@elitedcs/ghl-mcp 3.66.1 → 3.67.0

package/dist/index.js

@@ -147,10 +147,10 @@ var init_ghl_client = __esm({
             throw new Error(`Request timeout (30s): ${method} ${path15}`);
           }
           if (!options.noRetry && attempt < MAX_RETRIES) {
-            const delay4 = computeRetryDelay(null, attempt, BASE_DELAY_MS);
-            process.stderr.write(`[ghl-mcp] Network error on ${method} ${path15}, retry ${attempt + 1}/${MAX_RETRIES} in ${delay4}ms
+            const delay5 = computeRetryDelay(null, attempt, BASE_DELAY_MS);
+            process.stderr.write(`[ghl-mcp] Network error on ${method} ${path15}, retry ${attempt + 1}/${MAX_RETRIES} in ${delay5}ms
 `);
-            await new Promise((r) => setTimeout(r, delay4));
+            await new Promise((r) => setTimeout(r, delay5));
             return this.request(method, path15, options, attempt + 1);
           }
           throw error;
@@ -158,10 +158,10 @@ var init_ghl_client = __esm({
           clearTimeout(timeout);
         }
         if (!options.noRetry && (response.status === 429 || response.status >= 500) && attempt < MAX_RETRIES) {
-          const delay4 = computeRetryDelay(response.headers.get("Retry-After"), attempt, BASE_DELAY_MS);
-          process.stderr.write(`[ghl-mcp] ${response.status} on ${method} ${path15}, retry ${attempt + 1}/${MAX_RETRIES} in ${delay4}ms
+          const delay5 = computeRetryDelay(response.headers.get("Retry-After"), attempt, BASE_DELAY_MS);
+          process.stderr.write(`[ghl-mcp] ${response.status} on ${method} ${path15}, retry ${attempt + 1}/${MAX_RETRIES} in ${delay5}ms
 `);
-          await new Promise((r) => setTimeout(r, delay4));
+          await new Promise((r) => setTimeout(r, delay5));
           return this.request(method, path15, options, attempt + 1);
         }
         if (!response.ok) {
@@ -1648,7 +1648,7 @@ Note: Firebase credentials rejected (${fb.error}).`;
       const telemetryLine = telemetryDisabled(process.env) ? "" : `
 
 ${TELEMETRY_DISCLOSURE}`;
-      const finishedCount = isFree ? "111" : "239";
+      const finishedCount = isFree ? "111" : "241";
       const freeTip = isFree ? `
 
 Free tier: read-only. Write tools stay visible but answer with upgrade info instead of acting. Full version ($97/mo founding rate) upgrades in place \u2014 same install, you only swap the license key: https://ghlcommand.com` : "";
@@ -1693,7 +1693,7 @@ Free tier: read-only. Write tools stay visible but answer with upgrade info inst
 function registerEnableWorkflowBuilderTool(server2) {
   server2.tool(
     "enable_workflow_builder",
-    "Add Firebase credentials to an existing GHL Command install to unlock 55 additional tools across the internal-API modules: workflow builder (create/edit/clone/delete/publish/validate workflows, build_if_else_branch, build_goal_event, get_trigger_registry), funnel + page builder, form builder, pipeline builder, workflow cloner, smart lists, reputation, email campaigns, email templates, and memberships, plus the pre-deploy validator. On the FREE tier this same login unlocks the read-only auditor suite (audit_workflows, validate_workflow, full-detail workflow/funnel/pipeline reads). Requires you've already run setup_ghl_mcp. EASIEST PATH: run `capture_firebase_interactive` instead \u2014 a Chrome window opens, you log into GHL, zero pasting. Use THIS tool when you have JSON from `auto_capture_firebase_script` (console-paste path) to put in `firebase_paste`, or the three manual DevTools fields. Tool count goes from 184 to 239 after the next Claude restart.",
+    "Add Firebase credentials to an existing GHL Command install to unlock 55 additional tools across the internal-API modules: workflow builder (create/edit/clone/delete/publish/validate workflows, build_if_else_branch, build_goal_event, get_trigger_registry), funnel + page builder, form builder, pipeline builder, workflow cloner, smart lists, reputation, email campaigns, email templates, and memberships, plus the pre-deploy validator. On the FREE tier this same login unlocks the read-only auditor suite (audit_workflows, validate_workflow, full-detail workflow/funnel/pipeline reads). Requires you've already run setup_ghl_mcp. EASIEST PATH: run `capture_firebase_interactive` instead \u2014 a Chrome window opens, you log into GHL, zero pasting. Use THIS tool when you have JSON from `auto_capture_firebase_script` (console-paste path) to put in `firebase_paste`, or the three manual DevTools fields. Tool count goes from 186 to 241 after the next Claude restart.",
     {
       // v3.25.0: one-paste path. Tool runs `auto_capture_firebase_script` to
       // get the console script; the script returns a JSON object that pastes
@@ -2854,9 +2854,9 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@elitedcs/ghl-mcp",
-      version: "3.66.1",
+      version: "3.67.0",
       mcpName: "io.github.drjerryrelth/ghl-command",
-      description: "GoHighLevel MCP Server for Claude. 239 tools \u2014 full CRM, automation, marketing control, account-wide workflow audit, live funnel-capture verification, and the only programmatic GHL workflow builder, now multi-tenant across client accounts.",
+      description: "GoHighLevel MCP Server for Claude. 241 tools \u2014 full CRM, automation, marketing control, account-wide workflow audit, live funnel-capture verification, and the only programmatic GHL workflow builder, now multi-tenant across client accounts.",
       main: "dist/index.js",
       bin: {
         "ghl-mcp": "dist/index.js"
@@ -6187,10 +6187,10 @@ var WorkflowBuilderClient = class _WorkflowBuilderClient {
         throw new Error(`Request timeout (30s): ${method} ${urlPath}`);
