@integrity-labs/agt-cli 0.28.359 → 0.28.361

package/dist/mcp/direct-chat-channel.js

@@ -32922,7 +32922,7 @@ var INTEGRATION_REGISTRY = [
     id: "brand-ninja",
     name: "Brand Ninja",
     category: "social",
-    description: "Brand-aligned content generation: submit async content requests, track them, and discover publishing channels. Wired as the hosted Brand Ninja External-Content MCP at https://ext-api.app.brandninja.ai/v1/mcp.",
+    description: "Brand-aligned content generation: submit async content requests and track them, search transcripts and assemble ranked timelines from source clips, and discover the account catalog (channels, brands, topics, templates, content types, skills). Wired as the hosted Brand Ninja External-Content MCP at https://ext-api.app.brandninja.ai/v1/mcp.",
     // ENG-6820: same remote streamable-HTTP MCP + OAuth pattern as Granola.
     // Brand Ninja's server implements the full MCP discovery chain (RFC
     // 9728/8414/7591); auth is OAuth 2.0 authorization-code with PKCE (S256)
@@ -32937,6 +32937,9 @@ var INTEGRATION_REGISTRY = [
     capabilities: [
       { id: "brand-ninja:generate-content", name: "Generate Content", description: "Submit async brand-aligned content-generation requests and poll their status (submit_content_request, get_content_status, list_content_requests)", access: "write" },
       { id: "brand-ninja:list-channels", name: "List Channels", description: "Discover the publishing channels available to the account, metadata only (list_channels)", access: "read" },
+      { id: "brand-ninja:list-catalog", name: "List Catalog", description: "Discover account catalog metadata: brands, topics, timeline templates, content types, and source, output and conversion skills (list_brands, list_topics, list_timeline_templates, list_content_types, list_source_skills, list_output_skills, list_conversion_skills)", access: "read" },
+      { id: "brand-ninja:search-transcripts", name: "Search Transcripts", description: "Search the transcripts available to the account to source or reference when generating content, text and metadata (search_transcripts)", access: "read" },
+      { id: "brand-ninja:assemble-timeline", name: "Assemble Timeline", description: "Turn transcript spans into topic-tagged source clips and rank a topic's clips into a ranked timeline via an async LLM job (create_source_clips, create_timeline_ranking)", access: "write" },
       { id: "brand-ninja:read-credentials", name: "Read Credentials", description: "Read-only External-API credential metadata, secrets stripped. Requires the elevated external-api/admin scope (list_credentials)", access: "admin" }
     ],
     docs_url: "https://ext-api.app.brandninja.ai/v1/mcp",
@@ -34781,6 +34784,19 @@ var FLAG_REGISTRY = [
     // deliberate, audited per-org flip (ADR-0022 §4).
     sensitive: true
   },
+  {
+    key: "email-guard-require-approval-enabled",
+    description: "Platform enable-gate for the email-domain guardrail REQUIRE_APPROVAL stage (ENG-7939). When ON for an org, a scope at email_guard_stage=require_approval routes a send to a non-allowed domain into Human Approval (an Approve/Deny card) instead of a hard block: the rollout UI unlocks the option and the write routes accept require_approval. When OFF (default) the write routes reject require_approval and the UI shows it as not yet available, so no scope can select it. Structurally also depends on hitl-approval-routing being on (the approval broker fails closed to a hard block when routing is off). Evaluated per-org. Ships dark.",
+    flagType: "boolean",
+    // Declared safe value is `false` (require_approval is unselectable / inert). A flag-DB read
+    // error degrades here, so a flags outage can never start routing customer email through a
+    // half-wired approval path - the fail-closed direction. No envVar: net-new control with no
+    // pre-flags env gate to migrate (ADR-0022).
+    defaultValue: false,
+    // Ungates a stage that changes how real customer email is handled (block becomes approval),
+    // so it is a deliberate, audited per-org flip (ADR-0022 §4).
+    sensitive: true
+  },
   {
     key: "slack-reply-binding",
     description: "Slack reply-target binding (ENG-7396 / WS2, cross-thread reply routing): the model names which inbound it answers (inbound_id) and the server resolves the destination from its own verified record. shadow = classify + count only, routing unchanged; warn = same routing plus a tool-result note so the model self-corrects; enforce = route a bound reply to the registry thread and REJECT a reply whose target matches no inbound this process delivered. The channel server can't evaluate flags, so the manager materializes the resolved value into the AGT_SLACK_REPLY_BINDING spawn env (the operator/canary override, ADR-0022). Ships shadow.",

