@ductape/mcp 0.1.61 → 0.2.1

package/src/index.ts

@@ -1,4318 +0,0 @@
-#!/usr/bin/env node
-/**
- * Ductape MCP Server
- *
- * Exposes Ductape SDK operations as MCP tools by calling the backend proxy.
- *
- * Authentication:
- * Set DUCTAPE_PUBLISHABLE_KEY in the MCP server's env config to avoid passing
- * publishable_key on every tool call. Per-call publishable_key still overrides
- * the env var when provided.
- */
-
-import { createRequire } from 'module';
-import { execSync } from 'child_process';
-import { z } from 'zod';
-import {
-  executeViaProxy,
-  generateExecutablePayload,
-  getAssetSchemas,
-  type SDKModule,
-} from './proxy-client.js';
-
-const MODULES: SDKModule[] = [
-  'product', 'app', 'databases', 'graph', 'webhooks', 'notifications',
-  'events', 'messageBrokers', 'storage', 'vector', 'caches', 'sessions', 'quotas',
-  'actions', 'features', 'jobs', 'logs', 'resilience', 'health', 'fallback', 'secrets',
-];
-
-
-
-// ─── Exhaustive SDK Method & Params Reference ────────────────────────────────
-// Built from a complete read of sdk/ts/src/index.ts (Ductape class public API).
-// Each entry follows: [module].[method] → params array signature.
-// ─────────────────────────────────────────────────────────────────────────────
-
-const METHOD_DOCS = `
-━━━ TOOL SELECTION GUIDE ━━━
-
-There are THREE categories of operations. Use the right tool for each:
-
-  0. ADMINISTRATIVE OPERATIONS  (create/update products, apps, environments, cloud connections…)
-       These require an access key and CANNOT be done via ductape_execute (publishable key only).
-       → Use ductape_cli instead. Examples:
-           ductape_cli("products list")
-           ductape_cli("products create --name \\"My Product\\" --tag my-product")
-           ductape_cli("cloud connections list")
-           ductape_cli("link --product my-product --env dev")
-       If the CLI is not installed, ductape_cli will return install instructions automatically.
-       NOTE: Environments and app actions are configured in the Workbench UI — there are no CLI commands for them.
-
-       DECLARATIVE SYNC  (apply sessions, notifications, events from code; run DB migrations)
-       → Also use ductape_cli. The project must be linked first (ductape init --link).
-           ductape_cli("apply")                        # sync all: sessions + notifications + events
-           ductape_cli("apply sessions")               # sessions only
-           ductape_cli("apply notifications")          # notifications only
-           ductape_cli("apply events")                 # event brokers only
-           ductape_cli("apply --dry-run")              # preview without changes
-           ductape_cli("db schema generate")           # diff schema.json → write migration files
-           ductape_cli("db schema generate --destructive")  # also generate drop operations
-           ductape_cli("db migrate")                   # apply pending migration files
-           ductape_cli("db migrate --dry-run")         # preview without applying
-           ductape_cli("db migrate --env prd")         # apply to a specific environment
-           ductape_cli("db migrate status")            # show applied vs pending migrations
-           ductape_cli("db migrate status --json")     # machine-readable status
-           ductape_cli("db migrate rollback")          # roll back last migration
-           ductape_cli("db migrate rollback -n 3")     # roll back last 3 migrations
-
-       DATABASE SCHEMA FILE — ductape/database/schema.json
-       ─────────────────────────────────────────────────────────────────────────
-       IMPORTANT: "db schema generate" READS schema.json and emits migration files.
-       It does NOT create schema.json from scratch. You must write this file first.
-
-       If schema.json does not exist, "db schema generate" now auto-creates it and
-       attempts to hydrate it from the cloud (pass --db <tag> to enable cloud hydration):
-           ductape_cli("db schema generate --db statecraft-core")
-       If the cloud database is empty, schema.json will be created as [] and you must
-       populate it before running the command again.
-
-       FILE FORMAT — ductape/database/schema.json is a JSON array:
-       [
-         {
-           "db": "<database-component-tag>",
-           "tables": {
-             "<collection_name>": {
-               "<field_name>": {
-                 "type": "string|number|boolean|date|datetime|timestamp|uuid|object|array|json|text|decimal|bigint|smallint|double|binary|blob|time",
-                 "required": true,          // false by default (nullable)
-                 "unique": true,            // unique constraint on this field
-                 "index": true,             // create an index on this field (use with unique for unique index)
-                 "default": "value",        // default value ("now"/"NOW" → CURRENT_TIMESTAMP)
-                 "maxlength": 255,          // max length for string fields
-                 "enum": ["a", "b", "c"],   // restrict to enum values (sets type to string automatically)
-                 "primaryKey": true,        // mark as primary key
-                 "autoGenerate": true,      // auto-generate value on insert
-                 "float": true             // treat number as float (use with type: "number")
-               }
-             }
-           }
-         }
-       ]
-
-       SINGLE-FIELD INDEX: set index: true (+ unique: true for unique constraint)
-         "matchId": { "type": "string", "required": true, "unique": true, "index": true }
-
-       COMPOSITE INDEX: schema.json does not support composite indexes.
-       After running db schema generate, add a manual migration file in
-       ductape/migrations/<db-tag>/ with type "createIndex" and a fields array:
-         {
-           "tag": "create_map_events_match_seq_idx",
-           "name": "Composite unique index on matchId+sequence",
-           "up": [{
-             "type": "createIndex",
-             "collection": "map_events",
-             "name": "map_events_matchId_sequence_idx",
-             "fields": [{ "name": "matchId" }, { "name": "sequence" }],
-             "unique": true,
-             "ifNotExists": true
-           }],
-           "down": [{ "type": "dropIndex", "collection": "map_events", "name": "map_events_matchId_sequence_idx", "ifExists": true }],
-           "createdAt": "<ISO timestamp>"
-         }
-
-       WORKFLOW:
-         1. Create/edit ductape/database/schema.json with your collection definitions
-         2. ductape_cli("db schema generate --db <tag>")  → writes migration files
-         3. ductape_cli("db migrate --db <tag>")          → applies pending migrations
-         4. Add manual migration files for composite/partial indexes not expressible in schema.json
-
-  1. ASSET CREATION / UPDATE  (create, update, add, register… for ANY asset type)
-       ALL creation and update operations require an access key and CANNOT go through ductape_execute.
-       → Use ductape_cli for every create/update operation. Examples:
-           ductape_cli("apps create --name \\"Email Service\\" --description \\"Transactional email\\"")
-           ductape_cli("apps list")
-           ductape_cli("resources storage list")
-           ductape_cli("resources database create -f db-config.json")
-       This applies to: products, apps, and resources (databases, storage, caches, etc.),
-       cloud connections, and secrets. Environments, app actions, auths, quotas, fallbacks,
-       jobs, and healthchecks are configured in the Workbench UI. Features have no CLI create
-       command because their definitions are code-first through features.define.
-
-       ⚠ MULTI-ENV REQUIREMENT — applies to ALL product assets (storage, database, cache,
-       messageBroker, graph, vector, and any other resource with an envs array):
-       The envs array MUST contain one entry for EVERY environment defined on the product.
-       import-persist and provision-persist only generate a draft for ONE env at a time.
-       Calling import-persist once will fail with MISSING_ENV_COVERAGE because the single-env
-       draft does not cover all product environments. Use import-persist-all or
-       provision-persist-all instead — they accept an array of per-env inputs, import/provision
-       each env in parallel, merge the drafts, and persist once with full env coverage.
-
-       BEFORE constructing any resource file or initiating import/provision:
-         1. Run: ductape_cli("products environments list <product_tag> --json")
-         2. Note every slug returned (e.g. dev, snd, prd).
-         3. Collect connection details or confirmation for EACH slug from the user.
-            Do not proceed until you have details for every env.
-
-       Use import-persist-all / provision-persist-all (not the single-env forms) whenever
-       you have details for all envs. The file must be a JSON array — one object per env,
-       same format as a single import-persist/provision-persist input, all sharing the same
-       product and component tag. Example:
-         [{"cloud":"gcp-snd","service":"gcs","type":"storage","product":"my-prod",
-           "component":"assets","env":"snd","resource":"snd-bucket"},
-          {"cloud":"gcp-prd","service":"gcs","type":"storage","product":"my-prod",
-           "component":"assets","env":"prd","resource":"prd-bucket"}]
-         → ductape_cli("cloud resources import-persist-all -f all-envs.json --json")
-
-       Sharing one resource across multiple envs is allowed but must be confirmed per env:
-         - Ask the user explicitly: "Should <env> use the same <resource> as <other_env>?"
-         - Never assume shared configuration without confirmation.
-         - For cloud-linked envs, set config.cloud to the connection tag for that env and
-           omit raw credentials; the cloud connection must exist for that env too.
-
-  2. RUNTIME OPERATIONS  (run, dispatch, execute, start, send, produce, query, insert, update, delete…)
-       The "input" field shape is product- and operation-specific — it is NOT derivable from Joi validators.
-       It is defined by how the product's action/feature/session/quota/etc. was configured in Ductape.
-       → ALWAYS call ductape_generate_payload first to get the canonical payload template, EXCEPT for
-         messaging (produce/consume/dispatch) — see the Events section for why.
-       → The template shows you exactly which input keys are expected and their types/defaults.
-       → Then fill in the values and pass the completed payload to ductape_execute.
-       → Applies to: actions, features, sessions, notifications, databases, storage, graphs, vectors,
-         quotas, fallbacks, jobs, and any other operation that executes against a pre-configured schema.
-
-  Skipping ductape_generate_payload for applicable runtime operations will produce incorrect or empty input payloads.
-  Exception: messaging produce/consume/dispatch — the producer defines the schema, so infer from context instead.
-
-━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
-
-━━━ NESTJS INTEGRATION — use @ductape/nestjs ━━━
-
-When the target application is a NestJS service or controller, always use @ductape/nestjs
-instead of instantiating @ductape/sdk directly. It provides NestJS DI integration,
-global interceptors, decorators, and type-safe resource handles.
-
-SETUP — register once in AppModule:
-
-  ╔══════════════════════════════════════════════════════════════════════════╗
-  ║  redisUrl IS REQUIRED TO USE ANY *.dispatch()                          ║
-  ║                                                                          ║
-  ║  Every dispatch() call (actions, features, events, databases, storage,  ║
-  ║  graph, notifications, quotas, fallback) enqueues jobs                  ║
-  ║  via BullMQ over Redis. Without redisUrl the call throws at runtime:    ║
-  ║  "Queues not configured. dispatch() requires a queue connection."        ║
-  ║                                                                          ║
-  ║  *.run(), events.produce(), and @Events.Consumer do NOT need Redis.     ║
-  ║  Only dispatch() does — and it is non-negotiable.                       ║
-  ╚══════════════════════════════════════════════════════════════════════════╝
-
-  import { DuctapeModule } from '@ductape/nestjs';
-
-  @Module({
-    imports: [
-      DuctapeModule.forIntegration({
-        accessKey: process.env.DUCTAPE_ACCESS_KEY,
-        product: 'my-product',
-        env: process.env.NODE_ENV === 'production' ? 'prd' : 'snd',
-        redisUrl: process.env.DUCTAPE_REDIS_URL,  // required — no dispatch() works without this
-      }),
-    ],
-  })
-  export class AppModule {}
-
-  // Async (e.g. pulling from ConfigService):
-  DuctapeModule.forRootAsync({
-    imports: [ConfigModule],
-    inject: [ConfigService],
-    useFactory: (cfg: ConfigService) => ({
-      accessKey: cfg.get('DUCTAPE_ACCESS_KEY'),
-      product: cfg.get('DUCTAPE_PRODUCT'),
-      env: cfg.get('DUCTAPE_ENV'),
-      redisUrl: cfg.get('DUCTAPE_REDIS_URL'),  // required — no dispatch() works without this
-    }),
-  })
-
-  Environment variable (add to .env and deployment secrets):
-    DUCTAPE_REDIS_URL=redis://localhost:6379          # local dev
-    DUCTAPE_REDIS_URL=rediss://:<password>@host:6380  # managed Redis (TLS)
-
-INJECTING IN SERVICES AND CONTROLLERS — use @InjectContext():
-
-  import { InjectContext, DuctapeContext } from '@ductape/nestjs';
-
-  @Injectable()
-  export class MatchService {
-    constructor(@InjectContext() private readonly ductape: DuctapeContext) {}
-
-    async publishMatchState(matchId: string, state: object) {
-      await this.ductape.sdk.events.produce({
-        product: 'my-product',
-        env: 'prd',
-        event: 'statecraft-events:match-state',
-        message: { matchId, ...state },
-      });
-    }
-
-    async queryDatabase(env: string) {
-      const db = await this.ductape.database('core-db', { env });
-      return db.query({ table: 'matches', where: { active: true } });
-    }
-  }
-
-AVAILABLE ON DuctapeContext:
-
-  ctx.sdk                          — full @ductape/sdk instance (events, sessions, etc.)
-  ctx.database(tag, overrides?)    — connected DatabaseHandle (query, insert, update, delete)
-  ctx.storage(tag, overrides?)     — StorageHandle (upload, download, remove)
-  ctx.cache(tag, overrides?)       — CacheHandle (get, set, delete)
-  ctx.graph(tag, overrides?)       — GraphHandle
-  ctx.vector(tag, overrides?)      — VectorHandle
-  ctx.agent(tag, overrides?)       — AgentHandle
-  ctx.warehouse(overrides?)        — WarehouseHandle
-  ctx.cloudTiers(query?)           — query available cloud resource tiers and pricing
-  ctx.runJob({ product, env, event, input? })  — trigger a product job
-
-CONTROLLER DECORATORS:
-
-  @Product('my-product')   — override default product at class or method level
-  @Env('prd')              — override default env
-  @ApiRun({ app, action }) — bind a controller method to an app action (interceptor runs it automatically)
-  @ApiConfig({ app, ... }) — shared app credentials at class level
-  @Webhook.Register(...)   — register a webhook consumer URL
-  @Webhook.Consumer(...)   — mark inbound handler for forwarded webhook payloads
-
-FOR MESSAGING (events.produce / events.consume / events.dispatch):
-
-  In @ductape/nestjs, inject DuctapeContextService (not raw Ductape):
-    constructor(private readonly ductape: DuctapeContextService) {}
-
-  Produce immediately (method decorator — returns payload as message):
-    @Events.Produce({ event: 'broker-tag:topic-tag' })
-    emitOrderCreated(payload: { orderId: string }) { return payload; }
-
-  Dispatch (scheduled or immediate) — dispatch() CANNOT be used without redisUrl in forIntegration:
-    @Events.Dispatch({ broker: 'order-events', event: 'order-events:order-created', schedule: { every: 60000 } })
-    dispatchHeartbeat(payload: { message: { ping: boolean } }) { return payload; }
-
-  Dispatch with dynamic schedule — method returns { message, schedule?, retries? }:
-    @Events.Dispatch({ broker: 'statecraft-events', event: 'statecraft-events:boundary-due' })
-    scheduleBoundary(match: MatchLifecycle) {
-      return {
-        message: buildBoundaryCommand(match),
-        schedule: { start_at: match.nextBoundaryAt },
-        retries: 5,
-      };
-    }
-    // method return takes precedence over decorator schedule; use sdk.events.dispatch() directly
-    // when even the broker/event must vary at call time.
-    // ALL *.dispatch() calls require redisUrl — BullMQ over Redis. Without it dispatch throws.
-
-  Consume (method decorator — method is called for each incoming message):
-    @Events.Consumer({ event: 'order-events:order-created' })
-    async onOrderCreated(message: { orderId: string; total: number }) {
-      await this.processOrder(message);
-      // return to ack; throw to nack
-    }
-    // DuctapeEventsConsumerService wires this up automatically at module init.
-    // No manual onModuleInit needed when using the decorator.
-
-  Low-level SDK access (for produce only — not needed for consume with the decorator):
-    await this.ductape.sdk.events.produce({
-      product: 'my-product', env: 'prd',
-      event: 'broker-tag:topic-tag',
-      message: { ... },
-    });
-
-SPECIALIZED MODULES (for injecting handles directly without @InjectContext):
-
-  DuctapeDatabaseModule.forTags(['core-db'])   → inject with @Database('core-db')
-  DuctapeStorageModule.forTags(['assets'])     → inject with @Storage('assets')
-  DuctapeCacheModule, DuctapeGraphModule, DuctapeVectorModule — same pattern
-
-━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
-
-ALL params are passed as a JSON array in positional order matching the SDK signature.
-
-━━━ MODULE: product ━━━
-  IMPORTANT: ALL product.* methods require the access key and will return 403 with a publishable key.
-  Use ductape_cli for ALL product operations — never ductape_execute:
-    ductape_cli("products get --tag <tag> --json")           ← fetch product + full inventory
-    ductape_cli("products components list --tag <tag> --json") ← compact non-secret inventory
-    ductape_cli("products components get --tag <tag> --type notifications --json")
-    ductape_cli("products components get --tag <tag> --type events --json")
-    ductape_cli("products create --name <name> --tag <tag>")
-    ductape_cli("products environments list <tag> --json")
-    ductape_cli("products environments get <tag> <slug> --json")
-    ductape_cli("products apps list --product <id> --json")
-
-  SDK method signatures (for reference, admin key only):
-  product.create        [data: { name, description, tag?, envs?: [{slug, name}] }]
-  product.fetch         [product_tag: string]
-  product.update        [product_tag: string, data: { name?: string, description?: string }]
-  product.environments.create   [product_tag, data: { slug, env_name, description, active? }]
-  product.environments.list     [product_tag]
-  product.environments.fetch    [product_tag, slug]
-  product.apps.add      [product_tag, app: { access_tag, envs: [{ app_env_slug, product_env_slug, variables?, auth? }] }]
-  product.apps.list     [product_tag]
-  product.apps.fetch    [product_tag, access_tag]
-
-━━━ MODULE: app ━━━
-  app.create    [data: { app_name: string, description: string, unique?: boolean }]
-  app.fetch     [app_tag]
-  app.update    [app_tag, data: { app_name?: string, description?: string, logo?: string, colors?: { primary?: string, secondary?: string, accent?: string, background?: string }, require_whitelist?: boolean, aboutText?: string, aboutHTML?: string, request_type?: string }]
-  app.init      [app_tag]
-
-━━━ MODULE: actions (app actions) ━━━
-  actions.create  [app_tag, data: { tag: string, name: string, resource: string, method: "GET"|"POST"|"PUT"|"PATCH"|"DELETE", description?: string, body?: object, params?: object, query?: object, headers?: object, response?: { name?: string, status_code: number, success: boolean, body: object, response_format: "json"|"xml"|"form" } }]
-  actions.update  [app_tag, action_tag, data: { resource?: string, method?: "GET"|"POST"|"PUT"|"PATCH"|"DELETE", description?: string, request_type?: "json"|"xml"|"form", body?: object, query?: object, params?: object, headers?: object, response?: { name?: string, success: boolean, body: object, response_format: "json"|"xml"|"form", status_code: number } }]
-  actions.fetch   [app_tag, action_tag]
-  actions.list    [app_tag]
-  actions.run     [{ product, env, app, action, input: { "body:fieldName": value, ... } }]  ← CALL ductape_generate_payload FIRST (operation_family="action", method="run", targets={app, action})
-  actions.dispatch [{ product, env, app, action, input, retries?, session?, cache?, schedule?: { start_at?, cron?, every?, limit?, tz? } }]  ← CALL ductape_generate_payload FIRST (operation_family="action", method="dispatch") — requires redisUrl in ductape initialization
-
-━━━ MODULE: auths ━━━
-  auths.create  [app_tag, data: { tag: string, name: string, setup_type: "header"|"bearer"|"basic"|"oauth2"|"apikey", expiry: number, period: "seconds"|"minutes"|"hours"|"days", description: string, action_tag?: string }]
-  auths.update  [app_tag, auth_tag, data: { name?: string, setup_type?: "header"|"bearer"|"basic"|"oauth2"|"apikey", expiry?: number, period?: "seconds"|"minutes"|"hours"|"days", description?: string, action_tag?: string }]
-  auths.fetch   [app_tag, auth_tag]
-  auths.list    [app_tag]
-
-━━━ MODULE: webhooks ━━━
-  webhooks.create   [app_tag, data: { tag: string, name: string, description: string, envs?: [{ slug: string, registration_url?: string, method?: "GET"|"POST"|"PUT"|"PATCH", sample?: object }] }]
-  webhooks.update   [app_tag, webhook_tag, data: { name?: string, description?: string, envs?: [{ slug: string, registration_url?: string, method?: "GET"|"POST"|"PUT"|"PATCH", sample?: object }] }]
-  webhooks.fetch    [app_tag, webhook_tag]
-  webhooks.list     [app_tag]
-  webhooks.events.create [app_tag, data: { tag: string, name: string, selector: string, description: string, sample: object }]
-  webhooks.events.update [app_tag, event_tag, data: { name?: string, selector?: string, selectorValue?: string, description?: string, sample?: object }]
-  webhooks.events.fetch  [app_tag, event_tag]
-  webhooks.events.list   [app_tag, webhook_tag]
-
-━━━ MODULE: sessions ━━━
-  sessions.create        [product_tag, data: { tag: string, name: string, description?: string, expiry: number, period: "seconds"|"minutes"|"hours"|"days", selector: string, schema: Record<string, unknown> }]
-  ← selector MUST be in the format "$Session{fieldName}" (e.g. "$Session{playerId}"). Plain dot-paths are rejected.
-  ← schema is SAMPLE DATA — actual example values, not type declarations. The value at the selector path must be a primitive (string|number|boolean), not an object.
-  sessions.update        [product_tag, session_tag, data: { name?: string, description?: string, expiry?: number, period?: "seconds"|"minutes"|"hours"|"days", selector?: string, schema?: object }]
-  sessions.fetch         [product_tag, session_tag]
-  sessions.list          [product_tag]
-  sessions.delete        [product_tag, session_tag]
-  sessions.start         [{ product, env, tag, data: { key: value } }]  ← CALL ductape_generate_payload FIRST (operation_family="session", method="start", targets={tag}) to discover the data field shape
-  sessions.verify        [{ product, env, tag, token }]
-  sessions.refresh       [{ product, env, tag, refreshToken }]
-  sessions.revoke        [{ product, env, tag, sessionId?, identifier? }]
-  sessions.listActive    [{ product, env, tag, identifier?, page?, limit? }]
-  sessions.fetchUsers    [{ product, session, env?, page?, limit? }]
-  sessions.fetchUserDetails  [{ product, session, identifier, env? }]
-  sessions.fetchDashboard    [{ product, session, env? }]
-
-━━━ MODULE: quotas ━━━
-  quotas.create   [product_tag, data: {
-    tag: string,                          // unique identifier
-    name?: string,                        // display name
-    description?: string,
-
-    // INPUT SCHEMA (top-level): declares what fields the quota accepts when called at runtime.
-    // These are the fields callers will pass to quotas.run / quotas.dispatch.
-    // Construct this yourself — it is a schema declaration, not a runtime value.
-    input: {
-      fieldName: {
-        type: "string"|"number"|"boolean"|"object"|"array",
-        required?: boolean,
-        description?: string
-      }
-    },
-
-    options: [                            // list of providers tried in order
-      {
-        provider?: string,                // friendly name for this provider slot
-        app: string,                      // app tag whose action to call
-        type: "action",
-        event: string,                    // action tag on that app
-        quota: number,                    // max allowed uses for this provider
-        uses?: number,                    // current use count (usually 0 at creation)
-
-        // OPTIONS INPUT (per provider): maps the quota's declared input fields → the underlying action's fields.
-        // ← CALL ductape_generate_payload (operation_family="action", method="run", targets={app, event})
-        //   to discover what fields the action accepts, then wire them with "$Input{fieldName}" references.
-        input: { "body:field": "$Input{fieldName}" },
-
-        output: {},                       // expected output shape (can be {})
-        retries: number,
-        healthcheck?: string,             // optional healthcheck tag to gate this provider
-        check_interval?: number           // ms between health polls
-      }
-    ]
-  }]
-  quotas.update   [product_tag, quota_tag, data: { name?: string, description?: string, options?: array }]
-  quotas.fetch    [product_tag, quota_tag]
-  quotas.list     [product_tag]
-  quotas.delete   [product_tag, quota_tag]
-  quotas.run      [{ product: string, env: string, tag: string, input: { fieldName: value }, session?: string, cache?: string }]  ← CALL ductape_generate_payload FIRST (operation_family="quota", method="run", targets={tag})
-  quotas.dispatch [{ product: string, env: string, tag: string, input: object, session?: string, cache?: string, schedule?: { cron?: string, delay?: number, at?: string } }]  ← CALL ductape_generate_payload FIRST (operation_family="quota", method="dispatch") — requires redisUrl in ductape initialization
-
-━━━ MODULE: fallback ━━━
-  fallback.create   [product_tag, data: {
-    tag: string,
-    name?: string,
-    description?: string,
-
-    // INPUT SCHEMA (top-level): declares what fields the fallback accepts when called at runtime.
-    // These are the fields callers will pass to fallback.run / fallback.dispatch.
-    // Construct this yourself — it is a schema declaration, not a runtime value.
-    input: {
-      fieldName: {
-        type: "string"|"number"|"boolean"|"object"|"array",
-        required?: boolean,
-        description?: string
-      }
-    },
-
-    options: [                            // ordered list: primary first, then fallback(s)
-      {
-        provider?: string,                // friendly name e.g. "primary", "backup"
-        app: string,                      // app tag
-        type: "action",
-        event: string,                    // action tag
-
-        // OPTIONS INPUT (per provider): maps the fallback's declared input fields → the underlying action's fields.
-        // ← CALL ductape_generate_payload (operation_family="action", method="run", targets={app, event})
-        //   to discover what fields the action accepts, then wire them with "$Input{fieldName}" references.
