@stackwright-pro/mcp 0.2.0-alpha.107 → 0.2.0-alpha.109

package/dist/server.js

@@ -1334,6 +1334,10 @@ function answersToManifestFormat(answers, questions) {
 // src/validation.ts
 var SAFE_PHASE = /^[a-z][a-z0-9-]{0,30}$/;
 var SAFE_QUESTION_ID = /^[a-z0-9][a-z0-9-]{0,63}$/i;
+var SAFE_SLUG = /^[a-z0-9][a-z0-9-]{0,79}$/;
+function isValidSlug(slug) {
+  return SAFE_SLUG.test(slug);
+}
 function isValidPhase(phase) {
   return SAFE_PHASE.test(phase);
 }
@@ -2023,9 +2027,9 @@ function registerOrchestrationTools(server2) {
 
 // src/tools/pipeline.ts
 var import_zod13 = require("zod");
-var import_fs7 = require("fs");
+var import_fs8 = require("fs");
 var import_proper_lockfile = require("proper-lockfile");
-var import_path7 = require("path");
+var import_path8 = require("path");
 var import_crypto3 = require("crypto");
 
 // src/artifact-signing.ts
@@ -2552,6 +2556,234 @@ function formatPulseRetryPrompt(result) {
   return lines.join("\n");
 }
 
+// src/tools/validate-api-integration.ts
+var CANONICAL_API_AUTH_TYPES = ["apiKey", "bearer", "oauth2", "oidc", "none"];
+var CANONICAL_SET = new Set(CANONICAL_API_AUTH_TYPES);
+var VALID_SET_DISPLAY = CANONICAL_API_AUTH_TYPES.map((t) => `\`${t}\``).join(", ");
+var RENAME_MAP = {
+  // apiKey variants
+  "api-key": "apiKey",
+  api_key: "apiKey",
+  apikey: "apiKey",
+  // lowercase of 'apiKey' / 'APIKEY'
+  // oauth2 variants
+  "oauth-2": "oauth2",
+  oauth_2: "oauth2",
+  // oidc variants
+  "open-id-connect": "oidc",
+  "openid-connect": "oidc",
+  openidconnect: "oidc",
+  // lowercase of 'openIdConnect'
+  openidconnect_: "oidc",
+  // belt-and-suspenders
+  openIdConnect: "oidc",
+  // exact camelCase as emitted by some tooling
+  // bearer variants
+  "bearer-token": "bearer",
+  bearer_token: "bearer"
+};
+function renameSuggestion(badLiteral) {
+  return RENAME_MAP[badLiteral] ?? RENAME_MAP[badLiteral.toLowerCase()];
+}
+function validateAuthType(authType, yamlPath, artifactPath) {
+  if (authType === void 0 || authType === null) return null;
+  if (typeof authType !== "string") {
+    return [
+      `${artifactPath}: \`${yamlPath}\` must be a string, got \`${typeof authType}\`.`,
+      `Valid values: ${VALID_SET_DISPLAY}.`,
+      "Fix this value and re-call stackwright_pro_validate_artifact."
+    ].join("\n");
+  }
+  if (CANONICAL_SET.has(authType)) return null;
+  const suggestion = renameSuggestion(authType);
+  const lines = [
+    `${artifactPath}: \`${yamlPath}\` has non-canonical value \`"${authType}"\`.`,
+    `Valid values: ${VALID_SET_DISPLAY}.`
+  ];
+  if (suggestion) {
+    lines.push(`Did you mean: \`${suggestion}\`?`);
+  }
+  lines.push("Fix this value and re-call stackwright_pro_validate_artifact.");
+  return lines.join("\n");
+}
+function validateApiIntegration(artifact, integrationName) {
+  const artifactFile = integrationName ? `api-config-${integrationName}.json` : "api-config.json";
+  const artifactPath = `.stackwright/artifacts/${artifactFile}`;
+  if (artifact === null || typeof artifact !== "object") {
+    return { valid: true };
+  }
+  const obj = artifact;
+  const errors = [];
+  if ("auth" in obj && obj["auth"] !== null && typeof obj["auth"] === "object") {
+    const auth = obj["auth"];
+    const err = validateAuthType(auth["type"], "auth.type", artifactPath);
+    if (err) errors.push(err);
+  }
+  if ("securitySchemes" in obj && obj["securitySchemes"] !== null && typeof obj["securitySchemes"] === "object" && !Array.isArray(obj["securitySchemes"])) {
+    const schemes = obj["securitySchemes"];
+    for (const [schemeName, scheme] of Object.entries(schemes)) {
+      if (scheme !== null && typeof scheme === "object") {
+        const s = scheme;
+        const err = validateAuthType(s["type"], `securitySchemes.${schemeName}.type`, artifactPath);
+        if (err) errors.push(err);
+      }
+    }
+  }
+  if (errors.length === 0) return { valid: true };
+  const retryPrompt = [
+    `API integration auth validation failed: ${errors.length} violation(s) in ${artifactPath}.`,
+    "",
+    "You MUST fix ALL violations and re-call stackwright_pro_validate_artifact.",
+    "",
+    ...errors.flatMap((e) => [e, ""]),
+    `Canonical auth.type values: ${VALID_SET_DISPLAY}.`,
+    "Do NOT use hyphenated or underscored variants (api-key, oauth-2, bearer-token, etc.)."
+  ].join("\n");
+  return { valid: false, retryPrompt };
+}
+
+// src/tools/validate-auth-config.ts
+var KNOWN_NESTED_STRATEGIES = ["oidc", "pki"];
+var NESTED_STRATEGY_FIELD_EXAMPLES = {
+  oidc: ["discoveryUrl", "clientId", "clientSecret"],
+  pki: ["profile", "source", "headerPrefix"]
+};
+function nestedBlockError(strategy, nestedObj, artifactPath) {
+  const exampleFields = NESTED_STRATEGY_FIELD_EXAMPLES[strategy];
+  const actualKeys = Object.keys(nestedObj).slice(0, 2);
+  const showField0 = actualKeys[0] ?? exampleFields[0];
+  const showField1 = actualKeys[1] ?? exampleFields[1];
+  return [
+    `${artifactPath}: \`authConfig.${strategy}\` must not be a nested provider block.`,
+    `Hoist \`authConfig.${strategy}.*\` fields to \`authConfig.*\`. The canonical AuthConfig`,
+    `schema does not nest provider-specific fields under a named sub-object.`,
+    ``,
+    `Bad (nested block):`,
+    `  "authConfig": {`,
+    `    "type": "${strategy}",`,
+    `    "${strategy}": {`,
+    `      "${showField0}": "...",`,
+    `      "${showField1}": "...",`,
+    `      ...`,
+    `    }`,
+    `  }`,
+    ``,
+    `Correct (hoisted to root of authConfig):`,
+    `  "authConfig": {`,
+    `    "type": "${strategy}",`,
+    `    "${exampleFields[0]}": "...",`,
+    `    "${exampleFields[1]}": "...",`,
+    `    "${exampleFields[2]}": "...",`,
+    `    ...`,
+    `  }`,
+    ``,
+    `Move every key from \`authConfig.${strategy}\` up to \`authConfig\` and remove the \`"${strategy}"\` sub-object.`
+  ].join("\n");
+}
+function discriminatorKeyError(methodVal, artifactPath) {
+  return [
+    `${artifactPath}: \`authConfig.method\` is not a valid key in the canonical AuthConfig schema.`,
+    `Rename \`authConfig.method\` \u2192 \`authConfig.type\`. The canonical AuthConfig schema uses`,
+    `\`type\` as the auth-strategy discriminator, matching the api-config \`auth.type\` convention`,
+    `shipped in swp-fimq.`,
+    ``,
+    `Bad:`,
+    `  "authConfig": { "method": "${methodVal}", ... }`,
+    ``,
+    `Correct:`,
+    `  "authConfig": { "type": "${methodVal}", ... }`
+  ].join("\n");
+}
+function ambiguousDiscriminatorError(methodVal, typeVal, artifactPath) {
+  return [
+    `${artifactPath}: \`authConfig\` has both \`method: "${methodVal}"\` and \`type: "${typeVal}"\` \u2014 ambiguous discriminator.`,
+    `Remove \`authConfig.method\` and keep only \`authConfig.type\`. The canonical AuthConfig`,
+    `schema uses \`type\` as the sole auth-strategy discriminator.`
+  ].join("\n");
+}
+function validateAuthConfig(artifact, artifactPath) {
+  if (artifact === null || typeof artifact !== "object") {
+    return { valid: true };
+  }
+  const obj = artifact;
+  if (!("authConfig" in obj) || obj["authConfig"] === void 0 || obj["authConfig"] === null) {
+    return { valid: true };
+  }
+  if (typeof obj["authConfig"] !== "object" || Array.isArray(obj["authConfig"])) {
+    return { valid: true };
+  }
+  const authConfig = obj["authConfig"];
+  const errors = [];
+  const hasMethod = "method" in authConfig && authConfig["method"] !== void 0;
+  const hasType = "type" in authConfig && authConfig["type"] !== void 0;
+  if (hasMethod && hasType) {
+    errors.push(
+      ambiguousDiscriminatorError(
+        String(authConfig["method"]),
+        String(authConfig["type"]),
+        artifactPath
+      )
+    );
+  } else if (hasMethod && !hasType) {
+    errors.push(discriminatorKeyError(String(authConfig["method"]), artifactPath));
+  }
+  for (const strategy of KNOWN_NESTED_STRATEGIES) {
+    const nested = authConfig[strategy];
+    if (nested !== null && nested !== void 0 && typeof nested === "object" && !Array.isArray(nested)) {
+      errors.push(nestedBlockError(strategy, nested, artifactPath));
+    }
+  }
+  if (errors.length === 0) return { valid: true };
+  const retryPrompt = [
+    `Auth config validation failed: ${errors.length} violation(s) in ${artifactPath}.`,
+    ``,
+    `You MUST fix ALL violations and re-call stackwright_pro_validate_artifact.`,
+    ``,
+    ...errors.flatMap((e) => [e, ""]),
+    `The canonical authConfig shape uses \`type\` (not \`method\`) as the discriminator,`,
+    `with all provider-specific fields hoisted to the root of \`authConfig\`.`,
+    `AuthConfig is a discriminated union on \`type: 'oidc' | 'pki'\`.`
+  ].join("\n");
+  return { valid: false, retryPrompt };
+}
+
+// src/tools/auth-manifest-aggregator.ts
+var import_fs6 = require("fs");
+var import_path6 = require("path");
+function extractPatternBaseSlug(pattern) {
+  const stripped = pattern.replace(/^\//, "");
+  if (!stripped) return null;
+  return stripped.split("/")[0] ?? null;
+}
+function extractManifestSlugs(artifactsDir) {
+  const slugs = /* @__PURE__ */ new Set();
+  if (!(0, import_fs6.existsSync)(artifactsDir)) return slugs;
+  let entries;
+  try {
+    entries = (0, import_fs6.readdirSync)(artifactsDir);
+  } catch {
+    return slugs;
+  }
+  for (const entry of entries) {
+    if (!entry.endsWith("-manifest.json")) continue;
+    try {
+      const content = JSON.parse((0, import_fs6.readFileSync)((0, import_path6.join)(artifactsDir, entry), "utf-8"));
+      const pages = content.pages;
+      if (!Array.isArray(pages)) continue;
+      for (const page of pages) {
+        if (typeof page.slug !== "string" || !page.slug) continue;
+        const firstSeg = page.slug.split("/")[0];
+        if (firstSeg) slugs.add(firstSeg);
+        if (!page.slug.includes("[") && !page.slug.includes(":")) {
+          slugs.add(page.slug);
+        }
+      }
+    } catch {
+    }
+  }
+  return slugs;
+}
+
 // src/tools/pipeline.ts
 var import_types3 = require("@stackwright-pro/types");
 
