conduyt-mcp 4.22.0 → 4.23.1

package/dist/tools/automations.js

@@ -57,13 +57,29 @@ export function registerAutomationTools(server, client) {
             .optional()
             .describe("What a NEW trigger does when the contact is already mid-sequence: 'keep' (default — skip, existing run keeps its schedule) or 'restart' (cancel the parked run and re-enroll from step 1)"),
     }, async ({ id, ...updates }) => {
-        const result = await client.patch(`/api/v1/automations/${id}`, updates);
+        // (Conduyt Sentry r58–r60 parity) a save that replaces the actions of a LIVE workflow must carry the
+        // configRevision it was based on — fetch it first so the server can refuse a stale overwrite (409)
+        let body = updates;
+        if (updates.actions !== undefined && body.expectedConfigRevision === undefined) {
+            const current = (await client.get(`/api/v1/automations/${id}`));
+            if (typeof current?.configRevision === "number")
+                body = { ...body, expectedConfigRevision: current.configRevision };
+        }
+        const result = await client.patch(`/api/v1/automations/${id}`, body);
         return formatResult(result);
     });
-    server.tool("conduyt_publish_automation", "Publish an automation — copies the draft actions to the live published version. The automation must have actions defined.", {
+    server.tool("conduyt_publish_automation", "Publish an automation — copies the draft actions to the live published version. The automation must have actions defined. The publish is bound to the draft revision you reviewed (fetched automatically unless you pass expectedConfigRevision).", {
         id: z.string().describe("Automation UUID"),
-    }, async ({ id }) => {
-        const result = await client.post(`/api/v1/automations/${id}/publish`, {});
+        expectedConfigRevision: z.number().int().nonnegative().optional().describe("The configRevision of the draft you reviewed (from conduyt_get_automation); fetched automatically when omitted"),
+    }, async ({ id, expectedConfigRevision }) => {
+        // (Conduyt Sentry r59 parity) POST /publish requires the reviewed revision — an edit that landed after the
+        // review is refused (409) instead of going live unreviewed
+        let revision = expectedConfigRevision;
+        if (revision === undefined) {
+            const current = (await client.get(`/api/v1/automations/${id}`));
+            revision = typeof current?.configRevision === "number" ? current.configRevision : undefined;
+        }
+        const result = await client.post(`/api/v1/automations/${id}/publish`, { expectedConfigRevision: revision });
         return formatResult(result);
     });
     server.tool("conduyt_resolve_names", "Resolve human-readable names to UUIDs. Use this before creating automations — converts tag names, pipeline names, user names, and custom field labels to their UUIDs.", {

