@indemn/cli 1.7.8 → 1.7.10

package/src/mcp/tools.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod/v3';
-import { currentAccess, orgDenial, refreshAccess, roleIn, usableSomewhere } from '../sdk/access.js';
+import { currentAccess, inviteDenial, inviteProject, orgDenial, refreshAccess, roleIn, usableSomewhere } from '../sdk/access.js';
 import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import type { IndemnClient } from '../sdk/client.js';
 import { AgentInsightsSDK, AgentsSDK } from '../sdk/agents.js';
@@ -13,7 +13,7 @@ import { DistributionSDK } from '../sdk/distribution.js';
 import { AnalyticsSDK, AuditSDK, OrgSettingsSDK } from '../sdk/analytics.js';
 import { TicketsSDK } from '../sdk/tickets.js';
 import { BillingSDK } from '../sdk/billing.js';
-import { CampaignsSDK } from '../sdk/campaigns.js';
+import { CampaignsSDK, type Touchpoint } from '../sdk/campaigns.js';
 import { PlatformSDK } from '../sdk/platform.js';
 import { jarvisChat } from '../sdk/jarvis-chat.js';
 import { applyConfigChange, describePlan, liveText, mayBeLive, modelArg, planConfigChange, type ConfigChange } from '../sdk/config-change.js';
@@ -28,7 +28,7 @@ import { exchange, openTestChat } from '../sdk/test-chat.js';
 import { ConversationsSDK, conversationToTestSet, conversationUrl, isCliConversation, isTestConversation, projectOfAgent } from '../sdk/conversations.js';
 import { exportEvalMarkdown, exportEvalReport, exportAgentCard } from '../report/export.js';
 import { createRegistry, type Registry } from './registry.js';
-import { OrgsSDK } from '../sdk/orgs.js';
+import { INVITE_ROLES, OrgsSDK } from '../sdk/orgs.js';
 import { whoami } from '../sdk/auth.js';
 import { NeedsInputError, SessionExpiredError } from '../core/runtime.js';
 
@@ -168,6 +168,11 @@ const skillDefinition = z.preprocess(parseJsonText, z.object({
   }).passthrough()).optional(),
 }).passthrough());
 
+// Campaigns are on for an org only when Indemn has turned Solutions on: the dashboard hides them otherwise, and the
+// campaigns service does not check it, so these tools ask first (before any approval card).
+const CAMPAIGN_TOOLS = new Set(['get_campaigns', 'save_campaign', 'set_touchpoint', 'publish_campaign', 'set_campaign_status', 'save_campaign_template', 'save_template_skill', 'save_book']);
+const SOLUTIONS_OFF = 'Campaigns are off for this organization: Solutions is not turned on (the dashboard hides campaigns too). Indemn staff can turn it on with set_org_admin_settings (solutions: true); anyone else asks the Indemn team to turn it on.';
+
 export function registerTools(server: McpServer, client: IndemnClient): Registry {
   // Role awareness: the folder's linked org (or INDEMN_ORG_ID) narrows what counts; otherwise any org.
   const orgInView = () => process.env.INDEMN_ORG_ID || client.getLink()?.org_id || undefined;
@@ -177,6 +182,11 @@ export function registerTools(server: McpServer, client: IndemnClient): Registry
       visible: (name) => usableSomewhere(name, currentAccess(client), orgInView()),
       // Refuse early only when the saved access still says no after asking again (it may be stale).
       deny: async (name, orgId) => {
+        if (name === 'invite_org_member') return inviteDenial((await refreshAccess(client)) ?? currentAccess(client), orgId);
+        if (CAMPAIGN_TOOLS.has(name) && orgId) {
+          const on = await client.copilotGet<{ enableSolutions?: boolean }>(`/organization/${orgId}/configurations`).then((c) => c?.enableSolutions === true, () => false);
+          if (!on) return SOLUTIONS_OFF;
+        }
         if (!orgDenial(name, currentAccess(client), orgId)) return null;
         return orgDenial(name, await refreshAccess(client), orgId);
       },
@@ -219,7 +229,12 @@ export function registerTools(server: McpServer, client: IndemnClient): Registry
         add(args.ticket_id, null, (id) => tickets.get(id).then((t) => { const x = t as { ticket_ref?: string; title?: string }; return label([x.ticket_ref, x.title].filter(Boolean).join(' ')); })),
         add(args.rule_id, null, (id) => tickets.listRules({ includeTrashed: true }).then((rules) => label((rules as Array<{ _id?: string; id?: string; name?: string }>).find((r) => (r._id ?? r.id) === id)?.name))),
         add(args.distribution_id, null, (id) => distribution.list().then((d) => { const p = (d.paths ?? []).find((x) => x.id === id); return label(p ? `${p.path_name ?? ''} (${p.host_name ?? '*'}${p.path_expression ?? ''})`.trim() : undefined); })),
-        add(args.template_id, null, (id) => distribution.listTemplates().then((ts) => label((ts as Array<{ _id?: string; name?: string }>).find((t) => t._id === id)?.name))),
+        // A website template, else a campaign template.
+        add(args.template_id, null, (id) => distribution.listTemplates().then((ts) => label((ts as Array<{ _id?: string; name?: string }>).find((t) => t._id === id)?.name))
+          .then((l) => l.name ? l : new CampaignsSDK(client).template(id).then((t) => label((t as { name?: unknown }).name), () => l))),
+        add(args.campaign_id, 'campaign', (id) => new CampaignsSDK(client).get(id) as Promise<{ name?: unknown }>),
+        add(args.book_id, 'book', (id) => new CampaignsSDK(client).book(id)),
+        add(args.template_skill_id, 'template skill', (id) => new CampaignsSDK(client).templateSkill(id)),
         add(args.owner_id, null, (id) => orgs.listMembers().then((ms) => { const m = ms.find((x) => x.user_id === id); return label(m?.name ?? m?.email); })),
         agentId && typeof args.function_id === 'string' ? add(args.parameter_id, null, (id) => skillOf(agentId, String(args.function_id)).then((s) => functions.listParameters(agentId, s._id)).then((ps) => label(ps.find((p) => p._id === id)?.name))) : undefined,
         add(orgId, null, (id) => client.copilotGet<{ organization?: { name?: string } }>(`/organization/${id}`).then((r) => r.organization)),
@@ -278,6 +293,22 @@ export function registerTools(server: McpServer, client: IndemnClient): Registry
     },
   );
 
