@clipform/mcp-server 2.4.0 → 2.5.1

package/dist/{chunk-NMIUCFJT.js → chunk-3GBZFAEM.js}

@@ -6,7 +6,7 @@ import {
   getWorkflowText,
   objectType,
   registerPrompts
-} from "./chunk-4G4MF3ME.js";
+} from "./chunk-NYMC63ZK.js";
 import {
   GUIDE_TYPES,
   QUIZ_VARIANTS,
@@ -14,30 +14,32 @@ import {
   getGuideUri,
   guideFallbackText,
   registerResources
-} from "./chunk-IDOG3ZTF.js";
+} from "./chunk-6EHOUAPE.js";
 import {
   ACTIVE_NODE_TYPES,
-  BUSINESS,
   CONTACT_FIELDS,
   FORM_TYPE_ALIASES,
   KEN_BURNS_EFFECTS,
   KEN_BURNS_FIT_MODES,
   KEN_BURNS_PRESETS,
   MCP_TOOL_TIERS,
+  MCP_TOOL_TOOLSETS,
   NODE_TYPES,
   NON_COUNTABLE_TYPES,
   SLIDESHOW_TRANSITIONS,
+  bfsOrder,
   callApi,
+  defaultTarget,
   errorResult,
   exposedCompositionIds,
   resolveFormType,
   structuredResult,
   textResult
-} from "./chunk-5LV55T7F.js";
+} from "./chunk-3BYQLPTT.js";
 import {
   getMcpAuth,
   runWithMcpTool
-} from "./chunk-V4L5RQWK.js";
+} from "./chunk-ENHVQDSI.js";
 import {
   __commonJS,
   __export,
@@ -10749,7 +10751,7 @@ function object(shape, params) {
   return new ZodMiniObject(def);
 }
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.29.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-compat.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-compat.js
 function isZ4Schema(s) {
   const schema = s;
   return !!schema._zod;
@@ -10833,17 +10835,33 @@ function normalizeObjectSchema(schema) {
   }
   return void 0;
 }
+function getDotPath(path) {
+  if (path.length === 0) {
+    return "object root";
+  }
+  return path.reduce((acc, seg, index) => {
+    if (index === 0) {
+      return String(seg);
+    }
+    if (typeof seg === "number") {
+      return `${acc}[${seg}]`;
+    }
+    return `${acc}.${seg}`;
+  }, "");
+}
 function getParseErrorMessage(error2) {
   if (error2 && typeof error2 === "object") {
+    if ("issues" in error2 && Array.isArray(error2.issues) && error2.issues.length > 0) {
+      return error2.issues.map((i) => {
+        if (!i.path?.length) {
+          return i.message;
+        }
+        return `${i.message} at ${getDotPath(i.path)}`;
+      }).join("\n");
+    }
     if ("message" in error2 && typeof error2.message === "string") {
       return error2.message;
     }
-    if ("issues" in error2 && Array.isArray(error2.issues) && error2.issues.length > 0) {
-      const firstIssue = error2.issues[0];
-      if (firstIssue && typeof firstIssue === "object" && "message" in firstIssue) {
-        return String(firstIssue.message);
-      }
-    }
     try {
       return JSON.stringify(error2);
     } catch {
@@ -11588,7 +11606,7 @@ function preprocess(fn, schema) {
 // ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v4/classic/external.js
 config(en_default());
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.29.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/types.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/types.js
 var LATEST_PROTOCOL_VERSION = "2025-11-25";
 var SUPPORTED_PROTOCOL_VERSIONS = [LATEST_PROTOCOL_VERSION, "2025-06-18", "2025-03-26", "2024-11-05", "2024-10-07"];
 var RELATED_TASK_META_KEY = "io.modelcontextprotocol/related-task";
@@ -13119,7 +13137,7 @@ var UrlElicitationRequiredError = class extends McpError {
   }
 };
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.29.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/interfaces.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/interfaces.js
 function isTerminal(status) {
   return status === "completed" || status === "failed" || status === "cancelled";
 }
@@ -14408,7 +14426,7 @@ var zodToJsonSchema = (schema, options) => {
   return combined;
 };
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.29.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-json-schema-compat.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-json-schema-compat.js
 function mapMiniTarget(t) {
   if (!t)
     return "draft-7";
@@ -14450,7 +14468,7 @@ function parseWithCompat(schema, data) {
   return result.data;
 }
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.29.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/protocol.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/protocol.js
 var DEFAULT_REQUEST_TIMEOUT_MSEC = 6e4;
 var Protocol = class {
   constructor(_options) {
@@ -15404,7 +15422,7 @@ function mergeCapabilities(base, additional) {
   return result;
 }
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.29.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/validation/ajv-provider.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/validation/ajv-provider.js
 var import_ajv = __toESM(require_ajv(), 1);
 var import_ajv_formats = __toESM(require_dist(), 1);
 function createDefaultAjvInstance() {
@@ -15472,7 +15490,7 @@ var AjvJsonSchemaValidator = class {
   }
 };
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.29.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/server.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/server.js
 var ExperimentalServerTasks = class {
   constructor(_server) {
     this._server = _server;
@@ -15685,7 +15703,7 @@ var ExperimentalServerTasks = class {
   }
 };
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.29.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/helpers.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/helpers.js
 function assertToolsCallTaskCapability(requests, method, entityName) {
   if (!requests) {
     throw new Error(`${entityName} does not support task creation (required for ${method})`);
@@ -15720,7 +15738,7 @@ function assertClientRequestTaskCapability(requests, method, entityName) {
   }
 }
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.29.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js
 var Server = class extends Protocol {
   /**
    * Initializes this server with the given name and version information.
@@ -15786,16 +15804,7 @@ var Server = class extends Protocol {
     if (!methodSchema) {
       throw new Error("Schema is missing a method literal");
     }
-    let methodValue;
-    if (isZ4Schema(methodSchema)) {
-      const v4Schema = methodSchema;
-      const v4Def = v4Schema._zod?.def;
-      methodValue = v4Def?.value ?? v4Schema.value;
-    } else {
-      const v3Schema = methodSchema;
-      const legacyDef = v3Schema._def;
-      methodValue = legacyDef?.value ?? v3Schema.value;
-    }
+    const methodValue = getLiteralValue(methodSchema);
     if (typeof methodValue !== "string") {
       throw new Error("Schema method literal must be a string");
     }
@@ -16100,7 +16109,7 @@ var Server = class extends Protocol {
   }
 };
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.29.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/server/completable.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/server/completable.js
 var COMPLETABLE_SYMBOL = /* @__PURE__ */ Symbol.for("mcp.completable");
 function isCompletable(schema) {
   return !!schema && typeof schema === "object" && COMPLETABLE_SYMBOL in schema;
@@ -16114,7 +16123,7 @@ var McpZodTypeKind;
   McpZodTypeKind2["Completable"] = "McpCompletable";
 })(McpZodTypeKind || (McpZodTypeKind = {}));
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.29.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/toolNameValidation.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/toolNameValidation.js
 var TOOL_NAME_REGEX = /^[A-Za-z0-9._-]{1,128}$/;
 function validateToolName(name) {
   const warnings = [];
@@ -16172,7 +16181,7 @@ function validateAndWarnToolName(name) {
   return result.isValid;
 }
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.29.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/mcp-server.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/mcp-server.js
 var ExperimentalMcpServerTasks = class {
   constructor(_mcpServer) {
     this._mcpServer = _mcpServer;
@@ -16187,7 +16196,7 @@ var ExperimentalMcpServerTasks = class {
   }
 };
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.29.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js
 var McpServer = class {
   constructor(serverInfo, options) {
     this._registeredResources = {};
@@ -17158,7 +17167,11 @@ Example: A form that asks a question, collects contact info, then finishes:
       },
       outputSchema: {
         form_id: external_exports.string().describe("Form UUID - pass to follow-up tools"),
-        viewer_url: external_exports.string().describe("Live form URL for respondents"),
+        // #3330: an anonymous session's viewer_url is a scoped preview link
+        // (only the caller can open it) until the account is claimed and the
+        // form is published - only an authenticated/claimed workspace's
+        // create returns a genuinely live URL here.
