@wabery/cli 0.11.5 → 0.13.0

package/dist/mcp-server.js

@@ -16,6 +16,11 @@ const readinessRequirementSchema = z.enum([
 ]);
 const optInSchema = z
     .object({
+    categories: z
+        .array(z.enum(["GENERAL", "MARKETING", "UTILITY", "AUTHENTICATION"]))
+        .min(1)
+        .max(4)
+        .optional(),
     source: z.string().min(1).max(120),
     method: z.string().min(1).max(80).optional(),
     occurred_at: z.string().datetime().optional(),
@@ -23,9 +28,62 @@ const optInSchema = z
     evidence: z.record(z.string(), z.unknown()).optional(),
 })
     .optional();
-const SERVER_INSTRUCTIONS = `Use Wabery tools as a developer platform for WhatsApp, Instagram, and Messenger messaging: channels, routing, contacts, registration intents, conversations, message history, outbound messages, inbound media metadata, WhatsApp Flows, templates, automations, webhooks, and Meta Business Agent extensions.
+const broadcastStatusSchema = z.enum([
+    "draft",
+    "preparing",
+    "ready",
+    "scheduled",
+    "sending",
+    "completed",
+    "canceled",
+    "failed",
+]);
+const broadcastRecipientStatusSchema = z.enum([
+    "pending",
+    "queued",
+    "sending",
+    "sent",
+    "delivered",
+    "read",
+    "failed",
+    "skipped",
+    "canceled",
+]);
+const broadcastParameterMappingSchema = z.object({
+    component: z.enum(["header", "body", "button"]),
+    index: z.number().int().min(0),
+    button_index: z.number().int().min(0).optional(),
+    parameter_type: z
+        .enum(["text", "image", "document", "video"])
+        .default("text"),
+    source: z.enum([
+        "name",
+        "phone",
+        "preferred_language",
+        "metadata",
+        "constant",
+    ]),
+    metadata_key: z.string().min(1).max(120).optional(),
+    value: z.string().max(2000).optional(),
+    fallback: z.string().max(2000).optional(),
+});
+const broadcastVariantSchema = z.object({
+    template_id: z.string().min(1),
+    language: z.string().min(2).max(35),
+    parameter_mappings: z.array(broadcastParameterMappingSchema).max(100),
+});
+const broadcastAudienceFilterSchema = z.object({
+    search: z.string().max(120).optional(),
+    tags: z.array(z.string().min(1).max(60)).max(50).optional(),
+    languages: z.array(z.string().min(2).max(35)).max(50).optional(),
+    is_blocked: z.boolean().optional(),
+    created_after: z.string().datetime().optional(),
+    created_before: z.string().datetime().optional(),
+});
+const SERVER_INSTRUCTIONS = `Use Wabery tools as a developer platform for WhatsApp, Instagram, and Messenger messaging: channels, routing, contacts, registration intents, conversations, message history, outbound messages, inbound media metadata, WhatsApp Flows, templates, broadcasts, automations, webhooks, and Meta Business Agent extensions.
 Recommended order: read wabery_get_config_schema, select the project, call wabery_get_project_readiness, list channels only when more channel detail is needed, check Business Agent eligibility before adding business_agent config, create registration intents or enroll WhatsApp contacts as needed, store returned contact_id plus channel_id, validate and preview config diff, apply config only after review, publish flows only after explicit confirmation, then send messages or published flows with channel_id and contact_id/conversation_id.
 Always distinguish sandbox testing from production readiness: a project without its own connected phone number can often still be tested in the shared Wabery sandbox, but production inbound traffic requires a dedicated project channel. For WhatsApp templates and proactive reminders, inspect readiness before creation: template submission and proactive template sends require a dedicated non-sandbox WhatsApp channel, Meta business verification/account approval, a connected phone, and a Meta payment method. After sending a message, use wabery_get_message to inspect provider status and failures.
