@kivimedia/kmhub 2.9.0 → 2.10.0

package/tools/pending.mjs

@@ -1,122 +1,122 @@
-/**
- * Tool family: pending - what a scheduled run decided should happen, waiting on a person.
- *
- * Workstream D1, the design that survived review.
- *
- * A scheduled run has nobody at the keyboard, so it cannot give the confirmation a
- * money-spending or client-visible action requires. The first shipped answer to that
- * was "then schedules only read". This is the second answer: a scheduled run may
- * DECIDE something should happen, and may not DO it. The intent lands here carrying
- * the sentence the SERVER wrote about it, and a person approves.
- *
- * 🚨 THE SENTENCE IS NOT WRITTEN BY A MODEL. It comes from describeAction() in the
- * API, the same code that will carry the action out. That is the whole reason it can
- * be trusted as a description of what approving will do. Never paraphrase it into
- * something friendlier when presenting it: the paraphrase is what a person would be
- * consenting to, and it is not what will run.
- *
- * 🚨 NAMING. This family is deliberately NOT called proposals and its tools are
- * deliberately NOT km_list_proposals. That name is already taken by money.mjs for
- * SALES proposals sent to clients, and MCP tool names are a flat namespace: a second
- * km_list_proposals would have shadowed a shipped tool rather than erroring, so
- * "show me my proposals" would quietly have started answering a different question.
- * Same reason the routes are /pending-actions and not /proposals, which money.ts
- * already owns and, being registered first, would have won the match.
- *
- * The family contract this file follows is documented in ./README.md.
- */
-import { z } from 'zod';
-
-export const FAMILY = 'pending';
-
-export const TOOLS = ['km_list_pending_actions', 'km_approve_pending_action', 'km_reject_pending_action'];
-
-export const PROFILES = ['*'];
-
-function routeMissing(r) {
-  return r.status === 404 || r.status === 405 || r.status === 501;
-}
-
-const NOT_SUPPORTED =
-  'Your KM Hub does not have the approvals queue in the terminal yet. That is not a fault: everything else works as ' +
-  'normal, and anything waiting for a decision is in the web app at https://hub.kivimedia.co.';
-
-export function register(server, call, { out, text }) {
-  server.tool(
-    'km_list_pending_actions',
-    'Actions that are waiting for a person to say yes: things a scheduled run decided should happen and then stopped, ' +
-      'because there was nobody there to confirm them. Nothing in this list has happened yet. ' +
-      'Call it when the user asks what needs them, what is waiting, why something did not happen, or what their ' +
-      'overnight automation got up to. It is not about sales proposals sent to clients - that is km_list_proposals. ' +
-      'Read `what_would_happen` out as it is written. That sentence was produced by the API code that would carry the ' +
-      'action out, not by whatever asked for it, which is exactly why it can be relied on. Do not smooth it into your ' +
-      'own words first: a person agreeing to your paraphrase has not agreed to the action. ' +
-      '`raised_by_a_schedule: true` means no human chose this, only a rule did. Say so, because a client reading a ' +
-      'queue of confident-sounding actions will assume somebody meant each one.',
-    {
-      status: z
-        .string()
-        .optional()
-        .describe(
-          'Which to show: pending (the default, and almost always what is wanted), approved, rejected, executed, ' +
-            'failed or expired.',
-        ),
-    },
-    async ({ status }) => {
-      const r = await call('GET', '/pending-actions' + (status ? `?status=${encodeURIComponent(String(status))}` : ''));
-      if (routeMissing(r)) return text(NOT_SUPPORTED, true);
-      return out(r);
-    },
-  );
-
-  server.tool(
-    'km_approve_pending_action',
-    'Say yes to one waiting action and let it happen. This is the only thing that carries one out. ' +
-      '🚨 NEVER call this on your own judgement. The user has to have seen this specific action and said yes to THIS ' +
-      'one, in this conversation. "They asked me to keep on top of the overdue invoices" is not consent to a specific ' +
