@workerkit/core 0.3.17 → 0.3.19

package/CHANGELOG.md

@@ -6,6 +6,29 @@ and the package adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.3.19] - 2026-10-21
+
+### Added
+
+- Nine API-app authoring tools list, read, validate, preview, create and update account-private definitions, and publish, inspect and revoke immutable versions. Authoring requires a live account Admin and the explicit `managePrivateApiApps` scope. Draft edits preserve optimistic revisions; publication never upgrades worker bindings or creates a public listing.
+- `worker_bindings_get` and `worker_bindings_set` read and set a worker's grants to call other workers after install. One atomic alias map fills, re-points or clears grants; a declared kit slot supplies its own operations and Action tools; an unchanged live grant keeps its revision. Reads ride `readWorkers`; the write requires the new `manageAppsAndWorkers` scope.
+- `worker_permissions_set` replaces an existing worker's app set in the vocabulary `worker_permissions_get` returns, plus the contact stance, blocked sender categories, timeframes and child budget. A stance changes only when the call sends `allowAll`. Requires `manageAppsAndWorkers` and a live account Admin; rules, identities and MCP tool bindings remain dashboard-only.
+- `managePrivateApiApps` and `manageAppsAndWorkers` join `managerScopes`. Existing keys gain `managePrivateApiApps` only through explicit re-scoping. Keys that held every earlier scope when `manageAppsAndWorkers` was introduced carry it; other existing keys need an account admin to add it.
+- The backend contract's guidance coverage gains `APIAPP-01`, which pins the API-app safety guidance: Admin authority, no credentials in definitions, offline validation and preview, reviewed revisions and irreversible revocation.
+
+### Changed
+
+- `worker_permissions_get`, `worker_get`, `run_get`, `kit_install_preview` and `kit_install` point to the new tools for binding slots and changing access.
+- `worker_permissions_get` reports messaging `providers` and the Firecrawl and Nimble `capabilities` a worker holds, so its output writes back unchanged.
+- `kit_install` returns no worker API key. Trigger signing secrets are still returned once.
+- Quality receipt guidance separates code-computed `executionChecks` from model `systemReview` diagnostics and notes that runtime and app failure counts can overlap.
+
+## [0.3.18] - 2026-10-17
+
+### Added
+
+- `schedule_create` and `schedule_update` accept `daysOfWeek` on `DailyAtTime` schedules: the local weekdays the schedule fires on, as full English day names. An update that omits it keeps the current days. An occurrence on a restricted day that is missed past its local firing date expires without a run, and schedule responses list the selected days by canonical name.
+
 ## [0.3.17] - 2026-10-17
 
 ### Added

package/README.md

@@ -6,7 +6,7 @@
 [![license](https://img.shields.io/npm/l/%40workerkit%2Fcore.svg)](LICENSE)
 
 The [WorkerKit](https://workerkit.ai) API client and tool registry for Node.js.
-It provides 100 authenticated management tools, 8 anonymous directory tools,
+It provides 112 authenticated management tools, 8 anonymous directory tools,
 and a shared execution engine for their HTTP requests.
 
 Descriptors include agent guidance, annotations and Zod input schemas. MCP
@@ -68,6 +68,22 @@ whole-call deadline, bounded retries for idempotent methods only, a streamed
 response-size cap, and quota/rate-limit header extraction. `scrubSecrets` helps
 keep credentials out of logs.
 
+## Author API apps
+
+`api_app_validate` checks a `{ definition }` offline, and `api_app_create`
+saves it as an account-private draft from `{ name, definition, enabled: false }`.
+Use `api_apps_list` / `api_app_get` to inspect saved state, `api_app_update`
+with its reviewed revision to edit it, and `api_app_publish` with
+`{ appId, revision }` to publish an immutable version. Version reads and
+revocation use `api_app_version_get` and `api_app_version_revoke`.
+
+Authoring requires a live account Admin and the `managePrivateApiApps` scope,
+which existing keys gain only through explicit re-scoping. Publishing does not
+create a public listing or upgrade worker bindings. Definitions declare named
+authentication slots, never credentials; credentials and worker bindings are
+configured separately on the dashboard. A revision conflict requires re-reading
+the app.
+
 ## Discover GitHub targets before installing
 
 `app_github_accounts`, `app_github_repos` and `app_github_branches` look up
@@ -185,8 +201,15 @@ installed worker, to `kit_install`. The target must be in the same account and
 within the installer's authority and fleet-key selection, and its kind,
 operations and pinned contracts must match the slot. An install without
 bindings succeeds, but an unbound required slot reports the readiness issue
-`worker_slots_pending` and runs are skipped until it is bound under Apps and
-workers on the dashboard.
+`worker_slots_pending` and runs are skipped until it is bound.
+
+After install, `worker_bindings_get` lists a worker's grants, the slots its
+kit declares, the required slots still missing and the workers that could
+fill them. `worker_bindings_set` fills, re-points or clears aliases in one
+atomic map (`manageAppsAndWorkers`): a declared slot takes the slot's
+operations and Action tools when they are omitted, a free alias names its
+operations, and an unchanged live grant is left alone. Both follow the
+caller's authority and fleet-key selection.
 
 A binding shares the target's bounded result with the caller, not its full
 receipt or transcript. The target keeps its own permissions, budget, model and
@@ -197,6 +220,19 @@ returns the metadata and `contentReferences` without copying reports. A fleet
 key appears as an id, name and prefix snapshot, never a credential. Core only
 describes these fields; the server owns execution, waiting and billing.
 
+## Change an existing worker's apps
+
+`worker_permissions_set` (account Admin, `manageAppsAndWorkers`) replaces an
+existing worker's app set in the vocabulary `worker_permissions_get` returns.
+An app left out is switched off, and a stance changes only when the call sends
+`allowAll`: a deny-by-default app switched on reads nothing until the owner
+writes rules or the call sends `allowAll: true`. Rules, identities and MCP tool
+bindings stay on the dashboard.
+
+`manageAppsAndWorkers` also covers `worker_bindings_set`. Keys that held every
+earlier scope when it was introduced carry it; other existing keys need an
+account admin to add it.
+
 ## Worker quality
 
 `worker_quality_get` reads a worker's acceptance criteria, settings revision,

package/dist/contract-provenance.d.ts

@@ -1,6 +1,6 @@
 export declare const backendContractProvenance: {
     readonly sourceRepository: "workerkit-backend";
     readonly contractVersion: "1.0.0";
-    readonly sourceRevision: "bceae076c4110fa72e100aa407a5ed4db6bb8192";
-    readonly contentHash: "a196195c6760f0ac569c8d3008e9ab9f8c02dfb7c7bcac4c2cd4a34bbf3eeedb";
+    readonly sourceRevision: "b3e98b228c75eb49d2ce1bc37be7be4a3d2b2682";
+    readonly contentHash: "aa65f47736517127282a5d33b0bb81b77e6775f06a1baffbafd2b1de28ffbb40";
 };

package/dist/contract-provenance.js

@@ -2,7 +2,7 @@
 export const backendContractProvenance = {
     "sourceRepository": "workerkit-backend",
     "contractVersion": "1.0.0",
-    "sourceRevision": "bceae076c4110fa72e100aa407a5ed4db6bb8192",
-    "contentHash": "a196195c6760f0ac569c8d3008e9ab9f8c02dfb7c7bcac4c2cd4a34bbf3eeedb"
+    "sourceRevision": "b3e98b228c75eb49d2ce1bc37be7be4a3d2b2682",
+    "contentHash": "aa65f47736517127282a5d33b0bb81b77e6775f06a1baffbafd2b1de28ffbb40"
 };
 //# sourceMappingURL=contract-provenance.js.map

