@attrkit/mcp 0.4.5 → 1.0.0

package/dist/cli.js

@@ -5,7 +5,14 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 
 // src/index.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { z as z4 } from "zod";
+import { randomUUID } from "node:crypto";
+import { z as z5 } from "zod";
+
+// ../shared/src/json-contracts.ts
+import { z } from "zod";
+var jsonValueSchema = z.json();
+var jsonObjectSchema = z.record(z.string(), jsonValueSchema);
+var nonEmptyStringSchema = z.string().min(1);
 // ../shared/src/device-matching.ts
 import { isIP } from "node:net";
 // ../shared/ip-class-ranges.json
@@ -13634,7 +13641,9 @@ function ipv6ToBigInt(value) {
   const [head, tail = ""] = value.split("::");
   const headGroups = head ? head.split(":") : [];
   const tailGroups = tail ? tail.split(":") : [];
-  const missing = 8 - headGroups.length - tailGroups.length;
+  const groupWidth = (group) => group.includes(".") ? 2 : 1;
+  const explicitGroups = [...headGroups, ...tailGroups].reduce((sum, group) => sum + groupWidth(group), 0);
+  const missing = 8 - explicitGroups;
   if (missing < 0 || missing > 0 && !value.includes("::"))
     return;
   let n = 0n;
@@ -13650,22 +13659,30 @@ function ipv6ToBigInt(value) {
   }
   return n;
 }
-function parseRanges(entries) {
+var CIDR_PREFIX = /^(?:0|[1-9]\d{0,2})$/;
+function parseCidr(entry, label) {
+  const parts = entry.split("/");
+  const network = parts[0];
+  const rawPrefix = parts[1];
+  if (parts.length !== 2 || !network || rawPrefix === undefined || !CIDR_PREFIX.test(rawPrefix)) {
+    throw new Error(`Invalid ${label} CIDR entry: ${entry}`);
+  }
+  const prefix = Number(rawPrefix);
+  const v6 = network.includes(":");
+  const bits = v6 ? 128 : 32;
+  if (prefix > bits)
+    throw new Error(`Invalid ${label} CIDR prefix: ${entry}`);
+  const base = v6 ? ipv6ToBigInt(network) : ipv4ToBigInt(network);
+  if (base === undefined)
+    throw new Error(`Invalid ${label} CIDR address: ${entry}`);
+  return { base, prefix, bits, v6 };
+}
+function parseRanges(entries, label) {
   const parsed = { v4: [], v6: [] };
   for (const entry of entries) {
     if (entry.startsWith("_TODO"))
       continue;
-    const [network, rawPrefix] = entry.split("/");
-    const prefix = Number(rawPrefix);
-    if (!network || !Number.isInteger(prefix))
-      continue;
-    const v6 = network.includes(":");
-    const bits = v6 ? 128 : 32;
-    if (prefix < 0 || prefix > bits)
-      continue;
-    const base = v6 ? ipv6ToBigInt(network) : ipv4ToBigInt(network);
-    if (base === undefined)
-      continue;
+    const { base, prefix, bits, v6 } = parseCidr(entry, label);
     const hostBits = BigInt(bits - prefix);
     const start = base >> hostBits << hostBits;
     (v6 ? parsed.v6 : parsed.v4).push([start, start + (1n << hostBits) - 1n]);
@@ -13689,10 +13706,12 @@ function mergeIntervals(intervals) {
   return merged;
 }
 var CLASS_LISTS = [
-  { ipClass: "cgnat", parsed: parseRanges(ip_class_ranges_default.cgnat) },
-  { ipClass: "relay", parsed: parseRanges(ip_class_ranges_default.apple_private_relay_egress) }
+  { ipClass: "cgnat", parsed: parseRanges(ip_class_ranges_default.cgnat, "cgnat") },
+  { ipClass: "relay", parsed: parseRanges(ip_class_ranges_default.apple_private_relay_egress, "relay") }
 ];
 var IP_CLASS_RANGES_VERSION = ip_class_ranges_default.ranges_version;
+// ../shared/src/canonical-events.ts
+var LEDGER_ONLY_CANONICAL_EVENT_NAMES = Object.freeze(["refund_reversed"]);
 // ../shared/src/derived-events.ts
 var TWO_HOURS_MS = 2 * 60 * 60 * 1000;
 var STRICT_TRIAL_INVALIDATORS = Object.freeze([
@@ -13702,11 +13721,13 @@ var STRICT_TRIAL_INVALIDATORS = Object.freeze([
   "chargeback",
   "subscription_expired"
 ]);
-function leg(armedBy, windowMs = 0, invalidatedBy = []) {
+function leg(armedBy, windowMs = 0, invalidatedBy = [], requiresPrior = [], armedWhen = []) {
   return Object.freeze({
     armedBy: Object.freeze([...armedBy]),
     windowMs,
-    invalidatedBy: Object.freeze([...invalidatedBy])
+    invalidatedBy: Object.freeze([...invalidatedBy]),
+    requiresPrior: Object.freeze([...requiresPrior]),
+    armedWhen: Object.freeze(armedWhen.map((match) => Object.freeze({ ...match })))
   });
 }
 function rule(name, family, legs, fanoutEligible = true) {
@@ -13727,7 +13748,8 @@ var DERIVED_EVENT_RULES = Object.freeze([
     leg(["trial_started"], TWO_HOURS_MS, STRICT_TRIAL_INVALIDATORS)
   ]),
   rule("rc_trial_converted", "trial", [
-    leg(["subscription_renewed"])
+    leg(["subscription_renewed"], 0, [], ["trial_started"]),
+    leg(["subscription_renewed"], 0, [], [], [{ key: "is_trial_conversion", equals: "true" }])
   ]),
   rule("rc_intro_started", "trial", [
     leg(["intro_started"])
@@ -13761,7 +13783,7 @@ var DERIVED_EVENT_RULES = Object.freeze([
   ])
 ]);
 // ../shared/src/ownership.ts
-import { z } from "zod";
+import { z as z2 } from "zod";
 var EVENT_FAMILIES = [
   "install",
   "session",
@@ -13773,13 +13795,13 @@ var EVENT_FAMILIES = [
   "business"
 ];
 var DELIVERY_OWNERS = ["attrkit", "revenuecat", "customer"];
-var eventFamilySchema = z.enum(EVENT_FAMILIES);
-var deliveryOwnerSchema = z.enum(DELIVERY_OWNERS);
-var ownershipMatrixSchema = z.record(eventFamilySchema, deliveryOwnerSchema);
-var destinationActivationSchema = z.object({
-  enabled: z.boolean(),
-  revenuecat_connected: z.boolean().default(false),
-  ownership: z.partialRecord(eventFamilySchema, deliveryOwnerSchema)
+var eventFamilySchema = z2.enum(EVENT_FAMILIES);
+var deliveryOwnerSchema = z2.enum(DELIVERY_OWNERS);
+var ownershipMatrixSchema = z2.record(eventFamilySchema, deliveryOwnerSchema);
+var destinationActivationSchema = z2.object({
+  enabled: z2.boolean(),
+  revenuecat_connected: z2.boolean().default(false),
+  ownership: z2.partialRecord(eventFamilySchema, deliveryOwnerSchema)
 }).strict().superRefine((value, context) => {
   if (!value.enabled)
     return;
@@ -13799,6 +13821,8 @@ var HKDF_EMPTY_SALT = Buffer.alloc(0);
 // ../shared/src/management-key.ts
 var MANAGEMENT_KEY_HMAC_INFO = Buffer.from("attrkit/management-key-hmac/v1", "utf8");
 var HKDF_EMPTY_SALT2 = Buffer.alloc(0);
+// ../shared/src/attribution-context.ts
+var NO_MEASUREMENT_BASIS = new Set(["unknown", "denied", "revoked"]);
 // ../shared/src/ssrf-guard.ts
 import { BlockList, isIP as isIP2 } from "node:net";
 var blockedV4 = new BlockList;
@@ -13811,8 +13835,11 @@ for (const [network, prefix] of [
   ["169.254.0.0", 16],
   ["172.16.0.0", 12],
   ["192.0.0.0", 24],
+  ["192.0.2.0", 24],
   ["192.168.0.0", 16],
   ["198.18.0.0", 15],
+  ["198.51.100.0", 24],
+  ["203.0.113.0", 24],
   ["224.0.0.0", 4],
   ["240.0.0.0", 4]
 ]) {
@@ -13823,6 +13850,12 @@ for (const [network, prefix] of [
   ["::1", 128],
   ["::", 96],
   ["::ffff:0:0", 96],
+  ["64:ff9b::", 96],
+  ["64:ff9b:1::", 48],
+  ["100::", 64],
+  ["2001::", 23],
+  ["2002::", 16],
+  ["fec0::", 10],
   ["fc00::", 7],
   ["fe80::", 10],
   ["ff00::", 8],
@@ -13837,124 +13870,160 @@ var blockedHostnames = new Set([
   "metadata.google.internal"
 ]);
 // ../shared/src/ingestion.ts
-import { z as z2 } from "zod";
-var consentStateSchema = z2.object({
-  state: z2.enum(["unknown", "measurement_granted", "tracking_granted", "denied", "revoked"]),
-  policy_version: z2.number().int().positive(),
-  framework_string: z2.string().max(512).optional()
-}).strict();
-var coarseContextSchema = z2.object({
-  country_code: z2.string().regex(/^[A-Z]{2}$/).optional(),
-  region_code: z2.string().max(16).optional(),
-  os_major: z2.string().max(16).optional(),
-  device_class: z2.enum(["phone", "tablet", "desktop", "unknown"]).optional(),
-  locale: z2.string().max(35).optional()
+import { z as z3 } from "zod";
+var consentStateSchema = z3.object({
+  state: z3.enum(["unknown", "measurement_granted", "tracking_granted", "denied", "revoked"]),
+  policy_version: z3.number().int().positive(),
+  framework_string: z3.string().max(512).optional()
 }).strict();
-var exactTokenReferenceSchema = z2.object({
-  token: z2.string().min(16).max(512),
-  kind: z2.enum(["clipboard", "owned_deferred", "customer_signed"]),
-  clipboard_opt_in: z2.boolean().optional()
+var coarseContextSchema = z3.object({
+  country_code: z3.string().regex(/^[A-Z]{2}$/).optional(),
+  region_code: z3.string().max(16).optional(),
+  os_major: z3.string().max(16).optional(),
+  device_class: z3.enum(["phone", "tablet", "desktop", "unknown"]).optional(),
+  locale: z3.string().max(35).optional()
 }).strict();
-var playInstallReferrerSchema = z2.object({
-  referrer: z2.string().max(1024),
-  captured_at: z2.string().datetime({ offset: true })
+var exactTokenReferenceSchema = z3.object({
+  token: z3.string().min(16).max(512),
+  kind: z3.enum(["clipboard", "owned_deferred", "customer_signed"]),
+  clipboard_opt_in: z3.boolean().optional()
+}).strict().refine((value) => value.kind !== "clipboard" || value.clipboard_opt_in === true, { message: "clipboard tokens require explicit opt-in", path: ["clipboard_opt_in"] });
+var playInstallReferrerSchema = z3.object({
+  referrer: z3.string().max(1024),
+  captured_at: z3.string().datetime({ offset: true })
 }).strict();
 var NIL_UUID = "00000000-0000-0000-0000-000000000000";
-var sha256HexSchema = z2.string().regex(/^[0-9a-f]{64}$/);
-var idfaSchema = z2.string().uuid().refine((value) => value.toLowerCase() !== NIL_UUID, { message: "IDFA must not be all zeros" }).transform((value) => value.toLowerCase());
-var idfvSchema = z2.string().uuid().transform((value) => value.toLowerCase());
-var genderSchema = z2.enum(["m", "f"]).nullable();
-var deviceSignalsSchema = z2.object({
-  device_model: z2.string().min(1).max(128).optional(),
-  os_build: z2.string().min(1).max(128).optional(),
-  timezone: z2.string().min(1).max(128).optional(),
-  screen: z2.object({
-    w: z2.number().int().positive().max(16384),
-    h: z2.number().int().positive().max(16384),
-    scale: z2.number().positive().max(8)
+var EMAIL_PATTERN = /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/i;
+var PHONE_PATTERN = /(?:^|\D)(?:\+?\d[\d\s().-]{7,}\d)(?:$|\D)/;
+var NON_PHONE_VALUE_FORMS = [
+  /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,
+  /^\d{4}-\d{2}-\d{2}(?:[T ]\d{2}:\d{2}(?::\d{2}(?:\.\d+)?)?(?:Z|[+-]\d{2}:?\d{2})?)?$/,
+  /^-?\d+\.\d+$/
+];
+function looksLikePii(value) {
+  if (EMAIL_PATTERN.test(value))
+    return true;
+  if (NON_PHONE_VALUE_FORMS.some((form) => form.test(value.trim())))
+    return false;
+  return PHONE_PATTERN.test(value.replace(EMBEDDED_UUID_PATTERN, ""));
+}
+var EMBEDDED_UUID_PATTERN = /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/gi;
+var sha256HexSchema = z3.string().regex(/^[0-9a-f]{64}$/);
+var idfaSchema = z3.string().uuid().refine((value) => value.toLowerCase() !== NIL_UUID, { message: "IDFA must not be all zeros" }).transform((value) => value.toLowerCase());
+var idfvSchema = z3.string().uuid().transform((value) => value.toLowerCase());
+var genderSchema = z3.enum(["m", "f"]).nullable();
+var deviceSignalsSchema = z3.object({
+  device_model: z3.string().min(1).max(128).optional(),
+  os_build: z3.string().min(1).max(128).optional(),
+  timezone: z3.string().min(1).max(128).optional(),
+  screen: z3.object({
+    w: z3.number().int().positive().max(16384),
+    h: z3.number().int().positive().max(16384),
+    scale: z3.number().positive().max(8)
   }).strict().optional(),
-  languages: z2.array(z2.string().min(1).max(35)).max(16).optional()
+  languages: z3.array(z3.string().min(1).max(35)).max(16).optional()
 }).strict();
-var webFirstPartySchema = z2.object({
-  fbc: z2.string().min(1).max(512).optional(),
-  fbp: z2.string().min(1).max(512).optional(),
+var TIKTOK_BROWSER_ID_PATTERN = /^[A-Za-z0-9._~-]{1,512}$/;
+var webFirstPartySchema = z3.object({
+  fbc: z3.string().min(1).max(512).optional(),
+  fbp: z3.string().min(1).max(512).optional(),
+  ttp: z3.string().regex(TIKTOK_BROWSER_ID_PATTERN).optional(),
   email_hash: sha256HexSchema.optional(),
   phone_hash: sha256HexSchema.optional(),
   dob_hash: sha256HexSchema.optional(),
   gender: genderSchema.optional()
 }).strict();
-var firstOpenEnvelopeSchema = z2.object({
-  schema_version: z2.literal(1),
-  installation_id: z2.string().uuid(),
-  install_epoch_id: z2.string().uuid(),
-  occurred_at: z2.string().datetime({ offset: true }),
-  app_version: z2.string().min(1).max(128),
+var firstOpenEnvelopeSchema = z3.object({
+  schema_version: z3.literal(1),
+  installation_id: z3.string().uuid(),
+  install_epoch_id: z3.string().uuid(),
+  occurred_at: z3.string().datetime({ offset: true }),
+  app_version: z3.string().min(1).max(128),
   coarse_context: coarseContextSchema,
   consent: consentStateSchema,
-  app_transaction_jws: z2.string().min(16).max(32768).optional(),
-  asa_token: z2.string().min(8).max(8192).optional(),
+  app_transaction_jws: z3.string().min(16).max(32768).optional(),
+  asa_token: z3.string().min(8).max(8192).optional(),
   exact_token_ref: exactTokenReferenceSchema.optional(),
   play_install_referrer: playInstallReferrerSchema.optional(),