+        viewer_url: external_exports.string().describe("Form URL for respondents - a live public URL once authenticated/published, or a scoped preview-only link for an anonymous session"),
         dashboard_url: external_exports.string().optional().describe("Builder URL (sign in to edit)"),
         nodes: external_exports.array(external_exports.object({ id: external_exports.string(), type: external_exports.string(), prompt: external_exports.string() })).describe("Created nodes in order - IDs for attach_node_media / update_node"),
         plan: external_exports.object({ name: external_exports.string(), auth_mode: external_exports.string() }).optional().describe("Plan and auth context for this session")
@@ -17167,7 +17180,11 @@ Example: A form that asks a question, collects contact info, then finishes:
         readOnlyHint: false,
         destructiveHint: false,
         idempotentHint: false,
-        openWorldHint: false
+        // The form is live at a public (unguessable-share-link) URL from
+        // creation - OpenAI's openWorldHint rubric reads "publishing
+        // content" as true regardless of link guessability (#2976 research
+        // pass 2).
+        openWorldHint: true
       },
       _meta: { "anthropic/alwaysLoad": true }
     },
@@ -17195,8 +17212,7 @@ Example: A form that asks a question, collects contact info, then finishes:
       };
       const contentCount = nodes.filter((q) => !NON_COUNTABLE_TYPES.includes(q.type)).length;
       if (planContext.node_limit !== null && contentCount > planContext.node_limit) {
-        const upgradeUrl = `${BUSINESS.urls.dashboard}/billing`;
-        const message = planContext.is_authenticated ? `Your '${planContext.workspace_name}' workspace is on the ${planContext.plan_name} plan, capped at ${planContext.node_limit} nodes per form. You asked for ${contentCount}. Either rerun with ${planContext.node_limit} nodes or upgrade at ${upgradeUrl}.` : `Anonymous sessions are capped at ${planContext.node_limit} nodes per form (${planContext.plan_name} plan). You asked for ${contentCount}. Either rerun with ${planContext.node_limit} nodes, or sign in to your Clipform account so forms land in your workspace with your real plan limits.`;
+        const message = planContext.is_authenticated ? `Your '${planContext.workspace_name}' workspace is on the ${planContext.plan_name} plan, capped at ${planContext.node_limit} nodes per form. You asked for ${contentCount}. Rerun with ${planContext.node_limit} nodes or fewer.` : `Anonymous sessions are capped at ${planContext.node_limit} nodes per form (${planContext.plan_name} plan). You asked for ${contentCount}. Either rerun with ${planContext.node_limit} nodes, or sign in to your Clipform account so forms land in your workspace with your real plan limits.`;
         return errorResult(message);
       }
       if (planContext.form_limit !== null) {
@@ -17204,10 +17220,8 @@ Example: A form that asks a question, collects contact info, then finishes:
         if (formsResult.ok) {
           const forms = formsResult.data.forms ?? [];
           if (forms.length >= planContext.form_limit) {
-            const upgradeUrl = `${BUSINESS.urls.dashboard}/billing`;
             const formList = forms.map((f, i) => `  ${i + 1}. "${f.title || "Untitled"}" (id: ${f.id})`).join("\n");
-            const options = planContext.is_authenticated ? `  - Upgrade for unlimited forms: ${upgradeUrl}
-  - Or delete one of the forms below to free a slot.` : `  - Delete one of the forms below to free a slot.
+            const options = planContext.is_authenticated ? `  - Delete one of the forms below to free a slot.` : `  - Delete one of the forms below to free a slot.
   - Or sign in to a Clipform account to keep these forms and get higher limits.`;
             return errorResult(
               [
@@ -17219,7 +17233,7 @@ Example: A form that asks a question, collects contact info, then finishes:
                 `Current forms:`,
                 formList,
                 ``,
-                `Share this list with the user, explain they've hit the ${planContext.form_limit}-form limit, and let them choose: upgrade, or pick a form to delete. clipform_delete_form asks the user to confirm before removing anything.`
+                `Share this list with the user, explain they've hit the ${planContext.form_limit}-form limit, and let them pick a form to delete. clipform_delete_form asks the user to confirm before removing anything.`
               ].join("\n")
             );
           }
@@ -17249,6 +17263,7 @@ Example: A form that asks a question, collects contact info, then finishes:
       const formId = data.form_id;
       const formUrl = data.form_url ?? void 0;
       const createdNodes = data.nodes ?? [];
+      const isPreview = String(data.viewer_url ?? "").includes("mode=preview");
       if (font_family !== void 0) {
         await callApi(`/forms/${formId}`, {
           method: "PATCH",
@@ -17263,7 +17278,7 @@ Example: A form that asks a question, collects contact info, then finishes:
       }
       const truncate = (s, n = 60) => s.length > n ? `${s.slice(0, n - 1)}\u2026` : s;
       const lines = [
-        `Form created and live.`,
+        isPreview ? `Form created as a preview draft.` : `Form created and live.`,
         ``,
         `Title: ${title}`,
         `Form ID: ${formId}`,
@@ -17271,15 +17286,19 @@ Example: A form that asks a question, collects contact info, then finishes:
         `Node IDs (use directly with attach_node_media / update_node - no get_form round-trip needed):`,
         ...createdNodes.map((n) => `- [${n.type}] "${truncate(n.prompt)}": ${n.id}`),
         ``,
-        `FORM URL (live - share this with respondents): ${data.viewer_url}`
+        isPreview ? `PREVIEW URL (draft - only you can open this, not yet visible to respondents): ${data.viewer_url}` : `FORM URL (live - share this with respondents): ${data.viewer_url}`
       ];
       if (formUrl) {
-        lines.push(`DASHBOARD URL (sign in to edit and manage): ${formUrl}`);
+        lines.push(
+          isPreview ? `CLAIM URL (one-time - claim this account to publish): ${formUrl}` : `DASHBOARD URL (sign in to edit and manage): ${formUrl}`
+        );
       }
+      const firstUrlLabel = isPreview ? "PREVIEW" : "FORM";
+      const secondUrlLabel = isPreview ? "CLAIM" : "DASHBOARD";
       lines.push(
         ``,
-        `The form is live and accessible at the FORM URL above. Continue with media/narration steps if needed - changes appear immediately.`,
-        `The URLs above are exact values; constructed or guessed URLs return 404. Use the FORM URL and DASHBOARD URL as shown.`,
+        isPreview ? `This form is a preview - claim and publish to start collecting responses.${formUrl ? " Open the CLAIM URL to sign into the account this form already belongs to, then republish" : " Sign in to the account this form already belongs to and republish"} with clipform_update_form (is_live: true). The PREVIEW URL never becomes public on its own.` : `The form is live and accessible at the FORM URL above. Edits and media attached AFTER this point are NOT visible to respondents until you re-send is_live: true via clipform_update_form - republishing is the expected final step of a build, never skip it after attaching media/narration.`,
