@fruggr/zendesk-mcp-server 3.2.1 → 3.3.1

package/dist/index.js

@@ -7546,6 +7546,92 @@ const isStartupError = (err) => err instanceof Error && err.name === "StartupErr
 /** The errno code of a failed filesystem call, for the message. */
 const errnoCode = (err) => err?.code ?? "unknown error";
 //#endregion
+//#region src/utils/validation.ts
+const formatPath = (path) => path.map(String).join(".");
+const formatIssue$1 = (issue) => issue.path.length > 0 ? `${formatPath(issue.path)}: ${issue.message}` : issue.message;
+/**
+* `path: message` per issue, joined by `; ` since zod messages carry commas.
+* Ours rather than the SDK's (not exported): one wording for every mode and for
+* startup config errors, stable across SDK bumps.
+*/
+const formatIssues = (issues) => issues.map(formatIssue$1).join("; ");
+const unwrap$1 = (node) => node._zod.def.innerType ? unwrap$1(node._zod.def.innerType) : node;
+/**
+* Keys declared by the object at `path`, or undefined when no plain object sits
+* there (a record, say, whose keys zod checks against an enum).
+*/
+const keysAt = (node, path) => {
+	const { def } = unwrap$1(node)._zod;
+	if (path.length === 0) return def.shape && Object.keys(def.shape);
+	const [head, ...rest] = path;
+	const child = typeof head === "number" ? def.element : def.shape?.[String(head)];
+	return child && keysAt(child, rest);
+};
+const keyList = (keys) => [...keys].sort().join(", ") || "(none)";
+/** One sentence per object holding unknown keys, the top level first. */
+const unknownKeysMessage = (schema, issues, topLevelKeys) => [...issues].sort((a, b) => a.path.length - b.path.length).map(({ path, keys }) => {
+	if (path.length === 0) return `Unknown parameter(s): ${keys.join(", ")}. Valid parameters: ${topLevelKeys}.`;
+	const parent = formatPath(path);
+	const unknown = `Unknown parameter(s): ${keys.map((key) => `${parent}.${key}`).join(", ")}.`;
+	const valid = keysAt(schema, path);
+	return valid ? `${unknown} Valid parameters for ${parent}: ${keyList(valid)}.` : unknown;
+}).join(" ");
+/**
+* Build a strict validator for a tool's input schema, computing the strict
+* schema and the valid-key list once at construction rather than per call.
+*
+* Zod objects default to `strip`, which silently drops unknown keys. That hid
+* #100: a caller passing `per_page` to list_tickets (whose parameter is
+* `page_size`) had the key dropped, so a large unpaginated page came back. The
+* validator rejects unknown keys and names both the offending ones and the
+* valid parameters, so a misremembered name fails loudly. Any other failure is
+* one `path: message` per issue (#206). When both occur only the unknown keys
+* are reported: a guessed name is the one error a caller cannot spot by
+* re-reading its own arguments.
+*/
+const createStrictValidator = (schema, strict = schema.strict()) => {
+	const topLevelKeys = keyList(Object.keys(schema.shape));
+	return (params) => {
+		const result = strict.safeParse(params);
+		if (result.success) return {
+			success: true,
+			data: result.data
+		};
+		const unknownKeyIssues = result.error.issues.filter((issue) => issue.code === "unrecognized_keys");
+		return {
+			success: false,
+			message: unknownKeyIssues.length > 0 ? unknownKeysMessage(schema, unknownKeyIssues, topLevelKeys) : `Invalid parameter(s): ${formatIssues(result.error.issues)}`
+		};
+	};
+};
+/** The proxy dispatch path (namespace/single modes): throws the validator's message. */
+const createStrictParamsParser = (schema) => {
+	const validate = createStrictValidator(schema);
+	return (params) => {
+		const result = validate(params);
+		if (!result.success) throw new Error(result.message);
+		return result.data;
+	};
+};
+/**
+* The same validator as a Standard Schema, for `all` mode: the SDK calls this
+* `validate` and prints our pathless issue after its own prefix, so all three
+* modes word an error alike. The JSON Schema is zod's own, untouched.
+*/
+const toStrictStandardSchema = (schema) => {
+	const strict = schema.strict();
+	const validate = createStrictValidator(schema, strict);
+	return { "~standard": {
+		version: 1,
+		vendor: "zendesk-mcp-server",
+		validate: (value) => {
+			const result = validate(value);
+			return result.success ? { value: result.data } : { issues: [{ message: result.message }] };
+		},
+		jsonSchema: strict["~standard"].jsonSchema
+	} };
+};
+//#endregion
 //#region src/config.ts
 const ToolMode = _enum([
 	"single",
@@ -7583,6 +7669,14 @@ const Transport = _enum(["stdio", "http"]);
 const ConfigSchema = object({
 	subdomain: string$2().min(1, "ZENDESK_SUBDOMAIN is required"),
 	oauthClientId: string$2().min(1),
+	/**
+	* Help Center brand allow-list (`--brand-ids`): brand ids or subdomains, or
+	* 'all'. Unset: account default brand, surface unchanged. One entry: hard
+	* lock, no `brand_id` field. Several or 'all': `list_brands` exposed and
+	* `brand_id` required on brand-scoped tools. Entries resolve lazily, on first
+	* use. Modes and rationale: docs/configuration.md.
+	*/
+	brandIds: array(string$2().min(1)).min(1).optional(),
 	logLevel: LogLevel,
 	mode: ToolMode,
 	readOnly: boolean$1(),
@@ -7610,14 +7704,12 @@ const ConfigSchema = object({
 	topology: boolean$1().default(true),
 	/**
 	* Whether to PRE-LIST the promoted ("featured") Help Center articles: the
-	* `<scheme>://article/{id}` resource's `list` callback (which scans `/articles`
-	* to enumerate the promoted set for `resources/list`) AND the
-	* `list_promoted_articles` tool. On by default; an operator disables the
-	* pre-listing with `--no-promoted-articles` (e.g. on a very large Help Center
-	* where scanning is costly) so the server issues zero preloading requests. This
-	* does NOT disable reading a known article by id (`<scheme>://article/{id}` stays
-	* registered) — that is cheap and on-demand. Only ever active when the
-	* `help_center` namespace itself is active.
+	* article resource's `list` callback, which scans `/articles` to enumerate the
+	* promoted set for `resources/list`. On by default; `--no-promoted-articles`
+	* turns it off (e.g. on a very large or multi-brand Help Center) so the server
+	* issues zero preloading requests. Reading a known article by id and the
+	* on-demand `list_promoted_articles` tool stay available. Only ever active
+	* when the `help_center` namespace itself is active.
 	*/
 	promotedArticles: boolean$1().default(true),
 	/**
@@ -7696,8 +7788,25 @@ const portEnv = (name) => {
 	const env = readNonEmptyEnv(name);
 	return env.value === void 0 ? void 0 : parsePort(env.value, env.name);
 };
+/**
+* Split a raw `--brand-ids` / `ZENDESK_BRAND_IDS` value into its entries.
+* Comma-separated, entries trimmed; an empty entry (from `a,,b`, a leading/
+* trailing comma, or a whitespace-only value) is a misconfiguration, not an
+* ignored blank: it fails at startup naming the knob. Format validation only —
+* whether an id/subdomain exists is decided lazily, on first use (no token is
+* available at startup on either transport).
+*/
+const parseBrandIds = (raw) => {
+	if (raw === void 0) return void 0;
+	const entries = raw.split(",").map((entry) => entry.trim());
+	if (entries.some((entry) => entry.length === 0)) throw createStartupError("Invalid --brand-ids / ZENDESK_BRAND_IDS value: empty entry. Expected a comma-separated list of brand ids or subdomains, or \"all\".", STARTUP_DOCS.environment);
+	const normalized = entries.map((entry) => entry.toLowerCase());
+	if (normalized.length > 1 && normalized.includes("all")) throw createStartupError("Invalid --brand-ids / ZENDESK_BRAND_IDS value: \"all\" cannot be combined with brand ids or subdomains.", STARTUP_DOCS.environment);
+	return [...new Set(normalized)];
+};
 const CLI_OPTIONS = {
 	mode: { type: "string" },
+	"brand-ids": { type: "string" },
 	namespace: {
 		type: "string",
 		multiple: true
@@ -7767,7 +7876,7 @@ const parseStrict = (args) => {
 const validated = (input) => {
 	const result = ConfigSchema.safeParse(input);
 	if (result.success) return result.data;
-	throw createStartupError(`${result.error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`).join("; ")}.`, STARTUP_DOCS.cliReference, result.error);
+	throw createStartupError(`${formatIssues(result.error.issues)}.`, STARTUP_DOCS.cliReference, result.error);
 };
 const parseCliArgs = (args) => {
 	const { values, positionals } = parseStrict(args);
@@ -7785,6 +7894,7 @@ const parseCliArgs = (args) => {
 	}
 	if (values.port !== void 0) result.port = parsePort(values.port, "--port");
 	if (values["callback-port"] !== void 0) result.callbackPort = parsePort(values["callback-port"], "--callback-port");
+	if (values["brand-ids"] !== void 0) result.brandIds = values["brand-ids"];
 	return result;
 };
 const splitList = (raw) => (raw ?? "").split(",").map((s) => s.trim()).filter((s) => s.length > 0);
@@ -7812,10 +7922,12 @@ const loadConfig = (argv = process.argv.slice(2)) => {
 	const mode = cli.tools?.length ? "all" : cli.mode ?? "namespace";
 	const namespaces = cli.namespaces ?? (cli.tools?.length ? [...Namespace.options] : void 0);
 	const callbackPort = cli.callbackPort ?? portEnv("OAUTH_CALLBACK_PORT");
+	const brandIds = cli.brandIds ?? requireNonEmptyEnv("ZENDESK_BRAND_IDS");
 	const hcResourceScheme = cli.hcResourceScheme ?? requireNonEmptyEnv("HC_RESOURCE_SCHEME");
 	return validated({
 		subdomain,
 		oauthClientId,
+		brandIds: parseBrandIds(brandIds),
 		logLevel: cli.logLevel ?? requireNonEmptyEnv("LOG_LEVEL") ?? "info",
 		mode,
 		readOnly: cli.readOnly ?? false,
@@ -7832,7 +7944,389 @@ const loadConfig = (argv = process.argv.slice(2)) => {
 	});
 };
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+server@2.2.0/node_modules/@modelcontextprotocol/server/dist/chunk-Br0eD_fh.mjs
+//#region src/constants.ts
+const positiveIntEnv = (name, fallback) => {
+	const raw = readEnv(name).value;
+	if (raw === void 0 || raw.trim() === "") return fallback;
+	const parsed = Number(raw);
+	return Number.isSafeInteger(parsed) && parsed > 0 ? parsed : fallback;
+};
+const CHARACTER_LIMIT = positiveIntEnv("RESPONSE_CHARACTER_LIMIT", 25e3);
+const ARTICLE_RESOURCES_SCAN_MAX_PAGES = positiveIntEnv("ARTICLE_RESOURCES_SCAN_MAX_PAGES", 20);
+const DEFAULT_CALLBACK_PORT = 27439;
+const MAX_ATTACHMENT_BYTES = positiveIntEnv("ATTACHMENT_MAX_BYTES", 5242880);
+const MAX_EMBEDDED_IMAGE_COUNT = positiveIntEnv("EMBEDDED_IMAGES_MAX", 10);
+const STDIO_MAX_MESSAGE_BYTES = 10485760;
+const MESSAGE_CONTENT_BUDGET_BYTES = 10420224;
+const MAX_RESPONSE_BYTES = Math.min(positiveIntEnv("RESPONSE_MAX_BYTES", MESSAGE_CONTENT_BUDGET_BYTES), MESSAGE_CONTENT_BUDGET_BYTES);
+const MAX_BASE64_INPUT_CHARS = MESSAGE_CONTENT_BUDGET_BYTES;
+const MAX_BASE64_INPUT_MB = Number.parseFloat((MAX_BASE64_INPUT_CHARS / 4 * 3 / 1048576).toFixed(2));
+const MAX_COMMENT_PAGES = positiveIntEnv("COMMENT_MAX_PAGES", 10);
+const TICKET_FIELD_SCAN_MAX_PAGES = positiveIntEnv("TICKET_FIELD_SCAN_MAX_PAGES", 10);
+const REORDER_CONFIRM_THRESHOLD = positiveIntEnv("REORDER_CONFIRM_THRESHOLD", 20);
+const getBaseUrl = (subdomain) => `https://${subdomain}.zendesk.com/api/v2`;
+const getHelpCenterBaseUrl = (subdomain) => `https://${subdomain}.zendesk.com/api/v2/help_center`;
+const getOAuthUrls = (subdomain) => ({
+	authorizeUrl: `https://${subdomain}.zendesk.com/oauth/authorizations/new`,
+	tokenUrl: `https://${subdomain}.zendesk.com/oauth/tokens`
+});
+//#endregion
+//#region src/client/retry.ts
+const MAX_ATTEMPTS = 3;
+const BASE_DELAY_MS = 250;
+const MAX_DELAY_MS = 4e3;
+const REQUEST_TIMEOUT_MS = 3e4;
+const TRANSFER_TIMEOUT_MS = 12e4;
+/**
+* A deadline for one attempt. The abort surfaces as a `TimeoutError` whose `code`
+* is numeric, not a syscall string, so it classifies as `unknown`: a GET is
+* retried, a write is not — the request may have arrived before the deadline.
+*/
+const deadlineSignal = (timeoutMs) => AbortSignal.timeout(timeoutMs);
+const MAX_RETRY_AFTER_MS = 5e3;
+const POLICIES = {
+	GET: {
+		network: "any",
+		serverErrors: true
+	},
+	DELETE: {
+		network: "pre-send",
+		serverErrors: false
+	},
+	POST: {
+		network: "pre-send",
+		serverErrors: false
+	},
+	PUT: {
+		network: "pre-send",
+		serverErrors: false
+	}
+};
+const DELAY_SECONDS = /^\d+$/;
+const HTTP_DATE_START = /^[A-Za-z]/;
+const NON_ASCII = /[^ -~]/g;
+const TOKEN_SEGMENT = /\/token\/[^/]+/;
+const URL_IN_TEXT = /[a-z][a-z0-9+.-]*:\/\/\S+/gi;
+const PRE_SEND_CODES = /* @__PURE__ */ new Set([
+	"ENOTFOUND",
+	"EAI_AGAIN",
+	"ECONNREFUSED",
+	"UND_ERR_CONNECT_TIMEOUT"
+]);
+const defaultRetryDeps = {
+	sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+	random: Math.random
+};
+/** Non-ASCII bytes break `node:http` headers, so client error text stays ASCII. */
+const toAscii = (text) => text.replace(NON_ASCII, "?");
+/**
+* Identifies the request without leaking a credential: uploads carry an upload
+* token in the query string, and an attachment `content_url` carries a download
+* token as a path segment (`/attachments/token/<token>/`).
+*/
+const describeTarget = (url) => {
+	const { origin, pathname } = new URL(url);
+	return `${origin}${pathname.replace(TOKEN_SEGMENT, "/token/[redacted]")}`;
+};
+/** First `code` in the cause chain, inspecting 5 levels so a cycle cannot hang. */
+const errorCode = (err) => {
+	let current = err;
+	for (let depth = 0; depth < 5 && current !== null && typeof current === "object"; depth += 1) {
+		const { code, cause } = current;
+		if (typeof code === "string") return code;
+		current = cause;
+	}
+};
+const classifyNetworkError = (err) => PRE_SEND_CODES.has(errorCode(err)) ? "pre-send" : "unknown";
+const UNINFORMATIVE_NAMES = /* @__PURE__ */ new Set(["Error", "TypeError"]);
+/**
+* The client refuses to replay a write that may have landed — but the caller is
+* an LLM whose reflex on a failed tool call is to try again, which would undo
+* that. So a failed write says whether it may have taken effect. ASCII only,
+* same rule as the rest of the message.
+*/
+const MAY_HAVE_APPLIED_NOTE = "The write may already have been applied. Check the current state before retrying, or you may duplicate it.";
+const NEVER_SENT_NOTE = "The request never reached Zendesk, so nothing was applied. Retrying is safe.";
+const REFUSED_NOTE = "Zendesk refused the request, so nothing was applied. Retrying is safe.";
+/** Only a write can be duplicated by a replay, so only a write carries a note. */
+const writeNote = (method, note) => method === "GET" ? "" : ` ${note}`;
+/**
+* A cause message can quote the URL it failed on — Node's `fetch` refuses a URL
+* carrying credentials by printing the whole thing, query string included — which
+* would smuggle back exactly what `describeTarget` drops. Same treatment for both,
+* so one function owns what a URL may look like in our output.
+*/
+const redactUrls = (text) => text.replace(URL_IN_TEXT, (found) => {
+	try {
+		return new URL(found).origin === "null" ? "[url]" : describeTarget(found);
+	} catch {
+		return "[url]";
+	}
+});
+const failureDetail = (cause) => {
+	if (!(cause instanceof Error)) return redactUrls(String(cause));
+	const message = redactUrls(cause.message);
+	const code = errorCode(cause);
+	if (code !== void 0) return `${code}: ${message}`;
+	return UNINFORMATIVE_NAMES.has(cause.name) ? message : `${cause.name}: ${message}`;
+};
+const networkErrorMessage = (method, target, attempts, cause) => {
+	const base = `Network error on ${method} ${target} after ${attempts === 1 ? "1 attempt" : `${attempts} attempts`}: ${failureDetail(cause)}`;
+	const note = classifyNetworkError(cause) === "pre-send" ? NEVER_SENT_NOTE : MAY_HAVE_APPLIED_NOTE;
+	return toAscii(method === "GET" ? base : `${base}.${writeNote(method, note)}`);
+};
+const createZendeskNetworkError = (method, target, attempts, cause) => Object.assign(new Error(networkErrorMessage(method, target, attempts, cause), { cause }), {
+	name: "ZendeskNetworkError",
+	method,
+	target,
+	attempts
+});
+/** Exponential backoff with equal jitter: half the window fixed, half random. */
+const computeBackoffMs = (attempt, random) => {
+	const window = Math.min(BASE_DELAY_MS * 2 ** (attempt - 1), MAX_DELAY_MS);
+	return Math.round(window / 2 + window * random() / 2);
+};
+/** `Retry-After` in ms — delay-seconds or HTTP-date. */
+const parseRetryAfter = (header, now = Date.now()) => {
+	if (header === null) return void 0;
+	const value = header.trim();
+	if (DELAY_SECONDS.test(value)) return Number(value) * 1e3;
+	if (!HTTP_DATE_START.test(value)) return void 0;
+	const date = Date.parse(value);
+	if (Number.isNaN(date)) return void 0;
+	return Math.max(0, date - now);
+};
+/**
+* How long to wait before replaying this response, or undefined to accept it.
+* `Retry-After` wins over backoff wherever it appears — Zendesk sends it on a 503
+* during maintenance as well as on a 429 — and a value past the cap means the
+* response is surfaced rather than parking the call for that long.
+*/
+const retryDelayFor = (response, policy, attempt, random) => {
+	if (!(response.status === 429 || response.status >= 500 && policy.serverErrors)) return void 0;
+	const retryAfter = parseRetryAfter(response.headers.get("retry-after"));
+	if (retryAfter === void 0) return computeBackoffMs(attempt, random);
+	return retryAfter > MAX_RETRY_AFTER_MS ? void 0 : retryAfter;
+};
+/**
+* Runs `attempt` until it succeeds, hits a terminal outcome, or spends the
+* attempt budget. Returns the last response for the caller to inspect (a
+* non-ok status is still the caller's to turn into a `ZendeskApiError`), and
+* throws `ZendeskNetworkError` when no response was ever obtained.
+*/
+const fetchWithRetry = async (attempt, method, target, deps = defaultRetryDeps) => {
+	const policy = POLICIES[method];
+	for (let tries = 1;; tries += 1) {
+		const last = tries >= MAX_ATTEMPTS;
+		let response;
+		try {
+			response = await attempt();
+		} catch (err) {
+			const replayable = policy.network === "any" || classifyNetworkError(err) === policy.network;
+			if (last || !replayable) throw createZendeskNetworkError(method, target, tries, err);
+			await deps.sleep(computeBackoffMs(tries, deps.random));
+			continue;
+		}
+		if (last) return response;
+		const delayMs = retryDelayFor(response, policy, tries, deps.random);
+		if (delayMs === void 0) return response;
+		await response.text().catch(() => void 0);
+		await deps.sleep(delayMs);
+	}
+};
+//#endregion
+//#region src/client/zendesk-api.ts
+var ZendeskApiError = class ZendeskApiError extends Error {
+	status;
+	statusText;
+	body;
+	method;
+	constructor(status, statusText, body, method) {
+		super(ZendeskApiError.buildMessage(status, statusText, body, method));
+		this.status = status;
+		this.statusText = statusText;
+		this.body = body;
+		this.method = method;
+		this.name = "ZendeskApiError";
+	}
+	static buildMessage(status, statusText, body, method) {
+		switch (status) {
+			case 401: return "Authentication failed. Your Zendesk token may be expired or invalid. Re-authenticate to get a new token.";
+			case 403: return "Permission denied. Your Zendesk account does not have access to this resource.";
+			case 404: return `Resource not found. Please verify the ID is correct. (${statusText})`;
+			case 422: return `Validation error: ${body}`;
+			case 429: return `Rate limit exceeded. Please wait before making more requests.${writeNote(method, REFUSED_NOTE)}`;
+			default: {
+				const message = `Zendesk API error ${status}: ${statusText}. ${body}`;
+				return status >= 500 ? `${message}${writeNote(method, MAY_HAVE_APPLIED_NOTE)}` : message;
+			}
+		}
+	}
+};
+const buildAuthHeader = (token) => `Bearer ${token}`;
+const buildUrl = (base, path, params) => {
+	const url = new URL(`${base}${path}`);
+	if (params) for (const [key, value] of Object.entries(params)) url.searchParams.set(key, value);
+	return url.toString();
+};
+const performFetch = (method, url, init, timeoutMs = REQUEST_TIMEOUT_MS) => fetchWithRetry(() => fetch(url, {
+	...init,
+	method,
+	signal: deadlineSignal(timeoutMs)
+}), method, describeTarget(url));
+const executeRequest = async (url, token, options = {}) => {
+	const { method = "GET", body } = options;
+	const headers = {
+		Authorization: buildAuthHeader(token),
+		Accept: "application/json"
+	};
+	if (body) headers["Content-Type"] = "application/json";
+	const init = { headers };
+	if (body) init.body = JSON.stringify(body);
+	const response = await performFetch(method, url, init);
+	if (!response.ok) {
+		const responseBody = await response.text();
+		throw new ZendeskApiError(response.status, response.statusText, responseBody, method);
+	}
+	if (response.status === 204) return {};
+	return response.json();
+};
+const zendeskGet = (subdomain, token, path, params) => {
+	const url = buildUrl(getBaseUrl(subdomain), path, params);
+	return executeRequest(url, token);
+};
+const zendeskPost = (subdomain, token, path, body) => {
+	const url = buildUrl(getBaseUrl(subdomain), path);
+	return executeRequest(url, token, {
+		method: "POST",
+		body
+	});
+};
+const zendeskPut = (subdomain, token, path, body) => {
+	const url = buildUrl(getBaseUrl(subdomain), path);
+	return executeRequest(url, token, {
+		method: "PUT",
+		body
+	});
+};
+const helpCenterGet = (subdomain, token, path, params) => {
+	const url = buildUrl(getHelpCenterBaseUrl(subdomain), path, params);
+	return executeRequest(url, token);
+};
+const helpCenterPost = (subdomain, token, path, body) => {
+	const url = buildUrl(getHelpCenterBaseUrl(subdomain), path);
+	return executeRequest(url, token, {
+		method: "POST",
+		body
+	});
+};
+const helpCenterPut = (subdomain, token, path, body) => {
+	const url = buildUrl(getHelpCenterBaseUrl(subdomain), path);
+	return executeRequest(url, token, {
+		method: "PUT",
+		body
+	});
+};
+const helpCenterDelete = (subdomain, token, path) => {
+	const url = buildUrl(getHelpCenterBaseUrl(subdomain), path);
+	return executeRequest(url, token, { method: "DELETE" });
+};
+const fetchZendeskBinary = async (subdomain, token, contentUrl) => {
+	const expectedHost = `${subdomain}.zendesk.com`;
+	const headers = {};
+	if (new URL(contentUrl).hostname === expectedHost) headers["Authorization"] = buildAuthHeader(token);
+	const response = await performFetch("GET", contentUrl, { headers }, TRANSFER_TIMEOUT_MS);
+	if (!response.ok) {
+		const body = await response.text();
+		throw new ZendeskApiError(response.status, response.statusText, body, "GET");
+	}
+	const contentType = response.headers.get("content-type") ?? "application/octet-stream";
+	const arrayBuffer = await response.arrayBuffer();
+	return {
+		data: Buffer.from(arrayBuffer),
+		contentType
+	};
+};
+const zendeskUpload = async (subdomain, token, filename, data, contentType, uploadToken) => {
+	const params = { filename };
+	if (uploadToken) params["token"] = uploadToken;
+	const url = buildUrl(getBaseUrl(subdomain), "/uploads", params);
+	const response = await performFetch("POST", url, {
+		headers: {
+			Authorization: buildAuthHeader(token),
+			"Content-Type": contentType
+		},
+		body: data
+	}, TRANSFER_TIMEOUT_MS);
+	if (!response.ok) {
+		const responseBody = await response.text();
+		throw new ZendeskApiError(response.status, response.statusText, responseBody, "POST");
+	}
+	return response.json();
+};
+const helpCenterUpload = async (subdomain, token, path, formData) => {
+	const url = buildUrl(getHelpCenterBaseUrl(subdomain), path);
+	const response = await performFetch("POST", url, {
+		headers: { Authorization: buildAuthHeader(token) },
+		body: formData
+	}, TRANSFER_TIMEOUT_MS);
+	if (!response.ok) {
+		const responseBody = await response.text();
+		throw new ZendeskApiError(response.status, response.statusText, responseBody, "POST");
+	}
+	return response.json();
+};
+//#endregion
+//#region src/client/brands.ts
+const BRAND_SUBDOMAIN = /^[a-z0-9][a-z0-9-]*$/;
+/**
+* Fetch every brand of the account (cursor-paginated). `page[size]` is sent on
+* the FIRST request too: without it Zendesk falls back to OFFSET pagination,
+* which answers without `meta.after_cursor`, and the loop below would stop
+* after page 1 — a brand past the first 100 would resolve as Unknown.
