conduyt-mcp 4.96.0 → 4.97.0

package/README.md

@@ -465,3 +465,7 @@ Scopes can be restricted to specific modules (contacts, deals, tasks, etc.).
 |----------|----------|-------------|
 | `CONDUYT_API_URL` | Yes | Base URL (e.g. `https://conduyt.app`) |
 | `CONDUYT_API_KEY` | Yes | API key starting with `cdy_` |
+
+## Release: the contract gate's catalog pin
+
+CI (`.github/workflows/contract-gate.yml`) runs `ENFORCE=1 node scripts/verify-contracts.mjs` against the app's `generated-api-catalog.json` at the commit pinned in `contracts/catalog-source.json` (`repo`, full 40-character `commit`, `catalogPath`). The workflow checks that commit out with the read-only deploy key on the app repository, stored as the repository secret `CONDUYT_APP_DEPLOY_KEY` (the private half; the checkout uses `ssh-key`) and fails closed if the secret or the file is missing. When you publish, set `commit` to the app commit the refreshed `scripts/contracts-snapshot.json` was generated from (the same one named in the CHANGELOG entry), in the same commit as the version bump. CI never uses a live API key. Under `ENFORCE=1` with a catalog source the gate also fails if `scripts/contracts-snapshot.json` differs from that catalog's endpoints in any field, so a pin and snapshot that disagree cannot pass.

package/dist/index.js

@@ -3,60 +3,7 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { createRequire } from "node:module";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { ConduytClient } from "./client.js";
-import { registerDiscoveryTools } from "./tools/discovery.js";
-import { registerContactTools } from "./tools/contacts.js";
-import { registerDealTools } from "./tools/deals.js";
-import { registerTaskTools } from "./tools/tasks.js";
-import { registerPipelineTools } from "./tools/pipelines.js";
-import { registerActivityTools } from "./tools/activities.js";
-import { registerAiTools } from "./tools/ai.js";
-import { registerAutomationTools } from "./tools/automations.js";
-import { registerSequenceTools } from "./tools/sequences.js";
-import { registerMessagingTools } from "./tools/messaging.js";
-import { registerMessageCheckSettingsTools } from "./tools/message-check-settings.js";
-import { registerCallTools } from "./tools/calls.js";
-import { registerDialerSettingsTools } from "./tools/dialer-settings.js";
-import { registerCompanyTools } from "./tools/companies.js";
-import { registerTagTools } from "./tools/tags.js";
-import { registerCalendarTools } from "./tools/calendar.js";
-import { registerFormTools } from "./tools/forms.js";
-import { registerInvoiceTools } from "./tools/invoices.js";
-import { registerWebhookTools } from "./tools/webhooks.js";
-import { registerFormIntakeTools } from "./tools/form-intakes.js";
-import { registerCalendlyTools } from "./tools/calendly.js";
-import { registerBoardSettingsTools } from "./tools/board-settings.js";
-import { registerMailchimpTools } from "./tools/mailchimp.js";
-import { registerStatusMetadataTools } from "./tools/status-metadata.js";
-import { registerNotificationTools } from "./tools/notifications.js";
-import { registerChatTools } from "./tools/chat.js";
-import { registerCustomFieldTools } from "./tools/custom-fields.js";
-import { registerSmartListTools } from "./tools/smart-lists.js";
-import { registerUserTools } from "./tools/users.js";
-import { registerBulkTools } from "./tools/bulk.js";
-import { registerBatchOperationTools } from "./tools/batch-operations.js";
-import { registerDncTools } from "./tools/dnc.js";
-import { registerSavedFilterTools } from "./tools/saved-filters.js";
-import { registerDripCampaignTools } from "./tools/drip-campaigns.js";
-import { registerScoringTools } from "./tools/scoring.js";
-import { registerProductTools } from "./tools/products.js";
-import { registerTemplateTools } from "./tools/templates.js";
-import { registerDashboardTools } from "./tools/dashboard.js";
-import { registerAiExtendedTools } from "./tools/ai-extended.js";
-import { registerWorkflowSandboxTools } from "./tools/workflow-sandbox.js";
-import { registerPrivacyTools } from "./tools/privacy.js";
-import { registerSmartViewTools } from "./tools/smart-views.js";
-import { registerAccountExportTools } from "./tools/account-exports.js";
-import { registerLifecycleTools } from "./tools/lifecycle.js";
-import { registerLeadPoolTools } from "./tools/lead-pool.js";
-import { registerReplyCaptureTools } from "./tools/reply-capture.js";
-import { registerCallFlowTools } from "./tools/call-flows.js";
-import { registerProjectBlueTools } from "./tools/project-blue.js";
-import { registerWhatsappTools } from "./tools/whatsapp.js";
-import { registerFromkTools } from "./tools/fromk.js";
-import { registerZoomTools } from "./tools/zoom.js";
-import { registerBookingPageTools } from "./tools/booking-pages.js";
-import { registerReportTools } from "./tools/reports.js";
-import { registerReportDashboardTools } from "./tools/dashboards.js";
+import { registerAllTools } from "./register-all.js";
 const apiUrl = process.env.CONDUYT_API_URL;
 const apiKey = process.env.CONDUYT_API_KEY;
 if (!apiUrl || !apiKey) {
@@ -82,59 +29,6 @@ const server = new McpServer({
     name: "conduyt",
     version: pkg.version,
 });
-registerDiscoveryTools(server, client);
-registerContactTools(server, client);
-registerDealTools(server, client);
-registerTaskTools(server, client);
-registerPipelineTools(server, client);
-registerActivityTools(server, client);
-registerAiTools(server, client);
-registerAutomationTools(server, client);
-registerSequenceTools(server, client);
-registerMessagingTools(server, client);
-registerMessageCheckSettingsTools(server, client);
-registerCallTools(server, client);
-registerDialerSettingsTools(server, client);
-registerCompanyTools(server, client);
-registerTagTools(server, client);
-registerCalendarTools(server, client);
-registerFormTools(server, client);
-registerInvoiceTools(server, client);
-registerWebhookTools(server, client);
-registerFormIntakeTools(server, client);
-registerCalendlyTools(server, client);
-registerBoardSettingsTools(server, client);
-registerMailchimpTools(server, client);
-registerStatusMetadataTools(server, client);
-registerNotificationTools(server, client);
-registerChatTools(server, client);
-registerCustomFieldTools(server, client);
-registerSmartListTools(server, client);
-registerUserTools(server, client);
-registerBulkTools(server, client);
-registerBatchOperationTools(server, client);
-registerDncTools(server, client);
-registerSavedFilterTools(server, client);
-registerDripCampaignTools(server, client);
-registerScoringTools(server, client);
-registerProductTools(server, client);
-registerTemplateTools(server, client);
-registerDashboardTools(server, client);
-registerAiExtendedTools(server, client);
-registerWorkflowSandboxTools(server, client);
-registerPrivacyTools(server, client);
-registerSmartViewTools(server, client);
-registerAccountExportTools(server, client);
-registerLifecycleTools(server, client);
-registerLeadPoolTools(server, client);
-registerReplyCaptureTools(server, client);
-registerCallFlowTools(server, client);
-registerProjectBlueTools(server, client);
-registerWhatsappTools(server, client);
-registerFromkTools(server, client);
-registerZoomTools(server, client);
-registerBookingPageTools(server, client);
-registerReportTools(server, client);
-registerReportDashboardTools(server, client);
+registerAllTools(server, client);
 const transport = new StdioServerTransport();
 await server.connect(transport);

package/dist/register-all.d.ts

@@ -0,0 +1,4 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { ConduytClient } from "./client.js";
+/** Registers every Conduyt tool on the server; each tool gets its title + MCP annotations from src/tool-annotations.ts. */
+export declare function registerAllTools(server: McpServer, client: ConduytClient): void;

