@pairsystems/goodmem-mcp 0.1.13 → 0.1.15

package/dist/index.js

@@ -20988,15 +20988,28 @@ var StdioServerTransport = class {
 // dist/index.js
 var goodmemBaseUrl = process.env.GOODMEM_BASE_URL || "";
 var goodmemApiKey = process.env.GOODMEM_API_KEY || "";
-var BASED_ON_GOODMEM_COMMIT = "82cedec39260bff105828bed1c1e779d9f1e811f";
+var BASED_ON_GOODMEM_COMMIT = "62c6d77befdfab1bfe38ef917c6a202f4569eec7";
 function isConfigured() {
-  return goodmemBaseUrl !== "" && goodmemApiKey !== "";
+  return goodmemBaseUrl !== "";
 }
-async function callApi(method, path, body, query) {
+function _buildUrl(base, path) {
+  const baseUrl = new URL(base);
+  const basePath = baseUrl.pathname.endsWith("/") ? baseUrl.pathname.slice(0, -1) : baseUrl.pathname;
+  const tail = path.startsWith("/") ? path : "/" + path;
+  baseUrl.pathname = basePath + tail;
+  baseUrl.search = "";
+  baseUrl.hash = "";
+  return baseUrl;
+}
+var DEFAULT_TIMEOUT_MS = 6e4;
+function _trimBody(text) {
+  return text.length > 500 ? text.slice(0, 500) + "...[truncated]" : text;
+}
+async function callApi(method, path, body, query, timeoutMs) {
   if (!isConfigured()) {
     throw new Error("GoodMem is not configured. Call the goodmem_configure tool first with your base_url and api_key, or set GOODMEM_BASE_URL and GOODMEM_API_KEY environment variables.");
   }
-  const url = new URL(path, goodmemBaseUrl);
+  const url = _buildUrl(goodmemBaseUrl, path);
   if (query) {
     for (const [k, v] of Object.entries(query)) {
       if (v !== void 0 && v !== null && v !== "")
@@ -21004,18 +21017,26 @@ async function callApi(method, path, body, query) {
     }
   }
   const headers = {
-    "Content-Type": "application/json",
-    "x-api-key": goodmemApiKey
+    "Content-Type": "application/json"
   };
+  if (goodmemApiKey !== "") {
+    headers["x-api-key"] = goodmemApiKey;
+  }
   const resp = await fetch(url.toString(), {
     method,
     headers,
-    signal: AbortSignal.timeout(3e4),
+    signal: AbortSignal.timeout(timeoutMs ?? DEFAULT_TIMEOUT_MS),
+    // ``x-api-key`` is a custom header — fetch/undici don't strip it on
+    // 3xx like they strip Authorization. ``redirect: "error"`` fails the
+    // request instead of carrying the key across a host boundary. BYO
+    // callers can implement their own redirect policy at a higher layer.
+    // amin3141 pre-GA blocker #2, cycle 14. ``inv-no-redirect-with-custom-auth-header``.
+    redirect: "error",
     ...body ? { body: JSON.stringify(body) } : {}
   });
   if (!resp.ok) {
     const text = await resp.text();
-    throw new Error(`GoodMem API error ${resp.status}: ${text}`);
+    throw new Error(`GoodMem API error ${resp.status}: ${_trimBody(text)}`);
   }
   const ct = resp.headers.get("content-type") || "";
   if (ct.includes("application/json")) {
@@ -21027,7 +21048,7 @@ async function callApiNdjson(method, path, body, query, timeoutSec) {
   if (!isConfigured()) {
     throw new Error("GoodMem is not configured. Call the goodmem_configure tool first with your base_url and api_key, or set GOODMEM_BASE_URL and GOODMEM_API_KEY environment variables.");
   }
-  const url = new URL(path, goodmemBaseUrl);
+  const url = _buildUrl(goodmemBaseUrl, path);
   if (query) {
     for (const [k, v] of Object.entries(query)) {
       if (v !== void 0 && v !== null && v !== "")
@@ -21036,18 +21057,22 @@ async function callApiNdjson(method, path, body, query, timeoutSec) {
   }
   const headers = {
     "Content-Type": "application/json",
-    "Accept": "application/x-ndjson",
-    "x-api-key": goodmemApiKey
+    "Accept": "application/x-ndjson"
   };
+  if (goodmemApiKey !== "") {
+    headers["x-api-key"] = goodmemApiKey;
+  }
   const resp = await fetch(url.toString(), {
     method,
     headers,
     signal: AbortSignal.timeout((timeoutSec ?? 200) * 1e3),
+    // See callApi for the redirect-policy rationale.
+    redirect: "error",
     ...body ? { body: JSON.stringify(body) } : {}
   });
   if (!resp.ok) {
     const text2 = await resp.text();
-    throw new Error(`GoodMem API error ${resp.status}: ${text2}`);
+    throw new Error(`GoodMem API error ${resp.status}: ${_trimBody(text2)}`);
   }
   const text = await resp.text();
   const lines = text.split("\n").map((line) => line.trim()).filter(Boolean);
@@ -21176,8 +21201,7 @@ var MODEL_REGISTRY = {
       },
       "supportedModalities": [
         "TEXT",
-        "IMAGE",
-        "PDF"
+        "IMAGE"
       ],
       "maxSequenceLength": 32768
     },
@@ -21639,114 +21663,6 @@ var MODEL_REGISTRY = {
         "TEXT"
       ],
       "maxContextLength": 128e3
-    },
-    "command-a-03-2025": {
-      "providerType": "COHERE",
-      "supportedModalities": [
-        "TEXT"
-      ],
-      "maxContextLength": 256e3
-    },
-    "command-r7b-12-2024": {
-      "providerType": "COHERE",
-      "supportedModalities": [
-        "TEXT"
-      ],
-      "maxContextLength": 128e3
-    },
-    "command-a-translate-08-2025": {
-      "providerType": "COHERE",
-      "supportedModalities": [
-        "TEXT"
-      ],
-      "maxContextLength": 8e3
-    },
-    "command-a-reasoning-08-2025": {
-      "providerType": "COHERE",
-      "supportedModalities": [
-        "TEXT"
-      ],
-      "maxContextLength": 256e3
-    },
-    "command-a-vision-07-2025": {
-      "providerType": "COHERE",
-      "supportedModalities": [
-        "TEXT",
-        "IMAGE"
-      ],
-      "maxContextLength": 128e3
-    },
-    "command-r-08-2024": {
-      "providerType": "COHERE",
-      "supportedModalities": [
-        "TEXT"
-      ],
-      "maxContextLength": 128e3
-    },
-    "command-r-plus-08-2024": {
-      "providerType": "COHERE",
-      "supportedModalities": [
-        "TEXT"
-      ],
-      "maxContextLength": 128e3
-    },
-    "c4ai-aya-expanse-8b": {
-      "providerType": "COHERE",
-      "supportedModalities": [
-        "TEXT"
-      ],
-      "maxContextLength": 8e3
-    },
-    "c4ai-aya-expanse-32b": {
-      "providerType": "COHERE",
-      "supportedModalities": [
-        "TEXT"
-      ],
-      "maxContextLength": 128e3
-    },
-    "c4ai-aya-vision-8b": {
-      "providerType": "COHERE",
-      "supportedModalities": [
-        "TEXT",
-        "IMAGE"
-      ],
-      "maxContextLength": 16e3
-    },
-    "c4ai-aya-vision-32b": {
-      "providerType": "COHERE",
-      "supportedModalities": [
-        "TEXT",
-        "IMAGE"
-      ],
-      "maxContextLength": 16e3
-    },
-    "command-r-03-2024": {
-      "providerType": "COHERE",
-      "supportedModalities": [
-        "TEXT"
-      ],
-      "maxContextLength": 128e3
-    },
-    "command-r-plus-04-2024": {
-      "providerType": "COHERE",
-      "supportedModalities": [
-        "TEXT"
-      ],
-      "maxContextLength": 128e3
-    },
-    "command": {
-      "providerType": "COHERE",
-      "supportedModalities": [
-        "TEXT"
-      ],
-      "maxContextLength": 4e3
-    },
-    "command-light": {
-      "providerType": "COHERE",
-      "supportedModalities": [
-        "TEXT"
-      ],
-      "maxContextLength": 4e3
     }
   },
   "rerankers": {
@@ -21927,36 +21843,43 @@ function autoInferFromRegistry(registryType, args) {
 }
 var server = new McpServer({
   name: "goodmem",
-  version: "0.1.13"
+  version: "0.1.15"
 });
-server.tool("goodmem_configure", "Configure GoodMem server connection. Call this before using other GoodMem tools if GOODMEM_BASE_URL and GOODMEM_API_KEY environment variables are not set. Session credentials override environment variables.", {
+server.tool("goodmem_configure", "Configure GoodMem server connection. Call this before using other GoodMem tools if GOODMEM_BASE_URL and GOODMEM_API_KEY environment variables are not set. Session credentials override environment variables. For bootstrap workflows that need to call /v1/system/info or /v1/system/init before keys exist, api_key may be omitted; most other tools will return AuthenticationException until a real key is provided.", {
   base_url: external_exports.string().describe("GoodMem server URL (e.g., https://your-server.example.com)"),
-  api_key: external_exports.string().describe("GoodMem API key (starts with gm_)")
+  api_key: external_exports.string().describe("GoodMem API key (starts with gm_). Omit for bootstrap-only sessions that call /v1/system/info or /v1/system/init.").optional()
 }, async (args) => {
   if (!/^https?:\/\//i.test(args.base_url)) {
-    return { content: [{ type: "text", text: `base_url must include a scheme (e.g., http://${args.base_url} or https://${args.base_url}).` }] };
+    return { isError: true, content: [{ type: "text", text: `base_url must include a scheme (e.g., http://${args.base_url} or https://${args.base_url}).` }] };
   }
   try {
-    const url = new URL("/v1/system/info", args.base_url);
+    const url = _buildUrl(args.base_url, "/v1/system/info");
+    const verifyHeaders = {};
+    if (args.api_key && args.api_key !== "") {
+      verifyHeaders["x-api-key"] = args.api_key;
+    }
     const resp = await fetch(url.toString(), {
-      headers: { "x-api-key": args.api_key },
-      signal: AbortSignal.timeout(1e4)
+      headers: verifyHeaders,
+      signal: AbortSignal.timeout(1e4),
+      // See callApi for the redirect-policy rationale.
