conduyt-mcp 4.90.0 → 4.92.0

package/README.md

@@ -15,10 +15,13 @@ MCP server for [Conduyt CRM](https://conduyt.app) — expose your CRM as AI-acce
 | Tool | Description |
 |------|-------------|
 | `conduyt_list_contacts` | List and search contacts with filters |
-| `conduyt_get_contact` | Get full contact details with timeline; `hasOutboundSms` = the workspace has ever provably texted the contact; `hasOutboundEmail` = the same for email |
-| `conduyt_create_contact` | Create a new contact (with `callId`: the lead for a contact-less inbound call, linked in the same transaction; the server derives source "Inbound Call" and the owner) |
+| `conduyt_get_contact` | Get full contact details with timeline; `hasOutboundSms` = the workspace has ever provably texted the contact; `hasOutboundEmail` = the same for email; `duplicateProposals` and `heldIdentifiers` = the open possible-duplicate lines and held identifiers |
+| `conduyt_create_contact` | Create a new contact (a 409 with `existingId`, `rule`, `ruleVersion`, `matchedOn`, `reason` means the identity policy identified the incoming person with that record: confirm the identity (name, company) before updating it, a shared phone or email is not proof, and the server creates (with a passive duplicate proposal) a different person on a shared identifier; 409 `identifier_changed` / `owner_busy` and 503 `IDENTITY_INDEX_NOT_READY` are retryable, nothing written; with `callId`: the lead for a contact-less inbound call, linked in the same transaction; the server derives source "Inbound Call" and the owner) |
 | `conduyt_update_contact` | Update contact fields; optional `expectedRevision` (0..2147483647) refuses a stale save with 409 `contact_changed` (code + current revision in the error) |
 | `conduyt_merge_contacts` | DESTRUCTIVE: merge duplicates into a survivor (`POST /contacts/merge`, owner/admin); the losers are deleted. Two steps: without `confirmImpact` a preview (`counts`, `guardCounts`, `identifierOverflow`, `blockers`); with `confirmImpact: true` plus the preview's `expectedCounts`, `expectedGuardCounts` (and `expectedIdentifiers`) the merge; the confirm is sent only against a preview this server returned in the last 10 minutes (else refused locally); the server pins the record counts, guard counts and identifier plan, not other field edits made after the preview; 75 s timeout. Moved counts 409, 503 `merge_contacts_busy` / `merge_budget_exhausted` + Retry-After surfaced verbatim, never retried |
+| `conduyt_list_duplicate_proposals` | List a contact's possible duplicates (`GET /contacts/{id}/duplicate-proposals`): open and not-sure proposals (`id`, `status`, `rule`, `other`, `raisedHere`) and the identifiers held from it (value-free); a record you cannot view has no id; keyset paged with `cursor` / `limit` (default 50) and `held_cursor` / `held_limit` (default 20), answers `total`, `nextCursor`, the held twins and membership revisions (re-read page one when a later page answers another revision) |
+| `conduyt_list_import_duplicate_proposals` | The duplicate proposals one import raised on the records it created (`GET /imports/{id}/duplicate-proposals`, contacts:view): every status, oldest first, `page` / `per_page` (default 50), `{ rows, meta }`; a record you cannot view is "A contact you cannot view" with no id |
+| `conduyt_decide_duplicate_proposal` | Decide one proposal (`POST /contacts/{id}/duplicate-proposals/{proposalId}`, contacts:edit on both records): `not_sure` keeps both visible, `different` is final (never shown again), `merge` records a pair ALREADY merged (this tool never merges: use `conduyt_merge_contacts` first, else 409 `not_merged`); 409 `already_decided`, 403 `other_record_not_editable`; answers the list's `membershipRevision` and `total` after the decision and `previousMembershipRevision`; never retried |
 | `conduyt_add_contact_collaborator` | Add a team member as a collaborator (`POST /contacts/{id}/collaborators`); optional `expectedRevision`, 409 `contact_changed` |
 | `conduyt_remove_contact_collaborator` | Remove a collaborator (`DELETE /contacts/{id}/collaborators`, body); optional `expectedRevision`, 409 `contact_changed`, 404 when not a collaborator |