package/dist/register-all.js

@@ -0,0 +1,113 @@
+import { annotateRegistrations } from "./tool-annotations.js";
+import { registerDiscoveryTools } from "./tools/discovery.js";
+import { registerContactTools } from "./tools/contacts.js";
+import { registerDealTools } from "./tools/deals.js";
+import { registerTaskTools } from "./tools/tasks.js";
+import { registerPipelineTools } from "./tools/pipelines.js";
+import { registerActivityTools } from "./tools/activities.js";
+import { registerAiTools } from "./tools/ai.js";
+import { registerAutomationTools } from "./tools/automations.js";
+import { registerSequenceTools } from "./tools/sequences.js";
+import { registerMessagingTools } from "./tools/messaging.js";
+import { registerMessageCheckSettingsTools } from "./tools/message-check-settings.js";
+import { registerCallTools } from "./tools/calls.js";
+import { registerDialerSettingsTools } from "./tools/dialer-settings.js";
+import { registerCompanyTools } from "./tools/companies.js";
+import { registerTagTools } from "./tools/tags.js";
+import { registerCalendarTools } from "./tools/calendar.js";
+import { registerFormTools } from "./tools/forms.js";
+import { registerInvoiceTools } from "./tools/invoices.js";
+import { registerWebhookTools } from "./tools/webhooks.js";
+import { registerFormIntakeTools } from "./tools/form-intakes.js";
+import { registerCalendlyTools } from "./tools/calendly.js";
+import { registerBoardSettingsTools } from "./tools/board-settings.js";
+import { registerMailchimpTools } from "./tools/mailchimp.js";
+import { registerStatusMetadataTools } from "./tools/status-metadata.js";
+import { registerNotificationTools } from "./tools/notifications.js";
+import { registerChatTools } from "./tools/chat.js";
+import { registerCustomFieldTools } from "./tools/custom-fields.js";
+import { registerSmartListTools } from "./tools/smart-lists.js";
+import { registerUserTools } from "./tools/users.js";
+import { registerBulkTools } from "./tools/bulk.js";
+import { registerBatchOperationTools } from "./tools/batch-operations.js";
+import { registerDncTools } from "./tools/dnc.js";
+import { registerSavedFilterTools } from "./tools/saved-filters.js";
+import { registerDripCampaignTools } from "./tools/drip-campaigns.js";
+import { registerScoringTools } from "./tools/scoring.js";
+import { registerProductTools } from "./tools/products.js";
+import { registerTemplateTools } from "./tools/templates.js";
+import { registerDashboardTools } from "./tools/dashboard.js";
+import { registerAiExtendedTools } from "./tools/ai-extended.js";
+import { registerWorkflowSandboxTools } from "./tools/workflow-sandbox.js";
+import { registerPrivacyTools } from "./tools/privacy.js";
+import { registerSmartViewTools } from "./tools/smart-views.js";
+import { registerAccountExportTools } from "./tools/account-exports.js";
+import { registerLifecycleTools } from "./tools/lifecycle.js";
+import { registerLeadPoolTools } from "./tools/lead-pool.js";
+import { registerReplyCaptureTools } from "./tools/reply-capture.js";
+import { registerCallFlowTools } from "./tools/call-flows.js";
+import { registerProjectBlueTools } from "./tools/project-blue.js";
+import { registerWhatsappTools } from "./tools/whatsapp.js";
+import { registerFromkTools } from "./tools/fromk.js";
+import { registerZoomTools } from "./tools/zoom.js";
+import { registerBookingPageTools } from "./tools/booking-pages.js";
+import { registerReportTools } from "./tools/reports.js";
+import { registerReportDashboardTools } from "./tools/dashboards.js";
+/** Registers every Conduyt tool on the server; each tool gets its title + MCP annotations from src/tool-annotations.ts. */
+export function registerAllTools(server, client) {
+    annotateRegistrations(server);
+    registerDiscoveryTools(server, client);
+    registerContactTools(server, client);
+    registerDealTools(server, client);
+    registerTaskTools(server, client);
+    registerPipelineTools(server, client);
+    registerActivityTools(server, client);
+    registerAiTools(server, client);
+    registerAutomationTools(server, client);
+    registerSequenceTools(server, client);
+    registerMessagingTools(server, client);
+    registerMessageCheckSettingsTools(server, client);
+    registerCallTools(server, client);
+    registerDialerSettingsTools(server, client);
+    registerCompanyTools(server, client);
+    registerTagTools(server, client);
+    registerCalendarTools(server, client);
+    registerFormTools(server, client);
+    registerInvoiceTools(server, client);
+    registerWebhookTools(server, client);
+    registerFormIntakeTools(server, client);
+    registerCalendlyTools(server, client);
+    registerBoardSettingsTools(server, client);
+    registerMailchimpTools(server, client);
+    registerStatusMetadataTools(server, client);
+    registerNotificationTools(server, client);
+    registerChatTools(server, client);
+    registerCustomFieldTools(server, client);
+    registerSmartListTools(server, client);
+    registerUserTools(server, client);
+    registerBulkTools(server, client);
+    registerBatchOperationTools(server, client);
+    registerDncTools(server, client);
+    registerSavedFilterTools(server, client);
+    registerDripCampaignTools(server, client);
+    registerScoringTools(server, client);
+    registerProductTools(server, client);
+    registerTemplateTools(server, client);
+    registerDashboardTools(server, client);
+    registerAiExtendedTools(server, client);
+    registerWorkflowSandboxTools(server, client);
+    registerPrivacyTools(server, client);
+    registerSmartViewTools(server, client);
+    registerAccountExportTools(server, client);
+    registerLifecycleTools(server, client);
+    registerLeadPoolTools(server, client);
+    registerReplyCaptureTools(server, client);
+    registerCallFlowTools(server, client);
+    registerProjectBlueTools(server, client);
+    registerWhatsappTools(server, client);
+    registerFromkTools(server, client);
+    registerZoomTools(server, client);
+    registerBookingPageTools(server, client);
+    registerReportTools(server, client);
+    registerReportDashboardTools(server, client);
+}

package/dist/tool-annotations.d.ts

@@ -0,0 +1,33 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+/**
+ * MCP tool title + annotations for EVERY registered tool (#359). Hosts and connector directories read these hints to decide
+ * which tools may run without asking, and ChatGPT's directory requires all four hints to be explicit booleans.
+ *
+ * Every tool talks to the Conduyt API only, so openWorldHint is false on every row. The four kinds:
+ *   ro       reads only                                   (readOnly true,  destructive false, idempotent true)
+ *   create   adds records / sends / enqueues              (readOnly false, destructive false, idempotent false)
+ *   update   changes existing state, same call repeated   (readOnly false, destructive false, idempotent true)
+ *            lands on the same state (PATCH / PUT / settings / reversible archive, disable, unassign)
+ *   destroy  deletes, erases, merges or tears down data   (readOnly false, destructive true,  idempotent true)
+ * Policy (Codex mcp359-r1): readOnlyHint means no Conduyt domain state is written by the call, including side-effect GETs
+ * (membership bootstrap, snapshot refresh, run ledger, Activity rows). Operational bookkeeping that is not CRM data (AI-guard audit
+ * rows, expiring dry-run confirmation tokens, rate limits) is deliberately outside that policy, so conduyt_ai_compose_email,
+ * conduyt_ai_enrich_contact and the conduyt_ai_task_* dry runs stay read-only. destructiveHint is true when ANY branch can delete
+ * or irreversibly change data (final decisions, terminal cancels, consent changes, token revocation, replace-mode deletes).
+ * A tool whose callback uses more than one HTTP method takes the most conservative combination. A new tool without a row
+ * here fails registration (annotateRegistrations) and the build-time test.
+ */
+export interface ToolAnnotation {
+    title: string;
+    readOnlyHint: boolean;
+    destructiveHint: boolean;
+    idempotentHint: boolean;
+    openWorldHint: boolean;
+}
+export declare const TOOL_ANNOTATIONS: Record<string, ToolAnnotation>;
+/**
+ * Wraps server.tool so each tool registered afterwards gets its title and annotations from TOOL_ANNOTATIONS. The registered
+ * tool object is mutated in place (the same object strictInput() already swaps the input schema on), so the rest of each
+ * tool's registration is untouched. A tool with no row throws at registration.
+ */
+export declare function annotateRegistrations(server: McpServer): void;

