jetic-cli 0.1.7 → 0.1.9

package/dist/index.js

@@ -268509,7 +268509,7 @@ var require_endpoint_tools = __commonJS({
     "use strict";
     init_cjs_shims();
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.deleteEndpointSchema = exports2.updateEndpointSchema = exports2.addEndpointSchema = void 0;
+    exports2.deleteEndpointSchema = exports2.updateEndpointSchema = exports2.addEndpointSchema = exports2.constraintSchema = void 0;
     exports2.handleAddEndpoint = handleAddEndpoint;
     exports2.handleUpdateEndpoint = handleUpdateEndpoint;
     exports2.handleDeleteEndpoint = handleDeleteEndpoint;
@@ -268517,11 +268517,13 @@ var require_endpoint_tools = __commonJS({
     var crypto_1 = require("crypto");
     var types_1 = require_types();
     var parameterSchema = zod_1.z.object({
-      name: zod_1.z.string().describe("Parameter name"),
+      name: zod_1.z.string().min(1).describe("Parameter name"),
       in: zod_1.z.enum(["query", "path", "header", "cookie", "body"]).optional().describe("Parameter location in HTTP request"),
       type: zod_1.z.string().default("string").describe("Data type (string, number, boolean, array, object)"),
       format: zod_1.z.string().optional().describe("Format specifier (e.g. uuid, email, date-time, int64)"),
       required: zod_1.z.boolean().optional().describe("Whether parameter is required"),
+      min: zod_1.z.number().optional().describe("Minimum numeric value"),
+      max: zod_1.z.number().optional().describe("Maximum numeric value"),
       default: zod_1.z.any().optional().describe("Default value"),
       example: zod_1.z.any().optional().describe("Example value"),
       description: zod_1.z.string().optional().describe("Description")
@@ -268530,46 +268532,115 @@ var require_endpoint_tools = __commonJS({
       type: zod_1.z.string().describe("Data type (string, number, boolean, array, object)"),
       format: zod_1.z.string().optional().describe("Format specifier"),
       required: zod_1.z.boolean().optional().describe("Required flag"),
+      min: zod_1.z.number().optional().describe("Minimum numeric value"),
+      max: zod_1.z.number().optional().describe("Maximum numeric value"),
+      minLength: zod_1.z.number().optional().describe("Minimum string length"),
+      maxLength: zod_1.z.number().optional().describe("Maximum string length"),
       description: zod_1.z.string().optional().describe("Description"),
       example: zod_1.z.any().optional().describe("Example value"),
       default: zod_1.z.any().optional().describe("Default value"),
       enum: zod_1.z.array(zod_1.z.string()).optional().describe("Allowed enum values")
     });
+    exports2.constraintSchema = zod_1.z.object({
+      field: zod_1.z.string().optional().describe("Field this constraint applies to"),
+      rule: zod_1.z.string().optional().describe("Rule name (e.g. minLength, matches, requiredIf)"),
+      value: zod_1.z.any().optional().describe("Rule value / threshold"),
+      conflictStatus: zod_1.z.number().int().optional().describe("HTTP status on conflict"),
+      failureStatus: zod_1.z.number().int().optional().describe("HTTP status on validation failure"),
+      when: zod_1.z.object({
+        field: zod_1.z.string().describe("Condition field"),
+        present: zod_1.z.boolean().optional(),
+        equals: zod_1.z.any().optional()
+      }).optional().describe("Conditional constraint trigger"),
+      then: zod_1.z.object({
+        field: zod_1.z.string().describe("Field to constrain"),
+        type: zod_1.z.string().describe("Expected type when condition holds")
+      }).optional().describe("Conditional constraint effect")
+    });
     var requestBodySchema = zod_1.z.object({
       contentType: zod_1.z.string().nullable().default("application/json").describe("Content-Type header (e.g. application/json, multipart/form-data)"),
       required: zod_1.z.boolean().optional().describe("Whether request body is required"),
-      fields: zod_1.z.record(fieldDefinitionSchema).default({}).describe("Key-value record of payload fields")
+      fields: zod_1.z.record(fieldDefinitionSchema).default({}).describe("Key-value record of payload fields"),
+      constraints: zod_1.z.array(exports2.constraintSchema).optional().describe("Business-rule constraints extracted from handler logic (e.g. password minLength)")
     });
     var responseDefinitionSchema = zod_1.z.object({
       contentType: zod_1.z.string().optional().default("application/json"),
       description: zod_1.z.string().optional().describe("Human readable response description"),
-      schema: zod_1.z.record(zod_1.z.string()).optional().describe("Response body schema description (field -> type)"),
-      example: zod_1.z.any().optional().describe("Response payload example")
+      schema: zod_1.z.record(zod_1.z.string()).optional().describe("Response body schema description (field -> type, dot paths allowed)"),
+      example: zod_1.z.any().optional().describe("Response payload example"),
+      condition: zod_1.z.string().optional().describe("Condition under which this response occurs"),
+      ownershipCheck: zod_1.z.boolean().optional().describe("Whether this response enforces an ownership check")
     });
     var endpointSecuritySchema = zod_1.z.object({
-      scheme: zod_1.z.string().describe("Name of security scheme (e.g. bearerAuth, apiKey)"),
+      scheme: zod_1.z.string().describe("Name of security scheme declared in top-level securitySchemes (e.g. bearerAuth, apiKey)"),
       required: zod_1.z.boolean().optional().default(true),
-      scopes: zod_1.z.array(zod_1.z.string()).optional()
+      scopes: zod_1.z.array(zod_1.z.string()).optional().describe("OAuth2 scopes (only for oauth2 schemes)")
     });
     var sourceReferenceSchema = zod_1.z.object({
       file: zod_1.z.string().describe("Relative or absolute path to source file containing handler/route"),
       line: zod_1.z.number().describe("Line number in source file"),
       column: zod_1.z.number().optional()
     });
+    var middlewareSchema = zod_1.z.object({
+      name: zod_1.z.string().min(1).describe('Middleware name as in code (e.g. "auth", "cors", "express.json", "rateLimit")'),
+      type: zod_1.z.string().optional().describe('Middleware category (e.g. "auth", "parser", "cors", "rate-limit", "validation", "logging")'),
+      scheme: zod_1.z.string().optional().describe("Security scheme this middleware enforces (e.g. bearerAuth)"),
+      config: zod_1.z.record(zod_1.z.any()).optional().describe('Middleware options (e.g. { "max": 100, "windowMs": 60000 })'),