-        input: { "body:field": "$Input{fieldName}" },
-
-        output: {},
-        retries: number,
-        healthcheck?: string,
-        check_interval?: number
-      }
-    ]
-  }]
-  fallback.update   [product_tag, fallback_tag, data: { name?: string, description?: string, options?: array }]
-  fallback.fetch    [product_tag, fallback_tag]
-  fallback.list     [product_tag]
-  fallback.delete   [product_tag, fallback_tag]
-  fallback.run      [{ product: string, env: string, tag: string, input: { fieldName: value }, session?: string, cache?: string }]  ← CALL ductape_generate_payload FIRST (operation_family="fallback", method="run", targets={tag})
-  fallback.dispatch [{ product: string, env: string, tag: string, input: object, session?: string, cache?: string, schedule?: { cron?: string, delay?: number, at?: string } }]  ← CALL ductape_generate_payload FIRST (operation_family="fallback", method="dispatch") — requires redisUrl in ductape initialization
-
-━━━ MODULE: health ━━━
-  health.create   [product_tag, data: { tag: string, name: string, description?: string, app?: string, event?: string, probe?: { type: "app"|"database"|"feature", app?: string, event?: string, input?: object }, interval: number, retries: number, envs: [{ slug: string, input?: object }], onFailure?: { notifications?: [{ notification: string, message: string, channels: { email?: { recipients: string[] }, push?: { recipients?: string[] }, sms?: { recipients: string[] } } }], webhooks?: [{ url: string, method?: "GET"|"POST", headers?: object, body?: object }] } }]
-  health.update   [product_tag, health_tag, data: { name?: string, description?: string, app?: string, event?: string, probe?: { type: "app"|"database"|"feature", app?: string, event?: string, input?: object }, interval?: number, retries?: number, envs?: [{ slug: string, input?: object }], onFailure?: object }]
-  health.fetch    [product_tag, health_tag]
-  health.list     [product_tag]
-  health.delete   [product_tag, health_tag]
-  health.status   [{ product, env, tag }]
-  health.run      [{ product, env, tag }]
-  health.check    [{ product, env, tag }]
-
-━━━ MODULE: notifications ━━━
-  notifications.create   [product_tag, data: { tag: string, name: string, type?: "email"|"push"|"sms"|"callback" }]
-  notifications.update   [product_tag, notif_tag, data: { name?: string, type?: "email"|"push"|"sms"|"callback" }]
-  notifications.fetch    [product_tag, notif_tag]
-  notifications.list     [product_tag]
-  notifications.delete   [product_tag, notif_tag]
-  notifications.messages.create  [product_tag, data: { tag: string, name: string, description?: string, push_notification?: { title: string, body: string, data?: object }, email?: { subject: string, template: string }, callback?: object, sms?: string }]
-  notifications.messages.update  [product_tag, msg_tag, data: { name?: string, description?: string, push_notification?: { title: string, body: string, data?: object }, email?: { subject: string, template: string }, callback?: object, sms?: string }]
-  notifications.messages.fetch   [product_tag, msg_tag]
-  notifications.messages.list    [product_tag, notification_tag]
-  notifications.send     [{ product, env, event, input: { ... } }]  ← CALL ductape_generate_payload FIRST (operation_family="notification", method="send", targets={notification})
-  notifications.email.send  [{ product, env, notification, input: { ... }, session?, cache? }]  ← CALL ductape_generate_payload FIRST (operation_family="notification", method="email.send")
-  notifications.push.send   [{ product, env, notification, input: { ... }, session?, cache? }]  ← CALL ductape_generate_payload FIRST (operation_family="notification", method="push.send")
-  notifications.sms.send    [{ product, env, notification, input: { ... }, session?, cache? }]  ← CALL ductape_generate_payload FIRST (operation_family="notification", method="sms.send")
-  notifications.callback.send [{ product, env, notification, input: { ... }, session?, cache? }]  ← CALL ductape_generate_payload FIRST (operation_family="notification", method="callback.send")
-  notifications.slack.send   [{ product, env, notification, input: { text?, blocks?, channel? }, session?, cache? }]
-  notifications.discord.send [{ product, env, notification, input: { content?, embeds? }, session?, cache? }]
-  notifications.dispatch   [{ product, env, notification, event, input, retries?, session?, cache?, schedule?: { cron?, every?, start_at? } }]  ← CALL ductape_generate_payload FIRST (operation_family="notification", method="dispatch") — requires redisUrl in ductape initialization
-  notifications.getMessages [{ product_tag?, env?, notification_tag?, status?, type?, start_date?, end_date?, page?, limit? }]
-
-━━━ MODULE: events  (alias: messageBrokers — both accepted; events matches the TS SDK naming) ━━━
-  events.create   [{ product: string, tag: string, name: string, description?: string, type: "kafka"|"rabbitmq"|"redis"|"sqs", envs: [{ slug: string, connection_url: string }] }]
-  events.update   [product_tag, broker_tag, data: { name?: string, description?: string, type?: "kafka"|"rabbitmq"|"redis"|"sqs", envs?: [{ slug: string, connection_url: string }] }]
-  events.fetch    [product_tag, broker_tag]
-  events.list     [product_tag]
-  events.delete   [product_tag, broker_tag]
-  events.topics.create  ← FORBIDDEN with publishable key. Use ductape_cli instead:
-    ductape_cli("events topics create -f topic.json")
-    topic.json: { tag: "broker-tag:topic-tag", name, description?, sample?, idempotent?, queueUrls?: [{ env_slug, url }] }
-  ← Always required before consuming. For SQS: must include queueUrls per env.
-  ← For Pub/Sub, Kafka, RabbitMQ, Redis, NATS: the first produce call auto-registers the topic,
-     but you should still create it explicitly so consumers can subscribe before any produce occurs.
-  events.topics.update  ← FORBIDDEN with publishable key. Use ductape_cli:
-    ductape_cli("events topics update --tag broker:topic -f patch.json")
-  events.topics.delete  ← FORBIDDEN with publishable key. Use ductape_cli:
-    ductape_cli("events topics delete --tag broker:topic")
-  events.topics.fetch  [product_tag, topic_tag]   ← safe via ductape_execute
-  events.topics.list   [product_tag, broker_tag]  ← safe via ductape_execute
-  events.produce  [{ product, env, event: "broker_tag:topic_tag", message: { key: value }, session?, cache? }]
-  events.consume  [{ product, env, event: "broker_tag:topic_tag", callback: "function_ref" }]
-  events.dispatch [{ product, env, event: "broker_tag:topic_tag", input: { message }, retries?, session?, cache?, schedule?: { cron?, every?, start_at? } }]  — event is always the fully-qualified "broker:topic" string; do NOT pass broker separately — requires redisUrl in ductape initialization
-  events.messages.query [{ product, env, brokerTag, topicTag?, producerTag?, consumerTag?, status?, startDate?, endDate?, page?, limit? }]
-  events.messages.getProducers [{ product, env, brokerTag, topicTag?, page?, limit? }]
-  events.messages.getConsumers [{ product, env, brokerTag, topicTag?, page?, limit? }]
-  events.messages.getDeadLetters [{ product, env, brokerTag, topicTag?, consumerTag?, startDate?, endDate?, page?, limit? }]
-  events.messages.getStats      [{ product, env, brokerTag }]
-  events.messages.getDashboard  [{ product, env, brokerTag }]
-
-━━━ MODULE: storage ━━━
-  storage.create   [{ product: string, tag: string, name: string, description?: string, envs: [{ slug: string, type: "aws"|"azure"|"gcp", config: { bucket?: string, region?: string, accessKeyId?: string, secretAccessKey?: string, containerName?: string, connectionString?: string, projectId?: string, keyFilename?: string } }] }]
-  storage.update   [product_tag, storage_tag, data: { name?: string, description?: string, envs?: [{ slug: string, type: "aws"|"azure"|"gcp", config: { bucket?: string, region?: string, accessKeyId?: string, secretAccessKey?: string } }] }]
-  storage.fetch    [product_tag, storage_tag]
-  storage.list     [product_tag]
-  storage.delete   [product_tag, storage_tag]
-  storage.upload   [{ product, env, storage, fileName, buffer: string|Buffer, mimeType? }]
-  storage.download [{ product, env, storage, fileName }]
-  storage.remove   [{ product, env, storage, fileName }]
-  storage.listFiles [{ product, env, storage, prefix?, limit?, continuationToken? }]
-  storage.getSignedUrl [{ product, env, storage, fileName, expiresIn?: number, action?: "read"|"write" }]
-  storage.stats    [{ product, env, storage, prefix?, session?, cache? }]
-  storage.testConnection [{ product, env, storage }]
-  storage.files.upload   [{ product, env, storage, fileName, buffer, mimeType? }]
-  storage.files.download [{ product, env, storage, fileName }]
-  storage.files.delete   [{ product, env, storage, fileName }]
-  storage.files.list     [{ product, env, storage, prefix?, limit?, continuationToken? }]
-  storage.files.getSignedUrl [{ product, env, storage, fileName, expiresIn?, action? }]
-  storage.dispatch [{ product, env, storage, operation, input, retries?, session?, cache?, schedule? }]  ← CALL ductape_generate_payload FIRST (operation_family="storage", method="dispatch", targets={storage}) — requires redisUrl in ductape initialization
-
-━━━ MODULE: databases ━━━
-  databases.create  [{ product, tag, name, description?, type: "mongodb"|"postgresql"|"mysql"|"sqlite",
-                       envs: [{ slug, connection_url?,
-                                cloud?,        ← workspace cloud-connection tag (omit connection_url when using this)
-                                authMode?,     ← "cloud_connection" when using cloud field
-                                dbName?,       ← REQUIRED for MongoDB cloud connections — the database name inside the cluster (e.g. "myapp_snd")
-                                instance?,     ← RDS/Cloud SQL instance id (provision flow only)
-                                region? }] }]
-  MONGODB CLOUD CONNECTION RULE: when type="mongodb" and cloud is set, dbName is MANDATORY.
-    Without dbName the Atlas API returns a URL with no database name and the adapter will throw
-    at migrate/connect time. Provide one dbName per env — they typically differ per environment:
-    e.g. { slug:"snd", cloud:"atlas-conn", authMode:"cloud_connection", dbName:"myapp_snd" }
-        { slug:"prd", cloud:"atlas-conn", authMode:"cloud_connection", dbName:"myapp_prd" }
-  databases.register [product_tag, data: IProductDatabase]
-  databases.list    [product_tag]
-  databases.fetch   [product_tag, database_tag]
-  databases.updateDatabase [product_tag, database_tag, data: { name?, description?, type?,
-                             envs?: [{ slug, connection_url?, cloud?, authMode?, dbName?, instance?, region? }] }]
-  databases.connect [{ product, env, database }]
-  databases.testConnection [{ product, env, database }]
-  databases.disconnect []
-  databases.query   [{ product, env, database, table, where?: {field: value}, select?: string[], orderBy?: [{field, order:"ASC"|"DESC"}], limit?, offset?, session?, cache? }]  ← CALL ductape_generate_payload FIRST (operation_family="database", method="query", targets={database, table})
-  databases.insert  [{ product, env, database, table, data: {key: value}|{key:value}[], returning?, session?, cache? }]  ← CALL ductape_generate_payload FIRST (operation_family="database", method="insert", targets={database, table})
-  databases.update  [{ product, env, database, table, data: {key:value}, where: {field: value}, returning?, session?, cache? }]  ← CALL ductape_generate_payload FIRST (operation_family="database", method="update", targets={database, table})
-  databases.delete  [{ product, env, database, table, where: {field: value}, returning?, session?, cache? }]  ← CALL ductape_generate_payload FIRST (operation_family="database", method="delete", targets={database, table})
-  databases.upsert  [{ product, env, database, table, data: {key:value}, conflictKeys: string[], returning?, session?, cache? }]  ← CALL ductape_generate_payload FIRST (operation_family="database", method="upsert", targets={database, table})
-  NOTE on write operations (insert/update/delete/upsert): if the proxy returns "Authentication failed",
-  the publishable key does not have write access for that database. Write permissions are configured
-  in Workbench → Tokens → Publishable Key. An access key is required for write operations that are
-  not explicitly enabled for the publishable key. In that case the operation must be performed
-  server-side using a full Ductape SDK instance initialized with an access key.
-  NOTE: ductape_generate_payload for databases returns:
-    payload.input  — ready-to-use input with real field names in where/data, plus session and cache inside input
-    meta.schema_context.database.fields          — { fieldName: { type, required, description?, sample? } } for the table
-    meta.schema_context.database.available_tables — list of all tables that have configured actions
-    meta.schema_warnings — array of warning strings; if it contains "No table schema discovered..." it means no
-      migrations or schema have been synced to the server yet. To fix this, tell the user:
-        "Run: ductape db schema push --db <database_tag> --env <env_slug>
-        This reads the live table schema from the database and syncs it to the Ductape server,
-        enabling accurate field guidance for AI operations. Once complete, retry your request."
-  databases.count   [{ product, env, database, entity, where? }]
-  databases.sum     [{ product, env, database, entity, field, where? }]
-  databases.avg     [{ product, env, database, entity, field, where? }]
-  databases.min     [{ product, env, database, entity, field, where? }]
-  databases.max     [{ product, env, database, entity, field, where? }]
-  databases.aggregate [{ product, env, database, entity, aggregations: [{type:"count"|"sum"|"avg"|"min"|"max", field?, alias}], where?, groupBy? }]
-  databases.schema.create [collection_name, definition: { fieldName: "string"|"number"|"boolean"|"date"|{type, required?, unique?, default?} }, options?]
-  databases.schema.drop   [collection_name, options?]
-  databases.schema.addField [collection, fieldName, definition]
-  databases.schema.dropField [collection, fieldName]
-  databases.schema.renameField [collection, oldName, newName]
-  databases.schema.modifyField [collection, fieldName, changes: Partial<{type, required, unique, default}>]
-  databases.schema.createIndex [collection, fields: string[]|[{field, order}], options?: {unique?, name?}]
-  databases.schema.dropIndex   [collection, indexName]
-  databases.schema.list   [schemaName?]
-  databases.schema.describe [collection_name]
-  databases.schema.indexes  [collection_name]
-  databases.migration.create [{ product, database, data: { name, tag, description?, value: { up: string[], down: string[] } } }]
-  databases.migration.update [{ product, tag, data: { name?, description?, value? } }]
-  databases.migration.fetch  [{ product, tag }]
-  databases.migration.list   [{ product, database }]
-  databases.migration.delete [{ product, tag }]
-  databases.migration.run    [migrations, options?]
-  databases.migration.rollback [migrations, count?]
-  databases.migration.history []
-  databases.migration.status [migrations]
-  databases.action.create [{ product, database, data: { tag, name, description?, type:"sql"|"nosql", query } }]
-  databases.action.update [{ product: string, tag: string, data: { name?: string, description?: string, query?: string } }]
-  databases.action.fetch  [action_tag]
-  databases.action.list   [database_tag]
-  databases.action.delete [action_tag]
-  databases.action.dispatch [{ product, env, database, action, input, schedule? }]  ← CALL ductape_generate_payload FIRST (operation_family="database", method="dispatch", targets={database: "db_tag", table: "table_name"}) — requires redisUrl in ductape initialization
-  databases.dispatch [{ product, env, database, action, input, schedule? }]  ← CALL ductape_generate_payload FIRST (operation_family="database", method="dispatch", targets={database: "db_tag", table: "table_name"}) — requires redisUrl in ductape initialization
-  databases.beginTransaction [{ product, env, database, isolationLevel?: "READ_COMMITTED"|"REPEATABLE_READ"|"SERIALIZABLE" }]
-    → returns a transaction object; pass it to insert/update/delete/upsert/query calls as the last argument.
-    Commit with: transaction.commit()   Rollback with: transaction.rollback()
-    BEFORE using transactions: ask the user which database type and tier they are running.
-    Transaction support varies by database — call ductape_docs({ topic: "transactions" }) for the full matrix.
-  databases.transaction [{ product, env, database, isolationLevel? }, async (tx) => { … }]
-    → managed transaction: commits automatically on success, rolls back on error.
-    Prefer this over beginTransaction when the callback is self-contained.
-    See ductape_docs({ topic: "transactions" }) for database/tier compatibility before proceeding.
-
-━━━ MODULE: graph ━━━
-  graph.create  [{ product, tag, name, description?, type: "neo4j"|"nebula"|"arangodb", envs: [{slug, connection_url, username?, password?}] }]
-  graph.fetch   [product_tag, graph_tag]
-  graph.list    [product_tag?]
-  graph.update  [product_tag, graph_tag, data: { name?: string, description?: string, type?: "neo4j"|"neptune"|"arangodb"|"memgraph", envs?: [{ slug: string, connection_url: string, username?: string, password?: string, database?: string, graphName?: string, region?: string }] }]
-  graph.delete  [graph_tag, product_tag?]
-  graph.connect [{ product, env, graph }]
-  graph.testConnection [config]
-  graph.createNode    [{ labels: string[], properties: { key: value } }, transaction?]
-  graph.findNodes     [{ labels?: string[], where?: { key: value }, limit?, skip? }, transaction?]
-  graph.findNodeById  [id: string|number, transaction?]
-  graph.updateNode    [{ id, properties: { key: value } }, transaction?]
-  graph.deleteNode    [{ id, detach?: boolean }, transaction?]
-  graph.mergeNode     [{ labels: string[], matchProps: { key: value }, setProps?: { key: value } }, transaction?]
-  graph.addLabels     [{ id, labels: string[] }, transaction?]
-  graph.removeLabels  [{ id, labels: string[] }, transaction?]
-  graph.setLabels     [{ id, labels: string[] }, transaction?]
-  graph.createRelationship [{ fromId, toId, type: string, properties?: { key: value } }, transaction?]
-  graph.findRelationships  [{ type?: string, where?, limit? }, transaction?]
-  graph.findRelationshipById [id, transaction?]
-  graph.updateRelationship   [{ id, properties: { key: value } }, transaction?]
-  graph.deleteRelationship   [{ id }, transaction?]
-  graph.mergeRelationship    [{ fromId, toId, type, matchProps?, setProps? }, transaction?]
-  graph.traverse      [{ startId, direction?: "in"|"out"|"both", relationshipTypes?: string[], maxDepth?, where? }, transaction?]
-  graph.shortestPath  [{ fromId, toId, relationshipType?, maxDepth? }, transaction?]
-  graph.allPaths      [{ fromId, toId, relationshipType?, maxDepth? }, transaction?]
-  graph.getNeighborhood [{ id, depth?, relationshipTypes? }, transaction?]
-  graph.findConnectedComponents [{ labels? }, transaction?]
-  graph.query    [cypher_query: string, params?: { key: value }, transaction?]
-  graph.getStatistics [transaction?]
-  graph.countNodes [labels?: string[], where?, transaction?]
-  graph.countRelationships [types?: string[], where?, transaction?]
-  graph.fullTextSearch [{ index, query, limit? }, transaction?]
-  graph.vectorSearch   [{ index, vector: number[], topK? }, transaction?]
-  graph.createNodeIndex [{ label, field, type?: "btree"|"fulltext"|"vector" }]
-  graph.createNodeConstraint [{ label, field, type: "unique"|"exists" }]
-  graph.createRelationshipIndex [{ type, field }]
-  graph.listIndexes []
-  graph.listConstraints []
-  graph.dropIndex [name: string]
-  graph.dropConstraint [name: string]
-  graph.listLabels []
-  graph.listRelationshipTypes []
-  graph.createAction [{ graphTag, tag, name, query, params? }, productTag?]
-  graph.listActions  [graphTag?, productTag?]
-  graph.getAction    [actionTag, graphTag?, productTag?]
-  graph.updateAction [actionTag, updates, graphTag?, productTag?]
-  graph.deleteAction [actionTag, graphTag?, productTag?]
-  graph.beginTransaction [options?]
-  graph.commitTransaction [transaction]
-  graph.rollbackTransaction [transaction]
-  graph.dispatch [data]  ← CALL ductape_generate_payload FIRST (operation_family="graph", method="dispatch", targets={graph}) — requires redisUrl in ductape initialization
-
-━━━ MODULE: vector ━━━
-  vector.create  [{ product, tag, name, description?, provider: "pinecone"|"qdrant"|"weaviate", dimensions: number, metric?: "cosine"|"euclidean"|"dotproduct", envs: [{slug, api_key, environment?}] }]
-  vector.update  [{ product: string, tag: string, data: { name?: string, description?: string, type?: "pinecone"|"qdrant"|"weaviate"|"chroma"|"milvus"|"pgvector"|"memory", dimensions?: number, metric?: "cosine"|"euclidean"|"dotproduct", envs?: [{ slug: string, endpoint?: string, apiKey?: string, region?: string, index?: string, namespace?: string }] } }]
-  vector.fetch   [{ product, tag }]
-  vector.list    [{ product }]
-  vector.delete  [{ product, tag }]
-  vector.connect [{ product, env, vector }]
-  vector.disconnect [{ product, env, vector }]
-  vector.query   [{ product, env, tag, vector: number[], topK?: number, filter?, namespace?, includeValues?, includeMetadata? }]
-  vector.upsert  [{ product, env, tag, vectors: [{id, values: number[], metadata?}], namespace? }]
-  vector.fetchVectors  [{ product, env, vector, ids: string[], namespace? }]
-  vector.deleteVectors [{ product, env, tag, ids: string[], namespace?, deleteAll? }]
-  vector.findSimilar   [{ product, env, vector, values: number[], topK?, filter?, namespace?, includeValues?, includeMetadata? }]
-  vector.upsertOne     [{ product, env, tag, id, values: number[], metadata?, namespace?, session? }]
-  vector.fetchOne      [{ product, env, vector, id, namespace? }]
-  vector.updateVector  [{ product, env, vector, id, values?, setMetadata?, mergeMetadata?, namespace? }]
-  vector.updateMetadata [{ product, env, vector, id, metadata: { key: value }, merge?, namespace? }]
-  vector.deleteByIds   [{ product, env, vector, ids: string[], namespace? }]
-  vector.deleteAll     [{ product, env, vector, namespace? }]
-  vector.listVectors   [{ product, env, vector, namespace?, prefix?, limit?, cursor? }]
-  vector.listAllVectors [{ product, env, vector, namespace?, prefix? }]
-  vector.listNamespaces [{ product, env, vector }]
-  vector.deleteNamespace [{ product, env, vector, namespace }]
-  vector.describeIndex  [{ product, env, vector }]
-  vector.getStats       [{ product, env, vector }]
-  vector.createIndex    [{ product, env, vector, name, dimensions, metric?, replicas?, shards? }]
-  vector.deleteIndex    [{ product, env, vector, name }]
-  vector.listIndexes    [{ product, env, vector }]
-  vector.count          [{ product, env, vector, namespace? }]
-
-━━━ MODULE: features ━━━
-  Feature definitions are code-first. Use features.define in application source; do not call
-  administrative create/update/delete methods through ductape_execute.
-  features.fetch   [product_tag, feature_tag]
-  features.fetchAll [product_tag]
-
-  features.define  [{
-    product?: string,
-    tag: string,
-    name: string,
-    description?: string,
-    input?: { fieldName: { type: string, required?: boolean } },
-    output?: object,
-    signals?: { signalName: { input?: object } },
-    queries?: { queryName: { handler?: function } },
-    options?: { timeout?: number, retries?: number },
-    envs?: [{ slug: string, active?: boolean }],
-    recordInput?: object,         // sample input for step-recording (run once during define)
-    recordScenarios?: object[],   // multiple recording scenarios for branching
-    branchOverrides?: object,     // force step results during recording to reach later branches
-    handler: async (ctx) => {
-      // ctx.input                – typed feature input
-      // ctx.step(tag, fn, rollback?, opts?)  – define a durable step
-      // ctx.api.run({ app, event, input }) – call an app action
-      // ctx.database.query/insert/update/delete({ database, event, ... })
-      // ctx.graph.execute({ graph, action, input })
-      // ctx.notification.send/email/push/sms({ notification, event, ... })
-      // ctx.storage.upload/download({ storage, event, input })
-      // ctx.events.produce({ event: "broker:topic", message: {} })
-      // ctx.quota.execute({ quota, input })
-      // ctx.fallback.execute({ fallback, input })
-      // ctx.healthcheck.getStatus(tag)
-      // ctx.sleep(ms|"1h30m")
-      // ctx.waitForSignal("signal-name", { timeout? })
-      // ctx.setState(key, value) / ctx.getState(key)
-      // ctx.feature(childId, childTag, childInput) – child feature
-    }
-  }]
-
-  features.execute [{   ← CALL ductape_generate_payload FIRST (operation_family="features", method="execute", targets={tag}) to discover the input field shape
-    product: string,
-    env: string,
-    tag: string,
-    input: { fieldName: value },
-    session?: string,             // "session_tag:jwt_token"
-    idempotency_key?: string,
-    cache?: string,
-    retries?: number,
-    timeout?: number
-  }]
-
-  features.dispatch [{   ← CALL ductape_generate_payload FIRST (operation_family="features", method="dispatch", targets={feature}) — requires redisUrl in ductape initialization
-    product: string,
-    env: string,
-    feature: string,
-    input: { fieldName: value },
-    schedule?: { start_at?: number|string, cron?: string, every?: number, limit?: number, endDate?: number|string, tz?: string },
-    session?: string,
-    cache?: string,
-    retries?: number
-  }]
-
-  features.signal  [{ product, env, feature_id, signal: string, payload?: object }]
-  features.query   [{ product, env, feature_id, query: string, params?: object }]
-  features.status  [executionId: string]
-  features.cancel  [executionId: string, reason?: string]
-  features.replay  [executionId: string, options?: object]
-  features.restart [executionId: string]
-  features.resume  [executionId: string]
-  features.replayFromStep [executionId: string, stepTag: string]
-  features.history [executionId: string]
-  features.stepDetail [executionId: string, stepTag: string]
-  features.relatedExecutions [executionId: string]
-  features.compare [executionId1: string, executionId2: string]
-
-━━━ MODULE: caches ━━━
-  caches.create  [product_tag, data: { name: string, tag: string, description?: string, expiry: number }]
-  ← expiry is in MILLISECONDS (e.g. 3600000 = 1 hour, 86400000 = 1 day). No type or envs — Ductape manages the store.
-  caches.update  [product_tag, cache_tag, data: { name?: string, description?: string, expiry?: number }]
-  caches.fetch   [product_tag, cache_tag]
-  caches.list    [product_tag]
-  caches.delete  [product_tag, cache_tag]
-  caches.get     [{ key: string }]
-  caches.set     [{ product, cache, key, value: string, componentTag?, componentType?, expiry?: string (ISO 8601 absolute timestamp — NOT a duration; e.g. new Date(Date.now()+3600000).toISOString() for 1h TTL), env }]
-  caches.clear   [{ key: string }]
-  caches.clearAll [{ product, cache, env? }]
-  caches.fetchValues [{ product, cache, env?, page?, limit?, expiryFilter?: "all"|"expiring"|"permanent"|"expired" }]
-  caches.fetchDashboard [{ product, cache, env? }]
-
-━━━ MODULE: jobs ━━━
-  jobs.create  [product_tag, data: { tag, name, description?, type: "action"|"notification"|"storage"|"database"|"publish", app?, event?, executions?, intervals?, start_at? }]
-  jobs.update  [product_tag, job_tag, data: { name?: string, description?: string, type?: "action"|"notification"|"storage"|"database"|"publish", app?: string, event?: string, executions?: number, intervals?: number, start_at?: number }]
-  jobs.fetch   [product_tag, job_tag]
-  jobs.list    [product_tag]
-  jobs.delete  [product_tag, job_tag]
-  jobs.get     [jobId: string]
-  jobs.listJobs [{ product?, status?, limit?, page? }]
-  jobs.cancel  [jobId, { reason? }?]
-  jobs.cancelMany [{ product?, status? }]
-  jobs.pause   [jobId]
-  jobs.pauseMany [{ product?, recurring? }]
-  jobs.resume  [jobId]
-  jobs.resumeMany [{ product?, status? }]
-  jobs.retry   [jobId, { delay? }?]
-  jobs.retryMany [{ status?, from? }]
-  jobs.reschedule [jobId, { start_at?, cron?, every? }]
-  jobs.getHistory [jobId, { limit? }?]
-  jobs.getStats   [{ product?, env?, from?, to? }?]
-
-━━━ MODULE: secrets ━━━
-  secrets.create  [{ key, value, description?, token_type?: "api"|"password"|"certificate", scope?: string[], envs?: string[], expires_at?: number }]
-  secrets.update  [key, { value?, description?, scope?, envs?, expires_at? }]
-  secrets.fetch   [key]
-  secrets.list    []
-  secrets.delete  [key]
-  secrets.revoke  [key]
-  secrets.exists  [key]
-  secrets.resolve [value, { env?, app? }?]
-  secrets.validate [value]
-
-━━━ MODULE: logs ━━━
-  logs.init   [product_tag?, app_tag?]   (at least one required)
-  logs.fetch  [{ product_id?, app_id?, env?, level?: "info"|"warn"|"error"|"debug", start_date?, end_date?, page?, limit? }]
-
-━━━ TOOL: ductape_schema ━━━
-  Use this tool to dynamically discover the full field manifest for Ductape asset creation and update operations,
-  derived live from the SDK's Joi validators. No arguments are required to get everything.
-
-  Arguments:
-    module?: "app" | "product"   (optional — omit to get both modules + all enums)
-
-  Returns:
-    When module is omitted:
-      {
-        modules: {
-          app:     { [method: string]: { fields: { [field]: FieldDef } } },
-          product: { [method: string]: { fields: { [field]: FieldDef } } }
-        },
-        enums: {
-          HttpMethods, AuthTypes, DataFormats, DataTypes, StatusCodes, TokenPeriods,
-          DatabaseTypes, AppComponents, ProductComponents, Categories, DefaultTypes,
-          EventTypes, InputsTypes, PublicStates
-        }
-      }
-
-    When module="app" or module="product":
-      { module: string, methods: { [method]: { fields: { [field]: FieldDef } } }, enums: { ... } }
-
-  FieldDef shape:
-    {
-      type: string,           // "string" | "number" | "boolean" | "object" | "array" | "alternatives" | "any"
-      required: boolean,
-      enum?: (string | number | boolean)[],   // present when field is restricted to specific values
-      fields?: { [key]: FieldDef },           // present for nested objects
-      items?: FieldDef,                       // present for arrays (describes each element)
-      oneOf?: FieldDef[],                     // present for alternatives (.try(...))
