@lumibase/mcp-server 0.12.0 → 0.14.0

package/dist/index.cjs

@@ -110,10 +110,10 @@ function configFromEnv() {
 }
 
 // src/tools/access.ts
-var import_zod2 = require("zod");
+var import_zod3 = require("zod");
 
 // src/tools/_crud.ts
-var import_zod = require("zod");
+var import_zod2 = require("zod");
 
 // src/tools/_shared.ts
 function formatError(err) {
@@ -155,6 +155,20 @@ async function run(fn) {
 }
 var confirmDescription = "Must be true to confirm the destructive operation";
 
+// src/tools/path.ts
+var import_zod = require("zod");
+var namePattern = /^[a-z][a-z0-9_]{0,62}$/;
+var collectionNameSchema = import_zod.z.string().min(1).max(63).regex(namePattern, "Must be lowercase, start with a letter, only a-z0-9_");
+var fieldNameSchema = import_zod.z.string().min(1).max(63).regex(namePattern, "Must be lowercase snake_case, start with a letter");
+var idPathSegmentSchema = import_zod.z.string().min(1).refine((value) => value !== "." && value !== "..", "Must not be . or ..").refine((value) => !/[\\/]/.test(value), "Must not contain path separators");
+function encodePathSegment(segment) {
+  return encodeURIComponent(segment);
+}
+var mediaKeySchema = import_zod.z.string().min(1).refine((value) => !value.includes(".."), 'Must not contain ".."').refine((value) => !value.startsWith("/"), 'Must not start with "/"').refine((value) => !value.includes("\\"), "Must not contain backslashes");
+function encodeMediaKey(key) {
+  return key.split("/").map((segment) => encodeURIComponent(segment)).join("/");
+}
+
 // src/tools/_crud.ts
 function registerCrud(server, client, opts) {
   const {
@@ -185,9 +199,9 @@ function registerCrud(server, client, opts) {
       `get_${namePrefix}`,
       {
         description: `Get a single ${resource} by ${idParam}.`,
-        inputSchema: { [idParam]: import_zod.z.string().min(1) }
+        inputSchema: { [idParam]: idPathSegmentSchema }
       },
-      async (args) => run(() => client.get(`${basePath}/${String(args[idParam])}`))
+      async (args) => run(() => client.get(`${basePath}/${encodePathSegment(String(args[idParam]))}`))
     );
   }
   if (createSchema) {
@@ -205,11 +219,11 @@ function registerCrud(server, client, opts) {
       `update_${namePrefix}`,
       {
         description: `Update an existing ${resource} (partial PATCH).`,
-        inputSchema: { [idParam]: import_zod.z.string().min(1), ...updateSchema }
+        inputSchema: { [idParam]: idPathSegmentSchema, ...updateSchema }
       },
       async (args) => {
         const { [idParam]: id, ...patch } = args;
-        return run(() => client.patch(`${basePath}/${String(id)}`, patch));
+        return run(() => client.patch(`${basePath}/${encodePathSegment(String(id))}`, patch));
       }
     );
   }
@@ -219,14 +233,14 @@ function registerCrud(server, client, opts) {
       {
         description: `Delete a ${resource}. DESTRUCTIVE \u2014 warn the user first and pass confirm=true.`,
         inputSchema: {
-          [idParam]: import_zod.z.string().min(1),
-          confirm: import_zod.z.literal(true).describe(confirmDescription)
+          [idParam]: idPathSegmentSchema,
+          confirm: import_zod2.z.literal(true).describe(confirmDescription)
         }
       },
       async (args) => {
         const id = String(args[idParam]);
         return run(async () => {
-          await client.delete(`${basePath}/${id}`);
+          await client.delete(`${basePath}/${encodePathSegment(id)}`);
           return okText(`${resource} "${id}" deleted.`);
         });
       }
@@ -235,37 +249,37 @@ function registerCrud(server, client, opts) {
 }
 
 // src/tools/access.ts
-var roleSchema = import_zod2.z.object({
-  key: import_zod2.z.string().min(1).max(96).optional(),
-  systemKey: import_zod2.z.string().min(1).max(96).optional(),
-  name: import_zod2.z.string().min(1).max(64),
-  description: import_zod2.z.string().max(512).optional(),
-  icon: import_zod2.z.string().max(64).optional(),
-  parentId: import_zod2.z.string().nullable().optional(),
-  adminAccess: import_zod2.z.boolean().optional(),
-  appAccess: import_zod2.z.boolean().optional()
+var roleSchema = import_zod3.z.object({
+  key: import_zod3.z.string().min(1).max(96).optional(),
+  systemKey: import_zod3.z.string().min(1).max(96).optional(),
+  name: import_zod3.z.string().min(1).max(64),
+  description: import_zod3.z.string().max(512).optional(),
+  icon: import_zod3.z.string().max(64).optional(),
+  parentId: import_zod3.z.string().nullable().optional(),
+  adminAccess: import_zod3.z.boolean().optional(),
+  appAccess: import_zod3.z.boolean().optional()
 });
-var policySchema = import_zod2.z.object({
-  key: import_zod2.z.string().min(1).max(96).optional(),
-  name: import_zod2.z.string().min(1).max(64),
-  icon: import_zod2.z.string().max(64).optional(),
-  description: import_zod2.z.string().max(512).optional(),
-  adminAccess: import_zod2.z.boolean().optional(),
-  appAccess: import_zod2.z.boolean().optional(),
-  enforceTfa: import_zod2.z.boolean().optional(),
-  ipAllow: import_zod2.z.array(import_zod2.z.string()).optional(),
-  ipDeny: import_zod2.z.array(import_zod2.z.string()).optional(),
-  validFrom: import_zod2.z.string().datetime().nullable().optional(),
-  validUntil: import_zod2.z.string().datetime().nullable().optional(),
-  rules: import_zod2.z.record(import_zod2.z.unknown()).optional()
+var policySchema = import_zod3.z.object({
+  key: import_zod3.z.string().min(1).max(96).optional(),
+  name: import_zod3.z.string().min(1).max(64),
+  icon: import_zod3.z.string().max(64).optional(),
+  description: import_zod3.z.string().max(512).optional(),
+  adminAccess: import_zod3.z.boolean().optional(),
+  appAccess: import_zod3.z.boolean().optional(),
+  enforceTfa: import_zod3.z.boolean().optional(),
+  ipAllow: import_zod3.z.array(import_zod3.z.string()).optional(),
+  ipDeny: import_zod3.z.array(import_zod3.z.string()).optional(),
+  validFrom: import_zod3.z.string().datetime().nullable().optional(),
+  validUntil: import_zod3.z.string().datetime().nullable().optional(),
+  rules: import_zod3.z.record(import_zod3.z.unknown()).optional()
 });
-var permissionSchema = import_zod2.z.object({
-  collection: import_zod2.z.string().min(1).max(64),
-  action: import_zod2.z.enum(["create", "read", "update", "delete", "share"]),
-  permissions: import_zod2.z.record(import_zod2.z.unknown()).optional(),
-  validation: import_zod2.z.record(import_zod2.z.unknown()).optional(),
-  presets: import_zod2.z.record(import_zod2.z.unknown()).optional(),
-  fields: import_zod2.z.array(import_zod2.z.string()).optional()
+var permissionSchema = import_zod3.z.object({
+  collection: import_zod3.z.string().min(1).max(64),
+  action: import_zod3.z.enum(["create", "read", "update", "delete", "share"]),
+  permissions: import_zod3.z.record(import_zod3.z.unknown()).optional(),
+  validation: import_zod3.z.record(import_zod3.z.unknown()).optional(),
+  presets: import_zod3.z.record(import_zod3.z.unknown()).optional(),
+  fields: import_zod3.z.array(import_zod3.z.string()).optional()
 });
 function registerAccessTools(server, client) {
   registerCrud(server, client, {
@@ -280,26 +294,26 @@ function registerAccessTools(server, client) {
     {
       description: "Attach a policy to a role. Conflicts/warnings may require overrideWarnings=true.",
       inputSchema: {
-        id: import_zod2.z.string().min(1).describe("Role id."),
-        policyId: import_zod2.z.string().min(1),
-        priority: import_zod2.z.number().int().optional(),
-        overrideWarnings: import_zod2.z.boolean().optional()
+        id: idPathSegmentSchema.describe("Role id."),
+        policyId: idPathSegmentSchema,
+        priority: import_zod3.z.number().int().optional(),
+        overrideWarnings: import_zod3.z.boolean().optional()
       }
     },
-    async ({ id, ...body }) => run(() => client.post(`/roles/${id}/policies`, body))
+    async ({ id, ...body }) => run(() => client.post(`/roles/${encodePathSegment(id)}/policies`, body))
   );
   server.registerTool(
     "detach_role_policy",
     {
       description: "Detach a policy from a role. DESTRUCTIVE \u2014 pass confirm=true.",
       inputSchema: {
-        id: import_zod2.z.string().min(1).describe("Role id."),
-        policyId: import_zod2.z.string().min(1),
-        confirm: import_zod2.z.literal(true).describe(confirmDescription)
+        id: idPathSegmentSchema.describe("Role id."),
+        policyId: idPathSegmentSchema,
+        confirm: import_zod3.z.literal(true).describe(confirmDescription)
       }
     },
     async ({ id, policyId }) => run(async () => {
-      await client.delete(`/roles/${id}/policies/${policyId}`);
+      await client.delete(`/roles/${encodePathSegment(id)}/policies/${encodePathSegment(policyId)}`);
       return okText(`Policy "${policyId}" detached from role "${id}".`);
     })
   );
@@ -307,22 +321,22 @@ function registerAccessTools(server, client) {
     "assign_role_user",
     {
       description: "Assign a role to a user (sets the user's primary role for this site).",
-      inputSchema: { id: import_zod2.z.string().min(1).describe("Role id."), userId: import_zod2.z.string().min(1) }
+      inputSchema: { id: idPathSegmentSchema.describe("Role id."), userId: idPathSegmentSchema }
     },
-    async ({ id, userId }) => run(() => client.post(`/roles/${id}/users`, { userId }))
+    async ({ id, userId }) => run(() => client.post(`/roles/${encodePathSegment(id)}/users`, { userId }))
   );
   server.registerTool(
     "remove_role_user",
     {
       description: "Remove a user's role assignment. DESTRUCTIVE \u2014 pass confirm=true.",
       inputSchema: {
-        id: import_zod2.z.string().min(1).describe("Role id."),
-        userId: import_zod2.z.string().min(1),
-        confirm: import_zod2.z.literal(true).describe(confirmDescription)
+        id: idPathSegmentSchema.describe("Role id."),
+        userId: idPathSegmentSchema,
+        confirm: import_zod3.z.literal(true).describe(confirmDescription)
       }
     },
     async ({ id, userId }) => run(async () => {
-      await client.delete(`/roles/${id}/users/${userId}`);
+      await client.delete(`/roles/${encodePathSegment(id)}/users/${encodePathSegment(userId)}`);
       return okText(`User "${userId}" removed from role "${id}".`);
     })
   );
@@ -338,34 +352,34 @@ function registerAccessTools(server, client) {
     "add_policy_permission",
     {
       description: "Add a permission row (collection + action) to a policy.",
-      inputSchema: { id: import_zod2.z.string().min(1).describe("Policy id."), ...permissionSchema.shape }
+      inputSchema: { id: idPathSegmentSchema.describe("Policy id."), ...permissionSchema.shape }
     },
-    async ({ id, ...body }) => run(() => client.post(`/policies/${id}/permissions`, body))
+    async ({ id, ...body }) => run(() => client.post(`/policies/${encodePathSegment(id)}/permissions`, body))
   );
   server.registerTool(
     "update_policy_permission",
     {
       description: "Update a permission row on a policy (partial PATCH).",
       inputSchema: {
-        id: import_zod2.z.string().min(1).describe("Policy id."),
-        permId: import_zod2.z.string().min(1).describe("Permission row id."),
+        id: idPathSegmentSchema.describe("Policy id."),
+        permId: idPathSegmentSchema.describe("Permission row id."),
         ...permissionSchema.partial().shape
       }
     },
-    async ({ id, permId, ...body }) => run(() => client.patch(`/policies/${id}/permissions/${permId}`, body))
+    async ({ id, permId, ...body }) => run(() => client.patch(`/policies/${encodePathSegment(id)}/permissions/${encodePathSegment(permId)}`, body))
   );
   server.registerTool(
     "delete_policy_permission",
     {
       description: "Delete a permission row from a policy. DESTRUCTIVE \u2014 pass confirm=true.",
       inputSchema: {
-        id: import_zod2.z.string().min(1).describe("Policy id."),
-        permId: import_zod2.z.string().min(1).describe("Permission row id."),
-        confirm: import_zod2.z.literal(true).describe(confirmDescription)
+        id: idPathSegmentSchema.describe("Policy id."),
+        permId: idPathSegmentSchema.describe("Permission row id."),
+        confirm: import_zod3.z.literal(true).describe(confirmDescription)
       }
     },
     async ({ id, permId }) => run(async () => {
-      await client.delete(`/policies/${id}/permissions/${permId}`);
+      await client.delete(`/policies/${encodePathSegment(id)}/permissions/${encodePathSegment(permId)}`);
       return okText(`Permission "${permId}" deleted from policy "${id}".`);
     })
   );
@@ -374,26 +388,26 @@ function registerAccessTools(server, client) {
     {
       description: "Attach a policy directly to a user. Warnings may require overrideWarnings=true.",
       inputSchema: {
-        id: import_zod2.z.string().min(1).describe("Policy id."),
-        userId: import_zod2.z.string().min(1),
-        priority: import_zod2.z.number().int().optional(),
-        overrideWarnings: import_zod2.z.boolean().optional()
+        id: idPathSegmentSchema.describe("Policy id."),
+        userId: idPathSegmentSchema,
+        priority: import_zod3.z.number().int().optional(),
+        overrideWarnings: import_zod3.z.boolean().optional()
       }
     },
-    async ({ id, ...body }) => run(() => client.post(`/policies/${id}/users`, body))
+    async ({ id, ...body }) => run(() => client.post(`/policies/${encodePathSegment(id)}/users`, body))
   );
   server.registerTool(
     "detach_policy_user",
     {
       description: "Detach a policy from a user. DESTRUCTIVE \u2014 pass confirm=true.",
       inputSchema: {
-        id: import_zod2.z.string().min(1).describe("Policy id."),
-        userId: import_zod2.z.string().min(1),
-        confirm: import_zod2.z.literal(true).describe(confirmDescription)
+        id: idPathSegmentSchema.describe("Policy id."),
+        userId: idPathSegmentSchema,
+        confirm: import_zod3.z.literal(true).describe(confirmDescription)
       }
     },
     async ({ id, userId }) => run(async () => {
-      await client.delete(`/policies/${id}/users/${userId}`);
+      await client.delete(`/policies/${encodePathSegment(id)}/users/${encodePathSegment(userId)}`);
       return okText(`Policy "${id}" detached from user "${userId}".`);
     })
   );
@@ -406,7 +420,7 @@ function registerAccessTools(server, client) {
     "dry_run_access_import",
     {
       description: "Validate an RBAC manifest import without applying it. Returns the planned changes.",
-      inputSchema: { manifest: import_zod2.z.record(import_zod2.z.unknown()).describe("RBAC manifest from export_access.") }
+      inputSchema: { manifest: import_zod3.z.record(import_zod3.z.unknown()).describe("RBAC manifest from export_access.") }
     },
     async ({ manifest }) => run(() => client.post("/access/import?dryRun=true", manifest))
   );
@@ -415,9 +429,9 @@ function registerAccessTools(server, client) {
     {
       description: "Apply an RBAC manifest import. High-impact \u2014 changes roles/policies/permissions. Pass confirm=true.",
       inputSchema: {
-        manifest: import_zod2.z.record(import_zod2.z.unknown()).describe("RBAC manifest from export_access."),
-        mode: import_zod2.z.enum(["merge", "replace-managed", "replace-all"]).optional().describe("Import mode (default merge)."),
-        confirm: import_zod2.z.literal(true).describe(confirmDescription)
+        manifest: import_zod3.z.record(import_zod3.z.unknown()).describe("RBAC manifest from export_access."),
+        mode: import_zod3.z.enum(["merge", "replace-managed", "replace-all"]).optional().describe("Import mode (default merge)."),
+        confirm: import_zod3.z.literal(true).describe(confirmDescription)
       }
     },
     async ({ manifest, mode }) => run(() => client.post(`/access/import${mode ? `?mode=${mode}` : ""}`, manifest))
@@ -427,9 +441,9 @@ function registerAccessTools(server, client) {
     {
       description: "Check for permission conflicts before attaching/detaching policies on a target.",
       inputSchema: {
-        target: import_zod2.z.object({ type: import_zod2.z.enum(["role", "user", "api_key"]), id: import_zod2.z.string().min(1) }).describe("The role/user/api_key the policies would apply to."),
-        addPolicies: import_zod2.z.array(import_zod2.z.string()).optional(),
-        removePolicies: import_zod2.z.array(import_zod2.z.string()).optional()
+        target: import_zod3.z.object({ type: import_zod3.z.enum(["role", "user", "api_key"]), id: import_zod3.z.string().min(1) }).describe("The role/user/api_key the policies would apply to."),
+        addPolicies: import_zod3.z.array(import_zod3.z.string()).optional(),
+        removePolicies: import_zod3.z.array(import_zod3.z.string()).optional()
       }
     },
     async (input) => run(() => client.post("/access/conflicts/check", input))
@@ -437,14 +451,14 @@ function registerAccessTools(server, client) {
 }
 
