npm - @sendinel/mcp-server - Versions diffs - 1.0.106 → 1.0.108 - Mend

@sendinel/mcp-server 1.0.106 → 1.0.108

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (11) hide show

package/build/approval-app-html.d.ts +2 -0
package/build/approval-app-html.js +124 -0
package/build/lib/action-approvals.js +3 -0
package/build/lib/approval-app-conventions.d.ts +25 -0
package/build/lib/approval-app-conventions.js +24 -0
package/build/lib/approval-app.d.ts +43 -0
package/build/lib/approval-app.js +161 -0
package/build/lib/approval-elicitation.js +4 -2
package/build/server.js +2 -0
package/build/tools/campaigns.js +27 -6
package/package.json +1 -1

package/build/approval-app-html.d.ts ADDED Viewed

	@@ -0,0 +1,2 @@
1	+ /** Single-file, network-free Apps UI; email images load only inside scriptless srcdoc. */
2	+ export declare const APPROVAL_APP_HTML: string;

package/build/approval-app-html.js ADDED Viewed

@@ -0,0 +1,124 @@
+/** Single-file, network-free Apps UI; email images load only inside scriptless srcdoc. */
+export const APPROVAL_APP_HTML = String.raw `<!doctype html>
+<html lang="en"><head><meta charset="utf-8">
+<meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src 'nonce-__NONCE__'; style-src 'unsafe-inline'; img-src https: data:; frame-src 'self'; connect-src 'none'; object-src 'none'; base-uri 'none'; form-action 'none'">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Review email approval</title>
+<style>body{font:15px system-ui,sans-serif;margin:16px;color:#17212b;background:white}pre{white-space:pre-wrap;overflow-wrap:anywhere}section{margin:20px 0}dt{font-weight:650}dd{margin:0 0 10px;white-space:pre-wrap;overflow-wrap:anywhere}.devices{display:flex;gap:16px;overflow:auto}iframe{height:480px;border:1px solid #ccd3db;background:white;flex:none}button{padding:12px 24px;margin:8px 8px 8px 0;border:1px solid #667;border-radius:6px;background:white;color:#17212b}#approve{background:#0c857a;color:white}button:disabled{opacity:.5}#status{white-space:pre-wrap}</style>
+</head><body><h1>Review email</h1><p id="status" role="status">Connecting to approval host…</p>
+<main id="preview"></main><button id="approve" disabled>Approve</button><button id="reject" disabled>Reject</button>
+<script id="approval-data" type="application/json" nonce="__NONCE__">__APP_DATA__</script>
+<script nonce="__NONCE__">
+(() => {
+  'use strict';
+  let data = JSON.parse(document.getElementById('approval-data').textContent);
+  let ready = false, started = false, serial = 0;
+  const pending = new Map();
+  const status = document.getElementById('status');
+  const buttons = [document.getElementById('approve'), document.getElementById('reject')];
+  const notify = (method, params) => parent.postMessage({jsonrpc:'2.0',method,params}, '*');
+  function request(method, params) {
+    return new Promise((resolve, reject) => {
+      const id = ++serial;
+      const timeout = setTimeout(() => { pending.delete(id); reject(new Error('Host did not respond; open the dashboard approval link.')); }, 15000);
+      pending.set(id, {resolve, reject, timeout});
+      parent.postMessage({jsonrpc:'2.0',id,method,params}, '*');
+    });
+  }
+  function text(tag, value, target) {
+    const node = document.createElement(tag); node.textContent = String(value ?? 'unknown'); target.append(node); return node;
+  }
+  function safeEmail(html) {
+    // Parse inertly, then allow only email layout/formatting. No active elements,
+    // forms, navigation, event handlers, SVG/MathML, external CSS or arbitrary URLs.
+    const template = document.createElement('template'); template.innerHTML = html;
+    const tags = new Set('HTML HEAD BODY TITLE STYLE A B BLOCKQUOTE BR CENTER DIV EM FONT H1 H2 H3 H4 H5 H6 HR IMG LI OL P SMALL SPAN STRONG SUB SUP TABLE TBODY TD TFOOT TH THEAD TR U UL'.split(' '));
+    const attrs = new Set('style class id title alt width height align valign bgcolor border cellpadding cellspacing colspan rowspan role color face size'.split(' '));
+    for (const el of [...template.content.querySelectorAll('*')]) {
+      if (!tags.has(el.tagName) || el.namespaceURI !== 'http://www.w3.org/1999/xhtml') { el.remove(); continue; }
+      for (const attr of [...el.attributes]) {
+        if (el.tagName === 'IMG' && attr.name === 'src' && (/^https:\/\//i.test(attr.value) || /^data:image\/(png|gif|jpeg|webp);base64,/i.test(attr.value))) continue;
+        if (!attrs.has(attr.name)) el.removeAttribute(attr.name);
+      }
+    }
+    // CSP precedes every email element. The empty sandbox independently forbids
+    // scripts, same-origin access, top navigation, forms, popups and downloads.
+    const csp = document.createElement('meta'); csp.httpEquiv = 'Content-Security-Policy';
+    csp.content = "default-src 'none'; script-src 'none'; style-src 'unsafe-inline'; img-src https: data:; connect-src 'none'; frame-src 'none'; object-src 'none'; base-uri 'none'; form-action 'none'";
+    return '<!doctype html><html><head>' + csp.outerHTML + '</head><body>' + template.innerHTML + '</body></html>';
+  }
+  function render() {
+    const root = document.getElementById('preview'); root.replaceChildren();