-      minLength?: number, maxLength?: number, // string length constraints
-      min?: number, max?: number,             // number range constraints
-      pattern?: string                        // string pattern regex
-    }
-
-  Example method keys for app module:
-    "create", "update", "environments.create", "environments.update",
-    "actions.create", "actions.update", "auths.create", "auths.update",
-    "variables.create", "variables.update", "constants.create", "constants.update",
-    "webhooks.create", "webhooks.update", "webhooks.events.create", "webhooks.events.update"
-
-  Example method keys for product module:
-    "create", "environments.create", "environments.update", "apps.add", "apps.update",
-    "databases.create", "databases.update", "notifications.create", "notifications.update",
-    "caches.create", "caches.update", "jobs.create", "jobs.update",
-    "messageBrokers.create", "messageBrokers.update", "fallbacks.create", "fallbacks.update",
-    "graphs.create", "graphs.update", "vectors.create", "vectors.update",
-    "sessions.create", "sessions.update", "healthchecks.create",
-    "quotas.create", "quotas.update", "functions.create", "functions.update",
-    "agents.create", "agents.update", "models.create", "models.update",
-    "storage.create", "storage.update"
-
-  When to use this tool:
-  - Before constructing an administrative asset file for ductape_cli or Workbench — use this to discover required fields
-  - To enumerate valid enum values (e.g. which DatabaseTypes or AuthTypes are accepted)
-  - To understand nested object shapes without reading SDK docs
-`;
-
-const executeInputSchema = z.object({
-  publishable_key: z.string().optional().describe('Your workspace publishable key. Omit if DUCTAPE_PUBLISHABLE_KEY is set in the MCP server env config.'),
-  module: z.enum(MODULES as [string, ...string[]]).describe(
-    'SDK module to target. Options: ' + MODULES.join(', ') + '.'
-  ),
-  method: z.string().describe(
-    'The SDK method to call. Use dot-notation for nested methods (e.g. "environments.create", "schema.addField", "messages.query").\n' +
-    'Full reference: see the METHOD_DOCS embedded in the params description.'
-  ),
-  params: z.array(z.any()).default([]).describe(METHOD_DOCS),
-});
-
-const payloadGenerateInputSchema = z.object({
-  publishable_key: z.string().optional().describe('Your workspace publishable key. Omit if DUCTAPE_PUBLISHABLE_KEY is set in the MCP server env config.'),
-  product_tag: z.string().describe('The product tag (e.g. "my-product"). Identifies which product configuration to read.'),
-  env_slug: z.string().describe('The environment slug (e.g. "dev", "prod"). Determines which env-specific values are used.'),
-  operation_family: z.string().describe(
-    'The operation category. One of: "action", "features", "database", "graph", "vector", "storage", ' +
-    '"notification", "messaging", "quota", "fallback", "healthcheck", "session", "cache".'
-  ),
-  method: z.string().describe(
-    'The method within the operation family. E.g. "run", "dispatch", "execute", "start", "send", "produce", ' +
-    '"query", "insert", "update", "delete". Must match an allowed method for the given operation_family.'
-  ),
-  targets: z.record(z.any()).optional().describe(
-    'Identifies the specific operation to generate a payload for. ' +
-    'For actions: { app: "app_tag", action: "action_tag" }. ' +
-    'For features: { feature: "feature_tag" }. ' +
-    'For databases: { database: "db_tag", table: "table_or_collection_name" }. ' +
-    '  Providing table is strongly recommended — the generator scans all actions configured for that table, ' +
-    '  aggregates field definitions (name, type, required, sample value), and returns them in ' +
-    '  meta.schema_context.database.fields. The where/data placeholders in the payload are also ' +
-    '  pre-filled with the real field names. meta.schema_context.database.available_tables lists ' +
-    '  every table the database has actions configured for, so you can discover table names first. ' +
-    'For graphs: { graph: "graph_tag", node_label?: "NodeLabel", edge_type?: "REL_TYPE" }. ' +
-    '  node_label and edge_type pre-fill the Cypher template; omit to get generic placeholders. ' +
-    '  meta.schema_context.graph.type tells you the engine (neo4j, neptune, etc.). ' +
-    'For vectors: { vector: "vector_tag", namespace?: "ns" }. ' +
-    '  meta.schema_context.vector surfaces dimensions, metric, and index so you know what size ' +
-    '  embedding to pass and which distance function is used. ' +
-    'For sessions: { session: "session_tag" }. ' +
-    'For notifications: { notification: "notif_tag" }. ' +
-    'For quotas/fallbacks: { tag: "resource_tag" }. ' +
-    'For storage: { storage: "storage_tag" }. ' +
-    'For messaging: { broker: "broker_tag", topic?: "topic_tag" }.'
-  ),
-  include_session: z.boolean().optional().describe(
-    'Include a session placeholder inside the generated input object. ' +
-    'Defaults to false for execution_context="system" and true otherwise. ' +
-    'The placeholder is named "<session_tag_token>" to indicate it expects the runtime JWT, not the tag name.'
-  ),
-  execution_context: z.enum(['user', 'delegated', 'system']).optional().default('user').describe(
-    'Actor intent for this runtime operation. "user" means an active request initiated by the authenticated user; ' +
-    '"delegated" means work acting on behalf of a user with a short-lived delegated identity or application-owned ' +
-    'immutable actor context; "system" means intentionally unattributed background work. This drives session warnings.'
-  ),
-  include_cache: z.boolean().optional().describe(
-    'Include a cache tag inside the generated payload. Defaults to false; set true only when the runtime call should use cache explicitly.'
-  ),
-  schema_mode: z.enum(['strict', 'best_effort']).optional().default('best_effort').describe(
-    '"strict" — fail if any required field cannot be resolved. ' +
-    '"best_effort" — fill what is known, leave unknowns as null/placeholder. Use best_effort when exploring.'
-  ),
-  input_hint: z.record(z.any()).optional().describe(
-    'Optional. Partial input values you already know. These are merged into the generated payload template ' +
-    'so the result is pre-filled. Use this to get a payload with known values already substituted.'
-  ),
-});
-
-const snippetGenerateInputSchema = payloadGenerateInputSchema.extend({
-  language: z.enum(['typescript', 'python']).default('typescript'),
-});
-
-const schemaInputSchema = z.object({
-  module: z.enum(['app', 'product']).optional().describe(
-    'Optional. Scope the result to a single module ("app" or "product"). Omit to get the full manifest including enums.'
-  ),
-});
-
-function toPrettyJson(value: unknown): string {
-  return JSON.stringify(value ?? {}, null, 2);
-}
-
-const ALLOWED_SNIPPET_METHODS: Record<string, string[]> = {
-  action: ['run', 'dispatch', 'execute'],
-  features: ['run', 'dispatch', 'execute'],
-  database: ['dispatch', 'find', 'insert', 'update', 'delete', 'query', 'upsert', 'count', 'aggregate'],
-  graph: ['dispatch', 'find', 'insert', 'update', 'delete', 'query', 'execute'],
-  vector: ['query', 'find', 'findSimilar', 'upsert', 'insert', 'delete', 'dispatch'],
-  storage: ['dispatch', 'upload', 'download', 'remove', 'listFiles', 'getSignedUrl', 'stats'],
-  notification: ['dispatch', 'send', 'email.send', 'push.send', 'sms.send', 'callback.send', 'slack.send', 'discord.send'],
-  messaging: ['dispatch', 'send', 'publish', 'produce', 'consume'],
-  broker: ['dispatch', 'send', 'publish', 'produce', 'consume'],
-  quota: ['run', 'dispatch', 'check', 'consume'],
-  fallback: ['run', 'dispatch'],
-  healthcheck: ['run', 'check', 'status'],
-  health: ['run', 'check', 'status'],
-  session: ['start', 'verify', 'refresh', 'revoke', 'listActive'],
-  cache: ['get', 'set', 'clear', 'clearAll', 'dispatch', 'fetchValues'],
-};
-
-function ensureSupportedSnippetOperation(operationFamily: string, method: string): void {
-  const family = String(operationFamily || '').toLowerCase();
-  const m = String(method || '');
-  const allowed = ALLOWED_SNIPPET_METHODS[family] || [];
-  if (!allowed.includes(m)) {
-    const supportedFamilies = Object.keys(ALLOWED_SNIPPET_METHODS).sort().join(', ');
-    throw new Error(
-      `Unsupported snippet operation "${family}.${m}". Allowed methods for "${family}": ${allowed.join(', ') || '(none)'}.\n` +
-      `Supported families: ${supportedFamilies}`,
-    );
-  }
-}
-
-function resolveSdkCallPath(operationFamily: string, method: string): string {
-  const family = String(operationFamily || '').toLowerCase();
-  const m = String(method || '').toLowerCase();
-
-  if (family === 'action') return `actions.${m}`;
-  if (family === 'features' || family === 'feature') return `features.${m}`;
-  if (family === 'database') return m === 'dispatch' ? 'databases.dispatch' : `databases.${m}`;
-  if (family === 'graph') return m === 'dispatch' ? 'graph.dispatch' : `graph.${m}`;
-  if (family === 'vector') return `vector.${m}`;
-  if (family === 'storage') return m === 'dispatch' ? 'storage.dispatch' : `storage.${m}`;
-  if (family === 'notification') return m === 'dispatch' ? 'notifications.dispatch' : `notifications.${m}`;
-  if (family === 'messaging' || family === 'broker' || family === 'events' || family === 'event') {
-    if (m === 'dispatch') return 'events.dispatch';
-    if (m === 'send' || m === 'publish' || m === 'produce') return 'events.produce';
-    return `events.${m}`;
-  }
-  if (family === 'quota') return `quotas.${m}`;
-  if (family === 'fallback') return `fallback.${m}`;
-  if (family === 'healthcheck' || family === 'health') return `health.${m}`;
-  if (family === 'session') return `sessions.${m}`;
-  if (family === 'cache') return m === 'dispatch' ? 'caches.dispatch' : `caches.${m}`;
-  return `${family}.${m}`;
-}
-
-function buildSdkInvocationArgs(payload: Record<string, unknown>): Record<string, unknown> {
-  const input = (payload?.input as Record<string, unknown>) || {};
-  return {
-    product: payload?.product_tag,
-    env: payload?.env,
-    ...input,
-    ...(payload?.session ? { session: payload.session } : {}),
-    ...(payload?.cache ? { cache: payload.cache } : {}),
-  };
-}
-
-function operationAcceptsSession(operationFamily: string, method: string): boolean {
-  const family = operationFamily.toLowerCase();
-  const sessionFamilies = new Set([
-    'action', 'features', 'feature', 'database', 'graph', 'vector', 'storage',
-    'notification', 'messaging', 'broker', 'events', 'event', 'quota', 'fallback',
-  ]);
-  if (!sessionFamilies.has(family)) return false;
-  return !['consume', 'status', 'check', 'fetch', 'list'].includes(method.toLowerCase());
-}
-
-function addSessionAwarenessMetadata(
-  generated: any,
-  args: z.infer<typeof payloadGenerateInputSchema>,
-): any {
-  const acceptsSession = operationAcceptsSession(args.operation_family, args.method);
-  const executionContext = args.execution_context ?? 'user';
-  const payloadHasSession = Boolean(generated?.payload?.session || generated?.payload?.input?.session);
-  const sessionRequested = args.include_session ?? executionContext !== 'system';
-  const warnings: string[] = [];
-
-  if (acceptsSession && executionContext !== 'system' && (!sessionRequested || !payloadHasSession)) {
-    warnings.push(
-      `Session attribution is missing for a ${executionContext}-context operation. ` +
-      'Pass the original full session token for immediate user work, or an approved delegated identity/immutable actor context for delayed work.',
-    );
-  }
-  if (executionContext === 'system' && payloadHasSession) {
-    warnings.push(
-      'This operation is marked system-context but contains a session placeholder. Remove it unless the work is actually user/delegated.',
-    );
-  }
-
-  generated.meta = {
-    ...(generated?.meta ?? {}),
-    session_awareness: {
-      accepts_session: acceptsSession,
-      execution_context: executionContext,
-      appears_user_context: executionContext === 'user',
-      session_requested: sessionRequested,
-      session_present_in_payload: payloadHasSession,
-      intentionally_system_context: executionContext === 'system',
-      warnings,
-    },
-  };
-  return generated;
-}
-
-function buildTypeScriptSnippet(
-  payload: Record<string, unknown>,
-  operationFamily: string,
-  method: string,
-): string {
-  const callPath = resolveSdkCallPath(operationFamily, method);
-  const invocationArgs = buildSdkInvocationArgs(payload);
-  return `import Ductape from "@ductape/sdk";
-
-const ductape = new Ductape({
-  workspace_id: process.env.DUCTAPE_WORKSPACE_ID!,
-  user_id: process.env.DUCTAPE_USER_ID!,
-  public_key: process.env.DUCTAPE_PUBLIC_KEY!,
-});
-
-async function run() {
-  const payload = ${toPrettyJson(payload)};
-  const args = ${toPrettyJson(invocationArgs)};
-  const result = await ductape.${callPath}(args);
-  return { payload, result };
-}
-
-run().catch(console.error);
-`;
-}
-
-function buildPythonSnippet(
-  payload: Record<string, unknown>,
-  operationFamily: string,
-  method: string,
-): string {
-  const callPath = resolveSdkCallPath(operationFamily, method);
-  const invocationArgs = buildSdkInvocationArgs(payload);
-  return `from ductape import Ductape
-import os
-import json
-
-ductape = Ductape(
-    workspace_id=os.environ.get("DUCTAPE_WORKSPACE_ID"),
-    user_id=os.environ.get("DUCTAPE_USER_ID"),
-    public_key=os.environ.get("DUCTAPE_PUBLIC_KEY"),
-)
-
-def run():
-    payload = ${toPrettyJson(payload)}
-    args = ${toPrettyJson(invocationArgs)}
-    result = ductape.${callPath}(args)
-    return {"payload": payload, "result": result}
-
-if __name__ == "__main__":
-    print(json.dumps(run(), indent=2))
-`;
-}
-
-function buildSnippet(
-  language: 'typescript' | 'python',
-  payload: Record<string, unknown>,
-  operationFamily: string,
-  method: string,
-): string {
-  return language === 'python'
-    ? buildPythonSnippet(payload, operationFamily, method)
-    : buildTypeScriptSnippet(payload, operationFamily, method);
-}
-
-
-// ─── CLI helpers ─────────────────────────────────────────────────────────────
-
-// Per-process cache: avoids re-running whoami / workspaces use on every call.
-let authState: 'unknown' | 'ok' | 'none' = 'unknown';
-let workspaceSynced = false;
-
-const ADMIN_SUBCOMMANDS = [
-  'login', 'logout', 'whoami',
-  'profiles',
-  'workspaces',
-  'link', 'unlink', 'init',
-  'products', 'apps',
-  'resources',
-  'notifications',
-  'events',
-  'cloud',
-  'secrets',
-  'generate',
-  'apply',
-  'db',
-  'graph',
-];
-
-function checkCli(): { available: boolean; version?: string } {
-  try {
-    const out = execSync('ductape --version', {
-      encoding: 'utf8',
-      timeout: 5000,
-      stdio: ['pipe', 'pipe', 'pipe'],
-      env: cliEnvironment(),
-    }).trim();
-    return { available: true, version: out || 'unknown' };
-  } catch {
-    return { available: false };
-  }
-}
-
-function checkLoginState(): 'ok' | 'none' {
-  try {
-    // `ductape whoami` only reports whether a local credentials file exists. It does not validate
-    // the stored token, so an expired token would be cached as authenticated and fail later with 401.
-    // Use a harmless authenticated read to validate the credential against the API.
-    execSync('ductape workspaces list --json', {
-      encoding: 'utf8',
-      timeout: 10000,
-      stdio: ['pipe', 'pipe', 'pipe'],
-      env: cliEnvironment(),
-    });
-    authState = 'ok';
-    return 'ok';
-  } catch {
-    authState = 'none';
-    return 'none';
-  }
-}
-
-function syncWorkspace(): void {
-  const target = process.env.DUCTAPE_WORKSPACE;
-  workspaceSynced = true; // mark done regardless so we don't retry on every call
-  if (!target) return;
-  try {
-    execSync(`ductape workspaces use "${target}"`, {
-      encoding: 'utf8',
-      timeout: 10000,
-      stdio: ['pipe', 'pipe', 'pipe'],
-      env: cliEnvironment(),
-    });
-  } catch {
-    // best-effort; if it fails the user will see workspace-mismatch errors on subsequent commands
-  }
-}
-
-function runCli(command: string): { success: boolean; output: string } {
-  const first = command.trim().split(/\s+/)[0];
-  if (!ADMIN_SUBCOMMANDS.includes(first)) {
-    return {
-      success: false,
-      output: `Subcommand "${first}" is not in the allowed admin subcommand list. Allowed: ${ADMIN_SUBCOMMANDS.join(', ')}.`,
-    };
-  }
-  // Auto-inject --workspace on login if DUCTAPE_WORKSPACE is set and caller hasn't specified one
-  let finalCommand = command;
-  const ws = process.env.DUCTAPE_WORKSPACE;
-  if (first === 'login' && ws && !command.includes('--workspace') && !command.includes('--skip-workspace-select')) {
-    finalCommand = `${command} --workspace "${ws}"`;
-  }
-  try {
-    const output = execSync(`ductape ${finalCommand}`, {
-      encoding: 'utf8',
-      // Must exceed the proxy's operation timeout so stderr can preserve the structured timeout
-      // instead of this wrapper killing the CLI first and reducing it to "(no data)".
-      timeout: 90000,
-      stdio: ['pipe', 'pipe', 'pipe'],
-      env: cliEnvironment(),
-    });
-    return { success: true, output: output.trim() };
-  } catch (err: any) {
-    const msg = (err.stderr || err.stdout || err.message || String(err)).trim();
-    if (/\bHTTP 401\b|unauthori[sz]ed|invalid token|token expired/i.test(msg)) {
-      // Distinguish a genuinely expired login from a command-specific endpoint/auth bug.
-      // A valid workspace read proves the CLI session and selected workspace are authenticated.
-      if (checkLoginState() === 'ok') {
-        return {
-          success: false,
-          output: [
-            'The Ductape CLI session and active workspace are authenticated, but this command endpoint returned HTTP 401.',
-            'Do not ask the user to log in again and do not retry through ductape_execute.',
-            'This indicates a CLI command routing or endpoint authorization problem.',
-            '',
-            'Update the Ductape CLI to the latest version and retry the same ductape_cli command.',
-            `Original command: ductape ${command}`,
-          ].join('\n'),
-        };
-      }
-      authState = 'none';
-      workspaceSynced = false;
-      return {
-        success: false,
-        output: [
-          'Ductape CLI authentication expired or was revoked (HTTP 401).',
-          'This administrative operation correctly used ductape_cli; do not retry it through ductape_execute.',
-          '',
-          'Re-authenticate locally in a trusted terminal:',
-          '  ductape login',
-          'or use an OAuth flow:',
-          '  ductape login --browser google',
-          '  ductape login --browser github',
-          '',
-          'Do not paste a password, OAuth callback token, or stored CLI credential into an agent prompt.',
-          'After login succeeds, retry the same ductape_cli command.',
-        ].join('\n'),
-      };
-    }
-    return { success: false, output: msg };
-  }
-}
-
-/**
- * MCP is publishable-key-only. The standalone CLI may manage its own access-key
- * credentials, but an access key present in the MCP host environment is never
- * forwarded into CLI subprocesses.
- */
-function cliEnvironment(): NodeJS.ProcessEnv {
-  const environment = { ...process.env };
-  delete environment.DUCTAPE_ACCESS_KEY;
-  return environment;
-}
-
-const docsInputSchema = z.object({
-  topic: z.string().describe(
-    'Feature topic to look up. Supported: ' +
-    'transactions, presave, triggers, aggregations, migrations, indexes, performance, actions, ' +
-    'graphs, storage, cloud, vector, warehouse, secrets, apps, products, sessions, caches, ' +
-    'notifications, resilience, features, events, logs, frontend, frontend-analytics, client, react, vue',
-  ),
-});
-
-const DOCS: Record<string, string> = {
-  frontend: `
-DUCTAPE FRONTEND SDK GUIDE
-
-Choose one integration package:
-  React 17+  — npm install @ductape/react
-               Provider and hooks built on @ductape/client.
-               Continue with ductape_docs({ topic: "react" }).
-  Vue 3+     — npm install @ductape/vue
-               Plugin and composables built on @ductape/client.
-               Continue with ductape_docs({ topic: "vue" }).
-  Other UI   — npm install @ductape/client
-  frameworks   Use directly with Svelte, Angular, vanilla JavaScript, or a custom adapter.
-               Continue with ductape_docs({ topic: "client" }).
-
-Do not install @ductape/client separately when using @ductape/react or @ductape/vue unless the
-application also needs direct access to a client API not exposed by the framework package. Both
-framework packages wrap @ductape/client and expose the underlying client through useDuctape().
-
-SHARED APPLICATION LIFECYCLE
-  1. Create one client at the application root using a browser-safe publishableKey, proxy baseUrl,
-     default product tag, and environment slug.
-  2. Connect the real-time client only in the browser. In React use DuctapeProvider autoConnect or
-     connect() after mount; in Vue use createDuctape({ autoConnect: true }) or connect() in onMounted.
-  3. Authenticate the player with the sessions API and retain the returned session token according
-     to the application's security policy. Refresh it before expiry (the React/Vue packages provide
-     useSessionAutoRefresh) and revoke it on logout.
-  4. Pass the session value when connecting a broker that requires player-scoped authorization.
-  5. Subscribe through the framework hook/composable or the client service. Always unsubscribe on
-     component teardown; the framework integrations do this automatically for declarative hooks.
-  6. The underlying client reconnects its WebSocket and restores active subscriptions. Observe
-     connectionState to render disconnected/reconnecting UI; do not create duplicate subscriptions.
-  7. Disconnect resource sessions and the root client when the owning application scope is torn down.
-
-PRODUCT ANALYTICS
-  Frontend product analytics complements backend session propagation; neither replaces the other.
-  Continue with ductape_docs({ topic: "frontend-analytics" }) for identity lifecycle, pageviews,
-  custom events, privacy masking, hidden-state safety, trace correlation, and package-version checks.
-
-AUTHENTICATION AND SECURITY
-  - Use publishableKey in browser applications. Never ship workspace private keys or privileged
-    access keys in frontend bundles.
-  - A Ductape player session and the real-time transport connection are separate: authenticate or
-    refresh the session, then use that session when opening player-scoped broker resources.
-  - For SSR, create/connect the real-time client only on the browser side.
-
-MIGRATING A CUSTOM WRAPPER
-  - Keep @ductape/client when the wrapper implements application-specific projection or state logic.
-  - For React, move root connection ownership to DuctapeProvider, replace imperative subscriptions
-    with useBroker/useBrokerSubscription, and keep projection reduction in an application hook.
-  - For Vue, move root ownership to createDuctape(), replace imperative subscriptions with
-    useBroker/useBrokerSubscription, and keep projection reduction in an application composable.
-  - Verify session handoff, initial loading state, error state, reconnect UI, subscription cleanup,
-    and duplicate-event behavior with a live end-to-end run before removing the old wrapper.
-`.trim(),
-
-  transactions: `
-DUCTAPE DATABASE TRANSACTIONS
-
-Ask the user which database type and tier they are using before advising on transaction support.
-
-Support matrix:
-  PostgreSQL   — full ACID; all isolation levels (READ_UNCOMMITTED, READ_COMMITTED,
-                  REPEATABLE_READ, SERIALIZABLE). Always supported.
-  MySQL        — full ACID; same isolation levels as PostgreSQL.
-  MongoDB      — multi-document transactions require a replica set.
-                  Atlas M10+ (dedicated): supported.
-                  Atlas M0/M2/M5 (free/shared): NOT supported — all writes are
-                  single-document atomic only. Confirm tier with user before proceeding.
-                  Self-hosted: supported if replica set mode is enabled.
-  Cassandra    — does NOT support ACID transactions. Lightweight transactions (LWT)
-                  only for single-partition compare-and-set.
-  DynamoDB     — transactional API supported (TransactWrite) but NOT via Ductape's
-                  transaction abstraction; use single operations with condition expressions.
-
-Usage patterns:
-  // Managed (preferred) — auto-commit on success, auto-rollback on error:
-  await ductape.database.transaction(
-    { product, env, database, isolationLevel: 'READ_COMMITTED' },
-    async (tx) => {
-      await ductape.database.insert({ ..., transaction: tx });
-      await ductape.database.update({ ..., transaction: tx });
-    }
-  );
-
-  // Manual — commit/rollback yourself:
-  const tx = await ductape.database.beginTransaction({ product, env, database });
-  try {
-    await ductape.database.insert({ ..., transaction: tx });
-    await tx.commit();
-  } catch (e) {
-    await tx.rollback();
-    throw e;
-  }
-
-Via ductape_execute:
-  ductape_execute("databases.beginTransaction", [{ product, env, database, isolationLevel? }])
-  → returns a transaction reference you can pass to subsequent insert/update/delete calls.
-`.trim(),
-
-  presave: `
-DUCTAPE PRE-SAVE HOOKS
-
-Pre-save operations transform or validate data before it is written to the database.
-Pass a preSave array to insert or update operations. Operations run in priority order.
-
-Available operations (PreSaveOperationType):
-  encrypt         — AES-256 encrypt field (use for PII, secrets)
-  hash            — one-way hash (bcrypt/argon2 for passwords)
-  mask            — mask sensitive data (e.g. **** **** **** 1234)
-  trim            — strip leading/trailing whitespace
-  lowercase       — convert string to lowercase
-  uppercase       — convert string to uppercase
-  sanitize        — strip HTML/script tags
-  validate        — throw if field value fails a rule
-  transform       — apply a custom mapping function
-  uuid            — generate a UUID for the field
-  slug            — generate a URL slug from another field
-  timestamp       — set field to current timestamp (ISO 8601)
-  round           — round number to N decimal places
-  clamp           — clamp number to a min/max range
-  truncate        — truncate string to max length
-  default         — set a default value if null/undefined
-  normalizePhone  — normalise phone number format
-  normalizeEmail  — lowercase + trim email
-  parseJson       — parse JSON string to object
-  stringifyJson   — serialise object to JSON string
-  compute         — derive field value from other fields (runs before validate)
-
-Execution order is fixed regardless of declaration order:
-  default → compute → validate → trim → lowercase/uppercase/normalize* →
-  sanitize → truncate → slug → round/clamp → parseJson/stringifyJson → uuid/timestamp → transform
-
-Example:
-  await ductape.database.insert({
-    product, env, database: 'users', entity: 'users',
-    data: { email: '  User@Example.com  ', password: 'secret', username: 'My App User' },
-    preSave: [
-      { field: 'email',    operation: 'normalizeEmail' },
-      { field: 'password', operation: 'hash' },
-      { field: 'username', operation: 'slug', target: 'slug' },
-    ],
-  });
-`.trim(),
-
-  triggers: `
-DUCTAPE DATABASE TRIGGERS
-
-Triggers fire automatically in response to database write events.
-Defined via the Workbench UI or databases.trigger.create (admin SDK).
-
-Events (TriggerEvent):
-  beforeInsert / afterInsert
-  beforeUpdate / afterUpdate
-  beforeDelete / afterDelete
-  beforeWrite  / afterWrite  (any write)
-
-Timing (TriggerTiming):
-  sync    — block the write until trigger completes (adds latency)
-  async   — fire and forget (default for notifications, cache, broker)
-  queued  — enqueue for background processing
-
-Action types (TriggerActionType):
-  database.*    — insert/update/delete/query another collection
-  storage.*     — upload/delete/copy a file
-  notification.* — email/SMS/push/callback
-  broker.publish — publish to a message broker topic
-  cache.*       — set/invalidate/delete a cache key
-  feature.*     — execute or dispatch a Ductape feature
-  action.execute — call an app action
-  agent.run      — run an AI agent
-  quota.run / fallback.run / healthcheck.run
-  vector.upsert / vector.delete
-  session.revoke
-  log.create
-  custom.function / custom.http
-
-All triggers support an optional condition (field comparisons) to gate execution.
