@cookiemunch/mcp 0.2.0 → 0.4.0

package/dist/{chunk-PLBLLTYO.js → chunk-SKCEQX3L.js}

@@ -3,7 +3,7 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { createCookieMunch } from "@cookiemunch/sdk";
 
 // src/tools.ts
-import { z as z4 } from "zod";
+import { z as z5 } from "zod";
 
 // src/tools-config.ts
 import { z } from "zod";
@@ -90,7 +90,7 @@ function registerConfigTools(tool, client) {
   const setLanguagesSchema = z.object({
     cbid: z.string().describe("Site identifier (cbid)."),
     defaultCulture: z.string().optional().describe('Default locale/culture code, e.g. "en", "fr". Stored in i18n.defaultCulture.'),
-    autoDetect: z.boolean().optional().describe("Auto-detect visitor language from browser locale. Stored in i18n.autoDetect."),
+    autoDetect: z.union([z.boolean(), z.literal("page")]).optional().describe(`true: follow the visitor's browser language; false: defaultCulture for everyone; "page": follow the page's <html lang>, then the browser. Stored in i18n.autoDetect.`),
     translations: z.record(z.record(z.unknown())).optional().describe("Per-locale banner copy overrides. Merged onto banner.i18n (locale keys preserved)."),
     overrides: z.record(z.object({ banner: z.record(z.string()).optional(), categories: z.record(z.object({ label: z.string().optional(), description: z.string().optional() })).optional() })).optional().describe("The site's own copy per language, keyed by tag (de, pt-BR): { banner: { title, body, \u2026 }, categories: { <id>: { label, description } } }. Each language given replaces its entry in i18n.overrides; other languages are kept. Strings the site wrote are shown as written in any language without an override \u2014 stock translations never replace them.")
   });
@@ -191,7 +191,7 @@ function registerConfigTools(tool, client) {
     preset: z.enum(["bar", "box", "full"]).optional().describe("Named shape that sets type/secondLayer (and layout for box): bar = slim one-row bar + categories in a modal; box = centred card + modal; full = every category in the first layer."),
     secondLayer: z.enum(["expand", "popup", "modal"]).optional().describe("Where the categories open from an inline banner."),
     density: z.enum(["comfortable", "compact"]).optional().describe("compact = one-row bar from 760px wide."),
-    theme: z.record(z.unknown()).optional().describe("Partial ThemeTokens \u2014 deep-merged onto the existing banner theme."),
+    theme: z.record(z.unknown()).optional().describe("Partial ThemeTokens \u2014 deep-merged onto the existing banner theme. Includes `scrollbar`: { style: themed|thin|native|hidden, thumb?, thumbHover?, track?, width? 4\u201316, radius? 0\u2013999 }."),
     content: z.record(z.unknown()).optional().describe("Partial BannerContent \u2014 banner copy overrides (title, body, button labels, policyUrl, etc.).")
   });
   tool(
@@ -538,12 +538,16 @@ function registerPlatformTools(tool, client) {
     "connect_dsar_executor",
     "Connect a system that runs part of a rights request \u2014 an identity platform, a CRM, anything with a rights API. Cookie Munch is not specific to any platform: the `profile` describes that system's API (paths, the words it uses for export/erase, its status vocabulary, how it signs webhooks), so connecting a new one needs no code. The secret key is stored encrypted and never returned; the response carries the webhook URL to configure in that system. Sub-tasks open automatically once a request reaches fulfilment (after identity verification), and completions are picked up by webhook or by polling.",
     {
-      system: z2.string().describe("The name this connection answers to in a plan, e.g. identity or crm."),
-      baseUrl: z2.string().describe("The system's public https origin."),
+      preset: z2.string().optional().describe("Build profile (and, unless the preset takes baseUrl as a param, baseUrl) from a versioned preset instead of sending profile. list_dsar_executor_presets names them, what each needs, and which wait on another platform."),
+      presetVersion: z2.number().int().optional().describe("With preset: the version to build. Default the latest."),
+      orgId: z2.string().optional().describe("A preset param, when the preset's params list it."),
+      atlasIdAppId: z2.string().optional().describe("A preset param, when the preset's params list it: the identity platform's app id, so an erasure also revokes the app's grant."),
+      system: z2.string().optional().describe("The name this connection answers to in a plan, e.g. identity or crm. Required unless the preset has a default."),
+      baseUrl: z2.string().optional().describe("The system's public https origin. Required unless the preset sets it."),
       secretKey: z2.string().describe("Its API key, with whatever scope that system needs to export and erase a user."),
       webhookSecret: z2.string().optional().describe("Signing secret of its webhook endpoint. Optional: polling closes tasks without it."),
       auto: z2.boolean().optional().describe("Open a sub-task automatically when a request reaches fulfilment. Default true."),
-      profile: z2.record(z2.unknown()).describe("How to drive that system: { open, poll, statuses } required, plus optional subjectLookup, auth, idempotencyHeader and webhook. See the connected-systems docs for the shape."),
+      profile: z2.record(z2.unknown()).optional().describe("How to drive that system: { open, poll, statuses } required, plus optional subjectLookup, auth, idempotencyHeader, grantRevoke and webhook. Omit it when using preset."),
       dryRun: z2.boolean().optional().describe("Validate everything and answer the connection that would be created, storing nothing.")
     },
     (a) => {
@@ -551,6 +555,28 @@ function registerPlatformTools(tool, client) {
       return dryRun === true ? client.fulfillment.dryRunConnectExecutor(input) : client.fulfillment.connectExecutor(input);
     }
   );
+  tool(
+    "list_dsar_executor_presets",
+    "The versioned executor presets: each one's name, params, latest version, and whether it is usable now or waits on another platform's API (waitingOn names the platform and its spec items). Also this org's canary address for connection tests. Read-only.",
+    {},
+    () => client.fulfillment.executorPresets()
+  );
+  tool(
+    "upgrade_dsar_executor_preset",
+    "Rebuild a connection's profile and address from its preset's latest version (or presetVersion), keeping its id, credentials, system and scope \u2014 or adopt a preset on a hand-written connection by naming it. Answers with a diff. Use dryRun first: the answer shows exactly what would change and nothing is stored.",
+    {
+      id: z2.string().describe("The connection id."),
+      preset: z2.string().optional().describe("Only to adopt a preset on a connection that has none."),
+      presetVersion: z2.number().int().optional(),
+      orgId: z2.string().optional(),
+      atlasIdAppId: z2.string().optional(),
+      dryRun: z2.boolean().optional().describe("Answer the diff and change nothing.")
+    },
+    (a) => {
+      const { id, dryRun, ...input } = a;
+      return dryRun === true ? client.fulfillment.dryRunUpgradeExecutorPreset(id, input) : client.fulfillment.upgradeExecutorPreset(id, input);
+    }
+  );
   tool(
     "test_dsar_executor_webhook",
     "Would this webhook delivery from a connected system verify? Runs the receiver's exact check (headers, timestamp tolerance, prefix, HMAC) on headers and a raw body you supply, acts on nothing, and returns { verified, stage, reason } naming the stage that failed. `body` must be the raw request body string, byte for byte. Read-only.",
@@ -584,15 +610,17 @@ function registerPlatformTools(tool, client) {
   );
   tool(
     "test_dsar_executor",
-    "Try a connected system against one email WITHOUT filing a rights request. Runs its subject lookup and returns the raw upstream answers (credentials removed) and a one-line verdict. The open step is rendered but not sent, unless open is true on an export, which opens and polls a real export once. An erasure is never sent by a test.",
+    "Try a connected system against one email (or the org canary, canary: true) WITHOUT filing a rights request. Runs its subject lookup and returns the raw upstream answers (credentials removed) and a one-line verdict; code base_url_redirects means its baseUrl redirects and the verdict names where. The open step is rendered but not sent, unless open is true on an export, which opens and polls a real export once. An erasure is never sent by a test.",
     {
       id: z2.string().describe("The connection id."),
-      email: z2.string().describe("The address to look up."),
+      email: z2.string().optional().describe("The address to look up. Omit it with canary."),
+      canary: z2.boolean().optional().describe("Use this org's canary address \u2014 no real person involved. A canary locate also updates the connection's health."),
       operation: z2.enum(["locate", "export", "erase"]).optional().describe("Default locate."),
       open: z2.boolean().optional().describe("For export only: open a real export and poll it once.")
     },
     (a) => client.fulfillment.testExecutor(a.id, {
-      email: a.email,
+      ...typeof a.email === "string" ? { email: a.email } : {},
+      ...a.canary === true ? { canary: true } : {},
       ...a.operation ? { operation: a.operation } : {},
       ...typeof a.open === "boolean" ? { open: a.open } : {}
     })
@@ -678,31 +706,107 @@ function registerPlatformTools(tool, client) {
   );
 }
 
-// src/tools-rights-page.ts
+// src/tools-integrations.ts
 import { z as z3 } from "zod";
+function registerIntegrationTools(tool, client) {
+  const updateSiteSchema = z3.object({
+    cbid: z3.string().describe("Site identifier (cbid)."),
+    domain: z3.string().optional().describe("New domain, a bare hostname. A move clears verification: verify the new domain afterwards."),
+    name: z3.string().nullable().optional().describe("Display name data subjects see on the rights page and in notices; null clears it."),
+    aliases: z3.array(z3.string()).optional().describe("Other hosts serving the site (replaces the list; [] clears it). Accepted consent origins, never verified claims."),
+    dryRun: z3.boolean().optional().describe("Answer with the diff and its effects, storing nothing.")
+  });
+  tool(
+    "update_site",
+    "Rename or move a site: its domain, display name and aliases. The cbid and the consent ledger stay. Moving the domain clears verification; the scanner and preview links follow the new domain. Use dryRun first to see the diff and every effect.",
+    updateSiteSchema.shape,
+    (a) => {
+      const { cbid, dryRun, ...patch } = updateSiteSchema.parse(a);
+      return client.sites.update(cbid, patch, { dryRun });
+    }
+  );
+  tool(
+    "integration_health",
+    "Check every link a site\u2019s privacy wiring depends on: the domain, the snippet and CSP on the live page, connected systems (base URL redirects, a test lookup), webhooks, partner links, Atlas cookie_consent, cookies needing review, the rights page, the mail provider and the request SLA. Each row has ok (null = could not check) and a fix hint. Read-only.",
+    { cbid: z3.string().optional().describe("Site identifier; optional when the org has one site.") },
+    (a) => client.integrationHealth(a.cbid)
+  );
+  const provisionSchema = z3.object({
+    product: z3.string().describe("A slug naming the product."),
+    domain: z3.string().describe("The product\u2019s domain (bare hostname)."),
+    name: z3.string().optional(),
+    aliases: z3.array(z3.string()).optional(),
+    cbid: z3.string().optional().describe("Update this site instead of matching by domain."),
+    atlas: z3.object({ secretKey: z3.string(), cookieConsent: z3.boolean().optional(), dsrWebhook: z3.boolean().optional(), frontendApiHost: z3.string().optional().describe("Your Atlas frontend API host (auth.example.com): declares the Atlas sign-in cookies on the site.") }).optional().describe("Atlas secret key (sk_\u2026) \u2014 used for this call only, never stored or returned."),
+    forumulate: z3.object({ token: z3.string(), orgId: z3.string(), consent: z3.boolean().optional(), executorKey: z3.boolean().optional(), label: z3.string().optional() }).optional().describe("Forumulate org token \u2014 used for this call only, never stored or returned."),
+    rightsApi: z3.object({ baseUrl: z3.string(), secretKey: z3.string(), profilePreset: z3.string().optional() }).optional(),
+    dryRun: z3.boolean().optional().describe("Report what each step would do; write nothing on any platform. Run this first.")
