@audienti/cli 0.2.0-exora.4 → 0.2.0-exora.6

package/cli/rooms.mjs

@@ -7,8 +7,8 @@ import {callWorkspace,configuration} from './workspaces.mjs';
 import {readJsonFile} from './json-file.mjs';
 // Agent rooms client. Delivery is polled by the agent; nothing here opens a port.
 const valued=['profile','workspace','sort','since','about','limit','to','room','thread','body','body-file','file','answer-by','expires-at','request-id','with','slug','title','purpose','members','after','q','handle','exec','interval','timeout'];
-const switches=['retired','stop','once','json','unable','clear'];
-export const roomsUsage='Rooms: audienti rooms directory [--sort load] | inbox [--since ITEM] [--about TYPE:ID] [--limit N] | ack ITEM... | send (--to HANDLE|--room ROOM) [--thread ID] (--body TEXT|--body-file PATH|-) [--about TYPE:ID,...] [--answer-by ISO] [--expires-at ISO] [--unable] [--request-id UUID] | note (--body TEXT|--body-file PATH|-|--clear) | thread ID [--after N] | threads --about TYPE:ID | create (--with HANDLE | --slug S --title T [--purpose P] [--members a,b]) | list [--retired] [--q TEXT] | read ROOM [--q TEXT] | retire ROOM | restore ROOM | redact MESSAGE | resume THREAD | pause on|off | profile AGENT_ID [--handle H] [--about TEXT] | hook [--stop] | watch --exec CMD [--interval SECONDS] [--once] | wait --thread ID [--timeout SECONDS]';
+const switches=['retired','stop','once','json','unable','clear','brief'];
+export const roomsUsage='Rooms: audienti rooms directory [--sort load] | inbox [--since ITEM] [--about TYPE:ID] [--limit N] [--brief] | ack ITEM... | send (--to HANDLE|--room ROOM) [--thread ID] (--body TEXT|--body-file PATH|-) [--about TYPE:ID,...] [--answer-by ISO] [--expires-at ISO] [--unable] [--request-id UUID] | note (--body TEXT|--body-file PATH|-|--clear) | thread ID [--after N] | threads --about TYPE:ID | create (--with HANDLE | --slug S --title T [--purpose P] [--members a,b]) | list [--retired] [--q TEXT] | read ROOM [--q TEXT] | retire ROOM | restore ROOM | redact MESSAGE | resume THREAD | pause on|off | profile AGENT_ID [--handle H] [--about TEXT] | hook [--stop] | watch --exec CMD [--interval SECONDS] [--once] | wait --thread ID [--timeout SECONDS]';
 export const WATCH_MIN_INTERVAL=60,WAIT_MAX_TIMEOUT=900,WAIT_POLL=30,HOOK_CACHE=60;
 function parse(args){
  const position=[],flags={};
@@ -51,7 +51,7 @@ async function hook(flags,now=Date.now()){
  const path=statePath(flags),state=readState(path);
  let items=state.items;
  if(!items||!state.checkedAt||now-state.checkedAt>=HOOK_CACHE*1000){
-  try{items=(await call('rooms_inbox',{limit:20},flags)).data.items.map(i=>({id:i.id,reason:i.reason,overdue:i.overdue,answerBy:i.answerBy,message:{threadId:i.message.threadId,from:{handle:i.message.from.handle}}}))}catch{return}
+  try{items=(await call('rooms_inbox',{limit:20,brief:true},flags)).data.items.map(i=>({id:i.id,reason:i.reason,overdue:i.overdue,answerBy:i.answerBy,message:{threadId:i.message.threadId,from:{handle:i.message.from.handle}}}))}catch{return}
   Object.assign(state,{checkedAt:now,items});
  }
  if(flags.stop){
@@ -102,7 +102,7 @@ export async function roomsCli(args){
  const need=(count,text)=>{if(rest.length!==count)throw new Error(`Use audienti rooms ${text}.`)};
  switch(command){
   case 'directory':need(0,'directory [--sort load]');return print(await call('rooms_directory',{...(flags.sort?{sort:flags.sort}:{})},flags));
-  case 'inbox':need(0,'inbox');return print(await call('rooms_inbox',{...(flags.since?{since:flags.since}:{}),...(flags.about?{about:flags.about}:{}),...(flags.limit?{limit:integer(flags.limit,'Limit')}:{})},flags));
+  case 'inbox':need(0,'inbox');return print(await call('rooms_inbox',{...(flags.since?{since:flags.since}:{}),...(flags.about?{about:flags.about}:{}),...(flags.limit?{limit:integer(flags.limit,'Limit')}:{}),...(flags.brief?{brief:true}:{})},flags));
   case 'ack':if(!rest.length)throw new Error('Use audienti rooms ack ITEM....');return print(await call('rooms_ack',{ids:rest},flags));
   case 'send':{
    if(rest.length>1||(rest.length===1&&rest[0]!=='-'))throw new Error('Use audienti rooms send (--to HANDLE|--room ROOM) --body TEXT.');

package/cli/secret-operations.mjs

@@ -0,0 +1,7 @@
+import { z } from 'zod';
+const workspace = { workspaceId: z.string().uuid().optional() };
+export const secretName = z.string().regex(/^[A-Z][A-Z0-9_]{0,63}$/, 'A secret name uses capital letters, digits and underscores, for example HUBSPOT_TOKEN.');
+export const secretOperations = {
+ workspace_secret_list: { schema: z.object(workspace).strict(), method: 'GET', path: a => `/workspaces/${a.workspaceId}/secrets`, scoped: true, description: 'List the names of the secrets in the workspace Vault. Names only, never values. Use workspace_secret_get for one value.' },
+ workspace_secret_get: { schema: z.object({ ...workspace, name: secretName }).strict(), method: 'GET', path: a => `/workspaces/${a.workspaceId}/secrets/${encodeURIComponent(a.name)}`, scoped: true, description: 'Get one secret by name from the workspace Vault (for example HUBSPOT_TOKEN). Every agent in the workspace can read every secret and reading is free. Each read records who read it last and when. Use the value for the task only: never print it, paste it into a message or save it to a file.' },
+};

package/cli/secrets.mjs

@@ -0,0 +1,30 @@
+import { callWorkspace, configuration } from './workspaces.mjs';
+
+/** secret get NAME prints the value alone (so $(audienti secret get NAME) works); secret list prints names. --json prints the API answer. */
+export async function secretsCli(args) {
+ const flags = {}, positions = [];
+ let json = false;
+ for (let i = 0; i < args.length; i++) {
+  const arg = args[i];
+  if (arg === '--json') { json = true; continue; }
+  if (!arg.startsWith('--')) { positions.push(arg); continue; }
+  const key = arg.slice(2);
+  if (!['workspace', 'profile'].includes(key) || Object.hasOwn(flags, key) || i + 1 >= args.length) throw Error(`Invalid flag --${key}.`);
+  flags[key] = args[++i];
+ }
+ const usage = 'Use secret list [--workspace ID] or secret get NAME [--workspace ID] [--json].';
+ if (positions[0] !== 'secret' && positions[0] !== 'secrets') throw Error(usage);
+ const input = { workspaceId: flags.workspace }, config = configuration(flags.profile);
+ if (positions[1] === 'list' && positions.length === 2) {
+  const result = await callWorkspace('workspace_secret_list', input, config);
+  if (json) { console.log(JSON.stringify(result)); return; }
+  for (const secret of result.data.secrets) console.log(secret.name);
+  return;
+ }
+ if (positions[1] === 'get' && positions.length === 3) {
+  const result = await callWorkspace('workspace_secret_get', { ...input, name: positions[2] }, config);
+  if (json) console.log(JSON.stringify(result)); else console.log(result.data.value);
+  return;
+ }
+ throw Error(usage);
+}