   device_signals: deviceSignalsSchema.optional(),
   web_first_party: webFirstPartySchema.optional(),
   idfa: idfaSchema.optional(),
   idfv: idfvSchema.optional(),
-  local_lineage_present: z2.boolean().default(false),
-  local_epoch_present: z2.boolean().default(false),
-  local_signals_conflict: z2.boolean().default(false)
+  local_lineage_present: z3.boolean().default(false),
+  local_epoch_present: z3.boolean().default(false),
+  local_signals_conflict: z3.boolean().default(false)
 }).strict().refine((value) => value.idfa === undefined || value.consent.state === "tracking_granted", { message: "IDFA requires ATT tracking authorization", path: ["idfa"] });
-var identifyEnvelopeSchema = z2.object({
-  schema_version: z2.literal(1),
-  installation_id: z2.string().uuid(),
-  install_epoch_id: z2.string().uuid(),
-  occurred_at: z2.string().datetime({ offset: true }),
-  customer_user_id: z2.string().min(1).max(256).refine((value) => !value.includes("@"), "customer_user_id must be an opaque identifier").optional(),
+var customerUserIdSchema = z3.string().min(1).max(256).refine((value) => !looksLikePii(value), "customer_user_id must be an opaque identifier, not raw email or phone PII");
+var identifyEnvelopeSchema = z3.object({
+  schema_version: z3.literal(1),
+  installation_id: z3.string().uuid(),
+  install_epoch_id: z3.string().uuid(),
+  occurred_at: z3.string().datetime({ offset: true }),
+  customer_user_id: customerUserIdSchema.optional(),
   email_hash: sha256HexSchema.optional(),
   phone_hash: sha256HexSchema.optional(),
   exact_token_ref: exactTokenReferenceSchema.optional(),
   idfa: idfaSchema.optional(),
   idfv: idfvSchema.optional()
 }).strict().refine((value) => value.customer_user_id !== undefined || value.email_hash !== undefined || value.phone_hash !== undefined || value.exact_token_ref !== undefined || value.idfa !== undefined || value.idfv !== undefined, { message: "at least one opaque or hashed identity, platform identifier, or exact token is required" });
-var eventConsentSchema = z2.object({
-  measurement: z2.enum(["granted", "denied", "unknown"]),
-  tracking: z2.enum(["granted", "denied", "unknown"]),
-  policy_version: z2.number().int().positive()
+var eventConsentSchema = z3.object({
+  measurement: z3.enum(["granted", "denied", "unknown"]),
+  tracking: z3.enum(["granted", "denied", "unknown"]),
+  policy_version: z3.number().int().positive()
 }).strict();
-var EMAIL_PATTERN = /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/i;
-var PHONE_PATTERN = /(?:^|\D)(?:\+?\d[\d\s().-]{7,}\d)(?:$|\D)/;
-var propertyScalarSchema = z2.union([
-  z2.string().max(1024),
-  z2.number().finite(),
-  z2.boolean(),
-  z2.null()
+var propertyScalarSchema = z3.union([
+  z3.string().max(1024),
+  z3.number().finite(),
+  z3.boolean(),
+  z3.null()
 ]);
-var eventPropertiesSchema = z2.record(z2.string().min(1).max(64), propertyScalarSchema).superRefine((properties, context) => {
+var piiCandidateSchema = z3.string();
+function isPiiPropertyKey(key) {
+  if (/email|e-mail|phone|mobile|address/i.test(key))
+    return true;
+  const normalized = key.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replaceAll("-", "_").toLowerCase();
+  return /^(?:name|first_?name|last_?name|full_?name|given_?name|family_?name)$/.test(normalized);
+}
+var eventPropertiesSchema = z3.record(z3.string().min(1).max(64), propertyScalarSchema).superRefine((properties, context) => {
+  if (Object.keys(properties).length > 64) {
+    context.addIssue({ code: "custom", message: "at most 64 event properties are allowed" });
+  }
   for (const [key, value] of Object.entries(properties)) {
-    if (/email|e-mail|phone|mobile|address|name/i.test(key)) {
+    if (isPiiPropertyKey(key)) {
       context.addIssue({ code: "custom", path: [key], message: "PII property keys are forbidden" });
     }
-    if (typeof value === "string" && (EMAIL_PATTERN.test(value) || PHONE_PATTERN.test(value))) {
+    const piiCandidate = piiCandidateSchema.safeParse(value);
+    if (piiCandidate.success && looksLikePii(piiCandidate.data)) {
       context.addIssue({ code: "custom", path: [key], message: "PII-shaped property values are forbidden" });
     }
   }
 });
-var canonicalEventEnvelopeSchema = z2.object({
-  schema_version: z2.literal(1),
-  event_id: z2.string().uuid(),
-  event_name: z2.string().min(1).max(128).regex(/^[a-z][a-z0-9_.-]*$/),
-  event_version: z2.number().int().positive(),
-  occurred_at: z2.string().datetime({ offset: true }),
-  sent_at: z2.string().datetime({ offset: true }),
-  installation_id: z2.string().uuid(),
-  install_epoch_id: z2.string().uuid(),
-  session_id: z2.string().uuid(),
-  source: z2.enum(["ios_sdk", "android_sdk", "web_sdk", "server", "provider"]),
+var canonicalEventFieldSchemas = {
+  event_id: z3.string().uuid(),
+  event_name: z3.string().min(1).max(128).regex(/^[a-z][a-z0-9_.-]*$/),
+  event_version: z3.number().int().positive(),
+  occurred_at: z3.string().datetime({ offset: true }),
   consent: eventConsentSchema,
-  properties: eventPropertiesSchema,
-  provider: z2.string().min(1).max(64).optional(),
-  provider_event_id: z2.string().min(1).max(256).optional(),
-  supersedes_event_id: z2.string().uuid().optional()
+  properties: eventPropertiesSchema
+};
+var canonicalEventEnvelopeSchema = z3.object({
+  schema_version: z3.literal(1),
+  event_id: canonicalEventFieldSchemas.event_id,
+  event_name: canonicalEventFieldSchemas.event_name,
+  event_version: canonicalEventFieldSchemas.event_version,
+  occurred_at: canonicalEventFieldSchemas.occurred_at,
+  sent_at: z3.string().datetime({ offset: true }),
+  installation_id: z3.string().uuid(),
+  install_epoch_id: z3.string().uuid(),
+  session_id: z3.string().uuid(),
+  source: z3.enum(["ios_sdk", "android_sdk", "web_sdk", "server", "provider"]),
+  consent: canonicalEventFieldSchemas.consent,
+  properties: canonicalEventFieldSchemas.properties,
+  provider: z3.string().min(1).max(64).optional(),
+  provider_event_id: z3.string().min(1).max(256).optional(),
+  supersedes_event_id: z3.string().uuid().optional()
 }).strict().superRefine((event, context) => {
+  const hasProviderFields = event.provider !== undefined || event.provider_event_id !== undefined;
   if (event.provider === undefined !== (event.provider_event_id === undefined)) {
     context.addIssue({
       code: "custom",
@@ -13962,26 +14031,40 @@ var canonicalEventEnvelopeSchema = z2.object({
       message: "provider and provider_event_id must be supplied together"
     });
   }
+  if (event.source === "provider" && !hasProviderFields) {
+    context.addIssue({
+      code: "custom",
+      path: ["provider"],
+      message: "provider-sourced events require provider and provider_event_id"
+    });
+  }
+  if (event.source !== "provider" && hasProviderFields) {
+    context.addIssue({
+      code: "custom",
+      path: ["provider"],
+      message: "provider fields are forbidden unless source is provider"
+    });
+  }
 });
-var canonicalEventBatchSchema = z2.object({
-  batch_id: z2.string().min(1).max(256),
-  events: z2.array(canonicalEventEnvelopeSchema).min(1).max(100)
+var canonicalEventBatchSchema = z3.object({
+  batch_id: z3.string().min(1).max(256),
+  events: z3.array(canonicalEventEnvelopeSchema).min(1).max(100)
 }).strict();
-var consentReceiptSchema = z2.object({
-  installation_id: z2.string().uuid(),
-  install_epoch_id: z2.string().uuid(),
-  scope: z2.enum(["measurement", "tracking"]),
+var consentReceiptSchema = z3.object({
+  installation_id: z3.string().uuid(),
+  install_epoch_id: z3.string().uuid(),
+  scope: z3.enum(["measurement", "tracking"]),
   consent: consentStateSchema,
-  occurred_at: z2.string().datetime({ offset: true }),
-  source: z2.enum(["ios_sdk", "android_sdk", "web_sdk", "server"])
+  occurred_at: z3.string().datetime({ offset: true }),
+  source: z3.enum(["ios_sdk", "android_sdk", "web_sdk", "server"])
 }).strict();
-var sealedIngestEnvelopeSchema = z2.object({
+var sealedIngestEnvelopeSchema = z3.object({
   input: firstOpenEnvelopeSchema,
-  received_at: z2.string().datetime({ offset: true }),
-  client_skew_ms: z2.number().int()
+  received_at: z3.string().datetime({ offset: true }),
+  client_skew_ms: z3.number().int()
 }).strict();
 // ../shared/src/revenuecat-provider-app-id.ts
-import { z as z3 } from "zod";
+import { z as z4 } from "zod";
 var KNOWN_WRONG_CREDENTIAL_PREFIXES = [
   ["appl_", "the iOS platform SDK key"],
   ["goog_", "the Android platform SDK key"],
@@ -14000,149 +14083,995 @@ function revenueCatProviderAppIdIssue(value) {
   }
   return null;
 }
-var revenueCatProviderAppIdSchema = z3.string().trim().min(1).max(255).superRefine((value, context) => {
+var revenueCatProviderAppIdSchema = z4.string().trim().min(1).max(255).superRefine((value, context) => {
   const issue = revenueCatProviderAppIdIssue(value);
   if (issue)
     context.addIssue({ code: "custom", message: issue });
 });
+// ../shared/src/iso-4217-exponents.json
+var iso_4217_exponents_default = {
+  schemaVersion: 1,
+  published: "2026-01-01",
+  sources: {
+    listOneSha256: "838dfb991648cf36df939edd5fe3811737962b75a32252847d239cedd1e291c9",
+    listThreeSha256: "98fde2423cdb916dd59dcf5fe96222edad8fa198d865c1c83dbc464b9cc52387"
+  },
+  currencies: {
+    AED: {
+      exponent: 2,
+      status: "current"
+    },
+    AFN: {
+      exponent: 2,
+      status: "current"
+    },
+    ALL: {
+      exponent: 2,
+      status: "current"
+    },
+    AMD: {
+      exponent: 2,
+      status: "current"
+    },
+    AOA: {
+      exponent: 2,
+      status: "current"
+    },
+    ARS: {
+      exponent: 2,
+      status: "current"
+    },
+    AUD: {
+      exponent: 2,
+      status: "current"
+    },
+    AWG: {
+      exponent: 2,
+      status: "current"
+    },
+    AZN: {
+      exponent: 2,
+      status: "current"
+    },
+    BAM: {
+      exponent: 2,
+      status: "current"
+    },
+    BBD: {
+      exponent: 2,
+      status: "current"
+    },
+    BDT: {
+      exponent: 2,
+      status: "current"
+    },
+    BHD: {
+      exponent: 3,
+      status: "current"
+    },
+    BIF: {
+      exponent: 0,
+      status: "current"
+    },
+    BMD: {
+      exponent: 2,
+      status: "current"
+    },
+    BND: {
+      exponent: 2,
+      status: "current"
+    },
+    BOB: {
+      exponent: 2,
+      status: "current"
+    },
+    BOV: {
+      exponent: 2,
+      status: "current"
+    },
+    BRL: {
+      exponent: 2,
+      status: "current"
+    },
+    BSD: {
+      exponent: 2,
+      status: "current"
+    },
+    BTN: {
+      exponent: 2,
+      status: "current"
+    },
+    BWP: {
+      exponent: 2,
+      status: "current"
+    },
+    BYN: {
+      exponent: 2,
+      status: "current"
+    },
+    BZD: {
+      exponent: 2,
+      status: "current"
+    },
+    CAD: {
+      exponent: 2,
+      status: "current"
+    },
+    CDF: {
+      exponent: 2,
+      status: "current"
+    },
+    CHE: {
+      exponent: 2,
+      status: "current"
+    },
+    CHF: {
+      exponent: 2,
+      status: "current"
+    },
+    CHW: {
+      exponent: 2,
+      status: "current"
+    },
+    CLF: {
+      exponent: 4,
+      status: "current"
+    },
+    CLP: {
+      exponent: 0,
+      status: "current"
+    },
+    CNY: {
+      exponent: 2,
+      status: "current"
+    },
+    COP: {
+      exponent: 2,
+      status: "current"
+    },
+    COU: {
+      exponent: 2,
+      status: "current"
+    },
+    CRC: {
+      exponent: 2,
+      status: "current"
+    },
+    CUP: {
+      exponent: 2,
+      status: "current"
+    },
+    CVE: {
+      exponent: 2,
+      status: "current"
+    },
+    CZK: {
+      exponent: 2,
+      status: "current"
+    },
+    DJF: {
+      exponent: 0,
+      status: "current"
+    },
+    DKK: {
+      exponent: 2,
+      status: "current"
+    },
+    DOP: {
+      exponent: 2,
+      status: "current"
+    },
+    DZD: {
+      exponent: 2,
+      status: "current"
+    },
+    EGP: {
+      exponent: 2,
+      status: "current"
+    },
+    ERN: {
+      exponent: 2,
+      status: "current"
+    },
+    ETB: {
+      exponent: 2,
+      status: "current"
+    },
+    EUR: {
+      exponent: 2,
+      status: "current"
+    },
+    FJD: {
+      exponent: 2,
+      status: "current"
+    },
+    FKP: {
+      exponent: 2,
+      status: "current"
+    },
+    GBP: {
+      exponent: 2,
+      status: "current"
+    },
+    GEL: {
+      exponent: 2,
+      status: "current"
+    },
+    GHS: {
+      exponent: 2,
+      status: "current"
+    },
+    GIP: {
+      exponent: 2,
+      status: "current"
+    },
+    GMD: {
+      exponent: 2,
+      status: "current"
+    },
+    GNF: {
+      exponent: 0,
+      status: "current"
+    },
+    GTQ: {
+      exponent: 2,
+      status: "current"
+    },
+    GYD: {
+      exponent: 2,
+      status: "current"
+    },
+    HKD: {
+      exponent: 2,
+      status: "current"
+    },
+    HNL: {
+      exponent: 2,
+      status: "current"
+    },
+    HTG: {
