@elitedcs/ghl-mcp 3.67.0 → 3.68.0

package/dist/index.js

@@ -1648,7 +1648,7 @@ Note: Firebase credentials rejected (${fb.error}).`;
       const telemetryLine = telemetryDisabled(process.env) ? "" : `
 
 ${TELEMETRY_DISCLOSURE}`;
-      const finishedCount = isFree ? "111" : "241";
+      const finishedCount = isFree ? "112" : "242";
       const freeTip = isFree ? `
 
 Free tier: read-only. Write tools stay visible but answer with upgrade info instead of acting. Full version ($97/mo founding rate) upgrades in place \u2014 same install, you only swap the license key: https://ghlcommand.com` : "";
@@ -1693,7 +1693,7 @@ Free tier: read-only. Write tools stay visible but answer with upgrade info inst
 function registerEnableWorkflowBuilderTool(server2) {
   server2.tool(
     "enable_workflow_builder",
-    "Add Firebase credentials to an existing GHL Command install to unlock 55 additional tools across the internal-API modules: workflow builder (create/edit/clone/delete/publish/validate workflows, build_if_else_branch, build_goal_event, get_trigger_registry), funnel + page builder, form builder, pipeline builder, workflow cloner, smart lists, reputation, email campaigns, email templates, and memberships, plus the pre-deploy validator. On the FREE tier this same login unlocks the read-only auditor suite (audit_workflows, validate_workflow, full-detail workflow/funnel/pipeline reads). Requires you've already run setup_ghl_mcp. EASIEST PATH: run `capture_firebase_interactive` instead \u2014 a Chrome window opens, you log into GHL, zero pasting. Use THIS tool when you have JSON from `auto_capture_firebase_script` (console-paste path) to put in `firebase_paste`, or the three manual DevTools fields. Tool count goes from 186 to 241 after the next Claude restart.",
+    "Add Firebase credentials to an existing GHL Command install to unlock 55 additional tools across the internal-API modules: workflow builder (create/edit/clone/delete/publish/validate workflows, build_if_else_branch, build_goal_event, get_trigger_registry), funnel + page builder, form builder, pipeline builder, workflow cloner, smart lists, reputation, email campaigns, email templates, and memberships, plus the pre-deploy validator. On the FREE tier this same login unlocks the read-only auditor suite (audit_workflows, validate_workflow, full-detail workflow/funnel/pipeline reads). Requires you've already run setup_ghl_mcp. EASIEST PATH: run `capture_firebase_interactive` instead \u2014 a Chrome window opens, you log into GHL, zero pasting. Use THIS tool when you have JSON from `auto_capture_firebase_script` (console-paste path) to put in `firebase_paste`, or the three manual DevTools fields. Tool count goes from 187 to 242 after the next Claude restart.",
     {
       // v3.25.0: one-paste path. Tool runs `auto_capture_firebase_script` to
       // get the console script; the script returns a JSON object that pastes
@@ -2854,9 +2854,9 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@elitedcs/ghl-mcp",
-      version: "3.67.0",
+      version: "3.68.0",
       mcpName: "io.github.drjerryrelth/ghl-command",
-      description: "GoHighLevel MCP Server for Claude. 241 tools \u2014 full CRM, automation, marketing control, account-wide workflow audit, live funnel-capture verification, and the only programmatic GHL workflow builder, now multi-tenant across client accounts.",
+      description: "GoHighLevel MCP Server for Claude. 242 tools \u2014 full CRM, automation, marketing control, account-wide workflow audit, live funnel-capture verification, and the only programmatic GHL workflow builder, now multi-tenant across client accounts.",
       main: "dist/index.js",
       bin: {
         "ghl-mcp": "dist/index.js"
@@ -6506,8 +6506,10 @@ var FREE_TIER_EXTRA_READ_TOOLS = /* @__PURE__ */ new Set([
   // live funnel QA (reads + public URL probes)
   "check_blog_slug",
   // slug availability lookup
-  "workflow_builder_status"
+  "workflow_builder_status",
   // no-Firebase fallback diagnostic (pure status read)
+  "run_checkup"
+  // whole-install checkup: install layer + live capability probe (all reads)
 ]);
 var FREE_TIER_EXCLUDED_TOOLS = /* @__PURE__ */ new Set([
   "export_account"
@@ -10350,10 +10352,10 @@ function registerWebhookTools(server2, builderClient) {
       confirm: import_zod34.z.literal("DELETE").describe("Must be 'DELETE' to confirm this destructive action."),
       force: import_zod34.z.boolean().optional().describe("Delete even when the workflow contains other actions that would go with it.")
     },
-    async ({ webhookId, confirm, force }) => {
+    async ({ webhookId, confirm: confirm2, force }) => {
       try {
         const client = requireClient();
-        if (confirm !== "DELETE") throw new Error("Pass confirm: 'DELETE' to delete a webhook.");
+        if (confirm2 !== "DELETE") throw new Error("Pass confirm: 'DELETE' to delete a webhook.");
         const summary = summarizeWebhookWorkflow(await client.getWorkflow(webhookId));
         if (!summary) {
           throw new Error(
@@ -12072,7 +12074,7 @@ ${await response.text()}`);
       );
     };
     if (priorDataUrl) refuseCreate(livePageVersion);
-    for (let confirm = 0; confirm < 3; confirm++) {
+    for (let confirm2 = 0; confirm2 < 3; confirm2++) {
       await new Promise((r) => setTimeout(r, 1500));
       let again = null;
       try {
@@ -13666,8 +13668,8 @@ function registerBulkOperationTools(server2, client) {
       contactIds: import_zod45.z.array(import_zod45.z.string()).min(1, "At least one contact ID required.").describe("Array of contact IDs to permanently delete."),
       confirm: import_zod45.z.literal("DELETE").describe("Must pass the string 'DELETE' to confirm. This is a safety check.")
     },
-    async ({ contactIds, confirm }) => {
-      if (confirm !== "DELETE") {
+    async ({ contactIds, confirm: confirm2 }) => {
+      if (confirm2 !== "DELETE") {
         return errorResponse("Safety check failed. Pass confirm: 'DELETE' to proceed.");
       }
       const results = { success: 0, failed: 0, errors: [] };
@@ -16249,167 +16251,507 @@ async function getVersionStatus(installed) {
 }
 