@@ -2890,8 +3122,8 @@ function registerGetSchemaTool(server2) {
 }
 
 // src/tools/pipeline-graph.ts
-var import_fs6 = require("fs");
-var import_path6 = require("path");
+var import_fs7 = require("fs");
+var import_path7 = require("path");
 var MANIFEST_NAME_TO_PHASE = {
   "stackwright-pro-designer-otter": "designer",
   "stackwright-pro-theme-otter": "theme",
@@ -2921,9 +3153,9 @@ var OTTER_SEARCH_PATHS = [
 function resolveOtterDirFromCwd() {
   const cwd = process.cwd();
   for (const relative2 of OTTER_SEARCH_PATHS) {
-    const candidate = (0, import_path6.join)(cwd, relative2);
+    const candidate = (0, import_path7.join)(cwd, relative2);
     try {
-      (0, import_fs6.lstatSync)(candidate);
+      (0, import_fs7.lstatSync)(candidate);
       return candidate;
     } catch {
     }
@@ -2933,14 +3165,14 @@ function resolveOtterDirFromCwd() {
   );
 }
 function loadOtterManifestsFromDir(otterDir) {
-  const entries = (0, import_fs6.readdirSync)(otterDir);
+  const entries = (0, import_fs7.readdirSync)(otterDir);
   const manifests = [];
   for (const filename of entries) {
     if (!filename.endsWith("-otter.json")) continue;
-    const filePath = (0, import_path6.join)(otterDir, filename);
-    if ((0, import_fs6.lstatSync)(filePath).isSymbolicLink()) continue;
+    const filePath = (0, import_path7.join)(otterDir, filename);
+    if ((0, import_fs7.lstatSync)(filePath).isSymbolicLink()) continue;
     try {
-      const raw = (0, import_fs6.readFileSync)(filePath, "utf-8");
+      const raw = (0, import_fs7.readFileSync)(filePath, "utf-8");
       const manifest = JSON.parse(raw);
       manifests.push(manifest);
     } catch (err) {
@@ -3045,19 +3277,19 @@ var DISTRIBUTED_NAMESPACES = ["@stackwright-pro", "@stackwright"];
 function loadDistributedOtterManifests(cwd) {
   const results = [];
   for (const namespace of DISTRIBUTED_NAMESPACES) {
-    const nsDir = (0, import_path6.join)(cwd, "node_modules", namespace);
+    const nsDir = (0, import_path7.join)(cwd, "node_modules", namespace);
     let pkgDirNames;
     try {
-      pkgDirNames = (0, import_fs6.readdirSync)(nsDir);
+      pkgDirNames = (0, import_fs7.readdirSync)(nsDir);
     } catch {
       continue;
     }
     for (const pkgDirName of pkgDirNames) {
-      const pkgDir = (0, import_path6.join)(nsDir, pkgDirName);
+      const pkgDir = (0, import_path7.join)(nsDir, pkgDirName);
       const packageName = `${namespace}/${pkgDirName}`;
       let otterRelPaths;
       try {
-        const raw = (0, import_fs6.readFileSync)((0, import_path6.join)(pkgDir, "package.json"), "utf-8");
+        const raw = (0, import_fs7.readFileSync)((0, import_path7.join)(pkgDir, "package.json"), "utf-8");
         const pkgJson = JSON.parse(raw);
         const declared = pkgJson.stackwright?.otters;
         if (!Array.isArray(declared) || declared.length === 0) continue;
@@ -3066,9 +3298,9 @@ function loadDistributedOtterManifests(cwd) {
         continue;
       }
       for (const relPath of otterRelPaths) {
-        const otterFilePath = (0, import_path6.join)(pkgDir, relPath);
+        const otterFilePath = (0, import_path7.join)(pkgDir, relPath);
         try {
-          const raw = (0, import_fs6.readFileSync)(otterFilePath, "utf-8");
+          const raw = (0, import_fs7.readFileSync)(otterFilePath, "utf-8");
           const manifest = JSON.parse(raw);
           results.push({ manifest, packageName });
         } catch (err) {
@@ -3186,11 +3418,11 @@ function createDefaultState() {
   };
 }
 function statePath(cwd) {
-  return (0, import_path7.join)(cwd, ".stackwright", "pipeline-state.json");
+  return (0, import_path8.join)(cwd, ".stackwright", "pipeline-state.json");
 }
 function readState(cwd) {
   const p = statePath(cwd);
-  if (!(0, import_fs7.existsSync)(p)) return createDefaultState();
+  if (!(0, import_fs8.existsSync)(p)) return createDefaultState();
   const raw = JSON.parse(safeReadSync(p));
   if (typeof raw !== "object" || raw === null || raw.version !== "1.0") {
     return createDefaultState();
@@ -3198,34 +3430,34 @@ function readState(cwd) {
   return raw;
 }
 function safeWriteSync(filePath, content) {
-  if ((0, import_fs7.existsSync)(filePath)) {
-    const stat = (0, import_fs7.lstatSync)(filePath);
+  if ((0, import_fs8.existsSync)(filePath)) {
+    const stat = (0, import_fs8.lstatSync)(filePath);
     if (stat.isSymbolicLink()) {
       throw new Error(`Refusing to write to symlink: ${filePath}`);
     }
   }
-  (0, import_fs7.writeFileSync)(filePath, content);
+  (0, import_fs8.writeFileSync)(filePath, content);
 }
 function safeReadSync(filePath) {
-  if ((0, import_fs7.existsSync)(filePath)) {
-    const stat = (0, import_fs7.lstatSync)(filePath);
+  if ((0, import_fs8.existsSync)(filePath)) {
+    const stat = (0, import_fs8.lstatSync)(filePath);
     if (stat.isSymbolicLink()) {
       throw new Error(`Refusing to read symlink: ${filePath}`);
     }
   }
-  return (0, import_fs7.readFileSync)(filePath, "utf-8");
+  return (0, import_fs8.readFileSync)(filePath, "utf-8");
 }
 function writeState(cwd, state) {
-  const dir = (0, import_path7.join)(cwd, ".stackwright");
-  (0, import_fs7.mkdirSync)(dir, { recursive: true });
+  const dir = (0, import_path8.join)(cwd, ".stackwright");
+  (0, import_fs8.mkdirSync)(dir, { recursive: true });
   state.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
   safeWriteSync(statePath(cwd), JSON.stringify(state, null, 2) + "\n");
 }
 function updateStateAtomic(cwd, mutator) {
-  const dir = (0, import_path7.join)(cwd, ".stackwright");
-  (0, import_fs7.mkdirSync)(dir, { recursive: true });
+  const dir = (0, import_path8.join)(cwd, ".stackwright");
+  (0, import_fs8.mkdirSync)(dir, { recursive: true });
   const path5 = statePath(cwd);
-  if (!(0, import_fs7.existsSync)(path5)) {
+  if (!(0, import_fs8.existsSync)(path5)) {
     safeWriteSync(path5, JSON.stringify(createDefaultState(), null, 2) + "\n");
   }
   const release = (0, import_proper_lockfile.lockSync)(path5, {
@@ -3259,8 +3491,8 @@ function handleGetPipelineState(_cwd) {
   const cwd = _cwd ?? process.cwd();
   try {
     const state = readState(cwd);
-    const keyPath = (0, import_path7.join)(cwd, ".stackwright", "pipeline-keys.json");
-    if (!(0, import_fs7.existsSync)(keyPath)) {
+    const keyPath = (0, import_path8.join)(cwd, ".stackwright", "pipeline-keys.json");
+    if (!(0, import_fs8.existsSync)(keyPath)) {
       try {
         const { fingerprint } = initPipelineKeys(cwd);
         state["signingKeyFingerprint"] = fingerprint;
@@ -3391,8 +3623,8 @@ function handleCheckExecutionReady(_cwd, phase) {
         isError: true
       };
     }
-    const answerFile = (0, import_path7.join)(cwd, ".stackwright", "answers", `${phase}.json`);
-    if (!(0, import_fs7.existsSync)(answerFile)) {
+    const answerFile = (0, import_path8.join)(cwd, ".stackwright", "answers", `${phase}.json`);
+    if (!(0, import_fs8.existsSync)(answerFile)) {
       return {
         text: JSON.stringify({ ready: false, phase, reason: "Answer file not found" }),
         isError: false
@@ -3416,12 +3648,12 @@ function handleCheckExecutionReady(_cwd, phase) {
     }
   }
   try {
-    const answersDir = (0, import_path7.join)(cwd, ".stackwright", "answers");
+    const answersDir = (0, import_path8.join)(cwd, ".stackwright", "answers");
     const answeredPhases = [];
     const missingPhases = [];
     for (const phase2 of PHASE_ORDER) {
-      const answerFile = (0, import_path7.join)(answersDir, `${phase2}.json`);
-      if ((0, import_fs7.existsSync)(answerFile)) {
+      const answerFile = (0, import_path8.join)(answersDir, `${phase2}.json`);
+      if ((0, import_fs8.existsSync)(answerFile)) {
         try {
           const raw = safeReadSync(answerFile);
           const parsed = JSON.parse(raw);
@@ -3490,7 +3722,7 @@ function handleGetReadyPhases(_cwd) {
 function handleListArtifacts(_cwd) {
   const cwd = _cwd ?? process.cwd();
   try {
-    const artifactsDir = (0, import_path7.join)(cwd, ".stackwright", "artifacts");
+    const artifactsDir = (0, import_path8.join)(cwd, ".stackwright", "artifacts");
     let manifest = null;
     try {
       manifest = loadSignatureManifest(cwd);
@@ -3500,8 +3732,8 @@ function handleListArtifacts(_cwd) {
     let completedCount = 0;
     for (const phase of PHASE_ORDER) {
       const expectedFile = PHASE_ARTIFACT[phase];
-      const fullPath = (0, import_path7.join)(artifactsDir, expectedFile);
-      const exists = (0, import_fs7.existsSync)(fullPath);
+      const fullPath = (0, import_path8.join)(artifactsDir, expectedFile);
+      const exists = (0, import_fs8.existsSync)(fullPath);
       if (exists) completedCount++;
       let signed = false;
       let signatureValid = null;
@@ -3554,9 +3786,9 @@ function handleWritePhaseQuestions(input) {
       }
     } catch {
     }
-    const questionsDir = (0, import_path7.join)(cwd, ".stackwright", "questions");
-    (0, import_fs7.mkdirSync)(questionsDir, { recursive: true });
-    const filePath = (0, import_path7.join)(questionsDir, `${phase}.json`);
+    const questionsDir = (0, import_path8.join)(cwd, ".stackwright", "questions");
+    (0, import_fs8.mkdirSync)(questionsDir, { recursive: true });
+    const filePath = (0, import_path8.join)(questionsDir, `${phase}.json`);
     const payload = {
       version: "1.0",
       phase,
@@ -3596,14 +3828,14 @@ function handleBuildSpecialistPrompt(input) {
     };
   }
   try {
-    const answersPath = (0, import_path7.join)(cwd, ".stackwright", "answers", `${phase}.json`);
+    const answersPath = (0, import_path8.join)(cwd, ".stackwright", "answers", `${phase}.json`);
     let answers = {};
-    if ((0, import_fs7.existsSync)(answersPath)) {
+    if ((0, import_fs8.existsSync)(answersPath)) {
       answers = JSON.parse(safeReadSync(answersPath));
     }
     let buildContextText = "";
-    const buildContextPath = (0, import_path7.join)(cwd, ".stackwright", "build-context.json");
-    if ((0, import_fs7.existsSync)(buildContextPath)) {
+    const buildContextPath = (0, import_path8.join)(cwd, ".stackwright", "build-context.json");
+    if ((0, import_fs8.existsSync)(buildContextPath)) {
       try {
         const bcRaw = JSON.parse(safeReadSync(buildContextPath));
         if (typeof bcRaw.buildContext === "string" && bcRaw.buildContext.trim().length > 0) {
@@ -3618,8 +3850,8 @@ function handleBuildSpecialistPrompt(input) {
     const missingDependencies = [];
     for (const dep of deps) {
       const artifactFile = PHASE_ARTIFACT[dep];
-      const artifactPath = (0, import_path7.join)(cwd, ".stackwright", "artifacts", artifactFile);
-      if ((0, import_fs7.existsSync)(artifactPath)) {
+      const artifactPath = (0, import_path8.join)(cwd, ".stackwright", "artifacts", artifactFile);
+      if ((0, import_fs8.existsSync)(artifactPath)) {
         const rawContent = safeReadSync(artifactPath);
         const rawBytes = Buffer.from(rawContent, "utf-8");
         const content = JSON.parse(rawContent);
@@ -3684,8 +3916,8 @@ ${JSON.stringify(content, null, 2)}`
       parts.push("BUILD_CONTEXT:", buildContextText, "");
     }
     if (phase === "auth") {
-      const initContextPath = (0, import_path7.join)(cwd, ".stackwright", "init-context.json");
-      if ((0, import_fs7.existsSync)(initContextPath)) {
+      const initContextPath = (0, import_path8.join)(cwd, ".stackwright", "init-context.json");
+      if ((0, import_fs8.existsSync)(initContextPath)) {
         try {
           const initContext = JSON.parse(safeReadSync(initContextPath));
           if (initContext.devOnly === true || initContext.nonInteractive === true) {
@@ -4136,7 +4368,87 @@ function _validateArtifactInner(input) {
     };
     return { text: JSON.stringify(result), isError: false };
   }
+  if (phase === "auth") {
+    const authArtifactPath = `.stackwright/artifacts/${PHASE_ARTIFACT["auth"]}`;
+    const authShapeResult = validateAuthConfig(artifact, authArtifactPath);
+    if (!authShapeResult.valid) {
+      const result = {
+        valid: false,
+        phase,
+        violation: "schema-mismatch",
+        retryPrompt: authShapeResult.retryPrompt
+      };
+      return { text: JSON.stringify(result), isError: false };
+    }
+  }
+  if (phase === "auth") {
+    const rawUncovered = artifact["uncoveredSlugs"];
+    if (Array.isArray(rawUncovered) && rawUncovered.length > 0) {
+      const otterFromSource = (source) => {
+        if (source === "geo-manifest.json") return "geo-otter";
+        if (source === "dashboard-manifest.json") return "dashboard-otter";
+        if (source === "pages-manifest.json") return "page-otter";
+        return source || "(unknown)";
+      };
+      const slugLines = rawUncovered.map((entry) => {
+        const e = entry ?? {};
+        const source = typeof e["source"] === "string" ? e["source"] : "(unknown)";
+        const slug = typeof e["slug"] === "string" ? e["slug"] : "(unknown)";
