@walkeros/mcp 4.7.0-next-1790722899482 → 4.7.0

package/dist/stdio.js

@@ -14,28 +14,52 @@ import { mcpResult, mcpError } from "@walkeros/core";
 
 // src/schemas/output.ts
 import { z } from "zod";
+var ValidateIssueFields = {
+  path: z.string(),
+  message: z.string(),
+  value: z.unknown().optional(),
+  code: z.string().optional().describe("Stable code (the documented validate code list)"),
+  keyword: z.string().optional().describe("JSON Schema keyword of an ENTRY_SCHEMA finding")
+};
 var ValidateOutputShape = {
   valid: z.boolean().describe("Whether validation passed"),
   type: z.union([
     z.enum(["contract", "entry", "event", "flow", "mapping"]),
     z.string().regex(/^(destinations|sources|transformers)\.\w+$/)
   ]).describe("What was validated"),
-  errors: z.array(
-    z.object({
-      path: z.string(),
-      message: z.string(),
-      value: z.unknown().optional(),
-      code: z.string().optional()
-    })
-  ).describe("Validation errors"),
+  errors: z.array(z.object(ValidateIssueFields)).describe("Validation errors"),
   warnings: z.array(
     z.object({
-      path: z.string(),
-      message: z.string(),
+      ...ValidateIssueFields,
       suggestion: z.string().optional()
     })
   ).describe("Validation warnings"),
-  details: z.record(z.string(), z.unknown()).describe("Additional validation details")
+  details: z.object({
+    scope: z.object({
+      flows: z.array(z.string()),
+      entry: z.object({
+        section: z.string().optional(),
+        key: z.string(),
+        flows: z.array(z.string()),
+        searchedFlows: z.array(z.string())
+      }).optional(),
+      checks: z.array(z.string()),
+      offline: z.literal(true).optional()
+    }).optional().describe("What the run covered"),
+    skipped: z.array(
+      z.object({
+        path: z.string(),
+        check: z.string(),
+        reason: z.string(),
+        code: z.string()
+      })
+    ).optional().describe("Checks in scope that did not run, with the reason"),
+    deferred: z.array(z.object({ path: z.string(), reference: z.string() })).optional().describe("Values known only at runtime, not schema-checked")
+  }).catchall(z.unknown()).describe("Additional validation details"),
+  _hints: z.object({
+    next: z.array(z.string()).optional(),
+    warnings: z.array(z.string()).optional()
+  }).optional().describe("Suggested next steps")
 };
 var BundleOutputShape = {
   success: z.boolean().describe("Whether bundling succeeded"),
@@ -161,42 +185,14 @@ async function loadValidateInput(runtime, input, type) {
     throw error;
   }
 }
-var DEPRECATED_STORE_PACKAGE = "@walkeros/store-memory";
-function detectDeprecatedStorePackages(config) {
-  const errors = [];
-  if (!config || typeof config !== "object") return errors;
-  const flows = config.flows;
-  if (!flows || typeof flows !== "object") return errors;
-  for (const [flowName, flowEntry] of Object.entries(
-    flows
-  )) {
-    if (!flowEntry || typeof flowEntry !== "object") continue;
-    const stores = flowEntry.stores;
-    if (!stores || typeof stores !== "object") continue;
-    for (const [storeId, storeEntry] of Object.entries(
-      stores
-    )) {
-      if (!storeEntry || typeof storeEntry !== "object") continue;
-      const pkg = storeEntry.package;
-      if (pkg === DEPRECATED_STORE_PACKAGE) {
-        errors.push({
-          path: `flows.${flowName}.stores.${storeId}`,
-          message: `Store "${storeId}" uses ${DEPRECATED_STORE_PACKAGE}, which has been removed. Use the built-in cache by omitting cache.store, or remove the store declaration if it was only used as a cache target.`,
-          code: "DEPRECATED_PACKAGE"
-        });
-      }
-    }
-  }
-  return errors;
-}
 var TITLE = "Validate Flow";
-var DESCRIPTION = "Validate walkerOS events, flow configurations, mapping rules, or data contracts. Accepts JSON strings, file paths, or URLs as input; on the hosted server only inline JSON or a saved flow id (flow_ or cfg_), no file paths or URLs. Returns validation results with errors, warnings, and details.";
+var DESCRIPTION = "Validate walkerOS events, flow configurations, mapping rules, or data contracts. Accepts JSON strings, file paths, or URLs as input; on the hosted server only inline JSON or a saved flow id (flow_ or cfg_), no file paths or URLs. With only type and input, a flow runs every check on every flow and step, including each package's settings schema (fetched from the package CDN; offline: true skips that and says so). flow and path narrow the run; strict turns warnings and skips into failures: valid is false. Returns valid, errors and warnings with stable codes, and details.scope (what was checked), details.skipped (checks that could not run) and details.deferred (values known only at runtime).";
 var inputSchema = schemas.ValidateInputShape;
 var annotations = {
   readOnlyHint: true,
   destructiveHint: false,
   idempotentHint: true,
-  openWorldHint: false
+  openWorldHint: true
 };
 function createFlowValidateToolSpec(runtime) {
   return {
@@ -209,41 +205,46 @@ function createFlowValidateToolSpec(runtime) {
   };
 }
 async function flowValidateHandlerBody(runtime, input) {
+  const parsed = schemas.ValidateInputSchema.safeParse(input ?? {});
+  if (!parsed.success) {
+    return mcpError(parsed.error, "Check the flow_validate input fields");
+  }
   const {
     type,
     input: validateInput,
     flow,
-    path: path2
-  } = input ?? {};
+    path: path3,
+    strict,
+    offline
+  } = parsed.data;
   try {
     const resolved = await loadValidateInput(runtime, validateInput, type);
+    const configDir = runtime.baseDir?.(validateInput);
     const result = await validate(type, resolved, {
       flow,
-      path: path2
+      path: path3,
+      strict,
+      offline,
+      ...configDir ? { configDir } : {}
     });
-    let augmented = result;
-    if (type === "flow") {
-      const deprecatedErrors = detectDeprecatedStorePackages(resolved);
-      if (deprecatedErrors.length > 0) {
-        augmented = {
-          ...result,
-          valid: false,
-          errors: [...result.errors, ...deprecatedErrors]
-        };
-      }
-    }
-    const hints = augmented.valid ? {
-      next: runtime.simulate ? [
-        "Use flow_simulate to test event flow",
-        "Use flow_bundle to build"
-      ] : [HINT_OUT_OF_PROCESS]
-    } : {
+    const skipped = result.details.skipped ?? [];
+    const next = runtime.simulate ? ["Use flow_simulate to test event flow", "Use flow_bundle to build"] : [HINT_OUT_OF_PROCESS];
+    const hints = !result.valid && result.errors.length === 0 ? {
+      next: [
+        `strict: ${result.warnings.length} warning(s) and ${skipped.length} skipped check(s) count as failures; resolve them, or run without strict`
+      ]
+    } : !result.valid ? {
       next: [
         "Fix errors above, then run flow_validate again",
         "Read walkeros://reference/flow-schema for correct structure"
       ]
-    };
-    return mcpResult(augmented, hints);
+    } : skipped.length > 0 ? {
+      next: [
+        `Valid in checked scope; ${skipped.length} check(s) skipped, see details.skipped`,
+        ...next
+      ]
+    } : { next };
+    return mcpResult(result, hints);
   } catch (error) {
     return mcpError(
       error,
@@ -266,15 +267,30 @@ function registerFlowValidateTool(server, runtime) {
       outputSchema: ValidateOutputShape,
       annotations: spec.annotations
     },
-    // SDK infers handler type from inputSchema shape; ToolSpec.handler is the
-    // type-erased (input: unknown) => Promise<unknown> form by design.
-    spec.handler
+    (args) => flowValidateHandlerBody(runtime, args)
   );
 }
 
 // src/tools/bundle.ts
 import { schemas as schemas2 } from "@walkeros/cli/dev";
-import { mcpResult as mcpResult2, mcpError as mcpError2 } from "@walkeros/core";
+import { mcpResult as mcpResult2, mcpError as mcpError3 } from "@walkeros/core";
+
+// src/tools/parse-input.ts
+import { z as z2 } from "zod";
+import { mcpError as mcpError2 } from "@walkeros/core";
+function inputIssuesMessage(error) {
+  return error.issues.map((issue) => `${issue.path.join(".") || "input"}: ${issue.message}`).join("; ");
+}
+function parseToolInput(shape, raw) {
+  const parsed = z2.object(shape).safeParse(raw ?? {});
+  if (!parsed.success) {
+    return {
+      ok: false,
+      error: mcpError2(new Error(inputIssuesMessage(parsed.error)))
+    };
+  }
+  return { ok: true, data: parsed.data };
+}
 
 // src/tools/resolve-config-path.ts
 async function resolveConfigPath(client, configPath) {
@@ -306,10 +322,12 @@ function createFlowBundleToolSpec(client, runtime) {
   };
 }
 async function flowBundleHandlerBody(client, runtime, input) {
-  const { configPath, flow, stats, output } = input ?? {};
+  const parsed = parseToolInput(inputSchema2, input);
+  if (!parsed.ok) return parsed.error;
+  const { configPath, flow, stats, output } = parsed.data;
   if (!runtime.bundle) {
     const refusal = unavailableOperation("bundle");
-    return mcpError2(refusal, refusal.hint);
+    return mcpError3(refusal, refusal.hint);
   }
   try {
     const resolvedConfigPath = await resolveConfigPath(client, configPath);
@@ -329,9 +347,8 @@ async function flowBundleHandlerBody(client, runtime, input) {
         }
       );
     }
-    const output_ = result;
     return mcpResult2(
-      { success: true, ...output_ },
+      { success: true, ...result },
       {
         next: [
           "Use flow_simulate to test",
@@ -340,7 +357,7 @@ async function flowBundleHandlerBody(client, runtime, input) {
       }
     );
   } catch (error) {
-    return mcpError2(
+    return mcpError3(
       error,
       refusalHint(error, "Run flow_validate for detailed error messages")
     );
@@ -358,54 +375,39 @@ function registerFlowBundleTool(server, client, runtime) {
       outputSchema: BundleOutputShape,
       annotations: spec.annotations
     },
-    // SDK infers handler type from inputSchema shape; ToolSpec.handler is the
-    // type-erased (input: unknown) => Promise<unknown> form by design.
-    spec.handler
+    (args) => flowBundleHandlerBody(client, runtime, args)
   );
 }
 
 // src/tools/simulate.ts
-import { z as z2 } from "zod";
+import { z as z3 } from "zod";
 import { schemas as schemas3 } from "@walkeros/cli/dev";
-import { isObject as isObject2, mcpResult as mcpResult3, mcpError as mcpError3 } from "@walkeros/core";
-import { scrubSecrets, toPrintable } from "@walkeros/core/node";
-import { maskKnownNumbers } from "@walkeros/cli";
+import { filterValues, mcpResult as mcpResult4, mcpError as mcpError5 } from "@walkeros/core";
 
 // src/tools/simulate-description.ts
 var FLOW_SIMULATE_DESCRIPTION = `Simulate events through a walkerOS flow without making real API calls. For destinations: event is a walkerOS event { name: "entity action", data: {...} }. For sources: event is { content, trigger?: { type?, options? } }, where content is the walkerOS event { name: "entity action", data: {...} }. Only the simulated source starts. step (required) targets the step to simulate, e.g. "destination.gtag". Use flow_examples to discover available test data. A destination simulation starts only its target destination. A source's own walker commands (e.g. a CMP's walker consent) are returned as elb calls. Consent: state.consent is the collector consent the step starts from (any step; a consent-gated source such as the session source waits for it). A destination with require: ["consent"] waits until consent is present, so pass state.consent to start it; a destination with consent: { marketing: true } receives an event only when that consent is granted in state.consent or in the event's own consent. When a destination sends nothing, the result says why (waiting for its require, or a consent skip). command runs a step example with command (e.g. "consent") on a destination: event is the command's data, state.consent still applies first. Mapping transforms event names and data at the destination level. Policy redacts or injects fields before mapping runs.`;
 