+        formUrl ? `The URLs above are exact values; constructed or guessed URLs return 404. Use the ${firstUrlLabel} URL and ${secondUrlLabel} URL as shown.` : `The ${firstUrlLabel} URL above is an exact value; constructed or guessed URLs return 404.`,
         `Pass form_id on follow-up tools (get_form, add_node, attach_node_media, etc.).`
       );
       if (planContext) {
@@ -17322,7 +17341,7 @@ function registerListFormsTool(server) {
     "clipform_list_forms",
     {
       title: "List Clipforms",
-      description: `List forms in your workspace with optional filtering. Returns paginated results (cursor-based). next_cursor is included when more results exist.`,
+      description: `List forms in your workspace with optional filtering. Returns paginated results (cursor-based). next_cursor is included when more results exist. To find or open a form by name, pass search with part of its title instead of paging through results.`,
       inputSchema: {
         limit: external_exports.number().int().min(1).max(100).optional().describe("Number of forms to return (default 25, max 100)"),
         cursor: external_exports.string().optional().describe(
@@ -17332,7 +17351,9 @@ function registerListFormsTool(server) {
           "Filter by tag name(s), comma-separated. AND logic: only forms with ALL tags are returned."
         ),
         published: external_exports.enum(["true", "false"]).optional().describe("Filter by publish status"),
-        search: external_exports.string().optional().describe("Search forms by title (case-insensitive substring match)"),
+        search: external_exports.string().optional().describe(
+          "Filter to forms whose title contains this text (case-insensitive substring). Use this to resolve a form by name in one call instead of paginating."
+        ),
         sort: external_exports.enum(["created_at", "updated_at"]).optional().describe("Sort field (default: created_at)"),
         order: external_exports.enum(["asc", "desc"]).optional().describe("Sort order (default: desc, newest first)")
       },
@@ -17344,8 +17365,6 @@ function registerListFormsTool(server) {
             share_id: external_exports.string(),
             is_live: external_exports.boolean(),
             has_unpublished_changes: external_exports.boolean(),
-            created_at: external_exports.string(),
-            updated_at: external_exports.string(),
             tags: external_exports.array(external_exports.object({ id: external_exports.string(), name: external_exports.string(), color: external_exports.string().nullable() }))
           })
         ).describe("Matching forms (empty if none)"),
@@ -17379,8 +17398,6 @@ function registerListFormsTool(server) {
           share_id: f.share_id,
           is_live: f.is_live,
           has_unpublished_changes: f.has_unpublished_changes,
-          created_at: f.created_at,
-          updated_at: f.updated_at,
           tags: f.tags.map((t) => ({ id: t.id, name: t.name, color: t.color }))
         })),
         next_cursor: data.next_cursor
@@ -17406,30 +17423,78 @@ function registerListFormsTool(server) {
 }
 
 // src/lib/format-form.ts
+function allowedConfigKeys(nodeType) {
+  const schema = NODE_TYPES[nodeType]?.config_schema;
+  const properties = schema?.properties;
+  if (properties) return new Set(Object.keys(properties));
+  const oneOf = schema?.oneOf;
+  if (Array.isArray(oneOf)) {
+    const keys = /* @__PURE__ */ new Set();
+    for (const branch of oneOf) {
+      for (const k of Object.keys(branch?.properties ?? {})) keys.add(k);
+    }
+    return keys;
+  }
+  return /* @__PURE__ */ new Set();
+}
+function projectConfig(nodeType, config2) {
+  if (!config2) return void 0;
+  const allowed = allowedConfigKeys(nodeType);
+  const projected = {};
+  for (const [key, value] of Object.entries(config2)) {
+    if (allowed.has(key)) projected[key] = value;
+  }
+  return projected;
+}
 function getFormNodes(data) {
   return data.node ?? data.nodes ?? [];
 }
+function buildLogicByNode(nodes) {
+  const logicByNode = /* @__PURE__ */ new Map();
+  for (const node of nodes) {
+    if (node.node_logic && node.node_logic.length > 0) {
+      logicByNode.set(
+        node.id,
+        node.node_logic.flatMap((entry) => entry.actions ?? [])
+      );
+    }
+  }
+  return logicByNode;
+}
+function orderNodesWithLogic(data) {
+  const rawNodes = getFormNodes(data);
+  const logicByNode = buildLogicByNode(rawNodes);
+  return { nodes: bfsOrder(rawNodes, logicByNode), logicByNode };
+}
+function projectNext(node, logicByNode) {
+  const target = defaultTarget(logicByNode.get(node.id));
+  return target ? { target_id: target.value, target_type: target.type } : void 0;
+}
 function projectFormState(data) {
+  const { nodes, logicByNode } = orderNodesWithLogic(data);
   return {
     form_id: String(data.form_id ?? ""),
     title: String(data.title ?? ""),
     is_live: Boolean(data.is_live),
     has_unpublished_changes: Boolean(data.has_unpublished_changes),
-    nodes: getFormNodes(data).map((q) => {
+    nodes: nodes.map((q) => {
       const options = q.node_options ?? q.options;
+      const config2 = projectConfig(q.type, q.config);
+      const next = projectNext(q, logicByNode);
       return {
         id: q.id,
         type: q.type,
         prompt: q.prompt ?? "",
         required: Boolean(q.required),
-        ...q.config && Object.keys(q.config).length > 0 ? { config: q.config } : {},
-        ...options && options.length > 0 ? { options: options.map((o) => ({ id: o.id, content: o.content })) } : {}
+        ...config2 && Object.keys(config2).length > 0 ? { config: config2 } : {},
+        ...options && options.length > 0 ? { options: options.map((o) => ({ id: o.id, content: o.content })) } : {},
+        ...next ? { next } : {}
       };
     })
   };
 }
 function formatFormState(data) {
-  const nodes = getFormNodes(data);
+  const { nodes, logicByNode } = orderNodesWithLogic(data);
   const lines = [
     `Form: ${data.title}`,
     `Form ID: ${data.form_id}`,
@@ -17446,8 +17511,9 @@ function formatFormState(data) {
     lines.push(`  ${i + 1}. [${q.type}] ${q.prompt || "(no prompt)"}`);
     lines.push(`     Node ID: ${q.id}`);
     if (q.required) lines.push(`     Required: yes`);
-    if (q.config && Object.keys(q.config).length > 0) {
-      lines.push(`     Config: ${JSON.stringify(q.config)}`);
+    const config2 = projectConfig(q.type, q.config);
+    if (config2 && Object.keys(config2).length > 0) {
+      lines.push(`     Config: ${JSON.stringify(config2)}`);
     }
     const options = q.node_options ?? q.options;
     if (options && options.length > 0) {
@@ -17455,6 +17521,10 @@ function formatFormState(data) {
         `     Options: ${options.map((o) => o.content).join(", ")}`
       );
     }
+    const next = projectNext(q, logicByNode);
+    if (next) {
+      lines.push(`     -> next: ${next.target_id} (${next.target_type})`);
+    }
   }
   return lines.join("\n");
 }
