@elitedcs/ghl-mcp 3.83.3 → 3.83.5

package/CHANGELOG.md

@@ -2,6 +2,66 @@
 
 ## Unreleased
 
+## 3.83.5 — the brand page's buttons work, and a run tells you it is working
+
+If you use Design Studio, every button on a brand's own page has been dead since
+3.78.0. "Make it" did nothing but load a blank page. So did "Save changes", which
+means any accent, font, name or logo you edited there was thrown away without
+saying so. Nine days, five releases. One piece of broken punctuation in the page's
+script switched all of it off at once, and because a browser discards a script like
+that in silence, nothing on screen ever said so.
+
+Both are fixed, and a new check now reads every page the cockpit serves and refuses
+to ship one whose script will not run.
+
+A design run also used to tell you nothing at all while it worked. Claude writes the
+whole file in a single answer, so the log stayed empty for ten or twenty minutes,
+and there was no way to tell a working run from a dead one. The sensible thing to do
+was stop it, which was the wrong thing to do. The run now shows a clock, counts the
+passes, and says plainly that nothing will appear until a pass finishes.
+
+While reading what gets sent to Claude on those runs, we found the brief was asking
+for two tools that are deliberately switched off for them, and then telling Claude
+in the next line that it had no tools. It no longer does that.
+
+**A correction to 3.83.4.** That release said a form field written without its id,
+key and data type "is stored and shows as raw data instead of a rendered field."
+That is wrong, and we tested it after we shipped it rather than before. A field
+without those still renders normally in the form editor. What they actually do is
+tie the answer to the contact record, which is reason enough to set them, and
+`update_form` now says only that.
+
+## 3.83.4 — one door for every write, so "protected" cannot quietly stop meaning protected
+
+3.83.3 fixed the holes. This closes the shape that kept making them.
+
+Marking a client account protected is checked in one place for the public API. But
+this product also writes to GoHighLevel through its own builder connection, and
+eleven tool modules had each grown their own copy of that request — their own
+headers, their own timeout, their own fetch. Every copy was a separate door into
+your account, and a check added to one of them told you nothing about the other
+ten. That is why the last release had to find fourteen of them.
+
+They now share one door. It builds the headers, applies the thirty-second timeout
+and runs the protected-account check once, for all of them. A tool written next
+year gets the check without its author having to remember, and a test refuses any
+new code that tries to go around it.
+
+Nothing about what the tools do has changed. The same requests go to the same
+places with the same bodies and the same headers, including the two different
+builder origins GoHighLevel requires for page saves and for everything else. If
+you cannot tell the difference from the outside, that is the intended result.
+
+Also in this release: `update_form` now tells you what a field needs in order to
+RENDER rather than only how to send one. A custom question needs the real custom
+field's id, key and data type from your account; a field written without them is
+stored and shows as raw data instead of a rendered field.
+
+> **Corrected 2026-09-12, in 3.83.5.** The last sentence is wrong. It was tested
+> after this release shipped, not before: a field without those keys still renders
+> normally in the form editor. They tie the answer to the contact record. That is
+> what `update_form` says now.
+
 ## 3.83.3 — an account you marked protected is now actually protected
 
 **Marking a client account protected did not stop fourteen write paths from writing to it.**

package/README.md

@@ -897,7 +897,7 @@ Built by **[Elite DCs, LLC](https://elitedcs.com)** — a digital marketing and
 