-// src/tools/simulate.ts
-var STEP_TYPES = [
-  "source",
-  "transformer",
-  "collector",
-  "destination"
-];
-function isStepType(value) {
-  return STEP_TYPES.some((t) => t === value);
-}
+// src/tools/egress.ts
+import { isObject as isObject2, mcpResult as mcpResult3 } from "@walkeros/core";
+import { scrubJson, scrubSecrets } from "@walkeros/core/node";
 function scrubbed(result, known) {
-  const text = scrubSecrets(
-    JSON.stringify(maskKnownNumbers(toPrintable(result), known)),
-    { known }
-  );
-  let parsed;
-  try {
-    parsed = JSON.parse(text);
-  } catch {
-    parsed = void 0;
-  }
-  if (!isObject2(parsed))
-    throw new Error("Simulation result could not be redacted as JSON.");
+  const parsed = parseObject(scrubJson(result, { known }));
+  if (!parsed) throw new Error("Result could not be redacted as JSON.");
   return parsed;
 }
 function scrubbedError(response, known) {
   let structuredContent;
   try {
-    structuredContent = scrubbed(response.structuredContent, known);
+    if (response.structuredContent)
+      structuredContent = scrubbed(response.structuredContent, known);
   } catch {
-    structuredContent = {
-      error: "Simulation failed; the error could not be redacted."
+    structuredContent = void 0;
+  }
+  if (structuredContent) {
+    return {
+      ...response,
+      content: [{ type: "text", text: JSON.stringify(structuredContent) }],
+      structuredContent
     };
   }
   return {
@@ -414,9 +416,48 @@ function scrubbedError(response, known) {
       ...part,
       text: scrubSecrets(part.text, { known })
     })),
-    structuredContent
+    structuredContent: { error: "The error could not be redacted." }
+  };
+}
+function scrubbedPushResult(result, known) {
+  const text = scrubJson(result, { known, space: 2 });
+  const parsed = parseObject(text);
+  if (parsed)
+    return mcpResult3({
+      ...parsed,
+      success: result.success,
+      duration: result.duration
+    });
+  return {
+    content: [{ type: "text", text }],
+    structuredContent: { success: result.success, duration: result.duration }
+  };
+}
+function parseObject(text) {
+  try {
+    const parsed = JSON.parse(text);
+    return isObject2(parsed) ? parsed : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function readRun(runtime, input) {
+  if (runtime.loadRun) return runtime.loadRun(input);
+  return {
+    knownSecrets: runtime.knownSecrets ? await runtime.knownSecrets(input) : []
   };
 }
+
+// src/tools/simulate.ts
+var STEP_TYPES = [
+  "source",
+  "transformer",
+  "collector",
+  "destination"
+];
+function isStepType(value) {
+  return STEP_TYPES.some((t) => t === value);
+}
 var TITLE3 = "Simulate Flow";
 var COMMANDS = [
   "config",
@@ -426,29 +467,29 @@ var COMMANDS = [
 ];
 var inputSchema3 = {
   configPath: schemas3.SimulateInputShape.configPath,
-  event: z2.union([z2.record(z2.string(), z2.unknown()), z2.string()]).optional().describe(
+  event: z3.union([z3.record(z3.string(), z3.unknown()), z3.string()]).optional().describe(
     "For destinations: { name, data, consent? }; the event's consent counts toward the destination's consent requirement, on top of state.consent. With command: the command's data, e.g. { marketing: true } for consent. For sources: { content, trigger? } where content is the walkerOS event { name, data }. A web source's page URL goes in trigger.options.url (default http://localhost). Can also be a JSON string or file path."
   ),
   flow: schemas3.SimulateInputShape.flow,
   platform: schemas3.SimulateInputShape.platform,
   // Override the (optional) CLI `step` shape: the simulate handler hard-requires
   // a target step (no all-steps mode), so the registered schema must be honest.
-  step: z2.string().describe(
+  step: z3.string().describe(
     'Required. Target step as "type.name", e.g. "source.demo", "collector.default", "destination.gtag", "transformer.router". A collector step runs enrichment and then collector.next, returning every event the destinations would receive (none after a stop).'
   ),
-  verbose: z2.boolean().optional().describe("Include full payload per destination (default: false)"),
-  ingest: z2.record(z2.string(), z2.unknown()).optional().describe(
+  verbose: z3.boolean().optional().describe("Include full payload per destination (default: false)"),
+  ingest: z3.record(z3.string(), z3.unknown()).optional().describe(
     "Pipeline context a step reads via ctx.ingest, e.g. { url } for a request decoder or { ip, userAgent } for a conversion API. Used for transformer, collector and destination steps (their before chains included); _meta is always set by the runtime."
   ),
-  state: z2.object({
-    consent: z2.record(z2.string(), z2.boolean()).optional(),
-    user: z2.record(z2.string(), z2.unknown()).optional(),
-    globals: z2.record(z2.string(), z2.unknown()).optional(),
-    timing: z2.number().optional()
+  state: z3.object({
+    consent: z3.record(z3.string(), z3.boolean()).optional(),
+    user: z3.record(z3.string(), z3.unknown()).optional(),
+    globals: z3.record(z3.string(), z3.unknown()).optional(),
+    timing: z3.number().optional()
   }).optional().describe(
     "Collector state the step starts from. consent: every step (starts a destination that requires consent and feeds its consent check; for a source, the consent a consent-gated source waits for). user/globals/timing: collector steps, seeded before enrichment runs."
   ),
-  command: z2.enum(COMMANDS).optional().describe(
+  command: z3.enum(COMMANDS).optional().describe(
     "Destination steps only: run this collector command with event as its data instead of pushing it, as a step example with command does."
   )
 };
@@ -472,7 +513,18 @@ function createFlowSimulateToolSpec(client, runtime) {
     handler: (input) => flowSimulateHandlerBody(client, runtime, input)
   };
 }
+function toProperties(value) {
+  if (!value) return void 0;
+  const properties = {};
+  for (const [key, entry] of Object.entries(value)) {
+    const property = filterValues(entry);
+    if (property !== void 0) properties[key] = property;
+  }
+  return properties;
+}
 async function flowSimulateHandlerBody(client, runtime, input) {
+  const parsed = parseToolInput(inputSchema3, input);
+  if (!parsed.ok) return parsed.error;
   const {
     configPath,
     event,
@@ -483,10 +535,10 @@ async function flowSimulateHandlerBody(client, runtime, input) {
     ingest,
     state,
     command
-  } = input ?? {};
+  } = parsed.data;
   if (!runtime.simulate) {
     const refusal = unavailableOperation("simulate");
-    return mcpError3(refusal, refusal.hint);
+    return mcpError5(refusal, refusal.hint);
   }
   let known = [];
   try {
@@ -527,10 +579,25 @@ async function flowSimulateHandlerBody(client, runtime, input) {
       throw new Error("command applies to destination steps only.");
     }
     const resolvedConfigPath = await resolveConfigPath(client, configPath);
-    known = await knownSecretsOf(runtime, resolvedConfigPath);
+    const run = await readRun(runtime, resolvedConfigPath);
+    known = run.knownSecrets;
     const result = await runtime.simulate(
       resolvedConfigPath,
-      { stepType, stepId, event: resolvedEvent, flow, ingest, state, command }
+      {
+        stepType,
+        stepId,
+        event: resolvedEvent,
+        flow,
+        ingest,
+        state: state && {
+          consent: state.consent,
+          user: toProperties(state.user),
+          globals: toProperties(state.globals),
+          timing: state.timing
+        },
+        command,
+        config: run.config
+      }
     );
     const success = !result.error;
     const errorMessage = result.error?.message;
@@ -541,7 +608,7 @@ async function flowSimulateHandlerBody(client, runtime, input) {
       ).length;
       const summary = `Source captured ${eventCount} event${eventCount !== 1 ? "s" : ""} and ${commandCount} command${commandCount !== 1 ? "s" : ""}`;
       const shownCalls = verbose ? result.calls : result.calls.filter((call) => call.fn === "elb");
-      return mcpResult3(
+      return mcpResult4(
         scrubbed(
           {
             success,
@@ -563,7 +630,7 @@ async function flowSimulateHandlerBody(client, runtime, input) {
       );
     }
     if (result.step === "transformer") {
-      return mcpResult3(
+      return mcpResult4(
         scrubbed(
           {
             success,
@@ -580,7 +647,7 @@ async function flowSimulateHandlerBody(client, runtime, input) {
       );
     }
     if (result.step === "collector") {
-      return mcpResult3(
+      return mcpResult4(
         scrubbed(
           {
             success,
@@ -620,21 +687,13 @@ async function flowSimulateHandlerBody(client, runtime, input) {
       ...result.skipped ? { skipped: result.skipped } : {},
       duration: result.duration
     };
-    return mcpResult3(scrubbed(resultObj, known), {
+    return mcpResult4(scrubbed(resultObj, known), {
       next: ["Use flow_bundle to build for production"],
       ...warnings.length > 0 ? { warnings } : {}
     });
   } catch (error) {
     const hint = "Run flow_validate for detailed error messages";
-    return scrubbedError(mcpError3(error, refusalHint(error, hint)), known);
-  }
-}
-async function knownSecretsOf(runtime, input) {
-  if (!runtime.knownSecrets) return [];
-  try {
-    return await runtime.knownSecrets(input);
-  } catch {
-    return [];
+    return scrubbedError(mcpError5(error, refusalHint(error, hint)), known);
   }
 }
 function keysOf(consent) {
@@ -666,21 +725,19 @@ function registerFlowSimulateTool(server, client, runtime) {
       outputSchema: SimulateOutputShape,
       annotations: spec.annotations
     },
-    // SDK infers handler type from inputSchema shape; ToolSpec.handler is the
-    // type-erased (input: unknown) => Promise<unknown> form by design.
-    spec.handler
+    (args) => flowSimulateHandlerBody(client, runtime, args)
   );
 }
 
 // src/tools/push.ts
-import { z as z3 } from "zod";
+import { z as z4 } from "zod";
 import { schemas as schemas4 } from "@walkeros/cli/dev";
-import { mcpResult as mcpResult4, mcpError as mcpError4 } from "@walkeros/core";
+import { mcpError as mcpError6 } from "@walkeros/core";
 var TITLE4 = "Push Events";
 var DESCRIPTION3 = "Push a real event through a walkerOS flow to actual destinations. Makes real API calls to real endpoints. Best suited for server-side flows \u2014 web flows should use flow_simulate for testing.";
 var inputSchema4 = {
   configPath: schemas4.PushInputShape.configPath,
-  event: z3.record(z3.string(), z3.unknown()).describe(
+  event: z4.record(z4.string(), z4.unknown()).describe(
     'Event object, e.g. { name: "page view", data: { title: "Home" } }'
   ),
   flow: schemas4.PushInputShape.flow,
@@ -703,30 +760,42 @@ function createFlowPushToolSpec(runtime) {
   };
 }
 async function flowPushHandlerBody(runtime, input) {
-  const { configPath, event, flow, platform } = input ?? {};
+  const parsed = parseToolInput(inputSchema4, input);
+  if (!parsed.ok) return parsed.error;
+  const { configPath, event, flow, platform } = parsed.data;
   if (!runtime.push) {
     const refusal = unavailableOperation("push");
-    return mcpError4(refusal, refusal.hint);
+    return mcpError6(refusal, refusal.hint);
   }
+  let known = [];
   try {
+    const run = await readRun(runtime, configPath);
+    known = run.knownSecrets;
     const result = await runtime.push(configPath, event, {
       flow,
-      platform
+      platform,
+      config: run.config
     });
     if (!result.success) {
-      return mcpError4(
-        new Error(result.error || "Push failed"),
-        "Check destination configuration and connectivity."
+      return scrubbedError(
+        mcpError6(
+          new Error(result.error || "Push failed"),
+          "Check destination configuration and connectivity."
+        ),
+        known
       );
     }
-    return mcpResult4(result);
+    return scrubbedPushResult(result, known);
   } catch (error) {
-    return mcpError4(
-      error,
-      refusalHint(
+    return scrubbedError(
+      mcpError6(
         error,
-        "Check configPath and event format. For web flows, use flow_simulate."
-      )
+        refusalHint(
+          error,
+          "Check configPath and event format. For web flows, use flow_simulate."
+        )
+      ),
+      known
     );
   }
 }
@@ -742,15 +811,13 @@ function registerFlowPushTool(server, runtime) {
       outputSchema: PushOutputShape,
       annotations: spec.annotations
     },
-    // SDK infers handler type from inputSchema shape; ToolSpec.handler is the
-    // type-erased (input: unknown) => Promise<unknown> form by design.
-    spec.handler
+    (args) => flowPushHandlerBody(runtime, args)
   );
 }
 
 // src/tools/examples.ts
-import { z as z4 } from "zod";
-import { fetchPackage, mcpResult as mcpResult5, mcpError as mcpError5 } from "@walkeros/core";
+import { z as z5 } from "zod";
+import { fetchPackage, mcpResult as mcpResult5, mcpError as mcpError7 } from "@walkeros/core";
 import { resolveExportName, selectDevExamples } from "@walkeros/cli";
 
 // src/catalog.ts
@@ -758,7 +825,7 @@ var NPM_SEARCH_URL = "https://registry.npmjs.org/-/v1/search";
 var JSDELIVR_BASE = "https://cdn.jsdelivr.net/npm";
 var WALKEROS_JSON_PATH = "dist/walkerOS.json";
 var CACHE_TTL = 5 * 60 * 1e3;
-var CLIENT_HEADER = "walkeros-mcp/4.7.0-next-1790722899482";
+var CLIENT_HEADER = "walkeros-mcp/4.7.0";
 function getPackageBaseUrl() {
   return process.env.WALKEROS_APP_URL || void 0;
 }
@@ -910,20 +977,53 @@ function applyFilters(entries, filters) {
   return results;
 }
 
