conduyt-mcp 4.101.0 → 4.103.0

package/README.md

@@ -2,7 +2,7 @@
 
 MCP server for [Conduyt CRM](https://conduyt.app) — expose your CRM as AI-accessible tools. Covers the core CRM surface (contacts, deals, pipelines, custom fields, automations, messaging, and more); use `conduyt_api_catalog` to discover the full set of 600+ REST endpoints.
 
-## 299 Tools
+## 373 Tools
 
 ### Discovery
 | Tool | Description |
@@ -14,7 +14,8 @@ MCP server for [Conduyt CRM](https://conduyt.app) — expose your CRM as AI-acce
 ### Contacts
 | Tool | Description |
 |------|-------------|
-| `conduyt_list_contacts` | List and search contacts with filters (search, exact `email`, `tag` names, `tagId` uuids: ANY-of, repeatable up to 20, `meta.total` counts the filtered set) |
+| `conduyt_list_contacts` | List and search contacts with filters (search, exact `email`, `tag` names, `tagId` uuids: ANY-of, repeatable up to 20). `meta.total` can be null with `meta.total_deferred` true; `meta.has_more` is always exact |
+| `conduyt_count_contacts` | The exact total of a contacts list filter (`GET /contacts/count`, the filters shared with the list, not the list-only deal-context filters: with those, page with `meta.has_more` instead; read scope): `{ total, age_ms?, total_capped?, pending?, timed_out? }`; `pending` = ask again in a few seconds, `timed_out` = narrow the filter |
 | `conduyt_get_contact` | Get full contact details with timeline; `hasOutboundSms` = the workspace has ever provably texted the contact; `hasOutboundEmail` = the same for email; `duplicateProposals` and `heldIdentifiers` = the open possible-duplicate lines and held identifiers |
 | `conduyt_create_contact` | Create a new contact (a 409 with `existingId`, `rule`, `ruleVersion`, `matchedOn`, `reason` means the identity policy identified the incoming person with that record: confirm the identity (name, company) before updating it, a shared phone or email is not proof, and the server creates (with a passive duplicate proposal) a different person on a shared identifier; 409 `identifier_changed` / `owner_busy` and 503 `IDENTITY_INDEX_NOT_READY` are retryable, nothing written; with `callId`: the lead for a contact-less inbound call, linked in the same transaction; the server derives source "Inbound Call" and the owner) |
 | `conduyt_update_contact` | Update contact fields (incl. `assignedTo`; `keepPreviousOwnerAsCollaborator: true` with a reassignment keeps the previous owner as a read-only collaborator instead of releasing them, 400 without `assignedTo`); optional `expectedRevision` (0..2147483647) refuses a stale save with 409 `contact_changed` (code + current revision in the error) |
@@ -37,6 +38,7 @@ MCP server for [Conduyt CRM](https://conduyt.app) — expose your CRM as AI-acce
 | `conduyt_get_calling_hours` / `conduyt_update_calling_hours` | Read the window the dialer enforces (`effectiveCallingWindow`: `source`, `enabled`, `start`/`end` HH:MM, `timezone` or null = contact zone, then number area code, then account) / set `settings.callingWindow` (`enabled`, `start`, `end` always sent, `end` after `start`, `timezone` trimmed and recognised by the API (omit keeps the stored zone, null clears it); `enabled: false` needs `acknowledgeAnyHour: true`, else 400 `calling_hours_acknowledgement_required`) |
 | `conduyt_list_email_opt_outs` / `conduyt_add_email_opt_out` / `conduyt_resubscribe_email_opt_out` | The email opt-out list (owner / admin key; hash-only rows `{ id, source, reason, createdAt }`): list (`page`, `perPage` 1-100), add an address by hand (`reason` 1-200 required; 201 new row, 200 when an unsubscribe-link or Mailchimp row is promoted to manual, 409 with the existing row when already listed by hand) and take an address off (`{ removed }`) |
 | `conduyt_get_my_profile` | Read the caller's own identity (`GET /users/me`, same as `/auth/me`): `data.user` incl. `ringtone` (the incoming-ring slug, null = Conduyt Default), `data.account`, role, permissions, `apiKey`, `accounts`. Editing the profile is a signed-in person's action and is not exposed to API keys |
+| `conduyt_create_file_upload_intent` / `conduyt_finalize_file_upload` / `conduyt_create_chat_upload_intent` / `conduyt_finalize_chat_upload` / `conduyt_upload_local_file` / `conduyt_upload_chat_attachment` | Direct-to-storage uploads (#565): intent (`POST /files/upload/intent`, `POST /chat/channels/{id}/upload/intent`; `fileName`, `size`, optional `contentType`) returns a signed PUT URL, the bytes go straight to storage, finalize (`.../finalize`, `{ uploadId }`) settles it. CRM files up to 50 MB (key scope `files`), Team Chat attachments up to 10 MB (key scope `chat`). `conduyt_upload_local_file` / `conduyt_upload_chat_attachment` do all three steps for a local path and refuse an over-cap or empty file before any call (413 wording `File is too large (12 MB). Maximum allowed: 10 MB.`). Finalize refusals, verbatim: 400 `upload_id_required`, 404 `upload_not_found`, 409 `upload_incomplete` (bytes never PUT), 409 `upload_in_progress`, 413 `file_too_large`, 422 `upload_size_mismatch`, 400/415 `file_rejected`, 429, 503 `uploads_unavailable`; finalize allows 120 s. Only a finalize 409 `upload_in_progress` is repeated (at most 4 total attempts) |
 | `conduyt_create_short_link` | Make (or reuse) the workspace's Conduyt short link for a public link-shortener address the Message check flagged (`POST /short-links`, body `{ url }`; key needs the `messages` scope, member needs communications.create). Not shortenable: our own host, merge fields, `mailto:`/`tel:`/`sms:`, or any address the Message check does not flag as a link shortener (400 `not_shortenable`). Other errors verbatim, never retried: 400 `invalid_body`, 403 `forbidden`, 413 `body_too_large`, 429 `rate_limited` (with Retry-After), 503 `short_link_unavailable` (nothing changed) |
 | `conduyt_get_deal_card_fields` / `conduyt_set_deal_card_fields` | Read / replace the kanban card fields (1-8, built-ins or `custom:<fieldKey>`) |
 | `conduyt_get_settings_revision` | The account `settingsRevision` (plus stored stage rules and rot days): pass it as `expectedSettingsRevision` to `conduyt_archive_pipeline` / `conduyt_delete_stage` so a stale one is refused 409 `stale_settings_revision` |
@@ -148,7 +150,7 @@ No tool carries call audio. Fetch it with `GET {API base}/api/v1/dialer/call/{id
 ### Companies
 | Tool | Description |
 |------|-------------|
-| `conduyt_list_companies` | List and search companies |
+| `conduyt_list_companies` | List and search companies (`count_mode: none` skips the total: `meta.total` null, `meta.has_more` exact) |
 | `conduyt_get_company` | Get company with contacts and deals |
 | `conduyt_create_company` | Create a new company record |
 | `conduyt_update_company` | Update company details |
@@ -397,7 +399,7 @@ A refused call (HTTP 4xx/5xx) fails the tool with this text, stable across tools
 Conduyt API <status>: <server message>[ [Retry-After: <N>s]][ <details>]
 ```
 
-`[Retry-After: Ns]` appears only when the server sent the header (shown, never acted on: a mutation is never retried).