+    if (!data.preview) return;
+    const p = data.preview;
+    text('pre', p.plain_summary, root);
+    const dl = document.createElement('dl'); root.append(dl);
+    for (const [label,value] of [['From',p.sender],['Subject',p.subject],['Preheader',p.preheader || '(none)'],['Recipients',p.recipient_count == null ? 'unknown' : p.recipient_count],['Footer',p.footer_text || 'unknown']]) {
+      text('dt',label,dl); text('dd',value,dl);
+    }
+    for (const change of data.diff || []) {
+      const section = document.createElement('section'); root.append(section);
+      text('h2',change.field + ' — before → after',section);
+      text('pre',change.before + '\n→\n' + change.after,section);
+    }
+    for (const group of p.groups) {
+      text('h2',group.title,root); if (group.trigger) text('p',group.trigger,root);
+      for (const email of group.emails) {
+        const section = document.createElement('section'); root.append(section);
+        text('h3',email.label + ': ' + email.subject,section);
+        text('p','From: ' + email.from + '\nPreheader: ' + (email.preheader || '(none)'),section);
+        if (email.delay) text('p',email.delay,section);
+        const devices = document.createElement('div'); devices.className = 'devices'; section.append(devices);
+        for (const width of [600,375]) {
+          const device = document.createElement('div'); devices.append(device); text('p',width + 'px',device);
+          const frame = document.createElement('iframe'); frame.setAttribute('sandbox',''); frame.setAttribute('referrerpolicy','no-referrer');
+          frame.title = email.label + ' ' + width + 'px'; frame.width = String(width); frame.srcdoc = safeEmail(email.html || '<pre>' + email.text.replace(/&/g,'&amp;').replace(/</g,'&lt;') + '</pre>'); device.append(frame);
+        }
+      }
+    }
+    text('p','Template content shown; recipient merge fields resolve when sending. Expires: ' + data.expires_at,root);
+    text('p','Payload SHA-256: ' + data.payload_hash,root);
+    buttons.forEach(b => b.disabled = !ready || !data.app_session || started);
+  }
+  async function loadApproval(uri) {
+    const result = await request('resources/read',{uri});
+    const resource = new DOMParser().parseFromString(result.contents[0].text,'text/html');
+    const loaded = JSON.parse(resource.getElementById('approval-data').textContent);
+    // Host-only resource metadata, omitted from model-readable resource text.
+    loaded.app_session = result.contents[0]._meta?.[data.sessionMetaKey];
+    data = loaded; render(); status.textContent = data.app_session ? 'Review the email, then choose Approve or Reject.' : 'Use the dashboard approval link.';
+  }
+  window.addEventListener('message', async event => {
+    // Email frames are untrusted: even synthetic JSON-RPC from a child is ignored.
+    if (event.source !== parent || !event.data || event.data.jsonrpc !== '2.0') return;
+    const message = event.data, entry = pending.get(message.id);
+    if (entry) {
+      clearTimeout(entry.timeout); pending.delete(message.id);
+      if (message.error) entry.reject(new Error('Host refused the request.')); else entry.resolve(message.result);
+    } else if (message.method === 'ui/notifications/tool-result' && !data.preview) {
+      const uri = message.params?._meta?.ui?.resourceUri;
+      if (typeof uri !== 'string' || !/^ui:\/\/sendinel\/approval\/[a-zA-Z0-9-]+$/.test(uri)) return;
+      try {
+        await loadApproval(uri);
+      } catch (error) { status.textContent = error.message; }
+    }
+  });
+  buttons.forEach(button => button.addEventListener('click', async event => {
+    if (!event.isTrusted || !ready || !data.app_session || started) return;
+    started = true; buttons.forEach(b => b.disabled = true); status.textContent = 'Recording decision…';
+    try {
+      const result = await request('tools/call',{name:data.tool,arguments:{approval_id:data.approval_id,decision:button.id === 'approve' ? 'approve':'reject',app_session:data.app_session}});
+      data.app_session = undefined;
+      status.textContent = result.isError ? 'Decision refused. Open the dashboard approval link.' : 'Decision recorded. The next action call with approval_id can apply an approved payload.';
+    } catch (error) { data.app_session = undefined; status.textContent = error.message; }
+  }));
+  render();
+  request('ui/initialize',{appInfo:{name:'Sendinel approval',version:'1.0.0'},appCapabilities:{},protocolVersion:data.protocolVersion})
+    .then(async result => {
+      if (result.protocolVersion !== data.protocolVersion) throw new Error('Unsupported Apps protocol; open the dashboard approval link.');
+      ready = true; notify('ui/notifications/initialized',{}); render();
+      if (data.approval_id && !data.app_session) await loadApproval('ui://sendinel/approval/' + encodeURIComponent(data.approval_id));
+      status.textContent = data.preview ? (data.app_session ? 'Review the email, then choose Approve or Reject.' : 'Use the dashboard approval link.') : 'Waiting for approval preview…';
+    }).catch(error => { status.textContent = error.message; });
+})();
+</script></body></html>`;