+*/
+const fetchAllBrands = async (subdomain, token) => {
+	const brands = [];
+	let cursor;
+	do {
+		const response = await zendeskGet(subdomain, token, "/brands", {
+			"page[size]": String(100),
+			...cursor ? { "page[after]": cursor } : {}
+		});
+		brands.push(...response.brands ?? []);
+		const meta = response.meta;
+		if (meta?.has_more) {
+			if (!meta.after_cursor || meta.after_cursor === cursor) throw new Error("GET /brands reported more pages but returned no usable after_cursor (missing or identical to the cursor just sent). Cannot continue pagination safely.");
+			cursor = meta.after_cursor;
+		} else cursor = void 0;
+	} while (cursor);
+	return brands;
+};
+const createBrandSubdomainResolver = (subdomain, getToken) => {
+	let cached;
+	const brands = () => {
+		if (!cached || Date.now() - cached.at >= 3e5) {
+			const promise = (async () => fetchAllBrands(subdomain, await getToken()))();
+			cached = {
+				at: Date.now(),
+				promise
+			};
+			promise.catch(() => {
+				cached = void 0;
+			});
+		}
+		return cached.promise;
+	};
+	return async (idOrSubdomain) => {
+		const all = await brands();
+		const brand = all.find((b) => String(b.id) === idOrSubdomain) ?? all.find((b) => b.subdomain.toLowerCase() === idOrSubdomain.toLowerCase());
+		if (!brand) throw new Error(`Unknown brand "${idOrSubdomain}": no brand with that id or subdomain exists on this account; call list_brands to see the available brands.`);
+		if (!BRAND_SUBDOMAIN.test(brand.subdomain)) throw new Error(`Brand ${brand.id} has an unexpected subdomain; refusing to send a request to it.`);
+		return brand.subdomain;
+	};
+};
+//#endregion
+//#region node_modules/.pnpm/@modelcontextprotocol+server@2.3.1/node_modules/@modelcontextprotocol/server/dist/chunk-Br0eD_fh.mjs
 var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
@@ -7864,7 +8358,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 	enumerable: true
 }) : target, mod));
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+server@2.2.0/node_modules/@modelcontextprotocol/server/dist/dialects-DoSzNhcb.mjs
+//#region node_modules/.pnpm/@modelcontextprotocol+server@2.3.1/node_modules/@modelcontextprotocol/server/dist/dialects-DoSzNhcb.mjs
 /**
 * Canonical `$schema` URIs per supported dialect (http + https variants, trailing-`#` stripped).
 */
@@ -9527,7 +10021,7 @@ const OAuthTokenRevocationRequestSchema = object({
 	token_type_hint: string$2().optional()
 }).strip();
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+server@2.2.0/node_modules/@modelcontextprotocol/server/dist/src-BHSMhZ_W.mjs
+//#region node_modules/.pnpm/@modelcontextprotocol+server@2.3.1/node_modules/@modelcontextprotocol/server/dist/src-Cqbh3MYc.mjs
 /**
 * Cross-bundle `instanceof` support for the SDK error classes.
 *
@@ -12582,7 +13076,7 @@ function build() {
 	const subscriptionsListenParamsShape = { notifications: SubscriptionFilterSchema$1 };
 	const SubscriptionsListenRequestSchema$1 = wireRequest("subscriptions/listen", subscriptionsListenParamsShape);
 	/**
-	* Anchor SubscriptionsListenResultMeta — required subscriptionId stamp on
+	* Anchor SubscriptionsListenResultMetaObject — required subscriptionId stamp on
 	* the graceful-close result. Extends `ResultMetaObject` since spec PR
 	* #3002 (composed, so the serverInfo key and its leniency stay single-sourced).
 	*/
@@ -12855,7 +13349,8 @@ function build() {
 		ListResourceTemplatesResultResponseSchema: wireResultResponse(ListResourceTemplatesResultSchema$1),
 		ReadResourceResultResponseSchema: wireResultResponse(union([ReadResourceResultSchema$1, InputRequiredResultSchema])),
 		CompleteResultResponseSchema: wireResultResponse(CompleteResultSchema$1),
-		DiscoverResultResponseSchema: wireResultResponse(DiscoverResultSchema$1)
+		DiscoverResultResponseSchema: wireResultResponse(DiscoverResultSchema$1),
+		SubscriptionsListenResultResponseSchema: wireResultResponse(SubscriptionsListenResultSchema$1)
 	};
 }
 let memo;
@@ -13599,6 +14094,10 @@ function isSpecRequestMethod(method) {
 function isSpecNotificationMethod(method) {
 	return ALL_CODECS.some((codec) => codec.hasNotificationMethod(method));
 }
+/** The names SEP-2663 re-defines for the Tasks extension on the era that removed them from core. */
+function isExtensionReusedRequestMethod(method) {
+	return method === "tasks/get" || method === "tasks/cancel";
+}
 const ALL_CODECS = [rev2025Codec, rev2026Codec];
 var schemas_exports = /* @__PURE__ */ __exportAll({
 	AnnotationsSchema: () => AnnotationsSchema,
@@ -14631,6 +15130,8 @@ var Protocol = class {
 	_transport;
 	_requestMessageId = 0;
 	_requestHandlers = /* @__PURE__ */ new Map();
+	/** Methods registered with an explicit schema; the era gate in `_onrequest` reads it for the Tasks extension names. */
+	_customSchemaRequestMethods = /* @__PURE__ */ new Set();
 	_requestHandlerAbortControllers = /* @__PURE__ */ new Map();
 	_notificationHandlers = /* @__PURE__ */ new Map();
 	_responseHandlers = /* @__PURE__ */ new Map();
@@ -14908,7 +15409,7 @@ var Protocol = class {
 				return;
 			}
 		}
-		if (isSpecRequestMethod(request.method) && !codec.hasRequestMethod(request.method)) {
+		if (isSpecRequestMethod(request.method) && !codec.hasRequestMethod(request.method) && !(isExtensionReusedRequestMethod(request.method) && this._customSchemaRequestMethods.has(request.method))) {
 			sendErrorResponse(ProtocolErrorCode.MethodNotFound, "Method not found");
 			return;
 		}
@@ -15041,8 +15542,11 @@ var Protocol = class {
 	}
 	request(request, schemaOrOptions, maybeOptions) {
 		const codec = this._resolveOutboundCodec(request.method);
+		if (isStandardSchema(schemaOrOptions)) {
+			if (!isExtensionReusedRequestMethod(request.method)) this._assertOutboundRequestInEra(codec, request.method);
+			return this._requestWithSchemaViaCodec(codec, request, schemaOrOptions, maybeOptions);
+		}
 		this._assertOutboundRequestInEra(codec, request.method);
-		if (isStandardSchema(schemaOrOptions)) return this._requestWithSchemaViaCodec(codec, request, schemaOrOptions, maybeOptions);
 		const validate = codecResultValidator(codec, request.method);
 		if (validate === void 0) throw new TypeError(`'${request.method}' is not a spec method; pass a result schema as the second argument to request().`);
 		return this._requestWithSchemaViaCodec(codec, request, validate, schemaOrOptions);
@@ -15286,6 +15790,8 @@ var Protocol = class {
 			return maybeHandler(parsed.data, ctx);
 		};
 		else throw new TypeError("setRequestHandler: handler is required");
+		if (typeof schemasOrHandler === "function") this._customSchemaRequestMethods.delete(method);
+		else this._customSchemaRequestMethods.add(method);
 		this._requestHandlers.set(method, this._wrapHandler(method, stored));
 	}
 	/**
@@ -15314,6 +15820,7 @@ var Protocol = class {
 	*/
 	removeRequestHandler(method) {
 		this._requestHandlers.delete(method);
+		this._customSchemaRequestMethods.delete(method);
 	}
 	/**
 	* Asserts that a request handler has not already been set for the given method, in preparation for a new one being automatically installed.
@@ -15895,7 +16402,7 @@ function normalizeRawShapeSchema(schema) {
 	return schema;
 }
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+server@2.2.0/node_modules/@modelcontextprotocol/server/dist/ajvProvider-CEoC__sr.mjs
+//#region node_modules/.pnpm/@modelcontextprotocol+server@2.3.1/node_modules/@modelcontextprotocol/server/dist/ajvProvider-CEoC__sr.mjs
 var require_code$1 = /* @__PURE__ */ __commonJSMin(((exports) => {
 	Object.defineProperty(exports, "__esModule", { value: true });
 	exports.regexpCode = exports.getEsmExportName = exports.getProperty = exports.safeStringify = exports.stringify = exports.strConcat = exports.addCodeArg = exports.str = exports._ = exports.nil = exports._Code = exports.Name = exports.IDENTIFIER = exports._CodeOrName = void 0;
@@ -23030,7 +23537,7 @@ var AjvJsonSchemaValidator = class {
 };
 import_ajv.Ajv;
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+server@2.2.0/node_modules/@modelcontextprotocol/server/dist/mcp-DYuW2ZSs.mjs
+//#region node_modules/.pnpm/@modelcontextprotocol+server@2.3.1/node_modules/@modelcontextprotocol/server/dist/mcp-DIH4cS6P.mjs
 const COMPLETABLE_SYMBOL = Symbol.for("mcp.completable");
 /**
 * Checks if a schema is completable (has completion metadata).
@@ -23052,6 +23559,15 @@ function armSseKeepAlive(intervalMs, onTick) {
 	timer.unref?.();
 	return timer;
 }
+function comparableResource(value) {
+	const text = String(value);
+	const hash = text.indexOf("#");
+	return (hash === -1 ? text : text.slice(0, hash)).replace(/\/$/, "");
+}
+function sameResource(reported, expected) {
+	if (!reported) return false;
+	return comparableResource(reported) === comparableResource(expected);
+}
 function headerQuotedValue(value) {
 	return value.replaceAll(/[\\"]/g, String.raw`\$&`).replaceAll(/[^\u0020-\u007E]/g, " ");
 }
@@ -23071,6 +23587,38 @@ function buildWwwAuthenticateHeader(errorCode, description, requiredScopes, reso
 	return header;
 }
 /**
+* Validate a raw `Authorization` header value as a Bearer token and return
+* the verified {@link AuthInfo}.
+*
+* The runtime-neutral core of Bearer authentication: it parses the header,
+* runs the verifier, compares the token's resource with `expectedResource`,
+* enforces `requiredScopes`, and rejects tokens without an
+* expiration or past it. On any failure it throws an {@link OAuthError} —
+* pass that to {@link bearerAuthChallengeResponse} for the matching HTTP
+* answer, or use {@link requireBearerAuth} to get both steps as one call.
+*
+* Framework adapters build on this: `requireBearerAuth` from
+* `@modelcontextprotocol/express` feeds it `req.headers.authorization`.
+*/
+async function verifyBearerToken(authorizationHeader, options) {
+	const { verifier, requiredScopes = [], expectedResource } = options;
+	if (!authorizationHeader) throw new OAuthError(OAuthErrorCode.InvalidToken, "Missing Authorization header");
+	const [type, token] = authorizationHeader.split(" ");
+	if (type?.toLowerCase() !== "bearer" || !token) throw new OAuthError(OAuthErrorCode.InvalidToken, "Invalid Authorization header format, expected 'Bearer TOKEN'");
+	const authInfo = await verifier.verifyAccessToken(token);
+	if (expectedResource !== void 0 && !sameResource(authInfo.resource, expectedResource)) throw new OAuthError(OAuthErrorCode.InvalidToken, "Token was not issued for this resource");
+	if (requiredScopes.length > 0) {
+		if (!requiredScopes.every((scope) => authInfo.scopes.includes(scope))) throw new OAuthError(OAuthErrorCode.InsufficientScope, "Insufficient scope");
+	}
+	if (typeof authInfo.expiresAt !== "number" || Number.isNaN(authInfo.expiresAt)) throw new OAuthError(OAuthErrorCode.InvalidToken, "Token has no expiration time");
+	else if (authInfo.expiresAt < Date.now() / 1e3) throw new OAuthError(OAuthErrorCode.InvalidToken, "Token has expired");
+	if (options.resourceMetadataUrl !== void 0 && authInfo.resourceMetadataUrl === void 0) return {
+		...authInfo,
+		resourceMetadataUrl: options.resourceMetadataUrl
+	};
+	return authInfo;
+}
+/**
 * Build the HTTP answer for a Bearer authentication failure.
 *
 * Maps an {@link OAuthError} to its status — `401` for `invalid_token` and
@@ -23383,6 +23931,11 @@ var Server = class extends Protocol {
 		if (modernProtocolVersions(this._supportedProtocolVersions).length > 0) this.setRequestHandler("server/discover", () => this._ondiscover());
 		if (this._capabilities.logging) this._registerLoggingHandler();
 	}
+	/** Attaches to the given transport; rejects while this instance is connected to another one. */
+	async connect(transport) {
+		if (this.transport !== void 0) throw new SdkError(SdkErrorCode.AlreadyConnected, "Use a separate Server instance per connection: this instance is already connected to a transport. To connect it to a new transport, call close() first.");
+		await super.connect(transport);
+	}
 	/**
 	* Registers the built-in `logging/setLevel` request handler.
 	*
@@ -23928,6 +24481,30 @@ var Server = class extends Protocol {
 function discoverAdvertisedCapabilities(capabilities) {
 	return { ...capabilities };
 }
+function toolInputElementCount(value, max) {
+	let count = 0;
+	const stack = [value];
+	while (stack.length > 0) {
+		const node = stack.pop();
+		if (node === null || typeof node !== "object") continue;
+		if (Array.isArray(node)) for (const child of node) {
+			if (++count > max) return count;
+			if (child !== null && typeof child === "object") stack.push(child);
+		}
+		else for (const key in node) {
+			if (!Object.prototype.hasOwnProperty.call(node, key)) continue;
+			if (++count > max) return count;
+			const child = node[key];
+			if (child !== null && typeof child === "object") stack.push(child);
+		}
+	}
+	return count;
+}
+function resolveMaxToolInputElements(value) {
+	if (value === void 0 || value === Infinity) return void 0;
+	if (typeof value !== "number" || Number.isNaN(value) || value < 1) throw new RangeError(`maxToolInputElements must be a number of at least 1, or Infinity, got ${String(value)}`);
+	return value;
+}
 /**
 * High-level MCP server that provides a simpler API for working with resources, tools, and prompts.
 * For advanced usage (like sending notifications or setting custom request handlers), use the underlying
@@ -23946,16 +24523,12 @@ var McpServer = class {
 	* The underlying {@linkcode Server} instance, useful for advanced operations like sending notifications.
 	*/
 	server;
+	_maxToolInputElements;
 	_registeredResources = {};
 	_registeredResourceTemplates = {};
 	_registeredTools = {};
 	_registeredPrompts = {};
-	/**
-	* Per-tool JSON-converted `inputSchema`, memoized so the SEP-2243
-	* registration-time scan and the pre-dispatch validation step share one
-	* conversion instead of paying it twice per request under the
-	* per-request-factory `createMcpHandler` model.
-	*/
+	/** Per-tool JSON-converted `inputSchema`, filled on first use by `toolInputSchemaJson()`. */
 	_toolInputSchemaJson = {};
 	/**
 	* The JSON-serialized `inputSchema` of a registered tool, or `undefined`
@@ -23980,6 +24553,7 @@ var McpServer = class {
 	}
 	constructor(serverInfo, options) {
 		this.server = new Server(serverInfo, options);
+		this._maxToolInputElements = resolveMaxToolInputElements(options?.maxToolInputElements);
 		if (options?.capabilities?.tools) this.setToolRequestHandlers();
 		if (options?.capabilities?.resources) this.setResourceRequestHandlers();
 		if (options?.capabilities?.prompts) this.setPromptRequestHandlers();
@@ -24051,7 +24625,7 @@ var McpServer = class {
 				name,
 				title: tool.title,
 				description: tool.description,
-				inputSchema: tool.inputSchema ? standardSchemaToJsonSchema(tool.inputSchema, "input") : EMPTY_OBJECT_JSON_SCHEMA,
+				inputSchema: tool.inputSchema ? convertListedInputSchema(name, tool.inputSchema) : EMPTY_OBJECT_JSON_SCHEMA,
 				annotations: tool.annotations,
 				icons: tool.icons,
 				execution: tool.execution,
@@ -24096,6 +24670,7 @@ var McpServer = class {
 	* Validates tool input arguments against the tool's input schema.
 	*/
 	async validateToolInput(tool, args, toolName) {
+		if (this._maxToolInputElements !== void 0 && toolInputElementCount(args, this._maxToolInputElements) > this._maxToolInputElements) throw new ProtocolError(ProtocolErrorCode.InvalidParams, `Invalid arguments for tool ${toolName}: arguments contain more than the maximum of ${this._maxToolInputElements} elements`);
 		if (!tool.inputSchema) return;
 		const parseResult = await validateStandardSchema(tool.inputSchema, args ?? {});
 		if (!parseResult.success) throw new ProtocolError(ProtocolErrorCode.InvalidParams, `Input validation error: Invalid arguments for tool ${toolName}: ${parseResult.error}`);
@@ -24369,19 +24944,19 @@ var McpServer = class {
 	}
 	_createRegisteredTool(name, title, description, inputSchema, outputSchema, annotations, icons, execution, scopeChallenge, _meta, handler) {
 		validateAndWarnToolName(name);
-		if (inputSchema !== void 0) try {
-			const json = standardSchemaToJsonSchema(inputSchema, "input");
-			this._toolInputSchemaJson[name] = json;
-			const scan = scanXMcpHeaderDeclarations(json);
-			if (!scan.valid) console.warn(`[mcp-sdk] tool '${name}' carries an invalid x-mcp-header declaration and will be excluded by conforming Streamable HTTP clients: ${scan.reason}`);
-		} catch {}
 		let currentHandler = handler;
+		let outputSchemaJson;
 		const registeredTool = {
 			title,
 			description,
 			inputSchema,
 			outputSchema,
-			outputSchemaJson: convertOutputSchemaJson(outputSchema),
+			get outputSchemaJson() {
+				return outputSchemaJson ??= convertOutputSchemaJson(registeredTool.outputSchema);
+			},
+			set outputSchemaJson(value) {
+				outputSchemaJson = value;
+			},
 			annotations,
 			icons,
 			execution,
@@ -24542,6 +25117,13 @@ const EMPTY_OBJECT_JSON_SCHEMA = {
 	type: "object",
 	properties: {}
 };
+/** Converts a tool's `inputSchema` for `tools/list` and warns on an invalid SEP-2243 `x-mcp-header` declaration. */
+function convertListedInputSchema(name, inputSchema) {
+	const json = standardSchemaToJsonSchema(inputSchema, "input");
+	const scan = scanXMcpHeaderDeclarations(json);
+	if (!scan.valid) console.warn(`[mcp-sdk] tool '${name}' carries an invalid x-mcp-header declaration and will be excluded by conforming Streamable HTTP clients: ${scan.reason}`);
+	return json;
+}
 /**
 * Convert a registered `outputSchema` to JSON Schema, memoised on {@link RegisteredTool.outputSchemaJson}
 * so `tools/call` passes the SAME advertised schema to the wire codec's `projectCallToolResult` that
@@ -24564,7 +25146,7 @@ function createPromptHandler(name, argsSchema, callback) {
 	if (argsSchema) {
 		const typedCallback = callback;
 		return async (args, ctx) => {
-			const parseResult = await validateStandardSchema(argsSchema, args);
+			const parseResult = await validateStandardSchema(argsSchema, args ?? {});
 			if (!parseResult.success) throw new ProtocolError(ProtocolErrorCode.InvalidParams, `Invalid arguments for prompt ${name}: ${parseResult.error}`);
 			return typedCallback(parseResult.data, ctx);
 		};
@@ -24601,7 +25183,7 @@ function unwrapOptionalSchema(schema) {
 	return schema.def?.innerType ?? schema;
 }
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+server@2.2.0/node_modules/@modelcontextprotocol/server/dist/index.mjs
+//#region node_modules/.pnpm/@modelcontextprotocol+server@2.3.1/node_modules/@modelcontextprotocol/server/dist/index.mjs
 /** Default upper bound, in bytes, on a request body read by the HTTP entry points (4 MiB). */
 const DEFAULT_MAX_REQUEST_BODY_SIZE = 4194304;
 /** Upper bound on the number of messages accepted in one JSON-RPC batch array. */
@@ -24690,6 +25272,10 @@ async function readRequestBody(request, maxBytes = DEFAULT_MAX_REQUEST_BODY_SIZE
 * @example Hono.js
 * ```ts source="./streamableHttp.examples.ts#WebStandardStreamableHTTPServerTransport_hono"
 * app.all('/mcp', async c => {
+*     // Stateless example: create a server and a transport per request.
+*     const server = new McpServer({ name: 'my-server', version: '1.0.0' });
+*     const transport = new WebStandardStreamableHTTPServerTransport({ sessionIdGenerator: undefined });
+*     await server.connect(transport);
 *     return transport.handleRequest(c.req.raw);
 * });
 * ```
@@ -24698,6 +25284,10 @@ async function readRequestBody(request, maxBytes = DEFAULT_MAX_REQUEST_BODY_SIZE
 * ```ts source="./streamableHttp.examples.ts#WebStandardStreamableHTTPServerTransport_workers"
 * const worker = {
 *     async fetch(request: Request): Promise<Response> {
+*         // Stateless example: create a server and a transport per request.
