@sendinel/mcp-server 1.0.162 → 1.0.164

package/README.md

@@ -18,7 +18,7 @@ preserves REST outcomes, and redacts failures. See the
 [event-triggered campaign guide](../../docs/event-triggered-campaigns.md) for
 inputs, idempotency, subscription requirements, and conditional step examples.
 
-Sendinel currently exposes 35 tool groups and 348 tools (gateway mode exposes 4 meta-tools, sharing how_to with full mode). These counts are checked against the tool registry in CI, so this table matches what ships.
+Sendinel currently exposes 35 tool groups and 349 tools (gateway mode exposes 4 meta-tools, sharing how_to with full mode). These counts are checked against the tool registry in CI, so this table matches what ships.
 
 | Group | Count | Purpose |
 |-------|-------|---------|
@@ -27,7 +27,7 @@ Sendinel currently exposes 35 tool groups and 348 tools (gateway mode exposes 4
 | `advisor` | 6 | Campaign advisor: recommendations, benchmarks, subject/content/send-time guidance |
 | `ai-work` | 9 | AI work items, recommended segments, context events, agent proposals |
 | `analytics` | 15 | Stats, portfolio analytics, project switching, domain health, engagement, deliverability, revenue analytics |
-| `approvals` | 5 | Poll/list approvals, person OAuth approval, write-scoped cancellation, opted-in chat confirmation |
+| `approvals` | 6 | Poll/list approvals, person OAuth approval, write-scoped cancellation, opted-in chat confirmation |
 | `automations` | 7 | Automation triggers, previews, and response-gated escalation ladders |
 | `brand_kit` | 6 | Brand Core text import, media library upload/URL ingest, asset-context reads, project logo selection |
 | `campaigns` | 44 | Full campaign lifecycle: create, edit, approve, launch, enroll, schedule, sequence templates, convert imported campaigns |

package/build/lib/action-approvals.d.ts

@@ -31,7 +31,7 @@ export interface ExecutionDecision {
  * from getApprovalTier(), which only decides the tier itself. Call this before
  * requestApproval() at every gated/protected call site.
  */
-export declare function assertChannelCanExecute(action: string, params: Record<string, unknown> | undefined, context: ChannelExecutionContext): ExecutionDecision;
+export declare function assertChannelCanExecute(action: string, params: Record<string, unknown> | undefined, context: ChannelExecutionContext): Promise<ExecutionDecision>;
 /** Convenience: pull channel/verified out of the request-scoped context, defaulting to today's only live caller (mcp_api_key). */
 export declare function currentChannelContext(): ChannelExecutionContext;
 /**
@@ -71,7 +71,8 @@ type AdminApprovalAuthority = {
     id?: string;
     action: string;
     projectId: string;
-    phase: 'preview' | 'approved';
+    phase: 'preview' | 'approved' | 'level';
+    levelUserId?: string;
     decidedBy?: string;
     decisionChannel?: 'sandbox';
 };
@@ -105,6 +106,12 @@ type ToolResult = {
         text: string;
     }>;
 };
+export declare function approvalSatisfied(action: string): boolean;
+/** Catch preview/draft branches that historically returned before their hand-written gate.
+ * Existing gated execution paths retain their frozen-payload approval flow. */
+export declare function withPreviewApproval<A extends object, R extends ToolResult>(action: string, handler: (args: A, extra?: unknown) => Promise<R> | R): (args: A & {
+    approval_id?: string;
+}, extra?: unknown) => Promise<R | ToolResult>;
 export declare function markNotExecuted<R extends object>(result: R): R;
 /** HTTP statuses that mean the request was refused before it changed anything. */
 export declare function isPreExecutionStatus(status: number | undefined): boolean;