+        return `  ${source}  \u2192  ${slug}  (emitted by ${otterFromSource(source)})`;
+      });
+      const retryPrompt = [
+        "Auth-config cannot be finalized: the following page slugs have no auth declaration in their emitting otter's manifest:",
+        "",
+        ...slugLines,
+        "",
+        "This is a HARD build-gate failure \u2014 auth-otter cannot self-correct because the root cause is upstream.",
+        "",
+        "Fix: update the offending emitter otter to declare `authRequired: true` + `requiredRoles: [...]`",
+        "(and optionally `tier`, `authRationale`) in the manifest entry for each listed slug.",
+        "",
+        "For map pages: geo-otter (see swp-1114).",
+        "For dashboard pages: dashboard-otter (see swp-52lk).",
+        "For page pages: page-otter (already does this \u2014 check for regressions).",
+        "For workflow pages: form-wizard-otter emits routes but auth is derived from the pages-manifest",
+        "workflow-wrapper entry \u2014 check page-otter didn't skip a workflow-wrapper.",
+        "",
+        "After updating the offending manifest, re-run the pipeline from the affected phase."
+      ].join("\n");
+      const result = {
+        valid: false,
+        phase,
+        violation: "uncovered-slugs",
+        retryPrompt
+      };
+      return { text: JSON.stringify(result), isError: false };
+    }
+  }
   const PHASE_ZOD_VALIDATORS = {
+    // 5.0 Theme defaultColorMode hygiene (swp-0ryn / swp-mw97)
+    //
+    // DHL raft runs produced `defaultColorMode: "auto"` (not a valid value) and
+    // `defaultColorMode: "dark"` when the designer said "respect OS preference".
+    // This validator catches the `auto` literal at write-time so the otter
+    // self-corrects before the artifact lands on disk.
+    //
+    // Valid values: 'light' | 'dark' | 'system'
+    // Omitting the key entirely is also valid (app shell honors prefers-color-scheme).
+    theme: (artifact2) => {
+      const dcm = artifact2["defaultColorMode"];
+      if (dcm === void 0 || dcm === null) {
+        return { success: true };
+      }
+      const VALID_COLOR_MODES = ["light", "dark", "system"];
+      if (!VALID_COLOR_MODES.includes(dcm)) {
+        return {
+          success: false,
+          error: {
+            message: `theme-tokens.json: \`defaultColorMode: "${String(dcm)}"\` is not a valid value. Valid values are \`light\`, \`dark\`, or \`system\`. Use \`system\` for OS-following behavior (respects \`prefers-color-scheme\`). Alternatively, OMIT the \`defaultColorMode\` key entirely when the designer has specified in design-language.json operationalNotes that OS preference should be respected (trigger phrases: "respect OS preference", "no forced default").`
+          }
+        };
+      }
+      return { success: true };
+    },
     workflow: (artifact2) => {
       const workflowData = artifact2["workflow"];
       if (!workflowData) {
@@ -4186,33 +4498,60 @@ function _validateArtifactInner(input) {
       return { success: true };
     },
     // swp-4071 — opt-in cross-reference validator for the services phase.
-    // If workflow-config exists and declares serviceHooks, every hook ref must resolve
-    // to a flow or state-machine in this services-config artifact.
+    // Collects serviceHooks from ALL workflow-config-*.json artifacts (swp-x8sm fan-out)
+    // plus the legacy single-file workflow-config.json (backward compat).
+    // If any workflow declared serviceHooks, every ref must resolve to a flow or
+    // state-machine in this services-config artifact.
     // Skips gracefully when wizard-otter didn't run (Pro-only install) or declared no hooks.
     services: (artifact2) => {
-      const workflowArtifactPath = (0, import_path7.join)(cwd, ".stackwright", "artifacts", "workflow-config.json");
-      if (!(0, import_fs7.existsSync)(workflowArtifactPath)) {
-        return { success: true };
+      const artifactsDir = (0, import_path8.join)(cwd, ".stackwright", "artifacts");
+      const workflowArtifactFiles = [];
+      if ((0, import_fs8.existsSync)(artifactsDir)) {
+        try {
+          const entries = (0, import_fs8.readdirSync)(artifactsDir);
+          for (const entry of entries) {
+            if (entry.startsWith("workflow-config-") && entry.endsWith(".json")) {
+              workflowArtifactFiles.push((0, import_path8.join)(artifactsDir, entry));
+            }
+          }
+        } catch {
+        }
       }
-      let workflowArtifact;
-      try {
-        workflowArtifact = JSON.parse((0, import_fs7.readFileSync)(workflowArtifactPath, "utf-8"));
-      } catch {
+      const legacyPath = (0, import_path8.join)(artifactsDir, "workflow-config.json");
+      if ((0, import_fs8.existsSync)(legacyPath)) {
+        workflowArtifactFiles.push(legacyPath);
+      }
+      if (workflowArtifactFiles.length === 0) {
         return { success: true };
       }
-      const declaredHooks = workflowArtifact.serviceHooks ?? [];
-      if (declaredHooks.length === 0) {
+      const declaredHooks = [];
+      for (const filePath of workflowArtifactFiles) {
+        try {
+          const parsed = JSON.parse((0, import_fs8.readFileSync)(filePath, "utf-8"));
+          if (Array.isArray(parsed.serviceHooks)) {
+            declaredHooks.push(...parsed.serviceHooks);
+          }
+        } catch {
+        }
+      }
+      const seenRefs = /* @__PURE__ */ new Set();
+      const uniqueHooks = declaredHooks.filter((h) => {
+        if (seenRefs.has(h.ref)) return false;
+        seenRefs.add(h.ref);
+        return true;
+      });
+      if (uniqueHooks.length === 0) {
         return { success: true };
       }
       const flows = artifact2["flows"] ?? [];
       const workflows = artifact2["workflows"] ?? [];
       const flowNames = /* @__PURE__ */ new Set([...flows.map((f) => f.name), ...workflows.map((w) => w.name)]);
-      const unresolved = declaredHooks.filter((h) => !flowNames.has(h.ref));
+      const unresolved = uniqueHooks.filter((h) => !flowNames.has(h.ref));
       if (unresolved.length > 0) {
         return {
           success: false,
           error: {
-            message: `Workflow declared ${declaredHooks.length} service hook(s) but ${unresolved.length} unresolved by services-config: ` + unresolved.map((h) => `${h.ref} (${h.kind ?? "unknown"}: ${h.purpose ?? "no purpose"})`).join("; ") + ". Either add matching flows to services-config OR remove the hooks from the workflow YAML."
+            message: `Workflow(s) declared ${uniqueHooks.length} service hook(s) but ${unresolved.length} unresolved by services-config: ` + unresolved.map((h) => `${h.ref} (${h.kind ?? "unknown"}: ${h.purpose ?? "no purpose"})`).join("; ") + ". Either add matching flows to services-config OR remove the hooks from the workflow YAML."
           }
         };
       }
@@ -4278,11 +4617,55 @@ function _validateArtifactInner(input) {
       return { text: JSON.stringify(result), isError: false };
     }
   }
+  if (phase === "api") {
+    const apiAuthResult = validateApiIntegration(artifact, input.integrationName);
+    if (!apiAuthResult.valid) {
+      const result = {
+        valid: false,
+        phase,
+        violation: "schema-mismatch",
+        retryPrompt: apiAuthResult.retryPrompt
+      };
+      return { text: JSON.stringify(result), isError: false };
+    }
+  }
+  if (phase === "workflow" && input.workflowName !== void 0) {
+    if (!isValidSlug(input.workflowName)) {
+      const result = {
+        valid: false,
+        phase,
+        violation: "schema-mismatch",
+        retryPrompt: `workflowName "${input.workflowName}" is not a valid slug. Use lowercase kebab-case (a-z, 0-9, hyphens only, no spaces or path separators). Example: "patient-evacuation", "ambulance-crew-dispatch".`
+      };
+      return { text: JSON.stringify(result), isError: false };
+    }
+  }
+  let authOrphanWarning;
+  if (phase === "auth") {
+    const authCfg = artifact["authConfig"];
+    const routes = authCfg?.["protectedRoutes"];
+    if (Array.isArray(routes) && routes.length > 0) {
+      const artifactsDir = (0, import_path8.join)(cwd, ".stackwright", "artifacts");
+      const knownSlugs = extractManifestSlugs(artifactsDir);
+      const orphanPatterns = [];
+      for (const route of routes) {
+        const pattern = typeof route === "string" ? route : route.pattern ?? "";
+        if (!pattern) continue;
+        const baseSlug = extractPatternBaseSlug(pattern);
+        if (baseSlug && !knownSlugs.has(baseSlug)) {
+          orphanPatterns.push(pattern);
+        }
+      }
+      if (orphanPatterns.length > 0) {
+        authOrphanWarning = `The following protectedRoute patterns don't match any known page slug: ${orphanPatterns.map((p) => `"${p}"`).join(", ")}. If these are intentional cross-cutting rules (e.g., /admin/:path*, /audit/:path*), keep them; otherwise remove.`;
+      }
+    }
+  }
   try {
-    const artifactsDir = (0, import_path7.join)(cwd, ".stackwright", "artifacts");
-    (0, import_fs7.mkdirSync)(artifactsDir, { recursive: true });
-    const artifactFile = phase === "api" && input.integrationName ? `api-config-${input.integrationName}.json` : PHASE_ARTIFACT[phase];
-    const artifactPath = (0, import_path7.join)(artifactsDir, artifactFile);
+    const artifactsDir = (0, import_path8.join)(cwd, ".stackwright", "artifacts");
+    (0, import_fs8.mkdirSync)(artifactsDir, { recursive: true });
+    const artifactFile = phase === "api" && input.integrationName ? `api-config-${input.integrationName}.json` : phase === "workflow" && input.workflowName ? `workflow-config-${input.workflowName}.json` : PHASE_ARTIFACT[phase];
+    const artifactPath = (0, import_path8.join)(artifactsDir, artifactFile);
     const serialized = JSON.stringify(artifact, null, 2) + "\n";
     const artifactBytes = Buffer.from(serialized, "utf-8");
     safeWriteSync(artifactPath, serialized);
@@ -4305,7 +4688,8 @@ function _validateArtifactInner(input) {
       valid: true,
       phase,
       artifactPath,
-      summary: `Wrote ${artifactFile} (keys: ${topKeys}${Object.keys(artifact).length > 5 ? ", ..." : ""})${signed ? " [signed]" : ""}`
+      summary: `Wrote ${artifactFile} (keys: ${topKeys}${Object.keys(artifact).length > 5 ? ", ..." : ""})${signed ? " [signed]" : ""}`,
+      ...authOrphanWarning ? { retryPrompt: authOrphanWarning } : {}
     };
     return { text: JSON.stringify(result), isError: false };
   } catch (err) {
@@ -4501,10 +4885,10 @@ function registerPipelineTools(server2) {
             isError: true
           };
         }
-        const questionsDir = (0, import_path7.join)(process.cwd(), ".stackwright", "questions");
-        (0, import_fs7.mkdirSync)(questionsDir, { recursive: true });
-        const outPath = (0, import_path7.join)(questionsDir, `${phase}.json`);
-        (0, import_fs7.writeFileSync)(
+        const questionsDir = (0, import_path8.join)(process.cwd(), ".stackwright", "questions");
+        (0, import_fs8.mkdirSync)(questionsDir, { recursive: true });
+        const outPath = (0, import_path8.join)(questionsDir, `${phase}.json`);
+        (0, import_fs8.writeFileSync)(
           outPath,
           JSON.stringify({ phase, questions, writtenAt: (/* @__PURE__ */ new Date()).toISOString() }, null, 2)
         );
@@ -4543,15 +4927,19 @@ function registerPipelineTools(server2) {
       ),
       integrationName: import_zod13.z.string().optional().describe(
         'When phase="api": write to api-config-<integrationName>.json instead of api-config.json. Enables concurrent per-spec fan-out without collision (swp-530y).'
+      ),
+      workflowName: import_zod13.z.string().optional().describe(
+        `When phase="workflow": write to workflow-config-<workflowName>.json instead of workflow-config.json. Enables concurrent per-workflow fan-out without collision (swp-x8sm). Must be a kebab-case slug matching the workflow's id field.`
       )
     },
-    async ({ phase, responseText, artifact, integrationName }) => {
+    async ({ phase, responseText, artifact, integrationName, workflowName }) => {
       if (artifact) {
         return res(
           handleValidateArtifact({
             phase,
             artifact,
-            ...integrationName ? { integrationName } : {}
+            ...integrationName ? { integrationName } : {},
+            ...workflowName ? { workflowName } : {}
           })
         );
       }
@@ -4559,7 +4947,8 @@ function registerPipelineTools(server2) {
         handleValidateArtifact({
           phase,
           responseText: responseText ?? "",
-          ...integrationName ? { integrationName } : {}
+          ...integrationName ? { integrationName } : {},
+          ...workflowName ? { workflowName } : {}
         })
       );
     }
@@ -4591,8 +4980,8 @@ function registerPipelineTools(server2) {
 
