@awesomate/hosting-mcp 0.67.0 → 0.69.0

package/dist/index.js

@@ -39861,6 +39861,7 @@ var TOOL_FEATURE = {
   awesomate_crm_queries: "contacts",
   awesomate_crm_recipes: "contacts",
   awesomate_crm_email: "email",
+  awesomate_bookings: "bookings",
   awesomate_knowledge_status: "knowledge",
   awesomate_knowledge_provision: "knowledge",
   awesomate_knowledge_sources: "knowledge",
@@ -40110,6 +40111,227 @@ function hubPatch(config3, path, jsonBody = {}) {
 function hubDelete(config3, path, jsonBody) {
   return hubRequest(config3, "DELETE", path, jsonBody);
 }
+function serverMessage(body, status, fallback) {
+  const msg = body && typeof body === "object" && "message" in body && typeof body.message === "string" ? body.message : body && typeof body === "object" && "error" in body && typeof body.error === "string" ? body.error : `${fallback} (${status})`;
+  return /[.!?]$/.test(msg) ? msg : `${msg}.`;
+}
+async function readBody(res) {
+  const text = await res.text();
+  try {
+    return text ? JSON.parse(text) : null;
+  } catch {
+    return text;
+  }
+}
+async function hubUploadRaw(config3, path, file) {
+  const { openAsBlob } = await import("node:fs");
+  const blob = typeof openAsBlob === "function" ? await openAsBlob(file.localPath, { type: file.contentType ?? "application/octet-stream" }) : new Blob([await (await import("node:fs/promises")).readFile(file.localPath)], {
+    type: file.contentType ?? "application/octet-stream"
+  });
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), 6e5);
+  let res;
+  try {
+    res = await (0, import_undici.fetch)(`${config3.apiBase}${path}`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${config3.pat}`,
+        "Content-Type": blob.type || "application/octet-stream",
+        "Content-Length": String(blob.size)
+      },
+      body: blob,
+      signal: controller.signal,
+      dispatcher: proxyDispatcher
+    });
+  } catch (err) {
+    const aborted2 = err instanceof Error && err.name === "AbortError";
+    throw new HubApiError(
+      aborted2 ? "The upload timed out after 10 minutes. Try a smaller file, or upload it in the hub at Knowledge, Files." : `Could not reach the Awesomate hub at ${config3.apiBase} to upload. This is a connectivity issue, not an auth problem.`,
+      0,
+      null
+    );
+  } finally {
+    clearTimeout(timer);
+  }
+  const body = await readBody(res);
+  if (!res.ok) throw new HubApiError(serverMessage(body, res.status, "Upload failed"), res.status, body);
+  return body;
+}
+async function hubDownloadToFile(config3, path, localPath) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), 6e5);
+  try {
+    let res;
+    try {
+      res = await (0, import_undici.fetch)(`${config3.apiBase}${path}`, {
+        method: "GET",
+        headers: { Authorization: `Bearer ${config3.pat}` },
+        signal: controller.signal,
+        dispatcher: proxyDispatcher
+      });
+    } catch (err) {
+      const aborted2 = err instanceof Error && err.name === "AbortError";
+      throw new HubApiError(
+        aborted2 ? "The download timed out after 10 minutes." : `Could not reach the Awesomate hub at ${config3.apiBase} to download. This is a connectivity issue, not an auth problem.`,
+        0,
+        null
+      );
+    }
+    if (!res.ok || !res.body) {
+      const body = await readBody(res);
+      throw new HubApiError(serverMessage(body, res.status, "Download failed"), res.status, body);
+    }
+    const { createWriteStream } = await import("node:fs");
+    const { rename, rm } = await import("node:fs/promises");
+    const { Readable } = await import("node:stream");
+    const { pipeline } = await import("node:stream/promises");
+    const tmp = `${localPath}.part-${process.pid}-${Date.now()}`;
+    let bytes = 0;
+    const counted = Readable.fromWeb(res.body);
+    counted.on("data", (chunk) => {
+      bytes += chunk.length;
+    });
+    try {
+      await pipeline(counted, createWriteStream(tmp, { flags: "wx" }));
+      await rename(tmp, localPath);
+    } catch (err) {
+      await rm(tmp, { force: true });
+      throw err;
+    }
+    return bytes;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+// src/files.ts
+var FILES_ACTIONS = [
+  "status",
+  "list",
+  "search",
+  "download",
+  "upload",
+  "mkdir",
+  "move",
+  "make_public",
+  "make_private",
+  "delete"
+];
+var FILES_MAX_UPLOAD_BYTES = 50 * 1024 * 1024;
+var TOP = ["public", "private", "temp"];
+function filesPath(raw, what = "path") {
+  const p = String(raw ?? "").trim().replace(/^\/+/, "").replace(/^files\//, "");
+  const top = p.split("/")[0];
+  if (!p || !TOP.includes(top)) {
+    throw new Error(`${what} must start with public/, private/ or temp/ (got "${raw ?? ""}"). Paths are relative to the account's files folder.`);
+  }
+  return p;
+}
+function swapTopFolder(path, to) {
+  const rest = path.split("/").slice(1).join("/");
+  if (!rest) throw new Error(`"${path}" is a top folder. Name the file or folder inside it.`);
+  return `${to}/${rest}`;
+}
+function uploadTarget(dest, localName) {
+  const d = filesPath(dest, "path");
+  if (d.endsWith("/") || TOP.includes(d)) return `${d.replace(/\/$/, "")}/${localName}`;
+  return d;
+}
+var q = (params) => Object.entries(params).filter(([, v]) => v !== void 0 && v !== "").map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`).join("&");
+var PUBLIC_NOTE = "A file in public/ can be read by anyone who has its public_url, with no login. Files in private/ and temp/ are never served publicly.";
+async function filesAction(config3, args) {
+  switch (args.action) {
+    case "status": {
+      const caps = await hubGet(config3, "/api/files/capabilities");
+      if (!caps.enabled) {
+        const why = !caps.planEligible ? "Files comes with Support Plus, Pro and Embedded. Relay that honestly (hub.awesomate.ai/billing) and let the user decide." : !caps.variantEligible ? "Files needs a one-time switch of their automation account, which the owner starts in the hub at Knowledge, Files (a short restart). Never start it for them." : `The owner has not switched on "Open your automation account's file folders" in Settings, Privacy. Only they can switch it on; never do it for them.`;
+        return { ...caps, note: why };
+      }
+      const usage = await hubGet(config3, "/api/files/usage");
+      return { ...caps, usage, note: PUBLIC_NOTE };
+    }
+    case "list": {
+      const path = args.path ? filesPath(args.path) : "";
+      return { ...await hubGet(config3, `/api/files?${q({ path })}`), note: PUBLIC_NOTE };
+    }
+    case "search": {
+      const out = await hubGet(
+        config3,
+        `/api/files/search?${q({ q: args.q ?? "", top: args.top, exts: args.exts?.join(",") })}`
+      );
+      return out.truncated ? { ...out, note: "Only the first 200 matches came back. Narrow the search (a longer name, a top folder or file types) before saying something is not there." } : out;
+    }
+    case "download": {
+      const path = filesPath(args.path);
+      const { resolve: resolve3, basename, join: join4 } = await import("node:path");
+      const { existsSync: existsSync3, statSync } = await import("node:fs");