package/dist/contract-provenance.js.map

@@ -1 +1 @@
-{"version":3,"file":"contract-provenance.js","sourceRoot":"","sources":["../src/contract-provenance.ts"],"names":[],"mappings":"AAAA,sGAAsG;AACtG,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,kBAAkB,EAAE,mBAAmB;IACvC,iBAAiB,EAAE,OAAO;IAC1B,gBAAgB,EAAE,0CAA0C;IAC5D,aAAa,EAAE,kEAAkE;CACzE,CAAC","sourcesContent":["// Generated from the backend agent contract. Edit the backend source and re-import; do not edit here.\nexport const backendContractProvenance = {\n  \"sourceRepository\": \"workerkit-backend\",\n  \"contractVersion\": \"1.0.0\",\n  \"sourceRevision\": \"bceae076c4110fa72e100aa407a5ed4db6bb8192\",\n  \"contentHash\": \"a196195c6760f0ac569c8d3008e9ab9f8c02dfb7c7bcac4c2cd4a34bbf3eeedb\"\n} as const;\n"]}
+{"version":3,"file":"contract-provenance.js","sourceRoot":"","sources":["../src/contract-provenance.ts"],"names":[],"mappings":"AAAA,sGAAsG;AACtG,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,kBAAkB,EAAE,mBAAmB;IACvC,iBAAiB,EAAE,OAAO;IAC1B,gBAAgB,EAAE,0CAA0C;IAC5D,aAAa,EAAE,kEAAkE;CACzE,CAAC","sourcesContent":["// Generated from the backend agent contract. Edit the backend source and re-import; do not edit here.\nexport const backendContractProvenance = {\n  \"sourceRepository\": \"workerkit-backend\",\n  \"contractVersion\": \"1.0.0\",\n  \"sourceRevision\": \"b3e98b228c75eb49d2ce1bc37be7be4a3d2b2682\",\n  \"contentHash\": \"aa65f47736517127282a5d33b0bb81b77e6775f06a1baffbafd2b1de28ffbb40\"\n} as const;\n"]}

package/dist/descriptors/api-apps.d.ts

@@ -0,0 +1,3 @@
+import { type ToolDescriptor } from "./types.js";
+export declare const apiAppOperationsText = "Named operations. Each declares key, description, effect, method (GET/HEAD/POST/PUT/PATCH/DELETE), fixed path, inputs, and responseFields (output name to JSON Pointer), or emptyResponse:true. inputs is a closed object schema with properties, additionalProperties:false and optional required; supported types: object/array/string/integer/number/boolean, bounded enum/const and type-appropriate bounds. pathInputs/query/headers map names to {input:field} or {literal:value}; each declared top-level input maps once. body uses those leaves in a JSON object. Path placeholders occupy whole segments. authentication is {kind:none}, {kind:bearer,secretSlot}, {kind:basic,usernameSlot,passwordSlot}, or {kind:apiKey,headers:{name:slot},query:{name:slot}}. Store slot names only, never credentials. successStatuses contains declared 2xx codes. The backend rejects unknown fields, unsafe mappings and unsupported schema features; api_app_validate reports errors before saving.";
+export declare const apiAppDescriptors: readonly ToolDescriptor[];

package/dist/descriptors/api-apps.js

@@ -0,0 +1,79 @@
+// Generated from the backend agent contract. Edit the backend source and re-import; do not edit here.
+import { z } from "../zod.js";
+import { CREATE, DELETE, READ_ONLY, UPDATE, defineTool } from "./types.js";
+const API = "/api/manage/custom-api";
+const appId = z.string().uuid().describe("Account-owned app UUID from api_apps_list or api_app_create. Another account's app is indistinguishable from a missing app.");
+const versionId = z.string().uuid().describe("Immutable version UUID from api_app_get or api_app_publish.");
+const revision = z.string().uuid().describe("Current revision from api_app_get, api_app_create or api_app_update. After publishing use appRevision from that response. A 409 requires re-reading and reviewing the draft; never overwrite using a newer revision automatically.");
+const operations = "Named operations. Each declares key, description, effect, method (GET/HEAD/POST/PUT/PATCH/DELETE), fixed path, inputs, and responseFields (output name to JSON Pointer), or emptyResponse:true. inputs is a closed object schema with properties, additionalProperties:false and optional required; supported types: object/array/string/integer/number/boolean, bounded enum/const and type-appropriate bounds. pathInputs/query/headers map names to {input:field} or {literal:value}; each declared top-level input maps once. body uses those leaves in a JSON object. Path placeholders occupy whole segments. authentication is {kind:none}, {kind:bearer,secretSlot}, {kind:basic,usernameSlot,passwordSlot}, or {kind:apiKey,headers:{name:slot},query:{name:slot}}. Store slot names only, never credentials. successStatuses contains declared 2xx codes. The backend rejects unknown fields, unsafe mappings and unsupported schema features; api_app_validate reports errors before saving.";
+export const apiAppOperationsText = operations;
+const definition = z.object({
+    schemaVersion: z.literal(1).describe("Definition format version; must be 1."),
+    origin: z.string().url().max(2048).describe("One public HTTPS origin on port 443 without a path, query, credentials or fragment. Private networks and WorkerKit control-plane hosts are denied."),
+    operations: z.array(z.record(z.unknown())).min(1).max(40).describe(operations),
+}).strict().describe("Structured API definition, at most 128 KiB. No scripts, OpenAPI imports, executable templates or credentials. Validate before saving; preview only constructs a request shape and sends nothing.");
+const path = (params) => `${API}/apps/${encodeURIComponent(String(params.appId))}`;
+const versionPath = (params) => `${path(params)}/versions/${encodeURIComponent(String(params.versionId))}`;
+export const apiAppDescriptors = [
+    defineTool({
+        name: "api_apps_list", title: "List API Apps", auth: "manager", method: "get", schema: {}, path: `${API}/apps`,
+        description: "List this account's API apps: id, name, enabled, optimistic revision and liveVersionNumber (the newest unrevoked version; null if none). connectionCount, usableConnectionCount (enabled and authorized for the live version) and stoppedWorkerCount (enabled worker bindings stopped by a revoked version or a disabled or unauthorized connection) require an account Admin credential with managePrivateApiApps; otherwise null means withheld, not zero. {{scope}} Admins see all apps; members see only enabled apps explicitly granted to their current membership. Apps stay account-private. Use api_app_get for a saved draft and published version IDs.",
+        annotations: READ_ONLY,
+    }),
+    defineTool({
+        name: "api_app_get", title: "Get API App", auth: "manager", method: "get", schema: { appId }, path,
+        paramFilter: () => ({}), strictInput: true,
+        description: "Read app metadata, current revision and published version IDs/hashes/revocation state. {{scope}} The draft additionally requires an account Admin credential with managePrivateApiApps; otherwise draft:null means withheld. No credentials are returned. Existing workers keep their pinned versions when the draft changes. Use api_app_version_get for an immutable definition.",
+        annotations: READ_ONLY,
+    }),
+    defineTool({
+        name: "api_app_validate", title: "Validate API App", auth: "manager", method: "post", schema: { definition }, path: `${API}/validate`,
+        strictInput: true,
+        description: "Validate an API app definition offline and return its normalized definition and content hash. {{scope}} Requires a live account Admin. Saves nothing and sends no upstream request. Correct validation errors before api_app_create or api_app_update. A definition grants no worker access by itself; connections and exact worker bindings are configured separately on the dashboard.",
+        annotations: READ_ONLY,
+    }),
+    defineTool({
+        name: "api_app_preview", title: "Preview API Request", auth: "manager", method: "post",
+        schema: { definition, operation: z.string().min(1).max(48).describe("Operation key declared in definition.operations."),
+            arguments: z.record(z.unknown()).describe("Example arguments matching the operation's closed input schema. Use non-sensitive examples; this is shape validation, not a live test.") },
+        path: `${API}/preview`, strictInput: true,
+        description: "Construct an API request shape offline. {{scope}} Requires a live account Admin. Returns origin, method, path template, query/header names, body byte count and authentication slot names; argument values and credentials are omitted. Saves nothing, resolves no DNS and sends no upstream request. This does not prove credentials or the destination work.",
+        annotations: READ_ONLY,
+    }),
+    defineTool({
+        name: "api_app_create", title: "Create API App", auth: "manager", method: "post",
+        schema: { name: z.string().trim().min(1).max(100).describe("App's display name within this account."), definition,
+            enabled: z.boolean().optional().describe("Defaults false. Enabling allows existing authorized bindings to execute; it does not publish a version or grant user/worker access.") },
+        path: `${API}/apps`, strictInput: true,
+        description: "Create an account-private API app draft; returns its app UUID and revision. {{scope}} Requires a live account Admin. Validate first with api_app_validate. No upstream request, connection or worker grant is created. Publish the saved draft with api_app_publish before configuring a connection and binding in the dashboard. Limited to 25 apps/account. After a lost response inspect api_apps_list before creating again; creation is not idempotent.",
+        annotations: CREATE,
+    }),
+    defineTool({
+        name: "api_app_update", title: "Update API App", auth: "manager", method: "put",
+        schema: { appId, revision, name: z.string().trim().min(1).max(100).describe("Replacement display name."), definition,
+            enabled: z.boolean().describe("Explicit app state. false immediately blocks new dispatches for every version; true still requires current grants, bindings, connections and policy.") },
+        path, strictInput: true,
+        bodyBuilder: ({ appId: _appId, ...body }) => body,
+        description: "Replace an app's saved draft, name and enabled state using its current revision. {{scope}} Requires a live account Admin. Returns a new revision. Published definitions remain immutable and workers keep their pinned versions; use api_app_publish for a new version. A 409 revision_conflict requires reviewing the latest draft. Do not blindly retry a lost update with a newer revision.",
+        annotations: UPDATE,
+    }),
+    defineTool({
+        name: "api_app_publish", title: "Publish API App Version", auth: "manager", method: "post", schema: { appId, revision },
+        path: params => `${path(params)}/versions`, bodyBuilder: ({ revision }) => ({ revision }), strictInput: true,
+        description: "Publish the saved API app draft as an immutable version in this account; returns id, number, contentHash and appRevision. {{scope}} Requires a live account Admin. Uses the reviewed draft revision, creates no public listing and never upgrades worker bindings. Publication does not enable the app. A 409 means re-read the app; after a lost response inspect its versions before publishing again. Use appRevision for the next app edit or publication.",
+        annotations: CREATE,
+    }),
+    defineTool({
+        name: "api_app_version_get", title: "Get API App Version", auth: "manager", method: "get", schema: { appId, versionId },
+        path: versionPath, paramFilter: () => ({}), strictInput: true,
+        description: "Read one immutable API app definition, content hash, authentication-profile fingerprint and revoked state. {{scope}} Requires a live account Admin. No credential values are returned. Connections must match the version's origin and authentication profile; the worker's binding separately selects a finite operation list and fixed inputs. Revoked versions cannot execute.",
+        annotations: READ_ONLY,
+    }),
+    defineTool({
+        name: "api_app_version_revoke", title: "Revoke API App Version", auth: "manager", method: "delete", schema: { appId, versionId },
+        path: versionPath, strictInput: true,
+        description: "Permanently revoke a published API app version. {{scope}} Requires a live account Admin. Immediately prevents new dispatches by all workers pinned to that version; already dispatched effects cannot be undone. It does not delete the definition, app or credentials. Publish a new version and review bindings to resume use; revocation cannot be reversed.",
+        annotations: DELETE,
+    }),
+];
+//# sourceMappingURL=api-apps.js.map