+*         const server = new McpServer({ name: 'my-server', version: '1.0.0' });
+*         const transport = new WebStandardStreamableHTTPServerTransport({ sessionIdGenerator: undefined });
+*         await server.connect(transport);
 *         return transport.handleRequest(request);
 *     }
 * };
@@ -24706,6 +25296,7 @@ async function readRequestBody(request, maxBytes = DEFAULT_MAX_REQUEST_BODY_SIZE
 var WebStandardStreamableHTTPServerTransport = class {
 	sessionIdGenerator;
 	_started = false;
+	_hasHandledRequest = false;
 	_closed = false;
 	_streamMapping = /* @__PURE__ */ new Map();
 	_requestToStreamMapping = /* @__PURE__ */ new Map();
@@ -24827,6 +25418,8 @@ var WebStandardStreamableHTTPServerTransport = class {
 	*/
 	async handleRequest(req, options) {
 		if (this._closed) return this.createJsonErrorResponse(404, -32001, "Session not found");
+		if (!this.sessionIdGenerator && this._hasHandledRequest) throw new Error("Stateless transport cannot be reused across requests. Create a new transport per request.");
+		this._hasHandledRequest = true;
 		const validationError = this.validateRequestHeaders(req);
 		if (validationError) return validationError;
 		switch (req.method) {
@@ -25342,339 +25935,6 @@ var WebStandardStreamableHTTPServerTransport = class {
 	}
 };
 //#endregion
-//#region src/constants.ts
-const positiveIntEnv = (name, fallback) => {
-	const raw = readEnv(name).value;
-	if (raw === void 0 || raw.trim() === "") return fallback;
-	const parsed = Number(raw);
-	return Number.isSafeInteger(parsed) && parsed > 0 ? parsed : fallback;
-};
-const CHARACTER_LIMIT = positiveIntEnv("RESPONSE_CHARACTER_LIMIT", 25e3);
-const ARTICLE_RESOURCES_SCAN_MAX_PAGES = positiveIntEnv("ARTICLE_RESOURCES_SCAN_MAX_PAGES", 20);
-const DEFAULT_CALLBACK_PORT = 27439;
-const MAX_ATTACHMENT_BYTES = positiveIntEnv("ATTACHMENT_MAX_BYTES", 5242880);
-const MAX_EMBEDDED_IMAGE_COUNT = positiveIntEnv("EMBEDDED_IMAGES_MAX", 10);
-const STDIO_MAX_MESSAGE_BYTES = 10485760;
-const MESSAGE_CONTENT_BUDGET_BYTES = 10420224;
-const MAX_RESPONSE_BYTES = Math.min(positiveIntEnv("RESPONSE_MAX_BYTES", MESSAGE_CONTENT_BUDGET_BYTES), MESSAGE_CONTENT_BUDGET_BYTES);
-const MAX_BASE64_INPUT_CHARS = MESSAGE_CONTENT_BUDGET_BYTES;
-const MAX_BASE64_INPUT_MB = Number.parseFloat((MAX_BASE64_INPUT_CHARS / 4 * 3 / 1048576).toFixed(2));
-const MAX_COMMENT_PAGES = positiveIntEnv("COMMENT_MAX_PAGES", 10);
-const TICKET_FIELD_SCAN_MAX_PAGES = positiveIntEnv("TICKET_FIELD_SCAN_MAX_PAGES", 10);
-const REORDER_CONFIRM_THRESHOLD = positiveIntEnv("REORDER_CONFIRM_THRESHOLD", 20);
-const getBaseUrl = (subdomain) => `https://${subdomain}.zendesk.com/api/v2`;
-const getHelpCenterBaseUrl = (subdomain) => `https://${subdomain}.zendesk.com/api/v2/help_center`;
-const getOAuthUrls = (subdomain) => ({
-	authorizeUrl: `https://${subdomain}.zendesk.com/oauth/authorizations/new`,
-	tokenUrl: `https://${subdomain}.zendesk.com/oauth/tokens`
-});
-//#endregion
-//#region src/client/retry.ts
-const MAX_ATTEMPTS = 3;
-const BASE_DELAY_MS = 250;
-const MAX_DELAY_MS = 4e3;
-const REQUEST_TIMEOUT_MS = 3e4;
-const TRANSFER_TIMEOUT_MS = 12e4;
-/**
-* A deadline for one attempt. The abort surfaces as a `TimeoutError` whose `code`
-* is numeric, not a syscall string, so it classifies as `unknown`: a GET is
-* retried, a write is not — the request may have arrived before the deadline.
-*/
-const deadlineSignal = (timeoutMs) => AbortSignal.timeout(timeoutMs);
-const MAX_RETRY_AFTER_MS = 5e3;
-const POLICIES = {
-	GET: {
-		network: "any",
-		serverErrors: true
-	},
-	DELETE: {
-		network: "pre-send",
-		serverErrors: false
-	},
-	POST: {
-		network: "pre-send",
-		serverErrors: false
-	},
-	PUT: {
-		network: "pre-send",
-		serverErrors: false
-	}
-};
-const DELAY_SECONDS = /^\d+$/;
-const HTTP_DATE_START = /^[A-Za-z]/;
-const NON_ASCII = /[^ -~]/g;
-const TOKEN_SEGMENT = /\/token\/[^/]+/;
-const URL_IN_TEXT = /[a-z][a-z0-9+.-]*:\/\/\S+/gi;
-const PRE_SEND_CODES = /* @__PURE__ */ new Set([
-	"ENOTFOUND",
-	"EAI_AGAIN",
-	"ECONNREFUSED",
-	"UND_ERR_CONNECT_TIMEOUT"
-]);
-const defaultRetryDeps = {
-	sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
-	random: Math.random
-};
-/** Non-ASCII bytes break `node:http` headers, so client error text stays ASCII. */
-const toAscii = (text) => text.replace(NON_ASCII, "?");
-/**
-* Identifies the request without leaking a credential: uploads carry an upload
-* token in the query string, and an attachment `content_url` carries a download
-* token as a path segment (`/attachments/token/<token>/`).
-*/
-const describeTarget = (url) => {
-	const { origin, pathname } = new URL(url);
-	return `${origin}${pathname.replace(TOKEN_SEGMENT, "/token/[redacted]")}`;
-};
-/** First `code` in the cause chain, inspecting 5 levels so a cycle cannot hang. */
-const errorCode = (err) => {
-	let current = err;
-	for (let depth = 0; depth < 5 && current !== null && typeof current === "object"; depth += 1) {
-		const { code, cause } = current;
-		if (typeof code === "string") return code;
-		current = cause;
-	}
-};
-const classifyNetworkError = (err) => PRE_SEND_CODES.has(errorCode(err)) ? "pre-send" : "unknown";
-const UNINFORMATIVE_NAMES = /* @__PURE__ */ new Set(["Error", "TypeError"]);
-/**
-* The client refuses to replay a write that may have landed — but the caller is
-* an LLM whose reflex on a failed tool call is to try again, which would undo
-* that. So a failed write says whether it may have taken effect. ASCII only,
-* same rule as the rest of the message.
-*/
-const MAY_HAVE_APPLIED_NOTE = "The write may already have been applied. Check the current state before retrying, or you may duplicate it.";
-const NEVER_SENT_NOTE = "The request never reached Zendesk, so nothing was applied. Retrying is safe.";
-const REFUSED_NOTE = "Zendesk refused the request, so nothing was applied. Retrying is safe.";
-/** Only a write can be duplicated by a replay, so only a write carries a note. */
-const writeNote = (method, note) => method === "GET" ? "" : ` ${note}`;
-/**
-* A cause message can quote the URL it failed on — Node's `fetch` refuses a URL
-* carrying credentials by printing the whole thing, query string included — which
-* would smuggle back exactly what `describeTarget` drops. Same treatment for both,
-* so one function owns what a URL may look like in our output.
-*/
-const redactUrls = (text) => text.replace(URL_IN_TEXT, (found) => {
-	try {
-		return new URL(found).origin === "null" ? "[url]" : describeTarget(found);
-	} catch {
-		return "[url]";
-	}
-});
-const failureDetail = (cause) => {
-	if (!(cause instanceof Error)) return redactUrls(String(cause));
-	const message = redactUrls(cause.message);
-	const code = errorCode(cause);
-	if (code !== void 0) return `${code}: ${message}`;
-	return UNINFORMATIVE_NAMES.has(cause.name) ? message : `${cause.name}: ${message}`;
-};
-const networkErrorMessage = (method, target, attempts, cause) => {
-	const base = `Network error on ${method} ${target} after ${attempts === 1 ? "1 attempt" : `${attempts} attempts`}: ${failureDetail(cause)}`;
-	const note = classifyNetworkError(cause) === "pre-send" ? NEVER_SENT_NOTE : MAY_HAVE_APPLIED_NOTE;
-	return toAscii(method === "GET" ? base : `${base}.${writeNote(method, note)}`);
-};
-const createZendeskNetworkError = (method, target, attempts, cause) => Object.assign(new Error(networkErrorMessage(method, target, attempts, cause), { cause }), {
-	name: "ZendeskNetworkError",
-	method,
-	target,
-	attempts
-});
-/** Exponential backoff with equal jitter: half the window fixed, half random. */
-const computeBackoffMs = (attempt, random) => {
-	const window = Math.min(BASE_DELAY_MS * 2 ** (attempt - 1), MAX_DELAY_MS);
-	return Math.round(window / 2 + window * random() / 2);
-};
-/** `Retry-After` in ms — delay-seconds or HTTP-date. */
-const parseRetryAfter = (header, now = Date.now()) => {
-	if (header === null) return void 0;
-	const value = header.trim();
-	if (DELAY_SECONDS.test(value)) return Number(value) * 1e3;
-	if (!HTTP_DATE_START.test(value)) return void 0;
-	const date = Date.parse(value);
-	if (Number.isNaN(date)) return void 0;
-	return Math.max(0, date - now);
-};
-/**
-* How long to wait before replaying this response, or undefined to accept it.
-* `Retry-After` wins over backoff wherever it appears — Zendesk sends it on a 503
-* during maintenance as well as on a 429 — and a value past the cap means the
-* response is surfaced rather than parking the call for that long.
-*/
-const retryDelayFor = (response, policy, attempt, random) => {
-	if (!(response.status === 429 || response.status >= 500 && policy.serverErrors)) return void 0;
-	const retryAfter = parseRetryAfter(response.headers.get("retry-after"));
-	if (retryAfter === void 0) return computeBackoffMs(attempt, random);
-	return retryAfter > MAX_RETRY_AFTER_MS ? void 0 : retryAfter;
-};
-/**
-* Runs `attempt` until it succeeds, hits a terminal outcome, or spends the
-* attempt budget. Returns the last response for the caller to inspect (a
-* non-ok status is still the caller's to turn into a `ZendeskApiError`), and
-* throws `ZendeskNetworkError` when no response was ever obtained.
-*/
-const fetchWithRetry = async (attempt, method, target, deps = defaultRetryDeps) => {
-	const policy = POLICIES[method];
-	for (let tries = 1;; tries += 1) {
-		const last = tries >= MAX_ATTEMPTS;
-		let response;
-		try {
-			response = await attempt();
-		} catch (err) {
-			const replayable = policy.network === "any" || classifyNetworkError(err) === policy.network;
-			if (last || !replayable) throw createZendeskNetworkError(method, target, tries, err);
-			await deps.sleep(computeBackoffMs(tries, deps.random));
-			continue;
-		}
-		if (last) return response;
-		const delayMs = retryDelayFor(response, policy, tries, deps.random);
-		if (delayMs === void 0) return response;
-		await response.text().catch(() => void 0);
-		await deps.sleep(delayMs);
-	}
-};
-//#endregion
-//#region src/client/zendesk-api.ts
-var ZendeskApiError = class ZendeskApiError extends Error {
-	status;
-	statusText;
-	body;
-	method;
-	constructor(status, statusText, body, method) {
-		super(ZendeskApiError.buildMessage(status, statusText, body, method));
-		this.status = status;
-		this.statusText = statusText;
-		this.body = body;
-		this.method = method;
-		this.name = "ZendeskApiError";
-	}
-	static buildMessage(status, statusText, body, method) {
-		switch (status) {
-			case 401: return "Authentication failed. Your Zendesk token may be expired or invalid. Re-authenticate to get a new token.";
-			case 403: return "Permission denied. Your Zendesk account does not have access to this resource.";
-			case 404: return `Resource not found. Please verify the ID is correct. (${statusText})`;
-			case 422: return `Validation error: ${body}`;
-			case 429: return `Rate limit exceeded. Please wait before making more requests.${writeNote(method, REFUSED_NOTE)}`;
-			default: {
-				const message = `Zendesk API error ${status}: ${statusText}. ${body}`;
-				return status >= 500 ? `${message}${writeNote(method, MAY_HAVE_APPLIED_NOTE)}` : message;
-			}
-		}
-	}
-};
-const buildAuthHeader = (token) => `Bearer ${token}`;
-const buildUrl = (base, path, params) => {
-	const url = new URL(`${base}${path}`);
-	if (params) for (const [key, value] of Object.entries(params)) url.searchParams.set(key, value);
-	return url.toString();
-};
-const performFetch = (method, url, init, timeoutMs = REQUEST_TIMEOUT_MS) => fetchWithRetry(() => fetch(url, {
-	...init,
-	method,
-	signal: deadlineSignal(timeoutMs)
-}), method, describeTarget(url));
-const executeRequest = async (url, token, options = {}) => {
-	const { method = "GET", body } = options;
-	const headers = {
-		Authorization: buildAuthHeader(token),
-		Accept: "application/json"
-	};
-	if (body) headers["Content-Type"] = "application/json";
-	const init = { headers };
-	if (body) init.body = JSON.stringify(body);
-	const response = await performFetch(method, url, init);
-	if (!response.ok) {
-		const responseBody = await response.text();
-		throw new ZendeskApiError(response.status, response.statusText, responseBody, method);
-	}
-	if (response.status === 204) return {};
-	return response.json();
-};
-const zendeskGet = (subdomain, token, path, params) => {
-	const url = buildUrl(getBaseUrl(subdomain), path, params);
-	return executeRequest(url, token);
-};
-const zendeskPost = (subdomain, token, path, body) => {
-	const url = buildUrl(getBaseUrl(subdomain), path);
-	return executeRequest(url, token, {
-		method: "POST",
-		body
-	});
-};
-const zendeskPut = (subdomain, token, path, body) => {
-	const url = buildUrl(getBaseUrl(subdomain), path);
-	return executeRequest(url, token, {
-		method: "PUT",
-		body
-	});
-};
-const helpCenterGet = (subdomain, token, path, params) => {
-	const url = buildUrl(getHelpCenterBaseUrl(subdomain), path, params);
-	return executeRequest(url, token);
-};
-const helpCenterPost = (subdomain, token, path, body) => {
-	const url = buildUrl(getHelpCenterBaseUrl(subdomain), path);
-	return executeRequest(url, token, {
-		method: "POST",
-		body
-	});
-};
-const helpCenterPut = (subdomain, token, path, body) => {
-	const url = buildUrl(getHelpCenterBaseUrl(subdomain), path);
-	return executeRequest(url, token, {
-		method: "PUT",
-		body
-	});
-};
-const helpCenterDelete = (subdomain, token, path) => {
-	const url = buildUrl(getHelpCenterBaseUrl(subdomain), path);
-	return executeRequest(url, token, { method: "DELETE" });
-};
-const fetchZendeskBinary = async (subdomain, token, contentUrl) => {
-	const expectedHost = `${subdomain}.zendesk.com`;
-	const headers = {};
-	if (new URL(contentUrl).hostname === expectedHost) headers["Authorization"] = buildAuthHeader(token);
-	const response = await performFetch("GET", contentUrl, { headers }, TRANSFER_TIMEOUT_MS);
-	if (!response.ok) {
-		const body = await response.text();
-		throw new ZendeskApiError(response.status, response.statusText, body, "GET");
-	}
-	const contentType = response.headers.get("content-type") ?? "application/octet-stream";
-	const arrayBuffer = await response.arrayBuffer();
-	return {
-		data: Buffer.from(arrayBuffer),
-		contentType
-	};
-};
-const zendeskUpload = async (subdomain, token, filename, data, contentType, uploadToken) => {
-	const params = { filename };
-	if (uploadToken) params["token"] = uploadToken;
-	const url = buildUrl(getBaseUrl(subdomain), "/uploads", params);
-	const response = await performFetch("POST", url, {
-		headers: {
-			Authorization: buildAuthHeader(token),
-			"Content-Type": contentType
-		},
-		body: data
-	}, TRANSFER_TIMEOUT_MS);
-	if (!response.ok) {
-		const responseBody = await response.text();
-		throw new ZendeskApiError(response.status, response.statusText, responseBody, "POST");
-	}
-	return response.json();
-};
-const helpCenterUpload = async (subdomain, token, path, formData) => {
-	const url = buildUrl(getHelpCenterBaseUrl(subdomain), path);
-	const response = await performFetch("POST", url, {
-		headers: { Authorization: buildAuthHeader(token) },
-		body: formData
-	}, TRANSFER_TIMEOUT_MS);
-	if (!response.ok) {
-		const responseBody = await response.text();
-		throw new ZendeskApiError(response.status, response.statusText, responseBody, "POST");
-	}
-	return response.json();
-};
-//#endregion
 //#region node_modules/.pnpm/cheerio@1.2.0/node_modules/cheerio/dist/esm/options.js
 const defaultOpts$2 = { _useHtmlParser2: false };
 /**
@@ -83005,7 +83265,7 @@ function escapeStringRegexp(string) {
 	return string.replace(/[|\\{}()[\]^$+*?.]/g, "\\$&").replace(/-/g, "\\x2d");
 }
 //#endregion
-//#region node_modules/.pnpm/mdast-util-find-and-replace@3.0.2/node_modules/mdast-util-find-and-replace/lib/index.js
+//#region node_modules/.pnpm/mdast-util-find-and-replace@3.0.3/node_modules/mdast-util-find-and-replace/lib/index.js
 /**
 * @import {Nodes, Parents, PhrasingContent, Root, Text} from 'mdast'
 * @import {BuildVisitor, Test, VisitorResult} from 'unist-util-visit-parents'
@@ -83082,7 +83342,11 @@ function findAndReplace(tree, list, options) {
 	const pairs = toPairs(list);
 	let pairIndex = -1;
 	while (++pairIndex < pairs.length) visitParents(tree, "text", visitor);
-	/** @type {BuildVisitor<Root, 'text'>} */
+	/**
+	* Visit a text node, and handle it if it is not in an ignored parent.
+	*
+	* @type {BuildVisitor<Root, 'text'>}
+	*/
 	function visitor(node, parents) {
 		let index = -1;
 		/** @type {Parents | undefined} */
@@ -83100,11 +83364,11 @@ function findAndReplace(tree, list, options) {
 	* Handle a text node which is not in an ignored parent.
 	*
 	* @param {Text} node
-	*   Text node.
+	*   Text node to search in.
 	* @param {Array<Parents>} parents
-	*   Parents.
+	*   Ancestors of `node`.
 	* @returns {VisitorResult}
-	*   Result.
+	*   Where to continue visiting.
 	*/
 	function handler(node, parents) {
 		const parent = parents[parents.length - 1];
@@ -83132,12 +83396,12 @@ function findAndReplace(tree, list, options) {
 			} : void 0;
 			if (value === false) find.lastIndex = position + 1;
 			else {
-				if (start !== position) nodes.push({
+				if (start !== position) add({
 					type: "text",
 					value: node.value.slice(start, position)
 				});
-				if (Array.isArray(value)) nodes.push(...value);
-				else if (value) nodes.push(value);
+				if (Array.isArray(value)) for (const child of value) add(child);
+				else if (value) add(value);
 				start = position + match[0].length;
 				change = true;
 			}
@@ -83145,13 +83409,26 @@ function findAndReplace(tree, list, options) {
 			match = find.exec(node.value);
 		}
 		if (change) {
-			if (start < node.value.length) nodes.push({
+			if (start < node.value.length) add({
 				type: "text",
 				value: node.value.slice(start)
 			});
 			parent.children.splice(index, 1, ...nodes);
 		} else nodes = [node];
 		return index + nodes.length;
+		/**
+		* Add a node.
+		*
+		* @param {PhrasingContent} child
+		*   Node to add.
+		* @returns {undefined}
+		*   Nothing.
+		*/
+		function add(child) {
+			const previous = nodes[nodes.length - 1];
+			if (previous && previous.type === "text" && child.type === "text") previous.value += child.value;
+			else nodes.push(child);
+		}
 	}
 }
 /**
@@ -83163,9 +83440,9 @@ function findAndReplace(tree, list, options) {
 *   Clean pairs.
 */
 function toPairs(tupleOrList) {
+	if (!Array.isArray(tupleOrList)) throw new TypeError("Expected find and replace tuple or list of tuples");
 	/** @type {Pairs} */
 	const result = [];
-	if (!Array.isArray(tupleOrList)) throw new TypeError("Expected find and replace tuple or list of tuples");
 	/** @type {FindAndReplaceList} */
 	const list = !tupleOrList[0] || Array.isArray(tupleOrList[0]) ? tupleOrList : [tupleOrList];
 	let index = -1;
@@ -83179,9 +83456,9 @@ function toPairs(tupleOrList) {
 * Turn a find into an expression.
 *
 * @param {Find} find
-*   Find.
+*   Pattern to find.
 * @returns {RegExp}
-*   Expression.
+*   Global expression.
 */
 function toExpression(find) {
 	return typeof find === "string" ? new RegExp(escapeStringRegexp(find), "g") : find;
@@ -83190,9 +83467,9 @@ function toExpression(find) {
 * Turn a replace into a function.
 *
 * @param {Replace} replace
-*   Replace.
+*   Thing to replace with.
 * @returns {ReplaceFunction}
-*   Function.
+*   Function that returns that thing.
 */
 function toFunction(replace) {
 	return typeof replace === "function" ? replace : function() {
@@ -84056,7 +84333,7 @@ function toAlignment(value) {
 	return code === 67 || code === 99 ? 99 : code === 76 || code === 108 ? 108 : code === 82 || code === 114 ? 114 : 0;
 }
 //#endregion
-//#region node_modules/.pnpm/mdast-util-to-markdown@2.1.3/node_modules/mdast-util-to-markdown/lib/configure.js
+//#region node_modules/.pnpm/mdast-util-to-markdown@2.2.0/node_modules/mdast-util-to-markdown/lib/configure.js
 /**
 * @import {Options, State} from './types.js'
 */
@@ -84123,7 +84400,7 @@ function map$2(left, right) {
 	if (right) Object.assign(left, right);
 }
 //#endregion
-//#region node_modules/.pnpm/mdast-util-to-markdown@2.1.3/node_modules/mdast-util-to-markdown/lib/handle/blockquote.js
+//#region node_modules/.pnpm/mdast-util-to-markdown@2.2.0/node_modules/mdast-util-to-markdown/lib/handle/blockquote.js
 /**
 * @import {Blockquote, Parents} from 'mdast'
 * @import {Info, Map, State} from 'mdast-util-to-markdown'
@@ -84160,7 +84437,7 @@ function map$1(line, _, blank) {
 	return ">" + (blank ? "" : " ") + line;
 }
 //#endregion
-//#region node_modules/.pnpm/mdast-util-to-markdown@2.1.3/node_modules/mdast-util-to-markdown/lib/util/pattern-in-scope.js
+//#region node_modules/.pnpm/mdast-util-to-markdown@2.2.0/node_modules/mdast-util-to-markdown/lib/util/pattern-in-scope.js
 /**
 * @import {ConstructName, Unsafe} from 'mdast-util-to-markdown'
 */
@@ -84197,7 +84474,7 @@ function listInScope(stack, list, none) {
 	return false;
 }
 //#endregion
-//#region node_modules/.pnpm/mdast-util-to-markdown@2.1.3/node_modules/mdast-util-to-markdown/lib/handle/break.js
+//#region node_modules/.pnpm/mdast-util-to-markdown@2.2.0/node_modules/mdast-util-to-markdown/lib/handle/break.js
 /**
 * @import {Break, Parents} from 'mdast'
 * @import {Info, State} from 'mdast-util-to-markdown'
@@ -84253,7 +84530,7 @@ function longestStreak(value, substring) {
 	return max;
 }
 //#endregion
-//#region node_modules/.pnpm/mdast-util-to-markdown@2.1.3/node_modules/mdast-util-to-markdown/lib/util/format-code-as-indented.js
+//#region node_modules/.pnpm/mdast-util-to-markdown@2.2.0/node_modules/mdast-util-to-markdown/lib/util/format-code-as-indented.js
 /**
 * @import {State} from 'mdast-util-to-markdown'
 * @import {Code} from 'mdast'
@@ -84272,7 +84549,7 @@ function formatCodeAsIndented(node, state) {
 	return Boolean(state.options.fences === false && node.value && !node.lang && /[^\n\r ]/.test(node.value) && !/^[\t ]*(?:[\n\r]|$)|(?:^|[\n\r])[\t ]*$/.test(node.value));
 }
 //#endregion
-//#region node_modules/.pnpm/mdast-util-to-markdown@2.1.3/node_modules/mdast-util-to-markdown/lib/util/check-fence.js
+//#region node_modules/.pnpm/mdast-util-to-markdown@2.2.0/node_modules/mdast-util-to-markdown/lib/util/check-fence.js
 /**
 * @import {Options, State} from 'mdast-util-to-markdown'
 */
@@ -84290,7 +84567,7 @@ function checkFence(state) {
 	return marker;
 }
 //#endregion
-//#region node_modules/.pnpm/mdast-util-to-markdown@2.1.3/node_modules/mdast-util-to-markdown/lib/handle/code.js
+//#region node_modules/.pnpm/mdast-util-to-markdown@2.2.0/node_modules/mdast-util-to-markdown/lib/handle/code.js
 /**
 * @import {Info, Map, State} from 'mdast-util-to-markdown'
 * @import {Code, Parents} from 'mdast'
@@ -84359,7 +84636,7 @@ function map(line, _, blank) {
 	return (blank ? "" : "    ") + line;
 }
 //#endregion
-//#region node_modules/.pnpm/mdast-util-to-markdown@2.1.3/node_modules/mdast-util-to-markdown/lib/util/check-quote.js
+//#region node_modules/.pnpm/mdast-util-to-markdown@2.2.0/node_modules/mdast-util-to-markdown/lib/util/check-quote.js
 /**
 * @import {Options, State} from 'mdast-util-to-markdown'
 */
@@ -84377,7 +84654,7 @@ function checkQuote(state) {
 	return marker;
 }
 //#endregion
-//#region node_modules/.pnpm/mdast-util-to-markdown@2.1.3/node_modules/mdast-util-to-markdown/lib/handle/definition.js
+//#region node_modules/.pnpm/mdast-util-to-markdown@2.2.0/node_modules/mdast-util-to-markdown/lib/handle/definition.js
 /**
 * @import {Info, State} from 'mdast-util-to-markdown'
 * @import {Definition, Parents} from 'mdast'
@@ -84443,7 +84720,7 @@ function definition$1(node, _, state, info) {
 	return value;
 }
 //#endregion
-//#region node_modules/.pnpm/mdast-util-to-markdown@2.1.3/node_modules/mdast-util-to-markdown/lib/util/check-emphasis.js
+//#region node_modules/.pnpm/mdast-util-to-markdown@2.2.0/node_modules/mdast-util-to-markdown/lib/util/check-emphasis.js
 /**
 * @import {Options, State} from 'mdast-util-to-markdown'
 */
@@ -84461,7 +84738,7 @@ function checkEmphasis(state) {
 	return marker;
 }
 //#endregion
-//#region node_modules/.pnpm/mdast-util-to-markdown@2.1.3/node_modules/mdast-util-to-markdown/lib/handle/emphasis.js
+//#region node_modules/.pnpm/mdast-util-to-markdown@2.2.0/node_modules/mdast-util-to-markdown/lib/handle/emphasis.js
 /**
 * @import {AttentionInfo, Info, State} from 'mdast-util-to-markdown'
 * @import {Emphasis, Parents} from 'mdast'
@@ -84526,7 +84803,7 @@ function peek$1(_, _1, state) {
 	return state.options.emphasis || "*";
 }
 //#endregion
-//#region node_modules/.pnpm/mdast-util-to-markdown@2.1.3/node_modules/mdast-util-to-markdown/lib/util/encode-character-reference.js
+//#region node_modules/.pnpm/mdast-util-to-markdown@2.2.0/node_modules/mdast-util-to-markdown/lib/util/encode-character-reference.js
 /**
 * Encode a code point as a character reference.
