@walkeros/mcp 3.4.2 → 4.0.0-next-1777463920154

package/dist/index.js

@@ -1,1579 +1,2030 @@
-#!/usr/bin/env node
-
-// src/index.ts
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { setClientContext } from "@walkeros/cli";
-
-// src/tools/validate.ts
-import { validate } from "@walkeros/cli";
-import { schemas } from "@walkeros/cli/dev";
-import { mcpResult, mcpError } from "@walkeros/core";
-
-// src/schemas/output.ts
+// src/tools/auth.ts
 import { z } from "zod";
-var ValidateOutputShape = {
-  valid: z.boolean().describe("Whether validation passed"),
-  type: z.union([
-    z.enum(["contract", "entry", "event", "flow", "mapping"]),
-    z.string().regex(/^(destinations|sources|transformers)\.\w+$/)
-  ]).describe("What was validated"),
-  errors: z.array(
-    z.object({
-      path: z.string(),
-      message: z.string(),
-      value: z.unknown().optional(),
-      code: z.string().optional()
-    })
-  ).describe("Validation errors"),
-  warnings: z.array(
-    z.object({
-      path: z.string(),
-      message: z.string(),
-      suggestion: z.string().optional()
-    })
-  ).describe("Validation warnings"),
-  details: z.record(z.string(), z.unknown()).describe("Additional validation details")
-};
-var BundleOutputShape = {
-  success: z.boolean().describe("Whether bundling succeeded"),
-  totalSize: z.number().optional().describe("Total bundle size in bytes"),
-  buildTime: z.number().optional().describe("Build time in milliseconds"),
-  packages: z.array(
-    z.object({
-      name: z.string(),
-      size: z.number()
-    })
-  ).optional().describe("Per-package size breakdown"),
-  treeshakingEffective: z.boolean().optional().describe("Whether tree-shaking was effective"),
-  message: z.string().optional().describe("Status message")
-};
-var SimulateOutputShape = {
-  success: z.boolean().describe("Whether simulation succeeded"),
-  error: z.string().optional().describe("Error message if failed"),
-  summary: z.string().describe("One-line result summary"),
-  destinations: z.record(
-    z.string(),
-    z.object({
-      received: z.boolean().describe("Whether destination received the event"),
-      calls: z.number().describe("Number of API calls made"),
-      payload: z.unknown().optional().describe("All intercepted API calls (only when verbose: true)")
-    })
-  ).optional().describe("Per-destination results"),
-  capturedEvents: z.array(z.record(z.string(), z.unknown())).optional().describe("Events captured by source simulation"),
-  duration: z.number().optional().describe("Simulation duration in ms")
-};
-var PushOutputShape = {
-  success: z.boolean().describe("Whether push succeeded"),
-  elbResult: z.unknown().optional().describe("Push result from the collector"),
-  duration: z.number().describe("Push duration in milliseconds"),
-  error: z.string().optional().describe("Error message if push failed")
+import { mcpResult, mcpError } from "@walkeros/core";
+var TITLE = "Authentication";
+var DESCRIPTION = "Manage walkerOS authentication. Check login status, log in via device code flow, or log out. No terminal or browser required, the MCP client handles the authorization URL.";
+var inputSchema = {
+  action: z.enum(["status", "login", "logout"]).describe("Authentication action to perform"),
+  deviceCode: z.string().optional().describe(
+    "Device code from a previous pending login attempt. Provide to resume polling without requesting a new code."
+  )
 };
-var ExamplesListOutputShape = {
-  flow: z.string().describe("Flow name"),
-  count: z.number().describe("Number of examples found"),
-  examples: z.array(
-    z.object({
-      step: z.string().describe('Step location (e.g., "destination.gtag")'),
-      stepType: z.enum(["source", "transformer", "destination"]).describe("Step type"),
-      stepName: z.string().describe("Step name"),
-      exampleName: z.string().describe("Example name"),
-      title: z.string().optional().describe("Human-readable title if set"),
-      description: z.string().optional().describe("Short human-readable description"),
-      public: z.boolean().optional().describe(
-        "Whether the example is public (defaults to true if omitted)"
-      ),
-      hasIn: z.boolean().describe("Whether the example has an input value"),
-      hasOut: z.boolean().describe("Whether the example has an output value"),
-      hasMapping: z.boolean().describe("Whether the example has a mapping configuration"),
-      hasTrigger: z.boolean().describe("Whether the example has trigger metadata"),
-      in: z.unknown().optional().describe("Input event data"),
-      out: z.unknown().optional().describe("Expected output data"),
-      mapping: z.unknown().optional().describe("Mapping configuration for destinations"),
-      trigger: z.object({
-        type: z.string().optional(),
-        options: z.unknown().optional()
-      }).optional().describe("Trigger metadata for source simulation")
-    })
-  ).describe("Step examples")
+var annotations = {
+  readOnlyHint: false,
+  destructiveHint: true,
+  idempotentHint: false,
+  openWorldHint: true
 };
-
-// src/tools/validate.ts
-function registerFlowValidateTool(server2) {
-  server2.registerTool(
-    "flow_validate",
-    {
-      title: "Validate Flow",
-      description: "Validate walkerOS events, flow configurations, mapping rules, or data contracts. Accepts JSON strings, file paths, or URLs as input. Returns validation results with errors, warnings, and details.",
-      inputSchema: schemas.ValidateInputShape,
-      outputSchema: ValidateOutputShape,
-      annotations: {
-        readOnlyHint: true,
-        destructiveHint: false,
-        idempotentHint: true,
-        openWorldHint: false
+function createAuthToolSpec(client) {
+  return {
+    name: "auth",
+    title: TITLE,
+    description: DESCRIPTION,
+    inputSchema,
+    annotations,
+    handler: (input) => authHandlerBody(client, input)
+  };
+}
+async function authHandlerBody(client, input) {
+  const { action, deviceCode } = input ?? {};
+  try {
+    switch (action) {
+      case "status": {
+        const resolved = client.resolveToken();
+        if (!resolved) {
+          return mcpResult(
+            { authenticated: false },
+            { next: ['Use auth with action "login" to authenticate'] }
+          );
+        }
+        const user = await client.whoami();
+        return mcpResult({
+          authenticated: true,
+          ...user
+        });
       }
-    },
-    async ({ type, input, flow, path }) => {
-      try {
-        const result = await validate(type, input, {
-          flow,
-          path
+      case "login": {
+        if (deviceCode) {
+          const pollResult = await client.pollForToken(deviceCode, {
+            timeoutMs: 6e4
+          });
+          if (pollResult.success) {
+            return mcpResult(
+              { authenticated: true, email: pollResult.email },
+              {
+                next: [
+                  'Use project_manage with action "list" to see your projects'
+                ]
+              }
+            );
+          }
+          if (pollResult.status === "pending") {
+            return mcpResult({
+              authenticated: false,
+              status: "pending",
+              message: "Still waiting for authorization. Try again shortly.",
+              deviceCode
+            });
+          }
+          return mcpError(
+            new Error(pollResult.error || "Authorization failed")
+          );
+        }
+        const code = await client.requestDeviceCode();
+        const loginUrl = code.verificationUriComplete || code.verificationUri;
+        return mcpResult({
+          authenticated: false,
+          status: "awaiting_authorization",
+          loginUrl,
+          message: `Open this link to authorize: ${loginUrl}`,
+          deviceCode: code.deviceCode
         });
-        const hints = result.valid ? {
-          next: [
-            "Use flow_simulate to test event flow",
-            "Use flow_bundle to build"
-          ]
-        } : {
-          next: [
-            "Fix errors above, then run flow_validate again",
-            "Read walkeros://reference/flow-schema for correct structure"
-          ]
-        };
-        return mcpResult(result, hints);
-      } catch (error) {
-        return mcpError(
-          error,
-          "Check the input parameter \u2014 expected a JSON string, file path, or URL"
-        );
       }
+      case "logout": {
+        const deleted = client.deleteConfig();
+        const hadEnvToken = typeof process.env.WALKEROS_TOKEN === "string" && process.env.WALKEROS_TOKEN.length > 0;
+        delete process.env.WALKEROS_TOKEN;
+        let message;
+        if (deleted && hadEnvToken) {
+          message = "Logged out. Config removed and WALKEROS_TOKEN cleared from process environment.";
+        } else if (deleted) {
+          message = "Logged out and config removed.";
+        } else if (hadEnvToken) {
+          message = "No config found. WALKEROS_TOKEN cleared from process environment.";
+        } else {
+          message = "No config found, already logged out.";
+        }
+        return mcpResult({
+          loggedOut: true,
+          message
+        });
+      }
+      default:
+        throw new Error(
+          `Unknown action: ${action}. Use one of: status, login, logout`
+        );
     }
+  } catch (error) {
+    return mcpError(error);
+  }
+}
+function registerAuthTool(server, client) {
+  const spec = createAuthToolSpec(client);
+  server.registerTool(
+    spec.name,
+    {
+      title: spec.title,
+      description: spec.description,
+      inputSchema: spec.inputSchema,
+      annotations: spec.annotations
+    },
+    // SDK infers handler type from inputSchema shape; ToolSpec.handler is the
+    // type-erased (input: unknown) => Promise<unknown> form by design.
+    spec.handler
   );
 }
 
-// src/tools/bundle.ts
+// src/tools/project-manage.ts
 import { z as z2 } from "zod";
-import { bundle, bundleRemote } from "@walkeros/cli";
-import { schemas as schemas2 } from "@walkeros/cli/dev";
 import { mcpResult as mcpResult2, mcpError as mcpError2 } from "@walkeros/core";
-function registerFlowBundleTool(server2) {
-  server2.registerTool(
-    "flow_bundle",
-    {
-      title: "Bundle Flow",
-      description: "Bundle a walkerOS flow configuration into deployable JavaScript. Resolves all destinations, sources, and transformers, then outputs a tree-shaken production bundle. Returns bundle statistics. Set remote: true to use the walkerOS cloud service instead of local build tools.",
-      inputSchema: {
-        ...schemas2.BundleInputShape,
-        remote: z2.boolean().optional().describe(
-          "Use remote cloud bundling (requires authentication). Default: false (local)"
-        ),
-        content: z2.record(z2.string(), z2.unknown()).optional().describe("Flow.Config JSON content (required when remote: true)")
-      },
-      outputSchema: BundleOutputShape,
-      annotations: {
-        readOnlyHint: false,
-        destructiveHint: false,
-        idempotentHint: false,
-        openWorldHint: true
+
+// src/types.ts
+function isAuthError(error) {
+  if (!(error instanceof Error)) return false;
+  const msg = error.message.toLowerCase();
+  if (msg.includes("unauthorized") || msg.includes("forbidden") || msg.includes("invalid token") || msg.includes("token expired") || msg.includes("not authenticated")) {
+    return true;
+  }
+  const code = error.code;
+  if (!code) return false;
+  const upperCode = code.toUpperCase();
+  return upperCode === "UNAUTHORIZED" || upperCode === "FORBIDDEN" || upperCode === "401" || upperCode === "403" || upperCode.startsWith("AUTH_");
+}
+var AUTH_HINT = 'Are you logged in? Use auth(action: "status") to check.';
+
+// src/user-data.ts
+function wrapUserData(s) {
+  const alreadyWrapped = s.startsWith("<user_data>") && s.endsWith("</user_data>") && s.slice(11, -12).indexOf("</user_data>") === -1;
+  if (alreadyWrapped) return s;
+  const neutralised = s.replace(/<\/user_data>/g, "</user_data_>");
+  return `<user_data>${neutralised}</user_data>`;
+}
+function redactNestedStrings(value, opts) {
+  return walk(value, opts);
+}
+function walk(value, opts) {
+  if (typeof value === "string") return wrapUserData(value);
+  if (Array.isArray(value)) return value.map((v) => walk(v, opts));
+  if (value && typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      if (opts?.skip?.(k) && typeof v === "string") {
+        out[k] = v;
+      } else {
+        out[k] = walk(v, opts);
       }
-    },
-    async ({ configPath, flow, stats, output, remote, content }) => {
-      try {
-        if (remote) {
-          if (!content)
-            throw new Error("content is required when remote: true");
-          const result2 = await bundleRemote({
-            content,
-            flowName: flow
-          });
+    }
+    return out;
+  }
+  return value;
+}
+
+// src/tools/project-manage.ts
+function wrapProjectName(p) {
+  return p.name !== void 0 ? { ...p, name: wrapUserData(p.name) } : p;
+}
+var TITLE2 = "Project Management";
+var DESCRIPTION2 = "Manage walkerOS projects. List, create, update, delete projects, or set a default project for CLI operations.";
+var inputSchema2 = {
+  action: z2.enum(["list", "get", "create", "update", "delete", "set_default"]).describe("Project management action to perform"),
+  projectId: z2.string().optional().describe(
+    "Project ID. Required for get, update, delete, and set_default actions."
+  ),
+  name: z2.string().optional().describe(
+    "Project name. Required for create. Optional for update (to rename)."
+  )
+};
+var annotations2 = {
+  readOnlyHint: false,
+  destructiveHint: true,
+  idempotentHint: false,
+  openWorldHint: true
+};
+function createProjectManageToolSpec(client) {
+  return {
+    name: "project_manage",
+    title: TITLE2,
+    description: DESCRIPTION2,
+    inputSchema: inputSchema2,
+    annotations: annotations2,
+    handler: (input) => projectManageHandlerBody(client, input)
+  };
+}
+async function projectManageHandlerBody(client, input) {
+  const { action, projectId, name } = input ?? {};
+  try {
+    switch (action) {
+      case "list": {
+        const projects = await client.listProjects();
+        const items = Array.isArray(projects) ? projects : projects?.projects || [];
+        if (items.length === 0) {
           return mcpResult2(
-            { success: true, ...result2 },
+            { projects: [] },
             {
               next: [
-                "Use flow_simulate to test",
-                'Use deploy_manage with action "deploy" to publish'
+                'Use project_manage with action "create" to create your first project',
+                'Use project_manage with action "set_default" after creating to set it as default'
               ]
             }
           );
         }
-        const result = await bundle(configPath, {
-          flowName: flow,
-          stats: stats ?? true,
-          buildOverrides: output ? { output } : void 0
+        const typedItems = items;
+        const safe = Array.isArray(projects) ? typedItems.map(wrapProjectName) : { ...projects, projects: typedItems.map(wrapProjectName) };
+        return mcpResult2(safe);
+      }
+      case "get": {
+        if (!projectId) {
+          return mcpError2(
+            new Error(
+              'projectId is required for get action. Use action "list" to see available projects.'
+            )
+          );
+        }
+        const project = await client.getProject({ projectId });
+        return mcpResult2(wrapProjectName(project));
+      }
+      case "create": {
+        if (!name) {
+          return mcpError2(new Error("name is required for create action."));
+        }
+        const created = await client.createProject({ name });
+        return mcpResult2(wrapProjectName(created), {
+          next: [
+            'Use project_manage with action "set_default" to make this your active project'
+          ]
         });
-        if (!result) {
-          return mcpResult2(
-            { success: false, message: "Bundle produced no output" },
-            {
-              warnings: [
-                "The build returned no result. The flow may be empty or misconfigured."
-              ],
-              next: ["Run flow_validate to check your configuration"]
-            }
+      }
+      case "update": {
+        if (!projectId) {
+          return mcpError2(
+            new Error(
+              'projectId is required for update action. Use action "list" to see available projects.'
+            )
+          );
+        }
+        if (!name) {
+          return mcpError2(new Error("name is required for update action."));
+        }
+        const updated = await client.updateProject({ projectId, name });
+        return mcpResult2(wrapProjectName(updated));
+      }
+      case "delete": {
+        if (!projectId) {
+          return mcpError2(
+            new Error(
+              'projectId is required for delete action. Use action "list" to see available projects.'
+            )
+          );
+        }
+        const deleted = await client.deleteProject({ projectId });
+        return mcpResult2(deleted);
+      }
+      case "set_default": {
+        if (!projectId) {
+          return mcpError2(
+            new Error(
+              'projectId is required for set_default action. Use action "list" to see available projects.'
+            )
           );
         }
-        const output_ = result;
+        client.setDefaultProject(projectId);
         return mcpResult2(
-          { success: true, ...output_ },
+          { defaultProjectId: projectId },
           {
             next: [
-              "Use flow_simulate to test",
-              'Use deploy_manage with action "deploy" to publish'
+              'Use flow_manage with action "list" to see flows in this project'
             ]
           }
         );
-      } catch (error) {
-        return mcpError2(error, "Run flow_validate for detailed error messages");
       }
+      default:
+        throw new Error(
+          `Unknown action: ${action}. Use one of: list, get, create, update, delete, set_default`
+        );
     }
+  } catch (error) {
+    return mcpError2(error, isAuthError(error) ? AUTH_HINT : void 0);
+  }
+}
+function registerProjectManageTool(server, client) {
+  const spec = createProjectManageToolSpec(client);
+  server.registerTool(
+    spec.name,
+    {
+      title: spec.title,
+      description: spec.description,
+      inputSchema: spec.inputSchema,
+      annotations: spec.annotations
+    },
+    // SDK infers handler type from inputSchema shape; ToolSpec.handler is the
+    // type-erased (input: unknown) => Promise<unknown> form by design.
+    spec.handler
   );
 }
 