package/build/lib/action-approvals.js CHANGED Viewed

@@ -4,6 +4,7 @@ import { db, requestContext } from '../db.js';
 import { getProjectId } from '../project.js';
 import { captureApprovalSnapshot, withoutApprovalSnapshot } from './approval-snapshot.js';
 import { fireWebhookEvent } from './webhook-events.js';
+import { offerApprovalApp } from './approval-app.js';
 import { elicitApproval } from './approval-elicitation.js';
 /**
  * Action approval tiers:
@@ -365,6 +366,8 @@ export async function requestApproval(action, params, apiKeyId, channelContext,
     }, getProjectId()).catch(() => { });
     return elicitApproval({
         requires_approval: true,
+        ...offerApprovalApp({ id: data.id, action, params: frozenParams, summary, tier, expires_at: expiresAt,
+            payload_hash: approvalPayloadHash(action, frozenParams) }),
         approval_id: data.id,
         tier,
         action,

package/build/lib/approval-app-conventions.d.ts ADDED Viewed

@@ -0,0 +1,25 @@
+export declare const APPROVAL_APP: {
+    readonly mimeType: "text/html;profile=mcp-app";
+    readonly uri: 'ui://sendinel/approval';
+    readonly template: 'ui://sendinel/approval/{approval_id}';
+    readonly protocolVersion: '2026-01-26';
+    readonly tool: 'approval_app_decide';
+    readonly resultUriKey: 'resourceUri';
+    readonly csp: {
+        readonly connectDomains: readonly [];
+        readonly resourceDomains: readonly ['https:'];
+        readonly frameDomains: readonly ["'self'"];
+    };
+};
+export declare const approvalAppResourceMeta: {
+    ui: {
+        csp: {
+            readonly connectDomains: readonly [];
+            readonly resourceDomains: readonly ['https:'];
+            readonly frameDomains: readonly ["'self'"];
+        };
+        permissions: {};
+        prefersBorder: boolean;
+    };
+};
+export declare const APPROVAL_APP_SESSION_META = "sendinel/app_session";

package/build/lib/approval-app-conventions.js ADDED Viewed

@@ -0,0 +1,24 @@
+import { MCP_APP_MIME_TYPE } from './approval-capabilities.js';
+// Confirmed against ext-apps specification/2026-01-26/apps.mdx and src/spec.types.ts.
+// SDK 1.32 carries _meta through, but visibility filtering is the Apps HOST's duty.
+export const APPROVAL_APP = {
+    mimeType: MCP_APP_MIME_TYPE,
+    uri: 'ui://sendinel/approval',
+    template: 'ui://sendinel/approval/{approval_id}',
+    protocolVersion: '2026-01-26',
+    tool: 'approval_app_decide',
+    // UNCONFIRMED: dynamic resourceUri in a TOOL RESULT is requested by #4280;
+    // the stable spec defines it on tool definitions. The static definition URI
+    // also works: its app reads the dynamic resource using the tool-result metadata.
+    resultUriKey: 'resourceUri',
+    // UNCONFIRMED: host acceptance of scheme sources / srcdoc in these domain lists.
+    // Needed for real-email HTTPS images in nested srcdoc, without external scripts,
+    // CSS or outer-app fetch. Hosts may further restrict; live runbook must check.
+    csp: { connectDomains: [], resourceDomains: ['https:'], frameDomains: ["'self'"] },
+};
+export const approvalAppResourceMeta = { ui: { csp: APPROVAL_APP.csp, permissions: {}, prefersBorder: true } };
+// Custom, host/app-only metadata. Hosts must keep this OUT of model context,
+// including when the model reads a resource. UNCONFIRMED per client until live
+// runbook verifies resource metadata isolation (tool metadata isolation alone
+// is insufficient). Never embed this value in resource text.
+export const APPROVAL_APP_SESSION_META = 'sendinel/app_session';