+// src/tools/narrow.ts
+import { schemas as schemas5 } from "@walkeros/core/dev";
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function stringField(value, key) {
+  if (!isRecord(value)) return void 0;
+  const field = value[key];
+  return typeof field === "string" ? field : void 0;
+}
+function recordField(value, key) {
+  if (!isRecord(value)) return void 0;
+  const field = value[key];
+  return isRecord(field) ? field : void 0;
+}
+function fieldsOf(value) {
+  return isRecord(value) ? value : {};
+}
+function isFlowJson(value) {
+  return isRecord(value) && isRecord(value.flows);
+}
+function stepExamplesOf(value) {
+  if (!isRecord(value)) return void 0;
+  const examples = {};
+  const skipped = [];
+  for (const [name, example] of Object.entries(value)) {
+    const parsed = schemas5.FlowSchemas.StepExampleSchema.safeParse(example);
+    if (parsed.success) examples[name] = parsed.data;
+    else skipped.push(name);
+  }
+  return { examples, skipped };
+}
+
 // src/tools/examples.ts
 var MAX_PACKAGE_LOOKUPS = 25;
 var TITLE5 = "Flow Examples";
 var DESCRIPTION4 = 'List all step examples in a walkerOS flow configuration. Shows example names, step locations, and in/out shapes. Inline examples on a step take precedence; steps without inline examples fall back to the examples shipped by their referenced package. Each result is tagged with its source ("inline" or "package"). On the hosted server configPath accepts only inline JSON or a saved flow id (flow_ or cfg_), no file paths or URLs. Use this to discover available test fixtures and simulation data.';
 var inputSchema5 = {
-  configPath: z4.string().min(1).describe(
+  configPath: z5.string().min(1).describe(
     "Inline JSON string, file path, or URL of a flow configuration (hosted server: inline JSON or a saved flow id only)"
   ),
-  flow: z4.string().optional().describe("Flow name for multi-flow configs"),
-  step: z4.string().optional().describe('Filter to a specific step (e.g., "destination.gtag")'),
-  full: z4.boolean().optional().describe(
+  flow: z5.string().optional().describe("Flow name for multi-flow configs"),
+  step: z5.string().optional().describe('Filter to a specific step (e.g., "destination.gtag")'),
+  full: z5.boolean().optional().describe(
     "Return full in/out/mapping data for each example (default: false, returns metadata only)"
   ),
-  includeHidden: z4.boolean().optional().describe(
+  includeHidden: z5.boolean().optional().describe(
     "Include examples marked public: false (default: false). Set true for test/debug discovery."
   )
 };
@@ -944,9 +1044,14 @@ function createFlowExamplesToolSpec(runtime) {
   };
 }
 async function flowExamplesHandlerBody(runtime, input) {
-  const { configPath, flow, step, full, includeHidden } = input ?? {};
+  const parsed = parseToolInput(inputSchema5, input);
+  if (!parsed.ok) return parsed.error;
+  const { configPath, flow, step, full, includeHidden } = parsed.data;
   try {
     const rawConfig = await runtime.load(configPath);
+    if (!isFlowJson(rawConfig)) {
+      throw new Error("Config is not a flow config: it has no flows object.");
+    }
     const flowNames = Object.keys(rawConfig.flows || {});
     const flowName = flow || (flowNames.length === 1 ? flowNames[0] : void 0);
     if (!flowName) {
@@ -999,6 +1104,7 @@ async function flowExamplesHandlerBody(runtime, input) {
     };
     const packageLookups = /* @__PURE__ */ new Map();
     let skippedPackages = false;
+    const skippedExamples = [];
     const packageFor = (packageName) => {
       const existing = packageLookups.get(packageName);
       if (existing) return existing;
@@ -1015,10 +1121,7 @@ async function flowExamplesHandlerBody(runtime, input) {
         { examples: info.examples, exportExamples: info.exportExamples },
         exportName
       );
-      const stepExamples = selected?.step;
-      if (stepExamples && typeof stepExamples === "object")
-        return stepExamples;
-      return void 0;
+      return stepExamplesOf(selected?.step);
     };
     const stepTypes = [
       { key: "sources", type: "source" },
@@ -1030,9 +1133,7 @@ async function flowExamplesHandlerBody(runtime, input) {
       for (const [name, ref] of Object.entries(refs)) {
         if (step && `${type}.${name}` !== step) continue;
         if (ref.examples) {
-          examples.push(
-            ...toItems(ref.examples, type, name, "inline")
-          );
+          examples.push(...toItems(ref.examples, type, name, "inline"));
           continue;
         }
         if (!ref.package) continue;
@@ -1040,8 +1141,12 @@ async function flowExamplesHandlerBody(runtime, input) {
         if (!info) continue;
         const { exportName } = resolveExportName(flowSettings, type, name);
         const packageExamples = stepExamplesFor(info, exportName);
-        if (packageExamples)
-          examples.push(...toItems(packageExamples, type, name, "package"));
+        if (!packageExamples) continue;
+        examples.push(
+          ...toItems(packageExamples.examples, type, name, "package")
+        );
+        for (const exampleName of packageExamples.skipped)
+          skippedExamples.push(`${type}.${name}.${exampleName}`);
       }
     }
     const result = {
@@ -1055,6 +1160,11 @@ async function flowExamplesHandlerBody(runtime, input) {
         "No examples found. Add examples to step entries, or reference a package that ships examples (see package_get)."
       );
     }
+    if (skippedExamples.length > 0) {
+      warnings.push(
+        `Skipped ${skippedExamples.length} package example(s) that do not match the step example schema: ${skippedExamples.join(", ")}.`
+      );
+    }
     if (skippedPackages) {
       warnings.push(
         `Package examples were looked up for the first ${MAX_PACKAGE_LOOKUPS} packages only. Use step to narrow the result.`
@@ -1068,7 +1178,7 @@ async function flowExamplesHandlerBody(runtime, input) {
     };
     return mcpResult5(result, hints);
   } catch (error) {
-    return mcpError5(
+    return mcpError7(
       error,
       refusalHint(error, "Check configPath \u2014 expected a flow.json file")
     );
@@ -1086,25 +1196,23 @@ function registerFlowExamplesTool(server, runtime) {
       outputSchema: ExamplesListOutputShape,
       annotations: spec.annotations
     },
-    // SDK infers handler type from inputSchema shape; ToolSpec.handler is the
-    // type-erased (input: unknown) => Promise<unknown> form by design.
-    spec.handler
+    (args) => flowExamplesHandlerBody(runtime, args)
   );
 }
 
 // src/tools/package.ts
-import { z as z5 } from "zod";
-import { fetchPackage as fetchPackage2, mcpResult as mcpResult6, mcpError as mcpError6 } from "@walkeros/core";
+import { z as z6 } from "zod";
+import { fetchPackage as fetchPackage2, mcpResult as mcpResult6, mcpError as mcpError8 } from "@walkeros/core";
 import { mergeConfigSchema } from "@walkeros/core/dev";
 var SEARCH_TITLE = "Search Package";
 var SEARCH_DESCRIPTION = "Start here for package discovery. Never guess package names: use this tool first to find exact names. Without package name: returns catalog filtered by type/platform. With package name: returns metadata, hint keys, and example summaries.";
 var searchInputSchema = {
-  package: z5.string().min(1).optional().describe(
+  package: z6.string().min(1).optional().describe(
     "Exact npm package name for detailed lookup (e.g., @walkeros/web-destination-snowplow)"
   ),
-  type: z5.enum(["source", "destination", "transformer", "store"]).optional().describe("Filter by package type (browse mode)"),
-  platform: z5.enum(["web", "server"]).optional().describe("Filter by platform (browse mode, includes universal packages)"),
-  version: z5.string().optional().describe("Package version for detailed lookup (default: latest)")
+  type: z6.enum(["source", "destination", "transformer", "store"]).optional().describe("Filter by package type (browse mode)"),
+  platform: z6.enum(["web", "server"]).optional().describe("Filter by platform (browse mode, includes universal packages)"),
+  version: z6.string().optional().describe("Package version for detailed lookup (default: latest)")
 };
 var searchAnnotations = {
   readOnlyHint: true,
@@ -1123,12 +1231,9 @@ function createPackageSearchToolSpec() {
   };
 }
 async function packageSearchHandlerBody(input) {
-  const {
-    package: packageName,
-    type,
-    platform,
-    version
-  } = input ?? {};
+  const parsed = parseToolInput(searchInputSchema, input);
+  if (!parsed.ok) return parsed.error;
+  const { package: packageName, type, platform, version } = parsed.data;
   const baseUrl = getPackageBaseUrl();
   if (!packageName) {
     const { entries, warnings } = await fetchCatalog({
@@ -1161,7 +1266,7 @@ async function packageSearchHandlerBody(input) {
       next: ["Use package_get for schemas and examples"]
     });
   } catch (error) {
-    return mcpError6(
+    return mcpError8(
       error,
       "Package not found. Use package_search without parameters to browse available packages."
     );
@@ -1178,19 +1283,17 @@ function registerPackageSearchTool(server) {
       // No outputSchema: browse mode returns {catalog, count}, lookup returns metadata — incompatible shapes
       annotations: spec.annotations
     },
-    // SDK infers handler type from inputSchema shape; ToolSpec.handler is the
-    // type-erased (input: unknown) => Promise<unknown> form by design.
-    spec.handler
+    (args) => packageSearchHandlerBody(args)
   );
 }
 var GET_TITLE = "Get Package";
 var GET_DESCRIPTION = 'Requires exact package name: do not guess names, use package_search first to find them. Returns schemas + hint texts + example summaries by default (lightweight). Use section parameter for full content: "hints" (with code blocks), "examples" (full in/out data), or "all".';
 var getInputSchema = {
-  package: z5.string().min(1).describe(
+  package: z6.string().min(1).describe(
     "Exact npm package name (e.g., @walkeros/web-destination-snowplow)"
   ),
-  version: z5.string().optional().describe("Package version (default: latest)"),
-  section: z5.enum(["hints", "examples", "all"]).optional().describe(
+  version: z6.string().optional().describe("Package version (default: latest)"),
+  section: z6.enum(["hints", "examples", "all"]).optional().describe(
     "Section to expand with full content. Default: summary view with schemas + hint texts + example descriptions"
   )
 };
@@ -1210,12 +1313,35 @@ function createPackageGetToolSpec() {
     handler: (input) => packageGetHandlerBody(input)
   };
 }
+var STEP_PACKAGE_TYPES = [
+  "source",
+  "destination",
+  "transformer",
+  "store"
+];
+function isStepPackageType(type) {
+  return STEP_PACKAGE_TYPES.some((stepType) => stepType === type);
+}
+function shapeSchemas(type, schemas8) {
+  const shaped = {};
+  if (isStepPackageType(type)) {
+    const settings = recordField(schemas8, "settings");
+    const credentials = recordField(schemas8, "credentials");
+    shaped.config = mergeConfigSchema(type, {
+      ...schemas8,
+      settings,
+      credentials
+    });
+  }
+  for (const [key, value] of Object.entries(schemas8)) {
+    if (key !== "settings") shaped[key] = value;
+  }
+  return shaped;
+}
 async function packageGetHandlerBody(input) {
-  const {
-    package: packageName,
-    version,
-    section
-  } = input ?? {};
+  const parsed = parseToolInput(getInputSchema, input);
+  if (!parsed.ok) return parsed.error;
+  const { package: packageName, version, section } = parsed.data;
   const baseUrl = getPackageBaseUrl();
   try {
     const info = await fetchPackage2(packageName, {
@@ -1223,33 +1349,29 @@ async function packageGetHandlerBody(input) {
       baseUrl,
       client: CLIENT_HEADER
     });
-    const mergedSchemas = {};
-    if (info.type) {
-      mergedSchemas.config = mergeConfigSchema(
-        info.type,
-        info.schemas
-      );
-    }
-    for (const [key, value] of Object.entries(info.schemas)) {
-      if (key !== "settings") {
-        mergedSchemas[key] = value;
-      }
-    }
     const result = {
       package: info.packageName,
       version: info.version,
       type: info.type,
       platform: normalizePlatform(info.platform),
-      schemas: mergedSchemas
+      schemas: shapeSchemas(info.type, info.schemas)
     };
+    if (info.exportSchemas) {
+      result.exportSchemas = Object.fromEntries(
+        Object.entries(info.exportSchemas).map(([name, schemas8]) => [
+          name,
+          shapeSchemas(info.type, schemas8)
+        ])
+      );
+    }
     if (info.hints) {
       if (section === "hints" || section === "all") {
         result.hints = info.hints;
       } else {
         const hintSummary = {};
         for (const [key, hint] of Object.entries(info.hints)) {
-          const h = hint;
-          hintSummary[key] = { text: h.text };
+          const text = stringField(hint, "text");
+          if (text !== void 0) hintSummary[key] = { text };
         }
         result.hints = hintSummary;
       }
@@ -1262,7 +1384,7 @@ async function packageGetHandlerBody(input) {
     }
     return mcpResult6(result);
   } catch (error) {
-    return mcpError6(
+    return mcpError8(
       error,
       "Use package_search to browse available package names."
     );
@@ -1279,15 +1401,13 @@ function registerGetPackageSchemaTool(server) {
       // No outputSchema: removed to avoid SDK -32602 crashes on unexpected field values
       annotations: spec.annotations
     },
-    // SDK infers handler type from inputSchema shape; ToolSpec.handler is the
-    // type-erased (input: unknown) => Promise<unknown> form by design.
-    spec.handler
+    (args) => packageGetHandlerBody(args)
   );
 }
 
 // src/tools/flow-load.ts
-import { z as z6 } from "zod";
-import { mcpResult as mcpResult7, mcpError as mcpError7 } from "@walkeros/core";
+import { z as z7 } from "zod";
+import { mcpResult as mcpResult7, mcpError as mcpError9 } from "@walkeros/core";
 
 // src/types.ts
 function isAuthError(error) {
@@ -1394,16 +1514,16 @@ var SERVER_SKELETON = {
 var TITLE6 = "Load or Create Flow";
 var DESCRIPTION5 = "Load an existing flow configuration from a local file path, URL, or walkerOS API (by flow ID). On the hosted server only inline JSON or a saved flow id is accepted, no file paths or URLs. Or create a new empty flow by specifying a platform (web or server). Use the add-step prompt to add sources, destinations, transformers, or stores to the flow.";
 var inputSchema6 = {
-  source: z6.string().optional().describe(
+  source: z7.string().optional().describe(
     "Flow source: local file path (./flow.json), URL (https://...), inline JSON string, or API flow ID (cfg_...). Omit to create a new flow."
   ),
-  platform: z6.enum(["web", "server"]).optional().describe(
+  platform: z7.enum(["web", "server"]).optional().describe(
     "Platform for new flows. Required when source is omitted. web = browser tracking, server = Node.js HTTP."
   )
 };
 var outputSchema = {
-  version: z6.number().describe("Flow config version"),
-  flows: z6.record(z6.string(), z6.unknown()).describe("Flow entries")
+  version: z7.number().describe("Flow config version"),
+  flows: z7.record(z7.string(), z7.unknown()).describe("Flow entries")
 };
 var annotations6 = {
   readOnlyHint: true,
@@ -1422,11 +1542,13 @@ function createFlowLoadToolSpec(client, runtime) {
   };
 }
 async function flowLoadHandlerBody(client, runtime, input) {
-  const { source, platform } = input ?? {};
+  const parsed = parseToolInput(inputSchema6, input);
+  if (!parsed.ok) return parsed.error;
+  const { source, platform } = parsed.data;
   if (source && isCloudId(source)) {
     const resolvedProjectId = resolveDefaultProject(client, void 0);
     if (!resolvedProjectId) {
-      return mcpError7(new Error(NO_DEFAULT_PROJECT_ERROR));
+      return mcpError9(new Error(NO_DEFAULT_PROJECT_ERROR));
     }
     try {
       const flow = await client.getFlow({
@@ -1440,7 +1562,7 @@ async function flowLoadHandlerBody(client, runtime, input) {
         }
       );
     } catch (error) {
-      return mcpError7(error, isAuthError(error) ? AUTH_HINT : void 0);
+      return mcpError9(error, isAuthError(error) ? AUTH_HINT : void 0);
     }
   }
   try {
@@ -1451,7 +1573,7 @@ async function flowLoadHandlerBody(client, runtime, input) {
       });
     }
     if (!platform) {
-      return mcpError7(
+      return mcpError9(
         new Error(
           "Provide source (file path, URL, or flow ID) to load existing flow, or platform (web/server) to create a new one."
         )
@@ -1465,11 +1587,11 @@ async function flowLoadHandlerBody(client, runtime, input) {
       ]
     });
   } catch (error) {
-    if (error instanceof RuntimeRefusal) return mcpError7(error, error.hint);
+    if (error instanceof RuntimeRefusal) return mcpError9(error, error.hint);
     const msg = error instanceof Error ? error.message : "";
     if (msg.includes("not found") || msg.includes("ENOENT"))
-      return mcpError7(error, "Check configPath \u2014 expected a flow.json file");
-    return mcpError7(error);
+      return mcpError9(error, "Check configPath \u2014 expected a flow.json file");
+    return mcpError9(error);
   }
 }
 function registerFlowLoadTool(server, client, runtime) {
@@ -1484,20 +1606,18 @@ function registerFlowLoadTool(server, client, runtime) {
       outputSchema,
       annotations: spec.annotations
     },
-    // SDK infers handler type from inputSchema shape; ToolSpec.handler is the
-    // type-erased (input: unknown) => Promise<unknown> form by design.
-    spec.handler
+    (args) => flowLoadHandlerBody(client, runtime, args)
   );
 }
 
