@fleox-agent-crm/agentcrm 0.3.0 → 0.3.2

package/dist/agent/chunks/{seed-CugPGYZL.mjs → seed-6MRmQQBR.mjs}

@@ -11,7 +11,7 @@ import { a as standardObjects, b as defaultPipeline, c as defaultViews } from ".
 import { assertCan } from "./context-CxFfqS4D.mjs";
 import { sha256Hex } from "./files-CjsPJSR6.mjs";
 import { asDoc, objectOf, usersOf, settingsDoc } from "./store-5gqRSKXg.mjs";
-import { DEFAULT_SETTINGS } from "./settings-BtvR_jdm.mjs";
+import { DEFAULT_SETTINGS } from "./settings-Di8nzNEL.mjs";
 import "./pluginRegistry-DyHtlkcr.mjs";
 import "./runtimeConfig-CCOFg1RM.mjs";
 const PALETTES = [
@@ -362,6 +362,20 @@ const FIRST = ["Ada", "Alan", "Grace", "Linus", "Margaret", "Dennis", "Barbara",
 const LAST = ["Lovelace", "Turing", "Hopper", "Torvalds", "Hamilton", "Ritchie", "Liskov", "Thompson", "Allen", "Berners-Lee", "Perlman", "Cerf", "Lamarr", "McCarthy", "Johnson", "van Rossum", "Martin", "Bernard", "Dubois", "Durand", "Lefebvre", "Moreau", "Laurent", "Simon", "Michel", "Garcia", "Roux", "Fournier", "Girard", "Bonnet", "Smith", "Brown", "Wilson", "Taylor", "Clark", "Lewis", "Walker", "Young", "King", "Wright"];
 const TITLES = ["CEO", "CTO", "VP Sales", "Head of Marketing", "Procurement Manager", "Operations Director", "Product Manager", "Engineering Manager", "CFO", "Office Manager", "Account Executive", "Data Analyst"];
 const CITIES = ["Paris", "London", "New York", "Berlin", "Lyon", "Madrid", "Amsterdam", "Montréal", "San Francisco", "Lisbon", "Brussels", "Toronto"];
+const CITY_COUNTRY = {
+  Paris: ["France", "+33 1"],
+  London: ["United Kingdom", "+44 20"],
+  "New York": ["United States", "+1 212"],
+  Berlin: ["Germany", "+49 30"],
+  Lyon: ["France", "+33 4"],
+  Madrid: ["Spain", "+34 91"],
+  Amsterdam: ["Netherlands", "+31 20"],
+  Montréal: ["Canada", "+1 514"],
+  "San Francisco": ["United States", "+1 415"],
+  Lisbon: ["Portugal", "+351 21"],
+  Brussels: ["Belgium", "+32 2"],
+  Toronto: ["Canada", "+1 416"]
+};
 const DEAL_KINDS = ["Annual license", "Pilot", "Expansion", "Renewal", "Onboarding package", "Enterprise plan", "Support contract", "Consulting retainer"];
 const LIFECYCLE = ["subscriber", "lead", "lead", "mql", "sql", "opportunity", "customer", "customer", "evangelist"];
 const SOURCES = ["website", "referral", "event", "outbound", "partner", "ads", "social"];
@@ -405,19 +419,23 @@ async function seedDemoData(ctx, opts = {}) {
     updatedAt: stamp(Math.max(0, daysAgo - rand() * daysAgo)),
     ...opts.ownerId ? { createdBy: opts.ownerId } : {}
   });
-  const companies = COMPANIES.map(
-    ([name, domain, industry, employees], i) => rec(seededId(`demo:company:${i}`), "companies", {
+  const companies = COMPANIES.map(([name, domain, industry, employees], i) => {
+    const annualRevenue = Math.round(employees * (6e4 + rand() * 14e4) / 1e3) * 1e3;
+    const city = pick(CITIES);
+    rand();
+    const [country, dial] = CITY_COUNTRY[city];
+    return rec(seededId(`demo:company:${i}`), "companies", {
       name,
       domain: `https://${domain}`,
       industry,
       employees,
-      annualRevenue: Math.round(employees * (6e4 + rand() * 14e4) / 1e3) * 1e3,
-      address: { city: pick(CITIES), country: pick(["France", "United Kingdom", "United States", "Germany", "Canada", "Spain"]) },
+      annualRevenue,
+      address: { city, country },
       linkedin: `https://www.linkedin.com/company/${domain.split(".")[0]}`,
-      phone: `+33 1 ${String(10 + i).padStart(2, "0")} ${String(Math.floor(rand() * 90) + 10)} ${String(Math.floor(rand() * 90) + 10)} ${String(Math.floor(rand() * 90) + 10)}`,
+      phone: `${dial} ${String(10 + i).padStart(2, "0")} ${String(Math.floor(rand() * 90) + 10)} ${String(Math.floor(rand() * 90) + 10)} ${String(Math.floor(rand() * 90) + 10)}`,
       ...rand() < 0.3 ? { tags: [pick(["vip", "partner", "strategic", "smb", "enterprise"])] } : {}
-    }, i, 30 + rand() * 300)
-  );
+    }, i, 30 + rand() * 300);
+  });
   const people = [];
   for (let i = 0; i < 80; i++) {
     const firstName = FIRST[i % FIRST.length];