package/build/lib/approval-app.d.ts ADDED Viewed

@@ -0,0 +1,43 @@
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export type AppApproval = {
+    id: string;
+    action: string;
+    params: Record<string, any>;
+    summary?: string;
+    tier: string;
+    expires_at: string;
+    payload_hash: string;
+};
+/** Only frozen facts enter this view. No live reads or model-supplied display overrides. */
+export declare function approvalAppView(approval: AppApproval): {
+    approval_id: string;
+    preview: import("@sendinel/domain").ApprovalPreviewModel;
+    diff: {
+        field: string;
+        before: string;
+        after: string;
+    }[];
+    payload_hash: string;
+    expires_at: string;
+};
+/** A TypeScript string bundles the single HTML file into build/ without a copy step. */
+export declare function renderApprovalApp(approval?: AppApproval): string;
+export declare function registerApprovalAppResources(server: McpServer, read: (id: string) => Promise<{
+    html: string;
+    appSession: string;
+}>): void;
+/** Called only after the core has persisted its frozen payload. Tokens never enter tool results. */
+export declare function offerApprovalApp(approval: AppApproval): {
+    _meta?: {
+        ui: {
+            resourceUri: string;
+        };
+    };
+};
+/** Transport boundary, outside the model catalog and gateway catalog. Apps hosts MUST
+ * honor visibility. Even a raw model tools/call cannot decide without the resource-only token.
+ * The SDK Server instance is the connection boundary; no cross-request/global token cache.
+ */
+export declare function installApprovalApp(server: McpServer, options?: {
+    scopes?: string[];
+}, approvalTool?: (name: string) => boolean): McpServer;