+      redirect: "error"
     });
     if (!resp.ok) {
       const text = await resp.text();
-      return { content: [{ type: "text", text: `Connection failed (${resp.status}): ${text}. Credentials were NOT saved. Check your base_url and api_key.` }] };
+      return { isError: true, content: [{ type: "text", text: `Connection failed (${resp.status}): ${_trimBody(text)}. Credentials were NOT saved. Check your base_url and api_key.` }] };
     }
+    const info = await resp.json().catch(() => ({}));
     goodmemBaseUrl = args.base_url;
-    goodmemApiKey = args.api_key;
-    const info = await resp.json();
-    return { content: [{ type: "text", text: `Connected to GoodMem at ${goodmemBaseUrl}. Server version: ${info.version ?? "unknown"}.` }] };
+    goodmemApiKey = args.api_key ?? "";
+    const keyNote = goodmemApiKey === "" ? " (bootstrap-only session \u2014 no api_key set)" : "";
+    return { content: [{ type: "text", text: `Connected to GoodMem at ${goodmemBaseUrl}. Server version: ${info.version ?? "unknown"}.${keyNote}` }] };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     let hint = "Check your base_url.";
     if (msg.includes("CERT") || msg.includes("certificate") || msg.includes("self-signed") || msg.includes("self signed") || msg.includes("UNABLE_TO_VERIFY")) {
       hint = "TLS certificate error. If using self-signed certs, set NODE_TLS_REJECT_UNAUTHORIZED=0 (dev only) or NODE_EXTRA_CA_CERTS=/path/to/rootCA.pem in your MCP server env config.";
     }
-    return { content: [{ type: "text", text: `Could not connect to ${args.base_url}: ${msg}. Credentials were NOT saved. ${hint}` }] };
+    return { isError: true, content: [{ type: "text", text: `Could not connect to ${args.base_url}: ${msg}. Credentials were NOT saved. ${hint}` }] };
   }
 });
 server.tool("goodmem_lookup_model", "Look up a model in the registry to see its provider, endpoint, dimensions, and other auto-inferred fields. Use this to check what models are available before creating an embedder, LLM, or reranker.", {
@@ -21975,6 +21898,12 @@ server.tool("goodmem_lookup_model", "Look up a model in the registry to see its
           if (dims?.default !== void 0) {
             snakeEntry.dimensionality = dims.default;
           }
+          if (dims?.range !== void 0) {
+            snakeEntry.dimensions_range = dims.range;
+          }
+          if (dims?.allowed !== void 0) {
+            snakeEntry.dimensions_allowed = dims.allowed;
+          }
         } else {
           snakeEntry[camelToSnake(k)] = v;
         }
@@ -21988,22 +21917,24 @@ server.tool("goodmem_lookup_model", "Look up a model in the registry to see its
       }, null, 2) }] };
     }
   }
-  const allModels = Object.entries(MODEL_REGISTRY).flatMap(([type, models]) => Object.keys(models).map((m) => `${type.slice(0, -1)}: ${m}`));
-  return { content: [{ type: "text", text: `Model "${args.model_identifier}" not found in registry. Available models:
+  const filterTypes = args.type ? [args.type + "s"] : Object.keys(MODEL_REGISTRY);
+  const allModels = filterTypes.filter((t) => MODEL_REGISTRY[t]).flatMap((t) => Object.keys(MODEL_REGISTRY[t]).map((m) => `${t.slice(0, -1)}: ${m}`));
+  const scope = args.type ? `${args.type}s` : "any registry";
+  return { content: [{ type: "text", text: `Model "${args.model_identifier}" not found in ${scope}. Available models:
 ${allModels.join("\n")}` }] };
 });
 server.tool("goodmem_client_info", "Return the MCP client package version and the goodmem server commit it was built against. No server connection required.", {}, async () => {
   return { content: [{ type: "text", text: JSON.stringify({
-    mcpVersion: "0.1.13",
-    basedOnGoodmemCommit: BASED_ON_GOODMEM_COMMIT
+    mcp_version: "0.1.15",
+    based_on_goodmem_commit: BASED_ON_GOODMEM_COMMIT
   }, null, 2) }] };
 });
 function registerTools() {
-  server.tool("goodmem_admin_background_jobs_purge", "Purge completed background jobs", {
+  server.tool("goodmem_admin_background_jobs_purge", "Purge completed background jobs\n\nDeletes terminal background jobs older than a retention cutoff.", {
     older_than: external_exports.string().describe("ISO-8601 timestamp cutoff; only terminal jobs older than this instant are eligible."),
-    statuses: external_exports.array(external_exports.string()).describe("Optional terminal background job statuses to target for purging.").optional(),
+    statuses: external_exports.array(external_exports.enum(["BACKGROUND_JOB_SUCCEEDED", "BACKGROUND_JOB_FAILED", "BACKGROUND_JOB_CANCELED"])).describe("Optional terminal background job statuses to target for purging. If omitted, all terminal statuses are eligible. Canonical values are BACKGROUND_JOB_SUCCEEDED, BACKGROUND_JOB_FAILED, and BACKGROUND_JOB_CANCELED. Short aliases SUCCEEDED, FAILED, and CANCELED are also accepted for compatibility.").optional(),
     dry_run: external_exports.boolean().describe("If true, report purge counts without deleting any rows.").optional(),
-    limit: external_exports.number().int().describe("Maximum number of jobs to purge in this request.").optional()
+    limit: external_exports.number().int().describe("Maximum number of jobs to purge in this request. Must be >= 0; 0 means no limit.").optional()
   }, async (args) => {
     const body = {};
     if (args.older_than !== void 0)
@@ -22017,7 +21948,7 @@ function registerTools() {
     const result = await callApi("POST", `/v1/admin/background-jobs:purge`, body);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_admin_drain", "Request the server to enter drain mode", {
+  server.tool("goodmem_admin_drain", "Request the server to enter drain mode\n\nInitiates drain mode and optionally waits for the server to quiesce.", {
     timeout_sec: external_exports.number().int().describe("Maximum seconds to wait for the server to quiesce before returning.").optional(),
     reason: external_exports.string().describe("Human-readable reason for initiating drain mode.").optional(),
     wait_for_quiesce: external_exports.boolean().describe("If true, wait for in-flight requests to complete and the server to reach QUIESCED before responding.").optional()
@@ -22029,14 +21960,108 @@ function registerTools() {
       body["reason"] = args.reason;
     if (args.wait_for_quiesce !== void 0)
       body["waitForQuiesce"] = args.wait_for_quiesce;
-    const result = await callApi("POST", `/v1/admin:drain`, body);
+    const result = await callApi("POST", `/v1/admin:drain`, body, void 0, ((args.timeout_sec ?? 900) + 30) * 1e3);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_admin_license_reload", "Reload the active license from disk", {}, async (args) => {
+  server.tool("goodmem_admin_license_reload", "Reload the active license from disk\n\nTriggers the server to reload its license file from the configured directory and returns metadata about the currently active license.", {}, async (args) => {
     const result = await callApi("POST", `/v1/admin/license:reload`, void 0);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_apikeys_create", "Create a new API key", {
+  server.tool("goodmem_admin_retrieve_memory_log_policies_create", "Create a RetrieveMemory log policy\n\nCreates an immutable administrative policy that can automatically enable durable RetrieveMemory request logging.", {
+    policy_id: external_exports.string().describe("Optional client-provided policy UUID.").optional(),
+    display_name: external_exports.string().describe("Human-readable policy name."),
+    description: external_exports.string().describe("Optional operator description.").optional(),
+    condition: external_exports.object({
+      matchAll: external_exports.boolean().describe("When true, match every authenticated RetrieveMemory request. Defaults to false when omitted.").optional(),
+      anyOf: external_exports.array(external_exports.object({
+        requestorUserIds: external_exports.array(external_exports.string()).describe("Authenticated requestor user UUID strings.").optional(),
+        apiKeyIds: external_exports.array(external_exports.string()).describe("API key UUID strings used to authenticate RetrieveMemory requests.").optional(),
+        spaceIds: external_exports.array(external_exports.string()).describe("Post-permission accessible space UUID strings.").optional(),
+        apiKeyLabelSelectors: external_exports.record(external_exports.string(), external_exports.string()).describe("Exact API-key label selectors that must all match.").optional(),
+        spaceLabelSelectors: external_exports.record(external_exports.string(), external_exports.string()).describe("Exact space label selectors that must match at least one accessible space.").optional()
+      }).passthrough()).describe("OR clauses used for scoped matching. Required when matchAll is false or omitted, and must contain at least one non-empty clause.").optional()
+    }).passthrough().describe("Policy match condition."),
+    active_from: external_exports.number().int().describe("Inclusive activation time in milliseconds since epoch.").optional(),
+    active_until: external_exports.number().int().describe("Exclusive deactivation time in milliseconds since epoch.").optional(),
+    labels: external_exports.record(external_exports.string(), external_exports.string()).describe("Operator labels for listing and administration.").optional()
+  }, async (args) => {
+    const body = {};
+    if (args.policy_id !== void 0)
+      body["policyId"] = args.policy_id;
+    if (args.display_name !== void 0)
+      body["displayName"] = args.display_name;
+    if (args.description !== void 0)
+      body["description"] = args.description;
+    if (args.condition !== void 0)
+      body["condition"] = args.condition;
+    if (args.active_from !== void 0)
+      body["activeFrom"] = args.active_from;
+    if (args.active_until !== void 0)
+      body["activeUntil"] = args.active_until;
+    if (args.labels !== void 0)
+      body["labels"] = args.labels;
+    const result = await callApi("POST", `/v1/admin/retrieve-memory-log-policies`, body);
+    return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+  });
+  server.tool("goodmem_admin_retrieve_memory_log_policies_delete", "Delete a RetrieveMemory log policy\n\nIdempotently tombstones an immutable RetrieveMemory log policy.", {
+    id: external_exports.string().describe("The UUID of the policy to delete"),
+    reason: external_exports.string().describe("Optional tombstone reason.").optional()
+  }, async (args) => {
+    if (typeof args.id !== "string" || args.id === "") {
+      throw new Error("'id' must be a non-empty string");
+    }
+    const body = {};
+    if (args.reason !== void 0)
+      body["reason"] = args.reason;
+    await callApi("DELETE", `/v1/admin/retrieve-memory-log-policies/${encodeURIComponent(String(args.id))}`, body);
+    return { content: [{ type: "text", text: "Deleted successfully." }] };
+  });
+  server.tool("goodmem_admin_retrieve_memory_log_policies_get", "Get a RetrieveMemory log policy\n\nRetrieves a live RetrieveMemory log policy by UUID, or a tombstoned policy when include_deleted is true.", {
+    id: external_exports.string().describe("The UUID of the policy to retrieve"),
+    include_deleted: external_exports.boolean().describe("Whether to include tombstoned policies. Also accepts include_deleted.").optional()
+  }, async (args) => {
+    if (typeof args.id !== "string" || args.id === "") {
+      throw new Error("'id' must be a non-empty string");
+    }
+    const query = {};
+    if (args.include_deleted !== void 0)
+      query["includeDeleted"] = String(args.include_deleted);
+    const result = await callApi("GET", `/v1/admin/retrieve-memory-log-policies/${encodeURIComponent(String(args.id))}`, void 0, query);
+    return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+  });
+  server.tool("goodmem_admin_retrieve_memory_log_policies_list", "List RetrieveMemory log policies\n\nLists RetrieveMemory log policies with optional tombstone, active-time, name, label, sort, and pagination filters. LABEL FILTERS: Label filters accept either label.<key>=<value> or label[key]=value (for example, label.environment=production or label[environment]=production).", {
+    include_deleted: external_exports.boolean().describe("Whether to include tombstoned policies. Also accepts include_deleted.").optional(),
+    name_filter: external_exports.string().describe("Case-insensitive substring filter on policy display names. Also accepts name_filter.").optional(),
+    active_at: external_exports.number().int().describe("Only return policies active at this millisecond epoch timestamp. Also accepts active_at.").optional(),
+    max_results: external_exports.number().int().describe("Maximum number of policies to return. Also accepts max_results.").optional(),
+    next_token: external_exports.string().describe("Opaque pagination token returned by the previous list response. Also accepts next_token.").optional(),
+    sort_by: external_exports.enum(["created_at", "updated_at", "display_name"]).describe("Sort field: created_at, updated_at, or display_name. Also accepts sort_by.").optional(),
+    sort_order: external_exports.enum(["ASCENDING", "DESCENDING", "SORT_ORDER_UNSPECIFIED"]).describe("Sort order. Also accepts sort_order.").optional(),
+    label: external_exports.record(external_exports.string(), external_exports.string()).describe("Filter by label. Each key-value pair is sent as label[key]=value query parameter.").optional()
+  }, async (args) => {
+    const query = {};
+    if (args.include_deleted !== void 0)
+      query["includeDeleted"] = String(args.include_deleted);
+    if (args.name_filter !== void 0)
+      query["nameFilter"] = String(args.name_filter);
+    if (args.active_at !== void 0)
+      query["activeAt"] = String(args.active_at);
+    if (args.max_results !== void 0)
+      query["maxResults"] = String(args.max_results);
+    if (args.next_token !== void 0)
+      query["nextToken"] = String(args.next_token);
+    if (args.sort_by !== void 0)
+      query["sortBy"] = String(args.sort_by);
+    if (args.sort_order !== void 0)
+      query["sortOrder"] = String(args.sort_order);
+    if (args.label) {
+      for (const [k, v] of Object.entries(args.label))
+        query[`label[${k}]`] = v;
+    }
+    const result = await callApi("GET", `/v1/admin/retrieve-memory-log-policies`, void 0, query);
+    return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+  });
+  server.tool("goodmem_apikeys_create", "Create a new API key\n\nCreates a new API key for authenticating with the API. New keys start in ACTIVE status and can be used immediately for authentication. The response includes the one-time raw API key value which will not be retrievable later - clients must save this value as it cannot be recovered. Requires CREATE_APIKEY_OWN permission (or CREATE_APIKEY_ANY for admin users). Side effects include generating cryptographically secure key material, recording creation timestamp, and tracking creator ID. Returns INVALID_ARGUMENT if expires_at is set to a time in the past.", {
     labels: external_exports.record(external_exports.string(), external_exports.string()).describe("Key-value pairs of metadata associated with the API key. Used for organization and filtering.").optional(),
     expires_at: external_exports.number().int().describe("Expiration timestamp in milliseconds since epoch. If not provided, the key does not expire.").optional(),
     api_key_id: external_exports.string().describe("Optional client-provided UUID for idempotent creation. If not provided, server generates a new UUID. Returns ALREADY_EXISTS if ID is already in use.").optional()
@@ -22051,22 +22076,32 @@ function registerTools() {
     const result = await callApi("POST", `/v1/apikeys`, body);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_apikeys_delete", "Delete an API key", {