+  reg.tool(
+    'invite_org_member',
+    'Invite someone to the organization by email, as the dashboard\'s Invite user page does. Only owners and admins can invite. Roles: admin (manages agents, knowledge bases, conversations, teammates and organization settings; not billing), agent (handles live conversations, with full AI Studio access; cannot manage teammates or settings) or member (tests and reviews agents and sees conversations). Ask for the role if the person did not say one; there is no owner role here. Someone without an Indemn account gets an email to sign up; an existing account joins at once. The host asks the person to approve.',
+    {
+      email: z.string().trim().email().describe('Email address of the person to invite'),
+      role: z.enum(INVITE_ROLES).describe('admin, agent or member'),
+    },
+    async (args) => {
+      try {
+        const project = inviteProject(currentAccess(client) ?? await refreshAccess(client), await client.currentOrgId());
+        if (!project) throw new Error('Could not find a project in this organization where you are an owner or admin. Nothing was sent.');
+        return success(await orgs.inviteMember(project.project_id, args.email, args.role));
+      } catch (err) { return error(err); }
+    },
+  );
+
   reg.tool(
     'list_channels',
     'List the channels an agent can be published on, such as WEB or VOICE.',
@@ -1860,10 +1891,10 @@ export function registerTools(server: McpServer, client: IndemnClient): Registry
 
   reg.tool(
     'get_campaigns',
-    'Read-only campaigns: list, one campaign (campaign_id), its counts / forecast / next-touchpoints / versions, templates, one template (template_id, versions: true for subject and body), or template skills.',
+    'Read campaigns: list, one campaign (campaign_id, with its draft and touchpoints), its counts / forecast / next-touchpoints / versions, templates, one template (template_id, versions: true for subject and body), template skills, books, or one book (book_id).',
     {
-      what: z.enum(['list', 'campaign', 'counts', 'forecast', 'next-touchpoints', 'versions', 'templates', 'template', 'template-skills']),
-      campaign_id: z.string().optional(), template_id: z.string().optional(), versions: z.boolean().optional(),
+      what: z.enum(['list', 'campaign', 'counts', 'forecast', 'next-touchpoints', 'versions', 'templates', 'template', 'template-skills', 'books', 'book']),
+      campaign_id: z.string().optional(), template_id: z.string().optional(), book_id: z.string().optional(), versions: z.boolean().optional(),
       status: z.string().optional(), solution_id: z.string().optional(), channel: z.string().optional(),
       days: z.number().int().min(1).max(365).optional(), limit: z.number().int().min(1).max(500).optional(),
     },
@@ -1877,12 +1908,155 @@ export function registerTools(server: McpServer, client: IndemnClient): Registry
           case 'templates': return success(await c.templates({ channel: args.channel, solutionId: args.solution_id, limit: args.limit }));
           case 'template': return success(await c.template(need(args.template_id, 'template_id'), Boolean(args.versions)));
           case 'template-skills': return success(await c.templateSkills(args.solution_id));
+          case 'books': return success(await c.books({ solutionId: args.solution_id, limit: args.limit }));
+          case 'book': return success(await c.book(need(args.book_id, 'book_id')));
           default: return success(await c.detail(need(args.campaign_id, 'campaign_id'), args.what, args.days));
         }
       } catch (err) { return error(err); }
     },
   );
 
