@webhooks-cc/mcp 1.24.0 → 2.0.0

package/dist/index.js

@@ -20,131 +20,240 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var src_exports = {};
 __export(src_exports, {
+  ENABLE_TOOLS: () => ENABLE_TOOLS,
+  LocalToolGroups: () => LocalToolGroups,
   REMOTE_MAX_WAIT_MS: () => REMOTE_MAX_WAIT_MS,
+  TOOL_CATALOG: () => TOOL_CATALOG,
+  TOOL_GROUPS: () => TOOL_GROUPS,
+  TOOL_GROUP_NAMES: () => TOOL_GROUP_NAMES,
+  asToolServer: () => asToolServer,
+  clientLoadsEverything: () => clientLoadsEverything,
   createServer: () => createServer,
+  defaultToolGroups: () => defaultToolGroups,
+  localToolGroups: () => localToolGroups,
+  parseToolGroups: () => parseToolGroups,
   registerAgentRegistrationTools: () => registerAgentRegistrationTools,
   registerPrompts: () => registerPrompts,
   registerResources: () => registerResources,
   registerSandboxTools: () => registerSandboxTools,
-  registerTools: () => registerTools
+  registerTools: () => registerTools,
+  toolAnnotations: () => toolAnnotations,
+  toolSelection: () => toolSelection
 });
 module.exports = __toCommonJS(src_exports);
-var import_mcp2 = require("@modelcontextprotocol/sdk/server/mcp.js");
+var import_server3 = require("@modelcontextprotocol/server");
 var import_sdk3 = require("@webhooks-cc/sdk");
 
-// src/prompts.ts
-var import_zod = require("zod");
-function registerPrompts(server) {
-  server.registerPrompt(
-    "debug_webhook_delivery",
-    {
-      title: "Debug Webhook Delivery",
-      description: "Guide an agent through diagnosing why webhook delivery is failing or missing.",
-      argsSchema: {
-        provider: import_zod.z.string().optional().describe("Webhook provider, if known"),
-        endpointSlug: import_zod.z.string().optional().describe("Hosted endpoint slug, if known"),
-        targetUrl: import_zod.z.string().optional().describe("Your app's receiving URL, if known")
-      }
-    },
-    async ({ provider, endpointSlug, targetUrl }) => {
-      const scope = [
-        provider ? `Provider: ${provider}.` : null,
-        endpointSlug ? `Endpoint slug: ${endpointSlug}.` : null,
-        targetUrl ? `Target URL: ${targetUrl}.` : null
-      ].filter(Boolean).join(" ");
-      return {
-        description: "Diagnose a missing or broken webhook delivery.",
-        messages: [
-          {
-            role: "user",
-            content: {
-              type: "text",
-              text: [
-                scope,
-                "Diagnose webhook delivery step by step.",
-                "Use list_endpoints or get_endpoint to confirm the endpoint and URL.",
-                "Use list_requests, wait_for_request, or wait_for_requests to check whether anything arrived.",
-                "If the provider is known, use preview_webhook or send_webhook to reproduce the webhook with realistic signing.",
-                "Use verify_signature when a secret is available.",
-                "Use compare_requests to compare retries or changed payloads.",
-                "Conclude with the most likely cause and the next concrete fix."
-              ].filter(Boolean).join(" ")
-            }
-          }
-        ]
-      };
-    }
-  );
-  server.registerPrompt(
-    "setup_provider_testing",
-    {
-      title: "Setup Provider Testing",
-      description: "Guide an agent through setting up webhook testing for a provider.",
-      argsSchema: {
-        provider: import_zod.z.string().describe("Webhook provider to test"),
-        targetUrl: import_zod.z.string().optional().describe("Optional local or remote target URL")
-      }
-    },
-    async ({ provider, targetUrl }) => {
-      return {
-        description: `Set up webhook testing for ${provider}.`,
-        messages: [
-          {
-            role: "user",
-            content: {
-              type: "text",
-              text: [
-                `Set up webhook testing for ${provider}.`,
-                "Use list_provider_templates to inspect supported templates and signing details first.",
-                "Create an endpoint with create_endpoint, preferably ephemeral.",
-                "If a target URL is provided, use preview_webhook before send_to so the request shape is visible.",
-                targetUrl ? `Target URL: ${targetUrl}.` : null,
-                "Send a realistic provider webhook, wait for capture, and verify the signature if a secret is available.",
-                "Once real deliveries are captured, use generate_payload_schema to write the payload types for the handler.",
-                "Return the endpoint URL, the exact tools used, and the next step for the developer."
-              ].filter(Boolean).join(" ")
-            }
-          }
-        ]
-      };
-    }
-  );
-  server.registerPrompt(
-    "compare_webhook_attempts",
-    {
-      title: "Compare Webhook Attempts",
-      description: "Guide an agent through comparing two webhook deliveries or retries.",
-      argsSchema: {
-        endpointSlug: import_zod.z.string().optional().describe("Endpoint slug to inspect for recent attempts"),
-        leftRequestId: import_zod.z.string().optional().describe("First request ID, if already known"),
-        rightRequestId: import_zod.z.string().optional().describe("Second request ID, if already known")
-      }
-    },
-    async ({ endpointSlug, leftRequestId, rightRequestId }) => {
-      return {
-        description: "Compare two webhook deliveries and explain the difference.",
-        messages: [
-          {
-            role: "user",
-            content: {
-              type: "text",
-              text: [
-                endpointSlug ? `Endpoint slug: ${endpointSlug}.` : null,
-                leftRequestId && rightRequestId ? `Compare request ${leftRequestId} against ${rightRequestId}.` : "Find the most relevant two webhook attempts first.",
-                "Use compare_requests for the structured diff.",
-                "If request IDs are not provided, use list_requests or the endpoint recent resource to find the last two attempts.",
-                "Explain what changed in the body, headers, or timing, and whether the difference looks expected, retried, or broken."
-              ].filter(Boolean).join(" ")
-            }
-          }
-        ]
-      };
+// src/local-tools.ts
+var import_server = require("@modelcontextprotocol/server");
+var import_zod2 = require("zod");
+
+// src/catalog.ts
+var TOOL_GROUPS = {
+  core: "Endpoints, captured requests and emails, sending test webhooks, signatures, forwarding destinations, deliveries, previews of your local app and their logs, usage and approvals",
+  forwarding: "The rest of forwarding: preview what a destination would send, the endpoint's forwarding settings and signing secret, test deliveries",
+  layouts: "Email layouts and named fields: try layouts and fields on a captured email, add ready-made layouts, and AI setup",
+  extras: "Bulk endpoint changes, favourites, request counts and payload schemas",
+  teams: "Teams: members, invites, sharing endpoints with a team, and pricing team changes",
+  account: "The account: billing, API keys, connected agents, public share links to requests, and the display name",
+  domains: "Custom inbound email domains: add, verify, route and remove them",
+  sheets: "Google Sheets destinations: Google accounts, spreadsheets and their tabs",
+  names: "Preview names: reserve, release and password-protect them"
+};
+var TOOL_GROUP_NAMES = Object.keys(TOOL_GROUPS);
+var read = { readOnly: true };
+var write = {};
+var update = { idempotent: true };
+var remove = { destructive: true, idempotent: true };
+var replace = { destructive: true, idempotent: true };
+var outward = { openWorld: true };
+function group(name, tools) {
+  return Object.fromEntries(
+    Object.entries(tools).map(([tool, behaviour]) => [tool, { group: name, ...behaviour }])
+  );
+}
+var TOOL_CATALOG = {
+  ...group("core", {
+    create_endpoint: write,
+    list_endpoints: read,
+    get_endpoint: read,
+    // Replaces what it is given (a mock response, the signing secret).
+    update_endpoint: replace,
+    delete_endpoint: remove,
+    list_requests: read,
+    search_requests: read,
+    get_request: read,
+    wait_for_request: read,
+    wait_for_requests: read,
+    replay_request: outward,
+    compare_requests: read,
+    extract_from_request: read,
+    clear_requests: remove,
+    send_webhook: write,
+    send_to: outward,
+    test_webhook_flow: outward,
+    preview_webhook: read,
+    preview_response: read,
+    list_provider_templates: read,
+    verify_signature: read,
+    list_emails: read,
+    get_email: read,
+    wait_for_email: read,
+    send_test_email: write,
+    render_email: outward,
+    list_destinations: read,
+    add_destination: write,
+    update_destination: replace,
+    remove_destination: remove,
+    list_deliveries: read,
+    redeliver: outward,
+    share_port: outward,
+    list_shares: read,
+    share_requests: read,
+    stop_share: remove,
+    get_usage: read,
+    // Collecting an approved key hands it over once: not a pure read.
+    wait_for_approval: write,
+    describe: read
+  }),
+  ...group("forwarding", {
+    preview_destination: read,
+    configure_forwarding: replace,
+    // rotate: true replaces the secret, and receivers holding the old one fail.
+    get_forwarding_secret: { destructive: true },
+    test_forwarding: outward
+  }),
+  ...group("layouts", {
+    preview_layouts: read,
+    list_layout_templates: read,
+    add_layout_template: write,
+    preview_email_fields: read,
+    ai_setup_status: read,
+    // Sends the chosen emails to Anthropic once the owner approves.
+    ai_setup: outward
+  }),
+  ...group("extras", {
+    create_endpoints: write,
+    delete_endpoints: remove,
+    favorite_endpoint: update,
+    count_requests: read,
+    generate_payload_schema: read
+  }),
+  ...group("teams", {
+    list_teams: read,
+    list_team_members: read,
+    share_endpoint: update,
+    unshare_endpoint: remove,
+    create_team: write,
+    rename_team: update,
+    delete_team: remove,
+    remove_team_member: remove,
+    leave_team: remove,
+    invite_to_team: outward,
+    list_invites: read,
+    answer_invite: write,
+    withdraw_invite: remove,
+    quote_team_change: read
+  }),
+  ...group("account", {
+    get_billing: read,
+    list_api_keys: read,
+    create_api_key: write,
+    revoke_api_key: remove,
+    rename_account: update,
+    list_connected_agents: read,
+    disconnect_agent: remove,
+    list_share_links: read,
+    create_share_link: write,
+    revoke_share_link: remove
+  }),
+  ...group("domains", {
+    list_domains: read,
+    add_domain: write,
+    // A failed check counts toward lapsing a verified domain: not safe to repeat.
+    verify_domain: { destructive: true },
+    // Replaces the routing; a missing catch-all refuses mail.
+    route_domain: replace,
+    remove_domain: remove
+  }),
+  ...group("sheets", {
+    list_google_connections: read,
+    connect_google: outward,
+    pick_spreadsheet: outward,
+    create_spreadsheet: outward,
+    list_sheet_tabs: { readOnly: true, openWorld: true },
+    disconnect_google: remove
+  }),
+  ...group("names", {
+    // The log of what visitors asked a running preview for.
+    list_names: read,
+    reserve_name: write,
+    release_name: remove,
+    set_name_password: update,
+    // Opens the name to anyone again.
+    clear_name_password: { destructive: true, idempotent: true }
+  })
+};
+var ENABLE_TOOLS = "enable_tools";
+function toolAnnotations(name) {
+  const entry = TOOL_CATALOG[name];
+  const readOnly = entry?.readOnly === true;
+  return {
+    title: toolTitle(name),
+    readOnlyHint: readOnly,
+    // MCP reads a missing destructiveHint as true on any tool that writes.
+    destructiveHint: !readOnly && entry?.destructive === true,
+    idempotentHint: readOnly || entry?.idempotent === true,
+    openWorldHint: entry?.openWorld === true
+  };
+}
+function toolTitle(name) {
+  const words = name.split("_").map((word) => TITLE_WORDS[word] ?? word);
+  const first = words[0] ?? "";
+  return [first.charAt(0).toUpperCase() + first.slice(1), ...words.slice(1)].join(" ");
+}
+var TITLE_WORDS = {
+  api: "API",
+  ai: "AI",
+  mcp: "MCP"
+};
+function parseToolGroups(setting) {
+  if (setting === null || setting === void 0 || setting.trim() === "") return null;
+  const groups = /* @__PURE__ */ new Set(["core"]);
+  const unknown = [];
+  for (const raw of setting.split(/[\s,+]+/)) {
+    const name = raw.trim().toLowerCase();
+    if (!name) continue;
+    if (name === "all") {
+      for (const g of TOOL_GROUP_NAMES) groups.add(g);
+    } else if (TOOL_GROUP_NAMES.includes(name)) {
+      groups.add(name);
+    } else {
+      unknown.push(raw.trim());
     }
-  );
+  }
+  return { groups, unknown };
+}
+var LOADS_EVERYTHING = [
+  /^claude-code$/i,
+  /^claude-ai$/i,
+  /^claude$/i,
+  /codex/i,
+  /^openai-mcp$/i,
+  /chatgpt/i
+];
+function clientLoadsEverything(clientName) {
+  if (!clientName) return false;
+  const name = clientName.trim().toLowerCase().replace(/[\s_]+/g, "-");
+  return LOADS_EVERYTHING.some((pattern) => pattern.test(name));
+}
+function defaultToolGroups(clientName) {
+  return clientLoadsEverything(clientName) ? new Set(TOOL_GROUP_NAMES) : /* @__PURE__ */ new Set(["core"]);
 }
 
-// src/resources.ts
-var import_mcp = require("@modelcontextprotocol/sdk/server/mcp.js");
+// src/tools.ts
+var import_zod = require("zod");
+var import_sdk = require("@webhooks-cc/sdk");
 
 // src/compact.ts
 var MAX_OUTPUT = 32768;
@@ -354,142 +463,11 @@ function compactRequest(request) {
   return compact;
 }
 
-// src/resources.ts
-var ENDPOINTS_RESOURCE_URI = "webhooks://endpoints";
-var ENDPOINT_RECENT_TEMPLATE_URI = "webhooks://endpoint/{slug}/recent";
-var REQUEST_TEMPLATE_URI = "webhooks://request/{id}";
-var MAX_ENDPOINT_RESOURCE_ITEMS = 25;
-var RECENT_REQUEST_LIMIT = 10;
-function jsonResource(uri, value) {
-  return {
-    contents: [
-      {
-        uri,
-        mimeType: "application/json",
-        text: JSON.stringify(value, null, 2)
-      }
-    ]
-  };
-}
-function summarizeRequest(request) {
-  return {
-    id: request.id,
-    method: request.method,
-    path: request.path,
-    receivedAt: request.receivedAt,
-    contentType: request.contentType ?? null
-  };
-}
-function variableToString(value, name) {
-  if (typeof value === "string" && value.length > 0) {
-    return value;
-  }
-  throw new Error(`Missing resource variable "${name}"`);
-}
-async function listEndpointSummaries(client) {
-  const endpoints = (await client.endpoints.list()).slice().sort((left, right) => right.createdAt - left.createdAt);
-  const truncated = endpoints.length > MAX_ENDPOINT_RESOURCE_ITEMS;
-  const visible = endpoints.slice(0, MAX_ENDPOINT_RESOURCE_ITEMS);
-  const summaries = await Promise.all(
-    visible.map(async (endpoint) => {
-      const recent = await client.requests.list(endpoint.slug, { limit: 1 });
-      return {
-        ...endpoint,
-        lastRequest: recent[0] ? summarizeRequest(recent[0]) : null
-      };
-    })
-  );
-  return {
-    endpoints: summaries,
-    total: endpoints.length,
-    truncated
-  };
-}
-function registerResources(server, client) {
-  server.registerResource(
-    "endpoints-overview",
-    ENDPOINTS_RESOURCE_URI,
-    {
-      title: "Endpoints Overview",
-      description: "All endpoints with a summary of recent activity.",
-      mimeType: "application/json"
-    },
-    async () => {
-      return jsonResource(ENDPOINTS_RESOURCE_URI, await listEndpointSummaries(client));
-    }
-  );
-  server.registerResource(
-    "endpoint-recent-requests",
-    new import_mcp.ResourceTemplate(ENDPOINT_RECENT_TEMPLATE_URI, {
-      list: async () => {
-        const endpoints = await client.endpoints.list();
-        return {
-          resources: endpoints.map((endpoint) => ({
-            uri: `webhooks://endpoint/${endpoint.slug}/recent`,
-            name: `${endpoint.slug} recent requests`,
-            description: `Recent requests for endpoint ${endpoint.slug}`,
-            mimeType: "application/json"
-          }))
-        };
-      },
-      complete: {
-        slug: async (value) => {
-          const endpoints = await client.endpoints.list();
-          return endpoints.map((endpoint) => endpoint.slug).filter((slug) => slug.startsWith(value)).slice(0, 20);
-        }
-      }
-    }),
-    {
-      title: "Endpoint Recent Requests",
-      description: "Last 10 captured requests for an endpoint.",
-      mimeType: "application/json"
-    },
-    async (uri, variables) => {
-      const slug = variableToString(variables.slug, "slug");
-      const [endpoint, requests] = await Promise.all([
-        client.endpoints.get(slug),
-        client.requests.list(slug, { limit: RECENT_REQUEST_LIMIT })
-      ]);
-      return jsonResource(uri.toString(), {
-        endpoint,
-        requests: requests.map(compactRequest)
-      });
-    }
-  );
-  server.registerResource(
-    "request-details",
-    new import_mcp.ResourceTemplate(REQUEST_TEMPLATE_URI, {
-      list: void 0,
-      complete: {}
-    }),
-    {
-      title: "Request Details",
-      description: "Full details for a captured request by ID.",
-      mimeType: "application/json"
-    },
-    async (uri, variables) => {
-      const id = variableToString(variables.id, "id");
-      const request = await client.requests.get(id);
-      return jsonResource(uri.toString(), compactRequest(request));
-    }
-  );
-}
-
-// src/sandbox-tools.ts