package/dist/mcp/origami.js

@@ -38721,7 +38721,7 @@ var INTEGRATION_REGISTRY = [
     id: "brand-ninja",
     name: "Brand Ninja",
     category: "social",
-    description: "Brand-aligned content generation: submit async content requests, track them, and discover publishing channels. Wired as the hosted Brand Ninja External-Content MCP at https://ext-api.app.brandninja.ai/v1/mcp.",
+    description: "Brand-aligned content generation: submit async content requests and track them, search transcripts and assemble ranked timelines from source clips, and discover the account catalog (channels, brands, topics, templates, content types, skills). Wired as the hosted Brand Ninja External-Content MCP at https://ext-api.app.brandninja.ai/v1/mcp.",
     // ENG-6820: same remote streamable-HTTP MCP + OAuth pattern as Granola.
     // Brand Ninja's server implements the full MCP discovery chain (RFC
     // 9728/8414/7591); auth is OAuth 2.0 authorization-code with PKCE (S256)
@@ -38736,6 +38736,9 @@ var INTEGRATION_REGISTRY = [
     capabilities: [
       { id: "brand-ninja:generate-content", name: "Generate Content", description: "Submit async brand-aligned content-generation requests and poll their status (submit_content_request, get_content_status, list_content_requests)", access: "write" },
       { id: "brand-ninja:list-channels", name: "List Channels", description: "Discover the publishing channels available to the account, metadata only (list_channels)", access: "read" },
+      { id: "brand-ninja:list-catalog", name: "List Catalog", description: "Discover account catalog metadata: brands, topics, timeline templates, content types, and source, output and conversion skills (list_brands, list_topics, list_timeline_templates, list_content_types, list_source_skills, list_output_skills, list_conversion_skills)", access: "read" },
+      { id: "brand-ninja:search-transcripts", name: "Search Transcripts", description: "Search the transcripts available to the account to source or reference when generating content, text and metadata (search_transcripts)", access: "read" },
+      { id: "brand-ninja:assemble-timeline", name: "Assemble Timeline", description: "Turn transcript spans into topic-tagged source clips and rank a topic's clips into a ranked timeline via an async LLM job (create_source_clips, create_timeline_ranking)", access: "write" },
       { id: "brand-ninja:read-credentials", name: "Read Credentials", description: "Read-only External-API credential metadata, secrets stripped. Requires the elevated external-api/admin scope (list_credentials)", access: "admin" }
     ],
     docs_url: "https://ext-api.app.brandninja.ai/v1/mcp",
@@ -40544,6 +40547,19 @@ var FLAG_REGISTRY = [
     // deliberate, audited per-org flip (ADR-0022 §4).
     sensitive: true
   },
+  {
+    key: "email-guard-require-approval-enabled",
+    description: "Platform enable-gate for the email-domain guardrail REQUIRE_APPROVAL stage (ENG-7939). When ON for an org, a scope at email_guard_stage=require_approval routes a send to a non-allowed domain into Human Approval (an Approve/Deny card) instead of a hard block: the rollout UI unlocks the option and the write routes accept require_approval. When OFF (default) the write routes reject require_approval and the UI shows it as not yet available, so no scope can select it. Structurally also depends on hitl-approval-routing being on (the approval broker fails closed to a hard block when routing is off). Evaluated per-org. Ships dark.",
+    flagType: "boolean",
+    // Declared safe value is `false` (require_approval is unselectable / inert). A flag-DB read
+    // error degrades here, so a flags outage can never start routing customer email through a
+    // half-wired approval path - the fail-closed direction. No envVar: net-new control with no
+    // pre-flags env gate to migrate (ADR-0022).
+    defaultValue: false,
+    // Ungates a stage that changes how real customer email is handled (block becomes approval),
+    // so it is a deliberate, audited per-org flip (ADR-0022 §4).
+    sensitive: true
+  },
   {
     key: "slack-reply-binding",
     description: "Slack reply-target binding (ENG-7396 / WS2, cross-thread reply routing): the model names which inbound it answers (inbound_id) and the server resolves the destination from its own verified record. shadow = classify + count only, routing unchanged; warn = same routing plus a tool-result note so the model self-corrects; enforce = route a bound reply to the registry thread and REJECT a reply whose target matches no inbound this process delivered. The channel server can't evaluate flags, so the manager materializes the resolved value into the AGT_SLACK_REPLY_BINDING spawn env (the operator/canary override, ADR-0022). Ships shadow.",