       }
       if (attempt < MAX_RETRIES2) {
-        const delay4 = computeRetryDelay(null, attempt, BASE_DELAY_MS2);
-        process.stderr.write(`[ghl-mcp] Network error on ${method} ${urlPath}, retry ${attempt + 1}/${MAX_RETRIES2} in ${delay4}ms
+        const delay5 = computeRetryDelay(null, attempt, BASE_DELAY_MS2);
+        process.stderr.write(`[ghl-mcp] Network error on ${method} ${urlPath}, retry ${attempt + 1}/${MAX_RETRIES2} in ${delay5}ms
 `);
-        await new Promise((r) => setTimeout(r, delay4));
+        await new Promise((r) => setTimeout(r, delay5));
         return this.request(method, urlPath, body, attempt + 1);
       }
       throw error;
@@ -6198,10 +6198,10 @@ var WorkflowBuilderClient = class _WorkflowBuilderClient {
       clearTimeout(timeout);
     }
     if ((response.status === 429 || response.status >= 500) && attempt < MAX_RETRIES2) {
-      const delay4 = computeRetryDelay(response.headers.get("Retry-After"), attempt, BASE_DELAY_MS2);
-      process.stderr.write(`[ghl-mcp] ${response.status} on ${method} ${urlPath}, retry ${attempt + 1}/${MAX_RETRIES2} in ${delay4}ms
+      const delay5 = computeRetryDelay(response.headers.get("Retry-After"), attempt, BASE_DELAY_MS2);
+      process.stderr.write(`[ghl-mcp] ${response.status} on ${method} ${urlPath}, retry ${attempt + 1}/${MAX_RETRIES2} in ${delay5}ms
 `);
-      await new Promise((r) => setTimeout(r, delay4));
+      await new Promise((r) => setTimeout(r, delay5));
       return this.request(method, urlPath, body, attempt + 1);
     }
     if (!response.ok) {
@@ -10182,6 +10182,18 @@ function summarizeWebhookWorkflow(workflow) {
   };
 }
 var WorkflowListSchema = import_zod34.z.object({ rows: import_zod34.z.array(import_zod34.z.object({ _id: import_zod34.z.string().optional(), id: import_zod34.z.string().optional() }).passthrough()).optional() }).passthrough();
+async function loadWebhooks(client, limit) {
+  const listed = WorkflowListSchema.parse(await client.listWorkflows(limit, 0));
+  const rows = listed.rows ?? [];
+  const webhooks = [];
+  for (const row of rows) {
+    const id = row._id ?? row.id;
+    if (!id) continue;
+    const summary = summarizeWebhookWorkflow(await client.getWorkflow(id));
+    if (summary) webhooks.push(summary);
+  }
+  return { webhooks, scanned: rows.length };
+}
 function registerWebhookTools(server2, builderClient) {
   const requireClient = () => {
     if (!builderClient) {
@@ -10191,18 +10203,6 @@ function registerWebhookTools(server2, builderClient) {
     }
     return builderClient;
   };
-  const loadWebhooks = async (client, limit) => {
-    const listed = WorkflowListSchema.parse(await client.listWorkflows(limit, 0));
-    const rows = listed.rows ?? [];
-    const webhooks = [];
-    for (const row of rows) {
-      const id = row._id ?? row.id;
-      if (!id) continue;
-      const summary = summarizeWebhookWorkflow(await client.getWorkflow(id));
-      if (summary) webhooks.push(summary);
-    }
-    return { webhooks, scanned: rows.length };
-  };
   server2.tool(
     "list_webhooks",
     "List every webhook in the current sub-account. A webhook here is a workflow that fires a `webhook` action, so this also finds ones built by hand in the GHL UI. Returns the URL, HTTP method and triggering events for each. NOTE: GoHighLevel has no webhook REST API (it is Marketplace-OAuth only) \u2014 webhooks live on the workflow layer, which is why each one has a workflow ID and shows up in the client's Automation list. " + WEBHOOK_PAYLOAD_NOTE,
@@ -13688,11 +13688,407 @@ function registerBulkOperationTools(server2, client) {
 
 // src/tools/account-export.ts
 var import_zod46 = require("zod");
+
+// src/contact-export.ts
+var CONTACT_PAGE_SIZE = 100;
+var DEFAULT_MAX_CONTACTS = 5e3;
+var MAX_PAGES = 1e3;
+function isComplete(reason) {
+  return reason === "complete";
+}
+function stopReasonSentence(reason, fetched, cap) {
+  switch (reason) {
+    case "complete":
+      return `All ${fetched} contacts were exported.`;
+    case "cap-reached":
+      return `INCOMPLETE: ${fetched} contacts were exported and the limit of ${cap} was reached. This account has more contacts than that. Run it again with a higher limit before treating this file as the full list.`;
+    case "cursor-exhausted":
+      return `INCOMPLETE: ${fetched} contacts were exported, then GoHighLevel stopped providing a way to ask for the next page. Treat this file as partial.`;
+    case "cursor-stalled":
+      return `INCOMPLETE: ${fetched} contacts were exported, then GoHighLevel began returning the same page repeatedly. The export stopped rather than loop. Treat this file as partial.`;
+    case "page-ceiling":
+      return `INCOMPLETE: ${fetched} contacts were exported and the internal page ceiling was reached. Treat this file as partial.`;
+  }
+}
 function delay2(ms) {
   return new Promise((resolve8) => setTimeout(resolve8, ms));
 }
-function registerAccountExportTools(server2, client, registry2) {
-  const builderClient = WorkflowBuilderClient.fromEnv();
+async function fetchAllContacts(client, locationId2, options = {}) {
+  const cap = options.maxContacts ?? DEFAULT_MAX_CONTACTS;
+  const pauseMs = options.pauseMs ?? 100;
+  const rows = [];
+  let startAfter;
+  let startAfterId;
+  let pages = 0;
+  let indexTotal = null;
+  let stopReason = "complete";
+  while (true) {
+    if (pages >= MAX_PAGES) {
+      stopReason = "page-ceiling";
+      break;
+    }
+    const raw = await client.get("/contacts/", {
+      params: {
+        locationId: locationId2,
+        limit: CONTACT_PAGE_SIZE,
+        // Both cursor halves or neither. Sending one alone re-serves page 1.