 // src/tools/safe-write.ts
 var import_zod14 = require("zod");
-var import_fs8 = require("fs");
-var import_path8 = require("path");
+var import_fs9 = require("fs");
+var import_path9 = require("path");
 var import_telemetry2 = require("@stackwright-pro/telemetry");
 var OTTER_WRITE_ALLOWLISTS = {
   "stackwright-pro-designer-otter": [
@@ -4604,6 +4993,11 @@ var OTTER_WRITE_ALLOWLISTS = {
       prefix: "stackwright.theme.",
       suffix: ".yml",
       description: "Theme config YAML (merged at build time)"
+    },
+    {
+      prefix: "stackwright.yml",
+      suffix: "",
+      description: "Stackwright config (themeName + customTheme writeback)"
     }
   ],
   "stackwright-pro-auth-otter": [
@@ -4658,6 +5052,17 @@ var OTTER_WRITE_ALLOWLISTS = {
       prefix: ".stackwright/artifacts/",
       suffix: ".json",
       description: "Scaffold manifest artifact"
+    },
+    // swp-89w5: scaffold-otter initialises mock backend wiring via stackwright_pro_emit_env_local
+    {
+      prefix: ".env.local",
+      suffix: "",
+      description: "Dotenv runtime config (mock backend wiring: NEXT_PUBLIC_MOCK_BACKEND + per-integration mock keys)"
+    },
+    {
+      prefix: ".env.local.example",
+      suffix: "",
+      description: "Dotenv template (schema for real production values)"
     }
   ],
   "stackwright-pro-api-otter": [
@@ -4758,7 +5163,7 @@ function getMaxBytesForPath(filePath) {
 }
 var PAGE_REGISTRY_FILE = ".stackwright/page-registry.json";
 function extractPageSlug(filePath) {
-  const match = (0, import_path8.normalize)(filePath).match(/^pages\/(.+?)\/content\.ya?ml$/);
+  const match = (0, import_path9.normalize)(filePath).match(/^pages\/(.+?)\/content\.ya?ml$/);
   return match?.[1] ?? null;
 }
 function extractContentTypes(yamlContent) {
@@ -4774,27 +5179,27 @@ function extractContentTypes(yamlContent) {
   return types.length > 0 ? types : ["unknown"];
 }
 function readPageRegistry(cwd) {
-  const regPath = (0, import_path8.join)(cwd, PAGE_REGISTRY_FILE);
-  if (!(0, import_fs8.existsSync)(regPath)) return {};
+  const regPath = (0, import_path9.join)(cwd, PAGE_REGISTRY_FILE);
+  if (!(0, import_fs9.existsSync)(regPath)) return {};
   try {
-    const stat = (0, import_fs8.lstatSync)(regPath);
+    const stat = (0, import_fs9.lstatSync)(regPath);
     if (stat.isSymbolicLink()) return {};
-    return JSON.parse((0, import_fs8.readFileSync)(regPath, "utf-8"));
+    return JSON.parse((0, import_fs9.readFileSync)(regPath, "utf-8"));
   } catch {
     return {};
   }
 }
 function writePageRegistry(cwd, registry) {
-  const dir = (0, import_path8.join)(cwd, ".stackwright");
-  (0, import_fs8.mkdirSync)(dir, { recursive: true });
-  const regPath = (0, import_path8.join)(cwd, PAGE_REGISTRY_FILE);
-  if ((0, import_fs8.existsSync)(regPath)) {
-    const stat = (0, import_fs8.lstatSync)(regPath);
+  const dir = (0, import_path9.join)(cwd, ".stackwright");
+  (0, import_fs9.mkdirSync)(dir, { recursive: true });
+  const regPath = (0, import_path9.join)(cwd, PAGE_REGISTRY_FILE);
+  if ((0, import_fs9.existsSync)(regPath)) {
+    const stat = (0, import_fs9.lstatSync)(regPath);
     if (stat.isSymbolicLink()) {
       throw new Error("Refusing to write page registry through symlink");
     }
   }
-  (0, import_fs8.writeFileSync)(regPath, JSON.stringify(registry, null, 2) + "\n", { encoding: "utf-8" });
+  (0, import_fs9.writeFileSync)(regPath, JSON.stringify(registry, null, 2) + "\n", { encoding: "utf-8" });
 }
 function checkPageOwnership(cwd, slug, callerOtter) {
   const registry = readPageRegistry(cwd);
@@ -4813,11 +5218,11 @@ function stripNextjsBracketSegments(path5) {
   return path5.replace(NEXTJS_BRACKET_SEGMENT_RE, "");
 }
 function checkPathAllowed(callerOtter, filePath) {
-  const normalized = (0, import_path8.normalize)(filePath);
+  const normalized = (0, import_path9.normalize)(filePath);
   if (stripNextjsBracketSegments(normalized).includes("..")) {
     return { allowed: false, error: 'Path traversal detected: ".." segments are not allowed' };
   }
-  if ((0, import_path8.isAbsolute)(normalized)) {
+  if ((0, import_path9.isAbsolute)(normalized)) {
     return {
       allowed: false,
       error: "Absolute paths are not allowed \u2014 use paths relative to project root"
@@ -4959,11 +5364,11 @@ function _safeWriteInner(input) {
     };
     return { text: JSON.stringify(result), isError: true };
   }
-  const normalized = (0, import_path8.normalize)(filePath);
-  const fullPath = (0, import_path8.join)(cwd, normalized);
-  if ((0, import_fs8.existsSync)(fullPath)) {
+  const normalized = (0, import_path9.normalize)(filePath);
+  const fullPath = (0, import_path9.join)(cwd, normalized);
+  if ((0, import_fs9.existsSync)(fullPath)) {
     try {
-      const stat = (0, import_fs8.lstatSync)(fullPath);
+      const stat = (0, import_fs9.lstatSync)(fullPath);
       if (stat.isSymbolicLink()) {
         const result = {
           success: false,
@@ -5004,9 +5409,9 @@ function _safeWriteInner(input) {
   }
   try {
     if (createDirectories) {
-      (0, import_fs8.mkdirSync)((0, import_path8.dirname)(fullPath), { recursive: true });
+      (0, import_fs9.mkdirSync)((0, import_path9.dirname)(fullPath), { recursive: true });
     }
-    (0, import_fs8.writeFileSync)(fullPath, content, { encoding: "utf-8" });
+    (0, import_fs9.writeFileSync)(fullPath, content, { encoding: "utf-8" });
     if (pageSlug) {
       try {
         const registry = readPageRegistry(cwd);
@@ -5091,8 +5496,8 @@ function registerSafeWriteTools(server2) {
 