package/dist/tools/call-flows.js

@@ -32,7 +32,7 @@ export function registerCallFlowTools(server, client) {
     server.tool("conduyt_create_call_flow", "Create a call flow. Starts as a DRAFT — edit the graph, validate, then publish to make it live on its number.", {
         name: z.string().describe("Flow name"),
         phoneNumber: z.string().optional().describe("E.164 number this flow answers (must belong to the account)"),
-        draftGraph: flowGraphSchema.optional().describe("Initial flow graph — MUST have a string entryId and a nodes array (anything else is silently replaced by a default voicemail flow server-side). Node kinds: entry, greeting, agent, group (queue: holdSeconds/pressOneVoicemail/repeatRing = queue mode), menu (options[{digit,label,next}], next = no-choice path), timing (hours[{day,start,end}], timezone, next = during hours, closedNext = outside hours), voicemail, forward, hangup. Every branch must reach an ending — publish refuses otherwise."),
+        draftGraph: flowGraphSchema.optional().describe("Initial flow graph — MUST have a string entryId and a nodes array (anything else is silently replaced by a default voicemail flow server-side). Node kinds: entry, greeting, agent, group (queue: holdSeconds/pressOneVoicemail/repeatRing = queue mode), menu (options[{digit,label,next}], next = no-choice path), timing (hours[{day,start,end}], timezone, next = during hours, closedNext = outside hours), function (functionId = a registered function endpoint id, timeoutSeconds 2-8, next = success, failNext = failure; the JSON response's top-level scalars become call attributes), set_attributes (assignments[{key,value}] — value may use {{contact.firstName}} / {{call.from}} / {{attributes.x}}), branch (attribute, op equals|not_equals|contains|exists|not_exists, value, next = match, elseNext = otherwise), voicemail, forward, hangup. Spoken text in greeting/menu/voicemail/hangup may use {{contact.firstName|there}}, {{call.from}}, {{attributes.key}} (publish refuses unknown references). Every branch must reach an ending — publish refuses otherwise."),
     }, async (params) => {
         const result = await client.post("/api/v1/call-flows", params);
         return formatResult(result);
@@ -184,4 +184,19 @@ export function registerCallFlowTools(server, client) {
             return formatToolError(err.message);
         }
     });
+    // ── #32 Call Flows function endpoints (Amazon Connect "Invoke Lambda" parity) ──
+    server.tool("conduyt_list_call_flow_functions", "List the account's call-flow function endpoints — the HTTPS endpoints a flow's \"Call a function\" step may invoke mid-call (settings scope).", {}, async () => formatResult(await client.get("/api/v1/call-flows/functions")));
+    server.tool("conduyt_create_call_flow_function", "Register a call-flow function endpoint (admin). Conduyt POSTs a signed JSON snapshot of the call (X-Conduyt-Signature = sha256 HMAC of `${timestamp}.${body}` with the secret, X-Conduyt-Timestamp, Idempotency-Key callSid:version:nodeId); the endpoint replies 200 with a JSON object whose top-level strings/numbers/booleans become call attributes. https only, public hosts only, no redirects, 2-8 s timeout, 64 KB response cap. The secret is write-only.", {
+        name: z.string().min(1).max(60).describe("Display name (unique per account)"),
+        url: z.string().url().describe("HTTPS endpoint URL (ports 443/8443 only, public host)"),
+        secret: z.string().min(16).max(200).describe("HMAC signing secret the endpoint will verify with"),
+    }, async (params) => formatResult(await client.post("/api/v1/call-flows/functions", params)));
+    server.tool("conduyt_update_call_flow_function", "Rename a call-flow function endpoint, change its URL, or rotate its secret (admin).", {
+        id: z.string().describe("Function UUID"),
+        name: z.string().min(1).max(60).optional(),
+        url: z.string().url().optional(),
+        secret: z.string().min(16).max(200).optional().describe("New signing secret (rotation)"),
+    }, async ({ id, ...body }) => formatResult(await client.patch(`/api/v1/call-flows/functions/${id}`, body)));
+    server.tool("conduyt_delete_call_flow_function", "Remove a call-flow function endpoint (admin). Refused while a PUBLISHED flow still calls it — edit and republish that flow first.", { id: z.string().describe("Function UUID") }, async ({ id }) => formatResult(await client.del(`/api/v1/call-flows/functions/${id}`)));
+    server.tool("conduyt_test_call_flow_function", "Send a real signed test call (callSid TEST, a sample caller) to a function endpoint and report the status, latency and the attributes it would save.", { id: z.string().describe("Function UUID") }, async ({ id }) => formatResult(await client.post(`/api/v1/call-flows/functions/${id}/test`, {})));
 }

