@webhooks-cc/mcp 1.13.0 → 1.15.0

package/dist/index.mjs

@@ -1,6 +1,23 @@
+import {
+  REMOTE_MAX_WAIT_MS,
+  compactRequest,
+  createEndpointShape,
+  deleteEndpointShape,
+  getEndpointShape,
+  getRequestShape,
+  jsonContent,
+  listEndpointsShape,
+  listRequestsShape,
+  payloadSchemaResult,
+  payloadSchemaShape,
+  registerTools,
+  waitForRequestShape,
+  withErrorHandling
+} from "./chunk-RHQD2GRD.mjs";
+
 // src/index.ts
 import { McpServer as McpServer2 } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { WebhooksCC as WebhooksCC3 } from "@webhooks-cc/sdk";
+import { WebhooksCC as WebhooksCC2 } from "@webhooks-cc/sdk";
 
 // src/prompts.ts
 import { z } from "zod";
@@ -115,158 +132,6 @@ function registerPrompts(server) {
 
 // src/resources.ts
 import { ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js";
-
-// src/compact.ts
-var MAX_OUTPUT = 32768;
-var MAX_EMAIL_TEXT = 8e3;
-var MAX_EXTRACTS = 10;
-var MAX_LINK_TEXT = 200;
-var MAX_LINK_URL = 2e3;
-var MAX_LIST_ITEMS = 5;
-var EMAIL_LISTS = ["from", "to", "cc", "replyTo", "sender", "inReplyTo", "attachments"];
-var TEXT_FLOOR = 2e3;
-function jsonSize(value) {
-  return JSON.stringify(value, null, 2).length;
-}
-function sliceText(text, end) {
-  if (end <= 0) return "";
-  if (end >= text.length) return text;
-  const last = text.charCodeAt(end - 1);
-  return text.slice(0, last >= 55296 && last <= 56319 ? end - 1 : end);
-}
-function cutEmailText(text) {
-  if (text === null || text.length <= MAX_EMAIL_TEXT) return { text, cut: false };
-  return { text: sliceText(text, MAX_EMAIL_TEXT), cut: true };
-}
-function shrinkToFit(root, budget, steps) {
-  for (const step of steps) {
-    if (jsonSize(root) <= budget) return;
-    step();
-  }
-}
-function omitHeaders(holder) {
-  const headers = holder.headers;
-  if (headers === null || typeof headers !== "object") return;
-  const count = Object.keys(headers).length;
-  if (count === 0) return;
-  holder.headers = {};
-  holder.headersOmitted = `${count} headers left out to fit the output`;
-}
-function trimSpam(holder) {
-  const spam = holder.spam;
-  if (spam && typeof spam === "object" && !Array.isArray(spam)) {
-    const { score, required, action, error } = spam;
-    holder.spam = { score, required, action, error };
-  }
-}
-function capExtracts(holder) {
-  if (Array.isArray(holder.codes) && holder.codes.length > MAX_EXTRACTS) {
-    holder.codes = holder.codes.slice(0, MAX_EXTRACTS);
-    holder.codesTruncated = true;
-  }
-  if (Array.isArray(holder.links)) {
-    if (holder.links.length > MAX_EXTRACTS) {
-      holder.links = holder.links.slice(0, MAX_EXTRACTS);
-      holder.linksTruncated = true;
-    }
-    holder.links = holder.links.map((link) => ({
-      ...link,
-      ...typeof link.url === "string" ? { url: sliceText(link.url, MAX_LINK_URL) } : {},
-      ...typeof link.text === "string" ? { text: sliceText(link.text, MAX_LINK_TEXT) } : {}
-    }));
-  }
-}
-function capLists(holder) {
-  for (const key of EMAIL_LISTS) {
-    const list = holder[key];
-    if (Array.isArray(list) && list.length > MAX_LIST_ITEMS) {
-      holder[key] = list.slice(0, MAX_LIST_ITEMS);
-      holder[`${key}Total`] = list.length;
-    }
-  }
-}
-function keepOnly(holder, keep) {
-  for (const key of Object.keys(holder)) {
-    if (!keep.includes(key)) delete holder[key];
-  }
-  holder.trimmed = "The email was too big for the output, so only these fields are shown.";
-}
-function cutStringToFit(root, holder, key, flag, budget, floor = 0) {
-  const value = holder[key];
-  if (typeof value !== "string" || value.length <= floor) return;
-  const flagged = holder[flag] === true;
-  holder[key] = "";
-  holder[flag] = true;
-  const room = budget - jsonSize(root) + 2;
-  let low = 0;
-  let high = value.length;
-  while (low < high) {
-    const mid = Math.ceil((low + high) / 2);
-    if (JSON.stringify(sliceText(value, mid)).length <= room) low = mid;
-    else high = mid - 1;
-  }
-  const kept = sliceText(value, Math.max(low, floor));
-  holder[key] = kept;
-  if (kept.length === value.length && !flagged) delete holder[flag];
-}
-function keepFirst(holder, key) {
-  const list = holder[key];
-  if (!Array.isArray(list) || list.length <= 1) return;
-  holder[`${key}Total`] = holder[`${key}Total`] ?? list.length;
-  holder[key] = list.slice(0, 1);
-}
-var ESSENTIAL_EMAIL_FIELDS = [
-  "subject",
-  "from",
-  "fromTotal",
-  "tag",
-  "date",
-  "text",
-  "textTruncated",
-  "htmlSize",
-  "spam"
-];
-function compactRequest(request) {
-  if (request.kind !== "email") return request;
-  const compact = { ...request };
-  delete compact.body;
-  delete compact.bodyRaw;
-  compact.rawMessageOmitted = "The raw message and the HTML part are left out; size is the message size in bytes. get_email returns the HTML.";
-  if (!request.email) return compact;
-  const { html, ...rest } = request.email;
-  const { text, cut } = cutEmailText(rest.text);
-  const restoreText = () => {
-    email.text = text;
-    if (cut) email.textTruncated = true;
-    else delete email.textTruncated;
-  };
-  const email = {
-    ...rest,
-    text,
-    ...cut ? { textTruncated: true } : {},
-    htmlSize: html?.length ?? 0
-  };
-  compact.email = email;
-  const root = { items: [compact], truncated: true, total: 1e3, returned: 1e3 };
-  const budget = MAX_OUTPUT - 128;
-  shrinkToFit(root, budget, [
-    () => omitHeaders(compact),
-    () => trimSpam(email),
-    () => capLists(email),
-    () => cutStringToFit(root, email, "text", "textTruncated", budget, TEXT_FLOOR),
-    // Down to the essentials there may be room for more of the text again.
-    () => {
-      keepOnly(email, ESSENTIAL_EMAIL_FIELDS);
-      keepFirst(email, "from");
-      restoreText();
-      cutStringToFit(root, email, "text", "textTruncated", budget);
-    },
-    () => cutStringToFit(root, email, "subject", "subjectTruncated", budget)
-  ]);
-  return compact;
-}
-
-// src/resources.ts
 var ENDPOINTS_RESOURCE_URI = "webhooks://endpoints";
 var ENDPOINT_RECENT_TEMPLATE_URI = "webhooks://endpoint/{slug}/recent";
 var REQUEST_TEMPLATE_URI = "webhooks://request/{id}";
@@ -388,1382 +253,13 @@ function registerResources(server, client) {
 }
 
 // src/sandbox-tools.ts
-import { z as z3 } from "zod";
-import {
-  AgentAuthError,
-  WebhooksCC as WebhooksCC2
-} from "@webhooks-cc/sdk";
-
-// src/tools.ts
 import { z as z2 } from "zod";
 import {
-  diffRequests,
-  extractJsonField,
-  MOCK_RESPONSE_DELAY_MAX,
-  MOCK_RESPONSE_DELAY_MIN,
-  MOCK_RESPONSE_STATUS_MAX,
-  MOCK_RESPONSE_STATUS_MIN,
-  MAX_CONDITION_VALUE_LEN,
-  MAX_CONDITION_NAME_LEN,
-  MAX_CONDITION_PATH_LEN,
-  MAX_RULE_NAME_LEN,
-  MAX_GLOB_PATTERN_LEN,
-  NotFoundError,
-  RateLimitError,
-  TEMPLATE_METADATA,
-  TEMPLATE_PROVIDERS,
-  TimeoutError,
-  UnauthorizedError,
-  VERIFY_PROVIDERS,
-  verifySignature,
-  WebhooksCCError,
-  extractCode,
-  extractLink,
-  detectWebhookInfo,
-  generateRequestSchema,
-  PAYLOAD_SCHEMA_FORMATS
+  AgentAuthError,
+  AgentCredentialStore,
+  SandboxClient,
+  WebhooksCC
 } from "@webhooks-cc/sdk";
-var MAX_BODY_SIZE = MAX_OUTPUT;
-var HTTP_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"];
-var TIME_SEPARATOR = " \u2014 ";
-var httpUrlSchema = z2.string().url().refine(
-  (value) => {
-    try {
-      const protocol = new URL(value).protocol;
-      return protocol === "http:" || protocol === "https:";
-    } catch {
-      return false;
-    }
-  },
-  { message: "Only http and https URLs are supported" }
-);
-var methodSchema = z2.enum(HTTP_METHODS).default("POST").describe("HTTP method (default: POST)");
-var kindSchema = z2.enum(["http", "email"]).optional().describe('Only HTTP requests ("http") or only captured emails ("email")');
-var EMAIL_SCAN_LIMIT = 100;
-var durationOrTimestampSchema = z2.union([z2.string(), z2.number()]);
-var ruleConditionSchema = z2.object({
-  field: z2.enum(["method", "path", "header", "body_contains", "body_path", "query"]).describe("Request field to match against"),
-  op: z2.enum(["eq", "contains", "starts_with", "matches", "exists"]).describe("Comparison operator"),
-  value: z2.string().max(MAX_CONDITION_VALUE_LEN).optional().describe(
-    `Value to compare against (required unless op is "exists", max ${MAX_CONDITION_VALUE_LEN} chars)`
-  ),
-  name: z2.string().max(MAX_CONDITION_NAME_LEN).optional().describe(
-    `Header name or query param name (required for header/query, max ${MAX_CONDITION_NAME_LEN} chars)`
-  ),
-  path: z2.string().max(MAX_CONDITION_PATH_LEN).optional().describe(
-    `JSON dot-notation path (required for body_path, max ${MAX_CONDITION_PATH_LEN} chars)`
-  )
-}).refine((c) => c.op === "exists" || c.value !== void 0 && c.value.length > 0, {
-  message: 'value is required when op is not "exists"'
-}).refine(
-  (c) => !(c.field === "header" || c.field === "query") || c.name !== void 0 && c.name.length > 0,
-  { message: "name is required for header and query conditions" }
-).refine((c) => c.field !== "body_path" || c.path !== void 0 && c.path.length > 0, {
-  message: "path is required for body_path conditions"
-}).refine((c) => c.op !== "matches" || !c.value || c.value.length <= MAX_GLOB_PATTERN_LEN, {
-  message: `matches pattern must be ${MAX_GLOB_PATTERN_LEN} chars or less`
-});
-var responseRuleSchema = z2.object({
-  name: z2.string().max(MAX_RULE_NAME_LEN).optional().describe(`Human-readable rule name (max ${MAX_RULE_NAME_LEN} chars)`),
-  enabled: z2.boolean().optional().default(true).describe("Whether this rule is active"),
-  logic: z2.enum(["and", "or"]).optional().default("and").describe('How to combine conditions: "and" (all match) or "or" (any match)'),
-  conditions: z2.array(ruleConditionSchema).min(1).max(10).describe("Conditions to evaluate (1-10)"),
-  response: z2.lazy(() => mockResponseSchema).describe("Response when conditions match")
-});
-var responseRulesSchema = z2.array(responseRuleSchema).max(50).describe("Ordered conditional response rules (first match wins, max 50)");
-var mockResponseSchema = z2.object({
-  status: z2.number().int().min(MOCK_RESPONSE_STATUS_MIN).max(MOCK_RESPONSE_STATUS_MAX).describe(`HTTP status code (${MOCK_RESPONSE_STATUS_MIN}-${MOCK_RESPONSE_STATUS_MAX})`),
-  body: z2.string().default("").describe("Response body string (default: empty)"),
-  headers: z2.record(z2.string(), z2.string()).default({}).describe("Response headers (default: none)"),
-  delay: z2.number().int().min(MOCK_RESPONSE_DELAY_MIN).max(MOCK_RESPONSE_DELAY_MAX).optional().describe(
-    `Response delay in milliseconds (${MOCK_RESPONSE_DELAY_MIN}-${MOCK_RESPONSE_DELAY_MAX}, default: none)`
-  )
-});
-var createEndpointShape = {
-  name: z2.string().optional().describe("Display name for the endpoint"),
-  ephemeral: z2.boolean().optional().describe("Create a temporary endpoint that auto-expires"),
-  expiresIn: durationOrTimestampSchema.optional().describe('Auto-expire after this duration, for example "12h"'),
-  mockResponse: mockResponseSchema.optional().describe("Optional mock response to return when the endpoint receives a request"),
-  responseRules: responseRulesSchema.optional().describe(
-    "Conditional response rules. Each rule has conditions and a response. First matching rule wins."
