conduyt-mcp 4.69.0 → 4.71.0

package/dist/tools/booking-pages.js

@@ -24,9 +24,51 @@ const pageFields = {
     leadSource: z.string().max(100).nullable().optional().describe("lead source stamped on contacts the page creates"),
     brandName: z.string().max(100).nullable().optional().describe("white-label name shown on the page and in Zoom meeting names"),
     embedAllowedOrigins: z.array(z.string().url()).nullable().optional().describe("origins allowed to embed/call the page; null or empty = any"),
+    documentsEnabled: z.boolean().optional().describe("the documents step: the public upload-url and documents routes answer for this page's bookings (bank statements and funding agreements attached to the lead)"),
+    documentsPageUrl: z.string().url().nullable().optional().describe("the site page the confirmation email links the visitor back to for the upload (https; the page reads ?appointment=<id>); null = no link"),
     availabilityRules: z.array(availabilityWindow).nullable().optional().describe("availability override; null = the host's own rules"),
     isActive: z.boolean().optional(),
 };
+/** (Codex rb-r9 m3) every other field PATCH /booking-pages/{id} accepts (the OpenAPI BookingPagePatch schema): with pageFields
+ *  the update tool covers the route's whole body, typed as the route normalises it */
+const updateOnlyFields = {
+    durationOptions: z.array(z.object({ label: z.string().min(1), minutes: z.number().int().min(5).max(480) })).nullable().optional().describe("selectable durations; empty or null clears"),
+    bufferBefore: z.number().int().min(0).nullable().optional().describe("minutes blocked before each booking"),
+    bufferAfter: z.number().int().min(0).nullable().optional().describe("minutes blocked after each booking"),
+    maxBookingsPerDay: z.number().int().min(1).nullable().optional(),
+    color: z.string().regex(/^#[0-9a-fA-F]{3,8}$/).nullable().optional().describe("hex colour"),
+    thankYouMessage: z.string().max(2000).nullable().optional(),
+    redirectUrl: z.string().url().nullable().optional().describe("where the visitor goes after booking"),
+    requirePhone: z.boolean().optional(),
+    embedEnabled: z.boolean().optional(),
+    // (Codex rb-r10 m3) the shapes the route's sanitizers keep (an entry outside them is dropped; a list with none clears)
+    customQuestions: z.array(z.object({ id: z.string().max(57).optional(), label: z.string().min(1).max(500), type: z.enum(["short_text", "long_text", "email", "phone", "select", "checkbox", "date", "number", "hidden"]), required: z.boolean().optional(), options: z.array(z.string().max(500)).max(50).optional(), defaultValue: z.string().max(500).optional() })).max(50).optional(),
+    formFields: z.array(z.object({ id: z.string().min(1).max(64), label: z.string().min(1).max(120), type: z.enum(["text", "email", "tel", "textarea"]), show: z.boolean(), required: z.boolean(), locked: z.boolean().optional() })).max(20).nullable().optional(),
+    fieldMappings: z.array(z.object({ formFieldId: z.string().min(1).max(64), contactField: z.string().regex(/^(firstName|lastName|email|phone|company|jobTitle|address|city|state|zip|country|source|notes|website|customFields\.[a-zA-Z_][a-zA-Z0-9_]*)$/) })).max(20).nullable().optional(),
+    reminders: z.array(z.object({ type: z.enum(["email", "sms"]), minutesBefore: z.number().int().min(1).max(10080) })).max(10).optional(),
+    logoUrl: z.string().url().nullable().optional(),
+    hideBranding: z.boolean().optional(),
+    template: z.enum(["bda"]).nullable().optional().describe("null = the default page, 'bda' = the BDA template"),
+    reviews: z.object({ badges: z.array(z.record(z.string(), z.unknown())).optional(), testimonials: z.array(z.record(z.string(), z.unknown())).optional() }).nullable().optional(),
+    campaign: z.string().nullable().optional(),
+    hyrosTag: z.string().nullable().optional(),