package/dist/tool-annotations.js

@@ -0,0 +1,386 @@
+const row = (title, readOnlyHint, destructiveHint, idempotentHint) => ({
+    title, readOnlyHint, destructiveHint, idempotentHint, openWorldHint: false,
+});
+const ro = (title) => row(title, true, false, true);
+const create = (title) => row(title, false, false, false);
+const update = (title) => row(title, false, false, true);
+const destroy = (title) => row(title, false, true, true);
+export const TOOL_ANNOTATIONS = {
+    conduyt_api_catalog: ro("Get API Catalog"),
+    conduyt_check_permissions: ro("Check Permissions"),
+    conduyt_search: ro("Search CRM Records"),
+    conduyt_mcp_coverage: ro("Get MCP Coverage Matrix"),
+    conduyt_list_contacts: ro("List Contacts"),
+    conduyt_get_contact: ro("Get Contact"),
+    conduyt_create_contact: create("Create Contact"),
+    conduyt_update_contact: update("Update Contact"),
+    conduyt_add_contact_collaborator: update("Add Contact Collaborator"),
+    conduyt_remove_contact_collaborator: update("Remove Contact Collaborator"),
+    conduyt_delete_contact: destroy("Delete Contact"),
+    conduyt_add_tags: update("Add Tags"),
+    conduyt_link_contact_to_deal: update("Link Contact to Deal"),
+    conduyt_verify_line_type: create("Verify Phone Line Type"),
+    conduyt_merge_contacts: destroy("Merge Contacts"),
+    conduyt_list_duplicate_proposals: ro("List Duplicate Proposals"),
+    conduyt_decide_duplicate_proposal: destroy("Decide Duplicate Proposal"),
+    conduyt_list_import_duplicate_proposals: ro("List Import Duplicate Proposals"),
+    conduyt_list_deals: ro("List Deals"),
+    conduyt_pipeline_health: ro("Get Pipeline Health"),
+    conduyt_pipeline_health_fix_deal: update("Fix Deal From Pipeline Health"),
+    conduyt_pipeline_health_fix_next_action: create("Set Next Action From Pipeline Health"),
+    conduyt_get_deal: ro("Get Deal"),
+    conduyt_create_deal: create("Create Deal"),
+    conduyt_update_deal: row("Update Deal", false, false, false), // only a repeated close is silent; any other identical PATCH re-dispatches deal.updated and writes a deal.updated audit row (deals/[id]/route.ts:1330,1346)
+    conduyt_delete_deal: destroy("Delete Deal"),
+    conduyt_import_deals: create("Import Deals"),
+    conduyt_add_deal_tags: update("Add Deal Tags"),
+    conduyt_list_deal_views: ro("List Deal Views"),
+    conduyt_list_tasks: ro("List Tasks"),
+    conduyt_create_task: create("Create Task"),
+    conduyt_get_task: ro("Get Task"),
+    conduyt_update_task: update("Update Task"),
+    conduyt_complete_task: update("Complete Task"),
+    conduyt_delete_task: destroy("Delete Task"),
+    conduyt_list_pipelines: ro("List Pipelines"),
+    conduyt_list_archived_pipelines: ro("List Archived Pipelines"),
+    conduyt_create_pipeline: create("Create Pipeline"),
+    conduyt_update_pipeline: update("Update Pipeline"),
+    conduyt_delete_pipeline: destroy("Delete Pipeline"),
+    conduyt_archive_pipeline: update("Archive Pipeline"),
+    conduyt_restore_pipeline: update("Restore Pipeline"),
+    conduyt_reorder_pipelines: update("Reorder Pipelines"),
+    conduyt_create_stage: create("Create Stage"),
+    conduyt_update_stage: update("Update Stage"),
+    conduyt_reorder_stages: update("Reorder Stages"),
+    conduyt_delete_stage: destroy("Delete Stage"),
+    conduyt_list_activities: ro("List Activities"),
+    conduyt_create_activity: create("Create Activity"),
+    conduyt_ai_insights: create("Query AI Insights"),
+    conduyt_list_automations: ro("List Automations"),
+    conduyt_get_automation: ro("Get Automation"),
+    conduyt_create_automation: create("Create Automation"),
+    conduyt_update_automation: row("Update Automation", false, true, false), // webhook secret rotate/clear revokes the old credential; every config write bumps configRevision (automations/[id]/route.ts:248-275,726-739,1576-1579)
+    conduyt_publish_automation: row("Publish Automation", false, false, false), // each repeat can publish another numbered version (automations/[id]/publish/route.ts:218,291)
+    conduyt_resolve_names: ro("Resolve Names to IDs"),
+    conduyt_list_sequences: ro("List Sequences"),
+    conduyt_get_sequence: ro("Get Sequence"),
+    conduyt_create_sequence: create("Create Sequence"),
+    conduyt_update_sequence: row("Update Sequence", false, false, false), // archived:true assigns a fresh archivedAt on every call (emails/sequences/[id]/route.ts:124-128,235-238)
+    conduyt_list_sequence_senders: ro("List Sequence Senders"),
+    conduyt_preflight_sequence_enrollment: ro("Preflight Sequence Enrollment"),
+    conduyt_pick_sequence_list: ro("Pick Sequence List"),
+    conduyt_enroll_in_sequence: create("Enroll in Sequence"),
+    conduyt_unenroll_from_sequence: destroy("Unenroll from Sequence"),
+    conduyt_list_sequence_enrollments: ro("List Sequence Enrollments"),
+    conduyt_get_sequence_stats: ro("Get Sequence Stats"),
+    conduyt_check_message: ro("Check Message Grade"),
+    conduyt_list_sms_provider_options: ro("List SMS Provider Options"),
+    conduyt_sms_transports: ro("List SMS Transports"),
+    conduyt_whatsapp_templates: ro("List WhatsApp Templates"),
+    conduyt_voice_drop: create("Send Voice Drop"),
+    conduyt_send_sms: create("Send SMS"),
+    conduyt_send_email: create("Send Email"),
+    conduyt_get_conversation: ro("Get Conversation"),
+    conduyt_list_messages: ro("List Messages"),
+    conduyt_log_message: row("Log Message", false, true, false),
+    conduyt_sms_delivery_report: ro("Get SMS Delivery Report"),
+    conduyt_sms_drip_conversion_report: ro("Get SMS Drip Conversion Report"),
+    conduyt_speed_to_lead_report: ro("Get Speed to Lead Report"),
+    conduyt_attribution_report: ro("Get Attribution Report"),
+    conduyt_agent_performance_report: ro("Get Agent Performance Report"),
+    conduyt_list_targets: ro("List Targets"),
+    conduyt_set_targets: update("Set Targets"),
+    conduyt_call_performance_report: ro("Get Call Performance Report"),
+    conduyt_appointment_report: ro("Get Appointment Report"),
+    conduyt_funnel_report: ro("Get Funnel Report"),
+    conduyt_get_message_check_minimum_grade: ro("Get Message Check Minimum Grade"),
+    conduyt_update_message_check_minimum_grade: update("Update Message Check Minimum Grade"),
+    conduyt_list_calls: ro("List Calls"),
+    conduyt_search_dialer_history: ro("Search Dialer History"),
+    conduyt_search_dialer_calls: ro("Search Dialer Calls"),
+    conduyt_count_unknown_callers: ro("Count Unknown Callers"),
+    conduyt_link_call: update("Link Call"),
+    conduyt_get_call: ro("Get Call"),
+    conduyt_get_post_call_insight: ro("Get Post Call Insight"),
+    conduyt_sync_local_presence: row("Sync Local Presence", false, false, false), // every call writes lastSyncedAt (local-presence-sync.ts:225)
+    conduyt_get_dialer_settings: ro("Get Dialer Settings"),
+    conduyt_update_dialer_settings: update("Update Dialer Settings"),
+    conduyt_get_call_recording_settings: ro("Get Call Recording Settings"),
+    conduyt_update_call_recording_settings: update("Update Call Recording Settings"),
+    conduyt_list_companies: ro("List Companies"),
+    conduyt_get_company: ro("Get Company"),
+    conduyt_create_company: create("Create Company"),