 // src/tools/admin.ts
-var import_zod3 = require("zod");
-var materializeSchema = import_zod3.z.object({
-  collection: import_zod3.z.string().min(1).describe("Source collection name."),
-  target: import_zod3.z.string().regex(/^[a-z][a-z0-9_]{0,62}$/).describe("Physical table name (snake_case)."),
-  refreshStrategy: import_zod3.z.enum(["auto", "cron", "manual"]).optional(),
-  refreshCron: import_zod3.z.string().optional(),
-  projection: import_zod3.z.object({ fields: import_zod3.z.array(import_zod3.z.string()).optional(), orderBy: import_zod3.z.string().optional() }).optional(),
-  filter: import_zod3.z.record(import_zod3.z.unknown()).optional()
+var import_zod4 = require("zod");
+var materializeSchema = import_zod4.z.object({
+  collection: import_zod4.z.string().min(1).describe("Source collection name."),
+  target: import_zod4.z.string().regex(/^[a-z][a-z0-9_]{0,62}$/).describe("Physical table name (snake_case)."),
+  refreshStrategy: import_zod4.z.enum(["auto", "cron", "manual"]).optional(),
+  refreshCron: import_zod4.z.string().optional(),
+  projection: import_zod4.z.object({ fields: import_zod4.z.array(import_zod4.z.string()).optional(), orderBy: import_zod4.z.string().optional() }).optional(),
+  filter: import_zod4.z.record(import_zod4.z.unknown()).optional()
 });
 function registerAdminTools(server, client) {
   server.registerTool(
@@ -460,8 +474,8 @@ function registerAdminTools(server, client) {
     {
       description: "Restore a site configuration from an NDJSON bundle (as produced by export_backup). Existing rows are skipped (idempotent). DESTRUCTIVE / high-impact \u2014 pass confirm=true.",
       inputSchema: {
-        ndjson: import_zod3.z.string().min(1).describe("Raw NDJSON backup content, one JSON object per line."),
-        confirm: import_zod3.z.literal(true).describe(confirmDescription)
+        ndjson: import_zod4.z.string().min(1).describe("Raw NDJSON backup content, one JSON object per line."),
+        confirm: import_zod4.z.literal(true).describe(confirmDescription)
       }
     },
     async ({ ndjson }) => run(() => client.postRaw("/admin/restore", ndjson))
@@ -483,58 +497,58 @@ function registerAdminTools(server, client) {
     "refresh_materialization",
     {
       description: "Refresh a materialized collection (truncate + re-insert from source).",
-      inputSchema: { id: import_zod3.z.string().min(1) }
+      inputSchema: { id: idPathSegmentSchema }
     },
-    async ({ id }) => run(() => client.post(`/materialize/${id}/refresh`, {}))
+    async ({ id }) => run(() => client.post(`/materialize/${encodePathSegment(id)}/refresh`, {}))
   );
   server.registerTool(
     "query_materialization",
     {
       description: "Query the physical table of a materialized collection directly.",
-      inputSchema: { id: import_zod3.z.string().min(1) }
+      inputSchema: { id: idPathSegmentSchema }
     },
-    async ({ id }) => run(() => client.get(`/materialize/${id}/data`))
+    async ({ id }) => run(() => client.get(`/materialize/${encodePathSegment(id)}/data`))
   );
   server.registerTool(
     "drop_materialization",
     {
       description: "Drop a materialized collection (physical table + metadata). DESTRUCTIVE \u2014 pass confirm=true.",
-      inputSchema: { id: import_zod3.z.string().min(1), confirm: import_zod3.z.literal(true).describe(confirmDescription) }
+      inputSchema: { id: idPathSegmentSchema, confirm: import_zod4.z.literal(true).describe(confirmDescription) }
     },
     async ({ id }) => run(async () => {
-      await client.delete(`/materialize/${id}`);
+      await client.delete(`/materialize/${encodePathSegment(id)}`);
       return okText(`Materialization "${id}" dropped.`);
     })
   );
 }
 