 // src/tools/auth.ts
 var import_zod15 = require("zod");
-var import_fs9 = require("fs");
-var import_path9 = require("path");
+var import_fs10 = require("fs");
+var import_path10 = require("path");
 function buildHierarchy(roles) {
   const h = {};
   for (let i = 0; i < roles.length - 1; i++) {
@@ -5119,9 +5524,9 @@ ${indent}  requiredRole: ${r.requiredRole}`).join("\n");
 }
 function detectNextMajorVersion(cwd) {
   try {
-    const pkgPath = (0, import_path9.join)(cwd, "package.json");
-    if (!(0, import_fs9.existsSync)(pkgPath)) return null;
-    const pkg = JSON.parse((0, import_fs9.readFileSync)(pkgPath, "utf8"));
+    const pkgPath = (0, import_path10.join)(cwd, "package.json");
+    if (!(0, import_fs10.existsSync)(pkgPath)) return null;
+    const pkg = JSON.parse((0, import_fs10.readFileSync)(pkgPath, "utf8"));
     const nextVersion = pkg.dependencies?.next ?? pkg.devDependencies?.next;
     if (!nextVersion) return null;
     const match = nextVersion.match(/(\d+)/);
@@ -5785,7 +6190,7 @@ async function configureAuthHandler(params, cwd) {
       auditRetentionDays,
       normalizedRoutes
     );
-    (0, import_fs9.writeFileSync)((0, import_path9.join)(cwd, conventionFile), authFileContent, "utf8");
+    (0, import_fs10.writeFileSync)((0, import_path10.join)(cwd, conventionFile), authFileContent, "utf8");
     filesWritten.push(conventionFile);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -5805,12 +6210,12 @@ async function configureAuthHandler(params, cwd) {
   if (!devOnly) {
     try {
       const envBlock = generateEnvBlock(effectiveMethod, params);
-      const envPath = (0, import_path9.join)(cwd, ".env.example");
-      if ((0, import_fs9.existsSync)(envPath)) {
-        const existing = (0, import_fs9.readFileSync)(envPath, "utf8");
-        (0, import_fs9.writeFileSync)(envPath, existing.trimEnd() + "\n\n" + envBlock, "utf8");
+      const envPath = (0, import_path10.join)(cwd, ".env.example");
+      if ((0, import_fs10.existsSync)(envPath)) {
+        const existing = (0, import_fs10.readFileSync)(envPath, "utf8");
+        (0, import_fs10.writeFileSync)(envPath, existing.trimEnd() + "\n\n" + envBlock, "utf8");
       } else {
-        (0, import_fs9.writeFileSync)(envPath, envBlock, "utf8");
+        (0, import_fs10.writeFileSync)(envPath, envBlock, "utf8");
       }
       filesWritten.push(".env.example");
     } catch (err) {
@@ -5828,10 +6233,10 @@ async function configureAuthHandler(params, cwd) {
   }
   if (devOnly) {
     try {
-      const mockAuthDir = (0, import_path9.join)(cwd, "lib");
-      (0, import_fs9.mkdirSync)(mockAuthDir, { recursive: true });
+      const mockAuthDir = (0, import_path10.join)(cwd, "lib");
+      (0, import_fs10.mkdirSync)(mockAuthDir, { recursive: true });
       const mockAuthContent = generateMockAuthContent(roles, mockUsers);
-      (0, import_fs9.writeFileSync)((0, import_path9.join)(mockAuthDir, "mock-auth.ts"), mockAuthContent, "utf8");
+      (0, import_fs10.writeFileSync)((0, import_path10.join)(mockAuthDir, "mock-auth.ts"), mockAuthContent, "utf8");
       filesWritten.push("lib/mock-auth.ts");
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
@@ -5849,11 +6254,11 @@ async function configureAuthHandler(params, cwd) {
       };
     }
     try {
-      const pkgPath = (0, import_path9.join)(cwd, "package.json");
-      if ((0, import_fs9.existsSync)(pkgPath)) {
-        const existingPkg = (0, import_fs9.readFileSync)(pkgPath, "utf8");
+      const pkgPath = (0, import_path10.join)(cwd, "package.json");
+      if ((0, import_fs10.existsSync)(pkgPath)) {
+        const existingPkg = (0, import_fs10.readFileSync)(pkgPath, "utf8");
         const updatedPkg = updatePackageJsonScripts(existingPkg, roles, mockUsers);
-        (0, import_fs9.writeFileSync)(pkgPath, updatedPkg, "utf8");
+        (0, import_fs10.writeFileSync)(pkgPath, updatedPkg, "utf8");
         filesWritten.push("package.json");
       }
     } catch (err) {
@@ -5894,7 +6299,7 @@ async function configureAuthHandler(params, cwd) {
       normalizedRoutes,
       useProxy
     );
-    (0, import_fs9.writeFileSync)((0, import_path9.join)(cwd, "stackwright.auth.yml"), authYaml, "utf8");
+    (0, import_fs10.writeFileSync)((0, import_path10.join)(cwd, "stackwright.auth.yml"), authYaml, "utf8");
     filesWritten.push("stackwright.auth.yml");
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -6007,8 +6412,8 @@ function registerAuthTools(server2) {
 
