conduyt-mcp 4.21.0 → 4.23.0

package/dist/client.d.ts

@@ -49,6 +49,9 @@ export declare class ConduytClient {
     request(method: string, path: string, body?: unknown, opts?: RequestOptions): Promise<unknown>;
     requestText(method: string, path: string, body?: unknown, opts?: RequestOptions): Promise<string>;
     get(path: string, opts?: RequestOptions): Promise<unknown>;
+    /** Multipart upload (call-flow greeting audio): same auth, timeouts and
+     *  response bounds as JSON calls; the body is a FormData the caller built. */
+    postMultipart(path: string, form: FormData, opts?: RequestOptions): Promise<unknown>;
     post(path: string, body: unknown, opts?: RequestOptions): Promise<unknown>;
     postText(path: string, body: unknown, opts?: RequestOptions): Promise<string>;
     patch(path: string, body: unknown, opts?: RequestOptions): Promise<unknown>;

package/dist/client.js

@@ -235,6 +235,32 @@ export class ConduytClient {
     get(path, opts) {
         return this.request("GET", path, undefined, opts);
     }
+    /** Multipart upload (call-flow greeting audio): same auth, timeouts and
+     *  response bounds as JSON calls; the body is a FormData the caller built. */
+    async postMultipart(path, form, opts = {}) {
+        const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+        const url = `${this.baseUrl}${path}`;
+        let res;
+        try {
+            res = await fetch(url, { method: "POST", headers: { Authorization: `Bearer ${this.apiKey}` }, body: form, signal: AbortSignal.timeout(timeoutMs) });
+        }
+        catch (err) {
+            throw new ConduytApiError({ message: `Conduyt API network error for POST ${path}: ${err?.message ?? String(err)}`, code: err?.name === "TimeoutError" ? "timeout" : "network", retryable: true, cause: err });
+        }
+        const text = await res.text();
+        let json = null;
+        try {
+            json = text ? JSON.parse(text) : null;
+        }
+        catch {
+            json = { raw: text };
+        }
+        if (!res.ok) {
+            const msg = json?.error ?? text.slice(0, 300);
+            throw new ConduytApiError({ message: `Conduyt API ${res.status}: ${msg}`, status: res.status, code: "http", retryable: res.status >= 500 });
+        }
+        return json;
+    }
     post(path, body, opts) {
         return this.request("POST", path, body, opts);
     }