+        startAfter,
+        startAfterId
+      }
+    });
+    const parsed = ContactSearchResponseSchema.parse(raw);
+    pages += 1;
+    if (pages === 1 && typeof parsed.meta?.total === "number") {
+      indexTotal = parsed.meta.total;
+    }
+    if (parsed.contacts.length === 0) {
+      stopReason = "complete";
+      break;
+    }
+    for (const contact of parsed.contacts) {
+      rows.push(contact);
+      if (rows.length >= cap) break;
+    }
+    if (rows.length >= cap) {
+      stopReason = "cap-reached";
+      break;
+    }
+    const nextAfter = parsed.meta?.startAfter ?? void 0;
+    const nextAfterId = parsed.meta?.startAfterId ?? void 0;
+    if (nextAfter == null || !nextAfterId) {
+      stopReason = "cursor-exhausted";
+      break;
+    }
+    if (nextAfter === startAfter && nextAfterId === startAfterId) {
+      stopReason = "cursor-stalled";
+      break;
+    }
+    startAfter = nextAfter;
+    startAfterId = nextAfterId;
+    if (pauseMs > 0) await delay2(pauseMs);
+  }
+  return {
+    rows,
+    fetched: rows.length,
+    pages,
+    stopReason,
+    complete: isComplete(stopReason),
+    indexTotal
+  };
+}
+var PREFERRED_COLUMNS = [
+  "id",
+  "firstName",
+  "lastName",
+  "name",
+  "email",
+  "phone",
+  "companyName",
+  "tags",
+  "source",
+  "type",
+  "dateAdded",
+  "dateUpdated",
+  "address1",
+  "city",
+  "state",
+  "postalCode",
+  "country",
+  "timezone",
+  "dnd"
+];
+function neutralizeFormula(text) {
+  return /^[=+\-@\t\r]/.test(text) ? `'${text}` : text;
+}
+function cell(value) {
+  if (value === null || value === void 0) return "";
+  const raw = typeof value === "string" ? value : typeof value === "number" || typeof value === "boolean" ? String(value) : JSON.stringify(value);
+  const text = neutralizeFormula(raw);
+  return /[",\n\r]/.test(text) ? `"${text.replace(/"/g, '""')}"` : text;
+}
+function contactsToCsv(rows) {
+  if (rows.length === 0) return "";
+  const seen = /* @__PURE__ */ new Set();
+  for (const row of rows) for (const key of Object.keys(row)) seen.add(key);
+  const preferred = PREFERRED_COLUMNS.filter((c) => seen.has(c));
+  const rest = [...seen].filter((c) => !preferred.includes(c)).sort();
+  const columns = [...preferred, ...rest];
+  const lines = [columns.join(",")];
+  for (const row of rows) lines.push(columns.map((c) => cell(row[c])).join(","));
+  return lines.join("\n");
+}
+
+// src/asset-ownership.ts
+var OWNERSHIP_PREFIX = "Offboarding Owner: ";
+var OWNER_KINDS = ["client", "agency", "borrowed", "third-party"];
+var OWNER_MEANING = {
+  client: "The client owns this. It stays with them and they keep paying for it.",
+  agency: "The agency owns this. It leaves with the agency unless it is sold or transferred.",
+  borrowed: "Borrowed for the engagement. It must be returned, disconnected, or replaced at exit.",
+  "third-party": "Owned by an outside vendor. Transfer depends on that vendor's own process."
+};
+function readCustomValues(raw) {
+  const box = raw && typeof raw === "object" ? raw : {};
+  const list = Array.isArray(box.customValues) ? box.customValues : [];
+  return list.flatMap((entry) => {
+    if (!entry || typeof entry !== "object") return [];
+    const row = entry;
+    if (typeof row.id !== "string" || typeof row.name !== "string") return [];
+    return [{ id: row.id, name: row.name, value: typeof row.value === "string" ? row.value : "" }];
+  });
+}
+function isOwnerKind(value) {
+  return OWNER_KINDS.includes(value);
+}
+function encodeOwnership(owner, note) {
+  return note && note.trim() ? `${owner} | ${note.trim()}` : owner;
+}
+function decodeOwnership(value) {
+  const [head, ...rest] = value.split("|");
+  const owner = head.trim();
+  const note = rest.join("|").trim();
+  return { owner: isOwnerKind(owner) ? owner : null, note: note || void 0 };
+}
+async function readOwnership(client, locationId2) {
+  const values = readCustomValues(await client.get(`/locations/${locationId2}/customValues`));
+  const records = [];
+  const unreadable = [];
+  for (const value of values) {
+    if (!value.name.startsWith(OWNERSHIP_PREFIX)) continue;
+    const asset = value.name.slice(OWNERSHIP_PREFIX.length).trim();
+    const { owner, note } = decodeOwnership(value.value);
+    if (!owner) {
+      unreadable.push(`${asset}: "${value.value}"`);
+      continue;
+    }
+    records.push({ asset, owner, note, customValueId: value.id });
+  }
+  return { records, unreadable };
+}
+async function writeOwnership(client, locationId2, entries) {
+  const existing = readCustomValues(await client.get(`/locations/${locationId2}/customValues`));
+  const results = [];
+  for (const entry of entries) {
+    const asset = entry.asset.trim();
+    const name = `${OWNERSHIP_PREFIX}${asset}`;
+    const matches = existing.filter((value) => value.name === name);
+    if (matches.length > 1) {
+      results.push({
+        asset,
+        action: "halted",
+        reason: `${matches.length} custom values are named "${name}". Updating by name cannot tell them apart, so nothing was changed. Delete the extras in GHL, then run this again.`
+      });
+      continue;
+    }
+    const body = { name, value: encodeOwnership(entry.owner, entry.note) };
+    if (matches.length === 1) {
+      if (!matches[0].id) {
+        results.push({
+          asset,
+          action: "halted",
+          reason: `"${name}" was created earlier in this request but GoHighLevel did not return its id, so it cannot be updated safely. Run this asset again on its own.`
+        });
+        continue;
+      }
+      await client.put(`/locations/${locationId2}/customValues/${matches[0].id}`, { body });
+      results.push({ asset, action: "updated", customValueId: matches[0].id });
