@stackwright-pro/mcp 0.2.0-alpha.108 → 0.2.0-alpha.111

package/dist/server.mjs

@@ -849,6 +849,9 @@ var BASELINE_DEPS = {
   "@stackwright-pro/openapi": "latest",
   "@stackwright-pro/auth": "latest",
   "@stackwright-pro/auth-nextjs": "latest",
+  // SBOM compliance — every Pro raft is a compliance product (swp-ryqz)
+  "@stackwright-pro/sbom-enterprise": "latest",
+  "@stackwright/sbom-generator": "^0.2.2",
   zod: "^3.23.0"
 };
 var BASELINE_DEV_DEPS = {
@@ -2002,7 +2005,7 @@ function registerOrchestrationTools(server2) {
 }
 
 // src/tools/pipeline.ts
-import { z as z13 } from "zod";
+import { z as z14 } from "zod";
 import { readFileSync as readFileSync7, writeFileSync as writeFileSync4, existsSync as existsSync7, mkdirSync as mkdirSync4, lstatSync as lstatSync6, readdirSync as readdirSync5 } from "fs";
 import { lockSync } from "proper-lockfile";
 import { join as join7 } from "path";
@@ -2742,6 +2745,19 @@ function validateAuthConfig(artifact, artifactPath) {
 // src/tools/auth-manifest-aggregator.ts
 import { existsSync as existsSync6, readFileSync as readFileSync5, readdirSync as readdirSync3 } from "fs";
 import { join as join5 } from "path";
+import { z as z11 } from "zod";
+function computeLowestRole(requiredRoles, rbacRoles) {
+  let lowestIndex = -1;
+  let lowestRole = requiredRoles[0];
+  for (const role of requiredRoles) {
+    const idx = rbacRoles.indexOf(role);
+    if (idx > lowestIndex) {
+      lowestIndex = idx;
+      lowestRole = role;
+    }
+  }
+  return lowestRole;
+}
 function extractPatternBaseSlug(pattern) {
   const stripped = pattern.replace(/^\//, "");
   if (!stripped) return null;
@@ -2775,12 +2791,101 @@ function extractManifestSlugs(artifactsDir) {
   }
   return slugs;
 }
+function normalizeNextJsSlug(slug) {
+  return slug.replace(/\[\[\.\.\.([\w]+)\]\]/g, ":$1*").replace(/\[\.\.\.([\w]+)\]/g, ":$1*").replace(/\[([\w]+)\]/g, ":$1");
+}
+function deriveProtectedRoutes(pages, rbacRoles) {
+  const protectedRoutes = [];
+  const uncoveredSlugs = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const page of pages) {
+    if (seen.has(page.slug)) continue;
+    seen.add(page.slug);
+    if (page.authRequired === false) continue;
+    if (page.authRequired === true && Array.isArray(page.requiredRoles) && page.requiredRoles.length > 0) {
+      const normalizedSlug = normalizeNextJsSlug(page.slug);
+      const lowestRole = computeLowestRole(page.requiredRoles, rbacRoles);
+      protectedRoutes.push({ pattern: `/${normalizedSlug}`, requiredRole: lowestRole });
+      if (!normalizedSlug.endsWith("*")) {
+        protectedRoutes.push({ pattern: `/${normalizedSlug}/:path*`, requiredRole: lowestRole });
+      }
+      continue;
+    }
+    const reason = page.authRequired === true ? "authRequired: true but requiredRoles is missing or empty" : "page emitter did not declare authRequired + requiredRoles";
+    uncoveredSlugs.push({ source: page.source, slug: page.slug, reason });
+  }
+  return { protectedRoutes, uncoveredSlugs };
+}
+function readAllManifestPages(artifactsDir) {
+  const allPages = [];
+  if (!existsSync6(artifactsDir)) return allPages;
+  let entries;
+  try {
+    entries = readdirSync3(artifactsDir);
+  } catch {
+    return allPages;
+  }
+  for (const entry of entries) {
+    if (!entry.endsWith("-manifest.json")) continue;
+    const filePath = join5(artifactsDir, entry);
+    try {
+      const raw = JSON.parse(readFileSync5(filePath, "utf-8"));
+      if (!Array.isArray(raw.pages)) continue;
+      for (const page of raw.pages) {
+        if (typeof page.slug !== "string" || !page.slug) continue;
+        allPages.push({
+          slug: page.slug,
+          authRequired: page.authRequired,
+          requiredRoles: page.requiredRoles,
+          source: entry
+        });
+      }
+    } catch {
+    }
+  }
+  return allPages;
+}
+function registerReadAuthManifestsTool(server2) {
+  server2.tool(
+    "stackwright_pro_read_auth_manifests",
+    "Read ALL *-manifest.json files from the pipeline artifacts directory (pages-manifest.json, dashboard-manifest.json, geo-manifest.json, etc.) and deterministically derive protectedRoutes and uncoveredSlugs. Uses the both-forms invariant (swp-n7kk): every authRequired route registers BOTH /{slug} (exact) AND /{slug}/:path* (sub-path). Call this in Step 1 of auth configuration instead of manually reading each manifest file. Fixes the Bead C issue where dashboard-manifest.json and geo-manifest.json were silently missed.",
+    {
+      rbacRoles: z11.array(z11.string()).describe(
+        'RBAC role hierarchy in descending privilege order, e.g. ["ESF8_COORDINATOR", "HOSPITAL_EM", "OBSERVER"]. Used to compute the lowestRole for each authRequired page.'
+      ),
+      artifactsDir: z11.string().optional().describe(
+        "Absolute or relative path to the pipeline artifacts directory. Defaults to .stackwright/artifacts relative to cwd."
+      )
+    },
+    (params) => {
+      const cwd = process.cwd();
+      const artifactsDir = params.artifactsDir ? params.artifactsDir : join5(cwd, ".stackwright", "artifacts");
+      const allPages = readAllManifestPages(artifactsDir);
+      const { protectedRoutes, uncoveredSlugs } = deriveProtectedRoutes(allPages, params.rbacRoles);
+      const manifestsRead = [...new Set(allPages.map((p) => p.source))].sort();
+      const result = {
+        protectedRoutes,
+        uncoveredSlugs,
+        manifestsRead,
+        summary: {
+          totalPages: allPages.length,
+          protectedCount: protectedRoutes.length,
+          uncoveredCount: uncoveredSlugs.length,
+          artifactsDir
+        }
+      };
+      return {
+        content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+      };
+    }
+  );
+}
 
