@stackwright-pro/mcp 0.2.0-alpha.92 → 0.2.0-alpha.97

package/dist/server.js

@@ -144,8 +144,8 @@ function registerDataExplorerTools(server2) {
       lines.push("    endpoints:");
       if (result.filter.include && result.filter.include.length > 0) {
         lines.push("      include:");
-        for (const path3 of result.filter.include) {
-          lines.push(`        - ${path3}`);
+        for (const path4 of result.filter.include) {
+          lines.push(`        - ${path4}`);
         }
       }
       if (result.filter.exclude && result.filter.exclude.length > 0) {
@@ -1894,8 +1894,8 @@ function registerOrchestrationTools(server2) {
     {
       buildContext: import_zod9.z.string().describe("Free-text description of what the user wants to build")
     },
-    async ({ buildContext }) => {
-      const { text, isError } = handleSaveBuildContext({ buildContext });
+    async ({ buildContext: buildContext2 }) => {
+      const { text, isError } = handleSaveBuildContext({ buildContext: buildContext2 });
       return {
         content: [{ type: "text", text }],
         isError
@@ -2023,8 +2023,8 @@ function registerOrchestrationTools(server2) {
 
 // src/tools/pipeline.ts
 var import_zod13 = require("zod");
-var import_fs5 = require("fs");
-var import_path5 = require("path");
+var import_fs6 = require("fs");
+var import_path6 = require("path");
 var import_crypto3 = require("crypto");
 
 // src/artifact-signing.ts
@@ -2686,6 +2686,224 @@ function registerGetSchemaTool(server2) {
   );
 }
 
+// src/tools/pipeline-graph.ts
+var import_fs5 = require("fs");
+var import_path5 = require("path");
+var MANIFEST_NAME_TO_PHASE = {
+  "stackwright-pro-designer-otter": "designer",
+  "stackwright-pro-theme-otter": "theme",
+  "stackwright-pro-scaffold-otter": "scaffold",
+  "stackwright-pro-api-otter": "api",
+  "stackwright-pro-auth-otter": "auth",
+  "stackwright-pro-data-otter": "data",
+  "stackwright-pro-page-otter": "pages",
+  "stackwright-pro-dashboard-otter": "dashboard",
+  "stackwright-pro-form-wizard-otter": "workflow",
+  "stackwright-pro-geo-otter": "geo",
+  "stackwright-pro-polish-otter": "polish",
+  "stackwright-services-otter": "services",
+  "stackwright-pro-qa-otter": "qa"
+};
+function manifestNameToPhase(name) {
+  return MANIFEST_NAME_TO_PHASE[name] ?? null;
+}
+var OTTER_SEARCH_PATHS = [
+  "node_modules/@stackwright-pro/otters/src/",
+  // production: installed package
+  "packages/otters/src/",
+  // monorepo: run from repo root
+  "../otters/src/"
+  // monorepo: run from packages/mcp/
+];
+function resolveOtterDirFromCwd() {
+  const cwd = process.cwd();
+  for (const relative of OTTER_SEARCH_PATHS) {
+    const candidate = (0, import_path5.join)(cwd, relative);
+    try {
+      (0, import_fs5.lstatSync)(candidate);
+      return candidate;
+    } catch {
+    }
+  }
+  throw new Error(
+    `Cannot locate otter directory. Searched: ${OTTER_SEARCH_PATHS.join(", ")} (relative to ${cwd}). Make sure @stackwright-pro/otters is installed.`
+  );
+}
+function loadOtterManifestsFromDir(otterDir) {
+  const entries = (0, import_fs5.readdirSync)(otterDir);
+  const manifests = [];
+  for (const filename of entries) {
+    if (!filename.endsWith("-otter.json")) continue;
+    const filePath = (0, import_path5.join)(otterDir, filename);
+    if ((0, import_fs5.lstatSync)(filePath).isSymbolicLink()) continue;
+    try {
+      const raw = (0, import_fs5.readFileSync)(filePath, "utf-8");
+      const manifest = JSON.parse(raw);
+      manifests.push(manifest);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      throw new Error(`Failed to load otter manifest "${filename}": ${msg}`, { cause: err });
+    }
+  }
+  return manifests;
+}
+function topologicalSort(dependencies) {
+  const phases = Object.keys(dependencies);
+  const inDegree = {};
+  const adjList = {};
+  for (const phase of phases) {
+    inDegree[phase] ??= 0;
+    adjList[phase] ??= [];
+  }
+  for (const phase of phases) {
+    for (const dep of dependencies[phase] ?? []) {
+      inDegree[phase] = (inDegree[phase] ?? 0) + 1;
+      adjList[dep] ??= [];
+      adjList[dep].push(phase);
+    }
+  }
+  const queue = phases.filter((p) => (inDegree[p] ?? 0) === 0);
+  const result = [];
+  while (queue.length > 0) {
+    const node = queue.shift();
+    result.push(node);
+    for (const dependent of adjList[node] ?? []) {
+      inDegree[dependent] -= 1;
+      if (inDegree[dependent] === 0) {
+        queue.push(dependent);
+      }
+    }
+  }
+  if (result.length !== phases.length) {
+    const cycleNodes = phases.filter((p) => (inDegree[p] ?? 0) > 0);
+    throw new Error(
+      `Pipeline dependency cycle detected involving: [${cycleNodes.join(", ")}]. Check otter pipeline declarations for circular dependencies.`
+    );
+  }
+  return result;
+}
+function buildPipelineGraph(manifests) {
+  const sinkProducers = {};
+  const artifactProducers = {};
+  for (const m of manifests) {
+    const phase = manifestNameToPhase(m.name);
+    if (!phase) continue;
+    const out = m.pipeline?.outputs;
+    if (!out) continue;
+    for (const sink of out.sinks ?? []) {
+      if (sinkProducers[sink]) {
+        throw new Error(
+          `Sink "${sink}" is produced by both "${sinkProducers[sink]}" and "${phase}". Each sink must have exactly one producer.`
+        );
+      }
+      sinkProducers[sink] = phase;
+    }
+    if (out.artifact) {
+      if (artifactProducers[out.artifact]) {
+        throw new Error(
+          `Artifact "${out.artifact}" is produced by both "${artifactProducers[out.artifact]}" and "${phase}". Each artifact must have exactly one producer.`
+        );
+      }
+      artifactProducers[out.artifact] = phase;
+    }
+  }
+  const dependencies = {};
+  for (const m of manifests) {
+    const phase = manifestNameToPhase(m.name);
+    if (!phase) continue;
+    const deps = /* @__PURE__ */ new Set();
+    const inp = m.pipeline?.inputs;
+    if (inp) {
+      for (const sink of inp.sinks ?? []) {
+        const producer = sinkProducers[sink];
+        if (!producer) {
+          throw new Error(
+            `Phase "${phase}" declares sink input "${sink}" but no otter produces it. Add an otter with outputs.sinks including "${sink}".`
+          );
+        }
+        if (producer !== phase) deps.add(producer);
+      }
+      for (const artifact of inp.artifacts ?? []) {
+        const producer = artifactProducers[artifact];
+        if (!producer) {
+          throw new Error(
+            `Phase "${phase}" declares artifact input "${artifact}" but no otter produces it. Add an otter with outputs.artifact = "${artifact}".`
+          );
+        }
+        if (producer !== phase) deps.add(producer);
+      }
+    }
+    dependencies[phase] = Array.from(deps);
+  }
+  const order = topologicalSort(dependencies);
+  return { dependencies, order, sinkProducers, artifactProducers };
+}
+var DISTRIBUTED_NAMESPACES = ["@stackwright-pro", "@stackwright"];
+function loadDistributedOtterManifests(cwd) {
+  const results = [];
+  for (const namespace of DISTRIBUTED_NAMESPACES) {
+    const nsDir = (0, import_path5.join)(cwd, "node_modules", namespace);
+    let pkgDirNames;
+    try {
+      pkgDirNames = (0, import_fs5.readdirSync)(nsDir);
+    } catch {
+      continue;
+    }
+    for (const pkgDirName of pkgDirNames) {
+      const pkgDir = (0, import_path5.join)(nsDir, pkgDirName);
+      const packageName = `${namespace}/${pkgDirName}`;
+      let otterRelPaths;
+      try {
+        const raw = (0, import_fs5.readFileSync)((0, import_path5.join)(pkgDir, "package.json"), "utf-8");
+        const pkgJson = JSON.parse(raw);
+        const declared = pkgJson.stackwright?.otters;
+        if (!Array.isArray(declared) || declared.length === 0) continue;
+        otterRelPaths = declared;
+      } catch {
+        continue;
+      }
+      for (const relPath of otterRelPaths) {
+        const otterFilePath = (0, import_path5.join)(pkgDir, relPath);
+        try {
+          const raw = (0, import_fs5.readFileSync)(otterFilePath, "utf-8");
+          const manifest = JSON.parse(raw);
+          results.push({ manifest, packageName });
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : String(err);
+          console.warn(
+            `[pipeline-graph] Failed to load distributed otter at "${otterFilePath}" from "${packageName}": ${msg}`
+          );
+        }
+      }
+    }
+  }
+  return results;
+}
+function _mergeManifestPools(central, distributed) {
+  const centralNames = new Set(central.map((m) => m.name));
+  const merged = [...central];
+  for (const { manifest, packageName } of distributed) {
+    if (centralNames.has(manifest.name)) {
+      console.warn(
+        `[pipeline-graph] Otter "${manifest.name}" declared by both @stackwright-pro/otters and ${packageName} \u2014 using @stackwright-pro/otters version.`
+      );
+    } else {
+      merged.push(manifest);
+    }
+  }
+  return merged;
+}
+var _cachedGraph = null;
+function loadPipelineGraph() {
+  if (_cachedGraph) return _cachedGraph;
+  const otterDir = resolveOtterDirFromCwd();
+  const central = loadOtterManifestsFromDir(otterDir);
+  const distributed = loadDistributedOtterManifests(process.cwd());
+  const manifests = _mergeManifestPools(central, distributed);
+  _cachedGraph = buildPipelineGraph(manifests);
+  return _cachedGraph;
+}
+
 // src/tools/pipeline.ts
 var PHASE_ORDER = [
   "designer",
@@ -2694,45 +2912,16 @@ var PHASE_ORDER = [
   // generates app/ directory from config
   "api",
   "data",
+  "auth",
+  // moved earlier — only depends on design-language.json (designer)
   "geo",
   "workflow",
   "services",
   "pages",
   "dashboard",
-  "auth",
-  "polish"
+  "polish",
+  "qa"
 ];
-var PHASE_DEPENDENCIES = {
-  designer: [],
-  theme: ["designer"],
-  scaffold: ["designer", "theme"],
-  // needs stackwright.yml + theme-tokens
-  api: [],
-  data: ["api"],
-  geo: ["data"],
-  // workflow: no hard deps — uses service: references with Prism mock fallback
-  // when API artifacts aren't available; roles come from user answers
-  workflow: [],
-  // services: needs API endpoints to know what to wire, and optionally
-  // workflow states as trigger sources. Produces OpenAPI specs consumed
-  // by pages and dashboard for typed data wiring.
