@zackbart/connecta 0.8.0 → 0.9.0

package/dist/meta-tools.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { boundedDiscoveryText, CatalogService, DiscoveryPolicyError, groupedSearchResult, MAX_DESCRIBE_ADDRESSES, MAX_DISCOVERY_RESULT_BYTES, MAX_SEARCH_LIMIT, } from "./catalog-service.js";
+import { boundedDiscoveryText, CatalogService, DEFAULT_SEARCH_LIMIT, DiscoveryPolicyError, groupedSearchResult, MAX_DESCRIBE_ADDRESSES, MAX_DISCOVERY_RESULT_BYTES, MAX_SEARCH_LIMIT, } from "./catalog-service.js";
 import { mapSettledWithConcurrency, resolveDiscoveryConcurrency, } from "./concurrency.js";
 import { closeConnectorScope, } from "./connector-scope.js";
 import { classifyCallError, messageLooksRetryable, } from "./errors.js";
@@ -7,14 +7,13 @@ import { InvocationService, MAX_RETRY_BACKOFF_MS, retryBackoffMs, } from "./invo
 import { isValidMaxResultBytes, MIN_MAX_RESULT_BYTES, resolveMaxResultBytes, } from "./registry.js";
 import { hasConnectorGuides, listSkills, resolveSkill, } from "./skills.js";
 import { DEFAULT_PROBE_TIMEOUT_MS, normalizeTimeoutMs, withAbortableTimeout, } from "./timeout.js";
-import { credentialVerdictApplies } from "./credential-health.js";
-export { MAX_DESCRIBE_ADDRESSES, MAX_DISCOVERY_RESULT_BYTES, MAX_RETRY_BACKOFF_MS, MAX_SEARCH_LIMIT, DiscoveryPolicyError, retryBackoffMs, };
+export { MAX_DESCRIBE_ADDRESSES, MAX_DISCOVERY_RESULT_BYTES, MAX_RETRY_BACKOFF_MS, MAX_SEARCH_LIMIT, retryBackoffMs, };
 const RESULT_TTL_SECONDS = 900;
 const enc = new TextEncoder();
 const dec = new TextDecoder();
 export function jsonResult(obj) {
     return {
-        content: [{ type: "text", text: JSON.stringify(obj, null, 2) }],
+        content: [{ type: "text", text: JSON.stringify(obj) }],
         ...(obj !== null && typeof obj === "object" && !Array.isArray(obj)
             ? { structuredContent: obj }
             : {}),
@@ -40,8 +39,9 @@ function discoveryErrorResult(error) {
     result.isError = true;
     return result;
 }
-function discoveryResult(value, hint) {
+async function discoveryResult(operation, hint) {
     try {
+        const value = await operation();
         const text = boundedDiscoveryText(value, hint);
         return {
             content: [{ type: "text", text }],
@@ -174,7 +174,7 @@ function applyFieldsToContent(content, fields) {
         catch {
             return b;
         }
-        return { ...b, text: JSON.stringify(applyFields(parsed, fields), null, 2) };
+        return { ...b, text: JSON.stringify(applyFields(parsed, fields)) };
     });
 }
 // --- result-size guard + get_result (feature 1) ---------------------------
@@ -194,7 +194,7 @@ function applyFieldsToContent(content, fields) {
  * at all (a BigInt) still throws, as before, and is reported as a failure.