+      source: sourceReferenceSchema.optional().describe("Where the middleware is applied in source")
+    });
+    var paginationSchema = zod_1.z.object({
+      type: zod_1.z.enum(["offset", "cursor", "page"]).describe("Pagination strategy"),
+      pageParam: zod_1.z.string().optional().describe('Query param for page number/offset (e.g. "page")'),
+      limitParam: zod_1.z.string().optional().describe('Query param for page size (e.g. "limit")'),
+      cursorParam: zod_1.z.string().optional().describe("Query param for cursor (cursor strategy)"),
+      totalPath: zod_1.z.string().optional().describe('Response path to total count (e.g. "meta.total")')
+    });
+    var rateLimitSchema = zod_1.z.object({
+      windowMs: zod_1.z.number().int().positive().describe("Rate-limit window in milliseconds"),
+      max: zod_1.z.number().int().positive().describe("Max requests per window"),
+      scope: zod_1.z.string().optional().describe('Limit scope (e.g. "ip", "user", "global")')
+    });
+    var ownershipSchema = zod_1.z.object({
+      ownerField: zod_1.z.string().describe('Resource field holding the owner id (e.g. "userId")'),
+      mustMatchAuthClaim: zod_1.z.string().describe('Auth claim it must equal (e.g. "sub")')
+    });
+    var producesSchema = zod_1.z.object({
+      variable: zod_1.z.string().optional().describe('Memory variable name produced (e.g. "accessToken")'),
+      responseField: zod_1.z.string().optional().describe('Response path the value comes from (e.g. "data.accessToken")'),
+      resourceStateChange: zod_1.z.object({
+        resource: zod_1.z.string(),
+        field: zod_1.z.string(),
+        setFrom: zod_1.z.string()
+      }).optional().describe("Resource state mutation caused by this endpoint")
+    });
+    var consumesSchema = zod_1.z.object({
+      variable: zod_1.z.string().describe('Memory variable consumed (e.g. "accessToken")'),
+      usedAs: zod_1.z.string().describe('How it is used: "header:<Name>" (Bearer prefix auto-added for Authorization) or "body:<field>" / "query:<param>"'),
+      producedBy: zod_1.z.string().optional().describe('"METHOD /path" of the endpoint that produces it')
+    });
     exports2.addEndpointSchema = zod_1.z.object({
       projectPath: zod_1.z.string().optional().describe("Path to project root or .jetic folder"),
       method: zod_1.z.enum(["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS", "HEAD"]).describe("HTTP method"),
       path: zod_1.z.string().describe("Route path (e.g., /api/v1/users or /api/users/:id)"),
       name: zod_1.z.string().optional().describe('Human-readable endpoint name (e.g., "Create User")'),
+      summary: zod_1.z.string().optional().describe("Short one-line summary"),
       description: zod_1.z.string().optional().describe("Detailed description of endpoint functionality"),
       tags: zod_1.z.array(zod_1.z.string()).optional().describe('Category tags (e.g., ["users", "auth"])'),
+      deprecated: zod_1.z.boolean().optional().describe("Mark endpoint as deprecated"),
+      timeout: zod_1.z.number().int().positive().optional().describe("Request timeout in milliseconds"),
       handlerName: zod_1.z.string().optional().describe("Handler / controller function name (e.g. UserController.create)"),
       resource: zod_1.z.string().optional().describe("Associated domain resource (e.g. User, Order)"),
       source: sourceReferenceSchema.optional().describe("Source code provenance location"),
-      security: zod_1.z.array(endpointSecuritySchema).optional().describe("Security requirements"),
+      security: zod_1.z.array(endpointSecuritySchema).optional().describe("Security requirements (schemes must exist in top-level securitySchemes)"),
+      middleware: zod_1.z.array(middlewareSchema).optional().describe("Middleware chain IN EXECUTION ORDER (e.g. cors \u2192 json parser \u2192 auth \u2192 rateLimit \u2192 validator)"),
       parameters: zod_1.z.array(parameterSchema).optional().describe("Query, path, header, or cookie parameters"),
-      requestBody: requestBodySchema.optional().describe("Request body specification"),
+      requestBody: requestBodySchema.optional().describe("Request body specification incl. business-rule constraints"),
       responses: zod_1.z.record(responseDefinitionSchema).optional().describe('Response definitions keyed by status code (e.g. "200", "400")'),
+      pagination: paginationSchema.optional().describe("Pagination config for list endpoints"),
+      rateLimit: rateLimitSchema.optional().describe("Rate-limit config"),
+      ownership: ownershipSchema.optional().describe("Ownership / authorization rule"),
+      produces: zod_1.z.array(producesSchema).optional().describe("Memory variables produced from responses (feeds workflows)"),
+      consumes: zod_1.z.array(consumesSchema).optional().describe("Memory variables consumed as headers/body (chained auth)"),
       overwriteIfExists: zod_1.z.boolean().optional().default(true).describe("If endpoint with same method and path exists, update it instead of erroring")
     });
     function handleAddEndpoint(args) {
@@ -268581,6 +268652,11 @@ var require_endpoint_tools = __commonJS({
       if (existingIndex >= 0 && !overwriteIfExists) {
         throw new Error(`Endpoint ${methodUpper} ${normalizedPath} already exists in ${filePath}. Set overwriteIfExists: true to update it.`);
       }
+      for (const mw of args.middleware || []) {
+        if (!mw.name || !mw.name.trim()) {
+          throw new Error('Middleware entries must have a non-empty "name".');
+        }
+      }
       const source = args.source || {
         file: "manual-mcp",
         line: 1
@@ -268599,21 +268675,31 @@ var require_endpoint_tools = __commonJS({
           description: "Internal server error"
         }
       };
+      const previous = existingIndex >= 0 ? model.endpoints[existingIndex] : void 0;
       const newEndpoint = {
-        id: existingIndex >= 0 ? model.endpoints[existingIndex].id : (0, crypto_1.randomUUID)(),
+        id: previous?.id || (0, crypto_1.randomUUID)(),
         method: methodUpper,
         path: normalizedPath,
         name: args.name || `${methodUpper} ${normalizedPath}`,
+        summary: args.summary,
         description: args.description,
         tags: args.tags || [],
+        deprecated: args.deprecated,
+        timeout: args.timeout,
         handlerName: args.handlerName,
         resource: args.resource,
         source,
         security: args.security,
+        // Explicit middleware wins; otherwise preserve the previous chain (never silently drop it).