 | `conduyt_add_tags` | Add tags to a contact |

package/dist/tools/bulk.js

@@ -4,7 +4,7 @@ import { INVALID_NUMBER_REFUSALS } from "./contacts.js";
 /** (#136, Codex r1 m2) POST /bulk/contacts/update is NOT atomic and answers per row: an impossible phone is a per-row success:false inside HTTP 200 (no code) while other rows commit; the route takes no country */
 export const BULK_UPDATE_REFUSALS = " Results are PER ROW inside an HTTP 200 (not atomic: some rows can be saved while others fail): read data.summary { total, succeeded, failed } and data.results, each { id, success, error? }. An impossible US/Canada number (area code or exchange starting 0 or 1) fails only that row, success: false with the error text (no phone_invalid code, no top-level 400), and nothing is saved for that row. This route does not take country: a country-only row fails as a row, and a country sent beside another field is ignored while that field is applied (use conduyt_bulk_edit_contacts for a country; it refuses a null or blank country 400 country_invalid).";
 export function registerBulkTools(server, client) {
-    server.tool("conduyt_ai_import_contacts", "AI-powered bulk contact import. Accepts up to 1000 contacts with optional auto-tagging, smart list creation, and automation enrollment. Deduplicates by email, phone, or both.", {
+    server.tool("conduyt_ai_import_contacts", "AI-powered bulk contact import. Accepts up to 1000 contacts with optional auto-tagging, smart list creation, and automation enrollment. Deduplicates by email, phone, or both. A workspace whose identifier index is still being built answers 503 `IDENTITY_INDEX_NOT_READY` (nothing imported; retry later).", {
         contacts: z.array(z.object({
             firstName: z.string().optional(),
             lastName: z.string().optional(),
@@ -152,7 +152,7 @@ export function registerBulkTools(server, client) {
         const result = await client.post("/api/v1/bulk/deals/update", params);
         return formatResult(result);
     });
-    server.tool("conduyt_import_preflight", "Pre-check a contact import BEFORE running it — returns criticalWarnings (phone-less list bound for SMS, heavy create-only duplicate skips, double-mapped columns), duplicate/existing-match estimates, invalid emails, DNC/litigator hits, SMS-provider readiness, and plan-limit impact. Same engine the import wizard uses; call this before conduyt_ai_import_contacts on any sizeable list.", {
+    server.tool("conduyt_import_preflight", "Pre-check a contact import BEFORE running it — returns criticalWarnings (phone-less list bound for SMS, heavy create-only duplicate skips, double-mapped columns), duplicate/existing-match estimates, invalid emails, DNC/litigator hits, SMS-provider readiness, and plan-limit impact. Same engine the import wizard uses; call this before conduyt_ai_import_contacts on any sizeable list. A workspace whose identifier index is still being built answers 503 `IDENTITY_INDEX_NOT_READY` (nothing checked; retry later).", {
         objectType: z.enum(["contacts", "opportunities", "companies"]).default("contacts").describe("What the import creates"),
         importMode: z.enum(["create_and_update", "create_only", "update_only"]).optional().describe("Duplicate handling mode the import will use"),
         totalRows: z.number().describe("Total rows in the file/payload"),
@@ -160,6 +160,8 @@ export function registerBulkTools(server, client) {
         phones: z.array(z.string()).optional().describe("All phone values from the file (order-free)"),
         mappedFields: z.array(z.string()).optional().describe("The Conduyt field names your columns map to, e.g. ['firstName','phone']"),
         removeDuplicates: z.boolean().optional().describe("Whether explicit dedupe is on"),
+        ambiguousMatchMode: z.enum(["proposal", "hold", "create_new"]).nullish().describe("What the import does with a row whose email matches one record and phone another (identity v2): 'proposal' (the platform default: the row is created and carries a duplicate proposal naming the similar records) or 'hold' (held for review). 'create_new' is RETIRED for new imports (the server answers 400); it is accepted here only so a preview of an old job still validates."),
