@stackwright-pro/mcp 0.2.0-alpha.9 → 0.2.0-alpha.90

package/dist/server.mjs

@@ -3,15 +3,44 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 
 // src/tools/data-explorer.ts
-import { z } from "zod";
+import { z as z2 } from "zod";
 import { listEntities, generateFilter } from "@stackwright-pro/cli-data-explorer";
+
+// src/coerce.ts
+import { z } from "zod";
+function jsonCoerce(schema) {
+  return z.preprocess((v) => {
+    if (typeof v === "string") {
+      try {
+        return JSON.parse(v);
+      } catch {
+        return v;
+      }
+    }
+    return v;
+  }, schema);
+}
+function boolCoerce(schema) {
+  return z.preprocess((v) => v === "true" ? true : v === "false" ? false : v, schema);
+}
+function numCoerce(schema) {
+  return z.preprocess((v) => {
+    if (typeof v === "string" && v.trim() !== "") {
+      const n = Number(v);
+      if (!Number.isNaN(n)) return n;
+    }
+    return v;
+  }, schema);
+}
+
+// src/tools/data-explorer.ts
 function registerDataExplorerTools(server2) {
   server2.tool(
     "stackwright_pro_list_entities",
     "List all available API entities from OpenAPI specs or generated Zod schemas. Use this to discover what entities are available before generating endpoint filters. Returns entity names, endpoints, and field counts. Part of the Pro Otter Raft for building API-integrated Stackwright applications.",
     {
-      specPath: z.string().optional().describe("Path to OpenAPI spec file (YAML or JSON)"),
-      projectRoot: z.string().optional().describe("Project root directory (auto-detected if omitted)")
+      specPath: z2.string().optional().describe("Path to OpenAPI spec file (YAML or JSON)"),
+      projectRoot: z2.string().optional().describe("Project root directory (auto-detected if omitted)")
     },
     async ({ specPath, projectRoot }) => {
       const result = listEntities({
@@ -59,9 +88,13 @@ function registerDataExplorerTools(server2) {
     "stackwright_pro_generate_filter",
     "Generate endpoint filter configuration from selected entities. Creates include/exclude patterns for stackwright.yml OpenAPI integration. Use this after stackwright_pro_list_entities to select which API endpoints the application needs. Only selected endpoints will generate client code, reducing bundle size and improving security.",
     {
-      selectedEntities: z.array(z.string()).describe('Entity slugs to include (e.g., ["equipment", "supplies"])'),
-      excludePatterns: z.array(z.string()).optional().describe('Glob patterns to exclude (e.g., ["/admin/**", "/reports/**"])'),
-      projectRoot: z.string().optional().describe("Project root directory")
+      selectedEntities: jsonCoerce(z2.array(z2.string())).describe(
+        'Entity slugs to include (e.g., ["equipment", "supplies"])'
+      ),
+      excludePatterns: jsonCoerce(z2.array(z2.string()).optional()).describe(
+        'Glob patterns to exclude (e.g., ["/admin/**", "/reports/**"])'
+      ),
+      projectRoot: z2.string().optional().describe("Project root directory")
     },
     async ({ selectedEntities, excludePatterns, projectRoot }) => {
       const result = generateFilter({
@@ -117,7 +150,7 @@ function registerDataExplorerTools(server2) {
 }
 
 // src/tools/security.ts
-import { z as z2 } from "zod";
+import { z as z3 } from "zod";
 import { createHash } from "crypto";
 import fs from "fs";
 import path from "path";
@@ -126,8 +159,8 @@ function registerSecurityTools(server2) {
     "stackwright_pro_validate_spec",
     "Validate an OpenAPI spec against the enterprise approved-specs configuration. Checks if the spec URL is on the allowlist and verifies SHA-256 hash integrity. Use this in enterprise environments where only pre-approved API specs are allowed. Fails build if spec is not approved or has been modified.",
     {
-      specPath: z2.string().describe("URL or file path to the OpenAPI spec to validate"),
-      configPath: z2.string().optional().describe("Path to stackwright.yml with prebuild.security config")
+      specPath: z3.string().describe("URL or file path to the OpenAPI spec to validate"),
+      configPath: z3.string().optional().describe("Path to stackwright.yml with prebuild.security config")
     },
     async ({ specPath, configPath }) => {
       let securityEnabled = false;
@@ -235,16 +268,15 @@ Status: Valid (${allowlist.length} specs on allowlist)`
     "stackwright_pro_add_approved_spec",
     "Add an OpenAPI spec to the approved-specs allowlist in stackwright.yml. Computes the SHA-256 hash of the spec and adds it to the security configuration. Use this when onboarding a new API in enterprise environments.",
     {
-      name: z2.string().describe("Human-readable name for the spec"),
-      url: z2.string().describe("URL or file path to the OpenAPI spec"),
-      configPath: z2.string().optional().describe("Path to stackwright.yml")
+      name: z3.string().describe("Human-readable name for the spec"),
+      url: z3.string().describe("URL or file path to the OpenAPI spec"),
+      configPath: z3.string().optional().describe("Path to stackwright.yml")
     },
     async ({ name, url, configPath }) => {
       const configFile = configPath || path.join(process.cwd(), "stackwright.yml");
       let sha256 = "<computed-at-build>";
       try {
         if (url.startsWith("http://") || url.startsWith("https://")) {
-          sha256 = "<computed-at-build>";
         } else if (fs.existsSync(url)) {
           const specContent = fs.readFileSync(url, "utf8");
           sha256 = createHash("sha256").update(specContent).digest("hex");
@@ -291,7 +323,7 @@ SHA-256 computed: ${sha256}`
     "stackwright_pro_list_approved_specs",
     "List all specs currently on the approved-specs allowlist. Shows spec names, URLs, and hash prefixes. Use this to audit what APIs are approved in the project.",
     {
-      configPath: z2.string().optional().describe("Path to stackwright.yml")
+      configPath: z3.string().optional().describe("Path to stackwright.yml")
     },
     async ({ configPath }) => {
       const configFile = configPath || path.join(process.cwd(), "stackwright.yml");
@@ -360,16 +392,18 @@ SHA-256 computed: ${sha256}`
 }
 
 // src/tools/isr.ts
-import { z as z3 } from "zod";
+import { z as z4 } from "zod";
 function registerIsrTools(server2) {
   server2.tool(
     "stackwright_pro_configure_isr",
     "Configure Incremental Static Regeneration (ISR) for an API-backed collection. ISR allows API data to be cached and refreshed on a schedule, providing real-time data with the performance of static generation. Use this after stackwright_pro_generate_filter to set revalidation intervals.",
     {
-      collection: z3.string().describe('Collection name (e.g., "equipment", "supplies")'),
-      revalidateSeconds: z3.number().optional().describe("Revalidation interval in seconds (default: 60)"),
-      fallback: z3.enum(["blocking", "true", "false"]).optional().describe("Fallback behavior for new pages"),
-      configPath: z3.string().optional().describe("Path to stackwright.yml")
+      collection: z4.string().describe('Collection name (e.g., "equipment", "supplies")'),
+      revalidateSeconds: numCoerce(z4.number().optional()).describe(
+        "Revalidation interval in seconds (default: 60)"
+      ),
+      fallback: z4.enum(["blocking", "true", "false"]).optional().describe("Fallback behavior for new pages"),
+      configPath: z4.string().optional().describe("Path to stackwright.yml")
     },
     async ({ collection, revalidateSeconds = 60, fallback = "blocking", configPath }) => {
       const revalidate = revalidateSeconds;
@@ -380,7 +414,7 @@ function registerIsrTools(server2) {
     isr:
       revalidate: ${revalidate}
       fallback: ${fallback}`;
-      let description = "";
+      let description;
       if (revalidate < 60) {
         description = "\u26A1 Very fresh data (revalidate every " + revalidate + "s)";
       } else if (revalidate < 300) {
@@ -412,14 +446,16 @@ ${yamlSnippet}
     "stackwright_pro_configure_isr_batch",
     "Configure ISR for multiple collections at once. More efficient than calling stackwright_pro_configure_isr multiple times. Provide different revalidation intervals based on data freshness requirements.",
     {
-      collections: z3.array(
-        z3.object({
-          name: z3.string().describe("Collection name"),
-          revalidateSeconds: z3.number().optional().describe("Revalidation interval")
-        })
+      collections: jsonCoerce(
+        z4.array(
+          z4.object({
+            name: z4.string().describe("Collection name"),
+            revalidateSeconds: numCoerce(z4.number().optional()).describe("Revalidation interval")
+          })
+        )
       ).describe("Array of collection configurations"),
-      defaultFallback: z3.enum(["blocking", "true", "false"]).optional().describe("Default fallback behavior"),
-      configPath: z3.string().optional().describe("Path to stackwright.yml")
+      defaultFallback: z4.enum(["blocking", "true", "false"]).optional().describe("Default fallback behavior"),
+      configPath: z4.string().optional().describe("Path to stackwright.yml")
     },
     async ({ collections, defaultFallback = "blocking", configPath }) => {
       const lines = [`\u2699\uFE0F Batch ISR Configuration:
@@ -447,17 +483,17 @@ Fallback: ${defaultFallback}`);
 }
 
 // src/tools/dashboard.ts
-import { z as z4 } from "zod";
+import { z as z5 } from "zod";
 import { listEntities as listEntities2 } from "@stackwright-pro/cli-data-explorer";
 function registerDashboardTools(server2) {
   server2.tool(
     "stackwright_pro_generate_dashboard",
     "Generate a dashboard page configuration for displaying API data. Creates YAML content for a Stackwright page with grid, metric_card, data_table, and collection_list content types. Use this after stackwright_pro_generate_filter to create pages for your API collections.",
     {
-      entities: z4.array(z4.string()).describe("Entity slugs to include in dashboard"),
-      layout: z4.enum(["grid", "table", "mixed"]).optional().describe("Dashboard layout style"),
-      pageTitle: z4.string().optional().describe("Page title"),
-      specPath: z4.string().optional().describe("Path to OpenAPI spec for entity details")
+      entities: jsonCoerce(z5.array(z5.string())).describe("Entity slugs to include in dashboard"),
+      layout: z5.enum(["grid", "table", "mixed"]).optional().describe("Dashboard layout style"),
+      pageTitle: z5.string().optional().describe("Page title"),
+      specPath: z5.string().optional().describe("Path to OpenAPI spec for entity details")
     },
     async ({ entities, layout = "mixed", pageTitle, specPath }) => {
       let entityDetails = [];
@@ -543,9 +579,9 @@ ${yaml}
     "stackwright_pro_generate_detail_page",
     "Generate a detail view page for a single API entity. Creates YAML content for displaying all fields of an individual record. Use this to create detail pages that complement collection listing pages.",
     {
-      entity: z4.string().describe('Entity slug (e.g., "equipment")'),
-      slugField: z4.string().optional().describe('Field to use as URL slug (default: "id")'),
-      specPath: z4.string().optional().describe("Path to OpenAPI spec for field details")
+      entity: z5.string().describe('Entity slug (e.g., "equipment")'),
+      slugField: z5.string().optional().describe('Field to use as URL slug (default: "id")'),
+      specPath: z5.string().optional().describe("Path to OpenAPI spec for field details")
     },
     async ({ entity, slugField = "id", specPath }) => {
       let fields = [];
@@ -568,39 +604,49 @@ ${yaml}
         `    title: "${entityName} Details | {{ ${entity}.${slugField} }}"`,
         "",
         "  content_items:",
-        "    - main:",
-        '        label: "detail-header"',
-        "        heading:",
-        `          text: "{{ ${entity}.${slugField} }}"`,
-        '          textSize: "h1"',
-        "        textBlocks:",
-        `          - text: "Details for this ${entity}"`,
-        '            textSize: "body1"',
-        '        background: "primary"',
-        '        color: "text"',
+        "    - type: text_block",
+        '      label: "detail-header"',
+        "      heading:",
+        `        text: "{{ ${entity}.${slugField} }}"`,
+        '        textSize: "h1"',
+        "      textBlocks:",
+        `        - text: "Details for this ${entity}"`,
+        '          textSize: "body1"',
         "",
-        "    - grid:",
-        '        label: "detail-fields"',
-        "        columns: 2",
-        "        items:"
+        "    - type: grid",
+        '      label: "detail-fields"',
+        "      columns:"
       ];
       const displayFields = fields.length > 0 ? fields.slice(0, 8) : [
         { name: slugField, type: "string" },
         { name: "created_at", type: "datetime" },
         { name: "updated_at", type: "datetime" }
       ];
-      for (const field of displayFields) {
-        const label = field.name.replace(/_/g, " ").replace(/\b\w/g, (l) => l.toUpperCase());
-        yamlLines.push(`          - card:`);
-        yamlLines.push(`              label: "${field.name}-field"`);
-        yamlLines.push(`              heading:`);
-        yamlLines.push(`                text: "${label}"`);
-        yamlLines.push(`                textSize: "h4"`);
-        yamlLines.push(`              content:`);
-        yamlLines.push(`                - text: "{{ ${entity}.${field.name} }}"`);
-        yamlLines.push(`                  textSize: "body1"`);
-      }
-      yamlLines.push('        background: "background"');
+      const mid = Math.ceil(displayFields.length / 2);
+      const col1 = displayFields.slice(0, mid);
+      const col2 = displayFields.slice(mid);
+      for (const [colIndex, colFields] of [col1, col2].entries()) {
+        yamlLines.push("        - width: 1");
+        yamlLines.push("          content_items:");
+        for (const field of colFields) {
+          const label = field.name.replace(/_/g, " ").replace(/\b\w/g, (l) => l.toUpperCase());
+          yamlLines.push("            - type: text_block");
+          yamlLines.push(`              label: "${field.name}-field"`);
+          yamlLines.push("              heading:");
+          yamlLines.push(`                text: "${label}"`);
+          yamlLines.push('                textSize: "h4"');
+          yamlLines.push("              textBlocks:");
+          yamlLines.push(`                - text: "{{ ${entity}.${field.name} }}"`);
+          yamlLines.push('                  textSize: "body1"');
+        }
+      }
+      yamlLines.push("");
+      yamlLines.push("    - type: action_bar");
+      yamlLines.push("      actions:");
+      yamlLines.push(`        - label: "<- Back to ${entityName}"`);
+      yamlLines.push("          action: navigate");
+      yamlLines.push(`          href: "/${entity}"`);
+      yamlLines.push("          style: secondary");
       const yaml = yamlLines.join("\n");
       return {
         content: [
@@ -621,7 +667,7 @@ ${yaml}
 }
 
 // src/tools/clarification.ts
-import { z as z5 } from "zod";
+import { z as z6 } from "zod";
 var CONTRADICTION_PATTERNS = [
   {
     keywords: ["minimal", "clean", "simple"],
@@ -709,12 +755,14 @@ function registerClarificationTools(server2) {
     "stackwright_pro_clarify",
     "Ask the user for clarification when a specialist otter encounters ambiguity. This is for MID-EXECUTION questions, NOT upfront question collection (use the Question Manifest Protocol for that). Returns a structured response for the foreman to present to the user via ask_user_question (closed_choice) or directly (open_text).",
     {
-      context: z5.string().optional().describe("Context about what the otter is trying to do"),
-      question_type: z5.enum(["closed_choice", "open_text"]).describe("Type of question being asked"),
-      question: z5.string().describe("The clarification question to ask the user"),
-      choices: z5.array(z5.string()).optional().describe("Options for closed_choice questions"),
-      priority: z5.enum(["blocking", "preferred", "optional"]).optional().default("preferred").describe("How critical is this clarification? Default: preferred"),
-      target_field: z5.string().optional().describe("What field/config does this clarify?")
+      context: z6.string().optional().describe("Context about what the otter is trying to do"),
+      question_type: z6.enum(["closed_choice", "open_text"]).describe("Type of question being asked"),
+      question: z6.string().describe("The clarification question to ask the user"),
+      choices: jsonCoerce(z6.array(z6.string()).optional()).describe(
+        "Options for closed_choice questions"
+      ),
+      priority: z6.enum(["blocking", "preferred", "optional"]).optional().default("preferred").describe("How critical is this clarification? Default: preferred"),
+      target_field: z6.string().optional().describe("What field/config does this clarify?")
     },
     async ({ context, question_type, question, choices, priority, target_field }) => {
       const result = handleClarify({
@@ -743,8 +791,10 @@ function registerClarificationTools(server2) {
     "stackwright_pro_detect_conflict",
     "Detect when a user's stated preference conflicts with their selected choices. Uses keyword heuristics against known contradiction patterns (minimal vs vibrant, dark vs light, etc). Returns conflict details and resolution options.",
     {
-      stated_preference: z5.string().describe("What the user said they wanted"),
-      selected_values: z5.record(z5.string(), z5.string()).describe("What the user actually selected (field \u2192 value)")
+      stated_preference: z6.string().describe("What the user said they wanted"),
+      selected_values: jsonCoerce(z6.record(z6.string(), z6.string())).describe(
+        "What the user actually selected (field \u2192 value)"
+      )
     },
     async ({ stated_preference, selected_values }) => {
       const result = handleDetectConflict({ stated_preference, selected_values });
@@ -789,7 +839,7 @@ ${result.resolution_options?.map((o) => `  \u2022 ${o}`).join("\n")}
 }
 
 // src/tools/packages.ts
-import { z as z6 } from "zod";
+import { z as z7 } from "zod";
 import { readFileSync, writeFileSync, existsSync, realpathSync, lstatSync } from "fs";
 import { execSync } from "child_process";
 import path2 from "path";
@@ -810,17 +860,23 @@ function registerPackageTools(server2) {
     "Ensures pro packages are present in a project's package.json. Safe to call multiple times \u2014 never overwrites existing version pins. Use this to bootstrap dependencies before specialist otters run. Pass includeBaseline: true to automatically include all required @stackwright-pro/* baseline dependencies. Safe to call on existing projects \u2014 never overwrites pinned versions.",
     {
       // FIX 3 (B-new-1): Zod v4 requires two-arg z.record(keySchema, valueSchema)
-      packages: z6.record(z6.string(), z6.string()).describe(
-        'Dependencies to add. Record<packageName, version>. e.g. { "@stackwright-pro/auth": "latest" }'
+      packages: jsonCoerce(z7.record(z7.string(), z7.string()).optional().default({})).describe(
+        'Dependencies to add. Record<packageName, version>. e.g. { "@stackwright-pro/auth": "latest" }. Omit or pass {} when using includeBaseline: true.'
+      ),
+      devPackages: jsonCoerce(z7.record(z7.string(), z7.string()).optional()).describe(
+        "devDependencies to add. Same format as packages."
       ),
-      devPackages: z6.record(z6.string(), z6.string()).optional().describe("devDependencies to add. Same format as packages."),
-      scripts: z6.record(z6.string(), z6.string()).optional().describe("npm scripts to add. Only adds if key does not already exist."),
-      targetDir: z6.string().optional().describe(
+      scripts: jsonCoerce(z7.record(z7.string(), z7.string()).optional()).describe(
+        "npm scripts to add. Only adds if key does not already exist."
+      ),
+      targetDir: z7.string().optional().describe(
         "Project directory containing package.json. Defaults to process.cwd(). Must be an absolute path within the current working directory."
       ),
-      runInstall: z6.boolean().optional().default(true).describe("Run pnpm install after writing package.json. Defaults to true."),
-      includeBaseline: z6.boolean().optional().default(false).describe(
-        "When true, automatically merges BASELINE_DEPS and BASELINE_DEV_DEPS before applying packages/devPackages args. Safe to call on existing projects \u2014 never overwrites pinned versions."
+      runInstall: boolCoerce(z7.boolean().optional().default(true)).describe(
+        "Run pnpm install after writing package.json. Defaults to true. Pass boolean true/false."
+      ),
+      includeBaseline: boolCoerce(z7.boolean().optional().default(false)).describe(
+        "When true, automatically merges BASELINE_DEPS and BASELINE_DEV_DEPS before applying packages/devPackages args. Safe to call on existing projects \u2014 never overwrites pinned versions. Pass boolean true/false."
       )
     },
     async ({ packages, devPackages, scripts, targetDir, runInstall, includeBaseline }) => {
@@ -978,11 +1034,11 @@ function setupPackages(opts) {
       }
     }
     const raw = readFileSync(realPackageJsonPath, "utf8");
-    const PackageJsonSchema = z6.object({
+    const PackageJsonSchema = z7.object({
       // Zod v4: z.record(keySchema, valueSchema) — two-arg form required
-      dependencies: z6.record(z6.string(), z6.string()).optional(),
-      devDependencies: z6.record(z6.string(), z6.string()).optional(),
-      scripts: z6.record(z6.string(), z6.string()).optional()
+      dependencies: z7.record(z7.string(), z7.string()).optional(),
+      devDependencies: z7.record(z7.string(), z7.string()).optional(),
+      scripts: z7.record(z7.string(), z7.string()).optional()
     }).passthrough();
     const schemaResult = PackageJsonSchema.safeParse(JSON.parse(raw));
     if (!schemaResult.success) {
@@ -1063,9 +1119,10 @@ function setupPackages(opts) {
 }
 
 // src/tools/questions.ts
-import { readFile } from "fs/promises";
+import { readFile, writeFile } from "fs/promises";
+import { existsSync as existsSync2, lstatSync as lstatSync2, mkdirSync, renameSync } from "fs";
 import { join } from "path";
-import { z as z7 } from "zod";
+import { z as z8 } from "zod";
 
 // src/question-adapter.ts
 function truncate(str, maxLength) {
@@ -1250,23 +1307,30 @@ function answersToManifestFormat(answers, questions) {
   return result;
 }
 
