search) {
+                    const q = params.search.toLowerCase();
+                    items = items.filter(i =>
+                        (i.label || '').toLowerCase().includes(q) ||
+                        (i.type || '').toLowerCase().includes(q)
+                    );
+                }
+                // Slim each plugin, but preserve the built-in flag.
+                items = items.map(p => {
+                    const summary = pickPluginSummary(p);
+                    if (p.builtIn) summary.builtIn = true;
+                    return summary;
+                });
+                return {
+                    content: [{
+                        type: 'text',
+                        text: JSON.stringify({
+                            app: registry.selectedApp,
+                            count: items.length,
+                            plugins: items,
+                            usage: "Pass the chosen plugin object as pluginObject to add_node_to_flow. For built-in plugins (builtIn: true), pass just { type: '<type>' } — they don't need to be installed and don't have a real _id.",
+                            builtIns: items.filter(i => i.builtIn).map(i => i.type)
+                        }, null, 2)
+                    }]
+                };
+            } catch (error) {
+                return toolError('Failed to list process plugins', error);
+            }
+        }
+    );
+
+    // ─── Flow CRUD ──────────────────────────────────────────────────────────
+
+    server.registerTool(
+        'list_flows',
+        {
+            title: 'List Flows in App',
+            description: `List flows (data pipes) in the selected app. Useful for finding a flow by name before mutating it.
+
+Args:
+  - name (optional): Substring filter on flow name.
+  - status (optional): Filter by status, e.g. 'Draft', 'Active'.`,
+            inputSchema: {
+                name: z.string().optional().describe('Substring filter on flow name'),
+                status: z.string().optional().describe("Status filter, e.g. 'Draft' or 'Active'")
+            },
+            annotations: {readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false}
+        },
+        async (params) => {
+            const guard = requireApp();
+            if (guard) return guard;
+            try {
+                dnioClient.setToken(userContext.token);
+                const filter = {};
+                if (params.status) filter.status = params.status;
+                const result = await dnioClient.dataPipes.list(registry.selectedApp, {
+                    filter,
+                    select: '_id,name,status,version,inputNode,description'
+                });
+                let items = Array.isArray(result) ? result : [];
+                if (params.name) {
+                    const q = params.name.toLowerCase();
+                    items = items.filter(f => (f.name || '').toLowerCase().includes(q));
+                }
+                const summary = items.map(f => {
+                    const invocation = _flowInvocationUrl(dnioClient, registry.selectedApp, f);
+                    return {
+                        flowId: f._id,
+                        name: f.name,
+                        status: f.status,
+                        version: f.version,
+                        triggerType: f.inputNode?.type,
+                        ...(invocation ? {invocation} : {}),
+                        description: f.description
+                    };
+                });
+                return {
+                    content: [{
+                        type: 'text',
+                        text: JSON.stringify({app: registry.selectedApp, count: summary.length, flows: summary}, null, 2)
+                    }]
+                };
+            } catch (error) {
+                return toolError('Failed to list flows', error);
+            }
+        }
+    );
+
+    server.registerTool(
+        'get_flow',
+        {
+            title: 'Get Flow (Full Document)',
+            description: `Fetch the full flow document by flowId. Always returns the latest server state — use before any mutation if you want to inspect first. (The mutating tools all fetch internally, so calling get_flow is only needed for read/inspection.)
+
+For HTTP-triggered flows, the response is augmented with 'invocation: { method, url, warning }' at the top level — the public URL the user should call.
+
+⚠️  The flow document itself contains internal Kubernetes references — fields like 'url', 'host', 'port', 'namespace', 'deploymentName', or a generated 'yaml' whose URLs look like 'gateway.<namespace>.svc/api/b2b/...'. Those are cluster-internal and cannot be reached from outside the K8s network. NEVER show them to the user as the invocation URL — always use 'invocation.url'.