-// src/tools/simulate.ts
+// src/tools/flow-manage.ts
 import { z as z3 } from "zod";
-import {
-  simulateSource,
-  simulateTransformer,
-  simulateDestination
-} from "@walkeros/cli";
-import { schemas as schemas3 } from "@walkeros/cli/dev";
 import { mcpResult as mcpResult3, mcpError as mcpError3 } from "@walkeros/core";
-function registerFlowSimulateTool(server2) {
-  server2.registerTool(
-    "flow_simulate",
-    {
-      title: "Simulate Flow",
-      description: 'Simulate events through a walkerOS flow without making real API calls. For destinations: event is a walkerOS event { name: "entity action", data: {...} }. For sources: event is { content: ..., trigger?: { type?, options? }, env?: {...} }. Use step to target a specific step. Use flow_examples to discover available test data. IMPORTANT: Destinations with require (e.g. require: ["consent"]) stay pending until that collector event fires \u2014 simulation will error "not found" if require is not satisfied. Remove require from config or provide consent/user events before simulating. Separately, destinations with consent (e.g. consent: { marketing: true }) only receive events where the event includes matching consent. Mapping transforms event names and data at the destination level. Policy redacts or injects fields before mapping runs.',
-      inputSchema: {
-        configPath: schemas3.SimulateInputShape.configPath,
-        event: z3.union([z3.record(z3.string(), z3.unknown()), z3.string()]).optional().describe(
-          "For destinations: { name, data, consent? }. Include consent (e.g. { marketing: true }) to satisfy destination consent requirements. For sources: { content, trigger?, env? }. Can also be a JSON string or file path."
-        ),
-        flow: schemas3.SimulateInputShape.flow,
-        platform: schemas3.SimulateInputShape.platform,
-        step: schemas3.SimulateInputShape.step,
-        verbose: z3.boolean().optional().describe("Include full payload per destination (default: false)")
-      },
-      outputSchema: SimulateOutputShape,
-      annotations: {
-        readOnlyHint: true,
-        destructiveHint: false,
-        idempotentHint: true,
-        openWorldHint: false
+
+// src/ui-parts.ts
+function flowCanvasResult(payload) {
+  const structured = { kind: "flow-canvas", ...payload };
+  return {
+    content: [
+      {
+        type: "text",
+        text: JSON.stringify(structured, null, 2)
       }
-    },
-    async ({ configPath, event, flow, platform, step, verbose }) => {
-      try {
-        if (!event) {
-          throw new Error(
-            "event is required. For sources provide { content, trigger? }, for destinations provide { name, data }."
-          );
+    ],
+    structuredContent: structured
+  };
+}
+function isFlowCanvasResult(v) {
+  return typeof v === "object" && v !== null && v.kind === "flow-canvas";
+}
+
+// src/tools/flow-manage.ts
+function pickPlatform(content) {
+  if (content && typeof content === "object") {
+    const flows = content.flows;
+    if (flows && typeof flows === "object") {
+      for (const flow of Object.values(flows)) {
+        if (flow && typeof flow === "object") {
+          const config = flow.config;
+          if (config && typeof config === "object") {
+            const platform = config.platform;
+            if (platform === "web" || platform === "server") return platform;
+          }
         }
-        if (!step) {
-          throw new Error(
-            'step is required. Specify a target like "source.browser", "destination.gtag", or "transformer.demo".'
-          );
+      }
+    }
+  }
+  return "server";
+}
+var KEEP_LITERAL = /* @__PURE__ */ new Set([
+  "id",
+  "flowId",
+  "projectId",
+  "previewId",
+  "version",
+  "slug",
+  "createdAt",
+  "updatedAt",
+  "deletedAt"
+]);
+var keepLiteral = (key) => KEEP_LITERAL.has(key);
+function safeSummary(flow) {
+  return flow.name !== void 0 ? { ...flow, name: wrapUserData(flow.name) } : flow;
+}
+function safeDetail(flow) {
+  const withName = flow.name !== void 0 ? { ...flow, name: wrapUserData(flow.name) } : { ...flow };
+  if (flow.config !== void 0) {
+    withName.config = redactNestedStrings(
+      flow.config,
+      { skip: keepLiteral }
+    );
+  }
+  return withName;
+}
+var TITLE3 = "Flow Management";
+var DESCRIPTION3 = "Manage walkerOS flows and their previews. List/get/create/update/delete/duplicate flows, or create/inspect/delete preview bundles for testing flow changes on live sites.";
+var inputSchema3 = {
+  action: z3.enum([
+    "list",
+    "get",
+    "create",
+    "update",
+    "delete",
+    "duplicate",
+    "preview_list",
+    "preview_get",
+    "preview_create",
+    "preview_delete"
+  ]).describe("Flow management action to perform"),
+  flowId: z3.string().optional().describe(
+    "Flow ID (flow_...) or config ID (cfg_...). Required for get, update, delete, duplicate."
+  ),
+  projectId: z3.string().optional().describe(
+    "Project ID. Optional filter for list (omit to list all projects). Required for create if no default project set."
+  ),
+  name: z3.string().optional().describe(
+    "Flow name. Required for create. Optional for update (to rename) and duplicate."
+  ),
+  content: z3.record(z3.string(), z3.unknown()).optional().describe("Flow.Json content. Used for create and update."),
+  patch: z3.boolean().optional().describe(
+    "Merge-patch for update (default true). When true, only provided fields are updated."
+  ),
+  fields: z3.array(z3.string()).optional().describe("Dot-path selectors for get to return only specific fields."),
+  sort: z3.enum(["name", "updated_at", "created_at"]).optional().describe("Sort field for list."),
+  order: z3.enum(["asc", "desc"]).optional().describe("Sort order for list."),
+  includeDeleted: z3.boolean().optional().describe("Include soft-deleted flows in list results."),
+  previewId: z3.string().optional().describe(
+    "Preview ID (prv_...). Required for preview_get and preview_delete."
+  ),
+  flowName: z3.string().optional().describe(
+    "Flow settings name. Used by preview_create as an alternative to flowSettingsId."
+  ),
+  flowSettingsId: z3.string().optional().describe(
+    "Flow settings ID. Used by preview_create as an alternative to flowName."
+  ),
+  siteUrl: z3.string().optional().describe(
+    "Optional site URL for preview_create. When provided, the response includes full activationUrl and deactivationUrl the user can click."
+  )
+};
+var annotations3 = {
+  readOnlyHint: false,
+  destructiveHint: true,
+  idempotentHint: false,
+  openWorldHint: true
+};
+function createFlowManageToolSpec(client) {
+  return {
+    name: "flow_manage",
+    title: TITLE3,
+    description: DESCRIPTION3,
+    inputSchema: inputSchema3,
+    annotations: annotations3,
+    handler: (input) => flowManageHandlerBody(client, input)
+  };
+}
+async function flowManageHandlerBody(client, input) {
+  const {
+    action,
+    flowId,
+    projectId,
+    name,
+    content,
+    patch,
+    fields,
+    sort,
+    order,
+    includeDeleted,
+    previewId,
+    flowName,
+    flowSettingsId,
+    siteUrl
+  } = input ?? {};
+  try {
+    switch (action) {
+      case "list": {
+        if (projectId) {
+          const data2 = await client.listFlows({
+            projectId,
+            sort,
+            order,
+            includeDeleted
+          });
+          const dataObj = data2;
+          const flows = dataObj.flows;
+          const safe2 = Array.isArray(flows) ? { ...dataObj, flows: flows.map(safeSummary) } : data2;
+          return mcpResult3(safe2);
         }
-        let resolvedEvent = event;
-        if (typeof event === "string") {
-          try {
-            resolvedEvent = JSON.parse(event);
-          } catch {
-            throw new Error(
-              "Event string must be valid JSON. Got: " + event.substring(0, 50)
-            );
+        const data = await client.listAllFlows({
+          sort,
+          order,
+          includeDeleted
+        });
+        const safe = Array.isArray(data) ? data.map(safeSummary) : data;
+        return mcpResult3(
+          { projects: safe },
+          {
+            next: [
+              'Use flow_manage with action "get" and a flowId to inspect a specific flow',
+              "Use flow_load to open a flow for editing"
+            ]
           }
-        }
-        const dotIndex = step.indexOf(".");
-        if (dotIndex === -1) {
-          throw new Error(
-            `Invalid step format "${step}". Use "type.name" (e.g. "source.browser", "destination.gtag").`
+        );
+      }
+      case "get": {
+        if (!flowId) {
+          return mcpError3(
+            new Error(
+              'flowId is required for get action. Use action "list" to see available flows.'
+            )
           );
         }
-        const stepType = step.substring(0, dotIndex);
-        const stepId = step.substring(dotIndex + 1);
-        let result;
-        switch (stepType) {
-          case "source":
-            result = await simulateSource(configPath, resolvedEvent, {
-              sourceId: stepId,
-              flow,
-              silent: true
-            });
-            break;
-          case "transformer":
-            result = await simulateTransformer(
-              configPath,
-              resolvedEvent,
-              {
-                transformerId: stepId,
-                flow,
-                silent: true
-              }
-            );
-            break;
-          case "destination":
-            result = await simulateDestination(
-              configPath,
-              resolvedEvent,
-              {
-                destinationId: stepId,
-                flow,
-                silent: true
-              }
-            );
-            break;
-          default:
-            throw new Error(
-              `Unknown step type "${stepType}". Use "source", "transformer", or "destination".`
-            );
+        const flow = await client.getFlow({ flowId, projectId, fields });
+        const safe = safeDetail(
+          flow
+        );
+        return flowCanvasResult({
+          flowId: safe.id,
+          configName: safe.name ?? "default",
+          platform: pickPlatform(safe.config),
+          flowConfig: safe.config ?? {},
+          suggestions: [
+            {
+              label: "Validate this flow",
+              prompt: `Validate flow ${safe.id}`,
+              autoSend: true
+            },
+            {
+              label: "Add a destination",
+              prompt: `Help me add a destination to flow ${safe.id}`
+            }
+          ]
+        });
+      }
+      case "create": {
+        if (!name) {
+          return mcpError3(new Error("name is required for create action."));
         }
-        if (result.captured && result.captured.length > 0) {
-          const eventCount = result.captured.length;
-          const summary2 = `Source captured ${eventCount} event${eventCount !== 1 ? "s" : ""}`;
-          return mcpResult3(
+        const created = await client.createFlow({
+          name,
+          content: content ?? {},
+          projectId
+        });
+        const safeCreated = safeDetail(
+          created
+        );
+        return flowCanvasResult({
+          flowId: safeCreated.id,
+          configName: safeCreated.name ?? "default",
+          platform: pickPlatform(safeCreated.config),
+          flowConfig: safeCreated.config ?? {},
+          suggestions: [
             {
-              success: result.success,
-              error: result.error,
-              summary: summary2,
-              capturedEvents: result.captured,
-              duration: result.duration
+              label: "Validate this flow",
+              prompt: `Validate flow ${safeCreated.id}`,
+              autoSend: true
             },
             {
-              next: eventCount > 0 ? [
-                "Use flow_simulate with a destination step to test downstream processing"
-              ] : [
-                "Check source package examples with package_get, verify trigger type matches"
-              ]
+              label: "Deploy it",
+              prompt: `Deploy flow ${safeCreated.id}`
             }
+          ]
+        });
+      }
+      case "update": {
+        if (!flowId) {
+          return mcpError3(
+            new Error(
+              'flowId is required for update action. Use action "list" to see available flows.'
+            )
           );
         }
-        const destinations = {};
-        if (result.elbResult && typeof result.elbResult === "object" && "done" in result.elbResult && result.elbResult.done) {
-          const done = result.elbResult.done;
-          for (const name of Object.keys(done)) {
-            destinations[name] = { received: true, calls: 0 };
-          }
-        }
-        if (result.usage) {
-          for (const [name, calls] of Object.entries(result.usage)) {
-            const summary2 = {
-              received: calls.length > 0,
-              calls: calls.length
-            };
-            if (verbose && calls.length > 0) {
-              summary2.payload = calls;
+        const updated = await client.updateFlow({
+          flowId,
+          projectId,
+          name,
+          content,
+          mergePatch: patch ?? true
+        });
+        const safeUpdated = safeDetail(
+          updated
+        );
+        return flowCanvasResult({
+          flowId: safeUpdated.id,
+          configName: safeUpdated.name ?? "default",
+          platform: pickPlatform(safeUpdated.config),
+          flowConfig: safeUpdated.config ?? {},
+          suggestions: [
+            {
+              label: "Validate this flow",
+              prompt: `Validate flow ${safeUpdated.id}`,
+              autoSend: true
+            },
+            {
+              label: "Deploy it",
+              prompt: `Deploy flow ${safeUpdated.id}`
             }
-            destinations[name] = summary2;
-          }
+          ]
+        });
+      }
+      case "delete": {
+        if (!flowId) {
+          return mcpError3(
+            new Error(
+              'flowId is required for delete action. Use action "list" to see available flows.'
+            )
+          );
         }
-        const destCount = Object.keys(destinations).length;
-        const receivedCount = Object.values(destinations).filter(
-          (d) => d.received
-        ).length;
-        const warnings = [];
-        if (stepType === "destination" && destCount === 0) {
-          warnings.push(
-            'Destination did not receive the event. Common causes: (1) destination config has consent: { marketing: true } but event lacks matching consent, (2) mapping rules do not match the event name, (3) policy redacted required fields. Add consent to the event: { name: "...", data: {...}, consent: { marketing: true } }.'
+        const deleted = await client.deleteFlow({ flowId, projectId });
+        return mcpResult3(deleted);
+      }
+      case "duplicate": {
+        if (!flowId) {
+          return mcpError3(
+            new Error(
+              'flowId is required for duplicate action. Use action "list" to see available flows.'
+            )
           );
         }
-        const summary = stepType === "transformer" ? `Transformer processed event` : `${receivedCount}/${destCount} destinations received the event`;
-        const resultObj = {
-          success: result.success,
-          error: result.error,
-          summary,
-          destinations: destCount > 0 ? destinations : void 0,
-          duration: result.duration
-        };
-        return mcpResult3(resultObj, {
-          next: ["Use flow_bundle to build for production"],
-          ...warnings.length > 0 ? { warnings } : {}
+        const duplicated = await client.duplicateFlow({
+          flowId,
+          name,
+          projectId
         });
-      } catch (error) {
-        const msg = error instanceof Error ? error.message : "";
-        let hint = "Run flow_validate for detailed error messages";
-        if (msg.includes("not found in collector")) {
-          hint = 'If this destination has require: ["consent"] or require: ["user"], it stays pending until that event fires. For simulation, either remove require from the config or simulate with a flow that omits require on the target destination.';
-        }
-        return mcpError3(error, hint);
+        return mcpResult3(
+          safeDetail(duplicated)
+        );
       }
-    }
-  );
-}
-
-// src/tools/push.ts
-import { z as z4 } from "zod";
-import { push } from "@walkeros/cli";
-import { schemas as schemas4 } from "@walkeros/cli/dev";
-import { mcpResult as mcpResult4, mcpError as mcpError4 } from "@walkeros/core";
-function registerFlowPushTool(server2) {
-  server2.registerTool(
-    "flow_push",
-    {
-      title: "Push Events",
-      description: "Push a real event through a walkerOS flow to actual destinations. Makes real API calls to real endpoints. Best suited for server-side flows \u2014 web flows should use flow_simulate for testing.",
-      inputSchema: {
-        configPath: schemas4.PushInputShape.configPath,
-        event: z4.record(z4.string(), z4.unknown()).describe(
-          'Event object, e.g. { name: "page view", data: { title: "Home" } }'
-        ),
-        flow: schemas4.PushInputShape.flow,
-        platform: schemas4.PushInputShape.platform
-      },
-      outputSchema: PushOutputShape,
-      annotations: {
-        readOnlyHint: false,
-        destructiveHint: true,
-        idempotentHint: false,
-        openWorldHint: true
+      case "preview_list": {
+        if (!flowId) {
+          return mcpError3(
+            new Error(
+              'flowId is required for preview_list. Use action "list" to see available flows.'
+            )
+          );
+        }
+        const data = await client.listPreviews({ projectId, flowId });
+        return mcpResult3(data);
       }
-    },
-    async ({ configPath, event, flow, platform }) => {
-      try {
-        const result = await push(configPath, event, {
-          json: true,
-          flow,
-          platform
-        });
-        if (!result.success) {
-          return mcpError4(
-            new Error(result.error || "Push failed"),
-            "Check destination configuration and connectivity."
+      case "preview_get": {
+        if (!flowId || !previewId) {
+          return mcpError3(
+            new Error("flowId and previewId are required for preview_get.")
           );
         }
-        return mcpResult4(result);
-      } catch (error) {
-        return mcpError4(
-          error,
-          "Check configPath and event format. For web flows, use flow_simulate."
-        );
+        const data = await client.getPreview({
+          projectId,
+          flowId,
+          previewId
+        });
+        return mcpResult3(data);
       }
-    }
-  );
-}
-
-// src/tools/examples.ts
-import { z as z5 } from "zod";
-import { loadJsonConfig } from "@walkeros/cli";
-import { mcpResult as mcpResult5, mcpError as mcpError5 } from "@walkeros/core";
-function registerFlowExamplesTool(server2) {
-  server2.registerTool(
-    "flow_examples",
-    {
-      title: "Flow Examples",
-      description: "List all step examples in a walkerOS flow configuration. Shows example names, step locations, and in/out shapes. Use this to discover available test fixtures and simulation data.",
-      inputSchema: {
-        configPath: z5.string().min(1).describe(
-          "Path to flow configuration file, URL, or inline JSON string"
-        ),
-        flow: z5.string().optional().describe("Flow name for multi-flow configs"),
-        step: z5.string().optional().describe('Filter to a specific step (e.g., "destination.gtag")'),
-        full: z5.boolean().optional().describe(
-          "Return full in/out/mapping data for each example (default: false, returns metadata only)"
-        ),
-        includeHidden: z5.boolean().optional().describe(
-          "Include examples marked public: false (default: false). Set true for test/debug discovery."
-        )
-      },
-      outputSchema: ExamplesListOutputShape,
-      annotations: {
-        readOnlyHint: true,
-        destructiveHint: false,
-        idempotentHint: true,
-        openWorldHint: false
-      }
-    },
-    async ({ configPath, flow, step, full, includeHidden }) => {
-      try {
-        const rawConfig = await loadJsonConfig(configPath);
-        const flowNames = Object.keys(rawConfig.flows || {});
-        const flowName = flow || (flowNames.length === 1 ? flowNames[0] : void 0);
-        if (!flowName) {
-          throw new Error(
-            `Multiple flows found. Specify flow parameter. Available: ${flowNames.join(", ")}`
-          );
-        }
-        const flowSettings = rawConfig.flows[flowName];
-        if (!flowSettings) {
-          throw new Error(`Flow "${flowName}" not found`);
+      case "preview_create": {
+        if (!flowId) {
+          return mcpError3(new Error("flowId is required for preview_create."));
         }
-        const examples = [];
-        const stepTypes = [
-          { key: "sources", type: "source" },
-          { key: "transformers", type: "transformer" },
-          { key: "destinations", type: "destination" }
-        ];
-        for (const { key, type } of stepTypes) {
-          const refs = flowSettings[key] || {};
-          for (const [name, ref] of Object.entries(refs)) {
-            if (!ref.examples) continue;
-            if (step && `${type}.${name}` !== step) continue;
-            for (const [exName, ex] of Object.entries(
-              ref.examples
-            )) {
-              if (!includeHidden && ex.public === false) continue;
-              examples.push({
-                step: `${type}.${name}`,
-                stepType: type,
-                stepName: name,
-                exampleName: exName,
-                title: ex.title,
-                description: ex.description,
-                public: ex.public,
-                hasIn: ex.in !== void 0,
-                hasOut: ex.out !== void 0,
-                hasMapping: ex.mapping !== void 0,
-                hasTrigger: ex.trigger !== void 0,
-                ...full ? {
-                  in: ex.in,
-                  out: ex.out,
-                  mapping: ex.mapping,
-                  trigger: ex.trigger
-                } : {}
-              });
-            }
-          }
+        if (!flowName && !flowSettingsId) {
+          return mcpError3(
+            new Error(
+              "flowName or flowSettingsId is required for preview_create."
+            )
+          );
         }
-        const result = {
-          flow: flowName,
-          count: examples.length,
-          examples
-        };
-        const hints = {
-          next: ["Use flow_simulate with step and event to simulate"]
+        const preview = await client.createPreview({
+          projectId,
+          flowId,
+          flowName,
+          flowSettingsId
+        });
+        const typedPreview = preview;
+        const enriched = {
+          ...typedPreview,
+          activationParam: typedPreview.activationUrl
         };
-        if (examples.length === 0) {
-          hints.warnings = [
-            "No examples found. Add examples to step definitions in your flow config for testing."
-          ];
+        if (siteUrl) {
+          const on = new URL(siteUrl);
+          on.searchParams.set("elbPreview", typedPreview.token);
+          enriched.activationUrl = on.toString();
+          const off = new URL(siteUrl);
+          off.searchParams.set("elbPreview", "off");
+          enriched.deactivationUrl = off.toString();
+        } else {
+          delete enriched.activationUrl;
         }
-        return mcpResult5(result, hints);
-      } catch (error) {
-        return mcpError5(error, "Check configPath \u2014 expected a flow.json file");
+        return mcpResult3(enriched, {
+          next: siteUrl ? [
+            "Open activationUrl to activate preview mode; open deactivationUrl to exit."
+          ] : [
+            "Append activationParam to any URL on your site to activate preview mode."
+          ]
+        });
+      }
+      case "preview_delete": {
+        if (!flowId || !previewId) {
+          return mcpError3(
+            new Error("flowId and previewId are required for preview_delete.")
+          );
+        }
+        const data = await client.deletePreview({
+          projectId,
+          flowId,
+          previewId
+        });
+        return mcpResult3(data);
       }
+      default:
+        throw new Error(
+          `Unknown action: ${action}. Use one of: list, get, create, update, delete, duplicate, preview_list, preview_get, preview_create, preview_delete`
+        );
     }
+  } catch (error) {
+    return mcpError3(error, isAuthError(error) ? AUTH_HINT : void 0);
+  }
+}
+function registerFlowManageTool(server, client) {
+  const spec = createFlowManageToolSpec(client);
+  server.registerTool(
+    spec.name,
+    {
+      title: spec.title,
+      description: spec.description,
+      inputSchema: spec.inputSchema,
+      annotations: spec.annotations
+    },
+    // SDK infers handler type from inputSchema shape; ToolSpec.handler is the
+    // type-erased (input: unknown) => Promise<unknown> form by design.
+    spec.handler
   );
 }
 