+      exponent: 2,
+      status: "current"
+    },
+    HUF: {
+      exponent: 2,
+      status: "current"
+    },
+    IDR: {
+      exponent: 2,
+      status: "current"
+    },
+    ILS: {
+      exponent: 2,
+      status: "current"
+    },
+    INR: {
+      exponent: 2,
+      status: "current"
+    },
+    IQD: {
+      exponent: 3,
+      status: "current"
+    },
+    IRR: {
+      exponent: 2,
+      status: "current"
+    },
+    ISK: {
+      exponent: 0,
+      status: "current"
+    },
+    JMD: {
+      exponent: 2,
+      status: "current"
+    },
+    JOD: {
+      exponent: 3,
+      status: "current"
+    },
+    JPY: {
+      exponent: 0,
+      status: "current"
+    },
+    KES: {
+      exponent: 2,
+      status: "current"
+    },
+    KGS: {
+      exponent: 2,
+      status: "current"
+    },
+    KHR: {
+      exponent: 2,
+      status: "current"
+    },
+    KMF: {
+      exponent: 0,
+      status: "current"
+    },
+    KPW: {
+      exponent: 2,
+      status: "current"
+    },
+    KRW: {
+      exponent: 0,
+      status: "current"
+    },
+    KWD: {
+      exponent: 3,
+      status: "current"
+    },
+    KYD: {
+      exponent: 2,
+      status: "current"
+    },
+    KZT: {
+      exponent: 2,
+      status: "current"
+    },
+    LAK: {
+      exponent: 2,
+      status: "current"
+    },
+    LBP: {
+      exponent: 2,
+      status: "current"
+    },
+    LKR: {
+      exponent: 2,
+      status: "current"
+    },
+    LRD: {
+      exponent: 2,
+      status: "current"
+    },
+    LSL: {
+      exponent: 2,
+      status: "current"
+    },
+    LYD: {
+      exponent: 3,
+      status: "current"
+    },
+    MAD: {
+      exponent: 2,
+      status: "current"
+    },
+    MDL: {
+      exponent: 2,
+      status: "current"
+    },
+    MGA: {
+      exponent: 2,
+      status: "current"
+    },
+    MKD: {
+      exponent: 2,
+      status: "current"
+    },
+    MMK: {
+      exponent: 2,
+      status: "current"
+    },
+    MNT: {
+      exponent: 2,
+      status: "current"
+    },
+    MOP: {
+      exponent: 2,
+      status: "current"
+    },
+    MRU: {
+      exponent: 2,
+      status: "current"
+    },
+    MUR: {
+      exponent: 2,
+      status: "current"
+    },
+    MVR: {
+      exponent: 2,
+      status: "current"
+    },
+    MWK: {
+      exponent: 2,
+      status: "current"
+    },
+    MXN: {
+      exponent: 2,
+      status: "current"
+    },
+    MXV: {
+      exponent: 2,
+      status: "current"
+    },
+    MYR: {
+      exponent: 2,
+      status: "current"
+    },
+    MZN: {
+      exponent: 2,
+      status: "current"
+    },
+    NAD: {
+      exponent: 2,
+      status: "current"
+    },
+    NGN: {
+      exponent: 2,
+      status: "current"
+    },
+    NIO: {
+      exponent: 2,
+      status: "current"
+    },
+    NOK: {
+      exponent: 2,
+      status: "current"
+    },
+    NPR: {
+      exponent: 2,
+      status: "current"
+    },
+    NZD: {
+      exponent: 2,
+      status: "current"
+    },
+    OMR: {
+      exponent: 3,
+      status: "current"
+    },
+    PAB: {
+      exponent: 2,
+      status: "current"
+    },
+    PEN: {
+      exponent: 2,
+      status: "current"
+    },
+    PGK: {
+      exponent: 2,
+      status: "current"
+    },
+    PHP: {
+      exponent: 2,
+      status: "current"
+    },
+    PKR: {
+      exponent: 2,
+      status: "current"
+    },
+    PLN: {
+      exponent: 2,
+      status: "current"
+    },
+    PYG: {
+      exponent: 0,
+      status: "current"
+    },
+    QAR: {
+      exponent: 2,
+      status: "current"
+    },
+    RON: {
+      exponent: 2,
+      status: "current"
+    },
+    RSD: {
+      exponent: 2,
+      status: "current"
+    },
+    RUB: {
+      exponent: 2,
+      status: "current"
+    },
+    RWF: {
+      exponent: 0,
+      status: "current"
+    },
+    SAR: {
+      exponent: 2,
+      status: "current"
+    },
+    SBD: {
+      exponent: 2,
+      status: "current"
+    },
+    SCR: {
+      exponent: 2,
+      status: "current"
+    },
+    SDG: {
+      exponent: 2,
+      status: "current"
+    },
+    SEK: {
+      exponent: 2,
+      status: "current"
+    },
+    SGD: {
+      exponent: 2,
+      status: "current"
+    },
+    SHP: {
+      exponent: 2,
+      status: "current"
+    },
+    SLE: {
+      exponent: 2,
+      status: "current"
+    },
+    SOS: {
+      exponent: 2,
+      status: "current"
+    },
+    SRD: {
+      exponent: 2,
+      status: "current"
+    },
+    SSP: {
+      exponent: 2,
+      status: "current"
+    },
+    STN: {
+      exponent: 2,
+      status: "current"
+    },
+    SVC: {
+      exponent: 2,
+      status: "current"
+    },
+    SYP: {
+      exponent: 2,
+      status: "current"
+    },
+    SZL: {
+      exponent: 2,
+      status: "current"
+    },
+    THB: {
+      exponent: 2,
+      status: "current"
+    },
+    TJS: {
+      exponent: 2,
+      status: "current"
+    },
+    TMT: {
+      exponent: 2,
+      status: "current"
+    },
+    TND: {
+      exponent: 3,
+      status: "current"
+    },
+    TOP: {
+      exponent: 2,
+      status: "current"
+    },
+    TRY: {
+      exponent: 2,
+      status: "current"
+    },
+    TTD: {
+      exponent: 2,
+      status: "current"
+    },
+    TWD: {
+      exponent: 2,
+      status: "current"
+    },
+    TZS: {
+      exponent: 2,
+      status: "current"
+    },
+    UAH: {
+      exponent: 2,
+      status: "current"
+    },
+    UGX: {
+      exponent: 0,
+      status: "current"
+    },
+    USD: {
+      exponent: 2,
+      status: "current"
+    },
+    USN: {
+      exponent: 2,
+      status: "current"
+    },
+    UYI: {
+      exponent: 0,
+      status: "current"
+    },
+    UYU: {
+      exponent: 2,
+      status: "current"
+    },
+    UYW: {
+      exponent: 4,
+      status: "current"
+    },
+    UZS: {
+      exponent: 2,
+      status: "current"
+    },
+    VED: {
+      exponent: 2,
+      status: "current"
+    },
+    VES: {
+      exponent: 2,
+      status: "current"
+    },
+    VND: {
+      exponent: 0,
+      status: "current"
+    },
+    VUV: {
+      exponent: 0,
+      status: "current"
+    },
+    WST: {
+      exponent: 2,
+      status: "current"
+    },
+    XAD: {
+      exponent: 2,
+      status: "current"
+    },
+    XAF: {
+      exponent: 0,
+      status: "current"
+    },
+    XCD: {
+      exponent: 2,
+      status: "current"
+    },
+    XCG: {
+      exponent: 2,
+      status: "current"
+    },
+    XOF: {
+      exponent: 0,
+      status: "current"
+    },
+    XPF: {
+      exponent: 0,
+      status: "current"
+    },
+    YER: {
+      exponent: 2,
+      status: "current"
+    },
+    ZAR: {
+      exponent: 2,
+      status: "current"
+    },
+    ZMW: {
+      exponent: 2,
+      status: "current"
+    },
+    ZWG: {
+      exponent: 2,
+      status: "current"
+    }
+  }
+};
+
+// ../shared/src/money.ts
+var entries = iso_4217_exponents_default.currencies;
 // src/index.ts
+function validatedApiBaseUrl(value) {
+  const url = new URL(value);
+  const isLoopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && isLoopback)) {
+    throw new Error("protocol must be HTTPS, except HTTP is allowed for localhost development");
+  }
+  if (url.username || url.password) {
+    throw new Error("credentials are not allowed in ATTRKIT_API_URL");
+  }
+  if (value.includes("?")) {
+    throw new Error("query strings are not allowed in ATTRKIT_API_URL");
+  }
+  if (value.includes("#")) {
+    throw new Error("fragments are not allowed in ATTRKIT_API_URL");
+  }
+  return url;
+}
 function readConfig(env = process.env) {
   const apiKey = env.ATTRKIT_API_KEY;
   if (!apiKey) {
-    throw new Error("ATTRKIT_API_KEY is required (create one in AttrKit → Settings → API keys).");
+    throw new Error("ATTRKIT_API_KEY is required (create one in AttriKit → Settings → API keys).");
   }
   const apiUrl = (env.ATTRKIT_API_URL ?? "https://attrikit.io").replace(/\/+$/, "");
+  validatedApiBaseUrl(apiUrl);
   return { apiKey, apiUrl };
 }
+var STRING_TAG = "[object String]";
+var NUMBER_TAG = "[object Number]";
+var BOOLEAN_TAG = "[object Boolean]";
+var OBJECT_TAG = "[object Object]";
+function hasRuntimeTag(value, tag) {
+  return Object.prototype.toString.call(value) === tag;
+}
+function isString(value) {
+  return hasRuntimeTag(value, STRING_TAG);
+}
+function isNumber(value) {
+  return hasRuntimeTag(value, NUMBER_TAG);
+}
+function isBoolean(value) {
+  return hasRuntimeTag(value, BOOLEAN_TAG);
+}
+function isObject(value) {
+  return hasRuntimeTag(value, OBJECT_TAG);
+}
+function isRequestObject(value) {
+  return Object.prototype.toString.call(value) === OBJECT_TAG;
+}
+function isJsonObject(value) {
+  return isObject(value) && Object.values(value).every(isJsonValue);
+}
+function isJsonValue(value) {
+  return value === null || isString(value) || isNumber(value) || isBoolean(value) || Array.isArray(value) && value.every(isJsonValue) || isJsonObject(value);
+}
+function isApiErrorEnvelope(value) {
+  return isJsonObject(value) && (value.error === undefined || isJsonObject(value.error));
+}
 var REQUEST_TIMEOUT_MS = 15000;
-async function callApi(config, path, options = {}) {
-  const doFetch = options.fetchImpl ?? fetch;
-  const url = new URL(`${config.apiUrl}${path}`);
-  for (const [key, value] of Object.entries(options.query ?? {})) {
+var LONG_REQUEST_TIMEOUT_MS = 120000;
+function requestTimeoutMs(path, body) {
+  if (path === "/api/v1/export")
+    return LONG_REQUEST_TIMEOUT_MS;
+  if (path !== "/api/v1/spend" || !isRequestObject(body))
+    return REQUEST_TIMEOUT_MS;
+  return body.kind === "network_pull" || Array.isArray(body.rows) ? LONG_REQUEST_TIMEOUT_MS : REQUEST_TIMEOUT_MS;
+}
+function hasUnsafePathCharacter(path) {
+  return Array.from(path).some((character) => {
+    const code = character.charCodeAt(0);
+    return code <= 32 || code === 127;
+  });
+}
+function invalidResult(code, message) {
+  return {
+    ok: false,
+    status: 0,
+    json: { error: { code, message } }
+  };
+}
+function buildRequestUrl(baseUrl2, path, query) {
+  if (!path.startsWith("/") || hasUnsafePathCharacter(path)) {
+    throw new Error("path must be an absolute URL path without whitespace or control characters");
+  }
+  const url = new URL(`${baseUrl2.href.replace(/\/+$/, "")}${path}`);
+  for (const [key, value] of Object.entries(query ?? {})) {
     if (value !== undefined && value !== "")
       url.searchParams.set(key, value);
   }
+  return url;
+}
+function parseJsonBody(text) {
+  if (!text)
+    return null;
+  try {
+    const parsed = JSON.parse(text);
+    return isJsonValue(parsed) ? parsed : text;
+  } catch {
+    return text;
+  }
+}
+function requestHeaders(config, idempotencyKey) {
+  const headers = {
+    authorization: `AttriKit-Management ${config.apiKey}`,
+    "content-type": "application/json"
+  };
+  if (idempotencyKey)
+    headers["idempotency-key"] = idempotencyKey;
+  return headers;
+}
+function timeoutError(timeoutMs, method, idempotencyKey) {
+  const readOrRemoveOnly = method === "GET" || method === "DELETE";
+  return {
+    code: "timeout",
+    message: readOrRemoveOnly ? `no response within ${timeoutMs / 1000}s. This request was read-only or removal-only; no generated idempotency_key was used.` : `no response within ${timeoutMs / 1000}s. The request may still have been applied on the server; retry with idempotency_key ${idempotencyKey}.`
+  };
+}
+function networkError(cause, method, idempotencyKey) {
+  const message = cause instanceof Error ? cause.message : String(cause);
+  return {
+    code: "network_error",
+    message: method === "GET" || method === "DELETE" ? message : `${message}. The request may still have been applied on the server; retry with idempotency_key ${idempotencyKey}.`
+  };
+}
+function resolveIdempotencyKey(idempotencyKey, method) {
+  const mutating = method === "POST" || method === "PATCH" || method === "PUT";
+  return idempotencyKey === undefined && mutating ? randomUUID() : idempotencyKey;
+}
+function apiResultFromResponse(response, text, expectedResponse) {
+  const contentType = response.headers.get("content-type") ?? undefined;
+  const retryAfter = response.headers.get("retry-after") ?? undefined;
+  const nextCursor = response.headers.get("attrikit-next-cursor") ?? undefined;
+  const apiResult = {
+    ok: response.ok,
+    status: response.status,
+    json: parseJsonBody(text),
+    rawBody: text,
+    expectedResponse: expectedResponse ?? "json"
+  };
+  if (contentType)
+    apiResult.contentType = contentType;
+  if (retryAfter)
+    apiResult.retryAfter = retryAfter;
+  if (nextCursor)
+    apiResult.nextCursor = nextCursor;
+  return apiResult;
+}
+async function callApi(config, path, options = {}) {
+  const doFetch = options.fetchImpl ?? fetch;
+  let baseUrl2;
+  try {
+    baseUrl2 = validatedApiBaseUrl(config.apiUrl);
+  } catch (error) {
