@sendinel/mcp-server 1.0.140 → 1.0.142

package/build/lib/db-error.d.ts

@@ -0,0 +1,16 @@
+/** Public tool errors must not expose SQL, constraint names or database internals. */
+export declare function dbToolError(error: {
+    code?: string;
+    message?: string;
+}, message?: string): {
+    error: string;
+    code: string;
+};
+/** Mark coded failures as MCP errors so the hosted api_usage classifier sees them. */
+export declare function toolError(body: unknown): {
+    isError: true;
+    content: {
+        type: 'text';
+        text: string;
+    }[];
+};

package/build/lib/db-error.js

@@ -0,0 +1,17 @@
+/** Public tool errors must not expose SQL, constraint names or database internals. */
+export function dbToolError(error, message = 'Unable to complete database operation') {
+    if (error.code === '23505')
+        return { error: 'A record with these values already exists', code: 'conflict' };
+    if (error.code === '23503')
+        return { error: 'Referenced record not found', code: 'not_found' };
+    if (error.code === '42501')
+        return { error: 'Operation forbidden', code: 'forbidden' };
+    if (error.code?.startsWith('22') || error.code === '23514' || error.code === '23502') {
+        return { error: 'Invalid record values', code: 'validation_failed' };
+    }
+    return { error: message, code: 'internal_error' };
+}
+/** Mark coded failures as MCP errors so the hosted api_usage classifier sees them. */
+export function toolError(body) {
+    return { isError: true, content: [{ type: 'text', text: JSON.stringify(body, null, 2) }] };
+}

package/build/tools/ab-testing.js

@@ -13,7 +13,7 @@ export function registerAbTestingTools(server) {
             idempotentHint: false,
             openWorldHint: false,
         },
-        description: 'Create an A/B test for a campaign step. Requires at least 2 variant steps (add via add_campaign_step with variant_label). Returns the test config for review.',
+        description: 'Create an A/B test for a campaign step. Requires a non-blank subject and body on every variant, and at least 2 variant steps (add via add_campaign_step with variant_label). Returns the test config for review.',
         inputSchema: {
             campaign_id: z.string().uuid(),
             step_order: z.number().int().min(0).optional().default(0).describe('Which step to test (default: 0, the first email)'),
@@ -38,13 +38,20 @@ export function registerAbTestingTools(server) {
         // Check variant steps exist
         const { data: steps } = await db()
             .from('campaign_steps')
-            .select('id, variant_label, subject')
+            .select('id, variant_label, subject, body_html, body_text')
             .eq('campaign_id', campaign_id)
             .eq('step_order', step_order ?? 0);
         const variantLabels = (steps ?? []).map((s) => s.variant_label);
         if (variantLabels.length < 2) {
             return txt(`Error: Need at least 2 variant steps for step_order ${step_order ?? 0}. Found: [${variantLabels.join(', ')}]. Add more variants via add_campaign_step with variant_label parameter.`);
         }
+        const emptyVariants = (steps ?? []).filter((step) => !step.subject?.trim() || !(step.body_html?.trim() || step.body_text?.trim()));
+        if (emptyVariants.length) {
+            return j({
+                error: `Variant(s) [${emptyVariants.map((step) => step.variant_label).join(', ')}] for step_order ${step_order ?? 0} need a non-blank subject and body. Add content with add_campaign_step before creating the test.`,
+                code: 'validation_failed',
+            });
+        }
         // Check no existing test for this step
         const { data: existing } = await db()
             .from('ab_tests')

package/build/tools/advisor.js

@@ -1,8 +1,9 @@
-import { countEmailRows, groupMetricRows, percentRate, isDeliveredRow, isOpenedRow, countPeople, isComplainedRow, isBouncedRow, AI_MAX_TOKENS, outputConfig, anthropicCheckedText, readAllRows } from "@sendinel/domain";
+import { countEmailRows, groupMetricRows, percentRate, isBouncedRow, AI_MAX_TOKENS, outputConfig, anthropicCheckedText, readAllRows } from "@sendinel/domain";
 import { z } from 'zod';
 import Anthropic from '@anthropic-ai/sdk';
 import { db } from '../db.js';
 import { getProjectId } from '../project.js';
+import { toolError } from '../lib/db-error.js';
 import { buildVoicePrompt } from '../lib/voice.js';
 import { getAnthropicModelId } from '../anthropic-model.js';
 import { dkimRemediationText } from '../lib/email-provider.js';
@@ -103,19 +104,19 @@ export function registerAdvisorTools(server) {
         // 1. Current period email_log
         let currentQuery = db()
             .from('email_log')
-            .select("status, created_at, bounced_at, opened_at, clicked_at, contact_id, to_email")
+            .select("status, sent_at, bounced_at, opened_at, clicked_at, contact_id, to_email")
             .eq('project_id', projectId)
-            .gte('created_at', periodStart.toISOString());
+            .gte('sent_at', periodStart.toISOString());
         if (site_id)
             currentQuery = currentQuery.eq('site_id', site_id);
         const currentRows = await readAllRows(currentQuery);
         // 2. Prior period
         let priorQuery = db()
             .from('email_log')
-            .select("status, created_at, bounced_at, opened_at, clicked_at, contact_id, to_email")
+            .select("status, sent_at, bounced_at, opened_at, clicked_at, contact_id, to_email")
             .eq('project_id', projectId)
-            .gte('created_at', priorStart.toISOString())
-            .lt('created_at', periodStart.toISOString());
+            .gte('sent_at', priorStart.toISOString())
+            .lt('sent_at', periodStart.toISOString());
         if (site_id)
             priorQuery = priorQuery.eq('site_id', site_id);
         const priorRows = await readAllRows(priorQuery);
@@ -124,8 +125,8 @@ export function registerAdvisorTools(server) {
         // 3. Domain health (latest per site)
         let healthQuery = db()
             .from('domain_health')
-            .select('site_id, bounce_rate, complaint_rate, spf_valid, dkim_valid, dmarc_valid, warmup_day')
-            .eq('project_id', projectId)
+            .select('site_id, bounce_rate, complaint_rate, spf_valid, dkim_valid, dmarc_valid, warmup_day, sites!inner(project_id)')
+            .eq('sites.project_id', projectId)
             .order('check_date', { ascending: false })
             .limit(20);
         if (site_id)
@@ -595,15 +596,19 @@ Return ONLY valid JSON (no markdown fences): { "topics": [{ "title": "...", "rat
             .eq('id', site_id)
             .eq('project_id', projectId)
             .maybeSingle();
-        if (siteErr || !site)
-            return txt(`Error: Site not found — ${siteErr?.message ?? 'not found'}`);
+        if (siteErr)
+            return toolError({ error: 'Unable to load site', code: 'internal_error' });
+        if (!site)
+            return toolError({ error: 'Site not found', code: 'not_found' });
         // 2. Fetch latest domain_health
-        const { data: healthRows } = await db()
+        const { data: healthRows, error: healthError } = await db()
             .from('domain_health')
             .select('spf_valid, dkim_valid, dmarc_valid, bounce_rate, complaint_rate, warmup_day, warmup_daily_limit, delivery_rate, total_sent')
             .eq('site_id', site_id)
             .order('check_date', { ascending: false })
             .limit(1);
+        if (healthError)
+            return toolError({ error: 'Unable to load domain health', code: 'internal_error' });
         const health = (healthRows ?? [])[0];
         const spfValid = health?.spf_valid ?? null; // null = not checked yet (#3904)
         const spfFailed = spfValid === false;
@@ -615,18 +620,16 @@ Return ONLY valid JSON (no markdown fences): { "topics": [{ "title": "...", "rat
         const warmupDailyLimit = health?.warmup_daily_limit ?? null;
         // 3. Fetch recent 7-day email_log stats
         const sevenDaysAgo = new Date(Date.now() - 7 * 24 * 60 * 60 * 1000).toISOString();
-        const { data: recentLogs } = await db()
+        const { data: recentLogs, error: logsError } = await db()
             .from('email_log')
             .select("status, opened_at, clicked_at, bounced_at, contact_id, to_email")
             .eq('project_id', projectId)
             .eq('site_id', site_id)
             .gte('sent_at', sevenDaysAgo);
+        if (logsError)
+            return toolError({ error: 'Unable to load send history', code: 'internal_error' });
         const logs = recentLogs ?? [];
-        const totalSent = logs.length;
-        const bounced = logs.filter(isBouncedRow).length;
-        const complained = logs.filter(isComplainedRow).length;
-        const delivered = logs.filter(isDeliveredRow).length;
-        const opened = countPeople(logs, isOpenedRow);
+        const { sent: totalSent, bounced, complained, delivered, opened } = countEmailRows(logs);
         const bounceRate = percentRate(bounced, totalSent, 2) ?? 0;
         const complaintRate = percentRate(complained, totalSent, 2) ?? 0;
         const openRate = percentRate(opened, delivered, 2) ?? 0;
@@ -745,7 +748,8 @@ Return ONLY valid JSON (no markdown fences): { "topics": [{ "title": "...", "rat
             estimatedRecovery = '3-5 days';
         return j({
             site: { id: site.id, slug: site.slug, domain: site.sending_domain },
-            health_score: healthScore,
+            health_score: totalSent === 0 ? null : healthScore,
+            ...(totalSent === 0 ? { health_score_reason: 'no_send_data', reason: 'no_send_data' } : {}),
             recent_7d: {
                 total_sent: totalSent,
                 delivered,
@@ -765,7 +769,7 @@ Return ONLY valid JSON (no markdown fences): { "topics": [{ "title": "...", "rat
                 short_term: shortTerm.length > 0 ? shortTerm : ['Continue current sending practices'],
                 monitoring,
             },
-            estimated_recovery: issues.length === 0 ? 'No recovery needed — site is healthy' : estimatedRecovery,
+            ...(issues.some(issue => issue.type !== 'no_recent_sends') ? { estimated_recovery: estimatedRecovery } : {}),
         });
     });
 }