+        enrollAdditionalCampaign: z.boolean().optional().describe("true = the import's Add mode: a contested email or phone slot value is stripped and the row is still created (estimated the way the import will run it); every other mode skips such a row as secondary_identifier_conflict"),
         duplicateCheckFields: z.array(z.enum(["email", "phone"])).optional().describe("Identifiers explicit dedupe checks"),
         rowIdentifiers: z.array(z.object({
             email: z.string().nullable().optional(),

package/dist/tools/contacts.js

@@ -6,6 +6,15 @@ import { strictInput } from "./strict.js";
  *  create that carries callId must not carry either field. Refused here, after every field is merged, with the rule named. */
 export const CALL_DERIVED_REFUSAL = "callId cannot be combined with source or assignedTo: for a lead created from a call the server derives both (source is 'Inbound Call', the owner is the rep who took the call). Omit them.";
 export const callDerivedFieldsConflict = (v) => v.callId !== undefined && (v.source !== undefined || v.assignedTo !== undefined);
+/** Identity rules v2 (board #69, app main 61bf61876): what a create answers when the email or phone already belongs to a record. */
+const IDENTITY_409_MEANING = "A 409 with { existingId, rule, ruleVersion, matchedOn, reason } means the server's identity policy identified the incoming person WITH the record existingId (rule and matchedOn say how). It is not proof by itself: the policy deliberately allows two different people on one shared identifier when their full names conflict (rule R6; shared phone lines exist), and that case is NOT refused: the server creates the record and shows a passive duplicate proposal (conduyt_list_duplicate_proposals). The server itself refuses creates it identifies as the same person, so never create a copy. Before you update existingId, CONFIRM the identity (name, company); never treat a shared phone or email as proof that it is the same person.";
+const IDENTITY_CREATE_ANSWERS = "Identity rules (v2): " + IDENTITY_409_MEANING + " 409 with code `identifier_changed` or `owner_busy` = another save for the same email, phone or owner was in progress, nothing was written: wait a moment and send the same request again (retryable). 503 with code `IDENTITY_INDEX_NOT_READY` = the workspace's identifier index is still being built at this size, nothing was written: retry later. A possible duplicate that is not an exact match is created and shown as a duplicate proposal on the record (conduyt_list_duplicate_proposals).";
+const IDENTITY_SAVE_RETRY = "Identity rules (v2): " + IDENTITY_409_MEANING + " 409 with code `identifier_changed` = another save for this email or phone was in progress (or the record's email or phone changed while this saved), nothing was written: reload the contact and send the change again (retryable). 409 with code `owner_busy` = another save for the same owner was in progress, nothing was written: wait a moment and send the same request again (retryable). 503 with code `IDENTITY_INDEX_NOT_READY` = the workspace's identifier index is still being built at this size, nothing was written: retry later.";
+const PROPOSAL_DECISIONS = ["not_sure", "different", "merge"];
+/** Duplicate proposals look (board #95, app f2d638db6): paging bounds of the proposal lists. */
+const pageLimit = (max, dflt, name) => z.number().int().min(1).max(max).optional().describe(`${name}: integer 1-${max} (default ${dflt}); a value above ${max} is refused, not capped`);
+const opaqueCursor = (name, from) => z.string().min(1).max(2048).optional().describe(`${name}: the ${from} of the previous page's answer, unchanged (opaque). Omit for the first page.`);
+const MEMBERSHIP_REVISION_NOTE = "membershipRevision and heldIdentifiersMembershipRevision are opaque digests of each list's whole shown set (every page answers the same value while the list is unchanged): keep page one's revision and, when a later page answers another, discard that page and read page one again.";