+  // Campaigns configuration: every change is approved on a card. Nothing here sends a message, runs a book sync or
+  // deletes (CampaignsSDK WRITABLE); a campaign ends archived. A save_* tool given an id changes that item, else creates.
+  const campaigns = new CampaignsSDK(client);
+  type CampaignArgs = Record<string, any>;
+  // Only the tool's own arguments reach the service: not confirm/org_id, and not the "" or null a model fills unused
+  // fields with (an empty value never blanks a saved field).
+  const own = (args: CampaignArgs): CampaignArgs => Object.fromEntries(Object.entries(args).filter(([k, v]) => k !== 'confirm' && k !== 'org_id' && v !== '' && v !== null));
+  const lacking = (a: CampaignArgs, keys: string[]) => keys.filter((k) => a[k] === undefined);
+  // `problem` is checked before the card: a call that cannot work is answered at once, without asking or sending.
+  const campaignTool = (name: string, description: string, shape: Record<string, z.ZodTypeAny>, run: (a: CampaignArgs) => Promise<unknown>, problem: (a: CampaignArgs) => string | null = () => null) =>
+    reg.tool(name, description, shape, async (args) => {
+      try {
+        const a = own(args);
+        const p = problem(a);
+        if (p) throw new Error(p);
+        return success(await run(a));
+      } catch (err) { return error(err); }
+    }, { guardWhen: async (args) => problem(own(args)) === null });
+  // A create and then a change: if the change is refused, the item exists, so it is changed with its id next time.
+  const thenChange = async (what: string, made: { id: string }, change: () => Promise<unknown>) => {
+    try { return await change(); } catch (err) { throw new Error(`The ${what} was created (id ${made.id}), but ${err instanceof Error ? err.message : String(err)}. Change it with its id; do not create it again.`); }
+  };
+  const rule = (what: string) => jsonObject().describe(`${what}: a rule as an object or JSON text, e.g. {"all":[{"field":"status","op":"eq","value":"active"},{"field":"derived.days_out","op":"lte","value":60}]}. Ops: eq ne lt lte gt gte in nin exists missing contains; all / any / not combine rules.`);
+  const DRAFT_PARTS = ['audience', 'escalation_policy', 'channel_policy'];
+
+  campaignTool(
+    'save_campaign',
+    "Create a campaign (no campaign_id) as a draft for a solution's book, or change a campaign's draft: its audience (which records belong) and escalation and channel policies; what is not given stays. Touchpoints are set with set_touchpoint. Nothing is sent until the campaign is published (publish_campaign) and started (set_campaign_status running). Find the solution with list_solutions and its book with get_campaigns (what: books).",
+    {
+      campaign_id: z.string().optional().describe('The campaign to change; leave out to create one'),
+      solution_id: z.string().optional(), book_id: z.string().optional(), name: z.string().optional(),
+      campaign_type: z.string().optional().describe('To create: e.g. renewal, outreach'),
+      entry: z.enum(['rolling', 'cohort']).optional().describe('To create: rolling (records join as they match, the default) or cohort (a fixed set, with closes)'),
+      closes: z.string().optional().describe('To create a cohort campaign: ISO date it closes'),
+      audience: rule('Which records belong').optional(),
+      escalation_policy: jsonObject().optional().describe('e.g. {"after":{"touches_exhausted":true},"on_hard_failure":"escalate_immediately","then":"create_work_item","assign_to":null}'),
+      channel_policy: jsonObject().optional().describe('e.g. {"quiet_hours":null,"max_per_record_per_window":null}'),
+    },
+    async ({ campaign_id, audience, escalation_policy, channel_policy, ...create }) => {
+      const parts = { audience, escalation_policy, channel_policy };
+      if (campaign_id) return campaigns.updateDraft(campaign_id, parts);
+      const made = await campaigns.createCampaign(create as Parameters<CampaignsSDK['createCampaign']>[0]);
+      return DRAFT_PARTS.some((k) => (parts as CampaignArgs)[k] !== undefined) ? thenChange('campaign', made, async () => ({ ...made, draft: await campaigns.updateDraft(made.id, parts) })) : made;
+    },
+    (a) => a.campaign_id
+      ? (DRAFT_PARTS.some((k) => a[k] !== undefined) ? null : 'Nothing to change: give audience, escalation_policy or channel_policy (a campaign is not renamed here).')
+      : (lacking(a, ['solution_id', 'book_id', 'name', 'campaign_type']).length ? `To create a campaign also give ${lacking(a, ['solution_id', 'book_id', 'name', 'campaign_type']).join(', ')}; to change one, give its campaign_id.` : null),
+  );
+
+  campaignTool(
+    'set_touchpoint',
+    "Add a touchpoint to a campaign's draft, or change the one with the same key (only the fields given change). when is a trigger rule: days before the due date ({\"field\":\"derived.days_out\",\"op\":\"lte\",\"value\":45}), a day of the month (calendar.day_of_month), days without a reply (silence.days) or an inbound intent (intent). terminal_action draft (the default) prepares the message for a person to review; send sends it to the customer, so use send only when the person asks for it. A template given without a version is pinned to its latest.",
+    {
+      campaign_id: z.string(),
+      key: z.string().trim().min(1).describe('Unique in the campaign, e.g. t2_reminder_45'),
+      when: rule('When it fires').optional(),
+      channel: z.enum(['email', 'voice', 'sms']).optional(),
+      terminal_action: z.enum(['draft', 'send']).optional(),
+      order: z.number().int().optional(),
+      template_id: z.string().optional(), template_version_n: z.number().int().optional(),
+      grouping: jsonObject().optional().describe('e.g. {"key":"insured_account","recipient":"resolved"} (key: record, insured_account or fixed_recipient)'),
+      required_variables: jsonArray(z.string()).optional(),
+    },
+    async ({ campaign_id, ...touchpoint }) => campaigns.setTouchpoint(campaign_id, touchpoint as Touchpoint),
+  );
+
+  campaignTool(
+    'publish_campaign',