package/build/tools/analytics.d.ts

@@ -28,10 +28,11 @@ export declare function computeAnalyticsMetrics(rows: EmailLogRow[], eventCounts
     clicked: number;
 }): AnalyticsMetrics;
 export declare function computeSenderHealthScore(metrics: {
+    sent: number;
     bounce_rate: number;
     complaint_rate: number;
     unsubscribe_rate: number;
     open_rate: number;
-}, trackingEnabled: boolean): number;
+}, trackingEnabled: boolean): number | null;
 export declare function registerAnalyticsTools(server: McpServer): void;
 export {};

package/build/tools/analytics.js

@@ -1,4 +1,4 @@
-import { readPeriodCampaigns, campaignPeriodFields } from "@sendinel/domain";
+import { readPeriodCampaigns, campaignPeriodFields, filterPlanContacts } from "@sendinel/domain";
 import { isTrueConversionEvent, TRUE_CONVERSION_DEFINITION } from "@sendinel/domain";
 import { percentRate, groupMetricRows, readRevenue, isComplainedRow, isOpenedRow, countPeople, isClickedRow, summarizeEmailRows, countEmailRows, isDeliveredRow, isBouncedRow, fetchAllRows, readAllRows } from "@sendinel/domain";
 import { z } from 'zod';
@@ -7,6 +7,7 @@ import { getProjectId } from '../project.js';
 import { resolveProjectClient } from '../byod-client.js';
 import { decrypt } from '../crypto.js';
 import { logAudit } from '../audit.js';
+import { dbToolError, toolError } from '../lib/db-error.js';
 const txt = (text) => ({ content: [{ type: 'text', text }] });
 const j = (data) => txt(JSON.stringify(data, null, 2));
 const percent = (rate) => `${(rate * 100).toFixed(1)}%`;
@@ -21,6 +22,8 @@ export function computeAnalyticsMetrics(rows, eventCounts) {
         complaint_rate: metrics.complaint_rate ?? 0, unsubscribe_rate: metrics.unsubscribe_rate ?? 0 };
 }
 export function computeSenderHealthScore(metrics, trackingEnabled) {
+    if (metrics.sent === 0)
+        return null;
     let score = 100;
     if (metrics.bounce_rate > 0.05)
         score -= 40;
@@ -462,6 +465,11 @@ export function registerAnalyticsTools(server) {
     }, async ({ site_id, start_date, end_date }) => {
         const projectId = getProjectId();
         const end = end_date ?? new Date().toISOString().slice(0, 10);
+        const validDate = (value) => /^\d{4}-\d{2}-\d{2}$/.test(value) &&
+            Number.isFinite(Date.parse(value)) && new Date(value).toISOString().slice(0, 10) === value;
+        if (!validDate(start_date) || !validDate(end) || start_date > end) {
+            return toolError({ error: 'Use valid YYYY-MM-DD dates with start_date on or before end_date', code: 'validation_failed' });
+        }
         const { data: site, error: siteError } = await db()
             .from('sites')
             .select('tracking_enabled')
@@ -469,7 +477,9 @@ export function registerAnalyticsTools(server) {
             .eq('id', site_id)
             .maybeSingle();
         if (siteError)
-            return { content: [{ type: 'text', text: `Error: ${siteError.message}` }] };
+            return toolError({ error: 'Unable to load site', code: 'internal_error' });
+        if (!site)
+            return toolError({ error: 'Site not found', code: 'not_found' });
         const trackingEnabled = site?.tracking_enabled ?? false;
         const { data, error, pageCount: logPageCount } = await fetchAllRows(async (offset, limit) => db()
             .from('email_log')
@@ -481,7 +491,7 @@ export function registerAnalyticsTools(server) {
             .order('id', { ascending: true })
             .range(offset, offset + limit - 1));
         if (error)
-            return { content: [{ type: 'text', text: `Error: ${error.message}` }] };
+            return toolError(dbToolError(error));
         const rows = (data ?? []);
         let eventCounts = { opened: 0, clicked: 0 };
         let eventRows = [];
@@ -498,7 +508,7 @@ export function registerAnalyticsTools(server) {
                 .order('id', { ascending: true })
                 .range(offset, offset + limit - 1));
             if (eventsError)
-                return { content: [{ type: 'text', text: `Error: ${eventsError.message}` }] };
+                return toolError(dbToolError(eventsError));
             eventRows = events ?? [];
             eventPageCount = pageCount;
             const messageIds = new Set(rows.map(row => row.provider_message_id).filter((id) => Boolean(id)));
@@ -511,14 +521,14 @@ export function registerAnalyticsTools(server) {
         const periodDays = daysBetween(start_date, end);
         const priorStart = dateOnly(addDays(new Date(`${start_date}T00:00:00Z`), -periodDays));
         const priorEnd = dateOnly(addDays(new Date(`${start_date}T00:00:00Z`), -1));
-        const { data: subscribers, error: subscribersError, pageCount: subscriberPageCount } = await fetchAllRows(async (offset, limit) => db()
+        const { data: subscribers, error: subscribersError, pageCount: subscriberPageCount } = await fetchAllRows(async (offset, limit) => filterPlanContacts(db()
             .from('subscribers')
             .select('created_at, last_engaged_at, last_opened_at, last_clicked_at')
-            .eq('project_id', projectId)
+            .eq('project_id', projectId))
             .order('id', { ascending: true })
             .range(offset, offset + limit - 1));
         if (subscribersError)
-            return { content: [{ type: 'text', text: `Error: ${subscribersError.message}` }] };
+            return toolError(dbToolError(subscribersError));
         const subscriberRows = (subscribers ?? []);
         const currentNew = subscriberRows.filter(s => s.created_at && s.created_at >= `${start_date}T00:00:00Z` && s.created_at <= `${end}T23:59:59Z`).length;
         const priorNew = subscriberRows.filter(s => s.created_at && s.created_at >= `${priorStart}T00:00:00Z` && s.created_at <= `${priorEnd}T23:59:59Z`).length;
@@ -540,6 +550,7 @@ export function registerAnalyticsTools(server) {
             list_growth_rate: subscriberRows.length > 0 ? pctNumber(currentNew / subscriberRows.length) : 0,
             inactive_pct: subscriberRows.length > 0 ? pctNumber(inactive / subscriberRows.length) : 0,
             sender_health_score: computeSenderHealthScore(metrics, trackingEnabled),
+            ...(metrics.sent === 0 ? { sender_health_score_reason: 'no_send_data', reason: 'no_send_data' } : {}),
             coverage: {
                 log_rows_scanned: rows.length,
                 log_page_count: logPageCount,
@@ -890,7 +901,8 @@ export function registerAnalyticsTools(server) {
             return txt(`Error: ${attributionError.message}`);
         const scopedAttributionRows = attributionRows ?? [];
         const computeMetrics = (set, counts) => {
-            const total = counts?.sent ?? set.length;
+            const sharedCounts = counts ?? countEmailRows(set);
+            const total = sharedCounts.sent;
             const delivered = counts?.delivered ?? set.filter(isDeliveredRow).length;
             const opened = counts?.opened ?? countPeople(set, isOpenedRow);
             const clicked = counts?.clicked ?? countPeople(set, isClickedRow);