 export const CONTACT_REVISION_MAX = 2147483647;
 const CONTACT_CHANGED = "A stale pin is refused with 409 and code contact_changed (nothing written): the error text carries `code`, the contact's CURRENT `revision` and the current `contact`; reload, decide, and call again with that revision (never retry the same pin). A malformed expectedRevision is a 400; only an omitted field means unpinned.";
 const expectedRevision = () => z.number().int().min(0).max(CONTACT_REVISION_MAX).optional().describe("Optimistic-concurrency pin: the contact `revision` as you last read it (conduyt_get_contact / conduyt_list_contacts / a previous change). Omit for last-write-wins per field.");
@@ -95,13 +104,13 @@ export function registerContactTools(server, client) {
         const result = await client.get(`/api/v1/contacts?${params}`);
         return formatResult(result);
     });
-    server.tool("conduyt_get_contact", "Get a single contact with full details — profile, tags, custom fields, timeline, deals, and activity history. Includes `revision` (integer save revision): pass it as expectedRevision on conduyt_update_contact or the collaborator tools so a newer change is never overwritten. Includes `hasOutboundSms` (boolean): true when this workspace has ever PROVABLY texted the contact (a proven send only: not a draft, a queued row or a pre-send failure); use it to pick the `context` for conduyt_check_message (false = 'first', true = 'conversation'). Also includes `hasOutboundEmail` (boolean): the same for email (true when at least one outbound email to the contact was proven sent, so a genuine \"Re:\" reply is a conversation and not flagged); use it to pick the `context` for an email check.", {
+    server.tool("conduyt_get_contact", "Get a single contact with full details — profile, tags, custom fields, timeline, deals, and activity history. Includes `revision` (integer save revision): pass it as expectedRevision on conduyt_update_contact or the collaborator tools so a newer change is never overwritten. Includes `hasOutboundSms` (boolean): true when this workspace has ever PROVABLY texted the contact (a proven send only: not a draft, a queued row or a pre-send failure); use it to pick the `context` for conduyt_check_message (false = 'first', true = 'conversation'). Also includes `hasOutboundEmail` (boolean): the same for email (true when at least one outbound email to the contact was proven sent, so a genuine \"Re:\" reply is a conversation and not flagged); use it to pick the `context` for an email check. Also includes `duplicateProposals` (the open and not-sure possible-duplicate lines on this record, each naming the other record as far as your key may see it) and `heldIdentifiers` (emails or phones held from this record because another record owns them, value-free), each the FIRST page only, with duplicateProposalsTotal, duplicateProposalsNextCursor, duplicateProposalsMembershipRevision, heldIdentifiersTotal, heldIdentifiersNextCursor and heldIdentifiersMembershipRevision (page on with conduyt_list_duplicate_proposals, passing the next cursors as cursor / held_cursor); list or decide them with conduyt_list_duplicate_proposals / conduyt_decide_duplicate_proposal.", {
         id: z.string().describe("Contact UUID"),
     }, async ({ id }) => {
         const result = await client.get(`/api/v1/contacts/${id}`);
         return formatResult(result);
     });
-    const createContactTool = server.tool("conduyt_create_contact", "Create a new contact in the CRM. Email or phone is recommended but not strictly required. With callId (a lead made from a contact-less inbound call) you must NOT send source or assignedTo: the server derives both from the call, and the request is refused if either is present." + INVALID_NUMBER_REFUSALS, {
+    const createContactTool = server.tool("conduyt_create_contact", "Create a new contact in the CRM. Email or phone is recommended but not strictly required. With callId (a lead made from a contact-less inbound call) you must NOT send source or assignedTo: the server derives both from the call, and the request is refused if either is present." + INVALID_NUMBER_REFUSALS + " " + IDENTITY_CREATE_ANSWERS, {