+
+Args:
+  - flowId (required): The flow _id (e.g. 'FLOW6156').`,
+            inputSchema: {
+                flowId: z.string().min(1).describe("Flow _id (e.g. 'FLOW6156')")
+            },
+            annotations: {readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false}
+        },
+        async (params) => {
+            const guard = requireApp();
+            if (guard) return guard;
+            try {
+                dnioClient.setToken(userContext.token);
+                const result = await dnioClient.dataPipes.get(registry.selectedApp, params.flowId);
+                const invocation = _flowInvocationUrl(dnioClient, registry.selectedApp, result);
+                const response = invocation ? {invocation, ...result} : result;
+                return {content: [{type: 'text', text: JSON.stringify(response, null, 2)}]};
+            } catch (error) {
+                return toolError(`Failed to get flow ${params.flowId}`, error);
+            }
+        }
+    );
+
+    server.registerTool(
+        'create_flow',
+        {
+            title: 'Create Flow (with trigger + initial nodes)',
+            description: `Create a new flow with one trigger node as the inputNode and zero or more initial process nodes wired sequentially.
+
+Workflow: list_trigger_plugins → list_process_plugins → create_flow → add_node_to_flow (more) → publish_flow.
+
+Args:
+  - name (required): Flow name.
+  - description (optional): Free-form description.
+  - skipAuth (optional, default true): For HTTP triggers, whether the flow's HTTP endpoint skips auth.
+  - triggerPlugin (required): The full plugin object from list_trigger_plugins.
+  - triggerOptions (required): Options for the trigger. Shape depends on trigger type:
+      • V1_HTTP_SERVER: { method: 'POST', path: '/upload' }
+      • V1_TIMER: { cron: '0 9 * * *', timezone: 'Asia/Kolkata', holidayList?: '...' }
+      • V1_TIMER_MULTIPLE: { cronList: [{ cron, timezone }, ...] }
+  - initialNodes (optional): Array of { pluginObject, name, options?, mappings?, connector?, coordinates? } seeded into the flow. Wired sequentially: trigger → initialNodes[0] → initialNodes[1] → ... Each initialNode entry's pluginObject must be category=PROCESS.
+
+Returns the full flow JSON including the new flowId. For HTTP-triggered flows (V1_HTTP_SERVER), the response also includes 'invocation: { method, url, warning }' — the URL pattern is {DNIO_BASE_URL}/b2b/pipes/{app}/{httpServerPath}.
+
+⚠️  The flow JSON itself may contain INTERNAL fields like 'url', 'host', 'deploymentName', 'namespace', 'port', or a generated 'yaml' that reference Kubernetes service hosts (e.g. 'gateway.<namespace>.svc/api/b2b/...'). Those are NOT publicly callable — they resolve only inside the K8s cluster. ONLY use 'invocation.url' from the response when telling the user how to call the flow.`,
+            inputSchema: {
+                name: z.string().min(1),
+                description: z.string().optional(),
+                skipAuth: z.boolean().optional(),
+                triggerPlugin: z.record(z.any()).describe('Full plugin object from list_trigger_plugins'),
+                triggerOptions: z.record(z.any()).describe('Trigger-specific options'),
+                initialNodes: z.array(z.record(z.any())).optional()
+            },
+            annotations: {destructiveHint: false, idempotentHint: false}
+        },
+        async (params) => {
+            const guard = requireApp();
+            if (guard) return guard;
+            try {
+                const app = registry.selectedApp;
+                dnioClient.setToken(userContext.token);
+
+                // Always re-resolve the trigger plugin from the platform to guarantee
+                // inputSchema/outputSchema/errorSchema/nodeId are present.
+                const trigger = await _resolvePlugin(dnioClient, app, params.triggerPlugin);
+                if ((trigger?.category || '').toUpperCase() !== 'TRIGGER') {
+                    return toolError('triggerPlugin must have category=TRIGGER', new Error(`got category=${trigger?.category}`));
+                }
+
+                const inputNode = buildInputNode(trigger, params.triggerOptions);
+                inputNode.coordinates = {x: 0, y: 0};
+
+                const ids = new Set([inputNode._id]);
+                const builtNodes = [];
+                // Temp flow grows as we build initialNodes so each node's mappings can
+                // resolve against the previously-built node's outputSchema.
+                const tempFlow = {inputNode, nodes: builtNodes};
+                const initial = Array.isArray(params.initialNodes) ? params.initialNodes : [];
+
+                for (let i = 0; i < initial.length; i++) {
+                    const spec = initial[i] || {};
+                    let plugin;
+                    try {
+                        plugin = await _resolvePlugin(dnioClient, app, spec.pluginObject);
+                    } catch (err) {
+                        return toolError(`initialNodes[${i}] plugin resolution failed`, err);
+                    }
+                    try {
+                        plugin = await _applyAllSchemaOverrides(dnioClient, app, plugin, spec.schemaOverrides);
+                    } catch (err) {
+                        return toolError(`initialNodes[${i}] schema override failed`, err);
+                    }
+                    try {
+                        validateConnectorRequirement(plugin, spec.connector);
+                    } catch (err) {
+                        return toolError(`initialNodes[${i}] connector check failed`, err);
+                    }
+                    const slug = dedupeId(slugify(spec.name || plugin.label || plugin.type), ids);
+                    ids.add(slug);
+
+                    // Source for auto-mapping is the previous node in the chain (or the trigger).