package/dist/descriptors/api-apps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-apps.js","sourceRoot":"","sources":["../../src/descriptors/api-apps.ts"],"names":[],"mappings":"AAAA,sGAAsG;AACtG,OAAO,EAAE,CAAC,EAAE,MAAM,WAAW,CAAC;AAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAuB,MAAM,YAAY,CAAC;AAEhG,MAAM,GAAG,GAAG,wBAAwB,CAAC;AACrC,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,6HAA6H,CAAC,CAAC;AACxK,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,6DAA6D,CAAC,CAAC;AAC5G,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,oOAAoO,CAAC,CAAC;AAClR,MAAM,UAAU,GAAG,y8BAAy8B,CAAC;AAC79B,MAAM,CAAC,MAAM,oBAAoB,GAAG,UAAU,CAAC;AAC/C,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,uCAAuC,CAAC;IAC7E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,oJAAoJ,CAAC;IACjM,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;CAC/E,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,kMAAkM,CAAC,CAAC;AACzN,MAAM,IAAI,GAAG,CAAC,MAA+B,EAAE,EAAE,CAAC,GAAG,GAAG,SAAS,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;AAC5G,MAAM,WAAW,GAAG,CAAC,MAA+B,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;AAEpI,MAAM,CAAC,MAAM,iBAAiB,GAA8B;IAC1D,UAAU,CAAC;QACT,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,GAAG,OAAO;QAC9G,WAAW,EAAE,moBAAmoB;QAChpB,WAAW,EAAE,SAAS;KACvB,CAAC;IACF,UAAU,CAAC;QACT,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI;QAClG,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI;QAC1C,WAAW,EAAE,oXAAoX;QACjY,WAAW,EAAE,SAAS;KACvB,CAAC;IACF,UAAU,CAAC;QACT,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,GAAG,GAAG,WAAW;QACrI,WAAW,EAAE,IAAI;QACjB,WAAW,EAAE,0XAA0X;QACvY,WAAW,EAAE,SAAS;KACvB,CAAC;IACF,UAAU,CAAC;QACT,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,qBAAqB,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM;QACtF,MAAM,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,kDAAkD,CAAC;YACrH,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,wIAAwI,CAAC,EAAE;QACvL,IAAI,EAAE,GAAG,GAAG,UAAU,EAAE,WAAW,EAAE,IAAI;QACzC,WAAW,EAAE,gWAAgW;QAC7W,WAAW,EAAE,SAAS;KACvB,CAAC;IACF,UAAU,CAAC;QACT,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM;QAChF,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,yCAAyC,CAAC,EAAE,UAAU;YAC/G,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qIAAqI,CAAC,EAAE;QACnL,IAAI,EAAE,GAAG,GAAG,OAAO,EAAE,WAAW,EAAE,IAAI;QACtC,WAAW,EAAE,8bAA8b;QAC3c,WAAW,EAAE,MAAM;KACpB,CAAC;IACF,UAAU,CAAC;QACT,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK;QAC/E,MAAM,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,2BAA2B,CAAC,EAAE,UAAU;YAClH,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,sJAAsJ,CAAC,EAAE;QACzL,IAAI,EAAE,WAAW,EAAE,IAAI;QACvB,WAAW,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI;QACjD,WAAW,EAAE,gYAAgY;QAC7Y,WAAW,EAAE,MAAM;KACpB,CAAC;IACF,UAAU,CAAC;QACT,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,yBAAyB,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE;QACvH,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,WAAW,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI;QAC5G,WAAW,EAAE,gcAAgc;QAC7c,WAAW,EAAE,MAAM;KACpB,CAAC;IACF,UAAU,CAAC;QACT,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,qBAAqB,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE;QACvH,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI;QAC7D,WAAW,EAAE,mXAAmX;QAChY,WAAW,EAAE,SAAS;KACvB,CAAC;IACF,UAAU,CAAC;QACT,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,wBAAwB,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE;QAChI,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,IAAI;QACpC,WAAW,EAAE,iWAAiW;QAC9W,WAAW,EAAE,MAAM;KACpB,CAAC;CACH,CAAC","sourcesContent":["// Generated from the backend agent contract. Edit the backend source and re-import; do not edit here.\nimport { z } from \"../zod.js\";\nimport { CREATE, DELETE, READ_ONLY, UPDATE, defineTool, type ToolDescriptor } from \"./types.js\";\n\nconst API = \"/api/manage/custom-api\";\nconst appId = z.string().uuid().describe(\"Account-owned app UUID from api_apps_list or api_app_create. Another account's app is indistinguishable from a missing app.\");\nconst versionId = z.string().uuid().describe(\"Immutable version UUID from api_app_get or api_app_publish.\");\nconst revision = z.string().uuid().describe(\"Current revision from api_app_get, api_app_create or api_app_update. After publishing use appRevision from that response. A 409 requires re-reading and reviewing the draft; never overwrite using a newer revision automatically.\");\nconst operations = \"Named operations. Each declares key, description, effect, method (GET/HEAD/POST/PUT/PATCH/DELETE), fixed path, inputs, and responseFields (output name to JSON Pointer), or emptyResponse:true. inputs is a closed object schema with properties, additionalProperties:false and optional required; supported types: object/array/string/integer/number/boolean, bounded enum/const and type-appropriate bounds. pathInputs/query/headers map names to {input:field} or {literal:value}; each declared top-level input maps once. body uses those leaves in a JSON object. Path placeholders occupy whole segments. authentication is {kind:none}, {kind:bearer,secretSlot}, {kind:basic,usernameSlot,passwordSlot}, or {kind:apiKey,headers:{name:slot},query:{name:slot}}. Store slot names only, never credentials. successStatuses contains declared 2xx codes. The backend rejects unknown fields, unsafe mappings and unsupported schema features; api_app_validate reports errors before saving.\";\nexport const apiAppOperationsText = operations;\nconst definition = z.object({\n  schemaVersion: z.literal(1).describe(\"Definition format version; must be 1.\"),\n  origin: z.string().url().max(2048).describe(\"One public HTTPS origin on port 443 without a path, query, credentials or fragment. Private networks and WorkerKit control-plane hosts are denied.\"),\n  operations: z.array(z.record(z.unknown())).min(1).max(40).describe(operations),\n}).strict().describe(\"Structured API definition, at most 128 KiB. No scripts, OpenAPI imports, executable templates or credentials. Validate before saving; preview only constructs a request shape and sends nothing.\");\nconst path = (params: Record<string, unknown>) => `${API}/apps/${encodeURIComponent(String(params.appId))}`;\nconst versionPath = (params: Record<string, unknown>) => `${path(params)}/versions/${encodeURIComponent(String(params.versionId))}`;\n\nexport const apiAppDescriptors: readonly ToolDescriptor[] = [\n  defineTool({\n    name: \"api_apps_list\", title: \"List API Apps\", auth: \"manager\", method: \"get\", schema: {}, path: `${API}/apps`,\n    description: \"List this account's API apps: id, name, enabled, optimistic revision and liveVersionNumber (the newest unrevoked version; null if none). connectionCount, usableConnectionCount (enabled and authorized for the live version) and stoppedWorkerCount (enabled worker bindings stopped by a revoked version or a disabled or unauthorized connection) require an account Admin credential with managePrivateApiApps; otherwise null means withheld, not zero. {{scope}} Admins see all apps; members see only enabled apps explicitly granted to their current membership. Apps stay account-private. Use api_app_get for a saved draft and published version IDs.\",\n    annotations: READ_ONLY,\n  }),\n  defineTool({\n    name: \"api_app_get\", title: \"Get API App\", auth: \"manager\", method: \"get\", schema: { appId }, path,\n    paramFilter: () => ({}), strictInput: true,\n    description: \"Read app metadata, current revision and published version IDs/hashes/revocation state. {{scope}} The draft additionally requires an account Admin credential with managePrivateApiApps; otherwise draft:null means withheld. No credentials are returned. Existing workers keep their pinned versions when the draft changes. Use api_app_version_get for an immutable definition.\",\n    annotations: READ_ONLY,\n  }),\n  defineTool({\n    name: \"api_app_validate\", title: \"Validate API App\", auth: \"manager\", method: \"post\", schema: { definition }, path: `${API}/validate`,\n    strictInput: true,\n    description: \"Validate an API app definition offline and return its normalized definition and content hash. {{scope}} Requires a live account Admin. Saves nothing and sends no upstream request. Correct validation errors before api_app_create or api_app_update. A definition grants no worker access by itself; connections and exact worker bindings are configured separately on the dashboard.\",\n    annotations: READ_ONLY,\n  }),\n  defineTool({\n    name: \"api_app_preview\", title: \"Preview API Request\", auth: \"manager\", method: \"post\",\n    schema: { definition, operation: z.string().min(1).max(48).describe(\"Operation key declared in definition.operations.\"),\n      arguments: z.record(z.unknown()).describe(\"Example arguments matching the operation's closed input schema. Use non-sensitive examples; this is shape validation, not a live test.\") },\n    path: `${API}/preview`, strictInput: true,\n    description: \"Construct an API request shape offline. {{scope}} Requires a live account Admin. Returns origin, method, path template, query/header names, body byte count and authentication slot names; argument values and credentials are omitted. Saves nothing, resolves no DNS and sends no upstream request. This does not prove credentials or the destination work.\",\n    annotations: READ_ONLY,\n  }),\n  defineTool({\n    name: \"api_app_create\", title: \"Create API App\", auth: \"manager\", method: \"post\",\n    schema: { name: z.string().trim().min(1).max(100).describe(\"App's display name within this account.\"), definition,\n      enabled: z.boolean().optional().describe(\"Defaults false. Enabling allows existing authorized bindings to execute; it does not publish a version or grant user/worker access.\") },\n    path: `${API}/apps`, strictInput: true,\n    description: \"Create an account-private API app draft; returns its app UUID and revision. {{scope}} Requires a live account Admin. Validate first with api_app_validate. No upstream request, connection or worker grant is created. Publish the saved draft with api_app_publish before configuring a connection and binding in the dashboard. Limited to 25 apps/account. After a lost response inspect api_apps_list before creating again; creation is not idempotent.\",\n    annotations: CREATE,\n  }),\n  defineTool({\n    name: \"api_app_update\", title: \"Update API App\", auth: \"manager\", method: \"put\",\n    schema: { appId, revision, name: z.string().trim().min(1).max(100).describe(\"Replacement display name.\"), definition,\n      enabled: z.boolean().describe(\"Explicit app state. false immediately blocks new dispatches for every version; true still requires current grants, bindings, connections and policy.\") },\n    path, strictInput: true,\n    bodyBuilder: ({ appId: _appId, ...body }) => body,\n    description: \"Replace an app's saved draft, name and enabled state using its current revision. {{scope}} Requires a live account Admin. Returns a new revision. Published definitions remain immutable and workers keep their pinned versions; use api_app_publish for a new version. A 409 revision_conflict requires reviewing the latest draft. Do not blindly retry a lost update with a newer revision.\",\n    annotations: UPDATE,\n  }),\n  defineTool({\n    name: \"api_app_publish\", title: \"Publish API App Version\", auth: \"manager\", method: \"post\", schema: { appId, revision },\n    path: params => `${path(params)}/versions`, bodyBuilder: ({ revision }) => ({ revision }), strictInput: true,\n    description: \"Publish the saved API app draft as an immutable version in this account; returns id, number, contentHash and appRevision. {{scope}} Requires a live account Admin. Uses the reviewed draft revision, creates no public listing and never upgrades worker bindings. Publication does not enable the app. A 409 means re-read the app; after a lost response inspect its versions before publishing again. Use appRevision for the next app edit or publication.\",\n    annotations: CREATE,\n  }),\n  defineTool({\n    name: \"api_app_version_get\", title: \"Get API App Version\", auth: \"manager\", method: \"get\", schema: { appId, versionId },\n    path: versionPath, paramFilter: () => ({}), strictInput: true,\n    description: \"Read one immutable API app definition, content hash, authentication-profile fingerprint and revoked state. {{scope}} Requires a live account Admin. No credential values are returned. Connections must match the version's origin and authentication profile; the worker's binding separately selects a finite operation list and fixed inputs. Revoked versions cannot execute.\",\n    annotations: READ_ONLY,\n  }),\n  defineTool({\n    name: \"api_app_version_revoke\", title: \"Revoke API App Version\", auth: \"manager\", method: \"delete\", schema: { appId, versionId },\n    path: versionPath, strictInput: true,\n    description: \"Permanently revoke a published API app version. {{scope}} Requires a live account Admin. Immediately prevents new dispatches by all workers pinned to that version; already dispatched effects cannot be undone. It does not delete the definition, app or credentials. Publish a new version and review bindings to resume use; revocation cannot be reversed.\",\n    annotations: DELETE,\n  }),\n];\n"]}