  */
 function serializeResultText(value) {
-    const serialized = JSON.stringify(value, null, 2);
+    const serialized = JSON.stringify(value);
     return serialized === undefined ? String(value) : serialized;
 }
 /**
@@ -275,7 +275,7 @@ async function guardValue(value, results, cap) {
 async function guardContent(content, results, cap) {
     let text;
     try {
-        text = JSON.stringify(content, null, 2);
+        text = JSON.stringify(content);
     }
     catch {
         // A block carrying a BigInt or a cycle cannot be serialized, so it cannot
@@ -373,16 +373,23 @@ export function createMetaTools(registry, baseUrl, opts = {}) {
             },
         });
         if (!outcome.ok) {
+            const failedResult = outcome.error.code === "auth_required" ||
+                outcome.error.code === "input_required_unsupported" ||
+                call.resultMode === "value"
+                ? jsonResult({
+                    ok: false,
+                    error: outcome.error,
+                    durationMs: outcome.durationMs,
+                    attempts: outcome.attempts,
+                    ...(call.diagnostics ? { timing: outcome.timing } : {}),
+                })
+                : errorResult(outcome.error.message);
+            if (outcome.error.code === "auth_required" ||
+                outcome.error.code === "input_required_unsupported") {
+                failedResult.isError = true;
+            }
             return {
-                toolResult: call.resultMode === "value"
-                    ? jsonResult({
-                        ok: false,
-                        error: outcome.error,
-                        durationMs: outcome.durationMs,
-                        attempts: outcome.attempts,
-                        ...(call.diagnostics ? { timing: outcome.timing } : {}),
-                    })
-                    : errorResult(outcome.error.message),
+                toolResult: failedResult,
                 durationMs: outcome.durationMs,
                 attempts: outcome.attempts,
                 timing: outcome.timing,
@@ -438,9 +445,12 @@ export function createMetaTools(registry, baseUrl, opts = {}) {
             const inspect = async (c) => {
                 const statusStarted = Date.now();
                 const observed = registry.healthFor(c.id);
-                const verdict = await registry.credentialHealthFor(c.id);
+                const drift = await registry.credentialDriftFor(c.id);
                 let status;
-                if (probe) {
+                if (drift) {
+                    status = { state: "auth_required", message: drift };
+                }
+                else if (probe) {
                     try {
                         status = await withProbeDeadline(`list_connectors probe of "${c.id}"`, (options) => registry.statusFor(c.id, baseUrl, scope, options));
                     }
@@ -451,73 +461,20 @@ export function createMetaTools(registry, baseUrl, opts = {}) {
                         status = { state: "error", message: msg(err) };
                     }
                 }
-                else if (verdict &&
-                    // Deployment-wide, deliberately, like `hasObservedSuccess` beside
-                    // it: a sibling toolkit's successful call proves the shared
-                    // credential works, and a verdict retired for one view but not
-                    // another would make the same connector read differently per scope
-                    // for a reason that has nothing to do with scope.
-                    credentialVerdictApplies(verdict, registry.observedSuccessAt(c.id))) {
-                    // The proactive layer (issue #24): a liveness check already found
-                    // the stored credential dead, so say so on the cheap path instead of
-                    // waiting for an agent's real call to discover it. Only while it is
-                    // the freshest evidence — a successful call since then retires it.
-                    status = {
-                        state: verdict.state,
-                        ...(verdict.message ? { message: verdict.message } : {}),
-                        ...(verdict.authorizationUrl
-                            ? { authorizationUrl: verdict.authorizationUrl }
-                            : {}),
-                    };
-                }
                 else {
-                    // "error" comes from THIS view's own observations — a sibling
-                    // toolkit's failure is not this session's experience — while
-                    // ok/unknown may lean on the deployment-wide success signal, since
-                    // "the connector answers at all" is a fact about the connector.
-                    // Unscoped, the two are the same log, so this is unchanged there.
                     const derived = observed?.consecutiveFailures && observed.consecutiveFailures > 0
                         ? "error"
                         : registry.hasObservedSuccess(c.id) || c.kind === "api"
                             ? "ok"
                             : "unknown";
                     status = {
-                        // A successful liveness check upgrades "unknown" — nothing has
-                        // been called yet, but the credential was verified, which is how
-                        // re-authorization shows up here as ok rather than as an absence
-                        // of evidence. It never DOWNgrades an observed failure: a real
-                        // call that failed is stronger evidence than a background check.
-                        state: derived === "unknown" && verdict?.state === "ok"
-                            ? "ok"
-                            : derived,
+                        state: derived,
                         ...(observed?.lastError ? { message: observed.lastError } : {}),
                     };
                 }
-                // Stamped where the observation actually happened — after the status
-                // probe, not before it. A 30-second probe stamped at its start would
-                // report a verdict older than it is, and would lose the race against a
-                // real call that succeeded WHILE it ran (that success must retire the
-                // verdict, and only an honest timestamp says so).
+                // Stamped after any live probe so the response reports when its
+                // observation completed, not when a potentially slow request began.
                 const checkedAt = new Date().toISOString();
-                // A live status probe IS a liveness observation of the stored
-                // credential, so it updates the same verdict a background check
-                // writes: the cached read afterwards agrees with what the operator
-                // just saw, and they are not swept again moments later. Recorded from
-                // the STATUS phase only, and only when the connector actually answered
-                // — a catalog refresh below is not a credential check (the sweep never
-                // fetches one), it is already counted in the health log, and letting
-                // its failure land here would spend the freshness budget on it. The
-                // registry ignores this for connectors storing no credential of ours.