 // src/tools/diagnostics.ts
+async function collectInstallChecks(installedVersion, client, builderClient, registry2, getGatingReport) {
+  const checks = [];
+  const versionPromise = getVersionStatus(installedVersion);
+  const apiKeyPromise = (async () => {
+    const locId = client.defaultLocationId;
+    if (!locId) {
+      return { name: "GHL API key", status: "warn", detail: `Can't validate without a default location ID. Set GHL_LOCATION_ID or run setup_ghl_mcp.` };
+    }
+    try {
+      const response = await fetch(`https://services.leadconnectorhq.com/locations/${locId}`, {
+        method: "GET",
+        headers: {
+          Authorization: `Bearer ${client.getApiKey()}`,
+          "Content-Type": "application/json",
+          Accept: "application/json",
+          Version: "2021-07-28"
+        },
+        signal: AbortSignal.timeout(8e3)
+      });
+      if (response.status === 401) {
+        return { name: "GHL API key", status: "fail", detail: `401 Unauthorized \u2014 key ${client.getApiKeyPrefix()} is invalid or revoked. Run setup_ghl_mcp with a fresh key.` };
+      }
+      if (response.status === 403) {
+        return { name: "GHL API key", status: "fail", detail: `403 Forbidden \u2014 key ${client.getApiKeyPrefix()} doesn't have access to location ${locId}. The key may belong to a different sub-account.` };
+      }
+      if (!response.ok) {
+        return { name: "GHL API key", status: "warn", detail: `HTTP ${response.status} reading /locations/${locId} \u2014 key may be limited or GHL is having issues.` };
+      }
+      return { name: "GHL API key", status: "pass", detail: `Valid (key ${client.getApiKeyPrefix()}).` };
+    } catch (error) {
+      return { name: "GHL API key", status: "warn", detail: `Network error: ${error instanceof Error ? error.message : String(error)}. Server starts anyway; tool calls will report errors when invoked.` };
+    }
+  })();
+  const locationPromise = (async () => {
+    const locId = client.defaultLocationId;
+    if (!locId) {
+      return { name: "Default location", status: "warn", detail: "No default location set. Tools that don't accept locationId arg will fail." };
+    }
+    try {
+      const result = await client.get(`/locations/${locId}`);
+      const loc = result.location ?? result;
+      return { name: "Default location", status: "pass", detail: `${loc?.name ?? "Unknown"} (${locId}) reachable.` };
+    } catch (error) {
+      return { name: "Default location", status: "fail", detail: `Could not read location ${locId}: ${error instanceof Error ? error.message : String(error)}` };
+    }
+  })();
+  const firebasePromise = (async () => {
+    if (!builderClient) {
+      return { name: "Firebase auth (workflow builder)", status: "skip", detail: "Not configured \u2014 your install is one step from finished. Run capture_firebase_interactive: a Chrome window opens, you log into GHL once, and it captures + verifies everything itself (about 60 seconds). This powers the account auditor and the Firebase-gated tools. No Chrome on this machine? auto_capture_firebase_script is the copy-paste path. Do NOT put Firebase values as env vars in your Claude Desktop config \u2014 that path is unreliable and is the usual reason this still shows skip after a restart." };
+    }
+    const result = await builderClient.checkAuth();
+    const tokenCompany = builderClient.getTokenCompanyId();
+    const intendedCompany = builderClient.getIntendedCompanyId() ?? builderClient.getCurrentCompanyId();
+    const companyNote = intendedCompany ? ` Active location's company: ${intendedCompany}.` : "";
+    if (result.ok && intendedCompany && tokenCompany && intendedCompany !== tokenCompany) {
+      return {
+        name: "Firebase auth (workflow builder)",
+        status: "fail",
+        detail: `Company mismatch: the active location belongs to company ${intendedCompany}, but the Firebase token authenticates as ${tokenCompany}. Workflow-builder writes will 401 or hit the wrong account. This company's Firebase is missing or registered under the wrong ID. Run register_company_firebase with a token captured from that sub-account's GHL session (v3.27.0+ stores it under the correct internal ID automatically).`
+      };
+    }
+    if (result.ok) {
+      const idNote = tokenCompany ? ` Authenticated as company ${tokenCompany}.` : "";
+      return { name: "Firebase auth (workflow builder)", status: "pass", detail: `ID token refresh succeeded. Workflow builder tools are usable.${companyNote}${idNote}` };
+    }
+    return { name: "Firebase auth (workflow builder)", status: "fail", detail: `Token refresh failed: ${result.error}.${companyNote} If you're in a client's account, register its Firebase with register_company_firebase. Otherwise re-capture your Firebase values from GHL DevTools and re-run enable_workflow_builder.` };
+  })();
+  const registryCheck = (() => {
+    if (!registry2) {
+      return { name: "Token registry", status: "skip", detail: "Not initialized \u2014 using env-var credentials only. switch_location won't auto-swap keys between sub-accounts." };
+    }
+    const loadFailure = registry2.getLoadFailure();
+    if (loadFailure) {
+      return { name: "Token registry", status: "fail", detail: loadFailure };
+    }
+    const locs = registry2.listLocations();
+    const companies = registry2.listCompanyFirebases();
+    const companyNote = companies.length ? ` ${companies.length} company Firebase credential(s) registered for multi-tenant workflow-builder access.` : "";
+    if (locs.length === 0) {
+      return { name: "Token registry", status: "warn", detail: `Initialized but empty \u2014 register sub-accounts via register_location for cross-account switching.${companyNote}` };
+    }
+    return { name: "Token registry", status: "pass", detail: `${locs.length} sub-account(s) registered.${companyNote}` };
+  })();
+  const [versionStatus, apiKeyCheck, locationCheck, firebaseCheck] = await Promise.all([
+    versionPromise,
+    apiKeyPromise,
+    locationPromise,
+    firebasePromise
+  ]);
+  let versionCheck;
+  if (versionStatus.latest === null) {
+    versionCheck = { name: "npm registry + version", status: "warn", detail: `Installed v${versionStatus.installed}. Could not reach npm registry to check for updates: ${versionStatus.fetchError ?? "unknown"}.` };
+  } else if (versionStatus.upToDate) {
+    versionCheck = { name: "npm registry + version", status: "pass", detail: `Up to date at v${versionStatus.installed}.` };
+  } else {
+    versionCheck = { name: "npm registry + version", status: "warn", detail: `Installed v${versionStatus.installed} but latest is v${versionStatus.latest}. Quit Claude (Cmd+Q) and reopen to upgrade.` };
+  }
+  const gatingCheck = (() => {
+    const r = getGatingReport?.();
+    if (!r) {
+      return { name: "Tool gating", status: "skip", detail: "Gating report unavailable in this mode." };
+    }
+    if (!r.gatingActive) {
+      return { name: "Tool gating", status: "pass", detail: `No gating configured \u2014 all ${r.registeredCount} tools registered. Sub-account create/delete stays OFF unless GHL_ENABLE_ACCOUNT_ADMIN=1 is set.` };
+    }
+    const parts = [`${r.registeredCount} of ${r.attemptedCount} tools registered.`];
+    if (r.disabledTools.length > 0) parts.push(`Disabled tools: ${r.disabledTools.join(", ")}.`);
+    if (r.disabledModules.length > 0) parts.push(`Disabled modules: ${r.disabledModules.join(", ")}.`);
+    if (r.outOfBandDenied.length > 0) parts.push(`Confirmed unregistered (setup/helper tools): ${r.outOfBandDenied.join(", ")}.`);
+    if (r.allowlistActive) parts.push(`Allowlist: modules=[${r.enabledModules.join(",") || "-"}], tools=[${r.enabledTools.join(",") || "-"}].`);
+    parts.push(`Account admin (sub-account create/delete): ${r.accountAdminEnabled ? "ENABLED via GHL_ENABLE_ACCOUNT_ADMIN=1" : "OFF (default)"}.`);
+    const problems = [];
+    if (r.ignoredHardCoreDenials.length > 0) problems.push(`recovery-core tool(s) in GHL_DISABLED_TOOLS cannot be disabled and were IGNORED: ${r.ignoredHardCoreDenials.join(", ")}`);
+    if (r.unknownDisabledTools.length > 0) problems.push(`unrecognized name(s) in GHL_DISABLED_TOOLS (possible typo \u2014 those tools are NOT disabled): ${r.unknownDisabledTools.join(", ")}`);
+    if (r.unknownDisabledModules.length > 0) problems.push(`unrecognized name(s) in GHL_DISABLED_MODULES (possible typo): ${r.unknownDisabledModules.join(", ")}`);
+    if (r.unknownEnabledTools.length > 0) problems.push(`unrecognized name(s) in GHL_ENABLED_TOOLS: ${r.unknownEnabledTools.join(", ")}`);
+    if (r.unknownEnabledModules.length > 0) problems.push(`unrecognized name(s) in GHL_ENABLED_MODULES: ${r.unknownEnabledModules.join(", ")}`);
+    if (problems.length > 0) {
+      return { name: "Tool gating", status: "warn", detail: `${parts.join(" ")} PROBLEMS: ${problems.join("; ")}. Fix the env var in your Claude config and fully restart Claude.` };
+    }
+    return { name: "Tool gating", status: "pass", detail: parts.join(" ") };
+  })();
+  const telemetryCheck = telemetryDisabled(process.env) ? {
+    name: "Anonymous usage stats",
+    status: "skip",
+    detail: `OFF \u2014 ${process.env.GHL_TELEMETRY?.trim() === "0" ? "GHL_TELEMETRY=0" : "DO_NOT_TRACK"} is set. Nothing is sent.`
+  } : {
+    name: "Anonymous usage stats",
+    status: "pass",
+    detail: `ON. ${TELEMETRY_DISCLOSURE} Sent: install/startup events, package version, Node major, platform, and a random device id. NEVER sent: your license key, email, GHL API key, location ID, hostname, file paths, or any GHL account data.`
+  };
+  checks.push(versionCheck, apiKeyCheck, locationCheck, firebaseCheck, registryCheck, gatingCheck, telemetryCheck);
+  return checks;
+}
+function renderChecks(checks) {
+  const symbols = { pass: "\u2713", fail: "\u2717", warn: "!", skip: "\u2014" };
+  const lines = [];
+  for (const c of checks) {
+    lines.push(`${symbols[c.status]} ${c.name.padEnd(35)} ${c.status.toUpperCase()}`);
+    lines.push(`  ${c.detail}`);
+  }
+  return lines;
+}
+function summarizeChecks(checks) {
+  const fails = checks.filter((c) => c.status === "fail").length;
+  const warns = checks.filter((c) => c.status === "warn").length;
+  if (fails === 0 && warns === 0) return "All systems go.";
+  const parts = [];
+  if (fails > 0) parts.push(`${fails} failure(s)`);
+  if (warns > 0) parts.push(`${warns} warning(s)`);
+  return parts.join(", ") + " \u2014 see details above.";
+}
 function registerDiagnosticTools(server2, installedVersion, client, builderClient, registry2, getGatingReport) {
   server2.tool(
     "health_check",
-    "Run a full health check of the GHL Command MCP install. Reports on: npm registry + version status, GHL API key validity, default location reachability, Firebase auth status (workflow builder), token registry, and the tool-gating policy (disabled tools/modules, account-admin opt-in, typos in gating env vars). Returns a structured pass/fail/warn list with detail per check. Use this when something feels broken or after credentials change.",
+    "Run a full health check of the GHL Command MCP install. Reports on: npm registry + version status, GHL API key validity, default location reachability, Firebase auth status (workflow builder), token registry, and the tool-gating policy (disabled tools/modules, account-admin opt-in, typos in gating env vars). Returns a structured pass/fail/warn list with detail per check. Use this when something feels broken or after credentials change. For a wider report that also probes every GHL capability live and shows what you are not yet using, run `run_checkup`.",
     {},
     async () => {
-      const checks = [];
-      const versionPromise = getVersionStatus(installedVersion);
-      const apiKeyPromise = (async () => {
-        const locId = client.defaultLocationId;
-        if (!locId) {
-          return { name: "GHL API key", status: "warn", detail: `Can't validate without a default location ID. Set GHL_LOCATION_ID or run setup_ghl_mcp.` };
-        }
-        try {
-          const response = await fetch(`https://services.leadconnectorhq.com/locations/${locId}`, {
-            method: "GET",
-            headers: {
-              Authorization: `Bearer ${client.getApiKey()}`,
-              "Content-Type": "application/json",
-              Accept: "application/json",
-              Version: "2021-07-28"
-            },
-            signal: AbortSignal.timeout(8e3)
-          });
-          if (response.status === 401) {
-            return { name: "GHL API key", status: "fail", detail: `401 Unauthorized \u2014 key ${client.getApiKeyPrefix()} is invalid or revoked. Run setup_ghl_mcp with a fresh key.` };
-          }
-          if (response.status === 403) {
-            return { name: "GHL API key", status: "fail", detail: `403 Forbidden \u2014 key ${client.getApiKeyPrefix()} doesn't have access to location ${locId}. The key may belong to a different sub-account.` };
-          }
-          if (!response.ok) {
-            return { name: "GHL API key", status: "warn", detail: `HTTP ${response.status} reading /locations/${locId} \u2014 key may be limited or GHL is having issues.` };
-          }
-          return { name: "GHL API key", status: "pass", detail: `Valid (key ${client.getApiKeyPrefix()}).` };
-        } catch (error) {
-          return { name: "GHL API key", status: "warn", detail: `Network error: ${error instanceof Error ? error.message : String(error)}. Server starts anyway; tool calls will report errors when invoked.` };
-        }
-      })();
-      const locationPromise = (async () => {
-        const locId = client.defaultLocationId;
-        if (!locId) {
-          return { name: "Default location", status: "warn", detail: "No default location set. Tools that don't accept locationId arg will fail." };
-        }
-        try {
-          const result = await client.get(`/locations/${locId}`);
-          const loc = result.location ?? result;
-          return { name: "Default location", status: "pass", detail: `${loc?.name ?? "Unknown"} (${locId}) reachable.` };
-        } catch (error) {
-          return { name: "Default location", status: "fail", detail: `Could not read location ${locId}: ${error instanceof Error ? error.message : String(error)}` };
-        }
-      })();
-      const firebasePromise = (async () => {
-        if (!builderClient) {
-          return { name: "Firebase auth (workflow builder)", status: "skip", detail: "Not configured \u2014 your install is one step from finished. Run capture_firebase_interactive: a Chrome window opens, you log into GHL once, and it captures + verifies everything itself (about 60 seconds). This powers the account auditor and the Firebase-gated tools. No Chrome on this machine? auto_capture_firebase_script is the copy-paste path. Do NOT put Firebase values as env vars in your Claude Desktop config \u2014 that path is unreliable and is the usual reason this still shows skip after a restart." };
-        }
-        const result = await builderClient.checkAuth();
-        const tokenCompany = builderClient.getTokenCompanyId();
-        const intendedCompany = builderClient.getIntendedCompanyId() ?? builderClient.getCurrentCompanyId();
-        const companyNote = intendedCompany ? ` Active location's company: ${intendedCompany}.` : "";
-        if (result.ok && intendedCompany && tokenCompany && intendedCompany !== tokenCompany) {
-          return {
-            name: "Firebase auth (workflow builder)",
-            status: "fail",
-            detail: `Company mismatch: the active location belongs to company ${intendedCompany}, but the Firebase token authenticates as ${tokenCompany}. Workflow-builder writes will 401 or hit the wrong account. This company's Firebase is missing or registered under the wrong ID. Run register_company_firebase with a token captured from that sub-account's GHL session (v3.27.0+ stores it under the correct internal ID automatically).`
-          };
-        }
-        if (result.ok) {
-          const idNote = tokenCompany ? ` Authenticated as company ${tokenCompany}.` : "";
-          return { name: "Firebase auth (workflow builder)", status: "pass", detail: `ID token refresh succeeded. Workflow builder tools are usable.${companyNote}${idNote}` };
-        }
-        return { name: "Firebase auth (workflow builder)", status: "fail", detail: `Token refresh failed: ${result.error}.${companyNote} If you're in a client's account, register its Firebase with register_company_firebase. Otherwise re-capture your Firebase values from GHL DevTools and re-run enable_workflow_builder.` };
-      })();
-      const registryCheck = (() => {
-        if (!registry2) {
-          return { name: "Token registry", status: "skip", detail: "Not initialized \u2014 using env-var credentials only. switch_location won't auto-swap keys between sub-accounts." };
-        }
-        const loadFailure = registry2.getLoadFailure();
-        if (loadFailure) {
-          return { name: "Token registry", status: "fail", detail: loadFailure };
-        }
-        const locs = registry2.listLocations();
-        const companies = registry2.listCompanyFirebases();
-        const companyNote = companies.length ? ` ${companies.length} company Firebase credential(s) registered for multi-tenant workflow-builder access.` : "";
-        if (locs.length === 0) {
-          return { name: "Token registry", status: "warn", detail: `Initialized but empty \u2014 register sub-accounts via register_location for cross-account switching.${companyNote}` };
-        }
-        return { name: "Token registry", status: "pass", detail: `${locs.length} sub-account(s) registered.${companyNote}` };
-      })();
-      const [versionStatus, apiKeyCheck, locationCheck, firebaseCheck] = await Promise.all([
-        versionPromise,
-        apiKeyPromise,
-        locationPromise,
-        firebasePromise
-      ]);
-      let versionCheck;
-      if (versionStatus.latest === null) {
-        versionCheck = { name: "npm registry + version", status: "warn", detail: `Installed v${versionStatus.installed}. Could not reach npm registry to check for updates: ${versionStatus.fetchError ?? "unknown"}.` };
-      } else if (versionStatus.upToDate) {
-        versionCheck = { name: "npm registry + version", status: "pass", detail: `Up to date at v${versionStatus.installed}.` };
-      } else {
-        versionCheck = { name: "npm registry + version", status: "warn", detail: `Installed v${versionStatus.installed} but latest is v${versionStatus.latest}. Quit Claude (Cmd+Q) and reopen to upgrade.` };
-      }
-      const gatingCheck = (() => {
-        const r = getGatingReport?.();
-        if (!r) {
-          return { name: "Tool gating", status: "skip", detail: "Gating report unavailable in this mode." };
-        }
-        if (!r.gatingActive) {
-          return { name: "Tool gating", status: "pass", detail: `No gating configured \u2014 all ${r.registeredCount} tools registered. Sub-account create/delete stays OFF unless GHL_ENABLE_ACCOUNT_ADMIN=1 is set.` };
-        }
-        const parts = [`${r.registeredCount} of ${r.attemptedCount} tools registered.`];
-        if (r.disabledTools.length > 0) parts.push(`Disabled tools: ${r.disabledTools.join(", ")}.`);
-        if (r.disabledModules.length > 0) parts.push(`Disabled modules: ${r.disabledModules.join(", ")}.`);
-        if (r.outOfBandDenied.length > 0) parts.push(`Confirmed unregistered (setup/helper tools): ${r.outOfBandDenied.join(", ")}.`);
-        if (r.allowlistActive) parts.push(`Allowlist: modules=[${r.enabledModules.join(",") || "-"}], tools=[${r.enabledTools.join(",") || "-"}].`);
-        parts.push(`Account admin (sub-account create/delete): ${r.accountAdminEnabled ? "ENABLED via GHL_ENABLE_ACCOUNT_ADMIN=1" : "OFF (default)"}.`);
-        const problems = [];
-        if (r.ignoredHardCoreDenials.length > 0) problems.push(`recovery-core tool(s) in GHL_DISABLED_TOOLS cannot be disabled and were IGNORED: ${r.ignoredHardCoreDenials.join(", ")}`);
-        if (r.unknownDisabledTools.length > 0) problems.push(`unrecognized name(s) in GHL_DISABLED_TOOLS (possible typo \u2014 those tools are NOT disabled): ${r.unknownDisabledTools.join(", ")}`);
-        if (r.unknownDisabledModules.length > 0) problems.push(`unrecognized name(s) in GHL_DISABLED_MODULES (possible typo): ${r.unknownDisabledModules.join(", ")}`);
-        if (r.unknownEnabledTools.length > 0) problems.push(`unrecognized name(s) in GHL_ENABLED_TOOLS: ${r.unknownEnabledTools.join(", ")}`);
-        if (r.unknownEnabledModules.length > 0) problems.push(`unrecognized name(s) in GHL_ENABLED_MODULES: ${r.unknownEnabledModules.join(", ")}`);
-        if (problems.length > 0) {
-          return { name: "Tool gating", status: "warn", detail: `${parts.join(" ")} PROBLEMS: ${problems.join("; ")}. Fix the env var in your Claude config and fully restart Claude.` };
-        }
-        return { name: "Tool gating", status: "pass", detail: parts.join(" ") };
-      })();
-      const telemetryCheck = telemetryDisabled(process.env) ? {
-        name: "Anonymous usage stats",
-        status: "skip",
-        detail: `OFF \u2014 ${process.env.GHL_TELEMETRY?.trim() === "0" ? "GHL_TELEMETRY=0" : "DO_NOT_TRACK"} is set. Nothing is sent.`
-      } : {
-        name: "Anonymous usage stats",
-        status: "pass",
-        detail: `ON. ${TELEMETRY_DISCLOSURE} Sent: install/startup events, package version, Node major, platform, and a random device id. NEVER sent: your license key, email, GHL API key, location ID, hostname, file paths, or any GHL account data.`
-      };
-      checks.push(versionCheck, apiKeyCheck, locationCheck, firebaseCheck, registryCheck, gatingCheck, telemetryCheck);
-      const symbols = { pass: "\u2713", fail: "\u2717", warn: "!", skip: "\u2014" };
+      const checks = await collectInstallChecks(installedVersion, client, builderClient, registry2, getGatingReport);
       const lines = [];
       lines.push("GHL Command \u2014 Health Check");
       lines.push("\u2501".repeat(50));
-      for (const c of checks) {
-        lines.push(`${symbols[c.status]} ${c.name.padEnd(35)} ${c.status.toUpperCase()}`);
-        lines.push(`  ${c.detail}`);
-      }
+      lines.push(...renderChecks(checks));
       lines.push("\u2501".repeat(50));
-      const fails = checks.filter((c) => c.status === "fail").length;
-      const warns = checks.filter((c) => c.status === "warn").length;
-      if (fails === 0 && warns === 0) {
-        lines.push("All systems go.");
-      } else {
-        const parts = [];
-        if (fails > 0) parts.push(`${fails} failure(s)`);
-        if (warns > 0) parts.push(`${warns} warning(s)`);
-        lines.push(parts.join(", ") + " \u2014 see details above.");
-      }
+      lines.push(summarizeChecks(checks));
       return { content: [{ type: "text", text: lines.join("\n") }] };
     }
   );
 }
 