+`[Retry-After: Ns]` appears only when the server sent the header (shown, never acted on: a mutation is never retried; the one exception is the finalize POST of the upload convenience tools `conduyt_upload_local_file` and `conduyt_upload_chat_attachment`: on a 409 `upload_in_progress` only, at most 4 total attempts, the Retry-After is honoured (capped at 10 s, 5 s when absent or unreadable); finalize is idempotent on the server for the same upload id, so a repeat cannot double-finalize).
 `<details>` appears only when the body had more than `error`: it is ONE JSON object and the FINAL token. To extract it, try
 each `{` from the left until the rest of the text parses as JSON (a server message may itself contain a brace). The object
 carries scalars first (`code`, revision), then nested objects whole; `HealthFixRefusal.row` is always whole, any other nested

package/dist/client.d.ts

@@ -12,7 +12,7 @@ export declare class ConduytApiError extends Error {
     readonly code: "http" | "timeout" | "response_too_large" | "network";
     readonly retryable: boolean;
     /** The response's Retry-After, in seconds, when it sent one (a busy 503 / a 429): surfaced to the agent, never used
-     *  to replay a mutation. */
+     *  to replay a mutation. Exception (finalize of the convenience upload tools/commands only): on a 409 upload_in_progress the finalize POST is repeated, at most 4 total attempts, the Retry-After honoured and capped at 10 s, 5 s when absent or unreadable. */
     readonly retryAfterSeconds: number | null;
     constructor(opts: {
         message: string;

package/dist/client.js

@@ -11,7 +11,7 @@ export class ConduytApiError extends Error {
     code;
     retryable;
     /** The response's Retry-After, in seconds, when it sent one (a busy 503 / a 429): surfaced to the agent, never used
-     *  to replay a mutation. */
+     *  to replay a mutation. Exception (finalize of the convenience upload tools/commands only): on a 409 upload_in_progress the finalize POST is repeated, at most 4 total attempts, the Retry-After honoured and capped at 10 s, 5 s when absent or unreadable. */
     retryAfterSeconds;
     constructor(opts) {
         super(opts.message, opts.cause !== undefined ? { cause: opts.cause } : undefined);

package/dist/register-all.js

@@ -33,6 +33,7 @@ import { registerBatchOperationTools } from "./tools/batch-operations.js";
 import { registerDncTools } from "./tools/dnc.js";
 import { registerEmailOptOutTools } from "./tools/email-opt-out.js";
 import { registerShortLinkTools } from "./tools/short-links.js";
+import { registerDirectUploadTools } from "./tools/direct-uploads.js";
 import { registerMyProfileTools } from "./tools/my-profile.js";
 import { registerSavedFilterTools } from "./tools/saved-filters.js";
 import { registerDripCampaignTools } from "./tools/drip-campaigns.js";
@@ -94,6 +95,7 @@ export function registerAllTools(server, client) {
     registerDncTools(server, client);
     registerEmailOptOutTools(server, client);
     registerShortLinkTools(server, client);
+    registerDirectUploadTools(server, client);
     registerMyProfileTools(server, client);
     registerSavedFilterTools(server, client);
     registerDripCampaignTools(server, client);

package/dist/tool-annotations.js

@@ -11,6 +11,7 @@ export const TOOL_ANNOTATIONS = {
     conduyt_search: ro("Search CRM Records"),
     conduyt_mcp_coverage: ro("Get MCP Coverage Matrix"),
     conduyt_list_contacts: ro("List Contacts"),
+    conduyt_count_contacts: ro("Count Contacts"),
     conduyt_get_contact: ro("Get Contact"),
     conduyt_create_contact: create("Create Contact"),
     conduyt_update_contact: update("Update Contact"),
@@ -222,6 +223,12 @@ export const TOOL_ANNOTATIONS = {
     conduyt_add_email_opt_out: update("Add Email Opt-Out"), // a repeat is refused 409 (already listed by hand) before any write, so it lands on the same state; adding a block is protective
     conduyt_resubscribe_email_opt_out: destroy("Resubscribe Email Address"), // consent change: removing the row re-enables every customer-facing email to the address
     conduyt_get_my_profile: ro("Get My Profile"),
+    conduyt_create_file_upload_intent: create("Create File Upload Intent"), // mints a pending upload record and a signed PUT target; each call is a new upload id
+    conduyt_finalize_file_upload: update("Finalize File Upload"), // finalizing the same upload again answers the same body
+    conduyt_create_chat_upload_intent: create("Create Chat Upload Intent"),
+    conduyt_finalize_chat_upload: update("Finalize Chat Upload"), // finalizing again answers the same body
+    conduyt_upload_local_file: create("Upload Local File"), // reads a local file and PUTs it to the signed storage URL; each call stores a new file
+    conduyt_upload_chat_attachment: create("Upload Chat Attachment"),
     conduyt_create_short_link: update("Create Short Link"), // one link per account and target: a repeat returns the same link (idempotent), nothing existing is changed
     conduyt_list_saved_filters: ro("List Saved Filters"),
     conduyt_create_saved_filter: create("Create Saved Filter"),

package/dist/tools/batch-operations.js

@@ -5,7 +5,7 @@ import { formatResult } from "../client.js";
  * matching → Run Batch" action and the Run Batch page. Admins and owners only.
  */
 export function registerBatchOperationTools(server, client) {
-    server.tool("conduyt_create_batch_operation", "Queue a Run Batch: ONE task applied to many contacts, logged with progress and cancel (no undo). Tasks: enroll (automationId of a published workflow), delete (the #73 engine: cleanup runs, contacts with an upcoming appointment are kept), add_tag / remove_tag (params.tagId), assign (params.userId — one rep) or a round-robin pool (params.userIds, 2–50 reps rotated in order; a rep who is no longer an active member is skipped), set_source (params.source — OVERWRITES the lead source), set_status (params.status — one of the account's lead statuses; a lead with a won deal keeps its status). Pick the contacts ONE way: contactIds (up to 50,000), filterPayload (universal filters), or filter + expectedTotal — the same filter you would give conduyt_list_contacts plus the meta.total it returned; the server re-counts and refuses with 409 expected_total_mismatch when the set moved, then freezes the matching ids (max 50,000). The run is processed in the background; poll conduyt_get_batch_operation. Requires the admin or owner role and an active subscription.", {
+    server.tool("conduyt_create_batch_operation", "Queue a Run Batch: ONE task applied to many contacts, logged with progress and cancel (no undo). Tasks: enroll (automationId of a published workflow), delete (the #73 engine: cleanup runs, contacts with an upcoming appointment are kept), add_tag / remove_tag (params.tagId), assign (params.userId - one rep) or a round-robin pool (params.userIds, 2–50 reps rotated in order; a rep who is no longer an active member is skipped), set_source (params.source - OVERWRITES the lead source), set_status (params.status - one of the account's lead statuses; a lead with a won deal keeps its status). Pick the contacts ONE way: contactIds (up to 50,000), filterPayload (universal filters), or filter + expectedTotal - the same filter you would give conduyt_list_contacts plus the meta.total it returned (when the list answers meta.total null with meta.total_deferred true and has_more, use the total from conduyt_count_contacts for the same SHARED filter; with a deal-context filter see below); the server re-counts and refuses with 409 expected_total_mismatch when the set moved, then freezes the matching ids (max 50,000). Deal-context filters (deal_context_owners, deal_context_stages, deal_context_statuses) exist only on the list, not on conduyt_count_contacts: for a list that uses one of them do not take a total from the count tool (it would count a broader set); page the list with has_more and tally the rows instead. The run is processed in the background; poll conduyt_get_batch_operation. Requires the admin or owner role and an active subscription.", {
         name: z.string().min(1).max(256).describe("A name for the run (shown on the Run Batch page)"),
         operation: z.enum(["enroll", "delete", "add_tag", "remove_tag", "assign", "set_source", "set_status"]).describe("The task"),
         automationId: z.string().uuid().optional().describe("enroll only: the published workflow"),
@@ -13,8 +13,8 @@ export function registerBatchOperationTools(server, client) {