package/build/lib/action-approvals.js

@@ -1,3 +1,4 @@
+import { effectiveApproval, auditApprovalLevel } from './approval-classes.js';
 import { sandboxApprovalEligible, trySandboxApproval } from './sandbox-approvals.js';
 import { humanApprovalEligible } from './approval-human-eligibility.js';
 import { AsyncLocalStorage } from 'node:async_hooks';
@@ -92,8 +93,16 @@ const TIER2_CHANNELS = new Set([
  * from getApprovalTier(), which only decides the tier itself. Call this before
  * requestApproval() at every gated/protected call site.
  */
-export function assertChannelCanExecute(action, params, context) {
-    const tier = getApprovalTier(action, params);
+export async function assertChannelCanExecute(action, params, context) {
+    if (approvalSatisfied(action))
+        return { allowed: true, tier: 'autonomous' };
+    const effective = await effectiveApproval(action, params);
+    const originalTier = getApprovalTier(action, params);
+    const tier = effective.prompt ? (originalTier === 'autonomous' ? 'gated' : originalTier) : 'autonomous';
+    // An unverified caller never gains an exemption through a level.
+    if (effective.applied && !context.verified)
+        return { allowed: false, tier, reason: 'Verified channel required.' };
+    await auditApprovalLevel(action, effective);
     if (tier === 'autonomous')
         return { allowed: true, tier };
     if (!context.verified) {
@@ -267,20 +276,26 @@ function approvalParamsEqual(expected, actual) {
  * and returns instructions for the agent to wait.
  */
 export async function requestApproval(action, params, apiKeyId, channelContext, display) {
-    const tier = getApprovalTier(action, params);
+    const effective = await effectiveApproval(action, params);
+    const originalTier = getApprovalTier(action, params);
+    const tier = originalTier === 'autonomous' ? 'gated' : originalTier;
     const expiresAt = new Date(Date.now() + 24 * 60 * 60 * 1000).toISOString();
     const { channel, verified } = channelContext ?? currentChannelContext();
     const actor = requestContext();
     // Ignore any model-supplied reserved field; freeze facts read by the server.
     const cleanParams = withoutApprovalSnapshot(params);
-    const snapshot = await captureSnapshot(action, cleanParams);
+    const snapshot = { ...await captureSnapshot(action, cleanParams), ...(effective.applied ? { approval_class: effective.class, approval_channel_rule: effective.channelRule } : {}),
+        ...(display && 'recipient_count' in display ? { display_recipient_count: display.recipient_count } : {}) };
     const payload = cleanParams.payload;
     if (action === 'send_broadcast' && Array.isArray(payload?.contact_ids) && Array.isArray(snapshot.contact_ids) &&
         !approvalParamsEqual({ ids: [...payload.contact_ids].sort() }, { ids: snapshot.contact_ids })) {
         throw new Error('Approval audience changed while preparing the preview. Request a new approval.');
     }
     const frozenParams = { ...cleanParams, __approval_snapshot: snapshot };
-    const summary = buildApprovalSummary(action, frozenParams, display);
+    const detailSummary = buildApprovalSummary(action, frozenParams, display);
+    const preview = buildApprovalPreview({ action, params: frozenParams, summary: detailSummary,
+        ...(display && 'recipient_count' in display ? { recipientCount: display.recipient_count } : {}) });
+    const summary = `${preview.plain_summary.split('\n')[0]}\n${detailSummary}`;
     const { data, error } = await approvalStore()
         .from('action_approvals')
         .insert({
@@ -303,7 +318,7 @@ export async function requestApproval(action, params, apiKeyId, channelContext,
         throw new Error(`Failed to create approval request: ${error.message}`);
     let projectName;
     let sandboxDisplayRead = false;
-    const sandboxApproved = tier === 'gated' && await trySandboxApproval(data.id, getProjectId(), action, approvalPayloadHash(action, frozenParams), name => { projectName = name; sandboxDisplayRead = true; });
+    const sandboxApproved = !(effective.applied && (effective.level === 'ask_every_time' || effective.class === 'F')) && tier === 'gated' && await trySandboxApproval(data.id, getProjectId(), action, approvalPayloadHash(action, frozenParams), name => { projectName = name; sandboxDisplayRead = true; });
     if (isTesterRequest(action))
         await logTesterRequestAudit('tester_request', action, data.id, null);
     fireWebhookEvent('approval.requested', {
@@ -337,7 +352,7 @@ export async function requestApproval(action, params, apiKeyId, channelContext,
         : '';
     const result = await elicitApproval({
         requires_approval: true,
-        ...(await offerApprovalApp({ id: data.id, action, params: frozenParams, summary, tier, expires_at: expiresAt,
+        ...(effective.channelRule === 'human_only' ? {} : await offerApprovalApp({ id: data.id, action, params: frozenParams, summary, tier, expires_at: expiresAt,
             payload_hash: approvalPayloadHash(action, frozenParams) })),
         approval_id: data.id,
         tier,
@@ -347,8 +362,8 @@ export async function requestApproval(action, params, apiKeyId, channelContext,
         approve_via: 'Open approve_url (works on a phone) or Dashboard → Settings → Pending Approvals',
         approve_url: approveUrl,
         preview_text: previewText,
-        message: `Tap to approve: ${approveUrl}\n${previewText}\nIt stays open for 24 hours. In a terminal with prompts you can also answer the on-screen Accept/Decline.${chatGuidance}`,
-    }, { action, params: frozenParams, summary, projectName }, getProjectId());