+  server.tool("goodmem_apikeys_delete", 'Delete an API key\n\nPermanently deletes an API key. This operation cannot be undone and immediately invalidates the key for all future authentication attempts. TIP: For reversible deactivation, use the `goodmem_apikeys_update` tool with `status: "INACTIVE"` instead. Requires DELETE_APIKEY_OWN permission for keys you own (or DELETE_APIKEY_ANY for admin users to delete any user\'s keys). Side effects include permanently removing the key record from the database and immediate authentication invalidation.', {
     id: external_exports.string().describe("The UUID of the API key to delete")
   }, async (args) => {
+    if (typeof args.id !== "string" || args.id === "") {
+      throw new Error("'id' must be a non-empty string");
+    }
     await callApi("DELETE", `/v1/apikeys/${encodeURIComponent(String(args.id))}`, void 0);
     return { content: [{ type: "text", text: "Deleted successfully." }] };
   });
-  server.tool("goodmem_apikeys_list", "List API keys", {}, async (args) => {
+  server.tool("goodmem_apikeys_list", "List API keys\n\nRetrieves a list of API keys belonging to the authenticated user. The list includes metadata about each key but not the actual key values or key hashes for security reasons. Requires LIST_APIKEY_OWN permission (or LIST_APIKEY_ANY for admin users to view keys from any user). This is a read-only operation with no side effects.", {}, async (args) => {
     const result = await callApi("GET", `/v1/apikeys`, void 0);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_apikeys_update", "Update an API key", {
+  server.tool("goodmem_apikeys_update", "Update an API key\n\nUpdates an existing API key with new values for status or labels. IMPORTANT: Key ID, user ownership, key material, and audit fields cannot be modified - only status (ACTIVE/INACTIVE) and labels are mutable. Requires UPDATE_APIKEY_OWN permission for keys you own (or UPDATE_APIKEY_ANY for admin users to modify any user's keys). Side effects include updating the updated_at timestamp and recording the updater's user ID. This operation is idempotent - repeated identical requests have no additional effect.", {
     id: external_exports.string().describe("The UUID of the API key to update"),
-    status: external_exports.string().describe("New status for the API key. Allowed values: ACTIVE, INACTIVE.").optional(),
-    replace_labels: external_exports.record(external_exports.string(), external_exports.string()).describe("Replace all existing labels with this set. Mutually exclusive with mergeLabels.").optional(),
-    merge_labels: external_exports.record(external_exports.string(), external_exports.string()).describe("Merge these labels with existing ones. Mutually exclusive with replaceLabels.").optional()
+    status: external_exports.enum(["ACTIVE", "INACTIVE"]).describe("New status for the API key. Allowed values: ACTIVE, INACTIVE.").optional(),
+    replace_labels: external_exports.record(external_exports.string(), external_exports.string()).describe("Replace all existing labels with this set. Mutually exclusive with merge_labels.").optional(),
+    merge_labels: external_exports.record(external_exports.string(), external_exports.string()).describe("Merge these labels with existing ones. Mutually exclusive with replace_labels.").optional()
   }, async (args) => {
+    if (typeof args.id !== "string" || args.id === "") {
+      throw new Error("'id' must be a non-empty string");
+    }
+    const _set = [args.replace_labels !== void 0 && args.replace_labels !== null, args.merge_labels !== void 0 && args.merge_labels !== null].filter(Boolean).length;
+    if (_set > 1) {
+      throw new Error("at most one of replace_labels or merge_labels may be set");
+    }
     const body = {};
     if (args.status !== void 0)
       body["status"] = args.status;
@@ -22077,7 +22112,7 @@ function registerTools() {
     const result = await callApi("PUT", `/v1/apikeys/${encodeURIComponent(String(args.id))}`, body);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_embedders_create", "Create a new embedder", {
+  server.tool("goodmem_embedders_create", "Create a new embedder\n\nCreates a new embedder configuration for vectorizing content. Embedders represent connections to different embedding API services (like OpenAI, vLLM, etc.) and include all the necessary configuration to use them with memory spaces. DUPLICATE DETECTION: Returns HTTP 409 Conflict (ALREADY_EXISTS) if another embedder exists with identical {owner_id, provider_type, endpoint_url, api_path, model_identifier, dimensionality, distribution_type, credentialsFingerprint} after URL canonicalization. Uniqueness is enforced per-owner, allowing different users to have identical configurations. Credentials are hashed (SHA-256) for uniqueness while remaining encrypted. The api_path field defaults to '/v2/embed' for Cohere, '/embed' for TEI, and '/embeddings' for other providers when omitted. Requires CREATE_EMBEDDER_OWN permission (or CREATE_EMBEDDER_ANY for admin users).", {
     display_name: external_exports.string().describe("User-facing name of the embedder"),
     description: external_exports.string().describe("Description of the embedder").optional(),
     provider_type: external_exports.enum(["OPENAI", "VLLM", "TEI", "LLAMA_CPP", "VOYAGE", "COHERE", "JINA"]).describe("Type of embedding provider (auto-inferred from model_identifier if omitted)").optional(),
@@ -22094,16 +22129,16 @@ function registerTools() {
         inlineSecret: external_exports.string().describe("Secret stored directly in GoodMem (mutually exclusive with secretRef)").optional(),
         secretRef: external_exports.object({
           uri: external_exports.string().describe("URI identifying where the secret can be resolved (e.g., vault://, env://)"),
-          hints: external_exports.any().describe('Optional metadata to help resolvers decode the secret (e.g., {"encoding":"base64"})').optional()
+          hints: external_exports.record(external_exports.string(), external_exports.string()).describe('Optional metadata to help resolvers decode the secret (e.g., {"encoding":"base64"})').optional()
         }).passthrough().describe("Reference to an external secret manager entry (mutually exclusive with inlineSecret)").optional(),
         headerName: external_exports.string().describe("Desired HTTP header to carry the credential (defaults to Authorization)").optional(),
         prefix: external_exports.string().describe('Optional prefix prepended to the secret (e.g., "Bearer ")').optional()
       }).passthrough().describe("Configuration when kind is CREDENTIAL_KIND_API_KEY").optional(),
       gcpAdc: external_exports.object({
-        scopes: external_exports.any().describe("Additional OAuth scopes. Empty list falls back to the default cloud-platform scope.").optional(),
+        scopes: external_exports.array(external_exports.string()).describe("Additional OAuth scopes. Empty list falls back to the default cloud-platform scope.").optional(),
         quotaProjectId: external_exports.string().describe("Optional quota project used for billing").optional()
       }).passthrough().describe("Configuration when kind is CREDENTIAL_KIND_GCP_ADC").optional(),
-      labels: external_exports.any().describe('Optional annotations to aid operators (e.g., "owner=vertex")').optional()
+      labels: external_exports.record(external_exports.string(), external_exports.string()).describe('Optional annotations to aid operators (e.g., "owner=vertex")').optional()
     }).passthrough().describe("Structured credential payload describing how to authenticate with the provider. Required for SaaS providers; optional for local or proxy providers.").optional(),
     labels: external_exports.record(external_exports.string(), external_exports.string()).describe("User-defined labels for categorization").optional(),
     version: external_exports.string().describe("Version information").optional(),
@@ -22149,19 +22184,25 @@ function registerTools() {
     const result = await callApi("POST", `/v1/embedders`, body);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_embedders_delete", "Delete an embedder", {
+  server.tool("goodmem_embedders_delete", "Delete an embedder\n\nPermanently deletes an embedder configuration. This operation cannot be undone and removes the embedder record and securely deletes stored credentials. IMPORTANT: This does NOT invalidate or delete embeddings previously created with this embedder - existing embeddings remain accessible. CONFLICT: Returns HTTP 409 Conflict if the embedder is still referenced by a space. Requires DELETE_EMBEDDER_OWN permission for embedders you own (or DELETE_EMBEDDER_ANY for admin users).", {
     id: external_exports.string().describe("The unique identifier of the embedder to delete")
   }, async (args) => {
+    if (typeof args.id !== "string" || args.id === "") {
+      throw new Error("'id' must be a non-empty string");
+    }
     await callApi("DELETE", `/v1/embedders/${encodeURIComponent(String(args.id))}`, void 0);
     return { content: [{ type: "text", text: "Deleted successfully." }] };
   });
-  server.tool("goodmem_embedders_get", "Get an embedder by ID", {
+  server.tool("goodmem_embedders_get", "Get an embedder by ID\n\nRetrieves the details of a specific embedder configuration by its unique identifier. Requires READ_EMBEDDER_OWN permission for embedders you own (or READ_EMBEDDER_ANY for admin users to view any user's embedders). This is a read-only operation with no side effects.", {
     id: external_exports.string().describe("The unique identifier of the embedder to retrieve")
   }, async (args) => {
+    if (typeof args.id !== "string" || args.id === "") {
+      throw new Error("'id' must be a non-empty string");
+    }
     const result = await callApi("GET", `/v1/embedders/${encodeURIComponent(String(args.id))}`, void 0);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_embedders_list", "List embedders", {
+  server.tool("goodmem_embedders_list", "List embedders\n\nRetrieves a list of embedder configurations accessible to the caller, with optional filtering. LABEL FILTERS: Label filters accept either label.<key>=<value> or label[key]=value (for example, label.environment=production or label[environment]=production). PERMISSION-BASED FILTERING: With LIST_EMBEDDER_OWN permission, you can only see your own embedders (owner_id filter is ignored if set to another user). With LIST_EMBEDDER_ANY permission, you can see all embedders or filter by any owner_id. This is a read-only operation with no side effects.", {
     owner_id: external_exports.string().describe("Filter embedders by owner ID. With LIST_EMBEDDER_ANY permission, omitting this shows all accessible embedders; providing it filters by that owner. With LIST_EMBEDDER_OWN permission, only your own embedders are shown regardless of this parameter.").optional(),
     provider_type: external_exports.enum(["OPENAI", "VLLM", "TEI", "LLAMA_CPP", "VOYAGE", "COHERE", "JINA"]).describe("Filter embedders by provider type. Allowed values match the ProviderType schema.").optional(),
     label: external_exports.record(external_exports.string(), external_exports.string()).describe("Filter by label. Each key-value pair is sent as label[key]=value query parameter.").optional()
@@ -22178,7 +22219,7 @@ function registerTools() {
     const result = await callApi("GET", `/v1/embedders`, void 0, query);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_embedders_update", "Update an embedder", {
+  server.tool("goodmem_embedders_update", "Update an embedder\n\nUpdates an existing embedder configuration including display information, endpoint configuration, model parameters, credentials, and labels. All fields are optional - only specified fields will be updated. IMPORTANT: providerType is IMMUTABLE after creation and cannot be changed. CRITICAL: Returns HTTP 412 Precondition Failed (FAILED_PRECONDITION) if attempting to update core fields (dimensionality, distribution_type, model_identifier) while the embedder is actively referenced by spaces or ingestion jobs. DUPLICATE DETECTION: Returns HTTP 409 Conflict (ALREADY_EXISTS) if the update would create a duplicate embedder with the same provider, endpoint, model, dimensionality, distribution, and credentials for this owner. Requires UPDATE_EMBEDDER_OWN permission for embedders you own (or UPDATE_EMBEDDER_ANY for admin users).", {
     id: external_exports.string().describe("The unique identifier of the embedder to update"),
     display_name: external_exports.string().describe("User-facing name of the embedder").optional(),
     description: external_exports.string().describe("Description of the embedder").optional(),
@@ -22188,29 +22229,35 @@ function registerTools() {
     dimensionality: external_exports.number().int().describe("Output vector dimensions").optional(),
     distribution_type: external_exports.enum(["DENSE", "SPARSE"]).describe("Type of embedding distribution (DENSE or SPARSE)").optional(),
     max_sequence_length: external_exports.number().int().describe("Maximum input sequence length").optional(),
-    supported_modalities: external_exports.array(external_exports.enum(["TEXT", "IMAGE", "AUDIO", "VIDEO"])).describe("Supported content modalities").optional(),
     credentials: external_exports.object({
       kind: external_exports.enum(["CREDENTIAL_KIND_UNSPECIFIED", "CREDENTIAL_KIND_API_KEY", "CREDENTIAL_KIND_GCP_ADC"]).describe("Selected credential strategy"),
       apiKey: external_exports.object({
         inlineSecret: external_exports.string().describe("Secret stored directly in GoodMem (mutually exclusive with secretRef)").optional(),
         secretRef: external_exports.object({
           uri: external_exports.string().describe("URI identifying where the secret can be resolved (e.g., vault://, env://)"),
-          hints: external_exports.any().describe('Optional metadata to help resolvers decode the secret (e.g., {"encoding":"base64"})').optional()
+          hints: external_exports.record(external_exports.string(), external_exports.string()).describe('Optional metadata to help resolvers decode the secret (e.g., {"encoding":"base64"})').optional()
         }).passthrough().describe("Reference to an external secret manager entry (mutually exclusive with inlineSecret)").optional(),
         headerName: external_exports.string().describe("Desired HTTP header to carry the credential (defaults to Authorization)").optional(),
         prefix: external_exports.string().describe('Optional prefix prepended to the secret (e.g., "Bearer ")').optional()
       }).passthrough().describe("Configuration when kind is CREDENTIAL_KIND_API_KEY").optional(),
       gcpAdc: external_exports.object({
-        scopes: external_exports.any().describe("Additional OAuth scopes. Empty list falls back to the default cloud-platform scope.").optional(),
+        scopes: external_exports.array(external_exports.string()).describe("Additional OAuth scopes. Empty list falls back to the default cloud-platform scope.").optional(),
         quotaProjectId: external_exports.string().describe("Optional quota project used for billing").optional()
       }).passthrough().describe("Configuration when kind is CREDENTIAL_KIND_GCP_ADC").optional(),
-      labels: external_exports.any().describe('Optional annotations to aid operators (e.g., "owner=vertex")').optional()
+      labels: external_exports.record(external_exports.string(), external_exports.string()).describe('Optional annotations to aid operators (e.g., "owner=vertex")').optional()
     }).passthrough().describe("Structured credential payload describing how to authenticate with the provider").optional(),
-    replace_labels: external_exports.record(external_exports.string(), external_exports.string()).describe("Replace all existing labels with these (mutually exclusive with mergeLabels)").optional(),