+    conduyt_update_company: row("Update Company", false, false, false), // every identical PATCH creates a new company_updated Activity and re-dispatches the update fan-out (companies/[id]/route.ts:362-375)
+    conduyt_list_tags: ro("List Tags"),
+    conduyt_create_tag: create("Create Tag"),
+    conduyt_update_tag: update("Update Tag"),
+    conduyt_delete_tag: destroy("Delete Tag"),
+    conduyt_merge_tags: destroy("Merge Tags"),
+    conduyt_list_calendars: ro("List Calendars"),
+    conduyt_list_appointments: ro("List Appointments"),
+    conduyt_get_appointment: ro("Get Appointment"),
+    conduyt_create_appointment: create("Create Appointment"),
+    conduyt_update_appointment: row("Update Appointment", false, true, true), // cancellation permanently removes operational artifacts and cannot be reopened (appointments/[id]/route.ts:331); a repeat lands the same state
+    conduyt_appointment_outcome: row("Record Appointment Outcome", false, true, true), // cancelled outcomes cannot be undone; an identical outcome takes the explicit replay path (appointment-outcome-service.ts:515,633)
+    conduyt_appointment_outcome_undo: update("Undo Appointment Outcome"),
+    conduyt_list_forms: ro("List Forms"),
+    conduyt_get_form: ro("Get Form"),
+    conduyt_create_form: create("Create Form"),
+    conduyt_list_form_submissions: ro("List Form Submissions"),
+    conduyt_list_invoices: ro("List Invoices"),
+    conduyt_get_invoice: ro("Get Invoice"),
+    conduyt_create_invoice: create("Create Invoice"),
+    conduyt_update_invoice: row("Update Invoice", false, true, false), // line-item replacement deletes and recreates items with new ids every call (invoices/[id]/route.ts:413)
+    conduyt_send_invoice: create("Send Invoice"),
+    conduyt_list_webhooks: ro("List Webhooks"),
+    conduyt_create_webhook: create("Create Webhook"),
+    conduyt_update_webhook: update("Update Webhook"),
+    conduyt_delete_webhook: destroy("Delete Webhook"),
+    conduyt_cancel_webhook_log: destroy("Cancel Webhook Log"),
+    conduyt_get_form_intake_status: ro("Get Form Intake Status"),
+    conduyt_list_form_intakes: ro("List Form Intakes"),
+    conduyt_create_form_intake: create("Create Form Intake"),
+    conduyt_revoke_form_intake: destroy("Revoke Form Intake"),
+    conduyt_get_calendly_status: ro("Get Calendly Status"),
+    conduyt_get_calendly_import_progress: ro("Get Calendly Import Progress"),
+    conduyt_list_calendly_event_types: row("List Calendly Event Types", false, false, false), // refreshes and persists the live provider snapshot (calendly-sync.ts:430); not read-only per the round-2 policy
+    conduyt_set_calendly_event_types: row("Set Calendly Event Types", false, false, false), // always advances selectionSavedAt and can retry webhook/import setup (calendly-sync.ts:475)
+    conduyt_disconnect_calendly: destroy("Disconnect Calendly"),
+    conduyt_get_stage_rules: ro("Get Stage Rules"),
+    conduyt_set_stage_rules: update("Set Stage Rules"),
+    conduyt_get_deal_card_fields: ro("Get Deal Card Fields"),
+    conduyt_set_deal_card_fields: update("Set Deal Card Fields"),
+    conduyt_get_settings_revision: ro("Get Settings Revision"),
+    conduyt_get_pipeline_rot_days: ro("Get Pipeline Rot Days"),
+    conduyt_set_pipeline_rot_days: update("Set Pipeline Rot Days"),
+    conduyt_get_mailchimp_settings: ro("Get Mailchimp Settings"),
+    conduyt_update_mailchimp_settings: row("Update Mailchimp Settings", false, true, false), // audience change retires the old webhook/member generation; every save advances configGeneration (mailchimp-sync.ts:3684,3725)
+    conduyt_list_mailchimp_audiences: ro("List Mailchimp Audiences"),
+    conduyt_mailchimp_push_now: create("Push Contacts to Mailchimp Now"),
+    conduyt_mailchimp_retry_unsubscribes: row("Retry Mailchimp Unsubscribes", false, false, false), // one pass per call; a repeat can deliver more pending unsubscribes
+    conduyt_mailchimp_reconcile_statuses: row("Reconcile Mailchimp Statuses", false, false, false), // each call advances one pass (up to three); restart: true replaces a completed report
+    conduyt_mailchimp_confirm_reconciliation: row("Confirm Mailchimp Reconciliation", false, true, true), // final operator decision: deletes recovery ids, clears the report/block, advances the cursor; a repeat fails the precondition with no further effect (mailchimp-sync.ts:4606)
+    conduyt_list_status_metadata: ro("List Status Metadata"),
+    conduyt_get_status_metadata: ro("Get Status Metadata"),
+    conduyt_create_status_metadata: create("Create Status Metadata"),
+    conduyt_update_status_metadata: row("Update Status Metadata", false, false, false), // every successful write advances the concurrency version (status-metadata/[id]/route.ts:201)
+    conduyt_delete_status_metadata: destroy("Delete Status Metadata"),
+    conduyt_import_status_metadata: row("Import Status Metadata", false, true, false), // replace mode deletes and recreates rows with new ids; merge mode advances updatedAt (the concurrency version) on every call
+    conduyt_list_notifications: ro("List Notifications"),
+    conduyt_create_notification: create("Create Notification"),
+    conduyt_list_chat_channels: update("List Chat Channels"),
+    conduyt_get_chat_unread: ro("Get Chat Unread Counts"),
+    conduyt_list_chat_messages: update("List Chat Messages"),
+    conduyt_mark_chat_read: row("Mark Chat Read", false, false, false), // every call re-announces the read receipt to the reader's other tabs and devices, even when the marker did not move (chat/channels/[id]/messages/route.ts:126)
+    conduyt_get_chat_realtime_token: ro("Get Chat Realtime Token"),
+    conduyt_get_chat_notifications: update("Get Chat Notifications"),
+    conduyt_set_chat_notifications: update("Set Chat Notifications"),
+    conduyt_update_team_chat_settings: update("Update Team Chat Settings"),
+    conduyt_list_custom_fields: ro("List Custom Fields"),
+    conduyt_create_custom_field: create("Create Custom Field"),
+    conduyt_update_custom_field: update("Update Custom Field"),
+    conduyt_delete_custom_field: destroy("Delete Custom Field"),
+    conduyt_get_contact_table_defaults: ro("Get Contact Table Defaults"),
+    conduyt_set_contact_table_defaults: update("Set Contact Table Defaults"),
+    conduyt_list_smart_lists: ro("List Smart Lists"),
+    conduyt_get_smart_list: ro("Get Smart List"),
+    conduyt_create_smart_list: create("Create Smart List"),
+    conduyt_update_smart_list: update("Update Smart List"),
+    conduyt_add_contacts_to_smart_list: update("Add Contacts to Smart List"),
+    conduyt_get_smart_list_contacts: ro("Get Smart List Contacts"),
+    conduyt_list_users: ro("List Users"),
+    conduyt_get_user: ro("Get User"),
+    conduyt_create_user: create("Create User"),
+    conduyt_update_user: row("Update User", false, false, false), // phone supplied deletes and recreates the auto QuickConnect row, a fresh UUID each call (users/[id]/route.ts:579-594)
+    conduyt_get_user_stats: ro("Get User Stats"),
+    conduyt_invite_user: create("Invite User"),
+    conduyt_deactivate_user: update("Deactivate User"),
+    conduyt_reactivate_user: update("Reactivate User"),
+    conduyt_ai_import_contacts: create("Import Contacts With AI"),