-var import_zod3 = require("zod");
-var import_sdk2 = require("@webhooks-cc/sdk");
-
-// src/version.ts
-var VERSION = true ? "1.24.0" : "0.0.0-dev";
-var MCP_USER_AGENT = `webhooks-cc-mcp/${VERSION}`;
-
 // src/tools.ts
-var import_zod2 = require("zod");
-var import_sdk = require("@webhooks-cc/sdk");
 var MAX_BODY_SIZE = MAX_OUTPUT;
 var HTTP_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"];
 var TIME_SEPARATOR = " \u2014 ";
-var httpUrlSchema = import_zod2.z.string().url().refine(
+var httpUrlSchema = import_zod.z.string().url().refine(
   (value) => {
     try {
       const protocol = new URL(value).protocol;
@@ -500,24 +478,24 @@ var httpUrlSchema = import_zod2.z.string().url().refine(
   },
   { message: "Only http and https URLs are supported" }
 );
-var methodSchema = import_zod2.z.enum(HTTP_METHODS).default("POST").describe("HTTP method (default: POST)");
-var kindSchema = import_zod2.z.enum(["http", "email"]).optional().describe('Only HTTP requests ("http") or only captured emails ("email")');
+var methodSchema = import_zod.z.enum(HTTP_METHODS).default("POST").describe("HTTP method (default: POST)");
+var kindSchema = import_zod.z.enum(["http", "email"]).optional().describe('Only HTTP requests ("http") or only captured emails ("email")');
 var EMAIL_SCAN_LIMIT = 100;
-var durationOrTimestampSchema = import_zod2.z.union([import_zod2.z.string(), import_zod2.z.number()]);
+var durationOrTimestampSchema = import_zod.z.union([import_zod.z.string(), import_zod.z.number()]);
 var CONDITION_FIELD_NAMES = Object.keys(import_sdk.CONDITION_FIELDS);
 var CONDITION_OP_NAMES = import_sdk.CONDITION_OPS;
 function conditionSchema(use) {
   const fields = use === "response" ? CONDITION_FIELD_NAMES.filter((field) => import_sdk.CONDITION_FIELDS[field].response) : CONDITION_FIELD_NAMES;
-  return import_zod2.z.object({
-    field: import_zod2.z.enum(fields).describe(
+  return import_zod.z.object({
+    field: import_zod.z.enum(fields).describe(
       use === "response" ? "What to read: method, path, header (name), query (name), body (text), body_path (path into a JSON or form body), content_type, size" : "What to read: method, path, header (name), query (name), body, body_path (path), content_type, size, kind (http or email), email (name: subject, from, to, text or tag), spam_score, email_auth (name: spf, dkim or dmarc), signature (verified, failed or missing)"
     ),
-    op: import_zod2.z.enum(CONDITION_OP_NAMES).describe(
+    op: import_zod.z.enum(CONDITION_OP_NAMES).describe(
       "eq, neq, contains, not_contains, starts_with, ends_with, matches (glob: * one path segment, ** any, ? one character), regex (RE2, searched anywhere; (?i) ignores case), exists, not_exists, gt, gte, lt, lte (numbers)"
     ),
-    value: import_zod2.z.string().max(import_sdk.MAX_CONDITION_VALUE_LEN).optional().describe(`What to compare with (not for exists and not_exists)`),
-    name: import_zod2.z.string().max(import_sdk.MAX_CONDITION_NAME_LEN).optional().describe("Header or query parameter name; the email part; spf, dkim or dmarc"),
-    path: import_zod2.z.string().max(import_sdk.MAX_CONDITION_PATH_LEN).optional().describe('Dot path for body_path, e.g. data.object.status or items.0.sku or a["odd.key"]')
+    value: import_zod.z.string().max(import_sdk.MAX_CONDITION_VALUE_LEN).optional().describe(`What to compare with (not for exists and not_exists)`),
+    name: import_zod.z.string().max(import_sdk.MAX_CONDITION_NAME_LEN).optional().describe("Header or query parameter name; the email part; spf, dkim or dmarc"),
+    path: import_zod.z.string().max(import_sdk.MAX_CONDITION_PATH_LEN).optional().describe('Dot path for body_path, e.g. data.object.status or items.0.sku or a["odd.key"]')
   }).superRefine((condition, ctx) => {
     for (const issue of (0, import_sdk.conditionIssues)(condition, { use })) {
       ctx.addIssue({ code: "custom", message: issue });
@@ -525,46 +503,46 @@ function conditionSchema(use) {
   });
 }
 var ruleConditionSchema = conditionSchema("response");
-var emailFieldSchema = import_zod2.z.object({
-  name: import_zod2.z.string().describe("Letters, digits and _, starting with a letter: {{ fields.name }}"),
-  from: import_zod2.z.enum(["subject", "text", "html", "from", "to", "header"]).describe("What it reads; html is the HTML as text"),
-  header: import_zod2.z.string().optional().describe('The header name, for from "header"'),
-  pattern: import_zod2.z.string().describe("RE2 regular expression; the first group is the value (no lookarounds)")
+var emailFieldSchema = import_zod.z.object({
+  name: import_zod.z.string().describe("Letters, digits and _, starting with a letter: {{ fields.name }}"),
+  from: import_zod.z.enum(["subject", "text", "html", "from", "to", "header"]).describe("What it reads; html is the HTML as text"),
+  header: import_zod.z.string().optional().describe('The header name, for from "header"'),
+  pattern: import_zod.z.string().describe("RE2 regular expression; the first group is the value (no lookarounds)")
 });
-var layoutSchema = import_zod2.z.object({
-  id: import_zod2.z.string().describe("Stable id: 1 to 40 letters, digits, - or _"),
-  name: import_zod2.z.string().max(100),
-  enabled: import_zod2.z.boolean().optional().describe("Off: kept but never matched (default on)"),
-  match: import_zod2.z.object({
-    logic: import_zod2.z.enum(["and", "or"]).optional(),
-    conditions: import_zod2.z.array(conditionSchema("filter")).max(10)
+var layoutSchema = import_zod.z.object({
+  id: import_zod.z.string().describe("Stable id: 1 to 40 letters, digits, - or _"),
+  name: import_zod.z.string().max(100),
+  enabled: import_zod.z.boolean().optional().describe("Off: kept but never matched (default on)"),
+  match: import_zod.z.object({
+    logic: import_zod.z.enum(["and", "or"]).optional(),
+    conditions: import_zod.z.array(conditionSchema("filter")).max(10)
   }).optional().describe("When it applies, e.g. the sender or subject; no conditions: every email"),
-  fields: import_zod2.z.array(emailFieldSchema).max(20).optional().describe("Named values, as emailFields"),
-  lineItems: import_zod2.z.object({
-    from: import_zod2.z.enum(["text", "html", "attachment"]),
-    pattern: import_zod2.z.string().optional().describe(
+  fields: import_zod.z.array(emailFieldSchema).max(20).optional().describe("Named values, as emailFields"),
+  lineItems: import_zod.z.object({
+    from: import_zod.z.enum(["text", "html", "attachment"]),
+    pattern: import_zod.z.string().optional().describe(
       "text/html: RE2 with named groups found again and again, one row each, e.g. (?P<sku>[A-Z]+-\\d+)\\s+x(?P<qty>\\d+)"
     ),
-    start: import_zod2.z.string().optional().describe("text/html: search only after this (RE2)"),
-    end: import_zod2.z.string().optional().describe("text/html: and before this (RE2)"),
-    attachment: import_zod2.z.string().optional().describe("attachment: file name with * and ? (default: the first spreadsheet or CSV)"),
-    sheet: import_zod2.z.string().optional().describe("attachment: sheet name (default: the first)"),
-    columns: import_zod2.z.array(import_zod2.z.object({ name: import_zod2.z.string(), column: import_zod2.z.string() })).max(30).optional().describe("attachment: { name, column: header text or letter }; default: every column")
+    start: import_zod.z.string().optional().describe("text/html: search only after this (RE2)"),
+    end: import_zod.z.string().optional().describe("text/html: and before this (RE2)"),
+    attachment: import_zod.z.string().optional().describe("attachment: file name with * and ? (default: the first spreadsheet or CSV)"),
+    sheet: import_zod.z.string().optional().describe("attachment: sheet name (default: the first)"),
+    columns: import_zod.z.array(import_zod.z.object({ name: import_zod.z.string(), column: import_zod.z.string() })).max(30).optional().describe("attachment: { name, column: header text or letter }; default: every column")
   }).nullable().optional().describe("Rows such as an order's products"),
-  parseAttachments: import_zod2.z.boolean().optional().describe("Parse CSV, XLSX, ODS, PDF text and text files into the JSON; uses parsed pages")
+  parseAttachments: import_zod.z.boolean().optional().describe("Parse CSV, XLSX, ODS, PDF text and text files into the JSON; uses parsed pages")
 });
 var destinationFields = {
-  name: import_zod2.z.string().max(100).nullable().optional().describe("A name for the list and the log"),
-  enabled: import_zod2.z.boolean().optional().describe("Send to it (default true)"),
-  http: import_zod2.z.boolean().optional().describe("Takes HTTP requests (default true)"),
-  email: import_zod2.z.boolean().optional().describe("Takes emails (default true)"),
-  filter: import_zod2.z.object({
-    logic: import_zod2.z.enum(["and", "or"]).optional().describe("and (default): every condition; or: any"),
-    conditions: import_zod2.z.array(conditionSchema("filter")).max(10)
+  name: import_zod.z.string().max(100).nullable().optional().describe("A name for the list and the log"),
+  enabled: import_zod.z.boolean().optional().describe("Send to it (default true)"),
+  http: import_zod.z.boolean().optional().describe("Takes HTTP requests (default true)"),
+  email: import_zod.z.boolean().optional().describe("Takes emails (default true)"),
+  filter: import_zod.z.object({
+    logic: import_zod.z.enum(["and", "or"]).optional().describe("and (default): every condition; or: any"),
+    conditions: import_zod.z.array(conditionSchema("filter")).max(10)
   }).nullable().optional().describe(
     "Send only captures that match (null: everything it takes). Conditions like response rules plus kind, email (name: subject, from, to, text, tag), spam_score, email_auth (name: spf, dkim, dmarc) and signature (verified, failed, missing)"
   ),
-  format: import_zod2.z.enum([
+  format: import_zod.z.enum([
     "auto",
     "as_received",
     "json",
@@ -577,103 +555,103 @@ var destinationFields = {
   ]).optional().describe(
     "auto (pick from the URL), as_received (relay HTTP requests unchanged; emails as signed JSON), json (signed JSON envelope), template (your bodyTemplate, signed like json), chat (Slack or Discord message), or an inbound mail provider's shape for emails (postmark, sendgrid, mailgun, cloudmailin; HTTP requests then go as received), to test the inbound handler you wrote for that provider"
   ),
-  mailgunSigningKey: import_zod2.z.string().max(200).nullable().optional().describe(
+  mailgunSigningKey: import_zod.z.string().max(200).nullable().optional().describe(
     "For format mailgun: your Mailgun HTTP webhook signing key, so the form's signature verifies; null removes it. Write-only."
   ),
-  bodyTemplate: import_zod2.z.unknown().optional().describe(
+  bodyTemplate: import_zod.z.unknown().optional().describe(
     `For format template: any JSON value whose strings hold {{ placeholders }}, e.g. {"event": "{{ json.type }}", "amount": "{{ json.data.amount }}", "code": "{{ codes.0 }}"}. A string that is only a placeholder keeps the value's type; a missing field becomes null. HTTP requests read method, path, query.x, headers.x, body, json.path, id, receivedAt, signature; emails read the email.received fields (subject, from.address, to, text, codes, links, auth, spam, tag)`
   ),
-  messageTemplate: import_zod2.z.string().max(4e3).nullable().optional().describe(
+  messageTemplate: import_zod.z.string().max(4e3).nullable().optional().describe(
     "For format chat: the message text with {{ placeholders }}; null sends the standard message"
   ),
-  headers: import_zod2.z.array(
-    import_zod2.z.object({
-      name: import_zod2.z.string().describe("Header name, e.g. Authorization"),
-      value: import_zod2.z.string().nullable().describe("Value, or null to keep the stored one")
+  headers: import_zod.z.array(
+    import_zod.z.object({
+      name: import_zod.z.string().describe("Header name, e.g. Authorization"),
+      value: import_zod.z.string().nullable().describe("Value, or null to keep the stored one")
     })
   ).max(10).optional().describe("Your own headers for every delivery (not chat). Replaces the whole list"),
-  appendPath: import_zod2.z.boolean().optional().describe("Append the captured path to the URL (as_received)"),
-  retrySeconds: import_zod2.z.union([import_zod2.z.literal(0), import_zod2.z.literal(3600), import_zod2.z.literal(86400)]).optional().describe("Retry failed deliveries for 86400 (default), 3600 or 0 seconds"),
-  keepOrder: import_zod2.z.boolean().optional().describe("One delivery at a time, in capture order"),
-  sentField: import_zod2.z.string().max(128).nullable().optional().describe("JSON body field with the sender's own timestamp"),
-  throttleSeconds: import_zod2.z.number().int().min(0).max(3600).optional().describe(
+  appendPath: import_zod.z.boolean().optional().describe("Append the captured path to the URL (as_received)"),
+  retrySeconds: import_zod.z.union([import_zod.z.literal(0), import_zod.z.literal(3600), import_zod.z.literal(86400)]).optional().describe("Retry failed deliveries for 86400 (default), 3600 or 0 seconds"),
+  keepOrder: import_zod.z.boolean().optional().describe("One delivery at a time, in capture order"),
+  sentField: import_zod.z.string().max(128).nullable().optional().describe("JSON body field with the sender's own timestamp"),
+  throttleSeconds: import_zod.z.number().int().min(0).max(3600).optional().describe(
     "At most one delivery every N seconds; the rest are not sent (1 makes a heads-up channel)"
   ),
-  delaySeconds: import_zod2.z.number().int().min(0).max(3600).optional().describe("Wait this long after the capture before sending, like a callback")
+  delaySeconds: import_zod.z.number().int().min(0).max(3600).optional().describe("Wait this long after the capture before sending, like a callback")
 };
-var responseRuleSchema = import_zod2.z.object({
-  name: import_zod2.z.string().max(import_sdk.MAX_RULE_NAME_LEN).optional().describe(`Human-readable rule name (max ${import_sdk.MAX_RULE_NAME_LEN} chars)`),
-  enabled: import_zod2.z.boolean().optional().default(true).describe("Whether this rule is active"),
-  logic: import_zod2.z.enum(["and", "or"]).optional().default("and").describe('How to combine conditions: "and" (all match) or "or" (any match)'),
-  conditions: import_zod2.z.array(ruleConditionSchema).min(1).max(10).describe("Conditions to evaluate (1-10)"),
-  response: import_zod2.z.lazy(() => mockResponseSchema).describe("Response when conditions match")
+var responseRuleSchema = import_zod.z.object({
+  name: import_zod.z.string().max(import_sdk.MAX_RULE_NAME_LEN).optional().describe(`Human-readable rule name (max ${import_sdk.MAX_RULE_NAME_LEN} chars)`),
+  enabled: import_zod.z.boolean().optional().default(true).describe("Whether this rule is active"),
+  logic: import_zod.z.enum(["and", "or"]).optional().default("and").describe('How to combine conditions: "and" (all match) or "or" (any match)'),
+  conditions: import_zod.z.array(ruleConditionSchema).min(1).max(10).describe("Conditions to evaluate (1-10)"),
+  response: import_zod.z.lazy(() => mockResponseSchema).describe("Response when conditions match")
 });
-var responseRulesSchema = import_zod2.z.array(responseRuleSchema).max(50).describe("Ordered conditional response rules (first match wins, max 50)");
-var mockResponseSchema = import_zod2.z.object({
-  status: import_zod2.z.number().int().min(import_sdk.MOCK_RESPONSE_STATUS_MIN).max(import_sdk.MOCK_RESPONSE_STATUS_MAX).describe(`HTTP status code (${import_sdk.MOCK_RESPONSE_STATUS_MIN}-${import_sdk.MOCK_RESPONSE_STATUS_MAX})`),
-  body: import_zod2.z.string().default("").describe(
+var responseRulesSchema = import_zod.z.array(responseRuleSchema).max(50).describe("Ordered conditional response rules (first match wins, max 50)");
+var mockResponseSchema = import_zod.z.object({
+  status: import_zod.z.number().int().min(import_sdk.MOCK_RESPONSE_STATUS_MIN).max(import_sdk.MOCK_RESPONSE_STATUS_MAX).describe(`HTTP status code (${import_sdk.MOCK_RESPONSE_STATUS_MIN}-${import_sdk.MOCK_RESPONSE_STATUS_MAX})`),
+  body: import_zod.z.string().default("").describe(
     'Response body (default: empty). {{ placeholders }} are filled in from the request: {{ json.id }} (a JSON or form body field), {{ body }}, {{ headers.user-agent }}, {{ query.page }}, {{ method }}, {{ path }}, {{ id }}, {{ uuid }}, {{ now }}; filters: | default: "x", | json, | lower, | upper, | truncate: 80'
   ),
-  headers: import_zod2.z.record(import_zod2.z.string(), import_zod2.z.string()).default({}).describe("Response headers (default: none); values may use {{ placeholders }} too"),
-  delay: import_zod2.z.number().int().min(import_sdk.MOCK_RESPONSE_DELAY_MIN).max(import_sdk.MOCK_RESPONSE_DELAY_MAX).optional().describe(
+  headers: import_zod.z.record(import_zod.z.string(), import_zod.z.string()).default({}).describe("Response headers (default: none); values may use {{ placeholders }} too"),
+  delay: import_zod.z.number().int().min(import_sdk.MOCK_RESPONSE_DELAY_MIN).max(import_sdk.MOCK_RESPONSE_DELAY_MAX).optional().describe(
     `Response delay in milliseconds (${import_sdk.MOCK_RESPONSE_DELAY_MIN}-${import_sdk.MOCK_RESPONSE_DELAY_MAX}, default: none)`
   )
 });
-var endpointSiteSchema = import_zod2.z.enum(["webhooks", "mailhooks", "both"]).describe(
+var endpointSiteSchema = import_zod.z.enum(["webhooks", "mailhooks", "both"]).describe(
   "Which site's dashboard lists the endpoint: webhooks (webhooks.cc), mailhooks (mailhooks.cc) or both (the default when creating). Only the listing: its HTTP URL and email address work either way. Owner only to change."
