@elitedcs/ghl-mcp 3.66.2 → 3.68.0

package/dist/index.js

@@ -147,10 +147,10 @@ var init_ghl_client = __esm({
             throw new Error(`Request timeout (30s): ${method} ${path15}`);
           }
           if (!options.noRetry && attempt < MAX_RETRIES) {
-            const delay4 = computeRetryDelay(null, attempt, BASE_DELAY_MS);
-            process.stderr.write(`[ghl-mcp] Network error on ${method} ${path15}, retry ${attempt + 1}/${MAX_RETRIES} in ${delay4}ms
+            const delay5 = computeRetryDelay(null, attempt, BASE_DELAY_MS);
+            process.stderr.write(`[ghl-mcp] Network error on ${method} ${path15}, retry ${attempt + 1}/${MAX_RETRIES} in ${delay5}ms
 `);
-            await new Promise((r) => setTimeout(r, delay4));
+            await new Promise((r) => setTimeout(r, delay5));
             return this.request(method, path15, options, attempt + 1);
           }
           throw error;
@@ -158,10 +158,10 @@ var init_ghl_client = __esm({
           clearTimeout(timeout);
         }
         if (!options.noRetry && (response.status === 429 || response.status >= 500) && attempt < MAX_RETRIES) {
-          const delay4 = computeRetryDelay(response.headers.get("Retry-After"), attempt, BASE_DELAY_MS);
-          process.stderr.write(`[ghl-mcp] ${response.status} on ${method} ${path15}, retry ${attempt + 1}/${MAX_RETRIES} in ${delay4}ms
+          const delay5 = computeRetryDelay(response.headers.get("Retry-After"), attempt, BASE_DELAY_MS);
+          process.stderr.write(`[ghl-mcp] ${response.status} on ${method} ${path15}, retry ${attempt + 1}/${MAX_RETRIES} in ${delay5}ms
 `);
-          await new Promise((r) => setTimeout(r, delay4));
+          await new Promise((r) => setTimeout(r, delay5));
           return this.request(method, path15, options, attempt + 1);
         }
         if (!response.ok) {
@@ -1648,7 +1648,7 @@ Note: Firebase credentials rejected (${fb.error}).`;
       const telemetryLine = telemetryDisabled(process.env) ? "" : `
 
 ${TELEMETRY_DISCLOSURE}`;
-      const finishedCount = isFree ? "111" : "239";
+      const finishedCount = isFree ? "112" : "242";
       const freeTip = isFree ? `
 
 Free tier: read-only. Write tools stay visible but answer with upgrade info instead of acting. Full version ($97/mo founding rate) upgrades in place \u2014 same install, you only swap the license key: https://ghlcommand.com` : "";
@@ -1693,7 +1693,7 @@ Free tier: read-only. Write tools stay visible but answer with upgrade info inst
 function registerEnableWorkflowBuilderTool(server2) {
   server2.tool(
     "enable_workflow_builder",
-    "Add Firebase credentials to an existing GHL Command install to unlock 55 additional tools across the internal-API modules: workflow builder (create/edit/clone/delete/publish/validate workflows, build_if_else_branch, build_goal_event, get_trigger_registry), funnel + page builder, form builder, pipeline builder, workflow cloner, smart lists, reputation, email campaigns, email templates, and memberships, plus the pre-deploy validator. On the FREE tier this same login unlocks the read-only auditor suite (audit_workflows, validate_workflow, full-detail workflow/funnel/pipeline reads). Requires you've already run setup_ghl_mcp. EASIEST PATH: run `capture_firebase_interactive` instead \u2014 a Chrome window opens, you log into GHL, zero pasting. Use THIS tool when you have JSON from `auto_capture_firebase_script` (console-paste path) to put in `firebase_paste`, or the three manual DevTools fields. Tool count goes from 184 to 239 after the next Claude restart.",
+    "Add Firebase credentials to an existing GHL Command install to unlock 55 additional tools across the internal-API modules: workflow builder (create/edit/clone/delete/publish/validate workflows, build_if_else_branch, build_goal_event, get_trigger_registry), funnel + page builder, form builder, pipeline builder, workflow cloner, smart lists, reputation, email campaigns, email templates, and memberships, plus the pre-deploy validator. On the FREE tier this same login unlocks the read-only auditor suite (audit_workflows, validate_workflow, full-detail workflow/funnel/pipeline reads). Requires you've already run setup_ghl_mcp. EASIEST PATH: run `capture_firebase_interactive` instead \u2014 a Chrome window opens, you log into GHL, zero pasting. Use THIS tool when you have JSON from `auto_capture_firebase_script` (console-paste path) to put in `firebase_paste`, or the three manual DevTools fields. Tool count goes from 187 to 242 after the next Claude restart.",
     {
       // v3.25.0: one-paste path. Tool runs `auto_capture_firebase_script` to
       // get the console script; the script returns a JSON object that pastes
@@ -2854,9 +2854,9 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@elitedcs/ghl-mcp",
-      version: "3.66.2",
+      version: "3.68.0",
       mcpName: "io.github.drjerryrelth/ghl-command",
-      description: "GoHighLevel MCP Server for Claude. 239 tools \u2014 full CRM, automation, marketing control, account-wide workflow audit, live funnel-capture verification, and the only programmatic GHL workflow builder, now multi-tenant across client accounts.",
+      description: "GoHighLevel MCP Server for Claude. 242 tools \u2014 full CRM, automation, marketing control, account-wide workflow audit, live funnel-capture verification, and the only programmatic GHL workflow builder, now multi-tenant across client accounts.",
       main: "dist/index.js",
       bin: {
         "ghl-mcp": "dist/index.js"
@@ -6187,10 +6187,10 @@ var WorkflowBuilderClient = class _WorkflowBuilderClient {
         throw new Error(`Request timeout (30s): ${method} ${urlPath}`);
       }
       if (attempt < MAX_RETRIES2) {
-        const delay4 = computeRetryDelay(null, attempt, BASE_DELAY_MS2);
-        process.stderr.write(`[ghl-mcp] Network error on ${method} ${urlPath}, retry ${attempt + 1}/${MAX_RETRIES2} in ${delay4}ms
+        const delay5 = computeRetryDelay(null, attempt, BASE_DELAY_MS2);
+        process.stderr.write(`[ghl-mcp] Network error on ${method} ${urlPath}, retry ${attempt + 1}/${MAX_RETRIES2} in ${delay5}ms
 `);
-        await new Promise((r) => setTimeout(r, delay4));
+        await new Promise((r) => setTimeout(r, delay5));
         return this.request(method, urlPath, body, attempt + 1);
       }
       throw error;
@@ -6198,10 +6198,10 @@ var WorkflowBuilderClient = class _WorkflowBuilderClient {
       clearTimeout(timeout);
     }
     if ((response.status === 429 || response.status >= 500) && attempt < MAX_RETRIES2) {
-      const delay4 = computeRetryDelay(response.headers.get("Retry-After"), attempt, BASE_DELAY_MS2);
-      process.stderr.write(`[ghl-mcp] ${response.status} on ${method} ${urlPath}, retry ${attempt + 1}/${MAX_RETRIES2} in ${delay4}ms
+      const delay5 = computeRetryDelay(response.headers.get("Retry-After"), attempt, BASE_DELAY_MS2);
+      process.stderr.write(`[ghl-mcp] ${response.status} on ${method} ${urlPath}, retry ${attempt + 1}/${MAX_RETRIES2} in ${delay5}ms
 `);
-      await new Promise((r) => setTimeout(r, delay4));
+      await new Promise((r) => setTimeout(r, delay5));
       return this.request(method, urlPath, body, attempt + 1);
     }
     if (!response.ok) {
@@ -6506,8 +6506,10 @@ var FREE_TIER_EXTRA_READ_TOOLS = /* @__PURE__ */ new Set([
   // live funnel QA (reads + public URL probes)
   "check_blog_slug",
   // slug availability lookup
-  "workflow_builder_status"
+  "workflow_builder_status",
   // no-Firebase fallback diagnostic (pure status read)
+  "run_checkup"
+  // whole-install checkup: install layer + live capability probe (all reads)
 ]);
 var FREE_TIER_EXCLUDED_TOOLS = /* @__PURE__ */ new Set([
   "export_account"
@@ -10182,6 +10184,18 @@ function summarizeWebhookWorkflow(workflow) {
   };
 }
 var WorkflowListSchema = import_zod34.z.object({ rows: import_zod34.z.array(import_zod34.z.object({ _id: import_zod34.z.string().optional(), id: import_zod34.z.string().optional() }).passthrough()).optional() }).passthrough();
+async function loadWebhooks(client, limit) {
+  const listed = WorkflowListSchema.parse(await client.listWorkflows(limit, 0));
+  const rows = listed.rows ?? [];
+  const webhooks = [];
+  for (const row of rows) {
+    const id = row._id ?? row.id;
+    if (!id) continue;
+    const summary = summarizeWebhookWorkflow(await client.getWorkflow(id));
+    if (summary) webhooks.push(summary);
+  }
+  return { webhooks, scanned: rows.length };
+}
 function registerWebhookTools(server2, builderClient) {
   const requireClient = () => {
     if (!builderClient) {
@@ -10191,18 +10205,6 @@ function registerWebhookTools(server2, builderClient) {
     }
     return builderClient;
   };
-  const loadWebhooks = async (client, limit) => {
-    const listed = WorkflowListSchema.parse(await client.listWorkflows(limit, 0));
-    const rows = listed.rows ?? [];
-    const webhooks = [];
-    for (const row of rows) {
-      const id = row._id ?? row.id;
-      if (!id) continue;
-      const summary = summarizeWebhookWorkflow(await client.getWorkflow(id));
-      if (summary) webhooks.push(summary);
-    }
-    return { webhooks, scanned: rows.length };
-  };
   server2.tool(
     "list_webhooks",
     "List every webhook in the current sub-account. A webhook here is a workflow that fires a `webhook` action, so this also finds ones built by hand in the GHL UI. Returns the URL, HTTP method and triggering events for each. NOTE: GoHighLevel has no webhook REST API (it is Marketplace-OAuth only) \u2014 webhooks live on the workflow layer, which is why each one has a workflow ID and shows up in the client's Automation list. " + WEBHOOK_PAYLOAD_NOTE,
@@ -10350,10 +10352,10 @@ function registerWebhookTools(server2, builderClient) {
       confirm: import_zod34.z.literal("DELETE").describe("Must be 'DELETE' to confirm this destructive action."),
       force: import_zod34.z.boolean().optional().describe("Delete even when the workflow contains other actions that would go with it.")
     },
-    async ({ webhookId, confirm, force }) => {
+    async ({ webhookId, confirm: confirm2, force }) => {
       try {
         const client = requireClient();
-        if (confirm !== "DELETE") throw new Error("Pass confirm: 'DELETE' to delete a webhook.");
+        if (confirm2 !== "DELETE") throw new Error("Pass confirm: 'DELETE' to delete a webhook.");
         const summary = summarizeWebhookWorkflow(await client.getWorkflow(webhookId));
         if (!summary) {
           throw new Error(
@@ -12072,7 +12074,7 @@ ${await response.text()}`);
       );
     };
     if (priorDataUrl) refuseCreate(livePageVersion);
-    for (let confirm = 0; confirm < 3; confirm++) {
+    for (let confirm2 = 0; confirm2 < 3; confirm2++) {
       await new Promise((r) => setTimeout(r, 1500));
       let again = null;
       try {
@@ -13666,8 +13668,8 @@ function registerBulkOperationTools(server2, client) {
       contactIds: import_zod45.z.array(import_zod45.z.string()).min(1, "At least one contact ID required.").describe("Array of contact IDs to permanently delete."),
       confirm: import_zod45.z.literal("DELETE").describe("Must pass the string 'DELETE' to confirm. This is a safety check.")
     },
-    async ({ contactIds, confirm }) => {
-      if (confirm !== "DELETE") {
+    async ({ contactIds, confirm: confirm2 }) => {
+      if (confirm2 !== "DELETE") {
         return errorResponse("Safety check failed. Pass confirm: 'DELETE' to proceed.");
       }
       const results = { success: 0, failed: 0, errors: [] };
@@ -13688,9 +13690,391 @@ function registerBulkOperationTools(server2, client) {
 