+// src/tools/checkup.ts
+var import_zod54 = require("zod");
+var PROBES = [
+  { key: "contacts", label: "Contacts", path: "/contacts/", params: { locationId: "{loc}", limit: 1 }, listKeys: ["contacts"] },
+  { key: "opportunities", label: "Opportunities", path: "/opportunities/search", params: { location_id: "{loc}", limit: 1 }, listKeys: ["opportunities"] },
+  { key: "pipelines", label: "Pipelines", path: "/opportunities/pipelines", params: { locationId: "{loc}" }, listKeys: ["pipelines"] },
+  { key: "conversations", label: "Conversations", path: "/conversations/search", params: { locationId: "{loc}", limit: 1 }, listKeys: ["conversations"] },
+  { key: "calendars", label: "Calendars", path: "/calendars/", params: { locationId: "{loc}" }, listKeys: ["calendars"] },
+  { key: "workflows", label: "Workflows", path: "/workflows/", params: { locationId: "{loc}" }, listKeys: ["workflows"] },
+  { key: "funnels", label: "Funnels and websites", path: "/funnels/funnel/list", params: { locationId: "{loc}", limit: 1 }, listKeys: ["funnels"] },
+  { key: "forms", label: "Forms", path: "/forms/", params: { locationId: "{loc}", limit: 1 }, listKeys: ["forms"] },
+  { key: "surveys", label: "Surveys", path: "/surveys/", params: { locationId: "{loc}", limit: 1 }, listKeys: ["surveys"] },
+  { key: "customFields", label: "Custom fields", path: "/locations/{loc}/customFields", listKeys: ["customFields"] },
+  { key: "customValues", label: "Custom values", path: "/locations/{loc}/customValues", listKeys: ["customValues"] },
+  { key: "tags", label: "Tags", path: "/locations/{loc}/tags", listKeys: ["tags"] },
+  { key: "users", label: "Users", path: "/users/", params: { locationId: "{loc}" }, listKeys: ["users"] },
+  { key: "customObjects", label: "Custom objects", path: "/objects/", params: { locationId: "{loc}" }, listKeys: ["objects"], optional: true },
+  { key: "triggerLinks", label: "Trigger links", path: "/links/", params: { locationId: "{loc}" }, listKeys: ["links"] },
+  { key: "products", label: "Products", path: "/products/", params: { locationId: "{loc}", limit: 1 }, listKeys: ["products"] },
+  // limit AND offset are required by GHL here — omitting either 422s. Same
+  // params the shipped list_invoices sends (live-verified 2026-08-08).
+  { key: "invoices", label: "Invoices", path: "/invoices/", params: { locationId: "{loc}", altId: "{loc}", altType: "location", limit: 1, offset: 0 }, listKeys: ["invoices"] },
+  { key: "media", label: "Media library", path: "/medias/files", params: { altId: "{loc}", altType: "location", type: "file", limit: 1 }, listKeys: ["files"] },
+  { key: "phoneNumbers", label: "Phone numbers", path: "/phone-system/numbers/", params: { locationId: "{loc}" }, listKeys: ["phoneNumbers"] },
+  { key: "socialAccounts", label: "Social accounts", path: "/social-media-posting/{loc}/accounts", listKeys: ["accounts"], optional: true },
+  // limit/offset required here too, for the same reason as invoices.
+  { key: "blogAuthors", label: "Blogs", path: "/blogs/authors", params: { locationId: "{loc}", limit: 50, offset: 0 }, listKeys: ["authors"], optional: true },
+  { key: "campaigns", label: "Campaigns", path: "/campaigns/", params: { locationId: "{loc}" }, listKeys: ["campaigns"], optional: true },
+  { key: "courses", label: "Courses and memberships", path: "/courses/", params: { locationId: "{loc}" }, optional: true },
+  { key: "businesses", label: "Businesses", path: "/businesses/", params: { locationId: "{loc}" }, listKeys: ["businesses"], optional: true }
+];
+var BUILDER_PROBE_KEY = "workflowBuilder";
+function parseStatus(message) {
+  const m = /GHL API Error (\d{3})/.exec(message);
+  return m ? Number(m[1]) : null;
+}
+function classifyFailure(status, optional) {
+  if (status === null) {
+    return { verdict: "inconclusive", detail: "Could not reach GHL (network or timeout). Says nothing about this feature \u2014 run the checkup again." };
+  }
+  if (status === 401) {
+    return { verdict: "no-access", detail: "401 \u2014 the API key was rejected. See the Connection section above." };
+  }
+  if (status === 403) {
+    return { verdict: "no-access", detail: "403 \u2014 this API key's scopes don't include this feature. Fix: edit the Private Integration in GHL and tick every scope, then re-run setup." };
+  }
+  if (status === 429) {
+    return { verdict: "inconclusive", detail: "429 \u2014 GHL rate-limited this probe. Not a fault. Re-run in a minute." };
+  }
+  if (status >= 500) {
+    return { verdict: "inconclusive", detail: `${status} \u2014 GHL server error. Their side, not yours. Re-run later.` };
+  }
+  if (optional) {
+    return { verdict: "unavailable", detail: `${status} \u2014 not readable on this account. Usually means the feature isn't enabled on this GHL plan.` };
+  }
+  return { verdict: "broken", detail: `${status} \u2014 GHL rejected a read that should work. This is what a GoHighLevel change looks like. Please send this report to support@ghlcommand.com.` };
+}
+function countRows(raw, listKeys) {
+  if (typeof raw !== "object" || raw === null) return null;
+  const obj = raw;
+  const meta = obj.meta;
+  if (typeof meta === "object" && meta !== null) {
+    const total = meta.total;
+    if (typeof total === "number") return total;
+  }
+  if (typeof obj.total === "number") return obj.total;
+  for (const key of listKeys ?? []) {
+    if (Array.isArray(obj[key])) return obj[key].length;
+  }
+  for (const value of Object.values(obj)) {
+    if (Array.isArray(value)) return value.length;
+    if (typeof value === "object" && value !== null) {
+      for (const inner of Object.values(value)) {
+        if (Array.isArray(inner)) return inner.length;
+      }
+    }
+  }
+  return null;
+}
+function substitute(value, loc) {
+  return typeof value === "string" ? value.replace("{loc}", loc) : value;
+}
+var CONFIRM_ATTEMPTS = 3;
+var CONFIRM_DELAY_MS = 600;
+async function confirm(run) {
+  let last = await run();
+  for (let attempt = 1; attempt < CONFIRM_ATTEMPTS && last.verdict !== "working" && last.verdict !== "skipped"; attempt++) {
+    await new Promise((r) => setTimeout(r, CONFIRM_DELAY_MS));
+    last = await run();
+  }
+  if (last.verdict === "working" || last.verdict === "skipped") return last;
+  return { ...last, detail: `${last.detail} (Confirmed on ${CONFIRM_ATTEMPTS} separate reads, so this is not a blip.)` };
+}
+async function runProbes(client, loc) {
+  return Promise.all(
+    PROBES.map((probe) => confirm(async () => {
+      const path15 = probe.path.replace("{loc}", loc);
+      const params = probe.params ? Object.fromEntries(Object.entries(probe.params).map(([k, v]) => [k, substitute(v, loc)])) : void 0;
+      try {
+        const raw = await client.get(path15, { params, noRetry: true });
+        const count = countRows(raw, probe.listKeys);
+        return {
+          key: probe.key,
+          label: probe.label,
+          verdict: "working",
+          count,
+          status: 200,
+          detail: count === null ? "Reads fine." : count === 0 ? "Reads fine. You have none yet." : `Reads fine. ${count} in this account.`
+        };
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        const status = parseStatus(message);
+        const { verdict, detail } = classifyFailure(status, probe.optional === true);
+        return { key: probe.key, label: probe.label, verdict, count: null, status, detail };
+      }
+    }))
+  );
+}
+var BUILDER_AUTH_FAILURE = /TOKEN_EXPIRED|INVALID_ARGUMENT|UNAUTHENTICATED|token refresh|refresh token|invalid[_ ]grant|unauthorized/i;
+async function runBuilderProbe(builderClient) {
+  return confirm(() => builderProbeOnce(builderClient));
+}
+async function builderProbeOnce(builderClient) {
+  const base = { key: BUILDER_PROBE_KEY, label: "Workflow Builder (build + edit)", count: null, status: null };
+  if (!builderClient) {
+    return { ...base, verdict: "skipped", detail: "Not connected. This is step 2 of the install, not an extra. Say: Unlock the Workflow Builder." };
+  }
+  try {
+    const raw = await builderClient.listWorkflows(1, 0);
+    const count = countRows(raw, ["workflows"]);
+    return { ...base, verdict: "working", status: 200, count, detail: "Connected. Claude can build and edit workflows in this account." };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    const status = parseStatus(message);
+    if (status === 401 || status === 403 || BUILDER_AUTH_FAILURE.test(message)) {
+      return {
+        ...base,
+        status,
+        verdict: "no-access",
+        detail: "The saved GHL browser login has expired. Say: Unlock the Workflow Builder. It takes about 60 seconds and needs no pasting."
+      };
+    }
+    if (status === null || status === 429 || status >= 500) {
+      return { ...base, status, verdict: "inconclusive", detail: `Could not complete the check${status ? ` (${status})` : ""}. Says nothing either way. Run the checkup again.` };
+    }
+    return { ...base, status, verdict: "broken", detail: `${status} \u2014 the internal API rejected a read that should work. Please send this report to support@ghlcommand.com.` };
+  }
+}
+function buildNudges(probes, builder, registeredLocations) {
+  const by = new Map(probes.map((p) => [p.key, p]));
+  const count = (key) => by.get(key)?.count ?? null;
+  const emptyAndWorking = (key) => by.get(key)?.verdict === "working" && by.get(key)?.count === 0;
+  const nudges = [];
+  if (builder.verdict === "skipped" || builder.verdict === "no-access") {
+    nudges.push({
+      headline: "The Workflow Builder is off \u2014 that is the half that BUILDS.",
+      prompt: "Unlock the Workflow Builder.",
+      guide: "install-ghl-command"
+    });
+  }
+  const workflows = count("workflows");
+  if (workflows !== null && workflows > 0) {
+    nudges.push({
+      // Deliberately not "you have never audited these" — nothing here can
+      // know that, and a checkup that overclaims loses the reader.
+      headline: `${workflows} workflow(s) here. A silent-failure audit finds what GHL never warns you about.`,
+      prompt: "Audit my workflows and find broken pipeline, stage, or field IDs.",
+      guide: "audit-your-workflows"
+    });
+  } else if (emptyAndWorking("workflows")) {
+    nudges.push({
+      headline: "No workflows in this account \u2014 nothing follows up on its own.",
+      prompt: "Build a 7-day nurture sequence with texts, emails, and waits that stops the moment they reply.",
+      guide: "build-nurture-sequence"
+    });
+  }
+  const contacts = count("contacts");
+  if (emptyAndWorking("pipelines") && contacts !== null && contacts > 0) {
+    nudges.push({
+      headline: `${contacts} contacts and no pipeline \u2014 nothing tracks where they are.`,
+      prompt: "Stand up a New Patient pipeline with stages for Lead, Booked, Showed, Treated, and Rebooked.",
+      guide: "stand-up-a-pipeline"
+    });
+  }
+  if (emptyAndWorking("calendars")) {
+    nudges.push({
+      headline: "No booking calendar \u2014 every appointment is being set by hand.",
+      prompt: "Set up a booking calendar for me and show me the booking link.",
+      guide: "set-up-a-booking-calendar"
+    });
+  }
+  if (emptyAndWorking("forms")) {
+    nudges.push({
+      headline: "No forms \u2014 there is no way for a lead to raise their hand.",
+      prompt: "Create an intake form for new leads and show me where the submissions land.",
+      guide: "create-forms-and-read-submissions"
+    });
+  }
+  if (emptyAndWorking("triggerLinks")) {
+    nudges.push({
+      headline: "No trigger links \u2014 you cannot see who clicked what.",
+      prompt: "Create a trigger link and a workflow that tags anyone who clicks it.",
+      guide: "trigger-links"
+    });
+  }
+  if (emptyAndWorking("customValues")) {
+    nudges.push({
+      headline: "No custom values \u2014 AI bots and templates have nothing to personalize from.",
+      prompt: "Set up the custom values this account needs so my templates and AI bot stop hard-coding details.",
+      guide: "ai-bots-and-custom-values"
+    });
+  }
+  if (emptyAndWorking("socialAccounts")) {
+    nudges.push({
+      headline: "No social accounts connected \u2014 the Social Planner is unused.",
+      prompt: "Show me what I need to connect to post to social from here.",
+      guide: "social-posting"
+    });
+  }
+  if (emptyAndWorking("products") && emptyAndWorking("invoices")) {
+    nudges.push({
+      headline: "No products and no invoices \u2014 nothing here can take money.",
+      prompt: "Set up a product and send me a test invoice so I can see the payment flow.",
+      guide: "invoices-and-payments"
+    });
+  }
+  if (registeredLocations <= 1) {
+    nudges.push({
+      headline: "Only one sub-account is registered \u2014 Claude can work across all of them.",
+      prompt: "Register my other sub-accounts so you can switch between them by name.",
+      guide: "switch-between-client-accounts"
+    });
+  }
+  return nudges;
+}
+var VERDICT_SYMBOL = {
+  working: "\u2713",
+  broken: "\u2717",
+  "no-access": "!",
+  unavailable: "\u2014",
+  inconclusive: "?",
+  skipped: "\u2014"
+};
+function renderCheckup(data) {
+  const lines = [];
+  lines.push("GHL Command \u2014 Checkup");
+  lines.push(`v${data.version} \xB7 location ${data.locationId} \xB7 ${data.generatedAt}`);
+  lines.push("\u2501".repeat(58));
+  lines.push("");
+  lines.push("1. CONNECTION \u2014 is the install wired up?");
+  lines.push("\u2500".repeat(58));
+  lines.push(...renderChecks(data.install));
+  lines.push(summarizeChecks(data.install));
+  lines.push("");
+  lines.push("2. WHAT STILL WORKS \u2014 every capability read live, just now");
+  lines.push("\u2500".repeat(58));
+  for (const p of data.probes) {
+    lines.push(`${VERDICT_SYMBOL[p.verdict]} ${p.label.padEnd(30)} ${p.verdict.toUpperCase()}`);
+    lines.push(`  ${p.detail}`);
+  }
+  const broken = data.probes.filter((p) => p.verdict === "broken");
+  lines.push("");
+  if (broken.length === 0) {
+    lines.push("No breakage found. Every capability GHL Command claims still answers.");
+  } else {
+    lines.push(`\u26A0 ${broken.length} capability area(s) are BROKEN: ${broken.map((p) => p.label).join(", ")}.`);
+    lines.push("  This is almost always a GoHighLevel change, not something you did.");
+    lines.push("  Send this whole report to support@ghlcommand.com \u2014 it is exactly what we need to fix it.");
+  }
+  lines.push("");
+  lines.push("3. WHAT YOU ARE NOT USING YET");
+  lines.push("\u2500".repeat(58));
+  lines.push(`Actively using ${data.inUse} of ${data.usable} capability areas in this account.`);
+  lines.push("(Measured from what this GHL account contains \u2014 nothing about your usage is collected or sent.)");
+  lines.push("");
+  if (data.nudges.length === 0) {
+    lines.push("Nothing obvious left on the table. This account is being worked hard.");
+  } else {
+    data.nudges.forEach((n, i) => {
+      lines.push(`${i + 1}. ${n.headline}`);
+      lines.push(`   Say: "${n.prompt}"`);
+      if (n.guide) lines.push(`   Guide: ${n.guide} \u2014 open the full library with "open the user guide".`);
+    });
+  }
+  lines.push("");
+  lines.push("\u2501".repeat(58));
+  lines.push("Run this monthly, and any time GHL feels off. Questions: support@ghlcommand.com");
+  return lines.join("\n");
+}
+function registerCheckupTools(server2, installedVersion, client, builderClient, registry2, getGatingReport) {
+  server2.tool(
+    "run_checkup",
+    `The full GHL Command checkup \u2014 the answer to "am I using it all, and is it all still working?". Three sections: (1) CONNECTION, the same install checks as health_check; (2) WHAT STILL WORKS, one live read-only probe against every GHL capability family, which distinguishes "working but you own none" from "GoHighLevel changed something and this is broken"; (3) WHAT YOU ARE NOT USING YET, derived from what the account actually contains, each line carrying the exact sentence to paste back. Read-only and safe on live client accounts. Use format:'json' for a machine-readable report. Run it monthly, after a GHL update, or any time something feels off.`,
+    {
+      locationId: import_zod54.z.string().optional().describe("Sub-account to check. Defaults to the active location."),
+      format: import_zod54.z.enum(["report", "json"]).optional().describe("'report' (default) is the plain-English checkup. 'json' returns the same data for scripts and support tickets.")
+    },
+    async ({ locationId: locationId2, format }) => {
+      let loc;
+      try {
+        loc = client.resolveLocationId(locationId2);
+      } catch (error) {
+        return {
+          content: [{ type: "text", text: error instanceof Error ? error.message : String(error) }],
+          isError: true
+        };
+      }
+      const [install, probes, builder] = await Promise.all([
+        collectInstallChecks(installedVersion, client, builderClient, registry2, getGatingReport),
+        runProbes(client, loc),
+        runBuilderProbe(builderClient)
+      ]);
+      const allProbes = [...probes, builder];
+      const usable = allProbes.filter((p) => p.verdict === "working").length;
+      const inUse = allProbes.filter((p) => p.verdict === "working" && (p.count === null || p.count > 0)).length;
+      const data = {
+        version: installedVersion,
+        locationId: loc,
+        generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        install,
+        probes: allProbes,
+        nudges: buildNudges(probes, builder, registry2?.listLocations().length ?? 0),
+        inUse,
+        usable
+      };
+      const text = format === "json" ? JSON.stringify(data, null, 2) : renderCheckup(data);
+      return { content: [{ type: "text", text }] };
+    }
+  );
+}
+
 // src/tools/user-guide.ts
 var import_child_process2 = require("child_process");
 var fs8 = __toESM(require("fs"));
@@ -16462,11 +16804,11 @@ ${guidePath}`;
 }
 
