@indemn/cli 1.7.7 → 1.7.9

package/src/cli/auth.ts

@@ -1,9 +1,11 @@
-import { Command } from 'commander';
+import { Command, Option } from 'commander';
 import chalk from 'chalk';
 import ora from 'ora';
 import * as readline from 'readline';
 import { Writable } from 'node:stream';
-import { customHosts, login, logout, whoami, type WhoAmI } from '../sdk/auth.js';
+import { customHosts, login, loginWithBrowser, logout, whoami, type LoginResult, type WhoAmI } from '../sdk/auth.js';
+import { currentAccess, refreshAccess } from '../sdk/access.js';
+import { IndemnClient } from '../sdk/client.js';
 import { findLinkFile } from '../core/org-resolver.js';
 import { getOrgFlag } from '../core/scope.js';
 import { SessionExpiredError } from '../core/runtime.js';
@@ -61,70 +63,90 @@ function describeOrgRule(info: WhoAmI): string {
   return 'looked up on first use';
 }
 
+async function browserLogin(env: Environment): Promise<LoginResult> {
+  const spinner = ora();
+  try {
+    const result = await loginWithBrowser(env, {
+      showUrl: (url, opened) => {
+        console.log(opened ? 'Opening your browser to sign in…' : 'Open this link in your browser to sign in:');
+        console.log(chalk.dim(`  ${url}`));
+        spinner.start('Waiting for you to approve in the browser (5 minutes)…');
+      },
+    });
+    spinner.stop();
+    return result;
+  } catch (err) {
+    spinner.fail('Sign-in failed');
+    throw err;
+  }
+}
+
+async function passwordLogin(env: Environment): Promise<LoginResult | null> {
+  const email = await prompt('Email: ');
+  if (!email) {
+    printError('Email is required');
+    return null;
+  }
+  const password = await promptPassword('Password: ');
+  if (!password) {
+    printError('Password is required');
+    return null;
+  }
+  const spinner = ora('Authenticating...').start();
+  try {
+    return await login(email, password, env, {
+      mfaCodePrompt: async () => {
+        spinner.stop();
+        console.log(chalk.yellow('MFA code sent to your email.'));
+        const code = await prompt('MFA Code: ');
+        if (!code) {
+          throw new Error('MFA code is required');
+        }
+        spinner.start('Verifying MFA code...');
+        return code;
+      },
+    });
+  } catch (err) {
+    spinner.fail('Authentication failed');
+    throw err;
+  }
+}
+
+function printLoginResult(result: LoginResult): void {
+  printSuccess(`Logged in as ${result.email} on ${result.environment}`);
+  if (result.expiresAt) {
+    console.log(chalk.dim(`  Session valid until ${new Date(result.expiresAt).toLocaleString()}; run \`indemn login\` again after that.`));
+  }
+  if (result.orgs.length === 0) {
+    console.log(chalk.yellow('  You are not a member of any organization yet. Ask an admin to add you.'));
+  } else {
+    console.log(chalk.dim(`  Organizations (${result.orgs.length}):`));
+    for (const o of result.orgs) console.log(chalk.dim(`    ${o.id}  ${o.name}`));
+    if (result.orgs.length > 1) {
+      console.log(chalk.dim('  Choose one per command with --org <id>, or pin a project folder with `indemn link --org <id>`.'));
+    }
+  }
+}
+
 export function registerAuthCommands(program: Command): void {
   program
     .command('login')
-    .description('Authenticate with Indemn platform')
+    .description('Sign in through your browser (the dashboard approves this computer)')
     .option('--env <environment>', 'Target environment')
+    // Email/password/emailed-code prompts in the terminal; kept for one or two releases.
+    .addOption(new Option('--password', 'Sign in with email and password in the terminal').hideHelp())
     .action(async (options) => {
+      const env = (options.env || process.env.INDEMN_ENV || 'dev') as Environment;
+      if (env !== 'dev' && env !== 'production') {
+        printError('Environment must be "dev" or "production"');
+        process.exit(1);
+      }
       try {
-        const env = (options.env || process.env.INDEMN_ENV || 'dev') as Environment;
-        if (env !== 'dev' && env !== 'production') {
-          printError('Environment must be "dev" or "production"');
-          process.exit(1);
-        }
-
-        const email = await prompt('Email: ');
-        if (!email) {
-          printError('Email is required');
-          process.exit(1);
-        }
-
-        const password = await promptPassword('Password: ');
-        if (!password) {
-          printError('Password is required');
-          process.exit(1);
-        }
-
-        const spinner = ora('Authenticating...').start();
-
-        try {
-          const result = await login(email, password, env, {
-            mfaCodePrompt: async () => {
-              spinner.stop();
-              console.log(chalk.yellow('MFA code sent to your email.'));
-              const code = await prompt('MFA Code: ');
-              if (!code) {
-                throw new Error('MFA code is required');
-              }
-              spinner.start('Verifying MFA code...');
-              return code;
-            },
-          });
-          spinner.succeed(`Logged in as ${result.email} on ${result.environment}`);
-          if (result.expiresAt) {
-            console.log(chalk.dim(`  Session valid until ${new Date(result.expiresAt).toLocaleString()}; run \`indemn login\` again after that.`));
-          }
-          if (result.orgs.length === 0) {
-            console.log(chalk.yellow('  You are not a member of any organization yet. Ask an admin to add you.'));
-          } else {
-            console.log(chalk.dim(`  Organizations (${result.orgs.length}):`));
-            for (const o of result.orgs) console.log(chalk.dim(`    ${o.id}  ${o.name}`));
-            if (result.orgs.length > 1) {
-              console.log(chalk.dim('  Choose one per command with --org <id>, or pin a project folder with `indemn link --org <id>`.'));
-            }
-          }
-        } catch (err) {
-          spinner.fail('Authentication failed');
-          if (err instanceof Error) {
-            printError(err.message);
-          } else {
-            printError(err);
-          }
-          process.exit(1);
-        }
+        const result = options.password ? await passwordLogin(env) : await browserLogin(env);
+        if (!result) process.exit(1);
+        printLoginResult(result);
       } catch (err) {
-        printError(err);
+        printError(err instanceof Error ? err.message : err);
         process.exit(1);
       }
     });
@@ -146,16 +168,19 @@ export function registerAuthCommands(program: Command): void {
     .command('whoami')
     .description('Display current user and environment info')
     .option('--json', 'Output as JSON')
-    .action((options) => {
+    .action(async (options) => {
       try {
         const info = whoami();
         if (!info) {
           printError(new SessionExpiredError('Not logged in. Run `indemn login` first.'));
           process.exit(3);
         }
+        // Roles as copilot reports them now (display only; the servers decide each request).
+        const c = new IndemnClient();
+        const access = (await refreshAccess(c)) ?? currentAccess(c);
 