-    merge_labels: external_exports.record(external_exports.string(), external_exports.string()).describe("Merge these labels with existing ones (mutually exclusive with replaceLabels)").optional(),
+    replace_labels: external_exports.record(external_exports.string(), external_exports.string()).describe("Replace all existing labels with these (mutually exclusive with merge_labels)").optional(),
+    merge_labels: external_exports.record(external_exports.string(), external_exports.string()).describe("Merge these labels with existing ones (mutually exclusive with replace_labels)").optional(),
     version: external_exports.string().describe("Version information").optional(),
     monitoring_endpoint: external_exports.string().describe("Monitoring endpoint URL").optional()
   }, async (args) => {
+    if (typeof args.id !== "string" || args.id === "") {
+      throw new Error("'id' must be a non-empty string");
+    }
+    const _set = [args.replace_labels !== void 0 && args.replace_labels !== null, args.merge_labels !== void 0 && args.merge_labels !== null].filter(Boolean).length;
+    if (_set > 1) {
+      throw new Error("at most one of replace_labels or merge_labels may be set");
+    }
     const body = {};
     if (args.display_name !== void 0)
       body["displayName"] = args.display_name;
@@ -22228,8 +22275,6 @@ function registerTools() {
       body["distributionType"] = args.distribution_type;
     if (args.max_sequence_length !== void 0)
       body["maxSequenceLength"] = args.max_sequence_length;
-    if (args.supported_modalities !== void 0)
-      body["supportedModalities"] = args.supported_modalities;
     if (args.credentials !== void 0)
       body["credentials"] = args.credentials;
     if (args.replace_labels !== void 0)
@@ -22243,7 +22288,7 @@ function registerTools() {
     const result = await callApi("PUT", `/v1/embedders/${encodeURIComponent(String(args.id))}`, body);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_llms_create", "Create a new LLM", {
+  server.tool("goodmem_llms_create", "Create a new LLM\n\nCreates a new LLM configuration for text generation services. LLMs represent connections to different language model API services (like OpenAI, vLLM, etc.) and include all the necessary configuration to use them for text generation. DUPLICATE DETECTION: Returns HTTP 409 Conflict (ALREADY_EXISTS) if another LLM exists with identical {owner_id, provider_type, endpoint_url, api_path, model_identifier, credentialsFingerprint} after URL canonicalization. Uniqueness is enforced per-owner. Credentials are hashed (SHA-256) for uniqueness while remaining encrypted. The api_path field defaults to '/chat/completions' if omitted. Requires CREATE_LLM_OWN permission (or CREATE_LLM_ANY for admin users).", {
     display_name: external_exports.string().describe("User-facing name of the LLM"),
     description: external_exports.string().describe("Description of the LLM").optional(),
     provider_type: external_exports.enum(["OPENAI", "LITELLM_PROXY", "OPEN_ROUTER", "VLLM", "OLLAMA", "LLAMA_CPP", "CUSTOM_OPENAI_COMPATIBLE"]).describe("Type of LLM provider (auto-inferred from model_identifier if omitted)").optional(),
@@ -22257,16 +22302,16 @@ function registerTools() {
         inlineSecret: external_exports.string().describe("Secret stored directly in GoodMem (mutually exclusive with secretRef)").optional(),
         secretRef: external_exports.object({
           uri: external_exports.string().describe("URI identifying where the secret can be resolved (e.g., vault://, env://)"),
-          hints: external_exports.any().describe('Optional metadata to help resolvers decode the secret (e.g., {"encoding":"base64"})').optional()
+          hints: external_exports.record(external_exports.string(), external_exports.string()).describe('Optional metadata to help resolvers decode the secret (e.g., {"encoding":"base64"})').optional()
         }).passthrough().describe("Reference to an external secret manager entry (mutually exclusive with inlineSecret)").optional(),
         headerName: external_exports.string().describe("Desired HTTP header to carry the credential (defaults to Authorization)").optional(),
         prefix: external_exports.string().describe('Optional prefix prepended to the secret (e.g., "Bearer ")').optional()
       }).passthrough().describe("Configuration when kind is CREDENTIAL_KIND_API_KEY").optional(),
       gcpAdc: external_exports.object({
-        scopes: external_exports.any().describe("Additional OAuth scopes. Empty list falls back to the default cloud-platform scope.").optional(),
+        scopes: external_exports.array(external_exports.string()).describe("Additional OAuth scopes. Empty list falls back to the default cloud-platform scope.").optional(),
         quotaProjectId: external_exports.string().describe("Optional quota project used for billing").optional()
       }).passthrough().describe("Configuration when kind is CREDENTIAL_KIND_GCP_ADC").optional(),
-      labels: external_exports.any().describe('Optional annotations to aid operators (e.g., "owner=vertex")').optional()
+      labels: external_exports.record(external_exports.string(), external_exports.string()).describe('Optional annotations to aid operators (e.g., "owner=vertex")').optional()
     }).passthrough().describe("Structured credential payload describing how to authenticate with the provider. Required for SaaS providers; optional for local or proxy providers.").optional(),
     labels: external_exports.record(external_exports.string(), external_exports.string()).describe("User-defined labels for categorization").optional(),
     version: external_exports.string().describe("Version information").optional(),
@@ -22281,15 +22326,15 @@ function registerTools() {
     }).passthrough().describe("LLM capabilities defining supported features and modes. Optional - server infers capabilities from model identifier if not provided.").optional(),
     default_sampling_params: external_exports.object({
       maxTokens: external_exports.number().int().describe("Maximum tokens to generate (>0 if set; provider-dependent limits apply)").optional(),
-      temperature: external_exports.number().describe("Sampling temperature 0.0-2.0 (0.0=deterministic, 2.0=highly random)").optional(),
+      temperature: external_exports.number().describe("Sampling temperature; valid range depends on the configured provider").optional(),
       topP: external_exports.number().describe("Nucleus sampling threshold 0.0-1.0 (smaller values focus on higher probability tokens)").optional(),
       topK: external_exports.number().int().describe("Top-k sampling limit (>0 if set; primarily for local/open-source models)").optional(),
-      frequencyPenalty: external_exports.number().describe("Frequency penalty -2.0 to 2.0 (positive values reduce repetition based on frequency)").optional(),
-      presencePenalty: external_exports.number().describe("Presence penalty -2.0 to 2.0 (positive values encourage topic diversity)").optional(),
-      stopSequences: external_exports.any().describe("Generation stop sequences (\u226410 sequences; each \u2264100 chars; generation halts on exact match)").optional()
+      frequencyPenalty: external_exports.number().describe("Frequency penalty; valid range depends on the configured provider").optional(),
+      presencePenalty: external_exports.number().describe("Presence penalty; valid range depends on the configured provider").optional(),
+      stopSequences: external_exports.array(external_exports.string()).describe("Generation stop sequences; generation halts on exact match").optional()
     }).passthrough().describe("Default sampling parameters for generation requests").optional(),
     max_context_length: external_exports.number().int().describe("Maximum context window size in tokens").optional(),
-    client_config: external_exports.any().describe("Provider-specific client configuration as flexible JSON structure").optional(),
+    client_config: external_exports.record(external_exports.string(), external_exports.any()).describe("Provider-specific client configuration as flexible JSON structure").optional(),
     owner_id: external_exports.string().describe("Optional owner ID. If not provided, derived from the authentication context. Requires CREATE_LLM_ANY permission if specified.").optional(),
     llm_id: external_exports.string().describe("Optional client-provided UUID for idempotent creation. If not provided, server generates a new UUID. Returns ALREADY_EXISTS if ID is already in use.").optional()
   }, async (args) => {
@@ -22333,19 +22378,25 @@ function registerTools() {
     const result = await callApi("POST", `/v1/llms`, body);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_llms_delete", "Delete an LLM", {
+  server.tool("goodmem_llms_delete", "Delete an LLM\n\nPermanently deletes an LLM configuration. This operation cannot be undone and removes the LLM record and securely deletes stored credentials. IMPORTANT: This does NOT invalidate or delete any previously generated content using this LLM - existing generations remain accessible. Requires DELETE_LLM_OWN permission for LLMs you own (or DELETE_LLM_ANY for admin users).", {
     id: external_exports.string().describe("The unique identifier of the LLM to delete")
   }, async (args) => {
+    if (typeof args.id !== "string" || args.id === "") {
+      throw new Error("'id' must be a non-empty string");
+    }
     await callApi("DELETE", `/v1/llms/${encodeURIComponent(String(args.id))}`, void 0);
     return { content: [{ type: "text", text: "Deleted successfully." }] };
   });
-  server.tool("goodmem_llms_get", "Get an LLM by ID", {
+  server.tool("goodmem_llms_get", "Get an LLM by ID\n\nRetrieves the details of a specific LLM configuration by its unique identifier. Requires READ_LLM_OWN permission for LLMs you own (or READ_LLM_ANY for admin users to view any user's LLMs). This is a read-only operation with no side effects.", {
     id: external_exports.string().describe("The unique identifier of the LLM to retrieve")
   }, async (args) => {
+    if (typeof args.id !== "string" || args.id === "") {
+      throw new Error("'id' must be a non-empty string");
+    }
     const result = await callApi("GET", `/v1/llms/${encodeURIComponent(String(args.id))}`, void 0);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_llms_list", "List LLMs", {
+  server.tool("goodmem_llms_list", "List LLMs\n\nRetrieves a list of LLM configurations accessible to the caller, with optional filtering. LABEL FILTERS: Label filters accept either label.<key>=<value> or label[key]=value (for example, label.environment=production or label[environment]=production). PERMISSION-BASED FILTERING: With LIST_LLM_OWN permission, you can only see your own LLMs (owner_id filter is ignored if set to another user). With LIST_LLM_ANY permission, you can see all LLMs or filter by any owner_id. This is a read-only operation with no side effects.", {
     owner_id: external_exports.string().describe("Filter LLMs by owner ID. With LIST_LLM_ANY permission, omitting this shows all accessible LLMs; providing it filters by that owner. With LIST_LLM_OWN permission, only your own LLMs are shown regardless of this parameter.").optional(),
     provider_type: external_exports.enum(["OPENAI", "LITELLM_PROXY", "OPEN_ROUTER", "VLLM", "OLLAMA", "LLAMA_CPP", "CUSTOM_OPENAI_COMPATIBLE"]).describe("Filter LLMs by provider type. Allowed values match the LLMProviderType schema.").optional(),
     label: external_exports.record(external_exports.string(), external_exports.string()).describe("Filter by label. Each key-value pair is sent as label[key]=value query parameter.").optional()
@@ -22362,30 +22413,30 @@ function registerTools() {
     const result = await callApi("GET", `/v1/llms`, void 0, query);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_llms_update", "Update an LLM", {
+  server.tool("goodmem_llms_update", "Update an LLM\n\nUpdates an existing LLM configuration including display information, endpoint configuration, model parameters, credentials, and labels. All fields are optional - only specified fields will be updated. SUPPORTED_MODALITIES UPDATE: If the array contains >=1 elements, it replaces the stored set; if empty or omitted, no change occurs and it does not count as an update by itself. IMPORTANT: providerType is IMMUTABLE after creation and cannot be changed. Requires UPDATE_LLM_OWN permission for LLMs you own (or UPDATE_LLM_ANY for admin users).", {
     id: external_exports.string().describe("The unique identifier of the LLM to update"),
     display_name: external_exports.string().describe("Update display name").optional(),
     description: external_exports.string().describe("Update description").optional(),
     endpoint_url: external_exports.string().describe("Update endpoint base URL (OpenAI-compatible base, typically ends with /v1)").optional(),
     api_path: external_exports.string().describe("Update API path").optional(),
     model_identifier: external_exports.string().describe("Update model identifier (cannot be empty)").optional(),
-    supported_modalities: external_exports.array(external_exports.enum(["TEXT", "IMAGE", "AUDIO", "VIDEO"])).describe("Update supported modalities (if array contains \u22651 elements, replaces stored set; if empty or omitted, no change)").optional(),
+    supported_modalities: external_exports.array(external_exports.enum(["TEXT", "IMAGE", "AUDIO", "VIDEO"])).describe("Update supported modalities (if array contains >=1 elements, replaces stored set; if empty or omitted, no change and does not count as an update by itself)").optional(),
     credentials: external_exports.object({
       kind: external_exports.enum(["CREDENTIAL_KIND_UNSPECIFIED", "CREDENTIAL_KIND_API_KEY", "CREDENTIAL_KIND_GCP_ADC"]).describe("Selected credential strategy"),
       apiKey: external_exports.object({
         inlineSecret: external_exports.string().describe("Secret stored directly in GoodMem (mutually exclusive with secretRef)").optional(),
         secretRef: external_exports.object({
           uri: external_exports.string().describe("URI identifying where the secret can be resolved (e.g., vault://, env://)"),
-          hints: external_exports.any().describe('Optional metadata to help resolvers decode the secret (e.g., {"encoding":"base64"})').optional()
+          hints: external_exports.record(external_exports.string(), external_exports.string()).describe('Optional metadata to help resolvers decode the secret (e.g., {"encoding":"base64"})').optional()
         }).passthrough().describe("Reference to an external secret manager entry (mutually exclusive with inlineSecret)").optional(),
         headerName: external_exports.string().describe("Desired HTTP header to carry the credential (defaults to Authorization)").optional(),
         prefix: external_exports.string().describe('Optional prefix prepended to the secret (e.g., "Bearer ")').optional()
       }).passthrough().describe("Configuration when kind is CREDENTIAL_KIND_API_KEY").optional(),
       gcpAdc: external_exports.object({
-        scopes: external_exports.any().describe("Additional OAuth scopes. Empty list falls back to the default cloud-platform scope.").optional(),
+        scopes: external_exports.array(external_exports.string()).describe("Additional OAuth scopes. Empty list falls back to the default cloud-platform scope.").optional(),
         quotaProjectId: external_exports.string().describe("Optional quota project used for billing").optional()
       }).passthrough().describe("Configuration when kind is CREDENTIAL_KIND_GCP_ADC").optional(),
-      labels: external_exports.any().describe('Optional annotations to aid operators (e.g., "owner=vertex")').optional()