 // src/tools/snapshots.ts
-var import_zod54 = require("zod");
+var import_zod55 = require("zod");
 init_ghl_client();
-var SnapshotSchema = import_zod54.z.object({ id: import_zod54.z.string(), name: import_zod54.z.string(), type: import_zod54.z.string() }).passthrough();
-var SnapshotsResponseSchema = import_zod54.z.object({ snapshots: import_zod54.z.array(SnapshotSchema) }).passthrough();
-var ShareLinkResponseSchema = import_zod54.z.object({ id: import_zod54.z.string(), shareLink: import_zod54.z.string() }).passthrough();
+var SnapshotSchema = import_zod55.z.object({ id: import_zod55.z.string(), name: import_zod55.z.string(), type: import_zod55.z.string() }).passthrough();
+var SnapshotsResponseSchema = import_zod55.z.object({ snapshots: import_zod55.z.array(SnapshotSchema) }).passthrough();
+var ShareLinkResponseSchema = import_zod55.z.object({ id: import_zod55.z.string(), shareLink: import_zod55.z.string() }).passthrough();
 var SHARE_TYPES = [
   "link",
   "permanent_link",
@@ -16513,7 +16855,7 @@ function registerSnapshotTools(server2, client, registry2) {
     "list_snapshots",
     "List the agency's GHL snapshots (id, name, type) so you can pick the right one by name before applying it to a sub-account. Reads the agency/company-scoped key (not a sub-account PIT). companyId defaults to the active location's company; pass it explicitly to target a different company you have the agency key for. Read-only.",
     {
-      companyId: import_zod54.z.string().optional().describe(
+      companyId: import_zod55.z.string().optional().describe(
         "Agency/company ID whose snapshots to list. Defaults to the active location's company. Must match the company your agency key is scoped to."
       )
     },
@@ -16538,11 +16880,11 @@ function registerSnapshotTools(server2, client, registry2) {
     "create_snapshot_share_link",
     "Create a shareable load link for one of the agency's snapshots (returns a gohighlevel.com/?share=... URL to import the snapshot into a sub-account). Uses the agency/company-scoped key. WARNING: this is NOT idempotent \u2014 each call mints a NEW link, and there is no API to list or revoke links (revoke in the GHL UI under the snapshot's share settings). Pick share_type deliberately. Use list_snapshots first to get the snapshot id.",
     {
-      snapshot_id: import_zod54.z.string().describe("The snapshot id to share (from list_snapshots)."),
-      share_type: import_zod54.z.enum(SHARE_TYPES).describe(
+      snapshot_id: import_zod55.z.string().describe("The snapshot id to share (from list_snapshots)."),
+      share_type: import_zod55.z.enum(SHARE_TYPES).describe(
         "Share link type. 'link' = standard share link; 'permanent_link' = non-expiring; 'agency_link' = share to agencies; 'location_link' = load into a sub-account/location; 'marketplace_link' = marketplace listing. No default \u2014 choose intentionally."
       ),
-      companyId: import_zod54.z.string().optional().describe(
+      companyId: import_zod55.z.string().optional().describe(
         "Agency/company ID that owns the snapshot. Defaults to the active location's company. Must match the company your agency key is scoped to."
       )
     },
@@ -16572,17 +16914,17 @@ function registerSnapshotTools(server2, client, registry2) {
 }
 
