@stackwright-pro/mcp 0.2.0-alpha.13 → 0.2.0-alpha.15

package/dist/server.js

@@ -27,15 +27,44 @@ var import_mcp = require("@modelcontextprotocol/sdk/server/mcp.js");
 var import_stdio = require("@modelcontextprotocol/sdk/server/stdio.js");
 
 // src/tools/data-explorer.ts
-var import_zod = require("zod");
+var import_zod2 = require("zod");
 var import_cli_data_explorer = require("@stackwright-pro/cli-data-explorer");
+
+// src/coerce.ts
+var import_zod = require("zod");
+function jsonCoerce(schema) {
+  return import_zod.z.preprocess((v) => {
+    if (typeof v === "string") {
+      try {
+        return JSON.parse(v);
+      } catch {
+        return v;
+      }
+    }
+    return v;
+  }, schema);
+}
+function boolCoerce(schema) {
+  return import_zod.z.preprocess((v) => v === "true" ? true : v === "false" ? false : v, schema);
+}
+function numCoerce(schema) {
+  return import_zod.z.preprocess((v) => {
+    if (typeof v === "string" && v.trim() !== "") {
+      const n = Number(v);
+      if (!Number.isNaN(n)) return n;
+    }
+    return v;
+  }, schema);
+}
+
+// src/tools/data-explorer.ts
 function registerDataExplorerTools(server2) {
   server2.tool(
     "stackwright_pro_list_entities",
     "List all available API entities from OpenAPI specs or generated Zod schemas. Use this to discover what entities are available before generating endpoint filters. Returns entity names, endpoints, and field counts. Part of the Pro Otter Raft for building API-integrated Stackwright applications.",
     {
-      specPath: import_zod.z.string().optional().describe("Path to OpenAPI spec file (YAML or JSON)"),
-      projectRoot: import_zod.z.string().optional().describe("Project root directory (auto-detected if omitted)")
+      specPath: import_zod2.z.string().optional().describe("Path to OpenAPI spec file (YAML or JSON)"),
+      projectRoot: import_zod2.z.string().optional().describe("Project root directory (auto-detected if omitted)")
     },
     async ({ specPath, projectRoot }) => {
       const result = (0, import_cli_data_explorer.listEntities)({
@@ -83,9 +112,13 @@ function registerDataExplorerTools(server2) {
     "stackwright_pro_generate_filter",
     "Generate endpoint filter configuration from selected entities. Creates include/exclude patterns for stackwright.yml OpenAPI integration. Use this after stackwright_pro_list_entities to select which API endpoints the application needs. Only selected endpoints will generate client code, reducing bundle size and improving security.",
     {
-      selectedEntities: import_zod.z.array(import_zod.z.string()).describe('Entity slugs to include (e.g., ["equipment", "supplies"])'),
-      excludePatterns: import_zod.z.array(import_zod.z.string()).optional().describe('Glob patterns to exclude (e.g., ["/admin/**", "/reports/**"])'),
-      projectRoot: import_zod.z.string().optional().describe("Project root directory")
+      selectedEntities: jsonCoerce(import_zod2.z.array(import_zod2.z.string())).describe(
+        'Entity slugs to include (e.g., ["equipment", "supplies"])'
+      ),
+      excludePatterns: jsonCoerce(import_zod2.z.array(import_zod2.z.string()).optional()).describe(
+        'Glob patterns to exclude (e.g., ["/admin/**", "/reports/**"])'
+      ),
+      projectRoot: import_zod2.z.string().optional().describe("Project root directory")
     },
     async ({ selectedEntities, excludePatterns, projectRoot }) => {
       const result = (0, import_cli_data_explorer.generateFilter)({
@@ -141,7 +174,7 @@ function registerDataExplorerTools(server2) {
 }
 
 // src/tools/security.ts
-var import_zod2 = require("zod");
+var import_zod3 = require("zod");
 var import_crypto = require("crypto");
 var import_fs = __toESM(require("fs"));
 var import_path = __toESM(require("path"));
@@ -150,8 +183,8 @@ function registerSecurityTools(server2) {
     "stackwright_pro_validate_spec",
     "Validate an OpenAPI spec against the enterprise approved-specs configuration. Checks if the spec URL is on the allowlist and verifies SHA-256 hash integrity. Use this in enterprise environments where only pre-approved API specs are allowed. Fails build if spec is not approved or has been modified.",
     {
-      specPath: import_zod2.z.string().describe("URL or file path to the OpenAPI spec to validate"),
-      configPath: import_zod2.z.string().optional().describe("Path to stackwright.yml with prebuild.security config")
+      specPath: import_zod3.z.string().describe("URL or file path to the OpenAPI spec to validate"),
+      configPath: import_zod3.z.string().optional().describe("Path to stackwright.yml with prebuild.security config")
     },
     async ({ specPath, configPath }) => {
       let securityEnabled = false;
@@ -259,9 +292,9 @@ Status: Valid (${allowlist.length} specs on allowlist)`
     "stackwright_pro_add_approved_spec",
     "Add an OpenAPI spec to the approved-specs allowlist in stackwright.yml. Computes the SHA-256 hash of the spec and adds it to the security configuration. Use this when onboarding a new API in enterprise environments.",
     {
-      name: import_zod2.z.string().describe("Human-readable name for the spec"),
-      url: import_zod2.z.string().describe("URL or file path to the OpenAPI spec"),
-      configPath: import_zod2.z.string().optional().describe("Path to stackwright.yml")
+      name: import_zod3.z.string().describe("Human-readable name for the spec"),
+      url: import_zod3.z.string().describe("URL or file path to the OpenAPI spec"),
+      configPath: import_zod3.z.string().optional().describe("Path to stackwright.yml")
     },
     async ({ name, url, configPath }) => {
       const configFile = configPath || import_path.default.join(process.cwd(), "stackwright.yml");
@@ -315,7 +348,7 @@ SHA-256 computed: ${sha256}`
     "stackwright_pro_list_approved_specs",
     "List all specs currently on the approved-specs allowlist. Shows spec names, URLs, and hash prefixes. Use this to audit what APIs are approved in the project.",
     {
-      configPath: import_zod2.z.string().optional().describe("Path to stackwright.yml")
+      configPath: import_zod3.z.string().optional().describe("Path to stackwright.yml")
     },
     async ({ configPath }) => {
       const configFile = configPath || import_path.default.join(process.cwd(), "stackwright.yml");
@@ -384,16 +417,18 @@ SHA-256 computed: ${sha256}`
 }
 