         if (options.json) {
-          printJson({ ...info, org_rule: describeOrgRule(info) });
+          printJson({ ...info, org_rule: describeOrgRule(info), access: access ?? undefined });
           return;
         }
 
@@ -167,9 +192,14 @@ export function registerAuthCommands(program: Command): void {
           console.log(`  Session:     valid until ${new Date(info.sessionExpiresAt).toLocaleString()} (then \`indemn login\`)`);
         }
         console.log(`  Org here:    ${describeOrgRule(info)}`);
-        if (info.orgs.length) {
+        if (access?.is_indemn_staff) console.log(`  Indemn staff: yes`);
+        const orgs = access ? access.orgs.map((o) => ({ id: o.org_id, name: o.org_name, role: o.role })) : info.orgs;
+        if (orgs.length) {
           console.log(`  Orgs:`);
-          for (const o of info.orgs) console.log(`    ${o.id}  ${o.name}`);
+          for (const o of orgs) {
+            const role = 'role' in o && o.role ? chalk.dim(`  (${o.role})`) : '';
+            console.log(`    ${o.id}  ${o.name}${role}`);
+          }
         }
         // The servers only when one is not the platform's default: the usual ones are noise.
         const custom = customHosts(info);

package/src/mcp/registry.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod/v3';
-import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { McpServer, RegisteredTool } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { ErrorCode, type CallToolResult } from '@modelcontextprotocol/sdk/types.js';
 import type { Environment } from '../sdk/types.js';
 import { NeedsInputError, PERSON_TIMEOUT_MS } from '../core/runtime.js';
@@ -169,10 +169,29 @@ export function createRegistry(
      * and the ids that name nothing (no card is shown for those).
      */
     displayNames?: (args: Args, orgId?: string) => Promise<{ names: Record<string, string>; missing?: string[] }>;
+    /**
+     * Role awareness (display only; the servers still decide): hide tools the person can't use
+     * anywhere, refuse early with the reason when the person's access says so, and name the
+     * person's role when a server refuses.
+     */
+    access?: {
+      visible: (name: string) => boolean;
+      deny: (name: string, orgId?: string) => Promise<string | null>;
+      explain: (orgId?: string) => Promise<string | null>;
+    };
   },
 ) {
   const metaTable = opts.meta ?? TOOL_META;
   const registered: string[] = [];
+  const handles = new Map<string, RegisteredTool>();
+
+  // A refusal from the servers names the person's role (handlers report errors as results).
+  const withRoleNote = async (result: CallToolResult, orgId?: string): Promise<CallToolResult> => {
+    const first = result.isError ? result.content?.[0] : undefined;
+    if (!opts.access || !first || first.type !== 'text' || !/^Error: (Not allowed|Access denied)/.test(first.text)) return result;
+    const role = await opts.access.explain(orgId).catch(() => null);
+    return role ? { ...result, content: [{ ...first, text: `${first.text} ${role}` }, ...result.content.slice(1)] } : result;
+  };
 
   return {
     tool(name: string, description: string, shape: Shape, handler: Handler, extra: { preview?: (args: Args) => Promise<string>; guardWhen?: (args: Args) => Promise<boolean> } = {}): void {
@@ -202,12 +221,18 @@ export function createRegistry(
           .describe('Set true only after the user has agreed to the dry run. Ignored when the host can ask the user itself.');
       }
 