+    eventType: z.enum(["one_on_one", "round_robin", "collective", "group"]).optional(),
+    maxAttendees: z.number().int().min(1).nullable().optional(),
+    hostUserIds: z.array(z.string().uuid()).optional().describe("users on this account who can host"),
+    hostGroupId: z.string().uuid().nullable().optional(),
+    hostPriorities: z.record(z.string(), z.enum(["highest", "high", "low", "lowest"])).nullable().optional().describe("host user id to priority"),
+    distributionMethod: z.enum(["maximize", "equal"]).optional(),
+    paymentEnabled: z.boolean().optional().describe("accepted, but checkout is not implemented yet: the page stays unpaid and the answer carries a warning"),
+    paymentAmount: z.number().int().min(1).nullable().optional().describe("cents"),
+    paymentCurrency: z.enum(["usd", "eur", "gbp", "cad", "aud", "mxn"]).nullable().optional(),
+    stripeProductId: z.string().nullable().optional(),
+    stripePriceId: z.string().nullable().optional(),
+    gdprEnabled: z.boolean().optional(),
+    gdprText: z.string().max(2000).nullable().optional(),
+    gdprLinkUrl: z.string().url().nullable().optional(),
+    waitlistEnabled: z.boolean().optional(),
+    enableIcalFeed: z.boolean().optional().describe("true issues a new iCal feed token, false revokes it"),
+};
 export function registerBookingPageTools(server, client) {
     server.tool("conduyt_list_booking_pages", "List the account's booking pages (GET /api/v1/booking-pages): slug, title, host, duration, active, video option. Requires calendar:view.", { activeOnly: z.boolean().optional().describe("only pages accepting bookings") }, async ({ activeOnly }) => {
         const result = await client.get(`/api/v1/booking-pages?${activeOnly ? "is_active=true" : ""}`);
@@ -40,7 +82,7 @@ export function registerBookingPageTools(server, client) {
         const result = await client.post("/api/v1/booking-pages", params);
         return formatResult(result);
     });
-    server.tool("conduyt_update_booking_page", "Update a booking page (PATCH /api/v1/booking-pages/{id}): only the fields given change. videoProvider 'zoom' turns on one Zoom meeting per booking (null turns it off and clears the host); videoHostEmail must be a user of the connected Zoom account (null = the app's own user). Requires calendar:edit (admin/owner).", { id: z.string().uuid().describe("booking page UUID"), ...pageFields }, async ({ id, ...updates }) => {
+    server.tool("conduyt_update_booking_page", "Update a booking page (PATCH /api/v1/booking-pages/{id}): only the fields given change. videoProvider 'zoom' turns on one Zoom meeting per booking (null turns it off and clears the host); videoHostEmail must be a user of the connected Zoom account (null = the app's own user). Requires calendar:edit (admin/owner).", { id: z.string().uuid().describe("booking page UUID"), ...pageFields, ...updateOnlyFields }, async ({ id, ...updates }) => {
         const result = await client.patch(`/api/v1/booking-pages/${id}`, updates);
         return formatResult(result);
     });

package/dist/tools/dialer-settings.d.ts

@@ -1,7 +1,28 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { ConduytClient } from "../client.js";
+type DisclosureOn = "inbound" | "outbound" | "both";
+type RecordingPolicy = {
+    inbound: boolean;
+    outbound: boolean;
+    disclosure: {
+        enabled: boolean;
+        on: DisclosureOn;
+    };
+    consentGreeting: string;
+    enabled: boolean;
+};
+/**
+ * What a stored policy MEANS, read the way the server reads it (Codex r5): a workspace that never saved the new shape
+ * still stores the old one, `{ enabled, consentGreeting }`, which means outbound recording with the disclosure on
+ * whenever a wording is set. Handed back raw, an agent auditing consent would read no disclosure at all. `enabled`
+ * stays beside `outbound` as the old name of the same switch. null for a value that is not a policy.