 // src/tools/agent.ts
-var import_zod4 = require("zod");
-var intentSchema = import_zod4.z.object({
-  name: import_zod4.z.string().min(1).max(120),
-  collection: import_zod4.z.string().min(1).max(120),
-  rules: import_zod4.z.array(import_zod4.z.record(import_zod4.z.unknown())).describe("SLO rules (required_fields, freshness, translations, link_health, \u2026)."),
-  schedule: import_zod4.z.string().describe("5-field cron expression for reconciliation cadence."),
-  budget: import_zod4.z.record(import_zod4.z.unknown()).optional(),
-  autonomyCap: import_zod4.z.number().int().min(0).max(4).optional().describe("Max autonomy level L0\u2013L4 for this intent."),
-  maintenanceWindow: import_zod4.z.record(import_zod4.z.unknown()).nullable().optional()
+var import_zod5 = require("zod");
+var intentSchema = import_zod5.z.object({
+  name: import_zod5.z.string().min(1).max(120),
+  collection: import_zod5.z.string().min(1).max(120),
+  rules: import_zod5.z.array(import_zod5.z.record(import_zod5.z.unknown())).describe("SLO rules (required_fields, freshness, translations, link_health, \u2026)."),
+  schedule: import_zod5.z.string().describe("5-field cron expression for reconciliation cadence."),
+  budget: import_zod5.z.record(import_zod5.z.unknown()).optional(),
+  autonomyCap: import_zod5.z.number().int().min(0).max(4).optional().describe("Max autonomy level L0\u2013L4 for this intent."),
+  maintenanceWindow: import_zod5.z.record(import_zod5.z.unknown()).nullable().optional()
 });
-var flowNode = import_zod4.z.object({
-  id: import_zod4.z.string(),
-  key: import_zod4.z.string(),
-  options: import_zod4.z.record(import_zod4.z.unknown()).optional(),
-  next: import_zod4.z.string().nullable().optional(),
-  onError: import_zod4.z.string().nullable().optional()
+var flowNode = import_zod5.z.object({
+  id: import_zod5.z.string(),
+  key: import_zod5.z.string(),
+  options: import_zod5.z.record(import_zod5.z.unknown()).optional(),
+  next: import_zod5.z.string().nullable().optional(),
+  onError: import_zod5.z.string().nullable().optional()
 });
-var flowSchema = import_zod4.z.object({
-  name: import_zod4.z.string().min(1),
-  description: import_zod4.z.string().optional(),
-  status: import_zod4.z.enum(["active", "inactive", "draft"]).optional(),
-  triggerType: import_zod4.z.enum(["webhook", "event", "schedule", "manual"]),
-  triggerOptions: import_zod4.z.record(import_zod4.z.unknown()).optional(),
-  graph: import_zod4.z.object({
-    entry: import_zod4.z.string().optional(),
-    nodes: import_zod4.z.array(flowNode).optional()
+var flowSchema = import_zod5.z.object({
+  name: import_zod5.z.string().min(1),
+  description: import_zod5.z.string().optional(),
+  status: import_zod5.z.enum(["active", "inactive", "draft"]).optional(),
+  triggerType: import_zod5.z.enum(["webhook", "event", "schedule", "manual"]),
+  triggerOptions: import_zod5.z.record(import_zod5.z.unknown()).optional(),
+  graph: import_zod5.z.object({
+    entry: import_zod5.z.string().optional(),
+    nodes: import_zod5.z.array(flowNode).optional()
   })
 });
 function registerAgentTools(server, client) {
@@ -547,31 +561,31 @@ function registerAgentTools(server, client) {
   });
   server.registerTool(
     "pause_intent",
-    { description: "Pause an intent (stops scheduled reconciliation).", inputSchema: { id: import_zod4.z.string().min(1) } },
-    async ({ id }) => run(() => client.post(`/agent/intents/${id}/pause`, {}))
+    { description: "Pause an intent (stops scheduled reconciliation).", inputSchema: { id: idPathSegmentSchema } },
+    async ({ id }) => run(() => client.post(`/agent/intents/${encodePathSegment(id)}/pause`, {}))
   );
   server.registerTool(
     "resume_intent",
-    { description: "Resume a paused intent.", inputSchema: { id: import_zod4.z.string().min(1) } },
-    async ({ id }) => run(() => client.post(`/agent/intents/${id}/resume`, {}))
+    { description: "Resume a paused intent.", inputSchema: { id: idPathSegmentSchema } },
+    async ({ id }) => run(() => client.post(`/agent/intents/${encodePathSegment(id)}/resume`, {}))
   );
   server.registerTool(
     "list_intent_drifts",
-    { description: "List detected drifts (intent violations) for an intent.", inputSchema: { id: import_zod4.z.string().min(1) } },
-    async ({ id }) => run(() => client.get(`/agent/intents/${id}/drifts`))
+    { description: "List detected drifts (intent violations) for an intent.", inputSchema: { id: idPathSegmentSchema } },
+    async ({ id }) => run(() => client.get(`/agent/intents/${encodePathSegment(id)}/drifts`))
   );
   server.registerTool(
     "scan_intent",
-    { description: "Trigger an on-demand drift scan for an intent.", inputSchema: { id: import_zod4.z.string().min(1) } },
-    async ({ id }) => run(() => client.post(`/agent/intents/${id}/scan`, {}))
+    { description: "Trigger an on-demand drift scan for an intent.", inputSchema: { id: idPathSegmentSchema } },
+    async ({ id }) => run(() => client.post(`/agent/intents/${encodePathSegment(id)}/scan`, {}))
   );
   server.registerTool(
     "compile_intent",
     {
       description: "Compile a natural-language description into structured intent rules (preview, does not persist).",
       inputSchema: {
-        description: import_zod4.z.string().min(1).max(4e3),
-        collection: import_zod4.z.string().min(1).max(120)
+        description: import_zod5.z.string().min(1).max(4e3),
+        collection: import_zod5.z.string().min(1).max(120)
       }
     },
     async (input) => run(() => client.post("/agent/intents/compile", input))
@@ -588,21 +602,21 @@ function registerAgentTools(server, client) {
     {
       description: "Trigger a manual run of a flow with an optional input payload.",
       inputSchema: {
-        id: import_zod4.z.string().min(1),
-        input: import_zod4.z.record(import_zod4.z.unknown()).optional().describe("Initial context passed to the flow.")
+        id: idPathSegmentSchema,
+        input: import_zod5.z.record(import_zod5.z.unknown()).optional().describe("Initial context passed to the flow.")
       }
     },
-    async ({ id, input }) => run(() => client.post(`/flows/${id}/run`, input ?? {}))
+    async ({ id, input }) => run(() => client.post(`/flows/${encodePathSegment(id)}/run`, input ?? {}))
   );
   server.registerTool(
     "list_flow_runs",
-    { description: "List recent runs of a flow.", inputSchema: { id: import_zod4.z.string().min(1) } },
-    async ({ id }) => run(() => client.get(`/flows/${id}/runs`))
+    { description: "List recent runs of a flow.", inputSchema: { id: idPathSegmentSchema } },
+    async ({ id }) => run(() => client.get(`/flows/${encodePathSegment(id)}/runs`))
   );
 }
 
 // src/tools/api-keys.ts
-var import_zod5 = require("zod");
+var import_zod6 = require("zod");
 function registerApiKeyTools(server, client) {
   server.registerTool(
     "list_api_keys",
@@ -611,18 +625,18 @@ function registerApiKeyTools(server, client) {
   );
   server.registerTool(
     "get_api_key",
-    { description: "Get a single API key by id.", inputSchema: { id: import_zod5.z.string().min(1) } },
-    async ({ id }) => run(() => client.get(`/api-keys/${id}`))
+    { description: "Get a single API key by id.", inputSchema: { id: idPathSegmentSchema } },
+    async ({ id }) => run(() => client.get(`/api-keys/${encodePathSegment(id)}`))
   );
   server.registerTool(
     "create_api_key",
     {
       description: "Create a new API key. The plaintext token is returned ONCE in the response \u2014 surface it to the user and tell them it cannot be retrieved again.",
       inputSchema: {
-        name: import_zod5.z.string().min(1).max(96),
-        description: import_zod5.z.string().max(512).optional(),
-        expiresAt: import_zod5.z.string().datetime().nullable().optional(),
-        metadata: import_zod5.z.record(import_zod5.z.unknown()).optional()
+        name: import_zod6.z.string().min(1).max(96),
+        description: import_zod6.z.string().max(512).optional(),
+        expiresAt: import_zod6.z.string().datetime().nullable().optional(),
+        metadata: import_zod6.z.record(import_zod6.z.unknown()).optional()
       }
     },
     async (input) => run(() => client.post("/api-keys", input))
@@ -632,46 +646,46 @@ function registerApiKeyTools(server, client) {
     {
       description: "Rotate an API key \u2014 issues a new token (returned once) and invalidates the old one. DESTRUCTIVE for existing integrations \u2014 pass confirm=true.",
       inputSchema: {
-        id: import_zod5.z.string().min(1),
-        expiresAt: import_zod5.z.string().datetime().nullable().optional(),
-        confirm: import_zod5.z.literal(true).describe(confirmDescription)
+        id: idPathSegmentSchema,
+        expiresAt: import_zod6.z.string().datetime().nullable().optional(),
+        confirm: import_zod6.z.literal(true).describe(confirmDescription)
       }
     },
-    async ({ id, expiresAt }) => run(() => client.post(`/api-keys/${id}/rotate`, expiresAt !== void 0 ? { expiresAt } : {}))
+    async ({ id, expiresAt }) => run(() => client.post(`/api-keys/${encodePathSegment(id)}/rotate`, expiresAt !== void 0 ? { expiresAt } : {}))
   );
   server.registerTool(
     "revoke_api_key",
     {
       description: "Revoke an API key permanently. DESTRUCTIVE \u2014 pass confirm=true.",
-      inputSchema: { id: import_zod5.z.string().min(1), confirm: import_zod5.z.literal(true).describe(confirmDescription) }
+      inputSchema: { id: idPathSegmentSchema, confirm: import_zod6.z.literal(true).describe(confirmDescription) }
     },
-    async ({ id }) => run(() => client.post(`/api-keys/${id}/revoke`, {}))
+    async ({ id }) => run(() => client.post(`/api-keys/${encodePathSegment(id)}/revoke`, {}))
   );
   server.registerTool(
     "attach_api_key_role",
     {
       description: "Attach a role to an API key (grants the role\u2019s policies to the key).",
       inputSchema: {
-        id: import_zod5.z.string().min(1).describe("API key id."),
-        roleId: import_zod5.z.string().min(1),
-        priority: import_zod5.z.number().int().optional(),
-        overrideWarnings: import_zod5.z.boolean().optional()
+        id: idPathSegmentSchema.describe("API key id."),
+        roleId: idPathSegmentSchema,
+        priority: import_zod6.z.number().int().optional(),
+        overrideWarnings: import_zod6.z.boolean().optional()
       }
     },
-    async ({ id, ...body }) => run(() => client.post(`/api-keys/${id}/roles`, body))
+    async ({ id, ...body }) => run(() => client.post(`/api-keys/${encodePathSegment(id)}/roles`, body))
   );
   server.registerTool(
     "detach_api_key_role",
     {
       description: "Detach a role from an API key. DESTRUCTIVE \u2014 pass confirm=true.",
       inputSchema: {
-        id: import_zod5.z.string().min(1).describe("API key id."),
-        roleId: import_zod5.z.string().min(1),
-        confirm: import_zod5.z.literal(true).describe(confirmDescription)
+        id: idPathSegmentSchema.describe("API key id."),
+        roleId: idPathSegmentSchema,
+        confirm: import_zod6.z.literal(true).describe(confirmDescription)
       }
     },
     async ({ id, roleId }) => run(async () => {
-      await client.delete(`/api-keys/${id}/roles/${roleId}`);
+      await client.delete(`/api-keys/${encodePathSegment(id)}/roles/${encodePathSegment(roleId)}`);
       return okText(`Role "${roleId}" detached from API key "${id}".`);
     })
   );
@@ -680,73 +694,72 @@ function registerApiKeyTools(server, client) {
     {
       description: "Attach a policy directly to an API key.",
       inputSchema: {
-        id: import_zod5.z.string().min(1).describe("API key id."),
-        policyId: import_zod5.z.string().min(1),
-        priority: import_zod5.z.number().int().optional(),
-        overrideWarnings: import_zod5.z.boolean().optional()
+        id: idPathSegmentSchema.describe("API key id."),
+        policyId: idPathSegmentSchema,
+        priority: import_zod6.z.number().int().optional(),
+        overrideWarnings: import_zod6.z.boolean().optional()
       }
     },
-    async ({ id, ...body }) => run(() => client.post(`/api-keys/${id}/policies`, body))
+    async ({ id, ...body }) => run(() => client.post(`/api-keys/${encodePathSegment(id)}/policies`, body))
   );
   server.registerTool(
     "detach_api_key_policy",
     {
       description: "Detach a policy from an API key. DESTRUCTIVE \u2014 pass confirm=true.",
       inputSchema: {
-        id: import_zod5.z.string().min(1).describe("API key id."),
-        policyId: import_zod5.z.string().min(1),
-        confirm: import_zod5.z.literal(true).describe(confirmDescription)
+        id: idPathSegmentSchema.describe("API key id."),
+        policyId: idPathSegmentSchema,
+        confirm: import_zod6.z.literal(true).describe(confirmDescription)
       }
     },
     async ({ id, policyId }) => run(async () => {
-      await client.delete(`/api-keys/${id}/policies/${policyId}`);
+      await client.delete(`/api-keys/${encodePathSegment(id)}/policies/${encodePathSegment(policyId)}`);
       return okText(`Policy "${policyId}" detached from API key "${id}".`);
     })
   );
 }
 