 // src/tools/account-export.ts
 var import_zod46 = require("zod");
+
+// src/contact-export.ts
+var CONTACT_PAGE_SIZE = 100;
+var DEFAULT_MAX_CONTACTS = 5e3;
+var MAX_PAGES = 1e3;
+function isComplete(reason) {
+  return reason === "complete";
+}
+function stopReasonSentence(reason, fetched, cap) {
+  switch (reason) {
+    case "complete":
+      return `All ${fetched} contacts were exported.`;
+    case "cap-reached":
+      return `INCOMPLETE: ${fetched} contacts were exported and the limit of ${cap} was reached. This account has more contacts than that. Run it again with a higher limit before treating this file as the full list.`;
+    case "cursor-exhausted":
+      return `INCOMPLETE: ${fetched} contacts were exported, then GoHighLevel stopped providing a way to ask for the next page. Treat this file as partial.`;
+    case "cursor-stalled":
+      return `INCOMPLETE: ${fetched} contacts were exported, then GoHighLevel began returning the same page repeatedly. The export stopped rather than loop. Treat this file as partial.`;
+    case "page-ceiling":
+      return `INCOMPLETE: ${fetched} contacts were exported and the internal page ceiling was reached. Treat this file as partial.`;
+  }
+}
 function delay2(ms) {
   return new Promise((resolve8) => setTimeout(resolve8, ms));
 }
+async function fetchAllContacts(client, locationId2, options = {}) {
+  const cap = options.maxContacts ?? DEFAULT_MAX_CONTACTS;
+  const pauseMs = options.pauseMs ?? 100;
+  const rows = [];
+  let startAfter;
+  let startAfterId;
+  let pages = 0;
+  let indexTotal = null;
+  let stopReason = "complete";
+  while (true) {
+    if (pages >= MAX_PAGES) {
+      stopReason = "page-ceiling";
+      break;
+    }
+    const raw = await client.get("/contacts/", {
+      params: {
+        locationId: locationId2,
+        limit: CONTACT_PAGE_SIZE,
+        // Both cursor halves or neither. Sending one alone re-serves page 1.
+        startAfter,
+        startAfterId
+      }
+    });
+    const parsed = ContactSearchResponseSchema.parse(raw);
+    pages += 1;
+    if (pages === 1 && typeof parsed.meta?.total === "number") {
+      indexTotal = parsed.meta.total;
+    }
+    if (parsed.contacts.length === 0) {
+      stopReason = "complete";
+      break;
+    }
+    for (const contact of parsed.contacts) {
+      rows.push(contact);
+      if (rows.length >= cap) break;
+    }
+    if (rows.length >= cap) {
+      stopReason = "cap-reached";
+      break;
+    }
+    const nextAfter = parsed.meta?.startAfter ?? void 0;
+    const nextAfterId = parsed.meta?.startAfterId ?? void 0;
+    if (nextAfter == null || !nextAfterId) {
+      stopReason = "cursor-exhausted";
+      break;
+    }
+    if (nextAfter === startAfter && nextAfterId === startAfterId) {
+      stopReason = "cursor-stalled";
+      break;
+    }
+    startAfter = nextAfter;
+    startAfterId = nextAfterId;
+    if (pauseMs > 0) await delay2(pauseMs);
+  }
+  return {
+    rows,
+    fetched: rows.length,
+    pages,
+    stopReason,
+    complete: isComplete(stopReason),
+    indexTotal
+  };
+}
+var PREFERRED_COLUMNS = [
+  "id",
+  "firstName",
+  "lastName",
+  "name",
+  "email",
+  "phone",
+  "companyName",
+  "tags",
+  "source",
+  "type",
+  "dateAdded",
+  "dateUpdated",
+  "address1",
+  "city",
+  "state",
+  "postalCode",
+  "country",
+  "timezone",
+  "dnd"
+];
+function neutralizeFormula(text) {
+  return /^[=+\-@\t\r]/.test(text) ? `'${text}` : text;
+}
+function cell(value) {
+  if (value === null || value === void 0) return "";
+  const raw = typeof value === "string" ? value : typeof value === "number" || typeof value === "boolean" ? String(value) : JSON.stringify(value);
+  const text = neutralizeFormula(raw);
+  return /[",\n\r]/.test(text) ? `"${text.replace(/"/g, '""')}"` : text;
+}
+function contactsToCsv(rows) {
+  if (rows.length === 0) return "";
+  const seen = /* @__PURE__ */ new Set();
+  for (const row of rows) for (const key of Object.keys(row)) seen.add(key);
+  const preferred = PREFERRED_COLUMNS.filter((c) => seen.has(c));
+  const rest = [...seen].filter((c) => !preferred.includes(c)).sort();
+  const columns = [...preferred, ...rest];
+  const lines = [columns.join(",")];
+  for (const row of rows) lines.push(columns.map((c) => cell(row[c])).join(","));
+  return lines.join("\n");
+}
+
+// src/asset-ownership.ts
+var OWNERSHIP_PREFIX = "Offboarding Owner: ";
+var OWNER_KINDS = ["client", "agency", "borrowed", "third-party"];
+var OWNER_MEANING = {
+  client: "The client owns this. It stays with them and they keep paying for it.",
+  agency: "The agency owns this. It leaves with the agency unless it is sold or transferred.",
+  borrowed: "Borrowed for the engagement. It must be returned, disconnected, or replaced at exit.",
+  "third-party": "Owned by an outside vendor. Transfer depends on that vendor's own process."
+};
+function readCustomValues(raw) {
+  const box = raw && typeof raw === "object" ? raw : {};
+  const list = Array.isArray(box.customValues) ? box.customValues : [];
+  return list.flatMap((entry) => {
+    if (!entry || typeof entry !== "object") return [];
+    const row = entry;
+    if (typeof row.id !== "string" || typeof row.name !== "string") return [];
+    return [{ id: row.id, name: row.name, value: typeof row.value === "string" ? row.value : "" }];
+  });
+}
+function isOwnerKind(value) {
+  return OWNER_KINDS.includes(value);
+}
+function encodeOwnership(owner, note) {
+  return note && note.trim() ? `${owner} | ${note.trim()}` : owner;
+}
+function decodeOwnership(value) {
+  const [head, ...rest] = value.split("|");
+  const owner = head.trim();
+  const note = rest.join("|").trim();
+  return { owner: isOwnerKind(owner) ? owner : null, note: note || void 0 };
+}
+async function readOwnership(client, locationId2) {
+  const values = readCustomValues(await client.get(`/locations/${locationId2}/customValues`));
+  const records = [];
+  const unreadable = [];
+  for (const value of values) {
+    if (!value.name.startsWith(OWNERSHIP_PREFIX)) continue;
+    const asset = value.name.slice(OWNERSHIP_PREFIX.length).trim();
+    const { owner, note } = decodeOwnership(value.value);
+    if (!owner) {
+      unreadable.push(`${asset}: "${value.value}"`);
+      continue;
+    }
+    records.push({ asset, owner, note, customValueId: value.id });
+  }
+  return { records, unreadable };
+}
+async function writeOwnership(client, locationId2, entries) {
+  const existing = readCustomValues(await client.get(`/locations/${locationId2}/customValues`));
+  const results = [];
+  for (const entry of entries) {
+    const asset = entry.asset.trim();
+    const name = `${OWNERSHIP_PREFIX}${asset}`;
+    const matches = existing.filter((value) => value.name === name);
+    if (matches.length > 1) {
+      results.push({
+        asset,
+        action: "halted",
+        reason: `${matches.length} custom values are named "${name}". Updating by name cannot tell them apart, so nothing was changed. Delete the extras in GHL, then run this again.`
+      });
+      continue;
+    }
+    const body = { name, value: encodeOwnership(entry.owner, entry.note) };
+    if (matches.length === 1) {
+      if (!matches[0].id) {
+        results.push({
+          asset,
+          action: "halted",
+          reason: `"${name}" was created earlier in this request but GoHighLevel did not return its id, so it cannot be updated safely. Run this asset again on its own.`
+        });
+        continue;
+      }
+      await client.put(`/locations/${locationId2}/customValues/${matches[0].id}`, { body });
+      results.push({ asset, action: "updated", customValueId: matches[0].id });
+      continue;
+    }
+    const created = await client.post(`/locations/${locationId2}/customValues`, { body });
+    const createdId = readCreatedId(created);
+    existing.push({ id: createdId ?? "", name, value: body.value });
+    results.push({ asset, action: "created", customValueId: createdId });
+  }
+  return results;
+}
+function readCreatedId(raw) {
+  if (!raw || typeof raw !== "object") return void 0;
+  const box = raw;
+  if (typeof box.id === "string") return box.id;
+  const nested = box.customValue;
+  if (nested && typeof nested === "object") {
+    const inner = nested.id;
+    if (typeof inner === "string") return inner;
+  }
+  return void 0;
+}
+
+// src/handoff-doc.ts
+function sectionItems(section2) {
+  return Array.isArray(section2) ? section2 : [];
+}
+function bullet(lines) {
+  return lines.length ? lines.map((l) => `- ${l}`).join("\n") : "- None found.";
+}
+function plainReason(reason) {
+  const withoutBody = reason.split(/[{\n]/)[0];
+  const withoutRoute = withoutBody.replace(/:?\s*(GET|POST|PUT|DELETE)\s+\/\S*/g, "");
+  const cleaned = withoutRoute.replace(/\s+/g, " ").replace(/[:\s]+$/, "").trim();
+  return cleaned || "the account did not return this section";
+}
+function inventoryTable(inventory) {
+  const rows = Object.entries(inventory).map(([section2, data]) => {
+    if (data.unavailable) return `| ${section2} | not read | ${plainReason(data.unavailable)} |`;
+    const sample = data.names.slice(0, 8).join(", ");
+    const more = data.names.length > 8 ? `, and ${data.names.length - 8} more` : "";
+    return `| ${section2} | ${data.count ?? data.names.length} | ${sample || "none"}${more} |`;
+  });
+  return ["| What | How many | Which ones |", "| --- | --- | --- |", ...rows].join("\n");
+}
+function sectionList(section2, render) {
+  if (!Array.isArray(section2)) {
+    return `**Not read.** ${plainReason(section2.unavailable)}. This section is unknown, which is NOT the same as empty. Check it by hand before you rely on this document.`;
+  }
+  return bullet(section2.map(render));
+}
+function buildHandoffDoc(input) {
+  const {
+    accountName,
+    locationId: locationId2,
+    generatedAt,
+    contacts,
+    inventory,
+    users,
+    phoneNumbers,
+    socialAccounts,
+    webhooks,
+    webhookScanPartial,
+    ownership
+  } = input;
+  const ownedBy = (kind) => ownership.recorded.filter((r) => r.owner === kind);
+  const ownershipSection = ownership.recorded.length ? ["client", "agency", "borrowed", "third-party"].map((kind) => {
+    const items = ownedBy(kind);
+    if (!items.length) return "";
+    return `**${kind}** ${OWNER_MEANING[kind]}
+
+${bullet(
+      items.map((i) => i.note ? `${i.asset} (${i.note})` : i.asset)
+    )}`;
+  }).filter(Boolean).join("\n\n") : "Nothing has been recorded yet. Every asset below is unanswered.";
+  const unknownSection = ownership.unknown.length ? `These exist in the account but nobody has said who owns them. Answer them once and they stay answered:
+
+${bullet(ownership.unknown)}` : "Every asset found in this account has a recorded owner.";
+  const webhookSection = sectionList(webhooks, (w) => `${w.name} sends to ${w.url}${w.events.length ? ` when: ${w.events.join(", ")}` : ""}`) + (webhookScanPartial ? `
+
+**This list may be incomplete.** ${webhookScanPartial}` : "");
+  return `# Account handoff: ${accountName}
+
+Prepared ${generatedAt}. GoHighLevel account ID ${locationId2}.
+
+This document describes what is inside this account, who can get into it, and
+what has to change hands. It was generated from the live account, not from
+memory.
+
+## Read this first
+
+${contacts.complete ? "" : '**The contact export in this package is incomplete. See "Contacts" below before you rely on it.**\n\n'}Three things this document deliberately does not contain:
+
+1. **No passwords or API keys.** GoHighLevel does not hand out key values to any
+   tool, including this one. What you get instead is a list of every place a key
+   exists, so you can rotate them. That list is at the end.
+2. **No opinion about who owns what**, beyond what somebody actually recorded.
+   Anything unanswered is listed as unanswered.
+3. **No guesses about what is missing.** If a section could not be read, it says
+   so and why, rather than showing zero.
+
+## Contacts
+
+${contacts.sentence}${contacts.indexTotal !== null ? `
+
+GoHighLevel's own index reports **${contacts.indexTotal}** contacts for this account. This export contains **${contacts.exported}**. These two numbers are counted differently and GoHighLevel's index updates on a delay, so a small difference is normal and does not by itself mean the export is short.` : ""}
+
+## What is in the account
+
+${inventoryTable(inventory)}
+
+## Who can get in
+
+### People with logins
+
+${sectionList(users, (u) => `${u.name} (${u.email})${u.roles ? `, ${u.roles}` : ""}`)}
+
+Every person above can log into this account right now. Remove the ones who
+should not be able to, on the day the relationship ends, not later.
+
+### Phone numbers
+
+${sectionList(phoneNumbers, (p) => p.label ? `${p.number} (${p.label})` : p.number)}
+
+Numbers are rented from GoHighLevel and stop working if the account lapses. If
+the client needs to keep a number, it has to be ported out before then, and
+porting takes days to weeks.
+
+### Connected accounts
+
+${sectionList(socialAccounts, (s) => `${s.platform}: ${s.name}`)}
+
+These connections were authorised by a person. If that person leaves, the
+connection can break even though nothing in GoHighLevel changed.
+
+### Outbound webhooks
+
+${webhookSection}
+
+Each of these sends data out of this account to somewhere else. Confirm the
+receiving system should still be receiving it.
+
+## Who owns what
+
+${ownershipSection}
+
+### Not yet answered
+
+${unknownSection}
+${ownership.unreadable.length ? `
+### Recorded but unreadable
+
+Somebody edited these by hand and the answer no longer parses. They need a human:
+
+${bullet(ownership.unreadable)}
+` : ""}
+## Rotate these on the way out
+
+Key values cannot be read by any tool, so this is a checklist of places to go
+and change something, not a list of secrets.
+
+- The GoHighLevel Private Integration key for this account. Anyone holding the
+  old one keeps full access until it is deleted.
+- Any Firebase or agency-level credential used to reach this account.
+- Every connected account listed above, if the departing party authorised it.
+- Every webhook destination above, if it authenticates with a shared secret.
+- Any payment processor, email sending domain, or advertising account attached
+  to this business but living outside GoHighLevel.
+
+## What to do next
+
+1. Save the contact export alongside this document.
+2. Answer anything under "Not yet answered" and re-run the kit so the answers
+   are stored in the account itself.
+3. Work down the rotation list above.
+4. Remove the logins that should no longer exist.
+`;
+}
+
+// src/tools/account-export.ts
+function delay3(ms) {
+  return new Promise((resolve8) => setTimeout(resolve8, ms));
+}
 function builderSectionAvailability(builderLocationId, requestedLocationId) {
   if (!builderLocationId) {
     return {
@@ -13726,7 +14110,7 @@ function registerAccountExportTools(server2, client, registry2, builderClient) {
         } catch (e) {
           report.location = `Error fetching: ${errorMessage(e)}`;
         }
-        await delay2(100);
+        await delay3(100);
         try {
           const contacts = await client.get("/contacts/", {
             params: { locationId: locId, limit: includeContacts ? 100 : 1 }
@@ -13741,7 +14125,7 @@ function registerAccountExportTools(server2, client, registry2, builderClient) {
         } catch (e) {
           report.contacts = `Error fetching: ${errorMessage(e)}`;
         }
-        await delay2(100);
+        await delay3(100);
         try {
           report.pipelines = await client.get("/opportunities/pipelines", {
             params: { locationId: locId }
@@ -13749,7 +14133,7 @@ function registerAccountExportTools(server2, client, registry2, builderClient) {
         } catch (e) {
           report.pipelines = `Error fetching: ${errorMessage(e)}`;
         }
-        await delay2(100);
+        await delay3(100);
         try {
           report.workflows = await client.get("/workflows/", {
             params: { locationId: locId }
@@ -13757,7 +14141,7 @@ function registerAccountExportTools(server2, client, registry2, builderClient) {
         } catch (e) {
           report.workflows = `Error fetching: ${errorMessage(e)}`;
         }
-        await delay2(100);
+        await delay3(100);
         const builderUse = builderSectionAvailability(builderClient?.locationId, locId);
         if (builderUse.usable && builderClient) {
           try {
@@ -13765,7 +14149,7 @@ function registerAccountExportTools(server2, client, registry2, builderClient) {
           } catch (e) {
             report.workflowsFull = `Error fetching: ${errorMessage(e)}`;
           }
-          await delay2(100);
+          await delay3(100);
         } else {
           report.workflowsFull = builderUse.reason;
         }
@@ -13781,7 +14165,7 @@ function registerAccountExportTools(server2, client, registry2, builderClient) {
           } catch (e) {
             report.funnels = `Error fetching: ${errorMessage(e)}`;
           }
-          await delay2(100);
+          await delay3(100);
         } else {
           try {
             report.funnels = await client.get("/funnels/", {
@@ -13798,25 +14182,25 @@ function registerAccountExportTools(server2, client, registry2, builderClient) {
         } catch (e) {
           report.forms = `Error fetching: ${errorMessage(e)}`;
         }
-        await delay2(100);
+        await delay3(100);
         try {
           report.customFields = await client.get("/locations/" + locId + "/customFields");
         } catch (e) {
           report.customFields = `Error fetching: ${errorMessage(e)}`;
         }
-        await delay2(100);
+        await delay3(100);
         try {
           report.customValues = await client.get("/locations/" + locId + "/customValues");
         } catch (e) {
           report.customValues = `Error fetching: ${errorMessage(e)}`;
         }
-        await delay2(100);
+        await delay3(100);
         try {
           report.tags = await client.get("/locations/" + locId + "/tags");
         } catch (e) {
           report.tags = `Error fetching: ${errorMessage(e)}`;
         }
-        await delay2(100);
+        await delay3(100);
         try {
           report.calendars = await client.get("/calendars/", {
             params: { locationId: locId }
@@ -13824,7 +14208,7 @@ function registerAccountExportTools(server2, client, registry2, builderClient) {
         } catch (e) {
           report.calendars = `Error fetching: ${errorMessage(e)}`;
         }
-        await delay2(100);
+        await delay3(100);
         try {
           report.users = await client.get("/users/", {
             params: { locationId: locId }
@@ -13870,13 +14254,13 @@ function registerAccountExportTools(server2, client, registry2, builderClient) {
         const fetchData = async (locId) => {
           const data = {};
           data.pipelines = await read(() => client.get("/opportunities/pipelines", { params: { locationId: locId } }));
-          await delay2(100);
+          await delay3(100);
           data.workflows = await read(() => client.get("/workflows/", { params: { locationId: locId } }));
-          await delay2(100);
+          await delay3(100);
           data.customFields = await read(() => client.get(`/locations/${locId}/customFields`));
-          await delay2(100);
+          await delay3(100);
           data.tags = await read(() => client.get(`/locations/${locId}/tags`));
-          await delay2(100);
+          await delay3(100);
           data.forms = await read(() => client.get("/forms/", { params: { locationId: locId } }));
           return data;
         };
@@ -13909,6 +14293,270 @@ function registerAccountExportTools(server2, client, registry2, builderClient) {
       }
     }
   );
+  server2.tool(
+    "build_offboarding_kit",
+    "Assemble the complete exit package for a sub-account: a full contact export, an inventory of everything the account contains, an access map of every person and connected account that can reach it, the recorded owner of each asset, a key-rotation checklist, and a plain-language handoff document the next operator can follow. Read-only: it changes nothing. locationId is REQUIRED and never defaults, because exporting the wrong client's account is the one mistake this tool must not be able to make. Assets nobody has recorded an owner for come back under ownership.unanswered \u2014 answer those with record_asset_ownership and they stay answered. Key VALUES are never included: GoHighLevel does not expose them to any tool, so the kit lists where each key lives instead.",
+    {
+      locationId: import_zod46.z.string().describe("Sub-account to build the kit for. REQUIRED \u2014 this tool never falls back to the active account."),
+      contacts: import_zod46.z.enum(["summary", "csv"]).optional().describe(
+        "'summary' (default) returns contact counts only. 'csv' also returns the full contact export as CSV text, which can be large \u2014 ask for it when you are ready to save the file."
+      ),
+      maxContacts: import_zod46.z.number().int().positive().optional().describe(`Ceiling on contacts read. Defaults to ${DEFAULT_MAX_CONTACTS}. If the ceiling is hit, the kit says so in the handoff document itself rather than quietly returning a short list.`)
+    },
+    async ({ locationId: locationId2, contacts, maxContacts }) => {
+      const originalKey = client.getApiKey();
+      const registered = registry2?.getToken(locationId2);
+      const usedRegisteredKey = Boolean(registered?.apiKey && registered.apiKey !== originalKey);
+      if (usedRegisteredKey && registered?.apiKey) client.setApiKey(registered.apiKey);
+      try {
+        const generatedAt = (/* @__PURE__ */ new Date()).toISOString();
+        let accountName = locationId2;
+        let location = null;
+        try {
+          location = await client.get(`/locations/${locationId2}`);
+          const box = location && typeof location === "object" ? location : {};
+          const inner = box.location && typeof box.location === "object" ? box.location : box;
+          if (typeof inner.name === "string" && inner.name) accountName = inner.name;
+        } catch (e) {
+          location = `Error fetching: ${errorMessage(e)}`;
+        }
+        await delay3(100);
+        const inventory = {};
+        const section2 = async (label, fn) => {
+          try {
+            const names = extractNames(await fn());
+            inventory[label] = { count: names.length, names };
+          } catch (e) {
+            inventory[label] = { count: null, names: [], unavailable: errorMessage(e) };
+          }
+          await delay3(100);
+        };
+        await section2("pipelines", () => client.get("/opportunities/pipelines", { params: { locationId: locationId2 } }));
+        await section2("workflows", () => client.get("/workflows/", { params: { locationId: locationId2 } }));
+        await section2("funnels", () => client.get("/funnels/", { params: { locationId: locationId2 } }));
+        await section2("forms", () => client.get("/forms/", { params: { locationId: locationId2 } }));
+        await section2("calendars", () => client.get("/calendars/", { params: { locationId: locationId2 } }));
+        await section2("customFields", () => client.get(`/locations/${locationId2}/customFields`));
+        await section2("customValues", () => client.get(`/locations/${locationId2}/customValues`));
+        await section2("tags", () => client.get(`/locations/${locationId2}/tags`));
+        const users = await readUsers(client, locationId2);
+        await delay3(100);
+        const phoneNumbers = await readPhoneNumbers(client, locationId2);
+        await delay3(100);
+        const socialAccounts = await readSocialAccounts(client, locationId2);
+        await delay3(100);
+        const WEBHOOK_SCAN_LIMIT = 50;
+        const builderUse = builderSectionAvailability(builderClient?.locationId, locationId2);
+        let webhooks;
+        let webhookScanPartial;
+        if (builderUse.usable && builderClient) {
+          try {
+            const scan = await loadWebhooks(builderClient, WEBHOOK_SCAN_LIMIT);
+            const stillOurs = builderSectionAvailability(builderClient.locationId, locationId2);
+            if (!stillOurs.usable) {
+              webhooks = { unavailable: `The active account changed while webhooks were being read, so the result was discarded. ${stillOurs.reason ?? ""}` };
+            } else {
+              webhooks = scan.webhooks.map((w) => ({
+                name: w.name,
+                url: w.actions[0]?.url ?? "",
+                events: w.events
+              }));
+              if (scan.scanned >= WEBHOOK_SCAN_LIMIT) {
+                webhookScanPartial = `Only the first ${WEBHOOK_SCAN_LIMIT} workflows were checked and this account has at least that many, so a webhook built into a later workflow would not appear here. Check the account's Automation list by hand.`;
+              }
+            }
+          } catch (e) {
+            webhooks = { unavailable: `Error reading webhooks: ${errorMessage(e)}` };
+          }
+        } else {
+          webhooks = { unavailable: builderUse.reason ?? "Not read." };
+        }
+        let ownershipRecords = { records: [], unreadable: [] };
+        let ownershipError;
+        try {
+          ownershipRecords = await readOwnership(client, locationId2);
+        } catch (e) {
+          ownershipError = errorMessage(e);
+        }
+        const discovered = discoverAssets({ phoneNumbers, socialAccounts, inventory });
+        const answered = new Set(ownershipRecords.records.map((r) => r.asset.toLowerCase()));
+        const unanswered = discovered.filter((asset) => !answered.has(asset.toLowerCase()));
+        const cap = maxContacts ?? DEFAULT_MAX_CONTACTS;
+        let contactResult;
+        let contactSentence;
+        try {
+          contactResult = await fetchAllContacts(client, locationId2, { maxContacts: cap });
+          contactSentence = stopReasonSentence(contactResult.stopReason, contactResult.fetched, cap);
+        } catch (e) {
+          contactResult = { rows: [], fetched: 0, pages: 0, stopReason: "cursor-exhausted", complete: false, indexTotal: null };
+          contactSentence = `INCOMPLETE: the contact export failed and returned nothing. Reason: ${errorMessage(e)}`;
+        }
+        const handoffDoc = buildHandoffDoc({
+          accountName,
+          locationId: locationId2,
+          generatedAt,
+          contacts: {
+            exported: contactResult.fetched,
+            indexTotal: contactResult.indexTotal,
+            complete: contactResult.complete,
+            sentence: contactSentence
+          },
+          inventory,
+          users,
+          phoneNumbers,
+          socialAccounts,
+          webhooks,
+          webhookScanPartial,
+          ownership: {
+            recorded: ownershipRecords.records,
+            unknown: unanswered,
+            unreadable: ownershipRecords.unreadable
+          }
+        });
+        return jsonResponse({
+          account: { locationId: locationId2, name: accountName, generatedAt, usedRegisteredKey },
+          contacts: {
+            exported: contactResult.fetched,
+            ghlIndexTotal: contactResult.indexTotal,
+            complete: contactResult.complete,
+            stopReason: contactResult.stopReason,
+            pagesRead: contactResult.pages,
+            statement: contactSentence,
+            ...contacts === "csv" ? { csv: contactsToCsv(contactResult.rows) } : {
+              csvNote: "Run again with contacts:'csv' to get the full export as CSV text to save."
+            }
+          },
+          inventory,
+          accessMap: {
+            users,
+            phoneNumbers,
+            socialAccounts,
+            webhooks,
+            ...webhookScanPartial ? { webhookScanPartial } : {}
+          },
+          ownership: {
+            recorded: ownershipRecords.records,
+            unanswered,
+            unreadable: ownershipRecords.unreadable,
+            ...ownershipError ? { error: ownershipError } : {},
+            howToAnswer: "Record these with record_asset_ownership so the next run needs no interview."
+          },
+          keyRotationNote: "Key VALUES are not retrievable from GoHighLevel by any tool. The handoff document lists where each key lives so they can be rotated.",
+          handoffDoc
+        });
+      } catch (error) {
+        return errorResponse(error);
+      } finally {
+        client.setApiKey(originalKey);
+      }
+    }
+  );
+  server2.tool(
+    "record_asset_ownership",
+    "Record who owns an asset attached to a sub-account: the client, the agency, something borrowed for the engagement, or an outside vendor. Stored as custom values inside the client's own account, so the record outlives this tool and the client can read it without asking anyone. Answer these once at setup and build_offboarding_kit needs no interview later. Re-recording the same asset updates it in place instead of adding a duplicate. locationId is REQUIRED: writing ownership into the wrong client's account is worth preventing outright.",
+    {
+      locationId: import_zod46.z.string().describe("Sub-account to record ownership in. REQUIRED \u2014 never falls back to the active account."),
+      assets: import_zod46.z.array(
+        import_zod46.z.object({
+          asset: import_zod46.z.string().describe("What it is, in the words you would say out loud. e.g. 'Website domain' or 'Phone number +16025551234'."),
+          owner: import_zod46.z.enum(OWNER_KINDS).describe("client = stays with them. agency = leaves with you. borrowed = must be returned or replaced at exit. third-party = an outside vendor controls it."),
+          note: import_zod46.z.string().optional().describe("Anything the next person needs, e.g. 'registered on the client's own GoDaddy account'.")
+        })
+      ).min(1).describe("One entry per asset. Send several at once.")
+    },
+    async ({ locationId: locationId2, assets }) => {
+      const originalKey = client.getApiKey();
+      const registered = registry2?.getToken(locationId2);
+      if (registered?.apiKey && registered.apiKey !== originalKey) client.setApiKey(registered.apiKey);
+      try {
+        const results = await writeOwnership(client, locationId2, assets);
+        const halted = results.filter((r) => r.action === "halted");
+        return jsonResponse({
+          locationId: locationId2,
+          recorded: results.filter((r) => r.action !== "halted"),
+          ...halted.length ? { halted, warning: "Some assets were NOT recorded. See halted for which, and why." } : {}
+        });
+      } catch (error) {
+        return errorResponse(error);
+      } finally {
+        client.setApiKey(originalKey);
+      }
+    }
+  );
+}
+function extractNames(payload) {
+  const list = Array.isArray(payload) ? payload : payload && typeof payload === "object" ? Object.values(payload).find(Array.isArray) : void 0;
+  if (!Array.isArray(list)) return [];
+  return list.map(
+    (item) => item && typeof item === "object" ? String(item.name ?? item.id ?? "") : String(item)
+  ).filter(Boolean);
+}
+async function readSection(read) {
+  try {
+    return await read();
+  } catch (e) {
+    return { unavailable: errorMessage(e) };
+  }
+}
+async function readUsers(client, locationId2) {
+  return readSection(async () => {
+    const raw = await client.get("/users/", { params: { locationId: locationId2 } });
+    const box = raw && typeof raw === "object" ? raw : {};
+    const list = Array.isArray(box.users) ? box.users : [];
+    return list.flatMap((entry) => {
+      if (!entry || typeof entry !== "object") return [];
+      const u = entry;
+      const roles = u.roles && typeof u.roles === "object" ? String(u.roles.role ?? "") : "";
+      return [{
+        name: String(u.name ?? `${u.firstName ?? ""} ${u.lastName ?? ""}`).trim() || "(unnamed)",
+        email: String(u.email ?? ""),
+        roles
+      }];
+    });
+  });
+}
+async function readPhoneNumbers(client, locationId2) {
+  return readSection(async () => {
+    const raw = await client.get("/phone-system/numbers/", { params: { locationId: locationId2 } });
+    const box = raw && typeof raw === "object" ? raw : {};
+    const list = Array.isArray(box.phoneNumbers) ? box.phoneNumbers : [];
+    return list.flatMap((entry) => {
+      if (!entry || typeof entry !== "object") return [];
+      const n = entry;
+      const number = String(n.value ?? n.number ?? "");
+      return number ? [{ number, label: n.title ? String(n.title) : void 0 }] : [];
+    });
+  });
+}
+async function readSocialAccounts(client, locationId2) {
+  return readSection(async () => {
+    const raw = await client.get(`/social-media-posting/${locationId2}/accounts`);
+    const box = raw && typeof raw === "object" ? raw : {};
+    const results = box.results && typeof box.results === "object" ? box.results : {};
+    const list = Array.isArray(results.accounts) ? results.accounts : [];
+    return list.flatMap((entry) => {
+      if (!entry || typeof entry !== "object") return [];
+      const a = entry;
+      return [{ platform: String(a.platform ?? "unknown"), name: String(a.name ?? a.id ?? "") }];
+    });
+  });
+}
+var OFF_PLATFORM_ASSETS = [
+  "Website domain",
+  "Logo and brand files",
+  "Meta pixel or ad account",
+  "Google Analytics",
+  "Payment processor account",
+  "Email sending domain"
+];
+function discoverAssets(input) {
+  const assets = [];
+  for (const p of sectionItems(input.phoneNumbers)) assets.push(`Phone number ${p.number}`);
+  for (const s of sectionItems(input.socialAccounts)) assets.push(`${s.platform} account ${s.name}`.trim());
+  const funnels = input.inventory.funnels;
+  if (funnels && !funnels.unavailable) for (const name of funnels.names) assets.push(`Funnel "${name}"`);
+  assets.push(...OFF_PLATFORM_ASSETS);
+  return assets;
 }
 function buildLocationComparison(dataA, dataB, sections) {
   const unavailable = [];
@@ -14605,7 +15253,7 @@ function buildOfferPayload(o) {
 var import_zod52 = require("zod");
 var fs7 = __toESM(require("fs"));
 var path6 = __toESM(require("path"));
-function delay3(ms) {
+function delay4(ms) {
   return new Promise((resolve8) => setTimeout(resolve8, ms));
 }
 var TemplateSchema = import_zod52.z.object({
@@ -14790,7 +15438,7 @@ function registerTemplateDeployerTools(server2, client) {
               errors.push(`Location update: ${errorMessage(e)}`);
               log.push("  \u2717 Location update failed (may need agency-level key)");
             }
-            await delay3(200);
+            await delay4(200);
           }
         }
         if (template.tags) {
@@ -14809,7 +15457,7 @@ Tags: ${template.tags.length} to create`);
                   log.push(`  \u2717 Tag failed: ${tag}`);
                 }
               }
-              await delay3(100);
+              await delay4(100);
             }
           } else {
             for (const tag of template.tags) {
@@ -14839,7 +15487,7 @@ Custom Fields: ${template.customFields.length} to create`);
                   log.push(`  \u2717 Field failed: ${field.name}`);
                 }
               }
-              await delay3(100);
+              await delay4(100);
             }
           } else {
             for (const field of template.customFields) {
@@ -14885,7 +15533,7 @@ Pipelines: ${template.pipelines.length} to create`);
               } catch (e) {
                 errors.push(`Pipeline "${resolved2.name}": ${errorMessage(e)}`);
               }
-              await delay3(300);
+              await delay4(300);
             }
           }
         }
@@ -14923,7 +15571,7 @@ Workflows: ${workflows.length} to create`);
                 errors.push(`Workflow "${resolved2.name}": ${errorMessage(e)}`);
                 log.push(`  \u2717 Workflow failed: ${resolved2.name}`);
               }
-              await delay3(500);
+              await delay4(500);
             }
           }
         }
@@ -14948,7 +15596,7 @@ Calendars: ${template.calendars.length} to create`);
                 errors.push(`Calendar "${resolved2.name}": ${errorMessage(e)}`);
                 log.push(`  \u2717 Calendar failed: ${resolved2.name}`);
               }
-              await delay3(200);
+              await delay4(200);
             }
           }
         }
@@ -15603,167 +16251,507 @@ async function getVersionStatus(installed) {
 }
 