+    return invalidResult("invalid_api_url", `ATTRKIT_API_URL is invalid: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  let url;
+  try {
+    url = buildRequestUrl(baseUrl2, path, options.query);
+  } catch (error) {
+    return invalidResult("invalid_path", `AttriKit API path is invalid: ${error instanceof Error ? error.message : String(error)}`);
+  }
   const controller = new AbortController;
-  const timer = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
+  const timeoutMs = requestTimeoutMs(path, options.body);
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  const method = options.method ?? "GET";
+  const semanticMethod = options.readsOnly ? "GET" : method;
+  const idempotencyKey = resolveIdempotencyKey(options.idempotencyKey, semanticMethod);
   try {
-    const response = await doFetch(url.toString(), {
-      method: options.method ?? "GET",
-      headers: {
-        authorization: `AttriKit-Management ${config.apiKey}`,
-        "content-type": "application/json",
-        ...options.idempotencyKey ? { "idempotency-key": options.idempotencyKey } : {}
-      },
-      ...options.body !== undefined ? { body: JSON.stringify(options.body) } : {},
+    const request = {
+      method,
+      headers: requestHeaders(config, idempotencyKey),
       signal: controller.signal
-    });
-    const text = await response.text();
-    let json = null;
-    if (text) {
-      try {
-        json = JSON.parse(text);
-      } catch {
-        json = text;
-      }
-    }
-    const contentType = response.headers.get("content-type") ?? undefined;
-    const retryAfter = response.headers.get("retry-after") ?? undefined;
-    return {
-      ok: response.ok,
-      status: response.status,
-      json,
-      rawBody: text,
-      ...contentType ? { contentType } : {},
-      ...retryAfter ? { retryAfter } : {},
-      expectedResponse: options.expectedResponse ?? "json"
     };
+    if (options.body !== undefined)
+      request.body = JSON.stringify(options.body);
+    const response = await doFetch(url.toString(), request);
+    const text = await response.text();
+    return apiResultFromResponse(response, text, options.expectedResponse);
   } catch (error) {
     return {
       ok: false,
       status: 0,
       json: {
-        error: error instanceof Error && error.name === "AbortError" ? {
-          code: "timeout",
-          message: `no response within ${REQUEST_TIMEOUT_MS / 1000}s. The request may still have been applied on the server; retry with the same idempotency_key rather than a new one.`
-        } : { code: "network_error", message: error instanceof Error ? error.message : String(error) }
+        error: error instanceof Error && error.name === "AbortError" ? timeoutError(timeoutMs, semanticMethod, idempotencyKey) : networkError(error, semanticMethod, idempotencyKey)
       }
     };
   } finally {
     clearTimeout(timer);
   }
 }
+var redact = (text) => text.replace(/(["'](?:credential|authorization_secret|signing_secret|access_token|refresh_token|client_secret)["']\s*:\s*["'])[^"']+(["'])/gi, "$1[redacted]$2").replace(/(?<![A-Za-z0-9])(?:mk|pk|sk|rk)_[A-Za-z0-9_-]{8,}/g, "[redacted-key]").replace(/\bBearer\s+[A-Za-z0-9\-._~+/]+=*/gi, "Bearer [redacted]").replace(/\bAttriKit-(Management|Publishable)\s+\S+/g, "AttriKit-$1 [redacted]").replace(/\bEAA[A-Za-z0-9_-]{8,}/g, "[redacted-meta-token]").replace(/\b1\/\/[A-Za-z0-9._-]{8,}/g, "[redacted-google-token]").replace(/([?&](?:token|secret|key|password|code|signature)=)[^&\s]+/gi, "$1[redacted]");
+var OPAQUE_CURSOR_PATTERN = /^[A-Za-z0-9_\-=.]{1,4096}$/;
+function withNextCursor(tool, nextCursor) {
+  if (nextCursor === undefined || !OPAQUE_CURSOR_PATTERN.test(nextCursor))
+    return tool;
+  return {
+    ...tool,
+    content: [...tool.content, { type: "text", text: `next_cursor: ${nextCursor}` }],
+    structuredContent: { ...tool.structuredContent, next_cursor: nextCursor }
+  };
+}
+function ndjsonToolResult(result) {
+  const body = result.rawBody ?? "";
+  const contentType = (result.contentType ?? "").toLowerCase();
+  const firstLine = body.split(`
+`, 1)[0]?.trim() ?? "";
+  const looksLikeRecord = (() => {
+    try {
+      const parsed = JSON.parse(firstLine);
+      return isJsonObject(parsed) && (parsed.type === "install" || parsed.type === "event") && isString(parsed.id);
+    } catch {
+      return false;
+    }
+  })();
+  const isEmptyPage = body.trim() === "" && contentType.includes("ndjson");
+  if (!isEmptyPage && (contentType.includes("text/html") || !looksLikeRecord)) {
+    return {
+      content: [{
+        type: "text",
+        text: `AttriKit API error (${result.status}): invalid_response: expected an NDJSON export but received ${body === "" ? "an empty body" : "a body that is not export records"} with Content-Type ${result.contentType ?? "unknown content type"}. Body:
+${redact(body).slice(0, 600)}`
+      }],
+      isError: true
+    };
+  }
+  return withNextCursor({ content: [{ type: "text", text: body }], structuredContent: { value: body } }, result.nextCursor);
+}
 function toToolResult(result) {
   if (!result.ok) {
-    const envelope = result.json;
-    const code = envelope?.error?.code ?? `http_${result.status}`;
-    const message = envelope?.error?.message ? `: ${envelope.error.message}` : "";
-    const retryAfter = result.status === 429 && result.retryAfter ? ` (Retry-After: ${result.retryAfter})` : "";
-    const redact = (text) => text.replace(/\b(?:mk|pk|sk|rk)_[A-Za-z0-9_-]{8,}/g, "[redacted-key]").replace(/\b[Bb]earer\s+[A-Za-z0-9._-]{8,}/g, "Bearer [redacted]").replace(/\bAttriKit-(?:Management|Publishable)\s+\S+/g, "AttriKit-$1 [redacted]").replace(/([?&](?:token|secret|key|password|code|signature)=)[^&\s]+/gi, "$1[redacted]");
-    const excerpt = !envelope?.error?.message && result.rawBody ? ` — body: ${redact(result.rawBody.replace(/\s+/g, " ").trim()).slice(0, 300)}` : "";
+    const envelope = isApiErrorEnvelope(result.json) ? result.json : null;
+    const rawCode = envelope?.error?.code;
+    const code = isString(rawCode) && rawCode !== "" ? redact(rawCode).slice(0, 120) : `http_${result.status}`;
+    const rawMessage = envelope?.error?.message;
+    const hasMessage = isString(rawMessage) && rawMessage.trim() !== "";
+    const message = hasMessage ? `: ${redact(rawMessage).slice(0, 400)}` : "";
+    const retryAfterValue = result.retryAfter === undefined ? "" : redact(result.retryAfter).trim().slice(0, 120);
+    const validRetryAfter = /^\d{1,10}$/.test(retryAfterValue) || /^(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun), \d{2} (?:Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) \d{4} \d{2}:\d{2}:\d{2} GMT$/.test(retryAfterValue);
+    const retryAfter = result.status === 429 && validRetryAfter ? ` (Retry-After: ${retryAfterValue})` : "";
+    const excerpt = !hasMessage && result.rawBody ? ` — body: ${redact(result.rawBody.replace(/\s+/g, " ").trim()).slice(0, 300)}` : "";
     const hint = result.status === 401 ? " Check ATTRKIT_API_KEY: this is the same error for a missing, wrong, revoked or expired key." : "";
     return {
       content: [{
         type: "text",
-        text: `AttrKit API error (${result.status || "network"}): ${code}${message}${retryAfter}${excerpt}${hint}`
+        text: `AttriKit API error (${result.status || "network"}): ${code}${message}${retryAfter}${excerpt}${hint}`
       }],
       isError: true
     };
   }
   const expectedResponse = result.expectedResponse ?? "json";
+  if (expectedResponse === "ndjson")
+    return ndjsonToolResult(result);
   const isEmptySuccess = result.status === 204 && (result.rawBody === undefined || result.rawBody === "");
-  const isJsonEnvelope = result.json !== null && typeof result.json === "object" && !Array.isArray(result.json) && Object.hasOwn(result.json, "data");
+  const isJsonEnvelope = isJsonObject(result.json) && Object.hasOwn(result.json, "data");
   const contentType = (result.contentType ?? "").toLowerCase();
-  const looksLikeMarkup = typeof result.json === "string" && /^\s*<(?:!doctype|html|head|body)\b/i.test(result.json);
-  const isExpectedText = expectedResponse === "text" && typeof result.json === "string" && !contentType.includes("text/html") && !looksLikeMarkup;
+  const looksLikeCsv = (() => {
+    if (!isString(result.json))
+      return false;
+    const firstLine = result.json.split(`
+`, 1)[0]?.trim() ?? "";
+    if (!firstLine || firstLine.startsWith("<"))
+      return false;
+    const columns = firstLine.split(",").map((field) => field.trim().replace(/^"(.*)"$/s, "$1"));
+    return columns.length >= 2 && (columns[0] === "type" || columns[0] === "kind") && columns[1] === "id" && columns.every((field) => /^[A-Za-z][A-Za-z0-9_]*$/.test(field));
+  })();
+  const isExpectedText = expectedResponse === "text" && isString(result.json) && !contentType.includes("text/html") && looksLikeCsv;
   if (!isEmptySuccess && !isJsonEnvelope && !isExpectedText) {
     const reportedContentType = result.contentType ?? "unknown content type";
-    const received = result.json === null ? "an empty body" : Array.isArray(result.json) ? "a JSON array" : typeof result.json === "object" ? "a JSON object without a data field" : `a ${typeof result.json} body`;
-    const body = result.rawBody ?? (typeof result.json === "string" ? result.json : JSON.stringify(result.json, null, 2));
+    const received = result.json === null ? "an empty body" : Array.isArray(result.json) ? "a JSON array" : isJsonObject(result.json) ? "a JSON object without a data field" : `a ${isString(result.json) ? "string" : isNumber(result.json) ? "number" : "boolean"} body`;
+    const body = redact(result.rawBody ?? (isString(result.json) ? result.json : JSON.stringify(result.json, null, 2))).slice(0, 600);
+    const expectation = expectedResponse === "text" ? "expected a CSV export" : "expected a JSON data envelope";
     return {
       content: [{
         type: "text",
-        text: `AttrKit API error (${result.status}): invalid_response: expected a JSON data envelope but received ${received} with Content-Type ${reportedContentType}. Body:
+        text: `AttriKit API error (${result.status}): invalid_response: ${expectation} but received ${received} with Content-Type ${reportedContentType}. Body:
 ${body}`
       }],
       isError: true
     };
   }
-  const structured = result.json && typeof result.json === "object" ? result.json : { value: result.json };
-  return {
+  const structured = isJsonObject(result.json) ? result.json : { value: result.json };
+  return withNextCursor({
     content: [{ type: "text", text: JSON.stringify(result.json, null, 2) }],
     structuredContent: structured
-  };
+  }, result.nextCursor);
 }
-var SERVER_VERSION = "0.4.5";
-var periodSchema = z4.enum(["7d", "30d", "90d", "all"]).describe("Reporting window. Defaults to 30d.").optional();
-var appIdSchema = z4.string().describe("Optional app id to scope the result to one app.").optional();
-var requiredAppIdSchema = z4.string().describe("The AttrKit app id.");
-var idempotencyKeySchema = z4.string().max(255).describe("Stable retry key for this exact mutation.").optional();
-var ownersSchema = z4.record(z4.string(), z4.enum(["attrkit", "revenuecat", "customer"]));
-var cursorSchema = z4.string().optional().describe("Pass the next_cursor from the previous response to fetch the following page. Omit for the first page.");
-var listLimitSchema = z4.number().int().min(1).max(200).optional().describe("Rows per page, 1-200. The API defaults to 50, so a workspace with more than that needs paging.");
-var spendRowSchema = z4.object({
-  campaign_id: z4.string().optional().describe("The AttrKit campaign UUID, NOT the ad network's own campaign id. It is the opposite of create_campaign_link.campaign_id and is the most common mistake here: read it from list_campaigns. The API rejects a network id by name. Preferred snake_case spelling."),
-  campaignId: z4.string().optional().describe("Accepted camelCase alias for campaign_id."),
-  adset_id: z4.string().optional().nullable().describe("Ad set id. Must be sent together with ad_id; either one alone is rejected."),
-  adsetId: z4.string().optional().nullable(),
-  ad_id: z4.string().optional().nullable(),
-  adId: z4.string().optional().nullable(),
-  adset_name: z4.string().optional().nullable(),
-  adsetName: z4.string().optional().nullable(),
-  ad_name: z4.string().optional().nullable(),
-  adName: z4.string().optional().nullable(),
-  metric_date: z4.string().regex(/^\d{4}-\d{2}-\d{2}$/).optional().describe("Required metric date. Preferred snake_case spelling."),
-  metricDate: z4.string().regex(/^\d{4}-\d{2}-\d{2}$/).optional().describe("Accepted camelCase alias for metric_date."),
-  clicks: z4.number().int().nonnegative().optional(),
-  impressions: z4.number().int().nonnegative().optional(),
-  spend_minor_units: z4.number().int().nonnegative().optional().describe("Required spend amount. Preferred snake_case spelling."),
-  spendMinorUnits: z4.number().int().nonnegative().optional().describe("Accepted camelCase alias for spend_minor_units.")
-}).superRefine((row, context) => {
-  for (const [path, value] of [
-    ["campaign_id", row.campaign_id ?? row.campaignId],
-    ["metric_date", row.metric_date ?? row.metricDate],
-    ["spend_minor_units", row.spend_minor_units ?? row.spendMinorUnits]
-  ]) {
+var SERVER_VERSION = "1.0.0";
+var periodSchema = z5.enum(["7d", "30d", "90d", "all"]).describe("Reporting window. Omit to use the endpoint's documented default.").optional();
+var appIdSchema = z5.string().describe("Optional app id to scope the result to one app.").optional();
+var requiredAppIdSchema = z5.string().min(1).describe("The AttriKit app id.");
+var encodeOpaquePathSegment = (value) => encodeURIComponent(value).replaceAll(".", "%252E");
+var idempotencyKeySchema = z5.string().max(255).describe("Stable retry key for this exact mutation.").optional();
+var ownersSchema = z5.record(z5.string(), z5.enum(["attrkit", "revenuecat", "customer"]));
+var cursorSchema = z5.string().optional().describe("Pass the next_cursor from the previous response to fetch the following page. Omit for the first page.");
+var listLimitSchema = z5.number().int().min(1).max(200).optional().describe("Rows per page, 1-200. The API defaults to 50, so a workspace with more than that needs paging.");
+var calendarDaySchema = z5.string().regex(/^\d{4}-\d{2}-\d{2}$/, "Use a UTC calendar day, YYYY-MM-DD.");
+var rangeFromSchema = calendarDaySchema.optional().describe("First UTC day of an explicit window, YYYY-MM-DD, inclusive. Use instead of period; sending both is a 400.");
+var rangeToSchema = calendarDaySchema.optional().describe("Last UTC day of an explicit window, YYYY-MM-DD, inclusive. Use instead of period; sending both is a 400.");
+function validateMatchingSpendAliases(pairs, context) {
+  for (const [preferred, alias, preferredValue, aliasValue] of pairs) {
+    if (preferredValue !== undefined && aliasValue !== undefined && preferredValue !== aliasValue) {
+      context.addIssue({
+        code: "custom",
+        path: [alias],
+        message: `${preferred} and ${alias} must match when both are supplied`
+      });
+    }
+  }
+}
+function validateRequiredSpendValues(values, context) {
+  for (const [path, value] of values) {
     if (value === undefined) {
       context.addIssue({
         code: "custom",
@@ -14151,6 +15080,49 @@ var spendRowSchema = z4.object({
       });
     }
   }
+}
+function validatePairedAdIds(adsetId, adId, context) {
+  if (adsetId == null !== (adId == null)) {
+    context.addIssue({
+      code: "custom",
+      path: adsetId == null ? ["adset_id"] : ["ad_id"],
+      message: "adset_id and ad_id must be supplied together"
+    });
+  }
+}
+var spendRowSchema = z5.object({
+  campaign_id: z5.string().optional().describe("The AttriKit campaign UUID, NOT the ad network's own campaign id (that is create_campaign_link.network_campaign_id). It is the most common mistake here: read it from list_campaigns. The API rejects a network id by name. Preferred snake_case spelling."),
+  campaignId: z5.string().optional().describe("Accepted camelCase alias for campaign_id."),
+  adset_id: z5.string().optional().nullable().describe("Ad set id. Must be sent together with ad_id; either one alone is rejected."),
+  adsetId: z5.string().optional().nullable(),
+  ad_id: z5.string().optional().nullable(),
+  adId: z5.string().optional().nullable(),
+  adset_name: z5.string().optional().nullable(),
+  adsetName: z5.string().optional().nullable(),
+  ad_name: z5.string().optional().nullable(),
+  adName: z5.string().optional().nullable(),
+  metric_date: z5.string().regex(/^\d{4}-\d{2}-\d{2}$/).optional().describe("Required metric date. Preferred snake_case spelling."),
+  metricDate: z5.string().regex(/^\d{4}-\d{2}-\d{2}$/).optional().describe("Accepted camelCase alias for metric_date."),
+  clicks: z5.number().int().nonnegative().optional(),
+  impressions: z5.number().int().nonnegative().optional(),
+  spend_minor_units: z5.number().int().nonnegative().optional().describe("Required spend amount. Preferred snake_case spelling."),
+  spendMinorUnits: z5.number().int().nonnegative().optional().describe("Accepted camelCase alias for spend_minor_units.")
+}).superRefine((row, context) => {
+  validateMatchingSpendAliases([
+    ["campaign_id", "campaignId", row.campaign_id, row.campaignId],
+    ["adset_id", "adsetId", row.adset_id, row.adsetId],
+    ["ad_id", "adId", row.ad_id, row.adId],
+    ["adset_name", "adsetName", row.adset_name, row.adsetName],
+    ["ad_name", "adName", row.ad_name, row.adName],
+    ["metric_date", "metricDate", row.metric_date, row.metricDate],
+    ["spend_minor_units", "spendMinorUnits", row.spend_minor_units, row.spendMinorUnits]
+  ], context);
+  validateRequiredSpendValues([
+    ["campaign_id", row.campaign_id ?? row.campaignId],
+    ["metric_date", row.metric_date ?? row.metricDate],
+    ["spend_minor_units", row.spend_minor_units ?? row.spendMinorUnits]
+  ], context);
+  validatePairedAdIds(row.adset_id ?? row.adsetId, row.ad_id ?? row.adId, context);
 });
 function normalizeSpendRow(row) {
   return {
@@ -14181,12 +15153,12 @@ function createServer(config, fetchImpl) {
     inputSchema: {}
   }, async () => toToolResult(await call("/api/v1/workspace/usage-cap")));
   server.registerTool("set_usage_cap", {
-    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+    annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true },
     title: "Set the workspace usage cap",
     description: "Set a monthly qualified-install cap of at least 10,000 and its alert email. Pass null for both values to clear the cap. Requires a workspace-scoped write key.",
     inputSchema: {
-      monthly_qualified_install_cap: z4.number().int().min(1e4).max(Number.MAX_SAFE_INTEGER).nullable(),
-      alert_email: z4.string().trim().email().max(320).nullable(),
+      monthly_qualified_install_cap: z5.number().int().min(1e4).max(Number.MAX_SAFE_INTEGER).nullable(),
+      alert_email: z5.string().trim().email().max(320).nullable(),
       idempotency_key: idempotencyKeySchema
     }
   }, async ({
@@ -14198,7 +15170,7 @@ function createServer(config, fetchImpl) {
       return {
         content: [{
           type: "text",
-          text: "AttrKit usage-cap validation error: set both cap and alert email, or pass null for both to clear them."
+          text: "AttriKit usage-cap validation error: set both cap and alert email, or pass null for both to clear them."
         }],
         isError: true
       };
@@ -14215,22 +15187,27 @@ function createServer(config, fetchImpl) {
   server.registerTool("list_apps", {
     annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
     title: "List apps",
-    description: "List the iOS and Android apps in your AttrKit workspace (id, name, platform, bundle id, store id, status).",
+    description: "List the iOS and Android apps in your AttriKit workspace (id, name, platform, bundle id, store id, status).",
     inputSchema: { cursor: cursorSchema, limit: listLimitSchema }
-  }, async ({ cursor, limit }) => toToolResult(await call("/api/v1/apps", {
-    query: { ...cursor ? { cursor } : {}, ...limit === undefined ? {} : { limit: String(limit) } }
-  })));
+  }, async ({ cursor, limit }) => {
+    const query = {};
+    if (cursor)
+      query.cursor = cursor;
+    if (limit !== undefined)
+      query.limit = String(limit);
+    return toToolResult(await call("/api/v1/apps", { query }));
+  });
   server.registerTool("create_app", {
     annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
     title: "Create an app",
     description: "Create an iOS or Android app without the web UI. Returns the publishable key and a one-time app-scoped management key.",
     inputSchema: {
-      name: z4.string().min(1).max(80),
-      bundle_id: z4.string().min(3).max(255),
-      platform: z4.enum(["iOS", "Android"]),
-      store_url: z4.string().url(),
-      timezone: z4.string().max(64).optional(),
-      device_matching_mode: z4.enum(["on", "strict"]).optional(),
+      name: z5.string().min(1).max(80),
+      bundle_id: z5.string().min(3).max(255),
+      platform: z5.enum(["iOS", "Android"]),
+      store_url: z5.string().url(),
+      timezone: z5.string().max(64).optional(),
+      device_matching_mode: z5.enum(["on", "strict"]).optional(),
       idempotency_key: idempotencyKeySchema
     }
   }, async ({
@@ -14241,36 +15218,36 @@ function createServer(config, fetchImpl) {
     timezone,
     device_matching_mode,
     idempotency_key
-  }) => toToolResult(await call("/api/v1/apps", {
-    method: "POST",
-    idempotencyKey: idempotency_key,
-    body: {
-      name,
-      bundleId: bundle_id,
-      platform,
-      storeUrl: store_url,
-      ...timezone ? { timezone } : {},
-      ...device_matching_mode ? { deviceMatchingMode: device_matching_mode } : {}
-    }
-  })));
+  }) => {
+    const body = { name, bundleId: bundle_id, platform, storeUrl: store_url };
+    if (timezone)
+      body.timezone = timezone;
+    if (device_matching_mode)
+      body.deviceMatchingMode = device_matching_mode;
+    return toToolResult(await call("/api/v1/apps", {
+      method: "POST",
+      idempotencyKey: idempotency_key,
+      body
+    }));
+  });
   server.registerTool("get_app", {
     annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
     title: "Get an app",
     description: "Return one app's configuration.",
     inputSchema: { app_id: requiredAppIdSchema }
-  }, async ({ app_id }) => toToolResult(await call(`/api/v1/apps/${encodeURIComponent(app_id)}`)));
+  }, async ({ app_id }) => toToolResult(await call(`/api/v1/apps/${encodeOpaquePathSegment(app_id)}`)));
   server.registerTool("update_app", {
     annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
     title: "Update an app",
-    description: "Update app metadata, store destination, timezone or device-matching mode.",
+    description: "Update app metadata, store destination, timezone or coverage mode.",
     inputSchema: {
       app_id: requiredAppIdSchema,
-      name: z4.string().min(1).max(80).optional(),
-      bundle_id: z4.string().min(3).max(255).optional(),
-      platform: z4.enum(["iOS", "Android"]).optional(),
-      store_url: z4.string().url().optional(),
-      timezone: z4.string().max(64).optional(),
-      device_matching_mode: z4.enum(["on", "strict"]).optional(),
+      name: z5.string().min(1).max(80).optional(),
+      bundle_id: z5.string().min(3).max(255).optional(),
+      platform: z5.enum(["iOS", "Android"]).optional(),
+      store_url: z5.string().url().optional(),
+      timezone: z5.string().max(64).optional(),
+      device_matching_mode: z5.enum(["on", "strict"]).optional(),
       idempotency_key: idempotencyKeySchema
     }
   }, async ({
@@ -14282,24 +15259,32 @@ function createServer(config, fetchImpl) {
     timezone,
     device_matching_mode,
     idempotency_key
-  }) => toToolResult(await call(`/api/v1/apps/${encodeURIComponent(app_id)}`, {
-    method: "PATCH",
-    idempotencyKey: idempotency_key,
-    body: {
-      ...name ? { name } : {},
-      ...bundle_id ? { bundleId: bundle_id } : {},
-      ...platform ? { platform } : {},
-      ...store_url ? { storeUrl: store_url } : {},
-      ...timezone ? { timezone } : {},
-      ...device_matching_mode ? { deviceMatchingMode: device_matching_mode } : {}
-    }
-  })));
+  }) => {
+    const body = {};
+    if (name)
+      body.name = name;
+    if (bundle_id)
+      body.bundleId = bundle_id;
+    if (platform)
+      body.platform = platform;
+    if (store_url)
+      body.storeUrl = store_url;
+    if (timezone)
+      body.timezone = timezone;
+    if (device_matching_mode)
+      body.deviceMatchingMode = device_matching_mode;
+    return toToolResult(await call(`/api/v1/apps/${encodeOpaquePathSegment(app_id)}`, {
+      method: "PATCH",
+      idempotencyKey: idempotency_key,
+      body
+    }));
+  });
   server.registerTool("archive_app", {
     annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true },
     title: "Archive an app",
     description: "Archive an app and remove it from active customer operations.",
     inputSchema: { app_id: requiredAppIdSchema }
-  }, async ({ app_id }) => toToolResult(await call(`/api/v1/apps/${encodeURIComponent(app_id)}`, {
+  }, async ({ app_id }) => toToolResult(await call(`/api/v1/apps/${encodeOpaquePathSegment(app_id)}`, {
     method: "DELETE"
   })));
   server.registerTool("get_publishable_key", {
@@ -14307,7 +15292,7 @@ function createServer(config, fetchImpl) {
     title: "Get an app publishable key",
     description: "Reveal the recoverable SDK publishable key for an app.",
     inputSchema: { app_id: requiredAppIdSchema }
-  }, async ({ app_id }) => toToolResult(await call(`/api/v1/apps/${encodeURIComponent(app_id)}/publishable-key`)));
+  }, async ({ app_id }) => toToolResult(await call(`/api/v1/apps/${encodeOpaquePathSegment(app_id)}/publishable-key`)));
   server.registerTool("rotate_publishable_key", {
     annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true },
     title: "Rotate an app publishable key",
@@ -14316,7 +15301,7 @@ function createServer(config, fetchImpl) {
       app_id: requiredAppIdSchema,
       idempotency_key: idempotencyKeySchema
     }
-  }, async ({ app_id, idempotency_key }) => toToolResult(await call(`/api/v1/apps/${encodeURIComponent(app_id)}/publishable-key`, { method: "POST", idempotencyKey: idempotency_key })));
+  }, async ({ app_id, idempotency_key }) => toToolResult(await call(`/api/v1/apps/${encodeOpaquePathSegment(app_id)}/publishable-key`, { method: "POST", idempotencyKey: idempotency_key })));
   server.registerTool("list_api_keys", {
     annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
     title: "List management keys",
@@ -14328,9 +15313,9 @@ function createServer(config, fetchImpl) {
     title: "Create a management key",