-  ),
-  notificationUrl: z2.string().url().optional().describe(
-    "URL to POST a JSON summary to after each captured request (e.g. Slack/Discord webhook)"
-  ),
-  signingProvider: z2.string().optional().describe(
-    "Signing provider for automatic signature verification (e.g. stripe, github, shopify)"
-  ),
-  signingSecret: z2.string().optional().describe(
-    "Signing secret (encrypted server-side, never returned). Required when signingProvider is set."
-  ),
-  signingHeader: z2.string().optional().describe("Custom signature header name. Only used with generic-hmac provider.")
-};
-var listEndpointsShape = {
-  team: z2.string().min(1).optional().describe(
-    "Team id or name (case-insensitive). Keeps endpoints shared with you from that team and endpoints you own that are shared with it."
-  )
-};
-var getEndpointShape = { slug: z2.string().describe("The endpoint slug") };
-var deleteEndpointShape = { slug: z2.string().describe("The endpoint slug to delete") };
-var listRequestsShape = {
-  endpointSlug: z2.string().describe("The endpoint slug"),
-  limit: z2.number().int().min(1).max(100).default(25).describe("Max requests to return"),
-  since: z2.number().optional().describe("Only return requests after this timestamp in ms"),
-  kind: kindSchema
-};
-var getRequestShape = { requestId: z2.string().describe("The request ID") };
-var waitForRequestShape = {
-  endpointSlug: z2.string().describe("The endpoint slug to monitor"),
-  timeout: durationOrTimestampSchema.default("30s").describe('How long to wait, for example "30s"'),
-  pollInterval: durationOrTimestampSchema.optional().describe('Interval between polls, for example "500ms" or "1s"')
-};
-var payloadSchemaShape = {
-  endpointSlug: z2.string().describe("The endpoint slug"),
-  format: z2.enum(PAYLOAD_SCHEMA_FORMATS).default("typescript").describe(
-    'Output: "typescript" interfaces, "zod" schemas, "pydantic" models, or "json-schema"'
-  ),
-  name: z2.string().max(100).optional().describe("Root type name (default: from the detected event, else WebhookPayload)"),
-  event: z2.string().optional().describe(
-    'Only requests whose detected provider event matches, e.g. "invoice.paid" or "push". One event per schema gives the tightest types.'
-  ),
-  method: z2.string().optional().describe("Only requests with this HTTP method"),
-  path: z2.string().optional().describe("Only requests with this path"),
-  requestIds: z2.array(z2.string()).min(1).max(50).optional().describe("Use exactly these requests instead of the latest ones"),
-  limit: z2.number().int().min(1).max(100).default(20).describe("How many of the latest requests to read before filtering")
-};
-function eventName(event) {
-  const words = event.replace(/([a-z0-9])([A-Z])/g, "$1 $2").split(/[^A-Za-z0-9]+/).filter(Boolean);
-  const name = words.map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join("");
-  if (!name) return "WebhookPayload";
-  return /^[0-9]/.test(name) ? `Webhook${name}Event` : `${name}Event`;
-}
-function payloadSchemaResult(requests, args) {
-  const method = args.method?.toUpperCase();
-  const matching = requests.filter(
-    (request) => request.kind !== "email" && (!method || request.method.toUpperCase() === method) && (!args.path || request.path === args.path) && (!args.event || detectWebhookInfo(request)?.event === args.event)
-  );
-  if (matching.length === 0) {
-    throw new Error(
-      `None of the ${requests.length} requests read matched. Capture a request first, or loosen event, method or path.`
-    );
-  }
-  const events = [
-    ...new Set(
-      matching.map((request) => detectWebhookInfo(request)?.event).filter((e) => !!e)
-    )
-  ];
-  const name = args.name ?? (events.length === 1 ? eventName(events[0]) : void 0);
-  const result = generateRequestSchema(matching, { format: args.format, name });
-  if (result.samples === 0) {
-    throw new Error(
-      `None of the ${matching.length} matching requests has a JSON or form body to learn from.`
-    );
-  }
-  const output = {
-    format: result.format,
-    name: result.name,
-    samples: result.samples,
-    skipped: result.skipped,
-    ...events.length > 0 ? { events } : {},
-    ...events.length > 1 ? {
-      warning: `The samples mix ${events.length} events, so fields of one event show up as optional. Pass event for one schema per event.`
-    } : {},
-    code: result.code
-  };
-  const size = JSON.stringify(output, null, 2).length;
-  if (size > MAX_OUTPUT) {
-    throw new Error(
-      `The schema is ${result.code.length} characters, more than this tool can return. Narrow it with event or requestIds, or call generateRequestSchema() from @webhooks-cc/sdk in code.`
-    );
-  }
-  return jsonContent(output);
-}
-function textContent(text) {
-  return { content: [{ type: "text", text }] };
-}
-function serializeJson(value, limit = MAX_BODY_SIZE) {
-  const full = JSON.stringify(value, null, 2);
-  if (full.length <= limit) {
-    return full;
-  }
-  if (Array.isArray(value)) {
-    let low = 0;
-    let high = value.length;
-    let best = JSON.stringify(
-      { items: [], truncated: true, total: value.length, returned: 0 },
-      null,
-      2
-    );
-    while (low <= high) {
-      const mid = Math.floor((low + high) / 2);
-      const candidate = JSON.stringify(
-        {
-          items: value.slice(0, mid),
-          truncated: true,
-          total: value.length,
-          returned: mid
-        },
-        null,
-        2
-      );
-      if (candidate.length <= limit) {
-        best = candidate;
-        low = mid + 1;
-      } else {
-        high = mid - 1;
-      }
-    }
-    return best;
-  }
-  return full.slice(0, limit) + `
-... [truncated, ${full.length} chars total]`;
-}
-function fitArrayField(value, key) {
-  const items = value[key];
-  if (!Array.isArray(items) || jsonSize(value) <= MAX_BODY_SIZE) return value;
-  const cut = (count) => ({
-    ...value,
-    [key]: items.slice(0, count),
-    truncated: true,
-    returned: count
-  });
-  let low = 0;
-  let high = items.length;
-  while (low < high) {
-    const mid = Math.ceil((low + high) / 2);
-    if (jsonSize(cut(mid)) <= MAX_BODY_SIZE) low = mid;
-    else high = mid - 1;
-  }
-  return cut(low);
-}
-function jsonContent(value) {
-  return textContent(serializeJson(value));
-}
-async function readBodyTruncated(response, limit = MAX_BODY_SIZE) {
-  const text = await response.text();
-  if (text.length <= limit) return text;
-  return text.slice(0, limit) + `
-... [truncated, ${text.length} chars total]`;
-}
-function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-function splitHint(message) {
-  const separatorIndex = message.indexOf(TIME_SEPARATOR);
-  if (separatorIndex === -1) {
-    return { message, hint: null };
-  }
-  return {
-    message: message.slice(0, separatorIndex),
-    hint: message.slice(separatorIndex + TIME_SEPARATOR.length) || null
-  };
-}
-function serializeError(error) {
-  const rawMessage = error instanceof Error ? error.message : String(error);
-  const { message, hint } = splitHint(rawMessage);
-  const payload = {
-    error: true,
-    code: "validation_error",
-    message,
-    hint,
-    retryAfter: null
-  };
-  if (error instanceof UnauthorizedError) {
-    payload.code = "unauthorized";
-  } else if (error instanceof NotFoundError) {
-    payload.code = "not_found";
-  } else if (error instanceof RateLimitError) {
-    payload.code = "rate_limited";
-    payload.retryAfter = error.retryAfter ?? null;
-  } else if (error instanceof TimeoutError) {
-    payload.code = "timeout";
-  } else if (error instanceof WebhooksCCError) {
-    payload.code = error.statusCode >= 500 ? "server_error" : "validation_error";
-  }
-  return JSON.stringify(payload, null, 2);
-}
-function withErrorHandling(handler) {
-  return async (args) => {
-    try {
-      return await handler(args);
-    } catch (error) {
-      return { ...textContent(serializeError(error)), isError: true };
-    }
-  };
-}
-function filterRequestsByMethod(requests, method) {
-  if (!method) {
-    return requests;
-  }
-  const target = method.toUpperCase();
-  return requests.filter((request) => request.method.toUpperCase() === target);
-}
-async function waitForMultipleRequests(client, endpointSlug, options) {
-  const timeoutMs = typeof options.timeout === "number" ? options.timeout : options.timeout ? Number.isNaN(Number(options.timeout)) ? parseDurationLike(options.timeout) : Number(options.timeout) : 3e4;
-  const pollIntervalMs = typeof options.pollInterval === "number" ? options.pollInterval : options.pollInterval ? Number.isNaN(Number(options.pollInterval)) ? parseDurationLike(options.pollInterval) : Number(options.pollInterval) : 500;
-  const startedAt = Date.now();
-  let since = startedAt;
-  const seenIds = /* @__PURE__ */ new Set();
-  const requests = [];
-  while (Date.now() - startedAt < timeoutMs) {
-    const checkTime = Date.now();
-    const page = await client.requests.list(endpointSlug, {
-      since,
-      limit: Math.max(100, options.count * 5)
-    });
-    since = checkTime;
-    const filtered = filterRequestsByMethod(page, options.method).slice().sort((left, right) => left.receivedAt - right.receivedAt);
-    for (const request of filtered) {
-      if (seenIds.has(request.id)) {
-        continue;
-      }
-      seenIds.add(request.id);
-      requests.push(request);
-      if (requests.length >= options.count) {
-        return {
-          requests,
-          complete: true,
-          timedOut: false,
-          expectedCount: options.count
-        };
-      }
-    }
-    await sleep(Math.max(10, pollIntervalMs));
-  }
-  return {
-    requests,
-    complete: requests.length >= options.count,
-    timedOut: true,
-    expectedCount: options.count
-  };
-}
-function parseDurationLike(value) {
-  const trimmed = value.trim();
-  if (trimmed.length === 0) {
-    throw new Error("Duration value cannot be empty");
-  }
-  const numeric = Number(trimmed);
-  if (!Number.isNaN(numeric)) {
-    return numeric;
-  }