+ */
+export declare function effectiveRecordingPolicy(raw: unknown): RecordingPolicy | null;
+/** the iPhone line has no inbound calls: what its policy does there, the way the server applies it */
+export declare function iphoneDomain(policy: RecordingPolicy): RecordingPolicy;
 /**
  * Smart Dialing policy (GET/PATCH /api/v1/dialer/settings): the account-wide rules every rep's Smart Dialing run
  * follows. Read needs the dialer scope; update needs the settings scope (admin). (#95/#96, 2026-09-16)
  */
 export declare function registerDialerSettingsTools(server: McpServer, client: ConduytClient): void;
+export {};

package/dist/tools/dialer-settings.js

@@ -1,5 +1,34 @@
 import { z } from "zod";
 import { formatResult } from "../client.js";
+import { patchGeneralSettings } from "./lifecycle.js";
+/** the two lines a workspace records calls on: its Twilio lines (settings.recording) and its iPhone line (settings.projectBlueRecording) */
+const RECORDING_KEY = { twilio: "recording", iphone: "projectBlueRecording" };
+const isOn = (v) => v === "inbound" || v === "outbound" || v === "both";
+/**
+ * What a stored policy MEANS, read the way the server reads it (Codex r5): a workspace that never saved the new shape
+ * still stores the old one, `{ enabled, consentGreeting }`, which means outbound recording with the disclosure on
+ * whenever a wording is set. Handed back raw, an agent auditing consent would read no disclosure at all. `enabled`
+ * stays beside `outbound` as the old name of the same switch. null for a value that is not a policy.
+ */
+export function effectiveRecordingPolicy(raw) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        return null;
+    const r = raw;
+    const greeting = typeof r.consentGreeting === "string" ? r.consentGreeting.trim() : "";
+    const newShape = typeof r.inbound === "boolean" || typeof r.outbound === "boolean" || (r.disclosure !== undefined && r.disclosure !== null);
+    if (newShape) {
+        const d = (r.disclosure && typeof r.disclosure === "object" ? r.disclosure : {});
+        const outbound = typeof r.outbound === "boolean" ? r.outbound : r.enabled === true;
+        return { inbound: r.inbound === true, outbound, disclosure: { enabled: d.enabled === true, on: isOn(d.on) ? d.on : "outbound" }, consentGreeting: greeting, enabled: outbound };
+    }
+    const outbound = r.enabled === true;
+    return { inbound: false, outbound, disclosure: { enabled: outbound && greeting.length > 0, on: "outbound" }, consentGreeting: greeting, enabled: outbound };
+}
+/** the iPhone line has no inbound calls: what its policy does there, the way the server applies it */
+export function iphoneDomain(policy) {
+    const on = policy.disclosure.on;
+    return { ...policy, inbound: false, disclosure: on === "inbound" ? { enabled: false, on: "outbound" } : { enabled: policy.disclosure.enabled, on: "outbound" } };
+}
 /**
  * Smart Dialing policy (GET/PATCH /api/v1/dialer/settings): the account-wide rules every rep's Smart Dialing run
  * follows. Read needs the dialer scope; update needs the settings scope (admin). (#95/#96, 2026-09-16)
@@ -20,4 +49,56 @@ export function registerDialerSettingsTools(server, client) {
         const result = await client.patch("/api/v1/dialer/settings", { autoAdvanceEnabled, pauseSeconds, advanceOn, openLeadOnDial, smartDialCallerId });
         return formatResult(result);
     });
+    // Call recording policy (the Call recording card of Settings, released 2026-09-30): which calls are recorded and
+    // whether callers hear a disclosure. Stored in the general settings (GET/PATCH /api/v1/settings).