+        middleware: args.middleware || previous?.middleware || [],
         parameters: args.parameters,
         requestBody: args.requestBody,
         responses,
-        middleware: existingIndex >= 0 ? model.endpoints[existingIndex].middleware : []
+        pagination: args.pagination,
+        rateLimit: args.rateLimit || previous?.rateLimit,
+        ownership: args.ownership,
+        produces: args.produces,
+        consumes: args.consumes
       };
       if (existingIndex >= 0) {
         model.endpoints[existingIndex] = newEndpoint;
@@ -268621,31 +268707,45 @@ var require_endpoint_tools = __commonJS({
         model.endpoints.push(newEndpoint);
       }
       (0, types_1.saveModel)(filePath, model);
+      const unknownSchemes = (args.security || []).map((s) => s.scheme).filter((scheme) => model.securitySchemes && !(scheme in (model.securitySchemes || {})));
       return {
         success: true,
         action: existingIndex >= 0 ? "updated" : "added",
         filePath,
         endpointId: newEndpoint.id,
+        ...unknownSchemes.length > 0 ? {
+          warning: `Security scheme(s) not declared in top-level securitySchemes: ${unknownSchemes.join(", ")}. Declare them or run jetic_verify_model for details.`
+        } : {},
         endpoint: newEndpoint
       };
     }
+    var endpointUpdatesSchema = zod_1.z.object({
+      name: zod_1.z.string().optional(),
+      summary: zod_1.z.string().optional(),
+      description: zod_1.z.string().optional(),
+      tags: zod_1.z.array(zod_1.z.string()).optional(),
+      deprecated: zod_1.z.boolean().optional(),
+      timeout: zod_1.z.number().int().positive().optional(),
+      handlerName: zod_1.z.string().optional(),
+      resource: zod_1.z.string().optional(),
+      source: sourceReferenceSchema.optional(),
+      security: zod_1.z.array(endpointSecuritySchema).optional(),
+      middleware: zod_1.z.array(middlewareSchema).optional().describe("Replaces the whole middleware chain (order = execution order)"),
+      parameters: zod_1.z.array(parameterSchema).optional(),
+      requestBody: requestBodySchema.optional(),
+      responses: zod_1.z.record(responseDefinitionSchema).optional(),
+      pagination: paginationSchema.optional(),
+      rateLimit: rateLimitSchema.nullable().optional().describe("Set to null to remove rate limiting"),
+      ownership: ownershipSchema.optional(),
+      produces: zod_1.z.array(producesSchema).optional(),
+      consumes: zod_1.z.array(consumesSchema).optional()
+    });
     exports2.updateEndpointSchema = zod_1.z.object({
       projectPath: zod_1.z.string().optional().describe("Path to project root or .jetic folder"),
       id: zod_1.z.string().optional().describe("Target endpoint UUID"),
       method: zod_1.z.enum(["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS", "HEAD"]).optional().describe("HTTP method"),
       path: zod_1.z.string().optional().describe("Route path"),
-      updates: zod_1.z.object({
-        name: zod_1.z.string().optional(),
-        description: zod_1.z.string().optional(),
-        tags: zod_1.z.array(zod_1.z.string()).optional(),
-        handlerName: zod_1.z.string().optional(),
-        resource: zod_1.z.string().optional(),
-        source: sourceReferenceSchema.optional(),
-        security: zod_1.z.array(endpointSecuritySchema).optional(),
-        parameters: zod_1.z.array(parameterSchema).optional(),
-        requestBody: requestBodySchema.optional(),
-        responses: zod_1.z.record(responseDefinitionSchema).optional()
-      }).describe("Partial endpoint properties to update")
+      updates: endpointUpdatesSchema.describe("Partial endpoint properties to update (middleware replaces the whole chain)")
     });
     function handleUpdateEndpoint(args) {
       const { model, filePath } = (0, types_1.loadModel)(args.projectPath);
@@ -268666,10 +268766,16 @@ var require_endpoint_tools = __commonJS({
       const { updates } = args;
       if (updates.name !== void 0)
         endpoint.name = updates.name;
+      if (updates.summary !== void 0)
+        endpoint.summary = updates.summary;
       if (updates.description !== void 0)
         endpoint.description = updates.description;
       if (updates.tags !== void 0)
         endpoint.tags = updates.tags;
+      if (updates.deprecated !== void 0)
+        endpoint.deprecated = updates.deprecated;
+      if (updates.timeout !== void 0)
+        endpoint.timeout = updates.timeout;
       if (updates.handlerName !== void 0)
         endpoint.handlerName = updates.handlerName;
       if (updates.resource !== void 0)
@@ -268678,12 +268784,29 @@ var require_endpoint_tools = __commonJS({
         endpoint.source = updates.source;
       if (updates.security !== void 0)
         endpoint.security = updates.security;
+      if (updates.middleware !== void 0) {
+        for (const mw of updates.middleware) {
+          if (!mw.name || !mw.name.trim())
+            throw new Error('Middleware entries must have a non-empty "name".');
+        }
+        endpoint.middleware = updates.middleware;
+      }
       if (updates.parameters !== void 0)
         endpoint.parameters = updates.parameters;
       if (updates.requestBody !== void 0)
         endpoint.requestBody = updates.requestBody;
       if (updates.responses !== void 0)
         endpoint.responses = updates.responses;
+      if (updates.pagination !== void 0)
+        endpoint.pagination = updates.pagination;
+      if (updates.rateLimit !== void 0)
+        endpoint.rateLimit = updates.rateLimit;
+      if (updates.ownership !== void 0)
+        endpoint.ownership = updates.ownership;
+      if (updates.produces !== void 0)
+        endpoint.produces = updates.produces;
+      if (updates.consumes !== void 0)
+        endpoint.consumes = updates.consumes;
       (0, types_1.saveModel)(filePath, model);
       return {
         success: true,
@@ -269294,6 +269417,570 @@ var require_workflow_tools = __commonJS({
   }
 });
 
+// ../../packages/mcp-server/dist/tools/workflow-authoring-tools.js
+var require_workflow_authoring_tools = __commonJS({
+  "../../packages/mcp-server/dist/tools/workflow-authoring-tools.js"(exports2) {
+    "use strict";
+    init_cjs_shims();
+    var __createBinding = exports2 && exports2.__createBinding || (Object.create ? (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      var desc = Object.getOwnPropertyDescriptor(m, k);
+      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m[k];
+        } };
+      }
+      Object.defineProperty(o, k2, desc);
+    }) : (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      o[k2] = m[k];
+    }));
+    var __setModuleDefault = exports2 && exports2.__setModuleDefault || (Object.create ? (function(o, v) {
+      Object.defineProperty(o, "default", { enumerable: true, value: v });
+    }) : function(o, v) {
+      o["default"] = v;
+    });
+    var __importStar = exports2 && exports2.__importStar || /* @__PURE__ */ (function() {
+      var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function(o2) {
+          var ar = [];
+          for (var k in o2) if (Object.prototype.hasOwnProperty.call(o2, k)) ar[ar.length] = k;
+          return ar;
+        };
+        return ownKeys(o);
+      };
+      return function(mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) {
+          for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        }
+        __setModuleDefault(result, mod);
+        return result;
+      };
+    })();
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.deleteWorkflowSchema = exports2.updateWorkflowSchema = exports2.createWorkflowSchema = exports2.validateWorkflowSchema = exports2.workflowStepSchema = void 0;
+    exports2.validateWorkflowDefinition = validateWorkflowDefinition;
+    exports2.slugifyWorkflowName = slugifyWorkflowName;
+    exports2.handleValidateWorkflow = handleValidateWorkflow;
+    exports2.handleCreateWorkflow = handleCreateWorkflow;
+    exports2.handleUpdateWorkflow = handleUpdateWorkflow;
+    exports2.handleDeleteWorkflow = handleDeleteWorkflow;
+    var zod_1 = require("zod");
+    var fs4 = __importStar(require("fs"));
+    var path7 = __importStar(require("path"));
+    var types_1 = require_types();
+    var workflow_tools_1 = require_workflow_tools();
+    exports2.workflowStepSchema = zod_1.z.object({
+      name: zod_1.z.string().min(1).describe("Step name (must be unique within the workflow)"),
+      method: zod_1.z.enum(["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS", "HEAD"]).describe("HTTP method"),
+      path: zod_1.z.string().min(1).describe("Route path; :params resolve from body/memory (NOT from {{templates}} \u2014 those only work in body/inject)"),
+      description: zod_1.z.string().optional().describe("What this step does"),
+      body: zod_1.z.record(zod_1.z.any()).optional().describe("Request payload. Values support {{faker.*}}, {{scope:key}} and {{workflow:key}} templates"),
+      inject: zod_1.z.record(zod_1.z.string()).optional().describe('Memory/header injection: "header:Name" or "body:field" (or bare header name) -> "scope:key" or "{{template}}"'),
+      capture: zod_1.z.record(zod_1.z.string()).optional().describe('Save RESPONSE fields to memory: "scope:key" -> "dot.path.in.response"'),
+      captureInput: zod_1.z.record(zod_1.z.string()).optional().describe('Save REQUEST body fields to memory BEFORE sending: "scope:key" -> "bodyField"'),
+      expectStatus: zod_1.z.number().int().positive().optional().describe("Expected HTTP status (default 200; any 2xx passes when expecting 2xx)")
+      // NOTE: .passthrough() is intentional — unknown keys must REACH the validator
+      // (MODEL_DIALECT_KEY / UNKNOWN_STEP_KEY diagnostics). Zod's default strip
+      // behavior would silently swallow the exact mistakes we need to report.