-  const match = trimmed.match(/^(\d+)\s*(ms|s|m|h|d)$/i);
-  if (!match) {
-    throw new Error(`Invalid duration: "${value}"`);
-  }
-  const amount = Number(match[1]);
-  const unit = match[2].toLowerCase();
-  const multiplier = unit === "ms" ? 1 : unit === "s" ? 1e3 : unit === "m" ? 6e4 : unit === "h" ? 36e5 : 864e5;
-  return amount * multiplier;
-}
-function ensureVerifyArgs(args) {
-  if (args.provider === "discord") {
-    const publicKey = args.publicKey?.trim();
-    if (!publicKey) {
-      throw new Error('verify_signature for provider "discord" requires publicKey');
-    }
-    return {
-      provider: "discord",
-      publicKey
-    };
-  }
-  const secret = args.secret?.trim();
-  if (!secret) {
-    throw new Error(`verify_signature for provider "${args.provider}" requires secret`);
-  }
-  return {
-    provider: args.provider,
-    secret,
-    ...args.url ? { url: args.url } : {},
-    ...args.method ? { method: args.method } : {}
-  };
-}
-async function summarizeResponse(response) {
-  return {
-    status: response.status,
-    statusText: response.statusText,
-    body: await readBodyTruncated(response)
-  };
-}
-async function emailEndpointView(client, slug) {
-  const endpoint = await client.endpoints.get(slug);
-  return {
-    endpoint: { slug: endpoint.slug, name: endpoint.name ?? null },
-    includeExtracts: endpoint.showEmailExtracts !== false
-  };
-}
-function emailSlugFromAddress(address) {
-  const local = address.slice(0, Math.max(0, address.lastIndexOf("@")));
-  return local.split("+")[0].toLowerCase();
-}
-var MAX_SUMMARY_LINK = 8e3;
-function boundedLink(link, max) {
-  if (link == null || link.length <= max) return { link: link ?? null };
-  return {
-    link: null,
-    linkOmitted: `The main link is ${link.length} characters long, too long for the output`
-  };
-}
-var MAX_SUMMARY_FIELD = 1e3;
-function summarizeEmail(email, includeExtracts) {
-  const from = email.email.from[0];
-  const sender = from ? from.name ? `${from.name} <${from.address ?? ""}>` : from.address : null;
-  const subject = email.email.subject;
-  return {
-    id: email.id,
-    receivedAt: new Date(email.receivedAt).toISOString(),
-    address: email.path,
-    tag: email.email.tag,
-    subject: subject === null ? null : sliceText(subject, MAX_SUMMARY_FIELD),
-    from: sender == null ? null : sliceText(sender, MAX_SUMMARY_FIELD),
-    ...includeExtracts ? { code: extractCode(email), ...boundedLink(extractLink(email), MAX_SUMMARY_LINK) } : {},
-    attachments: email.email.attachments.length
-  };
-}
-var ESSENTIAL_DETAIL_FIELDS = [
-  "code",
-  "link",
-  "id",
-  "endpoint",
-  "receivedAt",
-  "address",
-  "tag",
-  "subject",
-  "from",
-  "size",
-  "test",
-  "spam",
-  "text",
-  "textTruncated",
-  "htmlSize",
-  "html",
-  "htmlTruncated"
-];
-function emailDetail(client, email, view, includeHtml) {
-  const { data } = client.emails.toJson(email, {
-    endpoint: view.endpoint,
-    includeExtracts: view.includeExtracts
-  });
-  const { html, text: fullText, ...rest } = data;
-  const { text, cut } = cutEmailText(fullText ?? null);
-  const restoreText = () => {
-    detail.text = text;
-    if (cut) detail.textTruncated = true;
-    else delete detail.textTruncated;
-  };
-  const detail = {
-    ...view.includeExtracts ? { code: extractCode(email), link: extractLink(email) } : {},
-    ...rest,
-    text,
-    ...cut ? { textTruncated: true } : {},
-    htmlSize: html?.length ?? 0,
-    ...includeHtml && html !== null ? { html } : {}
-  };
-  shrinkToFit(detail, MAX_BODY_SIZE, [
-    () => omitHeaders(detail),
-    () => trimSpam(detail),
-    () => capExtracts(detail),
-    () => capLists(detail),
-    () => cutStringToFit(detail, detail, "html", "htmlTruncated", MAX_BODY_SIZE),
-    () => cutStringToFit(detail, detail, "text", "textTruncated", MAX_BODY_SIZE, TEXT_FLOOR),
-    // Down to the essentials (and without a main link too long to use) there
-    // may be room for more of the text again.
-    () => {
-      keepOnly(detail, ESSENTIAL_DETAIL_FIELDS);
-      if (view.includeExtracts) {
-        Object.assign(detail, boundedLink(detail.link, MAX_BODY_SIZE / 2));
-      }
-      restoreText();
-      cutStringToFit(detail, detail, "text", "textTruncated", MAX_BODY_SIZE);
-    },
-    () => cutStringToFit(detail, detail, "subject", "subjectTruncated", MAX_BODY_SIZE)
-  ]);
-  return detail;
-}
-function registerTools(server, client) {
-  server.tool(
-    "create_endpoint",
-    "Create a webhook endpoint. Returns the endpoint slug, URL, and metadata.",
-    createEndpointShape,
-    withErrorHandling(
-      async ({
-        name,
-        ephemeral,
-        expiresIn,
-        mockResponse,
-        responseRules,
-        notificationUrl,
-        signingProvider,
-        signingSecret,
-        signingHeader
-      }) => {
-        if (signingProvider) {
-          if (signingProvider !== "discord" && !signingSecret) {
-            throw new Error(`signingSecret is required for provider "${signingProvider}"`);
-          }
-          if (signingProvider === "generic-hmac" && !signingHeader) {
-            throw new Error("signingHeader is required for generic-hmac provider");
-          }
-        }
-        if (signingSecret && !signingProvider) {
-          throw new Error("signingProvider is required when signingSecret is set");
-        }
-        const endpoint = await client.endpoints.create({
-          name,
-          ephemeral,
-          expiresIn,
-          mockResponse,
-          responseRules,
-          notificationUrl
-        });
-        if (signingProvider && signingSecret) {
-          try {
-            await client.endpoints.update(endpoint.slug, {
-              signingProvider,
-              signingSecret,
-              signingHeader
-            });
-          } catch (err) {
-            return jsonContent({
-              ...endpoint,
-              warning: `Endpoint created but signing configuration failed: ${err instanceof Error ? err.message : String(err)}. Update endpoint "${endpoint.slug}" to add signing.`
-            });
-          }
-        }
-        return jsonContent(endpoint);
-      }
-    )
-  );
-  server.tool(
-    "list_endpoints",
-    "List webhook endpoints: those you own (with sharedWith) and those shared with you through teams (with fromTeam). Optionally keep only one team's endpoints.",
-    listEndpointsShape,
-    withErrorHandling(async ({ team }) => {
-      const endpoints = await client.endpoints.list({ team });
-      return jsonContent(endpoints);
-    })
-  );
-  server.tool(
-    "list_teams",
-    "List the teams you own or belong to, with role, seats, pooled request usage (requestsUsed/requestLimit), period end, and whether the team is suspended for lack of a subscription.",
-    {},
-    withErrorHandling(async () => {
-      const teams = await client.teams.list();
-      return jsonContent(
-        teams.map((team) => ({
-          ...team,
-          periodEnd: team.periodEnd ? new Date(team.periodEnd).toISOString() : null
-        }))
-      );
-    })
-  );
-  server.tool(
-    "list_team_members",
-    "List a team's members and pending invites. Any member of the team may call this.",
-    { teamId: z2.string().min(1).describe("Team id (from list_teams)") },
-    withErrorHandling(async ({ teamId }) => {
-      const result = await client.teams.members(teamId);
-      return jsonContent(result);
-    })
-  );
-  server.tool(
-    "share_endpoint",
-    "Share an endpoint you own with a team so its members can inspect, stream, and edit it. The team needs an active subscription; the endpoint's requests then bill the team's pooled quota.",
-    {
-      slug: z2.string().describe("Slug of an endpoint you own"),
-      teamId: z2.string().min(1).describe("Team id (from list_teams)")
-    },
-    withErrorHandling(async ({ slug, teamId }) => {
-      await client.teams.share(teamId, slug);
-      return jsonContent({ shared: true, slug, teamId });
-    })
-  );
-  server.tool(
-    "unshare_endpoint",
-    "Stop sharing an endpoint you own with a team. Works even when the team is suspended.",
-    {
-      slug: z2.string().describe("Slug of an endpoint you own"),
-      teamId: z2.string().min(1).describe("Team id (from list_teams)")
-    },
-    withErrorHandling(async ({ slug, teamId }) => {
-      await client.teams.unshare(teamId, slug);
-      return jsonContent({ shared: false, slug, teamId });
-    })
-  );
-  server.tool(
-    "get_endpoint",
-    "Get details for a specific webhook endpoint by slug.",
-    getEndpointShape,
-    withErrorHandling(async ({ slug }) => {
-      const endpoint = await client.endpoints.get(slug);
-      return jsonContent(endpoint);
-    })
-  );
-  server.tool(
-    "update_endpoint",
-    "Update an endpoint name, mock response, conditional response rules, signing configuration, or whether codes and links are picked out of its emails.",
-    {
-      slug: z2.string().describe("The endpoint slug to update"),
-      name: z2.string().optional().describe("New display name"),
-      mockResponse: mockResponseSchema.nullable().optional().describe("Default mock response (used when no rule matches), or null to clear"),
-      responseRules: responseRulesSchema.nullable().optional().describe("Conditional response rules (first match wins), or null to clear"),
-      notificationUrl: z2.string().url().nullable().optional().describe("Notification webhook URL, or null to clear it"),
-      signingProvider: z2.string().nullable().optional().describe(
-        "Signing provider for automatic verification (e.g. stripe, github), or null to disable"
-      ),
-      signingSecret: z2.string().nullable().optional().describe("New signing secret (encrypted server-side). Pass null to clear."),
-      signingHeader: z2.string().nullable().optional().describe(
-        "Custom signature header name (only for generic-hmac provider), or null to clear"
-      ),
-      showEmailExtracts: z2.boolean().optional().describe("Pick codes and links out of emails (dashboard and forwarded JSON). Owner only.")