+  });
+  tool(
+    "provision_product",
+    "Wire a product\u2019s privacy in one call: create or update the site, connected systems, the Atlas request-completion webhook and hosted-page consent banner, and Forumulate consent and executor key. Writes across three platforms; run with dryRun first. Idempotent: a re-run answers every step unchanged. No secret appears in the result.",
+    provisionSchema.shape,
+    (a) => {
+      const { dryRun, ...input } = provisionSchema.parse(a);
+      return client.provision(input, { dryRun });
+    }
+  );
+  tool(
+    "list_site_partners",
+    "Which partner platforms (Forumulate, Atlas) receive this site\u2019s consent events, each with its status, and which partners are on offer. Read-only.",
+    { cbid: z3.string() },
+    (a) => client.sites.listPartners(a.cbid)
+  );
+  const linkSchema = z3.object({
+    cbid: z3.string(),
+    partner: z3.enum(["forumulate", "atlas"]),
+    externalId: z3.string().describe("The partner\u2019s id for the receiving account, e.g. a Forumulate organisation id."),
+    label: z3.string().optional().describe('Shown with the partner name, e.g. "docs".'),
+    events: z3.array(z3.enum(["consent.recorded", "consent.withdrawn"])).optional(),
+    dryRun: z3.boolean().optional()
+  });
+  tool(
+    "link_site_partner",
+    "Grant a partner platform this site\u2019s consent events (they start flowing out to it). No secret is created: deliveries are signed with Cookie Munch\u2019s own key. Idempotent.",
+    linkSchema.shape,
+    (a) => {
+      const { cbid, dryRun, ...input } = linkSchema.parse(a);
+      return client.sites.linkPartner(cbid, input, { dryRun });
+    }
+  );
+  tool(
+    "unlink_site_partner",
+    "Revoke a partner link: no further consent events go to that partner.",
+    { cbid: z3.string(), linkId: z3.string() },
+    (a) => client.sites.unlinkPartner(a.cbid, a.linkId)
+  );
+}
+
+// src/tools-rights-page.ts
+import { z as z4 } from "zod";
 function registerRightsTools(tool, client) {
-  const cbid = { cbid: z3.string().describe("Site identifier (cbid). Must belong to your org.") };
+  const cbid = { cbid: z4.string().describe("Site identifier (cbid). Must belong to your org.") };
   const base = {
-    baseUpdatedAt: z3.union([z3.number().int(), z3.string(), z3.null()]).optional().describe("The draft\u2019s updatedAt from your last read (null if it had none). If someone saved since, the write is refused with 409 draft_conflict and the current draft; omit to overwrite regardless.")
+    baseUpdatedAt: z4.union([z4.number().int(), z4.string(), z4.null()]).optional().describe("The draft\u2019s updatedAt from your last read (null if it had none). If someone saved since, the write is refused with 409 draft_conflict and the current draft; omit to overwrite regardless.")
   };
   const baseOpt = (a) => a.baseUpdatedAt !== void 0 ? { baseUpdatedAt: a.baseUpdatedAt } : {};
   tool("get_rights_page", "Read the site\u2019s rights page DRAFT (the default page until first saved), with warnings that would block publishing.", cbid, (a) => client.rightsPage.get(a.cbid));
   tool(
     "update_rights_page",
     "Replace the rights page draft with a full document (theme, sections, form, i18n, seo, customCss). Nothing goes live until publish_rights_page. Prefer patch_rights_page for small changes and preview_rights_page when unsure. Pass baseUpdatedAt (from get_rights_page) to avoid overwriting someone else\u2019s save: a mismatch is 409 draft_conflict with the current draft.",
-    { ...cbid, page: z3.record(z3.unknown()).describe("The whole RightsPage document (v: 1)."), ...base },
+    { ...cbid, page: z4.record(z4.unknown()).describe("The whole RightsPage document (v: 1)."), ...base },
     (a) => client.rightsPage.put(a.cbid, a.page, baseOpt(a))
   );
   tool(
     "patch_rights_page",
     "Change part of the rights page draft: objects merge, arrays (sections, request types, fields) replace whole, null removes a field. baseUpdatedAt works as on update_rights_page (409 draft_conflict).",
-    { ...cbid, patch: z3.record(z3.unknown()), ...base },
+    { ...cbid, patch: z4.record(z4.unknown()), ...base },
     (a) => client.rightsPage.patch(a.cbid, a.patch, baseOpt(a))
   );
   tool(
     "preview_rights_page",
     'Validate a rights-page write WITHOUT saving: returns the document as it would be stored and any publish warnings. mode "patch" (default) or "put".',
-    { ...cbid, page: z3.record(z3.unknown()), mode: z3.enum(["patch", "put"]).optional() },
+    { ...cbid, page: z4.record(z4.unknown()), mode: z4.enum(["patch", "put"]).optional() },
     (a) => client.rightsPage.dryRun(a.cbid, a.page, { mode: a.mode ?? "patch" })
   );
   tool("get_published_rights_page", "Read the LIVE rights page document (404 not_published while the site shows the default page).", cbid, (a) => client.rightsPage.getPublished(a.cbid));
@@ -716,14 +820,14 @@ function registerRightsTools(tool, client) {
   tool(
     "rollback_rights_page",
     "Publish an earlier version of the rights page again (as a new version): it goes live at once and REPLACES the current draft, so unpublished edits are lost and cannot be recovered (versions hold only published documents). Pass baseUpdatedAt (from get_rights_page) to refuse with 409 draft_conflict if anyone saved the draft since you read it.",
-    { ...cbid, version: z3.number().int().min(1), ...base },
+    { ...cbid, version: z4.number().int().min(1), ...base },
     (a) => client.rightsPage.rollback(a.cbid, a.version, baseOpt(a))
   );
 }
 function registerRightsPageTools(tool, client) {
-  const site = z3.object({ cbid: z3.string().describe("Site identifier (cbid). Must belong to your org.") });
+  const site = z4.object({ cbid: z4.string().describe("Site identifier (cbid). Must belong to your org.") });
   const host = site.extend({
-    hostname: z3.string().describe("The custom hostname, e.g. privacy.example.com (unicode or punycode).")
+    hostname: z4.string().describe("The custom hostname, e.g. privacy.example.com (unicode or punycode).")
   });
   tool(
     "list_rights_page_domains",
@@ -863,10 +967,10 @@ function registerTools(server, client) {
       }
     });
   };
-  const cbid = { cbid: z4.string().describe("Site identifier (cbid). Must belong to your org.") };
+  const cbid = { cbid: z5.string().describe("Site identifier (cbid). Must belong to your org.") };
   const range = {
-    from: z4.number().optional().describe("Epoch-ms lower bound."),
-    to: z4.number().optional().describe("Epoch-ms upper bound.")
+    from: z5.number().optional().describe("Epoch-ms lower bound."),
+    to: z5.number().optional().describe("Epoch-ms upper bound.")
   };
   tool(
     "whoami",
@@ -884,19 +988,19 @@ function registerTools(server, client) {
   tool(
     "get_site",
     "One site: its domain, cbid and verification status. Read-only.",
-    { cbid: z4.string() },
+    { cbid: z5.string() },
     (a) => client.sites.get(a.cbid)
   );
   tool(
     "get_site_banner",
     "Which banner design a site uses, or bannerId null when none is assigned. Read-only.",
-    { cbid: z4.string() },
+    { cbid: z5.string() },
     (a) => client.sites.banner(a.cbid)
   );
   tool(
     "get_privacy_policy",
     "Generate the site's privacy and cookie policy as Markdown, naming the org's data controller. Needs a contact email: the one given, else the org controller's, else the owner's. Read-only \u2014 nothing is published.",
-    { cbid: z4.string(), contactEmail: z4.string().optional(), effectiveDate: z4.string().optional().describe("YYYY-MM-DD; defaults to today."), jurisdictions: z4.array(z4.string()).optional() },
+    { cbid: z5.string(), contactEmail: z5.string().optional(), effectiveDate: z5.string().optional().describe("YYYY-MM-DD; defaults to today."), jurisdictions: z5.array(z5.string()).optional() },
     (a) => client.sites.policy(a.cbid, {
       ...a.contactEmail ? { contactEmail: a.contactEmail } : {},
       ...a.effectiveDate ? { effectiveDate: a.effectiveDate } : {},
@@ -906,7 +1010,7 @@ function registerTools(server, client) {
   tool(
     "set_ad_personalization",
     "Add or remove the separate 'personalised ads' choice on the site's live banner. With it on, accepting marketing no longer implies personalised ads unless `default` is true.",
-    { cbid: z4.string(), enabled: z4.boolean(), default: z4.boolean().optional(), label: z4.string().optional() },
+    { cbid: z5.string(), enabled: z5.boolean(), default: z5.boolean().optional(), label: z5.string().optional() },
     (a) => client.sites.setAdPersonalization(a.cbid, {
       enabled: a.enabled,
       ...a.default !== void 0 ? { default: a.default } : {},
@@ -917,11 +1021,11 @@ function registerTools(server, client) {
     "analyze_session",
     "Analyse a captured browsing session against the consent it ran under: which trackers fired after the visitor opted out, and what personal data left the page. Read-only.",
     {
-      cbid: z4.string(),
-      har: z4.unknown().optional().describe("A HAR export of the session."),
-      requests: z4.array(z4.unknown()).optional().describe("Or the requests directly."),
-      consent: z4.record(z4.string(), z4.boolean()).optional(),
-      gpc: z4.boolean().optional()
+      cbid: z5.string(),
+      har: z5.unknown().optional().describe("A HAR export of the session."),
+      requests: z5.array(z5.unknown()).optional().describe("Or the requests directly."),
+      consent: z5.record(z5.string(), z5.boolean()).optional(),
+      gpc: z5.boolean().optional()
     },
     (a) => client.sites.analyzeSession(a.cbid, {
       ...a.har !== void 0 ? { har: a.har } : {},
@@ -933,14 +1037,14 @@ function registerTools(server, client) {
   tool(
     "create_site",
     "Create a new site. The cbid is auto-generated if you omit it.",
-    { domain: z4.string().describe("The site domain, e.g. example.com."), cbid: z4.string().optional().describe("Optional explicit cbid.") },
+    { domain: z5.string().describe("The site domain, e.g. example.com."), cbid: z5.string().optional().describe("Optional explicit cbid.") },
     (a) => client.sites.create({ domain: a.domain, ...typeof a.cbid === "string" ? { cbid: a.cbid } : {} })
   );
   tool(
     "create_sites_bulk",
     "Create up to 100 sites in one call. Partial success: each item reports ok or its own error, and a bad or duplicate item fails only itself.",
     {
-      sites: z4.array(z4.object({ domain: z4.string(), cbid: z4.string().optional(), platform: z4.string().optional() })).min(1).max(100)
+      sites: z5.array(z5.object({ domain: z5.string(), cbid: z5.string().optional(), platform: z5.string().optional() })).min(1).max(100)
     },
     (a) => client.sites.createBulk(a.sites)
   );
@@ -950,15 +1054,15 @@ function registerTools(server, client) {
     "Replace (overwrite) the banner/consent configuration for a site via PUT. This is destructive, not a merge: any top-level SiteConfig field you omit from `config` reverts to its default rather than keeping its current value \u2014 unless keepUnspecified is true, in which case omitted top-level fields keep their stored value and only the fields you send are replaced (each whole). A top-level field sent as null reverts to its default. To change one setting, use patch_site_config instead \u2014 it merges server-side. Prefer the narrower set_* tools (set_blocking, set_banner_basics, etc.) when they cover your change.",
     {
       ...cbid,
-      config: z4.record(z4.unknown()).describe("The full SiteConfig to write, not a patch. Without keepUnspecified, omitted top-level fields are NOT preserved from the current config."),
-      keepUnspecified: z4.boolean().optional().describe("PUT ?keep=unspecified: keep the stored value of every top-level field `config` omits, instead of reverting it to its default.")