+      labels: external_exports.record(external_exports.string(), external_exports.string()).describe('Optional annotations to aid operators (e.g., "owner=vertex")').optional()
     }).passthrough().describe("Update credentials").optional(),
     version: external_exports.string().describe("Update version information").optional(),
     monitoring_endpoint: external_exports.string().describe("Update monitoring endpoint URL").optional(),
@@ -22399,18 +22450,25 @@ function registerTools() {
     }).passthrough().describe("Update LLM capabilities (replaces entire capability set; clients MUST send all flags)").optional(),
     default_sampling_params: external_exports.object({
       maxTokens: external_exports.number().int().describe("Maximum tokens to generate (>0 if set; provider-dependent limits apply)").optional(),
-      temperature: external_exports.number().describe("Sampling temperature 0.0-2.0 (0.0=deterministic, 2.0=highly random)").optional(),
+      temperature: external_exports.number().describe("Sampling temperature; valid range depends on the configured provider").optional(),
       topP: external_exports.number().describe("Nucleus sampling threshold 0.0-1.0 (smaller values focus on higher probability tokens)").optional(),
       topK: external_exports.number().int().describe("Top-k sampling limit (>0 if set; primarily for local/open-source models)").optional(),
-      frequencyPenalty: external_exports.number().describe("Frequency penalty -2.0 to 2.0 (positive values reduce repetition based on frequency)").optional(),
-      presencePenalty: external_exports.number().describe("Presence penalty -2.0 to 2.0 (positive values encourage topic diversity)").optional(),
-      stopSequences: external_exports.any().describe("Generation stop sequences (\u226410 sequences; each \u2264100 chars; generation halts on exact match)").optional()
+      frequencyPenalty: external_exports.number().describe("Frequency penalty; valid range depends on the configured provider").optional(),
+      presencePenalty: external_exports.number().describe("Presence penalty; valid range depends on the configured provider").optional(),
+      stopSequences: external_exports.array(external_exports.string()).describe("Generation stop sequences; generation halts on exact match").optional()
     }).passthrough().describe("Update default sampling parameters").optional(),
     max_context_length: external_exports.number().int().describe("Update maximum context window size in tokens").optional(),
-    client_config: external_exports.any().describe("Update provider-specific client configuration (replaces entire config; no merging)").optional(),
-    replace_labels: external_exports.record(external_exports.string(), external_exports.string()).describe("Replace all existing labels with this set. Empty map clears all labels. Cannot be used with mergeLabels.").optional(),
-    merge_labels: external_exports.record(external_exports.string(), external_exports.string()).describe("Merge with existing labels: upserts with overwrite. Labels not mentioned are preserved. Cannot be used with replaceLabels.").optional()
+    client_config: external_exports.record(external_exports.string(), external_exports.any()).describe("Update provider-specific client configuration (replaces entire config; no merging)").optional(),
+    replace_labels: external_exports.record(external_exports.string(), external_exports.string()).describe("Replace all existing labels with this set. Empty map clears all labels. Cannot be used with merge_labels.").optional(),
+    merge_labels: external_exports.record(external_exports.string(), external_exports.string()).describe("Merge with existing labels: upserts with overwrite. Labels not mentioned are preserved. Cannot be used with replace_labels.").optional()
   }, async (args) => {
+    if (typeof args.id !== "string" || args.id === "") {
+      throw new Error("'id' must be a non-empty string");
+    }
+    const _set = [args.replace_labels !== void 0 && args.replace_labels !== null, args.merge_labels !== void 0 && args.merge_labels !== null].filter(Boolean).length;
+    if (_set > 1) {
+      throw new Error("at most one of replace_labels or merge_labels may be set");
+    }
     const body = {};
     if (args.display_name !== void 0)
       body["displayName"] = args.display_name;
@@ -22445,21 +22503,21 @@ function registerTools() {
     const result = await callApi("PUT", `/v1/llms/${encodeURIComponent(String(args.id))}`, body);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_memories_batch_create", "Create multiple memories in a batch", {
+  server.tool("goodmem_memories_batch_create", "Create multiple memories in one batch. EACH item in `requests` must satisfy: exactly one of `originalContent` or `originalContentB64`; if `originalContentB64`, set `contentType` (e.g. `application/pdf`); `originalContentRef` is metadata only. Returns per-item success/failure; partial failures don't abort.", {
     requests: external_exports.array(external_exports.object({
       memoryId: external_exports.string().describe("Optional client-provided UUID for the memory. If omitted, the server generates one. Returns ALREADY_EXISTS if the ID is already in use.").optional(),
       spaceId: external_exports.string().describe("ID of the space where this memory will be stored"),
       originalContent: external_exports.string().describe("Original content as plain text (use either this or originalContentB64)").optional(),
       originalContentB64: external_exports.string().describe("Original content as base64-encoded binary data (use either this or originalContent)").optional(),
       originalContentRef: external_exports.string().describe("Reference to external content location").optional(),
-      contentType: external_exports.string().describe("MIME type of the content"),
-      metadata: external_exports.any().describe("Additional metadata for the memory").optional(),
+      contentType: external_exports.string().describe("MIME type of the content").optional(),
+      metadata: external_exports.record(external_exports.string(), external_exports.any()).describe("Additional metadata for the memory").optional(),
       chunkingConfig: external_exports.object({
         none: external_exports.any().describe("No chunking strategy - preserve original content as single unit").optional(),
         recursive: external_exports.object({
           chunkSize: external_exports.number().int().describe("Maximum size of a chunk (should be \u2264 context window)"),
           chunkOverlap: external_exports.number().int().describe("Sliding overlap between chunks"),
-          separators: external_exports.any().describe("Hierarchical separator list (order = preference)").optional(),
+          separators: external_exports.array(external_exports.string()).describe("Hierarchical separator list (order = preference)").optional(),
           keepStrategy: external_exports.enum(["KEEP_NONE", "KEEP_START", "KEEP_END"]).describe("How to handle separators after splitting. KEEP_NONE is deprecated and behaves as KEEP_END."),
           separatorIsRegex: external_exports.boolean().describe("Whether separators are regex patterns").optional(),
           lengthMeasurement: external_exports.enum(["CHARACTER_COUNT", "TOKEN_COUNT", "CUSTOM"]).describe("How to measure chunk length")
@@ -22471,22 +22529,38 @@ function registerTools() {
           lengthMeasurement: external_exports.enum(["CHARACTER_COUNT", "TOKEN_COUNT", "CUSTOM"]).describe("How to measure chunk length")
         }).passthrough().describe("Sentence-based chunking strategy with language detection").optional()
       }).passthrough().describe("Chunking strategy for this memory (if not provided, uses space default)").optional(),
-      extractPageImages: external_exports.boolean().describe("Optional hint to extract page images for eligible document types (for example, PDFs)").optional(),
-      fileField: external_exports.string().describe("Optional multipart file field name to bind binary content; required when multiple files are uploaded in a batch multipart request.").optional()
-    }).passthrough()).min(1).describe("Array of memory creation requests.")
+      extractPageImages: external_exports.boolean().describe("Optional hint to extract page images for eligible document types (for example, PDFs)").optional()
+    }).passthrough()).describe("Array of memory creation requests.")
   }, async (args) => {
+    for (const [_i, _item] of (Array.isArray(args.requests) ? args.requests : []).entries()) {
+      const _itemSet = [_item?.["originalContent"] !== void 0 && _item?.["originalContent"] !== null, _item?.["originalContentB64"] !== void 0 && _item?.["originalContentB64"] !== null].filter(Boolean).length;
+      if (_itemSet !== 1) {
+        throw new Error(`requests[${_i}]: exactly one of originalContent or originalContentB64 must be set`);
+      }
+      if (_item?.["originalContentB64"] !== void 0 && _item?.["originalContentB64"] !== null && (_item?.["contentType"] === void 0 || _item?.["contentType"] === null)) {
+        throw new Error(`requests[${_i}]: 'contentType' is required when 'originalContentB64' is set (the server cannot infer MIME type from base64 bytes). Hint: pass contentType="application/pdf" or whatever matches the decoded payload`);
+      }
+    }
     const body = {};
     if (args.requests !== void 0)
       body["requests"] = args.requests;
+    if (Array.isArray(body["requests"])) {
+      body["requests"] = body["requests"].map((item) => {
+        if (item && typeof item === "object" && item["originalContent"] !== void 0 && item["contentType"] === void 0) {
+          return { ...item, contentType: "text/plain" };
+        }
+        return item;
+      });
+    }
     const result = await callApi("POST", `/v1/memories:batchCreate`, body);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_memories_batch_delete", "Delete memories in batch", {
+  server.tool("goodmem_memories_batch_delete", "Delete memories in batch\n\nDeletes memories using selector entries. Each selector can target either a specific memory ID or a filtered subset scoped to a specific space.", {
     requests: external_exports.array(external_exports.object({
       memoryId: external_exports.string().describe("Deletes one specific memory by UUID").optional(),
       filterSelector: external_exports.object({
         spaceId: external_exports.string().describe("Space ID scope for the filtered delete"),
-        statusFilter: external_exports.string().describe("Optional processing status filter (PENDING, PROCESSING, COMPLETED, FAILED)").optional(),
+        statusFilter: external_exports.enum(["PENDING", "PROCESSING", "COMPLETED", "FAILED"]).describe("Optional processing status filter (PENDING, PROCESSING, COMPLETED, FAILED)").optional(),
         filter: external_exports.string().describe("Optional metadata filter expression").optional()
       }).passthrough().describe("Deletes a filtered set of memories within a specific space").optional()
     }).passthrough()).describe("Array of delete selectors")
@@ -22497,7 +22571,7 @@ function registerTools() {
     const result = await callApi("POST", `/v1/memories:batchDelete`, body);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_memories_batch_get", "Get multiple memories by ID", {
+  server.tool("goodmem_memories_batch_get", "Get multiple memories by ID\n\nRetrieves multiple memories in a single operation, with individual success/failure results.", {
     memory_ids: external_exports.array(external_exports.string()).describe("Array of memory IDs to retrieve"),
     include_content: external_exports.boolean().describe("Whether to include the original content in the response").optional(),
     include_processing_history: external_exports.boolean().describe("Whether to include background job processing history for each memory").optional()
@@ -22512,20 +22586,20 @@ function registerTools() {
     const result = await callApi("POST", `/v1/memories:batchGet`, body);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_memories_create", "Create a memory from text content or base64-encoded content. Content must be provided via exactly one of `original_content` or `original_content_b64`.", {
+  server.tool("goodmem_memories_create", "Create a memory from text content or base64-encoded binary content. Provide exactly one of `original_content` or `original_content_b64` per call; if `original_content_b64`, `content_type` is required. `original_content_ref` is a metadata URL pointer (the server does NOT fetch it) and may be set alongside the content source.", {
     memory_id: external_exports.string().describe("Optional client-provided UUID for the memory. If omitted, the server generates one. Returns ALREADY_EXISTS if the ID is already in use.").optional(),
     space_id: external_exports.string().describe("ID of the space where this memory will be stored"),
-    original_content: external_exports.string().describe("Original content as plain text (use either this or originalContentB64)").optional(),
-    original_content_b64: external_exports.string().describe("Original content as base64-encoded binary data (use either this or originalContent)").optional(),
+    original_content: external_exports.string().describe("Original content as plain text (use either this or original_content_b64)").optional(),
+    original_content_b64: external_exports.string().describe("Original content as base64-encoded binary data (use either this or original_content)").optional(),
     original_content_ref: external_exports.string().describe("Reference to external content location").optional(),
     content_type: external_exports.string().describe("MIME type of the content (defaults to text/plain when original_content is provided)").optional(),
-    metadata: external_exports.any().describe("Additional metadata for the memory").optional(),
+    metadata: external_exports.record(external_exports.string(), external_exports.any()).describe("Additional metadata for the memory").optional(),
     chunking_config: external_exports.object({
       none: external_exports.any().describe("No chunking strategy - preserve original content as single unit").optional(),
       recursive: external_exports.object({
         chunkSize: external_exports.number().int().describe("Maximum size of a chunk (should be \u2264 context window)"),
         chunkOverlap: external_exports.number().int().describe("Sliding overlap between chunks"),
-        separators: external_exports.any().describe("Hierarchical separator list (order = preference)").optional(),
+        separators: external_exports.array(external_exports.string()).describe("Hierarchical separator list (order = preference)").optional(),
         keepStrategy: external_exports.enum(["KEEP_NONE", "KEEP_START", "KEEP_END"]).describe("How to handle separators after splitting. KEEP_NONE is deprecated and behaves as KEEP_END."),
         separatorIsRegex: external_exports.boolean().describe("Whether separators are regex patterns").optional(),
         lengthMeasurement: external_exports.enum(["CHARACTER_COUNT", "TOKEN_COUNT", "CUSTOM"]).describe("How to measure chunk length")
@@ -22539,6 +22613,13 @@ function registerTools() {
     }).passthrough().describe("Chunking strategy for this memory (if not provided, uses space default)").optional(),
     extract_page_images: external_exports.boolean().describe("Optional hint to extract page images for eligible document types (for example, PDFs)").optional()
   }, async (args) => {
+    const _set = [args.original_content !== void 0 && args.original_content !== null, args.original_content_b64 !== void 0 && args.original_content_b64 !== null].filter(Boolean).length;
+    if (_set !== 1) {
+      throw new Error("exactly one of original_content or original_content_b64 must be set");
+    }
+    if (args.original_content_b64 !== void 0 && args.original_content_b64 !== null && (args.content_type === void 0 || args.content_type === null)) {