-// src/tools/package.ts
-import { z as z6 } from "zod";
-import { fetchPackage, mcpResult as mcpResult6, mcpError as mcpError6 } from "@walkeros/core";
-import { mergeConfigSchema } from "@walkeros/core/dev";
+// src/tools/deploy-manage.ts
+import { z as z4 } from "zod";
+import { mcpResult as mcpResult4, mcpError as mcpError4 } from "@walkeros/core";
 
-// src/catalog.ts
-var NPM_SEARCH_URL = "https://registry.npmjs.org/-/v1/search";
-var JSDELIVR_BASE = "https://cdn.jsdelivr.net/npm";
-var WALKEROS_JSON_PATH = "dist/walkerOS.json";
-var CACHE_TTL = 5 * 60 * 1e3;
-var cache;
-function normalizePlatform(platform) {
-  if (platform == null) return [];
-  if (typeof platform === "string") {
-    return platform === "universal" ? ["web", "server"] : [platform];
-  }
-  if (Array.isArray(platform)) {
-    return platform.filter((v) => typeof v === "string");
-  }
-  return [];
-}
-async function fetchCatalog(filters) {
-  if (cache && Date.now() - cache.timestamp < CACHE_TTL) {
-    return applyFilters(cache.entries, filters);
+// src/tools/_resolvers.ts
+var DeploymentNotFoundError = class extends Error {
+  code = "NOT_FOUND";
+  constructor(message) {
+    super(message);
+    this.name = "DeploymentNotFoundError";
   }
-  let entries;
-  try {
-    entries = filters?.baseUrl ? await fetchCatalogFrom(filters.baseUrl, filters) : await fetchFromNpm();
-  } catch {
-    try {
-      entries = await fetchFromNpm();
-    } catch {
-      return [];
-    }
+};
+var MultipleDeploymentsError = class extends Error {
+  code = "MULTIPLE_DEPLOYMENTS";
+  details;
+  constructor(message, details) {
+    super(message);
+    this.name = "MultipleDeploymentsError";
+    this.details = details;
   }
-  cache = { entries, timestamp: Date.now() };
-  return applyFilters(entries, filters);
-}
-async function fetchCatalogFrom(baseUrl, filters) {
-  const params = new URLSearchParams();
-  if (filters?.type) params.set("type", filters.type);
-  if (filters?.platform) params.set("platform", filters.platform);
-  const url = `${baseUrl}/api/packages${params.toString() ? `?${params}` : ""}`;
-  const res = await fetch(url, { signal: AbortSignal.timeout(15e3) });
-  if (!res.ok) throw new Error(`Catalog fetch failed: ${res.status}`);
-  const data = await res.json();
-  return data.catalog;
-}
-async function fetchFromNpm() {
-  const res = await fetch(`${NPM_SEARCH_URL}?text=@walkeros/&size=250`, {
-    signal: AbortSignal.timeout(1e4)
+};
+async function resolveDeploymentSlug(args) {
+  const matches = await args.list({
+    projectId: args.projectId,
+    flowId: args.flowId
   });
-  if (!res.ok) throw new Error(`npm search failed: ${res.status}`);
-  const data = await res.json();
-  const metaResults = await Promise.allSettled(
-    data.objects.map((obj) => enrichWithMeta(obj.package))
-  );
-  return metaResults.filter(
-    (r) => r.status === "fulfilled"
-  ).map((r) => r.value).filter((entry) => entry !== void 0);
-}
-async function enrichWithMeta(pkg) {
-  try {
-    const res = await fetch(
-      `${JSDELIVR_BASE}/${pkg.name}@${pkg.version}/${WALKEROS_JSON_PATH}`,
-      { signal: AbortSignal.timeout(5e3) }
+  if (matches.length === 0) {
+    throw new DeploymentNotFoundError(
+      `No deployments found for flow ${args.flowId}`
     );
-    if (!res.ok) return void 0;
-    const json = await res.json();
-    const meta = json.$meta;
-    if (!meta || typeof meta.type !== "string") return void 0;
-    return {
-      name: pkg.name,
-      version: pkg.version,
-      description: pkg.description,
-      type: meta.type,
-      platform: normalizePlatform(meta.platform)
-    };
-  } catch {
-    return void 0;
   }
-}
-function applyFilters(entries, filters) {
-  let results = entries;
-  if (filters?.type) {
-    results = results.filter((e) => e.type === filters.type);
+  if (args.slug !== void 0) {
+    const hit = matches.find((m) => m.slug === args.slug);
+    if (!hit) {
+      throw new DeploymentNotFoundError(
+        `No deployment with slug ${args.slug} in flow ${args.flowId}`
+      );
+    }
+    return hit.slug;
   }
-  if (filters?.platform) {
-    results = results.filter(
-      (e) => e.platform.length === 0 || e.platform.includes(filters.platform)
-    );
+  if (matches.length === 1) {
+    return matches[0].slug;
   }
-  return results;
+  throw new MultipleDeploymentsError(
+    `Flow ${args.flowId} has ${matches.length} active deployments; pass slug to disambiguate`,
+    matches.map((m) => ({
+      slug: m.slug,
+      type: m.type,
+      status: m.status,
+      updatedAt: m.updatedAt
+    }))
+  );
 }
 
-// src/tools/package.ts
-function registerPackageSearchTool(server2) {
-  server2.registerTool(
-    "package_search",
-    {
-      title: "Search Package",
-      description: "Start here for package discovery. Never guess package names \u2014 use this tool first to find exact names. Without package name: returns catalog filtered by type/platform. With package name: returns metadata, hint keys, and example summaries.",
-      inputSchema: {
-        package: z6.string().min(1).optional().describe(
-          "Exact npm package name for detailed lookup (e.g., @walkeros/web-destination-snowplow)"
-        ),
-        type: z6.enum(["source", "destination", "transformer", "store"]).optional().describe("Filter by package type (browse mode)"),
-        platform: z6.enum(["web", "server"]).optional().describe(
-          "Filter by platform (browse mode, includes universal packages)"
-        ),
-        version: z6.string().optional().describe("Package version for detailed lookup (default: latest)")
-      },
-      // No outputSchema: browse mode returns {catalog, count}, lookup returns metadata — incompatible shapes
-      annotations: {
-        readOnlyHint: true,
-        destructiveHint: false,
-        idempotentHint: true,
-        openWorldHint: false
-      }
-    },
-    async ({ package: packageName, type, platform, version }) => {
-      const baseUrl = process.env.APP_URL || void 0;
-      if (!packageName) {
-        const catalog = await fetchCatalog({ type, platform, baseUrl });
-        const result = { catalog, count: catalog.length };
-        return mcpResult6(result, {
-          next: ["Use package_get for schemas and examples"]
+// src/tools/deploy-manage.ts
+var TITLE4 = "Deploy Management";
+var DESCRIPTION4 = "Deploy walkerOS flows and manage deployments. For get/delete actions pass flowId (required) plus optional slug to disambiguate when a flow has multiple active deployments. If a flow has >=2 active deployments and no slug is supplied, the tool returns a MULTIPLE_DEPLOYMENTS error with a details[] list showing each deployment's slug, type, status, and updatedAt.";
+var inputSchema4 = {
+  action: z4.enum(["deploy", "list", "get", "delete"]).describe("Deployment action to perform"),
+  projectId: z4.string().optional().describe("Project ID. Optional; falls back to the default project."),
+  flowId: z4.string().optional().describe(
+    "Flow ID. Required for: deploy, get, delete. Optional filter for list."
+  ),
+  slug: z4.string().optional().describe(
+    "Deployment slug. Optional disambiguator for get/delete when the flow has multiple active deployments."
+  ),
+  type: z4.enum(["web", "server"]).optional().describe("Deployment type filter for list."),
+  status: z4.string().optional().describe("Status filter for list."),
+  wait: z4.boolean().optional().describe(
+    "Wait for deploy to complete (default true). Only used with deploy action."
+  ),
+  flowName: z4.string().optional().describe(
+    "Flow name for multi-settings flows. Only used with deploy action."
+  )
+};
+var annotations4 = {
+  readOnlyHint: false,
+  destructiveHint: true,
+  idempotentHint: false,
+  openWorldHint: true
+};
+function listForResolver(client, projectId) {
+  return async (q) => {
+    const resp = await client.listDeployments({
+      projectId: projectId || q.projectId || void 0,
+      flowId: q.flowId
+    });
+    return resp.deployments ?? [];
+  };
+}
+function createDeployManageToolSpec(client) {
+  return {
+    name: "deploy_manage",
+    title: TITLE4,
+    description: DESCRIPTION4,
+    inputSchema: inputSchema4,
+    annotations: annotations4,
+    handler: (input) => deployManageHandlerBody(client, input)
+  };
+}
+async function deployManageHandlerBody(client, input) {
+  const { action, projectId, flowId, slug, type, status, wait, flowName } = input ?? {};
+  try {
+    switch (action) {
+      case "deploy": {
+        if (!flowId) {
+          return mcpError4(
+            new Error(
+              'flowId is required for deploy action. Use flow_manage with action "list" to see available flows.'
+            )
+          );
+        }
+        const result = await client.deploy({
+          flowId,
+          wait: wait ?? true,
+          flowName
         });
-      }
-      try {
-        const info = await fetchPackage(packageName, { version, baseUrl });
-        const result = {
-          package: info.packageName,
-          version: info.version,
-          description: info.description,
-          type: info.type,
-          platform: normalizePlatform(info.platform),
-          hintKeys: info.hintKeys,
-          exampleSummaries: info.exampleSummaries
-        };
-        return mcpResult6(result, {
-          next: ["Use package_get for schemas and examples"]
+        return mcpResult4(result, {
+          next: [
+            'Use deploy_manage with action "get" to check deployment status'
+          ]
         });
-      } catch (error) {
-        return mcpError6(
-          error,
-          "Package not found. Use package_search without parameters to browse available packages."
-        );
       }
-    }
-  );
-}
-function registerGetPackageSchemaTool(server2) {
-  server2.registerTool(
-    "package_get",
-    {
-      title: "Get Package",
-      description: 'Requires exact package name \u2014 do not guess names, use package_search first to find them. Returns schemas + hint texts + example summaries by default (lightweight). Use section parameter for full content: "hints" (with code blocks), "examples" (full in/out data), or "all".',
-      inputSchema: {
-        package: z6.string().min(1).describe(
-          "Exact npm package name (e.g., @walkeros/web-destination-snowplow)"
-        ),
-        version: z6.string().optional().describe("Package version (default: latest)"),
-        section: z6.enum(["hints", "examples", "all"]).optional().describe(
-          "Section to expand with full content. Default: summary view with schemas + hint texts + example descriptions"
-        )
-      },
-      // No outputSchema — removed to avoid SDK -32602 crashes on unexpected field values
-      annotations: {
-        readOnlyHint: true,
-        destructiveHint: false,
-        idempotentHint: true,
-        openWorldHint: true
+      case "list": {
+        const data = await client.listDeployments({
+          projectId,
+          flowId,
+          type,
+          status
+        });
+        return mcpResult4(data);
       }
-    },
-    async ({ package: packageName, version, section }) => {
-      const baseUrl = process.env.APP_URL || void 0;
-      try {
-        const info = await fetchPackage(packageName, { version, baseUrl });
-        const mergedSchemas = {};
-        if (info.type) {
-          mergedSchemas.config = mergeConfigSchema(
-            info.type,
-            info.schemas
+      case "get": {
+        if (!flowId) {
+          return mcpError4(
+            new Error(
+              'flowId is required for get action. Use flow_manage with action "list" to see available flows.'
+            )
           );
         }
-        for (const [key, value] of Object.entries(info.schemas)) {
-          if (key !== "settings") {
-            mergedSchemas[key] = value;
-          }
-        }
-        const result = {
-          package: info.packageName,
-          version: info.version,
-          type: info.type,
-          platform: normalizePlatform(info.platform),
-          schemas: mergedSchemas
-        };
-        if (info.hints) {
-          if (section === "hints" || section === "all") {
-            result.hints = info.hints;
-          } else {
-            const hintSummary = {};
-            for (const [key, hint] of Object.entries(info.hints)) {
-              const h = hint;
-              hintSummary[key] = { text: h.text };
-            }
-            result.hints = hintSummary;
-          }
-        }
-        if (section === "examples" || section === "all") {
-          result.examples = info.examples;
-        } else {
-          result.exampleSummaries = info.exampleSummaries;
-        }
-        return mcpResult6(result);
-      } catch (error) {
-        return mcpError6(
-          error,
-          "Use package_search to browse available package names."
-        );
-      }
-    }
-  );
-}
-
-// src/tools/flow-load.ts
-import { z as z7 } from "zod";
-import { loadJsonConfig as loadJsonConfig2 } from "@walkeros/cli";
-import { mcpResult as mcpResult7, mcpError as mcpError7 } from "@walkeros/core";
-var WEB_SKELETON = {
-  version: 3,
-  flows: {
-    default: {
-      web: {},
-      packages: {},
-      sources: {},
-      destinations: {}
-    }
-  }
-};
-var SERVER_SKELETON = {
-  version: 3,
-  flows: {
-    default: {
-      server: {},
-      packages: {},
-      sources: {},
-      destinations: {}
-    }
-  }
-};
-function registerFlowLoadTool(server2) {
-  server2.registerTool(
-    "flow_load",
-    {
-      title: "Load or Create Flow",
-      description: "Load an existing flow configuration from a local file path, URL, or walkerOS API (by flow ID). Or create a new empty flow by specifying a platform (web or server). Use the add-step prompt to add sources, destinations, transformers, or stores to the flow.",
-      inputSchema: {
-        source: z7.string().optional().describe(
-          "Flow source: local file path (./flow.json), URL (https://...), inline JSON string, or API flow ID (cfg_...). Omit to create a new flow."
-        ),
-        platform: z7.enum(["web", "server"]).optional().describe(
-          "Platform for new flows. Required when source is omitted. web = browser tracking, server = Node.js HTTP."
-        )
-      },
-      outputSchema: {
-        version: z7.number().describe("Flow config version"),
-        flows: z7.record(z7.string(), z7.unknown()).describe("Flow definitions")
-      },
-      annotations: {
-        readOnlyHint: true,
-        destructiveHint: false,
-        idempotentHint: true,
-        openWorldHint: true
+        const resolvedSlug = await resolveDeploymentSlug({
+          projectId: projectId ?? "",
+          flowId,
+          slug,
+          list: listForResolver(client, projectId)
+        });
+        const data = await client.getDeploymentBySlug({
+          slug: resolvedSlug,
+          projectId
+        });
+        return mcpResult4(data);
       }
-    },
-    async ({ source, platform }) => {
-      try {
-        if (source) {
-          const config = await loadJsonConfig2(source);
-          return mcpResult7(config, {
-            next: [
-              "Use flow_validate to check",
-              "Use add-step prompt to modify"
-            ]
-          });
-        }
-        if (!platform) {
-          return mcpError7(
+      case "delete": {
+        if (!flowId) {
+          return mcpError4(
             new Error(
-              "Provide source (file path, URL, or flow ID) to load existing flow, or platform (web/server) to create a new one."
+              'flowId is required for delete action. Use flow_manage with action "list" to see available flows.'
             )
           );
         }
-        const skeleton = platform === "web" ? WEB_SKELETON : SERVER_SKELETON;
-        return mcpResult7(skeleton, {
-          next: [
-            "Read walkeros://reference/flow-schema for config structure",
-            "Use add-step prompt to add sources and destinations"
-          ]
+        const resolvedSlug = await resolveDeploymentSlug({
+          projectId: projectId ?? "",
+          flowId,
+          slug,
+          list: listForResolver(client, projectId)
+        });
+        const data = await client.deleteDeployment({
+          slug: resolvedSlug,
+          projectId
+        });
+        return mcpResult4({
+          deleted: true,
+          ...data
         });
-      } catch (error) {
-        const msg = error instanceof Error ? error.message : "";
-        if (msg.includes("not found") || msg.includes("ENOENT"))
-          return mcpError7(
-            error,
-            "Check configPath \u2014 expected a flow.json file"
-          );
-        return mcpError7(error);
       }
+      default:
+        throw new Error(
+          `Unknown action: ${action}. Use one of: deploy, list, get, delete`
+        );
     }
+  } catch (error) {
+    return mcpError4(error, isAuthError(error) ? AUTH_HINT : void 0);
+  }
+}
+function registerDeployTool(server, client) {
+  const spec = createDeployManageToolSpec(client);
+  server.registerTool(
+    spec.name,
+    {
+      title: spec.title,
+      description: spec.description,
+      inputSchema: spec.inputSchema,
+      annotations: spec.annotations
+    },
+    // SDK infers handler type from inputSchema shape; ToolSpec.handler is the
+    // type-erased (input: unknown) => Promise<unknown> form by design.
+    spec.handler
   );
 }
 