+                    const prevNodeId = i === 0 ? inputNode._id : builtNodes[i - 1]._id;
+                    let mappings;
+                    try {
+                        const resolved = _resolveMappings(tempFlow, prevNodeId, plugin.inputSchema || [], spec.mappings);
+                        mappings = resolved.mappings;
+                    } catch (err) {
+                        return toolError(`initialNodes[${i}] mapping build failed`, err);
+                    }
+
+                    const node = buildProcessNode(plugin, slug, {
+                        options: spec.options,
+                        mappings,
+                        connector: spec.connector,
+                        coordinates: spec.coordinates || {x: (i + 1) * 200, y: 0},
+                        app
+                    });
+                    builtNodes.push(node);
+                }
+
+                // Wire sequentially: inputNode → builtNodes[0] → builtNodes[1] → ...
+                if (builtNodes.length > 0) {
+                    inputNode.onSuccess = [{_id: builtNodes[0]._id}];
+                    for (let i = 0; i < builtNodes.length - 1; i++) {
+                        builtNodes[i].onSuccess = [{_id: builtNodes[i + 1]._id}];
+                    }
+                }
+
+                const payload = {
+                    name: params.name,
+                    description: params.description ?? null,
+                    type: trigger.type,
+                    app,
+                    skipAuth: params.skipAuth !== undefined ? params.skipAuth : true,
+                    inputNode,
+                    nodes: builtNodes
+                };
+
+                dnioClient.setToken(userContext.token);
+                const result = await dnioClient.dataPipes.create(app, payload);
+                const invocation = _flowInvocationUrl(dnioClient, app, result);
+                const response = {flowId: result._id, status: result.status, flow: result};
+                if (invocation) {
+                    response.invocation = invocation;
+                    response.note = `Flow created in '${result.status}' state. Run publish_flow(flowId='${result._id}') to make it live. PUBLIC INVOCATION URL: ${invocation.method} ${invocation.url} — use exactly this URL when telling the user how to call the flow. Do NOT use any url/host/gateway field elsewhere in the flow document; those are internal Kubernetes references.`;
+                }
+                return {content: [{type: 'text', text: JSON.stringify(response, null, 2)}]};
+            } catch (error) {
+                return toolError('Failed to create flow', error);
+            }
+        }
+    );
+
+    // ─── Node mutation ──────────────────────────────────────────────────────
+
+    server.registerTool(
+        'add_node_to_flow',
+        {
+            title: 'Add Node to Flow',
+            description: `Append a process node to an existing flow and wire it after another node. Always fetches the current flow, mutates it, and PUTs the full document.
+
+Wiring rules:
+  - Default: replace afterNodeId.onSuccess with [{ _id: <new node> }].
+  - If branchCondition is set: APPEND to afterNodeId.onSuccess so multiple branches can coexist (each entry has its own condition).
+
+Args:
+  - flowId (required)
+  - pluginObject (required): Full plugin object from list_process_plugins.
+  - name (required): Readable name; slug becomes the node _id.
+  - afterNodeId (required): _id of the node whose onSuccess should now point at this new node. Use the inputNode _id (e.g. 'http_server') to attach right after the trigger.
+  - options (optional): Node-specific options merged on top of platform defaults.
+  - mappings (required): Array of mapping entries. Two accepted forms (mix freely):
+      • SIMPLE (preferred):  { from: '<sourceNodeId>.<field>[.<nested>...]', to: '<targetField>', expression?: '<custom lodash template>' }
+        The tool walks the source node's outputSchema + the current node's inputSchema and builds the full DNIO mapping object (target / source / expression / children / dataPath / dataPathSegs / type / subType / etc.) for you. Pass only 'expression' (no 'from') for hardcoded values like '{{CONSTANTS.TOKEN}}'.
+      • FULL: pass an entry that already has 'target' as an object and 'source' as an array — used as-is.