+      const { homedir: homedir4 } = await import("node:os");
+      const name = basename(path);
+      const raw = args.to ? args.to.startsWith("~") ? join4(homedir4(), args.to.slice(1)) : args.to : name;
+      let target = resolve3(raw);
+      if (existsSync3(target) && statSync(target).isDirectory()) target = join4(target, name);
+      if (existsSync3(target) && !args.overwrite) {
+        throw new Error(`${target} already exists on this computer. Ask the user, then pass overwrite: true or a different "to".`);
+      }
+      const bytes = await hubDownloadToFile(config3, `/api/files/stream?${q({ path, disposition: "attachment" })}`, target);
+      return { downloaded: path, savedTo: target, bytes };
+    }
+    case "upload": {
+      if (!args.localPath) throw new Error('upload needs localPath (the file on this computer) and path (where it goes, e.g. "public/images/").');
+      const { resolve: resolve3, basename, join: join4 } = await import("node:path");
+      const { existsSync: existsSync3, statSync } = await import("node:fs");
+      const { homedir: homedir4 } = await import("node:os");
+      const abs = resolve3(args.localPath.startsWith("~") ? join4(homedir4(), args.localPath.slice(1)) : args.localPath);
+      if (!existsSync3(abs)) throw new Error(`No file at ${abs}. Prefer an absolute path: this server's working directory may differ from the user's shell.`);
+      const st = statSync(abs);
+      if (!st.isFile()) throw new Error(`${abs} is not a file. Upload one file per call.`);
+      if (st.size > FILES_MAX_UPLOAD_BYTES) {
+        throw new Error(`${basename(abs)} is ${(st.size / 1024 / 1024).toFixed(1)} MB, over the 50 MB limit for one upload. Compress or split it.`);
+      }
+      const target = uploadTarget(args.path ?? "", basename(abs));
+      const out = await hubUploadRaw(
+        config3,
+        `/api/files?${q({ path: target, overwrite: args.overwrite ? "1" : void 0 })}`,
+        { localPath: abs }
+      );
+      return target.startsWith("public/") ? { ...out, note: PUBLIC_NOTE } : out;
+    }
+    case "mkdir":
+      return hubPost(config3, "/api/files/mkdir", { path: filesPath(args.path) });
+    case "move": {
+      const from = filesPath(args.path, "path");
+      const to = filesPath(args.to, "to");
+      if (to.startsWith("public/") && !from.startsWith("public/") && !args.confirm) {
+        throw new Error(`Moving into public/ makes the file readable by anyone with its address. Ask the user first, then call again with confirm: true.`);
+      }
+      return hubPost(config3, "/api/files/move", { from, to });
+    }
+    case "make_public": {
+      const from = filesPath(args.path);
+      if (from.startsWith("public/")) throw new Error(`${from} is already public.`);
+      if (!args.confirm) {
+        throw new Error("Making a file public means anyone with its address can read it, with no login. Ask the user first, then call again with confirm: true.");
+      }
+      const out = await hubPost(config3, "/api/files/move", { from, to: swapTopFolder(from, "public") });
+      return { ...out, note: `Moved from ${from}. Any workflow or page that used the old path needs the new one.` };
+    }
+    case "make_private": {
+      const from = filesPath(args.path);
+      if (!from.startsWith("public/")) throw new Error(`${from} is not in public/, so it is already private.`);
+      const out = await hubPost(config3, "/api/files/move", { from, to: swapTopFolder(from, "private") });
+      return {
+        ...out,
+        note: `Moved from ${from}. Its public address no longer serves it, but Cloudflare can keep showing the last copy for up to 4 hours, and a copy someone already downloaded is not recalled. Any workflow, page or app that used it needs changing.`
+      };
+    }
+    case "delete": {
+      const path = filesPath(args.path);
+      if (!args.confirm) throw new Error(`Delete moves ${path} to the trash. Ask the user first, then call again with confirm: true.`);
+      const out = await hubDelete(config3, `/api/files?${q({ path })}`);
+      return { ...out, note: "Moved to the trash folder (trashPath), not erased, and no longer counted toward the Files allowance." };
+    }
+  }
+}
 
 // src/skills.ts
 import { cpSync, existsSync as existsSync2, readdirSync, readFileSync as readFileSync2, rmSync, writeFileSync } from "node:fs";
@@ -40346,10 +40568,10 @@ function describeSourcePage(page) {
 async function knowledgeSources(config3, args) {
   try {
     if (args.action === "list") {
-      const q = new URLSearchParams();
-      if (args.cursor) q.set("cursor", args.cursor);
-      if (args.limit !== void 0) q.set("limit", String(args.limit));
-      const qs = q.toString();
+      const q2 = new URLSearchParams();
+      if (args.cursor) q2.set("cursor", args.cursor);
+      if (args.limit !== void 0) q2.set("limit", String(args.limit));
+      const qs = q2.toString();
       const page = await hubGet(config3, `/api/knowledge/sources${qs ? `?${qs}` : ""}`);
       return describeSourcePage(page);
     }
@@ -40358,11 +40580,11 @@ async function knowledgeSources(config3, args) {
       return { ...r, note: "Each rule keeps a File Manager folder synced into the knowledge base: files under path_prefix (matching include_globs, if any) are ingested with the rule visibility/tags/collection, re-ingested when they change, and handled per on_file_removed when they disappear. A worker sweeps every 15 min; uploads under an auto rule sync immediately; sync_run sweeps now." };
     }
     if (args.action === "sync_state") {
-      const q = new URLSearchParams();
-      if (args.ruleId !== void 0) q.set("rule_id", String(args.ruleId));
-      if (args.status) q.set("status", args.status);
-      if (args.limit !== void 0) q.set("limit", String(args.limit));
-      const qs = q.toString();
+      const q2 = new URLSearchParams();
+      if (args.ruleId !== void 0) q2.set("rule_id", String(args.ruleId));
+      if (args.status) q2.set("status", args.status);
+      if (args.limit !== void 0) q2.set("limit", String(args.limit));
+      const qs = q2.toString();
       return await hubGet(config3, `/api/knowledge/files-sync/state${qs ? `?${qs}` : ""}`);
     }
     if (args.action === "sync_rule_create") {
@@ -40389,15 +40611,15 @@ async function knowledgeSources(config3, args) {
       return { ...r, note: 'Files ingested this run are queued on the platform; verify with awesomate_knowledge_sources {action:"jobs"} and a search for a phrase from the file, never with the run summary alone.' };
     }
     if (args.action === "search") {
-      const q = new URLSearchParams();
-      if (args.q) q.set("q", args.q);
-      if (args.kind) q.set("kind", args.kind);
-      if (args.visibility) q.set("visibility", args.visibility);
-      for (const t of args.tags ?? []) q.append("tag", t);
-      for (const c of args.collectionIds ?? []) q.append("collection", c);
-      if (args.cursor) q.set("cursor", args.cursor);
-      if (args.limit !== void 0) q.set("limit", String(args.limit));
-      const qs = q.toString();
+      const q2 = new URLSearchParams();
+      if (args.q) q2.set("q", args.q);
+      if (args.kind) q2.set("kind", args.kind);