 **Tech stack:** TypeScript, Node.js, esbuild, MCP SDK, Zod, GHL API v2, Firebase Auth
 
-**Version:** 3.83.3
+**Version:** 3.83.5
 
 ---
 

package/dist/index.js

@@ -1922,6 +1922,25 @@ function validateActionChain(actions, existingIds) {
     }
   }
 }
+async function builderRequest(client, method, url, opts = {}) {
+  assertWriteAllowed(method, url, { body: opts.body, defaultLocationId: client.locationId });
+  const headers = { ...await client.buildHeaders(), ...opts.headers ?? {} };
+  const init = { method, headers };
+  if (opts.body !== void 0) init.body = JSON.stringify(opts.body);
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 3e4);
+  init.signal = controller.signal;
+  try {
+    return await fetch(url, init);
+  } catch (error) {
+    if (error instanceof Error && error.name === "AbortError") {
+      throw new Error(`Request timeout (30s): ${method} ${url}`);
+    }
+    throw error;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
 var fs4, path4, dotenv, import_zod4, BACKEND_BASE, FIREBASE_TOKEN_URL, MAX_RETRIES2, BASE_DELAY_MS2, FirebaseTokenSchema, WorkflowActionSchema, WorkflowFullSchema, CreateWorkflowResponseSchema, ParkedContactsError, UUID_V4, WorkflowBuilderClient;
 var init_workflow_builder_client = __esm({
   "src/workflow-builder-client.ts"() {
@@ -7435,14 +7454,8 @@ function registerEmailTools(server2, client) {
 function registerEmailBuilderInternalTools(server2, builderClient, publicClient) {
   if (!builderClient) return;
   const client = builderClient;
-  async function builderRequest(method, path39, body) {
-    const headers = await client.buildHeaders();
-    assertWriteAllowed(method, `${EMAIL_BUILDER_BASE}${path39}`, { defaultLocationId: client.locationId });
-    const response = await fetch(`${EMAIL_BUILDER_BASE}${path39}`, {
-      method,
-      headers,
-      body: body ? JSON.stringify(body) : void 0
-    });
+  async function builderRequest2(method, path39, body) {
+    const response = await builderRequest(client, method, `${EMAIL_BUILDER_BASE}${path39}`, body ? { body } : {});
     if (!response.ok) {
       const text2 = await response.text();
       throw new Error(`Email Builder API Error ${response.status}: ${method} /emails/builder${path39}
@@ -7464,7 +7477,7 @@ ${text2}`);
       const loc = locationId2 ?? client.locationId;
       return deleteEmailTemplateThroughDoors({
         publicDelete: () => publicClient.delete(publicEmailTemplateDeletePath(loc, templateId)),
-        internalDelete: () => builderRequest("DELETE", internalEmailTemplateDeletePath(templateId, loc))
+        internalDelete: () => builderRequest2("DELETE", internalEmailTemplateDeletePath(templateId, loc))
       });
     }
   );
@@ -7479,7 +7492,7 @@ ${text2}`);
     },
     async ({ templateId, name, locationId: locationId2 }) => {
       const loc = locationId2 ?? client.locationId;
-      return builderRequest("PATCH", `/${templateId}`, { locationId: loc, name });
+      return builderRequest2("PATCH", `/${templateId}`, { locationId: loc, name });
     }
   );
   safeTool(
@@ -7493,7 +7506,7 @@ ${text2}`);
     },
     async ({ templateId, archived, locationId: locationId2 }) => {
       const loc = locationId2 ?? client.locationId;
-      return builderRequest("PATCH", `/${templateId}`, { locationId: loc, archived: archived ?? true });
+      return builderRequest2("PATCH", `/${templateId}`, { locationId: loc, archived: archived ?? true });
     }
   );
   safeTool(
@@ -7508,11 +7521,8 @@ ${text2}`);
     },
     async ({ name, body, type, locationId: locationId2 }) => {
       const loc = locationId2 ?? client.locationId;