-  services: ["api", "workflow"],
-  // pages/dashboard: depend on services for typed endpoint wiring (OpenAPI
-  // specs) and on geo so the specialist prompt includes geo-manifest.json
-  // — page/dashboard otters see which page slugs are already claimed and
-  // won't attempt to overwrite them (swp-73c). 'api' is still transitive
-  // through 'data'; auth removed — page-otter has graceful fallback.
-  pages: ["designer", "theme", "data", "services", "geo", "scaffold"],
-  dashboard: ["designer", "theme", "data", "services", "geo", "scaffold"],
-  // auth is the penultimate phase — runs after all content-producing phases
-  // so it can read pages, dashboard, workflow, and geo artifacts for route
-  // protection and RBAC wiring. Skipped upstream phases still satisfy deps
-  // (the foreman marks them executed=true), so auth always runs.
-  auth: ["pages", "dashboard", "workflow", "geo"],
-  // polish is the terminal phase — runs after auth so the landing page and
-  // nav reflect the final set of protected routes and all generated pages.
-  polish: ["auth"]
-};
 var PHASE_ARTIFACT = {
   designer: "design-language.json",
   theme: "theme-tokens.json",
@@ -2745,7 +2934,8 @@ var PHASE_ARTIFACT = {
   workflow: "workflow-config.json",
   services: "services-config.json",
   polish: "polish-manifest.json",
-  geo: "geo-manifest.json"
+  geo: "geo-manifest.json",
+  qa: "qa-findings.json"
 };
 var PHASE_TO_OTTER2 = {
   designer: "stackwright-pro-designer-otter",
@@ -2759,7 +2949,8 @@ var PHASE_TO_OTTER2 = {
   workflow: "stackwright-pro-form-wizard-otter",
   services: "stackwright-services-otter",
   polish: "stackwright-pro-polish-otter",
-  geo: "stackwright-pro-geo-otter"
+  geo: "stackwright-pro-geo-otter",
+  qa: "stackwright-pro-qa-otter"
 };
 function isValidPhase2(phase) {
   return PHASE_ORDER.includes(phase);
@@ -2789,11 +2980,11 @@ function createDefaultState() {
   };
 }
 function statePath(cwd) {
-  return (0, import_path5.join)(cwd, ".stackwright", "pipeline-state.json");
+  return (0, import_path6.join)(cwd, ".stackwright", "pipeline-state.json");
 }
 function readState(cwd) {
   const p = statePath(cwd);
-  if (!(0, import_fs5.existsSync)(p)) return createDefaultState();
+  if (!(0, import_fs6.existsSync)(p)) return createDefaultState();
   const raw = JSON.parse(safeReadSync(p));
   if (typeof raw !== "object" || raw === null || raw.version !== "1.0") {
     return createDefaultState();
@@ -2801,26 +2992,26 @@ function readState(cwd) {
   return raw;
 }
 function safeWriteSync(filePath, content) {
-  if ((0, import_fs5.existsSync)(filePath)) {
-    const stat = (0, import_fs5.lstatSync)(filePath);
+  if ((0, import_fs6.existsSync)(filePath)) {
+    const stat = (0, import_fs6.lstatSync)(filePath);
     if (stat.isSymbolicLink()) {
       throw new Error(`Refusing to write to symlink: ${filePath}`);
     }
   }
-  (0, import_fs5.writeFileSync)(filePath, content);
+  (0, import_fs6.writeFileSync)(filePath, content);
 }
 function safeReadSync(filePath) {
-  if ((0, import_fs5.existsSync)(filePath)) {
-    const stat = (0, import_fs5.lstatSync)(filePath);
+  if ((0, import_fs6.existsSync)(filePath)) {
+    const stat = (0, import_fs6.lstatSync)(filePath);
     if (stat.isSymbolicLink()) {
       throw new Error(`Refusing to read symlink: ${filePath}`);
     }
   }
-  return (0, import_fs5.readFileSync)(filePath, "utf-8");
+  return (0, import_fs6.readFileSync)(filePath, "utf-8");
 }
 function writeState(cwd, state) {
-  const dir = (0, import_path5.join)(cwd, ".stackwright");
-  (0, import_fs5.mkdirSync)(dir, { recursive: true });
+  const dir = (0, import_path6.join)(cwd, ".stackwright");
+  (0, import_fs6.mkdirSync)(dir, { recursive: true });
   state.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
   safeWriteSync(statePath(cwd), JSON.stringify(state, null, 2) + "\n");
 }
@@ -2841,8 +3032,8 @@ function handleGetPipelineState(_cwd) {
   const cwd = _cwd ?? process.cwd();
   try {
     const state = readState(cwd);
-    const keyPath = (0, import_path5.join)(cwd, ".stackwright", "pipeline-keys.json");
-    if (!(0, import_fs5.existsSync)(keyPath)) {
+    const keyPath = (0, import_path6.join)(cwd, ".stackwright", "pipeline-keys.json");
+    if (!(0, import_fs6.existsSync)(keyPath)) {
       try {
         const { fingerprint } = initPipelineKeys(cwd);
         state["signingKeyFingerprint"] = fingerprint;
@@ -2945,8 +3136,8 @@ function handleCheckExecutionReady(_cwd, phase) {
         isError: true
       };
     }
-    const answerFile = (0, import_path5.join)(cwd, ".stackwright", "answers", `${phase}.json`);
-    if (!(0, import_fs5.existsSync)(answerFile)) {
+    const answerFile = (0, import_path6.join)(cwd, ".stackwright", "answers", `${phase}.json`);
+    if (!(0, import_fs6.existsSync)(answerFile)) {
       return {
         text: JSON.stringify({ ready: false, phase, reason: "Answer file not found" }),
         isError: false
@@ -2970,12 +3161,12 @@ function handleCheckExecutionReady(_cwd, phase) {
     }
   }
   try {
-    const answersDir = (0, import_path5.join)(cwd, ".stackwright", "answers");
+    const answersDir = (0, import_path6.join)(cwd, ".stackwright", "answers");
     const answeredPhases = [];
     const missingPhases = [];
     for (const phase2 of PHASE_ORDER) {
-      const answerFile = (0, import_path5.join)(answersDir, `${phase2}.json`);
-      if ((0, import_fs5.existsSync)(answerFile)) {
+      const answerFile = (0, import_path6.join)(answersDir, `${phase2}.json`);
+      if ((0, import_fs6.existsSync)(answerFile)) {
         try {
           const raw = safeReadSync(answerFile);
           const parsed = JSON.parse(raw);
@@ -3008,6 +3199,7 @@ function handleGetReadyPhases(_cwd) {
   const cwd = _cwd ?? process.cwd();
   try {
     const state = readState(cwd);
+    const graph = loadPipelineGraph();
     const completed = [];
     const ready = [];
     const blocked = [];
@@ -3017,7 +3209,7 @@ function handleGetReadyPhases(_cwd) {
         completed.push(phase);
         continue;
       }
-      const deps = PHASE_DEPENDENCIES[phase];
+      const deps = graph.dependencies[phase] ?? [];
       const unmetDeps = deps.filter((dep) => !state.phases[dep]?.executed);
       if (unmetDeps.length === 0) {
         ready.push(phase);
@@ -3043,7 +3235,7 @@ function handleGetReadyPhases(_cwd) {
 function handleListArtifacts(_cwd) {
   const cwd = _cwd ?? process.cwd();
   try {
-    const artifactsDir = (0, import_path5.join)(cwd, ".stackwright", "artifacts");
+    const artifactsDir = (0, import_path6.join)(cwd, ".stackwright", "artifacts");
     let manifest = null;
     try {
       manifest = loadSignatureManifest(cwd);
@@ -3053,8 +3245,8 @@ function handleListArtifacts(_cwd) {
     let completedCount = 0;
     for (const phase of PHASE_ORDER) {
       const expectedFile = PHASE_ARTIFACT[phase];
-      const fullPath = (0, import_path5.join)(artifactsDir, expectedFile);
-      const exists = (0, import_fs5.existsSync)(fullPath);
+      const fullPath = (0, import_path6.join)(artifactsDir, expectedFile);
+      const exists = (0, import_fs6.existsSync)(fullPath);
       if (exists) completedCount++;
       let signed = false;
       let signatureValid = null;
@@ -3107,9 +3299,9 @@ function handleWritePhaseQuestions(input) {
       }
     } catch {
     }
-    const questionsDir = (0, import_path5.join)(cwd, ".stackwright", "questions");
-    (0, import_fs5.mkdirSync)(questionsDir, { recursive: true });
-    const filePath = (0, import_path5.join)(questionsDir, `${phase}.json`);
+    const questionsDir = (0, import_path6.join)(cwd, ".stackwright", "questions");
+    (0, import_fs6.mkdirSync)(questionsDir, { recursive: true });
+    const filePath = (0, import_path6.join)(questionsDir, `${phase}.json`);
     const payload = {
       version: "1.0",
       phase,
@@ -3149,14 +3341,14 @@ function handleBuildSpecialistPrompt(input) {
     };
   }
   try {
-    const answersPath = (0, import_path5.join)(cwd, ".stackwright", "answers", `${phase}.json`);
+    const answersPath = (0, import_path6.join)(cwd, ".stackwright", "answers", `${phase}.json`);
     let answers = {};
-    if ((0, import_fs5.existsSync)(answersPath)) {
+    if ((0, import_fs6.existsSync)(answersPath)) {
       answers = JSON.parse(safeReadSync(answersPath));
     }
     let buildContextText = "";
-    const buildContextPath = (0, import_path5.join)(cwd, ".stackwright", "build-context.json");
-    if ((0, import_fs5.existsSync)(buildContextPath)) {
+    const buildContextPath = (0, import_path6.join)(cwd, ".stackwright", "build-context.json");
+    if ((0, import_fs6.existsSync)(buildContextPath)) {
       try {
         const bcRaw = JSON.parse(safeReadSync(buildContextPath));
         if (typeof bcRaw.buildContext === "string" && bcRaw.buildContext.trim().length > 0) {
@@ -3165,13 +3357,14 @@ function handleBuildSpecialistPrompt(input) {
       } catch {
       }
     }
-    const deps = PHASE_DEPENDENCIES[phase];
+    const graph = loadPipelineGraph();
+    const deps = graph.dependencies[phase] ?? [];
     const artifactSections = [];
     const missingDependencies = [];
     for (const dep of deps) {
       const artifactFile = PHASE_ARTIFACT[dep];
-      const artifactPath = (0, import_path5.join)(cwd, ".stackwright", "artifacts", artifactFile);
-      if ((0, import_fs5.existsSync)(artifactPath)) {
+      const artifactPath = (0, import_path6.join)(cwd, ".stackwright", "artifacts", artifactFile);
+      if ((0, import_fs6.existsSync)(artifactPath)) {
         const rawContent = safeReadSync(artifactPath);
         const rawBytes = Buffer.from(rawContent, "utf-8");
         const content = JSON.parse(rawContent);
@@ -3236,8 +3429,8 @@ ${JSON.stringify(content, null, 2)}`
       parts.push("BUILD_CONTEXT:", buildContextText, "");
     }
     if (phase === "auth") {
-      const initContextPath = (0, import_path5.join)(cwd, ".stackwright", "init-context.json");
-      if ((0, import_fs5.existsSync)(initContextPath)) {
+      const initContextPath = (0, import_path6.join)(cwd, ".stackwright", "init-context.json");
+      if ((0, import_fs6.existsSync)(initContextPath)) {
         try {
           const initContext = JSON.parse(safeReadSync(initContextPath));
           if (initContext.devOnly === true || initContext.nonInteractive === true) {
@@ -3301,7 +3494,10 @@ var PHASE_REQUIRED_KEYS = {
   workflow: ["version", "generatedBy"],
   services: ["version", "generatedBy", "flows"],
   polish: ["version", "generatedBy"],
-  geo: ["version", "generatedBy", "geoCollections"]
+  geo: ["version", "generatedBy", "geoCollections"],
+  // qa: skipped=true path only needs version+generatedBy+skipped;
+  // skipped=false path also needs summary+findings — Zod validator enforces the conditional.