package/build/tools/approvals.js

@@ -1,6 +1,7 @@
 import { z } from 'zod';
 import { db } from '../db.js';
 import { getProjectId } from '../project.js';
+import { dbToolError, toolError } from '../lib/db-error.js';
 import { checkApproval } from '../lib/action-approvals.js';
 import { confirmApproval, confirmApprovalInput } from '../lib/approval-chat-confirm.js';
 const txt = (text) => ({ content: [{ type: 'text', text }] });
@@ -42,7 +43,7 @@ export function registerApprovalTools(server, options) {
             idempotentHint: true,
             openWorldHint: false,
         },
-        description: 'List all pending approval requests for this project. Excludes expired requests without mutating them. Shows what actions are waiting for human approval.',
+        description: 'List unexpired pending approval requests for this project. Expired rows are excluded even before the expiry cron runs.',
         inputSchema: {},
     }, async () => {
         const { data, error } = await db()
@@ -54,7 +55,7 @@ export function registerApprovalTools(server, options) {
             .order('requested_at', { ascending: false })
             .limit(25);
         if (error)
-            return j({ error: error.message, code: 'INTERNAL_ERROR' });
+            return toolError(dbToolError(error));
         return j({ pending: data ?? [], count: data?.length ?? 0 });
     });
 }