+    "Publish a campaign's draft as its next version (refused, with every problem listed, while it has no audience or touchpoint). A running campaign uses the new version from its next run.",
+    { campaign_id: z.string(), change_summary: z.string().optional() },
+    async (a) => campaigns.publish(a.campaign_id, a.change_summary),
+  );
+
+  campaignTool(
+    'set_campaign_status',
+    'Start (running), pause (paused) or archive (archived, for good) a campaign. Starting needs a published version; it then enrols the matching records of its book and runs its touchpoints. Campaigns are never deleted: asked to delete one, offer to archive it and say it is archived, not deleted.',
+    { campaign_id: z.string(), status: z.enum(['running', 'paused', 'archived']) },
+    async (a) => campaigns.setStatus(a.campaign_id, a.status),
+  );
+
+  const TEMPLATE_PARTS = ['subject', 'body', 'html', 'uses_variables', 'skills', 'selection_tags'];
+  campaignTool(
+    'save_campaign_template',
+    'Create a campaign message template (no template_id), or change one: a change is saved as its new version, made from the latest one with the fields given. Touchpoints keep the version they are set to until set_touchpoint sets the template again.',
+    {
+      template_id: z.string().optional().describe('The template to change; leave out to create one'),
+      solution_id: z.string().optional(), name: z.string().optional(), channel: z.enum(['email', 'voice', 'sms']).optional(),
+      subject: z.string().optional().describe('Email subject. Placeholders: {{ record.<book field> }}, e.g. {{ record.policy.number }}, or contact.*, campaign.*, enrollment.*'),
+      body: z.string().optional().describe('Message text, with placeholders as in subject'),
+      html: z.string().optional(),
+      uses_variables: jsonArray(z.string()).optional().describe('Every placeholder key the template uses, e.g. ["record.policy.number","contact.first_name"] (the service refuses an undeclared one)'),
+      skills: jsonObject().optional(), selection_tags: jsonObject().optional(),
+      change_summary: z.string().optional(),
+    },
+    async ({ template_id, solution_id, name, channel, ...content }) => template_id
+      ? campaigns.updateTemplate(template_id, content)
+      : campaigns.createTemplate({ solution_id, name, channel, ...content }),
+    (a) => a.template_id
+      ? (TEMPLATE_PARTS.some((k) => a[k] !== undefined) ? null : `Nothing to change: give ${TEMPLATE_PARTS.join(', ')}.`)
+      : (lacking(a, ['solution_id', 'name', 'channel', 'body']).length ? `To create a template also give ${lacking(a, ['solution_id', 'name', 'channel', 'body']).join(', ')}; to change one, give its template_id.` : null),
+  );
+
+  campaignTool(
+    'save_template_skill',
+    "Create a template skill (no template_skill_id): writing instructions a template uses when its message is composed. Or change one's name or instructions; templates using it write with the new text from their campaigns' next run, with no publish.",
+    {
+      template_skill_id: z.string().optional().describe('The skill to change; leave out to create one'),
+      solution_id: z.string().optional(), key: z.string().optional().describe('To create: unique in the solution, e.g. friendly_tone'),
+      name: z.string().optional(), instructions: z.string().optional(),
+    },
+    async ({ template_skill_id, solution_id, key, name, instructions }) => template_skill_id
+      ? campaigns.updateTemplateSkill(template_skill_id, { name, instructions })
+      : campaigns.createTemplateSkill({ solution_id, key, name, instructions }),
+    (a) => a.template_skill_id
+      ? (a.name !== undefined || a.instructions !== undefined ? null : 'Nothing to change: give name or instructions.')
+      : (lacking(a, ['solution_id', 'key', 'name', 'instructions']).length ? `To create a template skill also give ${lacking(a, ['solution_id', 'key', 'name', 'instructions']).join(', ')}; to change one, give its template_skill_id.` : null),
+  );
+
+  const BOOK_PARTS = ['source', 'field_map', 'identity_keys', 'display'];
+  campaignTool(
+    'save_book',
+    "Create a solution's book, the records a campaign works from (no book_id; a solution has one book, so look with get_campaigns what: books first). Or change a book's source, field map (which source column fills which field), identity keys (what makes a record unique; only while it has no records) or display (fields shown for a record); each part given replaces the book's. Keys are the book's schema keys, e.g. policy.number, insured.name.",
+    {
+      book_id: z.string().optional().describe('The book to change; leave out to create one'),
+      solution_id: z.string().optional(), name: z.string().optional(),
+      schema_id: z.string().optional().describe("To create: the entity schema; left out, the solution type's default fields"),
+      source: jsonObject().optional().describe('{"kind":"upload"} (records uploaded as CSV in the dashboard) or {"kind":"connection","integration_id":"…"}'),
+      field_map: jsonArray(jsonObject()).optional().describe('e.g. [{"schema_key":"policy.number","source_path":"Policy #"}]'),
+      identity_keys: jsonArray(z.string()).optional().describe('e.g. ["policy.number"]'),
+      display: jsonObject().optional().describe('e.g. {"primary":["policy.number"],"secondary":["insured.name"]}'),
+    },
+    async ({ book_id, solution_id, name, schema_id, source, ...parts }) => {
+      if (book_id) return campaigns.updateBook(book_id, { source, ...parts });
+      const made = await campaigns.createBook({ solution_id, name, schema_id, source });
+      return Object.keys(parts).length ? thenChange('book', made, () => campaigns.updateBook(made.id, parts)) : made;
+    },
+    (a) => a.book_id
+      ? (BOOK_PARTS.some((k) => a[k] !== undefined) ? null : `Nothing to change: give ${BOOK_PARTS.join(', ')}.`)
+      : (lacking(a, ['solution_id', 'name']).length ? `To create a book also give ${lacking(a, ['solution_id', 'name']).join(', ')}; to change one, give its book_id.` : null),
+  );
+
   const platform = new PlatformSDK(client);
   const platformResource = z.enum(['agents', 'templates', 'components', 'connectors', 'connector-bindings', 'scenarios']);
 