 // src/tools/isr.ts
-var import_zod3 = require("zod");
+var import_zod4 = require("zod");
 function registerIsrTools(server2) {
   server2.tool(
     "stackwright_pro_configure_isr",
     "Configure Incremental Static Regeneration (ISR) for an API-backed collection. ISR allows API data to be cached and refreshed on a schedule, providing real-time data with the performance of static generation. Use this after stackwright_pro_generate_filter to set revalidation intervals.",
     {
-      collection: import_zod3.z.string().describe('Collection name (e.g., "equipment", "supplies")'),
-      revalidateSeconds: import_zod3.z.number().optional().describe("Revalidation interval in seconds (default: 60)"),
-      fallback: import_zod3.z.enum(["blocking", "true", "false"]).optional().describe("Fallback behavior for new pages"),
-      configPath: import_zod3.z.string().optional().describe("Path to stackwright.yml")
+      collection: import_zod4.z.string().describe('Collection name (e.g., "equipment", "supplies")'),
+      revalidateSeconds: numCoerce(import_zod4.z.number().optional()).describe(
+        "Revalidation interval in seconds (default: 60)"
+      ),
+      fallback: import_zod4.z.enum(["blocking", "true", "false"]).optional().describe("Fallback behavior for new pages"),
+      configPath: import_zod4.z.string().optional().describe("Path to stackwright.yml")
     },
     async ({ collection, revalidateSeconds = 60, fallback = "blocking", configPath }) => {
       const revalidate = revalidateSeconds;
@@ -436,14 +471,16 @@ ${yamlSnippet}
     "stackwright_pro_configure_isr_batch",
     "Configure ISR for multiple collections at once. More efficient than calling stackwright_pro_configure_isr multiple times. Provide different revalidation intervals based on data freshness requirements.",
     {
-      collections: import_zod3.z.array(
-        import_zod3.z.object({
-          name: import_zod3.z.string().describe("Collection name"),
-          revalidateSeconds: import_zod3.z.number().optional().describe("Revalidation interval")
-        })
+      collections: jsonCoerce(
+        import_zod4.z.array(
+          import_zod4.z.object({
+            name: import_zod4.z.string().describe("Collection name"),
+            revalidateSeconds: numCoerce(import_zod4.z.number().optional()).describe("Revalidation interval")
+          })
+        )
       ).describe("Array of collection configurations"),
-      defaultFallback: import_zod3.z.enum(["blocking", "true", "false"]).optional().describe("Default fallback behavior"),
-      configPath: import_zod3.z.string().optional().describe("Path to stackwright.yml")
+      defaultFallback: import_zod4.z.enum(["blocking", "true", "false"]).optional().describe("Default fallback behavior"),
+      configPath: import_zod4.z.string().optional().describe("Path to stackwright.yml")
     },
     async ({ collections, defaultFallback = "blocking", configPath }) => {
       const lines = [`\u2699\uFE0F Batch ISR Configuration:
@@ -471,17 +508,17 @@ Fallback: ${defaultFallback}`);
 }
 