+For broadcasts, use only approved WhatsApp templates on a dedicated channel and only contacts with valid category-specific consent. Create a draft, prepare exactly one audience source, poll wabery_get_broadcast until it is ready, inspect its counts and excluded recipients, and send or schedule only after explicit user confirmation. Preparation freezes the recipient snapshot; create a new draft when the intended audience changes. CSV files are uploaded through the dashboard or CLI; use wabery_list_contact_imports and wabery_get_contact_import to select a completed import.
 Use wabery_list_conversations, wabery_get_conversation, and wabery_list_conversation_messages to inspect history. Inbound WhatsApp media appears on message records/webhooks as media/assets metadata with Wabery signed URLs when retained; download files promptly because URLs are short-lived and retention is plan-based.
 Config apply creates or updates Wabery flows, automations, webhook settings, and eligible Meta Business Agent declarations. It never publishes flows to Meta. Automations and Business Agent connector tools can trigger flows through references to flow config keys.
 High-risk tools require confirmation_token values shown in each tool description.`;
@@ -89,11 +147,81 @@ function checkWriteMode(action, token, expectedToken, writePolicy = "env") {
 }
 export function createWaberyMcpServer(client = new WaberyApiClient(), options = {}) {
     const writePolicy = options.writePolicy ?? "env";
-    const requireWrite = (action, token, expectedToken) => checkWriteMode(action, token, expectedToken, writePolicy);
     const server = new McpServer({
         name: "wabery",
         version: options.serverVersion ?? "0.1.0",
     }, { instructions: serverInstructions(writePolicy) });
+    const requireWrite = async (action, token, expectedToken) => {
+        const modeBlocked = checkWriteMode(action, undefined, undefined, writePolicy);
+        if (modeBlocked)
+            return modeBlocked;
+        if (!expectedToken)
+            return null;
+        if (server.server.getClientCapabilities()?.elicitation) {
+            const response = await server.server.elicitInput({
+                message: `Approve the high-risk Wabery action: ${action}`,
+                requestedSchema: {
+                    type: "object",
+                    properties: {
+                        confirm: {
+                            type: "boolean",
+                            title: "Confirm action",
+                            description: "Approve this external or destructive action",
+                            default: false,
+                        },
+                    },
+                    required: ["confirm"],
+                },
+            });
+            if (response.action === "accept" && response.content?.confirm === true) {
+                return null;
+            }
+            return errorResult({
+                action,
+                message: "The user declined or canceled the action.",
+            });
+        }
+        if (writePolicy === "enabled") {
+            return errorResult({
+                action,
+                message: "This hosted MCP client must support elicitation so Wabery can obtain real user approval.",
+            });
+        }
+        return checkWriteMode(action, token, expectedToken, writePolicy);
+    };
+    const requireBroadcastApproval = async (action, message, token, localConfirmationToken) => {
+        if (server.server.getClientCapabilities()?.elicitation) {
+            const response = await server.server.elicitInput({
+                message,
+                requestedSchema: {
+                    type: "object",
+                    properties: {
+                        confirm: {
+                            type: "boolean",
+                            title: "Confirm broadcast action",
+                            description: "Approve this external messaging action",
+                            default: false,
+                        },
+                    },
+                    required: ["confirm"],
+                },
+            });
+            if (response.action === "accept" && response.content?.confirm === true) {
+                return null;
+            }
+            return errorResult({
+                action,
+                message: "The user declined or canceled the broadcast action.",
+            });
+        }
+        if (writePolicy === "enabled") {
+            return errorResult({