         email: z.string().optional().describe("Contact email address"),
         firstName: z.string().optional().describe("First name"),
         lastName: z.string().optional().describe("Last name"),
@@ -131,7 +140,7 @@ export function registerContactTools(server, client) {
         created.inputSchema = Object.assign(base.superRefine((v, ctx) => { if (callDerivedFieldsConflict(v))
             ctx.addIssue({ code: z.ZodIssueCode.custom, message: CALL_DERIVED_REFUSAL, path: ["callId"] }); }), { shape: base.shape });
     }
-    strictInput(server.tool("conduyt_update_contact", "Update an existing contact's fields — name, email, phone, company, custom fields. customFields merge into existing values (omit a key to leave it unchanged). Pass expectedRevision (the contact's `revision` as you read it) to refuse the save when the contact changed since." + INVALID_NUMBER_REFUSALS + " " + CONTACT_CHANGED, {
+    strictInput(server.tool("conduyt_update_contact", "Update an existing contact's fields — name, email, phone, company, custom fields. customFields merge into existing values (omit a key to leave it unchanged). Pass expectedRevision (the contact's `revision` as you read it) to refuse the save when the contact changed since." + INVALID_NUMBER_REFUSALS + " " + CONTACT_CHANGED + " " + IDENTITY_SAVE_RETRY, {
         id: z.string().describe("Contact UUID"),
         email: z.string().optional().describe("Updated email"),
         firstName: z.string().optional().describe("Updated first name"),
@@ -235,4 +244,46 @@ export function registerContactTools(server, client) {
         mergePreviews.drop(key);
         return formatResult(result);
     }));
+    strictInput(server.tool("conduyt_list_duplicate_proposals", "List the possible duplicates of one contact (GET /api/v1/contacts/{contactId}/duplicate-proposals, identity rules v2; requires contacts:view). Answers { data: { proposals, heldIdentifiers, total, nextCursor, membershipRevision, heldIdentifiersTotal, heldIdentifiersNextCursor, heldIdentifiersMembershipRevision } }. Each proposal: { id (the proposalId for conduyt_decide_duplicate_proposal), status ('open' or 'not_sure': the only two shown), rule, ruleVersion, source, createdAt, decidedAt, raisedHere (true = this record is the newer arrival the proposal was raised on), other: { id, name, createdAt, visible, editable } }. When your key cannot view the other record it is described only as 'a contact you cannot view' with id and createdAt null and visible false: you cannot decide that pair. heldIdentifiers are the emails or phones this record was NOT given because another record owns them (rule 4), value-free: { id, kind ('email' or 'phone'), rule, source, createdAt, heldBy: [{ id, name, visible }] }. Paging: both lists are keyset paged, newest first. cursor / limit (1-100, default 50) page the proposals; held_cursor / held_limit (1-100, default 20) page the held identifiers; a list sent without its cursor answers its first page. total and heldIdentifiersTotal count every line of each list (all pages); nextCursor and heldIdentifiersNextCursor are the cursors of the next pages, null on the last page. " + MEMBERSHIP_REVISION_NOTE + " Read-only, nothing is changed. Refusals: 400 code `invalid_cursor` (a cursor this list did not issue, a held cursor sent as cursor or the reverse), 400 naming limit or held_limit, 404 = no such contact for you. conduyt_get_contact carries the first page of the same two lists.", {
+        contactId: z.string().uuid().describe("Contact UUID whose possible duplicates to list"),
+        cursor: opaqueCursor("cursor", "nextCursor"),
+        limit: pageLimit(100, 50, "limit (proposals per page)"),
+        held_cursor: opaqueCursor("held_cursor", "heldIdentifiersNextCursor"),
+        held_limit: pageLimit(100, 20, "held_limit (held identifiers per page)"),
+    }, async ({ contactId, cursor, limit, held_cursor, held_limit }) => {
+        const qp = new URLSearchParams();
+        if (cursor !== undefined)