+      config: z5.record(z5.unknown()).describe("The full SiteConfig to write, not a patch. Without keepUnspecified, omitted top-level fields are NOT preserved from the current config."),
+      keepUnspecified: z5.boolean().optional().describe("PUT ?keep=unspecified: keep the stored value of every top-level field `config` omits, instead of reverting it to its default.")
     },
     (a) => a.keepUnspecified === true ? client.sites.putConfig(a.cbid, a.config, { keep: "unspecified" }) : client.sites.putConfig(a.cbid, a.config)
   );
   tool(
     "patch_site_config",
     `Change part of a site's banner/consent configuration. The patch is a JSON Merge Patch (RFC 7386) over the stored config server-side: any field you omit keeps its current value, and a field set to null is REMOVED (it falls back to its default) \u2014 e.g. { "banner": { "i18n": { "es": null } } } drops the Spanish override. This is the safe way to flip one setting, and it needs no read-modify-write. Use update_site_config only when you genuinely mean to replace the whole document.`,
-    { ...cbid, config: z4.record(z4.unknown()).describe('The subset of SiteConfig to change, e.g. { "banner": { "showRightsLink": true } }. Everything else is preserved; null removes a field.') },
+    { ...cbid, config: z5.record(z5.unknown()).describe('The subset of SiteConfig to change, e.g. { "banner": { "showRightsLink": true } }. Everything else is preserved; null removes a field.') },
     (a) => client.sites.patchConfig(a.cbid, a.config)
   );
   tool(
@@ -966,9 +1070,9 @@ function registerTools(server, client) {
     'Preview a config change WITHOUT saving it: returns the config as it would be saved, a diff of every field that would change, and any warnings (plan-gated or unrecognised fields). mode "patch" (default) previews patch_site_config; mode "put" previews update_site_config, and its diff lists everything a replace would revert to its default (unless keepUnspecified is true). Use it before any write you are not sure of.',
     {
       ...cbid,
-      config: z4.record(z4.unknown()).describe('The patch (or, with mode "put", the full config) to preview.'),
-      mode: z4.enum(["patch", "put"]).optional().describe("patch (default) merges; put replaces."),
-      keepUnspecified: z4.boolean().optional().describe('With mode "put": preview update_site_config with keepUnspecified (omitted top-level fields keep their stored value).')
+      config: z5.record(z5.unknown()).describe('The patch (or, with mode "put", the full config) to preview.'),
+      mode: z5.enum(["patch", "put"]).optional().describe("patch (default) merges; put replaces."),
+      keepUnspecified: z5.boolean().optional().describe('With mode "put": preview update_site_config with keepUnspecified (omitted top-level fields keep their stored value).')
     },
     (a) => client.sites.dryRunConfig(a.cbid, a.config, {
       mode: a.mode ?? "patch",
@@ -980,8 +1084,8 @@ function registerTools(server, client) {
     'Check a banner config for consent-button parity WITHOUT saving it: is "Accept all" more prominent than "Reject all" anywhere \u2014 a brighter or more saturated colour, a bigger or bolder button, Reject styled as a link, hidden, below the fold, set apart, missing from the first layer, or worded to guilt-trip? Regulators (EDPB, CNIL) treat that as a dark pattern. Returns findings, a 0\u2013100 score and the reject style that would match Accept. It checks exactly what the write would store: merged over the stored config as patch_site_config would, or with replace: true replaced as update_site_config would. Run it before writing any banner design.',
     {
       ...cbid,
-      config: z4.record(z4.unknown()).describe("The proposed SiteConfig (or a partial one, or a v2 flow design)."),
-      replace: z4.boolean().optional().describe("Check what update_site_config (a full replace) would store, instead of what patch_site_config (a merge) would.")
+      config: z5.record(z5.unknown()).describe("The proposed SiteConfig (or a partial one, or a v2 flow design)."),
+      replace: z5.boolean().optional().describe("Check what update_site_config (a full replace) would store, instead of what patch_site_config (a merge) would.")
     },
     async (a) => {
       const r = await client.sites.lintConfig(a.cbid, a.config, a.replace === true ? { replace: true } : {});
@@ -1005,7 +1109,7 @@ ${JSON.stringify(r, null, 2)}` : r;
   tool(
     "get_consent_log",
     "Get recent anonymised consent records for a site.",
-    { ...cbid, ...range, limit: z4.number().optional().describe("Max records to return (default 200).") },
+    { ...cbid, ...range, limit: z5.number().optional().describe("Max records to return (default 200).") },
     (a) => client.consent.log(a.cbid, {
       from: a.from,
       to: a.to,
@@ -1015,7 +1119,7 @@ ${JSON.stringify(r, null, 2)}` : r;
   tool(
     "get_subject_consent",
     "One person's consent records across every site in the org \u2014 web, mobile and desktop \u2014 by the subjectId your apps attach. Consent data: needs the consent:read scope. Read-only.",
-    { subjectId: z4.string() },
+    { subjectId: z5.string() },
     (a) => client.subjects.consent(a.subjectId)
   );
   tool("list_dsar", "List all Data Subject Access Requests for your organization.", {}, () => client.dsar.list());
@@ -1023,51 +1127,53 @@ ${JSON.stringify(r, null, 2)}` : r;
     "update_dsar_executor",
     "Change a connected system in place \u2014 its profile, address, credential or auto flag. Only what you pass changes; the stored credential is kept unless you give a new one. With dryRun, answers the connection as it would be and a diff, and changes nothing.",
     {
-      id: z4.string(),
-      patch: z4.record(z4.unknown()),
-      dryRun: z4.boolean().optional().describe("Validate and diff without saving.")
+      id: z5.string(),
+      patch: z5.record(z5.unknown()),
+      dryRun: z5.boolean().optional().describe("Validate and diff without saving.")
     },
     (a) => a.dryRun === true ? client.fulfillment.dryRunUpdateExecutor(a.id, a.patch) : client.fulfillment.updateExecutor(a.id, a.patch)
   );
   tool(
     "get_dsar",
     "One rights request by id, including its status and the deadline it must be answered by.",
-    { id: z4.string() },
+    { id: z5.string() },
     (a) => client.dsar.get(a.id)
   );
   tool(
     "erase_dsar_subject",
     "For a deletion request that is past identity verification: erase the person\u2019s consent records on one site, identified by their consent stamp. Irreversible. The erasure is noted on the request. If the response carries a warning, nothing was cryptographically erased \u2014 tell the user.",
-    { id: z4.string(), cbid: z4.string(), stamp: z4.string() },
+    { id: z5.string(), cbid: z5.string(), stamp: z5.string() },
     (a) => client.dsar.erase(a.id, a.cbid, a.stamp)
   );
   tool(
     "export_dsar_subject",
     "For an access or portability request that is past identity verification: the person\u2019s consent records on one site, identified by their consent stamp. The export is noted on the request.",
-    { id: z4.string(), cbid: z4.string(), stamp: z4.string() },
+    { id: z5.string(), cbid: z5.string(), stamp: z5.string() },
     (a) => client.dsar.export(a.id, a.cbid, a.stamp)
   );
   tool(
     "get_dsar_response_notice",
     "The subject-facing response notice for a request, as plain text \u2014 what to send the person. Read-only; nothing is sent.",
-    { id: z4.string() },
+    { id: z5.string() },
     (a) => client.dsar.response(a.id)
   );
   tool(
     "create_dsar",
     "Open a new Data Subject Access Request.",
     {
-      type: z4.enum(["access", "deletion", "rectification", "portability", "opt-out"]).describe("DSAR right being exercised."),
-      subjectEmail: z4.string().describe("The data subject\u2019s email."),
-      regulation: z4.enum(["gdpr", "ccpa"]).describe("Governing regulation."),
-      note: z4.string().optional().describe("Optional free-text note."),
-      test: z4.boolean().optional().describe("Mark it as a test request: kept off the SLA board and deletable afterwards with delete_test_dsar.")
+      type: z5.enum(["access", "deletion", "rectification", "portability", "opt-out"]).describe("DSAR right being exercised."),
+      subjectEmail: z5.string().describe("The data subject\u2019s email."),
+      regulation: z5.enum(["gdpr", "ccpa"]).describe("Governing regulation."),
+      note: z5.string().optional().describe("Optional INTERNAL note; never shown to the data subject."),
+      messageToSubject: z5.string().max(2e3).optional().describe("The line the data subject reads in the response notice. Never an API key."),
+      test: z5.boolean().optional().describe("Mark it as a test request: kept off the SLA board and deletable afterwards with delete_test_dsar.")