-      server.registerTool(
+      const handle = server.registerTool(
         name,
         { title: meta.title, description, inputSchema, annotations: meta.annotations },
         (async (args: Args) => {
+          let orgId: string | undefined;
           try {
             const org = orgScoped ? await opts.resolveOrg!(typeof args.org_id === 'string' ? args.org_id : undefined) : undefined;
+            orgId = org?.id;
+            const refusal = opts.access ? await opts.access.deny(name, org?.id) : null;
+            if (refusal) {
+              return { content: [{ type: 'text', text: `Error: Not allowed: ${refusal} Nothing was changed.` }], isError: true };
+            }
             return await runWithOrg(org?.id, async () => {
               let confirmedByPerson = false;
               // A guarded tool asks every time, or only when guardWhen says so (e.g. the agent may be live).
@@ -233,7 +258,7 @@ export function createRegistry(
                 if (!gate.proceed) return gate.result;
                 confirmedByPerson = gate.byPerson;
               }
-              const result = await handler(args, { confirmedByPerson });
+              const result = await withRoleNote(await handler(args, { confirmedByPerson }), orgId);
               return withContext(result, { ...(await opts.context()), ...(confirmedByPerson ? { approved_by_person: true } : {}) }, paginate ? { limit: Number(args.limit ?? 50), page: Number(args.page ?? 1) } : undefined);
             });
           } catch (err) {
@@ -242,16 +267,30 @@ export function createRegistry(
               const message = err.message.replace('Choose one with --org <id>', 'Call again with org_id set to one of the ids below');
               return text({ needs_input: true, message, choices: err.choices, to_proceed: 'Ask the user which organization to use, then call again with org_id set to its id.' });
             }
-            const message = err instanceof Error ? err.message : String(err);
+            let message = err instanceof Error ? err.message : String(err);
+            if (opts.access && /^(Not allowed|Access denied)/.test(message)) {
+              const role = await opts.access.explain(orgId).catch(() => null);
+              if (role) message = `${message} ${role}`;
+            }
             return { content: [{ type: 'text', text: `Error: ${message}` }], isError: true };
           }
         }) as never,
       );
       registered.push(name);
+      handles.set(name, handle);
     },
     names(): string[] {
       return [...registered];
     },
+    /** Show only the tools the person can use somewhere; the host is told when the list changes. */
+    applyVisibility(): void {
+      if (!opts.access) return;
+      for (const [name, handle] of handles) {
+        const show = opts.access.visible(name);
+        if (show && !handle.enabled) handle.enable();
+        else if (!show && handle.enabled) handle.disable();
+      }
+    },
   };
 }
 

package/src/mcp/server.ts

@@ -2,6 +2,7 @@ import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { IndemnClient } from '../sdk/client.js';
 import { registerTools } from './tools.js';
+import { refreshAccess } from '../sdk/access.js';
 import { setAskers, type Askers } from '../core/scope.js';
 import { cliVersion, PERSON_TIMEOUT_MS } from '../core/runtime.js';
 
@@ -75,8 +76,26 @@ export async function startServer(): Promise<void> {
   }, { instructions: SERVER_INSTRUCTIONS });
 
   setAskers(mcpAskers(server));
-  registerTools(server, client);
+  const registry = registerTools(server, client);
+
+  // A host session (INDEMN_TOKEN) may be a different identity than any saved login,
+  // so never hide tools for it — deny() still refuses with the reason when a call
+  // isn't allowed. A saved login hides from what it already knows, before the host
+  // lists tools, then keeps it fresh.
+  const ownLogin = client.getCredential()?.source === 'config';
+  if (ownLogin) registry.applyVisibility();
 
   const transport = new StdioServerTransport();
   await server.connect(transport);
+
+  const refresh = () =>
+    refreshAccess(client).then(
+      () => { if (ownLogin) registry.applyVisibility(); },
+      () => undefined,
+    );
+  void refresh();
+  setInterval(() => void refresh(), ACCESS_REFRESH_MS).unref();
 }
+
+/** How often a running MCP server asks again what the person may do. */
+const ACCESS_REFRESH_MS = 15 * 60_000;

package/src/mcp/tool-meta.ts

@@ -29,6 +29,17 @@ const write = (title: string, extra: Partial<ToolAnnotations> = {}): ToolMeta =>
   annotations: { title, readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false, ...extra },
 });
 