+    server.tool("conduyt_get_call_recording_settings", "Read the workspace's call recording policy for both kinds of line. twilio = the workspace's Twilio lines: always an object, with everything off when the workspace never set it. Needs a key whose creator may view settings; without it the tool answers with an error instead of a policy. iphone = the iPhone line's OWN policy (outbound only); null = none was written, and the iPhone line then follows the Twilio lines' policy without its inbound part. Each object is the policy as it is APPLIED: inbound, outbound, disclosure { enabled, on: 'inbound' | 'outbound' | 'both' } (whether a recording disclosure is played and on which calls), consentGreeting (what is said; empty = the default sentence) and enabled (the OLD name of the outbound switch: the same value as outbound). A workspace that never saved the new shape is read the way the server reads its old one: outbound recording with the disclosure on whenever a wording is set. The workspace is responsible for consent where it operates.", {}, async () => {
+        const result = (await client.get("/api/v1/settings"));
+        const raw = result?.data ?? {};
+        const twilio = effectiveRecordingPolicy(raw[RECORDING_KEY.twilio]);
+        // a key whose creator may not view settings gets a short answer WITHOUT the policy: that is "not visible",
+        // never "not configured" (the full answer always carries the Twilio policy)
+        if (!twilio) {
+            return { content: [{ type: "text", text: "The call recording policy is not visible to this API key: its creator needs permission to view settings. Nothing can be said about whether calls are recorded." }], isError: true };
+        }
+        const iphone = effectiveRecordingPolicy(raw[RECORDING_KEY.iphone]);
+        return formatResult({ twilio, iphone: iphone ? iphoneDomain(iphone) : null });
+    });
+    server.tool("conduyt_update_call_recording_settings", "Change the workspace's call recording policy (admin: settings scope). line: 'twilio' (default) or 'iphone'. Send only what changes; what is not sent stays as it is. inbound / outbound: record calls the team receives / makes. disclosureEnabled + disclosureOn ('inbound' | 'outbound' | 'both'): play a recording disclosure and on which calls (send both together). On the iPhone line the disclosure plays on outbound calls only: 'inbound' is refused and 'both' is saved as 'outbound'. consentGreeting: the sentence that is said (500 characters at most). enabled: the OLD name of the outbound switch, accepted for older callers and sent as outbound (when both are sent, outbound decides); nothing else changes with it. Read conduyt_get_call_recording_settings first. The workspace is responsible for consent where it operates.", {
+        line: z.enum(["twilio", "iphone"]).optional().describe("Which line's policy: the Twilio lines (default) or the iPhone line"),
+        inbound: z.boolean().optional().describe("Record calls the team receives (Twilio lines only)"),
+        outbound: z.boolean().optional().describe("Record calls the team makes, including Smart Dialing"),
+        enabled: z.boolean().optional().describe("The OLD name of the outbound switch (older callers); prefer outbound"),
+        disclosureEnabled: z.boolean().optional().describe("Play a recording disclosure (send together with disclosureOn)"),
+        disclosureOn: z.enum(["inbound", "outbound", "both"]).optional().describe("Which calls the disclosure is played on (send together with disclosureEnabled)"),
+        consentGreeting: z.string().trim().max(500).optional().describe("What is said; empty string = the default sentence"),
+    }, async ({ line, inbound, outbound, enabled, disclosureEnabled, disclosureOn, consentGreeting }) => {
+        const fail = (text) => ({ content: [{ type: "text", text }], isError: true });