 *
@@ -84539,7 +84816,7 @@ function encodeCharacterReference(code) {
 	return "&#x" + code.toString(16).toUpperCase() + ";";
 }
 //#endregion
-//#region node_modules/.pnpm/mdast-util-to-markdown@2.1.3/node_modules/mdast-util-to-markdown/lib/util/format-heading-as-setext.js
+//#region node_modules/.pnpm/mdast-util-to-markdown@2.2.0/node_modules/mdast-util-to-markdown/lib/util/format-heading-as-setext.js
 /**
 * @import {State} from 'mdast-util-to-markdown'
 * @import {Heading} from 'mdast'
@@ -84565,7 +84842,7 @@ function formatHeadingAsSetext(node, state) {
 	return Boolean((!node.depth || node.depth < 3) && toString(node) && (state.options.setext || literalWithBreak));
 }
 //#endregion
-//#region node_modules/.pnpm/mdast-util-to-markdown@2.1.3/node_modules/mdast-util-to-markdown/lib/handle/heading.js
+//#region node_modules/.pnpm/mdast-util-to-markdown@2.2.0/node_modules/mdast-util-to-markdown/lib/handle/heading.js
 /**
 * @import {Info, State} from 'mdast-util-to-markdown'
 * @import {Heading, Parents} from 'mdast'
@@ -84617,7 +84894,7 @@ function heading$1(node, _, state, info) {
 	return value;
 }
 //#endregion
-//#region node_modules/.pnpm/mdast-util-to-markdown@2.1.3/node_modules/mdast-util-to-markdown/lib/handle/html.js
+//#region node_modules/.pnpm/mdast-util-to-markdown@2.2.0/node_modules/mdast-util-to-markdown/lib/handle/html.js
 /**
 * @import {Html} from 'mdast'
 */
@@ -84643,7 +84920,7 @@ function htmlPeek() {
 	return "<";
 }
 //#endregion
-//#region node_modules/.pnpm/mdast-util-to-markdown@2.1.3/node_modules/mdast-util-to-markdown/lib/handle/image.js
+//#region node_modules/.pnpm/mdast-util-to-markdown@2.2.0/node_modules/mdast-util-to-markdown/lib/handle/image.js
 /**
 * @import {Info, State} from 'mdast-util-to-markdown'
 * @import {Image, Parents} from 'mdast'
@@ -84720,7 +84997,7 @@ function imagePeek() {
 	return "!";
 }
 //#endregion
-//#region node_modules/.pnpm/mdast-util-to-markdown@2.1.3/node_modules/mdast-util-to-markdown/lib/handle/image-reference.js
+//#region node_modules/.pnpm/mdast-util-to-markdown@2.2.0/node_modules/mdast-util-to-markdown/lib/handle/image-reference.js
 /**
 * @import {Info, State} from 'mdast-util-to-markdown'
 * @import {ImageReference, Parents} from 'mdast'
@@ -84781,7 +85058,7 @@ function imageReferencePeek() {
 	return "!";
 }
 //#endregion
-//#region node_modules/.pnpm/mdast-util-to-markdown@2.1.3/node_modules/mdast-util-to-markdown/lib/handle/inline-code.js
+//#region node_modules/.pnpm/mdast-util-to-markdown@2.2.0/node_modules/mdast-util-to-markdown/lib/handle/inline-code.js
 /**
 * @import {State} from 'mdast-util-to-markdown'
 * @import {InlineCode, Parents} from 'mdast'
@@ -84829,7 +85106,7 @@ function inlineCodePeek() {
 	return "`";
 }
 //#endregion
-//#region node_modules/.pnpm/mdast-util-to-markdown@2.1.3/node_modules/mdast-util-to-markdown/lib/util/format-link-as-autolink.js
+//#region node_modules/.pnpm/mdast-util-to-markdown@2.2.0/node_modules/mdast-util-to-markdown/lib/util/format-link-as-autolink.js
 /**
 * @import {State} from 'mdast-util-to-markdown'
 * @import {Link} from 'mdast'
@@ -84849,7 +85126,7 @@ function formatLinkAsAutolink(node, state) {
 	return Boolean(!state.options.resourceLink && node.url && !node.title && node.children && node.children.length === 1 && node.children[0].type === "text" && (raw === node.url || "mailto:" + raw === node.url) && /^[a-z][+\-.a-z]+:/i.test(node.url) && !/[\0- <>\u007F]/.test(node.url));
 }
 //#endregion
-//#region node_modules/.pnpm/mdast-util-to-markdown@2.1.3/node_modules/mdast-util-to-markdown/lib/handle/link.js
+//#region node_modules/.pnpm/mdast-util-to-markdown@2.2.0/node_modules/mdast-util-to-markdown/lib/handle/link.js
 /**
 * @import {Info, State} from 'mdast-util-to-markdown'
 * @import {Link, Parents} from 'mdast'
@@ -84950,7 +85227,7 @@ function linkPeek(node, _, state) {
 	return formatLinkAsAutolink(node, state) ? "<" : "[";
 }
 //#endregion
-//#region node_modules/.pnpm/mdast-util-to-markdown@2.1.3/node_modules/mdast-util-to-markdown/lib/handle/link-reference.js
+//#region node_modules/.pnpm/mdast-util-to-markdown@2.2.0/node_modules/mdast-util-to-markdown/lib/handle/link-reference.js
 /**
 * @import {Info, State} from 'mdast-util-to-markdown'
 * @import {LinkReference, Parents} from 'mdast'
@@ -85011,7 +85288,7 @@ function linkReferencePeek() {
 	return "[";
 }
 //#endregion
-//#region node_modules/.pnpm/mdast-util-to-markdown@2.1.3/node_modules/mdast-util-to-markdown/lib/util/check-bullet.js
+//#region node_modules/.pnpm/mdast-util-to-markdown@2.2.0/node_modules/mdast-util-to-markdown/lib/util/check-bullet.js
 /**
 * @import {Options, State} from 'mdast-util-to-markdown'
 */
@@ -85029,7 +85306,7 @@ function checkBullet(state) {
 	return marker;
 }
 //#endregion
-//#region node_modules/.pnpm/mdast-util-to-markdown@2.1.3/node_modules/mdast-util-to-markdown/lib/util/check-bullet-other.js
+//#region node_modules/.pnpm/mdast-util-to-markdown@2.2.0/node_modules/mdast-util-to-markdown/lib/util/check-bullet-other.js
 /**
 * @import {Options, State} from 'mdast-util-to-markdown'
 */
@@ -85050,7 +85327,7 @@ function checkBulletOther(state) {
 	return bulletOther;
 }
 //#endregion
-//#region node_modules/.pnpm/mdast-util-to-markdown@2.1.3/node_modules/mdast-util-to-markdown/lib/util/check-bullet-ordered.js
+//#region node_modules/.pnpm/mdast-util-to-markdown@2.2.0/node_modules/mdast-util-to-markdown/lib/util/check-bullet-ordered.js
 /**
 * @import {Options, State} from 'mdast-util-to-markdown'
 */
@@ -85068,7 +85345,7 @@ function checkBulletOrdered(state) {
 	return marker;
 }
 //#endregion
-//#region node_modules/.pnpm/mdast-util-to-markdown@2.1.3/node_modules/mdast-util-to-markdown/lib/util/check-rule.js
+//#region node_modules/.pnpm/mdast-util-to-markdown@2.2.0/node_modules/mdast-util-to-markdown/lib/util/check-rule.js
 /**
 * @import {Options, State} from 'mdast-util-to-markdown'
 */
@@ -85086,7 +85363,7 @@ function checkRule(state) {
 	return marker;
 }
 //#endregion
-//#region node_modules/.pnpm/mdast-util-to-markdown@2.1.3/node_modules/mdast-util-to-markdown/lib/handle/list.js
+//#region node_modules/.pnpm/mdast-util-to-markdown@2.2.0/node_modules/mdast-util-to-markdown/lib/handle/list.js
 /**
 * @import {Info, State} from 'mdast-util-to-markdown'
 * @import {List, Parents} from 'mdast'
@@ -85136,7 +85413,7 @@ function list$2(node, parent, state, info) {
 	return value;
 }
 //#endregion
-//#region node_modules/.pnpm/mdast-util-to-markdown@2.1.3/node_modules/mdast-util-to-markdown/lib/util/check-list-item-indent.js
+//#region node_modules/.pnpm/mdast-util-to-markdown@2.2.0/node_modules/mdast-util-to-markdown/lib/util/check-list-item-indent.js
 /**
 * @import {Options, State} from 'mdast-util-to-markdown'
 */
@@ -85154,7 +85431,7 @@ function checkListItemIndent(state) {
 	return style;
 }
 //#endregion
-//#region node_modules/.pnpm/mdast-util-to-markdown@2.1.3/node_modules/mdast-util-to-markdown/lib/handle/list-item.js
+//#region node_modules/.pnpm/mdast-util-to-markdown@2.2.0/node_modules/mdast-util-to-markdown/lib/handle/list-item.js
 /**
 * @import {Info, Map, State} from 'mdast-util-to-markdown'
 * @import {ListItem, Parents} from 'mdast'
@@ -85197,7 +85474,7 @@ function listItem$1(node, parent, state, info) {
 	}
 }
 //#endregion
-//#region node_modules/.pnpm/mdast-util-to-markdown@2.1.3/node_modules/mdast-util-to-markdown/lib/handle/paragraph.js
+//#region node_modules/.pnpm/mdast-util-to-markdown@2.2.0/node_modules/mdast-util-to-markdown/lib/handle/paragraph.js
 /**
 * @import {Info, State} from 'mdast-util-to-markdown'
 * @import {Paragraph, Parents} from 'mdast'
@@ -85225,7 +85502,7 @@ function paragraph$1(node, _, state, info) {
 	return value;
 }
 //#endregion
-//#region node_modules/.pnpm/mdast-util-to-markdown@2.1.3/node_modules/mdast-util-to-markdown/lib/handle/root.js
+//#region node_modules/.pnpm/mdast-util-to-markdown@2.2.0/node_modules/mdast-util-to-markdown/lib/handle/root.js
 /**
 * @import {Info, State} from 'mdast-util-to-markdown'
 * @import {Parents, Root} from 'mdast'
@@ -85254,7 +85531,7 @@ function root$1(node, _, state, info) {
 	return value;
 }
 //#endregion
-//#region node_modules/.pnpm/mdast-util-to-markdown@2.1.3/node_modules/mdast-util-to-markdown/lib/util/check-strong.js
+//#region node_modules/.pnpm/mdast-util-to-markdown@2.2.0/node_modules/mdast-util-to-markdown/lib/util/check-strong.js
 /**
 * @import {Options, State} from 'mdast-util-to-markdown'
 */
@@ -85272,7 +85549,7 @@ function checkStrong(state) {
 	return marker;
 }
 //#endregion
-//#region node_modules/.pnpm/mdast-util-to-markdown@2.1.3/node_modules/mdast-util-to-markdown/lib/handle/strong.js
+//#region node_modules/.pnpm/mdast-util-to-markdown@2.2.0/node_modules/mdast-util-to-markdown/lib/handle/strong.js
 /**
 * @import {AttentionInfo, Info, State} from 'mdast-util-to-markdown'
 * @import {Parents, Strong} from 'mdast'
@@ -85337,7 +85614,7 @@ function peek(_, _1, state) {
 	return state.options.strong || "*";
 }
 //#endregion
-//#region node_modules/.pnpm/mdast-util-to-markdown@2.1.3/node_modules/mdast-util-to-markdown/lib/handle/text.js
+//#region node_modules/.pnpm/mdast-util-to-markdown@2.2.0/node_modules/mdast-util-to-markdown/lib/handle/text.js
 /**
 * @import {Info, State} from 'mdast-util-to-markdown'
 * @import {Parents, Text} from 'mdast'
@@ -85347,7 +85624,7 @@ function peek(_, _1, state) {
 *
 * @param {Text} node
 *   Node to serialize.
-* @param {Parents | undefined} _
+* @param {Parents | undefined} parent
 *   Parent node.
 * @param {State} state
 *   Info passed around.
@@ -85356,11 +85633,18 @@ function peek(_, _1, state) {
 * @returns {string}
 *   Serialized markdown.
 */
-function text$4(node, _, state, info) {
-	return state.safe(node.value, info);
+function text$4(node, parent, state, info) {
+	/* c8 ignore next -- parent always passed */
+	const siblings = parent ? parent.children : [];
+	const index = siblings.indexOf(node);
+	return state.safe(node.value, {
+		...info,
+		afterNode: siblings[index + 1],
+		beforeNode: siblings[index - 1]
+	});
 }
 //#endregion
-//#region node_modules/.pnpm/mdast-util-to-markdown@2.1.3/node_modules/mdast-util-to-markdown/lib/util/check-rule-repetition.js
+//#region node_modules/.pnpm/mdast-util-to-markdown@2.2.0/node_modules/mdast-util-to-markdown/lib/util/check-rule-repetition.js
 /**
 * @import {Options, State} from 'mdast-util-to-markdown'
 */
@@ -85378,7 +85662,7 @@ function checkRuleRepetition(state) {
 	return repetition;
 }
 //#endregion
-//#region node_modules/.pnpm/mdast-util-to-markdown@2.1.3/node_modules/mdast-util-to-markdown/lib/handle/thematic-break.js
+//#region node_modules/.pnpm/mdast-util-to-markdown@2.2.0/node_modules/mdast-util-to-markdown/lib/handle/thematic-break.js
 /**
 * @import {State} from 'mdast-util-to-markdown'
 * @import {Parents, ThematicBreak} from 'mdast'
@@ -85400,7 +85684,7 @@ function thematicBreak$2(_, _1, state) {
 	return state.options.ruleSpaces ? value.slice(0, -1) : value;
 }
 //#endregion
-//#region node_modules/.pnpm/mdast-util-to-markdown@2.1.3/node_modules/mdast-util-to-markdown/lib/handle/index.js
+//#region node_modules/.pnpm/mdast-util-to-markdown@2.2.0/node_modules/mdast-util-to-markdown/lib/handle/index.js
 /**
 * Default (CommonMark) handlers.
 */
@@ -85526,7 +85810,7 @@ const htmlRawNames = [
 	"textarea"
 ];
 //#endregion
-//#region node_modules/.pnpm/mdast-util-to-markdown@2.1.3/node_modules/mdast-util-to-markdown/lib/util/html-kind.js
+//#region node_modules/.pnpm/mdast-util-to-markdown@2.2.0/node_modules/mdast-util-to-markdown/lib/util/html-kind.js
 /**
 * @typedef {1 | 2 | 3 | 4 | 5 | 6 | 7} Kind
 *   Kind of HTML (flow) element.
@@ -85574,7 +85858,7 @@ function htmlKind(value) {
 	return htmlBlockNames.includes(name) ? 6 : 7;
 }
 //#endregion
-//#region node_modules/.pnpm/mdast-util-to-markdown@2.1.3/node_modules/mdast-util-to-markdown/lib/join.js
+//#region node_modules/.pnpm/mdast-util-to-markdown@2.2.0/node_modules/mdast-util-to-markdown/lib/join.js
 /**
 * @import {Join} from 'mdast-util-to-markdown'
 */
@@ -85601,7 +85885,7 @@ function joinDefaults(left, right, parent, state) {
 	}
 }
 //#endregion
-//#region node_modules/.pnpm/mdast-util-to-markdown@2.1.3/node_modules/mdast-util-to-markdown/lib/unsafe.js
+//#region node_modules/.pnpm/mdast-util-to-markdown@2.2.0/node_modules/mdast-util-to-markdown/lib/unsafe.js
 /**
 * @import {ConstructName, Unsafe} from 'mdast-util-to-markdown'
 */
@@ -88069,7 +88353,7 @@ function decode($0, $1, $2) {
 	return decodeNamedCharacterReference($2) || $0;
 }
 //#endregion
-//#region node_modules/.pnpm/mdast-util-to-markdown@2.1.3/node_modules/mdast-util-to-markdown/lib/util/association.js
+//#region node_modules/.pnpm/mdast-util-to-markdown@2.2.0/node_modules/mdast-util-to-markdown/lib/util/association.js
 /**
 * @import {AssociationId} from '../types.js'
 */
@@ -88098,7 +88382,7 @@ function association(node) {
 	return decodeString(node.identifier);
 }
 //#endregion
-//#region node_modules/.pnpm/mdast-util-to-markdown@2.1.3/node_modules/mdast-util-to-markdown/lib/util/compile-pattern.js
+//#region node_modules/.pnpm/mdast-util-to-markdown@2.2.0/node_modules/mdast-util-to-markdown/lib/util/compile-pattern.js
 /**
 * @import {CompilePattern} from '../types.js'
 */
@@ -88110,7 +88394,7 @@ function association(node) {
 function compilePattern(pattern) {
 	if (!pattern._compiled) {
 		const before = (pattern.atBreak ? "[\\r\\n][\\t ]*" : "") + (pattern.before ? "(?:" + pattern.before + ")" : "");
-		pattern._compiled = new RegExp((before ? "(" + before + ")" : "") + (/[$()*+\-.?[\\\]^{|}]/.test(pattern.character) ? "\\" : "") + pattern.character + (pattern.after ? "(?:" + pattern.after + ")" : ""), "g");
+		pattern._compiled = new RegExp((pattern.beforeNode ? "^" : before ? "(" + before + ")" : "") + (/[$()*+.?[\\\]^{|}]/.test(pattern.character) ? "\\" : "") + pattern.character + (pattern.afterNode ? "$" : pattern.after ? "(?:" + pattern.after + ")" : ""), pattern.unicode ? "gu" : "g");
 	}
 	return pattern._compiled;
 }
@@ -88138,7 +88422,7 @@ function classifyCharacter(code) {
 	if (unicodePunctuation(code)) return 2;
 }
 //#endregion
-//#region node_modules/.pnpm/mdast-util-to-markdown@2.1.3/node_modules/mdast-util-to-markdown/lib/util/character.js
+//#region node_modules/.pnpm/mdast-util-to-markdown@2.2.0/node_modules/mdast-util-to-markdown/lib/util/character.js
 /**
 * Get the first character of a value.
 *
@@ -88168,7 +88452,7 @@ function lastCharacter(value) {
 	return code !== void 0 && code > 65535 ? value.slice(-2) : value.slice(-1);
 }
 //#endregion
-//#region node_modules/.pnpm/mdast-util-to-markdown@2.1.3/node_modules/mdast-util-to-markdown/lib/util/encode-info.js
+//#region node_modules/.pnpm/mdast-util-to-markdown@2.2.0/node_modules/mdast-util-to-markdown/lib/util/encode-info.js
 /**
 * @import {EncodeSides} from '../types.js'
 */
@@ -88240,7 +88524,7 @@ function encodeInfo(outside, inside, marker) {
 	};
 }
 //#endregion
-//#region node_modules/.pnpm/mdast-util-to-markdown@2.1.3/node_modules/mdast-util-to-markdown/lib/util/container-phrasing.js
+//#region node_modules/.pnpm/mdast-util-to-markdown@2.2.0/node_modules/mdast-util-to-markdown/lib/util/container-phrasing.js
 /**
 * @import {Attention, Handle, Info, State} from 'mdast-util-to-markdown'
 * @import {PhrasingParents} from '../types.js'
@@ -88733,7 +89017,7 @@ function serialize(items, before, after) {
 	return result;
 }
 //#endregion
-//#region node_modules/.pnpm/mdast-util-to-markdown@2.1.3/node_modules/mdast-util-to-markdown/lib/util/container-flow.js
+//#region node_modules/.pnpm/mdast-util-to-markdown@2.2.0/node_modules/mdast-util-to-markdown/lib/util/container-flow.js
 /**
 * @import {State} from 'mdast-util-to-markdown'
 * @import {FlowChildren, FlowParents, TrackFields} from '../types.js'
@@ -88797,7 +89081,7 @@ function between(left, right, parent, state) {
 	return "\n\n";
 }
 //#endregion
-//#region node_modules/.pnpm/mdast-util-to-markdown@2.1.3/node_modules/mdast-util-to-markdown/lib/util/indent-lines.js
+//#region node_modules/.pnpm/mdast-util-to-markdown@2.2.0/node_modules/mdast-util-to-markdown/lib/util/indent-lines.js
 /**
 * @import {IndentLines} from '../types.js'
 */
@@ -88833,9 +89117,10 @@ function indentLines(value, map) {
 	}
 }
 //#endregion
-//#region node_modules/.pnpm/mdast-util-to-markdown@2.1.3/node_modules/mdast-util-to-markdown/lib/util/safe.js
+//#region node_modules/.pnpm/mdast-util-to-markdown@2.2.0/node_modules/mdast-util-to-markdown/lib/util/safe.js
 /**
-* @import {SafeConfig, State} from 'mdast-util-to-markdown'
+* @import {Nodes} from 'mdast'
+* @import {SafeConfig, State, Unsafe} from 'mdast-util-to-markdown'
 */
 const own$3 = {}.hasOwnProperty;
 /**
@@ -88872,17 +89157,21 @@ function safe(state, input, config) {
 	/** @type {Record<number, {before: boolean, after: boolean}>} */
 	const infos = {};
 	const percentEncode = state.stack.includes("autolink");
+	const offset = config.before ? config.before.length : 0;
+	const end = value.length - (config.after ? config.after.length : 0);
 	let index = -1;
 	while (++index < state.unsafe.length) {
 		const pattern = state.unsafe[index];
-		if (!patternInScope(state.stack, pattern)) continue;
+		if (!patternInScope(state.stack, pattern) || !nodeInScope(pattern.beforeNode, config.beforeNode) || !nodeInScope(pattern.afterNode, config.afterNode)) continue;
 		const expression = state.compilePattern(pattern);
+		const from = pattern.beforeNode ? offset : 0;
+		const subject = value.slice(from, pattern.afterNode ? end : void 0);
 		/** @type {RegExpExecArray | null} */
 		let match;
-		while (match = expression.exec(value)) {
+		while (match = expression.exec(subject)) {
 			const before = "before" in pattern || Boolean(pattern.atBreak);
 			const after = "after" in pattern;
-			const position = match.index + (before ? match[1].length : 0);
+			const position = from + match.index + (before ? match[1].length : 0);
 			if (own$3.call(infos, position)) {
 				if (infos[position].before && !before) infos[position].before = false;
 				if (infos[position].after && !after) infos[position].after = false;
@@ -88896,8 +89185,6 @@ function safe(state, input, config) {
 		}
 	}
 	positions.sort(numerical);
-	const offset = config.before ? config.before.length : 0;
-	const end = value.length - (config.after ? config.after.length : 0);
 	let start = offset;
 	index = -1;
 	while (++index < positions.length) {
@@ -88932,6 +89219,21 @@ function safe(state, input, config) {
 	return result.join("");
 }
 /**
+* Check if a node matches the node types of a pattern.