     },
     (a) => client.dsar.create({
       type: a.type,
       subjectEmail: a.subjectEmail,
       regulation: a.regulation,
       ...typeof a.note === "string" ? { note: a.note } : {},
+      ...typeof a.messageToSubject === "string" ? { messageToSubject: a.messageToSubject } : {},
       ...a.test === true ? { test: true } : {}
     })
   );
@@ -1075,11 +1181,11 @@ ${JSON.stringify(r, null, 2)}` : r;
     "create_rights_link",
     "Mint a signed, single-use link to a site\u2019s hosted rights page for a person you know is signed in to that site. On the page their email is filled in and locked and the email-code step is skipped; the filed request is recorded as verified by their account. Give the link only to that person. Expires in 15 minutes by default (max 1 hour). Needs dsar:write.",
     {
-      cbid: z4.string().describe("Site identifier (cbid). Must belong to your org."),
-      email: z4.string().describe("The signed-in person\u2019s verified email address."),
-      userId: z4.string().optional().describe("Your own account id for them; recorded on the request."),
-      rights: z4.array(z4.enum(["access", "erasure", "rectification", "portability", "restriction", "objection", "opt_out_sale", "opt_out_targeted", "limit_sensitive"])).min(1).optional().describe("Limit the link to these rights. Default: every right the page offers."),
-      ttlSeconds: z4.number().int().min(60).max(3600).optional().describe("How long the link works, in seconds (default 900).")
+      cbid: z5.string().describe("Site identifier (cbid). Must belong to your org."),
+      email: z5.string().describe("The signed-in person\u2019s verified email address."),
+      userId: z5.string().optional().describe("Your own account id for them; recorded on the request."),
+      rights: z5.array(z5.enum(["access", "erasure", "rectification", "portability", "restriction", "objection", "opt_out_sale", "opt_out_targeted", "limit_sensitive"])).min(1).optional().describe("Limit the link to these rights. Default: every right the page offers."),
+      ttlSeconds: z5.number().int().min(60).max(3600).optional().describe("How long the link works, in seconds (default 900).")
     },
     (a) => client.rightsLinks.create(a.cbid, {
       subject: { email: a.email, ...typeof a.userId === "string" ? { userId: a.userId } : {} },
@@ -1090,7 +1196,7 @@ ${JSON.stringify(r, null, 2)}` : r;
   tool(
     "delete_test_dsar",
     "Delete a TEST rights request (one created with test: true), with its tasks and their upstream log. Real requests cannot be deleted and are refused. The deletion is recorded in the audit log.",
-    { id: z4.string().describe("The test request id.") },
+    { id: z5.string().describe("The test request id.") },
     async (a) => {
       await client.dsar.delete(a.id);
       return { deleted: a.id };
@@ -1099,17 +1205,18 @@ ${JSON.stringify(r, null, 2)}` : r;
   tool(
     "mark_dsar_test",
     "Mark a CLOSED rights request (completed or rejected) as a test request, after the fact \u2014 for trial requests filed before test: true existed. An open request is refused (request_not_closed), so a live obligation can never be relabelled. Recorded in the audit log; afterwards delete_test_dsar can remove it. Returns { request, changed }.",
-    { id: z4.string().describe("The closed request id.") },
+    { id: z5.string().describe("The closed request id.") },
     (a) => client.dsar.markTest(a.id)
   );
   tool(
     "advance_dsar",
     "Advance a DSAR to a new status (received \u2192 verifying \u2192 in_progress \u2192 completed, or rejected).",
     {
-      id: z4.string().describe("The DSAR id."),
-      toStatus: z4.enum(["received", "verifying", "in_progress", "completed", "rejected"]).describe("Target status.")
+      id: z5.string().describe("The DSAR id."),
+      toStatus: z5.enum(["received", "verifying", "in_progress", "completed", "rejected"]).describe("Target status."),
+      messageToSubject: z5.string().max(2e3).optional().describe("Replaces the line the data subject reads in the notice \u2014 for a rejection, why.")
     },
-    (a) => client.dsar.advance(a.id, a.toStatus)
+    (a) => typeof a.messageToSubject === "string" ? client.dsar.advance(a.id, a.toStatus, { messageToSubject: a.messageToSubject }) : client.dsar.advance(a.id, a.toStatus)
   );
   tool(
     "export_consent",
@@ -1120,7 +1227,7 @@ ${JSON.stringify(r, null, 2)}` : r;
   tool(
     "get_receipt",
     "Fetch the signed consent receipt for a single consent record (by stamp).",
-    { ...cbid, stamp: z4.string().describe("The consent record stamp/id.") },
+    { ...cbid, stamp: z5.string().describe("The consent record stamp/id.") },
     (a) => client.consent.receipt(a.cbid, a.stamp)
   );
   tool("delete_site", "Delete a site (cbid) and its configuration from your org.", { ...cbid }, async (a) => {
@@ -1132,13 +1239,13 @@ ${JSON.stringify(r, null, 2)}` : r;
     "create_vendor",
     "Register a vendor (processor) and compute its risk score.",
     {
-      name: z4.string().describe("Vendor name."),
-      category: z4.string().describe("Vendor category, e.g. analytics."),
-      dataShared: z4.array(z4.string()).describe("Categories of data shared with the vendor."),
-      dpaSigned: z4.boolean().describe("Whether a Data Processing Agreement is signed."),
-      subprocessors: z4.number().describe("Number of subprocessors."),
-      certifications: z4.array(z4.string()).describe("Compliance certifications, e.g. ISO27001."),
-      region: z4.string().describe("Primary processing region, e.g. EU.")
+      name: z5.string().describe("Vendor name."),
+      category: z5.string().describe("Vendor category, e.g. analytics."),
+      dataShared: z5.array(z5.string()).describe("Categories of data shared with the vendor."),
+      dpaSigned: z5.boolean().describe("Whether a Data Processing Agreement is signed."),
+      subprocessors: z5.number().describe("Number of subprocessors."),
+      certifications: z5.array(z5.string()).describe("Compliance certifications, e.g. ISO27001."),
+      region: z5.string().describe("Primary processing region, e.g. EU.")
     },
     (a) => client.vendors.create({
       name: a.name,
@@ -1156,13 +1263,13 @@ ${JSON.stringify(r, null, 2)}` : r;
     "create_ropa",
     "Create a Record of Processing Activity (RoPA) entry.",
     {
-      name: z4.string().describe("Activity name."),
-      purpose: z4.string().describe("Purpose of processing."),
-      legalBasis: z4.enum(["consent", "contract", "legal-obligation", "vital-interests", "public-task", "legitimate-interests"]).describe("GDPR legal basis."),
-      dataCategories: z4.array(z4.string()).describe("Categories of personal data."),
-      recipients: z4.array(z4.string()).describe("Recipients of the data."),
-      retentionDays: z4.number().describe("Retention period in days."),
-      crossBorderTransfer: z4.boolean().describe("Whether data is transferred across borders.")
+      name: z5.string().describe("Activity name."),
+      purpose: z5.string().describe("Purpose of processing."),
+      legalBasis: z5.enum(["consent", "contract", "legal-obligation", "vital-interests", "public-task", "legitimate-interests"]).describe("GDPR legal basis."),
+      dataCategories: z5.array(z5.string()).describe("Categories of personal data."),
+      recipients: z5.array(z5.string()).describe("Recipients of the data."),
+      retentionDays: z5.number().describe("Retention period in days."),
+      crossBorderTransfer: z5.boolean().describe("Whether data is transferred across borders.")
     },
     (a) => client.ropa.create({
       name: a.name,
@@ -1182,15 +1289,23 @@ ${JSON.stringify(r, null, 2)}` : r;
   );
   tool(
     "scan_site",
-    "Trigger a cookie scan for a site. Returns the scan job state.",
-    { ...cbid },
-    (a) => client.sites.scan(a.cbid)
+    "Trigger a cookie crawl of a site (at most 90 s). Returns its scanId and state (queued). With wait: true, returns once it is done or failed \u2014 state, cookieCount, pagesVisited, durationMs, error. The stored list keeps cookies earlier crawls and real visits found; retire one the site no longer sets.",
+    { ...cbid, wait: z5.boolean().optional().describe("Wait for the scan to finish (up to 100 s) and return its outcome.") },
+    async (a) => {
+      let started;
+      try {
+        started = await client.sites.scan(a.cbid);
+      } catch (err) {
+        if (!a.wait || err.status !== 409) throw err;
+      }
+      return a.wait ? client.sites.waitForScan(a.cbid, { timeoutMs: 1e5 }) : started;
+    }
   );
   tool(
     "get_scan_status",
-    "Get the status/result of a site\u2019s most recent cookie scan.",
-    { ...cbid },
-    (a) => client.sites.scanStatus(a.cbid)
+    "Get a site\u2019s last cookie scan: state (queued, scanning, done, failed), scanId, durationMs, cookieCount, pagesVisited and error when it failed.",
+    { ...cbid, wait: z5.number().min(0).max(60).optional().describe("Seconds (\u226460) to wait for a running scan to settle before answering.") },
+    (a) => a.wait !== void 0 ? client.sites.scanStatus(a.cbid, { wait: a.wait }) : client.sites.scanStatus(a.cbid)
   );
   tool(
     "get_ab_results",
@@ -1201,16 +1316,25 @@ ${JSON.stringify(r, null, 2)}` : r;
   tool("list_brand_kits", "List reusable brand kits (colors/logo/typography) for your org.", {}, () => client.brandKits.list());
   tool("list_preferences", "List configurable consent preferences/purposes for your org.", {}, () => client.preferences.list());
   tool("list_members", "List the members of your organization.", {}, () => client.members.list());
-  tool("list_api_keys", "List the API keys for your organization (secrets are not returned).", {}, () => client.keys.list());
+  tool("list_api_keys", "List the API keys for your organization (secrets are not returned), with each key\u2019s scopes, expiry and when it was last used.", {}, () => client.keys.list());
+  tool(
+    "api_key_report",
+    "Key hygiene: keys not used for a while, keys with broad (full or wide write) access, and keys expiring soon, each with the reason. Read-only.",
+    {
+      unusedDays: z5.number().int().min(1).max(3650).optional().describe("Unused for at least this many days (default 90)."),
+      expiringDays: z5.number().int().min(1).max(3650).optional().describe("Expiring within this many days (default 14).")
+    },
+    (a) => client.keys.report({ ...a.unusedDays !== void 0 ? { unusedDays: a.unusedDays } : {}, ...a.expiringDays !== void 0 ? { expiringDays: a.expiringDays } : {} })
+  );
   tool("get_usage", "Get the current usage/quota summary for your organization.", {}, () => client.usage());
   tool("list_webhooks", "List webhook subscriptions for your organization.", {}, () => client.webhooks.list());
   tool(
     "create_webhook",
     "Create a webhook subscription. The response includes the signing secret (shown once).",
     {
-      url: z4.string().describe("HTTPS endpoint to deliver events to."),
-      events: z4.array(z4.string()).describe("Event names to subscribe to, e.g. consent.created."),
-      cbid: z4.string().optional().describe("Optional site cbid to scope the subscription to.")