 // src/tools/diagnostics.ts
+async function collectInstallChecks(installedVersion, client, builderClient, registry2, getGatingReport) {
+  const checks = [];
+  const versionPromise = getVersionStatus(installedVersion);
+  const apiKeyPromise = (async () => {
+    const locId = client.defaultLocationId;
+    if (!locId) {
+      return { name: "GHL API key", status: "warn", detail: `Can't validate without a default location ID. Set GHL_LOCATION_ID or run setup_ghl_mcp.` };
+    }
+    try {
+      const response = await fetch(`https://services.leadconnectorhq.com/locations/${locId}`, {
+        method: "GET",
+        headers: {
+          Authorization: `Bearer ${client.getApiKey()}`,
+          "Content-Type": "application/json",
+          Accept: "application/json",
+          Version: "2021-07-28"
+        },
+        signal: AbortSignal.timeout(8e3)
+      });
+      if (response.status === 401) {
+        return { name: "GHL API key", status: "fail", detail: `401 Unauthorized \u2014 key ${client.getApiKeyPrefix()} is invalid or revoked. Run setup_ghl_mcp with a fresh key.` };
+      }
+      if (response.status === 403) {
+        return { name: "GHL API key", status: "fail", detail: `403 Forbidden \u2014 key ${client.getApiKeyPrefix()} doesn't have access to location ${locId}. The key may belong to a different sub-account.` };
+      }
+      if (!response.ok) {
+        return { name: "GHL API key", status: "warn", detail: `HTTP ${response.status} reading /locations/${locId} \u2014 key may be limited or GHL is having issues.` };
+      }
+      return { name: "GHL API key", status: "pass", detail: `Valid (key ${client.getApiKeyPrefix()}).` };
+    } catch (error) {
+      return { name: "GHL API key", status: "warn", detail: `Network error: ${error instanceof Error ? error.message : String(error)}. Server starts anyway; tool calls will report errors when invoked.` };
+    }
+  })();
+  const locationPromise = (async () => {
+    const locId = client.defaultLocationId;
+    if (!locId) {
+      return { name: "Default location", status: "warn", detail: "No default location set. Tools that don't accept locationId arg will fail." };
+    }
+    try {
+      const result = await client.get(`/locations/${locId}`);
+      const loc = result.location ?? result;
+      return { name: "Default location", status: "pass", detail: `${loc?.name ?? "Unknown"} (${locId}) reachable.` };
+    } catch (error) {
+      return { name: "Default location", status: "fail", detail: `Could not read location ${locId}: ${error instanceof Error ? error.message : String(error)}` };
+    }
+  })();
+  const firebasePromise = (async () => {
+    if (!builderClient) {
+      return { name: "Firebase auth (workflow builder)", status: "skip", detail: "Not configured \u2014 your install is one step from finished. Run capture_firebase_interactive: a Chrome window opens, you log into GHL once, and it captures + verifies everything itself (about 60 seconds). This powers the account auditor and the Firebase-gated tools. No Chrome on this machine? auto_capture_firebase_script is the copy-paste path. Do NOT put Firebase values as env vars in your Claude Desktop config \u2014 that path is unreliable and is the usual reason this still shows skip after a restart." };
+    }
+    const result = await builderClient.checkAuth();
+    const tokenCompany = builderClient.getTokenCompanyId();
+    const intendedCompany = builderClient.getIntendedCompanyId() ?? builderClient.getCurrentCompanyId();
+    const companyNote = intendedCompany ? ` Active location's company: ${intendedCompany}.` : "";
+    if (result.ok && intendedCompany && tokenCompany && intendedCompany !== tokenCompany) {
+      return {
+        name: "Firebase auth (workflow builder)",
+        status: "fail",
+        detail: `Company mismatch: the active location belongs to company ${intendedCompany}, but the Firebase token authenticates as ${tokenCompany}. Workflow-builder writes will 401 or hit the wrong account. This company's Firebase is missing or registered under the wrong ID. Run register_company_firebase with a token captured from that sub-account's GHL session (v3.27.0+ stores it under the correct internal ID automatically).`
+      };
+    }
+    if (result.ok) {
+      const idNote = tokenCompany ? ` Authenticated as company ${tokenCompany}.` : "";
+      return { name: "Firebase auth (workflow builder)", status: "pass", detail: `ID token refresh succeeded. Workflow builder tools are usable.${companyNote}${idNote}` };
+    }
+    return { name: "Firebase auth (workflow builder)", status: "fail", detail: `Token refresh failed: ${result.error}.${companyNote} If you're in a client's account, register its Firebase with register_company_firebase. Otherwise re-capture your Firebase values from GHL DevTools and re-run enable_workflow_builder.` };
+  })();
+  const registryCheck = (() => {
+    if (!registry2) {
+      return { name: "Token registry", status: "skip", detail: "Not initialized \u2014 using env-var credentials only. switch_location won't auto-swap keys between sub-accounts." };
+    }
+    const loadFailure = registry2.getLoadFailure();
+    if (loadFailure) {
+      return { name: "Token registry", status: "fail", detail: loadFailure };
+    }
+    const locs = registry2.listLocations();
+    const companies = registry2.listCompanyFirebases();
+    const companyNote = companies.length ? ` ${companies.length} company Firebase credential(s) registered for multi-tenant workflow-builder access.` : "";
+    if (locs.length === 0) {
+      return { name: "Token registry", status: "warn", detail: `Initialized but empty \u2014 register sub-accounts via register_location for cross-account switching.${companyNote}` };
+    }
+    return { name: "Token registry", status: "pass", detail: `${locs.length} sub-account(s) registered.${companyNote}` };
+  })();
+  const [versionStatus, apiKeyCheck, locationCheck, firebaseCheck] = await Promise.all([
+    versionPromise,
+    apiKeyPromise,
+    locationPromise,
+    firebasePromise
+  ]);
+  let versionCheck;
+  if (versionStatus.latest === null) {
+    versionCheck = { name: "npm registry + version", status: "warn", detail: `Installed v${versionStatus.installed}. Could not reach npm registry to check for updates: ${versionStatus.fetchError ?? "unknown"}.` };
+  } else if (versionStatus.upToDate) {
+    versionCheck = { name: "npm registry + version", status: "pass", detail: `Up to date at v${versionStatus.installed}.` };
+  } else {
+    versionCheck = { name: "npm registry + version", status: "warn", detail: `Installed v${versionStatus.installed} but latest is v${versionStatus.latest}. Quit Claude (Cmd+Q) and reopen to upgrade.` };
+  }
+  const gatingCheck = (() => {
+    const r = getGatingReport?.();
+    if (!r) {
+      return { name: "Tool gating", status: "skip", detail: "Gating report unavailable in this mode." };
+    }
+    if (!r.gatingActive) {
+      return { name: "Tool gating", status: "pass", detail: `No gating configured \u2014 all ${r.registeredCount} tools registered. Sub-account create/delete stays OFF unless GHL_ENABLE_ACCOUNT_ADMIN=1 is set.` };
+    }
+    const parts = [`${r.registeredCount} of ${r.attemptedCount} tools registered.`];
+    if (r.disabledTools.length > 0) parts.push(`Disabled tools: ${r.disabledTools.join(", ")}.`);
+    if (r.disabledModules.length > 0) parts.push(`Disabled modules: ${r.disabledModules.join(", ")}.`);
+    if (r.outOfBandDenied.length > 0) parts.push(`Confirmed unregistered (setup/helper tools): ${r.outOfBandDenied.join(", ")}.`);
+    if (r.allowlistActive) parts.push(`Allowlist: modules=[${r.enabledModules.join(",") || "-"}], tools=[${r.enabledTools.join(",") || "-"}].`);
+    parts.push(`Account admin (sub-account create/delete): ${r.accountAdminEnabled ? "ENABLED via GHL_ENABLE_ACCOUNT_ADMIN=1" : "OFF (default)"}.`);
+    const problems = [];
+    if (r.ignoredHardCoreDenials.length > 0) problems.push(`recovery-core tool(s) in GHL_DISABLED_TOOLS cannot be disabled and were IGNORED: ${r.ignoredHardCoreDenials.join(", ")}`);
+    if (r.unknownDisabledTools.length > 0) problems.push(`unrecognized name(s) in GHL_DISABLED_TOOLS (possible typo \u2014 those tools are NOT disabled): ${r.unknownDisabledTools.join(", ")}`);
+    if (r.unknownDisabledModules.length > 0) problems.push(`unrecognized name(s) in GHL_DISABLED_MODULES (possible typo): ${r.unknownDisabledModules.join(", ")}`);
+    if (r.unknownEnabledTools.length > 0) problems.push(`unrecognized name(s) in GHL_ENABLED_TOOLS: ${r.unknownEnabledTools.join(", ")}`);
+    if (r.unknownEnabledModules.length > 0) problems.push(`unrecognized name(s) in GHL_ENABLED_MODULES: ${r.unknownEnabledModules.join(", ")}`);
+    if (problems.length > 0) {
+      return { name: "Tool gating", status: "warn", detail: `${parts.join(" ")} PROBLEMS: ${problems.join("; ")}. Fix the env var in your Claude config and fully restart Claude.` };
+    }
+    return { name: "Tool gating", status: "pass", detail: parts.join(" ") };
+  })();
+  const telemetryCheck = telemetryDisabled(process.env) ? {
+    name: "Anonymous usage stats",
+    status: "skip",
+    detail: `OFF \u2014 ${process.env.GHL_TELEMETRY?.trim() === "0" ? "GHL_TELEMETRY=0" : "DO_NOT_TRACK"} is set. Nothing is sent.`
+  } : {
+    name: "Anonymous usage stats",
+    status: "pass",
+    detail: `ON. ${TELEMETRY_DISCLOSURE} Sent: install/startup events, package version, Node major, platform, and a random device id. NEVER sent: your license key, email, GHL API key, location ID, hostname, file paths, or any GHL account data.`
+  };
+  checks.push(versionCheck, apiKeyCheck, locationCheck, firebaseCheck, registryCheck, gatingCheck, telemetryCheck);
+  return checks;
+}
+function renderChecks(checks) {
+  const symbols = { pass: "\u2713", fail: "\u2717", warn: "!", skip: "\u2014" };
+  const lines = [];
+  for (const c of checks) {
+    lines.push(`${symbols[c.status]} ${c.name.padEnd(35)} ${c.status.toUpperCase()}`);
+    lines.push(`  ${c.detail}`);
+  }
+  return lines;
+}
+function summarizeChecks(checks) {
+  const fails = checks.filter((c) => c.status === "fail").length;
+  const warns = checks.filter((c) => c.status === "warn").length;
+  if (fails === 0 && warns === 0) return "All systems go.";
+  const parts = [];
+  if (fails > 0) parts.push(`${fails} failure(s)`);
+  if (warns > 0) parts.push(`${warns} warning(s)`);
+  return parts.join(", ") + " \u2014 see details above.";
+}
 function registerDiagnosticTools(server2, installedVersion, client, builderClient, registry2, getGatingReport) {
   server2.tool(
     "health_check",
-    "Run a full health check of the GHL Command MCP install. Reports on: npm registry + version status, GHL API key validity, default location reachability, Firebase auth status (workflow builder), token registry, and the tool-gating policy (disabled tools/modules, account-admin opt-in, typos in gating env vars). Returns a structured pass/fail/warn list with detail per check. Use this when something feels broken or after credentials change.",
+    "Run a full health check of the GHL Command MCP install. Reports on: npm registry + version status, GHL API key validity, default location reachability, Firebase auth status (workflow builder), token registry, and the tool-gating policy (disabled tools/modules, account-admin opt-in, typos in gating env vars). Returns a structured pass/fail/warn list with detail per check. Use this when something feels broken or after credentials change. For a wider report that also probes every GHL capability live and shows what you are not yet using, run `run_checkup`.",
     {},
     async () => {
-      const checks = [];
-      const versionPromise = getVersionStatus(installedVersion);
-      const apiKeyPromise = (async () => {
-        const locId = client.defaultLocationId;
-        if (!locId) {
-          return { name: "GHL API key", status: "warn", detail: `Can't validate without a default location ID. Set GHL_LOCATION_ID or run setup_ghl_mcp.` };
-        }
-        try {
-          const response = await fetch(`https://services.leadconnectorhq.com/locations/${locId}`, {
-            method: "GET",
-            headers: {
-              Authorization: `Bearer ${client.getApiKey()}`,
-              "Content-Type": "application/json",
-              Accept: "application/json",
-              Version: "2021-07-28"
-            },
-            signal: AbortSignal.timeout(8e3)
-          });
-          if (response.status === 401) {
-            return { name: "GHL API key", status: "fail", detail: `401 Unauthorized \u2014 key ${client.getApiKeyPrefix()} is invalid or revoked. Run setup_ghl_mcp with a fresh key.` };
-          }
-          if (response.status === 403) {
-            return { name: "GHL API key", status: "fail", detail: `403 Forbidden \u2014 key ${client.getApiKeyPrefix()} doesn't have access to location ${locId}. The key may belong to a different sub-account.` };
-          }
-          if (!response.ok) {
-            return { name: "GHL API key", status: "warn", detail: `HTTP ${response.status} reading /locations/${locId} \u2014 key may be limited or GHL is having issues.` };
-          }
-          return { name: "GHL API key", status: "pass", detail: `Valid (key ${client.getApiKeyPrefix()}).` };
-        } catch (error) {
-          return { name: "GHL API key", status: "warn", detail: `Network error: ${error instanceof Error ? error.message : String(error)}. Server starts anyway; tool calls will report errors when invoked.` };
-        }
-      })();
-      const locationPromise = (async () => {
-        const locId = client.defaultLocationId;
-        if (!locId) {
-          return { name: "Default location", status: "warn", detail: "No default location set. Tools that don't accept locationId arg will fail." };
-        }
-        try {
-          const result = await client.get(`/locations/${locId}`);
-          const loc = result.location ?? result;
-          return { name: "Default location", status: "pass", detail: `${loc?.name ?? "Unknown"} (${locId}) reachable.` };
-        } catch (error) {
-          return { name: "Default location", status: "fail", detail: `Could not read location ${locId}: ${error instanceof Error ? error.message : String(error)}` };
-        }
-      })();
-      const firebasePromise = (async () => {
-        if (!builderClient) {
-          return { name: "Firebase auth (workflow builder)", status: "skip", detail: "Not configured \u2014 your install is one step from finished. Run capture_firebase_interactive: a Chrome window opens, you log into GHL once, and it captures + verifies everything itself (about 60 seconds). This powers the account auditor and the Firebase-gated tools. No Chrome on this machine? auto_capture_firebase_script is the copy-paste path. Do NOT put Firebase values as env vars in your Claude Desktop config \u2014 that path is unreliable and is the usual reason this still shows skip after a restart." };
-        }
-        const result = await builderClient.checkAuth();
-        const tokenCompany = builderClient.getTokenCompanyId();
-        const intendedCompany = builderClient.getIntendedCompanyId() ?? builderClient.getCurrentCompanyId();
-        const companyNote = intendedCompany ? ` Active location's company: ${intendedCompany}.` : "";
-        if (result.ok && intendedCompany && tokenCompany && intendedCompany !== tokenCompany) {
-          return {
-            name: "Firebase auth (workflow builder)",
-            status: "fail",
-            detail: `Company mismatch: the active location belongs to company ${intendedCompany}, but the Firebase token authenticates as ${tokenCompany}. Workflow-builder writes will 401 or hit the wrong account. This company's Firebase is missing or registered under the wrong ID. Run register_company_firebase with a token captured from that sub-account's GHL session (v3.27.0+ stores it under the correct internal ID automatically).`
-          };
-        }
-        if (result.ok) {
-          const idNote = tokenCompany ? ` Authenticated as company ${tokenCompany}.` : "";
-          return { name: "Firebase auth (workflow builder)", status: "pass", detail: `ID token refresh succeeded. Workflow builder tools are usable.${companyNote}${idNote}` };
-        }
-        return { name: "Firebase auth (workflow builder)", status: "fail", detail: `Token refresh failed: ${result.error}.${companyNote} If you're in a client's account, register its Firebase with register_company_firebase. Otherwise re-capture your Firebase values from GHL DevTools and re-run enable_workflow_builder.` };
-      })();
-      const registryCheck = (() => {
-        if (!registry2) {
-          return { name: "Token registry", status: "skip", detail: "Not initialized \u2014 using env-var credentials only. switch_location won't auto-swap keys between sub-accounts." };
-        }
-        const loadFailure = registry2.getLoadFailure();
-        if (loadFailure) {
-          return { name: "Token registry", status: "fail", detail: loadFailure };
-        }
-        const locs = registry2.listLocations();
-        const companies = registry2.listCompanyFirebases();
-        const companyNote = companies.length ? ` ${companies.length} company Firebase credential(s) registered for multi-tenant workflow-builder access.` : "";
-        if (locs.length === 0) {
-          return { name: "Token registry", status: "warn", detail: `Initialized but empty \u2014 register sub-accounts via register_location for cross-account switching.${companyNote}` };
-        }
-        return { name: "Token registry", status: "pass", detail: `${locs.length} sub-account(s) registered.${companyNote}` };
-      })();
-      const [versionStatus, apiKeyCheck, locationCheck, firebaseCheck] = await Promise.all([
-        versionPromise,
-        apiKeyPromise,
-        locationPromise,
-        firebasePromise
-      ]);
-      let versionCheck;
-      if (versionStatus.latest === null) {
-        versionCheck = { name: "npm registry + version", status: "warn", detail: `Installed v${versionStatus.installed}. Could not reach npm registry to check for updates: ${versionStatus.fetchError ?? "unknown"}.` };
-      } else if (versionStatus.upToDate) {
-        versionCheck = { name: "npm registry + version", status: "pass", detail: `Up to date at v${versionStatus.installed}.` };
-      } else {
-        versionCheck = { name: "npm registry + version", status: "warn", detail: `Installed v${versionStatus.installed} but latest is v${versionStatus.latest}. Quit Claude (Cmd+Q) and reopen to upgrade.` };
-      }
-      const gatingCheck = (() => {
-        const r = getGatingReport?.();
-        if (!r) {
-          return { name: "Tool gating", status: "skip", detail: "Gating report unavailable in this mode." };
-        }
-        if (!r.gatingActive) {
-          return { name: "Tool gating", status: "pass", detail: `No gating configured \u2014 all ${r.registeredCount} tools registered. Sub-account create/delete stays OFF unless GHL_ENABLE_ACCOUNT_ADMIN=1 is set.` };
-        }
-        const parts = [`${r.registeredCount} of ${r.attemptedCount} tools registered.`];
-        if (r.disabledTools.length > 0) parts.push(`Disabled tools: ${r.disabledTools.join(", ")}.`);
-        if (r.disabledModules.length > 0) parts.push(`Disabled modules: ${r.disabledModules.join(", ")}.`);
-        if (r.outOfBandDenied.length > 0) parts.push(`Confirmed unregistered (setup/helper tools): ${r.outOfBandDenied.join(", ")}.`);
-        if (r.allowlistActive) parts.push(`Allowlist: modules=[${r.enabledModules.join(",") || "-"}], tools=[${r.enabledTools.join(",") || "-"}].`);
-        parts.push(`Account admin (sub-account create/delete): ${r.accountAdminEnabled ? "ENABLED via GHL_ENABLE_ACCOUNT_ADMIN=1" : "OFF (default)"}.`);
-        const problems = [];
-        if (r.ignoredHardCoreDenials.length > 0) problems.push(`recovery-core tool(s) in GHL_DISABLED_TOOLS cannot be disabled and were IGNORED: ${r.ignoredHardCoreDenials.join(", ")}`);
-        if (r.unknownDisabledTools.length > 0) problems.push(`unrecognized name(s) in GHL_DISABLED_TOOLS (possible typo \u2014 those tools are NOT disabled): ${r.unknownDisabledTools.join(", ")}`);
-        if (r.unknownDisabledModules.length > 0) problems.push(`unrecognized name(s) in GHL_DISABLED_MODULES (possible typo): ${r.unknownDisabledModules.join(", ")}`);
-        if (r.unknownEnabledTools.length > 0) problems.push(`unrecognized name(s) in GHL_ENABLED_TOOLS: ${r.unknownEnabledTools.join(", ")}`);
-        if (r.unknownEnabledModules.length > 0) problems.push(`unrecognized name(s) in GHL_ENABLED_MODULES: ${r.unknownEnabledModules.join(", ")}`);
-        if (problems.length > 0) {
-          return { name: "Tool gating", status: "warn", detail: `${parts.join(" ")} PROBLEMS: ${problems.join("; ")}. Fix the env var in your Claude config and fully restart Claude.` };
-        }
-        return { name: "Tool gating", status: "pass", detail: parts.join(" ") };
-      })();
-      const telemetryCheck = telemetryDisabled(process.env) ? {
-        name: "Anonymous usage stats",
-        status: "skip",
-        detail: `OFF \u2014 ${process.env.GHL_TELEMETRY?.trim() === "0" ? "GHL_TELEMETRY=0" : "DO_NOT_TRACK"} is set. Nothing is sent.`
-      } : {
-        name: "Anonymous usage stats",
-        status: "pass",
-        detail: `ON. ${TELEMETRY_DISCLOSURE} Sent: install/startup events, package version, Node major, platform, and a random device id. NEVER sent: your license key, email, GHL API key, location ID, hostname, file paths, or any GHL account data.`
-      };
-      checks.push(versionCheck, apiKeyCheck, locationCheck, firebaseCheck, registryCheck, gatingCheck, telemetryCheck);
-      const symbols = { pass: "\u2713", fail: "\u2717", warn: "!", skip: "\u2014" };
+      const checks = await collectInstallChecks(installedVersion, client, builderClient, registry2, getGatingReport);
       const lines = [];
       lines.push("GHL Command \u2014 Health Check");
       lines.push("\u2501".repeat(50));
-      for (const c of checks) {
-        lines.push(`${symbols[c.status]} ${c.name.padEnd(35)} ${c.status.toUpperCase()}`);
-        lines.push(`  ${c.detail}`);
-      }
+      lines.push(...renderChecks(checks));
       lines.push("\u2501".repeat(50));
-      const fails = checks.filter((c) => c.status === "fail").length;
-      const warns = checks.filter((c) => c.status === "warn").length;
-      if (fails === 0 && warns === 0) {
-        lines.push("All systems go.");
-      } else {
-        const parts = [];
-        if (fails > 0) parts.push(`${fails} failure(s)`);
-        if (warns > 0) parts.push(`${warns} warning(s)`);
-        lines.push(parts.join(", ") + " \u2014 see details above.");
-      }
+      lines.push(summarizeChecks(checks));
       return { content: [{ type: "text", text: lines.join("\n") }] };
     }
   );
 }
 