package/build/lib/approval-app.js ADDED Viewed

@@ -0,0 +1,161 @@
+import { randomBytes } from 'node:crypto';
+import { buildApprovalPreview } from '@sendinel/domain';
+import { APPROVAL_APP, APPROVAL_APP_SESSION_META } from './approval-app-conventions.js';
+import { APPROVAL_APP_HTML } from '../approval-app-html.js';
+import { ResourceTemplate } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { approvalAppResourceMeta } from './approval-app-conventions.js';
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { z } from 'zod';
+import { requestContext } from '../db.js';
+import { getProjectId } from '../project.js';
+import { approval_channel_available } from './approval-capabilities.js';
+import { createHumanApprovalCallback } from './approval-human-callback.js';
+/** Only frozen facts enter this view. No live reads or model-supplied display overrides. */
+export function approvalAppView(approval) {
+    const preview = buildApprovalPreview(approval);
+    const p = approval.params;
+    const snapshot = p.__approval_snapshot ?? {};
+    const before = p.previous_campaign ?? p.previous_site ?? snapshot.campaigns?.[0] ?? snapshot.sites?.[0] ?? {};
+    const after = p.updates ?? p.payload ?? p;
+    const fields = ['trigger_event_name', 'trigger_tag', 'trigger_type', 'trigger_config', 'send_class',
+        'physical_address', 'unsub_link_enabled', 'unsub_footer_template'];
+    const diff = fields.filter(key => Object.hasOwn(after, key) && JSON.stringify(before[key]) !== JSON.stringify(after[key]))
+        .map(key => ({ field: key, before: before[key] === undefined ? 'unknown' : JSON.stringify(before[key]),
+        after: JSON.stringify(after[key]) }));
+    return { approval_id: approval.id, preview, diff, payload_hash: approval.payload_hash, expires_at: approval.expires_at };
+}
+/** A TypeScript string bundles the single HTML file into build/ without a copy step. */
+export function renderApprovalApp(approval) {
+    const nonce = randomBytes(24).toString('base64');
+    const data = { ...(approval ? approvalAppView(approval) : {}), sessionMetaKey: APPROVAL_APP_SESSION_META,
+        tool: APPROVAL_APP.tool, protocolVersion: APPROVAL_APP.protocolVersion };
+    // Never interpolate untrusted text as markup, even into an application/json script.
+    const json = JSON.stringify(data).replace(/</g, '\\u003c').replace(/>/g, '\\u003e').replace(/&/g, '\\u0026');
+    return APPROVAL_APP_HTML.replaceAll('__NONCE__', nonce).replace('__APP_DATA__', () => json);
+}
+export function registerApprovalAppResources(server, read) {
+    const config = { mimeType: APPROVAL_APP.mimeType, _meta: approvalAppResourceMeta };
+    const result = (uri, text, appSession) => ({ contents: [{ uri: uri.href,
+                mimeType: APPROVAL_APP.mimeType, text, _meta: { ...approvalAppResourceMeta,
+                    ...(appSession ? { [APPROVAL_APP_SESSION_META]: appSession } : {}) } }] });
+    server.registerResource('approval-app', APPROVAL_APP.uri, config, async (uri) => result(uri, renderApprovalApp()));
+    server.registerResource('approval-preview', new ResourceTemplate(APPROVAL_APP.template, { list: undefined }), config, async (uri, variables) => { const view = await read(String(variables.approval_id)); return result(uri, view.html, view.appSession); });
+}
+const runtimes = new WeakMap();
+const calls = new AsyncLocalStorage();
+const resourceUri = (id) => `${APPROVAL_APP.uri}/${encodeURIComponent(id)}`;
+function identity() {
+    const context = requestContext();
+    // Do not attribute an API key owner, agent or tester's click to a human.
+    return context?.channelVerified === true && context.actorId && context.authKind !== 'scoped_jwt'
+        ? { userId: context.actorId, projectId: getProjectId() } : null;
+}
+function matches(offer) {
+    const actor = identity();
+    return !!actor && actor.projectId === offer.projectId && actor.userId === offer.userId;
+}
+function live(approval) {
+    return Number.isFinite(Date.parse(approval.expires_at)) && Date.parse(approval.expires_at) > Date.now();
+}
+function prune(runtime) {
+    for (const [id, offer] of runtime.offers)
+        if (!live(offer.approval))
+            runtime.offers.delete(id);
+    for (const [token, session] of runtime.sessions)
+        if (!live(session.offer.approval))
+            runtime.sessions.delete(token);
+}
+/** Called only after the core has persisted its frozen payload. Tokens never enter tool results. */
+export function offerApprovalApp(approval) {
+    const runtime = calls.getStore(), actor = identity();
+    if (!runtime || !runtime.canDecide || !actor || approval.tier === 'protected' ||
+        approval_channel_available(runtime.server.server) !== 'mcp_app')
+        return {};
+    prune(runtime);
+    if (runtime.offers.size >= 128 || !live(approval))
+        return {};
+    runtime.offers.set(approval.id, { approval: structuredClone(approval), ...actor });
+    return { _meta: { ui: { [APPROVAL_APP.resultUriKey]: resourceUri(approval.id) } } };
+}
+/** Transport boundary, outside the model catalog and gateway catalog. Apps hosts MUST
+ * honor visibility. Even a raw model tools/call cannot decide without the resource-only token.
+ * The SDK Server instance is the connection boundary; no cross-request/global token cache.
+ */
+export function installApprovalApp(server, options = {}, approvalTool = () => false) {
+    // Catalog collectors have no transport/resource API; never expose this tool through them.
+    if (!server.server || typeof server.registerResource !== 'function')
+        return server;
+    let runtime = runtimes.get(server.server);
+    if (!runtime) {
+        runtime = { server, connectionId: randomBytes(32).toString('hex'), offers: new Map(), sessions: new Map(),
+            canDecide: !options.scopes?.some(scope => scope === 'tester' || scope === 'agent') };
+        runtimes.set(server.server, runtime);
+        const bound = runtime;
+        registerApprovalAppResources(server, async (id) => {
+            prune(bound);
+            const offer = bound.offers.get(id);
+            if (!offer || !matches(offer) || approval_channel_available(server.server) !== 'mcp_app')
+                throw new Error('Approval app unavailable on this connection; use approve_url.');
+            // One outstanding render session per approval. Re-render invalidates the old view.
+            for (const [token, session] of bound.sessions)
+                if (session.offer === offer)
+                    bound.sessions.delete(token);
+            const callback = createHumanApprovalCallback({ approvalId: id, projectId: offer.projectId,
+                userId: offer.userId, connectionId: bound.connectionId, channel: 'mcp_app' });
+            const token = randomBytes(32).toString('base64url');
+            bound.sessions.set(token, { offer, callback });
+            // Resource text can be shown to the model; the bearer belongs exclusively
+            // in host/app metadata, never HTML, a tool result, a URL or an audit entry.
+            return { html: renderApprovalApp(offer.approval), appSession: token };
+        });
+        const registerDecide = () => server.registerTool(APPROVAL_APP.tool, {
+            description: 'Record the human decision from this connection’s rendered approval app.',
+            _meta: { ui: { visibility: ['app'] } },
+            annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
+            inputSchema: z.object({ approval_id: z.string(), decision: z.enum(['approve', 'reject']), app_session: z.string().min(1) }).strict(),
+        }, async ({ approval_id, decision, app_session }) => {
+            prune(bound);
+            const session = bound.sessions.get(app_session);
+            const refused = () => ({ isError: true, content: [{ type: 'text', text: 'Decision refused; use the dashboard approval link.' }] });
+            if (!bound.canDecide || !session || session.offer.approval.id !== approval_id || !matches(session.offer) ||
+                !live(session.offer.approval) || approval_channel_available(server.server) !== 'mcp_app')
+                return refused();
+            // Claim before awaiting the callback, so concurrent clicks cannot reuse a session.
+            bound.sessions.delete(app_session);
+            bound.offers.delete(approval_id);
+            const accepted = await session.callback.complete({ interactionId: session.callback.interactionId,
+                connectionId: bound.connectionId, decision });
+            return accepted ? { content: [{ type: 'text', text: 'Decision recorded.' }] } : refused();
+        });
+        const previousInitialized = server.server.oninitialized;
+        server.server.oninitialized = () => {
+            previousInitialized?.();
+            if (bound.canDecide && approval_channel_available(server.server) === 'mcp_app')
+                registerDecide();
+        };
+        const previousClose = server.server.onclose;
+        server.server.onclose = () => { bound.offers.clear(); bound.sessions.clear(); previousClose?.(); };
+    }
+    const bound = runtime;
+    return new Proxy(server, { get(target, prop, receiver) {
+            if (prop !== 'registerTool')
+                return Reflect.get(target, prop, receiver);
+            return (name, config, handler) => target.registerTool(name, approvalTool(name) || name === 'invoke_tool' ? { ...config, _meta: { ...config._meta, ui: { resourceUri: APPROVAL_APP.uri } } } : config, async (...args) => calls.run(calls.getStore() ?? bound, async () => {
+                const result = await handler(...args);
+                // Existing tools serialize ApprovalResult into content; promote ONLY its UI
+                // reference to MCP result metadata. The resource token is never in that object.
+                for (const content of result?.content ?? []) {
+                    if (content.type !== 'text')
+                        continue;
+                    try {
+                        const value = JSON.parse(content.text);
+                        if (value.requires_approval === true && value._meta?.ui?.resourceUri) {
+                            return { ...result, _meta: { ...result._meta, ui: value._meta.ui } };
+                        }
+                    }
+                    catch { /* Non-JSON text fallback. */ }
+                }
+                return result;
+            }));
+        } });
+}