+    conduyt_export_contacts: create("Export Contacts"),
+    conduyt_export_deals: create("Export Deals"),
+    conduyt_bulk_tag_contacts: update("Bulk Tag Contacts"),
+    conduyt_bulk_untag_contacts: update("Bulk Untag Contacts"),
+    conduyt_bulk_edit_contacts: row("Bulk Edit Contacts", false, true, true), // optedOutSms / optedOutEmail / doNotContact can clear consent and re-enable outreach; switches are state-predicated absolute writes, so a repeat of the same body lands the same state
+    conduyt_bulk_update_contacts: row("Bulk Update Contacts", false, true, true), // same consent fields per row as bulk edit; state-predicated switches, a repeat lands the same state
+    conduyt_bulk_delete_contacts: destroy("Bulk Delete Contacts"),
+    conduyt_bulk_delete_contacts_matching: destroy("Bulk Delete Contacts Matching"),
+    conduyt_bulk_dnc_contacts: row("Bulk Set Do Not Contact", false, true, true), // action "remove" tombstones suppression rows (re-enables outreach); add skips rows already suppressed and remove matches only removedAt null, so a repeat changes nothing
+    conduyt_bulk_edit_deals: row("Bulk Edit Deals", false, false, false), // a stage-only update to the existing won/lost stage assigns a fresh wonAt/lostAt on every call (app/api/v1/bulk/deals/edit/route.ts:216-233)
+    conduyt_bulk_update_deals: row("Bulk Update Deals", false, false, false), // a stage-only update to the existing won/lost stage assigns a fresh wonAt/lostAt on every call (app/api/v1/bulk/deals/update/route.ts:195-212)
+    conduyt_import_preflight: ro("Check Contact Import Before Running"),
+    conduyt_create_batch_operation: row("Create Batch Operation", false, true, false),
+    conduyt_list_batch_operations: ro("List Batch Operations"),
+    conduyt_get_batch_operation: ro("Get Batch Operation"),
+    conduyt_cancel_batch_operation: destroy("Cancel Batch Operation"),
+    conduyt_list_dnc: ro("List DNC"),
+    conduyt_add_dnc: update("Add DNC"),
+    conduyt_remove_dnc: destroy("Remove DNC"),
+    conduyt_list_saved_filters: ro("List Saved Filters"),
+    conduyt_create_saved_filter: create("Create Saved Filter"),
+    conduyt_update_saved_filter: update("Update Saved Filter"),
+    conduyt_delete_saved_filter: destroy("Delete Saved Filter"),
+    conduyt_list_drip_campaigns: ro("List Drip Campaigns"),
+    conduyt_get_drip_campaign: ro("Get Drip Campaign"),
+    conduyt_create_drip_campaign: create("Create Drip Campaign"),
+    conduyt_update_drip_campaign: update("Update Drip Campaign"),
+    conduyt_list_drip_enrollments: ro("List Drip Enrollments"),
+    conduyt_batch_pause_enrollments: update("Pause Drip Enrollments in Bulk"),
+    conduyt_batch_resume_enrollments: update("Resume Drip Enrollments in Bulk"),
+    conduyt_batch_stop_enrollments: destroy("Stop Drip Enrollments in Bulk"),
+    conduyt_cancel_drip_enrollment_barrier: row("Cancel Drip Enrollment Send Barrier", false, true, false),
+    conduyt_list_scoring_rules: ro("List Scoring Rules"),
+    conduyt_create_scoring_rule: create("Create Scoring Rule"),
+    conduyt_update_scoring_rule: row("Update Scoring Rule", false, false, false), // queues a recalculation on every update (scoring-rules/[id]/route.ts:78-87; data-model-jobs.ts:133-165)
+    conduyt_delete_scoring_rule: destroy("Delete Scoring Rule"),
+    conduyt_recalculate_scores: row("Recalculate Scores", false, false, false), // after a prior job completes the same call creates another job (data-model-jobs.ts:133)
+    conduyt_list_products: ro("List Products"),
+    conduyt_get_product: ro("Get Product"),
+    conduyt_create_product: create("Create Product"),
+    conduyt_update_product: update("Update Product"),
+    conduyt_list_templates: ro("List Templates"),
+    conduyt_get_template: ro("Get Template"),
+    conduyt_create_template: create("Create Template"),
+    conduyt_update_template: update("Update Template"),
+    conduyt_dashboard: ro("Get CRM Dashboard Summary"),
+    conduyt_ai_compose_email: ro("Compose Email With AI"),
+    conduyt_ai_enrich_contact: ro("Enrich Contact With AI"),
+    conduyt_ai_summarize_contact: ro("Summarize Contact With AI"),
+    conduyt_ai_chat: ro("Chat With AI Assistant"),
+    conduyt_ai_improve_email: ro("Improve Email With AI"),
+    conduyt_ai_deal_insights: ro("Get AI Deal Insights"),
+    conduyt_ai_conversation_intelligence: create("Analyze Conversation With AI"),
+    conduyt_ai_call_disposition: ro("Suggest Call Disposition"),
+    conduyt_ai_agenda: ro("Get AI Agenda"),
+    conduyt_ai_plan_actions: ro("Plan Copilot Actions"),
+    conduyt_ai_execute_actions: create("Execute Copilot Actions"),
+    conduyt_reply_suggestion: ro("Get Suggested Reply"),
+    conduyt_reply_suggestion_decide: row("Record Suggested Reply Decision", false, true, true), // final decision: dismissed and sent cannot be reversed; a repeat is refused before any further write (message-insights.ts:480), so idempotent
+    conduyt_ai_daily_brief: ro("Get AI Daily Brief"),
+    conduyt_ai_next_actions: ro("Get AI Next Actions"),
+    conduyt_ai_feed: ro("Get AI Feed"),
+    conduyt_ai_usage: ro("Get AI Usage"),
+    conduyt_ai_task_import_and_enroll: ro("Preview AI Import and Enroll"),
+    conduyt_ai_task_segment_and_act: ro("Preview AI Segment and Act"),
+    conduyt_ai_task_pipeline_cleanup: ro("Preview AI Pipeline Cleanup"),
+    conduyt_workflow_validate: ro("Validate Workflow"),
+    conduyt_workflow_simulate: ro("Simulate Workflow"),
+    conduyt_workflow_promote: row("Validate and Publish Workflow", false, false, false), // each repeat can publish another numbered version (automations/[id]/publish/route.ts:218,291)
+    conduyt_export_contact_data: create("Export Contact Data"),
+    conduyt_forget_contact: destroy("Erase Contact (GDPR)"),
+    conduyt_list_smart_views: ro("List Smart Views"),
+    conduyt_update_smart_view_dialing: update("Update Smart View Dialing"),
+    conduyt_get_smart_dialing_order: ro("Get Smart Dialing Order"),
+    conduyt_set_smart_dialing_order: update("Set Smart Dialing Order"),
+    conduyt_set_smart_view_audience: row("Set Smart View Audience", false, false, false), // the tool always sends members (src/tools/smart-views.ts:135); app/api/v1/smart-views/[id]/route.ts:254-279 rewrites the audience on every call
+    conduyt_reorder_smart_views: update("Reorder Smart Views"),
+    conduyt_move_smart_view: update("Move Smart View"),
+    conduyt_scheduled_export_get_settings: ro("Get Scheduled Export Settings"),
+    conduyt_scheduled_export_update_settings: update("Update Scheduled Export Settings"),
+    conduyt_account_exports_list: ro("List Account Exports"),
+    conduyt_get_lifecycle_settings: ro("Get Lifecycle Settings"),
+    conduyt_update_intake_deals: update("Update Intake Deals Setting"),
+    conduyt_update_deal_working_mode: update("Update Deal Working Mode"),
+    conduyt_update_lost_propagation: update("Update Lost Propagation Setting"),
+    conduyt_update_booking_creates_own_card: update("Update Booking Creates Own Card Setting"),
+    conduyt_update_disposition_status_map: update("Update Disposition Status Map"),
+    conduyt_get_agent_statuses: ro("Get Agent Statuses"),
+    conduyt_update_agent_statuses: update("Update Agent Statuses"),