package/dist/agent/chunks/{server-ISwlDRCN.mjs → server-DC3t8r30.mjs}

@@ -97,7 +97,7 @@ function createMcpServer(opts) {
     try {
       const run = async () => {
         const ctx = await opts.backend.context();
-        const { callTool: call } = await import("./tools-Bew8lxKx.mjs");
+        const { callTool: call } = await import("./tools-iSH-yMpl.mjs");
         return call(ctx, name, args);
       };
       const result = tool.mutating ? await opts.backend.withWrite(run) : await run();
@@ -112,15 +112,15 @@ function createMcpServer(opts) {
   async function readResource(id, uri) {
     const ctx = await opts.backend.context();
     let value;
-    if (uri === "agentcrm://schema") value = (await import("./schema-DlHt2PxI.mjs")).describeSchema(ctx);
+    if (uri === "agentcrm://schema") value = (await import("./schema-C4lSslXv.mjs")).describeSchema(ctx);
     else if (uri === "agentcrm://pipelines") {
-      const { listPipelines, forecast } = await import("./pipelines-DCdRBNBV.mjs");
+      const { listPipelines, forecast } = await import("./pipelines-BAKpPk1w.mjs");
       value = listPipelines(ctx).map((p) => ({ ...p, forecast: forecast(ctx, { pipelineId: p.id }) }));
     } else if (uri === "agentcrm://modules") {
-      const [{ listModules }, { listExtensions }] = await Promise.all([import("./modules-CqdVQVJb.mjs"), import("./extensions-BP1k60md.mjs")]);
+      const [{ listModules }, { listExtensions }] = await Promise.all([import("./modules-clWdE-K2.mjs"), import("./extensions-Bp72uZ9a.mjs")]);
       value = { modules: listModules(ctx), extensions: listExtensions(ctx) };
     } else if (uri === "agentcrm://appearance") {
-      const { getAppearance, listPresets } = await import("./appearance-BaShelzt.mjs");
+      const { getAppearance, listPresets } = await import("./appearance-BloHbiLA.mjs");
       const { logo, favicon, customCss, ...rest } = getAppearance(ctx);
       value = { appearance: { ...rest, hasLogo: !!logo, hasFavicon: !!favicon, customCss: customCss ?? null }, presets: listPresets(ctx).map((p) => ({ id: p.id, name: p.name, source: p.source, description: p.description, ...p.enabled !== void 0 ? { enabled: p.enabled } : {} })) };
     } else return fail(id, -32002, `Resource not found: ${uri}`, { uri });

package/dist/agent/chunks/{settings-BtvR_jdm.mjs → settings-Di8nzNEL.mjs}

@@ -20,8 +20,25 @@ function getSettings(ctx) {
   assertCan(ctx, "settings.read");
   return { ...DEFAULT_SETTINGS, ...settingsDoc(ctx.store) ?? {} };
 }
+const SETTINGS_KEYS = ["name", "defaultCurrency", "locale", "timezone", "weekStartsOn", "staleDealDays", "ownerUserId", "maxUploadMb"];
 async function updateSettings(ctx, patch) {
   assertCan(ctx, "settings.write");
+  const unknown = Object.keys(patch).filter((k) => !SETTINGS_KEYS.includes(k) && k !== "createdAt" && k !== "updatedAt" && k !== "id");
+  if (unknown.length) {
+    throw new OpsError("validation", `Unknown setting${unknown.length > 1 ? "s" : ""} ${unknown.map((k) => `"${k}"`).join(", ")}. Settings: ${SETTINGS_KEYS.join(", ")}.`);
+  }
+  if (patch.name !== void 0 && (typeof patch.name !== "string" || !patch.name.trim())) {
+    throw new OpsError("validation", "The CRM name can't be empty.");
+  }
+  if (patch.weekStartsOn !== void 0 && patch.weekStartsOn !== 0 && patch.weekStartsOn !== 1) {
+    throw new OpsError("validation", "Week start must be 0 (Sunday) or 1 (Monday).");
+  }
+  if (patch.locale !== void 0 && !validLocale(patch.locale)) {
+    throw new OpsError("validation", `"${String(patch.locale)}" is not a valid locale (BCP-47, e.g. en-US, fr-FR).`);
+  }
+  if (patch.timezone !== void 0 && patch.timezone !== null && !validTimeZone(patch.timezone)) {
+    throw new OpsError("validation", `"${String(patch.timezone)}" is not a valid time zone (IANA, e.g. Europe/Paris).`);
+  }
   if (patch.defaultCurrency !== void 0 && !/^[A-Z]{3}$/.test(patch.defaultCurrency.toUpperCase())) {
     throw new OpsError("validation", `"${patch.defaultCurrency}" is not an ISO 4217 currency code.`);
   }
@@ -43,6 +60,23 @@ async function updateSettings(ctx, patch) {
   await ctx.store.write([{ op: "set", collection: "settings", doc: asDoc(next) }], { message: "Update settings" });
   return getSettings(ctx);
 }
+function validLocale(value) {
+  if (typeof value !== "string" || !value) return false;
+  try {
+    return Intl.getCanonicalLocales(value).length === 1;
+  } catch {
+    return false;
+  }
+}
+function validTimeZone(value) {
+  if (typeof value !== "string" || !value) return false;
+  try {
+    new Intl.DateTimeFormat("en-US", { timeZone: value });
+    return true;
+  } catch {
+    return false;
+  }
+}
 function assertNoSecrets(value, path = "") {
   if (!value || typeof value !== "object") return;
   for (const [k, v] of Object.entries(value)) {
@@ -68,6 +102,7 @@ async function setConfigDoc(ctx, id, value) {
 }
 export {
   DEFAULT_SETTINGS,
+  SETTINGS_KEYS,
   assertNoSecrets,
   getConfigDoc,
   getSettings,

