@lumibase/mcp-server 0.13.0 → 0.14.0

package/dist/index.js

@@ -109,10 +109,10 @@ function configFromEnv() {
 }
 
 // src/tools/access.ts
-import { z as z2 } from "zod";
+import { z as z3 } from "zod";
 
 // src/tools/_crud.ts
-import { z } from "zod";
+import { z as z2 } from "zod";
 
 // src/tools/_shared.ts
 function formatError(err) {
@@ -154,6 +154,20 @@ async function run(fn) {
 }
 var confirmDescription = "Must be true to confirm the destructive operation";
 
+// src/tools/path.ts
+import { z } from "zod";
+var namePattern = /^[a-z][a-z0-9_]{0,62}$/;
+var collectionNameSchema = z.string().min(1).max(63).regex(namePattern, "Must be lowercase, start with a letter, only a-z0-9_");
+var fieldNameSchema = z.string().min(1).max(63).regex(namePattern, "Must be lowercase snake_case, start with a letter");
+var idPathSegmentSchema = z.string().min(1).refine((value) => value !== "." && value !== "..", "Must not be . or ..").refine((value) => !/[\\/]/.test(value), "Must not contain path separators");
+function encodePathSegment(segment) {
+  return encodeURIComponent(segment);
+}
+var mediaKeySchema = z.string().min(1).refine((value) => !value.includes(".."), 'Must not contain ".."').refine((value) => !value.startsWith("/"), 'Must not start with "/"').refine((value) => !value.includes("\\"), "Must not contain backslashes");
+function encodeMediaKey(key) {
+  return key.split("/").map((segment) => encodeURIComponent(segment)).join("/");
+}
+
 // src/tools/_crud.ts
 function registerCrud(server, client, opts) {
   const {
@@ -184,9 +198,9 @@ function registerCrud(server, client, opts) {
       `get_${namePrefix}`,
       {
         description: `Get a single ${resource} by ${idParam}.`,
-        inputSchema: { [idParam]: z.string().min(1) }
+        inputSchema: { [idParam]: idPathSegmentSchema }
       },
-      async (args) => run(() => client.get(`${basePath}/${String(args[idParam])}`))
+      async (args) => run(() => client.get(`${basePath}/${encodePathSegment(String(args[idParam]))}`))
     );
   }
   if (createSchema) {
@@ -204,11 +218,11 @@ function registerCrud(server, client, opts) {
       `update_${namePrefix}`,
       {
         description: `Update an existing ${resource} (partial PATCH).`,
-        inputSchema: { [idParam]: z.string().min(1), ...updateSchema }
+        inputSchema: { [idParam]: idPathSegmentSchema, ...updateSchema }
       },
       async (args) => {
         const { [idParam]: id, ...patch } = args;
-        return run(() => client.patch(`${basePath}/${String(id)}`, patch));
+        return run(() => client.patch(`${basePath}/${encodePathSegment(String(id))}`, patch));
       }
     );
   }
@@ -218,14 +232,14 @@ function registerCrud(server, client, opts) {
       {
         description: `Delete a ${resource}. DESTRUCTIVE \u2014 warn the user first and pass confirm=true.`,
         inputSchema: {
-          [idParam]: z.string().min(1),
-          confirm: z.literal(true).describe(confirmDescription)
+          [idParam]: idPathSegmentSchema,
+          confirm: z2.literal(true).describe(confirmDescription)
         }
       },
       async (args) => {
         const id = String(args[idParam]);
         return run(async () => {
-          await client.delete(`${basePath}/${id}`);
+          await client.delete(`${basePath}/${encodePathSegment(id)}`);
           return okText(`${resource} "${id}" deleted.`);
         });
       }
@@ -234,37 +248,37 @@ function registerCrud(server, client, opts) {
 }
 