 // src/integrity.ts
 var import_crypto4 = require("crypto");
-var import_fs10 = require("fs");
-var import_path10 = require("path");
+var import_fs11 = require("fs");
+var import_path11 = require("path");
 var _checksums = /* @__PURE__ */ new Map([
   [
     "stackwright-pro-api-otter.json",
@@ -6016,11 +6421,11 @@ var _checksums = /* @__PURE__ */ new Map([
   ],
   [
     "stackwright-pro-auth-otter.json",
-    "1a21d9f23e250f23291124307e5a2a32af5a716566319a3290372dae3d02e637"
+    "69fa03c5532ef617c86fe7af41e8174c168d282baf602b1b269a7e933ea86b7c"
   ],
   [
     "stackwright-pro-dashboard-otter.json",
-    "4a9ac39e929866ae3c929aa5bcbba3d9483a1c251c35f26f267f3e7433506f0c"
+    "f55081bf4d6545e5435128919f6f9233956ba37671fc9f85300f240ad2497ab6"
   ],
   [
     "stackwright-pro-data-otter.json",
@@ -6036,19 +6441,19 @@ var _checksums = /* @__PURE__ */ new Map([
   ],
   [
     "stackwright-pro-foreman-otter.json",
-    "9d68b7b20af7a8a1668e2a693b4a2b05cf37acce1e9f6298a0966c97a3417e9f"
+    "88c4101154d44a7c5470ded13562402a39323ee570ed3a90a73b8d85d7fd2817"
   ],
   [
     "stackwright-pro-form-wizard-otter.json",
-    "7f6f94192f26face57dc8b2e22e0a49d23ceeeb356ca4ebde05492f1b25e3c47"
+    "cb350297a0068ead2424e703e8c775d91c0b87249ea6904f43b903baf8a84b79"
   ],
   [
     "stackwright-pro-geo-otter.json",
-    "fc3d18e02a6147d95d3dd9093ce74c0e8fffaecc2f9ecdbd19c163a80129d264"
+    "3032fbd27de36c0cdc0e19e46a32d771208d8e86714482f5a368d46342c8317a"
   ],
   [
     "stackwright-pro-page-otter.json",
-    "879e8ff4aa645bac2c63dc962cad1a549876983c257aec756e95293c3b22ce7e"
+    "cc0db24b00f0130f8b4ec8d385c73ea1bcf5d57ba45aca6b986bcbd5da328930"
   ],
   [
     "stackwright-pro-polish-otter.json",
@@ -6060,15 +6465,15 @@ var _checksums = /* @__PURE__ */ new Map([
   ],
   [
     "stackwright-pro-scaffold-otter.json",
-    "92930c732547c90a19e89ee0e25b5f037b7366f770941f0a01e148ff240a1b6d"
+    "90272bab51bd8ed9e25c0fb6481cdd4252386850f64192edfe1e2eff44166e2d"
   ],
   [
     "stackwright-pro-theme-otter.json",
-    "01d16d0597d475db60362e3b8020035e140817d197c36f4307a48b95f4b28b60"
+    "afb47f8381907145c0e098bdcaae4dd9f5c4ff825a8e88d00a218d2f6858820b"
   ],
   [
     "stackwright-services-otter.json",
-    "2a50ceb3fad166251d0ad8709a34a32118645713e0e34628165d16dced1d5c93"
+    "4351348806aeb98404a2bacb044209ca411be5e35e2f2c3d03eb4d28a07fde78"
   ]
 ]);
 Object.freeze(_checksums);
@@ -6091,14 +6496,14 @@ function safeEqual(a, b) {
   return (0, import_crypto4.timingSafeEqual)(Buffer.from(a, "utf8"), Buffer.from(b, "utf8"));
 }
 function verifyOtterFile(filePath) {
-  const filename = (0, import_path10.basename)(filePath);
+  const filename = (0, import_path11.basename)(filePath);
   const expected = CANONICAL_CHECKSUMS.get(filename);
   if (expected === void 0) {
     return { verified: false, filename, error: `Unknown otter file: not in canonical set` };
   }
   let stat;
   try {
-    stat = (0, import_fs10.lstatSync)(filePath);
+    stat = (0, import_fs11.lstatSync)(filePath);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     return { verified: false, filename, error: `Cannot stat file: ${msg}` };
@@ -6116,7 +6521,7 @@ function verifyOtterFile(filePath) {
   }
   let raw;
   try {
-    raw = (0, import_fs10.readFileSync)(filePath);
+    raw = (0, import_fs11.readFileSync)(filePath);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     return { verified: false, filename, error: `Cannot read file: ${msg}` };
@@ -6166,7 +6571,7 @@ function verifyAllOtters(otterDir) {
   const unknown = [];
   let entries;
   try {
-    entries = (0, import_fs10.readdirSync)(otterDir);
+    entries = (0, import_fs11.readdirSync)(otterDir);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     return {
@@ -6177,9 +6582,9 @@ function verifyAllOtters(otterDir) {
   }
   const otterFiles = entries.filter((f) => f.endsWith("-otter.json"));
   for (const filename of otterFiles) {
-    const filePath = (0, import_path10.join)(otterDir, filename);
+    const filePath = (0, import_path11.join)(otterDir, filename);
     try {
-      if ((0, import_fs10.lstatSync)(filePath).isSymbolicLink()) {
+      if ((0, import_fs11.lstatSync)(filePath).isSymbolicLink()) {
         failed.push({ filename, error: "Skipped: symlink" });
         continue;
       }
@@ -6205,9 +6610,9 @@ var DEFAULT_SEARCH_PATHS = ["node_modules/@stackwright-pro/otters/src/", "packag
 function resolveOtterDir() {
   const cwd = process.cwd();
   for (const relative2 of DEFAULT_SEARCH_PATHS) {
-    const candidate = (0, import_path10.join)(cwd, relative2);
+    const candidate = (0, import_path11.join)(cwd, relative2);
     try {
-      (0, import_fs10.lstatSync)(candidate);
+      (0, import_fs11.lstatSync)(candidate);
       return candidate;
     } catch {
     }
@@ -6286,13 +6691,13 @@ function registerIntegrityTools(server2) {
 
 // src/tools/domain.ts
 var import_zod16 = require("zod");
-var import_fs11 = require("fs");
-var import_path11 = require("path");
+var import_fs12 = require("fs");
+var import_path12 = require("path");
 function handleListCollections(input) {
   const cwd = input._cwd ?? process.cwd();
   const sources = [
     {
-      path: (0, import_path11.join)(cwd, ".stackwright", "artifacts", "data-config.json"),
+      path: (0, import_path12.join)(cwd, ".stackwright", "artifacts", "data-config.json"),
       source: "data-config.json",
       parse: (raw) => {
         const parsed = JSON.parse(raw);
@@ -6303,15 +6708,15 @@ function handleListCollections(input) {
       }
     },
     {
-      path: (0, import_path11.join)(cwd, "stackwright.yml"),
+      path: (0, import_path12.join)(cwd, "stackwright.yml"),
       source: "stackwright.yml",
       parse: extractCollectionsFromYaml
     }
   ];
   for (const { path: path5, source, parse } of sources) {
-    if (!(0, import_fs11.existsSync)(path5)) continue;
+    if (!(0, import_fs12.existsSync)(path5)) continue;
     try {
-      const collections = parse((0, import_fs11.readFileSync)(path5, "utf8"));
+      const collections = parse((0, import_fs12.readFileSync)(path5, "utf8"));
       return {
         text: JSON.stringify({ collections, source, collectionCount: collections.length }),
         isError: false
@@ -6462,8 +6867,8 @@ function handleValidateWorkflow(input) {
   if (input.workflow && Object.keys(input.workflow).length > 0) {
     raw = input.workflow;
   } else {
-    const artifactPath = (0, import_path11.join)(cwd, ".stackwright", "artifacts", "workflow-config.json");
-    if (!(0, import_fs11.existsSync)(artifactPath)) {
+    const artifactPath = (0, import_path12.join)(cwd, ".stackwright", "artifacts", "workflow-config.json");
+    if (!(0, import_fs12.existsSync)(artifactPath)) {
       return fail([
         {
           code: "NO_WORKFLOW",
@@ -6472,7 +6877,7 @@ function handleValidateWorkflow(input) {
       ]);
     }
     try {
-      raw = JSON.parse((0, import_fs11.readFileSync)(artifactPath, "utf8"));
+      raw = JSON.parse((0, import_fs12.readFileSync)(artifactPath, "utf8"));
     } catch (err) {
       return fail([{ code: "INVALID_JSON", message: `Failed to parse workflow artifact: ${err}` }]);
     }
@@ -6909,8 +7314,8 @@ function registerProPageTools(server2) {
 }
 