 // src/tools/collections.ts
-var import_zod6 = require("zod");
-var collectionNameSchema = import_zod6.z.string().min(1).max(63).regex(/^[a-z][a-z0-9_]{0,62}$/, "Must be lowercase, start with a letter, only a-z0-9_");
-var collectionInputSchema = import_zod6.z.object({
+var import_zod7 = require("zod");
+var collectionInputSchema = import_zod7.z.object({
   name: collectionNameSchema,
-  label: import_zod6.z.string().optional(),
-  pluralLabel: import_zod6.z.string().optional(),
-  hidden: import_zod6.z.boolean().optional(),
-  singleton: import_zod6.z.boolean().optional(),
-  icon: import_zod6.z.string().optional(),
-  color: import_zod6.z.string().optional(),
-  note: import_zod6.z.string().optional(),
-  primaryKeyField: import_zod6.z.string().optional(),
-  primaryKeyType: import_zod6.z.enum(["nanoid", "uuid", "integer", "bigInteger", "string"]).optional(),
-  storageMode: import_zod6.z.enum(["jsonb", "materialized", "physical", "external"]).optional(),
-  displayTemplate: import_zod6.z.string().optional(),
-  sortField: import_zod6.z.string().optional(),
-  archiveField: import_zod6.z.string().optional(),
-  archiveValue: import_zod6.z.string().optional(),
-  unarchiveValue: import_zod6.z.string().optional(),
-  accountability: import_zod6.z.enum(["all", "activity", "none"]).optional(),
-  versioning: import_zod6.z.boolean().optional()
+  label: import_zod7.z.string().optional(),
+  pluralLabel: import_zod7.z.string().optional(),
+  hidden: import_zod7.z.boolean().optional(),
+  singleton: import_zod7.z.boolean().optional(),
+  icon: import_zod7.z.string().optional(),
+  color: import_zod7.z.string().optional(),
+  note: import_zod7.z.string().optional(),
+  primaryKeyField: import_zod7.z.string().optional(),
+  primaryKeyType: import_zod7.z.enum(["nanoid", "uuid", "integer", "bigInteger", "string"]).optional(),
+  storageMode: import_zod7.z.enum(["jsonb", "materialized", "physical", "external"]).optional(),
+  displayTemplate: import_zod7.z.string().optional(),
+  sortField: import_zod7.z.string().optional(),
+  archiveField: import_zod7.z.string().optional(),
+  archiveValue: import_zod7.z.string().optional(),
+  unarchiveValue: import_zod7.z.string().optional(),
+  accountability: import_zod7.z.enum(["all", "activity", "none"]).optional(),
+  versioning: import_zod7.z.boolean().optional()
 });
-var fieldInputSchema = import_zod6.z.object({
-  name: collectionNameSchema,
-  type: import_zod6.z.string().min(1),
-  interface: import_zod6.z.string().min(1),
-  display: import_zod6.z.string().optional(),
-  label: import_zod6.z.string().optional(),
-  note: import_zod6.z.string().optional(),
-  nullable: import_zod6.z.boolean().optional(),
-  unique: import_zod6.z.boolean().optional(),
-  indexed: import_zod6.z.boolean().optional(),
-  searchable: import_zod6.z.boolean().optional(),
-  required: import_zod6.z.boolean().optional(),
-  readonly: import_zod6.z.boolean().optional(),
-  hidden: import_zod6.z.boolean().optional(),
-  width: import_zod6.z.enum(["half", "full", "fill"]).optional(),
-  sortOrder: import_zod6.z.number().int().optional(),
-  group: import_zod6.z.string().optional(),
-  options: import_zod6.z.record(import_zod6.z.unknown()).optional(),
-  defaultValue: import_zod6.z.unknown().optional()
+var fieldInputSchema = import_zod7.z.object({
+  name: fieldNameSchema,
+  type: import_zod7.z.string().min(1),
+  interface: import_zod7.z.string().min(1),
+  display: import_zod7.z.string().optional(),
+  label: import_zod7.z.string().optional(),
+  note: import_zod7.z.string().optional(),
+  nullable: import_zod7.z.boolean().optional(),
+  unique: import_zod7.z.boolean().optional(),
+  indexed: import_zod7.z.boolean().optional(),
+  searchable: import_zod7.z.boolean().optional(),
+  required: import_zod7.z.boolean().optional(),
+  readonly: import_zod7.z.boolean().optional(),
+  hidden: import_zod7.z.boolean().optional(),
+  width: import_zod7.z.enum(["half", "full", "fill"]).optional(),
+  sortOrder: import_zod7.z.number().int().optional(),
+  group: import_zod7.z.string().optional(),
+  options: import_zod7.z.record(import_zod7.z.unknown()).optional(),
+  defaultValue: import_zod7.z.unknown().optional()
 });
 function formatError2(err) {
   if (err instanceof LumiBaseApiError) {
@@ -774,11 +787,11 @@ function registerCollectionTools(server, client) {
     "get_collection",
     {
       description: "Get a collection with its compiled schema (all fields, system fields, meta).",
-      inputSchema: { name: import_zod6.z.string().min(1) }
+      inputSchema: { name: collectionNameSchema }
     },
     async ({ name }) => {
       try {
-        const data = await client.get(`/collections/${name}/compiled`);
+        const data = await client.get(`/collections/${encodePathSegment(name)}/compiled`);
         return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
       } catch (err) {
         return { content: [{ type: "text", text: `Error: ${formatError2(err)}` }], isError: true };
@@ -805,13 +818,13 @@ function registerCollectionTools(server, client) {
     {
       description: "Update metadata on an existing collection (label, icon, note, accountability, etc.).",
       inputSchema: {
-        name: import_zod6.z.string().min(1),
+        name: collectionNameSchema,
         patch: collectionInputSchema.omit({ name: true }).partial()
       }
     },
     async ({ name, patch }) => {
       try {
-        const data = await client.patch(`/collections/${name}`, patch);
+        const data = await client.patch(`/collections/${encodePathSegment(name)}`, patch);
         return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
       } catch (err) {
         return { content: [{ type: "text", text: `Error: ${formatError2(err)}` }], isError: true };
@@ -823,13 +836,13 @@ function registerCollectionTools(server, client) {
     {
       description: "Delete a collection and all its items. DESTRUCTIVE \u2014 cannot be undone. You MUST pass confirm=true explicitly after warning the user.",
       inputSchema: {
-        name: import_zod6.z.string().min(1),
-        confirm: import_zod6.z.literal(true).describe("Must be true to confirm destructive operation")
+        name: collectionNameSchema,
+        confirm: import_zod7.z.literal(true).describe("Must be true to confirm destructive operation")
       }
     },
     async ({ name, confirm: _ }) => {
       try {
-        await client.delete(`/collections/${name}`);
+        await client.delete(`/collections/${encodePathSegment(name)}`);
         return { content: [{ type: "text", text: `Collection "${name}" deleted.` }] };
       } catch (err) {
         return { content: [{ type: "text", text: `Error: ${formatError2(err)}` }], isError: true };
@@ -841,10 +854,10 @@ function registerCollectionTools(server, client) {
     {
       description: "Preview what would change if you applied a schema update. Returns added/modified/removed fields and any risky changes. Always call this before apply_schema to check for breaking changes.",
       inputSchema: {
-        name: import_zod6.z.string().min(1),
-        fields: import_zod6.z.array(fieldInputSchema).optional(),
-        label: import_zod6.z.string().optional(),
-        note: import_zod6.z.string().optional()
+        name: collectionNameSchema,
+        fields: import_zod7.z.array(fieldInputSchema).optional(),
+        label: import_zod7.z.string().optional(),
+        note: import_zod7.z.string().optional()
       }
     },
     async (input) => {
@@ -861,23 +874,26 @@ function registerCollectionTools(server, client) {
     {
       description: "Atomically apply a schema migration to a collection (add/update/remove fields and relations). Call diff_schema first to preview changes. Pass confirmRiskyChange=true on field inputs that have risky changes.",
       inputSchema: {
-        name: import_zod6.z.string().min(1),
-        fields: import_zod6.z.array(
+        name: collectionNameSchema,
+        fields: import_zod7.z.array(
           fieldInputSchema.extend({
-            renameFrom: import_zod6.z.string().optional(),
-            confirmRiskyChange: import_zod6.z.boolean().optional()
+            renameFrom: fieldNameSchema.optional(),
+            confirmRiskyChange: import_zod7.z.boolean().optional()
           })
         ).optional(),
-        label: import_zod6.z.string().optional(),
-        note: import_zod6.z.string().optional(),
-        accountability: import_zod6.z.enum(["all", "activity", "none"]).optional(),
-        versioning: import_zod6.z.boolean().optional()
+        label: import_zod7.z.string().optional(),
+        note: import_zod7.z.string().optional(),
+        accountability: import_zod7.z.enum(["all", "activity", "none"]).optional(),
+        versioning: import_zod7.z.boolean().optional()
       }
     },
     async (input) => {
       try {
         const { name, ...rest } = input;
-        const data = await client.put(`/collections/${name}/schema`, rest);
+        const data = await client.put(
+          `/collections/${encodePathSegment(name)}/schema`,
+          rest
+        );
         return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
       } catch (err) {
         return { content: [{ type: "text", text: `Error: ${formatError2(err)}` }], isError: true };
@@ -887,34 +903,34 @@ function registerCollectionTools(server, client) {
 }
 