+*
+* @param {Array<Nodes['type']> | Nodes['type'] | null | undefined} types
+*   Node types.
+* @param {Nodes | undefined} node
+*   Node.
+* @returns {boolean}
+*   Whether `node` matches `types`.
+*/
+function nodeInScope(types, node) {
+	if (!types) return true;
+	if (!node) return false;
+	return typeof types === "string" ? types === node.type : types.includes(node.type);
+}
+/**
 * Compare two numbers.
 *
 * @param {number} a
@@ -88975,7 +89277,7 @@ function escapeBackslashes(value, after) {
 	return results.join("");
 }
 //#endregion
-//#region node_modules/.pnpm/mdast-util-to-markdown@2.1.3/node_modules/mdast-util-to-markdown/lib/util/track.js
+//#region node_modules/.pnpm/mdast-util-to-markdown@2.2.0/node_modules/mdast-util-to-markdown/lib/util/track.js
 /**
 * @import {CreateTracker, TrackCurrent, TrackMove, TrackShift} from '../types.js'
 */
@@ -89033,7 +89335,7 @@ function track(config) {
 	}
 }
 //#endregion
-//#region node_modules/.pnpm/mdast-util-to-markdown@2.1.3/node_modules/mdast-util-to-markdown/lib/index.js
+//#region node_modules/.pnpm/mdast-util-to-markdown@2.2.0/node_modules/mdast-util-to-markdown/lib/index.js
 /**
 * @import {Info, Join, Options, SafeConfig, State} from 'mdast-util-to-markdown'
 * @import {Nodes} from 'mdast'
@@ -99040,7 +99342,7 @@ function preprocess() {
 	}
 }
 //#endregion
-//#region node_modules/.pnpm/mdast-util-from-markdown@2.0.3_supports-color@7.2.0/node_modules/mdast-util-from-markdown/lib/index.js
+//#region node_modules/.pnpm/mdast-util-from-markdown@2.1.0_supports-color@7.2.0/node_modules/mdast-util-from-markdown/lib/index.js
 /**
 * @import {
 *   Break,
@@ -99120,6 +99422,8 @@ function fromMarkdown(value, encoding, options) {
 function compiler(options) {
 	/** @type {Config} */
 	const config = {
+		afterExit: [],
+		beforeEnter: [],
 		transforms: [],
 		canContainEols: [
 			"emphasis",
@@ -99239,7 +99543,8 @@ function compiler(options) {
 		/** @type {Root} */
 		let tree = {
 			type: "root",
-			children: []
+			children: [],
+			position: void 0
 		};
 		/** @type {Omit<CompileContext, 'sliceSerialize'>} */
 		const context = {
@@ -99254,15 +99559,32 @@ function compiler(options) {
 		};
 		/** @type {Array<number>} */
 		const listStack = [];
+		/** @type {Array<Event>} */
+		const prepared = [];
 		let index = -1;
-		while (++index < events.length) if (events[index][1].type === "listOrdered" || events[index][1].type === "listUnordered") {
-			if (events[index][0] === "enter") listStack.push(index);
-			else index = prepareList(events, listStack.pop(), index);
+		while (++index < events.length) {
+			prepared.push(events[index]);
+			if (events[index][1].type === "listOrdered" || events[index][1].type === "listUnordered") {
+				if (events[index][0] === "enter") listStack.push(prepared.length - 1);
+				else prepareList(prepared, listStack.pop());
+			}
 		}
+		events = prepared;
 		index = -1;
 		while (++index < events.length) {
 			const handler = config[events[index][0]];
-			if (own$2.call(handler, events[index][1].type)) handler[events[index][1].type].call(Object.assign({ sliceSerialize: events[index][2].sliceSerialize }, context), events[index][1]);
+			if (events[index][0] === "enter" && config.beforeEnter.length > 0) callListeners(config.beforeEnter, {
+				...context,
+				sliceSerialize: events[index][2].sliceSerialize
+			}, events[index][1]);
+			if (own$2.call(handler, events[index][1].type)) handler[events[index][1].type].call({
+				...context,
+				sliceSerialize: events[index][2].sliceSerialize
+			}, events[index][1]);
+			if (events[index][0] === "exit" && config.afterExit.length > 0) callListeners(config.afterExit, {
+				...context,
+				sliceSerialize: events[index][2].sliceSerialize
+			}, events[index][1]);
 		}
 		if (context.tokenStack.length > 0) {
 			const tail = context.tokenStack[context.tokenStack.length - 1];
@@ -99285,12 +99607,28 @@ function compiler(options) {
 		return tree;
 	}
 	/**
+	* @param {Array<Handle>} listeners
+	*   Listeners.
+	* @param {CompileContext} context
+	*   Context.
+	* @param {Token} token
+	*   Token.
+	* @returns {undefined}
+	*   Nothing.
+	*/
+	function callListeners(listeners, context, token) {
+		let index = -1;
+		while (++index < listeners.length) listeners[index].call(context, token);
+	}
+	/**
 	* @param {Array<Event>} events
+	*   Events, ending with the list to prepare.
 	* @param {number} start
-	* @param {number} length
-	* @returns {number}
+	*   Index of the list enter.
+	* @returns {undefined}
 	*/
-	function prepareList(events, start, length) {
+	function prepareList(events, start) {
+		const end = events.length - 1;
 		let index = start - 1;
 		let containerBalance = -1;
 		let listSpread = false;
@@ -99302,7 +99640,14 @@ function compiler(options) {
 		let firstBlankLineIndex;
 		/** @type {boolean | undefined} */
 		let atMarker;
-		while (++index <= length) {
+		/**
+		* `listItem` events to insert before the event at `at`, in walk order.
+		* Merged in after the walk, as inserting while walking would shift the
+		* rest of the list once per item.
+		* @type {Array<{at: number, event: Event}>}
+		*/
+		const insertions = [];
+		while (++index <= end) {
 			const event = events[index];
 			switch (event[1].type) {
 				case "listUnordered":
@@ -99343,13 +99688,14 @@ function compiler(options) {
 					}
 					if (firstBlankLineIndex && (!lineIndex || firstBlankLineIndex < lineIndex)) listItem._spread = true;
 					listItem.end = Object.assign({}, lineIndex ? events[lineIndex][1].start : event[1].end);
-					events.splice(lineIndex || index, 0, [
-						"exit",
-						listItem,
-						event[2]
-					]);
-					index++;
-					length++;
+					insertions.push({
+						at: lineIndex || index,
+						event: [
+							"exit",
+							listItem,
+							event[2]
+						]
+					});
 				}
 				if (event[1].type === "listItemPrefix") {
 					/** @type {Token} */
@@ -99360,20 +99706,27 @@ function compiler(options) {
 						end: void 0
 					};
 					listItem = item;
-					events.splice(index, 0, [
-						"enter",
-						item,
-						event[2]
-					]);
-					index++;
-					length++;
+					insertions.push({
+						at: index,
+						event: [
+							"enter",
+							item,
+							event[2]
+						]
+					});
 					firstBlankLineIndex = void 0;
 					atMarker = true;
 				}
 			}
 		}
+		const listEvents = events.splice(start);
+		let insertion = 0;
+		index = -1;
+		while (++index < listEvents.length) {
+			while (insertion < insertions.length && insertions[insertion].at === start + index) events.push(insertions[insertion++].event);
+			events.push(listEvents[index]);
+		}
 		events[start][1]._spread = listSpread;
-		return length;
 	}
 	/**
 	* Create an opener handle.
@@ -99448,7 +99801,7 @@ function compiler(options) {
 			start: token.start,
 			end: token.end
 		}) + "): it’s not open");
-		else if (open[0].type !== token.type) {
+		if (open[0].type !== token.type) {
 			if (onExitError) onExitError.call(this, token, open[0]);
 			else (open[1] || defaultOnError).call(this, token, open[0]);
 		}
@@ -99816,7 +100169,8 @@ function compiler(options) {
 	function blockQuote() {
 		return {
 			type: "blockquote",
-			children: []
+			children: [],
+			position: void 0
 		};
 	}
 	/** @returns {Code} */
@@ -99825,14 +100179,16 @@ function compiler(options) {
 			type: "code",
 			lang: null,
 			meta: null,
-			value: ""
+			value: "",
+			position: void 0
 		};
 	}
 	/** @returns {InlineCode} */
 	function codeText() {
 		return {
 			type: "inlineCode",
-			value: ""
+			value: "",
+			position: void 0
 		};
 	}
 	/** @returns {Definition} */
@@ -99842,14 +100198,16 @@ function compiler(options) {
 			identifier: "",
 			label: null,
 			title: null,
-			url: ""
+			url: "",
+			position: void 0
 		};
 	}
 	/** @returns {Emphasis} */
 	function emphasis() {
 		return {
 			type: "emphasis",
-			children: []
+			children: [],
+			position: void 0
 		};
 	}
 	/** @returns {Heading} */
@@ -99857,18 +100215,23 @@ function compiler(options) {
 		return {
 			type: "heading",
 			depth: 0,
-			children: []
+			children: [],
+			position: void 0
 		};
 	}
 	/** @returns {Break} */
 	function hardBreak() {
-		return { type: "break" };
+		return {
+			type: "break",
+			position: void 0
+		};
 	}
 	/** @returns {Html} */
 	function html() {
 		return {
 			type: "html",
-			value: ""
+			value: "",
+			position: void 0
 		};
 	}
 	/** @returns {Image} */
@@ -99877,7 +100240,8 @@ function compiler(options) {
 			type: "image",
 			title: null,
 			url: "",
-			alt: null
+			alt: null,
+			position: void 0
 		};
 	}
 	/** @returns {Link} */
@@ -99886,7 +100250,8 @@ function compiler(options) {
 			type: "link",
 			title: null,
 			url: "",
-			children: []
+			children: [],
+			position: void 0
 		};
 	}
 	/**
@@ -99899,7 +100264,8 @@ function compiler(options) {
 			ordered: token.type === "listOrdered",
 			start: null,
 			spread: token._spread,
-			children: []
+			children: [],
+			position: void 0
 		};
 	}
 	/**
@@ -99911,33 +100277,40 @@ function compiler(options) {
 			type: "listItem",
 			spread: token._spread,
 			checked: null,
-			children: []
+			children: [],
+			position: void 0
 		};
 	}
 	/** @returns {Paragraph} */
 	function paragraph() {
 		return {
 			type: "paragraph",
-			children: []
+			children: [],
+			position: void 0
 		};
 	}
 	/** @returns {Strong} */
 	function strong() {
 		return {
 			type: "strong",
-			children: []
+			children: [],
+			position: void 0
 		};
 	}
 	/** @returns {Text} */
 	function text() {
 		return {
 			type: "text",
-			value: ""
+			value: "",
+			position: void 0
 		};
 	}
 	/** @returns {ThematicBreak} */
 	function thematicBreak() {
-		return { type: "thematicBreak" };
+		return {
+			type: "thematicBreak",
+			position: void 0
+		};
 	}
 }
 /**
@@ -99987,6 +100360,12 @@ function extension(combined, extension) {
 			if (right) combined[key].push(...right);
 			break;
 		}
+		case "afterExit":
+		case "beforeEnter": {
+			const right = extension[key];
+			if (right) combined[key].push(right);
+			break;
+		}
 		case "enter":
 		case "exit": {
 			const right = extension[key];
@@ -100004,7 +100383,7 @@ function defaultOnError(left, right) {
 		start: right.start,
 		end: right.end
 	}) + ") is open");
-	else throw new Error("Cannot close document, a token (`" + right.type + "`, " + stringifyPosition({
+	throw new Error("Cannot close document, a token (`" + right.type + "`, " + stringifyPosition({
 		start: right.start,
 		end: right.end
 	}) + ") is still open");
@@ -103736,6 +104115,7 @@ const formatNodeTranslationSummary = (translation) => [
 	`- **Updated**: ${translation.updated_at}`
 ].join("\n");
 const formatCategory = (category) => `- **${category.name}** (${category.id}) — ${category.description || "No description"}`;
+const formatBrand = (brand) => `- **${brand.name}** (${brand.id}) — ${brand.brand_url}${brand.default ? " — default" : ""}${brand.active ? "" : " — inactive"}`;
 const formatSection = (section) => `- **${section.name}** (${section.id}) — Category: ${section.category_id} — ${section.description || "No description"}`;
 const formatView = (view, count) => {
 	const countText = count ? ` — ${count.pretty} ticket(s)${count.fresh ? "" : " (count updating)"}` : "";
@@ -103786,13 +104166,7 @@ const extractSearchPaginationMeta = (response, perPage, page) => {
 };
 //#endregion
 //#region src/guidance/article-resources.ts
-/**
-* Name of the companion tool that lists promoted articles. Shared between the
-* tool definition (`help-center.ts`) and the `--no-promoted-articles` opt-out
-* filter (`server.ts`) so the two can never drift: renaming the tool here keeps
-* the filter dropping it, preserving the "zero preloading requests when off"
-* invariant.
-*/
+/** Name of the companion tool that lists promoted articles (`help-center.ts`). */
 const LIST_PROMOTED_ARTICLES_TOOL = "list_promoted_articles";
 /**
 * Scan the Help Center for promoted ("featured") articles with the CALLER'S
@@ -103801,9 +104175,11 @@ const LIST_PROMOTED_ARTICLES_TOOL = "list_promoted_articles";
 * `/articles` and filter `promoted` client-side, bounded by `maxPages` to keep
 * the scan tractable on a large Help Center. `truncated` signals the cap was hit.
 *
-* Returns the FULL promoted articles so callers that need rich metadata (the
-* `list_promoted_articles` tool) get everything; the resource provider maps these
-* down to lean refs before caching so the per-session cache doesn't retain bodies.
+* `subdomain` is the EFFECTIVE one — the account's, or the resolved brand's own
+* (a brand is only ever <subdomain>.zendesk.com). Returns the FULL promoted
+* articles so callers that need rich metadata (the `list_promoted_articles`
+* tool) get everything; the resource provider maps these down to lean refs
+* before caching so the per-session cache doesn't retain bodies.
 */
 const fetchPromotedArticles = async (subdomain, token, maxPages = ARTICLE_RESOURCES_SCAN_MAX_PAGES) => {
 	const promoted = [];
@@ -103833,6 +104209,7 @@ const fetchPromotedArticles = async (subdomain, token, maxPages = ARTICLE_RESOUR
 * caller's token and render it as Markdown: the shared metadata summary plus the
 * body converted from HTML (rather than a raw HTML dump), capped by the response
 * character limit. Reuses the same formatting as the `get_article` tool.
+* `subdomain` is the EFFECTIVE one — the account's, or the resolved brand's own.
 */
 const fetchArticleMarkdown = async (subdomain, token, id, locale) => {
 	const path = locale ? `/${locale}/articles/${id}` : `/articles/${id}`;
@@ -103852,24 +104229,69 @@ const fetchArticleMarkdown = async (subdomain, token, id, locale) => {
 * module scope — in HTTP mode a shared one would leak a caller's data to
 * another. `getToken` resolves lazily, so connecting never triggers the OAuth
 * flow, and a 401 notifies `onUnauthorized` to drop the stale token.
+*
+* Branding is resolved through the SHARED brand subdomain resolver, never a
+* second /brands walk: `brandIds` decides which brands `listPromoted` scans
+* (all of them in multi mode, so every allowed brand's promoted articles are
+* listed with their own URIs; 'all' scans every brand of the account), and
+* `readArticle` resolves the URI's {brand} through the same allow-list +
+* resolver the tools use.
 */
-const createArticleResourcesProvider = (getToken, subdomain, onUnauthorized) => {
+const createArticleResourcesProvider = (getToken, subdomain, onUnauthorized, resolveBrandSubdomain = () => Promise.resolve(subdomain), brandIds) => {
 	let cached;
 	const notifyIfUnauthorized = (err) => {
 		if (onUnauthorized && err instanceof ZendeskApiError && err.status === 401) onUnauthorized();
 	};
+	const isSingleLock = brandIds !== void 0 && brandIds.length === 1 && brandIds[0] !== "all";
+	const listBrands = async () => {
+		if (brandIds === void 0 || isSingleLock) return [void 0];
+		if (brandIds[0] === "all") return (await fetchAllBrands(subdomain, await getToken())).filter((b) => b.active && b.has_help_center).map((b) => b.subdomain);
+		return brandIds;
+	};
+	const effectiveSubdomain = async (brand) => {
+		if (brand !== void 0) return resolveBrandSubdomain(brand);
+		if (isSingleLock) return resolveBrandSubdomain(brandIds[0]);
+		return subdomain;
+	};
+	const scanBrand = async (brand, token) => {
+		try {
+			const hcSubdomain = await effectiveSubdomain(brand);
+			const scan = await fetchPromotedArticles(hcSubdomain, token, ARTICLE_RESOURCES_SCAN_MAX_PAGES);
+			return {
+				refs: scan.articles.map((a) => brand === void 0 ? {
+					id: a.id,
+					title: a.title
+				} : {
+					id: a.id,
+					title: a.title,
+					brand
+				}),
+				truncated: scan.truncated
+			};
+		} catch (err) {
+			if (err instanceof ZendeskApiError && err.status === 401) throw err;
+			return {
+				refs: [],
+				truncated: true
+			};
+		}
+	};
 	return {
 		listPromoted() {
 			const now = Date.now();
 			if (cached && now - cached.at < 3e5) return cached.promise;
 			const promise = (async () => {
 				const token = await getToken();
-				const { articles, truncated } = await fetchPromotedArticles(subdomain, token);
+				const brands = await listBrands();
+				const refs = [];
+				let truncated = false;
+				for (const brand of brands) {
+					const scan = await scanBrand(brand, token);
+					truncated = truncated || scan.truncated;
+					refs.push(...scan.refs);
+				}
 				return {
-					refs: articles.map((a) => ({
-						id: a.id,
-						title: a.title
-					})),
+					refs,
 					truncated
 				};
 			})().catch((err) => {
@@ -103883,10 +104305,10 @@ const createArticleResourcesProvider = (getToken, subdomain, onUnauthorized) =>
 			};
 			return promise;
 		},
-		async readArticle(id) {
+		async readArticle(id, brand) {
 			try {
-				const token = await getToken();
-				return await fetchArticleMarkdown(subdomain, token, id);
+				const [token, hcSubdomain] = await Promise.all([getToken(), effectiveSubdomain(brand)]);
+				return await fetchArticleMarkdown(hcSubdomain, token, id, void 0);
 			} catch (err) {
 				notifyIfUnauthorized(err);
 				throw err;
@@ -103907,17 +104329,33 @@ const topologyResourceUri = (config) => `${config.hcResourceScheme}://topology`;
 /**
 * URI template of the pull-only Help Center article resources, built from the
 * configured scheme exactly like `topologyResourceUri` (`--hc-resource-scheme`,
-* default `zendesk-hc` → `zendesk-hc://article/{id}`). The template's `list`
-* callback enumerates the promoted ("featured") articles (so clients can surface
-* them for pinning), while any article id can be read on demand.
+* default `zendesk-hc`). In multi/all brand mode the URI carries a brand
+* dimension — `<scheme>://brands/{brand}/articles/{id}` — because an article id
+* alone does not say which brand's Help Center holds it; the brand is named by
+* id or subdomain, the same idiom the tools' `brand_id` accepts. Unset and
+* single-brand modes keep `<scheme>://article/{id}`: one Help Center is
+* addressed, so a brand segment would be noise. The template's `list` callback
+* enumerates the promoted ("featured") articles (so clients can surface them
+* for pinning), while any article id can be read on demand.
 */
-const articleResourceUriTemplate = (config) => `${config.hcResourceScheme}://article/{id}`;
+const articleResourceUriTemplate = (config) => brandScopedArticles(config) ? `${config.hcResourceScheme}://brands/{brand}/articles/{id}` : `${config.hcResourceScheme}://article/{id}`;
 /**
 * Build the concrete resource URI for a single article id, under the configured
 * scheme. Shares the scheme with the template above so the listed URIs always
-* match the template the read callback is registered under.
+* match the template the read callback is registered under. In multi/all mode
+* the brand argument (id or subdomain) is required and fills the {brand} slot.
+*/
+const articleResourceUri = (config, id, brand) => brandScopedArticles(config) ? `${config.hcResourceScheme}://brands/${brand}/articles/${id}` : `${config.hcResourceScheme}://article/${id}`;
+/**
+* Whether the article resources address one Help Center among several: the
+* server was started with several brands, or with `all`. Only then does the URI
+* carry the brand dimension; unset and single-lock modes name exactly one Help
+* Center implicitly.
 */
-const articleResourceUri = (config, id) => `${config.hcResourceScheme}://article/${id}`;
+const brandScopedArticles = (config) => {
+	const brandIds = config.brandIds;
+	return brandIds !== void 0 && (brandIds.length > 1 || brandIds[0] === "all");
+};
 /**
 * Whether the `help_center` namespace is active: no `--namespace` filter, or one
 * that includes it. The shared second half of the two Help Center feature gates
@@ -103943,13 +104381,11 @@ const helpCenterContextEnabled = (config) => config.topology && helpCenterNamesp
 const articleResourceEnabled = (config) => helpCenterNamespaceActive(config);
 /**
 * Whether the promoted-article PRE-LISTING is exposed: the resource `list`
-* callback's scan (which enumerates the promoted articles for `resources/list`)
-* AND the `list_promoted_articles` tool. This is the costly, fan-out part (a capped
-* scan of `/articles`, no server-side promoted filter), so it gets its own flag —
-* `--no-promoted-articles` turns it off so the server issues zero preloading
-* requests, while read-by-id (above) stays available. `!== false` (not truthiness)
-* so an omitted flag on a hand-built Config stays default-on, matching the tool
-* filter in `server.ts`.
+* callback's scan, which enumerates the promoted articles for `resources/list`.
+* A client may trigger it unprompted, and it fans out (a capped scan of
+* `/articles`, per brand in scope), so `--no-promoted-articles` turns it off.
+* Read-by-id and the explicit `list_promoted_articles` tool stay available.
+* `!== false` so an omitted flag on a hand-built Config stays default-on.
 */
 const promotedArticlesEnabled = (config) => config.promotedArticles !== false && helpCenterNamespaceActive(config);
 /**
@@ -103960,13 +104396,20 @@ const promotedArticlesEnabled = (config) => config.promotedArticles !== false &&
 */
 const buildInstructions = (config) => {
 	if (!helpCenterContextEnabled(config)) return void 0;
+	let scope;
+	if (config.brandIds === void 0) scope = `the Zendesk Help Center of "${config.subdomain}"`;
+	else if (config.brandIds.length === 1 && config.brandIds[0] === "all") scope = `all brands of the Zendesk Help Center of "${config.subdomain}"`;
+	else if (config.brandIds.length === 1) scope = `brand ${config.brandIds[0]} of the Zendesk Help Center of "${config.subdomain}"`;
+	else scope = `brands ${config.brandIds.join(", ")} of the Zendesk Help Center of "${config.subdomain}"`;
+	const topologyBrandNote = config.brandIds !== void 0 && (config.brandIds.length > 1 || config.brandIds[0] === "all") ? [`The topology describes ${config.brandIds[0] === "all" ? "the account default brand" : `brand ${config.brandIds[0]}`} only; for another brand, use list_categories / list_sections with its brand_id.`] : [];
 	return [
-		`This MCP server is connected to the Zendesk Help Center of "${config.subdomain}".`,
+		`This MCP server is connected to ${scope}.`,
 		"",
 		`When creating or editing Help Center content, the resource ${topologyResourceUri(config)} is useful context:`,
 		"it lists the active locales (and the default one), the category → section tree with IDs,",
 		"the visibility user segments, the permission groups, and your current role.",
 		"Prefer its IDs (section_id, permission_group_id, user_segment_id, locale) over guessing from names.",
+		...topologyBrandNote,
 		"",
 		"It degrades gracefully: without Guide-admin / Help Center manager rights the permission-groups and",
 		"user-segments sections are marked unavailable (not empty). In that case reuse a permission_group_id",
@@ -104003,12 +104446,13 @@ const tolerate403 = async (promise, fallback) => {
 * and sections are each capped at one max-size page; `sectionsHasMore` /
 * `categoriesHasMore` signal a Help Center too large to enumerate inline.