-                if (probe && (status.state === "ok" || status.state === "auth_required")) {
-                    await registry.recordCredentialHealth(c.id, {
-                        state: status.state,
-                        checkedAt,
-                        ...(status.message ? { message: status.message } : {}),
-                        ...("authorizationUrl" in status && status.authorizationUrl
-                            ? { authorizationUrl: status.authorizationUrl }
-                            : {}),
-                    });
-                }
                 let tools = registry.peekTools(c.id);
                 // An auth_required status may have just started OAuth. A second
                 // listTools probe would overwrite its state/verifier while returning
@@ -545,15 +502,6 @@ export function createMetaTools(registry, baseUrl, opts = {}) {
                                         state: "auth_required",
                                         message: details.message,
                                     };
-                            await registry.recordCredentialHealth(c.id, {
-                                state: "auth_required",
-                                checkedAt,
-                                ...(status.message && { message: status.message }),
-                                ...("authorizationUrl" in status &&
-                                    status.authorizationUrl
-                                    ? { authorizationUrl: status.authorizationUrl }
-                                    : {}),
-                            });
                         }
                         else {
                             status = { state: "error", message: msg(err) };
@@ -563,9 +511,6 @@ export function createMetaTools(registry, baseUrl, opts = {}) {
                 }
                 const latencyMs = Date.now() - statusStarted;
                 const latestObserved = registry.healthFor(c.id);
-                const credentialCheck = probe
-                    ? await registry.credentialHealthFor(c.id)
-                    : verdict;
                 return {
                     id: c.id,
                     ...(c.title ? { title: c.title } : {}),
@@ -576,7 +521,6 @@ export function createMetaTools(registry, baseUrl, opts = {}) {
                     latencyMs,
                     probe,
                     ...(latestObserved ?? observed),
-                    ...(credentialCheck ? { credentialCheck } : {}),
                     ...("authorizationUrl" in status &&
                         status.authorizationUrl && {
                         authorizationUrl: status.authorizationUrl,
@@ -596,26 +540,10 @@ export function createMetaTools(registry, baseUrl, opts = {}) {
             return jsonResult({ connectors: out });
         },
         async searchTools(args) {
-            try {
-                return discoveryResult(groupedSearchResult(await catalog.search(args)), "Request a smaller limit, omit fullDescriptions, or use compact schemas.");
-            }
-            catch (err) {
-                if (err instanceof DiscoveryPolicyError) {
-                    return discoveryErrorResult(err);
-                }
-                throw err;
-            }
+            return discoveryResult(async () => groupedSearchResult(await catalog.search(args)), "Request a smaller limit, omit fullDescriptions, or use compact schemas.");
         },
         async describeTools(args) {
-            try {
-                return discoveryResult({ tools: await catalog.describe(args) }, 'Split the address list or use format: "compact".');
-            }
-            catch (err) {
-                if (err instanceof DiscoveryPolicyError) {
-                    return discoveryErrorResult(err);
-                }
-                throw err;
-            }
+            return discoveryResult(async () => ({ tools: await catalog.describe(args) }), 'Split the address list or use format: "compact".');
         },
         async callTool(args) {
             return (await runCall(args, "call_tool")).toolResult;
@@ -773,6 +701,21 @@ export function createMetaTools(registry, baseUrl, opts = {}) {
                             ...(details.retryAfterMs !== undefined
                                 ? { retryAfterMs: details.retryAfterMs }
                                 : {}),
+                            ...(details.connector !== undefined
+                                ? { connector: batchSummaryString(details.connector) }
+                                : {}),
+                            ...(details.operation !== undefined
+                                ? { operation: batchSummaryString(details.operation) }
+                                : {}),
+                            ...(details.recovery !== undefined
+                                ? { recovery: details.recovery }
+                                : {}),
+                            ...(details.nextAction !== undefined
+                                ? { nextAction: details.nextAction }
+                                : {}),
+                            ...(details.retry !== undefined
+                                ? { retry: batchSummaryString(details.retry) }
+                                : {}),
                         },
                     };
                 }),
@@ -786,28 +729,58 @@ export function createMetaTools(registry, baseUrl, opts = {}) {
                 return errorResult(`Unknown connector "${args.connector}"`);
             }
             if (!connector.startAuth) {
-                return errorResult(`Connector "${args.connector}" does not use downstream OAuth — its auth is static (headers/none), so there is nothing to authorize.`);
+                if (!connector.credential) {
+                    return jsonResult({
+                        connector: connector.id,
+                        recovery: "unavailable",
+                        message: `Connector "${connector.id}" declares neither downstream OAuth ` +
+                            "nor an operator-managed credential slot. Update the connector " +
+                            "or deployment configuration before retrying.",
+                    });
+                }
+                const ctx = registry.contextFor(connector.id, baseUrl, requestScope);
+                if (!ctx.credential) {
+                    return jsonResult({
+                        connector: connector.id,
+                        recovery: "unavailable",
+                        message: "Credential storage is not configured. Configure " +
+                            "credentials.encryptionKey, redeploy, then call " +
+                            "authorize_connector again.",
+                    });
+                }
+                const fields = connector.credential.fields?.map((field) => ({
+                    name: field.name,
+                    guidance: field.description ?? field.label,
+                })) ?? [
+                    {
+                        name: "value",
+                        guidance: connector.credential.description ??