package/cli/sender-account-operations.mjs

@@ -5,20 +5,24 @@ const base={requestId:uuid,reason:text(1,2000).describe('Trimmed NFC; no control
 const alias={provider:z.enum(['email','linkedin']),accountRef:text(1,200).regex(/^[A-Za-z0-9@._:+\/-]+$/),expectedAliasVersion:version};
 const identity=z.object({namespace:text(1,64).describe('Discovery namespace: trimmed and lowercased.'),accountId:text(1,256).describe('Trimmed printable ASCII provider identity; case-sensitive assertion, not verification.')}).strict();
 const actionType=z.enum(['email.send','linkedin.send']);
+const capability=z.enum(['profile.read','profile.connection.request','profile.follow','profile.message.send','profile.inmail.send','profile.inbox.read','people.search']).describe('Account action. Audienti gates profile.connection.request (invite and withdraw) and profile.message.send at send time; the agent follows the user\'s mode for the others. Email accounts have profile.message.send and inbox.read.');
+const useIn=z.object({allWorkspaces:z.boolean(),workspaceIds:z.array(uuid).max(200)}).strict().describe('Where the account is used: all of the user\'s workspaces, or only the listed ones. Left out, all of them.');
 const pageLimit=z.number().int().min(1).max(100).optional();
 const query=a=>{const q=new URLSearchParams(Object.entries(a).map(([k,v])=>[k,String(v)]));return q.size?'?'+q:'';};
 const path=a=>`/sender-accounts/${encodeURIComponent(a.senderAccountId)}`;
-const body=a=>Object.fromEntries(Object.entries(a).filter(([key])=>!['senderAccountId','actionType'].includes(key)));
+const body=a=>Object.fromEntries(Object.entries(a).filter(([key])=>!['senderAccountId','actionType','capability'].includes(key)));
 const opaque=z.string().trim().min(1).max(256).regex(/^[ -~]+$/);
 export const senderAccountOperations={
  sender_activity_report:{schema:z.object({...base,senderAccountId:uuid,sourceEventId:opaque,namespace:identity.shape.namespace,occurredAt:z.iso.datetime({offset:true}),providerMessageId:opaque.nullable(),relatedAttemptId:uuid.nullable()}).strict(),method:'POST',path:a=>path(a)+'/activity',body},
  sender_alias_get:{schema:z.object({provider:alias.provider,accountRef:alias.accountRef}).strict(),method:'GET',path:a=>'/sender-accounts/alias'+query(a),ownerOnly:true},
  sender_accounts_list:{schema:z.object({cursor:uuid.optional(),limit:pageLimit}).strict(),method:'GET',path:a=>'/sender-accounts'+query(a)},
  sender_account_get:{schema:z.object({senderAccountId:uuid,aliasesCursor:text(1,1024).optional(),aliasesLimit:pageLimit,historyCursor:uuid.optional(),historyLimit:pageLimit}).strict(),method:'GET',path:a=>path(a)+query(body(a))},
- sender_account_register:{schema:z.object({...base,...alias,agentId:uuid,accountIdentity:identity}).strict(),method:'POST',path:()=>'/sender-accounts',ownerOnly:true},
+ sender_account_register:{schema:z.object({...base,...alias,agentId:uuid,accountIdentity:identity,useIn:useIn.optional()}).strict(),method:'POST',path:()=>'/sender-accounts',ownerOnly:true},
  sender_alias_bind:{schema:z.object({...base,...alias,senderAccountId:uuid,agentId:uuid}).strict(),method:'POST',path:a=>path(a)+'/aliases',body,ownerOnly:true},
  sender_alias_unbind:{schema:z.object({...base,...alias,senderAccountId:uuid}).strict(),method:'POST',path:a=>path(a)+'/aliases/unbind',body,ownerOnly:true},
  sender_account_state_set:{schema:z.object({...base,senderAccountId:uuid,expectedVersion:version,state:z.enum(['active','retired'])}).strict(),method:'POST',path:a=>path(a)+'/lifecycle',body,ownerOnly:true},
  sender_automation_get:{schema:z.object({senderAccountId:uuid,actionType}).strict(),method:'GET',path:a=>path(a)+'/automation/'+encodeURIComponent(a.actionType)},
  sender_automation_set:{schema:z.object({...base,senderAccountId:uuid,actionType,expectedVersion:version,enabled:z.boolean()}).strict(),method:'POST',path:a=>path(a)+'/automation/'+encodeURIComponent(a.actionType),body,ownerOnly:true},
+ sender_action_modes_get:{schema:z.object({senderAccountId:uuid}).strict(),method:'GET',path:a=>path(a)+'/action-modes'},
+ sender_action_mode_set:{schema:z.object({...base,senderAccountId:uuid,capability,expectedVersion:version,mode:z.enum(['not_allowed','approval','automatic']).describe('not_allowed blocks the action even when approved; approval needs an exact approval; automatic skips only the approval card.')}).strict(),method:'POST',path:a=>path(a)+'/action-modes/'+encodeURIComponent(a.capability),body,ownerOnly:true},
 };

package/cli/sender-accounts.mjs

@@ -1,23 +1,28 @@
 import {senderAccountOperations} from './sender-account-operations.mjs';
 import {callOwnerAccountOperation} from './owner-account-client.mjs';
 import {readJsonFile} from './json-file.mjs';
-import {WorkspaceRequestError} from './workspaces.mjs';
+import {WorkspaceRequestError,callWorkspace,configuration} from './workspaces.mjs';
 export async function callSenderAccounts(name,args,profilePath){
  return callOwnerAccountOperation(senderAccountOperations[name],args,profilePath,'sender account');
 }
 export async function senderAccountsCli(args){
- const flags={},positions=[];const known=['profile','file','cursor','limit','aliases-cursor','aliases-limit','history-cursor','history-limit','action-type','provider','account-ref'];
+ const flags={},positions=[];const known=['profile','file','cursor','limit','aliases-cursor','aliases-limit','history-cursor','history-limit','action-type','capability','provider','account-ref'];
  for(let i=0;i<args.length;i++){const arg=args[i];if(arg==='--json')continue;if(!arg.startsWith('--')){positions.push(arg);continue;}const key=arg.slice(2);if(!known.includes(key)||Object.hasOwn(flags,key)||!args[i+1]||args[i+1].startsWith('--'))throw Error('Unknown, repeated or incomplete sender option.');flags[key]=args[++i];}
- if(positions[0]!=='sender'||positions[1]!=='accounts')throw Error('Use sender accounts list|get|alias|register|bind|unbind|state|automation.');
- const automation=positions[2]==='automation',activity=positions[2]==='activity',nested=automation||activity,command=nested?`${positions[2]}-${positions[3]}`:positions[2];
- const names={'activity-report':'sender_activity_report',alias:'sender_alias_get',list:'sender_accounts_list',get:'sender_account_get',register:'sender_account_register',bind:'sender_alias_bind',unbind:'sender_alias_unbind',state:'sender_account_state_set','automation-get':'sender_automation_get','automation-set':'sender_automation_set'};
+ if(positions[0]==='sender'&&positions[1]==='managed'){
+  const names={list:'workspace_managed_accounts_list',connect:'workspace_managed_account_connect'};
+  if(!names[positions[2]]||positions.length!==3||Object.keys(flags).some(key=>key!=='profile'))throw Error('Use sender managed list|connect [--profile PATH].');
+  console.log(JSON.stringify(await callWorkspace(names[positions[2]],{},configuration(flags.profile??process.env.AUDIENTI_PROFILE))));return;
+ }
+ if(positions[0]!=='sender'||positions[1]!=='accounts')throw Error('Use sender accounts list|get|alias|register|bind|unbind|state|automation|modes.');
+ const automation=positions[2]==='automation',modes=positions[2]==='modes',activity=positions[2]==='activity',nested=automation||modes||activity,command=nested?`${positions[2]}-${positions[3]}`:positions[2];
+ const names={'activity-report':'sender_activity_report',alias:'sender_alias_get',list:'sender_accounts_list',get:'sender_account_get',register:'sender_account_register',bind:'sender_alias_bind',unbind:'sender_alias_unbind',state:'sender_account_state_set','automation-get':'sender_automation_get','automation-set':'sender_automation_set','modes-get':'sender_action_modes_get','modes-set':'sender_action_mode_set'};
  const name=names[command];if(!name)throw Error('Unknown sender account command.');
  const operation=senderAccountOperations[name],hasId=!['list','register','alias'].includes(command),expected=nested?5:hasId?4:3;if(positions.length!==expected)throw Error('Unexpected sender arguments.');
- const allowed=['profile',...(operation.method==='POST'?['file']:command==='alias'?['provider','account-ref']:command==='list'?['cursor','limit']:command==='get'?['aliases-cursor','aliases-limit','history-cursor','history-limit']:[]),...(automation?['action-type']:[])];
+ const allowed=['profile',...(operation.method==='POST'?['file']:command==='alias'?['provider','account-ref']:command==='list'?['cursor','limit']:command==='get'?['aliases-cursor','aliases-limit','history-cursor','history-limit']:[]),...(automation?['action-type']:[]),...(command==='modes-set'?['capability']:[])];
  if(Object.keys(flags).some(key=>!allowed.includes(key)))throw Error('Option does not apply to this sender command.');
- let input={};if(operation.method==='POST'){if(!flags.file)throw Error('--file INPUT.json is required.');input=readJsonFile(flags.file,65536,'Sender input');if(!input||typeof input!=='object'||Array.isArray(input))throw Error('invalid_fields: input must be a JSON object.');if(Object.hasOwn(input,'senderAccountId')||Object.hasOwn(input,'actionType')||Object.hasOwn(input,'workspaceId'))throw Error('Path IDs and workspaceId are not allowed in the file.');}
+ let input={};if(operation.method==='POST'){if(!flags.file)throw Error('--file INPUT.json is required.');input=readJsonFile(flags.file,65536,'Sender input');if(!input||typeof input!=='object'||Array.isArray(input))throw Error('invalid_fields: input must be a JSON object.');if(Object.hasOwn(input,'senderAccountId')||Object.hasOwn(input,'actionType')||Object.hasOwn(input,'capability')||Object.hasOwn(input,'workspaceId'))throw Error('Path IDs and workspaceId are not allowed in the file.');}
  if(command==='alias'){input.provider=flags.provider;input.accountRef=flags['account-ref'];}
- if(hasId)input.senderAccountId=positions[nested?4:3];if(automation)input.actionType=flags['action-type'];
+ if(hasId)input.senderAccountId=positions[nested?4:3];if(automation)input.actionType=flags['action-type'];if(command==='modes-set')input.capability=flags.capability;
  for(const key of ['cursor','limit','aliases-cursor','aliases-limit','history-cursor','history-limit'])if(flags[key]!==undefined){const field=key.replace(/-([a-z])/g,(_,c)=>c.toUpperCase());if(key.endsWith('limit')){if(!/^\d+$/.test(flags[key]))throw new WorkspaceRequestError(400,'invalid_fields','Page limit must be 1–100.');input[field]=Number(flags[key]);}else input[field]=flags[key];}
  console.log(JSON.stringify(await callSenderAccounts(name,input,flags.profile??process.env.AUDIENTI_PROFILE)));
 }