 // src/tools/access.ts
-var roleSchema = z2.object({
-  key: z2.string().min(1).max(96).optional(),
-  systemKey: z2.string().min(1).max(96).optional(),
-  name: z2.string().min(1).max(64),
-  description: z2.string().max(512).optional(),
-  icon: z2.string().max(64).optional(),
-  parentId: z2.string().nullable().optional(),
-  adminAccess: z2.boolean().optional(),
-  appAccess: z2.boolean().optional()
+var roleSchema = z3.object({
+  key: z3.string().min(1).max(96).optional(),
+  systemKey: z3.string().min(1).max(96).optional(),
+  name: z3.string().min(1).max(64),
+  description: z3.string().max(512).optional(),
+  icon: z3.string().max(64).optional(),
+  parentId: z3.string().nullable().optional(),
+  adminAccess: z3.boolean().optional(),
+  appAccess: z3.boolean().optional()
 });
-var policySchema = z2.object({
-  key: z2.string().min(1).max(96).optional(),
-  name: z2.string().min(1).max(64),
-  icon: z2.string().max(64).optional(),
-  description: z2.string().max(512).optional(),
-  adminAccess: z2.boolean().optional(),
-  appAccess: z2.boolean().optional(),
-  enforceTfa: z2.boolean().optional(),
-  ipAllow: z2.array(z2.string()).optional(),
-  ipDeny: z2.array(z2.string()).optional(),
-  validFrom: z2.string().datetime().nullable().optional(),
-  validUntil: z2.string().datetime().nullable().optional(),
-  rules: z2.record(z2.unknown()).optional()
+var policySchema = z3.object({
+  key: z3.string().min(1).max(96).optional(),
+  name: z3.string().min(1).max(64),
+  icon: z3.string().max(64).optional(),
+  description: z3.string().max(512).optional(),
+  adminAccess: z3.boolean().optional(),
+  appAccess: z3.boolean().optional(),
+  enforceTfa: z3.boolean().optional(),
+  ipAllow: z3.array(z3.string()).optional(),
+  ipDeny: z3.array(z3.string()).optional(),
+  validFrom: z3.string().datetime().nullable().optional(),
+  validUntil: z3.string().datetime().nullable().optional(),
+  rules: z3.record(z3.unknown()).optional()
 });
-var permissionSchema = z2.object({
-  collection: z2.string().min(1).max(64),
-  action: z2.enum(["create", "read", "update", "delete", "share"]),
-  permissions: z2.record(z2.unknown()).optional(),
-  validation: z2.record(z2.unknown()).optional(),
-  presets: z2.record(z2.unknown()).optional(),
-  fields: z2.array(z2.string()).optional()
+var permissionSchema = z3.object({
+  collection: z3.string().min(1).max(64),
+  action: z3.enum(["create", "read", "update", "delete", "share"]),
+  permissions: z3.record(z3.unknown()).optional(),
+  validation: z3.record(z3.unknown()).optional(),
+  presets: z3.record(z3.unknown()).optional(),
+  fields: z3.array(z3.string()).optional()
 });
 function registerAccessTools(server, client) {
   registerCrud(server, client, {
@@ -279,26 +293,26 @@ function registerAccessTools(server, client) {
     {
       description: "Attach a policy to a role. Conflicts/warnings may require overrideWarnings=true.",
       inputSchema: {
-        id: z2.string().min(1).describe("Role id."),
-        policyId: z2.string().min(1),
-        priority: z2.number().int().optional(),
-        overrideWarnings: z2.boolean().optional()
+        id: idPathSegmentSchema.describe("Role id."),
+        policyId: idPathSegmentSchema,
+        priority: z3.number().int().optional(),
+        overrideWarnings: z3.boolean().optional()
       }
     },
-    async ({ id, ...body }) => run(() => client.post(`/roles/${id}/policies`, body))
+    async ({ id, ...body }) => run(() => client.post(`/roles/${encodePathSegment(id)}/policies`, body))
   );
   server.registerTool(
     "detach_role_policy",
     {
       description: "Detach a policy from a role. DESTRUCTIVE \u2014 pass confirm=true.",
       inputSchema: {
-        id: z2.string().min(1).describe("Role id."),
-        policyId: z2.string().min(1),
-        confirm: z2.literal(true).describe(confirmDescription)
+        id: idPathSegmentSchema.describe("Role id."),
+        policyId: idPathSegmentSchema,
+        confirm: z3.literal(true).describe(confirmDescription)
       }
     },
     async ({ id, policyId }) => run(async () => {
-      await client.delete(`/roles/${id}/policies/${policyId}`);
+      await client.delete(`/roles/${encodePathSegment(id)}/policies/${encodePathSegment(policyId)}`);
       return okText(`Policy "${policyId}" detached from role "${id}".`);
     })
   );
@@ -306,22 +320,22 @@ function registerAccessTools(server, client) {
     "assign_role_user",
     {
       description: "Assign a role to a user (sets the user's primary role for this site).",
-      inputSchema: { id: z2.string().min(1).describe("Role id."), userId: z2.string().min(1) }
+      inputSchema: { id: idPathSegmentSchema.describe("Role id."), userId: idPathSegmentSchema }
     },
-    async ({ id, userId }) => run(() => client.post(`/roles/${id}/users`, { userId }))
+    async ({ id, userId }) => run(() => client.post(`/roles/${encodePathSegment(id)}/users`, { userId }))
   );
   server.registerTool(
     "remove_role_user",
     {
       description: "Remove a user's role assignment. DESTRUCTIVE \u2014 pass confirm=true.",
       inputSchema: {
-        id: z2.string().min(1).describe("Role id."),
-        userId: z2.string().min(1),
-        confirm: z2.literal(true).describe(confirmDescription)
+        id: idPathSegmentSchema.describe("Role id."),
+        userId: idPathSegmentSchema,
+        confirm: z3.literal(true).describe(confirmDescription)
       }
     },
     async ({ id, userId }) => run(async () => {
-      await client.delete(`/roles/${id}/users/${userId}`);
+      await client.delete(`/roles/${encodePathSegment(id)}/users/${encodePathSegment(userId)}`);
       return okText(`User "${userId}" removed from role "${id}".`);
     })
   );
@@ -337,34 +351,34 @@ function registerAccessTools(server, client) {
     "add_policy_permission",
     {
       description: "Add a permission row (collection + action) to a policy.",
-      inputSchema: { id: z2.string().min(1).describe("Policy id."), ...permissionSchema.shape }
+      inputSchema: { id: idPathSegmentSchema.describe("Policy id."), ...permissionSchema.shape }
     },
-    async ({ id, ...body }) => run(() => client.post(`/policies/${id}/permissions`, body))
+    async ({ id, ...body }) => run(() => client.post(`/policies/${encodePathSegment(id)}/permissions`, body))
   );
   server.registerTool(
     "update_policy_permission",
     {
       description: "Update a permission row on a policy (partial PATCH).",
       inputSchema: {
-        id: z2.string().min(1).describe("Policy id."),
-        permId: z2.string().min(1).describe("Permission row id."),
+        id: idPathSegmentSchema.describe("Policy id."),
+        permId: idPathSegmentSchema.describe("Permission row id."),
         ...permissionSchema.partial().shape
       }
     },
-    async ({ id, permId, ...body }) => run(() => client.patch(`/policies/${id}/permissions/${permId}`, body))
+    async ({ id, permId, ...body }) => run(() => client.patch(`/policies/${encodePathSegment(id)}/permissions/${encodePathSegment(permId)}`, body))
   );
   server.registerTool(
     "delete_policy_permission",
     {
       description: "Delete a permission row from a policy. DESTRUCTIVE \u2014 pass confirm=true.",
       inputSchema: {
-        id: z2.string().min(1).describe("Policy id."),
-        permId: z2.string().min(1).describe("Permission row id."),
-        confirm: z2.literal(true).describe(confirmDescription)
+        id: idPathSegmentSchema.describe("Policy id."),
+        permId: idPathSegmentSchema.describe("Permission row id."),
+        confirm: z3.literal(true).describe(confirmDescription)
       }
     },
     async ({ id, permId }) => run(async () => {
-      await client.delete(`/policies/${id}/permissions/${permId}`);
+      await client.delete(`/policies/${encodePathSegment(id)}/permissions/${encodePathSegment(permId)}`);
       return okText(`Permission "${permId}" deleted from policy "${id}".`);
     })
   );
@@ -373,26 +387,26 @@ function registerAccessTools(server, client) {
     {
       description: "Attach a policy directly to a user. Warnings may require overrideWarnings=true.",
       inputSchema: {
-        id: z2.string().min(1).describe("Policy id."),
-        userId: z2.string().min(1),
-        priority: z2.number().int().optional(),
-        overrideWarnings: z2.boolean().optional()
+        id: idPathSegmentSchema.describe("Policy id."),
+        userId: idPathSegmentSchema,
+        priority: z3.number().int().optional(),
+        overrideWarnings: z3.boolean().optional()
       }
     },
-    async ({ id, ...body }) => run(() => client.post(`/policies/${id}/users`, body))
+    async ({ id, ...body }) => run(() => client.post(`/policies/${encodePathSegment(id)}/users`, body))
   );
   server.registerTool(
     "detach_policy_user",
     {
       description: "Detach a policy from a user. DESTRUCTIVE \u2014 pass confirm=true.",
       inputSchema: {
-        id: z2.string().min(1).describe("Policy id."),
-        userId: z2.string().min(1),
-        confirm: z2.literal(true).describe(confirmDescription)
+        id: idPathSegmentSchema.describe("Policy id."),
+        userId: idPathSegmentSchema,
+        confirm: z3.literal(true).describe(confirmDescription)
       }
     },
     async ({ id, userId }) => run(async () => {
-      await client.delete(`/policies/${id}/users/${userId}`);
+      await client.delete(`/policies/${encodePathSegment(id)}/users/${encodePathSegment(userId)}`);
       return okText(`Policy "${id}" detached from user "${userId}".`);
     })
   );
@@ -405,7 +419,7 @@ function registerAccessTools(server, client) {
     "dry_run_access_import",
     {
       description: "Validate an RBAC manifest import without applying it. Returns the planned changes.",
-      inputSchema: { manifest: z2.record(z2.unknown()).describe("RBAC manifest from export_access.") }
+      inputSchema: { manifest: z3.record(z3.unknown()).describe("RBAC manifest from export_access.") }
     },
     async ({ manifest }) => run(() => client.post("/access/import?dryRun=true", manifest))
   );
@@ -414,9 +428,9 @@ function registerAccessTools(server, client) {
     {
       description: "Apply an RBAC manifest import. High-impact \u2014 changes roles/policies/permissions. Pass confirm=true.",
       inputSchema: {
-        manifest: z2.record(z2.unknown()).describe("RBAC manifest from export_access."),
-        mode: z2.enum(["merge", "replace-managed", "replace-all"]).optional().describe("Import mode (default merge)."),
-        confirm: z2.literal(true).describe(confirmDescription)
+        manifest: z3.record(z3.unknown()).describe("RBAC manifest from export_access."),
+        mode: z3.enum(["merge", "replace-managed", "replace-all"]).optional().describe("Import mode (default merge)."),
+        confirm: z3.literal(true).describe(confirmDescription)
       }
     },
     async ({ manifest, mode }) => run(() => client.post(`/access/import${mode ? `?mode=${mode}` : ""}`, manifest))
@@ -426,9 +440,9 @@ function registerAccessTools(server, client) {
     {
       description: "Check for permission conflicts before attaching/detaching policies on a target.",
       inputSchema: {
-        target: z2.object({ type: z2.enum(["role", "user", "api_key"]), id: z2.string().min(1) }).describe("The role/user/api_key the policies would apply to."),
-        addPolicies: z2.array(z2.string()).optional(),
-        removePolicies: z2.array(z2.string()).optional()
+        target: z3.object({ type: z3.enum(["role", "user", "api_key"]), id: z3.string().min(1) }).describe("The role/user/api_key the policies would apply to."),
+        addPolicies: z3.array(z3.string()).optional(),
+        removePolicies: z3.array(z3.string()).optional()
       }
     },
     async (input) => run(() => client.post("/access/conflicts/check", input))
@@ -436,14 +450,14 @@ function registerAccessTools(server, client) {
 }
 
 // src/tools/admin.ts
-import { z as z3 } from "zod";
-var materializeSchema = z3.object({
-  collection: z3.string().min(1).describe("Source collection name."),
-  target: z3.string().regex(/^[a-z][a-z0-9_]{0,62}$/).describe("Physical table name (snake_case)."),
-  refreshStrategy: z3.enum(["auto", "cron", "manual"]).optional(),
-  refreshCron: z3.string().optional(),
-  projection: z3.object({ fields: z3.array(z3.string()).optional(), orderBy: z3.string().optional() }).optional(),
-  filter: z3.record(z3.unknown()).optional()
+import { z as z4 } from "zod";
+var materializeSchema = z4.object({
+  collection: z4.string().min(1).describe("Source collection name."),
+  target: z4.string().regex(/^[a-z][a-z0-9_]{0,62}$/).describe("Physical table name (snake_case)."),
+  refreshStrategy: z4.enum(["auto", "cron", "manual"]).optional(),
+  refreshCron: z4.string().optional(),
+  projection: z4.object({ fields: z4.array(z4.string()).optional(), orderBy: z4.string().optional() }).optional(),
+  filter: z4.record(z4.unknown()).optional()
 });
 function registerAdminTools(server, client) {
   server.registerTool(
@@ -459,8 +473,8 @@ function registerAdminTools(server, client) {
     {
       description: "Restore a site configuration from an NDJSON bundle (as produced by export_backup). Existing rows are skipped (idempotent). DESTRUCTIVE / high-impact \u2014 pass confirm=true.",
       inputSchema: {
-        ndjson: z3.string().min(1).describe("Raw NDJSON backup content, one JSON object per line."),
-        confirm: z3.literal(true).describe(confirmDescription)
+        ndjson: z4.string().min(1).describe("Raw NDJSON backup content, one JSON object per line."),
+        confirm: z4.literal(true).describe(confirmDescription)
       }
     },
     async ({ ndjson }) => run(() => client.postRaw("/admin/restore", ndjson))
@@ -482,58 +496,58 @@ function registerAdminTools(server, client) {
     "refresh_materialization",
     {
       description: "Refresh a materialized collection (truncate + re-insert from source).",
-      inputSchema: { id: z3.string().min(1) }
+      inputSchema: { id: idPathSegmentSchema }
     },
-    async ({ id }) => run(() => client.post(`/materialize/${id}/refresh`, {}))
+    async ({ id }) => run(() => client.post(`/materialize/${encodePathSegment(id)}/refresh`, {}))
   );
   server.registerTool(
     "query_materialization",
     {
       description: "Query the physical table of a materialized collection directly.",
-      inputSchema: { id: z3.string().min(1) }
+      inputSchema: { id: idPathSegmentSchema }
     },
-    async ({ id }) => run(() => client.get(`/materialize/${id}/data`))
+    async ({ id }) => run(() => client.get(`/materialize/${encodePathSegment(id)}/data`))
   );
   server.registerTool(
     "drop_materialization",
     {
       description: "Drop a materialized collection (physical table + metadata). DESTRUCTIVE \u2014 pass confirm=true.",
-      inputSchema: { id: z3.string().min(1), confirm: z3.literal(true).describe(confirmDescription) }
+      inputSchema: { id: idPathSegmentSchema, confirm: z4.literal(true).describe(confirmDescription) }
     },
     async ({ id }) => run(async () => {
-      await client.delete(`/materialize/${id}`);
+      await client.delete(`/materialize/${encodePathSegment(id)}`);
       return okText(`Materialization "${id}" dropped.`);
     })
   );
 }
 