+// src/validation.ts
+var SAFE_PHASE = /^[a-z][a-z0-9-]{0,30}$/;
+var SAFE_QUESTION_ID = /^[a-z0-9][a-z0-9-]{0,63}$/i;
+function isValidPhase(phase) {
+  return SAFE_PHASE.test(phase);
+}
+
 // src/tools/questions.ts
-var ManifestQuestionSchema = z7.object({
-  id: z7.string(),
-  question: z7.string(),
-  type: z7.enum(["text", "select", "multi-select", "confirm"]),
-  required: z7.boolean().optional(),
-  options: z7.array(
-    z7.object({
-      label: z7.string(),
-      value: z7.string()
+var ManifestQuestionSchema = z8.object({
+  id: z8.string(),
+  question: z8.string(),
+  type: z8.enum(["text", "select", "multi-select", "confirm"]),
+  required: z8.boolean().optional(),
+  options: z8.array(
+    z8.object({
+      label: z8.string(),
+      value: z8.string()
     })
   ).optional(),
-  default: z7.union([z7.string(), z7.boolean(), z7.array(z7.string())]).optional(),
-  help: z7.string().optional(),
-  dependsOn: z7.object({
-    questionId: z7.string(),
-    value: z7.union([z7.string(), z7.array(z7.string())])
+  default: z8.union([z8.string(), z8.boolean(), z8.array(z8.string())]).optional(),
+  help: z8.string().optional(),
+  dependsOn: z8.object({
+    questionId: z8.string(),
+    value: z8.union([z8.string(), z8.array(z8.string())])
   }).optional()
 });
 function registerQuestionTools(server2) {
@@ -1274,15 +1338,16 @@ function registerQuestionTools(server2) {
     "stackwright_pro_present_phase_questions",
     "Adapt manifest-format questions from a specialist otter and present them to the user via ask_user_question. Pass only the phase name \u2014 this tool reads questions from .stackwright/question-manifest.json automatically. The questions parameter is optional and only needed if the manifest has not been written yet. Use this instead of calling ask_user_question directly \u2014 it handles label truncation (50-char limit), header generation, confirm/text defaults, and correct array formatting automatically. IMPORTANT: This is the ONLY approved way to prepare questions before calling ask_user_question. Never call ask_user_question with raw manifest questions. Never retry ask_user_question validation errors by calling it directly \u2014 always re-call this tool.",
     {
-      phase: z7.string().describe('Phase name for display context, e.g. "designer", "api", "auth"'),
-      questions: z7.array(ManifestQuestionSchema).optional().describe(
+      phase: z8.string().describe('Phase name for display context, e.g. "designer", "api", "auth"'),
+      questions: jsonCoerce(z8.array(ManifestQuestionSchema).optional()).describe(
         "Questions in Question Manifest format. If omitted, questions are read from .stackwright/question-manifest.json using the phase name."
       ),
-      answers: z7.record(z7.union([z7.string(), z7.array(z7.string()), z7.boolean()])).optional().describe("Previously collected answers used to resolve dependsOn conditions")
+      answers: jsonCoerce(
+        z8.record(z8.string(), z8.union([z8.string(), z8.array(z8.string()), z8.boolean()])).optional()
+      ).describe("Previously collected answers used to resolve dependsOn conditions")
     },
     async ({ phase, questions, answers }) => {
       let resolvedQuestions;
-      const SAFE_PHASE = /^[a-z][a-z0-9-]{0,30}$/;
       if (!SAFE_PHASE.test(phase)) {
         return {
           content: [
@@ -1329,17 +1394,36 @@ function registerQuestionTools(server2) {
         }
       }
       const adapted = adaptQuestions(resolvedQuestions, answers ?? {});
+      const labelSchema = z8.string().max(50, "Value should have at most 50 characters");
+      for (const q of adapted) {
+        for (const opt of q.options) {
+          const check = labelSchema.safeParse(opt.label);
+          if (!check.success) {
+            return {
+              content: [
+                {
+                  type: "text",
+                  text: JSON.stringify({
+                    error: `Option label for phase "${phase}" exceeds 50 characters: ${check.error.issues[0]?.message ?? "label too long"}. Truncate option labels to \u226450 characters before calling this tool.`
+                  })
+                }
+              ],
+              isError: true
+            };
+          }
+        }
+      }
       if (adapted.length === 0) {
         return {
           content: [
             {
               type: "text",
-              text: JSON.stringify({
-                phase,
-                skipped: true,
-                reason: "No questions to present (all filtered by dependsOn conditions)",
-                answers: []
-              })
+              text: `Phase "${phase}" has no questions to present. Do NOT call ask_user_question. Call stackwright_pro_save_phase_answers({ phase: "${phase}", rawAnswers: [] }) directly, then proceed to the execution step for this phase.`
+            },
+            {
+              type: "text",
+              // Empty array — second block always present so the foreman's two-block contract holds
+              text: JSON.stringify([])
             }
           ],
           isError: false
@@ -1360,31 +1444,175 @@ function registerQuestionTools(server2) {
       };
     }
   );
+  server2.tool(
+    "stackwright_pro_get_next_question",
+    "Returns the next unanswered question for a phase as a plain JSON object \u2014 one question at a time. Returns { done: true } when all questions are answered or the phase has no questions. Call this in a loop: present the question in plain chat, get user reply, call record_answer, repeat.",
+    { phase: z8.string().describe('Phase name e.g. "designer", "api", "auth"') },
+    async ({ phase }) => {
+      if (!SAFE_PHASE.test(phase)) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({ error: `Invalid phase name: "${phase.slice(0, 50)}"` })
+            }
+          ],
+          isError: true
+        };
+      }
+      const cwd = process.cwd();
+      const questionsPath = join(cwd, ".stackwright", "questions", `${phase}.json`);
+      let questions = [];
+      try {
+        const raw = await readFile(questionsPath, "utf-8");
+        const parsed = JSON.parse(raw);
+        questions = parsed.questions ?? [];
+      } catch {
+        return { content: [{ type: "text", text: JSON.stringify({ done: true }) }] };
+      }
+      if (questions.length === 0) {
+        return { content: [{ type: "text", text: JSON.stringify({ done: true }) }] };
+      }
+      const answersPath = join(cwd, ".stackwright", "answers", `${phase}.json`);
+      let answeredIds = /* @__PURE__ */ new Set();
+      try {
+        const raw = await readFile(answersPath, "utf-8");
+        const parsed = JSON.parse(raw);
+        answeredIds = new Set(Object.keys(parsed.answers ?? {}));
+      } catch {
+      }
+      const next = questions.find((q) => !answeredIds.has(q.id));
+      if (!next) {
+        return { content: [{ type: "text", text: JSON.stringify({ done: true }) }] };
+      }
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify({
+              done: false,
+              questionId: next.id,
+              question: next.question,
+              type: next.type,
+              options: next.options ?? null,
+              help: next.help ?? null,
+              index: questions.indexOf(next) + 1,
+              total: questions.length
+            })
+          }
+        ]
+      };
+    }
+  );
+  server2.tool(
+    "stackwright_pro_record_answer",
+    "Records a single answer to a phase question. Appends to .stackwright/answers/{phase}.json incrementally. Idempotent \u2014 calling twice for the same questionId overwrites. Call after receiving each user reply in the conversational question loop.",
+    {
+      phase: z8.string().describe('Phase name e.g. "designer"'),
+      questionId: z8.string().describe('The question ID from get_next_question, e.g. "designer-1"'),
+      answer: z8.string().describe("The user's free-text answer")
+    },
+    async ({ phase, questionId, answer }) => {
+      if (!SAFE_PHASE.test(phase)) {
+        return {
+          content: [
+            { type: "text", text: JSON.stringify({ error: "Invalid phase name" }) }
+          ],
+          isError: true
+        };
+      }
+      if (!SAFE_QUESTION_ID.test(questionId)) {
+        return {
+          content: [
+            { type: "text", text: JSON.stringify({ error: "Invalid questionId" }) }
+          ],
+          isError: true
+        };
+      }
+      const safeAnswer = answer.slice(0, 2e3);
+      const cwd = process.cwd();
+      const answersDir = join(cwd, ".stackwright", "answers");
+      const answersPath = join(answersDir, `${phase}.json`);
+      if (existsSync2(answersDir) && lstatSync2(answersDir).isSymbolicLink()) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({ error: "answers dir is a symlink \u2014 refusing to write" })
+            }
+          ],
+          isError: true
+        };
+      }
+      mkdirSync(answersDir, { recursive: true });
+      let existing = {
+        version: "1.0",
+        phase,
+        answers: {}
+      };
+      try {
+        if (existsSync2(answersPath)) {
+          if (lstatSync2(answersPath).isSymbolicLink()) {
+            return {
+              content: [
+                {
+                  type: "text",
+                  text: JSON.stringify({ error: "answers file is a symlink \u2014 refusing to write" })
+                }
+              ],
+              isError: true
+            };
+          }
+          const raw = await readFile(answersPath, "utf-8");
+          existing = JSON.parse(raw);
+        }
+      } catch {
+      }
+      existing.answers[questionId] = safeAnswer;
+      existing.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+      const tmp = `${answersPath}.tmp`;
+      await writeFile(tmp, JSON.stringify(existing, null, 2), "utf-8");
+      renameSync(tmp, answersPath);
+      return {
+        content: [
+          { type: "text", text: JSON.stringify({ recorded: true, phase, questionId }) }
+        ]
+      };
+    }
+  );
 }
 
 // src/tools/orchestration.ts
-import { z as z8 } from "zod";
-import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, existsSync as existsSync2, mkdirSync, lstatSync as lstatSync2 } from "fs";
+import { z as z9 } from "zod";
+import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, existsSync as existsSync3, mkdirSync as mkdirSync2, lstatSync as lstatSync3 } from "fs";
 import { join as join2 } from "path";
 var OTTER_NAME_TO_PHASE = [
   ["designer", "designer"],
   ["theme", "theme"],
+  ["scaffold", "scaffold"],
   ["api", "api"],
   ["auth", "auth"],
   ["dashboard", "dashboard"],
   ["data", "data"],
   ["page", "pages"],
-  ["workflow", "workflow"]
+  ["workflow", "workflow"],
+  ["services", "services"],
+  ["polish", "polish"],
+  ["geo", "geo"]
 ];
 var PHASE_TO_OTTER = {
   designer: "stackwright-pro-designer-otter",
   theme: "stackwright-pro-theme-otter",
+  scaffold: "stackwright-pro-scaffold-otter",
   api: "stackwright-pro-api-otter",
   auth: "stackwright-pro-auth-otter",
   pages: "stackwright-pro-page-otter",
   dashboard: "stackwright-pro-dashboard-otter",
   data: "stackwright-pro-data-otter",
-  workflow: "stackwright-pro-workflow-otter"
+  workflow: "stackwright-pro-workflow-otter",
+  services: "stackwright-services-otter",
+  polish: "stackwright-pro-polish-otter",
+  geo: "stackwright-pro-geo-otter"
 };
 function detectPhase(otterName) {
   const lower = otterName.toLowerCase();
@@ -1420,9 +1648,9 @@ function handleSaveManifest(input) {
   const dir = join2(cwd, ".stackwright");
   const filePath = join2(dir, "question-manifest.json");
   try {
-    mkdirSync(dir, { recursive: true });
-    if (existsSync2(filePath)) {
-      const stat = lstatSync2(filePath);
+    mkdirSync2(dir, { recursive: true });
+    if (existsSync3(filePath)) {
+      const stat = lstatSync3(filePath);
       if (stat.isSymbolicLink()) {
         const message = `Refusing to write to symlink: ${filePath}`;
         return {
@@ -1450,14 +1678,78 @@ function handleSaveManifest(input) {
   }
 }
 function handleSavePhaseAnswers(input) {
+  if (!isValidPhase(input.phase)) {
+    return {
+      text: JSON.stringify({
+        success: false,
+        error: `Invalid phase name: "${input.phase.slice(0, 50)}". Must be lowercase alphanumeric with hyphens, max 31 chars.`
+      }),
+      isError: true
+    };
+  }
+  for (let i = 0; i < input.rawAnswers.length; i++) {
+    const a = input.rawAnswers[i];
+    if (!a.question_header || a.question_header.trim().length === 0) {
+      return {
+        text: JSON.stringify({
+          success: false,
+          error: `rawAnswers[${i}].question_header is empty \u2014 every answer must have a non-empty question_header.`
+        }),
+        isError: true
+      };
+    }
+    if (!a.selected_options || a.selected_options.length === 0) {
+      return {
+        text: JSON.stringify({
+          success: false,
+          error: `rawAnswers[${i}].selected_options is empty for question_header "${a.question_header}" \u2014 every answer must have at least one selected option.`
+        }),
+        isError: true
+      };
+    }
+  }
+  if (input.questions && input.questions.length > 0 && input.rawAnswers.length === 0) {
+    return {
+      text: JSON.stringify({
+        success: false,
+        error: `${input.questions.length} questions provided but rawAnswers is empty \u2014 this is a malformed payload. If the phase truly has no questions, omit the questions parameter.`
+      }),
+      isError: true
+    };
+  }
   const cwd = input._cwd ?? process.cwd();
   const dir = join2(cwd, ".stackwright", "answers");
   const filePath = join2(dir, `${input.phase}.json`);
   try {
-    mkdirSync(dir, { recursive: true });
+    mkdirSync2(dir, { recursive: true });
+    const warnings = [];
     let answers;
     if (input.questions && input.questions.length > 0) {
-      answers = answersToManifestFormat(input.rawAnswers, input.questions);
+      try {
+        answers = answersToManifestFormat(input.rawAnswers, input.questions);
+      } catch (mapErr) {
+        answers = {};
+        warnings.push(
+          `Reverse-mapping threw (${mapErr instanceof Error ? mapErr.message : String(mapErr)}) \u2014 falling back to direct key mapping.`
+        );
+      }
+      if (Object.keys(answers).length === 0 && input.rawAnswers.length > 0) {
+        answers = Object.fromEntries(
+          input.rawAnswers.map((a) => [
+            a.question_header,
+            a.selected_options.length > 1 ? a.selected_options : a.selected_options[0] ?? ""
+          ])
+        );
+        warnings.push(
+          `Reverse-mapping produced empty answers despite ${input.rawAnswers.length} rawAnswers \u2014 used direct key mapping as fallback. Ensure question_header values match the manifest header format (e.g. "DESI-1", not descriptive keys).`
+        );
+      }
+      const requiredCount = input.questions.filter((q) => q.required !== false).length;
+      if (input.rawAnswers.length < requiredCount) {
+        warnings.push(
+          `Only ${input.rawAnswers.length} answers provided for ${requiredCount} required questions (${input.questions.length} total) \u2014 answers may be incomplete.`
+        );
+      }
     } else {
       answers = Object.fromEntries(
         input.rawAnswers.map((a) => [a.question_header, a.selected_options[0] ?? ""])
@@ -1469,8 +1761,8 @@ function handleSavePhaseAnswers(input) {
       completedAt: (/* @__PURE__ */ new Date()).toISOString(),
       answers
     };
-    if (existsSync2(filePath)) {
-      const stat = lstatSync2(filePath);
+    if (existsSync3(filePath)) {
+      const stat = lstatSync3(filePath);
       if (stat.isSymbolicLink()) {
         const message = `Refusing to write to symlink: ${filePath}`;
         return {
@@ -1484,7 +1776,8 @@ function handleSavePhaseAnswers(input) {
       text: JSON.stringify({
         success: true,
         path: filePath,
-        answersCount: Object.keys(answers).length
+        answersCount: Object.keys(answers).length,
+        ...warnings.length > 0 ? { warnings } : {}
       }),
       isError: false
     };
@@ -1499,7 +1792,7 @@ function handleSavePhaseAnswers(input) {
 function handleReadPhaseAnswers(input) {
   const cwd = input._cwd ?? process.cwd();
   const filePath = join2(cwd, ".stackwright", "answers", `${input.phase}.json`);
-  if (!existsSync2(filePath)) {
+  if (!existsSync3(filePath)) {
     return {
       text: JSON.stringify({ missing: true, phase: input.phase }),
       isError: false
@@ -1531,13 +1824,63 @@ function handleGetOtterName(input) {
     isError: false
   };
 }
+function handleSaveBuildContext(input) {
+  const cwd = input._cwd ?? process.cwd();
+  const dir = join2(cwd, ".stackwright");
+  const filePath = join2(dir, "build-context.json");
+  try {
+    mkdirSync2(dir, { recursive: true });
+    if (existsSync3(filePath)) {
+      const stat = lstatSync3(filePath);
+      if (stat.isSymbolicLink()) {
+        return {
+          text: JSON.stringify({
+            success: false,
+            error: `Refusing to write to symlink: ${filePath}`
+          }),
+          isError: true
+        };
+      }
+    }
+    const payload = {
+      version: "1.0",
+      savedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      buildContext: input.buildContext
+    };
+    writeFileSync2(filePath, JSON.stringify(payload, null, 2) + "\n");
+    return {
+      text: JSON.stringify({ success: true, path: filePath }),
+      isError: false
+    };
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return {
+      text: JSON.stringify({ success: false, error: message }),
+      isError: true
+    };
+  }
+}
 function registerOrchestrationTools(server2) {
+  server2.tool(
+    "stackwright_pro_save_build_context",
+    `Save the user's initial build description to .stackwright/build-context.json. Call this once at startup after the user answers the opening "what are you building" question. The saved context is automatically prepended to specialist prompts by stackwright_pro_build_specialist_prompt.`,
+    {
+      buildContext: z9.string().describe("Free-text description of what the user wants to build")
+    },
+    async ({ buildContext }) => {
+      const { text, isError } = handleSaveBuildContext({ buildContext });
+      return {
+        content: [{ type: "text", text }],
+        isError
+      };
+    }
+  );
   server2.tool(
     "stackwright_pro_parse_otter_response",
     "Parse and validate a specialist otter's QUESTION_COLLECTION_MODE JSON response. Handles JSON extraction from LLM responses (strips markdown, fixes single quotes, trailing commas). Detects the phase from the otter name. Use this immediately after invoke_agent() to get a validated manifest phase object.",
     {
-      otterName: z8.string().describe('The agent name, e.g. "stackwright-pro-api-otter"'),
-      responseText: z8.string().describe("Raw text response from the otter's QUESTION_COLLECTION_MODE invocation")
+      otterName: z9.string().describe('The agent name, e.g. "stackwright-pro-api-otter"'),
+      responseText: z9.string().describe("Raw text response from the otter's QUESTION_COLLECTION_MODE invocation")
     },
     async ({ otterName, responseText }) => {
       const { result, isError } = handleParseOtterResponse({ otterName, responseText });
@@ -1551,16 +1894,18 @@ function registerOrchestrationTools(server2) {
     "stackwright_pro_save_manifest",
     "Write the question manifest to .stackwright/question-manifest.json. Call this after collecting and parsing questions from all otters via stackwright_pro_parse_otter_response.",
     {
-      phases: z8.array(
-        z8.object({
-          phase: z8.string(),
-          otter: z8.string(),
-          questions: z8.array(z8.any()),
-          requiredPackages: z8.object({
-            dependencies: z8.record(z8.string(), z8.string()).optional(),
-            devPackages: z8.record(z8.string(), z8.string()).optional()
-          }).optional()
-        })
+      phases: jsonCoerce(
+        z9.array(
+          z9.object({
+            phase: z9.string(),
+            otter: z9.string(),
+            questions: z9.array(z9.any()),
+            requiredPackages: z9.object({
+              dependencies: z9.record(z9.string(), z9.string()).optional(),
+              devPackages: z9.record(z9.string(), z9.string()).optional()
+            }).optional()
+          })
+        )
       ).describe("Array of parsed phase objects from stackwright_pro_parse_otter_response")
     },
     async ({ phases }) => {
@@ -1575,15 +1920,37 @@ function registerOrchestrationTools(server2) {
     "stackwright_pro_save_phase_answers",
     "Save user answers for a phase to .stackwright/answers/{phase}.json. Pass rawAnswers directly from ask_user_question and the original manifest questions for label-to-value reverse mapping.",
     {
-      phase: z8.string().describe('Phase name, e.g. "designer"'),
-      rawAnswers: z8.array(
-        z8.object({
-          question_header: z8.string(),
-          selected_options: z8.array(z8.string()),
-          other_text: z8.string().nullable().optional()
-        })
-      ).describe("Answers as returned by ask_user_question"),
-      questions: z8.array(z8.any()).optional().describe("Original manifest questions for label\u2192value reverse-mapping")
+      phase: z9.string().describe('Phase name, e.g. "designer"'),
+      rawAnswers: jsonCoerce(
+        z9.array(
+          z9.object({
+            question_header: z9.string().min(1, "question_header must not be empty"),
+            selected_options: z9.array(z9.string()).min(1, "selected_options must have at least one entry"),
+            other_text: z9.string().nullable().optional()
+          })
+        )
+      ).describe(
+        "Answers as returned by ask_user_question \u2014 pass the native array, not a JSON string"
+      ),
+      questions: jsonCoerce(
+        z9.array(
+          z9.object({
+            id: z9.string(),
+            question: z9.string(),
+            type: z9.string(),
+            options: z9.array(z9.object({ label: z9.string(), value: z9.string() })).optional(),
+            required: z9.boolean().optional(),
+            default: z9.union([z9.string(), z9.boolean(), z9.array(z9.string())]).optional(),
+            help: z9.string().optional(),
+            dependsOn: z9.object({
+              questionId: z9.string(),
+              value: z9.union([z9.string(), z9.array(z9.string())])
+            }).optional()
+          }).passthrough()
+        ).optional()
+      ).describe(
+        "Original manifest questions for label\u2192value reverse-mapping \u2014 pass the native array, not a JSON string"
+      )
     },
     async ({ phase, rawAnswers, questions }) => {
       const { text, isError } = handleSavePhaseAnswers({
@@ -1601,7 +1968,7 @@ function registerOrchestrationTools(server2) {
     "stackwright_pro_read_phase_answers",
     "Read saved answers for a phase from .stackwright/answers/{phase}.json. Returns { missing: true } when no answers exist yet \u2014 use this to skip phases safely in the execution loop.",
     {
-      phase: z8.string().describe('Phase name, e.g. "designer"')
+      phase: z9.string().describe('Phase name, e.g. "designer"')
     },
     async ({ phase }) => {
       const { text, isError } = handleReadPhaseAnswers({ phase });
@@ -1615,7 +1982,7 @@ function registerOrchestrationTools(server2) {
     "stackwright_pro_get_otter_name",
     "Get the agent name for a phase (e.g. 'designer' \u2192 'stackwright-pro-designer-otter'). Use this in the execution loop to invoke the correct specialist otter without hardcoding names in the prompt.",
     {
-      phase: z8.string().describe('Phase name, e.g. "designer", "api", "pages"')
+      phase: z9.string().describe('Phase name, e.g. "designer", "api", "pages"')
     },
     async ({ phase }) => {
       const { text, isError } = handleGetOtterName({ phase });
@@ -1628,53 +1995,777 @@ function registerOrchestrationTools(server2) {
 }
 