+      if (args.visibility) q2.set("visibility", args.visibility);
+      for (const t of args.tags ?? []) q2.append("tag", t);
+      for (const c of args.collectionIds ?? []) q2.append("collection", c);
+      if (args.cursor) q2.set("cursor", args.cursor);
+      if (args.limit !== void 0) q2.set("limit", String(args.limit));
+      const qs = q2.toString();
       const page = await hubGet(config3, `/api/knowledge/library${qs ? `?${qs}` : ""}`);
       return { ...describeSourcePage(page), note_visibility: "Each source carries visibility (private|internal|public \u2014 who may retrieve it; enforced) and collections. Nothing marked public = a public chatbot answers nothing." };
     }
@@ -40457,8 +40679,8 @@ async function knowledgeSources(config3, args) {
       }
     }
     if (args.action === "jobs") {
-      const q = args.status ? `?status=${encodeURIComponent(args.status)}` : "";
-      return await hubGet(config3, `/api/knowledge/jobs${q}`);
+      const q2 = args.status ? `?status=${encodeURIComponent(args.status)}` : "";
+      return await hubGet(config3, `/api/knowledge/jobs${q2}`);
     }
     if (args.action === "remove") {
       if (!args.sourceId) throw new Error("sourceId is required for remove");
@@ -40622,10 +40844,10 @@ async function knowledgePeople(config3, args) {
       const probe = await hubGet(config3, "/api/knowledge/entities");
       if (!probe.available) return entityLayerUnavailablePayload();
       if (args.action === "list") {
-        const q = new URLSearchParams();
-        if (args.status) q.set("status", args.status);
-        if (args.cursor) q.set("cursor", args.cursor);
-        const qs = q.toString();
+        const q2 = new URLSearchParams();
+        if (args.status) q2.set("status", args.status);
+        if (args.cursor) q2.set("cursor", args.cursor);
+        const qs = q2.toString();
         const page = await hubGet(config3, `/api/knowledge/people${qs ? `?${qs}` : ""}`);
         return {
           ...page,
@@ -40636,10 +40858,10 @@ async function knowledgePeople(config3, args) {
         };
       }
       if (args.action === "aliases") {
-        const q = new URLSearchParams({ status: "pending" });
-        if (args.kind) q.set("kind", args.kind);
-        if (args.cursor) q.set("cursor", args.cursor);
-        const page = await hubGet(config3, `/api/knowledge/entities/aliases?${q.toString()}`);
+        const q2 = new URLSearchParams({ status: "pending" });
+        if (args.kind) q2.set("kind", args.kind);
+        if (args.cursor) q2.set("cursor", args.cursor);
+        const page = await hubGet(config3, `/api/knowledge/entities/aliases?${q2.toString()}`);
         return {
           ...page,
           note: "Each suggestion is a text name the content uses that probably refers to a known entity. Show the user the alias, the suggested match and the confidence, then use decide with the (kind, alias_norm) pair: only after they explicitly say accept, reject, or create."
@@ -40763,9 +40985,9 @@ function plainSnippet(text) {
 }
 async function knowledgeSearch(config3, args) {
   try {
-    const q = new URLSearchParams();
-    if (args.q) q.set("q", args.q);
-    if (args.kind) q.set("kind", args.kind);
+    const q2 = new URLSearchParams();
+    if (args.q) q2.set("q", args.q);
+    if (args.kind) q2.set("kind", args.kind);
     for (const [name, values] of [
       ["topic", args.topic],
       ["person", args.person],
@@ -40775,12 +40997,12 @@ async function knowledgeSearch(config3, args) {
       ["year", args.year],
       ["doc", args.doc]
     ]) {
-      for (const v of values ?? []) q.append(name, v);
+      for (const v of values ?? []) q2.append(name, v);
     }
-    if (args.limit !== void 0) q.set("limit", String(args.limit));
-    if (args.offset !== void 0) q.set("offset", String(args.offset));
-    if (args.include_media) q.set("include", "media");
-    const qs = q.toString();
+    if (args.limit !== void 0) q2.set("limit", String(args.limit));
+    if (args.offset !== void 0) q2.set("offset", String(args.offset));
+    if (args.include_media) q2.set("include", "media");
+    const qs = q2.toString();
     const result = await hubGet(config3, `/api/knowledge/explore${qs ? `?${qs}` : ""}`);
     const hits = Array.isArray(result.hits) ? result.hits.map((h) => ({
       ...h,
@@ -41336,6 +41558,7 @@ var TITLES = {
   awesomate_knowledge_ask: "Ask the Knowledge Base",
   awesomate_knowledge_sources: "Manage knowledge sources",
   awesomate_knowledge_upload: "Upload file to Knowledge Base",
+  awesomate_files: "Manage Files (public and private file folders)",
   awesomate_knowledge_agent: "Configure knowledge agent",
   awesomate_knowledge_agents: "Manage knowledge agents",
   awesomate_knowledge_collections: "Manage knowledge collections",
@@ -41356,6 +41579,7 @@ var TITLES = {
   awesomate_crm_assistant: "Set up the AI in your app's conversations",
   awesomate_crm_notifications: "Email people when someone replies in your app",
   awesomate_crm_hooks: "Send record changes to your n8n",
+  awesomate_bookings: "Your booking diary and booking box",
   awesomate_crm_email: "Draft an email to a contact list"
 };
 function annotate(name, kind) {
@@ -41534,8 +41758,8 @@ server.registerTool(
         return textResult(await hubGet(cfg, "/api/my-n8n/machine/agents/status"));
       }
       if (action === "describe") {
-        const q = tool ? `?name=${encodeURIComponent(tool)}` : "";
-        return textResult(await hubGet(cfg, `/api/my-n8n/machine/agents/tools${q}`));
+        const q2 = tool ? `?name=${encodeURIComponent(tool)}` : "";
+        return textResult(await hubGet(cfg, `/api/my-n8n/machine/agents/tools${q2}`));
       }
       if (action === "result") {
         if (!call_id) return errorResult(new Error('call_id is required for action "result"'));
@@ -41610,10 +41834,10 @@ server.registerTool(
       if (action === "mine") return textResult(await hubGet(cfg, "/api/bookings"));
       if (!session_type) return errorResult(new Error(`session_type is required for ${action}`));
       if (action === "slots") {
-        const q = new URLSearchParams({ session_type });
-        if (from) q.set("from", String(Date.parse(from)));
-        if (to) q.set("to", String(Date.parse(to)));
-        return textResult(await hubGet(cfg, `/api/bookings/slots?${q.toString()}`));
+        const q2 = new URLSearchParams({ session_type });
+        if (from) q2.set("from", String(Date.parse(from)));
+        if (to) q2.set("to", String(Date.parse(to)));
+        return textResult(await hubGet(cfg, `/api/bookings/slots?${q2.toString()}`));
       }
       if (!starts_at || !host_team_member_id) return errorResult(new Error("starts_at and host_team_member_id are required for book"));
       return textResult(
@@ -41664,8 +41888,8 @@ server.registerTool(
         if (active) qs.set("active", active);
         if (limit) qs.set("limit", String(limit));
         if (offset) qs.set("offset", String(offset));
-        const q = qs.toString();
-        return textResult(await hubGet(requireConfig(), `/api/my-n8n/machine/workflows${q ? `?${q}` : ""}`));
+        const q2 = qs.toString();
+        return textResult(await hubGet(requireConfig(), `/api/my-n8n/machine/workflows${q2 ? `?${q2}` : ""}`));