-All triggers support retry config: { maxAttempts, delay, backoff: "fixed"|"exponential" }.
-
-Triggers are admin-only configuration — they cannot be set at runtime via ductape_execute.
-Use ductape_cli with the Workbench or databases.trigger.create via the admin SDK.
-`.trim(),
-
-  aggregations: `
-DUCTAPE DATABASE AGGREGATIONS
-
-databases.aggregate [{ product, env, database, entity, aggregations, where?, groupBy? }]
-
-aggregations array — each entry:
-  { type: "count"|"sum"|"avg"|"min"|"max", field?: string, alias: string }
-
-Example — total revenue grouped by category:
-  ductape_execute("databases.aggregate", [{
-    product: "my-product",
-    env: "prd",
-    database: "sales-db",
-    entity: "orders",
-    aggregations: [
-      { type: "sum",   field: "amount",   alias: "totalRevenue" },
-      { type: "count",                    alias: "orderCount"   },
-      { type: "avg",   field: "amount",   alias: "avgOrderValue" },
-    ],
-    groupBy: ["category"],
-    where: { status: { $eq: "completed" } },
-  }])
-
-Supported where operators: $eq, $ne, $gt, $gte, $lt, $lte, $in, $nin, $like, $ilike
-groupBy: array of field names to group by (omit for global aggregation)
-`.trim(),
-
-  migrations: `
-DUCTAPE DATABASE MIGRATIONS
-
-Migrations are versioned SQL/NoSQL schema change scripts managed per database component.
-
-Create migrations through the project migration files and ductape_cli, never ductape_execute.
-
-Use the access-key administrative CLI for running, rolling back, and inspecting migrations:
-  ductape_cli("db migrate")              // run pending
-  ductape_cli("db migrate rollback")     // roll back last
-  ductape_cli("db migrate rollback -n 3")
-
-MongoDB: migrations run as raw Mongo shell commands in the up/down arrays.
-`.trim(),
-
-  indexes: `
-DUCTAPE DATABASE INDEXES
-
-Create or update indexes through migration files and ductape_cli("db migrate"), not the
-publishable-key runtime proxy. Example definitions may use ["field1", "field2"] with
-{ unique: true, name: "idx_email_unique" }, or ordered fields such as
-[{ field: "createdAt", order: "DESC" }, { field: "userId", order: "ASC" }].
-
-Drop and inspect indexes through migration/CLI tooling or the database administration surface,
-not ductape_execute.
-
-Performance guidance:
-  - Index fields used in WHERE clauses, JOIN conditions, and ORDER BY.
-  - Compound indexes: put high-cardinality fields first.
-  - Unique indexes enforce uniqueness at the database level.
-  - MongoDB: compound indexes support prefix queries; order matters.
-  - PostgreSQL/MySQL: B-tree indexes by default; use partial indexes for sparse columns.
-  - Avoid over-indexing writes-heavy collections — each index slows inserts/updates.
-
-Before adding an index ask the user which fields they query/filter on and expected data volume.
-`.trim(),
-
-  performance: `
-DUCTAPE DATABASE PERFORMANCE GUIDANCE
-
-1. Queries
-   - Always pass select: ["field1", "field2"] to avoid fetching unused columns.
-   - Use limit + offset for pagination; add an index on the ORDER BY field.
-   - Use count/sum/avg/aggregate instead of fetching all rows and computing in code.
-
-2. Indexes (see ductape_docs({ topic: "indexes" }) for syntax)
-   - Index every WHERE / ORDER BY field.
-   - Compound index order: equality fields first, range fields last.
-   - For MongoDB: covered queries (index holds all projected fields) skip the document read.
-
-3. Connections
-   - The SDK pools connections per product+env+database triple.
-   - Call databases.connect once per process; the pool reuses the connection.
-   - databases.disconnect releases the pool — call only on shutdown.
-
-4. Transactions (see ductape_docs({ topic: "transactions" }))
-   - Keep transactions short; long-lived transactions block row locks (PostgreSQL/MySQL).
-   - For MongoDB on M10+, use sessions for multi-document writes — not for reads.
-
-5. Caching
-   - For read-heavy, rarely-changing data use caches.get before databases.query.
-   - Invalidate cache keys in an afterWrite trigger (see ductape_docs({ topic: "triggers" })).
-`.trim(),
-
-  actions: `
-DUCTAPE DATABASE ACTIONS
-
-A database action is a saved query or mutation (SQL string or NoSQL command) stored
-on the Ductape product and executed by tag at runtime.
-
-Create/update actions in Workbench (administrative access), never through ductape_execute.
-
-Dispatch an action at runtime:
-  → CALL ductape_generate_payload FIRST to get the canonical input shape.
-  ductape_execute("databases.action.dispatch", [{
-    product: "my-product",
-    env: "prd",
-    database: "core-db",
-    action: "get-active-users",
-    input: { status: "active" },
-  }])
-
-List actions for a database:
-  ductape_execute("databases.action.list", ["database_tag"])
-
-Fetch:
-  ductape_execute("databases.action.fetch",  ["action_tag"])
-Update/delete are administrative and must be performed in Workbench.
-
-Actions are the preferred way to encapsulate complex or reused queries — they can be
-scheduled, dispatched with retries, and audited via logs.
-`.trim(),
-
-  graphs: `
-DUCTAPE GRAPH DATABASES
-
-Supported engines: neo4j | neptune | cosmos-gremlin | spanner-graph | arangodb | memgraph
-
-Registration (admin — ductape_cli):
-  ductape_cli("resources graphs create -f graph.json")
-  File: { name, tag, type, envs: [{ slug, connection_url, username?, password?, graphName?, region? }] }
-  Sensitive fields (connection_url, username, password) are auto-wrapped as $Secret{...} when
-  a productTag is supplied — do NOT pre-wrap them yourself.
-
-Node operations:
-  graph.createNode    [{ labels: string[], properties: { key: value } }, transaction?]
-  graph.findNodes     [{ labels?, where?, limit?, skip? }, transaction?]
-  graph.findNodeById  [id, transaction?]
-  graph.updateNode    [{ id, properties }, transaction?]
-  graph.deleteNode    [{ id, detach?: boolean }, transaction?]
-  graph.mergeNode     [{ labels, matchProps, setProps? }, transaction?]
-  graph.addLabels / removeLabels / setLabels  [{ id, labels }, transaction?]
-
-Relationship operations:
-  graph.createRelationship  [{ fromId, toId, type, properties? }, transaction?]
-  graph.findRelationships   [{ type?, where?, limit? }, transaction?]
-  graph.updateRelationship  [{ id, properties }, transaction?]
-  graph.deleteRelationship  [{ id }, transaction?]
-  graph.mergeRelationship   [{ fromId, toId, type, matchProps?, setProps? }, transaction?]
-
-Traversal:
-  graph.traverse            [{ startId, direction: "in"|"out"|"both", relationshipTypes?, maxDepth?, where? }]
-  graph.shortestPath        [{ fromId, toId, relationshipType?, maxDepth? }]
-  graph.allPaths            [{ fromId, toId, relationshipType?, maxDepth? }]
-  graph.getNeighborhood     [{ id, depth?, relationshipTypes? }]
-  graph.findConnectedComponents [{ labels? }]
-
-Raw query (provider-native Cypher/Gremlin):
-  graph.query [cypher_query: string, params?: { key: value }, transaction?]
-
-Full-text and vector search (where supported):
-  graph.fullTextSearch  [{ index, query, limit? }]
-  graph.vectorSearch    [{ index, vector: number[], topK? }]
-
-Transactions:
-  graph.beginTransaction     [options?: { isolationLevel?, timeout? }]  → transaction object
-  graph.commitTransaction    [transaction]
-  graph.rollbackTransaction  [transaction]
-  Or use withTransaction (managed — auto-commit/rollback):
-    graph.withTransaction [graphTag, env, callback, options?]
-  Transaction support varies by engine — ask the user which engine they use before enabling.
-  neo4j: full ACID; neptune: limited; arangodb: multi-document; memgraph: full ACID.
-
-Schema management:
-  graph.createNodeIndex      [{ label, field, type: "btree"|"fulltext"|"vector" }]
-  graph.createNodeConstraint [{ label, field, type: "unique"|"exists" }]
-  graph.dropIndex / dropConstraint / listIndexes / listConstraints
-
-Saved actions (parameterized queries stored on the product):
-  graph.createAction [{ graphTag, tag, name, query, params? }, productTag?]
-  graph.listActions  [graphTag?, productTag?]
-  graph.dispatch     [data]  ← call ductape_generate_payload FIRST
-
-Supported index types: btree | fulltext | vector | range | point | text
-Supported constraint types: UNIQUE | EXISTS | NODE_KEY
-`.trim(),
-
-  storage: `
-DUCTAPE FILE STORAGE
-
-Supported providers: aws (S3) | gcp (GCS) | azure (Blob Storage)
-
-Registration (admin — ductape_cli):
-  ductape_cli("resources storage create -f storage.json")
-  File: { name, tag, envs: [{ slug, type: "aws"|"gcp"|"azure", config: { ... } }] }
-  For cloud-linked envs: set config.cloud to the connection tag; omit raw credentials.
-  For all envs in the product must be covered — see ductape_docs({ topic: "cloud" }) for
-  import-persist-all workflow when connecting existing buckets.
-
-Operations (runtime):
-  storage.upload       [{ product, env, storage, fileName, buffer: string|Buffer, mimeType? }]
-  storage.download     [{ product, env, storage, fileName }]   → { content, size, mimeType }
-  storage.remove       [{ product, env, storage, fileName }]
-  storage.listFiles    [{ product, env, storage, prefix?, limit?, continuationToken? }]
-  storage.getSignedUrl [{ product, env, storage, fileName, expiresIn?: number, action?: "read"|"write" }]
-  storage.stats        [{ product, env, storage, prefix?, cache? }]   → file counts by type
-  storage.testConnection [{ product, env, storage }]
-
-Background dispatch (fire-and-forget):
-  storage.dispatch [{ product, env, storage, operation, input, schedule? }]
-  → CALL ductape_generate_payload FIRST (operation_family="storage", method="dispatch")
-  → Returns { jobId, status: "queued" } immediately; actual operation runs in background.
-  → schedule: { start_at?, cron?, every?, limit?, endDate?, tz? }
-
-Caching:
-  download, listFiles, getSignedUrl, and stats all support a cache option.
-  Pass cache: "cache_tag" to check the product cache before hitting the provider.
-  Cached results are stored fire-and-forget on miss.
-
-Notes:
-  - buffer can be a Node.js Buffer (server) or a base64 string (JSON proxy clients).
-  - Cloud-linked configs inject runtime credentials via the cloud connection; no plaintext keys stored.
-  - $Secret{} references in config are resolved at runtime if cloud-link resolution fails.
-`.trim(),
-
-  cloud: `
-DUCTAPE CLOUD CONNECTIONS
-
-Cloud connections link your workspace to an external cloud provider so Ductape can manage
-resources (databases, storage, brokers, graphs, vectors) on your behalf.
-
-Supported providers: aws | gcp | azure | mongodb_atlas | neo4j_aura
-Auth modes: iam_role | oauth | service_principal | workload_identity | api_key
-
-Create a connection (admin — ductape_cli):
-  ductape_cli("cloud connections create --provider aws --name my-aws-conn")
-  Returns: external_id, trust_policy, setup_instructions, setup_url
-  AWS: the caller must create an IAM role using the returned trust policy, then complete:
-    ductape_cli("cloud connections complete <tag> --role-arn arn:aws:iam::...")
-  GCP: complete with project_id, service_account_email, service_account_json
-  Azure: complete with tenant_id, subscription_id, client_id, client_secret, default_location
-  Atlas: complete with atlas_public_key, atlas_private_key
-  Aura (Neo4j): complete with aura_client_id, aura_client_secret, aura_instance_id
-
-Validate a connection:
-  ductape_cli("cloud connections validate <tag>")
-  → { valid, status, message?, tested_at? }
-
-List / fetch / delete:
-  ductape_cli("cloud connections list")
-  ductape_cli("cloud connections fetch <tag>")
-
-Discover resources on a connection:
-  ductape_cli("cloud resources list -f query.json --json")
-  File: { cloud: "<tag>", service: "gcs"|"s3"|"blob"|"rds"|"atlas-cluster"|..., region? }
-  → returns list of available resources (buckets, clusters, instances, etc.)
-
-Import an existing resource and register it on the product:
-  Use import-persist-all for multi-env products (required):
-    ductape_cli("cloud resources import-persist-all -f all-envs.json --json")
-  File is a JSON ARRAY — one entry per env, same product + component tag across all entries.
-  Each entry: { cloud, service, type, product, component, env, resource, region?, dbName? }
-  Supported service identifiers: s3, gcs, blob, rds, postgresql, cloudsql, sqs, pubsub,
-    servicebus, neptune, cosmos-gremlin, opensearch, azure-search, atlas-cluster, aura-instance
-
-Provision a brand-new resource and register it:
-  ductape_cli("cloud resources provision-persist-all -f all-envs.json --json")
-  Additional per-entry fields: tier, region/location, waitForReady.
-  List available tiers first: ductape_cli("cloud tiers --provider aws --type database --db-type postgresql --json")
-  NEVER infer region, tier, or cost — always list and confirm with the user first.
-  Atlas and Neo4j Aura are IMPORT-ONLY — provision is not supported for these providers.
-
-VPC connector (private networking):
-  ductape_cli("cloud connections vpc update <tag> --vpc-id vpc-xxx --subnet-ids subnet-1,subnet-2")
-  ductape_cli("cloud connections vpc status <tag>")
-  VPC connector enables Ductape to reach resources in a private VPC; agent_status:
-    pending → connected → disconnected
-
-Scopes a connection can cover: storage | broker | database | graph | vector | cache
-
-Component types accepted by import/provision:
-  storage | messageBrokers | databases | graphs | vectors | caches
-`.trim(),
-
-  vector: `
-DUCTAPE VECTOR DATABASES
-
-Supported adapters: pinecone | qdrant | weaviate | opensearch | azure-search | vertex-vector-search
-  (chroma, milvus, pgvector are declared but not yet implemented — do not use them)
-
-Registration (admin — ductape_cli):
-  ductape_cli("resources vectors create -f vector.json")
-  File: { name, tag, type, dimensions: number, metric?: "cosine"|"euclidean"|"dotproduct",
-          envs: [{ slug, endpoint?, apiKey?, region?, index?, namespace? }] }
-
-Runtime operations:
-  vector.upsert      [{ product, env, tag, vectors: [{id, values: number[], metadata?}], namespace? }]
-  vector.upsertOne   [{ product, env, tag, id, values: number[], metadata?, namespace? }]
-  vector.query       [{ product, env, tag, vector: number[], topK?, filter?, namespace?,
-                        includeValues?, includeMetadata? }]
-  vector.findSimilar [{ product, env, vector, values: number[], topK?, filter?, namespace? }]
-  vector.fetchOne    [{ product, env, vector, id, namespace? }]
-  vector.fetchVectors [{ product, env, vector, ids: string[], namespace? }]
-  vector.updateVector [{ product, env, vector, id, values?, setMetadata?, mergeMetadata?, namespace? }]
-  vector.updateMetadata [{ product, env, vector, id, metadata: { key: value }, merge?, namespace? }]
-    merge: true → deep-merges metadata rather than replacing it
-  vector.deleteByIds  [{ product, env, vector, ids: string[], namespace? }]
-  vector.deleteAll    [{ product, env, vector, namespace? }]
-  vector.count        [{ product, env, vector, namespace? }]
-
-Namespace management:
-  vector.listNamespaces  [{ product, env, vector }]
-  vector.deleteNamespace [{ product, env, vector, namespace }]
-
-Listing (paginated):
-  vector.listVectors    [{ product, env, vector, namespace?, prefix?, limit?, cursor? }]
-  vector.listAllVectors [{ product, env, vector, namespace?, prefix? }]
-    listAllVectors auto-paginates until cursor exhausted — avoid on large indexes.
-
-Index management:
-  vector.describeIndex  [{ product, env, vector }]
-  vector.getStats       [{ product, env, vector }]  → totalVectorCount per namespace
-  vector.createIndex    [{ product, env, vector, name, dimensions, metric?, replicas?, shards? }]
-  vector.deleteIndex    [{ product, env, vector, name }]
-  vector.listIndexes    [{ product, env, vector }]
-
-Distance metrics: cosine | euclidean | dotproduct | manhattan | hamming
-Index types: flat | ivf | hnsw | pq | ivf_pq | annoy
-Feature flags per adapter: metadata_filtering | namespaces | hybrid_search | batch_operations |
-  index_management | vector_updates | sparse_vectors | multi_vector | aggregations
-
-Call vector.supportsFeature(feature) or vector.getSupportedFeatures() to check what the
-chosen adapter supports before using a feature.
-`.trim(),
-
-  warehouse: `
-DUCTAPE WAREHOUSE
-
-The Warehouse is a unified query layer over the three structured data stores: Database, Graph, and Vector.
-It provides a single API for cross-store operations without having to address each service separately.
-
-Warehouse is available on the SDK instance as ductape.warehouse (TypeScript) or Warehouse (C#/Go/Java).
-It is NOT a separate Ductape resource — it wraps the existing database, graph, and vector components
-that are already registered on the product.
-
-Key use cases:
-  - Run a relational query, a graph traversal, and a vector similarity search in a single call.
-  - Build recommendation pipelines: graph neighbors → vector re-rank → database hydration.
-  - Federated search across multiple store types with a single await.
-
-Usage (TypeScript SDK):
-  const result = await ductape.warehouse.query({
-    product: "my-product",
-    env: "prd",
-    database: { tag: "core-db", entity: "products", where: { active: { $eq: true } }, select: ["id", "name"] },
-    graph:    { tag: "reco-graph", startId: userId, direction: "out", maxDepth: 2 },
-    vector:   { tag: "embedding-store", vector: queryEmbedding, topK: 10 },
-  });
-
-  result.database  → relational rows
-  result.graph     → traversal nodes/relationships
-  result.vector    → similarity hits with scores
-
-Warehouse context is set at SDK init time (env + workspaceId) and shared across all three stores.
-Underlying store calls use the same auth and product context; individual store errors are surfaced per store.
-
-Before using Warehouse:
-  1. Ensure the database, graph, and vector components are registered on the product.
-  2. Confirm the env slug exists on all three stores.
-  3. Each store can be queried independently — pass only the fields for the stores you need.
-
-Warehouse does not support writes — use the individual service APIs (database.insert, graph.createNode,
-vector.upsert) for mutations.
-`.trim(),
-
-  secrets: `
-DUCTAPE SECRETS
-
-Secrets are workspace-level encrypted key-value pairs. They are referenced in resource configs,
-connection URLs, and any string field using the $Secret{KEY_NAME} syntax.
-
-Create/update secrets with ductape_cli or Workbench (administrative access), never ductape_execute.
-Definition fields include key, value, description, token_type, scope, envs, and expires_at.
-  The server never receives the plaintext value. Encryption uses the workspace private key.
-
-Fetch / resolve:
-  ductape_execute("secrets.fetch", ["STRIPE_API_KEY"])      → decrypted string value
-  ductape_execute("secrets.exists", ["STRIPE_API_KEY"])      → boolean
-  ductape_execute("secrets.validate", ["$Secret{STRIPE_API_KEY}"])  → { valid, missingKeys, existingKeys }
-  ductape_execute("secrets.resolve", ["$Secret{STRIPE_API_KEY}", { env: "prd" }])  → resolved string
-
-$Secret{} reference syntax:
-  - Embed anywhere a string is accepted: "postgresql://$Secret{DB_USER}:$Secret{DB_PASS}@host/db"
-  - Resolved at runtime before the value is used by the consuming service (storage, broker, graph, etc.)
-  - The in-memory cache stores the encrypted form only; decryption happens on each cache hit.
-  - Cache TTL: 5 minutes. Clear with: secrets.clearCache()
-
-Lifecycle mutations (revoke/delete/update) are administrative: use ductape_cli or Workbench.
-
-List all secrets (keys only — values are not returned in list):
-  ductape_execute("secrets.list", [])
-
-Important:
-  - Secrets are workspace-scoped, not product-scoped. scope[] and envs[] control access.
-  - Other services (storage, broker, graph, etc.) resolve $Secret{} references automatically
-    using the singleton secrets service — no manual resolution needed in most cases.
-  - Never log or return resolved secret values to end users.
-`.trim(),
-
-  apps: `
-DUCTAPE APPS
-
-WHAT AN APP IS:
-A Ductape App is a pre-configured, versioned API integration definition. It is NOT a generic HTTP
-client, NOT a job scheduler, and NOT anything you can call without registering first.
-
-An App must be fully set up in Ductape before any code can use it:
-  1. The App record must be created (name, tag, description)
-  2. Environments must be added (each environment slug → base URL for that stage)
-  3. Auth scheme must be configured (how outbound requests authenticate: apikey, bearer, OAuth2, etc.)
-  4. Action endpoints must be defined (each action = one HTTP endpoint spec: method, path, body/query/header shape, response shape)
-  5. The App must be connected to the product (product.apps.add) and its envs mapped
-
-ONLY after all five steps can any code call:
-  ctx.api.run({ app: '<app_tag>', event: '<action_tag>', input: { ... } })   ← in a feature handler
-  actions.run([{ product, env, app: '<app_tag>', action: '<action_tag>', input }])   ← at runtime
-
-ctx.api (alias for ctx.action) is NOT a generic HTTP call. It ONLY invokes a pre-registered
-Ductape App Action. If the App or action tag does not exist in the product, the call will fail.
-actions.dispatch is the same as actions.run but scheduled as a background job — it still requires
-a registered App. There is no way to dispatch a job to an arbitrary URL via ctx.api or actions.dispatch.
-
-If a feature step needs to call an external service and no App is registered for it yet:
-  → Flag it as "App to create" in your plan (STEP 4 of the feature design workflow)
-  → Create the App and all its actions first (see below)
-  → Only then write the ctx.api.run call
-
-An app is a versioned API integration definition. It contains environments (base URLs), actions
-(individual endpoint specs), auth schemes, webhooks, variables, and constants.
-
-Create an app (admin — ductape_cli):
-  ductape_cli("apps create --name \\"Email Service\\" --description \\"Transactional email\\"")
-  ductape_cli("app.init", ["app_tag"])       → loads app into builder state
-
-Import from a file:
-  ductape_cli("apps import <file.json> -t postman|openapi")
-  Supports Postman v2.1 collection and OpenAPI 3.0 spec.
-
-Manage environments (base URLs per stage) in Workbench; this currently has no CLI command.
-
-Discover apps in a product and their actions (ALWAYS do this before writing any ctx.api.run call):
-  Step 1 — list apps connected to the product:
-    ductape_cli("products get --tag <product_tag> --json")    → full product document; check apps[]
-    ductape_cli("products apps list --product <product_id> --json")  → apps[] with access_tag, envs
-  Step 2 — list actions in an app:
-    ductape_execute("actions.list", [app_tag])                → returns all action tags + names
-  Step 3 — fetch the input schema for an action:
-    ductape_execute("actions.fetch", [app_tag, action_tag])
-      → returns { body: {fieldName: {type, required}}, params: {}, query: {}, headers: {} }
-    OR: call ductape_generate_payload (operation_family="action", method="run",
-          targets={app: "app_tag", action: "action_tag"}) to get the exact resolved payload shape
-  Step 4 — call ductape_schema({ module: "app" }) if you need the JSON schema for creating/updating
-           app resources (not for runtime input — use actions.fetch or ductape_generate_payload for that)
-  NEVER assume action input field names. Always fetch the action definition first.
-
-Manage actions (individual API endpoints) in Workbench or import an OpenAPI/Postman file.
-Creation/update are administrative and must never use ductape_execute.
-  ductape_execute("actions.list",   [app_tag])
-  ductape_execute("actions.fetch",  [app_tag, action_tag])
-
-Action input — flat input format:
-  Fields are resolved to the correct location (body/params/query/headers) by matching the action schema.
-  For ambiguous keys, use explicit prefixes:
-    input: { amount: 1000 }                       → auto-resolved (body.amount if body field exists)
-    input: { "body:amount": 1000 }                → explicit body
-    input: { "params:id": "user_123" }            → route parameter
-    input: { "query:limit": 10 }                  → query string
-    input: { "headers:X-Idempotency-Key": "..." } → request header
-  Always use ductape_generate_payload or actions.fetch to know the exact field names — never guess.
-
-Run an action at runtime:
-  → CALL ductape_generate_payload FIRST (operation_family="action", method="run", targets={app, action})
-  ductape_execute("actions.run", [{ product, env, app, action, input: { "body:field": value } }])
-  ductape_execute("actions.dispatch", [{ product, env, app, action, input, schedule? }])
-
-Auth schemes (how the app authenticates outbound requests):
-  Setup types: header | bearer | basic | oauth2 | apikey
-  Configure auth in Workbench (administrative).
-  ductape_execute("auths.list",   [app_tag])
-
-Webhooks (inbound events from the external service):
-  Configure webhooks and webhook events in Workbench (administrative).
-
-Variables (per-env mutable values) and Constants (fixed values):
-  Configure variables and constants in Workbench (administrative).
-
-Connecting an app to a product (after creation):
-  NOTE: All product.* module methods require the access key and CANNOT use ductape_execute.
-  Use ductape_cli for all product-level operations.
-
-  FULL FLOW to make an app callable from a product:
-  1. Create the app:     ductape_cli("apps create --name \\"Service Name\\" --description \\"...\\"")
-  2. Add environments:   Workbench
-  3. Configure auth:     Workbench
-  4. Define actions:     Workbench
-                         OR import: ductape_cli("apps import <file.json> -t postman|openapi")
-  5. Connect to product: Requires the product_id (from ductape_cli("products get --tag <tag> --json")).
-                         There is no CLI command for this step — the SDK product.apps.add method requires
-                         an access key which only the backend can provide. Connect via Workbench.
-  6. Verify:             ductape_cli("products get --tag <product_tag> --json") → check apps[] contains the app
-                         ductape_execute("actions.list", [app_tag]) → verify actions are registered
-`.trim(),
-
-  products: `
-DUCTAPE PRODUCTS
-
-A product is the top-level namespace for all Ductape infrastructure: apps, databases, graphs,
-vectors, storage, brokers, sessions, caches, notifications, resilience, features, jobs, and envs.
-Every SDK service call resolves within a product context.
-
-IMPORTANT: The product module requires the access key. ALL product operations must use ductape_cli,
-not ductape_execute (which only accepts the publishable key and will return 403 for product.*).
-
-Create a product:
-  ductape_cli("products create --name \\"My App\\" --tag my-app")
-
-Environments — every resource's envs array MUST cover all product env slugs:
-  ductape_cli("products environments list <product_tag> --json")
-  ductape_cli("products environments get <product_tag> <slug> --json")
-  BEFORE registering any resource, always run environments list and collect all slugs.
-
-Fetch / update:
-  ductape_cli("products get --tag <product_tag> --json")
-  ductape_cli("products get --id <product_id> --json")
-
-Connect apps to a product:
-  See ductape_docs({ topic: "apps" }) for product.apps.add / product.apps.list.
-
-Resource registration (all via ductape_cli or ductape_execute — see per-topic docs):
-  databases → ductape_docs({ topic: "transactions" })
-  storage   → ductape_docs({ topic: "storage" })
-  graphs    → ductape_docs({ topic: "graphs" })
-  vectors   → ductape_docs({ topic: "vector" })
-  events    → ductape_docs({ topic: "events" })
-  caches    → ductape_docs({ topic: "caches" })
-  notifications → ductape_docs({ topic: "notifications" })
-  sessions  → ductape_docs({ topic: "sessions" })
-  frontend analytics → ductape_docs({ topic: "frontend-analytics" })
-  resilience → ductape_docs({ topic: "resilience" })
-  features  → ductape_docs({ topic: "features" })
-
-Product structure (IProduct fields):
-  _id, workspace_id, name, tag, description, private_key,
-  apps[], envs[], databases[], graphs[], vectors[], storage[], messageBrokers[],
-  caches[], sessions[], notifications[], quota[], fallback[], healthchecks[],
-  workflows[] (features), models[], agents[], jobs[]
-
-Bootstrap (single API call returning product context + component config + private key):
-  Each service makes a single bootstrap call at first use; results are cached in BootstrapCache
-  (Redis when available). This avoids repeated round-trips in high-frequency paths.