 // src/tools/pipeline.ts
-import { z as z9 } from "zod";
-import { readFileSync as readFileSync3, writeFileSync as writeFileSync3, existsSync as existsSync3, mkdirSync as mkdirSync2, lstatSync as lstatSync3 } from "fs";
+import { z as z13 } from "zod";
+import { readFileSync as readFileSync4, writeFileSync as writeFileSync4, existsSync as existsSync5, mkdirSync as mkdirSync4, lstatSync as lstatSync5 } from "fs";
+import { join as join4 } from "path";
+import { createHash as createHash3 } from "crypto";
+
+// src/artifact-signing.ts
+import {
+  createHash as createHash2,
+  generateKeyPairSync,
+  createPublicKey,
+  createPrivateKey,
+  sign,
+  verify,
+  timingSafeEqual
+} from "crypto";
+import {
+  readFileSync as readFileSync3,
+  writeFileSync as writeFileSync3,
+  existsSync as existsSync4,
+  mkdirSync as mkdirSync3,
+  lstatSync as lstatSync4,
+  unlinkSync,
+  readdirSync
+} from "fs";
 import { join as join3 } from "path";
-var PHASE_ORDER = [
-  "designer",
-  "theme",
-  "api",
-  "auth",
-  "data",
-  "pages",
-  "dashboard",
-  "workflow"
-];
-var PHASE_DEPENDENCIES = {
-  designer: [],
-  theme: ["designer"],
-  api: [],
-  auth: [],
-  data: ["api"],
-  pages: ["designer", "theme", "api", "data", "auth"],
-  dashboard: ["designer", "theme", "api", "data"],
-  workflow: ["auth"]
-};
-var PHASE_ARTIFACT = {
-  designer: "design-language.json",
-  theme: "theme-tokens.json",
-  api: "api-config.json",
-  auth: "auth-config.json",
-  data: "data-config.json",
-  pages: "pages-manifest.json",
-  dashboard: "dashboard-manifest.json",
-  workflow: "workflow-config.json"
-};
-var PHASE_TO_OTTER2 = {
-  designer: "stackwright-pro-designer-otter",
-  theme: "stackwright-pro-theme-otter",
-  api: "stackwright-pro-api-otter",
-  auth: "stackwright-pro-auth-otter",
-  data: "stackwright-pro-data-otter",
-  pages: "stackwright-pro-page-otter",
-  dashboard: "stackwright-pro-dashboard-otter",
-  workflow: "stackwright-pro-workflow-otter"
-};
-function isValidPhase(phase) {
-  return PHASE_ORDER.includes(phase);
-}
-function defaultPhaseStatus() {
+import { z as z10 } from "zod";
+var ALGORITHM = "ECDSA-P384-SHA384";
+var KEY_FILE = "pipeline-keys.json";
+var KEY_DIR = ".stackwright";
+var SIGNATURE_MANIFEST = "signatures.json";
+var ARTIFACTS_DIR = ".stackwright/artifacts";
+function rejectSymlink(filePath, context) {
+  if (!existsSync4(filePath)) return;
+  const stat = lstatSync4(filePath);
+  if (stat.isSymbolicLink()) {
+    throw new Error(`Security: refusing to follow symlink at ${context}: ${filePath}`);
+  }
+}
+function computeSha384(data) {
+  return createHash2("sha384").update(data).digest("hex");
+}
+function safeDigestEqual(a, b) {
+  if (a.length !== b.length) return false;
+  return timingSafeEqual(Buffer.from(a, "utf8"), Buffer.from(b, "utf8"));
+}
+function emptyManifest() {
+  return {
+    version: "1.0",
+    algorithm: ALGORITHM,
+    signatures: {}
+  };
+}
+function initPipelineKeys(cwd) {
+  const keyDir = join3(cwd, KEY_DIR);
+  const keyPath = join3(keyDir, KEY_FILE);
+  rejectSymlink(keyPath, "pipeline-keys.json");
+  mkdirSync3(keyDir, { recursive: true });
+  const { publicKey, privateKey } = generateKeyPairSync("ec", {
+    namedCurve: "P-384"
+  });
+  const publicKeyPem = publicKey.export({ type: "spki", format: "pem" });
+  const privateKeyPem = privateKey.export({ type: "pkcs8", format: "pem" });
+  const fingerprint = createHash2("sha256").update(publicKeyPem).digest("hex");
+  const keyFile = {
+    version: "1.0",
+    algorithm: ALGORITHM,
+    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+    publicKeyPem,
+    privateKeyPem
+  };
+  writeFileSync3(keyPath, JSON.stringify(keyFile, null, 2), { encoding: "utf-8" });
+  return { publicKeyPem, fingerprint };
+}
+function loadPipelineKeys(cwd) {
+  const keyPath = join3(cwd, KEY_DIR, KEY_FILE);
+  rejectSymlink(keyPath, "pipeline-keys.json");
+  if (!existsSync4(keyPath)) {
+    throw new Error("Pipeline keys not found \u2014 call initPipelineKeys() first");
+  }
+  let raw;
+  try {
+    raw = readFileSync3(keyPath, "utf-8");
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    throw new Error(`Cannot read pipeline keys: ${msg}`, { cause: err });
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error("Pipeline keys file is not valid JSON");
+  }
+  if (typeof parsed.publicKeyPem !== "string" || !parsed.publicKeyPem.includes("-----BEGIN PUBLIC KEY-----")) {
+    throw new Error("Invalid public key PEM in pipeline keys file");
+  }
+  if (typeof parsed.privateKeyPem !== "string" || !parsed.privateKeyPem.includes("-----BEGIN")) {
+    throw new Error("Invalid private key PEM in pipeline keys file");
+  }
+  const publicKey = createPublicKey(parsed.publicKeyPem);
+  const privateKey = createPrivateKey(parsed.privateKeyPem);
+  return { privateKey, publicKey };
+}
+function signArtifact(artifactBytes, privateKey) {
+  const digest = computeSha384(artifactBytes);
+  const sig = sign("SHA384", artifactBytes, privateKey);
+  return {
+    digest,
+    signature: sig.toString("base64"),
+    algorithm: ALGORITHM,
+    signedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function verifyArtifact(artifactBytes, signature, publicKey) {
+  const sigValid = verify(
+    "SHA384",
+    artifactBytes,
+    publicKey,
+    Buffer.from(signature.signature, "base64")
+  );
+  if (!sigValid) return false;
+  const actualDigest = computeSha384(artifactBytes);
+  return safeDigestEqual(actualDigest, signature.digest);
+}
+function loadSignatureManifest(cwd) {
+  const manifestPath = join3(cwd, ARTIFACTS_DIR, SIGNATURE_MANIFEST);
+  rejectSymlink(manifestPath, "signatures.json");
+  if (!existsSync4(manifestPath)) return emptyManifest();
+  let raw;
+  try {
+    raw = readFileSync3(manifestPath, "utf-8");
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    throw new Error(`Cannot read signature manifest: ${msg}`, { cause: err });
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    if (parsed.version !== "1.0" || typeof parsed.signatures !== "object") {
+      throw new Error("Malformed signature manifest: invalid version or missing signatures object");
+    }
+    return parsed;
+  } catch (err) {
+    if (err instanceof Error && err.message.startsWith("Malformed")) throw err;
+    throw new Error("Signature manifest is not valid JSON", { cause: err });
+  }
+}
+function saveArtifactSignature(cwd, artifactFilename, sig, signerOtter) {
+  const artifactsDir = join3(cwd, ARTIFACTS_DIR);
+  const manifestPath = join3(artifactsDir, SIGNATURE_MANIFEST);
+  rejectSymlink(manifestPath, "signatures.json (save)");
+  mkdirSync3(artifactsDir, { recursive: true });
+  const manifest = loadSignatureManifest(cwd);
+  manifest.signatures[artifactFilename] = {
+    ...sig,
+    signedBy: signerOtter
+  };
+  writeFileSync3(manifestPath, JSON.stringify(manifest, null, 2), { encoding: "utf-8" });
+}
+function getArtifactSignature(cwd, artifactFilename) {
+  const manifest = loadSignatureManifest(cwd);
+  const entry = manifest.signatures[artifactFilename];
+  if (!entry) return null;
+  return {
+    digest: entry.digest,
+    signature: entry.signature,
+    algorithm: entry.algorithm,
+    signedAt: entry.signedAt
+  };
+}
+function emitSignatureAuditEvent(params) {
+  const record = JSON.stringify({
+    level: "AUDIT",
+    event: "ARTIFACT_SIGNATURE_FAIL",
+    timestamp: params.timestamp,
+    source: params.source,
+    artifactFilename: params.artifactFilename,
+    expectedDigest: params.expectedDigest,
+    actualDigest: params.actualDigest,
+    phase: params.phase
+  });
+  process.stderr.write(`ARTIFACT_SIGNATURE_FAIL ${record}
+`);
+}
+function registerArtifactSigningTools(server2) {
+  server2.tool(
+    "stackwright_pro_verify_artifact_signatures",
+    "Verify ECDSA P-384 signatures for all pipeline artifacts in .stackwright/artifacts/. Auto-discovers keys from .stackwright/pipeline-keys.json. Returns per-artifact verification status.",
+    {
+      cwd: z10.string().optional().describe("Project root directory. Defaults to process.cwd().")
+    },
+    async ({ cwd: cwdParam }) => {
+      const cwd = cwdParam ?? process.cwd();
+      let publicKey;
+      try {
+        const keys = loadPipelineKeys(cwd);
+        publicKey = keys.publicKey;
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({
+                error: true,
+                message: `Cannot load pipeline keys: ${msg}`
+              })
+            }
+          ],
+          isError: true
+        };
+      }
+      let manifest;
+      try {
+        manifest = loadSignatureManifest(cwd);
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({
+                error: true,
+                message: `Cannot load signature manifest: ${msg}`
+              })
+            }
+          ],
+          isError: true
+        };
+      }
+      const artifactsPath = join3(cwd, ARTIFACTS_DIR);
+      let artifactFiles = [];
+      try {
+        if (existsSync4(artifactsPath)) {
+          artifactFiles = readdirSync(artifactsPath).filter(
+            (f) => f.endsWith(".json") && f !== SIGNATURE_MANIFEST
+          );
+        }
+      } catch {
+      }
+      const results = [];
+      let hasFailure = false;
+      for (const filename of artifactFiles) {
+        const filePath = join3(artifactsPath, filename);
+        try {
+          rejectSymlink(filePath, `artifact ${filename}`);
+        } catch {
+          results.push({
+            filename,
+            verified: false,
+            error: "Refusing to verify symlink"
+          });
+          hasFailure = true;
+          continue;
+        }
+        let artifactBytes;
+        try {
+          artifactBytes = readFileSync3(filePath);
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : String(err);
+          results.push({
+            filename,
+            verified: false,
+            error: `Cannot read artifact: ${msg}`
+          });
+          hasFailure = true;
+          continue;
+        }
+        const entry = manifest.signatures[filename];
+        if (!entry) {
+          results.push({
+            filename,
+            verified: false,
+            error: "No signature found in manifest"
+          });
+          hasFailure = true;
+          continue;
+        }
+        const sig = {
+          digest: entry.digest,
+          signature: entry.signature,
+          algorithm: entry.algorithm,
+          signedAt: entry.signedAt
+        };
+        const verified = verifyArtifact(artifactBytes, sig, publicKey);
+        if (!verified) {
+          const actualDigest = computeSha384(artifactBytes);
+          emitSignatureAuditEvent({
+            artifactFilename: filename,
+            expectedDigest: sig.digest,
+            actualDigest,
+            phase: entry.signedBy ?? "unknown",
+            timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+            source: "stackwright_pro_verify_artifact_signatures"
+          });
+          results.push({
+            filename,
+            verified: false,
+            error: `Signature verification failed \u2014 artifact may have been tampered with`,
+            signedBy: entry.signedBy,
+            signedAt: entry.signedAt
+          });
+          hasFailure = true;
+        } else {
+          results.push({
+            filename,
+            verified: true,
+            signedBy: entry.signedBy,
+            signedAt: entry.signedAt
+          });
+        }
+      }
+      for (const manifestFilename of Object.keys(manifest.signatures)) {
+        if (!artifactFiles.includes(manifestFilename)) {
+          results.push({
+            filename: manifestFilename,
+            verified: false,
+            error: "Artifact referenced in manifest but missing from disk"
+          });
+          hasFailure = true;
+        }
+      }
+      const verifiedCount = results.filter((r) => r.verified).length;
+      const failedCount = results.filter((r) => !r.verified).length;
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify({
+              totalArtifacts: artifactFiles.length,
+              verifiedCount,
+              failedCount,
+              results,
+              ...hasFailure ? {
+                error: "SIGNATURE VERIFICATION FAILED: One or more artifact signatures are invalid. Do not proceed \u2014 artifacts may have been tampered with."
+              } : {}
+            })
+          }
+        ],
+        isError: hasFailure
+      };
+    }
+  );
+}
+
+// src/tools/pipeline.ts
+import { WorkflowFileSchema, authConfigSchema as authConfigSchema3 } from "@stackwright-pro/types";
+
+// src/tools/get-schema.ts
+import { z as z12 } from "zod";
+import {
+  WorkflowStepSchema as WorkflowStepSchema2,
+  WorkflowDefinitionSchema as WorkflowDefinitionSchema2,
+  WorkflowFieldSchema as WorkflowFieldSchema2,
+  WorkflowActionSchema as WorkflowActionSchema2,
+  authConfigSchema as authConfigSchema2
+} from "@stackwright-pro/types";
+
+// src/tools/validate-yaml-fragment.ts
+import { z as z11 } from "zod";
+import { load as yamlLoad } from "js-yaml";
+import {
+  WorkflowStepSchema,
+  WorkflowDefinitionSchema,
+  WorkflowFieldSchema,
+  WorkflowActionSchema,
+  authConfigSchema
+} from "@stackwright-pro/types";
+var SUPPORTED_SCHEMA_NAMES = [
+  "workflow_step",
+  "workflow_definition",
+  "workflow_field",
+  "workflow_action",
+  "navigation_item",
+  "auth_config"
+];
+var NavigationLinkSchema = z11.lazy(
+  () => z11.object({
+    label: z11.string().min(1),
+    href: z11.string().min(1),
+    children: z11.array(NavigationLinkSchema).optional()
+  })
+);
+var NavigationSectionSchema = z11.object({
+  section: z11.string().min(1),
+  items: z11.array(NavigationLinkSchema)
+});
+var NavigationItemSchema = z11.union([
+  NavigationLinkSchema,
+  NavigationSectionSchema
+]);
+var FIELD_SYNONYMS = {
+  workflow_step: {
+    title: "label",
+    name: "label (at step level, use label: not name:)",
+    description: "message (use message: for step-level descriptive text)",
+    style: 'theme.variant \u2014 use theme: { variant: "primary" } not style: "primary"',
+    transitions: 'on_submit.transition \u2014 use on_submit: { transition: "next_step" } not transitions: [{then:...}]'
+  },
+  workflow_definition: {
+    title: "label",
+    name: "label (workflow-level label, not name:)",
+    description: "description is valid here \u2014 but message: is not (that is a step field)",
+    type: "id (workflows are identified by id:, not type:)"
+  },
+  workflow_field: {
+    id: "name (field-level identifier is name:, NOT id:)",
+    title: "label (field display text is label:, NOT title:)",
+    description: "placeholder or label (no description field on WorkflowField)"
+  },
+  workflow_action: {
+    style: 'theme.variant \u2014 use theme: { variant: "primary" } not style: "primary"',
+    then: "transition (action-level next-step is transition:, NOT then:)",
+    on_click: 'action: "service:..." (extract the service reference from on_click.action)',
+    title: "label (action display text is label:, NOT title:)",
+    name: "label (action display text is label:, NOT name:)"
+  },
+  navigation_item: {
+    children: "items (NavigationSection uses items: not children: \u2014 also use section: instead of label: for section headers)",
+    label: 'section (if this is a nav group/section, use section: "Title" and items: [...], not label:)',
+    title: "section (NavigationSection header field is section:, NOT title:)"
+  },
+  auth_config: {
+    method: 'type \u2014 auth config discriminates on type: "oidc" | "pki", NOT method:',
+    provider_type: 'type \u2014 use type: "oidc" or type: "pki"',
+    strategy: "type \u2014 top-level discriminator is type:, not strategy:"
+  }
+};
+function getSchema(name) {
+  switch (name) {
+    case "workflow_step":
+      return WorkflowStepSchema;
+    case "workflow_definition":
+      return WorkflowDefinitionSchema;
+    case "workflow_field":
+      return WorkflowFieldSchema;
+    case "workflow_action":
+      return WorkflowActionSchema;
+    case "navigation_item":
+      return NavigationItemSchema;
+    case "auth_config":
+      return authConfigSchema;
+  }
+}
+function enrichErrors(issues, synonyms) {
+  return issues.map((issue) => {
+    const pathStr = issue.path.join(".");
+    const lastSegment = issue.path[issue.path.length - 1];
+    const fieldName = typeof lastSegment === "string" ? lastSegment : void 0;
+    const didYouMean = fieldName ? synonyms[fieldName] : void 0;
+    return {
+      path: pathStr || "(root)",
+      message: issue.message,
+      ...didYouMean ? { didYouMean } : {}
+    };
+  });
+}
+function handleValidateYamlFragment(input) {
+  const { schemaName, yaml } = input;
+  if (!SUPPORTED_SCHEMA_NAMES.includes(schemaName)) {
+    return {
+      valid: false,
+      parseError: `Unknown schemaName: "${schemaName}". Supported: ${SUPPORTED_SCHEMA_NAMES.join(", ")}`
+    };
+  }
+  const name = schemaName;
+  let parsed;
+  try {
+    parsed = yamlLoad(yaml);
+  } catch (err) {
+    return {
+      valid: false,
+      parseError: `YAML parse error: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+  const schema = getSchema(name);
+  const result = schema.safeParse(parsed);
+  if (result.success) {
+    return { valid: true };
+  }
+  const synonyms = FIELD_SYNONYMS[name];
+  const errors = enrichErrors(result.error.issues, synonyms);
+  return { valid: false, errors };
+}
+function registerValidateYamlFragmentTool(server2) {
+  server2.tool(
+    "stackwright_pro_validate_yaml_fragment",
+    'Validates a YAML snippet against a canonical Zod schema before writing to disk. Returns actionable errors with "did you mean?" suggestions for common field-name drift (title vs label, id vs name, style vs theme.variant, etc.). Call this before stackwright_pro_safe_write to catch schema violations in-session.',
+    {
+      schemaName: z11.enum(SUPPORTED_SCHEMA_NAMES).describe(
+        "Schema to validate against. One of: workflow_step, workflow_definition, workflow_field, workflow_action, navigation_item, auth_config"
+      ),
+      yaml: z11.string().describe("YAML string to validate (can also be JSON \u2014 js-yaml parses both)")
+    },
+    async ({ schemaName, yaml }) => {
+      const result = handleValidateYamlFragment({ schemaName, yaml });
+      return {
+        content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+      };
+    }
+  );
+}
+
+// src/tools/get-schema.ts
+var NavigationLinkSchema2 = z12.lazy(
+  () => z12.object({
+    label: z12.string().min(1),
+    href: z12.string().min(1),
+    children: z12.array(NavigationLinkSchema2).optional()
+  })
+);
+var NavigationSectionSchema2 = z12.object({
+  section: z12.string().min(1),
+  items: z12.array(NavigationLinkSchema2)
+});
+var NavigationItemSchema2 = z12.union([
+  NavigationLinkSchema2,
+  NavigationSectionSchema2
+]);
+function getZodSchema(name) {
+  switch (name) {
+    case "workflow_step":
+      return WorkflowStepSchema2;
+    case "workflow_definition":
+      return WorkflowDefinitionSchema2;
+    case "workflow_field":
+      return WorkflowFieldSchema2;
+    case "workflow_action":
+      return WorkflowActionSchema2;
+    case "navigation_item":
+      return NavigationItemSchema2;
+    case "auth_config":
+      return authConfigSchema2;
+  }
+}
+function formatType(node, depth = 0) {
+  if (node.const !== void 0) return JSON.stringify(node.const);
+  if (node.enum) return node.enum.map((v) => JSON.stringify(v)).join(" | ");
+  if (node.oneOf || node.anyOf) {
+    const branches = node.oneOf ?? node.anyOf ?? [];
+    return branches.map((b) => {
+      const disc = b.properties ? Object.entries(b.properties).filter(([, v]) => v.const !== void 0).map(([k, v]) => `${k}: ${JSON.stringify(v.const)}`).join(", ") : "";
+      return disc ? `{ ${disc}, ... }` : "{ ... }";
+    }).join(" | ");
+  }
+  if (node.type === "array" && node.items) {
+    return `${formatType(node.items, depth)}[]`;
+  }
+  if (node.type === "object" && node.properties && depth < 2) {
+    const inner = Object.entries(node.properties).map(([k, v]) => `${k}: ${formatType(v, depth + 1)}`).join(", ");
+    return `{ ${inner} }`;
+  }
+  const base = Array.isArray(node.type) ? node.type.join(" | ") : node.type ?? "unknown";
+  const constraints = [];
+  if (node.maxLength !== void 0) constraints.push(`max ${node.maxLength} chars`);
+  if (node.minLength !== void 0) constraints.push(`min ${node.minLength} chars`);
+  if (node.pattern) constraints.push(`pattern: ${node.pattern}`);
+  if (node.minimum !== void 0) constraints.push(`min ${node.minimum}`);
+  if (node.maximum !== void 0) constraints.push(`max ${node.maximum}`);
+  return constraints.length > 0 ? `${base} (${constraints.join(", ")})` : base;
+}
+function formatObjectSchema(node, schemaName, synonyms) {
+  const lines = [];
+  const displayName = schemaName.split("_").map((w) => w[0].toUpperCase() + w.slice(1)).join("");
+  lines.push(`${displayName}:`);
+  if (node.oneOf || node.anyOf) {
+    const branches = node.oneOf ?? node.anyOf ?? [];
+    lines.push("  Discriminated union \u2014 choose one variant:");
+    for (const branch of branches) {
+      const req = new Set(branch.required ?? []);
+      const disc = Object.entries(branch.properties ?? {}).filter(([, v]) => v.const !== void 0).map(([k, v]) => `${k}: ${JSON.stringify(v.const)}`).join(", ");
+      lines.push(`  VARIANT (${disc}):`);
+      for (const [field, fieldNode] of Object.entries(branch.properties ?? {})) {
+        if (fieldNode.const !== void 0) continue;
+        const isRequired = req.has(field);
+        const hint = synonyms[field] ? `  -- WARNING: use ${field}: not ${synonyms[field]}` : "";
+        lines.push(
+          `    ${isRequired ? "REQUIRED" : "optional"}: ${field}: ${formatType(fieldNode)}${hint}`
+        );
+      }
+    }
+    return lines.join("\n");
+  }
+  const required = new Set(node.required ?? []);
+  const properties = node.properties ?? {};
+  const requiredFields = Object.entries(properties).filter(([k]) => required.has(k));
+  const optionalFields = Object.entries(properties).filter(([k]) => !required.has(k));
+  if (requiredFields.length > 0) {
+    lines.push("  REQUIRED:");
+    for (const [field, fieldNode] of requiredFields) {
+      const typeStr = formatType(fieldNode);
+      const warn = synonyms[field] ? `  -- CAUTION: this schema uses ${field}` : "";
+      lines.push(`    ${field}: ${typeStr}${warn}`);
+    }
+  }
+  if (optionalFields.length > 0) {
+    lines.push("  OPTIONAL:");
+    for (const [field, fieldNode] of optionalFields) {
+      const typeStr = formatType(fieldNode);
+      lines.push(`    ${field}: ${typeStr}`);
+    }
+  }
+  return lines.join("\n");
+}
+function handleGetSchema(input) {
+  const { schemaName } = input;
+  if (!SUPPORTED_SCHEMA_NAMES.includes(schemaName)) {
+    return {
+      error: `Unknown schemaName: "${schemaName}". Supported: ${SUPPORTED_SCHEMA_NAMES.join(", ")}`
+    };
+  }
+  const name = schemaName;
+  const schema = getZodSchema(name);
+  const synonyms = FIELD_SYNONYMS[name];
+  let jsonSchema;
+  try {
+    const raw = z12.toJSONSchema(schema, { unrepresentable: "any" });
+    jsonSchema = raw;
+  } catch {
+    jsonSchema = { type: "object", description: "Schema introspection unavailable for this type" };
+  }
+  const summary = formatObjectSchema(jsonSchema, name, synonyms);
+  const synonymWarnings = Object.entries(synonyms).map(
+    ([wrong, correct]) => `  WARNING: use "${correct}" \u2014 NOT "${wrong}"`
+  );
+  const fullText = [
+    summary,
+    "",
+    "FIELD NAME WARNINGS (common drift patterns):",
+    ...synonymWarnings
+  ].join("\n");
+  const tokenEstimate = Math.ceil(fullText.length / 4);
+  return {
+    schemaName: name,
+    summary,
+    synonymWarnings,
+    tokenEstimate
+  };
+}
+var PHASE_SCHEMA_NAMES = {
+  workflow: ["workflow_step", "workflow_definition", "workflow_field", "workflow_action"],
+  pages: ["navigation_item"],
+  dashboard: ["navigation_item"],
+  polish: ["navigation_item"],
+  auth: ["auth_config"]
+};
+function buildSchemaReferenceBlock(phase) {
+  const schemaNames = PHASE_SCHEMA_NAMES[phase];
+  if (!schemaNames || schemaNames.length === 0) return null;
+  const sections = [
+    "CANONICAL_SCHEMA_REFERENCE (authoritative \u2014 use exact field names below):",
+    ""
+  ];
+  for (const name of schemaNames) {
+    const result = handleGetSchema({ schemaName: name });
+    if ("error" in result) continue;
+    sections.push(result.summary);
+    if (result.synonymWarnings.length > 0) {
+      sections.push("  Common mistakes to avoid:");
+      sections.push(...result.synonymWarnings);
+    }
+    sections.push("");
+  }
+  return sections.join("\n");
+}
+function registerGetSchemaTool(server2) {
+  server2.tool(
+    "stackwright_pro_get_schema",
+    'Returns a compact, LLM-friendly summary of a canonical schema derived programmatically from Zod. Includes required/optional fields, types, constraints, and "did you mean?" warnings for common field-name drift. Use before authoring YAML to confirm exact field names.',
+    {
+      schemaName: z12.enum(SUPPORTED_SCHEMA_NAMES).describe(
+        "Schema to summarize. One of: workflow_step, workflow_definition, workflow_field, workflow_action, navigation_item, auth_config"
+      )
+    },
+    async ({ schemaName }) => {
+      const result = handleGetSchema({ schemaName });
+      if ("error" in result) {
+        return {
+          content: [{ type: "text", text: JSON.stringify({ error: result.error }) }],
+          isError: true
+        };
+      }
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify(result, null, 2)
+          }
+        ]
+      };
+    }
+  );
+}
+
+// src/tools/pipeline.ts
+var PHASE_ORDER = [
+  "designer",
+  "theme",
+  "scaffold",
+  // generates app/ directory from config
+  "api",
+  "data",
+  "geo",
+  "workflow",
+  "services",
+  "pages",
+  "dashboard",
+  "auth",
+  "polish"
+];
+var PHASE_DEPENDENCIES = {
+  designer: [],
+  theme: ["designer"],
+  scaffold: ["designer", "theme"],
+  // needs stackwright.yml + theme-tokens
+  api: [],
+  data: ["api"],
+  geo: ["data"],
+  // workflow: no hard deps — uses service: references with Prism mock fallback
+  // when API artifacts aren't available; roles come from user answers
+  workflow: [],
+  // services: needs API endpoints to know what to wire, and optionally
+  // workflow states as trigger sources. Produces OpenAPI specs consumed
+  // by pages and dashboard for typed data wiring.
+  services: ["api", "workflow"],
+  // pages/dashboard: depend on services for typed endpoint wiring (OpenAPI
+  // specs) and on geo so the specialist prompt includes geo-manifest.json
+  // — page/dashboard otters see which page slugs are already claimed and
+  // won't attempt to overwrite them (swp-73c). 'api' is still transitive
+  // through 'data'; auth removed — page-otter has graceful fallback.
+  pages: ["designer", "theme", "data", "services", "geo", "scaffold"],
+  dashboard: ["designer", "theme", "data", "services", "geo", "scaffold"],
+  // auth is the penultimate phase — runs after all content-producing phases
+  // so it can read pages, dashboard, workflow, and geo artifacts for route
+  // protection and RBAC wiring. Skipped upstream phases still satisfy deps
+  // (the foreman marks them executed=true), so auth always runs.
+  auth: ["pages", "dashboard", "workflow", "geo"],
+  // polish is the terminal phase — runs after auth so the landing page and
+  // nav reflect the final set of protected routes and all generated pages.
+  polish: ["auth"]
+};
+var PHASE_ARTIFACT = {
+  designer: "design-language.json",
+  theme: "theme-tokens.json",
+  scaffold: "scaffold-manifest.json",
+  api: "api-config.json",
+  auth: "auth-config.json",
+  data: "data-config.json",
+  pages: "pages-manifest.json",
+  dashboard: "dashboard-manifest.json",
+  workflow: "workflow-config.json",
+  services: "services-config.json",
+  polish: "polish-manifest.json",
+  geo: "geo-manifest.json"
+};
+var PHASE_TO_OTTER2 = {
+  designer: "stackwright-pro-designer-otter",
+  theme: "stackwright-pro-theme-otter",
+  scaffold: "stackwright-pro-scaffold-otter",
+  api: "stackwright-pro-api-otter",
+  auth: "stackwright-pro-auth-otter",
+  data: "stackwright-pro-data-otter",
+  pages: "stackwright-pro-page-otter",
+  dashboard: "stackwright-pro-dashboard-otter",
+  workflow: "stackwright-pro-workflow-otter",
+  services: "stackwright-services-otter",
+  polish: "stackwright-pro-polish-otter",
+  geo: "stackwright-pro-geo-otter"
+};
+function isValidPhase2(phase) {
+  return PHASE_ORDER.includes(phase);
+}
+function defaultPhaseStatus() {
   return {
     questionsCollected: false,
     answered: false,
@@ -1699,11 +2790,11 @@ function createDefaultState() {
   };
 }
 function statePath(cwd) {
-  return join3(cwd, ".stackwright", "pipeline-state.json");
+  return join4(cwd, ".stackwright", "pipeline-state.json");
 }
 function readState(cwd) {
   const p = statePath(cwd);
-  if (!existsSync3(p)) return createDefaultState();
+  if (!existsSync5(p)) return createDefaultState();
   const raw = JSON.parse(safeReadSync(p));
   if (typeof raw !== "object" || raw === null || raw.version !== "1.0") {
     return createDefaultState();
@@ -1711,26 +2802,26 @@ function readState(cwd) {
   return raw;
 }
 function safeWriteSync(filePath, content) {
-  if (existsSync3(filePath)) {
-    const stat = lstatSync3(filePath);
+  if (existsSync5(filePath)) {
+    const stat = lstatSync5(filePath);
     if (stat.isSymbolicLink()) {
       throw new Error(`Refusing to write to symlink: ${filePath}`);
     }
   }
-  writeFileSync3(filePath, content);
+  writeFileSync4(filePath, content);
 }
 function safeReadSync(filePath) {
-  if (existsSync3(filePath)) {
-    const stat = lstatSync3(filePath);
+  if (existsSync5(filePath)) {
+    const stat = lstatSync5(filePath);
     if (stat.isSymbolicLink()) {
       throw new Error(`Refusing to read symlink: ${filePath}`);
     }
   }
-  return readFileSync3(filePath, "utf-8");
+  return readFileSync4(filePath, "utf-8");
 }
 function writeState(cwd, state) {
-  const dir = join3(cwd, ".stackwright");
-  mkdirSync2(dir, { recursive: true });
+  const dir = join4(cwd, ".stackwright");
+  mkdirSync4(dir, { recursive: true });
   state.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
   safeWriteSync(statePath(cwd), JSON.stringify(state, null, 2) + "\n");
 }
@@ -1751,6 +2842,15 @@ function handleGetPipelineState(_cwd) {
   const cwd = _cwd ?? process.cwd();
   try {
     const state = readState(cwd);
+    const keyPath = join4(cwd, ".stackwright", "pipeline-keys.json");
+    if (!existsSync5(keyPath)) {
+      try {
+        const { fingerprint } = initPipelineKeys(cwd);
+        state["signingKeyFingerprint"] = fingerprint;
+        writeState(cwd, state);
+      } catch {
+      }
+    }
     return { text: JSON.stringify(state), isError: false };
   } catch (err) {
     return { text: JSON.stringify({ error: true, message: String(err) }), isError: true };
@@ -1758,7 +2858,7 @@ function handleGetPipelineState(_cwd) {
 }
 function handleSetPipelineState(input) {
   const cwd = input._cwd ?? process.cwd();
-  if (input.phase && !isValidPhase(input.phase)) {
+  if (input.phase && !isValidPhase2(input.phase)) {
     return {
       text: JSON.stringify({
         error: true,
@@ -1777,6 +2877,28 @@ function handleSetPipelineState(input) {
       isError: true
     };
   }
+  if (input.updates && input.updates.length > 0) {
+    for (const update of input.updates) {
+      if (!isValidPhase2(update.phase)) {
+        return {
+          text: JSON.stringify({
+            error: true,
+            message: `Invalid phase in batch update: ${update.phase}. Valid phases are: ${PHASE_ORDER.join(", ")}`
+          }),
+          isError: true
+        };
+      }
+      if (!VALID_FIELDS.includes(update.field)) {
+        return {
+          text: JSON.stringify({
+            error: true,
+            message: `Invalid field in batch update: ${update.field}. Valid fields are: ${VALID_FIELDS.join(", ")}`
+          }),
+          isError: true
+        };
+      }
+    }
+  }
   try {
     const state = readState(cwd);
     if (input.status) {
@@ -1796,34 +2918,78 @@ function handleSetPipelineState(input) {
       }
       state.currentPhase = phase;
     }
+    if (input.updates && input.updates.length > 0) {
+      for (const update of input.updates) {
+        if (!state.phases[update.phase]) {
+          state.phases[update.phase] = defaultPhaseStatus();
+        }
+        const batchPhaseState = state.phases[update.phase];
+        batchPhaseState[update.field] = update.value;
+        state.currentPhase = update.phase;
+      }
+    }
     writeState(cwd, state);
     return { text: JSON.stringify(state), isError: false };
   } catch (err) {
     return { text: JSON.stringify({ error: true, message: String(err) }), isError: true };
   }
 }
-function handleCheckExecutionReady(_cwd) {
+function handleCheckExecutionReady(_cwd, phase) {
   const cwd = _cwd ?? process.cwd();
+  if (phase) {
+    if (!isValidPhase2(phase)) {
+      return {
+        text: JSON.stringify({
+          error: true,
+          message: `Invalid phase: ${phase}. Valid phases are: ${PHASE_ORDER.join(", ")}`
+        }),
+        isError: true
+      };
+    }
+    const answerFile = join4(cwd, ".stackwright", "answers", `${phase}.json`);
+    if (!existsSync5(answerFile)) {
+      return {
+        text: JSON.stringify({ ready: false, phase, reason: "Answer file not found" }),
+        isError: false
+      };
+    }
+    try {
+      const raw = safeReadSync(answerFile);
+      const parsed = JSON.parse(raw);
+      if (typeof parsed["version"] !== "string" || typeof parsed["phase"] !== "string" || typeof parsed["answers"] !== "object" || parsed["answers"] === null) {
+        return {
+          text: JSON.stringify({ ready: false, phase, reason: "Answer file is malformed" }),
+          isError: false
+        };
+      }
+      return { text: JSON.stringify({ ready: true, phase }), isError: false };
+    } catch {
+      return {
+        text: JSON.stringify({ ready: false, phase, reason: "Answer file could not be parsed" }),
+        isError: false
+      };
+    }
+  }
   try {
-    const answersDir = join3(cwd, ".stackwright", "answers");
+    const answersDir = join4(cwd, ".stackwright", "answers");
     const answeredPhases = [];
     const missingPhases = [];
-    for (const phase of PHASE_ORDER) {
-      const answerFile = join3(answersDir, `${phase}.json`);
-      if (existsSync3(answerFile)) {
+    for (const phase2 of PHASE_ORDER) {
+      const answerFile = join4(answersDir, `${phase2}.json`);
+      if (existsSync5(answerFile)) {
         try {
           const raw = safeReadSync(answerFile);
           const parsed = JSON.parse(raw);
           if (typeof parsed["version"] !== "string" || typeof parsed["phase"] !== "string" || typeof parsed["answers"] !== "object" || parsed["answers"] === null) {
-            missingPhases.push(phase);
+            missingPhases.push(phase2);
             continue;
           }
-          answeredPhases.push(phase);
+          answeredPhases.push(phase2);
         } catch {
-          missingPhases.push(phase);
+          missingPhases.push(phase2);
         }
       } else {
-        missingPhases.push(phase);
+        missingPhases.push(phase2);
       }
     }
     return {
@@ -1839,18 +3005,74 @@ function handleCheckExecutionReady(_cwd) {
     return { text: JSON.stringify({ error: true, message: String(err) }), isError: true };
   }
 }
+function handleGetReadyPhases(_cwd) {
+  const cwd = _cwd ?? process.cwd();
+  try {
+    const state = readState(cwd);
+    const completed = [];
+    const ready = [];
+    const blocked = [];
+    for (const phase of PHASE_ORDER) {
+      const ps = state.phases[phase];
+      if (ps?.executed) {
+        completed.push(phase);
+        continue;
+      }
+      const deps = PHASE_DEPENDENCIES[phase];
+      const unmetDeps = deps.filter((dep) => !state.phases[dep]?.executed);
+      if (unmetDeps.length === 0) {
+        ready.push(phase);
+      } else {
+        blocked.push(phase);
+      }
+    }
+    return {
+      text: JSON.stringify({
+        readyPhases: ready,
+        completedPhases: completed,
+        blockedPhases: blocked,
+        waveSize: ready.length,
+        allComplete: ready.length === 0 && blocked.length === 0
+      }),
+      isError: false
+    };
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return { text: JSON.stringify({ error: true, message }), isError: true };
+  }
+}
 function handleListArtifacts(_cwd) {
   const cwd = _cwd ?? process.cwd();
   try {
-    const artifactsDir = join3(cwd, ".stackwright", "artifacts");
+    const artifactsDir = join4(cwd, ".stackwright", "artifacts");
+    let manifest = null;
+    try {
+      manifest = loadSignatureManifest(cwd);
+    } catch {
+    }
     const artifacts = [];
     let completedCount = 0;
     for (const phase of PHASE_ORDER) {
       const expectedFile = PHASE_ARTIFACT[phase];
-      const fullPath = join3(artifactsDir, expectedFile);
-      const exists = existsSync3(fullPath);
+      const fullPath = join4(artifactsDir, expectedFile);
+      const exists = existsSync5(fullPath);
       if (exists) completedCount++;
-      artifacts.push({ phase, expectedFile, exists, path: fullPath });
+      let signed = false;
+      let signatureValid = null;
+      if (exists && manifest) {
+        const entry = manifest.signatures[expectedFile];
+        if (entry) {
+          signed = true;
+          try {
+            const rawBytes = Buffer.from(safeReadSync(fullPath), "utf-8");
+            const { publicKey } = loadPipelineKeys(cwd);
+            signatureValid = verifyArtifact(rawBytes, entry, publicKey);
+          } catch {
+            signatureValid = null;
+          }
+        }
+      }
+      artifacts.push({ phase, expectedFile, exists, path: fullPath, signed, signatureValid });
     }
     return {
       text: JSON.stringify({ artifacts, completedCount, totalCount: PHASE_ORDER.length }),
@@ -1863,7 +3085,7 @@ function handleListArtifacts(_cwd) {
 function handleWritePhaseQuestions(input) {
   const cwd = input._cwd ?? process.cwd();
   const { phase, responseText } = input;
-  if (!isValidPhase(phase)) {
+  if (!isValidPhase2(phase)) {
     return {
       text: JSON.stringify({ error: true, message: `Unknown phase: ${phase}` }),
       isError: true
@@ -1886,9 +3108,9 @@ function handleWritePhaseQuestions(input) {
       }
     } catch {
     }
-    const questionsDir = join3(cwd, ".stackwright", "questions");
-    mkdirSync2(questionsDir, { recursive: true });
-    const filePath = join3(questionsDir, `${phase}.json`);
+    const questionsDir = join4(cwd, ".stackwright", "questions");
+    mkdirSync4(questionsDir, { recursive: true });
+    const filePath = join4(questionsDir, `${phase}.json`);
     const payload = {
       version: "1.0",
       phase,
@@ -1921,127 +3143,494 @@ function handleWritePhaseQuestions(input) {
 function handleBuildSpecialistPrompt(input) {
   const cwd = input._cwd ?? process.cwd();
   const { phase } = input;
-  if (!isValidPhase(phase)) {
+  if (!isValidPhase2(phase)) {
     return {
       text: JSON.stringify({ error: true, message: `Unknown phase: ${phase}` }),
       isError: true
     };
   }
   try {
-    const answersPath = join3(cwd, ".stackwright", "answers", `${phase}.json`);
+    const answersPath = join4(cwd, ".stackwright", "answers", `${phase}.json`);
     let answers = {};
-    if (existsSync3(answersPath)) {
+    if (existsSync5(answersPath)) {
       answers = JSON.parse(safeReadSync(answersPath));
     }
+    let buildContextText = "";
+    const buildContextPath = join4(cwd, ".stackwright", "build-context.json");
+    if (existsSync5(buildContextPath)) {
+      try {
+        const bcRaw = JSON.parse(safeReadSync(buildContextPath));
+        if (typeof bcRaw.buildContext === "string" && bcRaw.buildContext.trim().length > 0) {
+          buildContextText = bcRaw.buildContext.trim();
+        }
+      } catch {
+      }
+    }
     const deps = PHASE_DEPENDENCIES[phase];
     const artifactSections = [];
     const missingDependencies = [];
     for (const dep of deps) {
       const artifactFile = PHASE_ARTIFACT[dep];
-      const artifactPath = join3(cwd, ".stackwright", "artifacts", artifactFile);
-      if (existsSync3(artifactPath)) {
-        const content = JSON.parse(safeReadSync(artifactPath));
+      const artifactPath = join4(cwd, ".stackwright", "artifacts", artifactFile);
+      if (existsSync5(artifactPath)) {
+        const rawContent = safeReadSync(artifactPath);
+        const rawBytes = Buffer.from(rawContent, "utf-8");
+        const content = JSON.parse(rawContent);
+        let signatureVerified = false;
+        let signatureAvailable = false;
+        try {
+          const sig = getArtifactSignature(cwd, artifactFile);
+          if (sig) {
+            signatureAvailable = true;
+            const { publicKey } = loadPipelineKeys(cwd);
+            signatureVerified = verifyArtifact(rawBytes, sig, publicKey);
+            if (!signatureVerified) {
+              const actualDigest = createHash3("sha384").update(rawBytes).digest("hex");
+              emitSignatureAuditEvent({
+                artifactFilename: artifactFile,
+                expectedDigest: sig.digest,
+                actualDigest,
+                phase: dep,
+                timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+                source: "stackwright_pro_build_specialist_prompt"
+              });
+              missingDependencies.push(dep);
+              artifactSections.push(
+                `[${artifactFile}]:
+(integrity check failed: ECDSA-P384 signature verification failed \u2014 artifact may have been tampered with)`
+              );
+              continue;
+            }
+          }
+        } catch {
+        }
         const expectedOtter = PHASE_TO_OTTER2[dep];
         const artifactOtter = content["generatedBy"];
+        const normalizedOtter = artifactOtter?.replace(/-[a-f0-9]{6}$/, "");
         if (!artifactOtter) {
           missingDependencies.push(dep);
           artifactSections.push(
             `[${artifactFile}]:
 (integrity check failed: missing generatedBy field)`
           );
-        } else if (artifactOtter !== expectedOtter) {
+        } else if (normalizedOtter !== expectedOtter) {
           missingDependencies.push(dep);
           artifactSections.push(
             `[${artifactFile}]:
 (integrity check failed: artifact claims generatedBy="${artifactOtter}" but expected="${expectedOtter}")`
           );
         } else {
-          artifactSections.push(`[${artifactFile}]:
-${JSON.stringify(content, null, 2)}`);
+          const sigStatus = signatureAvailable ? signatureVerified ? " [signature verified]" : " [signature check skipped]" : " [unsigned]";
+          artifactSections.push(
+            `[${artifactFile}]${sigStatus}:
+${JSON.stringify(content, null, 2)}`
+          );
+        }
+      } else {
+        missingDependencies.push(dep);
+        artifactSections.push(`[${artifactFile}]:
+(not yet available)`);
+      }
+    }
+    const parts = [];
+    if (buildContextText) {
+      parts.push("BUILD_CONTEXT:", buildContextText, "");
+    }
+    if (phase === "auth") {
+      const initContextPath = join4(cwd, ".stackwright", "init-context.json");
+      if (existsSync5(initContextPath)) {
+        try {
+          const initContext = JSON.parse(safeReadSync(initContextPath));
+          if (initContext.devOnly === true || initContext.nonInteractive === true) {
+            answers["devOnly"] = true;
+          }
+        } catch {
+        }
+      }
+    }
+    parts.push("ANSWERS:", JSON.stringify(answers, null, 2));
+    if (artifactSections.length > 0) {
+      parts.push("", "UPSTREAM ARTIFACTS:", "", ...artifactSections);
+    }
+    const artifactSchema = PHASE_ARTIFACT_SCHEMA[phase];
+    parts.push("", "REQUIRED_ARTIFACT_SCHEMA:");
+    parts.push(artifactSchema);
+    const schemaRef = buildSchemaReferenceBlock(phase);
+    if (schemaRef) {
+      parts.push("", schemaRef);
+    }
+    parts.push("", "Execute using these answers and the upstream artifacts provided.");
+    const prompt = parts.join("\n");
+    const dependenciesSatisfied = missingDependencies.length === 0;
+    return {
+      text: JSON.stringify({
+        otterName: PHASE_TO_OTTER2[phase],
+        phase,
+        prompt,
+        dependenciesSatisfied,
+        missingDependencies
+      }),
+      isError: false
+    };
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return { text: JSON.stringify({ error: true, phase, message }), isError: true };
+  }
+}
+var OFF_SCRIPT_PATTERNS = [
+  {
+    pattern: /```(?:ts|tsx|js|jsx|python|bash|sh|sql|ruby|go|rust|java|csharp|c\+\+)\b/,
+    label: "code fence"
+  },
+  { pattern: /\bimport\s+[\w{]/, label: "import statement" },
+  { pattern: /\bexport\s+(?:const|function|default|class)\b/, label: "export statement" },
+  { pattern: /\brequire\s*\(/, label: "require() call" },
+  { pattern: /\beval\s*\(/, label: "eval() call" },
+  { pattern: /^#!/m, label: "shebang" },
+  { pattern: /<script[\s>]/i, label: "script tag" },
+  { pattern: /\.(ts|tsx|js|jsx)\b.*\bfile\b/i, label: "code file reference" }
+];
+var PHASE_REQUIRED_KEYS = {
+  designer: ["designLanguage", "themeTokenSeeds"],
+  theme: ["tokens"],
+  scaffold: ["version", "generatedBy", "appRouterFiles"],
+  api: ["entities", "version", "generatedBy"],
+  auth: ["version", "generatedBy"],
+  data: ["version", "generatedBy", "strategy", "collections"],
+  pages: ["version", "generatedBy"],
+  dashboard: ["version", "generatedBy"],
+  workflow: ["version", "generatedBy"],
+  services: ["version", "generatedBy", "flows"],
+  polish: ["version", "generatedBy"],
+  geo: ["version", "generatedBy", "geoCollections"]
+};
+var PHASE_ARTIFACT_SCHEMA = {
+  designer: JSON.stringify(
+    {
+      version: "1.0",
+      generatedBy: "stackwright-pro-designer-otter",
+      application: {
+        type: "<operational|data-explorer|admin|logistics|general>",
+        environment: "<workstation|field|control-room|mixed>",
+        density: "<compact|balanced|spacious>",
+        accessibility: "<wcag-aa|section-508|none>",
+        colorScheme: "<light|dark|both>"
+      },
+      designLanguage: {
+        rationale: "<design rationale>",
+        spacingScale: { base: 8, scale: [0, 4, 8, 16, 24, 32, 48, 64] },
+        colorSemantics: { primary: "#1a365d", accent: "#e53e3e" },
+        typography: {
+          dataFont: "Inter",
+          headingFont: "Inter",
+          monoFont: "monospace",
+          dataSizePx: 12,
+          bodySizePx: 14
+        },
+        contrastRatio: "4.5",
+        borderRadius: "4",
+        shadowElevation: "standard"
+      },
+      themeTokenSeeds: {
+        light: {
+          background: "#ffffff",
+          foreground: "#1a1a1a",
+          primary: "#1a365d",
+          surface: "#f7f7f7",
+          border: "#e2e8f0"
+        },
+        dark: {
+          background: "#1a1a1a",
+          foreground: "#ffffff",
+          primary: "#90cdf4",
+          surface: "#2d2d2d",
+          border: "#4a5568"
+        }
+      },
+      conformsTo: null,
+      operationalNotes: []
+    },
+    null,
+    2
+  ),
+  theme: JSON.stringify(
+    {
+      version: "1.0",
+      generatedBy: "stackwright-pro-theme-otter",
+      componentLibrary: "shadcn",
+      colorScheme: "<light|dark|both>",
+      tokens: {
+        colors: { "primary-500": "#1a365d", background: "#ffffff" },
+        spacing: { "spacing-1": "8px", "spacing-2": "16px" },
+        typography: { "font-data": "Inter", "text-sm": "12px" },
+        shape: { "radius-sm": "4px", "radius-md": "8px" },
+        shadows: { "shadow-sm": "0 1px 2px rgba(0,0,0,0.08)" }
+      },
+      cssVariables: {
+        "--background": "0 0% 100%",
+        "--foreground": "222.2 84% 4.9%",
+        "--primary": "222.2 47.4% 11.2%",
+        "--primary-foreground": "210 40% 98%",
+        "--surface": "210 40% 98%",
+        "--border": "214.3 31.8% 91.4%"
+      },
+      dark: { "--background": "222.2 84% 4.9%", "--foreground": "210 40% 98%" }
+    },
+    null,
+    2
+  ),
+  scaffold: JSON.stringify(
+    {
+      version: "1.0",
+      generatedBy: "stackwright-pro-scaffold-otter",
+      // REQUIRED: appRouterFiles is a required key — NOT 'files' (see swp-k3mb)
+      appRouterFiles: [
+        "app/layout.tsx",
+        "app/_components/page-client.tsx",
+        "app/page.tsx",
+        "app/[...slug]/page.tsx",
+        "app/_components/providers.tsx",
+        "app/not-found.tsx"
+      ],
+      title: "<title from stackwright.yml>",
+      hasCollectionEndpoints: false,
+      hasAuthConfig: true
+    },
+    null,
+    2
+  ),
+  api: JSON.stringify(
+    {
+      version: "1.0",
+      generatedBy: "stackwright-pro-api-otter",
+      entities: [
+        {
+          name: "Shipment",
+          endpoint: "/shipments",
+          method: "GET",
+          revalidate: 60,
+          mutationType: null
+        }
+      ],
+      skipped: [
+        {
+          spec: "ais-message-models.yaml",
+          format: "asyncapi",
+          reason: "AsyncAPI spec \u2014 WebSocket/event integration required (no REST endpoints)"
+        }
+      ],
+      warnings: [
+        "Spec contains external $ref URLs \u2014 recommend bundle: true in stackwright.yml integration config"
+      ],
+      auth: { type: "bearer", header: "Authorization", envVar: "API_TOKEN" },
+      baseUrl: "https://api.example.mil/v2",
+      specPath: "./specs/api.yaml"
+    },
+    null,
+    2
+  ),
+  data: JSON.stringify(
+    {
+      version: "1.0",
+      generatedBy: "stackwright-pro-data-otter",
+      strategy: "<pulse-fast|isr-fast|isr-standard|isr-slow>",
+      pulseMode: false,
+      collections: [{ name: "equipment", revalidate: 60, pulse: false }],
+      endpoints: { included: ["/equipment/**"], excluded: ["/admin/**"] },
+      requiredPackages: { dependencies: {}, devPackages: {} }
+    },
+    null,
+    2
+  ),
+  geo: JSON.stringify(
+    {
+      version: "1.0",
+      generatedBy: "stackwright-pro-geo-otter",
+      geoCollections: [
+        {
+          collection: "vessels",
+          latField: "latitude",
+          lngField: "longitude",
+          labelField: "vesselName",
+          colorField: "navigationStatus"
+        }
+      ],
+      pages: [
+        {
+          slug: "fleet-tracker",
+          type: "<tracker|zone|route|combined>",
+          collections: ["vessels"],
+          hasLayers: false
+        }
+      ]
+    },
+    null,
+    2
+  ),
+  workflow: JSON.stringify(
+    {
+      version: "1.0",
+      generatedBy: "stackwright-pro-workflow-otter",
+      // Root key is `workflow` — NOT `workflowConfig` (see swp-k7cl)
+      workflow: {
+        id: "procurement-approval",
+        route: "/procurement",
+        files: ["workflows/procurement-approval.yml"],
+        serviceDependencies: ["service:workflow-state"],
+        warnings: []
+      }
+    },
+    null,
+    2
+  ),
+  services: JSON.stringify(
+    {
+      version: "1.0",
+      generatedBy: "stackwright-services-otter",
+      flows: [
+        {
+          name: "at-risk-patients",
+          trigger: "<http|event|schedule|queue>",
+          steps: 3,
+          outputSpec: "at-risk-patients.openapi.json"
         }
-      } else {
-        missingDependencies.push(dep);
-        artifactSections.push(`[${artifactFile}]:
-(not yet available)`);
+      ],
+      workflows: [
+        {
+          name: "evacuation-coordination",
+          states: 4,
+          transitions: 5
+        }
+      ],
+      openApiSpecs: ["at-risk-patients.openapi.json"],
+      capabilitiesUsed: ["service.call", "collection.join", "collection.filter"]
+    },
+    null,
+    2
+  ),
+  pages: JSON.stringify(
+    {
+      version: "1.0",
+      generatedBy: "stackwright-pro-page-otter",
+      pages: [
+        {
+          slug: "catalog",
+          type: "collection_listing",
+          collection: "products",
+          themeApplied: true,
+          authRequired: false
+        },
+        {
+          slug: "admin",
+          type: "protected",
+          collection: null,
+          themeApplied: true,
+          authRequired: true
+        }
+      ]
+    },
+    null,
+    2
+  ),
+  dashboard: JSON.stringify(
+    {
+      version: "1.0",
+      generatedBy: "stackwright-pro-dashboard-otter",
+      pages: [
+        {
+          slug: "dashboard",
+          layout: "<grid|table|mixed>",
+          collections: ["equipment", "supplies"],
+          mode: "<ISR|Pulse>"
+        }
+      ]
+    },
+    null,
+    2
+  ),
+  // type: 'pki' = CAC/DoD certificate auth | 'oidc' = enterprise SSO
+  // For dev-only mock auth: use type: 'oidc' with devOnly: true (Zod strips devOnly — it's a convention only)
+  auth: JSON.stringify(
+    {
+      version: "1.0",
+      generatedBy: "stackwright-pro-auth-otter",
+      authConfig: {
+        type: "<pki|oidc>",
+        // OIDC-only fields (omit for pki):
+        provider: "<azure_ad|okta|cognito|auth0|authentik|keycloak|custom>",
+        discoveryUrl: "<IdP OIDC discovery URL>",
+        clientId: "<OIDC client ID>",
+        clientSecret: "<OIDC client secret>",
+        rbacRoles: ["ADMIN", "ANALYST"],
+        rbacDefaultRole: "ANALYST",
+        protectedRoutes: ["/dashboard/:path*", "/procurement/:path*"],
+        auditEnabled: true,
+        auditRetentionDays: 90
+      },
+      // devScripts is OPTIONAL — only present when devOnly: true was used
+      // Polish otter and foreman MUST check devScripts.written before referencing scripts
+      devScripts: {
+        written: true,
+        scripts: { "dev:admin": "MOCK_USER=admin next dev" }
       }
-    }
-    const parts = ["ANSWERS:", JSON.stringify(answers, null, 2)];
-    if (artifactSections.length > 0) {
-      parts.push("", "UPSTREAM ARTIFACTS:", "", ...artifactSections);
-    }
-    parts.push("", "Execute using these answers and the upstream artifacts provided.");
-    const prompt = parts.join("\n");
-    const dependenciesSatisfied = missingDependencies.length === 0;
-    return {
-      text: JSON.stringify({
-        otterName: PHASE_TO_OTTER2[phase],
-        phase,
-        prompt,
-        dependenciesSatisfied,
-        missingDependencies
-      }),
-      isError: false
-    };
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    return { text: JSON.stringify({ error: true, phase, message }), isError: true };
-  }
-}
-var OFF_SCRIPT_PATTERNS = [
-  {
-    pattern: /```(?:ts|tsx|js|jsx|python|bash|sh|sql|ruby|go|rust|java|csharp|c\+\+)\b/,
-    label: "code fence"
-  },
-  { pattern: /\bimport\s+[\w{]/, label: "import statement" },
-  { pattern: /\bexport\s+(?:const|function|default|class)\b/, label: "export statement" },
-  { pattern: /\brequire\s*\(/, label: "require() call" },
-  { pattern: /\beval\s*\(/, label: "eval() call" },
-  { pattern: /^#!/m, label: "shebang" },
-  { pattern: /<script[\s>]/i, label: "script tag" },
-  { pattern: /\.(ts|tsx|js|jsx)\b.*\bfile\b/i, label: "code file reference" }
-];
-var PHASE_REQUIRED_KEYS = {
-  designer: ["designLanguage", "themeTokenSeeds"],
-  theme: ["tokens"],
-  api: ["entities"],
-  auth: ["version", "generatedBy"],
-  data: ["version", "generatedBy"],
-  pages: ["version", "generatedBy"],
-  dashboard: ["version", "generatedBy"],
-  workflow: ["version", "generatedBy"]
+    },
+    null,
+    2
+  ),
+  polish: JSON.stringify(
+    {
+      version: "1.0",
+      generatedBy: "stackwright-pro-polish-otter",
+      landingPage: { slug: "", rewritten: true },
+      navigation: { itemCount: 5, items: ["/dashboard", "/equipment", "/workflows"] },
+      gettingStarted: "<rewritten|redirected|not-found>",
+      scaffoldCleanup: {
+        deleted: ["content/posts/getting-started.yaml"],
+        rewritten: ["app/not-found.tsx"],
+        skipped: []
+      }
+    },
+    null,
+    2
+  )
 };
 function handleValidateArtifact(input) {
   const cwd = input._cwd ?? process.cwd();
-  const { phase, responseText } = input;
-  if (!isValidPhase(phase)) {
+  const { phase, responseText, artifact: directArtifact } = input;
+  if (!isValidPhase2(phase)) {
     return {
       text: JSON.stringify({ error: true, message: `Unknown phase: ${phase}` }),
       isError: true
     };
   }
-  for (const { pattern, label } of OFF_SCRIPT_PATTERNS) {
-    if (pattern.test(responseText)) {
+  let artifact;
+  if (directArtifact) {
+    artifact = directArtifact;
+  } else {
+    const text = responseText ?? "";
+    for (const { pattern, label } of OFF_SCRIPT_PATTERNS) {
+      if (pattern.test(text)) {
+        const result = {
+          valid: false,
+          phase,
+          violation: "off-script",
+          retryPrompt: `You returned code output (detected: ${label}). Return ONLY a JSON artifact \u2014 no code, no files.`
+        };
+        return { text: JSON.stringify(result), isError: false };
+      }
+    }
+    try {
+      artifact = extractJsonFromResponse(text);
+    } catch {
       const result = {
         valid: false,
         phase,
-        violation: "off-script",
-        retryPrompt: `You returned code output (detected: ${label}). Return ONLY a JSON artifact \u2014 no code, no files.`
+        violation: "invalid-json",
+        retryPrompt: "Your response did not contain valid JSON. Return a single JSON object with no surrounding text."
       };
       return { text: JSON.stringify(result), isError: false };
     }
   }
-  let artifact;
-  try {
-    artifact = extractJsonFromResponse(responseText);
-  } catch {
-    const result = {
-      valid: false,
-      phase,
-      violation: "invalid-json",
-      retryPrompt: "Your response did not contain valid JSON. Return a single JSON object with no surrounding text."
-    };
-    return { text: JSON.stringify(result), isError: false };
-  }
   if (!artifact.version || !artifact.generatedBy) {
     const result = {
       valid: false,
@@ -2062,12 +3651,68 @@ function handleValidateArtifact(input) {
     };
     return { text: JSON.stringify(result), isError: false };
   }
+  const PHASE_ZOD_VALIDATORS = {
+    workflow: (artifact2) => {
+      const workflowData = artifact2["workflow"];
+      if (!workflowData) {
+        if (artifact2["workflowConfig"]) {
+          console.warn(
+            '[pipeline] DEPRECATED: workflow artifact uses "workflowConfig" key; rename to "workflow"'
+          );
+          return { success: true };
+        }
+        return { success: true };
+      }
+      if (typeof workflowData === "object" && workflowData !== null && "workflow" in workflowData) {
+        const result = WorkflowFileSchema.safeParse(workflowData);
+        if (!result.success) {
+          const issues = result.error.issues.slice(0, 3).map((i) => `${i.path.join(".")}: ${i.message}`).join("; ");
+          return { success: false, error: { message: issues } };
+        }
+      }
+      return { success: true };
+    },
+    auth: (artifact2) => {
+      const authConfig = artifact2["authConfig"];
+      if (!authConfig) return { success: true };
+      const result = authConfigSchema3.safeParse(authConfig);
+      if (!result.success) {
+        const issues = result.error.issues.slice(0, 3).map((i) => `${i.path.join(".")}: ${i.message}`).join("; ");
+        return { success: false, error: { message: issues } };
+      }
+      return { success: true };
+    }
+  };
+  const zodValidator = PHASE_ZOD_VALIDATORS[phase];
+  if (zodValidator) {
+    const zodResult = zodValidator(artifact);
+    if (!zodResult.success) {
+      const result = {
+        valid: false,
+        phase,
+        violation: "schema-mismatch",
+        retryPrompt: `Your artifact failed schema validation: ${zodResult.error?.message}. Fix these fields and return the corrected JSON artifact.`
+      };
+      return { text: JSON.stringify(result), isError: false };
+    }
+  }
   try {
-    const artifactsDir = join3(cwd, ".stackwright", "artifacts");
-    mkdirSync2(artifactsDir, { recursive: true });
+    const artifactsDir = join4(cwd, ".stackwright", "artifacts");
+    mkdirSync4(artifactsDir, { recursive: true });
     const artifactFile = PHASE_ARTIFACT[phase];
-    const artifactPath = join3(artifactsDir, artifactFile);
-    safeWriteSync(artifactPath, JSON.stringify(artifact, null, 2) + "\n");
+    const artifactPath = join4(artifactsDir, artifactFile);
+    const serialized = JSON.stringify(artifact, null, 2) + "\n";
+    const artifactBytes = Buffer.from(serialized, "utf-8");
+    safeWriteSync(artifactPath, serialized);
+    let signed = false;
+    try {
+      const { privateKey } = loadPipelineKeys(cwd);
+      const sig = signArtifact(artifactBytes, privateKey);
+      const signerOtter = PHASE_TO_OTTER2[phase];
+      saveArtifactSignature(cwd, artifactFile, sig, signerOtter);
+      signed = true;
+    } catch {
+    }
     const state = readState(cwd);
     if (!state.phases[phase]) state.phases[phase] = defaultPhaseStatus();
     const ps = state.phases[phase];
@@ -2078,7 +3723,7 @@ function handleValidateArtifact(input) {
       valid: true,
       phase,
       artifactPath,
-      summary: `Wrote ${artifactFile} (keys: ${topKeys}${Object.keys(artifact).length > 5 ? ", ..." : ""})`
+      summary: `Wrote ${artifactFile} (keys: ${topKeys}${Object.keys(artifact).length > 5 ? ", ..." : ""})${signed ? " [signed]" : ""}`
     };
     return { text: JSON.stringify(result), isError: false };
   } catch (err) {
@@ -2102,11 +3747,24 @@ function registerPipelineTools(server2) {
     "stackwright_pro_set_pipeline_state",
     `Atomic read\u2192modify\u2192write pipeline state. ${DESC}`,
     {
-      phase: z9.string().optional().describe('Phase to update, e.g. "designer"'),
-      field: z9.enum(["questionsCollected", "answered", "executed", "artifactWritten"]).optional().describe("Boolean field to set"),
-      value: z9.boolean().optional().describe("Value for the field"),
-      status: z9.enum(["setup", "questions", "execution", "done"]).optional().describe("Top-level status override"),
-      incrementRetry: z9.boolean().optional().describe("Bump retryCount by 1")
+      phase: z13.string().optional().describe('Phase to update, e.g. "designer"'),
+      field: z13.enum(["questionsCollected", "answered", "executed", "artifactWritten"]).optional().describe("Boolean field to set"),
+      value: boolCoerce(z13.boolean().optional()).describe(
+        'Value for the field \u2014 must be a JSON boolean (true/false), NOT the string "true"/"false"'
+      ),
+      status: z13.enum(["setup", "questions", "execution", "done"]).optional().describe("Top-level status override"),
+      incrementRetry: boolCoerce(z13.boolean().optional()).describe(
+        "Bump retryCount by 1 \u2014 must be a JSON boolean"
+      ),
+      updates: jsonCoerce(
+        z13.array(
+          z13.object({
+            phase: z13.string(),
+            field: z13.enum(["questionsCollected", "answered", "executed", "artifactWritten"]),
+            value: z13.boolean()
+          })
+        ).optional()
+      ).describe("Batch updates \u2014 apply multiple field changes in one atomic read\u2192modify\u2192write")
     },
     async (args) => res(
       handleSetPipelineState({
@@ -2114,15 +3772,24 @@ function registerPipelineTools(server2) {
         ...args.field != null ? { field: args.field } : {},
         ...args.value != null ? { value: args.value } : {},
         ...args.status != null ? { status: args.status } : {},
-        ...args.incrementRetry != null ? { incrementRetry: args.incrementRetry } : {}
+        ...args.incrementRetry != null ? { incrementRetry: args.incrementRetry } : {},
+        ...args.updates != null ? { updates: args.updates } : {}
       })
     )
   );
   server2.tool(
     "stackwright_pro_check_execution_ready",
-    `Check all phases have answer files in .stackwright/answers/. ${DESC}`,
+    `Check all phases have answer files in .stackwright/answers/. If phase is provided, check only that phase. ${DESC}`,
+    {
+      phase: z13.string().optional().describe("If provided, check only this phase's readiness. Omit to check all phases.")
+    },
+    async ({ phase }) => res(handleCheckExecutionReady(void 0, phase))
+  );
+  server2.tool(
+    "stackwright_pro_get_ready_phases",
+    `Return phases whose dependencies are all satisfied (executed=true). Use to determine which phases can run next \u2014 enables wave-based execution. ${DESC}`,
     {},
-    async () => res(handleCheckExecutionReady())
+    async () => res(handleGetReadyPhases())
   );
   server2.tool(
     "stackwright_pro_list_artifacts",
@@ -2132,40 +3799,91 @@ function registerPipelineTools(server2) {
   );
   server2.tool(
     "stackwright_pro_write_phase_questions",
-    `Parse otter question-collection response \u2192 .stackwright/questions/{phase}.json. ${DESC}`,
+    `Parse otter question-collection response \u2192 .stackwright/questions/{phase}.json. Specialists may also call this directly with a parsed questions array. ${DESC}`,
     {
-      phase: z9.string().describe('Phase name, e.g. "designer"'),
-      responseText: z9.string().describe("Raw LLM response from QUESTION_COLLECTION_MODE")
+      phase: z13.string().optional().describe('Phase name, e.g. "designer" (required for direct write)'),
+      responseText: z13.string().optional().describe("Raw LLM response from QUESTION_COLLECTION_MODE"),
+      questions: jsonCoerce(z13.array(z13.any()).optional()).describe(
+        "Questions array for direct specialist write"
+      )
     },
-    async ({ phase, responseText }) => res(handleWritePhaseQuestions({ phase, responseText }))
+    async ({ phase, responseText, questions }) => {
+      if (phase && questions && Array.isArray(questions)) {
+        if (!SAFE_PHASE.test(phase)) {
+          return {
+            content: [
+              { type: "text", text: JSON.stringify({ error: `Invalid phase name` }) }
+            ],
+            isError: true
+          };
+        }
+        const questionsDir = join4(process.cwd(), ".stackwright", "questions");
+        mkdirSync4(questionsDir, { recursive: true });
+        const outPath = join4(questionsDir, `${phase}.json`);
+        writeFileSync4(
+          outPath,
+          JSON.stringify({ phase, questions, writtenAt: (/* @__PURE__ */ new Date()).toISOString() }, null, 2)
+        );
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({
+                written: true,
+                phase,
+                count: questions.length
+              })
+            }
+          ]
+        };
+      }
+      return res(
+        handleWritePhaseQuestions({ phase: phase ?? "", responseText: responseText ?? "" })
+      );
+    }
   );
   server2.tool(
     "stackwright_pro_build_specialist_prompt",
     `Assemble execution prompt from answers + upstream artifacts. Foreman passes verbatim. ${DESC}`,
-    { phase: z9.string().describe('Phase to build prompt for, e.g. "pages"') },
+    { phase: z13.string().describe('Phase to build prompt for, e.g. "pages"') },
     async ({ phase }) => res(handleBuildSpecialistPrompt({ phase }))
   );
   server2.tool(
     "stackwright_pro_validate_artifact",
-    `Validate specialist response + write artifact to .stackwright/artifacts/. Returns retryPrompt on failure. ${DESC}`,
+    `Validate and write artifact to .stackwright/artifacts/. Returns retryPrompt on failure. ${DESC}`,
     {
-      phase: z9.string().describe('Phase that produced this artifact, e.g. "designer"'),
-      responseText: z9.string().describe("Raw response text from the specialist otter")
+      phase: z13.string().describe('Phase that produced this artifact, e.g. "designer"'),
+      responseText: z13.string().optional().describe("Raw response text from the specialist otter (Foreman-mediated path, legacy)"),
+      artifact: jsonCoerce(z13.record(z13.string(), z13.unknown()).optional()).describe(
+        "Artifact object to validate and write directly (specialist direct path \u2014 skips off-script detection and JSON parsing)"
+      )
     },
-    async ({ phase, responseText }) => res(handleValidateArtifact({ phase, responseText }))
+    async ({ phase, responseText, artifact }) => {
+      if (artifact) {
+        return res(
+          handleValidateArtifact({ phase, artifact })
+        );
+      }
+      return res(handleValidateArtifact({ phase, responseText: responseText ?? "" }));
+    }
   );
 }
 