+        if ([inbound, outbound, enabled, disclosureEnabled, disclosureOn, consentGreeting].every((v) => v === undefined))
+            return fail("Nothing to change: pass at least one of inbound, outbound, disclosureEnabled + disclosureOn, consentGreeting.");
+        if ((disclosureEnabled === undefined) !== (disclosureOn === undefined))
+            return fail("disclosureEnabled and disclosureOn are sent together: the disclosure is one setting (whether it plays, and on which calls).");
+        const which = line ?? "twilio";
+        if (which === "iphone" && inbound !== undefined)
+            return fail("The iPhone line records outbound calls only: inbound is not a setting of that line.");
+        // the iPhone line has no inbound calls: a disclosure on inbound only would never play, so it is refused here
+        // instead of saved as if it were on; 'both' is what the line does on its outbound calls
+        if (which === "iphone" && disclosureOn === "inbound")
+            return fail("The iPhone line has outbound calls only: a disclosure on inbound calls would never play. Send disclosureOn 'outbound'.");
+        const on = which === "iphone" && disclosureOn === "both" ? "outbound" : disclosureOn;
+        const policy = {};
+        if (inbound !== undefined)
+            policy.inbound = inbound;
+        // (Codex r4) the old name is the outbound switch and nothing else: sent AS outbound, never as enabled, because
+        // the server gives an enabled-only write over a policy saved in the old shape its old whole meaning (the
+        // disclosure recomputed from it), which this tool promises not to touch
+        if (outbound !== undefined)
+            policy.outbound = outbound;
+        else if (enabled !== undefined)
+            policy.outbound = enabled;
+        if (disclosureEnabled !== undefined && on !== undefined)
+            policy.disclosure = { enabled: disclosureEnabled, on };
+        if (consentGreeting !== undefined)
+            policy.consentGreeting = consentGreeting;
+        return patchGeneralSettings(client, { [RECORDING_KEY[which]]: policy });
+    });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "conduyt-mcp",
-  "version": "4.69.0",
+  "version": "4.71.0",
   "description": "MCP server for Conduyt CRM — expose CRM operations as AI-accessible tools",
   "type": "module",
   "main": "dist/index.js",

package/scripts/coverage-manifest.json

@@ -1,7 +1,7 @@
 {
-  "description": "SOL-016: the INTENTIONAL REST->MCP coverage policy. Every catalog endpoint must be either covered by a tool (derived automatically), matched by a rule here, or the coverage gate fails \u2014 silent drift between 'discoverable API' and 'callable MCP' is the failure mode this prevents. Rules are first-match-wins prefix matches on 'METHOD /path' keys (a bare path prefix matches every method).",
+  "description": "SOL-016: the INTENTIONAL REST->MCP coverage policy. Every catalog endpoint must be either covered by a tool (derived automatically), matched by a rule here, or the coverage gate fails — silent drift between 'discoverable API' and 'callable MCP' is the failure mode this prevents. Rules are first-match-wins prefix matches on 'METHOD /path' keys (a bare path prefix matches every method).",
   "statuses": {
-    "excluded": "never MCP-callable by design \u2014 the reason says why",
+    "excluded": "never MCP-callable by design — the reason says why",
     "planned": "callable in principle; a typed tool is wanted but not built yet"
   },
   "rules": [
@@ -43,22 +43,22 @@
     {
       "match": "/api/public/",
       "status": "excluded",
-      "reason": "public unauthenticated surfaces (forms, booking, unsubscribe) \u2014 no key semantics"
+      "reason": "public unauthenticated surfaces (forms, booking, unsubscribe) — no key semantics"
     },
     {
       "match": "/api/v1/public/",