-`.trim(),
-
-  sessions: `
-DUCTAPE SESSIONS
-
-A session is a named JWT schema on a product. It defines:
-  - tag / name        — unique identifier and display name
-  - expiry + period   — how long each issued JWT is valid (duration, not an absolute date)
-  - selector          — MUST be in the format "$Session{fieldName}" where fieldName is the key
-                        in the schema that is the PRIMARY user identifier (e.g. "$Session{playerId}").
-                        Plain dot-paths like "playerId" are REJECTED by the validator.
-                        This field becomes the lookup key for revoke, list, and analytics.
-  - schema            — SAMPLE DATA showing example values for each field embedded in the JWT.
-                        This is NOT a type declaration. Use actual example values.
-                        The value at the selector path must be a primitive (string/number/boolean),
-                        not an object or array.
-
-IMPORTANT — schema is sample data, not type declarations:
-  CORRECT:   schema: { playerId: "player_abc123", username: "Alice", role: "player" }
-  INCORRECT: schema: { playerId: { type: "string", required: true } }   ← WILL FAIL
-
-IMPORTANT — selector must be "$Session{fieldName}" format:
-  CORRECT:   selector: "$Session{playerId}"
-  INCORRECT: selector: "playerId"   ← WILL FAIL with "Selector should be in the format $Session{...}{key}"
-
-Example definition (configure via declarative apply or Workbench, not ductape_execute):
-  {
-    tag: "player-session",
-    name: "Player Session",
-    expiry: 24,
-    period: "hours",
-    selector: "$Session{playerId}",     // $Session{} wrapper required
-    schema: {
-      playerId:  "player_abc123",       // sample value — primitive required at selector path
-      username:  "ShadowBlade",
-      role:      "player",
-      accountId: "acct_xyz",
-    },
-  }
-
-Runtime — create a session (sign a JWT):
-  → CALL ductape_generate_payload FIRST (operation_family="session", method="start", targets={tag})
-    to discover the exact data field names accepted for this session tag.
-  ductape_execute("sessions.start", [{ product, env, tag: "player-session",
-    data: {
-      playerId:  "player_abc123",   // must match selector path — used as the revocation/lookup key
-      username:  "ShadowBlade",
-      role:      "player",
-      accountId: "acct_xyz",
-    } }])
-  → returns token: "player-session:eyJ..."   ← format is always "session_tag:jwt"
-  The token embeds all schema fields in the JWT payload, signed with the product private key.
-
-Verify a token:
-  ductape_execute("sessions.verify", [{ product, env, tag: "user-session", token: "user-session:eyJ..." }])
-  → decodes JWT + checks revocation blacklist; throws if revoked or expired
-
-Refresh (atomic token rotation):
-  ductape_execute("sessions.refresh", [{ product, env, tag: "user-session", refreshToken: "..." }])
-  Old refresh token is invalidated server-side atomically — no partial state possible.
-  The refresh token is AES-encrypted JSON (NOT a JWT).
-
-Revoke:
-  ductape_execute("sessions.revoke", [{ product, env, tag, sessionId?, identifier? }])
-  Requires at least one of sessionId or identifier.
-  Revocation is enforced via a ProcessorAPI blacklist check on every verify() call.
-
-Analytics:
-  sessions.listActive        [{ product, env, tag, identifier?, page?, limit? }]
-  sessions.fetchUsers        [{ product, session, env?, page?, limit? }]
-  sessions.fetchUserDetails  [{ product, session, identifier, env? }]
-  sessions.fetchDashboard    [{ product, session, env? }]
-    → { DAU, WAU, MAU, activityTimeline, peakHours, environmentBreakdown, avgSessionDuration }
-
-Token format: "session_tag:jwt_token" — pass this format verbatim wherever session is expected.
-JWT is signed with the product private key (not a symmetric shared secret).
-
-SESSION PROPAGATION
-  Extract the original full "session_tag:jwt" token once at the HTTP/transport boundary and retain
-  it separately from verified/decoded claims. Claims are authorization data; they are not a token.
-  Store a request ActorContext in a NestJS request-scoped provider or AsyncLocalStorage:
-    type ActorContext =
-      | { kind: "user"; session: string; actorId: string }
-      | { kind: "delegated"; delegatedIdentity: string; actorId: string; initiatedAt: string }
-      | { kind: "system"; reason: string };
-  Pass ActorContext explicitly through service boundaries. At each immediate Ductape runtime call,
-  pass actor.kind === "user" ? actor.session : the SDK-approved delegated identity. Put only
-  non-secret actor metadata (actorId, kind, initiatedAt, correlationId) in Event envelopes.
-  Feature execution should receive the same explicit actor classification. Never log, serialize
-  into business payloads, or attach the raw session/refresh token to traces or error messages.
-
-  SECURITY BOUNDARY FOR DURABLE WORK
-  The current SDK accepts a session string on dispatch, but it does not expose an immutable
-  attribution snapshot API, an expired-token attribution contract, or a general delegated-session
-  issuer. Therefore do NOT persist reusable JWTs indefinitely or assume an expired initiating token
-  will remain valid when delayed work executes. Pass the full token only for immediate work within
-  its validity window. For delayed/recurring work, classify execution as system-context, or use an
-  application-owned immutable actor-context envelope plus a short-lived delegated identity issued
-  by an explicitly approved auth design. Until the SDK provides that design, actor metadata is for
-  audit/correlation and must not be treated as authorization.
-
-  Distinguish contexts deliberately:
-    user      — active request; original valid full token is required when the operation accepts it
-    delegated — delayed/on-behalf-of work; approved short-lived credential + immutable actor metadata
-    system    — scheduler/maintenance with no user authority; omit session and record a reason
-
-  Backend propagation attributes component activity to an actor, but it does not record frontend
-  pageviews, navigation, UI intent, funnels, or client failures. Continue immediately with
-  ductape_docs({ topic: "frontend-analytics" }); both layers are required for a complete picture.
-`.trim(),
-
-  caches: `
-DUCTAPE CACHES
-
-Caches are product-level Redis (or in-memory) stores for temporary key-value data with optional TTL.
-
-Registration (admin — ductape_cli):
-  ductape_cli("resources caches create -f cache.json")
-  File: { name, tag, description?, expiry: <milliseconds> }
-  No type or envs — Ductape manages the store infrastructure.
-  expiry is in MILLISECONDS: 3600000 = 1 hour, 86400000 = 1 day, 604800000 = 1 week.
-
-Operations:
-  caches.set   [{ product, cache, key, value: string, expiry?: string (ISO 8601), env }]
-    expiry is an ABSOLUTE TIMESTAMP (not a duration).
-    To expire in 1 hour: expiry = new Date(Date.now() + 3600_000).toISOString()
-    To expire in 24 hours: expiry = new Date(Date.now() + 86400_000).toISOString()
-    To never expire: omit expiry entirely.
-    Via MCP: pass an ISO 8601 string e.g. "2026-07-17T12:00:00.000Z"
-    → Writes to Redis synchronously, then fires remote API write in background (non-blocking).
-  caches.get   [{ key: string }]
-    → Checks Redis first; on miss falls through to remote API; on hit from API, populates Redis.
-    → Enforces TTL by comparing the stored expiry timestamp against current time (client-side check).
-  caches.clear [{ key: string }]
-    → Deletes from Redis and from remote API.
-  caches.clearAll [{ product, cache, env? }]
-    → Bulk delete via remote API only. Redis may still have stale keys until naturally evicted.
-  caches.fetchValues [{ product, cache, env?, page?, limit?,
-                        expiryFilter?: "all"|"expiring"|"permanent"|"expired" }]
-  caches.fetchDashboard [{ product, cache, env? }]
-    → { totalValues, activeValues, expiredValues, totalSize }
-
-Tier architecture (three tiers applied automatically):
-  Tier 1: in-process Map (SDK metadata cache, 5-min TTL — not for user data)
-  Tier 2: Redis hash (hSet/hGetAll) with optional EXPIRE
-  Tier 3: Remote Ductape API
-
-Practical examples:
-  // Cache a player leaderboard for 5 minutes:
-  { product, cache: "leaderboard-cache", key: "top-100", value: JSON.stringify(rows),
-    expiry: new Date(Date.now() + 300_000).toISOString(), env: "prd" }
-
-  // Cache a session token lookup for 1 hour:
-  { product, cache: "session-cache", key: "player:u_123", value: token,
-    expiry: new Date(Date.now() + 3_600_000).toISOString(), env: "prd" }
-
-Important:
-  - Redis is optional; without it all reads/writes go through the remote API.
-  - expiry is stored as a Date field, not a Redis TTL — the expiry check happens client-side on read.
-  - clearAll only clears via the remote API bulk endpoint; Redis may retain stale entries until evicted.
-  - Cache entries are stored as Redis hashes (not plain strings).
-  - Other services (storage, graph, notifications, sessions) also use CacheManager internally —
-    configure a shared Redis URL at SDK init to share the pool.
-`.trim(),
-
-  notifications: `
-DUCTAPE NOTIFICATIONS
-
-Notifications send messages across multiple channels: email, SMS, push, or HTTP callback.
-
-ADMINISTRATION — CLI (never ductape_execute)
-  ductape_cli("resources notifications create -f notification.json")
-  ductape_cli("resources notifications get --tag <notification-tag> --json")
-  ductape_cli("resources notifications list --json")
-  ductape_cli("resources notifications update --tag <notification-tag> -f patch.json")
-  ductape_cli("resources notifications delete --tag <notification-tag>")
-  ductape_cli("notifications messages create -f message.json")
-  ductape_cli("notifications messages list --notification <notification-tag> --json")
-  ductape_cli("notifications messages get --tag <notification:message> --json")
-  ductape_cli("notifications messages update --tag <notification:message> -f patch.json")
-  Declarative alternative: ductape/notifications.json then ductape_cli("apply notifications").
-  The file MUST be a top-level JSON array. Each item is a notification definition and may contain
-  a nested "messages" array. {"notifications":[],"messages":[]} is not a valid envelope.
-
-Notification definition:
-  {
-    tag: "welcome-email", // component tags cannot contain ":"
-    name: "Welcome Email",
-    description: "Transactional welcome messages",
-    envs: [{
-      slug: "prd",
-      emails: {
-        provider: "smtp",
-        smtp: {
-          host: "smtp.example.com",
-          port: "$Secret{smtp-port}",
-          sender_email: "hello@example.com",
-          auth: { user: "$Secret{smtp-user}", pass: "$Secret{smtp-password}" },
-          secure: true
-        }
-      }
-    }],
-    messages: []
-  }
-
-Create a message template through declarative apply or Workbench:
-  {
-    tag: "welcome-email:default", // message tags use component-tag:message-tag
-    name: "Default welcome",
-    description: "Sent after account creation",
-    push_notification: {
-      title: "Welcome, {{name}}!",
-      body: "Thanks for signing up.",
-      data: {}
-    },
-    email: {
-      subject: "Welcome, {{name}}!",
-      template: "Hi {{name}}, thanks for signing up."
-    }
-  }
-
-TAG AND SMTP RULES
-  Component tag: "game-alerts-critical" (no colon).
-  Message tag: "game-alerts-critical:match-launch" (one colon separator).
-  Do not add "notification", "subject", or "body" at message root.
-  SMTP requires emails.smtp.sender_email.
-  emails.smtp.secure is a boolean and cannot be a $Secret{...} string.
-  Credential strings such as auth.user and auth.pass may use $Secret{...}.
-
-Send at runtime (one channel at a time):
-  → CALL ductape_generate_payload FIRST (operation_family="notification", method="email.send")
-  notifications.email.send    [{ product, env, notification, input: { recipients, subject?, template? } }]
-  notifications.push.send     [{ product, env, notification, input: { device_tokens, title?, body?, data? } }]
-  notifications.sms.send      [{ product, env, notification, input: { recipients, body? } }]
-  notifications.callback.send [{ product, env, notification, input: { query?, headers?, params?, body? } }]
-  notifications.slack.send   [{ product, env, notification, input: { text?, blocks?, channel? } }]
-  notifications.discord.send [{ product, env, notification, input: { content?, embeds? } }]
-
-Multi-channel send (all channels in parallel):
-  notifications.send [{ product, env, event: "notif_tag:message_tag", input: { ... } }]
-  → success is true if at least one channel succeeds; channel failures do not abort siblings.
-
-Background dispatch with scheduling:
-  notifications.dispatch [{ product, env, notification, event, input,
-    schedule?: { start_at?, cron?, every?, limit?, endDate?, tz? } }]
-  → Returns { job_id, status: "queued", scheduled_at, recurring, next_run_at }
-
-Query delivery logs:
-  notifications.getMessages [{ product_tag?, env?, notification_tag?, status?,
-    type?, start_date?, end_date?, page?, limit? }]
-  Status values: pending | sent | failed | reprocessing
-
-Supported providers:
-  Email:  smtp | mailgun | sendgrid | postmark | brevo
-  SMS:    twilio | nexmo | plivo | other
-  Push:   firebase | expo
-  Callback: any HTTP endpoint
-
-Each notification env may configure push_notifications, emails, sms, callbacks, slack, and discord.
-Email providers: smtp, sendgrid, mailgun, postmark, brevo.
-SMS providers: twilio, nexmo/vonage, plivo.
-
-FIREBASE THROUGH A GCP CLOUD CONNECTION
-  Complete and validate a GCP cloud connection with a service account authorized for Firebase
-  Cloud Messaging. Then configure the notification env without copying service-account JSON:
-    {
-      "slug": "snd",
-      "push_notifications": {
-        "type": "firebase",
-        "cloud": "gcp-connection-tag",
-        "authMode": "cloud_connection",
-        "databaseUrl": "https://<project>.firebaseio.com"
-      }
-    }
-  The SDK requests current GCP credentials from the cloud connection at send time. Never put the
-  service-account private key in the notification file. Expo does not use a GCP cloud connection.
-  The recommended cloud connection scope is "notifications". It expresses Ductape capability/UI
-  intent; creating a notification does not prove Google-side FCM permission. Runtime delivery
-  requires fcm.googleapis.com and roles/firebasecloudmessaging.admin, so validate the connection
-  and perform a delivery test.
-Notification tag and message tag are ALWAYS passed together as "notification_tag:message_tag".
-`.trim(),
-
-  resilience: `
-DUCTAPE RESILIENCE
-
-Resilience covers three mechanisms: quotas (rate-limited provider pools), fallbacks (automatic
-provider switching), and healthchecks (continuous probe monitoring with failure actions).
-
-CONFIGURATION BOUNDARY
-  Quotas, fallbacks, and health checks are administrative product configuration. Configure them in
-  Workbench (or a future access-key administrative tool explicitly documented for the asset).
-  Never route administrative create/update methods through ductape_execute: its publishable-key
-  runtime proxy will fail.
-
-QUOTAS — rate-limited multi-provider pools:
-  Workbench definition shape:
-  {
-    tag: "sms-quota",
-    name: "SMS Provider Pool",
-    input: { to: { type: "string", required: true }, message: { type: "string" } },
-    options: [
-      { provider: "twilio", app: "twilio-app", type: "action", event: "send-sms",
-        quota: 1000, uses: 0, retries: 2,
-        input: { "body:to": "$Input{to}", "body:message": "$Input{message}" },
-        output: {} },
-      { provider: "nexmo", app: "nexmo-app", type: "action", event: "send-sms",
-        quota: 500, uses: 0, retries: 1,
-        input: { "body:to": "$Input{to}", "body:body": "$Input{message}" },
-        output: {} },
-    ],
-  }
-  Providers are tried in order until quota is not exhausted.
-  quotas.run      [{ product, env, tag, input }]  ← CALL ductape_generate_payload FIRST
-  quotas.dispatch [{ product, env, tag, input, schedule? }]
-
-FALLBACKS — automatic provider switching on failure:
-  Same schema as quotas but options are ordered: primary first, then fallback(s).
-  Primary is used first; on failure, the next provider is tried automatically.
-  Configure in Workbench: { tag, name, input: { ... }, options: [...] }
-  fallback.run      [{ product, env, tag, input }]  ← CALL ductape_generate_payload FIRST
-  fallback.dispatch [{ product, env, tag, input, schedule? }]
-
-HEALTHCHECKS — continuous probe with failure notifications:
-  Workbench definition shape:
-  {
-    tag: "payment-health",
-    name: "Payment Service Health",
-    probe: { type: "app", app: "stripe-app", event: "ping" },
-    interval: 30000,    // ms between checks
-    retries: 3,
-    envs: [{ slug: "prd", input: {} }],
-    onFailure: {
-      notifications: [{ notification: "ops-alerts", message: "payment-down",
-        channels: { email: { recipients: ["ops@example.com"] } } }],
-      webhooks: [{ url: "https://hooks.example.com/alert", method: "POST" }],
-    },
-  }
-  health.run    [{ product, env, tag }]   → triggers an immediate probe
-  health.check  [{ product, env, tag }]   → same as run
-  health.status [{ product, env, tag }]   → current health status
-
-Probe types: app | database | feature | graph | message_broker | storage
-Failure actions: notification channels, HTTP webhooks, and/or message broker emit — all can
-  be configured simultaneously on the same healthcheck.
-Input template references: $Input{field} → maps declared input to the probe's action input.
-Provider status: available | unavailable
-
-DECISION MATRIX
-  Rate/capacity allocation across providers       → quota
-  Equivalent provider after operational failure   → fallback
-  Detect failure before routing provider traffic  → health check
-  Transient failure of one operation              → bounded retry + idempotency policy
-  Multi-step business recovery/compensation       → Feature
-  Database atomicity                              → database transaction, not Feature rollback
-  Scheduled single operation                      → that component's dispatch
-  Scheduled multi-step process                    → Feature dispatch
-
-COMBINING MECHANISMS
-  A health check may keep an unhealthy provider out of a fallback/quota pool; the pool controls
-  provider selection; each operation may use bounded retries and an idempotency key; a Feature
-  coordinates business steps and compensation around those resilient operations. Do not stack them
-  reflexively: each layer needs a distinct failure it owns, bounded retry budgets, and observable
-  terminal behavior. Database transactions remain the atomicity boundary for related DB writes.
-`.trim(),
-
-  'frontend-analytics': `
-DUCTAPE FRONTEND PRODUCT ANALYTICS AND SESSION ACTIVITY
-
-Frontend analytics and backend session attribution are complementary; neither replaces the other.
-
-BACKEND OPERATION ATTRIBUTION
-  Immediate user-initiated backend work should pass the original full Ductape session token to every
-  database, Event, Feature, notification, storage, graph, vector, action, and other runtime operation
-  that accepts session. This attributes immediate server work to the authenticated actor.
-  For delayed/durable work, do not persist raw JWTs indefinitely. Use system context, or an approved
-  delegated actor design with immutable non-secret actor metadata. Actor metadata supports audit and
-  correlation; it is not authorization. Intentional system/background work should remain sessionless.
-
-FRONTEND PRODUCT ANALYTICS
-  Use the browser Analytics service for anonymous visits, authenticated page views, navigation,
-  UI interactions, funnels, client errors, realtime state, and product-surface engagement.
-
-  IMPORTANT:
-  Passing session to backend component calls does not replace frontend analytics.
-  Calling analytics.identify(sessionToken) and tracking frontend events does not replace backend
-  session propagation. A complete activity picture requires both.
-
-VERSION AND DOCUMENTATION PRECEDENCE
-  1. Installed package types and exports determine what can be called now.
-  2. Version-matched package documentation explains intended usage.
-  3. Current docs/docs/Frontend describes the latest supported design.
-  4. If they disagree, report the mismatch; never fabricate compatibility.
-
-  Inspect package.json plus package exports/type declarations before recommending framework hooks.
-  The current repository exports useAnalytics from @ductape/react and @ductape/vue. Their installed
-  hook/composable exposes track, pageview, identify, visitorId, enableAutoCapture, and flush.
-  clearSession and disableAutoCapture are available on client.analytics but are not currently
-  returned by those framework wrappers. Use useDuctape().client.analytics for those calls, or
-  recommend a package version that exports them; do not generate a hook method that does not exist.
-
-CLIENT API — IDENTIFY AFTER AUTHENTICATION
-  ductape.analytics.identify(sessionToken);
-
-  sessionToken is the complete value returned by Ductape, in "player-session:jwt" format.
-  It is NOT a player ID, session tag, session ID, decoded claims, or refresh token.
-  identify links subsequent frontend analytics to the authenticated Ductape session and lets
-  supported analytics correlate anonymous pre-login activity with authenticated activity.
-
-LOGOUT / ACCOUNT SWITCHING
-  await ductape.analytics.flush();
-  ductape.analytics.clearSession();
-
-  Clear analytics identity when logout or revocation succeeds, refresh fails irrecoverably, local
-  authentication is removed, or a different user is about to authenticate in the same browser.
-  Removing only the application token can leave later anonymous/next-user events associated with
-  the previous analytics identity. Flush is best-effort; browser shutdown does not guarantee it.
-
-CUSTOM EVENTS
-  await ductape.analytics.track({
-    event: 'order_submitted',
-    traceId,
-    properties: { matchId, orderType },
-  });
-
-  IAnalyticsTrackOptions:
-    event: string
-    properties?: Record<string, unknown>
-    session?: string
-    product?: string
-    env?: string
-    traceId?: string
-    context?: { url?, path?, referrer?, locale?, screen?: { width, height } }
-
-  identify establishes the default analytics session. An individual event may explicitly provide
-  session. Normally use product/env from client configuration. traceId correlates frontend intent
-  with backend logs, Events, Features, and order processing.
-
-PAGE VIEWS
-  await ductape.analytics.pageview({
-    path: location.pathname,
-    title: document.title,
-    properties: { matchId, screen: 'governance' },
-  });
-
-  IAnalyticsPageviewOptions:
-    path?: string
-    title?: string
-    session?: string
-    product?: string
-    env?: string
-    properties?: Record<string, unknown>
-
-AUTO-CAPTURE — OPT IN ONLY AFTER A PRIVACY AUDIT
-  const stopAutoCapture = ductape.analytics.enableAutoCapture({
-    session: () => authSession?.token,
-    clicks: false,
-    pageviews: true,
-    maskTextSelectors: [
-      '[data-private]',
-      '[data-secret]',
-      '[data-player-message]',
-      '[data-intelligence-report]',
-    ],
-  });
-  stopAutoCapture(); // or ductape.analytics.disableAutoCapture()
-
-  Mark sensitive UI with data-private/data-secret attributes. Text masking may not mask attributes,
-  IDs, URLs, element names, custom properties, console errors, or network errors. Inspect actual
-  payloads before production. For hidden-information products, begin with reviewed automatic
-  pageviews, clicks disabled, and preferred custom named events.
-
-VISITOR ID
-  const visitorId = ductape.analytics.getVisitorId();
-  A visitor ID is anonymous analytics identity, not authentication or authorization.
-
-FRONTEND SESSION LIFECYCLE
-  Before login:
-    - Track anonymous pageviews/onboarding; do not invent a session.
-  After login/registration:
-    - Store the session securely, identify(fullSessionToken), track success, start authenticated
-      pageviews, and pass the same token to user-context realtime/component operations.
-  After refresh:
-    - Replace the old token, identify(newSessionToken), update realtime connections/subscriptions,
-      and use the refreshed token for future backend operations.
-  Logout:
-    - Optionally track logout_initiated, flush, revoke, disconnect realtime, clearSession, then
-      remove local authentication.
-  Refresh failure/revocation:
-    - Disconnect user-context clients, clearSession, clear local auth, navigate to authentication,
-      and track only anonymous events afterward.
-
-REACT ROUTE TRACKING (verify installed exports first)
-  import { useAnalytics, useDuctape } from '@ductape/react';
-  import { useEffect } from 'react';
-  import { useLocation } from 'react-router-dom';
-
-  function ProductAnalytics({ sessionToken }: { sessionToken?: string }) {
-    const analytics = useAnalytics();
-    const { client } = useDuctape();
-    const location = useLocation();
-    useEffect(() => {
-      if (sessionToken) analytics.identify(sessionToken);
-      else client.analytics.clearSession();
-    }, [analytics, client, sessionToken]);
-    useEffect(() => {
-      void analytics.pageview({ path: location.pathname, title: document.title });
-    }, [analytics, location.pathname]);
-    return null;
-  }
-
-SAFE EVENT TAXONOMY
-  Define stable names centrally; do not invent variants throughout components.
-  Authentication:
-    registration_started, registration_completed, registration_failed,
-    login_started, login_completed, login_failed, session_refreshed,
-    session_refresh_failed, logout_completed
-  Match:
-    match_list_viewed, match_creation_started, match_created, match_joined, lobby_viewed,
-    player_marked_ready, match_preparation_started, world_loaded, match_reconnected,
-    match_completed, endgame_viewed
-  Orders:
-    order_form_opened, order_previewed, order_submission_started, order_submitted,
-    order_submission_failed, order_cancelled, boundary_result_viewed
-  Realtime:
-    realtime_connect_started, realtime_connected, realtime_disconnected,
-    realtime_reconnect_attempted, realtime_subscription_failed, projection_refresh_failed,
-    client_error
-  Funnels:
-    tutorial_started, tutorial_step_completed, tutorial_abandoned, first_match_created,
-    first_order_submitted, first_boundary_viewed, first_match_completed
-
-  Safe properties include matchId, orderType, screen, tick, result, and errorCategory.
-
-HIDDEN AND SENSITIVE DATA — NEVER SEND TO ANALYTICS
-  Do not track exact hidden formations, operative/handler identities, secret operation payloads,
-  false-report truth markers, undiscovered evasion details, invisible treaties, canonical hidden
-  map state, private messages, passwords, authorization headers, session/refresh tokens in event
-  properties, or full errors/records that may contain secrets. Analytics must observe usage, not
-  become a hidden-state side channel.
-
-CORRELATION
-  Frontend: create traceId = crypto.randomUUID(), track intent with traceId, and send traceId with
-  the actual request. Backend logs the same traceId and propagates session to Ductape operations.
-  Track completion with the same traceId.
-
-  traceId       = correlation
-  session       = actor attribution
-  idempotencyKey = duplicate prevention
-  matchId/orderId = domain identity
-  These values are not interchangeable.
-
-OWNERSHIP BOUNDARIES
-  Analytics is never an authoritative order, authorization proof, or gameplay source of truth.
-  Analytics failure must not block or alter gameplay. The server verifies sessions independently;
-  authoritative database and Event streams remain the source of truth. Prefer non-blocking
-  analytics except explicit best-effort flushes at safe lifecycle transitions.
-
-FRONTEND PROJECT AUDIT
-  Inspect installed @ductape/client/react/vue versions and actual exports; client/provider setup;
-  identify after login and refresh; clearSession on logout/account switch; SPA pageviews; auto-
-  capture and masking; taxonomy consistency; sensitive custom properties; and shared trace IDs.
-  Report capability as Present/Missing/Partial/Not applicable with concrete findings.
-
-WHEN “SESSION ACTIVITY IS MISSING FROM THE DASHBOARD”
-  Investigate both tracks before blaming the SDK.
-  Backend: start/verify format, correct env, session on database/Event/Feature/notification/etc.,
-  and intentional background sessionlessness.
-  Frontend: identify after login/refresh, clearSession on logout, pageviews/custom events, flush,
-  correct publishable key/product/env, installed API compatibility, browser failures, and privacy
-  controls that may suppress events.
