{
  action: "list" | "get",
  
  // Common - scope selection
  scope: "project" | "group",
  projectId?: string,        // Required if scope="project"
  groupId?: string,          // Required if scope="group"
  
  // For "get" action
  key: string,               // Variable key name
  filter?: {
    environment_scope?: string  // e.g., "production", "*"
  }
}

{
  action: "create" | "update" | "delete",
  
  // Common - scope selection
  scope: "project" | "group",
  projectId?: string,
  groupId?: string,
  
  // Variable identification
  key: string,
  
  // For "create" and "update"
  value?: string,
  variable_type?: "env_var" | "file",
  protected?: boolean,
  masked?: boolean,
  raw?: boolean,
  environment_scope?: string,
  description?: string,
  
  // For "delete" with environment scope
  filter?: {
    environment_scope?: string
  }
}

// browse_variables - READ operations
const BrowseVariablesSchema = z.object({
  action: z.enum(["list", "get"]),
  scope: z.enum(["project", "group"]),
  projectId: z.string().optional(),
  groupId: z.string().optional(),
  // get-specific
  key: z.string().optional(),
  environment_scope: z.string().optional(),
}).refine(
  (data) => data.scope !== "project" || data.projectId !== undefined,
  { message: "projectId is required when scope is 'project'", path: ["projectId"] }
).refine(
  (data) => data.scope !== "group" || data.groupId !== undefined,
  { message: "groupId is required when scope is 'group'", path: ["groupId"] }
).refine(
  (data) => data.action !== "get" || data.key !== undefined,
  { message: "key is required for 'get' action", path: ["key"] }
);

// manage_variable - WRITE operations
const ManageVariableSchema = z.object({
  action: z.enum(["create", "update", "delete"]),
  scope: z.enum(["project", "group"]),
  projectId: z.string().optional(),
  groupId: z.string().optional(),
  key: z.string(),
  // create/update fields
  value: z.string().optional(),
  variable_type: z.enum(["env_var", "file"]).optional(),
  protected: z.boolean().optional(),
  masked: z.boolean().optional(),
  raw: z.boolean().optional(),
  environment_scope: z.string().optional(),
  description: z.string().optional(),
}).refine(
  (data) => data.scope !== "project" || data.projectId !== undefined,
  { message: "projectId is required when scope is 'project'", path: ["projectId"] }
).refine(
  (data) => data.scope !== "group" || data.groupId !== undefined,
  { message: "groupId is required when scope is 'group'", path: ["groupId"] }
).refine(
  (data) => data.action !== "create" || data.value !== undefined,
  { message: "value is required for 'create' action", path: ["value"] }
);