 // src/tools/dashboard.ts
-var import_zod4 = require("zod");
+var import_zod5 = require("zod");
 var import_cli_data_explorer2 = require("@stackwright-pro/cli-data-explorer");
 function registerDashboardTools(server2) {
   server2.tool(
     "stackwright_pro_generate_dashboard",
     "Generate a dashboard page configuration for displaying API data. Creates YAML content for a Stackwright page with grid, metric_card, data_table, and collection_list content types. Use this after stackwright_pro_generate_filter to create pages for your API collections.",
     {
-      entities: import_zod4.z.array(import_zod4.z.string()).describe("Entity slugs to include in dashboard"),
-      layout: import_zod4.z.enum(["grid", "table", "mixed"]).optional().describe("Dashboard layout style"),
-      pageTitle: import_zod4.z.string().optional().describe("Page title"),
-      specPath: import_zod4.z.string().optional().describe("Path to OpenAPI spec for entity details")
+      entities: jsonCoerce(import_zod5.z.array(import_zod5.z.string())).describe("Entity slugs to include in dashboard"),
+      layout: import_zod5.z.enum(["grid", "table", "mixed"]).optional().describe("Dashboard layout style"),
+      pageTitle: import_zod5.z.string().optional().describe("Page title"),
+      specPath: import_zod5.z.string().optional().describe("Path to OpenAPI spec for entity details")
     },
     async ({ entities, layout = "mixed", pageTitle, specPath }) => {
       let entityDetails = [];
@@ -567,9 +604,9 @@ ${yaml}
     "stackwright_pro_generate_detail_page",
     "Generate a detail view page for a single API entity. Creates YAML content for displaying all fields of an individual record. Use this to create detail pages that complement collection listing pages.",
     {
-      entity: import_zod4.z.string().describe('Entity slug (e.g., "equipment")'),
-      slugField: import_zod4.z.string().optional().describe('Field to use as URL slug (default: "id")'),
-      specPath: import_zod4.z.string().optional().describe("Path to OpenAPI spec for field details")
+      entity: import_zod5.z.string().describe('Entity slug (e.g., "equipment")'),
+      slugField: import_zod5.z.string().optional().describe('Field to use as URL slug (default: "id")'),
+      specPath: import_zod5.z.string().optional().describe("Path to OpenAPI spec for field details")
     },
     async ({ entity, slugField = "id", specPath }) => {
       let fields = [];
@@ -645,7 +682,7 @@ ${yaml}
 }
 
 // src/tools/clarification.ts
-var import_zod5 = require("zod");
+var import_zod6 = require("zod");
 var CONTRADICTION_PATTERNS = [
   {
     keywords: ["minimal", "clean", "simple"],
@@ -733,12 +770,14 @@ function registerClarificationTools(server2) {
     "stackwright_pro_clarify",
     "Ask the user for clarification when a specialist otter encounters ambiguity. This is for MID-EXECUTION questions, NOT upfront question collection (use the Question Manifest Protocol for that). Returns a structured response for the foreman to present to the user via ask_user_question (closed_choice) or directly (open_text).",
     {
-      context: import_zod5.z.string().optional().describe("Context about what the otter is trying to do"),
-      question_type: import_zod5.z.enum(["closed_choice", "open_text"]).describe("Type of question being asked"),
-      question: import_zod5.z.string().describe("The clarification question to ask the user"),
-      choices: import_zod5.z.array(import_zod5.z.string()).optional().describe("Options for closed_choice questions"),
-      priority: import_zod5.z.enum(["blocking", "preferred", "optional"]).optional().default("preferred").describe("How critical is this clarification? Default: preferred"),
-      target_field: import_zod5.z.string().optional().describe("What field/config does this clarify?")
+      context: import_zod6.z.string().optional().describe("Context about what the otter is trying to do"),
+      question_type: import_zod6.z.enum(["closed_choice", "open_text"]).describe("Type of question being asked"),
+      question: import_zod6.z.string().describe("The clarification question to ask the user"),
+      choices: jsonCoerce(import_zod6.z.array(import_zod6.z.string()).optional()).describe(
+        "Options for closed_choice questions"
+      ),
+      priority: import_zod6.z.enum(["blocking", "preferred", "optional"]).optional().default("preferred").describe("How critical is this clarification? Default: preferred"),
+      target_field: import_zod6.z.string().optional().describe("What field/config does this clarify?")
     },
     async ({ context, question_type, question, choices, priority, target_field }) => {
       const result = handleClarify({
@@ -767,8 +806,10 @@ function registerClarificationTools(server2) {
     "stackwright_pro_detect_conflict",
     "Detect when a user's stated preference conflicts with their selected choices. Uses keyword heuristics against known contradiction patterns (minimal vs vibrant, dark vs light, etc). Returns conflict details and resolution options.",
     {
-      stated_preference: import_zod5.z.string().describe("What the user said they wanted"),
-      selected_values: import_zod5.z.record(import_zod5.z.string(), import_zod5.z.string()).describe("What the user actually selected (field \u2192 value)")
+      stated_preference: import_zod6.z.string().describe("What the user said they wanted"),
+      selected_values: jsonCoerce(import_zod6.z.record(import_zod6.z.string(), import_zod6.z.string())).describe(
+        "What the user actually selected (field \u2192 value)"
+      )
     },
     async ({ stated_preference, selected_values }) => {
       const result = handleDetectConflict({ stated_preference, selected_values });
@@ -813,7 +854,7 @@ ${result.resolution_options?.map((o) => `  \u2022 ${o}`).join("\n")}
 }
 