package/src/sdk/access.ts

@@ -120,6 +120,18 @@ export function roleIn(access: Access | null, orgId: string | undefined): string
   return `${org.role ?? 'member'} in ${org.org_name}`;
 }
 
+/** The org's project where the person can invite people: copilot's invite route needs owner or admin there. */
+export function inviteProject(access: Access | null, orgId: string): AccessProject | undefined {
+  return access?.orgs.find((o) => o.org_id === orgId)?.projects.find((p) => p.role === 'owner' || p.role === 'admin');
+}
+
+/** Why the person can't invite people to this org, or null (also when access is unknown: the server decides). */
+export function inviteDenial(access: Access | null, orgId: string | undefined): string | null {
+  const org = orgId ? access?.orgs.find((o) => o.org_id === orgId) : undefined;
+  if (!org || inviteProject(access, org.org_id)) return null;
+  return `Only owners and admins can invite people, and your role in ${org.org_name} is ${org.role ?? 'member'}.`;
+}
+
 /**
  * For org-scoped requirements: why this org can't be used, or null. Project-scoped
  * requirements are decided by the server (the project comes from the agent).

package/src/sdk/campaigns.ts

@@ -1,7 +1,7 @@
 import type { IndemnClient } from './client.js';
 import { CliError, EXIT } from '../core/runtime.js';
 
-/** Paths of the campaigns service the CLI may read. Everything else, and every write, is refused. */
+/** Paths of the campaigns service the CLI may read. Everything else is refused. */
 const READABLE = [
   /^\/campaigns$/,
   /^\/campaigns\/[\w-]+$/,
@@ -11,12 +11,44 @@ const READABLE = [
   /^\/templates\/[\w-]+\/versions$/,
   /^\/template-skills$/,
   /^\/template-skills\/[\w-]+$/,
+  /^\/books$/,
+  /^\/books\/[\w-]+$/,
 ];
 