+  - connector (optional): { _id: '<CONNECTOR_ID>' } — required when pluginObject.connectorType !== 'NONE'.
+
+PLUGIN OBJECT: pass either the full plugin from list_process_plugins, or just '{ _id: <installed plugin _id> }' or '{ type: 'V1_PARSE_JSON' }' — the tool re-fetches the plugin from /my-node and copies the canonical inputSchema / outputSchema / errorSchema / nodeId onto the persisted node. You don't need to round-trip the schemas through this call.
+
+SCHEMA OVERRIDES (optional): pin a node's inputSchema or outputSchema field to a specific Data Service so the platform UI shows typed fields instead of generic 'Schema'. Default behaviour is to use the plugin's marketplace schemas as-is — only pass this if the user explicitly asks to bind a field to a particular data format.
+
+  schemaOverrides: {
+    inputSchema: [
+      { key: 'data', refFormatType: 'service', refFormatId: 'SRVC13342' }
+    ],
+    outputSchema: [ /* same shape, optional */ ]
+  }
+
+The tool fetches the data service definition by refFormatId and embeds it as 'refData' on the matching field. Currently only refFormatType: 'service' is supported.
+  - coordinates (optional): { x, y }. Defaults to right of last node.
+  - branchCondition (optional): { condition: '<lodash expr>', name: '<branch label>', color?: '<hex>' } — adds as a conditional branch instead of replacing onSuccess.
+
+CODEBLOCK FALLBACK:
+When no installed plugin covers the task and the logic is trivial, use V1_CODEBLOCK as the pluginObject and pass the JavaScript in options.code.
+
+V1_CODEBLOCK is a PLATFORM BUILT-IN — DO NOT call list_marketplace_plugins or install_plugins for it (it isn't there). Pass it directly here:
+    add_node_to_flow({ pluginObject: { type: 'V1_CODEBLOCK' }, options: { code: '<your JS>' }, ... })
+The tool seeds a working default for options.code if you don't pass one — replace it via update_node_in_flow.options.code or pass the real code at add time.
+
+The function signature is fixed:
+
+  async function executeCode(inputData, node, connectorConfig) {
+    try {
+      let data = {};
+      // your logic here, reading from inputData and previous-node mappings
+      return data;            // becomes outputSchema.data downstream
+    } catch (err) {
+      logger.error(err);      // 'logger' is provided by the platform
+      throw err;               // routes to onError
+    }
+  }
+
+Notes:
+  - Only the function body matters; the platform invokes executeCode for you.
+  - inputData is a plain object built from the node's mappings.
+  - Use \`logger.info/debug/warn/error\` for runtime logs.
+  - V1_CODEBLOCK has connectorType=NONE; do not pass a connector.
+  - Always prefer a first-class plugin over a CODEBLOCK when one exists.
+
+HTTP RESPONSE NODE (V1_RESPONSE):
+For HTTP-triggered flows (V1_HTTP_SERVER) where the caller expects data back, the LAST node MUST be V1_RESPONSE. It IS a marketplace plugin — install_plugins if not already installed.
+
+Its inputSchema has three fields, and the typical mapping pattern is:
+  • data       (Buffer)      — the response body. Auto-maps from the previous node's 'data' (e.g. V1_RENDER_JSON, V1_PARSE_JSON, V1_CODEBLOCK all output 'data') because key names match.
+  • statusCode (Number)      — HTTP status. Pass an explicit hardcoded mapping: { to: 'statusCode', expression: '200' }
+  • headers    (KeyValPair)  — optional response headers. Leave unmapped unless the user asks for specific headers.
+
+Example call after a V1_RENDER_JSON node named 'render_response':
+  add_node_to_flow({
+    pluginObject: { type: 'V1_RESPONSE' },
+    name: 'send_response',
+    afterNodeId: 'render_response',
+    mappings: [
+      { from: 'render_response.data', to: 'data' },
+      { to: 'statusCode', expression: '200' }
+    ]
+  })
+
+Flows without V1_RESPONSE simply terminate without returning a body — fine for fire-and-forget endpoints (timer-triggered jobs, async processing), but breaks anything the HTTP caller waits on.