+      throw new Error('`content_type` is required when `original_content_b64` is set (the server cannot infer MIME type from base64 bytes). Hint: pass content_type="application/pdf" or whatever matches the decoded payload');
+    }
     const body = {};
     if (args.memory_id !== void 0)
       body["memoryId"] = args.memory_id;
@@ -22564,17 +22645,23 @@ function registerTools() {
     const result = await callApi("POST", `/v1/memories`, body);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_memories_delete", "Delete a memory", {
+  server.tool("goodmem_memories_delete", "Delete a memory\n\nPermanently deletes a memory and its associated chunks. This operation cannot be undone and immediately removes the memory record from the database. IDEMPOTENCY: This operation is safe to retry - may return NOT_FOUND if the memory was already deleted or never existed. Requires DELETE_MEMORY_OWN permission for memories in spaces you own (or DELETE_MEMORY_ANY for admin users to delete any memory). Side effects include permanent removal of the memory record and all associated chunk data.", {
     id: external_exports.string().describe("The UUID of the memory to delete")
   }, async (args) => {
+    if (typeof args.id !== "string" || args.id === "") {
+      throw new Error("'id' must be a non-empty string");
+    }
     await callApi("DELETE", `/v1/memories/${encodeURIComponent(String(args.id))}`, void 0);
     return { content: [{ type: "text", text: "Deleted successfully." }] };
   });
-  server.tool("goodmem_memories_get", "Get a memory by ID", {
+  server.tool("goodmem_memories_get", "Get a memory by ID\n\nRetrieves a single memory by its ID. PERMISSION CLARIFICATION: With READ_MEMORY_OWN permission, access is granted if you own the parent space OR if the parent space is public (public_read=true). With READ_MEMORY_ANY permission, you can access any memory regardless of ownership. This is a read-only operation with no side effects and is safe to retry. Returns NOT_FOUND if the memory or its parent space does not exist.", {
     id: external_exports.string().describe("The UUID of the memory to retrieve"),
     include_content: external_exports.boolean().describe("Whether to include the original content in the response (defaults to false).").optional(),
     include_processing_history: external_exports.boolean().describe("Whether to include background job processing history in the response (defaults to false).").optional()
   }, async (args) => {
+    if (typeof args.id !== "string" || args.id === "") {
+      throw new Error("'id' must be a non-empty string");
+    }
     const query = {};
     if (args.include_content !== void 0)
       query["includeContent"] = String(args.include_content);
@@ -22583,17 +22670,20 @@ function registerTools() {
     const result = await callApi("GET", `/v1/memories/${encodeURIComponent(String(args.id))}`, void 0, query);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_memories_list", "Lists memories within a given space. Results are paginated \u2014 the returned `Page` eagerly fetches the first page. Access `.data` for items and `.next_token` to resume. Use `for mem in page` to auto-paginate all pages, `page_size` to control items per API call, and `max_items` to cap total results.", {
+  server.tool("goodmem_memories_list", "Lists memories within a given space. Results are paginated; pass the response's `next_token` back as a query parameter to fetch subsequent pages.", {
     space_id: external_exports.string().describe("The UUID of the space containing the memories"),
     include_content: external_exports.boolean().describe("Whether to include the original content in the response (defaults to false).").optional(),
     include_processing_history: external_exports.boolean().describe("Whether to include background job processing history in the response (defaults to false).").optional(),
-    status_filter: external_exports.string().describe("Filter memories by processing status (PENDING, PROCESSING, COMPLETED, FAILED).").optional(),
+    status_filter: external_exports.enum(["PENDING", "PROCESSING", "COMPLETED", "FAILED"]).describe("Filter memories by processing status (PENDING, PROCESSING, COMPLETED, FAILED).").optional(),
     filter: external_exports.string().describe("Optional metadata filter expression for list results").optional(),
     max_results: external_exports.number().int().describe("Maximum number of results per page (defaults to 50, clamped to [1, 500]).").optional(),
     next_token: external_exports.string().describe("Opaque pagination token for the next page. URL-safe Base64 without padding; do not parse or construct it.").optional(),
-    sort_by: external_exports.string().describe("Field to sort by (e.g., 'created_at').").optional(),
+    sort_by: external_exports.enum(["created_at", "updated_at", "content_type", "processing_status"]).describe("Field to sort by (e.g., 'created_at').").optional(),
     sort_order: external_exports.enum(["ASCENDING", "DESCENDING", "SORT_ORDER_UNSPECIFIED"]).describe("Sort direction (ASCENDING or DESCENDING).").optional()
   }, async (args) => {
+    if (typeof args.space_id !== "string" || args.space_id === "") {
+      throw new Error("'space_id' must be a non-empty string");
+    }
     const query = {};
     if (args.include_content !== void 0)
       query["includeContent"] = String(args.include_content);
@@ -22614,7 +22704,7 @@ function registerTools() {
     const result = await callApi("GET", `/v1/spaces/${encodeURIComponent(String(args.space_id))}/memories`, void 0, query);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_memories_pages", "List memory page images", {
+  server.tool("goodmem_memories_pages", "List memory page images\n\nLists extracted page-image metadata for a memory with optional filters and pagination.", {
     id: external_exports.string().describe("Memory UUID"),
     start_page_index: external_exports.number().int().describe("Optional lower bound for returned page indices, inclusive.").optional(),
     end_page_index: external_exports.number().int().describe("Optional upper bound for returned page indices, inclusive.").optional(),
@@ -22623,6 +22713,9 @@ function registerTools() {
     max_results: external_exports.number().int().describe("Maximum number of results per page.").optional(),
     next_token: external_exports.string().describe("Opaque pagination token for the next page. Do not parse or construct it.").optional()
   }, async (args) => {
+    if (typeof args.id !== "string" || args.id === "") {
+      throw new Error("'id' must be a non-empty string");
+    }
     const query = {};
     if (args.start_page_index !== void 0)
       query["startPageIndex"] = String(args.start_page_index);
@@ -22650,12 +22743,18 @@ function registerTools() {
     }).passthrough()).describe("Optional context items (text or binary) to provide additional context for the search.").optional(),
     space_keys: external_exports.array(external_exports.object({
       spaceId: external_exports.string().describe("The UUID for the space to search."),
-      embedderWeights: external_exports.any().describe("Optional per-embedder weight overrides for this space. If not specified, database defaults are used.").optional(),
+      embedderWeights: external_exports.array(external_exports.object({
+        embedderId: external_exports.string().describe("The UUID for the embedder."),
+        weight: external_exports.number().describe("The weight to apply to this embedder's results. Can be positive, negative, or zero.")
+      }).passthrough()).describe("Optional per-embedder weight overrides for this space. If not specified, database defaults are used.").optional(),
       filter: external_exports.string().describe("Optional filter expression that must evaluate to true for memories in this space.").optional()
     }).passthrough()).describe("List of spaces to search with optional per-embedder weight overrides."),
     requested_size: external_exports.number().int().describe("Maximum number of memories to retrieve.").optional(),
-    fetch_memory: external_exports.boolean().describe("Whether to include streamed memory-definition records in the response. Defaults to true when omitted. These records include memory metadata and audit fields, but omit originalContent unless fetchMemoryContent is true.").optional(),
-    fetch_memory_content: external_exports.boolean().describe("Whether streamed memory-definition records include originalContent bytes. Requires fetchMemory=true. Defaults to false when omitted.").optional(),
+    output_budget: external_exports.object({
+      tokens: external_exports.number().int().describe("Token count for the budget. Must be positive.")
+    }).passthrough().describe("Optional soft cap for generated retrieve replies. When set to a positive token count, chat post-processing uses this value as the LLM completion-token budget.").optional(),
+    fetch_memory: external_exports.boolean().describe("Whether to include streamed memory-definition records in the response. Defaults to true when omitted. These records include memory metadata and audit fields, but omit originalContent unless fetch_memory_content is true.").optional(),
+    fetch_memory_content: external_exports.boolean().describe("Whether streamed memory-definition records include originalContent bytes. Requires fetch_memory=true. Defaults to false when omitted.").optional(),
     hnsw: external_exports.object({
       efSearch: external_exports.number().int().describe("HNSW candidate list size (1..1000).").optional(),
       iterativeScan: external_exports.enum(["ITERATIVE_SCAN_UNSPECIFIED", "ITERATIVE_SCAN_OFF", "ITERATIVE_SCAN_RELAXED_ORDER", "ITERATIVE_SCAN_STRICT_ORDER"]).describe("HNSW iterative scan mode. Use POST retrieve for this advanced tuning control.").optional(),
@@ -22664,12 +22763,12 @@ function registerTools() {
     }).passthrough().describe("Optional request-level HNSW tuning overrides. Advanced usage; available on POST retrieve.").optional(),
     post_processor: external_exports.object({
       name: external_exports.string().describe("Fully qualified factory class name of the post-processor to apply."),
-      config: external_exports.any().describe("Configuration parameters for the post-processor. Fields depend on the selected processor; see the linked documentation for the built-in ChatPostProcessor schema.").optional()
+      config: external_exports.record(external_exports.string(), external_exports.any()).describe("Configuration parameters for the post-processor. Fields depend on the selected processor; see the linked documentation for the built-in ChatPostProcessor schema.").optional()
     }).passthrough().describe("Optional post-processor configuration to transform retrieval results.").optional(),
     logging: external_exports.object({
-      enabled: external_exports.boolean().describe("Opts this request in to durable server-side request logging."),
-      callerAttributes: external_exports.any().describe("Optional flat scalar attributes attached to the persisted log row. Supported value types are string, integer, floating-point, and boolean.").optional()
-    }).passthrough().describe("Optional durable request logging block for POST retrieve requests. Supply logging.enabled=true to opt in, and optionally attach flat scalar logging.callerAttributes for persisted experiment or tracing metadata.").optional(),
+      enabled: external_exports.boolean().describe("Opts this request in to durable server-side request logging. False or omitted does not opt out of admin policy logging.").optional(),
+      callerAttributes: external_exports.record(external_exports.string(), external_exports.any()).describe("Optional flat scalar attributes attached if this request is persisted by caller opt-in or admin policy logging. Supported value types are string, integer, floating-point, and boolean. At most 32 entries are accepted.").optional()
+    }).passthrough().describe("Optional durable request logging block for POST retrieve requests. Set logging.enabled=true to opt in, or supply flat scalar logging.callerAttributes to attach if caller opt-in or an admin policy logs the request.").optional(),
     timeout_sec: external_exports.number().int().describe("Maximum seconds to wait for the streaming response (default: 200).").optional()
   }, async (args) => {
     const body = {};
@@ -22681,6 +22780,8 @@ function registerTools() {
       body["spaceKeys"] = args.space_keys;
     if (args.requested_size !== void 0)
       body["requestedSize"] = args.requested_size;
+    if (args.output_budget !== void 0)
+      body["outputBudget"] = args.output_budget;
     if (args.fetch_memory !== void 0)
       body["fetchMemory"] = args.fetch_memory;
     if (args.fetch_memory_content !== void 0)
@@ -22694,7 +22795,7 @@ function registerTools() {
     const result = await callApiNdjson("POST", `/v1/memories:retrieve`, body, void 0, args.timeout_sec);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_ocr_document", "Run OCR on a document or image. Pass base64-encoded document bytes as `content`. Optionally specify `format` (e.g., PDF, PNG) \u2014 if omitted, the server auto-detects.", {
+  server.tool("goodmem_ocr_document", "Run OCR on a document or image. Pass base64-encoded document bytes as `content`. The server auto-detects format; set `format` explicitly only if needed.", {
     content: external_exports.string().describe("Base64-encoded document bytes"),
     format: external_exports.enum(["AUTO", "PDF", "TIFF", "PNG", "JPEG", "BMP"]).describe("Input format hint (AUTO, PDF, TIFF, PNG, JPEG, BMP)").optional(),
     include_raw_json: external_exports.boolean().describe("Include raw OCR JSON payload in the response").optional(),
@@ -22718,7 +22819,79 @@ function registerTools() {
     const result = await callApi("POST", `/v1/ocr:document`, body);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_rerankers_create", "Create a new reranker", {
+  server.tool("goodmem_ping_once", "Run a single ping probe\n\nRuns a single ping probe and returns the probe result.", {
+    target_id: external_exports.string().describe("Target resource ID (UUID)"),
+    target_type_hint: external_exports.enum(["TARGET_TYPE_UNSPECIFIED", "EMBEDDER", "RERANKER", "LLM"]).describe("Optional hint for the target resource type").optional(),
+    payload_type: external_exports.enum(["PAYLOAD_TYPE_UNSPECIFIED", "TEXT", "JSON", "BINARY"]).describe("Desired payload type (defaults to provider-specific value)").optional(),
+    payload: external_exports.string().describe("Explicit UTF-8 payload to send with the probe (mutually exclusive with payload_size_bytes)").optional(),
+    payload_size_bytes: external_exports.number().int().describe("Synthetic payload size in bytes (mutually exclusive with payload)").optional(),
+    timeout_ms: external_exports.number().int().describe("Per-probe timeout in milliseconds (0 uses server default)").optional()
+  }, async (args) => {
+    const _set = [args.payload !== void 0 && args.payload !== null, args.payload_size_bytes !== void 0 && args.payload_size_bytes !== null].filter(Boolean).length;
+    if (_set > 1) {
+      throw new Error("at most one of payload or payload_size_bytes may be set");
+    }
+    const body = {};
+    if (args.target_id !== void 0)
+      body["targetId"] = args.target_id;
+    if (args.target_type_hint !== void 0)
+      body["targetTypeHint"] = args.target_type_hint;
+    if (args.payload_type !== void 0)
+      body["payloadType"] = args.payload_type;
+    if (args.payload !== void 0)
+      body["payload"] = args.payload;
+    if (args.payload_size_bytes !== void 0)
+      body["payloadSizeBytes"] = args.payload_size_bytes;
+    if (args.timeout_ms !== void 0)
+      body["timeoutMs"] = args.timeout_ms;