+// src/tools/checkup.ts
+var import_zod54 = require("zod");
+var PROBES = [
+  { key: "contacts", label: "Contacts", path: "/contacts/", params: { locationId: "{loc}", limit: 1 }, listKeys: ["contacts"] },
+  { key: "opportunities", label: "Opportunities", path: "/opportunities/search", params: { location_id: "{loc}", limit: 1 }, listKeys: ["opportunities"] },
+  { key: "pipelines", label: "Pipelines", path: "/opportunities/pipelines", params: { locationId: "{loc}" }, listKeys: ["pipelines"] },
+  { key: "conversations", label: "Conversations", path: "/conversations/search", params: { locationId: "{loc}", limit: 1 }, listKeys: ["conversations"] },
+  { key: "calendars", label: "Calendars", path: "/calendars/", params: { locationId: "{loc}" }, listKeys: ["calendars"] },
+  { key: "workflows", label: "Workflows", path: "/workflows/", params: { locationId: "{loc}" }, listKeys: ["workflows"] },
+  { key: "funnels", label: "Funnels and websites", path: "/funnels/funnel/list", params: { locationId: "{loc}", limit: 1 }, listKeys: ["funnels"] },
+  { key: "forms", label: "Forms", path: "/forms/", params: { locationId: "{loc}", limit: 1 }, listKeys: ["forms"] },
+  { key: "surveys", label: "Surveys", path: "/surveys/", params: { locationId: "{loc}", limit: 1 }, listKeys: ["surveys"] },
+  { key: "customFields", label: "Custom fields", path: "/locations/{loc}/customFields", listKeys: ["customFields"] },
+  { key: "customValues", label: "Custom values", path: "/locations/{loc}/customValues", listKeys: ["customValues"] },
+  { key: "tags", label: "Tags", path: "/locations/{loc}/tags", listKeys: ["tags"] },
+  { key: "users", label: "Users", path: "/users/", params: { locationId: "{loc}" }, listKeys: ["users"] },
+  { key: "customObjects", label: "Custom objects", path: "/objects/", params: { locationId: "{loc}" }, listKeys: ["objects"], optional: true },
+  { key: "triggerLinks", label: "Trigger links", path: "/links/", params: { locationId: "{loc}" }, listKeys: ["links"] },
+  { key: "products", label: "Products", path: "/products/", params: { locationId: "{loc}", limit: 1 }, listKeys: ["products"] },
+  // limit AND offset are required by GHL here — omitting either 422s. Same
+  // params the shipped list_invoices sends (live-verified 2026-08-08).
+  { key: "invoices", label: "Invoices", path: "/invoices/", params: { locationId: "{loc}", altId: "{loc}", altType: "location", limit: 1, offset: 0 }, listKeys: ["invoices"] },
+  { key: "media", label: "Media library", path: "/medias/files", params: { altId: "{loc}", altType: "location", type: "file", limit: 1 }, listKeys: ["files"] },
+  { key: "phoneNumbers", label: "Phone numbers", path: "/phone-system/numbers/", params: { locationId: "{loc}" }, listKeys: ["phoneNumbers"] },
+  { key: "socialAccounts", label: "Social accounts", path: "/social-media-posting/{loc}/accounts", listKeys: ["accounts"], optional: true },
+  // limit/offset required here too, for the same reason as invoices.
+  { key: "blogAuthors", label: "Blogs", path: "/blogs/authors", params: { locationId: "{loc}", limit: 50, offset: 0 }, listKeys: ["authors"], optional: true },
+  { key: "campaigns", label: "Campaigns", path: "/campaigns/", params: { locationId: "{loc}" }, listKeys: ["campaigns"], optional: true },
+  { key: "courses", label: "Courses and memberships", path: "/courses/", params: { locationId: "{loc}" }, optional: true },
+  { key: "businesses", label: "Businesses", path: "/businesses/", params: { locationId: "{loc}" }, listKeys: ["businesses"], optional: true }
+];
+var BUILDER_PROBE_KEY = "workflowBuilder";
+function parseStatus(message) {
+  const m = /GHL API Error (\d{3})/.exec(message);
+  return m ? Number(m[1]) : null;
+}
+function classifyFailure(status, optional) {
+  if (status === null) {
+    return { verdict: "inconclusive", detail: "Could not reach GHL (network or timeout). Says nothing about this feature \u2014 run the checkup again." };
+  }
+  if (status === 401) {
+    return { verdict: "no-access", detail: "401 \u2014 the API key was rejected. See the Connection section above." };
+  }
+  if (status === 403) {
+    return { verdict: "no-access", detail: "403 \u2014 this API key's scopes don't include this feature. Fix: edit the Private Integration in GHL and tick every scope, then re-run setup." };
+  }
+  if (status === 429) {
+    return { verdict: "inconclusive", detail: "429 \u2014 GHL rate-limited this probe. Not a fault. Re-run in a minute." };
+  }
+  if (status >= 500) {
+    return { verdict: "inconclusive", detail: `${status} \u2014 GHL server error. Their side, not yours. Re-run later.` };
+  }
+  if (optional) {
+    return { verdict: "unavailable", detail: `${status} \u2014 not readable on this account. Usually means the feature isn't enabled on this GHL plan.` };
+  }
+  return { verdict: "broken", detail: `${status} \u2014 GHL rejected a read that should work. This is what a GoHighLevel change looks like. Please send this report to support@ghlcommand.com.` };
+}
+function countRows(raw, listKeys) {
+  if (typeof raw !== "object" || raw === null) return null;
+  const obj = raw;
+  const meta = obj.meta;
+  if (typeof meta === "object" && meta !== null) {
+    const total = meta.total;
+    if (typeof total === "number") return total;
+  }
+  if (typeof obj.total === "number") return obj.total;
+  for (const key of listKeys ?? []) {
+    if (Array.isArray(obj[key])) return obj[key].length;
+  }
+  for (const value of Object.values(obj)) {
+    if (Array.isArray(value)) return value.length;
+    if (typeof value === "object" && value !== null) {
+      for (const inner of Object.values(value)) {
+        if (Array.isArray(inner)) return inner.length;
+      }
+    }
+  }
+  return null;
+}
+function substitute(value, loc) {
+  return typeof value === "string" ? value.replace("{loc}", loc) : value;
+}
+var CONFIRM_ATTEMPTS = 3;
+var CONFIRM_DELAY_MS = 600;
+async function confirm(run) {
+  let last = await run();
+  for (let attempt = 1; attempt < CONFIRM_ATTEMPTS && last.verdict !== "working" && last.verdict !== "skipped"; attempt++) {
+    await new Promise((r) => setTimeout(r, CONFIRM_DELAY_MS));
+    last = await run();
+  }
+  if (last.verdict === "working" || last.verdict === "skipped") return last;
+  return { ...last, detail: `${last.detail} (Confirmed on ${CONFIRM_ATTEMPTS} separate reads, so this is not a blip.)` };
+}
+async function runProbes(client, loc) {
+  return Promise.all(
+    PROBES.map((probe) => confirm(async () => {
+      const path15 = probe.path.replace("{loc}", loc);
+      const params = probe.params ? Object.fromEntries(Object.entries(probe.params).map(([k, v]) => [k, substitute(v, loc)])) : void 0;
+      try {
+        const raw = await client.get(path15, { params, noRetry: true });
+        const count = countRows(raw, probe.listKeys);
+        return {
+          key: probe.key,
+          label: probe.label,
+          verdict: "working",
+          count,
+          status: 200,
+          detail: count === null ? "Reads fine." : count === 0 ? "Reads fine. You have none yet." : `Reads fine. ${count} in this account.`
+        };
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        const status = parseStatus(message);
+        const { verdict, detail } = classifyFailure(status, probe.optional === true);
+        return { key: probe.key, label: probe.label, verdict, count: null, status, detail };
+      }
+    }))
+  );
+}
+var BUILDER_AUTH_FAILURE = /TOKEN_EXPIRED|INVALID_ARGUMENT|UNAUTHENTICATED|token refresh|refresh token|invalid[_ ]grant|unauthorized/i;
+async function runBuilderProbe(builderClient) {
+  return confirm(() => builderProbeOnce(builderClient));
+}
+async function builderProbeOnce(builderClient) {
+  const base = { key: BUILDER_PROBE_KEY, label: "Workflow Builder (build + edit)", count: null, status: null };
+  if (!builderClient) {
+    return { ...base, verdict: "skipped", detail: "Not connected. This is step 2 of the install, not an extra. Say: Unlock the Workflow Builder." };
+  }
+  try {
+    const raw = await builderClient.listWorkflows(1, 0);
+    const count = countRows(raw, ["workflows"]);
+    return { ...base, verdict: "working", status: 200, count, detail: "Connected. Claude can build and edit workflows in this account." };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    const status = parseStatus(message);
+    if (status === 401 || status === 403 || BUILDER_AUTH_FAILURE.test(message)) {
+      return {
+        ...base,
+        status,
+        verdict: "no-access",
+        detail: "The saved GHL browser login has expired. Say: Unlock the Workflow Builder. It takes about 60 seconds and needs no pasting."
+      };
+    }
+    if (status === null || status === 429 || status >= 500) {
+      return { ...base, status, verdict: "inconclusive", detail: `Could not complete the check${status ? ` (${status})` : ""}. Says nothing either way. Run the checkup again.` };
+    }
+    return { ...base, status, verdict: "broken", detail: `${status} \u2014 the internal API rejected a read that should work. Please send this report to support@ghlcommand.com.` };
+  }
+}
+function buildNudges(probes, builder, registeredLocations) {
+  const by = new Map(probes.map((p) => [p.key, p]));
+  const count = (key) => by.get(key)?.count ?? null;
+  const emptyAndWorking = (key) => by.get(key)?.verdict === "working" && by.get(key)?.count === 0;
+  const nudges = [];
+  if (builder.verdict === "skipped" || builder.verdict === "no-access") {
+    nudges.push({
+      headline: "The Workflow Builder is off \u2014 that is the half that BUILDS.",
+      prompt: "Unlock the Workflow Builder.",
+      guide: "install-ghl-command"
+    });
+  }
+  const workflows = count("workflows");
+  if (workflows !== null && workflows > 0) {
+    nudges.push({
+      // Deliberately not "you have never audited these" — nothing here can
+      // know that, and a checkup that overclaims loses the reader.
+      headline: `${workflows} workflow(s) here. A silent-failure audit finds what GHL never warns you about.`,
+      prompt: "Audit my workflows and find broken pipeline, stage, or field IDs.",
+      guide: "audit-your-workflows"
+    });
+  } else if (emptyAndWorking("workflows")) {
+    nudges.push({
+      headline: "No workflows in this account \u2014 nothing follows up on its own.",
+      prompt: "Build a 7-day nurture sequence with texts, emails, and waits that stops the moment they reply.",
+      guide: "build-nurture-sequence"
+    });
+  }
+  const contacts = count("contacts");
+  if (emptyAndWorking("pipelines") && contacts !== null && contacts > 0) {
+    nudges.push({
+      headline: `${contacts} contacts and no pipeline \u2014 nothing tracks where they are.`,
+      prompt: "Stand up a New Patient pipeline with stages for Lead, Booked, Showed, Treated, and Rebooked.",
+      guide: "stand-up-a-pipeline"
+    });
+  }
+  if (emptyAndWorking("calendars")) {
+    nudges.push({
+      headline: "No booking calendar \u2014 every appointment is being set by hand.",
+      prompt: "Set up a booking calendar for me and show me the booking link.",
+      guide: "set-up-a-booking-calendar"
+    });
+  }
+  if (emptyAndWorking("forms")) {
+    nudges.push({
+      headline: "No forms \u2014 there is no way for a lead to raise their hand.",
+      prompt: "Create an intake form for new leads and show me where the submissions land.",
+      guide: "create-forms-and-read-submissions"
+    });
+  }
+  if (emptyAndWorking("triggerLinks")) {
+    nudges.push({
+      headline: "No trigger links \u2014 you cannot see who clicked what.",
+      prompt: "Create a trigger link and a workflow that tags anyone who clicks it.",
+      guide: "trigger-links"
+    });
+  }
+  if (emptyAndWorking("customValues")) {
+    nudges.push({
+      headline: "No custom values \u2014 AI bots and templates have nothing to personalize from.",
+      prompt: "Set up the custom values this account needs so my templates and AI bot stop hard-coding details.",
+      guide: "ai-bots-and-custom-values"
+    });
+  }
+  if (emptyAndWorking("socialAccounts")) {
+    nudges.push({
+      headline: "No social accounts connected \u2014 the Social Planner is unused.",
+      prompt: "Show me what I need to connect to post to social from here.",
+      guide: "social-posting"
+    });
+  }
+  if (emptyAndWorking("products") && emptyAndWorking("invoices")) {
+    nudges.push({
+      headline: "No products and no invoices \u2014 nothing here can take money.",
+      prompt: "Set up a product and send me a test invoice so I can see the payment flow.",
+      guide: "invoices-and-payments"
+    });
+  }
+  if (registeredLocations <= 1) {
+    nudges.push({
+      headline: "Only one sub-account is registered \u2014 Claude can work across all of them.",
+      prompt: "Register my other sub-accounts so you can switch between them by name.",
+      guide: "switch-between-client-accounts"
+    });
+  }
+  return nudges;
+}
+var VERDICT_SYMBOL = {
+  working: "\u2713",
+  broken: "\u2717",
+  "no-access": "!",
+  unavailable: "\u2014",
+  inconclusive: "?",
+  skipped: "\u2014"
+};
+function renderCheckup(data) {
+  const lines = [];
+  lines.push("GHL Command \u2014 Checkup");
+  lines.push(`v${data.version} \xB7 location ${data.locationId} \xB7 ${data.generatedAt}`);
+  lines.push("\u2501".repeat(58));
+  lines.push("");
+  lines.push("1. CONNECTION \u2014 is the install wired up?");
+  lines.push("\u2500".repeat(58));
+  lines.push(...renderChecks(data.install));
+  lines.push(summarizeChecks(data.install));
+  lines.push("");
+  lines.push("2. WHAT STILL WORKS \u2014 every capability read live, just now");
+  lines.push("\u2500".repeat(58));
+  for (const p of data.probes) {
+    lines.push(`${VERDICT_SYMBOL[p.verdict]} ${p.label.padEnd(30)} ${p.verdict.toUpperCase()}`);
+    lines.push(`  ${p.detail}`);
+  }
+  const broken = data.probes.filter((p) => p.verdict === "broken");
+  lines.push("");
+  if (broken.length === 0) {
+    lines.push("No breakage found. Every capability GHL Command claims still answers.");
+  } else {
+    lines.push(`\u26A0 ${broken.length} capability area(s) are BROKEN: ${broken.map((p) => p.label).join(", ")}.`);
+    lines.push("  This is almost always a GoHighLevel change, not something you did.");
+    lines.push("  Send this whole report to support@ghlcommand.com \u2014 it is exactly what we need to fix it.");
+  }
+  lines.push("");
+  lines.push("3. WHAT YOU ARE NOT USING YET");
+  lines.push("\u2500".repeat(58));
+  lines.push(`Actively using ${data.inUse} of ${data.usable} capability areas in this account.`);
+  lines.push("(Measured from what this GHL account contains \u2014 nothing about your usage is collected or sent.)");
+  lines.push("");
+  if (data.nudges.length === 0) {
+    lines.push("Nothing obvious left on the table. This account is being worked hard.");
+  } else {
+    data.nudges.forEach((n, i) => {
+      lines.push(`${i + 1}. ${n.headline}`);
+      lines.push(`   Say: "${n.prompt}"`);
+      if (n.guide) lines.push(`   Guide: ${n.guide} \u2014 open the full library with "open the user guide".`);
+    });
+  }
+  lines.push("");
+  lines.push("\u2501".repeat(58));
+  lines.push("Run this monthly, and any time GHL feels off. Questions: support@ghlcommand.com");
+  return lines.join("\n");
+}
+function registerCheckupTools(server2, installedVersion, client, builderClient, registry2, getGatingReport) {
+  server2.tool(
+    "run_checkup",
+    `The full GHL Command checkup \u2014 the answer to "am I using it all, and is it all still working?". Three sections: (1) CONNECTION, the same install checks as health_check; (2) WHAT STILL WORKS, one live read-only probe against every GHL capability family, which distinguishes "working but you own none" from "GoHighLevel changed something and this is broken"; (3) WHAT YOU ARE NOT USING YET, derived from what the account actually contains, each line carrying the exact sentence to paste back. Read-only and safe on live client accounts. Use format:'json' for a machine-readable report. Run it monthly, after a GHL update, or any time something feels off.`,
+    {
+      locationId: import_zod54.z.string().optional().describe("Sub-account to check. Defaults to the active location."),
+      format: import_zod54.z.enum(["report", "json"]).optional().describe("'report' (default) is the plain-English checkup. 'json' returns the same data for scripts and support tickets.")
+    },
+    async ({ locationId: locationId2, format }) => {
+      let loc;
+      try {
+        loc = client.resolveLocationId(locationId2);
+      } catch (error) {
+        return {
+          content: [{ type: "text", text: error instanceof Error ? error.message : String(error) }],
+          isError: true
+        };
+      }
+      const [install, probes, builder] = await Promise.all([
+        collectInstallChecks(installedVersion, client, builderClient, registry2, getGatingReport),
+        runProbes(client, loc),
+        runBuilderProbe(builderClient)
+      ]);
+      const allProbes = [...probes, builder];
+      const usable = allProbes.filter((p) => p.verdict === "working").length;
+      const inUse = allProbes.filter((p) => p.verdict === "working" && (p.count === null || p.count > 0)).length;
+      const data = {
+        version: installedVersion,
+        locationId: loc,
+        generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        install,
+        probes: allProbes,
+        nudges: buildNudges(probes, builder, registry2?.listLocations().length ?? 0),
+        inUse,
+        usable
+      };
+      const text = format === "json" ? JSON.stringify(data, null, 2) : renderCheckup(data);
+      return { content: [{ type: "text", text }] };
+    }
+  );
+}
+
 // src/tools/user-guide.ts
 var import_child_process2 = require("child_process");
 var fs8 = __toESM(require("fs"));
@@ -15816,11 +16804,11 @@ ${guidePath}`;
 }
 