-    },
-    withErrorHandling(
-      async ({
-        slug,
-        name,
-        mockResponse,
-        responseRules,
-        notificationUrl,
-        signingProvider,
-        signingSecret,
-        signingHeader,
-        showEmailExtracts
-      }) => {
-        const endpoint = await client.endpoints.update(slug, {
-          name,
-          mockResponse,
-          responseRules,
-          notificationUrl,
-          signingProvider,
-          signingSecret,
-          signingHeader,
-          showEmailExtracts
-        });
-        return jsonContent(endpoint);
-      }
-    )
-  );
-  server.tool(
-    "delete_endpoint",
-    "Delete a webhook endpoint and all its captured requests.",
-    deleteEndpointShape,
-    withErrorHandling(async ({ slug }) => {
-      await client.endpoints.delete(slug);
-      return textContent(`Endpoint "${slug}" deleted.`);
-    })
-  );
-  server.tool(
-    "create_endpoints",
-    "Create multiple webhook endpoints in one call.",
-    {
-      count: z2.number().int().min(1).max(20).describe("Number of endpoints to create"),
-      namePrefix: z2.string().optional().describe("Optional prefix for endpoint names"),
-      ephemeral: z2.boolean().optional().describe("Create temporary endpoints that auto-expire"),
-      expiresIn: durationOrTimestampSchema.optional().describe('Auto-expire after this duration, for example "12h"')
-    },
-    withErrorHandling(async ({ count, namePrefix, ephemeral, expiresIn }) => {
-      const endpoints = await Promise.all(
-        Array.from(
-          { length: count },
-          (_, index) => client.endpoints.create({
-            name: namePrefix ? `${namePrefix}-${index + 1}` : void 0,
-            ephemeral,
-            expiresIn
-          })
-        )
-      );
-      return jsonContent({ endpoints });
-    })
-  );
-  server.tool(
-    "delete_endpoints",
-    "Delete multiple webhook endpoints in one call.",
-    {
-      slugs: z2.array(z2.string()).min(1).max(100).describe("Endpoint slugs to delete")
-    },
-    withErrorHandling(async ({ slugs }) => {
-      const settled = await Promise.allSettled(
-        slugs.map(async (slug) => {
-          await client.endpoints.delete(slug);
-          return slug;
-        })
-      );
-      return jsonContent({
-        deleted: settled.filter(
-          (result) => result.status === "fulfilled"
-        ).map((result) => result.value),
-        failed: settled.flatMap(
-          (result, index) => result.status === "rejected" ? [
-            {
-              slug: slugs[index],
-              message: result.reason instanceof Error ? result.reason.message : String(result.reason)
-            }
-          ] : []
-        )
-      });
-    })
-  );
-  server.tool(
-    "send_webhook",
-    "Send a test webhook to a hosted endpoint. Supports provider templates and signing.",
-    {
-      slug: z2.string().describe("The endpoint slug to send to"),
-      method: methodSchema,
-      headers: z2.record(z2.string(), z2.string()).optional().describe("HTTP headers to include"),
-      body: z2.unknown().optional().describe("Request body"),
-      provider: z2.enum(TEMPLATE_PROVIDERS).optional().describe("Optional provider template to send with signed headers"),
-      template: z2.string().optional().describe("Provider-specific template preset"),
-      event: z2.string().optional().describe("Provider event or topic name"),
-      secret: z2.string().optional().describe(
-        "Signing secret. Required for signed provider templates; omit for secretless providers (sendgrid, discord, plaid)."
-      )
-    },
-    withErrorHandling(
-      async ({ slug, method, headers, body, provider, template, event, secret }) => {
-        let response;
-        if (provider) {
-          const templateSecret = secret?.trim();
-          if (!templateSecret && TEMPLATE_METADATA[provider]?.secretRequired !== false) {
-            throw new Error(`send_webhook with provider "${provider}" requires a non-empty secret`);
-          }
-          response = await client.endpoints.sendTemplate(slug, {
-            provider,
-            template,
-            event,
-            secret: templateSecret,
-            method,
-            headers,
-            body
-          });
-        } else {
-          response = await client.endpoints.send(slug, { method, headers, body });
-        }
-        const responseBody = await readBodyTruncated(response);
-        return jsonContent({
-          status: response.status,
-          statusText: response.statusText,
-          body: responseBody
-        });
-      }
-    )
-  );
-  server.tool(
-    "list_requests",
-    "List recent captured requests for an endpoint, HTTP requests and emails together (filter with kind). For emails, list_emails is shorter.",
-    listRequestsShape,
-    withErrorHandling(async ({ endpointSlug, limit, since, kind }) => {
-      const requests = await client.requests.list(endpointSlug, { limit, since, kind });
-      return jsonContent(requests.map(compactRequest));
-    })
-  );
-  server.tool(
-    "search_requests",
-    "Search captured webhook requests across endpoints using retained full-text search.",
-    {
-      slug: z2.string().optional().describe("Filter to a specific endpoint slug"),
-      method: z2.string().optional().describe("Filter by HTTP method"),
-      kind: kindSchema,
-      q: z2.string().optional().describe("Free-text search across path, body, and headers"),
-      from: durationOrTimestampSchema.optional().describe('Start time as a timestamp or duration like "1h" or "7d"'),
-      to: durationOrTimestampSchema.optional().describe('End time as a timestamp or duration like "1h" or "7d"'),
-      limit: z2.number().int().min(1).max(200).default(50).describe("Max results to return"),
-      offset: z2.number().int().min(0).max(1e4).default(0).describe("Result offset"),
-      order: z2.enum(["asc", "desc"]).default("desc").describe("Sort order by received time")
-    },
-    withErrorHandling(async ({ slug, method, kind, q, from, to, limit, offset, order }) => {
-      const results = await client.requests.search({
-        slug,
-        method,
-        kind,
-        q,
-        from,
-        to,
-        limit,
-        offset,
-        order
-      });
-      return jsonContent(results.map(compactRequest));
-    })
-  );
-  server.tool(
-    "count_requests",
-    "Count captured webhook requests that match the given filters.",
-    {
-      slug: z2.string().optional().describe("Filter to a specific endpoint slug"),
-      method: z2.string().optional().describe("Filter by HTTP method"),
-      kind: kindSchema,
-      q: z2.string().optional().describe("Free-text search across path, body, and headers"),
-      from: durationOrTimestampSchema.optional().describe('Start time as a timestamp or duration like "1h" or "7d"'),
-      to: durationOrTimestampSchema.optional().describe('End time as a timestamp or duration like "1h" or "7d"')
-    },
-    withErrorHandling(async ({ slug, method, kind, q, from, to }) => {
-      const count = await client.requests.count({ slug, method, kind, q, from, to });
-      return jsonContent({ count });
-    })
-  );
-  server.tool(
-    "get_request",
-    "Get full details for a specific captured request by ID.",
-    getRequestShape,
-    withErrorHandling(async ({ requestId }) => {
-      const request = await client.requests.get(requestId);
-      return jsonContent(compactRequest(request));
-    })
-  );
-  server.tool(
-    "wait_for_request",
-    "Wait for a request to arrive at an endpoint.",
-    waitForRequestShape,
-    withErrorHandling(async ({ endpointSlug, timeout, pollInterval }) => {
-      const request = await client.requests.waitFor(endpointSlug, { timeout, pollInterval });
-      return jsonContent(compactRequest(request));
-    })
-  );
-  server.tool(
-    "wait_for_requests",
-    "Wait for multiple requests to arrive at an endpoint.",
-    {
-      endpointSlug: z2.string().describe("The endpoint slug to monitor"),
-      count: z2.number().int().min(1).max(20).describe("Number of requests to collect"),
-      timeout: durationOrTimestampSchema.default("30s").describe('How long to wait, for example "30s"'),
-      pollInterval: durationOrTimestampSchema.optional().describe('Interval between polls, for example "500ms" or "1s"'),
-      method: z2.string().optional().describe("Only collect requests with this HTTP method")
-    },
-    withErrorHandling(async ({ endpointSlug, count, timeout, pollInterval, method }) => {
-      const result = await waitForMultipleRequests(client, endpointSlug, {
-        count,
-        timeout,
-        pollInterval,
-        method
-      });
-      return jsonContent(
-        fitArrayField({ ...result, requests: result.requests.map(compactRequest) }, "requests")
-      );
-    })
-  );
-  server.tool(
-    "replay_request",
-    "Replay a previously captured request to a target URL.",
-    {
-      requestId: z2.string().describe("The captured request ID"),
-      targetUrl: httpUrlSchema.describe("The URL to replay the request to")
-    },
-    withErrorHandling(async ({ requestId, targetUrl }) => {
-      const response = await client.requests.replay(requestId, targetUrl);
-      const responseBody = await readBodyTruncated(response);
-      return jsonContent({
-        status: response.status,
-        statusText: response.statusText,
-        body: responseBody
-      });
-    })
-  );
-  server.tool(
-    "compare_requests",
-    "Compare two captured requests and show the structured differences.",
-    {
-      leftRequestId: z2.string().describe("The first request ID"),
-      rightRequestId: z2.string().describe("The second request ID"),
-      ignoreHeaders: z2.array(z2.string()).optional().describe("Headers to ignore during comparison")
-    },
-    withErrorHandling(async ({ leftRequestId, rightRequestId, ignoreHeaders }) => {
-      const [leftRequest, rightRequest] = await Promise.all([
-        client.requests.get(leftRequestId),
-        client.requests.get(rightRequestId)
-      ]);
-      const diff = diffRequests(leftRequest, rightRequest, { ignoreHeaders });
-      return jsonContent(diff);
-    })
-  );
-  server.tool(
-    "generate_payload_schema",
-    "Generate TypeScript interfaces, Zod schemas, Pydantic models, or JSON Schema from captured request bodies. Several requests of one event teach which fields are optional or nullable, so filter with event (or pass requestIds) and write the result into the codebase instead of hand-typing the payload.",
-    payloadSchemaShape,
-    withErrorHandling(async ({ endpointSlug, requestIds, limit, ...args }) => {
-      const requests = requestIds ? await Promise.all(requestIds.map((id) => client.requests.get(id))) : await client.requests.list(endpointSlug, { limit, kind: "http" });
-      return payloadSchemaResult(requests, args);
-    })
-  );
-  server.tool(
-    "extract_from_request",
-    "Extract specific JSON fields from a captured request body.",
-    {
-      requestId: z2.string().describe("The request ID"),
-      jsonPaths: z2.array(z2.string()).min(1).max(50).describe("Dot-notation JSON paths to extract")
-    },
-    withErrorHandling(async ({ requestId, jsonPaths }) => {
-      const request = await client.requests.get(requestId);
-      const extracted = Object.fromEntries(
-        jsonPaths.map((path) => [path, extractJsonField(request, path) ?? null])
-      );
-      return jsonContent(extracted);
-    })
-  );
-  server.tool(
-    "verify_signature",
-    "Verify the webhook signature on a captured request. When called without provider/secret, returns the server-side pre-computed result (if signing is configured on the endpoint). When called with provider+secret, performs client-side verification.",
-    {
-      requestId: z2.string().describe("The captured request ID"),
-      provider: z2.enum(VERIFY_PROVIDERS).optional().describe("Provider whose signature scheme should be verified. Omit to use stored result."),
-      secret: z2.string().optional().describe(
-        "Provider credential for client-side verification (for example a shared signing secret, Adyen hex HMAC key, or PayPal webhook ID). Required for non-Discord providers."