+        message: `${previewText}\nTap to approve: ${approveUrl}\nIt stays open for 24 hours. ${effective.channelRule === 'human_only' ? 'Use the dashboard link or a typed chat reply.' : 'In a terminal with prompts you can also answer the on-screen Accept/Decline.'}${chatGuidance}`,
+    }, { action, params: frozenParams, summary, projectName, channelRule: effective.channelRule }, getProjectId());
     if (result.decision_status === 'approved') {
         return { ...result, message: 'Approved. Call this tool again with the same arguments plus approval_id to run it.' };
     }
@@ -444,6 +459,9 @@ async function checkApprovalState(approvalId, options = {}) {
         !await sandboxApprovalEligible(getProjectId(), data.action))) {
         return { approved: false, status: 'sandbox_decision_no_longer_eligible' };
     }
+    if (data.status === 'approved' && data.params?.__approval_snapshot?.approval_channel_rule === 'human_only' && !['dashboard', 'chat_confirm'].includes(data.decided_via)) {
+        return { approved: false, status: 'human_decision_required' };
+    }
     if (data.status === 'approved' && !sandboxDecision && (!isHumanApprovalChannel(data.decided_via) ||
         (isHumanRequestableAdminTool(data.action) && data.decided_via !== 'dashboard' &&
             (!['mcp_app', 'mcp_elicitation', 'chat_confirm', 'mcp_person'].includes(data.decided_via) ||
@@ -494,6 +512,9 @@ async function checkApprovalState(approvalId, options = {}) {
     if (claimError || !claimed) {
         return { approved: false, status: 'consumed' };
     }
+    if ((await effectiveApproval(data.action, withoutApprovalSnapshot(data.params))).channelRule === 'human_only' && !['dashboard', 'chat_confirm'].includes(data.decided_via)) {
+        return { approved: false, status: 'human_decision_required' };
+    }
     return {
         approved: true,
         status: 'approved',
@@ -505,6 +526,30 @@ async function checkApprovalState(approvalId, options = {}) {
 function toolText(value) {
     return { content: [{ type: 'text', text: value }] };
 }
+const satisfiedApproval = new AsyncLocalStorage();
+export function approvalSatisfied(action) {
+    const authority = registeredApproval.getStore();
+    return satisfiedApproval.getStore() === action || (authority?.phase === 'level' && authority.action === action && authority.projectId === getProjectId());
+}
+/** Catch preview/draft branches that historically returned before their hand-written gate.
+ * Existing gated execution paths retain their frozen-payload approval flow. */
+export function withPreviewApproval(action, handler) {
+    return async (args, extra) => {
+        const params = args;
+        const previewBranch = (['launch_campaign', 'create_campaign_with_content'].includes(action) && params.confirmed !== true) ||
+            ['update_campaign', 'set_campaign_trigger'].includes(action);
+        if (!previewBranch && getApprovalTier(action, params) !== 'autonomous')
+            return handler(args, extra);
+        const decision = await effectiveApproval(action, args);
+        if (!decision.applied || (previewBranch && !['launch_campaign', 'create_campaign_with_content'].includes(action) && decision.level !== 'ask_every_time'))
+            return handler(args, extra);
+        if (!decision.prompt) {
+            await auditApprovalLevel(action, decision);
+            return satisfiedApproval.run(action, () => handler(args, extra));
+        }
+        return withApproval(action, (params, innerExtra) => satisfiedApproval.run(action, () => handler(params, innerExtra)))(args, extra);
+    };
+}
 /**
  * Wrap a tool handler in the standard approval flow (#4005). In standard mode the first call
  * (no approval_id) records the exact arguments and returns the approval request without running
@@ -530,13 +575,13 @@ export function withApproval(action, handler, options = {}) {
     return async (args, extra) => {
         const { approval_id, ...params } = args;
         const channelContext = currentChannelContext();
-        const decision = assertChannelCanExecute(action, params, channelContext);
+        const decision = await assertChannelCanExecute(action, params, channelContext);
         if (!decision.allowed)
             return toolText(decision.reason ?? 'This channel cannot request this action.');
         let decidedBy;
         let decisionChannel;
         let consumedAt;
-        if (options.registeredRequestOnly || decision.tier !== 'autonomous') {
+        if (decision.tier !== 'autonomous') {
             if (!approval_id) {
                 const display = options.display ? await options.display(params) : undefined;
                 return toolText(JSON.stringify(await requestApproval(action, params, undefined, channelContext, display), null, 2));
@@ -550,7 +595,8 @@ export function withApproval(action, handler, options = {}) {
             }
         }
         if (options.registeredRequestOnly) {
-            return registeredApproval.run({ id: approval_id, action, projectId: getProjectId(), phase: 'approved', decidedBy, decisionChannel }, () => handler(args, extra));
+            return registeredApproval.run({ id: approval_id, action, projectId: getProjectId(), phase: decision.tier === 'autonomous' ? 'level' : 'approved',
+                ...(decision.tier === 'autonomous' ? { levelUserId: requestContext()?.actorId ?? undefined } : {}), decidedBy, decisionChannel }, () => handler(args, extra));
         }
         const result = await handler(params, extra);
         // Keep the atomic claim across the outbound hop. Only a definitive pre-acceptance

