@elitedcs/ghl-mcp 3.83.3 → 3.83.4

package/CHANGELOG.md

@@ -2,6 +2,32 @@
 
 ## Unreleased
 
+## 3.83.4 — one door for every write, so "protected" cannot quietly stop meaning protected
+
+3.83.3 fixed the holes. This closes the shape that kept making them.
+
+Marking a client account protected is checked in one place for the public API. But
+this product also writes to GoHighLevel through its own builder connection, and
+eleven tool modules had each grown their own copy of that request — their own
+headers, their own timeout, their own fetch. Every copy was a separate door into
+your account, and a check added to one of them told you nothing about the other
+ten. That is why the last release had to find fourteen of them.
+
+They now share one door. It builds the headers, applies the thirty-second timeout
+and runs the protected-account check once, for all of them. A tool written next
+year gets the check without its author having to remember, and a test refuses any
+new code that tries to go around it.
+
+Nothing about what the tools do has changed. The same requests go to the same
+places with the same bodies and the same headers, including the two different
+builder origins GoHighLevel requires for page saves and for everything else. If
+you cannot tell the difference from the outside, that is the intended result.
+
+Also in this release: `update_form` now tells you what a field needs in order to
+RENDER rather than only how to send one. A custom question needs the real custom
+field's id, key and data type from your account; a field written without them is
+stored and shows as raw data instead of a rendered field.
+
 ## 3.83.3 — an account you marked protected is now actually protected
 
 **Marking a client account protected did not stop fourteen write paths from writing to it.**

package/README.md

@@ -897,7 +897,7 @@ Built by **[Elite DCs, LLC](https://elitedcs.com)** — a digital marketing and
 