package/build/tools/campaigns.js

@@ -13,6 +13,7 @@ import { ensureReplyActionSecretConfigured, mintReplyAction, } from '@sendinel/d
 import { finishCampaignEdit, resumeCampaignEdit, TRIGGER_EDIT_SELECT } from '../lib/campaign-trigger-approval.js';
 import { adminDb, db, requestContext } from '../db.js';
 import { getProjectId } from '../project.js';
+import { dbToolError, toolError } from '../lib/db-error.js';
 import { checkPlanLimit } from '../plan-limits.js';
 import { buildVoicePrompt, buildEmailSystemPrompt, deriveTemplateVariables, validateTemplate } from '../lib/voice.js';
 import { fireWebhookEvent } from '../lib/webhook-events.js';
@@ -136,6 +137,9 @@ export function buildCampaignTriggerDiagnostics(campaign, seenEvents) {
     if ((campaign.trigger_type === 'date_field' || campaign.trigger_type === 'contact_event') && (events.length || tags.length) && campaign.type === 'triggered') {
         diagnostics.push(`trigger_type is "${String(campaign.trigger_type)}" but event/tag triggers are also set; event intake will start it immediately, outside the ${String(campaign.trigger_type)} schedule`);
     }
+    if (campaign.type === 'triggered' && campaignTriggerKind(campaign) === 'manual' && !campaign.segment_id) {
+        diagnostics.push('campaign type is "triggered" but no trigger is set (it will never fire)');
+    }
     if (campaign.status !== 'active') {
         diagnostics.push(`it is ${String(campaign.status)}, so nothing starts until it is active`);
     }
@@ -383,10 +387,12 @@ async function campaignInProject(campaignId) {
     return Boolean(data);
 }
 /** Mirrors validateTarget() in the branches REST route. */
-async function validateBranchTarget(campaignId, action, targetStepId, targetCampaignId) {
+async function validateBranchTarget(campaignId, fromStepId, action, targetStepId, targetCampaignId) {
     if (action === 'goto_step') {
         if (!targetStepId)
             return 'target_step_id is required for goto_step';
+        if (targetStepId === fromStepId)
+            return 'goto_step cannot target its own source step';
         const { data } = await db()
             .from('campaign_steps')
             .select('id')
@@ -399,6 +405,8 @@ async function validateBranchTarget(campaignId, action, targetStepId, targetCamp
     if (action === 'goto_campaign') {
         if (!targetCampaignId)
             return 'target_campaign_id is required for goto_campaign';
+        if (targetCampaignId === campaignId)
+            return 'goto_campaign cannot target its own campaign';
         if (!(await campaignInProject(targetCampaignId)))
             return 'target_campaign_id must be a campaign in this project';
     }
@@ -850,7 +858,7 @@ export function registerCampaignTools(server) {
             .single();
         if (error)
             return { content: [{ type: 'text', text: `Error: ${error.message}` }] };
-        return { content: [{ type: 'text', text: JSON.stringify({ ...data, requires_approval_description: ACTIVATION_APPROVAL_DESCRIPTION }, null, 2) }] };
+        return { content: [{ type: 'text', text: JSON.stringify({ ...data, requires_approval_description: ACTIVATION_APPROVAL_DESCRIPTION, fires_on: buildCampaignFiresOn(data), trigger_diagnostics: buildCampaignTriggerDiagnostics(data) }, null, 2) }] };
     });
     const propertyConditions = z.array(z.union([
         z.object({ key: z.string(), op: z.enum(['eq', 'neq']), value: z.string() }).strict(),
@@ -864,7 +872,7 @@ export function registerCampaignTools(server) {
             idempotentHint: false,
             openWorldHint: false,
         },
-        description: 'Add an email step to a campaign. For A/B testing, add multiple steps with the same step_order but different variant_label values.',
+        description: 'Add an email step to a campaign. Requires a non-blank subject and body_html, body_text, or blocks that render to content. For A/B testing, add multiple steps with the same step_order but different variant_label values.',
         inputSchema: {
             campaign_id: z.string().uuid(),
             step_order: z.number().int().min(0).describe('Position in sequence (0 = first)'),
@@ -887,6 +895,16 @@ export function registerCampaignTools(server) {
             const properties = validateStepPropertyRules({ skip_if_property, send_only_if_property });
             if (!properties.ok)
                 return j({ error: properties.error, code: "INVALID_INPUT" });
+            const normalizedBlocks = blocks ? normalizeComposerBlocks(blocks) : undefined;
+            const htmlFromBlocks = normalizedBlocks?.length ? blocksToHtml(normalizedBlocks) : undefined;
+            if (!subject.trim())
+                return j({ error: 'A step needs a non-blank subject.', code: 'validation_failed' });
+            const hasBody = body_html?.trim() || body_text?.trim()
+                || htmlFromBlocks?.replace(/<[^>]*>/g, '').trim()
+                || normalizedBlocks?.some((block) => block.type === 'image' && block.url);
+            if (!hasBody) {
+                return j({ error: 'A step needs body_html or body_text (or blocks that render to content).', code: 'validation_failed' });
+            }
             const { data: campaign, error: campaignError } = await db()
                 .schema('email')
                 .from('campaigns')
@@ -906,8 +924,6 @@ export function registerCampaignTools(server) {
                 renderVars.survey_link = surveyLink;
             }
             const renderedSubject = survey_id ? renderTemplateVars(subject, renderVars) : subject;
-            const normalizedBlocks = blocks ? normalizeComposerBlocks(blocks) : undefined;
-            const htmlFromBlocks = normalizedBlocks?.length ? blocksToHtml(normalizedBlocks) : undefined;
             const renderedHtml = body_html !== undefined && survey_id ? renderTemplateVars(body_html, renderVars) : body_html ?? htmlFromBlocks;
             const renderedText = body_text !== undefined && survey_id ? renderTemplateVars(body_text, renderVars) : body_text;
             const { data, error } = await db()
@@ -970,12 +986,15 @@ export function registerCampaignTools(server) {
             // Placeholder text and links to the sending domain never go out (#3853).
             const { data: campRow, error: campErr } = await db()
                 .from('campaigns')
-                .select('id, name, site_id, trigger_event_name')
+                .select('id, name, site_id, type, trigger_type, trigger_event_name, trigger_tag, trigger_config, segment_id')
                 .eq('id', campaign_id)
                 .eq('project_id', getProjectId())
                 .maybeSingle();
             if (campErr)
                 return j({ error: `Could not check the campaign: ${campErr.message}`, code: 'CAMPAIGN_LOOKUP_FAILED' });
+            if (campRow?.type === 'triggered' && campaignTriggerKind(campRow) === 'manual' && !campRow.segment_id) {
+                return j({ error: 'This triggered campaign has no trigger. Set an event, tag, date, contact event, or segment before activating it.', code: 'validation_failed' });
+            }