 // src/tools/scaffold-cleanup.ts
-var import_fs12 = require("fs");
-var import_path12 = require("path");
+var import_fs13 = require("fs");
+var import_path13 = require("path");
 var SCAFFOLD_FILES_TO_DELETE = [
   "content/posts/getting-started.yaml",
   "content/posts/hello-world.yaml"
@@ -6935,12 +7340,12 @@ var FALLBACK_COLORS = {
   mutedForeground: "#737373"
 };
 function readThemeColors(cwd) {
-  const tokenPath = (0, import_path12.join)(cwd, ".stackwright", "artifacts", "theme-tokens.json");
-  if (!(0, import_fs12.existsSync)(tokenPath)) return { ...FALLBACK_COLORS };
-  const stat = (0, import_fs12.lstatSync)(tokenPath);
+  const tokenPath = (0, import_path13.join)(cwd, ".stackwright", "artifacts", "theme-tokens.json");
+  if (!(0, import_fs13.existsSync)(tokenPath)) return { ...FALLBACK_COLORS };
+  const stat = (0, import_fs13.lstatSync)(tokenPath);
   if (stat.isSymbolicLink()) return { ...FALLBACK_COLORS };
   try {
-    const raw = JSON.parse((0, import_fs12.readFileSync)(tokenPath, "utf-8"));
+    const raw = JSON.parse((0, import_fs13.readFileSync)(tokenPath, "utf-8"));
     const css = raw?.cssVariables ?? {};
     const toHsl = (hslValue) => {
       if (!hslValue || typeof hslValue !== "string") return null;
@@ -7000,15 +7405,15 @@ function generateNotFoundPage(colors) {
 `;
 }
 function isSafePath(fullPath) {
-  if (!(0, import_fs12.existsSync)(fullPath)) return true;
-  const stat = (0, import_fs12.lstatSync)(fullPath);
+  if (!(0, import_fs13.existsSync)(fullPath)) return true;
+  const stat = (0, import_fs13.lstatSync)(fullPath);
   return !stat.isSymbolicLink();
 }
 function isDirEmpty(dirPath) {
-  if (!(0, import_fs12.existsSync)(dirPath)) return false;
-  const stat = (0, import_fs12.lstatSync)(dirPath);
+  if (!(0, import_fs13.existsSync)(dirPath)) return false;
+  const stat = (0, import_fs13.lstatSync)(dirPath);
   if (!stat.isDirectory()) return false;
-  return (0, import_fs12.readdirSync)(dirPath).length === 0;
+  return (0, import_fs13.readdirSync)(dirPath).length === 0;
 }
 function handleCleanupScaffold(_cwd) {
   const cwd = _cwd ?? process.cwd();
@@ -7021,8 +7426,8 @@ function handleCleanupScaffold(_cwd) {
     cleanupWarnings: []
   };
   for (const relPath of SCAFFOLD_FILES_TO_DELETE) {
-    const fullPath = (0, import_path12.join)(cwd, relPath);
-    if (!(0, import_fs12.existsSync)(fullPath)) {
+    const fullPath = (0, import_path13.join)(cwd, relPath);
+    if (!(0, import_fs13.existsSync)(fullPath)) {
       result.skipped.push(relPath);
       continue;
     }
@@ -7031,7 +7436,7 @@ function handleCleanupScaffold(_cwd) {
       continue;
     }
     try {
-      (0, import_fs12.unlinkSync)(fullPath);
+      (0, import_fs13.unlinkSync)(fullPath);
       result.deleted.push(relPath);
     } catch (err) {
       result.errors.push(`Failed to delete ${relPath}: ${String(err)}`);
@@ -7039,19 +7444,19 @@ function handleCleanupScaffold(_cwd) {
   }
   {
     const relPath = "pages/getting-started/content.yml";
-    const fullPath = (0, import_path12.join)(cwd, relPath);
-    if (!(0, import_fs12.existsSync)(fullPath)) {
+    const fullPath = (0, import_path13.join)(cwd, relPath);
+    if (!(0, import_fs13.existsSync)(fullPath)) {
       result.skipped.push(relPath);
     } else if (!isSafePath(fullPath)) {
       result.errors.push(`Refusing to delete symlink: ${relPath}`);
     } else {
-      const content = (0, import_fs12.readFileSync)(fullPath, "utf-8");
+      const content = (0, import_fs13.readFileSync)(fullPath, "utf-8");
       const isScaffoldDefault = GETTING_STARTED_SCAFFOLD_FINGERPRINTS.some(
         (marker) => content.includes(marker)
       );
       if (isScaffoldDefault) {
         try {
-          (0, import_fs12.unlinkSync)(fullPath);
+          (0, import_fs13.unlinkSync)(fullPath);
           result.deleted.push(relPath);
         } catch (err) {
           result.errors.push(`Failed to delete ${relPath}: ${String(err)}`);
@@ -7065,21 +7470,21 @@ function handleCleanupScaffold(_cwd) {
   }
   {
     const relPath = `content/posts/${POSTS_COLLECTION_FILE}`;
-    const fullPath = (0, import_path12.join)(cwd, relPath);
-    const postsDir = (0, import_path12.join)(cwd, "content/posts");
-    if (!(0, import_fs12.existsSync)(fullPath)) {
+    const fullPath = (0, import_path13.join)(cwd, relPath);
+    const postsDir = (0, import_path13.join)(cwd, "content/posts");
+    if (!(0, import_fs13.existsSync)(fullPath)) {
       result.skipped.push(relPath);
     } else if (!isSafePath(fullPath)) {
       result.errors.push(`Refusing to delete symlink: ${relPath}`);
-    } else if (!(0, import_fs12.existsSync)(postsDir)) {
+    } else if (!(0, import_fs13.existsSync)(postsDir)) {
       result.skipped.push(relPath);
     } else {
-      const userPostFiles = (0, import_fs12.readdirSync)(postsDir).filter(
+      const userPostFiles = (0, import_fs13.readdirSync)(postsDir).filter(
         (f) => f !== POSTS_COLLECTION_FILE && POST_FILE_EXTENSIONS.some((ext) => f.endsWith(ext))
       );
       if (userPostFiles.length === 0) {
         try {
-          (0, import_fs12.unlinkSync)(fullPath);
+          (0, import_fs13.unlinkSync)(fullPath);
           result.deleted.push(relPath);
         } catch (err) {
           result.errors.push(`Failed to delete ${relPath}: ${String(err)}`);
@@ -7092,15 +7497,15 @@ function handleCleanupScaffold(_cwd) {
     }
   }
   for (const relDir of SCAFFOLD_DIRS_TO_PRUNE) {
-    const fullDir = (0, import_path12.join)(cwd, relDir);
-    if (!(0, import_fs12.existsSync)(fullDir)) continue;
+    const fullDir = (0, import_path13.join)(cwd, relDir);
+    if (!(0, import_fs13.existsSync)(fullDir)) continue;
     if (!isSafePath(fullDir)) {
       result.errors.push(`Refusing to prune symlink directory: ${relDir}`);
       continue;
     }
     if (isDirEmpty(fullDir)) {
       try {
-        (0, import_fs12.rmdirSync)(fullDir);
+        (0, import_fs13.rmdirSync)(fullDir);
         result.prunedDirs.push(relDir);
       } catch (err) {
         result.errors.push(`Failed to prune directory ${relDir}: ${String(err)}`);
@@ -7108,8 +7513,8 @@ function handleCleanupScaffold(_cwd) {
     }
   }
   {
-    const fullPath = (0, import_path12.join)(cwd, NOT_FOUND_PATH);
-    if (!(0, import_fs12.existsSync)(fullPath)) {
+    const fullPath = (0, import_path13.join)(cwd, NOT_FOUND_PATH);
+    if (!(0, import_fs13.existsSync)(fullPath)) {
       result.skipped.push(NOT_FOUND_PATH);
     } else if (!isSafePath(fullPath)) {
       result.errors.push(`Refusing to rewrite symlink: ${NOT_FOUND_PATH}`);
@@ -7117,9 +7522,9 @@ function handleCleanupScaffold(_cwd) {
       try {
         const colors = readThemeColors(cwd);
         const content = generateNotFoundPage(colors);
-        const dir = (0, import_path12.dirname)(fullPath);
-        (0, import_fs12.mkdirSync)(dir, { recursive: true });
-        (0, import_fs12.writeFileSync)(fullPath, content, "utf-8");
+        const dir = (0, import_path13.dirname)(fullPath);
+        (0, import_fs13.mkdirSync)(dir, { recursive: true });
+        (0, import_fs13.writeFileSync)(fullPath, content, "utf-8");
         result.rewritten.push(NOT_FOUND_PATH);
       } catch (err) {
         result.errors.push(`Failed to rewrite ${NOT_FOUND_PATH}: ${String(err)}`);
@@ -7388,23 +7793,23 @@ function registerContrastTools(server2) {
 
 // src/tools/compile.ts
 var import_zod20 = require("zod");
-var import_fs13 = __toESM(require("fs"));
-var import_path13 = __toESM(require("path"));
+var import_fs14 = __toESM(require("fs"));
+var import_path14 = __toESM(require("path"));
 var import_server = require("@stackwright-pro/pulse/server");
 var import_server2 = require("@stackwright-pro/auth-nextjs/server");
 var import_server3 = require("@stackwright-pro/openapi/server");
 function buildContext(projectRoot) {
   return {
     projectRoot,
-    contentOutDir: import_path13.default.join(projectRoot, "public", "stackwright-content"),
-    imagesDir: import_path13.default.join(projectRoot, "public", "images"),
+    contentOutDir: import_path14.default.join(projectRoot, "public", "stackwright-content"),
+    imagesDir: import_path14.default.join(projectRoot, "public", "images"),
     siteConfig: loadSiteConfig(projectRoot)
   };
 }
 function loadSiteConfig(projectRoot) {
   try {
-    const sitePath = import_path13.default.join(projectRoot, "public", "stackwright-content", "_site.json");
-    return JSON.parse(import_fs13.default.readFileSync(sitePath, "utf8"));
+    const sitePath = import_path14.default.join(projectRoot, "public", "stackwright-content", "_site.json");
+    return JSON.parse(import_fs14.default.readFileSync(sitePath, "utf8"));
   } catch {
     return {};
   }
@@ -7415,8 +7820,8 @@ function formatDuration(startMs) {
 }
 async function tryOssCompile(fn, ctx, extra) {
   try {
-    const bsPath = import_path13.default.join(ctx.projectRoot, "node_modules", "@stackwright", "build-scripts");
-    if (!import_fs13.default.existsSync(bsPath)) {
+    const bsPath = import_path14.default.join(ctx.projectRoot, "node_modules", "@stackwright", "build-scripts");
+    if (!import_fs14.default.existsSync(bsPath)) {
       return {
         ok: false,
         error: `@stackwright/build-scripts not found at ${bsPath}. Is it installed in your project?`
@@ -7630,14 +8035,14 @@ ${results.join("\n")}`;
 
 // src/tools/strip-legacy-integrations.ts
 var import_zod21 = require("zod");
-var import_fs14 = require("fs");
-var import_path14 = require("path");
+var import_fs15 = require("fs");
+var import_path15 = require("path");
 function handleStripLegacyIntegrations(input) {
   const { projectRoot } = input;
-  const ymlPath = (0, import_path14.join)(projectRoot, "stackwright.yml");
-  const yamlPath = (0, import_path14.join)(projectRoot, "stackwright.yaml");
-  if (!(0, import_fs14.existsSync)(ymlPath)) {
-    if ((0, import_fs14.existsSync)(yamlPath)) {
+  const ymlPath = (0, import_path15.join)(projectRoot, "stackwright.yml");
+  const yamlPath = (0, import_path15.join)(projectRoot, "stackwright.yaml");
+  if (!(0, import_fs15.existsSync)(ymlPath)) {
+    if ((0, import_fs15.existsSync)(yamlPath)) {
       return {
         changed: false,
         removedEntries: 0,
@@ -7650,7 +8055,7 @@ function handleStripLegacyIntegrations(input) {
       message: "stackwright.yml not found \u2014 no-op."
     };
   }
-  const raw = (0, import_fs14.readFileSync)(ymlPath, "utf-8");
+  const raw = (0, import_fs15.readFileSync)(ymlPath, "utf-8");
   const isCRLF = raw.includes("\r\n");
   const content = isCRLF ? raw.replace(/\r\n/g, "\n") : raw;
   const lines = content.split("\n");
@@ -7680,7 +8085,7 @@ function handleStripLegacyIntegrations(input) {
     outputContent += "\n";
   }
   const outputRaw = isCRLF ? outputContent.replace(/\n/g, "\r\n") : outputContent;
-  (0, import_fs14.writeFileSync)(ymlPath, outputRaw, "utf-8");
+  (0, import_fs15.writeFileSync)(ymlPath, outputRaw, "utf-8");
   return {
     changed: true,
     removedEntries,
@@ -7705,15 +8110,15 @@ function registerStripLegacyIntegrationsTool(server2) {
 