 // src/tools/feedback.ts
-import { z as z8 } from "zod";
-import {
-  feedback,
-  getFeedbackPreference,
-  setFeedbackPreference
-} from "@walkeros/cli";
-import { mcpResult as mcpResult8, mcpError as mcpError8 } from "@walkeros/core";
-function registerFeedbackTool(server2) {
-  server2.registerTool(
-    "feedback",
-    {
-      title: "Send Feedback",
-      description: "Send feedback about walkerOS",
-      inputSchema: {
-        text: z8.string().describe("Your feedback text"),
-        anonymous: z8.boolean().optional().describe(
-          "Include user/project info? false = include, true = anonymous. Only needed on first call if not yet configured."
-        )
-      },
-      annotations: {
-        readOnlyHint: false,
-        destructiveHint: false,
-        idempotentHint: false,
-        openWorldHint: true
-      }
-    },
-    async (params) => {
-      try {
-        const { text, anonymous: explicitAnonymous } = params;
-        let anonymous = getFeedbackPreference();
-        if (anonymous === void 0 && explicitAnonymous === void 0) {
-          return mcpResult8(
-            { needsConsent: true },
-            {
-              next: [
-                "Ask the user if they want to include their info",
-                "Call feedback again with anonymous: true or false"
-              ]
-            }
-          );
-        }
-        if (anonymous === void 0 && explicitAnonymous !== void 0) {
-          anonymous = explicitAnonymous;
-          setFeedbackPreference(anonymous);
+import { z as z5 } from "zod";
+import { mcpResult as mcpResult5, mcpError as mcpError5 } from "@walkeros/core";
+var TITLE5 = "Send Feedback";
+var DESCRIPTION5 = "Send feedback about walkerOS";
+var inputSchema5 = {
+  text: z5.string().describe("Your feedback text"),
+  anonymous: z5.boolean().optional().describe(
+    "Include user/project info? false = include, true = anonymous. Only needed on first call if not yet configured."
+  )
+};
+var annotations5 = {
+  readOnlyHint: false,
+  destructiveHint: false,
+  idempotentHint: false,
+  openWorldHint: true
+};
+function createFeedbackToolSpec(client) {
+  return {
+    name: "feedback",
+    title: TITLE5,
+    description: DESCRIPTION5,
+    inputSchema: inputSchema5,
+    annotations: annotations5,
+    handler: (input) => feedbackHandlerBody(client, input)
+  };
+}
+async function feedbackHandlerBody(client, input) {
+  const { text, anonymous: explicitAnonymous } = input ?? {};
+  try {
+    let anonymous = client.getFeedbackPreference();
+    if (anonymous === void 0 && explicitAnonymous === void 0) {
+      return mcpResult5(
+        { needsConsent: true },
+        {
+          next: [
+            "Ask the user if they want to include their info",
+            "Call feedback again with anonymous: true or false"
+          ]
         }
-        const isAnonymous = explicitAnonymous ?? anonymous ?? true;
-        await feedback(text, { anonymous: isAnonymous, version: "3.4.2" });
-        return mcpResult8({ ok: true });
-      } catch (error) {
-        return mcpError8(error);
-      }
+      );
+    }
+    if (anonymous === void 0 && explicitAnonymous !== void 0) {
+      anonymous = explicitAnonymous;
+      client.setFeedbackPreference(anonymous);
     }
+    const isAnonymous = explicitAnonymous ?? anonymous ?? true;
+    await client.submitFeedback(text, {
+      anonymous: isAnonymous,
+      version: "4.0.0-next-1777463920154"
+    });
+    return mcpResult5({ ok: true });
+  } catch (error) {
+    return mcpError5(error);
+  }
+}
+function registerFeedbackTool(server, client) {
+  const spec = createFeedbackToolSpec(client);
+  server.registerTool(
+    spec.name,
+    {
+      title: spec.title,
+      description: spec.description,
+      inputSchema: spec.inputSchema,
+      annotations: spec.annotations
+    },
+    // SDK infers handler type from inputSchema shape; ToolSpec.handler is the
+    // type-erased (input: unknown) => Promise<unknown> form by design.
+    spec.handler
   );
 }
 
-// src/tools/auth.ts
-import { z as z9 } from "zod";
-import {
-  resolveToken,
-  deleteConfig,
-  requestDeviceCode,
-  pollForToken,
-  whoami
-} from "@walkeros/cli";
-import { mcpResult as mcpResult9, mcpError as mcpError9 } from "@walkeros/core";
-function registerAuthTool(server2) {
-  server2.registerTool(
-    "auth",
+// src/tools/validate.ts
+import { validate } from "@walkeros/cli";
+import { schemas } from "@walkeros/cli/dev";
+import { mcpResult as mcpResult6, mcpError as mcpError6 } from "@walkeros/core";
+
+// src/schemas/output.ts
+import { z as z6 } from "zod";
+var ValidateOutputShape = {
+  valid: z6.boolean().describe("Whether validation passed"),
+  type: z6.union([
+    z6.enum(["contract", "entry", "event", "flow", "mapping"]),
+    z6.string().regex(/^(destinations|sources|transformers)\.\w+$/)
+  ]).describe("What was validated"),
+  errors: z6.array(
+    z6.object({
+      path: z6.string(),
+      message: z6.string(),
+      value: z6.unknown().optional(),
+      code: z6.string().optional()
+    })
+  ).describe("Validation errors"),
+  warnings: z6.array(
+    z6.object({
+      path: z6.string(),
+      message: z6.string(),
+      suggestion: z6.string().optional()
+    })
+  ).describe("Validation warnings"),
+  details: z6.record(z6.string(), z6.unknown()).describe("Additional validation details")
+};
+var BundleOutputShape = {
+  success: z6.boolean().describe("Whether bundling succeeded"),
+  totalSize: z6.number().optional().describe("Total bundle size in bytes"),
+  buildTime: z6.number().optional().describe("Build time in milliseconds"),
+  packages: z6.array(
+    z6.object({
+      name: z6.string(),
+      size: z6.number()
+    })
+  ).optional().describe("Per-package size breakdown"),
+  treeshakingEffective: z6.boolean().optional().describe("Whether tree-shaking was effective"),
+  message: z6.string().optional().describe("Status message")
+};
+var SimulateOutputShape = {
+  success: z6.boolean().describe("Whether simulation succeeded"),
+  error: z6.string().optional().describe("Error message if failed"),
+  summary: z6.string().describe("One-line result summary"),
+  destinations: z6.record(
+    z6.string(),
+    z6.object({
+      received: z6.boolean().describe("Whether destination received the event"),
+      calls: z6.number().describe("Number of API calls made"),
+      payload: z6.unknown().optional().describe("All intercepted API calls (only when verbose: true)")
+    })
+  ).optional().describe("Per-destination results"),
+  capturedEvents: z6.array(z6.record(z6.string(), z6.unknown())).optional().describe("Events captured by source simulation"),
+  duration: z6.number().optional().describe("Simulation duration in ms")
+};
+var PushOutputShape = {
+  success: z6.boolean().describe("Whether push succeeded"),
+  elbResult: z6.unknown().optional().describe("Push result from the collector"),
+  duration: z6.number().describe("Push duration in milliseconds"),
+  error: z6.string().optional().describe("Error message if push failed")
+};
+var ExamplesListOutputShape = {
+  flow: z6.string().describe("Flow name"),
+  count: z6.number().describe("Number of examples found"),
+  examples: z6.array(
+    z6.object({
+      step: z6.string().describe('Step location (e.g., "destination.gtag")'),
+      stepType: z6.enum(["source", "transformer", "destination"]).describe("Step type"),
+      stepName: z6.string().describe("Step name"),
+      exampleName: z6.string().describe("Example name"),
+      title: z6.string().optional().describe("Human-readable title if set"),
+      description: z6.string().optional().describe("Short human-readable description"),
+      public: z6.boolean().optional().describe(
+        "Whether the example is public (defaults to true if omitted)"
+      ),
+      hasIn: z6.boolean().describe("Whether the example has an input value"),
+      hasOut: z6.boolean().describe("Whether the example has an output value"),
+      hasMapping: z6.boolean().describe("Whether the example has a mapping configuration"),
+      hasTrigger: z6.boolean().describe("Whether the example has trigger metadata"),
+      in: z6.unknown().optional().describe("Input event data"),
+      out: z6.unknown().optional().describe("Expected output data"),
+      mapping: z6.unknown().optional().describe("Mapping configuration for destinations"),
+      trigger: z6.object({
+        type: z6.string().optional(),
+        options: z6.unknown().optional()
+      }).optional().describe("Trigger metadata for source simulation")
+    })
+  ).describe("Step examples")
+};
+
+// src/tools/validate.ts
+function wrapIssueMessages(result) {
+  return {
+    ...result,
+    errors: result.errors.map((e) => ({
+      ...e,
+      message: wrapUserData(e.message)
+    })),
+    warnings: result.warnings.map((w) => ({
+      ...w,
+      message: wrapUserData(w.message)
+    }))
+  };
+}
+var TITLE6 = "Validate Flow";
+var DESCRIPTION6 = "Validate walkerOS events, flow configurations, mapping rules, or data contracts. Accepts JSON strings, file paths, or URLs as input. Returns validation results with errors, warnings, and details.";
+var inputSchema6 = schemas.ValidateInputShape;
+var annotations6 = {
+  readOnlyHint: true,
+  destructiveHint: false,
+  idempotentHint: true,
+  openWorldHint: false
+};
+function createFlowValidateToolSpec() {
+  return {
+    name: "flow_validate",
+    title: TITLE6,
+    description: DESCRIPTION6,
+    inputSchema: inputSchema6,
+    annotations: annotations6,
+    handler: (input) => flowValidateHandlerBody(input)
+  };
+}
+async function flowValidateHandlerBody(input) {
+  const {
+    type,
+    input: validateInput,
+    flow,
+    path
+  } = input ?? {};
+  try {
+    const result = await validate(type, validateInput, {
+      flow,
+      path
+    });
+    const hints = result.valid ? {
+      next: [
+        "Use flow_simulate to test event flow",
+        "Use flow_bundle to build"
+      ]
+    } : {
+      next: [
+        "Fix errors above, then run flow_validate again",
+        "Read walkeros://reference/flow-schema for correct structure"
+      ]
+    };
+    return mcpResult6(wrapIssueMessages(result), hints);
+  } catch (error) {
+    return mcpError6(
+      error,
+      "Check the input parameter \u2014 expected a JSON string, file path, or URL"
+    );
+  }
+}
+function registerFlowValidateTool(server) {
+  const spec = createFlowValidateToolSpec();
+  server.registerTool(
+    spec.name,
     {
-      title: "Authentication",
-      description: "Manage walkerOS authentication. Check login status, log in via device code flow, or log out. No terminal or browser required \u2014 the MCP client handles the authorization URL.",
-      inputSchema: {
-        action: z9.enum(["status", "login", "logout"]).describe("Authentication action to perform"),
-        deviceCode: z9.string().optional().describe(
-          "Device code from a previous pending login attempt. Provide to resume polling without requesting a new code."
-        )
-      },
-      // No outputSchema: action-dispatched tool — each action returns a different shape
-      annotations: {
-        readOnlyHint: false,
-        destructiveHint: true,
-        idempotentHint: false,
-        openWorldHint: true
+      title: spec.title,
+      description: spec.description,
+      inputSchema: spec.inputSchema,
+      // outputSchema is wire-only; not part of ToolSpec
+      outputSchema: ValidateOutputShape,
+      annotations: spec.annotations
+    },
+    // SDK infers handler type from inputSchema shape; ToolSpec.handler is the
+    // type-erased (input: unknown) => Promise<unknown> form by design.
+    spec.handler
+  );
+}
+
+// src/tools/bundle.ts
+import { bundle } from "@walkeros/cli";
+import { schemas as schemas2 } from "@walkeros/cli/dev";
+import { mcpResult as mcpResult7, mcpError as mcpError7 } from "@walkeros/core";
+var TITLE7 = "Bundle Flow";
+var DESCRIPTION7 = "Bundle a walkerOS flow configuration into deployable JavaScript. Resolves all destinations, sources, and transformers, then outputs a tree-shaken production bundle. Returns bundle statistics.";
+var inputSchema7 = {
+  ...schemas2.BundleInputShape
+};
+var annotations7 = {
+  readOnlyHint: false,
+  destructiveHint: false,
+  idempotentHint: false,
+  openWorldHint: true
+};
+function createFlowBundleToolSpec() {
+  return {
+    name: "flow_bundle",
+    title: TITLE7,
+    description: DESCRIPTION7,
+    inputSchema: inputSchema7,
+    annotations: annotations7,
+    handler: (input) => flowBundleHandlerBody(input)
+  };
+}
+async function flowBundleHandlerBody(input) {
+  const { configPath, flow, stats, output } = input ?? {};
+  try {
+    const result = await bundle(configPath, {
+      flowName: flow,
+      stats: stats ?? true,
+      buildOverrides: output ? { output } : void 0
+    });
+    if (!result) {
+      return mcpResult7(
+        { success: false, message: "Bundle produced no output" },
+        {
+          warnings: [
+            "The build returned no result. The flow may be empty or misconfigured."
+          ],
+          next: ["Run flow_validate to check your configuration"]
+        }
+      );
+    }
+    const output_ = result;
+    return mcpResult7(
+      { success: true, ...output_ },
+      {
+        next: [
+          "Use flow_simulate to test",
+          'Use deploy_manage with action "deploy" to publish'
+        ]
       }
+    );
+  } catch (error) {
+    return mcpError7(error, "Run flow_validate for detailed error messages");
+  }
+}
+function registerFlowBundleTool(server) {
+  const spec = createFlowBundleToolSpec();
+  server.registerTool(
+    spec.name,
+    {
+      title: spec.title,
+      description: spec.description,
+      inputSchema: spec.inputSchema,
+      // outputSchema is wire-only; not part of ToolSpec
+      outputSchema: BundleOutputShape,
+      annotations: spec.annotations
     },
-    async ({ action, deviceCode }) => {
+    // SDK infers handler type from inputSchema shape; ToolSpec.handler is the
+    // type-erased (input: unknown) => Promise<unknown> form by design.
+    spec.handler
+  );
+}
+
+// src/tools/simulate.ts
+import { z as z7 } from "zod";
+import {
+  simulateSource,
+  simulateTransformer,
+  simulateDestination
+} from "@walkeros/cli";
+import { schemas as schemas3 } from "@walkeros/cli/dev";
+import { mcpResult as mcpResult8, mcpError as mcpError8 } from "@walkeros/core";
+var TITLE8 = "Simulate Flow";
+var DESCRIPTION8 = 'Simulate events through a walkerOS flow without making real API calls. For destinations: event is a walkerOS event { name: "entity action", data: {...} }. For sources: event is { content: ..., trigger?: { type?, options? }, env?: {...} }. Use step to target a specific step. Use flow_examples to discover available test data. IMPORTANT: Destinations with require (e.g. require: ["consent"]) stay pending until that collector event fires \u2014 simulation will error "not found" if require is not satisfied. Remove require from config or provide consent/user events before simulating. Separately, destinations with consent (e.g. consent: { marketing: true }) only receive events where the event includes matching consent. Mapping transforms event names and data at the destination level. Policy redacts or injects fields before mapping runs.';
+var inputSchema8 = {
+  configPath: schemas3.SimulateInputShape.configPath,
+  event: z7.union([z7.record(z7.string(), z7.unknown()), z7.string()]).optional().describe(
+    "For destinations: { name, data, consent? }. Include consent (e.g. { marketing: true }) to satisfy destination consent requirements. For sources: { content, trigger?, env? }. Can also be a JSON string or file path."
+  ),
+  flow: schemas3.SimulateInputShape.flow,
+  platform: schemas3.SimulateInputShape.platform,
+  step: schemas3.SimulateInputShape.step,
+  verbose: z7.boolean().optional().describe("Include full payload per destination (default: false)")
+};
+var annotations8 = {
+  readOnlyHint: true,
+  destructiveHint: false,
+  idempotentHint: true,
+  openWorldHint: false
+};
+function createFlowSimulateToolSpec() {
+  return {
+    name: "flow_simulate",
+    title: TITLE8,
+    description: DESCRIPTION8,
+    inputSchema: inputSchema8,
+    annotations: annotations8,
+    handler: (input) => flowSimulateHandlerBody(input)
+  };
+}
+async function flowSimulateHandlerBody(input) {
+  const { configPath, event, flow, platform, step, verbose } = input ?? {};
+  try {
+    if (!event) {
+      throw new Error(
+        "event is required. For sources provide { content, trigger? }, for destinations provide { name, data }."
+      );
+    }
+    if (!step) {
+      throw new Error(
+        'step is required. Specify a target like "source.browser", "destination.gtag", or "transformer.demo".'
+      );
+    }
+    let resolvedEvent = event;
+    if (typeof event === "string") {
       try {
-        switch (action) {
-          case "status": {
-            const resolved = resolveToken();
-            if (!resolved) {
-              return mcpResult9(
-                { authenticated: false },
-                { next: ['Use auth with action "login" to authenticate'] }
-              );
-            }
-            const user = await whoami();
-            return mcpResult9({ authenticated: true, ...user });
-          }
-          case "login": {
-            if (deviceCode) {
-              const pollResult = await pollForToken(deviceCode, {
-                timeoutMs: 6e4
-              });
-              if (pollResult.success) {
-                return mcpResult9(
-                  { authenticated: true, email: pollResult.email },
-                  {
-                    next: [
-                      'Use project_manage with action "list" to see your projects'
-                    ]
-                  }
-                );
-              }
-              if (pollResult.status === "pending") {
-                return mcpResult9({
-                  authenticated: false,
-                  status: "pending",
-                  message: "Still waiting for authorization. Try again shortly.",
-                  deviceCode
-                });
-              }
-              return mcpError9(
-                new Error(pollResult.error || "Authorization failed")
-              );
-            }
-            const code = await requestDeviceCode();
-            const loginUrl = code.verificationUriComplete || code.verificationUri;
-            return mcpResult9({
-              authenticated: false,
-              status: "awaiting_authorization",
-              loginUrl,
-              message: `Open this link to authorize: ${loginUrl}`,
-              deviceCode: code.deviceCode
-            });
+        resolvedEvent = JSON.parse(event);
+      } catch {
+        throw new Error(
+          "Event string must be valid JSON. Got: " + event.substring(0, 50)
+        );
+      }
+    }
+    const dotIndex = step.indexOf(".");
+    if (dotIndex === -1) {
+      throw new Error(
+        `Invalid step format "${step}". Use "type.name" (e.g. "source.browser", "destination.gtag").`
+      );
+    }
+    const stepType = step.substring(0, dotIndex);
+    const stepId = step.substring(dotIndex + 1);
+    let result;
+    switch (stepType) {
+      case "source":
+        result = await simulateSource(configPath, resolvedEvent, {
+          sourceId: stepId,
+          flow,
+          silent: true
+        });
+        break;
+      case "transformer":
+        result = await simulateTransformer(
+          configPath,
+          resolvedEvent,
+          {
+            transformerId: stepId,
+            flow,
+            silent: true
           }
-          case "logout": {
-            const deleted = deleteConfig();
-            const hadEnvToken = typeof process.env.WALKEROS_TOKEN === "string" && process.env.WALKEROS_TOKEN.length > 0;
-            delete process.env.WALKEROS_TOKEN;
-            let message;
-            if (deleted && hadEnvToken) {
-              message = "Logged out. Config removed and WALKEROS_TOKEN cleared from process environment.";
-            } else if (deleted) {
-              message = "Logged out and config removed.";
-            } else if (hadEnvToken) {
-              message = "No config found. WALKEROS_TOKEN cleared from process environment.";
-            } else {
-              message = "No config found \u2014 already logged out.";
-            }
-            return mcpResult9({
-              loggedOut: true,
-              message
-            });
+        );
+        break;
+      case "destination":
+        result = await simulateDestination(
+          configPath,
+          resolvedEvent,
+          {
+            destinationId: stepId,
+            flow,
+            silent: true
           }
-          default:
-            throw new Error(
-              `Unknown action: ${action}. Use one of: status, login, logout`
-            );
+        );
+        break;
+      default:
+        throw new Error(
+          `Unknown step type "${stepType}". Use "source", "transformer", or "destination".`
+        );
+    }
+    if (result.captured && result.captured.length > 0) {
+      const eventCount = result.captured.length;
+      const summary2 = `Source captured ${eventCount} event${eventCount !== 1 ? "s" : ""}`;
+      return mcpResult8(
+        {
+          success: result.success,
+          error: result.error,
+          summary: summary2,
+          capturedEvents: result.captured,
+          duration: result.duration
+        },
+        {
+          next: eventCount > 0 ? [
+            "Use flow_simulate with a destination step to test downstream processing"
+          ] : [
+            "Check source package examples with package_get, verify trigger type matches"
+          ]
+        }
+      );
+    }
+    const destinations = {};
+    if (result.elbResult && typeof result.elbResult === "object" && "done" in result.elbResult && result.elbResult.done) {
+      const done = result.elbResult.done;
+      for (const name of Object.keys(done)) {
+        destinations[name] = { received: true, calls: 0 };
+      }
+    }
+    if (result.usage) {
+      for (const [name, calls] of Object.entries(result.usage)) {
+        const summary2 = {
+          received: calls.length > 0,
+          calls: calls.length
+        };
+        if (verbose && calls.length > 0) {
+          summary2.payload = calls;
         }
-      } catch (error) {
-        return mcpError9(error);
+        destinations[name] = summary2;
       }
     }
+    const destCount = Object.keys(destinations).length;
+    const receivedCount = Object.values(destinations).filter(
+      (d) => d.received
+    ).length;
+    const warnings = [];
+    if (stepType === "destination" && destCount === 0) {
+      warnings.push(
+        'Destination did not receive the event. Common causes: (1) destination config has consent: { marketing: true } but event lacks matching consent, (2) mapping rules do not match the event name, (3) policy redacted required fields. Add consent to the event: { name: "...", data: {...}, consent: { marketing: true } }.'
+      );
+    }
+    const summary = stepType === "transformer" ? `Transformer processed event` : `${receivedCount}/${destCount} destinations received the event`;
+    const resultObj = {
+      success: result.success,
+      error: result.error,
+      summary,
+      destinations: destCount > 0 ? destinations : void 0,
+      duration: result.duration
+    };
+    return mcpResult8(resultObj, {
+      next: ["Use flow_bundle to build for production"],
+      ...warnings.length > 0 ? { warnings } : {}
+    });
+  } catch (error) {
+    const msg = error instanceof Error ? error.message : "";
+    let hint = "Run flow_validate for detailed error messages";
+    if (msg.includes("not found in collector")) {
+      hint = 'If this destination has require: ["consent"] or require: ["user"], it stays pending until that event fires. For simulation, either remove require from the config or simulate with a flow that omits require on the target destination.';
+    }
+    return mcpError8(error, hint);
+  }
+}
+function registerFlowSimulateTool(server) {
+  const spec = createFlowSimulateToolSpec();
+  server.registerTool(
+    spec.name,
+    {
+      title: spec.title,
+      description: spec.description,
+      inputSchema: spec.inputSchema,
+      // outputSchema is wire-only; not part of ToolSpec
+      outputSchema: SimulateOutputShape,
+      annotations: spec.annotations
+    },
+    // SDK infers handler type from inputSchema shape; ToolSpec.handler is the
+    // type-erased (input: unknown) => Promise<unknown> form by design.
+    spec.handler
   );
 }
 