 // src/tools/pipeline.ts
 import { WorkflowFileSchema, authConfigSchema as authConfigSchema3 } from "@stackwright-pro/types";
 
 // src/tools/get-schema.ts
-import { z as z12 } from "zod";
+import { z as z13 } from "zod";
 import {
   WorkflowStepSchema as WorkflowStepSchema2,
   WorkflowDefinitionSchema as WorkflowDefinitionSchema2,
@@ -2790,7 +2895,7 @@ import {
 } from "@stackwright-pro/types";
 
 // src/tools/validate-yaml-fragment.ts
-import { z as z11 } from "zod";
+import { z as z12 } from "zod";
 import { load as yamlLoad2 } from "js-yaml";
 import {
   WorkflowStepSchema,
@@ -2807,18 +2912,18 @@ var SUPPORTED_SCHEMA_NAMES = [
   "navigation_item",
   "auth_config"
 ];
-var NavigationLinkSchema = z11.lazy(
-  () => z11.object({
-    label: z11.string().min(1),
-    href: z11.string().min(1),
-    children: z11.array(NavigationLinkSchema).optional()
+var NavigationLinkSchema = z12.lazy(
+  () => z12.object({
+    label: z12.string().min(1),
+    href: z12.string().min(1),
+    children: z12.array(NavigationLinkSchema).optional()
   })
 );
-var NavigationSectionSchema = z11.object({
-  section: z11.string().min(1),
-  items: z11.array(NavigationLinkSchema)
+var NavigationSectionSchema = z12.object({
+  section: z12.string().min(1),
+  items: z12.array(NavigationLinkSchema)
 });
-var NavigationItemSchema = z11.union([
+var NavigationItemSchema = z12.union([
   NavigationLinkSchema,
   NavigationSectionSchema
 ]);
@@ -2920,10 +3025,10 @@ function registerValidateYamlFragmentTool(server2) {
     "stackwright_pro_validate_yaml_fragment",
     'Validates a YAML snippet against a canonical Zod schema before writing to disk. Returns actionable errors with "did you mean?" suggestions for common field-name drift (title vs label, id vs name, style vs theme.variant, etc.). Call this before stackwright_pro_safe_write to catch schema violations in-session.',
     {
-      schemaName: z11.enum(SUPPORTED_SCHEMA_NAMES).describe(
+      schemaName: z12.enum(SUPPORTED_SCHEMA_NAMES).describe(
         "Schema to validate against. One of: workflow_step, workflow_definition, workflow_field, workflow_action, navigation_item, auth_config"
       ),
-      yaml: z11.string().describe("YAML string to validate (can also be JSON \u2014 js-yaml parses both)")
+      yaml: z12.string().describe("YAML string to validate (can also be JSON \u2014 js-yaml parses both)")
     },
     async ({ schemaName, yaml: yaml3 }) => {
       const result = handleValidateYamlFragment({ schemaName, yaml: yaml3 });
@@ -2935,18 +3040,18 @@ function registerValidateYamlFragmentTool(server2) {
 }
 