+                action,
+                message: "This hosted MCP client must support elicitation so Wabery can obtain real user approval.",
+            });
+        }
+        return await requireWrite(action, token, localConfirmationToken);
+    };
     const resolveProjectId = async (projectId) => {
         if (projectId)
             return projectId;
@@ -258,7 +386,7 @@ export function createWaberyMcpServer(client = new WaberyApiClient(), options =
         },
     }, async (input) => {
         const { config, confirmation_token } = input;
-        const blocked = requireWrite("wabery_apply_config", confirmation_token, "apply_config");
+        const blocked = await requireWrite("wabery_apply_config", confirmation_token, "apply_config");
         if (blocked)
             return blocked;
         try {
@@ -335,7 +463,7 @@ export function createWaberyMcpServer(client = new WaberyApiClient(), options =
         },
     }, async (input) => {
         const { confirmation_token, ...body } = input;
-        const blocked = requireWrite("wabery_apply_business_agent", confirmation_token, "apply_business_agent");
+        const blocked = await requireWrite("wabery_apply_business_agent", confirmation_token, "apply_business_agent");
         if (blocked)
             return blocked;
         return jsonResult(await client.put("/business-agents", body));
@@ -376,7 +504,7 @@ export function createWaberyMcpServer(client = new WaberyApiClient(), options =
         },
     }, async (input) => {
         const { business_agent_id, confirmation_token, ...body } = input;
-        const blocked = requireWrite("wabery_update_business_agent_settings", confirmation_token, "update_business_agent_settings");
+        const blocked = await requireWrite("wabery_update_business_agent_settings", confirmation_token, "update_business_agent_settings");
         if (blocked)
             return blocked;
         return jsonResult(await client.put(`/business-agents/${encodeURIComponent(business_agent_id)}/settings`, body));
@@ -418,7 +546,7 @@ export function createWaberyMcpServer(client = new WaberyApiClient(), options =
         },
     }, async (input) => {
         const { confirmation_token, ...body } = input;
-        const blocked = requireWrite("wabery_create_business_agent_connector", confirmation_token, "create_business_agent_connector");
+        const blocked = await requireWrite("wabery_create_business_agent_connector", confirmation_token, "create_business_agent_connector");
         if (blocked)
             return blocked;
         return jsonResult(await client.post("/business-agents/connectors", body));
@@ -453,7 +581,7 @@ export function createWaberyMcpServer(client = new WaberyApiClient(), options =
         },
     }, async (input) => {
         const { connector_id, confirmation_token, ...body } = input;
-        const blocked = requireWrite("wabery_create_business_agent_connector_tool", confirmation_token, "create_business_agent_connector_tool");
+        const blocked = await requireWrite("wabery_create_business_agent_connector_tool", confirmation_token, "create_business_agent_connector_tool");
         if (blocked)
             return blocked;
         return jsonResult(await client.post(`/business-agents/connectors/${encodeURIComponent(connector_id)}/tools`, body));
@@ -513,7 +641,7 @@ export function createWaberyMcpServer(client = new WaberyApiClient(), options =
         },
     }, async (input) => {
         const { connector_id, tool_id, confirmation_token, ...body } = input;
-        const blocked = requireWrite("wabery_update_business_agent_connector_tool", confirmation_token, "update_business_agent_connector_tool");
+        const blocked = await requireWrite("wabery_update_business_agent_connector_tool", confirmation_token, "update_business_agent_connector_tool");
         if (blocked)
             return blocked;
         return jsonResult(await client.patch(`/business-agents/connectors/${encodeURIComponent(connector_id)}/tools/${encodeURIComponent(tool_id)}`, body));
@@ -536,7 +664,7 @@ export function createWaberyMcpServer(client = new WaberyApiClient(), options =
             openWorldHint: false,
         },
     }, async ({ connector_id, tool_id, confirmation_token }) => {
-        const blocked = requireWrite("wabery_delete_business_agent_connector_tool", confirmation_token, "delete_business_agent_connector_tool");
+        const blocked = await requireWrite("wabery_delete_business_agent_connector_tool", confirmation_token, "delete_business_agent_connector_tool");