package/dist/tools/automations.js

@@ -30,7 +30,10 @@ export function registerAutomationTools(server, client) {
         graphVersion: z.number().optional().describe("Graph version — 1 (legacy array) or 2 (node graph). Default 1"),
         schedule: z.string().optional().describe("5-field cron expression (required if triggerEvent='scheduled')"),
         scheduleTimezone: z.string().optional().describe("IANA timezone for scheduled triggers (e.g. 'America/Los_Angeles')"),
-        triggerConditions: z.any().optional().describe("Conditions that must match for the trigger to fire"),
+        triggerConditions: z
+            .any()
+            .optional()
+            .describe("Conditions that must match for the trigger to fire. Scalar filters like tagId/pipelineId/bookingPageIds, plus per-event config: for 'contact.untouched' pass { untouchedDays: N } (integer 1-365) to fire once per quiet episode when a contact has had no outreach for N+ days — without it the trigger is the minutes-scale speed-to-lead alert. Unknown keys on native events are rejected at create/publish (422)."),
     }, async (params) => {
         const result = await client.post("/api/v1/automations", params);
         return formatResult(result);
@@ -40,6 +43,10 @@ export function registerAutomationTools(server, client) {
         name: z.string().optional().describe("Updated name"),
         description: z.string().optional().describe("Updated description"),
         triggerEvent: z.string().optional().describe("Updated trigger event"),
+        triggerConditions: z
+            .any()
+            .optional()
+            .describe("Updated trigger conditions (replaces the object). Same keys as create — e.g. { untouchedDays: 7 } on 'contact.untouched'. (#16 tri-surface parity: the UI and API could set this; MCP could not.)"),
         isActive: z.boolean().optional().describe("Enable or disable the automation"),
         actions: z.any().optional().describe("Updated actions graph"),
         schedule: z.string().optional().describe("Updated cron schedule"),
@@ -50,13 +57,29 @@ export function registerAutomationTools(server, client) {
             .optional()
             .describe("What a NEW trigger does when the contact is already mid-sequence: 'keep' (default — skip, existing run keeps its schedule) or 'restart' (cancel the parked run and re-enroll from step 1)"),
     }, async ({ id, ...updates }) => {
-        const result = await client.patch(`/api/v1/automations/${id}`, updates);
+        // (Conduyt Sentry r58–r60 parity) a save that replaces the actions of a LIVE workflow must carry the
+        // configRevision it was based on — fetch it first so the server can refuse a stale overwrite (409)
+        let body = updates;
+        if (updates.actions !== undefined && body.expectedConfigRevision === undefined) {
+            const current = (await client.get(`/api/v1/automations/${id}`));
+            if (typeof current?.configRevision === "number")
+                body = { ...body, expectedConfigRevision: current.configRevision };
+        }
+        const result = await client.patch(`/api/v1/automations/${id}`, body);
         return formatResult(result);
     });
-    server.tool("conduyt_publish_automation", "Publish an automation — copies the draft actions to the live published version. The automation must have actions defined.", {
+    server.tool("conduyt_publish_automation", "Publish an automation — copies the draft actions to the live published version. The automation must have actions defined. The publish is bound to the draft revision you reviewed (fetched automatically unless you pass expectedConfigRevision).", {
         id: z.string().describe("Automation UUID"),
-    }, async ({ id }) => {
-        const result = await client.post(`/api/v1/automations/${id}/publish`, {});
+        expectedConfigRevision: z.number().int().nonnegative().optional().describe("The configRevision of the draft you reviewed (from conduyt_get_automation); fetched automatically when omitted"),
+    }, async ({ id, expectedConfigRevision }) => {
+        // (Conduyt Sentry r59 parity) POST /publish requires the reviewed revision — an edit that landed after the
+        // review is refused (409) instead of going live unreviewed
+        let revision = expectedConfigRevision;
+        if (revision === undefined) {
+            const current = (await client.get(`/api/v1/automations/${id}`));
+            revision = typeof current?.configRevision === "number" ? current.configRevision : undefined;
+        }
+        const result = await client.post(`/api/v1/automations/${id}/publish`, { expectedConfigRevision: revision });
         return formatResult(result);
     });
     server.tool("conduyt_resolve_names", "Resolve human-readable names to UUIDs. Use this before creating automations — converts tag names, pipeline names, user names, and custom field labels to their UUIDs.", {

