@stackwright-pro/mcp 0.2.0-alpha.114 → 0.2.0-alpha.117

package/dist/server.mjs

@@ -1290,7 +1290,7 @@ function answersToManifestFormat(answers, questions) {
         return qHeader.startsWith(headerLower.split("-")[0]);
       });
       if (matched) {
-        result[matched.id] = answer.selected_options[0] || "";
+        result[matched.id] = answer.selected_options.length > 1 ? answer.selected_options : answer.selected_options[0] || "";
       }
       continue;
     }
@@ -1762,7 +1762,10 @@ function handleSavePhaseAnswers(input) {
       }
     } else {
       answers = Object.fromEntries(
-        input.rawAnswers.map((a) => [a.question_header, a.selected_options[0] ?? ""])
+        input.rawAnswers.map((a) => [
+          a.question_header,
+          a.selected_options.length > 1 ? a.selected_options : a.selected_options[0] ?? ""
+        ])
       );
     }
     const payload = {
@@ -2006,9 +2009,9 @@ function registerOrchestrationTools(server2) {
 
 // src/tools/pipeline.ts
 import { z as z14 } from "zod";
-import { readFileSync as readFileSync7, writeFileSync as writeFileSync4, existsSync as existsSync7, mkdirSync as mkdirSync4, lstatSync as lstatSync6, readdirSync as readdirSync5 } from "fs";
+import { readFileSync as readFileSync11, writeFileSync as writeFileSync4, existsSync as existsSync11, mkdirSync as mkdirSync4, lstatSync as lstatSync6, readdirSync as readdirSync8 } from "fs";
 import { lockSync } from "proper-lockfile";
-import { join as join7 } from "path";
+import { join as join11 } from "path";
 import { createHash as createHash3 } from "crypto";
 
 // src/artifact-signing.ts
@@ -2551,6 +2554,598 @@ function formatPulseRetryPrompt(result) {
   return lines.join("\n");
 }
 
+// src/tools/validate-theme-tokens.ts
+import { readdirSync as readdirSync3, readFileSync as readFileSync6, existsSync as existsSync7 } from "fs";
+import { join as join6, relative as relative2 } from "path";
+import { load as yamlLoad2 } from "js-yaml";
+
+// src/tools/schema-registry.ts
+import { z as z11 } from "zod";
+import { readFileSync as readFileSync5, existsSync as existsSync6 } from "fs";
+import { join as join5 } from "path";
+import {
+  WorkflowStepSchema,
+  WorkflowDefinitionSchema,
+  WorkflowFieldSchema,
+  WorkflowActionSchema,
+  WorkflowWizardContentSchema,
+  authConfigSchema,
+  themeTokensFileSchema
+} from "@stackwright-pro/types";
+import {
+  MetricCardPulseSchema,
+  DataTablePulseSchema,
+  StatusBadgePulseSchema,
+  MapPulseSchema
+} from "@stackwright-pro/pulse";
+function getSchemaForEntry(entry, ctx) {
+  if (entry.schema) return entry.schema;
+  if (entry.schemaFactory) {
+    if (ctx) return entry.schemaFactory(ctx);
+    console.warn(
+      "[schema-registry] schemaFactory entry requires projectRoot context. Pass { projectRoot } to get the project-specific schema. Falling back to z.string() (no enforcement)."
+    );
+    return z11.string();
+  }
+  return z11.unknown();
+}
+var NavigationLinkSchema = z11.lazy(
+  () => z11.object({
+    label: z11.string().min(1),
+    href: z11.string().min(1),
+    children: z11.array(NavigationLinkSchema).optional()
+  })
+);
+var NavigationSectionSchema = z11.object({
+  section: z11.string().min(1),
+  items: z11.array(NavigationLinkSchema)
+});
+var NavigationItemSchema = z11.union([
+  NavigationLinkSchema,
+  NavigationSectionSchema
+]);
+var THEME_TOKENS_PATHS = [
+  join5(".stackwright", "artifacts", "theme-tokens.json"),
+  join5("public", "stackwright-content", "_theme.json")
+];
+function resolveStatusLadder(projectRoot) {
+  for (const relPath of THEME_TOKENS_PATHS) {
+    const fullPath = join5(projectRoot, relPath);
+    if (!existsSync6(fullPath)) continue;
+    try {
+      const raw = readFileSync5(fullPath, "utf-8");
+      const parsed = JSON.parse(raw);
+      if (Array.isArray(parsed["statusLadder"]) && parsed["statusLadder"].length > 0) {
+        return parsed["statusLadder"].filter(
+          (t) => typeof t === "string" && t.startsWith("status-")
+        );
+      }
+      const colors = parsed["tokens"]?.["colors"];
+      if (colors && typeof colors === "object") {
+        const statusKeys = Object.keys(colors).filter((k) => k.startsWith("status-"));
+        if (statusKeys.length > 0) return statusKeys;
+      }
+    } catch {
+    }
+  }
+  return [];
+}
+function buildThemeStatusTokenSchema(ctx) {
+  const ladder = resolveStatusLadder(ctx.projectRoot);
+  if (ladder.length === 0) {
+    return z11.string();
+  }
+  return z11.enum(ladder);
+}
+var REGISTRY = /* @__PURE__ */ new Map([
+  // ── Workflow schemas ──────────────────────────────────────────────────────
+  [
+    "workflow_step",
+    {
+      schema: WorkflowStepSchema,
+      synonyms: {
+        label: ["title", "name"],
+        message: ["description"],
+        "theme.variant": ["style"],
+        "on_submit.transition": ["transitions"]
+      },
+      phaseAffinity: ["workflow"]
+    }
+  ],
+  [
+    "workflow_definition",
+    {
+      schema: WorkflowDefinitionSchema,
+      synonyms: {
+        label: ["title", "name"],
+        id: ["type"]
+      },
+      phaseAffinity: ["workflow"]
+    }
+  ],
+  [
+    "workflow_field",
+    {
+      schema: WorkflowFieldSchema,
+      synonyms: {
+        name: ["id"],
+        label: ["title", "description"]
+      },
+      phaseAffinity: ["workflow"]
+    }
+  ],
+  [
+    "workflow_action",
+    {
+      schema: WorkflowActionSchema,
+      synonyms: {
+        label: ["title", "name"],
+        transition: ["then"],
+        "theme.variant": ["style"],
+        action: ["on_click"]
+      },
+      phaseAffinity: ["workflow"]
+    }
+  ],
+  // ── Navigation ────────────────────────────────────────────────────────────
+  [
+    "navigation_item",
+    {
+      schema: NavigationItemSchema,
+      synonyms: {
+        items: ["children"],
+        section: ["label", "title"]
+      },
+      phaseAffinity: ["pages", "dashboard", "polish"]
+    }
+  ],
+  // ── Auth ──────────────────────────────────────────────────────────────────
+  [
+    "auth_config",
+    {
+      schema: authConfigSchema,
+      synonyms: {
+        type: ["method", "provider_type", "strategy"]
+      },
+      phaseAffinity: ["auth"]
+    }
+  ],
+  // ── Pulse content types ───────────────────────────────────────────────────
+  [
+    "metric_card_pulse",
+    {
+      schema: MetricCardPulseSchema,
+      synonyms: {
+        field: ["valueField", "valuePath", "dataField", "value"]
+      },
+      phaseAffinity: ["dashboard", "pages"]
+    }
+  ],
+  [
+    "data_table_pulse",
+    {
+      schema: DataTablePulseSchema,
+      synonyms: {
+        header: ["label"],
+        type: ["renderAs"],
+        colorMap: ["severityMap"]
+      },
+      phaseAffinity: ["dashboard", "pages"]
+    }
+  ],
+  [
+    "status_badge_pulse",
+    {
+      schema: StatusBadgePulseSchema,
+      synonyms: {},
+      phaseAffinity: ["dashboard", "pages"]
+    }
+  ],
+  [
+    "map_pulse",
+    {
+      schema: MapPulseSchema,
+      synonyms: {},
+      phaseAffinity: ["geo", "dashboard", "pages"]
+    }
+  ],
+  // ── Workflow container page content type (swp-dvde) ───────────────────────
+  [
+    "workflow_wizard",
+    {
+      schema: WorkflowWizardContentSchema,
+      synonyms: {
+        workflowFile: ["workflowPath", "file", "path", "yamlFile"],
+        workflowId: ["id", "workflowName", "name"],
+        persistenceKey: ["stateKey", "storageKey"]
+      },
+      phaseAffinity: ["workflow"]
+    }
+  ],
+  // ── Theme schemas (swp-cxwu) ──────────────────────────────────────────────
+  [
+    "theme_tokens",
+    {
+      schema: themeTokensFileSchema,
+      synonyms: {},
+      phaseAffinity: ["theme"]
+    }
+  ],
+  [
+    "theme_status_token",
+    {
+      // No static schema — this is a project-specific runtime enum.
+      // Call getSchemaForEntry(entry, { projectRoot }) to get the project's ladder.
+      schemaFactory: buildThemeStatusTokenSchema,
+      synonyms: {},
+      phaseAffinity: ["pages", "dashboard", "geo"]
+    }
+  ]
+]);
+var SCHEMA_REGISTRY = REGISTRY;
+var REGISTRY_SCHEMA_NAMES = Array.from(REGISTRY.keys());
+function buildReverseSynonyms(synonyms) {
+  const reverse = {};
+  for (const [correct, wrongs] of Object.entries(synonyms)) {
+    for (const wrong of wrongs) {
+      reverse[wrong] = correct;
+    }
+  }
+  return reverse;
+}
+function buildPhaseSchemaNames() {
+  const phaseMap = {};
+  for (const [name, entry] of REGISTRY.entries()) {
+    for (const phase of entry.phaseAffinity ?? []) {
+      if (!phaseMap[phase]) phaseMap[phase] = [];
+      phaseMap[phase].push(name);
+    }
+  }
+  return phaseMap;
+}
+
+// src/tools/validate-theme-tokens.ts
+var COLOR_FIELD_KEYS = /* @__PURE__ */ new Set([
+  "color",
+  "colorMap",
+  "layerColor",
+  "borderColor",
+  "backgroundColor",
+  "iconColor",
+  "fill",
+  "stroke",
+  "markerColor",
+  "fillColor",
+  "outlineColor",
+  "statusColor",
+  "badgeColor",
+  "tagColor"
+]);
+var LEGACY_OSS_TOKENS = /* @__PURE__ */ new Set(["success", "warning", "danger", "info", "muted"]);
+var LEGACY_MAPPING_HINT = "Suggested mapping: success->status-safe, warning->status-warning, danger->status-critical, info->status-watch, muted->status-at-risk.";
+var HEX_RE = /^#[0-9a-f]{3,8}$/i;
+var STATUS_TOKEN_RE = /^status-[a-z0-9-]+$/;
+function walkYaml(node, fieldName, pathParts, inColorContext, visitor) {
+  if (typeof node === "string") {
+    visitor(node, fieldName, pathParts.join(".") || "(root)", inColorContext);
+    return;
+  }
+  if (Array.isArray(node)) {
+    node.forEach((item, idx) => {
+      walkYaml(item, fieldName, [...pathParts, `[${idx}]`], inColorContext, visitor);
+    });
+    return;
+  }
+  if (node !== null && typeof node === "object") {
+    for (const [key, val] of Object.entries(node)) {
+      const thisIsColorField = COLOR_FIELD_KEYS.has(key);
+      walkYaml(val, key, [...pathParts, key], inColorContext || thisIsColorField, visitor);
+    }
+  }
+}
+function detectViolationsInYaml(yamlContent, ladder, ladderSet, relPath) {
+  const violations = [];
+  walkYaml(yamlContent, null, [], false, (value, fieldName, path5, inColorContext) => {
+    const isColorField = inColorContext || fieldName !== null && COLOR_FIELD_KEYS.has(fieldName);
+    if (STATUS_TOKEN_RE.test(value) && !ladderSet.has(value)) {
+      violations.push({
+        type: "undefined_token",
+        message: `Undefined theme token: "${value}" not in declared theme ladder. Declared tokens: ${ladder.join(", ")}`,
+        file: relPath,
+        path: path5,
+        value
+      });
+      return;
+    }
+    if (!isColorField) return;
+    if (HEX_RE.test(value)) {
+      violations.push({
+        type: "raw_hex",
+        message: `Raw hex color "${value}" in color field "${fieldName ?? "<color context>"}". Use declared theme tokens instead. Available: ${ladder.join(", ")}`,
+        file: relPath,
+        path: path5,
+        value
+      });
+      return;
+    }
+    if (LEGACY_OSS_TOKENS.has(value)) {
+      violations.push({
+        type: "legacy_vocab",
+        message: `Legacy status token "${value}" in color field "${fieldName ?? "<color context>"}". This project's ladder is: ${ladder.join(", ")}. ` + LEGACY_MAPPING_HINT,
+        file: relPath,
+        path: path5,
+        value
+      });
+    }
+  });
+  return violations;
+}
+function findContentFiles(pagesRoot) {
+  if (!existsSync7(pagesRoot)) return [];
+  const files = [];
+  try {
+    const slugDirs = readdirSync3(pagesRoot, { withFileTypes: true });
+    for (const entry of slugDirs) {
+      if (!entry.isDirectory()) continue;
+      const slugDir = join6(pagesRoot, entry.name);
+      for (const candidate of ["content.yml", "content.yaml"]) {
+        const p = join6(slugDir, candidate);
+        if (existsSync7(p)) files.push(p);
+      }
+    }
+  } catch {
+  }
+  return files;
+}
+function validateThemeTokenUsage(projectRoot) {
+  const ladder = resolveStatusLadder(projectRoot);
+  if (ladder.length === 0) {
+    return {
+      valid: true,
+      violations: [],
+      skipped: true
+    };
+  }
+  const ladderSet = new Set(ladder);
+  const pagesRoot = join6(projectRoot, "pages");
+  const contentFiles = findContentFiles(pagesRoot);
+  const allViolations = [];
+  for (const absPath of contentFiles) {
+    const relPath = relative2(projectRoot, absPath);
+    try {
+      const raw = readFileSync6(absPath, "utf-8");
+      const parsed = yamlLoad2(raw);
+      const fileViolations = detectViolationsInYaml(parsed, ladder, ladderSet, relPath);
+      allViolations.push(...fileViolations);
+    } catch {
+    }
+  }
+  if (allViolations.length === 0) {
+    return { valid: true, violations: [] };
+  }
+  const lines = [
+    `Theme token enforcement found ${allViolations.length} violation(s):`,
+    "",
+    ...allViolations.map((v, i) => {
+      const typeLabel = v.type === "undefined_token" ? "UNDEFINED TOKEN" : v.type === "raw_hex" ? "RAW HEX" : "LEGACY VOCAB";
+      return `  ${i + 1}. [${typeLabel}] ${v.message}
+     Emitted in: ${v.file} at ${v.path}`;
+    }),
+    "",
+    `Fix all violations to use declared theme tokens: ${ladder.join(", ")}`
+  ];
+  return {
+    valid: false,
+    violations: allViolations,
+    retryPrompt: lines.join("\n")
+  };
+}
+
+// src/tools/validate-build-context-globals.ts
+import { existsSync as existsSync8, readFileSync as readFileSync7, readdirSync as readdirSync4 } from "fs";
+import { join as join7, relative as relative3 } from "path";
+import { load as yamlLoad3 } from "js-yaml";
+var DATA_WIDGET_TYPES = /* @__PURE__ */ new Set([
+  "data_table_pulse",
+  "stats_grid",
+  "metric_card_pulse",
+  "map_pulse"
+]);
+function readGlobalDefaults(projectRoot) {
+  const bcPath = join7(projectRoot, ".stackwright", "build-context.json");
+  if (!existsSync8(bcPath)) return null;
+  try {
+    const raw = readFileSync7(bcPath, "utf-8");
+    const parsed = JSON.parse(raw);
+    const gd = parsed.globalDefaults;
+    if (!gd || typeof gd !== "object") return null;
+    return gd;
+  } catch {
+    return null;
+  }
+}
+function findDataWidgets(node, pathParts, out) {
+  if (node === null || node === void 0 || typeof node !== "object") return;
+  if (Array.isArray(node)) {
+    node.forEach((item, idx) => {
+      findDataWidgets(item, [...pathParts, `[${idx}]`], out);
+    });
+    return;
+  }
+  const obj = node;
+  const contentType = typeof obj["type"] === "string" ? obj["type"] : null;
+  if (contentType && DATA_WIDGET_TYPES.has(contentType)) {
+    out.push({
+      type: contentType,
+      label: typeof obj["label"] === "string" ? obj["label"] : void 0,
+      data: obj,
+      path: pathParts.join(".") || "(root)"
+    });
+  }
+  for (const [key, val] of Object.entries(obj)) {
+    findDataWidgets(val, [...pathParts, key], out);
+  }
+}
+function findContentFiles2(pagesRoot) {
+  if (!existsSync8(pagesRoot)) return [];
+  const files = [];
+  try {
+    const slugDirs = readdirSync4(pagesRoot, { withFileTypes: true });
+    for (const entry of slugDirs) {
+      if (!entry.isDirectory()) continue;
+      for (const candidate of ["content.yml", "content.yaml"]) {
+        const p = join7(pagesRoot, entry.name, candidate);
+        if (existsSync8(p)) files.push(p);
+      }
+    }
+  } catch {
+  }
+  return files;
+}
+function validateBuildContextGlobals(projectRoot) {
+  const globalDefaults = readGlobalDefaults(projectRoot);
+  if (!globalDefaults) {
+    return { valid: true, violations: [], skipped: true };
+  }
+  const requiredFields = Object.entries(globalDefaults).filter(([, v]) => v === true).map(([k]) => k);
+  if (requiredFields.length === 0) {
+    return { valid: true, violations: [], skipped: true };
+  }
+  const pagesRoot = join7(projectRoot, "pages");
+  const contentFiles = findContentFiles2(pagesRoot);
+  const allViolations = [];
+  for (const absPath of contentFiles) {
+    const relPath = relative3(projectRoot, absPath);
+    try {
+      const raw = readFileSync7(absPath, "utf-8");
+      const parsed = yamlLoad3(raw);
+      const widgets = [];
+      findDataWidgets(parsed, [], widgets);
+      for (const widget of widgets) {
+        for (const field of requiredFields) {
+          if (widget.data[field] !== true) {
+            allViolations.push({
+              field,
+              widgetType: widget.type,
+              widgetLabel: widget.label,
+              file: relPath,
+              path: widget.path
+            });
+          }
+        }
+      }
+    } catch {
+    }
+  }
+  if (allViolations.length === 0) {
+    return { valid: true, violations: [] };
+  }
+  const lines = [
+    `BUILD_CONTEXT global defaults: ${allViolations.length} violation(s) found.`,
+    "",
+    ...allViolations.map((v, i) => {
+      const widgetId = v.widgetLabel ? `"${v.widgetLabel}" (${v.widgetType})` : `${v.widgetType}`;
+      return `  ${i + 1}. BUILD_CONTEXT.${v.field} is globally true but widget ${widgetId} omits it.
+     Set ${v.field}: true on this widget.
+     Emitted in: ${v.file} at ${v.path}`;
+    }),
+    "",
+    `Required global defaults: ${requiredFields.map((f) => `${f}: true`).join(", ")}`
+  ];
+  return {
+    valid: false,
+    violations: allViolations,
+    retryPrompt: lines.join("\n")
+  };
+}
+
+// src/tools/validate-workflow-container-pages.ts
+import { existsSync as existsSync9, readFileSync as readFileSync8, readdirSync as readdirSync5 } from "fs";
+import { join as join8 } from "path";
+import { load as yamlLoad4 } from "js-yaml";
+function discoverWorkflowIds(projectRoot) {
+  const artifactsDir = join8(projectRoot, ".stackwright", "artifacts");
+  if (!existsSync9(artifactsDir)) return [];
+  const entries = [];
+  let files;
+  try {
+    files = readdirSync5(artifactsDir);
+  } catch {
+    return [];
+  }
+  for (const filename of files) {
+    if (filename !== "workflow-config.json" && !filename.startsWith("workflow-config-")) continue;
+    if (!filename.endsWith(".json")) continue;
+    const fullPath = join8(artifactsDir, filename);
+    try {
+      const raw = JSON.parse(readFileSync8(fullPath, "utf-8"));
+      const workflowData = raw["workflow"] ?? raw["workflowConfig"];
+      const workflowId = typeof workflowData?.["id"] === "string" ? workflowData["id"] : null;
+      if (workflowId && /^[a-z0-9-]+$/.test(workflowId)) {
+        entries.push({ workflowId, sourceFile: filename });
+      }
+    } catch {
+    }
+  }
+  return entries;
+}
+function hasWorkflowWizardType(filePath) {
+  try {
+    const raw = readFileSync8(filePath, "utf-8");
+    const parsed = yamlLoad4(raw);
+    if (!parsed) return false;
+    const content = parsed["content"];
+    if (!content) return false;
+    const items = content["content_items"];
+    if (!Array.isArray(items)) return false;
+    return items.some((item) => item["type"] === "workflow_wizard");
+  } catch {
+    return false;
+  }
+}
+function validateWorkflowContainerPages(projectRoot) {
+  const workflows = discoverWorkflowIds(projectRoot);
+  if (workflows.length === 0) {
+    return { valid: true, violations: [], skipped: true };
+  }
+  const violations = [];
+  for (const { workflowId, sourceFile: _sourceFile } of workflows) {
+    const expectedPath = `pages/workflows/${workflowId}/content.yml`;
+    const fullPath = join8(projectRoot, expectedPath);
+    if (!existsSync9(fullPath)) {
+      violations.push({ workflowId, expectedPath, reason: "missing-file" });
+      continue;
+    }
+    if (!hasWorkflowWizardType(fullPath)) {
+      violations.push({ workflowId, expectedPath, reason: "missing-workflow-wizard-type" });
+    }
+  }
+  if (violations.length === 0) {
+    return { valid: true, violations: [] };
+  }
+  const lines = [
+    `Workflow container page cross-check failed: ${violations.length} workflow(s) missing container pages.`,
+    "",
+    ...violations.map((v, i) => {
+      const reason = v.reason === "missing-file" ? `File does not exist. Create it via stackwright_pro_write_workflow_container_page.` : `File exists but has no workflow_wizard content item. Must contain type: workflow_wizard.`;
+      return `  ${i + 1}. workflowId "${v.workflowId}"
+     Expected: ${v.expectedPath}
+     Issue: ${reason}`;
+    }),
+    "",
+    "Fix: workflow-otter must call stackwright_pro_write_workflow_container_page immediately",
+    "after writing each workflow YAML. Required args:",
+    '  { workflowId, workflowFile, pageSlug: "workflows/<workflowId>", label, requiredRoles }',
+    "",
+    "Without the container page, the route 404s and auth-reconcile cannot protect it."
+  ];
+  return {
+    valid: false,
+    violations,
+    retryPrompt: lines.join("\n")
+  };
+}
+
 // src/tools/validate-api-integration.ts
 var CANONICAL_API_AUTH_TYPES = ["apiKey", "bearer", "oauth2", "oidc", "none"];
 var CANONICAL_SET = new Set(CANONICAL_API_AUTH_TYPES);
@@ -2743,9 +3338,9 @@ function validateAuthConfig(artifact, artifactPath) {
 }
 