package/dist/tools/custom-fields.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { formatResult } from "../client.js";
+import { ConduytApiError, formatResult } from "../client.js";
 export function registerCustomFieldTools(server, client) {
     server.tool("conduyt_list_custom_fields", "List custom field definitions. Filter by entity type (contact, deal, or company) to see available fields.", {
         entityType: z.enum(["contact", "deal", "company"]).optional().describe("Filter by entity type"),
@@ -45,4 +45,36 @@ export function registerCustomFieldTools(server, client) {
         const result = await client.del(`/api/v1/custom-fields/${id}`);
         return formatResult(result);
     });
+    // ─── account default columns for the contacts list (admin-managed; applied to every user on their next visit) ───
+    server.tool("conduyt_get_contact_table_defaults", "Read the account-level DEFAULT COLUMNS for the Contacts list: the column ids every user gets merged into their own layout on their next visit (each version once; users can rearrange afterwards). null = no account default (users see the built-in layout). Reads /api/v1/settings (settings:view).", {}, async () => {
+        const result = (await client.get("/api/v1/settings"));
+        const raw = result?.data?.contactTableDefaults;
+        return formatResult({ data: raw && typeof raw === "object" ? raw : null, revision: raw && typeof raw === "object" && typeof raw.revision === "string" ? raw.revision : "0", columnIds: ["name", "email", "phone", "company", "source", "tags", "score", "intent", "stage", "createdAt", "lastActivity", "assignedTo", "address", "city", "state", "zip", "custom:<fieldKey>"] });
+    });
+    server.tool("conduyt_set_contact_table_defaults", "Set the account-level DEFAULT COLUMNS for the Contacts list (settings:edit). Every user's saved layout gains the columns it lacks on their next visit (appended; nothing they already show moves); at most 8 ids; custom fields as 'custom:<fieldKey>' (the key must exist). The write is revision-fenced: by default the tool reads the current row and names its `revision` (version@epoch); pass expectedRevision to fence on a row you read earlier. A concurrent change answers { conflict: true, current } — re-read and decide, nothing was overwritten.", {
+        columns: z
+            .array(z.string().min(1).max(120))
+            .max(8)
+            .describe("Column ids in display order, e.g. ['createdAt','name','email','phone','company','source','tags','stage','lastActivity']; custom fields as 'custom:<fieldKey>'"),
+        expectedRevision: z.string().min(1).max(80).optional().describe("The row `revision` this set was derived from (version@epoch, or '0' when never configured). Omitted: the tool reads the current row and uses its revision."),
+    }, async (params) => {
+        // (default columns r10, Codex r9 m1) tri-surface parity with the browser: the PATCH contract REQUIRES the server revision
+        const readRevision = async () => {
+            const result = (await client.get("/api/v1/settings"));
+            const raw = result?.data?.contactTableDefaults;
+            return raw && typeof raw === "object" && typeof raw.revision === "string" && raw.revision ? raw.revision : "0";
+        };
+        const expectedRevision = params.expectedRevision ?? (await readRevision());
+        try {
+            const result = await client.patch("/api/v1/settings", { contactTableDefaults: { columns: params.columns, expectedRevision } });
+            return formatResult(result);
+        }
+        catch (err) {
+            if (err instanceof ConduytApiError && err.status === 409) {
+                const current = (await client.get("/api/v1/settings"));
+                return formatResult({ conflict: true, message: err.message, expectedRevision, current: current?.data?.contactTableDefaults ?? null, hint: "the account defaults changed since that revision was read; nothing was overwritten — re-read `current`, merge your intent, and call again with its revision" });
+            }
+            throw err;
+        }
+    });
 }