+    }).passthrough();
+    var inlineWorkflowSchema = zod_1.z.object({
+      name: zod_1.z.string().min(1).describe("Workflow name (also used to derive the file slug)"),
+      description: zod_1.z.string().optional(),
+      environment: zod_1.z.string().optional().describe("Target environment name from the model (e.g. local)"),
+      steps: zod_1.z.array(exports2.workflowStepSchema).min(1).describe("Ordered steps; later steps can use memory captured by earlier ones")
+    }).passthrough();
+    var TEMPLATE_RE = /\{\{\s*([^}]+?)\s*\}\}/g;
+    var KNOWN_WORKFLOW_KEYS = /* @__PURE__ */ new Set(["name", "description", "environment", "steps", "generatedAt"]);
+    var KNOWN_STEP_KEYS = /* @__PURE__ */ new Set([
+      "name",
+      "method",
+      "path",
+      "description",
+      "inject",
+      "capture",
+      "captureInput",
+      "expectStatus",
+      "body",
+      "condition"
+    ]);
+    var MODEL_DIALECT_KEYS = /* @__PURE__ */ new Set(["call", "auth", "bind"]);
+    function err(list, stepIndex, stepName, code, message, fix) {
+      list.push({ severity: "error", stepIndex, stepName, code, message, fix });
+    }
+    function warn(list, stepIndex, stepName, code, message, fix) {
+      list.push({ severity: "warning", stepIndex, stepName, code, message, fix });
+    }
+    function splitMemKey(raw) {
+      const idx = raw.indexOf(":");
+      if (idx <= 0)
+        return { scope: "workflow", key: raw };
+      return { scope: raw.slice(0, idx), key: raw.slice(idx + 1) };
+    }
+    function readMemoryKeys(projectRoot) {
+      const keys = /* @__PURE__ */ new Set();
+      try {
+        const memPath = path7.join(projectRoot, ".jetic", "memory.json");
+        if (!fs4.existsSync(memPath))
+          return keys;
+        const data = JSON.parse(fs4.readFileSync(memPath, "utf-8"));
+        for (const [scope, entries] of Object.entries(data || {})) {
+          if (!entries || typeof entries !== "object")
+            continue;
+          for (const key of Object.keys(entries))
+            keys.add(`${scope}:${key}`);
+        }
+      } catch {
+      }
+      return keys;
+    }
+    function collectTemplateRefs(value, out) {
+      if (typeof value === "string") {
+        TEMPLATE_RE.lastIndex = 0;
+        let m;
+        while ((m = TEMPLATE_RE.exec(value)) !== null)
+          out.push(m[1].trim());
+      } else if (Array.isArray(value)) {
+        for (const v of value)
+          collectTemplateRefs(v, out);
+      } else if (value && typeof value === "object") {
+        for (const v of Object.values(value))
+          collectTemplateRefs(v, out);
+      }
+    }
+    function suggestEndpoints(model, method, wfPath) {
+      const samePath = model.filter((e) => e.path === wfPath).map((e) => `${e.method} ${e.path}`);
+      if (samePath.length > 0)
+        return samePath.slice(0, 3);
+      const prefix = wfPath.split("/").slice(0, 3).join("/");
+      return model.filter((e) => e.path.startsWith(prefix)).map((e) => `${e.method} ${e.path}`).slice(0, 3);
+    }
+    function validateWorkflowDefinition(wf, opts) {
+      const errors = [];
+      const warnings = [];
+      const { model } = (0, types_1.loadModel)(opts?.projectPath);
+      const projectRoot = (0, types_1.projectRootOfModel)((0, types_1.resolveModelPath)(opts?.projectPath));
+      const persistedMemory = readMemoryKeys(projectRoot);
+      if (!wf || typeof wf !== "object") {
+        err(errors, void 0, void 0, "NOT_AN_OBJECT", "Workflow must be an object with name + steps.", "Pass { name, steps: [...] }.");
+        return toReport(errors, warnings);
+      }
+      if (!wf.name || typeof wf.name !== "string" || !wf.name.trim()) {
+        err(errors, void 0, void 0, "MISSING_NAME", 'Workflow needs a non-empty "name".', 'Set a descriptive name like "User onboarding".');
+      }
+      if (!Array.isArray(wf.steps) || wf.steps.length === 0) {
+        err(errors, void 0, void 0, "NO_STEPS", "Workflow needs at least one step.", "Add steps with { name, method, path }.");
+        return toReport(errors, warnings);
+      }
+      if (wf.environment && !(model.environments || []).some((e) => e.name === wf.environment)) {
+        warn(warnings, void 0, void 0, "UNKNOWN_ENVIRONMENT", `Environment "${wf.environment}" is not declared in model.json.`, `Use one of: ${(model.environments || []).map((e) => e.name).join(", ") || "(none declared)"}, or add it with jetic_manage_environment.`);
+      }
+      for (const key of Object.keys(wf)) {
+        if (!KNOWN_WORKFLOW_KEYS.has(key)) {
+          warn(warnings, void 0, void 0, "UNKNOWN_WORKFLOW_KEY", `Top-level key "${key}" is not part of the file-workflow format and will be ignored.`, "Valid keys: name, description, environment, steps.");
+        }
+      }
+      const seenNames = /* @__PURE__ */ new Set();
+      const defined = /* @__PURE__ */ new Set();
+      wf.steps.forEach((rawStep, i) => {
+        const stepNo = i + 1;
+        const sName = typeof rawStep?.name === "string" ? rawStep.name : void 0;
+        if (!rawStep || typeof rawStep !== "object" || Array.isArray(rawStep)) {
+          err(errors, stepNo, void 0, "STEP_NOT_AN_OBJECT", `Step ${stepNo} must be an object.`, "Use { name, method, path, ... }.");
+          return;
+        }
+        const step = rawStep;
+        for (const key of Object.keys(step)) {
+          if (MODEL_DIALECT_KEYS.has(key)) {
+            err(errors, stepNo, sName, "MODEL_DIALECT_KEY", `Step ${stepNo} uses "${key}" from the model-embedded workflow dialect, which file workflows ignore.`, 'File-workflow equivalent: split "call" into method+path; replace auth/bind with inject/capture.');
+          } else if (!KNOWN_STEP_KEYS.has(key)) {
+            warn(warnings, stepNo, sName, "UNKNOWN_STEP_KEY", `Step ${stepNo} has unknown key "${key}" which the simulator ignores.`, "Remove it or check the field name (valid: name, method, path, description, body, inject, capture, captureInput, expectStatus).");
+          }
+        }
+        if ("condition" in step) {
+          warn(warnings, stepNo, sName, "CONDITION_IGNORED", `"condition" is accepted but currently ignored by the simulator \u2014 the step always runs.`, "Encode branching as separate workflows, or gate with expectStatus per step.");
+        }
+        if (!sName || !sName.trim()) {
+          err(errors, stepNo, void 0, "STEP_MISSING_NAME", `Step ${stepNo} needs a non-empty "name".`, "Give every step a unique descriptive name.");
+        } else if (seenNames.has(sName)) {
+          warn(warnings, stepNo, sName, "DUPLICATE_STEP_NAME", `Duplicate step name "${sName}".`, "Rename steps so logs stay readable.");
+        } else {
+          seenNames.add(sName);
+        }
+        const method = typeof step.method === "string" ? step.method.toUpperCase() : void 0;