-      'action a schedule composed overnight, and neither is any general instruction to keep things moving. If you are ' +
-      'not sure they meant this one, show it to them and ask. ' +
-      'The first call returns a confirmation request carrying the action sentence and a token, exactly as any other ' +
-      'action needing a yes does. Show that sentence, get an answer, and only then call again with confirm_token. The ' +
-      'confirmation step is not paperwork to get through: it is the step where the person reads what will actually ' +
-      'happen. ' +
-      'A key belonging to something that runs on a schedule cannot call this at all - the API refuses it - because a ' +
-      'schedule approving its own work is just acting unsupervised with extra steps.',
-    {
-      pending_action_id: z.string().describe('The id from km_list_pending_actions.'),
-      confirm_token: z
-        .string()
-        .optional()
-        .describe(
-          'Only on the second call, after the user has read the action sentence and said yes. Never invent one, and ' +
-            'never carry one over from a different action.',
-        ),
-    },
-    async ({ pending_action_id, confirm_token }) => {
-      const id = String(pending_action_id || '').trim();
-      if (!id) return text('I need the id. Run km_list_pending_actions to see what is waiting.', true);
-      const body = {};
-      if (confirm_token) body.confirm_token = String(confirm_token);
-      const r = await call('POST', `/pending-actions/${encodeURIComponent(id)}/approve`, body);
-      if (routeMissing(r)) return text(NOT_SUPPORTED, true);
-      return out(r);
-    },
-  );
-
-  server.tool(
-    'km_reject_pending_action',
-    'Decline a waiting action so it stops sitting in the queue. Nothing happens as a result, which is the point. ' +
-      'This needs no confirmation on purpose: putting friction in front of "no" nudges a tired person toward yes, and ' +
-      'declining is the reversible direction. Afterwards, say plainly that the action did not happen.',
-    {
-      pending_action_id: z.string().describe('The id from km_list_pending_actions.'),
-    },
-    async ({ pending_action_id }) => {
-      const id = String(pending_action_id || '').trim();
-      if (!id) return text('I need the id. Run km_list_pending_actions to see what is waiting.', true);
-      const r = await call('POST', `/pending-actions/${encodeURIComponent(id)}/reject`, {});
-      if (routeMissing(r)) return text(NOT_SUPPORTED, true);
-      return out(r);
-    },
-  );
-}
+/**
+ * Tool family: pending - what a scheduled run decided should happen, waiting on a person.
+ *
+ * Workstream D1, the design that survived review.
+ *
+ * A scheduled run has nobody at the keyboard, so it cannot give the confirmation a
+ * money-spending or client-visible action requires. The first shipped answer to that
+ * was "then schedules only read". This is the second answer: a scheduled run may
+ * DECIDE something should happen, and may not DO it. The intent lands here carrying
+ * the sentence the SERVER wrote about it, and a person approves.
+ *
+ * 🚨 THE SENTENCE IS NOT WRITTEN BY A MODEL. It comes from describeAction() in the
+ * API, the same code that will carry the action out. That is the whole reason it can
+ * be trusted as a description of what approving will do. Never paraphrase it into
+ * something friendlier when presenting it: the paraphrase is what a person would be
+ * consenting to, and it is not what will run.
+ *
+ * 🚨 NAMING. This family is deliberately NOT called proposals and its tools are
+ * deliberately NOT km_list_proposals. That name is already taken by money.mjs for
+ * SALES proposals sent to clients, and MCP tool names are a flat namespace: a second
+ * km_list_proposals would have shadowed a shipped tool rather than erroring, so
+ * "show me my proposals" would quietly have started answering a different question.
+ * Same reason the routes are /pending-actions and not /proposals, which money.ts
+ * already owns and, being registered first, would have won the match.
+ *
+ * The family contract this file follows is documented in ./README.md.