 );
 var createEndpointShape = {
-  name: import_zod2.z.string().optional().describe("Display name for the endpoint"),
-  ephemeral: import_zod2.z.boolean().optional().describe("Create a temporary endpoint that auto-expires"),
+  name: import_zod.z.string().optional().describe("Display name for the endpoint"),
+  ephemeral: import_zod.z.boolean().optional().describe("Create a temporary endpoint that auto-expires"),
   expiresIn: durationOrTimestampSchema.optional().describe('Auto-expire after this duration, for example "12h"'),
   mockResponse: mockResponseSchema.optional().describe("Optional mock response to return when the endpoint receives a request"),
   responseRules: responseRulesSchema.optional().describe(
     "Conditional response rules. Each rule has conditions and a response. First matching rule wins."
   ),
-  notificationUrl: import_zod2.z.string().url().optional().describe(
+  notificationUrl: import_zod.z.string().url().optional().describe(
     "URL to POST a JSON summary to after each captured request (e.g. Slack/Discord webhook)"
   ),
   site: endpointSiteSchema.optional(),
-  signingProvider: import_zod2.z.string().optional().describe(
+  signingProvider: import_zod.z.string().optional().describe(
     "Signing provider for automatic signature verification (e.g. stripe, github, shopify)"
   ),
-  signingSecret: import_zod2.z.string().optional().describe(
+  signingSecret: import_zod.z.string().optional().describe(
     "Signing secret (encrypted server-side, never returned). Required when signingProvider is set."
   ),
-  signingHeader: import_zod2.z.string().optional().describe("Custom signature header name. Only used with generic-hmac provider.")
+  signingHeader: import_zod.z.string().optional().describe("Custom signature header name. Only used with generic-hmac provider.")
 };
 var listEndpointsShape = {
-  team: import_zod2.z.string().min(1).optional().describe(
+  team: import_zod.z.string().min(1).optional().describe(
     "Team id or name (case-insensitive). Keeps endpoints shared with you from that team and endpoints you own that are shared with it."
   )
 };
-var getEndpointShape = { slug: import_zod2.z.string().describe("The endpoint slug") };
-var deleteEndpointShape = { slug: import_zod2.z.string().describe("The endpoint slug to delete") };
+var getEndpointShape = { slug: import_zod.z.string().describe("The endpoint slug") };
+var deleteEndpointShape = { slug: import_zod.z.string().describe("The endpoint slug to delete") };
 var listRequestsShape = {
-  endpointSlug: import_zod2.z.string().describe("The endpoint slug"),
-  limit: import_zod2.z.number().int().min(1).max(100).default(25).describe("Max requests to return"),
-  since: import_zod2.z.number().optional().describe("Only return requests after this timestamp in ms"),
+  endpointSlug: import_zod.z.string().describe("The endpoint slug"),
+  limit: import_zod.z.number().int().min(1).max(100).default(25).describe("Max requests to return"),
+  since: import_zod.z.number().optional().describe("Only return requests after this timestamp in ms"),
   kind: kindSchema
 };
-var getRequestShape = { requestId: import_zod2.z.string().describe("The request ID") };
+var getRequestShape = { requestId: import_zod.z.string().describe("The request ID") };
 var waitForRequestShape = {
-  endpointSlug: import_zod2.z.string().describe("The endpoint slug to monitor"),
+  endpointSlug: import_zod.z.string().describe("The endpoint slug to monitor"),
   timeout: durationOrTimestampSchema.default("30s").describe('How long to wait, for example "30s"'),
   pollInterval: durationOrTimestampSchema.optional().describe('Interval between polls, for example "500ms" or "1s"')
 };
 var payloadSchemaShape = {
-  endpointSlug: import_zod2.z.string().describe("The endpoint slug"),
-  format: import_zod2.z.enum(import_sdk.PAYLOAD_SCHEMA_FORMATS).default("typescript").describe(
+  endpointSlug: import_zod.z.string().describe("The endpoint slug"),
+  format: import_zod.z.enum(import_sdk.PAYLOAD_SCHEMA_FORMATS).default("typescript").describe(
     'Output: "typescript" interfaces, "zod" schemas, "pydantic" models, or "json-schema"'
   ),
-  name: import_zod2.z.string().max(100).optional().describe("Root type name (default: from the detected event, else WebhookPayload)"),
-  event: import_zod2.z.string().optional().describe(
+  name: import_zod.z.string().max(100).optional().describe("Root type name (default: from the detected event, else WebhookPayload)"),
+  event: import_zod.z.string().optional().describe(
     'Only requests whose detected provider event matches, e.g. "invoice.paid" or "push". One event per schema gives the tightest types.'
   ),
-  method: import_zod2.z.string().optional().describe("Only requests with this HTTP method"),
-  path: import_zod2.z.string().optional().describe("Only requests with this path"),
-  requestIds: import_zod2.z.array(import_zod2.z.string()).min(1).max(50).optional().describe("Use exactly these requests instead of the latest ones"),
-  limit: import_zod2.z.number().int().min(1).max(100).default(20).describe("How many of the latest requests to read before filtering")
+  method: import_zod.z.string().optional().describe("Only requests with this HTTP method"),
+  path: import_zod.z.string().optional().describe("Only requests with this path"),
+  requestIds: import_zod.z.array(import_zod.z.string()).min(1).max(50).optional().describe("Use exactly these requests instead of the latest ones"),
+  limit: import_zod.z.number().int().min(1).max(100).default(20).describe("How many of the latest requests to read before filtering")
 };
 function eventName(event) {
   const words = event.replace(/([a-z0-9])([A-Z])/g, "$1 $2").split(/[^A-Za-z0-9]+/).filter(Boolean);
@@ -1171,11 +1149,18 @@ function durationMs(value) {
     return null;
   }
 }
-function toolTarget(target, remote, handles) {
+function toolTarget(target, options, handles) {
+  const remote = options.remote === true;
   return {
     tool(name, description, shape, handler) {
       if (remote && LOCAL_ONLY_TOOLS.has(name)) return { remove() {
       } };
+      const entry = TOOL_CATALOG[name];
+      if (!entry) throw new Error(`${name} has no entry in catalog.ts`);
+      if (options.groups && !options.groups.has(entry.group)) return { remove() {
+      } };
+      if (options.readOnly && entry.readOnly !== true) return { remove() {
+      } };
       const wrapped = remote ? async (args) => {
         const input = args;
         if (TARGET_URL_TOOLS.has(name) && input.targetUrl !== void 0) {
@@ -1209,7 +1194,7 @@ function toolTarget(target, remote, handles) {
         }
         return handler(bounded);
       } : handler;
-      const handle = target.tool(name, description, shape, wrapped);
+      const handle = target.tool(name, description, shape, wrapped, toolAnnotations(name));
       handles.push(handle);
       return handle;
     }
@@ -1285,7 +1270,7 @@ function withShareHints(list, remote = false) {
 function registerTools(target, client, options = {}) {
   const handles = [];
   const remote = options.remote === true;
-  const server = toolTarget(target, remote, handles);
+  const server = toolTarget(target, options, handles);
   const shareWith = remote ? REMOTE_SHARE : "share_port";
   server.tool(
     "create_endpoint",
@@ -1368,7 +1353,7 @@ function registerTools(target, client, options = {}) {
   server.tool(
     "list_team_members",
     "List a team's members and pending invites. Any member of the team may call this.",
-    { teamId: import_zod2.z.string().min(1).describe("Team id (from list_teams)") },
+    { teamId: import_zod.z.string().min(1).describe("Team id (from list_teams)") },
     withErrorHandling(async ({ teamId }) => {
       const result = await client.teams.members(teamId);
       return jsonContent(result);
@@ -1378,8 +1363,8 @@ function registerTools(target, client, options = {}) {
     "share_endpoint",
     "Share an endpoint you own with a team so its members can inspect, stream, and edit it. The team needs an active subscription; the endpoint's requests then bill the team's pooled quota.",
     {
-      slug: import_zod2.z.string().describe("Slug of an endpoint you own"),
-      teamId: import_zod2.z.string().min(1).describe("Team id (from list_teams)")
+      slug: import_zod.z.string().describe("Slug of an endpoint you own"),
+      teamId: import_zod.z.string().min(1).describe("Team id (from list_teams)")
     },
     withErrorHandling(async ({ slug, teamId }) => {
       await client.teams.share(teamId, slug);
@@ -1390,8 +1375,8 @@ function registerTools(target, client, options = {}) {
     "unshare_endpoint",
     "Stop sharing an endpoint you own with a team. Works even when the team is suspended.",
     {
-      slug: import_zod2.z.string().describe("Slug of an endpoint you own"),
-      teamId: import_zod2.z.string().min(1).describe("Team id (from list_teams)")
+      slug: import_zod.z.string().describe("Slug of an endpoint you own"),
+      teamId: import_zod.z.string().min(1).describe("Team id (from list_teams)")
     },
     withErrorHandling(async ({ slug, teamId }) => {
       await client.teams.unshare(teamId, slug);
@@ -1401,15 +1386,15 @@ function registerTools(target, client, options = {}) {
   server.tool(
     "create_team",
     "Create a team you own, to share endpoints with its members under a pooled quota. It does nothing until it has a subscription, which the person starts in the browser (Account > Teams); until then it is suspended.",
-    { name: import_zod2.z.string().trim().min(1).max(100).describe("The team's name") },
+    { name: import_zod.z.string().trim().min(1).max(100).describe("The team's name") },
     withErrorHandling(async ({ name }) => jsonContent(await client.teams.create(name)))
   );
   server.tool(
     "rename_team",
     "Rename a team you own.",
     {
-      teamId: import_zod2.z.string().min(1).describe("Team id (from list_teams)"),
-      name: import_zod2.z.string().trim().min(1).max(100).describe("The new name")
+      teamId: import_zod.z.string().min(1).describe("Team id (from list_teams)"),
+      name: import_zod.z.string().trim().min(1).max(100).describe("The new name")
     },
     withErrorHandling(async ({ teamId, name }) => {
       await client.teams.rename(teamId, name);
@@ -1419,7 +1404,7 @@ function registerTools(target, client, options = {}) {
   server.tool(
     "delete_team",
     "Delete a team you own: its subscription ends at once, every member loses the endpoints shared with it, and it cannot be undone. Only when the person asks for it. The team's owner must approve it: this returns a link and a code to show them, then call wait_for_approval.",
-    { teamId: import_zod2.z.string().min(1).describe("Team id (from list_teams)") },
+    { teamId: import_zod.z.string().min(1).describe("Team id (from list_teams)") },
     withErrorHandling(async ({ teamId }) => {
       const pending = await client.teams.delete(teamId);
       if (!pending.id) return textContent(`Deleted the team ${teamId}.`);
@@ -1430,8 +1415,8 @@ function registerTools(target, client, options = {}) {
     "remove_team_member",
     "Remove a member from a team you own: the endpoints they shared with the team stop being shared, and their seat is free for someone else. Only when the person asks for it.",
     {
-      teamId: import_zod2.z.string().min(1).describe("Team id (from list_teams)"),
-      userId: import_zod2.z.string().min(1).describe("The member's userId (from list_team_members)")
+      teamId: import_zod.z.string().min(1).describe("Team id (from list_teams)"),
+      userId: import_zod.z.string().min(1).describe("The member's userId (from list_team_members)")
     },
     withErrorHandling(async ({ teamId, userId }) => {
       await client.teams.removeMember(teamId, userId);
@@ -1441,7 +1426,7 @@ function registerTools(target, client, options = {}) {
   server.tool(
     "leave_team",
     "Leave a team you belong to: the endpoints you shared with it stop being shared, and you lose access to the ones shared with you through it. An owner cannot leave; they delete the team instead (delete_team). Only when the person asks for it.",
-    { teamId: import_zod2.z.string().min(1).describe("Team id (from list_teams)") },
+    { teamId: import_zod.z.string().min(1).describe("Team id (from list_teams)") },
     withErrorHandling(async ({ teamId }) => {
       await client.teams.leave(teamId);
       return jsonContent({ left: true, teamId });
@@ -1451,8 +1436,8 @@ function registerTools(target, client, options = {}) {
     "invite_to_team",
     "Invite an email address to a team you own. It emails that address, so the team's owner must approve it: this returns a link and a code to show them, then call wait_for_approval, which returns the invite. Accepting the invite claims one of the team's paid seats. Only when the person asks for it.",
     {
-      teamId: import_zod2.z.string().min(1).describe("Team id (from list_teams)"),
-      email: import_zod2.z.string().trim().email().describe("The address to invite")
+      teamId: import_zod.z.string().min(1).describe("Team id (from list_teams)"),
+      email: import_zod.z.string().trim().email().describe("The address to invite")
     },
     withErrorHandling(async ({ teamId, email }) => {
       const pending = await client.teams.invite(teamId, email);
@@ -1470,8 +1455,8 @@ function registerTools(target, client, options = {}) {
     "answer_invite",
     "Accept or decline a team invite waiting for you (from list_invites). Accepting claims one of the team's paid seats and you join the team, seeing the endpoints shared with it; it fails when the team is full or suspended. Only when the person says which.",
     {
-      inviteId: import_zod2.z.string().min(1).describe("The invite's id, from list_invites"),
-      answer: import_zod2.z.enum(["accept", "decline"]).describe("accept joins the team; decline turns it down")
+      inviteId: import_zod.z.string().min(1).describe("The invite's id, from list_invites"),
+      answer: import_zod.z.enum(["accept", "decline"]).describe("accept joins the team; decline turns it down")
     },
     withErrorHandling(async ({ inviteId, answer }) => {
       if (answer === "accept") {
@@ -1486,8 +1471,8 @@ function registerTools(target, client, options = {}) {
     "withdraw_invite",
     "Withdraw an invite to a team you own before it is answered (pending invites and their ids are in list_team_members). The invite link stops working.",
     {
-      teamId: import_zod2.z.string().min(1).describe("Team id (from list_teams)"),
-      inviteId: import_zod2.z.string().min(1).describe("The invite's id (from list_team_members' pendingInvites)")
+      teamId: import_zod.z.string().min(1).describe("Team id (from list_teams)"),
+      inviteId: import_zod.z.string().min(1).describe("The invite's id (from list_team_members' pendingInvites)")
     },
     withErrorHandling(async ({ teamId, inviteId }) => {
       await client.teams.withdrawInvite(teamId, inviteId);
@@ -1498,10 +1483,10 @@ function registerTools(target, client, options = {}) {
     "quote_team_change",
     "What changing a team's seat count or plan would cost, read only (owner only): what is due now, any credit, and the price from the renewal. Give seats, or plan (with interval). The change itself is made by the person in the browser.",
     {
-      teamId: import_zod2.z.string().min(1).describe("Team id (from list_teams)"),
-      seats: import_zod2.z.number().int().min(1).optional().describe("Price this seat count"),
-      plan: import_zod2.z.enum(["team", "team_business"]).optional().describe("Price a move to this plan: team (Teams) or team_business (Team Business)"),
-      interval: import_zod2.z.enum(["month", "year"]).optional().describe("Billing interval for plan (default month; Teams is monthly only)")
+      teamId: import_zod.z.string().min(1).describe("Team id (from list_teams)"),
+      seats: import_zod.z.number().int().min(1).optional().describe("Price this seat count"),
+      plan: import_zod.z.enum(["team", "team_business"]).optional().describe("Price a move to this plan: team (Teams) or team_business (Team Business)"),
+      interval: import_zod.z.enum(["month", "year"]).optional().describe("Billing interval for plan (default month; Teams is monthly only)")
     },
     withErrorHandling(async ({ teamId, seats, plan, interval }) => {
       if (seats === void 0 === (plan === void 0)) {
@@ -1529,8 +1514,8 @@ function registerTools(target, client, options = {}) {
     "favorite_endpoint",
     "Mark an endpoint as one of your favourites, or unmark it with favorite: false. A favourite is your own choice, so endpoints shared with you through teams can be marked too; list_endpoints and get_endpoint show it as favorite. Idempotent.",
     {
-      slug: import_zod2.z.string().describe("The endpoint slug"),
-      favorite: import_zod2.z.boolean().optional().describe("true marks it as a favourite (the default), false unmarks it")
+      slug: import_zod.z.string().describe("The endpoint slug"),
+      favorite: import_zod.z.boolean().optional().describe("true marks it as a favourite (the default), false unmarks it")
     },
     withErrorHandling(async ({ slug, favorite }) => {
       const result = favorite === false ? await client.endpoints.unfavorite(slug) : await client.endpoints.favorite(slug);
@@ -1541,24 +1526,24 @@ function registerTools(target, client, options = {}) {
     "update_endpoint",
     "Update an endpoint name, mock response, conditional response rules, signing configuration, whether codes and links are picked out of its emails, or the named fields picked out of them.",
     {
-      slug: import_zod2.z.string().describe("The endpoint slug to update"),
-      name: import_zod2.z.string().optional().describe("New display name"),
+      slug: import_zod.z.string().describe("The endpoint slug to update"),
+      name: import_zod.z.string().optional().describe("New display name"),
       mockResponse: mockResponseSchema.nullable().optional().describe("Default mock response (used when no rule matches), or null to clear"),
       responseRules: responseRulesSchema.nullable().optional().describe("Conditional response rules (first match wins), or null to clear"),
-      notificationUrl: import_zod2.z.string().url().nullable().optional().describe("Notification webhook URL, or null to clear it"),
-      signingProvider: import_zod2.z.string().nullable().optional().describe(
+      notificationUrl: import_zod.z.string().url().nullable().optional().describe("Notification webhook URL, or null to clear it"),
+      signingProvider: import_zod.z.string().nullable().optional().describe(
         "Signing provider for automatic verification (e.g. stripe, github), or null to disable"
       ),
-      signingSecret: import_zod2.z.string().nullable().optional().describe("New signing secret (encrypted server-side). Pass null to clear."),
-      signingHeader: import_zod2.z.string().nullable().optional().describe(
+      signingSecret: import_zod.z.string().nullable().optional().describe("New signing secret (encrypted server-side). Pass null to clear."),
+      signingHeader: import_zod.z.string().nullable().optional().describe(
         "Custom signature header name (only for generic-hmac provider), or null to clear"
       ),
-      showEmailExtracts: import_zod2.z.boolean().optional().describe("Pick codes and links out of emails (dashboard and forwarded JSON). Owner only."),
+      showEmailExtracts: import_zod.z.boolean().optional().describe("Pick codes and links out of emails (dashboard and forwarded JSON). Owner only."),
       site: endpointSiteSchema.optional(),
-      emailFields: import_zod2.z.array(emailFieldSchema).max(20).nullable().optional().describe(
+      emailFields: import_zod.z.array(emailFieldSchema).max(20).nullable().optional().describe(
         "Named fields picked out of every email: shown with it, `fields` in its JSON, read by forwarding templates and filters (email_field). Replaces the list; null or [] removes them. Owner only."