       }
       const full = await hubGet(requireConfig(), `/api/my-n8n/workflows/${encodeURIComponent(id)}`);
       if (detail === "structure" && full?.workflow?.nodes) {
@@ -41696,8 +41920,8 @@ server.registerTool(
       const cfg = requireConfig();
       if (what === "datatable_rows") {
         if (!datatableId) return errorResult(new Error("datatableId is required for datatable_rows"));
-        const q = limit ? `?limit=${limit}` : "";
-        return textResult(await hubGet(cfg, `/api/my-n8n/machine/datatables/${encodeURIComponent(datatableId)}/rows${q}`));
+        const q2 = limit ? `?limit=${limit}` : "";
+        return textResult(await hubGet(cfg, `/api/my-n8n/machine/datatables/${encodeURIComponent(datatableId)}/rows${q2}`));
       }
       const path = {
         nodes: "/api/my-n8n/machine/nodes",
@@ -41850,19 +42074,19 @@ server.registerTool(
       )
     }
   },
-  async ({ action, q, subject, message, category }) => {
+  async ({ action, q: q2, subject, message, category }) => {
     try {
       const cfg = requireConfig();
       if (action === "ask") {
-        if (!q) return errorResult(new Error("ask needs q"));
-        return textResult(await hubGet(cfg, `/api/help/ask?q=${encodeURIComponent(q)}`));
+        if (!q2) return errorResult(new Error("ask needs q"));
+        return textResult(await hubGet(cfg, `/api/help/ask?q=${encodeURIComponent(q2)}`));
       }
       if (action === "faq") {
-        return textResult(await hubGet(cfg, `/api/help/faq${q ? `?q=${encodeURIComponent(q)}` : ""}`));
+        return textResult(await hubGet(cfg, `/api/help/faq${q2 ? `?q=${encodeURIComponent(q2)}` : ""}`));
       }
       if (action === "help_docs") {
-        if (!q) return errorResult(new Error("help_docs needs q"));
-        return textResult(await hubGet(cfg, `/api/help/docs?q=${encodeURIComponent(q)}`));
+        if (!q2) return errorResult(new Error("help_docs needs q"));
+        return textResult(await hubGet(cfg, `/api/help/docs?q=${encodeURIComponent(q2)}`));
       }
       if (action === "list_tickets") {
         return textResult(await hubGet(cfg, "/api/support/tickets"));
@@ -42564,10 +42788,10 @@ server.registerTool(
       limit: external_exports.number().int().min(1).max(200).optional().describe("list only: page size (default 50, max 200)")
     }
   },
-  async ({ action, url, sitemap, since, sourceId, status, cursor, limit, q, kind, visibility, tags, collectionIds, removeCollectionIds, sourceIds, confirm, pathPrefix, includeGlobs, onFileRemoved, ruleId }) => {
+  async ({ action, url, sitemap, since, sourceId, status, cursor, limit, q: q2, kind, visibility, tags, collectionIds, removeCollectionIds, sourceIds, confirm, pathPrefix, includeGlobs, onFileRemoved, ruleId }) => {
     try {
       return knowledgeResult(
-        await knowledgeSources(requireConfig(), { action, url, sitemap, since, sourceId, status, cursor, limit, q, kind, visibility, tags, collectionIds, removeCollectionIds, sourceIds, confirm, pathPrefix, includeGlobs, onFileRemoved, ruleId })
+        await knowledgeSources(requireConfig(), { action, url, sitemap, since, sourceId, status, cursor, limit, q: q2, kind, visibility, tags, collectionIds, removeCollectionIds, sourceIds, confirm, pathPrefix, includeGlobs, onFileRemoved, ruleId })
       );
     } catch (err) {
       return knowledgeError(err);
@@ -42762,6 +42986,31 @@ server.registerTool(
     }
   }
 );
+server.registerTool(
+  "awesomate_files",
+  {
+    annotations: annotate("awesomate_files", DESTRUCTIVE),
+    description: `The account's Files: the folders on their automation account (n8n) that workflows read and write, and that the hub shows at Knowledge, Files. Three top folders: public/ (every file has a public_url anyone can open with no login: images for a site or email, downloads, media a workflow made), private/ (only the account, its workflows and the hub) and temp/ (scratch space). Support Plus, Pro and Embedded; the owner must also have switched on "Open your automation account's file folders" in Settings, Privacy. Paths are relative to the files folder and start with the top folder, e.g. public/images/logo.png. action 'status': whether Files is on, why not, and storage used against the plan's limit: call this first. 'list' {path?}: one folder (no path = the top folders); files in public/ carry public_url. 'search' {q?, top?, exts?}: find files by name across the folders (first 200 matches; truncated:true means narrow it). 'download' {path, to?, overwrite?}: save a file to THIS computer (to = a local file or folder, default the working directory); never overwrites without overwrite:true. 'upload' {localPath, path, overwrite?}: send a file from this computer (max 50 MB each); path is the target file, or a folder ending in / to keep the name. Upload into public/ only when the user wants it publicly reachable. 'mkdir' {path}. 'move' {path, to}: rename or move; moving into public/ needs confirm:true. 'make_public' {path, confirm:true}: moves private/ or temp/ to the same place under public/ and returns its public_url: ASK the user first, anyone with the address can read it. 'make_private' {path}: moves it out of public/, so its public address stops serving it; Cloudflare can keep showing the last copy for up to 4 hours (also after a delete or a replace of a public file), so never promise it is gone at once. 'delete' {path, confirm:true}: moves to the trash (not erased); ask first. Moving or renaming changes the path, so tell the user any workflow, page or app using the old path or address needs the new one. Contents stream between this computer and the hub: never paste a file's contents into the conversation to move it. A 507 files_storage_full means the plan's Files allowance is used: say how much, offer to find large or old files to remove, and leave any plan change to the user.`,
+    inputSchema: {
+      action: external_exports.enum(FILES_ACTIONS),
+      path: external_exports.string().max(1024).optional().describe("A path in Files, starting public/, private/ or temp/. For upload, the target (a folder ending in / keeps the local name)."),
+      to: external_exports.string().max(4096).optional().describe("move: the new Files path. download: where to save on this computer (file or folder; ~ expands)."),
+      localPath: external_exports.string().max(4096).optional().describe("upload: the file on this computer (~ expands; prefer an absolute path)."),
+      q: external_exports.string().max(200).optional().describe("search: part of a file name (* and ? work as wildcards)."),
+      top: external_exports.enum(["public", "private", "temp"]).optional().describe("search: only this top folder."),
+      exts: external_exports.array(external_exports.string().regex(/^\.[a-z0-9]+$/i)).max(20).optional().describe('search: only these extensions, e.g. [".png", ".jpg"].'),
+      overwrite: external_exports.boolean().optional().describe("upload: replace a file already at path. download: replace a local file."),
+      confirm: external_exports.boolean().optional().describe("true only after the user agreed: make_public, delete, and a move into public/.")