package/dist/agent/chunks/{stats-CfeJssSS.mjs → stats-BfuLWhVV.mjs}

@@ -6,7 +6,7 @@ const __filename = __acrmPath(import.meta.url);
 const __dirname = __acrmDirname(__filename);
 import { A as ACTIVITY_TYPES } from "../agentcrm.mjs";
 import { assertCan } from "./context-CxFfqS4D.mjs";
-import { forecast } from "./pipelines-DCdRBNBV.mjs";
+import { forecast } from "./pipelines-BAKpPk1w.mjs";
 import { activitiesOf, pipelinesOf, usersOf, objectsOf, recordsOf } from "./store-5gqRSKXg.mjs";
 import "node:util";
 import "node:fs";
@@ -20,7 +20,7 @@ import "./pluginRegistry-DyHtlkcr.mjs";
 import "./fields-B0bitgmr.mjs";
 import "./ids-CvnmrMJX.mjs";
 import "./standardObjects-CheqfDqa.mjs";
-import "./records-DoqiT9xR.mjs";
+import "./records-DcHFelq5.mjs";
 import "./query-C5nJB_3C.mjs";
 import "./relations-B9TynBmA.mjs";
 function getStats(ctx) {

package/dist/agent/chunks/{tools-Bew8lxKx.mjs → tools-iSH-yMpl.mjs}

@@ -6,24 +6,24 @@ const __filename = __acrmPath(import.meta.url);
 const __dirname = __acrmDirname(__filename);
 import { recordLabel, normalizeEmail, formatFieldValue } from "./fields-B0bitgmr.mjs";
 import { r as resolveField } from "./query-C5nJB_3C.mjs";
-import { F as FILTER_OPS, A as ACTIVITY_TYPES, e as FIELD_TYPES } from "../agentcrm.mjs";
+import { F as FILTER_OPS, A as ACTIVITY_TYPES, a as FIELD_TYPES } from "../agentcrm.mjs";
 import { OpsError } from "./context-CxFfqS4D.mjs";
 import { listActivities, addNote, addActivity, createTask, completeTask, listTasks } from "./activities-Cj_SIOay.mjs";
 import { mergeRecords } from "./dedupe-BepmsaHv.mjs";
-import { importCsv } from "./importCsv-DmE_sBch.mjs";
-import { moveStage, forecast, listPipelines } from "./pipelines-DCdRBNBV.mjs";
-import { getRecord, searchRecords, listRecords, getRecordDetails, createRecord, updateRecord, deleteRecord, queryContext } from "./records-DoqiT9xR.mjs";
-import { runReport, REPORTS } from "./reports-BB59N6ke.mjs";
-import { describeSchema, createField } from "./schema-DlHt2PxI.mjs";
+import { importCsv } from "./importCsv-LVmMTaWU.mjs";
+import { moveStage, forecast, listPipelines } from "./pipelines-BAKpPk1w.mjs";
+import { getRecord, searchRecords, listRecords, getRecordDetails, createRecord, updateRecord, deleteRecord, queryContext } from "./records-DcHFelq5.mjs";
+import { runReport, REPORTS } from "./reports-BACHGccj.mjs";
+import { describeSchema, createField } from "./schema-C4lSslXv.mjs";
 import { objectOf, recordOf, userOf, activitiesOf, fileOf } from "./store-5gqRSKXg.mjs";
-import { ACTION_TYPES, TRIGGER_TYPES, listAutomationRuns, AUTOMATION_TEMPLATES, listAutomations, createAutomationFromTemplate, createAutomation, setAutomationEnabled, testAutomation, runScheduled } from "./automations-BWrvLqP6.mjs";
-import { listForms, ingestInbox } from "./forms-BKU5F9WF.mjs";
-import { B as BUTTON_STYLES, C as CONTRASTS, d as COLOR_MODES, S as SIDEBAR_STYLES, e as DENSITIES, R as RADII, N as NEUTRALS, F as FONTS } from "./schema-7-4-qtSS.mjs";
-import { listPresets, getAppearance, setAppearance, applyPreset } from "./appearance-BaShelzt.mjs";
-import { listExtensions, setExtensionEnabled } from "./extensions-BP1k60md.mjs";
-import { listModules, setModuleEnabled } from "./modules-CqdVQVJb.mjs";
+import { ACTION_TYPES, TRIGGER_TYPES, listAutomationRuns, AUTOMATION_TEMPLATES, listAutomations, createAutomationFromTemplate, createAutomation, setAutomationEnabled, testAutomation, runScheduled } from "./automations-DwWruxmu.mjs";
+import { listForms, ingestInbox } from "./forms-BfuWaQjA.mjs";
+import { B as BUTTON_STYLES, C as CONTRASTS, d as COLOR_MODES, S as SIDEBAR_STYLES, e as DENSITIES, R as RADII, N as NEUTRALS, F as FONTS } from "./schema-DnLj8dUO.mjs";
+import { listPresets, getAppearance, setAppearance, applyPreset } from "./appearance-BloHbiLA.mjs";
+import { listExtensions, setExtensionEnabled } from "./extensions-Bp72uZ9a.mjs";
+import { listModules, setModuleEnabled } from "./modules-clWdE-K2.mjs";
 import { inlineFileIds, formatBytes, fileKind } from "./files-CjsPJSR6.mjs";
-import { listFiles, fileUsage } from "./files-q8Xu5bft.mjs";