         comment: z.string().max(2000).optional().describe("Why this run (stored with it)"),
         contactIds: z.array(z.string().uuid()).min(1).max(50_000).optional().describe("Explicit contacts"),
         filterPayload: z.array(z.record(z.string(), z.unknown())).min(1).optional().describe("Universal filter rules (the Smart View filter shape)"),
-        filter: z.record(z.string(), z.union([z.string(), z.array(z.string())])).optional().describe("The contact list filter parameters, exactly as for conduyt_list_contacts; at least one non-empty value"),
-        expectedTotal: z.number().int().positive().optional().describe("With filter: the total the list showed for it (meta.total)"),
+        filter: z.record(z.string(), z.union([z.string(), z.array(z.string())])).optional().describe("The contact list filter parameters as for conduyt_list_contacts (the filters shared with conduyt_count_contacts; the list-only deal_context_owners / deal_context_stages / deal_context_statuses cannot be counted there: page by has_more and tally rows); at least one non-empty value"),
+        expectedTotal: z.number().int().positive().optional().describe("With filter: the total the list showed for it (meta.total), or the total from conduyt_count_contacts when meta.total was null (total_deferred); not for a deal-context filter (list-only, the count tool cannot express it): tally rows by has_more"),
     }, async (params) => {
         const body = { name: params.name, operation: params.operation };
         if (params.automationId)

package/dist/tools/bulk.js

@@ -118,9 +118,9 @@ export function registerBulkTools(server, client) {
         const result = await client.post("/api/v1/bulk/contacts/delete", params);
         return formatResult(result);
     });
-    server.tool("conduyt_bulk_delete_contacts_matching", "Soft-delete EVERY contact a list filter matches, across pages (#73, 2026-09-15) — the contacts page's \"Select all N matching\" action. FIRST CALL: pass the same filter you would give conduyt_list_contacts (search, tag, tags, source, reachability, company, company_id, assigned_to, created_from/to, updated_from/to, min_score, import_id, smart_view, smartListId, filters JSON, master_status, exclude_master_status, cf[key]) and expectedTotal = the meta.total that filter returned. The server re-counts and refuses when the set moved (409 expected_total_mismatch), refuses when some matching contacts are shared with you but not yours to delete (409 not_all_editable), then FREEZES the matching ids (max 50,000; 422 above) and deletes only those. Contacts with an upcoming appointment are kept (keptWithAppointments). If done=false the response carries remainingIds AND a signed continuation token: CALL AGAIN with ids = remainingIds and continuation = that token, verbatim (no filter, no expectedTotal) until done=true; busy=true means wait a moment first. The token is bound to you, this account and exactly those ids and expires after 2 hours (403 continuation_*); a continuation without it is refused. Empty filters are refused. Requires contacts:delete and an active subscription.", {
-        filter: z.record(z.string(), z.union([z.string(), z.array(z.string())])).optional().describe("First call: the contact list filter parameters, exactly as for conduyt_list_contacts; at least one non-empty value"),
-        expectedTotal: z.number().int().positive().optional().describe("First call: the total the list showed for this filter (meta.total)"),
+    server.tool("conduyt_bulk_delete_contacts_matching", "Soft-delete EVERY contact a list filter matches, across pages (#73, 2026-09-15) - the contacts page's \"Select all N matching\" action. FIRST CALL: pass the same filter you would give conduyt_list_contacts (search, tag, tags, source, reachability, company, company_id, assigned_to, created_from/to, updated_from/to, min_score, import_id, smart_view, smartListId, filters JSON, master_status, exclude_master_status, cf[key]) and expectedTotal = the meta.total that filter returned (when the list answers meta.total null with meta.total_deferred true and has_more, get the exact total from conduyt_count_contacts with the same SHARED filter; with a deal-context filter see below). Deal-context filters (deal_context_owners, deal_context_stages, deal_context_statuses) exist only on the list, not on conduyt_count_contacts: for a list that uses one of them do not take a total from the count tool (it would count a broader set); page the list with has_more and tally the rows instead. The server re-counts and refuses when the set moved (409 expected_total_mismatch), refuses when some matching contacts are shared with you but not yours to delete (409 not_all_editable), then FREEZES the matching ids (max 50,000; 422 above) and deletes only those. Contacts with an upcoming appointment are kept (keptWithAppointments). If done=false the response carries remainingIds AND a signed continuation token: CALL AGAIN with ids = remainingIds and continuation = that token, verbatim (no filter, no expectedTotal) until done=true; busy=true means wait a moment first. The token is bound to you, this account and exactly those ids and expires after 2 hours (403 continuation_*); a continuation without it is refused. Empty filters are refused. Requires contacts:delete and an active subscription.", {
+        filter: z.record(z.string(), z.union([z.string(), z.array(z.string())])).optional().describe("First call: the contact list filter parameters as for conduyt_list_contacts (the filters shared with conduyt_count_contacts; the list-only deal_context_owners / deal_context_stages / deal_context_statuses cannot be counted there: page by has_more and tally rows); at least one non-empty value"),
+        expectedTotal: z.number().int().positive().optional().describe("First call: the total the list showed for this filter (meta.total), or the total from conduyt_count_contacts when meta.total was null (total_deferred); not for a deal-context filter (list-only, the count tool cannot express it): tally rows by has_more"),
         ids: z.array(z.string().uuid()).min(1).max(50_000).optional().describe("Continuation: the remainingIds from the previous response, in the same order (send INSTEAD of filter/expectedTotal)"),
         continuation: z.string().max(2_000).optional().describe("Continuation: the `continuation` token from the previous response, verbatim (required with ids)"),
     }, async (params) => {

package/dist/tools/companies.js

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import { formatResult } from "../client.js";
 export function registerCompanyTools(server, client) {
-    server.tool("conduyt_list_companies", "List and search companies. Returns name, domain, industry, contact count, deal count, and total deal value.", {
+    server.tool("conduyt_list_companies", "List and search companies. Returns name, domain, industry, contact count, deal count, and total deal value. `count_mode: \"none\"` skips the total count (a picker that only lists names): meta.total is then null and meta.has_more says whether another page exists.", {
         search: z.string().optional().describe("Search by company name, domain, or phone"),
         industry: z.string().optional().describe("Filter by industry"),
         size: z.enum(["1-10", "11-50", "51-200", "201-500", "501-1000", "1001+"]).optional().describe("Filter by company size"),
@@ -9,7 +9,8 @@ export function registerCompanyTools(server, client) {
         order: z.enum(["asc", "desc"]).optional().describe("Sort order (default: desc)"),
         page: z.number().optional().describe("Page number (default 1)"),
         per_page: z.number().optional().describe("Results per page (default 50, max 200)"),
-    }, async ({ search, industry, size, sort, order, page, per_page }) => {
+        count_mode: z.enum(["exact", "none"]).optional().describe("exact (default) counts every matching company into meta.total. none skips that count: meta.total is then null and meta.has_more says whether another page exists."),
+    }, async ({ search, industry, size, sort, order, page, per_page, count_mode }) => {
         const params = new URLSearchParams();
         if (search)
             params.set("search", search);
@@ -25,6 +26,8 @@ export function registerCompanyTools(server, client) {
             params.set("page", String(page));
         if (per_page)
             params.set("per_page", String(per_page));
+        if (count_mode)
+            params.set("count_mode", count_mode);
         const result = await client.get(`/api/v1/companies?${params}`);