package/dist/descriptors/index.d.ts

@@ -3,7 +3,7 @@ export type { HttpMethod, ToolAnnotations, ToolDescriptor } from "./types.js";
 export { manageDescriptors } from "./manage.js";
 export { directoryDescriptors, kitDetailData, kitDetailFooter, kitListData, listFooter, publisherPageData, publisherPageFooter, } from "./directory.js";
 import type { ToolDescriptor } from "./types.js";
-/** Every descriptor this package ships — 100 manager + 8 anonymous. */
+/** Every descriptor this package ships: the manager tools, then the anonymous directory tools. */
 export declare const allDescriptors: readonly ToolDescriptor[];
 /** Look a descriptor up by its tool name. */
 export declare function byName(name: string): ToolDescriptor | undefined;

package/dist/descriptors/index.js

@@ -4,7 +4,7 @@ export { manageDescriptors } from "./manage.js";
 export { directoryDescriptors, kitDetailData, kitDetailFooter, kitListData, listFooter, publisherPageData, publisherPageFooter, } from "./directory.js";
 import { manageDescriptors } from "./manage.js";
 import { directoryDescriptors } from "./directory.js";
-/** Every descriptor this package ships — 100 manager + 8 anonymous. */
+/** Every descriptor this package ships: the manager tools, then the anonymous directory tools. */
 export const allDescriptors = [
     ...manageDescriptors,
     ...directoryDescriptors,