 **Tech stack:** TypeScript, Node.js, esbuild, MCP SDK, Zod, GHL API v2, Firebase Auth
 
-**Version:** 3.83.3
+**Version:** 3.83.4
 
 ---
 

package/dist/index.js

@@ -1922,6 +1922,25 @@ function validateActionChain(actions, existingIds) {
     }
   }
 }
+async function builderRequest(client, method, url, opts = {}) {
+  assertWriteAllowed(method, url, { body: opts.body, defaultLocationId: client.locationId });
+  const headers = { ...await client.buildHeaders(), ...opts.headers ?? {} };
+  const init = { method, headers };
+  if (opts.body !== void 0) init.body = JSON.stringify(opts.body);
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 3e4);
+  init.signal = controller.signal;
+  try {
+    return await fetch(url, init);
+  } catch (error) {
+    if (error instanceof Error && error.name === "AbortError") {
+      throw new Error(`Request timeout (30s): ${method} ${url}`);
+    }
+    throw error;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
 var fs4, path4, dotenv, import_zod4, BACKEND_BASE, FIREBASE_TOKEN_URL, MAX_RETRIES2, BASE_DELAY_MS2, FirebaseTokenSchema, WorkflowActionSchema, WorkflowFullSchema, CreateWorkflowResponseSchema, ParkedContactsError, UUID_V4, WorkflowBuilderClient;
 var init_workflow_builder_client = __esm({
   "src/workflow-builder-client.ts"() {
@@ -7435,14 +7454,8 @@ function registerEmailTools(server2, client) {
 function registerEmailBuilderInternalTools(server2, builderClient, publicClient) {
   if (!builderClient) return;
   const client = builderClient;
-  async function builderRequest(method, path39, body) {
-    const headers = await client.buildHeaders();
-    assertWriteAllowed(method, `${EMAIL_BUILDER_BASE}${path39}`, { defaultLocationId: client.locationId });
-    const response = await fetch(`${EMAIL_BUILDER_BASE}${path39}`, {
-      method,
-      headers,
-      body: body ? JSON.stringify(body) : void 0
-    });
+  async function builderRequest2(method, path39, body) {
+    const response = await builderRequest(client, method, `${EMAIL_BUILDER_BASE}${path39}`, body ? { body } : {});
     if (!response.ok) {
       const text2 = await response.text();
       throw new Error(`Email Builder API Error ${response.status}: ${method} /emails/builder${path39}
@@ -7464,7 +7477,7 @@ ${text2}`);
       const loc = locationId2 ?? client.locationId;
       return deleteEmailTemplateThroughDoors({
         publicDelete: () => publicClient.delete(publicEmailTemplateDeletePath(loc, templateId)),
-        internalDelete: () => builderRequest("DELETE", internalEmailTemplateDeletePath(templateId, loc))
+        internalDelete: () => builderRequest2("DELETE", internalEmailTemplateDeletePath(templateId, loc))
       });
     }
   );
@@ -7479,7 +7492,7 @@ ${text2}`);
     },
     async ({ templateId, name, locationId: locationId2 }) => {
       const loc = locationId2 ?? client.locationId;
-      return builderRequest("PATCH", `/${templateId}`, { locationId: loc, name });
+      return builderRequest2("PATCH", `/${templateId}`, { locationId: loc, name });
     }
   );
   safeTool(
@@ -7493,7 +7506,7 @@ ${text2}`);
     },
     async ({ templateId, archived, locationId: locationId2 }) => {
       const loc = locationId2 ?? client.locationId;
-      return builderRequest("PATCH", `/${templateId}`, { locationId: loc, archived: archived ?? true });
+      return builderRequest2("PATCH", `/${templateId}`, { locationId: loc, archived: archived ?? true });
     }
   );
   safeTool(
@@ -7508,11 +7521,8 @@ ${text2}`);
     },
     async ({ name, body, type, locationId: locationId2 }) => {
       const loc = locationId2 ?? client.locationId;