package/dist/tools/call-flows.js

@@ -32,7 +32,7 @@ export function registerCallFlowTools(server, client) {
     server.tool("conduyt_create_call_flow", "Create a call flow. Starts as a DRAFT — edit the graph, validate, then publish to make it live on its number.", {
         name: z.string().describe("Flow name"),
         phoneNumber: z.string().optional().describe("E.164 number this flow answers (must belong to the account)"),
-        draftGraph: flowGraphSchema.optional().describe("Initial flow graph — MUST have a string entryId and a nodes array (anything else is silently replaced by a default voicemail flow server-side)"),
+        draftGraph: flowGraphSchema.optional().describe("Initial flow graph — MUST have a string entryId and a nodes array (anything else is silently replaced by a default voicemail flow server-side). Node kinds: entry, greeting, agent, group (queue: holdSeconds/pressOneVoicemail/repeatRing = queue mode), menu (options[{digit,label,next}], next = no-choice path), timing (hours[{day,start,end}], timezone, next = during hours, closedNext = outside hours), function (functionId = a registered function endpoint id, timeoutSeconds 2-8, next = success, failNext = failure; the JSON response's top-level scalars become call attributes), set_attributes (assignments[{key,value}] — value may use {{contact.firstName}} / {{call.from}} / {{attributes.x}}), branch (attribute, op equals|not_equals|contains|exists|not_exists, value, next = match, elseNext = otherwise), voicemail, forward, hangup. Spoken text in greeting/menu/voicemail/hangup may use {{contact.firstName|there}}, {{call.from}}, {{attributes.key}} (publish refuses unknown references). Every branch must reach an ending — publish refuses otherwise."),
     }, async (params) => {
         const result = await client.post("/api/v1/call-flows", params);
         return formatResult(result);
@@ -41,7 +41,7 @@ export function registerCallFlowTools(server, client) {
         id: z.string().describe("Call flow UUID"),
         name: z.string().optional().describe("New name"),
         phoneNumber: z.string().optional().describe("New E.164 number"),
-        draftGraph: flowGraphSchema.optional().describe("Replacement draft graph — MUST have a string entryId and a nodes array; REQUIRES expectedDraftRevision"),
+        draftGraph: flowGraphSchema.optional().describe("Replacement draft graph — MUST have a string entryId and a nodes array; REQUIRES expectedDraftRevision. Kinds: entry, greeting, agent, group (queue.repeatRing = queue mode), menu (options[{digit,label,next}]), timing (hours, timezone, next/closedNext), voicemail, forward, hangup; every branch must reach an ending."),
         expectedDraftRevision: z.number().int().min(0).optional().describe("draftRevision from your last conduyt_get_call_flow read (REQUIRED when replacing draftGraph)"),
     }, async ({ id, ...updates }) => {
         if (updates.draftGraph !== undefined && updates.expectedDraftRevision === undefined) {
@@ -139,4 +139,64 @@ export function registerCallFlowTools(server, client) {
         const result = await client.post("/api/v1/ring-groups/release-number", params);
         return formatResult(result);
     });
+    // ── Rollout fix 2026-08-24: numbers, Twilio wiring, greeting audio ──────
+    server.tool("conduyt_list_call_flow_numbers", "The voice numbers this workspace owns in Twilio, each with what answers it in Conduyt today (claimedBy: call flow / ring group / main line) and whether its Twilio voice webhook is already wired to Conduyt. Use it to pick a free number for a flow.", {}, async () => {
+        const result = await client.get("/api/v1/call-flows/numbers");
+        return formatResult(result);
+    });
+    server.tool("conduyt_get_call_flow_wiring", "Twilio's truth for a call flow's number: the voice webhook Twilio has right now vs the inboundUrl Conduyt needs, and whether they match (wired). A published flow that is NOT wired does not receive calls.", { id: z.string().describe("Call flow UUID") }, async ({ id }) => {
+        const result = await client.get(`/api/v1/call-flows/${id}/wiring`);
+        return formatResult(result);
+    });
+    server.tool("conduyt_wire_call_flow_number", "Point the flow's number's Twilio voice webhook at Conduyt (the same step publish performs; use it when publish reported wiring.error, or after changing the number in Twilio). Admin. Returns the resulting wiring state.", { id: z.string().describe("Call flow UUID") }, async ({ id }) => {
+        const result = await client.post(`/api/v1/call-flows/${id}/wiring`, {});
+        return formatResult(result);
+    });