 */
-const fetchTopology = async (subdomain, token) => {
+const fetchTopology = async (subdomain, token, brandIds, brandSubdomain) => {
 	const pageParams = { "page[size]": String(100) };
+	const hcSubdomain = brandSubdomain ?? subdomain;
 	const [locales, categoriesRes, sectionsRes, segments, perms, meRes] = await Promise.all([
-		helpCenterGet(subdomain, token, "/locales"),
-		helpCenterGet(subdomain, token, "/categories", pageParams),
-		helpCenterGet(subdomain, token, "/sections", pageParams),
+		helpCenterGet(hcSubdomain, token, "/locales"),
+		helpCenterGet(hcSubdomain, token, "/categories", pageParams),
+		helpCenterGet(hcSubdomain, token, "/sections", pageParams),
 		tolerate403(helpCenterGet(subdomain, token, "/user_segments"), { user_segments: [] }),
 		tolerate403(zendeskGet(subdomain, token, "/guide/permission_groups"), { permission_groups: [] }),
 		zendeskGet(subdomain, token, "/users/me")
@@ -104017,6 +104461,7 @@ const fetchTopology = async (subdomain, token) => {
 	const sections = sectionsRes.sections ?? [];
 	return {
 		subdomain,
+		...brandIds === void 0 ? {} : { brandIds },
 		locales,
 		categories,
 		sections,
@@ -104068,10 +104513,20 @@ const renderAdminSection = (items, denied, deniedNote) => {
 };
 /** Render the topology as a compact Markdown document for the LLM context. */
 const formatTopology = (data) => {
+	let brandNote;
+	let allowedBrandsLine = [];
+	if (data.brandIds === void 0) brandNote = "";
+	else if (data.brandIds.length === 1 && data.brandIds[0] === "all") brandNote = " (all brands; tree below: account default)";
+	else if (data.brandIds.length === 1) brandNote = ` (brand ${data.brandIds[0]})`;
+	else {
+		brandNote = ` (brand ${data.brandIds[0]})`;
+		allowedBrandsLine = ["", `**Allowed brands**: ${data.brandIds.join(", ")}`];
+	}
 	const text = [
-		`# Zendesk Help Center topology — ${data.subdomain}`,
+		`# Zendesk Help Center topology — ${data.subdomain}${brandNote}`,
 		"",
 		`**Your access**: ${data.currentUser.name} (id ${data.currentUser.id}), role "${data.currentUser.role}".`,
+		...allowedBrandsLine,
 		"",
 		"## Locales",
 		`- Default: ${data.locales.default_locale}`,
@@ -104098,14 +104553,14 @@ const formatTopology = (data) => {
 * token. A 401 notifies `onUnauthorized` (stdio OAuth only) to invalidate the
 * stale token, mirroring the tool dispatch path in `server.ts`.
 */
-const createTopologyProvider = (getToken, subdomain, onUnauthorized) => {
+const createTopologyProvider = (getToken, subdomain, onUnauthorized, brandIds, resolveBrandSubdomain = () => Promise.resolve(void 0)) => {
 	let cached;
 	return { read() {
 		const now = Date.now();
 		if (cached && now - cached.at < 3e5) return cached.promise;
 		const promise = (async () => {
-			const token = await getToken();
-			return formatTopology(await fetchTopology(subdomain, token));
+			const [token, brandSubdomain] = await Promise.all([getToken(), resolveBrandSubdomain()]);
+			return formatTopology(await fetchTopology(subdomain, token, brandIds, brandSubdomain));
 		})().catch((err) => {
 			cached = void 0;
 			if (onUnauthorized && err instanceof ZendeskApiError && err.status === 401) onUnauthorized();
@@ -104149,7 +104604,6 @@ const filterTools = (allTools, options) => allTools.filter((tool) => {
 	if (options.readOnly && !tool.readOnly) return false;
 	if (options.namespaces?.length && !options.namespaces.includes(tool.namespace)) return false;
 	if (options.tools?.length && !options.tools.includes(tool.name)) return false;
-	if (options.promotedArticles === false && tool.name === "list_promoted_articles") return false;
 	return true;
 });
 const groupByNamespace = (tools) => {
@@ -104267,6 +104721,50 @@ const isPlacedAsRequested = (effectiveAfter, movedId, target, referenceId) => {
 //#endregion
 //#region src/tools/help-center.ts
 const ARTICLE_ID_DESC = "Article ID — the numeric id of the Help Center article. Obtain it from list_articles or search_articles.";
+const brandIdField = (brandIds) => {
+	if (!brandIds || brandIds.length === 0) return void 0;
+	if (brandIds.length === 1 && brandIds[0] !== "all") return void 0;
+	const description = brandIds[0] === "all" ? "Brand of the Help Center to operate on, by id or subdomain. Required: any brand from list_brands." : `Brand of the Help Center to operate on, by id or subdomain. Required: one of ${brandIds.join(", ")}.`;
+	return union([number$2().int(), string$2().min(1)]).describe(description);
+};
+/**
+* Resolve which brand a call targets, enforcing the deploy allow-list.
+*
+* - unset: no brand override; a per-call brand_id is rejected (schema has no
+*   field for it, so this is a backstop for hand-crafted calls).
+* - single: the configured entry is the only brand; ANY per-call brand_id is
+*   rejected (hard lock, no escape — the schema has no field for it).
+* - multi: brand_id is REQUIRED; the per-call id is resolved and must match an
+*   allowed entry by id or resolved subdomain.
+* - all: brand_id is REQUIRED; any existing brand passes (validated by the
+*   resolver).
+*
+* Returns the brand's subdomain, or undefined for the account default.
+*/
+const resolveBrand = async (perCall, brandIds, resolveSubdomain) => {
+	if (!brandIds || brandIds.length === 0) {
+		if (perCall !== void 0) throw new Error("brand_id is not accepted: this server was started without --brand-ids, so it targets the account default brand.");
+		return;
+	}
+	const isAll = brandIds.length === 1 && brandIds[0] === "all";
+	if (brandIds.length === 1 && !isAll) {
+		const locked = brandIds[0];
+		if (perCall !== void 0) throw new Error(`brand_id is not accepted: this server was started with --brand-ids ${locked}, which locks every Help Center operation to that brand. Omit brand_id.`);
+		return resolveSubdomain(locked);
+	}
+	if (perCall === void 0) throw new Error(`brand_id is required: this server was started with --brand-ids ${brandIds.join(", ")}, so every brand-scoped Help Center call must name one.`);
+	const resolved = await resolveSubdomain(String(perCall));
+	if (isAll) return resolved;
+	await assertAllowed(perCall, resolved, brandIds, resolveSubdomain);
+	return resolved;
+};
+const assertAllowed = async (perCall, resolved, brandIds, resolveSubdomain) => {
+	if (brandIds.includes(String(perCall))) return;
+	const settled = await Promise.allSettled(brandIds.map((entry) => resolveSubdomain(entry)));
+	const allowed = new Set(brandIds);
+	for (const r of settled) if (r.status === "fulfilled") allowed.add(r.value);
+	if (!allowed.has(resolved)) throw new Error(`brand_id ${perCall} is not allowed: this server was started with --brand-ids ${brandIds.join(", ")}. Allowed: ${[...allowed].join(", ")}.`);
+};
 const listTranslations = (subdomain, token, articleId) => helpCenterGet(subdomain, token, `/articles/${articleId}/translations`).then((res) => res.translations);
 const NODE_LABEL = {
 	sections: "section",
@@ -104467,13 +104965,54 @@ const structureWarning = (r) => {
 	return [];
 };
 const sectionUpdateNotes = (r) => [...r.stripped ? [`Note: removed a leading <${r.stripped.tag}> "${r.stripped.text}" from content; the section heading is kept automatically and is not part of content.`] : [], ...structureWarning(r)];
+/**
+* Build the `list_brands` tool when the server runs in multi/all mode; an empty
+* array otherwise. It is the discovery source for the required per-call
+* `brand_id`: in single-lock or unset mode the brand is implicit, the schemas
+* carry no `brand_id` field, and the tool stays hidden. In multi mode (not
+* 'all') the listing is filtered to the allowed brands.
+*/
+const createListBrandsTool = (ctx) => {
+	const { subdomain, brandIds, getToken } = ctx;
+	if (brandIds === void 0) return [];
+	const isAll = brandIds.length === 1 && brandIds[0] === "all";
+	if (brandIds.length === 1 && !isAll) return [];
+	return [{
+		name: "list_brands",
+		namespace: "help_center",
+		readOnly: true,
+		title: "List Zendesk Brands",
+		description: "List the Zendesk account's brands (id, name, URL, default/active flags) from the Support API. Multi-brand Guide accounts have one Help Center per brand: find the brand id here, then pass it as brand_id (id or subdomain) — REQUIRED on every brand-scoped Help Center tool in multi/all mode.",
+		inputSchema: object({}),
+		annotations: {
+			readOnlyHint: true,
+			destructiveHint: false,
+			idempotentHint: true,
+			openWorldHint: true
+		},
+		handler: async () => {
+			const token = await getToken();
+			const brands = await fetchAllBrands(subdomain, token);
+			const visible = isAll ? brands : brands.filter((b) => brandIds.includes(String(b.id)) || brandIds.includes(b.subdomain));
+			return { content: [{
+				type: "text",
+				text: formatList(visible, formatBrand, void 0, "Pass a brand id as brand_id to any Help Center tool to operate on that brand.")
+			}] };
+		}
+	}];
+};
 const createHelpCenterTools = (ctx) => {
-	const { subdomain, getToken } = ctx;
-	const fetchSectionOrder = async (sectionId, locale, token) => {
+	const { subdomain, brandIds, resolveBrandSubdomain, getToken } = ctx;
+	const brandIdSchema = brandIdField(brandIds);
+	const brandIdPart = brandIdSchema ? { brand_id: brandIdSchema } : {};
+	const resolveHcSubdomain = async (brand_id) => {
+		return await resolveBrand(brand_id, brandIds, resolveBrandSubdomain) ?? subdomain;
+	};
+	const fetchSectionOrder = async (sectionId, locale, token, hcSubdomain) => {
 		const order = [];
 		let cursor;
 		do {
-			const response = await helpCenterGet(subdomain, token, `/${locale}/sections/${sectionId}/articles`, buildCursorParams(100, cursor));
+			const response = await helpCenterGet(hcSubdomain, token, `/${locale}/sections/${sectionId}/articles`, buildCursorParams(100, cursor));
 			const articles = response.articles ?? [];
 			for (const article of articles) order.push({
 				id: article.id,
@@ -104484,19 +105023,19 @@ const createHelpCenterTools = (ctx) => {
 		} while (cursor);
 		return order;
 	};
-	const assertReferenceInSection = async (effective, referenceArticleId, articleId, sectionId, token) => {
+	const assertReferenceInSection = async (effective, referenceArticleId, articleId, sectionId, token, hcSubdomain) => {
 		if (effective.some((a) => a.id === referenceArticleId)) return;
 		let detail = "was not found";
 		try {
-			const { article: ref } = await helpCenterGet(subdomain, token, `/articles/${referenceArticleId}`);
+			const { article: ref } = await helpCenterGet(hcSubdomain, token, `/articles/${referenceArticleId}`);
 			detail = `is in section #${ref.section_id}, not section #${sectionId}`;
 		} catch {}
 		throw new Error(`Reference article #${referenceArticleId} ${detail}. It must be in the same section (#${sectionId}) as article #${articleId}.`);
 	};
-	const applyPositionWrites = async (writes, articleId, token) => {
+	const applyPositionWrites = async (writes, articleId, token, hcSubdomain) => {
 		let applied = 0;
 		for (const write of writes) try {
-			await helpCenterPut(subdomain, token, `/articles/${write.id}`, { article: { position: write.position } });
+			await helpCenterPut(hcSubdomain, token, `/articles/${write.id}`, { article: { position: write.position } });
 			applied += 1;
 		} catch (error) {
 			const reason = error instanceof Error ? error.message : String(error);
@@ -104505,6 +105044,7 @@ const createHelpCenterTools = (ctx) => {
 		return applied;
 	};
 	return [
+		...createListBrandsTool(ctx),
 		{
 			name: "search_articles",
 			namespace: "help_center",
@@ -104515,7 +105055,8 @@ const createHelpCenterTools = (ctx) => {
 				query: string$2().min(1).describe("Full-text query matched against article titles and body. Plain keywords; combine with the locale filter to scope to one language."),
 				locale: string$2().optional().describe("Filter by locale (e.g., \"en-us\", \"fr\")"),
 				per_page: number$2().int().min(1).max(100).default(100).describe(PER_PAGE_DESC),
-				page: number$2().int().min(1).default(1).describe(PAGE_DESC)
+				page: number$2().int().min(1).default(1).describe(PAGE_DESC),
+				...brandIdPart
 			}),
 			annotations: {
 				readOnlyHint: true,
@@ -104524,14 +105065,15 @@ const createHelpCenterTools = (ctx) => {
 				openWorldHint: true
 			},
 			handler: async (params) => {
-				const { query, locale, per_page, page } = params;
+				const { query, locale, per_page, page, brand_id } = params;
 				const token = await getToken();
+				const hcSubdomain = await resolveHcSubdomain(brand_id);
 				const p = {
 					query,
 					...buildOffsetParams(per_page, page)
 				};
 				if (locale) p["locale"] = locale;
-				const response = await helpCenterGet(subdomain, token, "/articles/search", p);
+				const response = await helpCenterGet(hcSubdomain, token, "/articles/search", p);
 				return { content: [{
 					type: "text",
 					text: formatList(response.results ?? [], formatArticleSummary, extractSearchPaginationMeta(response, per_page, page))
@@ -104546,7 +105088,8 @@ const createHelpCenterTools = (ctx) => {
 			description: "Retrieve an article by ID with full body content. For large articles, prefer get_article_outline + get_article_section to save tokens. Optionally specify locale for a translated version. Returns body (HTML), metadata, source_locale, and list of available translations.",
 			inputSchema: object({
 				article_id: number$2().int().describe(ARTICLE_ID_DESC),
-				locale: string$2().optional().describe("Locale for translated version")
+				locale: string$2().optional().describe("Locale for translated version"),
+				...brandIdPart
 			}),
 			annotations: {
 				readOnlyHint: true,
@@ -104555,11 +105098,12 @@ const createHelpCenterTools = (ctx) => {
 				openWorldHint: true
 			},
 			handler: async (params) => {
-				const { article_id, locale } = params;
+				const { article_id, locale, brand_id } = params;
 				const token = await getToken();
+				const hcSubdomain = await resolveHcSubdomain(brand_id);
 				const path = locale ? `/${locale}/articles/${article_id}` : `/articles/${article_id}`;
-				const { article } = await helpCenterGet(subdomain, token, path);
-				const translations = await listTranslations(subdomain, token, article_id);
+				const { article } = await helpCenterGet(hcSubdomain, token, path, void 0);
+				const translations = await listTranslations(hcSubdomain, token, article_id);
 				const text = (largeArticleHint(article.body, parseSections(article.body).length) ?? "") + formatArticle(article) + `\n\n**Available translations**: ${translations.map((t) => t.locale).join(", ")}`;
 				return { content: [{
 					type: "text",
@@ -104576,7 +105120,8 @@ const createHelpCenterTools = (ctx) => {
 			inputSchema: object({
 				locale: string$2().optional().describe("Locale for category names (e.g., \"en-us\", \"fr\"). Defaults to the Help Center default locale."),
 				page_size: number$2().int().min(1).max(100).default(100).describe("Categories per page (1-100, default 100)."),
-				cursor: string$2().optional().describe("Pagination cursor from a previous response; omit for the first page.")
+				cursor: string$2().optional().describe("Pagination cursor from a previous response; omit for the first page."),
+				...brandIdPart
 			}),
 			annotations: {
 				readOnlyHint: true,
@@ -104585,10 +105130,11 @@ const createHelpCenterTools = (ctx) => {
 				openWorldHint: true
 			},
 			handler: async (params) => {
-				const { locale, page_size, cursor } = params;
+				const { locale, page_size, cursor, brand_id } = params;
 				const token = await getToken();
+				const hcSubdomain = await resolveHcSubdomain(brand_id);
 				const path = `${localePrefix(locale)}/categories`;
-				const response = await helpCenterGet(subdomain, token, path, buildCursorParams(page_size, cursor));
+				const response = await helpCenterGet(hcSubdomain, token, path, buildCursorParams(page_size, cursor));
 				const categories = response.categories ?? [];
 				return { content: [{
 					type: "text",
@@ -104606,7 +105152,8 @@ const createHelpCenterTools = (ctx) => {
 				category_id: number$2().int().optional().describe("Restrict to sections of this category (id from list_categories). Omit to list every section."),
 				locale: string$2().optional().describe("Locale for section names (e.g., \"en-us\", \"fr\"). Defaults to the Help Center default locale."),
 				page_size: number$2().int().min(1).max(100).default(100).describe("Sections per page (1-100, default 100)."),
-				cursor: string$2().optional().describe("Pagination cursor from a previous response; omit for the first page.")
+				cursor: string$2().optional().describe("Pagination cursor from a previous response; omit for the first page."),
+				...brandIdPart
 			}),
 			annotations: {
 				readOnlyHint: true,
@@ -104615,9 +105162,10 @@ const createHelpCenterTools = (ctx) => {
 				openWorldHint: true
 			},
 			handler: async (params) => {
-				const { category_id, locale, page_size, cursor } = params;
+				const { category_id, locale, page_size, cursor, brand_id } = params;
 				const token = await getToken();
-				const response = await helpCenterGet(subdomain, token, sectionListPath(category_id, locale), buildCursorParams(page_size, cursor));
+				const hcSubdomain = await resolveHcSubdomain(brand_id);
+				const response = await helpCenterGet(hcSubdomain, token, sectionListPath(category_id, locale), buildCursorParams(page_size, cursor));
 				const sections = response.sections ?? [];
 				return { content: [{
 					type: "text",
@@ -104643,7 +105191,8 @@ const createHelpCenterTools = (ctx) => {
 					"title"
 				]).default("position").describe("Field to sort by; \"position\" (the default) is the manual order set in Guide."),
 				sort_order: _enum(["asc", "desc"]).default("asc").describe("Sort direction: ascending or descending."),
-				include_translations: boolean$1().default(false).describe("Include available translation locales per article (causes 1 extra API call per article)")
+				include_translations: boolean$1().default(false).describe("Include available translation locales per article (causes 1 extra API call per article)"),
+				...brandIdPart
 			}),
 			annotations: {
 				readOnlyHint: true,
@@ -104652,9 +105201,10 @@ const createHelpCenterTools = (ctx) => {
 				openWorldHint: true
 			},
 			handler: async (params) => {
-				const { section_id, locale, page_size, cursor, sort_by, sort_order, include_translations } = params;
+				const { section_id, locale, page_size, cursor, sort_by, sort_order, include_translations, brand_id } = params;
 				const token = await getToken();
-				const response = await helpCenterGet(subdomain, token, articleListPath(section_id, locale), {
+				const hcSubdomain = await resolveHcSubdomain(brand_id);
+				const response = await helpCenterGet(hcSubdomain, token, articleListPath(section_id, locale), {
 					...buildCursorParams(page_size, cursor),
 					sort_by,
 					sort_order
@@ -104665,7 +105215,7 @@ const createHelpCenterTools = (ctx) => {
 					text: formatList(articles, formatArticleSummary, extractPaginationMeta(response, articles.length))
 				}] };
 				const formatted = await Promise.all(articles.map(async (article) => {
-					const locales = (await listTranslations(subdomain, token, article.id)).map((t) => t.locale).join(", ");
+					const locales = (await listTranslations(hcSubdomain, token, article.id)).map((t) => t.locale).join(", ");
 					return `${formatArticleSummary(article)}\n- **Translations**: ${locales}`;
 				}));
 				const meta = extractPaginationMeta(response, articles.length);
@@ -104682,23 +105232,25 @@ const createHelpCenterTools = (ctx) => {
 			readOnly: true,
 			title: "List Promoted Help Center Articles",
 			description: "List the promoted (\"featured\") Help Center articles — the small, editorially-curated set surfaced at the top of their sections. Returns metadata only (no body); use get_article for full content. COST: the Help Center API has no server-side promoted filter, so this scans article pages (one Zendesk API request per page, up to ARTICLE_RESOURCES_SCAN_MAX_PAGES, default 20) and filters client-side — potentially costly on a large Help Center. Each call performs a fresh, uncached scan, so avoid calling it repeatedly. On a very large Help Center some promoted articles may be omitted, and both the omission and the number of pages scanned are flagged in the output. Lists the default locale. To promote or unpromote an article, use update_article with `promoted` (requires Help Center admin / Guide admin rights).",
-			inputSchema: object({}),
+			inputSchema: object({ ...brandIdPart }),
 			annotations: {
 				readOnlyHint: true,
 				destructiveHint: false,
 				idempotentHint: true,
 				openWorldHint: true
 			},
-			handler: async () => {
+			handler: async (params) => {
+				const { brand_id } = params;
 				const token = await getToken();
-				const { articles, truncated, pagesScanned } = await fetchPromotedArticles(subdomain, token);
+				const hcSubdomain = await resolveHcSubdomain(brand_id);
+				const { articles, truncated, pagesScanned } = await fetchPromotedArticles(hcSubdomain, token, ARTICLE_RESOURCES_SCAN_MAX_PAGES);
 				const header = `Promoted (featured) articles: ${articles.length}`;
 				const body = articles.length ? articles.map(formatArticleSummary).join("\n\n") : "_No promoted articles found._";
 				const cost = `${pagesScanned} Zendesk API request${pagesScanned === 1 ? "" : "s"}`;
 				const note = scanCostNote(truncated, pagesScanned, cost);
 				return { content: [{
 					type: "text",
-					text: truncateIfNeeded(`${header}\n\n${body}${note}`, "list_promoted_articles takes no parameters, so this listing cannot be narrowed from the call; read a single article with get_article.")
+					text: truncateIfNeeded(`${header}\n\n${body}${note}`, "list_promoted_articles takes no filter parameters, so this listing cannot be narrowed from the call; read a single article with get_article.")
 				}] };
 			}
 		},
@@ -104708,7 +105260,10 @@ const createHelpCenterTools = (ctx) => {
 			readOnly: true,
 			title: "List Article Translations",
 			description: "List all available translations for an article (metadata only, no body: locale, title, draft, updated_at). Use get_article with locale for full translated content.",
-			inputSchema: object({ article_id: number$2().int().describe(ARTICLE_ID_DESC) }),
+			inputSchema: object({
+				article_id: number$2().int().describe(ARTICLE_ID_DESC),
+				...brandIdPart
+			}),
 			annotations: {
 				readOnlyHint: true,
 				destructiveHint: false,
@@ -104716,9 +105271,10 @@ const createHelpCenterTools = (ctx) => {
 				openWorldHint: true
 			},
 			handler: async (params) => {
-				const { article_id } = params;
+				const { article_id, brand_id } = params;
 				const token = await getToken();
-				const translations = await listTranslations(subdomain, token, article_id);
+				const hcSubdomain = await resolveHcSubdomain(brand_id);
+				const translations = await listTranslations(hcSubdomain, token, article_id);
 				return { content: [{
 					type: "text",
 					text: formatList(translations, formatTranslationSummary, void 0, "list_article_translations takes only article_id, so this listing cannot be narrowed from the call; read one locale in full with get_article.")
@@ -104736,7 +105292,8 @@ const createHelpCenterTools = (ctx) => {
 				locale: string$2().describe("Target locale (e.g., \"fr\", \"de\")"),
 				title: string$2().min(1).describe("Translated article title."),
 				body: string$2().min(1).describe("Translated body (HTML)"),
-				draft: boolean$1().default(false).describe("Create the translation as a draft (not visible to end users). Defaults to false (published).")