+type WriteMethod = 'POST' | 'PUT' | 'PATCH';
+/** What the CLI may change: campaigns and their drafts (touchpoints live there), publish and status, templates
+ *  (each change a new version), template skills and books. Never sending or resolving anything, book runs,
+ *  uploads, test ticks or enrollments, and no deletes: those act on real customers or cannot be undone. */
+const WRITABLE: Array<[WriteMethod, RegExp]> = [
+  ['POST', /^\/campaigns$/],
+  ['PUT', /^\/campaigns\/[\w-]+\/draft$/],
+  ['POST', /^\/campaigns\/[\w-]+\/(publish|status)$/],
+  ['POST', /^\/templates$/],
+  ['POST', /^\/templates\/[\w-]+\/versions$/],
+  ['POST', /^\/template-skills$/],
+  ['PUT', /^\/template-skills\/[\w-]+$/],
+  ['POST', /^\/books$/],
+  ['PATCH', /^\/books\/[\w-]+\/source$/],
+  ['PUT', /^\/books\/[\w-]+\/(field-map|identity-keys|display)$/],
+];
+
+export type CampaignStatus = 'draft' | 'running' | 'paused' | 'archived';
+/** A touchpoint in a campaign's draft, found by its key. */
+export type Touchpoint = { key: string } & Record<string, unknown>;
+type Draft = { audience?: unknown; touchpoints?: Touchpoint[]; escalation_policy?: unknown; channel_policy?: unknown };
+type Envelope = { total?: number; items?: Array<Record<string, unknown>> };
+// A template version is whole: a change starts from the latest version's content.
+const TEMPLATE_CONTENT = ['subject', 'body', 'html', 'uses_variables', 'selection_tags', 'skills', 'batch_row'];
+const given = <T extends object>(o: T) => Object.fromEntries(Object.entries(o).filter(([, v]) => v !== undefined)) as Partial<T>;
+type Variable = { key: string; required?: boolean; example?: unknown };
+// Templates declare the variables they read as {key, required, example}; given as keys, a key the template already
+// declares keeps its entry.
+const declare = (keys: string[] | undefined, current: Variable[] = []) => keys?.map((key) => current.find((v) => v.key === key) ?? { key });
+
 /**
- * Campaigns, READ-ONLY by design, through copilot's proxy to the campaigns
- * service. The CLI never publishes a campaign, sends a communication or
- * triggers a book sync; those act on real customers.
+ * Campaigns through copilot's proxy to the campaigns service: reads, and
+ * writes to configuration only (WRITABLE). The CLI never sends a
+ * communication, runs a book sync or deletes; those act on real customers.
  */
 export class CampaignsSDK {
   constructor(private client: IndemnClient) {}
@@ -26,6 +58,11 @@ export class CampaignsSDK {
     return this.client.copilotGet<T>(`/organization/:org_id/campaigns-service${path}`, query);
   }
 