 // src/tools/snapshots.ts
-var import_zod54 = require("zod");
+var import_zod55 = require("zod");
 init_ghl_client();
-var SnapshotSchema = import_zod54.z.object({ id: import_zod54.z.string(), name: import_zod54.z.string(), type: import_zod54.z.string() }).passthrough();
-var SnapshotsResponseSchema = import_zod54.z.object({ snapshots: import_zod54.z.array(SnapshotSchema) }).passthrough();
-var ShareLinkResponseSchema = import_zod54.z.object({ id: import_zod54.z.string(), shareLink: import_zod54.z.string() }).passthrough();
+var SnapshotSchema = import_zod55.z.object({ id: import_zod55.z.string(), name: import_zod55.z.string(), type: import_zod55.z.string() }).passthrough();
+var SnapshotsResponseSchema = import_zod55.z.object({ snapshots: import_zod55.z.array(SnapshotSchema) }).passthrough();
+var ShareLinkResponseSchema = import_zod55.z.object({ id: import_zod55.z.string(), shareLink: import_zod55.z.string() }).passthrough();
 var SHARE_TYPES = [
   "link",
   "permanent_link",
@@ -15867,7 +16855,7 @@ function registerSnapshotTools(server2, client, registry2) {
     "list_snapshots",
     "List the agency's GHL snapshots (id, name, type) so you can pick the right one by name before applying it to a sub-account. Reads the agency/company-scoped key (not a sub-account PIT). companyId defaults to the active location's company; pass it explicitly to target a different company you have the agency key for. Read-only.",
     {
-      companyId: import_zod54.z.string().optional().describe(
+      companyId: import_zod55.z.string().optional().describe(
         "Agency/company ID whose snapshots to list. Defaults to the active location's company. Must match the company your agency key is scoped to."
       )
     },
@@ -15892,11 +16880,11 @@ function registerSnapshotTools(server2, client, registry2) {
     "create_snapshot_share_link",
     "Create a shareable load link for one of the agency's snapshots (returns a gohighlevel.com/?share=... URL to import the snapshot into a sub-account). Uses the agency/company-scoped key. WARNING: this is NOT idempotent \u2014 each call mints a NEW link, and there is no API to list or revoke links (revoke in the GHL UI under the snapshot's share settings). Pick share_type deliberately. Use list_snapshots first to get the snapshot id.",
     {
-      snapshot_id: import_zod54.z.string().describe("The snapshot id to share (from list_snapshots)."),
-      share_type: import_zod54.z.enum(SHARE_TYPES).describe(
+      snapshot_id: import_zod55.z.string().describe("The snapshot id to share (from list_snapshots)."),
+      share_type: import_zod55.z.enum(SHARE_TYPES).describe(
         "Share link type. 'link' = standard share link; 'permanent_link' = non-expiring; 'agency_link' = share to agencies; 'location_link' = load into a sub-account/location; 'marketplace_link' = marketplace listing. No default \u2014 choose intentionally."
       ),
-      companyId: import_zod54.z.string().optional().describe(
+      companyId: import_zod55.z.string().optional().describe(
         "Agency/company ID that owns the snapshot. Defaults to the active location's company. Must match the company your agency key is scoped to."
       )
     },
@@ -15926,17 +16914,17 @@ function registerSnapshotTools(server2, client, registry2) {
 }
 
 // src/tools/phone.ts
-var import_zod55 = require("zod");
-var PhoneNumberSchema = import_zod55.z.object({ sid: import_zod55.z.string(), value: import_zod55.z.string(), title: import_zod55.z.string().optional() }).passthrough();
-var NumbersResponseSchema = import_zod55.z.object({ phoneNumbers: import_zod55.z.array(PhoneNumberSchema) }).passthrough();
-var PoolsResponseSchema = import_zod55.z.object({ pools: import_zod55.z.array(import_zod55.z.object({}).passthrough()) }).passthrough();
+var import_zod56 = require("zod");
+var PhoneNumberSchema = import_zod56.z.object({ sid: import_zod56.z.string(), value: import_zod56.z.string(), title: import_zod56.z.string().optional() }).passthrough();
+var NumbersResponseSchema = import_zod56.z.object({ phoneNumbers: import_zod56.z.array(PhoneNumberSchema) }).passthrough();
+var PoolsResponseSchema = import_zod56.z.object({ pools: import_zod56.z.array(import_zod56.z.object({}).passthrough()) }).passthrough();
 function registerPhoneTools(server2, client) {
   safeTool(
     server2,
     "list_phone_numbers",
     "List the LC Phone numbers provisioned for a location (sid, number, label). Read-only. Use to verify or count purchased numbers (e.g. provisioning step 11). Number purchase is not exposed (billable write).",
     {
-      locationId: import_zod55.z.string().optional().describe("Defaults to the active location.")
+      locationId: import_zod56.z.string().optional().describe("Defaults to the active location.")
     },
     async ({ locationId: locationId2 }) => {
       const loc = client.resolveLocationId(locationId2);
@@ -15954,7 +16942,7 @@ function registerPhoneTools(server2, client) {
     "list_number_pools",
     "List LC Phone number pools configured for a location. Read-only.",
     {
-      locationId: import_zod55.z.string().optional().describe("Defaults to the active location.")
+      locationId: import_zod56.z.string().optional().describe("Defaults to the active location.")
     },
     async ({ locationId: locationId2 }) => {
       const loc = client.resolveLocationId(locationId2);
@@ -15966,10 +16954,10 @@ function registerPhoneTools(server2, client) {
 }
 
 // src/tools/account-health.ts
-var import_zod56 = require("zod");
-var MetaTotalSchema = import_zod56.z.object({ meta: import_zod56.z.object({ total: import_zod56.z.number() }).passthrough() }).passthrough();
-var TotalSchema2 = import_zod56.z.object({ total: import_zod56.z.number() }).passthrough();
-var NumbersSchema = import_zod56.z.object({ phoneNumbers: import_zod56.z.array(import_zod56.z.unknown()) }).passthrough();
+var import_zod57 = require("zod");
+var MetaTotalSchema = import_zod57.z.object({ meta: import_zod57.z.object({ total: import_zod57.z.number() }).passthrough() }).passthrough();
+var TotalSchema2 = import_zod57.z.object({ total: import_zod57.z.number() }).passthrough();
+var NumbersSchema = import_zod57.z.object({ phoneNumbers: import_zod57.z.array(import_zod57.z.unknown()) }).passthrough();
 var OPP_STATUSES = ["open", "won", "lost", "abandoned"];
 async function section(scope, fn) {
   try {
@@ -15984,8 +16972,8 @@ function registerAccountHealthTools(server2, client) {
     "get_account_health_summary",
     "Account-health summary for a location, composed from existing reads (GHL has no reporting API). Returns: total contacts + NEW contacts in the window; total opportunities + counts by status (open/won/lost/abandoned); total conversations; phone-number count. Every metric is explicitly labeled all_time vs window (with start/end) \u2014 windowed and all-time numbers are never conflated. Sections that can't be read return status:'unavailable' (never a misleading 0). Revenue and appointments are intentionally excluded (not reachable / too costly via the public API).",
     {
-      locationId: import_zod56.z.string().optional().describe("Defaults to the active location."),
-      windowDays: import_zod56.z.number().int().positive().max(365).optional().describe("Lookback window in days for windowed metrics (new contacts). Default 30.")
+      locationId: import_zod57.z.string().optional().describe("Defaults to the active location."),
+      windowDays: import_zod57.z.number().int().positive().max(365).optional().describe("Lookback window in days for windowed metrics (new contacts). Default 30.")
     },
     async ({ locationId: locationId2, windowDays }) => {
       const loc = client.resolveLocationId(locationId2);
@@ -16051,7 +17039,7 @@ function registerAccountHealthTools(server2, client) {
 }
 
 // src/tools/intake-to-build.ts
-var import_zod59 = require("zod");
+var import_zod60 = require("zod");
 
 // src/intake-to-build/form-template.ts
 init_question_set();
@@ -16335,7 +17323,7 @@ init_question_set();
 init_question_set();
 
 // src/intake-to-build/brief.ts
-var import_zod57 = require("zod");
+var import_zod58 = require("zod");
 var BRIEF_SCHEMA_VERSION = "0.1";
 var PRESETS = [
   "generic",
@@ -16345,67 +17333,67 @@ var PRESETS = [
   "ecom",
   "agency"
 ];
-var presetSchema = import_zod57.z.enum(PRESETS);
+var presetSchema = import_zod58.z.enum(PRESETS);
 var BRIEF_SOURCES = ["agency_os", "business_os", "intake_form", "hybrid"];
-var briefSourceSchema = import_zod57.z.enum(BRIEF_SOURCES);
-var pricePointSchema = import_zod57.z.object({
-  name: import_zod57.z.string(),
-  price: import_zod57.z.string()
+var briefSourceSchema = import_zod58.z.enum(BRIEF_SOURCES);
+var pricePointSchema = import_zod58.z.object({
+  name: import_zod58.z.string(),
+  price: import_zod58.z.string()
 });
-var briefSchema = import_zod57.z.object({
-  schemaVersion: import_zod57.z.string(),
-  briefId: import_zod57.z.string(),
+var briefSchema = import_zod58.z.object({
+  schemaVersion: import_zod58.z.string(),
+  briefId: import_zod58.z.string(),
   preset: presetSchema,
   briefSource: briefSourceSchema,
   /** Partner-OS deep structures (ICA / offer / brand-DNA), carried verbatim. */
-  extended: import_zod57.z.record(import_zod57.z.unknown()).optional(),
-  business: import_zod57.z.object({
-    name: import_zod57.z.string(),
-    type: import_zod57.z.string().optional(),
-    website: import_zod57.z.string().optional(),
-    location: import_zod57.z.string().optional(),
-    timezone: import_zod57.z.string().optional(),
+  extended: import_zod58.z.record(import_zod58.z.unknown()).optional(),
+  business: import_zod58.z.object({
+    name: import_zod58.z.string(),
+    type: import_zod58.z.string().optional(),
+    website: import_zod58.z.string().optional(),
+    location: import_zod58.z.string().optional(),
+    timezone: import_zod58.z.string().optional(),
     // Ratified additions (atlas 2026-06-15). Enum-ish but kept as strings for
     // the same tolerance reason as business.type (don't reject valid briefs).
-    teamSize: import_zod57.z.string().optional(),
-    monthlyLeadVolume: import_zod57.z.string().optional(),
-    hours: import_zod57.z.string().optional()
+    teamSize: import_zod58.z.string().optional(),
+    monthlyLeadVolume: import_zod58.z.string().optional(),
+    hours: import_zod58.z.string().optional()
   }).passthrough(),
-  offer: import_zod57.z.object({
-    summary: import_zod57.z.string().optional(),
+  offer: import_zod58.z.object({
+    summary: import_zod58.z.string().optional(),
     // Parsed best-effort; tolerate a raw string when parsing was not possible.
-    pricePoints: import_zod57.z.union([import_zod57.z.array(pricePointSchema), import_zod57.z.string()]).optional(),
-    leadMagnet: import_zod57.z.string().optional(),
-    avgDealValue: import_zod57.z.string().optional()
+    pricePoints: import_zod58.z.union([import_zod58.z.array(pricePointSchema), import_zod58.z.string()]).optional(),
+    leadMagnet: import_zod58.z.string().optional(),
+    avgDealValue: import_zod58.z.string().optional()
   }).passthrough().optional(),
-  audience: import_zod57.z.object({
-    ideal: import_zod57.z.string().optional(),
-    painPoints: import_zod57.z.array(import_zod57.z.string()).optional(),
-    objections: import_zod57.z.array(import_zod57.z.string()).optional()
+  audience: import_zod58.z.object({
+    ideal: import_zod58.z.string().optional(),
+    painPoints: import_zod58.z.array(import_zod58.z.string()).optional(),
+    objections: import_zod58.z.array(import_zod58.z.string()).optional()
   }).passthrough().optional(),
-  goal: import_zod57.z.object({
+  goal: import_zod58.z.object({
     // Kept as string: the form option labels are the canonical values, but
     // the contract sample shortens some (e.g. "high-touch"). See §7 note.
-    primary: import_zod57.z.string(),
-    salesStages: import_zod57.z.array(import_zod57.z.string()).optional(),
-    bookingNeeded: import_zod57.z.boolean().optional(),
-    followUpStyle: import_zod57.z.string().optional()
+    primary: import_zod58.z.string(),
+    salesStages: import_zod58.z.array(import_zod58.z.string()).optional(),
+    bookingNeeded: import_zod58.z.boolean().optional(),
+    followUpStyle: import_zod58.z.string().optional()
   }).passthrough(),
-  channels: import_zod57.z.object({
-    email: import_zod57.z.boolean().optional(),
-    sms: import_zod57.z.boolean().optional(),
-    a2pStatus: import_zod57.z.string().optional(),
-    payment: import_zod57.z.string().optional(),
-    calendarConnected: import_zod57.z.boolean().optional(),
-    social: import_zod57.z.array(import_zod57.z.string()).optional()
+  channels: import_zod58.z.object({
+    email: import_zod58.z.boolean().optional(),
+    sms: import_zod58.z.boolean().optional(),
+    a2pStatus: import_zod58.z.string().optional(),
+    payment: import_zod58.z.string().optional(),
+    calendarConnected: import_zod58.z.boolean().optional(),
+    social: import_zod58.z.array(import_zod58.z.string()).optional()
   }).passthrough().optional(),
-  assets: import_zod57.z.object({
-    existingPipeline: import_zod57.z.string().optional(),
-    existingWorkflows: import_zod57.z.string().optional(),
-    brand: import_zod57.z.string().optional(),
-    notes: import_zod57.z.string().optional()
+  assets: import_zod58.z.object({
+    existingPipeline: import_zod58.z.string().optional(),
+    existingWorkflows: import_zod58.z.string().optional(),
+    brand: import_zod58.z.string().optional(),
+    notes: import_zod58.z.string().optional()
   }).passthrough().optional(),
-  flags: import_zod57.z.array(import_zod57.z.string()).optional()
+  flags: import_zod58.z.array(import_zod58.z.string()).optional()
 }).strict();
 function validateBrief(input) {
   const parsed = briefSchema.safeParse(input);
@@ -16563,7 +17551,7 @@ function normalizeSubmissionToBrief(opts) {
 }
 