package/dist/mcp/slack-channel.js

@@ -32604,7 +32604,7 @@ var INTEGRATION_REGISTRY = [
     id: "brand-ninja",
     name: "Brand Ninja",
     category: "social",
-    description: "Brand-aligned content generation: submit async content requests, track them, and discover publishing channels. Wired as the hosted Brand Ninja External-Content MCP at https://ext-api.app.brandninja.ai/v1/mcp.",
+    description: "Brand-aligned content generation: submit async content requests and track them, search transcripts and assemble ranked timelines from source clips, and discover the account catalog (channels, brands, topics, templates, content types, skills). Wired as the hosted Brand Ninja External-Content MCP at https://ext-api.app.brandninja.ai/v1/mcp.",
     // ENG-6820: same remote streamable-HTTP MCP + OAuth pattern as Granola.
     // Brand Ninja's server implements the full MCP discovery chain (RFC
     // 9728/8414/7591); auth is OAuth 2.0 authorization-code with PKCE (S256)
@@ -32619,6 +32619,9 @@ var INTEGRATION_REGISTRY = [
     capabilities: [
       { id: "brand-ninja:generate-content", name: "Generate Content", description: "Submit async brand-aligned content-generation requests and poll their status (submit_content_request, get_content_status, list_content_requests)", access: "write" },
       { id: "brand-ninja:list-channels", name: "List Channels", description: "Discover the publishing channels available to the account, metadata only (list_channels)", access: "read" },
+      { id: "brand-ninja:list-catalog", name: "List Catalog", description: "Discover account catalog metadata: brands, topics, timeline templates, content types, and source, output and conversion skills (list_brands, list_topics, list_timeline_templates, list_content_types, list_source_skills, list_output_skills, list_conversion_skills)", access: "read" },
+      { id: "brand-ninja:search-transcripts", name: "Search Transcripts", description: "Search the transcripts available to the account to source or reference when generating content, text and metadata (search_transcripts)", access: "read" },
+      { id: "brand-ninja:assemble-timeline", name: "Assemble Timeline", description: "Turn transcript spans into topic-tagged source clips and rank a topic's clips into a ranked timeline via an async LLM job (create_source_clips, create_timeline_ranking)", access: "write" },
       { id: "brand-ninja:read-credentials", name: "Read Credentials", description: "Read-only External-API credential metadata, secrets stripped. Requires the elevated external-api/admin scope (list_credentials)", access: "admin" }
     ],
     docs_url: "https://ext-api.app.brandninja.ai/v1/mcp",
@@ -34463,6 +34466,19 @@ var FLAG_REGISTRY = [
     // deliberate, audited per-org flip (ADR-0022 §4).
     sensitive: true
   },
+  {
+    key: "email-guard-require-approval-enabled",
+    description: "Platform enable-gate for the email-domain guardrail REQUIRE_APPROVAL stage (ENG-7939). When ON for an org, a scope at email_guard_stage=require_approval routes a send to a non-allowed domain into Human Approval (an Approve/Deny card) instead of a hard block: the rollout UI unlocks the option and the write routes accept require_approval. When OFF (default) the write routes reject require_approval and the UI shows it as not yet available, so no scope can select it. Structurally also depends on hitl-approval-routing being on (the approval broker fails closed to a hard block when routing is off). Evaluated per-org. Ships dark.",
+    flagType: "boolean",
+    // Declared safe value is `false` (require_approval is unselectable / inert). A flag-DB read
+    // error degrades here, so a flags outage can never start routing customer email through a
+    // half-wired approval path - the fail-closed direction. No envVar: net-new control with no
+    // pre-flags env gate to migrate (ADR-0022).
+    defaultValue: false,
+    // Ungates a stage that changes how real customer email is handled (block becomes approval),
+    // so it is a deliberate, audited per-org flip (ADR-0022 §4).
+    sensitive: true
+  },
   {
     key: "slack-reply-binding",
     description: "Slack reply-target binding (ENG-7396 / WS2, cross-thread reply routing): the model names which inbound it answers (inbound_id) and the server resolves the destination from its own verified record. shadow = classify + count only, routing unchanged; warn = same routing plus a tool-result note so the model self-corrects; enforce = route a bound reply to the registry thread and REJECT a reply whose target matches no inbound this process delivered. The channel server can't evaluate flags, so the manager materializes the resolved value into the AGT_SLACK_REPLY_BINDING spawn env (the operator/canary override, ADR-0022). Ships shadow.",