+                            connector.credential.label,
+                    },
+                ];
+                return jsonResult({
+                    connector: connector.id,
+                    recovery: "operator_config",
+                    credential: {
+                        label: connector.credential.label,
+                        fields,
+                    },
+                    operatorUrl: new URL("/credentials", baseUrl).toString(),
+                    instructions: "Have the operator open operatorUrl, set and test the credential, " +
+                        "then retry the original call. No redeploy is needed. Credential " +
+                        "mutation requires a Clerk-authenticated operator.",
+                });
             }
             const ctx = registry.contextFor(connector.id, baseUrl, requestScope);
             try {
                 const status = await connector.startAuth(ctx, args.force !== undefined ? { force: args.force } : {});
-                // startAuth just spoke to the downstream about this exact credential, so
-                // its answer replaces any older liveness verdict — including the stale
-                // `auth_required` that sent the agent here, once it reports ok.
-                await registry.recordCredentialHealth(connector.id, {
-                    state: status.state,
-                    checkedAt: new Date().toISOString(),
-                    ...(status.message ? { message: status.message } : {}),
-                    ...(status.authorizationUrl
-                        ? { authorizationUrl: status.authorizationUrl }
-                        : {}),
-                });
                 if (status.state === "auth_required" && !status.authorizationUrl) {
                     // auth_required with nothing to open is a dead end for the operator.
                     return errorResult(`Connector "${connector.id}": authorization required but no URL is available — retry authorize_connector.`);
                 }
                 return jsonResult({
                     connector: connector.id,
+                    recovery: "oauth",
                     status: status.state,
                     ...(status.authorizationUrl
                         ? {
@@ -830,13 +803,13 @@ export function createMetaTools(registry, baseUrl, opts = {}) {
     };
 }
 const LIST_DESC = "List connectors with status, cached tool count, and recent real-call health. Use probe=false for a fast inventory; use probe=true (default) only to diagnose live health or authorization.";
-const SEARCH_DESC = `Start here when a tool address is unknown. Exact/name matches rank above description matches; an empty query browses all. Pages contain at most ${MAX_SEARCH_LIMIT} tools. includeSchemas="compact" usually removes the describe_tools round trip.`;
+const SEARCH_DESC = `Start here when a tool address is unknown. Exact/name matches rank above description matches; an empty query browses all. The default page has ${DEFAULT_SEARCH_LIMIT} tools; explicit limit can request up to ${MAX_SEARCH_LIMIT}. includeSchemas="compact" usually removes the describe_tools round trip.`;
 const DESCRIBE_DESC = `Inspect up to ${MAX_DESCRIBE_ADDRESSES} known tool addresses when search_tools did not include a sufficient schema. Returns descriptions, input/output schemas, and behavior annotations; format "compact" is the default.`;
 const CALL_DESC = 'Use for one tool explicitly annotated readOnlyHint: true. For 2–10 independent read-only calls use batch_call; for dependent steps or data reduction use execute_code when available. Unannotated, write-capable, and destructive tools are refused and require call_destructive_tool. fields selects JSON dot-paths, resultMode "value" unwraps results, timeoutMs sets a deadline, safe maxRetries are annotation-gated, diagnostics adds timing, and large results page through get_result.';
 const CALL_DESTRUCTIVE_DESC = "Invoke any tool that is not explicitly annotated readOnlyHint: true, including unannotated, write-capable, or destructive tools. The MCP destructiveHint on this meta-tool lets the host request human approval before execution. Use only after reviewing the downstream tool schema and consequences.";
 const GET_RESULT_DESC = "Page a truncated result stashed by call_tool/batch_call. Input { id, offset?, maxBytes? } → { text, offset, nextOffset?, totalBytes } sliced by byte offset. maxBytes is a whole number of bytes >= 1 (omit for the deployment default) and offset a whole number of bytes >= 0; an offset inside a multi-byte character is moved back to that character's first byte and the offset served is returned. Unknown/expired id is an error.";
 const BATCH_DESC = "Use for 2–10 independent tools explicitly annotated readOnlyHint: true. Calls run in parallel with shared request-scoped clients; use execute_code when available instead for dependencies or in-sandbox reduction. Unannotated, write-capable, and destructive tools are refused. Batch timeout, safe retry, result mode, and diagnostics defaults may be overridden per call. An oversized final envelope returns ordered outcome summaries plus a get_result page handle.";