 // src/tools/agent.ts
-import { z as z4 } from "zod";
-var intentSchema = z4.object({
-  name: z4.string().min(1).max(120),
-  collection: z4.string().min(1).max(120),
-  rules: z4.array(z4.record(z4.unknown())).describe("SLO rules (required_fields, freshness, translations, link_health, \u2026)."),
-  schedule: z4.string().describe("5-field cron expression for reconciliation cadence."),
-  budget: z4.record(z4.unknown()).optional(),
-  autonomyCap: z4.number().int().min(0).max(4).optional().describe("Max autonomy level L0\u2013L4 for this intent."),
-  maintenanceWindow: z4.record(z4.unknown()).nullable().optional()
+import { z as z5 } from "zod";
+var intentSchema = z5.object({
+  name: z5.string().min(1).max(120),
+  collection: z5.string().min(1).max(120),
+  rules: z5.array(z5.record(z5.unknown())).describe("SLO rules (required_fields, freshness, translations, link_health, \u2026)."),
+  schedule: z5.string().describe("5-field cron expression for reconciliation cadence."),
+  budget: z5.record(z5.unknown()).optional(),
+  autonomyCap: z5.number().int().min(0).max(4).optional().describe("Max autonomy level L0\u2013L4 for this intent."),
+  maintenanceWindow: z5.record(z5.unknown()).nullable().optional()
 });
-var flowNode = z4.object({
-  id: z4.string(),
-  key: z4.string(),
-  options: z4.record(z4.unknown()).optional(),
-  next: z4.string().nullable().optional(),
-  onError: z4.string().nullable().optional()
+var flowNode = z5.object({
+  id: z5.string(),
+  key: z5.string(),
+  options: z5.record(z5.unknown()).optional(),
+  next: z5.string().nullable().optional(),
+  onError: z5.string().nullable().optional()
 });
-var flowSchema = z4.object({
-  name: z4.string().min(1),
-  description: z4.string().optional(),
-  status: z4.enum(["active", "inactive", "draft"]).optional(),
-  triggerType: z4.enum(["webhook", "event", "schedule", "manual"]),
-  triggerOptions: z4.record(z4.unknown()).optional(),
-  graph: z4.object({
-    entry: z4.string().optional(),
-    nodes: z4.array(flowNode).optional()
+var flowSchema = z5.object({
+  name: z5.string().min(1),
+  description: z5.string().optional(),
+  status: z5.enum(["active", "inactive", "draft"]).optional(),
+  triggerType: z5.enum(["webhook", "event", "schedule", "manual"]),
+  triggerOptions: z5.record(z5.unknown()).optional(),
+  graph: z5.object({
+    entry: z5.string().optional(),
+    nodes: z5.array(flowNode).optional()
   })
 });
 function registerAgentTools(server, client) {
@@ -546,31 +560,31 @@ function registerAgentTools(server, client) {
   });
   server.registerTool(
     "pause_intent",
-    { description: "Pause an intent (stops scheduled reconciliation).", inputSchema: { id: z4.string().min(1) } },
-    async ({ id }) => run(() => client.post(`/agent/intents/${id}/pause`, {}))
+    { description: "Pause an intent (stops scheduled reconciliation).", inputSchema: { id: idPathSegmentSchema } },
+    async ({ id }) => run(() => client.post(`/agent/intents/${encodePathSegment(id)}/pause`, {}))
   );
   server.registerTool(
     "resume_intent",
-    { description: "Resume a paused intent.", inputSchema: { id: z4.string().min(1) } },
-    async ({ id }) => run(() => client.post(`/agent/intents/${id}/resume`, {}))
+    { description: "Resume a paused intent.", inputSchema: { id: idPathSegmentSchema } },
+    async ({ id }) => run(() => client.post(`/agent/intents/${encodePathSegment(id)}/resume`, {}))
   );
   server.registerTool(
     "list_intent_drifts",
-    { description: "List detected drifts (intent violations) for an intent.", inputSchema: { id: z4.string().min(1) } },
-    async ({ id }) => run(() => client.get(`/agent/intents/${id}/drifts`))
+    { description: "List detected drifts (intent violations) for an intent.", inputSchema: { id: idPathSegmentSchema } },
+    async ({ id }) => run(() => client.get(`/agent/intents/${encodePathSegment(id)}/drifts`))
   );
   server.registerTool(
     "scan_intent",
-    { description: "Trigger an on-demand drift scan for an intent.", inputSchema: { id: z4.string().min(1) } },
-    async ({ id }) => run(() => client.post(`/agent/intents/${id}/scan`, {}))
+    { description: "Trigger an on-demand drift scan for an intent.", inputSchema: { id: idPathSegmentSchema } },
+    async ({ id }) => run(() => client.post(`/agent/intents/${encodePathSegment(id)}/scan`, {}))
   );
   server.registerTool(
     "compile_intent",
     {
       description: "Compile a natural-language description into structured intent rules (preview, does not persist).",
       inputSchema: {
-        description: z4.string().min(1).max(4e3),
-        collection: z4.string().min(1).max(120)
+        description: z5.string().min(1).max(4e3),
+        collection: z5.string().min(1).max(120)
       }
     },
     async (input) => run(() => client.post("/agent/intents/compile", input))
@@ -587,21 +601,21 @@ function registerAgentTools(server, client) {
     {
       description: "Trigger a manual run of a flow with an optional input payload.",
       inputSchema: {
-        id: z4.string().min(1),
-        input: z4.record(z4.unknown()).optional().describe("Initial context passed to the flow.")
+        id: idPathSegmentSchema,
+        input: z5.record(z5.unknown()).optional().describe("Initial context passed to the flow.")
       }
     },
-    async ({ id, input }) => run(() => client.post(`/flows/${id}/run`, input ?? {}))
+    async ({ id, input }) => run(() => client.post(`/flows/${encodePathSegment(id)}/run`, input ?? {}))
   );
   server.registerTool(
     "list_flow_runs",
-    { description: "List recent runs of a flow.", inputSchema: { id: z4.string().min(1) } },
-    async ({ id }) => run(() => client.get(`/flows/${id}/runs`))
+    { description: "List recent runs of a flow.", inputSchema: { id: idPathSegmentSchema } },
+    async ({ id }) => run(() => client.get(`/flows/${encodePathSegment(id)}/runs`))
   );
 }
 
 // src/tools/api-keys.ts
-import { z as z5 } from "zod";
+import { z as z6 } from "zod";
 function registerApiKeyTools(server, client) {
   server.registerTool(
     "list_api_keys",
@@ -610,18 +624,18 @@ function registerApiKeyTools(server, client) {
   );
   server.registerTool(
     "get_api_key",
-    { description: "Get a single API key by id.", inputSchema: { id: z5.string().min(1) } },
-    async ({ id }) => run(() => client.get(`/api-keys/${id}`))
+    { description: "Get a single API key by id.", inputSchema: { id: idPathSegmentSchema } },
+    async ({ id }) => run(() => client.get(`/api-keys/${encodePathSegment(id)}`))
   );
   server.registerTool(
     "create_api_key",
     {
       description: "Create a new API key. The plaintext token is returned ONCE in the response \u2014 surface it to the user and tell them it cannot be retrieved again.",
       inputSchema: {
-        name: z5.string().min(1).max(96),
-        description: z5.string().max(512).optional(),
-        expiresAt: z5.string().datetime().nullable().optional(),
-        metadata: z5.record(z5.unknown()).optional()
+        name: z6.string().min(1).max(96),
+        description: z6.string().max(512).optional(),
+        expiresAt: z6.string().datetime().nullable().optional(),
+        metadata: z6.record(z6.unknown()).optional()
       }
     },
     async (input) => run(() => client.post("/api-keys", input))
@@ -631,46 +645,46 @@ function registerApiKeyTools(server, client) {
     {
       description: "Rotate an API key \u2014 issues a new token (returned once) and invalidates the old one. DESTRUCTIVE for existing integrations \u2014 pass confirm=true.",
       inputSchema: {
-        id: z5.string().min(1),
-        expiresAt: z5.string().datetime().nullable().optional(),
-        confirm: z5.literal(true).describe(confirmDescription)
+        id: idPathSegmentSchema,
+        expiresAt: z6.string().datetime().nullable().optional(),
+        confirm: z6.literal(true).describe(confirmDescription)
       }
     },
-    async ({ id, expiresAt }) => run(() => client.post(`/api-keys/${id}/rotate`, expiresAt !== void 0 ? { expiresAt } : {}))
+    async ({ id, expiresAt }) => run(() => client.post(`/api-keys/${encodePathSegment(id)}/rotate`, expiresAt !== void 0 ? { expiresAt } : {}))
   );
   server.registerTool(
     "revoke_api_key",
     {
       description: "Revoke an API key permanently. DESTRUCTIVE \u2014 pass confirm=true.",
-      inputSchema: { id: z5.string().min(1), confirm: z5.literal(true).describe(confirmDescription) }
+      inputSchema: { id: idPathSegmentSchema, confirm: z6.literal(true).describe(confirmDescription) }
     },
-    async ({ id }) => run(() => client.post(`/api-keys/${id}/revoke`, {}))
+    async ({ id }) => run(() => client.post(`/api-keys/${encodePathSegment(id)}/revoke`, {}))
   );
   server.registerTool(
     "attach_api_key_role",
     {
       description: "Attach a role to an API key (grants the role\u2019s policies to the key).",
       inputSchema: {
-        id: z5.string().min(1).describe("API key id."),
-        roleId: z5.string().min(1),
-        priority: z5.number().int().optional(),
-        overrideWarnings: z5.boolean().optional()
+        id: idPathSegmentSchema.describe("API key id."),
+        roleId: idPathSegmentSchema,
+        priority: z6.number().int().optional(),
+        overrideWarnings: z6.boolean().optional()
       }
     },
-    async ({ id, ...body }) => run(() => client.post(`/api-keys/${id}/roles`, body))
+    async ({ id, ...body }) => run(() => client.post(`/api-keys/${encodePathSegment(id)}/roles`, body))
   );
   server.registerTool(
     "detach_api_key_role",
     {
       description: "Detach a role from an API key. DESTRUCTIVE \u2014 pass confirm=true.",
       inputSchema: {
-        id: z5.string().min(1).describe("API key id."),
-        roleId: z5.string().min(1),
-        confirm: z5.literal(true).describe(confirmDescription)
+        id: idPathSegmentSchema.describe("API key id."),
+        roleId: idPathSegmentSchema,
+        confirm: z6.literal(true).describe(confirmDescription)
       }
     },
     async ({ id, roleId }) => run(async () => {
-      await client.delete(`/api-keys/${id}/roles/${roleId}`);
+      await client.delete(`/api-keys/${encodePathSegment(id)}/roles/${encodePathSegment(roleId)}`);
       return okText(`Role "${roleId}" detached from API key "${id}".`);
     })
   );
@@ -679,73 +693,72 @@ function registerApiKeyTools(server, client) {
     {
       description: "Attach a policy directly to an API key.",
       inputSchema: {
-        id: z5.string().min(1).describe("API key id."),
-        policyId: z5.string().min(1),
-        priority: z5.number().int().optional(),
-        overrideWarnings: z5.boolean().optional()
+        id: idPathSegmentSchema.describe("API key id."),
+        policyId: idPathSegmentSchema,
+        priority: z6.number().int().optional(),
+        overrideWarnings: z6.boolean().optional()
       }
     },
-    async ({ id, ...body }) => run(() => client.post(`/api-keys/${id}/policies`, body))
+    async ({ id, ...body }) => run(() => client.post(`/api-keys/${encodePathSegment(id)}/policies`, body))
   );
   server.registerTool(
     "detach_api_key_policy",
     {
       description: "Detach a policy from an API key. DESTRUCTIVE \u2014 pass confirm=true.",
       inputSchema: {
-        id: z5.string().min(1).describe("API key id."),
-        policyId: z5.string().min(1),
-        confirm: z5.literal(true).describe(confirmDescription)
+        id: idPathSegmentSchema.describe("API key id."),
+        policyId: idPathSegmentSchema,
+        confirm: z6.literal(true).describe(confirmDescription)
       }
     },
     async ({ id, policyId }) => run(async () => {
-      await client.delete(`/api-keys/${id}/policies/${policyId}`);
+      await client.delete(`/api-keys/${encodePathSegment(id)}/policies/${encodePathSegment(policyId)}`);
       return okText(`Policy "${policyId}" detached from API key "${id}".`);
     })
   );
 }
 