 // src/tools/packages.ts
-var import_zod6 = require("zod");
+var import_zod7 = require("zod");
 var import_fs2 = require("fs");
 var import_child_process = require("child_process");
 var import_path2 = __toESM(require("path"));
@@ -834,24 +875,22 @@ function registerPackageTools(server2) {
     "Ensures pro packages are present in a project's package.json. Safe to call multiple times \u2014 never overwrites existing version pins. Use this to bootstrap dependencies before specialist otters run. Pass includeBaseline: true to automatically include all required @stackwright-pro/* baseline dependencies. Safe to call on existing projects \u2014 never overwrites pinned versions.",
     {
       // FIX 3 (B-new-1): Zod v4 requires two-arg z.record(keySchema, valueSchema)
-      packages: import_zod6.z.record(import_zod6.z.string(), import_zod6.z.string()).optional().default({}).describe(
+      packages: import_zod7.z.record(import_zod7.z.string(), import_zod7.z.string()).optional().default({}).describe(
         'Dependencies to add. Record<packageName, version>. e.g. { "@stackwright-pro/auth": "latest" }. Omit or pass {} when using includeBaseline: true.'
       ),
-      devPackages: import_zod6.z.record(import_zod6.z.string(), import_zod6.z.string()).optional().describe("devDependencies to add. Same format as packages."),
-      scripts: import_zod6.z.record(import_zod6.z.string(), import_zod6.z.string()).optional().describe("npm scripts to add. Only adds if key does not already exist."),
-      targetDir: import_zod6.z.string().optional().describe(
+      devPackages: jsonCoerce(import_zod7.z.record(import_zod7.z.string(), import_zod7.z.string()).optional()).describe(
+        "devDependencies to add. Same format as packages."
+      ),
+      scripts: jsonCoerce(import_zod7.z.record(import_zod7.z.string(), import_zod7.z.string()).optional()).describe(
+        "npm scripts to add. Only adds if key does not already exist."
+      ),
+      targetDir: import_zod7.z.string().optional().describe(
         "Project directory containing package.json. Defaults to process.cwd(). Must be an absolute path within the current working directory."
       ),
-      runInstall: import_zod6.z.preprocess(
-        (v) => v === "true" ? true : v === "false" ? false : v,
-        import_zod6.z.boolean().optional().default(true)
-      ).describe(
+      runInstall: boolCoerce(import_zod7.z.boolean().optional().default(true)).describe(
         "Run pnpm install after writing package.json. Defaults to true. Pass boolean true/false."
       ),
-      includeBaseline: import_zod6.z.preprocess(
-        (v) => v === "true" ? true : v === "false" ? false : v,
-        import_zod6.z.boolean().optional().default(false)
-      ).describe(
+      includeBaseline: boolCoerce(import_zod7.z.boolean().optional().default(false)).describe(
         "When true, automatically merges BASELINE_DEPS and BASELINE_DEV_DEPS before applying packages/devPackages args. Safe to call on existing projects \u2014 never overwrites pinned versions. Pass boolean true/false."
       )
     },
@@ -1010,11 +1049,11 @@ function setupPackages(opts) {
       }
     }
     const raw = (0, import_fs2.readFileSync)(realPackageJsonPath, "utf8");
-    const PackageJsonSchema = import_zod6.z.object({
+    const PackageJsonSchema = import_zod7.z.object({
       // Zod v4: z.record(keySchema, valueSchema) — two-arg form required
-      dependencies: import_zod6.z.record(import_zod6.z.string(), import_zod6.z.string()).optional(),
-      devDependencies: import_zod6.z.record(import_zod6.z.string(), import_zod6.z.string()).optional(),
-      scripts: import_zod6.z.record(import_zod6.z.string(), import_zod6.z.string()).optional()
+      dependencies: import_zod7.z.record(import_zod7.z.string(), import_zod7.z.string()).optional(),
+      devDependencies: import_zod7.z.record(import_zod7.z.string(), import_zod7.z.string()).optional(),
+      scripts: import_zod7.z.record(import_zod7.z.string(), import_zod7.z.string()).optional()
     }).passthrough();
     const schemaResult = PackageJsonSchema.safeParse(JSON.parse(raw));
     if (!schemaResult.success) {
@@ -1097,7 +1136,7 @@ function setupPackages(opts) {
 // src/tools/questions.ts
 var import_promises = require("fs/promises");
 var import_node_path = require("path");
-var import_zod7 = require("zod");
+var import_zod8 = require("zod");
 
 // src/question-adapter.ts
 function truncate(str, maxLength) {
@@ -1283,22 +1322,22 @@ function answersToManifestFormat(answers, questions) {
 }
 