         if (blocked)
             return blocked;
         return jsonResult(await client.delete(`/business-agents/connectors/${encodeURIComponent(connector_id)}/tools/${encodeURIComponent(tool_id)}`));
@@ -565,7 +693,7 @@ export function createWaberyMcpServer(client = new WaberyApiClient(), options =
         },
     }, async (input) => {
         const { confirmation_token, ...body } = input;
-        const blocked = requireWrite("wabery_business_agent_thread_control", confirmation_token, "thread_control");
+        const blocked = await requireWrite("wabery_business_agent_thread_control", confirmation_token, "thread_control");
         if (blocked)
             return blocked;
         return jsonResult(await client.post("/business-agents/thread-control", body));
@@ -633,7 +761,7 @@ export function createWaberyMcpServer(client = new WaberyApiClient(), options =
             openWorldHint: true,
         },
     }, async ({ confirmation_token, ...body }) => {
-        const blocked = requireWrite("wabery_set_business_agent_skills", confirmation_token, "set_business_agent_skills");
+        const blocked = await requireWrite("wabery_set_business_agent_skills", confirmation_token, "set_business_agent_skills");
         if (blocked)
             return blocked;
         return jsonResult(await client.put("/business-agents/skills", body));
@@ -732,7 +860,7 @@ export function createWaberyMcpServer(client = new WaberyApiClient(), options =
             openWorldHint: false,
         },
     }, async ({ project_id, ...body }) => {
-        const blocked = requireWrite("wabery_update_project");
+        const blocked = await requireWrite("wabery_update_project");
         if (blocked)
             return blocked;
         return jsonResult(await client.patch(`/projects/${encodeURIComponent(project_id)}`, body));
@@ -751,7 +879,7 @@ export function createWaberyMcpServer(client = new WaberyApiClient(), options =
             openWorldHint: false,
         },
     }, async ({ project_id, webhook_secret }) => {
-        const blocked = requireWrite("wabery_rotate_webhook_secret");
+        const blocked = await requireWrite("wabery_rotate_webhook_secret");
         if (blocked)
             return blocked;
         return jsonResult(await client.post(`/projects/${encodeURIComponent(project_id)}/rotate-webhook-secret`, webhook_secret ? { webhook_secret } : undefined));
@@ -792,7 +920,7 @@ export function createWaberyMcpServer(client = new WaberyApiClient(), options =
             openWorldHint: false,
         },
     }, async ({ channel_id, routing_mode }) => {
-        const blocked = requireWrite("wabery_update_channel");
+        const blocked = await requireWrite("wabery_update_channel");
         if (blocked)
             return blocked;
         return jsonResult(await client.patch(`/channels/${encodeURIComponent(channel_id)}`, {
@@ -821,7 +949,7 @@ export function createWaberyMcpServer(client = new WaberyApiClient(), options =
             openWorldHint: false,
         },
     }, async ({ project_id, customer_reference, metadata }) => {
-        const blocked = requireWrite("wabery_create_registration_intent");
+        const blocked = await requireWrite("wabery_create_registration_intent");
         if (blocked)
             return blocked;
         return jsonResult(await client.post("/registration-intents", {
@@ -895,7 +1023,7 @@ export function createWaberyMcpServer(client = new WaberyApiClient(), options =
             openWorldHint: true,
         },
     }, async ({ flow_id, confirmation_token }) => {
-        const blocked = requireWrite("wabery_publish_flow", confirmation_token, `publish:${flow_id}`);
+        const blocked = await requireWrite("wabery_publish_flow", confirmation_token, `publish:${flow_id}`);
         if (blocked)
             return blocked;
         return apiResult(client.post(`/flows/${flow_id}/publish`));
@@ -919,7 +1047,7 @@ export function createWaberyMcpServer(client = new WaberyApiClient(), options =
                 .optional()
                 .describe("Your own user/customer id for correlation."),
             metadata: metadataSchema,
-            opt_in: optInSchema.describe("WhatsApp opt-in evidence. Include source, method, consent_text, and evidence where available."),
+            opt_in: optInSchema.describe("WhatsApp opt-in evidence. For broadcasts include the applicable MARKETING or UTILITY category plus source, method, consent_text, and evidence."),
         },
         annotations: {
             readOnlyHint: false,