+            qp.set("cursor", cursor);
+        if (limit !== undefined)
+            qp.set("limit", String(limit));
+        if (held_cursor !== undefined)
+            qp.set("held_cursor", held_cursor);
+        if (held_limit !== undefined)
+            qp.set("held_limit", String(held_limit));
+        const qs = qp.toString();
+        const result = await client.get(`/api/v1/contacts/${encodeURIComponent(contactId)}/duplicate-proposals` + (qs ? `?${qs}` : ""));
+        return formatResult(result);
+    }));
+    strictInput(server.tool("conduyt_decide_duplicate_proposal", "Record a decision on one possible-duplicate pair shown on a contact (POST /api/v1/contacts/{contactId}/duplicate-proposals/{proposalId} with { decision }; requires contacts:edit on BOTH records of the pair). Get proposalId from conduyt_list_duplicate_proposals. decision, exactly one of: 'not_sure' = keep both records visible, the pair stays listed and who looked is recorded (it can be decided again later); 'different' = the two records are different people, the pair is never shown again and the decision is FINAL; 'merge' = record that the pair is ALREADY merged: this tool NEVER merges. Merge first with conduyt_merge_contacts (preview, then confirm), then send 'merge' here; before the merge exists it is refused with 409 code `not_merged`. A pair already decided 'different' or merged is final: 409 code `already_decided` (also when someone decided it just now). Other refusals, nothing written: 404 (no such proposal on this contact: for EVERY decision; or the other record is gone: for 'not_sure' and 'different' only, while 'merge' still succeeds after the other record has been merged away), 403 code `other_record_not_editable` (you cannot edit the other record), 403 (you can view this contact but not edit it), 400 (decision missing or not one of the three), 402 billing. Answers { data: { id, status, decidedAt, previousMembershipRevision, membershipRevision, total } } with status 'not_sure', 'different' or 'merged'. membershipRevision and total are this contact's proposals list AFTER the decision (the same digest and count conduyt_list_duplicate_proposals answers); previousMembershipRevision is that digest just BEFORE the write (equal to membershipRevision on an idempotent repeat): a client holding loaded pages adopts the after values only when previousMembershipRevision equals the revision it holds, otherwise it reads page one again. Never retried automatically.", {
+        contactId: z.string().uuid().describe("Contact UUID the proposal is shown on"),
+        proposalId: z.string().uuid().describe("The proposal id from conduyt_list_duplicate_proposals"),
+        decision: z.enum(PROPOSAL_DECISIONS).describe("'not_sure' keeps both visible; 'different' = different people, never shown again (final); 'merge' = the pair is already merged elsewhere (run conduyt_merge_contacts first; this tool never merges)"),
+    }, async ({ contactId, proposalId, decision }) => {
+        const result = await client.post(`/api/v1/contacts/${encodeURIComponent(contactId)}/duplicate-proposals/${encodeURIComponent(proposalId)}`, { decision });
+        return formatResult(result);
+    }));
+    strictInput(server.tool("conduyt_list_import_duplicate_proposals", "List the duplicate proposals one import raised on the records it created (GET /api/v1/imports/{importId}/duplicate-proposals; the import results section 'Created, similar record exists'; requires contacts:view). One row per proposal, EVERY status ('open', 'not_sure', 'different', 'merged'; a pair whose records are merged reads 'merged'), oldest first. Paged with page (1-100000, default 1) and per_page (1-100, default 50): answers { data: { rows, meta: { page, per_page, total } } }, total counts every row of the import. Each row: { proposalId, status, rowNum (the import file's row number), createdAt, decidedAt, decidedByName, newRecord (the record the import created), similar (the existing record it may duplicate), matchedOn (kinds only such as 'phone' or 'phone + company', never a value), keptName (for a merged pair, the record that was kept) }; newRecord and similar are { id, name, visible, editable, live }. A record outside your key's visibility has id null and the name 'A contact you cannot view': that row cannot be decided. Decide a row with conduyt_decide_duplicate_proposal (contactId = newRecord.id, proposalId; needs contacts:edit on both records). An owner, admin or view-all key reads any import of the account, any other key only the imports its user ran. Read-only. Refusals: 400 naming page or per_page (not an integer, out of range), 403 without contacts:view, 404 for an unknown import or one this key may not read.", {