@@ -17465,7 +17535,7 @@ function registerGetFormTool(server) {
     "clipform_get_form",
     {
       title: "Get Clipform",
-      description: `Retrieve a form's details including all nodes in sequential order. Returns title, settings, and every node with its options, config, and media status.`,
+      description: `Retrieve a form's details including all nodes in sequential order and their routing. Returns title, settings, and every node with its options, config, media status, and next node (from clipform_set_logic).`,
       inputSchema: {
         form_id: external_exports.string().uuid().describe("The form UUID (returned by clipform_create_form, not the short share_id from the URL)")
       },
@@ -17481,7 +17551,11 @@ function registerGetFormTool(server) {
             prompt: external_exports.string(),
             required: external_exports.boolean(),
             config: external_exports.record(external_exports.unknown()).optional(),
-            options: external_exports.array(external_exports.object({ id: external_exports.string(), content: external_exports.string() })).optional()
+            options: external_exports.array(external_exports.object({ id: external_exports.string(), content: external_exports.string() })).optional(),
+            next: external_exports.object({
+              target_id: external_exports.string().describe("The node/screen ID this node routes to"),
+              target_type: external_exports.enum(["node", "end_screen", "redirect", "link_list"]).describe("What kind of target target_id is")
+            }).optional().describe("This node's outgoing edge, set via clipform_set_logic. Omitted for a chain tail or terminal node.")
           })
         ).describe("Nodes in sequential order - IDs for update_node / attach_node_media")
       },
@@ -17493,7 +17567,7 @@ function registerGetFormTool(server) {
       }
     },
     async ({ form_id }) => {
-      const result = await callApi(`/forms/${form_id}`);
+      const result = await callApi(`/forms/${form_id}?include=logic`);
       if (!result.ok) {
         return errorResult(result.error);
       }
@@ -17526,11 +17600,20 @@ function registerUpdateFormTool(server) {
         brand_name: external_exports.string().nullable().optional().describe("AI-PROTECTED: Custom brand name shown in footer. Only set when user explicitly provides."),
         tags: external_exports.array(external_exports.string()).optional().describe("Replace all tags on this form. Pass the full desired set (e.g. ['quiz', 'trivia', 'slug:elephants']). Omit to leave tags unchanged.")
       },
+      outputSchema: {
+        form_id: external_exports.string().describe("Form UUID"),
+        updated_fields: external_exports.array(external_exports.string()).describe("Names of the fields that were changed by this call")
+      },
       annotations: {
         readOnlyHint: false,
-        destructiveHint: false,
+        // is_live: true/false publishes, republishes, or unpublishes the
+        // live form, and other fields (title, theme, logo) overwrite what
+        // respondents already see (#2976 research pass 2).
+        destructiveHint: true,
         idempotentHint: true,
-        openWorldHint: false
+        // is_live: true makes the form live at a public URL - openWorldHint
+        // per OpenAI's "publishing content" reading (#2976 research pass 2).
+        openWorldHint: true
       }
     },
     async ({ form_id, title, is_live, show_step_counter, disable_back_navigation, total_steps, primary_color, background_color, font_family, description, author, logo_url, show_branding, brand_name, tags }) => {
@@ -17567,34 +17650,64 @@ function registerUpdateFormTool(server) {
         }
       }
       const updates = [];
-      if (title !== void 0) updates.push(`Title \u2192 "${title}"`);
-      if (is_live !== void 0)
+      const updatedFields = [];
+      if (title !== void 0) {
+        updates.push(`Title \u2192 "${title}"`);
+        updatedFields.push("title");
+      }
+      if (is_live !== void 0) {
         updates.push(`Live \u2192 ${is_live}`);
-      if (show_step_counter !== void 0)
+        updatedFields.push("is_live");
+      }
+      if (show_step_counter !== void 0) {
         updates.push(`Step counter \u2192 ${show_step_counter}`);
-      if (disable_back_navigation !== void 0)
+        updatedFields.push("show_step_counter");
+      }
+      if (disable_back_navigation !== void 0) {
         updates.push(`Back navigation \u2192 ${disable_back_navigation ? "disabled" : "enabled"}`);
-      if (total_steps !== void 0)
+        updatedFields.push("disable_back_navigation");
+      }
+      if (total_steps !== void 0) {
         updates.push(`Total steps \u2192 ${total_steps === null ? "auto" : total_steps}`);
-      if (primary_color !== void 0)
+        updatedFields.push("total_steps");
+      }
+      if (primary_color !== void 0) {
         updates.push(`Primary color \u2192 ${primary_color}`);
-      if (background_color !== void 0)
+        updatedFields.push("primary_color");
+      }
+      if (background_color !== void 0) {
         updates.push(`Background color \u2192 ${background_color}`);
-      if (font_family !== void 0)
+        updatedFields.push("background_color");
+      }
+      if (font_family !== void 0) {
         updates.push(`Font \u2192 ${font_family}`);
-      if (description !== void 0)
+        updatedFields.push("font_family");
+      }
+      if (description !== void 0) {
         updates.push(`Description \u2192 ${description === null ? "cleared" : `"${description}"`}`);
-      if (author !== void 0)
+        updatedFields.push("description");
+      }
+      if (author !== void 0) {
         updates.push(`Author \u2192 ${author === null ? "cleared" : `"${author}"`}`);
-      if (logo_url !== void 0)
+        updatedFields.push("author");
+      }
+      if (logo_url !== void 0) {
         updates.push(`Logo URL \u2192 ${logo_url === null ? "cleared" : logo_url}`);
-      if (show_branding !== void 0)
+        updatedFields.push("logo_url");
+      }
+      if (show_branding !== void 0) {
         updates.push(`Show branding \u2192 ${show_branding}`);
-      if (brand_name !== void 0)
+        updatedFields.push("show_branding");
+      }
+      if (brand_name !== void 0) {
         updates.push(`Brand name \u2192 ${brand_name === null ? "cleared" : `"${brand_name}"`}`);
-      if (tags)
+        updatedFields.push("brand_name");
+      }
+      if (tags) {
         updates.push(`Tags \u2192 [${tags.join(", ")}]`);
-      return textResult(`Form updated: ${updates.join(", ")}`);
+        updatedFields.push("tags");
+      }
+      return structuredResult(`Form updated: ${updates.join(", ")}`, { form_id, updated_fields: updatedFields });
     }
   );
 }
@@ -17636,8 +17749,13 @@ function registerDeleteFormTool(server) {
       annotations: {
         readOnlyHint: false,
         destructiveHint: true,
-        idempotentHint: false,
-        openWorldHint: false
+        // Deleting an already-trashed form has no further effect -
+        // calling this twice with the same form_id is a no-op the second
+        // time (textbook idempotent delete, #2976).