       ),
-      layouts: import_zod2.z.array(layoutSchema).max(50).nullable().optional().describe(
+      layouts: import_zod.z.array(layoutSchema).max(50).nullable().optional().describe(
         "How the endpoint reads each sender's emails: the first layout whose match holds applies its fields, line items and attachment parsing; the result is `parsed` in the email's JSON, and deliveries wait for it. The plan uses the first 2 (Business 50). Replaces the list; null or [] removes them. Try them with preview_layouts first. Owner only."
       )
     },
@@ -1598,9 +1583,9 @@ function registerTools(target, client, options = {}) {
     "preview_layouts",
     "Dry run of an endpoint's layouts on a captured email: which layout matches, the fields and line items it finds, and what earlier parses of its attachments held. Nothing is saved and no pages are used. Pass layouts to try them before saving them with update_endpoint.",
     {
-      slug: import_zod2.z.string().describe("The endpoint slug"),
-      requestId: import_zod2.z.string().optional().describe("A captured email on the endpoint (default: the newest)"),
-      layouts: import_zod2.z.array(layoutSchema).max(50).optional().describe("Unsaved layouts to try")
+      slug: import_zod.z.string().describe("The endpoint slug"),
+      requestId: import_zod.z.string().optional().describe("A captured email on the endpoint (default: the newest)"),
+      layouts: import_zod.z.array(layoutSchema).max(50).optional().describe("Unsaved layouts to try")
     },
     withErrorHandling(async ({ slug, requestId, layouts }) => {
       const preview = await client.endpoints.previewLayouts(slug, { requestId, layouts });
@@ -1612,15 +1597,15 @@ function registerTools(target, client, options = {}) {
   server.tool(
     "list_layout_templates",
     "List the ready-made email layouts (order emails from Shopify, WooCommerce, Etsy and more, payments, bookings, attachments): each with its id, sender, kind, description, the fields it reads and whether it reads line items. Add one with add_layout_template.",
-    { slug: import_zod2.z.string().describe("The endpoint slug") },
+    { slug: import_zod.z.string().describe("The endpoint slug") },
     withErrorHandling(async ({ slug }) => jsonContent(await client.endpoints.layoutTemplates(slug)))
   );
   server.tool(
     "add_layout_template",
     "Add a ready-made layout (an id from list_layout_templates) to the end of an endpoint's layouts. Emails it matches are parsed from the next one on; check it on a captured email with preview_layouts. Owner only.",
     {
-      slug: import_zod2.z.string().describe("The endpoint slug"),
-      template: import_zod2.z.string().min(1).describe("The template's id, from list_layout_templates")
+      slug: import_zod.z.string().describe("The endpoint slug"),
+      template: import_zod.z.string().min(1).describe("The template's id, from list_layout_templates")
     },
     withErrorHandling(
       async ({ slug, template }) => jsonContent(await client.endpoints.addLayoutTemplate(slug, template))
@@ -1630,9 +1615,9 @@ function registerTools(target, client, options = {}) {
     "preview_email_fields",
     "Dry run of an endpoint's named email fields on a captured email: each field's value (null where it finds nothing), and problems with fields you pass. Nothing is saved. Pass emailFields to try fields before saving them with update_endpoint. Owner only.",
     {
-      slug: import_zod2.z.string().describe("The endpoint slug"),
-      requestId: import_zod2.z.string().optional().describe("A captured email on the endpoint (default: the newest)"),
-      emailFields: import_zod2.z.array(emailFieldSchema).max(20).optional().describe("Unsaved fields to try instead of the saved ones")
+      slug: import_zod.z.string().describe("The endpoint slug"),
+      requestId: import_zod.z.string().optional().describe("A captured email on the endpoint (default: the newest)"),
+      emailFields: import_zod.z.array(emailFieldSchema).max(20).optional().describe("Unsaved fields to try instead of the saved ones")
     },
     withErrorHandling(
       async ({ slug, requestId, emailFields }) => jsonContent(await client.endpoints.previewEmailFields(slug, { requestId, emailFields }))
@@ -1642,8 +1627,8 @@ function registerTools(target, client, options = {}) {
     "preview_response",
     "Dry run of an endpoint's responses: which response rule answers a captured request, and the response with its {{ placeholders }} filled in, exactly as the receiver would send it. Nothing is sent. Pass mockResponse or responseRules to try settings before saving them with update_endpoint.",
     {
-      slug: import_zod2.z.string().describe("The endpoint slug"),
-      requestId: import_zod2.z.string().optional().describe(
+      slug: import_zod.z.string().describe("The endpoint slug"),
+      requestId: import_zod.z.string().optional().describe(
         "A captured request on the endpoint (default: the newest HTTP request, or a sample)"
       ),
       mockResponse: mockResponseSchema.nullable().optional().describe("Try this default response instead of the saved one (null: none)"),
@@ -1671,9 +1656,9 @@ function registerTools(target, client, options = {}) {
     "create_endpoints",
     "Create multiple webhook endpoints in one call.",
     {
-      count: import_zod2.z.number().int().min(1).max(20).describe("Number of endpoints to create"),
-      namePrefix: import_zod2.z.string().optional().describe("Optional prefix for endpoint names"),
-      ephemeral: import_zod2.z.boolean().optional().describe("Create temporary endpoints that auto-expire"),
+      count: import_zod.z.number().int().min(1).max(20).describe("Number of endpoints to create"),
+      namePrefix: import_zod.z.string().optional().describe("Optional prefix for endpoint names"),
+      ephemeral: import_zod.z.boolean().optional().describe("Create temporary endpoints that auto-expire"),
       expiresIn: durationOrTimestampSchema.optional().describe('Auto-expire after this duration, for example "12h"')
     },
     withErrorHandling(async ({ count, namePrefix, ephemeral, expiresIn }) => {
@@ -1694,7 +1679,7 @@ function registerTools(target, client, options = {}) {
     "delete_endpoints",
     "Delete multiple webhook endpoints in one call.",
     {
-      slugs: import_zod2.z.array(import_zod2.z.string()).min(1).max(100).describe("Endpoint slugs to delete")
+      slugs: import_zod.z.array(import_zod.z.string()).min(1).max(100).describe("Endpoint slugs to delete")
     },
     withErrorHandling(async ({ slugs }) => {
       const settled = await Promise.allSettled(
@@ -1722,14 +1707,14 @@ function registerTools(target, client, options = {}) {
     "send_webhook",
     "Send a test webhook to a hosted endpoint. Supports provider templates and signing.",
     {
-      slug: import_zod2.z.string().describe("The endpoint slug to send to"),
+      slug: import_zod.z.string().describe("The endpoint slug to send to"),
       method: methodSchema,
-      headers: import_zod2.z.record(import_zod2.z.string(), import_zod2.z.string()).optional().describe("HTTP headers to include"),
-      body: import_zod2.z.unknown().optional().describe("Request body"),
-      provider: import_zod2.z.enum(import_sdk.TEMPLATE_PROVIDERS).optional().describe("Optional provider template to send with signed headers"),
-      template: import_zod2.z.string().optional().describe("Provider-specific template preset"),
-      event: import_zod2.z.string().optional().describe("Provider event or topic name"),
-      secret: import_zod2.z.string().optional().describe(
+      headers: import_zod.z.record(import_zod.z.string(), import_zod.z.string()).optional().describe("HTTP headers to include"),
+      body: import_zod.z.unknown().optional().describe("Request body"),
+      provider: import_zod.z.enum(import_sdk.TEMPLATE_PROVIDERS).optional().describe("Optional provider template to send with signed headers"),
+      template: import_zod.z.string().optional().describe("Provider-specific template preset"),
+      event: import_zod.z.string().optional().describe("Provider event or topic name"),
+      secret: import_zod.z.string().optional().describe(
         "Signing secret. Required for signed provider templates; omit for secretless providers (sendgrid, discord, plaid)."
       )
     },
@@ -1775,10 +1760,10 @@ function registerTools(target, client, options = {}) {
     "search_requests",
     "Search captured requests and emails across endpoints: a substring match on path, headers, body and decoded email fields. One call reads back through history for about 2 seconds and returns { requests, complete, searchedUntil, cursor }. When complete is false, older requests were not searched yet: call again with the cursor and the same filters to continue.",
     {
-      slug: import_zod2.z.string().optional().describe("Filter to a specific endpoint slug"),
-      method: import_zod2.z.string().optional().describe("Filter by HTTP method"),
+      slug: import_zod.z.string().optional().describe("Filter to a specific endpoint slug"),
+      method: import_zod.z.string().optional().describe("Filter by HTTP method"),
       kind: kindSchema,
-      q: import_zod2.z.string().optional().describe(
+      q: import_zod.z.string().optional().describe(
         "Substring to find in the path, headers, body and decoded email fields (up to 1,000 characters)"
       ),
       from: durationOrTimestampSchema.optional().describe(
@@ -1787,10 +1772,10 @@ function registerTools(target, client, options = {}) {
       to: durationOrTimestampSchema.optional().describe(
         'End time as a timestamp (Unix ms) or a duration back from now like "1h" or "7d". A duration is counted from each call, so when you continue with a cursor pass a timestamp to keep the same range.'
       ),
-      limit: import_zod2.z.number().int().min(1).max(200).default(50).describe("Max results to return"),
-      offset: import_zod2.z.number().int().min(0).max(1e4).default(0).describe("Matches to skip (first call only; a cursor carries what is left of it)"),
-      order: import_zod2.z.enum(["asc", "desc"]).default("desc").describe("Sort order by received time"),
-      cursor: import_zod2.z.string().optional().describe(
+      limit: import_zod.z.number().int().min(1).max(200).default(50).describe("Max results to return"),
+      offset: import_zod.z.number().int().min(0).max(1e4).default(0).describe("Matches to skip (first call only; a cursor carries what is left of it)"),
+      order: import_zod.z.enum(["asc", "desc"]).default("desc").describe("Sort order by received time"),
+      cursor: import_zod.z.string().optional().describe(
         "The cursor from a previous search_requests result, to continue that search. Keep the other inputs the same."
       )
     },
@@ -1825,10 +1810,10 @@ function registerTools(target, client, options = {}) {
     "count_requests",
     "Count captured requests and emails that match the given filters (q is a substring match on path, headers, body and decoded email fields). Returns { count, exact, searchedUntil, cursor }. With q or method a call counts back through history for about 2 seconds: when exact is false, count covers history back to searchedUntil only, and calling again with the cursor counts the next stretch (add the counts up).",
     {
-      slug: import_zod2.z.string().optional().describe("Filter to a specific endpoint slug"),
-      method: import_zod2.z.string().optional().describe("Filter by HTTP method"),
+      slug: import_zod.z.string().optional().describe("Filter to a specific endpoint slug"),
+      method: import_zod.z.string().optional().describe("Filter by HTTP method"),
       kind: kindSchema,
-      q: import_zod2.z.string().optional().describe(
+      q: import_zod.z.string().optional().describe(
         "Substring to find in the path, headers, body and decoded email fields (up to 1,000 characters)"
       ),
       from: durationOrTimestampSchema.optional().describe(
@@ -1837,7 +1822,7 @@ function registerTools(target, client, options = {}) {
       to: durationOrTimestampSchema.optional().describe(
         'End time as a timestamp (Unix ms) or a duration back from now like "1h" or "7d". A duration is counted from each call, so when you continue with a cursor pass a timestamp to keep the same range.'
       ),
-      cursor: import_zod2.z.string().optional().describe(
+      cursor: import_zod.z.string().optional().describe(
         "The cursor from a previous count_requests result, to count the next stretch. Keep the other inputs the same."
       )
     },
@@ -1877,11 +1862,11 @@ function registerTools(target, client, options = {}) {
     "wait_for_requests",
     "Wait for multiple requests to arrive at an endpoint.",
     {
-      endpointSlug: import_zod2.z.string().describe("The endpoint slug to monitor"),
-      count: import_zod2.z.number().int().min(1).max(20).describe("Number of requests to collect"),
+      endpointSlug: import_zod.z.string().describe("The endpoint slug to monitor"),
+      count: import_zod.z.number().int().min(1).max(20).describe("Number of requests to collect"),
       timeout: durationOrTimestampSchema.default("30s").describe('How long to wait, for example "30s"'),
       pollInterval: durationOrTimestampSchema.optional().describe('Interval between polls, for example "500ms" or "1s"'),
-      method: import_zod2.z.string().optional().describe("Only collect requests with this HTTP method")
+      method: import_zod.z.string().optional().describe("Only collect requests with this HTTP method")
     },
     withErrorHandling(async ({ endpointSlug, count, timeout, pollInterval, method }) => {
       const result = await waitForMultipleRequests(client, endpointSlug, {
@@ -1899,7 +1884,7 @@ function registerTools(target, client, options = {}) {
     "replay_request",
     "Replay a previously captured request to a target URL.",
     {
-      requestId: import_zod2.z.string().describe("The captured request ID"),
+      requestId: import_zod.z.string().describe("The captured request ID"),
       targetUrl: httpUrlSchema.describe("The URL to replay the request to")
     },
     withErrorHandling(async ({ requestId, targetUrl }) => {
@@ -1916,9 +1901,9 @@ function registerTools(target, client, options = {}) {
     "render_email",
     "A captured email in the shape an inbound mail provider posts it (postmark, sendgrid, mailgun, cloudmailin), to test the inbound handler you wrote for that provider against real mail. Returns the method, headers and body; with targetUrl (your local handler), posts it there and returns the answer. A Mailgun form is signed when you pass the signing key your handler checks.",
     {
-      requestId: import_zod2.z.string().describe("The captured email's request ID"),
-      format: import_zod2.z.enum(["postmark", "sendgrid", "mailgun", "cloudmailin", "json"]).describe("Whose shape; json is webhooks.cc's own email.received JSON (unsigned)"),
-      mailgunSigningKey: import_zod2.z.string().optional().describe("For mailgun: the signing key your handler verifies with (a test key)"),
+      requestId: import_zod.z.string().describe("The captured email's request ID"),
+      format: import_zod.z.enum(["postmark", "sendgrid", "mailgun", "cloudmailin", "json"]).describe("Whose shape; json is webhooks.cc's own email.received JSON (unsigned)"),
+      mailgunSigningKey: import_zod.z.string().optional().describe("For mailgun: the signing key your handler verifies with (a test key)"),
       targetUrl: httpUrlSchema.optional().describe("Post it here, e.g. http://localhost:3000/api/inbound/postmark")
     },
     withErrorHandling(async ({ requestId, format, mailgunSigningKey, targetUrl }) => {
@@ -1949,9 +1934,9 @@ function registerTools(target, client, options = {}) {
     "compare_requests",
     "Compare two captured requests and show the structured differences.",
     {
-      leftRequestId: import_zod2.z.string().describe("The first request ID"),
-      rightRequestId: import_zod2.z.string().describe("The second request ID"),
-      ignoreHeaders: import_zod2.z.array(import_zod2.z.string()).optional().describe("Headers to ignore during comparison")
+      leftRequestId: import_zod.z.string().describe("The first request ID"),
+      rightRequestId: import_zod.z.string().describe("The second request ID"),
+      ignoreHeaders: import_zod.z.array(import_zod.z.string()).optional().describe("Headers to ignore during comparison")
     },
     withErrorHandling(async ({ leftRequestId, rightRequestId, ignoreHeaders }) => {
       const [leftRequest, rightRequest] = await Promise.all([
@@ -1975,8 +1960,8 @@ function registerTools(target, client, options = {}) {
     "extract_from_request",
     "Extract specific JSON fields from a captured request body.",
     {
-      requestId: import_zod2.z.string().describe("The request ID"),
-      jsonPaths: import_zod2.z.array(import_zod2.z.string()).min(1).max(50).describe("Dot-notation JSON paths to extract")
+      requestId: import_zod.z.string().describe("The request ID"),
+      jsonPaths: import_zod.z.array(import_zod.z.string()).min(1).max(50).describe("Dot-notation JSON paths to extract")
     },
     withErrorHandling(async ({ requestId, jsonPaths }) => {
       const request = await client.requests.get(requestId);
@@ -1990,14 +1975,14 @@ function registerTools(target, client, options = {}) {
     "verify_signature",
     "Verify the webhook signature on a captured request. When called without provider/secret, returns the server-side pre-computed result (if signing is configured on the endpoint). When called with provider+secret, performs client-side verification.",
     {
-      requestId: import_zod2.z.string().describe("The captured request ID"),
-      provider: import_zod2.z.enum(import_sdk.VERIFY_PROVIDERS).optional().describe("Provider whose signature scheme should be verified. Omit to use stored result."),
-      secret: import_zod2.z.string().optional().describe(
+      requestId: import_zod.z.string().describe("The captured request ID"),
+      provider: import_zod.z.enum(import_sdk.VERIFY_PROVIDERS).optional().describe("Provider whose signature scheme should be verified. Omit to use stored result."),
+      secret: import_zod.z.string().optional().describe(
         "Provider credential for client-side verification (for example a shared signing secret, Adyen hex HMAC key, or PayPal webhook ID). Required for non-Discord providers."