+      continue;
+    }
+    const created = await client.post(`/locations/${locationId2}/customValues`, { body });
+    const createdId = readCreatedId(created);
+    existing.push({ id: createdId ?? "", name, value: body.value });
+    results.push({ asset, action: "created", customValueId: createdId });
+  }
+  return results;
+}
+function readCreatedId(raw) {
+  if (!raw || typeof raw !== "object") return void 0;
+  const box = raw;
+  if (typeof box.id === "string") return box.id;
+  const nested = box.customValue;
+  if (nested && typeof nested === "object") {
+    const inner = nested.id;
+    if (typeof inner === "string") return inner;
+  }
+  return void 0;
+}
+
+// src/handoff-doc.ts
+function sectionItems(section2) {
+  return Array.isArray(section2) ? section2 : [];
+}
+function bullet(lines) {
+  return lines.length ? lines.map((l) => `- ${l}`).join("\n") : "- None found.";
+}
+function plainReason(reason) {
+  const withoutBody = reason.split(/[{\n]/)[0];
+  const withoutRoute = withoutBody.replace(/:?\s*(GET|POST|PUT|DELETE)\s+\/\S*/g, "");
+  const cleaned = withoutRoute.replace(/\s+/g, " ").replace(/[:\s]+$/, "").trim();
+  return cleaned || "the account did not return this section";
+}
+function inventoryTable(inventory) {
+  const rows = Object.entries(inventory).map(([section2, data]) => {
+    if (data.unavailable) return `| ${section2} | not read | ${plainReason(data.unavailable)} |`;
+    const sample = data.names.slice(0, 8).join(", ");
+    const more = data.names.length > 8 ? `, and ${data.names.length - 8} more` : "";
+    return `| ${section2} | ${data.count ?? data.names.length} | ${sample || "none"}${more} |`;
+  });
+  return ["| What | How many | Which ones |", "| --- | --- | --- |", ...rows].join("\n");
+}
+function sectionList(section2, render) {
+  if (!Array.isArray(section2)) {
+    return `**Not read.** ${plainReason(section2.unavailable)}. This section is unknown, which is NOT the same as empty. Check it by hand before you rely on this document.`;
+  }
+  return bullet(section2.map(render));
+}
+function buildHandoffDoc(input) {
+  const {
+    accountName,
+    locationId: locationId2,
+    generatedAt,
+    contacts,
+    inventory,
+    users,
+    phoneNumbers,
+    socialAccounts,
+    webhooks,
+    webhookScanPartial,
+    ownership
+  } = input;
+  const ownedBy = (kind) => ownership.recorded.filter((r) => r.owner === kind);
+  const ownershipSection = ownership.recorded.length ? ["client", "agency", "borrowed", "third-party"].map((kind) => {
+    const items = ownedBy(kind);
+    if (!items.length) return "";
+    return `**${kind}** ${OWNER_MEANING[kind]}
+
+${bullet(
+      items.map((i) => i.note ? `${i.asset} (${i.note})` : i.asset)
+    )}`;
+  }).filter(Boolean).join("\n\n") : "Nothing has been recorded yet. Every asset below is unanswered.";
+  const unknownSection = ownership.unknown.length ? `These exist in the account but nobody has said who owns them. Answer them once and they stay answered:
+
+${bullet(ownership.unknown)}` : "Every asset found in this account has a recorded owner.";
+  const webhookSection = sectionList(webhooks, (w) => `${w.name} sends to ${w.url}${w.events.length ? ` when: ${w.events.join(", ")}` : ""}`) + (webhookScanPartial ? `
+
+**This list may be incomplete.** ${webhookScanPartial}` : "");
+  return `# Account handoff: ${accountName}
+
+Prepared ${generatedAt}. GoHighLevel account ID ${locationId2}.
+
+This document describes what is inside this account, who can get into it, and
+what has to change hands. It was generated from the live account, not from
+memory.
+
+## Read this first
+
+${contacts.complete ? "" : '**The contact export in this package is incomplete. See "Contacts" below before you rely on it.**\n\n'}Three things this document deliberately does not contain:
+
+1. **No passwords or API keys.** GoHighLevel does not hand out key values to any
+   tool, including this one. What you get instead is a list of every place a key
+   exists, so you can rotate them. That list is at the end.
+2. **No opinion about who owns what**, beyond what somebody actually recorded.
+   Anything unanswered is listed as unanswered.
+3. **No guesses about what is missing.** If a section could not be read, it says
+   so and why, rather than showing zero.
+
+## Contacts
+
+${contacts.sentence}${contacts.indexTotal !== null ? `
+
+GoHighLevel's own index reports **${contacts.indexTotal}** contacts for this account. This export contains **${contacts.exported}**. These two numbers are counted differently and GoHighLevel's index updates on a delay, so a small difference is normal and does not by itself mean the export is short.` : ""}
+
+## What is in the account
+
+${inventoryTable(inventory)}
+
+## Who can get in
+
+### People with logins
+
+${sectionList(users, (u) => `${u.name} (${u.email})${u.roles ? `, ${u.roles}` : ""}`)}
+
+Every person above can log into this account right now. Remove the ones who
+should not be able to, on the day the relationship ends, not later.
+
+### Phone numbers
+
+${sectionList(phoneNumbers, (p) => p.label ? `${p.number} (${p.label})` : p.number)}
+
+Numbers are rented from GoHighLevel and stop working if the account lapses. If
+the client needs to keep a number, it has to be ported out before then, and
+porting takes days to weeks.
+
+### Connected accounts
+
+${sectionList(socialAccounts, (s) => `${s.platform}: ${s.name}`)}
+
+These connections were authorised by a person. If that person leaves, the
+connection can break even though nothing in GoHighLevel changed.
+
+### Outbound webhooks
+
+${webhookSection}
+
+Each of these sends data out of this account to somewhere else. Confirm the
+receiving system should still be receiving it.