-      const headers = await client.buildHeaders();
-      const response = await fetch(`${SNIPPETS_BASE}/${loc}`, {
-        method: "POST",
-        headers,
-        body: JSON.stringify(buildSnippetPayload({ name, body, type }))
+      const response = await builderRequest(client, "POST", `${SNIPPETS_BASE}/${loc}`, {
+        body: buildSnippetPayload({ name, body, type })
       });
       if (!response.ok) {
         const text2 = await response.text();
@@ -7542,8 +7552,8 @@ var init_emails = __esm({
     init_account_read_retry();
     init_account_reads();
     import_zod28 = require("zod");
+    init_workflow_builder_client();
     init_tool_helpers();
-    init_account_rules();
     EMAIL_BUILDER_BASE = "https://backend.leadconnectorhq.com/emails/builder";
     SNIPPETS_BASE = "https://services.leadconnectorhq.com/snippets";
     TEMPLATE_TYPES = ["html", "folder", "import", "builder", "blank", "ai_template", "vibe-editor"];
@@ -11238,15 +11248,17 @@ function registerFunnelBuilderTools(server2, builderClient) {
     return client.request("DELETE", path39);
   }
   async function funnelRequest(method, path39, body) {
-    const headers = await client.buildHeaders();
-    headers.Origin = "https://app.gohighlevel.com";
-    headers.Referer = "https://app.gohighlevel.com/";
     const url = `https://backend.leadconnectorhq.com/funnels${path39}`;
-    const options = { method, headers };
-    if (body && (method === "POST" || method === "PUT")) {
-      options.body = JSON.stringify(body);
-    }
-    const response = await fetch(url, options);
+    const sendsBody = body !== void 0 && (method === "POST" || method === "PUT");
+    const response = await builderRequest(client, method, url, {
+      ...sendsBody ? { body } : {},
+      headers: {
+        // Internal-API calls require the app origin (autosave needs the
+        // page-builder one instead; see the autosave call).
+        Origin: "https://app.gohighlevel.com",
+        Referer: "https://app.gohighlevel.com/"
+      }
+    });
     if (!response.ok) {
       const text2 = await response.text();
       throw new Error(`Funnel API Error ${response.status}: ${method} ${path39}
@@ -11508,12 +11520,17 @@ ${text2}`);
     };
   }
   async function autosaveRequest(pageId, body) {
-    const headers = await client.buildHeaders();
-    headers.Origin = "https://page-builder.leadconnectorhq.com";
-    headers.Referer = "https://page-builder.leadconnectorhq.com/";
     const url = `https://backend.leadconnectorhq.com/funnels/builder/autosave/${pageId}`;
-    assertWriteAllowed("POST", url, { defaultLocationId: client.locationId });
-    const response = await fetch(url, { method: "POST", headers, body: JSON.stringify(body) });
+    const response = await builderRequest(client, "POST", url, {
+      body,
+      headers: {
+        // The autosave endpoint's IAM check requires the builder origin (verified
+        // live — app.gohighlevel.com was not tested and page-builder is what the
+        // real builder sends).
+        Origin: "https://page-builder.leadconnectorhq.com",
+        Referer: "https://page-builder.leadconnectorhq.com/"
+      }
+    });
     if (!response.ok) {
       throw new Error(`Funnel API Error ${response.status}: POST /builder/autosave/${pageId}
 ${await response.text()}`);
@@ -11619,9 +11636,9 @@ var init_funnel_builder = __esm({
   "src/tools/funnel-builder.ts"() {
     "use strict";
     import_zod41 = require("zod");
+    init_workflow_builder_client();
     init_tool_helpers();
     init_page_reads();
-    init_account_rules();
   }
 });
 