+      url: z5.string().describe("HTTPS endpoint to deliver events to."),
+      events: z5.array(z5.string()).describe("Event names to subscribe to, e.g. consent.created."),
+      cbid: z5.string().optional().describe("Optional site cbid to scope the subscription to.")
     },
     (a) => client.webhooks.create({
       url: a.url,
@@ -1221,13 +1345,13 @@ ${JSON.stringify(r, null, 2)}` : r;
   tool(
     "roll_webhook_secret",
     "Rotate a webhook subscription\u2019s signing secret. The new secret is returned once; the receiving endpoint must be updated to verify with it.",
-    { id: z4.string() },
+    { id: z5.string() },
     (a) => client.webhooks.rollSecret(a.id)
   );
   tool(
     "test_webhook",
     "Send a signed test event to a webhook subscription now, and report what the endpoint answered.",
-    { id: z4.string() },
+    { id: z5.string() },
     (a) => client.webhooks.test(a.id)
   );
   tool(
@@ -1239,18 +1363,18 @@ ${JSON.stringify(r, null, 2)}` : r;
   tool(
     "replay_webhook_dead_letter",
     "Deliver a dead-lettered webhook event again, to the subscription as it is now.",
-    { id: z4.string() },
+    { id: z5.string() },
     (a) => client.webhooks.replayDeadLetter(a.id)
   );
   tool(
     "update_webhook",
     "Change a webhook subscription, or pause it with active:false (delivery stops; the subscription is kept). Only the fields given change. cbid: null widens it to every property in the org.",
     {
-      id: z4.string(),
-      url: z4.string().optional(),
-      events: z4.array(z4.string()).optional(),
-      cbid: z4.string().nullable().optional(),
-      active: z4.boolean().optional()
+      id: z5.string(),
+      url: z5.string().optional(),
+      events: z5.array(z5.string()).optional(),
+      cbid: z5.string().nullable().optional(),
+      active: z5.boolean().optional()
     },
     (a) => client.webhooks.update(a.id, {
       ...a.url !== void 0 ? { url: a.url } : {},
@@ -1259,20 +1383,20 @@ ${JSON.stringify(r, null, 2)}` : r;
       ...a.active !== void 0 ? { active: a.active } : {}
     })
   );
-  tool("delete_webhook", "Delete a webhook subscription by id.", { id: z4.string().describe("The webhook subscription id.") }, async (a) => {
+  tool("delete_webhook", "Delete a webhook subscription by id.", { id: z5.string().describe("The webhook subscription id.") }, async (a) => {
     await client.webhooks.delete(a.id);
     return { ok: true };
   });
   tool(
     "verify_site",
     "Verify that your organization controls a domain by one of three challenge methods (dns / meta / file). Required to unlock consent export and signed receipts.",
-    { ...cbid, method: z4.enum(["dns", "meta", "file"]).describe("Challenge method: dns (TXT record), meta (HTML tag), or file (/.well-known/cookiemunch-verify.txt).") },
+    { ...cbid, method: z5.enum(["dns", "meta", "file"]).describe("Challenge method: dns (TXT record), meta (HTML tag), or file (/.well-known/cookiemunch-verify.txt).") },
     (a) => client.sites.verify(a.cbid, a.method)
   );
   tool(
     "get_verification_challenge",
     "Exactly what to publish to prove control of a site\u2019s domain: the DNS TXT record, the meta tag, the file, or installing the embed. Read-only \u2014 publish one, then call verify_site.",
-    { cbid: z4.string() },
+    { cbid: z5.string() },
     (a) => client.sites.verifyChallenge(a.cbid)
   );
   tool(
@@ -1284,15 +1408,15 @@ ${JSON.stringify(r, null, 2)}` : r;
   tool(
     "get_flow",
     "Get the v2 banner flow config for a site, including current views, categories, and any lint issues.",
-    { cbid: z4.string().describe("Site identifier (cbid).") },
+    { cbid: z5.string().describe("Site identifier (cbid).") },
     (a) => client.sites.getFlow(a.cbid)
   );
   tool(
     "edit_flow",
     "Apply a batch of structured edit operations to a site's v2 banner flow. All ops are validated server-side and the final config must be lint-clean before it is saved.",
     {
-      cbid: z4.string().describe("Site identifier (cbid)."),
-      operations: z4.array(z4.record(z4.unknown())).describe(
+      cbid: z5.string().describe("Site identifier (cbid)."),
+      operations: z5.array(z5.record(z5.unknown())).describe(
         'Ordered list of ops. Each must have an "op" field: addView | removeView | addElement | setButtonTransition | addCustomCategory.'
       )
     },
@@ -1302,21 +1426,22 @@ ${JSON.stringify(r, null, 2)}` : r;
     "set_flow",
     "Wholesale replace a site's v2 banner flow with a complete config (e.g. from a template). Validated server-side before it is saved.",
     {
-      cbid: z4.string().describe("Site identifier (cbid)."),
-      config: z4.record(z4.unknown()).describe("A full v2 FlowConfig object ({ v:2, flow, categories, ... }).")
+      cbid: z5.string().describe("Site identifier (cbid)."),
+      config: z5.record(z5.unknown()).describe("A full v2 FlowConfig object ({ v:2, flow, categories, ... }).")
     },
     (a) => client.sites.setFlow(a.cbid, a.config)
   );
   registerConfigTools(tool, client);
   registerPlatformTools(tool, client);
+  registerIntegrationTools(tool, client);
   registerRightsTools(tool, client);
   registerRightsPageTools(tool, client);
   tool(
     "invite_member",
     "Invite a person to your organization by email. role must be admin, member, or viewer. The org is derived from the API key \u2014 you cannot invite into a different org.",
     {
-      email: z4.string().describe("Email address of the person to invite."),
-      role: z4.enum(["admin", "member", "viewer"]).describe("Role to assign: admin, member, or viewer. owner is not assignable via API key.")
+      email: z5.string().describe("Email address of the person to invite."),
+      role: z5.enum(["admin", "member", "viewer"]).describe("Role to assign: admin, member, or viewer. owner is not assignable via API key.")
     },
     (a) => client.members.invite(a.email, a.role)
   );
@@ -1324,8 +1449,8 @@ ${JSON.stringify(r, null, 2)}` : r;
     "set_member_role",
     "Change the role of a member in your organization. The org owner's role cannot be changed.",
     {
-      userId: z4.string().describe("The userId of the member whose role to change."),
-      role: z4.enum(["admin", "member", "viewer"]).describe("New role: admin, member, or viewer.")
+      userId: z5.string().describe("The userId of the member whose role to change."),
+      role: z5.enum(["admin", "member", "viewer"]).describe("New role: admin, member, or viewer.")
     },
     (a) => client.members.setRole(a.userId, a.role)
   );
@@ -1333,7 +1458,7 @@ ${JSON.stringify(r, null, 2)}` : r;
     "remove_member",
     "Remove a member from your organization. The org owner cannot be removed.",
     {
-      userId: z4.string().describe("The userId of the member to remove.")
+      userId: z5.string().describe("The userId of the member to remove.")
     },
     async (a) => {
       await client.members.remove(a.userId);
@@ -1344,11 +1469,11 @@ ${JSON.stringify(r, null, 2)}` : r;
     "create_brand_kit",
     "Create a reusable brand kit (colors, logo, typography) for your organization's consent banners.",
     {
-      name: z4.string().describe("Display name for the brand kit."),
-      theme: z4.record(z4.unknown()).describe("Theme tokens (colors, fonts, etc.) as a JSON object."),
-      content: z4.record(z4.unknown()).optional().describe("Optional banner copy overrides."),
-      logoUrl: z4.string().optional().describe("Optional URL for your org logo."),
-      customCss: z4.string().optional().describe("Optional custom CSS string to inject into the banner.")
+      name: z5.string().describe("Display name for the brand kit."),
+      theme: z5.record(z5.unknown()).describe("Theme tokens (colors, fonts, etc.) as a JSON object."),
+      content: z5.record(z5.unknown()).optional().describe("Optional banner copy overrides."),
+      logoUrl: z5.string().optional().describe("Optional URL for your org logo."),
+      customCss: z5.string().optional().describe("Optional custom CSS string to inject into the banner.")
     },
     (a) => client.brandKits.create({
       name: a.name,
@@ -1362,7 +1487,7 @@ ${JSON.stringify(r, null, 2)}` : r;
     "delete_brand_kit",
     "Delete a brand kit by id. The kit must belong to your organization (cross-org deletes are rejected).",
     {
-      id: z4.string().describe("The brand kit id to delete.")
+      id: z5.string().describe("The brand kit id to delete.")
     },
     async (a) => {
       await client.brandKits.delete(a.id);
@@ -1373,63 +1498,65 @@ ${JSON.stringify(r, null, 2)}` : r;
     "save_preference",
     "Save or update the consent preferences for an end-user (by subjectId) within your organization. purposes is a map of purpose-name \u2192 boolean.",
     {
-      subjectId: z4.string().describe("The end-user identifier (e.g. email or internal user id)."),
-      purposes: z4.record(z4.boolean()).describe('Map of purpose names to consent values, e.g. { "newsletter": true, "analytics": false }.')
+      subjectId: z5.string().describe("The end-user identifier (e.g. email or internal user id)."),
+      purposes: z5.record(z5.boolean()).describe('Map of purpose names to consent values, e.g. { "newsletter": true, "analytics": false }.')
     },
     (a) => client.preferences.save(a.subjectId, a.purposes)
   );
   tool(
     "get_preference",
     "One end-user\u2019s saved preferences, by subjectId. Read-only.",
-    { subjectId: z4.string() },
+    { subjectId: z5.string() },
     (a) => client.preferences.get(a.subjectId)
   );
   tool(
     "issue_api_key",
     "Issue a new API key. The secret is returned once and never again. Prefer the least privilege the job needs: `scopes` limits what it can do, `cbids` locks it to specific sites (it then cannot reach anything org-wide), `expiresInDays` retires it. Omitting all three mints a full-access, org-wide, non-expiring key.",
     {
-      name: z4.string().optional(),
-      scopes: z4.array(z4.string()).optional(),
-      cbids: z4.array(z4.string()).min(1).optional(),
-      expiresInDays: z4.number().int().min(1).max(3650).optional()
+      name: z5.string().optional(),
+      scopes: z5.array(z5.string()).optional(),
+      cbids: z5.array(z5.string()).min(1).optional(),
+      expiresInDays: z5.number().int().min(1).max(3650).optional(),
+      expiresAt: z5.string().optional().describe("Or the exact expiry, an ISO date-time (not with expiresInDays).")