+import { listFiles, fileUsage } from "./files-D1daDgY0.mjs";
 import { l as labelOf } from "./relations-B9TynBmA.mjs";
 import "node:util";
 import "node:fs";
@@ -35,17 +35,17 @@ import "node:child_process";
 import "node:http";
 import "./pluginRegistry-DyHtlkcr.mjs";
 import "./ids-CvnmrMJX.mjs";
-import "./papaparse-DjBYnQM2.mjs";
+import "./papaparse-Df7i1dHr.mjs";
 import "./_commonjsHelpers-ClciMIcB.mjs";
 import "stream";
 import "./utils-DmI8FtXP.mjs";
 import "./standardObjects-CheqfDqa.mjs";
-import "./settings-BtvR_jdm.mjs";
+import "./settings-Di8nzNEL.mjs";
 import "./runtimeConfig-CCOFg1RM.mjs";
 import "./extensionActions-D2HtpQz4.mjs";
 import "./themes-DPZFv3yc.mjs";
-import "./api-B6OqNVWp.mjs";
-import "./package-DWbn3t2R.mjs";
+import "./api-Cz0Ubj-B.mjs";
+import "./package-B7mI6HGi.mjs";
 import "./index-w03ReRs4.mjs";
 import "events";
 import "buffer";
@@ -824,18 +824,58 @@ function subscribeAiTools(listener) {
 function findTool(name) {
   return AI_TOOLS.find((t) => t.name === name) ?? extraTools.get(name);
 }
+function jsonTypeOf(value) {
+  if (value === null) return "null";
+  if (Array.isArray(value)) return "array";
+  return typeof value;
+}
+function checkToolInput(schema, value, path) {
+  const types = schema.type === void 0 ? [] : Array.isArray(schema.type) ? schema.type : [schema.type];
+  let v = value;
+  if (types.length && v !== null && v !== void 0) {
+    const actual = jsonTypeOf(v);
+    const accepts = (t) => t === actual || t === "integer" && actual === "number" && Number.isInteger(v);
+    if (!types.some(accepts)) {
+      if ((types.includes("number") || types.includes("integer")) && typeof v === "string" && v.trim() !== "" && Number.isFinite(Number(v))) v = Number(v);
+      else if (types.includes("boolean") && (v === "true" || v === "false")) v = v === "true";
+      else throw new OpsError("validation", `${path} must be ${types.map((t) => t === "array" || t === "object" || t === "integer" ? `an ${t}` : `a ${t}`).join(" or ")}, got ${actual === "array" || actual === "object" ? `an ${actual}` : `${actual} ${JSON.stringify(v)}`.slice(0, 80)}.`);
+    }
+  }
+  if (v === null || v === void 0) return v;
+  if (schema.enum && !schema.enum.includes(v)) {
+    throw new OpsError("validation", `${path} must be one of ${schema.enum.map((e) => JSON.stringify(e)).join(", ")}, got ${JSON.stringify(v).slice(0, 80)}.`);
+  }
+  if (Array.isArray(v) && schema.items) {
+    const items = schema.items;
+    return v.map((item, i) => checkToolInput(items, item, `${path}[${i}]`));
+  }
+  if (jsonTypeOf(v) === "object" && (schema.properties || schema.required)) {
+    const obj = { ...v };
+    for (const key of schema.required ?? []) {
+      if (obj[key] === void 0 || obj[key] === null) throw new OpsError("validation", `${path}: missing required "${key}".`);
+    }
+    for (const [key, sub] of Object.entries(schema.properties ?? {})) {
+      if (obj[key] !== void 0) obj[key] = checkToolInput(sub, obj[key], `${path}.${key}`);
+    }
+    return obj;
+  }
+  return v;
+}
 async function callTool(ctx, name, input) {
   const tool = findTool(name);
   if (!tool) throw new OpsError("notFound", `Unknown tool "${name}". Tools: ${listAiTools().map((t) => t.name).join(", ")}.`);
-  const args = input && typeof input === "object" ? input : {};
+  if (input !== void 0 && input !== null && jsonTypeOf(input) !== "object") throw new OpsError("validation", `${name}: the input must be a JSON object, got ${jsonTypeOf(input) === "array" ? "an array" : `a ${jsonTypeOf(input)}`}.`);
+  const raw = input ?? {};
   for (const key of tool.inputSchema.required ?? []) {
-    if (args[key] === void 0 || args[key] === null) throw new OpsError("validation", `${name}: missing required "${key}".`);
+    if (raw[key] === void 0 || raw[key] === null) throw new OpsError("validation", `${name}: missing required "${key}".`);
   }
+  const args = checkToolInput({ ...tool.inputSchema, required: [] }, raw, name);
   return tool.handler(ctx, args);
 }
 export {
   AI_TOOLS,
   callTool,
+  checkToolInput,
   findTool,
   listAiTools,
   registerAiTool,