@@ -16477,10 +16494,15 @@ function registerPageStudioTools(server2, builderClient) {
     return { map: out, truncated };
   }
   async function funnelRequest(method, path39, body) {
-    const headers = await client.buildHeaders();
-    headers.Origin = "https://app.gohighlevel.com";
-    headers.Referer = "https://app.gohighlevel.com/";
-    const response = await fetch(`https://backend.leadconnectorhq.com/funnels${path39}`, { method, headers, ...body && { body: JSON.stringify(body) } });
+    const response = await builderRequest(client, method, `https://backend.leadconnectorhq.com/funnels${path39}`, {
+      ...body ? { body } : {},
+      headers: {
+        // Internal-API calls require the app origin (autosave needs the
+        // page-builder one instead; see the autosave call).
+        Origin: "https://app.gohighlevel.com",
+        Referer: "https://app.gohighlevel.com/"
+      }
+    });
     if (!response.ok) throw new Error(`Funnel API Error ${response.status}: ${method} ${path39}
 ${await response.text()}`);
     const text = await response.text();
@@ -16497,15 +16519,13 @@ ${await response.text()}`);
     }
   }
   async function autosaveRequest(pageId, body) {
-    const headers = await client.buildHeaders();
-    headers.Origin = "https://page-builder.leadconnectorhq.com";
-    headers.Referer = "https://page-builder.leadconnectorhq.com/";
     const autosaveUrl = `https://backend.leadconnectorhq.com/funnels/builder/autosave/${pageId}`;
-    assertWriteAllowed("POST", autosaveUrl, { defaultLocationId: client.locationId });
-    const response = await fetch(autosaveUrl, {
-      method: "POST",
-      headers,
-      body: JSON.stringify(body)
+    const response = await builderRequest(client, "POST", autosaveUrl, {
+      body,
+      headers: {
+        Origin: "https://page-builder.leadconnectorhq.com",
+        Referer: "https://page-builder.leadconnectorhq.com/"
+      }
     });
     if (!response.ok) throw new Error(`Funnel API Error ${response.status}: POST /builder/autosave/${pageId}
 ${await response.text()}`);
@@ -16991,6 +17011,7 @@ var init_page_studio = __esm({
     "use strict";
     import_zod43 = require("zod");
     crypto4 = __toESM(require("node:crypto"));
+    init_workflow_builder_client();
     init_ghl_templates();
     init_retheme();
     init_ghl_page();
@@ -16999,7 +17020,6 @@ var init_page_studio = __esm({
     init_tool_helpers();
     init_compose();
     init_website();
-    init_account_rules();
     valueCardSchema = import_zod43.z.object({
       title: import_zod43.z.string().describe("Card title (short, uppercase reads best)."),
       bodyHtml: import_zod43.z.string().describe("Card body as HTML (<p>\u2026</p>). May use {{location.*}} merge fields."),
@@ -17088,14 +17108,9 @@ function cleanFormDataForSave(formData) {
   return isJsonObject(cleaned) ? cleaned : formData;
 }
 async function formApiRequest(client, method, path39, body) {
-  const headers = await client.buildHeaders();
   const url = `https://backend.leadconnectorhq.com/forms${path39}`;
-  assertWriteAllowed(method, url, { defaultLocationId: client.locationId });
-  const options = { method, headers };
-  if (body && (method === "POST" || method === "PUT")) {
-    options.body = JSON.stringify(body);
-  }
-  const response = await fetch(url, options);
+  const sendsBody = body !== void 0 && (method === "POST" || method === "PUT");
+  const response = await builderRequest(client, method, url, sendsBody ? { body } : {});
   if (!response.ok) {
     const text2 = await response.text();
     throw new Error(`Form API Error ${response.status}: ${method} ${path39}
@@ -17162,10 +17177,10 @@ function registerFormBuilderTools(server2, builderClient, publicClient) {
   );
   server2.tool(
     "update_form",
-    "Update a form's structure \u2014 fields, labels, conditional logic, auto-responder, email notifications, styling. Use get_form_full first to read the current form, modify the formData object, then pass it here. If name is omitted, the current name is preserved (one extra GET).",
+    "Update a form's structure \u2014 fields, labels, conditional logic, auto-responder, email notifications, styling. Use get_form_full first to read the current form, modify the formData object, then pass it here. If name is omitted, the current name is preserved (one extra GET). IMPORTANT \u2014 a custom-question field should carry the real custom field's `id`, `fieldKey` and `dataType` from THIS account (read them with get_custom_fields; do not invent them), and a standard field (first_name, last_name, email, phone) needs `standard: true` with its `tag`. That binding is what ties the answer to the contact record. A field WITHOUT it still renders in the form editor \u2014 verified live on 2026-09-12, so do not expect a missing binding to show up as a broken field. Copy an existing field from get_form_full rather than composing one from memory; these shapes were reverse-engineered from live UI-built forms.",
     {
       formId: import_zod44.z.string().describe("The form ID to update."),
-      formData: import_zod44.z.record(import_zod44.z.string(), import_zod44.z.unknown()).describe("The updated formData object containing form fields, settings, autoResponder config, etc."),
+      formData: import_zod44.z.record(import_zod44.z.string(), import_zod44.z.unknown()).describe("The updated formData object containing form fields, settings, autoResponder config, etc. Fields live at formData.form.fields; each one needs the binding described above or the editor cannot render it."),
       name: import_zod44.z.string().optional().describe("Updated form name. If omitted, the current name is preserved.")
     },
     async ({ formId, formData, name }) => {
@@ -17292,8 +17307,8 @@ var init_form_builder = __esm({
   "src/tools/form-builder.ts"() {
     "use strict";
     import_zod44 = require("zod");
+    init_workflow_builder_client();
     init_tool_helpers();
-    init_account_rules();
   }
 });
 
@@ -17686,14 +17701,9 @@ function registerPipelineBuilderTools(server2, builderClient) {
   if (!builderClient) return;
   const client = builderClient;
   async function pipelineRequest(method, path39, body) {
-    const headers = await client.buildHeaders();
     const url = `https://backend.leadconnectorhq.com/opportunities/pipelines${path39}`;
-    assertWriteAllowed(method, url, { defaultLocationId: client.locationId });
-    const options = { method, headers };
-    if (body && (method === "POST" || method === "PUT" || method === "PATCH")) {
-      options.body = JSON.stringify(body);
-    }
-    const response = await fetch(url, options);
+    const sendsBody = body !== void 0 && (method === "POST" || method === "PUT" || method === "PATCH");
+    const response = await builderRequest(client, method, url, sendsBody ? { body } : {});
     if (!response.ok) {
       const text2 = await response.text();
       throw new Error(`Pipeline API Error ${response.status}: ${method} ${path39}
@@ -17871,7 +17881,7 @@ var init_pipeline_builder = __esm({
   "src/tools/pipeline-builder.ts"() {
     "use strict";
     import_zod46 = require("zod");
-    init_account_rules();
+    init_workflow_builder_client();
   }
 });
 
@@ -21358,7 +21368,7 @@ function tokensCss(d, theme) {
   ];
   return [...light, "", ...dark].join("\n");
 }
-function composeBrief(d, brief) {
+function composeBrief(d, brief, packOpts = {}) {
   const conversionMode = brief.options.pageMode === "conversion" && brief.conversion;
   const { design, antiDefault } = rulesFor(brief.medium, "html", conversionMode ? "conversion" : "standard");
   const opts = brief.options;
@@ -21475,7 +21485,7 @@ ${cleanLogo.slice(0, 6e3)}` : d.logo?.dataUri ? `Logo markup: <img src="${d.logo
     "## Before you finish",
     ...checklist.map((c) => `- [ ] ${c}`),
     "",
-    `Write the whole file to \`${fileName}\`. Then run lint_design_contract, then verify_design; fix what they name; stop after three passes and report.`
+    ...packOpts.tools === false ? [] : [`Write the whole file to \`${fileName}\`. Then run lint_design_contract, then verify_design; fix what they name; stop after three passes and report.`]
   ].join("\n");
   return { fileName, markdown, tokensCss: css2, rules: design, antiDefault, contract: chosenContract, checklist, bannedTells };
 }
@@ -28581,7 +28591,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@elitedcs/ghl-mcp",
-      version: "3.83.3",
+      version: "3.83.5",
       mcpName: "io.github.drjerryrelth/ghl-command",
       description: "GoHighLevel MCP Server for Claude. 250 tools \u2014 full CRM, automation, marketing control, account-wide workflow audit, live funnel-capture verification, and the only programmatic GHL workflow builder, now multi-tenant across client accounts.",
       main: "dist/index.js",
@@ -32387,8 +32397,18 @@ ${d.provenance.source ? `<p class="small">Source: ${esc5(d.provenance.source.url
 ${opts.dir ? `<p class="small">Stored at ${esc5(opts.dir)}</p>` : ""}
 ${foot(SHELL_JS(opts.seatToken ?? "") + `
 (function(){
-var poll=null,runId=null;
-function stopPolling(){if(poll){clearInterval(poll);poll=null}}
+var poll=null,runId=null,started=0,ticker=null,passes=0;
+function stopPolling(){if(poll){clearInterval(poll);poll=null}if(ticker){clearInterval(ticker);ticker=null}}
+function elapsed(ms){var s=Math.floor(ms/1000),m=Math.floor(s/60);s=s%60;return m?(m+"m "+(s<10?"0":"")+s+"s"):(s+"s")}
+/* The run prints NOTHING while Claude writes - it answers in one go, so the log
+   box sits still for ten minutes or more. Silence used to be indistinguishable
+   from a dead run, and the rational move was to press Stop on a working one
+   (BUG-2026-09-12-03). So the cockpit keeps its own clock: it needs nothing
+   from the child process, and it ticks every second, not every poll. */
+function tick(){
+  if(!started)return;
+  say("mk-status","Working on your Claude: "+elapsed(Date.now()-started)+" so far"+(passes?(", on pass "+(passes+1)):"")+". Claude writes the whole file in one answer, so nothing appears below until a pass finishes. Ten to twenty minutes is normal. Closing this tab does not stop it.");
+}
 function show(t){var el=document.getElementById("mk-log");el.hidden=false;el.textContent=t}
 document.getElementById("make").addEventListener("submit",async function(e){
   e.preventDefault();
@@ -32405,24 +32425,25 @@ document.getElementById("make").addEventListener("submit",async function(e){
     var r=await post("/api/design/run",body);
     runId=r.id;
     document.getElementById("mk-cancel").hidden=false;
-    say("mk-status","Running on your Claude. This keeps going if you close the tab.");
+    started=Date.now();passes=0;tick();ticker=setInterval(tick,1000);
     poll=setInterval(async function(){
       var s=await (await fetch("/api/design/run?id="+encodeURIComponent(runId))).json();
-      show((s.tail||[]).join("
-"));
+      var lines=s.tail||[];
+      show(lines.join("\\n"));
+      passes=lines.filter(function(l){return l.trim().slice(0,5)==="pass "}).length;
       if(s.status!=="running"){
         stopPolling();go.disabled=false;document.getElementById("mk-cancel").hidden=true;
         var run=s.run||{};
         var design=run.ok?"design PASS on pass "+run.greenAt:"design NOT GREEN";
-        var copy=run.copy?(run.copy.error?" \xB7 copy not graded":" \xB7 copy "+run.copy.verdict+(run.copy.firstBreakdown?" (first breakdown: "+run.copy.firstBreakdown+")"):"")):"";
+        var copy=run.copy?(run.copy.error?" \xB7 copy not graded":" \xB7 copy "+run.copy.verdict+(run.copy.firstBreakdown?" (first breakdown: "+run.copy.firstBreakdown+")":"")):"";
         say("mk-status",s.status==="done"?design+copy+" \xB7 "+(run.file||s.outDir):"The run stopped: "+design+copy,s.status==="done"&&run.ok?"ok":"err");
       }
     },4000);
-  }catch(err){say("mk-status",err.message,"err");go.disabled=false}
+  }catch(err){stopPolling();started=0;say("mk-status",err.message,"err");go.disabled=false}
 });
 document.getElementById("mk-cancel").addEventListener("click",async function(){
   if(!runId)return;
-  try{await post("/api/design/cancel",{id:runId});stopPolling();say("mk-status","Stopped.");document.getElementById("mk-go").disabled=false;this.hidden=true}catch(e){say("mk-status",e.message,"err")}
+  try{await post("/api/design/cancel",{id:runId});stopPolling();started=0;say("mk-status","Stopped.");document.getElementById("mk-go").disabled=false;this.hidden=true}catch(e){say("mk-status",e.message,"err")}
 });
 })();
 document.getElementById("override").addEventListener("submit",async(e)=>{e.preventDefault();const g=(id)=>document.getElementById(id).value.trim();const body={slug:${scriptJson(d.slug)}};if(g("accent"))body.accent=g("accent");if(g("displayFont"))body.displayFont=g("displayFont");if(g("bodyFont"))body.bodyFont=g("bodyFont");if(g("brandName"))body.name=g("brandName");if(g("logoSvg"))body.logoSvg=g("logoSvg");if(Object.keys(body).length===1){say("save-status","Nothing to change.");return}const b=document.getElementById("save");b.disabled=true;try{await post("/api/brand/set",body);say("save-status","Saved.","ok");location.reload()}catch(err){say("save-status",err.message,"err");b.disabled=false}});
@@ -39216,14 +39237,9 @@ function registerSmartListTools(server2, builderClient) {
   if (!builderClient) return;
   const client = builderClient;
   async function smartListRequest(method, path39, body) {
-    const headers = await client.buildHeaders();
     const url = `${SMARTLIST_BASE}${path39}`;
-    assertWriteAllowed(method, url, { defaultLocationId: client.locationId });
-    const options = { method, headers };
-    if (body && (method === "POST" || method === "PUT")) {
-      options.body = JSON.stringify(body);
-    }
-    const response = await fetch(url, options);
+    const sendsBody = body !== void 0 && (method === "POST" || method === "PUT");
+    const response = await builderRequest(client, method, url, sendsBody ? { body } : {});
     if (!response.ok) {
       const text2 = await response.text();
       throw new Error(`Smart Lists API Error ${response.status}: ${method} ${path39}
@@ -39288,8 +39304,7 @@ ${await res.text()}`);
         ];
         const body = buildContactSmartListBody({ listName: name, locationId: loc, filters });
         const headers = await client.buildHeaders();
-        assertWriteAllowed("POST", CONTACT_SMARTLIST_BASE, { defaultLocationId: client.locationId });
-        const res = await fetch(CONTACT_SMARTLIST_BASE, { method: "POST", headers, body: JSON.stringify(body) });
+        const res = await builderRequest(client, "POST", CONTACT_SMARTLIST_BASE, { body });
         if (!res.ok) throw new Error(`Smart Lists API Error ${res.status}: POST /contacts/smartlist
 ${await res.text()}`);
         return jsonResponse(JSON.parse(await res.text() || "{}"));
@@ -39326,12 +39341,7 @@ ${await res.text()}`);
     async ({ listId }) => {
       try {
         const headers = await client.buildHeaders();
-        assertWriteAllowed("POST", CONTACT_SMARTLIST_DELETE, { defaultLocationId: client.locationId });
-        const res = await fetch(CONTACT_SMARTLIST_DELETE, {
-          method: "POST",
-          headers,
-          body: JSON.stringify({ smartlist_id: listId })
-        });
+        const res = await builderRequest(client, "POST", CONTACT_SMARTLIST_DELETE, { body: { smartlist_id: listId } });
         if (!res.ok) throw new Error(`Smart Lists API Error ${res.status}: POST /smartlist/delete
 ${await res.text()}`);
         return jsonResponse(JSON.parse(await res.text() || "{}"));