package/build/lib/approval-elicitation.js CHANGED Viewed

@@ -3,15 +3,17 @@ import { randomUUID } from 'node:crypto';
 import { buildApprovalPreview, isHumanApprovalChannel } from '@sendinel/domain';
 import { db } from '../db.js';
 import { approval_channel_available, probeApprovalCapabilities } from './approval-capabilities.js';
+// Keyed by the SDK Server, not the McpServer wrapper: other installers (the Apps tier) wrap
+// McpServer in a Proxy, which changes the wrapper's identity but never the connection's Server.
 const sessions = new WeakMap();
 const requests = new AsyncLocalStorage();
 const TIMEOUT_MS = 60_000;
 export function installApprovalElicitation(server, binding) {
-    sessions.set(server, { ...binding, connectionId: randomUUID() });
+    sessions.set(server.server, { ...binding, connectionId: randomUUID() });
 }
 /** Called by the registry wrapper with SDK-owned extra, outside parsed model arguments. */
 export function runWithApprovalElicitation(server, extra, run) {
-    const binding = sessions.get(server);
+    const binding = sessions.get(server.server);
     // Nested gateway dispatch retains the originating connection/request. The hosted bridge
     // has no binding and cannot impersonate its outer HTTP client's capabilities.
     if (!binding || requests.getStore())

package/build/server.js CHANGED Viewed

@@ -1,4 +1,5 @@
 import { installApprovalCapabilityProbe } from './lib/approval-capabilities.js';
+import { installApprovalApp } from './lib/approval-app.js';
 import { runWithApprovalElicitation } from './lib/approval-elicitation.js';
 import { runWithToolContext } from './db.js';
 import { isApprovalGatedAction } from './lib/action-approvals.js';
@@ -381,6 +382,7 @@ export const SENDINEL_SERVER_INSTRUCTIONS = [
 export function registerAllTools(server, options) {
     if (server.server)
         installApprovalCapabilityProbe(server.server);
+    server = installApprovalApp(server, options, isApprovalGatedAction);
     const rawScopes = options?.scopes ?? [];
     if (rawScopes.includes('gateway')) {
         const permissionScopes = rawScopes.filter((scope) => scope !== 'gateway');