+${EXPRESSION_GLOBALS}`,
+            inputSchema: {
+                flowId: z.string().min(1),
+                pluginObject: z.record(z.any()).describe('Full plugin object from list_process_plugins'),
+                name: z.string().min(1),
+                afterNodeId: z.string().min(1),
+                options: z.record(z.any()).optional(),
+                mappings: z.array(z.record(z.any())).optional(),
+                connector: z.object({_id: z.string()}).optional(),
+                coordinates: z.object({x: z.number(), y: z.number()}).optional(),
+                branchCondition: z.object({
+                    condition: z.string(),
+                    name: z.string(),
+                    color: z.string().optional()
+                }).optional(),
+                schemaOverrides: z.object({
+                    inputSchema: z.array(z.object({
+                        key: z.string(),
+                        refFormatType: z.enum(['service']),
+                        refFormatId: z.string()
+                    })).optional(),
+                    outputSchema: z.array(z.object({
+                        key: z.string(),
+                        refFormatType: z.enum(['service']),
+                        refFormatId: z.string()
+                    })).optional()
+                }).optional()
+            },
+            annotations: {destructiveHint: false, idempotentHint: false}
+        },
+        async (params) => {
+            const guard = requireApp();
+            if (guard) return guard;
+            try {
+                const app = registry.selectedApp;
+                dnioClient.setToken(userContext.token);
+
+                // Always re-resolve the plugin so inputSchema / outputSchema / errorSchema
+                // / nodeId end up on the persisted node, even if the LLM dropped them.
+                let plugin;
+                try {
+                    plugin = await _resolvePlugin(dnioClient, app, params.pluginObject);
+                } catch (err) {
+                    return toolError('Plugin resolution failed', err);
+                }
+
+                // Optional per-field schema overlays (e.g. pin V1_RENDER_JSON's `data` field
+                // to a specific data service). Default keeps the plugin's marketplace schemas.
+                try {
+                    plugin = await _applyAllSchemaOverrides(dnioClient, app, plugin, params.schemaOverrides);
+                } catch (err) {
+                    return toolError('Schema override failed', err);
+                }
+
+                try {
+                    validateConnectorRequirement(plugin, params.connector);
+                } catch (err) {
+                    return toolError('Connector validation failed', err);
+                }
+
+                const flow = await dnioClient.dataPipes.get(app, params.flowId);
+
+                const after = findNodeRef(flow, params.afterNodeId);
+                if (!after) {
+                    return toolError(`afterNodeId '${params.afterNodeId}' not found in flow`, new Error('check inputNode._id and nodes[]._id'));
+                }
+
+                const ids = collectFlowIds(flow);
+                const newId = dedupeId(slugify(params.name), ids);
+                const coords = params.coordinates || {x: maxX(flow) + 200, y: 0};
+
+                let mappings, autoMapped;
+                try {
+                    const resolved = _resolveMappings(flow, params.afterNodeId, plugin.inputSchema || [], params.mappings);
+                    mappings = resolved.mappings;
+                    autoMapped = resolved.autoMapped;
+                } catch (err) {
+                    return toolError('Mapping build failed', err);
+                }
+                const unmapped = _unmappedFields(plugin.inputSchema || [], mappings);
+
+                const newNode = buildProcessNode(plugin, newId, {
+                    options: params.options,
+                    mappings,
+                    connector: params.connector,
+                    coordinates: coords,
+                    app
+                });
+                newNode.name = params.name;
+
+                flow.nodes = flow.nodes || [];
+                flow.nodes.push(newNode);
+
+                const edgeEntry = params.branchCondition
+                    ? {
+                        _id: newId,
+                        condition: params.branchCondition.condition,
+                        name: params.branchCondition.name,
+                        ...(params.branchCondition.color ? {color: params.branchCondition.color} : {})
+                    }
+                    : {_id: newId};
+
+                after.node.onSuccess = after.node.onSuccess || [];
+                if (params.branchCondition) {
+                    after.node.onSuccess.push(edgeEntry);
+                } else {
+                    after.node.onSuccess = [edgeEntry];
+                }
+
+                const result = await dnioClient.dataPipes.update(app, params.flowId, flow);
+                const response = {
+                    addedNodeId: newId,
+                    autoMapped,
+                    appliedMappings: mappings || [],
+                    unmappedInputFields: unmapped,
+                    flow: result
+                };
+                if (unmapped.length > 0) {
+                    response.note = `Node added, but ${unmapped.length} input field(s) [${unmapped.map(f => f.key).join(', ')}] are NOT mapped. If the right source is obvious from the upstream nodes' outputSchemas, call update_node_in_flow with explicit mappings. If not, ask the user how to populate these fields before publishing.`;
+                }
+                return {content: [{type: 'text', text: JSON.stringify(response, null, 2)}]};
+            } catch (error) {
+                return toolError(`Failed to add node to flow ${params.flowId}`, error);
+            }
+        }
+    );
+
+    server.registerTool(
+        'update_node_in_flow',
+        {
+            title: 'Update Node in Flow',
+            description: `Edit an existing node's options, mappings, coordinates, name, or connector. Fetches the full flow, mutates the matching node, PUTs the whole document.