 // src/tools/auth-manifest-aggregator.ts
-import { existsSync as existsSync6, readFileSync as readFileSync5, readdirSync as readdirSync3 } from "fs";
-import { join as join5 } from "path";
-import { z as z11 } from "zod";
+import { existsSync as existsSync10, readFileSync as readFileSync9, readdirSync as readdirSync6 } from "fs";
+import { join as join9 } from "path";
+import { z as z12 } from "zod";
 function computeLowestRole(requiredRoles, rbacRoles) {
   let lowestIndex = -1;
   let lowestRole = requiredRoles[0];
@@ -2765,17 +3360,17 @@ function extractPatternBaseSlug(pattern) {
 }
 function extractManifestSlugs(artifactsDir) {
   const slugs = /* @__PURE__ */ new Set();
-  if (!existsSync6(artifactsDir)) return slugs;
+  if (!existsSync10(artifactsDir)) return slugs;
   let entries;
   try {
-    entries = readdirSync3(artifactsDir);
+    entries = readdirSync6(artifactsDir);
   } catch {
     return slugs;
   }
   for (const entry of entries) {
     if (!entry.endsWith("-manifest.json")) continue;
     try {
-      const content = JSON.parse(readFileSync5(join5(artifactsDir, entry), "utf-8"));
+      const content = JSON.parse(readFileSync9(join9(artifactsDir, entry), "utf-8"));
       const pages = content.pages;
       if (!Array.isArray(pages)) continue;
       for (const page of pages) {
@@ -2818,18 +3413,18 @@ function deriveProtectedRoutes(pages, rbacRoles) {
 }
 function readAllManifestPages(artifactsDir) {
   const allPages = [];
-  if (!existsSync6(artifactsDir)) return allPages;
+  if (!existsSync10(artifactsDir)) return allPages;
   let entries;
   try {
-    entries = readdirSync3(artifactsDir);
+    entries = readdirSync6(artifactsDir);
   } catch {
     return allPages;
   }
   for (const entry of entries) {
     if (entry.endsWith("-manifest.json")) {
-      const filePath = join5(artifactsDir, entry);
+      const filePath = join9(artifactsDir, entry);
       try {
-        const raw = JSON.parse(readFileSync5(filePath, "utf-8"));
+        const raw = JSON.parse(readFileSync9(filePath, "utf-8"));
         if (!Array.isArray(raw.pages)) continue;
         for (const page of raw.pages) {
           if (typeof page.slug !== "string" || !page.slug) continue;
@@ -2845,9 +3440,9 @@ function readAllManifestPages(artifactsDir) {
       continue;
     }
     if (entry === "workflow-config.json" || entry.startsWith("workflow-config-")) {
-      const filePath = join5(artifactsDir, entry);
+      const filePath = join9(artifactsDir, entry);
       try {
-        const raw = JSON.parse(readFileSync5(filePath, "utf-8"));
+        const raw = JSON.parse(readFileSync9(filePath, "utf-8"));
         const route = raw.workflow?.route;
         if (typeof route !== "string" || !route) continue;
         const slug = route.startsWith("/") ? route.slice(1) : route;
@@ -2869,16 +3464,16 @@ function registerReadAuthManifestsTool(server2) {
     "stackwright_pro_read_auth_manifests",
     "Read ALL route-producing artifacts from the pipeline artifacts directory: *-manifest.json files (pages, dashboard, geo, form-wizard) AND workflow-config.json / workflow-config-*.json (different shape: workflow.route). Deterministically derives protectedRoutes and uncoveredSlugs. Uses the both-forms invariant (swp-n7kk): every authRequired route registers BOTH /{slug} (exact) AND /{slug}/:path* (sub-path). Workflow routes appear in uncoveredSlugs (no requiredRoles declared) for auth-reconcile to resolve via cross-cutting rules from auth-config.json. Extended by swp-hng0 to cover all four manifest types (was: pages+dashboard only).",
     {
-      rbacRoles: z11.array(z11.string()).describe(
+      rbacRoles: z12.array(z12.string()).describe(
         'RBAC role hierarchy in descending privilege order, e.g. ["ESF8_COORDINATOR", "HOSPITAL_EM", "OBSERVER"]. Used to compute the lowestRole for each authRequired page.'
       ),
-      artifactsDir: z11.string().optional().describe(
+      artifactsDir: z12.string().optional().describe(
         "Absolute or relative path to the pipeline artifacts directory. Defaults to .stackwright/artifacts relative to cwd."
       )
     },
     (params) => {
       const cwd = process.cwd();
-      const artifactsDir = params.artifactsDir ? params.artifactsDir : join5(cwd, ".stackwright", "artifacts");
+      const artifactsDir = params.artifactsDir ? params.artifactsDir : join9(cwd, ".stackwright", "artifacts");
       const allPages = readAllManifestPages(artifactsDir);
       const { protectedRoutes, uncoveredSlugs } = deriveProtectedRoutes(allPages, params.rbacRoles);
       const manifestsRead = [...new Set(allPages.map((p) => p.source))].sort();
@@ -2901,195 +3496,11 @@ function registerReadAuthManifestsTool(server2) {
 }
 