 // src/tools/phone.ts
-var import_zod55 = require("zod");
-var PhoneNumberSchema = import_zod55.z.object({ sid: import_zod55.z.string(), value: import_zod55.z.string(), title: import_zod55.z.string().optional() }).passthrough();
-var NumbersResponseSchema = import_zod55.z.object({ phoneNumbers: import_zod55.z.array(PhoneNumberSchema) }).passthrough();
-var PoolsResponseSchema = import_zod55.z.object({ pools: import_zod55.z.array(import_zod55.z.object({}).passthrough()) }).passthrough();
+var import_zod56 = require("zod");
+var PhoneNumberSchema = import_zod56.z.object({ sid: import_zod56.z.string(), value: import_zod56.z.string(), title: import_zod56.z.string().optional() }).passthrough();
+var NumbersResponseSchema = import_zod56.z.object({ phoneNumbers: import_zod56.z.array(PhoneNumberSchema) }).passthrough();
+var PoolsResponseSchema = import_zod56.z.object({ pools: import_zod56.z.array(import_zod56.z.object({}).passthrough()) }).passthrough();
 function registerPhoneTools(server2, client) {
   safeTool(
     server2,
     "list_phone_numbers",
     "List the LC Phone numbers provisioned for a location (sid, number, label). Read-only. Use to verify or count purchased numbers (e.g. provisioning step 11). Number purchase is not exposed (billable write).",
     {
-      locationId: import_zod55.z.string().optional().describe("Defaults to the active location.")
+      locationId: import_zod56.z.string().optional().describe("Defaults to the active location.")
     },
     async ({ locationId: locationId2 }) => {
       const loc = client.resolveLocationId(locationId2);
@@ -16600,7 +16942,7 @@ function registerPhoneTools(server2, client) {
     "list_number_pools",
     "List LC Phone number pools configured for a location. Read-only.",
     {
-      locationId: import_zod55.z.string().optional().describe("Defaults to the active location.")
+      locationId: import_zod56.z.string().optional().describe("Defaults to the active location.")
     },
     async ({ locationId: locationId2 }) => {
       const loc = client.resolveLocationId(locationId2);
@@ -16612,10 +16954,10 @@ function registerPhoneTools(server2, client) {
 }
 
 // src/tools/account-health.ts
-var import_zod56 = require("zod");
-var MetaTotalSchema = import_zod56.z.object({ meta: import_zod56.z.object({ total: import_zod56.z.number() }).passthrough() }).passthrough();
-var TotalSchema2 = import_zod56.z.object({ total: import_zod56.z.number() }).passthrough();
-var NumbersSchema = import_zod56.z.object({ phoneNumbers: import_zod56.z.array(import_zod56.z.unknown()) }).passthrough();
+var import_zod57 = require("zod");
+var MetaTotalSchema = import_zod57.z.object({ meta: import_zod57.z.object({ total: import_zod57.z.number() }).passthrough() }).passthrough();
+var TotalSchema2 = import_zod57.z.object({ total: import_zod57.z.number() }).passthrough();
+var NumbersSchema = import_zod57.z.object({ phoneNumbers: import_zod57.z.array(import_zod57.z.unknown()) }).passthrough();
 var OPP_STATUSES = ["open", "won", "lost", "abandoned"];
 async function section(scope, fn) {
   try {
@@ -16630,8 +16972,8 @@ function registerAccountHealthTools(server2, client) {
     "get_account_health_summary",
     "Account-health summary for a location, composed from existing reads (GHL has no reporting API). Returns: total contacts + NEW contacts in the window; total opportunities + counts by status (open/won/lost/abandoned); total conversations; phone-number count. Every metric is explicitly labeled all_time vs window (with start/end) \u2014 windowed and all-time numbers are never conflated. Sections that can't be read return status:'unavailable' (never a misleading 0). Revenue and appointments are intentionally excluded (not reachable / too costly via the public API).",
     {
-      locationId: import_zod56.z.string().optional().describe("Defaults to the active location."),
-      windowDays: import_zod56.z.number().int().positive().max(365).optional().describe("Lookback window in days for windowed metrics (new contacts). Default 30.")
+      locationId: import_zod57.z.string().optional().describe("Defaults to the active location."),
+      windowDays: import_zod57.z.number().int().positive().max(365).optional().describe("Lookback window in days for windowed metrics (new contacts). Default 30.")
     },
     async ({ locationId: locationId2, windowDays }) => {
       const loc = client.resolveLocationId(locationId2);
@@ -16697,7 +17039,7 @@ function registerAccountHealthTools(server2, client) {
 }
 
 // src/tools/intake-to-build.ts
-var import_zod59 = require("zod");
+var import_zod60 = require("zod");
 
 // src/intake-to-build/form-template.ts
 init_question_set();
@@ -16981,7 +17323,7 @@ init_question_set();
 init_question_set();
 
 // src/intake-to-build/brief.ts
-var import_zod57 = require("zod");
+var import_zod58 = require("zod");
 var BRIEF_SCHEMA_VERSION = "0.1";
 var PRESETS = [
   "generic",
@@ -16991,67 +17333,67 @@ var PRESETS = [
   "ecom",
   "agency"
 ];
-var presetSchema = import_zod57.z.enum(PRESETS);
+var presetSchema = import_zod58.z.enum(PRESETS);
 var BRIEF_SOURCES = ["agency_os", "business_os", "intake_form", "hybrid"];
-var briefSourceSchema = import_zod57.z.enum(BRIEF_SOURCES);
-var pricePointSchema = import_zod57.z.object({
-  name: import_zod57.z.string(),
-  price: import_zod57.z.string()
+var briefSourceSchema = import_zod58.z.enum(BRIEF_SOURCES);
+var pricePointSchema = import_zod58.z.object({
+  name: import_zod58.z.string(),
+  price: import_zod58.z.string()
 });
-var briefSchema = import_zod57.z.object({
-  schemaVersion: import_zod57.z.string(),
-  briefId: import_zod57.z.string(),
+var briefSchema = import_zod58.z.object({
+  schemaVersion: import_zod58.z.string(),
+  briefId: import_zod58.z.string(),
   preset: presetSchema,
   briefSource: briefSourceSchema,
   /** Partner-OS deep structures (ICA / offer / brand-DNA), carried verbatim. */
-  extended: import_zod57.z.record(import_zod57.z.unknown()).optional(),
-  business: import_zod57.z.object({
-    name: import_zod57.z.string(),
-    type: import_zod57.z.string().optional(),
-    website: import_zod57.z.string().optional(),
-    location: import_zod57.z.string().optional(),
-    timezone: import_zod57.z.string().optional(),
+  extended: import_zod58.z.record(import_zod58.z.unknown()).optional(),
+  business: import_zod58.z.object({
+    name: import_zod58.z.string(),
+    type: import_zod58.z.string().optional(),
+    website: import_zod58.z.string().optional(),
+    location: import_zod58.z.string().optional(),
+    timezone: import_zod58.z.string().optional(),
     // Ratified additions (atlas 2026-06-15). Enum-ish but kept as strings for
     // the same tolerance reason as business.type (don't reject valid briefs).
-    teamSize: import_zod57.z.string().optional(),
-    monthlyLeadVolume: import_zod57.z.string().optional(),
-    hours: import_zod57.z.string().optional()
+    teamSize: import_zod58.z.string().optional(),
+    monthlyLeadVolume: import_zod58.z.string().optional(),
+    hours: import_zod58.z.string().optional()
   }).passthrough(),
-  offer: import_zod57.z.object({
-    summary: import_zod57.z.string().optional(),
+  offer: import_zod58.z.object({
+    summary: import_zod58.z.string().optional(),
     // Parsed best-effort; tolerate a raw string when parsing was not possible.
-    pricePoints: import_zod57.z.union([import_zod57.z.array(pricePointSchema), import_zod57.z.string()]).optional(),
-    leadMagnet: import_zod57.z.string().optional(),
-    avgDealValue: import_zod57.z.string().optional()
+    pricePoints: import_zod58.z.union([import_zod58.z.array(pricePointSchema), import_zod58.z.string()]).optional(),
+    leadMagnet: import_zod58.z.string().optional(),
+    avgDealValue: import_zod58.z.string().optional()
   }).passthrough().optional(),
-  audience: import_zod57.z.object({
-    ideal: import_zod57.z.string().optional(),
-    painPoints: import_zod57.z.array(import_zod57.z.string()).optional(),
-    objections: import_zod57.z.array(import_zod57.z.string()).optional()
+  audience: import_zod58.z.object({
+    ideal: import_zod58.z.string().optional(),
+    painPoints: import_zod58.z.array(import_zod58.z.string()).optional(),
+    objections: import_zod58.z.array(import_zod58.z.string()).optional()
   }).passthrough().optional(),
-  goal: import_zod57.z.object({
+  goal: import_zod58.z.object({
     // Kept as string: the form option labels are the canonical values, but
     // the contract sample shortens some (e.g. "high-touch"). See §7 note.
-    primary: import_zod57.z.string(),
-    salesStages: import_zod57.z.array(import_zod57.z.string()).optional(),
-    bookingNeeded: import_zod57.z.boolean().optional(),
-    followUpStyle: import_zod57.z.string().optional()
+    primary: import_zod58.z.string(),
+    salesStages: import_zod58.z.array(import_zod58.z.string()).optional(),
+    bookingNeeded: import_zod58.z.boolean().optional(),
+    followUpStyle: import_zod58.z.string().optional()
   }).passthrough(),
-  channels: import_zod57.z.object({
-    email: import_zod57.z.boolean().optional(),
-    sms: import_zod57.z.boolean().optional(),
-    a2pStatus: import_zod57.z.string().optional(),
-    payment: import_zod57.z.string().optional(),
-    calendarConnected: import_zod57.z.boolean().optional(),
-    social: import_zod57.z.array(import_zod57.z.string()).optional()
+  channels: import_zod58.z.object({
+    email: import_zod58.z.boolean().optional(),
+    sms: import_zod58.z.boolean().optional(),
+    a2pStatus: import_zod58.z.string().optional(),
+    payment: import_zod58.z.string().optional(),
+    calendarConnected: import_zod58.z.boolean().optional(),
+    social: import_zod58.z.array(import_zod58.z.string()).optional()
   }).passthrough().optional(),
-  assets: import_zod57.z.object({
-    existingPipeline: import_zod57.z.string().optional(),
-    existingWorkflows: import_zod57.z.string().optional(),
-    brand: import_zod57.z.string().optional(),
-    notes: import_zod57.z.string().optional()
+  assets: import_zod58.z.object({
+    existingPipeline: import_zod58.z.string().optional(),
+    existingWorkflows: import_zod58.z.string().optional(),
+    brand: import_zod58.z.string().optional(),
+    notes: import_zod58.z.string().optional()
   }).passthrough().optional(),
-  flags: import_zod57.z.array(import_zod57.z.string()).optional()
+  flags: import_zod58.z.array(import_zod58.z.string()).optional()
 }).strict();
 function validateBrief(input) {
   const parsed = briefSchema.safeParse(input);
@@ -17209,7 +17551,7 @@ function normalizeSubmissionToBrief(opts) {
 }
 