 // src/tools/safe-write.ts
-import { z as z10 } from "zod";
-import { writeFileSync as writeFileSync4, existsSync as existsSync4, mkdirSync as mkdirSync3, lstatSync as lstatSync4 } from "fs";
-import { normalize, isAbsolute, dirname, join as join4 } from "path";
+import { z as z14 } from "zod";
+import { writeFileSync as writeFileSync5, readFileSync as readFileSync5, existsSync as existsSync6, mkdirSync as mkdirSync5, lstatSync as lstatSync6 } from "fs";
+import { normalize, isAbsolute, dirname, join as join5 } from "path";
 var OTTER_WRITE_ALLOWLISTS = {
   "stackwright-pro-designer-otter": [
     { prefix: ".stackwright/artifacts/", suffix: ".json", description: "Design language artifact" }
   ],
   "stackwright-pro-theme-otter": [
-    { prefix: ".stackwright/artifacts/", suffix: ".json", description: "Theme tokens artifact" }
+    { prefix: ".stackwright/artifacts/", suffix: ".json", description: "Theme tokens artifact" },
+    {
+      prefix: "stackwright.theme.",
+      suffix: ".yml",
+      description: "Theme config YAML (merged at build time)"
+    }
   ],
   "stackwright-pro-auth-otter": [
     { prefix: ".stackwright/artifacts/", suffix: ".json", description: "Auth config artifact" },
@@ -2175,6 +3893,16 @@ var OTTER_WRITE_ALLOWLISTS = {
       prefix: ".env",
       suffix: "",
       description: "Dotenv files (.env, .env.local, .env.production, etc.)"
+    },
+    {
+      prefix: "lib/mock-auth",
+      suffix: ".ts",
+      description: "Mock auth module (DEV_ONLY_MODE role updates)"
+    },
+    {
+      prefix: "package.json",
+      suffix: ".json",
+      description: "Project package.json (DEV_ONLY_MODE script cleanup)"
     }
   ],
   "stackwright-pro-data-otter": [
@@ -2196,18 +3924,135 @@ var OTTER_WRITE_ALLOWLISTS = {
     { prefix: "workflows/", suffix: ".yaml", description: "Workflow definition" },
     { prefix: ".stackwright/artifacts/", suffix: ".json", description: "Workflow config" }
   ],
+  "stackwright-pro-scaffold-otter": [
+    { prefix: "app/", suffix: ".tsx", description: "Next.js App Router shell files" },
+    {
+      prefix: ".stackwright/artifacts/",
+      suffix: ".json",
+      description: "Scaffold manifest artifact"
+    }
+  ],
   "stackwright-pro-api-otter": [
     { prefix: ".stackwright/artifacts/", suffix: ".json", description: "API config artifact" }
+  ],
+  "stackwright-pro-geo-otter": [
+    { prefix: ".stackwright/artifacts/", suffix: ".json", description: "Geo manifest artifact" },
+    { prefix: "pages/", suffix: "/content.yml", description: "Map page content" },
+    { prefix: "pages/", suffix: "/content.yaml", description: "Map page content" }
+  ],
+  "stackwright-pro-polish-otter": [
+    {
+      prefix: "stackwright.yml",
+      suffix: "",
+      description: "Stackwright config (navigation updates)"
+    },
+    {
+      prefix: "stackwright.navigation.",
+      suffix: ".yml",
+      description: "Navigation config YAML (merged at build time)"
+    },
+    { prefix: "pages/", suffix: "/content.yml", description: "Landing page content" },
+    { prefix: "pages/", suffix: "/content.yaml", description: "Landing page content" },
+    { prefix: ".stackwright/artifacts/", suffix: ".json", description: "Polish artifact" },
+    { prefix: "README.md", suffix: "", description: "Project README rewrite" }
+  ],
+  // domain-expert-otter is a reader/answerer only — it writes via stackwright_pro_save_phase_answers,
+  // not via safe_write. Entry required here because the MCP tool availability guard boilerplate
+  // in its system prompt mentions stackwright_pro_safe_write (triggering the coherence test).
+  "stackwright-pro-domain-expert-otter": [],
+  "stackwright-services-otter": [
+    { prefix: ".stackwright/artifacts/", suffix: ".json", description: "Services config artifact" },
+    { prefix: "services/", suffix: ".ts", description: "Service implementation files" },
+    { prefix: "services/", suffix: ".yaml", description: "Service flow definitions" },
+    { prefix: "services/", suffix: ".yml", description: "Service flow definitions" },
+    { prefix: "lib/seeds/", suffix: ".ts", description: "Seed data files" },
+    { prefix: "specs/", suffix: ".json", description: "Generated OpenAPI specs" },
+    { prefix: "specs/", suffix: ".yaml", description: "Generated OpenAPI specs" },
+    { prefix: "stackwright-generated/", suffix: ".json", description: "Services manifest" }
   ]
 };
 var PROTECTED_PATH_PREFIXES = [
   ".stackwright/pipeline-state.json",
+  ".stackwright/pipeline-keys.json",
+  // ephemeral signing keys
+  ".stackwright/artifacts/signatures.json",
+  // artifact signature manifest
   ".stackwright/questions/",
-  ".stackwright/answers/"
+  ".stackwright/answers/",
+  ".stackwright/page-registry.json"
+  // page ownership — managed by safe_write internally
 ];
+var MAX_SAFE_WRITE_BYTES_JSON = 512 * 1024;
+var MAX_SAFE_WRITE_BYTES_YAML = 256 * 1024;
+var MAX_SAFE_WRITE_BYTES_ENV = 4 * 1024;
+var MAX_SAFE_WRITE_BYTES_DEFAULT = 256 * 1024;
+function getMaxBytesForPath(filePath) {
+  if (filePath.endsWith(".json")) return { limit: MAX_SAFE_WRITE_BYTES_JSON, label: "JSON" };
+  if (filePath.endsWith(".yml") || filePath.endsWith(".yaml"))
+    return { limit: MAX_SAFE_WRITE_BYTES_YAML, label: "YAML" };
+  if (filePath === ".env" || /^\.env\.[a-zA-Z0-9]+/.test(filePath))
+    return { limit: MAX_SAFE_WRITE_BYTES_ENV, label: "env" };
+  return { limit: MAX_SAFE_WRITE_BYTES_DEFAULT, label: "default" };
+}
+var PAGE_REGISTRY_FILE = ".stackwright/page-registry.json";
+function extractPageSlug(filePath) {
+  const match = normalize(filePath).match(/^pages\/(.+?)\/content\.ya?ml$/);
+  return match?.[1] ?? null;
+}
+function extractContentTypes(yamlContent) {
+  const typePattern = /^\s*-?\s*type:\s*(\S+)/gm;
+  const types = [];
+  let m;
+  while ((m = typePattern.exec(yamlContent)) !== null) {
+    const typeName = m[1];
+    if (typeName && !types.includes(typeName)) {
+      types.push(typeName);
+    }
+  }
+  return types.length > 0 ? types : ["unknown"];
+}
+function readPageRegistry(cwd) {
+  const regPath = join5(cwd, PAGE_REGISTRY_FILE);
+  if (!existsSync6(regPath)) return {};
+  try {
+    const stat = lstatSync6(regPath);
+    if (stat.isSymbolicLink()) return {};
+    return JSON.parse(readFileSync5(regPath, "utf-8"));
+  } catch {
+    return {};
+  }
+}
+function writePageRegistry(cwd, registry) {
+  const dir = join5(cwd, ".stackwright");
+  mkdirSync5(dir, { recursive: true });
+  const regPath = join5(cwd, PAGE_REGISTRY_FILE);
+  if (existsSync6(regPath)) {
+    const stat = lstatSync6(regPath);
+    if (stat.isSymbolicLink()) {
+      throw new Error("Refusing to write page registry through symlink");
+    }
+  }
+  writeFileSync5(regPath, JSON.stringify(registry, null, 2) + "\n", { encoding: "utf-8" });
+}
+function checkPageOwnership(cwd, slug, callerOtter) {
+  const registry = readPageRegistry(cwd);
+  const existing = registry[slug];
+  if (!existing || existing.claimedBy === callerOtter) {
+    return { allowed: true };
+  }
+  return {
+    allowed: false,
+    owner: existing.claimedBy,
+    contentTypes: existing.contentTypes
+  };
+}
+var NEXTJS_BRACKET_SEGMENT_RE = /\[\[\.{3}[a-zA-Z_][a-zA-Z0-9_]*\]\]|\[\.{3}[a-zA-Z_][a-zA-Z0-9_]*\]|\[[a-zA-Z_][a-zA-Z0-9_]*\]/g;
+function stripNextjsBracketSegments(path3) {
+  return path3.replace(NEXTJS_BRACKET_SEGMENT_RE, "");
+}
 function checkPathAllowed(callerOtter, filePath) {
   const normalized = normalize(filePath);
-  if (normalized.includes("..")) {
+  if (stripNextjsBracketSegments(normalized).includes("..")) {
     return { allowed: false, error: 'Path traversal detected: ".." segments are not allowed' };
   }
   if (isAbsolute(normalized)) {
@@ -2246,6 +4091,16 @@ function checkPathAllowed(callerOtter, filePath) {
           continue;
         }
       }
+      if (rule.prefix === "lib/mock-auth" && rule.suffix === ".ts") {
+        if (normalized !== "lib/mock-auth.ts") {
+          continue;
+        }
+      }
+      if (rule.prefix === "package.json" && rule.suffix === ".json") {
+        if (normalized !== "package.json") {
+          continue;
+        }
+      }
       return { allowed: true, rule: rule.description };
     }
   }
@@ -2330,11 +4185,23 @@ function handleSafeWrite(input) {
     };
     return { text: JSON.stringify(result), isError: true };
   }
+  const contentBytes = Buffer.byteLength(content, "utf-8");
+  const { limit: maxBytes, label: fileTypeLabel } = getMaxBytesForPath(filePath);
+  if (contentBytes > maxBytes) {
+    const result = {
+      success: false,
+      error: `Content size ${contentBytes} bytes exceeds ${fileTypeLabel} limit of ${maxBytes} bytes (${maxBytes / 1024} KB)`,
+      callerOtter,
+      attemptedPath: filePath,
+      allowedPaths: []
+    };
+    return { text: JSON.stringify(result), isError: true };
+  }
   const normalized = normalize(filePath);
-  const fullPath = join4(cwd, normalized);
-  if (existsSync4(fullPath)) {
+  const fullPath = join5(cwd, normalized);
+  if (existsSync6(fullPath)) {
     try {
-      const stat = lstatSync4(fullPath);
+      const stat = lstatSync6(fullPath);
       if (stat.isSymbolicLink()) {
         const result = {
           success: false,
@@ -2359,11 +4226,38 @@ function handleSafeWrite(input) {
     };
     return { text: JSON.stringify(result), isError: true };
   }
+  const pageSlug = extractPageSlug(normalized);
+  if (pageSlug) {
+    const ownership = checkPageOwnership(cwd, pageSlug, callerOtter);
+    if (!ownership.allowed) {
+      const result = {
+        success: false,
+        error: `Page slug "${pageSlug}" is already claimed by ${ownership.owner} (content types: ${ownership.contentTypes.join(", ")}). Use a different slug or coordinate with the owning otter.`,
+        callerOtter,
+        attemptedPath: filePath,
+        allowedPaths: []
+      };
+      return { text: JSON.stringify(result), isError: true };
+    }
+  }
   try {
     if (createDirectories) {
-      mkdirSync3(dirname(fullPath), { recursive: true });
+      mkdirSync5(dirname(fullPath), { recursive: true });
+    }
+    writeFileSync5(fullPath, content, { encoding: "utf-8" });
+    if (pageSlug) {
+      try {
+        const registry = readPageRegistry(cwd);
+        registry[pageSlug] = {
+          slug: pageSlug,
+          claimedBy: callerOtter,
+          contentTypes: extractContentTypes(content),
+          writtenAt: (/* @__PURE__ */ new Date()).toISOString()
+        };
+        writePageRegistry(cwd, registry);
+      } catch {
+      }
     }
-    writeFileSync4(fullPath, content, { encoding: "utf-8" });
     const result = {
       success: true,
       path: normalized,
@@ -2389,10 +4283,12 @@ function registerSafeWriteTools(server2) {
     "stackwright_pro_safe_write",
     DESC,
     {
-      callerOtter: z10.string().describe('The otter agent name requesting the write, e.g. "stackwright-pro-page-otter"'),
-      filePath: z10.string().describe('Relative path from project root, e.g. "pages/dashboard/content.yml"'),
-      content: z10.string().describe("File content to write"),
-      createDirectories: z10.boolean().optional().describe("Create parent directories if they don't exist. Default: true")
+      callerOtter: z14.string().describe('The otter agent name requesting the write, e.g. "stackwright-pro-page-otter"'),
+      filePath: z14.string().describe('Relative path from project root, e.g. "pages/dashboard/content.yml"'),
+      content: z14.string().describe("File content to write"),
+      createDirectories: boolCoerce(z14.boolean().optional().default(true)).describe(
+        "Create parent directories if they don't exist. Default: true"
+      )
     },
     async ({ callerOtter, filePath, content, createDirectories }) => {
       const result = handleSafeWrite({
@@ -2407,9 +4303,9 @@ function registerSafeWriteTools(server2) {
 }
 