 // src/tools/content-config.ts
-var import_zod7 = require("zod");
-var presetSchema = import_zod7.z.object({
-  bookmark: import_zod7.z.string().nullable().optional(),
-  collection: import_zod7.z.string(),
-  userId: import_zod7.z.string().nullable().optional(),
-  roleId: import_zod7.z.string().nullable().optional(),
-  layout: import_zod7.z.string().optional(),
-  layoutQuery: import_zod7.z.record(import_zod7.z.unknown()).optional(),
-  layoutOptions: import_zod7.z.record(import_zod7.z.unknown()).optional(),
-  search: import_zod7.z.string().nullable().optional(),
-  filter: import_zod7.z.record(import_zod7.z.unknown()).optional(),
-  icon: import_zod7.z.string().nullable().optional(),
-  color: import_zod7.z.string().nullable().optional(),
-  refreshInterval: import_zod7.z.number().int().min(0).optional()
+var import_zod8 = require("zod");
+var presetSchema = import_zod8.z.object({
+  bookmark: import_zod8.z.string().nullable().optional(),
+  collection: import_zod8.z.string(),
+  userId: import_zod8.z.string().nullable().optional(),
+  roleId: import_zod8.z.string().nullable().optional(),
+  layout: import_zod8.z.string().optional(),
+  layoutQuery: import_zod8.z.record(import_zod8.z.unknown()).optional(),
+  layoutOptions: import_zod8.z.record(import_zod8.z.unknown()).optional(),
+  search: import_zod8.z.string().nullable().optional(),
+  filter: import_zod8.z.record(import_zod8.z.unknown()).optional(),
+  icon: import_zod8.z.string().nullable().optional(),
+  color: import_zod8.z.string().nullable().optional(),
+  refreshInterval: import_zod8.z.number().int().min(0).optional()
 });
-var translationSchema = import_zod7.z.object({
-  language: import_zod7.z.string(),
-  namespace: import_zod7.z.string(),
-  key: import_zod7.z.string(),
-  value: import_zod7.z.string(),
-  status: import_zod7.z.string().optional()
+var translationSchema = import_zod8.z.object({
+  language: import_zod8.z.string(),
+  namespace: import_zod8.z.string(),
+  key: import_zod8.z.string(),
+  value: import_zod8.z.string(),
+  status: import_zod8.z.string().optional()
 });
 function registerContentConfigTools(server, client) {
   registerCrud(server, client, {
     basePath: "/presets",
     resource: "preset",
     namePrefix: "preset",
-    listQuery: { collection: import_zod7.z.string().optional() },
+    listQuery: { collection: import_zod8.z.string().optional() },
     createSchema: presetSchema.shape,
     updateSchema: presetSchema.partial().shape
   });
@@ -923,8 +939,8 @@ function registerContentConfigTools(server, client) {
     resource: "translation",
     namePrefix: "translation",
     listQuery: {
-      namespace: import_zod7.z.string().optional(),
-      language: import_zod7.z.string().optional()
+      namespace: import_zod8.z.string().optional(),
+      language: import_zod8.z.string().optional()
     },
     createSchema: translationSchema.shape,
     updateSchema: translationSchema.partial().shape
@@ -933,7 +949,7 @@ function registerContentConfigTools(server, client) {
     "list_settings",
     {
       description: "List site settings, optionally filtered by scope.",
-      inputSchema: { scope: import_zod7.z.string().optional() }
+      inputSchema: { scope: import_zod8.z.string().optional() }
     },
     async ({ scope }) => run(() => client.get(`/settings${scope ? `?scope=${encodeURIComponent(scope)}` : ""}`))
   );
@@ -941,18 +957,18 @@ function registerContentConfigTools(server, client) {
     "get_setting",
     {
       description: "Get a single setting by key.",
-      inputSchema: { key: import_zod7.z.string().min(1) }
+      inputSchema: { key: idPathSegmentSchema }
     },
-    async ({ key }) => run(() => client.get(`/settings/${encodeURIComponent(key)}`))
+    async ({ key }) => run(() => client.get(`/settings/${encodePathSegment(key)}`))
   );
   server.registerTool(
     "upsert_setting",
     {
       description: "Create or update a setting (upsert by key).",
       inputSchema: {
-        key: import_zod7.z.string().min(1),
-        value: import_zod7.z.record(import_zod7.z.unknown()).describe("Arbitrary JSON value object for the setting."),
-        scope: import_zod7.z.string().optional()
+        key: idPathSegmentSchema,
+        value: import_zod8.z.record(import_zod8.z.unknown()).describe("Arbitrary JSON value object for the setting."),
+        scope: import_zod8.z.string().optional()
       }
     },
     async (input) => run(() => client.post("/settings", input))
@@ -962,29 +978,29 @@ function registerContentConfigTools(server, client) {
     {
       description: "Delete a setting by key. DESTRUCTIVE \u2014 warn the user first and pass confirm=true.",
       inputSchema: {
-        key: import_zod7.z.string().min(1),
-        confirm: import_zod7.z.literal(true).describe(confirmDescription)
+        key: idPathSegmentSchema,
+        confirm: import_zod8.z.literal(true).describe(confirmDescription)
       }
     },
     async ({ key }) => run(async () => {
-      await client.delete(`/settings/${encodeURIComponent(key)}`);
+      await client.delete(`/settings/${encodePathSegment(key)}`);
       return okText(`Setting "${key}" deleted.`);
     })
   );
 }
 
 // src/tools/extensions.ts
-var import_zod8 = require("zod");
+var import_zod9 = require("zod");
 var EXTENSION_TYPES = ["interface", "display", "layout", "panel", "module", "hook", "endpoint"];
-var extensionSchema = import_zod8.z.object({
-  key: import_zod8.z.string().regex(/^[a-z0-9_:-]+$/).optional(),
-  name: import_zod8.z.string().min(1),
-  version: import_zod8.z.string().min(1),
-  type: import_zod8.z.enum(EXTENSION_TYPES),
-  enabled: import_zod8.z.boolean().optional(),
-  bundleUrl: import_zod8.z.string().min(1).describe("https:, http:, or data:text/javascript bundle URL."),
-  manifest: import_zod8.z.record(import_zod8.z.string()).optional(),
-  capabilities: import_zod8.z.array(import_zod8.z.string()).optional()
+var extensionSchema = import_zod9.z.object({
+  key: import_zod9.z.string().regex(/^[a-z0-9_:-]+$/).optional(),
+  name: import_zod9.z.string().min(1),
+  version: import_zod9.z.string().min(1),
+  type: import_zod9.z.enum(EXTENSION_TYPES),
+  enabled: import_zod9.z.boolean().optional(),
+  bundleUrl: import_zod9.z.string().min(1).describe("https:, http:, or data:text/javascript bundle URL."),
+  manifest: import_zod9.z.record(import_zod9.z.string()).optional(),
+  capabilities: import_zod9.z.array(import_zod9.z.string()).optional()
 });
 function registerExtensionTools(server, client) {
   server.registerTool(
@@ -1004,18 +1020,18 @@ function registerExtensionTools(server, client) {
     "update_extension",
     {
       description: "Update an installed extension (enable/disable, version, config). Partial PATCH.",
-      inputSchema: { id: import_zod8.z.string().min(1), ...extensionSchema.partial().shape }
+      inputSchema: { id: idPathSegmentSchema, ...extensionSchema.partial().shape }
     },
-    async ({ id, ...patch }) => run(() => client.patch(`/extensions/${id}`, patch))
+    async ({ id, ...patch }) => run(() => client.patch(`/extensions/${encodePathSegment(id)}`, patch))
   );
   server.registerTool(
     "uninstall_extension",
     {
       description: "Uninstall an extension from the site. DESTRUCTIVE \u2014 pass confirm=true.",
-      inputSchema: { id: import_zod8.z.string().min(1), confirm: import_zod8.z.literal(true).describe(confirmDescription) }
+      inputSchema: { id: idPathSegmentSchema, confirm: import_zod9.z.literal(true).describe(confirmDescription) }
     },
     async ({ id }) => run(async () => {
-      await client.delete(`/extensions/${id}`);
+      await client.delete(`/extensions/${encodePathSegment(id)}`);
       return okText(`Extension "${id}" uninstalled.`);
     })
   );
@@ -1024,12 +1040,12 @@ function registerExtensionTools(server, client) {
     {
       description: "Browse the published extension marketplace.",
       inputSchema: {
-        q: import_zod8.z.string().optional(),
-        category: import_zod8.z.string().optional(),
-        tags: import_zod8.z.string().optional().describe("Comma-separated tags."),
-        sort: import_zod8.z.string().optional(),
-        page: import_zod8.z.number().int().min(1).optional(),
-        perPage: import_zod8.z.number().int().min(1).optional()
+        q: import_zod9.z.string().optional(),
+        category: import_zod9.z.string().optional(),
+        tags: import_zod9.z.string().optional().describe("Comma-separated tags."),
+        sort: import_zod9.z.string().optional(),
+        page: import_zod9.z.number().int().min(1).optional(),
+        perPage: import_zod9.z.number().int().min(1).optional()
       }
     },
     async (args) => run(
@@ -1042,9 +1058,9 @@ function registerExtensionTools(server, client) {
     "get_marketplace_extension",
     {
       description: "Get a single marketplace extension by slug.",
-      inputSchema: { slug: import_zod8.z.string().min(1) }
+      inputSchema: { slug: idPathSegmentSchema }
     },
-    async ({ slug }) => run(() => client.get(`/marketplace/extensions/${slug}`))
+    async ({ slug }) => run(() => client.get(`/marketplace/extensions/${encodePathSegment(slug)}`))
   );
   server.registerTool(
     "list_marketplace_updates",
@@ -1055,22 +1071,22 @@ function registerExtensionTools(server, client) {
     "install_marketplace_extension",
     {
       description: "Install a published marketplace extension onto the active site by slug.",
-      inputSchema: { slug: import_zod8.z.string().min(1) }
+      inputSchema: { slug: idPathSegmentSchema }
     },
-    async ({ slug }) => run(() => client.post(`/marketplace/extensions/${slug}/install`, {}))
+    async ({ slug }) => run(() => client.post(`/marketplace/extensions/${encodePathSegment(slug)}/install`, {}))
   );
   server.registerTool(
     "publish_extension",
     {
       description: "Publish an extension to the marketplace (signs + marks it published).",
       inputSchema: {
-        extensionId: import_zod8.z.string().min(1),
-        marketplaceSlug: import_zod8.z.string().min(1),
-        publisher: import_zod8.z.record(import_zod8.z.unknown()).optional(),
-        signature: import_zod8.z.string().optional(),
-        signatureAlg: import_zod8.z.string().optional(),
-        publisherKeyId: import_zod8.z.string().optional(),
-        bundleSha256: import_zod8.z.string().optional()
+        extensionId: import_zod9.z.string().min(1),
+        marketplaceSlug: import_zod9.z.string().min(1),
+        publisher: import_zod9.z.record(import_zod9.z.unknown()).optional(),
+        signature: import_zod9.z.string().optional(),
+        signatureAlg: import_zod9.z.string().optional(),
+        publisherKeyId: import_zod9.z.string().optional(),
+        bundleSha256: import_zod9.z.string().optional()
       }
     },
     async (input) => run(() => client.post("/marketplace/publish", input))
@@ -1078,40 +1094,39 @@ function registerExtensionTools(server, client) {
 }
 