package/build/lib/approval-classes.d.ts

@@ -0,0 +1,17 @@
+import { type ApprovalClass, type ApprovalLevel } from '@sendinel/domain';
+import { type HumanDecisionIdentity } from './approval-human-eligibility.js';
+export { APPROVAL_CLASSES, approvalClass } from '@sendinel/domain';
+export type { ApprovalClass, ApprovalLevel } from '@sendinel/domain';
+export type EffectiveApproval = {
+    prompt: boolean;
+    channelRule: 'any' | 'human_only';
+    class: ApprovalClass | undefined;
+    level: ApprovalLevel;
+    applied: boolean;
+};
+/** No transport-supplied role or preference grants authority: verify the live person grant. */
+export declare function personApprovalLevel(ctx?: HumanDecisionIdentity | undefined, action?: string): Promise<ApprovalLevel | null>;
+/** One decision function. Lookup errors preserve today's tier, including preview exceptions. */
+export declare function effectiveApproval(action: string, params?: Record<string, unknown>, ctx?: HumanDecisionIdentity | undefined): Promise<EffectiveApproval>;
+/** Audit must succeed before a level can authorize execution. Never turn an audit failure into a send. */
+export declare function auditApprovalLevel(action: string, decision: EffectiveApproval): Promise<void>;