 // src/tools/auth.ts
-import { z as z11 } from "zod";
-import { readFileSync as readFileSync4, writeFileSync as writeFileSync5, existsSync as existsSync5 } from "fs";
-import { join as join5 } from "path";
+import { z as z15 } from "zod";
+import { readFileSync as readFileSync6, writeFileSync as writeFileSync6, existsSync as existsSync7, mkdirSync as mkdirSync6 } from "fs";
+import { join as join6 } from "path";
 function buildHierarchy(roles) {
   const h = {};
   for (let i = 0; i < roles.length - 1; i++) {
@@ -2429,6 +4325,19 @@ function routesToYaml(routes, defaultRole, indent) {
   return routes.map((r) => `${indent}- pattern: ${r}
 ${indent}  requiredRole: ${defaultRole}`).join("\n");
 }
+function detectNextMajorVersion(cwd) {
+  try {
+    const pkgPath = join6(cwd, "package.json");
+    if (!existsSync7(pkgPath)) return null;
+    const pkg = JSON.parse(readFileSync6(pkgPath, "utf8"));
+    const nextVersion = pkg.dependencies?.next ?? pkg.devDependencies?.next;
+    if (!nextVersion) return null;
+    const match = nextVersion.match(/(\d+)/);
+    return match ? parseInt(match[1], 10) : null;
+  } catch {
+    return null;
+  }
+}
 function upsertAuthBlock(existing, authYaml) {
   const lines = existing.split("\n");
   let authStart = -1;
@@ -2441,14 +4350,99 @@ function upsertAuthBlock(existing, authYaml) {
       break;
     }
   }
-  if (authStart < 0) {
-    return existing.trimEnd() + "\n" + authYaml + "\n";
+  if (authStart < 0) {
+    return existing.trimEnd() + "\n" + authYaml + "\n";
+  }
+  const before = lines.slice(0, authStart);
+  const after = lines.slice(authEnd);
+  return [...before, ...authYaml.trimEnd().split("\n"), ...after.length ? after : []].join("\n");
+}
+function generateMiddlewareContent(method, params, roles, defaultRole, hierarchy, auditEnabled, auditRetentionDays, protectedRoutes) {
+  const rbacBlock = `  rbac: {
+    roles: ${JSON.stringify(roles)},
+    defaultRole: '${defaultRole}',
+    hierarchy: ${JSON.stringify(hierarchy, null, 4)},
+  },`;
+  const auditBlock = `  audit: {
+    enabled: ${auditEnabled},
+    retentionDays: ${auditRetentionDays},
+  },`;
+  const routesBlock = `  protectedRoutes: ${JSON.stringify(protectedRoutes)},`;
+  const configBlock = `export const config = {
+  matcher: ${JSON.stringify(protectedRoutes)},
+};`;
+  if (method === "cac") {
+    const caBundle = params.cacCaBundle ?? "./certs/dod-ca-bundle.pem";
+    const edipiLookup = params.cacEdipiLookup ?? "./config/edipi-lookup.json";
+    const ocspEndpoint = params.cacOcspEndpoint ?? "https://ocsp.disa.mil";
+    const certHeader = params.cacCertHeader ?? "X-SSL-Client-Cert";
+    return `// middleware.ts \u2014 generated by @stackwright-pro/auth
+// \u26A0\uFE0F  SECURITY REVIEW REQUIRED \u2014 CAC/PKI certificate validation
+// DoD security officer review required before production deployment.
+// Verify: CA bundle completeness, EDIPI lookup endpoint, OCSP accessibility.
+import { createProMiddleware } from '@stackwright-pro/auth-nextjs/edge';
+
+export const middleware = createProMiddleware({
+  method: 'cac',
+  cac: {
+    caBundle: process.env.CAC_CA_BUNDLE ?? '${caBundle}',
+    edipiLookup: '${edipiLookup}',
+    ocspEndpoint: process.env.CAC_OCSP_ENDPOINT ?? '${ocspEndpoint}',
+    certHeader: '${certHeader}',
+  },
+${rbacBlock}
+${auditBlock}
+${routesBlock}
+});
+
+${configBlock}
+`;
+  }
+  if (method === "oidc") {
+    const scopes2 = params.oidcScopes ?? "openid profile email";
+    const roleClaim = params.oidcRoleClaim ?? "roles";
+    return `// middleware.ts \u2014 generated by @stackwright-pro/auth-nextjs
+import { createProMiddleware } from '@stackwright-pro/auth-nextjs/edge';
+
+export const middleware = createProMiddleware({
+  method: 'oidc',
+  oidc: {
+    discoveryUrl: process.env.OIDC_DISCOVERY_URL!,
+    clientId: process.env.OIDC_CLIENT_ID!,
+    clientSecret: process.env.OIDC_CLIENT_SECRET!,
+    scopes: '${scopes2}',
+    roleClaim: '${roleClaim}',
+  },
+${rbacBlock}
+${auditBlock}
+${routesBlock}
+});
+
+${configBlock}
+`;
   }
-  const before = lines.slice(0, authStart);
-  const after = lines.slice(authEnd);
-  return [...before, ...authYaml.trimEnd().split("\n"), ...after.length ? after : []].join("\n");
+  const scopes = params.oauth2Scopes ?? "read write";
+  return `// middleware.ts \u2014 generated by @stackwright-pro/auth-nextjs
+import { createProMiddleware } from '@stackwright-pro/auth-nextjs/edge';
+
+export const middleware = createProMiddleware({
+  method: 'oauth2',
+  oauth2: {
+    authorizationUrl: process.env.OAUTH2_AUTH_URL!,
+    tokenUrl: process.env.OAUTH2_TOKEN_URL!,
+    clientId: process.env.OAUTH2_CLIENT_ID!,
+    clientSecret: process.env.OAUTH2_CLIENT_SECRET!,
+    scopes: '${scopes}',
+  },
+${rbacBlock}
+${auditBlock}
+${routesBlock}
+});
+
+${configBlock}
+`;
 }
-function generateMiddlewareContent(method, params, roles, defaultRole, hierarchy, auditEnabled, auditRetentionDays, protectedRoutes) {
+function generateProxyContent(method, params, roles, defaultRole, hierarchy, auditEnabled, auditRetentionDays, protectedRoutes) {
   const rbacBlock = `  rbac: {
     roles: ${JSON.stringify(roles)},
     defaultRole: '${defaultRole}',
@@ -2467,13 +4461,13 @@ function generateMiddlewareContent(method, params, roles, defaultRole, hierarchy
     const edipiLookup = params.cacEdipiLookup ?? "./config/edipi-lookup.json";
     const ocspEndpoint = params.cacOcspEndpoint ?? "https://ocsp.disa.mil";
     const certHeader = params.cacCertHeader ?? "X-SSL-Client-Cert";
-    return `// middleware.ts \u2014 generated by @stackwright-pro/auth
-// \u26A0\uFE0F  SECURITY REVIEW REQUIRED \u2014 CAC/PKI certificate validation
+    return `// proxy.ts \u2014 generated by @stackwright-pro/auth (Next.js >=16)
+//   SECURITY REVIEW REQUIRED \u2014 CAC/PKI certificate validation
 // DoD security officer review required before production deployment.
 // Verify: CA bundle completeness, EDIPI lookup endpoint, OCSP accessibility.
-import { createProMiddleware } from '@stackwright-pro/auth-nextjs';
+import { createProProxy } from '@stackwright-pro/auth-nextjs/edge';
 