package/build/tools/campaigns.js CHANGED Viewed

@@ -2,7 +2,7 @@ import { readCampaignPeriods, campaignPeriodFields } from "@sendinel/domain";
 import { CAMPAIGN_BRANCH_CONDITIONS, campaignBranchConditionValue, isContactPropertyConditionList, STEP_PROPERTY_CONDITIONS_ERROR, validateStepPropertyRules } from "@sendinel/domain";
 import { z } from 'zod';
 import Anthropic from '@anthropic-ai/sdk';
-import { assertSendAccepted, providerSendError, sendError, SendRefusedError, BLOCKING_CONTENT_ISSUE_KINDS, computeSendContentKey, findContentIssues, sendingHostOf, NAME_FALLBACKS, ONE_SEND_MATCH_STATUSES, ONE_SEND_SENT_STATUSES, ONE_SEND_WINDOW_DAYS, normalizeTriggerConfig, renderTemplateString as renderTemplateVars, resolveBrandTokens, brandWarnings, readAllRows, isSegmentRulesError, scopeSegmentRulesToSite, SegmentRulesError, validateSegmentRules, } from '@sendinel/domain';
+import { assertSendAccepted, providerSendError, sendError, SendRefusedError, BLOCKING_CONTENT_ISSUE_KINDS, computeSendContentKey, findContentIssues, sendingHostOf, NAME_FALLBACKS, ONE_SEND_MATCH_STATUSES, ONE_SEND_SENT_STATUSES, ONE_SEND_WINDOW_DAYS, normalizeTriggerConfig, renderTemplateString as renderTemplateVars, resolveBrandTokens, brandWarnings, readAllRows, isSegmentRulesError, scopeSegmentRulesToSite, SegmentRulesError, validateSegmentRules, validateUnsubFooterTemplate, } from '@sendinel/domain';
 // Subpath import, not the barrel above -- reply-actions.ts uses node:crypto,
 // and MCP-server-side that's fine (this never runs in an Edge Function), but
 // keeping it off the shared barrel avoids re-creating the Edge-Function
@@ -652,7 +652,7 @@ export function registerCampaignTools(server) {
     }, async ({ site_id, status, limit, period }) => {
         let q = db()
             .from('campaigns')
-            .select('id, site_id, name, type, status, sends_per_hour, total_enrolled, total_sent, total_opened, total_clicked, created_at, period_key, segment_id, trigger_type, trigger_event_name, trigger_tag, trigger_config')
+            .select('id, site_id, name, type, status, sends_per_hour, total_enrolled, total_sent, total_opened, total_clicked, created_at, period_key, segment_id, trigger_type, trigger_event_name, trigger_tag, trigger_config, send_class, unsub_footer_template')
             .eq('project_id', getProjectId())
             .order('created_at', { ascending: false })
             .limit(limit ?? 25);
@@ -2966,6 +2966,8 @@ Return ONLY valid JSON with this exact shape:
             site_id: z.string().uuid().describe('Site to send from'),
             name: z.string().min(1).max(200).describe('Campaign name'),
             type: z.enum(['sequence', 'broadcast', 'triggered']).describe('Campaign type'),
+            send_class: z.enum(['broadcast', 'product']).optional().describe("Consent class: broadcast (marketing, default) or product (account, onboarding, trial and billing mail)."),
+            unsub_footer_template: z.string().nullable().optional().describe('Campaign unsubscribe footer override. Must contain <unsubscribe>link text</unsubscribe>. Null uses the site footer.'),
             trigger_event_name: z.string().nullable().optional(),
             trigger_tag: z.string().nullable().optional(),
             trigger_type: z.enum(['manual', 'date_field', 'contact_event']).nullable().optional(),
@@ -2984,7 +2986,14 @@ Return ONLY valid JSON with this exact shape:
             confirmed: z.boolean().optional().default(false).describe('Two-call confirmation. First call previews, second call with confirmed=true executes.'),
             approval_id: z.string().uuid().optional().describe('Approval token from a previous call. Required when activate=true — get this by calling once without it, then have a human approve via the dashboard.'),
         },
-    }, async ({ site_id, name, type, steps, segment_id, sends_per_hour, activate, confirmed, approval_id, trigger_event_name, trigger_tag, trigger_type, trigger_config }) => {
+    }, async ({ site_id, name, type, steps, segment_id, sends_per_hour, activate, confirmed, approval_id, trigger_event_name, trigger_tag, trigger_type, trigger_config, send_class, unsub_footer_template }) => {
+        const footerTemplate = unsub_footer_template?.trim() ?? null;
+        if (footerTemplate !== null) {
+            const footerError = validateUnsubFooterTemplate(footerTemplate);
+            if (footerError)
+                return j({ error: footerError, code: 'INVALID_FIELD' });
+        }
+        const sendClass = send_class ?? 'broadcast';
         const targeting = {};
         const triggerInput = { trigger_event_name, trigger_tag, trigger_type, trigger_config };
         const targetingError = await applyCampaignTargetingFields(targeting, triggerInput, getProjectId());
@@ -2996,7 +3005,7 @@ Return ONLY valid JSON with this exact shape:
         const canActivateOnTrigger = campaignType === 'triggered' && (hasEventOrTag || targeting.trigger_type === 'date_field' || targeting.trigger_type === 'contact_event');
         // Human-in-the-loop gate for activation
         if (activate && confirmed) {
-            const approvalParams = { site_id, name, type, steps, segment_id, sends_per_hour, activate, ...triggerInput };
+            const approvalParams = { site_id, name, type, steps, segment_id, sends_per_hour, activate, send_class, unsub_footer_template, ...triggerInput };
             const channelContext = currentChannelContext();
             const decision = assertChannelCanExecute('create_campaign_with_content', { activate }, channelContext);
             if (!decision.allowed)
@@ -3042,7 +3051,7 @@ Return ONLY valid JSON with this exact shape:
         if (!confirmed) {
             return j({
                 confirmation_required: true,
-                campaign: { name, type: campaignType, site: site.name, ...targeting },
+                campaign: { name, type: campaignType, site: site.name, send_class: sendClass, unsub_footer_template: footerTemplate, ...targeting },
                 steps: steps.map((s, i) => ({
                     step: i + 1,
                     subject: s.subject,
@@ -3066,6 +3075,8 @@ Return ONLY valid JSON with this exact shape:
             site_id,
             name,
             type: campaignType,
+            send_class: sendClass,
+            unsub_footer_template: footerTemplate,
             ...targeting,
             status: 'draft',
             segment_id: segment_id ?? null,
@@ -3150,6 +3161,8 @@ Return ONLY valid JSON with this exact shape:
             campaign_id: campaign.id,
             name,
             type: campaignType,
+            send_class: campaign.send_class,
+            unsub_footer_template: campaign.unsub_footer_template,
             ...targeting,
             fires_on: buildCampaignFiresOn({ ...campaign, status: willActivate ? 'active' : 'draft' }),
             trigger_diagnostics: buildCampaignTriggerDiagnostics({ ...campaign, status: willActivate ? 'active' : 'draft' }),
@@ -3415,6 +3428,7 @@ Return ONLY valid JSON with this exact shape:
             type: z.enum(['sequence', 'triggered']).optional().describe("Switch a DRAFT campaign between 'sequence' and 'triggered'. Event and tag triggers only start campaigns of type 'triggered'."),
             sends_per_hour: z.number().int().min(1).nullable().optional().describe('Optional hourly send cap for wave sending. Set null to clear.'),
             send_in_contact_timezone: z.boolean().optional(),
+            unsub_footer_template: z.string().nullable().optional().describe('Campaign unsubscribe footer override. Must contain <unsubscribe>link text</unsubscribe>. Set null to use the site footer.'),
             send_class: z.enum(['broadcast', 'product']).optional().describe("Who may receive it when the project's consent gate is on: 'broadcast' (default) = only contacts who opted in to marketing; 'product' = also the customer's signed-up users (onboarding, trial, account mail)."),
         },
     }, async ({ approval_id, ...input }) => {
@@ -3422,9 +3436,14 @@ Return ONLY valid JSON with this exact shape:
             const result = await resumeCampaignEdit('update_campaign', approval_id, input);
             return j(result.error ? result : { ...result, fires_on: buildCampaignFiresOn(result), trigger_diagnostics: buildCampaignTriggerDiagnostics(result) });
         }
-        const { campaign_id, name, site_id, segment_id, send_at, topic, trigger_event_name, trigger_tag, trigger_type, trigger_config, type, sends_per_hour, send_in_contact_timezone, send_class } = input;
+        const { campaign_id, name, site_id, segment_id, send_at, topic, trigger_event_name, trigger_tag, trigger_type, trigger_config, type, sends_per_hour, send_in_contact_timezone, send_class, unsub_footer_template } = input;
         if (!campaign_id)
             return j({ error: 'campaign_id is required', code: 'INVALID_FIELD' });
+        if (unsub_footer_template !== undefined && unsub_footer_template !== null) {
+            const footerError = validateUnsubFooterTemplate(unsub_footer_template);
+            if (footerError)
+                return j({ error: footerError, code: 'INVALID_FIELD' });
+        }
         const projectId = getProjectId();
         let campaignType;
         const loadExisting = () => db()
@@ -3491,6 +3510,8 @@ Return ONLY valid JSON with this exact shape:
             updates.send_in_contact_timezone = send_in_contact_timezone;
         if (send_class !== undefined)
             updates.send_class = send_class;
+        if (unsub_footer_template !== undefined)
+            updates.unsub_footer_template = unsub_footer_template?.trim() ?? null;
         const targetingError = await applyCampaignTargetingFields(updates, { trigger_event_name, trigger_tag, trigger_type, trigger_config, segment_id }, projectId, existingCampaignForTargeting);
         if (targetingError)
             return j({ error: targetingError, code: targetingError === 'Segment not found' ? 'NOT_FOUND' : 'INVALID_FIELD' });

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@sendinel/mcp-server",
-  "version": "1.0.106",
+  "version": "1.0.108",
   "description": "AI-controlled email operations control plane for campaigns, contacts, segments, analytics, and multi-provider sending via MCP.",
   "mcpName": "ai.sendinel/mcp-server",
   "type": "module",