+  qa: ["version", "generatedBy", "skipped"]
 };
 var PHASE_ARTIFACT_SCHEMA = {
   designer: JSON.stringify(
@@ -3591,6 +3787,41 @@ var PHASE_ARTIFACT_SCHEMA = {
     },
     null,
     2
+  ),
+  qa: JSON.stringify(
+    {
+      version: "1.0",
+      generatedBy: "stackwright-pro-qa-otter",
+      // skipped: true path — when dev server is unreachable at audit time
+      // skipped: false path — full audit completed
+      skipped: false,
+      skipReason: null,
+      wcagLevel: "<AA|AAA>",
+      summary: {
+        routesAudited: 3,
+        serious: 0,
+        moderate: 1,
+        minor: 0
+      },
+      findings: [
+        {
+          id: "qa-001",
+          route: "/dashboard",
+          severity: "<serious|moderate|minor>",
+          category: "<visual|a11y|design-contract|runtime>",
+          finding: "Human-readable description of what was observed",
+          evidence: {
+            screenshot: ".stackwright/qa/screenshots/dashboard-light.png",
+            consoleErrors: [],
+            axeViolations: []
+          },
+          suggested_otters: ["stackwright-pro-theme-otter"],
+          suggested_fix: "Specific, concrete next step the repair otter should take"
+        }
+      ]
+    },
+    null,
+    2
   )
 };
 function handleValidateArtifact(input) {
@@ -3704,13 +3935,13 @@ function handleValidateArtifact(input) {
     // to a flow or state-machine in this services-config artifact.
     // Skips gracefully when wizard-otter didn't run (Pro-only install) or declared no hooks.
     services: (artifact2) => {
-      const workflowArtifactPath = (0, import_path5.join)(cwd, ".stackwright", "artifacts", "workflow-config.json");
-      if (!(0, import_fs5.existsSync)(workflowArtifactPath)) {
+      const workflowArtifactPath = (0, import_path6.join)(cwd, ".stackwright", "artifacts", "workflow-config.json");
+      if (!(0, import_fs6.existsSync)(workflowArtifactPath)) {
         return { success: true };
       }
       let workflowArtifact;
       try {
-        workflowArtifact = JSON.parse((0, import_fs5.readFileSync)(workflowArtifactPath, "utf-8"));
+        workflowArtifact = JSON.parse((0, import_fs6.readFileSync)(workflowArtifactPath, "utf-8"));
       } catch {
         return { success: true };
       }
@@ -3731,6 +3962,40 @@ function handleValidateArtifact(input) {
         };
       }
       return { success: true };
+    },
+    // qa artifact — permissive validator: requires version + generatedBy + skipped.
+    // When skipped=true: skipReason must be a string.
+    // When skipped=false: findings must be an array and summary must be an object.
+    qa: (artifact2) => {
+      const skipped = artifact2["skipped"];
+      if (typeof skipped !== "boolean") {
+        return {
+          success: false,
+          error: { message: '"skipped" must be a boolean (true or false).' }
+        };
+      }
+      if (skipped === true) {
+        if (typeof artifact2["skipReason"] !== "string") {
+          return {
+            success: false,
+            error: { message: 'When skipped=true, "skipReason" must be a string.' }
+          };
+        }
+        return { success: true };
+      }
+      if (!Array.isArray(artifact2["findings"])) {
+        return {
+          success: false,
+          error: { message: 'When skipped=false, "findings" must be an array.' }
+        };
+      }
+      if (typeof artifact2["summary"] !== "object" || artifact2["summary"] === null) {
+        return {
+          success: false,
+          error: { message: 'When skipped=false, "summary" must be an object.' }
+        };
+      }
+      return { success: true };
     }
   };
   const zodValidator = PHASE_ZOD_VALIDATORS[phase];
@@ -3747,10 +4012,10 @@ function handleValidateArtifact(input) {
     }
   }
   try {
-    const artifactsDir = (0, import_path5.join)(cwd, ".stackwright", "artifacts");
-    (0, import_fs5.mkdirSync)(artifactsDir, { recursive: true });
+    const artifactsDir = (0, import_path6.join)(cwd, ".stackwright", "artifacts");
+    (0, import_fs6.mkdirSync)(artifactsDir, { recursive: true });
     const artifactFile = PHASE_ARTIFACT[phase];
-    const artifactPath = (0, import_path5.join)(artifactsDir, artifactFile);
+    const artifactPath = (0, import_path6.join)(artifactsDir, artifactFile);
     const serialized = JSON.stringify(artifact, null, 2) + "\n";
     const artifactBytes = Buffer.from(serialized, "utf-8");
     safeWriteSync(artifactPath, serialized);
@@ -3867,10 +4132,10 @@ function registerPipelineTools(server2) {
             isError: true
           };
         }
-        const questionsDir = (0, import_path5.join)(process.cwd(), ".stackwright", "questions");
-        (0, import_fs5.mkdirSync)(questionsDir, { recursive: true });
-        const outPath = (0, import_path5.join)(questionsDir, `${phase}.json`);
-        (0, import_fs5.writeFileSync)(
+        const questionsDir = (0, import_path6.join)(process.cwd(), ".stackwright", "questions");
+        (0, import_fs6.mkdirSync)(questionsDir, { recursive: true });
+        const outPath = (0, import_path6.join)(questionsDir, `${phase}.json`);
+        (0, import_fs6.writeFileSync)(
           outPath,
           JSON.stringify({ phase, questions, writtenAt: (/* @__PURE__ */ new Date()).toISOString() }, null, 2)
         );
@@ -3921,8 +4186,8 @@ function registerPipelineTools(server2) {
 
 // src/tools/safe-write.ts
 var import_zod14 = require("zod");
-var import_fs6 = require("fs");
-var import_path6 = require("path");
+var import_fs7 = require("fs");
+var import_path7 = require("path");
 var OTTER_WRITE_ALLOWLISTS = {
   "stackwright-pro-designer-otter": [
     { prefix: ".stackwright/artifacts/", suffix: ".json", description: "Design language artifact" }
@@ -3937,8 +4202,11 @@ var OTTER_WRITE_ALLOWLISTS = {
   ],
   "stackwright-pro-auth-otter": [
     { prefix: ".stackwright/artifacts/", suffix: ".json", description: "Auth config artifact" },
-    { prefix: "config/", suffix: ".yml", description: "Auth YAML config" },
-    { prefix: "config/", suffix: ".yaml", description: "Auth YAML config" },
+    {
+      prefix: "stackwright.auth.",
+      suffix: ".yml",
+      description: "Auth config YAML (stackwright.auth.yml \u2014 compiled to _auth.json)"
+    },
     {
       prefix: ".env",
       suffix: "",
@@ -3957,7 +4225,11 @@ var OTTER_WRITE_ALLOWLISTS = {
   ],
   "stackwright-pro-data-otter": [
     { prefix: ".stackwright/artifacts/", suffix: ".json", description: "Data config artifact" },
-    { prefix: "stackwright.yml", suffix: "", description: "Stackwright config" }
+    {
+      prefix: "stackwright.collections.",
+      suffix: ".yml",
+      description: "Collections config YAML (stackwright.collections.yml \u2014 compiled to _collections.json)"
+    }
   ],
   "stackwright-pro-page-otter": [
     { prefix: "pages/", suffix: "/content.yml", description: "Page content YAML" },
@@ -3983,7 +4255,12 @@ var OTTER_WRITE_ALLOWLISTS = {
     }
   ],
   "stackwright-pro-api-otter": [
-    { prefix: ".stackwright/artifacts/", suffix: ".json", description: "API config artifact" }
+    { prefix: ".stackwright/artifacts/", suffix: ".json", description: "API config artifact" },
+    {
+      prefix: "stackwright.integrations.",
+      suffix: ".yml",
+      description: "Integrations config YAML (stackwright.integrations.yml \u2014 compiled to _integrations.json)"
+    }
   ],
   "stackwright-pro-geo-otter": [
     { prefix: ".stackwright/artifacts/", suffix: ".json", description: "Geo manifest artifact" },
@@ -4006,6 +4283,25 @@ var OTTER_WRITE_ALLOWLISTS = {
     { prefix: ".stackwright/artifacts/", suffix: ".json", description: "Polish artifact" },
     { prefix: "README.md", suffix: "", description: "Project README rewrite" }
   ],
+  // QA otter writes ONLY to the qa/ directory and the qa-findings artifact.
+  // It never writes .tsx, .ts, .yml, or .json outside these paths.
+  "stackwright-pro-qa-otter": [
+    {
+      prefix: ".stackwright/artifacts/qa-findings.json",
+      suffix: "",
+      description: "QA findings artifact"
+    },
+    {
+      prefix: ".stackwright/qa/",
+      suffix: ".md",
+      description: "QA report markdown"
+    },
+    {
+      prefix: ".stackwright/qa/screenshots/",
+      suffix: ".png",
+      description: "Route screenshots for evidence"
+    }
+  ],
   // domain-expert-otter is a reader/answerer only — it writes via stackwright_pro_save_phase_answers,
   // not via safe_write. Entry required here because the MCP tool availability guard boilerplate
   // in its system prompt mentions stackwright_pro_safe_write (triggering the coherence test).