package/dist/mcp/telegram-channel.js

@@ -32954,7 +32954,7 @@ var INTEGRATION_REGISTRY = [
     id: "brand-ninja",
     name: "Brand Ninja",
     category: "social",
-    description: "Brand-aligned content generation: submit async content requests, track them, and discover publishing channels. Wired as the hosted Brand Ninja External-Content MCP at https://ext-api.app.brandninja.ai/v1/mcp.",
+    description: "Brand-aligned content generation: submit async content requests and track them, search transcripts and assemble ranked timelines from source clips, and discover the account catalog (channels, brands, topics, templates, content types, skills). Wired as the hosted Brand Ninja External-Content MCP at https://ext-api.app.brandninja.ai/v1/mcp.",
     // ENG-6820: same remote streamable-HTTP MCP + OAuth pattern as Granola.
     // Brand Ninja's server implements the full MCP discovery chain (RFC
     // 9728/8414/7591); auth is OAuth 2.0 authorization-code with PKCE (S256)
@@ -32969,6 +32969,9 @@ var INTEGRATION_REGISTRY = [
     capabilities: [
       { id: "brand-ninja:generate-content", name: "Generate Content", description: "Submit async brand-aligned content-generation requests and poll their status (submit_content_request, get_content_status, list_content_requests)", access: "write" },
       { id: "brand-ninja:list-channels", name: "List Channels", description: "Discover the publishing channels available to the account, metadata only (list_channels)", access: "read" },
+      { id: "brand-ninja:list-catalog", name: "List Catalog", description: "Discover account catalog metadata: brands, topics, timeline templates, content types, and source, output and conversion skills (list_brands, list_topics, list_timeline_templates, list_content_types, list_source_skills, list_output_skills, list_conversion_skills)", access: "read" },
+      { id: "brand-ninja:search-transcripts", name: "Search Transcripts", description: "Search the transcripts available to the account to source or reference when generating content, text and metadata (search_transcripts)", access: "read" },
+      { id: "brand-ninja:assemble-timeline", name: "Assemble Timeline", description: "Turn transcript spans into topic-tagged source clips and rank a topic's clips into a ranked timeline via an async LLM job (create_source_clips, create_timeline_ranking)", access: "write" },
       { id: "brand-ninja:read-credentials", name: "Read Credentials", description: "Read-only External-API credential metadata, secrets stripped. Requires the elevated external-api/admin scope (list_credentials)", access: "admin" }
     ],
     docs_url: "https://ext-api.app.brandninja.ai/v1/mcp",
@@ -34813,6 +34816,19 @@ var FLAG_REGISTRY = [
     // deliberate, audited per-org flip (ADR-0022 §4).
     sensitive: true
   },
+  {
+    key: "email-guard-require-approval-enabled",
+    description: "Platform enable-gate for the email-domain guardrail REQUIRE_APPROVAL stage (ENG-7939). When ON for an org, a scope at email_guard_stage=require_approval routes a send to a non-allowed domain into Human Approval (an Approve/Deny card) instead of a hard block: the rollout UI unlocks the option and the write routes accept require_approval. When OFF (default) the write routes reject require_approval and the UI shows it as not yet available, so no scope can select it. Structurally also depends on hitl-approval-routing being on (the approval broker fails closed to a hard block when routing is off). Evaluated per-org. Ships dark.",
+    flagType: "boolean",
+    // Declared safe value is `false` (require_approval is unselectable / inert). A flag-DB read
+    // error degrades here, so a flags outage can never start routing customer email through a
+    // half-wired approval path - the fail-closed direction. No envVar: net-new control with no
+    // pre-flags env gate to migrate (ADR-0022).
+    defaultValue: false,
+    // Ungates a stage that changes how real customer email is handled (block becomes approval),
+    // so it is a deliberate, audited per-org flip (ADR-0022 §4).
+    sensitive: true
+  },
   {
     key: "slack-reply-binding",
     description: "Slack reply-target binding (ENG-7396 / WS2, cross-thread reply routing): the model names which inbound it answers (inbound_id) and the server resolves the destination from its own verified record. shadow = classify + count only, routing unchanged; warn = same routing plus a tool-result note so the model self-corrects; enforce = route a bound reply to the registry thread and REJECT a reply whose target matches no inbound this process delivered. The channel server can't evaluate flags, so the manager materializes the resolved value into the AGT_SLACK_REPLY_BINDING spawn env (the operator/canary override, ADR-0022). Ships shadow.",

package/dist/{persistent-session-R7JOZNIC.js → persistent-session-7VMIE4G4.js}

@@ -36,7 +36,7 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-FAGXXKWZ.js";
+} from "./chunk-3D7IBJYZ.js";
 import "./chunk-XWVM4KPK.js";
 export {
   EGRESS_BASELINE_DOMAINS,
@@ -77,4 +77,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-R7JOZNIC.js.map
+//# sourceMappingURL=persistent-session-7VMIE4G4.js.map

package/dist/{responsiveness-probe-7SUERVWL.js → responsiveness-probe-XJ7DQX4M.js}

@@ -1,6 +1,6 @@
 import {
   paneLogPath
-} from "./chunk-FAGXXKWZ.js";
+} from "./chunk-3D7IBJYZ.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -437,4 +437,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-7SUERVWL.js.map
+//# sourceMappingURL=responsiveness-probe-XJ7DQX4M.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.359",
+  "version": "0.28.361",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {