@sendinel/mcp-server 1.0.135 → 1.0.137

package/build/plan-limits.d.ts

@@ -3,6 +3,9 @@ interface LimitCheck {
     current: number;
     limit: number;
     resource: string;
+    upgrade_url?: string | null;
 }
+/** Shared cap copy for single adds and bulk imports, without assuming a plan tier. */
+export declare function contactLimitMessage(limit: LimitCheck, newCount?: number): string;
 export declare function checkPlanLimit(resource: 'contacts' | 'monthly_sends' | 'active_campaigns' | 'sites' | 'ai_drafts'): Promise<LimitCheck>;
 export {};

package/build/plan-limits.js

@@ -1,5 +1,13 @@
 import { adminDb } from './db.js';
 import { getProjectId } from './project.js';
+/** Shared cap copy for single adds and bulk imports, without assuming a plan tier. */
+export function contactLimitMessage(limit, newCount) {
+    const usage = `(${limit.current}/${limit.limit})`;
+    const message = newCount === undefined
+        ? `Contact limit reached ${usage}.`
+        : `Import would add ${newCount} new contacts but only ${Math.max(0, limit.limit - limit.current)} slots remaining ${usage}.`;
+    return `${message} Raise your contact limit${limit.upgrade_url ? `: ${limit.upgrade_url}` : '.'}`;
+}
 export async function checkPlanLimit(resource) {
     const { data, error } = await adminDb()
         .rpc('check_plan_limit', { p_project_id: getProjectId(), p_resource: resource });

package/build/tools/contacts.js

@@ -6,7 +6,7 @@ import { z } from 'zod';
 import { callSendinelV1 } from '../lib/v1-client.js';
 import { db, projectClientForWriteback } from '../db.js';
 import { getProjectId } from '../project.js';
-import { checkPlanLimit } from '../plan-limits.js';
+import { checkPlanLimit, contactLimitMessage } from '../plan-limits.js';
 import { logConsent, logAudit } from '../audit.js';
 import { assertChannelCanExecute, currentChannelContext, requestApproval, checkApproval, withApproval } from '../lib/action-approvals.js';
 import { decrypt } from '../crypto.js';
@@ -18,6 +18,7 @@ import { AI_MAX_TOKENS, outputConfig, anthropicCheckedText } from '@sendinel/dom
 const txt = (text) => ({ content: [{ type: 'text', text }] });
 const err = (text) => ({ ...txt(text), isError: true });
 const j = (data) => txt(JSON.stringify(data, null, 2));
+const contactInputError = (code, message) => err(JSON.stringify({ code, error: message }));
 const CUSTOM_FIELD_TYPES = [
     'email', 'text', 'textarea', 'select', 'checkbox', 'number', 'tel', 'url', 'date',
     'multi_select', 'contact_reference',
@@ -1220,22 +1221,27 @@ Requirements: urgency without desperation, acknowledge the gap, one clear CTA, v
     }, async ({ email, site_id, first_name, last_name, company_id, company_name, company_domain, source, utm_source, utm_medium, utm_campaign, utm_content, utm_term }) => {
         email = email.trim().toLowerCase();
         const projectId = getProjectId();
-        const embedOk = await hasCompaniesEmbed(projectId);
-        const resolvedCompanyId = await resolveCompanyId(projectId, { company_id, company_name, company_domain });
         // Block distribution list / system addresses
         const DISTRO_LOCAL_PARTS = new Set(['all', 'everyone', 'distro', 'broadcast', 'announce', 'postmaster', 'abuse', 'mailer-daemon', 'bounce', 'bounces', 'noreply', 'no-reply', 'nobody', 'null', 'void']);
         const DISTRO_PATTERNS = [/^all[-+.]/, /[-+.]all$/, /^list[-+.]/, /[-+.]list$/, /[-+.]announce$/, /^announce[-+.]/, /[-+.]distro$/, /^distro[-+.]/, /[-+.]broadcast$/, /^broadcast[-+.]/];
         const local = email.trim().toLowerCase().split('@')[0] ?? '';
         if (DISTRO_LOCAL_PARTS.has(local) || DISTRO_PATTERNS.some(p => p.test(local))) {
-            return { content: [{ type: 'text', text: `Blocked: "${email}" looks like a group or distribution list address. Sendinel sends to individual people only.` }] };
-        }
+            return contactInputError('validation_failed', `Blocked: "${email}" looks like a group or distribution list address. Sendinel sends to individual people only.`);
+        }
+        // Validate project ownership before the cap, and reuse the double opt-in lookup.
+        const { data: siteInfo, error: siteError } = await db().from('sites')
+            .select('double_opt_in').eq('id', site_id).eq('project_id', projectId).maybeSingle();
+        if (siteError)
+            throw new Error(`Site lookup failed: ${siteError.message}`);
+        if (!siteInfo)
+            return contactInputError('not_found', 'Site not found for this project.');
+        const needsConfirm = siteInfo.double_opt_in === true;
         const limit = await checkPlanLimit('contacts');
         if (!limit.allowed) {
-            return { content: [{ type: 'text', text: `Contact limit reached (${limit.current}/${limit.limit}). Upgrade to Pro for more contacts.` }] };
+            return contactInputError('plan_limit', contactLimitMessage(limit));
         }
-        // Check if site requires double opt-in
-        const { data: siteInfo } = await db().from('sites').select('double_opt_in').eq('id', site_id).maybeSingle();
-        const needsConfirm = siteInfo?.double_opt_in === true;
+        const embedOk = await hasCompaniesEmbed(projectId);
+        const resolvedCompanyId = await resolveCompanyId(projectId, { company_id, company_name, company_domain });
         let { data: existingContact, error: lookupError } = await db()
             .from('subscribers')
             .select('id, source, first_name, last_name, company_id, custom_properties, opted_in_at')
@@ -1395,7 +1401,7 @@ Requirements: urgency without desperation, acknowledge the gap, one clear CTA, v
             const msg = skippedDistro.length
                 ? `No valid contacts to import. ${skippedDistro.length} address(es) blocked as distribution lists: ${skippedDistro.slice(0, 5).join(', ')}`
                 : 'No valid contacts to import.';
-            return { content: [{ type: 'text', text: msg }] };
+            return contactInputError('validation_failed', msg);
         }
         // Check which already exist
         const { data: existing } = await db()
@@ -1407,9 +1413,9 @@ Requirements: urgency without desperation, acknowledge the gap, one clear CTA, v
         const newCount = valid.filter(c => !existingEmails.has(c.email)).length;
         if (newCount > 0) {
             const limit = await checkPlanLimit('contacts');
-            const remaining = limit.limit - limit.current;
+            const remaining = Math.max(0, limit.limit - limit.current);
             if (newCount > remaining) {
-                return { content: [{ type: 'text', text: `Import would add ${newCount} new contacts but only ${remaining} slots remaining (${limit.current}/${limit.limit}). Upgrade to import more.` }] };
+                return contactInputError('plan_limit', contactLimitMessage(limit, newCount));
             }
         }
         const rows = valid.map(c => ({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sendinel/mcp-server",
-  "version": "1.0.135",
+  "version": "1.0.137",
   "description": "AI-controlled email operations control plane for campaigns, contacts, segments, analytics, and multi-provider sending via MCP.",
   "mcpName": "ai.sendinel/mcp-server",
   "type": "module",