package/dist/agent/chunks/{views-fO_BM5U_.mjs → views-DH1n9Lrt.mjs}

@@ -7,7 +7,7 @@ const __dirname = __acrmDirname(__filename);
 import { n as newId } from "./ids-CvnmrMJX.mjs";
 import { F as FILTER_OPS } from "../agentcrm.mjs";
 import { OpsError, assertCan, can } from "./context-CxFfqS4D.mjs";
-import { listRecords } from "./records-DoqiT9xR.mjs";
+import { listRecords } from "./records-DcHFelq5.mjs";
 import { requireObject, asDoc, viewsOf, thaw, pipelinesOf } from "./store-5gqRSKXg.mjs";
 import "node:util";
 import "node:fs";

package/dist/version.json

@@ -1,6 +1,6 @@
 {
   "name": "@fleox-agent-crm/agentcrm",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "minSkillsVersion": "0.1.0",
   "dataSchema": 1,
   "repository": "github:fleox/agentcrm"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fleox-agent-crm/agentcrm",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "type": "module",
   "description": "The static CRM your AI agent can run: a Twenty / HubSpot-style CRM that runs entirely in the browser or headless through the agentcrm CLI, with data on storage you own.",
   "license": "SEE LICENSE IN LICENSE",

package/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agentcrm",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "Skills to install AgentCRM (the static CRM your AI agent can run), manage its sites, run and customise the CRM (modules, appearance, extensions), drive sales workflows and build extension modules and themes.",
   "author": {
     "name": "fleox"

package/plugin/skills/agentcrm-admin/SKILL.md

@@ -4,7 +4,7 @@ description: Run an AgentCRM like its admin does - find, list, create, update, d
 license: PolyForm-Noncommercial-1.0.0
 compatibility: Requires Node.js 20+.
 metadata:
-  version: "0.3.0"
+  version: "0.3.2"
   repository: "https://github.com/fleox/agentcrm"
 allowed-tools: Bash Read Write
 ---
@@ -15,7 +15,7 @@ The CLI runs the admin's own engine headless: the same validation, roles and aut
 
 **Language:** talk to the user in their language; keep commands and files in English.
 
-Every command is `npx -y @fleox-agent-crm/agentcrm@0.3.0 <command> --json`; always pass `--site <alias>` (see `agentcrm-manage` to pick one). Read `error.hint` when `ok` is false. `npx -y @fleox-agent-crm/agentcrm@0.3.0 help records --json` lists any command's actions and options.
+Every command is `npx -y @fleox-agent-crm/agentcrm@0.3.2 <command> --json`; always pass `--site <alias>` (see `agentcrm-manage` to pick one). Read `error.hint` when `ok` is false. `npx -y @fleox-agent-crm/agentcrm@0.3.2 help records --json` lists any command's actions and options.
 