+    conduyt_update_master_statuses: update("Update Master Statuses"),
+    conduyt_list_pool_filter_sets: ro("List Pool Filter Sets"),
+    conduyt_create_pool_filter_set: create("Create Pool Filter Set"),
+    conduyt_update_pool_filter_set: update("Update Pool Filter Set"),
+    conduyt_delete_pool_filter_set: destroy("Delete Pool Filter Set"),
+    conduyt_get_lead_pool_settings: ro("Get Lead Pool Settings"),
+    conduyt_update_lead_pool_settings: update("Update Lead Pool Settings"),
+    conduyt_list_up_for_grabs: ro("List Up for Grabs Leads"),
+    conduyt_reply_capture_get: row("Get Reply Capture", false, true, false), // reconciliation can move a live domain to degraded, which retires it permanently; the outcome depends on provider state at call time
+    conduyt_reply_capture_setup: update("Set Up Reply Capture"),
+    conduyt_reply_capture_verify: row("Verify Reply Capture", false, false, false), // kicks provider verification; a later identical poll can promote the domain (email-domains/reply-capture/verify/route.ts:96)
+    conduyt_reply_capture_remove: destroy("Remove Reply Capture"),
+    conduyt_list_call_flows: ro("List Call Flows"),
+    conduyt_get_call_flow: ro("Get Call Flow"),
+    conduyt_create_call_flow: create("Create Call Flow"),
+    conduyt_update_call_flow: update("Update Call Flow"),
+    conduyt_delete_call_flow: destroy("Delete Call Flow"),
+    conduyt_validate_call_flow: ro("Validate Call Flow"),
+    conduyt_publish_call_flow: update("Publish Call Flow"),
+    conduyt_unpublish_call_flow: update("Unpublish Call Flow"),
+    conduyt_simulate_call_flow: ro("Simulate Call Flow"),
+    conduyt_call_flow_roster: ro("Get Call Flow Roster"),
+    conduyt_list_ring_groups: ro("List Ring Groups"),
+    conduyt_get_ring_group: ro("Get Ring Group"),
+    conduyt_create_ring_group: create("Create Ring Group"),
+    conduyt_update_ring_group: update("Update Ring Group"),
+    conduyt_delete_ring_group: destroy("Delete Ring Group"),
+    conduyt_release_ring_group_number: destroy("Release Ring Group Number"),
+    conduyt_list_call_flow_numbers: ro("List Call Flow Numbers"),
+    conduyt_get_call_flow_wiring: ro("Get Call Flow Wiring"),
+    conduyt_wire_call_flow_number: update("Wire Call Flow Number"),
+    conduyt_release_call_flow_tombstone: destroy("Release Call Flow Tombstone"),
+    conduyt_upload_call_flow_audio: create("Upload Call Flow Audio"),
+    conduyt_list_call_flow_functions: ro("List Call Flow Functions"),
+    conduyt_create_call_flow_function: create("Create Call Flow Function"),
+    conduyt_update_call_flow_function: row("Update Call Flow Function", false, true, true), // a new secret revokes the old signing credential; the secret is caller-supplied and the PATCH is a pure set, so a repeat of the same body lands the same state
+    conduyt_delete_call_flow_function: destroy("Delete Call Flow Function"),
+    conduyt_test_call_flow_function: create("Test Call Flow Function"),
+    conduyt_project_blue_status: ro("Project Blue Status"),
+    conduyt_project_blue_lines: ro("Project Blue Lines"),
+    conduyt_project_blue_assign_line: row("Assign Project Blue Line", false, false, false), // lib/project-blue-lines.ts:186-195 deletes the current same-line/same-user assignment and creates a new row (new UUID, lastInboundSyncAt cleared) on every identical call
+    conduyt_project_blue_voice_status: ro("Project Blue Voice Status"),
+    conduyt_project_blue_voice_connect: row("Connect or Disconnect Project Blue Voice", false, true, false), // rewrites health timestamps and reopens unreconcilable vendor calls (project-blue-voice.ts:146, settings/project-blue/voice/route.ts:100)
+    conduyt_whatsapp_status: ro("WhatsApp Status"),
+    conduyt_whatsapp_senders: ro("WhatsApp Senders"),
+    conduyt_whatsapp_connect: destroy("Connect or Disconnect WhatsApp"),
+    conduyt_fromk_status: ro("FromK.ai Status"),
+    conduyt_fromk_lines: row("FromK.ai Lines", false, false, false), // persists a provider-dependent line snapshot (fromk-transport.ts:110)
+    conduyt_fromk_connect: row("Connect or Disconnect FromK.ai", false, true, false), // even the same key refreshes lines and deletes all contact links (fromk-transport.ts:87)
+    conduyt_fromk_webhook_secret: destroy("Set or Clear FromK.ai Webhook Secret"),
+    conduyt_zoom_status: ro("Zoom Status"),
+    conduyt_zoom_connect: destroy("Connect or Disconnect Zoom"),
+    conduyt_zoom_test: ro("Test Zoom Connection"),
+    conduyt_list_booking_pages: ro("List Booking Pages"),
+    conduyt_get_booking_page: ro("Get Booking Page"),
+    conduyt_create_booking_page: create("Create Booking Page"),
+    conduyt_update_booking_page: row("Update Booking Page", false, true, true), // owner transfer clears the iCal feed token (booking-pages/[id]/route.ts:266); the tool no longer offers enableIcalFeed (the route refuses it for API-key calls, #401), so a repeat lands the same state
+    conduyt_report_fields: ro("Report Fields"),
+    conduyt_list_reports: ro("List Reports"),
+    conduyt_create_report: create("Create Report"),
+    conduyt_run_report: create("Run Saved Report"),
+    conduyt_preview_report: ro("Preview Report"),
+    conduyt_update_report: update("Update Report"),
+    conduyt_export_report: create("Export Report File"),
+    conduyt_list_report_schedules: ro("List Report Schedules"),
+    conduyt_create_report_schedule: create("Create Report Schedule"),
+    conduyt_update_report_schedule: row("Update Report Schedule", false, false, false), // nextRunAt recomputed from now, slotAt/retryCount reset on any schedule field (reports/subscriptions/[sid]/route.ts:64-79)
+    conduyt_delete_report_schedule: destroy("Delete Report Schedule"),
+    conduyt_send_report_schedule_now: create("Send Report Schedule Now"),
+    conduyt_report_schedule_deliveries: ro("Report Schedule Deliveries"),
+    conduyt_list_dashboards: ro("List Dashboards"),
+    conduyt_create_dashboard: create("Create Dashboard"),
+    conduyt_get_dashboard: ro("Get Dashboard"),
+    conduyt_update_dashboard: update("Update Dashboard"),
+    conduyt_delete_dashboard: destroy("Delete Dashboard"),
+    conduyt_add_dashboard_tile: create("Add Dashboard Tile"),
+    conduyt_update_dashboard_tile: update("Update Dashboard Tile"),
+    conduyt_remove_dashboard_tile: destroy("Remove Dashboard Tile"),
+    conduyt_run_dashboard: ro("Run Dashboard"),
+};
+/**
+ * Wraps server.tool so each tool registered afterwards gets its title and annotations from TOOL_ANNOTATIONS. The registered
+ * tool object is mutated in place (the same object strictInput() already swaps the input schema on), so the rest of each
+ * tool's registration is untouched. A tool with no row throws at registration.
+ */
+export function annotateRegistrations(server) {
+    const original = server.tool.bind(server);
+    server.tool = (name, ...rest) => {
+        const a = TOOL_ANNOTATIONS[name];
+        if (!a)
+            throw new Error(`tool ${name} has no row in src/tool-annotations.ts: add a title and its four MCP hints`);
+        const registered = original(name, ...rest);
+        const { title, ...hints } = a;
+        registered.title = title;
+        registered.annotations = { title, ...hints };
+        return registered;
+    };
+}