+        const validMethods = ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS", "HEAD"];
+        if (!method || !validMethods.includes(method)) {
+          err(errors, stepNo, sName, "BAD_METHOD", `Step ${stepNo} has invalid method ${JSON.stringify(step.method)}.`, `Use one of: ${validMethods.join(", ")}.`);
+          return;
+        }
+        if (typeof step.path !== "string" || !step.path.trim()) {
+          err(errors, stepNo, sName, "BAD_PATH", `Step ${stepNo} needs a "path" string.`, 'Use the route path, e.g. "/api/users/:id".');
+          return;
+        }
+        const wfPath = step.path.startsWith("/") ? step.path : `/${step.path}`;
+        const endpoint = (model.endpoints || []).find((e) => e.method.toUpperCase() === method && e.path === wfPath);
+        if (!endpoint) {
+          const suggestions = suggestEndpoints(model.endpoints || [], method, wfPath);
+          const msg = `Step ${stepNo} (${method} ${wfPath}) matches no endpoint in model.json.` + (suggestions.length > 0 ? ` Did you mean: ${suggestions.join(" | ")}?` : "");
+          if (opts?.allowUnknownEndpoints) {
+            warn(warnings, stepNo, sName, "UNKNOWN_ENDPOINT", msg, "Add the endpoint with jetic_add_endpoint so future runs stay verifiable.");
+          } else {
+            err(errors, stepNo, sName, "UNKNOWN_ENDPOINT", msg, "Add it with jetic_add_endpoint, fix the method/path, or re-run with allowUnknownEndpoints.");
+          }
+        } else if (step.expectStatus !== void 0) {
+          const codes = Object.keys(endpoint.responses || {});
+          const exp = Number(step.expectStatus);
+          const in2xx = exp >= 200 && exp < 300;
+          const modelHas2xx = codes.some((c3) => Number(c3) >= 200 && Number(c3) < 300);
+          if (!codes.includes(String(exp)) && !(in2xx && modelHas2xx)) {
+            warn(warnings, stepNo, sName, "UNEXPECTED_STATUS", `Step ${stepNo} expects ${exp} but the model declares [${codes.join(", ") || "none"}] for ${method} ${wfPath}.`, "Align expectStatus with the model, or update the endpoint responses.");
+          }
+        }
+        if (step.body !== void 0 && (typeof step.body !== "object" || step.body === null || Array.isArray(step.body))) {
+          err(errors, stepNo, sName, "BAD_BODY", `Step ${stepNo} "body" must be an object of field -> value.`, 'Use { "email": "{{faker.internet.email}}" }.');
+        }
+        if ((method === "GET" || method === "HEAD") && step.body && Object.keys(step.body).length > 0) {
+          warn(warnings, stepNo, sName, "GET_WITH_BODY", `Step ${stepNo} is ${method} with a body \u2014 it will be sent as URL query params, not a JSON body.`, "This is usually what you want for filters; otherwise switch to POST.");
+        }
+        if (endpoint?.requestBody?.fields && step.body && typeof step.body === "object") {
+          for (const field of Object.keys(step.body)) {
+            if (!(field in endpoint.requestBody.fields)) {
+              warn(warnings, stepNo, sName, "UNKNOWN_BODY_FIELD", `Step ${stepNo} sends body field "${field}" not declared on ${method} ${wfPath}.`, "Check the spelling, or extend the endpoint with jetic_update_endpoint.");
+            }
+          }
+        }
+        const pathParams = wfPath.match(/:([a-zA-Z_][a-zA-Z0-9_]*)/g) || [];
+        for (const p of pathParams) {
+          const pname = p.substring(1);
+          const inBody = step.body && typeof step.body === "object" && pname in step.body;
+          const inMemory = [...defined].some((d) => d.split(":")[1] === pname) || [...persistedMemory].some((d) => d.split(":")[1] === pname);
+          if (!inBody && !inMemory) {
+            err(errors, stepNo, sName, "UNRESOLVED_PATH_PARAM", `Path param ":${pname}" in step ${stepNo} has no body field or memory source \u2014 the URL will literally contain ":${pname}" and fail.`, `Add "${pname}" to this step's body, or capture it as memory in an earlier step (capture: { "workflow:${pname}": "data.${pname}" }).`);
+          }
+        }
+        if (/\{\{[^}]+\}\}/.test(wfPath)) {
+          warn(warnings, stepNo, sName, "PATH_TEMPLATE", `Step ${stepNo} path contains a {{template}} \u2014 paths only resolve :params, templates work in body/inject.`, 'Use "/api/users/:id" with an "id" body field or captured memory key.');
+        }
+        const refs = [];
+        collectTemplateRefs(step.body, refs);
+        if (step.inject && typeof step.inject === "object") {
+          for (const v of Object.values(step.inject))
+            collectTemplateRefs(v, refs);
+        }
+        for (const ref of refs) {
+          if (ref.startsWith("faker.")) {
+            if (ref.split(".").length < 3) {
+              warn(warnings, stepNo, sName, "SUSPICIOUS_FAKER", `"{{${ref}}}" looks like an incomplete faker path.`, "Use full paths like {{faker.internet.email}} or {{faker.string.uuid}}.");
+            }
+            continue;
+          }
+          if (!ref.includes(":")) {
+            err(errors, stepNo, sName, "BAD_TEMPLATE", `"{{${ref}}}" in step ${stepNo} needs a scope ("{{workflow:key}}", "{{scope:key}}") or faker ("{{faker.x.y}}").`, "Bare {{key}} is left literal \u2014 add the scope prefix.");
+            continue;
+          }
+          const { scope, key } = splitMemKey(ref);
+          if (!key) {
+            err(errors, stepNo, sName, "BAD_TEMPLATE", `"{{${ref}}}" has an empty key.`, "Use {{scope:key}} with a real key.");
+            continue;
+          }
+          const full = `${scope}:${key}`;
+          if (!defined.has(full) && !persistedMemory.has(full)) {
+            err(errors, stepNo, sName, "UNDEFINED_MEMORY_REF", `"{{${ref}}}" in step ${stepNo} is never captured by an earlier step and is not in memory.json \u2014 it resolves to "".`, `Capture "${full}" in an earlier step (capture/captureInput), or seed it first.`);
+          } else if (!defined.has(full)) {
+            warn(warnings, stepNo, sName, "MEMORY_FILE_DEPENDENT", `"{{${ref}}}" in step ${stepNo} only exists in the current memory.json, not from an earlier step \u2014 reruns after memory clear will break.`, `Capture "${full}" inside this workflow instead.`);
+          }
+        }
+        if (step.inject !== void 0) {
+          if (typeof step.inject !== "object" || step.inject === null || Array.isArray(step.inject)) {
+            err(errors, stepNo, sName, "BAD_INJECT", `Step ${stepNo} "inject" must be an object.`, 'Use { "header:Authorization": "Bearer {{workflow:accessToken}}" }.');
+          } else {
+            for (const [target, memRef] of Object.entries(step.inject)) {
+              if (!target.trim() || typeof memRef !== "string" || !memRef.trim()) {
+                err(errors, stepNo, sName, "BAD_INJECT", `Step ${stepNo} has an empty inject target or value.`, 'Use "header:Name"/"body:field" -> "scope:key".');