package/build/lib/approval-classes.js

@@ -0,0 +1,107 @@
+import { approvalClass, isApprovalLevel, matchSendAllowlist, readContactTestStatus } from '@sendinel/domain';
+import { adminDb, requestContext } from '../db.js';
+import { getProjectId } from '../project.js';
+import { humanApprovalEligible } from './approval-human-eligibility.js';
+import { getApprovalTier } from './action-approvals.js';
+export { APPROVAL_CLASSES, approvalClass } from '@sendinel/domain';
+/** No transport-supplied role or preference grants authority: verify the live person grant. */
+export async function personApprovalLevel(ctx = requestContext(), action = 'get_approval_level') {
+    if (ctx?.scopes?.some(scope => scope === 'service' || scope.startsWith('service:')))
+        return null;
+    try {
+        if (!await humanApprovalEligible(action, getProjectId(), ctx, false, () => adminDb().schema('email')))
+            return null;
+        const { data, error } = await adminDb().schema('email').from('approval_preferences')
+            .select('level').eq('user_id', ctx.actorId).maybeSingle();
+        if (error || (data && !isApprovalLevel(data.level)))
+            return null;
+        return data?.level ?? 'default';
+    }
+    catch {
+        return null;
+    }
+}
+/** Explicit mailbox allowlists only: a NULL policy means unrestricted, never test-safe. */
+async function safeAddresses(addresses, ctx) {
+    if (!addresses.length || !ctx.actorId)
+        return false;
+    const client = adminDb();
+    const { data, error } = await client.auth.admin.getUserById(ctx.actorId);
+    if (error || !data?.user?.email)
+        return false;
+    const remaining = addresses.filter(address => address.trim().toLowerCase() !== data.user.email.toLowerCase());
+    if (!remaining.length)
+        return true;
+    const project = await client.schema('email').from('projects')
+        .select('send_allowlist, org_id, org:organizations(send_allowlist)').eq('id', getProjectId()).single();
+    if (project.error || !project.data)
+        return false;
+    const lists = [project.data.send_allowlist, project.data.org?.send_allowlist].filter(Array.isArray);
+    return remaining.every(address => lists.some(list => !matchSendAllowlist(list, { to: address })));
+}
+async function exemptTargets(action, params, ctx) {
+    try {
+        if (action === 'draft_agent_reply')
+            return true;
+        if (action === 'send_test_email') {
+            // Include every copied recipient defensively; never infer recipients from display text.
+            const copied = [params.cc, params.bcc].filter(value => value !== undefined);
+            if (copied.some(value => !Array.isArray(value) || value.some(address => typeof address !== 'string')))
+                return false;
+            return typeof params.to_email === 'string' && await safeAddresses([params.to_email, ...copied.flat()], ctx);
+        }
+        // Filters and segments are open audiences, never an exemption based on a sample.
+        if (['enroll_segment', 'add_list_members_by_filter'].includes(action))
+            return false;
+        const ids = Array.isArray(params.contact_ids) ? params.contact_ids : params.contact_id ? [params.contact_id] : [];
+        if (ids.length) {
+            if (ids.some(id => typeof id !== 'string'))
+                return false;
+            const contacts = await readContactTestStatus(adminDb(), getProjectId(), ids);
+            return (await Promise.all(contacts.map(contact => contact.is_test === true ||
+                (typeof contact.email === 'string' && safeAddresses([contact.email], ctx))))).every(Boolean);
+        }
+        // Never trust a model-supplied is_test flag. Read the saved record by its address.
+        const address = params.email;
+        if (typeof address !== 'string')
+            return false;
+        if (await safeAddresses([address], ctx))
+            return true;
+        const { data, error } = await adminDb().schema('email').from('subscribers')
+            .select('is_test').eq('project_id', getProjectId()).eq('email', address.trim().toLowerCase()).maybeSingle();
+        return !error && data?.is_test === true;
+    }
+    catch {
+        return false;
+    }
+}
+/** One decision function. Lookup errors preserve today's tier, including preview exceptions. */
+export async function effectiveApproval(action, params = {}, ctx = requestContext()) {
+    const baseline = getApprovalTier(action, params) !== 'autonomous';
+    let kind = approvalClass(action);
+    const level = kind ? await personApprovalLevel(ctx, action) : null;
+    if (!level)
+        return { prompt: baseline, channelRule: 'any', class: kind, level: 'default', applied: false };
+    const exempt = (kind === 'T' || kind === 'E') && await exemptTargets(action, params, ctx);
+    if (action === 'send_test_email' && !exempt)
+        kind = 'S';
+    // Live trigger edits have an additional domain gate even under the legacy autonomous mode.
+    const triggerGate = ['update_campaign', 'set_campaign_trigger'].includes(action) && !!params.previous_campaign && !!params.updates;
+    const prompt = level === 'ask_every_time' ? true : level === 'auto' ? (kind === 'F' || kind === 'D') : (baseline || triggerGate) && !exempt;
+    return { prompt, class: kind, level, applied: true,
+        channelRule: level === 'ask_every_time' && (kind === 'S' || kind === 'F' || (kind === 'E' && !exempt)) ? 'human_only' : 'any' };
+}
+/** Audit must succeed before a level can authorize execution. Never turn an audit failure into a send. */
+export async function auditApprovalLevel(action, decision) {
+    if (decision.prompt || !decision.applied || (decision.level === 'default' && decision.class !== 'T' && decision.class !== 'E'))
+        return;
+    const ctx = requestContext();
+    const { error } = await adminDb().schema('email').from('audit_log').insert({
+        project_id: getProjectId(), actor_type: 'user', actor_id: ctx.actorId,
+        action: 'approval.level_applied', resource_type: 'approval',
+        details: { action, class: decision.class, level: decision.level, user_id: ctx.actorId,
+            connection_id: `oauth:${ctx.oauthTokenId}`, reason: 'level' },
+    });
+    if (error)
+        throw new Error('Could not record your approval level. Nothing was run.');
+}