       "status": "excluded",
-      "reason": "public unauthenticated surfaces \u2014 no key semantics"
+      "reason": "public unauthenticated surfaces — no key semantics"
     },
     {
       "match": "/api/v1/webhooks/manage",
       "status": "planned",
-      "reason": "OUTBOUND webhook subscription management (CRUD/test/deliveries) \u2014 agent-relevant, unlike the inbound receivers below"
+      "reason": "OUTBOUND webhook subscription management (CRUD/test/deliveries) — agent-relevant, unlike the inbound receivers below"
     },
     {
       "match": "/api/v1/webhooks/replay",
       "status": "planned",
-      "reason": "outbound webhook delivery replay \u2014 agent-relevant"
+      "reason": "outbound webhook delivery replay — agent-relevant"
     },
     {
       "match": "/api/v1/webhooks/",
@@ -78,7 +78,7 @@
     {
       "match": "/api/v1/dialer/",
       "status": "excluded",
-      "reason": "realtime browser dialer (WebRTC tokens, live call control) \u2014 needs a live audio session"
+      "reason": "realtime browser dialer (WebRTC tokens, live call control) — needs a live audio session"
     },
     {
       "match": "/api/v1/screen-share",
@@ -208,7 +208,7 @@
     {
       "match": "/api/v1/email-domains",
       "status": "planned",
-      "reason": "sending-domain management (reply-capture subpaths ARE covered \u2014 see the reply_capture_* tools)"
+      "reason": "sending-domain management (reply-capture subpaths ARE covered — see the reply_capture_* tools)"
     },
     {
       "match": "/api/v1/mailbox",
@@ -403,7 +403,7 @@
     {
       "match": "/api/track/",
       "status": "excluded",
-      "reason": "email open/click tracking pixels and redirects \u2014 recipient-facing"
+      "reason": "email open/click tracking pixels and redirects — recipient-facing"
     },
     {
       "match": "/api/webhooks/",
@@ -508,7 +508,7 @@
     {
       "match": "/api/v1/automation-folders",
       "status": "planned",
-      "reason": "automation-folder organization (shipped 2026-08) \u2014 agent-relevant workflow housekeeping; typed tools wanted"
+      "reason": "automation-folder organization (shipped 2026-08) — agent-relevant workflow housekeeping; typed tools wanted"
     },
     {
       "match": "POST /api/v1/call-flows/audio",
@@ -518,7 +518,37 @@
     {
       "match": "GET /api/v1/ops/capacity",
       "status": "planned",
-      "reason": "operator capacity dashboard (#51, shipped 2026-09) \u2014 read-only queue/park telemetry; a typed conduyt_capacity_snapshot tool is agent-relevant for throughput questions"
+      "reason": "operator capacity dashboard (#51, shipped 2026-09) — read-only queue/park telemetry; a typed conduyt_capacity_snapshot tool is agent-relevant for throughput questions"
+    },
+    {
+      "match": "GET /api/v1/help/guides",
+      "status": "planned",
+      "reason": "the Help center's guides (2026-09-30): a typed read tool is next, right after the API is live"
+    },
+    {
+      "match": "GET /api/v1/help/guides/:slug",
+      "status": "planned",
+      "reason": "one guide's text (2026-09-30): a typed read tool is next, right after the API is live"
+    },
+    {
+      "match": "/api/v1/help/guides/:slug/feedback",
+      "status": "excluded",
+      "reason": "a person's own answer to Was this helpful: session only (assertSessionOnly), never an API key's"
+    },
+    {
+      "match": "POST /api/v1/help/guides/:slug/open",
+      "status": "excluded",
+      "reason": "a person's own reading of a guide, for Most read: session only (assertSessionOnly)"
+    },
+    {
+      "match": "POST /api/v1/help/suggestions",
+      "status": "excluded",
+      "reason": "a person's own suggestion, mailed to support: session only (assertSessionOnly)"
+    },
+    {
+      "match": "/api/v1/support/",
+      "status": "excluded",