+  private async write<T>(method: WriteMethod, path: string, body: unknown): Promise<T> {
+    if (!WRITABLE.some(([m, r]) => m === method && r.test(path))) throw new CliError(`Campaigns ${method} ${path} is not allowed from the CLI.`, EXIT.NEEDS_INPUT);
+    return this.client.copilotRequestRaw<T>(method, `/organization/:org_id/campaigns-service${path}`, body);
+  }
+
   list(filter: { status?: string; solutionId?: string; limit?: number; skip?: number } = {}): Promise<{ total?: number; items?: unknown[] }> {
     const q: Record<string, string> = { limit: String(Math.min(filter.limit ?? 50, 500)), skip: String(filter.skip ?? 0) };
     if (filter.status) q.status = filter.status;
@@ -57,4 +94,88 @@ export class CampaignsSDK {
   templateSkills(solutionId?: string): Promise<unknown> {
     return this.read('/template-skills', solutionId ? { solution_id: solutionId } : undefined);
   }
+
+  templateSkill(id: string): Promise<{ name?: string; instructions?: string }> {
+    return this.read(`/template-skills/${id}`);
+  }
+
+  books(filter: { solutionId?: string; limit?: number } = {}): Promise<Envelope> {
+    const q: Record<string, string> = { limit: String(Math.min(filter.limit ?? 50, 200)) };  // the service allows 200
+    if (filter.solutionId) q.solution_id = filter.solutionId;
+    return this.read('/books', q);
+  }
+
+  book(id: string): Promise<{ name?: string }> {
+    return this.read(`/books/${id}`);
+  }
+
+  createCampaign(input: { solution_id: string; book_id: string; name: string; campaign_type: string; entry?: string; closes?: string }): Promise<{ id: string }> {
+    return this.write('POST', '/campaigns', given(input));
+  }
+
+  /** Change parts of the draft; the rest of it (its touchpoints among it) stays as it is. */
+  async updateDraft(id: string, parts: Omit<Draft, 'touchpoints'>): Promise<Draft> {
+    const { draft } = await this.read<{ draft?: Draft }>(`/campaigns/${id}`);
+    return this.write('PUT', `/campaigns/${id}/draft`, { ...draft, ...given(parts) });
+  }
+
+  /** Add a touchpoint, or change the one with its key (only the fields given). A new one drafts unless told to
+   *  send; a template given without a version is pinned to its latest. */
+  async setTouchpoint(id: string, touchpoint: Touchpoint): Promise<Draft> {
+    const { draft } = await this.read<{ draft?: Draft }>(`/campaigns/${id}`);
+    const current = draft?.touchpoints ?? [];
+    const existing = current.find((t) => t.key === touchpoint.key);
+    const tp: Touchpoint = { ...(existing ?? { terminal_action: 'draft' }), ...given(touchpoint), key: touchpoint.key };
+    if (typeof touchpoint.template_id === 'string' && touchpoint.template_version_n === undefined) {
+      tp.template_version_n = Number((await this.latestTemplateVersion(touchpoint.template_id))?.version_n ?? 1);
+    }
+    const touchpoints = existing ? current.map((t) => (t.key === tp.key ? tp : t)) : [...current, tp];
+    return this.write('PUT', `/campaigns/${id}/draft`, { ...draft, touchpoints });
+  }
+
+  publish(id: string, changeSummary?: string): Promise<unknown> {
+    return this.write('POST', `/campaigns/${id}/publish`, { change_summary: changeSummary ?? '' });
+  }
+
+  setStatus(id: string, status: CampaignStatus): Promise<unknown> {
+    return this.write('POST', `/campaigns/${id}/status`, { status });
+  }
+
+  createTemplate(input: Record<string, unknown> & { uses_variables?: string[] }): Promise<unknown> {
+    return this.write('POST', '/templates', given({ ...input, uses_variables: declare(input.uses_variables) }));
+  }
+
+  private async latestTemplateVersion(id: string): Promise<Record<string, unknown> | undefined> {
+    return (await this.read<Envelope>(`/templates/${id}/versions`)).items?.[0];  // newest first
+  }
+
+  /** A new version of the template: its latest one with the changes given. */
+  async updateTemplate(id: string, changes: Record<string, unknown> & { uses_variables?: string[] }): Promise<unknown> {
+    const latest = (await this.latestTemplateVersion(id)) ?? {};
+    const kept = Object.fromEntries(TEMPLATE_CONTENT.filter((k) => k in latest).map((k) => [k, latest[k]]));
+    return this.write('POST', `/templates/${id}/versions`, { ...kept, ...given({ ...changes, uses_variables: declare(changes.uses_variables, latest.uses_variables as Variable[]) }) });
+  }
+
+  createTemplateSkill(input: { solution_id?: string; key: string; name: string; instructions: string }): Promise<unknown> {
+    return this.write('POST', '/template-skills', input);
+  }
+
+  async updateTemplateSkill(id: string, changes: { name?: string; instructions?: string }): Promise<unknown> {
+    const skill = await this.templateSkill(id);
+    return this.write('PUT', `/template-skills/${id}`, { name: skill.name, instructions: skill.instructions, ...given(changes) });
+  }
+
+  createBook(input: { solution_id: string; name: string; schema_id?: string; source?: unknown }): Promise<{ id: string }> {
+    return this.write('POST', '/books', given(input));
+  }
+
+  /** Change the parts of a book that are given, each its own call in the service. Keys are the book's schema
+   *  keys; identity keys change only while the book has no records. */
+  async updateBook(id: string, changes: { source?: unknown; field_map?: unknown[]; identity_keys?: string[]; display?: unknown }): Promise<unknown> {
+    if (changes.source !== undefined) await this.write('PATCH', `/books/${id}/source`, { source: changes.source });
+    if (changes.field_map !== undefined) await this.write('PUT', `/books/${id}/field-map`, { field_map: changes.field_map });
+    if (changes.identity_keys !== undefined) await this.write('PUT', `/books/${id}/identity-keys`, { identity_keys: changes.identity_keys });
+    if (changes.display !== undefined) await this.write('PUT', `/books/${id}/display`, { display: changes.display });
+    return this.book(id);
+  }
 }

package/src/sdk/orgs.ts

@@ -8,6 +8,18 @@ interface RawProjectUser {
   id_project?: { name?: string } | string | null;
 }
 
+/** The roles the dashboard's Invite user page offers. copilot saves any role it is sent, so never owner here. */
+export const INVITE_ROLES = ['admin', 'agent', 'member'] as const;
+export type InviteRole = (typeof INVITE_ROLES)[number];
+
+export interface InviteResult {
+  email: string;
+  role: InviteRole;
+  /** invited: no Indemn account yet, a sign-up email went out; added: an existing account joined now. The others changed nothing. */
+  outcome: 'invited' | 'added' | 'already_invited' | 'already_member';
+  message: string;
+}
+
 export interface SandboxOrg {
   organization_id: string;
   name: string;
@@ -59,6 +71,31 @@ export class OrgsSDK {
     return [...byUser.values()];
   }
 