+    const result = await callApi("POST", `/v1/ping:once`, body, void 0, (args.timeout_ms ?? 5e3) + 3e4);
+    return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+  });
+  server.tool("goodmem_ping_stream", "Stream ping probe results\n\nOpens a streaming ping session and returns per-probe results plus a terminal summary.", {
+    target_id: external_exports.string().describe("Target resource ID (UUID)"),
+    target_type_hint: external_exports.enum(["TARGET_TYPE_UNSPECIFIED", "EMBEDDER", "RERANKER", "LLM"]).describe("Optional hint for the target resource type").optional(),
+    count: external_exports.number().int().describe("Number of probes to run (0 uses server default)").optional(),
+    interval_ms: external_exports.number().int().describe("Delay between probes in milliseconds (0 uses server default)").optional(),
+    timeout_ms: external_exports.number().int().describe("Per-probe timeout in milliseconds (0 uses server default)").optional(),
+    payload_type: external_exports.enum(["PAYLOAD_TYPE_UNSPECIFIED", "TEXT", "JSON", "BINARY"]).describe("Desired payload type (defaults to provider-specific value)").optional(),
+    payload: external_exports.string().describe("Explicit UTF-8 payload to send with each probe (mutually exclusive with payload_size_bytes)").optional(),
+    payload_size_bytes: external_exports.number().int().describe("Synthetic payload size in bytes (mutually exclusive with payload)").optional(),
+    max_in_flight: external_exports.number().int().describe("Maximum concurrent probes (defaults to 1)").optional(),
+    jitter: external_exports.boolean().describe("Add jitter to probe scheduling").optional(),
+    labels: external_exports.record(external_exports.string(), external_exports.string()).describe("Optional labels to attach to the ping session").optional(),
+    timeout_sec: external_exports.number().int().describe("Maximum seconds to wait for the streaming response (default: 200).").optional()
+  }, async (args) => {
+    const _set = [args.payload !== void 0 && args.payload !== null, args.payload_size_bytes !== void 0 && args.payload_size_bytes !== null].filter(Boolean).length;
+    if (_set > 1) {
+      throw new Error("at most one of payload or payload_size_bytes may be set");
+    }
+    const body = {};
+    if (args.target_id !== void 0)
+      body["targetId"] = args.target_id;
+    if (args.target_type_hint !== void 0)
+      body["targetTypeHint"] = args.target_type_hint;
+    if (args.count !== void 0)
+      body["count"] = args.count;
+    if (args.interval_ms !== void 0)
+      body["intervalMs"] = args.interval_ms;
+    if (args.timeout_ms !== void 0)
+      body["timeoutMs"] = args.timeout_ms;
+    if (args.payload_type !== void 0)
+      body["payloadType"] = args.payload_type;
+    if (args.payload !== void 0)
+      body["payload"] = args.payload;
+    if (args.payload_size_bytes !== void 0)
+      body["payloadSizeBytes"] = args.payload_size_bytes;
+    if (args.max_in_flight !== void 0)
+      body["maxInFlight"] = args.max_in_flight;
+    if (args.jitter !== void 0)
+      body["jitter"] = args.jitter;
+    if (args.labels !== void 0)
+      body["labels"] = args.labels;
+    const result = await callApiNdjson("POST", `/v1/ping:stream`, body, void 0, args.timeout_sec ?? Math.ceil(((args.count || 100) * (args.interval_ms || 1e3) + (args.timeout_ms || 5e3) + 6e4) / 1e3));
+    return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+  });
+  server.tool("goodmem_rerankers_create", "Create a new reranker\n\nCreates a new reranker configuration for ranking search results. Rerankers represent connections to different reranking API services (like TEI, OpenAI, etc.) and include all the necessary configuration to use them for result ranking. DUPLICATE DETECTION: Returns HTTP 409 Conflict (ALREADY_EXISTS) if another reranker exists with identical {owner_id, provider_type, endpoint_url, api_path, model_identifier, credentialsFingerprint} after URL canonicalization. Uniqueness is enforced per-owner, allowing different users to have identical configurations. Credentials are hashed (SHA-256) for uniqueness while remaining encrypted. DEFAULTS: api_path defaults to '/v2/rerank' for Cohere and '/rerank' for other providers if omitted; supported_modalities defaults to [TEXT] if omitted. Requires CREATE_RERANKER_OWN permission (or CREATE_RERANKER_ANY for admin users). This operation is NOT idempotent - each request creates a new reranker record.", {
     display_name: external_exports.string().describe("User-facing name of the reranker"),
     description: external_exports.string().describe("Description of the reranker").optional(),
     provider_type: external_exports.enum(["OPENAI", "VLLM", "TEI", "LLAMA_CPP", "VOYAGE", "COHERE", "JINA"]).describe("Type of reranking provider (auto-inferred from model_identifier if omitted)").optional(),
@@ -22732,16 +22905,16 @@ function registerTools() {
         inlineSecret: external_exports.string().describe("Secret stored directly in GoodMem (mutually exclusive with secretRef)").optional(),
         secretRef: external_exports.object({
           uri: external_exports.string().describe("URI identifying where the secret can be resolved (e.g., vault://, env://)"),
-          hints: external_exports.any().describe('Optional metadata to help resolvers decode the secret (e.g., {"encoding":"base64"})').optional()
+          hints: external_exports.record(external_exports.string(), external_exports.string()).describe('Optional metadata to help resolvers decode the secret (e.g., {"encoding":"base64"})').optional()
         }).passthrough().describe("Reference to an external secret manager entry (mutually exclusive with inlineSecret)").optional(),
         headerName: external_exports.string().describe("Desired HTTP header to carry the credential (defaults to Authorization)").optional(),
         prefix: external_exports.string().describe('Optional prefix prepended to the secret (e.g., "Bearer ")').optional()
       }).passthrough().describe("Configuration when kind is CREDENTIAL_KIND_API_KEY").optional(),
       gcpAdc: external_exports.object({
-        scopes: external_exports.any().describe("Additional OAuth scopes. Empty list falls back to the default cloud-platform scope.").optional(),
+        scopes: external_exports.array(external_exports.string()).describe("Additional OAuth scopes. Empty list falls back to the default cloud-platform scope.").optional(),
         quotaProjectId: external_exports.string().describe("Optional quota project used for billing").optional()
       }).passthrough().describe("Configuration when kind is CREDENTIAL_KIND_GCP_ADC").optional(),
-      labels: external_exports.any().describe('Optional annotations to aid operators (e.g., "owner=vertex")').optional()
+      labels: external_exports.record(external_exports.string(), external_exports.string()).describe('Optional annotations to aid operators (e.g., "owner=vertex")').optional()
     }).passthrough().describe("Structured credential payload describing how to authenticate with the provider. Required for SaaS providers; optional for local or proxy providers.").optional(),
     labels: external_exports.record(external_exports.string(), external_exports.string()).describe("User-defined labels for categorization").optional(),
     version: external_exports.string().describe("Version information").optional(),
@@ -22781,19 +22954,25 @@ function registerTools() {
     const result = await callApi("POST", `/v1/rerankers`, body);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_rerankers_delete", "Delete a reranker", {
+  server.tool("goodmem_rerankers_delete", "Delete a reranker\n\nPermanently deletes a reranker configuration. This operation cannot be undone and immediately removes the reranker record from the database. SIDE EFFECTS: Invalidates any cached references to this reranker; does not affect historical usage data or audit logs. Requires DELETE_RERANKER_OWN permission for rerankers you own (or DELETE_RERANKER_ANY for admin users). This operation is safe to retry - may return NOT_FOUND if already deleted.", {
     id: external_exports.string().describe("The unique identifier of the reranker to delete")
   }, async (args) => {
+    if (typeof args.id !== "string" || args.id === "") {
+      throw new Error("'id' must be a non-empty string");
+    }
     await callApi("DELETE", `/v1/rerankers/${encodeURIComponent(String(args.id))}`, void 0);
     return { content: [{ type: "text", text: "Deleted successfully." }] };
   });
-  server.tool("goodmem_rerankers_get", "Get a reranker by ID", {
+  server.tool("goodmem_rerankers_get", "Get a reranker by ID\n\nRetrieves the details of a specific reranker configuration by its unique identifier. Response payloads include stored credentials, matching gRPC response semantics. Requires READ_RERANKER_OWN permission for rerankers you own (or READ_RERANKER_ANY for admin users). This is a read-only operation with no side effects and is safe to retry.", {
     id: external_exports.string().describe("The unique identifier of the reranker to retrieve")
   }, async (args) => {
+    if (typeof args.id !== "string" || args.id === "") {
+      throw new Error("'id' must be a non-empty string");
+    }
     const result = await callApi("GET", `/v1/rerankers/${encodeURIComponent(String(args.id))}`, void 0);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_rerankers_list", "List rerankers", {
+  server.tool("goodmem_rerankers_list", "List rerankers\n\nRetrieves a list of reranker configurations accessible to the caller, with optional filtering. IMPORTANT: Pagination is NOT supported - all matching results are returned. Results are ordered by created_at descending. Responses include stored credentials, matching gRPC response semantics. LABEL FILTERS: Label filters accept either label.<key>=<value> or label[key]=value (for example, label.environment=production or label[environment]=production). PERMISSION-BASED FILTERING: With LIST_RERANKER_OWN permission, only your own rerankers are shown. With LIST_RERANKER_ANY permission, you can see all rerankers or filter by any owner_id. Specifying owner_id without LIST_RERANKER_ANY permission returns PERMISSION_DENIED.", {
     owner_id: external_exports.string().describe("Filter rerankers by owner ID. With LIST_RERANKER_ANY permission, omitting this shows all accessible rerankers; providing it filters by that owner. With LIST_RERANKER_OWN permission, only your own rerankers are shown regardless of this parameter (PERMISSION_DENIED if set to another user).").optional(),
     provider_type: external_exports.enum(["OPENAI", "VLLM", "TEI", "LLAMA_CPP", "VOYAGE", "COHERE", "JINA"]).describe("Filter rerankers by provider type. Allowed values match the ProviderType schema.").optional(),
     label: external_exports.record(external_exports.string(), external_exports.string()).describe("Filter by label. Each key-value pair is sent as label[key]=value query parameter.").optional()
@@ -22810,36 +22989,43 @@ function registerTools() {
     const result = await callApi("GET", `/v1/rerankers`, void 0, query);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_rerankers_update", "Update a reranker", {
+  server.tool("goodmem_rerankers_update", "Update a reranker\n\nUpdates an existing reranker configuration including display information, endpoint configuration, model parameters, credentials, and labels. All fields are optional - only specified fields will be updated. IMMUTABLE FIELDS: providerType and ownerId cannot be changed after creation. SUPPORTED_MODALITIES UPDATE: If the array contains >=1 elements, it replaces the stored set; if empty or omitted, no change occurs and it does not count as an update by itself. Returns ALREADY_EXISTS if update would create duplicate with same {ownerId, providerType, endpoint_url, api_path, model_identifier, credentialsFingerprint} after URL canonicalization (HTTP 409 Conflict / ALREADY_EXISTS). Requires UPDATE_RERANKER_OWN permission for rerankers you own (or UPDATE_RERANKER_ANY for admin users). This operation is idempotent.", {
     id: external_exports.string().describe("The unique identifier of the reranker to update"),
     display_name: external_exports.string().describe("User-facing name of the reranker").optional(),
     description: external_exports.string().describe("Description of the reranker").optional(),
     endpoint_url: external_exports.string().describe("API endpoint URL").optional(),
     api_path: external_exports.string().describe("API path for reranking request").optional(),
     model_identifier: external_exports.string().describe("Model identifier").optional(),
-    supported_modalities: external_exports.array(external_exports.enum(["TEXT", "IMAGE", "AUDIO", "VIDEO"])).describe("Supported content modalities").optional(),
+    supported_modalities: external_exports.array(external_exports.enum(["TEXT", "IMAGE", "AUDIO", "VIDEO"])).describe("Update supported modalities (if array contains >=1 elements, replaces stored set; if empty or omitted, no change and does not count as an update by itself)").optional(),
     credentials: external_exports.object({
       kind: external_exports.enum(["CREDENTIAL_KIND_UNSPECIFIED", "CREDENTIAL_KIND_API_KEY", "CREDENTIAL_KIND_GCP_ADC"]).describe("Selected credential strategy"),
       apiKey: external_exports.object({
         inlineSecret: external_exports.string().describe("Secret stored directly in GoodMem (mutually exclusive with secretRef)").optional(),
         secretRef: external_exports.object({
           uri: external_exports.string().describe("URI identifying where the secret can be resolved (e.g., vault://, env://)"),
-          hints: external_exports.any().describe('Optional metadata to help resolvers decode the secret (e.g., {"encoding":"base64"})').optional()
+          hints: external_exports.record(external_exports.string(), external_exports.string()).describe('Optional metadata to help resolvers decode the secret (e.g., {"encoding":"base64"})').optional()
         }).passthrough().describe("Reference to an external secret manager entry (mutually exclusive with inlineSecret)").optional(),
         headerName: external_exports.string().describe("Desired HTTP header to carry the credential (defaults to Authorization)").optional(),
         prefix: external_exports.string().describe('Optional prefix prepended to the secret (e.g., "Bearer ")').optional()
       }).passthrough().describe("Configuration when kind is CREDENTIAL_KIND_API_KEY").optional(),
       gcpAdc: external_exports.object({
-        scopes: external_exports.any().describe("Additional OAuth scopes. Empty list falls back to the default cloud-platform scope.").optional(),
+        scopes: external_exports.array(external_exports.string()).describe("Additional OAuth scopes. Empty list falls back to the default cloud-platform scope.").optional(),
         quotaProjectId: external_exports.string().describe("Optional quota project used for billing").optional()
       }).passthrough().describe("Configuration when kind is CREDENTIAL_KIND_GCP_ADC").optional(),
-      labels: external_exports.any().describe('Optional annotations to aid operators (e.g., "owner=vertex")').optional()
+      labels: external_exports.record(external_exports.string(), external_exports.string()).describe('Optional annotations to aid operators (e.g., "owner=vertex")').optional()
     }).passthrough().describe("Structured credential payload describing how to authenticate with the provider. Omit to keep existing credentials.").optional(),
-    replace_labels: external_exports.record(external_exports.string(), external_exports.string()).describe("Replace all existing labels with these (mutually exclusive with mergeLabels)").optional(),
-    merge_labels: external_exports.record(external_exports.string(), external_exports.string()).describe("Merge these labels with existing ones (mutually exclusive with replaceLabels)").optional(),