+/** The parts a call changes, in words: "audience, channel policy". */
+const parts = (a: Record<string, unknown>, keys: string[]) => keys.filter((k) => a[k] !== undefined && a[k] !== '').map((k) => k.replace(/_/g, ' ')).join(', ');
+
+/** A book change with its new values, so the person sees what they approve: "field map to Company → account.name". */
+const bookChanges = (a: Record<string, any>) => [
+  a.source !== undefined && `source to ${a.source?.kind ?? JSON.stringify(a.source)}`,
+  Array.isArray(a.field_map) && `field map to ${a.field_map.map((m: { source_path?: string; schema_key?: string }) => `${m.source_path} → ${m.schema_key}`).join(', ')}`,
+  Array.isArray(a.identity_keys) && `identity keys to ${a.identity_keys.join(', ')}`,
+  a.display && `display to ${['primary', 'secondary'].filter((k) => Array.isArray(a.display[k])).map((k) => `${k} ${a.display[k].join(', ')}`).join('; ')}`,
+].filter(Boolean).join('; ');
+
 /** Overwrites or removes something that cannot be restored from the tool itself. */
 const destroy = (title: string, extra: Partial<ToolAnnotations> = {}): ToolMeta => ({
   title,
@@ -217,8 +228,44 @@ export const TOOL_META: Record<string, ToolMeta> = {
   // Billing (read-only)
   get_billing: read('Billing status, invoices, usage or plans'),
 
-  // Campaigns (read-only)
-  get_campaigns: read('Read campaigns and templates'),
+  // Campaigns: each change is approved on a card; nothing here sends a message, and nothing deletes.
+  get_campaigns: read('Read campaigns, templates and books'),
+  save_campaign: {
+    ...write('Create or change campaign'), guard: true,
+    describe: (a) => a.campaign_id
+      ? `This will change the ${parts(a, ['audience', 'escalation_policy', 'channel_policy'])} in the draft of campaign ${a.campaign_id} (it takes effect when the campaign is published).`
+      : `This will create campaign "${a.name}" as a draft; it sends nothing until it is published and started.`,
+  },
+  set_touchpoint: {
+    ...write('Add or change touchpoint', { idempotentHint: true }), guard: true,
+    describe: (a) => `This will add or change touchpoint "${a.key}" in the draft of campaign ${a.campaign_id}${a.channel ? ` (${a.channel})` : ''}${a.terminal_action === 'send' ? '. It is set to SEND to customers directly once the campaign is published and running' : ''}.`,
+  },
+  publish_campaign: { ...write('Publish campaign'), guard: true, describe: (a) => `This will publish the draft of campaign ${a.campaign_id} as its next version; if it is running, it uses it from its next run.` },
+  set_campaign_status: {
+    ...write('Start, pause or archive campaign'), guard: true,
+    describe: (a) => a.status === 'running'
+      ? `This will START campaign ${a.campaign_id}: it enrols the matching records of its book and runs its touchpoints (touchpoints set to send reach real customers).`
+      : a.status === 'archived' ? `This will archive campaign ${a.campaign_id} for good: it cannot be started again.`
+      : `This will pause campaign ${a.campaign_id}: its touchpoints stop until it is started again.`,
+  },
+  save_campaign_template: {
+    ...write('Create or change campaign template'), guard: true,
+    describe: (a) => a.template_id
+      ? `This will save a new version of template ${a.template_id} (${parts(a, ['subject', 'body', 'html', 'uses_variables', 'skills', 'selection_tags'])}); touchpoints keep the version they are set to until it is set again.`
+      : `This will create ${a.channel} template "${a.name}".`,
+  },
+  save_template_skill: {
+    ...write('Create or change template skill'), guard: true,
+    describe: (a) => a.template_skill_id
+      ? `This will change template skill ${a.template_skill_id} (${parts(a, ['name', 'instructions'])}); templates using it write with it from their campaigns' next run.`
+      : `This will create template skill "${a.name}".`,
+  },
+  save_book: {
+    ...write('Create or change book'), guard: true,
+    describe: (a) => a.book_id
+      ? `This will change book ${a.book_id}: ${bookChanges(a)}.`
+      : `This will create book "${a.name}" for this solution.`,
+  },
 