+        idempotentHint: true,
+        // Removes a form's public page - openWorldHint per OpenAI's
+        // "publishing content" reading (#2976 research pass 2).
+        openWorldHint: true
       }
     },
     async ({ form_id, confirm }) => {
@@ -17660,13 +17778,210 @@ function registerDeleteFormTool(server) {
   );
 }
 
+// src/tools/get-results.ts
+var MAX_TEXT_LENGTH = 500;
+var MAX_LABEL_LENGTH = 80;
+var MAX_RECENT_ANSWERS = 20;
+function coerceToString(value, maxLength) {
+  if (value === null || value === void 0) return "";
+  if (typeof value === "string") {
+    return value.length > maxLength ? `${value.slice(0, maxLength)}\u2026` : value;
+  }
+  if (typeof value === "number" || typeof value === "boolean") {
+    return String(value);
+  }
+  let json;
+  try {
+    json = JSON.stringify(value);
+  } catch {
+    return "";
+  }
+  return json.length > maxLength ? `${json.slice(0, maxLength)}\u2026` : json;
+}
+function projectNode(node) {
+  const base = {
+    node_id: node.node_id,
+    node_type: node.node_type,
+    prompt: node.node_text,
+    total_responses: node.total_responses,
+    total_views: node.total_views
+  };
+  if (node.node_type === "choice") {
+    const answers = node.answers;
+    return {
+      ...base,
+      options: answers.map((a) => ({
+        label: a.answer_text,
+        count: a.count,
+        percentage: a.percentage
+      }))
+    };
+  }
+  if (node.node_type === "payment") {
+    return base;
+  }
+  if (node.node_category === "action") {
+    const answers = node.answers;
+    return {
+      ...base,
+      options: answers.map((a) => ({
+        label: coerceToString(a.answer_value, MAX_LABEL_LENGTH),
+        count: a.count,
+        percentage: a.percentage
+      }))
+    };
+  }
+  if (node.node_type === "open") {
+    const answers = node.answers;
+    return {
+      ...base,
+      recent_answers: answers.slice(0, MAX_RECENT_ANSWERS).map((a) => ({
+        text: coerceToString(a.answer_value, MAX_TEXT_LENGTH),
+        submitted_at: a.submitted_at
+      }))
+    };
+  }
+  return base;
+}
+function registerGetResultsTool(server) {
+  server.registerTool(
+    "clipform_get_results",
+    {
+      title: "Get Clipform Results",
+      description: `View response counts, choice/action answer breakdowns, and recent open-text answers for a form. Contact, file, draw, camera, and payment answers are counts only - use the dashboard for per-response detail.`,
+      inputSchema: {
+        form_id: external_exports.string().describe("The form UUID (returned by clipform_create_form, not the short share_id from the URL)")
+      },
+      outputSchema: {
+        total_responses: external_exports.number().describe("Total unique respondents to the form"),
+        nodes: external_exports.array(
+          external_exports.object({
+            node_id: external_exports.string(),
+            node_type: external_exports.string(),
+            prompt: external_exports.string(),
+            total_responses: external_exports.number(),
+            total_views: external_exports.number(),
+            options: external_exports.array(
+              external_exports.object({
+                label: external_exports.string(),
+                count: external_exports.number(),
+                percentage: external_exports.number()
+              })
+            ).optional().describe("Answer breakdown - choice and action-category (booking/file_download/shopping) nodes only"),
+            recent_answers: external_exports.array(
+              external_exports.object({
+                text: external_exports.string(),
+                submitted_at: external_exports.string()
+              })
+            ).optional().describe("Most recent open-text answers, capped at 20 - open questions only")
+          })
+        ).describe("Nodes in form order. Contact/file/draw/camera/payment nodes carry only total_responses/total_views - no per-response detail.")
+      },
+      annotations: {
+        readOnlyHint: true,
+        destructiveHint: false,
+        idempotentHint: true,
+        openWorldHint: false
+      }
+    },
+    async ({ form_id }) => {
+      const result = await callApi(`/forms/${form_id}/results`);
+      if (!result.ok) {
+        return errorResult(result.error);
+      }
+      const data = result.data;
+      const nodes = (data.nodes || []).map(projectNode);
+      const structured = {
+        total_responses: data.total_responses,
+        nodes
+      };
+      if (data.total_responses === 0) {
+        return structuredResult(
+          `This form has no responses yet (${nodes.length} node(s)).`,
+          structured
+        );
+      }
+      const lines = [`${data.total_responses} total response(s) across ${nodes.length} node(s).`];
+      const highlights = nodes.filter((n) => "options" in n || "recent_answers" in n).slice(0, 3);
+      for (const n of highlights) {
+        if ("options" in n && n.options) {
+          const top = n.options.slice(0, 3).map((o) => `${o.label} (${o.percentage}%)`).join(", ");
+          lines.push(`- ${n.prompt}: ${top || "no answers yet"}`);
+        } else if ("recent_answers" in n && n.recent_answers) {
+          lines.push(`- ${n.prompt}: ${n.recent_answers.length} recent open-text answer(s)`);
+        }
+      }
+      return structuredResult(lines.join("\n"), structured);
+    }
+  );
+}
+
+// src/tools/whoami.ts
+function registerWhoamiTool(server) {
+  server.registerTool(
+    "clipform_whoami",
+    {
+      title: "Who Am I",
+      description: `Show the current identity: auth mode (api key, session, or anonymous), active workspace, and plan limits.`,
+      inputSchema: {},
+      outputSchema: {
+        auth_mode: external_exports.enum(["api_key", "session", "anonymous"]).describe("How this session is authenticated"),
+        is_authenticated: external_exports.boolean().describe("True for api_key or session auth; false for anonymous"),
+        workspace: external_exports.object({ id: external_exports.string(), name: external_exports.string() }).nullable().describe("Active workspace, or null when anonymous"),
+        plan: external_exports.object({
+          name: external_exports.string(),
+          tier: external_exports.number(),
+          node_limit: external_exports.number().nullable().describe("Max nodes per form, or null if unlimited"),
+          form_limit: external_exports.number().nullable().describe("Max forms in the workspace, or null if unlimited")
+        }).describe("Plan limits for the active workspace"),
+        workspaces: external_exports.array(external_exports.object({ id: external_exports.string(), name: external_exports.string() })).optional().describe("All workspaces in the caller's company - only present for session (dashboard) auth")
+      },
+      annotations: {
+        readOnlyHint: true,
+        destructiveHint: false,