+
+## Who owns what
+
+${ownershipSection}
+
+### Not yet answered
+
+${unknownSection}
+${ownership.unreadable.length ? `
+### Recorded but unreadable
+
+Somebody edited these by hand and the answer no longer parses. They need a human:
+
+${bullet(ownership.unreadable)}
+` : ""}
+## Rotate these on the way out
+
+Key values cannot be read by any tool, so this is a checklist of places to go
+and change something, not a list of secrets.
+
+- The GoHighLevel Private Integration key for this account. Anyone holding the
+  old one keeps full access until it is deleted.
+- Any Firebase or agency-level credential used to reach this account.
+- Every connected account listed above, if the departing party authorised it.
+- Every webhook destination above, if it authenticates with a shared secret.
+- Any payment processor, email sending domain, or advertising account attached
+  to this business but living outside GoHighLevel.
+
+## What to do next
+
+1. Save the contact export alongside this document.
+2. Answer anything under "Not yet answered" and re-run the kit so the answers
+   are stored in the account itself.
+3. Work down the rotation list above.
+4. Remove the logins that should no longer exist.
+`;
+}
+
+// src/tools/account-export.ts
+function delay3(ms) {
+  return new Promise((resolve8) => setTimeout(resolve8, ms));
+}
+function builderSectionAvailability(builderLocationId, requestedLocationId) {
+  if (!builderLocationId) {
+    return {
+      usable: false,
+      reason: "Not read: the workflow builder is not connected. Run enable_workflow_builder to add Firebase credentials, then export again."
+    };
+  }
+  if (builderLocationId !== requestedLocationId) {
+    return {
+      usable: false,
+      reason: `Not read: the workflow builder is connected to a DIFFERENT sub-account (${builderLocationId}), not the one being exported (${requestedLocationId}). Reading it would describe the wrong account. Run switch_location to ${requestedLocationId} and export again.`
+    };
+  }
+  return { usable: true };
+}
+function registerAccountExportTools(server2, client, registry2, builderClient) {
   server2.tool(
     "export_account",
     "Export a complete inventory of the GHL sub-account: location info, contacts (count + sample), pipelines with stages, workflows (with full actions if builder auth is configured), funnels with pages, forms, custom fields, custom values, tags, calendars, and users. Returns a comprehensive JSON report for auditing or backup.",
@@ -13709,10 +14105,10 @@ function registerAccountExportTools(server2, client, registry2) {
         };
         try {
           report.location = await client.get(`/locations/${locId}`);
-        } catch {
-          report.location = "Error fetching";
+        } catch (e) {
+          report.location = `Error fetching: ${errorMessage(e)}`;
         }
-        await delay2(100);
+        await delay3(100);
         try {
           const contacts = await client.get("/contacts/", {
             params: { locationId: locId, limit: includeContacts ? 100 : 1 }
@@ -13724,36 +14120,38 @@ function registerAccountExportTools(server2, client, registry2) {
             total: typeof meta.total === "number" ? meta.total : contactList.length,
             sample: includeContacts ? contactList : contactList.slice(0, 1)
           };
-        } catch {
-          report.contacts = "Error fetching";
+        } catch (e) {
+          report.contacts = `Error fetching: ${errorMessage(e)}`;
         }
-        await delay2(100);
+        await delay3(100);
         try {
           report.pipelines = await client.get("/opportunities/pipelines", {
             params: { locationId: locId }
           });
-        } catch {
-          report.pipelines = "Error fetching";
+        } catch (e) {
+          report.pipelines = `Error fetching: ${errorMessage(e)}`;
         }
-        await delay2(100);
+        await delay3(100);
         try {
           report.workflows = await client.get("/workflows/", {
             params: { locationId: locId }
           });
-        } catch {
-          report.workflows = "Error fetching";
+        } catch (e) {
+          report.workflows = `Error fetching: ${errorMessage(e)}`;
         }
-        await delay2(100);
-        if (builderClient) {
+        await delay3(100);
+        const builderUse = builderSectionAvailability(builderClient?.locationId, locId);
+        if (builderUse.usable && builderClient) {
           try {
-            const fullWorkflows = await builderClient.listWorkflows(50, 0);
-            report.workflowsFull = fullWorkflows;
-          } catch {
-            report.workflowsFull = "Error fetching (builder auth may have expired)";
+            report.workflowsFull = await builderClient.listWorkflows(50, 0);
+          } catch (e) {
+            report.workflowsFull = `Error fetching: ${errorMessage(e)}`;
           }
-          await delay2(100);
+          await delay3(100);
+        } else {
+          report.workflowsFull = builderUse.reason;
         }
-        if (builderClient) {
+        if (builderUse.usable && builderClient) {
           try {
             const headers = await builderClient.buildHeaders();
             const res = await fetch(
@@ -13761,60 +14159,60 @@ function registerAccountExportTools(server2, client, registry2) {
               { headers }
             );
             if (res.ok) report.funnels = await res.json();
-            else report.funnels = "Error fetching";
-          } catch {
-            report.funnels = "Error fetching";
+            else report.funnels = `Error fetching: builder returned HTTP ${res.status}`;
+          } catch (e) {
+            report.funnels = `Error fetching: ${errorMessage(e)}`;
           }
-          await delay2(100);
+          await delay3(100);
         } else {
           try {
             report.funnels = await client.get("/funnels/", {
               params: { locationId: locId }
             });
-          } catch {
-            report.funnels = "Error fetching";
+          } catch (e) {
+            report.funnels = `Error fetching: ${errorMessage(e)}`;
           }
         }
         try {
           report.forms = await client.get("/forms/", {
             params: { locationId: locId }
           });
-        } catch {
-          report.forms = "Error fetching";
+        } catch (e) {
+          report.forms = `Error fetching: ${errorMessage(e)}`;
         }
-        await delay2(100);
+        await delay3(100);