 // src/tools/emitters.ts
 var import_zod22 = require("zod");
-var import_fs15 = require("fs");
-var import_path15 = require("path");
+var import_fs16 = require("fs");
+var import_path16 = require("path");
 var import_js_yaml4 = __toESM(require("js-yaml"));
 var import_emitters = require("@stackwright-pro/emitters");
 function readIntegrations(cwd) {
-  const filePath = (0, import_path15.join)(cwd, "stackwright.integrations.yml");
-  if (!(0, import_fs15.existsSync)(filePath)) return [];
+  const filePath = (0, import_path16.join)(cwd, "stackwright.integrations.yml");
+  if (!(0, import_fs16.existsSync)(filePath)) return [];
   try {
-    const raw = import_js_yaml4.default.load((0, import_fs15.readFileSync)(filePath, "utf-8"));
+    const raw = import_js_yaml4.default.load((0, import_fs16.readFileSync)(filePath, "utf-8"));
     if (!raw?.integrations || !Array.isArray(raw.integrations)) return [];
     return raw.integrations.filter((i) => typeof i.name === "string").map((i) => ({
       name: i.name,
@@ -7724,15 +8129,15 @@ function readIntegrations(cwd) {
   }
 }
 function readServiceTokenRefs(cwd) {
-  const servicesDir = (0, import_path15.join)(cwd, "services");
-  if (!(0, import_fs15.existsSync)(servicesDir)) return [];
+  const servicesDir = (0, import_path16.join)(cwd, "services");
+  if (!(0, import_fs16.existsSync)(servicesDir)) return [];
   try {
-    const files = (0, import_fs15.readdirSync)(servicesDir).filter((f) => f.endsWith(".yml") || f.endsWith(".yaml"));
+    const files = (0, import_fs16.readdirSync)(servicesDir).filter((f) => f.endsWith(".yml") || f.endsWith(".yaml"));
     const refs = [];
     for (const file of files) {
       try {
         const raw = import_js_yaml4.default.load(
-          (0, import_fs15.readFileSync)((0, import_path15.join)(servicesDir, file), "utf-8")
+          (0, import_fs16.readFileSync)((0, import_path16.join)(servicesDir, file), "utf-8")
         );
         if (raw?.tokenEnv && typeof raw.tokenEnv === "string") {
           refs.push({
@@ -7882,12 +8287,12 @@ This is the third concrete instance of the swp-zf9y deterministic emitter patter
 
 // src/tools/list-specs.ts
 var import_zod23 = require("zod");
-var import_fs16 = require("fs");
-var import_path16 = require("path");
+var import_fs17 = require("fs");
+var import_path17 = require("path");
 var STRIP_SUFFIXES = ["-openapi", "-asyncapi", "-api", "-spec"];
 var ALLOWED_EXTS = /* @__PURE__ */ new Set([".yaml", ".yml", ".json"]);
 function deriveIntegrationName(fileName) {
-  let name = (0, import_path16.basename)(fileName, (0, import_path16.extname)(fileName));
+  let name = (0, import_path17.basename)(fileName, (0, import_path17.extname)(fileName));
   for (const suffix of STRIP_SUFFIXES) {
     if (name.endsWith(suffix)) {
       name = name.slice(0, -suffix.length);
@@ -7905,29 +8310,29 @@ function detectFormat(snippet) {
 }
 function handleListSpecs(input) {
   const { projectRoot } = input;
-  const specsDir = (0, import_path16.join)(projectRoot, "specs");
+  const specsDir = (0, import_path17.join)(projectRoot, "specs");
   const empty = { projectRoot, specs: [], totalCount: 0 };
-  if (!(0, import_fs16.existsSync)(specsDir)) return empty;
+  if (!(0, import_fs17.existsSync)(specsDir)) return empty;
   let entries;
   try {
-    entries = (0, import_fs16.readdirSync)(specsDir);
+    entries = (0, import_fs17.readdirSync)(specsDir);
   } catch {
     return empty;
   }
   const specs = [];
   for (const entry of entries) {
-    const fullPath = (0, import_path16.join)(specsDir, entry);
+    const fullPath = (0, import_path17.join)(specsDir, entry);
     let stat;
     try {
-      stat = (0, import_fs16.statSync)(fullPath);
+      stat = (0, import_fs17.statSync)(fullPath);
     } catch {
       continue;
     }
     if (!stat.isFile()) continue;
-    if (!ALLOWED_EXTS.has((0, import_path16.extname)(entry).toLowerCase())) continue;
+    if (!ALLOWED_EXTS.has((0, import_path17.extname)(entry).toLowerCase())) continue;
     let snippet = "";
     try {
-      snippet = (0, import_fs16.readFileSync)(fullPath, "utf-8").slice(0, 2048);
+      snippet = (0, import_fs17.readFileSync)(fullPath, "utf-8").slice(0, 2048);
     } catch {
     }
     specs.push({
@@ -7959,14 +8364,14 @@ function registerListSpecsTool(server2) {
 
 // src/tools/consolidate-integrations.ts
 var import_zod24 = require("zod");
-var import_fs17 = require("fs");
+var import_fs18 = require("fs");
 var import_proper_lockfile2 = require("proper-lockfile");
-var import_path17 = require("path");
+var import_path18 = require("path");
 var import_js_yaml5 = __toESM(require("js-yaml"));
 var BASE_MOCK_PORT = 4011;
 var STRIP_SUFFIXES2 = ["-openapi", "-asyncapi", "-api", "-spec"];
 function deriveNameFromFilename(filename) {
-  const base = (0, import_path17.basename)(filename, ".json").replace(/^api-config-/, "");
+  const base = (0, import_path18.basename)(filename, ".json").replace(/^api-config-/, "");
   for (const suffix of STRIP_SUFFIXES2) {
     if (base.endsWith(suffix)) return base.slice(0, -suffix.length);
   }
@@ -7974,13 +8379,13 @@ function deriveNameFromFilename(filename) {
 }
 function handleConsolidateIntegrations(input) {
   const { projectRoot } = input;
-  const artifactsDir = (0, import_path17.join)(projectRoot, ".stackwright", "artifacts");
-  if (!(0, import_fs17.existsSync)(artifactsDir)) {
+  const artifactsDir = (0, import_path18.join)(projectRoot, ".stackwright", "artifacts");
+  if (!(0, import_fs18.existsSync)(artifactsDir)) {
     return { written: false, integrationCount: 0, reason: "no per-spec artifacts found" };
   }
   let entries;
   try {
-    entries = (0, import_fs17.readdirSync)(artifactsDir).filter(
+    entries = (0, import_fs18.readdirSync)(artifactsDir).filter(
       (f) => f.startsWith("api-config-") && f.endsWith(".json") && f !== "api-config.json"
     );
   } catch {
@@ -7991,14 +8396,22 @@ function handleConsolidateIntegrations(input) {
   }
   entries.sort();
   const integrationsByName = /* @__PURE__ */ new Map();
+  const skippedIntegrationsList = [];
   entries.forEach((filename, index) => {
     let artifact = {};
     try {
-      const raw = (0, import_fs17.readFileSync)((0, import_path17.join)(artifactsDir, filename), "utf-8");
+      const raw = (0, import_fs18.readFileSync)((0, import_path18.join)(artifactsDir, filename), "utf-8");
       artifact = JSON.parse(raw);
     } catch {
     }
     const name = artifact.integrationName ?? deriveNameFromFilename(filename);
+    if (artifact.skipped && artifact.skipped.length > 0) {
+      skippedIntegrationsList.push({
+        name,
+        reason: artifact.skipped[0]?.reason ?? "explicitly skipped by api-otter"
+      });
+      return;
+    }
     const spec = artifact.integrationSpec ?? artifact.specPath ?? `./specs/${name}.yaml`;
     const mockUrl = artifact.mockUrl ?? `http://localhost:${BASE_MOCK_PORT + index}`;
     const baseUrl = artifact.baseUrl ?? "";
@@ -8019,21 +8432,21 @@ function handleConsolidateIntegrations(input) {
     integrationsByName.set(name, entry);
   });
   const integrations = Array.from(integrationsByName.values());
-  const dedupedCount = entries.length - integrations.length;
-  const integrationsYmlPath = (0, import_path17.join)(projectRoot, "stackwright.integrations.yml");
+  const dedupedCount = entries.length - skippedIntegrationsList.length - integrations.length;
+  const integrationsYmlPath = (0, import_path18.join)(projectRoot, "stackwright.integrations.yml");
   let existing = {};
-  if ((0, import_fs17.existsSync)(integrationsYmlPath)) {
+  if ((0, import_fs18.existsSync)(integrationsYmlPath)) {
     try {
-      const raw = (0, import_fs17.readFileSync)(integrationsYmlPath, "utf-8");
+      const raw = (0, import_fs18.readFileSync)(integrationsYmlPath, "utf-8");
       existing = import_js_yaml5.default.load(raw) ?? {};
     } catch {
       existing = {};
     }
   }
   const merged = { ...existing, integrations };
-  (0, import_fs17.mkdirSync)((0, import_path17.join)(projectRoot), { recursive: true });
-  if (!(0, import_fs17.existsSync)(integrationsYmlPath)) {
-    (0, import_fs17.writeFileSync)(integrationsYmlPath, "", "utf-8");
+  (0, import_fs18.mkdirSync)((0, import_path18.join)(projectRoot), { recursive: true });
+  if (!(0, import_fs18.existsSync)(integrationsYmlPath)) {
+    (0, import_fs18.writeFileSync)(integrationsYmlPath, "", "utf-8");
   }
   const release = (0, import_proper_lockfile2.lockSync)(integrationsYmlPath, {
     realpath: false,
@@ -8043,7 +8456,7 @@ function handleConsolidateIntegrations(input) {
     const header = `# stackwright.integrations.yml \u2014 Auto-generated by stackwright_pro_consolidate_integrations
 `;
     const body = import_js_yaml5.default.dump(merged, { lineWidth: 120, noRefs: true });
-    (0, import_fs17.writeFileSync)(integrationsYmlPath, header + body, "utf-8");
+    (0, import_fs18.writeFileSync)(integrationsYmlPath, header + body, "utf-8");
   } finally {
     release();
   }
@@ -8051,7 +8464,11 @@ function handleConsolidateIntegrations(input) {
     written: true,
     integrationCount: integrations.length,
     path: "stackwright.integrations.yml",
-    ...dedupedCount > 0 ? { dedupedCount } : {}
+    ...dedupedCount > 0 ? { dedupedCount } : {},
+    ...skippedIntegrationsList.length > 0 ? {
+      skippedCount: skippedIntegrationsList.length,
+      skippedIntegrations: skippedIntegrationsList
+    } : {}
   };
 }
 function registerConsolidateIntegrationsTool(server2) {
@@ -8125,7 +8542,7 @@ var package_default = {
     "test:coverage": "vitest run --coverage"
   },
   name: "@stackwright-pro/mcp",
-  version: "0.2.0-alpha.107",
+  version: "0.2.0-alpha.109",
   description: "MCP tools for Stackwright Pro - Data Explorer, Security, ISR, and Dashboard generation",
   license: "SEE LICENSE IN LICENSE",
   main: "./dist/server.js",