-const AUTHORIZE_DESC = "Use after a connector reports auth_required. Starts downstream OAuth and returns an authorizationUrl for the operator to open. force=true wipes stored credentials first and restarts consent.";
+const AUTHORIZE_DESC = "Use after auth_required. Returns an OAuth or operator-credential handoff, or reports required deployment configuration. force=true restarts OAuth only; this tool never accepts credentials.";
 const SKILLS_DESC = 'List or fetch concise guidance for choosing among Connecta meta-tools. Call skills({ name: "usage" }) once when the routing workflow is unfamiliar; do not refetch it in the same task.';
 /**
  * Sentences appended to a meta-tool description only when this connection
@@ -844,10 +817,7 @@ const SKILLS_DESC = 'List or fetch concise guidance for choosing among Connecta
  * so a deployment with no guides gets every base description unchanged rather
  * than paying for text about a feature it does not use.
  *
- * Registration is per connection and reads the connection's own registry view,
- * so under a toolkit these sentences reflect the SCOPED connector set: a scoped
- * session whose connectors carry no guides sees the base descriptions, and
- * never learns from a tool description that guides exist out of scope.
+ * Registration is per connection and reads the configured connector set.
  */
 const GUIDE_NOTES = {
     skills: ' skills({}) also lists this deployment\'s per-connector usage guides as "connector:<connectorId>"; fetch the guide for a connector before working with it for the first time.',
@@ -878,6 +848,15 @@ const READ_ONLY_LOCAL = {
     idempotentHint: true,
     openWorldHint: false,
 };
+const CALL_INPUT_SCHEMA = {
+    address: z.string(),
+    args: z.record(z.string(), z.unknown()).optional(),
+    fields: z.array(z.string()).optional(),
+    resultMode: z.enum(["mcp", "value"]).optional(),
+    timeoutMs: z.number().int().positive().optional(),
+    maxRetries: z.number().int().min(0).max(2).optional(),
+    diagnostics: z.boolean().optional(),
+};
 /** Register the nine meta-tools onto an McpServer instance. */
 export function registerMetaTools(server, registry, ctx) {
     const mt = createMetaTools(registry, ctx.baseUrl, {
@@ -898,66 +877,45 @@ export function registerMetaTools(server, registry, ctx) {
     });
     server.registerTool("skills", {
         description: describedFor(registry, SKILLS_DESC, "skills"),
-        inputSchema: { name: z.string().optional() },
-        annotations: {
-            readOnlyHint: true,
-            destructiveHint: false,
-            idempotentHint: true,
-            openWorldHint: false,
-        },
+        inputSchema: z.object({ name: z.string().optional() }),
+        annotations: READ_ONLY_LOCAL,
     }, async (args) => mt.skills(args));
     server.registerTool("list_connectors", {
         description: LIST_DESC,
-        inputSchema: { probe: z.boolean().optional() },
+        inputSchema: z.object({ probe: z.boolean().optional() }),
         annotations: READ_ONLY_REMOTE,
     }, async (args) => mt.listConnectors(args));
     server.registerTool("search_tools", {
         description: describedFor(registry, SEARCH_DESC, "search"),
-        inputSchema: {
+        inputSchema: z.object({
             query: z.string().optional(),
             connector: z.string().optional(),
             limit: z.number().int().positive().max(MAX_SEARCH_LIMIT).optional(),
             offset: z.number().int().nonnegative().optional(),
             fullDescriptions: z.boolean().optional(),
             includeSchemas: z.enum(["compact", "json"]).optional(),
-        },
+        }),
         annotations: READ_ONLY_REMOTE,
     }, async (args) => mt.searchTools(args));
     server.registerTool("describe_tools", {
         description: describedFor(registry, DESCRIBE_DESC, "describe"),
-        inputSchema: {
+        inputSchema: z.object({
             addresses: z.array(z.string()).max(MAX_DESCRIBE_ADDRESSES),
             format: z.enum(["compact", "json"]).optional(),
             fullDescriptions: z.boolean().optional(),
-        },
+        }),
         annotations: READ_ONLY_REMOTE,
     }, async (args) => mt.describeTools(args));
     server.registerTool("call_tool", {
         description: CALL_DESC,
-        inputSchema: {
-            address: z.string(),
-            args: z.record(z.string(), z.unknown()).optional(),
-            fields: z.array(z.string()).optional(),
-            resultMode: z.enum(["mcp", "value"]).optional(),
-            timeoutMs: z.number().int().positive().optional(),
-            maxRetries: z.number().int().min(0).max(2).optional(),
-            diagnostics: z.boolean().optional(),
-        },
+        inputSchema: z.object(CALL_INPUT_SCHEMA),
         // call_tool admits only tools that are themselves explicitly read-only;
         // anything else is refused and routed to call_destructive_tool.
