@awesomate/hosting-mcp 0.50.0 → 0.51.0

package/dist/index.js

@@ -42887,13 +42887,14 @@ server.registerTool(
   "awesomate_crm_apps",
   {
     annotations: annotate("awesomate_crm_apps", MUTATING),
-    description: "The account's own apps (a client portal, a members' app) whose users sign in by email link and then read and change only what each kind's access rules allow them (awesomate_crm_kinds set_access). Pro and above to create or change; reading is every plan. action 'list': each app with its publishable key, allowed origins, sign-up mode and default role. action 'create' {name, allowed_origins, sign_up?, default_role?}: name appears in the sign-in email; allowed_origins are the exact origins the app runs on (https://portal.example.com; http://localhost:5173 for development; capacitor://localhost for the mobile shell), with no path and no wildcard; sign_up 'invite' (default: only people added with awesomate_crm_app_users) or 'open' (anyone who uses the email link gets the default role). action 'update' {app_id, ...any of those, status?}: status 'disabled' signs everyone out of that app and stops its server keys. The publishable key (pk_...) is not a secret: it goes in the app's browser code, with @awesomate/sdk. Never put the account's own token (amt_pat_...) in browser code. Confirm origins and sign-up mode with the user: open sign-up lets strangers in under the default role. SERVER KEYS (ak_...), for the app's own server or an n8n workflow, used with @awesomate/sdk createClient({ token: <key> }) or as a Bearer token on https://hub.awesomate.ai/api/sdk/v1/server: action 'keys' {app_id} lists them (never the secrets); 'create_key' {app_id, name, access: 'read'|'write', kinds?} makes one (kinds leaves it to those kinds, 'contact' to read contacts; leave it out for every kind) and returns the key ONCE: put it straight into the app server's environment (awesomate_app_set_env for an app hosted with us, or the n8n credential) and never into browser code, a repository or a reply to the user; 'revoke_key' {app_id, key_id} stops it at once. A key reads every attribute of an app kind, contacts only as you read them, and writes need Support Plus and above. Prefer the narrowest key: read unless the server writes, and only the kinds it uses.",
+    description: "The account's own apps (a client portal, a members' app) whose users sign in by email link and then read and change only what each kind's access rules allow them (awesomate_crm_kinds set_access). Pro and above to create or change; reading is every plan. action 'list': each app with its publishable key, allowed origins, sign-up mode and default role. action 'create' {name, allowed_origins, sign_up?, default_role?}: name appears in the sign-in email; allowed_origins are the exact origins the app runs on (https://portal.example.com; http://localhost:5173 for development; capacitor://localhost for the mobile shell), with no path and no wildcard; sign_up 'invite' (default: only people added with awesomate_crm_app_users) or 'open' (anyone who uses the email link gets the default role). action 'update' {app_id, ...any of those, status?}: status 'disabled' signs everyone out of that app and stops its server keys. The publishable key (pk_...) is not a secret: it goes in the app's browser code, with @awesomate/sdk. Never put the account's own token (amt_pat_...) in browser code. Confirm origins and sign-up mode with the user: open sign-up lets strangers in under the default role. action 'customer_lookup' {app_id, roles?}: which roles in that app may look customers up (name, email and phone, by search or id, with @awesomate/sdk lookupCustomers) and so put a record under any customer, not only themselves. Without roles it reads the setting; roles ['staff'] switches it on for staff; [] switches it off. Never the app's default role (the one customers sign in with): that would show every customer to every other customer, and the hub refuses it. Off until the owner asks for it. SERVER KEYS (ak_...), for the app's own server or an n8n workflow, used with @awesomate/sdk createClient({ token: <key> }) or as a Bearer token on https://hub.awesomate.ai/api/sdk/v1/server: action 'keys' {app_id} lists them (never the secrets); 'create_key' {app_id, name, access: 'read'|'write', kinds?} makes one (kinds leaves it to those kinds, 'contact' to read contacts; leave it out for every kind) and returns the key ONCE: put it straight into the app server's environment (awesomate_app_set_env for an app hosted with us, or the n8n credential) and never into browser code, a repository or a reply to the user; 'revoke_key' {app_id, key_id} stops it at once. A key reads every attribute of an app kind, contacts only as you read them, and writes need Support Plus and above. Prefer the narrowest key: read unless the server writes, and only the kinds it uses.",
     inputSchema: {
-      action: external_exports.enum(["list", "create", "update", "keys", "create_key", "revoke_key"]),
-      app_id: external_exports.string().max(48).optional().describe("update, keys, create_key, revoke_key: the app"),
+      action: external_exports.enum(["list", "create", "update", "keys", "create_key", "revoke_key", "customer_lookup"]),
+      app_id: external_exports.string().max(48).optional().describe("update, keys, create_key, revoke_key, customer_lookup: the app"),
       access: external_exports.enum(["read", "write"]).optional().describe("create_key"),
       kinds: external_exports.array(external_exports.string().max(41)).max(50).optional().describe("create_key: only these kinds (contact to read contacts); leave out for every kind"),
       key_id: external_exports.string().max(64).optional().describe("revoke_key: from keys"),
+      roles: external_exports.array(external_exports.string().max(31)).max(10).optional().describe("customer_lookup: the roles that may look customers up; [] switches it off; leave out to read"),
       name: external_exports.string().max(80).optional(),
       allowed_origins: external_exports.array(external_exports.string().max(200)).max(10).optional(),
       sign_up: external_exports.enum(["invite", "open"]).optional(),
@@ -42901,10 +42902,15 @@ server.registerTool(
       status: external_exports.enum(["active", "disabled"]).optional().describe("update only")
     }
   },
-  async ({ action, app_id, name, allowed_origins, sign_up, default_role, status, access, kinds, key_id }) => {
+  async ({ action, app_id, name, allowed_origins, sign_up, default_role, status, access, kinds, key_id, roles }) => {
     try {
       const cfg = requireConfig();
       if (action === "list") return textResult(await hubGet(cfg, "/api/my-crm/v1/apps"));
+      if (action === "customer_lookup") {
+        if (!app_id) return errorResult(new Error("customer_lookup needs app_id, from list."));
+        const path = `/api/my-crm/v1/apps/${encodeURIComponent(app_id)}/customer-lookup`;
+        return textResult(roles === void 0 ? await hubGet(cfg, path) : await hubPut(cfg, path, { roles }));
+      }
       if (action === "keys" || action === "create_key" || action === "revoke_key") {
         if (!app_id) return errorResult(new Error(`${action} needs app_id, from list.`));
         const keys = `/api/my-crm/v1/apps/${encodeURIComponent(app_id)}/keys`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awesomate/hosting-mcp",
-  "version": "0.50.0",
+  "version": "0.51.0",
   "description": "Awesomate MCP server — lets Claude manage your Awesomate WordPress hosting, plan, limits, n8n automations, and build Node/static apps + databases",
   "license": "UNLICENSED",
   "type": "module",