+
+Only the fields you pass are merged in — others are left untouched. Pass options as a partial; it merges onto the existing options object (not the platform defaults).
+
+Args:
+  - flowId (required)
+  - nodeId (required): _id of the node to edit (or 'inputNode' to edit the trigger).
+  - options (optional): Partial options; merged onto existing.
+  - mappings (optional): Replaces the existing mappings array entirely. Same two accepted forms as add_node_to_flow:
+      • SIMPLE: { from: '<nodeId>.<field>', to: '<targetField>', expression?: '<custom>' } — the tool walks schemas to build the full DNIO mapping shape.
+      • FULL: pass entries with 'target' as an object and 'source' as an array — used as-is.
+  - coordinates (optional): { x, y }.
+  - name (optional): New name (does NOT change the _id).
+  - connector (optional): { _id }; sets options.connector.
+  - schemaOverrides (optional): Same shape as add_node_to_flow — pin a field's inputSchema or outputSchema to a specific data service. Only the listed fields are modified; the rest of the schema is left intact.
+${EXPRESSION_GLOBALS}`,
+            inputSchema: {
+                flowId: z.string().min(1),
+                nodeId: z.string().min(1),
+                options: z.record(z.any()).optional(),
+                mappings: z.array(z.record(z.any())).optional(),
+                coordinates: z.object({x: z.number(), y: z.number()}).optional(),
+                name: z.string().optional(),
+                connector: z.object({_id: z.string()}).optional(),
+                schemaOverrides: z.object({
+                    inputSchema: z.array(z.object({
+                        key: z.string(),
+                        refFormatType: z.enum(['service']),
+                        refFormatId: z.string()
+                    })).optional(),
+                    outputSchema: z.array(z.object({
+                        key: z.string(),
+                        refFormatType: z.enum(['service']),
+                        refFormatId: z.string()
+                    })).optional()
+                }).optional()
+            },
+            annotations: {destructiveHint: false, idempotentHint: true}
+        },
+        async (params) => {
+            const guard = requireApp();
+            if (guard) return guard;
+            try {
+                const app = registry.selectedApp;
+                dnioClient.setToken(userContext.token);
+                const flow = await dnioClient.dataPipes.get(app, params.flowId);
+
+                const ref = findNodeRef(flow, params.nodeId);
+                if (!ref) {
+                    return toolError(`Node '${params.nodeId}' not found in flow`, new Error('check inputNode._id and nodes[]._id'));
+                }
+
+                const node = ref.node;
+                if (params.options) node.options = {...(node.options || {}), ...params.options};
+                if (params.schemaOverrides) {
+                    try {
+                        if (params.schemaOverrides.inputSchema) {
+                            node.inputSchema = await _applySchemaOverrides(dnioClient, app, node.inputSchema, params.schemaOverrides.inputSchema);
+                        }
+                        if (params.schemaOverrides.outputSchema) {
+                            node.outputSchema = await _applySchemaOverrides(dnioClient, app, node.outputSchema, params.schemaOverrides.outputSchema);
+                        }
+                    } catch (err) {
+                        return toolError('Schema override failed', err);
+                    }
+                }
+                if (params.mappings) {
+                    try {
+                        node.mappings = _buildMappings(flow, node.inputSchema || [], params.mappings);
+                    } catch (err) {
+                        return toolError('Mapping build failed', err);
+                    }
+                }
+                if (params.coordinates) node.coordinates = params.coordinates;
+                if (params.name) node.name = params.name;
+                if (params.connector?._id) {
+                    node.options = node.options || {};
+                    node.options.connector = {_id: params.connector._id};
+                }
+
+                const result = await dnioClient.dataPipes.update(app, params.flowId, flow);
+                return {content: [{type: 'text', text: JSON.stringify({updatedNodeId: params.nodeId, flow: result}, null, 2)}]};
+            } catch (error) {
+                return toolError(`Failed to update node ${params.nodeId} in flow ${params.flowId}`, error);
+            }
+        }
+    );
+
+    server.registerTool(
+        'connect_nodes',
+        {
+            title: 'Connect / Re-route Nodes',
+            description: `Wire onSuccess or onError between existing nodes. Use to re-route flow paths or add branches after the fact.