@@ -4046,7 +4342,7 @@ function getMaxBytesForPath(filePath) {
 }
 var PAGE_REGISTRY_FILE = ".stackwright/page-registry.json";
 function extractPageSlug(filePath) {
-  const match = (0, import_path6.normalize)(filePath).match(/^pages\/(.+?)\/content\.ya?ml$/);
+  const match = (0, import_path7.normalize)(filePath).match(/^pages\/(.+?)\/content\.ya?ml$/);
   return match?.[1] ?? null;
 }
 function extractContentTypes(yamlContent) {
@@ -4062,27 +4358,27 @@ function extractContentTypes(yamlContent) {
   return types.length > 0 ? types : ["unknown"];
 }
 function readPageRegistry(cwd) {
-  const regPath = (0, import_path6.join)(cwd, PAGE_REGISTRY_FILE);
-  if (!(0, import_fs6.existsSync)(regPath)) return {};
+  const regPath = (0, import_path7.join)(cwd, PAGE_REGISTRY_FILE);
+  if (!(0, import_fs7.existsSync)(regPath)) return {};
   try {
-    const stat = (0, import_fs6.lstatSync)(regPath);
+    const stat = (0, import_fs7.lstatSync)(regPath);
     if (stat.isSymbolicLink()) return {};
-    return JSON.parse((0, import_fs6.readFileSync)(regPath, "utf-8"));
+    return JSON.parse((0, import_fs7.readFileSync)(regPath, "utf-8"));
   } catch {
     return {};
   }
 }
 function writePageRegistry(cwd, registry) {
-  const dir = (0, import_path6.join)(cwd, ".stackwright");
-  (0, import_fs6.mkdirSync)(dir, { recursive: true });
-  const regPath = (0, import_path6.join)(cwd, PAGE_REGISTRY_FILE);
-  if ((0, import_fs6.existsSync)(regPath)) {
-    const stat = (0, import_fs6.lstatSync)(regPath);
+  const dir = (0, import_path7.join)(cwd, ".stackwright");
+  (0, import_fs7.mkdirSync)(dir, { recursive: true });
+  const regPath = (0, import_path7.join)(cwd, PAGE_REGISTRY_FILE);
+  if ((0, import_fs7.existsSync)(regPath)) {
+    const stat = (0, import_fs7.lstatSync)(regPath);
     if (stat.isSymbolicLink()) {
       throw new Error("Refusing to write page registry through symlink");
     }
   }
-  (0, import_fs6.writeFileSync)(regPath, JSON.stringify(registry, null, 2) + "\n", { encoding: "utf-8" });
+  (0, import_fs7.writeFileSync)(regPath, JSON.stringify(registry, null, 2) + "\n", { encoding: "utf-8" });
 }
 function checkPageOwnership(cwd, slug, callerOtter) {
   const registry = readPageRegistry(cwd);
@@ -4097,15 +4393,15 @@ function checkPageOwnership(cwd, slug, callerOtter) {
   };
 }
 var NEXTJS_BRACKET_SEGMENT_RE = /\[\[\.{3}[a-zA-Z_][a-zA-Z0-9_]*\]\]|\[\.{3}[a-zA-Z_][a-zA-Z0-9_]*\]|\[[a-zA-Z_][a-zA-Z0-9_]*\]/g;
-function stripNextjsBracketSegments(path3) {
-  return path3.replace(NEXTJS_BRACKET_SEGMENT_RE, "");
+function stripNextjsBracketSegments(path4) {
+  return path4.replace(NEXTJS_BRACKET_SEGMENT_RE, "");
 }
 function checkPathAllowed(callerOtter, filePath) {
-  const normalized = (0, import_path6.normalize)(filePath);
+  const normalized = (0, import_path7.normalize)(filePath);
   if (stripNextjsBracketSegments(normalized).includes("..")) {
     return { allowed: false, error: 'Path traversal detected: ".." segments are not allowed' };
   }
-  if ((0, import_path6.isAbsolute)(normalized)) {
+  if ((0, import_path7.isAbsolute)(normalized)) {
     return {
       allowed: false,
       error: "Absolute paths are not allowed \u2014 use paths relative to project root"
@@ -4247,11 +4543,11 @@ function handleSafeWrite(input) {
     };
     return { text: JSON.stringify(result), isError: true };
   }
-  const normalized = (0, import_path6.normalize)(filePath);
-  const fullPath = (0, import_path6.join)(cwd, normalized);
-  if ((0, import_fs6.existsSync)(fullPath)) {
+  const normalized = (0, import_path7.normalize)(filePath);
+  const fullPath = (0, import_path7.join)(cwd, normalized);
+  if ((0, import_fs7.existsSync)(fullPath)) {
     try {
-      const stat = (0, import_fs6.lstatSync)(fullPath);
+      const stat = (0, import_fs7.lstatSync)(fullPath);
       if (stat.isSymbolicLink()) {
         const result = {
           success: false,
@@ -4292,9 +4588,9 @@ function handleSafeWrite(input) {
   }
   try {
     if (createDirectories) {
-      (0, import_fs6.mkdirSync)((0, import_path6.dirname)(fullPath), { recursive: true });
+      (0, import_fs7.mkdirSync)((0, import_path7.dirname)(fullPath), { recursive: true });
     }
-    (0, import_fs6.writeFileSync)(fullPath, content, { encoding: "utf-8" });
+    (0, import_fs7.writeFileSync)(fullPath, content, { encoding: "utf-8" });
     if (pageSlug) {
       try {
         const registry = readPageRegistry(cwd);
@@ -4354,8 +4650,8 @@ function registerSafeWriteTools(server2) {
 
 // src/tools/auth.ts
 var import_zod15 = require("zod");
-var import_fs7 = require("fs");
-var import_path7 = require("path");
+var import_fs8 = require("fs");
+var import_path8 = require("path");
 function buildHierarchy(roles) {
   const h = {};
   for (let i = 0; i < roles.length - 1; i++) {
@@ -4369,7 +4665,7 @@ function hierarchyToYaml(hierarchy, indent) {
   return entries.map(([role, subs]) => `${indent}${role}: [${subs.join(", ")}]`).join("\n");
 }
 function rolesToYaml(roles, indent) {
-  return roles.map((r) => `${indent}- ${r}`).join("\n");
+  return roles.map((r) => `${indent}- name: ${r}`).join("\n");
 }
 function normalizeRoutes(routes, defaultRole) {
   return routes.map(
@@ -4382,9 +4678,9 @@ ${indent}  requiredRole: ${r.requiredRole}`).join("\n");
 }
 function detectNextMajorVersion(cwd) {
   try {
-    const pkgPath = (0, import_path7.join)(cwd, "package.json");
-    if (!(0, import_fs7.existsSync)(pkgPath)) return null;
-    const pkg = JSON.parse((0, import_fs7.readFileSync)(pkgPath, "utf8"));
+    const pkgPath = (0, import_path8.join)(cwd, "package.json");
+    if (!(0, import_fs8.existsSync)(pkgPath)) return null;
+    const pkg = JSON.parse((0, import_fs8.readFileSync)(pkgPath, "utf8"));
     const nextVersion = pkg.dependencies?.next ?? pkg.devDependencies?.next;
     if (!nextVersion) return null;
     const match = nextVersion.match(/(\d+)/);
@@ -4393,25 +4689,6 @@ function detectNextMajorVersion(cwd) {
     return null;
   }
 }
-function upsertAuthBlock(existing, authYaml) {
-  const lines = existing.split("\n");
-  let authStart = -1;
-  let authEnd = lines.length;
-  for (let i = 0; i < lines.length; i++) {
-    if (/^auth:/.test(lines[i])) {
-      authStart = i;
-    } else if (authStart >= 0 && i > authStart && /^\S/.test(lines[i]) && lines[i].trim() !== "") {
-      authEnd = i;
-      break;
-    }
-  }
-  if (authStart < 0) {
-    return existing.trimEnd() + "\n" + authYaml + "\n";
-  }
-  const before = lines.slice(0, authStart);
-  const after = lines.slice(authEnd);
-  return [...before, ...authYaml.trimEnd().split("\n"), ...after.length ? after : []].join("\n");
-}
 function generateMiddlewareContent(method, params, roles, defaultRole, hierarchy, auditEnabled, auditRetentionDays, protectedRoutes) {
   const rbacBlock = `  rbac: {
     roles: ${JSON.stringify(roles)},
@@ -4611,33 +4888,33 @@ OAUTH2_CLIENT_SECRET=your-client-secret
 `;
 }
 function generateYamlBlock(method, params, roles, defaultRole, hierarchy, auditEnabled, auditRetentionDays, protectedRoutes, useProxy) {
-  const rbacSection = `  rbac:
-    roles:
-${rolesToYaml(roles, "      ")}
-    defaultRole: ${defaultRole}
-    hierarchy:
-${hierarchyToYaml(hierarchy, "      ")}`;
-  const auditSection = `  audit:
-    enabled: ${auditEnabled}
-    retentionDays: ${auditRetentionDays}`;
-  const routeLines = routesToYaml(protectedRoutes, "    ");
-  const providerLine = params.provider ? `  provider: ${params.provider}
+  const rbacSection = `rbac:
+  roles:
+${rolesToYaml(roles, "    ")}
+  defaultRole: ${defaultRole}
+  hierarchy:
+${hierarchyToYaml(hierarchy, "    ")}`;
+  const auditSection = `audit:
+  enabled: ${auditEnabled}
+  retentionDays: ${auditRetentionDays}`;
+  const routeLines = routesToYaml(protectedRoutes, "  ");
+  const providerLine = params.provider ? `provider: ${params.provider}
 ` : "";
   if (method === "cac") {
     const caBundle = params.cacCaBundle ?? "./certs/dod-ca-bundle.pem";
     const edipiLookup = params.cacEdipiLookup ?? "./config/edipi-lookup.json";
     const ocspEndpoint = params.cacOcspEndpoint ?? "https://ocsp.disa.mil";
     const certHeader = params.cacCertHeader ?? "X-SSL-Client-Cert";
-    return `auth:
-  method: cac
-${providerLine}  ${useProxy ? "proxy" : "middleware"}: ./${useProxy ? "proxy" : "middleware"}.ts
-  cac:
-    caBundle: \${CAC_CA_BUNDLE}
-    edipiLookup: ${edipiLookup}
-    ocspEndpoint: \${CAC_OCSP_ENDPOINT}
-    certHeader: ${certHeader}
+    return `# stackwright.auth.yml \u2014 generated by Auth Otter
+method: cac
+${providerLine}${useProxy ? "proxy" : "middleware"}: ./${useProxy ? "proxy" : "middleware"}.ts
+cac:
+  caBundle: \${CAC_CA_BUNDLE}
+  edipiLookup: ${edipiLookup}
+  ocspEndpoint: \${CAC_OCSP_ENDPOINT}
+  certHeader: ${certHeader}
 ${rbacSection}
-  protectedRoutes:
+protectedRoutes:
 ${routeLines}
 ${auditSection}
 `;
@@ -4645,33 +4922,33 @@ ${auditSection}
   if (method === "oidc") {
     const scopes2 = params.oidcScopes ?? "openid profile email";
     const roleClaim = params.oidcRoleClaim ?? "roles";
-    return `auth:
-  method: oidc
-${providerLine}  ${useProxy ? "proxy" : "middleware"}: ./${useProxy ? "proxy" : "middleware"}.ts
-  oidc:
-    discoveryUrl: \${OIDC_DISCOVERY_URL}
-    clientId: \${OIDC_CLIENT_ID}
-    clientSecret: \${OIDC_CLIENT_SECRET}
-    scopes: ${scopes2}
-    roleClaim: ${roleClaim}
+    return `# stackwright.auth.yml \u2014 generated by Auth Otter
+method: oidc
+${providerLine}${useProxy ? "proxy" : "middleware"}: ./${useProxy ? "proxy" : "middleware"}.ts
+oidc:
+  discoveryUrl: \${OIDC_DISCOVERY_URL}
+  clientId: \${OIDC_CLIENT_ID}
+  clientSecret: \${OIDC_CLIENT_SECRET}
+  scopes: ${scopes2}
+  roleClaim: ${roleClaim}
 ${rbacSection}
-  protectedRoutes:
+protectedRoutes:
 ${routeLines}
 ${auditSection}
 `;
   }
   const scopes = params.oauth2Scopes ?? "read write";
-  return `auth:
-  method: oauth2