-
-PAYLOAD RECIPES
-  Anonymous:
-    await ductape.analytics.pageview({ path: window.location.pathname, title: document.title });
-  Authenticated:
-    ductape.analytics.identify(playerSessionToken);
-    await ductape.analytics.track({
-      event: 'match_created', session: playerSessionToken, traceId, properties: { matchId },
-    });
-  Logout:
-    await ductape.analytics.flush();
-    ductape.analytics.clearSession();
-`.trim(),
-
-  features: `
-DUCTAPE FEATURES
-
-A feature is an orchestrated workflow of durable steps. Steps can call app actions, database
-operations, graph queries, storage uploads, notifications, broker publishes, child features,
-quotas, fallbacks, and more. Features support rollback, signals, checkpoints, and sleep.
-
-━━━ AI DESIGN WORKFLOW — follow this process every time a user asks you to build or plan a feature ━━━
-
-ALWAYS use features.define (code-first). NEVER use features.create.
-The feature handler is real code written into the project's source files — find the project's
-language and framework, write the feature into an appropriate file in the codebase, and call
-features.define from there. Do not generate inline snippets and stop — write the actual file.
-
-STEP 1 — UNDERSTAND the goal
-  Ask clarifying questions if the user's intent is unclear. Do not start designing until you
-  understand: what the feature does, what it returns, what can fail and how failures should behave.
-
-STEP 2 — INVENTORY existing Ductape components
-  Call ductape_cli("products get --tag <product_tag> --json") to read the full product document.
-  (product.* requires the access key — never use ductape_execute for product reads, it will return 403)
-  Note what already exists:
-    - databases[]      → available for ctx.database.insert/query/update/delete steps
-    - apps[]           → available for ctx.api.run steps ONLY if the App is fully registered:
-                         (a) App record exists, (b) environments defined with base URLs,
-                         (c) auth scheme configured, (d) action endpoints defined,
-                         (e) connected to the product via product.apps.add.
-                         Check app.events[] for action tags. If no app exists for a service the
-                         feature needs to call, flag it as "App to create" in the plan — do NOT
-                         assume ctx.api can call any URL or schedule any job without a registered App.
-    - notifications[]  → available for ctx.notification.email/sms/push steps
-    - storage[]        → available for ctx.storage.upload/download steps
-    - messageBrokers[] → available for ctx.events.produce steps
-    - graphs[]         → available for ctx.graph steps
-    - features[]       → can be called as child features via ctx.feature.execute()
-    - caches[], sessions[]
-  Do NOT assume a component or event tag exists — verify from the product before using it.
-  Do NOT treat ctx.api as a generic HTTP call or job scheduler. It requires a registered App.
-
-STEP 3 — PLAN each step
-  For every logical step:
-    a. Identify which existing component handles it, or flag it as needing creation.
-       If a step calls an external service, it MUST go through a registered Ductape App.
-       If no App for that service exists in the product → mark it "App to create: <service name>".
-       DO NOT plan a raw HTTP call, a direct dispatch to a URL, or any workaround in place of a missing App.
-    b. Note how inputs flow: ctx.input fields, or return values from earlier steps (plain JS variables — no special notation needed)
-    c. Decide if a rollback handler is needed (e.g. charge → refund on later failure)
-    d. Decide allow_fail: true for non-critical steps (email, analytics, audit logs)
-
-STEP 4 — PRESENT the plan and get approval BEFORE writing any code or creating anything
-  Show the user:
-    Feature: <name> (<tag>)
-    Input fields: list them with types
-    Steps (in order):
-      1. <step-tag> — <what it does> — <component> [rollback: yes/no] [allow_fail: yes/no]
-      2. ...
-    Return value: describe what the handler returns
-    Components to create: list anything missing with a short description
-  Ask: "Should I proceed? Shall I create the missing components first?"
-  Wait for confirmation before writing code or calling any create tool.
-
-STEP 5 — CREATE missing components (only with user approval)
-  Administrative assets must never be created through ductape_execute. Use ductape_cli for products,
-  apps, supported resources, broker topics, cloud connections, secrets, and declarative apply flows.
-  App actions, auths, quotas, fallbacks, health checks, and other administrative assets for which
-  the CLI has no command must be configured in Workbench. Feature definitions are the exception:
-  they are code-first via features.define, are registered by application boot/runtime initialization,
-  and cannot be created with the CLI. Do not generate a Workbench-only or publishable-key
-  create/update call for a Feature. For a missing database action, configure it in Workbench, then verify it exists.
-  For a missing child feature, recursively apply this same workflow.
-  Tell the user what you are about to create before each tool call.
-
-STEP 6 — WRITE the feature into the project codebase
-  - Locate or create an appropriate file in the project (e.g. src/features/feature-name.ts, features/feature_name.py)
-  - Use features.define with an async handler
-  - Step results are plain variables — just await ctx.step(...) and use the return value in the next step
-  - No special notation needed: const user = await ctx.step('create-user', async () => { ... }); then use user.id directly in the next step
-  - Write rollback handlers inline as the third argument to ctx.step()
-  - Return a plain object as the feature's output
-
-STEP 7 — HANDLE conditionals, loops, and branching (when applicable)
-  Branch on step result (early return in handler):
-    → Add branchOverrides: { stepTag: { field: value } } so all branches are recorded
-    → At runtime the executor evaluates the real result and skips or runs later steps accordingly
-  Loop over input array:
-    → Add recordInput: { items: [{ id: "1" }, { id: "2" }] } so the loop runs during recording
-    → Use unique step tags per iteration (e.g. "process-" + item.id)
-  Switch/if-else on feature input values:
-    → Add recordScenarios: [{ type: "a" }, { type: "b" }] — handler runs once per scenario
-    → Only the scenario whose input matches runs at execution time
-
-STEP 8 — SET rollbacks for reversible steps
-  Any step that allocates a resource should undo it if a later step fails.
-  ctx.api.run requires a pre-registered Ductape App — 'stripe' below is the tag of a registered App:
-    const charge = await ctx.step(
-      'charge',
-      async () => ctx.api.run({ app: 'stripe', event: 'create-charge', input: { amount: ctx.input.amount } }),
-      async (result) => ctx.api.run({ app: 'stripe', event: 'refund', input: { chargeId: result.id } })
-    );
-
-Step types: action | database | graph | notification | storage | produce | quota | fallback |
-  vector | child_feature | sleep | wait_for_signal | checkpoint
-
-Define a feature (write this into the project's source files — do NOT use features.create):
-  // src/features/onboard-user.ts  (or the equivalent path/language for the project)
-  await ductape.features.define({
-    tag: "onboard-user",
-    name: "Onboard User",
-    handler: async (ctx) => {
-      const account = await ctx.step("create-account", async () =>
-        ctx.database.insert({ database: "core-db", event: "insert-user",
-          data: { userId: ctx.input.userId, email: ctx.input.email } }),
-        async (result) => ctx.database.delete({ database: "core-db", event: "delete-user",
-          where: { id: result.id } })   // rollback
-      );
-
-      await ctx.step("send-welcome", async () =>
-        ctx.notification.email({ notification: "welcome-email", event: "welcome",
-          recipients: [ctx.input.email], subject: {}, template: {} }),
-        null,
-        { allow_fail: true }
-      );
-
-      return { userId: account.id };
-    },
-  });
-
-Execute at runtime:
-  → CALL ductape_generate_payload FIRST (operation_family="features", method="execute", targets={tag})
-  features.execute [{ product, env, tag, input: { userId: "u_123", email: "..." },
-    idempotency_key?: string, retries?: number, timeout?: number }]
-
-Background dispatch with scheduling:
-  features.dispatch [{ product, env, feature, input,
-    schedule?: { start_at?, cron?, every?, limit?, endDate?, tz? } }]
-  → Returns { job_id, status: "queued"|"scheduled", scheduled_at, next_run_at }
-
-Execution management:
-  features.status        [executionId]  → { status, current_step, completed_steps, output, error }
-  features.cancel        [executionId, reason?]  → triggers rollback of running steps
-  features.replay        [executionId, options?]  → re-run with original input
-  features.restart       [executionId]  → re-run with new input
-  features.resume        [executionId]  → continue from a checkpoint
-  features.replayFromStep [executionId, stepTag]  → replay from a specific step
-  features.history       [executionId]  → { events[], checkpoints[], replays[], restarts[] }
-  features.stepDetail    [executionId, stepTag]  → per-step input/output/error/timing
-
-Signals and queries (for long-running features):
-  features.signal [{ product, env, feature_id, signal: "payment-confirmed", payload? }]
-  features.query  [{ product, env, feature_id, query: "current-status", params? }]
-
-Rollback strategies: reverse_all | reverse_critical | compensate | none
-Feature statuses: pending | running | completed | failed | rolled_back | rolling_back | paused
-
-━━━ FEATURE RECORDING SEMANTICS ━━━
-
-When you call features.define({ handler }), the handler runs TWICE:
-
-  1. RECORDING PHASE (at define time) — handler is called with a RecordingContext.
-     All ctx.step() calls return lightweight proxy objects, not real data.
-     This phase captures the step graph: which steps exist, their types, tags, and declared
-     inputs/outputs. No real API calls, DB queries, or side effects occur.
-     Arbitrary JS code OUTSIDE ctx.step() ALSO runs during recording — with proxy values.
-     For loops: use recordInput so the handler sees sample data and all iterations are recorded.
-     For branches: use branchOverrides so each path is captured.
-
-  2. EXECUTION PHASE (at runtime) — handler is called with a real ExecutionContext.
-     ctx.step() actually executes. All real Ductape component calls happen.
-     Arbitrary JS logic (math, string ops, conditionals on step results) runs for real.
-
-  Implication: put all meaningful business logic INSIDE ctx.step() handlers, not in the
-  outer handler body. Code in the outer body runs during recording with proxy values and
-  may behave unexpectedly (e.g. typeof proxy === 'object' is true but .someField is a proxy).
-
-  Features do NOT execute arbitrary NestJS or server code directly. A feature handler can only
-  call Ductape component primitives (ctx.api, ctx.database, ctx.notification, etc.) as steps.
-  To invoke internal application business logic, produce a broker event from a feature step
-  (ctx.events.produce in the currently published SDK) and consume it in your NestJS service.
-  ctx.publish is deprecated; do not use it. Do not assume a ctx.messaging alias exists unless the
-  installed SDK types explicitly expose it.
-
-━━━ ORCHESTRATION DECISION RULE ━━━
-
-  One component operation at a future time:
-    → use that component's own dispatch method
-      e.g. ductape.events.dispatch({ ..., schedule: { start_at: ... } })
-      e.g. ductape.api.dispatch({ ..., schedule: { start_at: ... } })
-      e.g. ductape.database.dispatch({ ..., schedule: { start_at: ... } })
-
-  Several durable Ductape component operations in sequence (with rollback / retry / state):
-    → define a Feature, then features.dispatch to schedule it
-
-  Invoke internal application business logic (your own NestJS/backend service code):
-    → produce a broker event (ctx.events.produce inside a Feature, or ductape.events.produce outside it)
-    → follow ductape_docs({ topic: "events" }) and use the canonical NestJS decorator:
-      @Events.Consumer({ event: "broker-tag:topic-tag" })
-      async handle(message: MessageShape) { /* injected-service business logic; throw to nack */ }
-    → DuctapeModule auto-registers the decorated consumer; no manual onModuleInit is needed
-    → events.consume() remains a supported lower-level alternative for plain TypeScript/Node.js
-    → your service method runs with full access to DI, DB transactions, etc.
-    Do NOT create an App Action just to call your own service over HTTP.
-
-  Invoke an external/public HTTP service:
-    → create a Ductape App (register base URL, auth, action endpoints) then use ctx.api.run
-    → requires the App to be fully registered and connected to the product first
-`.trim(),
-
-  events: `
-DUCTAPE EVENTS (MESSAGE BROKERS)
-
-ARCHITECTURE — always two separate steps:
-  Step 1: Register the BROKER COMPONENT (establishes the connection to the broker service).
-          The broker's envs[] holds connection credentials and host/project info, NOT topics.
-  Step 2: Create TOPIC DEFINITIONS on that broker (unlimited; each is a named subject or queue).
-          Topics are separate from the broker registration and added after.
-  A single broker component can have as many topics as needed.
-
-━━━ SUPPORTED BROKER TYPES ━━━
-
-Cloud-managed (provision OR import via cloud connection):
-  GCP Pub/Sub    → service: "pubsub",      type in envs: "google_pubsub"
-  AWS SQS        → service: "sqs",         type in envs: "aws_sqs"
-  Azure SvcBus   → service: "servicebus",  type in envs: "azure_servicebus"
-
-Self-hosted (import-only — supply connection URL manually):
-  Kafka          → type in envs: "kafka"
-  RabbitMQ       → type in envs: "rabbitmq"
-  Redis          → type in envs: "redis"
-  NATS           → type in envs: "nats"
-
-━━━ STEP 1A: REGISTER VIA CLOUD CONNECTION (cloud-managed brokers) ━━━
-
-Provision (create a NEW resource in the cloud):
-  ductape_cli("cloud resources provision-persist-all -f brokers.json --json")
-  File: JSON ARRAY — one entry per env, same product + component tag across all entries.
-  type field: "messageBrokers" (exact — not "messagebrokers" or "events")
-
-  GCP Pub/Sub — creates a new Pub/Sub topic in GCP, stores credentials in secrets:
-    Cost: GCP Pub/Sub is usage-based — no upfront cost, no tier selection required.
-    You pay per GB of data published/subscribed (first 10 GB/month free).
-    It is safe to provision without user approval of a fixed monthly cost.
-    [{"cloud":"gcp-snd","service":"pubsub","type":"messageBrokers",
-      "product":"my-product","component":"notifications-broker","env":"snd",
-      "topicName":"my-product-notifications-snd"},
-     {"cloud":"gcp-prd","service":"pubsub","type":"messageBrokers",
-      "product":"my-product","component":"notifications-broker","env":"prd",
-      "topicName":"my-product-notifications-prd"}]
-    If topicName is omitted a timestamped name is generated — always supply it explicitly.
-
-  AWS SQS — creates a new SQS queue per env:
-    Cost: SQS is usage-based — no upfront cost, no tier selection required.
-    First 1 million requests/month free; $0.40 per million after that.
-    It is safe to provision without user approval of a fixed monthly cost.
-    [{"cloud":"aws-snd","service":"sqs","type":"messageBrokers",
-      "product":"my-product","component":"notifications-broker","env":"snd",
-      "queueName":"my-product-notifications-snd"},
-     {"cloud":"aws-prd","service":"sqs","type":"messageBrokers",
-      "product":"my-product","component":"notifications-broker","env":"prd",
-      "queueName":"my-product-notifications-prd"}]
-
-  Azure Service Bus — creates a namespace + queue per env:
-    Cost: Azure Service Bus has TIERED pricing — confirm the tier with the user before provisioning.
-    Basic:    queues only, ~$0.05/million operations. No topics/subscriptions.
-    Standard: queues + topics, ~$10/month base + $0.10/million operations.
-    Premium:  dedicated capacity, starts ~$677/month. Not needed for standard workloads.
-    DO NOT provision Azure Service Bus without confirming the tier with the user.
-    [{"cloud":"azure-snd","service":"servicebus","type":"messageBrokers",
-      "product":"my-product","component":"notifications-broker","env":"snd",
-      "namespaceName":"myproduct-snd","queueName":"notifications"},
-     {"cloud":"azure-prd","service":"servicebus","type":"messageBrokers",
-      "product":"my-product","component":"notifications-broker","env":"prd",
-      "namespaceName":"myproduct-prd","queueName":"notifications"}]
-
-Import (register an EXISTING cloud resource):
-  Same as above but use import-persist-all and supply "resource" (the existing resource name/ID):
-    ductape_cli("cloud resources import-persist-all -f brokers.json --json")
-    Each entry: { cloud, service, type: "messageBrokers", product, component, env, resource: "<id>" }
-
-  IMPORTANT: Never share one cloud resource (topic/queue) across snd and prd envs — use
-  separate resources per env to avoid mixing sandbox and production events.
-
-━━━ STEP 1B: REGISTER SELF-HOSTED BROKER (no cloud connection needed) ━━━
-
-  ductape_cli("resources events create -f broker.json")
-  File: {
-    name: string, tag: string, description?: string,
-    envs: [
-      {
-        slug: "snd",
-        type: "kafka"|"rabbitmq"|"redis"|"nats",
-        config: <see config shapes below>
-      },
-      { slug: "prd", type: "kafka", config: { ... } }
-    ]
-  }
-
-  Config shapes per type:
-    kafka:    { brokers: ["host:9092"], clientId: "my-app", groupId?: "...",
-                ssl?: true, sasl?: { mechanism: "plain", username, password } }
-    rabbitmq: { url: "amqp://user:pass@host:5672/vhost" }
-    redis:    { host: "...", port: 6379, password?: "..." }
-    nats:     { servers: ["nats://host:4222"], token?: "...", user?: "...", pass?: "...", tls?: true }
-
-━━━ STEP 2: DEFINE TOPICS ━━━
-
-  Topics MUST be defined before any consumer can subscribe to them.
-  Producing to a topic also calls ensureTopicRegistered in the background — but DO NOT rely on
-  auto-registration for consume paths. Always create topics explicitly.
-
-  IMPORTANT: events.topics.create requires an access key (admin operation).
-  Use ductape_cli — NOT ductape_execute — to create topics.
-
-  Write a topic.json file, then:
-    ductape_cli("events topics create -f topic.json")
-
-  topic.json schema:
-    {
-      "tag": "order-events:order-created",  // ALWAYS "broker-tag:topic-tag" — full event string
-      "name": "Order Created",
-      "description": "...",                // optional
-      "sample": { "orderId": "string", "total": 0 },  // expected message shape
-      "idempotent": false,                 // optional — deduplicates by idempotency_key when true
-      // AWS SQS only — per-env queue URL:
-      "queueUrls": [
-        { "env_slug": "snd", "url": "https://sqs.us-east-1.amazonaws.com/123/queue-snd" },
-        { "env_slug": "prd", "url": "https://sqs.us-east-1.amazonaws.com/123/queue-prd" }
-      ]
-    }
-
-  Other topic operations (all require access key via ductape_cli):
-    ductape_cli("events topics list --tag order-events")          → list topics for a broker
-    ductape_cli("events topics get --tag order-events:order-created")
-    ductape_cli("events topics update --tag order-events:order-created -f patch.json")
-    ductape_cli("events topics delete --tag order-events:order-created")
-
-  Read-only fetches (safe with publishable key via ductape_execute):
-    ductape_execute("events.fetch", [product_tag, "broker-tag"])  → includes topics[]
-
-━━━ STEP 3: PRODUCE — WRITTEN IN APPLICATION CODE ━━━
-
-  There is NO admin command to declare a producer. Producers are auto-registered by the SDK on
-  the first produce call — you do not pre-declare them.
-  Do NOT call ductape_generate_payload for messaging. The producer owns the schema.
-  Infer the message shape from context, present it to the user for approval, then implement.
-
-  GENERAL BACKEND (TypeScript/Node.js — not NestJS):
-    import Ductape from '@ductape/sdk';
-    // produce() does not need redis_url.
-    // dispatch() requires redis_url in the Ductape initialization options — it throws at runtime without it.
-    const ductape = new Ductape({
-      accessKey: process.env.DUCTAPE_ACCESS_KEY,
-      redis_url: process.env.DUCTAPE_REDIS_URL,  // required for any dispatch(); omit only if never dispatching
-    });
-    await ductape.events.produce({
-      product: "my-product",
-      env: "prd",
-      event: "broker-tag:topic-tag",   // always colon-separated
-      message: { key: value },
-      session?: "session-tag:jwt",     // optional — traces message to a user session
-    });
-    // Idempotent publish (deduplicates — prevents double-processing on retries):
-    await ductape.events.publishIdempotent({
-      product, env, event, message,
-      idempotencyKey: "order-123-charge",  // stable key unique to this logical operation
-      idempotencyTtl?: 86400,             // seconds; default 86400 (24h)
-    });
-
-  NESTJS — initialization + method decorators:
-    // AppModule — redisUrl is required whenever any *.dispatch() is used:
-    DuctapeModule.forRootAsync({
-      useFactory: () => ({
-        accessKey: process.env.DUCTAPE_ACCESS_KEY,
-        product: 'my-product',
-        env: process.env.NODE_ENV === 'production' ? 'prd' : 'snd',
-        redisUrl: process.env.DUCTAPE_REDIS_URL,  // required — dispatch() throws without this
-      }),
-    });
-    // Environment: DUCTAPE_REDIS_URL=redis://localhost:6379 (local) or rediss://:<pw>@host:6380 (managed)
-    // produce() and @Events.Consumer do NOT need DUCTAPE_REDIS_URL — only dispatch() does.
-
-    import { Events } from '@ductape/nestjs';
-    @Injectable() export class OrdersService {
-      // Immediate produce — method returns the message payload:
-      @Events.Produce({ event: 'order-events:order-created' })
-      emitOrderCreated(payload: { orderId: string; total: number }) { return payload; }
-
-      // Dispatch with static schedule — requires redisUrl in DuctapeModule initialization:
-      @Events.Dispatch({ broker: 'order-events', event: 'order-events:reminder-due',
-                         schedule: { every: 86400000 } })
-      scheduleReminder(payload: { message: { orderId: string } }) { return payload; }
-
-      // Dispatch with dynamic schedule (known at call time) — method returns { message, schedule?, retries? }:
-      @Events.Dispatch({ broker: 'order-events', event: 'order-events:fulfillment-due' })
-      scheduleFulfillment(order: Order) {
-        return {
-          message: { orderId: order.id, items: order.items },
-          schedule: { start_at: order.expectedAt },
-          retries: 3,
-        };
-      }
-      // Called as: await this.ordersService.scheduleFulfillment(order);
-      // When method return has a 'message' key, schedule/retries from return take precedence over decorator config.
-      // For even more control (dynamic broker/event), use sdk.events.dispatch() directly.
-    }
-
-  CLIENT-SIDE (browser — publishable key):
-    Clients CAN produce messages using a publishable key + session token.
-    Only produce to topics whose schema is safe for client authorship.
-    NEVER allow clients to produce to topics that trigger privileged server-side operations
-    (payments, admin actions, state mutations) — those must go through a backend endpoint first.
-    import { createClient } from '@ductape/client';
-    // Equivalent supported import: import Ductape from '@ductape/client';
-    const ductape = createClient({
-      publishableKey: 'pk_...',
-      env: 'prd',
-      product: 'my-product',
-    });
-    await ductape.connect();
-    await ductape.brokers.connect({
-      broker: 'user-events',
-      session: 'user-session:eyJ...',
-    });
-    await ductape.brokers.publish({
-      topic: 'user-action',
-      message: { action: "button-click", screen: "dashboard" },
-      session: "user-session:eyJ...",  // REQUIRED for client-side produce
-    });
-
-  SCHEDULED DISPATCH (background job):
-    ductape_execute("events.dispatch", [{
-      product, env,
-      event: "order-events:reminder-due",    // fully-qualified "broker-tag:topic-tag" — no separate broker field
-      input: { message: { orderId: "123" } },
-      retries?: 3,
-      session?: "session-tag:jwt",
-      schedule?: {
-        start_at?: 1735689600000,    // Unix ms or ISO string
-        cron?: "0 9 * * *",          // recurring cron
-        every?: 86400000,            // recurring interval ms
-        limit?: 10,                  // max repetitions
-        endDate?: "2026-12-31",
-        tz?: "America/New_York",
-      },
-    }])
-    Returns: { job_id, status: "scheduled"|"queued", scheduled_at, recurring, next_run_at? }
-
-━━━ STEP 4: CONSUME — WRITTEN IN APPLICATION CODE ━━━
-
-  ACK BEHAVIOR (automatic):
-    - Callback returns successfully → message is acknowledged (ack)
-    - Callback throws → message is tracked as failed; broker nacks/retries per provider behavior
-    - After max retries → message moves to dead-letter queue (DLQ)
-    There is no manual ack API. Acknowledgement is implicit from callback outcome.
-
-  CONSUMER GROUPS (Kafka-specific):
-    Consumer groups are set in the broker's envs[].config.groupId (at broker registration time).
-    All service instances sharing the same groupId form a consumer group and share partition load.
-    To configure: set groupId in the kafka config when creating/updating the broker.
-
-  CONCURRENCY:
-    Ductape has no per-consumer concurrency setting. Concurrency is determined by:
-      - Number of running service instances (horizontal scale)
-      - Broker-level partition count (Kafka) or visibility timeout (SQS)
-    Run multiple instances of your service to scale consumption.
-
-  GENERAL BACKEND (TypeScript/Node.js — not NestJS):
-    await ductape.events.consume({
-      product: "my-product",
-      env: "prd",
-      event: "order-events:order-created",   // ALWAYS "broker-tag:topic-tag"
-      callback: async (message) => {
-        // Throw to nack. Return to ack.
-        await processOrder(message as { orderId: string; total: number });
-      },
-    });
-
-  NESTJS — use @Events.Consumer decorator (preferred):
-    import { Events } from '@ductape/nestjs';
-    @Injectable()
-    export class OrderConsumerService {
-      @Events.Consumer({ event: 'order-events:order-created' })
-      async onOrderCreated(message: { orderId: string; total: number }) {
-        await this.processOrder(message);
-        // return to ack; throw to nack
-      }
-      private async processOrder(msg: { orderId: string; total: number }) { /* ... */ }
-    }
-    // DuctapeEventsConsumerService (auto-registered by DuctapeModule) wires this up at startup.
-    // No manual onModuleInit needed.
-
-    // If you need to override product/env for a specific consumer:
-    @Events.Consumer({ event: 'order-events:order-created', product: 'my-product', env: 'prd' })
-
-  CLIENT-SIDE: Clients CANNOT consume. Event consumption is always server-side only.
-  This is the key distinction between server topics (produce + consume) and client-observable
-  topics (produce from client, consume on server). Never set up a consumer in browser code.
-
-  DEAD-LETTER QUEUE (DLQ):
-    Messages whose callbacks consistently throw are automatically moved to the DLQ.
-    Query:     ductape_execute("events.messages.getDeadLetters",
-                 [{ product, env, brokerTag, topicTag?, consumerTag?, limit? }])
-    Reprocess: ductape_execute("events.reprocessDLQ",
-                 [{ product, env, brokerTag, topicTag?, messageIds?, limit? }])
-    Replay:    ductape_execute("events.replayEvent",
-                 [{ product, env, eventId, force? }])
-
-━━━ OBSERVABILITY ━━━
-
-  events.messages.query        [{ product, env, brokerTag, topicTag?, status?, page?, limit? }]
-  events.messages.getStats     [{ product, env, brokerTag }]
-  events.messages.getDashboard [{ product, env, brokerTag }]
-  events.messages.getDeadLetters [{ product, env, brokerTag, topicTag?, consumerTag?, limit? }]
-  events.messages.getProducers [{ product, env, brokerTag, topicTag?, page?, limit? }]
-  events.messages.getConsumers [{ product, env, brokerTag, topicTag?, page?, limit? }]
-  events.replayEvent           [{ product, env, eventId, force? }]
-  events.reprocessDLQ         [{ product, env, brokerTag, topicTag?, messageIds?, limit? }]
-  events.checkIdempotency      [{ product, env, brokerTag, idempotency_key }]
-`.trim(),
-
-  logs: `
-DUCTAPE LOGS
-
-Logs record every SDK operation — actions, features, database queries, notifications, sessions,
-brokers, storage, cache hits, graph, vector, and resilience events.
-
-Fetch logs (runtime — ductape_execute):
-  ductape_execute("logs.fetch", [{
-    app_id?: string,        // query by app (requires component: "app")
-    product_id?: string,    // query by product (requires component: "product")
-    env?: string,
-    start_date?: string,    // ISO 8601
-    end_date?: string,
-    page?: number,
-    limit?: number,
-  }])
-  component "app" or "product" is required — there is no default.
-  When component="app", tag is only valid with type: "actions".
-
-Log data fields (ILogData):
-  process_id, product_tag, env, type (LogEventType), status, data (encrypted if private key set)
-  message?, parent_tag?, child_tag?, app_id?, action?, method?,
-  cache_tag?, cache_key?, cache_status (true = hit),
-  start, end, latency (auto-calculated from start/end),
-  session_user_id?, session_id?, session_tag?, visitor_id?,
-  ip_address?, language?, data_encrypted?, successful_execution?, failed_execution?