 // src/tools/collections.ts
-import { z as z6 } from "zod";
-var collectionNameSchema = z6.string().min(1).max(63).regex(/^[a-z][a-z0-9_]{0,62}$/, "Must be lowercase, start with a letter, only a-z0-9_");
-var collectionInputSchema = z6.object({
+import { z as z7 } from "zod";
+var collectionInputSchema = z7.object({
   name: collectionNameSchema,
-  label: z6.string().optional(),
-  pluralLabel: z6.string().optional(),
-  hidden: z6.boolean().optional(),
-  singleton: z6.boolean().optional(),
-  icon: z6.string().optional(),
-  color: z6.string().optional(),
-  note: z6.string().optional(),
-  primaryKeyField: z6.string().optional(),
-  primaryKeyType: z6.enum(["nanoid", "uuid", "integer", "bigInteger", "string"]).optional(),
-  storageMode: z6.enum(["jsonb", "materialized", "physical", "external"]).optional(),
-  displayTemplate: z6.string().optional(),
-  sortField: z6.string().optional(),
-  archiveField: z6.string().optional(),
-  archiveValue: z6.string().optional(),
-  unarchiveValue: z6.string().optional(),
-  accountability: z6.enum(["all", "activity", "none"]).optional(),
-  versioning: z6.boolean().optional()
+  label: z7.string().optional(),
+  pluralLabel: z7.string().optional(),
+  hidden: z7.boolean().optional(),
+  singleton: z7.boolean().optional(),
+  icon: z7.string().optional(),
+  color: z7.string().optional(),
+  note: z7.string().optional(),
+  primaryKeyField: z7.string().optional(),
+  primaryKeyType: z7.enum(["nanoid", "uuid", "integer", "bigInteger", "string"]).optional(),
+  storageMode: z7.enum(["jsonb", "materialized", "physical", "external"]).optional(),
+  displayTemplate: z7.string().optional(),
+  sortField: z7.string().optional(),
+  archiveField: z7.string().optional(),
+  archiveValue: z7.string().optional(),
+  unarchiveValue: z7.string().optional(),
+  accountability: z7.enum(["all", "activity", "none"]).optional(),
+  versioning: z7.boolean().optional()
 });
-var fieldInputSchema = z6.object({
-  name: collectionNameSchema,
-  type: z6.string().min(1),
-  interface: z6.string().min(1),
-  display: z6.string().optional(),
-  label: z6.string().optional(),
-  note: z6.string().optional(),
-  nullable: z6.boolean().optional(),
-  unique: z6.boolean().optional(),
-  indexed: z6.boolean().optional(),
-  searchable: z6.boolean().optional(),
-  required: z6.boolean().optional(),
-  readonly: z6.boolean().optional(),
-  hidden: z6.boolean().optional(),
-  width: z6.enum(["half", "full", "fill"]).optional(),
-  sortOrder: z6.number().int().optional(),
-  group: z6.string().optional(),
-  options: z6.record(z6.unknown()).optional(),
-  defaultValue: z6.unknown().optional()
+var fieldInputSchema = z7.object({
+  name: fieldNameSchema,
+  type: z7.string().min(1),
+  interface: z7.string().min(1),
+  display: z7.string().optional(),
+  label: z7.string().optional(),
+  note: z7.string().optional(),
+  nullable: z7.boolean().optional(),
+  unique: z7.boolean().optional(),
+  indexed: z7.boolean().optional(),
+  searchable: z7.boolean().optional(),
+  required: z7.boolean().optional(),
+  readonly: z7.boolean().optional(),
+  hidden: z7.boolean().optional(),
+  width: z7.enum(["half", "full", "fill"]).optional(),
+  sortOrder: z7.number().int().optional(),
+  group: z7.string().optional(),
+  options: z7.record(z7.unknown()).optional(),
+  defaultValue: z7.unknown().optional()
 });
 function formatError2(err) {
   if (err instanceof LumiBaseApiError) {
@@ -773,11 +786,11 @@ function registerCollectionTools(server, client) {
     "get_collection",
     {
       description: "Get a collection with its compiled schema (all fields, system fields, meta).",
-      inputSchema: { name: z6.string().min(1) }
+      inputSchema: { name: collectionNameSchema }
     },
     async ({ name }) => {
       try {
-        const data = await client.get(`/collections/${name}/compiled`);
+        const data = await client.get(`/collections/${encodePathSegment(name)}/compiled`);
         return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
       } catch (err) {
         return { content: [{ type: "text", text: `Error: ${formatError2(err)}` }], isError: true };
@@ -804,13 +817,13 @@ function registerCollectionTools(server, client) {
     {
       description: "Update metadata on an existing collection (label, icon, note, accountability, etc.).",
       inputSchema: {
-        name: z6.string().min(1),
+        name: collectionNameSchema,
         patch: collectionInputSchema.omit({ name: true }).partial()
       }
     },
     async ({ name, patch }) => {
       try {
-        const data = await client.patch(`/collections/${name}`, patch);
+        const data = await client.patch(`/collections/${encodePathSegment(name)}`, patch);
         return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
       } catch (err) {
         return { content: [{ type: "text", text: `Error: ${formatError2(err)}` }], isError: true };
@@ -822,13 +835,13 @@ function registerCollectionTools(server, client) {
     {
       description: "Delete a collection and all its items. DESTRUCTIVE \u2014 cannot be undone. You MUST pass confirm=true explicitly after warning the user.",
       inputSchema: {
-        name: z6.string().min(1),
-        confirm: z6.literal(true).describe("Must be true to confirm destructive operation")
+        name: collectionNameSchema,
+        confirm: z7.literal(true).describe("Must be true to confirm destructive operation")
       }
     },
     async ({ name, confirm: _ }) => {
       try {
-        await client.delete(`/collections/${name}`);
+        await client.delete(`/collections/${encodePathSegment(name)}`);
         return { content: [{ type: "text", text: `Collection "${name}" deleted.` }] };
       } catch (err) {
         return { content: [{ type: "text", text: `Error: ${formatError2(err)}` }], isError: true };
@@ -840,10 +853,10 @@ function registerCollectionTools(server, client) {
     {
       description: "Preview what would change if you applied a schema update. Returns added/modified/removed fields and any risky changes. Always call this before apply_schema to check for breaking changes.",
       inputSchema: {
-        name: z6.string().min(1),
-        fields: z6.array(fieldInputSchema).optional(),
-        label: z6.string().optional(),
-        note: z6.string().optional()
+        name: collectionNameSchema,
+        fields: z7.array(fieldInputSchema).optional(),
+        label: z7.string().optional(),
+        note: z7.string().optional()
       }
     },
     async (input) => {
@@ -860,23 +873,26 @@ function registerCollectionTools(server, client) {
     {
       description: "Atomically apply a schema migration to a collection (add/update/remove fields and relations). Call diff_schema first to preview changes. Pass confirmRiskyChange=true on field inputs that have risky changes.",
       inputSchema: {
-        name: z6.string().min(1),
-        fields: z6.array(
+        name: collectionNameSchema,
+        fields: z7.array(
           fieldInputSchema.extend({
-            renameFrom: z6.string().optional(),
-            confirmRiskyChange: z6.boolean().optional()
+            renameFrom: fieldNameSchema.optional(),
+            confirmRiskyChange: z7.boolean().optional()
           })
         ).optional(),
-        label: z6.string().optional(),
-        note: z6.string().optional(),
-        accountability: z6.enum(["all", "activity", "none"]).optional(),
-        versioning: z6.boolean().optional()
+        label: z7.string().optional(),
+        note: z7.string().optional(),
+        accountability: z7.enum(["all", "activity", "none"]).optional(),
+        versioning: z7.boolean().optional()
       }
     },
     async (input) => {
       try {
         const { name, ...rest } = input;
-        const data = await client.put(`/collections/${name}/schema`, rest);
+        const data = await client.put(
+          `/collections/${encodePathSegment(name)}/schema`,
+          rest
+        );
         return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
       } catch (err) {
         return { content: [{ type: "text", text: `Error: ${formatError2(err)}` }], isError: true };
@@ -886,34 +902,34 @@ function registerCollectionTools(server, client) {
 }
 