             let contentWarnings = [];
             if (campRow) {
                 const { data: contentSteps, error: contentErr } = await db()
@@ -1606,7 +1625,7 @@ export function registerCampaignTools(server) {
             idempotentHint: false,
             openWorldHint: false,
         },
-        description: 'Clone an existing campaign (with all steps) into a new draft campaign',
+        description: 'Clone campaign steps into a draft. Trigger, audience, send class, re-entry, goals and branches are NOT copied; fields_not_copied and warnings explicitly identify these omissions. Review and configure before activation.',
         inputSchema: {
             campaign_id: z.string().uuid().describe('Source campaign to clone'),
             new_name: z.string().min(1).describe('Name for the cloned campaign'),
@@ -1620,11 +1639,13 @@ export function registerCampaignTools(server) {
             .eq('id', campaign_id)
             .eq('project_id', projectId)
             .maybeSingle();
-        if (fetchErr || !original)
-            return txt(`Error: Campaign not found — ${fetchErr?.message ?? 'not found'}`);
+        if (fetchErr)
+            return toolError(dbToolError(fetchErr));
+        if (!original)
+            return toolError({ error: 'Campaign not found', code: 'not_found' });
         const limit = await checkPlanLimit('active_campaigns');
         if (!limit.allowed)
-            return txt(`Active campaign limit reached (${limit.current}/${limit.limit}).`);
+            return toolError({ error: `Active campaign limit reached (${limit.current}/${limit.limit}).`, code: 'plan_limit' });
         const { data: newCampaign, error: createErr } = await db()
             .from('campaigns')
             .insert({
@@ -1640,7 +1661,7 @@ export function registerCampaignTools(server) {
             .select()
             .single();
         if (createErr)
-            return txt(`Error creating campaign: ${createErr.message}`);
+            return toolError(dbToolError(createErr));
         const steps = (original.campaign_steps ?? []).sort((a, b) => a.step_order - b.step_order);
         if (steps.length > 0) {
             const stepRows = steps.map((s) => ({
@@ -1655,9 +1676,18 @@ export function registerCampaignTools(server) {
             }));
             const { error: stepErr } = await db().from('campaign_steps').insert(stepRows);
             if (stepErr)
-                return txt(`Campaign created but steps failed: ${stepErr.message}`);
-        }
-        return j({ ...newCampaign, steps_copied: steps.length, cloned_from: campaign_id });
+                return toolError({ ...dbToolError(stepErr, 'Campaign created but copying steps failed'), campaign_id: newCampaign.id });
+        }
+        const copied = new Set(['project_id', 'site_id', 'name', 'type', 'description', 'sends_per_hour', 'requires_approval']);
+        const identity = new Set(['id', 'status', 'created_at', 'updated_at', 'campaign_steps']);
+        const fields_not_copied = [...new Set([
+                ...Object.keys(original).filter(key => !copied.has(key) && !identity.has(key)),
+                'trigger_type', 'trigger_event_name', 'trigger_tag', 'trigger_config', 'segment_id',
+                'send_class', 'unsub_footer_template', 'period_key', 'reentry_mode', 'campaign_goals', 'campaign_step_branches',
+            ])];
+        await logAudit({ action: 'campaign.cloned', resourceType: 'campaign', resourceId: newCampaign.id, details: { cloned_from: campaign_id, fields_not_copied } });
+        return j({ ...newCampaign, steps_copied: steps.length, cloned_from: campaign_id, fields_not_copied,
+            warnings: fields_not_copied.map(field => `${field} was not copied; review and configure the draft before activation.`) });
     });
     server.registerTool('list_sequence_templates', {
         title: 'List Sequence Templates',
@@ -3848,14 +3878,20 @@ Return ONLY valid JSON with this exact shape:
     }, async ({ campaign_id, from_step_id, condition_type, condition_value, action, target_step_id, target_campaign_id, priority }) => {
         const conditionValue = campaignBranchConditionValue(condition_type, condition_value);
         if (!conditionValue.ok)
-            return { ...j({ error: conditionValue.error, code: 'INVALID_CONDITION_VALUE' }), isError: true };
+            return { ...j({ error: conditionValue.error, code: 'validation_failed' }), isError: true };
         if (!(await campaignInProject(campaign_id)))
-            return j({ error: 'Campaign not found in this project', code: 'CAMPAIGN_NOT_FOUND' });
+            return toolError({ error: 'Campaign not found in this project', code: 'not_found' });
+        const { data: sourceStep, error: sourceError } = await db().from('campaign_steps').select('id')
+            .eq('id', from_step_id).eq('campaign_id', campaign_id).maybeSingle();
+        if (sourceError)
+            return toolError(dbToolError(sourceError));
+        if (!sourceStep)
+            return toolError({ error: 'from_step_id must be a step in this campaign', code: 'validation_failed' });
         // Same requirement the REST route enforces: an action naming a target must have one,
         // and that target must belong to this project.
-        const targetError = await validateBranchTarget(campaign_id, action, target_step_id ?? null, target_campaign_id ?? null);
+        const targetError = await validateBranchTarget(campaign_id, from_step_id, action, target_step_id ?? null, target_campaign_id ?? null);
         if (targetError)
-            return j({ error: targetError, code: 'INVALID_TARGET' });
+            return toolError({ error: targetError, code: 'validation_failed' });
         const { data, error } = await db()
             .from('campaign_step_branches')
             .insert({
@@ -3871,9 +3907,14 @@ Return ONLY valid JSON with this exact shape:
             .select('id, from_step_id, condition_type, condition_value, action, target_step_id, target_campaign_id, priority')
             .single();
         if (error)
-            return j({ error: error.message });
+            return toolError(dbToolError(error));
         await logAudit({ action: 'add_campaign_branch', resourceType: 'campaign', resourceId: campaign_id, details: { branch_id: data?.id, condition_type, branch_action: action } }).catch(() => { });
-        return j({ success: true, branch: data });
+        // Read after insertion so a tie already committed by a concurrent request is visible.
+        const { data: peers, error: peerError } = await db().from('campaign_step_branches').select('id')
+            .eq('campaign_id', campaign_id).eq('from_step_id', from_step_id).eq('priority', priority ?? 0).neq('id', data.id);
+        const warnings = peerError ? ['Branch saved, but priority ties could not be checked.']
+            : peers?.length ? ['Another branch on this step has the same priority; evaluation order may be ambiguous.'] : [];
+        return j({ success: true, branch: data, warnings });
     });
     server.registerTool('remove_campaign_branch', {
         title: 'Remove Campaign Branch',