-${providerLine}  ${useProxy ? "proxy" : "middleware"}: ./${useProxy ? "proxy" : "middleware"}.ts
-  oauth2:
-    authorizationUrl: \${OAUTH2_AUTH_URL}
-    tokenUrl: \${OAUTH2_TOKEN_URL}
-    clientId: \${OAUTH2_CLIENT_ID}
-    clientSecret: \${OAUTH2_CLIENT_SECRET}
-    scopes: ${scopes}
+  return `# stackwright.auth.yml \u2014 generated by Auth Otter
+method: oauth2
+${providerLine}${useProxy ? "proxy" : "middleware"}: ./${useProxy ? "proxy" : "middleware"}.ts
+oauth2:
+  authorizationUrl: \${OAUTH2_AUTH_URL}
+  tokenUrl: \${OAUTH2_TOKEN_URL}
+  clientId: \${OAUTH2_CLIENT_ID}
+  clientSecret: \${OAUTH2_CLIENT_SECRET}
+  scopes: ${scopes}
 ${rbacSection}
-  protectedRoutes:
+protectedRoutes:
 ${routeLines}
 ${auditSection}
 `;
@@ -4857,35 +5134,35 @@ ${configBlock}
 `;
 }
 function generateDevOnlyYamlBlock(method, params, roles, defaultRole, hierarchy, auditEnabled, auditRetentionDays, protectedRoutes, useProxy) {
-  const rbacSection = `  rbac:
-    roles:
-${rolesToYaml(roles, "      ")}
-    defaultRole: ${defaultRole}
-    hierarchy:
-${hierarchyToYaml(hierarchy, "      ")}`;
-  const auditSection = `  audit:
-    enabled: ${auditEnabled}
-    retentionDays: ${auditRetentionDays}`;
-  const routeLines = protectedRoutes.map((r) => `    - pattern: ${r.pattern}
-      requiredRole: ${r.requiredRole}`).join("\n");
-  const providerLine = params.provider ? `  provider: ${params.provider}
+  const rbacSection = `rbac:
+  roles:
+${rolesToYaml(roles, "    ")}
+  defaultRole: ${defaultRole}
+  hierarchy:
+${hierarchyToYaml(hierarchy, "    ")}`;
+  const auditSection = `audit:
+  enabled: ${auditEnabled}
+  retentionDays: ${auditRetentionDays}`;
+  const routeLines = protectedRoutes.map((r) => `  - pattern: ${r.pattern}
+    requiredRole: ${r.requiredRole}`).join("\n");
+  const providerLine = params.provider ? `provider: ${params.provider}
 ` : "";
   if (method === "cac") {
     const caBundle = params.cacCaBundle ?? "./certs/dod-ca-bundle.pem";
     const edipiLookup = params.cacEdipiLookup ?? "./config/edipi-lookup.json";
     const ocspEndpoint = params.cacOcspEndpoint ?? "https://ocsp.disa.mil";
     const certHeader = params.cacCertHeader ?? "X-SSL-Client-Cert";
-    return `auth:
-  method: cac
-  devOnly: true
-${providerLine}  ${useProxy ? "proxy" : "middleware"}: ./${useProxy ? "proxy" : "middleware"}.ts
-  cac:
-    caBundle: ${caBundle}
-    edipiLookup: ${edipiLookup}
-    ocspEndpoint: ${ocspEndpoint}
-    certHeader: ${certHeader}
+    return `# stackwright.auth.yml \u2014 generated by Auth Otter
+method: cac
+devOnly: true
+${providerLine}${useProxy ? "proxy" : "middleware"}: ./${useProxy ? "proxy" : "middleware"}.ts
+cac:
+  caBundle: ${caBundle}
+  edipiLookup: ${edipiLookup}
+  ocspEndpoint: ${ocspEndpoint}
+  certHeader: ${certHeader}
 ${rbacSection}
-  protectedRoutes:
+protectedRoutes:
 ${routeLines}
 ${auditSection}
 `;
@@ -4893,35 +5170,35 @@ ${auditSection}
   if (method === "oidc") {
     const scopes2 = params.oidcScopes ?? "openid profile email";
     const roleClaim = params.oidcRoleClaim ?? "roles";
-    return `auth:
-  method: oidc
-  devOnly: true
-${providerLine}  ${useProxy ? "proxy" : "middleware"}: ./${useProxy ? "proxy" : "middleware"}.ts
-  oidc:
-    discoveryUrl: https://dev-mock-oidc/.well-known/openid-configuration
-    clientId: dev-mock-client
-    clientSecret: dev-mock-secret
-    scopes: ${scopes2}
-    roleClaim: ${roleClaim}
+    return `# stackwright.auth.yml \u2014 generated by Auth Otter
+method: oidc
+devOnly: true
+${providerLine}${useProxy ? "proxy" : "middleware"}: ./${useProxy ? "proxy" : "middleware"}.ts
+oidc:
+  discoveryUrl: https://dev-mock-oidc/.well-known/openid-configuration
+  clientId: dev-mock-client
+  clientSecret: dev-mock-secret
+  scopes: ${scopes2}
+  roleClaim: ${roleClaim}
 ${rbacSection}
-  protectedRoutes:
+protectedRoutes:
 ${routeLines}
 ${auditSection}
 `;
   }
   const scopes = params.oauth2Scopes ?? "read write";
-  return `auth:
-  method: oauth2
-  devOnly: true
-${providerLine}  ${useProxy ? "proxy" : "middleware"}: ./${useProxy ? "proxy" : "middleware"}.ts
-  oauth2:
-    authorizationUrl: https://dev-mock-oauth2/authorize
-    tokenUrl: https://dev-mock-oauth2/token
-    clientId: dev-mock-client
-    clientSecret: dev-mock-secret
-    scopes: ${scopes}
+  return `# stackwright.auth.yml \u2014 generated by Auth Otter
+method: oauth2
+devOnly: true
+${providerLine}${useProxy ? "proxy" : "middleware"}: ./${useProxy ? "proxy" : "middleware"}.ts
+oauth2:
+  authorizationUrl: https://dev-mock-oauth2/authorize
+  tokenUrl: https://dev-mock-oauth2/token
+  clientId: dev-mock-client
+  clientSecret: dev-mock-secret
+  scopes: ${scopes}
 ${rbacSection}
-  protectedRoutes:
+protectedRoutes:
 ${routeLines}
 ${auditSection}
 `;
@@ -5066,7 +5343,7 @@ async function configureAuthHandler(params, cwd) {
       auditRetentionDays,
       normalizedRoutes
     );
-    (0, import_fs7.writeFileSync)((0, import_path7.join)(cwd, conventionFile), authFileContent, "utf8");
+    (0, import_fs8.writeFileSync)((0, import_path8.join)(cwd, conventionFile), authFileContent, "utf8");
     filesWritten.push(conventionFile);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -5086,12 +5363,12 @@ async function configureAuthHandler(params, cwd) {
   if (!devOnly) {
     try {
       const envBlock = generateEnvBlock(effectiveMethod, params);
-      const envPath = (0, import_path7.join)(cwd, ".env.example");
-      if ((0, import_fs7.existsSync)(envPath)) {
-        const existing = (0, import_fs7.readFileSync)(envPath, "utf8");
-        (0, import_fs7.writeFileSync)(envPath, existing.trimEnd() + "\n\n" + envBlock, "utf8");
+      const envPath = (0, import_path8.join)(cwd, ".env.example");
+      if ((0, import_fs8.existsSync)(envPath)) {
+        const existing = (0, import_fs8.readFileSync)(envPath, "utf8");
+        (0, import_fs8.writeFileSync)(envPath, existing.trimEnd() + "\n\n" + envBlock, "utf8");
       } else {
-        (0, import_fs7.writeFileSync)(envPath, envBlock, "utf8");
+        (0, import_fs8.writeFileSync)(envPath, envBlock, "utf8");
       }
       filesWritten.push(".env.example");
     } catch (err) {
@@ -5109,10 +5386,10 @@ async function configureAuthHandler(params, cwd) {
   }
   if (devOnly) {
     try {
-      const mockAuthDir = (0, import_path7.join)(cwd, "lib");
-      (0, import_fs7.mkdirSync)(mockAuthDir, { recursive: true });
+      const mockAuthDir = (0, import_path8.join)(cwd, "lib");
+      (0, import_fs8.mkdirSync)(mockAuthDir, { recursive: true });
       const mockAuthContent = generateMockAuthContent(roles, mockUsers);
-      (0, import_fs7.writeFileSync)((0, import_path7.join)(mockAuthDir, "mock-auth.ts"), mockAuthContent, "utf8");
+      (0, import_fs8.writeFileSync)((0, import_path8.join)(mockAuthDir, "mock-auth.ts"), mockAuthContent, "utf8");
       filesWritten.push("lib/mock-auth.ts");
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
@@ -5130,11 +5407,11 @@ async function configureAuthHandler(params, cwd) {
       };
     }
     try {
-      const pkgPath = (0, import_path7.join)(cwd, "package.json");
-      if ((0, import_fs7.existsSync)(pkgPath)) {
-        const existingPkg = (0, import_fs7.readFileSync)(pkgPath, "utf8");
+      const pkgPath = (0, import_path8.join)(cwd, "package.json");
+      if ((0, import_fs8.existsSync)(pkgPath)) {
+        const existingPkg = (0, import_fs8.readFileSync)(pkgPath, "utf8");
         const updatedPkg = updatePackageJsonScripts(existingPkg, roles, mockUsers);
-        (0, import_fs7.writeFileSync)(pkgPath, updatedPkg, "utf8");
+        (0, import_fs8.writeFileSync)(pkgPath, updatedPkg, "utf8");
         filesWritten.push("package.json");
       }
     } catch (err) {
@@ -5175,21 +5452,18 @@ async function configureAuthHandler(params, cwd) {
       normalizedRoutes,
       useProxy
     );
-    const ymlPath = (0, import_path7.join)(cwd, "stackwright.yml");
-    if (!(0, import_fs7.existsSync)(ymlPath)) {
-      (0, import_fs7.writeFileSync)(ymlPath, authYaml, "utf8");
-    } else {
-      const existing = (0, import_fs7.readFileSync)(ymlPath, "utf8");
-      (0, import_fs7.writeFileSync)(ymlPath, upsertAuthBlock(existing, authYaml), "utf8");
-    }
-    filesWritten.push("stackwright.yml");
+    (0, import_fs8.writeFileSync)((0, import_path8.join)(cwd, "stackwright.auth.yml"), authYaml, "utf8");
+    filesWritten.push("stackwright.auth.yml");
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     return {
       content: [
         {
           type: "text",
-          text: JSON.stringify({ success: false, error: `Failed writing stackwright.yml: ${msg}` })
+          text: JSON.stringify({
+            success: false,
+            error: `Failed writing stackwright.auth.yml: ${msg}`
+          })
         }
       ],
       isError: true
@@ -5234,7 +5508,7 @@ async function configureAuthHandler(params, cwd) {
 function registerAuthTools(server2) {
   server2.tool(
     "stackwright_pro_configure_auth",
-    "Generate authentication middleware and configuration for a Next.js Stackwright application. Writes `middleware.ts` from a secure template, appends/updates the `auth:` section in `stackwright.yml`, and generates `.env.example` with required environment variables. \u26A0\uFE0F For CAC/PKI: generated `middleware.ts` carries a SECURITY REVIEW REQUIRED comment \u2014 certificate chain validation must be verified by a DoD security officer before production deployment. This is the ONLY approved path to generating `middleware.ts`. Never write TypeScript auth files directly.",
+    "Generate authentication middleware and configuration for a Next.js Stackwright application. Writes `middleware.ts` (or `proxy.ts` for Next.js >=16) from a secure template, writes a standalone `stackwright.auth.yml` sibling file, and generates `.env.example` with required environment variables. \u26A0\uFE0F For CAC/PKI: generated `middleware.ts` carries a SECURITY REVIEW REQUIRED comment \u2014 certificate chain validation must be verified by a DoD security officer before production deployment. This is the ONLY approved path to generating `middleware.ts`. Never write TypeScript auth files directly.",