+        idempotentHint: true,
+        openWorldHint: false
+      },
+      _meta: { "anthropic/alwaysLoad": true }
+    },
+    async () => {
+      const result = await callApi("/me", { method: "GET" });
+      if (!result.ok) {
+        return errorResult(result.error);
+      }
+      const me = result.data;
+      const authMode = me.auth_mode ?? "anonymous";
+      const isAuthenticated = me.auth_mode != null && me.auth_mode !== "anonymous";
+      const workspace = me.workspace ? { id: me.workspace.id, name: me.workspace.name } : null;
+      const plan = {
+        name: me.plan?.name ?? "Free",
+        tier: me.plan?.tier ?? 0,
+        node_limit: me.plan?.node_limit ?? null,
+        form_limit: me.plan?.form_limit ?? null
+      };
+      const structured = {
+        auth_mode: authMode,
+        is_authenticated: isAuthenticated,
+        workspace,
+        plan
+      };
+      if (Array.isArray(me.workspaces)) {
+        structured.workspaces = me.workspaces.map((w) => ({ id: w.id, name: w.name }));
+      }
+      const workspaceLine = workspace ? `workspace '${workspace.name}'` : "no workspace (anonymous)";
+      const summary = `Auth: ${authMode}. ${workspaceLine}. Plan: ${plan.name}.`;
+      return structuredResult(summary, structured);
+    }
+  );
+}
+
 // src/tools/add-node.ts
 function registerAddNodeTool(server) {
   server.registerTool(
     "clipform_add_node",
     {
       title: "Add Node",
-      description: `Add a new node to an existing form. Inserted before the end screen by default; after_node_id controls insertion position. Node types and config schemas match clipform_create_form.`,
+      description: `Add a new node to an existing form. Inserted before the end screen by default; after_node_id controls insertion position. Inserting into a linear flow automatically re-links the chain (the node before the insertion point points to the new node, which points to what followed) - you do not need clipform_set_logic for a simple insert. Branching still needs an explicit logic write. Node types and config schemas match clipform_create_form.`,
       inputSchema: {
         form_id: external_exports.string().uuid().describe("The form UUID (returned by clipform_create_form, not the short share_id from the URL)"),
         node: NodeSchema.describe("The node to add"),
@@ -17697,8 +18012,10 @@ function registerAddNodeTool(server) {
         return errorResult(result.error);
       }
       const nodeId = result.data.node_id;
+      const warnings = result.data.warnings ?? [];
+      const relinkNote = warnings.length > 0 ? ` ${warnings.join(" ")}` : " The logic chain was automatically re-linked - no clipform_set_logic call is needed for this insert.";
       return structuredResult(
-        `Node added. ID: ${nodeId} | Type: ${node.type}`,
+        `Node added. ID: ${nodeId} | Type: ${node.type}.${relinkNote}`,
         { node_id: nodeId, type: node.type }
       );
     }
@@ -17741,7 +18058,10 @@ function registerUpdateNodeTool(server) {
       },
       annotations: {
         readOnlyHint: false,
-        destructiveHint: false,
+        // Overwrites the node's prompt/config with whatever is sent - a
+        // field explicitly set to null clears it, so this can destroy data,
+        // not just add to it (#2976 research pass 2).
+        destructiveHint: true,
         idempotentHint: true,
         openWorldHint: false
       }
@@ -17801,7 +18121,9 @@ function registerDeleteNodeTool(server) {
       annotations: {
         readOnlyHint: false,
         destructiveHint: true,
-        idempotentHint: false,
+        // Deleting an already-deleted node has no further effect -
+        // textbook idempotent delete (#2976).
+        idempotentHint: true,
         openWorldHint: false
       }
     },
@@ -18034,8 +18356,15 @@ function registerAttachNodeMediaTool(server) {
       },
       annotations: {
         readOnlyHint: false,
-        destructiveHint: false,
-        idempotentHint: false,
+        // Attaching replaces the node's existing media placement (the API
+        // overwrites it, not merges) - the previous placement is gone, even
+        // though the underlying library asset it pointed to is never deleted
+        // (#2976 research pass 2).
+        destructiveHint: true,
+        // Re-attaching the same media_asset_id to the same node converges to
+        // the same placement state - no new resource is created each call
+        // (#2976).
+        idempotentHint: true,
         openWorldHint: false
       }
     },
@@ -18157,7 +18486,9 @@ function registerDeleteNodeMediaTool(server) {
       annotations: {
         readOnlyHint: false,
         destructiveHint: true,
-        idempotentHint: false,
+        // Deleting already-removed media has no further effect - textbook
+        // idempotent delete (#2976).
+        idempotentHint: true,
         openWorldHint: false
       }
     },
@@ -18184,23 +18515,20 @@ function registerDeleteNodeMediaTool(server) {
 
 // src/tools/set-node-logic.ts
 var LogicRuleSchema = external_exports.object({
-  option_content: external_exports.string().optional().describe(
-    "The option text to match. Omit for a default rule (applies to all unmatched options)."
-  ),
-  target_node_id: external_exports.string().describe("The node ID to jump to when this rule matches")
+  target_node_id: external_exports.string().describe("The node ID this node routes to")
 });
 var NodeLogicSchema = external_exports.object({
-  node_id: external_exports.string().describe("The node ID to set logic on"),
-  rules: external_exports.array(LogicRuleSchema).min(1).describe("Branching rules. Each maps an option or default to a target node.")
+  node_id: external_exports.string().describe("The node ID to set routing on"),
+  rules: external_exports.array(LogicRuleSchema).min(1).max(1).describe("Exactly one rule: the single node this node routes to")
 });
 function registerSetNodeLogicTool(server) {
   server.registerTool(
     "clipform_set_logic",
     {
       title: "Set Node Logic",
-      description: `Set routing logic on one or more nodes. Pass multiple nodes in one call instead of separate tool calls. Linear routing (A to B to C) is supported. NOTE: Conditional branching (different paths based on which option is picked) is a planned feature - do not create conditional branching paths.
+      description: `Set the next node for one or more nodes, wiring a linear route (A to B to C). Pass multiple nodes in one call instead of separate tool calls. Each node routes to exactly one target node; conditional branching by which option was picked is not yet supported.
 
-Each rule maps an option (by its text content) to a target node. Rules without option_content are "default" rules applied to all unmatched options.
+A call replaces that node's routing entirely - it does not merge with any prior target.