-      const headers = await client.buildHeaders();
-      const response = await fetch(`${SNIPPETS_BASE}/${loc}`, {
-        method: "POST",
-        headers,
-        body: JSON.stringify(buildSnippetPayload({ name, body, type }))
+      const response = await builderRequest(client, "POST", `${SNIPPETS_BASE}/${loc}`, {
+        body: buildSnippetPayload({ name, body, type })
       });
       if (!response.ok) {
         const text2 = await response.text();
@@ -7542,8 +7552,8 @@ var init_emails = __esm({
     init_account_read_retry();
     init_account_reads();
     import_zod28 = require("zod");
+    init_workflow_builder_client();
     init_tool_helpers();
-    init_account_rules();
     EMAIL_BUILDER_BASE = "https://backend.leadconnectorhq.com/emails/builder";
     SNIPPETS_BASE = "https://services.leadconnectorhq.com/snippets";
     TEMPLATE_TYPES = ["html", "folder", "import", "builder", "blank", "ai_template", "vibe-editor"];
@@ -11238,15 +11248,17 @@ function registerFunnelBuilderTools(server2, builderClient) {
     return client.request("DELETE", path39);
   }
   async function funnelRequest(method, path39, body) {
-    const headers = await client.buildHeaders();
-    headers.Origin = "https://app.gohighlevel.com";
-    headers.Referer = "https://app.gohighlevel.com/";
     const url = `https://backend.leadconnectorhq.com/funnels${path39}`;
-    const options = { method, headers };
-    if (body && (method === "POST" || method === "PUT")) {
-      options.body = JSON.stringify(body);
-    }
-    const response = await fetch(url, options);
+    const sendsBody = body !== void 0 && (method === "POST" || method === "PUT");
+    const response = await builderRequest(client, method, url, {
+      ...sendsBody ? { body } : {},
+      headers: {
+        // Internal-API calls require the app origin (autosave needs the
+        // page-builder one instead; see the autosave call).
+        Origin: "https://app.gohighlevel.com",
+        Referer: "https://app.gohighlevel.com/"
+      }
+    });
     if (!response.ok) {
       const text2 = await response.text();
       throw new Error(`Funnel API Error ${response.status}: ${method} ${path39}
@@ -11508,12 +11520,17 @@ ${text2}`);
     };
   }
   async function autosaveRequest(pageId, body) {
-    const headers = await client.buildHeaders();
-    headers.Origin = "https://page-builder.leadconnectorhq.com";
-    headers.Referer = "https://page-builder.leadconnectorhq.com/";
     const url = `https://backend.leadconnectorhq.com/funnels/builder/autosave/${pageId}`;
-    assertWriteAllowed("POST", url, { defaultLocationId: client.locationId });
-    const response = await fetch(url, { method: "POST", headers, body: JSON.stringify(body) });
+    const response = await builderRequest(client, "POST", url, {
+      body,
+      headers: {
+        // The autosave endpoint's IAM check requires the builder origin (verified
+        // live — app.gohighlevel.com was not tested and page-builder is what the
+        // real builder sends).
+        Origin: "https://page-builder.leadconnectorhq.com",
+        Referer: "https://page-builder.leadconnectorhq.com/"
+      }
+    });
     if (!response.ok) {
       throw new Error(`Funnel API Error ${response.status}: POST /builder/autosave/${pageId}
 ${await response.text()}`);
@@ -11619,9 +11636,9 @@ var init_funnel_builder = __esm({
   "src/tools/funnel-builder.ts"() {
     "use strict";
     import_zod41 = require("zod");
+    init_workflow_builder_client();
     init_tool_helpers();
     init_page_reads();
-    init_account_rules();
   }
 });
 