 // src/tools/feedback.ts
-import { z as z7 } from "zod";
-import { mcpResult as mcpResult8, mcpError as mcpError8 } from "@walkeros/core";
+import { z as z8 } from "zod";
+import { mcpResult as mcpResult8, mcpError as mcpError10 } from "@walkeros/core";
 var TITLE7 = "Send Feedback";
 var DESCRIPTION6 = "Send feedback about walkerOS";
 var inputSchema7 = {
-  text: z7.string().describe("Your feedback text"),
-  anonymous: z7.boolean().optional().describe(
+  text: z8.string().describe("Your feedback text"),
+  anonymous: z8.boolean().optional().describe(
     "Include user/project info? false = include, true = anonymous. Only needed on first call if not yet configured."
   )
 };
@@ -1518,7 +1638,9 @@ function createFeedbackToolSpec(client) {
   };
 }
 async function feedbackHandlerBody(client, input) {
-  const { text, anonymous: explicitAnonymous } = input ?? {};
+  const parsed = parseToolInput(inputSchema7, input);
+  if (!parsed.ok) return parsed.error;
+  const { text, anonymous: explicitAnonymous } = parsed.data;
   try {
     let anonymous = client.getFeedbackPreference();
     if (anonymous === void 0 && explicitAnonymous === void 0) {
@@ -1539,11 +1661,11 @@ async function feedbackHandlerBody(client, input) {
     const isAnonymous = explicitAnonymous ?? anonymous ?? true;
     await client.submitFeedback(text, {
       anonymous: isAnonymous,
-      version: "4.7.0-next-1790722899482"
+      version: "4.7.0"
     });
     return mcpResult8({ ok: true });
   } catch (error) {
-    return mcpError8(error);
+    return mcpError10(error);
   }
 }
 function registerFeedbackTool(server, client) {
@@ -1556,9 +1678,7 @@ function registerFeedbackTool(server, client) {
       inputSchema: spec.inputSchema,
       annotations: spec.annotations
     },
-    // SDK infers handler type from inputSchema shape; ToolSpec.handler is the
-    // type-erased (input: unknown) => Promise<unknown> form by design.
-    spec.handler
+    (args) => feedbackHandlerBody(client, args)
   );
 }
 
@@ -21271,20 +21391,18 @@ function registerDiagnosticsTool(server, client, packageVersion) {
       inputSchema: spec.inputSchema,
       annotations: spec.annotations
     },
-    // SDK infers handler type from inputSchema shape; ToolSpec.handler is the
-    // type-erased (input: unknown) => Promise<unknown> form by design.
-    spec.handler
+    () => diagnosticsHandlerBody(client, packageVersion)
   );
 }
 
 // src/tools/auth.ts
-import { z as z8 } from "zod";
-import { mcpResult as mcpResult10, mcpError as mcpError9 } from "@walkeros/core";
+import { z as z9 } from "zod";
+import { mcpResult as mcpResult10, mcpError as mcpError11 } from "@walkeros/core";
 var TITLE9 = "Authentication";
 var DESCRIPTION8 = "Manage walkerOS authentication. Check login status, log in via the device authorization grant, or log out. No terminal or browser required, the MCP client handles the authorization URL.";
 var inputSchema9 = {
-  action: z8.enum(["status", "login", "logout"]).describe("Authentication action to perform"),
-  deviceCode: z8.string().optional().describe(
+  action: z9.enum(["status", "login", "logout"]).describe("Authentication action to perform"),
+  deviceCode: z9.string().optional().describe(
     "Device code from a previous pending login attempt. Provide to resume polling without requesting a new code."
   )
 };
@@ -21305,7 +21423,9 @@ function createAuthToolSpec(client) {
   };
 }
 async function authHandlerBody(client, input) {
-  const { action, deviceCode } = input ?? {};
+  const parsed = parseToolInput(inputSchema9, input);
+  if (!parsed.ok) return parsed.error;
+  const { action, deviceCode } = parsed.data;
   try {
     switch (action) {
       case "status": {
@@ -21318,7 +21438,7 @@ async function authHandlerBody(client, input) {
         const user = await client.whoami();
         return mcpResult10({
           authenticated: true,
-          ...user
+          ...fieldsOf(user)
         });
       }
       case "login": {
@@ -21346,14 +21466,14 @@ async function authHandlerBody(client, input) {
             });
           }
           if (poll.status === "denied")
-            return mcpError9(new Error("Authorization was denied."));
+            return mcpError11(new Error("Authorization was denied."));
           if (poll.status === "expired")
-            return mcpError9(
+            return mcpError11(
               new Error(
                 'The one-time code expired. Run auth with action "login" for a new one.'
               )
             );
-          return mcpError9(new Error(poll.error));
+          return mcpError11(new Error(poll.error));
         }
         const code = await client.requestDeviceCode();
         const loginUrl = code.verificationUriComplete;
@@ -21390,7 +21510,7 @@ async function authHandlerBody(client, input) {
         );
     }
   } catch (error) {
-    return mcpError9(error);
+    return mcpError11(error);
   }
 }
 function registerAuthTool(server, client) {
@@ -21403,15 +21523,13 @@ function registerAuthTool(server, client) {
       inputSchema: spec.inputSchema,
       annotations: spec.annotations
     },
-    // SDK infers handler type from inputSchema shape; ToolSpec.handler is the
-    // type-erased (input: unknown) => Promise<unknown> form by design.
-    spec.handler
+    (args) => authHandlerBody(client, args)
   );
 }
 
 // src/tools/project-manage.ts
-import { z as z9 } from "zod";
-import { mcpResult as mcpResult11, mcpError as mcpError10 } from "@walkeros/core";
+import { z as z10 } from "zod";
+import { mcpResult as mcpResult11, mcpError as mcpError12 } from "@walkeros/core";
 
 // src/action-requirements.ts
 function validateActionInput(toolName, action, input, map) {
@@ -21532,21 +21650,22 @@ var FRAME_MANAGE_REQUIREMENTS = {
 };
 
 // src/tools/project-manage.ts
-function wrapProjectName(p) {
-  return p.name !== void 0 ? { ...p, name: wrapUserData(p.name) } : p;
+function wrapProjectName(project) {
+  const name = stringField(project, "name");
+  return isRecord(project) && name !== void 0 ? { ...project, name: wrapUserData(name) } : project;
 }
 var TITLE10 = "Project Management";
 var DESCRIPTION9 = "Manage walkerOS projects. List, create, update, delete projects, or set a default project for CLI operations.";
 var inputSchema10 = {
-  action: z9.enum(["list", "get", "create", "update", "delete", "set_default"]).describe("Project management action to perform"),
-  projectId: z9.string().optional().describe("Required for get, update, delete, set_default."),
-  name: z9.string().optional().describe(
+  action: z10.enum(["list", "get", "create", "update", "delete", "set_default"]).describe("Project management action to perform"),
+  projectId: z10.string().optional().describe("Required for get, update, delete, set_default."),
+  name: z10.string().optional().describe(
     "Required for create and update (update also requires projectId)."
   ),
-  cursor: z9.string().optional().describe(
+  cursor: z10.string().optional().describe(
     "Pagination cursor from a previous list response. Only used with the list action."
   ),
-  limit: z9.number().int().min(1).max(100).optional().describe("Max items per page (1-100). Only used with the list action.")
+  limit: z10.number().int().min(1).max(100).optional().describe("Max items per page (1-100). Only used with the list action.")
 };
 var annotations10 = {
   readOnlyHint: false,
@@ -21565,19 +21684,22 @@ function createProjectManageToolSpec(client) {
   };
 }
 async function projectManageHandlerBody(client, input) {
-  const { action, projectId, name, cursor, limit } = input ?? {};
+  const parsed = parseToolInput(inputSchema10, input);
+  if (!parsed.ok) return parsed.error;
+  const { action, projectId, name, cursor, limit } = parsed.data;
   const validationError = validateActionInput(
     "project_manage",
     action ?? "",
     { projectId, name },
     PROJECT_MANAGE_REQUIREMENTS
   );
-  if (validationError) return mcpError10(new Error(validationError));
+  if (validationError) return mcpError12(new Error(validationError));
   try {
     switch (action) {
       case "list": {
         const projects = await client.listProjects({ cursor, limit });
-        const items = Array.isArray(projects) ? projects : projects?.projects || [];
+        const listed = isRecord(projects) ? projects.projects : void 0;
+        const items = Array.isArray(projects) ? projects : Array.isArray(listed) ? listed : [];
         if (items.length === 0) {
           return mcpResult11(
             { projects: [] },
@@ -21589,8 +21711,7 @@ async function projectManageHandlerBody(client, input) {
             }
           );
         }
-        const typedItems = items;
-        const safe = Array.isArray(projects) ? typedItems.map(wrapProjectName) : { ...projects, projects: typedItems.map(wrapProjectName) };
+        const safe = Array.isArray(projects) ? items.map(wrapProjectName) : { ...fieldsOf(projects), projects: items.map(wrapProjectName) };
         return mcpResult11(safe);
       }
       case "get": {
@@ -21633,7 +21754,7 @@ async function projectManageHandlerBody(client, input) {
         );
     }
   } catch (error) {
-    return mcpError10(error, isAuthError(error) ? AUTH_HINT : void 0);
+    return mcpError12(error, isAuthError(error) ? AUTH_HINT : void 0);
   }
 }
 function registerProjectManageTool(server, client) {
@@ -21646,15 +21767,13 @@ function registerProjectManageTool(server, client) {
       inputSchema: spec.inputSchema,
       annotations: spec.annotations
     },
-    // SDK infers handler type from inputSchema shape; ToolSpec.handler is the
-    // type-erased (input: unknown) => Promise<unknown> form by design.
-    spec.handler
+    (args) => projectManageHandlerBody(client, args)
   );
 }
 
 // src/tools/flow-manage.ts
-import { z as z10 } from "zod";
-import { mcpResult as mcpResult12, mcpError as mcpError11 } from "@walkeros/core";
+import { z as z11 } from "zod";
+import { mcpResult as mcpResult12, mcpError as mcpError13 } from "@walkeros/core";
 
 // src/ui-parts.ts
 function flowCanvasResult(payload) {
@@ -21759,19 +21878,10 @@ var links = {
 
 // src/tools/flow-manage.ts
 function pickPlatform(content) {
-  if (content && typeof content === "object") {
-    const flows = content.flows;
-    if (flows && typeof flows === "object") {
-      for (const flow of Object.values(flows)) {
-        if (flow && typeof flow === "object") {
-          const config = flow.config;
-          if (config && typeof config === "object") {
-            const platform = config.platform;
-            if (platform === "web" || platform === "server") return platform;
-          }
-        }
-      }
-    }
+  const flows = recordField(content, "flows");
+  for (const flow of Object.values(flows ?? {})) {
+    const platform = stringField(recordField(flow, "config"), "platform");
+    if (platform === "web" || platform === "server") return platform;
   }
   return "server";
 }
@@ -21780,22 +21890,29 @@ function flowPageUrl(client, projectId, flowId) {
   return links.flow({ baseUrl: client.appBaseUrl(), projectId, flowId });
 }
 function safeSummary(flow) {
-  return flow.name !== void 0 ? { ...flow, name: wrapUserData(flow.name) } : flow;
+  const name = stringField(flow, "name");
+  return isRecord(flow) && name !== void 0 ? { ...flow, name: wrapUserData(name) } : flow;
 }
 function safeDetail(flow) {
-  const withName = flow.name !== void 0 ? { ...flow, name: wrapUserData(flow.name) } : { ...flow };
-  if (flow.config !== void 0) {
-    withName.config = redactNestedStrings(
-      flow.config,
-      { skip: keepStructural }
-    );
+  const fields = { ...fieldsOf(flow) };
+  const name = stringField(fields, "name");
+  if (name !== void 0) fields.name = wrapUserData(name);
+  if (fields.config !== void 0) {
+    fields.config = redactNestedStrings(fields.config, {
+      skip: keepStructural
+    });
   }
-  return withName;
+  return {
+    fields,
+    id: stringField(fields, "id"),
+    name: stringField(fields, "name"),
+    config: recordField(fields, "config")
+  };
 }
 var TITLE11 = "Flow Management";
 var DESCRIPTION10 = "Manage walkerOS flows and their previews. List/get/create/update/delete/duplicate flows, or create/inspect/delete preview bundles and mint activation grants (preview_regrant) for testing flow changes on live sites.";
 var inputSchema11 = {
-  action: z10.enum([
+  action: z11.enum([
     "list",
     "get",
     "create",
@@ -21808,52 +21925,52 @@ var inputSchema11 = {
     "preview_delete",
     "preview_regrant"
   ]).describe("Flow management action to perform"),
-  flowId: z10.string().optional().describe(
+  flowId: z11.string().optional().describe(
     "Flow ID (flow_...) or config ID (cfg_...). Required for get, update, delete, duplicate, preview_list, preview_get, preview_create, preview_delete, preview_regrant."
   ),
-  projectId: z10.string().optional().describe(
+  projectId: z11.string().optional().describe(
     "Project ID. Optional filter for list (omit to list all projects). Required for create if no default project set."
   ),
-  name: z10.string().optional().describe(
+  name: z11.string().optional().describe(
     "Flow name. Required for create. Optional for update (to rename) and duplicate."
   ),
-  content: z10.record(z10.string(), z10.unknown()).optional().describe("Flow.Json content. Used for create and update."),
-  patch: z10.boolean().optional().describe(
+  content: z11.record(z11.string(), z11.unknown()).optional().describe("Flow.Json content. Used for create and update."),
+  patch: z11.boolean().optional().describe(
     "Merge-patch for update (default true). When true, only provided fields are updated."
   ),
-  fields: z10.array(z10.string()).optional().describe("Dot-path selectors for get to return only specific fields."),
-  sort: z10.enum(["name", "updated_at", "created_at"]).optional().describe("Sort field for list."),
-  order: z10.enum(["asc", "desc"]).optional().describe("Sort order for list."),
-  includeDeleted: z10.boolean().optional().describe("Include soft-deleted flows in list results."),
-  cursor: z10.string().optional().describe(
+  fields: z11.array(z11.string()).optional().describe("Dot-path selectors for get to return only specific fields."),
+  sort: z11.enum(["name", "updated_at", "created_at"]).optional().describe("Sort field for list."),
+  order: z11.enum(["asc", "desc"]).optional().describe("Sort order for list."),
+  includeDeleted: z11.boolean().optional().describe("Include soft-deleted flows in list results."),
+  cursor: z11.string().optional().describe(
     "Pagination cursor from a previous list response. Only used with the list action."
   ),
-  limit: z10.number().int().min(1).max(100).optional().describe("Max items per page (1-100). Only used with the list action."),
-  previewId: z10.string().optional().describe(
+  limit: z11.number().int().min(1).max(100).optional().describe("Max items per page (1-100). Only used with the list action."),
+  previewId: z11.string().optional().describe(
     "Preview ID (prv_...). Required for preview_get, preview_delete, and preview_regrant (all also require flowId)."
   ),
-  flowName: z10.string().optional().describe(
+  flowName: z11.string().optional().describe(
     "Used by preview_create \u2014 provide one of flowName or flowSettingsId (preview_create also requires flowId)."
   ),
-  flowSettingsId: z10.string().optional().describe(
+  flowSettingsId: z11.string().optional().describe(
     "Used by preview_create \u2014 provide one of flowName or flowSettingsId (preview_create also requires flowId)."
   ),
-  source: z10.discriminatedUnion("kind", [
-    z10.object({ kind: z10.literal("draft") }),
-    z10.object({
-      kind: z10.literal("deployment-version"),
-      deploymentVersionId: z10.string()
+  source: z11.discriminatedUnion("kind", [
+    z11.object({ kind: z11.literal("draft") }),
+    z11.object({
+      kind: z11.literal("deployment-version"),
+      deploymentVersionId: z11.string()
     })
   ]).optional().describe(
     "What the preview should run, for preview_create: the flow's draft (default) or a deployed version's stored config (kind 'deployment-version' with its deploymentVersionId)."
   ),
-  siteUrl: z10.string().optional().describe(
+  siteUrl: z11.string().optional().describe(
     "Optional site URL (e.g. https://shop.example.com) for preview_create. When provided, the activation grant is minted for that origin so the returned activationUrl works there."
   ),
-  origins: z10.array(z10.string()).optional().describe(
+  origins: z11.array(z11.string()).optional().describe(
     "Site origins (bare https://host[:port]) to mint a preview activation grant for. Used by preview_regrant; the returned activationUrl targets the first origin."
   ),
-  sessionId: z10.string().optional().describe(
+  sessionId: z11.string().optional().describe(
     "Observe session id \u2014 when set, preview_regrant mints an activation/forwarding grant PAIR: the returned activationUrl both activates the web preview and lets the page forward events to the session container (elbPreviewSession param). Pass it to observe server-side hops; omit for a plain web preview."
   )
 };
@@ -21879,9 +21996,6 @@ var PREVIEW_SUMMARY_FIELDS = [
   "createdBy",
   "createdAt"
 ];
-function isRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 function redactPreview(data) {
   if (!isRecord(data)) return {};
   const out = {};
@@ -21920,6 +22034,8 @@ function createFlowManageToolSpec(client) {
   };
 }
 async function flowManageHandlerBody(client, input) {
+  const parsed = parseToolInput(inputSchema11, input);
+  if (!parsed.ok) return parsed.error;
   const {
     action,
     flowId,
@@ -21940,14 +22056,14 @@ async function flowManageHandlerBody(client, input) {
     siteUrl,
     origins,
     sessionId
-  } = input ?? {};
+  } = parsed.data;
   const validationError = validateActionInput(
     "flow_manage",
     action ?? "",
     { flowId, projectId, name, previewId, flowName, flowSettingsId },
     FLOW_MANAGE_REQUIREMENTS
   );
-  if (validationError) return mcpError11(new Error(validationError));
+  if (validationError) return mcpError13(new Error(validationError));
   try {
     switch (action) {
       case "list": {
@@ -21960,9 +22076,8 @@ async function flowManageHandlerBody(client, input) {
             cursor,
             limit
           });
-          const dataObj = data2;
-          const flows = dataObj.flows;
-          const safe2 = Array.isArray(flows) ? { ...dataObj, flows: flows.map(safeSummary) } : data2;
+          const flows = isRecord(data2) ? data2.flows : void 0;
+          const safe2 = isRecord(data2) && Array.isArray(flows) ? { ...data2, flows: flows.map(safeSummary) } : data2;
           return mcpResult12(safe2);
         }
         const data = await client.listAllFlows({
@@ -21987,16 +22102,14 @@ async function flowManageHandlerBody(client, input) {
         assertParam(flowId, "flowId", "get");
         const resolvedProjectId = resolveDefaultProject(client, projectId);
         if (!resolvedProjectId) {
-          return mcpError11(new Error(NO_DEFAULT_PROJECT_ERROR));
+          return mcpError13(new Error(NO_DEFAULT_PROJECT_ERROR));
         }
         const flow = await client.getFlow({
           flowId,
           projectId: resolvedProjectId,
           fields
         });
-        const safe = safeDetail(
-          flow
-        );
+        const safe = safeDetail(flow);
         const appUrl = flowPageUrl(client, resolvedProjectId, safe.id);
         return flowCanvasResult({
           flowId: safe.id,
@@ -22021,16 +22134,14 @@ async function flowManageHandlerBody(client, input) {
         assertParam(name, "name", "create");
         const resolvedProjectId = resolveDefaultProject(client, projectId);
         if (!resolvedProjectId) {
-          return mcpError11(new Error(NO_DEFAULT_PROJECT_ERROR));
+          return mcpError13(new Error(NO_DEFAULT_PROJECT_ERROR));
         }
         const created = await client.createFlow({
           name,
           content: content ?? {},
           projectId: resolvedProjectId
         });
-        const safeCreated = safeDetail(
-          created
-        );
+        const safeCreated = safeDetail(created);
         const createdAppUrl = flowPageUrl(
           client,
           resolvedProjectId,
@@ -22059,7 +22170,7 @@ async function flowManageHandlerBody(client, input) {
         assertParam(flowId, "flowId", "update");
         const resolvedProjectId = resolveDefaultProject(client, projectId);
         if (!resolvedProjectId) {
-          return mcpError11(new Error(NO_DEFAULT_PROJECT_ERROR));
+          return mcpError13(new Error(NO_DEFAULT_PROJECT_ERROR));
         }
         const updated = await client.updateFlow({
           flowId,
@@ -22068,9 +22179,7 @@ async function flowManageHandlerBody(client, input) {
           content,
           mergePatch: patch ?? true
         });
-        const safeUpdated = safeDetail(
-          updated
-        );
+        const safeUpdated = safeDetail(updated);
         return flowCanvasResult({
           flowId: safeUpdated.id,
           configName: safeUpdated.name ?? "default",
@@ -22093,7 +22202,7 @@ async function flowManageHandlerBody(client, input) {
         assertParam(flowId, "flowId", "delete");
         const resolvedProjectId = resolveDefaultProject(client, projectId);
         if (!resolvedProjectId) {
-          return mcpError11(new Error(NO_DEFAULT_PROJECT_ERROR));
+          return mcpError13(new Error(NO_DEFAULT_PROJECT_ERROR));
         }
         const deleted = await client.deleteFlow({
           flowId,
@@ -22105,22 +22214,20 @@ async function flowManageHandlerBody(client, input) {
         assertParam(flowId, "flowId", "duplicate");
         const resolvedProjectId = resolveDefaultProject(client, projectId);
         if (!resolvedProjectId) {
-          return mcpError11(new Error(NO_DEFAULT_PROJECT_ERROR));
+          return mcpError13(new Error(NO_DEFAULT_PROJECT_ERROR));
         }
         const duplicated = await client.duplicateFlow({
           flowId,
           name,
           projectId: resolvedProjectId
         });
-        return mcpResult12(
-          safeDetail(duplicated)
-        );
+        return mcpResult12(safeDetail(duplicated).fields);
       }
       case "preview_list": {
         assertParam(flowId, "flowId", "preview_list");
         const resolvedProjectId = resolveDefaultProject(client, projectId);
         if (!resolvedProjectId) {
-          return mcpError11(new Error(NO_DEFAULT_PROJECT_ERROR));
+          return mcpError13(new Error(NO_DEFAULT_PROJECT_ERROR));
         }
         const data = await client.listPreviews({
           projectId: resolvedProjectId,
@@ -22133,7 +22240,7 @@ async function flowManageHandlerBody(client, input) {
         assertParam(previewId, "previewId", "preview_get");
         const resolvedProjectId = resolveDefaultProject(client, projectId);
         if (!resolvedProjectId) {
-          return mcpError11(new Error(NO_DEFAULT_PROJECT_ERROR));
+          return mcpError13(new Error(NO_DEFAULT_PROJECT_ERROR));
         }
         const data = await client.getPreview({
           projectId: resolvedProjectId,
@@ -22146,7 +22253,7 @@ async function flowManageHandlerBody(client, input) {
         assertParam(flowId, "flowId", "preview_create");
         const resolvedProjectId = resolveDefaultProject(client, projectId);
         if (!resolvedProjectId) {
-          return mcpError11(new Error(NO_DEFAULT_PROJECT_ERROR));
+          return mcpError13(new Error(NO_DEFAULT_PROJECT_ERROR));
         }
         const preview = await client.createPreview({
           projectId: resolvedProjectId,
@@ -22168,7 +22275,7 @@ async function flowManageHandlerBody(client, input) {
         assertParam(previewId, "previewId", "preview_delete");
         const resolvedProjectId = resolveDefaultProject(client, projectId);
         if (!resolvedProjectId) {
-          return mcpError11(new Error(NO_DEFAULT_PROJECT_ERROR));
+          return mcpError13(new Error(NO_DEFAULT_PROJECT_ERROR));
         }
         const data = await client.deletePreview({
           projectId: resolvedProjectId,
@@ -22184,10 +22291,10 @@ async function flowManageHandlerBody(client, input) {
         assertParam(previewId, "previewId", "preview_regrant");
         const resolvedProjectId = resolveDefaultProject(client, projectId);
         if (!resolvedProjectId) {
-          return mcpError11(new Error(NO_DEFAULT_PROJECT_ERROR));
+          return mcpError13(new Error(NO_DEFAULT_PROJECT_ERROR));
         }
         if (!client.regrantPreview) {
-          return mcpError11(
+          return mcpError13(
             new Error("preview_regrant is not supported by this client")
           );
         }
@@ -22211,7 +22318,7 @@ async function flowManageHandlerBody(client, input) {
         );
     }
   } catch (error) {
-    return mcpError11(error, isAuthError(error) ? AUTH_HINT : void 0);
+    return mcpError13(error, isAuthError(error) ? AUTH_HINT : void 0);
   }
 }
 function registerFlowManageTool(server, client) {
@@ -22224,15 +22331,13 @@ function registerFlowManageTool(server, client) {
       inputSchema: spec.inputSchema,
       annotations: spec.annotations
     },
-    // SDK infers handler type from inputSchema shape; ToolSpec.handler is the
-    // type-erased (input: unknown) => Promise<unknown> form by design.
-    spec.handler
+    (args) => flowManageHandlerBody(client, args)
   );
 }
 
 // src/tools/deploy-manage.ts
-import { z as z11 } from "zod";
-import { mcpResult as mcpResult13, mcpError as mcpError12 } from "@walkeros/core";
+import { z as z12 } from "zod";
+import { mcpResult as mcpResult13, mcpError as mcpError14 } from "@walkeros/core";
 