package/build/lib/approval-elicitation.d.ts

@@ -57,6 +57,7 @@ export declare function elicitApproval<T extends ApprovalFallback>(result: T, fr
     params: unknown;
     summary: string;
     projectName?: string;
+    channelRule?: 'any' | 'human_only';
 }, projectId: string): Promise<T & {
     decision_status: ElicitationDecision;
 }>;

package/build/lib/approval-elicitation.js

@@ -29,6 +29,8 @@ export async function elicitApproval(result, frozen, projectId) {
     const pending = { ...result, decision_status: 'decision_pending' };
     const warn = (reason) => console.warn('[approval_wait]', { stage: 'elicitation', reason });
     const exit = (reason) => { warn(reason); return pending; };
+    if (frozen.channelRule === 'human_only')
+        return exit('human_only');
     const context = requests.getStore();
     if (!context)
         return exit('no_transport_context');

package/build/lib/approval-human-callback.js

@@ -1,3 +1,4 @@
+import { effectiveApproval } from './approval-classes.js';
 import { humanApprovalEligible } from './approval-human-eligibility.js';
 import { requestContext } from '../db.js';
 import { randomUUID } from 'node:crypto';
@@ -21,11 +22,14 @@ export function createHumanApprovalCallback(binding) {
             const source = approvalStore();
             const client = typeof source.schema === 'function' ? source.schema('email') : source;
             const { data: approval, error: loadError } = await client.from('action_approvals')
-                .select('action').eq('id', binding.approvalId).eq('project_id', binding.projectId).maybeSingle();
+                .select('action, params').eq('id', binding.approvalId).eq('project_id', binding.projectId).maybeSingle();
             if (loadError || typeof approval?.action !== 'string' || !approval.action ||
                 requestContext()?.actorId !== binding.userId ||
                 !await humanApprovalEligible(approval.action, binding.projectId))
                 return false;
+            if (approval.params?.__approval_snapshot?.approval_channel_rule === 'human_only' ||
+                (await effectiveApproval(approval.action, approval.params)).channelRule === 'human_only')
+                return false;
             const now = new Date().toISOString();
             const { data, error } = await client.from('action_approvals')
                 .update({ status: response.decision === 'approve' ? 'approved' : 'rejected', decided_via: binding.channel,