+
+Mode:
+  - condition unset → replaces the source node's chosen edge with [{ _id: toNodeId }] (replace mode).
+  - condition set → APPENDS { _id: toNodeId, condition, name, color? } to the edge (branch mode).
+  - mode arg explicitly overrides this default.
+
+Args:
+  - flowId (required)
+  - fromNodeId (required): Source node _id (can be the inputNode).
+  - toNodeId (required): Target node _id.
+  - edge (optional, default 'onSuccess'): 'onSuccess' or 'onError'.
+  - condition (optional): Lodash-style branch expression (e.g. "_.isNull({{prev.data.content}})").
+  - branchName (optional): Branch label (required if condition is set).
+  - branchColor (optional): Hex color without '#'.
+  - mode (optional): 'append' or 'replace' to override the default behaviour.
+${EXPRESSION_GLOBALS}`,
+            inputSchema: {
+                flowId: z.string().min(1),
+                fromNodeId: z.string().min(1),
+                toNodeId: z.string().min(1),
+                edge: z.enum(['onSuccess', 'onError']).optional(),
+                condition: z.string().optional(),
+                branchName: z.string().optional(),
+                branchColor: z.string().optional(),
+                mode: z.enum(['append', 'replace']).optional()
+            },
+            annotations: {destructiveHint: false, idempotentHint: false}
+        },
+        async (params) => {
+            const guard = requireApp();
+            if (guard) return guard;
+            try {
+                const app = registry.selectedApp;
+                dnioClient.setToken(userContext.token);
+                const flow = await dnioClient.dataPipes.get(app, params.flowId);
+
+                const fromRef = findNodeRef(flow, params.fromNodeId);
+                if (!fromRef) {
+                    return toolError(`fromNodeId '${params.fromNodeId}' not found`, new Error(''));
+                }
+                const toRef = findNodeRef(flow, params.toNodeId);
+                if (!toRef) {
+                    return toolError(`toNodeId '${params.toNodeId}' not found`, new Error(''));
+                }
+                if (params.condition && !params.branchName) {
+                    return toolError('branchName is required when condition is set', new Error(''));
+                }
+
+                const edge = params.edge || 'onSuccess';
+                const mode = params.mode || (params.condition ? 'append' : 'replace');
+                const entry = params.condition
+                    ? {
+                        _id: params.toNodeId,
+                        condition: params.condition,
+                        name: params.branchName,
+                        ...(params.branchColor ? {color: params.branchColor} : {})
+                    }
+                    : {_id: params.toNodeId};
+
+                fromRef.node[edge] = fromRef.node[edge] || [];
+                if (mode === 'replace') {
+                    fromRef.node[edge] = [entry];
+                } else {
+                    fromRef.node[edge].push(entry);
+                }
+
+                const result = await dnioClient.dataPipes.update(app, params.flowId, flow);
+                return {content: [{type: 'text', text: JSON.stringify({from: params.fromNodeId, to: params.toNodeId, edge, mode, flow: result}, null, 2)}]};
+            } catch (error) {
+                return toolError(`Failed to connect nodes in flow ${params.flowId}`, error);
+            }
+        }
+    );
+
+    server.registerTool(
+        'remove_node_from_flow',
+        {
+            title: 'Remove Node From Flow',
+            description: `⚠️ Destructive. Remove a node from a flow and clean up dangling references in every other node's onSuccess and onError arrays.
+
+Refuses to remove the inputNode (cannot remove the trigger). Refuses if the inputNode's only successor is being removed and downstream nodes still exist, unless force=true.
+
+Args:
+  - flowId (required)
+  - nodeId (required): The _id of the node to remove.