       ),
-      publicKey: import_zod2.z.string().optional().describe("Discord application public key. Required for provider=discord."),
+      publicKey: import_zod.z.string().optional().describe("Discord application public key. Required for provider=discord."),
       url: httpUrlSchema.optional().describe("Original signed URL. Required for Twilio, Square, and HubSpot verification."),
-      method: import_zod2.z.string().optional().describe(
+      method: import_zod.z.string().optional().describe(
         "Original HTTP method used when the signature was generated. Used by HubSpot v3 verification; the SDK assumes POST when omitted."
       )
     },
@@ -2046,7 +2031,7 @@ function registerTools(target, client, options = {}) {
     "clear_requests",
     "Delete captured requests for an endpoint without deleting the endpoint itself.",
     {
-      slug: import_zod2.z.string().describe("The endpoint slug to clear"),
+      slug: import_zod.z.string().describe("The endpoint slug to clear"),
       before: durationOrTimestampSchema.optional().describe('Only clear requests older than this timestamp or duration like "1h"')
     },
     withErrorHandling(async ({ slug, before }) => {
@@ -2060,12 +2045,12 @@ function registerTools(target, client, options = {}) {
     {
       url: httpUrlSchema.describe("Target URL"),
       method: methodSchema,
-      headers: import_zod2.z.record(import_zod2.z.string(), import_zod2.z.string()).optional().describe("HTTP headers to include"),
-      body: import_zod2.z.unknown().optional().describe("Request body"),
-      provider: import_zod2.z.enum(import_sdk.TEMPLATE_PROVIDERS).optional().describe("Optional provider template for signing"),
-      template: import_zod2.z.string().optional().describe("Provider-specific template preset"),
-      event: import_zod2.z.string().optional().describe("Provider event or topic name"),
-      secret: import_zod2.z.string().optional().describe(
+      headers: import_zod.z.record(import_zod.z.string(), import_zod.z.string()).optional().describe("HTTP headers to include"),
+      body: import_zod.z.unknown().optional().describe("Request body"),
+      provider: import_zod.z.enum(import_sdk.TEMPLATE_PROVIDERS).optional().describe("Optional provider template for signing"),
+      template: import_zod.z.string().optional().describe("Provider-specific template preset"),
+      event: import_zod.z.string().optional().describe("Provider event or topic name"),
+      secret: import_zod.z.string().optional().describe(
         "Signing secret. Required for signed provider templates; omit for secretless providers (sendgrid, discord, plaid)."
       )
     },
@@ -2093,12 +2078,12 @@ function registerTools(target, client, options = {}) {
     {
       url: httpUrlSchema.describe("Target URL"),
       method: methodSchema,
-      headers: import_zod2.z.record(import_zod2.z.string(), import_zod2.z.string()).optional().describe("HTTP headers to include"),
-      body: import_zod2.z.unknown().optional().describe("Request body"),
-      provider: import_zod2.z.enum(import_sdk.TEMPLATE_PROVIDERS).optional().describe("Optional provider template for signing"),
-      template: import_zod2.z.string().optional().describe("Provider-specific template preset"),
-      event: import_zod2.z.string().optional().describe("Provider event or topic name"),
-      secret: import_zod2.z.string().optional().describe(
+      headers: import_zod.z.record(import_zod.z.string(), import_zod.z.string()).optional().describe("HTTP headers to include"),
+      body: import_zod.z.unknown().optional().describe("Request body"),
+      provider: import_zod.z.enum(import_sdk.TEMPLATE_PROVIDERS).optional().describe("Optional provider template for signing"),
+      template: import_zod.z.string().optional().describe("Provider-specific template preset"),
+      event: import_zod.z.string().optional().describe("Provider event or topic name"),
+      secret: import_zod.z.string().optional().describe(
         "Signing secret. Required for signed provider templates; omit for secretless providers (sendgrid, discord, plaid)."
       )
     },
@@ -2119,7 +2104,7 @@ function registerTools(target, client, options = {}) {
     "list_provider_templates",
     "List supported webhook providers, templates, and signing metadata.",
     {
-      provider: import_zod2.z.enum(import_sdk.TEMPLATE_PROVIDERS).optional().describe("Filter to a single provider")
+      provider: import_zod.z.enum(import_sdk.TEMPLATE_PROVIDERS).optional().describe("Filter to a single provider")
     },
     withErrorHandling(async ({ provider }) => {
       if (provider) {
@@ -2173,15 +2158,15 @@ function registerTools(target, client, options = {}) {
     "test_webhook_flow",
     "Run a full webhook test flow: create endpoint, optionally mock, send, wait, verify, replay, and clean up.",
     {
-      provider: import_zod2.z.enum(import_sdk.TEMPLATE_PROVIDERS).optional().describe("Optional provider template to use when sending the webhook"),
-      event: import_zod2.z.string().optional().describe("Optional provider event or topic name"),
-      secret: import_zod2.z.string().optional().describe(
+      provider: import_zod.z.enum(import_sdk.TEMPLATE_PROVIDERS).optional().describe("Optional provider template to use when sending the webhook"),
+      event: import_zod.z.string().optional().describe("Optional provider event or topic name"),
+      secret: import_zod.z.string().optional().describe(
         "Signing secret. Required when provider is set or signature verification is enabled."
       ),
-      mockStatus: import_zod2.z.number().int().min(100).max(599).optional().describe("Optional mock response status to configure before sending"),
+      mockStatus: import_zod.z.number().int().min(100).max(599).optional().describe("Optional mock response status to configure before sending"),
       targetUrl: httpUrlSchema.optional().describe("Optional URL to replay the captured request to after capture"),
-      verifySignature: import_zod2.z.boolean().default(false).describe("Verify the captured request signature after capture"),
-      cleanup: import_zod2.z.boolean().default(true).describe("Delete the created endpoint after the flow completes")
+      verifySignature: import_zod.z.boolean().default(false).describe("Verify the captured request signature after capture"),
+      cleanup: import_zod.z.boolean().default(true).describe("Delete the created endpoint after the flow completes")
     },
     withErrorHandling(
       async ({
@@ -2256,14 +2241,14 @@ function registerTools(target, client, options = {}) {
     "list_emails",
     "List the emails an endpoint received at its mailhooks.cc address, newest first: subject, sender, tag, and the one-time code and main link found in each.",
     {
-      endpointSlug: import_zod2.z.string().describe("The endpoint slug"),
-      limit: import_zod2.z.number().int().min(1).max(100).default(25).describe(
+      endpointSlug: import_zod.z.string().describe("The endpoint slug"),
+      limit: import_zod.z.number().int().min(1).max(100).default(25).describe(
         `Max emails to return. With tag, subject or from, the newest ${EMAIL_SCAN_LIMIT} emails are searched.`
       ),
-      since: import_zod2.z.number().optional().describe("Only emails received after this timestamp in ms"),
-      tag: import_zod2.z.string().optional().describe("Only emails sent to {slug}+{tag}@mailhooks.cc (exact, case-sensitive)"),
-      subject: import_zod2.z.string().optional().describe("Only emails whose subject contains this text"),
-      from: import_zod2.z.string().optional().describe("Only emails from this address (case-insensitive)")
+      since: import_zod.z.number().optional().describe("Only emails received after this timestamp in ms"),
+      tag: import_zod.z.string().optional().describe("Only emails sent to {slug}+{tag}@mailhooks.cc (exact, case-sensitive)"),
+      subject: import_zod.z.string().optional().describe("Only emails whose subject contains this text"),
+      from: import_zod.z.string().optional().describe("Only emails from this address (case-insensitive)")
     },
     withErrorHandling(async ({ endpointSlug, limit, since, tag, subject, from }) => {
       const filtered = tag !== void 0 || subject !== void 0 || from !== void 0;
@@ -2281,10 +2266,10 @@ function registerTools(target, client, options = {}) {
     "get_email",
     "Get one captured email: by requestId, or the newest at an endpoint (optionally with a tag). Returns the parsed message with its one-time code and main link.",
     {
-      requestId: import_zod2.z.string().optional().describe("The email's request ID"),
-      endpointSlug: import_zod2.z.string().optional().describe("Get the newest email at this endpoint instead (with requestId unset)"),
-      tag: import_zod2.z.string().optional().describe("With endpointSlug: only emails sent to this +tag"),
-      includeHtml: import_zod2.z.boolean().default(false).describe("Include the HTML part (default: false, only its size)")
+      requestId: import_zod.z.string().optional().describe("The email's request ID"),
+      endpointSlug: import_zod.z.string().optional().describe("Get the newest email at this endpoint instead (with requestId unset)"),
+      tag: import_zod.z.string().optional().describe("With endpointSlug: only emails sent to this +tag"),
+      includeHtml: import_zod.z.boolean().default(false).describe("Include the HTML part (default: false, only its size)")
     },
     withErrorHandling(async ({ requestId, endpointSlug, tag, includeHtml }) => {
       if (requestId === void 0 === (endpointSlug === void 0)) {
@@ -2307,15 +2292,15 @@ function registerTools(target, client, options = {}) {
     "wait_for_email",
     "Wait for an email to arrive at an endpoint (for example after triggering a signup), then return it with its one-time code and main link. Use a tag per run to find your own email.",
     {
-      endpointSlug: import_zod2.z.string().describe("The endpoint slug"),
-      tag: import_zod2.z.string().optional().describe("Only emails sent to {slug}+{tag}@mailhooks.cc"),
-      subject: import_zod2.z.string().optional().describe("Only emails whose subject contains this text"),
-      from: import_zod2.z.string().optional().describe("Only emails from this address (case-insensitive)"),
+      endpointSlug: import_zod.z.string().describe("The endpoint slug"),
+      tag: import_zod.z.string().optional().describe("Only emails sent to {slug}+{tag}@mailhooks.cc"),
+      subject: import_zod.z.string().optional().describe("Only emails whose subject contains this text"),
+      from: import_zod.z.string().optional().describe("Only emails from this address (case-insensitive)"),
       timeout: durationOrTimestampSchema.default("30s").describe(
         `How long to wait (default "30s"). Keep it under your MCP client's request timeout, often 60 seconds.`
       ),
-      since: import_zod2.z.number().optional().describe("Only emails received after this timestamp in ms (default: five minutes ago)"),
-      includeHtml: import_zod2.z.boolean().default(false).describe("Include the HTML part (default: false)")
+      since: import_zod.z.number().optional().describe("Only emails received after this timestamp in ms (default: five minutes ago)"),
+      includeHtml: import_zod.z.boolean().default(false).describe("Include the HTML part (default: false)")
     },
     withErrorHandling(async ({ endpointSlug, tag, subject, from, timeout, since, includeHtml }) => {
       const view = await emailEndpointView(client, endpointSlug);
@@ -2333,8 +2318,8 @@ function registerTools(target, client, options = {}) {
     "send_test_email",
     "Deliver a sample email (with a 6-digit code and a link) to an endpoint, optionally to a +tag address. It counts as one request and skips SMTP, so sender checks do not run on it.",
     {
-      slug: import_zod2.z.string().describe("The endpoint slug"),
-      tag: import_zod2.z.string().optional().describe("Deliver to {slug}+{tag}@mailhooks.cc")
+      slug: import_zod.z.string().describe("The endpoint slug"),
+      tag: import_zod.z.string().optional().describe("Deliver to {slug}+{tag}@mailhooks.cc")
     },
     withErrorHandling(async ({ slug, tag }) => {
       const result = await client.emails.sendTest(slug, { tag });
@@ -2345,8 +2330,8 @@ function registerTools(target, client, options = {}) {
     "list_destinations",
     "List where an endpoint's captures go: its destinations (up to 10) with their URL, kinds, filter, format, templates and timing, and with summary: true their last 24 hours. Owner only.",
     {
-      slug: import_zod2.z.string().describe("The endpoint slug"),
-      summary: import_zod2.z.boolean().default(true).describe("Add each destination's last 24 hours")
+      slug: import_zod.z.string().describe("The endpoint slug"),
+      summary: import_zod.z.boolean().default(true).describe("Add each destination's last 24 hours")
     },
     withErrorHandling(async ({ slug, summary }) => {
       return jsonContent(await client.destinations.list(slug, { summary }));
@@ -2356,7 +2341,7 @@ function registerTools(target, client, options = {}) {
     "add_destination",
     "Add a destination for an endpoint's captures: your server (as received or signed JSON), a Slack or Discord channel (chat, optionally your own messageTemplate, throttleSeconds 1 for a heads-up), or a JSON body you shape with bodyTemplate (for Zapier, n8n or your API). filter sends only matching captures; delaySeconds makes it a callback. Each destination gets its own signing secret. Check it with preview_destination before relying on it. Owner only.",
     {
-      slug: import_zod2.z.string().describe("The endpoint slug"),
+      slug: import_zod.z.string().describe("The endpoint slug"),
       url: httpUrlSchema.describe("https URL on a public host name, or a Slack or Discord webhook"),
       ...destinationFields
     },
@@ -2368,8 +2353,8 @@ function registerTools(target, client, options = {}) {
     "update_destination",
     "Change a destination: any of its fields; only the ones you pass change. Owner only.",
     {
-      slug: import_zod2.z.string().describe("The endpoint slug"),
-      destinationId: import_zod2.z.string().describe("The destination's id (from list_destinations)"),
+      slug: import_zod.z.string().describe("The endpoint slug"),
+      destinationId: import_zod.z.string().describe("The destination's id (from list_destinations)"),
       url: httpUrlSchema.optional().describe("A new URL"),
       ...destinationFields
     },
@@ -2381,8 +2366,8 @@ function registerTools(target, client, options = {}) {
     "remove_destination",
     "Remove a destination. Deliveries still waiting for it are marked failed; its log stays. Owner only.",
     {
-      slug: import_zod2.z.string().describe("The endpoint slug"),
-      destinationId: import_zod2.z.string().describe("The destination's id")
+      slug: import_zod.z.string().describe("The endpoint slug"),
+      destinationId: import_zod.z.string().describe("The destination's id")
     },
     withErrorHandling(async ({ slug, destinationId }) => {
       await client.destinations.delete(slug, destinationId);
@@ -2393,10 +2378,10 @@ function registerTools(target, client, options = {}) {
     "preview_destination",
     "Dry run of a destination against a captured request: whether its filter lets the request through and the exact request it would send (method, URL, headers, body with placeholders filled in). Nothing is sent. Use destinationId for a saved destination, destination for unsaved fields (on top of the saved ones, or with a url on their own), or both.",
     {
-      slug: import_zod2.z.string().describe("The endpoint slug"),
-      destinationId: import_zod2.z.string().optional().describe("A saved destination"),
-      destination: import_zod2.z.object({ url: httpUrlSchema.optional(), ...destinationFields }).optional().describe("Unsaved fields to try"),
-      requestId: import_zod2.z.string().optional().describe("A captured request (default: the newest of the kind it takes, or a sample)")
+      slug: import_zod.z.string().describe("The endpoint slug"),
+      destinationId: import_zod.z.string().optional().describe("A saved destination"),
+      destination: import_zod.z.object({ url: httpUrlSchema.optional(), ...destinationFields }).optional().describe("Unsaved fields to try"),
+      requestId: import_zod.z.string().optional().describe("A captured request (default: the newest of the kind it takes, or a sample)")
     },
     withErrorHandling(async ({ slug, destinationId, destination, requestId }) => {
       if (!destinationId && !destination?.url) {
@@ -2415,26 +2400,26 @@ function registerTools(target, client, options = {}) {
     "configure_forwarding",
     "Change an endpoint's primary forwarding destination (the one the endpoint's forward* fields stand for): the URL, on or off, which kinds, the format, your own headers, and the advanced options. Only the arguments you pass change. Owner only. For several destinations, filters, templates, throttling or delays, use add_destination and update_destination.",
     {
-      slug: import_zod2.z.string().describe("The endpoint slug"),
+      slug: import_zod.z.string().describe("The endpoint slug"),
       url: httpUrlSchema.nullable().optional().describe("https URL on a public host name, or null to remove it (forwarding must be off)"),
-      enabled: import_zod2.z.boolean().optional().describe("Turn forwarding on (needs a URL) or off (fails deliveries still waiting)"),
-      http: import_zod2.z.boolean().optional().describe("Forward HTTP requests"),
-      email: import_zod2.z.boolean().optional().describe("Forward emails"),
-      format: import_zod2.z.enum(["auto", "as_received", "json", "chat"]).optional().describe(
+      enabled: import_zod.z.boolean().optional().describe("Turn forwarding on (needs a URL) or off (fails deliveries still waiting)"),
+      http: import_zod.z.boolean().optional().describe("Forward HTTP requests"),
+      email: import_zod.z.boolean().optional().describe("Forward emails"),
+      format: import_zod.z.enum(["auto", "as_received", "json", "chat"]).optional().describe(
         "auto (pick from the URL), as_received (relay HTTP requests unchanged; emails as signed JSON), json (signed JSON envelope for both kinds) or chat (Slack or Discord message)"
       ),
-      headers: import_zod2.z.array(
-        import_zod2.z.object({
-          name: import_zod2.z.string().describe("Header name, e.g. Authorization"),
-          value: import_zod2.z.string().nullable().describe("Header value, or null to keep the value stored under this name")
+      headers: import_zod.z.array(
+        import_zod.z.object({
+          name: import_zod.z.string().describe("Header name, e.g. Authorization"),
+          value: import_zod.z.string().nullable().describe("Header value, or null to keep the value stored under this name")
         })
       ).max(10).optional().describe(
         "Your own headers for every delivery (not chat). Replaces the whole list; [] removes them"
       ),
-      appendPath: import_zod2.z.boolean().optional().describe("Add the path after the slug to the URL for relayed requests (default true)"),
-      retrySeconds: import_zod2.z.union([import_zod2.z.literal(0), import_zod2.z.literal(3600), import_zod2.z.literal(86400)]).optional().describe("Retry failed deliveries for 86400 (default), 3600 or 0 seconds"),
-      keepOrder: import_zod2.z.boolean().optional().describe("One delivery at a time, in capture order (default false)"),
-      sentField: import_zod2.z.string().max(128).nullable().optional().describe(
+      appendPath: import_zod.z.boolean().optional().describe("Add the path after the slug to the URL for relayed requests (default true)"),
+      retrySeconds: import_zod.z.union([import_zod.z.literal(0), import_zod.z.literal(3600), import_zod.z.literal(86400)]).optional().describe("Retry failed deliveries for 86400 (default), 3600 or 0 seconds"),
+      keepOrder: import_zod.z.boolean().optional().describe("One delivery at a time, in capture order (default false)"),
+      sentField: import_zod.z.string().max(128).nullable().optional().describe(
         "JSON body field with the sender's own timestamp, e.g. publishedAt or data.publishedAt; null clears it"
       )
     },
@@ -2460,9 +2445,9 @@ function registerTools(target, client, options = {}) {
     "get_forwarding_secret",
     "Read (or with rotate: true, replace) the whsec_ secret forwarded deliveries are signed with. Owner only. Treat the value as a credential: put it in the handler's environment, not in code.",
     {
-      slug: import_zod2.z.string().describe("The endpoint slug"),
-      destinationId: import_zod2.z.string().optional().describe("A destination (default: the endpoint's primary destination)"),
-      rotate: import_zod2.z.boolean().default(false).describe("Replace the secret; every delivery from now on uses the new one")
+      slug: import_zod.z.string().describe("The endpoint slug"),
+      destinationId: import_zod.z.string().optional().describe("A destination (default: the endpoint's primary destination)"),
+      rotate: import_zod.z.boolean().default(false).describe("Replace the secret; every delivery from now on uses the new one")
     },
     withErrorHandling(async ({ slug, destinationId, rotate }) => {
       const secret = destinationId ? rotate ? await client.destinations.rotateSecret(slug, destinationId) : await client.destinations.secret(slug, destinationId) : rotate ? await client.forwarding.rotateSecret(slug) : await client.forwarding.secret(slug);
@@ -2473,10 +2458,10 @@ function registerTools(target, client, options = {}) {
     "test_forwarding",
     "Send the endpoint's newest captured request of a kind (or a sample, or requestId) to a destination once, exactly as a delivery would go out, and report the answer. Works whether it is on or off, and whatever its filter says; nothing is retried or logged.",
     {
-      slug: import_zod2.z.string().describe("The endpoint slug"),
-      destinationId: import_zod2.z.string().optional().describe("A destination (default: the endpoint's primary destination)"),
-      kind: import_zod2.z.enum(["http", "email"]).optional().describe("Which kind to send (default: http when the destination takes HTTP requests)"),
-      requestId: import_zod2.z.string().optional().describe("With destinationId: a captured request to send")
+      slug: import_zod.z.string().describe("The endpoint slug"),
+      destinationId: import_zod.z.string().optional().describe("A destination (default: the endpoint's primary destination)"),
+      kind: import_zod.z.enum(["http", "email"]).optional().describe("Which kind to send (default: http when the destination takes HTTP requests)"),
+      requestId: import_zod.z.string().optional().describe("With destinationId: a captured request to send")
     },
     withErrorHandling(async ({ slug, destinationId, kind, requestId }) => {
       if (destinationId) {
@@ -2494,14 +2479,14 @@ function registerTools(target, client, options = {}) {
     "list_deliveries",
     "List forwarding deliveries: an endpoint's delivery log with its counts (endpointSlug), or every delivery and try of one captured request or email (requestId). Rows carry senderAt when the request had the sender's own timestamp, so receivedAt - senderAt is the time to reach webhooks.cc.",
     {
-      endpointSlug: import_zod2.z.string().optional().describe("List the endpoint's delivery log"),
-      requestId: import_zod2.z.string().optional().describe("List every delivery and try of this request"),
-      limit: import_zod2.z.number().int().min(1).max(100).default(20).describe("With endpointSlug: max rows"),
-      status: import_zod2.z.enum(["all", "pending", "failed", "skipped"]).default("all").describe(
+      endpointSlug: import_zod.z.string().optional().describe("List the endpoint's delivery log"),
+      requestId: import_zod.z.string().optional().describe("List every delivery and try of this request"),
+      limit: import_zod.z.number().int().min(1).max(100).default(20).describe("With endpointSlug: max rows"),
+      status: import_zod.z.enum(["all", "pending", "failed", "skipped"]).default("all").describe(
         "With endpointSlug: all, pending (queued or retrying), failed or skipped (filtered out)"
       ),
-      destinationId: import_zod2.z.string().optional().describe("With endpointSlug: only this destination"),
-      before: import_zod2.z.string().optional().describe("With endpointSlug: a row's cursor, to list older rows")
+      destinationId: import_zod.z.string().optional().describe("With endpointSlug: only this destination"),
+      before: import_zod.z.string().optional().describe("With endpointSlug: a row's cursor, to list older rows")
     },
     withErrorHandling(async ({ endpointSlug, requestId, limit, status, destinationId, before }) => {
       if (requestId === void 0 === (endpointSlug === void 0)) {
@@ -2528,9 +2513,9 @@ function registerTools(target, client, options = {}) {
     "redeliver",
     "Forward again with the current settings: one captured request or email (requestId; to every destination that takes it, or with destinationId to that one whatever its filter says), or every request whose latest delivery failed (endpointSlug, optionally only destinationId, oldest first, up to 1,000 at a time per destination). Owner only.",
     {
-      requestId: import_zod2.z.string().optional().describe("The request or email to send again"),
-      endpointSlug: import_zod2.z.string().optional().describe("Send every failed delivery of this endpoint again"),
-      destinationId: import_zod2.z.string().optional().describe("Only this destination")
+      requestId: import_zod.z.string().optional().describe("The request or email to send again"),
+      endpointSlug: import_zod.z.string().optional().describe("Send every failed delivery of this endpoint again"),
+      destinationId: import_zod.z.string().optional().describe("Only this destination")
     },
     withErrorHandling(async ({ requestId, endpointSlug, destinationId }) => {
       if (requestId === void 0 === (endpointSlug === void 0)) {
@@ -2547,9 +2532,9 @@ function registerTools(target, client, options = {}) {
     "share_port",
     "Share a port on this computer at a public link (https://<name>.sharehooks.cc) by running the webhooks.cc CLI (whk share), so a person can open the site you are building. Returns the link. It keeps running until stop_share, the plan's session limit, or the end of this MCP server. Asking again for the same port without a name or password returns the running link; with a name or password, the running share on that port stops and a new one starts. Free accounts get a random name ending in -free, a 2-hour limit and a notice page before the site; Pro and Business can use a reserved name and a password. Needs whk installed on this computer. For a webhook provider that must get your local app's real answer, use `whk tunnel <port> --live` instead.",
     {
-      port: import_zod2.z.number().int().min(1).max(65535).describe("The local port the site runs on"),
-      name: import_zod2.z.string().optional().describe("A name you reserved (Pro and Business); leave out for a random one"),
-      password: import_zod2.z.string().min(8).max(200).optional().describe("What visitors must type (Pro and Business), 8 to 200 characters")
+      port: import_zod.z.number().int().min(1).max(65535).describe("The local port the site runs on"),
+      name: import_zod.z.string().optional().describe("A name you reserved (Pro and Business); leave out for a random one"),
+      password: import_zod.z.string().min(8).max(200).optional().describe("What visitors must type (Pro and Business), 8 to 200 characters")
     },
     withErrorHandling(async ({ port, name, password }) => {
       const running = started.get(port);
@@ -2594,7 +2579,7 @@ function registerTools(target, client, options = {}) {
     "list_shares",
     `List your public previews of local ports (whk share${remote ? "" : ", share_port"}) and live tunnels (whk tunnel --live): live ones first, then the latest that ended, with this month's shared data and your plan's sharing limits. Not the same as share_endpoint, which shares an endpoint with a team.`,
     {
-      state: import_zod2.z.enum(["live", "ended"]).optional().describe("Only the running ones, or only the ended ones")
+      state: import_zod.z.enum(["live", "ended"]).optional().describe("Only the running ones, or only the ended ones")
     },
     withErrorHandling(async ({ state }) => {
       return jsonContent(withShareHints(await client.shares.list(state ? { state } : {}), remote));
@@ -2610,8 +2595,8 @@ function registerTools(target, client, options = {}) {
     "create_api_key",
     "Ask for a new API key for the account, for CI or another tool. The account's owner must approve it: this returns at once with a link and a code. Show the person the link and tell them to check that the page shows the same code, then call wait_for_approval with the approval id to get the key (shown once).",
     {
-      name: import_zod2.z.string().min(1).max(64).describe('A name that says where the key is used, such as "GitHub Actions"'),
-      expiresInDays: import_zod2.z.number().int().min(1).max(365).optional().describe("How many days the key works, 1 to 365 (default 90)")
+      name: import_zod.z.string().min(1).max(64).describe('A name that says where the key is used, such as "GitHub Actions"'),
+      expiresInDays: import_zod.z.number().int().min(1).max(365).optional().describe("How many days the key works, 1 to 365 (default 90)")
     },
     withErrorHandling(async ({ name, expiresInDays }) => {
       const pending = await client.apiKeys.create({ name, expiresInDays });
@@ -2626,7 +2611,7 @@ function registerTools(target, client, options = {}) {
     "wait_for_approval",
     "Wait for the account's owner to answer an approval (from create_api_key, create_share_link, remove_domain, rename_account, delete_team, invite_to_team, connect_google, pick_spreadsheet or ai_setup) and collect what it grants or did, such as the new API key, the share link or AI setup's proposals. If they have not answered yet, call it again.",
     {
-      id: import_zod2.z.string().describe("The approval id"),
+      id: import_zod.z.string().describe("The approval id"),
       timeout: durationOrTimestampSchema.default("45s").describe('How long to wait for the person, for example "45s"')
     },
     withErrorHandling(async ({ id, timeout }) => {
@@ -2658,7 +2643,7 @@ function registerTools(target, client, options = {}) {
     "revoke_api_key",
     "Revoke one of the account's API keys by its id (from list_api_keys). Anything using it stops working at once.",
     {
-      id: import_zod2.z.string().describe("The key's id, from list_api_keys")
+      id: import_zod.z.string().describe("The key's id, from list_api_keys")
     },
     withErrorHandling(async ({ id }) => {
       await client.apiKeys.revoke(id);
@@ -2669,7 +2654,7 @@ function registerTools(target, client, options = {}) {
     "rename_account",
     "Set the account's display name, or clear it with null. The account's owner must approve it: this returns a link and a code to show them, then call wait_for_approval.",
     {
-      name: import_zod2.z.string().min(1).max(100).nullable().describe("The new display name, or null to clear it")
+      name: import_zod.z.string().min(1).max(100).nullable().describe("The new display name, or null to clear it")
     },
     withErrorHandling(async ({ name }) => {
       const pending = await client.account.rename(name);
@@ -2687,7 +2672,7 @@ function registerTools(target, client, options = {}) {
     "disconnect_agent",
     "Disconnect an agent by its id (from list_connected_agents): its tokens stop working at once. The endpoints it made stay in the account. Disconnecting the agent you are running as ends your own access.",
     {
-      id: import_zod2.z.string().describe("The agent's id, from list_connected_agents")
+      id: import_zod.z.string().describe("The agent's id, from list_connected_agents")
     },
     withErrorHandling(async ({ id }) => {
       await client.agents.disconnect(id);
@@ -2698,7 +2683,7 @@ function registerTools(target, client, options = {}) {
     "list_share_links",
     "List live public links to frozen copies of requests (/s/<token>), the account's or one request's. Not the same as list_shares, which lists port previews and live tunnels.",
     {
-      requestId: import_zod2.z.string().optional().describe("Only the links to this request")
+      requestId: import_zod.z.string().optional().describe("Only the links to this request")
     },
     withErrorHandling(async ({ requestId }) => {
       const links = requestId ? await client.shareLinks.forRequest(requestId) : await client.shareLinks.list();
@@ -2709,9 +2694,9 @@ function registerTools(target, client, options = {}) {
     "create_share_link",
     "Make a public link to a read-only copy of one HTTP request (not an email), for a teammate or a bug report. Anyone with the link can read it, so the account's owner must approve: this returns a link and a code to show them, then call wait_for_approval for the share link.",
     {
-      requestId: import_zod2.z.string().describe("The request's id"),
-      expiresInDays: import_zod2.z.union([import_zod2.z.literal(1), import_zod2.z.literal(7), import_zod2.z.literal(30)]).optional().describe("How long the link works: 1, 7 or 30 days (default 7)"),
-      hideSensitive: import_zod2.z.boolean().optional().describe(
+      requestId: import_zod.z.string().describe("The request's id"),
+      expiresInDays: import_zod.z.union([import_zod.z.literal(1), import_zod.z.literal(7), import_zod.z.literal(30)]).optional().describe("How long the link works: 1, 7 or 30 days (default 7)"),
+      hideSensitive: import_zod.z.boolean().optional().describe(
         "Also leave out signature and token headers (default true). Credentials are always left out."
       )
     },
@@ -2725,14 +2710,14 @@ function registerTools(target, client, options = {}) {
     "revoke_share_link",
     "Revoke a share link by its id (from list_share_links): its page answers 404 from then on.",
     {
-      id: import_zod2.z.string().describe("The link's id, from list_share_links")
+      id: import_zod.z.string().describe("The link's id, from list_share_links")
     },
     withErrorHandling(async ({ id }) => {
       await client.shareLinks.revoke(id);
       return textContent(`Revoked the share link ${id}.`);
     })
   );
-  const teamIdSchema = import_zod2.z.string().optional().describe("A Team Business team's id (its owner only); leave out for your own account");
+  const teamIdSchema = import_zod.z.string().optional().describe("A Team Business team's id (its owner only); leave out for your own account");
   server.tool(
     "list_domains",
     "List custom inbound domains (Business): each one's status, DNS records to publish, routes and catch-all endpoint.",
@@ -2743,7 +2728,7 @@ function registerTools(target, client, options = {}) {
     "add_domain",
     "Add a custom inbound domain (Business) so mail to it is captured. Returns the TXT and MX records to publish; then call verify_domain.",
     {
-      domain: import_zod2.z.string().min(1).max(253).describe("The domain, such as mail.example.com"),
+      domain: import_zod.z.string().min(1).max(253).describe("The domain, such as mail.example.com"),
       teamId: teamIdSchema
     },
     withErrorHandling(
@@ -2754,7 +2739,7 @@ function registerTools(target, client, options = {}) {
     "verify_domain",
     "Look a custom domain's TXT and MX records up now. It receives mail once both are found.",
     {
-      id: import_zod2.z.string().describe("The domain's id, from list_domains"),
+      id: import_zod.z.string().describe("The domain's id, from list_domains"),
       teamId: teamIdSchema
     },
     withErrorHandling(
@@ -2765,12 +2750,12 @@ function registerTools(target, client, options = {}) {
     "route_domain",
     "Set where a custom domain's mail goes: routes by local part (the part before @) to endpoints, everything else to a catch-all endpoint, or refused when the catch-all is null. Replaces the domain's routing.",
     {
-      id: import_zod2.z.string().describe("The domain's id, from list_domains"),
-      catchAllEndpointId: import_zod2.z.string().nullable().describe("The endpoint id for mail no route matches, or null to refuse it"),
-      routes: import_zod2.z.array(
-        import_zod2.z.object({
-          localPart: import_zod2.z.string().max(64).describe("The part before @"),
-          endpointId: import_zod2.z.string().describe("The endpoint's id")
+      id: import_zod.z.string().describe("The domain's id, from list_domains"),
+      catchAllEndpointId: import_zod.z.string().nullable().describe("The endpoint id for mail no route matches, or null to refuse it"),
+      routes: import_zod.z.array(
+        import_zod.z.object({
+          localPart: import_zod.z.string().max(64).describe("The part before @"),
+          endpointId: import_zod.z.string().describe("The endpoint's id")
         })
       ).max(100).default([]).describe("Routes by local part"),
       teamId: teamIdSchema
@@ -2783,7 +2768,7 @@ function registerTools(target, client, options = {}) {
     "remove_domain",
     "Remove a custom inbound domain: mail to it is refused from then on. The account's owner must approve it: this returns a link and a code to show them, then call wait_for_approval.",
     {
-      id: import_zod2.z.string().describe("The domain's id, from list_domains"),
+      id: import_zod.z.string().describe("The domain's id, from list_domains"),
       teamId: teamIdSchema
     },
     withErrorHandling(async ({ id, teamId }) => {
@@ -2808,7 +2793,7 @@ function registerTools(target, client, options = {}) {
     "pick_spreadsheet",
     "Have the account's owner choose an existing spreadsheet from Google Drive with a connected account (to add rows to it from a Sheets destination). Returns a link and a code to show them; the page opens Google's picker. Then call wait_for_approval for the spreadsheet's id and tabs. To use a new spreadsheet instead, call create_spreadsheet.",
     {
-      connectionId: import_zod2.z.string().describe("The Google connection's id, from list_google_connections")
+      connectionId: import_zod.z.string().describe("The Google connection's id, from list_google_connections")
     },
     withErrorHandling(
       async ({ connectionId }) => textContent(approvalAskText(await client.google.pick(connectionId)))
@@ -2818,10 +2803,10 @@ function registerTools(target, client, options = {}) {
     "create_spreadsheet",
     "Create a new spreadsheet with a header row in a connected Google account, for a Sheets destination. Needs no approval: the app reaches only spreadsheets it created or that were chosen for it.",
     {
-      connectionId: import_zod2.z.string().describe("The Google connection's id, from list_google_connections"),
-      title: import_zod2.z.string().max(200).optional().describe("The spreadsheet's title"),
-      sheet: import_zod2.z.string().max(100).optional().describe('The tab rows go to (default "Sheet1")'),
-      headers: import_zod2.z.array(import_zod2.z.string().max(200)).max(50).describe("The header row, one per column")
+      connectionId: import_zod.z.string().describe("The Google connection's id, from list_google_connections"),
+      title: import_zod.z.string().max(200).optional().describe("The spreadsheet's title"),
+      sheet: import_zod.z.string().max(100).optional().describe('The tab rows go to (default "Sheet1")'),
+      headers: import_zod.z.array(import_zod.z.string().max(200)).max(50).describe("The header row, one per column")
     },
     withErrorHandling(
       async ({ connectionId, title, sheet, headers }) => jsonContent(await client.google.createSpreadsheet({ connectionId, title, sheet, headers }))
@@ -2831,8 +2816,8 @@ function registerTools(target, client, options = {}) {
     "list_sheet_tabs",
     "List a spreadsheet's tabs (one created by the app or chosen with pick_spreadsheet), to choose the one a Sheets destination writes to.",
     {
-      connectionId: import_zod2.z.string().describe("The Google connection's id"),
-      spreadsheetId: import_zod2.z.string().describe("The spreadsheet's id")
+      connectionId: import_zod.z.string().describe("The Google connection's id"),
+      spreadsheetId: import_zod.z.string().describe("The spreadsheet's id")
     },
     withErrorHandling(
       async ({ connectionId, spreadsheetId }) => jsonContent({ tabs: await client.google.tabs(connectionId, spreadsheetId) })
@@ -2842,7 +2827,7 @@ function registerTools(target, client, options = {}) {
     "disconnect_google",
     "Disconnect a Google account (id from list_google_connections) and revoke its access at Google. Sheets destinations using it fail until another account is chosen.",
     {
-      connectionId: import_zod2.z.string().describe("The Google connection's id")
+      connectionId: import_zod.z.string().describe("The Google connection's id")
     },
     withErrorHandling(async ({ connectionId }) => {
       await client.google.disconnect(connectionId);
@@ -2853,7 +2838,7 @@ function registerTools(target, client, options = {}) {
     "ai_setup_status",
     "Whether AI setup is offered for an endpoint, and how many AI assists the plan has left in a rolling 30 days.",
     {
-      slug: import_zod2.z.string().describe("The endpoint's slug")
+      slug: import_zod.z.string().describe("The endpoint's slug")
     },
     withErrorHandling(async ({ slug }) => jsonContent(await client.ai.status(slug)))
   );
@@ -2861,25 +2846,25 @@ function registerTools(target, client, options = {}) {
     "ai_setup",
     "Have AI propose email fields (or a layout, or a repaired field) from 1 to 5 of an endpoint's captured emails. It sends those emails (subject, sender, recipients, text, headers; never attachments) to Anthropic's model, so the account's owner must approve it: this returns a link and a code to show them, and the page lists the emails. Then call wait_for_approval for the proposals, each with the value it found in every email. Nothing is saved: apply the fields with update_endpoint. Uses one AI assist.",
     {
-      slug: import_zod2.z.string().describe("The endpoint's slug"),
-      requestIds: import_zod2.z.array(import_zod2.z.string()).min(1).max(5).describe("1 to 5 of the endpoint's email request ids, from list_emails"),
-      ask: import_zod2.z.union([
-        import_zod2.z.object({
-          kind: import_zod2.z.literal("field"),
-          name: import_zod2.z.string().describe("The field's name: letters, digits and _"),
-          description: import_zod2.z.string().describe('What the field is, such as "the order number"')
+      slug: import_zod.z.string().describe("The endpoint's slug"),
+      requestIds: import_zod.z.array(import_zod.z.string()).min(1).max(5).describe("1 to 5 of the endpoint's email request ids, from list_emails"),
+      ask: import_zod.z.union([
+        import_zod.z.object({
+          kind: import_zod.z.literal("field"),
+          name: import_zod.z.string().describe("The field's name: letters, digits and _"),
+          description: import_zod.z.string().describe('What the field is, such as "the order number"')
         }),
-        import_zod2.z.object({
-          kind: import_zod2.z.literal("layout"),
-          description: import_zod2.z.string().optional().describe("What these emails are")
+        import_zod.z.object({
+          kind: import_zod.z.literal("layout"),
+          description: import_zod.z.string().optional().describe("What these emails are")
         }),
-        import_zod2.z.object({
-          kind: import_zod2.z.literal("repair"),
-          field: import_zod2.z.object({
-            name: import_zod2.z.string(),
-            from: import_zod2.z.string(),
-            header: import_zod2.z.string().optional(),
-            pattern: import_zod2.z.string()
+        import_zod.z.object({
+          kind: import_zod.z.literal("repair"),
+          field: import_zod.z.object({
+            name: import_zod.z.string(),
+            from: import_zod.z.string(),
+            header: import_zod.z.string().optional(),
+            pattern: import_zod.z.string()
           }).describe("The field to repair, as the endpoint has it")
         })
       ]).describe("What to propose")
@@ -2899,7 +2884,7 @@ function registerTools(target, client, options = {}) {
     "stop_share",
     "Stop a public preview or live tunnel by its id (from list_shares). The CLI running it is told why and exits.",
     {
-      id: import_zod2.z.string().describe("The share's id, from list_shares")
+      id: import_zod.z.string().describe("The share's id, from list_shares")
     },
     withErrorHandling(async ({ id }) => {
       const result = await client.shares.stop(id);
@@ -2915,7 +2900,7 @@ function registerTools(target, client, options = {}) {
     "share_requests",
     "The last requests visitors made to a running preview (from list_shares), newest first: method, path, status, time, size, country, device and a number per visitor, never an address. Use it to see whether the person opened the link and what failed for them. `available` is false when the log could not be read just now.",
     {
-      id: import_zod2.z.string().describe("The share's id, from list_shares")
+      id: import_zod.z.string().describe("The share's id, from list_shares")
     },
     withErrorHandling(async ({ id }) => {
       return jsonContent(await client.shares.requests(id));
@@ -2933,8 +2918,8 @@ function registerTools(target, client, options = {}) {
     "reserve_name",
     `Reserve a preview name, so ${shareWith} can use the link https://<name>.sharehooks.cc (Pro and Business). Lowercase letters, digits and dashes; names that look like random ones or end in -free are refused. With team, the name belongs to that team and every member may share under it.`,
     {
-      name: import_zod2.z.string().min(1).max(63).describe("The name: lowercase letters, digits and dashes"),
-      team: import_zod2.z.string().optional().describe("A team's id or name (from list_teams), to keep the name inside that team")
+      name: import_zod.z.string().min(1).max(63).describe("The name: lowercase letters, digits and dashes"),
+      team: import_zod.z.string().optional().describe("A team's id or name (from list_teams), to keep the name inside that team")
     },
     withErrorHandling(async ({ name, team }) => {
       return jsonContent(await client.names.reserve(name, team ? { team } : {}));
@@ -2944,7 +2929,7 @@ function registerTools(target, client, options = {}) {
     "release_name",
     "Release a reserved preview name you kept (or, for a team name, as the team's owner). A preview running under it stops, and the link stops working.",
     {
-      name: import_zod2.z.string().min(1).max(63).describe("The name, from list_names")
+      name: import_zod.z.string().min(1).max(63).describe("The name, from list_names")
     },
     withErrorHandling(async ({ name }) => {
       await client.names.release(name);
@@ -2955,8 +2940,8 @@ function registerTools(target, client, options = {}) {
     "set_name_password",
     "Put a password on every preview under a reserved name (Pro and Business): visitors must type it before the page opens. The password is not shown back; give it to the person yourself.",
     {
-      name: import_zod2.z.string().min(1).max(63).describe("The name, from list_names"),
-      password: import_zod2.z.string().min(8).max(200).describe("What visitors must type, 8 to 200 characters")
+      name: import_zod.z.string().min(1).max(63).describe("The name, from list_names"),
+      password: import_zod.z.string().min(8).max(200).describe("What visitors must type, 8 to 200 characters")
     },
     withErrorHandling(async ({ name, password }) => {
       await client.names.setPassword(name, password);
@@ -2967,7 +2952,7 @@ function registerTools(target, client, options = {}) {
     "clear_name_password",
     "Take the password off a reserved name, so its previews open without one.",
     {
-      name: import_zod2.z.string().min(1).max(63).describe("The name, from list_names")
+      name: import_zod.z.string().min(1).max(63).describe("The name, from list_names")
     },
     withErrorHandling(async ({ name }) => {
       await client.names.clearPassword(name);
@@ -2986,18 +2971,440 @@ function registerTools(target, client, options = {}) {
   return handles;
 }
 
-// src/sandbox-tools.ts
-var SANDBOX = {
-  maxEndpoints: 3,
-  requestsPerEndpoint: 25,
-  requests: 100,
-  lifetimeHours: 24
-};
-var DEFAULT_WAIT_SECONDS = 45;
-var MAX_WAIT_SECONDS = 600;
-var DOCS_URL = "https://webhooks.cc/docs/agents";
-var ACCOUNT_ONLY_OPTIONS = [
-  "mockResponse",
+// src/local-tools.ts
+function asToolServer(server) {
+  return {
+    tool(name, description, shape, handler, annotations) {
+      const registered = server.registerTool(
+        name,
+        {
+          title: annotations?.title,
+          description,
+          inputSchema: import_zod2.z.object(shape),
+          annotations
+        },
+        async (args) => handler(args)
+      );
+      return { remove: () => registered.remove() };
+    }
+  };
+}
+var warned = /* @__PURE__ */ new Set();
+function toolSelection(options = {}) {
+  const fromOption = options.tools !== void 0;
+  const parsed = parseToolGroups(fromOption ? options.tools : process.env.WHK_MCP_TOOLS);
+  const setting = fromOption ? options.tools : process.env.WHK_MCP_TOOLS;
+  if (parsed && parsed.unknown.length > 0 && !warned.has(setting ?? "")) {
+    warned.add(setting ?? "");
+    console.error(
+      `webhooks-cc-mcp: unknown tool groups in ${fromOption ? "tools" : "WHK_MCP_TOOLS"}: ${parsed.unknown.join(", ")} (known: all, ${TOOL_GROUP_NAMES.join(", ")})`
+    );
+  }
+  const readOnly = options.readOnly ?? /^(1|true|yes|on)$/i.test((process.env.WHK_MCP_READ_ONLY ?? "").trim());
+  return { groups: parsed?.groups ?? null, readOnly };
+}
+var EXTRA_GROUPS = TOOL_GROUP_NAMES.filter((group2) => group2 !== "core");
+var ENABLE_TOOLS_ANNOTATIONS = {
+  title: toolTitle(ENABLE_TOOLS),
+  readOnlyHint: false,
+  destructiveHint: false,
+  idempotentHint: true,
+  openWorldHint: false
+};
+var LocalToolGroups = class {
+  constructor(server, selection) {
+    this.server = server;
+    this.selection = selection;
+    this.client = null;
+    this.loaded = /* @__PURE__ */ new Set();
+    this.handles = [];
+    this.enableTools = null;
+    this.clientKnown = false;
+  }
+  /** The groups an account's tools start with. */
+  startingGroups() {
+    if (this.selection.groups) return [...this.selection.groups];
+    return this.clientKnown && clientLoadsEverything(this.clientName) ? [...TOOL_GROUP_NAMES] : ["core"];
+  }
+  /** Registers the tools for an account; the handle removes them all again. */
+  show(client) {
+    this.hide();
+    this.client = client;
+    this.load(this.startingGroups());
+    return { remove: () => this.hide() };
+  }
+  /** Removes every account tool, enable_tools included. */
+  hide() {
+    for (const handle of this.handles) handle.remove();
+    this.enableTools?.remove();
+    this.handles = [];
+    this.enableTools = null;
+    this.loaded.clear();
+    this.client = null;
+  }
+  /** The groups loaded now. */
+  loadedGroups() {
+    return TOOL_GROUP_NAMES.filter((group2) => this.loaded.has(group2));
+  }
+  /**
+   * The client named itself (initialize, or a 2026-07-28 request's _meta).
+   * Without a WHK_MCP_TOOLS setting, a client that takes long tool lists
+   * gets every group. Only the first name counts.
+   */
+  clientIdentified(name) {
+    if (this.clientKnown) return;
+    this.clientKnown = true;
+    this.clientName = name;
+    if (this.selection.groups || !clientLoadsEverything(name)) return;
+    if (this.client) this.load(TOOL_GROUP_NAMES);
+  }
+  /** Registers the groups not loaded yet; returns the tools each one added. */
+  load(groups) {
+    const client = this.client;
+    const fresh = groups.filter((group2) => !this.loaded.has(group2));
+    if (!client || fresh.length === 0) return {};
+    const added = {};
+    for (const group2 of fresh) added[group2] = [];
+    const server = this.server;
+    const recorder = {
+      tool(name, description, shape, handler, annotations) {
+        added[TOOL_CATALOG[name].group]?.push(name);
+        return server.tool(name, description, shape, handler, annotations);
+      }
+    };
+    this.handles.push(
+      ...registerTools(recorder, client, {
+        groups: new Set(fresh),
+        readOnly: this.selection.readOnly
+      })
+    );
+    for (const group2 of fresh) this.loaded.add(group2);
+    this.showEnableTools();
+    return added;
+  }
+  /** (Re)registers enable_tools with the current groups, or drops it once all are loaded. */
+  showEnableTools() {
+    this.enableTools?.remove();
+    this.enableTools = null;
+    const left = EXTRA_GROUPS.filter((group2) => !this.loaded.has(group2));
+    if (!this.client || left.length === 0) return;
+    const lines = EXTRA_GROUPS.map(
+      (group2) => `- ${group2}${this.loaded.has(group2) ? " (loaded)" : ""}: ${TOOL_GROUPS[group2]}`
+    );
+    const description = [
+      "Load more webhooks.cc tools into this session. This server lists its core tools by default; the rest come in groups. If a tool you need is missing, load its group, then look at the tool list again.",
+      "Groups:",
+      ...lines,
+      this.selection.readOnly ? "This server is read-only (WHK_MCP_READ_ONLY): a group brings only its tools that change nothing." : null
+    ].filter(Boolean).join("\n");
+    this.enableTools = this.server.tool(
+      ENABLE_TOOLS,
+      description,
+      {
+        groups: import_zod2.z.array(import_zod2.z.enum([...EXTRA_GROUPS, "all"])).min(1).describe('Groups to load, or ["all"]')
+      },
+      withErrorHandling(async ({ groups }) => {
+        const wanted = groups.includes("all") ? [...TOOL_GROUP_NAMES] : groups;
+        const already = wanted.filter((group2) => group2 !== "core" && this.loaded.has(group2));
+        const added = this.load(wanted);
+        const loadedNow = Object.keys(added).length > 0;
+        return jsonContent({
+          added,
+          ...already.length > 0 ? { alreadyLoaded: [...new Set(already)] } : {},
+          loaded: this.loadedGroups(),
+          ...this.selection.readOnly ? { readOnly: true } : {},
+          note: loadedNow ? "The tool list changed. If your client does not show the new tools, ask the user to set WHK_MCP_TOOLS (for example all) and restart the server." : "Nothing new to load."
+        });
+      }),
+      ENABLE_TOOLS_ANNOTATIONS
+    );
+  }
+};
+function modernClientName(message) {
+  if (typeof message !== "object" || message === null) return null;
+  const params = message.params;
+  const info = params?._meta?.[import_server.CLIENT_INFO_META_KEY];
+  if (typeof info !== "object" || info === null) return null;
+  const name = info.name;
+  return typeof name === "string" ? name : void 0;
+}
+function watchClient(server, groups) {
+  const low = server.server;
+  const initialized = low.oninitialized;
+  low.oninitialized = () => {
+    initialized?.();
+    groups.clientIdentified(low.getClientVersion()?.name);
+  };
+  const connect = server.connect.bind(server);
+  server.connect = async (transport) => {
+    const previous = transport.onmessage;
+    transport.onmessage = (message, extra) => {
+      const name = modernClientName(message);
+      if (name !== null) groups.clientIdentified(name);
+      previous?.call(transport, message, extra);
+    };
+    return connect(transport);
+  };
+}
+function localToolGroups(server, selection) {
+  const groups = new LocalToolGroups(asToolServer(server), selection);
+  watchClient(server, groups);
+  return groups;
+}
+
+// src/prompts.ts
+var import_zod3 = require("zod");
+function registerPrompts(server) {
+  server.registerPrompt(
+    "debug_webhook_delivery",
+    {
+      title: "Debug Webhook Delivery",
+      description: "Guide an agent through diagnosing why webhook delivery is failing or missing.",
+      argsSchema: import_zod3.z.object({
+        provider: import_zod3.z.string().optional().describe("Webhook provider, if known"),
+        endpointSlug: import_zod3.z.string().optional().describe("Hosted endpoint slug, if known"),
+        targetUrl: import_zod3.z.string().optional().describe("Your app's receiving URL, if known")
+      })
+    },
+    async ({ provider, endpointSlug, targetUrl }) => {
+      const scope = [
+        provider ? `Provider: ${provider}.` : null,
+        endpointSlug ? `Endpoint slug: ${endpointSlug}.` : null,
+        targetUrl ? `Target URL: ${targetUrl}.` : null
+      ].filter(Boolean).join(" ");
+      return {
+        description: "Diagnose a missing or broken webhook delivery.",
+        messages: [
+          {
+            role: "user",
+            content: {
+              type: "text",
+              text: [
+                scope,
+                "Diagnose webhook delivery step by step.",
+                "Use list_endpoints or get_endpoint to confirm the endpoint and URL.",
+                "Use list_requests, wait_for_request, or wait_for_requests to check whether anything arrived.",
+                "If the provider is known, use preview_webhook or send_webhook to reproduce the webhook with realistic signing.",
+                "Use verify_signature when a secret is available.",
+                "Use compare_requests to compare retries or changed payloads.",
+                "Conclude with the most likely cause and the next concrete fix."
+              ].filter(Boolean).join(" ")
+            }
+          }
+        ]
+      };
+    }
+  );
+  server.registerPrompt(
+    "setup_provider_testing",
+    {
+      title: "Setup Provider Testing",
+      description: "Guide an agent through setting up webhook testing for a provider.",
+      argsSchema: import_zod3.z.object({
+        provider: import_zod3.z.string().describe("Webhook provider to test"),
+        targetUrl: import_zod3.z.string().optional().describe("Optional local or remote target URL")
+      })
+    },
+    async ({ provider, targetUrl }) => {
+      return {
+        description: `Set up webhook testing for ${provider}.`,
+        messages: [
+          {
+            role: "user",
+            content: {
+              type: "text",
+              text: [
+                `Set up webhook testing for ${provider}.`,
+                "Use list_provider_templates to inspect supported templates and signing details first.",
+                "Create an endpoint with create_endpoint, preferably ephemeral.",
+                "If a target URL is provided, use preview_webhook before send_to so the request shape is visible.",
+                targetUrl ? `Target URL: ${targetUrl}.` : null,
+                "Send a realistic provider webhook, wait for capture, and verify the signature if a secret is available.",
+                "Once real deliveries are captured, use generate_payload_schema to write the payload types for the handler.",
+                "Return the endpoint URL, the exact tools used, and the next step for the developer."
+              ].filter(Boolean).join(" ")
+            }
+          }
+        ]
+      };
+    }
+  );
+  server.registerPrompt(
+    "compare_webhook_attempts",
+    {
+      title: "Compare Webhook Attempts",
+      description: "Guide an agent through comparing two webhook deliveries or retries.",
+      argsSchema: import_zod3.z.object({
+        endpointSlug: import_zod3.z.string().optional().describe("Endpoint slug to inspect for recent attempts"),
+        leftRequestId: import_zod3.z.string().optional().describe("First request ID, if already known"),
+        rightRequestId: import_zod3.z.string().optional().describe("Second request ID, if already known")
+      })
+    },
+    async ({ endpointSlug, leftRequestId, rightRequestId }) => {
+      return {
+        description: "Compare two webhook deliveries and explain the difference.",
+        messages: [
+          {
+            role: "user",
+            content: {
+              type: "text",
+              text: [
+                endpointSlug ? `Endpoint slug: ${endpointSlug}.` : null,
+                leftRequestId && rightRequestId ? `Compare request ${leftRequestId} against ${rightRequestId}.` : "Find the most relevant two webhook attempts first.",
+                "Use compare_requests for the structured diff.",
+                "If request IDs are not provided, use list_requests or the endpoint recent resource to find the last two attempts.",
+                "Explain what changed in the body, headers, or timing, and whether the difference looks expected, retried, or broken."
+              ].filter(Boolean).join(" ")
+            }
+          }
+        ]
+      };
+    }
+  );
+}
+
+// src/resources.ts
+var import_server2 = require("@modelcontextprotocol/server");
+var ENDPOINTS_RESOURCE_URI = "webhooks://endpoints";
+var ENDPOINT_RECENT_TEMPLATE_URI = "webhooks://endpoint/{slug}/recent";
+var REQUEST_TEMPLATE_URI = "webhooks://request/{id}";
+var MAX_ENDPOINT_RESOURCE_ITEMS = 25;
+var RECENT_REQUEST_LIMIT = 10;
+function jsonResource(uri, value) {
+  return {
+    contents: [
+      {
+        uri,
+        mimeType: "application/json",
+        text: JSON.stringify(value, null, 2)
+      }
+    ]
+  };
+}
+function summarizeRequest(request) {
+  return {
+    id: request.id,
+    method: request.method,
+    path: request.path,
+    receivedAt: request.receivedAt,
+    contentType: request.contentType ?? null
+  };
+}
+function variableToString(value, name) {
+  if (typeof value === "string" && value.length > 0) {
+    return value;
+  }
+  throw new Error(`Missing resource variable "${name}"`);
+}
+async function listEndpointSummaries(client) {
+  const endpoints = (await client.endpoints.list()).slice().sort((left, right) => right.createdAt - left.createdAt);
+  const truncated = endpoints.length > MAX_ENDPOINT_RESOURCE_ITEMS;
+  const visible = endpoints.slice(0, MAX_ENDPOINT_RESOURCE_ITEMS);
+  const summaries = await Promise.all(
+    visible.map(async (endpoint) => {
+      const recent = await client.requests.list(endpoint.slug, { limit: 1 });
+      return {
+        ...endpoint,
+        lastRequest: recent[0] ? summarizeRequest(recent[0]) : null
+      };
+    })
+  );
+  return {
+    endpoints: summaries,
+    total: endpoints.length,
+    truncated
+  };
+}
+function registerResources(server, client) {
+  server.registerResource(
+    "endpoints-overview",
+    ENDPOINTS_RESOURCE_URI,
+    {
+      title: "Endpoints Overview",
+      description: "All endpoints with a summary of recent activity.",
+      mimeType: "application/json"
+    },
+    async () => {
+      return jsonResource(ENDPOINTS_RESOURCE_URI, await listEndpointSummaries(client));
+    }
+  );
+  server.registerResource(
+    "endpoint-recent-requests",
+    new import_server2.ResourceTemplate(ENDPOINT_RECENT_TEMPLATE_URI, {
+      list: async () => {
+        const endpoints = await client.endpoints.list();
+        return {
+          resources: endpoints.map((endpoint) => ({
+            uri: `webhooks://endpoint/${endpoint.slug}/recent`,
+            name: `${endpoint.slug} recent requests`,
+            description: `Recent requests for endpoint ${endpoint.slug}`,
+            mimeType: "application/json"
+          }))
+        };
+      },
+      complete: {
+        slug: async (value) => {
+          const endpoints = await client.endpoints.list();
+          return endpoints.map((endpoint) => endpoint.slug).filter((slug) => slug.startsWith(value)).slice(0, 20);
+        }
+      }
+    }),
+    {
+      title: "Endpoint Recent Requests",
+      description: "Last 10 captured requests for an endpoint.",
+      mimeType: "application/json"
+    },
+    async (uri, variables) => {
+      const slug = variableToString(variables.slug, "slug");
+      const [endpoint, requests] = await Promise.all([
+        client.endpoints.get(slug),
+        client.requests.list(slug, { limit: RECENT_REQUEST_LIMIT })
+      ]);
+      return jsonResource(uri.toString(), {
+        endpoint,
+        requests: requests.map(compactRequest)
+      });
+    }
+  );
+  server.registerResource(
+    "request-details",
+    new import_server2.ResourceTemplate(REQUEST_TEMPLATE_URI, {
+      list: void 0,
+      complete: {}
+    }),
+    {
+      title: "Request Details",
+      description: "Full details for a captured request by ID.",
+      mimeType: "application/json"
+    },
+    async (uri, variables) => {
+      const id = variableToString(variables.id, "id");
+      const request = await client.requests.get(id);
+      return jsonResource(uri.toString(), compactRequest(request));
+    }
+  );
+}
+
+// src/sandbox-tools.ts
+var import_zod4 = require("zod");
+var import_sdk2 = require("@webhooks-cc/sdk");
+
+// src/version.ts
+var VERSION = true ? "2.0.0" : "0.0.0-dev";
+var MCP_USER_AGENT = `webhooks-cc-mcp/${VERSION}`;
+
+// src/sandbox-tools.ts
+var SANDBOX = {
+  maxEndpoints: 3,
+  requestsPerEndpoint: 25,
+  requests: 100,
+  lifetimeHours: 24
+};
+var DEFAULT_WAIT_SECONDS = 45;
+var MAX_WAIT_SECONDS = 600;
+var DOCS_URL = "https://webhooks.cc/docs/agents";
+var ACCOUNT_ONLY_OPTIONS = [
+  "mockResponse",
   "responseRules",
   "notificationUrl",
   "signingProvider",
@@ -3100,6 +3507,8 @@ function registerSandboxTools(server, options = {}) {
     options.clientName ?? "webhooks-cc-mcp",
     options.credentialsFile
   );
+  const target = asToolServer(server);
+  const groups = options.toolGroups ?? localToolGroups(server, toolSelection(options));
   let handles = [];
   let shown = 0;
   const swap = (register) => {
@@ -3107,7 +3516,9 @@ function registerSandboxTools(server, options = {}) {
     for (const handle of handles) handle.remove();
     handles = register(id);
   };
-  const showSandbox = () => swap(() => sandboxToolSet(server, session, showAccount));
+  const showSandbox = () => swap(
+    () => sandboxToolSet(sandboxTarget(target, groups.selection.readOnly), session, showAccount, groups)
+  );
   const savedAccount = (id) => options.credentialsFile === false ? null : import_sdk2.WebhooksCC.fromSavedConnection({
     baseUrl,
     webhookUrl,
@@ -3120,18 +3531,54 @@ function registerSandboxTools(server, options = {}) {
     })
   });
   function showAccount(client) {
-    swap((id) => registerTools(server, savedAccount(id) ?? client));
+    swap((id) => [groups.show(savedAccount(id) ?? client)]);
     options.onConnected?.(client);
   }
   const saved = savedAccount(1);
   if (saved) {
-    swap(() => registerTools(server, saved));
+    swap(() => [groups.show(saved)]);
     options.onConnected?.(saved);
   } else {
     showSandbox();
   }
 }
-function sandboxToolSet(server, session, showAccount) {
+var SANDBOX_ONLY_TOOLS = {
+  // A new code each time.
+  connect_account: {
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: false,
+    openWorldHint: false
+  },
+  // Changes this session's tools once the human has connected.
+  wait_for_connection: {
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  about_sandbox: {
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  }
+};
+var CONNECT_TOOLS = /* @__PURE__ */ new Set(["connect_account", "wait_for_connection"]);
+function sandboxTarget(target, readOnly) {
+  return {
+    tool(name, description, shape, handler) {
+      const own = SANDBOX_ONLY_TOOLS[name];
+      const annotations = own ? { title: toolTitle(name), ...own } : toolAnnotations(name);
+      if (readOnly && !annotations.readOnlyHint && !CONNECT_TOOLS.has(name)) {
+        return { remove() {
+        } };
+      }
+      return target.tool(name, description, shape, handler, annotations);
+    }
+  };
+}
+function sandboxToolSet(server, session, showAccount, groups) {
   const tools = [];
   const limits = `up to ${SANDBOX.maxEndpoints} endpoints at a time, ${SANDBOX.requestsPerEndpoint} captured requests each and ${SANDBOX.requests} in all, deleted ${SANDBOX.lifetimeHours} hours after the sandbox was created`;
   const file = savedTo(session.credentialsFile);
@@ -3246,7 +3693,7 @@ function sandboxToolSet(server, session, showAccount) {
       "connect_account",
       "Connect this agent to a human's webhooks.cc account, for the full tool set (mock responses, signatures, email, teams) and to keep the sandbox endpoints. Returns a link and a 6-digit code: show both to the human, who signs in or signs up with that email and enters the code. Then call wait_for_connection. Calling again gives a new code.",
       {
-        email: import_zod3.z.string().email({ message: "Invalid email address" }).describe(
+        email: import_zod4.z.string().email({ message: "Invalid email address" }).describe(
           "The email the human signs in to webhooks.cc with (their GitHub or Google primary email if they sign in that way); only someone signed in as it can connect"
         )
       },
@@ -3299,7 +3746,7 @@ function sandboxToolSet(server, session, showAccount) {
       "wait_for_connection",
       `Wait for the human to enter the code from connect_account. On success the full webhooks.cc tools for their account replace these sandbox tools. Returns after timeoutSeconds (default ${DEFAULT_WAIT_SECONDS}) if they have not finished yet; call it again to keep waiting.`,
       {
-        timeoutSeconds: import_zod3.z.number().int().min(1).max(MAX_WAIT_SECONDS).optional().describe(`How long to wait, in seconds (default ${DEFAULT_WAIT_SECONDS})`)
+        timeoutSeconds: import_zod4.z.number().int().min(1).max(MAX_WAIT_SECONDS).optional().describe(`How long to wait, in seconds (default ${DEFAULT_WAIT_SECONDS})`)
       },
       withErrorHandling(async ({ timeoutSeconds }) => {
         const pending = session.connect;
@@ -3342,7 +3789,7 @@ function sandboxToolSet(server, session, showAccount) {
         return jsonContent({
           connected: true,
           email: pending.email,
-          message: `Connected to the webhooks.cc account of ${pending.email}. The full tool set has replaced the sandbox tools (the tool list changed; if your client does not pick that up, ask the user to restart it).${movedEndpoints ? " The sandbox endpoints are now that account's endpoints, with what they captured." : ""} ${file ? `The connection is saved in ${file}, so later sessions, the whk CLI and the SDKs start connected; it lasts 90 days, and the human can remove it under Account, Connected agents.` : "This connection lasts while this MCP server runs; for a lasting setup, the human can create an API key under Account and set WHK_API_KEY."}`
+          message: `Connected to the webhooks.cc account of ${pending.email}. The account's tools have replaced the sandbox tools (the tool list changed; if your client does not pick that up, ask the user to restart it).${groups.loadedGroups().length < TOOL_GROUP_NAMES.length ? " More tools load in groups: see enable_tools." : ""}${movedEndpoints ? " The sandbox endpoints are now that account's endpoints, with what they captured." : ""} ${file ? `The connection is saved in ${file}, so later sessions, the whk CLI and the SDKs start connected; it lasts 90 days, and the human can remove it under Account, Connected agents.` : "This connection lasts while this MCP server runs; for a lasting setup, the human can create an API key under Account and set WHK_API_KEY."}`
         });
       })
     )
@@ -3384,33 +3831,57 @@ function registerAgentRegistrationTools(server) {
 }
 
 // src/index.ts
+var INSTRUCTIONS = "webhooks.cc captures webhooks and inbound email for testing. Start with create_endpoint, send to its URL (or point a provider at it), then wait_for_request and get_request to inspect what arrived. send_webhook sends a signed test webhook to an endpoint; verify_signature checks a captured request. With an account the tools come in groups: when a tool you need is missing, enable_tools loads its group (teams, domains, Google Sheets, billing and keys, and more).";
 function createServer(options = {}) {
   const apiKey = options.apiKey ?? process.env.WHK_API_KEY;
   const webhookUrl = options.webhookUrl ?? process.env.WHK_WEBHOOK_URL;
   const baseUrl = options.baseUrl ?? process.env.WHK_BASE_URL;
-  const server = new import_mcp2.McpServer(
-    { name: "webhooks-cc", version: VERSION },
-    // Connecting an account swaps every tool at once: one list_changed, not dozens.
-    { debouncedNotificationMethods: ["notifications/tools/list_changed"] }
+  const server = new import_server3.McpServer(
+    { name: "webhooks-cc", title: "webhooks.cc", version: VERSION },
+    {
+      capabilities: { tools: { listChanged: true } },
+      instructions: INSTRUCTIONS,
+      // Connecting an account or loading groups changes many tools at once:
+      // one list_changed, not dozens.
+      debouncedNotificationMethods: ["notifications/tools/list_changed"]
+    }
   );
+  const groups = localToolGroups(server, toolSelection(options));
   if (!apiKey) {
-    registerSandboxTools(server, { baseUrl, webhookUrl, credentialsFile: options.credentialsFile });
+    registerSandboxTools(server, {
+      baseUrl,
+      webhookUrl,
+      credentialsFile: options.credentialsFile,
+      toolGroups: groups
+    });
     registerPrompts(server);
     return server;
   }
   const client = new import_sdk3.WebhooksCC({ apiKey, webhookUrl, baseUrl, userAgent: MCP_USER_AGENT });
-  registerTools(server, client);
+  groups.show(client);
   registerPrompts(server);
   registerResources(server, client);
   return server;
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  ENABLE_TOOLS,
+  LocalToolGroups,
   REMOTE_MAX_WAIT_MS,
+  TOOL_CATALOG,
+  TOOL_GROUPS,
+  TOOL_GROUP_NAMES,
+  asToolServer,
+  clientLoadsEverything,
   createServer,
+  defaultToolGroups,
+  localToolGroups,
+  parseToolGroups,
   registerAgentRegistrationTools,
   registerPrompts,
   registerResources,
   registerSandboxTools,
-  registerTools
+  registerTools,
+  toolAnnotations,
+  toolSelection
 });