   // V2 platform and Jarvis (Darwin)
   platform_list: read('List V2 platform items'),

package/src/mcp/tools.ts

@@ -1,4 +1,5 @@
 import { z } from 'zod/v3';
+import { currentAccess, orgDenial, refreshAccess, roleIn, usableSomewhere } from '../sdk/access.js';
 import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import type { IndemnClient } from '../sdk/client.js';
 import { AgentInsightsSDK, AgentsSDK } from '../sdk/agents.js';
@@ -12,7 +13,7 @@ import { DistributionSDK } from '../sdk/distribution.js';
 import { AnalyticsSDK, AuditSDK, OrgSettingsSDK } from '../sdk/analytics.js';
 import { TicketsSDK } from '../sdk/tickets.js';
 import { BillingSDK } from '../sdk/billing.js';
-import { CampaignsSDK } from '../sdk/campaigns.js';
+import { CampaignsSDK, type Touchpoint } from '../sdk/campaigns.js';
 import { PlatformSDK } from '../sdk/platform.js';
 import { jarvisChat } from '../sdk/jarvis-chat.js';
 import { applyConfigChange, describePlan, liveText, mayBeLive, modelArg, planConfigChange, type ConfigChange } from '../sdk/config-change.js';
@@ -167,9 +168,32 @@ const skillDefinition = z.preprocess(parseJsonText, z.object({
   }).passthrough()).optional(),
 }).passthrough());
 
+// Campaigns are on for an org only when Indemn has turned Solutions on: the dashboard hides them otherwise, and the
+// campaigns service does not check it, so these tools ask first (before any approval card).
+const CAMPAIGN_TOOLS = new Set(['get_campaigns', 'save_campaign', 'set_touchpoint', 'publish_campaign', 'set_campaign_status', 'save_campaign_template', 'save_template_skill', 'save_book']);
+const SOLUTIONS_OFF = 'Campaigns are off for this organization: Solutions is not turned on (the dashboard hides campaigns too). Indemn staff can turn it on with set_org_admin_settings (solutions: true); anyone else asks the Indemn team to turn it on.';
+
 export function registerTools(server: McpServer, client: IndemnClient): Registry {
+  // Role awareness: the folder's linked org (or INDEMN_ORG_ID) narrows what counts; otherwise any org.
+  const orgInView = () => process.env.INDEMN_ORG_ID || client.getLink()?.org_id || undefined;
   const reg = createRegistry(server, {
     context: () => client.getResultContext(),
+    access: {
+      visible: (name) => usableSomewhere(name, currentAccess(client), orgInView()),
+      // Refuse early only when the saved access still says no after asking again (it may be stale).
+      deny: async (name, orgId) => {
+        if (CAMPAIGN_TOOLS.has(name) && orgId) {
+          const on = await client.copilotGet<{ enableSolutions?: boolean }>(`/organization/${orgId}/configurations`).then((c) => c?.enableSolutions === true, () => false);
+          if (!on) return SOLUTIONS_OFF;
+        }
+        if (!orgDenial(name, currentAccess(client), orgId)) return null;
+        return orgDenial(name, await refreshAccess(client), orgId);
+      },
+      explain: async (orgId) => {
+        const role = roleIn((await refreshAccess(client)) ?? currentAccess(client), orgId);
+        return role ? `Your role: ${role}.` : null;
+      },
+    },
     // Each call decides its own org; an answer given once is not reused for the next call.
     resolveOrg: (explicit) => client.resolveOrg(explicit, { cache: false }),
     // The person approves a change by names: look up the ids the call names.
@@ -204,7 +228,12 @@ export function registerTools(server: McpServer, client: IndemnClient): Registry
         add(args.ticket_id, null, (id) => tickets.get(id).then((t) => { const x = t as { ticket_ref?: string; title?: string }; return label([x.ticket_ref, x.title].filter(Boolean).join(' ')); })),
         add(args.rule_id, null, (id) => tickets.listRules({ includeTrashed: true }).then((rules) => label((rules as Array<{ _id?: string; id?: string; name?: string }>).find((r) => (r._id ?? r.id) === id)?.name))),
         add(args.distribution_id, null, (id) => distribution.list().then((d) => { const p = (d.paths ?? []).find((x) => x.id === id); return label(p ? `${p.path_name ?? ''} (${p.host_name ?? '*'}${p.path_expression ?? ''})`.trim() : undefined); })),
-        add(args.template_id, null, (id) => distribution.listTemplates().then((ts) => label((ts as Array<{ _id?: string; name?: string }>).find((t) => t._id === id)?.name))),
+        // A website template, else a campaign template.
+        add(args.template_id, null, (id) => distribution.listTemplates().then((ts) => label((ts as Array<{ _id?: string; name?: string }>).find((t) => t._id === id)?.name))
+          .then((l) => l.name ? l : new CampaignsSDK(client).template(id).then((t) => label((t as { name?: unknown }).name), () => l))),
+        add(args.campaign_id, 'campaign', (id) => new CampaignsSDK(client).get(id) as Promise<{ name?: unknown }>),
+        add(args.book_id, 'book', (id) => new CampaignsSDK(client).book(id)),
+        add(args.template_skill_id, 'template skill', (id) => new CampaignsSDK(client).templateSkill(id)),
         add(args.owner_id, null, (id) => orgs.listMembers().then((ms) => { const m = ms.find((x) => x.user_id === id); return label(m?.name ?? m?.email); })),
         agentId && typeof args.function_id === 'string' ? add(args.parameter_id, null, (id) => skillOf(agentId, String(args.function_id)).then((s) => functions.listParameters(agentId, s._id)).then((ps) => label(ps.find((p) => p._id === id)?.name))) : undefined,
         add(orgId, null, (id) => client.copilotGet<{ organization?: { name?: string } }>(`/organization/${id}`).then((r) => r.organization)),
@@ -1845,10 +1874,10 @@ export function registerTools(server: McpServer, client: IndemnClient): Registry
 