 // src/tools/questions.ts
-var ManifestQuestionSchema = import_zod7.z.object({
-  id: import_zod7.z.string(),
-  question: import_zod7.z.string(),
-  type: import_zod7.z.enum(["text", "select", "multi-select", "confirm"]),
-  required: import_zod7.z.boolean().optional(),
-  options: import_zod7.z.array(
-    import_zod7.z.object({
-      label: import_zod7.z.string(),
-      value: import_zod7.z.string()
+var ManifestQuestionSchema = import_zod8.z.object({
+  id: import_zod8.z.string(),
+  question: import_zod8.z.string(),
+  type: import_zod8.z.enum(["text", "select", "multi-select", "confirm"]),
+  required: import_zod8.z.boolean().optional(),
+  options: import_zod8.z.array(
+    import_zod8.z.object({
+      label: import_zod8.z.string(),
+      value: import_zod8.z.string()
     })
   ).optional(),
-  default: import_zod7.z.union([import_zod7.z.string(), import_zod7.z.boolean(), import_zod7.z.array(import_zod7.z.string())]).optional(),
-  help: import_zod7.z.string().optional(),
-  dependsOn: import_zod7.z.object({
-    questionId: import_zod7.z.string(),
-    value: import_zod7.z.union([import_zod7.z.string(), import_zod7.z.array(import_zod7.z.string())])
+  default: import_zod8.z.union([import_zod8.z.string(), import_zod8.z.boolean(), import_zod8.z.array(import_zod8.z.string())]).optional(),
+  help: import_zod8.z.string().optional(),
+  dependsOn: import_zod8.z.object({
+    questionId: import_zod8.z.string(),
+    value: import_zod8.z.union([import_zod8.z.string(), import_zod8.z.array(import_zod8.z.string())])
   }).optional()
 });
 function registerQuestionTools(server2) {
@@ -1306,11 +1345,13 @@ function registerQuestionTools(server2) {
     "stackwright_pro_present_phase_questions",
     "Adapt manifest-format questions from a specialist otter and present them to the user via ask_user_question. Pass only the phase name \u2014 this tool reads questions from .stackwright/question-manifest.json automatically. The questions parameter is optional and only needed if the manifest has not been written yet. Use this instead of calling ask_user_question directly \u2014 it handles label truncation (50-char limit), header generation, confirm/text defaults, and correct array formatting automatically. IMPORTANT: This is the ONLY approved way to prepare questions before calling ask_user_question. Never call ask_user_question with raw manifest questions. Never retry ask_user_question validation errors by calling it directly \u2014 always re-call this tool.",
     {
-      phase: import_zod7.z.string().describe('Phase name for display context, e.g. "designer", "api", "auth"'),
-      questions: import_zod7.z.array(ManifestQuestionSchema).optional().describe(
+      phase: import_zod8.z.string().describe('Phase name for display context, e.g. "designer", "api", "auth"'),
+      questions: jsonCoerce(import_zod8.z.array(ManifestQuestionSchema).optional()).describe(
         "Questions in Question Manifest format. If omitted, questions are read from .stackwright/question-manifest.json using the phase name."
       ),
-      answers: import_zod7.z.record(import_zod7.z.string(), import_zod7.z.union([import_zod7.z.string(), import_zod7.z.array(import_zod7.z.string()), import_zod7.z.boolean()])).optional().describe("Previously collected answers used to resolve dependsOn conditions")
+      answers: jsonCoerce(
+        import_zod8.z.record(import_zod8.z.string(), import_zod8.z.union([import_zod8.z.string(), import_zod8.z.array(import_zod8.z.string()), import_zod8.z.boolean()])).optional()
+      ).describe("Previously collected answers used to resolve dependsOn conditions")
     },
     async ({ phase, questions, answers }) => {
       let resolvedQuestions;
@@ -1395,7 +1436,7 @@ function registerQuestionTools(server2) {
 }
 