package/build/tools/contacts.js

@@ -7,6 +7,8 @@ import { z } from 'zod';
 import { callSendinelV1 } from '../lib/v1-client.js';
 import { db, projectClientForWriteback } from '../db.js';
 import { getProjectId } from '../project.js';
+import { dbToolError, toolError } from '../lib/db-error.js';
+import { resolveSegmentContactIds } from '../lib/send-audience.js';
 import { checkPlanLimit, contactLimitMessage } from '../plan-limits.js';
 import { logConsent, logAudit } from '../audit.js';
 import { assertChannelCanExecute, currentChannelContext, requestApproval, checkApproval, withApproval } from '../lib/action-approvals.js';
@@ -238,6 +240,49 @@ function normalizePhoneE164(value) {
 function isPlainObject(value) {
     return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
 }
+const SUBSCRIBER_VIEW_COLUMNS = new Set([
+    'contact', 'status_strip', 'quick_send', 'site', 'company', 'status', 'last_activity',
+    'sms_opt_in', 'tags', 'score', 'stage', 'opens', 'clicks', 'joined', 'embed_actions',
+    'email', 'first_name', 'last_name', 'introduced_by',
+]);
+const SUBSCRIBER_VIEW_STAGES = new Set(['new', 'active', 'cooling', 'cold', 'churned', 'lead', 'trial', 'customer', 'win-back']);
+function validateSubscriberViewInput(columns, filters) {
+    if (isPlainObject(filters)) {
+        for (const [key, value] of Object.entries(filters)) {
+            if (!SUBSCRIBER_VIEW_FILTER_KEYS.has(key))
+                return `Unknown filter "${key}". Valid keys: ${[...SUBSCRIBER_VIEW_FILTER_KEYS].join(', ')}`;
+            if (key === 'show_test' ? typeof value !== 'boolean' : typeof value !== 'string' || value.length > 500)
+                return `Invalid value for filter "${key}"`;
+            if (key === 'stage' && value !== '' && !SUBSCRIBER_VIEW_STAGES.has(value))
+                return `Invalid stage. Valid stages: ${[...SUBSCRIBER_VIEW_STAGES].join(', ')}`;
+            if (key === 'dir' && value !== 'asc' && value !== 'desc')
+                return 'dir must be asc or desc';
+            if (key === 'sort' && value !== '' && !SUBSCRIBER_VIEW_SORT_FIELDS.has(value))
+                return 'Invalid sort field';
+            if (key === 'status' && !['', 'all', 'active', 'unsubscribed', 'not_subscribed'].includes(value))
+                return 'Invalid subscription status';
+            if (key === 'cp_key' && value !== '' && !SUBSCRIBER_VIEW_CUSTOM_PROPERTY_KEY_RE.test(value))
+                return 'Invalid custom property key';
+        }
+    }
+    if (isPlainObject(filters) && Boolean(filters.cp_key) !== Boolean(filters.cp_value))
+        return 'cp_key and cp_value must be provided together';
+    if (isPlainObject(columns)) {
+        for (const list of [columns.order, columns.hidden]) {
+            if (list === undefined)
+                continue;
+            if (!Array.isArray(list) || list.length > SUBSCRIBER_VIEW_MAX_COLUMNS)
+                return 'Invalid column list';
+            for (const key of list) {
+                if (typeof key !== 'string' || !SUBSCRIBER_VIEW_KEY_RE.test(key) ||
+                    (!SUBSCRIBER_VIEW_COLUMNS.has(key) && !(key.startsWith('prop:') && SUBSCRIBER_VIEW_CUSTOM_PROPERTY_KEY_RE.test(key.slice(5))))) {
+                    return `Unknown column "${String(key)}". Use a subscriber column or prop:<custom property key>`;
+                }
+            }
+        }
+    }
+    return null;
+}
 function normalizeSubscriberViewKeys(value) {
     if (!Array.isArray(value))
         return [];
@@ -1075,9 +1120,12 @@ Requirements: urgency without desperation, acknowledge the gap, one clear CTA, v
             filters: z.record(z.string(), z.unknown()).optional(),
         },
     }, async ({ name, view_mode, columns, filters }) => {
+        const inputError = validateSubscriberViewInput(columns, filters);
+        if (inputError)
+            return toolError({ error: inputError, code: 'validation_failed' });
         const normalizedName = name.trim().slice(0, SUBSCRIBER_VIEW_MAX_NAME_LENGTH);
         if (!normalizedName)
-            return txt('Error: name is required');
+            return toolError({ error: 'name is required', code: 'validation_failed' });
         const { data, error } = await db()
             .from('subscriber_list_views')
             .insert({
@@ -1091,9 +1139,10 @@ Requirements: urgency without desperation, acknowledge the gap, one clear CTA, v
             .select('id, name, view_mode, columns, filters, created_by, created_at, updated_at')
             .maybeSingle();
         if (error?.code === '23505')
-            return txt(`Error: A view named "${normalizedName}" already exists`);
+            return toolError({ error: `A view named "${normalizedName}" already exists`, code: 'conflict' });
         if (error)
-            return txt(`Error: ${error.message}`);
+            return toolError(dbToolError(error));
+        await logAudit({ action: 'subscriber_view.saved', resourceType: 'subscriber_view', resourceId: data?.id });
         return j({ view: data });
     });
     server.registerTool('update_subscriber_view', {
@@ -1116,11 +1165,14 @@ Requirements: urgency without desperation, acknowledge the gap, one clear CTA, v
         if (name === undefined && view_mode === undefined && columns === undefined && filters === undefined) {
             return txt('Nothing to update');
         }
+        const inputError = validateSubscriberViewInput(columns, filters);
+        if (inputError)
+            return toolError({ error: inputError, code: 'validation_failed' });
         const updates = {};
         if (name !== undefined) {
             const normalizedName = name.trim().slice(0, SUBSCRIBER_VIEW_MAX_NAME_LENGTH);
             if (!normalizedName)
-                return txt('Error: name is required');
+                return toolError({ error: 'name is required', code: 'validation_failed' });
             updates.name = normalizedName;
         }
         if (view_mode !== undefined)
@@ -1137,11 +1189,12 @@ Requirements: urgency without desperation, acknowledge the gap, one clear CTA, v
             .select('id, name, view_mode, columns, filters, created_by, created_at, updated_at')
             .maybeSingle();
         if (error?.code === '23505')
-            return txt('Error: A view with that name already exists');
+            return toolError({ error: 'A view with that name already exists', code: 'conflict' });
         if (error)
-            return txt(`Error: ${error.message}`);
+            return toolError(dbToolError(error));
         if (!data)
-            return txt('View not found');
+            return toolError({ error: 'View not found', code: 'not_found' });
+        await logAudit({ action: 'subscriber_view.saved', resourceType: 'subscriber_view', resourceId: data?.id });
         return j({ view: data });
     });
     server.registerTool('delete_subscriber_view', {
@@ -1649,6 +1702,7 @@ Requirements: urgency without desperation, acknowledge the gap, one clear CTA, v
         },
         description: 'List contacts filtered by engagement score range and/or lifecycle stage. Useful for building re-engagement campaigns or identifying high-value contacts.',
         inputSchema: {
+            segment_id: z.string().uuid().optional().describe('Saved segment; mutually exclusive with inline audience filters'),
             lifecycle_stage: z.enum(['new', 'active', 'cooling', 'cold', 'churned', 'lead', 'trial', 'customer', 'win-back']).optional(),
             min_score: z.number().int().min(0).max(100).optional(),
             max_score: z.number().int().min(0).max(100).optional(),
@@ -1657,8 +1711,28 @@ Requirements: urgency without desperation, acknowledge the gap, one clear CTA, v
             company_domain: z.string().optional(),
             limit: z.number().int().min(1).max(200).optional().default(50),
         },
-    }, async ({ lifecycle_stage, min_score, max_score, site_id, company_id, company_domain, limit }) => {
+    }, async ({ segment_id, lifecycle_stage, min_score, max_score, site_id, company_id, company_domain, limit }) => {
         const projectId = getProjectId();
+        let segmentIds;
+        if (segment_id) {
+            if ([lifecycle_stage, min_score, max_score, site_id, company_id, company_domain].some(value => value !== undefined)) {
+                return toolError({ error: 'Provide segment_id or inline filters, not both', code: 'validation_failed' });
+            }
+            const { data: segment, error } = await db().from('segments').select('rules')
+                .eq('project_id', projectId).eq('id', segment_id).maybeSingle();
+            if (error)
+                return toolError(dbToolError(error));
+            if (!segment)
+                return toolError({ error: 'Segment not found', code: 'not_found' });
+            try {
+                segmentIds = await resolveSegmentContactIds(projectId, segment.rules);
+            }
+            catch (error) {
+                return toolError(isSegmentRulesError(error) ? { error: error.message, code: 'validation_failed' } : { error: 'Unable to evaluate segment', code: 'internal_error' });
+            }
+            if (!segmentIds.length)
+                return j([]);
+        }
         const embedOk = await hasCompaniesEmbed(projectId);
         let q = db()
             .from('subscribers')
@@ -1697,9 +1771,23 @@ Requirements: urgency without desperation, acknowledge the gap, one clear CTA, v
                 return { content: [{ type: 'text', text: '[]' }] };
             q = q.in('company_id', ids);
         }
+        if (segmentIds) {
+            const rows = [];
+            for (const ids of chunkIds(segmentIds)) {
+                // A Supabase builder is mutable; build a fresh query for each chunk.
+                const { data, error } = await db().from('subscribers')
+                    .select(embedOk ? SEGMENT_SUBSCRIBER_SELECT_WITH_COMPANY : SEGMENT_SUBSCRIBER_SELECT_NO_COMPANY)
+                    .eq('project_id', projectId).eq('global_unsubscribed', false).in('id', ids)
+                    .order('engagement_score', { ascending: false }).limit(limit ?? 50);
+                if (error)
+                    return toolError(dbToolError(error));
+                rows.push(...(data ?? []));
+            }
+            return j(rows.sort((a, b) => b.engagement_score - a.engagement_score).slice(0, limit ?? 50));
+        }
         const { data, error } = await q;
         if (error)
-            return { content: [{ type: 'text', text: `Error: ${error.message}` }] };
+            return toolError(dbToolError(error));
         return { content: [{ type: 'text', text: JSON.stringify(data, null, 2) }] };
     });
     server.registerTool('update_subscriber', {
@@ -2056,18 +2144,23 @@ Requirements: urgency without desperation, acknowledge the gap, one clear CTA, v
         },
     }, async ({ contact_ids, add_tags = [], remove_tags = [] }) => {
         if (!add_tags.length && !remove_tags.length)
-            return txt('No tags to add or remove.');
+            return toolError({ error: 'No tags to add or remove.', code: 'validation_failed' });
         const projectId = getProjectId();
         let updated = 0;
+        const missing_contact_ids = [];
         for (const cid of contact_ids) {
-            const { data: contact } = await db()
+            const { data: contact, error: readError } = await db()
                 .from('subscribers')
                 .select('id, email, first_name, last_name, custom_properties, tags')
                 .eq('id', cid)
                 .eq('project_id', projectId)
                 .maybeSingle();
-            if (!contact)
+            if (readError)
+                return toolError({ ...dbToolError(readError), updated });
+            if (!contact) {
+                missing_contact_ids.push(cid);
                 continue;
+            }
             const currentTags = contact.tags ?? [];
             const removeSet = new Set(remove_tags);
             const merged = currentTags.filter((t) => !removeSet.has(t));
@@ -2075,17 +2168,25 @@ Requirements: urgency without desperation, acknowledge the gap, one clear CTA, v
                 if (!merged.includes(t))
                     merged.push(t);
             }
-            const { error } = await db()
+            const { data: saved, error } = await db()
                 .from('subscribers')
                 .update({ tags: merged })
                 .eq('id', cid)
-                .eq('project_id', projectId);
-            if (!error) {
-                updated++;
-                await writeBackMcpContact(projectId, contact, { tags: merged });
+                .eq('project_id', projectId)
+                .select('id').maybeSingle();
+            if (error)
+                return toolError({ ...dbToolError(error), updated });
+            if (!saved) {
+                missing_contact_ids.push(cid);
+                continue;
             }
+            updated++;
+            await writeBackMcpContact(projectId, contact, { tags: merged });
+            await logAudit({ action: 'subscriber.tags_updated', resourceType: 'subscriber', resourceId: cid, details: { add_tags, remove_tags } });
         }
-        return j({ updated, total: contact_ids.length, add_tags, remove_tags });
+        if (!updated)
+            return toolError({ error: 'Subscriber not found', code: 'not_found', updated, missing_contact_ids });
+        return j({ missing_contact_ids, updated, total: contact_ids.length, add_tags, remove_tags });
     });
     server.registerTool('bulk_update_subscribers', {
         title: 'Bulk Update Subscribers',