+    replace_labels: external_exports.record(external_exports.string(), external_exports.string()).describe("Replace all existing labels with these (mutually exclusive with merge_labels)").optional(),
+    merge_labels: external_exports.record(external_exports.string(), external_exports.string()).describe("Merge these labels with existing ones (mutually exclusive with replace_labels)").optional(),
     version: external_exports.string().describe("Version information").optional(),
     monitoring_endpoint: external_exports.string().describe("Monitoring endpoint URL").optional()
   }, async (args) => {
+    if (typeof args.id !== "string" || args.id === "") {
+      throw new Error("'id' must be a non-empty string");
+    }
+    const _set = [args.replace_labels !== void 0 && args.replace_labels !== null, args.merge_labels !== void 0 && args.merge_labels !== null].filter(Boolean).length;
+    if (_set > 1) {
+      throw new Error("at most one of replace_labels or merge_labels may be set");
+    }
     const body = {};
     if (args.display_name !== void 0)
       body["displayName"] = args.display_name;
@@ -22866,13 +23052,13 @@ function registerTools() {
     const result = await callApi("PUT", `/v1/rerankers/${encodeURIComponent(String(args.id))}`, body);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_spaces_create", "Create a new Space", {
+  server.tool("goodmem_spaces_create", "Create a new Space\n\nCreates a new space with the provided name, labels, and embedder configuration. A space is a container for organizing related memories. OWNER DEFAULTS: Owner defaults to authenticated user unless owner_id is provided (requires CREATE_SPACE_ANY if differs). EMBEDDER REQUIREMENTS: At least one embedder configuration must be specified. DUPLICATE DETECTION: Returns ALREADY_EXISTS if another space exists with identical {owner_id, name} (case-sensitive). Requires CREATE_SPACE_OWN permission (or CREATE_SPACE_ANY for admin users). This operation is NOT idempotent.", {
     name: external_exports.string().describe("The desired name for the space. Must be unique within the user's scope."),
     labels: external_exports.record(external_exports.string(), external_exports.string()).describe("A set of key-value pairs to categorize or tag the space. Used for filtering and organizational purposes.").optional(),
     space_embedders: external_exports.array(external_exports.object({
       embedderId: external_exports.string().describe("The UUID for the embedder to associate with the space."),
       defaultRetrievalWeight: external_exports.number().describe("Relative weight for this embedder used by default during retrieval. If omitted, defaults to 1.0; values need not sum to 1 and can be overridden per request.").optional()
-    }).passthrough()).min(1).describe("List of embedder configurations to associate with this space. At least one embedder configuration is required. Each specifies an embedder ID and a relative default retrieval weight used when no per-request overrides are provided."),
+    }).passthrough()).describe("List of embedder configurations to associate with this space. At least one embedder configuration is required. Each specifies an embedder ID and a relative default retrieval weight used when no per-request overrides are provided."),
     public_read: external_exports.boolean().describe("Indicates if the space and its memories can be read by unauthenticated users or users other than the owner. Defaults to false.").optional(),
     owner_id: external_exports.string().describe("Optional owner ID. If not provided, derived from the authentication context. Requires CREATE_SPACE_ANY permission if specified.").optional(),
     default_chunking_config: external_exports.object({
@@ -22880,7 +23066,7 @@ function registerTools() {
       recursive: external_exports.object({
         chunkSize: external_exports.number().int().describe("Maximum size of a chunk (should be \u2264 context window)"),
         chunkOverlap: external_exports.number().int().describe("Sliding overlap between chunks"),
-        separators: external_exports.any().describe("Hierarchical separator list (order = preference)").optional(),
+        separators: external_exports.array(external_exports.string()).describe("Hierarchical separator list (order = preference)").optional(),
         keepStrategy: external_exports.enum(["KEEP_NONE", "KEEP_START", "KEEP_END"]).describe("How to handle separators after splitting. KEEP_NONE is deprecated and behaves as KEEP_END."),
         separatorIsRegex: external_exports.boolean().describe("Whether separators are regex patterns").optional(),
         lengthMeasurement: external_exports.enum(["CHARACTER_COUNT", "TOKEN_COUNT", "CUSTOM"]).describe("How to measure chunk length")
@@ -22912,24 +23098,30 @@ function registerTools() {
     const result = await callApi("POST", `/v1/spaces`, body);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_spaces_delete", "Delete a space", {
+  server.tool("goodmem_spaces_delete", "Delete a space\n\nPermanently deletes a space and all associated content. This operation cannot be undone. CASCADE DELETION: Removes the space record and cascades deletion to associated memories, chunks, and embedder associations. Requires DELETE_SPACE_OWN permission for spaces you own (or DELETE_SPACE_ANY for admin users). This operation is safe to retry - may return NOT_FOUND if already deleted.", {
     id: external_exports.string().describe("The unique identifier of the space to delete")
   }, async (args) => {
+    if (typeof args.id !== "string" || args.id === "") {
+      throw new Error("'id' must be a non-empty string");
+    }
     await callApi("DELETE", `/v1/spaces/${encodeURIComponent(String(args.id))}`, void 0);
     return { content: [{ type: "text", text: "Deleted successfully." }] };
   });
-  server.tool("goodmem_spaces_get", "Get a space by ID", {
+  server.tool("goodmem_spaces_get", "Get a space by ID\n\nRetrieves a specific space by its unique identifier. Returns the complete space information, including name, labels, embedder configuration, and metadata. PUBLIC SPACE ACCESS: When public_read=true, any authenticated user can retrieve the space metadata, bypassing ownership checks. Otherwise, requires ownership or DISPLAY_SPACE_ANY permission. Requires DISPLAY_SPACE_OWN permission for owned spaces (or DISPLAY_SPACE_ANY for admin users to view any space). This is a read-only operation safe to retry.", {
     id: external_exports.string().describe("The unique identifier of the space to retrieve")
   }, async (args) => {
+    if (typeof args.id !== "string" || args.id === "") {
+      throw new Error("'id' must be a non-empty string");
+    }
     const result = await callApi("GET", `/v1/spaces/${encodeURIComponent(String(args.id))}`, void 0);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_spaces_list", "List spaces accessible to the caller, with optional filtering by owner, labels, and name. Results are paginated \u2014 the returned `Page` eagerly fetches the first page. Access `.data` for items and `.next_token` to resume. Use `for space in page` to auto-paginate all pages, `page_size` to control items per API call, and `max_items` to cap total results.", {
-    owner_id: external_exports.string().describe("Filter spaces by owner ID. With LIST_SPACE_ANY permission and ownerId omitted, returns all visible spaces. Otherwise returns caller-owned spaces only. Specifying ownerId without LIST_SPACE_ANY returns PERMISSION_DENIED.").optional(),
+  server.tool("goodmem_spaces_list", "List spaces accessible to the caller, with optional filtering by owner, labels, and name. Results are paginated; pass the response's `next_token` back as a query parameter to fetch subsequent pages.", {
+    owner_id: external_exports.string().describe("Filter spaces by owner ID. With LIST_SPACE_ANY permission and owner_id omitted, returns all visible spaces. Otherwise returns caller-owned spaces only. Specifying owner_id without LIST_SPACE_ANY returns PERMISSION_DENIED.").optional(),
     name_filter: external_exports.string().describe("Filter spaces by name using glob pattern matching").optional(),
     max_results: external_exports.number().int().describe("Maximum number of results to return in a single page (defaults to 50, clamped to [1, 1000])").optional(),
     next_token: external_exports.string().describe("Pagination token for retrieving the next set of results").optional(),
-    sort_by: external_exports.string().describe("Field to sort by: 'created_time', 'updated_time', or 'name' (default: 'created_time'). Unsupported values return INVALID_ARGUMENT.").optional(),
+    sort_by: external_exports.enum(["created_time", "updated_time", "name"]).describe("Field to sort by: 'created_time', 'updated_time', or 'name' (default: 'created_time'). Unsupported values return INVALID_ARGUMENT.").optional(),
     sort_order: external_exports.enum(["ASCENDING", "DESCENDING", "SORT_ORDER_UNSPECIFIED"]).describe("Sort order (ASCENDING or DESCENDING, default: DESCENDING)").optional(),
     label: external_exports.record(external_exports.string(), external_exports.string()).describe("Filter by label. Each key-value pair is sent as label[key]=value query parameter.").optional()
   }, async (args) => {
@@ -22953,13 +23145,20 @@ function registerTools() {
     const result = await callApi("GET", `/v1/spaces`, void 0, query);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_spaces_update", "Update a space", {
+  server.tool("goodmem_spaces_update", "Update a space\n\nUpdates an existing space with new values for the specified fields. Only name, public_read, and labels can be updated. Fields not included in the request remain unchanged. IMMUTABLE FIELDS: space_embedders, default_chunking_config, and ownerId cannot be modified after creation. NAME UNIQUENESS: Name must be unique per owner - returns ALREADY_EXISTS if name conflicts with existing space. Requires UPDATE_SPACE_OWN permission for spaces you own (or UPDATE_SPACE_ANY for admin users). This operation is idempotent.", {
     id: external_exports.string().describe("The unique identifier of the space to update"),
     name: external_exports.string().describe("The new name for the space.").optional(),
     public_read: external_exports.boolean().describe("Whether the space is publicly readable by all users.").optional(),
-    replace_labels: external_exports.record(external_exports.string(), external_exports.string()).describe("Labels to replace all existing labels. Mutually exclusive with mergeLabels.").optional(),
-    merge_labels: external_exports.record(external_exports.string(), external_exports.string()).describe("Labels to merge with existing labels. Mutually exclusive with replaceLabels.").optional()
+    replace_labels: external_exports.record(external_exports.string(), external_exports.string()).describe("Labels to replace all existing labels. Mutually exclusive with merge_labels.").optional(),
+    merge_labels: external_exports.record(external_exports.string(), external_exports.string()).describe("Labels to merge with existing labels. Mutually exclusive with replace_labels.").optional()
   }, async (args) => {
+    if (typeof args.id !== "string" || args.id === "") {
+      throw new Error("'id' must be a non-empty string");
+    }
+    const _set = [args.replace_labels !== void 0 && args.replace_labels !== null, args.merge_labels !== void 0 && args.merge_labels !== null].filter(Boolean).length;
+    if (_set > 1) {
+      throw new Error("at most one of replace_labels or merge_labels may be set");
+    }
     const body = {};
     if (args.name !== void 0)
       body["name"] = args.name;
@@ -22972,27 +23171,29 @@ function registerTools() {
     const result = await callApi("PUT", `/v1/spaces/${encodeURIComponent(String(args.id))}`, body);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_system_info", "Retrieve server build metadata", {}, async (args) => {
+  server.tool("goodmem_system_info", "Retrieve server build metadata\n\nReturns the server's advertised semantic version, git metadata, build timestamp, and optional capability flags. The endpoint is intentionally unauthenticated so bootstrap tooling can call it before API keys exist.", {}, async (args) => {
     const result = await callApi("GET", `/v1/system/info`, void 0);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_system_init", "Initialize the system", {}, async (args) => {
+  server.tool("goodmem_system_init", "Initialize the system\n\nInitializes the system by creating a root user and API key. This endpoint should only be called once during first-time setup. If the system is already initialized, the endpoint will return a success response without creating new credentials.", {}, async (args) => {
     const result = await callApi("POST", `/v1/system/init`, void 0);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_users_get", "Retrieves a user by ID or email address. Exactly one of `id` and `email` must be provided. For getting your own profile, use `client.users.me()`.", {
+  server.tool("goodmem_users_get", "Retrieves a user by ID or email address. Exactly one of `id` and `email` must be provided. For getting your own profile, use the `goodmem_users_me` tool.", {
     id: external_exports.string().describe("The UUID of the user to retrieve").optional(),
     email: external_exports.string().describe("The email address of the user to retrieve").optional()
   }, async (args) => {
-    if (args.id !== void 0 && args.email !== void 0)
+    const _hasId = typeof args.id === "string" && args.id !== "";
+    const _hasEmail = typeof args.email === "string" && args.email !== "";
+    if (_hasId && _hasEmail)
       throw new Error("Exactly one of 'id', 'email' must be provided, not both.");
-    if (args.id === void 0 && args.email === void 0)
-      throw new Error("Exactly one of 'id', 'email' must be provided.");
-    const url = args.email ? `/v1/users/email/${encodeURIComponent(String(args.email))}` : `/v1/users/${encodeURIComponent(String(args.id))}`;
+    if (!_hasId && !_hasEmail)
+      throw new Error("Exactly one of 'id', 'email' must be provided (non-empty).");
+    const url = _hasEmail ? `/v1/users/email/${encodeURIComponent(String(args.email))}` : `/v1/users/${encodeURIComponent(String(args.id))}`;
     const result = await callApi("GET", url, void 0);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_users_me", "Get current user profile", {}, async (args) => {
+  server.tool("goodmem_users_me", "Get current user profile\n\nRetrieves the authenticated user's profile information including email, display name, and creation time. This endpoint does not require any parameters as it automatically returns the caller's information.", {}, async (args) => {
     const result = await callApi("GET", `/v1/users/me`, void 0);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
@@ -23004,17 +23205,19 @@ async function healthCheck() {
     return;
   }
   try {
-    const url = new URL("/v1/system/info", goodmemBaseUrl);
+    const url = _buildUrl(goodmemBaseUrl, "/v1/system/info");
     const resp = await fetch(url.toString(), {
       headers: { "x-api-key": goodmemApiKey },
-      signal: AbortSignal.timeout(1e4)
+      signal: AbortSignal.timeout(1e4),
+      // See callApi for the redirect-policy rationale.
+      redirect: "error"
     });
     if (resp.ok) {
       const info = await resp.json();
       console.error(`[goodmem-mcp] Connected to ${goodmemBaseUrl} (server ${info.version ?? "unknown"}).`);
     } else {
       const text = await resp.text();
-      console.error(`[goodmem-mcp] Health check failed (${resp.status}): ${text}`);
+      console.error(`[goodmem-mcp] Health check failed (${resp.status}): ${_trimBody(text)}`);
     }
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);