-// src/tools/project-manage.ts
-import { z as z10 } from "zod";
-import {
-  listProjects,
-  getProject,
-  createProject,
-  updateProject,
-  deleteProject,
-  setDefaultProject
-} from "@walkeros/cli";
-import { mcpResult as mcpResult10, mcpError as mcpError10 } from "@walkeros/core";
-
-// src/types.ts
-function isAuthError(error) {
-  if (!(error instanceof Error)) return false;
-  const msg = error.message.toLowerCase();
-  if (msg.includes("unauthorized") || msg.includes("forbidden") || msg.includes("invalid token") || msg.includes("token expired") || msg.includes("not authenticated")) {
-    return true;
+// src/tools/push.ts
+import { z as z8 } from "zod";
+import { push } from "@walkeros/cli";
+import { schemas as schemas4 } from "@walkeros/cli/dev";
+import { mcpResult as mcpResult9, mcpError as mcpError9 } from "@walkeros/core";
+var TITLE9 = "Push Events";
+var DESCRIPTION9 = "Push a real event through a walkerOS flow to actual destinations. Makes real API calls to real endpoints. Best suited for server-side flows \u2014 web flows should use flow_simulate for testing.";
+var inputSchema9 = {
+  configPath: schemas4.PushInputShape.configPath,
+  event: z8.record(z8.string(), z8.unknown()).describe(
+    'Event object, e.g. { name: "page view", data: { title: "Home" } }'
+  ),
+  flow: schemas4.PushInputShape.flow,
+  platform: schemas4.PushInputShape.platform
+};
+var annotations9 = {
+  readOnlyHint: false,
+  destructiveHint: true,
+  idempotentHint: false,
+  openWorldHint: true
+};
+function createFlowPushToolSpec() {
+  return {
+    name: "flow_push",
+    title: TITLE9,
+    description: DESCRIPTION9,
+    inputSchema: inputSchema9,
+    annotations: annotations9,
+    handler: (input) => flowPushHandlerBody(input)
+  };
+}
+async function flowPushHandlerBody(input) {
+  const { configPath, event, flow, platform } = input ?? {};
+  try {
+    const result = await push(configPath, event, {
+      json: true,
+      flow,
+      platform
+    });
+    if (!result.success) {
+      return mcpError9(
+        new Error(result.error || "Push failed"),
+        "Check destination configuration and connectivity."
+      );
+    }
+    return mcpResult9(result);
+  } catch (error) {
+    return mcpError9(
+      error,
+      "Check configPath and event format. For web flows, use flow_simulate."
+    );
   }
-  const code = error.code;
-  if (!code) return false;
-  const upperCode = code.toUpperCase();
-  return upperCode === "UNAUTHORIZED" || upperCode === "FORBIDDEN" || upperCode === "401" || upperCode === "403" || upperCode.startsWith("AUTH_");
 }
-var AUTH_HINT = 'Are you logged in? Use auth(action: "status") to check.';
-
-// src/tools/project-manage.ts
-function registerProjectManageTool(server2) {
-  server2.registerTool(
-    "project_manage",
+function registerFlowPushTool(server) {
+  const spec = createFlowPushToolSpec();
+  server.registerTool(
+    spec.name,
     {
-      title: "Project Management",
-      description: "Manage walkerOS projects. List, create, update, delete projects, or set a default project for CLI operations.",
-      inputSchema: {
-        action: z10.enum(["list", "get", "create", "update", "delete", "set_default"]).describe("Project management action to perform"),
-        projectId: z10.string().optional().describe(
-          "Project ID. Required for get, update, delete, and set_default actions."
-        ),
-        name: z10.string().optional().describe(
-          "Project name. Required for create. Optional for update (to rename)."
-        )
-      },
-      // No outputSchema: action-dispatched tool — each action returns a different shape
-      annotations: {
-        readOnlyHint: false,
-        destructiveHint: true,
-        idempotentHint: false,
-        openWorldHint: true
-      }
+      title: spec.title,
+      description: spec.description,
+      inputSchema: spec.inputSchema,
+      // outputSchema is wire-only; not part of ToolSpec
+      outputSchema: PushOutputShape,
+      annotations: spec.annotations
     },
-    async ({ action, projectId, name }) => {
-      try {
-        switch (action) {
-          case "list": {
-            const projects = await listProjects();
-            const items = Array.isArray(projects) ? projects : projects?.projects || [];
-            if (items.length === 0) {
-              return mcpResult10(
-                { projects: [] },
-                {
-                  next: [
-                    'Use project_manage with action "create" to create your first project',
-                    'Use project_manage with action "set_default" after creating to set it as default'
-                  ]
-                }
-              );
-            }
-            return mcpResult10(projects);
-          }
-          case "get": {
-            if (!projectId) {
-              return mcpError10(
-                new Error(
-                  'projectId is required for get action. Use action "list" to see available projects.'
-                )
-              );
-            }
-            const project = await getProject({ projectId });
-            return mcpResult10(project);
-          }
-          case "create": {
-            if (!name) {
-              return mcpError10(new Error("name is required for create action."));
-            }
-            const created = await createProject({ name });
-            return mcpResult10(created, {
-              next: [
-                'Use project_manage with action "set_default" to make this your active project'
-              ]
-            });
-          }
-          case "update": {
-            if (!projectId) {
-              return mcpError10(
-                new Error(
-                  'projectId is required for update action. Use action "list" to see available projects.'
-                )
-              );
-            }
-            if (!name) {
-              return mcpError10(new Error("name is required for update action."));
-            }
-            const updated = await updateProject({ projectId, name });
-            return mcpResult10(updated);
-          }
-          case "delete": {
-            if (!projectId) {
-              return mcpError10(
-                new Error(
-                  'projectId is required for delete action. Use action "list" to see available projects.'
-                )
-              );
-            }
-            const deleted = await deleteProject({ projectId });
-            return mcpResult10(deleted);
-          }
-          case "set_default": {
-            if (!projectId) {
-              return mcpError10(
-                new Error(
-                  'projectId is required for set_default action. Use action "list" to see available projects.'
-                )
-              );
-            }
-            setDefaultProject(projectId);
-            return mcpResult10(
-              { defaultProjectId: projectId },
-              {
-                next: [
-                  'Use flow_manage with action "list" to see flows in this project'
-                ]
-              }
-            );
-          }
-          default:
-            throw new Error(
-              `Unknown action: ${action}. Use one of: list, get, create, update, delete, set_default`
-            );
+    // SDK infers handler type from inputSchema shape; ToolSpec.handler is the
+    // type-erased (input: unknown) => Promise<unknown> form by design.
+    spec.handler
+  );
+}
+
+// src/tools/examples.ts
+import { z as z9 } from "zod";
+import { loadJsonConfig } from "@walkeros/cli";
+import { mcpResult as mcpResult10, mcpError as mcpError10 } from "@walkeros/core";
+var TITLE10 = "Flow Examples";
+var DESCRIPTION10 = "List all step examples in a walkerOS flow configuration. Shows example names, step locations, and in/out shapes. Use this to discover available test fixtures and simulation data.";
+var inputSchema10 = {
+  configPath: z9.string().min(1).describe("Path to flow configuration file, URL, or inline JSON string"),
+  flow: z9.string().optional().describe("Flow name for multi-flow configs"),
+  step: z9.string().optional().describe('Filter to a specific step (e.g., "destination.gtag")'),
+  full: z9.boolean().optional().describe(
+    "Return full in/out/mapping data for each example (default: false, returns metadata only)"
+  ),
+  includeHidden: z9.boolean().optional().describe(
+    "Include examples marked public: false (default: false). Set true for test/debug discovery."
+  )
+};
+var annotations10 = {
+  readOnlyHint: true,
+  destructiveHint: false,
+  idempotentHint: true,
+  openWorldHint: false
+};
+function createFlowExamplesToolSpec() {
+  return {
+    name: "flow_examples",
+    title: TITLE10,
+    description: DESCRIPTION10,
+    inputSchema: inputSchema10,
+    annotations: annotations10,
+    handler: (input) => flowExamplesHandlerBody(input)
+  };
+}
+async function flowExamplesHandlerBody(input) {
+  const { configPath, flow, step, full, includeHidden } = input ?? {};
+  try {
+    const rawConfig = await loadJsonConfig(configPath);
+    const flowNames = Object.keys(rawConfig.flows || {});
+    const flowName = flow || (flowNames.length === 1 ? flowNames[0] : void 0);
+    if (!flowName) {
+      throw new Error(
+        `Multiple flows found. Specify flow parameter. Available: ${flowNames.join(", ")}`
+      );
+    }
+    const flowSettings = rawConfig.flows[flowName];
+    if (!flowSettings) {
+      throw new Error(`Flow "${flowName}" not found`);
+    }
+    const examples = [];
+    const stepTypes = [
+      { key: "sources", type: "source" },
+      { key: "transformers", type: "transformer" },
+      { key: "destinations", type: "destination" }
+    ];
+    for (const { key, type } of stepTypes) {
+      const refs = flowSettings[key] || {};
+      for (const [name, ref] of Object.entries(refs)) {
+        if (!ref.examples) continue;
+        if (step && `${type}.${name}` !== step) continue;
+        for (const [exName, ex] of Object.entries(
+          ref.examples
+        )) {
+          if (!includeHidden && ex.public === false) continue;
+          examples.push({
+            step: `${type}.${name}`,
+            stepType: type,
+            stepName: name,
+            exampleName: exName,
+            title: ex.title,
+            description: ex.description,
+            public: ex.public,
+            hasIn: ex.in !== void 0,
+            hasOut: ex.out !== void 0,
+            hasMapping: ex.mapping !== void 0,
+            hasTrigger: ex.trigger !== void 0,
+            ...full ? {
+              in: ex.in,
+              out: ex.out,
+              mapping: ex.mapping,
+              trigger: ex.trigger
+            } : {}
+          });
         }
-      } catch (error) {
-        return mcpError10(error, isAuthError(error) ? AUTH_HINT : void 0);
       }
     }
+    const result = {
+      flow: flowName,
+      count: examples.length,
+      examples
+    };
+    const hints = {
+      next: ["Use flow_simulate with step and event to simulate"]
+    };
+    if (examples.length === 0) {
+      hints.warnings = [
+        "No examples found. Add examples to step definitions in your flow config for testing."
+      ];
+    }
+    return mcpResult10(result, hints);
+  } catch (error) {
+    return mcpError10(error, "Check configPath \u2014 expected a flow.json file");
+  }
+}
+function registerFlowExamplesTool(server) {
+  const spec = createFlowExamplesToolSpec();
+  server.registerTool(
+    spec.name,
+    {
+      title: spec.title,
+      description: spec.description,
+      inputSchema: spec.inputSchema,
+      // outputSchema is wire-only; not part of ToolSpec
+      outputSchema: ExamplesListOutputShape,
+      annotations: spec.annotations
+    },
+    // SDK infers handler type from inputSchema shape; ToolSpec.handler is the
+    // type-erased (input: unknown) => Promise<unknown> form by design.
+    spec.handler
   );
 }
 