   reg.tool(
     'get_campaigns',
-    'Read-only campaigns: list, one campaign (campaign_id), its counts / forecast / next-touchpoints / versions, templates, one template (template_id, versions: true for subject and body), or template skills.',
+    'Read campaigns: list, one campaign (campaign_id, with its draft and touchpoints), its counts / forecast / next-touchpoints / versions, templates, one template (template_id, versions: true for subject and body), template skills, books, or one book (book_id).',
     {
-      what: z.enum(['list', 'campaign', 'counts', 'forecast', 'next-touchpoints', 'versions', 'templates', 'template', 'template-skills']),
-      campaign_id: z.string().optional(), template_id: z.string().optional(), versions: z.boolean().optional(),
+      what: z.enum(['list', 'campaign', 'counts', 'forecast', 'next-touchpoints', 'versions', 'templates', 'template', 'template-skills', 'books', 'book']),
+      campaign_id: z.string().optional(), template_id: z.string().optional(), book_id: z.string().optional(), versions: z.boolean().optional(),
       status: z.string().optional(), solution_id: z.string().optional(), channel: z.string().optional(),
       days: z.number().int().min(1).max(365).optional(), limit: z.number().int().min(1).max(500).optional(),
     },
@@ -1862,12 +1891,155 @@ export function registerTools(server: McpServer, client: IndemnClient): Registry
           case 'templates': return success(await c.templates({ channel: args.channel, solutionId: args.solution_id, limit: args.limit }));
           case 'template': return success(await c.template(need(args.template_id, 'template_id'), Boolean(args.versions)));
           case 'template-skills': return success(await c.templateSkills(args.solution_id));
+          case 'books': return success(await c.books({ solutionId: args.solution_id, limit: args.limit }));
+          case 'book': return success(await c.book(need(args.book_id, 'book_id')));
           default: return success(await c.detail(need(args.campaign_id, 'campaign_id'), args.what, args.days));
         }
       } catch (err) { return error(err); }
     },
   );
 