     description: "Create a read-only or read/write workspace or app key. The secret is returned once.",
     inputSchema: {
-      label: z4.string().min(1).max(80),
-      scopes: z4.array(z4.enum(["read", "write"])).min(1).max(2),
-      app_id: z4.string().uuid().optional().nullable(),
+      label: z5.string().min(1).max(80),
+      scopes: z5.array(z5.enum(["read", "write"])).min(1).max(2),
+      app_id: z5.string().uuid().optional().nullable(),
       idempotency_key: idempotencyKeySchema
     }
   }, async ({ label, scopes, app_id, idempotency_key }) => toToolResult(await call("/api/v1/api-keys", {
@@ -14342,18 +15327,18 @@ function createServer(config, fetchImpl) {
     annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true },
     title: "Revoke a management key",
     description: "Immediately revoke a management key by id.",
-    inputSchema: { key_id: z4.string().uuid() }
+    inputSchema: { key_id: z5.string().uuid() }
   }, async ({ key_id }) => toToolResult(await call(`/api/v1/api-keys/${encodeURIComponent(key_id)}`, {
     method: "DELETE"
   })));
   server.registerTool("list_links", {
     annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
     title: "List campaign links",
-    description: "List tracking links, optionally for one app.",
+    description: "List tracking links, optionally for one app. Each link's tracking_url is the campaign link to use in the ad (null if unavailable); url is the store destination.",
     inputSchema: {
       app_id: appIdSchema,
-      cursor: z4.string().optional(),
-      limit: z4.number().int().min(1).max(200).optional()
+      cursor: z5.string().optional(),
+      limit: z5.number().int().min(1).max(200).optional()
     }
   }, async ({ app_id, cursor, limit }) => toToolResult(await call("/api/v1/links", {
     query: {
@@ -14365,16 +15350,19 @@ function createServer(config, fetchImpl) {
   server.registerTool("list_campaigns", {
     annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
     title: "List campaigns",
-    description: "List ad campaigns with their honest profit surface: the scale/cut/hold call, profit p05/p50/p95, spend, retention, and payback. Use this to see how campaigns are performing.",
-    inputSchema: { app_id: appIdSchema, period: periodSchema, cursor: cursorSchema, limit: listLimitSchema }
-  }, async ({ app_id, period, cursor, limit }) => toToolResult(await call("/api/v1/reports/campaigns", {
-    query: {
+    description: "List ad campaigns with their honest profit surface. `call` preserves the original v1 fail-closed automation behavior for multi-component rows; `recommended_call` is the additive SCALE/CUT/HOLD recommendation the current engine made. It is backed by `envelope_lower`/`envelope_central`/`envelope_upper`. Read `aggregation_basis` before quoting the low end: single_component_quantiles means it is a calibrated 5th percentile; marginal_endpoint_sum_no_joint_coverage means it is the sum of each component period's own low end, which is pessimistic against independence but is NOT a floor or a guarantee, so describe it as a scenario. The quantile-named `profit_p05`/`profit_p50`/`profit_p95` are null unless one component supplied calibrated ones. Also includes spend, retention, and payback.",
+    inputSchema: { app_id: appIdSchema, period: periodSchema, from: rangeFromSchema, to: rangeToSchema, cursor: cursorSchema, limit: listLimitSchema }
+  }, async ({ app_id, period, from, to, cursor, limit }) => {
+    const query = {
       appId: app_id,
       period,
-      ...cursor ? { cursor } : {},
-      ...limit === undefined ? {} : { limit: String(limit) }
-    }
-  })));
+      from,
+      to,
+      cursor: cursor || undefined,
+      limit: limit === undefined ? undefined : String(limit)
+    };
+    return toToolResult(await call("/api/v1/reports/campaigns", { query }));
+  });
   server.registerTool("list_ads", {
     annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
     title: "List creative-level ad performance",
@@ -14382,12 +15370,18 @@ function createServer(config, fetchImpl) {
     inputSchema: {
       app_id: appIdSchema,
       period: periodSchema,
-      limit: z4.number().int().min(1).max(200).optional()
+      from: rangeFromSchema,
+      to: rangeToSchema,
+      cursor: cursorSchema,
+      limit: z5.number().int().min(1).max(200).optional()
     }
-  }, async ({ app_id, period, limit }) => toToolResult(await call("/api/v1/reports/ads", {
+  }, async ({ app_id, period, from, to, cursor, limit }) => toToolResult(await call("/api/v1/reports/ads", {
     query: {
       appId: app_id,
       period,
+      from,
+      to,
+      cursor,
       limit: limit === undefined ? undefined : String(limit)
     }
   })));
@@ -14397,62 +15391,54 @@ function createServer(config, fetchImpl) {
     description: "Return the same recent attribution events and installs visible on the Live dashboard.",
     inputSchema: {
       app_id: appIdSchema,
-      limit: z4.number().int().min(1).max(50).optional()
+      limit: z5.number().int().min(1).max(50).optional(),
+      from: calendarDaySchema.optional().describe("First UTC day to include, YYYY-MM-DD. May be sent without to. Sending from, to or cursor switches the response to paged mode, which adds next_cursor."),
+      to: calendarDaySchema.optional().describe("Last UTC day to include, YYYY-MM-DD. May be sent without from."),
+      cursor: cursorSchema
     }
-  }, async ({ app_id, limit }) => toToolResult(await call("/api/v1/events", {
+  }, async ({ app_id, limit, from, to, cursor }) => toToolResult(await call("/api/v1/events", {
     query: {
       appId: app_id,
+      from,
+      to,
+      cursor,
       limit: limit === undefined ? undefined : String(limit)
     }
   })));
   server.registerTool("get_campaign_decision", {
     annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
     title: "Get campaign decisions (scale / cut / hold)",
-    description: "Return AttrKit's profit DECISIONS for your campaigns: the scale/cut/hold call and confidence, computed by the attribution engine. Report the `call` VERBATIM — do not recompute or override it; when it says not_enough_data, say so. This is the tool to drive budget automation.",
-    inputSchema: { app_id: appIdSchema }
-  }, async ({ app_id }) => toToolResult(await call("/api/v1/decisions", { query: { appId: app_id } })));
+    description: "Return AttriKit's profit DECISIONS for your campaigns: the scale/cut/hold call and confidence, computed by the attribution engine. Report the `call` VERBATIM — do not recompute or override it; when it says not_enough_data, say so. This is the tool to drive budget automation.",
+    inputSchema: {
+      app_id: appIdSchema,
+      period: periodSchema,
+      cursor: cursorSchema,
+      limit: listLimitSchema
+    }
+  }, async ({ app_id, period, cursor, limit }) => toToolResult(await call("/api/v1/decisions", {
+    query: {
+      appId: app_id,
+      period,
+      cursor,
+      limit: limit === undefined ? undefined : String(limit)
+    }
+  })));
   server.registerTool("record_campaign_decision", {
     annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
     title: "Record a campaign decision",
-    description: "Freeze a scale/cut/hold decision and its exact model inputs for later maturity evaluation.",
+    description: "Record a scale/cut/hold decision for the reporting period the caller reviewed. AttriKit freezes that period's current campaign range, spend, costs, revenue basis, and model version server-side; callers cannot author receipt provenance.",
     inputSchema: {
       app_id: requiredAppIdSchema,
-      campaign_id: z4.string().describe("The AttrKit campaign uuid, as returned by list_campaigns or get_campaign_decision. Not the ad network's own campaign id."),
-      call: z4.enum(["scale", "cut", "hold"]).describe("The decision being frozen. Report get_campaign_decision's own call verbatim rather than forming your own."),
-      actor: z4.enum(["dashboard", "auto_suggested"]).optional().describe("Who made the call. Use auto_suggested when an agent proposed it without a human confirming."),
-      p05: z4.number().describe("Low end of the profit range from get_campaign_decision, in minor units. Pass through unchanged."),
-      p50: z4.number().describe("Central profit estimate from get_campaign_decision, in minor units. Pass through unchanged."),
-      p95: z4.number().describe("High end of the profit range from get_campaign_decision, in minor units. Pass through unchanged."),
-      spend_minor_units: z4.number().nonnegative().describe("Spend the decision was taken against, in minor units of `currency`."),
-      currency: z4.string().length(3).describe("ISO 4217 code for spend and revenue on this decision, e.g. USD. Three letters."),
-      band_width_pct: z4.number().nonnegative().describe("Width of the profit band as a percentage, from get_campaign_decision. It is how the maturity check later judges whether the range was tight enough to act on."),
-      threshold: z4.number().describe("The profit threshold the call was made against, in minor units."),
-      model_version: z4.string().describe("Model version string from get_campaign_decision. Recorded so a later evaluation knows which model produced the range."),
-      cost_model_version: z4.number().int().positive().nullable().describe("Cost model version from get_campaign_decision, or null when no cost model applied."),
-      revenue_per_install_minor_units: z4.number().nonnegative().nullable().describe("Revenue per install used in the estimate, in minor units, or null when revenue was unavailable."),
-      revenue_per_install_quality: z4.enum([
-        "campaign_verified_cohort",
-        "app_verified_cohort_fallback",
-        "unavailable"
-      ]).describe("How that revenue figure was derived: from this campaign's own verified cohort, from the app-wide fallback, or not at all. Pass through from get_campaign_decision."),
+      campaign_id: z5.string().uuid().describe("The AttriKit campaign uuid, as returned by list_campaigns or get_campaign_decision. Not the ad network's own campaign id."),
+      call: z5.enum(["scale", "cut", "hold"]).describe("The decision being frozen. Report get_campaign_decision's own call verbatim rather than forming your own."),
+      period: periodSchema.describe("The reporting window you reviewed; the receipt freezes that window. Pass the same period you read. Omitted, this tool and get_campaign_decision use all, while list_campaigns defaults to 30d."),
       idempotency_key: idempotencyKeySchema
     }
   }, async ({
     app_id,
     campaign_id,
     call: decisionCall,
-    actor,
-    p05,
-    p50,
-    p95,
-    spend_minor_units,
-    currency,
-    band_width_pct,
-    threshold,
-    model_version,
-    cost_model_version,
-    revenue_per_install_minor_units,
-    revenue_per_install_quality,
+    period,
     idempotency_key
   }) => toToolResult(await call("/api/v1/decisions", {
     method: "POST",
@@ -14461,70 +15447,76 @@ function createServer(config, fetchImpl) {
       appId: app_id,
       campaignId: campaign_id,
       call: decisionCall,
-      ...actor ? { actor } : {},
-      inputs: {
-        p05,
-        p50,
-        p95,
-        spend_minor_units,
-        currency,
-        band_width_pct,
-        threshold,
-        model_version,
-        cost_model_version,
-        revenue_per_install_minor_units,
-        revenue_per_install_quality
-      }
+      period
     }
   })));
   server.registerTool("get_attribution_rollup", {
     annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
     title: "Get attribution rollup",
-    description: "Return the account-level attribution overview: installs accounted-for by evidence class (verified / device-matched / modeled / organic), MER, revenue and data freshness.",
-    inputSchema: { app_id: appIdSchema, period: periodSchema }
-  }, async ({ app_id, period }) => toToolResult(await call("/api/v1/reports/overview", { query: { appId: app_id, period } })));
+    description: "Return the account-level attribution overview: installs accounted-for by evidence class (verified / matched / modeled / organic), MER, revenue and data freshness.",
+    inputSchema: { app_id: appIdSchema, period: periodSchema, from: rangeFromSchema, to: rangeToSchema }
+  }, async ({ app_id, period, from, to }) => toToolResult(await call("/api/v1/reports/overview", { query: { appId: app_id, period, from, to } })));
   server.registerTool("create_campaign_link", {
     annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
     title: "Create a campaign tracking link",
-    description: "Create a web-to-app tracking link for an ad campaign. Requires a write-scoped API key. Returns the link id and url.",
+    description: "Create a web-to-app tracking link for an ad campaign. Requires a write-scoped API key. Returns the link: tracking_url is the campaign link to use in the ad (for meta the ad's Website URL, for tiktok the ad's destination, for google the tracking template with the App Store URL kept as the final URL); url is only the App Store destination you passed, never the link to put in an ad. tracking_url is null when the server has no link origin configured or the network is unrecognized; then create the link in AttriKit, Links.",
     inputSchema: {
-      app_id: z4.string().describe("The app id the link belongs to."),
-      network: z4.enum(["meta", "google", "tiktok"]).describe("The ad network delivering the campaign."),
-      destination_url: z4.string().url().describe("The App Store URL to send users to."),
-      campaign_name: z4.string().max(120).optional().describe("Optional human-readable campaign name."),
-      campaign_id: z4.string().optional().describe("Optional external campaign id. This is the AD NETWORK's own campaign id, not an AttrKit uuid; it is the opposite of import_spend.campaign_id, which requires the AttrKit one."),