 ## Rules
 
@@ -27,13 +27,13 @@ Every command is `npx -y @fleox-agent-crm/agentcrm@0.3.0 <command> --json`; alwa
 ## Records
 
 ```bash
-npx -y @fleox-agent-crm/agentcrm@0.3.0 records list --site acme --object deals --filter stage:in:proposal,negotiation --filter amount:gte:10000 --sort amount:desc --limit 20 --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 records get <id> --site acme --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 records search "globex" --site acme --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 records create --site acme --object people --set firstName=Grace --set lastName=Hopper --set email=grace@globex.com --set company=<companyId> --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 records update <id> --site acme --set jobTitle=CTO --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 records delete <id> --site acme --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 records restore <id> --site acme --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 records list --site acme --object deals --filter stage:in:proposal,negotiation --filter amount:gte:10000 --sort amount:desc --limit 20 --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 records get <id> --site acme --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 records search "globex" --site acme --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 records create --site acme --object people --set firstName=Grace --set lastName=Hopper --set email=grace@globex.com --set company=<companyId> --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 records update <id> --site acme --set jobTitle=CTO --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 records delete <id> --site acme --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 records restore <id> --site acme --json
 ```
 
 - Filters: `--filter field:op:value`, repeatable. Ops: eq, neq, contains, notContains, empty, notEmpty, gt, gte, lt, lte, in, notIn, before, after, withinDays. Dates: `YYYY-MM-DD`, `today`, `+30d`. Also `id`, `ownerId`, `createdAt`, `updatedAt`.
@@ -46,13 +46,13 @@ More examples per object: references/records.md.
 ## Timeline and tasks
 
 ```bash
-npx -y @fleox-agent-crm/agentcrm@0.3.0 notes add <recordId> --site acme --body "Met at the expo; wants a demo in June." --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 activities add --site acme --type call --title "Discovery call" --record <personId> --record <dealId> --meta '{"durationMin":25}' --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 activities list --site acme --record <companyId> --related --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 tasks add --site acme --title "Send the proposal" --due 2026-11-10 --assignee me --record <dealId> --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 tasks list --site acme --assignee me --overdue --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 tasks done <taskId> --site acme --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 tasks reassign <taskId> --site acme --assignee sam@acme.com --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 notes add <recordId> --site acme --body "Met at the expo; wants a demo in June." --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 activities add --site acme --type call --title "Discovery call" --record <personId> --record <dealId> --meta '{"durationMin":25}' --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 activities list --site acme --record <companyId> --related --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 tasks add --site acme --title "Send the proposal" --due 2026-11-10 --assignee me --record <dealId> --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 tasks list --site acme --assignee me --overdue --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 tasks done <taskId> --site acme --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 tasks reassign <taskId> --site acme --assignee sam@acme.com --json
 ```
 
 Activity types: note, task, call, email, meeting. `--body @notes.md` reads a file.
@@ -62,18 +62,18 @@ Activity types: note, task, call, email, meeting. `--body @notes.md` reads a fil
 People have a **photo** (`avatar` field) and companies a **logo** (`logo`), shown next to the name everywhere; custom objects get one by adding an `image` field (the first becomes the object's image). Files (any type: images, PDFs, Office documents…) attach to a record or to an activity (note, task, call, email, meeting).
 
 ```bash
-npx -y @fleox-agent-crm/agentcrm@0.3.0 records image <personId> ./ada.jpg --site acme --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 records image <companyId> ./logo.svg --site acme --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 records image <personId> --remove --site acme --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 notes add <recordId> --body "Signed contract attached." --attach ./contract.pdf --site acme --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 tasks add --title "Review the quote" --record <dealId> --attach ./quote.xlsx --attach ./scope.pdf --site acme --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 activities add --type meeting --title "Workshop" --record <companyId> --attach ./whiteboard.png --site acme --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 files upload ./brochure.pdf ./photo.png --record <companyId> --site acme --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 files upload ./minutes.docx --activity <noteId> --site acme --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 files list --record <companyId> --related --site acme --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 files get <fileId> --out ./contract.pdf --site acme --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 files delete <fileId> --site acme --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 files usage --site acme --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 records image <personId> ./ada.jpg --site acme --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 records image <companyId> ./logo.svg --site acme --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 records image <personId> --remove --site acme --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 notes add <recordId> --body "Signed contract attached." --attach ./contract.pdf --site acme --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 tasks add --title "Review the quote" --record <dealId> --attach ./quote.xlsx --attach ./scope.pdf --site acme --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 activities add --type meeting --title "Workshop" --record <companyId> --attach ./whiteboard.png --site acme --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 files upload ./brochure.pdf ./photo.png --record <companyId> --site acme --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 files upload ./minutes.docx --activity <noteId> --site acme --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 files list --record <companyId> --related --site acme --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 files get <fileId> --out ./contract.pdf --site acme --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 files delete <fileId> --site acme --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 files usage --site acme --json
 ```
 
 - Files live next to the data and are **encrypted with the same passphrase** on the journal backend; IndexedDB in local mode; the data repo (`files/`) for git-json (warn: history keeps them); Firebase Storage for Firebase (Storage must be enabled, see docs/files.md).
@@ -86,9 +86,9 @@ npx -y @fleox-agent-crm/agentcrm@0.3.0 files usage --site acme --json
 ## Pipelines
 
 ```bash
-npx -y @fleox-agent-crm/agentcrm@0.3.0 pipelines list --site acme --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 pipelines move <dealId> Negotiation --site acme --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 pipelines move <dealId> Lost --lost-reason "Budget" --site acme --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 pipelines list --site acme --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 pipelines move <dealId> Negotiation --site acme --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 pipelines move <dealId> Lost --lost-reason "Budget" --site acme --json
 ```
 