+              }
+            }
+          }
+        }
+        for (const field of ["capture", "captureInput"]) {
+          const cap = step[field];
+          if (cap === void 0)
+            continue;
+          if (typeof cap !== "object" || cap === null || Array.isArray(cap)) {
+            err(errors, stepNo, sName, "BAD_CAPTURE", `Step ${stepNo} "${field}" must be an object.`, `Use { "workflow:myVar": "${field === "capture" ? "data.id" : "bodyField"}" }.`);
+            continue;
+          }
+          for (const [memKey, srcPath] of Object.entries(cap)) {
+            if (!memKey.trim() || typeof srcPath !== "string" || !srcPath.trim()) {
+              err(errors, stepNo, sName, "BAD_CAPTURE", `Step ${stepNo} "${field}" has an empty key or path.`, 'Use { "workflow:myVar": "data.id" }.');
+              continue;
+            }
+            if (field === "captureInput" && (!step.body || typeof step.body !== "object" || !(srcPath in step.body))) {
+              warn(warnings, stepNo, sName, "CAPTURE_INPUT_MISSING_FIELD", `captureInput "${memKey}" reads body field "${srcPath}" which step ${stepNo} does not send.`, 'Add the field to body, or capture from the response with "capture" instead.');
+            }
+          }
+        }
+        for (const field of ["capture", "captureInput"]) {
+          const cap = step[field];
+          if (cap && typeof cap === "object" && !Array.isArray(cap)) {
+            for (const memKey of Object.keys(cap)) {
+              const { scope, key } = splitMemKey(memKey);
+              if (key)
+                defined.add(`${scope}:${key}`);
+            }
+          }
+        }
+      });
+      return toReport(errors, warnings);
+    }
+    function toReport(errors, warnings) {
+      return {
+        valid: errors.length === 0,
+        errorsCount: errors.length,
+        warningsCount: warnings.length,
+        errors,
+        warnings
+      };
+    }
+    function slugifyWorkflowName(name) {
+      const slug = name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 80);
+      return slug || "workflow";
+    }
+    function workflowsDir(projectPath) {
+      return path7.join(path7.dirname((0, types_1.resolveModelPath)(projectPath)), "workflows");
+    }
+    function workflowFilePath(projectPath, slug) {
+      return path7.join(workflowsDir(projectPath), `${slug}.json`);
+    }
+    function resolveFileWorkflow(projectPath, ref) {
+      const listing = (0, workflow_tools_1.handleListWorkflows)({ projectPath });
+      const search = ref.toLowerCase();
+      const item = listing.workflows.find((w) => w.id.toLowerCase() === search || w.name.toLowerCase() === search || w.filePath && path7.resolve(w.filePath).toLowerCase() === path7.resolve(ref).toLowerCase());
+      if (!item) {
+        throw new Error(`Workflow "${ref}" not found. Available: ${listing.workflows.map((w) => w.id).join(", ") || "(none)"}.`);
+      }
+      if (item.source === "model_json" || !item.filePath) {
+        throw new Error(`Workflow "${ref}" lives inside model.json, which this tool cannot edit. Migrate it with jetic_create_workflow { fromModelWorkflow: "${item.name}" } first.`);
+      }
+      let def;
+      try {
+        def = JSON.parse(fs4.readFileSync(item.filePath, "utf-8"));
+      } catch (e) {
+        throw new Error(`Cannot read workflow file at ${item.filePath}: ${e?.message || e}`);
+      }
+      return { slug: item.id, filePath: item.filePath, def };
+    }
+    function migrateModelWorkflow(modelWorkflow) {
+      const notes = [];
+      const steps = (modelWorkflow.steps || []).map((s, i) => {
+        let method = "GET";
+        let reqPath = "/";
+        if (typeof s.call === "string" && s.call.includes(" ")) {
+          const parts = s.call.split(" ");
+          method = parts[0].toUpperCase();
+          reqPath = parts.slice(1).join(" ");
+        } else if (typeof s.call === "string") {
+          reqPath = s.call;
+        }
+        if (s.auth)
+          notes.push(`Step ${i + 1}: model "auth: ${s.auth}" has no file equivalent \u2014 express it with inject (header:Authorization).`);
+        if (s.bind)
+          notes.push(`Step ${i + 1}: model "bind" has no file equivalent \u2014 express it with capture/captureInput.`);
+        return {
+          name: s.description || `${method} ${reqPath}`,
+          method,
+          path: reqPath,
+          description: s.description,
+          body: s.body,
+          expectStatus: s.expectStatus
+        };
+      });
+      return { def: { name: modelWorkflow.name, description: modelWorkflow.description, steps }, notes };
+    }
+    function writeWorkflowFile(filePath, def) {
+      fs4.mkdirSync(path7.dirname(filePath), { recursive: true });
+      const payload = { ...def, generatedAt: (/* @__PURE__ */ new Date()).toISOString() };
+      const tmp = `${filePath}.tmp`;
+      fs4.writeFileSync(tmp, JSON.stringify(payload, null, 2), "utf-8");
+      fs4.renameSync(tmp, filePath);
+    }
+    exports2.validateWorkflowSchema = zod_1.z.object({
+      projectPath: zod_1.z.string().optional().describe("Path to project root or .jetic folder"),
+      workflow: zod_1.z.string().optional().describe('Workflow slug, name, or file path to validate (omit when passing inline "definition")'),
+      definition: inlineWorkflowSchema.optional().describe("Inline workflow to dry-run validate WITHOUT saving (for pre-save checks)"),
+      allowUnknownEndpoints: zod_1.z.boolean().optional().default(false).describe("Downgrade unknown-endpoint errors to warnings (endpoint exists on server but not in model yet)")
+    });
+    function handleValidateWorkflow(args) {
+      if (!args.workflow && !args.definition) {
+        throw new Error('Provide either "workflow" (slug/name/file) or an inline "definition" to validate.');
+      }
+      let def;
+      let filePath;
+      if (args.definition) {
+        def = args.definition;
+      } else {
+        const resolved = resolveFileWorkflow(args.projectPath, args.workflow);
+        def = resolved.def;
+        filePath = resolved.filePath;
+      }
+      const report = validateWorkflowDefinition(def, {
+        projectPath: args.projectPath,
+        allowUnknownEndpoints: args.allowUnknownEndpoints === true
+      });
+      return { ...filePath ? { filePath } : { saved: false }, ...report };
+    }
+    exports2.createWorkflowSchema = zod_1.z.object({
+      projectPath: zod_1.z.string().optional().describe("Path to project root or .jetic folder"),
+      name: zod_1.z.string().min(1).optional().describe("Workflow name (required unless fromModelWorkflow is used)"),
+      slug: zod_1.z.string().optional().describe('File slug override (default: derived from name, e.g. "User Onboarding" -> "user-onboarding")'),