+ */
+import { z } from 'zod';
+
+export const FAMILY = 'pending';
+
+export const TOOLS = ['km_list_pending_actions', 'km_approve_pending_action', 'km_reject_pending_action'];
+
+export const PROFILES = ['*'];
+
+function routeMissing(r) {
+  return r.status === 404 || r.status === 405 || r.status === 501;
+}
+
+const NOT_SUPPORTED =
+  'Your KM Hub does not have the approvals queue in the terminal yet. That is not a fault: everything else works as ' +
+  'normal, and anything waiting for a decision is in the web app at https://hub.kivimedia.co.';
+
+export function register(server, call, { out, text }) {
+  server.tool(
+    'km_list_pending_actions',
+    'Actions that are waiting for a person to say yes: things a scheduled run decided should happen and then stopped, ' +
+      'because there was nobody there to confirm them. Nothing in this list has happened yet. ' +
+      'Call it when the user asks what needs them, what is waiting, why something did not happen, or what their ' +
+      'overnight automation got up to. It is not about sales proposals sent to clients - that is km_list_proposals. ' +
+      'Read `what_would_happen` out as it is written. That sentence was produced by the API code that would carry the ' +
+      'action out, not by whatever asked for it, which is exactly why it can be relied on. Do not smooth it into your ' +
+      'own words first: a person agreeing to your paraphrase has not agreed to the action. ' +
+      '`raised_by_a_schedule: true` means no human chose this, only a rule did. Say so, because a client reading a ' +
+      'queue of confident-sounding actions will assume somebody meant each one.',
+    {
+      status: z
+        .string()
+        .optional()
+        .describe(
+          'Which to show: pending (the default, and almost always what is wanted), approved, rejected, executed, ' +
+            'failed or expired.',
+        ),
+    },
+    async ({ status }) => {
+      const r = await call('GET', '/pending-actions' + (status ? `?status=${encodeURIComponent(String(status))}` : ''));
+      if (routeMissing(r)) return text(NOT_SUPPORTED, true);
+      return out(r);
+    },
+  );
+
+  server.tool(
+    'km_approve_pending_action',
+    'Say yes to one waiting action and let it happen. This is the only thing that carries one out. ' +
+      '🚨 NEVER call this on your own judgement. The user has to have seen this specific action and said yes to THIS ' +
+      'one, in this conversation. "They asked me to keep on top of the overdue invoices" is not consent to a specific ' +
+      'action a schedule composed overnight, and neither is any general instruction to keep things moving. If you are ' +
+      'not sure they meant this one, show it to them and ask. ' +
+      'The first call returns a confirmation request carrying the action sentence and a token, exactly as any other ' +
+      'action needing a yes does. Show that sentence, get an answer, and only then call again with confirm_token. The ' +
+      'confirmation step is not paperwork to get through: it is the step where the person reads what will actually ' +
+      'happen. ' +
+      'A key belonging to something that runs on a schedule cannot call this at all - the API refuses it - because a ' +
+      'schedule approving its own work is just acting unsupervised with extra steps.',
+    {
+      pending_action_id: z.string().describe('The id from km_list_pending_actions.'),
+      confirm_token: z
+        .string()
+        .optional()
+        .describe(
+          'Only on the second call, after the user has read the action sentence and said yes. Never invent one, and ' +
+            'never carry one over from a different action.',
+        ),
+    },
+    async ({ pending_action_id, confirm_token }) => {
+      const id = String(pending_action_id || '').trim();
+      if (!id) return text('I need the id. Run km_list_pending_actions to see what is waiting.', true);
+      const body = {};
+      if (confirm_token) body.confirm_token = String(confirm_token);
+      const r = await call('POST', `/pending-actions/${encodeURIComponent(id)}/approve`, body);
+      if (routeMissing(r)) return text(NOT_SUPPORTED, true);
+      return out(r);
+    },
+  );
+
+  server.tool(
+    'km_reject_pending_action',
+    'Decline a waiting action so it stops sitting in the queue. Nothing happens as a result, which is the point. ' +
+      'This needs no confirmation on purpose: putting friction in front of "no" nudges a tired person toward yes, and ' +
+      'declining is the reversible direction. Afterwards, say plainly that the action did not happen.',
+    {
+      pending_action_id: z.string().describe('The id from km_list_pending_actions.'),
+    },
+    async ({ pending_action_id }) => {
+      const id = String(pending_action_id || '').trim();
+      if (!id) return text('I need the id. Run km_list_pending_actions to see what is waiting.', true);
+      const r = await call('POST', `/pending-actions/${encodeURIComponent(id)}/reject`, {});
+      if (routeMissing(r)) return text(NOT_SUPPORTED, true);
+      return out(r);
+    },
+  );
+}

package/tools/photos.mjs

@@ -1,140 +1,140 @@
-/**
- * Tool family: photos - the work-photo library, and the photos on an outreach draft.
- *
- * Until now the terminal could see galleries and was told, in as many words, that
- * "adding images happens in KM Hub". So a session could write every word of an
- * email and then had to hand the visual half back to a person. These four tools
- * close that: get photos into the library, choose which ones ride an email, and
- * choose the shape they sit in.
- *
- * The safety line is the same as the rest of outreach: nothing here sends. A
- * draft with a gallery on it is still a draft, and a person still approves it.
- *
- * The family contract this file follows is documented in ./README.md.