 // src/tools/orchestration.ts
-var import_zod8 = require("zod");
+var import_zod9 = require("zod");
 var import_fs3 = require("fs");
 var import_path3 = require("path");
 var OTTER_NAME_TO_PHASE = [
@@ -1568,8 +1609,8 @@ function registerOrchestrationTools(server2) {
     "stackwright_pro_parse_otter_response",
     "Parse and validate a specialist otter's QUESTION_COLLECTION_MODE JSON response. Handles JSON extraction from LLM responses (strips markdown, fixes single quotes, trailing commas). Detects the phase from the otter name. Use this immediately after invoke_agent() to get a validated manifest phase object.",
     {
-      otterName: import_zod8.z.string().describe('The agent name, e.g. "stackwright-pro-api-otter"'),
-      responseText: import_zod8.z.string().describe("Raw text response from the otter's QUESTION_COLLECTION_MODE invocation")
+      otterName: import_zod9.z.string().describe('The agent name, e.g. "stackwright-pro-api-otter"'),
+      responseText: import_zod9.z.string().describe("Raw text response from the otter's QUESTION_COLLECTION_MODE invocation")
     },
     async ({ otterName, responseText }) => {
       const { result, isError } = handleParseOtterResponse({ otterName, responseText });
@@ -1583,16 +1624,18 @@ function registerOrchestrationTools(server2) {
     "stackwright_pro_save_manifest",
     "Write the question manifest to .stackwright/question-manifest.json. Call this after collecting and parsing questions from all otters via stackwright_pro_parse_otter_response.",
     {
-      phases: import_zod8.z.array(
-        import_zod8.z.object({
-          phase: import_zod8.z.string(),
-          otter: import_zod8.z.string(),
-          questions: import_zod8.z.array(import_zod8.z.any()),
-          requiredPackages: import_zod8.z.object({
-            dependencies: import_zod8.z.record(import_zod8.z.string(), import_zod8.z.string()).optional(),
-            devPackages: import_zod8.z.record(import_zod8.z.string(), import_zod8.z.string()).optional()
-          }).optional()
-        })
+      phases: jsonCoerce(
+        import_zod9.z.array(
+          import_zod9.z.object({
+            phase: import_zod9.z.string(),
+            otter: import_zod9.z.string(),
+            questions: import_zod9.z.array(import_zod9.z.any()),
+            requiredPackages: import_zod9.z.object({
+              dependencies: import_zod9.z.record(import_zod9.z.string(), import_zod9.z.string()).optional(),
+              devPackages: import_zod9.z.record(import_zod9.z.string(), import_zod9.z.string()).optional()
+            }).optional()
+          })
+        )
       ).describe("Array of parsed phase objects from stackwright_pro_parse_otter_response")
     },
     async ({ phases }) => {
@@ -1607,15 +1650,21 @@ function registerOrchestrationTools(server2) {
     "stackwright_pro_save_phase_answers",
     "Save user answers for a phase to .stackwright/answers/{phase}.json. Pass rawAnswers directly from ask_user_question and the original manifest questions for label-to-value reverse mapping.",
     {
-      phase: import_zod8.z.string().describe('Phase name, e.g. "designer"'),
-      rawAnswers: import_zod8.z.array(
-        import_zod8.z.object({
-          question_header: import_zod8.z.string(),
-          selected_options: import_zod8.z.array(import_zod8.z.string()),
-          other_text: import_zod8.z.string().nullable().optional()
-        })
-      ).describe("Answers as returned by ask_user_question"),
-      questions: import_zod8.z.array(import_zod8.z.any()).optional().describe("Original manifest questions for label\u2192value reverse-mapping")
+      phase: import_zod9.z.string().describe('Phase name, e.g. "designer"'),
+      rawAnswers: jsonCoerce(
+        import_zod9.z.array(
+          import_zod9.z.object({
+            question_header: import_zod9.z.string(),
+            selected_options: import_zod9.z.array(import_zod9.z.string()),
+            other_text: import_zod9.z.string().nullable().optional()
+          })
+        )
+      ).describe(
+        "Answers as returned by ask_user_question \u2014 pass the native array, not a JSON string"
+      ),
+      questions: jsonCoerce(import_zod9.z.array(import_zod9.z.any()).optional()).describe(
+        "Original manifest questions for label\u2192value reverse-mapping \u2014 pass the native array, not a JSON string"
+      )
     },
     async ({ phase, rawAnswers, questions }) => {
       const { text, isError } = handleSavePhaseAnswers({
@@ -1633,7 +1682,7 @@ function registerOrchestrationTools(server2) {
     "stackwright_pro_read_phase_answers",
     "Read saved answers for a phase from .stackwright/answers/{phase}.json. Returns { missing: true } when no answers exist yet \u2014 use this to skip phases safely in the execution loop.",
     {
-      phase: import_zod8.z.string().describe('Phase name, e.g. "designer"')
+      phase: import_zod9.z.string().describe('Phase name, e.g. "designer"')
     },
     async ({ phase }) => {
       const { text, isError } = handleReadPhaseAnswers({ phase });
@@ -1647,7 +1696,7 @@ function registerOrchestrationTools(server2) {
     "stackwright_pro_get_otter_name",
     "Get the agent name for a phase (e.g. 'designer' \u2192 'stackwright-pro-designer-otter'). Use this in the execution loop to invoke the correct specialist otter without hardcoding names in the prompt.",
     {
-      phase: import_zod8.z.string().describe('Phase name, e.g. "designer", "api", "pages"')
+      phase: import_zod9.z.string().describe('Phase name, e.g. "designer", "api", "pages"')
     },
     async ({ phase }) => {
       const { text, isError } = handleGetOtterName({ phase });
@@ -1660,7 +1709,7 @@ function registerOrchestrationTools(server2) {
 }
 