+    server.tool("conduyt_release_call_flow_tombstone", "Release a number still held by a deleted call flow's tombstone: restores the number's pre-Conduyt Twilio configuration (verified) and lets the tombstone go. Admin. 404 when no tombstone holds the number; 409 when Conduyt still answers it and no prior configuration is known.", { phoneNumber: z.string().describe("E.164 number held by the tombstone") }, async ({ phoneNumber }) => {
+        const result = await client.post(`/api/v1/call-flows/tombstones/release`, { phoneNumber });
+        return formatResult(result);
+    });
+    server.tool("conduyt_upload_call_flow_audio", "Upload a greeting recording (mp3, wav or m4a, up to 10 MB) for use in a greeting node's audioUrl. Pass the file as base64. Returns { url } — put it on the greeting node via conduyt_update_call_flow.", {
+        filename: z.string().describe("File name with extension, e.g. greeting.mp3"),
+        contentBase64: z.string().describe("The file bytes, base64-encoded"),
+        mimeType: z.string().optional().describe("audio/mpeg | audio/wav | audio/mp4 (inferred from the extension when omitted)"),
+    }, async ({ filename, contentBase64, mimeType }) => {
+        const ext = filename.toLowerCase().split(".").pop() ?? "";
+        const type = mimeType ?? { mp3: "audio/mpeg", wav: "audio/wav", m4a: "audio/mp4" }[ext] ?? "application/octet-stream";
+        let bytes;
+        try {
+            bytes = Buffer.from(contentBase64, "base64");
+        }
+        catch {
+            return formatToolError("contentBase64 is not valid base64");
+        }
+        if (bytes.byteLength === 0)
+            return formatToolError("The file is empty");
+        if (bytes.byteLength > 10 * 1024 * 1024)
+            return formatToolError("The recording exceeds 10 MB");
+        const form = new FormData();
+        form.append("file", new Blob([Uint8Array.from(bytes)], { type }), filename);
+        try {
+            const result = await client.postMultipart("/api/v1/call-flows/audio", form, { timeoutMs: 60_000 });
+            return formatResult(result);
+        }
+        catch (err) {
+            return formatToolError(err.message);
+        }
+    });
+    // ── #32 Call Flows function endpoints (Amazon Connect "Invoke Lambda" parity) ──
+    server.tool("conduyt_list_call_flow_functions", "List the account's call-flow function endpoints — the HTTPS endpoints a flow's \"Call a function\" step may invoke mid-call (settings scope).", {}, async () => formatResult(await client.get("/api/v1/call-flows/functions")));
+    server.tool("conduyt_create_call_flow_function", "Register a call-flow function endpoint (admin). Conduyt POSTs a signed JSON snapshot of the call (X-Conduyt-Signature = sha256 HMAC of `${timestamp}.${body}` with the secret, X-Conduyt-Timestamp, Idempotency-Key callSid:version:nodeId); the endpoint replies 200 with a JSON object whose top-level strings/numbers/booleans become call attributes. https only, public hosts only, no redirects, 2-8 s timeout, 64 KB response cap. The secret is write-only.", {
+        name: z.string().min(1).max(60).describe("Display name (unique per account)"),
+        url: z.string().url().describe("HTTPS endpoint URL (ports 443/8443 only, public host)"),
+        secret: z.string().min(16).max(200).describe("HMAC signing secret the endpoint will verify with"),
+    }, async (params) => formatResult(await client.post("/api/v1/call-flows/functions", params)));
+    server.tool("conduyt_update_call_flow_function", "Rename a call-flow function endpoint, change its URL, or rotate its secret (admin).", {
+        id: z.string().describe("Function UUID"),
+        name: z.string().min(1).max(60).optional(),
+        url: z.string().url().optional(),
+        secret: z.string().min(16).max(200).optional().describe("New signing secret (rotation)"),
+    }, async ({ id, ...body }) => formatResult(await client.patch(`/api/v1/call-flows/functions/${id}`, body)));
+    server.tool("conduyt_delete_call_flow_function", "Remove a call-flow function endpoint (admin). Refused while a PUBLISHED flow still calls it — edit and republish that flow first.", { id: z.string().describe("Function UUID") }, async ({ id }) => formatResult(await client.del(`/api/v1/call-flows/functions/${id}`)));
+    server.tool("conduyt_test_call_flow_function", "Send a real signed test call (callSid TEST, a sample caller) to a function endpoint and report the status, latency and the attributes it would save.", { id: z.string().describe("Function UUID") }, async ({ id }) => formatResult(await client.post(`/api/v1/call-flows/functions/${id}/test`, {})));
 }