-      ),
-      publicKey: z2.string().optional().describe("Discord application public key. Required for provider=discord."),
-      url: httpUrlSchema.optional().describe("Original signed URL. Required for Twilio, Square, and HubSpot verification."),
-      method: z2.string().optional().describe(
-        "Original HTTP method used when the signature was generated. Used by HubSpot v3 verification; the SDK assumes POST when omitted."
-      )
-    },
-    withErrorHandling(async ({ requestId, provider, secret, publicKey, url, method }) => {
-      const request = await client.requests.get(requestId);
-      if (!provider && !secret && !publicKey) {
-        const verified = request.signatureVerified;
-        if (verified === null || verified === void 0) {
-          return jsonContent({
-            valid: null,
-            details: "No signature verification configured on this endpoint. Pass provider and secret to verify client-side."
-          });
-        }
-        let errorData = null;
-        if (request.signatureError) {
-          try {
-            errorData = JSON.parse(request.signatureError);
-          } catch {
-            errorData = null;
-          }
-        }
-        const isSkipped = !verified && errorData?.code && (errorData.code === "missing_header" || errorData.code === "unsupported");
-        return jsonContent({
-          valid: isSkipped ? null : verified,
-          provider: request.signingProvider ?? null,
-          details: verified ? "Signature verified by server." : isSkipped ? `Verification skipped: ${errorData?.message ?? errorData?.code}` : `Signature invalid: ${request.signatureError ?? "unknown error"}`,
-          error: request.signatureError ?? null,
-          skipped: isSkipped ?? false
-        });
-      }
-      const verificationOptions = ensureVerifyArgs({
-        provider,
-        secret,
-        publicKey,
-        url,
-        method
-      });
-      const result = await verifySignature(request, verificationOptions);
-      return jsonContent({
-        valid: result.valid,
-        details: result.valid ? "Signature is valid." : "Signature did not match."
-      });
-    })
-  );
-  server.tool(
-    "clear_requests",
-    "Delete captured requests for an endpoint without deleting the endpoint itself.",
-    {
-      slug: z2.string().describe("The endpoint slug to clear"),
-      before: durationOrTimestampSchema.optional().describe('Only clear requests older than this timestamp or duration like "1h"')
-    },
-    withErrorHandling(async ({ slug, before }) => {
-      await client.requests.clear(slug, { before });
-      return jsonContent({ slug, cleared: true, before: before ?? null });
-    })
-  );
-  server.tool(
-    "send_to",
-    "Send a webhook directly to any URL with optional provider signing.",
-    {
-      url: httpUrlSchema.describe("Target URL"),
-      method: methodSchema,
-      headers: z2.record(z2.string(), z2.string()).optional().describe("HTTP headers to include"),
-      body: z2.unknown().optional().describe("Request body"),
-      provider: z2.enum(TEMPLATE_PROVIDERS).optional().describe("Optional provider template for signing"),
-      template: z2.string().optional().describe("Provider-specific template preset"),
-      event: z2.string().optional().describe("Provider event or topic name"),
-      secret: z2.string().optional().describe(
-        "Signing secret. Required for signed provider templates; omit for secretless providers (sendgrid, discord, plaid)."
-      )
-    },
-    withErrorHandling(async ({ url, method, headers, body, provider, template, event, secret }) => {
-      const response = await client.sendTo(url, {
-        method,
-        headers,
-        body,
-        provider,
-        template,
-        event,
-        secret
-      });
-      const responseBody = await readBodyTruncated(response);
-      return jsonContent({
-        status: response.status,
-        statusText: response.statusText,
-        body: responseBody
-      });
-    })
-  );
-  server.tool(
-    "preview_webhook",
-    "Preview a webhook request without sending it. Returns the exact URL, method, headers, and body.",
-    {
-      url: httpUrlSchema.describe("Target URL"),
-      method: methodSchema,
-      headers: z2.record(z2.string(), z2.string()).optional().describe("HTTP headers to include"),
-      body: z2.unknown().optional().describe("Request body"),
-      provider: z2.enum(TEMPLATE_PROVIDERS).optional().describe("Optional provider template for signing"),
-      template: z2.string().optional().describe("Provider-specific template preset"),
-      event: z2.string().optional().describe("Provider event or topic name"),
-      secret: z2.string().optional().describe(
-        "Signing secret. Required for signed provider templates; omit for secretless providers (sendgrid, discord, plaid)."
-      )
-    },
-    withErrorHandling(async ({ url, method, headers, body, provider, template, event, secret }) => {
-      const preview = await client.buildRequest(url, {
-        method,
-        headers,
-        body,
-        provider,
-        template,
-        event,
-        secret
-      });
-      return jsonContent(preview);
-    })
-  );
-  server.tool(
-    "list_provider_templates",
-    "List supported webhook providers, templates, and signing metadata.",
-    {
-      provider: z2.enum(TEMPLATE_PROVIDERS).optional().describe("Filter to a single provider")
-    },
-    withErrorHandling(async ({ provider }) => {
-      if (provider) {
-        return jsonContent([client.templates.get(provider)]);
-      }
-      return jsonContent(
-        client.templates.listProviders().map((name) => client.templates.get(name))
-      );
-    })
-  );
-  server.tool(
-    "get_usage",
-    "Check current request usage, remaining quota, plan, and period end, plus the pooled quota of every subscribed team you belong to.",
-    {},
-    withErrorHandling(async () => {
-      const [usageResult, teamsResult] = await Promise.allSettled([
-        client.usage(),
-        client.teams.list()
-      ]);
-      if (usageResult.status === "rejected") throw usageResult.reason;
-      const usage = usageResult.value;
-      const teams = teamsResult.status === "fulfilled" ? teamsResult.value : [];
-      const teamsError = teamsResult.status === "rejected" ? teamsResult.reason instanceof Error ? teamsResult.reason.message : String(teamsResult.reason) : void 0;
-      return jsonContent({
-        ...usage,
-        periodEnd: usage.periodEnd ? new Date(usage.periodEnd).toISOString() : null,
-        ...teamsError ? { teamsError } : {},
-        teams: teams.filter((team) => !team.suspended).map((team) => ({
-          id: team.id,
-          name: team.name,
-          role: team.role,
-          seats: team.seats,
-          used: team.requestsUsed,
-          limit: team.requestLimit,
-          remaining: Math.max(0, team.requestLimit - team.requestsUsed),
-          periodEnd: team.periodEnd ? new Date(team.periodEnd).toISOString() : null
-        }))
-      });
-    })
-  );
-  server.tool(
-    "test_webhook_flow",
-    "Run a full webhook test flow: create endpoint, optionally mock, send, wait, verify, replay, and clean up.",
-    {
-      provider: z2.enum(TEMPLATE_PROVIDERS).optional().describe("Optional provider template to use when sending the webhook"),
-      event: z2.string().optional().describe("Optional provider event or topic name"),
-      secret: z2.string().optional().describe(
-        "Signing secret. Required when provider is set or signature verification is enabled."
-      ),
-      mockStatus: z2.number().int().min(100).max(599).optional().describe("Optional mock response status to configure before sending"),
-      targetUrl: httpUrlSchema.optional().describe("Optional URL to replay the captured request to after capture"),
-      verifySignature: z2.boolean().default(false).describe("Verify the captured request signature after capture"),
-      cleanup: z2.boolean().default(true).describe("Delete the created endpoint after the flow completes")
-    },
-    withErrorHandling(
-      async ({
-        provider,
-        event,
-        secret,
-        mockStatus,
-        targetUrl,
-        verifySignature: shouldVerify,
-        cleanup
-      }) => {
-        const flow = client.flow().createEndpoint({ expiresIn: "1h" }).waitForCapture({ timeout: "30s" });
-        if (mockStatus !== void 0) {
-          flow.setMock({
-            status: mockStatus,
-            body: "",
-            headers: {}
-          });
-        }
-        if (provider) {
-          const templateSecret = secret?.trim();
-          if (!templateSecret && TEMPLATE_METADATA[provider]?.secretRequired !== false) {
-            throw new Error(
-              `test_webhook_flow with provider "${provider}" requires a non-empty secret`
-            );
-          }
-          flow.sendTemplate({
-            provider,
-            event,
-            secret: templateSecret
-          });
-          if (shouldVerify) {
-            if (provider === "discord") {
-              throw new Error(
-                "test_webhook_flow cannot verify Discord signatures (Ed25519 requires a public key, not a secret)"
-              );
-            }
-            if (!templateSecret) {
-              throw new Error(
-                `test_webhook_flow cannot verify "${provider}" signatures \u2014 this provider's templates are unsigned`
-              );
-            }
-            flow.verifySignature({
-              provider,
-              secret: templateSecret
-            });
-          }
-        } else {
-          if (shouldVerify) {
-            throw new Error("test_webhook_flow cannot verify signatures without a provider");
-          }
-          flow.send();
-        }
-        if (targetUrl) {
-          flow.replayTo(targetUrl);
-        }
-        if (cleanup) {
-          flow.cleanup();
-        }
-        const result = await flow.run();
-        return jsonContent({
-          endpoint: result.endpoint,
-          request: result.request ?? null,
-          verification: result.verification ?? null,
-          replayResponse: result.replayResponse ? await summarizeResponse(result.replayResponse) : null,
-          cleanedUp: result.cleanedUp
-        });
-      }
-    )
-  );
-  server.tool(
-    "list_emails",
-    "List the emails an endpoint received at its mailhooks.cc address, newest first: subject, sender, tag, and the one-time code and main link found in each.",
-    {
-      endpointSlug: z2.string().describe("The endpoint slug"),
-      limit: z2.number().int().min(1).max(100).default(25).describe(
-        `Max emails to return. With tag, subject or from, the newest ${EMAIL_SCAN_LIMIT} emails are searched.`
-      ),
-      since: z2.number().optional().describe("Only emails received after this timestamp in ms"),
-      tag: z2.string().optional().describe("Only emails sent to {slug}+{tag}@mailhooks.cc (exact, case-sensitive)"),
-      subject: z2.string().optional().describe("Only emails whose subject contains this text"),
-      from: z2.string().optional().describe("Only emails from this address (case-insensitive)")
-    },
-    withErrorHandling(async ({ endpointSlug, limit, since, tag, subject, from }) => {
-      const filtered = tag !== void 0 || subject !== void 0 || from !== void 0;
-      const scan = filtered ? Math.max(limit, EMAIL_SCAN_LIMIT) : limit;
-      const [emails, view] = await Promise.all([
-        client.emails.list(endpointSlug, { limit: scan, since, tag, subject, from }),
-        emailEndpointView(client, endpointSlug)
-      ]);
-      return jsonContent(
-        emails.slice(0, limit).map((email) => summarizeEmail(email, view.includeExtracts))
-      );
-    })
-  );
-  server.tool(
-    "get_email",
-    "Get one captured email: by requestId, or the newest at an endpoint (optionally with a tag). Returns the parsed message with its one-time code and main link.",
-    {
-      requestId: z2.string().optional().describe("The email's request ID"),
-      endpointSlug: z2.string().optional().describe("Get the newest email at this endpoint instead (with requestId unset)"),
-      tag: z2.string().optional().describe("With endpointSlug: only emails sent to this +tag"),
-      includeHtml: z2.boolean().default(false).describe("Include the HTML part (default: false, only its size)")
-    },
-    withErrorHandling(async ({ requestId, endpointSlug, tag, includeHtml }) => {
-      if (requestId === void 0 === (endpointSlug === void 0)) {
-        throw new Error("Pass exactly one of requestId or endpointSlug");
-      }
-      const email = requestId ? await client.emails.get(requestId) : await client.emails.latest(endpointSlug, { tag });
-      if (!email) {
-        throw new NotFoundError(
-          `No email at ${endpointSlug}${tag ? ` with tag "${tag}"` : ""} yet. Send one with send_test_email, or wait with wait_for_email.`
-        );
-      }
-      const view = await emailEndpointView(
-        client,
-        endpointSlug ?? emailSlugFromAddress(email.path)
-      );
-      return jsonContent(emailDetail(client, email, view, includeHtml));
-    })
-  );
-  server.tool(
-    "wait_for_email",
-    "Wait for an email to arrive at an endpoint (for example after triggering a signup), then return it with its one-time code and main link. Use a tag per run to find your own email.",
-    {
-      endpointSlug: z2.string().describe("The endpoint slug"),
-      tag: z2.string().optional().describe("Only emails sent to {slug}+{tag}@mailhooks.cc"),
-      subject: z2.string().optional().describe("Only emails whose subject contains this text"),
-      from: z2.string().optional().describe("Only emails from this address (case-insensitive)"),
-      timeout: durationOrTimestampSchema.default("30s").describe(
-        `How long to wait (default "30s"). Keep it under your MCP client's request timeout, often 60 seconds.`
-      ),
-      since: z2.number().optional().describe("Only emails received after this timestamp in ms (default: five minutes ago)"),
-      includeHtml: z2.boolean().default(false).describe("Include the HTML part (default: false)")
-    },
-    withErrorHandling(async ({ endpointSlug, tag, subject, from, timeout, since, includeHtml }) => {
-      const [email, view] = await Promise.all([
-        client.emails.waitFor(endpointSlug, { tag, subject, from, timeout, since }),
-        emailEndpointView(client, endpointSlug)
-      ]);
-      return jsonContent(emailDetail(client, email, view, includeHtml));
-    })
-  );
-  server.tool(
-    "send_test_email",
-    "Deliver a sample email (with a 6-digit code and a link) to an endpoint, optionally to a +tag address. It counts as one request and skips SMTP, so sender checks do not run on it.",
-    {
-      slug: z2.string().describe("The endpoint slug"),
-      tag: z2.string().optional().describe("Deliver to {slug}+{tag}@mailhooks.cc")
-    },
-    withErrorHandling(async ({ slug, tag }) => {
-      const result = await client.emails.sendTest(slug, { tag });
-      return jsonContent({ ...result, address: client.emails.address(slug, tag) });
-    })
-  );
-  server.tool(
-    "configure_forwarding",
-    "Change an endpoint's forwarding: the URL, on or off, which kinds (HTTP requests, emails), the format, your own headers, and the advanced options. Only the arguments you pass change. Owner only. Saving the first URL creates the signing secret. A Slack or Discord webhook URL gets a chat message automatically.",
-    {
-      slug: z2.string().describe("The endpoint slug"),
-      url: httpUrlSchema.nullable().optional().describe("https URL on a public host name, or null to remove it (forwarding must be off)"),
-      enabled: z2.boolean().optional().describe("Turn forwarding on (needs a URL) or off (fails deliveries still waiting)"),
-      http: z2.boolean().optional().describe("Forward HTTP requests"),
-      email: z2.boolean().optional().describe("Forward emails"),
-      format: z2.enum(["auto", "as_received", "json", "chat"]).optional().describe(
-        "auto (pick from the URL), as_received (relay HTTP requests unchanged; emails as signed JSON), json (signed JSON envelope for both kinds) or chat (Slack or Discord message)"
-      ),
-      headers: z2.array(
-        z2.object({
-          name: z2.string().describe("Header name, e.g. Authorization"),
-          value: z2.string().nullable().describe("Header value, or null to keep the value stored under this name")
-        })
-      ).max(10).optional().describe(
-        "Your own headers for every delivery (not chat). Replaces the whole list; [] removes them"
-      ),
-      appendPath: z2.boolean().optional().describe("Add the path after the slug to the URL for relayed requests (default true)"),
-      retrySeconds: z2.union([z2.literal(0), z2.literal(3600), z2.literal(86400)]).optional().describe("Retry failed deliveries for 86400 (default), 3600 or 0 seconds"),
-      keepOrder: z2.boolean().optional().describe("One delivery at a time, in capture order (default false)"),
-      sentField: z2.string().max(128).nullable().optional().describe(
-        "JSON body field with the sender's own timestamp, e.g. publishedAt or data.publishedAt; null clears it"
-      )
-    },
-    withErrorHandling(async ({ slug, ...options }) => {
-      const endpoint = await client.forwarding.configure(slug, options);
-      return jsonContent({
-        slug: endpoint.slug,
-        forwardEnabled: endpoint.forwardEnabled ?? false,
-        forwardUrl: endpoint.forwardUrl ?? null,
-        hasForwardSecret: endpoint.hasForwardSecret ?? false,
-        forwardHttp: endpoint.forwardHttp ?? false,
-        forwardEmail: endpoint.forwardEmail ?? false,
-        forwardFormat: endpoint.forwardFormat ?? "auto",
-        forwardHeaders: endpoint.forwardHeaders ?? [],
-        forwardAppendPath: endpoint.forwardAppendPath ?? true,
-        forwardRetrySeconds: endpoint.forwardRetrySeconds ?? 86400,
-        forwardKeepOrder: endpoint.forwardKeepOrder ?? false,
-        forwardSentField: endpoint.forwardSentField ?? null
-      });
-    })
-  );
-  server.tool(
-    "get_forwarding_secret",
-    "Read (or with rotate: true, replace) the whsec_ secret forwarded deliveries are signed with. Owner only. Treat the value as a credential: put it in the handler's environment, not in code.",
-    {
-      slug: z2.string().describe("The endpoint slug"),
-      rotate: z2.boolean().default(false).describe("Replace the secret; every delivery from now on uses the new one")
-    },
-    withErrorHandling(async ({ slug, rotate }) => {
-      const secret = rotate ? await client.forwarding.rotateSecret(slug) : await client.forwarding.secret(slug);
-      return jsonContent({ secret, rotated: rotate });
-    })
-  );
-  server.tool(
-    "test_forwarding",
-    "Send the endpoint's newest captured request of a kind (or a sample) to its forwarding URL once, exactly as a delivery would go out, and report the answer. Works with forwarding on or off; nothing is retried or logged.",
-    {
-      slug: z2.string().describe("The endpoint slug"),
-      kind: z2.enum(["http", "email"]).optional().describe(
-        "Which kind to send (default: http when HTTP requests are forwarded, else email)"
-      )
-    },
-    withErrorHandling(async ({ slug, kind }) => {
-      return jsonContent(await client.forwarding.test(slug, kind ? { kind } : {}));
-    })
-  );
-  server.tool(
-    "list_deliveries",
-    "List forwarding deliveries: an endpoint's delivery log with its counts (endpointSlug), or every delivery and try of one captured request or email (requestId). Rows carry senderAt when the request had the sender's own timestamp, so receivedAt - senderAt is the time to reach webhooks.cc.",
-    {
-      endpointSlug: z2.string().optional().describe("List the endpoint's delivery log"),
-      requestId: z2.string().optional().describe("List every delivery and try of this request"),
-      limit: z2.number().int().min(1).max(100).default(20).describe("With endpointSlug: max rows"),
-      status: z2.enum(["all", "pending", "failed"]).default("all").describe("With endpointSlug: all, pending (queued or retrying) or failed"),
-      before: z2.string().optional().describe("With endpointSlug: a row's cursor, to list older rows")
-    },
-    withErrorHandling(async ({ endpointSlug, requestId, limit, status, before }) => {
-      if (requestId === void 0 === (endpointSlug === void 0)) {
-        throw new Error("Pass exactly one of endpointSlug or requestId");
-      }
-      if (requestId) return jsonContent(await client.forwarding.requestDeliveries(requestId));
-      const [summary, deliveries] = await Promise.all([
-        client.forwarding.summary(endpointSlug),
-        client.forwarding.deliveries(endpointSlug, { limit, status, before })
-      ]);
-      return jsonContent({
-        summary,
-        deliveries,
-        nextCursor: deliveries.length === limit ? deliveries[deliveries.length - 1]?.cursor ?? null : null
-      });
-    })
-  );
-  server.tool(
-    "redeliver",
-    "Forward again with the endpoint's current settings: one captured request or email (requestId; it also sends one that was never forwarded), or every request whose latest delivery failed (endpointSlug, oldest first, up to 1,000 at a time). Owner only; fails while forwarding is off.",
-    {
-      requestId: z2.string().optional().describe("The request or email to send again"),
-      endpointSlug: z2.string().optional().describe("Send every failed delivery of this endpoint again")
-    },
-    withErrorHandling(async ({ requestId, endpointSlug }) => {
-      if (requestId === void 0 === (endpointSlug === void 0)) {
-        throw new Error("Pass exactly one of requestId or endpointSlug");
-      }
-      return jsonContent(
-        requestId ? await client.forwarding.redeliver(requestId) : await client.forwarding.redeliverFailed(endpointSlug)
-      );
-    })
-  );
-  server.tool(
-    "describe",
-    "Describe all available SDK operations, parameters, and types.",
-    {},
-    withErrorHandling(async () => {
-      const description = client.describe();
-      return jsonContent(description);
-    })
-  );
-}
-
-// src/sandbox-tools.ts
 var SANDBOX = {
   maxEndpoints: 3,
   requestsPerEndpoint: 25,
@@ -1772,7 +268,6 @@ var SANDBOX = {
 };
 var DEFAULT_WAIT_SECONDS = 45;
 var MAX_WAIT_SECONDS = 600;
-var TOKEN_REFRESH_MARGIN_MS = 6e4;
 var DOCS_URL = "https://webhooks.cc/docs/agents";
 var ACCOUNT_ONLY_OPTIONS = [
   "mockResponse",
@@ -1783,20 +278,29 @@ var ACCOUNT_ONLY_OPTIONS = [
   "signingHeader"
 ];
 var AgentSession = class {
-  constructor(baseUrl, webhookUrl, clientName) {
+  constructor(baseUrl, webhookUrl, clientName, credentialsFile) {
     this.baseUrl = baseUrl;
     this.webhookUrl = webhookUrl;
     this.clientName = clientName;
+    this.credentialsFile = credentialsFile;
     this.sandbox = null;
-    this.claim = null;
-    this.connected = false;
+    this.connect = null;
+  }
+  sandboxOptions() {
+    return {
+      baseUrl: this.baseUrl,
+      webhookUrl: this.webhookUrl,
+      clientName: this.clientName,
+      credentialsFile: this.credentialsFile
+    };
   }
   /**
-   * The sandbox, registered on first use and again after it expired. Tool
-   * calls can run in parallel: this.sandbox is read again after every await,
-   * and a new sandbox is assigned with no await in between, so parallel
-   * calls share one registration. Calls waiting on a registration that fails
-   * get its error (a 429 asks them to wait); the next call starts again.
