fix(client): align webhook/schedule MCP calls with current api shape

Six contract mismatches discovered while running every advertised tool
against a live local api. After this commit the MCP exercises all
webhook + schedule CRUD endpoints without errors:

  - createWebhook now sends {events: [event], url, signingSecret} so the
    API-Platform-exposed POST /api/v1/webhooks accepts it. The single
    user-facing event arg is expanded internally.
  - updateWebhook expands {event} → {events: [event]} the same way.
  - toggleWebhook switched POST → PATCH (API-Platform exposes only PATCH
    on /webhooks/{uuid}/toggle).
  - testWebhook now hits /zapier/webhooks/{uuid}/test — the main webhook
    bundle has no /test endpoint; the Zapier-integration controller
    accepts the same UUID.
  - updateSchedule switched PATCH → PUT (API-Platform default for the
    schedules resource).
  - runSchedule path /schedules/{uuid}/run → /schedules/{uuid}/run-now.

Also: respect EXPORTCOMMENTS_API_BASE env var so the same client can be
pointed at a local api during development (defaults unchanged to
https://exportcomments.com).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: exportcomments-bot

src/client.ts

@@ -7,8 +7,9 @@ import type {
   CLIOutput,
 } from './types.js';
 
-const BASE_URL = 'https://exportcomments.com/api/v3';
-const V1_BASE_URL = 'https://exportcomments.com/api/v1';
+const API_BASE = process.env.EXPORTCOMMENTS_API_BASE?.replace(/\/+$/, '') ?? 'https://exportcomments.com';
+const BASE_URL = `${API_BASE}/api/v3`;
+const V1_BASE_URL = `${API_BASE}/api/v1`;
 const USER_AGENT = 'exportcomments-cli/1.0.0';
 
 /** A JWT has three base64url-encoded segments separated by dots (header.payload.signature). */
@@ -280,26 +281,40 @@ export class ExportCommentsClient {
   /**
    * @param event subscription event name (e.g. "export.completed")
    * @param url   POST target — must respond 2xx within 10s
+   *
+   * The API-Platform webhook resource expects `events: string[]` and a
+   * `signingSecret` for HMAC verification. We accept a single event in the
+   * MCP-facing shape and expand it here so the MCP tool stays single-arg.
    */
   async createWebhook(event: string, url: string): Promise<CLIOutput<unknown>> {
-    return this.v1Request('POST', '/webhooks', { event, url });
+    const { randomBytes } = await import('node:crypto');
+    return this.v1Request('POST', '/webhooks', {
+      events: [event],
+      url,
+      signingSecret: randomBytes(32).toString('hex'),
+    });
   }
 
   async updateWebhook(uuid: string, fields: { event?: string; url?: string }): Promise<CLIOutput<unknown>> {
-    return this.v1Request('PATCH', `/webhooks/${uuid}`, fields);
+    const payload: { events?: string[]; url?: string } = {};
+    if (fields.event) payload.events = [fields.event];
+    if (fields.url) payload.url = fields.url;
+    return this.v1Request('PATCH', `/webhooks/${uuid}`, payload);
   }
 
   async deleteWebhook(uuid: string): Promise<CLIOutput<unknown>> {
     return this.v1Request('DELETE', `/webhooks/${uuid}`);
   }
 
+  /** Toggle uses PATCH (API-Platform exposes it that way). */
   async toggleWebhook(uuid: string): Promise<CLIOutput<unknown>> {
-    return this.v1Request('POST', `/webhooks/${uuid}/toggle`);
+    return this.v1Request('PATCH', `/webhooks/${uuid}/toggle`);
   }
 
-  /** Sends a test event payload to a webhook URL for connectivity verification. */
+  /** Sends a test event payload. The main /webhooks bundle has no test
+   * endpoint; the Zapier-integration route does, and accepts the same UUID. */
   async testWebhook(uuid: string): Promise<CLIOutput<unknown>> {
-    return this.v1Request('POST', `/webhooks/${uuid}/test`);
+    return this.v1Request('POST', `/zapier/webhooks/${uuid}/test`);
   }
 
   // ── Scheduled exports ──
@@ -318,15 +333,15 @@ export class ExportCommentsClient {
   }
 
   async updateSchedule(uuid: string, fields: Record<string, unknown>): Promise<CLIOutput<unknown>> {
-    return this.v1Request('PATCH', `/schedules/${uuid}`, fields);
+    return this.v1Request('PUT', `/schedules/${uuid}`, fields);
   }
 
   async deleteSchedule(uuid: string): Promise<CLIOutput<unknown>> {
     return this.v1Request('DELETE', `/schedules/${uuid}`);
   }
 
   async runSchedule(uuid: string): Promise<CLIOutput<unknown>> {
-    return this.v1Request('POST', `/schedules/${uuid}/run`);
+    return this.v1Request('POST', `/schedules/${uuid}/run-now`);
   }
 
   async pauseSchedule(uuid: string): Promise<CLIOutput<unknown>> {