 // src/intake-to-build/plan.ts
-var import_zod58 = require("zod");
+var import_zod59 = require("zod");
 var REF_NAMESPACES = [
   "pipeline",
   "stage",
@@ -17226,22 +17568,22 @@ var REF_NAMESPACES = [
   "handoff"
 ];
 var REF_RE = new RegExp(`^(${REF_NAMESPACES.join("|")})\\.[a-z0-9]+(_[a-z0-9]+)*$`);
-var refSchema = import_zod58.z.string().regex(REF_RE, "must be a <namespace>.<snake_case_slug> ref (no real GHL IDs)");
+var refSchema = import_zod59.z.string().regex(REF_RE, "must be a <namespace>.<snake_case_slug> ref (no real GHL IDs)");
 function nsRef(ns) {
-  return import_zod58.z.string().regex(new RegExp(`^${ns}\\.[a-z0-9]+(_[a-z0-9]+)*$`), `must be a ${ns}.* ref`);
+  return import_zod59.z.string().regex(new RegExp(`^${ns}\\.[a-z0-9]+(_[a-z0-9]+)*$`), `must be a ${ns}.* ref`);
 }
 function refNamespace(ref) {
   return ref.split(".")[0];
 }
-var stageSchema = import_zod58.z.object({
+var stageSchema = import_zod59.z.object({
   ref: nsRef("stage"),
-  name: import_zod58.z.string(),
-  position: import_zod58.z.number().int().nonnegative()
+  name: import_zod59.z.string(),
+  position: import_zod59.z.number().int().nonnegative()
 });
-var pipelineSchema = import_zod58.z.object({
+var pipelineSchema = import_zod59.z.object({
   ref: nsRef("pipeline"),
-  name: import_zod58.z.string(),
-  stages: import_zod58.z.array(stageSchema).min(1)
+  name: import_zod59.z.string(),
+  stages: import_zod59.z.array(stageSchema).min(1)
 });
 var GHL_FIELD_DATATYPES = [
   "TEXT",
@@ -17258,21 +17600,21 @@ var GHL_FIELD_DATATYPES = [
   "FILE_UPLOAD",
   "SIGNATURE"
 ];
-var customFieldSchema = import_zod58.z.object({
+var customFieldSchema = import_zod59.z.object({
   ref: nsRef("field"),
-  name: import_zod58.z.string(),
-  dataType: import_zod58.z.enum(GHL_FIELD_DATATYPES),
-  model: import_zod58.z.enum(["contact", "opportunity"]).optional(),
-  options: import_zod58.z.array(import_zod58.z.string()).optional()
+  name: import_zod59.z.string(),
+  dataType: import_zod59.z.enum(GHL_FIELD_DATATYPES),
+  model: import_zod59.z.enum(["contact", "opportunity"]).optional(),
+  options: import_zod59.z.array(import_zod59.z.string()).optional()
 });
-var tagSchema = import_zod58.z.object({
+var tagSchema = import_zod59.z.object({
   ref: nsRef("tag"),
-  name: import_zod58.z.string()
+  name: import_zod59.z.string()
 });
-var customValueSchema = import_zod58.z.object({
+var customValueSchema = import_zod59.z.object({
   ref: nsRef("cv"),
-  name: import_zod58.z.string(),
-  value: import_zod58.z.string().optional(),
+  name: import_zod59.z.string(),
+  value: import_zod59.z.string().optional(),
   filledBy: refSchema.optional()
 });
 var CALENDAR_TYPES = [
@@ -17282,89 +17624,89 @@ var CALENDAR_TYPES = [
   "collective",
   "service_booking"
 ];
-var openHoursBlockSchema = import_zod58.z.object({
-  daysOfTheWeek: import_zod58.z.array(import_zod58.z.number().int().min(0).max(6)),
-  hours: import_zod58.z.array(
-    import_zod58.z.object({
-      openHour: import_zod58.z.number().int().min(0).max(23),
-      openMinute: import_zod58.z.number().int().min(0).max(59),
-      closeHour: import_zod58.z.number().int().min(0).max(23),
-      closeMinute: import_zod58.z.number().int().min(0).max(59)
+var openHoursBlockSchema = import_zod59.z.object({
+  daysOfTheWeek: import_zod59.z.array(import_zod59.z.number().int().min(0).max(6)),
+  hours: import_zod59.z.array(
+    import_zod59.z.object({
+      openHour: import_zod59.z.number().int().min(0).max(23),
+      openMinute: import_zod59.z.number().int().min(0).max(59),
+      closeHour: import_zod59.z.number().int().min(0).max(23),
+      closeMinute: import_zod59.z.number().int().min(0).max(59)
     })
   )
 });
-var calendarSchema = import_zod58.z.object({
+var calendarSchema = import_zod59.z.object({
   ref: nsRef("calendar"),
-  name: import_zod58.z.string(),
-  calendarType: import_zod58.z.enum(CALENDAR_TYPES),
-  openHours: import_zod58.z.array(openHoursBlockSchema).optional(),
-  availabilityType: import_zod58.z.number().int().optional(),
-  requiresStaff: import_zod58.z.boolean().optional()
+  name: import_zod59.z.string(),
+  calendarType: import_zod59.z.enum(CALENDAR_TYPES),
+  openHours: import_zod59.z.array(openHoursBlockSchema).optional(),
+  availabilityType: import_zod59.z.number().int().optional(),
+  requiresStaff: import_zod59.z.boolean().optional()
 });
-var formFieldSchema = import_zod58.z.discriminatedUnion("type", [
-  import_zod58.z.object({
-    type: import_zod58.z.literal("standard"),
-    key: import_zod58.z.string(),
-    required: import_zod58.z.boolean().optional()
+var formFieldSchema = import_zod59.z.discriminatedUnion("type", [
+  import_zod59.z.object({
+    type: import_zod59.z.literal("standard"),
+    key: import_zod59.z.string(),
+    required: import_zod59.z.boolean().optional()
   }),
-  import_zod58.z.object({
-    type: import_zod58.z.literal("custom"),
+  import_zod59.z.object({
+    type: import_zod59.z.literal("custom"),
     fieldRef: nsRef("field"),
-    required: import_zod58.z.boolean().optional()
+    required: import_zod59.z.boolean().optional()
   })
 ]);
-var formSchema = import_zod58.z.object({
+var formSchema = import_zod59.z.object({
   ref: nsRef("form"),
-  name: import_zod58.z.string(),
-  fields: import_zod58.z.array(formFieldSchema)
+  name: import_zod59.z.string(),
+  fields: import_zod59.z.array(formFieldSchema)
 });
-var pageSchema = import_zod58.z.object({
+var pageSchema = import_zod59.z.object({
   ref: nsRef("page"),
-  name: import_zod58.z.string(),
-  role: import_zod58.z.string().optional(),
-  outline: import_zod58.z.string().optional(),
+  name: import_zod59.z.string(),
+  role: import_zod59.z.string().optional(),
+  outline: import_zod59.z.string().optional(),
   formRef: nsRef("form").optional(),
   calendarRef: nsRef("calendar").optional()
 });
 var FUNNEL_TARGETS = ["ghl", "external"];
 var FUNNEL_HOSTS = ["cloudflare", "vercel"];
-var funnelSchema = import_zod58.z.object({
+var funnelSchema = import_zod59.z.object({
   ref: nsRef("funnel"),
-  name: import_zod58.z.string(),
+  name: import_zod59.z.string(),
   // Where the funnel is built. "ghl" (default) = funnel + named steps in GHL.
   // "external" = the subscriber builds + hosts the site themselves (Cloudflare/
   // Vercel) and wires its form back to this GHL sub-account (POWER-USER path —
   // see blueprint-funnel-targets-spec.md §9). The executor does NOT build or
   // deploy an external funnel; it surfaces the GHL-side wiring info.
-  target: import_zod58.z.enum(FUNNEL_TARGETS).optional(),
-  host: import_zod58.z.enum(FUNNEL_HOSTS).optional(),
+  target: import_zod59.z.enum(FUNNEL_TARGETS).optional(),
+  host: import_zod59.z.enum(FUNNEL_HOSTS).optional(),
   // external only
-  domain: import_zod58.z.string().optional(),
+  domain: import_zod59.z.string().optional(),
   // external only
-  pages: import_zod58.z.array(pageSchema)
+  pages: import_zod59.z.array(pageSchema)
 });
-var emailAssetSchema = import_zod58.z.object({
+var emailAssetSchema = import_zod59.z.object({
   ref: nsRef("email"),
-  name: import_zod58.z.string(),
-  subject: import_zod58.z.string().optional(),
-  bodyOutline: import_zod58.z.string().optional(),
-  body: import_zod58.z.string().optional(),
-  mergeTags: import_zod58.z.array(import_zod58.z.string()).optional()
+  name: import_zod59.z.string(),
+  subject: import_zod59.z.string().optional(),
+  bodyOutline: import_zod59.z.string().optional(),
+  body: import_zod59.z.string().optional(),
+  mergeTags: import_zod59.z.array(import_zod59.z.string()).optional()
 });
-var smsAssetSchema = import_zod58.z.object({
+var smsAssetSchema = import_zod59.z.object({
   ref: nsRef("sms"),
-  name: import_zod58.z.string(),
-  bodyOutline: import_zod58.z.string().optional(),
-  body: import_zod58.z.string().optional(),
-  mergeTags: import_zod58.z.array(import_zod58.z.string()).optional()
+  name: import_zod59.z.string(),
+  bodyOutline: import_zod59.z.string().optional(),
+  body: import_zod59.z.string().optional(),
+  mergeTags: import_zod59.z.array(import_zod59.z.string()).optional()
 });
-var waitUnit = import_zod58.z.enum(["minutes", "hours", "days"]);
+var waitUnit = import_zod59.z.enum(["minutes", "hours", "days"]);
 var branchActionOptions = [
-  import_zod58.z.object({ type: import_zod58.z.literal("add_contact_tag"), tagRef: nsRef("tag") }),
-  import_zod58.z.object({ type: import_zod58.z.literal("remove_contact_tag"), tagRef: nsRef("tag") }),
-  import_zod58.z.object({ type: import_zod58.z.literal("send_email"), emailRef: nsRef("email") }),
-  import_zod58.z.object({ type: import_zod58.z.literal("send_sms"), smsRef: nsRef("sms") }),
-  import_zod58.z.object({ type: import_zod58.z.literal("wait"), value: import_zod58.z.number().positive(), unit: waitUnit }),
+  import_zod59.z.object({ type: import_zod59.z.literal("add_contact_tag"), tagRef: nsRef("tag") }),
+  import_zod59.z.object({ type: import_zod59.z.literal("remove_contact_tag"), tagRef: nsRef("tag") }),
+  import_zod59.z.object({ type: import_zod59.z.literal("send_email"), emailRef: nsRef("email") }),
+  import_zod59.z.object({ type: import_zod59.z.literal("send_sms"), smsRef: nsRef("sms") }),
+  import_zod59.z.object({ type: import_zod59.z.literal("wait"), value: import_zod59.z.number().positive(), unit: waitUnit }),
   // Appointment-relative wait ("wait until N BEFORE the appointment").
   // Only works when the workflow has an appointment in context (i.e. an
   // `appointment` trigger) — enforced by validateBuildPlan. Expands to GHL's
@@ -17373,80 +17715,80 @@ var branchActionOptions = [
   // (GHL stores whole minutes). Only "before" is emitted today — that's the
   // shape we captured + proved; "after" (post-appointment follow-up) is
   // deferred until its shape is captured from a real workflow.
-  import_zod58.z.object({
-    type: import_zod58.z.literal("wait_appointment"),
-    value: import_zod58.z.number().int().positive(),
+  import_zod59.z.object({
+    type: import_zod59.z.literal("wait_appointment"),
+    value: import_zod59.z.number().int().positive(),
     unit: waitUnit
   }),
-  import_zod58.z.object({
-    type: import_zod58.z.literal("internal_notification"),
-    to: import_zod58.z.string(),
-    title: import_zod58.z.string(),
-    body: import_zod58.z.string()
+  import_zod59.z.object({
+    type: import_zod59.z.literal("internal_notification"),
+    to: import_zod59.z.string(),
+    title: import_zod59.z.string(),
+    body: import_zod59.z.string()
   }),
-  import_zod58.z.object({
-    type: import_zod58.z.literal("update_contact_field"),
+  import_zod59.z.object({
+    type: import_zod59.z.literal("update_contact_field"),
     fieldRef: nsRef("field"),
-    value: import_zod58.z.string()
+    value: import_zod59.z.string()
   }),
-  import_zod58.z.object({ type: import_zod58.z.literal("add_notes"), body: import_zod58.z.string() }),
-  import_zod58.z.object({
-    type: import_zod58.z.literal("task_notification"),
-    title: import_zod58.z.string(),
-    body: import_zod58.z.string().optional(),
-    dueDate: import_zod58.z.string().optional(),
-    assignedTo: import_zod58.z.string().optional()
+  import_zod59.z.object({ type: import_zod59.z.literal("add_notes"), body: import_zod59.z.string() }),
+  import_zod59.z.object({
+    type: import_zod59.z.literal("task_notification"),
+    title: import_zod59.z.string(),
+    body: import_zod59.z.string().optional(),
+    dueDate: import_zod59.z.string().optional(),
+    assignedTo: import_zod59.z.string().optional()
   }),
-  import_zod58.z.object({ type: import_zod58.z.literal("remove_from_workflow"), workflowRef: nsRef("workflow") }),
-  import_zod58.z.object({ type: import_zod58.z.literal("add_to_workflow"), workflowRef: nsRef("workflow") }),
-  import_zod58.z.object({
-    type: import_zod58.z.literal("create_opportunity"),
+  import_zod59.z.object({ type: import_zod59.z.literal("remove_from_workflow"), workflowRef: nsRef("workflow") }),
+  import_zod59.z.object({ type: import_zod59.z.literal("add_to_workflow"), workflowRef: nsRef("workflow") }),
+  import_zod59.z.object({
+    type: import_zod59.z.literal("create_opportunity"),
     pipelineRef: nsRef("pipeline"),
     stageRef: nsRef("stage"),
     // Opportunity name (merge fields allowed). Defaults to the contact's name.
     // Required by GHL's create node; without it the create silently no-ops.
-    name: import_zod58.z.string().optional(),
+    name: import_zod59.z.string().optional(),
     // Opportunity monetary value (the deal/sale dollar amount). A string so it
     // can be a literal ("2500") OR a merge field ("{{contact.package_value}}").
     // Optional — omitted → GHL leaves the value unset. Shape captured from Lux
     // Bio "14. Package Sale". Lux models the lifecycle by pipeline STAGE, not GHL
     // won/lost status, so a "won" opp = move to the closing stage WITH this value.
-    value: import_zod58.z.string().optional()
+    value: import_zod59.z.string().optional()
   }),
-  import_zod58.z.object({
-    type: import_zod58.z.literal("update_opportunity"),
+  import_zod59.z.object({
+    type: import_zod59.z.literal("update_opportunity"),
     pipelineRef: nsRef("pipeline"),
     stageRef: nsRef("stage"),
     // Opportunity monetary value (see create_opportunity.value). Optional.
-    value: import_zod58.z.string().optional()
+    value: import_zod59.z.string().optional()
   }),
-  import_zod58.z.object({
-    type: import_zod58.z.literal("goal_event"),
-    goalCondition: import_zod58.z.string(),
+  import_zod59.z.object({
+    type: import_zod59.z.literal("goal_event"),
+    goalCondition: import_zod59.z.string(),
     // GHL's GoalAction enum (extracted 2026-05-18): continue | wait | exit.
-    action: import_zod58.z.enum(["exit", "continue", "wait"]).optional()
+    action: import_zod59.z.enum(["exit", "continue", "wait"]).optional()
   })
 ];
-var branchActionSchema = import_zod58.z.discriminatedUnion("type", branchActionOptions);
-var findOpportunitySchema = import_zod58.z.object({
-  type: import_zod58.z.literal("find_opportunity"),
+var branchActionSchema = import_zod59.z.discriminatedUnion("type", branchActionOptions);
+var findOpportunitySchema = import_zod59.z.object({
+  type: import_zod59.z.literal("find_opportunity"),
   pipelineRef: nsRef("pipeline"),
-  found: import_zod58.z.array(branchActionSchema).default([]),
-  notFound: import_zod58.z.array(branchActionSchema).default([])
+  found: import_zod59.z.array(branchActionSchema).default([]),
+  notFound: import_zod59.z.array(branchActionSchema).default([])
 });
-var actionSchema = import_zod58.z.discriminatedUnion("type", [...branchActionOptions, findOpportunitySchema]);
+var actionSchema = import_zod59.z.discriminatedUnion("type", [...branchActionOptions, findOpportunitySchema]);
 var APPOINTMENT_STATUSES = ["new", "confirmed", "showed", "noshow", "cancelled", "invalid"];
 var CALL_STATUSES = ["busy", "canceled", "voicemail", "no-answer", "completed"];
 var NUMBER_VALIDATION_STATES = ["not_valid", "sms_incapable"];
-var triggerSchema = import_zod58.z.object({
-  type: import_zod58.z.string(),
+var triggerSchema = import_zod59.z.object({
+  type: import_zod59.z.string(),
   formRef: nsRef("form").optional(),
   tagRef: nsRef("tag").optional(),
   calendarRef: nsRef("calendar").optional(),
   pipelineRef: nsRef("pipeline").optional(),
   stageRef: nsRef("stage").optional(),
   // Required for a native `appointment` trigger (the status it fires on).
-  appointmentStatus: import_zod58.z.enum(APPOINTMENT_STATUSES).optional(),
+  appointmentStatus: import_zod59.z.enum(APPOINTMENT_STATUSES).optional(),
   // ── customer_reply scoping ──────────────────────────────────────
   // A bare customer_reply trigger fires on EVERY inbound reply from EVERY
   // contact. That is almost never what a plan means: "alert the owner when a
@@ -17460,27 +17802,27 @@ var triggerSchema = import_zod58.z.object({
   // Both optional and additive — omitting them keeps the long-standing
   // fires-on-any-reply baseline.
   hasTagRef: nsRef("tag").optional(),
-  replyIntent: import_zod58.z.enum(["positive", "negative"]).optional(),
+  replyIntent: import_zod59.z.enum(["positive", "negative"]).optional(),
   // ── call_status scoping (missed-call text-back) ─────────────────
   // GHL's call_status trigger fires on a completed call attempt. The states it
   // exposes are exactly what a "missed call" means operationally. Required for
   // a call_status trigger — without them the trigger would fire on EVERY call
   // including answered ones, so the executor refuses rather than guess.
-  callStatuses: import_zod58.z.array(import_zod58.z.enum(CALL_STATUSES)).optional(),
-  callDirection: import_zod58.z.enum(["inbound", "outbound"]).optional(),
+  callStatuses: import_zod59.z.array(import_zod59.z.enum(CALL_STATUSES)).optional(),
+  callDirection: import_zod59.z.enum(["inbound", "outbound"]).optional(),
   // ── validation_error (GHL UI: "Number validation") ──────────────
   // Fires after a phone number passes or fails a validation check. The UI shows
   // "Not valid" / "SMS incapable"; the WIRE values are snake_case. Required for
   // a validation_error trigger — without them the executor refuses rather than
   // guess which failure states to fire on.
-  numberValidation: import_zod58.z.array(import_zod58.z.enum(NUMBER_VALIDATION_STATES)).optional()
+  numberValidation: import_zod59.z.array(import_zod59.z.enum(NUMBER_VALIDATION_STATES)).optional()
 });
-var workflowSchema = import_zod58.z.object({
+var workflowSchema = import_zod59.z.object({
   ref: nsRef("workflow"),
-  name: import_zod58.z.string(),
+  name: import_zod59.z.string(),
   trigger: triggerSchema.optional(),
-  stopOnResponse: import_zod58.z.boolean().optional(),
-  actions: import_zod58.z.array(actionSchema).max(40)
+  stopOnResponse: import_zod59.z.boolean().optional(),
+  actions: import_zod59.z.array(actionSchema).max(40)
   // house rule: <=40 actions/workflow
 });
 var HANDOFF_OWNER_LEGACY = {
@@ -17488,35 +17830,35 @@ var HANDOFF_OWNER_LEGACY = {
   "JERRY-EXT": "OPERATOR-EXT",
   "SASHA": "TEAM"
 };
-var handoffSchema = import_zod58.z.object({
+var handoffSchema = import_zod59.z.object({
   ref: nsRef("handoff"),
-  owner: import_zod58.z.enum(["OPERATOR-UI", "OPERATOR-EXT", "TEAM", "JERRY-UI", "JERRY-EXT", "SASHA"]).transform((o) => HANDOFF_OWNER_LEGACY[o] ?? o),
-  title: import_zod58.z.string(),
-  trigger: import_zod58.z.string().optional(),
-  instruction: import_zod58.z.string(),
+  owner: import_zod59.z.enum(["OPERATOR-UI", "OPERATOR-EXT", "TEAM", "JERRY-UI", "JERRY-EXT", "SASHA"]).transform((o) => HANDOFF_OWNER_LEGACY[o] ?? o),
+  title: import_zod59.z.string(),
+  trigger: import_zod59.z.string().optional(),
+  instruction: import_zod59.z.string(),
   produces: refSchema.nullable().optional(),
-  successCheck: import_zod58.z.string(),
-  blocks: import_zod58.z.array(import_zod58.z.string()).optional()
+  successCheck: import_zod59.z.string(),
+  blocks: import_zod59.z.array(import_zod59.z.string()).optional()
 });
-var buildPlanSchema = import_zod58.z.object({
-  schemaVersion: import_zod58.z.string(),
-  planId: import_zod58.z.string(),
-  briefId: import_zod58.z.string(),
-  preset: import_zod58.z.string(),
-  summary: import_zod58.z.string().optional(),
-  pipelines: import_zod58.z.array(pipelineSchema).optional(),
-  customFields: import_zod58.z.array(customFieldSchema).optional(),
-  tags: import_zod58.z.array(tagSchema).optional(),
-  customValues: import_zod58.z.array(customValueSchema).optional(),
-  calendars: import_zod58.z.array(calendarSchema).optional(),
-  forms: import_zod58.z.array(formSchema).optional(),
-  funnels: import_zod58.z.array(funnelSchema).optional(),
-  emails: import_zod58.z.array(emailAssetSchema).optional(),
-  sms: import_zod58.z.array(smsAssetSchema).optional(),
-  workflows: import_zod58.z.array(workflowSchema).optional(),
-  handoffs: import_zod58.z.array(handoffSchema).optional(),
-  buildOrder: import_zod58.z.array(import_zod58.z.string()).optional(),
-  idMap: import_zod58.z.record(import_zod58.z.string()).optional()
+var buildPlanSchema = import_zod59.z.object({
+  schemaVersion: import_zod59.z.string(),
+  planId: import_zod59.z.string(),
+  briefId: import_zod59.z.string(),
+  preset: import_zod59.z.string(),
+  summary: import_zod59.z.string().optional(),
+  pipelines: import_zod59.z.array(pipelineSchema).optional(),
+  customFields: import_zod59.z.array(customFieldSchema).optional(),
+  tags: import_zod59.z.array(tagSchema).optional(),
+  customValues: import_zod59.z.array(customValueSchema).optional(),
+  calendars: import_zod59.z.array(calendarSchema).optional(),
+  forms: import_zod59.z.array(formSchema).optional(),
+  funnels: import_zod59.z.array(funnelSchema).optional(),
+  emails: import_zod59.z.array(emailAssetSchema).optional(),
+  sms: import_zod59.z.array(smsAssetSchema).optional(),
+  workflows: import_zod59.z.array(workflowSchema).optional(),
+  handoffs: import_zod59.z.array(handoffSchema).optional(),
+  buildOrder: import_zod59.z.array(import_zod59.z.string()).optional(),
+  idMap: import_zod59.z.record(import_zod59.z.string()).optional()
 }).strict();
 function collectDefinedRefs(plan) {
   const refs = /* @__PURE__ */ new Map();
@@ -19186,16 +19528,16 @@ function msg(e) {
 }
 