package/build/lib/approval-human-eligibility.d.ts

@@ -1,3 +1,4 @@
+import { approvalStore } from './tester-requests-store.js';
 export type HumanDecisionIdentity = {
     projectId?: string;
     actorId?: string | null;
@@ -11,7 +12,7 @@ export type HumanDecisionIdentity = {
  * (for admin requests) the project's org membership on every prompt and every decision.
  * Missing connection_role is NOT a human grant: it must be exactly SQL NULL.
  */
-export declare function humanApprovalEligible(action: string, projectId: string, identity?: HumanDecisionIdentity | undefined, requireChatConfirm?: boolean): Promise<boolean>;
+export declare function humanApprovalEligible(action: string, projectId: string, identity?: HumanDecisionIdentity | undefined, requireChatConfirm?: boolean, store?: () => ReturnType<typeof approvalStore>): Promise<boolean>;
 /** Opt-in is a live grant fact as well as a transport snapshot; errors never enable it. */
 export declare function chatConfirmConnectionEnabled(identity?: {
     scopes?: readonly string[];

package/build/lib/approval-human-eligibility.js

@@ -5,14 +5,14 @@ import { isHumanRequestableAdminTool } from './admin-tools.js';
  * (for admin requests) the project's org membership on every prompt and every decision.
  * Missing connection_role is NOT a human grant: it must be exactly SQL NULL.
  */
-export async function humanApprovalEligible(action, projectId, identity = requestContext(), requireChatConfirm = false) {
+export async function humanApprovalEligible(action, projectId, identity = requestContext(), requireChatConfirm = false, store) {
     if (!identity || identity.channelVerified !== true || identity.authKind !== 'oauth' ||
         (requireChatConfirm && identity.chatConfirmEnabled !== true) ||
         !identity.actorId || !identity.oauthTokenId || identity.projectId !== projectId || !projectId ||
         identity.scopes?.some(scope => scope === 'tester' || scope === 'agent'))
         return false;
     try {
-        const source = approvalStore();
+        const source = store ? store() : approvalStore();
         const client = typeof source.schema === 'function' ? source.schema('email') : source;
         const { data: grant, error } = await client.from('mcp_oauth_tokens')
             .select('id, user_id, connection_role, scopes, revoked_at, expires_at, chat_confirm_enabled')

package/build/lib/approval-snapshot.d.ts

@@ -23,6 +23,15 @@ export declare function captureApprovalDisplay(action: string, params: Params, p
 /** Exclude only optional display facts from revalidation, never from the payload hash. */
 export declare function withoutApprovalDisplay(snapshot: Params): Params;
 /** Server-owned display facts, saved inside the hash-bound params. Never supplied by a tool. */
-export declare function captureApprovalSnapshot(action: string, params: Params, projectId: string): Promise<Params>;
+export declare function captureApprovalSnapshot(action: string, params: Params, projectId: string): Promise<{
+    version: number;
+    invitation: Params;
+    recipient_count: number;
+} | {
+    display?: {
+        target_name: string;
+        target_detail?: string | undefined;
+    } | undefined;
+}>;
 export declare function withoutApprovalSnapshot(params: unknown): Record<string, unknown>;
 export {};