+      "reason": "the Contact support form and its attachment upload: a signed-in person's request, session only (assertSessionOnly)"
     }
   ]
-}
+}

package/scripts/coverage-matrix.json

@@ -1,11 +1,11 @@
 {
-  "generatedAt": "2026-09-27T00:07:38.757Z",
-  "toolCount": 290,
-  "totalEndpoints": 1011,
+  "generatedAt": "2026-09-30T16:40:04.197Z",
+  "toolCount": 292,
+  "totalEndpoints": 1031,
   "counts": {
     "covered": 266,
-    "excluded": 295,
-    "planned": 450,
+    "excluded": 311,
+    "planned": 454,
     "uncategorized": 0
   },
   "matrix": {
@@ -1657,6 +1657,10 @@
       "status": "excluded",
       "reason": "CRON_SECRET-gated infrastructure jobs; never key-callable"
     },
+    "GET /api/v1/cron/lead-pool-push": {
+      "status": "excluded",
+      "reason": "CRON_SECRET-gated infrastructure jobs; never key-callable"
+    },
     "GET /api/v1/cron/lead-redistribution": {
       "status": "excluded",
       "reason": "CRON_SECRET-gated infrastructure jobs; never key-callable"
@@ -1797,6 +1801,10 @@
       "status": "excluded",
       "reason": "CRON_SECRET-gated infrastructure jobs; never key-callable"
     },
+    "GET /api/v1/cron/process-subscriber-deals": {
+      "status": "excluded",
+      "reason": "CRON_SECRET-gated infrastructure jobs; never key-callable"
+    },
     "GET /api/v1/cron/process-trial-signup-alerts": {
       "status": "excluded",
       "reason": "CRON_SECRET-gated infrastructure jobs; never key-callable"
@@ -1805,6 +1813,10 @@
       "status": "excluded",
       "reason": "CRON_SECRET-gated infrastructure jobs; never key-callable"
     },
+    "GET /api/v1/cron/process-unsubscribe-intents": {
+      "status": "excluded",
+      "reason": "CRON_SECRET-gated infrastructure jobs; never key-callable"
+    },
     "GET /api/v1/cron/process-wake-jobs": {
       "status": "excluded",
       "reason": "CRON_SECRET-gated infrastructure jobs; never key-callable"
@@ -2205,6 +2217,10 @@
       "status": "excluded",
       "reason": "realtime browser dialer (WebRTC tokens, live call control) — needs a live audio session"
     },
+    "GET /api/v1/dialer/call/:id": {
+      "status": "excluded",
+      "reason": "realtime browser dialer (WebRTC tokens, live call control) — needs a live audio session"
+    },
     "PATCH /api/v1/dialer/call/:id": {
       "status": "excluded",
       "reason": "realtime browser dialer (WebRTC tokens, live call control) — needs a live audio session"
@@ -2771,6 +2787,30 @@
       "status": "excluded",
       "reason": "unauthenticated liveness probe"
     },
+    "GET /api/v1/help/guides": {
+      "status": "planned",
+      "reason": "the Help center's guides (2026-09-30): a typed read tool is next, right after the API is live"
+    },
+    "GET /api/v1/help/guides/:slug": {
+      "status": "planned",
+      "reason": "the Help center's guides (2026-09-30): a typed read tool is next, right after the API is live"
+    },
+    "GET /api/v1/help/guides/:slug/feedback": {
+      "status": "planned",
+      "reason": "the Help center's guides (2026-09-30): a typed read tool is next, right after the API is live"
+    },
+    "POST /api/v1/help/guides/:slug/feedback": {
+      "status": "excluded",
+      "reason": "a person's own answer to Was this helpful: session only (assertSessionOnly), never an API key's"
+    },
+    "POST /api/v1/help/guides/:slug/open": {
+      "status": "excluded",
+      "reason": "a person's own reading of a guide, for Most read: session only (assertSessionOnly)"
+    },
+    "POST /api/v1/help/suggestions": {
+      "status": "excluded",
+      "reason": "a person's own suggestion, mailed to support: session only (assertSessionOnly)"
+    },
     "GET /api/v1/imports": {
       "status": "planned",
       "reason": "import job monitoring/resubmission (ai-import tool covers creation)"
@@ -3239,6 +3279,14 @@
       "status": "excluded",