 // src/tools/intake-to-build.ts
-var customFieldItemSchema = import_zod59.z.object({
-  id: import_zod59.z.string(),
-  name: import_zod59.z.string(),
-  fieldKey: import_zod59.z.string(),
-  dataType: import_zod59.z.string(),
-  model: import_zod59.z.string().optional(),
-  parentId: import_zod59.z.string().optional(),
-  position: import_zod59.z.number().optional(),
-  dateAdded: import_zod59.z.string().optional(),
-  picklistOptions: import_zod59.z.array(import_zod59.z.string()).optional()
+var customFieldItemSchema = import_zod60.z.object({
+  id: import_zod60.z.string(),
+  name: import_zod60.z.string(),
+  fieldKey: import_zod60.z.string(),
+  dataType: import_zod60.z.string(),
+  model: import_zod60.z.string().optional(),
+  parentId: import_zod60.z.string().optional(),
+  position: import_zod60.z.number().optional(),
+  dateAdded: import_zod60.z.string().optional(),
+  picklistOptions: import_zod60.z.array(import_zod60.z.string()).optional()
 }).passthrough();
 function parseCustomFields(raw) {
   const obj = raw && typeof raw === "object" ? raw : {};
@@ -19604,7 +19946,7 @@ function registerIntakeToBuildTools(server2, client, builderClient) {
     "validate_brief",
     "Validate an Intake-to-Build Brief object against the \xA74 schema. Returns {valid, errors}. Use to check a normalized brief before handing it to the plan-generation skill.",
     {
-      brief: import_zod59.z.record(import_zod59.z.unknown()).describe("The Brief object to validate.")
+      brief: import_zod60.z.record(import_zod60.z.unknown()).describe("The Brief object to validate.")
     },
     async ({ brief }) => validateBrief(brief)
   );
@@ -19613,7 +19955,7 @@ function registerIntakeToBuildTools(server2, client, builderClient) {
     "validate_build_plan",
     "Validate an Intake-to-Build Build Plan against the \xA75 schema AND check ref-integrity: every symbolic ref (pipeline.*, stage.*, tag.*, ...) must resolve to a defined object of the right type, and refs must be unique. Dead references are reported as errors here, before any build runs \u2014 the structural guard against 'an invalid ID silently kills downstream actions'. Returns {valid, errors, warnings, referencesScanned}.",
     {
-      plan: import_zod59.z.record(import_zod59.z.unknown()).describe("The Build Plan object to validate.")
+      plan: import_zod60.z.record(import_zod60.z.unknown()).describe("The Build Plan object to validate.")
     },
     async ({ plan }) => validateBuildPlan(plan)
   );
@@ -19621,12 +19963,12 @@ function registerIntakeToBuildTools(server2, client, builderClient) {
     "apply_build_plan",
     `Take an APPROVED Blueprint \xA75 build plan + the CURRENT confirmed sub-account and build it. mode:"dry_run" (default) writes NOTHING \u2014 it resolves refs, expands each workflow's logical actions to native GHL JSON, runs the NEVER-CLOBBER existing-asset scan, and returns a two-part report. Run it FIRST. mode:"execute" performs LIVE writes for the CRM backbone (pipelines+stages, custom fields, tags, custom values), calendars, AND forms: never clobbers (same-named objects are bound to their existing id, never modified), verifies each create by read-back before resolving its ref, halts on the first failure returning the partial idMap, and is idempotent (re-run = no-op). Staff-requiring calendars (round_robin etc.) auto-build only when you are the sole account user (auto-assigns you as the team member); with 0 or 2+ users they're surfaced as a manual step, not auto-staffed to a guess. Forms build with their standard + custom fields (custom fieldRefs resolve to the real fields created earlier in the run). Funnels: a GHL funnel (target:"ghl", default) builds structurally (funnel + named steps; page content/HTML is a manual step \u2014 plans carry outlines); a funnel with target:"external" is NOT built or deployed here \u2014 the user builds + hosts the site themselves (Cloudflare/Vercel) and wires its form back to this GHL sub-account (surfaced as a manual wiring step). Workflows build as DRAFT with all their logical actions expanded to native GHL JSON (incl. opportunity create/move steps, re-enabled v3.41.0) and chained; a contact_tag trigger is built automatically, other trigger types are surfaced as a manual step; the operator reviews + publishes. Always confirms the active location and validates the plan before any write.`,
     {
-      plan: import_zod59.z.record(import_zod59.z.unknown()).describe("The approved \xA75 Build Plan object."),
-      mode: import_zod59.z.enum(["dry_run", "execute"]).optional().describe("dry_run (default) = resolve/expand/scan/report, no writes. execute = live writes (not yet enabled)."),
-      locationId: import_zod59.z.string().optional().describe("Target sub-account. MUST match the active location; if it differs the tool refuses (confirm/switch first)."),
-      metHandoffs: import_zod59.z.array(import_zod59.z.string()).optional().describe('Handoff refs the operator has already satisfied (e.g. ["handoff.a2p"]) \u2014 lifts their gate so dependent workflows are not held DRAFT.'),
-      publishWorkflows: import_zod59.z.boolean().optional().describe("If true, ungated workflows would be published instead of left DRAFT. Default false (DRAFT)."),
-      onConflict: import_zod59.z.enum(["skip", "abort"]).optional().describe("skip (default) = bind same-named existing objects and continue. abort = report conflicts as a halt.")
+      plan: import_zod60.z.record(import_zod60.z.unknown()).describe("The approved \xA75 Build Plan object."),
+      mode: import_zod60.z.enum(["dry_run", "execute"]).optional().describe("dry_run (default) = resolve/expand/scan/report, no writes. execute = live writes (not yet enabled)."),
+      locationId: import_zod60.z.string().optional().describe("Target sub-account. MUST match the active location; if it differs the tool refuses (confirm/switch first)."),
+      metHandoffs: import_zod60.z.array(import_zod60.z.string()).optional().describe('Handoff refs the operator has already satisfied (e.g. ["handoff.a2p"]) \u2014 lifts their gate so dependent workflows are not held DRAFT.'),
+      publishWorkflows: import_zod60.z.boolean().optional().describe("If true, ungated workflows would be published instead of left DRAFT. Default false (DRAFT)."),
+      onConflict: import_zod60.z.enum(["skip", "abort"]).optional().describe("skip (default) = bind same-named existing objects and continue. abort = report conflicts as a halt.")
     },
     async ({ plan, mode, locationId: locationId2, metHandoffs, publishWorkflows, onConflict }) => {
       try {
@@ -19829,9 +20171,9 @@ function registerIntakeToBuildTools(server2, client, builderClient) {
     "install_intake_form",
     "Install the canonical Intake-to-Build client-intake form into the CURRENT GHL location (whatever get_current_location returns). Account-agnostic, zero hardcoded IDs. Creates any missing intake custom fields (idempotent \u2014 reused on re-run), then builds the form with the proven GHL form-builder field shapes and verifies it. Returns {formId, fieldMap} \u2014 keep fieldMap; normalize_submission_to_brief uses it. Pass dryRun:true to preview what would be created without writing. Pass formId to update an existing intake form in place instead of creating a new one.",
     {
-      dryRun: import_zod59.z.boolean().optional().describe("Preview the fields/form that would be created without writing anything."),
-      formId: import_zod59.z.string().optional().describe("Update this existing form in place instead of creating a new one."),
-      formName: import_zod59.z.string().optional().describe(`Form name. Defaults to "${INTAKE_FORM_NAME}".`)
+      dryRun: import_zod60.z.boolean().optional().describe("Preview the fields/form that would be created without writing anything."),
+      formId: import_zod60.z.string().optional().describe("Update this existing form in place instead of creating a new one."),
+      formName: import_zod60.z.string().optional().describe(`Form name. Defaults to "${INTAKE_FORM_NAME}".`)
     },
     async ({ dryRun, formId, formName }) => {
       try {
@@ -19919,10 +20261,10 @@ function registerIntakeToBuildTools(server2, client, builderClient) {
     "normalize_submission_to_brief",
     'Read an intake form submission and normalize it into a \xA74 Brief (briefSource:"intake_form"). Pass the formId; by default the most recent submission is used (or pass submissionId). The intakeKey->customFieldId map is taken from fieldMap if provided (the install_intake_form output, most robust), otherwise reconstructed from the live form. Returns {brief, validation, submissionId} \u2014 validation flags any missing required fields (e.g. an incomplete submission).',
     {
-      formId: import_zod59.z.string().describe("The intake form ID (from install_intake_form)."),
-      submissionId: import_zod59.z.string().optional().describe("Specific submission to normalize. Defaults to the most recent."),
-      fieldMap: import_zod59.z.record(import_zod59.z.string()).optional().describe("intakeKey -> customFieldId map from install_intake_form. Reconstructed from the form if omitted."),
-      preset: import_zod59.z.string().optional().describe("Override the preset. Defaults to one derived from business_type.")
+      formId: import_zod60.z.string().describe("The intake form ID (from install_intake_form)."),
+      submissionId: import_zod60.z.string().optional().describe("Specific submission to normalize. Defaults to the most recent."),
+      fieldMap: import_zod60.z.record(import_zod60.z.string()).optional().describe("intakeKey -> customFieldId map from install_intake_form. Reconstructed from the form if omitted."),
+      preset: import_zod60.z.string().optional().describe("Override the preset. Defaults to one derived from business_type.")
     },
     async ({ formId, submissionId, fieldMap, preset }) => {
       try {
@@ -19951,7 +20293,7 @@ function registerIntakeToBuildTools(server2, client, builderClient) {
           const formFull = await formApiRequest(bc, "GET", `/${formId}?locationId=${locationId2}`);
           resolvedMap = buildFieldMapFromFormFields(extractFormFields(formFull));
         }
-        const presetSchema2 = import_zod59.z.enum(["generic", "med_spa", "clinic_launch_a2p", "coach", "ecom", "agency"]).optional();
+        const presetSchema2 = import_zod60.z.enum(["generic", "med_spa", "clinic_launch_a2p", "coach", "ecom", "agency"]).optional();
         const presetParsed = presetSchema2.safeParse(preset);
         const brief = normalizeSubmissionToBrief({
           others,
@@ -20033,6 +20375,7 @@ var FORM_BUILDER_MODULE = "form-builder";
 var INTAKE_TO_BUILD_MODULE = "intake-to-build";
 var FUNNEL_QA_MODULE = "funnel-qa";
 var USER_GUIDE_MODULE = "user-guide";
+var CHECKUP_MODULE = "checkup";
 var KNOWN_MODULES = /* @__PURE__ */ new Set([
   ...publicApiTools.map(([, label]) => label),
   ...internalApiTools.map(([, label]) => label),
@@ -20040,6 +20383,7 @@ var KNOWN_MODULES = /* @__PURE__ */ new Set([
   INTAKE_TO_BUILD_MODULE,
   FUNNEL_QA_MODULE,
   USER_GUIDE_MODULE,
+  CHECKUP_MODULE,
   VALIDATORS_MODULE,
   DIAGNOSTICS_MODULE,
   LOCATION_SWITCHER_MODULE,
@@ -20072,6 +20416,14 @@ function registerAllTools(server2, client, registry2, mcpVersion, env = process.
     registry2 ?? null,
     () => buildGatingReport(config3, KNOWN_MODULES, attemptedTools, registeredTools, outOfBand)
   );
+  registerCheckupTools(
+    wrap(CHECKUP_MODULE),
+    mcpVersion ?? "unknown",
+    client,
+    builderClient,
+    registry2 ?? null,
+    () => buildGatingReport(config3, KNOWN_MODULES, attemptedTools, registeredTools, outOfBand)
+  );
   registerSnapshotTools(wrap(SNAPSHOTS_MODULE), client, registry2);
   registerAccountExportTools(wrap(ACCOUNT_EXPORT_MODULE), client, registry2, builderClient);
   registerLocationSwitcherTools(
@@ -20129,7 +20481,7 @@ init_credentials_store();
 init_setup_tool();
 
 // src/tools/skills.ts
-var import_zod60 = require("zod");
+var import_zod61 = require("zod");
 
 // src/skill-installer.ts
 var import_node_crypto2 = require("node:crypto");
@@ -20249,7 +20601,7 @@ function registerSkillsTool(server2, packageVersion, baseDir) {
     "install_skills",
     "Install (or repair) the guided skills bundled with GHL Command \u2014 Blueprint (build a whole client account from one intake), Clone Site (clone and rebrand a live web page for a client, with a rights declaration and a pre-launch liability report), and GHL Reports (verified counts, lists, and weekly reports without token burn) \u2014 into your ~/.claude/skills/ so Claude can use them. Runs automatically on startup; call this to verify what is installed, or to re-install after deleting a skill. NEVER overwrites files you have edited (your version is kept and reported). Restart Claude after install for new skills to load.",
     {
-      targetDir: import_zod60.z.string().optional().describe("Override the install directory. Default: ~/.claude/skills")
+      targetDir: import_zod61.z.string().optional().describe("Override the install directory. Default: ~/.claude/skills")
     },
     async ({ targetDir }) => {
       try {