 // src/tools/pipeline.ts
-import { WorkflowFileSchema, authConfigSchema as authConfigSchema3 } from "@stackwright-pro/types";
+import { WorkflowFileSchema, authConfigSchema as authConfigSchema2 } from "@stackwright-pro/types";
 
 // src/tools/get-schema.ts
 import { z as z13 } from "zod";
-import {
-  WorkflowStepSchema as WorkflowStepSchema2,
-  WorkflowDefinitionSchema as WorkflowDefinitionSchema2,
-  WorkflowFieldSchema as WorkflowFieldSchema2,
-  WorkflowActionSchema as WorkflowActionSchema2,
-  authConfigSchema as authConfigSchema2
-} from "@stackwright-pro/types";
-
-// src/tools/validate-yaml-fragment.ts
-import { z as z12 } from "zod";
-import { load as yamlLoad2 } from "js-yaml";
-import {
-  WorkflowStepSchema,
-  WorkflowDefinitionSchema,
-  WorkflowFieldSchema,
-  WorkflowActionSchema,
-  authConfigSchema
-} from "@stackwright-pro/types";
-var SUPPORTED_SCHEMA_NAMES = [
-  "workflow_step",
-  "workflow_definition",
-  "workflow_field",
-  "workflow_action",
-  "navigation_item",
-  "auth_config"
-];
-var NavigationLinkSchema = z12.lazy(
-  () => z12.object({
-    label: z12.string().min(1),
-    href: z12.string().min(1),
-    children: z12.array(NavigationLinkSchema).optional()
-  })
-);
-var NavigationSectionSchema = z12.object({
-  section: z12.string().min(1),
-  items: z12.array(NavigationLinkSchema)
-});
-var NavigationItemSchema = z12.union([
-  NavigationLinkSchema,
-  NavigationSectionSchema
-]);
-var FIELD_SYNONYMS = {
-  workflow_step: {
-    title: "label",
-    name: "label (at step level, use label: not name:)",
-    description: "message (use message: for step-level descriptive text)",
-    style: 'theme.variant \u2014 use theme: { variant: "primary" } not style: "primary"',
-    transitions: 'on_submit.transition \u2014 use on_submit: { transition: "next_step" } not transitions: [{then:...}]'
-  },
-  workflow_definition: {
-    title: "label",
-    name: "label (workflow-level label, not name:)",
-    description: "description is valid here \u2014 but message: is not (that is a step field)",
-    type: "id (workflows are identified by id:, not type:)"
-  },
-  workflow_field: {
-    id: "name (field-level identifier is name:, NOT id:)",
-    title: "label (field display text is label:, NOT title:)",
-    description: "placeholder or label (no description field on WorkflowField)"
-  },
-  workflow_action: {
-    style: 'theme.variant \u2014 use theme: { variant: "primary" } not style: "primary"',
-    then: "transition (action-level next-step is transition:, NOT then:)",
-    on_click: 'action: "service:..." (extract the service reference from on_click.action)',
-    title: "label (action display text is label:, NOT title:)",
-    name: "label (action display text is label:, NOT name:)"
-  },
-  navigation_item: {
-    children: "items (NavigationSection uses items: not children: \u2014 also use section: instead of label: for section headers)",
-    label: 'section (if this is a nav group/section, use section: "Title" and items: [...], not label:)',
-    title: "section (NavigationSection header field is section:, NOT title:)"
-  },
-  auth_config: {
-    method: 'type \u2014 auth config discriminates on type: "oidc" | "pki", NOT method:',
-    provider_type: 'type \u2014 use type: "oidc" or type: "pki"',
-    strategy: "type \u2014 top-level discriminator is type:, not strategy:"
-  }
-};
-function getSchema(name) {
-  switch (name) {
-    case "workflow_step":
-      return WorkflowStepSchema;
-    case "workflow_definition":
-      return WorkflowDefinitionSchema;
-    case "workflow_field":
-      return WorkflowFieldSchema;
-    case "workflow_action":
-      return WorkflowActionSchema;
-    case "navigation_item":
-      return NavigationItemSchema;
-    case "auth_config":
-      return authConfigSchema;
-  }
-}
-function enrichErrors(issues, synonyms) {
-  return issues.map((issue) => {
-    const pathStr = issue.path.join(".");
-    const lastSegment = issue.path[issue.path.length - 1];
-    const fieldName = typeof lastSegment === "string" ? lastSegment : void 0;
-    const didYouMean = fieldName ? synonyms[fieldName] : void 0;
-    return {
-      path: pathStr || "(root)",
-      message: issue.message,
-      ...didYouMean ? { didYouMean } : {}
-    };
-  });
-}
-function handleValidateYamlFragment(input) {
-  const { schemaName, yaml: yaml4 } = input;
-  if (!SUPPORTED_SCHEMA_NAMES.includes(schemaName)) {
-    return {
-      valid: false,
-      parseError: `Unknown schemaName: "${schemaName}". Supported: ${SUPPORTED_SCHEMA_NAMES.join(", ")}`
-    };
-  }
-  const name = schemaName;
-  let parsed;
-  try {
-    parsed = yamlLoad2(yaml4);
-  } catch (err) {
-    return {
-      valid: false,
-      parseError: `YAML parse error: ${err instanceof Error ? err.message : String(err)}`
-    };
-  }
-  const schema = getSchema(name);
-  const result = schema.safeParse(parsed);
-  if (result.success) {
-    return { valid: true };
-  }
-  const synonyms = FIELD_SYNONYMS[name];
-  const errors = enrichErrors(result.error.issues, synonyms);
-  return { valid: false, errors };
-}
-function registerValidateYamlFragmentTool(server2) {
-  server2.tool(
-    "stackwright_pro_validate_yaml_fragment",
-    'Validates a YAML snippet against a canonical Zod schema before writing to disk. Returns actionable errors with "did you mean?" suggestions for common field-name drift (title vs label, id vs name, style vs theme.variant, etc.). Call this before stackwright_pro_safe_write to catch schema violations in-session.',
-    {
-      schemaName: z12.enum(SUPPORTED_SCHEMA_NAMES).describe(
-        "Schema to validate against. One of: workflow_step, workflow_definition, workflow_field, workflow_action, navigation_item, auth_config"
-      ),
-      yaml: z12.string().describe("YAML string to validate (can also be JSON \u2014 js-yaml parses both)")
-    },
-    async ({ schemaName, yaml: yaml4 }) => {
-      const result = handleValidateYamlFragment({ schemaName, yaml: yaml4 });
-      return {
-        content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
-      };
-    }
-  );
-}
-
-// src/tools/get-schema.ts
-var NavigationLinkSchema2 = z13.lazy(
-  () => z13.object({
-    label: z13.string().min(1),
-    href: z13.string().min(1),
-    children: z13.array(NavigationLinkSchema2).optional()
-  })
-);
-var NavigationSectionSchema2 = z13.object({
-  section: z13.string().min(1),
-  items: z13.array(NavigationLinkSchema2)
-});
-var NavigationItemSchema2 = z13.union([
-  NavigationLinkSchema2,
-  NavigationSectionSchema2
-]);
-function getZodSchema(name) {
-  switch (name) {
-    case "workflow_step":
-      return WorkflowStepSchema2;
-    case "workflow_definition":
-      return WorkflowDefinitionSchema2;
-    case "workflow_field":
-      return WorkflowFieldSchema2;
-    case "workflow_action":
-      return WorkflowActionSchema2;
-    case "navigation_item":
-      return NavigationItemSchema2;
-    case "auth_config":
-      return authConfigSchema2;
-  }
-}
+var PHASE_SCHEMA_NAMES = buildPhaseSchemaNames();
 function formatType(node, depth = 0) {
   if (node.const !== void 0) return JSON.stringify(node.const);
   if (node.enum) return node.enum.map((v) => JSON.stringify(v)).join(" | ");
@@ -3116,7 +3527,7 @@ function formatType(node, depth = 0) {
   if (node.maximum !== void 0) constraints.push(`max ${node.maximum}`);
   return constraints.length > 0 ? `${base} (${constraints.join(", ")})` : base;
 }
-function formatObjectSchema(node, schemaName, synonyms) {
+function formatObjectSchema(node, schemaName, reverseSynonyms) {
   const lines = [];
   const displayName = schemaName.split("_").map((w) => w[0].toUpperCase() + w.slice(1)).join("");
   lines.push(`${displayName}:`);
@@ -3130,7 +3541,8 @@ function formatObjectSchema(node, schemaName, synonyms) {
       for (const [field, fieldNode] of Object.entries(branch.properties ?? {})) {
         if (fieldNode.const !== void 0) continue;
         const isRequired = req.has(field);
-        const hint = synonyms[field] ? `  -- WARNING: use ${field}: not ${synonyms[field]}` : "";
+        const correctFor = reverseSynonyms[field];
+        const hint = correctFor ? `  -- WARNING: use ${correctFor}: not ${field}:` : "";
         lines.push(
           `    ${isRequired ? "REQUIRED" : "optional"}: ${field}: ${formatType(fieldNode)}${hint}`
         );
@@ -3138,6 +3550,12 @@ function formatObjectSchema(node, schemaName, synonyms) {
     }
     return lines.join("\n");
   }
+  if (!node.properties && !node.oneOf && !node.anyOf) {
+    const typeStr = formatType(node);
+    lines.push(`  type: ${typeStr}`);
+    if (node.description) lines.push(`  description: ${node.description}`);
+    return lines.join("\n");
+  }
   const required = new Set(node.required ?? []);
   const properties = node.properties ?? {};
   const requiredFields = Object.entries(properties).filter(([k]) => required.has(k));
@@ -3146,8 +3564,7 @@ function formatObjectSchema(node, schemaName, synonyms) {
     lines.push("  REQUIRED:");
     for (const [field, fieldNode] of requiredFields) {
       const typeStr = formatType(fieldNode);
-      const warn = synonyms[field] ? `  -- CAUTION: this schema uses ${field}` : "";
-      lines.push(`    ${field}: ${typeStr}${warn}`);
+      lines.push(`    ${field}: ${typeStr}`);
     }
   }
   if (optionalFields.length > 0) {
@@ -3161,24 +3578,30 @@ function formatObjectSchema(node, schemaName, synonyms) {
 }
 function handleGetSchema(input) {
   const { schemaName } = input;
-  if (!SUPPORTED_SCHEMA_NAMES.includes(schemaName)) {
+  const entry = SCHEMA_REGISTRY.get(schemaName);
+  if (!entry) {
     return {
-      error: `Unknown schemaName: "${schemaName}". Supported: ${SUPPORTED_SCHEMA_NAMES.join(", ")}`
+      error: `Unknown schemaName: "${schemaName}". Supported: ${REGISTRY_SCHEMA_NAMES.join(", ")}`
     };
   }
-  const name = schemaName;
-  const schema = getZodSchema(name);
-  const synonyms = FIELD_SYNONYMS[name];
+  const synonyms = entry.synonyms ?? {};
+  const reverseSynonyms = {};
+  for (const [correct, wrongs] of Object.entries(synonyms)) {
+    for (const wrong of wrongs) {
+      reverseSynonyms[wrong] = correct;
+    }
+  }
+  const ctx = input.projectRoot ? { projectRoot: input.projectRoot } : void 0;
+  const resolvedSchema = getSchemaForEntry(entry, ctx);
   let jsonSchema;
   try {
-    const raw = z13.toJSONSchema(schema, { unrepresentable: "any" });
-    jsonSchema = raw;
+    jsonSchema = z13.toJSONSchema(resolvedSchema, { unrepresentable: "any" });
   } catch {
     jsonSchema = { type: "object", description: "Schema introspection unavailable for this type" };
   }
-  const summary = formatObjectSchema(jsonSchema, name, synonyms);
+  const summary = formatObjectSchema(jsonSchema, schemaName, reverseSynonyms);
   const synonymWarnings = Object.entries(synonyms).map(
-    ([wrong, correct]) => `  WARNING: use "${correct}" \u2014 NOT "${wrong}"`
+    ([correct, wrongs]) => `  WARNING: use "${correct}" \u2014 NOT ${wrongs.map((w) => `"${w}"`).join(" or ")}`
   );
   const fullText = [
     summary,
@@ -3188,19 +3611,12 @@ function handleGetSchema(input) {
   ].join("\n");
   const tokenEstimate = Math.ceil(fullText.length / 4);
   return {
-    schemaName: name,
+    schemaName,
     summary,
     synonymWarnings,
     tokenEstimate
   };
 }
-var PHASE_SCHEMA_NAMES = {
-  workflow: ["workflow_step", "workflow_definition", "workflow_field", "workflow_action"],
-  pages: ["navigation_item"],
-  dashboard: ["navigation_item"],
-  polish: ["navigation_item"],
-  auth: ["auth_config"]
-};
 function buildSchemaReferenceBlock(phase) {
   const schemaNames = PHASE_SCHEMA_NAMES[phase];
   if (!schemaNames || schemaNames.length === 0) return null;
@@ -3225,12 +3641,13 @@ function registerGetSchemaTool(server2) {
     "stackwright_pro_get_schema",
     'Returns a compact, LLM-friendly summary of a canonical schema derived programmatically from Zod. Includes required/optional fields, types, constraints, and "did you mean?" warnings for common field-name drift. Use before authoring YAML to confirm exact field names.',
     {
-      schemaName: z13.enum(SUPPORTED_SCHEMA_NAMES).describe(
-        "Schema to summarize. One of: workflow_step, workflow_definition, workflow_field, workflow_action, navigation_item, auth_config"
+      schemaName: z13.string().describe(`Schema to summarize. Available: ${REGISTRY_SCHEMA_NAMES.join(", ")}`),
+      projectRoot: z13.string().optional().describe(
+        "Absolute path to the project root. Required for factory schemas like theme_status_token. Defaults to cwd."
       )
     },
-    async ({ schemaName }) => {
-      const result = handleGetSchema({ schemaName });
+    async ({ schemaName, projectRoot }) => {
+      const result = handleGetSchema({ schemaName, projectRoot: projectRoot ?? process.cwd() });
       if ("error" in result) {
         return {
           content: [{ type: "text", text: JSON.stringify({ error: result.error }) }],
@@ -3250,8 +3667,8 @@ function registerGetSchemaTool(server2) {
 }
 