     },
     (a) => client.keys.issue({
+      ...a.expiresAt ? { expiresAt: a.expiresAt } : {},
       ...a.name ? { name: a.name } : {},
       ...a.scopes ? { scopes: a.scopes } : {},
       ...a.cbids ? { cbids: a.cbids } : {},
       ...a.expiresInDays !== void 0 ? { expiresInDays: a.expiresInDays } : {}
     })
   );
-  tool("revoke_api_key", "Revoke an API key by its prefix. Takes effect immediately; anything using that key stops working.", { prefix: z4.string() }, async (a) => {
+  tool("revoke_api_key", "Revoke an API key by its prefix. Takes effect immediately; anything using that key stops working.", { prefix: z5.string() }, async (a) => {
     await client.keys.revoke(a.prefix);
     return { revoked: a.prefix };
   });
   tool(
     "import_cookie_declaration",
     "Read a cookie declaration exported from another CMP (OneTrust, Cookiebot, CookieYes, or any CSV/JSON with the same columns) and translate its categories into ours. Nothing is applied \u2014 it comes back for review, with the rows whose category could not be placed listed separately.",
-    { cbid: z4.string(), data: z4.string().describe("The exported file, as text (CSV or JSON).") },
+    { cbid: z5.string(), data: z5.string().describe("The exported file, as text (CSV or JSON).") },
     (a) => client.sites.importDeclaration(a.cbid, a.data)
   );
   tool(
     "apply_cookie_import",
     "Import a cookie declaration exported from another CMP AND declare it: every row whose category mapped to ours and that has a purpose becomes a site declaration; the rest come back in `skipped` with the reason. Cookies the site already declared are kept unless overwrite is true. Prefer import_cookie_declaration first to review.",
-    { cbid: z4.string(), data: z4.string().describe("The exported file, as text (CSV or JSON)."), overwrite: z4.boolean().optional() },
+    { cbid: z5.string(), data: z5.string().describe("The exported file, as text (CSV or JSON)."), overwrite: z5.boolean().optional() },
     (a) => client.sites.applyImport(a.cbid, a.data, a.overwrite ? { overwrite: true } : void 0)
   );
   const declarationShape = {
-    category: z4.string().describe("necessary, preferences, statistics, marketing, or one of the site\u2019s categories.custom ids."),
-    purpose: z4.string().describe("What the cookie does, as visitors will read it \u2014 and the fallback for any language purposes lacks."),
-    purposes: z4.record(z4.string(), z4.string().max(1e3)).nullable().optional().describe('The purpose in other languages, keyed by BCP-47 tag: {"es": "\u2026", "pt-BR": "\u2026"}. The banner, data-cc="declaration" and cookie-declaration.js draw the visitor\u2019s language. null clears.'),
-    provider: z4.string().optional(),
-    expiry: z4.string().optional().describe('e.g. "Session", "30 days", "1 year" (the banner localises these forms).'),
-    domain: z4.string().optional(),
-    pattern: z4.boolean().optional().describe("Treat the name as a prefix wildcard (a trailing * does the same).")
+    category: z5.string().describe("necessary, preferences, statistics, marketing, or one of the site\u2019s categories.custom ids."),
+    purpose: z5.string().describe("What the cookie does, as visitors will read it \u2014 and the fallback for any language purposes lacks."),
+    purposes: z5.record(z5.string(), z5.string().max(1e3)).nullable().optional().describe('The purpose in other languages, keyed by BCP-47 tag: {"es": "\u2026", "pt-BR": "\u2026"}. The banner, data-cc="declaration" and cookie-declaration.js draw the visitor\u2019s language. null clears.'),
+    provider: z5.string().optional(),
+    expiry: z5.string().optional().describe('e.g. "Session", "30 days", "1 year" (the banner localises these forms).'),
+    domain: z5.string().optional(),
+    pattern: z5.boolean().optional().describe("Treat the name as a prefix wildcard (a trailing * does the same).")
   };
-  const dryRunArg = z4.boolean().optional().describe("Store nothing: answer with the would-be declarations and a diff (added / removed / changed) to check first.");
+  const dryRunArg = z5.boolean().optional().describe("Store nothing: answer with the would-be declarations and a diff (added / removed / changed) to check first.");
   tool(
     "declare_cookie",
     'Declare what one of the site\u2019s cookies is. Overrides the scanner, observed visits and the cookie database everywhere the declaration is shown (API, preference modal, data-cc="declaration"). Use for the site\u2019s own cookies the database cannot know. A name ending in * covers every cookie with that prefix.',
-    { cbid: z4.string(), name: z4.string(), ...declarationShape, dryRun: dryRunArg },
+    { cbid: z5.string(), name: z5.string(), ...declarationShape, dryRun: dryRunArg },
     (a) => {
       const { cbid: cbid2, name, dryRun, ...rest } = a;
       return client.sites.declareCookie(cbid2, name, rest, dryRun ? { dryRun: true } : void 0);
@@ -1438,7 +1565,7 @@ ${JSON.stringify(r, null, 2)}` : r;
   tool(
     "declare_cookies",
     "Declare many cookies at once. All-or-nothing: one invalid item refuses the whole request and nothing is saved. replace: true also removes every declaration the list does not name.",
-    { cbid: z4.string(), cookies: z4.array(z4.object({ name: z4.string(), ...declarationShape })).max(500), replace: z4.boolean().optional(), dryRun: dryRunArg },
+    { cbid: z5.string(), cookies: z5.array(z5.object({ name: z5.string(), ...declarationShape })).max(500), replace: z5.boolean().optional(), dryRun: dryRunArg },
     (a) => {
       const o = { ...a.replace ? { replace: true } : {}, ...a.dryRun ? { dryRun: true } : {} };
       return client.sites.declareCookies(a.cbid, a.cookies, Object.keys(o).length ? o : void 0);
@@ -1447,35 +1574,118 @@ ${JSON.stringify(r, null, 2)}` : r;
   tool(
     "undeclare_cookie",
     "Remove a cookie declaration; the scanned/observed classification applies again.",
-    { cbid: z4.string(), name: z4.string(), dryRun: dryRunArg },
+    { cbid: z5.string(), name: z5.string(), dryRun: dryRunArg },
     async (a) => {
       if (a.dryRun) return client.sites.undeclareCookie(a.cbid, a.name, { dryRun: true });
       await client.sites.undeclareCookie(a.cbid, a.name);
       return { undeclared: a.name };
     }
   );
+  tool(
+    "retire_cookie",
+    'Retire a cookie the site renamed or stopped setting: it leaves the banner\u2019s cookie list, data-cc="declaration" and the public feed, and stays listed for the owner with retired. A name ending in * retires every cookie with that prefix; the name must match a scanned, observed or declared cookie. If a crawl or a real visit sees it again afterwards, it is listed again with review: retired_but_seen.',
+    {
+      cbid: z5.string(),
+      name: z5.string(),
+      renamedTo: z5.string().max(256).optional().describe("The cookie\u2019s new name, if it was renamed."),
+      note: z5.string().max(1e3).optional(),
+      dryRun: z5.boolean().optional().describe("Store nothing: answer with the would-be retirement and list to check first.")
+    },
+    (a) => {
+      const input = { ...a.renamedTo ? { renamedTo: a.renamedTo } : {}, ...a.note ? { note: a.note } : {} };
+      return client.sites.retireCookie(a.cbid, a.name, input, a.dryRun ? { dryRun: true } : void 0);
+    }
+  );
+  tool(
+    "unretire_cookie",
+    "Un-retire a cookie: it is listed again everywhere.",
+    { cbid: z5.string(), name: z5.string(), dryRun: z5.boolean().optional().describe("Store nothing: answer with what the list would be.") },
+    async (a) => {
+      if (a.dryRun) return client.sites.unretireCookie(a.cbid, a.name, { dryRun: true });
+      await client.sites.unretireCookie(a.cbid, a.name);
+      return { unretired: a.name };
+    }
+  );
+  tool(
+    "list_cookie_presets",
+    "Declaration presets for the platforms a site is built on (atlas, forumulate, chatly, cookiemunch): each one\u2019s parameters, what it has declared on this site, and whether the vendor\u2019s live manifest can be imported yet. Read-only.",
+    { cbid: z5.string() },
+    (a) => client.sites.cookiePresets(a.cbid)
+  );
+  tool(
+    "apply_cookie_preset",
+    "Apply (or re-sync) a vendor preset: declares exactly what that platform writes \u2014 cookies and browser storage, with domain and lifetime \u2014 marked as declared by that vendor. Re-applying removes keys the vendor no longer writes. Names the owner declared are kept (skipped). Atlas needs frontendApiHost (and crossSubdomainCookies, default true); Chatly needs publicId.",
+    {
+      cbid: z5.string(),
+      vendor: z5.enum(["atlas", "forumulate", "chatly", "cookiemunch"]),
+      frontendApiHost: z5.string().optional().describe("Atlas: your frontend API host, e.g. auth.example.com."),
+      crossSubdomainCookies: z5.boolean().optional().describe("Atlas: default true \u2014 the cookies live on the parent domain."),
+      publicId: z5.string().optional().describe("Chatly: the channel public id (ch_web_\u2026)."),
+      dragging: z5.boolean().optional().describe("Chatly: the launcher can be dragged (adds the drag-position key)."),
+      category: z5.string().optional().describe("Chatly: the category for its keys. Default necessary."),
+      dryRun: dryRunArg
+    },
+    (a) => {
+      const params = {};
+      for (const k of ["frontendApiHost", "crossSubdomainCookies", "publicId", "dragging", "category"]) if (a[k] !== void 0) params[k] = a[k];
+      return client.sites.applyCookiePreset(a.cbid, a.vendor, params, a.dryRun ? { dryRun: true } : void 0);
+    }
+  );
+  tool(
+    "remove_cookie_preset",
+    "Remove every declaration a vendor preset made on this site.",
+    { cbid: z5.string(), vendor: z5.enum(["atlas", "forumulate", "chatly", "cookiemunch"]), dryRun: dryRunArg },
+    (a) => client.sites.removeCookiePreset(a.cbid, a.vendor, a.dryRun ? { dryRun: true } : void 0)
+  );
+  tool(
+    "delete_observed_cookie",
+    "Remove every stored row of this name that crawls or real visits put in the site\u2019s cookie list (e.g. a name someone reported that the site never sets). A declaration of it stays. If real visits keep reporting it, it comes back quarantined.",
+    { cbid: z5.string(), name: z5.string(), dryRun: dryRunArg },
+    async (a) => {
+      if (a.dryRun) return client.sites.deleteObservedCookie(a.cbid, a.name, { dryRun: true });
+      await client.sites.deleteObservedCookie(a.cbid, a.name);
+      return { deleted: a.name };
+    }
+  );
+  tool(
+    "purge_observed_cookies",
+    "Purge observed since T: remove every row a real visit first reported at or after `since` (and before `until`). Crawled rows and declarations stay. Rows from before provenance was recorded use their last-seen time, so run with dryRun first.",
+    {
+      cbid: z5.string(),
+      since: z5.union([z5.string(), z5.number()]).describe("ISO-8601 time or epoch milliseconds."),
+      until: z5.union([z5.string(), z5.number()]).optional().describe("Optional end of the window (exclusive)."),
+      dryRun: dryRunArg
+    },
+    (a) => client.sites.purgeObservedCookies(
+      a.cbid,
+      { since: a.since, ...a.until !== void 0 ? { until: a.until } : {} },
+      a.dryRun ? { dryRun: true } : void 0
+    )
+  );
   tool(
     "get_blocked_pages",
     "Pages where the embed could not load its banner renderer \u2014 the page\u2019s Content Security Policy or Trusted Types policy refused it, so nobody there can be asked for consent. An empty list is healthy. Read-only.",
-    { cbid: z4.string() },
+    { cbid: z5.string() },
     (a) => client.sites.blocked(a.cbid)
   );
   tool(
     "roll_api_key",
     "Rotate an API key: returns a new secret once, with the same name, scopes, property lock and expiry. The old secret stops working immediately \u2014 if it is the key this server runs with, this server stops working too until it is reconfigured.",
-    { prefix: z4.string() },
+    { prefix: z5.string() },
     (a) => client.keys.roll(a.prefix)
   );
   tool(
     "update_api_key",
-    "Rename an API key, or replace its scopes or the properties it is locked to. Only the fields given change; the secret does not.",
+    "Rename an API key, replace its scopes or the properties it is locked to, or set or remove its expiry. Only the fields given change; the secret does not.",
     {
-      prefix: z4.string(),
-      name: z4.string().optional(),
-      scopes: z4.array(z4.string()).optional(),
-      cbids: z4.array(z4.string()).min(1).optional()
+      prefix: z5.string(),
+      name: z5.string().optional(),
+      scopes: z5.array(z5.string()).optional(),
+      cbids: z5.array(z5.string()).min(1).optional(),
+      expiresAt: z5.string().nullable().optional().describe("A new expiry (ISO date-time), or null to remove it.")