package/cli/skills.mjs

@@ -10,18 +10,18 @@ const bundles = {
     helpers: true,
   },
   'getting-started': {
-    version: '1.2.0',
-    files: ['SKILL.md', 'references/inventory.md', 'references/campaign-draft.md', 'references/audience.md'],
+    version: '1.5.1',
+    files: ['SKILL.md', 'references/capabilities.md', 'references/campaign-draft.md', 'references/audience.md', 'references/outcome-checks.md', 'references/replies.md', 'references/reply-checks.md', 'references/mailbox-check.md'],
     helpers: false,
   },
-  'approach-design': {
-    version: '1.0.0',
+  'playbook-design': {
+    version: '1.1.0',
     files: ['SKILL.md', 'references/fields.md'],
     helpers: false,
   },
   'agent-rooms': {
     version: '1.0.0',
-    description: "Talk with your owner's other registered agents in rooms: check your inbox each run, ask and answer, reply unable, and leave a turnover note.",
+    description: "Talk with your user's other registered agents in rooms: check your inbox each run, ask and answer, reply unable, and leave a turnover note.",
     files: ['SKILL.md', 'references/commands.md'],
     helpers: false,
   },

package/cli/tools-operations.mjs

@@ -1,6 +1,7 @@
 import { z } from 'zod';
 const uuid = z.string().uuid(), workspace = { workspaceId: uuid.optional() };
 const root = a => `/workspaces/${a.workspaceId}/tools`;
+const toolId = z.string().regex(/^[a-z][a-z0-9._]{0,63}$/);
 const key = z.string().regex(/^[a-z][a-z0-9_]{0,47}$/).refine(v => !['constructor','prototype'].includes(v));
 const instruction = z.string().trim().min(1).max(4000);
 const question = z.discriminatedUnion('type', [
@@ -15,18 +16,18 @@ const contentInputs = {
  'posts.search':z.object({query:z.string().trim().min(1).max(500),topicId:uuid,postedLimit,...page,sortBy:z.enum(['relevance','date']).optional()}).strict(),
  'posts.comments':z.object({postId:uuid,...page}).strict(),
  'posts.reactions':z.object({postId:uuid,page:page.page}).strict(),
- 'profiles.search':z.object({kind:z.enum(['person','company']).optional(),query:z.string().trim().min(1).max(500).optional(),title:z.string().trim().min(1).max(200).optional(),location:z.string().trim().min(1).max(200).optional(),geoId:z.string().regex(/^\d{1,20}$/).optional(),industryIds:z.array(z.string().regex(/^\d{1,20}$/)).max(20).optional(),keywordsCompany:z.string().trim().min(1).max(200).optional(),currentCompany:z.string().trim().min(1).max(1024).optional(),companySizes:z.array(z.enum(['1-10','11-50','51-200','201-500','501-1000','1001-5000','5001-10000','10001+'])).max(8).optional(),page:page.page}).strict(),
+ 'profiles.search':z.object({kind:z.enum(['person','company']).optional(),query:z.string().trim().min(1).max(500).optional(),title:z.string().trim().min(1).max(200).optional(),location:z.string().trim().min(1).max(200).optional(),geoId:z.string().regex(/^\d{1,20}$/).optional(),industryIds:z.array(z.string().regex(/^\d{1,20}$/)).max(20).optional(),keywordsCompany:z.string().trim().min(1).max(200).optional(),currentCompany:z.string().trim().min(1).max(1024).optional(),companySizes:z.array(z.enum(['1-10','11-50','51-200','201-500','501-1000','1001-5000','5001-10000','10001+'])).max(8).optional(),page:page.page,saveProfiles:z.boolean().optional()}).strict(),
  'profiles.posts':z.object({profileId:uuid,topicId:uuid,postedLimit,...page}).strict(),
 };
 const contentOperations = Object.fromEntries(Object.entries(contentInputs).map(([tool,input])=>[`tools_${tool.replaceAll('.','_')}`,{tool,paid:true,schema:z.object({...workspace,requestId:uuid,input}).strict(),method:'POST',path:a=>root(a)+'/'+tool,body:a=>({requestId:a.requestId,input:a.input}),scoped:true,timeoutMs:30000}]));
 const recordsRoot = (a,kind) => `/workspaces/${a.workspaceId}/${kind}`;
 const contactInputs = {
- 'email.find':z.object({profileId:uuid,domain:z.string().trim().min(1).max(253),refresh:z.boolean().optional()}).strict(),
- 'mobile.find':z.object({profileId:uuid,email:z.string().min(1).max(320).optional(),refresh:z.boolean().optional()}).strict(),
+ 'email.find':z.object({profileId:uuid,domain:z.string().trim().min(1).max(253),refresh:z.boolean().optional(),cached:z.boolean().optional()}).strict(),
+ 'mobile.find':z.object({profileId:uuid,email:z.string().min(1).max(320).optional(),refresh:z.boolean().optional(),cached:z.boolean().optional()}).strict(),
 };
 export const hostedToolOperations = {
  ...Object.fromEntries(Object.entries(contactInputs).map(([tool,input])=>[`tools_${tool.replaceAll('.','_')}`,{tool,paid:true,limits:{cacheDays:7,maximumAttempts:tool==='email.find'?130:3},schema:z.object({...workspace,requestId:uuid,input}).strict(),method:'POST',path:a=>root(a)+'/'+tool,body:a=>({requestId:a.requestId,input:a.input}),scoped:true,timeoutMs:60000}])),
- tools_email_verify:{tool:'email.verify',paid:true,limits:{providerCalls:1,cacheDays:7},schema:z.object({...workspace,requestId:uuid,input:z.object({email:z.string().max(320),refresh:z.boolean().optional()}).strict()}).strict(),method:'POST',path:a=>root(a)+'/email.verify',body:a=>({requestId:a.requestId,input:a.input}),scoped:true,timeoutMs:30000},
+ tools_email_verify:{tool:'email.verify',paid:true,limits:{providerCalls:1,cacheDays:7},schema:z.object({...workspace,requestId:uuid,input:z.object({email:z.string().max(320),refresh:z.boolean().optional(),cached:z.boolean().optional()}).strict()}).strict(),method:'POST',path:a=>root(a)+'/email.verify',body:a=>({requestId:a.requestId,input:a.input}),scoped:true,timeoutMs:30000},
  ...contentOperations,
  topics_create:{traced:true,schema:z.object({...workspace,requestId:uuid,name:z.string().trim().min(1).max(200),slug:z.string().max(200).optional(),description:z.string().max(4000).optional()}).strict(),method:'POST',path:a=>recordsRoot(a,'topics'),body:({workspaceId,...a})=>a,scoped:true},
  ...Object.fromEntries(['topics','posts'].flatMap(kind=>[
@@ -34,12 +35,15 @@ export const hostedToolOperations = {
   [`${kind}_get`,{traced:true,schema:z.object({...workspace,id:uuid}).strict(),method:'GET',path:a=>recordsRoot(a,kind)+'/'+a.id,scoped:true}],
  ])),
  tools_list:{schema:z.object(workspace).strict(),method:'GET',path:root,scoped:true},
- tools_web_search:{tool:'web.search',paid:true,limits:{providerCalls:1,cacheHours:24},schema:z.object({...workspace,requestId:uuid,input:z.object({query:z.string().trim().min(1).max(1000),country:z.string().regex(/^[A-Za-z]{2}$/).optional(),language:z.string().regex(/^[a-z]{2}(?:-[A-Z]{2})?$/).optional(),page:z.number().int().min(1).max(100).optional(),limit:z.number().int().min(1).max(10).optional(),timeRange:z.enum(['day','week','month','year']).optional(),refresh:z.boolean().optional()}).strict()}).strict(),method:'POST',path:a=>root(a)+'/web.search',body:a=>({requestId:a.requestId,input:a.input}),scoped:true,timeoutMs:30000},