@@ -16477,10 +16494,15 @@ function registerPageStudioTools(server2, builderClient) {
     return { map: out, truncated };
   }
   async function funnelRequest(method, path39, body) {
-    const headers = await client.buildHeaders();
-    headers.Origin = "https://app.gohighlevel.com";
-    headers.Referer = "https://app.gohighlevel.com/";
-    const response = await fetch(`https://backend.leadconnectorhq.com/funnels${path39}`, { method, headers, ...body && { body: JSON.stringify(body) } });
+    const response = await builderRequest(client, method, `https://backend.leadconnectorhq.com/funnels${path39}`, {
+      ...body ? { body } : {},
+      headers: {
+        // Internal-API calls require the app origin (autosave needs the
+        // page-builder one instead; see the autosave call).
+        Origin: "https://app.gohighlevel.com",
+        Referer: "https://app.gohighlevel.com/"
+      }
+    });
     if (!response.ok) throw new Error(`Funnel API Error ${response.status}: ${method} ${path39}
 ${await response.text()}`);
     const text = await response.text();
@@ -16497,15 +16519,13 @@ ${await response.text()}`);
     }
   }
   async function autosaveRequest(pageId, body) {
-    const headers = await client.buildHeaders();
-    headers.Origin = "https://page-builder.leadconnectorhq.com";
-    headers.Referer = "https://page-builder.leadconnectorhq.com/";
     const autosaveUrl = `https://backend.leadconnectorhq.com/funnels/builder/autosave/${pageId}`;
-    assertWriteAllowed("POST", autosaveUrl, { defaultLocationId: client.locationId });
-    const response = await fetch(autosaveUrl, {
-      method: "POST",
-      headers,
-      body: JSON.stringify(body)
+    const response = await builderRequest(client, "POST", autosaveUrl, {
+      body,
+      headers: {
+        Origin: "https://page-builder.leadconnectorhq.com",
+        Referer: "https://page-builder.leadconnectorhq.com/"
+      }
     });
     if (!response.ok) throw new Error(`Funnel API Error ${response.status}: POST /builder/autosave/${pageId}
 ${await response.text()}`);
@@ -16991,6 +17011,7 @@ var init_page_studio = __esm({
     "use strict";
     import_zod43 = require("zod");
     crypto4 = __toESM(require("node:crypto"));
+    init_workflow_builder_client();
     init_ghl_templates();
     init_retheme();
     init_ghl_page();
@@ -16999,7 +17020,6 @@ var init_page_studio = __esm({
     init_tool_helpers();
     init_compose();
     init_website();
-    init_account_rules();
     valueCardSchema = import_zod43.z.object({
       title: import_zod43.z.string().describe("Card title (short, uppercase reads best)."),
       bodyHtml: import_zod43.z.string().describe("Card body as HTML (<p>\u2026</p>). May use {{location.*}} merge fields."),
@@ -17088,14 +17108,9 @@ function cleanFormDataForSave(formData) {
   return isJsonObject(cleaned) ? cleaned : formData;
 }
 async function formApiRequest(client, method, path39, body) {
-  const headers = await client.buildHeaders();
   const url = `https://backend.leadconnectorhq.com/forms${path39}`;
-  assertWriteAllowed(method, url, { defaultLocationId: client.locationId });
-  const options = { method, headers };
-  if (body && (method === "POST" || method === "PUT")) {
-    options.body = JSON.stringify(body);
-  }
-  const response = await fetch(url, options);
+  const sendsBody = body !== void 0 && (method === "POST" || method === "PUT");
+  const response = await builderRequest(client, method, url, sendsBody ? { body } : {});
   if (!response.ok) {
     const text2 = await response.text();
     throw new Error(`Form API Error ${response.status}: ${method} ${path39}
@@ -17162,10 +17177,10 @@ function registerFormBuilderTools(server2, builderClient, publicClient) {
   );
   server2.tool(
     "update_form",
-    "Update a form's structure \u2014 fields, labels, conditional logic, auto-responder, email notifications, styling. Use get_form_full first to read the current form, modify the formData object, then pass it here. If name is omitted, the current name is preserved (one extra GET).",
+    "Update a form's structure \u2014 fields, labels, conditional logic, auto-responder, email notifications, styling. Use get_form_full first to read the current form, modify the formData object, then pass it here. If name is omitted, the current name is preserved (one extra GET). IMPORTANT \u2014 a NEW field will not render in GoHighLevel's form editor unless it carries the binding GHL needs: a custom-question field must include the real custom field's `id`, `fieldKey` and `dataType` from THIS account (read them with get_custom_fields first; do not invent them), and a standard field (first_name, last_name, email, phone) needs `standard: true` with its `tag`. A field written without that binding is stored but shows as raw data instead of a rendered field. These shapes were reverse-engineered from live UI-built forms; copy an existing field from get_form_full rather than composing one from memory.",
     {
       formId: import_zod44.z.string().describe("The form ID to update."),
-      formData: import_zod44.z.record(import_zod44.z.string(), import_zod44.z.unknown()).describe("The updated formData object containing form fields, settings, autoResponder config, etc."),
+      formData: import_zod44.z.record(import_zod44.z.string(), import_zod44.z.unknown()).describe("The updated formData object containing form fields, settings, autoResponder config, etc. Fields live at formData.form.fields; each one needs the binding described above or the editor cannot render it."),
       name: import_zod44.z.string().optional().describe("Updated form name. If omitted, the current name is preserved.")
     },
     async ({ formId, formData, name }) => {
@@ -17292,8 +17307,8 @@ var init_form_builder = __esm({
   "src/tools/form-builder.ts"() {
     "use strict";
     import_zod44 = require("zod");
+    init_workflow_builder_client();
     init_tool_helpers();
-    init_account_rules();
   }
 });
 