 // src/tools/content-config.ts
-import { z as z7 } from "zod";
-var presetSchema = z7.object({
-  bookmark: z7.string().nullable().optional(),
-  collection: z7.string(),
-  userId: z7.string().nullable().optional(),
-  roleId: z7.string().nullable().optional(),
-  layout: z7.string().optional(),
-  layoutQuery: z7.record(z7.unknown()).optional(),
-  layoutOptions: z7.record(z7.unknown()).optional(),
-  search: z7.string().nullable().optional(),
-  filter: z7.record(z7.unknown()).optional(),
-  icon: z7.string().nullable().optional(),
-  color: z7.string().nullable().optional(),
-  refreshInterval: z7.number().int().min(0).optional()
+import { z as z8 } from "zod";
+var presetSchema = z8.object({
+  bookmark: z8.string().nullable().optional(),
+  collection: z8.string(),
+  userId: z8.string().nullable().optional(),
+  roleId: z8.string().nullable().optional(),
+  layout: z8.string().optional(),
+  layoutQuery: z8.record(z8.unknown()).optional(),
+  layoutOptions: z8.record(z8.unknown()).optional(),
+  search: z8.string().nullable().optional(),
+  filter: z8.record(z8.unknown()).optional(),
+  icon: z8.string().nullable().optional(),
+  color: z8.string().nullable().optional(),
+  refreshInterval: z8.number().int().min(0).optional()
 });
-var translationSchema = z7.object({
-  language: z7.string(),
-  namespace: z7.string(),
-  key: z7.string(),
-  value: z7.string(),
-  status: z7.string().optional()
+var translationSchema = z8.object({
+  language: z8.string(),
+  namespace: z8.string(),
+  key: z8.string(),
+  value: z8.string(),
+  status: z8.string().optional()
 });
 function registerContentConfigTools(server, client) {
   registerCrud(server, client, {
     basePath: "/presets",
     resource: "preset",
     namePrefix: "preset",
-    listQuery: { collection: z7.string().optional() },
+    listQuery: { collection: z8.string().optional() },
     createSchema: presetSchema.shape,
     updateSchema: presetSchema.partial().shape
   });
@@ -922,8 +938,8 @@ function registerContentConfigTools(server, client) {
     resource: "translation",
     namePrefix: "translation",
     listQuery: {
-      namespace: z7.string().optional(),
-      language: z7.string().optional()
+      namespace: z8.string().optional(),
+      language: z8.string().optional()
     },
     createSchema: translationSchema.shape,
     updateSchema: translationSchema.partial().shape
@@ -932,7 +948,7 @@ function registerContentConfigTools(server, client) {
     "list_settings",
     {
       description: "List site settings, optionally filtered by scope.",
-      inputSchema: { scope: z7.string().optional() }
+      inputSchema: { scope: z8.string().optional() }
     },
     async ({ scope }) => run(() => client.get(`/settings${scope ? `?scope=${encodeURIComponent(scope)}` : ""}`))
   );
@@ -940,18 +956,18 @@ function registerContentConfigTools(server, client) {
     "get_setting",
     {
       description: "Get a single setting by key.",
-      inputSchema: { key: z7.string().min(1) }
+      inputSchema: { key: idPathSegmentSchema }
     },
-    async ({ key }) => run(() => client.get(`/settings/${encodeURIComponent(key)}`))
+    async ({ key }) => run(() => client.get(`/settings/${encodePathSegment(key)}`))
   );
   server.registerTool(
     "upsert_setting",
     {
       description: "Create or update a setting (upsert by key).",
       inputSchema: {
-        key: z7.string().min(1),
-        value: z7.record(z7.unknown()).describe("Arbitrary JSON value object for the setting."),
-        scope: z7.string().optional()
+        key: idPathSegmentSchema,
+        value: z8.record(z8.unknown()).describe("Arbitrary JSON value object for the setting."),
+        scope: z8.string().optional()
       }
     },
     async (input) => run(() => client.post("/settings", input))
@@ -961,29 +977,29 @@ function registerContentConfigTools(server, client) {
     {
       description: "Delete a setting by key. DESTRUCTIVE \u2014 warn the user first and pass confirm=true.",
       inputSchema: {
-        key: z7.string().min(1),
-        confirm: z7.literal(true).describe(confirmDescription)
+        key: idPathSegmentSchema,
+        confirm: z8.literal(true).describe(confirmDescription)
       }
     },
     async ({ key }) => run(async () => {
-      await client.delete(`/settings/${encodeURIComponent(key)}`);
+      await client.delete(`/settings/${encodePathSegment(key)}`);
       return okText(`Setting "${key}" deleted.`);
     })
   );
 }
 
 // src/tools/extensions.ts
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 var EXTENSION_TYPES = ["interface", "display", "layout", "panel", "module", "hook", "endpoint"];
-var extensionSchema = z8.object({
-  key: z8.string().regex(/^[a-z0-9_:-]+$/).optional(),
-  name: z8.string().min(1),
-  version: z8.string().min(1),
-  type: z8.enum(EXTENSION_TYPES),
-  enabled: z8.boolean().optional(),
-  bundleUrl: z8.string().min(1).describe("https:, http:, or data:text/javascript bundle URL."),
-  manifest: z8.record(z8.string()).optional(),
-  capabilities: z8.array(z8.string()).optional()
+var extensionSchema = z9.object({
+  key: z9.string().regex(/^[a-z0-9_:-]+$/).optional(),
+  name: z9.string().min(1),
+  version: z9.string().min(1),
+  type: z9.enum(EXTENSION_TYPES),
+  enabled: z9.boolean().optional(),
+  bundleUrl: z9.string().min(1).describe("https:, http:, or data:text/javascript bundle URL."),
+  manifest: z9.record(z9.string()).optional(),
+  capabilities: z9.array(z9.string()).optional()
 });
 function registerExtensionTools(server, client) {
   server.registerTool(
@@ -1003,18 +1019,18 @@ function registerExtensionTools(server, client) {
     "update_extension",
     {
       description: "Update an installed extension (enable/disable, version, config). Partial PATCH.",
-      inputSchema: { id: z8.string().min(1), ...extensionSchema.partial().shape }
+      inputSchema: { id: idPathSegmentSchema, ...extensionSchema.partial().shape }
     },
-    async ({ id, ...patch }) => run(() => client.patch(`/extensions/${id}`, patch))
+    async ({ id, ...patch }) => run(() => client.patch(`/extensions/${encodePathSegment(id)}`, patch))
   );
   server.registerTool(
     "uninstall_extension",
     {
       description: "Uninstall an extension from the site. DESTRUCTIVE \u2014 pass confirm=true.",
-      inputSchema: { id: z8.string().min(1), confirm: z8.literal(true).describe(confirmDescription) }
+      inputSchema: { id: idPathSegmentSchema, confirm: z9.literal(true).describe(confirmDescription) }
     },
     async ({ id }) => run(async () => {
-      await client.delete(`/extensions/${id}`);
+      await client.delete(`/extensions/${encodePathSegment(id)}`);
       return okText(`Extension "${id}" uninstalled.`);
     })
   );
@@ -1023,12 +1039,12 @@ function registerExtensionTools(server, client) {
     {
       description: "Browse the published extension marketplace.",
       inputSchema: {
-        q: z8.string().optional(),
-        category: z8.string().optional(),
-        tags: z8.string().optional().describe("Comma-separated tags."),
-        sort: z8.string().optional(),
-        page: z8.number().int().min(1).optional(),
-        perPage: z8.number().int().min(1).optional()
+        q: z9.string().optional(),
+        category: z9.string().optional(),
+        tags: z9.string().optional().describe("Comma-separated tags."),
+        sort: z9.string().optional(),
+        page: z9.number().int().min(1).optional(),
+        perPage: z9.number().int().min(1).optional()
       }
     },
     async (args) => run(
@@ -1041,9 +1057,9 @@ function registerExtensionTools(server, client) {
     "get_marketplace_extension",
     {
       description: "Get a single marketplace extension by slug.",
-      inputSchema: { slug: z8.string().min(1) }
+      inputSchema: { slug: idPathSegmentSchema }
     },
-    async ({ slug }) => run(() => client.get(`/marketplace/extensions/${slug}`))
+    async ({ slug }) => run(() => client.get(`/marketplace/extensions/${encodePathSegment(slug)}`))
   );
   server.registerTool(
     "list_marketplace_updates",
@@ -1054,22 +1070,22 @@ function registerExtensionTools(server, client) {
     "install_marketplace_extension",
     {
       description: "Install a published marketplace extension onto the active site by slug.",
-      inputSchema: { slug: z8.string().min(1) }
+      inputSchema: { slug: idPathSegmentSchema }
     },
-    async ({ slug }) => run(() => client.post(`/marketplace/extensions/${slug}/install`, {}))
+    async ({ slug }) => run(() => client.post(`/marketplace/extensions/${encodePathSegment(slug)}/install`, {}))
   );
   server.registerTool(
     "publish_extension",
     {
       description: "Publish an extension to the marketplace (signs + marks it published).",
       inputSchema: {
-        extensionId: z8.string().min(1),
-        marketplaceSlug: z8.string().min(1),
-        publisher: z8.record(z8.unknown()).optional(),
-        signature: z8.string().optional(),
-        signatureAlg: z8.string().optional(),
-        publisherKeyId: z8.string().optional(),
-        bundleSha256: z8.string().optional()
+        extensionId: z9.string().min(1),
+        marketplaceSlug: z9.string().min(1),
+        publisher: z9.record(z9.unknown()).optional(),
+        signature: z9.string().optional(),
+        signatureAlg: z9.string().optional(),
+        publisherKeyId: z9.string().optional(),
+        bundleSha256: z9.string().optional()
       }
     },
     async (input) => run(() => client.post("/marketplace/publish", input))
@@ -1077,40 +1093,39 @@ function registerExtensionTools(server, client) {
 }
 