     },
     (a) => client.keys.update(a.prefix, {
+      ...a.expiresAt !== void 0 ? { expiresAt: a.expiresAt } : {},
       ...a.name !== void 0 ? { name: a.name } : {},
       ...a.scopes ? { scopes: a.scopes } : {},
       ...a.cbids ? { cbids: a.cbids } : {}
@@ -1485,7 +1695,7 @@ ${JSON.stringify(r, null, 2)}` : r;
   tool(
     "update_org",
     "Rename your organisation or set its logo. logoUrl: null removes the logo; upload an image with upload_asset to get a URL. Deleting the organisation is not possible here.",
-    { name: z4.string().min(1).optional(), logoUrl: z4.string().nullable().optional() },
+    { name: z5.string().min(1).optional(), logoUrl: z5.string().nullable().optional() },
     (a) => client.org.update({
       ...a.name !== void 0 ? { name: a.name } : {},
       ...a.logoUrl !== void 0 ? { logoUrl: a.logoUrl } : {}
@@ -1501,20 +1711,20 @@ ${JSON.stringify(r, null, 2)}` : r;
     "set_mail_provider",
     "Connect your own mail provider for rights-request mail \u2014 recommended, so codes come from your own domain. Replaces the stored one. It carries mail only after test_mail_provider succeeds; every save clears that. Omit secret to keep the stored one (same provider only).",
     {
-      provider: z4.enum(["brevo", "sendgrid", "postmark", "resend", "ses", "smtp"]),
-      fromEmail: z4.string().describe("An address on a domain your provider has verified."),
-      fromName: z4.string().max(100).nullable().optional(),
-      replyTo: z4.string().nullable().optional(),
-      secret: z4.string().optional().describe("API key (Brevo, SendGrid, Resend), server token (Postmark), secret access key (SES) or SMTP password. Write-only."),
-      ses: z4.object({ region: z4.string(), accessKeyId: z4.string() }).optional().describe("Required for ses."),
-      smtp: z4.object({ host: z4.string(), port: z4.union([z4.literal(25), z4.literal(465), z4.literal(587), z4.literal(2525)]), security: z4.enum(["tls", "starttls"]), username: z4.string() }).optional().describe("Required for smtp. TLS is always required.")
+      provider: z5.enum(["brevo", "sendgrid", "postmark", "resend", "ses", "smtp"]),
+      fromEmail: z5.string().describe("An address on a domain your provider has verified."),
+      fromName: z5.string().max(100).nullable().optional(),
+      replyTo: z5.string().nullable().optional(),
+      secret: z5.string().optional().describe("API key (Brevo, SendGrid, Resend), server token (Postmark), secret access key (SES) or SMTP password. Write-only."),
+      ses: z5.object({ region: z5.string(), accessKeyId: z5.string() }).optional().describe("Required for ses."),
+      smtp: z5.object({ host: z5.string(), port: z5.union([z5.literal(25), z5.literal(465), z5.literal(587), z5.literal(2525)]), security: z5.enum(["tls", "starttls"]), username: z5.string() }).optional().describe("Required for smtp. TLS is always required.")
     },
     (a) => client.org.mailProvider.set(a)
   );
   tool(
     "test_mail_provider",
     "Send a test message through your own mail provider (never Cookie Munch\u2019s) and report what it answered. Success marks the configuration verified, after which it carries all rights mail.",
-    { to: z4.string().optional().describe("Recipient. Default: the reply-to, else the from address.") },
+    { to: z5.string().optional().describe("Recipient. Default: the reply-to, else the from address.") },
     (a) => client.org.mailProvider.test(a.to)
   );
   tool(
@@ -1528,11 +1738,11 @@ ${JSON.stringify(r, null, 2)}` : r;
   );
   const CAPTCHA_OFF = "Off removes spam protection beyond the hidden spam-trap field, the rate limits and the email code: expect more spam requests. Own keys are recommended.";
   const captchaInput = {
-    mode: z4.enum(["own", "off"]).describe(`own: your own captcha provider keys (recommended). off: no captcha. ${CAPTCHA_OFF}`),
-    provider: z4.enum(["turnstile", "hcaptcha", "recaptcha_v2", "recaptcha_v3"]).optional().describe("Required for own."),
-    siteKey: z4.string().optional().describe("Required for own: the public site key. List your rights-page hostnames on it at the provider."),
-    secret: z4.string().optional().describe("The provider secret key. Write-only; never returned. Omit to keep the stored one (same provider)."),
-    minScore: z4.number().min(0.1).max(0.9).optional().describe("reCAPTCHA v3 only. Default 0.5.")
+    mode: z5.enum(["own", "off"]).describe(`own: your own captcha provider keys (recommended). off: no captcha. ${CAPTCHA_OFF}`),
+    provider: z5.enum(["turnstile", "hcaptcha", "recaptcha_v2", "recaptcha_v3"]).optional().describe("Required for own."),
+    siteKey: z5.string().optional().describe("Required for own: the public site key. List your rights-page hostnames on it at the provider."),
+    secret: z5.string().optional().describe("The provider secret key. Write-only; never returned. Omit to keep the stored one (same provider)."),
+    minScore: z5.number().min(0.1).max(0.9).optional().describe("reCAPTCHA v3 only. Default 0.5.")
   };
   const captchaBody = (a) => ({
     mode: a.mode,
@@ -1544,19 +1754,19 @@ ${JSON.stringify(r, null, 2)}` : r;
   tool(
     "get_rights_captcha",
     "The captcha on a site\u2019s hosted rights page: its own setting, else the organisation default, else off (`source` says which). Never returns the secret. Read-only.",
-    { cbid: z4.string() },
+    { cbid: z5.string() },
     (a) => client.rightsCaptcha.get(a.cbid)
   );
   tool(
     "set_rights_captcha",
     `Set a site\u2019s rights-page captcha: your own Turnstile, hCaptcha or reCAPTCHA keys (recommended; the provider must accept the secret before it is saved), or off. ${CAPTCHA_OFF} Audited with the old and new mode.`,
-    { cbid: z4.string(), ...captchaInput },
+    { cbid: z5.string(), ...captchaInput },
     (a) => client.rightsCaptcha.set(a.cbid, captchaBody(a))
   );
   tool(
     "remove_rights_captcha",
     "Remove a site\u2019s own captcha setting: it inherits the organisation default again (or off). Returns the setting now in force.",
-    { cbid: z4.string() },
+    { cbid: z5.string() },
     (a) => client.rightsCaptcha.remove(a.cbid)
   );
   tool(
@@ -1579,15 +1789,15 @@ ${JSON.stringify(r, null, 2)}` : r;
   );
   const IDENTITY_NOTE = "The JWKS is fetched and checked before anything is saved. The session token must carry the email and a verified-email claim (default email_verified) set to true (Clerk: add email: {{user.primary_email_address}} to the session token; Clerk documents no claim for whether that address is verified, so either add your own or set trustEmailClaim). oidc_jwt needs an audience or authorizedParties.";
   const identityInput = {
-    type: z4.enum(["clerk", "atlas", "oidc_jwt"]).describe("clerk, atlas (Clerk-shaped), or oidc_jwt (any issuer that signs session JWTs with a published JWKS)."),
-    issuer: z4.string().describe("https URL exactly as in the token\u2019s iss (Clerk: your Frontend API URL)."),
-    jwksUrl: z4.string().optional().describe("Required for oidc_jwt; clerk/atlas default to <issuer>/.well-known/jwks.json."),
-    audience: z4.string().optional().describe("Expected aud. For oidc_jwt an audience or authorizedParties is required (a shared issuer mints tokens for every app)."),
-    authorizedParties: z4.array(z4.string()).optional().describe("Your own origins (https://www.example.com) the token\u2019s azp must be one of. Required for clerk and atlas; for oidc_jwt when there is no audience."),
-    emailClaim: z4.string().optional().describe("Default email."),
-    emailVerifiedClaim: z4.string().optional().describe("Default email_verified; must be exactly true."),
-    sessionCookieName: z4.string().optional().describe("Default __session: the cookie the hosted page on your custom domain reads."),
-    trustEmailClaim: z4.boolean().optional().describe("clerk/atlas only, default false. True: a token without the verified claim is accepted, its email claim taken as verified. Set only if every address your provider puts in that claim is verified.")