+      description: zod_1.z.string().optional(),
+      environment: zod_1.z.string().optional().describe("Target environment name from the model (e.g. local)"),
+      steps: zod_1.z.array(exports2.workflowStepSchema).min(1).optional().describe("Ordered steps (required unless fromModelWorkflow is used)"),
+      fromModelWorkflow: zod_1.z.string().optional().describe("Migrate an embedded model.json workflow by name instead of authoring steps manually"),
+      overwrite: zod_1.z.boolean().optional().default(false).describe("Overwrite the file if the slug already exists (default false \u2014 safe creation)"),
+      validateOnly: zod_1.z.boolean().optional().default(false).describe("Only validate, do not write any file (dry run)"),
+      allowUnknownEndpoints: zod_1.z.boolean().optional().default(false).describe("Save even when steps reference endpoints missing from model.json (recorded as warnings)")
+    });
+    function handleCreateWorkflow(args) {
+      let def;
+      const migrationNotes = [];
+      if (args.fromModelWorkflow) {
+        const { model } = (0, types_1.loadModel)(args.projectPath);
+        const raw = (model.workflows || []).find((w) => w.name === args.fromModelWorkflow);
+        if (!raw) {
+          throw new Error(`Embedded workflow "${args.fromModelWorkflow}" not found in model.json. Available: ${(model.workflows || []).map((w) => w.name).join(", ") || "(none)"}.`);
+        }
+        const migrated = migrateModelWorkflow(raw);
+        def = {
+          ...args.name ? { name: args.name } : {},
+          ...migrated.def,
+          ...args.description ? { description: args.description } : {},
+          ...args.environment ? { environment: args.environment } : {},
+          ...args.steps ? { steps: args.steps } : {}
+        };
+        migrationNotes.push(...migrated.notes);
+      } else {
+        if (!args.name)
+          throw new Error('"name" is required to create a workflow (or use fromModelWorkflow to migrate one).');
+        if (!args.steps || args.steps.length === 0) {
+          throw new Error('"steps" with at least one step is required (or use fromModelWorkflow to migrate one).');
+        }
+        def = {
+          name: args.name,
+          ...args.description ? { description: args.description } : {},
+          ...args.environment ? { environment: args.environment } : {},
+          steps: args.steps
+        };
+      }
+      const report = validateWorkflowDefinition(def, {
+        projectPath: args.projectPath,
+        allowUnknownEndpoints: args.allowUnknownEndpoints === true
+      });
+      const warnings = [...report.warnings];
+      for (const note of migrationNotes) {
+        warnings.push({ severity: "warning", code: "MIGRATION_NOTE", message: note, fix: "Adjust the saved file with jetic_update_workflow." });
+      }
+      if (!report.valid) {
+        throw new Error(`Workflow "${def.name}" has ${report.errorsCount} error(s) and was NOT saved:
+` + report.errors.map((e) => `- [step ${e.stepIndex ?? "-"}] ${e.message} Fix: ${e.fix}`).join("\n"));
+      }
+      const slug = args.slug?.trim() ? slugifyWorkflowName(args.slug) : slugifyWorkflowName(def.name);
+      const filePath = workflowFilePath(args.projectPath, slug);
+      const overwrite = args.overwrite === true;
+      const validateOnly = args.validateOnly === true;
+      if (validateOnly) {
+        return {
+          success: true,
+          action: "validated",
+          saved: false,
+          slug,
+          filePath,
+          stepsCount: def.steps.length,
+          validation: { ...report, warnings }
+        };
+      }
+      if (fs4.existsSync(filePath) && !overwrite) {
+        throw new Error(`Workflow file already exists at ${filePath}. Pass overwrite: true to replace it, use jetic_update_workflow to edit it, or pick another slug.`);
+      }
+      const existedBefore = fs4.existsSync(filePath);
+      writeWorkflowFile(filePath, def);
+      return {
+        success: true,
+        action: existedBefore ? "overwritten" : "created",
+        slug,
+        filePath,
+        stepsCount: def.steps.length,
+        validation: { ...report, warnings },
+        next: `Run it with jetic_simulate_workflow { "workflow": "${slug}" }.`
+      };
+    }
+    exports2.updateWorkflowSchema = zod_1.z.object({
+      projectPath: zod_1.z.string().optional().describe("Path to project root or .jetic folder"),
+      workflow: zod_1.z.string().describe("Workflow slug, name, or file path to update"),
+      name: zod_1.z.string().min(1).optional().describe("Rename the workflow (file slug stays the same)"),
+      description: zod_1.z.string().optional().describe("Replace the description"),
+      environment: zod_1.z.string().optional().describe("Replace the target environment"),
+      steps: zod_1.z.array(exports2.workflowStepSchema).min(1).optional().describe("REPLACE all steps (use appendSteps to only add)"),
+      appendSteps: zod_1.z.array(exports2.workflowStepSchema).optional().describe("Append steps to the end (memory from existing steps stays usable)"),
+      validateOnly: zod_1.z.boolean().optional().default(false).describe("Only validate the result, do not write"),
+      allowUnknownEndpoints: zod_1.z.boolean().optional().default(false)
+    });
+    function handleUpdateWorkflow(args) {
+      const resolved = resolveFileWorkflow(args.projectPath, args.workflow);
+      const def = {
+        ...resolved.def,
+        ...args.name ? { name: args.name } : {},
+        ...args.description !== void 0 ? { description: args.description } : {},
+        ...args.environment !== void 0 ? { environment: args.environment } : {},
+        steps: [
+          ...args.steps ? [] : resolved.def.steps || [],
+          ...args.steps || [],
+          ...args.appendSteps || []
+        ]
+      };
+      const report = validateWorkflowDefinition(def, {
+        projectPath: args.projectPath,
+        allowUnknownEndpoints: args.allowUnknownEndpoints === true
+      });
+      if (!report.valid) {
+        throw new Error(`Updated workflow has ${report.errorsCount} error(s) and was NOT saved:
+` + report.errors.map((e) => `- [step ${e.stepIndex ?? "-"}] ${e.message} Fix: ${e.fix}`).join("\n"));
+      }
+      if (args.validateOnly === true) {
+        return { success: true, action: "validated", saved: false, slug: resolved.slug, filePath: resolved.filePath, stepsCount: def.steps.length, validation: report };
+      }
+      writeWorkflowFile(resolved.filePath, def);
+      return {
+        success: true,
+        action: "updated",
+        slug: resolved.slug,
+        filePath: resolved.filePath,
+        stepsCount: def.steps.length,
+        validation: report,
+        next: `Run it with jetic_simulate_workflow { "workflow": "${resolved.slug}" }.`
+      };
+    }