-// src/tools/flow-manage.ts
-import { z as z11 } from "zod";
-import {
-  listAllFlows,
-  listFlows,
-  getFlow,
-  createFlow,
-  updateFlow,
-  deleteFlow,
-  duplicateFlow,
-  listPreviews,
-  getPreview,
-  createPreview,
-  deletePreview
-} from "@walkeros/cli";
+// src/tools/flow-load.ts
+import { z as z10 } from "zod";
+import { loadJsonConfig as loadJsonConfig2 } from "@walkeros/cli";
 import { mcpResult as mcpResult11, mcpError as mcpError11 } from "@walkeros/core";
-function registerFlowManageTool(server2) {
-  server2.registerTool(
-    "flow_manage",
-    {
-      title: "Flow Management",
-      description: "Manage walkerOS flows and their previews. List/get/create/update/delete/duplicate flows, or create/inspect/delete preview bundles for testing flow changes on live sites.",
-      inputSchema: {
-        action: z11.enum([
-          "list",
-          "get",
-          "create",
-          "update",
-          "delete",
-          "duplicate",
-          "preview_list",
-          "preview_get",
-          "preview_create",
-          "preview_delete"
-        ]).describe("Flow management action to perform"),
-        flowId: z11.string().optional().describe(
-          "Flow ID (flow_...) or config ID (cfg_...). Required for get, update, delete, duplicate."
-        ),
-        projectId: z11.string().optional().describe(
-          "Project ID. Optional filter for list (omit to list all projects). Required for create if no default project set."
-        ),
-        name: z11.string().optional().describe(
-          "Flow name. Required for create. Optional for update (to rename) and duplicate."
-        ),
-        content: z11.record(z11.string(), z11.unknown()).optional().describe("Flow.Config JSON content. Used for create and update."),
-        patch: z11.boolean().optional().describe(
-          "Merge-patch for update (default true). When true, only provided fields are updated."
-        ),
-        fields: z11.array(z11.string()).optional().describe(
-          "Dot-path selectors for get to return only specific fields."
-        ),
-        sort: z11.enum(["name", "updated_at", "created_at"]).optional().describe("Sort field for list."),
-        order: z11.enum(["asc", "desc"]).optional().describe("Sort order for list."),
-        includeDeleted: z11.boolean().optional().describe("Include soft-deleted flows in list results."),
-        previewId: z11.string().optional().describe(
-          "Preview ID (prv_...). Required for preview_get and preview_delete."
-        ),
-        flowName: z11.string().optional().describe(
-          "Flow settings name. Used by preview_create as an alternative to flowSettingsId."
-        ),
-        flowSettingsId: z11.string().optional().describe(
-          "Flow settings ID. Used by preview_create as an alternative to flowName."
-        ),
-        siteUrl: z11.string().optional().describe(
-          "Optional site URL for preview_create. When provided, the response includes full activationUrl and deactivationUrl the user can click."
+var KEEP_LITERAL2 = /* @__PURE__ */ new Set([
+  "id",
+  "flowId",
+  "projectId",
+  "version",
+  "slug",
+  "createdAt",
+  "updatedAt",
+  "deletedAt"
+]);
+var keepLiteral2 = (key) => KEEP_LITERAL2.has(key);
+var WEB_SKELETON = {
+  version: 4,
+  flows: {
+    default: {
+      config: { platform: "web", bundle: { packages: {} } },
+      sources: {},
+      destinations: {}
+    }
+  }
+};
+var SERVER_SKELETON = {
+  version: 4,
+  flows: {
+    default: {
+      config: { platform: "server", bundle: { packages: {} } },
+      sources: {},
+      destinations: {}
+    }
+  }
+};
+var TITLE11 = "Load or Create Flow";
+var DESCRIPTION11 = "Load an existing flow configuration from a local file path, URL, or walkerOS API (by flow ID). Or create a new empty flow by specifying a platform (web or server). Use the add-step prompt to add sources, destinations, transformers, or stores to the flow.";
+var inputSchema11 = {
+  source: z10.string().optional().describe(
+    "Flow source: local file path (./flow.json), URL (https://...), inline JSON string, or API flow ID (cfg_...). Omit to create a new flow."
+  ),
+  platform: z10.enum(["web", "server"]).optional().describe(
+    "Platform for new flows. Required when source is omitted. web = browser tracking, server = Node.js HTTP."
+  )
+};
+var outputSchema = {
+  version: z10.number().describe("Flow config version"),
+  flows: z10.record(z10.string(), z10.unknown()).describe("Flow definitions")
+};
+var annotations11 = {
+  readOnlyHint: true,
+  destructiveHint: false,
+  idempotentHint: true,
+  openWorldHint: true
+};
+function createFlowLoadToolSpec() {
+  return {
+    name: "flow_load",
+    title: TITLE11,
+    description: DESCRIPTION11,
+    inputSchema: inputSchema11,
+    annotations: annotations11,
+    handler: (input) => flowLoadHandlerBody(input)
+  };
+}
+async function flowLoadHandlerBody(input) {
+  const { source, platform } = input ?? {};
+  try {
+    if (source) {
+      const config = await loadJsonConfig2(source);
+      return mcpResult11(redactNestedStrings(config, { skip: keepLiteral2 }), {
+        next: ["Use flow_validate to check", "Use add-step prompt to modify"]
+      });
+    }
+    if (!platform) {
+      return mcpError11(
+        new Error(
+          "Provide source (file path, URL, or flow ID) to load existing flow, or platform (web/server) to create a new one."
         )
-      },
-      // No outputSchema: action-dispatched tool — each action returns a different shape
-      annotations: {
-        readOnlyHint: false,
-        destructiveHint: true,
-        idempotentHint: false,
-        openWorldHint: true
-      }
+      );
+    }
+    const skeleton = platform === "web" ? WEB_SKELETON : SERVER_SKELETON;
+    return mcpResult11(skeleton, {
+      next: [
+        "Read walkeros://reference/flow-schema for config structure",
+        "Use add-step prompt to add sources and destinations"
+      ]
+    });
+  } catch (error) {
+    const msg = error instanceof Error ? error.message : "";
+    if (msg.includes("not found") || msg.includes("ENOENT"))
+      return mcpError11(error, "Check configPath \u2014 expected a flow.json file");
+    return mcpError11(error);
+  }
+}
+function registerFlowLoadTool(server) {
+  const spec = createFlowLoadToolSpec();
+  server.registerTool(
+    spec.name,
+    {
+      title: spec.title,
+      description: spec.description,
+      inputSchema: spec.inputSchema,
+      // outputSchema is wire-only; not part of ToolSpec
+      outputSchema,
+      annotations: spec.annotations
     },
-    async ({
-      action,
-      flowId,
-      projectId,
-      name,
-      content,
-      patch,
-      fields,
-      sort,
-      order,
-      includeDeleted,
-      previewId,
-      flowName,
-      flowSettingsId,
-      siteUrl
-    }) => {
-      try {
-        switch (action) {
-          case "list": {
-            if (projectId) {
-              const data2 = await listFlows({
-                projectId,
-                sort,
-                order,
-                includeDeleted
-              });
-              return mcpResult11(data2);
-            }
-            const data = await listAllFlows({ sort, order, includeDeleted });
-            return mcpResult11(
-              { projects: data },
-              {
-                next: [
-                  'Use flow_manage with action "get" and a flowId to inspect a specific flow',
-                  "Use flow_load to open a flow for editing"
-                ]
-              }
-            );
-          }
-          case "get": {
-            if (!flowId) {
-              return mcpError11(
-                new Error(
-                  'flowId is required for get action. Use action "list" to see available flows.'
-                )
-              );
-            }
-            const flow = await getFlow({ flowId, projectId, fields });
-            return mcpResult11(flow, {
-              next: [
-                "Use flow_load to open this flow for editing and validation"
-              ]
-            });
-          }
-          case "create": {
-            if (!name) {
-              return mcpError11(new Error("name is required for create action."));
-            }
-            const created = await createFlow({
-              name,
-              content: content ?? {},
-              projectId
-            });
-            return mcpResult11(created, {
-              next: [
-                "Use flow_load to open this flow for editing and validation"
-              ]
-            });
-          }
-          case "update": {
-            if (!flowId) {
-              return mcpError11(
-                new Error(
-                  'flowId is required for update action. Use action "list" to see available flows.'
-                )
-              );
-            }
-            const updated = await updateFlow({
-              flowId,
-              projectId,
-              name,
-              content,
-              mergePatch: patch ?? true
-            });
-            return mcpResult11(updated);
-          }
-          case "delete": {
-            if (!flowId) {
-              return mcpError11(
-                new Error(
-                  'flowId is required for delete action. Use action "list" to see available flows.'
-                )
-              );
-            }
-            const deleted = await deleteFlow({ flowId, projectId });
-            return mcpResult11(deleted);
-          }
-          case "duplicate": {
-            if (!flowId) {
-              return mcpError11(
-                new Error(
-                  'flowId is required for duplicate action. Use action "list" to see available flows.'
-                )
-              );
-            }
-            const duplicated = await duplicateFlow({
-              flowId,
-              name,
-              projectId
-            });
-            return mcpResult11(duplicated);
-          }
-          case "preview_list": {
-            if (!flowId) {
-              return mcpError11(
-                new Error(
-                  'flowId is required for preview_list. Use action "list" to see available flows.'
-                )
-              );
-            }
-            const data = await listPreviews({ projectId, flowId });
-            return mcpResult11(data);
-          }
-          case "preview_get": {
-            if (!flowId || !previewId) {
-              return mcpError11(
-                new Error("flowId and previewId are required for preview_get.")
-              );
-            }
-            const data = await getPreview({ projectId, flowId, previewId });
-            return mcpResult11(data);
-          }
-          case "preview_create": {
-            if (!flowId) {
-              return mcpError11(
-                new Error("flowId is required for preview_create.")
-              );
-            }
-            if (!flowName && !flowSettingsId) {
-              return mcpError11(
-                new Error(
-                  "flowName or flowSettingsId is required for preview_create."
-                )
-              );
-            }
-            const preview = await createPreview({
-              projectId,
-              flowId,
-              flowName,
-              flowSettingsId
-            });
-            const typedPreview = preview;
-            const enriched = {
-              ...typedPreview,
-              activationParam: typedPreview.activationUrl
-            };
-            if (siteUrl) {
-              const on = new URL(siteUrl);
-              on.searchParams.set("elbPreview", typedPreview.token);
-              enriched.activationUrl = on.toString();
-              const off = new URL(siteUrl);
-              off.searchParams.set("elbPreview", "off");
-              enriched.deactivationUrl = off.toString();
-            } else {
-              delete enriched.activationUrl;
-            }
-            return mcpResult11(enriched, {
-              next: siteUrl ? [
-                "Open activationUrl to activate preview mode; open deactivationUrl to exit."
-              ] : [
-                "Append activationParam to any URL on your site to activate preview mode."
-              ]
-            });
-          }
-          case "preview_delete": {
-            if (!flowId || !previewId) {
-              return mcpError11(
-                new Error(
-                  "flowId and previewId are required for preview_delete."
-                )
-              );
-            }
-            const data = await deletePreview({
-              projectId,
-              flowId,
-              previewId
-            });
-            return mcpResult11(data);
-          }
-          default:
-            throw new Error(
-              `Unknown action: ${action}. Use one of: list, get, create, update, delete, duplicate, preview_list, preview_get, preview_create, preview_delete`
-            );
-        }
-      } catch (error) {
-        return mcpError11(error, isAuthError(error) ? AUTH_HINT : void 0);
-      }
+    // SDK infers handler type from inputSchema shape; ToolSpec.handler is the
+    // type-erased (input: unknown) => Promise<unknown> form by design.
+    spec.handler
+  );
+}
+
+// src/tools/package.ts
+import { z as z11 } from "zod";
+import { fetchPackage, mcpResult as mcpResult12, mcpError as mcpError12 } from "@walkeros/core";
+import { mergeConfigSchema } from "@walkeros/core/dev";
+
+// src/catalog.ts
+var NPM_SEARCH_URL = "https://registry.npmjs.org/-/v1/search";
+var JSDELIVR_BASE = "https://cdn.jsdelivr.net/npm";
+var WALKEROS_JSON_PATH = "dist/walkerOS.json";
+var CACHE_TTL = 5 * 60 * 1e3;
+var CLIENT_HEADER = "walkeros-mcp/4.0.0-next-1777463920154";
+var cache;
+function normalizePlatform(platform) {
+  if (platform == null) return [];
+  if (typeof platform === "string") {
+    return platform === "universal" ? ["web", "server"] : [platform];
+  }
+  if (Array.isArray(platform)) {
+    return platform.filter((v) => typeof v === "string");
+  }
+  return [];
+}
+async function fetchCatalog(filters) {
+  if (cache && Date.now() - cache.timestamp < CACHE_TTL) {
+    return applyFilters(cache.entries, filters);
+  }
+  let entries;
+  try {
+    entries = filters?.baseUrl ? await fetchCatalogFrom(filters.baseUrl, filters) : await fetchFromNpm();
+  } catch {
+    try {
+      entries = await fetchFromNpm();
+    } catch {
+      return [];
     }
+  }
+  cache = { entries, timestamp: Date.now() };
+  return applyFilters(entries, filters);
+}
+async function fetchCatalogFrom(baseUrl, filters) {
+  const params = new URLSearchParams();
+  if (filters?.type) params.set("type", filters.type);
+  if (filters?.platform) params.set("platform", filters.platform);
+  const url = `${baseUrl}/api/packages${params.toString() ? `?${params}` : ""}`;
+  const res = await fetch(url, {
+    signal: AbortSignal.timeout(15e3),
+    headers: { "X-Walkeros-Client": CLIENT_HEADER }
+  });
+  if (!res.ok) throw new Error(`Catalog fetch failed: ${res.status}`);
+  const data = await res.json();
+  return data.catalog;
+}
+async function fetchFromNpm() {
+  const res = await fetch(`${NPM_SEARCH_URL}?text=@walkeros/&size=250`, {
+    signal: AbortSignal.timeout(1e4),
+    headers: { "X-Walkeros-Client": CLIENT_HEADER }
+  });
+  if (!res.ok) throw new Error(`npm search failed: ${res.status}`);
+  const data = await res.json();
+  const metaResults = await Promise.allSettled(
+    data.objects.map((obj) => enrichWithMeta(obj.package))
   );
+  return metaResults.filter(
+    (r) => r.status === "fulfilled"
+  ).map((r) => r.value).filter((entry) => entry !== void 0);
+}
+async function enrichWithMeta(pkg) {
+  try {
+    const res = await fetch(
+      `${JSDELIVR_BASE}/${pkg.name}@${pkg.version}/${WALKEROS_JSON_PATH}`,
+      {
+        signal: AbortSignal.timeout(5e3),
+        headers: { "X-Walkeros-Client": CLIENT_HEADER }
+      }
+    );
+    if (!res.ok) return void 0;
+    const json = await res.json();
+    const meta = json.$meta;
+    if (!meta || typeof meta.type !== "string") return void 0;
+    return {
+      name: pkg.name,
+      version: pkg.version,
+      description: pkg.description,
+      type: meta.type,
+      platform: normalizePlatform(meta.platform)
+    };
+  } catch {
+    return void 0;
+  }
+}
+function applyFilters(entries, filters) {
+  let results = entries;
+  if (filters?.type) {
+    results = results.filter((e) => e.type === filters.type);
+  }
+  if (filters?.platform) {
+    results = results.filter(
+      (e) => e.platform.length === 0 || e.platform.includes(filters.platform)
+    );
+  }
+  return results;
 }
 