package/build/tools/content.js

@@ -2,6 +2,9 @@ import { withApproval } from '../lib/action-approvals.js';
 import { z } from 'zod';
 import { adminDb, db } from '../db.js';
 import { getProjectId } from '../project.js';
+import { stripActiveEmailContent, validateUnsubscribeFooterTemplate } from '@sendinel/domain';
+import { dbToolError, toolError } from '../lib/db-error.js';
+import { logAudit } from '../audit.js';
 import { assertHttpUrl } from '../lib/url-validation.js';
 const j = (data) => ({ content: [{ type: 'text', text: JSON.stringify(data, null, 2) }] });
 const BLOG_IMAGE_FORMATS = ['square_image', 'story_image', 'animated_gif', 'short_video', 'carousel'];
@@ -219,7 +222,7 @@ export function registerContentTools(server) {
             idempotentHint: false,
             openWorldHint: false,
         },
-        description: 'Create a reusable content block.',
+        description: 'Create a reusable content block. Active HTML is rejected; footer blocks require an unsubscribe link or merge tag.',
         inputSchema: {
             name: z.string().min(1),
             category: z.enum(['header', 'footer', 'cta', 'legal', 'general']).optional().default('general'),
@@ -227,12 +230,19 @@ export function registerContentTools(server) {
             description: z.string().optional(),
         },
     }, async ({ name, category = 'general', html, description }) => {
+        const active = stripActiveEmailContent(html);
+        if (active.removed.length)
+            return toolError({ error: 'Active HTML is not allowed in content blocks', code: 'validation_failed' });
+        if (category === 'footer' && !/href\s*=\s*["']\s*\{\{\s*unsubscribe_url\s*\}\}/i.test(html) && !validateUnsubscribeFooterTemplate(html).ok) {
+            return toolError({ error: 'Footer blocks require {{unsubscribe_url}} in a link or <unsubscribe>link text</unsubscribe>', code: 'validation_failed' });
+        }
         const { data, error } = await db().from('content_blocks')
             .insert({ project_id: getProjectId(), name, category, html, description: description ?? null })
             .select('id, name, category, html, description, created_at')
             .single();
         if (error)
-            return j({ error: error.message });
+            return toolError(dbToolError(error));
+        await logAudit({ action: 'content_block.created', resourceType: 'content_block', resourceId: data.id });
         return j({ block: data });
     });
     server.registerTool('delete_content_block', {

package/build/tools/delivery-ops.js

@@ -6,6 +6,7 @@ import { adminDb, db } from '../db.js';
 import { assertChannelCanExecute, checkApproval, currentChannelContext, requestApproval, withApproval } from '../lib/action-approvals.js';
 import { callSendinelV1 } from '../lib/v1-client.js';
 import { getProjectId } from '../project.js';
+import { dbToolError, toolError } from '../lib/db-error.js';
 const j = (data) => ({ content: [{ type: 'text', text: JSON.stringify(data, null, 2) }] });
 function asRecord(value) {
     return value && typeof value === 'object' ? value : {};
@@ -154,18 +155,18 @@ export function registerDeliveryOpsTools(server) {
             .eq('id', domain_id)
             .maybeSingle();
         if (error)
-            return j({ error: error.message });
+            return toolError(dbToolError(error, 'Unable to load domain'));
         if (!data)
-            return j({ error: 'Domain not found', code: 'NOT_FOUND' });
+            return toolError({ error: 'Domain not found', code: 'NOT_FOUND' });
         const { data: health, error: healthError } = await db().from('domain_health')
             .select('spf_valid, dkim_valid, dmarc_valid, sites!inner(domain_id)')
-            .eq('project_id', getProjectId())
+            .eq('sites.project_id', getProjectId())
             .eq('sites.domain_id', domain_id)
             .order('check_date', { ascending: false })
             .limit(1)
             .maybeSingle();
         if (healthError)
-            return j({ error: healthError.message });
+            return toolError(dbToolError(healthError, 'Unable to load domain health'));
         const spf = health?.spf_valid ?? null;
         const dkim = health?.dkim_valid ?? null;
         const dmarc = health?.dmarc_valid ?? null;