+  // Campaigns configuration: every change is approved on a card. Nothing here sends a message, runs a book sync or
+  // deletes (CampaignsSDK WRITABLE); a campaign ends archived. A save_* tool given an id changes that item, else creates.
+  const campaigns = new CampaignsSDK(client);
+  type CampaignArgs = Record<string, any>;
+  // Only the tool's own arguments reach the service: not confirm/org_id, and not the "" or null a model fills unused
+  // fields with (an empty value never blanks a saved field).
+  const own = (args: CampaignArgs): CampaignArgs => Object.fromEntries(Object.entries(args).filter(([k, v]) => k !== 'confirm' && k !== 'org_id' && v !== '' && v !== null));
+  const lacking = (a: CampaignArgs, keys: string[]) => keys.filter((k) => a[k] === undefined);
+  // `problem` is checked before the card: a call that cannot work is answered at once, without asking or sending.
+  const campaignTool = (name: string, description: string, shape: Record<string, z.ZodTypeAny>, run: (a: CampaignArgs) => Promise<unknown>, problem: (a: CampaignArgs) => string | null = () => null) =>
+    reg.tool(name, description, shape, async (args) => {
+      try {
+        const a = own(args);
+        const p = problem(a);
+        if (p) throw new Error(p);
+        return success(await run(a));
+      } catch (err) { return error(err); }
+    }, { guardWhen: async (args) => problem(own(args)) === null });
+  // A create and then a change: if the change is refused, the item exists, so it is changed with its id next time.
+  const thenChange = async (what: string, made: { id: string }, change: () => Promise<unknown>) => {
+    try { return await change(); } catch (err) { throw new Error(`The ${what} was created (id ${made.id}), but ${err instanceof Error ? err.message : String(err)}. Change it with its id; do not create it again.`); }
+  };
+  const rule = (what: string) => jsonObject().describe(`${what}: a rule as an object or JSON text, e.g. {"all":[{"field":"status","op":"eq","value":"active"},{"field":"derived.days_out","op":"lte","value":60}]}. Ops: eq ne lt lte gt gte in nin exists missing contains; all / any / not combine rules.`);
+  const DRAFT_PARTS = ['audience', 'escalation_policy', 'channel_policy'];
+
+  campaignTool(
+    'save_campaign',
+    "Create a campaign (no campaign_id) as a draft for a solution's book, or change a campaign's draft: its audience (which records belong) and escalation and channel policies; what is not given stays. Touchpoints are set with set_touchpoint. Nothing is sent until the campaign is published (publish_campaign) and started (set_campaign_status running). Find the solution with list_solutions and its book with get_campaigns (what: books).",
+    {
+      campaign_id: z.string().optional().describe('The campaign to change; leave out to create one'),
+      solution_id: z.string().optional(), book_id: z.string().optional(), name: z.string().optional(),
+      campaign_type: z.string().optional().describe('To create: e.g. renewal, outreach'),
+      entry: z.enum(['rolling', 'cohort']).optional().describe('To create: rolling (records join as they match, the default) or cohort (a fixed set, with closes)'),
+      closes: z.string().optional().describe('To create a cohort campaign: ISO date it closes'),
+      audience: rule('Which records belong').optional(),
+      escalation_policy: jsonObject().optional().describe('e.g. {"after":{"touches_exhausted":true},"on_hard_failure":"escalate_immediately","then":"create_work_item","assign_to":null}'),
+      channel_policy: jsonObject().optional().describe('e.g. {"quiet_hours":null,"max_per_record_per_window":null}'),
+    },
+    async ({ campaign_id, audience, escalation_policy, channel_policy, ...create }) => {
+      const parts = { audience, escalation_policy, channel_policy };
+      if (campaign_id) return campaigns.updateDraft(campaign_id, parts);
+      const made = await campaigns.createCampaign(create as Parameters<CampaignsSDK['createCampaign']>[0]);
+      return DRAFT_PARTS.some((k) => (parts as CampaignArgs)[k] !== undefined) ? thenChange('campaign', made, async () => ({ ...made, draft: await campaigns.updateDraft(made.id, parts) })) : made;
+    },
+    (a) => a.campaign_id
+      ? (DRAFT_PARTS.some((k) => a[k] !== undefined) ? null : 'Nothing to change: give audience, escalation_policy or channel_policy (a campaign is not renamed here).')
+      : (lacking(a, ['solution_id', 'book_id', 'name', 'campaign_type']).length ? `To create a campaign also give ${lacking(a, ['solution_id', 'book_id', 'name', 'campaign_type']).join(', ')}; to change one, give its campaign_id.` : null),
+  );
+
+  campaignTool(
+    'set_touchpoint',
+    "Add a touchpoint to a campaign's draft, or change the one with the same key (only the fields given change). when is a trigger rule: days before the due date ({\"field\":\"derived.days_out\",\"op\":\"lte\",\"value\":45}), a day of the month (calendar.day_of_month), days without a reply (silence.days) or an inbound intent (intent). terminal_action draft (the default) prepares the message for a person to review; send sends it to the customer, so use send only when the person asks for it. A template given without a version is pinned to its latest.",
+    {
+      campaign_id: z.string(),
+      key: z.string().trim().min(1).describe('Unique in the campaign, e.g. t2_reminder_45'),
+      when: rule('When it fires').optional(),
+      channel: z.enum(['email', 'voice', 'sms']).optional(),
+      terminal_action: z.enum(['draft', 'send']).optional(),
+      order: z.number().int().optional(),
+      template_id: z.string().optional(), template_version_n: z.number().int().optional(),
+      grouping: jsonObject().optional().describe('e.g. {"key":"insured_account","recipient":"resolved"} (key: record, insured_account or fixed_recipient)'),
+      required_variables: jsonArray(z.string()).optional(),
+    },
+    async ({ campaign_id, ...touchpoint }) => campaigns.setTouchpoint(campaign_id, touchpoint as Touchpoint),
+  );
+
+  campaignTool(
+    'publish_campaign',