-// src/tools/deploy-manage.ts
-import { z as z12 } from "zod";
-import {
-  deploy as deployFlow,
-  listDeployments,
-  getDeployment,
-  getDeploymentBySlug,
-  deleteDeployment
-} from "@walkeros/cli";
-import { mcpResult as mcpResult12, mcpError as mcpError12 } from "@walkeros/core";
-function registerDeployTool(server2) {
-  server2.registerTool(
-    "deploy_manage",
+// src/tools/package.ts
+var SEARCH_TITLE = "Search Package";
+var SEARCH_DESCRIPTION = "Start here for package discovery. Never guess package names: use this tool first to find exact names. Without package name: returns catalog filtered by type/platform. With package name: returns metadata, hint keys, and example summaries.";
+var searchInputSchema = {
+  package: z11.string().min(1).optional().describe(
+    "Exact npm package name for detailed lookup (e.g., @walkeros/web-destination-snowplow)"
+  ),
+  type: z11.enum(["source", "destination", "transformer", "store"]).optional().describe("Filter by package type (browse mode)"),
+  platform: z11.enum(["web", "server"]).optional().describe("Filter by platform (browse mode, includes universal packages)"),
+  version: z11.string().optional().describe("Package version for detailed lookup (default: latest)")
+};
+var searchAnnotations = {
+  readOnlyHint: true,
+  destructiveHint: false,
+  idempotentHint: true,
+  openWorldHint: false
+};
+function createPackageSearchToolSpec() {
+  return {
+    name: "package_search",
+    title: SEARCH_TITLE,
+    description: SEARCH_DESCRIPTION,
+    inputSchema: searchInputSchema,
+    annotations: searchAnnotations,
+    handler: (input) => packageSearchHandlerBody(input)
+  };
+}
+async function packageSearchHandlerBody(input) {
+  const {
+    package: packageName,
+    type,
+    platform,
+    version
+  } = input ?? {};
+  const baseUrl = process.env.APP_URL || void 0;
+  if (!packageName) {
+    const catalog = await fetchCatalog({ type, platform, baseUrl });
+    const result = { catalog, count: catalog.length };
+    return mcpResult12(result, {
+      next: ["Use package_get for schemas and examples"]
+    });
+  }
+  try {
+    const info = await fetchPackage(packageName, {
+      version,
+      baseUrl,
+      client: CLIENT_HEADER
+    });
+    const result = {
+      package: info.packageName,
+      version: info.version,
+      description: info.description,
+      type: info.type,
+      platform: normalizePlatform(info.platform),
+      hintKeys: info.hintKeys,
+      exampleSummaries: info.exampleSummaries
+    };
+    return mcpResult12(result, {
+      next: ["Use package_get for schemas and examples"]
+    });
+  } catch (error) {
+    return mcpError12(
+      error,
+      "Package not found. Use package_search without parameters to browse available packages."
+    );
+  }
+}
+function registerPackageSearchTool(server) {
+  const spec = createPackageSearchToolSpec();
+  server.registerTool(
+    spec.name,
     {
-      title: "Deploy Management",
-      description: 'Deploy walkerOS flows and manage deployments. Deploy a flow, list deployments, get deployment details, or delete deployments. Note: the "get" and "delete" actions accept a deployment slug (e.g. "dep_..."), not a flow ID. If you only have a flowId, resolve the latest deployment slug first via flow_manage with action "get".',
-      inputSchema: {
-        action: z12.enum(["deploy", "list", "get", "delete"]).describe("Deployment action to perform"),
-        flowId: z12.string().optional().describe("Flow ID. Required for deploy action."),
-        id: z12.string().optional().describe(
-          'Deployment slug (e.g. "dep_..."). Required for get and delete actions. This is the deployment slug, not a flow ID \u2014 if you only have a flowId, use flow_manage action "get" to resolve the latest deployment slug.'
-        ),
-        projectId: z12.string().optional().describe("Project ID. Optional filter for list."),
-        type: z12.enum(["web", "server"]).optional().describe("Deployment type filter for list."),
-        status: z12.string().optional().describe("Status filter for list."),
-        wait: z12.boolean().optional().describe(
-          "Wait for deploy to complete (default true). Only used with deploy action."
-        ),
-        flowName: z12.string().optional().describe(
-          "Flow name for multi-settings flows. Only used with deploy action."
-        )
-      },
-      // No outputSchema: action-dispatched tool — each action returns a different shape
-      annotations: {
-        readOnlyHint: false,
-        destructiveHint: true,
-        idempotentHint: false,
-        openWorldHint: true
-      }
+      title: spec.title,
+      description: spec.description,
+      inputSchema: spec.inputSchema,
+      // No outputSchema: browse mode returns {catalog, count}, lookup returns metadata — incompatible shapes
+      annotations: spec.annotations
     },
-    async ({ action, flowId, id, projectId, type, status, wait, flowName }) => {
-      try {
-        switch (action) {
-          case "deploy": {
-            if (!flowId) {
-              return mcpError12(
-                new Error(
-                  'flowId is required for deploy action. Use flow_manage with action "list" to see available flows.'
-                )
-              );
-            }
-            const result = await deployFlow({
-              flowId,
-              wait: wait ?? true,
-              flowName
-            });
-            return mcpResult12(result, {
-              next: [
-                'Use deploy_manage with action "get" to check deployment status'
-              ]
-            });
-          }
-          case "list": {
-            const data = await listDeployments({ projectId, type, status });
-            return mcpResult12(data);
-          }
-          case "get": {
-            if (!id) {
-              return mcpError12(
-                new Error(
-                  'id is required for get action. Use deploy_manage with action "list" to see available deployments.'
-                )
-              );
-            }
-            try {
-              const data = await getDeploymentBySlug({ slug: id, projectId });
-              return mcpResult12(data);
-            } catch {
-              const data = await getDeployment({ flowId: id, projectId });
-              return mcpResult12(data);
-            }
-          }
-          case "delete": {
-            if (!id) {
-              return mcpError12(
-                new Error(
-                  'id is required for delete action. Use deploy_manage with action "list" to see available deployments.'
-                )
-              );
-            }
-            try {
-              const data = await deleteDeployment({ slug: id, projectId });
-              return mcpResult12({ deleted: true, ...data });
-            } catch (error) {
-              if (isAuthError(error)) {
-                return mcpError12(error, AUTH_HINT);
-              }
-              const message = error instanceof Error ? error.message : String(error);
-              if (/not[\s_-]?found|404/i.test(message)) {
-                return mcpError12(
-                  error,
-                  'Deployment not found. The "delete" action expects a deployment slug (e.g. "dep_..."), not a flow ID. If you only have a flowId, use flow_manage with action "get" to resolve the latest deployment slug first.'
-                );
-              }
-              return mcpError12(error);
-            }
-          }
-          default:
-            throw new Error(
-              `Unknown action: ${action}. Use one of: deploy, list, get, delete`
-            );
+    // SDK infers handler type from inputSchema shape; ToolSpec.handler is the
+    // type-erased (input: unknown) => Promise<unknown> form by design.
+    spec.handler
+  );
+}
+var GET_TITLE = "Get Package";
+var GET_DESCRIPTION = 'Requires exact package name: do not guess names, use package_search first to find them. Returns schemas + hint texts + example summaries by default (lightweight). Use section parameter for full content: "hints" (with code blocks), "examples" (full in/out data), or "all".';
+var getInputSchema = {
+  package: z11.string().min(1).describe(
+    "Exact npm package name (e.g., @walkeros/web-destination-snowplow)"
+  ),
+  version: z11.string().optional().describe("Package version (default: latest)"),
+  section: z11.enum(["hints", "examples", "all"]).optional().describe(
+    "Section to expand with full content. Default: summary view with schemas + hint texts + example descriptions"
+  )
+};
+var getAnnotations = {
+  readOnlyHint: true,
+  destructiveHint: false,
+  idempotentHint: true,
+  openWorldHint: true
+};
+function createPackageGetToolSpec() {
+  return {
+    name: "package_get",
+    title: GET_TITLE,
+    description: GET_DESCRIPTION,
+    inputSchema: getInputSchema,
+    annotations: getAnnotations,
+    handler: (input) => packageGetHandlerBody(input)
+  };
+}
+async function packageGetHandlerBody(input) {
+  const {
+    package: packageName,
+    version,
+    section
+  } = input ?? {};
+  const baseUrl = process.env.APP_URL || void 0;
+  try {
+    const info = await fetchPackage(packageName, {
+      version,
+      baseUrl,
+      client: CLIENT_HEADER
+    });
+    const mergedSchemas = {};
+    if (info.type) {
+      mergedSchemas.config = mergeConfigSchema(
+        info.type,
+        info.schemas
+      );
+    }
+    for (const [key, value] of Object.entries(info.schemas)) {
+      if (key !== "settings") {
+        mergedSchemas[key] = value;
+      }
+    }
+    const result = {
+      package: info.packageName,
+      version: info.version,
+      type: info.type,
+      platform: normalizePlatform(info.platform),
+      schemas: mergedSchemas
+    };
+    if (info.hints) {
+      if (section === "hints" || section === "all") {
+        result.hints = info.hints;
+      } else {
+        const hintSummary = {};
+        for (const [key, hint] of Object.entries(info.hints)) {
+          const h = hint;
+          hintSummary[key] = { text: h.text };
         }
-      } catch (error) {
-        return mcpError12(error, isAuthError(error) ? AUTH_HINT : void 0);
+        result.hints = hintSummary;
       }
     }
+    if (section === "examples" || section === "all") {
+      result.examples = info.examples;
+    } else {
+      result.exampleSummaries = info.exampleSummaries;
+    }
+    return mcpResult12(result);
+  } catch (error) {
+    return mcpError12(
+      error,
+      "Use package_search to browse available package names."
+    );
+  }
+}
+function registerGetPackageSchemaTool(server) {
+  const spec = createPackageGetToolSpec();
+  server.registerTool(
+    spec.name,
+    {
+      title: spec.title,
+      description: spec.description,
+      inputSchema: spec.inputSchema,
+      // No outputSchema: removed to avoid SDK -32602 crashes on unexpected field values
+      annotations: spec.annotations
+    },
+    // SDK infers handler type from inputSchema shape; ToolSpec.handler is the
+    // type-erased (input: unknown) => Promise<unknown> form by design.
+    spec.handler
   );
 }
 
+// src/server.ts
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+
 // src/resources/package-schemas.ts
 import { ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { fetchPackageSchema } from "@walkeros/core";
-function registerPackageSchemaResources(server2) {
+function registerPackageSchemaResources(server) {
   const template = new ResourceTemplate("walkeros://schema/{packageName}", {
     list: async () => {
       const catalog = await fetchCatalog();
@@ -1587,7 +2038,7 @@ function registerPackageSchemaResources(server2) {
       };
     }
   });
-  server2.registerResource(
+  server.registerResource(
     "package-schema",
     template,
     {
@@ -1614,12 +2065,12 @@ function registerPackageSchemaResources(server2) {
 
 // src/resources/references.ts
 import { schemas as schemas5 } from "@walkeros/core/dev";
-function registerReferenceResources(server2) {
-  server2.resource(
+function registerReferenceResources(server) {
+  server.resource(
     "flow-schema",
     "walkeros://reference/flow-schema",
     {
-      description: "JSON Schema for Flow.Config \u2014 the complete flow configuration structure",
+      description: "JSON Schema for Flow.Json \u2014 the complete flow configuration structure",
       mimeType: "application/json"
     },
     async () => ({
@@ -1632,7 +2083,7 @@ function registerReferenceResources(server2) {
       ]
     })
   );
-  server2.resource(
+  server.resource(
     "event-model",
     "walkeros://reference/event-model",
     {
@@ -1649,7 +2100,7 @@ function registerReferenceResources(server2) {
       ]
     })
   );
-  server2.resource(
+  server.resource(
     "mapping",
     "walkeros://reference/mapping",
     {
@@ -1675,7 +2126,7 @@ function registerReferenceResources(server2) {
       ]
     })
   );
-  server2.resource(
+  server.resource(
     "consent",
     "walkeros://reference/consent",
     {
@@ -1692,11 +2143,11 @@ function registerReferenceResources(server2) {
       ]
     })
   );
-  server2.resource(
+  server.resource(
     "variables",
     "walkeros://reference/variables",
     {
-      description: "walkerOS variable patterns: $var, $env, $def, $contract, $code, $store substitution",
+      description: "walkerOS variable patterns: $var, $env, $def, $contract, $code, $store, $secret substitution",
       mimeType: "application/json"
     },
     async () => ({
@@ -1705,16 +2156,18 @@ function registerReferenceResources(server2) {
           uri: "walkeros://reference/variables",
           text: JSON.stringify(
             {
+              separatorRule: "`.` for names and paths; `:` for literal values or raw-code payloads.",
               patterns: {
                 "$var.name": "Variable substitution \u2014 cascade: step settings > flow settings > config variables",
                 "$env.NAME": "Environment variable \u2014 $env.GA_ID reads process.env.GA_ID",
-                "$env.NAME:default": "Environment variable with fallback \u2014 $env.GA_ID:G-DEFAULT",
+                "$env.NAME:default": "Environment variable with fallback \u2014 $env.GA_ID:G-DEFAULT (the `:` is the literal default separator)",
                 "$def.name": "Definition reference \u2014 reusable config blocks from definitions section",
                 "$def.name.path.deep": "Nested definition access \u2014 $def.ga4Events.purchase",
                 "$contract.name": "Contract reference \u2014 links to named contract for validation",
                 "$contract.name.path": "Nested contract access \u2014 $contract.ecommerce.product",
-                "$code:(expr)": "Inline JavaScript \u2014 $code:(event) => event.data.price * 100",
-                "$store:storeId": "Store injection in env values \u2014 wires runtime store access"
+                "$code:(expr)": "Inline JavaScript \u2014 $code:(event) => event.data.price * 100 (the `:` carries the raw-code payload)",
+                "$store.storeId": "Store injection in env values \u2014 wires runtime store access",
+                "$secret.NAME": "Secret injection \u2014 resolved server-side at deploy/runtime"
               },
               cascade: {
                 priority: [
@@ -1745,7 +2198,7 @@ function registerReferenceResources(server2) {
       ]
     })
   );
-  server2.resource(
+  server.resource(
     "contract",
     "walkeros://reference/contract",
     {
@@ -1762,7 +2215,7 @@ function registerReferenceResources(server2) {
       ]
     })
   );
-  server2.resource(
+  server.resource(
     "examples",
     "walkeros://reference/examples",
     {
@@ -1791,7 +2244,7 @@ function registerReferenceResources(server2) {
       };
     }
   );
-  server2.resource(
+  server.resource(
     "openapi",
     "walkeros://reference/openapi",
     {
@@ -1820,7 +2273,7 @@ function registerReferenceResources(server2) {
       };
     }
   );
-  server2.resource(
+  server.resource(
     "packages",
     "walkeros://reference/packages",
     {
@@ -1843,17 +2296,17 @@ function registerReferenceResources(server2) {
 }
 
 // src/prompts/add-step.ts
-import { z as z13 } from "zod";
-function registerAddStepPrompt(server2) {
-  server2.registerPrompt(
+import { z as z12 } from "zod";
+function registerAddStepPrompt(server) {
+  server.registerPrompt(
     "add-step",
     {
       description: "Add a source, destination, transformer, or store step to a flow configuration. Guides through package selection, config scaffolding, and wiring.",
       argsSchema: {
-        stepType: z13.string().optional().describe(
+        stepType: z12.string().optional().describe(
           "Type of step to add: source, destination, transformer, or store"
         ),
-        flowPath: z13.string().optional().describe("Path to the flow.json file to modify")
+        flowPath: z12.string().optional().describe("Path to the flow.json file to modify")
       }
     },
     async ({ stepType, flowPath }) => ({
@@ -1881,7 +2334,7 @@ function registerAddStepPrompt(server2) {
               "- Read the walkeros://reference/flow-schema resource to understand connection rules.",
               "- Sources connect to pre-collector transformers via `next`.",
               "- Destinations connect to post-collector transformers via `before`.",
-              "- Stores are passive \u2014 referenced via `$store:storeName` in env values.",
+              "- Stores are passive \u2014 referenced via `$store.storeName` in env values.",
               "- Use variables ($var) for values that change between environments.",
               "- For required settings without defaults in the package schema, ask the user which value to use. Do not guess credentials, IDs, or environment-specific values.",
               "- If $meta.exports lists named exports, set the `code` field on the step to the chosen export name. If only one export exists, use it automatically."
@@ -1894,14 +2347,14 @@ function registerAddStepPrompt(server2) {
 }
 
 // src/prompts/setup-mapping.ts
-import { z as z14 } from "zod";
-function registerSetupMappingPrompt(server2) {
-  server2.registerPrompt(
+import { z as z13 } from "zod";
+function registerSetupMappingPrompt(server) {
+  server.registerPrompt(
     "setup-mapping",
     {
       description: "Set up event mapping for any step in a flow. Teaches mapping syntax and uses package examples as templates.",
       argsSchema: {
-        stepName: z14.string().optional().describe('Step name in the flow (e.g., "gtag", "meta", "express")')
+        stepName: z13.string().optional().describe('Step name in the flow (e.g., "gtag", "meta", "express")')
       }
     },
     async ({ stepName }) => ({
@@ -1939,14 +2392,14 @@ function registerSetupMappingPrompt(server2) {
 }
 
 // src/prompts/manage-contract.ts
-import { z as z15 } from "zod";
-function registerManageContractPrompt(server2) {
-  server2.registerPrompt(
+import { z as z14 } from "zod";
+function registerManageContractPrompt(server) {
+  server.registerPrompt(
     "manage-contract",
     {
       description: "Create or update event contracts for a flow. Can generate contracts from existing mappings or scaffold mappings from contracts.",
       argsSchema: {
-        direction: z15.string().optional().describe(
+        direction: z14.string().optional().describe(
           'Direction: "from-mappings" (extract contract from existing mappings), "from-scratch" (create new contract), or "to-mappings" (scaffold mappings from contract)'
         )
       }
@@ -1984,14 +2437,14 @@ function registerManageContractPrompt(server2) {
 }
 
 // src/prompts/use-definitions.ts
-import { z as z16 } from "zod";
-function registerUseDefinitionsPrompt(server2) {
-  server2.registerPrompt(
+import { z as z15 } from "zod";
+function registerUseDefinitionsPrompt(server) {
+  server.registerPrompt(
     "use-definitions",
     {
       description: "Extract shared patterns into definitions and variables for DRY, environment-aware flow configurations.",
       argsSchema: {
-        flowPath: z16.string().optional().describe("Path to the flow.json file to analyze")
+        flowPath: z15.string().optional().describe("Path to the flow.json file to analyze")
       }
     },
     async ({ flowPath }) => ({
@@ -2017,7 +2470,7 @@ function registerUseDefinitionsPrompt(server2) {
               "- `$def.name` and `$def.name.path.deep` \u2014 definition references",
               "- `$contract.name` \u2014 contract references",
               "- `$code:(expr)` \u2014 inline JavaScript functions",
-              "- `$store:storeId` \u2014 store injection in env values",
+              "- `$store.storeId` \u2014 store injection in env values",
               "",
               "Look for:",
               "- Same API keys or URLs across multiple destinations \u2192 $var or $env",
@@ -2031,15 +2484,8 @@ function registerUseDefinitionsPrompt(server2) {
   );
 }
 
-// src/index.ts
-setClientContext({ type: "mcp", version: "3.4.2" });
-var server = new McpServer(
-  {
-    name: "walkeros-flow",
-    version: "3.4.2"
-  },
-  {
-    instructions: `walkerOS is an open-source, privacy-first event data collection platform. Define event pipelines as code using JSON flow configurations.
+// src/instructions.ts
+var SERVER_INSTRUCTIONS = `walkerOS is an open-source, privacy-first event data collection platform. Define event pipelines as code using JSON flow configurations.
 
 ## Rules
 
@@ -2071,10 +2517,10 @@ Every component in a flow is a **step**: sources capture events, transformers pr
 
 \`\`\`json
 {
-  "version": 3,
+  "version": 4,
   "flows": {
     "default": {
-      "web": {},
+      "config": { "platform": "web" },
       "sources": { "<name>": { "package": "<npm-package>", "config": {} } },
       "destinations": { "<name>": { "package": "<npm-package>", "config": { "settings": {} } } }
     }
@@ -2082,8 +2528,8 @@ Every component in a flow is a **step**: sources capture events, transformers pr
 }
 \`\`\`
 
-- \`version: 3\` is required
-- Each flow must have exactly one of \`web: {}\` or \`server: {}\`
+- \`version: 4\` is required
+- Each flow declares its target via \`config.platform\` (\`"web"\` or \`"server"\`)
 - Destination settings go inside \`config.settings\`, not directly on the destination
 - Event format: \`{ name: "entity action", data: {...}, entity: "...", action: "..." }\`
 
@@ -2096,42 +2542,551 @@ Every component in a flow is a **step**: sources capture events, transformers pr
 
 ## Simulation Tips
 
-- Destinations with \`require: ["consent"]\` stay **pending** until a \`"walker consent"\` event fires. Simulation will error "not found" for pending destinations \u2014 remove \`require\` from config when testing with \`flow_simulate\`.
+- Destinations with \`require: ["consent"]\` stay **pending** until a \`"walker consent"\` event fires. Simulation will error "not found" for pending destinations, remove \`require\` from config when testing with \`flow_simulate\`.
 - Destinations with \`consent: { marketing: true }\` silently skip events that lack matching consent. Include \`consent\` in the event: \`{ name: "page view", data: {...}, consent: { marketing: true } }\`.
 - **Mapping** transforms event names and data at the destination level. Events without a matching mapping rule pass through unmodified.
-- **Policy** modifies the event before mapping runs \u2014 use it to inject computed fields or redact sensitive data.
+- **Policy** modifies the event before mapping runs, use it to inject computed fields or redact sensitive data.
 