 Moving sets the deal's probability to the stage's. Adding / renaming stages is done in the admin (Settings → Data model).
@@ -102,10 +102,10 @@ See references/schema.md for objects, fields (types, options, relations), views,
 Built-in modules: dashboard, deals (deals object + pipelines), reports, forms, tasks, automations, integrations (email and calendar), assistant (in-admin AI); records, search, settings, setup and customize are required. Installed extension modules are listed with `source: "extension"`. Disabling hides pages, navigation, widgets and owned objects for every user; it never deletes data, and enabling again brings everything back.
 
 ```bash
-npx -y @fleox-agent-crm/agentcrm@0.3.0 modules list --site acme --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 modules disable forms --site acme --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 modules disable forms --site acme --yes --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 modules enable deals --site acme --cascade --yes --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 modules list --site acme --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 modules disable forms --site acme --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 modules disable forms --site acme --yes --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 modules enable deals --site acme --cascade --yes --json
 ```
 
 - When the user says "we only manage contacts" or "hide what we don't use": list the modules, propose which to turn off (with what each hides), and apply only after they agree.
@@ -117,14 +117,14 @@ npx -y @fleox-agent-crm/agentcrm@0.3.0 modules enable deals --site acme --cascad
 One accent color drives the whole palette (a 50 to 950 scale is generated). Applies live to every user.
 
 ```bash
-npx -y @fleox-agent-crm/agentcrm@0.3.0 appearance get --site acme --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 appearance presets --site acme --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 appearance set --site acme --accent "#0f766e" --neutral stone --radius lg --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 appearance preset ocean --site acme --yes --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 appearance logo ./logo.svg --site acme --yes --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 appearance favicon ./favicon.png --site acme --yes --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 appearance css ./brand.css --site acme --yes --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 appearance reset --site acme --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 appearance get --site acme --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 appearance presets --site acme --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 appearance set --site acme --accent "#0f766e" --neutral stone --radius lg --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 appearance preset ocean --site acme --yes --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 appearance logo ./logo.svg --site acme --yes --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 appearance favicon ./favicon.png --site acme --yes --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 appearance css ./brand.css --site acme --yes --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 appearance reset --site acme --json
 ```
 
 - **Brand from a hex:** `appearance set --accent <hex>`, then pick `--neutral` by temperature (blue / teal brands: slate; warm brands: stone; otherwise zinc), `--buttons accent` for a colorful brand. **From a logo:** read the dominant non-gray color of the SVG (its `fill`) or the image, propose it as the accent, and upload the logo itself with `appearance logo`.
@@ -134,9 +134,9 @@ npx -y @fleox-agent-crm/agentcrm@0.3.0 appearance reset --site acme --json
 ## Extensions (installed modules and themes)
 
 ```bash
-npx -y @fleox-agent-crm/agentcrm@0.3.0 ext list --site acme --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 ext disable sales-goals --site acme --yes --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 ext enable sales-goals --site acme --yes --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 ext list --site acme --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 ext disable sales-goals --site acme --yes --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 ext enable sales-goals --site acme --yes --json
 ```
 
 Installing, building or debugging extensions: the `agentcrm-extensions` skill. Installing runs third-party code with admin rights: always show the plan and ask. If the admin misbehaves after an extension change, `ext disable <id> --yes`, or open the admin with `?safe=1`; CLI commands accept `--safe` to skip extensions.
@@ -144,11 +144,11 @@ Installing, building or debugging extensions: the `agentcrm-extensions` skill. I
 ## Import and export
 
 ```bash
-npx -y @fleox-agent-crm/agentcrm@0.3.0 import csv contacts.csv --site acme --object people --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 import csv contacts.csv --site acme --object people --yes --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 export csv --site acme --object companies --out companies.csv --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 export json --site acme --out backup.json --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 export zip --site acme --out backup.zip --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 import csv contacts.csv --site acme --object people --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 import csv contacts.csv --site acme --object people --yes --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 export csv --site acme --object companies --out companies.csv --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 export json --site acme --out backup.json --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 export zip --site acme --out backup.zip --json
 ```
 
 The import is a DRY RUN until `--yes`: read the report (mapping, per-row action, errors, new select options, companies to create) with the user before applying. Mapping, dedupe and coercion rules: references/import.md.
@@ -156,25 +156,25 @@ The import is a DRY RUN until `--yes`: read the report (mapping, per-row action,
 ## Reports and stats
 
 ```bash
-npx -y @fleox-agent-crm/agentcrm@0.3.0 report pipeline --site acme --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 report forecast --site acme --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 report won-lost --site acme --months 6 --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 report activity --site acme --days 30 --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 report lead-sources --site acme --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 report stale --site acme --days 21 --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 report conversion --site acme --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 stats --site acme --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 report pipeline --site acme --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 report forecast --site acme --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 report won-lost --site acme --months 6 --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 report activity --site acme --days 30 --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 report lead-sources --site acme --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 report stale --site acme --days 21 --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 report conversion --site acme --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 stats --site acme --json
 ```
 