+ tools_search:{schema:z.object({...workspace,query:z.string().trim().min(1).max(200),limit:z.number().int().min(1).max(50).optional()}).strict(),method:'GET',path:a=>root(a)+'/search?'+new URLSearchParams({q:a.query,...a.limit!==undefined?{limit:String(a.limit)}:{}}),scoped:true,description:'One search across hosted tools, Audienti CLI commands and skills. Product words work (ICP finds audience tools, commands and skills; enrich finds profile tools) and so do provider names. Returns compact rows only: id, kind (tool, command or skill), one-line description and, for paid tools, the price per call or the metered unit. Then tools_get for a tool\'s inputs and tools_call to run it.'},
+ tools_get:{schema:z.object({...workspace,tool:toolId}).strict(),method:'GET',path:a=>root(a)+'/'+encodeURIComponent(a.tool),scoped:true,description:'One catalog tool: input JSON schema, limits, price per call, whether it is configured and available now, and this workspace\'s own 30-day call count, success rate and median speed.'},
+ tools_call:{paid:true,generic:true,schema:z.object({...workspace,tool:toolId,requestId:uuid,input:z.record(z.string(),z.unknown())}).strict(),method:'POST',path:a=>root(a)+'/call',body:a=>({tool:a.tool,requestId:a.requestId,input:a.input}),scoped:true,timeoutMs:90000,description:'Run any catalog tool by id (audienti.<object>.<verb>) or old name (find ids with tools_search, inputs with tools_get). Record tools accept input cached:false to skip the saved record and make a fresh paid call. Charged through workspace credits like the per-tool operations. Generate requestId once and reuse it with the same input after any interruption or error: a replay is free and returns the saved result, a new ID is a new purchase. A timeout may have consumed paid work; inspect tools_runs_get rather than redispatching with a new ID. Positive credit balance is required for paid dispatch; completion may overdraw. Rejected means no provider dispatch.'},
+ tools_web_search:{tool:'web.search',paid:true,limits:{providerCalls:1,cacheHours:24},schema:z.object({...workspace,requestId:uuid,input:z.object({query:z.string().trim().min(1).max(1000),country:z.string().regex(/^[A-Za-z]{2}$/).optional(),language:z.string().regex(/^[a-z]{2}(?:-[A-Z]{2})?$/).optional(),page:z.number().int().min(1).max(100).optional(),limit:z.number().int().min(1).max(10).optional(),timeRange:z.enum(['day','week','month','year']).optional(),refresh:z.boolean().optional(),cached:z.boolean().optional()}).strict()}).strict(),method:'POST',path:a=>root(a)+'/web.search',body:a=>({requestId:a.requestId,input:a.input}),scoped:true,timeoutMs:30000},
  tools_web_fetch:{tool:'web.fetch',paid:true,limits:{providerCalls:3,resultCache:false},schema:z.object({...workspace,requestId:uuid,input:z.object({url:z.string().min(1).max(2048)}).strict()}).strict(),method:'POST',path:a=>root(a)+'/web.fetch',body:a=>({requestId:a.requestId,input:a.input}),scoped:true,timeoutMs:90000},
  tools_proxy_sessions_create:{tool:'proxy.sessions.create',paid:true,limits:{maxSeconds:3600,concurrentWorkspaceConnections:32,meter:'upstream_tcp_payload_bytes'},schema:z.object({...workspace,requestId:uuid,input:z.object({ttlSeconds:z.number().int().min(60).max(3600).optional(),parentOperationId:uuid.optional()}).strict()}).strict(),method:'POST',path:a=>root(a)+'/proxy.sessions.create',body:a=>({requestId:a.requestId,input:a.input}),scoped:true,timeoutMs:30000},
- tools_proxy_sessions_close:{schema:z.object({...workspace,operationId:uuid}).strict(),method:'POST',path:a=>root(a)+'/proxy.sessions.close',body:a=>({operationId:a.operationId}),scoped:true},
+ tools_proxy_sessions_close:{tool:'proxy.sessions.close',schema:z.object({...workspace,operationId:uuid}).strict(),method:'POST',path:a=>root(a)+'/proxy.sessions.close',body:a=>({operationId:a.operationId}),scoped:true},
  tools_decide:{tool:'decide',paid:true,schema:z.object({...workspace,requestId:uuid,input:z.object({state:z.union([z.string(),z.record(z.string(),z.unknown()),z.array(z.unknown())]),questions:z.record(key,question).refine(v=>Object.keys(v).length>=1&&Object.keys(v).length<=16)}).strict()}).strict(),method:'POST',path:a=>root(a)+'/decide',body:a=>({requestId:a.requestId,input:a.input}),scoped:true,timeoutMs:30000},
- tools_profiles_fetch:{tool:'profiles.fetch',paid:true,schema:z.object({...workspace,requestId:uuid,input:z.object({url:z.string().min(1).max(1024),refresh:z.boolean().optional(),fields:z.array(z.enum(['name','headline','about','location','experience','currentPositions','education','skills','websites','photo','connections','followers','certifications','languages','industries','employeeCount','employeeCountRange','founded','specialities','locations'])).min(1).max(20).optional()}).strict()}).strict(),method:'POST',path:a=>root(a)+'/profiles.fetch',body:a=>({requestId:a.requestId,input:a.input}),scoped:true,timeoutMs:30000},
+ tools_profiles_fetch:{tool:'profiles.fetch',paid:true,schema:z.object({...workspace,requestId:uuid,input:z.object({url:z.string().min(1).max(1024),refresh:z.boolean().optional(),cached:z.boolean().optional(),fields:z.array(z.enum(['name','headline','about','location','experience','currentPositions','education','skills','websites','photo','connections','followers','certifications','languages','industries','employeeCount','employeeCountRange','founded','specialities','locations','companyType'])).min(1).max(20).optional()}).strict()}).strict(),method:'POST',path:a=>root(a)+'/profiles.fetch',body:a=>({requestId:a.requestId,input:a.input}),scoped:true,timeoutMs:30000},
  tools_runs_get:{schema:z.object({...workspace,operationId:uuid,attemptAfter:z.number().int().min(0).max(2147483647).optional(),entryAfter:uuid.optional()}).strict(),method:'GET',path:a=>root(a)+`/runs/${a.operationId}`+((a.attemptAfter!==undefined||a.entryAfter)?`?${new URLSearchParams({...a.attemptAfter!==undefined?{attemptAfter:String(a.attemptAfter)}:{},...a.entryAfter?{entryAfter:a.entryAfter}:{}})}`:''),scoped:true},
  tools_runs_list:{schema:z.object({...workspace,cursor:uuid.optional()}).strict(),method:'GET',path:a=>root(a)+'/runs'+(a.cursor?`?cursor=${encodeURIComponent(a.cursor)}`:''),scoped:true},
  tools_balance:{schema:z.object(workspace).strict(),method:'GET',path:a=>root(a)+'/balance',scoped:true},
@@ -59,12 +63,16 @@ hostedToolOperations.tools_profiles_discover = {
  path: a => root(a) + '/profiles.discover',
 };
 export const paidToolOperations = Object.fromEntries(Object.entries(hostedToolOperations).filter(([,operation])=>operation.paid));
-export const paidToolByName = Object.fromEntries(Object.entries(paidToolOperations).map(([name,operation])=>[operation.tool,{name,...operation}]));
-export const isPaidToolOperation = name => Object.hasOwn(paidToolOperations,name);
+export const paidToolByName = Object.fromEntries(Object.entries(paidToolOperations).filter(([,operation])=>operation.tool).map(([name,operation])=>[operation.tool,{name,...operation}]));
+// tools_call is paid except for the free proxy.sessions.close control call, which has no requestId or fee.
+export const isPaidToolOperation = (name, args) => name === 'tools_call' ? !['proxy.sessions.close', 'audienti.proxy.session.close'].includes(args?.tool) : Object.hasOwn(paidToolOperations, name);
 