- */
-import { z } from 'zod';
-
-export const FAMILY = 'photos';
-
-export const TOOLS = [
-  'km_list_work_photos',
-  'km_add_work_photos',
-  'km_attach_draft_photos',
-  'km_remove_draft_photos',
-];
-
-export const PROFILES = ['outreach', 'content'];
-
-const LAYOUT = ['grid', 'pyramid'];
-
-export function register(server, call, { out }) {
-  server.tool(
-    'km_list_work_photos',
-    'The real work photos this business has on file, grouped into the themed sets they belong to, each with its caption, ' +
-      'its hosted URL and the id you need to put it on an email. ' +
-      'Reach for it before attaching photos to anything, so you are choosing from what actually exists rather than guessing, ' +
-      'and when the user asks what imagery they have. ' +
-      'These are the photos that ride inside first-touch outreach emails, so they are also the honest answer to "what does a ' +
-      'prospect see when we write to them". ' +
-      'An empty library is worth saying out loud: it means every email this workspace sends is text only. Read only.',
-    {},
-    async () => out(await call('GET', '/photos')),
-  );
-
-  server.tool(
-    'km_add_work_photos',
-    'Add photos to the work-photo library, either by URL or as base64, into a named set. Once they are in, any outreach draft ' +
-      'in the workspace can use them. ' +
-      'Reach for it when the user hands you images, points you at some, or asks to get their work photos in. ' +
-      'Give each one a short caption where you can: the caption becomes the image alt text that a recipient with images turned ' +
-      'off actually reads, so a photo with no caption is a blank box to them. ' +
-      '🚨 SIZE IS THE ONE THING THAT WILL BITE. Each photo must be under about 1.2MB, and a phone original is five times that. ' +
-      'KM Hub resizes in the browser before uploading; nothing here can, so an oversized photo is REFUSED rather than quietly ' +
-      'accepted, and the answer tells you which one and why. Resize to roughly 1600px on the longest edge as a JPEG around 82 ' +
-      'percent quality and send it again. Do that yourself rather than asking the user to. ' +
-      'JPEG, PNG and GIF only: HEIC and WebP render as a broken box in Gmail and Outlook, which is worse than sending no photo. ' +
-      'It adds to the library and nothing else. It does not attach anything to an email and it does not send.',
-    {
-      photos: z
-        .array(
-          z.object({
-            url: z.string().optional().describe('Public http or https URL to fetch the image from.'),
-            base64: z.string().optional().describe('The image itself, base64 encoded. A data: URL is fine. Use this for a local file.'),
-            caption: z.string().optional().describe('Short human caption. Becomes the alt text, and helps the matcher pick this set for the right lead.'),
-            filename: z.string().optional().describe('Original filename, used to name the stored file. Optional.'),
-          }),
-        )
-        .min(1)
-        .max(20)
-        .describe('The photos to add. Each needs either a url or a base64. Twenty per call.'),
-      theme: z
-        .string()
-        .optional()
-        .describe(
-          'The set these belong to, in plain words, like "burning rubber" or "grand openings". Default "my best work". ' +
-            'Sets are how the right photos reach the right lead, so a name that describes the WORK beats a name that describes the date.',
-        ),
-    },
-    async ({ photos, theme }) => out(await call('POST', '/photos', { photos, theme })),
-  );
-
-  server.tool(
-    'km_attach_draft_photos',
-    'Put a photo gallery on an outreach draft that is still waiting for approval, and choose the shape it sits in. ' +
-      'This is how "add some photos to that email" actually lands: the recipient opens the message and sees the words followed ' +
-      'by the pictures. ' +
-      'LAYOUT. "pyramid" is one big image across the top, then two side by side, then three, which is the shape that reads as ' +
-      'designed rather than dumped, and it is built around six photos. "grid" is the plainer two-across block and is what every ' +
-      'existing campaign already sends. ' +
-      'Pick the photos with photo_ids when the order matters, and put the strongest image FIRST, because in a pyramid the first ' +
-      'one is the big one. Pass a theme instead to take a whole set in its own order. ' +
-      'Attaching REPLACES any gallery already on the draft rather than adding a second one. ' +
-      'The wording stays yours afterwards: km_edit_outreach_draft rebuilds the message around these photos and keeps them, so ' +
-      'there is no need to finish the text before adding images. ' +
-      'It refuses on a message that is already approved, scheduled, sent or cancelled, on anything that is not email, and on a ' +