 // src/tools/pipeline-graph.ts
-import { readFileSync as readFileSync6, readdirSync as readdirSync4, lstatSync as lstatSync5 } from "fs";
-import { join as join6 } from "path";
+import { readFileSync as readFileSync10, readdirSync as readdirSync7, lstatSync as lstatSync5 } from "fs";
+import { join as join10 } from "path";
 var MANIFEST_NAME_TO_PHASE = {
   "stackwright-pro-designer-otter": "designer",
   "stackwright-pro-theme-otter": "theme",
@@ -3283,8 +3700,8 @@ var OTTER_SEARCH_PATHS = [
 ];
 function resolveOtterDirFromCwd() {
   const cwd = process.cwd();
-  for (const relative2 of OTTER_SEARCH_PATHS) {
-    const candidate = join6(cwd, relative2);
+  for (const relative4 of OTTER_SEARCH_PATHS) {
+    const candidate = join10(cwd, relative4);
     try {
       lstatSync5(candidate);
       return candidate;
@@ -3296,14 +3713,14 @@ function resolveOtterDirFromCwd() {
   );
 }
 function loadOtterManifestsFromDir(otterDir) {
-  const entries = readdirSync4(otterDir);
+  const entries = readdirSync7(otterDir);
   const manifests = [];
   for (const filename of entries) {
     if (!filename.endsWith("-otter.json")) continue;
-    const filePath = join6(otterDir, filename);
+    const filePath = join10(otterDir, filename);
     if (lstatSync5(filePath).isSymbolicLink()) continue;
     try {
-      const raw = readFileSync6(filePath, "utf-8");
+      const raw = readFileSync10(filePath, "utf-8");
       const manifest = JSON.parse(raw);
       manifests.push(manifest);
     } catch (err) {
@@ -3408,19 +3825,19 @@ var DISTRIBUTED_NAMESPACES = ["@stackwright-pro", "@stackwright"];
 function loadDistributedOtterManifests(cwd) {
   const results = [];
   for (const namespace of DISTRIBUTED_NAMESPACES) {
-    const nsDir = join6(cwd, "node_modules", namespace);
+    const nsDir = join10(cwd, "node_modules", namespace);
     let pkgDirNames;
     try {
-      pkgDirNames = readdirSync4(nsDir);
+      pkgDirNames = readdirSync7(nsDir);
     } catch {
       continue;
     }
     for (const pkgDirName of pkgDirNames) {
-      const pkgDir = join6(nsDir, pkgDirName);
+      const pkgDir = join10(nsDir, pkgDirName);
       const packageName = `${namespace}/${pkgDirName}`;
       let otterRelPaths;
       try {
-        const raw = readFileSync6(join6(pkgDir, "package.json"), "utf-8");
+        const raw = readFileSync10(join10(pkgDir, "package.json"), "utf-8");
         const pkgJson = JSON.parse(raw);
         const declared = pkgJson.stackwright?.otters;
         if (!Array.isArray(declared) || declared.length === 0) continue;
@@ -3429,9 +3846,9 @@ function loadDistributedOtterManifests(cwd) {
         continue;
       }
       for (const relPath of otterRelPaths) {
-        const otterFilePath = join6(pkgDir, relPath);
+        const otterFilePath = join10(pkgDir, relPath);
         try {
-          const raw = readFileSync6(otterFilePath, "utf-8");
+          const raw = readFileSync10(otterFilePath, "utf-8");
           const manifest = JSON.parse(raw);
           results.push({ manifest, packageName });
         } catch (err) {
@@ -3576,18 +3993,18 @@ function createDefaultState() {
   };
 }
 function statePath(cwd) {
-  return join7(cwd, ".stackwright", "pipeline-state.json");
+  return join11(cwd, ".stackwright", "pipeline-state.json");
 }
 function readState(cwd) {
   const p = statePath(cwd);
-  if (!existsSync7(p)) return createDefaultState();
+  if (!existsSync11(p)) return createDefaultState();
   const raw = JSON.parse(safeReadSync(p));
   const result = PipelineStateSchema.safeParse(raw);
   if (!result.success) return createDefaultState();
   return result.data;
 }
 function safeWriteSync(filePath, content) {
-  if (existsSync7(filePath)) {
+  if (existsSync11(filePath)) {
     const stat = lstatSync6(filePath);
     if (stat.isSymbolicLink()) {
       throw new Error(`Refusing to write to symlink: ${filePath}`);
@@ -3596,25 +4013,25 @@ function safeWriteSync(filePath, content) {
   writeFileSync4(filePath, content);
 }
 function safeReadSync(filePath) {
-  if (existsSync7(filePath)) {
+  if (existsSync11(filePath)) {
     const stat = lstatSync6(filePath);
     if (stat.isSymbolicLink()) {
       throw new Error(`Refusing to read symlink: ${filePath}`);
     }
   }
-  return readFileSync7(filePath, "utf-8");
+  return readFileSync11(filePath, "utf-8");
 }
 function writeState(cwd, state) {
-  const dir = join7(cwd, ".stackwright");
+  const dir = join11(cwd, ".stackwright");
   mkdirSync4(dir, { recursive: true });
   state.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
   safeWriteSync(statePath(cwd), JSON.stringify(state, null, 2) + "\n");
 }
 function updateStateAtomic(cwd, mutator) {
-  const dir = join7(cwd, ".stackwright");
+  const dir = join11(cwd, ".stackwright");
   mkdirSync4(dir, { recursive: true });
   const path5 = statePath(cwd);
-  if (!existsSync7(path5)) {
+  if (!existsSync11(path5)) {
     safeWriteSync(path5, JSON.stringify(createDefaultState(), null, 2) + "\n");
   }
   const release = lockSync(path5, {
@@ -3648,8 +4065,8 @@ function handleGetPipelineState(_cwd) {
   const cwd = _cwd ?? process.cwd();
   try {
     const state = readState(cwd);
-    const keyPath = join7(cwd, ".stackwright", "pipeline-keys.json");
-    if (!existsSync7(keyPath)) {
+    const keyPath = join11(cwd, ".stackwright", "pipeline-keys.json");
+    if (!existsSync11(keyPath)) {
       try {
         const { fingerprint } = initPipelineKeys(cwd);
         state["signingKeyFingerprint"] = fingerprint;
@@ -3788,8 +4205,8 @@ function handleCheckExecutionReady(_cwd, phase) {
     if (AUTO_EXECUTE_PHASES.has(phase)) {
       return { text: JSON.stringify({ ready: true, phase, autoExecute: true }), isError: false };
     }
-    const answerFile = join7(cwd, ".stackwright", "answers", `${phase}.json`);
-    if (!existsSync7(answerFile)) {
+    const answerFile = join11(cwd, ".stackwright", "answers", `${phase}.json`);
+    if (!existsSync11(answerFile)) {
       return {
         text: JSON.stringify({ ready: false, phase, reason: "Answer file not found" }),
         isError: false
@@ -3813,7 +4230,7 @@ function handleCheckExecutionReady(_cwd, phase) {
     }
   }
   try {
-    const answersDir = join7(cwd, ".stackwright", "answers");
+    const answersDir = join11(cwd, ".stackwright", "answers");
     const answeredPhases = [];
     const missingPhases = [];
     for (const phase2 of PHASE_ORDER) {
@@ -3821,8 +4238,8 @@ function handleCheckExecutionReady(_cwd, phase) {
         answeredPhases.push(phase2);
         continue;
       }
-      const answerFile = join7(answersDir, `${phase2}.json`);
-      if (existsSync7(answerFile)) {
+      const answerFile = join11(answersDir, `${phase2}.json`);
+      if (existsSync11(answerFile)) {
         try {
           const raw = safeReadSync(answerFile);
           const parsed = JSON.parse(raw);
@@ -3891,7 +4308,7 @@ function handleGetReadyPhases(_cwd) {
 function handleListArtifacts(_cwd) {
   const cwd = _cwd ?? process.cwd();
   try {
-    const artifactsDir = join7(cwd, ".stackwright", "artifacts");
+    const artifactsDir = join11(cwd, ".stackwright", "artifacts");
     let manifest = null;
     try {
       manifest = loadSignatureManifest(cwd);
@@ -3901,8 +4318,8 @@ function handleListArtifacts(_cwd) {
     let completedCount = 0;
     for (const phase of PHASE_ORDER) {
       const expectedFile = PHASE_ARTIFACT[phase];
-      const fullPath = join7(artifactsDir, expectedFile);
-      const exists = existsSync7(fullPath);
+      const fullPath = join11(artifactsDir, expectedFile);
+      const exists = existsSync11(fullPath);
       if (exists) completedCount++;
       let signed = false;
       let signatureValid = null;
@@ -3955,9 +4372,9 @@ function handleWritePhaseQuestions(input) {
       }
     } catch {
     }
-    const questionsDir = join7(cwd, ".stackwright", "questions");
+    const questionsDir = join11(cwd, ".stackwright", "questions");
     mkdirSync4(questionsDir, { recursive: true });
-    const filePath = join7(questionsDir, `${phase}.json`);
+    const filePath = join11(questionsDir, `${phase}.json`);
     const payload = {
       version: "1.0",
       phase,
@@ -3997,14 +4414,14 @@ function handleBuildSpecialistPrompt(input) {
     };
   }
   try {
-    const answersPath = join7(cwd, ".stackwright", "answers", `${phase}.json`);
+    const answersPath = join11(cwd, ".stackwright", "answers", `${phase}.json`);
     let answers = {};
-    if (existsSync7(answersPath)) {
+    if (existsSync11(answersPath)) {
       answers = JSON.parse(safeReadSync(answersPath));
     }
     let buildContextText = "";
-    const buildContextPath = join7(cwd, ".stackwright", "build-context.json");
-    if (existsSync7(buildContextPath)) {
+    const buildContextPath = join11(cwd, ".stackwright", "build-context.json");
+    if (existsSync11(buildContextPath)) {
       try {
         const bcRaw = JSON.parse(safeReadSync(buildContextPath));
         if (typeof bcRaw.buildContext === "string" && bcRaw.buildContext.trim().length > 0) {
@@ -4019,8 +4436,8 @@ function handleBuildSpecialistPrompt(input) {
     const missingDependencies = [];
     for (const dep of deps) {
       const artifactFile = PHASE_ARTIFACT[dep];
-      const artifactPath = join7(cwd, ".stackwright", "artifacts", artifactFile);
-      if (existsSync7(artifactPath)) {
+      const artifactPath = join11(cwd, ".stackwright", "artifacts", artifactFile);
+      if (existsSync11(artifactPath)) {
         const rawContent = safeReadSync(artifactPath);
         const rawBytes = Buffer.from(rawContent, "utf-8");
         const content = JSON.parse(rawContent);
@@ -4085,8 +4502,8 @@ ${JSON.stringify(content, null, 2)}`
       parts.push("BUILD_CONTEXT:", buildContextText, "");
     }
     if (phase === "auth") {
-      const initContextPath = join7(cwd, ".stackwright", "init-context.json");
-      if (existsSync7(initContextPath)) {
+      const initContextPath = join11(cwd, ".stackwright", "init-context.json");
+      if (existsSync11(initContextPath)) {
         try {
           const initContext = JSON.parse(safeReadSync(initContextPath));
           if (initContext.devOnly === true || initContext.nonInteractive === true) {
@@ -4227,7 +4644,12 @@ var PHASE_ARTIFACT_SCHEMA = {
         "--surface": "210 40% 98%",
         "--border": "214.3 31.8% 91.4%"
       },
-      dark: { "--background": "222.2 84% 4.9%", "--foreground": "210 40% 98%" }
+      dark: { "--background": "222.2 84% 4.9%", "--foreground": "210 40% 98%" },
+      // Optional — include when design language has status semantics (swp-cxwu).
+      // Array of status-* token names emitted in tokens.colors.
+      // Consumed by validate_artifact theme enforcement to reject unknown status tokens.
+      // OMIT if project has no status-coded data.
+      statusLadder: ["status-ok", "status-warning", "status-error", "status-info"]
     },
     null,
     2
@@ -4665,7 +5087,7 @@ function _validateArtifactInner(input) {
     auth: (artifact2) => {
       const authConfig = artifact2["authConfig"];
       if (!authConfig) return { success: true };
-      const result = authConfigSchema3.safeParse(authConfig);
+      const result = authConfigSchema2.safeParse(authConfig);
       if (!result.success) {
         const issues = result.error.issues.slice(0, 3).map((i) => `${i.path.join(".")}: ${i.message}`).join("; ");
         return { success: false, error: { message: issues } };
@@ -4697,21 +5119,21 @@ function _validateArtifactInner(input) {
     // state-machine in this services-config artifact.
     // Skips gracefully when wizard-otter didn't run (Pro-only install) or declared no hooks.
     services: (artifact2) => {
-      const artifactsDir = join7(cwd, ".stackwright", "artifacts");
+      const artifactsDir = join11(cwd, ".stackwright", "artifacts");
       const workflowArtifactFiles = [];
-      if (existsSync7(artifactsDir)) {
+      if (existsSync11(artifactsDir)) {
         try {
-          const entries = readdirSync5(artifactsDir);
+          const entries = readdirSync8(artifactsDir);
           for (const entry of entries) {
             if (entry.startsWith("workflow-config-") && entry.endsWith(".json")) {
-              workflowArtifactFiles.push(join7(artifactsDir, entry));
+              workflowArtifactFiles.push(join11(artifactsDir, entry));
             }
           }
         } catch {
         }
       }
-      const legacyPath = join7(artifactsDir, "workflow-config.json");
-      if (existsSync7(legacyPath)) {
+      const legacyPath = join11(artifactsDir, "workflow-config.json");
+      if (existsSync11(legacyPath)) {
         workflowArtifactFiles.push(legacyPath);
       }
       if (workflowArtifactFiles.length === 0) {
@@ -4720,7 +5142,7 @@ function _validateArtifactInner(input) {
       const declaredHooks = [];
       for (const filePath of workflowArtifactFiles) {
         try {
-          const parsed = JSON.parse(readFileSync7(filePath, "utf-8"));
+          const parsed = JSON.parse(readFileSync11(filePath, "utf-8"));
           if (Array.isArray(parsed.serviceHooks)) {
             declaredHooks.push(...parsed.serviceHooks);
           }
@@ -4810,6 +5232,42 @@ function _validateArtifactInner(input) {
       return { text: JSON.stringify(result), isError: false };
     }
   }
+  if (phase === "pages" || phase === "dashboard" || phase === "geo") {
+    const themeResult = validateThemeTokenUsage(cwd);
+    if (!themeResult.valid && !themeResult.skipped) {
+      const result = {
+        valid: false,
+        phase,
+        violation: "schema-mismatch",
+        retryPrompt: themeResult.retryPrompt
+      };
+      return { text: JSON.stringify(result), isError: false };
+    }
+  }
+  if (phase === "pages" || phase === "dashboard" || phase === "geo") {
+    const globalsResult = validateBuildContextGlobals(cwd);
+    if (!globalsResult.valid && !globalsResult.skipped) {
+      const result = {
+        valid: false,
+        phase,
+        violation: "schema-mismatch",
+        retryPrompt: globalsResult.retryPrompt
+      };
+      return { text: JSON.stringify(result), isError: false };
+    }
+  }
+  if (phase === "pages") {
+    const workflowCrossCheck = validateWorkflowContainerPages(cwd);
+    if (!workflowCrossCheck.valid) {
+      const result = {
+        valid: false,
+        phase,
+        violation: "schema-mismatch",
+        retryPrompt: workflowCrossCheck.retryPrompt
+      };
+      return { text: JSON.stringify(result), isError: false };
+    }
+  }
   if (phase === "api") {
     const apiAuthResult = validateApiIntegration(artifact, input.integrationName);
     if (!apiAuthResult.valid) {
@@ -4838,7 +5296,7 @@ function _validateArtifactInner(input) {
     const authCfg = artifact["authConfig"];
     const routes = authCfg?.["protectedRoutes"];
     if (Array.isArray(routes) && routes.length > 0) {
-      const artifactsDir = join7(cwd, ".stackwright", "artifacts");
+      const artifactsDir = join11(cwd, ".stackwright", "artifacts");
       const knownSlugs = extractManifestSlugs(artifactsDir);
       const orphanPatterns = [];
       for (const route of routes) {
@@ -4855,10 +5313,10 @@ function _validateArtifactInner(input) {
     }
   }
   try {
-    const artifactsDir = join7(cwd, ".stackwright", "artifacts");
+    const artifactsDir = join11(cwd, ".stackwright", "artifacts");
     mkdirSync4(artifactsDir, { recursive: true });
     const artifactFile = phase === "api" && input.integrationName ? `api-config-${input.integrationName}.json` : phase === "workflow" && input.workflowName ? `workflow-config-${input.workflowName}.json` : PHASE_ARTIFACT[phase];
-    const artifactPath = join7(artifactsDir, artifactFile);
+    const artifactPath = join11(artifactsDir, artifactFile);
     const serialized = JSON.stringify(artifact, null, 2) + "\n";
     const artifactBytes = Buffer.from(serialized, "utf-8");
     safeWriteSync(artifactPath, serialized);
@@ -5088,9 +5546,9 @@ function registerPipelineTools(server2) {
             isError: true
           };
         }
-        const questionsDir = join7(process.cwd(), ".stackwright", "questions");
+        const questionsDir = join11(process.cwd(), ".stackwright", "questions");
         mkdirSync4(questionsDir, { recursive: true });
-        const outPath = join7(questionsDir, `${phase}.json`);
+        const outPath = join11(questionsDir, `${phase}.json`);
         writeFileSync4(
           outPath,
           JSON.stringify({ phase, questions, writtenAt: (/* @__PURE__ */ new Date()).toISOString() }, null, 2)
@@ -5183,8 +5641,8 @@ function registerPipelineTools(server2) {
 
 // src/tools/safe-write.ts
 import { z as z15 } from "zod";
-import { writeFileSync as writeFileSync5, readFileSync as readFileSync8, existsSync as existsSync8, mkdirSync as mkdirSync5, lstatSync as lstatSync7 } from "fs";
-import { normalize, isAbsolute, dirname, join as join8 } from "path";
+import { writeFileSync as writeFileSync5, readFileSync as readFileSync12, existsSync as existsSync12, mkdirSync as mkdirSync5, lstatSync as lstatSync7 } from "fs";
+import { normalize, isAbsolute, dirname, join as join12 } from "path";
 import { emit as emit2 } from "@stackwright-pro/telemetry";
 var OTTER_WRITE_ALLOWLISTS = {
   "stackwright-pro-designer-otter": [
@@ -5261,7 +5719,18 @@ var OTTER_WRITE_ALLOWLISTS = {
   "stackwright-pro-form-wizard-otter": [
     { prefix: "workflows/", suffix: ".yml", description: "Workflow definition" },
     { prefix: "workflows/", suffix: ".yaml", description: "Workflow definition" },
-    { prefix: ".stackwright/artifacts/", suffix: ".json", description: "Workflow config" }
+    { prefix: ".stackwright/artifacts/", suffix: ".json", description: "Workflow config" },
+    // swp-dvde: workflow-otter owns the container page to prevent the 404 gap
+    {
+      prefix: "pages/workflows/",
+      suffix: "/content.yml",
+      description: "Workflow container page content (swp-dvde)"
+    },
+    {
+      prefix: "pages/workflows/",
+      suffix: "/content.yaml",
+      description: "Workflow container page content (swp-dvde)"
+    }
   ],
   "stackwright-pro-scaffold-otter": [
     { prefix: "app/", suffix: ".tsx", description: "Next.js App Router shell files" },
@@ -5396,21 +5865,21 @@ function extractContentTypes(yamlContent) {
   return types.length > 0 ? types : ["unknown"];
 }
 function readPageRegistry(cwd) {
-  const regPath = join8(cwd, PAGE_REGISTRY_FILE);
-  if (!existsSync8(regPath)) return {};
+  const regPath = join12(cwd, PAGE_REGISTRY_FILE);
+  if (!existsSync12(regPath)) return {};
   try {
     const stat = lstatSync7(regPath);
     if (stat.isSymbolicLink()) return {};
-    return JSON.parse(readFileSync8(regPath, "utf-8"));
+    return JSON.parse(readFileSync12(regPath, "utf-8"));
   } catch {
     return {};
   }
 }
 function writePageRegistry(cwd, registry) {
-  const dir = join8(cwd, ".stackwright");
+  const dir = join12(cwd, ".stackwright");
   mkdirSync5(dir, { recursive: true });
-  const regPath = join8(cwd, PAGE_REGISTRY_FILE);
-  if (existsSync8(regPath)) {
+  const regPath = join12(cwd, PAGE_REGISTRY_FILE);
+  if (existsSync12(regPath)) {
     const stat = lstatSync7(regPath);
     if (stat.isSymbolicLink()) {
       throw new Error("Refusing to write page registry through symlink");
@@ -5582,8 +6051,8 @@ function _safeWriteInner(input) {
     return { text: JSON.stringify(result), isError: true };
   }
   const normalized = normalize(filePath);
-  const fullPath = join8(cwd, normalized);
-  if (existsSync8(fullPath)) {
+  const fullPath = join12(cwd, normalized);
+  if (existsSync12(fullPath)) {
     try {
       const stat = lstatSync7(fullPath);
       if (stat.isSymbolicLink()) {
@@ -5713,8 +6182,8 @@ function registerSafeWriteTools(server2) {
 
 // src/tools/auth.ts
 import { z as z16 } from "zod";
-import { readFileSync as readFileSync9, writeFileSync as writeFileSync6, existsSync as existsSync9, mkdirSync as mkdirSync6 } from "fs";
-import { join as join9 } from "path";
+import { readFileSync as readFileSync13, writeFileSync as writeFileSync6, existsSync as existsSync13, mkdirSync as mkdirSync6 } from "fs";
+import { join as join13 } from "path";
 function normalizeProviderSlug(slug) {
   return slug.replace(/-/g, "_");
 }
@@ -5744,9 +6213,9 @@ ${indent}  requiredRole: ${r.requiredRole}`).join("\n");
 }
 function detectNextMajorVersion(cwd) {
   try {
-    const pkgPath = join9(cwd, "package.json");
-    if (!existsSync9(pkgPath)) return null;
-    const pkg = JSON.parse(readFileSync9(pkgPath, "utf8"));
+    const pkgPath = join13(cwd, "package.json");
+    if (!existsSync13(pkgPath)) return null;
+    const pkg = JSON.parse(readFileSync13(pkgPath, "utf8"));
     const nextVersion = pkg.dependencies?.next ?? pkg.devDependencies?.next;
     if (!nextVersion) return null;
     const match = nextVersion.match(/(\d+)/);
@@ -6408,7 +6877,7 @@ async function configureAuthHandler(params, cwd) {
       auditRetentionDays,
       normalizedRoutes
     );
-    writeFileSync6(join9(cwd, conventionFile), authFileContent, "utf8");
+    writeFileSync6(join13(cwd, conventionFile), authFileContent, "utf8");
     filesWritten.push(conventionFile);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -6428,9 +6897,9 @@ async function configureAuthHandler(params, cwd) {
   if (!devOnly) {
     try {
       const envBlock = generateEnvBlock(effectiveMethod, params);
-      const envPath = join9(cwd, ".env.example");
-      if (existsSync9(envPath)) {
-        const existing = readFileSync9(envPath, "utf8");
+      const envPath = join13(cwd, ".env.example");
+      if (existsSync13(envPath)) {
+        const existing = readFileSync13(envPath, "utf8");
         writeFileSync6(envPath, existing.trimEnd() + "\n\n" + envBlock, "utf8");
       } else {
         writeFileSync6(envPath, envBlock, "utf8");
@@ -6451,10 +6920,10 @@ async function configureAuthHandler(params, cwd) {
   }
   if (devOnly) {
     try {
-      const mockAuthDir = join9(cwd, "lib");
+      const mockAuthDir = join13(cwd, "lib");
       mkdirSync6(mockAuthDir, { recursive: true });
       const mockAuthContent = generateMockAuthContent(roles, mockUsers);
-      writeFileSync6(join9(mockAuthDir, "mock-auth.ts"), mockAuthContent, "utf8");
+      writeFileSync6(join13(mockAuthDir, "mock-auth.ts"), mockAuthContent, "utf8");
       filesWritten.push("lib/mock-auth.ts");
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
@@ -6472,9 +6941,9 @@ async function configureAuthHandler(params, cwd) {
       };
     }
     try {
-      const pkgPath = join9(cwd, "package.json");
-      if (existsSync9(pkgPath)) {
-        const existingPkg = readFileSync9(pkgPath, "utf8");
+      const pkgPath = join13(cwd, "package.json");
+      if (existsSync13(pkgPath)) {
+        const existingPkg = readFileSync13(pkgPath, "utf8");
         const updatedPkg = updatePackageJsonScripts(existingPkg, roles, mockUsers);
         writeFileSync6(pkgPath, updatedPkg, "utf8");
         filesWritten.push("package.json");
@@ -6517,7 +6986,7 @@ async function configureAuthHandler(params, cwd) {
       normalizedRoutes,
       useProxy
     );
-    writeFileSync6(join9(cwd, "stackwright.auth.yml"), authYaml, "utf8");
+    writeFileSync6(join13(cwd, "stackwright.auth.yml"), authYaml, "utf8");
     filesWritten.push("stackwright.auth.yml");
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -6631,8 +7100,8 @@ function registerAuthTools(server2) {
 
 // src/integrity.ts
 import { createHash as createHash4, timingSafeEqual as timingSafeEqual2 } from "crypto";
-import { readFileSync as readFileSync10, readdirSync as readdirSync6, lstatSync as lstatSync8 } from "fs";
-import { join as join10, basename } from "path";
+import { readFileSync as readFileSync14, readdirSync as readdirSync9, lstatSync as lstatSync8 } from "fs";
+import { join as join14, basename } from "path";
 var _checksums = /* @__PURE__ */ new Map([
   [
     "stackwright-pro-api-otter.json",
@@ -6648,7 +7117,7 @@ var _checksums = /* @__PURE__ */ new Map([
   ],
   [
     "stackwright-pro-dashboard-otter.json",
-    "f55081bf4d6545e5435128919f6f9233956ba37671fc9f85300f240ad2497ab6"
+    "ac0a049da72ee20bfb711f640bac571263bf2b05f80cd22a0c2eb5778c40989c"
   ],
   [
     "stackwright-pro-data-otter.json",
@@ -6668,15 +7137,15 @@ var _checksums = /* @__PURE__ */ new Map([
   ],
   [
     "stackwright-pro-form-wizard-otter.json",
-    "cb350297a0068ead2424e703e8c775d91c0b87249ea6904f43b903baf8a84b79"
+    "941bb11b767530460f96fdd08af638b3ede9f7a1ae6f19de04b7d81c95cc62ad"
   ],
   [
     "stackwright-pro-geo-otter.json",
-    "3032fbd27de36c0cdc0e19e46a32d771208d8e86714482f5a368d46342c8317a"
+    "bee276605a3ae3203f5b6a18476316f615cf0ea6f4c73ecf57dcd627417de7f3"
   ],
   [
     "stackwright-pro-page-otter.json",
-    "cc0db24b00f0130f8b4ec8d385c73ea1bcf5d57ba45aca6b986bcbd5da328930"
+    "8c04dd8a14c6e1aa9b0b6685a71a657547c20d99c25448e3523f73d670f87a4a"
   ],
   [
     "stackwright-pro-polish-otter.json",
@@ -6692,7 +7161,7 @@ var _checksums = /* @__PURE__ */ new Map([
   ],
   [
     "stackwright-pro-theme-otter.json",
-    "afb47f8381907145c0e098bdcaae4dd9f5c4ff825a8e88d00a218d2f6858820b"
+    "e3cb6ef9d9f7cbf662a26f637f3d244ec33cb19cb6a4a55dcd148cbfdaa4d71e"
   ],
   [
     "stackwright-services-otter.json",
@@ -6744,7 +7213,7 @@ function verifyOtterFile(filePath) {
   }
   let raw;
   try {
-    raw = readFileSync10(filePath);
+    raw = readFileSync14(filePath);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     return { verified: false, filename, error: `Cannot read file: ${msg}` };
@@ -6794,7 +7263,7 @@ function verifyAllOtters(otterDir) {
   const unknown = [];
   let entries;
   try {
-    entries = readdirSync6(otterDir);
+    entries = readdirSync9(otterDir);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     return {
@@ -6805,7 +7274,7 @@ function verifyAllOtters(otterDir) {
   }
   const otterFiles = entries.filter((f) => f.endsWith("-otter.json"));
   for (const filename of otterFiles) {
-    const filePath = join10(otterDir, filename);
+    const filePath = join14(otterDir, filename);
     try {
       if (lstatSync8(filePath).isSymbolicLink()) {
         failed.push({ filename, error: "Skipped: symlink" });
@@ -6832,8 +7301,8 @@ function verifyAllOtters(otterDir) {
 var DEFAULT_SEARCH_PATHS = ["node_modules/@stackwright-pro/otters/src/", "packages/otters/src/"];
 function resolveOtterDir() {
   const cwd = process.cwd();
-  for (const relative2 of DEFAULT_SEARCH_PATHS) {
-    const candidate = join10(cwd, relative2);
+  for (const relative4 of DEFAULT_SEARCH_PATHS) {
+    const candidate = join14(cwd, relative4);
     try {
       lstatSync8(candidate);
       return candidate;
@@ -6914,13 +7383,13 @@ function registerIntegrityTools(server2) {
 
 // src/tools/domain.ts
 import { z as z17 } from "zod";
-import { readFileSync as readFileSync11, existsSync as existsSync10 } from "fs";
-import { join as join11 } from "path";
+import { readFileSync as readFileSync15, existsSync as existsSync14 } from "fs";
+import { join as join15 } from "path";
 function handleListCollections(input) {
   const cwd = input._cwd ?? process.cwd();
   const sources = [
     {
-      path: join11(cwd, ".stackwright", "artifacts", "data-config.json"),
+      path: join15(cwd, ".stackwright", "artifacts", "data-config.json"),
       source: "data-config.json",
       parse: (raw) => {
         const parsed = JSON.parse(raw);
@@ -6931,15 +7400,15 @@ function handleListCollections(input) {
       }
     },
     {
-      path: join11(cwd, "stackwright.yml"),
+      path: join15(cwd, "stackwright.yml"),
       source: "stackwright.yml",
       parse: extractCollectionsFromYaml
     }
   ];
   for (const { path: path5, source, parse } of sources) {
-    if (!existsSync10(path5)) continue;
+    if (!existsSync14(path5)) continue;
     try {
-      const collections = parse(readFileSync11(path5, "utf8"));
+      const collections = parse(readFileSync15(path5, "utf8"));
       return {
         text: JSON.stringify({ collections, source, collectionCount: collections.length }),
         isError: false
@@ -7090,8 +7559,8 @@ function handleValidateWorkflow(input) {
   if (input.workflow && Object.keys(input.workflow).length > 0) {
     raw = input.workflow;
   } else {
-    const artifactPath = join11(cwd, ".stackwright", "artifacts", "workflow-config.json");
-    if (!existsSync10(artifactPath)) {
+    const artifactPath = join15(cwd, ".stackwright", "artifacts", "workflow-config.json");
+    if (!existsSync14(artifactPath)) {
       return fail([
         {
           code: "NO_WORKFLOW",
@@ -7100,7 +7569,7 @@ function handleValidateWorkflow(input) {
       ]);
     }
     try {
-      raw = JSON.parse(readFileSync11(artifactPath, "utf8"));
+      raw = JSON.parse(readFileSync15(artifactPath, "utf8"));
     } catch (err) {
       return fail([{ code: "INVALID_JSON", message: `Failed to parse workflow artifact: ${err}` }]);
     }
@@ -7407,12 +7876,92 @@ function registerTypeSchemasTool(server2) {
   );
 }
 
+// src/tools/validate-yaml-fragment.ts
+import { z as z19 } from "zod";
+import { load as yamlLoad5 } from "js-yaml";
+var FIELD_SYNONYMS = Object.fromEntries(
+  Array.from(SCHEMA_REGISTRY.entries()).map(([name, entry]) => [
+    name,
+    buildReverseSynonyms(entry.synonyms ?? {})
+  ])
+);
+function enrichErrors(issues, reverseSynonyms) {
+  return issues.map((issue) => {
+    const pathStr = issue.path.join(".");
+    const lastSegment = issue.path[issue.path.length - 1];
+    const fieldName = typeof lastSegment === "string" ? lastSegment : void 0;
+    const didYouMean = fieldName ? reverseSynonyms[fieldName] : void 0;
+    return {
+      path: pathStr || "(root)",
+      message: issue.message,
+      ...didYouMean ? { didYouMean } : {}
+    };
+  });
+}
+function handleValidateYamlFragment(input) {
+  const { schemaName, yaml: yaml4 } = input;
+  const entry = SCHEMA_REGISTRY.get(schemaName);
+  if (!entry) {
+    return {
+      valid: false,
+      parseError: `Unknown schemaName: "${schemaName}". Supported: ${REGISTRY_SCHEMA_NAMES.join(", ")}`
+    };
+  }
+  let parsed;
+  try {
+    parsed = yamlLoad5(yaml4);
+  } catch (err) {
+    return {
+      valid: false,
+      parseError: `YAML parse error: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+  const ctx = input.projectRoot ? { projectRoot: input.projectRoot } : void 0;
+  const resolvedSchema = getSchemaForEntry(entry, ctx);
+  const result = resolvedSchema.safeParse(parsed);
+  if (result.success) {
+    const projectRoot = input.projectRoot ?? process.cwd();
+    const ladder = resolveStatusLadder(projectRoot);
+    if (ladder.length > 0) {
+      const ladderSet = new Set(ladder);
+      const tokenViolations = detectViolationsInYaml(parsed, ladder, ladderSet, "fragment");
+      if (tokenViolations.length > 0) {
+        const tokenErrors = tokenViolations.map((v) => ({
+          path: v.path,
+          message: v.message
+        }));
+        return { valid: false, errors: tokenErrors };
+      }
+    }
+    return { valid: true };
+  }
+  const reverseSynonyms = buildReverseSynonyms(entry.synonyms ?? {});
+  const errors = enrichErrors(result.error.issues, reverseSynonyms);
+  return { valid: false, errors };
+}
+function registerValidateYamlFragmentTool(server2) {
+  server2.tool(
+    "stackwright_pro_validate_yaml_fragment",
+    'Validates a YAML snippet against a canonical Zod schema before writing to disk. Returns actionable errors with "did you mean?" suggestions for common field-name drift (title vs label, id vs name, style vs theme.variant, etc.). Call this before stackwright_pro_safe_write to catch schema violations in-session.',
+    {
+      schemaName: z19.string().describe(`Schema to validate against. Available: ${REGISTRY_SCHEMA_NAMES.join(", ")}`),
+      yaml: z19.string().describe("YAML string to validate (can also be JSON \u2014 js-yaml parses both)")
+    },
+    async ({ schemaName, yaml: yaml4 }) => {
+      const result = handleValidateYamlFragment({ schemaName, yaml: yaml4 });
+      return {
+        content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+      };
+    }
+  );
+}
+
 // src/tools/pages.ts
 import * as fs2 from "fs";
 import * as os from "os";
 import * as path3 from "path";
-import { z as z19 } from "zod";
-import { load as yamlLoad3, dump as yamlDump } from "js-yaml";
+import { z as z20 } from "zod";
+import { load as yamlLoad6, dump as yamlDump } from "js-yaml";
 import { writePage, resolvePagesDir } from "@stackwright/cli";
 import { isProContentType, isOssTypeWithProExtension } from "@stackwright-pro/types";
 var BCP47_RE = /^[a-z]{2}(-[A-Z]{2})?$/;
@@ -7466,7 +8015,7 @@ function handleProWritePage(input) {
   }
   let parsed;
   try {
-    parsed = yamlLoad3(content);
+    parsed = yamlLoad6(content);
   } catch (err) {
     return {
       isError: true,
@@ -7523,10 +8072,10 @@ function registerProPageTools(server2) {
     "stackwright_pro_write_page",
     "Write or update a page's YAML content with Pro content-type awareness. Validates against the Stackwright schema (including Pro types like stats_grid, data_table_pulse, map_pulse, alert_banner). Invalid YAML or schema violations on OSS-type fields are rejected with field-level errors. Use this instead of stackwright_write_page for any page containing Pro content types.",
     {
-      projectRoot: z19.string().describe("Absolute path to the Stackwright project root"),
-      slug: z19.string().describe('Page slug (e.g. "dashboard/main" or "/dashboard/main")'),
-      content: z19.string().describe("Full YAML content for the page (content.yml contents)"),
-      locale: z19.string().optional().describe(
+      projectRoot: z20.string().describe("Absolute path to the Stackwright project root"),
+      slug: z20.string().describe('Page slug (e.g. "dashboard/main" or "/dashboard/main")'),
+      content: z20.string().describe("Full YAML content for the page (content.yml contents)"),
+      locale: z20.string().optional().describe(
         'BCP 47 locale tag (e.g. "fr", "de"). If provided, writes content.<locale>.yml instead of content.yml.'
       )
     },
@@ -7538,16 +8087,16 @@ function registerProPageTools(server2) {
 
 // src/tools/scaffold-cleanup.ts
 import {
-  existsSync as existsSync12,
+  existsSync as existsSync16,
   lstatSync as lstatSync9,
   unlinkSync as unlinkSync2,
-  readFileSync as readFileSync12,
+  readFileSync as readFileSync16,
   writeFileSync as writeFileSync8,
-  readdirSync as readdirSync7,
+  readdirSync as readdirSync10,
   rmdirSync,
   mkdirSync as mkdirSync8
 } from "fs";
-import { join as join13, dirname as dirname3 } from "path";
+import { join as join17, dirname as dirname3 } from "path";
 var SCAFFOLD_FILES_TO_DELETE = [
   "content/posts/getting-started.yaml",
   "content/posts/hello-world.yaml"
@@ -7572,12 +8121,12 @@ var FALLBACK_COLORS = {
   mutedForeground: "#737373"
 };
 function readThemeColors(cwd) {
-  const tokenPath = join13(cwd, ".stackwright", "artifacts", "theme-tokens.json");
-  if (!existsSync12(tokenPath)) return { ...FALLBACK_COLORS };
+  const tokenPath = join17(cwd, ".stackwright", "artifacts", "theme-tokens.json");
+  if (!existsSync16(tokenPath)) return { ...FALLBACK_COLORS };
   const stat = lstatSync9(tokenPath);
   if (stat.isSymbolicLink()) return { ...FALLBACK_COLORS };
   try {
-    const raw = JSON.parse(readFileSync12(tokenPath, "utf-8"));
+    const raw = JSON.parse(readFileSync16(tokenPath, "utf-8"));
     const css = raw?.cssVariables ?? {};
     const toHsl = (hslValue) => {
       if (!hslValue || typeof hslValue !== "string") return null;
@@ -7637,15 +8186,15 @@ function generateNotFoundPage(colors) {
 `;
 }
 function isSafePath(fullPath) {
-  if (!existsSync12(fullPath)) return true;
+  if (!existsSync16(fullPath)) return true;
   const stat = lstatSync9(fullPath);
   return !stat.isSymbolicLink();
 }
 function isDirEmpty(dirPath) {
-  if (!existsSync12(dirPath)) return false;
+  if (!existsSync16(dirPath)) return false;
   const stat = lstatSync9(dirPath);
   if (!stat.isDirectory()) return false;
-  return readdirSync7(dirPath).length === 0;
+  return readdirSync10(dirPath).length === 0;
 }
 function handleCleanupScaffold(_cwd) {
   const cwd = _cwd ?? process.cwd();
@@ -7658,8 +8207,8 @@ function handleCleanupScaffold(_cwd) {
     cleanupWarnings: []
   };
   for (const relPath of SCAFFOLD_FILES_TO_DELETE) {
-    const fullPath = join13(cwd, relPath);
-    if (!existsSync12(fullPath)) {
+    const fullPath = join17(cwd, relPath);
+    if (!existsSync16(fullPath)) {
       result.skipped.push(relPath);
       continue;
     }
@@ -7676,13 +8225,13 @@ function handleCleanupScaffold(_cwd) {
   }
   {
     const relPath = "pages/getting-started/content.yml";
-    const fullPath = join13(cwd, relPath);
-    if (!existsSync12(fullPath)) {
+    const fullPath = join17(cwd, relPath);
+    if (!existsSync16(fullPath)) {
       result.skipped.push(relPath);
     } else if (!isSafePath(fullPath)) {
       result.errors.push(`Refusing to delete symlink: ${relPath}`);
     } else {
-      const content = readFileSync12(fullPath, "utf-8");
+      const content = readFileSync16(fullPath, "utf-8");
       const isScaffoldDefault = GETTING_STARTED_SCAFFOLD_FINGERPRINTS.some(
         (marker) => content.includes(marker)
       );
@@ -7702,16 +8251,16 @@ function handleCleanupScaffold(_cwd) {
   }
   {
     const relPath = `content/posts/${POSTS_COLLECTION_FILE}`;
-    const fullPath = join13(cwd, relPath);
-    const postsDir = join13(cwd, "content/posts");
-    if (!existsSync12(fullPath)) {
+    const fullPath = join17(cwd, relPath);
+    const postsDir = join17(cwd, "content/posts");
+    if (!existsSync16(fullPath)) {
       result.skipped.push(relPath);
     } else if (!isSafePath(fullPath)) {
       result.errors.push(`Refusing to delete symlink: ${relPath}`);
-    } else if (!existsSync12(postsDir)) {
+    } else if (!existsSync16(postsDir)) {
       result.skipped.push(relPath);
     } else {
-      const userPostFiles = readdirSync7(postsDir).filter(
+      const userPostFiles = readdirSync10(postsDir).filter(
         (f) => f !== POSTS_COLLECTION_FILE && POST_FILE_EXTENSIONS.some((ext) => f.endsWith(ext))
       );
       if (userPostFiles.length === 0) {
@@ -7729,8 +8278,8 @@ function handleCleanupScaffold(_cwd) {
     }
   }
   for (const relDir of SCAFFOLD_DIRS_TO_PRUNE) {
-    const fullDir = join13(cwd, relDir);
-    if (!existsSync12(fullDir)) continue;
+    const fullDir = join17(cwd, relDir);
+    if (!existsSync16(fullDir)) continue;
     if (!isSafePath(fullDir)) {
       result.errors.push(`Refusing to prune symlink directory: ${relDir}`);
       continue;
@@ -7745,8 +8294,8 @@ function handleCleanupScaffold(_cwd) {
     }
   }
   {
-    const fullPath = join13(cwd, NOT_FOUND_PATH);
-    if (!existsSync12(fullPath)) {
+    const fullPath = join17(cwd, NOT_FOUND_PATH);
+    if (!existsSync16(fullPath)) {
       result.skipped.push(NOT_FOUND_PATH);
     } else if (!isSafePath(fullPath)) {
       result.errors.push(`Refusing to rewrite symlink: ${NOT_FOUND_PATH}`);
@@ -7784,8 +8333,159 @@ function registerScaffoldCleanupTools(server2) {
   );
 }
 