 // src/tools/fields.ts
-var import_zod9 = require("zod");
-var namePattern = /^[a-z][a-z0-9_]{0,62}$/;
-var fieldInputSchema2 = import_zod9.z.object({
-  type: import_zod9.z.string().min(1).describe(
+var import_zod10 = require("zod");
+var fieldInputSchema2 = import_zod10.z.object({
+  type: import_zod10.z.string().min(1).describe(
     "Storage type: string, text, integer, bigInteger, float, decimal, boolean, date, dateTime, time, json, uuid, csv, hash, alias"
   ),
-  interface: import_zod9.z.string().min(1).describe(
+  interface: import_zod10.z.string().min(1).describe(
     "UI widget: input, textarea, select, toggle, datetime, file, image, repeater, relation-m2o, relation-o2m, relation-m2m, code, markdown, wysiwyg, \u2026"
   ),
-  display: import_zod9.z.string().optional(),
-  label: import_zod9.z.string().optional(),
-  note: import_zod9.z.string().optional(),
-  defaultValue: import_zod9.z.unknown().optional(),
-  nullable: import_zod9.z.boolean().optional().default(true),
-  unique: import_zod9.z.boolean().optional().default(false),
-  indexed: import_zod9.z.boolean().optional().default(false),
-  searchable: import_zod9.z.boolean().optional().default(false),
-  length: import_zod9.z.number().int().positive().optional(),
-  precision: import_zod9.z.number().int().positive().optional(),
-  scale: import_zod9.z.number().int().min(0).optional(),
-  special: import_zod9.z.array(import_zod9.z.string()).optional(),
-  options: import_zod9.z.record(import_zod9.z.unknown()).optional(),
-  displayOptions: import_zod9.z.record(import_zod9.z.unknown()).optional(),
-  conditions: import_zod9.z.array(import_zod9.z.unknown()).optional(),
-  required: import_zod9.z.boolean().optional().default(false),
-  readonly: import_zod9.z.boolean().optional().default(false),
-  hidden: import_zod9.z.boolean().optional().default(false),
-  encrypted: import_zod9.z.boolean().optional().default(false),
-  versioned: import_zod9.z.boolean().optional().default(false),
-  width: import_zod9.z.enum(["half", "full", "fill"]).optional().default("full"),
-  group: import_zod9.z.string().optional(),
-  sortOrder: import_zod9.z.number().int().optional(),
-  renameFrom: import_zod9.z.string().regex(namePattern).optional().describe("Previous field name if this is a rename operation"),
-  confirmRiskyChange: import_zod9.z.boolean().optional().describe("Set true to confirm type-change or destructive migration")
+  display: import_zod10.z.string().optional(),
+  label: import_zod10.z.string().optional(),
+  note: import_zod10.z.string().optional(),
+  defaultValue: import_zod10.z.unknown().optional(),
+  nullable: import_zod10.z.boolean().optional().default(true),
+  unique: import_zod10.z.boolean().optional().default(false),
+  indexed: import_zod10.z.boolean().optional().default(false),
+  searchable: import_zod10.z.boolean().optional().default(false),
+  length: import_zod10.z.number().int().positive().optional(),
+  precision: import_zod10.z.number().int().positive().optional(),
+  scale: import_zod10.z.number().int().min(0).optional(),
+  special: import_zod10.z.array(import_zod10.z.string()).optional(),
+  options: import_zod10.z.record(import_zod10.z.unknown()).optional(),
+  displayOptions: import_zod10.z.record(import_zod10.z.unknown()).optional(),
+  conditions: import_zod10.z.array(import_zod10.z.unknown()).optional(),
+  required: import_zod10.z.boolean().optional().default(false),
+  readonly: import_zod10.z.boolean().optional().default(false),
+  hidden: import_zod10.z.boolean().optional().default(false),
+  encrypted: import_zod10.z.boolean().optional().default(false),
+  versioned: import_zod10.z.boolean().optional().default(false),
+  width: import_zod10.z.enum(["half", "full", "fill"]).optional().default("full"),
+  group: import_zod10.z.string().optional(),
+  sortOrder: import_zod10.z.number().int().optional(),
+  renameFrom: fieldNameSchema.optional().describe("Previous field name if this is a rename operation"),
+  confirmRiskyChange: import_zod10.z.boolean().optional().describe("Set true to confirm type-change or destructive migration")
 });
 function formatError3(err) {
   if (err instanceof LumiBaseApiError) {
@@ -1125,12 +1140,12 @@ function registerFieldTools(server, client) {
     {
       description: "List all fields in a collection, including system fields.",
       inputSchema: {
-        collection: import_zod9.z.string().min(1)
+        collection: collectionNameSchema
       }
     },
     async ({ collection }) => {
       try {
-        const data = await client.get(`/collections/${collection}/fields`);
+        const data = await client.get(`/collections/${encodePathSegment(collection)}/fields`);
         return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
       } catch (err) {
         return { content: [{ type: "text", text: `Error: ${formatError3(err)}` }], isError: true };
@@ -1142,15 +1157,15 @@ function registerFieldTools(server, client) {
     {
       description: 'Create or update a field in a collection. field_name must be lowercase snake_case (e.g. "published_at"). Common types: string (varchar), text (longtext), integer, boolean, dateTime, json, uuid. Common interfaces: input, textarea, datetime, toggle, select, file, markdown.',
       inputSchema: {
-        collection: import_zod9.z.string().min(1),
-        field_name: import_zod9.z.string().regex(namePattern, "Must be lowercase snake_case, start with a letter").describe("Machine name of the field"),
+        collection: collectionNameSchema,
+        field_name: fieldNameSchema.describe("Machine name of the field"),
         ...fieldInputSchema2.shape
       }
     },
     async ({ collection, field_name, ...fieldInput }) => {
       try {
         const data = await client.put(
-          `/collections/${collection}/fields/${field_name}`,
+          `/collections/${encodePathSegment(collection)}/fields/${encodePathSegment(field_name)}`,
           fieldInput
         );
         return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
@@ -1164,16 +1179,18 @@ function registerFieldTools(server, client) {
     {
       description: "Delete a field from a collection. Data stored in this field will be lost. Pass confirm=true to confirm the destructive operation.",
       inputSchema: {
-        collection: import_zod9.z.string().min(1),
-        field_name: import_zod9.z.string().min(1),
-        confirm: import_zod9.z.literal(true).describe("Must be true to confirm destructive operation"),
-        force: import_zod9.z.boolean().optional().describe("Force deletion even if risky (foreign keys, etc.)")
+        collection: collectionNameSchema,
+        field_name: fieldNameSchema,
+        confirm: import_zod10.z.literal(true).describe("Must be true to confirm destructive operation"),
+        force: import_zod10.z.boolean().optional().describe("Force deletion even if risky (foreign keys, etc.)")
       }
     },
     async ({ collection, field_name, force }) => {
       try {
         const qs = force ? "?force=true" : "";
-        await client.delete(`/collections/${collection}/fields/${field_name}${qs}`);
+        await client.delete(
+          `/collections/${encodePathSegment(collection)}/fields/${encodePathSegment(field_name)}${qs}`
+        );
         return {
           content: [{ type: "text", text: `Field "${field_name}" deleted from "${collection}".` }]
         };
@@ -1185,7 +1202,7 @@ function registerFieldTools(server, client) {
 }
 