-      'draft built from a saved template, and it says which. It does NOT approve and does NOT send.',
-    {
-      id: z.string().describe('UUID of the draft (see km_list_outreach_drafts).'),
-      layout: z
-        .enum(LAYOUT)
-        .optional()
-        .describe('pyramid for one big then two then three. grid for the plain two-across block. Default grid.'),
-      photo_ids: z
-        .array(z.string())
-        .optional()
-        .describe('UUIDs from km_list_work_photos, in the order they should appear. The first one is the hero in a pyramid.'),
-      theme: z
-        .string()
-        .optional()
-        .describe('Take a whole themed set instead of naming photos. Ignored when photo_ids is given.'),
-      count: z
-        .number()
-        .int()
-        .min(1)
-        .max(12)
-        .optional()
-        .describe('How many photos to use. Defaults to what the layout is built for: 6 for a pyramid, 10 for a grid.'),
-      heading: z
-        .string()
-        .optional()
-        .describe('The quiet line above the photos. Default "A few pieces of our recent work:".'),
-    },
-    async ({ id, layout, photo_ids, theme, count, heading }) =>
-      out(await call('POST', `/outreach-drafts/${encodeURIComponent(String(id))}/photos`, {
-        layout, photo_ids, theme, count, heading,
-      })),
-  );
-
-  server.tool(
-    'km_remove_draft_photos',
-    'Take the photo gallery back off a draft, so it goes back to being a plain text email. ' +
-      'Reach for it when the user says the pictures are wrong, too many, or not right for this prospect, and you want the ' +
-      'message clean before choosing again. ' +
-      'It removes the photos from THIS ONE MESSAGE. The photos stay in the library and every other draft keeps its own. ' +
-      'It only works while the message is still a draft, and it does not send anything.',
-    {
-      id: z.string().describe('UUID of the draft (see km_list_outreach_drafts).'),
-    },
-    async ({ id }) => out(await call('DELETE', `/outreach-drafts/${encodeURIComponent(String(id))}/photos`)),
-  );
-}
+/**
+ * Tool family: photos - the work-photo library, and the photos on an outreach draft.
+ *
+ * Until now the terminal could see galleries and was told, in as many words, that
+ * "adding images happens in KM Hub". So a session could write every word of an
+ * email and then had to hand the visual half back to a person. These four tools
+ * close that: get photos into the library, choose which ones ride an email, and
+ * choose the shape they sit in.
+ *
+ * The safety line is the same as the rest of outreach: nothing here sends. A
+ * draft with a gallery on it is still a draft, and a person still approves it.
+ *
+ * The family contract this file follows is documented in ./README.md.
+ */
+import { z } from 'zod';
+
+export const FAMILY = 'photos';
+
+export const TOOLS = [
+  'km_list_work_photos',
+  'km_add_work_photos',
+  'km_attach_draft_photos',
+  'km_remove_draft_photos',
+];
+
+export const PROFILES = ['outreach', 'content'];
+
+const LAYOUT = ['grid', 'pyramid'];
+
+export function register(server, call, { out }) {
+  server.tool(
+    'km_list_work_photos',
+    'The real work photos this business has on file, grouped into the themed sets they belong to, each with its caption, ' +
+      'its hosted URL and the id you need to put it on an email. ' +
+      'Reach for it before attaching photos to anything, so you are choosing from what actually exists rather than guessing, ' +
+      'and when the user asks what imagery they have. ' +
+      'These are the photos that ride inside first-touch outreach emails, so they are also the honest answer to "what does a ' +
+      'prospect see when we write to them". ' +
+      'An empty library is worth saying out loud: it means every email this workspace sends is text only. Read only.',
+    {},
+    async () => out(await call('GET', '/photos')),
+  );
+
+  server.tool(
+    'km_add_work_photos',
+    'Add photos to the work-photo library, either by URL or as base64, into a named set. Once they are in, any outreach draft ' +
+      'in the workspace can use them. ' +
+      'Reach for it when the user hands you images, points you at some, or asks to get their work photos in. ' +
+      'Give each one a short caption where you can: the caption becomes the image alt text that a recipient with images turned ' +
+      'off actually reads, so a photo with no caption is a blank box to them. ' +
+      '🚨 SIZE IS THE ONE THING THAT WILL BITE. Each photo must be under about 1.2MB, and a phone original is five times that. ' +
+      'KM Hub resizes in the browser before uploading; nothing here can, so an oversized photo is REFUSED rather than quietly ' +
+      'accepted, and the answer tells you which one and why. Resize to roughly 1600px on the longest edge as a JPEG around 82 ' +