+    }
+  },
+  async (args) => {
+    try {
+      return textResult(await filesAction(requireConfig(), args));
+    } catch (err) {
+      return errorResult(err);
+    }
+  }
+);
 server.registerTool(
   "awesomate_knowledge_people",
   {
@@ -43035,7 +43284,7 @@ server.registerTool(
   "awesomate_crm_apps",
   {
     annotations: annotate("awesomate_crm_apps", MUTATING),
-    description: "The account's own apps (a client portal, a members' app) whose users sign in by email link and then read and change only what each kind's access rules allow them (awesomate_crm_kinds set_access). Pro and above to create or change; reading is every plan. action 'list': each app with its publishable key, allowed origins, sign-up mode and default role. action 'create' {name, allowed_origins, sign_up?, default_role?}: name appears in the sign-in email; allowed_origins are the exact origins the app runs on (https://portal.example.com; http://localhost:5173 for development; capacitor://localhost for the mobile shell), with no path and no wildcard; sign_up 'invite' (default: only people added with awesomate_crm_app_users) or 'open' (anyone who uses the email link gets the default role). action 'update' {app_id, ...any of those, status?}: status 'disabled' signs everyone out of that app and stops its server keys; voice_agent_id names the account's agent that signed-in people talk to by voice (Talk to the agent: @awesomate/sdk voiceAgent() and voiceSession() with the hub's AwesomateAgent widget; the agent greets them by name and, when the app's assistant is set up, knows the 10 most recent conversations they can see, read as them; the app's origin must also be listed under the agent's 'Where your app runs'), null takes it away. The publishable key (pk_...) is not a secret: it goes in the app's browser code, with @awesomate/sdk. Never put the account's own token (amt_pat_...) in browser code. SDK docs, with a tutorial that builds a customer portal: https://hub.awesomate.ai/docs/sdk/ (as one text file for you: https://hub.awesomate.ai/docs/sdk/llms-full.txt). Confirm origins and sign-up mode with the user: open sign-up lets strangers in under the default role. action 'customer_lookup' {app_id, roles?}: which roles in that app may look customers up (name, email and phone, by search or id, with @awesomate/sdk lookupCustomers) and so put a record under any customer, not only themselves. Without roles it reads the setting; roles ['staff'] switches it on for staff; [] switches it off. Never the app's default role (the one customers sign in with): that would show every customer to every other customer, and the hub refuses it. Off until the owner asks for it. SERVER KEYS (ak_...), for the app's own server or an n8n workflow, used with @awesomate/sdk createClient({ token: <key> }) or as a Bearer token on https://hub.awesomate.ai/api/sdk/v1/server: action 'keys' {app_id} lists them (never the secrets); 'create_key' {app_id, name, access: 'read'|'write', kinds?} makes one (kinds leaves it to those kinds, 'contact' to read contacts; leave it out for every kind) and returns the key ONCE: put it straight into the app server's environment (awesomate_app_set_env for an app hosted with us) and never into browser code, a repository or a reply to the user. For an n8n workflow pass n8n_credential: true instead (prefer it): the hub puts the key into a Header Auth credential 'Awesomate app key: <name>' on their n8n (Authorization: Bearer, usable only towards the hub) and returns only its id and name, so the key never passes through you. 'revoke_key' {app_id, key_id} stops it at once, and removes a credential the hub made. A key reads every attribute of an app kind, contacts only as you read them, and writes need Support Plus and above. Prefer the narrowest key: read unless the server writes, and only the kinds it uses.",
+    description: "The account's own apps (a client portal, a members' app) whose users sign in by email link and then read and change only what each kind's access rules allow them (awesomate_crm_kinds set_access). Pro and above to create or change; reading is every plan. action 'list': each app with its publishable key, allowed origins, sign-up mode and default role. action 'create' {name, allowed_origins, sign_up?, default_role?}: name appears in the sign-in email; allowed_origins are the exact origins the app runs on (https://portal.example.com; http://localhost:5173 for development; capacitor://localhost for the mobile shell), with no path and no wildcard; sign_up 'invite' (default: only people added with awesomate_crm_app_users) or 'open' (anyone who uses the email link gets the default role). action 'update' {app_id, ...any of those, status?}: status 'disabled' signs everyone out of that app and stops its server keys; voice_agent_id names the account's agent that signed-in people talk to by voice (Talk to the agent: @awesomate/sdk voiceAgent() and voiceSession() with the hub's AwesomateAgent widget; the agent greets them by name and, when the app's assistant is set up, knows the 10 most recent conversations they can see, read as them; the app's origin must also be listed under the agent's 'Where your app runs'), null takes it away; file_uploads 'off' (default) | 'private' | 'public' lets signed-in people upload files from the app (@awesomate/sdk files.upload, up to 10 MB each) into the account's Files under private/apps/<app_id>/ or public/apps/<app_id>/ (public gives each a public address; page and script types are refused there), counted toward the plan's Files space: with open sign-up that means anyone, so confirm with the user. The publishable key (pk_...) is not a secret: it goes in the app's browser code, with @awesomate/sdk. Never put the account's own token (amt_pat_...) in browser code. SDK docs, with a tutorial that builds a customer portal: https://hub.awesomate.ai/docs/sdk/ (as one text file for you: https://hub.awesomate.ai/docs/sdk/llms-full.txt). Confirm origins and sign-up mode with the user: open sign-up lets strangers in under the default role. action 'customer_lookup' {app_id, roles?}: which roles in that app may look customers up (name, email and phone, by search or id, with @awesomate/sdk lookupCustomers) and so put a record under any customer, not only themselves. Without roles it reads the setting; roles ['staff'] switches it on for staff; [] switches it off. Never the app's default role (the one customers sign in with): that would show every customer to every other customer, and the hub refuses it. Off until the owner asks for it. SERVER KEYS (ak_...), for the app's own server or an n8n workflow, used with @awesomate/sdk createClient({ token: <key> }) or as a Bearer token on https://hub.awesomate.ai/api/sdk/v1/server: action 'keys' {app_id} lists them (never the secrets); 'create_key' {app_id, name, access: 'read'|'write', kinds?} makes one (kinds leaves it to those kinds, 'contact' to read contacts; leave it out for every kind) and returns the key ONCE: put it straight into the app server's environment (awesomate_app_set_env for an app hosted with us) and never into browser code, a repository or a reply to the user. For an n8n workflow pass n8n_credential: true instead (prefer it): the hub puts the key into a Header Auth credential 'Awesomate app key: <name>' on their n8n (Authorization: Bearer, usable only towards the hub) and returns only its id and name, so the key never passes through you. 'revoke_key' {app_id, key_id} stops it at once, and removes a credential the hub made. A key reads every attribute of an app kind, contacts only as you read them, and writes need Support Plus and above. Prefer the narrowest key: read unless the server writes, and only the kinds it uses.",
     inputSchema: {
       action: external_exports.enum(["list", "create", "update", "keys", "create_key", "revoke_key", "customer_lookup"]),
       app_id: external_exports.string().max(48).optional().describe("update, keys, create_key, revoke_key, customer_lookup: the app"),
@@ -43049,10 +43298,11 @@ server.registerTool(