+   * The sandbox: the one saved by an earlier session when it is still live,
+   * else a new registration (and again after it expired). Tool calls can run
+   * in parallel: this.sandbox is read again after every await, and a new
+   * sandbox is assigned with no await in between, so parallel calls share
+   * one registration. Calls waiting on a registration that fails get its
+   * error (a 429 asks them to wait); the next call starts again.
    */
   async sandboxClient() {
     while (this.sandbox) {
@@ -1804,35 +308,36 @@ var AgentSession = class {
       const sandbox = await pending;
       if (!this.expired(pending, sandbox)) return sandbox;
     }
-    const created = WebhooksCC2.sandbox({
-      baseUrl: this.baseUrl,
-      webhookUrl: this.webhookUrl,
-      clientName: this.clientName
-    });
+    const created = WebhooksCC.sandbox(this.sandboxOptions());
     this.sandbox = created;
     created.catch(() => {
       if (this.sandbox === created) this.sandbox = null;
     });
     return created;
   }
-  /** The live sandbox, if one was registered; never registers one. */
+  /** The live sandbox, from this session or the credential file; never registers one. */
   async existingSandbox() {
     const pending = this.sandbox;
-    if (!pending) return null;
-    let sandbox;
-    try {
-      sandbox = await pending;
-    } catch {
-      return null;
+    if (pending) {
+      let sandbox;
+      try {
+        sandbox = await pending;
+      } catch {
+        return null;
+      }
+      return this.expired(pending, sandbox) ? null : sandbox;
     }
-    return this.expired(pending, sandbox) ? null : sandbox;
+    const resumed = await SandboxClient.resume(this.sandboxOptions()).catch(() => null);
+    if (!resumed) return null;
+    if (!this.sandbox) this.sandbox = Promise.resolve(resumed);
+    return this.sandbox;
   }
   /** True when the sandbox is past its 24 hours; then it is dropped. */
   expired(pending, sandbox) {
     if (sandbox.expiresAt.getTime() > Date.now()) return false;
     if (this.sandbox === pending) this.sandbox = null;
-    if (this.claim?.kind === "sandbox" && this.claim.claimToken === sandbox.registration.claimToken) {
-      this.claim = null;
+    if (this.connect?.via === "sandbox" && this.connect.sandbox === sandbox) {
+      this.connect = null;
     }
     return true;
   }
@@ -1843,26 +348,11 @@ var AgentSession = class {
     }
     return sandbox;
   }
-  forgetSandbox() {
+  reset() {
     this.sandbox = null;
+    this.connect = null;
   }
 };
-function claimedTokens(baseUrl, assertion, first) {
-  let current = first;
-  let pending = null;
-  return async (options) => {
-    if (!options?.forceRefresh && current.expiresAt.getTime() - Date.now() > TOKEN_REFRESH_MARGIN_MS) {
-      return current.accessToken;
-    }
-    if (!pending) {
-      pending = WebhooksCC2.agent.exchange({ baseUrl, assertion }).finally(() => {
-        pending = null;
-      });
-    }
-    current = await pending;
-    return current.accessToken;
-  };
-}
 function minutesLeft(until) {
   return Math.max(1, Math.round((until.getTime() - Date.now()) / 6e4));
 }
@@ -1870,16 +360,53 @@ function onlyKind(requests, kind) {
   if (!kind) return requests;
   return requests.filter((request) => (request.kind ?? "http") === kind);
 }
+function savedTo(credentialsFile) {
+  return AgentCredentialStore.resolve(credentialsFile)?.path ?? null;
+}
 function registerSandboxTools(server, options = {}) {
   const baseUrl = options.baseUrl ?? process.env.WHK_BASE_URL ?? "https://webhooks.cc";
+  const webhookUrl = options.webhookUrl ?? process.env.WHK_WEBHOOK_URL;
   const session = new AgentSession(
     baseUrl,
-    options.webhookUrl ?? process.env.WHK_WEBHOOK_URL,
-    options.clientName ?? "webhooks-cc-mcp"
-  );
-  const registered = [];
+    webhookUrl,
+    options.clientName ?? "webhooks-cc-mcp",
+    options.credentialsFile
+  );
+  let handles = [];
+  let shown = 0;
+  const swap = (register) => {
+    const id = ++shown;
+    for (const handle of handles) handle.remove();
+    handles = register(id);
+  };
+  const showSandbox = () => swap(() => sandboxToolSet(server, session, showAccount));
+  const savedAccount = (id) => options.credentialsFile === false ? null : WebhooksCC.fromSavedConnection({
+    baseUrl,
+    webhookUrl,
+    credentialsFile: options.credentialsFile,
+    // The human disconnected the agent: back to the sandbox, unless a
+    // newer connection is already on display.