-export const middleware = createProMiddleware({
+export const proxy = createProProxy({
   method: 'cac',
   cac: {
     caBundle: process.env.CAC_CA_BUNDLE ?? '${caBundle}',
@@ -2492,10 +4486,10 @@ ${configBlock}
   if (method === "oidc") {
     const scopes2 = params.oidcScopes ?? "openid profile email";
     const roleClaim = params.oidcRoleClaim ?? "roles";
-    return `// middleware.ts \u2014 generated by @stackwright-pro/auth-nextjs
-import { createProMiddleware } from '@stackwright-pro/auth-nextjs';
+    return `// proxy.ts \u2014 generated by @stackwright-pro/auth (Next.js >=16)
+import { createProProxy } from '@stackwright-pro/auth-nextjs/edge';
 
-export const middleware = createProMiddleware({
+export const proxy = createProProxy({
   method: 'oidc',
   oidc: {
     discoveryUrl: process.env.OIDC_DISCOVERY_URL!,
@@ -2513,10 +4507,10 @@ ${configBlock}
 `;
   }
   const scopes = params.oauth2Scopes ?? "read write";
-  return `// middleware.ts \u2014 generated by @stackwright-pro/auth-nextjs
-import { createProMiddleware } from '@stackwright-pro/auth-nextjs';
+  return `// proxy.ts \u2014 generated by @stackwright-pro/auth (Next.js >=16)
+import { createProProxy } from '@stackwright-pro/auth-nextjs/edge';
 
-export const middleware = createProMiddleware({
+export const proxy = createProProxy({
   method: 'oauth2',
   oauth2: {
     authorizationUrl: process.env.OAUTH2_AUTH_URL!,
@@ -2559,7 +4553,7 @@ OAUTH2_CLIENT_ID=your-client-id
 OAUTH2_CLIENT_SECRET=your-client-secret
 `;
 }
-function generateYamlBlock(method, params, roles, defaultRole, hierarchy, auditEnabled, auditRetentionDays, protectedRoutes) {
+function generateYamlBlock(method, params, roles, defaultRole, hierarchy, auditEnabled, auditRetentionDays, protectedRoutes, useProxy) {
   const rbacSection = `  rbac:
     roles:
 ${rolesToYaml(roles, "      ")}
@@ -2582,7 +4576,7 @@ ${routesToYaml(protectedRoutes, "    ", defaultRole)}`.replace(/\n\s+,/g, "");
     const certHeader = params.cacCertHeader ?? "X-SSL-Client-Cert";
     return `auth:
   method: cac
-${providerLine}  middleware: ./middleware.ts
+${providerLine}  ${useProxy ? "proxy" : "middleware"}: ./${useProxy ? "proxy" : "middleware"}.ts
   cac:
     caBundle: \${CAC_CA_BUNDLE}
     edipiLookup: ${edipiLookup}
@@ -2599,7 +4593,7 @@ ${auditSection}
     const roleClaim = params.oidcRoleClaim ?? "roles";
     return `auth:
   method: oidc
-${providerLine}  middleware: ./middleware.ts
+${providerLine}  ${useProxy ? "proxy" : "middleware"}: ./${useProxy ? "proxy" : "middleware"}.ts
   oidc:
     discoveryUrl: \${OIDC_DISCOVERY_URL}
     clientId: \${OIDC_CLIENT_ID}
@@ -2615,7 +4609,7 @@ ${auditSection}
   const scopes = params.oauth2Scopes ?? "read write";
   return `auth:
   method: oauth2
-${providerLine}  middleware: ./middleware.ts
+${providerLine}  ${useProxy ? "proxy" : "middleware"}: ./${useProxy ? "proxy" : "middleware"}.ts
   oauth2:
     authorizationUrl: \${OAUTH2_AUTH_URL}
     tokenUrl: \${OAUTH2_TOKEN_URL}
@@ -2628,10 +4622,321 @@ ${routeLines}
 ${auditSection}
 `;
 }
+function generateDevOnlyMiddlewareContent(method, params, roles, defaultRole, hierarchy, auditEnabled, auditRetentionDays, protectedRoutes) {
+  const rbacBlock = `  rbac: {
+    roles: ${JSON.stringify(roles)},
+    defaultRole: '${defaultRole}',
+    hierarchy: ${JSON.stringify(hierarchy, null, 4)},
+  },`;
+  const auditBlock = `  audit: {
+    enabled: ${auditEnabled},
+    retentionDays: ${auditRetentionDays},
+  },`;
+  const routesBlock = `  protectedRoutes: ${JSON.stringify(protectedRoutes)},`;
+  const configBlock = `export const config = {
+  matcher: ${JSON.stringify(protectedRoutes)},
+};`;
+  const devHeader = [
+    "// middleware.ts \u2014 generated by @stackwright-pro/auth-nextjs (dev-only mock)",
+    "//   DEV ONLY \u2014 uses mock authentication from lib/mock-auth.ts",
+    "// Do NOT deploy to production.",
+    "import { createProMiddleware } from '@stackwright-pro/auth-nextjs/edge';",
+    "import { mockAuthProvider } from './lib/mock-auth';"
+  ].join("\n");
+  if (method === "cac") {
+    const caBundle = params.cacCaBundle ?? "./certs/dod-ca-bundle.pem";
+    const edipiLookup = params.cacEdipiLookup ?? "./config/edipi-lookup.json";
+    const ocspEndpoint = params.cacOcspEndpoint ?? "https://ocsp.disa.mil";
+    const certHeader = params.cacCertHeader ?? "X-SSL-Client-Cert";
+    return `${devHeader}
+
+export const middleware = createProMiddleware({
+  method: 'cac',
+  cac: {
+    caBundle: '${caBundle}',
+    edipiLookup: '${edipiLookup}',
+    ocspEndpoint: '${ocspEndpoint}',
+    certHeader: '${certHeader}',
+    provider: mockAuthProvider,
+  },
+${rbacBlock}
+${auditBlock}
+${routesBlock}
+});
+
+${configBlock}
+`;
+  }
+  if (method === "oidc") {
+    const scopes2 = params.oidcScopes ?? "openid profile email";
+    const roleClaim = params.oidcRoleClaim ?? "roles";
+    return `${devHeader}
+
+export const middleware = createProMiddleware({
+  method: 'oidc',
+  oidc: {
+    discoveryUrl: 'https://dev-mock-oidc/.well-known/openid-configuration',
+    clientId: 'dev-mock-client',
+    clientSecret: 'dev-mock-secret',
+    scopes: '${scopes2}',
+    roleClaim: '${roleClaim}',
+    provider: mockAuthProvider,
+  },
+${rbacBlock}
+${auditBlock}
+${routesBlock}
+});
+
+${configBlock}
+`;
+  }
+  const scopes = params.oauth2Scopes ?? "read write";
+  return `${devHeader}
+
+export const middleware = createProMiddleware({
+  method: 'oauth2',
+  oauth2: {
+    authorizationUrl: 'https://dev-mock-oauth2/authorize',
+    tokenUrl: 'https://dev-mock-oauth2/token',
+    clientId: 'dev-mock-client',
+    clientSecret: 'dev-mock-secret',
+    scopes: '${scopes}',
+    provider: mockAuthProvider,
+  },
+${rbacBlock}
+${auditBlock}
+${routesBlock}
+});
+
+${configBlock}
+`;
+}
+function generateDevOnlyProxyContent(method, params, roles, defaultRole, hierarchy, auditEnabled, auditRetentionDays, protectedRoutes) {
+  const rbacBlock = `  rbac: {
+    roles: ${JSON.stringify(roles)},
+    defaultRole: '${defaultRole}',
+    hierarchy: ${JSON.stringify(hierarchy, null, 4)},
+  },`;
+  const auditBlock = `  audit: {
+    enabled: ${auditEnabled},
+    retentionDays: ${auditRetentionDays},
+  },`;
+  const routesBlock = `  protectedRoutes: ${JSON.stringify(protectedRoutes)},`;
+  const configBlock = `export const config = {
+  matcher: ${JSON.stringify(protectedRoutes)},
+};`;
+  const devHeader = [
+    "// proxy.ts -- generated by @stackwright-pro/auth (Next.js >=16, dev-only mock)",
+    "//   DEV ONLY -- uses mock authentication from lib/mock-auth.ts",
+    "// Do NOT deploy to production.",
+    "import { createProProxy } from '@stackwright-pro/auth-nextjs/edge';",
+    "import { mockAuthProvider } from './lib/mock-auth';"
+  ].join("\n");
+  if (method === "cac") {
+    const caBundle = params.cacCaBundle ?? "./certs/dod-ca-bundle.pem";
+    const edipiLookup = params.cacEdipiLookup ?? "./config/edipi-lookup.json";
+    const ocspEndpoint = params.cacOcspEndpoint ?? "https://ocsp.disa.mil";
+    const certHeader = params.cacCertHeader ?? "X-SSL-Client-Cert";
+    return `${devHeader}
+
+export const proxy = createProProxy({
+  method: 'cac',
+  cac: {
+    caBundle: '${caBundle}',
+    edipiLookup: '${edipiLookup}',
+    ocspEndpoint: '${ocspEndpoint}',
+    certHeader: '${certHeader}',
+    provider: mockAuthProvider,
+  },
+${rbacBlock}
+${auditBlock}
+${routesBlock}
+});
+
+${configBlock}
+`;
+  }
+  if (method === "oidc") {
+    const scopes2 = params.oidcScopes ?? "openid profile email";
+    const roleClaim = params.oidcRoleClaim ?? "roles";
+    return `${devHeader}
+
+export const proxy = createProProxy({
+  method: 'oidc',
+  oidc: {
+    discoveryUrl: 'https://dev-mock-oidc/.well-known/openid-configuration',
+    clientId: 'dev-mock-client',
+    clientSecret: 'dev-mock-secret',
+    scopes: '${scopes2}',
+    roleClaim: '${roleClaim}',
+    provider: mockAuthProvider,
+  },
+${rbacBlock}
+${auditBlock}
+${routesBlock}
+});
+
+${configBlock}
+`;
+  }
+  const scopes = params.oauth2Scopes ?? "read write";
+  return `${devHeader}
+
+export const proxy = createProProxy({
+  method: 'oauth2',
+  oauth2: {
+    authorizationUrl: 'https://dev-mock-oauth2/authorize',
+    tokenUrl: 'https://dev-mock-oauth2/token',
+    clientId: 'dev-mock-client',
+    clientSecret: 'dev-mock-secret',
+    scopes: '${scopes}',
+    provider: mockAuthProvider,
+  },
+${rbacBlock}
+${auditBlock}
+${routesBlock}
+});
+
+${configBlock}
+`;
+}
+function generateDevOnlyYamlBlock(method, params, roles, defaultRole, hierarchy, auditEnabled, auditRetentionDays, protectedRoutes, useProxy) {
+  const rbacSection = `  rbac:
+    roles:
+${rolesToYaml(roles, "      ")}
+    defaultRole: ${defaultRole}
+    hierarchy:
+${hierarchyToYaml(hierarchy, "      ")}`;
+  const auditSection = `  audit:
+    enabled: ${auditEnabled}
+    retentionDays: ${auditRetentionDays}`;
+  const routeLines = protectedRoutes.map((r) => `    - pattern: ${r}
+      requiredRole: ${defaultRole}`).join("\n");
+  const providerLine = params.provider ? `  provider: ${params.provider}
+` : "";
+  if (method === "cac") {
+    const caBundle = params.cacCaBundle ?? "./certs/dod-ca-bundle.pem";
+    const edipiLookup = params.cacEdipiLookup ?? "./config/edipi-lookup.json";
+    const ocspEndpoint = params.cacOcspEndpoint ?? "https://ocsp.disa.mil";
+    const certHeader = params.cacCertHeader ?? "X-SSL-Client-Cert";
+    return `auth:
+  method: cac
+  devOnly: true
+${providerLine}  ${useProxy ? "proxy" : "middleware"}: ./${useProxy ? "proxy" : "middleware"}.ts
+  cac:
+    caBundle: ${caBundle}
+    edipiLookup: ${edipiLookup}
+    ocspEndpoint: ${ocspEndpoint}
+    certHeader: ${certHeader}
+${rbacSection}
+  protectedRoutes:
+${routeLines}
+${auditSection}
+`;
+  }
+  if (method === "oidc") {
+    const scopes2 = params.oidcScopes ?? "openid profile email";
+    const roleClaim = params.oidcRoleClaim ?? "roles";
+    return `auth:
+  method: oidc
+  devOnly: true
+${providerLine}  ${useProxy ? "proxy" : "middleware"}: ./${useProxy ? "proxy" : "middleware"}.ts
+  oidc:
+    discoveryUrl: https://dev-mock-oidc/.well-known/openid-configuration
+    clientId: dev-mock-client
+    clientSecret: dev-mock-secret
+    scopes: ${scopes2}
+    roleClaim: ${roleClaim}
+${rbacSection}
+  protectedRoutes:
+${routeLines}
+${auditSection}
+`;
+  }
+  const scopes = params.oauth2Scopes ?? "read write";
+  return `auth:
+  method: oauth2
+  devOnly: true
+${providerLine}  ${useProxy ? "proxy" : "middleware"}: ./${useProxy ? "proxy" : "middleware"}.ts
+  oauth2:
+    authorizationUrl: https://dev-mock-oauth2/authorize
+    tokenUrl: https://dev-mock-oauth2/token
+    clientId: dev-mock-client
+    clientSecret: dev-mock-secret
+    scopes: ${scopes}
+${rbacSection}
+  protectedRoutes:
+${routeLines}
+${auditSection}
+`;
+}
+function deriveDevKey(roleName) {
+  const segment = roleName.split("_")[0];
+  return (segment ?? roleName).toLowerCase();
+}
+function generateMockAuthContent(roles, mockUsers) {
+  const entries = [];
+  const scriptLines = [];
+  for (let i = 0; i < roles.length; i++) {
+    const role = roles[i];
+    const devKey = deriveDevKey(role);
+    const persona = mockUsers?.[i];
+    const name = persona?.name ?? `Dev ${role}`;
+    const email = persona?.email ?? `dev-${devKey}@example.mil`;
+    const edipi = String(i + 1).padStart(10, "0");
+    entries.push(`  ${devKey}: {
+    id: 'mock-${devKey}-${String(i + 1).padStart(3, "0")}',
+    name: '${name}',
+    email: '${email}',
+    roles: ['${role}'],
+    edipi: '${edipi}',
+  }`);
+    scriptLines.push(` *   pnpm dev:${devKey}   \u2014 ${name}`);
+  }
+  return `/**
+ * Mock authentication for development mode.
+ *
+ * DEV_ONLY_MODE \u2014 no real auth provider. Select a persona via MOCK_USER env var
+ * or use the convenience scripts in package.json:
+${scriptLines.join("\n")}
+ */
+
+export const MOCK_USERS = {
+${entries.join(",\n")}
+} as const;
+
+export type MockRole = keyof typeof MOCK_USERS;
+
+export function getMockUser(role?: string) {
+  const key = (role ?? process.env.MOCK_USER) as MockRole | undefined;
+  if (!key) return null;
+  return MOCK_USERS[key] ?? null;
+}
+
+export function mockAuthProvider() {
+  return getMockUser();
+}
+`;
+}
+function updatePackageJsonScripts(existingJson, roles, mockUsers) {
+  const pkg = JSON.parse(existingJson);
+  const scripts = pkg.scripts ?? {};
+  delete scripts["dev:admin"];
+  delete scripts["dev:analyst"];
+  delete scripts["dev:viewer"];
+  for (let i = 0; i < roles.length; i++) {
+    const devKey = deriveDevKey(roles[i]);
+    scripts[`dev:${devKey}`] = `MOCK_USER=${devKey} next dev`;
+  }
+  pkg.scripts = scripts;
+  return JSON.stringify(pkg, null, 2) + "\n";
+}
 async function configureAuthHandler(params, cwd) {
   const {
     method,
     provider,
+    devOnly = false,
+    mockUsers,
     rbacRoles = ["SUPER_ADMIN", "ADMIN", "ANALYST"],
     auditEnabled = true,
     auditRetentionDays = 90,
@@ -2640,7 +4945,10 @@ async function configureAuthHandler(params, cwd) {
   const roles = rbacRoles;
   const defaultRole = params.rbacDefaultRole ?? roles[roles.length - 1];
   const hierarchy = buildHierarchy(roles);
-  if (method === "none") {
+  const detectedVersion = params.nextMajorVersion ?? detectNextMajorVersion(cwd);
+  const useProxy = (detectedVersion ?? 0) >= 16;
+  const conventionFile = useProxy ? "proxy.ts" : "middleware.ts";
+  if (method === "none" && !devOnly) {
     return {
       content: [
         {
@@ -2653,16 +4961,46 @@ async function configureAuthHandler(params, cwd) {
             rbacDefaultRole: defaultRole,
             protectedRoutesCount: protectedRoutes.length,
             filesWritten: [],
-            securityWarning: null
+            securityWarning: null,
+            autoUpgradeWarning: null
           })
         }
       ]
     };
   }
+  const effectiveMethod = method === "none" ? "oidc" : method;
+  const autoUpgradeWarning = method === "none" ? "method: 'none' + devOnly: true was automatically upgraded to method: 'oidc' + devOnly: true. In DEV_ONLY_MODE, pass method: 'oidc' + devOnly: true directly (swp-5tmy)." : null;
   const filesWritten = [];
   try {
-    const middlewareContent = generateMiddlewareContent(
-      method,
+    const authFileContent = devOnly ? useProxy ? generateDevOnlyProxyContent(
+      effectiveMethod,
+      params,
+      roles,
+      defaultRole,
+      hierarchy,
+      auditEnabled,
+      auditRetentionDays,
+      protectedRoutes
+    ) : generateDevOnlyMiddlewareContent(
+      effectiveMethod,
+      params,
+      roles,
+      defaultRole,
+      hierarchy,
+      auditEnabled,
+      auditRetentionDays,
+      protectedRoutes
+    ) : useProxy ? generateProxyContent(
+      effectiveMethod,
+      params,
+      roles,
+      defaultRole,
+      hierarchy,
+      auditEnabled,
+      auditRetentionDays,
+      protectedRoutes
+    ) : generateMiddlewareContent(
+      effectiveMethod,
       params,
       roles,
       defaultRole,
@@ -2671,59 +5009,121 @@ async function configureAuthHandler(params, cwd) {
       auditRetentionDays,
       protectedRoutes
     );
-    writeFileSync5(join5(cwd, "middleware.ts"), middlewareContent, "utf8");
-    filesWritten.push("middleware.ts");
+    writeFileSync6(join6(cwd, conventionFile), authFileContent, "utf8");
+    filesWritten.push(conventionFile);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     return {
       content: [
         {
           type: "text",
-          text: JSON.stringify({ success: false, error: `Failed writing middleware.ts: ${msg}` })
+          text: JSON.stringify({
+            success: false,
+            error: `Failed writing ${conventionFile}: ${msg}`
+          })
         }
       ],
       isError: true
     };
   }
-  try {
-    const envBlock = generateEnvBlock(method, params);
-    const envPath = join5(cwd, ".env.example");
-    if (existsSync5(envPath)) {
-      const existing = readFileSync4(envPath, "utf8");
-      writeFileSync5(envPath, existing.trimEnd() + "\n\n" + envBlock, "utf8");
-    } else {
-      writeFileSync5(envPath, envBlock, "utf8");
+  if (!devOnly) {
+    try {
+      const envBlock = generateEnvBlock(effectiveMethod, params);
+      const envPath = join6(cwd, ".env.example");
+      if (existsSync7(envPath)) {
+        const existing = readFileSync6(envPath, "utf8");
+        writeFileSync6(envPath, existing.trimEnd() + "\n\n" + envBlock, "utf8");
+      } else {
+        writeFileSync6(envPath, envBlock, "utf8");
+      }
+      filesWritten.push(".env.example");
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify({ success: false, error: `Failed writing .env.example: ${msg}` })
+          }
+        ],
+        isError: true
+      };
+    }
+  }
+  if (devOnly) {
+    try {
+      const mockAuthDir = join6(cwd, "lib");
+      mkdirSync6(mockAuthDir, { recursive: true });
+      const mockAuthContent = generateMockAuthContent(roles, mockUsers);
+      writeFileSync6(join6(mockAuthDir, "mock-auth.ts"), mockAuthContent, "utf8");
+      filesWritten.push("lib/mock-auth.ts");
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify({
+              success: false,
+              error: `Failed writing lib/mock-auth.ts: ${msg}`
+            })
+          }
+        ],
+        isError: true
+      };
+    }
+    try {
+      const pkgPath = join6(cwd, "package.json");
+      if (existsSync7(pkgPath)) {
+        const existingPkg = readFileSync6(pkgPath, "utf8");
+        const updatedPkg = updatePackageJsonScripts(existingPkg, roles, mockUsers);
+        writeFileSync6(pkgPath, updatedPkg, "utf8");
+        filesWritten.push("package.json");
+      }
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify({
+              success: false,
+              error: `Failed updating package.json: ${msg}`
+            })
+          }
+        ],
+        isError: true
+      };
     }
-    filesWritten.push(".env.example");
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    return {
-      content: [
-        {
-          type: "text",
-          text: JSON.stringify({ success: false, error: `Failed writing .env.example: ${msg}` })
-        }
-      ],
-      isError: true
-    };
   }
   try {
-    const authYaml = generateYamlBlock(
-      method,
+    const authYaml = devOnly ? generateDevOnlyYamlBlock(
+      effectiveMethod,
       params,
       roles,
       defaultRole,
       hierarchy,
       auditEnabled,
       auditRetentionDays,
-      protectedRoutes
+      protectedRoutes,
+      useProxy
+    ) : generateYamlBlock(
+      effectiveMethod,
+      params,
+      roles,
+      defaultRole,
+      hierarchy,
+      auditEnabled,
+      auditRetentionDays,
+      protectedRoutes,
+      useProxy
     );
-    const ymlPath = join5(cwd, "stackwright.yml");
-    if (!existsSync5(ymlPath)) {
-      writeFileSync5(ymlPath, authYaml, "utf8");
+    const ymlPath = join6(cwd, "stackwright.yml");
+    if (!existsSync7(ymlPath)) {
+      writeFileSync6(ymlPath, authYaml, "utf8");
     } else {
-      const existing = readFileSync4(ymlPath, "utf8");
-      writeFileSync5(ymlPath, upsertAuthBlock(existing, authYaml), "utf8");
+      const existing = readFileSync6(ymlPath, "utf8");
+      writeFileSync6(ymlPath, upsertAuthBlock(existing, authYaml), "utf8");
     }
     filesWritten.push("stackwright.yml");
   } catch (err) {
@@ -2738,20 +5138,37 @@ async function configureAuthHandler(params, cwd) {
       isError: true
     };
   }
-  const securityWarning = method === "cac" ? "SECURITY REVIEW REQUIRED \u2014 CAC certificate chain must be verified before production deployment" : null;
+  const securityWarning = effectiveMethod === "cac" ? "SECURITY REVIEW REQUIRED \u2014 CAC certificate chain must be verified before production deployment" : null;
   return {
     content: [
       {
         type: "text",
         text: JSON.stringify({
           success: true,
-          method,
+          method: effectiveMethod,
           provider: provider ?? null,
           rbacRoles: roles,
           rbacDefaultRole: defaultRole,
           protectedRoutesCount: protectedRoutes.length,
           filesWritten,
-          securityWarning
+          convention: useProxy ? "proxy" : "middleware",
+          nextMajorVersion: params.nextMajorVersion ?? null,
+          securityWarning,
+          autoUpgradeWarning,
+          ...devOnly ? {
+            devScripts: {
+              written: filesWritten.includes("package.json"),
+              scripts: filesWritten.includes("package.json") ? Object.fromEntries(
+                roles.map((r) => {
+                  const k = deriveDevKey(r);
+                  return [`dev:${k}`, `MOCK_USER=${k} next dev`];
+                })
+              ) : {},
+              ...filesWritten.includes("package.json") ? {} : {
+                warning: "package.json not found \u2014 dev scripts were not written. Run the auth phase again after scaffolding creates package.json."
+              }
+            }
+          } : {}
         })
       }
     ]
@@ -2762,35 +5179,38 @@ function registerAuthTools(server2) {
     "stackwright_pro_configure_auth",
     "Generate authentication middleware and configuration for a Next.js Stackwright application. Writes `middleware.ts` from a secure template, appends/updates the `auth:` section in `stackwright.yml`, and generates `.env.example` with required environment variables. \u26A0\uFE0F For CAC/PKI: generated `middleware.ts` carries a SECURITY REVIEW REQUIRED comment \u2014 certificate chain validation must be verified by a DoD security officer before production deployment. This is the ONLY approved path to generating `middleware.ts`. Never write TypeScript auth files directly.",
     {
-      method: z11.enum(["cac", "oidc", "oauth2", "none"]),
-      provider: z11.enum(["azure-ad", "okta", "ping", "cognito", "custom"]).optional(),
+      method: z15.enum(["cac", "oidc", "oauth2", "none"]),
+      provider: z15.enum(["azure-ad", "okta", "ping", "cognito", "custom"]).optional(),
       // CAC
-      cacCaBundle: z11.string().optional(),
-      cacEdipiLookup: z11.string().optional(),
-      cacOcspEndpoint: z11.string().optional(),
-      cacCertHeader: z11.string().optional(),
+      cacCaBundle: z15.string().optional(),
+      cacEdipiLookup: z15.string().optional(),
+      cacOcspEndpoint: z15.string().optional(),
+      cacCertHeader: z15.string().optional(),
       // OIDC
-      oidcDiscoveryUrl: z11.string().optional(),
-      oidcClientId: z11.string().optional(),
-      oidcClientSecret: z11.string().optional(),
-      oidcScopes: z11.string().optional(),
-      oidcRoleClaim: z11.string().optional(),
+      oidcDiscoveryUrl: z15.string().optional(),
+      oidcClientId: z15.string().optional(),
+      oidcClientSecret: z15.string().optional(),
+      oidcScopes: z15.string().optional(),
+      oidcRoleClaim: z15.string().optional(),
       // OAuth2
-      oauth2AuthUrl: z11.string().optional(),
-      oauth2TokenUrl: z11.string().optional(),
-      oauth2ClientId: z11.string().optional(),
-      oauth2ClientSecret: z11.string().optional(),
-      oauth2Scopes: z11.string().optional(),
+      oauth2AuthUrl: z15.string().optional(),
+      oauth2TokenUrl: z15.string().optional(),
+      oauth2ClientId: z15.string().optional(),
+      oauth2ClientSecret: z15.string().optional(),
+      oauth2Scopes: z15.string().optional(),
       // RBAC
-      rbacRoles: z11.array(z11.string()).optional(),
-      rbacDefaultRole: z11.string().optional(),
+      rbacRoles: jsonCoerce(z15.array(z15.string()).optional()),
+      rbacDefaultRole: z15.string().optional(),
       // Audit
-      auditEnabled: z11.boolean().optional(),
-      auditRetentionDays: z11.number().int().positive().optional(),
+      auditEnabled: boolCoerce(z15.boolean().optional()),
+      auditRetentionDays: numCoerce(z15.number().int().positive().optional()),
       // Routes
-      protectedRoutes: z11.array(z11.string()).optional(),
+      protectedRoutes: jsonCoerce(z15.array(z15.string()).optional()),
       // Injection for tests
-      _cwd: z11.string().optional()
+      _cwd: z15.string().optional(),
+      devOnly: boolCoerce(z15.boolean().optional()),
+      mockUsers: jsonCoerce(z15.array(z15.object({ name: z15.string(), email: z15.string() })).optional()),
+      nextMajorVersion: numCoerce(z15.number().int().positive().optional())
     },
     async (params) => {
       const cwd = params._cwd ?? process.cwd();
@@ -2800,45 +5220,65 @@ function registerAuthTools(server2) {
 }
 