+				draft: boolean$1().default(false).describe("Create the translation as a draft (not visible to end users). Defaults to false (published)."),
+				...brandIdPart
 			}),
 			annotations: {
 				readOnlyHint: false,
@@ -104745,9 +105302,10 @@ const createHelpCenterTools = (ctx) => {
 				openWorldHint: true
 			},
 			handler: async (params) => {
-				const { article_id, locale, title, body, draft } = params;
+				const { article_id, locale, title, body, draft, brand_id } = params;
 				const token = await getToken();
-				const { translation } = await helpCenterPost(subdomain, token, `/articles/${article_id}/translations`, { translation: {
+				const hcSubdomain = await resolveHcSubdomain(brand_id);
+				const { translation } = await helpCenterPost(hcSubdomain, token, `/articles/${article_id}/translations`, { translation: {
 					locale,
 					title,
 					body,
@@ -104770,7 +105328,8 @@ const createHelpCenterTools = (ctx) => {
 				locale: string$2().describe("Locale of the translation to update, e.g. \"en-us\" or \"fr\". Use the source_locale (from get_article) to edit the default language."),
 				title: string$2().optional().describe("New title for this locale. Omit to leave the current title unchanged."),
 				body: string$2().optional().describe("New full body (HTML) for this locale. Replaces the entire body — for a single-section edit prefer update_article_section. Omit to leave the body unchanged."),
-				draft: boolean$1().optional().describe("When true, keeps this translation as a draft; when false, publishes it.")
+				draft: boolean$1().optional().describe("When true, keeps this translation as a draft; when false, publishes it."),
+				...brandIdPart
 			}),
 			annotations: {
 				readOnlyHint: false,
@@ -104779,9 +105338,10 @@ const createHelpCenterTools = (ctx) => {
 				openWorldHint: true
 			},
 			handler: async (params) => {
-				const { article_id, locale, ...updates } = params;
+				const { article_id, locale, brand_id, ...updates } = params;
 				const token = await getToken();
-				const { translation } = await helpCenterPut(subdomain, token, `/articles/${article_id}/translations/${locale}`, { translation: updates });
+				const hcSubdomain = await resolveHcSubdomain(brand_id);
+				const { translation } = await helpCenterPut(hcSubdomain, token, `/articles/${article_id}/translations/${locale}`, { translation: updates });
 				return { content: [{
 					type: "text",
 					text: `Translation updated for article #${article_id} in "${locale}".\n\n${formatTranslation(translation)}`
@@ -104794,7 +105354,10 @@ const createHelpCenterTools = (ctx) => {
 			readOnly: true,
 			title: "List Section Translations",
 			description: "List the translations of a Help Center section: for each locale, the localized name, whether a description is set, and whether the translation is published or still a draft. Reach for this when a section looks wrong in a locale, because list_sections with that locale cannot settle it: a section with no translation is omitted from it, while a section whose translation is an unpublished draft may still be listed there under the draft name — so appearing in that listing does not mean published, and the draft flag here is what decides. Fix either case with set_section_translation; to sweep every category and section at once, use find_translation_gaps.",
-			inputSchema: object({ section_id: number$2().int().describe("Section ID — the numeric id of the Help Center section. Obtain it from list_sections or the zendesk-hc://topology resource.") }),
+			inputSchema: object({
+				section_id: number$2().int().describe("Section ID — the numeric id of the Help Center section. Obtain it from list_sections or the zendesk-hc://topology resource."),
+				...brandIdPart
+			}),
 			annotations: {
 				readOnlyHint: true,
 				destructiveHint: false,
@@ -104802,9 +105365,10 @@ const createHelpCenterTools = (ctx) => {
 				openWorldHint: true
 			},
 			handler: async (params) => {
-				const { section_id } = params;
+				const { section_id, brand_id } = params;
 				const token = await getToken();
-				const translations = await listNodeTranslations(subdomain, token, "sections", section_id);
+				const hcSubdomain = await resolveHcSubdomain(brand_id);
+				const translations = await listNodeTranslations(hcSubdomain, token, "sections", section_id, void 0);
 				return { content: [{
 					type: "text",
 					text: formatList(translations, formatNodeTranslationSummary, void 0, "list_section_translations takes only section_id, so this listing cannot be narrowed from the call; write one locale with set_section_translation.")
@@ -104817,7 +105381,10 @@ const createHelpCenterTools = (ctx) => {
 			readOnly: true,
 			title: "List Category Translations",
 			description: "List the translations of a Help Center category: for each locale, the localized name, whether a description is set, and whether the translation is published or still a draft. Reach for this when a category looks wrong in a locale, because list_categories with that locale cannot settle it: a category with no translation is omitted from it, while a category whose translation is an unpublished draft may still be listed there under the draft name — so appearing in that listing does not mean published, and the draft flag here is what decides. Fix either case with set_category_translation; to sweep every category and section at once, use find_translation_gaps.",
-			inputSchema: object({ category_id: number$2().int().describe("Category ID — the numeric id of the Help Center category. Obtain it from list_categories or the zendesk-hc://topology resource.") }),
+			inputSchema: object({
+				category_id: number$2().int().describe("Category ID — the numeric id of the Help Center category. Obtain it from list_categories or the zendesk-hc://topology resource."),
+				...brandIdPart
+			}),
 			annotations: {
 				readOnlyHint: true,
 				destructiveHint: false,
@@ -104825,9 +105392,10 @@ const createHelpCenterTools = (ctx) => {
 				openWorldHint: true
 			},
 			handler: async (params) => {
-				const { category_id } = params;
+				const { category_id, brand_id } = params;
 				const token = await getToken();
-				const translations = await listNodeTranslations(subdomain, token, "categories", category_id);
+				const hcSubdomain = await resolveHcSubdomain(brand_id);
+				const translations = await listNodeTranslations(hcSubdomain, token, "categories", category_id, void 0);
 				return { content: [{
 					type: "text",
 					text: formatList(translations, formatNodeTranslationSummary, void 0, "list_category_translations takes only category_id, so this listing cannot be narrowed from the call; write one locale with set_category_translation.")
@@ -104842,7 +105410,8 @@ const createHelpCenterTools = (ctx) => {
 			description: "Audit the Help Center tree for a target locale and report every category and section that has no translation, or one that is still an unpublished draft. Use it before or after translating articles: an article published in a second locale is unreachable while its parent section only exists in the source locale. Listing sections in that locale cannot answer this — a node with no translation is simply absent, without saying why, and a node whose translation is an unpublished draft may still be listed under its draft name — so this audit reads the draft flag on each node instead of trusting that listing. Costs two listings and covers up to 100 categories and 100 sections; past that only the first page of each level is audited, and the report says so — pass category_id to narrow it. Fix what it reports with set_section_translation / set_category_translation.",
 			inputSchema: object({
 				locale: string$2().describe("Locale to audit, e.g. \"fr\" or \"de\" — usually a non-default active locale of the Help Center (zendesk-hc://topology lists them). A locale that is not active is reported as a warning, since every node would then look untranslated."),
-				category_id: number$2().int().optional().describe("Restrict the audit to this category and the sections it contains (id from list_categories). Omit to sweep the whole tree, which costs two listings and covers up to 100 categories and 100 sections.")
+				category_id: number$2().int().optional().describe("Restrict the audit to this category and the sections it contains (id from list_categories). Omit to sweep the whole tree, which costs two listings and covers up to 100 categories and 100 sections."),
+				...brandIdPart
 			}),
 			annotations: {
 				readOnlyHint: true,
@@ -104851,12 +105420,13 @@ const createHelpCenterTools = (ctx) => {
 				openWorldHint: true
 			},
 			handler: async (params) => {
-				const { locale, category_id } = params;
+				const { locale, category_id, brand_id } = params;
 				const token = await getToken();
+				const hcSubdomain = await resolveHcSubdomain(brand_id);
 				const [locales, categoryScope, sectionsRes] = await Promise.all([
-					helpCenterGet(subdomain, token, "/locales"),
-					fetchGapCategories(subdomain, token, category_id),
-					helpCenterGet(subdomain, token, sectionListPath(category_id, void 0), {
+					helpCenterGet(hcSubdomain, token, "/locales", void 0),
+					fetchGapCategories(hcSubdomain, token, category_id),
+					helpCenterGet(hcSubdomain, token, sectionListPath(category_id, void 0), {
 						...buildCursorParams(100, void 0),
 						include: TRANSLATIONS_SIDELOAD
 					})
@@ -104899,7 +105469,8 @@ const createHelpCenterTools = (ctx) => {
 				locale: string$2().describe("Locale to write, e.g. \"fr\" or \"de\". Must be an active locale of the Help Center (zendesk-hc://topology lists them); list_section_translations shows which ones the section already has."),
 				name: string$2().min(1).optional().describe("Localized section name for this locale (sent as the API's translation `title`). Required when the locale has no translation yet; omit on an existing one to leave its name untouched, for instance when only publishing a draft."),
 				description: string$2().optional().describe("Localized section description for this locale (sent as the API's translation `body`). Omit to leave an existing description untouched; pass an empty string to clear it."),
-				draft: boolean$1().optional().describe("Publication state: false publishes the translation, making the section visible to end users in this locale; true keeps (or puts) it back as a draft. Defaults to false when creating; omit on an existing translation to leave its state unchanged.")
+				draft: boolean$1().optional().describe("Publication state: false publishes the translation, making the section visible to end users in this locale; true keeps (or puts) it back as a draft. Defaults to false when creating; omit on an existing translation to leave its state unchanged."),
+				...brandIdPart
 			}),
 			annotations: {
 				readOnlyHint: false,
@@ -104908,9 +105479,10 @@ const createHelpCenterTools = (ctx) => {
 				openWorldHint: true
 			},
 			handler: async (params) => {
-				const { section_id, ...input } = params;
+				const { section_id, brand_id, ...input } = params;
 				const token = await getToken();
-				const { translation, created } = await upsertNodeTranslation(subdomain, token, "sections", section_id, input);
+				const hcSubdomain = await resolveHcSubdomain(brand_id);
+				const { translation, created } = await upsertNodeTranslation(hcSubdomain, token, "sections", section_id, input);
 				return { content: [{
 					type: "text",
 					text: nodeTranslationWriteText("sections", section_id, translation, created)
@@ -104928,7 +105500,8 @@ const createHelpCenterTools = (ctx) => {
 				locale: string$2().describe("Locale to write, e.g. \"fr\" or \"de\". Must be an active locale of the Help Center (zendesk-hc://topology lists them); list_category_translations shows which ones the category already has."),
 				name: string$2().min(1).optional().describe("Localized category name for this locale (sent as the API's translation `title`). Required when the locale has no translation yet; omit on an existing one to leave its name untouched, for instance when only publishing a draft."),
 				description: string$2().optional().describe("Localized category description for this locale (sent as the API's translation `body`). Omit to leave an existing description untouched; pass an empty string to clear it."),
-				draft: boolean$1().optional().describe("Publication state: false publishes the translation, making the category visible to end users in this locale; true keeps (or puts) it back as a draft. Defaults to false when creating; omit on an existing translation to leave its state unchanged.")
+				draft: boolean$1().optional().describe("Publication state: false publishes the translation, making the category visible to end users in this locale; true keeps (or puts) it back as a draft. Defaults to false when creating; omit on an existing translation to leave its state unchanged."),
+				...brandIdPart
 			}),
 			annotations: {
 				readOnlyHint: false,
@@ -104937,9 +105510,10 @@ const createHelpCenterTools = (ctx) => {
 				openWorldHint: true
 			},
 			handler: async (params) => {
-				const { category_id, ...input } = params;
+				const { category_id, brand_id, ...input } = params;
 				const token = await getToken();
-				const { translation, created } = await upsertNodeTranslation(subdomain, token, "categories", category_id, input);
+				const hcSubdomain = await resolveHcSubdomain(brand_id);
+				const { translation, created } = await upsertNodeTranslation(hcSubdomain, token, "categories", category_id, input);
 				return { content: [{
 					type: "text",
 					text: nodeTranslationWriteText("categories", category_id, translation, created)
@@ -104991,7 +105565,8 @@ const createHelpCenterTools = (ctx) => {
 				locale: string$2().optional().describe("Source locale for the article, e.g. \"en-us\" or \"fr\". Defaults to the Help Center's default locale; becomes the article's source_locale."),
 				draft: boolean$1().default(true).describe("When true (default), the article is created unpublished; set false to publish immediately."),
 				promoted: boolean$1().default(false).describe("When true, marks the article as promoted (featured) in its section. Defaults to false."),
-				label_names: array(string$2()).optional().describe("Label names for search ranking (use list_labels to see existing labels)")
+				label_names: array(string$2()).optional().describe("Label names for search ranking (use list_labels to see existing labels)"),
+				...brandIdPart
 			}),
 			annotations: {
 				readOnlyHint: false,
@@ -105000,9 +105575,10 @@ const createHelpCenterTools = (ctx) => {
 				openWorldHint: true
 			},
 			handler: async (params) => {
-				const { section_id, ...articleData } = params;
+				const { section_id, brand_id, ...articleData } = params;
 				const token = await getToken();
-				const { article } = await helpCenterPost(subdomain, token, `/sections/${section_id}/articles`, { article: articleData });
+				const hcSubdomain = await resolveHcSubdomain(brand_id);
+				const { article } = await helpCenterPost(hcSubdomain, token, `/sections/${section_id}/articles`, { article: articleData });
 				return { content: [{
 					type: "text",
 					text: `Article #${article.id} created.\n\n${formatArticle(article)}`
@@ -105025,7 +105601,8 @@ const createHelpCenterTools = (ctx) => {
 				author_id: number$2().int().optional().describe("User id of the article author (from search_users)."),
 				permission_group_id: number$2().int().optional().describe("Guide permission group controlling who can edit (id from list_permission_groups; if that is forbidden because the token is not a Guide admin, reuse the permission_group_id of an existing article from get_article)."),
 				section_id: number$2().int().optional().describe("Move the article to this section (numeric id from list_sections)."),
-				position: number$2().int().min(0).optional().describe("Sort position within the section (manual ordering only; 0 = first/top). New articles default to position 0. To move an article to the END of its section, set this to one more than the highest current position: read the highest position P from list_articles with sort_by=\"position\", sort_order=\"desc\", then set position = P + 1.")
+				position: number$2().int().min(0).optional().describe("Sort position within the section (manual ordering only; 0 = first/top). New articles default to position 0. To move an article to the END of its section, set this to one more than the highest current position: read the highest position P from list_articles with sort_by=\"position\", sort_order=\"desc\", then set position = P + 1."),
+				...brandIdPart
 			}),
 			annotations: {
 				readOnlyHint: false,
@@ -105034,9 +105611,10 @@ const createHelpCenterTools = (ctx) => {
 				openWorldHint: true
 			},
 			handler: async (params) => {
-				const { article_id, ...updates } = params;
+				const { article_id, brand_id, ...updates } = params;
 				const token = await getToken();
-				const { article } = await helpCenterPut(subdomain, token, `/articles/${article_id}`, { article: updates });
+				const hcSubdomain = await resolveHcSubdomain(brand_id);
+				const { article } = await helpCenterPut(hcSubdomain, token, `/articles/${article_id}`, { article: updates });
 				return { content: [{
 					type: "text",
 					text: `Article #${article.id} updated.\n\n${formatArticle(article)}`
@@ -105059,7 +105637,8 @@ const createHelpCenterTools = (ctx) => {
 				]).describe("Where to move the article relative to its section siblings: \"top\" (becomes first), \"bottom\" (becomes last), or \"before\"/\"after\" a specific reference article. \"before\" and \"after\" require reference_article_id."),
 				reference_article_id: number$2().int().optional().describe("The sibling article to position next to when target is \"before\" or \"after\" (numeric id from list_articles). Must belong to the same section and differ from article_id; leave it unset for \"top\" or \"bottom\"."),
 				normalize: boolean$1().default(false).describe("When true, also renumber every article in the section to contiguous positions (0, 1, 2, …) so the stored positions stay tidy. Defaults to false, which writes the fewest positions possible and lets gaps remain. Either way the confirmation threshold still applies."),
-				confirm: boolean$1().default(false).describe("Safety guard for large reorders. When the move would rewrite more article positions than the configured threshold (REORDER_CONFIRM_THRESHOLD, default 20), the tool refuses and reports the count until you pass true here. Has no effect on small reorders.")
+				confirm: boolean$1().default(false).describe("Safety guard for large reorders. When the move would rewrite more article positions than the configured threshold (REORDER_CONFIRM_THRESHOLD, default 20), the tool refuses and reports the count until you pass true here. Has no effect on small reorders."),
+				...brandIdPart
 			}),
 			annotations: {
 				readOnlyHint: false,
@@ -105068,15 +105647,16 @@ const createHelpCenterTools = (ctx) => {
 				openWorldHint: true
 			},
 			handler: async (params) => {
-				const { article_id, target, reference_article_id, normalize = false, confirm = false } = params;
+				const { article_id, target, reference_article_id, normalize = false, confirm = false, brand_id } = params;
 				assertReorderParamsCoherent(article_id, target, reference_article_id);
 				const needsReference = needsReferenceArticle(target);
 				const token = await getToken();
-				const { article } = await helpCenterGet(subdomain, token, `/articles/${article_id}`);
+				const hcSubdomain = await resolveHcSubdomain(brand_id);
+				const { article } = await helpCenterGet(hcSubdomain, token, `/articles/${article_id}`, void 0);
 				const sectionId = article.section_id;
 				const locale = article.source_locale;
-				const effective = await fetchSectionOrder(sectionId, locale, token);
-				if (reference_article_id !== void 0) await assertReferenceInSection(effective, reference_article_id, article_id, sectionId, token);
+				const effective = await fetchSectionOrder(sectionId, locale, token, hcSubdomain);
+				if (reference_article_id !== void 0) await assertReferenceInSection(effective, reference_article_id, article_id, sectionId, token, hcSubdomain);
 				const targetLabel = needsReference ? `${target} article #${reference_article_id}` : target;
 				const desired = arrangeDesiredOrder(effective, article_id, target, reference_article_id);
 				const writes = computePositionWrites(desired, article_id, normalize);
@@ -105092,8 +105672,8 @@ const createHelpCenterTools = (ctx) => {
 					type: "text",
 					text: `Reordering article #${article_id} to ${targetLabel} would reposition ${writes.length} articles in section #${sectionId}, above the safety threshold of ${REORDER_CONFIRM_THRESHOLD}. Re-run with confirm: true to proceed.`
 				}] };
-				const applied = await applyPositionWrites(writes, article_id, token);
-				const after = await fetchSectionOrder(sectionId, locale, token);
+				const applied = await applyPositionWrites(writes, article_id, token, hcSubdomain);
+				const after = await fetchSectionOrder(sectionId, locale, token, hcSubdomain);
 				if (!isPlacedAsRequested(after, article_id, target, reference_article_id)) return { content: [{
 					type: "text",
 					text: autoSortNotice(sectionId, applied)
@@ -105112,7 +105692,8 @@ const createHelpCenterTools = (ctx) => {
 			description: "Archive (soft-delete) a Help Center article: it is removed from the Help Center but can be restored from the Guide admin UI. Returns a confirmation message; the article and all its translations become invisible to end users. This is the only removal the Zendesk API offers — permanent deletion is not available via the API (do it from the Guide admin UI). To only hide an article temporarily while keeping it in the knowledge base, use update_article with draft: true (unpublish) instead. Guarded by a required confirm flag.",
 			inputSchema: object({
 				article_id: number$2().int().describe(ARTICLE_ID_DESC),
-				confirm: boolean$1().describe("Explicit safety guard: must be set to true to archive the article. Any other value refuses the operation without calling Zendesk.")
+				confirm: boolean$1().describe("Explicit safety guard: must be set to true to archive the article. Any other value refuses the operation without calling Zendesk."),
+				...brandIdPart
 			}),
 			annotations: {
 				readOnlyHint: false,
@@ -105121,10 +105702,11 @@ const createHelpCenterTools = (ctx) => {
 				openWorldHint: true
 			},
 			handler: async (params) => {
-				const { article_id, confirm } = params;
+				const { article_id, confirm, brand_id } = params;
 				if (confirm !== true) throw new Error("Archiving is guarded: pass confirm: true to archive (soft-delete) this article. No changes were made.");
 				const token = await getToken();
-				await helpCenterDelete(subdomain, token, `/articles/${article_id}`);
+				const hcSubdomain = await resolveHcSubdomain(brand_id);
+				await helpCenterDelete(hcSubdomain, token, `/articles/${article_id}`);
 				return { content: [{
 					type: "text",
 					text: `Article #${article_id} archived (soft-deleted). It is removed from the Help Center; restore it from the Guide admin UI if needed.`
@@ -105196,19 +105778,21 @@ const createHelpCenterTools = (ctx) => {
 			readOnly: true,
 			title: "List Article Labels",
 			description: "List all article labels. Labels improve Help Center search ranking and are not visible to end users. Attach them to an article through the label_names parameter of create_article or update_article.",
-			inputSchema: object({}),
+			inputSchema: object({ ...brandIdPart }),
 			annotations: {
 				readOnlyHint: true,
 				destructiveHint: false,
 				idempotentHint: true,
 				openWorldHint: true
 			},
-			handler: async () => {
+			handler: async (params) => {
+				const { brand_id } = params;
 				const token = await getToken();
-				const response = await helpCenterGet(subdomain, token, "/articles/labels");
+				const hcSubdomain = await resolveHcSubdomain(brand_id);
+				const response = await helpCenterGet(hcSubdomain, token, "/articles/labels", void 0);
 				return { content: [{
 					type: "text",
-					text: formatList(response.labels ?? [], formatLabel, void 0, "list_labels takes no parameters, so this listing cannot be narrowed from the call.")
+					text: formatList(response.labels ?? [], formatLabel, void 0, "list_labels takes no filter parameters, so this listing cannot be narrowed from the call.")
 				}] };
 			}
 		},
@@ -105229,7 +105813,7 @@ const createHelpCenterTools = (ctx) => {
 				const token = await getToken();
 				let response;
 				try {
-					response = await helpCenterGet(subdomain, token, "/user_segments");
+					response = await helpCenterGet(subdomain, token, "/user_segments", void 0);
 				} catch (error) {
 					if (error instanceof ZendeskApiError && error.status === 403) throw new Error("list_user_segments reads Help Center user segments (GET /help_center/user_segments), which Zendesk restricts to Guide admins / Help Center managers. The current token lacks that role (HTTP 403). To set an article's visibility without it, reuse the user_segment_id of an existing article (get_article), or omit user_segment_id when creating/updating to default to everyone.", { cause: error });
 					throw error;
@@ -105246,7 +105830,10 @@ const createHelpCenterTools = (ctx) => {
 			readOnly: true,
 			title: "List Article Attachments",
 			description: "List all attachments for an article. Returns attachment metadata only (id, file name, content type, size, URL), not the file bytes; both inline and block attachments are included. This is for Help Center articles — for attachments on support tickets use get_ticket_attachments instead. Upload new files with create_article_attachment.",
-			inputSchema: object({ article_id: number$2().int().describe("ID of the Help Center article whose attachments to list.") }),
+			inputSchema: object({
+				article_id: number$2().int().describe("ID of the Help Center article whose attachments to list."),
+				...brandIdPart
+			}),
 			annotations: {
 				readOnlyHint: true,
 				destructiveHint: false,
@@ -105254,9 +105841,10 @@ const createHelpCenterTools = (ctx) => {
 				openWorldHint: true
 			},
 			handler: async (params) => {
-				const { article_id } = params;
+				const { article_id, brand_id } = params;
 				const token = await getToken();
-				const attachments = (await helpCenterGet(subdomain, token, `/articles/${article_id}/attachments`)).article_attachments ?? [];
+				const hcSubdomain = await resolveHcSubdomain(brand_id);
+				const attachments = (await helpCenterGet(hcSubdomain, token, `/articles/${article_id}/attachments`)).article_attachments ?? [];
 				if (attachments.length === 0) return { content: [{
 					type: "text",
 					text: `No attachments found on article #${article_id}.`
@@ -105275,7 +105863,8 @@ const createHelpCenterTools = (ctx) => {
 			description: "Return a compact outline of an article (list of sections delimited by h1/h2/h3, with word counts) for the given locale (defaults to source_locale). Includes available translations with their outdated status. Use get_article_section to fetch a specific section.",
 			inputSchema: object({
 				article_id: number$2().int().describe(ARTICLE_ID_DESC),
-				locale: string$2().optional().describe("Locale of the body to outline (defaults to article source_locale)")
+				locale: string$2().optional().describe("Locale of the body to outline (defaults to article source_locale)"),
+				...brandIdPart
 			}),
 			annotations: {
 				readOnlyHint: true,
@@ -105284,12 +105873,13 @@ const createHelpCenterTools = (ctx) => {
 				openWorldHint: true
 			},
 			handler: async (params) => {
-				const { article_id, locale } = params;
+				const { article_id, locale, brand_id } = params;
 				const token = await getToken();
-				const { article } = await helpCenterGet(subdomain, token, `/articles/${article_id}`);
+				const hcSubdomain = await resolveHcSubdomain(brand_id);
+				const { article } = await helpCenterGet(hcSubdomain, token, `/articles/${article_id}`, void 0);
 				const effectiveLocale = locale ?? article.source_locale;
-				const { translation } = await helpCenterGet(subdomain, token, `/articles/${article_id}/translations/${effectiveLocale}`);
-				const translations = await listTranslations(subdomain, token, article_id);
+				const { translation } = await helpCenterGet(hcSubdomain, token, `/articles/${article_id}/translations/${effectiveLocale}`, void 0);
+				const translations = await listTranslations(hcSubdomain, token, article_id);
 				const sections = parseSections(translation.body);
 				const outlineLines = sections.length ? sections.map((s) => `- [${s.index}] ${s.headingTag ? `${s.headingTag}: ` : ""}${s.heading} (${s.wordCount} words)`).join("\n") : "_(no sections detected)_";
 				const translationsList = translations.map((t) => `- ${t.locale}${t.outdated ? " (outdated)" : ""}`).join("\n");
@@ -105318,7 +105908,8 @@ const createHelpCenterTools = (ctx) => {
 				article_id: number$2().int().describe(ARTICLE_ID_DESC),
 				locale: string$2().describe("Locale of the body (e.g., \"en-us\", \"fr\")"),
 				section_index: number$2().int().min(0).describe("0-based index of the section (see get_article_outline)"),
-				format: _enum(["html", "markdown"]).default("html").describe("Output format. \"html\" (default) is round-trip safe. \"markdown\" is lossy on some HTML structures — use only for human review, not before update_article_section.")