package/dist/tools/contacts.js

@@ -51,6 +51,7 @@ export function registerContactTools(server, client) {
         firstName: z.string().optional().describe("First name"),
         lastName: z.string().optional().describe("Last name"),
         phone: z.string().optional().describe("Phone number"),
+        timezone: z.string().optional().describe("IANA timezone of the lead (e.g. America/Chicago). Omit to let Conduyt derive it from ZIP → phone area code → state (the stored contact carries timezone + timezoneSource)."),
         company: z.string().optional().describe("Company name"),
         source: z.string().trim().min(1).max(100).optional().describe("Lead source (e.g. 'website', 'referral', 'import') — FIRST-WRITE-WINS acquisition truth for the lead; later inbound events do not overwrite it. 1-100 chars."),
         masterStatus: z.string().trim().min(1).max(40).optional().describe("Lifecycle status of the LEAD (master record), distinct from any deal's status: 'open' (default), 'won', 'lost', 'abandoned', 'disqualified', or an account-defined custom status. A terminal status (won/lost/abandoned/disqualified) SILENCES all outbound automations for this contact — drips, sequences, and scheduled sends stop. Use conduyt_get_lifecycle_settings to see the account's configured statuses."),
@@ -69,6 +70,7 @@ export function registerContactTools(server, client) {
         firstName: z.string().optional().describe("Updated first name"),
         lastName: z.string().optional().describe("Updated last name"),
         phone: z.string().optional().describe("Updated phone"),
+        timezone: z.string().nullable().optional().describe("IANA timezone override (e.g. America/Denver); pass null to clear the override and re-derive from ZIP → area code → state"),
         company: z.string().optional().describe("Updated company name"),
         source: z.string().trim().min(1).max(100).nullable().optional().describe("Correct the lead's first-touch source (normally first-write-wins and set at creation — update only to FIX bad attribution). Pass null to clear."),
         masterStatus: z.string().trim().min(1).max(40).optional().describe("Lifecycle status of the LEAD (master record), distinct from any deal's status: 'open' (default), 'won', 'lost', 'abandoned', 'disqualified', or an account-defined custom status. A terminal status (won/lost/abandoned/disqualified) SILENCES all outbound automations for this contact — drips, sequences, and scheduled sends stop. Use conduyt_get_lifecycle_settings to see the account's configured statuses."),