@@ -928,7 +1056,7 @@ export function createWaberyMcpServer(client = new WaberyApiClient(), options =
             openWorldHint: false,
         },
     }, async (input) => {
-        const blocked = requireWrite("wabery_enroll_contact");
+        const blocked = await requireWrite("wabery_enroll_contact");
         if (blocked)
             return blocked;
         return jsonResult(await client.post("/contacts", input));
@@ -960,6 +1088,33 @@ export function createWaberyMcpServer(client = new WaberyApiClient(), options =
             openWorldHint: false,
         },
     }, async ({ contact_id }) => jsonResult(await client.get(`/contacts/${contact_id}`)));
+    server.registerTool("wabery_list_contact_imports", {
+        title: "List Wabery contact imports",
+        description: "List CSV contact imports and their processing counts. Upload files in the dashboard or CLI, then use a completed import_id as a broadcast audience source.",
+        inputSchema: {
+            limit: z.number().int().min(1).max(100).optional(),
+            starting_after: z.string().optional(),
+        },
+        annotations: {
+            readOnlyHint: true,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: false,
+        },
+    }, async (query) => apiResult(client.get("/contact-imports", query)));
+    server.registerTool("wabery_get_contact_import", {
+        title: "Get Wabery contact import",
+        description: "Inspect one CSV contact import's status and row counts. Wait for completed before using its import_id to prepare a broadcast.",
+        inputSchema: {
+            import_id: z.string().min(1),
+        },
+        annotations: {
+            readOnlyHint: true,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: false,
+        },
+    }, async ({ import_id }) => apiResult(client.get(`/contact-imports/${import_id}`)));
     server.registerTool("wabery_unenroll_contact", {
         title: "Unenroll Wabery contact",
         description: "Remove a contact phone's sandbox authorization for this organization. Pass erase=true for irreversible org-scoped contact data deletion.",
@@ -978,11 +1133,233 @@ export function createWaberyMcpServer(client = new WaberyApiClient(), options =
             openWorldHint: false,
         },
     }, async ({ contact_id, erase, confirmation_token }) => {
-        const blocked = requireWrite("wabery_unenroll_contact", confirmation_token, erase ? `erase:${contact_id}` : undefined);
+        const blocked = await requireWrite("wabery_unenroll_contact", confirmation_token, erase ? `erase:${contact_id}` : undefined);
         if (blocked)
             return blocked;
         return jsonResult(await client.delete(`/contacts/${contact_id}${erase ? "?erase=true" : ""}`));
     });
+    server.registerTool("wabery_list_broadcasts", {
+        title: "List Wabery broadcasts",
+        description: "List broadcast campaigns and delivery counts. Filter by lifecycle status when monitoring preparation or delivery.",
+        inputSchema: {
+            limit: z.number().int().min(1).max(100).optional(),
+            starting_after: z.string().optional(),
+            status: broadcastStatusSchema.optional(),
+        },
+        annotations: {
+            readOnlyHint: true,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: false,
+        },
+    }, async (query) => apiResult(client.get("/broadcasts", query)));
+    server.registerTool("wabery_get_broadcast", {
+        title: "Get Wabery broadcast",
+        description: "Fetch one broadcast with its lifecycle status and recipient counts. Poll while status is preparing, and review counts before requesting send or schedule confirmation.",
+        inputSchema: {
+            broadcast_id: z.string().min(1),
+        },
+        annotations: {
+            readOnlyHint: true,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: false,
+        },
+    }, async ({ broadcast_id }) => apiResult(client.get(`/broadcasts/${broadcast_id}`)));
+    server.registerTool("wabery_create_broadcast", {
+        title: "Create Wabery broadcast draft",
+        description: "Create a draft from approved WhatsApp template variants. This does not select recipients or send messages. Use a dedicated WhatsApp channel and category-specific consent.",
+        inputSchema: {
+            name: z.string().min(1).max(120),
+            channel_id: z.string().min(1),
+            category: z.enum(["MARKETING", "UTILITY"]),
+            template_name: z.string().min(1).max(512),