 // src/tools/get-schema.ts
-var NavigationLinkSchema2 = z12.lazy(
-  () => z12.object({
-    label: z12.string().min(1),
-    href: z12.string().min(1),
-    children: z12.array(NavigationLinkSchema2).optional()
+var NavigationLinkSchema2 = z13.lazy(
+  () => z13.object({
+    label: z13.string().min(1),
+    href: z13.string().min(1),
+    children: z13.array(NavigationLinkSchema2).optional()
   })
 );
-var NavigationSectionSchema2 = z12.object({
-  section: z12.string().min(1),
-  items: z12.array(NavigationLinkSchema2)
+var NavigationSectionSchema2 = z13.object({
+  section: z13.string().min(1),
+  items: z13.array(NavigationLinkSchema2)
 });
-var NavigationItemSchema2 = z12.union([
+var NavigationItemSchema2 = z13.union([
   NavigationLinkSchema2,
   NavigationSectionSchema2
 ]);
@@ -3047,7 +3152,7 @@ function handleGetSchema(input) {
   const synonyms = FIELD_SYNONYMS[name];
   let jsonSchema;
   try {
-    const raw = z12.toJSONSchema(schema, { unrepresentable: "any" });
+    const raw = z13.toJSONSchema(schema, { unrepresentable: "any" });
     jsonSchema = raw;
   } catch {
     jsonSchema = { type: "object", description: "Schema introspection unavailable for this type" };
@@ -3101,7 +3206,7 @@ function registerGetSchemaTool(server2) {
     "stackwright_pro_get_schema",
     'Returns a compact, LLM-friendly summary of a canonical schema derived programmatically from Zod. Includes required/optional fields, types, constraints, and "did you mean?" warnings for common field-name drift. Use before authoring YAML to confirm exact field names.',
     {
-      schemaName: z12.enum(SUPPORTED_SCHEMA_NAMES).describe(
+      schemaName: z13.enum(SUPPORTED_SCHEMA_NAMES).describe(
         "Schema to summarize. One of: workflow_step, workflow_definition, workflow_field, workflow_action, navigation_item, auth_config"
       )
     },
@@ -4428,6 +4533,31 @@ function _validateArtifactInner(input) {
     }
   }
   const PHASE_ZOD_VALIDATORS = {
+    // 5.0 Theme defaultColorMode hygiene (swp-0ryn / swp-mw97)
+    //
+    // DHL raft runs produced `defaultColorMode: "auto"` (not a valid value) and
+    // `defaultColorMode: "dark"` when the designer said "respect OS preference".
+    // This validator catches the `auto` literal at write-time so the otter
+    // self-corrects before the artifact lands on disk.
+    //
+    // Valid values: 'light' | 'dark' | 'system'
+    // Omitting the key entirely is also valid (app shell honors prefers-color-scheme).
+    theme: (artifact2) => {
+      const dcm = artifact2["defaultColorMode"];
+      if (dcm === void 0 || dcm === null) {
+        return { success: true };
+      }
+      const VALID_COLOR_MODES = ["light", "dark", "system"];
+      if (!VALID_COLOR_MODES.includes(dcm)) {
+        return {
+          success: false,
+          error: {
+            message: `theme-tokens.json: \`defaultColorMode: "${String(dcm)}"\` is not a valid value. Valid values are \`light\`, \`dark\`, or \`system\`. Use \`system\` for OS-following behavior (respects \`prefers-color-scheme\`). Alternatively, OMIT the \`defaultColorMode\` key entirely when the designer has specified in design-language.json operationalNotes that OS preference should be respected (trigger phrases: "respect OS preference", "no forced default").`
+          }
+        };
+      }
+      return { success: true };
+    },
     workflow: (artifact2) => {
       const workflowData = artifact2["workflow"];
       if (!workflowData) {
@@ -4787,28 +4917,28 @@ function registerPipelineTools(server2) {
     "stackwright_pro_set_pipeline_state",
     `Atomic read\u2192modify\u2192write pipeline state. ${DESC}`,
     {
-      phase: z13.string().optional().describe('Phase to update, e.g. "designer"'),
-      field: z13.enum(["questionsCollected", "answered", "executed", "artifactWritten", "inFlight"]).optional().describe("Boolean field to set"),
+      phase: z14.string().optional().describe('Phase to update, e.g. "designer"'),
+      field: z14.enum(["questionsCollected", "answered", "executed", "artifactWritten", "inFlight"]).optional().describe("Boolean field to set"),
       // inFlight: set true BEFORE specialist invoke (dataflow mode, swp-ioc7); false after.
-      value: boolCoerce(z13.boolean().optional()).describe(
+      value: boolCoerce(z14.boolean().optional()).describe(
         'Value for the field \u2014 must be a JSON boolean (true/false), NOT the string "true"/"false"'
       ),
-      status: z13.enum(["setup", "questions", "execution", "done"]).optional().describe("Top-level status override"),
-      incrementRetry: boolCoerce(z13.boolean().optional()).describe(
+      status: z14.enum(["setup", "questions", "execution", "done"]).optional().describe("Top-level status override"),
+      incrementRetry: boolCoerce(z14.boolean().optional()).describe(
         "Bump retryCount by 1 \u2014 must be a JSON boolean"
       ),
       updates: jsonCoerce(
-        z13.array(
-          z13.object({
-            phase: z13.string(),
-            field: z13.enum([
+        z14.array(
+          z14.object({
+            phase: z14.string(),
+            field: z14.enum([
               "questionsCollected",
               "answered",
               "executed",
               "artifactWritten",
               "inFlight"
             ]),
-            value: z13.boolean()
+            value: z14.boolean()
           })
         ).optional()
       ).describe("Batch updates \u2014 apply multiple field changes in one atomic read\u2192modify\u2192write")
@@ -4828,7 +4958,7 @@ function registerPipelineTools(server2) {
     "stackwright_pro_check_execution_ready",
     `Check all phases have answer files in .stackwright/answers/. If phase is provided, check only that phase. ${DESC}`,
     {
-      phase: z13.string().optional().describe("If provided, check only this phase's readiness. Omit to check all phases.")
+      phase: z14.string().optional().describe("If provided, check only this phase's readiness. Omit to check all phases.")
     },
     async ({ phase }) => res(handleCheckExecutionReady(void 0, phase))
   );
@@ -4848,9 +4978,9 @@ function registerPipelineTools(server2) {
     "stackwright_pro_write_phase_questions",
     `Parse otter question-collection response \u2192 .stackwright/questions/{phase}.json. Specialists may also call this directly with a parsed questions array. ${DESC}`,
     {
-      phase: z13.string().optional().describe('Phase name, e.g. "designer" (required for direct write)'),
-      responseText: z13.string().optional().describe("Raw LLM response from QUESTION_COLLECTION_MODE"),
-      questions: jsonCoerce(z13.array(z13.any()).optional()).describe(
+      phase: z14.string().optional().describe('Phase name, e.g. "designer" (required for direct write)'),
+      responseText: z14.string().optional().describe("Raw LLM response from QUESTION_COLLECTION_MODE"),
+      questions: jsonCoerce(z14.array(z14.any()).optional()).describe(
         "Questions array for direct specialist write"
       )
     },
@@ -4892,22 +5022,22 @@ function registerPipelineTools(server2) {
   server2.tool(
     "stackwright_pro_build_specialist_prompt",
     `Assemble execution prompt from answers + upstream artifacts. Foreman passes verbatim. ${DESC}`,
-    { phase: z13.string().describe('Phase to build prompt for, e.g. "pages"') },
+    { phase: z14.string().describe('Phase to build prompt for, e.g. "pages"') },
     async ({ phase }) => res(handleBuildSpecialistPrompt({ phase }))
   );
   server2.tool(
     "stackwright_pro_validate_artifact",
     `Validate and write artifact to .stackwright/artifacts/. Returns retryPrompt on failure. ${DESC}`,
     {
-      phase: z13.string().describe('Phase that produced this artifact, e.g. "designer"'),
-      responseText: z13.string().optional().describe("Raw response text from the specialist otter (Foreman-mediated path, legacy)"),
-      artifact: jsonCoerce(z13.record(z13.string(), z13.unknown()).optional()).describe(
+      phase: z14.string().describe('Phase that produced this artifact, e.g. "designer"'),
+      responseText: z14.string().optional().describe("Raw response text from the specialist otter (Foreman-mediated path, legacy)"),
+      artifact: jsonCoerce(z14.record(z14.string(), z14.unknown()).optional()).describe(
         "Artifact object to validate and write directly (specialist direct path \u2014 skips off-script detection and JSON parsing)"
       ),
-      integrationName: z13.string().optional().describe(
+      integrationName: z14.string().optional().describe(
         'When phase="api": write to api-config-<integrationName>.json instead of api-config.json. Enables concurrent per-spec fan-out without collision (swp-530y).'
       ),
-      workflowName: z13.string().optional().describe(
+      workflowName: z14.string().optional().describe(
         `When phase="workflow": write to workflow-config-<workflowName>.json instead of workflow-config.json. Enables concurrent per-workflow fan-out without collision (swp-x8sm). Must be a kebab-case slug matching the workflow's id field.`
       )
     },
@@ -4936,7 +5066,7 @@ function registerPipelineTools(server2) {
     "stackwright_pro_emit_event",
     `FOREMAN ONLY \u2014 specialist otters that call this will receive an authorization rejection (no-op, not an error). Emit a telemetry event to .stackwright/pipeline-events.ndjson. Foreman calls this at phase boundaries and agent-invoke boundaries. Best-effort: failures are silent and never block. ${DESC}`,
     {
-      type: z13.enum([
+      type: z14.enum([
         "phase_start",
         "phase_complete",
         "phase_ready",
@@ -4945,20 +5075,20 @@ function registerPipelineTools(server2) {
       ]).describe("Event type to emit"),
       // phase_ready: emitted in dataflow mode (swp-ioc7) when a phase enters the ready set
       // (deps satisfied, not inFlight, not yet complete) — BEFORE invoking the specialist.
-      phase: z13.string().optional().describe("Current phase name"),
-      targetOtter: z13.string().optional().describe("For agent_invoke_* events: which otter is being invoked"),
-      success: boolCoerce(z13.boolean().optional()).describe(
+      phase: z14.string().optional().describe("Current phase name"),
+      targetOtter: z14.string().optional().describe("For agent_invoke_* events: which otter is being invoked"),
+      success: boolCoerce(z14.boolean().optional()).describe(
         'For agent_invoke_complete: did the invocation succeed? (boolean; string "true"/"false" also accepted for caller tolerance)'
       ),
-      otter: z13.string().optional().describe('Which otter is emitting (defaults to "foreman")'),
-      durationSec: z13.number().optional().describe("Duration in seconds (for *_complete events)")
+      otter: z14.string().optional().describe('Which otter is emitting (defaults to "foreman")'),
+      durationSec: z14.number().optional().describe("Duration in seconds (for *_complete events)")
     },
     async ({ type, phase, targetOtter, success, otter, durationSec }) => res(handleEmitEvent({ type, phase, targetOtter, success, otter, durationSec }))
   );
 }
 