 ## Automations and lead forms
 
 ```bash
-npx -y @fleox-agent-crm/agentcrm@0.3.0 automations list --site acme --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 automations disable <id> --site acme --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 automations run --site acme --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 forms list --site acme --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 forms publish <formId> --site acme --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 forms ingest --site acme --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 automations list --site acme --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 automations disable <id> --site acme --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 automations run --site acme --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 forms list --site acme --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 forms publish <formId> --site acme --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 forms ingest --site acme --json
 ```
 
 Event automations (record created, field changed, stage changed) fire on every write, from the CLI too. Building automations and forms is done in the admin; the CLI enables / disables, runs the scheduled ones and ingests form submissions. For a cron, see the `agentcrm-manage` skill.
@@ -184,8 +184,8 @@ Event automations (record created, field changed, stage changed) fire on every w
 The same tools the MCP server and the in-admin assistant expose, including the tools of enabled extension modules (`source: "extension"`) the customisation tools (`list_modules`, `set_module_enabled`, `get_appearance`, `set_appearance`, `apply_appearance_preset`, `list_extensions`, `set_extension_enabled`) and the file tools (`list_files`, `describe_attachments`):
 
 ```bash
-npx -y @fleox-agent-crm/agentcrm@0.3.0 tools list --site acme --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 tools call pipeline_summary --site acme --input '{}' --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 tools list --site acme --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 tools call pipeline_summary --site acme --input '{}' --json
 ```
 
 Useful when a tool returns exactly what you need in one call (`get_record` with relations and latest activities, `pipeline_summary`).

package/plugin/skills/agentcrm-admin/references/appearance.md

@@ -18,7 +18,7 @@
 Changing a visual value marks the preset `custom`. Other actions:
 
 - `appearance preset <id>`: default, ocean, forest, sunset, graphite, rose, high-contrast, or a theme extension id. Keeps logo, favicon, custom CSS and the default mode.
-- `appearance logo <file>` / `appearance favicon <file>`: PNG, JPEG, GIF, WebP, SVG or ICO, at most 200 KB; `--remove` deletes it.
+- `appearance logo <file>` / `appearance favicon <file>`: PNG, JPEG, GIF, WebP, SVG or ICO, at most 200 KB (SVGs with scripts or event handlers are refused); `--remove` deletes it.
 - `appearance css <file|->`: plain CSS (no `<style>` / `<script>`), at most 50 KB, loaded last; `--remove` deletes it. Style through the CSS variables (`--acc-50` to `--acc-950`, `--srf-50` to `--srf-950`, `--primary`, `--radius-scale`, `--font-sans`, `--row-h`…) as `rgb(var(--acc-600))`.
 - `appearance reset`: back to defaults, keeping logo and favicon (`--branding` removes them too).
 - `appearance get --full` includes the logo / favicon data URLs and the custom CSS.

package/plugin/skills/agentcrm-admin/references/records.md

@@ -12,17 +12,17 @@ Always confirm with `objects get <object>`: admins add fields and options.
 
 ```bash
 # A company and its contact
-npx -y @fleox-agent-crm/agentcrm@0.3.0 records create --site acme --object companies --set name="Globex" --set domain=globex.com --set industry=software --json
-npx -y @fleox-agent-crm/agentcrm@0.3.0 records create --site acme --object people --fields @grace.json --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 records create --site acme --object companies --set name="Globex" --set domain=globex.com --set industry=software --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 records create --site acme --object people --fields @grace.json --json
 
 # A deal linked to both
-npx -y @fleox-agent-crm/agentcrm@0.3.0 records create --site acme --object deals --fields '{"name":"Globex pilot","amount":12000,"closeDate":"2026-12-15","company":"<companyId>","contacts":["<personId>"]}' --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 records create --site acme --object deals --fields '{"name":"Globex pilot","amount":12000,"closeDate":"2026-12-15","company":"<companyId>","contacts":["<personId>"]}' --json
 
 # Leads created this week, without an owner
-npx -y @fleox-agent-crm/agentcrm@0.3.0 records list --site acme --object people --filter lifecycleStage:eq:lead --filter createdAt:withinDays:-7 --filter ownerId:empty --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 records list --site acme --object people --filter lifecycleStage:eq:lead --filter createdAt:withinDays:-7 --filter ownerId:empty --json
 
 # Assign an owner
-npx -y @fleox-agent-crm/agentcrm@0.3.0 records update <id> --site acme --owner <userId> --json
+npx -y @fleox-agent-crm/agentcrm@0.3.2 records update <id> --site acme --owner <userId> --json
 ```
 
 `records get` returns `relations` (records this one points to) and `related` (records pointing to it, e.g. a company's people and deals) plus `activityCount`.