@@ -17686,14 +17701,9 @@ function registerPipelineBuilderTools(server2, builderClient) {
   if (!builderClient) return;
   const client = builderClient;
   async function pipelineRequest(method, path39, body) {
-    const headers = await client.buildHeaders();
     const url = `https://backend.leadconnectorhq.com/opportunities/pipelines${path39}`;
-    assertWriteAllowed(method, url, { defaultLocationId: client.locationId });
-    const options = { method, headers };
-    if (body && (method === "POST" || method === "PUT" || method === "PATCH")) {
-      options.body = JSON.stringify(body);
-    }
-    const response = await fetch(url, options);
+    const sendsBody = body !== void 0 && (method === "POST" || method === "PUT" || method === "PATCH");
+    const response = await builderRequest(client, method, url, sendsBody ? { body } : {});
     if (!response.ok) {
       const text2 = await response.text();
       throw new Error(`Pipeline API Error ${response.status}: ${method} ${path39}
@@ -17871,7 +17881,7 @@ var init_pipeline_builder = __esm({
   "src/tools/pipeline-builder.ts"() {
     "use strict";
     import_zod46 = require("zod");
-    init_account_rules();
+    init_workflow_builder_client();
   }
 });
 
@@ -28581,7 +28591,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@elitedcs/ghl-mcp",
-      version: "3.83.3",
+      version: "3.83.4",
       mcpName: "io.github.drjerryrelth/ghl-command",
       description: "GoHighLevel MCP Server for Claude. 250 tools \u2014 full CRM, automation, marketing control, account-wide workflow audit, live funnel-capture verification, and the only programmatic GHL workflow builder, now multi-tenant across client accounts.",
       main: "dist/index.js",
@@ -39216,14 +39226,9 @@ function registerSmartListTools(server2, builderClient) {
   if (!builderClient) return;
   const client = builderClient;
   async function smartListRequest(method, path39, body) {
-    const headers = await client.buildHeaders();
     const url = `${SMARTLIST_BASE}${path39}`;
-    assertWriteAllowed(method, url, { defaultLocationId: client.locationId });
-    const options = { method, headers };
-    if (body && (method === "POST" || method === "PUT")) {
-      options.body = JSON.stringify(body);
-    }
-    const response = await fetch(url, options);
+    const sendsBody = body !== void 0 && (method === "POST" || method === "PUT");
+    const response = await builderRequest(client, method, url, sendsBody ? { body } : {});
     if (!response.ok) {
       const text2 = await response.text();
       throw new Error(`Smart Lists API Error ${response.status}: ${method} ${path39}
@@ -39288,8 +39293,7 @@ ${await res.text()}`);
         ];
         const body = buildContactSmartListBody({ listName: name, locationId: loc, filters });
         const headers = await client.buildHeaders();
-        assertWriteAllowed("POST", CONTACT_SMARTLIST_BASE, { defaultLocationId: client.locationId });
-        const res = await fetch(CONTACT_SMARTLIST_BASE, { method: "POST", headers, body: JSON.stringify(body) });
+        const res = await builderRequest(client, "POST", CONTACT_SMARTLIST_BASE, { body });
         if (!res.ok) throw new Error(`Smart Lists API Error ${res.status}: POST /contacts/smartlist
 ${await res.text()}`);
         return jsonResponse(JSON.parse(await res.text() || "{}"));
@@ -39326,12 +39330,7 @@ ${await res.text()}`);
     async ({ listId }) => {
       try {
         const headers = await client.buildHeaders();
-        assertWriteAllowed("POST", CONTACT_SMARTLIST_DELETE, { defaultLocationId: client.locationId });
-        const res = await fetch(CONTACT_SMARTLIST_DELETE, {
-          method: "POST",
-          headers,
-          body: JSON.stringify({ smartlist_id: listId })
-        });
+        const res = await builderRequest(client, "POST", CONTACT_SMARTLIST_DELETE, { body: { smartlist_id: listId } });
         if (!res.ok) throw new Error(`Smart Lists API Error ${res.status}: POST /smartlist/delete
 ${await res.text()}`);
         return jsonResponse(JSON.parse(await res.text() || "{}"));
@@ -39439,8 +39438,8 @@ var init_smart_lists = __esm({
   "src/tools/smart-lists.ts"() {
     "use strict";
     import_zod57 = require("zod");
+    init_workflow_builder_client();
     init_tool_helpers();
-    init_account_rules();