+      'percent quality and send it again. Do that yourself rather than asking the user to. ' +
+      'JPEG, PNG and GIF only: HEIC and WebP render as a broken box in Gmail and Outlook, which is worse than sending no photo. ' +
+      'It adds to the library and nothing else. It does not attach anything to an email and it does not send.',
+    {
+      photos: z
+        .array(
+          z.object({
+            url: z.string().optional().describe('Public http or https URL to fetch the image from.'),
+            base64: z.string().optional().describe('The image itself, base64 encoded. A data: URL is fine. Use this for a local file.'),
+            caption: z.string().optional().describe('Short human caption. Becomes the alt text, and helps the matcher pick this set for the right lead.'),
+            filename: z.string().optional().describe('Original filename, used to name the stored file. Optional.'),
+          }),
+        )
+        .min(1)
+        .max(20)
+        .describe('The photos to add. Each needs either a url or a base64. Twenty per call.'),
+      theme: z
+        .string()
+        .optional()
+        .describe(
+          'The set these belong to, in plain words, like "burning rubber" or "grand openings". Default "my best work". ' +
+            'Sets are how the right photos reach the right lead, so a name that describes the WORK beats a name that describes the date.',
+        ),
+    },
+    async ({ photos, theme }) => out(await call('POST', '/photos', { photos, theme })),
+  );
+
+  server.tool(
+    'km_attach_draft_photos',
+    'Put a photo gallery on an outreach draft that is still waiting for approval, and choose the shape it sits in. ' +
+      'This is how "add some photos to that email" actually lands: the recipient opens the message and sees the words followed ' +
+      'by the pictures. ' +
+      'LAYOUT. "pyramid" is one big image across the top, then two side by side, then three, which is the shape that reads as ' +
+      'designed rather than dumped, and it is built around six photos. "grid" is the plainer two-across block and is what every ' +
+      'existing campaign already sends. ' +
+      'Pick the photos with photo_ids when the order matters, and put the strongest image FIRST, because in a pyramid the first ' +
+      'one is the big one. Pass a theme instead to take a whole set in its own order. ' +
+      'Attaching REPLACES any gallery already on the draft rather than adding a second one. ' +
+      'The wording stays yours afterwards: km_edit_outreach_draft rebuilds the message around these photos and keeps them, so ' +
+      'there is no need to finish the text before adding images. ' +
+      'It refuses on a message that is already approved, scheduled, sent or cancelled, on anything that is not email, and on a ' +
+      'draft built from a saved template, and it says which. It does NOT approve and does NOT send.',
+    {
+      id: z.string().describe('UUID of the draft (see km_list_outreach_drafts).'),
+      layout: z
+        .enum(LAYOUT)
+        .optional()
+        .describe('pyramid for one big then two then three. grid for the plain two-across block. Default grid.'),
+      photo_ids: z
+        .array(z.string())
+        .optional()
+        .describe('UUIDs from km_list_work_photos, in the order they should appear. The first one is the hero in a pyramid.'),
+      theme: z
+        .string()
+        .optional()
+        .describe('Take a whole themed set instead of naming photos. Ignored when photo_ids is given.'),
+      count: z
+        .number()
+        .int()
+        .min(1)
+        .max(12)
+        .optional()
+        .describe('How many photos to use. Defaults to what the layout is built for: 6 for a pyramid, 10 for a grid.'),
+      heading: z
+        .string()
+        .optional()
+        .describe('The quiet line above the photos. Default "A few pieces of our recent work:".'),
+    },
+    async ({ id, layout, photo_ids, theme, count, heading }) =>
+      out(await call('POST', `/outreach-drafts/${encodeURIComponent(String(id))}/photos`, {
+        layout, photo_ids, theme, count, heading,
+      })),
+  );
+
+  server.tool(
+    'km_remove_draft_photos',
+    'Take the photo gallery back off a draft, so it goes back to being a plain text email. ' +
+      'Reach for it when the user says the pictures are wrong, too many, or not right for this prospect, and you want the ' +
+      'message clean before choosing again. ' +
+      'It removes the photos from THIS ONE MESSAGE. The photos stay in the library and every other draft keeps its own. ' +
+      'It only works while the message is still a draft, and it does not send anything.',
+    {
+      id: z.string().describe('UUID of the draft (see km_list_outreach_drafts).'),
+    },
+    async ({ id }) => out(await call('DELETE', `/outreach-drafts/${encodeURIComponent(String(id))}/photos`)),
+  );
+}