 // src/tools/safe-write.ts
-import { z as z14 } from "zod";
+import { z as z15 } from "zod";
 import { writeFileSync as writeFileSync5, readFileSync as readFileSync8, existsSync as existsSync8, mkdirSync as mkdirSync5, lstatSync as lstatSync7 } from "fs";
 import { normalize, isAbsolute, dirname, join as join8 } from "path";
 import { emit as emit2 } from "@stackwright-pro/telemetry";
@@ -5454,10 +5584,10 @@ function registerSafeWriteTools(server2) {
     "stackwright_pro_safe_write",
     DESC,
     {
-      callerOtter: z14.string().describe('The otter agent name requesting the write, e.g. "stackwright-pro-page-otter"'),
-      filePath: z14.string().describe('Relative path from project root, e.g. "pages/dashboard/content.yml"'),
-      content: z14.string().describe("File content to write"),
-      createDirectories: boolCoerce(z14.boolean().optional().default(true)).describe(
+      callerOtter: z15.string().describe('The otter agent name requesting the write, e.g. "stackwright-pro-page-otter"'),
+      filePath: z15.string().describe('Relative path from project root, e.g. "pages/dashboard/content.yml"'),
+      content: z15.string().describe("File content to write"),
+      createDirectories: boolCoerce(z15.boolean().optional().default(true)).describe(
         "Create parent directories if they don't exist. Default: true"
       )
     },
@@ -5474,9 +5604,12 @@ function registerSafeWriteTools(server2) {
 }
 