+    exports2.deleteWorkflowSchema = zod_1.z.object({
+      projectPath: zod_1.z.string().optional().describe("Path to project root or .jetic folder"),
+      workflow: zod_1.z.string().describe("Workflow slug, name, or file path to delete")
+    });
+    function handleDeleteWorkflow(args) {
+      const listing = (0, workflow_tools_1.handleListWorkflows)({ projectPath: args.projectPath });
+      const search = args.workflow.toLowerCase();
+      const item = listing.workflows.find((w) => w.id.toLowerCase() === search || w.name.toLowerCase() === search || w.filePath && path7.resolve(w.filePath).toLowerCase() === path7.resolve(args.workflow).toLowerCase());
+      if (!item) {
+        return { success: false, message: `Workflow "${args.workflow}" not found.` };
+      }
+      if (item.source === "model_json" || !item.filePath) {
+        throw new Error(`Workflow "${args.workflow}" is embedded in model.json and cannot be deleted by this tool. Remove it by editing .jetic/model.json directly.`);
+      }
+      fs4.rmSync(item.filePath, { force: true });
+      return { success: true, action: "deleted", slug: item.id, filePath: item.filePath };
+    }
+  }
+});
+
 // ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/zod-compat.js
 var require_zod_compat = __commonJS({
   "../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/zod-compat.js"(exports2) {
@@ -283362,6 +284049,7 @@ var require_server3 = __commonJS({
     var testing_tools_1 = require_testing_tools();
     var environment_tools_1 = require_environment_tools();
     var workflow_tools_1 = require_workflow_tools();
+    var workflow_authoring_tools_1 = require_workflow_authoring_tools();
     exports2.JETIC_MCP_SERVER_NAME = "jetic-mcp-server";
     function getJeticMcpVersion() {
       try {
@@ -283381,6 +284069,7 @@ var require_server3 = __commonJS({
       "3. Mutating tools (`jetic_add_endpoint`, `jetic_update_endpoint`, `jetic_delete_endpoint`, `jetic_manage_environment`) write to disk \u2014 confirm intent with the user first when the change is destructive (delete/overwrite).",
       "4. After edits, run `jetic_verify_model` and fix reported errors.",
       "5. Use `jetic_test_endpoint` / `jetic_simulate_workflow` only against a running server (local/staging); pass `baseUrl` to override the stored environment URL.",
+      "Authoring workflows: NEVER hand-write workflow files blind. Build the steps, then run `jetic_validate_workflow` with the inline definition (dry run), fix reported errors, save with `jetic_create_workflow`, and finally execute with `jetic_simulate_workflow`. Chain steps with capture/captureInput (producer) + inject or {{workflow:key}} templates (consumer).",
       "Project resolution: every tool accepts an optional `projectPath`. If omitted, the server uses the `JETIC_PROJECT_PATH` environment variable, falling back to its own working directory. Set one of them to the project root so the server edits the right `.jetic/model.json`."
     ].join("\n");
     var READ_ONLY = {
@@ -283441,6 +284130,10 @@ var require_server3 = __commonJS({
       register("jetic_list_workflows", "List workflows", "Lists multi-step integration test workflows from .jetic/workflows/*.json, .jetic/workflow.json, or embedded model.json workflows.", workflow_tools_1.listWorkflowsSchema.shape, READ_ONLY, workflow_tools_1.handleListWorkflows);
       register("jetic_simulate_workflow", "Simulate workflow", "Executes a full end-to-end multi-step workflow simulation with dynamic memory capture, header injection, and schema validation against the live server.", workflow_tools_1.simulateWorkflowSchema.shape, READ_LIVE, workflow_tools_1.handleSimulateWorkflow);
       register("jetic_simulate", "Simulate workflow (alias)", "Alias of jetic_simulate_workflow: runs a multi-step user-journey workflow against the live server. Prefer jetic_simulate_workflow in new prompts.", workflow_tools_1.simulateWorkflowSchema.shape, READ_LIVE, workflow_tools_1.handleSimulateWorkflow);
+      register("jetic_validate_workflow", "Validate workflow", "Deep-validates a workflow WITHOUT saving or running it: step structure, endpoint cross-checks against model.json, and memory data-flow analysis (every {{scope:key}} must be captured by an earlier step). Accepts a saved workflow reference or an inline definition for pre-save dry runs.", workflow_authoring_tools_1.validateWorkflowSchema.shape, READ_ONLY, workflow_authoring_tools_1.handleValidateWorkflow);
+      register("jetic_create_workflow", "Create workflow", "Creates a .jetic/workflows/<slug>.json workflow from ordered steps with capture/inject memory chaining. Refuses to save when validation errors exist (error messages say exactly how to fix); use validateOnly for a dry run. Can also migrate an embedded model.json workflow via fromModelWorkflow.", workflow_authoring_tools_1.createWorkflowSchema.shape, WRITES_MODEL, workflow_authoring_tools_1.handleCreateWorkflow);
+      register("jetic_update_workflow", "Update workflow", "Updates a saved file workflow: rename, description/environment, full steps replacement, or appendSteps. Validates before writing and refuses to save on errors.", workflow_authoring_tools_1.updateWorkflowSchema.shape, WRITES_MODEL, workflow_authoring_tools_1.handleUpdateWorkflow);
+      register("jetic_delete_workflow", "Delete workflow", "Deletes a saved .jetic/workflows/*.json workflow file by slug, name, or path. Destructive: confirm with the user before calling. Cannot delete model.json-embedded workflows.", workflow_authoring_tools_1.deleteWorkflowSchema.shape, DESTRUCTIVE, workflow_authoring_tools_1.handleDeleteWorkflow);
       return server;
     }
     async function runMcpServer2() {
@@ -283506,6 +284199,7 @@ var require_dist7 = __commonJS({
     __exportStar(require_testing_tools(), exports2);
     __exportStar(require_environment_tools(), exports2);
     __exportStar(require_workflow_tools(), exports2);
+    __exportStar(require_workflow_authoring_tools(), exports2);
     __exportStar(require_server3(), exports2);
     __exportStar(require_serial_transport(), exports2);
     var fs4 = __importStar(require("fs"));
@@ -286107,7 +286801,7 @@ var mcpCommand = new import_commander10.Command("mcp").description("Launch Model
 
 // src/index.ts
 var program = new import_commander11.Command();
-program.name("jetic").description("AI-Native API Behavior Testing").version("0.1.6");
+program.name("jetic").description("AI-Native API Behavior Testing").version("0.1.8");
 program.addCommand(initCommand);
 program.addCommand(scanCommand);
 program.addCommand(inspectCommand);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jetic-cli",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "description": "AI-Native API Behavior Testing & Discovery Tool — CLI and Local Studio Dashboard",
   "main": "dist/index.js",
   "bin": {