       sign_up: external_exports.enum(["invite", "open"]).optional(),
       default_role: external_exports.string().max(31).optional().describe("lower case; the role open sign-up gives"),
       status: external_exports.enum(["active", "disabled"]).optional().describe("update only"),
-      voice_agent_id: external_exports.string().uuid().nullable().optional().describe("update only: the account's own agent (awesomate_knowledge_agents list) that signed-in people talk to by voice in this app; null takes voice away")
+      voice_agent_id: external_exports.string().uuid().nullable().optional().describe("update only: the account's own agent (awesomate_knowledge_agents list) that signed-in people talk to by voice in this app; null takes voice away"),
+      file_uploads: external_exports.enum(["off", "private", "public"]).optional().describe("update only: whether signed-in people may upload files from the app, and whether each gets a public address")
     }
   },
-  async ({ action, app_id, name, allowed_origins, sign_up, default_role, status, voice_agent_id, access, kinds, key_id, roles, n8n_credential }) => {
+  async ({ action, app_id, name, allowed_origins, sign_up, default_role, status, voice_agent_id, file_uploads, access, kinds, key_id, roles, n8n_credential }) => {
     try {
       const cfg = requireConfig();
       if (action === "list") return textResult(await hubGet(cfg, "/api/my-crm/v1/apps"));
@@ -43078,7 +43328,8 @@ server.registerTool(
       return textResult(await hubPatch(cfg, `/api/my-crm/v1/apps/${encodeURIComponent(app_id)}`, {
         ...fields,
         ...status ? { status } : {},
-        ...voice_agent_id === void 0 ? {} : { voice_agent_id }
+        ...voice_agent_id === void 0 ? {} : { voice_agent_id },
+        ...file_uploads ? { file_uploads } : {}
       }));
     } catch (err) {
       return errorResult(err);
@@ -43187,6 +43438,109 @@ server.registerTool(
     }
   }
 );
+server.registerTool(
+  "awesomate_bookings",
+  {
+    annotations: annotate("awesomate_bookings", MUTATING),
+    description: `The business's own booking diary: customers book appointments or classes on the business's website, get an email with an invite and a link to change or cancel, and each booking lands in Contacts linked to the person. Read the awesomate-bookings skill first. Reading is every plan; every action that changes something needs Support Plus or above (on Essentials the hub answers upgrade_required: tell the owner they can do it in the hub under Contacts, Bookings, and do not retry). action 'setup': calendars, services, and this month's website bookings against the plan's limit. 'save_calendar' {key, name, timezone, hours, min_notice_minutes?, buffer_minutes?, max_per_day?, notify_email?, active?}: a person, room or resource with weekly hours ({"mon": [["09:00","17:00"]]}, 24-hour, in its own zone); a change names only what moves. 'save_service' {key, name, minutes, calendars, capacity?, price_text?, location?, cancel_cutoff_hours?, intake?, description?, active?}: capacity above 1 is a class several people join at one start; price is shown, never charged. 'open_times' {service, from?, to?, calendar?}. 'list' {from?, to?, status?}: bookings with each customer and their answers. 'book' {service, calendar, starts_at (from open_times), email, first_name?, last_name?, phone?, answers?, notify?, outside_hours?}. 'move' {booking_id, starts_at, notify?, outside_hours?}. 'cancel' {booking_id, reason?, notify?}. notify: false skips the customer's email; the calendar's notice email always hears. 'keys': the booking keys for the account's websites, each with the snippet to paste. 'create_key' {website}: the booking box for one site (https), returns the snippet. 'update_key' {key_id, active?, website?}. Nobody can double-book a time: the hub re-checks under a lock and answers 409 with why (not_open, slot_taken, session_full, day_full).`,
+    inputSchema: {
+      action: external_exports.enum(["setup", "save_calendar", "save_service", "open_times", "list", "book", "move", "cancel", "keys", "create_key", "update_key"]),
+      key: external_exports.string().max(41).optional().describe("save_calendar, save_service: lower case, digits and underscores"),
+      name: external_exports.string().max(80).optional(),
+      timezone: external_exports.string().max(60).optional().describe("IANA zone, like Australia/Sydney"),
+      hours: external_exports.record(external_exports.string(), external_exports.array(external_exports.tuple([external_exports.string(), external_exports.string()]))).optional().describe('save_calendar: {"mon": [["09:00","17:00"]], ...}'),
+      min_notice_minutes: external_exports.number().int().min(0).optional(),
+      buffer_minutes: external_exports.number().int().min(0).optional(),
+      max_per_day: external_exports.number().int().min(1).nullable().optional(),
+      notify_email: external_exports.string().max(254).nullable().optional(),
+      active: external_exports.boolean().optional(),
+      minutes: external_exports.number().int().optional().describe("save_service: length in minutes"),
+      capacity: external_exports.number().int().min(1).optional(),
+      price_text: external_exports.string().max(80).optional(),
+      location: external_exports.string().max(500).optional(),
+      description: external_exports.string().max(2e3).optional(),
+      cancel_cutoff_hours: external_exports.number().int().min(0).optional(),
+      intake: external_exports.array(external_exports.object({
+        key: external_exports.string().max(41),
+        label: external_exports.string().max(200),
+        type: external_exports.enum(["text", "textarea", "select", "multiselect", "url"]),
+        required: external_exports.boolean().optional(),
+        options: external_exports.array(external_exports.string().max(100)).max(50).optional()
+      })).max(20).optional().describe("save_service: the questions asked when booking"),
+      calendars: external_exports.array(external_exports.string().max(41)).max(50).optional().describe("save_service: calendar keys that offer it"),
+      service: external_exports.string().max(41).optional(),
+      calendar: external_exports.string().max(41).optional(),
+      from: external_exports.string().max(40).optional(),
+      to: external_exports.string().max(40).optional(),
+      status: external_exports.enum(["confirmed", "cancelled", "completed", "no_show"]).optional(),
+      starts_at: external_exports.string().max(40).optional().describe("an ISO time from open_times"),
+      email: external_exports.string().max(254).optional(),
+      first_name: external_exports.string().max(80).optional(),
+      last_name: external_exports.string().max(80).optional(),
+      phone: external_exports.string().max(40).optional(),
+      answers: external_exports.record(external_exports.string(), external_exports.union([external_exports.string(), external_exports.array(external_exports.string())])).optional(),
+      notify: external_exports.boolean().optional(),
+      outside_hours: external_exports.boolean().optional(),
+      booking_id: external_exports.string().max(40).optional(),
+      reason: external_exports.string().max(500).optional(),
+      website: external_exports.string().max(300).optional().describe("create_key, update_key: the site address, like https://example.com.au"),
+      key_id: external_exports.number().int().optional().describe("update_key: from keys")
+    }
+  },
+  async (a) => {
+    try {
+      const cfg = requireConfig();
+      const base = "/api/my-crm/v1/bookings";
+      const pick2 = (...ks) => Object.fromEntries(ks.map((k) => [k, a[k]]).filter(([, v]) => v !== void 0));
+      const qs = (o) => Object.entries(o).filter(([, v]) => v !== void 0).map(([k, v]) => `${k}=${encodeURIComponent(String(v))}`).join("&");
+      const origin = (w) => new URL(w).origin;
+      switch (a.action) {
+        case "setup":
+          return textResult(await hubGet(cfg, `${base}/setup`));
+        case "save_calendar":
+          if (!a.key) return errorResult(new Error("save_calendar needs key."));