package/dist/tools/custom-fields.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { formatResult } from "../client.js";
+import { ConduytApiError, formatResult } from "../client.js";
 export function registerCustomFieldTools(server, client) {
     server.tool("conduyt_list_custom_fields", "List custom field definitions. Filter by entity type (contact, deal, or company) to see available fields.", {
         entityType: z.enum(["contact", "deal", "company"]).optional().describe("Filter by entity type"),
@@ -45,4 +45,36 @@ export function registerCustomFieldTools(server, client) {
         const result = await client.del(`/api/v1/custom-fields/${id}`);
         return formatResult(result);
     });
+    // ─── account default columns for the contacts list (admin-managed; applied to every user on their next visit) ───
+    server.tool("conduyt_get_contact_table_defaults", "Read the account-level DEFAULT COLUMNS for the Contacts list: the column ids every user gets merged into their own layout on their next visit (each version once; users can rearrange afterwards). null = no account default (users see the built-in layout). Reads /api/v1/settings (settings:view).", {}, async () => {
+        const result = (await client.get("/api/v1/settings"));
+        const raw = result?.data?.contactTableDefaults;
+        return formatResult({ data: raw && typeof raw === "object" ? raw : null, revision: raw && typeof raw === "object" && typeof raw.revision === "string" ? raw.revision : "0", columnIds: ["name", "email", "phone", "company", "source", "tags", "score", "intent", "stage", "createdAt", "lastActivity", "assignedTo", "address", "city", "state", "zip", "custom:<fieldKey>"] });
+    });
+    server.tool("conduyt_set_contact_table_defaults", "Set the account-level DEFAULT COLUMNS for the Contacts list (settings:edit). Every user's saved layout gains the columns it lacks on their next visit (appended; nothing they already show moves); at most 8 ids; custom fields as 'custom:<fieldKey>' (the key must exist). The write is revision-fenced: by default the tool reads the current row and names its `revision` (version@epoch); pass expectedRevision to fence on a row you read earlier. A concurrent change answers { conflict: true, current } — re-read and decide, nothing was overwritten.", {
+        columns: z
+            .array(z.string().min(1).max(120))
+            .max(8)
+            .describe("Column ids in display order, e.g. ['createdAt','name','email','phone','company','source','tags','stage','lastActivity']; custom fields as 'custom:<fieldKey>'"),
+        expectedRevision: z.string().min(1).max(80).optional().describe("The row `revision` this set was derived from (version@epoch, or '0' when never configured). Omitted: the tool reads the current row and uses its revision."),
+    }, async (params) => {
+        // (default columns r10, Codex r9 m1) tri-surface parity with the browser: the PATCH contract REQUIRES the server revision
+        const readRevision = async () => {
+            const result = (await client.get("/api/v1/settings"));
+            const raw = result?.data?.contactTableDefaults;
+            return raw && typeof raw === "object" && typeof raw.revision === "string" && raw.revision ? raw.revision : "0";
+        };
+        const expectedRevision = params.expectedRevision ?? (await readRevision());
+        try {
+            const result = await client.patch("/api/v1/settings", { contactTableDefaults: { columns: params.columns, expectedRevision } });
+            return formatResult(result);
+        }
+        catch (err) {
+            if (err instanceof ConduytApiError && err.status === 409) {
+                const current = (await client.get("/api/v1/settings"));
+                return formatResult({ conflict: true, message: err.message, expectedRevision, current: current?.data?.contactTableDefaults ?? null, hint: "the account defaults changed since that revision was read; nothing was overwritten — re-read `current`, merge your intent, and call again with its revision" });
+            }
+            throw err;
+        }
+    });
 }