     {
       method: import_zod15.z.enum(["cac", "oidc", "oauth2", "none"]),
       provider: import_zod15.z.enum(["azure-ad", "okta", "ping", "cognito", "custom"]).optional(),
@@ -5285,28 +5559,28 @@ function registerAuthTools(server2) {
 
 // src/integrity.ts
 var import_crypto4 = require("crypto");
-var import_fs8 = require("fs");
-var import_path8 = require("path");
+var import_fs9 = require("fs");
+var import_path9 = require("path");
 var _checksums = /* @__PURE__ */ new Map([
   [
     "stackwright-pro-api-otter.json",
-    "df79f4389a576c2885efa07b04f613c60eb8ebf4a8b1d4c7da5e4bb6ee4248dd"
+    "822b35d7a330ed8ac0b42a63b0f70a41885aa9b5ea23cc5b8b998b549da4c05c"
   ],
   [
     "stackwright-pro-auth-otter.json",
-    "643344b88e42992e0467845fb0184d3932e115b85130fbc6a47a3175759678c8"
+    "d6cd5732667018d99456be77d5955e454da7a0999a0330b5f03a483aa1b9b33f"
   ],
   [
     "stackwright-pro-dashboard-otter.json",
-    "160af221e04200f53709f8c3e249ca6dafb38a325b232fabd478b28f5492ab01"
+    "19268b1ab423bfbb628ebfbc9f6767d5c0bfedd03963c6d445a2724a8bb78f9c"
   ],
   [
     "stackwright-pro-data-otter.json",
-    "709c8e49328908549fe87de181a5991e09c918ef24bbfe6948f9888f0c758c25"
+    "bb66eaab31c6872536dca4d3ff145724a46356946dd0665cc4f0346714d3bacb"
   ],
   [
     "stackwright-pro-designer-otter.json",
-    "1364b2c235c07b0b798e9aab90a68604f60019a5508d41ba576977f173e20cd9"
+    "b54121c6a2ab5b1ad68c1262c58b2e04e6315feacd6bb8de8e78eb36f2fa6be6"
   ],
   [
     "stackwright-pro-domain-expert-otter.json",
@@ -5314,35 +5588,39 @@ var _checksums = /* @__PURE__ */ new Map([
   ],
   [
     "stackwright-pro-foreman-otter.json",
-    "438b03d2c35f64536055c68b3a9044fe3b5e4f2889acde4500dd801fad724be1"
+    "abb1cc5e40a8c5ff98057273f43a9e90e2791a15951090cd4d98407c0c3618e3"
   ],
   [
     "stackwright-pro-form-wizard-otter.json",
-    "3dffa3ef2d2ef057578391f784cbea779d768e87d98321894ea5bcd9e3ab7e60"
+    "975ad68e8fb6fe5a10373be278946fa4d9d7ec2238a0b2bd9e4a412e5b1fdd6d"
   ],
   [
     "stackwright-pro-geo-otter.json",
-    "2ec83c26a08c413d9553ff8b8f0f0f643c1a8da043741b356e27106cad78f05f"
+    "eef152e5b58947c8eb1ffec2c37acffc39f84b61be4c6cb827310f052221935b"
   ],
   [
     "stackwright-pro-page-otter.json",
-    "0057ea97f7c2e33a8673140f59a0237eb627d82c676af3fae4faa31033598e03"
+    "ddfa497a4d4980080fa2918aec4d6dfd78d5c28ec6426b4b52f4f26fccaddabb"
   ],
   [
     "stackwright-pro-polish-otter.json",
-    "bd87327b9a9a62fabaee8837492ce943feae8bfc15e5d43b45ba0e84619daec3"
+    "5e6532c1fe0737ed83b1f46dd55642e1076adb6ef23d4de636523eb3d88d3087"
+  ],
+  [
+    "stackwright-pro-qa-otter.json",
+    "ecb1e76170723fce43f515044e304d9da32253dadecbf29bf08c90bb8f375f77"
   ],
   [
     "stackwright-pro-scaffold-otter.json",
-    "91de5861f1406043d1d387388302fb1492211b81e2eea9777dec60e48f317f2a"
+    "96ac7754b54c15732206cd4d8043b558d0c465757a0bc70fae6b498d6f02f22a"
   ],
   [
     "stackwright-pro-theme-otter.json",
-    "fe10108e3ba67106751ea662f512bb5f4eb58f7abda26880ef4cf6b0f9feb944"
+    "fb62e56642f7f94c50ce173f3e1ce978b3f20ab1567e87403b901d6dd991a7db"
   ],
   [
     "stackwright-services-otter.json",
-    "c013d7fc2475e62d0af54d57bc988182feee7766bac0edf841cbfad5c73e9261"
+    "0a5dac670482871c718099767b30bf23d8ec57e942bd40a00ce295926d82c6bd"
   ]
 ]);
 Object.freeze(_checksums);
@@ -5355,6 +5633,7 @@ for (const [name, digest] of CANONICAL_CHECKSUMS) {
     );
   }
 }
+var CANONICAL_OTTERS = Object.freeze([...CANONICAL_CHECKSUMS.keys()]);
 var MAX_OTTER_BYTES = 1 * 1024 * 1024;
 function computeSha256(data) {
   return (0, import_crypto4.createHash)("sha256").update(data).digest("hex");
@@ -5364,14 +5643,14 @@ function safeEqual(a, b) {
   return (0, import_crypto4.timingSafeEqual)(Buffer.from(a, "utf8"), Buffer.from(b, "utf8"));
 }
 function verifyOtterFile(filePath) {
-  const filename = (0, import_path8.basename)(filePath);
+  const filename = (0, import_path9.basename)(filePath);
   const expected = CANONICAL_CHECKSUMS.get(filename);
   if (expected === void 0) {
     return { verified: false, filename, error: `Unknown otter file: not in canonical set` };
   }
   let stat;
   try {
-    stat = (0, import_fs8.lstatSync)(filePath);
+    stat = (0, import_fs9.lstatSync)(filePath);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     return { verified: false, filename, error: `Cannot stat file: ${msg}` };
@@ -5389,7 +5668,7 @@ function verifyOtterFile(filePath) {
   }
   let raw;
   try {
-    raw = (0, import_fs8.readFileSync)(filePath);
+    raw = (0, import_fs9.readFileSync)(filePath);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     return { verified: false, filename, error: `Cannot read file: ${msg}` };
@@ -5439,7 +5718,7 @@ function verifyAllOtters(otterDir) {
   const unknown = [];
   let entries;
   try {
-    entries = (0, import_fs8.readdirSync)(otterDir);
+    entries = (0, import_fs9.readdirSync)(otterDir);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     return {
@@ -5450,9 +5729,9 @@ function verifyAllOtters(otterDir) {
   }
   const otterFiles = entries.filter((f) => f.endsWith("-otter.json"));
   for (const filename of otterFiles) {
-    const filePath = (0, import_path8.join)(otterDir, filename);
+    const filePath = (0, import_path9.join)(otterDir, filename);
     try {
-      if ((0, import_fs8.lstatSync)(filePath).isSymbolicLink()) {
+      if ((0, import_fs9.lstatSync)(filePath).isSymbolicLink()) {
         failed.push({ filename, error: "Skipped: symlink" });
         continue;
       }
@@ -5478,9 +5757,9 @@ var DEFAULT_SEARCH_PATHS = ["node_modules/@stackwright-pro/otters/src/", "packag
 function resolveOtterDir() {
   const cwd = process.cwd();
   for (const relative of DEFAULT_SEARCH_PATHS) {
-    const candidate = (0, import_path8.join)(cwd, relative);
+    const candidate = (0, import_path9.join)(cwd, relative);
     try {
-      (0, import_fs8.lstatSync)(candidate);
+      (0, import_fs9.lstatSync)(candidate);
       return candidate;
     } catch {
     }
@@ -5559,13 +5838,13 @@ function registerIntegrityTools(server2) {
 
 // src/tools/domain.ts
 var import_zod16 = require("zod");
-var import_fs9 = require("fs");
-var import_path9 = require("path");
+var import_fs10 = require("fs");
+var import_path10 = require("path");
 function handleListCollections(input) {
   const cwd = input._cwd ?? process.cwd();
   const sources = [
     {
-      path: (0, import_path9.join)(cwd, ".stackwright", "artifacts", "data-config.json"),
+      path: (0, import_path10.join)(cwd, ".stackwright", "artifacts", "data-config.json"),
       source: "data-config.json",
       parse: (raw) => {
         const parsed = JSON.parse(raw);
@@ -5576,15 +5855,15 @@ function handleListCollections(input) {
       }
     },
     {
-      path: (0, import_path9.join)(cwd, "stackwright.yml"),
+      path: (0, import_path10.join)(cwd, "stackwright.yml"),
       source: "stackwright.yml",
       parse: extractCollectionsFromYaml
     }
   ];
-  for (const { path: path3, source, parse } of sources) {
-    if (!(0, import_fs9.existsSync)(path3)) continue;
+  for (const { path: path4, source, parse } of sources) {
+    if (!(0, import_fs10.existsSync)(path4)) continue;
     try {
-      const collections = parse((0, import_fs9.readFileSync)(path3, "utf8"));
+      const collections = parse((0, import_fs10.readFileSync)(path4, "utf8"));
       return {
         text: JSON.stringify({ collections, source, collectionCount: collections.length }),
         isError: false
@@ -5735,8 +6014,8 @@ function handleValidateWorkflow(input) {
   if (input.workflow && Object.keys(input.workflow).length > 0) {
     raw = input.workflow;
   } else {
-    const artifactPath = (0, import_path9.join)(cwd, ".stackwright", "artifacts", "workflow-config.json");
-    if (!(0, import_fs9.existsSync)(artifactPath)) {
+    const artifactPath = (0, import_path10.join)(cwd, ".stackwright", "artifacts", "workflow-config.json");
+    if (!(0, import_fs10.existsSync)(artifactPath)) {
       return fail([
         {
           code: "NO_WORKFLOW",
@@ -5745,7 +6024,7 @@ function handleValidateWorkflow(input) {
       ]);
     }
     try {
-      raw = JSON.parse((0, import_fs9.readFileSync)(artifactPath, "utf8"));
+      raw = JSON.parse((0, import_fs10.readFileSync)(artifactPath, "utf8"));
     } catch (err) {
       return fail([{ code: "INVALID_JSON", message: `Failed to parse workflow artifact: ${err}` }]);
     }
@@ -5857,12 +6136,12 @@ function handleValidateWorkflow(input) {
   return { text: JSON.stringify({ valid: errors.length === 0, errors, warnings }), isError: false };
 }
 function validateTransitionTargets(step, stepId, stepIds, errors) {
-  const check = (target, path3) => {
+  const check = (target, path4) => {
     if (typeof target === "string" && !stepIds.has(target)) {
       errors.push({
         code: "ORPHANED_TRANSITION",
         message: `Step "${stepId}" transitions to "${target}" which does not exist`,
-        path: path3
+        path: path4
       });
     }
   };
@@ -5901,11 +6180,11 @@ function validateTransitionTargets(step, stepId, stepIds, errors) {
 }
 function collectServiceWarnings(step, stepId, warnings) {
   const isService = (val) => typeof val === "string" && val.startsWith("service:");
-  const warn = (path3) => {
+  const warn = (path4) => {
     warnings.push({
       code: "WARN_SERVICE_REFERENCE",
-      message: `service: reference at "${path3}" requires @stackwright-pro/services. Prism mock fallback will be used until services layer is configured.`,
-      path: path3
+      message: `service: reference at "${path4}" requires @stackwright-pro/services. Prism mock fallback will be used until services layer is configured.`,