-
-Log event types (LogEventTypes):
-  notifications | push | email | sms | callbacks | slack | discord |
-  database_actions | actions | functions | storage | webhook | jobs |
-  message_broker | producer | consumer | quota | fallback | database_migration |
-  feature | feature_step | database | graph | session | vector | cache | frontend
-
-Log statuses: success | fail | waiting | processing
-
-Encryption:
-  When workspace_private_key is provided at SDK init, each log entry's data field is
-  AES-encrypted client-side before transmission. data_encrypted: true is set on the entry.
-  The backend can decrypt when returning logs to the Workbench.
-
-Emit a log manually (SDK only — not via MCP):
-  logs.add({ process_id, product_tag, env, type, status, data, message?, ... })
-  logs.publish()  → flushes all buffered entries to the API in one call
-
-Notes:
-  - Every SDK service (storage, broker, feature, graph, notifications, sessions, vector, cache,
-    resilience) emits its own logs automatically — manual add/publish is only needed for custom logs.
-  - language defaults to "typescript" so the backend knows which SDK emitted the entry.
-  - Logs are batched in memory and sent in a single publish() call per operation.
-`.trim(),
-
-  client: `
-DUCTAPE CLIENT SDK (@ductape/client)
-
-The client SDK is for frontend applications (React, Vue, Svelte, vanilla JS). All HTTP
-operations are routed through the Ductape proxy using a publishableKey. WebSocket subscriptions
-connect to the proxy's /realtime gateway. Never use this package on the server — use @ductape/sdk
-for server-side code.
-
-INSTALL
-  npm install @ductape/client
-
-INITIALIZATION
-  import { createClient } from '@ductape/client';
-  // or: import Ductape from '@ductape/client';
-
-  const ductape = createClient({
-    publishableKey: 'pk_live_...',            // from Workbench → Settings → Publishable Keys
-    baseUrl: 'https://your-proxy.example.com', // your deployed proxy URL
-    product: 'my-product',                    // default product tag (can be overridden per call)
-    env: 'prd',                               // default environment slug
-  });
-
-  When publishableKey is set:
-    - HTTP calls go to baseUrl/proxy/v1/sdk-proxy/execute
-    - WebSocket connects to wss://your-proxy.example.com/realtime?token=pk_live_...
-    - No server secret is exposed to the browser
-
-  Use accessKey only for server-side or trusted environments — never in a browser bundle.
-  Override wsUrl to point to a custom WebSocket endpoint.
-
-REAL-TIME CONNECTION
-  await ductape.connect();        // opens WebSocket; required before any .subscribe() call
-  ductape.disconnect();           // closes WebSocket and clears all subscriptions
-  ductape.isConnected             // boolean
-  ductape.connectionState         // 'disconnected' | 'connecting' | 'connected' | 'reconnecting'
-  ductape.onConnectionChange(cb)  // listen to state changes; returns unsubscribe fn
-
-SERVICES
-  ductape.databases     DatabaseService    — CRUD + real-time query subscriptions
-  ductape.features      FeatureService     — execute features, subscribe to execution status
-  ductape.agents        AgentService       — run AI agents, subscribe to output stream
-  ductape.vectors       VectorService      — vector upsert / search
-  ductape.graphs        GraphService       — graph queries + subscriptions
-  ductape.brokers       BrokerService      — publish / subscribe to message brokers
-  ductape.sessions      SessionService     — verify, refresh, revoke sessions
-  ductape.resilience    ResilienceService  — subscribe to healthcheck status
-  ductape.storage       StorageService     — upload / download files
-  ductape.warehouse     WarehouseService   — cross-store federated queries
-  ductape.cache         CacheService       — key-value cache get / set / clear
-  ductape.api           ApiService         — run app actions with OAuth credential support
-  ductape.notifications NotificationsService — send push / email / SMS / callback
-  ductape.analytics     AnalyticsService   — track pageviews, clicks, custom events
-  ductape.workflows     (deprecated alias → features)
-  ductape.actions       (deprecated alias → api)
-
-DATABASE SERVICE
-  await ductape.databases.connect({ database: 'core-db' });
-  const { data } = await ductape.databases.query({ entity: 'users', where: { active: true } });
-  await ductape.databases.insert({ entity: 'users', data: { name: 'Alice', email: 'a@b.com' } });
-  await ductape.databases.update({ entity: 'users', where: { id: 1 }, data: { name: 'Bob' } });
-  await ductape.databases.delete({ entity: 'users', where: { id: 1 } });
-  await ductape.databases.upsert({ entity: 'users', data: { email: 'a@b.com' }, conflict: ['email'] });
-  const total = await ductape.databases.count({ entity: 'users', where: { active: true } });
-  await ductape.databases.raw({ query: 'SELECT * FROM users WHERE id = $1', params: [1] });
-  await ductape.databases.transaction(async (tx) => {
-    await tx.insert({ entity: 'orders', data: { ... } });
-    await tx.update({ entity: 'inventory', where: { ... }, data: { ... } });
-  });
-  await ductape.databases.disconnect();
-
-  Real-time subscription (ductape.connect() must be called first):
-  const sub = ductape.databases.subscribe(
-    { entity: 'orders', where: { status: 'pending' } },
-    (rows) => console.log('live update', rows),
-  );
-  sub.unsubscribe(); // stop receiving updates
-
-FEATURE SERVICE
-  const { executionId } = await ductape.features.execute({ feature: 'onboard-user', input: { userId: 'u_1' } });
-  const status = await ductape.features.status({ feature: 'onboard-user', executionId });
-  await ductape.features.cancel({ feature: 'onboard-user', executionId, reason: 'user request' });
-  await ductape.features.signal({ feature: 'onboard-user', executionId, signal: 'payment-confirmed' });
-  const history = await ductape.features.history({ feature: 'onboard-user', executionId });
-  const { executions } = await ductape.features.list({ status: 'running', limit: 20 });
-
-  Real-time status subscription:
-  const sub = ductape.features.subscribe(
-    { feature: 'onboard-user', executionId },
-    (events) => {
-      const ev = events[0]; // { executionId, feature, status, currentStep, output, error }
-      console.log(ev.status, ev.currentStep);
-      if (ev.status === 'completed' || ev.status === 'failed') sub.unsubscribe();
-    },
-  );
-
-AGENT SERVICE
-  const result = await ductape.agents.run({ agent: 'support-bot', input: { message: 'Help!' } });
-  const sub = ductape.agents.subscribe(
-    { agent: 'support-bot', executionId: result.executionId },
-    (events) => console.log('chunk', events[0]),
-  );
-  sub.unsubscribe();
-
-BROKER SERVICE
-  await ductape.brokers.connect({ broker: 'notifications-broker', session: 'user-session:eyJ...' });
-  await ductape.brokers.publish({ topic: 'chat.message', message: { text: 'Hello', userId: 'u_1' } });
-  const sub = ductape.brokers.subscribe(
-    { topic: 'chat.message' },
-    (msgs) => {
-      const m = msgs[0]; // { topic, message, headers?, key?, timestamp, offset?, partition? }
-      console.log('new message', m.message);
-    },
-  );
-  sub.unsubscribe();
-  await ductape.brokers.disconnect();
-
-  Passing session scopes delivery to a specific end-user so the server applies session-level
-  authorization. Without session, messages for the whole product+env are delivered.
-
-GRAPH SERVICE
-  const nodes = await ductape.graphs.findNodes({ labels: ['User'], where: { active: true } });
-  const sub = ductape.graphs.subscribe({ labels: ['Order'] }, (nodes) => console.log(nodes));
-  sub.unsubscribe();
-
-RESILIENCE SERVICE (health subscriptions)
-  const sub = ductape.resilience.subscribe(
-    { tag: 'payment-health' },
-    (events) => console.log('health change', events[0]),
-  );
-  sub.unsubscribe();
-
-SESSIONS SERVICE
-  const { valid } = await ductape.sessions.verify({ token: 'user-session:eyJ...' });
-  await ductape.sessions.revoke({ token: 'user-session:eyJ...' });
-  const { token } = await ductape.sessions.refresh({ refreshToken: '...' });
-
-ANALYTICS SERVICE
-  ductape.analytics.identify('player-session:eyJ...'); // full Ductape session token
-  await ductape.analytics.pageview({ path: '/dashboard', title: document.title });
-  await ductape.analytics.track({
-    event: 'button_clicked',
-    properties: { button: 'sign-up' },
-  });
-  await ductape.analytics.flush();
-  ductape.analytics.clearSession(); // logout/account switch
-  See ductape_docs({ topic: "frontend-analytics" }) before enabling auto-capture.
-
-FRAMEWORK-SPECIFIC PACKAGES
-  For React and Vue projects, use the dedicated packages instead of managing the client manually:
-    @ductape/react — DuctapeProvider + hooks (useDatabaseQuery, useFeatureSubscription, etc.)
-                     See: ductape_docs({ topic: "react" })
-    @ductape/vue   — createDuctape() plugin + composables (useDatabaseQuery, useFeatureSubscription, etc.)
-                     See: ductape_docs({ topic: "vue" })
-
-  Use @ductape/client directly only for vanilla JS, Svelte, Angular, or custom integrations.
-
-IMPORTANT
-  - Call ductape.connect() before any .subscribe() — it throws if not connected.
-  - Always clean up (sub.unsubscribe()) in component teardown to prevent memory leaks.
-  - The client auto-resubscribes after a WebSocket reconnect — no manual retry needed.
-  - publishableKey is safe in browser bundles; it grants only proxy-authorized operations.
-  - For SSR, skip connect() on the server; call it only client-side (useEffect / onMounted).
-  - The client SDK does NOT expose secrets, access keys, or workspace admin operations.
-  - Pass session (format session_tag:jwt) to broker connect/subscribe for per-user scoping.
-`.trim(),
-
-  react: `
-DUCTAPE REACT (@ductape/react)
-
-React hooks and context provider for Ductape. Wraps @ductape/client.
-Requires react >= 17.
-
-INSTALL
-  npm install @ductape/react
-
-SETUP — wrap your app root with DuctapeProvider
-  import { DuctapeProvider } from '@ductape/react';
-
-  function App() {
-    return (
-      <DuctapeProvider
-        config={{
-          publishableKey: import.meta.env.VITE_PUBLISHABLE_KEY,
-          baseUrl: import.meta.env.VITE_PROXY_URL,
-          product: 'my-product',
-          env: 'prd',
-        }}
-        autoConnect={false}
-      >
-        <MyApp />
-      </DuctapeProvider>
-    );
-  }
-
-  DuctapeProvider props:
-    config              IDuctapeClientConfig  — publishableKey (or accessKey), baseUrl, product, env
-    autoConnect         boolean (default false) — connect WebSocket automatically on mount
-    onConnected         () => void
-    onDisconnected      () => void
-    onError             (error: Error) => void
-    onConnectionChange  (state: ConnectionState) => void
-
-CORE HOOKS
-  useDuctape()        → { client, isConnected, connectionState, connect, disconnect, isReady }
-  useDuctapeContext()  → same; throws if called outside DuctapeProvider
-
-DATABASE HOOKS
-  useDatabase(database)
-    → { isConnected, isConnecting, error, connect, disconnect }
-    Call connect() in a useEffect to open the database session.
-
-  useDatabaseQuery(key, queryOptions, hookOptions?)
-    → { data: IQueryResult<T>, isLoading, error, refetch }
-    key: string | string[]  — deduplication key
-    queryOptions: { table, where?, select?, limit?, offset?, sort? }
-
-  useDatabaseInsert(hookOptions?)   → { mutate({ table, data }), isLoading, error, data }
-  useDatabaseUpdate(hookOptions?)   → { mutate({ table, where, data }), isLoading, error, data }
-  useDatabaseDelete(hookOptions?)   → { mutate({ table, where }), isLoading, error, data }
-
-  useDatabaseSubscription(subscribeOptions, hookOptions?)
-    → { data: T[] | null, isSubscribed, error, unsubscribe, resubscribe }
-    subscribeOptions: { table, where?, select? }
-    Requires autoConnect: true (or manual connect()) and databases.connect() before subscribing.
-
-FEATURE HOOKS
-  useFeatureExecute(hookOptions?)
-    → { mutate({ feature, input?, product?, env? }), isLoading, error, data }
-  useFeatureStatus(statusInput, hookOptions?)
-    → { data: FeatureStatus, isLoading, error, refetch }
-    statusInput: { feature, executionId, product?, env? }
-  useFeatureSubscription(subscribeOptions, hookOptions?)
-    → { data: FeatureStatusEvent[], isSubscribed, error, unsubscribe, resubscribe }
-    subscribeOptions: { feature, executionId, product?, env? }
-  useFeatureSignal(hookOptions?)   → { mutate({ feature, executionId, signal, data? }), isLoading }
-  useFeatureCancel(hookOptions?)   → { mutate({ feature, executionId, reason? }), isLoading }
-
-AGENT HOOKS
-  useAgentRun(hookOptions?)
-    → { mutate({ tag, input?, sessionId? }), isLoading, error, data: IAgentExecutionResult }
-  useAgentStream(tag, input?, hookOptions?)
-    → { events, content, isStreaming, isComplete, error, start, stop, reset }
-    content: accumulated string from all stream text events
-  useAgentStatus(statusInput, hookOptions?)  → { data, isLoading, error, refetch }
-  useAgentSignal(hookOptions?)               → { mutate, isLoading, error }
-
-BROKER HOOKS
-  useBroker()
-    → { isConnected, isConnecting, error, connect, disconnect }
-    connect({ broker, session?, product?, env? }) forwards the complete options object to
-    @ductape/client. Pass session for player-scoped authorization.
-  useBrokerPublish(hookOptions?)
-    → { mutate({ topic, message, headers?, key? }), isLoading, error, data }
-  useBrokerSubscription(subscribeOptions, hookOptions?)
-    → { data: BrokerMessage[], isSubscribed, error, unsubscribe, resubscribe }
-    subscribeOptions: { broker?, topic, group?, session?, product?, env? }
-
-GRAPH HOOKS
-  useGraph(graphTag)  → { isConnected, isConnecting, error, connect, disconnect }
-  useCreateNode(hookOptions?)          → { mutate({ labels, properties }), isLoading, error, data }
-  useUpdateNode(hookOptions?)          → { mutate({ id, properties }), isLoading, error, data }
-  useDeleteNode(hookOptions?)          → { mutate({ id, detach? }), isLoading, error, data }
-  useQueryNodes(key, options, hookOptions?)        → { data, isLoading, error }
-  useCreateRelationship(hookOptions?)  → { mutate, isLoading, error, data }
-  useDeleteRelationship(hookOptions?)  → { mutate, isLoading, error }
-  useQueryRelationships(key, options, hookOptions?) → { data, isLoading, error }
-  useTraverse(key, options, hookOptions?)           → { data, isLoading, error }
-  useShortestPath(key, options, hookOptions?)       → { data, isLoading, error }
-  useGraphSubscription(subscribeOptions, hookOptions?)
-    → { data, isSubscribed, error, unsubscribe, resubscribe }
-
-VECTOR HOOKS
-  useVector(vectorTag)    → { isConnected, isConnecting, error, connect, disconnect }
-  useVectorQuery(key, options, hookOptions?)   → { data, isLoading, error }
-  useVectorSearch(key, options, hookOptions?)  → { data, isLoading, error }
-  useVectorUpsert(hookOptions?)   → { mutate({ id, values, metadata? }), isLoading, error, data }
-  useVectorDelete(hookOptions?)   → { mutate({ ids }), isLoading, error }
-  useVectorFetch(key, options, hookOptions?)   → { data: VectorFetchResult, isLoading, error }
-  useVectorStats(key, options, hookOptions?)   → { data: VectorStatsResult, isLoading, error }
-  useVectorNamespaces(key, options, hookOptions?) → { data, isLoading, error }
-
-STORAGE HOOKS
-  useUpload(hookOptions?)
-    → { upload({ storage, fileName, buffer, mimeType? }), isLoading, progress, error, data }
-    progress: 0–100 number
-  useDownload(hookOptions?)         → { mutate, isLoading, error, data }
-  useStorageDelete(hookOptions?)    → { mutate, isLoading, error }
-  useListFiles(key, options, hookOptions?)    → { data, isLoading, error }
-  useSignedUrl(key, options, hookOptions?)    → { data: string, isLoading, error }
-
-SESSION HOOKS
-  useSessionStart(hookOptions?)     → { mutate, isLoading, error, data: { token, refreshToken } }
-  useSessionVerify(hookOptions?)    → { mutate, isLoading, error, data }
-  useSessionRefresh(hookOptions?)   → { mutate, isLoading, error, data }
-  useSessionRevoke(hookOptions?)    → { mutate, isLoading, error }
-  useSessionRevokeAll(hookOptions?) → { mutate, isLoading, error }
-  useSessionList(key, options, hookOptions?) → { data, isLoading, error }
-  useSessionAutoRefresh(config)
-    → { token, isRefreshing }; auto-refreshes before expiry; no manual call needed
-
-CACHE HOOKS
-  useCacheGet(key, options, hookOptions?)     → { data, isLoading, error }
-  useCacheSet(hookOptions?)                  → { mutate({ key, value, expiry? }), isLoading, error }
-  useCacheDelete(hookOptions?)               → { mutate({ key }), isLoading, error }
-  useCacheExists(key, options, hookOptions?) → { data: boolean, isLoading, error }
-  useCacheGetMany / useCacheSetMany / useCacheDeleteMany
-
-RESILIENCE HOOKS
-  useHealthStatus(key, options, hookOptions?)
-    → { data: HealthStatusResult, isLoading, error, refetch }
-  useHealthSubscription(subscribeOptions, hookOptions?)
-    → { data: HealthChangeEvent[], isSubscribed, error, unsubscribe, resubscribe }
-  useQuotaCheck(hookOptions?)  → { mutate, isLoading, error, data: QuotaCheckResult }
-  useQuotaStatus(key, options, hookOptions?) → { data, isLoading, error }
-  useQuotaSubscription(subscribeOptions, hookOptions?) → { data, isSubscribed, error }
-
-WAREHOUSE HOOKS
-  useWarehouseQuery / useWarehouseSelect / useWarehouseInsert
-  useWarehouseUpdate / useWarehouseDelete / useWarehouseUpsert / useWarehouseTransaction
-
-ACTIONS HOOKS
-  useActions(app) → { isConnected, connect, disconnect }
-  useActionRun(hookOptions?) → { mutate, isLoading, error, data }
-
-ANALYTICS HOOK
-  useAnalytics() → { pageview, track, identify, visitorId, enableAutoCapture, flush }
-  The currently installed hook does NOT return clearSession or disableAutoCapture.
-  Use useDuctape().client.analytics.clearSession()/disableAutoCapture(), or verify a newer installed
-  package export before generating those hook calls. See ductape_docs({ topic: "frontend-analytics" }).
-
-hookOptions pattern (applies to all hooks):
-  enabled?    boolean — false skips auto-fetch/subscribe
-  onSuccess?  (data) => void
-  onError?    (error: Error) => void
-  Subscriptions also accept: onData, onSubscribe, onUnsubscribe
-
-EXAMPLE
-  // main.tsx
-  import { DuctapeProvider } from '@ductape/react';
-  root.render(
-    <DuctapeProvider config={{ publishableKey: 'pk_...', baseUrl: '...', product: 'my-app', env: 'prd' }} autoConnect>
-      <App />
-    </DuctapeProvider>
-  );
-
-  // UsersList.tsx
-  import { useDatabaseQuery } from '@ductape/react';
-  function UsersList() {
-    const { data, isLoading } = useDatabaseQuery('users', { table: 'users', limit: 20 });
-    if (isLoading) return <p>Loading...</p>;
-    return <ul>{data?.rows.map(u => <li key={u.id}>{u.name}</li>)}</ul>;
-  }
-
-  // FeatureTracker.tsx
-  import { useFeatureSubscription } from '@ductape/react';
-  function FeatureTracker({ executionId }) {
-    const { data: events } = useFeatureSubscription(
-      { feature: 'onboard-user', executionId },
-      { onData: (evs) => console.log('status:', evs[0].status) },
-    );
-    return <p>{events?.[0]?.status ?? 'waiting'}</p>;
-  }
-
-DEPRECATED ALIASES
-  useWorkflowExecute → useFeatureExecute
-  useWorkflowStatus  → useFeatureStatus
-  useWorkflowSubscription → useFeatureSubscription
-  useWorkflowSignal  → useFeatureSignal
-  useWorkflowCancel  → useFeatureCancel
-`.trim(),
-
-  vue: `
-DUCTAPE VUE (@ductape/vue)
-
-Vue 3 composables and plugin for Ductape. Wraps @ductape/client.
-Requires vue >= 3.
-
-INSTALL
-  npm install @ductape/vue
-
-SETUP — install the plugin at app root
-  // main.ts
-  import { createApp } from 'vue';
-  import { createDuctape } from '@ductape/vue';
-  import App from './App.vue';
-
-  const app = createApp(App);
-
-  app.use(createDuctape({
-    publishableKey: import.meta.env.VITE_PUBLISHABLE_KEY,
-    baseUrl: import.meta.env.VITE_PROXY_URL,
-    product: 'my-product',
-    env: 'prd',
-    autoConnect: false,   // true = connect WebSocket when plugin installs
-  }));
-
-  app.mount('#app');
-
-  Plugin options (extends IDuctapeClientConfig):
-    publishableKey / accessKey  — auth
-    baseUrl                     — proxy URL
-    product, env                — defaults for all composables
-    autoConnect                 — boolean (default false)
-
-  The client is provided via inject(DUCTAPE_INJECTION_KEY) and is available on
-  this.$ductape in Options API components.
-
-CORE COMPOSABLE
-  useDuctape()
-    → { client, isReady, isConnected: Ref<boolean>, connectionState: Ref<ConnectionState>,
-        error: Ref<Error|null>, connect, disconnect }
-
-DATABASE COMPOSABLES
-  useDatabase(database)
-    → { isConnected, isConnecting, error, connect, disconnect }  — all Refs
-    Call connect() in onMounted to open the database session.
-
-  useDatabaseQuery(key, queryOptions, composableOptions?)
-    → { data: Ref<IQueryResult<T>|null>, isLoading: Ref<boolean>, error: Ref<Error|null>, refetch }
-
-  useDatabaseInsert(composableOptions?)  → { mutate({ table, data }), isLoading, error, data }
-  useDatabaseUpdate(composableOptions?)  → { mutate({ table, where, data }), isLoading, error, data }
-  useDatabaseDelete(composableOptions?)  → { mutate({ table, where }), isLoading, error, data }
-
-  useDatabaseSubscription(subscribeOptions, composableOptions?)
-    → { data: Ref<T[]|null>, isSubscribed: Ref<boolean>, error, unsubscribe, resubscribe }
-    subscribeOptions: { table, where?, select? }
-
-FEATURE COMPOSABLES
-  useFeatureExecute(composableOptions?)
-    → { mutate({ feature, input?, product?, env? }), isLoading, error, data }
-  useFeatureStatus(statusInput, composableOptions?)
-    → { data: Ref<FeatureStatus|null>, isLoading, error, refetch }
-  useFeatureSubscription(subscribeOptions, composableOptions?)
-    → { data: Ref<FeatureStatusEvent[]|null>, isSubscribed, error, unsubscribe, resubscribe }
-    subscribeOptions: { feature, executionId, product?, env? }
-  useFeatureSignal(composableOptions?)  → { mutate, isLoading, error }
-  useFeatureCancel(composableOptions?)  → { mutate, isLoading, error }
-
-AGENT COMPOSABLES
-  useAgentRun(composableOptions?)
-    → { mutate({ tag, input?, sessionId? }), isLoading, error, data }
-  useAgentStream(tag, input?, composableOptions?)
-    → { events, content, isStreaming, isComplete, error, start, stop, reset }
-    content: Ref<string> accumulated from stream text events
-  useAgentStatus(statusInput, composableOptions?) → { data, isLoading, error, refetch }
-  useAgentSignal(composableOptions?)              → { mutate, isLoading, error }
-
-BROKER COMPOSABLES
-  useBroker(broker, options?)
-    → { isConnected, isConnecting, error, connect, disconnect }
-  useBrokerPublish(composableOptions?)
-    → { mutate({ topic, message, headers?, key? }), isLoading, error, data }
-  useBrokerSubscription(subscribeOptions, composableOptions?)
-    → { data: Ref<BrokerMessage[]|null>, isSubscribed, error, unsubscribe, resubscribe }
-    subscribeOptions: { topic, group? }
-
-GRAPH COMPOSABLES
-  useGraph(graphTag)  → { isConnected, isConnecting, error, connect, disconnect }
-  useCreateNode / useUpdateNode / useDeleteNode / useQueryNodes
-  useCreateRelationship / useDeleteRelationship / useQueryRelationships
-  useTraverse / useShortestPath
-  useGraphSubscription(subscribeOptions, composableOptions?)
-    → { data, isSubscribed, error, unsubscribe, resubscribe }
-
-VECTOR COMPOSABLES
-  useVector(vectorTag) → { isConnected, isConnecting, error, connect, disconnect }
-  useVectorQuery / useVectorSearch / useVectorUpsert / useVectorDelete
-  useVectorFetch / useVectorStats / useVectorNamespaces
-
-STORAGE COMPOSABLES
-  useUpload(composableOptions?)
-    → { upload({ storage, fileName, buffer, mimeType? }), isLoading, progress: Ref<number>, error, data }
-  useDownload / useStorageDelete / useListFiles / useSignedUrl
-
-SESSION COMPOSABLES
-  useSessionStart / useSessionVerify / useSessionRefresh
-  useSessionRevoke / useSessionRevokeAll / useSessionList
-  useSessionAutoRefresh(config) → { token: Ref<string|null>, isRefreshing: Ref<boolean> }
-
-CACHE COMPOSABLES
-  useCacheGet / useCacheSet / useCacheDelete / useCacheExists
-  useCacheGetMany / useCacheSetMany / useCacheDeleteMany
-
-RESILIENCE COMPOSABLES
-  useHealthStatus / useHealthSubscription
-  useQuotaRun / useQuotaCheck / useQuotaStatus / useQuotaSubscription
-  useFallbackRun
-
-WAREHOUSE COMPOSABLES
-  useWarehouseQuery / useWarehouseSelect / useWarehouseInsert
-  useWarehouseUpdate / useWarehouseDelete / useWarehouseUpsert / useWarehouseTransaction
-
-ACTIONS COMPOSABLES
-  useActions(app) → { isConnected, connect, disconnect }
-  useActionRun(composableOptions?) → { mutate, isLoading, error, data }
-
-ANALYTICS COMPOSABLE
-  useAnalytics() → { pageview, track, identify, visitorId, enableAutoCapture, flush }
-  The currently installed composable does NOT return clearSession or disableAutoCapture.
-  Use useDuctape().client.analytics.clearSession()/disableAutoCapture(), or verify a newer installed
-  package export before generating those composable calls. See ductape_docs({ topic: "frontend-analytics" }).