package/dist/tools/lifecycle.js

@@ -1,5 +1,24 @@
 import { z } from "zod";
-import { formatResult } from "../client.js";
+import { ConduytApiError, formatResult } from "../client.js";
+/** (default columns r18, Codex r17 h1) every general-settings PATCH names the revision it loaded: read it, save, and on a 409 hand
+ *  the conflict back with the current settings so the caller re-derives its change (tri-surface parity with the browser) */
+async function patchGeneralSettings(client, body) {
+    const read = async () => {
+        const result = (await client.get("/api/v1/settings"));
+        return typeof result?.data?.settingsRevision === "string" ? result.data.settingsRevision : null;
+    };
+    const expectedSettingsRevision = await read();
+    try {
+        return formatResult(await client.patch("/api/v1/settings", { ...body, ...(expectedSettingsRevision ? { expectedSettingsRevision } : {}) }));
+    }
+    catch (err) {
+        if (err instanceof ConduytApiError && err.status === 409) {
+            const current = (await client.get("/api/v1/settings"));
+            return formatResult({ conflict: true, message: err.message, expectedSettingsRevision, current: current?.data ?? null, hint: "the account settings changed since that revision was read — re-derive the change from `current` and call again" });
+        }
+        throw err;
+    }
+}
 /**
  * Lifecycle v2 settings (master lead status + intake deals). The master lead
  * is the acquisition truth (first-write-wins source, one lifecycle status);
@@ -48,17 +67,11 @@ export function registerLifecycleTools(server, client) {
             .enum(["always", "if_no_open", "never"])
             .optional()
             .describe("Policy for contacts that already exist (default 'if_no_open')"),
-    }, async (params) => {
-        const result = await client.patch("/api/v1/settings", { intakeDeals: params });
-        return formatResult(result);
-    });
+    }, async (params) => patchGeneralSettings(client, { intakeDeals: params }));
     server.tool("conduyt_update_master_statuses", "Set the account's custom lead lifecycle statuses. The five defaults (open, won, lost, abandoned, disqualified) always exist and cannot be removed; this REPLACES the custom list on top of them (max 20 names, 1-40 chars each, letters/numbers/spaces/-/_ only). Terminal statuses stop all outbound automation for a contact. Requires settings:edit.", {
         statuses: z
             .array(masterStatusName)
             .max(20)
             .describe("Custom status names to make available alongside the defaults, e.g. ['nurturing', 'in underwriting']"),
-    }, async ({ statuses }) => {
-        const result = await client.patch("/api/v1/settings", { masterStatuses: statuses });
-        return formatResult(result);
-    });
+    }, async ({ statuses }) => patchGeneralSettings(client, { masterStatuses: statuses }));
 }

package/dist/tools/saved-filters.js

@@ -14,7 +14,7 @@ import { formatResult } from "../client.js";
 // limits (10 groups × 20 rules) so oversized payloads fail here instead of
 // round-tripping to a 400.
 const ruleSchema = z.object({
-    field: z.string().describe("Filter field, e.g. assignedTo, source, tags, pipelineStage, dealStatus, createdAt"),
+    field: z.string().describe("Filter field, e.g. assignedTo, source, tags, pipeline (the whole pipeline), pipelineStage, dealStatus, createdAt"),
     operator: z.string().describe("Operator valid for the field, e.g. equals, is_any_of, contains, is_empty"),
     value: z.union([z.string(), z.array(z.string())]).optional(),
 });

package/dist/tools/workflow-sandbox.js

@@ -77,7 +77,9 @@ export function registerWorkflowSandboxTools(server, client) {
                 message: "Workflow has warnings and allowWarnings is false. Fix warnings or set allowWarnings to true.",
             });
         }
-        const published = await client.post(`/api/v1/automations/${automationId}/publish`, {});
+        // (Conduyt Sentry r59 parity) the publish carries the revision of the draft that was just validated
+        const current = (await client.get(`/api/v1/automations/${automationId}`));
+        const published = await client.post(`/api/v1/automations/${automationId}/publish`, { expectedConfigRevision: typeof current?.configRevision === "number" ? current.configRevision : undefined });
         return formatResult({
             promoted: true,
             warnings: hasWarnings ? validation.warnings : [],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "conduyt-mcp",
-  "version": "4.22.0",
+  "version": "4.23.1",
   "description": "MCP server for Conduyt CRM — expose CRM operations as AI-accessible tools",
   "type": "module",
   "main": "dist/index.js",

package/scripts/coverage-manifest.json

@@ -5,6 +5,11 @@
     "planned": "callable in principle; a typed tool is wanted but not built yet"
   },
   "rules": [
+    {
+      "match": "GET /api/v1/call-flows/functions/:id",
+      "status": "planned",
+      "reason": "single-function read; the list tool plus update/delete/test exist, a typed get is wanted but not built (4.23.0)"
+    },
     {
       "match": "/api/health",
       "status": "excluded",
@@ -516,4 +521,4 @@
       "reason": "operator capacity dashboard (#51, shipped 2026-09) \u2014 read-only queue/park telemetry; a typed conduyt_capacity_snapshot tool is agent-relevant for throughput questions"
     }
   ]
-}
+}