 // Only known descriptor shape decides where a paid operation lives. Never infer
 // a nested operation for unrelated responses or let projection state mask billing.
-export const paidToolResult = (name, data) => {
+// Through tools_call the shape follows the resolved tool: profiles.enrich nests its operation.
+export const paidToolResult = (name, data, args) => {
+ if (name === 'tools_call') return ['profiles.enrich', 'audienti.people.profile.enrich'].includes(args?.tool) ? data?.operation : data;
  const descriptor = paidToolOperations[name];
  return descriptor?.resultKey ? data?.[descriptor.resultKey] : data;
 };
+

package/cli/tools.mjs

@@ -1,15 +1,25 @@
-import { z } from 'zod';
+import { randomUUID } from 'node:crypto';
 import { hostedToolOperations, paidToolByName, isPaidToolOperation, paidToolResult } from './tools-operations.mjs';
 import { parseArgs } from 'node:util';
 import { readJsonFile } from './json-file.mjs';
 import { callWorkspace, configuration } from './workspaces.mjs';
 const help = `Usage:
-  audienti tools list [--workspace UUID] [--json]
-  audienti tools proxy.sessions.close UUID [--workspace UUID]
-  audienti tools describe decide|email.verify|email.find|mobile.find|profiles.fetch|posts.fetch|posts.search|posts.comments|posts.reactions|profiles.posts|profiles.search|proxy.sessions.create|web.search|web.fetch
-  audienti tools decide|email.verify|email.find|mobile.find|profiles.fetch|posts.fetch|posts.search|posts.comments|posts.reactions|profiles.posts|profiles.search|proxy.sessions.create|web.search|web.fetch --input FILE|- --request-id UUID [--workspace UUID] [--json]
+  audienti call TOOL ['JSON_INPUT'] [--input FILE|-] [--request-id UUID] [--workspace UUID] [--json]
+  audienti tools search "WORDS" [--limit N] [--workspace UUID]   one server search over tools, audienti commands and skills; rows: id, kind, description, price
+  audienti tools get TOOL [--workspace UUID]         one tool: inputs, price, availability, your 30-day success rate and speed
+  audienti tools list [--workspace UUID] [--json]    the whole catalog
   audienti tools runs get UUID [--attempt-after ORDINAL] [--entry-after UUID] | list [--cursor UUID]
   audienti tools balance
+  audienti tools NAME --input FILE|- --request-id UUID [--workspace UUID] [--json]   same as call NAME; kept for existing scripts
+  audienti tools proxy.sessions.close UUID [--workspace UUID]
+
+The server catalog is the only source of tool names, inputs and prices: run tools search or tools get, then call.
+call sends {tool,requestId,input} to one route for every tool. Published ids look like audienti.email.verify;
+an old name (for example profiles.enrich) resolves on the server. A tool with no configured provider is not listed or callable.
+Record tools (profile read and enrich, email and mobile find, email.verify, web.search) reuse a saved record when one is
+current; put "cached":false in the input to skip it, make a fresh paid call and save the result.
+Without --request-id, call generates one and prints it to stderr. Save it: replaying the same ID is free and
+returns the saved result; a new ID is a new purchase.
 
 email.find and mobile.find may return running: poll tools runs get OPERATION_ID.
 Keep the same request ID after interruptions; never submit a new one to retry a purchase.
@@ -23,12 +33,12 @@ profiles.fetch accepts a person /in/ or company /company/ URL as {url,fields?,re
 Explicit refresh requires paid admission; the result includes saved profile/prospect IDs.
 Fields: name, headline, about, location, experience, currentPositions, education, skills,
 websites, photo, connections, followers, certifications, languages. Company-specific fields:
-industries, employeeCount, employeeCountRange, founded, specialities, locations.
+industries, employeeCount, employeeCountRange, founded, specialities, locations, companyType.
 profiles.enrich accepts the same fields as profiles.fetch, using url or saved profileId.
 Its operation has the same admission identity as profiles.fetch; the Prospect projection is a current free read.
 profiles.discover is the clear external-search alias of profiles.search; profiles list searches saved workspace records.
 profiles.search accepts person filters or {kind:"company",query,companySizes?}; results are partial profiles.
-Use describe for exact fields. No implicit email lookup.
+Use tools get TOOL for exact fields. No implicit email lookup.
 decide accepts {state,questions}; question types: boolean, choice, score.
 Questions have instructions; choice requires named criteria; score criteria are ordered
 from level zero. State is text, an object or an array. At most 32 KiB, 16 questions,
@@ -43,13 +53,41 @@ async function readStdin() {
  for await(const chunk of process.stdin){size+=chunk.length;if(size>32768)throw new Error('Tool input exceeds 32 KiB.');chunks.push(chunk);}
  try{return JSON.parse(new TextDecoder('utf-8',{fatal:true}).decode(Buffer.concat(chunks)));}catch{throw new Error('Tool input must be valid UTF-8 JSON.');}
 }
+const asJson=value=>{try{return JSON.parse(value);}catch{throw new Error('Tool input must be valid JSON.');}};
+async function printPaid(name,args,values){
+ try{
+  const result=await callWorkspace(name,args,configuration(values.profile));
+  const paidResult=paidToolResult(name,result?.data,args);
+  if(['failed','uncertain','rejected'].includes(paidResult?.status)){
+   process.stderr.write(JSON.stringify({error:{code:paidResult.error?.code??'tool_incomplete'},operationId:paidResult.operationId,requestId:args.requestId,billing:paidResult.billing,...(paidResult.result?.persistence?{result:paidResult.result}:{}),requestTraceId:result.requestTraceId,recovery:paidResult.status==='rejected'?'resolve_rejection_then_new_request_id':paidResult.result?.persistence?.recovery??'retry_same_request_id'})+'\n');process.exitCode=1;return;
+  }
+  console.log(JSON.stringify(result));
+ }catch(error){
+  if(isPaidToolOperation(name,args))process.stderr.write(`Retain request ID ${args.requestId}; retry with the same ID to inspect/recover this operation.\n`);
+  throw error;
+ }
+}
+const parseOptions={help:{type:'boolean',short:'h'},json:{type:'boolean'},input:{type:'string'},'request-id':{type:'string'},workspace:{type:'string'},profile:{type:'string'},cursor:{type:'string'},limit:{type:'string'},'attempt-after':{type:'string'},'entry-after':{type:'string'}};
+/** audienti call TOOL ['JSON'] : one generic route for every catalog tool. */
+export async function callCli(argv) {
+ const {positionals,values}=parseArgs({args:argv.slice(1),allowPositionals:true,strict:true,options:parseOptions});
+ if(values.help||positionals.length===0){console.log(help);return;}
+ const [tool,inline]=positionals;
+ if(positionals.length>2||(inline!==undefined&&values.input))throw new Error('Give the input once: a JSON argument or --input FILE|-.');
+ const input=inline!==undefined?asJson(inline):values.input?(values.input==='-'?await readStdin():readJsonFile(values.input,32768,'Tool input')):{};
+ if(!input||typeof input!=='object'||Array.isArray(input))throw new Error('Tool input must be a JSON object.');
+ const requestId=values['request-id']??randomUUID();
+ if(!values['request-id'])process.stderr.write(`request-id: ${requestId}\n`);
+ await printPaid('tools_call',{workspaceId:values.workspace,tool,requestId,input},values);
+}
 export async function toolsCli(argv) {
- const {positionals,values}=parseArgs({args:argv.slice(1),allowPositionals:true,strict:true,options:{help:{type:'boolean',short:'h'},json:{type:'boolean'},input:{type:'string'},'request-id':{type:'string'},workspace:{type:'string'},profile:{type:'string'},cursor:{type:'string'},'attempt-after':{type:'string'},'entry-after':{type:'string'}}});
+ const {positionals,values}=parseArgs({args:argv.slice(1),allowPositionals:true,strict:true,options:parseOptions});
  if(values.help||positionals.length===0){console.log(help);return;}
  const [verb,sub,id]=positionals;
- if(verb==='describe'&&Object.hasOwn(paidToolByName,sub)&&positionals.length===2){console.log(JSON.stringify({name:sub,version:'1',canonicalTool:paidToolByName[sub].canonicalTool??sub,responseOperationPath:paidToolByName[sub].resultKey??null,inputSchema:z.toJSONSchema(paidToolByName[sub].schema.shape.input),limits:paidToolByName[sub].limits??(sub==='decide'?{bytes:32768,depth:32,questions:16,choices:32,scoreLevels:10}:sub==='profiles.fetch'?{providerCalls:1,normalizedBytes:65536,cacheDays:30}:{providerCalls:1,resultCache:false}),retry:'Reuse the same requestId and authenticated principal after interruptions.'},null,values.json?undefined:2));return;}
  let name,args={workspaceId:values.workspace};
  if(verb==='list'&&positionals.length===1)name='tools_list';
+ else if(verb==='search'&&positionals.length>=2){name='tools_search';args.query=positionals.slice(1).join(' ');if(values.limit!==undefined)args.limit=Number(values.limit);}
+ else if((verb==='get'||verb==='describe')&&positionals.length===2){name='tools_get';args.tool=sub;}
  else if(verb==='balance'&&positionals.length===1)name='tools_balance';
  else if(verb==='runs'&&sub==='get'&&positionals.length===3){name='tools_runs_get';args.operationId=id;args.entryAfter=values['entry-after'];if(values['attempt-after']!==undefined)args.attemptAfter=Number(values['attempt-after']);}
  else if(verb==='runs'&&sub==='list'&&positionals.length===2){name='tools_runs_list';args.cursor=values.cursor;}
@@ -58,15 +96,5 @@ export async function toolsCli(argv) {
   if(!values.input||!values['request-id'])throw new Error(`${verb} requires --input FILE|- and --request-id UUID. Keep the request ID for retries.`);
   name=paidToolByName[verb].name;args.requestId=values['request-id'];args.input=values.input==='-'?await readStdin():readJsonFile(values.input,32768,'Tool input');
  }else throw new Error('Unknown tools command. Use audienti tools --help.');
- try{
-  const result=await callWorkspace(name,args,configuration(values.profile));
-  const paidResult = paidToolResult(name,result?.data);
-  if(['failed','uncertain','rejected'].includes(paidResult?.status)){
-   process.stderr.write(JSON.stringify({error:{code:paidResult.error?.code??'tool_incomplete'},operationId:paidResult.operationId,requestId:args.requestId,billing:paidResult.billing,...(paidResult.result?.persistence?{result:paidResult.result}:{}),requestTraceId:result.requestTraceId,recovery:paidResult.status==='rejected'?'resolve_rejection_then_new_request_id':paidResult.result?.persistence?.recovery??'retry_same_request_id'})+'\n');process.exitCode=1;return;
-  }
-  console.log(JSON.stringify(result));
- }catch(error){
-  if(isPaidToolOperation(name))process.stderr.write(`Retain request ID ${args.requestId}; retry with the same ID to inspect/recover this operation.\n`);
-  throw error;
- }
+ await printPaid(name,args,values);
 }