+        importId: z.string().uuid().describe("Import job UUID"),
+        page: z.number().int().min(1).max(100000).optional().describe("page: integer 1-100000 (default 1)"),
+        per_page: pageLimit(100, 50, "per_page (rows per page)"),
+    }, async ({ importId, page, per_page }) => {
+        const qp = new URLSearchParams();
+        if (page !== undefined)
+            qp.set("page", String(page));
+        if (per_page !== undefined)
+            qp.set("per_page", String(per_page));
+        const qs = qp.toString();
+        const result = await client.get(`/api/v1/imports/${encodeURIComponent(importId)}/duplicate-proposals` + (qs ? `?${qs}` : ""));
+        return formatResult(result);
+    }));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "conduyt-mcp",
-  "version": "4.90.0",
+  "version": "4.92.0",
   "mcpName": "com.conduyt/mcp",
   "description": "MCP server for Conduyt CRM — expose CRM operations as AI-accessible tools",
   "type": "module",

package/scripts/coverage-matrix.json

@@ -1,9 +1,9 @@
 {
-  "generatedAt": "2026-10-16T01:23:28.000Z",
-  "toolCount": 352,
-  "totalEndpoints": 1090,
+  "generatedAt": "2026-10-16T09:38:16.598Z",
+  "toolCount": 355,
+  "totalEndpoints": 1093,
   "counts": {
-    "covered": 311,
+    "covered": 314,
     "excluded": 324,
     "planned": 455,
     "uncategorized": 0
@@ -1495,6 +1495,18 @@
       "status": "planned",
       "reason": "contact subroutes beyond the core CRUD/search tools"
     },
+    "GET /api/v1/contacts/:id/duplicate-proposals": {
+      "status": "covered",
+      "tools": [
+        "conduyt_list_duplicate_proposals"
+      ]
+    },
+    "POST /api/v1/contacts/:id/duplicate-proposals/:proposalId": {
+      "status": "covered",
+      "tools": [
+        "conduyt_decide_duplicate_proposal"
+      ]
+    },
     "POST /api/v1/contacts/:id/enrich": {
       "status": "planned",
       "reason": "contact subroutes beyond the core CRUD/search tools"
@@ -2964,6 +2976,12 @@
       "status": "planned",
       "reason": "import job monitoring/resubmission (ai-import tool covers creation)"
     },
+    "GET /api/v1/imports/:id/duplicate-proposals": {
+      "status": "covered",
+      "tools": [
+        "conduyt_list_import_duplicate_proposals"
+      ]
+    },
     "GET /api/v1/imports/:id/integrity": {
       "status": "planned",
       "reason": "import job monitoring/resubmission (ai-import tool covers creation)"

package/dist/tools/action-config-typos.d.ts

@@ -1,11 +0,0 @@
-export type ActionConfigTypo = {
-    actionType: string;
-    key: string;
-    suggestion: string;
-};
-/** The first misspelled option key in an actions graph (v1 array of {type, config}, or v2 { nodes: [{ action: {type, config} }] }), or null */
-export declare function findActionConfigTypo(graph: unknown): ActionConfigTypo | null;
-/** The refusal text; the details object is the final token */
-export declare function actionConfigTypoMessage(t: ActionConfigTypo): string;
-/** Throws (a plain Error) when the graph carries a misspelled option */
-export declare function assertNoActionConfigTypo(graph: unknown): void;

package/dist/tools/action-config-typos.js

@@ -1,78 +0,0 @@
-/**
- * Local typo guard for automation action configs (card ownership per lane, Codex r1/r2). The server validator is the authority
- * and there the option names are not enforced yet, so a typoed `laneSoruce` on assign_to_user would silently assign the run's
- * deal instead of the lane card. Only the options below are known here.