 // src/intake-to-build/plan.ts
-var import_zod58 = require("zod");
+var import_zod59 = require("zod");
 var REF_NAMESPACES = [
   "pipeline",
   "stage",
@@ -16580,22 +17568,22 @@ var REF_NAMESPACES = [
   "handoff"
 ];
 var REF_RE = new RegExp(`^(${REF_NAMESPACES.join("|")})\\.[a-z0-9]+(_[a-z0-9]+)*$`);
-var refSchema = import_zod58.z.string().regex(REF_RE, "must be a <namespace>.<snake_case_slug> ref (no real GHL IDs)");
+var refSchema = import_zod59.z.string().regex(REF_RE, "must be a <namespace>.<snake_case_slug> ref (no real GHL IDs)");
 function nsRef(ns) {
-  return import_zod58.z.string().regex(new RegExp(`^${ns}\\.[a-z0-9]+(_[a-z0-9]+)*$`), `must be a ${ns}.* ref`);
+  return import_zod59.z.string().regex(new RegExp(`^${ns}\\.[a-z0-9]+(_[a-z0-9]+)*$`), `must be a ${ns}.* ref`);
 }
 function refNamespace(ref) {
   return ref.split(".")[0];
 }
-var stageSchema = import_zod58.z.object({
+var stageSchema = import_zod59.z.object({
   ref: nsRef("stage"),
-  name: import_zod58.z.string(),
-  position: import_zod58.z.number().int().nonnegative()
+  name: import_zod59.z.string(),
+  position: import_zod59.z.number().int().nonnegative()
 });
-var pipelineSchema = import_zod58.z.object({
+var pipelineSchema = import_zod59.z.object({
   ref: nsRef("pipeline"),
-  name: import_zod58.z.string(),
-  stages: import_zod58.z.array(stageSchema).min(1)
+  name: import_zod59.z.string(),
+  stages: import_zod59.z.array(stageSchema).min(1)
 });
 var GHL_FIELD_DATATYPES = [
   "TEXT",
@@ -16612,21 +17600,21 @@ var GHL_FIELD_DATATYPES = [
   "FILE_UPLOAD",
   "SIGNATURE"
 ];
-var customFieldSchema = import_zod58.z.object({
+var customFieldSchema = import_zod59.z.object({
   ref: nsRef("field"),
-  name: import_zod58.z.string(),
-  dataType: import_zod58.z.enum(GHL_FIELD_DATATYPES),
-  model: import_zod58.z.enum(["contact", "opportunity"]).optional(),
-  options: import_zod58.z.array(import_zod58.z.string()).optional()
+  name: import_zod59.z.string(),
+  dataType: import_zod59.z.enum(GHL_FIELD_DATATYPES),
+  model: import_zod59.z.enum(["contact", "opportunity"]).optional(),
+  options: import_zod59.z.array(import_zod59.z.string()).optional()
 });
-var tagSchema = import_zod58.z.object({
+var tagSchema = import_zod59.z.object({
   ref: nsRef("tag"),
-  name: import_zod58.z.string()
+  name: import_zod59.z.string()
 });
-var customValueSchema = import_zod58.z.object({
+var customValueSchema = import_zod59.z.object({
   ref: nsRef("cv"),
-  name: import_zod58.z.string(),
-  value: import_zod58.z.string().optional(),
+  name: import_zod59.z.string(),
+  value: import_zod59.z.string().optional(),
   filledBy: refSchema.optional()
 });
 var CALENDAR_TYPES = [
@@ -16636,89 +17624,89 @@ var CALENDAR_TYPES = [
   "collective",
   "service_booking"
 ];
-var openHoursBlockSchema = import_zod58.z.object({
-  daysOfTheWeek: import_zod58.z.array(import_zod58.z.number().int().min(0).max(6)),
-  hours: import_zod58.z.array(
-    import_zod58.z.object({
-      openHour: import_zod58.z.number().int().min(0).max(23),
-      openMinute: import_zod58.z.number().int().min(0).max(59),
-      closeHour: import_zod58.z.number().int().min(0).max(23),
-      closeMinute: import_zod58.z.number().int().min(0).max(59)
+var openHoursBlockSchema = import_zod59.z.object({
+  daysOfTheWeek: import_zod59.z.array(import_zod59.z.number().int().min(0).max(6)),
+  hours: import_zod59.z.array(
+    import_zod59.z.object({
+      openHour: import_zod59.z.number().int().min(0).max(23),
+      openMinute: import_zod59.z.number().int().min(0).max(59),
+      closeHour: import_zod59.z.number().int().min(0).max(23),
+      closeMinute: import_zod59.z.number().int().min(0).max(59)
     })
   )
 });
-var calendarSchema = import_zod58.z.object({
+var calendarSchema = import_zod59.z.object({
   ref: nsRef("calendar"),
-  name: import_zod58.z.string(),
-  calendarType: import_zod58.z.enum(CALENDAR_TYPES),
-  openHours: import_zod58.z.array(openHoursBlockSchema).optional(),
-  availabilityType: import_zod58.z.number().int().optional(),
-  requiresStaff: import_zod58.z.boolean().optional()
+  name: import_zod59.z.string(),
+  calendarType: import_zod59.z.enum(CALENDAR_TYPES),
+  openHours: import_zod59.z.array(openHoursBlockSchema).optional(),
+  availabilityType: import_zod59.z.number().int().optional(),
+  requiresStaff: import_zod59.z.boolean().optional()
 });
-var formFieldSchema = import_zod58.z.discriminatedUnion("type", [
-  import_zod58.z.object({
-    type: import_zod58.z.literal("standard"),
-    key: import_zod58.z.string(),
-    required: import_zod58.z.boolean().optional()
+var formFieldSchema = import_zod59.z.discriminatedUnion("type", [
+  import_zod59.z.object({
+    type: import_zod59.z.literal("standard"),
+    key: import_zod59.z.string(),
+    required: import_zod59.z.boolean().optional()
   }),
-  import_zod58.z.object({
-    type: import_zod58.z.literal("custom"),
+  import_zod59.z.object({
+    type: import_zod59.z.literal("custom"),
     fieldRef: nsRef("field"),
-    required: import_zod58.z.boolean().optional()
+    required: import_zod59.z.boolean().optional()
   })
 ]);
-var formSchema = import_zod58.z.object({
+var formSchema = import_zod59.z.object({
   ref: nsRef("form"),
-  name: import_zod58.z.string(),
-  fields: import_zod58.z.array(formFieldSchema)
+  name: import_zod59.z.string(),
+  fields: import_zod59.z.array(formFieldSchema)
 });
-var pageSchema = import_zod58.z.object({
+var pageSchema = import_zod59.z.object({
   ref: nsRef("page"),
-  name: import_zod58.z.string(),
-  role: import_zod58.z.string().optional(),
-  outline: import_zod58.z.string().optional(),
+  name: import_zod59.z.string(),
+  role: import_zod59.z.string().optional(),
+  outline: import_zod59.z.string().optional(),
   formRef: nsRef("form").optional(),
   calendarRef: nsRef("calendar").optional()
 });
 var FUNNEL_TARGETS = ["ghl", "external"];
 var FUNNEL_HOSTS = ["cloudflare", "vercel"];
-var funnelSchema = import_zod58.z.object({
+var funnelSchema = import_zod59.z.object({
   ref: nsRef("funnel"),
-  name: import_zod58.z.string(),
+  name: import_zod59.z.string(),
   // Where the funnel is built. "ghl" (default) = funnel + named steps in GHL.
   // "external" = the subscriber builds + hosts the site themselves (Cloudflare/
   // Vercel) and wires its form back to this GHL sub-account (POWER-USER path —
   // see blueprint-funnel-targets-spec.md §9). The executor does NOT build or
   // deploy an external funnel; it surfaces the GHL-side wiring info.
-  target: import_zod58.z.enum(FUNNEL_TARGETS).optional(),
-  host: import_zod58.z.enum(FUNNEL_HOSTS).optional(),
+  target: import_zod59.z.enum(FUNNEL_TARGETS).optional(),
+  host: import_zod59.z.enum(FUNNEL_HOSTS).optional(),
   // external only
-  domain: import_zod58.z.string().optional(),
+  domain: import_zod59.z.string().optional(),
   // external only
-  pages: import_zod58.z.array(pageSchema)
+  pages: import_zod59.z.array(pageSchema)
 });
-var emailAssetSchema = import_zod58.z.object({
+var emailAssetSchema = import_zod59.z.object({
   ref: nsRef("email"),
-  name: import_zod58.z.string(),
-  subject: import_zod58.z.string().optional(),
-  bodyOutline: import_zod58.z.string().optional(),
-  body: import_zod58.z.string().optional(),
-  mergeTags: import_zod58.z.array(import_zod58.z.string()).optional()
+  name: import_zod59.z.string(),
+  subject: import_zod59.z.string().optional(),
+  bodyOutline: import_zod59.z.string().optional(),
+  body: import_zod59.z.string().optional(),
+  mergeTags: import_zod59.z.array(import_zod59.z.string()).optional()
 });
-var smsAssetSchema = import_zod58.z.object({
+var smsAssetSchema = import_zod59.z.object({
   ref: nsRef("sms"),
-  name: import_zod58.z.string(),
-  bodyOutline: import_zod58.z.string().optional(),
-  body: import_zod58.z.string().optional(),
-  mergeTags: import_zod58.z.array(import_zod58.z.string()).optional()
+  name: import_zod59.z.string(),
+  bodyOutline: import_zod59.z.string().optional(),
+  body: import_zod59.z.string().optional(),
+  mergeTags: import_zod59.z.array(import_zod59.z.string()).optional()
 });
-var waitUnit = import_zod58.z.enum(["minutes", "hours", "days"]);
+var waitUnit = import_zod59.z.enum(["minutes", "hours", "days"]);
 var branchActionOptions = [
-  import_zod58.z.object({ type: import_zod58.z.literal("add_contact_tag"), tagRef: nsRef("tag") }),
-  import_zod58.z.object({ type: import_zod58.z.literal("remove_contact_tag"), tagRef: nsRef("tag") }),
-  import_zod58.z.object({ type: import_zod58.z.literal("send_email"), emailRef: nsRef("email") }),
-  import_zod58.z.object({ type: import_zod58.z.literal("send_sms"), smsRef: nsRef("sms") }),
-  import_zod58.z.object({ type: import_zod58.z.literal("wait"), value: import_zod58.z.number().positive(), unit: waitUnit }),
+  import_zod59.z.object({ type: import_zod59.z.literal("add_contact_tag"), tagRef: nsRef("tag") }),
+  import_zod59.z.object({ type: import_zod59.z.literal("remove_contact_tag"), tagRef: nsRef("tag") }),
+  import_zod59.z.object({ type: import_zod59.z.literal("send_email"), emailRef: nsRef("email") }),
+  import_zod59.z.object({ type: import_zod59.z.literal("send_sms"), smsRef: nsRef("sms") }),
+  import_zod59.z.object({ type: import_zod59.z.literal("wait"), value: import_zod59.z.number().positive(), unit: waitUnit }),
   // Appointment-relative wait ("wait until N BEFORE the appointment").
   // Only works when the workflow has an appointment in context (i.e. an
   // `appointment` trigger) — enforced by validateBuildPlan. Expands to GHL's
@@ -16727,80 +17715,80 @@ var branchActionOptions = [
   // (GHL stores whole minutes). Only "before" is emitted today — that's the
   // shape we captured + proved; "after" (post-appointment follow-up) is
   // deferred until its shape is captured from a real workflow.
-  import_zod58.z.object({
-    type: import_zod58.z.literal("wait_appointment"),
-    value: import_zod58.z.number().int().positive(),
+  import_zod59.z.object({
+    type: import_zod59.z.literal("wait_appointment"),
+    value: import_zod59.z.number().int().positive(),
     unit: waitUnit
   }),
-  import_zod58.z.object({
-    type: import_zod58.z.literal("internal_notification"),
-    to: import_zod58.z.string(),
-    title: import_zod58.z.string(),
-    body: import_zod58.z.string()
+  import_zod59.z.object({
+    type: import_zod59.z.literal("internal_notification"),
+    to: import_zod59.z.string(),
+    title: import_zod59.z.string(),
+    body: import_zod59.z.string()
   }),
-  import_zod58.z.object({
-    type: import_zod58.z.literal("update_contact_field"),
+  import_zod59.z.object({
+    type: import_zod59.z.literal("update_contact_field"),
     fieldRef: nsRef("field"),
-    value: import_zod58.z.string()
+    value: import_zod59.z.string()
   }),
-  import_zod58.z.object({ type: import_zod58.z.literal("add_notes"), body: import_zod58.z.string() }),
-  import_zod58.z.object({
-    type: import_zod58.z.literal("task_notification"),
-    title: import_zod58.z.string(),
-    body: import_zod58.z.string().optional(),
-    dueDate: import_zod58.z.string().optional(),
-    assignedTo: import_zod58.z.string().optional()
+  import_zod59.z.object({ type: import_zod59.z.literal("add_notes"), body: import_zod59.z.string() }),
+  import_zod59.z.object({
+    type: import_zod59.z.literal("task_notification"),
+    title: import_zod59.z.string(),
+    body: import_zod59.z.string().optional(),
+    dueDate: import_zod59.z.string().optional(),
+    assignedTo: import_zod59.z.string().optional()
   }),
-  import_zod58.z.object({ type: import_zod58.z.literal("remove_from_workflow"), workflowRef: nsRef("workflow") }),
-  import_zod58.z.object({ type: import_zod58.z.literal("add_to_workflow"), workflowRef: nsRef("workflow") }),
-  import_zod58.z.object({
-    type: import_zod58.z.literal("create_opportunity"),
+  import_zod59.z.object({ type: import_zod59.z.literal("remove_from_workflow"), workflowRef: nsRef("workflow") }),
+  import_zod59.z.object({ type: import_zod59.z.literal("add_to_workflow"), workflowRef: nsRef("workflow") }),
+  import_zod59.z.object({
+    type: import_zod59.z.literal("create_opportunity"),
     pipelineRef: nsRef("pipeline"),
     stageRef: nsRef("stage"),
     // Opportunity name (merge fields allowed). Defaults to the contact's name.
     // Required by GHL's create node; without it the create silently no-ops.
-    name: import_zod58.z.string().optional(),
+    name: import_zod59.z.string().optional(),
     // Opportunity monetary value (the deal/sale dollar amount). A string so it
     // can be a literal ("2500") OR a merge field ("{{contact.package_value}}").
     // Optional — omitted → GHL leaves the value unset. Shape captured from Lux
     // Bio "14. Package Sale". Lux models the lifecycle by pipeline STAGE, not GHL
     // won/lost status, so a "won" opp = move to the closing stage WITH this value.
-    value: import_zod58.z.string().optional()
+    value: import_zod59.z.string().optional()
   }),
-  import_zod58.z.object({
-    type: import_zod58.z.literal("update_opportunity"),
+  import_zod59.z.object({
+    type: import_zod59.z.literal("update_opportunity"),
     pipelineRef: nsRef("pipeline"),
     stageRef: nsRef("stage"),
     // Opportunity monetary value (see create_opportunity.value). Optional.
-    value: import_zod58.z.string().optional()
+    value: import_zod59.z.string().optional()
   }),
-  import_zod58.z.object({
-    type: import_zod58.z.literal("goal_event"),
-    goalCondition: import_zod58.z.string(),
+  import_zod59.z.object({
+    type: import_zod59.z.literal("goal_event"),
+    goalCondition: import_zod59.z.string(),
     // GHL's GoalAction enum (extracted 2026-05-18): continue | wait | exit.
-    action: import_zod58.z.enum(["exit", "continue", "wait"]).optional()
+    action: import_zod59.z.enum(["exit", "continue", "wait"]).optional()
   })
 ];
-var branchActionSchema = import_zod58.z.discriminatedUnion("type", branchActionOptions);
-var findOpportunitySchema = import_zod58.z.object({
-  type: import_zod58.z.literal("find_opportunity"),
+var branchActionSchema = import_zod59.z.discriminatedUnion("type", branchActionOptions);
+var findOpportunitySchema = import_zod59.z.object({
+  type: import_zod59.z.literal("find_opportunity"),
   pipelineRef: nsRef("pipeline"),
-  found: import_zod58.z.array(branchActionSchema).default([]),
-  notFound: import_zod58.z.array(branchActionSchema).default([])
+  found: import_zod59.z.array(branchActionSchema).default([]),
+  notFound: import_zod59.z.array(branchActionSchema).default([])
 });
-var actionSchema = import_zod58.z.discriminatedUnion("type", [...branchActionOptions, findOpportunitySchema]);
+var actionSchema = import_zod59.z.discriminatedUnion("type", [...branchActionOptions, findOpportunitySchema]);
 var APPOINTMENT_STATUSES = ["new", "confirmed", "showed", "noshow", "cancelled", "invalid"];
 var CALL_STATUSES = ["busy", "canceled", "voicemail", "no-answer", "completed"];
 var NUMBER_VALIDATION_STATES = ["not_valid", "sms_incapable"];
-var triggerSchema = import_zod58.z.object({
-  type: import_zod58.z.string(),
+var triggerSchema = import_zod59.z.object({
+  type: import_zod59.z.string(),
   formRef: nsRef("form").optional(),
   tagRef: nsRef("tag").optional(),
   calendarRef: nsRef("calendar").optional(),
   pipelineRef: nsRef("pipeline").optional(),
   stageRef: nsRef("stage").optional(),
   // Required for a native `appointment` trigger (the status it fires on).
-  appointmentStatus: import_zod58.z.enum(APPOINTMENT_STATUSES).optional(),
+  appointmentStatus: import_zod59.z.enum(APPOINTMENT_STATUSES).optional(),
   // ── customer_reply scoping ──────────────────────────────────────
   // A bare customer_reply trigger fires on EVERY inbound reply from EVERY
   // contact. That is almost never what a plan means: "alert the owner when a
@@ -16814,27 +17802,27 @@ var triggerSchema = import_zod58.z.object({
   // Both optional and additive — omitting them keeps the long-standing
   // fires-on-any-reply baseline.
   hasTagRef: nsRef("tag").optional(),
-  replyIntent: import_zod58.z.enum(["positive", "negative"]).optional(),
+  replyIntent: import_zod59.z.enum(["positive", "negative"]).optional(),
   // ── call_status scoping (missed-call text-back) ─────────────────
   // GHL's call_status trigger fires on a completed call attempt. The states it
   // exposes are exactly what a "missed call" means operationally. Required for
   // a call_status trigger — without them the trigger would fire on EVERY call
   // including answered ones, so the executor refuses rather than guess.
-  callStatuses: import_zod58.z.array(import_zod58.z.enum(CALL_STATUSES)).optional(),
-  callDirection: import_zod58.z.enum(["inbound", "outbound"]).optional(),
+  callStatuses: import_zod59.z.array(import_zod59.z.enum(CALL_STATUSES)).optional(),
+  callDirection: import_zod59.z.enum(["inbound", "outbound"]).optional(),
   // ── validation_error (GHL UI: "Number validation") ──────────────
   // Fires after a phone number passes or fails a validation check. The UI shows
   // "Not valid" / "SMS incapable"; the WIRE values are snake_case. Required for
   // a validation_error trigger — without them the executor refuses rather than
   // guess which failure states to fire on.
-  numberValidation: import_zod58.z.array(import_zod58.z.enum(NUMBER_VALIDATION_STATES)).optional()
+  numberValidation: import_zod59.z.array(import_zod59.z.enum(NUMBER_VALIDATION_STATES)).optional()
 });
-var workflowSchema = import_zod58.z.object({
+var workflowSchema = import_zod59.z.object({
   ref: nsRef("workflow"),
-  name: import_zod58.z.string(),
+  name: import_zod59.z.string(),
   trigger: triggerSchema.optional(),
-  stopOnResponse: import_zod58.z.boolean().optional(),
-  actions: import_zod58.z.array(actionSchema).max(40)
+  stopOnResponse: import_zod59.z.boolean().optional(),
+  actions: import_zod59.z.array(actionSchema).max(40)
   // house rule: <=40 actions/workflow
 });
 var HANDOFF_OWNER_LEGACY = {
@@ -16842,35 +17830,35 @@ var HANDOFF_OWNER_LEGACY = {
   "JERRY-EXT": "OPERATOR-EXT",
   "SASHA": "TEAM"
 };
-var handoffSchema = import_zod58.z.object({
+var handoffSchema = import_zod59.z.object({
   ref: nsRef("handoff"),
-  owner: import_zod58.z.enum(["OPERATOR-UI", "OPERATOR-EXT", "TEAM", "JERRY-UI", "JERRY-EXT", "SASHA"]).transform((o) => HANDOFF_OWNER_LEGACY[o] ?? o),
-  title: import_zod58.z.string(),
-  trigger: import_zod58.z.string().optional(),
-  instruction: import_zod58.z.string(),
+  owner: import_zod59.z.enum(["OPERATOR-UI", "OPERATOR-EXT", "TEAM", "JERRY-UI", "JERRY-EXT", "SASHA"]).transform((o) => HANDOFF_OWNER_LEGACY[o] ?? o),
+  title: import_zod59.z.string(),
+  trigger: import_zod59.z.string().optional(),
+  instruction: import_zod59.z.string(),
   produces: refSchema.nullable().optional(),
-  successCheck: import_zod58.z.string(),
-  blocks: import_zod58.z.array(import_zod58.z.string()).optional()
+  successCheck: import_zod59.z.string(),
+  blocks: import_zod59.z.array(import_zod59.z.string()).optional()
 });
-var buildPlanSchema = import_zod58.z.object({
-  schemaVersion: import_zod58.z.string(),
-  planId: import_zod58.z.string(),
-  briefId: import_zod58.z.string(),
-  preset: import_zod58.z.string(),
-  summary: import_zod58.z.string().optional(),
-  pipelines: import_zod58.z.array(pipelineSchema).optional(),
-  customFields: import_zod58.z.array(customFieldSchema).optional(),
-  tags: import_zod58.z.array(tagSchema).optional(),
-  customValues: import_zod58.z.array(customValueSchema).optional(),
-  calendars: import_zod58.z.array(calendarSchema).optional(),
-  forms: import_zod58.z.array(formSchema).optional(),
-  funnels: import_zod58.z.array(funnelSchema).optional(),
-  emails: import_zod58.z.array(emailAssetSchema).optional(),
-  sms: import_zod58.z.array(smsAssetSchema).optional(),
-  workflows: import_zod58.z.array(workflowSchema).optional(),
-  handoffs: import_zod58.z.array(handoffSchema).optional(),
-  buildOrder: import_zod58.z.array(import_zod58.z.string()).optional(),
-  idMap: import_zod58.z.record(import_zod58.z.string()).optional()
+var buildPlanSchema = import_zod59.z.object({
+  schemaVersion: import_zod59.z.string(),
+  planId: import_zod59.z.string(),
+  briefId: import_zod59.z.string(),
+  preset: import_zod59.z.string(),
+  summary: import_zod59.z.string().optional(),
+  pipelines: import_zod59.z.array(pipelineSchema).optional(),
+  customFields: import_zod59.z.array(customFieldSchema).optional(),
+  tags: import_zod59.z.array(tagSchema).optional(),
+  customValues: import_zod59.z.array(customValueSchema).optional(),
+  calendars: import_zod59.z.array(calendarSchema).optional(),
+  forms: import_zod59.z.array(formSchema).optional(),
+  funnels: import_zod59.z.array(funnelSchema).optional(),
+  emails: import_zod59.z.array(emailAssetSchema).optional(),
+  sms: import_zod59.z.array(smsAssetSchema).optional(),
+  workflows: import_zod59.z.array(workflowSchema).optional(),
+  handoffs: import_zod59.z.array(handoffSchema).optional(),
+  buildOrder: import_zod59.z.array(import_zod59.z.string()).optional(),
+  idMap: import_zod59.z.record(import_zod59.z.string()).optional()
 }).strict();
 function collectDefinedRefs(plan) {
   const refs = /* @__PURE__ */ new Map();
@@ -18540,16 +19528,16 @@ function msg(e) {
 }
 