     SMARTLIST_BASE = "https://backend.leadconnectorhq.com/lists/dynamic";
     OBJECT_KEYS = ["contacts", "opportunity"];
     CONTACT_SMARTLIST_BASE = "https://services.leadconnectorhq.com/contacts/smartlist";
@@ -39462,9 +39461,7 @@ function registerReputationTools(server2, builderClient) {
   if (!builderClient) return;
   const client = builderClient;
   async function reputationRequest(method, path39) {
-    assertWriteAllowed(method, `${REPUTATION_BASE}${path39}`, { defaultLocationId: client.locationId });
-    const headers = await client.buildHeaders();
-    const response = await fetch(`${REPUTATION_BASE}${path39}`, { method, headers });
+    const response = await builderRequest(client, method, `${REPUTATION_BASE}${path39}`);
     if (!response.ok) {
       const text2 = await response.text();
       throw new Error(`Reputation API Error ${response.status}: ${method} ${path39}
@@ -39540,8 +39537,8 @@ var init_reputation = __esm({
   "src/tools/reputation.ts"() {
     "use strict";
     import_zod58 = require("zod");
+    init_workflow_builder_client();
     init_tool_helpers();
-    init_account_rules();
     REPUTATION_BASE = "https://backend.leadconnectorhq.com/reputation";
   }
 });
@@ -39575,13 +39572,7 @@ function registerEmailCampaignTools(server2, builderClient) {
       if (isPlainText !== void 0) body.isPlainText = isPlainText;
       if (enableResendToUnopened !== void 0) body.enableResendToUnopened = enableResendToUnopened;
       if (hasUtmTracking !== void 0) body.hasUtmTracking = hasUtmTracking;
-      const headers = await client.buildHeaders();
-      assertWriteAllowed("POST", `${SVC_BASE}/emails/schedule`, { defaultLocationId: client.locationId });
-      const response = await fetch(`${SVC_BASE}/emails/schedule`, {
-        method: "POST",
-        headers,
-        body: JSON.stringify(body)
-      });
+      const response = await builderRequest(client, "POST", `${SVC_BASE}/emails/schedule`, { body });
       if (!response.ok) {
         const text2 = await response.text();
         throw new Error(`Email Campaign API Error ${response.status}: POST /emails/schedule
@@ -39601,8 +39592,8 @@ var init_email_campaigns = __esm({
   "src/tools/email-campaigns.ts"() {
     "use strict";
     import_zod59 = require("zod");
+    init_workflow_builder_client();
     init_tool_helpers();
-    init_account_rules();
     SVC_BASE = "https://services.leadconnectorhq.com";
   }
 });
@@ -39612,13 +39603,7 @@ function registerMembershipTools(server2, builderClient) {
   if (!builderClient) return;
   const client = builderClient;
   async function membershipRequest(path39, method = "GET", body) {
-    assertWriteAllowed(method, `${MEMBERSHIP_BASE2}${path39}`, { defaultLocationId: client.locationId });
-    const headers = await client.buildHeaders();
-    const response = await fetch(`${MEMBERSHIP_BASE2}${path39}`, {
-      method,
-      headers,
-      body: body ? JSON.stringify(body) : void 0
-    });
+    const response = await builderRequest(client, method, `${MEMBERSHIP_BASE2}${path39}`, body ? { body } : {});
     if (!response.ok) {
       const text2 = await response.text();
       throw new Error(`Membership API Error ${response.status}: ${method} ${path39}
@@ -39799,8 +39784,8 @@ var init_memberships = __esm({
   "src/tools/memberships.ts"() {
     "use strict";
     import_zod60 = require("zod");
+    init_workflow_builder_client();
     init_tool_helpers();
-    init_account_rules();
     MEMBERSHIP_BASE2 = "https://backend.leadconnectorhq.com/membership";
   }
 });
@@ -40148,12 +40133,8 @@ Pipelines: ${template.pipelines.length} to create`);
               }
             } else {
               try {
-                const headers = await builderClient.buildHeaders();
-                assertWriteAllowed("POST", "https://backend.leadconnectorhq.com/opportunities/pipelines", { defaultLocationId: locId });
-                const res = await fetch("https://backend.leadconnectorhq.com/opportunities/pipelines", {
-                  method: "POST",
-                  headers,
-                  body: JSON.stringify({
+                const res = await builderRequest(builderClient, "POST", "https://backend.leadconnectorhq.com/opportunities/pipelines", {
+                  body: {
                     name: resolved2.name,
                     stages: (resolved2.stages || []).map((s) => ({