-      serve_landing: z4.boolean().optional().describe("Serve the interstitial landing bridge on this link. Defaults to true at the API. The bridge is what captures browser-side context for device matching, so turning it off narrows what can be matched."),
+      app_id: requiredAppIdSchema.describe("The app id the link belongs to."),
+      network: z5.enum(["meta", "google", "tiktok"]).describe("The ad network delivering the campaign."),
+      destination_url: z5.string().url().describe("The App Store URL to send users to."),
+      campaign_name: z5.string().max(120).optional().describe("Optional human-readable campaign name."),
+      network_campaign_id: z5.string().optional().describe("The AD NETWORK's own campaign id (for Meta, the campaign ID in Ads Manager, which exists as soon as the campaign is saved, even as a draft). pull_network_spend matches report rows on it, so set it on every link whose spend you will pull: a link created without it can never match. Create the network campaign first, then the link, then paste the link into the ad."),
+      campaign_id: z5.string().optional().describe("Optional EXISTING AttriKit campaign uuid (from list_campaigns) to attach this link to. Not the ad network's id: use network_campaign_id for that. Pass one or the other, not both."),
+      serve_landing: z5.boolean().optional().describe("Serve the landing bridge on this link. Defaults to true at the API."),
       idempotency_key: idempotencyKeySchema
     }
-  }, async ({ app_id, network, destination_url, campaign_name, campaign_id, serve_landing, idempotency_key }) => toToolResult(await call("/api/v1/links", {
-    method: "POST",
-    idempotencyKey: idempotency_key,
-    body: {
-      appId: app_id,
-      network,
-      destinationUrl: destination_url,
-      ...campaign_name ? { campaignName: campaign_name } : {},
-      ...campaign_id ? { campaignId: campaign_id } : {},
-      ...serve_landing === undefined ? {} : { serveLanding: serve_landing }
-    }
-  })));
+  }, async ({ app_id, network, destination_url, campaign_name, campaign_id, network_campaign_id, serve_landing, idempotency_key }) => {
+    const body = { appId: app_id, network, destinationUrl: destination_url };
+    if (campaign_name)
+      body.campaignName = campaign_name;
+    if (campaign_id)
+      body.campaignId = campaign_id;
+    if (network_campaign_id)
+      body.networkCampaignId = network_campaign_id;
+    if (serve_landing !== undefined)
+      body.serveLanding = serve_landing;
+    return toToolResult(await call("/api/v1/links", {
+      method: "POST",
+      idempotencyKey: idempotency_key,
+      body
+    }));
+  });
   server.registerTool("update_link_status", {
     annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
-    title: "Enable or disable a campaign link",
-    description: "Change a tracking link between active and disabled.",
+    title: "Enable or disable a campaign link, or attach its network campaign id",
+    description: "Change a tracking link between active and disabled, and/or attach the ad network's own campaign id to a link created without one (then pull_network_spend can match its spend). Send status, network_campaign_id, or both. A campaign that already has a different network id is refused with 409 network_campaign_conflict.",
     inputSchema: {
-      link_id: z4.string().uuid(),
-      status: z4.enum(["active", "disabled"]),
+      link_id: z5.string().uuid(),
+      status: z5.enum(["active", "disabled"]).optional(),
+      network_campaign_id: z5.string().optional().describe("The ad network's own campaign id (for Meta, the campaign ID in Ads Manager)."),
       idempotency_key: idempotencyKeySchema
     }
-  }, async ({ link_id, status, idempotency_key }) => toToolResult(await call(`/api/v1/links/${encodeURIComponent(link_id)}`, { method: "PATCH", idempotencyKey: idempotency_key, body: { status } })));
+  }, async ({ link_id, status, network_campaign_id, idempotency_key }) => {
+    const body = {};
+    if (status !== undefined)
+      body.status = status;
+    if (network_campaign_id !== undefined)
+      body.network_campaign_id = network_campaign_id;
+    return toToolResult(await call(`/api/v1/links/${encodeURIComponent(link_id)}`, { method: "PATCH", idempotencyKey: idempotency_key, body }));
+  });
   server.registerTool("get_spend", {
     annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
     title: "Get spend and cost models",
-    description: "Return imported ad spend, cost models, completeness and spend freshness.",
-    inputSchema: { app_id: appIdSchema }
-  }, async ({ app_id }) => toToolResult(await call("/api/v1/spend", {
-    query: { appId: app_id }
+    description: "Return imported ad spend, cost models, completeness and spend freshness. Without from, to or cursor every row comes back at once; with any of them the rows are paged, ordered by network, campaign, ad set, ad and day, and next_cursor is null on the last page.",
+    inputSchema: {
+      app_id: appIdSchema,
+      from: calendarDaySchema.optional().describe("First metric day to include (UTC, YYYY-MM-DD). May be sent without to."),
+      to: calendarDaySchema.optional().describe("Last metric day to include (UTC, YYYY-MM-DD). May be sent without from."),
+      cursor: cursorSchema,
+      limit: z5.number().int().min(1).max(5000).optional().describe("Rows per page, 1-5000 (1000 when omitted). Read only in paged mode; alone it changes nothing.")
+    }
+  }, async ({ app_id, from, to, cursor, limit }) => toToolResult(await call("/api/v1/spend", {
+    query: { appId: app_id, from, to, cursor, limit: limit === undefined ? undefined : String(limit) }
   })));
   server.registerTool("import_spend", {
     annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
@@ -14532,16 +15524,16 @@ function createServer(config, fetchImpl) {
     description: "Import campaign or creative-level spend rows.",
     inputSchema: {
       app_id: requiredAppIdSchema,
-      network: z4.enum(["meta", "google", "tiktok", "apple_ads"]),
-      source: z4.enum(["network_api", "csv", "manual"]).optional(),
-      account_ref: z4.string().optional(),
-      currency: z4.string().length(3),
-      report_timezone: z4.string().optional(),
-      covers_from: z4.string().regex(/^\d{4}-\d{2}-\d{2}$/),
-      covers_to: z4.string().regex(/^\d{4}-\d{2}-\d{2}$/),
-      completeness: z4.enum(["partial", "final"]).optional(),
-      notes: z4.string().optional(),
-      rows: z4.array(spendRowSchema).min(1).max(5000),
+      network: z5.enum(["meta", "google", "tiktok", "apple_ads"]),
+      source: z5.enum(["network_api", "csv", "manual"]).optional(),
+      account_ref: z5.string().optional(),
+      currency: z5.string().length(3),
+      report_timezone: z5.string().optional(),
+      covers_from: z5.string().regex(/^\d{4}-\d{2}-\d{2}$/),
+      covers_to: z5.string().regex(/^\d{4}-\d{2}-\d{2}$/),
+      completeness: z5.enum(["partial", "final"]).optional(),
+      notes: z5.string().optional(),
+      rows: z5.array(spendRowSchema).min(1).max(5000),
       idempotency_key: idempotencyKeySchema
     }
   }, async ({
@@ -14557,36 +15549,44 @@ function createServer(config, fetchImpl) {
     notes,
     rows,
     idempotency_key
-  }) => toToolResult(await call("/api/v1/spend", {
-    method: "POST",
-    idempotencyKey: idempotency_key,
-    body: {
+  }) => {
+    const body = {
       kind: "spend",
       appId: app_id,
       network,
-      ...source ? { source } : {},
-      ...account_ref ? { accountRef: account_ref } : {},
       currency,
-      ...report_timezone ? { reportTimezone: report_timezone } : {},
       coversFrom: covers_from,
       coversTo: covers_to,
-      ...completeness ? { completeness } : {},
-      ...notes ? { notes } : {},
       rows: rows.map(normalizeSpendRow)
-    }
-  })));
+    };
+    if (source)
+      body.source = source;
+    if (account_ref)
+      body.accountRef = account_ref;
+    if (report_timezone)
+      body.reportTimezone = report_timezone;
+    if (completeness)
+      body.completeness = completeness;
+    if (notes)
+      body.notes = notes;
+    return toToolResult(await call("/api/v1/spend", {
+      method: "POST",
+      idempotencyKey: idempotency_key,
+      body
+    }));
+  });
   server.registerTool("set_cost_model", {
     annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
     title: "Set an app cost model",
     description: "Version commission, payment fees and variable COGS used in profit decisions.",
     inputSchema: {
       app_id: requiredAppIdSchema,
-      effective_at: z4.string(),
-      store_commission_bps: z4.number().int().min(0).max(1e4),
-      payment_fee_bps: z4.number().int().min(0).max(1e4),
-      variable_cogs_kind: z4.enum(["bps", "per_unit_minor"]),
-      variable_cogs_value: z4.number().nonnegative(),
-      assumptions: z4.record(z4.string(), z4.unknown()).optional(),
+      effective_at: z5.string(),
+      store_commission_bps: z5.number().int().min(0).max(1e4),
+      payment_fee_bps: z5.number().int().min(0).max(1e4),
+      variable_cogs_kind: z5.enum(["bps", "per_unit_minor"]),
+      variable_cogs_value: z5.number().nonnegative(),
+      assumptions: z5.record(z5.string(), z5.unknown()).optional(),
       idempotency_key: idempotencyKeySchema
     }
   }, async ({
@@ -14598,43 +15598,52 @@ function createServer(config, fetchImpl) {
     variable_cogs_value,
     assumptions,
     idempotency_key
-  }) => toToolResult(await call("/api/v1/spend", {
-    method: "POST",
-    idempotencyKey: idempotency_key,
-    body: {
+  }) => {
+    const body = {
       kind: "cost_model",
       appId: app_id,
       effectiveAt: effective_at,
       storeCommissionBps: store_commission_bps,
       paymentFeeBps: payment_fee_bps,
-      variableCogs: { kind: variable_cogs_kind, value: variable_cogs_value },
-      ...assumptions ? { assumptions } : {}
+      variableCogs: { kind: variable_cogs_kind, value: variable_cogs_value }
+    };
+    if (assumptions) {
+      body.assumptions = assumptions;
     }
-  })));
+    return toToolResult(await call("/api/v1/spend", {
+      method: "POST",
+      idempotencyKey: idempotency_key,
+      body
+    }));
+  });
   server.registerTool("pull_network_spend", {
     annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
     title: "Pull spend from an ad network",
-    description: "Fetch and import creative-level spend from a configured Meta, Google or TikTok connection.",
+    description: "Fetch and import creative-level spend from a configured Meta, Google or TikTok connection. AttriKit already pulls every enabled connection every 6 hours, covering today and the 3 days before; call this for an immediate pull or a longer window. Report rows are kept only for campaigns whose network id AttriKit knows (create_campaign_link.network_campaign_id); if none match, the call fails and imports nothing. A network reports rows only for ads that have delivered, so the first useful pull is after the ads start spending.",
     inputSchema: {
       app_id: requiredAppIdSchema,
-      network: z4.enum(["meta", "google", "tiktok"]),
-      connection_id: z4.string().optional(),
-      covers_from: z4.string().regex(/^\d{4}-\d{2}-\d{2}$/),
-      covers_to: z4.string().regex(/^\d{4}-\d{2}-\d{2}$/),
+      network: z5.enum(["meta", "google", "tiktok"]),
+      connection_id: z5.string().optional(),
+      covers_from: z5.string().regex(/^\d{4}-\d{2}-\d{2}$/),
+      covers_to: z5.string().regex(/^\d{4}-\d{2}-\d{2}$/),
       idempotency_key: idempotencyKeySchema
     }
-  }, async ({ app_id, network, connection_id, covers_from, covers_to, idempotency_key }) => toToolResult(await call("/api/v1/spend", {
-    method: "POST",
-    idempotencyKey: idempotency_key,
-    body: {
+  }, async ({ app_id, network, connection_id, covers_from, covers_to, idempotency_key }) => {
+    const body = {
       kind: "network_pull",
       appId: app_id,
       network,
-      ...connection_id ? { connectionId: connection_id } : {},
       coversFrom: covers_from,
       coversTo: covers_to
-    }
-  })));
+    };
+    if (connection_id)
+      body.connectionId = connection_id;
+    return toToolResult(await call("/api/v1/spend", {
+      method: "POST",
+      idempotencyKey: idempotency_key,
+      body
+    }));
+  });
   server.registerTool("list_integrations", {
     annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
     title: "List ad-network integrations",
@@ -14644,13 +15653,13 @@ function createServer(config, fetchImpl) {
   server.registerTool("create_integration", {
     annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
     title: "Create an ad-network integration",
-    description: "Store encrypted network credentials and configure event ownership.",
+    description: "Store encrypted network credentials and choose, for each of the eight event families (install, session, trial, subscription, purchase, refund, paywall, business), which source's copy AttriKit forwards to the network. AttriKit always does the sending; the owner only picks the copy. attrkit = the events your app reports through the AttriKit SDK (the RevenueCat copy of that family is dropped). revenuecat = the events AttriKit received from your RevenueCat webhook (the SDK copy is dropped); RevenueCat itself sends nothing to the network. customer = events your own servers post to AttriKit. If your app reports subscriptions only through RevenueCat, set trial, subscription, purchase and refund to revenuecat, or none of them reach the network.",
     inputSchema: {
-      network: z4.enum(["meta", "google", "tiktok"]),
-      account_ref: z4.string().min(1),
-      credential: z4.string().min(1),
-      owners: ownersSchema.describe("Which destination owns each event family. Enabling a destination requires ALL eight families to be present, or the API rejects the call."),
-      enable: z4.boolean().optional(),