+      path: path4
     });
   };
   const onSubmit = step.on_submit;
@@ -6053,8 +6332,8 @@ function registerTypeSchemasTool(server2) {
 }
 
 // src/tools/scaffold-cleanup.ts
-var import_fs10 = require("fs");
-var import_path10 = require("path");
+var import_fs11 = require("fs");
+var import_path11 = require("path");
 var SCAFFOLD_FILES_TO_DELETE = [
   "content/posts/getting-started.yaml",
   "content/posts/hello-world.yaml"
@@ -6079,12 +6358,12 @@ var FALLBACK_COLORS = {
   mutedForeground: "#737373"
 };
 function readThemeColors(cwd) {
-  const tokenPath = (0, import_path10.join)(cwd, ".stackwright", "artifacts", "theme-tokens.json");
-  if (!(0, import_fs10.existsSync)(tokenPath)) return { ...FALLBACK_COLORS };
-  const stat = (0, import_fs10.lstatSync)(tokenPath);
+  const tokenPath = (0, import_path11.join)(cwd, ".stackwright", "artifacts", "theme-tokens.json");
+  if (!(0, import_fs11.existsSync)(tokenPath)) return { ...FALLBACK_COLORS };
+  const stat = (0, import_fs11.lstatSync)(tokenPath);
   if (stat.isSymbolicLink()) return { ...FALLBACK_COLORS };
   try {
-    const raw = JSON.parse((0, import_fs10.readFileSync)(tokenPath, "utf-8"));
+    const raw = JSON.parse((0, import_fs11.readFileSync)(tokenPath, "utf-8"));
     const css = raw?.cssVariables ?? {};
     const toHsl = (hslValue) => {
       if (!hslValue || typeof hslValue !== "string") return null;
@@ -6144,15 +6423,15 @@ function generateNotFoundPage(colors) {
 `;
 }
 function isSafePath(fullPath) {
-  if (!(0, import_fs10.existsSync)(fullPath)) return true;
-  const stat = (0, import_fs10.lstatSync)(fullPath);
+  if (!(0, import_fs11.existsSync)(fullPath)) return true;
+  const stat = (0, import_fs11.lstatSync)(fullPath);
   return !stat.isSymbolicLink();
 }
 function isDirEmpty(dirPath) {
-  if (!(0, import_fs10.existsSync)(dirPath)) return false;
-  const stat = (0, import_fs10.lstatSync)(dirPath);
+  if (!(0, import_fs11.existsSync)(dirPath)) return false;
+  const stat = (0, import_fs11.lstatSync)(dirPath);
   if (!stat.isDirectory()) return false;
-  return (0, import_fs10.readdirSync)(dirPath).length === 0;
+  return (0, import_fs11.readdirSync)(dirPath).length === 0;
 }
 function handleCleanupScaffold(_cwd) {
   const cwd = _cwd ?? process.cwd();
@@ -6165,8 +6444,8 @@ function handleCleanupScaffold(_cwd) {
     cleanupWarnings: []
   };
   for (const relPath of SCAFFOLD_FILES_TO_DELETE) {
-    const fullPath = (0, import_path10.join)(cwd, relPath);
-    if (!(0, import_fs10.existsSync)(fullPath)) {
+    const fullPath = (0, import_path11.join)(cwd, relPath);
+    if (!(0, import_fs11.existsSync)(fullPath)) {
       result.skipped.push(relPath);
       continue;
     }
@@ -6175,7 +6454,7 @@ function handleCleanupScaffold(_cwd) {
       continue;
     }
     try {
-      (0, import_fs10.unlinkSync)(fullPath);
+      (0, import_fs11.unlinkSync)(fullPath);
       result.deleted.push(relPath);
     } catch (err) {
       result.errors.push(`Failed to delete ${relPath}: ${String(err)}`);
@@ -6183,19 +6462,19 @@ function handleCleanupScaffold(_cwd) {
   }
   {
     const relPath = "pages/getting-started/content.yml";
-    const fullPath = (0, import_path10.join)(cwd, relPath);
-    if (!(0, import_fs10.existsSync)(fullPath)) {
+    const fullPath = (0, import_path11.join)(cwd, relPath);
+    if (!(0, import_fs11.existsSync)(fullPath)) {
       result.skipped.push(relPath);
     } else if (!isSafePath(fullPath)) {
       result.errors.push(`Refusing to delete symlink: ${relPath}`);
     } else {
-      const content = (0, import_fs10.readFileSync)(fullPath, "utf-8");
+      const content = (0, import_fs11.readFileSync)(fullPath, "utf-8");
       const isScaffoldDefault = GETTING_STARTED_SCAFFOLD_FINGERPRINTS.some(
         (marker) => content.includes(marker)
       );
       if (isScaffoldDefault) {
         try {
-          (0, import_fs10.unlinkSync)(fullPath);
+          (0, import_fs11.unlinkSync)(fullPath);
           result.deleted.push(relPath);
         } catch (err) {
           result.errors.push(`Failed to delete ${relPath}: ${String(err)}`);
@@ -6209,21 +6488,21 @@ function handleCleanupScaffold(_cwd) {
   }
   {
     const relPath = `content/posts/${POSTS_COLLECTION_FILE}`;
-    const fullPath = (0, import_path10.join)(cwd, relPath);
-    const postsDir = (0, import_path10.join)(cwd, "content/posts");
-    if (!(0, import_fs10.existsSync)(fullPath)) {
+    const fullPath = (0, import_path11.join)(cwd, relPath);
+    const postsDir = (0, import_path11.join)(cwd, "content/posts");
+    if (!(0, import_fs11.existsSync)(fullPath)) {
       result.skipped.push(relPath);
     } else if (!isSafePath(fullPath)) {
       result.errors.push(`Refusing to delete symlink: ${relPath}`);
-    } else if (!(0, import_fs10.existsSync)(postsDir)) {
+    } else if (!(0, import_fs11.existsSync)(postsDir)) {
       result.skipped.push(relPath);
     } else {
-      const userPostFiles = (0, import_fs10.readdirSync)(postsDir).filter(
+      const userPostFiles = (0, import_fs11.readdirSync)(postsDir).filter(
         (f) => f !== POSTS_COLLECTION_FILE && POST_FILE_EXTENSIONS.some((ext) => f.endsWith(ext))
       );
       if (userPostFiles.length === 0) {
         try {
-          (0, import_fs10.unlinkSync)(fullPath);
+          (0, import_fs11.unlinkSync)(fullPath);
           result.deleted.push(relPath);
         } catch (err) {
           result.errors.push(`Failed to delete ${relPath}: ${String(err)}`);
@@ -6236,15 +6515,15 @@ function handleCleanupScaffold(_cwd) {
     }
   }
   for (const relDir of SCAFFOLD_DIRS_TO_PRUNE) {
-    const fullDir = (0, import_path10.join)(cwd, relDir);
-    if (!(0, import_fs10.existsSync)(fullDir)) continue;
+    const fullDir = (0, import_path11.join)(cwd, relDir);
+    if (!(0, import_fs11.existsSync)(fullDir)) continue;
     if (!isSafePath(fullDir)) {
       result.errors.push(`Refusing to prune symlink directory: ${relDir}`);
       continue;
     }
     if (isDirEmpty(fullDir)) {
       try {
-        (0, import_fs10.rmdirSync)(fullDir);
+        (0, import_fs11.rmdirSync)(fullDir);
         result.prunedDirs.push(relDir);
       } catch (err) {
         result.errors.push(`Failed to prune directory ${relDir}: ${String(err)}`);
@@ -6252,8 +6531,8 @@ function handleCleanupScaffold(_cwd) {
     }
   }
   {
-    const fullPath = (0, import_path10.join)(cwd, NOT_FOUND_PATH);
-    if (!(0, import_fs10.existsSync)(fullPath)) {
+    const fullPath = (0, import_path11.join)(cwd, NOT_FOUND_PATH);
+    if (!(0, import_fs11.existsSync)(fullPath)) {
       result.skipped.push(NOT_FOUND_PATH);
     } else if (!isSafePath(fullPath)) {
       result.errors.push(`Refusing to rewrite symlink: ${NOT_FOUND_PATH}`);
@@ -6261,9 +6540,9 @@ function handleCleanupScaffold(_cwd) {
       try {
         const colors = readThemeColors(cwd);
         const content = generateNotFoundPage(colors);
-        const dir = (0, import_path10.dirname)(fullPath);
-        (0, import_fs10.mkdirSync)(dir, { recursive: true });
-        (0, import_fs10.writeFileSync)(fullPath, content, "utf-8");
+        const dir = (0, import_path11.dirname)(fullPath);
+        (0, import_fs11.mkdirSync)(dir, { recursive: true });
+        (0, import_fs11.writeFileSync)(fullPath, content, "utf-8");
         result.rewritten.push(NOT_FOUND_PATH);
       } catch (err) {
         result.errors.push(`Failed to rewrite ${NOT_FOUND_PATH}: ${String(err)}`);
@@ -6530,12 +6809,258 @@ function registerContrastTools(server2) {
   );
 }
 
+// src/tools/compile.ts
+var import_zod19 = require("zod");
+var import_fs12 = __toESM(require("fs"));
+var import_path12 = __toESM(require("path"));
+var import_server = require("@stackwright-pro/pulse/server");
+var import_server2 = require("@stackwright-pro/auth-nextjs/server");
+var import_server3 = require("@stackwright-pro/openapi/server");
+function buildContext(projectRoot) {
+  return {
+    projectRoot,
+    contentOutDir: import_path12.default.join(projectRoot, "public", "stackwright-content"),
+    imagesDir: import_path12.default.join(projectRoot, "public", "images"),
+    siteConfig: loadSiteConfig(projectRoot)
+  };
+}
+function loadSiteConfig(projectRoot) {
+  try {
+    const sitePath = import_path12.default.join(projectRoot, "public", "stackwright-content", "_site.json");
+    return JSON.parse(import_fs12.default.readFileSync(sitePath, "utf8"));
+  } catch {
+    return {};
+  }
+}
+function formatDuration(startMs) {
+  const ms = Date.now() - startMs;
+  return ms < 1e3 ? `${ms}ms` : `${(ms / 1e3).toFixed(2)}s`;
+}
+async function tryOssCompile(fn, ctx, extra) {
+  try {
+    const bsPath = import_path12.default.join(ctx.projectRoot, "node_modules", "@stackwright", "build-scripts");
+    if (!import_fs12.default.existsSync(bsPath)) {
+      return {
+        ok: false,
+        error: `@stackwright/build-scripts not found at ${bsPath}. Is it installed in your project?`
+      };
+    }
+    const bs = await import(bsPath);
+    if (typeof bs[fn] !== "function") {
+      return { ok: false, error: `${fn} not exported from @stackwright/build-scripts` };
+    }
+    await bs[fn](ctx, ...extra ? [extra] : []);
+    return { ok: true };
+  } catch (err) {
+    return { ok: false, error: err instanceof Error ? err.message : String(err) };
+  }
+}
+function registerCompileTools(server2) {
+  const projectRootArg = import_zod19.z.string().optional().describe("Absolute path to project root (defaults to cwd)");
+  server2.tool(
+    "stackwright_pro_compile_collections",
+    "Compile stackwright.collections.yml \u2192 public/stackwright-content/_collections.json. Reads and validates the live-collections sidecar config file and emits the JSON sink consumed at runtime by PulseCollectionProvider.",
+    { projectRoot: projectRootArg },
+    async ({ projectRoot }) => {
+      const start = Date.now();
+      const root = projectRoot ?? process.cwd();
+      try {