+          return textResult(await hubPut(
+            cfg,
+            `${base}/calendars/${encodeURIComponent(a.key)}`,
+            pick2("name", "timezone", "hours", "min_notice_minutes", "buffer_minutes", "max_per_day", "notify_email", "active")
+          ));
+        case "save_service":
+          if (!a.key) return errorResult(new Error("save_service needs key."));
+          return textResult(await hubPut(
+            cfg,
+            `${base}/services/${encodeURIComponent(a.key)}`,
+            pick2("name", "minutes", "capacity", "price_text", "location", "description", "cancel_cutoff_hours", "intake", "calendars", "active")
+          ));
+        case "open_times":
+          if (!a.service) return errorResult(new Error("open_times needs service."));
+          return textResult(await hubGet(cfg, `${base}/open-times?${qs({ service: a.service, from: a.from, to: a.to, calendar: a.calendar })}`));
+        case "list":
+          return textResult(await hubGet(cfg, `${base}/?${qs({ from: a.from, to: a.to, status: a.status })}`));
+        case "book":
+          return textResult(await hubPost(cfg, base, pick2("service", "calendar", "starts_at", "email", "first_name", "last_name", "phone", "answers", "notify", "outside_hours")));
+        case "move":
+          if (!a.booking_id) return errorResult(new Error("move needs booking_id, from list."));
+          return textResult(await hubPost(cfg, `${base}/${encodeURIComponent(a.booking_id)}/move`, pick2("starts_at", "notify", "outside_hours")));
+        case "cancel":
+          if (!a.booking_id) return errorResult(new Error("cancel needs booking_id, from list."));
+          return textResult(await hubPost(cfg, `${base}/${encodeURIComponent(a.booking_id)}/cancel`, pick2("reason", "notify")));
+        case "keys":
+          return textResult(await hubGet(cfg, `${base}/keys`));
+        case "create_key":
+          if (!a.website) return errorResult(new Error("create_key needs website: the site's address, like https://example.com.au."));
+          return textResult(await hubPost(cfg, `${base}/keys`, { name: new URL(a.website).hostname, allowed_origins: [origin(a.website)] }));
+        case "update_key":
+          if (a.key_id === void 0) return errorResult(new Error("update_key needs key_id, from keys."));
+          return textResult(await hubPatch(cfg, `${base}/keys/${a.key_id}`, {
+            ...a.active === void 0 ? {} : { active: a.active },
+            ...a.website ? { allowed_origins: [origin(a.website)] } : {}
+          }));
+      }
+    } catch (err) {
+      return errorResult(err);
+    }
+  }
+);
 server.registerTool(
   "awesomate_crm_notifications",
   {
@@ -43658,8 +44012,8 @@ server.registerTool(
   async ({ domain, path }) => {
     try {
       const dom = encodeURIComponent(domain.toLowerCase());
-      const q = path && path !== "/" ? `?path=${encodeURIComponent(path)}` : "";
-      return textResult(await hubGet(requireConfig(), `/api/client-hosting/sites/${dom}/audit${q}`));
+      const q2 = path && path !== "/" ? `?path=${encodeURIComponent(path)}` : "";
+      return textResult(await hubGet(requireConfig(), `/api/client-hosting/sites/${dom}/audit${q2}`));
     } catch (err) {
       return errorResult(err);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awesomate/hosting-mcp",
-  "version": "0.67.0",
+  "version": "0.69.0",
   "description": "Awesomate MCP server — lets Claude manage your Awesomate WordPress hosting, plan, limits, n8n automations, and build Node/static apps + databases",
   "license": "UNLICENSED",
   "type": "module",
@@ -19,7 +19,7 @@
   "scripts": {
     "build": "esbuild src/index.ts --bundle --platform=node --target=node18 --format=esm --outfile=dist/index.js --banner:js='#!/usr/bin/env node\nimport { createRequire as __awmCreateRequire } from \"node:module\"; const require = __awmCreateRequire(import.meta.url);' --external:node:*",
     "typecheck": "tsc --noEmit",
-    "test": "npm run build && esbuild src/config.ts --bundle --platform=node --target=node18 --format=esm --outfile=test/.build/config.mjs --external:node:* && esbuild src/knowledge.ts --bundle --platform=node --target=node18 --format=esm --outfile=test/.build/knowledge.mjs --banner:js='import { createRequire as __awmCreateRequire } from \"node:module\"; const require = __awmCreateRequire(import.meta.url);' --external:node:* && esbuild src/skills.ts --bundle --platform=node --target=node18 --format=esm --outfile=test/.build/skills.mjs --external:node:* && esbuild src/features.ts --bundle --platform=node --target=node18 --format=esm --outfile=test/.build/features.mjs --external:node:* && esbuild src/http.ts --bundle --platform=node --target=node18 --format=esm --outfile=test/.build/http.mjs --banner:js='import { createRequire as __awmCreateRequire } from \"node:module\"; const require = __awmCreateRequire(import.meta.url);' --external:node:* && node --test test/*.test.mjs",
+    "test": "npm run build && esbuild src/config.ts --bundle --platform=node --target=node18 --format=esm --outfile=test/.build/config.mjs --external:node:* && esbuild src/knowledge.ts --bundle --platform=node --target=node18 --format=esm --outfile=test/.build/knowledge.mjs --banner:js='import { createRequire as __awmCreateRequire } from \"node:module\"; const require = __awmCreateRequire(import.meta.url);' --external:node:* && esbuild src/skills.ts --bundle --platform=node --target=node18 --format=esm --outfile=test/.build/skills.mjs --external:node:* && esbuild src/features.ts --bundle --platform=node --target=node18 --format=esm --outfile=test/.build/features.mjs --external:node:* && esbuild src/http.ts --bundle --platform=node --target=node18 --format=esm --outfile=test/.build/http.mjs --banner:js='import { createRequire as __awmCreateRequire } from \"node:module\"; const require = __awmCreateRequire(import.meta.url);' --external:node:* && esbuild src/files.ts --bundle --platform=node --target=node18 --format=esm --outfile=test/.build/files.mjs --banner:js='import { createRequire as __awmCreateRequire } from \"node:module\"; const require = __awmCreateRequire(import.meta.url);' --external:node:* && node --test test/*.test.mjs",
     "prepublishOnly": "npm run typecheck && npm run test"
   },
   "dependencies": {

package/skill/CHANGELOG.json

@@ -1,5 +1,18 @@
 {
   "versions": [
+    {
+      "version": "0.69.0",
+      "highlights": [
+        "Bookings: your customers book appointments or classes on your own website, get an email with an invite and a link to change or cancel, and each booking lands in Contacts. Claude sets up your calendars, services and the booking box (awesomate_bookings), and can book, move and cancel for you"
+      ]
+    },
+    {
+      "version": "0.68.0",
+      "highlights": [
+        "Claude can work with your Files: the folders your workflows use on your automation account. Put an image up and get its public address, fetch a report a workflow saved, make a file public or private, and tidy up, with storage counted against your plan's Files space",
+        "Apps you build can let signed-in people attach files, such as a photo of a job, when you switch uploads on for the app"
+      ]
+    },
     {
       "version": "0.67.0",
       "highlights": [

package/skill/awesomate-bookings/SKILL.md

@@ -0,0 +1,83 @@
+---
+name: awesomate-bookings
+description: Let the business's own customers book appointments or classes online, and manage those bookings. Sets up calendars (a person, room or resource with weekly hours), services (what is booked, how long, how many places, the questions asked), and the booking box for their website, then books, moves and cancels for them. Use when the user says "booking", "bookings", "appointments", "book online", "booking calendar", "scheduling", "let customers book", "Calendly", "class bookings", "who's booked tomorrow", or wants a booking page on their site. Companion to awesomate-app-builder and awesomate-hosting (the page it goes on) and awesomate-n8n (follow-ups): same connection, same token.