-
-composableOptions pattern (applies to all composables):
-  enabled?    boolean — false skips auto-fetch/subscribe
-  onSuccess?  (data) => void
-  onError?    (error: Error) => void
-  Subscriptions also accept: onData, onSubscribe, onUnsubscribe
-
-EXAMPLE
-  <!-- UsersList.vue -->
-  <script setup>
-  import { useDatabaseQuery } from '@ductape/vue';
-  const { data, isLoading, error } = useDatabaseQuery('users', { table: 'users', limit: 20 });
-  </script>
-  <template>
-    <div v-if="isLoading">Loading...</div>
-    <div v-else-if="error">{{ error.message }}</div>
-    <ul v-else>
-      <li v-for="user in data?.rows" :key="user.id">{{ user.name }}</li>
-    </ul>
-  </template>
-
-  <!-- FeatureTracker.vue -->
-  <script setup>
-  import { useFeatureSubscription } from '@ductape/vue';
-  const props = defineProps(['executionId']);
-  const { data: events, isSubscribed } = useFeatureSubscription(
-    { feature: 'onboard-user', executionId: props.executionId },
-  );
-  </script>
-  <template>
-    <p>{{ events?.[0]?.status ?? 'waiting' }}</p>
-  </template>
-
-DEPRECATED ALIASES
-  useWorkflowExecute → useFeatureExecute
-  useWorkflowStatus  → useFeatureStatus
-  useWorkflowSubscription → useFeatureSubscription
-  useWorkflowSignal  → useFeatureSignal
-  useWorkflowCancel  → useFeatureCancel
-`.trim(),
-};
-
-const docsHandler = async (args: { topic: string }) => {
-  const key = args.topic.toLowerCase().trim();
-  const doc = DOCS[key];
-  if (!doc) {
-    const available = Object.keys(DOCS).join(', ');
-    return {
-      content: [{ type: 'text' as const, text: `Unknown topic "${args.topic}". Available topics: ${available}` }],
-    };
-  }
-  return { content: [{ type: 'text' as const, text: doc }] };
-};
-
-const cliInputSchema = z.object({
-  command: z.string().describe(
-    'The ductape CLI command to run, without the leading "ductape" word. ' +
-    'Examples: "products list", "products create --name \\"My Product\\" --tag my-product", ' +
-    '"apps list", "apps create -f app.json", "resources storage list", ' +
-    '"events topics create -f topic.json", "events topics list --tag broker-tag", ' +
-    '"cloud connections list", "link --product my-product --env dev".\n\n' +
-    'Use this tool for administrative operations: creating or updating products, apps, ' +
-    'resources (databases, storage, caches…), event broker topics, cloud connections, secrets, ' +
-    'and for apply/migrate workflows.\n\n' +
-    'Note: environments, app actions, quotas, fallbacks, and jobs are configured in the ' +
-    'Workbench UI. Features also have no CLI creation command: define them in application code ' +
-    'with features.define so application boot/runtime registration makes them available.\n\n' +
-    'The CLI uses the user\'s local logged-in session (ductape login) — no key is required.',
-  ),
-});
-
-async function loadMcpSdk(): Promise<{
-  McpServer: new (info: { name: string; version: string }) => any;
-  StdioServerTransport: new () => any;
-}> {
-  try {
-    const [{ McpServer }, { StdioServerTransport }] = await Promise.all([
-      import('@modelcontextprotocol/sdk/server/mcp.js'),
-      import('@modelcontextprotocol/sdk/server/stdio.js'),
-    ]);
-    if (McpServer && StdioServerTransport) {
-      return { McpServer, StdioServerTransport };
-    }
-  } catch {
-    // fall through to v2 alpha package
-  }
-
-  try {
-    const sdk = await import('@modelcontextprotocol/server');
-    if (sdk.McpServer && sdk.StdioServerTransport) {
-      return { McpServer: sdk.McpServer, StdioServerTransport: sdk.StdioServerTransport };
-    }
-  } catch {
-    // fall through
-  }
-
-  console.error(
-    'Failed to load MCP SDK. Install: npm install @modelcontextprotocol/sdk zod\n' +
-      'Or v2 alpha: npm install @modelcontextprotocol/server zod @cfworker/json-schema',
-  );
-  process.exit(1);
-  throw new Error('MCP SDK not available');
-}
-
-function handleCliFlags(): boolean {
-  const arg = process.argv[2];
-  if (arg === '--version' || arg === '-v') {
-    const { version } = createRequire(import.meta.url)('../package.json') as { version: string };
-    process.stdout.write(version + '\n');
-    return true;
-  }
-  if (arg === '--help' || arg === '-h') {
-    process.stdout.write(
-      'ductape-mcp — Ductape MCP server\n\n' +
-      'Usage: ductape-mcp\n\n' +
-      'The server communicates over stdio and is meant to be spawned by an MCP\n' +
-      'client (Cursor, Claude Desktop, Claude Code). Run it directly only to\n' +
-      'verify the binary is working.\n\n' +
-      'Options:\n' +
-      '  --version, -v   Print version and exit\n' +
-      '  --help,    -h   Print this message and exit\n\n' +
-      'Environment:\n' +
-      '  DUCTAPE_PUBLISHABLE_KEY   Your workspace publishable key. Set this in\n' +
-      '                            the MCP client env config to avoid passing\n' +
-      '                            publishable_key on every tool call.\n',
-    );
-    return true;
-  }
-  return false;
-}
-
-async function main() {
-  const { McpServer, StdioServerTransport } = await loadMcpSdk();
-  const server = new McpServer({ name: 'ductape-mcp', version: '0.1.0' });
-  const transport = new StdioServerTransport();
-
-  const cliHandler = async (args: { command: string }) => {
-    const cli = checkCli();
-    if (!cli.available) {
-      return {
-        content: [{
-          type: 'text',
-          text: [
-            'The Ductape CLI is not installed or not in PATH.',
-            '',
-            'Install it with:',
-            '  npm install --global @ductape/cli',
-            '',
-            'Then log in:',
-            '  ductape login',
-            '',
-            'After logging in, retry this operation.',
-          ].join('\n'),
-        }],
-        isError: true,
-      };
-    }
-
-    const firstWord = args.command.trim().split(/\s+/)[0];
-    const isAuthCommand = firstWord === 'login' || firstWord === 'logout';
-
-    if (!isAuthCommand) {
-      // Cache successful authentication, but re-check a missing/expired session on every call.
-      // The user may complete `ductape login` in another terminal while this MCP process remains
-      // alive; caching "none" would otherwise make the MCP blind to the newly written session.
-      if (authState === 'unknown' || authState === 'none') {
-        checkLoginState();
-      }
-      if (authState === 'none') {
-        const wsFlag = process.env.DUCTAPE_WORKSPACE ? ` --workspace "${process.env.DUCTAPE_WORKSPACE}"` : '';
-        return {
-          content: [{
-            type: 'text',
-            text: [
-              'The Ductape CLI has no remotely valid authenticated session.',
-              '',
-              'Administrative reads and writes must remain on ductape_cli; do not fall back to ductape_execute.',
-              '',
-              'Ask the user to re-authenticate in a trusted local terminal:',
-              `  ductape login${wsFlag}`,
-              'or:',
-              `  ductape login --browser google${wsFlag}`,
-              `  ductape login --browser github${wsFlag}`,
-              '',
-              'Never ask the user to paste their password, OAuth callback token, or stored CLI credential into the agent.',
-              'After login succeeds, retry the original ductape_cli command.',
-            ].join('\n'),
-          }],
-          isError: true,
-        };
-      }
-      // Sync to the configured workspace once per process (best-effort)
-      if (!workspaceSynced) {
-        syncWorkspace();
-      }
-    }
-
-    const result = runCli(args.command);
-
-    // Update cached state after auth commands
-    if (firstWord === 'login' && result.success) {
-      authState = 'ok';
-      workspaceSynced = false; // re-sync workspace after fresh login
-    }
-    if (firstWord === 'logout' && result.success) {
-      authState = 'none';
-      workspaceSynced = false;
-    }
-
-    return {
-      content: [{ type: 'text', text: result.output || '(no output)' }],
-      ...(result.success ? {} : { isError: true }),
-    };
-  };
-
-  const executeHandler = async (args: { publishable_key?: string; module: SDKModule; method: string; params: unknown[] }) => {
-    try {
-      const runtimeMutationMethods: Partial<Record<SDKModule, Set<string>>> = {
-        databases: new Set(['insert', 'update', 'delete', 'upsert']),
-        graph: new Set(['insert', 'update', 'delete']),
-        vector: new Set(['insert', 'upsert', 'upsertOne', 'delete']),
-        sessions: new Set(['revoke']),
-      };
-      const isRuntimeDataMutation = runtimeMutationMethods[args.module]?.has(args.method) === true;
-      const isAdministrativeMutation =
-        (/^migration\./.test(args.method) ||
-          /^schema\.(create|drop|add|remove|update)/.test(args.method) ||
-          /(^|\.)(create|update|delete|configure|add|remove|revoke)$/.test(args.method)) &&
-        !isRuntimeDataMutation;
-      if (isAdministrativeMutation) {
-        throw new Error(
-          `Administrative operation "${args.module}.${args.method}" is blocked in ductape_execute. ` +
-          'Use ductape_cli when that resource is supported by the CLI; otherwise configure it in Workbench. ' +
-          'The runtime proxy uses a publishable key and cannot administer platform assets.',
-        );
-      }
-      const key = args.publishable_key || process.env.DUCTAPE_PUBLISHABLE_KEY;
-      if (!key) {
-        throw new Error(
-          'Runtime authentication is missing. Set DUCTAPE_PUBLISHABLE_KEY in the MCP server environment ' +
-          'or pass publishable_key to ductape_execute. The MCP server never accepts access keys.',
-        );
-      }
-      // The TS SDK uses ductape.events.* for broker operations; the backend proxy uses messageBrokers.
-      const proxyModule: SDKModule = args.module === 'events' ? 'messageBrokers' : args.module;
-
-      // Normalize events.dispatch params: event must be fully-qualified "broker:topic".
-      // If an agent passes both broker and event="broker:topic", strip broker and de-duplicate.
-      let params = args.params;
-      if ((args.module === 'events' || args.module === 'messageBrokers') && args.method === 'dispatch') {
-        params = params.map((p) => {
-          if (p && typeof p === 'object' && !Array.isArray(p)) {
-            const obj = p as Record<string, unknown>;
-            const broker = typeof obj['broker'] === 'string' ? obj['broker'] : '';
-            const event = typeof obj['event'] === 'string' ? obj['event'] : '';
-            if (broker && event) {
-              // Strip broker prefix if event is already "broker:..." to avoid "broker:broker:topic"
-              const normalized = event.startsWith(broker + ':') ? event : `${broker}:${event}`;
-              const { broker: _removed, ...rest } = obj;
-              return { ...rest, event: normalized };
-            }
-          }
-          return p;
-        });
-      }
-
-      let result: unknown;
-      try {
-        result = await executeViaProxy(key, proxyModule, args.method, params);
-      } catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        if (/authentication failed|unauthorized|invalid.*key/i.test(message)) {
-          throw new Error(
-            'The DUCTAPE_PUBLISHABLE_KEY was rejected by the runtime proxy. ' +
-            'Use a publishable key for the same workspace/product. The MCP server never accepts or forwards access keys.',
-          );
-        }
-        throw error;
-      }
-      return { content: [{ type: 'text', text: JSON.stringify(result ?? null, null, 2) }] };
-    } catch (err) {
-      let message = err instanceof Error ? err.message : String(err);
-      const isAuthFailed = /authentication failed/i.test(message);
-      const isDbWrite = args.module === 'databases' && /^(insert|update|delete|upsert)$/.test(args.method);
-      if (isAuthFailed && isDbWrite) {
-        message += '\n\nThe publishable key does not have write access for this database operation. ' +
-          'Enable it in Workbench → Tokens → Publishable Key. ' +
-          'If write access cannot be granted to the publishable key, perform this operation server-side using a full Ductape SDK instance initialized with an access key.';
-      }
-      return { content: [{ type: 'text', text: `Error: ${message}` }], isError: true };
-    }
-  };
-
-  const payloadGenerateHandler = async (
-    args: z.infer<typeof payloadGenerateInputSchema>,
-  ) => {
-    try {
-      const key = args.publishable_key || process.env.DUCTAPE_PUBLISHABLE_KEY;
-      if (!key) {
-        throw new Error('Not authenticated. Set DUCTAPE_PUBLISHABLE_KEY in your MCP server env config, or pass publishable_key on every tool call.');
-      }
-      const includeSession = args.include_session ?? args.execution_context !== 'system';
-      const result = addSessionAwarenessMetadata(
-        await generateExecutablePayload({ ...args, include_session: includeSession, publishable_key: key }),
-        args,
-      );
-
-      let text = JSON.stringify(result ?? null, null, 2);
-
-      if (args.operation_family === 'database') {
-        const meta = (result as any)?.meta ?? {};
-        const fields = meta.schema_context?.database?.fields ?? {};
-        const warnings: string[] = Array.isArray(meta.schema_warnings) ? meta.schema_warnings : [];
-        const noSchema = Object.keys(fields).length === 0 || warnings.some((w: string) => w.includes('No table schema'));
-        if (noSchema) {
-          const dbTag = (args.targets as any)?.database_tag ?? '<database_tag>';
-          const envSlug = (args as any).env_slug ?? '<env_slug>';
-          text += `\n\n--- SCHEMA NOT FOUND ---\nNo table schema is available for database "${dbTag}" in environment "${envSlug}".\nTell the user:\n  Run: ductape db schema push --db ${dbTag} --env ${envSlug}\n  This reads the live schema from the database and syncs it to the Ductape server so the AI can provide accurate field guidance.\n  Once complete, retry the operation.\n------------------------`;
-        }
-      }
-
-      return { content: [{ type: 'text', text }] };
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      return { content: [{ type: 'text', text: `Error: ${message}` }], isError: true };
-    }
-  };
-
-  const snippetGenerateHandler = async (
-    args: z.infer<typeof snippetGenerateInputSchema>,
-  ) => {
-    try {
-      const key = args.publishable_key || process.env.DUCTAPE_PUBLISHABLE_KEY;
-      if (!key) {
-        throw new Error('Not authenticated. Set DUCTAPE_PUBLISHABLE_KEY in your MCP server env config, or pass publishable_key on every tool call.');
-      }
-      ensureSupportedSnippetOperation(args.operation_family, args.method);
-      const includeSession = args.include_session ?? args.execution_context !== 'system';
-      const generated = addSessionAwarenessMetadata(
-        await generateExecutablePayload({ ...args, include_session: includeSession, publishable_key: key }),
-        args,
-      );
-      const payload = (generated as any)?.payload ?? {};
-      const snippet = buildSnippet(args.language, payload, args.operation_family, args.method);
-      return {
-        content: [
-          {
-            type: 'text',
-            text: JSON.stringify(
-              {
-                payload: generated,
-                snippet,
-              },
-              null,
-              2,
-            ),
-          },
-        ],
-      };
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      return { content: [{ type: 'text', text: `Error: ${message}` }], isError: true };
-    }
-  };
-
-  const schemaHandler = async (args: { module?: 'app' | 'product' }) => {
-    try {
-      const data = await getAssetSchemas(args.module);
-      return { content: [{ type: 'text', text: JSON.stringify(data ?? null, null, 2) }] };
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      return { content: [{ type: 'text', text: `Error: ${message}` }], isError: true };
-    }
-  };
-
-  if (typeof server.registerTool === 'function') {
-    server.registerTool(
-      'ductape_execute',
-      {
-        title: 'Ductape SDK Execute',
-        description:
-          'Execute a Ductape SDK RUNTIME operation via the backend proxy (publishable key).\n\n' +
-          'ONLY use this tool for runtime operations: run, dispatch, execute, start, send, produce, query, insert, update, delete.\n' +
-          'Do NOT use this for creating or updating any asset (product, app, action, environment, database, storage, etc.) — ' +
-          'those require an access key. Use ductape_cli for all creation and update operations.\n\n' +
-          'Two-step rule for runtime operations:\n' +
-          '  1. Call ductape_generate_payload first to get the canonical payload template.\n' +
-          '     This reveals the exact "input" field keys — they are product/env/operation-specific.\n' +
-          '  2. Fill in the values from the template, then call ductape_execute.',
-        inputSchema: executeInputSchema,
-      },
-      executeHandler,
-    );
-    server.registerTool(
-      'ductape_generate_payload',
-      {
-        title: 'Ductape Payload Generator',
-        description:
-          'Generate the canonical input payload template for a runtime SDK operation.\n\n' +
-          'CALL THIS BEFORE ductape_execute when you need to run, dispatch, execute, start, send, produce, ' +
-          'or otherwise trigger any Ductape operation that takes an "input" field.\n\n' +
-          'The "input" field shape is defined by how each action/feature/session/quota/etc. was configured ' +
-          'in the product — it cannot be inferred from the SDK schema alone. This tool returns the exact ' +
-          'field names, types, and placeholder values for that specific operation in that specific environment.\n\n' +
-          'Returns: { payload: { product, env, input: { fieldName: placeholder, ... }, session?, cache? }, meta: { ... } }',
-        inputSchema: payloadGenerateInputSchema,
-      },
-      payloadGenerateHandler,
-    );
-    server.registerTool(
-      'ductape_generate_snippet',
-      {
-        title: 'Ductape Snippet Generator',
-        description: 'Generate canonical payload and ready TypeScript/Python snippet for engineers',
-        inputSchema: snippetGenerateInputSchema,
-      },
-      snippetGenerateHandler,
-    );
-    server.registerTool(
-      'ductape_schema',
-      {
-        title: 'Ductape Asset Schema',
-        description:
-          'Returns the full field manifest for Ductape asset creation/update methods, ' +
-          'derived live from the SDK Joi validators. Includes field types, required flags, ' +
-          'enum values, nested structures, and all enum constants. ' +
-          'Pass module="app" or module="product" to scope the result.\n\n' +
-          'ALWAYS call this before constructing a file for "resources <type> create" or any cloud ' +
-          'import/provision operation — field shapes are not guessable from context.\n\n' +
-          'Conditional fields: some fields are returned as oneOf (an array of variant shapes). ' +
-          'For example, storage.create envs[].config is oneOf [awsConfig, gcpConfig, azureConfig] — ' +
-          'pick the variant whose fields match the envs[].type value (aws/gcp/azure). ' +
-          'Fields inside oneOf variants are context-dependent and should all be treated as optional ' +
-          'unless the chosen variant explicitly marks them required.',
-        inputSchema: schemaInputSchema,
-      },
-      schemaHandler,
-    );
-    server.registerTool(
-      'ductape_docs',
-      {
-        title: 'Ductape Feature Docs',
-        description:
-          'Look up detailed documentation for a specific Ductape SDK feature.\n\n' +
-          'Call this when you need guidance on how a feature works before using it — ' +
-          'especially for features that require configuration decisions (tier, isolation level, ' +
-          'index strategy, operation types) that should be confirmed with the user first.\n\n' +
-          'Available topics: transactions, presave, triggers, aggregations, migrations, indexes, performance, actions, ' +
-          'graphs, storage, cloud, vector, warehouse, secrets, apps, products, sessions, caches, ' +
-          'notifications, resilience, features, events, logs, frontend, frontend-analytics, client, react, vue',
-        inputSchema: docsInputSchema,
-      },
-      docsHandler,
-    );
-    server.registerTool(
-      'ductape_cli',
-      {
-        title: 'Ductape CLI',
-        description:
-          'Run a Ductape CLI command for administrative operations.\n\n' +
-          'USE THIS TOOL for any operation that creates or modifies platform configuration:\n' +
-          '  - Creating or updating products (products create/update) and apps (apps create/update)\n' +
-          '  - Importing an app from a Postman v2.1 or OpenAPI 3.0 file: "apps import <file> -t postman|openapi"\n' +
-          '  - Managing resources via "resources <type> <verb>" (databases, storage, caches…)\n' +
-          '    ALWAYS call ductape_schema(module="product") first to get the exact field shape before\n' +
-          '    constructing a file. Storage envs[].config is conditional on envs[].type (aws/gcp/azure)\n' +
-          '    and returned as oneOf — pick the variant matching the type.\n' +
-          '    REQUIRED: before building any resource file, run\n' +
-          '      ductape_cli("products environments list <product_tag> --json")\n' +
-          '    and include an envs entry for EVERY environment returned. Omitting any env causes a\n' +
-          '    validation error. If the user has not supplied connection details for every env, ask\n' +
-          '    them explicitly. Confirm per-env before reusing the same resource across environments.\n' +
-          '  - Three distinct storage registration flows — choose the right one:\n' +
-          '    1. Manual credentials (bucket already exists, you supply keys directly):\n' +
-          '         resources storage create -f storage.json\n' +
-          '       File shape: { name, tag, envs: [{ slug, type: "aws"|"gcp"|"azure", config: { bucketName, ...creds } }] }\n' +
-          '       For cloud-linked envs set config.cloud to the connection tag and omit raw credentials.\n' +
-          '    2. Import existing cloud buckets via cloud connections (no provisioning):\n' +
-          '         cloud resources import-persist-all -f import-all.json --json\n' +
-          '       File is a JSON ARRAY — one entry per env, all with the same product and component tag.\n' +
-          '       Each entry: cloud (connection tag), service (e.g. "gcs","s3"), type ("storage"),\n' +
-          '       product, component (new tag), env, resource (bucket name/identifier).\n' +
-          '       Example (two envs): [{"cloud":"gcp-snd","service":"gcs","type":"storage",\n' +
-          '       "product":"my-product","component":"assets","env":"snd","resource":"snd-bucket"},\n' +
-          '       {"cloud":"gcp-prd","service":"gcs","type":"storage","product":"my-product",\n' +
-          '       "component":"assets","env":"prd","resource":"prd-bucket"}].\n' +
-          '       All envs are imported in parallel, drafts merged, then the asset is created once.\n' +
-          '       Use import-persist (single-env form) only when the product has exactly one environment.\n' +
-          '       If import-persist-all fails, the error reports all create/update failures — do not retry blindly.\n' +
-          '    3. Provision brand-new buckets AND register them (see provision-persist-all docs below).\n' +
-          '  - Managing cloud connections and cloud-linked resources\n' +
-          '  - Discovering cloud tiers: "cloud tiers --provider <provider> --type <database|storage> [--db-type <type>] --json"\n' +
-          '    IMPORTANT: `cloud tiers` has no `list` verb. Use only a tier returned for the selected provider/type.\n' +
-          '  - Provisioning and persisting cloud resources:\n' +
-          '    For a product with multiple environments always use provision-persist-all (not provision-persist):\n' +
-          '      cloud resources provision-persist-all -f file.json --json\n' +
-          '    File is a JSON ARRAY — one entry per env, all with the same product and component tag.\n' +
-          '    Each entry requires: cloud (connection tag), service (provider service), type (Ductape component type),\n' +
-          '    product (product tag), component (new component tag), env (existing environment slug).\n' +
-          '    Provider parameters such as region, location, bucketName, dbName, tier, and waitForReady\n' +
-          '    may be supplied per entry in the file.\n' +
-          '    Example (two envs): [{"cloud":"gcp-snd","service":"gcs","type":"storage",\n' +
-          '    "product":"product-tag","component":"assets","env":"snd","location":"us-central1"},\n' +
-          '    {"cloud":"gcp-prd","service":"gcs","type":"storage","product":"product-tag",\n' +
-          '    "component":"assets","env":"prd","location":"us-central1"}].\n' +
-          '    Use provision-persist (single-env) only when the product has exactly one environment.\n' +
-          '    Use provision alone when you only need the provider resource without registering an asset.\n' +
-          '    Tier discovery does not by itself prove that a connection supports provisioning that service:\n' +
-          '    if provisioning reports an unsupported provider/service pair, stop and report it.\n' +
-          '    Never infer an environment, provider service, region, tier, or cost. List/verify each before provisioning.\n' +
-          '  - Known provisioning limitations: MongoDB Atlas (M0 free tier) and Neo4j Aura cannot be provisioned via\n' +
-          '    Ductape — they are import-only. Only AWS, GCP, and Azure managed services support provision-persist.\n' +
-          '    Supported service/component pairs include: rds→database, aurora→database, gcs→storage, s3→storage,\n' +
-          '    azure-blob→storage, cloud-sql→database, neptune→graph, opensearch→vector. Attempting an unsupported pair\n' +
-          '    will return an error; do not retry with a different tier — report the limitation to the user.\n' +
-          '  - Atlas (MongoDB Atlas) import flow — service identifier is "atlas-cluster" (required, not optional):\n' +
-          '    IMPORTANT: dbName is mandatory for every MongoDB env — see "MONGODB CLOUD CONNECTION RULE" in the\n' +
-          '    databases module above. The SDK enforces this at create time; omitting it throws a validation error.\n' +
-          '    Step 1 — discover the cluster name:\n' +
-          '      ductape_cli("cloud resources list -f /tmp/atlas-list.json --json")\n' +
-          '      File: {"cloud": "<atlas-connection-tag>", "service": "atlas-cluster"}\n' +
-          '      Returns a list of clusters; note the "name" field (this is your resource identifier).\n' +
-          '    Step 2 — check if the database component already exists:\n' +
-          '      ductape_cli("resources databases list <product_tag> --json")\n' +
-          '      If a component already uses the same Atlas cluster, do NOT re-import — instead update it:\n' +
-          '        use ductape_cli resource update when supported; otherwise update it in Workbench\n' +
-          '      Add or change the dbName in the env\'s connection_url to switch databases on the same cluster.\n' +
-          '    Step 3 — import (only if no existing component uses this cluster):\n' +
-          '      Use import-persist-all with one entry per product env. Required fields per entry:\n' +
-          '        cloud (connection tag), service: "atlas-cluster", type: "databases",\n' +
-          '        product, component (new tag), env, resource (cluster name from Step 1),\n' +
-          '        dbName (the MongoDB database name to connect to — required for Atlas).\n' +
-          '      Example: [{"cloud":"atlas-tag","service":"atlas-cluster","type":"databases",\n' +
-          '        "product":"my-product","component":"core-db","env":"snd","resource":"Cluster0","dbName":"myapp_snd"},\n' +
-          '        {"cloud":"atlas-tag","service":"atlas-cluster","type":"databases",\n' +
-          '        "product":"my-product","component":"core-db","env":"prd","resource":"Cluster0","dbName":"myapp_prd"}]\n' +
-          '  - Message broker / event broker import:\n' +
-          '    CLI accepts these aliases for the messageBrokers module: events, event, broker, brokers, message-brokers.\n' +
-          '    List existing brokers: ductape_cli("resources events list --json")\n' +
-          '    GCP Pub/Sub service identifier is "pubsub". AWS SQS is "sqs". Azure Service Bus is "servicebus".\n' +
-          '    Message brokers are import-only (no provision-persist). Import flow is the same as storage.\n' +
-          '    type field = "messageBrokers" (not "messagebrokers" or "events").\n' +
-          '    After importing, create topics first with ductape_cli("events topics create -f topic.json") — SQS requires explicit topic creation with queueUrls. For other providers, topics auto-register on first produce but should still be created explicitly before any consumer subscribes.\n' +
-          '  - Listing workspaces, products, focused product components, secrets\n' +
-          '    Prefer "products components list --tag <tag> --json" for compact inventory; use\n' +
-          '    "products components get --tag <tag> --type notifications|events --json" for focused detail.\n' +
-          '  - Managing notification components and message templates through "resources notifications" and "notifications messages"\n' +
-          '  - Linking a project folder: "link --product <tag> --env <slug>"\n' +
-          '  - Syncing sessions/notifications/events: "apply" or "apply sessions" etc.\n' +
-          '  - Running database migrations: "db migrate", "db schema generate"\n\n' +
-          'NOTE: Environments, app actions, auths, quotas, fallbacks, and jobs are configured ' +
-          'in the Workbench UI. Features have no CLI creation command because definitions are ' +
-          'code-first through features.define and registered by the application runtime.\n\n' +
-          'DO NOT use ductape_execute for admin operations — it uses a publishable key which only ' +
-          'covers runtime operations. Administrative operations will fail with "Authentication failed".\n\n' +
-          'The CLI uses the user\'s local logged-in session (ductape login). ' +
-          'If the CLI is not installed, this tool will return install instructions automatically.',
-        inputSchema: cliInputSchema,
-      },
-      cliHandler,
-    );
-  } else if (typeof server.tool === 'function') {
-    server.tool('ductape_execute', executeInputSchema.shape, executeHandler);
-    server.tool('ductape_generate_payload', payloadGenerateInputSchema.shape, payloadGenerateHandler);
-    server.tool('ductape_generate_snippet', snippetGenerateInputSchema.shape, snippetGenerateHandler);
-    server.tool('ductape_schema', schemaInputSchema.shape, schemaHandler);
-    server.tool('ductape_docs', docsInputSchema.shape, docsHandler);
-    server.tool('ductape_cli', cliInputSchema.shape, cliHandler);
-  } else {
-    console.error('MCP server does not expose .registerTool() or .tool()');
-    process.exit(1);
-  }
-
-  await server.connect(transport);
-}
-
-if (!handleCliFlags()) {
-  main().catch((err) => {
-    console.error(err);
-    process.exit(1);
-  });
-}