+// src/tools/write-workflow-container-page.ts
+import { z as z21 } from "zod";
+import { dump as yamlDump2 } from "js-yaml";
+import { WorkflowWizardContentSchema as WorkflowWizardContentSchema2 } from "@stackwright-pro/types";
+var WriteWorkflowContainerPageInputSchema = z21.object({
+  /**
+   * Test-only: override process.cwd() for deterministic temp-dir testing.
+   * Never set in production — omit entirely in normal MCP tool calls.
+   */
+  _cwd: z21.string().optional(),
+  /**
+   * Kebab-case workflow ID — must match `workflow.id` in the referenced YAML.
+   * Example: `patient-evacuation-authorization`
+   */
+  workflowId: z21.string().regex(/^[a-z0-9-]+$/, {
+    message: "workflowId must be kebab-case (lowercase alphanumeric + hyphens)"
+  }),
+  /**
+   * Relative path to the workflow YAML file from project root.
+   * Example: `workflows/patient-evacuation-authorization.yml`
+   */
+  workflowFile: z21.string().min(1).regex(/^workflows\/[a-z0-9-]+\.(yml|yaml)$/, {
+    message: "workflowFile must be: workflows/<id>.yml"
+  }),
+  /**
+   * URL slug for the container page route.
+   * Convention: `workflows/<workflowId>` → page at `/workflows/<workflowId>`.
+   * Example: `workflows/patient-evacuation`
+   *
+   * The tool writes to `pages/<pageSlug>/content.yml`.
+   */
+  pageSlug: z21.string().min(1).regex(/^workflows\/[a-z0-9-]+$/, {
+    message: 'pageSlug must start with "workflows/" and be kebab-case. Example: workflows/patient-evacuation'
+  }),
+  /**
+   * Human-readable label for the workflow (used in page title + breadcrumbs).
+   * Example: `Patient Evacuation Authorization`
+   */
+  label: z21.string().min(1).max(120),
+  /**
+   * Union of required roles across all steps in the workflow YAML.
+   * Consumed by auth-reconcile to build protectedRoutes.
+   * Must be non-empty — workflow pages are always auth-protected.
+   */
+  requiredRoles: z21.array(z21.string().min(1)).min(1, {
+    message: "requiredRoles must have at least one role \u2014 workflow pages are always auth-protected"
+  }),
+  /**
+   * Persistence key for workflow state (localStorage slot).
+   * Defaults to `workflow-<workflowId>` when omitted.
+   */
+  persistenceKey: z21.string().optional(),
+  /**
+   * Layout mode for the container page. Defaults to `app-shell` per Pro convention.
+   * Only override when you have a specific reason — `app-shell` is correct for all
+   * workflow container pages in data-dense Pro apps.
+   */
+  layoutMode: z21.enum(["app-shell", "page"]).default("app-shell")
+});
+function handleWriteWorkflowContainerPage(input) {
+  const parsed = WriteWorkflowContainerPageInputSchema.safeParse(input);
+  if (!parsed.success) {
+    const issues = parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ");
+    return {
+      text: JSON.stringify({ error: `Invalid input: ${issues}` }),
+      isError: true
+    };
+  }
+  const { workflowId, workflowFile, pageSlug, label, requiredRoles, persistenceKey, layoutMode } = parsed.data;
+  const resolvedPersistenceKey = persistenceKey ?? `workflow-${workflowId}`;
+  const wizardItem = {
+    type: "workflow_wizard",
+    label: workflowId,
+    // slug-form label for the content item (page title comes from meta)
+    workflowFile,
+    workflowId,
+    persistenceKey: resolvedPersistenceKey
+  };
+  const schemaCheck = WorkflowWizardContentSchema2.safeParse(wizardItem);
+  if (!schemaCheck.success) {
+    const issues = schemaCheck.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ");
+    return {
+      text: JSON.stringify({ error: `Internal schema validation failed: ${issues}` }),
+      isError: true
+    };
+  }
+  const pageContent = {
+    layoutMode,
+    meta: {
+      title: `${label} | Workflow`,
+      description: `${label} \u2014 multi-step workflow. Requires authorization.`,
+      authRequired: true,
+      requiredRoles
+    },
+    content: {
+      content_items: [wizardItem]
+    }
+  };
+  const yamlContent = yamlDump2(pageContent, {
+    indent: 2,
+    lineWidth: 120,
+    quotingType: "'",
+    forceQuotes: false
+  });
+  const filePath = `pages/${pageSlug}/content.yml`;
+  const writeResult = handleSafeWrite({
+    callerOtter: "stackwright-pro-form-wizard-otter",
+    filePath,
+    content: yamlContent,
+    createDirectories: true,
+    _cwd: parsed.data._cwd
+  });
+  if (writeResult.isError) {
+    return writeResult;
+  }
+  const result = {
+    written: true,
+    path: filePath,
+    contentTypesEmitted: ["workflow_wizard"],
+    content: yamlContent
+  };
+  return {
+    text: JSON.stringify(result),
+    isError: false
+  };
+}
+function registerWriteWorkflowContainerPageTool(server2) {
+  server2.tool(
+    "stackwright_pro_write_workflow_container_page",
+    [
+      "Create the canonical container page for a workflow at pages/workflows/<workflowId>/content.yml.",
+      "",
+      "ALWAYS call this immediately after writing the workflow YAML via stackwright_pro_safe_write.",
+      "Without it, the route /workflows/<workflowId> 404s at runtime.",
+      "",
+      "The tool deterministically emits:",
+      "  - layoutMode: app-shell",
+      "  - meta.authRequired: true, meta.requiredRoles: <your input>",
+      "  - One workflow_wizard content item binding workflowFile + workflowId",
+      "",
+      "requiredRoles: supply the UNION of required roles from all steps in your workflow YAML.",
+      'pageSlug: convention is "workflows/<workflowId>" \u2014 must start with "workflows/".'
+    ].join("\n"),
+    WriteWorkflowContainerPageInputSchema.shape,
+    async (args) => {
+      const result = handleWriteWorkflowContainerPage(args);
+      return { content: [{ type: "text", text: result.text }] };
+    }
+  );
+}
+
 // src/tools/contrast.ts
-import { z as z20 } from "zod";
+import { z as z22 } from "zod";
 function linearizeChannel(c255) {
   const c = c255 / 255;
   return c <= 0.04045 ? c / 12.92 : Math.pow((c + 0.055) / 1.055, 2.4);
@@ -7957,8 +8657,8 @@ function registerContrastTools(server2) {
     "stackwright_pro_check_contrast",
     'Compute the exact WCAG 2.1 contrast ratio between a foreground and background color. Returns the ratio and AA/AAA pass/fail flags. Use this to verify any foreground/background color pair before writing it to the token set. Accepts #RGB, #RRGGBB, hsl(...), or shadcn HSL format ("H S% L%").',
     {
-      fg: z20.string().describe("Foreground (text) color \u2014 hex or HSL"),
-      bg: z20.string().describe("Background color \u2014 hex or HSL")
+      fg: z22.string().describe("Foreground (text) color \u2014 hex or HSL"),
+      bg: z22.string().describe("Background color \u2014 hex or HSL")
     },
     async ({ fg, bg }) => {
       let result;
@@ -7988,8 +8688,8 @@ function registerContrastTools(server2) {
     "stackwright_pro_derive_accessible_palette",
     'Given a seed color (treated as a background), derive the best accessible foreground (text) color that meets the target contrast ratio. Evaluates #ffffff and #000000 against the seed and picks whichever satisfies the target ratio with the highest contrast. Use this for every {name}-foreground token derivation instead of guessing white vs black. Accepts #RGB, #RRGGBB, hsl(...), or shadcn HSL format ("H S% L%").',
     {
-      seed: z20.string().describe("Background (seed) color \u2014 hex or HSL"),
-      targetRatio: numCoerce(z20.number().default(4.5)).describe(
+      seed: z22.string().describe("Background (seed) color \u2014 hex or HSL"),
+      targetRatio: numCoerce(z22.number().default(4.5)).describe(
         "Minimum required contrast ratio (default 4.5 for WCAG AA)"
       )
     },
@@ -8024,7 +8724,7 @@ function registerContrastTools(server2) {
 }
 
 // src/tools/compile.ts
-import { z as z21 } from "zod";
+import { z as z23 } from "zod";
 import fs3 from "fs";
 import path4 from "path";
 import { compileCollections } from "@stackwright-pro/pulse/server";
@@ -8070,7 +8770,7 @@ async function tryOssCompile(fn, ctx, extra) {
   }
 }
 function registerCompileTools(server2) {
-  const projectRootArg = z21.string().optional().describe("Absolute path to project root (defaults to cwd)");
+  const projectRootArg = z23.string().optional().describe("Absolute path to project root (defaults to cwd)");
   server2.tool(
     "stackwright_pro_compile_collections",
     "Compile stackwright.collections.yml \u2192 public/stackwright-content/_collections.json. Reads and validates the live-collections sidecar config file and emits the JSON sink consumed at runtime by PulseCollectionProvider.",
@@ -8246,7 +8946,7 @@ ${results.join("\n")}`;
     "stackwright_pro_compile_page",
     "Compile a single page by slug. Delegates to compilePage from @stackwright/build-scripts installed in the project.",
     {
-      slug: z21.string().describe('Page slug (relative path under pages/, e.g. "dashboard")'),
+      slug: z23.string().describe('Page slug (relative path under pages/, e.g. "dashboard")'),
       projectRoot: projectRootArg
     },
     async ({ slug, projectRoot }) => {
@@ -8266,15 +8966,15 @@ ${results.join("\n")}`;
 }
 
 // src/tools/strip-legacy-integrations.ts
-import { z as z22 } from "zod";
-import { existsSync as existsSync13, readFileSync as readFileSync13, writeFileSync as writeFileSync9 } from "fs";
-import { join as join14 } from "path";
+import { z as z24 } from "zod";
+import { existsSync as existsSync17, readFileSync as readFileSync17, writeFileSync as writeFileSync9 } from "fs";
+import { join as join18 } from "path";
 function handleStripLegacyIntegrations(input) {
   const { projectRoot } = input;
-  const ymlPath = join14(projectRoot, "stackwright.yml");
-  const yamlPath = join14(projectRoot, "stackwright.yaml");
-  if (!existsSync13(ymlPath)) {
-    if (existsSync13(yamlPath)) {
+  const ymlPath = join18(projectRoot, "stackwright.yml");
+  const yamlPath = join18(projectRoot, "stackwright.yaml");
+  if (!existsSync17(ymlPath)) {
+    if (existsSync17(yamlPath)) {
       return {
         changed: false,
         removedEntries: 0,
@@ -8287,7 +8987,7 @@ function handleStripLegacyIntegrations(input) {
       message: "stackwright.yml not found \u2014 no-op."
     };
   }
-  const raw = readFileSync13(ymlPath, "utf-8");
+  const raw = readFileSync17(ymlPath, "utf-8");
   const isCRLF = raw.includes("\r\n");
   const content = isCRLF ? raw.replace(/\r\n/g, "\n") : raw;
   const lines = content.split("\n");
@@ -8329,7 +9029,7 @@ function registerStripLegacyIntegrationsTool(server2) {
     "stackwright_pro_strip_legacy_integrations",
     "Removes the deprecated top-level integrations[] block from stackwright.yml. The authoritative source for integration config is stackwright.integrations.yml \u2014 this tool cleans up legacy entries from older raft runs. Idempotent: no-op if no legacy block present. Preserves all other top-level keys, comments, and formatting.",
     {
-      projectRoot: z22.string().describe("Absolute path to the project root directory")
+      projectRoot: z24.string().describe("Absolute path to the project root directory")
     },
     async ({ projectRoot }) => {
       const result = handleStripLegacyIntegrations({ projectRoot });
@@ -8341,16 +9041,16 @@ function registerStripLegacyIntegrationsTool(server2) {
 }
 