 // src/tools/auth.ts
-import { z as z15 } from "zod";
+import { z as z16 } from "zod";
 import { readFileSync as readFileSync9, writeFileSync as writeFileSync6, existsSync as existsSync9, mkdirSync as mkdirSync6 } from "fs";
 import { join as join9 } from "path";
+function normalizeProviderSlug(slug) {
+  return slug.replace(/-/g, "_");
+}
 function buildHierarchy(roles) {
   const h = {};
   for (let i = 0; i < roles.length - 1; i++) {
@@ -5731,13 +5864,12 @@ ${hierarchyToYaml(hierarchy, "    ")}`;
     const ocspEndpoint = params.cacOcspEndpoint ?? "https://ocsp.disa.mil";
     const certHeader = params.cacCertHeader ?? "X-SSL-Client-Cert";
     return `# stackwright.auth.yml \u2014 generated by Auth Otter
-method: cac
-${providerLine}${useProxy ? "proxy" : "middleware"}: ./${useProxy ? "proxy" : "middleware"}.ts
-cac:
-  caBundle: \${CAC_CA_BUNDLE}
-  edipiLookup: ${edipiLookup}
-  ocspEndpoint: \${CAC_OCSP_ENDPOINT}
-  certHeader: ${certHeader}
+type: pki
+${useProxy ? "proxy" : "middleware"}: ./${useProxy ? "proxy" : "middleware"}.ts
+caBundle: \${CAC_CA_BUNDLE}
+edipiLookup: ${edipiLookup}
+ocspEndpoint: \${CAC_OCSP_ENDPOINT}
+certHeader: ${certHeader}
 ${rbacSection}
 protectedRoutes:
 ${routeLines}
@@ -5748,14 +5880,13 @@ ${auditSection}
     const scopes2 = params.oidcScopes ?? "openid profile email";
     const roleClaim = params.oidcRoleClaim ?? "roles";
     return `# stackwright.auth.yml \u2014 generated by Auth Otter
-method: oidc
+type: oidc
 ${providerLine}${useProxy ? "proxy" : "middleware"}: ./${useProxy ? "proxy" : "middleware"}.ts
-oidc:
-  discoveryUrl: \${OIDC_DISCOVERY_URL}
-  clientId: \${OIDC_CLIENT_ID}
-  clientSecret: \${OIDC_CLIENT_SECRET}
-  scopes: ${scopes2}
-  roleClaim: ${roleClaim}
+discoveryUrl: \${OIDC_DISCOVERY_URL}
+clientId: \${OIDC_CLIENT_ID}
+clientSecret: \${OIDC_CLIENT_SECRET}
+scopes: ${scopes2}
+roleClaim: ${roleClaim}
 ${rbacSection}
 protectedRoutes:
 ${routeLines}
@@ -5764,14 +5895,13 @@ ${auditSection}
   }
   const scopes = params.oauth2Scopes ?? "read write";
   return `# stackwright.auth.yml \u2014 generated by Auth Otter
-method: oauth2
+type: oauth2
 ${providerLine}${useProxy ? "proxy" : "middleware"}: ./${useProxy ? "proxy" : "middleware"}.ts
-oauth2:
-  authorizationUrl: \${OAUTH2_AUTH_URL}
-  tokenUrl: \${OAUTH2_TOKEN_URL}
-  clientId: \${OAUTH2_CLIENT_ID}
-  clientSecret: \${OAUTH2_CLIENT_SECRET}
-  scopes: ${scopes}
+authorizationUrl: \${OAUTH2_AUTH_URL}
+tokenUrl: \${OAUTH2_TOKEN_URL}
+clientId: \${OAUTH2_CLIENT_ID}
+clientSecret: \${OAUTH2_CLIENT_SECRET}
+scopes: ${scopes}
 ${rbacSection}
 protectedRoutes:
 ${routeLines}
@@ -5978,14 +6108,13 @@ ${hierarchyToYaml(hierarchy, "    ")}`;
     const ocspEndpoint = params.cacOcspEndpoint ?? "https://ocsp.disa.mil";
     const certHeader = params.cacCertHeader ?? "X-SSL-Client-Cert";
     return `# stackwright.auth.yml \u2014 generated by Auth Otter
-method: cac
+type: pki
 devOnly: true
-${providerLine}${useProxy ? "proxy" : "middleware"}: ./${useProxy ? "proxy" : "middleware"}.ts
-cac:
-  caBundle: ${caBundle}
-  edipiLookup: ${edipiLookup}
-  ocspEndpoint: ${ocspEndpoint}
-  certHeader: ${certHeader}
+${useProxy ? "proxy" : "middleware"}: ./${useProxy ? "proxy" : "middleware"}.ts
+caBundle: ${caBundle}
+edipiLookup: ${edipiLookup}
+ocspEndpoint: ${ocspEndpoint}
+certHeader: ${certHeader}
 ${rbacSection}
 protectedRoutes:
 ${routeLines}
@@ -5996,15 +6125,14 @@ ${auditSection}
     const scopes2 = params.oidcScopes ?? "openid profile email";
     const roleClaim = params.oidcRoleClaim ?? "roles";
     return `# stackwright.auth.yml \u2014 generated by Auth Otter
-method: oidc
+type: oidc
 devOnly: true
 ${providerLine}${useProxy ? "proxy" : "middleware"}: ./${useProxy ? "proxy" : "middleware"}.ts
-oidc:
-  discoveryUrl: https://dev-mock-oidc/.well-known/openid-configuration
-  clientId: dev-mock-client
-  clientSecret: dev-mock-secret
-  scopes: ${scopes2}
-  roleClaim: ${roleClaim}
+discoveryUrl: https://dev-mock-oidc/.well-known/openid-configuration
+clientId: dev-mock-client
+clientSecret: dev-mock-secret
+scopes: ${scopes2}
+roleClaim: ${roleClaim}
 ${rbacSection}
 protectedRoutes:
 ${routeLines}
@@ -6013,15 +6141,14 @@ ${auditSection}
   }
   const scopes = params.oauth2Scopes ?? "read write";
   return `# stackwright.auth.yml \u2014 generated by Auth Otter
-method: oauth2
+type: oauth2
 devOnly: true
 ${providerLine}${useProxy ? "proxy" : "middleware"}: ./${useProxy ? "proxy" : "middleware"}.ts
-oauth2:
-  authorizationUrl: https://dev-mock-oauth2/authorize
-  tokenUrl: https://dev-mock-oauth2/token
-  clientId: dev-mock-client
-  clientSecret: dev-mock-secret
-  scopes: ${scopes}
+authorizationUrl: https://dev-mock-oauth2/authorize
+tokenUrl: https://dev-mock-oauth2/token
+clientId: dev-mock-client
+clientSecret: dev-mock-secret
+scopes: ${scopes}
 ${rbacSection}
 protectedRoutes:
 ${routeLines}
@@ -6091,6 +6218,10 @@ function updatePackageJsonScripts(existingJson, roles, mockUsers) {
   return JSON.stringify(pkg, null, 2) + "\n";
 }
 async function configureAuthHandler(params, cwd) {
+  params = {
+    ...params,
+    provider: params.provider != null ? normalizeProviderSlug(params.provider) : void 0
+  };
   const {
     method,
     provider,
@@ -6342,45 +6473,46 @@ function registerAuthTools(server2) {
     "stackwright_pro_configure_auth",
     "Generate authentication middleware and configuration for a Next.js Stackwright application. Writes `middleware.ts` (or `proxy.ts` for Next.js >=16) from a secure template, writes a standalone `stackwright.auth.yml` sibling file, and generates `.env.example` with required environment variables. \u26A0\uFE0F For CAC/PKI: generated `middleware.ts` carries a SECURITY REVIEW REQUIRED comment \u2014 certificate chain validation must be verified by a DoD security officer before production deployment. This is the ONLY approved path to generating `middleware.ts`. Never write TypeScript auth files directly.",
     {
-      method: z15.enum(["cac", "oidc", "oauth2", "none"]),
-      provider: z15.enum(["azure-ad", "okta", "ping", "cognito", "custom"]).optional(),
+      method: z16.enum(["cac", "oidc", "oauth2", "none"]),
+      // Both hyphen and underscore accepted at the tool surface; normalized to underscore downstream.
+      provider: z16.enum(["azure-ad", "azure_ad", "okta", "ping", "cognito", "custom"]).optional(),
       // CAC
-      cacCaBundle: z15.string().optional(),
-      cacEdipiLookup: z15.string().optional(),
-      cacOcspEndpoint: z15.string().optional(),
-      cacCertHeader: z15.string().optional(),
+      cacCaBundle: z16.string().optional(),
+      cacEdipiLookup: z16.string().optional(),
+      cacOcspEndpoint: z16.string().optional(),
+      cacCertHeader: z16.string().optional(),
       // OIDC
-      oidcDiscoveryUrl: z15.string().optional(),
-      oidcClientId: z15.string().optional(),
-      oidcClientSecret: z15.string().optional(),
-      oidcScopes: z15.string().optional(),
-      oidcRoleClaim: z15.string().optional(),
+      oidcDiscoveryUrl: z16.string().optional(),
+      oidcClientId: z16.string().optional(),
+      oidcClientSecret: z16.string().optional(),
+      oidcScopes: z16.string().optional(),
+      oidcRoleClaim: z16.string().optional(),
       // OAuth2
-      oauth2AuthUrl: z15.string().optional(),
-      oauth2TokenUrl: z15.string().optional(),
-      oauth2ClientId: z15.string().optional(),
-      oauth2ClientSecret: z15.string().optional(),
-      oauth2Scopes: z15.string().optional(),
+      oauth2AuthUrl: z16.string().optional(),
+      oauth2TokenUrl: z16.string().optional(),
+      oauth2ClientId: z16.string().optional(),
+      oauth2ClientSecret: z16.string().optional(),
+      oauth2Scopes: z16.string().optional(),
       // RBAC
-      rbacRoles: jsonCoerce(z15.array(z15.string()).optional()),
-      rbacDefaultRole: z15.string().optional(),
+      rbacRoles: jsonCoerce(z16.array(z16.string()).optional()),
+      rbacDefaultRole: z16.string().optional(),
       // Audit
-      auditEnabled: boolCoerce(z15.boolean().optional()),
-      auditRetentionDays: numCoerce(z15.number().int().positive().optional()),
+      auditEnabled: boolCoerce(z16.boolean().optional()),
+      auditRetentionDays: numCoerce(z16.number().int().positive().optional()),
       // Routes — accepts bare strings (backward-compat) or per-route objects (swp-owu0)
       protectedRoutes: jsonCoerce(
-        z15.array(
-          z15.union([
-            z15.string(),
-            z15.object({ pattern: z15.string(), requiredRole: z15.string().optional() })
+        z16.array(
+          z16.union([
+            z16.string(),
+            z16.object({ pattern: z16.string(), requiredRole: z16.string().optional() })
           ])
         ).optional()
       ),
       // Injection for tests
-      _cwd: z15.string().optional(),
-      devOnly: boolCoerce(z15.boolean().optional()),
-      mockUsers: jsonCoerce(z15.array(z15.object({ name: z15.string(), email: z15.string() })).optional()),
-      nextMajorVersion: numCoerce(z15.number().int().positive().optional())
+      _cwd: z16.string().optional(),
+      devOnly: boolCoerce(z16.boolean().optional()),
+      mockUsers: jsonCoerce(z16.array(z16.object({ name: z16.string(), email: z16.string() })).optional()),
+      nextMajorVersion: numCoerce(z16.number().int().positive().optional())
     },
     async (params) => {
       const cwd = params._cwd ?? process.cwd();
@@ -6400,7 +6532,7 @@ var _checksums = /* @__PURE__ */ new Map([
   ],
   [
     "stackwright-pro-auth-otter.json",
-    "69fa03c5532ef617c86fe7af41e8174c168d282baf602b1b269a7e933ea86b7c"
+    "eee511fa214203ce88d51996c6b1b483b6ad3a0ae474cc7be5d380fdbbc43bb1"
   ],
   [
     "stackwright-pro-dashboard-otter.json",
@@ -6436,7 +6568,7 @@ var _checksums = /* @__PURE__ */ new Map([
   ],
   [
     "stackwright-pro-polish-otter.json",
-    "fd8f8963266c6179eebf8eac4f656e8274aa3a721e5296abdbde5b00ad8a2297"
+    "4b8223d89af7f92b9051fee7bb29fc4b1ee2a5a9ab87e8e67a6d8be6122fa029"
   ],
   [
     "stackwright-pro-qa-otter.json",
@@ -6448,7 +6580,7 @@ var _checksums = /* @__PURE__ */ new Map([
   ],
   [
     "stackwright-pro-theme-otter.json",
-    "01d16d0597d475db60362e3b8020035e140817d197c36f4307a48b95f4b28b60"
+    "afb47f8381907145c0e098bdcaae4dd9f5c4ff825a8e88d00a218d2f6858820b"
   ],
   [
     "stackwright-services-otter.json",
@@ -6669,7 +6801,7 @@ function registerIntegrityTools(server2) {
 }
 