package/cli/work-execution-operations.mjs

@@ -25,8 +25,14 @@ const body=({workspaceId,planId,clientActionId,attemptId,...rest})=>rest;
 export const workspaceExecutionOperations={
  workspace_work_claim:{schema:z.object({...location,expectedRevision:z.number().int().positive(),requestId:uuid}).strict(),scoped:true,method:'POST',path:a=>`${path(a)}/claims`,body},
  workspace_work_start:{schema:z.object({...location,claimId:uuid,requestId:uuid}).strict(),scoped:true,method:'POST',path:a=>`${path(a)}/start`,body},
+ workspace_work_send:{schema:z.object({...location,claimId:uuid,requestId:uuid}).strict(),scoped:true,method:'POST',path:a=>`${path(a)}/send`,body,description:'LinkedIn accounts connected through Audienti only. Starts the claimed, approved action and sends it once through the managed account, then records the result. Replaying the same claim returns the recorded send; it never sends again.'},
  workspace_work_attempt_get:{schema:z.object({...location,historyCursor:uuid.optional(),historyLimit:z.number().int().min(1).max(100).optional()}).strict(),scoped:true,method:'GET',path:a=>{const q=new URLSearchParams();for(const key of ['historyCursor','historyLimit'])if(a[key]!==undefined)q.set(key,String(a[key]));return `${path(a)}/attempt?${q}`;}},
 };
+// LinkedIn accounts connected through Audienti. Only the user connects one; agents list them and send through work send.
+export const managedAccountOperations={
+ workspace_managed_accounts_list:{schema:z.object({workspaceId:uuid.optional()}).strict(),scoped:true,method:'GET',path:a=>`/workspaces/${a.workspaceId}/managed-accounts`,description:'List the LinkedIn accounts connected through Audienti in this workspace, with their sending account IDs and status.'},
+ workspace_managed_account_connect:{schema:z.object({workspaceId:uuid.optional()}).strict(),scoped:true,method:'POST',path:a=>`/workspaces/${a.workspaceId}/managed-accounts/connect`,body:()=>({}),description:'The user only, not agents. Returns a sign-in link, valid 15 minutes, where the user connects a LinkedIn account through Audienti.'},
+};
 export const narrowExecutionOperations={
  work_claim_release:{schema:z.object({claimId:uuid,requestId:uuid,reason}).strict(),method:'POST',path:a=>`/work-execution/claims/${a.claimId}/release`,body:({claimId,...rest})=>rest},
  work_attempt_lookup:{schema:z.object({claimId:uuid}).strict(),method:'GET',path:a=>`/work-execution/claims/${a.claimId}/attempt`},

package/cli/work-execution.mjs

@@ -12,9 +12,9 @@ export async function workExecutionCli(args) {
   const arg=args[i];if(arg==='--json')continue;if(!arg.startsWith('--')){positions.push(arg);continue;}
   const key=arg.slice(2);if(!['profile','workspace','action','claim','attempt','file','cursor','limit'].includes(key)||Object.hasOwn(flags,key)||!args[i+1]||args[i+1].startsWith('--'))throw Error('Unknown, repeated or incomplete execution option.');flags[key]=args[++i];
  }
- const command=positions[2],workspace=['claim','start','get'].includes(command),read=['get','lookup'].includes(command);
- const names={claim:'workspace_work_claim',start:'workspace_work_start',get:'workspace_work_attempt_get',release:'work_claim_release',lookup:'work_attempt_lookup',report:'work_result_report'};
- if(!names[command]||positions.length!==(workspace?4:3))throw Error('Use work execution claim|start|get PLAN, release|lookup --claim ID, or report --attempt ID.');
+ const command=positions[2],workspace=['claim','start','send','get'].includes(command),read=['get','lookup'].includes(command);
+ const names={claim:'workspace_work_claim',start:'workspace_work_start',send:'workspace_work_send',get:'workspace_work_attempt_get',release:'work_claim_release',lookup:'work_attempt_lookup',report:'work_result_report'};
+ if(!names[command]||positions.length!==(workspace?4:3))throw Error('Use work execution claim|start|send|get PLAN, release|lookup --claim ID, or report --attempt ID.');
  const allowed=['profile',...(workspace?['workspace','action']:command==='report'?['attempt']:['claim']),...(read?command==='get'?['cursor','limit']:[]:['file'])];
  if(Object.keys(flags).some(key=>!allowed.includes(key)))throw Error('Option does not apply to this execution command.');
  if(workspace&&!flags.action)throw Error('This command requires --action.');