 // src/tools/pipeline.ts
-var import_zod9 = require("zod");
+var import_zod10 = require("zod");
 var import_fs4 = require("fs");
 var import_path4 = require("path");
 var PHASE_ORDER = [
@@ -2134,19 +2183,15 @@ function registerPipelineTools(server2) {
     "stackwright_pro_set_pipeline_state",
     `Atomic read\u2192modify\u2192write pipeline state. ${DESC}`,
     {
-      phase: import_zod9.z.string().optional().describe('Phase to update, e.g. "designer"'),
-      field: import_zod9.z.enum(["questionsCollected", "answered", "executed", "artifactWritten"]).optional().describe("Boolean field to set"),
-      value: import_zod9.z.preprocess(
-        (v) => v === "true" ? true : v === "false" ? false : v,
-        import_zod9.z.boolean().optional()
-      ).describe(
+      phase: import_zod10.z.string().optional().describe('Phase to update, e.g. "designer"'),
+      field: import_zod10.z.enum(["questionsCollected", "answered", "executed", "artifactWritten"]).optional().describe("Boolean field to set"),
+      value: boolCoerce(import_zod10.z.boolean().optional()).describe(
         'Value for the field \u2014 must be a JSON boolean (true/false), NOT the string "true"/"false"'
       ),
-      status: import_zod9.z.enum(["setup", "questions", "execution", "done"]).optional().describe("Top-level status override"),
-      incrementRetry: import_zod9.z.preprocess(
-        (v) => v === "true" ? true : v === "false" ? false : v,
-        import_zod9.z.boolean().optional()
-      ).describe("Bump retryCount by 1 \u2014 must be a JSON boolean")
+      status: import_zod10.z.enum(["setup", "questions", "execution", "done"]).optional().describe("Top-level status override"),
+      incrementRetry: boolCoerce(import_zod10.z.boolean().optional()).describe(
+        "Bump retryCount by 1 \u2014 must be a JSON boolean"
+      )
     },
     async (args) => res(
       handleSetPipelineState({
@@ -2174,30 +2219,30 @@ function registerPipelineTools(server2) {
     "stackwright_pro_write_phase_questions",
     `Parse otter question-collection response \u2192 .stackwright/questions/{phase}.json. ${DESC}`,
     {
-      phase: import_zod9.z.string().describe('Phase name, e.g. "designer"'),
-      responseText: import_zod9.z.string().describe("Raw LLM response from QUESTION_COLLECTION_MODE")
+      phase: import_zod10.z.string().describe('Phase name, e.g. "designer"'),
+      responseText: import_zod10.z.string().describe("Raw LLM response from QUESTION_COLLECTION_MODE")
     },
     async ({ phase, responseText }) => res(handleWritePhaseQuestions({ phase, responseText }))
   );
   server2.tool(
     "stackwright_pro_build_specialist_prompt",
     `Assemble execution prompt from answers + upstream artifacts. Foreman passes verbatim. ${DESC}`,
-    { phase: import_zod9.z.string().describe('Phase to build prompt for, e.g. "pages"') },
+    { phase: import_zod10.z.string().describe('Phase to build prompt for, e.g. "pages"') },
     async ({ phase }) => res(handleBuildSpecialistPrompt({ phase }))
   );
   server2.tool(
     "stackwright_pro_validate_artifact",
     `Validate specialist response + write artifact to .stackwright/artifacts/. Returns retryPrompt on failure. ${DESC}`,
     {
-      phase: import_zod9.z.string().describe('Phase that produced this artifact, e.g. "designer"'),
-      responseText: import_zod9.z.string().describe("Raw response text from the specialist otter")
+      phase: import_zod10.z.string().describe('Phase that produced this artifact, e.g. "designer"'),
+      responseText: import_zod10.z.string().describe("Raw response text from the specialist otter")
     },
     async ({ phase, responseText }) => res(handleValidateArtifact({ phase, responseText }))
   );
 }
 
 // src/tools/safe-write.ts
-var import_zod10 = require("zod");
+var import_zod11 = require("zod");
 var import_fs5 = require("fs");
 var import_path5 = require("path");
 var OTTER_WRITE_ALLOWLISTS = {
@@ -2429,10 +2474,10 @@ function registerSafeWriteTools(server2) {
     "stackwright_pro_safe_write",
     DESC,
     {
-      callerOtter: import_zod10.z.string().describe('The otter agent name requesting the write, e.g. "stackwright-pro-page-otter"'),
-      filePath: import_zod10.z.string().describe('Relative path from project root, e.g. "pages/dashboard/content.yml"'),
-      content: import_zod10.z.string().describe("File content to write"),
-      createDirectories: import_zod10.z.boolean().optional().describe("Create parent directories if they don't exist. Default: true")
+      callerOtter: import_zod11.z.string().describe('The otter agent name requesting the write, e.g. "stackwright-pro-page-otter"'),
+      filePath: import_zod11.z.string().describe('Relative path from project root, e.g. "pages/dashboard/content.yml"'),
+      content: import_zod11.z.string().describe("File content to write"),
+      createDirectories: import_zod11.z.boolean().optional().describe("Create parent directories if they don't exist. Default: true")
     },
     async ({ callerOtter, filePath, content, createDirectories }) => {
       const result = handleSafeWrite({
@@ -2447,7 +2492,7 @@ function registerSafeWriteTools(server2) {
 }
 