 // src/tools/_resolvers.ts
 var DeploymentNotFoundError = class extends Error {
@@ -22288,24 +22393,24 @@ async function resolveDeploymentSlug(args) {
 var TITLE12 = "Deploy Management";
 var DESCRIPTION11 = "Deploy walkerOS flows and manage deployments. deploy waits for the deployment to reach a terminal status by default (wait=true), with a 12-minute budget; pass wait=false to return immediately with the deployment id. A finished deployment carries its status and, on failure, an errorMessage with the user-facing reason; use the get action to re-read it. list supports cursor and limit for pagination. delete removes an active deployment. For get and delete pass flowId (required) plus optional slug to disambiguate when a flow has multiple active deployments. If a flow has >=2 active deployments and no slug is supplied, the tool returns a MULTIPLE_DEPLOYMENTS error with a details[] list showing each deployment's slug, type, status, and updatedAt.";
 var inputSchema12 = {
-  action: z11.enum(["deploy", "list", "get", "delete"]).describe("Deployment action to perform"),
-  projectId: z11.string().optional().describe("Project ID. Optional; falls back to the default project."),
-  flowId: z11.string().optional().describe("Required for deploy, get, delete."),
-  slug: z11.string().optional().describe(
+  action: z12.enum(["deploy", "list", "get", "delete"]).describe("Deployment action to perform"),
+  projectId: z12.string().optional().describe("Project ID. Optional; falls back to the default project."),
+  flowId: z12.string().optional().describe("Required for deploy, get, delete."),
+  slug: z12.string().optional().describe(
     "Deployment slug. Optional disambiguator for get/delete when the flow has multiple active deployments."
   ),
-  type: z11.enum(["web", "server"]).optional().describe("Deployment type filter for list."),
-  status: z11.string().optional().describe("Status filter for list."),
-  wait: z11.boolean().optional().describe(
+  type: z12.enum(["web", "server"]).optional().describe("Deployment type filter for list."),
+  status: z12.string().optional().describe("Status filter for list."),
+  wait: z12.boolean().optional().describe(
     "Wait for the deployment to reach a terminal status (default true), with a 12-minute budget. Set false to return the deployment id immediately. Only used with deploy action."
   ),
-  flowName: z11.string().optional().describe(
+  flowName: z12.string().optional().describe(
     "Flow name for multi-settings flows. Only used with deploy action."
   ),
-  cursor: z11.string().optional().describe(
+  cursor: z12.string().optional().describe(
     "Pagination cursor from a previous list response. Only used with the list action."
   ),
-  limit: z11.number().int().min(1).max(100).optional().describe("Max items per page (1-100). Only used with the list action.")
+  limit: z12.number().int().min(1).max(100).optional().describe("Max items per page (1-100). Only used with the list action.")
 };
 var annotations12 = {
   readOnlyHint: false,
@@ -22340,13 +22445,22 @@ function withAppUrl(data, appUrl) {
   }
   return { ...data, appUrl };
 }
+function readDeploymentSummary(value) {
+  if (!isRecord(value)) return [];
+  const slug = stringField(value, "slug");
+  const type = stringField(value, "type");
+  const status = stringField(value, "status");
+  const updatedAt = stringField(value, "updatedAt");
+  return slug !== void 0 && type !== void 0 && status !== void 0 && updatedAt !== void 0 ? [{ ...value, slug, type, status, updatedAt }] : [];
+}
 function listForResolver(client, projectId) {
   return async (q) => {
     const resp = await client.listDeployments({
       projectId: projectId || q.projectId || void 0,
       flowId: q.flowId
     });
-    return resp.deployments ?? [];
+    const deployments = isRecord(resp) ? resp.deployments : void 0;
+    return Array.isArray(deployments) ? deployments.flatMap(readDeploymentSummary) : [];
   };
 }
 function createDeployManageToolSpec(client) {
@@ -22360,6 +22474,8 @@ function createDeployManageToolSpec(client) {
   };
 }
 async function deployManageHandlerBody(client, input) {
+  const parsed = parseToolInput(inputSchema12, input);
+  if (!parsed.ok) return parsed.error;
   const {
     action,
     projectId,
@@ -22371,14 +22487,14 @@ async function deployManageHandlerBody(client, input) {
     flowName,
     cursor,
     limit
-  } = input ?? {};
+  } = parsed.data;
   const validationError = validateActionInput(
     "deploy_manage",
     action ?? "",
     { flowId, projectId },
     DEPLOY_MANAGE_REQUIREMENTS
   );
-  if (validationError) return mcpError12(new Error(validationError));
+  if (validationError) return mcpError14(new Error(validationError));
   try {
     switch (action) {
       case "deploy": {
@@ -22437,7 +22553,7 @@ async function deployManageHandlerBody(client, input) {
         return mcpResult13(
           redactDisplayNames({
             deleted: true,
-            ...data
+            ...fieldsOf(data)
           })
         );
       }
@@ -22447,7 +22563,7 @@ async function deployManageHandlerBody(client, input) {
         );
     }
   } catch (error) {
-    return mcpError12(error, isAuthError(error) ? AUTH_HINT : void 0);
+    return mcpError14(error, isAuthError(error) ? AUTH_HINT : void 0);
   }
 }
 function registerDeployTool(server, client) {
@@ -22460,35 +22576,33 @@ function registerDeployTool(server, client) {
       inputSchema: spec.inputSchema,
       annotations: spec.annotations
     },
-    // SDK infers handler type from inputSchema shape; ToolSpec.handler is the
-    // type-erased (input: unknown) => Promise<unknown> form by design.
-    spec.handler
+    (args) => deployManageHandlerBody(client, args)
   );
 }
 
 // src/tools/secret-manage.ts
-import { z as z12 } from "zod";
-import { mcpResult as mcpResult14, mcpError as mcpError13 } from "@walkeros/core";
+import { z as z13 } from "zod";
+import { mcpResult as mcpResult14, mcpError as mcpError15 } from "@walkeros/core";
 var TITLE13 = "Secret Management";
 var DESCRIPTION12 = "Manage a flow\u2019s managed secrets (the $secret.<NAME> values its steps reference at deploy/run time). Actions: list (metadata only), set (create), update (rotate value), delete. Secrets are write-mostly: values are encrypted at rest and are NEVER returned, listed, or echoed. Reference a secret from a flow step as $secret.<NAME>. Credentials, tokens, and private keys must use $secret, not $env: the deploy pipeline only injects values referenced as $secret.<NAME> into the server runner. Server flows only.";
 var inputSchema13 = {
-  action: z12.enum(["list", "set", "update", "delete"]).describe("Secret management action to perform"),
-  projectId: z12.string().optional().describe(
+  action: z13.enum(["list", "set", "update", "delete"]).describe("Secret management action to perform"),
+  projectId: z13.string().optional().describe(
     "Project ID. Optional: falls back to the default project when omitted."
   ),
-  flowId: z12.string().describe(
+  flowId: z13.string().describe(
     "Flow ID (flow_...) or config ID (cfg_...). Required for list, set, update, and delete: secrets are flow-scoped."
   ),
-  name: z12.string().regex(
+  name: z13.string().regex(
     /^[A-Z_][A-Z0-9_]*$/,
     "Secret name must be uppercase letters, digits, and underscores, starting with a letter or underscore."
   ).optional().describe(
     "Secret name (UPPER_SNAKE_CASE). Required for set. Referenced in flows as $secret.<NAME>."
   ),
-  value: z12.string().min(1).max(65536).optional().describe(
+  value: z13.string().min(1).max(65536).optional().describe(
     "Secret value (1-65536 chars). Required for set and update. Write-only: never returned or logged."
   ),
-  secretId: z12.string().optional().describe(
+  secretId: z13.string().optional().describe(
     'Secret ID (sec_...). Required for update and delete. Use action "list" to find it.'
   )
 };
@@ -22509,18 +22623,20 @@ function createSecretManageToolSpec(client) {
   };
 }
 async function secretManageHandlerBody(client, input) {
-  const { action, projectId, flowId, name, value, secretId } = input ?? {};
+  const parsed = parseToolInput(inputSchema13, input);
+  if (!parsed.ok) return parsed.error;
+  const { action, projectId, flowId, name, value, secretId } = parsed.data;
   const validationError = validateActionInput(
     "secret_manage",
     action ?? "",
     { flowId, name, value, secretId },
     SECRET_MANAGE_REQUIREMENTS
   );
-  if (validationError) return mcpError13(new Error(validationError));
+  if (validationError) return mcpError15(new Error(validationError));
   try {
     const resolvedProjectId = resolveDefaultProject(client, projectId);
     if (!resolvedProjectId)
-      return mcpError13(new Error(NO_DEFAULT_PROJECT_ERROR));
+      return mcpError15(new Error(NO_DEFAULT_PROJECT_ERROR));
     switch (action) {
       case "list": {
         assertParam(flowId, "flowId", "list");
@@ -22579,7 +22695,7 @@ async function secretManageHandlerBody(client, input) {
         );
     }
   } catch (error) {
-    return mcpError13(error, isAuthError(error) ? AUTH_HINT : void 0);
+    return mcpError15(error, isAuthError(error) ? AUTH_HINT : void 0);
   }
 }
 function registerSecretManageTool(server, client) {
@@ -22592,22 +22708,20 @@ function registerSecretManageTool(server, client) {
       inputSchema: spec.inputSchema,
       annotations: spec.annotations
     },
-    // SDK infers handler type from inputSchema shape; ToolSpec.handler is the
-    // type-erased (input: unknown) => Promise<unknown> form by design.
-    spec.handler
+    (args) => secretManageHandlerBody(client, args)
   );
 }
 
 // src/tools/observe-journeys.ts
-import { z as z13 } from "zod";
-import { mcpResult as mcpResult15, mcpError as mcpError14 } from "@walkeros/core";
+import { z as z14 } from "zod";
+import { mcpResult as mcpResult15, mcpError as mcpError16 } from "@walkeros/core";
 var TITLE14 = "Observe Journeys";
 var DESCRIPTION13 = "Read the assembled, cross-runtime journeys for a flow that is currently being observed (an active Observe session). Pass flowId; the active session is resolved for you (a flow has at most one). Each journey is one traced event reconstructed end to end across web and server: its ordered hops (source, transformer, collector, destination), each hop status (pending/done/skipped/error), captured in/out payloads, consent, and vendor calls. Use this to see what actually happened to live events: which destinations fired, what mapping ran, where an event was skipped or errored, and whether records were lost (gaps + a journey `lossy` flag). When the flow has no active session the result is `{ sessionId: null, journeys: [], gaps: [] }` \u2014 start an Observe session in the app and drive traffic first, then read again. Narrow with traceId (one trace) and limit (page cap, most recent kept; default 50). Read-only.";
 var inputSchema14 = {
-  flowId: z13.string().describe("Flow to read journeys for (its active Observe session)."),
-  projectId: z13.string().optional().describe("Project ID. Optional; falls back to the default project."),
-  traceId: z13.string().optional().describe("Return only the journeys for this trace id."),
-  limit: z13.number().int().min(1).max(100).optional().describe(
+  flowId: z14.string().describe("Flow to read journeys for (its active Observe session)."),
+  projectId: z14.string().optional().describe("Project ID. Optional; falls back to the default project."),
+  traceId: z14.string().optional().describe("Return only the journeys for this trace id."),
+  limit: z14.number().int().min(1).max(100).optional().describe(
     "Max journeys to return (1-100, most recent kept). Defaults to 50."
   )
 };
@@ -22665,9 +22779,11 @@ function createObserveJourneysToolSpec(client) {
   };
 }
 async function observeJourneysHandlerBody(client, input) {
-  const { flowId, projectId, traceId, limit } = input ?? {};
+  const parsed = parseToolInput(inputSchema14, input);
+  if (!parsed.ok) return parsed.error;
+  const { flowId, projectId, traceId, limit } = parsed.data;
   if (!flowId) {
-    return mcpError14(new Error("flowId is required for observe_journeys."));
+    return mcpError16(new Error("flowId is required for observe_journeys."));
   }
   try {
     const result = await client.listJourneys({
@@ -22694,7 +22810,7 @@ async function observeJourneysHandlerBody(client, input) {
       ]
     });
   } catch (error) {
-    return mcpError14(error, isAuthError(error) ? AUTH_HINT : void 0);
+    return mcpError16(error, isAuthError(error) ? AUTH_HINT : void 0);
   }
 }
 function registerObserveJourneysTool(server, client) {
@@ -22707,15 +22823,13 @@ function registerObserveJourneysTool(server, client) {
       inputSchema: spec.inputSchema,
       annotations: spec.annotations
     },
-    // SDK infers handler type from inputSchema shape; ToolSpec.handler is the
-    // type-erased (input: unknown) => Promise<unknown> form by design.
-    spec.handler
+    (args) => observeJourneysHandlerBody(client, args)
   );
 }
 