         try {
           report.customFields = await client.get("/locations/" + locId + "/customFields");
-        } catch {
-          report.customFields = "Error fetching";
+        } catch (e) {
+          report.customFields = `Error fetching: ${errorMessage(e)}`;
         }
-        await delay2(100);
+        await delay3(100);
         try {
           report.customValues = await client.get("/locations/" + locId + "/customValues");
-        } catch {
-          report.customValues = "Error fetching";
+        } catch (e) {
+          report.customValues = `Error fetching: ${errorMessage(e)}`;
         }
-        await delay2(100);
+        await delay3(100);
         try {
           report.tags = await client.get("/locations/" + locId + "/tags");
-        } catch {
-          report.tags = "Error fetching";
+        } catch (e) {
+          report.tags = `Error fetching: ${errorMessage(e)}`;
         }
-        await delay2(100);
+        await delay3(100);
         try {
           report.calendars = await client.get("/calendars/", {
             params: { locationId: locId }
           });
-        } catch {
-          report.calendars = "Error fetching";
+        } catch (e) {
+          report.calendars = `Error fetching: ${errorMessage(e)}`;
         }
-        await delay2(100);
+        await delay3(100);
         try {
           report.users = await client.get("/users/", {
             params: { locationId: locId }
           });
-        } catch {
-          report.users = "Error fetching";
+        } catch (e) {
+          report.users = `Error fetching: ${errorMessage(e)}`;
         }
         return jsonResponse(report);
       } catch (error) {
@@ -13854,13 +14252,13 @@ function registerAccountExportTools(server2, client, registry2) {
         const fetchData = async (locId) => {
           const data = {};
           data.pipelines = await read(() => client.get("/opportunities/pipelines", { params: { locationId: locId } }));
-          await delay2(100);
+          await delay3(100);
           data.workflows = await read(() => client.get("/workflows/", { params: { locationId: locId } }));
-          await delay2(100);
+          await delay3(100);
           data.customFields = await read(() => client.get(`/locations/${locId}/customFields`));
-          await delay2(100);
+          await delay3(100);
           data.tags = await read(() => client.get(`/locations/${locId}/tags`));
-          await delay2(100);
+          await delay3(100);
           data.forms = await read(() => client.get("/forms/", { params: { locationId: locId } }));
           return data;
         };
@@ -13893,6 +14291,270 @@ function registerAccountExportTools(server2, client, registry2) {
       }
     }
   );
+  server2.tool(
+    "build_offboarding_kit",
+    "Assemble the complete exit package for a sub-account: a full contact export, an inventory of everything the account contains, an access map of every person and connected account that can reach it, the recorded owner of each asset, a key-rotation checklist, and a plain-language handoff document the next operator can follow. Read-only: it changes nothing. locationId is REQUIRED and never defaults, because exporting the wrong client's account is the one mistake this tool must not be able to make. Assets nobody has recorded an owner for come back under ownership.unanswered \u2014 answer those with record_asset_ownership and they stay answered. Key VALUES are never included: GoHighLevel does not expose them to any tool, so the kit lists where each key lives instead.",
+    {
+      locationId: import_zod46.z.string().describe("Sub-account to build the kit for. REQUIRED \u2014 this tool never falls back to the active account."),
+      contacts: import_zod46.z.enum(["summary", "csv"]).optional().describe(
+        "'summary' (default) returns contact counts only. 'csv' also returns the full contact export as CSV text, which can be large \u2014 ask for it when you are ready to save the file."
+      ),
+      maxContacts: import_zod46.z.number().int().positive().optional().describe(`Ceiling on contacts read. Defaults to ${DEFAULT_MAX_CONTACTS}. If the ceiling is hit, the kit says so in the handoff document itself rather than quietly returning a short list.`)
+    },
+    async ({ locationId: locationId2, contacts, maxContacts }) => {
+      const originalKey = client.getApiKey();
+      const registered = registry2?.getToken(locationId2);
+      const usedRegisteredKey = Boolean(registered?.apiKey && registered.apiKey !== originalKey);
+      if (usedRegisteredKey && registered?.apiKey) client.setApiKey(registered.apiKey);
+      try {
+        const generatedAt = (/* @__PURE__ */ new Date()).toISOString();
+        let accountName = locationId2;
+        let location = null;
+        try {
+          location = await client.get(`/locations/${locationId2}`);
+          const box = location && typeof location === "object" ? location : {};
+          const inner = box.location && typeof box.location === "object" ? box.location : box;
+          if (typeof inner.name === "string" && inner.name) accountName = inner.name;
+        } catch (e) {
+          location = `Error fetching: ${errorMessage(e)}`;
+        }
+        await delay3(100);
+        const inventory = {};
+        const section2 = async (label, fn) => {
+          try {
+            const names = extractNames(await fn());
+            inventory[label] = { count: names.length, names };
+          } catch (e) {
+            inventory[label] = { count: null, names: [], unavailable: errorMessage(e) };
+          }
+          await delay3(100);
+        };
+        await section2("pipelines", () => client.get("/opportunities/pipelines", { params: { locationId: locationId2 } }));
+        await section2("workflows", () => client.get("/workflows/", { params: { locationId: locationId2 } }));
+        await section2("funnels", () => client.get("/funnels/", { params: { locationId: locationId2 } }));
+        await section2("forms", () => client.get("/forms/", { params: { locationId: locationId2 } }));
+        await section2("calendars", () => client.get("/calendars/", { params: { locationId: locationId2 } }));
+        await section2("customFields", () => client.get(`/locations/${locationId2}/customFields`));
+        await section2("customValues", () => client.get(`/locations/${locationId2}/customValues`));
+        await section2("tags", () => client.get(`/locations/${locationId2}/tags`));