 // src/integrity.ts
-import { createHash as createHash2, timingSafeEqual } from "crypto";
-import { readFileSync as readFileSync5, readdirSync, lstatSync as lstatSync5 } from "fs";
-import { join as join6, basename } from "path";
+import { createHash as createHash4, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { readFileSync as readFileSync7, readdirSync as readdirSync2, lstatSync as lstatSync7 } from "fs";
+import { join as join7, basename } from "path";
 var _checksums = /* @__PURE__ */ new Map([
   [
     "stackwright-pro-api-otter.json",
-    "f1cc9edf2dd1df3ebcea1d0ab33d17a358faaf8aa97ee232cd7994042f2eac0d"
+    "df79f4389a576c2885efa07b04f613c60eb8ebf4a8b1d4c7da5e4bb6ee4248dd"
   ],
   [
     "stackwright-pro-auth-otter.json",
-    "a19e06c503209a8a35fe321d30448623545b36b48c47a6ec064d13406ad1f725"
+    "07134125ab4f8c82ee015f27587e4d84bdeefca5ec211d1563bcb25b8aa61eb3"
   ],
   [
     "stackwright-pro-dashboard-otter.json",
-    "b3cb3d7554f2e9eed3b57d5e0e3bf85d6ba5b4db5d3af5514391cf0575fcc001"
+    "160af221e04200f53709f8c3e249ca6dafb38a325b232fabd478b28f5492ab01"
   ],
   [
     "stackwright-pro-data-otter.json",
-    "bfacb87ae82867472a75982215554336a105a658d6cd3dd2c8b819fa1e11d7ac"
+    "709c8e49328908549fe87de181a5991e09c918ef24bbfe6948f9888f0c758c25"
   ],
   [
     "stackwright-pro-designer-otter.json",
-    "c58fa7c7ead9e6398074e1c7ce3f31a8ef4eb3679f5fa18cc03cae3a87878c88"
+    "1364b2c235c07b0b798e9aab90a68604f60019a5508d41ba576977f173e20cd9"
+  ],
+  [
+    "stackwright-pro-domain-expert-otter.json",
+    "1f21b8ff3450bdae29a4d31b31462ba22583995a448af3c11ab0a5071f46bd72"
   ],
   [
     "stackwright-pro-foreman-otter.json",
-    "27f4dfd4676246c9fea14fd1de4f148928eeaf06e58b08240761fd3e663dd540"
+    "438b03d2c35f64536055c68b3a9044fe3b5e4f2889acde4500dd801fad724be1"
+  ],
+  [
+    "stackwright-pro-geo-otter.json",
+    "2ec83c26a08c413d9553ff8b8f0f0f643c1a8da043741b356e27106cad78f05f"
   ],
   [
     "stackwright-pro-page-otter.json",
-    "65bec3a3a0dda6b7591bba2de9399f1e3a4fb99cfe1075342f4f4be98d917b67"
+    "0057ea97f7c2e33a8673140f59a0237eb627d82c676af3fae4faa31033598e03"
+  ],
+  [
+    "stackwright-pro-polish-otter.json",
+    "bd87327b9a9a62fabaee8837492ce943feae8bfc15e5d43b45ba0e84619daec3"
+  ],
+  [
+    "stackwright-pro-scaffold-otter.json",
+    "91de5861f1406043d1d387388302fb1492211b81e2eea9777dec60e48f317f2a"
   ],
   [
     "stackwright-pro-theme-otter.json",
-    "64ffaeeceacd739922788a1d074f6feaffc3f91d09706c2c104f0c0281677732"
+    "fe10108e3ba67106751ea662f512bb5f4eb58f7abda26880ef4cf6b0f9feb944"
   ],
   [
     "stackwright-pro-workflow-otter.json",
-    "0eec9d6a731678cf547c2a7b0b6fc338ca143c35501365a1e4e5dd2779dd5510"
+    "5f6209fadc1355580e2455a16386f06bd7d5814f047b2dd5b33800abf6a48ff8"
+  ],
+  [
+    "stackwright-services-otter.json",
+    "c013d7fc2475e62d0af54d57bc988182feee7766bac0edf841cbfad5c73e9261"
   ]
 ]);
 Object.freeze(_checksums);
@@ -2853,11 +5293,11 @@ for (const [name, digest] of CANONICAL_CHECKSUMS) {
 }
 var MAX_OTTER_BYTES = 1 * 1024 * 1024;
 function computeSha256(data) {
-  return createHash2("sha256").update(data).digest("hex");
+  return createHash4("sha256").update(data).digest("hex");
 }
 function safeEqual(a, b) {
   if (a.length !== b.length) return false;
-  return timingSafeEqual(Buffer.from(a, "utf8"), Buffer.from(b, "utf8"));
+  return timingSafeEqual2(Buffer.from(a, "utf8"), Buffer.from(b, "utf8"));
 }
 function verifyOtterFile(filePath) {
   const filename = basename(filePath);
@@ -2867,7 +5307,7 @@ function verifyOtterFile(filePath) {
   }
   let stat;
   try {
-    stat = lstatSync5(filePath);
+    stat = lstatSync7(filePath);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     return { verified: false, filename, error: `Cannot stat file: ${msg}` };
@@ -2885,7 +5325,7 @@ function verifyOtterFile(filePath) {
   }
   let raw;
   try {
-    raw = readFileSync5(filePath);
+    raw = readFileSync7(filePath);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     return { verified: false, filename, error: `Cannot read file: ${msg}` };
@@ -2918,12 +5358,24 @@ function verifyOtterFile(filePath) {
   return { verified: true, filename };
 }
 function verifyAllOtters(otterDir) {
+  if (/(?:^|[/\\])\.\.(?:[/\\]|$)/.test(otterDir) || otterDir.includes("..")) {
+    return {
+      verified: [],
+      failed: [
+        {
+          filename: "<directory>",
+          error: `Security: path traversal sequence detected in otter directory parameter`
+        }
+      ],
+      unknown: []
+    };
+  }
   const verified = [];
   const failed = [];
   const unknown = [];
   let entries;
   try {
-    entries = readdirSync(otterDir);
+    entries = readdirSync2(otterDir);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     return {
@@ -2934,9 +5386,9 @@ function verifyAllOtters(otterDir) {
   }
   const otterFiles = entries.filter((f) => f.endsWith("-otter.json"));
   for (const filename of otterFiles) {
-    const filePath = join6(otterDir, filename);
+    const filePath = join7(otterDir, filename);
     try {
-      if (lstatSync5(filePath).isSymbolicLink()) {
+      if (lstatSync7(filePath).isSymbolicLink()) {
         failed.push({ filename, error: "Skipped: symlink" });
         continue;
       }
@@ -2962,15 +5414,30 @@ var DEFAULT_SEARCH_PATHS = ["node_modules/@stackwright-pro/otters/src/", "packag
 function resolveOtterDir() {
   const cwd = process.cwd();
   for (const relative of DEFAULT_SEARCH_PATHS) {
-    const candidate = join6(cwd, relative);
+    const candidate = join7(cwd, relative);
     try {
-      lstatSync5(candidate);
+      lstatSync7(candidate);
       return candidate;
     } catch {
     }
   }
   return null;
 }
+function emitIntegrityAuditEvent(params) {
+  const record = JSON.stringify({
+    level: "AUDIT",
+    event: "INTEGRITY_FAIL",
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    source: "stackwright_pro_verify_otter_integrity",
+    otterDir: params.otterDir,
+    failedCount: params.failed.length,
+    unknownCount: params.unknown.length,
+    failures: params.failed,
+    unknown: params.unknown
+  });
+  process.stderr.write(`INTEGRITY_FAIL ${record}
+`);
+}
 function registerIntegrityTools(server2) {
   server2.tool(
     "stackwright_pro_verify_otter_integrity",
@@ -2994,6 +5461,13 @@ function registerIntegrityTools(server2) {
       }
       const result = verifyAllOtters(resolved);
       const allGood = result.failed.length === 0 && result.unknown.length === 0;
+      if (!allGood) {
+        emitIntegrityAuditEvent({
+          otterDir: resolved,
+          failed: result.failed,
+          unknown: result.unknown
+        });
+      }
       return {
         content: [
           {
@@ -3007,25 +5481,27 @@ function registerIntegrityTools(server2) {
               verified: result.verified,
               failed: result.failed,
               unknown: result.unknown,
-              warning: result.failed.length > 0 ? "SHA-256 mismatches detected (non-blocking). PKI-signed manifest support coming soon." : void 0
+              ...allGood ? {} : {
+                error: "INTEGRITY CHECK FAILED: SHA-256 mismatch detected in otter agent definitions. Do not proceed \u2014 otter files may have been tampered with."
+              }
             })
           }
         ],
-        isError: false
+        isError: !allGood
       };
     }
   );
 }
 
 // src/tools/domain.ts
-import { z as z12 } from "zod";
-import { readFileSync as readFileSync6, existsSync as existsSync6 } from "fs";
-import { join as join7 } from "path";
+import { z as z16 } from "zod";
+import { readFileSync as readFileSync8, existsSync as existsSync8 } from "fs";
+import { join as join8 } from "path";
 function handleListCollections(input) {
   const cwd = input._cwd ?? process.cwd();
   const sources = [
     {
-      path: join7(cwd, ".stackwright", "artifacts", "data-config.json"),
+      path: join8(cwd, ".stackwright", "artifacts", "data-config.json"),
       source: "data-config.json",
       parse: (raw) => {
         const parsed = JSON.parse(raw);
@@ -3036,15 +5512,15 @@ function handleListCollections(input) {
       }
     },
     {
-      path: join7(cwd, "stackwright.yml"),
+      path: join8(cwd, "stackwright.yml"),
       source: "stackwright.yml",
       parse: extractCollectionsFromYaml
     }
   ];
   for (const { path: path3, source, parse } of sources) {
-    if (!existsSync6(path3)) continue;
+    if (!existsSync8(path3)) continue;
     try {
-      const collections = parse(readFileSync6(path3, "utf8"));
+      const collections = parse(readFileSync8(path3, "utf8"));
       return {
         text: JSON.stringify({ collections, source, collectionCount: collections.length }),
         isError: false
@@ -3195,8 +5671,8 @@ function handleValidateWorkflow(input) {
   if (input.workflow && Object.keys(input.workflow).length > 0) {
     raw = input.workflow;
   } else {
-    const artifactPath = join7(cwd, ".stackwright", "artifacts", "workflow-config.json");
-    if (!existsSync6(artifactPath)) {
+    const artifactPath = join8(cwd, ".stackwright", "artifacts", "workflow-config.json");
+    if (!existsSync8(artifactPath)) {
       return fail([
         {
           code: "NO_WORKFLOW",
@@ -3205,7 +5681,7 @@ function handleValidateWorkflow(input) {
       ]);
     }
     try {
-      raw = JSON.parse(readFileSync6(artifactPath, "utf8"));
+      raw = JSON.parse(readFileSync8(artifactPath, "utf8"));
     } catch (err) {
       return fail([{ code: "INVALID_JSON", message: `Failed to parse workflow artifact: ${err}` }]);
     }
@@ -3404,7 +5880,7 @@ function registerDomainTools(server2) {
     "stackwright_pro_resolve_data_strategy",
     "Look up the data freshness strategy configuration from the user's answer. Returns mechanism, revalidation seconds, required packages, and the exact MCP tool call to make. Replaces the strategy table in the data-otter prompt.",
     {
-      strategy: z12.string().describe(
+      strategy: z16.string().describe(
         'The data-1 answer value: "pulse-fast", "isr-fast", "isr-standard", or "isr-slow"'
       )
     },
@@ -3414,7 +5890,7 @@ function registerDomainTools(server2) {
     "stackwright_pro_validate_workflow",
     "Validate a workflow definition against the Stackwright workflow schema. Checks step ID uniqueness, transition targets, terminal state existence, and service references. Call this after the workflow otter produces output.",
     {
-      workflow: z12.record(z12.string(), z12.unknown()).optional().describe(
+      workflow: jsonCoerce(z16.record(z16.string(), z16.unknown()).optional()).describe(
         "Parsed workflow object. If omitted, reads from .stackwright/artifacts/workflow-config.json"
       )
     },
@@ -3422,18 +5898,598 @@ function registerDomainTools(server2) {
   );
 }
 