 // src/tools/intake-to-build.ts
-var customFieldItemSchema = import_zod59.z.object({
-  id: import_zod59.z.string(),
-  name: import_zod59.z.string(),
-  fieldKey: import_zod59.z.string(),
-  dataType: import_zod59.z.string(),
-  model: import_zod59.z.string().optional(),
-  parentId: import_zod59.z.string().optional(),
-  position: import_zod59.z.number().optional(),
-  dateAdded: import_zod59.z.string().optional(),
-  picklistOptions: import_zod59.z.array(import_zod59.z.string()).optional()
+var customFieldItemSchema = import_zod60.z.object({
+  id: import_zod60.z.string(),
+  name: import_zod60.z.string(),
+  fieldKey: import_zod60.z.string(),
+  dataType: import_zod60.z.string(),
+  model: import_zod60.z.string().optional(),
+  parentId: import_zod60.z.string().optional(),
+  position: import_zod60.z.number().optional(),
+  dateAdded: import_zod60.z.string().optional(),
+  picklistOptions: import_zod60.z.array(import_zod60.z.string()).optional()
 }).passthrough();
 function parseCustomFields(raw) {
   const obj = raw && typeof raw === "object" ? raw : {};
@@ -18958,7 +19946,7 @@ function registerIntakeToBuildTools(server2, client, builderClient) {
     "validate_brief",
     "Validate an Intake-to-Build Brief object against the \xA74 schema. Returns {valid, errors}. Use to check a normalized brief before handing it to the plan-generation skill.",
     {
-      brief: import_zod59.z.record(import_zod59.z.unknown()).describe("The Brief object to validate.")
+      brief: import_zod60.z.record(import_zod60.z.unknown()).describe("The Brief object to validate.")
     },
     async ({ brief }) => validateBrief(brief)
   );
@@ -18967,7 +19955,7 @@ function registerIntakeToBuildTools(server2, client, builderClient) {
     "validate_build_plan",
     "Validate an Intake-to-Build Build Plan against the \xA75 schema AND check ref-integrity: every symbolic ref (pipeline.*, stage.*, tag.*, ...) must resolve to a defined object of the right type, and refs must be unique. Dead references are reported as errors here, before any build runs \u2014 the structural guard against 'an invalid ID silently kills downstream actions'. Returns {valid, errors, warnings, referencesScanned}.",
     {
-      plan: import_zod59.z.record(import_zod59.z.unknown()).describe("The Build Plan object to validate.")
+      plan: import_zod60.z.record(import_zod60.z.unknown()).describe("The Build Plan object to validate.")
     },
     async ({ plan }) => validateBuildPlan(plan)
   );
@@ -18975,12 +19963,12 @@ function registerIntakeToBuildTools(server2, client, builderClient) {
     "apply_build_plan",
     `Take an APPROVED Blueprint \xA75 build plan + the CURRENT confirmed sub-account and build it. mode:"dry_run" (default) writes NOTHING \u2014 it resolves refs, expands each workflow's logical actions to native GHL JSON, runs the NEVER-CLOBBER existing-asset scan, and returns a two-part report. Run it FIRST. mode:"execute" performs LIVE writes for the CRM backbone (pipelines+stages, custom fields, tags, custom values), calendars, AND forms: never clobbers (same-named objects are bound to their existing id, never modified), verifies each create by read-back before resolving its ref, halts on the first failure returning the partial idMap, and is idempotent (re-run = no-op). Staff-requiring calendars (round_robin etc.) auto-build only when you are the sole account user (auto-assigns you as the team member); with 0 or 2+ users they're surfaced as a manual step, not auto-staffed to a guess. Forms build with their standard + custom fields (custom fieldRefs resolve to the real fields created earlier in the run). Funnels: a GHL funnel (target:"ghl", default) builds structurally (funnel + named steps; page content/HTML is a manual step \u2014 plans carry outlines); a funnel with target:"external" is NOT built or deployed here \u2014 the user builds + hosts the site themselves (Cloudflare/Vercel) and wires its form back to this GHL sub-account (surfaced as a manual wiring step). Workflows build as DRAFT with all their logical actions expanded to native GHL JSON (incl. opportunity create/move steps, re-enabled v3.41.0) and chained; a contact_tag trigger is built automatically, other trigger types are surfaced as a manual step; the operator reviews + publishes. Always confirms the active location and validates the plan before any write.`,
     {
-      plan: import_zod59.z.record(import_zod59.z.unknown()).describe("The approved \xA75 Build Plan object."),
-      mode: import_zod59.z.enum(["dry_run", "execute"]).optional().describe("dry_run (default) = resolve/expand/scan/report, no writes. execute = live writes (not yet enabled)."),
-      locationId: import_zod59.z.string().optional().describe("Target sub-account. MUST match the active location; if it differs the tool refuses (confirm/switch first)."),
-      metHandoffs: import_zod59.z.array(import_zod59.z.string()).optional().describe('Handoff refs the operator has already satisfied (e.g. ["handoff.a2p"]) \u2014 lifts their gate so dependent workflows are not held DRAFT.'),
-      publishWorkflows: import_zod59.z.boolean().optional().describe("If true, ungated workflows would be published instead of left DRAFT. Default false (DRAFT)."),
-      onConflict: import_zod59.z.enum(["skip", "abort"]).optional().describe("skip (default) = bind same-named existing objects and continue. abort = report conflicts as a halt.")
+      plan: import_zod60.z.record(import_zod60.z.unknown()).describe("The approved \xA75 Build Plan object."),
+      mode: import_zod60.z.enum(["dry_run", "execute"]).optional().describe("dry_run (default) = resolve/expand/scan/report, no writes. execute = live writes (not yet enabled)."),
+      locationId: import_zod60.z.string().optional().describe("Target sub-account. MUST match the active location; if it differs the tool refuses (confirm/switch first)."),
+      metHandoffs: import_zod60.z.array(import_zod60.z.string()).optional().describe('Handoff refs the operator has already satisfied (e.g. ["handoff.a2p"]) \u2014 lifts their gate so dependent workflows are not held DRAFT.'),
+      publishWorkflows: import_zod60.z.boolean().optional().describe("If true, ungated workflows would be published instead of left DRAFT. Default false (DRAFT)."),
+      onConflict: import_zod60.z.enum(["skip", "abort"]).optional().describe("skip (default) = bind same-named existing objects and continue. abort = report conflicts as a halt.")
     },
     async ({ plan, mode, locationId: locationId2, metHandoffs, publishWorkflows, onConflict }) => {
       try {
@@ -19183,9 +20171,9 @@ function registerIntakeToBuildTools(server2, client, builderClient) {
     "install_intake_form",
     "Install the canonical Intake-to-Build client-intake form into the CURRENT GHL location (whatever get_current_location returns). Account-agnostic, zero hardcoded IDs. Creates any missing intake custom fields (idempotent \u2014 reused on re-run), then builds the form with the proven GHL form-builder field shapes and verifies it. Returns {formId, fieldMap} \u2014 keep fieldMap; normalize_submission_to_brief uses it. Pass dryRun:true to preview what would be created without writing. Pass formId to update an existing intake form in place instead of creating a new one.",
     {
-      dryRun: import_zod59.z.boolean().optional().describe("Preview the fields/form that would be created without writing anything."),
-      formId: import_zod59.z.string().optional().describe("Update this existing form in place instead of creating a new one."),
-      formName: import_zod59.z.string().optional().describe(`Form name. Defaults to "${INTAKE_FORM_NAME}".`)
+      dryRun: import_zod60.z.boolean().optional().describe("Preview the fields/form that would be created without writing anything."),
+      formId: import_zod60.z.string().optional().describe("Update this existing form in place instead of creating a new one."),
+      formName: import_zod60.z.string().optional().describe(`Form name. Defaults to "${INTAKE_FORM_NAME}".`)
     },
     async ({ dryRun, formId, formName }) => {
       try {
@@ -19273,10 +20261,10 @@ function registerIntakeToBuildTools(server2, client, builderClient) {
     "normalize_submission_to_brief",
     'Read an intake form submission and normalize it into a \xA74 Brief (briefSource:"intake_form"). Pass the formId; by default the most recent submission is used (or pass submissionId). The intakeKey->customFieldId map is taken from fieldMap if provided (the install_intake_form output, most robust), otherwise reconstructed from the live form. Returns {brief, validation, submissionId} \u2014 validation flags any missing required fields (e.g. an incomplete submission).',
     {
-      formId: import_zod59.z.string().describe("The intake form ID (from install_intake_form)."),
-      submissionId: import_zod59.z.string().optional().describe("Specific submission to normalize. Defaults to the most recent."),
-      fieldMap: import_zod59.z.record(import_zod59.z.string()).optional().describe("intakeKey -> customFieldId map from install_intake_form. Reconstructed from the form if omitted."),
-      preset: import_zod59.z.string().optional().describe("Override the preset. Defaults to one derived from business_type.")
+      formId: import_zod60.z.string().describe("The intake form ID (from install_intake_form)."),
+      submissionId: import_zod60.z.string().optional().describe("Specific submission to normalize. Defaults to the most recent."),
+      fieldMap: import_zod60.z.record(import_zod60.z.string()).optional().describe("intakeKey -> customFieldId map from install_intake_form. Reconstructed from the form if omitted."),
+      preset: import_zod60.z.string().optional().describe("Override the preset. Defaults to one derived from business_type.")
     },
     async ({ formId, submissionId, fieldMap, preset }) => {
       try {
@@ -19305,7 +20293,7 @@ function registerIntakeToBuildTools(server2, client, builderClient) {
           const formFull = await formApiRequest(bc, "GET", `/${formId}?locationId=${locationId2}`);
           resolvedMap = buildFieldMapFromFormFields(extractFormFields(formFull));
         }
-        const presetSchema2 = import_zod59.z.enum(["generic", "med_spa", "clinic_launch_a2p", "coach", "ecom", "agency"]).optional();
+        const presetSchema2 = import_zod60.z.enum(["generic", "med_spa", "clinic_launch_a2p", "coach", "ecom", "agency"]).optional();
         const presetParsed = presetSchema2.safeParse(preset);
         const brief = normalizeSubmissionToBrief({
           others,
@@ -19387,6 +20375,7 @@ var FORM_BUILDER_MODULE = "form-builder";
 var INTAKE_TO_BUILD_MODULE = "intake-to-build";
 var FUNNEL_QA_MODULE = "funnel-qa";
 var USER_GUIDE_MODULE = "user-guide";
+var CHECKUP_MODULE = "checkup";
 var KNOWN_MODULES = /* @__PURE__ */ new Set([
   ...publicApiTools.map(([, label]) => label),
   ...internalApiTools.map(([, label]) => label),
@@ -19394,6 +20383,7 @@ var KNOWN_MODULES = /* @__PURE__ */ new Set([
   INTAKE_TO_BUILD_MODULE,
   FUNNEL_QA_MODULE,
   USER_GUIDE_MODULE,
+  CHECKUP_MODULE,
   VALIDATORS_MODULE,
   DIAGNOSTICS_MODULE,
   LOCATION_SWITCHER_MODULE,
@@ -19426,6 +20416,14 @@ function registerAllTools(server2, client, registry2, mcpVersion, env = process.
     registry2 ?? null,
     () => buildGatingReport(config3, KNOWN_MODULES, attemptedTools, registeredTools, outOfBand)
   );
+  registerCheckupTools(
+    wrap(CHECKUP_MODULE),
+    mcpVersion ?? "unknown",
+    client,
+    builderClient,
+    registry2 ?? null,
+    () => buildGatingReport(config3, KNOWN_MODULES, attemptedTools, registeredTools, outOfBand)
+  );
   registerSnapshotTools(wrap(SNAPSHOTS_MODULE), client, registry2);
   registerAccountExportTools(wrap(ACCOUNT_EXPORT_MODULE), client, registry2, builderClient);
   registerLocationSwitcherTools(
@@ -19483,7 +20481,7 @@ init_credentials_store();
 init_setup_tool();
 
 // src/tools/skills.ts
-var import_zod60 = require("zod");
+var import_zod61 = require("zod");
 
 // src/skill-installer.ts
 var import_node_crypto2 = require("node:crypto");
@@ -19603,7 +20601,7 @@ function registerSkillsTool(server2, packageVersion, baseDir) {
     "install_skills",
     "Install (or repair) the guided skills bundled with GHL Command \u2014 Blueprint (build a whole client account from one intake), Clone Site (clone and rebrand a live web page for a client, with a rights declaration and a pre-launch liability report), and GHL Reports (verified counts, lists, and weekly reports without token burn) \u2014 into your ~/.claude/skills/ so Claude can use them. Runs automatically on startup; call this to verify what is installed, or to re-install after deleting a skill. NEVER overwrites files you have edited (your version is kept and reported). Restart Claude after install for new skills to load.",
     {
-      targetDir: import_zod60.z.string().optional().describe("Override the install directory. Default: ~/.claude/skills")
+      targetDir: import_zod61.z.string().optional().describe("Override the install directory. Default: ~/.claude/skills")
     },
     async ({ targetDir }) => {
       try {