 // src/tools/items.ts
-var import_zod10 = require("zod");
+var import_zod11 = require("zod");
 function formatError4(err) {
   if (err instanceof LumiBaseApiError) {
     return err.errors.map((e) => `[${e.code}] ${e.message}`).join("; ");
@@ -1206,19 +1223,19 @@ function registerItemTools(server, client) {
     {
       description: "List items from a collection with optional filtering, sorting, and pagination.",
       inputSchema: {
-        collection: import_zod10.z.string().min(1),
-        limit: import_zod10.z.number().int().min(1).max(200).optional().default(25),
-        offset: import_zod10.z.number().int().min(0).optional().default(0),
-        status: import_zod10.z.enum(["draft", "published", "archived"]).optional(),
-        sort: import_zod10.z.string().optional().describe('Comma-separated field names; prefix with - for descending (e.g. "-created_at")'),
-        fields: import_zod10.z.string().optional().describe('Comma-separated field names to return (e.g. "id,title,status")'),
-        search: import_zod10.z.string().optional().describe("Full-text search across searchable fields")
+        collection: collectionNameSchema,
+        limit: import_zod11.z.number().int().min(1).max(200).optional().default(25),
+        offset: import_zod11.z.number().int().min(0).optional().default(0),
+        status: import_zod11.z.enum(["draft", "published", "archived"]).optional(),
+        sort: import_zod11.z.string().optional().describe('Comma-separated field names; prefix with - for descending (e.g. "-created_at")'),
+        fields: import_zod11.z.string().optional().describe('Comma-separated field names to return (e.g. "id,title,status")'),
+        search: import_zod11.z.string().optional().describe("Full-text search across searchable fields")
       }
     },
     async ({ collection, ...params }) => {
       try {
         const qs = buildQs2(params);
-        const data = await client.get(`/items/${collection}${qs}`);
+        const data = await client.get(`/items/${encodePathSegment(collection)}${qs}`);
         return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
       } catch (err) {
         return { content: [{ type: "text", text: `Error: ${formatError4(err)}` }], isError: true };
@@ -1230,15 +1247,17 @@ function registerItemTools(server, client) {
     {
       description: "Get a single item by ID from a collection.",
       inputSchema: {
-        collection: import_zod10.z.string().min(1),
-        id: import_zod10.z.string().min(1),
-        fields: import_zod10.z.string().optional().describe("Comma-separated field names to return")
+        collection: collectionNameSchema,
+        id: idPathSegmentSchema,
+        fields: import_zod11.z.string().optional().describe("Comma-separated field names to return")
       }
     },
     async ({ collection, id, fields }) => {
       try {
         const qs = buildQs2({ fields });
-        const data = await client.get(`/items/${collection}/${id}${qs}`);
+        const data = await client.get(
+          `/items/${encodePathSegment(collection)}/${encodePathSegment(id)}${qs}`
+        );
         return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
       } catch (err) {
         return { content: [{ type: "text", text: `Error: ${formatError4(err)}` }], isError: true };
@@ -1250,14 +1269,14 @@ function registerItemTools(server, client) {
     {
       description: "Create a new item in a collection.",
       inputSchema: {
-        collection: import_zod10.z.string().min(1),
-        data: import_zod10.z.record(import_zod10.z.unknown()).describe("Field values for the new item"),
-        status: import_zod10.z.enum(["draft", "published"]).optional().default("draft")
+        collection: collectionNameSchema,
+        data: import_zod11.z.record(import_zod11.z.unknown()).describe("Field values for the new item"),
+        status: import_zod11.z.enum(["draft", "published"]).optional().default("draft")
       }
     },
     async ({ collection, data: itemData, status }) => {
       try {
-        const data = await client.post(`/items/${collection}`, {
+        const data = await client.post(`/items/${encodePathSegment(collection)}`, {
           ...itemData,
           status
         });
@@ -1272,14 +1291,17 @@ function registerItemTools(server, client) {
     {
       description: "Partially update an item (PATCH \u2014 only provided fields are changed).",
       inputSchema: {
-        collection: import_zod10.z.string().min(1),
-        id: import_zod10.z.string().min(1),
-        data: import_zod10.z.record(import_zod10.z.unknown()).describe("Fields to update")
+        collection: collectionNameSchema,
+        id: idPathSegmentSchema,
+        data: import_zod11.z.record(import_zod11.z.unknown()).describe("Fields to update")
       }
     },
     async ({ collection, id, data: itemData }) => {
       try {
-        const data = await client.patch(`/items/${collection}/${id}`, itemData);
+        const data = await client.patch(
+          `/items/${encodePathSegment(collection)}/${encodePathSegment(id)}`,
+          itemData
+        );
         return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
       } catch (err) {
         return { content: [{ type: "text", text: `Error: ${formatError4(err)}` }], isError: true };
@@ -1291,14 +1313,14 @@ function registerItemTools(server, client) {
     {
       description: "Soft-delete an item (sets deleted_at, recoverable). Pass confirm=true.",
       inputSchema: {
-        collection: import_zod10.z.string().min(1),
-        id: import_zod10.z.string().min(1),
-        confirm: import_zod10.z.literal(true).describe("Must be true to confirm deletion")
+        collection: collectionNameSchema,
+        id: idPathSegmentSchema,
+        confirm: import_zod11.z.literal(true).describe("Must be true to confirm deletion")
       }
     },
     async ({ collection, id }) => {
       try {
-        await client.delete(`/items/${collection}/${id}`);
+        await client.delete(`/items/${encodePathSegment(collection)}/${encodePathSegment(id)}`);
         return { content: [{ type: "text", text: `Item "${id}" deleted from "${collection}".` }] };
       } catch (err) {
         return { content: [{ type: "text", text: `Error: ${formatError4(err)}` }], isError: true };
@@ -1308,15 +1330,15 @@ function registerItemTools(server, client) {
 }
 
 // src/tools/ops.ts
-var import_zod11 = require("zod");
+var import_zod12 = require("zod");
 function registerOpsTools(server, client) {
   server.registerTool(
     "list_activity",
     {
       description: "List the site activity / audit trail (most recent first).",
       inputSchema: {
-        limit: import_zod11.z.number().int().min(1).max(500).optional(),
-        offset: import_zod11.z.number().int().min(0).optional()
+        limit: import_zod12.z.number().int().min(1).max(500).optional(),
+        offset: import_zod12.z.number().int().min(0).optional()
       }
     },
     async (args) => run(
@@ -1338,7 +1360,7 @@ function registerOpsTools(server, client) {
 }
 
 // src/tools/permissions.ts
-var import_zod12 = require("zod");
+var import_zod13 = require("zod");
 function registerPermissionTools(server, client) {
   server.registerTool(
     "get_my_permissions",
@@ -1353,9 +1375,9 @@ function registerPermissionTools(server, client) {
     {
       description: "Evaluate whether the current principal may perform an action on a collection (optionally against a specific item), returning { allowed, reason, fields }.",
       inputSchema: {
-        collection: import_zod12.z.string().min(1),
-        action: import_zod12.z.enum(["create", "read", "update", "delete", "share"]),
-        item: import_zod12.z.record(import_zod12.z.unknown()).optional().describe("Item payload to evaluate row-level rules against.")
+        collection: import_zod13.z.string().min(1),
+        action: import_zod13.z.enum(["create", "read", "update", "delete", "share"]),
+        item: import_zod13.z.record(import_zod13.z.unknown()).optional().describe("Item payload to evaluate row-level rules against.")
       }
     },
     async (input) => run(() => client.post("/permissions/check", input))
@@ -1363,21 +1385,21 @@ function registerPermissionTools(server, client) {
 }
 
 // src/tools/relations.ts
-var import_zod13 = require("zod");
+var import_zod14 = require("zod");
 var relationInputSchema = {
-  manyCollection: import_zod13.z.string().min(1).describe('Collection that holds the foreign key (the "many" side).'),
-  manyField: import_zod13.z.string().min(1).describe("Field on manyCollection that stores the relation."),
-  oneCollection: import_zod13.z.string().min(1).describe('Related collection (the "one" side).'),
-  oneField: import_zod13.z.string().nullable().optional(),
-  junctionCollection: import_zod13.z.string().nullable().optional().describe("Junction table for m2m relations."),
-  type: import_zod13.z.enum(["m2o", "o2m", "m2m", "m2a"]).optional(),
-  aliasField: import_zod13.z.string().nullable().optional(),
-  relatedDisplayTemplate: import_zod13.z.string().nullable().optional(),
-  junctionManyField: import_zod13.z.string().nullable().optional(),
-  junctionOneField: import_zod13.z.string().nullable().optional(),
-  sortField: import_zod13.z.string().nullable().optional(),
-  onDelete: import_zod13.z.enum(["restrict", "cascade", "set null", "no action"]).optional(),
-  meta: import_zod13.z.record(import_zod13.z.unknown()).optional()
+  manyCollection: import_zod14.z.string().min(1).describe('Collection that holds the foreign key (the "many" side).'),
+  manyField: import_zod14.z.string().min(1).describe("Field on manyCollection that stores the relation."),
+  oneCollection: import_zod14.z.string().min(1).describe('Related collection (the "one" side).'),
+  oneField: import_zod14.z.string().nullable().optional(),
+  junctionCollection: import_zod14.z.string().nullable().optional().describe("Junction table for m2m relations."),
+  type: import_zod14.z.enum(["m2o", "o2m", "m2m", "m2a"]).optional(),
+  aliasField: import_zod14.z.string().nullable().optional(),
+  relatedDisplayTemplate: import_zod14.z.string().nullable().optional(),
+  junctionManyField: import_zod14.z.string().nullable().optional(),
+  junctionOneField: import_zod14.z.string().nullable().optional(),
+  sortField: import_zod14.z.string().nullable().optional(),
+  onDelete: import_zod14.z.enum(["restrict", "cascade", "set null", "no action"]).optional(),
+  meta: import_zod14.z.record(import_zod14.z.unknown()).optional()
 };
 function registerRelationTools(server, client) {
   server.registerTool(
@@ -1398,31 +1420,31 @@ function registerRelationTools(server, client) {
     {
       description: "Delete a relation by id. DESTRUCTIVE \u2014 warn the user first and pass confirm=true.",
       inputSchema: {
-        id: import_zod13.z.string().min(1),
-        confirm: import_zod13.z.literal(true).describe(confirmDescription)
+        id: idPathSegmentSchema,
+        confirm: import_zod14.z.literal(true).describe(confirmDescription)
       }
     },
     async ({ id }) => run(async () => {
-      await client.delete(`/relations/${id}`);
+      await client.delete(`/relations/${encodePathSegment(id)}`);
       return okText(`Relation "${id}" deleted.`);
     })
   );
 }
 
 // src/tools/search-media.ts
-var import_zod14 = require("zod");
+var import_zod15 = require("zod");
 function registerSearchMediaTools(server, client) {
   server.registerTool(
     "search",
     {
       description: "Full-text search within a collection. Returns ranked hits from the search backend. The `collection` parameter is required.",
       inputSchema: {
-        q: import_zod14.z.string().min(1).describe("Query string."),
-        collection: import_zod14.z.string().min(1).describe("Collection to search."),
-        filter: import_zod14.z.string().optional().describe("Backend filter expression."),
-        sort: import_zod14.z.string().optional().describe("Comma-separated sort fields."),
-        limit: import_zod14.z.number().int().min(1).max(200).optional(),
-        offset: import_zod14.z.number().int().min(0).optional()
+        q: import_zod15.z.string().min(1).describe("Query string."),
+        collection: import_zod15.z.string().min(1).describe("Collection to search."),
+        filter: import_zod15.z.string().optional().describe("Backend filter expression."),
+        sort: import_zod15.z.string().optional().describe("Comma-separated sort fields."),
+        limit: import_zod15.z.number().int().min(1).max(200).optional(),
+        offset: import_zod15.z.number().int().min(0).optional()
       }
     },
     async (args) => run(
@@ -1435,7 +1457,7 @@ function registerSearchMediaTools(server, client) {
     "list_media",
     {
       description: "List media asset keys, optionally filtered by key prefix.",
-      inputSchema: { prefix: import_zod14.z.string().optional() }
+      inputSchema: { prefix: import_zod15.z.string().optional() }
     },
     async ({ prefix }) => run(() => client.get(`/media${prefix ? `?prefix=${encodeURIComponent(prefix)}` : ""}`))
   );
@@ -1444,27 +1466,27 @@ function registerSearchMediaTools(server, client) {
     {
       description: "Delete a media asset by key. DESTRUCTIVE \u2014 warn the user first and pass confirm=true.",
       inputSchema: {
-        key: import_zod14.z.string().min(1).describe("Full storage key of the asset."),
-        confirm: import_zod14.z.literal(true).describe(confirmDescription)
+        key: mediaKeySchema.describe("Full storage key of the asset."),
+        confirm: import_zod15.z.literal(true).describe(confirmDescription)
       }
     },
     async ({ key }) => run(async () => {
-      await client.delete(`/media/${key}`);
+      await client.delete(`/media/${encodeMediaKey(key)}`);
       return okText(`Media asset "${key}" deleted.`);
     })
   );
 }
 