+// src/tools/type-schemas.ts
+import { z as z17 } from "zod";
+function buildTypeSchemaSummary() {
+  return {
+    version: "1.0",
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    domains: {
+      workflow: {
+        description: "Workflow DSL \u2014 step definitions, auth blocks, field types, conditions",
+        schemas: [
+          "WorkflowFileSchema",
+          "WorkflowDefinitionSchema",
+          "WorkflowStepSchema",
+          "WorkflowStepTypeSchema",
+          "WorkflowFieldSchema",
+          "WorkflowActionSchema",
+          "WorkflowAuthSchema",
+          "WorkflowThemeSchema",
+          "TransitionConditionSchema",
+          "PersistenceSchema"
+        ],
+        otter: "stackwright-pro-workflow-otter",
+        artifactKey: "workflowConfig"
+      },
+      auth: {
+        description: "Authentication providers \u2014 PKI/CAC, OIDC, RBAC configuration",
+        schemas: [
+          "authConfigSchema",
+          "pkiConfigSchema",
+          "oidcConfigSchema",
+          "rbacConfigSchema",
+          "componentAuthSchema",
+          "authUserSchema",
+          "authSessionSchema"
+        ],
+        otter: "stackwright-pro-auth-otter",
+        artifactKey: "authConfig"
+      },
+      openapi: {
+        description: "OpenAPI spec integration \u2014 collection config, endpoint filters, actions",
+        interfaces: [
+          "OpenAPIConfig",
+          "ActionConfig",
+          "EndpointFilter",
+          "ApprovedSpec",
+          "PrebuildSecurityConfig",
+          "SiteConfig",
+          "ValidationResult"
+        ],
+        otter: "stackwright-pro-api-otter",
+        artifactKey: "apiConfig"
+      },
+      pulse: {
+        description: "Real-time data polling \u2014 source-agnostic polling options and states",
+        interfaces: ["PulseOptions", "PulseMeta", "PulseState"],
+        note: "React-bound types (PulseProps, PulseIndicatorProps) remain in @stackwright-pro/pulse"
+      },
+      enterprise: {
+        description: "Enterprise collection access \u2014 multi-tenant provider extension",
+        interfaces: [
+          "EnterpriseCollectionProvider",
+          "CollectionProvider",
+          "CollectionEntry",
+          "CollectionListOptions",
+          "CollectionListResult",
+          "TenantFilter",
+          "Collection"
+        ],
+        note: "CollectionProvider, CollectionEntry, CollectionListOptions, and CollectionListResult are re-exported from @stackwright/types (^1.5.0). EnterpriseCollectionProvider, TenantFilter, and Collection are Pro-only extensions."
+      }
+    }
+  };
+}
+function registerTypeSchemasTool(server2) {
+  server2.tool(
+    "stackwright_pro_get_type_schemas",
+    "Returns a structured summary of all canonical @stackwright-pro/types schemas, organized by domain. Use this to determine which otter owns a given schema and what artifact key to expect.",
+    {
+      format: z17.enum(["full", "domains-only"]).optional().default("full").describe("full = complete summary with all fields; domains-only = just domain names")
+    },
+    async ({ format }) => {
+      const summary = buildTypeSchemaSummary();
+      const output = format === "domains-only" ? Object.keys(summary.domains) : summary;
+      return {
+        content: [{ type: "text", text: JSON.stringify(output, null, 2) }]
+      };
+    }
+  );
+}
+
+// src/tools/scaffold-cleanup.ts
+import {
+  existsSync as existsSync9,
+  lstatSync as lstatSync8,
+  unlinkSync as unlinkSync2,
+  readFileSync as readFileSync9,
+  writeFileSync as writeFileSync7,
+  readdirSync as readdirSync3,
+  rmdirSync,
+  mkdirSync as mkdirSync7
+} from "fs";
+import { join as join9, dirname as dirname2 } from "path";
+var SCAFFOLD_FILES_TO_DELETE = [
+  "content/posts/getting-started.yaml",
+  "content/posts/hello-world.yaml"
+];
+var GETTING_STARTED_SCAFFOLD_FINGERPRINTS = [
+  "Welcome to your new Stackwright",
+  "Petstore API",
+  "Petstore"
+];
+var POST_FILE_EXTENSIONS = [".yaml", ".yml", ".md", ".mdx"];
+var POSTS_COLLECTION_FILE = "_collection.yaml";
+var SCAFFOLD_DIRS_TO_PRUNE = [
+  "pages/getting-started",
+  "content/posts"
+  // Don't prune 'content' — user may have other content directories
+];
+var NOT_FOUND_PATH = "app/not-found.tsx";
+var FALLBACK_COLORS = {
+  background: "#ffffff",
+  foreground: "#171717",
+  primary: "#525252",
+  mutedForeground: "#737373"
+};
+function readThemeColors(cwd) {
+  const tokenPath = join9(cwd, ".stackwright", "artifacts", "theme-tokens.json");
+  if (!existsSync9(tokenPath)) return { ...FALLBACK_COLORS };
+  const stat = lstatSync8(tokenPath);
+  if (stat.isSymbolicLink()) return { ...FALLBACK_COLORS };
+  try {
+    const raw = JSON.parse(readFileSync9(tokenPath, "utf-8"));
+    const css = raw?.cssVariables ?? {};
+    const toHsl = (hslValue) => {
+      if (!hslValue || typeof hslValue !== "string") return null;
+      return `hsl(${hslValue})`;
+    };
+    return {
+      background: toHsl(css["--background"]) ?? FALLBACK_COLORS.background,
+      foreground: toHsl(css["--foreground"]) ?? FALLBACK_COLORS.foreground,
+      primary: toHsl(css["--primary"]) ?? FALLBACK_COLORS.primary,
+      mutedForeground: toHsl(css["--muted-foreground"]) ?? FALLBACK_COLORS.mutedForeground
+    };
+  } catch {
+    return { ...FALLBACK_COLORS };
+  }
+}
+function generateNotFoundPage(colors) {
+  return `export default function NotFound() {
+  return (
+    <div
+      style={{
+        display: 'flex',
+        flexDirection: 'column',
+        alignItems: 'center',
+        justifyContent: 'center',
+        minHeight: '100vh',
+        backgroundColor: '${colors.background}',
+        color: '${colors.foreground}',
+        fontFamily: 'system-ui, -apple-system, sans-serif',
+        padding: '2rem',
+        textAlign: 'center',
+      }}
+    >
+      <h1 style={{ fontSize: '4rem', fontWeight: 700, margin: 0, color: '${colors.primary}' }}>
+        404
+      </h1>
+      <p style={{ fontSize: '1.25rem', color: '${colors.mutedForeground}', marginTop: '0.5rem' }}>
+        Page not found
+      </p>
+      <a
+        href="/"
+        style={{
+          marginTop: '2rem',
+          padding: '0.75rem 1.5rem',
+          backgroundColor: '${colors.primary}',
+          color: '${colors.background}',
+          borderRadius: '0.5rem',
+          textDecoration: 'none',
+          fontSize: '0.875rem',
+          fontWeight: 500,
+        }}
+      >
+        Go Home
+      </a>
+    </div>
+  );
+}
+`;
+}
+function isSafePath(fullPath) {
+  if (!existsSync9(fullPath)) return true;
+  const stat = lstatSync8(fullPath);
+  return !stat.isSymbolicLink();
+}
+function isDirEmpty(dirPath) {
+  if (!existsSync9(dirPath)) return false;
+  const stat = lstatSync8(dirPath);
+  if (!stat.isDirectory()) return false;
+  return readdirSync3(dirPath).length === 0;
+}
+function handleCleanupScaffold(_cwd) {
+  const cwd = _cwd ?? process.cwd();
+  const result = {
+    deleted: [],
+    rewritten: [],
+    skipped: [],
+    errors: [],
+    prunedDirs: [],
+    cleanupWarnings: []
+  };
+  for (const relPath of SCAFFOLD_FILES_TO_DELETE) {
+    const fullPath = join9(cwd, relPath);
+    if (!existsSync9(fullPath)) {
+      result.skipped.push(relPath);
+      continue;
+    }
+    if (!isSafePath(fullPath)) {
+      result.errors.push(`Refusing to delete symlink: ${relPath}`);
+      continue;
+    }
+    try {
+      unlinkSync2(fullPath);
+      result.deleted.push(relPath);
+    } catch (err) {
+      result.errors.push(`Failed to delete ${relPath}: ${String(err)}`);
+    }
+  }
+  {
+    const relPath = "pages/getting-started/content.yml";
+    const fullPath = join9(cwd, relPath);
+    if (!existsSync9(fullPath)) {
+      result.skipped.push(relPath);
+    } else if (!isSafePath(fullPath)) {
+      result.errors.push(`Refusing to delete symlink: ${relPath}`);
+    } else {
+      const content = readFileSync9(fullPath, "utf-8");
+      const isScaffoldDefault = GETTING_STARTED_SCAFFOLD_FINGERPRINTS.some(
+        (marker) => content.includes(marker)
+      );
+      if (isScaffoldDefault) {
+        try {
+          unlinkSync2(fullPath);
+          result.deleted.push(relPath);
+        } catch (err) {
+          result.errors.push(`Failed to delete ${relPath}: ${String(err)}`);
+        }
+      } else {
+        result.cleanupWarnings.push(
+          `pages/getting-started/content.yml preserved \u2014 no scaffold fingerprint found (user-modified content)`
+        );
+      }
+    }
+  }
+  {
+    const relPath = `content/posts/${POSTS_COLLECTION_FILE}`;
+    const fullPath = join9(cwd, relPath);
+    const postsDir = join9(cwd, "content/posts");
+    if (!existsSync9(fullPath)) {
+      result.skipped.push(relPath);
+    } else if (!isSafePath(fullPath)) {
+      result.errors.push(`Refusing to delete symlink: ${relPath}`);
+    } else if (!existsSync9(postsDir)) {
+      result.skipped.push(relPath);
+    } else {
+      const userPostFiles = readdirSync3(postsDir).filter(
+        (f) => f !== POSTS_COLLECTION_FILE && POST_FILE_EXTENSIONS.some((ext) => f.endsWith(ext))
+      );
+      if (userPostFiles.length === 0) {
+        try {
+          unlinkSync2(fullPath);
+          result.deleted.push(relPath);
+        } catch (err) {
+          result.errors.push(`Failed to delete ${relPath}: ${String(err)}`);
+        }
+      } else {
+        result.cleanupWarnings.push(
+          `content/posts/_collection.yaml preserved \u2014 ${userPostFiles.length} user post file(s) exist: ${userPostFiles.slice(0, 3).join(", ")}`
+        );
+      }
+    }
+  }
+  for (const relDir of SCAFFOLD_DIRS_TO_PRUNE) {
+    const fullDir = join9(cwd, relDir);
+    if (!existsSync9(fullDir)) continue;
+    if (!isSafePath(fullDir)) {
+      result.errors.push(`Refusing to prune symlink directory: ${relDir}`);
+      continue;
+    }
+    if (isDirEmpty(fullDir)) {
+      try {
+        rmdirSync(fullDir);
+        result.prunedDirs.push(relDir);
+      } catch (err) {
+        result.errors.push(`Failed to prune directory ${relDir}: ${String(err)}`);
+      }
+    }
+  }
+  {
+    const fullPath = join9(cwd, NOT_FOUND_PATH);
+    if (!existsSync9(fullPath)) {
+      result.skipped.push(NOT_FOUND_PATH);
+    } else if (!isSafePath(fullPath)) {
+      result.errors.push(`Refusing to rewrite symlink: ${NOT_FOUND_PATH}`);
+    } else {
+      try {
+        const colors = readThemeColors(cwd);
+        const content = generateNotFoundPage(colors);
+        const dir = dirname2(fullPath);
+        mkdirSync7(dir, { recursive: true });
+        writeFileSync7(fullPath, content, "utf-8");
+        result.rewritten.push(NOT_FOUND_PATH);
+      } catch (err) {
+        result.errors.push(`Failed to rewrite ${NOT_FOUND_PATH}: ${String(err)}`);
+      }
+    }
+  }
+  return {
+    text: JSON.stringify(result),
+    isError: false
+  };
+}
+function registerScaffoldCleanupTools(server2) {
+  const DESC = "Deterministic scaffold remnant cleanup \u2014 removes stale OSS scaffold files after raft run.";
+  server2.tool(
+    "stackwright_pro_cleanup_scaffold",
+    `Remove/rewrite stale scaffold files (blog posts, hardcoded not-found page) after the raft pipeline completes. ${DESC}`,
+    {},
+    async () => {
+      const r = handleCleanupScaffold();
+      return {
+        content: [{ type: "text", text: r.text }],
+        isError: r.isError
+      };
+    }
+  );
+}
+
+// src/tools/contrast.ts
+import { z as z18 } from "zod";
+function linearizeChannel(c255) {
+  const c = c255 / 255;
+  return c <= 0.04045 ? c / 12.92 : Math.pow((c + 0.055) / 1.055, 2.4);
+}
+function relativeLuminance(r, g, b) {
+  return 0.2126 * linearizeChannel(r) + 0.7152 * linearizeChannel(g) + 0.0722 * linearizeChannel(b);
+}
+function contrastRatioFromLuminance(l1, l2) {
+  const lighter = Math.max(l1, l2);
+  const darker = Math.min(l1, l2);
+  return (lighter + 0.05) / (darker + 0.05);
+}
+function parseHex(hex) {
+  const clean = hex.replace("#", "").trim().toLowerCase();
+  if (clean.length === 3) {
+    const r = parseInt(clean.charAt(0) + clean.charAt(0), 16);
+    const g = parseInt(clean.charAt(1) + clean.charAt(1), 16);
+    const b = parseInt(clean.charAt(2) + clean.charAt(2), 16);
+    if (isNaN(r) || isNaN(g) || isNaN(b)) return null;
+    return [r, g, b];
+  }
+  if (clean.length === 6) {
+    const r = parseInt(clean.slice(0, 2), 16);
+    const g = parseInt(clean.slice(2, 4), 16);
+    const b = parseInt(clean.slice(4, 6), 16);
+    if (isNaN(r) || isNaN(g) || isNaN(b)) return null;
+    return [r, g, b];
+  }
+  return null;
+}
+function hslToRgb(h, s, l) {
+  const hn = h / 360;
+  const sn = s / 100;
+  const ln = l / 100;
+  const hue2rgb = (p, q, t) => {
+    let tt = t;
+    if (tt < 0) tt += 1;
+    if (tt > 1) tt -= 1;
+    if (tt < 1 / 6) return p + (q - p) * 6 * tt;
+    if (tt < 1 / 2) return q;
+    if (tt < 2 / 3) return p + (q - p) * (2 / 3 - tt) * 6;
+    return p;
+  };
+  let r, g, b;
+  if (sn === 0) {
+    r = g = b = ln;
+  } else {
+    const q = ln < 0.5 ? ln * (1 + sn) : ln + sn - ln * sn;
+    const p = 2 * ln - q;
+    r = hue2rgb(p, q, hn + 1 / 3);
+    g = hue2rgb(p, q, hn);
+    b = hue2rgb(p, q, hn - 1 / 3);
+  }
+  return [Math.round(r * 255), Math.round(g * 255), Math.round(b * 255)];
+}
+function parseHsl(hsl) {
+  let str = hsl.replace(/^hsl\s*\(\s*/i, "").replace(/\s*\)$/, "").trim();
+  str = str.replace(/%/g, "");
+  const parts = str.split(/[\s,]+/).filter(Boolean);
+  if (parts.length !== 3) return null;
+  const h = parseFloat(parts[0]);
+  const s = parseFloat(parts[1]);
+  const l = parseFloat(parts[2]);
+  if (isNaN(h) || isNaN(s) || isNaN(l)) return null;
+  return hslToRgb(h, s, l);
+}
+function parseColor(color) {
+  const trimmed = color.trim();
+  if (trimmed.startsWith("#")) return parseHex(trimmed);
+  if (/^hsl\s*\(/i.test(trimmed)) return parseHsl(trimmed);
+  if (/^\d[\d.]*[\s,]+\d[\d.]*%?[\s,]+\d[\d.]*%?$/.test(trimmed)) return parseHsl(trimmed);
+  return null;
+}
+function rgbToHex(r, g, b) {
+  return "#" + [r, g, b].map(
+    (c) => Math.max(0, Math.min(255, Math.round(c))).toString(16).padStart(2, "0")
+  ).join("");
+}
+function handleCheckContrast(fg, bg) {
+  const fgRgb = parseColor(fg);
+  const bgRgb = parseColor(bg);
+  if (!fgRgb) throw new Error(`Cannot parse foreground color: "${fg}"`);
+  if (!bgRgb) throw new Error(`Cannot parse background color: "${bg}"`);
+  const fgL = relativeLuminance(...fgRgb);
+  const bgL = relativeLuminance(...bgRgb);
+  const ratio = parseFloat(contrastRatioFromLuminance(fgL, bgL).toFixed(2));
+  return {
+    fgHex: rgbToHex(...fgRgb),
+    bgHex: rgbToHex(...bgRgb),
+    ratio,
+    aa: ratio >= 4.5,
+    aaLarge: ratio >= 3,
+    aaa: ratio >= 7,
+    aaaLarge: ratio >= 4.5
+  };
+}
+function handleDeriveAccessiblePalette(seed, targetRatio) {
+  const seedRgb = parseColor(seed);
+  if (!seedRgb) throw new Error(`Cannot parse seed color: "${seed}"`);
+  const seedHex = rgbToHex(...seedRgb);
+  const seedL = relativeLuminance(...seedRgb);
+  const whiteRatio = parseFloat(contrastRatioFromLuminance(1, seedL).toFixed(2));
+  const blackRatio = parseFloat(contrastRatioFromLuminance(0, seedL).toFixed(2));
+  const whiteWorks = whiteRatio >= targetRatio;
+  const blackWorks = blackRatio >= targetRatio;
+  let strategy;
+  let foreground;
+  let ratio;
+  let alternativeForeground;
+  let alternativeRatio;
+  if (blackWorks && whiteWorks) {
+    if (blackRatio >= whiteRatio) {
+      strategy = "black";
+      foreground = "#000000";
+      ratio = blackRatio;
+      alternativeForeground = "#ffffff";
+      alternativeRatio = whiteRatio;
+    } else {
+      strategy = "white";
+      foreground = "#ffffff";
+      ratio = whiteRatio;
+      alternativeForeground = "#000000";
+      alternativeRatio = blackRatio;
+    }
+  } else if (blackWorks) {
+    strategy = "black";
+    foreground = "#000000";
+    ratio = blackRatio;
+    alternativeForeground = "#ffffff";
+    alternativeRatio = whiteRatio;
+  } else if (whiteWorks) {
+    strategy = "white";
+    foreground = "#ffffff";
+    ratio = whiteRatio;
+    alternativeForeground = "#000000";
+    alternativeRatio = blackRatio;
+  } else {
+    strategy = "unachievable";
+    if (blackRatio >= whiteRatio) {
+      foreground = "#000000";
+      ratio = blackRatio;
+      alternativeForeground = "#ffffff";
+      alternativeRatio = whiteRatio;
+    } else {
+      foreground = "#ffffff";
+      ratio = whiteRatio;
+      alternativeForeground = "#000000";
+      alternativeRatio = blackRatio;
+    }
+  }
+  return {
+    seedHex,
+    foreground,
+    ratio,
+    aa: ratio >= 4.5,
+    aaLarge: ratio >= 3,
+    aaa: ratio >= 7,
+    meetsTarget: ratio >= targetRatio,
+    strategy,
+    alternativeForeground,
+    alternativeRatio
+  };
+}
+var PASS = "[PASS]";
+var FAIL = "[FAIL]";
+var mark = (ok) => ok ? PASS : FAIL;
+function registerContrastTools(server2) {
+  server2.tool(
+    "stackwright_pro_check_contrast",
+    'Compute the exact WCAG 2.1 contrast ratio between a foreground and background color. Returns the ratio and AA/AAA pass/fail flags. Use this to verify any foreground/background color pair before writing it to the token set. Accepts #RGB, #RRGGBB, hsl(...), or shadcn HSL format ("H S% L%").',
+    {
+      fg: z18.string().describe("Foreground (text) color \u2014 hex or HSL"),
+      bg: z18.string().describe("Background color \u2014 hex or HSL")
+    },
+    async ({ fg, bg }) => {
+      let result;
+      try {
+        result = handleCheckContrast(fg, bg);
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: `Error: ${err.message}` }]
+        };
+      }
+      const text = [
+        `WCAG 2.1 Contrast Check`,
+        ``,
+        `  Foreground : ${result.fgHex}`,
+        `  Background : ${result.bgHex}`,
+        `  Ratio      : ${result.ratio}:1`,
+        ``,
+        `  ${mark(result.aa)}  AA  \u2014 normal text  (\u22654.5:1)`,
+        `  ${mark(result.aaLarge)}  AA  \u2014 large text   (\u22653.0:1)`,
+        `  ${mark(result.aaa)}  AAA \u2014 normal text  (\u22657.0:1)`,
+        `  ${mark(result.aaaLarge)}  AAA \u2014 large text   (\u22654.5:1)`
+      ].join("\n");
+      return { content: [{ type: "text", text }] };
+    }
+  );
+  server2.tool(
+    "stackwright_pro_derive_accessible_palette",
+    'Given a seed color (treated as a background), derive the best accessible foreground (text) color that meets the target contrast ratio. Evaluates #ffffff and #000000 against the seed and picks whichever satisfies the target ratio with the highest contrast. Use this for every {name}-foreground token derivation instead of guessing white vs black. Accepts #RGB, #RRGGBB, hsl(...), or shadcn HSL format ("H S% L%").',
+    {
+      seed: z18.string().describe("Background (seed) color \u2014 hex or HSL"),
+      targetRatio: numCoerce(z18.number().default(4.5)).describe(
+        "Minimum required contrast ratio (default 4.5 for WCAG AA)"
+      )
+    },
+    async ({ seed, targetRatio }) => {
+      let result;
+      try {
+        result = handleDeriveAccessiblePalette(seed, targetRatio ?? 4.5);
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: `Error: ${err.message}` }]
+        };
+      }
+      const metLine = result.meetsTarget ? `${PASS} Meets target (${targetRatio}:1)` : `${FAIL} Target (${targetRatio}:1) UNACHIEVABLE with white or black \u2014 best available used`;
+      const altNote = result.alternativeRatio >= (targetRatio ?? 4.5) ? `also passes (${result.alternativeRatio}:1)` : `fails at ${result.alternativeRatio}:1`;
+      const text = [
+        `Accessible Palette Derivation`,
+        ``,
+        `  Background (seed) : ${result.seedHex}`,
+        `  Foreground        : ${result.foreground}  (${result.strategy})`,
+        `  Contrast ratio    : ${result.ratio}:1`,
+        `  ${metLine}`,
+        ``,
+        `  ${mark(result.aa)}  AA  \u2014 normal text  (\u22654.5:1)`,
+        `  ${mark(result.aaLarge)}  AA  \u2014 large text   (\u22653.0:1)`,
+        `  ${mark(result.aaa)}  AAA \u2014 normal text  (\u22657.0:1)`,
+        ``,
+        `  Alternative (${result.alternativeForeground}): ${altNote}`
+      ].join("\n");
+      return { content: [{ type: "text", text }] };
+    }
+  );
+}
+
 // package.json
 var package_default = {
   dependencies: {
     "@modelcontextprotocol/sdk": "^1.10.0",
     "@stackwright-pro/cli-data-explorer": "workspace:*",
-    zod: "^4.3.6"
+    "@stackwright-pro/types": "workspace:*",
+    "@types/js-yaml": "^4.0.9",
+    "js-yaml": "^4.2.0",
+    zod: "^4.4.3"
   },
   devDependencies: {
-    "@types/node": "^24.1.0",
-    tsup: "^8.5.0",
-    typescript: "^5.8.3",
-    vitest: "^4.0.18"
+    "@types/node": "catalog:",
+    tsup: "catalog:",
+    typescript: "catalog:",
+    vitest: "catalog:"
   },
   scripts: {
     prepublishOnly: "node scripts/verify-integrity-sync.js",
@@ -3444,10 +6500,13 @@ var package_default = {
     "test:coverage": "vitest run --coverage"
   },
   name: "@stackwright-pro/mcp",
-  version: "0.2.0-alpha.9",
+  version: "0.2.0-alpha.90",
   description: "MCP tools for Stackwright Pro - Data Explorer, Security, ISR, and Dashboard generation",
-  license: "PROPRIETARY",
+  license: "SEE LICENSE IN LICENSE",
   main: "./dist/server.js",
+  bin: {
+    "stackwright-pro-mcp": "./dist/server.js"
+  },
   module: "./dist/server.mjs",
   types: "./dist/server.d.ts",
   exports: {
@@ -3460,6 +6519,11 @@ var package_default = {
       types: "./dist/integrity.d.ts",
       import: "./dist/integrity.mjs",
       require: "./dist/integrity.js"
+    },
+    "./type-schemas": {
+      types: "./dist/tools/type-schemas.d.ts",
+      import: "./dist/tools/type-schemas.mjs",
+      require: "./dist/tools/type-schemas.js"
     }
   },
   files: [
@@ -3487,9 +6551,24 @@ registerPipelineTools(server);
 registerSafeWriteTools(server);
 registerAuthTools(server);
 registerIntegrityTools(server);
+registerArtifactSigningTools(server);
 registerDomainTools(server);
+registerTypeSchemasTool(server);
+registerValidateYamlFragmentTool(server);
+registerGetSchemaTool(server);
+registerScaffoldCleanupTools(server);
+registerContrastTools(server);
 async function main() {
   const transport = new StdioServerTransport();
+  try {
+    const servicesRegisterPkg = "@stackwright-services/mcp/register";
+    const mod = await import(servicesRegisterPkg);
+    if (typeof mod.registerServicesTools === "function") {
+      mod.registerServicesTools(server);
+      console.error("Stackwright Services tools registered on pro MCP");
+    }
+  } catch {
+  }
   await server.connect(transport);
   console.error("Stackwright Pro MCP server running on stdio");
 }