 // src/tools/observe-session.ts
-import { z as z14 } from "zod";
-import { mcpResult as mcpResult16, mcpError as mcpError15 } from "@walkeros/core";
+import { z as z15 } from "zod";
+import { mcpResult as mcpResult16, mcpError as mcpError17 } from "@walkeros/core";
 var TITLE15 = "Observe Session";
 var DESCRIPTION14 = "Open, inspect, or end an Observe session: a time-boxed window on one flow that runtimes attach to as arms. A preview arm streams from a browser, a container arm runs server-side, and both feed ONE shared journeys feed. start opens the window (arms picks which runtimes attach), status reports per-arm state plus recordsReceived and expiresAt, stop ends the whole session including every arm. A flow has at most one session, so status/stop resolve it from flowId when sessionId is omitted. Read the events with observe_journeys; this tool never returns event data and never judges whether events are correct.";
 var HINT_SIMULATE_FIRST = "Simulate before preview: flow_simulate checks mapping with no browser.";
@@ -22726,29 +22840,29 @@ var HINT_EMPTY_FEED = "recordsReceived is 0: nothing has reached the feed yet. D
 var HINT_ENDED = "Session ended and both arms detached. Start a new one with observe_session start.";
 var HINT_NO_WINDOW = "No Observe session on this flow. Open one with observe_session start.";
 var inputSchema15 = {
-  action: z14.enum(["start", "status", "stop"]).describe(
+  action: z15.enum(["start", "status", "stop"]).describe(
     "start opens a session, status reports arm state, stop ends the whole session."
   ),
-  flowId: z14.string().describe("Flow the Observe session runs on."),
-  projectId: z14.string().optional().describe("Project ID. Optional; falls back to the default project."),
-  sessionId: z14.string().optional().describe(
+  flowId: z15.string().describe("Flow the Observe session runs on."),
+  projectId: z15.string().optional().describe("Project ID. Optional; falls back to the default project."),
+  sessionId: z15.string().optional().describe(
     "Session to act on for status/stop. Optional; the flow has at most one session and it is resolved for you."
   ),
-  arms: z14.object({
-    container: z14.literal(true).optional().describe(
+  arms: z15.object({
+    container: z15.literal(true).optional().describe(
       "Pass true to attach the server container arm, which selects the flow's server settings when no preview arm is named. Only true is accepted: a web settings that references a server flow always brings its container arm along, so a container cannot be suppressed here."
     ),
-    preview: z14.string().optional().describe(
+    preview: z15.string().optional().describe(
       "Name the flow settings this session observes. A web settings attaches the browser preview arm (plus the container arm of any server flow it references); a server settings attaches the container arm alone. Omit to use the flow's single web settings."
     )
   }).optional().describe(
     "Which runtimes attach. Omit to attach the default preview arm; a web settings that references a server flow brings its container arm with it."
   ),
-  origins: z14.array(z14.string()).optional().describe(
+  origins: z15.array(z15.string()).optional().describe(
     "Bare https origins (https://host[:port]) the session may ingest web events from."
   ),
-  level: z14.enum(["off", "standard", "trace"]).optional().describe("Container observation verbosity. Defaults to the app's own."),
-  replace: z14.boolean().optional().describe(
+  level: z15.enum(["off", "standard", "trace"]).optional().describe("Container observation verbosity. Defaults to the app's own."),
+  replace: z15.boolean().optional().describe(
     "Replace the flow's existing window instead of attaching to it. Re-provisions from the new config."
   )
 };
@@ -22759,14 +22873,14 @@ var annotations15 = {
   openWorldHint: true
 };
 function readSettings(flow) {
-  if (!flow || typeof flow !== "object") return [];
+  if (!isRecord(flow)) return [];
   const settings = flow.settings;
   if (!Array.isArray(settings)) return [];
   const entries = [];
   for (const entry of settings) {
-    if (!entry || typeof entry !== "object") continue;
-    const { name, platform } = entry;
-    if (typeof name !== "string") continue;
+    const name = stringField(entry, "name");
+    const platform = stringField(entry, "platform");
+    if (name === void 0) continue;
     if (platform !== "web" && platform !== "server") continue;
     entries.push({ name, platform });
   }
@@ -22896,6 +23010,8 @@ function createObserveSessionToolSpec(client) {
   };
 }
 async function observeSessionHandlerBody(client, input) {
+  const parsed = parseToolInput(inputSchema15, input);
+  if (!parsed.ok) return parsed.error;
   const {
     action,
     flowId,
@@ -22905,19 +23021,19 @@ async function observeSessionHandlerBody(client, input) {
     origins,
     level,
     replace
-  } = input ?? {};
+  } = parsed.data;
   if (!flowId) {
-    return mcpError15(new Error("flowId is required for observe_session."));
+    return mcpError17(new Error("flowId is required for observe_session."));
   }
   const resolvedProjectId = resolveProjectId(client, projectId);
   if (!resolvedProjectId) {
-    return mcpError15(new Error(NO_DEFAULT_PROJECT_ERROR2));
+    return mcpError17(new Error(NO_DEFAULT_PROJECT_ERROR2));
   }
   try {
     switch (action) {
       case "start": {
         if (!client.startObserveSession) {
-          return mcpError15(
+          return mcpError17(
             new Error("observe_session start is not supported by this client.")
           );
         }
@@ -22943,7 +23059,7 @@ async function observeSessionHandlerBody(client, input) {
       }
       case "status": {
         if (!client.getObserveSession) {
-          return mcpError15(
+          return mcpError17(
             new Error(
               "observe_session status is not supported by this client."
             )
@@ -22970,7 +23086,7 @@ async function observeSessionHandlerBody(client, input) {
       }
       case "stop": {
         if (!client.endObserveSession) {
-          return mcpError15(
+          return mcpError17(
             new Error("observe_session stop is not supported by this client.")
           );
         }
@@ -23000,7 +23116,7 @@ async function observeSessionHandlerBody(client, input) {
         );
     }
   } catch (error) {
-    return mcpError15(error, isAuthError(error) ? AUTH_HINT : void 0);
+    return mcpError17(error, isAuthError(error) ? AUTH_HINT : void 0);
   }
 }
 function registerObserveSessionTool(server, client) {
@@ -23013,15 +23129,13 @@ function registerObserveSessionTool(server, client) {
       inputSchema: spec.inputSchema,
       annotations: spec.annotations
     },
-    // SDK infers handler type from inputSchema shape; ToolSpec.handler is the
-    // type-erased (input: unknown) => Promise<unknown> form by design.
-    spec.handler
+    (args) => observeSessionHandlerBody(client, args)
   );
 }
 
 // src/tools/hub-manage.ts
-import { z as z15 } from "zod";
-import { mcpResult as mcpResult17, mcpError as mcpError16 } from "@walkeros/core";
+import { z as z16 } from "zod";
+import { mcpResult as mcpResult17, mcpError as mcpError18 } from "@walkeros/core";
 
 // src/tools/feature-gate.ts
 var FEATURE_NOT_AVAILABLE = "FEATURE_NOT_AVAILABLE";
@@ -23074,56 +23188,56 @@ var TOOL_ANCHOR_TYPES = [
   "tag"
 ];
 var HUB_MANAGE_INPUT_SCHEMA = {
-  action: z15.enum(ACTIONS, {
+  action: z16.enum(ACTIONS, {
     error: () => `Unknown action. Use one of: ${ACTIONS.join(", ")}`
   }).describe("Which part of the release history to read or write"),
-  projectId: z15.string().optional().describe(
+  projectId: z16.string().optional().describe(
     "Project ID. Optional: falls back to the default project when omitted."
   ),
-  flowId: z15.string().optional().describe(
+  flowId: z16.string().optional().describe(
     'Flow ID (flow_...). Required for every action except "knowledge", which hangs on a page rather than a flow and refuses this field.'
   ),
-  versionId: z15.string().min(1).optional().describe(
+  versionId: z16.string().min(1).optional().describe(
     'Release version ID (ver_...) from action "releases". Addresses one release for release_get and rationale_set. Pass this or versionNumber.'
   ),
-  versionNumber: z15.number().int().positive().optional().describe(
+  versionNumber: z16.number().int().positive().optional().describe(
     'Spine release number for this flow, the `versionNumber` field of action "releases". Alternative to versionId. Not the same as a row\'s deploymentAttempt.'
   ),
-  step: z15.string().optional().describe(
+  step: z16.string().optional().describe(
     'Step key as "type.name", e.g. "destination.ga4" or "contract.checkout". Required for step_history.'
   ),
-  flow: z15.string().optional().describe(
+  flow: z16.string().optional().describe(
     'Named flow inside the config, e.g. "web" or "server". Optional for step_history: omit to scan every named flow. Ignored for contract steps, which are top-level.'
   ),
-  text: z15.string().trim().min(1).max(MAX_ANNOTATION_TEXT_LENGTH).optional().describe(
+  text: z16.string().trim().min(1).max(MAX_ANNOTATION_TEXT_LENGTH).optional().describe(
     `The text to write (1-${MAX_ANNOTATION_TEXT_LENGTH} chars). Required for rationale_set and note_add. As rationale it replaces the note already on the release and never touches the machine summary; as a note it is appended to a thread and nothing is ever replaced.`
   ),
-  limit: z15.number().int().positive().optional().describe(
+  limit: z16.number().int().positive().optional().describe(
     `Page size. Releases to list for action "releases" (max 100), or releases to SCAN for step_history (max ${MAX_STEP_HISTORY_LIMIT}). For step_history this bounds releases, not entries: a step present in several named flows yields one entry per flow per release, and the scan stops at ${MAX_STEP_HISTORY_ENTRIES} entries with entriesTruncated set. Narrow with "flow" to avoid that. For threads it bounds threads, and a read that carries messages is held to ${MAX_THREADS_WITH_MESSAGES} of them. Knowledge entries are bounded the same way.`
   ),
-  offset: z15.number().int().min(0).optional().describe('Releases to skip. Action "releases" only.'),
-  anchorType: z15.enum(TOOL_ANCHOR_TYPES).optional().describe(
+  offset: z16.number().int().min(0).optional().describe('Releases to skip. Action "releases" only.'),
+  anchorType: z16.enum(TOOL_ANCHOR_TYPES).optional().describe(
     'What a thread hangs on. Defaults to "release", the only anchor the app writes today. Pair it with anchorKey; a key means a different thing under each type.'
   ),
-  anchorKey: z15.string().min(1).max(MAX_ANCHOR_KEY_LENGTH).optional().describe(
+  anchorKey: z16.string().min(1).max(MAX_ANCHOR_KEY_LENGTH).optional().describe(
     'What the anchor addresses within its type: a release version ID (ver_...) for "release", a "type.name" step key for "step". For a release you can pass versionId or versionNumber instead. Omit entirely on action "threads" to read every thread on the flow.'
   ),
-  anchorLabel: z15.string().min(1).max(MAX_ANCHOR_LABEL_LENGTH).optional().describe(
+  anchorLabel: z16.string().min(1).max(MAX_ANCHOR_LABEL_LENGTH).optional().describe(
     'How the anchor reads on screen, stored once when a thread is opened so a later rename leaves it readable. Derived for a release ("v14"); pass it only when opening a thread on another anchor type.'
   ),
-  threadId: z15.string().min(1).optional().describe(
+  threadId: z16.string().min(1).optional().describe(
     'Thread ID (thr_...) from action "threads". Pass it to note_add to reply in that thread; omit it to open a new thread on the anchor.'
   ),
-  status: z15.enum(THREAD_STATUSES).optional().describe(
+  status: z16.enum(THREAD_STATUSES).optional().describe(
     'Read only threads in this state. Action "threads" only; omit for both.'
   ),
-  pageKey: z15.string().min(1).max(MAX_SOURCE_KEY_LENGTH).optional().describe(
+  pageKey: z16.string().min(1).max(MAX_SOURCE_KEY_LENGTH).optional().describe(
     'The page a note was left on, as Tag Mode addressed it, usually the page URL. Narrows action "knowledge" to every frame that page holds, at any depth; omit it to read the whole project.'
   ),
-  frameId: z15.string().regex(FRAME_ID_PATTERN).optional().describe(
+  frameId: z16.string().regex(FRAME_ID_PATTERN).optional().describe(
     'One frame (frm_...), the named rectangle a note hangs on. Action "knowledge" only. Narrower than pageKey, since a page holds several frames.'
   ),
-  markId: z15.string().min(1).max(MAX_MARK_ID_LENGTH).optional().describe(
+  markId: z16.string().min(1).max(MAX_MARK_ID_LENGTH).optional().describe(
     'One tag within "frameId", by its tag id (the id of an entry in frame_manage marks.tags). Action "knowledge" only, and refused without frameId, since a mark id alone addresses nothing. Naming a mark is also what attaches the message bodies.'
   )
 };
@@ -23169,7 +23283,7 @@ var HUB_HINT_ENTRY_NAMES_FLOW = "An entry names the flow it was written against
 var HUB_HINT_KNOWLEDGE_READ_ONLY = "This tool only reads knowledge. Answering a note, and settling it, are done by a person in the app.";
 var HUB_HINT_READ_FRAME = 'Use frame_manage action "get" with the frameId to read the frame and its marks.';
 var HUB_NOT_FOUND_HINT = 'Use action "releases" to find version ids and action "threads" to find thread ids.';
-var hubInputSchema = z15.object(HUB_MANAGE_INPUT_SCHEMA);
+var hubInputSchema = z16.object(HUB_MANAGE_INPUT_SCHEMA);
 var HubToolError = class extends Error {
   constructor(code, message) {
     super(message);
@@ -23589,12 +23703,7 @@ async function hubManageHandler(client, rawInput) {
   try {
     const parsed = hubInputSchema.safeParse(rawInput ?? {});
     if (!parsed.success) {
-      throw new HubToolError(
-        "INVALID_INPUT",
-        parsed.error.issues.map(
-          (issue) => `${issue.path.join(".") || "input"}: ${issue.message}`
-        ).join("; ")
-      );
+      throw new HubToolError("INVALID_INPUT", inputIssuesMessage(parsed.error));
     }
     const input = parsed.data;
     const { action } = input;
@@ -23627,7 +23736,7 @@ async function hubManageHandler(client, rawInput) {
         return await handleNoteAdd(client, projectId, flowId, input);
     }
   } catch (error) {
-    return mcpError16(error, errorHint(error, "hub", HUB_NOT_FOUND_HINT));
+    return mcpError18(error, errorHint(error, "hub", HUB_NOT_FOUND_HINT));
   }
 }
 function createHubManageToolSpec(client) {
@@ -23655,23 +23764,23 @@ function registerHubManageTool(server, client) {
 }
 