         annotations: READ_ONLY_REMOTE,
     }, async (args) => mt.callTool(args));
     server.registerTool("call_destructive_tool", {
         description: CALL_DESTRUCTIVE_DESC,
-        inputSchema: {
-            address: z.string(),
-            args: z.record(z.string(), z.unknown()).optional(),
-            fields: z.array(z.string()).optional(),
-            resultMode: z.enum(["mcp", "value"]).optional(),
-            timeoutMs: z.number().int().positive().optional(),
-            maxRetries: z.number().int().min(0).max(2).optional(),
-            diagnostics: z.boolean().optional(),
-        },
+        inputSchema: z.object(CALL_INPUT_SCHEMA),
         annotations: {
             destructiveHint: true,
             readOnlyHint: false,
@@ -966,10 +924,10 @@ export function registerMetaTools(server, registry, ctx) {
     }, async (args) => mt.callDestructiveTool(args));
     server.registerTool("authorize_connector", {
         description: AUTHORIZE_DESC,
-        inputSchema: {
+        inputSchema: z.object({
             connector: z.string(),
             force: z.boolean().optional(),
-        },
+        }),
         // Starts (or with force, resets) a downstream OAuth flow — it changes
         // stored connector auth state, so it is deliberately not read-only.
         annotations: {
@@ -980,7 +938,7 @@ export function registerMetaTools(server, registry, ctx) {
     }, async (args) => mt.authorizeConnector(args));
     server.registerTool("get_result", {
         description: GET_RESULT_DESC,
-        inputSchema: {
+        inputSchema: z.object({
             id: z.string(),
             // Both bounds are the shared rules (isValidResultOffset,
             // isValidMaxResultBytes) expressed for the wire: spelling them against
@@ -988,29 +946,21 @@ export function registerMetaTools(server, registry, ctx) {
             // in-handler checks if either floor ever moves.
             offset: z.number().int().min(MIN_RESULT_OFFSET).optional(),
             maxBytes: z.number().int().min(MIN_MAX_RESULT_BYTES).optional(),
-        },
+        }),
         annotations: READ_ONLY_LOCAL,
     }, async (args) => mt.getResult(args));
     server.registerTool("batch_call", {
         description: BATCH_DESC,
-        inputSchema: {
+        inputSchema: z.object({
             calls: z
-                .array(z.object({
-                address: z.string(),
-                args: z.record(z.string(), z.unknown()).optional(),
-                fields: z.array(z.string()).optional(),
-                resultMode: z.enum(["mcp", "value"]).optional(),
-                timeoutMs: z.number().int().positive().optional(),
-                maxRetries: z.number().int().min(0).max(2).optional(),
-                diagnostics: z.boolean().optional(),
-            }))
+                .array(z.object(CALL_INPUT_SCHEMA))
                 .min(1)
                 .max(10),
             resultMode: z.enum(["mcp", "value"]).optional(),
             timeoutMs: z.number().int().positive().optional(),
             maxRetries: z.number().int().min(0).max(2).optional(),
             diagnostics: z.boolean().optional(),
-        },
+        }),
         // Same gate as call_tool: every call in the batch must be explicitly
         // read-only or the batch is refused.
         annotations: READ_ONLY_REMOTE,