                       ...s,
@@ -40163,7 +40144,7 @@ Pipelines: ${template.pipelines.length} to create`);
                     locationId: locId,
                     showInFunnel: true,
                     showInPieChart: true
-                  })
+                  }
                 });
                 if (res.ok) {
                   counts.pipelines.created++;
@@ -40324,7 +40305,7 @@ var init_template_deployer = __esm({
     init_tool_helpers();
     fs28 = __toESM(require("fs"));
     path27 = __toESM(require("path"));
-    init_account_rules();
+    init_workflow_builder_client();
     TemplateSchema = import_zod61.z.object({
       templateName: import_zod61.z.string(),
       templateVersion: import_zod61.z.string().optional(),
@@ -50986,9 +50967,7 @@ function pickCalendarPins(workflow) {
 }
 function makeFirebaseRequest(builderClient) {
   return async (url, method, body) => {
-    assertWriteAllowed(method, url, { defaultLocationId: builderClient.locationId });
-    const headers = await builderClient.buildHeaders();
-    const response = await fetch(url, { method, headers, body: body ? JSON.stringify(body) : void 0 });
+    const response = await builderRequest(builderClient, method, url, body ? { body } : {});
     if (!response.ok) {
       const text2 = await response.text();
       throw new Error(`API ${response.status}: ${method} ${url.replace(/^https:\/\/[^/]+/, "")}
@@ -51000,11 +50979,9 @@ ${text2}`);
 }
 function makePipelineApi(builderClient) {
   return async (method, path39, body) => {
-    const headers = await builderClient.buildHeaders();
     const url = `https://backend.leadconnectorhq.com/opportunities/pipelines${path39}`;
-    const options = { method, headers };
-    if (body && (method === "POST" || method === "PUT")) options.body = JSON.stringify(body);
-    const response = await fetch(url, options);
+    const sendsBody = body !== void 0 && (method === "POST" || method === "PUT");
+    const response = await builderRequest(builderClient, method, url, sendsBody ? { body } : {});
     if (!response.ok) {
       const text2 = await response.text();
       throw new Error(`Pipeline API ${response.status}: ${method} ${path39}
@@ -51021,13 +50998,17 @@ ${text2}`);
 }
 function makeFunnelApi(builderClient) {
   return async (method, path39, body) => {
-    const headers = await builderClient.buildHeaders();
-    headers.Origin = "https://app.gohighlevel.com";
-    headers.Referer = "https://app.gohighlevel.com/";
     const url = `https://backend.leadconnectorhq.com/funnels${path39}`;
-    const options = { method, headers };
-    if (body && (method === "POST" || method === "PUT")) options.body = JSON.stringify(body);
-    const response = await fetch(url, options);
+    const sendsBody = body !== void 0 && (method === "POST" || method === "PUT");
+    const response = await builderRequest(builderClient, method, url, {
+      ...sendsBody ? { body } : {},
+      headers: {
+        // Origin/Referer REQUIRED on internal-API funnel writes (else 401
+        // "Error calling IAM service") — verified in funnel-builder.ts.
+        Origin: "https://app.gohighlevel.com",
+        Referer: "https://app.gohighlevel.com/"
+      }
+    });
     if (!response.ok) {
       const text2 = await response.text();
       throw new Error(`Funnel API ${response.status}: ${method} ${path39}
@@ -52138,6 +52119,7 @@ var init_intake_to_build = __esm({
     init_build_contract();
     init_build_obligations();
     import_zod80 = require("zod");
+    init_workflow_builder_client();
     init_tool_helpers();
     init_form_builder();
     init_calendars();
@@ -52160,7 +52142,6 @@ var init_intake_to_build = __esm({
     init_plan_from_preset();
     init_executor();
     init_execute();
-    init_account_rules();
     customFieldItemSchema = import_zod80.z.object({
       id: import_zod80.z.string(),
       name: import_zod80.z.string(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@elitedcs/ghl-mcp",
-  "version": "3.83.3",
+  "version": "3.83.4",
   "mcpName": "io.github.drjerryrelth/ghl-command",
   "description": "GoHighLevel MCP Server for Claude. 250 tools — full CRM, automation, marketing control, account-wide workflow audit, live funnel-capture verification, and the only programmatic GHL workflow builder, now multi-tenant across client accounts.",
   "main": "dist/index.js",