+    "Publish a campaign's draft as its next version (refused, with every problem listed, while it has no audience or touchpoint). A running campaign uses the new version from its next run.",
+    { campaign_id: z.string(), change_summary: z.string().optional() },
+    async (a) => campaigns.publish(a.campaign_id, a.change_summary),
+  );
+
+  campaignTool(
+    'set_campaign_status',
+    'Start (running), pause (paused) or archive (archived, for good) a campaign. Starting needs a published version; it then enrols the matching records of its book and runs its touchpoints. Campaigns are never deleted: asked to delete one, offer to archive it and say it is archived, not deleted.',
+    { campaign_id: z.string(), status: z.enum(['running', 'paused', 'archived']) },
+    async (a) => campaigns.setStatus(a.campaign_id, a.status),
+  );
+
+  const TEMPLATE_PARTS = ['subject', 'body', 'html', 'uses_variables', 'skills', 'selection_tags'];
+  campaignTool(
+    'save_campaign_template',
+    'Create a campaign message template (no template_id), or change one: a change is saved as its new version, made from the latest one with the fields given. Touchpoints keep the version they are set to until set_touchpoint sets the template again.',
+    {
+      template_id: z.string().optional().describe('The template to change; leave out to create one'),
+      solution_id: z.string().optional(), name: z.string().optional(), channel: z.enum(['email', 'voice', 'sms']).optional(),
+      subject: z.string().optional().describe('Email subject. Placeholders: {{ record.<book field> }}, e.g. {{ record.policy.number }}, or contact.*, campaign.*, enrollment.*'),
+      body: z.string().optional().describe('Message text, with placeholders as in subject'),
+      html: z.string().optional(),
+      uses_variables: jsonArray(z.string()).optional().describe('Every placeholder key the template uses, e.g. ["record.policy.number","contact.first_name"] (the service refuses an undeclared one)'),
+      skills: jsonObject().optional(), selection_tags: jsonObject().optional(),
+      change_summary: z.string().optional(),
+    },
+    async ({ template_id, solution_id, name, channel, ...content }) => template_id
+      ? campaigns.updateTemplate(template_id, content)
+      : campaigns.createTemplate({ solution_id, name, channel, ...content }),
+    (a) => a.template_id
+      ? (TEMPLATE_PARTS.some((k) => a[k] !== undefined) ? null : `Nothing to change: give ${TEMPLATE_PARTS.join(', ')}.`)
+      : (lacking(a, ['solution_id', 'name', 'channel', 'body']).length ? `To create a template also give ${lacking(a, ['solution_id', 'name', 'channel', 'body']).join(', ')}; to change one, give its template_id.` : null),
+  );
+
+  campaignTool(
+    'save_template_skill',
+    "Create a template skill (no template_skill_id): writing instructions a template uses when its message is composed. Or change one's name or instructions; templates using it write with the new text from their campaigns' next run, with no publish.",
+    {
+      template_skill_id: z.string().optional().describe('The skill to change; leave out to create one'),
+      solution_id: z.string().optional(), key: z.string().optional().describe('To create: unique in the solution, e.g. friendly_tone'),
+      name: z.string().optional(), instructions: z.string().optional(),
+    },
+    async ({ template_skill_id, solution_id, key, name, instructions }) => template_skill_id
+      ? campaigns.updateTemplateSkill(template_skill_id, { name, instructions })
+      : campaigns.createTemplateSkill({ solution_id, key, name, instructions }),
+    (a) => a.template_skill_id
+      ? (a.name !== undefined || a.instructions !== undefined ? null : 'Nothing to change: give name or instructions.')
+      : (lacking(a, ['solution_id', 'key', 'name', 'instructions']).length ? `To create a template skill also give ${lacking(a, ['solution_id', 'key', 'name', 'instructions']).join(', ')}; to change one, give its template_skill_id.` : null),
+  );
+
+  const BOOK_PARTS = ['source', 'field_map', 'identity_keys', 'display'];
+  campaignTool(
+    'save_book',
+    "Create a solution's book, the records a campaign works from (no book_id; a solution has one book, so look with get_campaigns what: books first). Or change a book's source, field map (which source column fills which field), identity keys (what makes a record unique; only while it has no records) or display (fields shown for a record); each part given replaces the book's. Keys are the book's schema keys, e.g. policy.number, insured.name.",
+    {
+      book_id: z.string().optional().describe('The book to change; leave out to create one'),
+      solution_id: z.string().optional(), name: z.string().optional(),
+      schema_id: z.string().optional().describe("To create: the entity schema; left out, the solution type's default fields"),
+      source: jsonObject().optional().describe('{"kind":"upload"} (records uploaded as CSV in the dashboard) or {"kind":"connection","integration_id":"…"}'),
+      field_map: jsonArray(jsonObject()).optional().describe('e.g. [{"schema_key":"policy.number","source_path":"Policy #"}]'),
+      identity_keys: jsonArray(z.string()).optional().describe('e.g. ["policy.number"]'),
+      display: jsonObject().optional().describe('e.g. {"primary":["policy.number"],"secondary":["insured.name"]}'),
+    },
+    async ({ book_id, solution_id, name, schema_id, source, ...parts }) => {
+      if (book_id) return campaigns.updateBook(book_id, { source, ...parts });
+      const made = await campaigns.createBook({ solution_id, name, schema_id, source });
+      return Object.keys(parts).length ? thenChange('book', made, () => campaigns.updateBook(made.id, parts)) : made;
+    },
+    (a) => a.book_id
+      ? (BOOK_PARTS.some((k) => a[k] !== undefined) ? null : `Nothing to change: give ${BOOK_PARTS.join(', ')}.`)
+      : (lacking(a, ['solution_id', 'name']).length ? `To create a book also give ${lacking(a, ['solution_id', 'name']).join(', ')}; to change one, give its book_id.` : null),
+  );
+
   const platform = new PlatformSDK(client);
   const platformResource = z.enum(['agents', 'templates', 'components', 'connectors', 'connector-bindings', 'scenarios']);