+    type: z5.enum(["clerk", "atlas", "oidc_jwt"]).describe("clerk, atlas (Clerk-shaped), or oidc_jwt (any issuer that signs session JWTs with a published JWKS)."),
+    issuer: z5.string().describe("https URL exactly as in the token\u2019s iss (Clerk: your Frontend API URL)."),
+    jwksUrl: z5.string().optional().describe("Required for oidc_jwt; clerk/atlas default to <issuer>/.well-known/jwks.json."),
+    audience: z5.string().optional().describe("Expected aud. For oidc_jwt an audience or authorizedParties is required (a shared issuer mints tokens for every app)."),
+    authorizedParties: z5.array(z5.string()).optional().describe("Your own origins (https://www.example.com) the token\u2019s azp must be one of. Required for clerk and atlas; for oidc_jwt when there is no audience."),
+    emailClaim: z5.string().optional().describe("Default email."),
+    emailVerifiedClaim: z5.string().optional().describe("Default email_verified; must be exactly true."),
+    sessionCookieName: z5.string().optional().describe("Default __session: the cookie the hosted page on your custom domain reads."),
+    trustEmailClaim: z5.boolean().optional().describe("clerk/atlas only, default false. True: a token without the verified claim is accepted, its email claim taken as verified. Set only if every address your provider puts in that claim is verified.")
   };
   const identityBody = (a) => {
     const out = { type: a.type, issuer: a.issuer };
@@ -1597,19 +1807,19 @@ ${JSON.stringify(r, null, 2)}` : r;
   tool(
     "get_rights_identity",
     "The sign-in provider a site\u2019s rights requests are verified with: its own setting, else the organisation default, else none (`source` says which). Read-only.",
-    { cbid: z4.string() },
+    { cbid: z5.string() },
     (a) => client.rightsIdentity.get(a.cbid)
   );
   tool(
     "set_rights_identity",
     `Connect a site\u2019s sign-in provider so a visitor signed in to the site is verified by their session, with no code mail. ${IDENTITY_NOTE} Audited.`,
-    { cbid: z4.string(), ...identityInput },
+    { cbid: z5.string(), ...identityInput },
     (a) => client.rightsIdentity.set(a.cbid, identityBody(a))
   );
   tool(
     "remove_rights_identity",
     "Remove a site\u2019s own sign-in provider: it inherits the organisation default again (or none). Returns the setting now in force.",
-    { cbid: z4.string() },
+    { cbid: z5.string() },
     (a) => client.rightsIdentity.remove(a.cbid)
   );
   tool(
@@ -1633,22 +1843,22 @@ ${JSON.stringify(r, null, 2)}` : r;
   tool(
     "get_audit_log",
     "The organisation\u2019s audit log, newest first: administrative changes made in the dashboard or through the API, and who made them. Read-only.",
-    { limit: z4.number().int().min(1).max(500).optional() },
+    { limit: z5.number().int().min(1).max(500).optional() },
     (a) => client.audit(a.limit)
   );
   tool(
     "upload_asset",
     "Upload an image \u2014 a banner logo \u2014 and get its public URL. data is base64 (a data: URL also works); PNG, JPEG, WebP, GIF or SVG, up to 1,000,000 bytes.",
     {
-      data: z4.string(),
-      contentType: z4.enum(["image/png", "image/jpeg", "image/webp", "image/gif", "image/svg+xml"])
+      data: z5.string(),
+      contentType: z5.enum(["image/png", "image/jpeg", "image/webp", "image/gif", "image/svg+xml"])
     },
     (a) => client.assets.upload({ data: a.data, contentType: a.contentType })
   );
   tool(
     "delete_asset",
     "Delete a stored image by its URL (or file name). Only your own organisation\u2019s images can be named.",
-    { url: z4.string().describe("The URL upload_asset returned, or just its file name.") },
+    { url: z5.string().describe("The URL upload_asset returned, or just its file name.") },
     async (a) => {
       await client.assets.delete(a.url);
       return { deleted: a.url };
@@ -1663,18 +1873,18 @@ ${JSON.stringify(r, null, 2)}` : r;
   tool(
     "get_customer",
     "One child org: its controller details and usage. Read-only.",
-    { id: z4.string() },
+    { id: z5.string() },
     (a) => client.reseller.get(a.id)
   );
   tool(
     "provision_customer",
     "Create a new child org under this reseller. With `mintKey`, its first API key is returned once. Counts toward the reseller plan\u2019s pooled limits.",
     {
-      name: z4.string(),
-      ownerEmail: z4.string().optional(),
-      delegatedAccess: z4.boolean().optional().describe("Whether this reseller may act inside the child."),
-      mintKey: z4.boolean().optional(),
-      keyScopes: z4.array(z4.string()).optional()
+      name: z5.string(),
+      ownerEmail: z5.string().optional(),
+      delegatedAccess: z5.boolean().optional().describe("Whether this reseller may act inside the child."),
+      mintKey: z5.boolean().optional(),
+      keyScopes: z5.array(z5.string()).optional()
     },
     (a) => client.reseller.create({
       name: a.name,
@@ -1688,10 +1898,10 @@ ${JSON.stringify(r, null, 2)}` : r;
     "update_customer",
     "Change a child org\u2019s status, delegated access or DSAR routing. `dsarRouting: null` clears the override.",
     {
-      id: z4.string(),
-      status: z4.enum(["active", "suspended"]).optional(),
-      delegatedAccess: z4.boolean().optional(),
-      dsarRouting: z4.enum(["reseller", "child"]).nullable().optional()
+      id: z5.string(),
+      status: z5.enum(["active", "suspended"]).optional(),
+      delegatedAccess: z5.boolean().optional(),
+      dsarRouting: z5.enum(["reseller", "child"]).nullable().optional()
     },
     (a) => client.reseller.update(a.id, {
       ...a.status ? { status: a.status } : {},
@@ -1702,7 +1912,7 @@ ${JSON.stringify(r, null, 2)}` : r;
   tool(
     "suspend_customer",
     "Suspend a child org: it stops ingesting consent and its keys stop working, and it can be reactivated with update_customer. Its data is kept. (Permanent deletion is deliberately not available here.)",
-    { id: z4.string() },
+    { id: z5.string() },
     async (a) => {
       await client.reseller.deprovision(a.id);
       return { suspended: a.id };
@@ -1711,72 +1921,72 @@ ${JSON.stringify(r, null, 2)}` : r;
   tool(
     "list_customer_keys",
     "A child org's API key prefixes. Never the secrets. Read-only.",
-    { id: z4.string() },
+    { id: z5.string() },
     (a) => client.reseller.listKeys(a.id)
   );
   tool(
     "issue_customer_key",
     "Mint an API key for a child org. The secret is returned once. Prefer scopes and a property lock over a full-access key.",
-    { id: z4.string(), name: z4.string().optional(), scopes: z4.array(z4.string()).optional(), cbids: z4.array(z4.string()).min(1).optional() },
+    { id: z5.string(), name: z5.string().optional(), scopes: z5.array(z5.string()).optional(), cbids: z5.array(z5.string()).min(1).optional() },
     (a) => client.reseller.mintKey(a.id, {
       ...a.name ? { name: a.name } : {},
       ...a.scopes ? { scopes: a.scopes } : {},
       ...a.cbids ? { cbids: a.cbids } : {}
     })
   );
-  tool("revoke_customer_key", "Revoke a child org's API key by prefix. Takes effect immediately.", { id: z4.string(), prefix: z4.string() }, async (a) => {
+  tool("revoke_customer_key", "Revoke a child org's API key by prefix. Takes effect immediately.", { id: z5.string(), prefix: z5.string() }, async (a) => {
     await client.reseller.revokeKey(a.id, a.prefix);
     return { revoked: a.prefix };
   });
   tool(
     "erase_subject_data",
     "IRREVERSIBLY crypto-erase a data subject's consent records by their consent-receipt stamp (GDPR/CCPA deletion). Destroys the encryption key; the tamper-evident chain stays intact.",
-    { cbid: z4.string(), stamp: z4.string() },
+    { cbid: z5.string(), stamp: z5.string() },
     (a) => client.consent.eraseSubject(a.cbid, a.stamp)
   );
   tool(
     "export_subject_data",
     "Export a data subject's consent records (GDPR access/portability).",
-    { cbid: z4.string(), stamp: z4.string() },
+    { cbid: z5.string(), stamp: z5.string() },
     (a) => client.consent.exportSubject(a.cbid, a.stamp)
   );
   tool("list_banners", "List reusable banner designs in your org.", {}, () => client.banners.list());
   tool(
     "create_banner",
     "Create a reusable banner design.",
-    { name: z4.string(), json: z4.record(z4.unknown()).describe("A v2 BannerConfig.") },
+    { name: z5.string(), json: z5.record(z5.unknown()).describe("A v2 BannerConfig.") },
     (a) => client.banners.create({ name: a.name, json: a.json })
   );
-  tool("get_banner", "Get a banner design by id.", { id: z4.string() }, (a) => client.banners.get(a.id));
+  tool("get_banner", "Get a banner design by id.", { id: z5.string() }, (a) => client.banners.get(a.id));
   tool(
     "update_banner",
     "Update a banner design (name and/or config).",
-    { id: z4.string(), name: z4.string().optional(), json: z4.record(z4.unknown()).optional() },
+    { id: z5.string(), name: z5.string().optional(), json: z5.record(z5.unknown()).optional() },
     (a) => client.banners.update(a.id, {
       ...a.name !== void 0 ? { name: a.name } : {},
       ...a.json !== void 0 ? { json: a.json } : {}
     })
   );
-  tool("delete_banner", "Delete a banner design (fails if assigned to sites).", { id: z4.string() }, async (a) => {
+  tool("delete_banner", "Delete a banner design (fails if assigned to sites).", { id: z5.string() }, async (a) => {
     await client.banners.delete(a.id);
     return { ok: true };
   });
   tool(
     "get_banner_assignments",
     "The sites (cbids) a banner design is currently assigned to. Read-only.",
-    { id: z4.string() },
+    { id: z5.string() },
     (a) => client.banners.assignments(a.id)
   );
   tool(
     "assign_banner",
     "Set which sites (cbids) use a banner design.",
-    { id: z4.string(), cbids: z4.array(z4.string()) },
+    { id: z5.string(), cbids: z5.array(z5.string()) },
     (a) => client.banners.setAssignments(a.id, a.cbids)
   );
   tool(
     "publish_banner",
     "Publish a design live to all its assigned sites.",
-    { id: z4.string() },
+    { id: z5.string() },
     (a) => client.banners.publish(a.id)
   );
 }
@@ -1793,4 +2003,4 @@ export {
   registerTools,
   createCookieMunchMcp
 };
-//# sourceMappingURL=chunk-PLBLLTYO.js.map
+//# sourceMappingURL=chunk-SKCEQX3L.js.map