+  - force (optional, default false): Remove even if it would orphan downstream nodes.`,
+            inputSchema: {
+                flowId: z.string().min(1),
+                nodeId: z.string().min(1),
+                force: z.boolean().optional()
+            },
+            annotations: {destructiveHint: true, idempotentHint: false}
+        },
+        async (params) => {
+            const guard = requireApp();
+            if (guard) return guard;
+            try {
+                const app = registry.selectedApp;
+                dnioClient.setToken(userContext.token);
+                const flow = await dnioClient.dataPipes.get(app, params.flowId);
+
+                if (flow.inputNode?._id === params.nodeId) {
+                    return toolError('Cannot remove the inputNode (trigger).', new Error(''));
+                }
+
+                const idx = (flow.nodes || []).findIndex(n => n._id === params.nodeId);
+                if (idx < 0) {
+                    return toolError(`Node '${params.nodeId}' not found in flow`, new Error(''));
+                }
+
+                // Orphan check: would removing this leave inputNode pointing to nothing while others exist?
+                if (!params.force) {
+                    const inSuccs = flow.inputNode?.onSuccess || [];
+                    const onlyEdgeIsThis = inSuccs.length === 1 && inSuccs[0]._id === params.nodeId;
+                    const moreNodesRemain = (flow.nodes || []).length > 1;
+                    if (onlyEdgeIsThis && moreNodesRemain) {
+                        return toolError('Removing this node would orphan downstream nodes. Pass force=true to remove anyway.', new Error(''));
+                    }
+                }
+
+                flow.nodes.splice(idx, 1);
+
+                const stripRef = (arr) => (arr || []).filter(e => e._id !== params.nodeId);
+                if (flow.inputNode) {
+                    flow.inputNode.onSuccess = stripRef(flow.inputNode.onSuccess);
+                    flow.inputNode.onError = stripRef(flow.inputNode.onError);
+                }
+                for (const n of flow.nodes) {
+                    n.onSuccess = stripRef(n.onSuccess);
+                    n.onError = stripRef(n.onError);
+                }
+
+                const result = await dnioClient.dataPipes.update(app, params.flowId, flow);
+                return {content: [{type: 'text', text: JSON.stringify({removedNodeId: params.nodeId, flow: result}, null, 2)}]};
+            } catch (error) {
+                return toolError(`Failed to remove node ${params.nodeId} from flow ${params.flowId}`, error);
+            }
+        }
+    );
+
+    server.registerTool(
+        'publish_flow',
+        {
+            title: 'Publish Flow',
+            description: `Publish a flow to move it out of Draft state. The platform validates the flow during publish — fix errors via the other flow tools and retry if it fails.
+
+For HTTP-triggered flows the response includes 'invocation: { method, url, warning }'. The URL pattern is {DNIO_BASE_URL}/b2b/pipes/{app}/{httpServerPath} (e.g. https://qa.datanimbus.io/b2b/pipes/dx-mcp/enrichUsersWithDob).
+
+⚠️  ONLY use 'invocation.url' when telling the user how to call the flow. The platform's publish response and the flow document itself contain internal Kubernetes service URLs (fields like 'url', 'host', 'deploymentName', 'yaml', often shaped like 'gateway.<namespace>.svc/api/b2b/<app>/<path>' or '/api/...' paths). Those are cluster-internal and NOT callable from outside — never paste them into a curl for the user.
+
+Args:
+  - flowId (required)`,
+            inputSchema: {
+                flowId: z.string().min(1)
+            },
+            annotations: {destructiveHint: false, idempotentHint: true}
+        },
+        async (params) => {
+            const guard = requireApp();
+            if (guard) return guard;
+            try {
+                dnioClient.setToken(userContext.token);
+                const result = await dnioClient.dataPipes.publish(registry.selectedApp, params.flowId);
+                // Fetch the flow afterwards to build the invocation URL for HTTP triggers.
+                let invocation = null;
+                try {
+                    const flow = await dnioClient.dataPipes.get(registry.selectedApp, params.flowId);
+                    invocation = _flowInvocationUrl(dnioClient, registry.selectedApp, flow);
+                } catch (_) { /* non-fatal — publish already succeeded */ }
+                const response = {flowId: params.flowId, result};
+                if (invocation) {
+                    response.invocation = invocation;
+                    response.note = `Published. Invoke with: ${invocation.method} ${invocation.url}`;
+                }
+                return {content: [{type: 'text', text: JSON.stringify(response, null, 2)}]};
+            } catch (error) {
+                return toolError(`Failed to publish flow ${params.flowId}`, error);
+            }
+        }
+    );
+};