+				format: _enum(["html", "markdown"]).default("html").describe("Output format. \"html\" (default) is round-trip safe. \"markdown\" is lossy on some HTML structures — use only for human review, not before update_article_section."),
+				...brandIdPart
 			}),
 			annotations: {
 				readOnlyHint: true,
@@ -105327,9 +105918,10 @@ const createHelpCenterTools = (ctx) => {
 				openWorldHint: true
 			},
 			handler: async (params) => {
-				const { article_id, locale, section_index, format } = params;
+				const { article_id, locale, section_index, format, brand_id } = params;
 				const token = await getToken();
-				const { translation } = await helpCenterGet(subdomain, token, `/articles/${article_id}/translations/${locale}`);
+				const hcSubdomain = await resolveHcSubdomain(brand_id);
+				const { translation } = await helpCenterGet(hcSubdomain, token, `/articles/${article_id}/translations/${locale}`, void 0);
 				const sections = parseSections(translation.body);
 				const section = sections[section_index];
 				if (!section) throw new Error(`Section index ${section_index} not found. Article has ${sections.length} section(s) (0-${Math.max(0, sections.length - 1)}).`);
@@ -105357,7 +105949,8 @@ const createHelpCenterTools = (ctx) => {
 				locale: string$2().describe("Locale of the translation to update"),
 				section_index: number$2().int().min(0).describe("0-based index of the section to replace (see get_article_outline). 0 is the heading-less intro when the body has text before its first heading, otherwise the first heading."),
 				content: string$2().describe("New content for the section (heading excluded: send neither the heading nor the \"## [n] hN: ...\" label line that get_article_section prints). HTML by default, Markdown if format=\"markdown\"."),
-				format: _enum(["html", "markdown"]).default("html").describe("Input format. \"html\" (default) is the safe path. \"markdown\" is converted to HTML server-side but may introduce artifacts on complex content.")
+				format: _enum(["html", "markdown"]).default("html").describe("Input format. \"html\" (default) is the safe path. \"markdown\" is converted to HTML server-side but may introduce artifacts on complex content."),
+				...brandIdPart
 			}),
 			annotations: {
 				readOnlyHint: false,
@@ -105366,12 +105959,13 @@ const createHelpCenterTools = (ctx) => {
 				openWorldHint: true
 			},
 			handler: async (params) => {
-				const { article_id, locale, section_index, content, format } = params;
+				const { article_id, locale, section_index, content, format, brand_id } = params;
 				const token = await getToken();
-				const { translation } = await helpCenterGet(subdomain, token, `/articles/${article_id}/translations/${locale}`);
+				const hcSubdomain = await resolveHcSubdomain(brand_id);
+				const { translation } = await helpCenterGet(hcSubdomain, token, `/articles/${article_id}/translations/${locale}`, void 0);
 				const newSectionHtml = format === "markdown" ? markdownToHtml(content) : content;
 				const { body: newBody, stripped, contentHeadings, introLost, sectionsBefore } = applySectionUpdate(translation.body, section_index, newSectionHtml);
-				const { translation: updated } = await helpCenterPut(subdomain, token, `/articles/${article_id}/translations/${locale}`, { translation: { body: newBody } });
+				const { translation: updated } = await helpCenterPut(hcSubdomain, token, `/articles/${article_id}/translations/${locale}`, { translation: { body: newBody } });
 				const updatedSections = parseSections(updated.body);
 				const updatedSection = updatedSections[section_index];
 				const emptied = introLost === "empty";
@@ -105402,7 +105996,8 @@ const createHelpCenterTools = (ctx) => {
 			inputSchema: object({
 				article_id: number$2().int().describe(ARTICLE_ID_DESC),
 				source_locale: string$2().describe("Reference locale to diff against, e.g. \"en-us\". Usually the article source_locale (from get_article)."),
-				target_locale: string$2().describe("Target locale to compare against source")
+				target_locale: string$2().describe("Target locale to compare against source"),
+				...brandIdPart
 			}),
 			annotations: {
 				readOnlyHint: true,
@@ -105411,12 +106006,13 @@ const createHelpCenterTools = (ctx) => {
 				openWorldHint: true
 			},
 			handler: async (params) => {
-				const { article_id, source_locale, target_locale } = params;
+				const { article_id, source_locale, target_locale, brand_id } = params;
 				const token = await getToken();
+				const hcSubdomain = await resolveHcSubdomain(brand_id);
 				const [sourceRes, targetRes, translations] = await Promise.all([
-					helpCenterGet(subdomain, token, `/articles/${article_id}/translations/${source_locale}`),
-					helpCenterGet(subdomain, token, `/articles/${article_id}/translations/${target_locale}`),
-					listTranslations(subdomain, token, article_id)
+					helpCenterGet(hcSubdomain, token, `/articles/${article_id}/translations/${source_locale}`, void 0),
+					helpCenterGet(hcSubdomain, token, `/articles/${article_id}/translations/${target_locale}`, void 0),
+					listTranslations(hcSubdomain, token, article_id)
 				]);
 				const sourceSections = parseSections(sourceRes.translation.body);
 				const targetSections = parseSections(targetRes.translation.body);
@@ -105455,7 +106051,8 @@ const createHelpCenterTools = (ctx) => {
 					abort: true,
 					error: (issue) => `File too large: ${issue.input.length} base64 characters, limit ${MAX_BASE64_INPUT_CHARS}. Downscale the file, split it, or host it elsewhere and link to it.`
 				}).describe(`The file's raw bytes as a base64-encoded string; the server decodes them before upload. At most ${MAX_BASE64_INPUT_CHARS} characters (about ${MAX_BASE64_INPUT_MB} MB of file); the HTTP transport additionally caps request bodies at 4 MB.`),
-				content_type: string$2().default("application/octet-stream").describe("MIME type of the file, e.g. \"image/png\" or \"application/pdf\". Defaults to application/octet-stream when omitted.")
+				content_type: string$2().default("application/octet-stream").describe("MIME type of the file, e.g. \"image/png\" or \"application/pdf\". Defaults to application/octet-stream when omitted."),
+				...brandIdPart
 			}),
 			annotations: {
 				readOnlyHint: false,
@@ -105464,13 +106061,14 @@ const createHelpCenterTools = (ctx) => {
 				openWorldHint: true
 			},
 			handler: async (params) => {
-				const { article_id, file_name, file_base64, content_type } = params;
+				const { article_id, file_name, file_base64, content_type, brand_id } = params;
 				const token = await getToken();
+				const hcSubdomain = await resolveHcSubdomain(brand_id);
 				const buffer = Buffer.from(file_base64, "base64");
 				const blob = new Blob([buffer], { type: content_type });
 				const formData = new FormData();
 				formData.append("file", blob, file_name);
-				const { article_attachment } = await helpCenterUpload(subdomain, token, `/articles/${article_id}/attachments`, formData);
+				const { article_attachment } = await helpCenterUpload(hcSubdomain, token, `/articles/${article_id}/attachments`, formData);
 				return { content: [{
 					type: "text",
 					text: `Attachment created for article #${article_id}.\n\n${formatAttachment(article_attachment)}`
@@ -105496,7 +106094,7 @@ const attachmentSchema = object({
 		error: (issue) => `Attachment too large: ${issue.input.length} base64 characters, limit ${MAX_BASE64_INPUT_CHARS}. Downscale the file, split the upload, or link to it instead of uploading.`
 	}).base64().describe(`File content encoded as base64. At most ${MAX_BASE64_INPUT_CHARS} characters (about ${MAX_BASE64_INPUT_MB} MB of file), and the attachments of one call must stay under that total; the HTTP transport additionally caps request bodies at 4 MB.`),
 	content_type: string$2().min(1).default("application/octet-stream").describe("MIME type, e.g. \"text/plain\", \"image/png\", \"application/pdf\".")
-});
+}).strict();
 /**
 * The optional `attachments` array parameter, capped as a whole.
 *
@@ -105826,7 +106424,7 @@ const createRequestTools = (ctx) => {
 				custom_fields: array(object({
 					id: number$2().int(),
 					value: unknown$3()
-				})).optional().describe("Answers to the form's own questions, as { id, value } pairs. Take both the ids and the accepted values from get_request_form; an id this form does not carry, or a value a dropdown does not offer, is refused here because Zendesk would drop it without an error. Option values are the tag strings, never numbers."),
+				}).strict()).optional().describe("Answers to the form's own questions, as { id, value } pairs. Take both the ids and the accepted values from get_request_form; an id this form does not carry, or a value a dropdown does not offer, is refused here because Zendesk would drop it without an error. Option values are the tag strings, never numbers."),
 				attachments: attachmentsParam("Files to attach to the request, such as a screenshot or a log, with their content base64-encoded.")
 			}),
 			annotations: {
@@ -106616,7 +107214,7 @@ const createTicketTools = (ctx) => {
 				custom_fields: array(object({
 					id: number$2().int(),
 					value: unknown$3()
-				})).optional().describe("Custom field values as { id, value } pairs (field ids come from your Zendesk admin settings). Call list_ticket_fields first to discover the numeric field ids and, for dropdown/multiselect fields, the exact option values Zendesk accepts.")
+				}).strict()).optional().describe("Custom field values as { id, value } pairs (field ids come from your Zendesk admin settings). Call list_ticket_fields first to discover the numeric field ids and, for dropdown/multiselect fields, the exact option values Zendesk accepts.")
 			}),
 			annotations: {
 				readOnlyHint: false,
@@ -106673,7 +107271,7 @@ const createTicketTools = (ctx) => {
 				custom_fields: array(object({
 					id: number$2().int(),
 					value: unknown$3()
-				})).optional().describe("Custom field values as { id, value } pairs (field ids come from your Zendesk admin settings). Call list_ticket_fields first to discover the numeric field ids and, for dropdown/multiselect fields, the exact option values Zendesk accepts."),
+				}).strict()).optional().describe("Custom field values as { id, value } pairs (field ids come from your Zendesk admin settings). Call list_ticket_fields first to discover the numeric field ids and, for dropdown/multiselect fields, the exact option values Zendesk accepts."),
 				followers: object({
 					add: subscriberIdList("User ids to start following the ticket. Omit to only remove."),
 					remove: subscriberIdList("User ids to stop following the ticket. Omit to only add.")
@@ -107337,32 +107935,6 @@ const readPackageInfo = () => {
 	return cached;
 };
 //#endregion
-//#region src/utils/validation.ts
-/**
-* Build a strict params parser for a tool's input schema, computing the strict
-* schema and the valid-key list once at construction rather than per call.
-*
-* Zod objects default to `strip`, which silently drops unknown keys. That hid
-* #100: a caller passing `per_page` to list_tickets (whose parameter is
-* `page_size`) had the key dropped, so a large unpaginated page came back. The
-* parser rejects unknown keys and names both the offending ones and the valid
-* parameters, so a misremembered name fails loudly.
-*
-* Used on the proxy dispatch path (namespace/single modes); in `all` mode the
-* SDK validates against the strict schema we register.
-*/
-const createStrictParamsParser = (schema) => {
-	const strict = schema.strict();
-	const validKeys = Object.keys(schema.shape).sort().join(", ");
-	return (params) => {
-		const result = strict.safeParse(params);
-		if (result.success) return result.data;
-		const unknownKeys = result.error.issues.flatMap((issue) => issue.code === "unrecognized_keys" ? issue.keys : []);
-		if (unknownKeys.length > 0) throw new Error(`Unknown parameter(s): ${unknownKeys.join(", ")}. Valid parameters: ${validKeys || "(none)"}.`);
-		throw result.error;
-	};
-};
-//#endregion
 //#region src/server.ts
 /**
 * Invoke a tool handler, notifying `onUnauthorized` when Zendesk rejects the
@@ -107445,6 +108017,31 @@ const createServerShell = (config, logger = silentLogger) => {
 	return server;
 };
 /**
+* Lazily resolve the Help Center subdomain the topology resource pins to: the
+* FIRST allowed brand when a list is set (named in the header), else undefined
+* (the account default). Uses the SHARED resolver so the topology and article
+* resources hit the same cached brand list the tools use; it only fires when a
+* brand list is set. Providers await it per read (cheap after the first), since
+* registerToolset is synchronous and cannot resolve up front.
+*/
+const firstBrandSubdomainResolver = (config, resolveBrandSubdomain) => {
+	const first = config.brandIds?.[0];
+	if (first === void 0 || first === "all") return () => Promise.resolve(void 0);
+	return () => resolveBrandSubdomain(first);
+};
+/**
+* Per-call brand guard for the article resource URIs in multi/all mode: the
+* {brand} slot of `<scheme>://brands/{brand}/articles/{id}` is resolved and
+* allow-list-checked EXACTLY like a tool call's `brand_id` (shared resolver,
+* same resolveBrand rules), returning the brand's subdomain for the Help
+* Center fetch. Unset/single modes never reach here — their URIs carry no
+* brand segment.
+*/
+const resourceBrandResolver = (config, resolveBrandSubdomain) => {
+	const singleLock = config.brandIds?.length === 1 && config.brandIds[0] !== "all";
+	return (idOrSubdomain) => singleLock ? resolveBrandSubdomain(idOrSubdomain) : resolveBrand(idOrSubdomain, config.brandIds, resolveBrandSubdomain).then((sub) => sub ?? config.subdomain);
+};
+/**
 * Registers one generation of the toolset (mode/filters applied) plus the
 * optional topology resource onto an existing server, and returns a handle
 * whose `dispose()` removes exactly what this call added. When the SDK server
@@ -107454,7 +108051,8 @@ const createServerShell = (config, logger = silentLogger) => {
 * without dropping the transport. `tools` is passed in (not built here) so the
 * reload path can hand over freshly re-imported definitions.
 */
-const registerToolset = (server, { config, getToken, onUnauthorized, logger = silentLogger }, tools) => {
+const registerToolset = (server, { config, getToken, resolveBrandSubdomain, onUnauthorized, logger = silentLogger }, tools) => {
+	const sharedResolver = resolveBrandSubdomain ?? createBrandSubdomainResolver(config.subdomain, getToken);
 	const registered = [];
 	const dispose = () => {
 		for (const handle of registered) handle.remove();
@@ -107462,8 +108060,7 @@ const registerToolset = (server, { config, getToken, onUnauthorized, logger = si
 	const filteredTools = filterTools(tools, {
 		readOnly: config.readOnly,
 		namespaces: config.namespaces,
-		tools: config.tools,
-		promotedArticles: config.promotedArticles
+		tools: config.tools
 	});
 	try {
 		switch (config.mode) {
@@ -107471,7 +108068,7 @@ const registerToolset = (server, { config, getToken, onUnauthorized, logger = si
 				for (const tool of filteredTools) registered.push(server.registerTool(tool.name, {
 					title: tool.title,
 					description: tool.description,
-					inputSchema: tool.inputSchema.strict(),
+					inputSchema: toStrictStandardSchema(tool.inputSchema),
 					annotations: tool.annotations
 				}, async (params) => runHandler(tool, params, onUnauthorized)));
 				break;
@@ -107492,7 +108089,7 @@ const registerToolset = (server, { config, getToken, onUnauthorized, logger = si
 			}
 		}
 		if (helpCenterContextEnabled(config)) {
-			const topology = createTopologyProvider(getToken, config.subdomain, onUnauthorized);
+			const topology = createTopologyProvider(getToken, config.subdomain, onUnauthorized, config.brandIds, firstBrandSubdomainResolver(config, sharedResolver));
 			registered.push(server.registerResource("help-center-topology", topologyResourceUri(config), {
 				title: "Zendesk Help Center topology",
 				description: "Active locales, category → section tree, visibility segments, permission groups, and your role. Useful context when creating or editing content; admin-only sections (permission groups, user segments) are marked unavailable rather than empty when your role lacks Guide-admin rights.",
@@ -107504,7 +108101,7 @@ const registerToolset = (server, { config, getToken, onUnauthorized, logger = si
 			}] })));
 		}
 		if (articleResourceEnabled(config)) {
-			const articles = createArticleResourcesProvider(getToken, config.subdomain, onUnauthorized);
+			const articles = createArticleResourcesProvider(getToken, config.subdomain, onUnauthorized, resourceBrandResolver(config, sharedResolver), config.brandIds);
 			const listPromotedEnabled = promotedArticlesEnabled(config);
 			const template = new ResourceTemplate(articleResourceUriTemplate(config), { list: async () => {
 				if (!listPromotedEnabled) return { resources: [] };
@@ -107515,10 +108112,10 @@ const registerToolset = (server, { config, getToken, onUnauthorized, logger = si
 						listed: refs.length
 					});
 					return { resources: refs.map((ref) => ({
-						uri: articleResourceUri(config, ref.id),
-						name: ref.title,
+						uri: articleResourceUri(config, ref.id, ref.brand),
+						name: ref.brand === void 0 ? ref.title : `${ref.title} (${ref.brand})`,
 						title: ref.title,
-						description: `"${ref.title}" (article ${ref.id}) — promoted Help Center article, as Markdown.`,
+						description: ref.brand === void 0 ? `"${ref.title}" (article ${ref.id}) — promoted Help Center article, as Markdown.` : `"${ref.title}" (article ${ref.id}, brand ${ref.brand}) — promoted Help Center article, as Markdown.`,
 						mimeType: "text/markdown"
 					})) };
 				} catch (err) {
@@ -107528,16 +108125,18 @@ const registerToolset = (server, { config, getToken, onUnauthorized, logger = si
 			} });
 			registered.push(server.registerResource("help-center-article", template, {
 				title: "Zendesk Help Center article",
-				description: "A Help Center article rendered as Markdown, addressed by id. The list surfaces the promoted (featured) articles so one can be pinned as context; any article id can be read, subject to your Zendesk read permissions.",
+				description: "A Help Center article rendered as Markdown, addressed by id (by brand and id when the server runs multi-brand). The list surfaces the promoted (featured) articles so one can be pinned as context; any article id can be read, subject to your Zendesk read permissions.",
 				mimeType: "text/markdown"
 			}, async (uri, variables) => {
-				const raw = Array.isArray(variables["id"]) ? variables["id"][0] : variables["id"];
-				const id = Number(raw);
+				const rawId = Array.isArray(variables["id"]) ? variables["id"][0] : variables["id"];
+				const id = Number(rawId);
 				if (!Number.isSafeInteger(id) || id <= 0) throw new Error(`Invalid article id in resource URI: ${uri.toString()}`);
+				const rawBrand = variables["brand"];
+				const brand = Array.isArray(rawBrand) ? rawBrand[0] : rawBrand;
 				return { contents: [{
 					uri: uri.toString(),
 					mimeType: "text/markdown",
-					text: await articles.readArticle(id)
+					text: await articles.readArticle(id, brand)
 				}] };
 			}));
 		}
@@ -107556,20 +108155,24 @@ const registerToolset = (server, { config, getToken, onUnauthorized, logger = si
 };
 const createMcpServer = (config, getToken, logger = silentLogger, onUnauthorized) => {
 	const server = createServerShell(config, logger);
+	const resolveBrandSubdomain = createBrandSubdomainResolver(config.subdomain, getToken);
 	const tools = createAllTools({
 		subdomain: config.subdomain,
+		brandIds: config.brandIds,
+		resolveBrandSubdomain,
 		getToken
 	});
 	registerToolset(server, {
 		config,
 		getToken,
+		resolveBrandSubdomain,
 		onUnauthorized,
 		logger
 	}, tools);
 	return server;
 };
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+server@2.2.0/node_modules/@modelcontextprotocol/server/dist/stdio.mjs
+//#region node_modules/.pnpm/@modelcontextprotocol+server@2.3.1/node_modules/@modelcontextprotocol/server/dist/stdio.mjs
 /**
 * Marks a stdout `'error'` listener that a closed transport left attached purely to
 * swallow late write failures (see {@link StdioServerTransport.close}). A fresh
@@ -107752,13 +108355,17 @@ const loadFreshTools = async (ctx) => {
 */
 const createReloadableServer = (config, getToken, logger = silentLogger, onUnauthorized, loadTools = loadFreshTools) => {
 	const server = createServerShell(config, logger);
+	const resolveBrandSubdomain = createBrandSubdomainResolver(config.subdomain, getToken);
 	const ctx = {
 		subdomain: config.subdomain,
+		brandIds: config.brandIds,
+		resolveBrandSubdomain,
 		getToken
 	};
 	const params = {
 		config,
 		getToken,
+		resolveBrandSubdomain,
 		onUnauthorized,
 		logger
 	};
@@ -107897,8 +108504,7 @@ const renderToolSurface = (config, tools) => {
 	const filtered = filterTools(tools, {
 		readOnly: config.readOnly,
 		namespaces: config.namespaces,
-		tools: config.tools,
-		promotedArticles: config.promotedArticles
+		tools: config.tools
 	});
 	const header = renderHeader(config);
 	if (filtered.length === 0) return `${header}\n\nNo tools exposed. Check --namespace / --tool / --read-only.`;
@@ -107994,7 +108600,7 @@ const installShutdown = (options) => {
 //#endregion
 //#region src/index.ts
 const buildStdioTokenStore = async (config, logger) => {
-	const { createTokenStore } = await import("./token-store-SYK0DN9M.js");
+	const { createTokenStore } = await import("./token-store-BLAkLLQO.js");
 	return createTokenStore({
 		subdomain: config.subdomain,
 		oauthClientId: config.oauthClientId,
@@ -108013,6 +108619,8 @@ const main = async () => {
 	if (config.printTools) {
 		const tools = createAllTools({
 			subdomain: config.subdomain,
+			brandIds: config.brandIds,
+			resolveBrandSubdomain: () => Promise.resolve(""),
 			getToken: () => ""
 		});
 		console.log(renderToolSurface(config, tools));
@@ -108033,7 +108641,7 @@ const main = async () => {
 		return;
 	}
 	if (config.dev) logger.warn("dev_mode_ignored_http");
-	const { startHttpTransport } = await import("./http-7NVoxfEA.js");
+	const { startHttpTransport } = await import("./http-BYYYoQaK.js");
 	const http = await startHttpTransport(config, logger);
 	installShutdown({
 		watchStdin: false,
@@ -108047,4 +108655,4 @@ main().catch((error) => {
 	process.exit(1);
 });
 //#endregion
-export { __toESM$1 as _, REQUEST_TIMEOUT_MS as a, getOAuthUrls as c, createStartupError as d, errnoCode as f, __require as g, __exportAll$1 as h, zendeskGet as i, WebStandardStreamableHTTPServerTransport as l, __commonJSMin$1 as m, readPackageInfo as n, deadlineSignal as o, readEnv as p, silentLogger as r, DEFAULT_CALLBACK_PORT as s, createMcpServer as t, STARTUP_DOCS as u };
+export { __commonJSMin$1 as _, verifyBearerToken as a, __toESM$1 as b, zendeskGet as c, DEFAULT_CALLBACK_PORT as d, getOAuthUrls as f, readEnv as g, errnoCode as h, WebStandardStreamableHTTPServerTransport as i, REQUEST_TIMEOUT_MS as l, createStartupError as m, readPackageInfo as n, OAuthError as o, STARTUP_DOCS as p, silentLogger as r, OAuthErrorCode as s, createMcpServer as t, deadlineSignal as u, __exportAll$1 as v, __require as y };