 // src/tools/frame-manage.ts
-import { z as z16 } from "zod";
-import { mcpResult as mcpResult18, mcpError as mcpError17 } from "@walkeros/core";
+import { z as z17 } from "zod";
+import { mcpResult as mcpResult18, mcpError as mcpError19 } from "@walkeros/core";
 var FRAME_ID_PATTERN2 = /^frm_[A-Za-z0-9_-]{21}$/;
 var MAX_PAGE_KEY_CHARS = 1024;
 var TITLE17 = "Frames";
 var FRAME_MANAGE_DESCRIPTION = 'Read the frames of a measurement plan: named rectangles with marks inside them, drawn in Tag Mode or in the app. Actions: list (every frame of the project, without marks), page (the frames of one page at any depth, with marks), get (one frame with its marks). Read-only: frames are drawn and edited in Tag Mode or the app, never here. A frame name is documentation; the marks inside it carry the meaning. A frame that extends another stores only what it adds, so its tags may carry only the fields they change. Marks are { tags, note }: tags is one flat list of tags, each with an id, a kind such as entity, property or action, a name, and a parentId naming the tag it sits under; note is the frame\u2019s own description and thread. Use hub_manage action "knowledge" with a frameId or markId to read what people wrote on a frame. A markId is a tag id: a tag\u2019s id, parentId and threadRef come back literal when they have the shape the app mints, so they can be passed straight back; every other string value in the marks is wrapped as data, and so is an object key that is not a plain identifier.';
 var FRAME_MANAGE_INPUT_SCHEMA = {
-  action: z16.enum(["list", "page", "get"]).describe(
+  action: z17.enum(["list", "page", "get"]).describe(
     "list the project\u2019s frames, read one page with marks, or read one frame"
   ),
-  projectId: z16.string().optional().describe(
+  projectId: z17.string().optional().describe(
     "Project ID. Optional: falls back to the default project when omitted."
   ),
-  pageKey: z16.string().min(1).max(MAX_PAGE_KEY_CHARS).optional().describe(
+  pageKey: z17.string().min(1).max(MAX_PAGE_KEY_CHARS).optional().describe(
     "The page as its frames address it (the `source.key` of a page frame, usually the page URL without query). Required for page."
   ),
-  frameId: z16.string().regex(FRAME_ID_PATTERN2).optional().describe(
+  frameId: z17.string().regex(FRAME_ID_PATTERN2).optional().describe(
     'Frame ID (frm_...). Required for get. Use action "list" or "page" to find one.'
   )
 };
@@ -23781,17 +23890,11 @@ function serializeFrame(frame) {
     marks: walkMarks(frame.marks)
   };
 }
-var frameInputSchema = z16.object(FRAME_MANAGE_INPUT_SCHEMA);
+var frameInputSchema = z17.object(FRAME_MANAGE_INPUT_SCHEMA);
 async function frameManageHandler(client, rawInput) {
   const parsed = frameInputSchema.safeParse(rawInput ?? {});
   if (!parsed.success) {
-    return mcpError17(
-      new Error(
-        parsed.error.issues.map(
-          (issue) => `${issue.path.join(".") || "input"}: ${issue.message}`
-        ).join("; ")
-      )
-    );
+    return mcpError19(new Error(inputIssuesMessage(parsed.error)));
   }
   const { action, projectId, pageKey, frameId } = parsed.data;
   const validationError = validateActionInput(
@@ -23800,11 +23903,11 @@ async function frameManageHandler(client, rawInput) {
     { pageKey, frameId },
     FRAME_MANAGE_REQUIREMENTS
   );
-  if (validationError) return mcpError17(new Error(validationError));
+  if (validationError) return mcpError19(new Error(validationError));
   try {
     const resolvedProjectId = resolveDefaultProject(client, projectId);
     if (!resolvedProjectId) {
-      return mcpError17(new Error(NO_DEFAULT_PROJECT_ERROR));
+      return mcpError19(new Error(NO_DEFAULT_PROJECT_ERROR));
     }
     switch (action) {
       case "list": {
@@ -23849,7 +23952,7 @@ async function frameManageHandler(client, rawInput) {
       }
     }
   } catch (error) {
-    return mcpError17(error, errorHint(error, "frames", FRAME_NOT_FOUND_HINT));
+    return mcpError19(error, errorHint(error, "frames", FRAME_NOT_FOUND_HINT));
   }
 }
 function createFrameManageToolSpec(client) {
@@ -23919,7 +24022,7 @@ function registerPackageSchemaResources(server) {
 }
 
 // src/resources/references.ts
-import { schemas as schemas5 } from "@walkeros/core/dev";
+import { schemas as schemas6 } from "@walkeros/core/dev";
 function registerReferenceResources(server) {
   server.resource(
     "flow-schema",
@@ -23932,7 +24035,7 @@ function registerReferenceResources(server) {
       contents: [
         {
           uri: "walkeros://reference/flow-schema",
-          text: JSON.stringify(schemas5.configJsonSchema, null, 2),
+          text: JSON.stringify(schemas6.configJsonSchema, null, 2),
           mimeType: "application/json"
         }
       ]
@@ -23949,7 +24052,7 @@ function registerReferenceResources(server) {
       contents: [
         {
           uri: "walkeros://reference/event-model",
-          text: JSON.stringify(schemas5.eventJsonSchema, null, 2),
+          text: JSON.stringify(schemas6.eventJsonSchema, null, 2),
           mimeType: "application/json"
         }
       ]
@@ -23968,10 +24071,10 @@ function registerReferenceResources(server) {
           uri: "walkeros://reference/mapping",
           text: JSON.stringify(
             {
-              rules: schemas5.rulesJsonSchema,
-              valueConfig: schemas5.valueConfigJsonSchema,
-              rule: schemas5.ruleJsonSchema,
-              policy: schemas5.policyJsonSchema
+              rules: schemas6.rulesJsonSchema,
+              valueConfig: schemas6.valueConfigJsonSchema,
+              rule: schemas6.ruleJsonSchema,
+              policy: schemas6.policyJsonSchema
             },
             null,
             2
@@ -23992,7 +24095,7 @@ function registerReferenceResources(server) {
       contents: [
         {
           uri: "walkeros://reference/consent",
-          text: JSON.stringify(schemas5.consentJsonSchema, null, 2),
+          text: JSON.stringify(schemas6.consentJsonSchema, null, 2),
           mimeType: "application/json"
         }
       ]
@@ -24068,7 +24171,7 @@ function registerReferenceResources(server) {
       contents: [
         {
           uri: "walkeros://reference/contract",
-          text: JSON.stringify(schemas5.contractJsonSchema, null, 2),
+          text: JSON.stringify(schemas6.contractJsonSchema, null, 2),
           mimeType: "application/json"
         }
       ]
@@ -24146,17 +24249,17 @@ function registerReferenceResources(server) {
 }
 
 // src/prompts/add-step.ts
-import { z as z17 } from "zod";
+import { z as z18 } from "zod";
 function registerAddStepPrompt(server) {
   server.registerPrompt(
     "add-step",
     {
       description: "Add a source, destination, transformer, or store step to a flow configuration. Guides through package selection, config scaffolding, and wiring.",
       argsSchema: {
-        stepType: z17.string().optional().describe(
+        stepType: z18.string().optional().describe(
           "Type of step to add: source, destination, transformer, or store"
         ),
-        flowPath: z17.string().optional().describe("Path to the flow.json file to modify")
+        flowPath: z18.string().optional().describe("Path to the flow.json file to modify")
       }
     },
     async ({ stepType, flowPath }) => ({
@@ -24202,14 +24305,14 @@ function registerAddStepPrompt(server) {
 }
 
 // src/prompts/setup-mapping.ts
-import { z as z18 } from "zod";
+import { z as z19 } from "zod";
 function registerSetupMappingPrompt(server) {
   server.registerPrompt(
     "setup-mapping",
     {
       description: "Set up event mapping for any step in a flow. Teaches mapping syntax and uses package examples as templates.",
       argsSchema: {
-        stepName: z18.string().optional().describe('Step name in the flow (e.g., "gtag", "meta", "express")')
+        stepName: z19.string().optional().describe('Step name in the flow (e.g., "gtag", "meta", "express")')
       }
     },
     async ({ stepName }) => ({
@@ -24247,14 +24350,14 @@ function registerSetupMappingPrompt(server) {
 }
 
 // src/prompts/manage-contract.ts
-import { z as z19 } from "zod";
+import { z as z20 } from "zod";
 function registerManageContractPrompt(server) {
   server.registerPrompt(
     "manage-contract",
     {
       description: "Create or update event contracts for a flow. Can generate contracts from existing mappings or scaffold mappings from contracts.",
       argsSchema: {
-        direction: z19.string().optional().describe(
+        direction: z20.string().optional().describe(
           'Direction: "from-mappings" (extract contract from existing mappings), "from-scratch" (create new contract), or "to-mappings" (scaffold mappings from contract)'
         )
       }
@@ -24298,7 +24401,7 @@ var SERVER_INSTRUCTIONS = `walkerOS is an open-source, privacy-first event data
 
 - **Never guess package names.** Always use \`package_search\` first to find exact names, then \`package_get\` for details.
 - **Never construct flow configs from memory.** Read \`walkeros://reference/flow-schema\` and use \`package_get\` for package-specific schemas.
-- **Always validate.** Run \`flow_validate\` after every config change. If validation fails, fix and re-validate.
+- **Always validate.** Run \`flow_validate\` after every config change. If validation fails, fix and re-validate. By default it checks every flow and step, package settings included; a valid result can still list \`details.skipped\` checks, so read them before trusting it (\`strict: true\` turns warnings and skips into failures: \`valid\` is false).
 - **Simulate before deploying.** Use \`flow_simulate\` to test with mocked API calls before \`flow_bundle\` or \`flow_push\`.
 - **When a request fails,** call \`diagnostics\` to see which MCP/CLI versions, app URL, and backend you are on, plus whether the app is reachable.
 
@@ -24802,8 +24905,11 @@ var HttpToolClient = class {
 };
 
 // src/runtime/local.ts
+import * as fs from "fs";
+import * as path2 from "path";
 import {
   collectKnownSecrets,
+  loadConfig,
   loadJsonConfig,
   bundle as bundle2,
   push,
@@ -24812,6 +24918,8 @@ import {
   simulateCollector,
   simulateDestination
 } from "@walkeros/cli";
+import { isObject as isObject3 } from "@walkeros/core";
+import { schemas as schemas7 } from "@walkeros/core/dev";
 
 // src/runtime/bundle-cache.ts
 import { createHash } from "crypto";
@@ -24902,6 +25010,10 @@ async function getOrBuildBundle(resolvedConfig) {
 function createLocalRuntime() {
   return {
     load: (input) => loadJsonConfig(input),
+    baseDir(input) {
+      const file = path2.resolve(input);
+      return fs.existsSync(file) && fs.statSync(file).isFile() ? path2.dirname(file) : void 0;
+    },
     bundle: (input, opts) => bundle2(input, {
       flowName: opts.flowName,
       stats: opts.stats,
@@ -24915,60 +25027,75 @@ function createLocalRuntime() {
         bundlePath = void 0;
       }
       const common = { bundlePath, flow: opts.flow, silent: true };
+      const config = opts.config ?? input;
       switch (opts.stepType) {
         case "source":
-          return simulateSource(input, opts.event, {
+          return simulateSource(config, opts.event, {
             sourceId: opts.stepId,
             ...common,
             consent: opts.state?.consent
           });
         case "transformer":
-          return simulateTransformer(
-            input,
-            opts.event,
-            {
-              transformerId: opts.stepId,
-              ...common,
-              ingest: opts.ingest,
-              consent: opts.state?.consent
-            }
-          );
+          return simulateTransformer(config, partialEvent(opts.event), {
+            transformerId: opts.stepId,
+            ...common,
+            ingest: opts.ingest,
+            consent: opts.state?.consent
+          });
         case "collector":
-          return simulateCollector(
-            input,
-            opts.event,
-            {
-              collectorName: opts.stepId,
-              ...common,
-              state: opts.state,
-              ingest: opts.ingest
-            }
-          );
+          return simulateCollector(config, partialEvent(opts.event), {
+            collectorName: opts.stepId,
+            ...common,
+            state: opts.state,
+            ingest: opts.ingest
+          });
         case "destination":
-          return simulateDestination(
-            input,
-            opts.event,
-            {
-              destinationId: opts.stepId,
-              ...common,
-              ingest: opts.ingest,
-              consent: opts.state?.consent,
-              command: opts.command
-            }
-          );
+          return simulateDestination(config, eventObject(opts.event), {
+            destinationId: opts.stepId,
+            ...common,
+            ingest: opts.ingest,
+            consent: opts.state?.consent,
+            command: opts.command
+          });
       }
     },
     knownSecrets: async (input) => collectKnownSecrets(await loadJsonConfig(input)),
+    async loadRun(input) {
+      const content = await loadConfig(input, { json: false });
+      const config = typeof content === "string" ? parseJson(content) : void 0;
+      if (!isFlowJson(config)) return { knownSecrets: [] };
+      return { config, knownSecrets: collectKnownSecrets(config) };
+    },
     push: (input, event, opts) => push(input, event, {
       json: true,
       flow: opts.flow,
-      platform: opts.platform
+      platform: opts.platform,
+      ...opts.config !== void 0 && { raw: opts.config }
     })
   };
 }
+function partialEvent(value) {
+  if (isPartialEvent(value)) return value;
+  const parsed = schemas7.PartialEventSchema.safeParse(value);
+  throw new Error(parsed.error?.message ?? "Invalid event");
+}
+function isPartialEvent(value) {
+  return schemas7.PartialEventSchema.safeParse(value).success;
+}
+function eventObject(value) {
+  if (isObject3(value)) return value;
+  throw new Error("event must be an object.");
+}
+function parseJson(content) {
+  try {
+    return JSON.parse(content);
+  } catch {
+    return void 0;
+  }
+}
 
 // src/stdio.ts
-setClientContext({ type: "mcp", version: "4.7.0-next-1790722899482" });
+setClientContext({ type: "mcp", version: "4.7.0" });
 process.on("uncaughtException", (err) => {
   const emitter = getMcpEmitterSingleton();
   if (emitter) {
@@ -24988,7 +25115,7 @@ process.on("unhandledRejection", (reason) => {
 async function main() {
   const server = createWalkerOSMcpServer({
     client: new HttpToolClient(),
-    version: "4.7.0-next-1790722899482",
+    version: "4.7.0",
     runtime: createLocalRuntime()
   });
   const transport = new StdioServerTransport();
@@ -24999,7 +25126,7 @@ main().catch(async (error) => {
   try {
     const emitter = await createMcpEmitter({
       clientInfo: void 0,
-      packageVersion: "4.7.0-next-1790722899482"
+      packageVersion: "4.7.0"
     });
     await emitter.emitError("startup");
   } catch {