+            fallback_language: z.string().min(2).max(35),
+            variants: z.array(broadcastVariantSchema).min(1).max(50),
+        },
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: false,
+            idempotentHint: false,
+            openWorldHint: false,
+        },
+    }, async ({ name, channel_id, category, template_name, fallback_language, variants, }) => {
+        const blocked = await requireWrite("wabery_create_broadcast");
+        if (blocked)
+            return blocked;
+        return apiResult(client.post("/broadcasts", {
+            name,
+            channelId: channel_id,
+            category,
+            templateName: template_name,
+            fallbackLanguage: fallback_language,
+            variants: variants.map((variant) => ({
+                templateId: variant.template_id,
+                language: variant.language,
+                parameterMappings: variant.parameter_mappings.map((mapping) => ({
+                    component: mapping.component,
+                    index: mapping.index,
+                    buttonIndex: mapping.button_index,
+                    parameterType: mapping.parameter_type,
+                    source: mapping.source,
+                    metadataKey: mapping.metadata_key,
+                    value: mapping.value,
+                    fallback: mapping.fallback,
+                })),
+            })),
+        }));
+    });
+    server.registerTool("wabery_prepare_broadcast_audience", {
+        title: "Prepare Wabery broadcast audience",
+        description: "Resolve and freeze a draft broadcast's recipients from exactly one source: contact_ids, import_id, or filter. Preparation is asynchronous and does not send messages. Poll wabery_get_broadcast until ready, then inspect counts and recipients.",
+        inputSchema: {
+            broadcast_id: z.string().min(1),
+            contact_ids: z.array(z.string().min(1)).max(1000).optional(),
+            import_id: z.string().min(1).optional(),
+            filter: broadcastAudienceFilterSchema.optional(),
+            exclude_contact_ids: z.array(z.string().min(1)).max(1000).optional(),
+        },
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: false,
+        },
+    }, async ({ broadcast_id, contact_ids, import_id, filter, exclude_contact_ids, }) => {
+        const blocked = await requireWrite("wabery_prepare_broadcast_audience");
+        if (blocked)
+            return blocked;
+        const sources = [contact_ids, import_id, filter].filter((value) => value !== undefined);
+        if (sources.length !== 1) {
+            return {
+                ...jsonResult({
+                    error: "invalid_audience_source",
+                    message: "Provide exactly one audience source: contact_ids, import_id, or filter.",
+                }),
+                isError: true,
+            };
+        }
+        return apiResult(client.post(`/broadcasts/${broadcast_id}/audience`, {
+            contactIds: contact_ids,
+            importId: import_id,
+            filter: filter
+                ? {
+                    search: filter.search,
+                    tags: filter.tags,
+                    languages: filter.languages,
+                    isBlocked: filter.is_blocked,
+                    createdAfter: filter.created_after,
+                    createdBefore: filter.created_before,
+                }
+                : undefined,
+            excludeContactIds: exclude_contact_ids ?? [],
+        }));
+    });
+    server.registerTool("wabery_list_broadcast_recipients", {
+        title: "List Wabery broadcast recipients",
+        description: "Inspect the prepared recipient snapshot, language selection, skips, failures, and delivery state. Use before confirmation and while monitoring delivery.",
+        inputSchema: {
+            broadcast_id: z.string().min(1),
+            limit: z.number().int().min(1).max(100).optional(),
+            starting_after: z.string().optional(),
+            status: broadcastRecipientStatusSchema.optional(),
+        },
+        annotations: {
+            readOnlyHint: true,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: false,
+        },
+    }, async ({ broadcast_id, ...query }) => apiResult(client.get(`/broadcasts/${broadcast_id}/recipients`, query)));
+    server.registerTool("wabery_send_broadcast", {
+        title: "Send Wabery broadcast",
+        description: "Start sending a ready broadcast to its frozen recipient snapshot. This creates real external WhatsApp messages and requires explicit user confirmation with confirmation_token send_broadcast:<broadcast_id>.",