         return formatResult(result);
     });

package/dist/tools/contacts.d.ts

@@ -21,5 +21,7 @@ export declare const MERGE_PREVIEW_MAX = 50;
 export declare const MERGE_PREVIEW_TTL_MS: number;
 export declare const EMAIL_LOOKUP_NOTE = "Exact email lookup: one address, or up to 20 distinct addresses in an array. Each is trimmed and lower-cased and matches the contact's primary email OR any secondary email slot (email_2 and up); it is an exact match, not a substring search (use `search` for partial text). Combines with every other filter (AND) inside your account and visibility. An empty or invalid address, or more than 20 distinct addresses, is a 400. On a workspace whose identifier index is still being built, the lookup answers 422 when the stored spellings of the requested addresses exceed its stored-spelling bind budget (a count of spellings, not of contacts; other filters do not help); ask support to complete the identifier backfill. Send addresses once; duplicates collapse.";
 export declare const TAG_FILTER_NOTE = "Filter by tag NAME: one name, or up to 20 distinct names in an array (the contact carries ANY of them). Names match case-insensitively within your account. Cannot be combined with tagId (400). To filter by tag id use tagId.";
-export declare const TAG_ID_FILTER_NOTE = "Filter by tag ID (uuid): one id, or up to 20 distinct ids in an array (the contact carries ANY of them). A malformed id or more than 20 ids is a 400; an id that is not a tag of your account matches nothing; a merged-away tag id follows its alias to the live tag. Cannot be combined with tag (400). The returned total (meta.total) counts the filtered set, so tagId with per_page=1 is a cheap count of the contacts holding a tag.";
+export declare const TAG_ID_FILTER_NOTE = "Filter by tag ID (uuid): one id, or up to 20 distinct ids in an array (the contact carries ANY of them). A malformed id or more than 20 ids is a 400; an id that is not a tag of your account matches nothing; a merged-away tag id follows its alias to the live tag. Cannot be combined with tag (400). meta.total counts the filtered set when present, but it can be null with total_deferred; per_page 1 is only an existence probe. Use conduyt_count_contacts with tagId for the exact total.";
+/** (slow566b, app main 9aef66389) the contacts list may not count: how a caller gets the exact total */
+export declare const LIST_TOTAL_NOTE = "`meta.total` can be null: then `meta.total_deferred` is true and the page was not counted (the unfiltered list and a Smart View answer a cached total, `meta.total_age_ms`, null until first counted; a filter without an index of its own is never counted here). `meta.has_more` is always exact, so page on by `has_more`, never by `total`. For the exact total call conduyt_count_contacts (GET /contacts/count), which takes the SHARED filters only: with dealContextOwners, dealContextStages or dealContextStatuses (list-only) the count route cannot answer (dropping them counts a broader set), so page with has_more instead. A search stops counting at 10,000 (`meta.total_capped`).";
 export declare function registerContactTools(server: McpServer, client: ConduytClient): void;

package/dist/tools/contacts.js

@@ -73,10 +73,13 @@ export const EMAIL_LOOKUP_NOTE = "Exact email lookup: one address, or up to 20 d
 /** (API ?tag= / ?tagId=, #506) both are repeatable and capped at 20 distinct values; the API reads every occurrence (ANY-of) and refuses tagId together with tag */
 const TAG_FILTER_MAX = 20;
 export const TAG_FILTER_NOTE = "Filter by tag NAME: one name, or up to 20 distinct names in an array (the contact carries ANY of them). Names match case-insensitively within your account. Cannot be combined with tagId (400). To filter by tag id use tagId.";
-export const TAG_ID_FILTER_NOTE = "Filter by tag ID (uuid): one id, or up to 20 distinct ids in an array (the contact carries ANY of them). A malformed id or more than 20 ids is a 400; an id that is not a tag of your account matches nothing; a merged-away tag id follows its alias to the live tag. Cannot be combined with tag (400). The returned total (meta.total) counts the filtered set, so tagId with per_page=1 is a cheap count of the contacts holding a tag.";
+export const TAG_ID_FILTER_NOTE = "Filter by tag ID (uuid): one id, or up to 20 distinct ids in an array (the contact carries ANY of them). A malformed id or more than 20 ids is a 400; an id that is not a tag of your account matches nothing; a merged-away tag id follows its alias to the live tag. Cannot be combined with tag (400). meta.total counts the filtered set when present, but it can be null with total_deferred; per_page 1 is only an existence probe. Use conduyt_count_contacts with tagId for the exact total.";
+/** (slow566b, app main 9aef66389) the contacts list may not count: how a caller gets the exact total */
+export const LIST_TOTAL_NOTE = "`meta.total` can be null: then `meta.total_deferred` is true and the page was not counted (the unfiltered list and a Smart View answer a cached total, `meta.total_age_ms`, null until first counted; a filter without an index of its own is never counted here). `meta.has_more` is always exact, so page on by `has_more`, never by `total`. For the exact total call conduyt_count_contacts (GET /contacts/count), which takes the SHARED filters only: with dealContextOwners, dealContextStages or dealContextStatuses (list-only) the count route cannot answer (dropping them counts a broader set), so page with has_more instead. A search stops counting at 10,000 (`meta.total_capped`).";
 export function registerContactTools(server, client) {
     const mergePreviews = createMergePreviewStore();
-    server.tool("conduyt_list_contacts", "List and search contacts with filtering. To find the contact(s) holding a known email address, pass `email` (exact match on the primary or any secondary email); `search` is a substring search. To list the contacts carrying a tag (or any of several tags), pass `tagId` (uuid) or `tag` (name); meta.total is the count of that filtered set. Returns paginated results with name, email, phone, tags, source, and assignee. Each row carries `revision` (integer save revision; pass it back as expectedRevision on conduyt_update_contact or the collaborator tools).", {
+    /** the filter parameters conduyt_list_contacts and conduyt_count_contacts share (GET /contacts and GET /contacts/count read the same ones) */
+    const contactFilterShape = {
         search: z.string().optional().describe("Search by name, email, or phone number"),
         email: z.union([EMAIL_LOOKUP_ONE, z.array(EMAIL_LOOKUP_ONE).min(1).max(20)]).optional().describe(EMAIL_LOOKUP_NOTE),
         tag: z.union([z.string().trim().min(1), z.array(z.string().trim().min(1)).min(1).max(TAG_FILTER_MAX)]).optional().describe(TAG_FILTER_NOTE),
@@ -85,9 +88,25 @@ export function registerContactTools(server, client) {
         assignedTo: z.string().optional().describe("Filter by assigned user ID"),
         masterStatus: z.array(z.string().trim().min(1).max(40)).max(20).optional().describe("Only contacts whose LEAD (master) status is one of these: 'open', 'won', 'lost', 'abandoned', 'disqualified' or an account custom status. Unknown values are a 400."),
         excludeMasterStatus: z.array(z.string().trim().min(1).max(40)).max(20).optional().describe("Hide contacts whose lead status is one of these — e.g. ['won','lost','abandoned','disqualified'] is the 'Active' view. Naming a status in both lists is a 400."),
-        page: z.number().optional().describe("Page number (default 1)"),
-        per_page: z.number().optional().describe("Results per page (default 25, max 100)"),
-    }, async ({ search, email, tag, tagId, source, assignedTo, masterStatus, excludeMasterStatus, page, per_page }) => {
+        // the rest of the filters GET /contacts and GET /contacts/count both read (app main 9aef66389); each maps to the query param of the same meaning
+        company: z.string().optional().describe("Filter by company name (query param `company`)"),
+        companyId: z.string().optional().describe("Filter by company id (query param `company_id`)"),
+        createdFrom: z.string().optional().describe("Created on or after this date/time (query param `created_from`)"),
+        createdTo: z.string().optional().describe("Created on or before this date/time (query param `created_to`)"),
+        updatedFrom: z.string().optional().describe("Updated on or after this date/time (query param `updated_from`)"),
+        updatedTo: z.string().optional().describe("Updated on or before this date/time (query param `updated_to`)"),
+        importId: z.string().optional().describe("Only contacts from this import job (query param `import_id`)"),
+        minScore: z.number().int().optional().describe("Minimum lead score (query param `min_score`)"),
+        smartView: z.string().optional().describe("Smart View: a Smart View id, or a built-in view such as needs_follow_up, hot_leads, new_this_week, recently_won, untagged, missing_email, missing_phone (query param `smart_view`)"),
+        smartListId: z.string().optional().describe("Smart List id (uuid); a non-uuid is a 400 invalid_smart_list_id, an unknown list a 404 smart_list_not_found (query param `smartListId`)"),
+        tags: z.string().optional().describe("Comma-separated tag names (query param `tags`; the same set the Run Batch / bulk delete filters use). Prefer `tag` / `tagId` for new calls"),
+        filters: z.string().optional().describe("The filter builder's JSON, as a string (query param `filters`)"),
+        reachability: z.string().optional().describe("Reachability filter (query param `reachability`)"),
+        cf: z.string().optional().describe("Compact custom-field filters: fieldKey=value pairs (comma-separated) or a JSON object; a value can be exact, __notempty__ or __empty__ (query param `cf`)"),
+        customFieldFilters: z.record(z.string(), z.string()).optional().describe("Filter by contact custom fields: { fieldKey: exact value | '__notempty__' | '__empty__' }; each is sent as `cf[fieldKey]`. The key must be a contact custom-field of the account"),
+    };
+    const contactFilterParams = (f) => {
+        const { search, email, tag, tagId, source, assignedTo, masterStatus, excludeMasterStatus } = f;
         const params = new URLSearchParams();
         if (search)
             params.set("search", search);
@@ -107,6 +126,34 @@ export function registerContactTools(server, client) {
             params.set("master_status", masterStatus.join(","));
         if (excludeMasterStatus?.length)
             params.set("exclude_master_status", excludeMasterStatus.join(","));
+        const plain = [
+            ["company", f.company], ["company_id", f.companyId], ["created_from", f.createdFrom], ["created_to", f.createdTo],
+            ["updated_from", f.updatedFrom], ["updated_to", f.updatedTo], ["import_id", f.importId], ["min_score", f.minScore],
+            ["smart_view", f.smartView], ["smartListId", f.smartListId], ["tags", f.tags], ["filters", f.filters], ["reachability", f.reachability], ["cf", f.cf],
+        ];
+        for (const [name, value] of plain)
+            if (value !== undefined && value !== "")
+                params.set(name, String(value));
+        for (const [key, value] of Object.entries(f.customFieldFilters ?? {}))
+            params.set(`cf[${key}]`, value);
+        return params;
+    };
+    server.tool("conduyt_list_contacts", "List and search contacts with filtering. To find the contact(s) holding a known email address, pass `email` (exact match on the primary or any secondary email); `search` is a substring search. To list the contacts carrying a tag (or any of several tags), pass `tagId` (uuid) or `tag` (name). Returns paginated results with name, email, phone, tags, source, and assignee. Each row carries `revision` (integer save revision; pass it back as expectedRevision on conduyt_update_contact or the collaborator tools). " + LIST_TOTAL_NOTE, {
+        ...contactFilterShape,
+        // list-only filters (GET /contacts reads them; GET /contacts/count does not)
+        dealContextOwners: z.string().optional().describe("Deal-context filter: comma-separated owner ids (query param `deal_context_owners`; list only, the count route does not read it)"),
+        dealContextStages: z.string().optional().describe("Deal-context filter: comma-separated stage ids (query param `deal_context_stages`; list only)"),
+        dealContextStatuses: z.string().optional().describe("Deal-context filter: comma-separated deal statuses (query param `deal_context_statuses`; list only)"),
+        page: z.number().optional().describe("Page number (default 1)"),
+        per_page: z.number().optional().describe("Results per page (default 25, max 100)"),
+    }, async ({ page, per_page, dealContextOwners, dealContextStages, dealContextStatuses, ...filter }) => {
+        const params = contactFilterParams(filter);
+        if (dealContextOwners)
+            params.set("deal_context_owners", dealContextOwners);
+        if (dealContextStages)
+            params.set("deal_context_stages", dealContextStages);
+        if (dealContextStatuses)
+            params.set("deal_context_statuses", dealContextStatuses);
         if (page)
             params.set("page", String(page));
         if (per_page)
@@ -114,6 +161,11 @@ export function registerContactTools(server, client) {
         const result = await client.get(`/api/v1/contacts?${params}`);
         return formatResult(result);
     });
+    server.tool("conduyt_count_contacts", "Count the contacts a list filter matches (GET /contacts/count): the exact total when conduyt_list_contacts answers `meta.total: null` with `meta.total_deferred: true`. Takes the SHARED subset of conduyt_list_contacts filters (no page, per_page or sort, and NOT dealContextOwners / dealContextStages / dealContextStatuses, which exist only on the list): with a deal-context filter the exact total is not available here (dropping it counts a broader set), so page the list with has_more instead. Answers `{ total, age_ms?, total_capped?, pending?, timed_out? }`: a cached list (the unfiltered list, or a Smart View alone) answers its cached exact count while under a minute old (`age_ms`), else recounts; `total: null` with `pending: true` = another request is recounting and nothing is cached yet, ask again in a few seconds; `total: null` with `timed_out: true` = the count could not finish within 30 s (narrow the filter); a `search` counts up to 10,000 (`total_capped: true` = more match). Use the total as `expectedTotal` for conduyt_bulk_delete_contacts_matching or conduyt_create_batch_operation.", contactFilterShape, async (filter) => {
+        const params = contactFilterParams(filter);
+        const result = await client.get(`/api/v1/contacts/count?${params}`);
+        return formatResult(result);
+    });
     server.tool("conduyt_get_contact", "Get a single contact with full details — profile, tags, custom fields, timeline, deals, and activity history. Includes `revision` (integer save revision): pass it as expectedRevision on conduyt_update_contact or the collaborator tools so a newer change is never overwritten. Includes `hasOutboundSms` (boolean): true when this workspace has ever PROVABLY texted the contact (a proven send only: not a draft, a queued row or a pre-send failure); use it to pick the `context` for conduyt_check_message (false = 'first', true = 'conversation'). Also includes `hasOutboundEmail` (boolean): the same for email (true when at least one outbound email to the contact was proven sent, so a genuine \"Re:\" reply is a conversation and not flagged); use it to pick the `context` for an email check. Also includes `duplicateProposals` (the open and not-sure possible-duplicate lines on this record, each naming the other record as far as your key may see it) and `heldIdentifiers` (emails or phones held from this record because another record owns them, value-free), each the FIRST page only, with duplicateProposalsTotal, duplicateProposalsNextCursor, duplicateProposalsMembershipRevision, heldIdentifiersTotal, heldIdentifiersNextCursor and heldIdentifiersMembershipRevision (page on with conduyt_list_duplicate_proposals, passing the next cursors as cursor / held_cursor); list or decide them with conduyt_list_duplicate_proposals / conduyt_decide_duplicate_proposal.", {
         id: z.string().describe("Contact UUID"),
     }, async ({ id }) => {

package/dist/tools/direct-uploads.d.ts

@@ -0,0 +1,41 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { ConduytClient } from "../client.js";
+/**
+ * Direct-to-storage uploads (#565; app routes POST /api/v1/files/upload/intent + /finalize and
+ * POST /api/v1/chat/channels/{id}/upload/intent + /finalize). The bytes go straight to the signed storage URL; the API never
+ * carries the file. The four routes are exposed one to one, plus ONE convenience tool per surface that runs the whole flow
+ * (intent, PUT the bytes of a local file, finalize). Every API call is sent once: a refusal reaches the agent verbatim.
+ * The only repeat is finalize on 409 upload_in_progress, which the API documents as retryable (finalizing again answers the
+ * same body), and only inside the convenience tools.
+ */
+/** the app's caps (lib/file-upload-policy.ts CRM_FILE_MAX_BYTES, lib/chat-upload-policy.ts CHAT_UPLOAD_MAX_BYTES) */
+export declare const FILE_UPLOAD_MAX_BYTES: number;
+export declare const CHAT_UPLOAD_MAX_BYTES: number;
+export declare const tooLargeMessage: (size: number, max: number) => string;
+/** both app finalize routes set maxDuration = 120 (finalize reads the staged object back and rewrites it), above the client's 30 s default */
+export declare const FINALIZE_TIMEOUT_MS = 120000;
+/** finalize retry on 409 upload_in_progress: exactly `attempts` calls; between them the refusal's Retry-After (capped at maxDelayMs)
+ *  or, when it sent none or an unreadable one, delayMs. `sleep` is module state so tests can spy on the scheduled delay. */
+export declare const finalizeRetry: {
+    attempts: number;
+    delayMs: number;
+    maxDelayMs: number;
+    sleep: (ms: number) => Promise<unknown>;
+};
+/** the milliseconds to wait before finalizing again; pure */
+export declare function finalizeWaitMs(err: unknown): number;
+/** Everything the end-to-end tools do after the argument checks; exported for the tests. */
+export declare function runDirectUpload(client: ConduytClient, o: {
+    intentPath: string;
+    finalizePath: string;
+    maxBytes: number;
+    filePath: string;
+    fileName?: string;
+    contentType?: string;
+}): Promise<{
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+}>;
+export declare function registerDirectUploadTools(server: McpServer, client: ConduytClient): void;

package/dist/tools/direct-uploads.js

@@ -0,0 +1,113 @@
+import { createReadStream } from "node:fs";
+import { stat } from "node:fs/promises";
+import { basename, resolve } from "node:path";
+import { Readable } from "node:stream";
+import { z } from "zod";
+import { formatResult, formatToolError } from "../client.js";
+import { strictInput } from "./strict.js";
+/**
+ * Direct-to-storage uploads (#565; app routes POST /api/v1/files/upload/intent + /finalize and
+ * POST /api/v1/chat/channels/{id}/upload/intent + /finalize). The bytes go straight to the signed storage URL; the API never
+ * carries the file. The four routes are exposed one to one, plus ONE convenience tool per surface that runs the whole flow
+ * (intent, PUT the bytes of a local file, finalize). Every API call is sent once: a refusal reaches the agent verbatim.
+ * The only repeat is finalize on 409 upload_in_progress, which the API documents as retryable (finalizing again answers the
+ * same body), and only inside the convenience tools.
+ */
+/** the app's caps (lib/file-upload-policy.ts CRM_FILE_MAX_BYTES, lib/chat-upload-policy.ts CHAT_UPLOAD_MAX_BYTES) */
+export const FILE_UPLOAD_MAX_BYTES = 50 * 1024 * 1024;
+export const CHAT_UPLOAD_MAX_BYTES = 10 * 1024 * 1024;
+/** the app's own wording (lib/direct-upload.ts mb()) so a client-side refusal reads the same as the server's 413 */
+const mb = (bytes) => `${Math.round((bytes / 1024 / 1024) * 10) / 10} MB`;
+export const tooLargeMessage = (size, max) => `File is too large (${mb(size)}). Maximum allowed: ${mb(max)}.`;
+/** both app finalize routes set maxDuration = 120 (finalize reads the staged object back and rewrites it), above the client's 30 s default */
+export const FINALIZE_TIMEOUT_MS = 120_000;
+/** finalize retry on 409 upload_in_progress: exactly `attempts` calls; between them the refusal's Retry-After (capped at maxDelayMs)
+ *  or, when it sent none or an unreadable one, delayMs. `sleep` is module state so tests can spy on the scheduled delay. */
+export const finalizeRetry = {
+    attempts: 4,
+    delayMs: 5000,
+    maxDelayMs: 10_000,
+    sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
+};
+/** the milliseconds to wait before finalizing again; pure */
+export function finalizeWaitMs(err) {
+    const ra = err?.retryAfterSeconds;
+    return typeof ra === "number" && Number.isFinite(ra) && ra >= 0 ? Math.min(ra * 1000, finalizeRetry.maxDelayMs) : finalizeRetry.delayMs;
+}
+const unwrap = (r) => (r && typeof r === "object" && "data" in r ? r.data : r);
+const FILE_SCOPE = "an API key needs the 'files' scope and the member files.create";
+const CHAT_SCOPE = "an API key needs the 'chat' scope and the member communications.create and membership of the channel";
+const INTENT_ERRORS = "Errors, surfaced verbatim and never retried: 400 file_name_required / file_type_not_allowed / file_size_required / file_empty; 413 file_too_large; 429 (rate limited, Retry-After in the error); 503 uploads_unavailable (nothing changed).";
+const FINALIZE_ERRORS = "Errors, surfaced verbatim: 400 upload_id_required; 404 upload_not_found (malformed, unknown, expired or someone else's upload: upload again); 409 upload_incomplete (the bytes were never PUT, or not all of them: upload again; not retried); 409 upload_in_progress (still being saved: finalize again, same body); 413 file_too_large (the stored object is over the cap); 422 upload_size_mismatch (the stored size is not the declared one: upload again); 400/415 file_rejected (the content check refused the bytes; the status and message are the check's); 429 (rate limited, Retry-After in the error); 503 uploads_unavailable (try again shortly). Finalize allows 120 seconds.";
+/** Everything the end-to-end tools do after the argument checks; exported for the tests. */
+export async function runDirectUpload(client, o) {
+    const abs = resolve(o.filePath);
+    let st;
+    try {
+        st = await stat(abs);
+    }
+    catch {
+        return formatToolError(`Cannot read '${o.filePath}': no such file. Nothing was uploaded.`);
+    }
+    if (!st.isFile())
+        return formatToolError(`'${o.filePath}' is not a regular file. Nothing was uploaded.`);
+    // the size cap is checked BEFORE the intent call, with the server's wording
+    if (st.size === 0)
+        return formatToolError("The file is empty.");
+    if (st.size > o.maxBytes)
+        return formatToolError(tooLargeMessage(st.size, o.maxBytes));
+    const body = { fileName: o.fileName ?? basename(abs), size: st.size };
+    if (o.contentType !== undefined)
+        body.contentType = o.contentType;
+    const intent = unwrap(await client.post(o.intentPath, body));
+    // the bytes go to the signed URL as-is: NO Authorization header (the URL is the credential), exactly the declared length and type
+    let put;
+    try {
+        put = await fetch(intent.uploadUrl, {
+            method: intent.method || "PUT",
+            headers: { "Content-Type": intent.contentType, "Content-Length": String(st.size) },
+            body: Readable.toWeb(createReadStream(abs)),
+            duplex: "half",
+            signal: AbortSignal.timeout(Math.max(1, intent.expiresIn) * 1000),
+        });
+    }
+    catch (err) {
+        return formatToolError(`Storage upload failed before finalize (${err?.message ?? String(err)}). Nothing was saved; call this tool again (the upload id ${intent.uploadId} is abandoned).`);
+    }
+    if (!put.ok) {
+        return formatToolError(`Storage refused the upload (HTTP ${put.status}). Nothing was saved; call this tool again (the upload id ${intent.uploadId} is abandoned).`);
+    }
+    for (let attempt = 1;; attempt++) {
+        try {
+            return formatResult(await client.post(o.finalizePath, { uploadId: intent.uploadId }, { timeoutMs: FINALIZE_TIMEOUT_MS }));
+        }
+        catch (err) {
+            const inProgress = err?.status === 409 && /upload_in_progress/.test(err.message);
+            if (!inProgress || attempt >= finalizeRetry.attempts)
+                throw err;
+            await finalizeRetry.sleep(finalizeWaitMs(err));
+        }
+    }
+}
+export function registerDirectUploadTools(server, client) {
+    const fileNameField = z.string().min(1).describe("File name with its extension, e.g. contract.pdf (the extension decides the allowed type)");
+    const contentTypeField = z.string().optional().describe("MIME type; omit to let the API infer it from the file name");
+    const sizeField = z.number().int().positive().describe("Exact size of the file in bytes");
+    const uploadIdField = z.string().uuid().describe("uploadId from the intent call, after its bytes were PUT");
+    const channelField = z.string().uuid().describe("Team Chat channel UUID (you must be a member)");
+    strictInput(server.tool("conduyt_create_file_upload_intent", `Step 1 of a direct-to-storage CRM file upload, up to 50 MB (POST /api/v1/files/upload/intent; ${FILE_SCOPE}). Answers 201 { uploadId, uploadUrl, method: "PUT", contentType, size, expiresIn, maxBytes }: PUT exactly 'size' bytes to uploadUrl with Content-Type: contentType within expiresIn seconds (no Authorization header), then call conduyt_finalize_file_upload. This tool does not move bytes; to upload a local file in one step use conduyt_upload_local_file. ${INTENT_ERRORS}`, { fileName: fileNameField, contentType: contentTypeField, size: sizeField }, async ({ fileName, contentType, size }) => formatResult(await client.post("/api/v1/files/upload/intent", { fileName, contentType, size }))));
+    strictInput(server.tool("conduyt_finalize_file_upload", `Step 3 of a direct-to-storage CRM file upload (POST /api/v1/files/upload/finalize; ${FILE_SCOPE}). The stored object must be present and exactly the declared size; its bytes are judged by content, then settled. Answers 201 { uploadId, filename, size, contentType}, the same body as the multipart upload; the uploadId is then attached with POST /api/v1/files { entityType, entityId, uploadId }. Finalizing the same upload again answers the same body. ${FINALIZE_ERRORS}`, { uploadId: uploadIdField }, async ({ uploadId }) => formatResult(await client.post("/api/v1/files/upload/finalize", { uploadId }, { timeoutMs: FINALIZE_TIMEOUT_MS }))));
+    strictInput(server.tool("conduyt_create_chat_upload_intent", `Step 1 of a direct-to-storage Team Chat attachment, up to 10 MB (POST /api/v1/chat/channels/{id}/upload/intent; ${CHAT_SCOPE}). Answers 201 { uploadId, uploadUrl, method: "PUT", contentType, size, expiresIn, maxBytes }: PUT exactly 'size' bytes to uploadUrl with Content-Type: contentType within expiresIn seconds (no Authorization header), then call conduyt_finalize_chat_upload. This tool does not move bytes; to upload a local file in one step use conduyt_upload_chat_attachment. A deal channel is 404 for a key without the deals scope; a non-member gets 403. ${INTENT_ERRORS}`, { channelId: channelField, fileName: fileNameField, contentType: contentTypeField, size: sizeField }, async ({ channelId, fileName, contentType, size }) => formatResult(await client.post(`/api/v1/chat/channels/${channelId}/upload/intent`, { fileName, contentType, size }))));
+    strictInput(server.tool("conduyt_finalize_chat_upload", `Step 3 of a direct-to-storage Team Chat attachment (POST /api/v1/chat/channels/{id}/upload/finalize; ${CHAT_SCOPE}). Answers 201 { url, name, size, type }, the same body as the multipart upload: send it in a message's metadata.attachments. A message that claims an attachment that was never finalized is refused 409 attachment_unavailable. Finalizing again answers the same body. ${FINALIZE_ERRORS}`, { channelId: channelField, uploadId: uploadIdField }, async ({ channelId, uploadId }) => formatResult(await client.post(`/api/v1/chat/channels/${channelId}/upload/finalize`, { uploadId }, { timeoutMs: FINALIZE_TIMEOUT_MS }))));
+    strictInput(server.tool("conduyt_upload_local_file", `Upload a file from the machine this server runs on, end to end, as a CRM file (up to 50 MB): checks the size here first, then intent (POST /api/v1/files/upload/intent), PUT of the bytes to the signed URL, finalize (POST /api/v1/files/upload/finalize). ${FILE_SCOPE}. Answers { uploadId, filename, size, contentType }; attach it with POST /api/v1/files { entityType, entityId, uploadId }. A file over the cap is refused here with the API's wording ("File is too large (60 MB). Maximum allowed: 50 MB.") before any call is made; an empty file likewise ("The file is empty."). API refusals are surfaced verbatim and not retried; a storage failure leaves nothing saved, call the tool again. Only a 409 upload_in_progress on finalize is repeated (at most 4 total attempts, waiting the Retry-After, capped at 10 seconds, else 5 seconds). Finalize refusals: ${FINALIZE_ERRORS}`, {
+        filePath: z.string().min(1).describe("Path of the local file to upload"),
+        fileName: z.string().min(1).optional().describe("Name to store it under; default: the file's own name"),
+        contentType: contentTypeField,
+    }, async ({ filePath, fileName, contentType }) => runDirectUpload(client, { intentPath: "/api/v1/files/upload/intent", finalizePath: "/api/v1/files/upload/finalize", maxBytes: FILE_UPLOAD_MAX_BYTES, filePath, fileName, contentType })));
+    strictInput(server.tool("conduyt_upload_chat_attachment", `Upload a file from the machine this server runs on, end to end, as a Team Chat attachment (up to 10 MB): checks the size here first, then intent (POST /api/v1/chat/channels/{id}/upload/intent), PUT of the bytes, finalize (.../upload/finalize). ${CHAT_SCOPE}. Answers { url, name, size, type }: send it in a message's metadata.attachments. A file over the cap is refused here with the API's wording ("File is too large (12 MB). Maximum allowed: 10 MB.") before any call is made; an empty file likewise ("The file is empty."). API refusals are surfaced verbatim and not retried; a storage failure leaves nothing saved, call the tool again. Only a 409 upload_in_progress on finalize is repeated (at most 4 total attempts, waiting the Retry-After, capped at 10 seconds, else 5 seconds). Finalize refusals: ${FINALIZE_ERRORS}`, {
+        channelId: channelField,