 // src/tools/emitters.ts
-import { z as z23 } from "zod";
-import { readFileSync as readFileSync14, existsSync as existsSync14, readdirSync as readdirSync8 } from "fs";
-import { join as join15 } from "path";
+import { z as z25 } from "zod";
+import { readFileSync as readFileSync18, existsSync as existsSync18, readdirSync as readdirSync11 } from "fs";
+import { join as join19 } from "path";
 import yaml from "js-yaml";
 import { emitEnvLocal, emitProvidersFile, emitMockPorts } from "@stackwright-pro/emitters";
 function readIntegrations(cwd) {
-  const filePath = join15(cwd, "stackwright.integrations.yml");
-  if (!existsSync14(filePath)) return [];
+  const filePath = join19(cwd, "stackwright.integrations.yml");
+  if (!existsSync18(filePath)) return [];
   try {
-    const raw = yaml.load(readFileSync14(filePath, "utf-8"));
+    const raw = yaml.load(readFileSync18(filePath, "utf-8"));
     if (!raw?.integrations || !Array.isArray(raw.integrations)) return [];
     return raw.integrations.filter((i) => typeof i.name === "string").map((i) => ({
       name: i.name,
@@ -8361,15 +9061,15 @@ function readIntegrations(cwd) {
   }
 }
 function readServiceTokenRefs(cwd) {
-  const servicesDir = join15(cwd, "services");
-  if (!existsSync14(servicesDir)) return [];
+  const servicesDir = join19(cwd, "services");
+  if (!existsSync18(servicesDir)) return [];
   try {
-    const files = readdirSync8(servicesDir).filter((f) => f.endsWith(".yml") || f.endsWith(".yaml"));
+    const files = readdirSync11(servicesDir).filter((f) => f.endsWith(".yml") || f.endsWith(".yaml"));
     const refs = [];
     for (const file of files) {
       try {
         const raw = yaml.load(
-          readFileSync14(join15(servicesDir, file), "utf-8")
+          readFileSync18(join19(servicesDir, file), "utf-8")
         );
         if (raw?.tokenEnv && typeof raw.tokenEnv === "string") {
           refs.push({
@@ -8400,7 +9100,7 @@ Call this tool, then write both files with stackwright_pro_safe_write:
 
 Do NOT compose the contents by hand. This emitter is the source of truth. If an env var is missing, update integrations.yml or the emitter \u2014 not the file. This is the first concrete instance of the swp-zf9y deterministic emitter pattern. ${ENV_LOCAL_DESC}`,
     {
-      cwd: z23.string().describe(
+      cwd: z25.string().describe(
         "Absolute path to the project root containing stackwright.integrations.yml and optionally services/*.yml"
       )
     },
@@ -8447,8 +9147,8 @@ mapProvider options:
 
 This is the second concrete instance of the swp-zf9y deterministic emitter pattern. Refs: swp-57ku, swp-2m89, swp-zf9y, drawer 957. ${PROVIDERS_DESC}`,
     {
-      cwd: z23.string().describe("Absolute path to the project root containing stackwright.integrations.yml"),
-      mapProvider: z23.enum(["maplibre", "cesium", "none"]).optional().describe(
+      cwd: z25.string().describe("Absolute path to the project root containing stackwright.integrations.yml"),
+      mapProvider: z25.enum(["maplibre", "cesium", "none"]).optional().describe(
         "Map provider to register (default: cesium for Pro \u2014 3D globe + terrain). Use maplibre for OSS-style 2D dashboards (explicit opt-out). Use none if pages have no map content_items."
       )
     },
@@ -8489,7 +9189,7 @@ Workflow:
 
 This is the third concrete instance of the swp-zf9y deterministic emitter pattern. Refs: swp-phkh, swp-zf9y. ${PORTS_DESC}`,
     {
-      cwd: z23.string().describe("Absolute path to the project root containing stackwright.integrations.yml")
+      cwd: z25.string().describe("Absolute path to the project root containing stackwright.integrations.yml")
     },
     async ({ cwd }) => {
       const integrations = readIntegrations(cwd);
@@ -8518,9 +9218,9 @@ This is the third concrete instance of the swp-zf9y deterministic emitter patter
 }
 
 // src/tools/list-specs.ts
-import { z as z24 } from "zod";
-import { readdirSync as readdirSync9, readFileSync as readFileSync15, statSync as statSync2, existsSync as existsSync15 } from "fs";
-import { join as join16, extname, basename as basename2 } from "path";
+import { z as z26 } from "zod";
+import { readdirSync as readdirSync12, readFileSync as readFileSync19, statSync as statSync2, existsSync as existsSync19 } from "fs";
+import { join as join20, extname, basename as basename2 } from "path";
 var STRIP_SUFFIXES = ["-openapi", "-asyncapi", "-api", "-spec"];
 var ALLOWED_EXTS = /* @__PURE__ */ new Set([".yaml", ".yml", ".json"]);
 function deriveIntegrationName(fileName) {
@@ -8542,18 +9242,18 @@ function detectFormat(snippet) {
 }
 function handleListSpecs(input) {
   const { projectRoot } = input;
-  const specsDir = join16(projectRoot, "specs");
+  const specsDir = join20(projectRoot, "specs");
   const empty = { projectRoot, specs: [], totalCount: 0 };
-  if (!existsSync15(specsDir)) return empty;
+  if (!existsSync19(specsDir)) return empty;
   let entries;
   try {
-    entries = readdirSync9(specsDir);
+    entries = readdirSync12(specsDir);
   } catch {
     return empty;
   }
   const specs = [];
   for (const entry of entries) {
-    const fullPath = join16(specsDir, entry);
+    const fullPath = join20(specsDir, entry);
     let stat;
     try {
       stat = statSync2(fullPath);
@@ -8564,7 +9264,7 @@ function handleListSpecs(input) {
     if (!ALLOWED_EXTS.has(extname(entry).toLowerCase())) continue;
     let snippet = "";
     try {
-      snippet = readFileSync15(fullPath, "utf-8").slice(0, 2048);
+      snippet = readFileSync19(fullPath, "utf-8").slice(0, 2048);
     } catch {
     }
     specs.push({
@@ -8583,7 +9283,7 @@ function registerListSpecsTool(server2) {
     "stackwright_pro_list_specs",
     "Enumerate OpenAPI/AsyncAPI specs in the project's specs/ directory. Returns one entry per spec with integration name (derived from filename), detected format, and size. Used by the foreman to fan out the api phase with one api-otter invocation per spec.",
     {
-      projectRoot: z24.string().describe("Absolute path to the project root directory")
+      projectRoot: z26.string().describe("Absolute path to the project root directory")
     },
     async ({ projectRoot }) => {
       const result = handleListSpecs({ projectRoot });
@@ -8595,8 +9295,8 @@ function registerListSpecsTool(server2) {
 }
 
 // src/tools/describe-endpoint.ts
-import { z as z25 } from "zod";
-import { readFileSync as readFileSync16 } from "fs";
+import { z as z27 } from "zod";
+import { readFileSync as readFileSync20 } from "fs";
 import { extname as extname2 } from "path";
 import yaml2 from "js-yaml";
 function resolveRef(root, ref) {
@@ -8629,7 +9329,7 @@ function deref(root, obj) {
   return o;
 }
 function loadSpec(specPath) {
-  const raw = readFileSync16(specPath, "utf-8");
+  const raw = readFileSync20(specPath, "utf-8");
   const ext = extname2(specPath).toLowerCase();
   if (ext === ".json") {
     return JSON.parse(raw);
@@ -8742,9 +9442,9 @@ function registerDescribeEndpointTool(server2) {
       "from required query params and resolved auth query params (swp-8r8i + swp-1l6l)."
     ].join("\n"),
     {
-      specPath: z25.string().describe("Absolute path to the OpenAPI spec file (.yaml, .yml, or .json)"),
-      path: z25.string().describe('The API path to inspect (e.g. "/stations/{stationId}/observations")'),
-      method: z25.string().describe('HTTP method (case-insensitive: "get", "post", "put", etc.)')
+      specPath: z27.string().describe("Absolute path to the OpenAPI spec file (.yaml, .yml, or .json)"),
+      path: z27.string().describe('The API path to inspect (e.g. "/stations/{stationId}/observations")'),
+      method: z27.string().describe('HTTP method (case-insensitive: "get", "post", "put", etc.)')
     },
     async ({ specPath, path: path5, method }) => {
       try {
@@ -8764,10 +9464,10 @@ function registerDescribeEndpointTool(server2) {
 }
 
 // src/tools/consolidate-integrations.ts
-import { z as z26 } from "zod";
-import { readdirSync as readdirSync10, readFileSync as readFileSync17, writeFileSync as writeFileSync10, existsSync as existsSync16, mkdirSync as mkdirSync9 } from "fs";
+import { z as z28 } from "zod";
+import { readdirSync as readdirSync13, readFileSync as readFileSync21, writeFileSync as writeFileSync10, existsSync as existsSync20, mkdirSync as mkdirSync9 } from "fs";
 import { lockSync as lockSync2 } from "proper-lockfile";
-import { join as join17, basename as basename3 } from "path";
+import { join as join21, basename as basename3 } from "path";
 import yaml3 from "js-yaml";
 var BASE_MOCK_PORT = 4011;
 var STRIP_SUFFIXES2 = ["-openapi", "-asyncapi", "-api", "-spec"];
@@ -8780,13 +9480,13 @@ function deriveNameFromFilename(filename) {
 }
 function handleConsolidateIntegrations(input) {
   const { projectRoot } = input;
-  const artifactsDir = join17(projectRoot, ".stackwright", "artifacts");
-  if (!existsSync16(artifactsDir)) {
+  const artifactsDir = join21(projectRoot, ".stackwright", "artifacts");
+  if (!existsSync20(artifactsDir)) {
     return { written: false, integrationCount: 0, reason: "no per-spec artifacts found" };
   }
   let entries;
   try {
-    entries = readdirSync10(artifactsDir).filter(
+    entries = readdirSync13(artifactsDir).filter(
       (f) => f.startsWith("api-config-") && f.endsWith(".json") && f !== "api-config.json"
     );
   } catch {
@@ -8801,7 +9501,7 @@ function handleConsolidateIntegrations(input) {
   entries.forEach((filename, index) => {
     let artifact = {};
     try {
-      const raw = readFileSync17(join17(artifactsDir, filename), "utf-8");
+      const raw = readFileSync21(join21(artifactsDir, filename), "utf-8");
       artifact = JSON.parse(raw);
     } catch {
     }
@@ -8834,19 +9534,19 @@ function handleConsolidateIntegrations(input) {
   });
   const integrations = Array.from(integrationsByName.values());
   const dedupedCount = entries.length - skippedIntegrationsList.length - integrations.length;
-  const integrationsYmlPath = join17(projectRoot, "stackwright.integrations.yml");
+  const integrationsYmlPath = join21(projectRoot, "stackwright.integrations.yml");
   let existing = {};
-  if (existsSync16(integrationsYmlPath)) {
+  if (existsSync20(integrationsYmlPath)) {
     try {
-      const raw = readFileSync17(integrationsYmlPath, "utf-8");
+      const raw = readFileSync21(integrationsYmlPath, "utf-8");
       existing = yaml3.load(raw) ?? {};
     } catch {
       existing = {};
     }
   }
   const merged = { ...existing, integrations };
-  mkdirSync9(join17(projectRoot), { recursive: true });
-  if (!existsSync16(integrationsYmlPath)) {
+  mkdirSync9(join21(projectRoot), { recursive: true });
+  if (!existsSync20(integrationsYmlPath)) {
     writeFileSync10(integrationsYmlPath, "", "utf-8");
   }
   const release = lockSync2(integrationsYmlPath, {
@@ -8885,7 +9585,7 @@ function registerConsolidateIntegrationsTool(server2) {
       "no per-spec artifacts are found."
     ].join(" "),
     {
-      projectRoot: z26.string().describe("Absolute path to the project root directory")
+      projectRoot: z28.string().describe("Absolute path to the project root directory")
     },
     async ({ projectRoot }) => {
       try {
@@ -8921,7 +9621,7 @@ var package_default = {
     "@stackwright-pro/pulse": "workspace:*",
     "@stackwright-pro/telemetry": "workspace:*",
     "@stackwright-pro/types": "workspace:*",
-    "@stackwright/mcp": "0.6.0-alpha.2",
+    "@stackwright/mcp": "0.6.0-alpha.5",
     "@types/js-yaml": "^4.0.9",
     "js-yaml": "^4.2.0",
     "proper-lockfile": "^4.1.2",
@@ -8943,7 +9643,7 @@ var package_default = {
     "test:coverage": "vitest run --coverage"
   },
   name: "@stackwright-pro/mcp",
-  version: "0.2.0-alpha.114",
+  version: "0.2.0-alpha.117",
   description: "MCP tools for Stackwright Pro - Data Explorer, Security, ISR, and Dashboard generation",
   license: "SEE LICENSE IN LICENSE",
   main: "./dist/server.js",
@@ -9021,6 +9721,7 @@ registerValidateYamlFragmentTool(server);
 registerProPageTools(server);
 registerGetSchemaTool(server);
 registerScaffoldCleanupTools(server);
+registerWriteWorkflowContainerPageTool(server);
 registerContrastTools(server);
 registerCompileTools(server);
 registerStripLegacyIntegrationsTool(server);