+      network: z5.enum(["meta", "google", "tiktok"]),
+      account_ref: z5.string().min(1),
+      credential: z5.string().min(1),
+      owners: ownersSchema.describe("For each event family, whose copy is forwarded: attrkit, revenuecat or customer (see the tool description). Enabling a destination requires ALL eight families to be present, or the API rejects the call."),
+      enable: z5.boolean().optional(),
       idempotency_key: idempotencyKeySchema
     }
   }, async ({ network, account_ref, credential, owners, enable, idempotency_key }) => toToolResult(await call("/api/v1/integrations", {
@@ -14663,48 +15672,57 @@ function createServer(config, fetchImpl) {
     title: "Update an ad-network integration",
     description: "Rotate credentials or enable/disable an integration.",
     inputSchema: {
-      connection_id: z4.string(),
-      action: z4.enum(["rotate", "disable", "enable"]),
-      credential: z4.string().optional(),
+      connection_id: z5.string(),
+      action: z5.enum(["rotate", "disable", "enable"]),
+      credential: z5.string().optional(),
       owners: ownersSchema.optional(),
       idempotency_key: idempotencyKeySchema
     }
-  }, async ({ connection_id, action, credential, owners, idempotency_key }) => toToolResult(await call(`/api/v1/integrations/${encodeURIComponent(connection_id)}`, {
-    method: "PATCH",
-    idempotencyKey: idempotency_key,
-    body: {
-      action,
-      ...credential ? { credential } : {},
-      ...owners ? { owners } : {}
-    }
-  })));
+  }, async ({ connection_id, action, credential, owners, idempotency_key }) => {
+    const body = { action };
+    if (credential !== undefined)
+      body.credential = credential;
+    if (owners)
+      body.owners = owners;
+    return toToolResult(await call(`/api/v1/integrations/${encodeOpaquePathSegment(connection_id)}`, {
+      method: "PATCH",
+      idempotencyKey: idempotency_key,
+      body
+    }));
+  });
   server.registerTool("delete_integration", {
     annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true },
     title: "Delete an ad-network integration",
     description: "Delete a disabled integration. Enabled integrations must be disabled first.",
-    inputSchema: { connection_id: z4.string() }
-  }, async ({ connection_id }) => toToolResult(await call(`/api/v1/integrations/${encodeURIComponent(connection_id)}`, { method: "DELETE" })));
+    inputSchema: { connection_id: z5.string() }
+  }, async ({ connection_id }) => toToolResult(await call(`/api/v1/integrations/${encodeOpaquePathSegment(connection_id)}`, { method: "DELETE" })));
   server.registerTool("get_revenuecat", {
     annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
     title: "Get RevenueCat configuration",
-    description: "Return redacted RevenueCat status and the AttrKit webhook URL.",
+    description: "Return redacted RevenueCat status and the AttriKit webhook URL.",
     inputSchema: { app_id: requiredAppIdSchema }
-  }, async ({ app_id }) => toToolResult(await call(`/api/v1/apps/${encodeURIComponent(app_id)}/revenuecat`)));
+  }, async ({ app_id }) => toToolResult(await call(`/api/v1/apps/${encodeOpaquePathSegment(app_id)}/revenuecat`)));
   server.registerTool("configure_revenuecat", {
-    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+    annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true },
     title: "Configure RevenueCat",
-    description: "Store the RevenueCat provider app id and encrypted authorization secret for an app.",
+    description: "Store the RevenueCat provider app id and encrypted authorization secret for an app, and optionally the webhook signing secret (omitted, the stored one is kept).",
     inputSchema: {
       app_id: requiredAppIdSchema,
       provider_app_id: revenueCatProviderAppIdSchema.describe("RevenueCat's PROJECT app id from their dashboard app settings, not the SDK key."),
-      authorization_secret: z4.string().min(16).max(1024),
+      authorization_secret: z5.string().min(16).max(1024),
+      signing_secret: z5.string().trim().min(16).max(1024).optional().describe("RevenueCat's HMAC signing secret, for the X-RevenueCat-Webhook-Signature header. Optional: omitted, the stored one is kept."),
       idempotency_key: idempotencyKeySchema
     }
-  }, async ({ app_id, provider_app_id, authorization_secret, idempotency_key }) => toToolResult(await call(`/api/v1/apps/${encodeURIComponent(app_id)}/revenuecat`, {
-    method: "PUT",
-    idempotencyKey: idempotency_key,
-    body: { provider_app_id, authorization_secret }
-  })));
+  }, async ({ app_id, provider_app_id, authorization_secret, signing_secret, idempotency_key }) => {
+    const body = { provider_app_id, authorization_secret };
+    if (signing_secret !== undefined)
+      body.signing_secret = signing_secret;
+    return toToolResult(await call(`/api/v1/apps/${encodeOpaquePathSegment(app_id)}/revenuecat`, {
+      method: "PUT",
+      idempotencyKey: idempotency_key,
+      body
+    }));
+  });
   server.registerTool("list_webhooks", {
     annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
     title: "List outbound webhooks",
@@ -14716,41 +15734,98 @@ function createServer(config, fetchImpl) {
     title: "Create an outbound webhook",
     description: "Create an SSRF-checked webhook subscription. Returns the signing secret once.",
     inputSchema: {
-      url: z4.string().url(),
-      event_types: z4.array(z4.enum(["install", "event", "decision", "fraud"])).min(1).max(4),
-      description: z4.string().max(500).optional(),
-      app_id: z4.string().uuid().optional(),
+      url: z5.string().url(),
+      event_types: z5.array(z5.enum(["install", "event", "decision", "fraud"])).min(1).max(4),
+      description: z5.string().max(500).optional(),
+      app_id: z5.string().uuid().optional(),
       idempotency_key: idempotencyKeySchema
     }
-  }, async ({ url, event_types, description, app_id, idempotency_key }) => toToolResult(await call("/api/v1/webhooks", {
-    method: "POST",
-    idempotencyKey: idempotency_key,
-    body: {
-      url,
-      event_types,
-      ...description ? { description } : {},
-      ...app_id ? { app_id } : {}
-    }
-  })));
+  }, async ({ url, event_types, description, app_id, idempotency_key }) => {
+    const body = { url, event_types };
+    if (description)
+      body.description = description;
+    if (app_id)
+      body.app_id = app_id;
+    return toToolResult(await call("/api/v1/webhooks", {
+      method: "POST",
+      idempotencyKey: idempotency_key,
+      body
+    }));
+  });
   server.registerTool("delete_webhook", {
     annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true },
     title: "Delete an outbound webhook",
     description: "Delete a webhook subscription.",
-    inputSchema: { subscription_id: z4.string().uuid() }
+    inputSchema: { subscription_id: z5.string().uuid() }
   }, async ({ subscription_id }) => toToolResult(await call(`/api/v1/webhooks/${encodeURIComponent(subscription_id)}`, { method: "DELETE" })));
   server.registerTool("export_events", {
     annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
     title: "Export events and installs",
-    description: "Export one app's events and installs as CSV for an inclusive date range.",
+    description: "Export one app's events and installs for an inclusive date range. By default (version 1) the answer is the seven-column CSV, event rows capped at the 100,000 most recent INSIDE the range; narrow the range until it is safely below that cap when a complete snapshot is required. Pass version 2 for the wide record export (campaign, ad, evidence and revenue columns), oldest first, as csv or ndjson and paged: each page holds up to `limit` records (10,000 by default), and when another page follows the result carries next_cursor, which you send back as `cursor` with the same app_id, from and to. No next_cursor means the last page.",
     inputSchema: {
       app_id: requiredAppIdSchema,
-      from: z4.string().describe("ISO date or timestamp"),
-      to: z4.string().describe("ISO date or timestamp")
+      from: z5.string().describe("ISO date or timestamp"),
+      to: z5.string().describe("ISO date or timestamp"),
+      version: z5.number().int().min(1).max(2).optional().describe("Export version, 1 or 2. Omit for version 1, the original CSV, unchanged. format, limit and cursor need version 2."),
+      format: z5.enum(["csv", "ndjson"]).optional().describe("Version 2 only: csv (the default) or ndjson, one JSON record per line."),
+      limit: z5.number().int().min(1).max(1e4).optional().describe("Version 2 only: records per page, 1-10,000 (10,000 when omitted)."),
+      cursor: z5.string().optional().describe("Version 2 only: the next_cursor of the previous page. Omit for the first page.")
     }
-  }, async ({ app_id, from, to }) => toToolResult(await call("/api/v1/export", {
-    query: { appId: app_id, from, to },
-    expectedResponse: "text"
-  })));
+  }, async ({ app_id, from, to, version, format, limit, cursor }) => {
+    if (version !== 2 && (format !== undefined || limit !== undefined || cursor !== undefined)) {
+      return toToolResult(invalidResult("invalid_request", "format, limit and cursor apply to version 2 only; pass version: 2."));
+    }
+    return toToolResult(await call("/api/v1/export", {
+      query: {
+        appId: app_id,
+        from,
+        to,
+        version: version === undefined ? undefined : String(version),
+        format,
+        limit: limit === undefined ? undefined : String(limit),
+        cursor
+      },
+      expectedResponse: format === "ndjson" ? "ndjson" : "text"
+    }));
+  });
+  server.registerTool("send_server_event", {
+    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+    title: "Report an event from your backend",
+    description: "Report an event for one of your users from your own backend, by the customer_user_id your app passed to AttriKit.setUserID; no device installation id is needed. The event is attached to the install that id resolves to and reaches the destinations whose sender for its family is Your servers. Requires a write-scoped API key. Answers status accepted, duplicate (this event_id was already stored) or suppressed (consent.measurement is not granted, so nothing was collected), with the install_epoch_id it resolved to. 404 customer_user_not_found means no install identified with this id.",
+    inputSchema: {
+      app_id: requiredAppIdSchema,
+      customer_user_id: z5.string().min(1).max(256).describe("The opaque id your app passed to AttriKit.setUserID. Refused when it looks like an email address or phone number. Hashed on arrival, never stored."),
+      event_id: z5.string().uuid().describe("Your id for this event. A second event with the same id is a duplicate and is not written again."),
+      event_name: z5.string().min(1).max(128).regex(/^[a-z][a-z0-9_.-]*$/).describe("Canonical event name, for example purchase or subscription_started."),
+      event_version: z5.number().int().positive(),
+      occurred_at: z5.string().datetime({ offset: true }).describe("When the event happened, ISO 8601 with a UTC offset."),
+      consent: z5.object({
+        measurement: z5.enum(["granted", "denied", "unknown"]),
+        tracking: z5.enum(["granted", "denied", "unknown"]),
+        policy_version: z5.number().int().positive()
+      }).describe("The per-event consent SDK events carry. An event whose measurement is not granted is not collected."),
+      properties: z5.record(z5.string(), z5.union([z5.string().max(1024), z5.number(), z5.boolean(), z5.null()])).optional().describe("Scalar values only, at most 64 keys. Revenue is value (major units) or price_minor_units with currency, an ISO 4217 code."),
+      idempotency_key: idempotencyKeySchema
+    }
+  }, async ({ app_id, customer_user_id, event_id, event_name, event_version, occurred_at, consent, properties, idempotency_key }) => {
+    const body = { customer_user_id, event_id, event_name, event_version, occurred_at, consent };
+    if (properties !== undefined)
+      body.properties = properties;
+    return toToolResult(await call(`/api/v1/apps/${encodeOpaquePathSegment(app_id)}/events`, {
+      method: "POST",
+      idempotencyKey: idempotency_key,
+      body
+    }));
+  });
+  server.registerTool("lookup_customer_attribution", {
+    annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+    title: "Look up a user's attribution",
+    description: "Look up the attribution of one of your users by the customer_user_id your app passed to AttriKit.setUserID: the campaign, ad set, ad, network, match confidence and attribution_status (attributed, device_matched, organic, pending or consent_required) of the user's newest install. 404 customer_user_not_found means no install identified with this id. Read scope is enough.",
+    inputSchema: {
+      app_id: requiredAppIdSchema,
+      customer_user_id: z5.string().min(1).max(256).describe("The opaque id your app passed to AttriKit.setUserID. Refused when it looks like an email address or phone number.")
+    }
+  }, async ({ app_id, customer_user_id }) => toToolResult(await call(`/api/v1/apps/${encodeOpaquePathSegment(app_id)}/attribution/lookup`, { method: "POST", body: { customer_user_id }, readsOnly: true })));
   return server;
 }
 
@@ -14761,8 +15836,7 @@ async function main() {
     config = readConfig();
   } catch (error) {
     process.stderr.write(`${error instanceof Error ? error.message : String(error)}
-`);
-    process.exit(1);
+`, () => process.exit(1));
     return;
   }
   const server = createServer(config);
@@ -14773,6 +15847,5 @@ async function main() {
 }
 main().catch((error) => {
   process.stderr.write(`attrkit-mcp failed to start: ${error instanceof Error ? error.stack ?? error.message : String(error)}
-`);
-  process.exit(1);
+`, () => process.exit(1));
 });