+        const users = await readUsers(client, locationId2);
+        await delay3(100);
+        const phoneNumbers = await readPhoneNumbers(client, locationId2);
+        await delay3(100);
+        const socialAccounts = await readSocialAccounts(client, locationId2);
+        await delay3(100);
+        const WEBHOOK_SCAN_LIMIT = 50;
+        const builderUse = builderSectionAvailability(builderClient?.locationId, locationId2);
+        let webhooks;
+        let webhookScanPartial;
+        if (builderUse.usable && builderClient) {
+          try {
+            const scan = await loadWebhooks(builderClient, WEBHOOK_SCAN_LIMIT);
+            const stillOurs = builderSectionAvailability(builderClient.locationId, locationId2);
+            if (!stillOurs.usable) {
+              webhooks = { unavailable: `The active account changed while webhooks were being read, so the result was discarded. ${stillOurs.reason ?? ""}` };
+            } else {
+              webhooks = scan.webhooks.map((w) => ({
+                name: w.name,
+                url: w.actions[0]?.url ?? "",
+                events: w.events
+              }));
+              if (scan.scanned >= WEBHOOK_SCAN_LIMIT) {
+                webhookScanPartial = `Only the first ${WEBHOOK_SCAN_LIMIT} workflows were checked and this account has at least that many, so a webhook built into a later workflow would not appear here. Check the account's Automation list by hand.`;
+              }
+            }
+          } catch (e) {
+            webhooks = { unavailable: `Error reading webhooks: ${errorMessage(e)}` };
+          }
+        } else {
+          webhooks = { unavailable: builderUse.reason ?? "Not read." };
+        }
+        let ownershipRecords = { records: [], unreadable: [] };
+        let ownershipError;
+        try {
+          ownershipRecords = await readOwnership(client, locationId2);
+        } catch (e) {
+          ownershipError = errorMessage(e);
+        }
+        const discovered = discoverAssets({ phoneNumbers, socialAccounts, inventory });
+        const answered = new Set(ownershipRecords.records.map((r) => r.asset.toLowerCase()));
+        const unanswered = discovered.filter((asset) => !answered.has(asset.toLowerCase()));
+        const cap = maxContacts ?? DEFAULT_MAX_CONTACTS;
+        let contactResult;
+        let contactSentence;
+        try {
+          contactResult = await fetchAllContacts(client, locationId2, { maxContacts: cap });
+          contactSentence = stopReasonSentence(contactResult.stopReason, contactResult.fetched, cap);
+        } catch (e) {
+          contactResult = { rows: [], fetched: 0, pages: 0, stopReason: "cursor-exhausted", complete: false, indexTotal: null };
+          contactSentence = `INCOMPLETE: the contact export failed and returned nothing. Reason: ${errorMessage(e)}`;
+        }
+        const handoffDoc = buildHandoffDoc({
+          accountName,
+          locationId: locationId2,
+          generatedAt,
+          contacts: {
+            exported: contactResult.fetched,
+            indexTotal: contactResult.indexTotal,
+            complete: contactResult.complete,
+            sentence: contactSentence
+          },
+          inventory,
+          users,
+          phoneNumbers,
+          socialAccounts,
+          webhooks,
+          webhookScanPartial,
+          ownership: {
+            recorded: ownershipRecords.records,
+            unknown: unanswered,
+            unreadable: ownershipRecords.unreadable
+          }
+        });
+        return jsonResponse({
+          account: { locationId: locationId2, name: accountName, generatedAt, usedRegisteredKey },
+          contacts: {
+            exported: contactResult.fetched,
+            ghlIndexTotal: contactResult.indexTotal,
+            complete: contactResult.complete,
+            stopReason: contactResult.stopReason,
+            pagesRead: contactResult.pages,
+            statement: contactSentence,
+            ...contacts === "csv" ? { csv: contactsToCsv(contactResult.rows) } : {
+              csvNote: "Run again with contacts:'csv' to get the full export as CSV text to save."
+            }
+          },
+          inventory,
+          accessMap: {
+            users,
+            phoneNumbers,
+            socialAccounts,
+            webhooks,
+            ...webhookScanPartial ? { webhookScanPartial } : {}
+          },
+          ownership: {
+            recorded: ownershipRecords.records,
+            unanswered,
+            unreadable: ownershipRecords.unreadable,
+            ...ownershipError ? { error: ownershipError } : {},
+            howToAnswer: "Record these with record_asset_ownership so the next run needs no interview."
+          },
+          keyRotationNote: "Key VALUES are not retrievable from GoHighLevel by any tool. The handoff document lists where each key lives so they can be rotated.",
+          handoffDoc
+        });
+      } catch (error) {
+        return errorResponse(error);
+      } finally {
+        client.setApiKey(originalKey);
+      }
+    }
+  );
+  server2.tool(
+    "record_asset_ownership",
+    "Record who owns an asset attached to a sub-account: the client, the agency, something borrowed for the engagement, or an outside vendor. Stored as custom values inside the client's own account, so the record outlives this tool and the client can read it without asking anyone. Answer these once at setup and build_offboarding_kit needs no interview later. Re-recording the same asset updates it in place instead of adding a duplicate. locationId is REQUIRED: writing ownership into the wrong client's account is worth preventing outright.",
+    {
+      locationId: import_zod46.z.string().describe("Sub-account to record ownership in. REQUIRED \u2014 never falls back to the active account."),
+      assets: import_zod46.z.array(
+        import_zod46.z.object({
+          asset: import_zod46.z.string().describe("What it is, in the words you would say out loud. e.g. 'Website domain' or 'Phone number +16025551234'."),
+          owner: import_zod46.z.enum(OWNER_KINDS).describe("client = stays with them. agency = leaves with you. borrowed = must be returned or replaced at exit. third-party = an outside vendor controls it."),
+          note: import_zod46.z.string().optional().describe("Anything the next person needs, e.g. 'registered on the client's own GoDaddy account'.")
+        })
+      ).min(1).describe("One entry per asset. Send several at once.")