 // src/tools/auth.ts
-var import_zod11 = require("zod");
+var import_zod12 = require("zod");
 var import_fs6 = require("fs");
 var import_path6 = require("path");
 function buildHierarchy(roles) {
@@ -2802,35 +2847,35 @@ function registerAuthTools(server2) {
     "stackwright_pro_configure_auth",
     "Generate authentication middleware and configuration for a Next.js Stackwright application. Writes `middleware.ts` from a secure template, appends/updates the `auth:` section in `stackwright.yml`, and generates `.env.example` with required environment variables. \u26A0\uFE0F For CAC/PKI: generated `middleware.ts` carries a SECURITY REVIEW REQUIRED comment \u2014 certificate chain validation must be verified by a DoD security officer before production deployment. This is the ONLY approved path to generating `middleware.ts`. Never write TypeScript auth files directly.",
     {
-      method: import_zod11.z.enum(["cac", "oidc", "oauth2", "none"]),
-      provider: import_zod11.z.enum(["azure-ad", "okta", "ping", "cognito", "custom"]).optional(),
+      method: import_zod12.z.enum(["cac", "oidc", "oauth2", "none"]),
+      provider: import_zod12.z.enum(["azure-ad", "okta", "ping", "cognito", "custom"]).optional(),
       // CAC
-      cacCaBundle: import_zod11.z.string().optional(),
-      cacEdipiLookup: import_zod11.z.string().optional(),
-      cacOcspEndpoint: import_zod11.z.string().optional(),
-      cacCertHeader: import_zod11.z.string().optional(),
+      cacCaBundle: import_zod12.z.string().optional(),
+      cacEdipiLookup: import_zod12.z.string().optional(),
+      cacOcspEndpoint: import_zod12.z.string().optional(),
+      cacCertHeader: import_zod12.z.string().optional(),
       // OIDC
-      oidcDiscoveryUrl: import_zod11.z.string().optional(),
-      oidcClientId: import_zod11.z.string().optional(),
-      oidcClientSecret: import_zod11.z.string().optional(),
-      oidcScopes: import_zod11.z.string().optional(),
-      oidcRoleClaim: import_zod11.z.string().optional(),
+      oidcDiscoveryUrl: import_zod12.z.string().optional(),
+      oidcClientId: import_zod12.z.string().optional(),
+      oidcClientSecret: import_zod12.z.string().optional(),
+      oidcScopes: import_zod12.z.string().optional(),
+      oidcRoleClaim: import_zod12.z.string().optional(),
       // OAuth2
-      oauth2AuthUrl: import_zod11.z.string().optional(),
-      oauth2TokenUrl: import_zod11.z.string().optional(),
-      oauth2ClientId: import_zod11.z.string().optional(),
-      oauth2ClientSecret: import_zod11.z.string().optional(),
-      oauth2Scopes: import_zod11.z.string().optional(),
+      oauth2AuthUrl: import_zod12.z.string().optional(),
+      oauth2TokenUrl: import_zod12.z.string().optional(),
+      oauth2ClientId: import_zod12.z.string().optional(),
+      oauth2ClientSecret: import_zod12.z.string().optional(),
+      oauth2Scopes: import_zod12.z.string().optional(),
       // RBAC
-      rbacRoles: import_zod11.z.array(import_zod11.z.string()).optional(),
-      rbacDefaultRole: import_zod11.z.string().optional(),
+      rbacRoles: jsonCoerce(import_zod12.z.array(import_zod12.z.string()).optional()),
+      rbacDefaultRole: import_zod12.z.string().optional(),
       // Audit
-      auditEnabled: import_zod11.z.boolean().optional(),
-      auditRetentionDays: import_zod11.z.number().int().positive().optional(),
+      auditEnabled: boolCoerce(import_zod12.z.boolean().optional()),
+      auditRetentionDays: numCoerce(import_zod12.z.number().int().positive().optional()),
       // Routes
-      protectedRoutes: import_zod11.z.array(import_zod11.z.string()).optional(),
+      protectedRoutes: jsonCoerce(import_zod12.z.array(import_zod12.z.string()).optional()),
       // Injection for tests
-      _cwd: import_zod11.z.string().optional()
+      _cwd: import_zod12.z.string().optional()
     },
     async (params) => {
       const cwd = params._cwd ?? process.cwd();
@@ -2874,7 +2919,7 @@ var _checksums = /* @__PURE__ */ new Map([
   ],
   [
     "stackwright-pro-theme-otter.json",
-    "64ffaeeceacd739922788a1d074f6feaffc3f91d09706c2c104f0c0281677732"
+    "1f182326f1acd3d4091a38c7012085cbb4945893e95be4ca3de72318ad092767"
   ],
   [
     "stackwright-pro-workflow-otter.json",
@@ -3058,7 +3103,7 @@ function registerIntegrityTools(server2) {
 }
 
 // src/tools/domain.ts
-var import_zod12 = require("zod");
+var import_zod13 = require("zod");
 var import_fs8 = require("fs");
 var import_path8 = require("path");
 function handleListCollections(input) {
@@ -3444,7 +3489,7 @@ function registerDomainTools(server2) {
     "stackwright_pro_resolve_data_strategy",
     "Look up the data freshness strategy configuration from the user's answer. Returns mechanism, revalidation seconds, required packages, and the exact MCP tool call to make. Replaces the strategy table in the data-otter prompt.",
     {
-      strategy: import_zod12.z.string().describe(
+      strategy: import_zod13.z.string().describe(
         'The data-1 answer value: "pulse-fast", "isr-fast", "isr-standard", or "isr-slow"'
       )
     },
@@ -3454,7 +3499,7 @@ function registerDomainTools(server2) {
     "stackwright_pro_validate_workflow",
     "Validate a workflow definition against the Stackwright workflow schema. Checks step ID uniqueness, transition targets, terminal state existence, and service references. Call this after the workflow otter produces output.",
     {
-      workflow: import_zod12.z.record(import_zod12.z.string(), import_zod12.z.unknown()).optional().describe(
+      workflow: jsonCoerce(import_zod13.z.record(import_zod13.z.string(), import_zod13.z.unknown()).optional()).describe(
         "Parsed workflow object. If omitted, reads from .stackwright/artifacts/workflow-config.json"
       )
     },
@@ -3484,7 +3529,7 @@ var package_default = {
     "test:coverage": "vitest run --coverage"
   },
   name: "@stackwright-pro/mcp",
-  version: "0.2.0-alpha.13",
+  version: "0.2.0-alpha.15",
   description: "MCP tools for Stackwright Pro - Data Explorer, Security, ISR, and Dashboard generation",
   license: "PROPRIETARY",
   main: "./dist/server.js",