 
 Example:
   nodes: [
@@ -18211,15 +18539,28 @@ Example:
         form_id: external_exports.string().uuid().describe("The form UUID (returned by clipform_create_form, not the short share_id from the URL)"),
         nodes: external_exports.array(NodeLogicSchema).min(1).max(20).describe("One or more nodes to set logic on")
       },
+      outputSchema: {
+        results: external_exports.array(
+          external_exports.object({
+            node_id: external_exports.string(),
+            ok: external_exports.boolean(),
+            rules_count: external_exports.number().optional(),
+            error: external_exports.string().optional()
+          })
+        ).describe("One result per node, in order")
+      },
       annotations: {
         readOnlyHint: false,
-        destructiveHint: false,
+        // A call wholesale REPLACES a node's rule set - a prior set of rules
+        // is discarded, not merged (#2976).
+        destructiveHint: true,
         idempotentHint: true,
         openWorldHint: false
       }
     },
     async ({ form_id, nodes }) => {
       const allLines = [];
+      const results = [];
       for (const { node_id, rules } of nodes) {
         const result = await callApi(
           `/forms/${form_id}/nodes/${node_id}/logic/rules`,
@@ -18229,12 +18570,15 @@ Example:
           }
         );
         if (!result.ok) {
-          allLines.push(`Node ${node_id}: FAILED \u2014 ${result.error}`);
+          allLines.push(`Node ${node_id}: FAILED - ${result.error}`);
+          results.push({ node_id, ok: false, error: result.error });
           continue;
         }
-        allLines.push(`Node ${node_id}: logic set (${result.data.rules_count} rules)`);
+        const rulesCount = result.data.rules_count;
+        allLines.push(`Node ${node_id}: logic set (${rulesCount} rules)`);
+        results.push({ node_id, ok: true, rules_count: rulesCount });
       }
-      return textResult(allLines.join("\n"));
+      return structuredResult(allLines.join("\n"), { results });
     }
   );
 }
@@ -18245,7 +18589,7 @@ function registerLogGenerationTool(server) {
     "clipform_log_generation",
     {
       title: "Log Form Generation Audit",
-      description: `Save an audit trail for a generated form. Records where content came from - the sources and image attributions.`,
+      description: `Internal audit step run by a form-generation workflow. Records a completed generation's content provenance (sources, image attributions) for the flow that just built the form. Not a user action - only call it as the final step of a generation workflow you are running, never in response to a plain create or edit request.`,
       inputSchema: {
         form_id: external_exports.string().uuid().describe("The form ID (UUID format, not the share ID)"),
         summary: external_exports.string().describe("Short description of what was generated"),
@@ -18270,7 +18614,8 @@ function registerLogGenerationTool(server) {
       });
       if (!result.ok) return errorResult(result.error);
       return textResult(`Audit log saved for form ${form_id}
-Summary: ${summary}`);
+Summary: ${summary}
+This is an internal generation-audit step, not a user-requested action.`);
     }
   );
 }
@@ -18304,7 +18649,9 @@ Returns: article title, source, author, date, URL, description, and image URL pe
           })
         ).describe("Matching articles (empty if none)")
       },
-      annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false }
+      // Fetches from NewsAPI / The Guardian, external systems outside our
+      // product - openWorldHint: true (#2976).
+      annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true }
     },
     async ({ query, count }) => {
       const result = await callApi("/internal/search-news", {
@@ -18338,56 +18685,6 @@ Returns: article title, source, author, date, URL, description, and image URL pe
   );
 }
 
-// src/tools/youtube-transcript.ts
-function registerYouTubeTranscriptTool(server) {
-  server.registerTool(
-    "clipform_youtube_transcript",
-    {
-      title: "Get YouTube Transcript",
-      description: `Extract the transcript, title, and channel info from a YouTube video. Returns the full transcript text plus metadata (title, channel, duration).
-
-Supports any public YouTube video with captions enabled. Does NOT work for private/age-restricted videos, videos with captions disabled, or non-YouTube URLs.`,
-      inputSchema: {
-        url: external_exports.string().url().describe(
-          "YouTube video URL (any format: watch?v=, youtu.be/, shorts/)"
-        ),
-        lang: external_exports.string().optional().default("en").describe(
-          "Transcript language code (default: 'en'). Try 'en' first, omit for auto-detect if English unavailable."
-        ),
-        max_chars: external_exports.number().optional().default(15e3).describe(
-          "Maximum transcript characters to return (default: 15000). Increase for longer videos where full context matters."
-        )
-      },
-      annotations: {
-        readOnlyHint: true,
-        destructiveHint: false,
-        idempotentHint: true,
-        openWorldHint: false
-      }
-    },
-    async ({ url, lang, max_chars }) => {
-      const result = await callApi("/internal/youtube-transcript", {
-        body: { url, lang, max_chars }
-      });
-      if (!result.ok) return errorResult(result.error);
-      const data = result.data;
-      const meta = data.metadata;
-      const lines = [
-        `## Video: ${meta.title}`,
-        `Channel: ${meta.author}`,
-        `Duration: ~${Math.round(data.durationSeconds / 60)} minutes`,
-        `Language: ${data.language}`,
-        `Transcript length: ${data.transcript.length} characters`,
-        ``,
-        `## Transcript`,
-        ``,
-        data.transcript
-      ];
-      return textResult(lines.join("\n"));
-    }
-  );
-}
-
 // src/tools/generate-tts.ts
 var CaptionSchema2 = external_exports.object({
   start: external_exports.number(),
@@ -18518,7 +18815,9 @@ Example: { queries: [{ query: "saturn rings" }, { query: "mars surface", count:
           })
         ).describe("Results grouped by query (items empty if a query found nothing or failed)")
       },
-      annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false }
+      // Fetches from external stock media providers (Pexels/etc) -
+      // openWorldHint: true (#2976).
+      annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true }
     },
     async ({ queries }) => {
       const allLines = [];
@@ -18645,6 +18944,7 @@ var RENDER_TIMING = {
   etaPhrase: "a couple of minutes"
 };
 function createJob(tool) {
+  pruneJobs();
   const job = {
     id: v4_default(),
     status: "rendering",
@@ -18887,7 +19187,11 @@ ${RENDER_ATTACH_RULE} In batch mode, set node_id per item (see items) and form_i
           })
         ).describe("One entry per render (single or batch)")
       },
-      annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false }
+      // node_id auto-attach replaces the node's existing media placement and
+      // republishes an already-live form - an indirect but real overwrite +
+      // publish (#2976 research pass 2), even though this tool works with no
+      // node_id too (destructive/openWorld apply "even in only select modes").
+      annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true }
     },
     async ({ compositionId, outputFormat, inputProps, wait, items, node_id, form_id, captions }) => {
       if (items?.length && compositionId) {
@@ -19015,7 +19319,9 @@ function registerSearchMusicTool(server) {
           })
         ).describe("Matching tracks (empty if none); pass a url as the audio track to generate_video")
       },
-      annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false }
+      // Fetches from an external royalty-free music provider - openWorldHint:
+      // true (#2976).