 // src/tools/translation-memory.ts
-var import_zod15 = require("zod");
+var import_zod16 = require("zod");
 function registerTranslationMemoryTools(server, client) {
   server.registerTool(
     "list_tm",
     {
       description: "List translation-memory entries, optionally filtered by source/target language.",
       inputSchema: {
-        source: import_zod15.z.string().optional().describe("Source language code."),
-        target: import_zod15.z.string().optional().describe("Target language code.")
+        source: import_zod16.z.string().optional().describe("Source language code."),
+        target: import_zod16.z.string().optional().describe("Target language code.")
       }
     },
     async (args) => run(
@@ -1476,14 +1498,14 @@ function registerTranslationMemoryTools(server, client) {
     {
       description: "Add or update a translation-memory entry.",
       inputSchema: {
-        sourceLang: import_zod15.z.string().min(2),
-        targetLang: import_zod15.z.string().min(2),
-        sourceText: import_zod15.z.string().min(1),
-        targetText: import_zod15.z.string().min(1),
-        context: import_zod15.z.string().optional(),
-        quality: import_zod15.z.number().min(0).max(100).optional(),
-        source: import_zod15.z.enum(["human", "mt", "imported"]).optional(),
-        provider: import_zod15.z.string().optional()
+        sourceLang: import_zod16.z.string().min(2),
+        targetLang: import_zod16.z.string().min(2),
+        sourceText: import_zod16.z.string().min(1),
+        targetText: import_zod16.z.string().min(1),
+        context: import_zod16.z.string().optional(),
+        quality: import_zod16.z.number().min(0).max(100).optional(),
+        source: import_zod16.z.enum(["human", "mt", "imported"]).optional(),
+        provider: import_zod16.z.string().optional()
       }
     },
     async (input) => run(() => client.post("/tm", input))
@@ -1493,10 +1515,10 @@ function registerTranslationMemoryTools(server, client) {
     {
       description: "Fuzzy-match a query string against translation memory for a language pair.",
       inputSchema: {
-        query: import_zod15.z.string().min(1),
-        sourceLang: import_zod15.z.string().min(2),
-        targetLang: import_zod15.z.string().min(2),
-        threshold: import_zod15.z.number().min(0).max(100).optional().describe("Minimum match score (default 75).")
+        query: import_zod16.z.string().min(1),
+        sourceLang: import_zod16.z.string().min(2),
+        targetLang: import_zod16.z.string().min(2),
+        threshold: import_zod16.z.number().min(0).max(100).optional().describe("Minimum match score (default 75).")
       }
     },
     async (input) => run(() => client.post("/tm/lookup", input))
@@ -1506,10 +1528,10 @@ function registerTranslationMemoryTools(server, client) {
     {
       description: "Run the full translation pipeline (TM + glossary + MT provider) for a text.",
       inputSchema: {
-        text: import_zod15.z.string().min(1),
-        from: import_zod15.z.string().min(2),
-        to: import_zod15.z.string().min(2),
-        provider: import_zod15.z.string().optional()
+        text: import_zod16.z.string().min(1),
+        from: import_zod16.z.string().min(2),
+        to: import_zod16.z.string().min(2),
+        provider: import_zod16.z.string().optional()
       }
     },
     async (input) => run(() => client.post("/tm/translate", input))
@@ -1517,7 +1539,7 @@ function registerTranslationMemoryTools(server, client) {
 }
 
 // src/tools/users-teams.ts
-var import_zod16 = require("zod");
+var import_zod17 = require("zod");
 function registerUsersTeamsTools(server, client) {
   server.registerTool(
     "list_users",
@@ -1526,16 +1548,16 @@ function registerUsersTeamsTools(server, client) {
   );
   server.registerTool(
     "get_user",
-    { description: "Get a single user in the active site by id.", inputSchema: { id: import_zod16.z.string().min(1) } },
-    async ({ id }) => run(() => client.get(`/users/${id}`))
+    { description: "Get a single user in the active site by id.", inputSchema: { id: idPathSegmentSchema } },
+    async ({ id }) => run(() => client.get(`/users/${encodePathSegment(id)}`))
   );
   server.registerTool(
     "invite_user",
     {
       description: "Invite a user to the site by email, optionally assigning a role. Sends an invite email.",
       inputSchema: {
-        email: import_zod16.z.string().email(),
-        roleId: import_zod16.z.string().optional()
+        email: import_zod17.z.string().email(),
+        roleId: import_zod17.z.string().optional()
       }
     },
     async (input) => run(() => client.post("/users/invite", input))
@@ -1545,21 +1567,21 @@ function registerUsersTeamsTools(server, client) {
     {
       description: "Update a user's site membership (role and/or status).",
       inputSchema: {
-        id: import_zod16.z.string().min(1),
-        roleId: import_zod16.z.string().nullable().optional(),
-        status: import_zod16.z.string().optional().describe("e.g. active, suspended.")
+        id: idPathSegmentSchema,
+        roleId: import_zod17.z.string().nullable().optional(),
+        status: import_zod17.z.string().optional().describe("e.g. active, suspended.")
       }
     },
-    async ({ id, ...patch }) => run(() => client.patch(`/users/${id}`, patch))
+    async ({ id, ...patch }) => run(() => client.patch(`/users/${encodePathSegment(id)}`, patch))
   );
   server.registerTool(
     "remove_user",
     {
       description: "Remove a user from the site. DESTRUCTIVE \u2014 pass confirm=true.",
-      inputSchema: { id: import_zod16.z.string().min(1), confirm: import_zod16.z.literal(true).describe(confirmDescription) }
+      inputSchema: { id: idPathSegmentSchema, confirm: import_zod17.z.literal(true).describe(confirmDescription) }
     },
     async ({ id }) => run(async () => {
-      await client.delete(`/users/${id}`);
+      await client.delete(`/users/${encodePathSegment(id)}`);
       return okText(`User "${id}" removed from the site.`);
     })
   );
@@ -1570,14 +1592,14 @@ function registerUsersTeamsTools(server, client) {
   );
   server.registerTool(
     "get_team",
-    { description: "Get a single team by id.", inputSchema: { id: import_zod16.z.string().min(1) } },
-    async ({ id }) => run(() => client.get(`/teams/${id}`))
+    { description: "Get a single team by id.", inputSchema: { id: idPathSegmentSchema } },
+    async ({ id }) => run(() => client.get(`/teams/${encodePathSegment(id)}`))
   );
   server.registerTool(
     "create_team",
     {
       description: "Create a team.",
-      inputSchema: { name: import_zod16.z.string().min(1).max(128), description: import_zod16.z.string().nullable().optional() }
+      inputSchema: { name: import_zod17.z.string().min(1).max(128), description: import_zod17.z.string().nullable().optional() }
     },
     async (input) => run(() => client.post("/teams", input))
   );
@@ -1586,64 +1608,64 @@ function registerUsersTeamsTools(server, client) {
     {
       description: "Update a team (partial PATCH).",
       inputSchema: {
-        id: import_zod16.z.string().min(1),
-        name: import_zod16.z.string().min(1).max(128).optional(),
-        description: import_zod16.z.string().nullable().optional()
+        id: idPathSegmentSchema,
+        name: import_zod17.z.string().min(1).max(128).optional(),
+        description: import_zod17.z.string().nullable().optional()
       }
     },
-    async ({ id, ...patch }) => run(() => client.patch(`/teams/${id}`, patch))
+    async ({ id, ...patch }) => run(() => client.patch(`/teams/${encodePathSegment(id)}`, patch))
   );
   server.registerTool(
     "delete_team",
     {
       description: "Delete a team. DESTRUCTIVE \u2014 pass confirm=true.",
-      inputSchema: { id: import_zod16.z.string().min(1), confirm: import_zod16.z.literal(true).describe(confirmDescription) }
+      inputSchema: { id: idPathSegmentSchema, confirm: import_zod17.z.literal(true).describe(confirmDescription) }
     },
     async ({ id }) => run(async () => {
-      await client.delete(`/teams/${id}`);
+      await client.delete(`/teams/${encodePathSegment(id)}`);
       return okText(`Team "${id}" deleted.`);
     })
   );
   server.registerTool(
     "list_team_members",
-    { description: "List members of a team.", inputSchema: { id: import_zod16.z.string().min(1).describe("Team id.") } },
-    async ({ id }) => run(() => client.get(`/teams/${id}/members`))
+    { description: "List members of a team.", inputSchema: { id: idPathSegmentSchema.describe("Team id.") } },
+    async ({ id }) => run(() => client.get(`/teams/${encodePathSegment(id)}/members`))
   );
   server.registerTool(
     "add_team_member",
     {
       description: "Add a user to a team.",
-      inputSchema: { id: import_zod16.z.string().min(1).describe("Team id."), userId: import_zod16.z.string().min(1) }
+      inputSchema: { id: idPathSegmentSchema.describe("Team id."), userId: idPathSegmentSchema }
     },
-    async ({ id, userId }) => run(() => client.post(`/teams/${id}/members`, { userId }))
+    async ({ id, userId }) => run(() => client.post(`/teams/${encodePathSegment(id)}/members`, { userId }))
   );
   server.registerTool(
     "remove_team_member",
     {
       description: "Remove a user from a team. DESTRUCTIVE \u2014 pass confirm=true.",
       inputSchema: {
-        id: import_zod16.z.string().min(1).describe("Team id."),
-        userId: import_zod16.z.string().min(1),
-        confirm: import_zod16.z.literal(true).describe(confirmDescription)
+        id: idPathSegmentSchema.describe("Team id."),
+        userId: idPathSegmentSchema,
+        confirm: import_zod17.z.literal(true).describe(confirmDescription)
       }
     },
     async ({ id, userId }) => run(async () => {
-      await client.delete(`/teams/${id}/members/${userId}`);
+      await client.delete(`/teams/${encodePathSegment(id)}/members/${encodePathSegment(userId)}`);
       return okText(`User "${userId}" removed from team "${id}".`);
     })
   );
 }
 
 // src/tools/webhooks.ts
-var import_zod17 = require("zod");
-var webhookSchema = import_zod17.z.object({
-  name: import_zod17.z.string().min(1).max(255),
-  url: import_zod17.z.string().url(),
-  actions: import_zod17.z.array(import_zod17.z.string()).optional().describe("Item events that trigger the webhook (e.g. create, update, delete)."),
-  collections: import_zod17.z.array(import_zod17.z.string()).optional().describe("Collections to filter on (empty = all)."),
-  headers: import_zod17.z.record(import_zod17.z.string()).optional(),
-  status: import_zod17.z.enum(["active", "inactive"]).optional(),
-  secret: import_zod17.z.string().nullable().optional()
+var import_zod18 = require("zod");
+var webhookSchema = import_zod18.z.object({
+  name: import_zod18.z.string().min(1).max(255),
+  url: import_zod18.z.string().url(),
+  actions: import_zod18.z.array(import_zod18.z.string()).optional().describe("Item events that trigger the webhook (e.g. create, update, delete)."),
+  collections: import_zod18.z.array(import_zod18.z.string()).optional().describe("Collections to filter on (empty = all)."),
+  headers: import_zod18.z.record(import_zod18.z.string()).optional(),
+  status: import_zod18.z.enum(["active", "inactive"]).optional(),
+  secret: import_zod18.z.string().nullable().optional()
 });
 function registerWebhookTools(server, client) {
   registerCrud(server, client, {