 ## Reference Resources
 
-Read these before constructing configs manually: \`walkeros://reference/flow-schema\`, \`walkeros://reference/mapping\`, \`walkeros://reference/event-model\`, \`walkeros://reference/consent\`, \`walkeros://reference/variables\`, \`walkeros://reference/contract\`, \`walkeros://reference/examples\`.`
-  }
-);
-registerFlowValidateTool(server);
-registerFlowBundleTool(server);
-registerFlowSimulateTool(server);
-registerFlowPushTool(server);
-registerFlowExamplesTool(server);
-registerPackageSearchTool(server);
-registerGetPackageSchemaTool(server);
-registerFlowLoadTool(server);
-registerFeedbackTool(server);
-registerAuthTool(server);
-registerProjectManageTool(server);
-registerFlowManageTool(server);
-registerDeployTool(server);
-registerPackageSchemaResources(server);
-registerReferenceResources(server);
-registerAddStepPrompt(server);
-registerSetupMappingPrompt(server);
-registerManageContractPrompt(server);
-registerUseDefinitionsPrompt(server);
-async function main() {
-  const transport = new StdioServerTransport();
-  await server.connect(transport);
-  console.error("walkerOS Flow MCP server running on stdio");
-}
-main().catch((error) => {
-  console.error("Failed to start Flow MCP server:", error);
-  process.exit(1);
-});
+Read these before constructing configs manually: \`walkeros://reference/flow-schema\`, \`walkeros://reference/mapping\`, \`walkeros://reference/event-model\`, \`walkeros://reference/consent\`, \`walkeros://reference/variables\`, \`walkeros://reference/contract\`, \`walkeros://reference/examples\`.`;
+
+// src/telemetry.ts
+import { randomUUID } from "crypto";
+import { telemetry } from "@walkeros/cli";
+async function createMcpEmitter(opts) {
+  const clientName = opts.clientInfo?.name || "unknown";
+  const session = randomUUID();
+  const emitter = await telemetry.createEmitter({
+    source: {
+      type: "mcp",
+      platform: "server"
+    },
+    packageVersion: opts.packageVersion,
+    session
+  });
+  return {
+    async emitStart() {
+      const ci = telemetry.getCiInfo();
+      await emitter.send("mcp start", {
+        ...ci,
+        client: clientName
+      });
+    },
+    async emitInvoke(tool, outcome, timingMs) {
+      await emitter.send(
+        "cmd invoke",
+        { outcome, client: clientName },
+        timingMs,
+        { tool }
+      );
+    },
+    async emitError(kind) {
+      await emitter.send("error throw", { kind });
+    }
+  };
+}
+
+// src/server.ts
+var currentEmitter;
+function wrapRegisteredToolsWithTelemetry(server) {
+  const internal = server;
+  const tools = internal._registeredTools;
+  if (!tools) return;
+  for (const [toolName, tool] of Object.entries(tools)) {
+    const original = tool.handler;
+    tool.handler = async (...args) => {
+      const start = Date.now();
+      try {
+        const result = await original(...args);
+        const emitter = currentEmitter;
+        if (emitter) {
+          emitter.emitInvoke(toolName, "success", Date.now() - start).catch(() => {
+          });
+        }
+        return result;
+      } catch (err) {
+        const emitter = currentEmitter;
+        if (emitter) {
+          emitter.emitInvoke(toolName, "error", Date.now() - start).catch(() => {
+          });
+        }
+        throw err;
+      }
+    };
+  }
+}
+function createWalkerOSMcpServer(opts) {
+  const packageVersion = opts.version ?? "0.0.0";
+  const server = new McpServer(
+    {
+      name: "walkeros-flow",
+      version: packageVersion
+    },
+    { instructions: SERVER_INSTRUCTIONS }
+  );
+  registerAuthTool(server, opts.client);
+  registerProjectManageTool(server, opts.client);
+  registerFlowManageTool(server, opts.client);
+  registerDeployTool(server, opts.client);
+  registerFeedbackTool(server, opts.client);
+  registerFlowValidateTool(server);
+  registerFlowBundleTool(server);
+  registerFlowSimulateTool(server);
+  registerFlowPushTool(server);
+  registerFlowExamplesTool(server);
+  registerFlowLoadTool(server);
+  registerPackageSearchTool(server);
+  registerGetPackageSchemaTool(server);
+  registerPackageSchemaResources(server);
+  registerReferenceResources(server);
+  registerAddStepPrompt(server);
+  registerSetupMappingPrompt(server);
+  registerManageContractPrompt(server);
+  registerUseDefinitionsPrompt(server);
+  wrapRegisteredToolsWithTelemetry(server);
+  const priorOnInitialized = server.server.oninitialized;
+  server.server.oninitialized = () => {
+    try {
+      priorOnInitialized?.();
+    } catch {
+    }
+    const clientInfo = server.server.getClientVersion();
+    void createMcpEmitter({
+      clientInfo,
+      packageVersion
+    }).then(async (emitter) => {
+      currentEmitter = emitter;
+      await emitter.emitStart();
+    }).catch(() => {
+    });
+  };
+  return server;
+}
+
+// src/http-tool-client.ts
+import {
+  listProjects,
+  getProject,
+  createProject,
+  updateProject,
+  deleteProject,
+  setDefaultProject,
+  getDefaultProject,
+  listAllFlows,
+  listFlows,
+  getFlow,
+  createFlow,
+  updateFlow,
+  deleteFlow,
+  duplicateFlow,
+  listPreviews,
+  getPreview,
+  createPreview,
+  deletePreview,
+  deploy,
+  listDeployments,
+  getDeploymentBySlug,
+  deleteDeployment,
+  requestDeviceCode,
+  pollForToken,
+  whoami,
+  resolveToken,
+  deleteConfig,
+  feedback,
+  getFeedbackPreference,
+  setFeedbackPreference
+} from "@walkeros/cli";
+var HttpToolClient = class {
+  async listProjects() {
+    return listProjects();
+  }
+  async getProject(options) {
+    return getProject(options);
+  }
+  async createProject(options) {
+    return createProject(options);
+  }
+  async updateProject(options) {
+    return updateProject(options);
+  }
+  async deleteProject(options) {
+    return deleteProject(options);
+  }
+  setDefaultProject(projectId) {
+    setDefaultProject(projectId);
+  }
+  getDefaultProject() {
+    return getDefaultProject();
+  }
+  async listAllFlows(options) {
+    return listAllFlows(options);
+  }
+  async listFlows(options) {
+    return listFlows(options);
+  }
+  async getFlow(options) {
+    return getFlow(options);
+  }
+  async createFlow(options) {
+    return createFlow(options);
+  }
+  async updateFlow(options) {
+    return updateFlow(options);
+  }
+  async deleteFlow(options) {
+    return deleteFlow(options);
+  }
+  async duplicateFlow(options) {
+    return duplicateFlow(options);
+  }
+  async listPreviews(options) {
+    return listPreviews(options);
+  }
+  async getPreview(options) {
+    return getPreview(options);
+  }
+  async createPreview(options) {
+    return createPreview(options);
+  }
+  async deletePreview(options) {
+    return deletePreview(options);
+  }
+  async deploy(options) {
+    return deploy(options);
+  }
+  async listDeployments(options) {
+    return listDeployments(options);
+  }
+  async getDeploymentBySlug(options) {
+    return getDeploymentBySlug(options);
+  }
+  async deleteDeployment(options) {
+    return deleteDeployment(options);
+  }
+  async requestDeviceCode() {
+    return requestDeviceCode();
+  }
+  async pollForToken(deviceCode, options) {
+    return pollForToken(deviceCode, options);
+  }
+  async whoami() {
+    return whoami();
+  }
+  resolveToken() {
+    return resolveToken();
+  }
+  deleteConfig() {
+    return deleteConfig();
+  }
+  async submitFeedback(text, options) {
+    await feedback(text, options);
+  }
+  getFeedbackPreference() {
+    return getFeedbackPreference();
+  }
+  setFeedbackPreference(anonymous) {
+    setFeedbackPreference(anonymous);
+  }
+};
+
+// src/http.ts
+import {
+  WebStandardStreamableHTTPServerTransport
+} from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
+function createStreamableHttpHandler(server, opts = {}) {
+  const { onSessionInitialized, ...transportOpts } = opts;
+  const userInit = transportOpts.onsessioninitialized;
+  const transport = new WebStandardStreamableHTTPServerTransport({
+    ...transportOpts,
+    onsessioninitialized: async (sessionId) => {
+      await userInit?.(sessionId);
+      await onSessionInitialized?.(sessionId);
+    }
+  });
+  const connectPromise = server.connect(transport);
+  return async (request) => {
+    await connectPromise;
+    return transport.handleRequest(request);
+  };
+}
+
+// src/tool-definitions.ts
+import { z as z16 } from "zod";
+import { schemas as schemas6 } from "@walkeros/cli/dev";
+var TOOL_DEFINITIONS = [
+  {
+    name: "auth",
+    title: "Authentication",
+    description: "Manage walkerOS authentication. Check login status, log in via device code flow, or log out. No terminal or browser required, the MCP client handles the authorization URL.",
+    inputSchema: {
+      action: z16.enum(["status", "login", "logout"]),
+      deviceCode: z16.string().optional()
+    },
+    annotations: {
+      readOnlyHint: false,
+      destructiveHint: true,
+      idempotentHint: false,
+      openWorldHint: true
+    }
+  },
+  {
+    name: "project_manage",
+    title: "Project Management",
+    description: "Manage walkerOS projects. List, create, update, delete projects, or set a default project for CLI operations.",
+    inputSchema: {
+      action: z16.enum([
+        "list",
+        "get",
+        "create",
+        "update",
+        "delete",
+        "set_default"
+      ]),
+      projectId: z16.string().optional(),
+      name: z16.string().optional()
+    },
+    annotations: {
+      readOnlyHint: false,
+      destructiveHint: true,
+      idempotentHint: false,
+      openWorldHint: true
+    }
+  },
+  {
+    name: "flow_manage",
+    title: "Flow Management",
+    description: "Manage walkerOS flows and their previews. List/get/create/update/delete/duplicate flows, or create/inspect/delete preview bundles for testing flow changes on live sites.",
+    inputSchema: {
+      action: z16.enum([
+        "list",
+        "get",
+        "create",
+        "update",
+        "delete",
+        "duplicate",
+        "preview_list",
+        "preview_get",
+        "preview_create",
+        "preview_delete"
+      ]),
+      flowId: z16.string().optional(),
+      projectId: z16.string().optional(),
+      name: z16.string().optional(),
+      content: z16.record(z16.string(), z16.unknown()).optional(),
+      patch: z16.boolean().optional(),
+      fields: z16.array(z16.string()).optional(),
+      sort: z16.enum(["name", "updated_at", "created_at"]).optional(),
+      order: z16.enum(["asc", "desc"]).optional(),
+      includeDeleted: z16.boolean().optional(),
+      previewId: z16.string().optional(),
+      flowName: z16.string().optional(),
+      flowSettingsId: z16.string().optional(),
+      siteUrl: z16.string().optional()
+    },
+    annotations: {
+      readOnlyHint: false,
+      destructiveHint: true,
+      idempotentHint: false,
+      openWorldHint: true
+    }
+  },
+  {
+    name: "deploy_manage",
+    title: "Deploy Management",
+    description: "Deploy walkerOS flows and manage deployments. For get/delete actions pass flowId (required) plus optional slug to disambiguate when a flow has multiple active deployments. If a flow has >=2 active deployments and no slug is supplied, the tool returns a MULTIPLE_DEPLOYMENTS error with a details[] list showing each deployment's slug, type, status, and updatedAt.",
+    inputSchema: {
+      action: z16.enum(["deploy", "list", "get", "delete"]),
+      projectId: z16.string().optional(),
+      flowId: z16.string().optional(),
+      slug: z16.string().optional(),
+      type: z16.enum(["web", "server"]).optional(),
+      status: z16.string().optional(),
+      wait: z16.boolean().optional(),
+      flowName: z16.string().optional()
+    },
+    annotations: {
+      readOnlyHint: false,
+      destructiveHint: true,
+      idempotentHint: false,
+      openWorldHint: true
+    }
+  },
+  {
+    name: "flow_validate",
+    title: "Validate Flow",
+    description: "Validate walkerOS events, flow configurations, mapping rules, or data contracts. Accepts JSON strings, file paths, or URLs as input. Returns validation results with errors, warnings, and details.",
+    inputSchema: schemas6.ValidateInputShape,
+    annotations: {
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: false
+    }
+  },
+  {
+    name: "flow_bundle",
+    title: "Bundle Flow",
+    description: "Bundle a walkerOS flow configuration into deployable JavaScript. Resolves all destinations, sources, and transformers, then outputs a tree-shaken production bundle. Returns bundle statistics. Set remote: true to use the walkerOS cloud service instead of local build tools.",
+    inputSchema: {
+      ...schemas6.BundleInputShape,
+      remote: z16.boolean().optional(),
+      content: z16.record(z16.string(), z16.unknown()).optional()
+    },
+    annotations: {
+      readOnlyHint: false,
+      destructiveHint: false,
+      idempotentHint: false,
+      openWorldHint: true
+    }
+  },
+  {
+    name: "flow_simulate",
+    title: "Simulate Flow",
+    description: 'Simulate events through a walkerOS flow without making real API calls. For destinations: event is a walkerOS event { name: "entity action", data: {...} }. For sources: event is { content: ..., trigger?: { type?, options? }, env?: {...} }. Use step to target a specific step. Use flow_examples to discover available test data. IMPORTANT: Destinations with require (e.g. require: ["consent"]) stay pending until that collector event fires, simulation will error "not found" if require is not satisfied. Remove require from config or provide consent/user events before simulating. Separately, destinations with consent (e.g. consent: { marketing: true }) only receive events where the event includes matching consent. Mapping transforms event names and data at the destination level. Policy redacts or injects fields before mapping runs.',
+    inputSchema: {
+      configPath: schemas6.SimulateInputShape.configPath,
+      event: z16.union([z16.record(z16.string(), z16.unknown()), z16.string()]).optional(),
+      flow: schemas6.SimulateInputShape.flow,
+      platform: schemas6.SimulateInputShape.platform,
+      step: schemas6.SimulateInputShape.step,
+      verbose: z16.boolean().optional()
+    },
+    annotations: {
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: false
+    }
+  },
+  {
+    name: "flow_push",
+    title: "Push Events",
+    description: "Push a real event through a walkerOS flow to actual destinations. Makes real API calls to real endpoints. Best suited for server-side flows, web flows should use flow_simulate for testing.",
+    inputSchema: {
+      configPath: schemas6.PushInputShape.configPath,
+      event: z16.record(z16.string(), z16.unknown()),
+      flow: schemas6.PushInputShape.flow,
+      platform: schemas6.PushInputShape.platform
+    },
+    annotations: {
+      readOnlyHint: false,
+      destructiveHint: true,
+      idempotentHint: false,
+      openWorldHint: true
+    }
+  },
+  {
+    name: "flow_examples",
+    title: "Flow Examples",
+    description: "List all step examples in a walkerOS flow configuration. Shows example names, step locations, and in/out shapes. Use this to discover available test fixtures and simulation data.",
+    inputSchema: {
+      configPath: z16.string().min(1),
+      flow: z16.string().optional(),
+      step: z16.string().optional(),
+      full: z16.boolean().optional(),
+      includeHidden: z16.boolean().optional()
+    },
+    annotations: {
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: false
+    }
+  },
+  {
+    name: "flow_load",
+    title: "Load or Create Flow",
+    description: "Load an existing flow configuration from a local file path, URL, or walkerOS API (by flow ID). Or create a new empty flow by specifying a platform (web or server). Use the add-step prompt to add sources, destinations, transformers, or stores to the flow.",
+    inputSchema: {
+      source: z16.string().optional(),
+      platform: z16.enum(["web", "server"]).optional()
+    },
+    annotations: {
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: true
+    }
+  },
+  {
+    name: "package_search",
+    title: "Search Package",
+    description: "Start here for package discovery. Never guess package names, use this tool first to find exact names. Without package name: returns catalog filtered by type/platform. With package name: returns metadata, hint keys, and example summaries.",
+    inputSchema: {
+      package: z16.string().min(1).optional(),
+      type: z16.enum(["source", "destination", "transformer", "store"]).optional(),
+      platform: z16.enum(["web", "server"]).optional(),
+      version: z16.string().optional()
+    },
+    annotations: {
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: false
+    }
+  },
+  {
+    name: "package_get",
+    title: "Get Package",
+    description: 'Requires exact package name, do not guess names, use package_search first to find them. Returns schemas + hint texts + example summaries by default (lightweight). Use section parameter for full content: "hints" (with code blocks), "examples" (full in/out data), or "all".',
+    inputSchema: {
+      package: z16.string().min(1),
+      version: z16.string().optional(),
+      section: z16.enum(["hints", "examples", "all"]).optional()
+    },
+    annotations: {
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: true
+    }
+  },
+  {
+    name: "feedback",
+    title: "Send Feedback",
+    description: "Send feedback about walkerOS",
+    inputSchema: {
+      text: z16.string(),
+      anonymous: z16.boolean().optional()
+    },
+    annotations: {
+      readOnlyHint: false,
+      destructiveHint: false,
+      idempotentHint: false,
+      openWorldHint: true
+    }
+  }
+];
+
+// src/index.ts
+function createToolHandlers(client) {
+  const specs = [
+    createAuthToolSpec(client),
+    createProjectManageToolSpec(client),
+    createFlowManageToolSpec(client),
+    createDeployManageToolSpec(client),
+    createFeedbackToolSpec(client),
+    createFlowValidateToolSpec(),
+    createFlowBundleToolSpec(),
+    createFlowSimulateToolSpec(),
+    createFlowPushToolSpec(),
+    createFlowExamplesToolSpec(),
+    createFlowLoadToolSpec(),
+    createPackageSearchToolSpec(),
+    createPackageGetToolSpec()
+  ];
+  return Object.fromEntries(specs.map((s) => [s.name, s]));
+}
+export {
+  HttpToolClient,
+  TOOL_DEFINITIONS,
+  createStreamableHttpHandler,
+  createToolHandlers,
+  createWalkerOSMcpServer,
+  flowCanvasResult,
+  isFlowCanvasResult,
+  redactNestedStrings,
+  wrapUserData
+};
 //# sourceMappingURL=index.js.map