package/cli/work-operations.mjs

@@ -5,7 +5,7 @@ const page = z.object({cursor: uuid.optional(), limit: z.number().int().min(1).m
 const clientId = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/);
 const accountRef = z.string().min(1).max(200).regex(/^[A-Za-z0-9@._:+\/-]+$/);
 const evidence = z.array(uuid).max(100);
-const commonAction = {clientActionId: clientId, reason: z.string().min(1), evidenceIds: evidence, replyToEvidenceId: uuid.optional()};
+const commonAction = {clientActionId: clientId, capability: z.enum(['profile.connection.request','profile.message.send']).optional().describe('The owner action: profile.connection.request or profile.message.send on linkedin.send, profile.message.send on email.send. The sending account\'s mode for it decides whether approval is needed or the action is not allowed. Without it the old per-channel automation switch applies, unless a mode restricts it.'), reason: z.string().min(1), evidenceIds: evidence, replyToEvidenceId: uuid.optional(), playbookStepKey: uuid.optional().describe("The playbook step this action runs; a succeeded result starts that step's wait. Saving the plan checks it: the key must name a step of the playbook pinned to the person's active participation in the plan's Campaign, and the step's channel must match the action type (email.send only with an Email step, linkedin.send only with a LinkedIn step); otherwise the save is refused with invalid_fields.")};
 const email = z.object({...commonAction, type:z.literal('email.send'), content:z.object({subject:z.string(),body:z.string()}).strict(),recipient:z.object({prospectId:uuid,email:z.string(),contactId:uuid.optional()}).strict(),sender:z.object({provider:z.literal('email'),accountRef,senderAccountId:uuid.optional()}).strict()}).strict();
 const linkedin = z.object({...commonAction,type:z.literal('linkedin.send'),content:z.object({body:z.string()}).strict(),recipient:z.object({prospectId:uuid,profileUrl:z.string(),contactId:uuid.optional()}).strict(),sender:z.object({provider:z.literal('linkedin'),accountRef,senderAccountId:uuid.optional()}).strict()}).strict();
 const cadence = z.object({notBefore:z.string().datetime().optional(),clientActionId:clientId,afterClientActionId:clientId.nullable(),trigger:z.literal('reported_success').nullable(),at:z.string().nullable(),waitSeconds:z.number().int().min(0).max(7776000).nullable(),condition:z.literal('no_pending_reply').nullable()}).strict();
@@ -18,12 +18,13 @@ const omit = (a, keys) => Object.fromEntries(Object.entries(a).filter(([k])=>!ke
 const body = a => omit(a,['workspaceId','planId','clientActionId']);
 const qs = values => { const p=new URLSearchParams(); for(const [k,v] of Object.entries(values)) if(v!==undefined)p.set(k,String(v));return p.toString(); };
 export const workOperations = {
- workspace_work_activity_list: {description:'Read recorded workspace Activity, newest first: actor, fact, person, time and recorded status. Human tokens require workspace:access; connected agents require workspace:read and workspace policy access, acting as their owner. Stage decisions follow Admin/current-assignee visibility. Fixed pages of 50; reuse search and both cursor fields. Read only, no decision or inferred send success.',schema:z.object({...workspace,search:z.string().trim().max(120).optional(),cursor:z.object({at:z.string().datetime(),id:z.string().max(160)}).strict().optional()}).strict(),method:'GET',path:a=>`${root(a)}/operator/activity?${qs({search:a.search,cursorAt:a.cursor?.at,cursorId:a.cursor?.id})}`,scoped:true},
+ workspace_work_activity_list: {description:'Read recorded workspace Activity, newest first: actor, fact, person, time and recorded status. Human tokens require workspace:access; connected agents require workspace:read and workspace policy access, acting as their user. Stage decisions follow Admin/current-assignee visibility. Fixed pages of 50; reuse search and both cursor fields. Read only, no decision or inferred send success.',schema:z.object({...workspace,search:z.string().trim().max(120).optional(),cursor:z.object({at:z.string().datetime(),id:z.string().max(160)}).strict().optional()}).strict(),method:'GET',path:a=>`${root(a)}/operator/activity?${qs({search:a.search,cursorAt:a.cursor?.at,cursorId:a.cursor?.id})}`,scoped:true},
  workspace_work_action_plan_save: {schema:z.object({...workspace,planId:uuid.nullable(),prospectId:uuid,campaignId:uuid.nullable(),campaignRevision:z.number().int().positive().nullable(),expectedRevision:version,requestId:uuid,origin:z.discriminatedUnion('kind',[z.object({kind:z.literal('agent'),skill:z.object({id:z.string(),version:z.string()}).strict()}).strict(),z.object({kind:z.literal('human'),editReason:z.string()}).strict()]),rationale:z.string(),evidenceIds:evidence,actions:z.array(z.discriminatedUnion('type',[email,linkedin])).min(1).max(50),cadence:z.array(cadence).max(50)}).strict(), method:'POST',path:a=>`${root(a)}/action-plans`,body:a=>omit(a,['workspaceId']),scoped:true},
- workspace_work_operator_list: {description:'Read workspace proposals. order=priority matches the Operator queue: open replies first, then oldest proposals, with head-page totals. Omit order for legacy oldest-first order. Keep order and filters unchanged while paging. Read only; grants no execution authority.',schema:z.object({...workspace,order:z.enum(['oldest','priority']).optional(),page:page.optional(),filter:z.object({state:z.enum(['open','cancelled','terminal','invalidated']).optional(),reviewStatus:z.enum(['awaiting_revision','invalidated','pending_review','approved','in_progress','reconciliation_required','completed','cancelled']).optional(),search:z.string().optional(),queue:z.enum(['review','blocked','activity']).optional()}).strict().optional()}).strict(),method:'GET',path:a=>`${root(a)}/operator/work?${qs({...a.page,...a.filter,order:a.order})}`,scoped:true},
+ workspace_work_operator_list: {description:'Read workspace proposals. order=priority matches the Operator queue: open replies first, then oldest proposals, with head-page totals. Omit order for legacy oldest-first order. Keep order and filters unchanged while paging. Read only; grants no execution authority.',schema:z.object({...workspace,order:z.enum(['oldest','priority']).optional(),page:page.optional(),filter:z.object({state:z.enum(['open','cancelled','terminal','invalidated']).optional(),reviewStatus:z.enum(['awaiting_revision','invalidated','pending_review','approved','in_progress','reconciliation_required','completed','skipped','cancelled']).optional(),search:z.string().optional(),queue:z.enum(['review','blocked','activity']).optional()}).strict().optional()}).strict(),method:'GET',path:a=>`${root(a)}/operator/work?${qs({...a.page,...a.filter,order:a.order})}`,scoped:true},
  workspace_work_operator_get: {schema:z.object({...workspace,planId:uuid,revision:z.number().int().positive().optional(),history:page.optional()}).strict(),method:'GET',path:a=>`${plan(a)}?${qs({revision:a.revision,historyCursor:a.history?.cursor,historyLimit:a.history?.limit})}`,scoped:true},
  workspace_work_action_approve: {schema:z.object({...mutation,expectedApprovalVersion:version}).strict(),method:'POST',path:a=>`${action(a)}/approve`,body,scoped:true},
  workspace_work_action_withdraw: {schema:z.object({...mutation,expectedApprovalVersion:z.number().int().positive(),reason:z.string().min(1)}).strict(),method:'POST',path:a=>`${action(a)}/withdraw`,body,scoped:true},
  workspace_work_action_cancel: {schema:z.object({...mutation,reason:z.string().min(1)}).strict(),method:'POST',path:a=>`${action(a)}/cancel`,body,scoped:true},
+ workspace_work_action_skip: {description:'Human only. Skip one pending touch without sending it; the plan continues with its next step. When no touch is left the plan closes and the person stays in the campaign for the next playbook step. Only skipping the playbook\'s last step for the person ends their campaign, with the note skipped by owner; a skipped reply proposal never does, and the reply stays unanswered.',schema:z.object(mutation).strict(),method:'POST',path:a=>`${action(a)}/skip`,body,scoped:true},
  workspace_work_eligibility_get: {schema:z.object(located).strict(),method:'GET',path:a=>`${action(a)}/eligibility`,scoped:true},
 };

package/cli/work.mjs

@@ -8,8 +8,8 @@ export async function workCli(args) {
   if(!args[i].startsWith('--')){position.push(args[i]);continue;}
   const key=args[i].slice(2);if(!allowed.includes(key)||Object.hasOwn(flags,key)||args[i+1]===undefined||args[i+1].startsWith('--'))throw new Error('Unknown, repeated, or incomplete work option.');flags[key]=args[++i];
  }
- const names={'work activity':'workspace_work_activity_list','work plan save':'workspace_work_action_plan_save','work list':'workspace_work_operator_list','work show':'workspace_work_operator_get','work approve':'workspace_work_action_approve','work withdraw-approval':'workspace_work_action_withdraw','work cancel':'workspace_work_action_cancel','work eligibility':'workspace_work_eligibility_get'};
- const name=names[position.join(' ')];if(!name)throw new Error('Use work plan save, list, activity, show, approve, withdraw-approval, cancel, or eligibility. Writes require --file INPUT.json.');
+ const names={'work activity':'workspace_work_activity_list','work plan save':'workspace_work_action_plan_save','work list':'workspace_work_operator_list','work show':'workspace_work_operator_get','work approve':'workspace_work_action_approve','work withdraw-approval':'workspace_work_action_withdraw','work cancel':'workspace_work_action_cancel','work skip':'workspace_work_action_skip','work eligibility':'workspace_work_eligibility_get'};
+ const name=names[position.join(' ')];if(!name)throw new Error('Use work plan save, list, activity, show, approve, withdraw-approval, cancel, skip, or eligibility. Writes require --file INPUT.json.');
  const read=['workspace_work_activity_list','workspace_work_operator_list','workspace_work_operator_get','workspace_work_eligibility_get'].includes(name);
  const input=read?{}:readJsonFile(flags.file,65536,'Work input');
  for(const [flag,key] of [['workspace','workspaceId'],['request-id','requestId'],['plan-id','planId'],['client-action-id','clientActionId']])if(flags[flag]!==undefined)input[key]=flags[flag];