+    },
+    async ({ locationId: locationId2, assets }) => {
+      const originalKey = client.getApiKey();
+      const registered = registry2?.getToken(locationId2);
+      if (registered?.apiKey && registered.apiKey !== originalKey) client.setApiKey(registered.apiKey);
+      try {
+        const results = await writeOwnership(client, locationId2, assets);
+        const halted = results.filter((r) => r.action === "halted");
+        return jsonResponse({
+          locationId: locationId2,
+          recorded: results.filter((r) => r.action !== "halted"),
+          ...halted.length ? { halted, warning: "Some assets were NOT recorded. See halted for which, and why." } : {}
+        });
+      } catch (error) {
+        return errorResponse(error);
+      } finally {
+        client.setApiKey(originalKey);
+      }
+    }
+  );
+}
+function extractNames(payload) {
+  const list = Array.isArray(payload) ? payload : payload && typeof payload === "object" ? Object.values(payload).find(Array.isArray) : void 0;
+  if (!Array.isArray(list)) return [];
+  return list.map(
+    (item) => item && typeof item === "object" ? String(item.name ?? item.id ?? "") : String(item)
+  ).filter(Boolean);
+}
+async function readSection(read) {
+  try {
+    return await read();
+  } catch (e) {
+    return { unavailable: errorMessage(e) };
+  }
+}
+async function readUsers(client, locationId2) {
+  return readSection(async () => {
+    const raw = await client.get("/users/", { params: { locationId: locationId2 } });
+    const box = raw && typeof raw === "object" ? raw : {};
+    const list = Array.isArray(box.users) ? box.users : [];
+    return list.flatMap((entry) => {
+      if (!entry || typeof entry !== "object") return [];
+      const u = entry;
+      const roles = u.roles && typeof u.roles === "object" ? String(u.roles.role ?? "") : "";
+      return [{
+        name: String(u.name ?? `${u.firstName ?? ""} ${u.lastName ?? ""}`).trim() || "(unnamed)",
+        email: String(u.email ?? ""),
+        roles
+      }];
+    });
+  });
+}
+async function readPhoneNumbers(client, locationId2) {
+  return readSection(async () => {
+    const raw = await client.get("/phone-system/numbers/", { params: { locationId: locationId2 } });
+    const box = raw && typeof raw === "object" ? raw : {};
+    const list = Array.isArray(box.phoneNumbers) ? box.phoneNumbers : [];
+    return list.flatMap((entry) => {
+      if (!entry || typeof entry !== "object") return [];
+      const n = entry;
+      const number = String(n.value ?? n.number ?? "");
+      return number ? [{ number, label: n.title ? String(n.title) : void 0 }] : [];
+    });
+  });
+}
+async function readSocialAccounts(client, locationId2) {
+  return readSection(async () => {
+    const raw = await client.get(`/social-media-posting/${locationId2}/accounts`);
+    const box = raw && typeof raw === "object" ? raw : {};
+    const results = box.results && typeof box.results === "object" ? box.results : {};
+    const list = Array.isArray(results.accounts) ? results.accounts : [];
+    return list.flatMap((entry) => {
+      if (!entry || typeof entry !== "object") return [];
+      const a = entry;
+      return [{ platform: String(a.platform ?? "unknown"), name: String(a.name ?? a.id ?? "") }];
+    });
+  });
+}
+var OFF_PLATFORM_ASSETS = [
+  "Website domain",
+  "Logo and brand files",
+  "Meta pixel or ad account",
+  "Google Analytics",
+  "Payment processor account",
+  "Email sending domain"
+];
+function discoverAssets(input) {
+  const assets = [];
+  for (const p of sectionItems(input.phoneNumbers)) assets.push(`Phone number ${p.number}`);
+  for (const s of sectionItems(input.socialAccounts)) assets.push(`${s.platform} account ${s.name}`.trim());
+  const funnels = input.inventory.funnels;
+  if (funnels && !funnels.unavailable) for (const name of funnels.names) assets.push(`Funnel "${name}"`);
+  assets.push(...OFF_PLATFORM_ASSETS);
+  return assets;
 }
 function buildLocationComparison(dataA, dataB, sections) {
   const unavailable = [];
@@ -14589,7 +15251,7 @@ function buildOfferPayload(o) {
 var import_zod52 = require("zod");
 var fs7 = __toESM(require("fs"));
 var path6 = __toESM(require("path"));
-function delay3(ms) {
+function delay4(ms) {
   return new Promise((resolve8) => setTimeout(resolve8, ms));
 }
 var TemplateSchema = import_zod52.z.object({
@@ -14774,7 +15436,7 @@ function registerTemplateDeployerTools(server2, client) {
               errors.push(`Location update: ${errorMessage(e)}`);
               log.push("  \u2717 Location update failed (may need agency-level key)");
             }
-            await delay3(200);
+            await delay4(200);
           }
         }
         if (template.tags) {
@@ -14793,7 +15455,7 @@ Tags: ${template.tags.length} to create`);
                   log.push(`  \u2717 Tag failed: ${tag}`);
                 }
               }
-              await delay3(100);
+              await delay4(100);
             }
           } else {
             for (const tag of template.tags) {
@@ -14823,7 +15485,7 @@ Custom Fields: ${template.customFields.length} to create`);
                   log.push(`  \u2717 Field failed: ${field.name}`);
                 }
               }
-              await delay3(100);
+              await delay4(100);
             }
           } else {
             for (const field of template.customFields) {
@@ -14869,7 +15531,7 @@ Pipelines: ${template.pipelines.length} to create`);
               } catch (e) {
                 errors.push(`Pipeline "${resolved2.name}": ${errorMessage(e)}`);
               }
-              await delay3(300);
+              await delay4(300);
             }
           }
         }
@@ -14907,7 +15569,7 @@ Workflows: ${workflows.length} to create`);
                 errors.push(`Workflow "${resolved2.name}": ${errorMessage(e)}`);
                 log.push(`  \u2717 Workflow failed: ${resolved2.name}`);
               }
-              await delay3(500);
+              await delay4(500);
             }
           }
         }
@@ -14932,7 +15594,7 @@ Calendars: ${template.calendars.length} to create`);
                 errors.push(`Calendar "${resolved2.name}": ${errorMessage(e)}`);
                 log.push(`  \u2717 Calendar failed: ${resolved2.name}`);
               }
-              await delay3(200);
+              await delay4(200);
             }
           }
         }
@@ -19411,7 +20073,7 @@ function registerAllTools(server2, client, registry2, mcpVersion, env = process.
     () => buildGatingReport(config3, KNOWN_MODULES, attemptedTools, registeredTools, outOfBand)
   );
   registerSnapshotTools(wrap(SNAPSHOTS_MODULE), client, registry2);
-  registerAccountExportTools(wrap(ACCOUNT_EXPORT_MODULE), client, registry2);
+  registerAccountExportTools(wrap(ACCOUNT_EXPORT_MODULE), client, registry2, builderClient);
   registerLocationSwitcherTools(
     wrap(LOCATION_SWITCHER_MODULE),
     client,