 // src/tools/domain.ts
-import { z as z16 } from "zod";
+import { z as z17 } from "zod";
 import { readFileSync as readFileSync11, existsSync as existsSync10 } from "fs";
 import { join as join11 } from "path";
 function handleListCollections(input) {
@@ -7055,7 +7187,7 @@ function registerDomainTools(server2) {
     "stackwright_pro_resolve_data_strategy",
     "Look up the data freshness strategy configuration from the user's answer. Returns mechanism, revalidation seconds, required packages, and the exact MCP tool call to make. Replaces the strategy table in the data-otter prompt.",
     {
-      strategy: z16.string().describe(
+      strategy: z17.string().describe(
         'The data-1 answer value: "pulse-fast", "isr-fast", "isr-standard", or "isr-slow"'
       )
     },
@@ -7065,7 +7197,7 @@ function registerDomainTools(server2) {
     "stackwright_pro_validate_workflow",
     "Validate a workflow definition against the Stackwright workflow schema. Checks step ID uniqueness, transition targets, terminal state existence, and service references. Call this after the workflow otter produces output.",
     {
-      workflow: jsonCoerce(z16.record(z16.string(), z16.unknown()).optional()).describe(
+      workflow: jsonCoerce(z17.record(z17.string(), z17.unknown()).optional()).describe(
         "Parsed workflow object. If omitted, reads from .stackwright/artifacts/workflow-config.json"
       )
     },
@@ -7074,7 +7206,7 @@ function registerDomainTools(server2) {
 }
 