@@ -39439,8 +39449,8 @@ var init_smart_lists = __esm({
   "src/tools/smart-lists.ts"() {
     "use strict";
     import_zod57 = require("zod");
+    init_workflow_builder_client();
     init_tool_helpers();
-    init_account_rules();
     SMARTLIST_BASE = "https://backend.leadconnectorhq.com/lists/dynamic";
     OBJECT_KEYS = ["contacts", "opportunity"];
     CONTACT_SMARTLIST_BASE = "https://services.leadconnectorhq.com/contacts/smartlist";
@@ -39462,9 +39472,7 @@ function registerReputationTools(server2, builderClient) {
   if (!builderClient) return;
   const client = builderClient;
   async function reputationRequest(method, path39) {
-    assertWriteAllowed(method, `${REPUTATION_BASE}${path39}`, { defaultLocationId: client.locationId });
-    const headers = await client.buildHeaders();
-    const response = await fetch(`${REPUTATION_BASE}${path39}`, { method, headers });
+    const response = await builderRequest(client, method, `${REPUTATION_BASE}${path39}`);
     if (!response.ok) {
       const text2 = await response.text();
       throw new Error(`Reputation API Error ${response.status}: ${method} ${path39}
@@ -39540,8 +39548,8 @@ var init_reputation = __esm({
   "src/tools/reputation.ts"() {
     "use strict";
     import_zod58 = require("zod");
+    init_workflow_builder_client();
     init_tool_helpers();
-    init_account_rules();
     REPUTATION_BASE = "https://backend.leadconnectorhq.com/reputation";
   }
 });
@@ -39575,13 +39583,7 @@ function registerEmailCampaignTools(server2, builderClient) {
       if (isPlainText !== void 0) body.isPlainText = isPlainText;
       if (enableResendToUnopened !== void 0) body.enableResendToUnopened = enableResendToUnopened;
       if (hasUtmTracking !== void 0) body.hasUtmTracking = hasUtmTracking;
-      const headers = await client.buildHeaders();
-      assertWriteAllowed("POST", `${SVC_BASE}/emails/schedule`, { defaultLocationId: client.locationId });
-      const response = await fetch(`${SVC_BASE}/emails/schedule`, {
-        method: "POST",
-        headers,
-        body: JSON.stringify(body)
-      });
+      const response = await builderRequest(client, "POST", `${SVC_BASE}/emails/schedule`, { body });
       if (!response.ok) {
         const text2 = await response.text();
         throw new Error(`Email Campaign API Error ${response.status}: POST /emails/schedule
@@ -39601,8 +39603,8 @@ var init_email_campaigns = __esm({
   "src/tools/email-campaigns.ts"() {
     "use strict";
     import_zod59 = require("zod");
+    init_workflow_builder_client();
     init_tool_helpers();
-    init_account_rules();
     SVC_BASE = "https://services.leadconnectorhq.com";
   }
 });
@@ -39612,13 +39614,7 @@ function registerMembershipTools(server2, builderClient) {
   if (!builderClient) return;
   const client = builderClient;
   async function membershipRequest(path39, method = "GET", body) {
-    assertWriteAllowed(method, `${MEMBERSHIP_BASE2}${path39}`, { defaultLocationId: client.locationId });
-    const headers = await client.buildHeaders();
-    const response = await fetch(`${MEMBERSHIP_BASE2}${path39}`, {
-      method,
-      headers,
-      body: body ? JSON.stringify(body) : void 0
-    });
+    const response = await builderRequest(client, method, `${MEMBERSHIP_BASE2}${path39}`, body ? { body } : {});
     if (!response.ok) {
       const text2 = await response.text();
       throw new Error(`Membership API Error ${response.status}: ${method} ${path39}
@@ -39799,8 +39795,8 @@ var init_memberships = __esm({
   "src/tools/memberships.ts"() {
     "use strict";
     import_zod60 = require("zod");
+    init_workflow_builder_client();
     init_tool_helpers();
-    init_account_rules();
     MEMBERSHIP_BASE2 = "https://backend.leadconnectorhq.com/membership";
   }
 });
@@ -40148,12 +40144,8 @@ Pipelines: ${template.pipelines.length} to create`);
               }
             } else {
               try {
-                const headers = await builderClient.buildHeaders();
-                assertWriteAllowed("POST", "https://backend.leadconnectorhq.com/opportunities/pipelines", { defaultLocationId: locId });
-                const res = await fetch("https://backend.leadconnectorhq.com/opportunities/pipelines", {
-                  method: "POST",
-                  headers,
-                  body: JSON.stringify({
+                const res = await builderRequest(builderClient, "POST", "https://backend.leadconnectorhq.com/opportunities/pipelines", {
+                  body: {
                     name: resolved2.name,
                     stages: (resolved2.stages || []).map((s) => ({
                       ...s,
@@ -40163,7 +40155,7 @@ Pipelines: ${template.pipelines.length} to create`);
                     locationId: locId,
                     showInFunnel: true,