package/build/tools/landing-pages.js

@@ -3,10 +3,55 @@ import { z } from 'zod';
 import { db } from '../db.js';
 import { getProjectId } from '../project.js';
 import { logAudit } from '../audit.js';
+import { stripActiveEmailContent } from '@sendinel/domain';
+import { dbToolError, toolError } from '../lib/db-error.js';
 const j = (data) => ({ content: [{ type: 'text', text: JSON.stringify(data, null, 2) }] });
 const SLUG_RE = /^[a-z0-9][a-z0-9\-]{0,62}$/;
 const VALID_STATUSES = ['draft', 'published', 'archived'];
 const LIST_COLUMNS = 'id, title, slug, site_id, status, form_id, blocks, meta_title, meta_description, conversion_event, views, conversions, background_color, accent_color, custom_css, created_at, updated_at, published_at';
+// Types rendered by LandingPageRenderer. Reuse the domain active-content pass.
+const BLOCK_TYPES = new Set(['hero', 'text', 'image', 'form', 'features', 'testimonial', 'cta', 'spacer']);
+const COLOR_RE = /^#(?:[0-9a-f]{3}|[0-9a-f]{6})$/i;
+function validatePageContent(input) {
+    for (const key of ['background_color', 'accent_color']) {
+        if (input[key] !== undefined && (typeof input[key] !== 'string' || !COLOR_RE.test(input[key]))) {
+            return `${key} must be a three- or six-digit hex color`;
+        }
+    }
+    if (input.custom_css != null && (typeof input.custom_css !== 'string' || /<\s*\/\s*style|<\s*script|javascript\s*:|expression\s*\(|@import/i.test(input.custom_css))) {
+        return 'custom_css contains unsafe content';
+    }
+    if (input.blocks !== undefined && (!Array.isArray(input.blocks) || input.blocks.some(block => !block || typeof block !== 'object' || !BLOCK_TYPES.has(block.type)))) {
+        return `Each block must have a recognized type: ${[...BLOCK_TYPES].join(', ')}`;
+    }
+    return null;
+}
+function sanitizeBlockValue(value) {
+    if (typeof value === 'string') {
+        // Also inspect bare URL fields (ctaUrl/url/src), using the same URL decoder
+        // as HTML attributes rather than a second scheme blacklist.
+        const url = stripActiveEmailContent(`<a href="${value.replace(/"/g, '&quot;')}">`);
+        if (url.removed.some(finding => finding.endsWith(' URL')))
+            return '';
+        return stripActiveEmailContent(value).html;
+    }
+    if (Array.isArray(value))
+        return value.map(sanitizeBlockValue);
+    if (value && typeof value === 'object')
+        return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, sanitizeBlockValue(item)]));
+    return value;
+}
+async function validatePageForm(formId) {
+    if (!formId)
+        return null;
+    const { data, error } = await db().from('signup_forms').select('id')
+        .eq('project_id', getProjectId()).eq('id', formId).maybeSingle();
+    if (error)
+        return dbToolError(error, 'Unable to load form');
+    if (!data)
+        return { error: 'form_id not found in this project', code: 'not_found' };
+    return null;
+}
 function slugify(text) {
     return text
         .toLowerCase()
@@ -53,7 +98,7 @@ export function registerLandingPageTools(server) {
     server.registerTool('create_landing_page', {
         title: 'Create Landing Page',
         annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
-        description: 'Create a draft landing page. Publish it with update_landing_page by setting status to published.',
+        description: 'Create a draft landing page. Blocks require a renderer type and have active content stripped; colors must be hex and custom_css must be safe. Publish with update_landing_page.',
         inputSchema: {
             title: z.string().trim().min(1).max(200),
             slug: z.string().trim().regex(SLUG_RE, 'Lowercase alphanumeric + hyphens, max 63 chars').optional(),
@@ -72,7 +117,13 @@ export function registerLandingPageTools(server) {
         const normalizedTitle = title.trim();
         const normalizedSlug = (slug ?? slugify(normalizedTitle)).trim();
         if (!SLUG_RE.test(normalizedSlug))
-            return j({ error: 'Invalid slug (lowercase alphanumeric + hyphens, max 63 chars)' });
+            return toolError({ error: 'Invalid slug (lowercase alphanumeric + hyphens, max 63 chars)', code: 'validation_failed' });
+        const contentError = validatePageContent({ blocks, background_color, accent_color, custom_css });
+        if (contentError)
+            return toolError({ error: contentError, code: 'validation_failed' });
+        const formError = await validatePageForm(form_id);
+        if (formError)
+            return toolError(formError);
         const insert = {
             project_id: projectId,
             title: normalizedTitle,
@@ -83,7 +134,7 @@ export function registerLandingPageTools(server) {
         if (form_id)
             insert.form_id = form_id;
         if (blocks)
-            insert.blocks = blocks;
+            insert.blocks = sanitizeBlockValue(blocks);
         if (meta_title)
             insert.meta_title = meta_title;
         if (meta_description)
@@ -103,8 +154,10 @@ export function registerLandingPageTools(server) {
             .single();
         if (error) {
             if (error.code === '23505')
-                return j({ error: 'A page with this slug already exists' });
-            return j({ error: error.message });
+                return toolError({ error: 'A page with this slug already exists', code: 'conflict' });
+            if (error.code === '23503')
+                return toolError({ error: 'Referenced form or site not found', code: 'not_found' });
+            return toolError(dbToolError(error));
         }
         await logAudit({
             action: 'landing_page.created',
@@ -136,6 +189,24 @@ export function registerLandingPageTools(server) {
         },
     }, withApproval('update_landing_page', async ({ page_id, title, slug, status, site_id, form_id, blocks, meta_title, meta_description, conversion_event, background_color, accent_color, custom_css }) => {
         const projectId = getProjectId();
+        // Validate the effective document on publish, including unsafe older drafts.
+        let content = { blocks, background_color, accent_color, custom_css };
+        if (status === 'published') {
+            const { data: existing, error: readError } = await db().from('landing_pages')
+                .select('blocks, background_color, accent_color, custom_css, form_id')
+                .eq('id', page_id).eq('project_id', projectId).maybeSingle();
+            if (readError)
+                return toolError(dbToolError(readError));
+            if (!existing)
+                return toolError({ error: 'Landing page not found', code: 'not_found' });
+            content = { ...existing, ...Object.fromEntries(Object.entries(content).filter(([, value]) => value !== undefined)) };
+        }
+        const contentError = validatePageContent(content);
+        if (contentError)
+            return toolError({ error: contentError, code: 'validation_failed' });
+        const formError = await validatePageForm(form_id === undefined ? content.form_id : form_id);
+        if (formError)
+            return toolError(formError);
         const updates = { updated_at: new Date().toISOString() };
         if (title !== undefined)
             updates.title = title.trim();
@@ -151,7 +222,7 @@ export function registerLandingPageTools(server) {
         if (form_id !== undefined)
             updates.form_id = form_id;
         if (blocks !== undefined)
-            updates.blocks = blocks;
+            updates.blocks = sanitizeBlockValue(blocks);
         if (meta_title !== undefined)
             updates.meta_title = meta_title;
         if (meta_description !== undefined)
@@ -164,18 +235,24 @@ export function registerLandingPageTools(server) {
             updates.accent_color = accent_color;
         if (custom_css !== undefined)
             updates.custom_css = custom_css;
+        if (status === 'published' && content.blocks !== undefined)
+            updates.blocks = sanitizeBlockValue(content.blocks);
         const { data, error } = await db()
             .from('landing_pages')
             .update(updates)
             .eq('id', page_id)
             .eq('project_id', projectId)
             .select()
-            .single();
+            .maybeSingle();
         if (error) {
             if (error.code === '23505')
-                return j({ error: 'A page with this slug already exists' });
-            return j({ error: error.message });
+                return toolError({ error: 'A page with this slug already exists', code: 'conflict' });
+            if (error.code === '23503')
+                return toolError({ error: 'Referenced form or site not found', code: 'not_found' });
+            return toolError(dbToolError(error));
         }
+        if (!data)
+            return toolError({ error: 'Landing page not found', code: 'not_found' });
         await logAudit({
             action: 'landing_page.updated',
             resourceType: 'landing_page',

package/build/tools/segments.js

@@ -4,6 +4,7 @@ import { z } from 'zod';
 import Anthropic from '@anthropic-ai/sdk';
 import { db } from '../db.js';
 import { getProjectId } from '../project.js';
+import { dbToolError, toolError } from '../lib/db-error.js';
 import { getAnthropicModelId } from '../anthropic-model.js';
 import { AI_MAX_TOKENS, outputConfig, anthropicCheckedText } from '@sendinel/domain';
 import { applySegmentRules, buildSegmentBaseQuery, evaluateSegmentRules, hydrateEmailSendsContacts, isSegmentRulesError, normalizeSegmentRulesToTree, prepareSegmentRulesForStorage, readAllRows, } from '@sendinel/domain';
@@ -89,7 +90,7 @@ export function registerSegmentTools(server) {
             catch (rulesError) {
                 const invalid = invalidRules(rulesError);
                 if (invalid)
-                    return invalid;
+                    return toolError({ error: rulesError instanceof Error ? rulesError.message : 'Invalid segment rules', code: 'validation_failed' });
                 throw rulesError;
             }
             const { data, error } = await db()
@@ -97,8 +98,10 @@ export function registerSegmentTools(server) {
                 .insert({ project_id: getProjectId(), name, description, rules: storedRules })
                 .select('id, name, description, rules, created_at')
                 .single();
+            if (error?.code === '23505')
+                return toolError({ error: 'A segment with this name already exists', code: 'conflict' });
             if (error)
-                return dbErrorResult(error);
+                return toolError(dbToolError(error));
             // Count against the stored (normalized) tree, not the raw input: a tree skips
             // applySegmentRules' SQL push-down and filters in JS, which is what list_segments
             // does for this same segment a moment later. Pushing the flat rules down instead

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sendinel/mcp-server",
-  "version": "1.0.140",
+  "version": "1.0.142",
   "description": "AI-controlled email operations control plane for campaigns, contacts, segments, analytics, and multi-provider sending via MCP.",
   "mcpName": "ai.sendinel/mcp-server",
   "type": "module",