 // src/tools/type-schemas.ts
-import { z as z17 } from "zod";
+import { z as z18 } from "zod";
 function buildTypeSchemaSummary() {
   return {
     version: "1.0",
@@ -7151,7 +7283,7 @@ function registerTypeSchemasTool(server2) {
     "stackwright_pro_get_type_schemas",
     "Returns a structured summary of all canonical @stackwright-pro/types schemas, organized by domain. Use this to determine which otter owns a given schema and what artifact key to expect.",
     {
-      format: z17.enum(["full", "domains-only"]).optional().default("full").describe("full = complete summary with all fields; domains-only = just domain names")
+      format: z18.enum(["full", "domains-only"]).optional().default("full").describe("full = complete summary with all fields; domains-only = just domain names")
     },
     async ({ format }) => {
       const summary = buildTypeSchemaSummary();
@@ -7167,7 +7299,7 @@ function registerTypeSchemasTool(server2) {
 import * as fs2 from "fs";
 import * as os from "os";
 import * as path3 from "path";
-import { z as z18 } from "zod";
+import { z as z19 } from "zod";
 import { load as yamlLoad3, dump as yamlDump } from "js-yaml";
 import { writePage, resolvePagesDir } from "@stackwright/cli";
 import { isProContentType, isOssTypeWithProExtension } from "@stackwright-pro/types";
@@ -7279,10 +7411,10 @@ function registerProPageTools(server2) {
     "stackwright_pro_write_page",
     "Write or update a page's YAML content with Pro content-type awareness. Validates against the Stackwright schema (including Pro types like stats_grid, data_table_pulse, map_pulse, alert_banner). Invalid YAML or schema violations on OSS-type fields are rejected with field-level errors. Use this instead of stackwright_write_page for any page containing Pro content types.",
     {
-      projectRoot: z18.string().describe("Absolute path to the Stackwright project root"),
-      slug: z18.string().describe('Page slug (e.g. "dashboard/main" or "/dashboard/main")'),
-      content: z18.string().describe("Full YAML content for the page (content.yml contents)"),
-      locale: z18.string().optional().describe(
+      projectRoot: z19.string().describe("Absolute path to the Stackwright project root"),
+      slug: z19.string().describe('Page slug (e.g. "dashboard/main" or "/dashboard/main")'),
+      content: z19.string().describe("Full YAML content for the page (content.yml contents)"),
+      locale: z19.string().optional().describe(
         'BCP 47 locale tag (e.g. "fr", "de"). If provided, writes content.<locale>.yml instead of content.yml.'
       )
     },
@@ -7541,7 +7673,7 @@ function registerScaffoldCleanupTools(server2) {
 }
 
 // src/tools/contrast.ts
-import { z as z19 } from "zod";
+import { z as z20 } from "zod";
 function linearizeChannel(c255) {
   const c = c255 / 255;
   return c <= 0.04045 ? c / 12.92 : Math.pow((c + 0.055) / 1.055, 2.4);
@@ -7713,8 +7845,8 @@ function registerContrastTools(server2) {
     "stackwright_pro_check_contrast",
     'Compute the exact WCAG 2.1 contrast ratio between a foreground and background color. Returns the ratio and AA/AAA pass/fail flags. Use this to verify any foreground/background color pair before writing it to the token set. Accepts #RGB, #RRGGBB, hsl(...), or shadcn HSL format ("H S% L%").',
     {
-      fg: z19.string().describe("Foreground (text) color \u2014 hex or HSL"),
-      bg: z19.string().describe("Background color \u2014 hex or HSL")
+      fg: z20.string().describe("Foreground (text) color \u2014 hex or HSL"),
+      bg: z20.string().describe("Background color \u2014 hex or HSL")
     },
     async ({ fg, bg }) => {
       let result;
@@ -7744,8 +7876,8 @@ function registerContrastTools(server2) {
     "stackwright_pro_derive_accessible_palette",
     'Given a seed color (treated as a background), derive the best accessible foreground (text) color that meets the target contrast ratio. Evaluates #ffffff and #000000 against the seed and picks whichever satisfies the target ratio with the highest contrast. Use this for every {name}-foreground token derivation instead of guessing white vs black. Accepts #RGB, #RRGGBB, hsl(...), or shadcn HSL format ("H S% L%").',
     {
-      seed: z19.string().describe("Background (seed) color \u2014 hex or HSL"),
-      targetRatio: numCoerce(z19.number().default(4.5)).describe(
+      seed: z20.string().describe("Background (seed) color \u2014 hex or HSL"),
+      targetRatio: numCoerce(z20.number().default(4.5)).describe(
         "Minimum required contrast ratio (default 4.5 for WCAG AA)"
       )
     },
@@ -7780,7 +7912,7 @@ function registerContrastTools(server2) {
 }
 
 // src/tools/compile.ts
-import { z as z20 } from "zod";
+import { z as z21 } from "zod";
 import fs3 from "fs";
 import path4 from "path";
 import { compileCollections } from "@stackwright-pro/pulse/server";
@@ -7826,7 +7958,7 @@ async function tryOssCompile(fn, ctx, extra) {
   }
 }
 function registerCompileTools(server2) {
-  const projectRootArg = z20.string().optional().describe("Absolute path to project root (defaults to cwd)");
+  const projectRootArg = z21.string().optional().describe("Absolute path to project root (defaults to cwd)");
   server2.tool(
     "stackwright_pro_compile_collections",
     "Compile stackwright.collections.yml \u2192 public/stackwright-content/_collections.json. Reads and validates the live-collections sidecar config file and emits the JSON sink consumed at runtime by PulseCollectionProvider.",
@@ -8002,7 +8134,7 @@ ${results.join("\n")}`;
     "stackwright_pro_compile_page",
     "Compile a single page by slug. Delegates to compilePage from @stackwright/build-scripts installed in the project.",
     {
-      slug: z20.string().describe('Page slug (relative path under pages/, e.g. "dashboard")'),
+      slug: z21.string().describe('Page slug (relative path under pages/, e.g. "dashboard")'),
       projectRoot: projectRootArg
     },
     async ({ slug, projectRoot }) => {
@@ -8022,7 +8154,7 @@ ${results.join("\n")}`;
 }
 