- *
- * Traversal rule: ONLY the real action positions of the graph are visited, exactly as the graph is shaped: a v1 `actions`
- * array's elements `{type, config}`, and a v2 graph's `nodes[].action` `{type, config}`. For each action of a known type the
- * IMMEDIATE keys of `config` are checked; the config VALUES are opaque and never descended into (a webhook payload may hold any
- * object, including one shaped like an action), and nothing outside those positions (request metadata, other node fields) is
- * scanned. A key that is not a known option but is a case-insensitive match or ONE edit (substitution, insertion, deletion or
- * adjacent transposition) from one is refused; keys further away, and every other action type, pass through.
- * Source of the names: lib/automation-action-registry.ts in the app (assign_to_user, create_deal, close_other_open_deals).
- */
-const KNOWN_ACTION_OPTIONS = {
-    assign_to_user: ["runWindow", "mode", "userId", "userIds", "groupId", "target", "applyTo", "overwriteExisting", "laneSource", "lanePipelineId", "laneStageId"],
-    create_deal: ["pipelineId", "stageId", "dealName", "dealValue", "allowDuplicates", "status", "source", "assignedTo", "leaveUnassigned"],
-    close_other_open_deals: ["lostReason"],
-};
-/** Damerau-Levenshtein (optimal string alignment) distance, case-insensitive */
-function distance(a, b) {
-    const x = a.toLowerCase(), y = b.toLowerCase();
-    const d = Array.from({ length: x.length + 1 }, (_, i) => [i, ...Array(y.length).fill(0)]);
-    for (let j = 1; j <= y.length; j++)
-        d[0][j] = j;
-    for (let i = 1; i <= x.length; i++) {
-        for (let j = 1; j <= y.length; j++) {
-            d[i][j] = Math.min(d[i - 1][j] + 1, d[i][j - 1] + 1, d[i - 1][j - 1] + (x[i - 1] === y[j - 1] ? 0 : 1));
-            if (i > 1 && j > 1 && x[i - 1] === y[j - 2] && x[i - 2] === y[j - 1])
-                d[i][j] = Math.min(d[i][j], d[i - 2][j - 2] + 1);
-        }
-    }
-    return d[x.length][y.length];
-}
-const isObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
-function checkAction(action) {
-    if (!isObject(action) || typeof action.type !== "string" || !isObject(action.config))
-        return null;
-    const known = KNOWN_ACTION_OPTIONS[action.type];
-    if (!known)
-        return null;
-    for (const key of Object.keys(action.config)) {
-        if (known.includes(key))
-            continue;
-        const near = known.find((k) => distance(key, k) <= 1);
-        if (near)
-            return { actionType: action.type, key, suggestion: near };
-    }
-    return null;
-}
-/** The first misspelled option key in an actions graph (v1 array of {type, config}, or v2 { nodes: [{ action: {type, config} }] }), or null */
-export function findActionConfigTypo(graph) {
-    if (Array.isArray(graph)) {
-        for (const action of graph) {
-            const t = checkAction(action);
-            if (t)
-                return t;
-        }
-        return null;
-    }
-    if (isObject(graph) && Array.isArray(graph.nodes)) {
-        for (const node of graph.nodes) {
-            const t = isObject(node) ? checkAction(node.action) : null;
-            if (t)
-                return t;
-        }
-    }
-    return null;
-}
-/** The refusal text; the details object is the final token */
-export function actionConfigTypoMessage(t) {
-    return `Unknown option "${t.key}" in ${t.actionType} config: did you mean "${t.suggestion}"? Nothing was sent. ${JSON.stringify(t)}`;
-}
-/** Throws (a plain Error) when the graph carries a misspelled option */
-export function assertNoActionConfigTypo(graph) {
-    const t = findActionConfigTypo(graph);
-    if (t)
-        throw new Error(actionConfigTypoMessage(t));
-}