 // src/tools/fields.ts
-import { z as z9 } from "zod";
-var namePattern = /^[a-z][a-z0-9_]{0,62}$/;
-var fieldInputSchema2 = z9.object({
-  type: z9.string().min(1).describe(
+import { z as z10 } from "zod";
+var fieldInputSchema2 = z10.object({
+  type: z10.string().min(1).describe(
     "Storage type: string, text, integer, bigInteger, float, decimal, boolean, date, dateTime, time, json, uuid, csv, hash, alias"
   ),
-  interface: z9.string().min(1).describe(
+  interface: z10.string().min(1).describe(
     "UI widget: input, textarea, select, toggle, datetime, file, image, repeater, relation-m2o, relation-o2m, relation-m2m, code, markdown, wysiwyg, \u2026"
   ),
-  display: z9.string().optional(),
-  label: z9.string().optional(),
-  note: z9.string().optional(),
-  defaultValue: z9.unknown().optional(),
-  nullable: z9.boolean().optional().default(true),
-  unique: z9.boolean().optional().default(false),
-  indexed: z9.boolean().optional().default(false),
-  searchable: z9.boolean().optional().default(false),
-  length: z9.number().int().positive().optional(),
-  precision: z9.number().int().positive().optional(),
-  scale: z9.number().int().min(0).optional(),
-  special: z9.array(z9.string()).optional(),
-  options: z9.record(z9.unknown()).optional(),
-  displayOptions: z9.record(z9.unknown()).optional(),
-  conditions: z9.array(z9.unknown()).optional(),
-  required: z9.boolean().optional().default(false),
-  readonly: z9.boolean().optional().default(false),
-  hidden: z9.boolean().optional().default(false),
-  encrypted: z9.boolean().optional().default(false),
-  versioned: z9.boolean().optional().default(false),
-  width: z9.enum(["half", "full", "fill"]).optional().default("full"),
-  group: z9.string().optional(),
-  sortOrder: z9.number().int().optional(),
-  renameFrom: z9.string().regex(namePattern).optional().describe("Previous field name if this is a rename operation"),
-  confirmRiskyChange: z9.boolean().optional().describe("Set true to confirm type-change or destructive migration")
+  display: z10.string().optional(),
+  label: z10.string().optional(),
+  note: z10.string().optional(),
+  defaultValue: z10.unknown().optional(),
+  nullable: z10.boolean().optional().default(true),
+  unique: z10.boolean().optional().default(false),
+  indexed: z10.boolean().optional().default(false),
+  searchable: z10.boolean().optional().default(false),
+  length: z10.number().int().positive().optional(),
+  precision: z10.number().int().positive().optional(),
+  scale: z10.number().int().min(0).optional(),
+  special: z10.array(z10.string()).optional(),
+  options: z10.record(z10.unknown()).optional(),
+  displayOptions: z10.record(z10.unknown()).optional(),
+  conditions: z10.array(z10.unknown()).optional(),
+  required: z10.boolean().optional().default(false),
+  readonly: z10.boolean().optional().default(false),
+  hidden: z10.boolean().optional().default(false),
+  encrypted: z10.boolean().optional().default(false),
+  versioned: z10.boolean().optional().default(false),
+  width: z10.enum(["half", "full", "fill"]).optional().default("full"),
+  group: z10.string().optional(),
+  sortOrder: z10.number().int().optional(),
+  renameFrom: fieldNameSchema.optional().describe("Previous field name if this is a rename operation"),
+  confirmRiskyChange: z10.boolean().optional().describe("Set true to confirm type-change or destructive migration")
 });
 function formatError3(err) {
   if (err instanceof LumiBaseApiError) {
@@ -1124,12 +1139,12 @@ function registerFieldTools(server, client) {
     {
       description: "List all fields in a collection, including system fields.",
       inputSchema: {
-        collection: z9.string().min(1)
+        collection: collectionNameSchema
       }
     },
     async ({ collection }) => {
       try {
-        const data = await client.get(`/collections/${collection}/fields`);
+        const data = await client.get(`/collections/${encodePathSegment(collection)}/fields`);
         return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
       } catch (err) {
         return { content: [{ type: "text", text: `Error: ${formatError3(err)}` }], isError: true };
@@ -1141,15 +1156,15 @@ function registerFieldTools(server, client) {
     {
       description: 'Create or update a field in a collection. field_name must be lowercase snake_case (e.g. "published_at"). Common types: string (varchar), text (longtext), integer, boolean, dateTime, json, uuid. Common interfaces: input, textarea, datetime, toggle, select, file, markdown.',
       inputSchema: {
-        collection: z9.string().min(1),
-        field_name: z9.string().regex(namePattern, "Must be lowercase snake_case, start with a letter").describe("Machine name of the field"),
+        collection: collectionNameSchema,
+        field_name: fieldNameSchema.describe("Machine name of the field"),
         ...fieldInputSchema2.shape
       }
     },
     async ({ collection, field_name, ...fieldInput }) => {
       try {
         const data = await client.put(
-          `/collections/${collection}/fields/${field_name}`,
+          `/collections/${encodePathSegment(collection)}/fields/${encodePathSegment(field_name)}`,
           fieldInput
         );
         return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
@@ -1163,16 +1178,18 @@ function registerFieldTools(server, client) {
     {
       description: "Delete a field from a collection. Data stored in this field will be lost. Pass confirm=true to confirm the destructive operation.",
       inputSchema: {
-        collection: z9.string().min(1),
-        field_name: z9.string().min(1),
-        confirm: z9.literal(true).describe("Must be true to confirm destructive operation"),
-        force: z9.boolean().optional().describe("Force deletion even if risky (foreign keys, etc.)")
+        collection: collectionNameSchema,
+        field_name: fieldNameSchema,
+        confirm: z10.literal(true).describe("Must be true to confirm destructive operation"),
+        force: z10.boolean().optional().describe("Force deletion even if risky (foreign keys, etc.)")
       }
     },
     async ({ collection, field_name, force }) => {
       try {
         const qs = force ? "?force=true" : "";
-        await client.delete(`/collections/${collection}/fields/${field_name}${qs}`);
+        await client.delete(
+          `/collections/${encodePathSegment(collection)}/fields/${encodePathSegment(field_name)}${qs}`
+        );
         return {
           content: [{ type: "text", text: `Field "${field_name}" deleted from "${collection}".` }]
         };
@@ -1184,7 +1201,7 @@ function registerFieldTools(server, client) {
 }
 