 // src/tools/strip-legacy-integrations.ts
-import { z as z21 } from "zod";
+import { z as z22 } from "zod";
 import { existsSync as existsSync13, readFileSync as readFileSync13, writeFileSync as writeFileSync9 } from "fs";
 import { join as join14 } from "path";
 function handleStripLegacyIntegrations(input) {
@@ -8085,7 +8217,7 @@ function registerStripLegacyIntegrationsTool(server2) {
     "stackwright_pro_strip_legacy_integrations",
     "Removes the deprecated top-level integrations[] block from stackwright.yml. The authoritative source for integration config is stackwright.integrations.yml \u2014 this tool cleans up legacy entries from older raft runs. Idempotent: no-op if no legacy block present. Preserves all other top-level keys, comments, and formatting.",
     {
-      projectRoot: z21.string().describe("Absolute path to the project root directory")
+      projectRoot: z22.string().describe("Absolute path to the project root directory")
     },
     async ({ projectRoot }) => {
       const result = handleStripLegacyIntegrations({ projectRoot });
@@ -8097,7 +8229,7 @@ function registerStripLegacyIntegrationsTool(server2) {
 }
 
 // src/tools/emitters.ts
-import { z as z22 } from "zod";
+import { z as z23 } from "zod";
 import { readFileSync as readFileSync14, existsSync as existsSync14, readdirSync as readdirSync8 } from "fs";
 import { join as join15 } from "path";
 import yaml from "js-yaml";
@@ -8156,7 +8288,7 @@ Call this tool, then write both files with stackwright_pro_safe_write:
 
 Do NOT compose the contents by hand. This emitter is the source of truth. If an env var is missing, update integrations.yml or the emitter \u2014 not the file. This is the first concrete instance of the swp-zf9y deterministic emitter pattern. ${ENV_LOCAL_DESC}`,
     {
-      cwd: z22.string().describe(
+      cwd: z23.string().describe(
         "Absolute path to the project root containing stackwright.integrations.yml and optionally services/*.yml"
       )
     },
@@ -8203,8 +8335,8 @@ mapProvider options:
 
 This is the second concrete instance of the swp-zf9y deterministic emitter pattern. Refs: swp-57ku, swp-2m89, swp-zf9y, drawer 957. ${PROVIDERS_DESC}`,
     {
-      cwd: z22.string().describe("Absolute path to the project root containing stackwright.integrations.yml"),
-      mapProvider: z22.enum(["maplibre", "cesium", "none"]).optional().describe(
+      cwd: z23.string().describe("Absolute path to the project root containing stackwright.integrations.yml"),
+      mapProvider: z23.enum(["maplibre", "cesium", "none"]).optional().describe(
         "Map provider to register (default: cesium for Pro \u2014 3D globe + terrain). Use maplibre for OSS-style 2D dashboards (explicit opt-out). Use none if pages have no map content_items."
       )
     },
@@ -8245,7 +8377,7 @@ Workflow:
 
 This is the third concrete instance of the swp-zf9y deterministic emitter pattern. Refs: swp-phkh, swp-zf9y. ${PORTS_DESC}`,
     {
-      cwd: z22.string().describe("Absolute path to the project root containing stackwright.integrations.yml")
+      cwd: z23.string().describe("Absolute path to the project root containing stackwright.integrations.yml")
     },
     async ({ cwd }) => {
       const integrations = readIntegrations(cwd);
@@ -8274,7 +8406,7 @@ This is the third concrete instance of the swp-zf9y deterministic emitter patter
 }
 
 // src/tools/list-specs.ts
-import { z as z23 } from "zod";
+import { z as z24 } from "zod";
 import { readdirSync as readdirSync9, readFileSync as readFileSync15, statSync as statSync2, existsSync as existsSync15 } from "fs";
 import { join as join16, extname, basename as basename2 } from "path";
 var STRIP_SUFFIXES = ["-openapi", "-asyncapi", "-api", "-spec"];
@@ -8339,7 +8471,7 @@ function registerListSpecsTool(server2) {
     "stackwright_pro_list_specs",
     "Enumerate OpenAPI/AsyncAPI specs in the project's specs/ directory. Returns one entry per spec with integration name (derived from filename), detected format, and size. Used by the foreman to fan out the api phase with one api-otter invocation per spec.",
     {
-      projectRoot: z23.string().describe("Absolute path to the project root directory")
+      projectRoot: z24.string().describe("Absolute path to the project root directory")
     },
     async ({ projectRoot }) => {
       const result = handleListSpecs({ projectRoot });
@@ -8351,7 +8483,7 @@ function registerListSpecsTool(server2) {
 }
 
 // src/tools/consolidate-integrations.ts
-import { z as z24 } from "zod";
+import { z as z25 } from "zod";
 import { readdirSync as readdirSync10, readFileSync as readFileSync16, writeFileSync as writeFileSync10, existsSync as existsSync16, mkdirSync as mkdirSync9 } from "fs";
 import { lockSync as lockSync2 } from "proper-lockfile";
 import { join as join17, basename as basename3 } from "path";
@@ -8472,7 +8604,7 @@ function registerConsolidateIntegrationsTool(server2) {
       "no per-spec artifacts are found."
     ].join(" "),
     {
-      projectRoot: z24.string().describe("Absolute path to the project root directory")
+      projectRoot: z25.string().describe("Absolute path to the project root directory")
     },
     async ({ projectRoot }) => {
       try {
@@ -8530,7 +8662,7 @@ var package_default = {
     "test:coverage": "vitest run --coverage"
   },
   name: "@stackwright-pro/mcp",
-  version: "0.2.0-alpha.108",
+  version: "0.2.0-alpha.111",
   description: "MCP tools for Stackwright Pro - Data Explorer, Security, ISR, and Dashboard generation",
   license: "SEE LICENSE IN LICENSE",
   main: "./dist/server.js",
@@ -8599,6 +8731,7 @@ registerOrchestrationTools(server);
 registerPipelineTools(server);
 registerSafeWriteTools(server);
 registerAuthTools(server);
+registerReadAuthManifestsTool(server);
 registerIntegrityTools(server);
 registerArtifactSigningTools(server);
 registerDomainTools(server);