+        await (0, import_server.compileCollections)(buildContext(root));
+        return {
+          content: [
+            {
+              type: "text",
+              text: ` _collections.json written (${formatDuration(start)})`
+            }
+          ]
+        };
+      } catch (err) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: ` compile_collections failed: ${err instanceof Error ? err.message : String(err)}`
+            }
+          ]
+        };
+      }
+    }
+  );
+  server2.tool(
+    "stackwright_pro_compile_auth",
+    "Compile stackwright.auth.yml \u2192 public/stackwright-content/_auth.json. Reads and validates the auth sidecar config file and emits the JSON sink consumed at app startup to configure auth middleware.",
+    { projectRoot: projectRootArg },
+    async ({ projectRoot }) => {
+      const start = Date.now();
+      const root = projectRoot ?? process.cwd();
+      try {
+        await (0, import_server2.compileAuth)(buildContext(root));
+        return {
+          content: [
+            {
+              type: "text",
+              text: ` _auth.json written (${formatDuration(start)})`
+            }
+          ]
+        };
+      } catch (err) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: ` compile_auth failed: ${err instanceof Error ? err.message : String(err)}`
+            }
+          ]
+        };
+      }
+    }
+  );
+  server2.tool(
+    "stackwright_pro_compile_integrations",
+    "Compile stackwright.integrations.yml \u2192 public/stackwright-content/_integrations.json. If no yml file exists, falls back to extracting integration metadata from _site.json (collections data is excluded \u2014 it lives in _collections.json).",
+    { projectRoot: projectRootArg },
+    async ({ projectRoot }) => {
+      const start = Date.now();
+      const root = projectRoot ?? process.cwd();
+      try {
+        await (0, import_server3.compileIntegrations)(buildContext(root));
+        return {
+          content: [
+            {
+              type: "text",
+              text: ` _integrations.json written (${formatDuration(start)})`
+            }
+          ]
+        };
+      } catch (err) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: ` compile_integrations failed: ${err instanceof Error ? err.message : String(err)}`
+            }
+          ]
+        };
+      }
+    }
+  );
+  server2.tool(
+    "stackwright_pro_compile_all",
+    "Run all Pro compile sinks (collections + auth + integrations) in sequence. Equivalent to running compile_collections, compile_auth, and compile_integrations individually. Use this for a full Pro prebuild pass.",
+    { projectRoot: projectRootArg },
+    async ({ projectRoot }) => {
+      const start = Date.now();
+      const root = projectRoot ?? process.cwd();
+      const ctx = buildContext(root);
+      const results = [];
+      const errors = [];
+      for (const [label, fn] of [
+        ["collections", () => (0, import_server.compileCollections)(ctx)],
+        ["auth", () => (0, import_server2.compileAuth)(ctx)],
+        ["integrations", () => (0, import_server3.compileIntegrations)(ctx)]
+      ]) {
+        try {
+          await fn();
+          results.push(`   _${label}.json`);
+        } catch (err) {
+          errors.push(`   ${label}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+      }
+      const summary = errors.length > 0 ? ` compile_all finished with errors (${formatDuration(start)}):
+${results.join("\n")}
+Errors:
+${errors.join("\n")}` : ` compile_all complete (${formatDuration(start)}):
+${results.join("\n")}`;
+      return { content: [{ type: "text", text: summary }] };
+    }
+  );
+  server2.tool(
+    "stackwright_pro_compile_theme",
+    "Compile stackwright.yml theme config \u2192 _theme.json. Delegates to compileTheme from @stackwright/build-scripts installed in the project.",
+    { projectRoot: projectRootArg },
+    async ({ projectRoot }) => {
+      const start = Date.now();
+      const root = projectRoot ?? process.cwd();
+      const { ok, error } = await tryOssCompile("compileTheme", buildContext(root));
+      return {
+        content: [
+          {
+            type: "text",
+            text: ok ? ` _theme.json written (${formatDuration(start)})` : ` compile_theme failed: ${error}`
+          }
+        ]
+      };
+    }
+  );
+  server2.tool(
+    "stackwright_pro_compile_site",
+    "Compile stackwright.yml \u2192 _site.json. Delegates to compileSite from @stackwright/build-scripts installed in the project.",
+    { projectRoot: projectRootArg },
+    async ({ projectRoot }) => {
+      const start = Date.now();
+      const root = projectRoot ?? process.cwd();
+      const { ok, error } = await tryOssCompile("compileSite", buildContext(root));
+      return {
+        content: [
+          {
+            type: "text",
+            text: ok ? ` _site.json written (${formatDuration(start)})` : ` compile_site failed: ${error}`
+          }
+        ]
+      };
+    }
+  );
+  server2.tool(
+    "stackwright_pro_compile_pages",
+    "Compile all pages content.yml files \u2192 page JSON files. Delegates to compilePages from @stackwright/build-scripts installed in the project.",
+    { projectRoot: projectRootArg },
+    async ({ projectRoot }) => {
+      const start = Date.now();
+      const root = projectRoot ?? process.cwd();
+      const { ok, error } = await tryOssCompile("compilePages", buildContext(root));
+      return {
+        content: [
+          {
+            type: "text",
+            text: ok ? ` pages compiled (${formatDuration(start)})` : ` compile_pages failed: ${error}`
+          }
+        ]
+      };
+    }
+  );
+  server2.tool(
+    "stackwright_pro_compile_page",
+    "Compile a single page by slug. Delegates to compilePage from @stackwright/build-scripts installed in the project.",
+    {
+      slug: import_zod19.z.string().describe('Page slug (relative path under pages/, e.g. "dashboard")'),
+      projectRoot: projectRootArg
+    },
+    async ({ slug, projectRoot }) => {
+      const start = Date.now();
+      const root = projectRoot ?? process.cwd();
+      const { ok, error } = await tryOssCompile("compilePage", buildContext(root), { slug });
+      return {
+        content: [
+          {
+            type: "text",
+            text: ok ? ` page "${slug}" compiled (${formatDuration(start)})` : ` compile_page failed: ${error}`
+          }
+        ]
+      };
+    }
+  );
+}
+
 // package.json
 var package_default = {
   dependencies: {
     "@modelcontextprotocol/sdk": "^1.10.0",
+    "@stackwright-pro/auth-nextjs": "workspace:*",
     "@stackwright-pro/cli-data-explorer": "workspace:*",
+    "@stackwright-pro/openapi": "workspace:*",
+    "@stackwright-pro/pulse": "workspace:*",
     "@stackwright-pro/types": "workspace:*",
+    "@stackwright/mcp": "0.6.0-alpha.1",
     "@types/js-yaml": "^4.0.9",
     "js-yaml": "^4.2.0",
     zod: "^4.4.3"
@@ -6555,7 +7080,7 @@ var package_default = {
     "test:coverage": "vitest run --coverage"
   },
   name: "@stackwright-pro/mcp",
-  version: "0.2.0-alpha.92",
+  version: "0.2.0-alpha.97",
   description: "MCP tools for Stackwright Pro - Data Explorer, Security, ISR, and Dashboard generation",
   license: "SEE LICENSE IN LICENSE",
   main: "./dist/server.js",
@@ -6579,6 +7104,11 @@ var package_default = {
       types: "./dist/tools/type-schemas.d.ts",
       import: "./dist/tools/type-schemas.mjs",
       require: "./dist/tools/type-schemas.js"
+    },
+    "./pipeline-constants": {
+      types: "./dist/pipeline-constants.d.ts",
+      import: "./dist/pipeline-constants.mjs",
+      require: "./dist/pipeline-constants.js"
     }
   },
   files: [
@@ -6590,6 +7120,7 @@ var package_default = {
 };
 
 // src/server.ts
+var import_register = require("@stackwright/mcp/register");
 var server = new import_mcp.McpServer({
   name: "stackwright-pro",
   version: package_default.version
@@ -6613,7 +7144,45 @@ registerValidateYamlFragmentTool(server);
 registerGetSchemaTool(server);
 registerScaffoldCleanupTools(server);
 registerContrastTools(server);
+registerCompileTools(server);
+(0, import_register.registerContentTypeTools)(server);
+(0, import_register.registerPageTools)(server);
+(0, import_register.registerSiteTools)(server);
+(0, import_register.registerProjectTools)(server);
+(0, import_register.registerGitOpsTools)(server);
+(0, import_register.registerBoardTools)(server);
+(0, import_register.registerCollectionTools)(server);
+(0, import_register.registerIntegrationTools)(server);
+(0, import_register.registerComposeTools)(server);
+(0, import_register.registerRenderTools)(server);
+(0, import_register.registerA11yTools)(server);
+process.on("SIGINT", async () => {
+  const forceExit = setTimeout(() => process.exit(1), 3e3);
+  forceExit.unref();
+  await (0, import_register.closeBrowser)();
+  process.exit(0);
+});
+process.on("SIGTERM", async () => {
+  const forceExit = setTimeout(() => process.exit(1), 3e3);
+  forceExit.unref();
+  await (0, import_register.closeBrowser)();
+  process.exit(0);
+});
 async function main() {
+  const pipelineGraph = loadPipelineGraph();
+  const phasePosition = new Map(PHASE_ORDER.map((p, i) => [p, i]));
+  for (const [phase, deps] of Object.entries(pipelineGraph.dependencies)) {
+    const phaseIdx = phasePosition.get(phase);
+    if (phaseIdx === void 0) continue;
+    for (const dep of deps) {
+      const depIdx = phasePosition.get(dep);
+      if (depIdx !== void 0 && depIdx >= phaseIdx) {
+        throw new Error(
+          `PHASE_ORDER sanity check failed: "${dep}" (position ${depIdx}) must precede "${phase}" (position ${phaseIdx}) but it doesn't. Update PHASE_ORDER in pipeline.ts to reflect the new dependency structure.`
+        );
+      }
+    }
+  }
   const transport = new import_stdio.StdioServerTransport();
   try {
     const servicesRegisterPkg = "@stackwright-services/mcp/register";