+      annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true }
     },
     async ({ query, count, instrumentalOnly, minDuration, maxDuration, tags }) => {
       const result = await callApi("/internal/search-music", {
@@ -19226,7 +19532,11 @@ ${RENDER_ATTACH_RULE}`,
         republished: external_exports.boolean().optional().describe("True when the form was live and was republished to include this media."),
         attach_error: external_exports.string().optional().describe("Present when node_id was provided but auto-attach failed - the render itself still succeeded.")
       },
-      annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false }
+      // node_id auto-attach replaces the node's existing media placement and
+      // republishes an already-live form - an indirect but real overwrite +
+      // publish (#2976 research pass 2), even though this tool works with no
+      // node_id too (destructive/openWorld apply "even in only select modes").
+      annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true }
     },
     async ({ template, controls, outputFormat, wait, node_id, form_id, captions }) => {
       if (node_id && !form_id) {
@@ -19434,7 +19744,11 @@ ${RENDER_ATTACH_RULE}`,
         republished: external_exports.boolean().optional().describe("True when the form was live and was republished to include this media."),
         attach_error: external_exports.string().optional().describe("Present when node_id was provided but auto-attach failed - the render itself still succeeded.")
       },
-      annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false }
+      // node_id auto-attach replaces the node's existing media placement and
+      // republishes an already-live form - an indirect but real overwrite +
+      // publish (#2976 research pass 2), even though this tool works with no
+      // node_id too (destructive/openWorld apply "even in only select modes").
+      annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true }
     },
     async ({ items, audio_url, background_audio_url, background_audio_volume, duration_seconds, random_effects, transition, style_preset, texture, duotone, background_color, wait, node_id, form_id, captions }) => {
       if (node_id && !form_id) {
@@ -19609,7 +19923,6 @@ Pass job_ids to check a whole batch in ONE call - one line of status per job. Pa
       annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false }
     },
     async ({ job_id, job_ids }) => {
-      pruneJobs();
       const ids = job_ids?.length ? job_ids : job_id ? [job_id] : [];
       if (!ids.length) {
         return errorResult("Pass job_id (single) or job_ids (batch).");
@@ -19699,7 +20012,16 @@ mainlandOnly excludes small islands and overseas territories (e.g. Corsica for F
         mainlandOnly: external_exports.boolean().default(true).describe("Keep only the largest landmass, excluding small islands and overseas territories"),
         maxPoints: external_exports.number().default(500).describe("Maximum points per polygon ring for simplification (default 500, lower = smaller payload)")
       },
-      annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false }
+      outputSchema: {
+        name: external_exports.string().describe("Resolved place name"),
+        geometry_type: external_exports.enum(["Polygon", "MultiPolygon"]),
+        size_kb: external_exports.number().describe("Approximate size of the returned GeoJSON in KB"),
+        mainland_only: external_exports.boolean(),
+        geojson: external_exports.string().describe("The Feature GeoJSON as a JSON string - use as the boundary prop in the Map composition")
+      },
+      // Fetches from Nominatim (OpenStreetMap), an external system -
+      // openWorldHint: true (#2976).
+      annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true }
     },
     async ({ query, type, mainlandOnly, maxPoints }) => {
       const params = new URLSearchParams({
@@ -19716,11 +20038,16 @@ mainlandOnly excludes small islands and overseas territories (e.g. Corsica for F
         params.set("q", query);
       }
       const url = `${NOMINATIM_BASE}?${params}`;
-      const response = await fetch(url, {
-        headers: { "User-Agent": USER_AGENT }
-      });
+      let response;
+      try {
+        response = await fetch(url, {
+          headers: { "User-Agent": USER_AGENT }
+        });
+      } catch {
+        return errorResult(`Boundary lookup failed for "${query}". Try again, or try a different name or type.`);
+      }
       if (!response.ok) {
-        return errorResult(`Nominatim API error: ${response.status} ${response.statusText}`);
+        return errorResult(`Boundary lookup failed for "${query}". Try again, or try a different name or type.`);
       }
       const data = await response.json();
       if (!data.features?.length) {
@@ -19757,8 +20084,8 @@ mainlandOnly excludes small islands and overseas territories (e.g. Corsica for F
         geometry
       };
       const geojsonStr = JSON.stringify(result);
-      const sizeKb = (geojsonStr.length / 1024).toFixed(1);
-      return textResult(
+      const sizeKb = Number((geojsonStr.length / 1024).toFixed(1));
+      return structuredResult(
         [
           `Boundary fetched for: ${feature.properties.display_name}`,
           `Geometry: ${geometry.type}`,
@@ -19770,7 +20097,14 @@ mainlandOnly excludes small islands and overseas territories (e.g. Corsica for F
           "```json",
           geojsonStr,
           "```"
-        ].join("\n")
+        ].join("\n"),
+        {
+          name: feature.properties.display_name,
+          geometry_type: geometry.type,
+          size_kb: sizeKb,
+          mainland_only: mainlandOnly,
+          geojson: geojsonStr
+        }
       );
     }
   );
@@ -19915,6 +20249,7 @@ function createServer(options) {
         "Before building, derive a register from the topic and audience (e.g. hype, playful, warm, considered, elegant, sombre); if the user states a mood explicitly, that wins. State the register once, then apply it to every rendering choice - narration tone, motion preset, music, pacing. Never mix registers in one form.",
         "At the start of a build, call clipform_get_workflow to load the recipe for the form type, and clipform_get_guide for craft detail.",
         "Every *_id argument is a UUID returned by the tools - not the short share_id from a form URL.",
+        "For an account-scoped request, call clipform_whoami first to confirm the active workspace and plan.",
         "Deleting a form, node, or its media is permanent; those tools ask the user to confirm before running."
       ].join(" ")
     }
@@ -19925,6 +20260,12 @@ function createServer(options) {
     if (options?.planTier !== void 0 && requiredTier > options.planTier) {
       return void 0;
     }
+    if (options?.toolsets !== void 0) {
+      const toolset = MCP_TOOL_TOOLSETS[name];
+      if (!toolset || !options.toolsets.includes(toolset)) {
+        return void 0;
+      }
+    }
     return _registerTool(
       name,
       config2,
@@ -19941,9 +20282,11 @@ function createServer(options) {
   };
   registerCreateFormTool(server);
   registerListFormsTool(server);
+  registerWhoamiTool(server);
   registerGetFormTool(server);
   registerUpdateFormTool(server);
   registerDeleteFormTool(server);
+  registerGetResultsTool(server);
   registerAddNodeTool(server);
   registerUpdateNodeTool(server);
   registerDeleteNodeTool(server);
@@ -19955,7 +20298,6 @@ function createServer(options) {
   registerSetNodeLogicTool(server);
   registerLogGenerationTool(server);
   registerSearchNewsTool(server);
-  registerYouTubeTranscriptTool(server);
   registerGenerateTtsTool(server);
   registerGenerateVideoTool(server);
   registerSearchMediaTool(server);
@@ -19979,4 +20321,4 @@ export {
   RENDER_TIMING,
   createServer
 };
-//# sourceMappingURL=chunk-NMIUCFJT.js.map
+//# sourceMappingURL=chunk-3GBZFAEM.js.map