 // src/tools/items.ts
-import { z as z10 } from "zod";
+import { z as z11 } from "zod";
 function formatError4(err) {
   if (err instanceof LumiBaseApiError) {
     return err.errors.map((e) => `[${e.code}] ${e.message}`).join("; ");
@@ -1205,19 +1222,19 @@ function registerItemTools(server, client) {
     {
       description: "List items from a collection with optional filtering, sorting, and pagination.",
       inputSchema: {
-        collection: z10.string().min(1),
-        limit: z10.number().int().min(1).max(200).optional().default(25),
-        offset: z10.number().int().min(0).optional().default(0),
-        status: z10.enum(["draft", "published", "archived"]).optional(),
-        sort: z10.string().optional().describe('Comma-separated field names; prefix with - for descending (e.g. "-created_at")'),
-        fields: z10.string().optional().describe('Comma-separated field names to return (e.g. "id,title,status")'),
-        search: z10.string().optional().describe("Full-text search across searchable fields")
+        collection: collectionNameSchema,
+        limit: z11.number().int().min(1).max(200).optional().default(25),
+        offset: z11.number().int().min(0).optional().default(0),
+        status: z11.enum(["draft", "published", "archived"]).optional(),
+        sort: z11.string().optional().describe('Comma-separated field names; prefix with - for descending (e.g. "-created_at")'),
+        fields: z11.string().optional().describe('Comma-separated field names to return (e.g. "id,title,status")'),
+        search: z11.string().optional().describe("Full-text search across searchable fields")
       }
     },
     async ({ collection, ...params }) => {
       try {
         const qs = buildQs2(params);
-        const data = await client.get(`/items/${collection}${qs}`);
+        const data = await client.get(`/items/${encodePathSegment(collection)}${qs}`);
         return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
       } catch (err) {
         return { content: [{ type: "text", text: `Error: ${formatError4(err)}` }], isError: true };
@@ -1229,15 +1246,17 @@ function registerItemTools(server, client) {
     {
       description: "Get a single item by ID from a collection.",
       inputSchema: {
-        collection: z10.string().min(1),
-        id: z10.string().min(1),
-        fields: z10.string().optional().describe("Comma-separated field names to return")
+        collection: collectionNameSchema,
+        id: idPathSegmentSchema,
+        fields: z11.string().optional().describe("Comma-separated field names to return")
       }
     },
     async ({ collection, id, fields }) => {
       try {
         const qs = buildQs2({ fields });
-        const data = await client.get(`/items/${collection}/${id}${qs}`);
+        const data = await client.get(
+          `/items/${encodePathSegment(collection)}/${encodePathSegment(id)}${qs}`
+        );
         return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
       } catch (err) {
         return { content: [{ type: "text", text: `Error: ${formatError4(err)}` }], isError: true };
@@ -1249,14 +1268,14 @@ function registerItemTools(server, client) {
     {
       description: "Create a new item in a collection.",
       inputSchema: {
-        collection: z10.string().min(1),
-        data: z10.record(z10.unknown()).describe("Field values for the new item"),
-        status: z10.enum(["draft", "published"]).optional().default("draft")
+        collection: collectionNameSchema,
+        data: z11.record(z11.unknown()).describe("Field values for the new item"),
+        status: z11.enum(["draft", "published"]).optional().default("draft")
       }
     },
     async ({ collection, data: itemData, status }) => {
       try {
-        const data = await client.post(`/items/${collection}`, {
+        const data = await client.post(`/items/${encodePathSegment(collection)}`, {
           ...itemData,
           status
         });
@@ -1271,14 +1290,17 @@ function registerItemTools(server, client) {
     {
       description: "Partially update an item (PATCH \u2014 only provided fields are changed).",
       inputSchema: {
-        collection: z10.string().min(1),
-        id: z10.string().min(1),
-        data: z10.record(z10.unknown()).describe("Fields to update")
+        collection: collectionNameSchema,
+        id: idPathSegmentSchema,
+        data: z11.record(z11.unknown()).describe("Fields to update")
       }
     },
     async ({ collection, id, data: itemData }) => {
       try {
-        const data = await client.patch(`/items/${collection}/${id}`, itemData);
+        const data = await client.patch(
+          `/items/${encodePathSegment(collection)}/${encodePathSegment(id)}`,
+          itemData
+        );
         return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
       } catch (err) {
         return { content: [{ type: "text", text: `Error: ${formatError4(err)}` }], isError: true };
@@ -1290,14 +1312,14 @@ function registerItemTools(server, client) {
     {
       description: "Soft-delete an item (sets deleted_at, recoverable). Pass confirm=true.",
       inputSchema: {
-        collection: z10.string().min(1),
-        id: z10.string().min(1),
-        confirm: z10.literal(true).describe("Must be true to confirm deletion")
+        collection: collectionNameSchema,
+        id: idPathSegmentSchema,
+        confirm: z11.literal(true).describe("Must be true to confirm deletion")
       }
     },
     async ({ collection, id }) => {
       try {
-        await client.delete(`/items/${collection}/${id}`);
+        await client.delete(`/items/${encodePathSegment(collection)}/${encodePathSegment(id)}`);
         return { content: [{ type: "text", text: `Item "${id}" deleted from "${collection}".` }] };
       } catch (err) {
         return { content: [{ type: "text", text: `Error: ${formatError4(err)}` }], isError: true };
@@ -1307,15 +1329,15 @@ function registerItemTools(server, client) {
 }
 
 // src/tools/ops.ts
-import { z as z11 } from "zod";
+import { z as z12 } from "zod";
 function registerOpsTools(server, client) {
   server.registerTool(
     "list_activity",
     {
       description: "List the site activity / audit trail (most recent first).",
       inputSchema: {
-        limit: z11.number().int().min(1).max(500).optional(),
-        offset: z11.number().int().min(0).optional()
+        limit: z12.number().int().min(1).max(500).optional(),
+        offset: z12.number().int().min(0).optional()
       }
     },
     async (args) => run(
@@ -1337,7 +1359,7 @@ function registerOpsTools(server, client) {
 }
 
 // src/tools/permissions.ts
-import { z as z12 } from "zod";
+import { z as z13 } from "zod";
 function registerPermissionTools(server, client) {
   server.registerTool(
     "get_my_permissions",
@@ -1352,9 +1374,9 @@ function registerPermissionTools(server, client) {
     {
       description: "Evaluate whether the current principal may perform an action on a collection (optionally against a specific item), returning { allowed, reason, fields }.",
       inputSchema: {
-        collection: z12.string().min(1),
-        action: z12.enum(["create", "read", "update", "delete", "share"]),
-        item: z12.record(z12.unknown()).optional().describe("Item payload to evaluate row-level rules against.")
+        collection: z13.string().min(1),
+        action: z13.enum(["create", "read", "update", "delete", "share"]),
+        item: z13.record(z13.unknown()).optional().describe("Item payload to evaluate row-level rules against.")
       }
     },
     async (input) => run(() => client.post("/permissions/check", input))
@@ -1362,21 +1384,21 @@ function registerPermissionTools(server, client) {
 }
 
 // src/tools/relations.ts
-import { z as z13 } from "zod";
+import { z as z14 } from "zod";
 var relationInputSchema = {
-  manyCollection: z13.string().min(1).describe('Collection that holds the foreign key (the "many" side).'),
-  manyField: z13.string().min(1).describe("Field on manyCollection that stores the relation."),
-  oneCollection: z13.string().min(1).describe('Related collection (the "one" side).'),
-  oneField: z13.string().nullable().optional(),
-  junctionCollection: z13.string().nullable().optional().describe("Junction table for m2m relations."),
-  type: z13.enum(["m2o", "o2m", "m2m", "m2a"]).optional(),
-  aliasField: z13.string().nullable().optional(),
-  relatedDisplayTemplate: z13.string().nullable().optional(),
-  junctionManyField: z13.string().nullable().optional(),
-  junctionOneField: z13.string().nullable().optional(),
-  sortField: z13.string().nullable().optional(),
-  onDelete: z13.enum(["restrict", "cascade", "set null", "no action"]).optional(),
-  meta: z13.record(z13.unknown()).optional()
+  manyCollection: z14.string().min(1).describe('Collection that holds the foreign key (the "many" side).'),
+  manyField: z14.string().min(1).describe("Field on manyCollection that stores the relation."),
+  oneCollection: z14.string().min(1).describe('Related collection (the "one" side).'),
+  oneField: z14.string().nullable().optional(),
+  junctionCollection: z14.string().nullable().optional().describe("Junction table for m2m relations."),
+  type: z14.enum(["m2o", "o2m", "m2m", "m2a"]).optional(),
+  aliasField: z14.string().nullable().optional(),
+  relatedDisplayTemplate: z14.string().nullable().optional(),
+  junctionManyField: z14.string().nullable().optional(),
+  junctionOneField: z14.string().nullable().optional(),
+  sortField: z14.string().nullable().optional(),
+  onDelete: z14.enum(["restrict", "cascade", "set null", "no action"]).optional(),
+  meta: z14.record(z14.unknown()).optional()
 };
 function registerRelationTools(server, client) {
   server.registerTool(
@@ -1397,31 +1419,31 @@ function registerRelationTools(server, client) {
     {
       description: "Delete a relation by id. DESTRUCTIVE \u2014 warn the user first and pass confirm=true.",
       inputSchema: {
-        id: z13.string().min(1),
-        confirm: z13.literal(true).describe(confirmDescription)
+        id: idPathSegmentSchema,
+        confirm: z14.literal(true).describe(confirmDescription)
       }
     },
     async ({ id }) => run(async () => {
-      await client.delete(`/relations/${id}`);
+      await client.delete(`/relations/${encodePathSegment(id)}`);
       return okText(`Relation "${id}" deleted.`);
     })
   );
 }
 
 // src/tools/search-media.ts
-import { z as z14 } from "zod";
+import { z as z15 } from "zod";
 function registerSearchMediaTools(server, client) {
   server.registerTool(
     "search",
     {
       description: "Full-text search within a collection. Returns ranked hits from the search backend. The `collection` parameter is required.",
       inputSchema: {
-        q: z14.string().min(1).describe("Query string."),
-        collection: z14.string().min(1).describe("Collection to search."),
-        filter: z14.string().optional().describe("Backend filter expression."),
-        sort: z14.string().optional().describe("Comma-separated sort fields."),
-        limit: z14.number().int().min(1).max(200).optional(),
-        offset: z14.number().int().min(0).optional()
+        q: z15.string().min(1).describe("Query string."),
+        collection: z15.string().min(1).describe("Collection to search."),
+        filter: z15.string().optional().describe("Backend filter expression."),
+        sort: z15.string().optional().describe("Comma-separated sort fields."),
+        limit: z15.number().int().min(1).max(200).optional(),
+        offset: z15.number().int().min(0).optional()
       }
     },
     async (args) => run(
@@ -1434,7 +1456,7 @@ function registerSearchMediaTools(server, client) {
     "list_media",
     {
       description: "List media asset keys, optionally filtered by key prefix.",
-      inputSchema: { prefix: z14.string().optional() }
+      inputSchema: { prefix: z15.string().optional() }
     },
     async ({ prefix }) => run(() => client.get(`/media${prefix ? `?prefix=${encodeURIComponent(prefix)}` : ""}`))
   );
@@ -1443,27 +1465,27 @@ function registerSearchMediaTools(server, client) {
     {
       description: "Delete a media asset by key. DESTRUCTIVE \u2014 warn the user first and pass confirm=true.",
       inputSchema: {
-        key: z14.string().min(1).describe("Full storage key of the asset."),
-        confirm: z14.literal(true).describe(confirmDescription)
+        key: mediaKeySchema.describe("Full storage key of the asset."),
+        confirm: z15.literal(true).describe(confirmDescription)
       }
     },
     async ({ key }) => run(async () => {
-      await client.delete(`/media/${key}`);
+      await client.delete(`/media/${encodeMediaKey(key)}`);
       return okText(`Media asset "${key}" deleted.`);
     })
   );
 }
 