                     showInPieChart: true
-                  })
+                  }
                 });
                 if (res.ok) {
                   counts.pipelines.created++;
@@ -40324,7 +40316,7 @@ var init_template_deployer = __esm({
     init_tool_helpers();
     fs28 = __toESM(require("fs"));
     path27 = __toESM(require("path"));
-    init_account_rules();
+    init_workflow_builder_client();
     TemplateSchema = import_zod61.z.object({
       templateName: import_zod61.z.string(),
       templateVersion: import_zod61.z.string().optional(),
@@ -43708,7 +43700,7 @@ async function runDesign(opts) {
   const medium = brief.medium;
   const outDir = (0, import_node_path7.resolve)(opts.outDir);
   (0, import_node_fs7.mkdirSync)(outDir, { recursive: true });
-  const pack = composeBrief(dna, brief);
+  const pack = composeBrief(dna, brief, { tools: false });
   const maxPasses = Math.max(1, Math.min(3, opts.maxPasses ?? 3));
   const generate = opts.generate ?? claudeGenerate(opts.model ?? DEFAULT_MODEL);
   const conversionRun = brief.options.pageMode === "conversion" && brief.conversion ? { brief: brief.conversion, gate: opts.gate ?? "ship" } : void 0;
@@ -50986,9 +50978,7 @@ function pickCalendarPins(workflow) {
 }
 function makeFirebaseRequest(builderClient) {
   return async (url, method, body) => {
-    assertWriteAllowed(method, url, { defaultLocationId: builderClient.locationId });
-    const headers = await builderClient.buildHeaders();
-    const response = await fetch(url, { method, headers, body: body ? JSON.stringify(body) : void 0 });
+    const response = await builderRequest(builderClient, method, url, body ? { body } : {});
     if (!response.ok) {
       const text2 = await response.text();
       throw new Error(`API ${response.status}: ${method} ${url.replace(/^https:\/\/[^/]+/, "")}
@@ -51000,11 +50990,9 @@ ${text2}`);
 }
 function makePipelineApi(builderClient) {
   return async (method, path39, body) => {
-    const headers = await builderClient.buildHeaders();
     const url = `https://backend.leadconnectorhq.com/opportunities/pipelines${path39}`;
-    const options = { method, headers };
-    if (body && (method === "POST" || method === "PUT")) options.body = JSON.stringify(body);
-    const response = await fetch(url, options);
+    const sendsBody = body !== void 0 && (method === "POST" || method === "PUT");
+    const response = await builderRequest(builderClient, method, url, sendsBody ? { body } : {});
     if (!response.ok) {
       const text2 = await response.text();
       throw new Error(`Pipeline API ${response.status}: ${method} ${path39}
@@ -51021,13 +51009,17 @@ ${text2}`);
 }
 function makeFunnelApi(builderClient) {
   return async (method, path39, body) => {
-    const headers = await builderClient.buildHeaders();
-    headers.Origin = "https://app.gohighlevel.com";
-    headers.Referer = "https://app.gohighlevel.com/";
     const url = `https://backend.leadconnectorhq.com/funnels${path39}`;
-    const options = { method, headers };
-    if (body && (method === "POST" || method === "PUT")) options.body = JSON.stringify(body);
-    const response = await fetch(url, options);
+    const sendsBody = body !== void 0 && (method === "POST" || method === "PUT");
+    const response = await builderRequest(builderClient, method, url, {
+      ...sendsBody ? { body } : {},
+      headers: {
+        // Origin/Referer REQUIRED on internal-API funnel writes (else 401
+        // "Error calling IAM service") — verified in funnel-builder.ts.
+        Origin: "https://app.gohighlevel.com",
+        Referer: "https://app.gohighlevel.com/"
+      }
+    });
     if (!response.ok) {
       const text2 = await response.text();
       throw new Error(`Funnel API ${response.status}: ${method} ${path39}
@@ -52138,6 +52130,7 @@ var init_intake_to_build = __esm({
     init_build_contract();
     init_build_obligations();
     import_zod80 = require("zod");
+    init_workflow_builder_client();
     init_tool_helpers();
     init_form_builder();
     init_calendars();
@@ -52160,7 +52153,6 @@ var init_intake_to_build = __esm({
     init_plan_from_preset();
     init_executor();
     init_execute();
-    init_account_rules();
     customFieldItemSchema = import_zod80.z.object({
       id: import_zod80.z.string(),
       name: import_zod80.z.string(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@elitedcs/ghl-mcp",
-  "version": "3.83.3",
+  "version": "3.83.5",
   "mcpName": "io.github.drjerryrelth/ghl-command",
   "description": "GoHighLevel MCP Server for Claude. 250 tools — full CRM, automation, marketing control, account-wide workflow audit, live funnel-capture verification, and the only programmatic GHL workflow builder, now multi-tenant across client accounts.",
   "main": "dist/index.js",