       "reason": "public unauthenticated surfaces — no key semantics"
     },
+    "POST /api/v1/public/booking/:slug/documents": {
+      "status": "excluded",
+      "reason": "public unauthenticated surfaces — no key semantics"
+    },
+    "OPTIONS /api/v1/public/booking/:slug/documents": {
+      "status": "excluded",
+      "reason": "public unauthenticated surfaces — no key semantics"
+    },
     "GET /api/v1/public/booking/:slug/embed": {
       "status": "excluded",
       "reason": "public unauthenticated surfaces — no key semantics"
@@ -3267,6 +3315,14 @@
       "status": "excluded",
       "reason": "public unauthenticated surfaces — no key semantics"
     },
+    "POST /api/v1/public/booking/:slug/upload-url": {
+      "status": "excluded",
+      "reason": "public unauthenticated surfaces — no key semantics"
+    },
+    "OPTIONS /api/v1/public/booking/:slug/upload-url": {
+      "status": "excluded",
+      "reason": "public unauthenticated surfaces — no key semantics"
+    },
     "POST /api/v1/public/booking/:slug/waitlist": {
       "status": "excluded",
       "reason": "public unauthenticated surfaces — no key semantics"
@@ -3295,6 +3351,10 @@
       "status": "excluded",
       "reason": "public unauthenticated surfaces — no key semantics"
     },
+    "POST /api/v1/public/screen-share/:code/state": {
+      "status": "excluded",
+      "reason": "public unauthenticated surfaces — no key semantics"
+    },
     "POST /api/v1/public/subscribe": {
       "status": "excluded",
       "reason": "public unauthenticated surfaces — no key semantics"
@@ -3711,6 +3771,10 @@
       "status": "excluded",
       "reason": "realtime browser RTC surface"
     },
+    "GET /api/v1/screen-share/session/:code": {
+      "status": "excluded",
+      "reason": "realtime browser RTC surface"
+    },
     "DELETE /api/v1/screen-share/session/:code": {
       "status": "excluded",
       "reason": "realtime browser RTC surface"
@@ -3726,6 +3790,7 @@
       "tools": [
         "conduyt_get_contact_table_defaults",
         "conduyt_set_contact_table_defaults",
+        "conduyt_get_call_recording_settings",
         "conduyt_get_lead_pool_settings",
         "conduyt_update_lead_pool_settings",
         "conduyt_get_lifecycle_settings",
@@ -4179,6 +4244,14 @@
       "status": "excluded",
       "reason": "UI enum/metadata hydration for dashboard pickers; tools embed their enums"
     },
+    "POST /api/v1/support/requests": {
+      "status": "excluded",
+      "reason": "the Contact support form and its attachment upload: a signed-in person's request, session only (assertSessionOnly)"
+    },
+    "POST /api/v1/support/upload-url": {
+      "status": "excluded",
+      "reason": "the Contact support form and its attachment upload: a signed-in person's request, session only (assertSessionOnly)"
+    },
     "GET /api/v1/tags": {
       "status": "covered",
       "tools": [
@@ -4384,7 +4457,11 @@
       "status": "planned",
       "reason": "team management subroutes beyond list/invite"
     },
-    "POST /api/v1/users/me/welcomed": {
+    "GET /api/v1/users/me/tour": {
+      "status": "planned",
+      "reason": "team management subroutes beyond list/invite"
+    },
+    "POST /api/v1/users/me/tour": {
       "status": "planned",
       "reason": "team management subroutes beyond list/invite"
     },
@@ -4542,6 +4619,10 @@
       "status": "excluded",
       "reason": "inbound provider callback receivers (Twilio/Resend/etc.), not client-callable"
     },
+    "POST /api/v1/webhooks/voice/vendor-greeting": {
+      "status": "excluded",
+      "reason": "inbound provider callback receivers (Twilio/Resend/etc.), not client-callable"
+    },
     "POST /api/v1/webhooks/voice/vendor-recording": {
       "status": "excluded",
       "reason": "inbound provider callback receivers (Twilio/Resend/etc.), not client-callable"