 // src/tools/translation-memory.ts
-import { z as z15 } from "zod";
+import { z as z16 } from "zod";
 function registerTranslationMemoryTools(server, client) {
   server.registerTool(
     "list_tm",
     {
       description: "List translation-memory entries, optionally filtered by source/target language.",
       inputSchema: {
-        source: z15.string().optional().describe("Source language code."),
-        target: z15.string().optional().describe("Target language code.")
+        source: z16.string().optional().describe("Source language code."),
+        target: z16.string().optional().describe("Target language code.")
       }
     },
     async (args) => run(
@@ -1475,14 +1497,14 @@ function registerTranslationMemoryTools(server, client) {
     {
       description: "Add or update a translation-memory entry.",
       inputSchema: {
-        sourceLang: z15.string().min(2),
-        targetLang: z15.string().min(2),
-        sourceText: z15.string().min(1),
-        targetText: z15.string().min(1),
-        context: z15.string().optional(),
-        quality: z15.number().min(0).max(100).optional(),
-        source: z15.enum(["human", "mt", "imported"]).optional(),
-        provider: z15.string().optional()
+        sourceLang: z16.string().min(2),
+        targetLang: z16.string().min(2),
+        sourceText: z16.string().min(1),
+        targetText: z16.string().min(1),
+        context: z16.string().optional(),
+        quality: z16.number().min(0).max(100).optional(),
+        source: z16.enum(["human", "mt", "imported"]).optional(),
+        provider: z16.string().optional()
       }
     },
     async (input) => run(() => client.post("/tm", input))
@@ -1492,10 +1514,10 @@ function registerTranslationMemoryTools(server, client) {
     {
       description: "Fuzzy-match a query string against translation memory for a language pair.",
       inputSchema: {
-        query: z15.string().min(1),
-        sourceLang: z15.string().min(2),
-        targetLang: z15.string().min(2),
-        threshold: z15.number().min(0).max(100).optional().describe("Minimum match score (default 75).")
+        query: z16.string().min(1),
+        sourceLang: z16.string().min(2),
+        targetLang: z16.string().min(2),
+        threshold: z16.number().min(0).max(100).optional().describe("Minimum match score (default 75).")
       }
     },
     async (input) => run(() => client.post("/tm/lookup", input))
@@ -1505,10 +1527,10 @@ function registerTranslationMemoryTools(server, client) {
     {
       description: "Run the full translation pipeline (TM + glossary + MT provider) for a text.",
       inputSchema: {
-        text: z15.string().min(1),
-        from: z15.string().min(2),
-        to: z15.string().min(2),
-        provider: z15.string().optional()
+        text: z16.string().min(1),
+        from: z16.string().min(2),
+        to: z16.string().min(2),
+        provider: z16.string().optional()
       }
     },
     async (input) => run(() => client.post("/tm/translate", input))
@@ -1516,7 +1538,7 @@ function registerTranslationMemoryTools(server, client) {
 }
 
 // src/tools/users-teams.ts
-import { z as z16 } from "zod";
+import { z as z17 } from "zod";
 function registerUsersTeamsTools(server, client) {
   server.registerTool(
     "list_users",
@@ -1525,16 +1547,16 @@ function registerUsersTeamsTools(server, client) {
   );
   server.registerTool(
     "get_user",
-    { description: "Get a single user in the active site by id.", inputSchema: { id: z16.string().min(1) } },
-    async ({ id }) => run(() => client.get(`/users/${id}`))
+    { description: "Get a single user in the active site by id.", inputSchema: { id: idPathSegmentSchema } },
+    async ({ id }) => run(() => client.get(`/users/${encodePathSegment(id)}`))
   );
   server.registerTool(
     "invite_user",
     {
       description: "Invite a user to the site by email, optionally assigning a role. Sends an invite email.",
       inputSchema: {
-        email: z16.string().email(),
-        roleId: z16.string().optional()
+        email: z17.string().email(),
+        roleId: z17.string().optional()
       }
     },
     async (input) => run(() => client.post("/users/invite", input))
@@ -1544,21 +1566,21 @@ function registerUsersTeamsTools(server, client) {
     {
       description: "Update a user's site membership (role and/or status).",
       inputSchema: {
-        id: z16.string().min(1),
-        roleId: z16.string().nullable().optional(),
-        status: z16.string().optional().describe("e.g. active, suspended.")
+        id: idPathSegmentSchema,
+        roleId: z17.string().nullable().optional(),
+        status: z17.string().optional().describe("e.g. active, suspended.")
       }
     },
-    async ({ id, ...patch }) => run(() => client.patch(`/users/${id}`, patch))
+    async ({ id, ...patch }) => run(() => client.patch(`/users/${encodePathSegment(id)}`, patch))
   );
   server.registerTool(
     "remove_user",
     {
       description: "Remove a user from the site. DESTRUCTIVE \u2014 pass confirm=true.",
-      inputSchema: { id: z16.string().min(1), confirm: z16.literal(true).describe(confirmDescription) }
+      inputSchema: { id: idPathSegmentSchema, confirm: z17.literal(true).describe(confirmDescription) }
     },
     async ({ id }) => run(async () => {
-      await client.delete(`/users/${id}`);
+      await client.delete(`/users/${encodePathSegment(id)}`);
       return okText(`User "${id}" removed from the site.`);
     })
   );
@@ -1569,14 +1591,14 @@ function registerUsersTeamsTools(server, client) {
   );
   server.registerTool(
     "get_team",
-    { description: "Get a single team by id.", inputSchema: { id: z16.string().min(1) } },
-    async ({ id }) => run(() => client.get(`/teams/${id}`))
+    { description: "Get a single team by id.", inputSchema: { id: idPathSegmentSchema } },
+    async ({ id }) => run(() => client.get(`/teams/${encodePathSegment(id)}`))
   );
   server.registerTool(
     "create_team",
     {
       description: "Create a team.",
-      inputSchema: { name: z16.string().min(1).max(128), description: z16.string().nullable().optional() }
+      inputSchema: { name: z17.string().min(1).max(128), description: z17.string().nullable().optional() }
     },
     async (input) => run(() => client.post("/teams", input))
   );
@@ -1585,64 +1607,64 @@ function registerUsersTeamsTools(server, client) {
     {
       description: "Update a team (partial PATCH).",
       inputSchema: {
-        id: z16.string().min(1),
-        name: z16.string().min(1).max(128).optional(),
-        description: z16.string().nullable().optional()
+        id: idPathSegmentSchema,
+        name: z17.string().min(1).max(128).optional(),
+        description: z17.string().nullable().optional()
       }
     },
-    async ({ id, ...patch }) => run(() => client.patch(`/teams/${id}`, patch))
+    async ({ id, ...patch }) => run(() => client.patch(`/teams/${encodePathSegment(id)}`, patch))
   );
   server.registerTool(
     "delete_team",
     {
       description: "Delete a team. DESTRUCTIVE \u2014 pass confirm=true.",
-      inputSchema: { id: z16.string().min(1), confirm: z16.literal(true).describe(confirmDescription) }
+      inputSchema: { id: idPathSegmentSchema, confirm: z17.literal(true).describe(confirmDescription) }
     },
     async ({ id }) => run(async () => {
-      await client.delete(`/teams/${id}`);
+      await client.delete(`/teams/${encodePathSegment(id)}`);
       return okText(`Team "${id}" deleted.`);
     })
   );
   server.registerTool(
     "list_team_members",
-    { description: "List members of a team.", inputSchema: { id: z16.string().min(1).describe("Team id.") } },
-    async ({ id }) => run(() => client.get(`/teams/${id}/members`))
+    { description: "List members of a team.", inputSchema: { id: idPathSegmentSchema.describe("Team id.") } },
+    async ({ id }) => run(() => client.get(`/teams/${encodePathSegment(id)}/members`))
   );
   server.registerTool(
     "add_team_member",
     {
       description: "Add a user to a team.",
-      inputSchema: { id: z16.string().min(1).describe("Team id."), userId: z16.string().min(1) }
+      inputSchema: { id: idPathSegmentSchema.describe("Team id."), userId: idPathSegmentSchema }
     },
-    async ({ id, userId }) => run(() => client.post(`/teams/${id}/members`, { userId }))
+    async ({ id, userId }) => run(() => client.post(`/teams/${encodePathSegment(id)}/members`, { userId }))
   );
   server.registerTool(
     "remove_team_member",
     {
       description: "Remove a user from a team. DESTRUCTIVE \u2014 pass confirm=true.",
       inputSchema: {
-        id: z16.string().min(1).describe("Team id."),
-        userId: z16.string().min(1),
-        confirm: z16.literal(true).describe(confirmDescription)
+        id: idPathSegmentSchema.describe("Team id."),
+        userId: idPathSegmentSchema,
+        confirm: z17.literal(true).describe(confirmDescription)
       }
     },
     async ({ id, userId }) => run(async () => {
-      await client.delete(`/teams/${id}/members/${userId}`);
+      await client.delete(`/teams/${encodePathSegment(id)}/members/${encodePathSegment(userId)}`);
       return okText(`User "${userId}" removed from team "${id}".`);
     })
   );
 }
 
 // src/tools/webhooks.ts
-import { z as z17 } from "zod";
-var webhookSchema = z17.object({
-  name: z17.string().min(1).max(255),
-  url: z17.string().url(),
-  actions: z17.array(z17.string()).optional().describe("Item events that trigger the webhook (e.g. create, update, delete)."),
-  collections: z17.array(z17.string()).optional().describe("Collections to filter on (empty = all)."),
-  headers: z17.record(z17.string()).optional(),
-  status: z17.enum(["active", "inactive"]).optional(),
-  secret: z17.string().nullable().optional()
+import { z as z18 } from "zod";
+var webhookSchema = z18.object({
+  name: z18.string().min(1).max(255),
+  url: z18.string().url(),
+  actions: z18.array(z18.string()).optional().describe("Item events that trigger the webhook (e.g. create, update, delete)."),
+  collections: z18.array(z18.string()).optional().describe("Collections to filter on (empty = all)."),
+  headers: z18.record(z18.string()).optional(),
+  status: z18.enum(["active", "inactive"]).optional(),
+  secret: z18.string().nullable().optional()
 });
 function registerWebhookTools(server, client) {
   registerCrud(server, client, {