+  /**
+   * Invite someone to the org's project, as the dashboard's Invite user page does (copilot allows owners and
+   * admins only). A new email gets a sign-up invitation; an existing Indemn account is added at once and told
+   * by email. Already invited or already a member: nothing is sent, and the result says so.
+   */
+  async inviteMember(projectId: string, email: string, role: InviteRole): Promise<InviteResult> {
+    const address = email.trim().toLowerCase();
+    const result = (outcome: InviteResult['outcome'], message: string): InviteResult => ({ email: address, role, outcome, message });
+    try {
+      const res = await this.client.copilotPost<{ pendingInvitation?: unknown }>(`/${projectId}/project_users/invite`, {
+        email: address, role, user_available: false, id_organization: await this.client.currentOrgId(),
+      });
+      return res?.pendingInvitation
+        ? result('invited', `Invitation sent to ${address}. They join as ${role} once they sign up from the email.`)
+        : result('added', `${address} already had an Indemn account and is now in the organization as ${role}. They were told by email.`);
+    } catch (err) {
+      // copilot answers these with 200 {success:false} and 500/403 with a code; the dashboard shows them as messages.
+      const message = err instanceof Error ? err.message : String(err);
+      if (/Pending Invitation already exist/i.test(message)) return result('already_invited', `${address} already has a pending invitation. Nothing was sent again.`);
+      if (/already a member/i.test(message)) return result('already_member', `${address} is already a member of the organization. Nothing was changed.`);
+      if (/invite oneself/i.test(message)) throw new Error('You can\'t invite yourself. Nothing was sent.');
+      throw err;
+    }
+  }
+
   /**
    * A sandbox organization for a prospect. Only the Indemn support account may create one (copilot
    * refuses anyone else), and copilot always puts it on the sandbox plan set for the platform.

package/test/mcp/__snapshots__/tools-snapshot.test.ts.snap

@@ -68,6 +68,7 @@ exports[`MCP tool list > gives every tool a title and annotations 1`] = `
   "import_agent",
   "import_functions",
   "import_kb",
+  "invite_org_member",
   "jarvis_chat",
   "jarvis_create_job",
   "jarvis_jobs",
@@ -111,10 +112,15 @@ exports[`MCP tool list > gives every tool a title and annotations 1`] = `
   "platform_list",
   "platform_save",
   "promote_prod_call",
+  "publish_campaign",
   "reimport_kb_source",
   "remove_holiday",
   "run_evaluation",
   "run_simulation",
+  "save_book",
+  "save_campaign",
+  "save_campaign_template",
+  "save_template_skill",
   "save_ticket_rule",
   "scrape_url",
   "search_phone_numbers",
@@ -122,10 +128,12 @@ exports[`MCP tool list > gives every tool a title and annotations 1`] = `
   "set_agent_transcriber",
   "set_agent_voice",
   "set_business_hours",
+  "set_campaign_status",
   "set_config",
   "set_org_admin_settings",
   "set_org_timezone",
   "set_prompt",
+  "set_touchpoint",
   "simulation_status",
   "test_function",
   "transfer_agent_owner",

package/test/mcp/access.test.ts

@@ -127,6 +127,24 @@ describe('role-aware MCP tools', () => {
     await pair.close();
   });
 
+  it('invites only where the person is an owner or admin, into that project, after approval', async () => {
+    const { calls } = recordFetch([
+      on('GET', '/auth/me/access', { json: accessWith() }),
+      on('POST', '/project_users/invite', { json: { pendingInvitation: { _id: 'i1' } } }),
+    ]);
+    const pair = await connectPair(setup, { elicit: () => ({ action: 'accept', content: { confirm: true } }) });
+    const refused = await pair.call('invite_org_member', { org_id: B, email: 'jane@acme.test', role: 'agent' });
+    expect(refused.isError).toBe(true);
+    expect(refused.body).toContain('Only owners and admins can invite people, and your role in QA B is guest.');
+    expect(pair.questions).toHaveLength(0);
+    const sent = await pair.call('invite_org_member', { org_id: A, email: 'jane@acme.test', role: 'agent' });
+    expect(sent.body.data).toMatchObject({ outcome: 'invited', email: 'jane@acme.test' });
+    expect(pair.questions[0].message).toContain('This will invite jane@acme.test to the organization as Agent.');
+    const invites = calls.filter((c) => c.url.includes('/project_users/invite'));
+    expect(invites.map((c) => new URL(c.url).pathname)).toEqual(['/api/p1/project_users/invite']);
+    await pair.close();
+  });
+
   it('tells the host when the visible tools change', async () => {
     vi.stubEnv('INDEMN_ORG_ID', B);
     recordFetch([on('GET', '/auth/me/access', { json: accessWith(true) })]);