package/dist/tools/automations.d.ts

@@ -1,7 +1,7 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { ConduytClient } from "../client.js";
 /** (card ownership per lane, app 10-08/09) the action options an agent can set; the catalog does not carry action config, so this is the one place they are documented */
-export declare const CARD_OWNERSHIP_ACTIONS_NOTE = " Card ownership per lane: assign_to_user config {userId | userIds (round robin) | groupId, target|applyTo: contact|deal|both, overwriteExisting, laneSource, lanePipelineId, laneStageId}: laneSource names a card lane (the Deal.source its Auto-Create step wrote, e.g. 'GSM', max 500 chars) and makes the deal leg assign the contact's newest OPEN card from that lane (inside lanePipelineId when set) instead of the run's deal; when the contact has none and lanePipelineId is set, the card is created there (laneStageId, else the pipeline's first stage) already owned by the user; lanePipelineId or laneStageId without laneSource, or laneStageId without lanePipelineId, is refused; a lane never applies to an 'Assign to: contact' step. create_deal config {pipelineId (required), stageId, dealName, dealValue, allowDuplicates, status, source, assignedTo, leaveUnassigned}: leaveUnassigned true leaves the card unassigned when no assignee is set (default false: the card goes to the lead's owner). close_other_open_deals config {lostReason (required)}: closes the contact's OTHER open cards as lost with that reason, keeping the run's own card (each moves to its pipeline's lost stage with the usual stage-change effects; cards already won/lost, in the DPP Post-Close pipeline or in a pipeline with no lost stage are skipped; a re-run closes nothing twice); it needs the run's own deal, so use a deal trigger or a find_opportunity step first.";
+export declare const CARD_OWNERSHIP_ACTIONS_NOTE = " Card ownership per lane: assign_to_user config {userId | userIds (round robin) | groupId, mode (single | round_robin | trigger_host), target|applyTo: contact|deal|both, overwriteExisting, laneSource, lanePipelineId, laneStageId}: laneSource names a card lane (the Deal.source its Auto-Create step wrote, e.g. 'GSM', max 500 chars) and makes the deal leg assign the contact's newest OPEN card from that lane (inside lanePipelineId when set) instead of the run's deal; when the contact has none and lanePipelineId is set, the card is created there (laneStageId, else the pipeline's first stage) already owned by the user; lanePipelineId or laneStageId without laneSource, or laneStageId without lanePipelineId, is refused; a lane never applies to an 'Assign to: contact' step. assign_to_user mode 'trigger_host' assigns to the appointment's booked host (appointment.booked runs only; fails closed when the run has no host). create_deal config {pipelineId (required), stageId, dealName, dealValue, allowDuplicates, status, source, assignedTo, assigneeMode, leaveUnassigned}: leaveUnassigned true leaves the card unassigned when no assignee is set (default false: the card goes to the lead's owner). assigneeMode 'trigger_host' assigns the card to the appointment's booked host (appointment.booked runs only; wins over assignedTo; fails closed when the run has no host, creating nothing). The condition field 'Booked host' (trigger.hostUserId) exists on appointment.booked, whose payload now carries hostUserId. close_other_open_deals config {lostReason (required)}: closes the contact's OTHER open cards as lost with that reason, keeping the run's own card (each moves to its pipeline's lost stage with the usual stage-change effects; cards already won/lost, in the DPP Post-Close pipeline or in a pipeline with no lost stage are skipped; a re-run closes nothing twice); it needs the run's own deal, so use a deal trigger or a find_opportunity step first.";
 /** (deal nodes, app 10-13) find_opportunity v2, link_appointment_to_deal, update_deal_field systemField source; the catalog does not carry action config */
 export declare const DEAL_NODES_ACTIONS_NOTE = " Deal nodes: find_opportunity config {version: 2, pipelineIds (ordered; the first pipeline holding a match wins; empty = every pipeline), status (open default | won | lost | abandoned | any), excludeSources (lead sources never matched, case-insensitive), excludeCreatedByAutomationIds (automations whose create_deal cards are skipped; cards created from 2026-10-13 on), matchField {fieldKey, value} (searches the WHOLE WORKSPACE, any contact, for the card whose deal custom field equals the value, merge fields allowed e.g. {{trigger.oes}}; a card is found when its field holds the searched value (trimmed) as the same text exactly (no case folding); a value written with separators such as dashes or spaces also matches its digits as text; it matches a stored number only when the value (or those digits) is a plain number with no leading zero and at most 15 significant digits that a number holds exactly (007 is text and does not match the number 7; a 16-digit value, 1e-400 or 3e-324 is text only); booleans and differently formatted stored values never match; status, pipelines and exclusions still apply; exactly one match is found, several are ambiguous and take not found; a found card becomes the run's contact when the run has none; the field must exist; an empty rendered value finds nothing), resolution}: searches the run's contact's cards; FOUND makes the card the run's deal and follows nextIfTrue (else next), NOT FOUND is a normal outcome that follows nextIfFalse (else next) and leaves the run's existing deal unchanged (a later deal step on the false branch still acts on the deal the run already had); without version 2 the step keeps the original single-pipeline lookup (a miss fails the step). Prerequisite: a version 2 find needs step cursors on this workspace, and publishing refuses (find_needs_step_cursors) with \"Find opportunity needs step cursors on this workspace; ask support\"; every version 2 find must hold its own live step cursor or it hard-stops the run without selecting or routing. A version 2 find cannot be retried on its own: retrying a failed one alone answers 409, so re-trigger the automation for the contact. An automation definition that touches deals needs the `deals` scope on an API key: without it the write answers 403. link_appointment_to_deal config {stageId, pipelineId (needs stageId), lostReason}: in an appointment-triggered run, links the trigger's appointment to the run's deal (its appointment fields follow it; a newer booking is never displaced; the appointment must be the deal's contact's), then optionally moves the card; it needs an appointment trigger and the run's deal (find_opportunity first, or a booking made with a deal id). update_deal_field config {systemField: \"source\", value, overwriteExisting}: sets the deal's own lead source instead of a custom field (a value only, trimmed, at most 500 characters; overwriteExisting false writes only while the source is the Unknown label).";
 /** (#124, automation unknown keys / types) the refusal codes the write paths answer; surfaced verbatim by the client (details JSON object last), never retried */