package/scripts/coverage-matrix.json

@@ -1,11 +1,11 @@
 {
-  "generatedAt": "2026-09-02T06:05:57.360Z",
-  "toolCount": 194,
-  "totalEndpoints": 883,
+  "generatedAt": "2026-09-04T21:17:21.600Z",
+  "toolCount": 201,
+  "totalEndpoints": 893,
   "counts": {
-    "covered": 181,
-    "excluded": 261,
-    "planned": 441,
+    "covered": 186,
+    "excluded": 263,
+    "planned": 444,
     "uncategorized": 0
   },
   "matrix": {
@@ -569,6 +569,8 @@
       "status": "covered",
       "tools": [
         "conduyt_get_automation",
+        "conduyt_update_automation",
+        "conduyt_publish_automation",
         "conduyt_workflow_promote"
       ]
     },
@@ -1060,6 +1062,40 @@
       "status": "excluded",
       "reason": "multipart file upload (IVR audio) - not expressible as a text MCP tool; agents reference existing audio by id from conduyt_get_call_flow"
     },
+    "GET /api/v1/call-flows/functions": {
+      "status": "covered",
+      "tools": [
+        "conduyt_list_call_flow_functions"
+      ]
+    },
+    "POST /api/v1/call-flows/functions": {
+      "status": "covered",
+      "tools": [
+        "conduyt_create_call_flow_function"
+      ]
+    },
+    "GET /api/v1/call-flows/functions/:id": {
+      "status": "planned",
+      "reason": "single-function read; the list tool plus update/delete/test exist, a typed get is wanted but not built (4.23.0)"
+    },
+    "PATCH /api/v1/call-flows/functions/:id": {
+      "status": "covered",
+      "tools": [
+        "conduyt_update_call_flow_function"
+      ]
+    },
+    "DELETE /api/v1/call-flows/functions/:id": {
+      "status": "covered",
+      "tools": [
+        "conduyt_delete_call_flow_function"
+      ]
+    },
+    "POST /api/v1/call-flows/functions/:id/test": {
+      "status": "covered",
+      "tools": [
+        "conduyt_test_call_flow_function"
+      ]
+    },
     "GET /api/v1/call-flows/numbers": {
       "status": "covered",
       "tools": [
@@ -3252,14 +3288,15 @@
     "GET /api/v1/settings": {
       "status": "covered",
       "tools": [
+        "conduyt_get_contact_table_defaults",
+        "conduyt_set_contact_table_defaults",
         "conduyt_get_lifecycle_settings"
       ]
     },
     "PATCH /api/v1/settings": {
       "status": "covered",
       "tools": [
-        "conduyt_update_intake_deals",
-        "conduyt_update_master_statuses"
+        "conduyt_set_contact_table_defaults"
       ]
     },
     "GET /api/v1/settings/ai": {
@@ -3314,6 +3351,14 @@
       "status": "planned",
       "reason": "account settings read/update surfaces"
     },
+    "GET /api/v1/settings/operations": {
+      "status": "planned",
+      "reason": "account settings read/update surfaces"
+    },
+    "POST /api/v1/settings/operations": {
+      "status": "planned",
+      "reason": "account settings read/update surfaces"
+    },
     "GET /api/v1/settings/scheduled-export": {
       "status": "covered",
       "tools": [
@@ -3839,6 +3884,14 @@
       "status": "excluded",
       "reason": "inbound provider callback receivers (Twilio/Resend/etc.), not client-callable"
     },
+    "GET /api/v1/webhooks/voice/fallback": {
+      "status": "excluded",
+      "reason": "inbound provider callback receivers (Twilio/Resend/etc.), not client-callable"
+    },
+    "POST /api/v1/webhooks/voice/fallback": {
+      "status": "excluded",
+      "reason": "inbound provider callback receivers (Twilio/Resend/etc.), not client-callable"
+    },
     "POST /api/v1/webhooks/voice/flow-step": {
       "status": "excluded",
       "reason": "inbound provider callback receivers (Twilio/Resend/etc.), not client-callable"