+    onRevoked: () => queueMicrotask(() => {
+      if (shown === id) showSandbox();
+    })
+  });
+  function showAccount(client) {
+    swap((id) => registerTools(server, savedAccount(id) ?? client));
+    options.onConnected?.(client);
+  }
+  const saved = savedAccount(1);
+  if (saved) {
+    swap(() => registerTools(server, saved));
+    options.onConnected?.(saved);
+  } else {
+    showSandbox();
+  }
+}
+function sandboxToolSet(server, session, showAccount) {
+  const tools = [];
   const limits = `up to ${SANDBOX.maxEndpoints} endpoints at a time, ${SANDBOX.requestsPerEndpoint} captured requests each and ${SANDBOX.requests} in all, deleted ${SANDBOX.lifetimeHours} hours after the sandbox was created`;
-  registered.push(
+  const file = savedTo(session.credentialsFile);
+  tools.push(
     server.tool(
       "create_endpoint",
       `Create a temporary webhook capture endpoint in the agent sandbox (no account needed): ${limits}. The first call registers the sandbox, which takes a few seconds of proof of work. Mock responses, notifications and signature verification need an account: see connect_account.`,
@@ -1903,7 +430,7 @@ function registerSandboxTools(server, options = {}) {
       })
     )
   );
-  registered.push(
+  tools.push(
     server.tool(
       "list_endpoints",
       "List this agent's sandbox endpoints. Empty until create_endpoint starts the sandbox.",
@@ -1917,7 +444,7 @@ function registerSandboxTools(server, options = {}) {
       })
     )
   );
-  registered.push(
+  tools.push(
     server.tool(
       "get_endpoint",
       "Get one of this agent's sandbox endpoints by slug, with its sandbox limits and usage.",
@@ -1927,7 +454,7 @@ function registerSandboxTools(server, options = {}) {
       })
     )
   );
-  registered.push(
+  tools.push(
     server.tool(
       "delete_endpoint",
       "Delete one of this agent's sandbox endpoints and its captured requests. Frees a slot; the sandbox's request budget is not refunded.",
@@ -1938,7 +465,7 @@ function registerSandboxTools(server, options = {}) {
       })
     )
   );
-  registered.push(
+  tools.push(
     server.tool(
       "list_requests",
       "List recent requests captured by a sandbox endpoint, newest first.",
@@ -1950,7 +477,7 @@ function registerSandboxTools(server, options = {}) {
       })
     )
   );
-  registered.push(
+  tools.push(
     server.tool(
       "get_request",
       "Get full details for a request captured by a sandbox endpoint.",
@@ -1961,7 +488,7 @@ function registerSandboxTools(server, options = {}) {
       })
     )
   );
-  registered.push(
+  tools.push(
     server.tool(
       "wait_for_request",
       "Wait for a request to arrive at a sandbox endpoint.",
@@ -1973,7 +500,7 @@ function registerSandboxTools(server, options = {}) {
       })
     )
   );
-  registered.push(
+  tools.push(
     server.tool(
       "generate_payload_schema",
       "Generate TypeScript interfaces, Zod schemas, Pydantic models, or JSON Schema from the bodies of requests captured by a sandbox endpoint. Several requests of one event teach which fields are optional or nullable.",
@@ -1985,91 +512,82 @@ function registerSandboxTools(server, options = {}) {
       })
     )
   );
-  registered.push(
+  tools.push(
     server.tool(
       "connect_account",
       "Connect this agent to a human's webhooks.cc account, for the full tool set (mock responses, signatures, email, teams) and to keep the sandbox endpoints. Returns a link and a 6-digit code: show both to the human, who signs in or signs up with that email and enters the code. Then call wait_for_connection. Calling again gives a new code.",
       {
-        email: z3.string().email({ message: "Invalid email address" }).describe("The human's email address; only someone signed in as it can connect")
+        email: z2.string().email({ message: "Invalid email address" }).describe(
+          "The email the human signs in to webhooks.cc with (their GitHub or Google primary email if they sign in that way); only someone signed in as it can connect"
+        )
       },
       withErrorHandling(async ({ email }) => {
-        if (session.connected) {
-          return jsonContent({ connected: true, message: "Already connected to an account." });
-        }
         const normalized = email.trim().toLowerCase();
+        const previous = session.connect;
         const sandbox = await session.existingSandbox();
-        let claim;
+        let attempt;
+        let movesEndpoints = false;
         if (sandbox) {
-          claim = {
-            kind: "sandbox",
-            claimToken: sandbox.registration.claimToken,
-            email: normalized,
-            attempt: await sandbox.claim({ email: normalized }),
-            claimExpires: sandbox.expiresAt
-          };
-        } else if (session.claim?.kind === "service_auth" && session.claim.email === normalized && session.claim.claimExpires.getTime() > Date.now()) {
-          const attempt = await WebhooksCC2.agent.startClaim({
-            baseUrl,
-            claimToken: session.claim.claimToken
-          });
-          claim = { ...session.claim, attempt };
+          const claim = await sandbox.claim({ email: normalized });
+          session.connect = { via: "sandbox", sandbox, email: normalized, attempt: claim };
+          attempt = claim;
+          movesEndpoints = claim.movesEndpoints;
         } else {
-          const registration = await WebhooksCC2.agent.registerServiceAuth({
-            baseUrl,
-            email: normalized,
-            clientName: session.clientName
-          });
-          claim = {
-            kind: "service_auth",
-            claimToken: registration.claimToken,
+          let pending = null;
+          if (previous?.via === "connect" && previous.email === normalized) {
+            pending = await previous.pending.restart().catch((error) => {
+              if (error instanceof AgentAuthError) return null;
+              throw error;
+            });
+          }
+          pending ?? (pending = await WebhooksCC.connect({
+            baseUrl: session.baseUrl,
+            webhookUrl: session.webhookUrl,
             email: normalized,
-            attempt: registration.claim,
-            claimExpires: registration.claimTokenExpires
-          };
+            clientName: session.clientName,
+            credentialsFile: session.credentialsFile
+          }));
+          session.connect = { via: "connect", pending, email: normalized };
+          attempt = pending;
         }
-        session.claim = claim;
-        const { verificationUri, userCode, expiresAt } = claim.attempt;
+        const { verificationUri, userCode, expiresAt } = attempt;
         return jsonContent({
           verificationUri,
           userCode,
           expiresAt: expiresAt.toISOString(),
           tellTheHuman: `Open ${verificationUri}, sign in or sign up as ${normalized}, and enter the code ${userCode}.`,
           next: `Show the human that line, then call wait_for_connection. The code works for about ${minutesLeft(expiresAt)} minutes; connect_account gives a new one.`,
-          ...claim.kind === "sandbox" ? { endpoints: "The sandbox endpoints move into that account with what they captured." } : {}
+          ...sandbox ? {
+            endpoints: movesEndpoints ? "The sandbox endpoints move into that account with what they captured." : "The sandbox endpoints were made in an earlier session, so they stay in the sandbox until it expires; the account starts without them."
+          } : {}
         });
       })
     )
   );
-  registered.push(
+  tools.push(
     server.tool(
       "wait_for_connection",
       `Wait for the human to enter the code from connect_account. On success the full webhooks.cc tools for their account replace these sandbox tools. Returns after timeoutSeconds (default ${DEFAULT_WAIT_SECONDS}) if they have not finished yet; call it again to keep waiting.`,
       {
-        timeoutSeconds: z3.number().int().min(1).max(MAX_WAIT_SECONDS).optional().describe(`How long to wait, in seconds (default ${DEFAULT_WAIT_SECONDS})`)
+        timeoutSeconds: z2.number().int().min(1).max(MAX_WAIT_SECONDS).optional().describe(`How long to wait, in seconds (default ${DEFAULT_WAIT_SECONDS})`)
       },
       withErrorHandling(async ({ timeoutSeconds }) => {
-        if (session.connected) {
-          return jsonContent({ connected: true, message: "Already connected to an account." });
-        }
-        const claim = session.claim;
-        if (!claim) {
+        const pending = session.connect;
+        if (!pending) {
           throw new Error("Nothing to wait for: call connect_account first.");
         }
-        let claimed;
+        const timeout = (timeoutSeconds ?? DEFAULT_WAIT_SECONDS) * 1e3;
+        const expiresAt = pending.via === "sandbox" ? pending.attempt.expiresAt : pending.pending.expiresAt;
+        let client;
         try {
-          claimed = await WebhooksCC2.agent.waitForClaim({
-            baseUrl,
-            claimToken: claim.claimToken,
-            interval: claim.attempt.interval,
-            timeout: (timeoutSeconds ?? DEFAULT_WAIT_SECONDS) * 1e3
-          });
+          client = pending.via === "sandbox" ? await pending.sandbox.waitForClaim({ timeout }) : await pending.pending.wait({ timeout });
         } catch (error) {
           if (!(error instanceof AgentAuthError)) throw error;
           if (error.code === "timeout") {
             return jsonContent({
               connected: false,
               status: "waiting",
-              message: `Not connected yet. The code works until ${claim.attempt.expiresAt.toISOString()}; call wait_for_connection again.`
+              message: `Not connected yet. The code works until ${expiresAt.toISOString()}; call wait_for_connection again.`
             });
           }
           if (error.code === "expired_token") {
@@ -2088,34 +606,25 @@ function registerSandboxTools(server, options = {}) {
           }
           throw error;
         }
-        const client = new WebhooksCC2({
-          baseUrl,
-          webhookUrl: session.webhookUrl,
-          getAccessToken: claimedTokens(baseUrl, claimed.identityAssertion, claimed.token)
-        });
-        session.connected = true;
-        session.claim = null;
-        session.forgetSandbox();
-        for (const tool of registered) tool.remove();
-        registerTools(server, client);
-        options.onConnected?.(client);
+        const movedEndpoints = pending.via === "sandbox" && pending.attempt.movesEndpoints;
+        session.reset();
+        showAccount(client);
         return jsonContent({
           connected: true,
-          email: claim.email,
-          scope: claimed.token.scope,
-          message: `Connected to the webhooks.cc account of ${claim.email}. The full tool set has replaced the sandbox tools (the tool list changed; if your client does not pick that up, ask the user to restart it).${claim.kind === "sandbox" ? " The sandbox endpoints are now that account's endpoints, with what they captured." : ""} This connection lasts while this MCP server runs; for a lasting setup, the human can create an API key under Account and set WHK_API_KEY.`
+          email: pending.email,
+          message: `Connected to the webhooks.cc account of ${pending.email}. The full tool set has replaced the sandbox tools (the tool list changed; if your client does not pick that up, ask the user to restart it).${movedEndpoints ? " The sandbox endpoints are now that account's endpoints, with what they captured." : ""} ${file ? `The connection is saved in ${file}, so later sessions, the whk CLI and the SDKs start connected; it lasts 90 days, and the human can remove it under Account, Connected agents.` : "This connection lasts while this MCP server runs; for a lasting setup, the human can create an API key under Account and set WHK_API_KEY."}`
         });
       })
     )
   );
-  registered.push(
+  tools.push(
     server.tool(
       "about_sandbox",
       "Explain what this agent can do without a webhooks.cc account, the sandbox limits, and how to connect an account. No network call.",
       {},
       withErrorHandling(async () => {
         return jsonContent({
-          mode: "sandbox (no WHK_API_KEY)",
+          mode: "sandbox (no WHK_API_KEY, no saved connection)",
           sandbox: {
             maxEndpoints: SANDBOX.maxEndpoints,
             requestsPerEndpoint: SANDBOX.requestsPerEndpoint,
@@ -2126,24 +635,26 @@ function registerSandboxTools(server, options = {}) {
             notAvailable: "Mock responses, response rules, notifications, signature verification, email capture, forwarding, teams and sending webhooks."
           },
           connectAnAccount: [
-            "Call connect_account with the human's email and show them the link and code it returns.",
+            "Call connect_account with the email the human signs in to webhooks.cc with, and show them the link and code it returns.",
             "Call wait_for_connection until it reports connected; the full tools for their account then replace the sandbox tools.",
-            "Sandbox endpoints move into the account with their captured requests."
+            "Sandbox endpoints registered by this server process move into the account with their captured requests; a sandbox resumed from an earlier session stays in the sandbox (connect_account says which)."
           ],
+          savedIn: file ? `${file} (shared with the whk CLI and the SDKs): the sandbox and the connection survive restarts.` : "nowhere: this session only.",
           withAnApiKey: "Set WHK_API_KEY to a whcc_ key from the dashboard and restart for the full tools from the start.",
           docs: DOCS_URL,
-          protocol: `${baseUrl}/auth.md`
+          protocol: `${session.baseUrl}/auth.md`
         });
       })
     )
   );
+  return tools;
 }
 function registerAgentRegistrationTools(server) {
   registerSandboxTools(server);
 }
 
 // src/index.ts
-var VERSION = true ? "1.13.0" : "0.0.0-dev";
+var VERSION = true ? "1.15.0" : "0.0.0-dev";
 function createServer(options = {}) {
   const apiKey = options.apiKey ?? process.env.WHK_API_KEY;
   const webhookUrl = options.webhookUrl ?? process.env.WHK_WEBHOOK_URL;
@@ -2154,17 +665,18 @@ function createServer(options = {}) {
     { debouncedNotificationMethods: ["notifications/tools/list_changed"] }
   );
   if (!apiKey) {
-    registerSandboxTools(server, { baseUrl, webhookUrl });
+    registerSandboxTools(server, { baseUrl, webhookUrl, credentialsFile: options.credentialsFile });
     registerPrompts(server);
     return server;
   }
-  const client = new WebhooksCC3({ apiKey, webhookUrl, baseUrl });
+  const client = new WebhooksCC2({ apiKey, webhookUrl, baseUrl });
   registerTools(server, client);
   registerPrompts(server);
   registerResources(server, client);
   return server;
 }
 export {
+  REMOTE_MAX_WAIT_MS,
   createServer,
   registerAgentRegistrationTools,
   registerPrompts,