+        inputSchema: {
+            broadcast_id: z.string().min(1),
+            confirmation_token: z
+                .string()
+                .optional()
+                .describe("Required: send_broadcast:<broadcast_id>. Obtain explicit user confirmation after reviewing counts."),
+        },
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: true,
+            idempotentHint: true,
+            openWorldHint: true,
+        },
+    }, async ({ broadcast_id, confirmation_token }) => {
+        const blocked = await requireBroadcastApproval("wabery_send_broadcast", `Send broadcast ${broadcast_id} to its prepared WhatsApp recipients now?`, confirmation_token, `send_broadcast:${broadcast_id}`);
+        if (blocked)
+            return blocked;
+        return apiResult(client.post(`/broadcasts/${broadcast_id}/send`));
+    });
+    server.registerTool("wabery_schedule_broadcast", {
+        title: "Schedule Wabery broadcast",
+        description: "Schedule a ready broadcast for future delivery to its frozen recipient snapshot. Requires explicit user confirmation with confirmation_token schedule_broadcast:<broadcast_id>.",
+        inputSchema: {
+            broadcast_id: z.string().min(1),
+            scheduled_at: z.string().datetime(),
+            timezone: z.string().min(1).max(80),
+            confirmation_token: z
+                .string()
+                .optional()
+                .describe("Required: schedule_broadcast:<broadcast_id>. Obtain explicit user confirmation after reviewing counts and time."),
+        },
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: true,
+            idempotentHint: true,
+            openWorldHint: true,
+        },
+    }, async ({ broadcast_id, scheduled_at, timezone, confirmation_token }) => {
+        const blocked = await requireBroadcastApproval("wabery_schedule_broadcast", `Schedule broadcast ${broadcast_id} for ${scheduled_at} (${timezone})?`, confirmation_token, `schedule_broadcast:${broadcast_id}`);
+        if (blocked)
+            return blocked;
+        return apiResult(client.post(`/broadcasts/${broadcast_id}/schedule`, {
+            scheduledAt: scheduled_at,
+            timezone,
+        }));
+    });
+    server.registerTool("wabery_cancel_broadcast", {
+        title: "Cancel Wabery broadcast",
+        description: "Cancel a draft, ready, scheduled, or sending broadcast and stop recipients that have not been dispatched. Already accepted messages cannot be recalled. Requires confirmation_token cancel_broadcast:<broadcast_id>.",
+        inputSchema: {
+            broadcast_id: z.string().min(1),
+            confirmation_token: z
+                .string()
+                .optional()
+                .describe("Required: cancel_broadcast:<broadcast_id>."),
+        },
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: true,
+            idempotentHint: true,
+            openWorldHint: false,
+        },
+    }, async ({ broadcast_id, confirmation_token }) => {
+        const blocked = await requireBroadcastApproval("wabery_cancel_broadcast", `Cancel broadcast ${broadcast_id}? Messages already accepted by WhatsApp cannot be recalled.`, confirmation_token, `cancel_broadcast:${broadcast_id}`);
+        if (blocked)
+            return blocked;
+        return apiResult(client.post(`/broadcasts/${broadcast_id}/cancel`));
+    });
+    server.registerTool("wabery_duplicate_broadcast", {
+        title: "Duplicate Wabery broadcast",
+        description: "Create a new draft with the source broadcast's channel, template variants, and parameter mappings. The recipient snapshot is not copied; prepare a new audience before sending.",
+        inputSchema: {
+            broadcast_id: z.string().min(1),
+        },
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: false,
+            idempotentHint: false,
+            openWorldHint: false,
+        },
+    }, async ({ broadcast_id }) => {
+        const blocked = await requireWrite("wabery_duplicate_broadcast");
+        if (blocked)
+            return blocked;
+        return apiResult(client.post(`/broadcasts/${broadcast_id}/duplicate`));
+    });
     server.registerTool("wabery_list_conversations", {
         title: "List Wabery conversations",
         description: "List organization-scoped conversations for inbox, support, or analytics tooling.",
@@ -1044,7 +1421,7 @@ export function createWaberyMcpServer(client = new WaberyApiClient(), options =