package/dist/descriptors/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/descriptors/index.ts"],"names":[],"mappings":"AAAA,sGAAsG;AACtG,OAAO,EACL,MAAM,EACN,MAAM,EACN,SAAS,EACT,OAAO,EACP,MAAM,GACP,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,eAAe,EACf,WAAW,EACX,UAAU,EACV,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAEtD,uEAAuE;AACvE,MAAM,CAAC,MAAM,cAAc,GAA8B;IACvD,GAAG,iBAAiB;IACpB,GAAG,oBAAoB;CACxB,CAAC;AAEF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAEpE,6CAA6C;AAC7C,MAAM,UAAU,MAAM,CAAC,IAAY;IACjC,OAAO,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC","sourcesContent":["// Generated from the backend agent contract. Edit the backend source and re-import; do not edit here.\nexport {\n  CREATE,\n  DELETE,\n  READ_ONLY,\n  TRIGGER,\n  UPDATE,\n} from \"./types.js\";\nexport type { HttpMethod, ToolAnnotations, ToolDescriptor } from \"./types.js\";\n\nexport { manageDescriptors } from \"./manage.js\";\nexport {\n  directoryDescriptors,\n  kitDetailData,\n  kitDetailFooter,\n  kitListData,\n  listFooter,\n  publisherPageData,\n  publisherPageFooter,\n} from \"./directory.js\";\n\nimport type { ToolDescriptor } from \"./types.js\";\nimport { manageDescriptors } from \"./manage.js\";\nimport { directoryDescriptors } from \"./directory.js\";\n\n/** Every descriptor this package ships — 100 manager + 8 anonymous. */\nexport const allDescriptors: readonly ToolDescriptor[] = [\n  ...manageDescriptors,\n  ...directoryDescriptors,\n];\n\nconst byNameIndex = new Map(allDescriptors.map((d) => [d.name, d]));\n\n/** Look a descriptor up by its tool name. */\nexport function byName(name: string): ToolDescriptor | undefined {\n  return byNameIndex.get(name);\n}\n\nexport { toolDocumentation } from \"./types.js\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/descriptors/index.ts"],"names":[],"mappings":"AAAA,sGAAsG;AACtG,OAAO,EACL,MAAM,EACN,MAAM,EACN,SAAS,EACT,OAAO,EACP,MAAM,GACP,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,eAAe,EACf,WAAW,EACX,UAAU,EACV,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAEtD,kGAAkG;AAClG,MAAM,CAAC,MAAM,cAAc,GAA8B;IACvD,GAAG,iBAAiB;IACpB,GAAG,oBAAoB;CACxB,CAAC;AAEF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAEpE,6CAA6C;AAC7C,MAAM,UAAU,MAAM,CAAC,IAAY;IACjC,OAAO,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC","sourcesContent":["// Generated from the backend agent contract. Edit the backend source and re-import; do not edit here.\nexport {\n  CREATE,\n  DELETE,\n  READ_ONLY,\n  TRIGGER,\n  UPDATE,\n} from \"./types.js\";\nexport type { HttpMethod, ToolAnnotations, ToolDescriptor } from \"./types.js\";\n\nexport { manageDescriptors } from \"./manage.js\";\nexport {\n  directoryDescriptors,\n  kitDetailData,\n  kitDetailFooter,\n  kitListData,\n  listFooter,\n  publisherPageData,\n  publisherPageFooter,\n} from \"./directory.js\";\n\nimport type { ToolDescriptor } from \"./types.js\";\nimport { manageDescriptors } from \"./manage.js\";\nimport { directoryDescriptors } from \"./directory.js\";\n\n/** Every descriptor this package ships: the manager tools, then the anonymous directory tools. */\nexport const allDescriptors: readonly ToolDescriptor[] = [\n  ...manageDescriptors,\n  ...directoryDescriptors,\n];\n\nconst byNameIndex = new Map(allDescriptors.map((d) => [d.name, d]));\n\n/** Look a descriptor up by its tool name. */\nexport function byName(name: string): ToolDescriptor | undefined {\n  return byNameIndex.get(name);\n}\n\nexport { toolDocumentation } from \"./types.js\";\n"]}

package/dist/descriptors/manage.js

@@ -1,9 +1,10 @@
 // Generated from the backend agent contract. Edit the backend source and re-import; do not edit here.
-// The 100 authenticated fleet-management tools, as pure descriptors. The
+// The authenticated fleet-management tools, as pure descriptors. The
 // descriptions ARE the product surface: they are served verbatim to MCP
 // clients (and any future CLI help), so every contract nuance an agent must
 // not get wrong is taught here.
 import { actionDescriptors } from "./actions.js";
+import { apiAppDescriptors } from "./api-apps.js";
 import { appDiscoveryDescriptors } from "./app-discovery.js";
 import { compactDecisionReceipt } from "./decision-receipt.js";
 import { createDecisionWorker } from "./decision-authoring.js";
@@ -33,7 +34,7 @@ const HYBRID_NOTE = " Hybrid classifies a bounded window, then runs one language
 // Result interpretation is authored once and delivered with classified receipts.
 // REST and offline help retain it even when callers choose raw JSON.
 const CLASSIFIED_RESULT_DESCRIPTION = (DECISION_BLOCK_NOTE + HYBRID_NOTE).trim();
-const QUALITY_RESULT_DESCRIPTION = "qualityEvaluation separates worker-specific criteria from systemReview diagnostics. Unknown means unverified, not pass. A needs_attention system check includes a recommendation for owner review, not an applied fix. Neither layer replaces execution status or proves external effects.";
+const QUALITY_RESULT_DESCRIPTION = "qualityEvaluation separates worker criteria, code-computed executionChecks and model systemReview diagnostics. Unknown means unverified, not pass. Runtime/app failure counts may overlap; do not add them. Recovered attempts remain recorded without failing business acceptance. needs_attention includes a recommendation for owner review, not an applied fix. None proves external effects.";
 // Raw HTTP and CLI --json bodies remain unchanged; MCP/plain CLI render footers.
 function classifiedReceiptGuidance(data) {
     if (!data || typeof data !== "object" || Array.isArray(data))
@@ -105,7 +106,7 @@ const accountUsage = defineTool({
 const getWorker = defineTool({
     name: "worker_get",
     title: "Get Worker",
-    description: "Read worker detail, including all workers_list fields, timeZoneId, maxRunsPerDay, kit templateId/slug/name, hasInstruction, isProtected and jobSentence. {{scope}} readiness is ready|blocked with issues (worker_inactive, no_identity, app_not_connected with candidateProviders, no_instruction, action_connection_unavailable/action_tools_unavailable, worker_slots_pending when a required worker slot is unbound); canRun means hosted readiness, canInvoke means Action readiness. modelType: language runs prose on a model; decision runs a routing table (instruction_get/worker_run; decisionPendingSetup names unanswered setup); hybrid classifies then passes selected items to one language agent; none is Action (no model, deployment or run; worker_run/worker_deploy return 400 action_worker_requires_invoke; use worker_tools/worker_tool_call). apps[] lists enabled apps, providers and connected|needs_connection|unknown; fix needs_connection with app_connect on this worker's operator or dashboard. deployment has status/modelSlug; null means no hosted execution regardless of readiness (worker_deploy fixes it, except Action). Activity covers 30-day outcomes/success rate/cost; null when hosted runtime is disabled.",
+    description: "Read worker detail, including all workers_list fields, timeZoneId, maxRunsPerDay, kit templateId/slug/name, hasInstruction, isProtected and jobSentence. {{scope}} readiness is ready|blocked with issues (worker_inactive, no_identity, app_not_connected with candidateProviders, no_instruction, action_connection_unavailable/action_tools_unavailable, worker_slots_pending when a required worker slot is unbound: worker_bindings_set fills it); canRun means hosted readiness, canInvoke means Action readiness. modelType: language runs prose on a model; decision runs a routing table (instruction_get/worker_run; decisionPendingSetup names unanswered setup); hybrid classifies then passes selected items to one language agent; none is Action (no model, deployment or run; worker_run/worker_deploy return 400 action_worker_requires_invoke; use worker_tools/worker_tool_call). apps[] lists enabled apps, providers and connected|needs_connection|unknown; fix needs_connection with app_connect on this worker's operator or dashboard. deployment has status/modelSlug; null means no hosted execution regardless of readiness (worker_deploy fixes it, except Action). Activity covers 30-day outcomes/success rate/cost; null when hosted runtime is disabled.",
     auth: "manager",
     method: "get",
     schema: {
@@ -249,7 +250,7 @@ const getRun = defineTool({
     resultDescription: `${CLASSIFIED_RESULT_DESCRIPTION}\n\n${QUALITY_RESULT_DESCRIPTION}`,
     name: "run_get",
     title: "Get Run",
-    description: "Read a run receipt. includeContent:false returns metadata and bounded contentReferences without copying reports; resolve report/structured with run_get(includeContent:true), transcript with run_transcript, using the same runId and current readRuns/worker authority. References grant no access. Transcript expiry is enforced at read time; reports follow receipt retention and explicit clearing. digestStructured.result is an optional v1 JSON business result: data, evidence, unresolved, completeness and self-reported acceptance. validationError means its shape failed, independently of execution status; Succeeded can still have partial coverage or a rejected business result. " + guidance.spendCap + " Fields: initiator (immediate user/fleetKey/schedule/webhook/worker; historicalUnknown when unrecorded), origin (original run and initiator), relationship (questionContinuation or workerCall), workerCalls (bounded model/Action references, modelType, operation and statuses; runId for model children or actionInvocationId/actionTool for existing Action receipts; canReadReceipt reflects existing receipt authority), status, trigger, timings, token/cost metering, billingMode Platform|Byok, byokFeeUsd, finalDigest (worker report), runPrompt/runContext, in-flight liveness live|stalled/lastActivity, errorCode/errorDetail and issues. {{scope}} Fleet-key identity is a safe id/name/prefix snapshot at start, not a credential or proof of API/CLI/OAuth transport; requestedByUserId remains the accountable user. Continuations preserve origin and record the answering key as initiator. Worker calls identify the immediate caller run and original initiator; child runs have separate charges. A worker binding shares its bounded invocation result, not full receipt/transcript access. Configure grants in Apps and workers, or explicitly bind declared kit slots during an authorized kit_install; manager run permission alone does not grant binding authority. On BYOK, modelCostUsd is provider list price, not wallet charge. Parse footprint, turnsTimeline, issues and priceSnapshot: they are raw JSON strings. Grades: selfScore, selfScoreReason, ownerScore (set with run_score)." + SCORE_NOTE + " Decision/hybrid receipts include classification, source coverage and committed wallet cost. Hybrid runs are manual/on-demand only; never automatically repeat an uncertain write." + RUNTIME_NOTE,
+    description: "Read a run receipt. includeContent:false returns metadata and bounded contentReferences without copying reports; resolve report/structured with run_get(includeContent:true), transcript with run_transcript, using the same runId and current readRuns/worker authority. References grant no access. Transcript expiry is enforced at read time; reports follow receipt retention and explicit clearing. digestStructured.result is an optional v1 JSON business result: data, evidence, unresolved, completeness and self-reported acceptance. validationError means its shape failed, independently of execution status; Succeeded can still have partial coverage or a rejected business result. " + guidance.spendCap + " Fields: initiator (immediate user/fleetKey/schedule/webhook/worker; historicalUnknown when unrecorded), origin (original run and initiator), relationship (questionContinuation or workerCall), workerCalls (bounded model/Action references, modelType, operation and statuses; runId for model children or actionInvocationId/actionTool for existing Action receipts; canReadReceipt reflects existing receipt authority), status, trigger, timings, token/cost metering, billingMode Platform|Byok, byokFeeUsd, finalDigest (worker report), runPrompt/runContext, in-flight liveness live|stalled/lastActivity, errorCode/errorDetail and issues. {{scope}} Fleet-key identity is a safe id/name/prefix snapshot at start, not a credential or proof of API/CLI/OAuth transport; requestedByUserId remains the accountable user. Continuations preserve origin and record the answering key as initiator. Worker calls identify the immediate caller run and original initiator; child runs have separate charges. A worker binding shares its bounded invocation result, not full receipt/transcript access. Grants are set with worker_bindings_set (manageAppsAndWorkers) or kit_install.workerBindings (installKits); run permission alone grants none. On BYOK, modelCostUsd is provider list price, not wallet charge. Parse footprint, turnsTimeline, issues and priceSnapshot: they are raw JSON strings. Grades: selfScore, selfScoreReason, ownerScore (set with run_score)." + SCORE_NOTE + " Decision/hybrid receipts include classification, source coverage and committed wallet cost. Hybrid runs are manual/on-demand only; never automatically repeat an uncertain write." + RUNTIME_NOTE,
     auth: "manager",
     method: "get",
     schema: {
@@ -471,6 +472,7 @@ const SCHEDULE_OVERLAP_NOTE = " Schedules never overlap any in-flight run of the
 // schedule writes, so an agent fixing a report's times does not reach for the
 // schedule: that only moves when it fires.
 const SCHEDULE_ZONE_NOTE = " Schedule timeZoneId controls firing only; worker_timezone_set controls the worker's local dates and reports.";
+const SCHEDULE_DAYS_HINT = "DailyAtTime only: non-empty array of full English day names, e.g. ['Monday','Tuesday','Wednesday','Thursday','Friday']. Names are case-insensitive; duplicates collapse. Days follow the schedule's effective timezone. Restricted-day occurrences missed past their local firing date expire without a run; manual runs are unaffected.";
 const createSchedule = defineTool({
     name: "schedule_create",
     title: "Create Schedule",
@@ -488,6 +490,7 @@ const createSchedule = defineTool({
         intervalValue: z.number().int().min(1).optional().describe("EveryNMinutes: 1–1440. EveryNHours: 1–168. Required for those types, ignored otherwise."),
         timeOfDayMinutes: z.number().int().min(0).max(1439).optional().describe("DailyAtTime only: wall-clock minutes past midnight in the effective time zone (e.g. 540 = 09:00). DST-correct."),
         timeZoneId: z.string().optional().describe("IANA time zone (e.g. 'America/New_York') overriding the worker's zone. Omit to follow the worker."),
+        daysOfWeek: z.array(z.string()).min(1).nullable().optional().describe(SCHEDULE_DAYS_HINT + " Omit or send null for every day. Rejected on other schedule types."),
         anchorUtc: z.string().optional().describe(`OneShot only: when to fire, must be in the future. ${UTC_HINT}`),
         isEnabled: z.boolean().default(true).describe("Whether the schedule starts enabled."),
     },
@@ -498,6 +501,7 @@ const createSchedule = defineTool({
         intervalValue: params.intervalValue,
         timeOfDayMinutes: params.timeOfDayMinutes,
         timeZoneId: params.timeZoneId,
+        daysOfWeek: params.daysOfWeek,
         anchorUtc: params.anchorUtc,
         isEnabled: params.isEnabled,
     }),
@@ -519,6 +523,7 @@ const updateSchedule = defineTool({
         intervalValue: z.number().int().min(1).optional().describe("New interval (see type rules)."),
         timeOfDayMinutes: z.number().int().min(0).max(1439).optional().describe("DailyAtTime: new wall-clock minutes past midnight."),
         timeZoneId: z.string().optional().describe("IANA zone override; empty string '' clears it (follow the worker)."),
+        daysOfWeek: z.array(z.string()).min(1).nullable().optional().describe(SCHEDULE_DAYS_HINT + " Omit/null to keep current days; send all seven to restore every day. Rejected if the resulting type is not DailyAtTime; changing away from daily clears the restriction."),
         anchorUtc: z.string().optional().describe(`OneShot: new fire time. ${UTC_HINT}`),
         isEnabled: z.boolean().optional().describe("Enable or disable the schedule."),
     },
@@ -529,6 +534,7 @@ const updateSchedule = defineTool({
         intervalValue: params.intervalValue,
         timeOfDayMinutes: params.timeOfDayMinutes,
         timeZoneId: params.timeZoneId,
+        daysOfWeek: params.daysOfWeek,
         anchorUtc: params.anchorUtc,
         isEnabled: params.isEnabled,
     }),
@@ -851,7 +857,7 @@ const GITHUB_SELECTION = z.object({
 const kitInstallPreview = defineTool({
     name: "kit_install_preview",
     title: "Preview Kit Install",
-    description: "Preview the install form and account readiness; creates nothing. Call before kit_install and collect required answers. {{scope}} requiredInputs: EVERY exact key needs a human-supplied value. memorySetup: only required:true answers are mandatory. modelType language|decision|hybrid|none; decisionNarration explains classification, which acts from the first run without a chosen language model. Answer decisionSetup by key in decisionAnswers: required questions without defaults are mandatory, except appPick can wait for instruction_set. Action: actionSpec lists tools, no model/deployment; actionConnections lists Slack bots to pin via slackConnectionId. workerSlots lists the workers this kit calls (alias, modelType, operations, required): fill them with installed workers in kit_install.workerBindings, or later in Apps and workers. Choose ONE member/categorySlot in categoryChoices, preferably connected; connectionProvider requires matching operatorResources.resourceId, preferably hasActiveConnection. apps/appsNeedingConnection predict initial connections; install may proceed blocked, with human setup at connectAppsUrl. githubAccounts.id is connectionId; githubSetup provides requiredScope, discovery tools and explicitSelectionRequired: discover repos/branches, then supply githubSelection selected IDs or accounts:[] to defer. operator identifies target; limits shows currentWorkers/maxWorkers (cap causes 402); kitPageUrl is the human install page. Advisory only: installed readiness is authoritative. kit_get supplies full permissions/instruction. evaluationSpec contains public criteria copied at install; all three quality/learning gates stay off. Review worker_quality_get after install.",
+    description: "Preview the install form and account readiness; creates nothing. Call before kit_install and collect required answers. {{scope}} requiredInputs: EVERY exact key needs a human-supplied value. memorySetup: only required:true answers are mandatory. modelType language|decision|hybrid|none; decisionNarration explains classification, which acts from the first run without a chosen language model. Answer decisionSetup by key in decisionAnswers: required questions without defaults are mandatory, except appPick can wait for instruction_set. Action: actionSpec lists tools, no model/deployment; actionConnections lists Slack bots to pin via slackConnectionId. workerSlots lists the workers this kit calls (alias, modelType, operations, required): fill them with installed workers in kit_install.workerBindings, or later with worker_bindings_set. Choose ONE member/categorySlot in categoryChoices, preferably connected; connectionProvider requires matching operatorResources.resourceId, preferably hasActiveConnection. apps/appsNeedingConnection predict initial connections; install may proceed blocked, with human setup at connectAppsUrl. githubAccounts.id is connectionId; githubSetup provides requiredScope, discovery tools and explicitSelectionRequired: discover repos/branches, then supply githubSelection selected IDs or accounts:[] to defer. operator identifies target; limits shows currentWorkers/maxWorkers (cap causes 402); kitPageUrl is the human install page. Advisory only: installed readiness is authoritative. kit_get supplies full permissions/instruction. evaluationSpec contains public criteria copied at install; all three quality/learning gates stay off. Review worker_quality_get after install.",
     auth: "manager",
     method: "get",
     schema: {
@@ -868,7 +874,7 @@ const kitInstallPreview = defineTool({
 const kitInstall = defineTool({
     name: "kit_install",
     title: "Install Kit",
-    description: "Install a kit as a NEW worker. {{scope}} NOT idempotent: every success creates another; never retry success. After timeout, inspect workers_list (readWorkers) first. Preview first: supply every requiredInputs key in inputs (missing/unknown key: 400), required memoryAnswers, decisionAnswers and one categoryChoices entry/slot; connectionProvider also needs resourceId from operatorResources. Secrets shown ONCE: install.rawKey (worker pe_ key) and install.triggers[].signingSecret; give them to the human before discarding. Return workerUrl to the human. readiness ready|blocked includes actionable issues (app_not_connected/candidateProviders); null means the install SUCCEEDED but readiness check failed: worker_get, never reinstall. connectAppsUrl is human setup. 402 limit_exceeded is terminal: upgrade or, with human agreement, worker_delete (permanent; deleteWorkers). Rate: 10 installs/hour/account. Install never runs; without deployment no schedule fires and worker_run returns not_deployed. deploy:true optionally takes deployment(modelSlug from models_list, ceilings) ; missing deployment scope is 403 before creation. Omit deploy to install only, then seek authorized scope review before worker_deploy. Post-install deploy failure still returns 201/deploymentError: worker exists; fix and worker_deploy, never reinstall. Action(modelType none): omit deploy; worker_tools then worker_tool_call. Worker-slot kits (preview lists workerSlots): workerBindings maps each alias to an installed worker, which returns bounded results to the new worker. Install succeeds without bindings, but an unbound required slot reports readiness issue worker_slots_pending and runs are Skipped until it is bound in Apps and workers. Kit criteria copy with all three quality/learning gates off; review worker_quality_get afterwards. Install has no learning-consent options.",
+    description: "Install a kit as a NEW worker. {{scope}} NOT idempotent: every success creates another; never retry success. After timeout, inspect workers_list (readWorkers) first. Preview first: supply every requiredInputs key in inputs (missing/unknown key: 400), required memoryAnswers, decisionAnswers and one categoryChoices entry/slot; connectionProvider also needs resourceId from operatorResources. Install returns no worker API secret. Secret shown ONCE: install.triggers[].signingSecret; give it to the human before discarding. Return workerUrl to the human. readiness ready|blocked includes actionable issues (app_not_connected/candidateProviders); null means the install SUCCEEDED but readiness check failed: worker_get, never reinstall. connectAppsUrl is human setup. 402 limit_exceeded is terminal: upgrade or, with human agreement, worker_delete (permanent; deleteWorkers). Rate: 10 installs/hour/account. Install never runs; without deployment no schedule fires and worker_run returns not_deployed. deploy:true optionally takes deployment(modelSlug from models_list, ceilings) ; missing deployment scope is 403 before creation. Omit deploy to install only, then seek authorized scope review before worker_deploy. Post-install deploy failure still returns 201/deploymentError: worker exists; fix and worker_deploy, never reinstall. Action(modelType none): omit deploy; worker_tools then worker_tool_call. Worker-slot kits (preview lists workerSlots): workerBindings maps each alias to an installed worker, which returns bounded results to the new worker. Install succeeds without bindings, but an unbound required slot reports readiness issue worker_slots_pending and runs are Skipped until worker_bindings_set fills it. Kit criteria copy with all three quality/learning gates off; review worker_quality_get afterwards. Install has no learning-consent options.",
     auth: "manager",
     method: "post",
     schema: {
@@ -879,7 +885,7 @@ const kitInstall = defineTool({
         timeZoneId: z.string().trim().min(1).max(64).optional().describe("IANA timezone for local dates/reports, set before kit schedules. Ask the worker creator if unknown; never infer from calendars/server clock. Omitted means UTC. Response install.effectiveTimeZoneId confirms the applied zone."),
         slackConnectionId: z.number().int().positive().optional().describe("Action kits: pin a Slack bot from actionConnections in the install preview. A sole usable connection can be selected automatically; choose explicitly when several exist. No model/deployment."),
         githubSelection: GITHUB_SELECTION.optional().describe("GitHub targets from app_github_accounts/repos/branches (discoverAppResources); preview githubAccounts[].id is connectionId. For specific jobs use selected with 1-500 stable repositoryIds. all includes future granted repos: choose only intentionally. accounts:[] defers setup. Required on GitHub kits for keys with discoverAppResources; legacy keys keep single-account fallback. Discovery/branch inputs grant no access. These owner selections never enter a published kit manifest."),
-        workerBindings: z.record(z.string().regex(/^[a-z][a-z0-9_]{0,19}$/), z.string().uuid()).optional().describe("Map of worker-slot alias (kit_install_preview.workerSlots) to the UUID of the installed worker that fills it. The target must be in the same account and within the caller's current owner/Admin authority and fleet-key selection; its modelType, operations and pinned contracts must match the slot. A binding shares the target's bounded results, never its private receipts. Omit to bind later in Apps and workers; an unbound required slot blocks runs. Unknown alias or refused binding: 400."),
+        workerBindings: z.record(z.string().regex(/^[a-z][a-z0-9_]{0,19}$/), z.string().uuid()).optional().describe("Map of worker-slot alias (kit_install_preview.workerSlots) to the UUID of the installed worker that fills it. The target must be in the same account and within the caller's current owner/Admin authority and fleet-key selection; its modelType, operations and pinned contracts must match the slot. A binding shares the target's bounded results, never its private receipts. Omit to bind later with worker_bindings_set; an unbound required slot blocks runs. Unknown alias or refused binding: 400."),
         categoryChoices: z.array(z.object({
             categoryCode: z.string().describe("The slot's categoryCode from the preview."),
             memberCode: z.string().describe("Member code (e.g. 'gmail'). Any member of the slot's category is accepted; one outside the author's shortlist uses an existing kit block for that app, otherwise safe defaults. Unknown category member:400."),
@@ -1179,11 +1185,14 @@ const undeployWorker = defineTool({
     successMessage: "Worker undeployed. It still exists and keeps its instruction, memory and schedules; deploy it again with worker_deploy to make it run.",
     annotations: DELETE,
 });
-// ─── Permissions (read-only) ────────────────────────────────────────────────
+// ─── Permissions and worker grants ──────────────────────────────────────────
+// The two halves of the dashboard's Apps and workers drawer. Reads ride readWorkers;
+// the writes ride manageAppsAndWorkers (install-time workerBindings stay on installKits).
+// Rules, identities and MCP tool bindings stay on the dashboard.
 const getWorkerPermissions = defineTool({
     name: "worker_permissions_get",
     title: "Get Worker Permissions",
-    description: "Read exact worker access in kit-authoring vocabulary: app operations/fields/providers/stances, category slots, contact/timeframe/child limits and ruleCounts. {{scope}} ruleCounts reveals presence only, never rule values. No tool here edits grants: ask the human to change Apps and workers in the dashboard, then reread to verify; alternatively create different permissions via private kit_publish then kit_install. worker_clone preserves source rules; kit_publish(sourceWorkerId) does not, so kit installs can be MORE permissive than a source with rules.",
+    description: "Read exact worker access in kit-authoring vocabulary: app operations/fields/providers/stances, category slots, contact/timeframe/child limits and ruleCounts. {{scope}} ruleCounts reveals presence only, never rule values. Edit and write back with worker_permissions_set (account Admin), or create different permissions via private kit_publish then kit_install. worker_clone preserves source rules; kit_publish(sourceWorkerId) does not, so kit installs can be MORE permissive than a source with rules.",
     auth: "manager",
     method: "get",
     schema: {
@@ -1193,6 +1202,67 @@ const getWorkerPermissions = defineTool({
     paramFilter: () => ({}),
     annotations: READ_ONLY,
 });
+const setWorkerPermissions = defineTool({
+    name: "worker_permissions_set",
+    title: "Set Worker Permissions",
+    description: "Replace what the worker may touch, in the shape worker_permissions_get returns: apps is the whole app set, so an app left out is switched OFF. {{scope}} Account Admin only. An omitted axis keeps the worker's last saved value, so send every axis you mean. The stance changes only when sent: a deny-by-default app switched on here reads nothing until the owner writes rules or you send allowAll:true, and an existing allowAll is never flipped by omission. Rules, identities and MCP tool bindings stay on the dashboard. A scalar left out is unchanged; -1 clears a timeframe. 400 names the refusal: an Action worker, an unknown app or key, a Member-owned worker given an unsupported app, or a classifier losing a tool. Returns the effective permissions; confirm with the human before widening access." + NEW_SCOPE_NOTE,
+    auth: "manager",
+    method: "put",
+    schema: {
+        tokenId: z.number().int().min(1).describe(TOKEN_ID_HINT),
+        apps: z.array(z.record(z.unknown())).describe("One entry per app, the kit content.apps[] shape: code (kit_vocabulary) plus optional operations, visibleFields, allowAll, writeEnabled, providers, channels, writableFields, readOperations, masterAccessLevel, objectTypes, scopePolicy, contentTypeScopes, includeSpamFolders, pastDays, capabilities. Unknown app codes or vocabulary keys: 400. search_emails implies view_email and view_thread. github switched on here admits no repository until a human selects them in the dashboard."),
+        contactAllowAll: z.boolean().optional().describe("Contact stance: true reads every sender except what contact rules block, false only what they allow. Omit to keep."),
+        blockedSenderCategories: z.array(z.string()).optional().describe("financial|healthcare|government|insurance|hr_payroll; [] blocks none. Omit to keep."),
+        timeframePastDays: z.number().int().min(-1).max(3650).optional().describe("Read window into the past, in days; -1 clears it. Omit to keep."),
+        timeframeFutureDays: z.number().int().min(-1).max(3650).optional().describe("Read window into the future, in days; -1 clears it. Omit to keep."),
+        maxChildTokens: z.number().int().min(0).optional().describe("Legacy spawned sub-worker budget; 0 = none. Omit to keep."),
+    },
+    path: (params) => `${API}/${params.tokenId}/permissions`,
+    bodyBuilder: (params) => ({
+        apps: params.apps,
+        contactAllowAll: params.contactAllowAll,
+        blockedSenderCategories: params.blockedSenderCategories,
+        timeframePastDays: params.timeframePastDays,
+        timeframeFutureDays: params.timeframeFutureDays,
+        maxChildTokens: params.maxChildTokens,
+    }),
+    annotations: UPDATE,
+});
+const getWorkerBindings = defineTool({
+    name: "worker_bindings_get",
+    title: "Get Worker Bindings",
+    description: "Read a worker's grants to call other workers: bindings[] (alias, target workerId and title, operations bits, revision, available), slots[] its kit declares, missingSlots[] (required slots that keep runs Skipped) and targets[] it may bind: same-account deployed Language, Decision or Hybrid workers and Action workers with tools, narrowed by search. {{scope}} Member keys see their own workers. Fill, re-point or clear an alias with worker_bindings_set.",
+    auth: "manager",
+    method: "get",
+    schema: {
+        tokenId: z.number().int().min(1).describe(TOKEN_ID_HINT),
+        search: z.string().max(100).optional().describe("Case-insensitive title filter for targets; at most 50 are listed."),
+    },
+    path: (params) => `${API}/${params.tokenId}/worker-bindings`,
+    paramFilter: (params) => {
+        const { tokenId: _tokenId, ...query } = params;
+        return query;
+    },
+    annotations: READ_ONLY,
+});
+const setWorkerBindings = defineTool({
+    name: "worker_bindings_set",
+    title: "Set Worker Bindings",
+    description: "Fill, re-point or clear a worker's grants by alias, atomically; aliases not named are untouched. {{scope}} A declared kit slot takes the slot's operations and tools when they are omitted; a free alias needs operations, and an Action target needs actionTools. One worker fills one alias per caller: clear the old alias first, or swap both in one call. An unchanged live grant is left alone; a stale one is refreshed. Member keys bind their own workers to their own workers. 400 names the refusal. Returns worker_bindings_get." + NEW_SCOPE_NOTE,
+    auth: "manager",
+    method: "patch",
+    schema: {
+        tokenId: z.number().int().min(1).describe(TOKEN_ID_HINT),
+        workerBindings: z.record(z.string().regex(/^[a-z][a-z0-9_]{0,19}$/), z.object({
+            workerId: z.string().uuid().describe("The worker that fills the alias (workers_list workerId): this account, within this key's reach."),
+            operations: z.number().int().min(1).max(15).optional().describe("Bits: 1 trigger, 2 trigger with prompt, 4 call tool (Action targets, alone), 8 trigger with typed input. Omit on a declared slot to take the slot's."),
+            actionTools: z.array(z.string().min(1).max(128)).min(1).max(8).optional().describe("Action targets: 1-8 of the target's saved tool refs from worker_tools. Omit on a declared slot to take the slot's."),
+        }).strict().nullable()).describe("Alias to choice, or null to clear the alias. 1-10 aliases per call."),
+    },
+    path: (params) => `${API}/${params.tokenId}/worker-bindings`,
+    bodyBuilder: (params) => ({ workerBindings: params.workerBindings }),
+    annotations: UPDATE,
+});
 // ─── Kits (authoring) ───────────────────────────────────────────────────────
 //
 // The publishKits lane. A PRIVATE kit installed with kit_install is the kit route
@@ -1627,6 +1697,7 @@ const deleteMcpServer = defineTool({
 });
 // ─── Export ─────────────────────────────────────────────────────────────────
 export const manageDescriptors = [
+    ...apiAppDescriptors,
     ...qualityDescriptors,
     ...appDiscoveryDescriptors,
     ...onboardingDescriptors,
@@ -1684,6 +1755,9 @@ export const manageDescriptors = [
     getFleetBudget,
     setFleetBudget,
     getWorkerPermissions,
+    setWorkerPermissions,
+    getWorkerBindings,
+    setWorkerBindings,
     listModels,
     listDeployments,
     getDeployment,