package/cli/workspaces.mjs

@@ -2,14 +2,17 @@ import {randomUUID} from 'node:crypto';
 import {notificationOperations} from './notification-operations.mjs';
 import {roomsOperations} from './rooms-operations.mjs';
 import {queueOperations} from './queue-operations.mjs';
+import {kvOperations} from './kv-operations.mjs';
+import {outcomeOperations} from './outcome-operations.mjs';
 import {questionOperations} from './question-operations.mjs';
 import {searchOperations} from './search-operations.mjs';
 import {fileOperations,uploadFileContent} from './file-operations.mjs';
-import {approachOperations} from './approach-operations.mjs';
+import {playbookOperations} from './playbook-operations.mjs';
 import {connectionRegistryOperations} from './connection-registry-operations.mjs';
 import { budgetOperations } from './budget-operations.mjs';
+import { secretOperations } from './secret-operations.mjs';
 import { hostedToolOperations, paidToolByName, isPaidToolOperation, paidToolResult } from './tools-operations.mjs';
-import { workspaceExecutionOperations } from './work-execution-operations.mjs';
+import { workspaceExecutionOperations, managedAccountOperations } from './work-execution-operations.mjs';
 import { workFeedbackOperations } from './work-feedback-operations.mjs';
 import { accountReplyOperations } from './account-reply-operations.mjs';
 import { accountIntakeOperations } from './account-intake-operations.mjs';
@@ -38,14 +41,18 @@ export const operations = {
  ...notificationOperations,
  ...roomsOperations,
  ...queueOperations,
+ ...kvOperations,
+ ...outcomeOperations,
  ...questionOperations,
  ...fileOperations,
- ...approachOperations,
+ ...playbookOperations,
  ...connectionRegistryOperations,
  ...budgetOperations,
+ ...secretOperations,
  ...hostedToolOperations,
  ...workOperations,
  ...workspaceExecutionOperations,
+ ...managedAccountOperations,
  ...workFeedbackOperations,
  ...suppressionOperations,
  ...guardrailsOperations,
@@ -122,7 +129,7 @@ export function validateUrl(value) {
 }
 export class WorkspaceRequestError extends Error {
  constructor(status, code, message, retryAt, blockers, requestTraceId) { super(message); this.status = status; this.code = code; this.retryAt = retryAt; this.blockers = blockers; this.requestTraceId = requestTraceId; }
- toJSON() { return { ...(this.requestId ? {requestId:this.requestId,recovery:this.recovery} : {}), ...(this.requestTraceId ? {requestTraceId:this.requestTraceId} : {}), code:this.code, status:this.status, message:this.message, ...(this.retryAt ? {retryAt:this.retryAt} : {}), ...(this.blockers ? {blockers:this.blockers} : {}) }; }
+ toJSON() { return { ...(this.requestId ? {requestId:this.requestId,recovery:this.recovery} : {}), ...(this.requestTraceId ? {requestTraceId:this.requestTraceId} : {}), code:this.code, status:this.status, message:this.message, ...(this.retryAt ? {retryAt:this.retryAt} : {}), ...(this.blockers ? {blockers:this.blockers} : {}), ...(this.charged ? {charged:this.charged} : {}) }; }
 }
 export class HostedResponseUnknown extends Error {
  constructor(requestId, reason, requestTraceId) { super('The server response is unknown. Paid work may have started. Retry using the same requestId and principal; never generate a new ID to recover this call.'); this.requestId=requestId; this.reason=reason; this.requestTraceId=requestTraceId; }
@@ -133,27 +140,30 @@ export async function callWorkspace(name, args, config) {
  const parsed=operation.schema.safeParse(args);if(!parsed.success) throw new Error(`Invalid workspace arguments. Check IDs and required fields: ${parsed.error.issues.slice(0,5).map(i=>`${i.path.join('.')||'input'}: ${i.message}`).join('; ')}.`);
  const input={...parsed.data};
  if(operation.localUpload)return uploadFileContent(input,(operationName,fields)=>callWorkspace(operationName,fields,config));
- if(operation.scoped) { input.workspaceId ??= config.workspaceId;if(!uuid.safeParse(input.workspaceId).success) throw new Error('Select a workspace or supply --workspace ID.'); }
+ // #333: an agent's own queue covers all its workspaces; a user's reads the selected workspace, as before.
+ if(operation.scoped || (operation.agentWide && !/^agt_/.test(config.token ?? ''))) { input.workspaceId ??= config.workspaceId;if(!uuid.safeParse(input.workspaceId).success) throw new Error('Select a workspace or supply --workspace ID.'); }
  const url=validateUrl(config.url); if(!config.token) throw new Error('A workspace:access token is required. Configure the environment or a private profile.');
  const target=new URL(`/api/v1${operation.path(input)}`,url);
- let response;try {response=await fetch(target,{method:operation.method,headers:{Authorization:`Bearer ${config.token}`,Accept:'application/json','Content-Type':'application/json',...((operation.traced||name.startsWith('tools_'))?{'X-Audienti-Interface':config.interface==='mcp'?'mcp':'cli'}:{})},...(['POST','PUT','PATCH'].includes(operation.method)?{body:JSON.stringify(operation.body?.(input)??{})}:{}),redirect:'error',signal:AbortSignal.timeout(operation.timeoutMs ?? 10000)});}catch(error){if(isPaidToolOperation(name))throw new HostedResponseUnknown(input.requestId,['TimeoutError','AbortError'].includes(error?.name)?'timeout':'transport_failure');throw new Error('Could not reach the API. Redirects are not followed.');}
+ let response;try {response=await fetch(target,{method:operation.method,headers:{Authorization:`Bearer ${config.token}`,Accept:'application/json','Content-Type':'application/json',...((operation.traced||name.startsWith('tools_'))?{'X-Audienti-Interface':config.interface==='mcp'?'mcp':'cli'}:{})},...(['POST','PUT','PATCH'].includes(operation.method)?{body:JSON.stringify(operation.body?.(input)??{})}:{}),redirect:'error',signal:AbortSignal.timeout(operation.timeoutMs ?? 10000)});}catch(error){if(isPaidToolOperation(name,input)||operation.recoverable)throw new HostedResponseUnknown(input.requestId,['TimeoutError','AbortError'].includes(error?.name)?'timeout':'transport_failure');throw new Error('Could not reach the API. Redirects are not followed.');}
  const headerTrace=(operation.traced||name.startsWith('tools_'))&&uuid.safeParse(response.headers.get('x-request-trace-id')).success?response.headers.get('x-request-trace-id'):undefined;
- let result;try{result=await response.json();}catch{if(isPaidToolOperation(name))throw new HostedResponseUnknown(input.requestId,'invalid_response',headerTrace);throw new Error('The API returned an invalid response.');}
+ let result;try{result=await response.json();}catch{if(isPaidToolOperation(name,input)||operation.recoverable)throw new HostedResponseUnknown(input.requestId,'invalid_response',headerTrace);throw new Error('The API returned an invalid response.');}
  const requestTraceId=uuid.safeParse(result?.requestTraceId).success?result.requestTraceId:headerTrace;
  if(!response.ok) {
   const code = typeof result?.error?.code==='string' && /^[a-z_]+$/.test(result.error.code) ? result.error.code : 'request_failed';
   const retryAt = typeof result?.error?.retryAt === 'string' && /^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d\.\d{3}Z$/.test(result.error.retryAt) ? result.error.retryAt : undefined;
-  const detail = ((response.status===400 && code==='invalid_fields') || (response.status===409 && code==='identity_conflict')) && typeof result?.error?.message==='string' && result.error.message.length<=300 && !/[\u0000-\u001f\u007f]/.test(result.error.message) && !/^Workspace request failed/.test(result.error.message) && !(config.token && result.error.message.includes(config.token)) ? result.error.message.trim() : '';
-  const blockers = code==='execution_blocked' && Array.isArray(result?.error?.blockers) && result.error.blockers.length<=28 && result.error.blockers.every(v=>typeof v==='string' && /^[a-z_]+$/.test(v)) ? result.error.blockers : undefined;
+  const detail = ((response.status===400 && (code==='invalid_fields' || code==='validation_error' || code==='secret_rejected')) || (response.status===409 && (code==='identity_conflict' || code==='task_not_for_you' || code==='version_conflict' || code==='request_conflict' || code==='campaign_not_ready' || code==='campaign_not_paced'))) && typeof result?.error?.message==='string' && result.error.message.length<=1000 && !/[\u0000-\u001f\u007f]/.test(result.error.message) && !/^Workspace request failed/.test(result.error.message) && !(config.token && result.error.message.includes(config.token)) ? result.error.message.trim() : '';
+  const blockers = (code==='execution_blocked' || code==='campaign_not_ready') && Array.isArray(result?.error?.blockers) && result.error.blockers.length<=28 && result.error.blockers.every(v=>typeof v==='string' && /^[a-z_]+$/.test(v)) ? result.error.blockers : undefined;
   const error = new WorkspaceRequestError(response.status, code, `Workspace request failed: ${code} (HTTP ${response.status}).${detail ? ` ${detail}` : ''}${retryAt ? ` Retry after ${retryAt}.` : ''}`, retryAt, blockers, requestTraceId);
-  if(isPaidToolOperation(name)){error.requestId=input.requestId;error.recovery=response.status>=500?'retry_same_request_id':'inspect_rejection';}
+  // What a failed paid check already spent (pico USD), so a caller counting its spend never loses it.
+  if(typeof result?.error?.charged==='string'&&/^\d{1,20}$/.test(result.error.charged))error.charged=result.error.charged;
+  if(isPaidToolOperation(name,input)){error.requestId=input.requestId;error.recovery=response.status>=500?'retry_same_request_id':'inspect_rejection';}
   throw error;
  }
- if(!result || !Object.hasOwn(result,'data')) {if(isPaidToolOperation(name))throw new HostedResponseUnknown(input.requestId,'invalid_response',requestTraceId);throw new Error('The API returned an invalid response.');}
- const paidResult = paidToolResult(name, result?.data);
- if(isPaidToolOperation(name)&&(!uuid.safeParse(paidResult?.operationId).success||paidResult.requestId!==input.requestId||!['running','succeeded','failed','uncertain','rejected'].includes(paidResult.status)))throw new HostedResponseUnknown(input.requestId,'invalid_response',requestTraceId);
+ if(!result || !Object.hasOwn(result,'data')) {if(isPaidToolOperation(name,input)||operation.recoverable)throw new HostedResponseUnknown(input.requestId,'invalid_response',requestTraceId);throw new Error('The API returned an invalid response.');}
+ const paidResult = paidToolResult(name, result?.data, input);
+ if(isPaidToolOperation(name,input)&&(!uuid.safeParse(paidResult?.operationId).success||paidResult.requestId!==input.requestId||!['running','succeeded','failed','uncertain','rejected'].includes(paidResult.status)))throw new HostedResponseUnknown(input.requestId,'invalid_response',requestTraceId);
  if(name==='workspace_select') config.workspaceId=input.workspaceId;
- return {data:result.data,...(requestTraceId?{requestTraceId}:{})};
+ return {data:operation.transform?operation.transform(result.data,input):result.data,...(requestTraceId?{requestTraceId}:{})};
 }
 export async function workspaceCli(args) {
  const flags={}; const position=[];

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@audienti/cli",
-  "version": "0.2.0-exora.4",
-  "description": "Audienti CLI and MCP client for exo.audienti.com",
+  "version": "0.2.0-exora.6",
+  "description": "Audienti CLI and MCP client for app.audienti.com",
   "type": "module",
   "bin": {
     "audienti": "cli/audienti.mjs",