             openWorldHint: true,
         },
     }, async ({ body }) => {
-        const blocked = requireWrite("wabery_send_message");
+        const blocked = await requireWrite("wabery_send_message");
         if (blocked)
             return blocked;
         return apiResult(client.post("/messages", body));
@@ -1105,7 +1482,7 @@ export function createWaberyMcpServer(client = new WaberyApiClient(), options =
             openWorldHint: true,
         },
     }, async ({ body }) => {
-        const blocked = requireWrite("wabery_create_template");
+        const blocked = await requireWrite("wabery_create_template");
         if (blocked)
             return blocked;
         return apiResult(client.post("/templates", body));
@@ -1151,7 +1528,7 @@ export function createWaberyMcpServer(client = new WaberyApiClient(), options =
             openWorldHint: true,
         },
     }, async ({ flow_id, ...body }) => {
-        const blocked = requireWrite("wabery_send_flow");
+        const blocked = await requireWrite("wabery_send_flow");
         if (blocked)
             return blocked;
         return apiResult(client.post(`/flows/${flow_id}/send`, body));
@@ -1249,7 +1626,7 @@ export function createWaberyMcpServer(client = new WaberyApiClient(), options =
         },
     }, async (input) => {
         const { confirmation_token, ...body } = input;
-        const blocked = requireWrite("wabery_create_function", confirmation_token, "create_function");
+        const blocked = await requireWrite("wabery_create_function", confirmation_token, "create_function");
         if (blocked)
             return blocked;
         return jsonResult(await client.post("/functions", body));
@@ -1272,7 +1649,7 @@ export function createWaberyMcpServer(client = new WaberyApiClient(), options =
             openWorldHint: false,
         },
     }, async ({ function_id, source, confirmation_token }) => {
-        const blocked = requireWrite("wabery_deploy_function", confirmation_token, "deploy_function");
+        const blocked = await requireWrite("wabery_deploy_function", confirmation_token, "deploy_function");
         if (blocked)
             return blocked;
         return jsonResult(await client.post(`/functions/${function_id}/deploy`, { source }));
@@ -1295,7 +1672,7 @@ export function createWaberyMcpServer(client = new WaberyApiClient(), options =
             openWorldHint: false,
         },
     }, async ({ function_id, text, confirmation_token }) => {
-        const blocked = requireWrite("wabery_test_function", confirmation_token, "test_function");
+        const blocked = await requireWrite("wabery_test_function", confirmation_token, "test_function");
         if (blocked)
             return blocked;
         return jsonResult(await client.post(`/functions/${function_id}/test`, { text }));
@@ -1328,7 +1705,7 @@ export function createWaberyMcpServer(client = new WaberyApiClient(), options =
             openWorldHint: false,
         },
     }, async ({ function_id, confirmation_token }) => {
-        const blocked = requireWrite("wabery_delete_function", confirmation_token, "delete_function");
+        const blocked = await requireWrite("wabery_delete_function", confirmation_token, "delete_function");
         if (blocked)
             return blocked;
         return jsonResult(await client.delete(`/functions/${function_id}`));
@@ -1355,7 +1732,7 @@ export function createWaberyMcpServer(client = new WaberyApiClient(), options =
         },
     }, async (input) => {
         const { function_id, confirmation_token, ...body } = input;
-        const blocked = requireWrite("wabery_update_function", confirmation_token, "update_function");
+        const blocked = await requireWrite("wabery_update_function", confirmation_token, "update_function");
         if (blocked)
             return blocked;
         return jsonResult(await client.patch(`/functions/${function_id}`, body));
@@ -1379,7 +1756,7 @@ export function createWaberyMcpServer(client = new WaberyApiClient(), options =
             openWorldHint: true,
         },
     }, async ({ function_id, arguments: args, contact_id, confirmation_token, }) => {
-        const blocked = requireWrite("wabery_invoke_function", confirmation_token, "invoke_function");
+        const blocked = await requireWrite("wabery_invoke_function", confirmation_token, "invoke_function");
         if (blocked)
             return blocked;
         return jsonResult(await client.post(`/functions/${function_id}/invoke`, {