+---
+
+# Awesomate Bookings: customers book themselves, bookings land in Contacts
+
+A business's customers pick a time on the business's own website, get an email with a calendar
+invite and a link to change or cancel, and the business gets a notice for each booking. Every
+booking is a record in the business's own Contacts, linked to the person who made it.
+
+Everything goes through one tool, `awesomate_bookings`. Work in plain words with the owner: ask
+what people book, who with, and when they are open, then set it up and show them the result in a
+sentence or two.
+
+## What it is made of
+
+- **Calendars**: a person, room or resource people book. Each has weekly hours in its own time
+  zone, how much notice it needs, a gap between bookings, an optional daily limit, and the email
+  that hears about every booking (with an invite for their own calendar). Set the notice email:
+  without one, customers' replies to booking emails reach nobody.
+- **Services**: what is booked. A length in minutes, places (1 for one person at a time, more for
+  a class several people join), a price shown as text (nothing is charged), where it happens,
+  questions to ask when booking, how many hours before the start changes close online, and which
+  calendars offer it.
+- **The booking box**: one key per website, locked to that site's address. `create_key` returns the
+  snippet to paste.
+
+## Setting up (in this order)
+
+1. `awesomate_bookings` action `save_calendar` with `key` (lower case, like `nicole`), `name`,
+   `timezone` (like `Australia/Sydney`), `hours` (`{"mon": [["09:00","17:00"]], ...}`, 24-hour, no
+   overlaps), and `notify_email`.
+2. `save_service` with `key`, `name`, `minutes`, `calendars` (keys), and optionally `capacity`,
+   `price_text`, `location`, `cancel_cutoff_hours`, `intake` (questions:
+   `[{"key":"reason","label":"What brings you in?","type":"textarea","required":true}]`; types are
+   text, textarea, select, multiselect, url; select and multiselect take `options`).
+3. `open_times` with `service` to check the times look right before telling the owner it is ready.
+4. `create_key` with `website` (the site's address, https). Put the returned `snippet` on the page
+   the owner wants, or give it to them to paste:
+
+```html
+<div data-awesomate-bookings></div>
+<script src="https://hub.awesomate.ai/widget/v1/bookings.js" data-key="bk_..." async></script>
+```
+
+On the div, `data-service="<key>"` offers one service only, and `data-accent="#0f766e"` colours the
+buttons to match the site. On a WordPress site, a Custom HTML block holds both lines. On a site you
+build with awesomate-app-builder, put them in the page where booking belongs (a "Book now" section,
+or a /book page) and deploy as usual. The box only works on the website named on its key: to use it
+on another domain, `update_key` with `allowed_origins`.
+
+Changing a calendar or service later: call the same `save_` action with only what changes.
+
+## Running the diary
+
+- `list` (optionally `from`, `to`, `status`): upcoming bookings with each customer's name, email,
+  phone and answers. Use it for "who's booked tomorrow".
+- `book`: book someone in (`service`, `calendar`, `starts_at` from `open_times`, the customer's
+  `email`, `first_name`, `last_name`, `phone`, `answers`). `notify: false` when the customer should
+  not get an email (a booking taken by phone that they already know about). Staff may book outside
+  the hours with `outside_hours: true`; nobody can double-book a time.
+- `move` (`booking_id`, `starts_at`) and `cancel` (`booking_id`, `reason`): the customer is emailed
+  unless `notify: false`, and the calendar's notice email always is.
+
+## Follow-ups through n8n (Pro)
+
+Each booking is a record of the `booking` kind in Contacts. On Pro, an account with one of its own
+apps (`awesomate_crm_apps`) can add a hook with `awesomate_crm_hooks` and `kinds: ["booking"]` to
+send each booking's created, updated and archived events to its own n8n: an SMS reminder, copying it
+into Google Calendar with the owner's own n8n credential, a thank-you after the visit. Bookings
+themselves cannot be written through `awesomate_crm_write`; only these actions change them.
+
+## Plans and limits
+
+- Every plan can set up bookings and take them on its website. Essentials takes up to 50 website
+  bookings a month; bookings the business makes itself never count.
+- Changing bookings from Claude Code (the write actions here) needs Support Plus or above. On
+  Essentials, the tool answers `upgrade_required`: say the owner can do the same in the hub under
+  Contacts, Bookings, and do not retry.
+- Payments and deposits are not part of bookings yet. Do not promise them; the price is shown only.
+- Two-way sync with the owner's own Google or Outlook calendar is not available yet: the notice
+  email's invite is how a booking reaches their calendar. Do not promise automatic sync.

package/skill/awesomate-hosting/SKILL.md

@@ -224,6 +224,7 @@ MCP, so say that rather than stopping.
 | `awesomate_dns_check` | Live answer to "where does this domain actually point" — before and after any DNS change |
 | `awesomate_site_uptime` | 30-day availability, incidents, downtime per domain (cached, free) |
 | `awesomate_site_audit` | SEO + AEO build gates for one page, fetched as GPTBot — content present without JS, retrieval bots reachable, canonical, schema, structure, speed. Not plan-gated. Run it after any public-page change, and see the awesomate-seo skill for the fixes |
+| `awesomate_files` | Files on their automation account (public/, private/, temp/): put an image or download up and hand back its `public_url`, fetch what a workflow wrote, tidy a folder. Ask before make_public, a move into public/, or delete. Support Plus+, owner's file-folders switch on (`status` says what's missing). Guide: https://hub.awesomate.ai/docs/mcp/guides/files/ |
 | `awesomate_snapshot_site` | Before ANY change to a live site — files + DB restore point |
 | `awesomate_list_snapshots` | What restore points a site has |
 | `awesomate_rollback_site` | Restore a snapshot after something went wrong (confirm first) |

package/skill/awesomate-portals/SKILL.md

@@ -178,6 +178,17 @@ https://hub.awesomate.ai/docs/sdk/guides/customer-actions/
   `agentId: await app.voiceAgent()` and `session: () => app.voiceSession()`. Guide:
   https://hub.awesomate.ai/docs/sdk/guides/voice/
 
+## 6b2. Optional: file uploads
+
+People signed in to the app can attach files (a photo of a job, a signed form) when the owner
+switches it on: `awesomate_crm_apps {action:'update', app_id, file_uploads:'private'}` ('public'
+also gives each file a public address; web pages and scripts are refused there). Off by default;
+with open sign-up anyone could upload, so ask the owner. Give the kind a `file` attribute
+(`awesomate_crm_kinds {action:'add_attribute'}`), then the page does
+`const f = await app.files.upload(file)` (10 MB each) and stores `f.handle` in that attribute;
+`app.files.download(handle)` gives the file back to anyone in the app who can read the record.
+Uploads count toward the account's Files space. Guide: https://hub.awesomate.ai/docs/sdk/guides/files/
+
 ## 6c. Optional: reply emails
 
 `awesomate_crm_notifications {action:'set', app_id, notifications: {enabled: true, thread_link: 'job'}}`