package/dist/tools/lifecycle.js

@@ -1,5 +1,24 @@
 import { z } from "zod";
-import { formatResult } from "../client.js";
+import { ConduytApiError, formatResult } from "../client.js";
+/** (default columns r18, Codex r17 h1) every general-settings PATCH names the revision it loaded: read it, save, and on a 409 hand
+ *  the conflict back with the current settings so the caller re-derives its change (tri-surface parity with the browser) */
+async function patchGeneralSettings(client, body) {
+    const read = async () => {
+        const result = (await client.get("/api/v1/settings"));
+        return typeof result?.data?.settingsRevision === "string" ? result.data.settingsRevision : null;
+    };
+    const expectedSettingsRevision = await read();
+    try {
+        return formatResult(await client.patch("/api/v1/settings", { ...body, ...(expectedSettingsRevision ? { expectedSettingsRevision } : {}) }));
+    }
+    catch (err) {
+        if (err instanceof ConduytApiError && err.status === 409) {
+            const current = (await client.get("/api/v1/settings"));
+            return formatResult({ conflict: true, message: err.message, expectedSettingsRevision, current: current?.data ?? null, hint: "the account settings changed since that revision was read — re-derive the change from `current` and call again" });
+        }
+        throw err;
+    }
+}
 /**
  * Lifecycle v2 settings (master lead status + intake deals). The master lead
  * is the acquisition truth (first-write-wins source, one lifecycle status);
@@ -48,17 +67,11 @@ export function registerLifecycleTools(server, client) {
             .enum(["always", "if_no_open", "never"])
             .optional()
             .describe("Policy for contacts that already exist (default 'if_no_open')"),
-    }, async (params) => {
-        const result = await client.patch("/api/v1/settings", { intakeDeals: params });
-        return formatResult(result);
-    });
+    }, async (params) => patchGeneralSettings(client, { intakeDeals: params }));
     server.tool("conduyt_update_master_statuses", "Set the account's custom lead lifecycle statuses. The five defaults (open, won, lost, abandoned, disqualified) always exist and cannot be removed; this REPLACES the custom list on top of them (max 20 names, 1-40 chars each, letters/numbers/spaces/-/_ only). Terminal statuses stop all outbound automation for a contact. Requires settings:edit.", {
         statuses: z
             .array(masterStatusName)
             .max(20)
             .describe("Custom status names to make available alongside the defaults, e.g. ['nurturing', 'in underwriting']"),
-    }, async ({ statuses }) => {
-        const result = await client.patch("/api/v1/settings", { masterStatuses: statuses });
-        return formatResult(result);
-    });
+    }, async ({ statuses }) => patchGeneralSettings(client, { masterStatuses: statuses }));
 }

package/dist/tools/workflow-sandbox.js

@@ -77,7 +77,9 @@ export function registerWorkflowSandboxTools(server, client) {
                 message: "Workflow has warnings and allowWarnings is false. Fix warnings or set allowWarnings to true.",
             });
         }
-        const published = await client.post(`/api/v1/automations/${automationId}/publish`, {});
+        // (Conduyt Sentry r59 parity) the publish carries the revision of the draft that was just validated
+        const current = (await client.get(`/api/v1/automations/${automationId}`));
+        const published = await client.post(`/api/v1/automations/${automationId}/publish`, { expectedConfigRevision: typeof current?.configRevision === "number" ? current.configRevision : undefined });
         return formatResult({
             promoted: true,
             warnings: hasWarnings ? validation.warnings : [],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "conduyt-mcp",
-  "version": "4.21.0",
+  "version": "4.23.0",
   "description": "MCP server for Conduyt CRM — expose CRM operations as AI-accessible tools",
   "type": "module",
   "main": "dist/index.js",