package/dist/tools/automations.js

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import { formatResult, formatToolError } from "../client.js";
 /** (card ownership per lane, app 10-08/09) the action options an agent can set; the catalog does not carry action config, so this is the one place they are documented */
-export const CARD_OWNERSHIP_ACTIONS_NOTE = " Card ownership per lane: assign_to_user config {userId | userIds (round robin) | groupId, target|applyTo: contact|deal|both, overwriteExisting, laneSource, lanePipelineId, laneStageId}: laneSource names a card lane (the Deal.source its Auto-Create step wrote, e.g. 'GSM', max 500 chars) and makes the deal leg assign the contact's newest OPEN card from that lane (inside lanePipelineId when set) instead of the run's deal; when the contact has none and lanePipelineId is set, the card is created there (laneStageId, else the pipeline's first stage) already owned by the user; lanePipelineId or laneStageId without laneSource, or laneStageId without lanePipelineId, is refused; a lane never applies to an 'Assign to: contact' step. create_deal config {pipelineId (required), stageId, dealName, dealValue, allowDuplicates, status, source, assignedTo, leaveUnassigned}: leaveUnassigned true leaves the card unassigned when no assignee is set (default false: the card goes to the lead's owner). close_other_open_deals config {lostReason (required)}: closes the contact's OTHER open cards as lost with that reason, keeping the run's own card (each moves to its pipeline's lost stage with the usual stage-change effects; cards already won/lost, in the DPP Post-Close pipeline or in a pipeline with no lost stage are skipped; a re-run closes nothing twice); it needs the run's own deal, so use a deal trigger or a find_opportunity step first.";
+export const CARD_OWNERSHIP_ACTIONS_NOTE = " Card ownership per lane: assign_to_user config {userId | userIds (round robin) | groupId, mode (single | round_robin | trigger_host), target|applyTo: contact|deal|both, overwriteExisting, laneSource, lanePipelineId, laneStageId}: laneSource names a card lane (the Deal.source its Auto-Create step wrote, e.g. 'GSM', max 500 chars) and makes the deal leg assign the contact's newest OPEN card from that lane (inside lanePipelineId when set) instead of the run's deal; when the contact has none and lanePipelineId is set, the card is created there (laneStageId, else the pipeline's first stage) already owned by the user; lanePipelineId or laneStageId without laneSource, or laneStageId without lanePipelineId, is refused; a lane never applies to an 'Assign to: contact' step. assign_to_user mode 'trigger_host' assigns to the appointment's booked host (appointment.booked runs only; fails closed when the run has no host). create_deal config {pipelineId (required), stageId, dealName, dealValue, allowDuplicates, status, source, assignedTo, assigneeMode, leaveUnassigned}: leaveUnassigned true leaves the card unassigned when no assignee is set (default false: the card goes to the lead's owner). assigneeMode 'trigger_host' assigns the card to the appointment's booked host (appointment.booked runs only; wins over assignedTo; fails closed when the run has no host, creating nothing). The condition field 'Booked host' (trigger.hostUserId) exists on appointment.booked, whose payload now carries hostUserId. close_other_open_deals config {lostReason (required)}: closes the contact's OTHER open cards as lost with that reason, keeping the run's own card (each moves to its pipeline's lost stage with the usual stage-change effects; cards already won/lost, in the DPP Post-Close pipeline or in a pipeline with no lost stage are skipped; a re-run closes nothing twice); it needs the run's own deal, so use a deal trigger or a find_opportunity step first.";
 /** (deal nodes, app 10-13) find_opportunity v2, link_appointment_to_deal, update_deal_field systemField source; the catalog does not carry action config */
 export const DEAL_NODES_ACTIONS_NOTE = " Deal nodes: find_opportunity config {version: 2, pipelineIds (ordered; the first pipeline holding a match wins; empty = every pipeline), status (open default | won | lost | abandoned | any), excludeSources (lead sources never matched, case-insensitive), excludeCreatedByAutomationIds (automations whose create_deal cards are skipped; cards created from 2026-10-13 on), matchField {fieldKey, value} (searches the WHOLE WORKSPACE, any contact, for the card whose deal custom field equals the value, merge fields allowed e.g. {{trigger.oes}}; a card is found when its field holds the searched value (trimmed) as the same text exactly (no case folding); a value written with separators such as dashes or spaces also matches its digits as text; it matches a stored number only when the value (or those digits) is a plain number with no leading zero and at most 15 significant digits that a number holds exactly (007 is text and does not match the number 7; a 16-digit value, 1e-400 or 3e-324 is text only); booleans and differently formatted stored values never match; status, pipelines and exclusions still apply; exactly one match is found, several are ambiguous and take not found; a found card becomes the run's contact when the run has none; the field must exist; an empty rendered value finds nothing), resolution}: searches the run's contact's cards; FOUND makes the card the run's deal and follows nextIfTrue (else next), NOT FOUND is a normal outcome that follows nextIfFalse (else next) and leaves the run's existing deal unchanged (a later deal step on the false branch still acts on the deal the run already had); without version 2 the step keeps the original single-pipeline lookup (a miss fails the step). Prerequisite: a version 2 find needs step cursors on this workspace, and publishing refuses (find_needs_step_cursors) with \"Find opportunity needs step cursors on this workspace; ask support\"; every version 2 find must hold its own live step cursor or it hard-stops the run without selecting or routing. A version 2 find cannot be retried on its own: retrying a failed one alone answers 409, so re-trigger the automation for the contact. An automation definition that touches deals needs the `deals` scope on an API key: without it the write answers 403. link_appointment_to_deal config {stageId, pipelineId (needs stageId), lostReason}: in an appointment-triggered run, links the trigger's appointment to the run's deal (its appointment fields follow it; a newer booking is never displaced; the appointment must be the deal's contact's), then optionally moves the card; it needs an appointment trigger and the run's deal (find_opportunity first, or a booking made with a deal id). update_deal_field config {systemField: \"source\", value, overwriteExisting}: sets the deal's own lead source instead of a custom field (a value only, trimmed, at most 500 characters; overwriteExisting false writes only while the source is the Unknown label).";
 /** (#124, automation unknown keys / types) the refusal codes the write paths answer; surfaced verbatim by the client (details JSON object last), never retried */

package/dist/tools/booking-pages.js

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import { formatResult } from "../client.js";
+import { strictInput } from "./strict.js";
 /**
  * Booking pages (Conduyt #72, 2026-09-15): the public scheduling pages. Until now an AI operator could read appointments
  * but not the pages that create them; these tools cover the page itself and its video option (videoProvider "zoom" =
@@ -67,7 +68,6 @@ const updateOnlyFields = {
     gdprText: z.string().max(2000).nullable().optional(),
     gdprLinkUrl: z.string().url().nullable().optional(),
     waitlistEnabled: z.boolean().optional(),
-    enableIcalFeed: z.boolean().optional().describe("true issues a new iCal feed token, false revokes it"),
 };
 export function registerBookingPageTools(server, client) {
     server.tool("conduyt_list_booking_pages", "List the account's booking pages (GET /api/v1/booking-pages): slug, title, host, duration, active, video option. Requires calendar:view.", { activeOnly: z.boolean().optional().describe("only pages accepting bookings") }, async ({ activeOnly }) => {
@@ -78,12 +78,12 @@ export function registerBookingPageTools(server, client) {
         const result = await client.get(`/api/v1/booking-pages/${id}`);
         return formatResult(result);
     });
-    server.tool("conduyt_create_booking_page", "Create a booking page (POST /api/v1/booking-pages): title, slug, userId (host) and durationMinutes at least; optional written location, videoProvider 'zoom' + videoHostEmail for one Zoom meeting per booking, availabilityRules override, embedAllowedOrigins, leadSource, brandName. Requires calendar:edit (admin/owner).", { ...pageFields, title: z.string().min(1).max(200), slug: z.string().min(1).max(100), userId: z.string().uuid(), durationMinutes: z.number().int().min(5).max(480) }, async (params) => {
+    strictInput(server.tool("conduyt_create_booking_page", "Create a booking page (POST /api/v1/booking-pages): title, slug, userId (host) and durationMinutes at least; optional written location, videoProvider 'zoom' + videoHostEmail for one Zoom meeting per booking, availabilityRules override, embedAllowedOrigins, leadSource, brandName. Requires calendar:edit (admin/owner).", { ...pageFields, title: z.string().min(1).max(200), slug: z.string().min(1).max(100), userId: z.string().uuid(), durationMinutes: z.number().int().min(5).max(480) }, async (params) => {
         const result = await client.post("/api/v1/booking-pages", params);
         return formatResult(result);
-    });
-    server.tool("conduyt_update_booking_page", "Update a booking page (PATCH /api/v1/booking-pages/{id}): only the fields given change. videoProvider 'zoom' turns on one Zoom meeting per booking (null turns it off and clears the host); videoHostEmail must be a user of the connected Zoom account (null = the app's own user). Requires calendar:edit (admin/owner).", { id: z.string().uuid().describe("booking page UUID"), ...pageFields, ...updateOnlyFields }, async ({ id, ...updates }) => {
+    }));
+    strictInput(server.tool("conduyt_update_booking_page", "Update a booking page (PATCH /api/v1/booking-pages/{id}): only the fields given change. videoProvider 'zoom' turns on one Zoom meeting per booking (null turns it off and clears the host); videoHostEmail must be a user of the connected Zoom account (null = the app's own user). The iCal feed token cannot be issued or revoked through the API; the page owner does that in the app. Requires calendar:edit (admin/owner).", { id: z.string().uuid().describe("booking page UUID"), ...pageFields, ...updateOnlyFields }, async ({ id, ...updates }) => {
         const result = await client.patch(`/api/v1/booking-pages/${id}`, updates);
         return formatResult(result);
-    });
+    }));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "conduyt-mcp",
-  "version": "4.96.0",
+  "version": "4.97.0",
   "mcpName": "com.conduyt/mcp",
   "description": "MCP server for Conduyt CRM — expose CRM operations as AI-accessible tools",
   "type": "module",

package/scripts/coverage-matrix.json

@@ -1,5 +1,5 @@
 {
-  "generatedAt": "2026-10-21T22:15:38.973Z",
+  "generatedAt": "2026-10-23T19:52:32.945Z",
   "toolCount": 359,
   "totalEndpoints": 1103,
   "counts": {