+        filePath: z.string().min(1).describe("Path of the local file to upload"),
+        fileName: z.string().min(1).optional().describe("Name to store it under; default: the file's own name"),
+        contentType: contentTypeField,
+    }, async ({ channelId, filePath, fileName, contentType }) => runDirectUpload(client, { intentPath: `/api/v1/chat/channels/${channelId}/upload/intent`, finalizePath: `/api/v1/chat/channels/${channelId}/upload/finalize`, maxBytes: CHAT_UPLOAD_MAX_BYTES, filePath, fileName, contentType })));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "conduyt-mcp",
-  "version": "4.101.0",
+  "version": "4.103.0",
   "mcpName": "com.conduyt/mcp",
   "description": "MCP server for Conduyt CRM — expose CRM operations as AI-accessible tools",
   "type": "module",
@@ -39,7 +39,7 @@
     "claude",
     "llm-tools"
   ],
-  "homepage": "https://conduyt.app",
+  "homepage": "https://conduyt.com",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/ptaramona/conduyt-mcp-server.git"

package/scripts/coverage-manifest.json

@@ -123,7 +123,7 @@
     {
       "match": "/api/v1/files",
       "status": "planned",
-      "reason": "file listing/metadata is agent-useful; upload stays browser-side"
+      "reason": "file listing/metadata is agent-useful; the direct-upload routes (POST /files/upload/intent and /finalize) are covered, the multipart upload stays browser-side"
     },
     {
       "match": "GET /api/v1/chat/messages/",

package/scripts/coverage-matrix.json

@@ -1,11 +1,11 @@
 {
-  "generatedAt": "2026-10-27T01:28:17.262Z",
-  "toolCount": 366,
-  "totalEndpoints": 1108,
+  "generatedAt": "2026-10-29T23:02:33.248Z",
+  "toolCount": 373,
+  "totalEndpoints": 1118,
   "counts": {
-    "covered": 322,
-    "excluded": 332,
-    "planned": 454,
+    "covered": 327,
+    "excluded": 336,
+    "planned": 455,
     "uncategorized": 0
   },
   "matrix": {
@@ -269,6 +269,10 @@
       "status": "excluded",
       "reason": "raw CSV bytes (up to 50k rows) do not belong in a tool result; conduyt_account_exports_list returns the authed downloadPath for API/CLI retrieval"
     },
+    "POST /api/v1/account/company-name": {
+      "status": "planned",
+      "reason": "account readiness/onboarding surfaces"
+    },
     "GET /api/v1/account/readiness": {
       "status": "planned",
       "reason": "account readiness/onboarding surfaces"
@@ -501,6 +505,10 @@
       "status": "excluded",
       "reason": "interactive session/password/SSO flows; API keys are the MCP auth model"
     },
+    "POST /api/v1/auth/google": {
+      "status": "excluded",
+      "reason": "interactive session/password/SSO flows; API keys are the MCP auth model"
+    },
     "GET /api/v1/auth/google/callback": {
       "status": "excluded",
       "reason": "interactive session/password/SSO flows; API keys are the MCP auth model"
@@ -545,6 +553,10 @@
       "status": "excluded",
       "reason": "interactive session/password/SSO flows; API keys are the MCP auth model"
     },
+    "POST /api/v1/auth/microsoft": {
+      "status": "excluded",
+      "reason": "interactive session/password/SSO flows; API keys are the MCP auth model"
+    },
     "GET /api/v1/auth/microsoft/callback": {
       "status": "excluded",
       "reason": "interactive session/password/SSO flows; API keys are the MCP auth model"
@@ -597,6 +609,14 @@
       "status": "excluded",
       "reason": "interactive session/password/SSO flows; API keys are the MCP auth model"
     },
+    "GET /api/v1/auth/sso/confirm": {
+      "status": "excluded",
+      "reason": "interactive session/password/SSO flows; API keys are the MCP auth model"
+    },
+    "POST /api/v1/auth/sso/confirm": {
+      "status": "excluded",
+      "reason": "interactive session/password/SSO flows; API keys are the MCP auth model"
+    },
     "POST /api/v1/auth/switch-account": {
       "status": "excluded",
       "reason": "interactive session/password/SSO flows; API keys are the MCP auth model"
@@ -1350,6 +1370,18 @@
       "status": "planned",
       "reason": "team chat read/post for agents"
     },
+    "POST /api/v1/chat/channels/:id/upload/finalize": {
+      "status": "covered",
+      "tools": [
+        "conduyt_finalize_chat_upload"
+      ]
+    },
+    "POST /api/v1/chat/channels/:id/upload/intent": {
+      "status": "covered",
+      "tools": [
+        "conduyt_create_chat_upload_intent"
+      ]
+    },
     "GET /api/v1/chat/floor": {
       "status": "planned",
       "reason": "team chat read/post for agents"
@@ -1579,6 +1611,12 @@
         "conduyt_ai_import_contacts"
       ]
     },
+    "GET /api/v1/contacts/count": {
+      "status": "covered",
+      "tools": [
+        "conduyt_count_contacts"
+      ]
+    },
     "GET /api/v1/contacts/dnc-status": {
       "status": "planned",
       "reason": "contact subroutes beyond the core CRUD/search tools"
@@ -2918,23 +2956,35 @@
     },
     "GET /api/v1/files": {
       "status": "planned",
-      "reason": "file listing/metadata is agent-useful; upload stays browser-side"
+      "reason": "file listing/metadata is agent-useful; the direct-upload routes (POST /files/upload/intent and /finalize) are covered, the multipart upload stays browser-side"
     },
     "POST /api/v1/files": {
       "status": "planned",
-      "reason": "file listing/metadata is agent-useful; upload stays browser-side"
+      "reason": "file listing/metadata is agent-useful; the direct-upload routes (POST /files/upload/intent and /finalize) are covered, the multipart upload stays browser-side"
     },
     "DELETE /api/v1/files": {
       "status": "planned",
-      "reason": "file listing/metadata is agent-useful; upload stays browser-side"
+      "reason": "file listing/metadata is agent-useful; the direct-upload routes (POST /files/upload/intent and /finalize) are covered, the multipart upload stays browser-side"
     },
     "GET /api/v1/files/:id/download": {
       "status": "planned",
-      "reason": "file listing/metadata is agent-useful; upload stays browser-side"
+      "reason": "file listing/metadata is agent-useful; the direct-upload routes (POST /files/upload/intent and /finalize) are covered, the multipart upload stays browser-side"
     },
     "POST /api/v1/files/upload": {
       "status": "planned",
-      "reason": "file listing/metadata is agent-useful; upload stays browser-side"
+      "reason": "file listing/metadata is agent-useful; the direct-upload routes (POST /files/upload/intent and /finalize) are covered, the multipart upload stays browser-side"
+    },
+    "POST /api/v1/files/upload/finalize": {
+      "status": "covered",
+      "tools": [
+        "conduyt_finalize_file_upload"
+      ]
+    },
+    "POST /api/v1/files/upload/intent": {
+      "status": "covered",
+      "tools": [
+        "conduyt_create_file_upload_intent"
+      ]
     },
     "GET /api/v1/generated-documents": {
       "status": "planned",