package/scripts/coverage-manifest.json

@@ -5,6 +5,11 @@
     "planned": "callable in principle; a typed tool is wanted but not built yet"
   },
   "rules": [
+    {
+      "match": "GET /api/v1/call-flows/functions/:id",
+      "status": "planned",
+      "reason": "single-function read; the list tool plus update/delete/test exist, a typed get is wanted but not built (4.23.0)"
+    },
     {
       "match": "/api/health",
       "status": "excluded",
@@ -509,6 +514,11 @@
       "match": "POST /api/v1/call-flows/audio",
       "status": "excluded",
       "reason": "multipart file upload (IVR audio) - not expressible as a text MCP tool; agents reference existing audio by id from conduyt_get_call_flow"
+    },
+    {
+      "match": "GET /api/v1/ops/capacity",
+      "status": "planned",
+      "reason": "operator capacity dashboard (#51, shipped 2026-09) \u2014 read-only queue/park telemetry; a typed conduyt_capacity_snapshot tool is agent-relevant for throughput questions"
     }
   ]
 }

package/scripts/coverage-matrix.json

@@ -1,11 +1,11 @@
 {
-  "generatedAt": "2026-08-23T13:00:42.998Z",
-  "toolCount": 189,
-  "totalEndpoints": 872,
+  "generatedAt": "2026-09-04T21:17:21.600Z",
+  "toolCount": 201,
+  "totalEndpoints": 893,
   "counts": {
-    "covered": 177,
-    "excluded": 256,
-    "planned": 439,
+    "covered": 186,
+    "excluded": 263,
+    "planned": 444,
     "uncategorized": 0
   },
   "matrix": {
@@ -569,6 +569,8 @@
       "status": "covered",
       "tools": [
         "conduyt_get_automation",
+        "conduyt_update_automation",
+        "conduyt_publish_automation",
         "conduyt_workflow_promote"
       ]
     },
@@ -1044,16 +1046,74 @@
         "conduyt_validate_call_flow"
       ]
     },
+    "GET /api/v1/call-flows/:id/wiring": {
+      "status": "covered",
+      "tools": [
+        "conduyt_get_call_flow_wiring"
+      ]
+    },
+    "POST /api/v1/call-flows/:id/wiring": {
+      "status": "covered",
+      "tools": [
+        "conduyt_wire_call_flow_number"
+      ]
+    },
     "POST /api/v1/call-flows/audio": {
       "status": "excluded",
       "reason": "multipart file upload (IVR audio) - not expressible as a text MCP tool; agents reference existing audio by id from conduyt_get_call_flow"
     },
+    "GET /api/v1/call-flows/functions": {
+      "status": "covered",
+      "tools": [
+        "conduyt_list_call_flow_functions"
+      ]
+    },
+    "POST /api/v1/call-flows/functions": {
+      "status": "covered",
+      "tools": [
+        "conduyt_create_call_flow_function"
+      ]
+    },
+    "GET /api/v1/call-flows/functions/:id": {
+      "status": "planned",
+      "reason": "single-function read; the list tool plus update/delete/test exist, a typed get is wanted but not built (4.23.0)"
+    },
+    "PATCH /api/v1/call-flows/functions/:id": {
+      "status": "covered",
+      "tools": [
+        "conduyt_update_call_flow_function"
+      ]
+    },
+    "DELETE /api/v1/call-flows/functions/:id": {
+      "status": "covered",
+      "tools": [
+        "conduyt_delete_call_flow_function"
+      ]
+    },
+    "POST /api/v1/call-flows/functions/:id/test": {
+      "status": "covered",
+      "tools": [
+        "conduyt_test_call_flow_function"
+      ]
+    },
+    "GET /api/v1/call-flows/numbers": {
+      "status": "covered",
+      "tools": [
+        "conduyt_list_call_flow_numbers"
+      ]
+    },
     "GET /api/v1/call-flows/roster": {
       "status": "covered",
       "tools": [
         "conduyt_call_flow_roster"
       ]
     },
+    "POST /api/v1/call-flows/tombstones/release": {
+      "status": "covered",
+      "tools": [
+        "conduyt_release_call_flow_tombstone"
+      ]
+    },
     "GET /api/v1/calls": {
       "status": "covered",
       "tools": [
@@ -1417,6 +1477,14 @@
       "status": "excluded",
       "reason": "CRON_SECRET-gated infrastructure jobs; never key-callable"
     },
+    "GET /api/v1/cron/capacity-monitor": {
+      "status": "excluded",
+      "reason": "CRON_SECRET-gated infrastructure jobs; never key-callable"
+    },
+    "POST /api/v1/cron/capacity-monitor": {
+      "status": "excluded",
+      "reason": "CRON_SECRET-gated infrastructure jobs; never key-callable"
+    },
     "GET /api/v1/cron/capture-rfc-ids": {
       "status": "excluded",
       "reason": "CRON_SECRET-gated infrastructure jobs; never key-callable"
@@ -1561,6 +1629,14 @@
       "status": "excluded",
       "reason": "CRON_SECRET-gated infrastructure jobs; never key-callable"
     },
+    "GET /api/v1/cron/process-unattended-leads": {
+      "status": "excluded",
+      "reason": "CRON_SECRET-gated infrastructure jobs; never key-callable"
+    },
+    "GET /api/v1/cron/process-wake-jobs": {
+      "status": "excluded",
+      "reason": "CRON_SECRET-gated infrastructure jobs; never key-callable"
+    },
     "GET /api/v1/cron/prune-screen-share-sessions": {
       "status": "excluded",
       "reason": "CRON_SECRET-gated infrastructure jobs; never key-callable"
@@ -1597,6 +1673,10 @@
       "status": "excluded",
       "reason": "CRON_SECRET-gated infrastructure jobs; never key-callable"
     },
+    "GET /api/v1/cron/reconcile-voice-releases": {
+      "status": "excluded",
+      "reason": "CRON_SECRET-gated infrastructure jobs; never key-callable"
+    },
     "GET /api/v1/cron/recover-booking-side-effects": {
       "status": "excluded",
       "reason": "CRON_SECRET-gated infrastructure jobs; never key-callable"
@@ -1799,6 +1879,10 @@
       "status": "planned",
       "reason": "deal subroutes beyond core CRUD (history, files, links)"
     },
+    "GET /api/v1/deals/:id/handoff-files/:fileId/download": {
+      "status": "planned",
+      "reason": "deal subroutes beyond core CRUD (history, files, links)"
+    },
     "GET /api/v1/deals/:id/history": {
       "status": "planned",
       "reason": "deal subroutes beyond core CRUD (history, files, links)"
@@ -2685,6 +2769,10 @@
       "status": "planned",
       "reason": "notification surfaces"
     },
+    "GET /api/v1/ops/capacity": {
+      "status": "planned",
+      "reason": "operator capacity dashboard (#51, shipped 2026-09) — read-only queue/park telemetry; a typed conduyt_capacity_snapshot tool is agent-relevant for throughput questions"
+    },
     "GET /api/v1/phone-numbers": {
       "status": "planned",
       "reason": "phone number inventory"
@@ -3200,14 +3288,15 @@
     "GET /api/v1/settings": {
       "status": "covered",
       "tools": [
+        "conduyt_get_contact_table_defaults",
+        "conduyt_set_contact_table_defaults",
         "conduyt_get_lifecycle_settings"
       ]
     },
     "PATCH /api/v1/settings": {
       "status": "covered",
       "tools": [
-        "conduyt_update_intake_deals",
-        "conduyt_update_master_statuses"
+        "conduyt_set_contact_table_defaults"
       ]
     },
     "GET /api/v1/settings/ai": {
@@ -3262,6 +3351,14 @@
       "status": "planned",
       "reason": "account settings read/update surfaces"
     },
+    "GET /api/v1/settings/operations": {
+      "status": "planned",
+      "reason": "account settings read/update surfaces"
+    },
+    "POST /api/v1/settings/operations": {
+      "status": "planned",
+      "reason": "account settings read/update surfaces"
+    },
     "GET /api/v1/settings/scheduled-export": {
       "status": "covered",
       "tools": [
@@ -3787,6 +3884,14 @@
       "status": "excluded",
       "reason": "inbound provider callback receivers (Twilio/Resend/etc.), not client-callable"
     },
+    "GET /api/v1/webhooks/voice/fallback": {
+      "status": "excluded",
+      "reason": "inbound provider callback receivers (Twilio/Resend/etc.), not client-callable"
+    },
+    "POST /api/v1/webhooks/voice/fallback": {
+      "status": "excluded",
+      "reason": "inbound provider callback receivers (Twilio/Resend/etc.), not client-callable"
+    },
     "POST /api/v1/webhooks/voice/flow-step": {
       "status": "excluded",
       "reason": "inbound provider callback receivers (Twilio/Resend/etc.), not client-callable"