package/skill/CHANGELOG.json

@@ -1,5 +1,12 @@
 {
   "versions": [
+    {
+      "version": "0.51.0",
+      "highlights": [
+        "Your app's staff can now find a customer and put a job under them, straight from the portal. Switch it on per app for the roles that need it (awesomate_crm_apps, customer_lookup). Pro and above",
+        "They see name, email and phone only, never a field you marked sensitive, and never the role your customers sign in with: customers still see only themselves"
+      ]
+    },
     {
       "version": "0.50.0",
       "highlights": [

package/skill/awesomate-portals/SKILL.md

@@ -63,9 +63,11 @@ message: {"read": {"member": "linked:job.customer", "staff": "all"}, "write": {"
   a mistake in the page can never show anyone more than their role allows.
 - A person can only link a record to something they can see: a customer can point a job at their
   own contact, never someone else's.
-- **Known gap:** staff cannot yet put a job under a customer from the portal (they can only link
-  to contacts they can see, and app people do not read the contact list). Until that lands, the
-  owner creates or reassigns jobs for customers through Claude (`awesomate_crm_write`).
+- **Staff putting a job under a customer** needs one more switch, per app: app people read no
+  contacts but their own, so by default staff can only link to themselves. Ask the owner, then
+  `awesomate_crm_apps {action:'customer_lookup', app_id, roles:['staff']}`. Those roles can then
+  search customers (name, email, phone; never a sensitive field) and link a record to any of
+  them. Never the app's default role (the one customers sign in with); the hub refuses it.
 
 ## 4. Create the app and add people
 
@@ -84,7 +86,7 @@ loads from a CDN, or from npm in a Vite app:
 
 ```html
 <script type="module">
-import { createAppClient } from 'https://cdn.jsdelivr.net/npm/@awesomate/sdk@0.6/+esm';
+import { createAppClient } from 'https://cdn.jsdelivr.net/npm/@awesomate/sdk@0.8/+esm';
 const app = createAppClient({ publishableKey: 'pk_...' });
 
 // The email link signs them in by itself (also when it opens in a tab already on this page).
@@ -100,6 +102,10 @@ await app.auth.signInWithLink(email, { redirectTo: location.href });
 const stop = app.live('job', { orderBy: ['created_at', 'desc'], limit: 100 }, (rows) => renderJobs(rows));
 await app.write('job', { title: 'Leaking tap', status: 'open' }, { links: { customer: user.contact_id } });
 await app.write('message', { body }, { links: { job: jobId } });
+
+// Staff, once customer_lookup is on for their role: find a customer, file a job for them.
+const [customer] = await app.lookupCustomers({ q: 'jo' });
+await app.write('job', { title: 'Gutters', status: 'open' }, { links: { customer: customer.id } });
 </script>
 ```