package/build/lib/approval-snapshot.js

@@ -1,6 +1,6 @@
 import { isTesterRequest } from './tester-policy.js';
 import { captureTesterRequestSnapshot } from './tester-request-snapshot.js';
-import { readAllRows, chunkIds, scopeSegmentRulesToSite, approvalDisplayFact, parseLinkedInCommentUrl } from '@sendinel/domain';
+import { campaignMatchesTrigger, normalizeTriggerList, readAllRows, chunkIds, scopeSegmentRulesToSite, approvalDisplayFact, parseLinkedInCommentUrl } from '@sendinel/domain';
 import { callSendinelV1 } from './v1-client.js';
 import { adminDb, db } from '../db.js';
 import { resolveSendAudience, resolveSegmentContactIds } from './send-audience.js';
@@ -155,9 +155,45 @@ export async function captureApprovalDisplay(action, params, projectId) {
 }
 /** Exclude only optional display facts from revalidation, never from the payload hash. */
 export function withoutApprovalDisplay(snapshot) {
-    const { display: _display, ...rest } = snapshot;
+    const { display: _display, approval_class: _class, approval_channel_rule: _rule, display_recipient_count: _count, ...rest } = snapshot;
     return rest;
 }
+/** Potential sending campaigns, using the intake matchers. Unknown is never called no-send. */
+async function captureEnrollmentConsequence(action, params, projectId) {
+    if (!['identify_subscriber', 'emit_contact_event', 'enroll_contact', 'enroll_segment'].includes(action))
+        return {};
+    const source = db();
+    const client = typeof source.schema === 'function' ? source.schema('email') : source;
+    if (action === 'enroll_contact' || action === 'enroll_segment') {
+        const { data, error } = await client.from('campaigns').select('id, name').eq('project_id', projectId).eq('id', params.campaign_id).maybeSingle();
+        if (error || !data)
+            throw new Error('Approval enrollment campaign unavailable');
+        let contact_email;
+        if (params.contact_id) {
+            const contact = await client.from('subscribers').select('email').eq('id', params.contact_id).eq('project_id', projectId).maybeSingle();
+            if (contact.error || !contact.data)
+                throw new Error('Approval contact unavailable');
+            contact_email = contact.data.email;
+        }
+        return { enrollment_campaigns: [data], ...(contact_email ? { contact_email } : {}) };
+    }
+    const campaigns = await readAllRows(client.from('campaigns')
+        .select('id, name, site_id, type, trigger_event_name, trigger_tag, trigger_config')
+        .eq('project_id', projectId).eq('status', 'active'));
+    let tags = Array.isArray(params.tags) ? params.tags : [];
+    if (action === 'emit_contact_event') {
+        const contact = await client.from('subscribers').select('tags').eq('project_id', projectId)
+            .eq('email', params.email).maybeSingle();
+        if (contact.error)
+            throw new Error('Approval event contact unavailable');
+        tags = normalizeTriggerList(contact.data?.tags ?? []);
+    }
+    const matches = campaigns.filter(campaign => action === 'identify_subscriber'
+        ? ((params.site_id && params.consent !== 'customer' && campaign.site_id === params.site_id && campaign.trigger_event_name === 'signup') ||
+            (campaign.type === 'triggered' && tags.some((tag) => campaignMatchesTrigger(campaign, { tags: [tag] }))))
+        : campaign.type === 'triggered' && campaignMatchesTrigger(campaign, { event: params.event, tags, data: params.data }));
+    return { enrollment_campaigns: matches.map(campaign => ({ id: campaign.id, name: campaign.name })).sort((a, b) => String(a.id).localeCompare(String(b.id))) };
+}
 /** Server-owned display facts, saved inside the hash-bound params. Never supplied by a tool. */
 export async function captureApprovalSnapshot(action, params, projectId) {
     if (action === 'invite_team_member') {
@@ -169,7 +205,8 @@ export async function captureApprovalSnapshot(action, params, projectId) {
         return { version: 1, invitation: preview, recipient_count: 1 };
     }
     const display = await captureApprovalDisplay(action, params, projectId);
-    const withDisplay = (value) => display ? { ...value, display } : value;
+    const enrollment = await captureEnrollmentConsequence(action, params, projectId).catch(() => ({}));
+    const withDisplay = (value) => ({ ...value, ...enrollment, ...(display ? { display } : {}) });
     const setup = isTesterRequest(action) ? await captureTesterRequestSnapshot(action, params, projectId) : null;
     const snapshot = { version: 1, campaigns: [], steps: [], sites: [], recipient_count: null };
     if (!TARGET_ACTIONS.has(action))

package/build/lib/approval-tool-decisions.js

@@ -1,3 +1,4 @@
+import { effectiveApproval } from './approval-classes.js';
 import { requestContext } from '../db.js';
 import { getProjectId } from '../project.js';
 import { humanApprovalEligible } from './approval-human-eligibility.js';
@@ -81,6 +82,9 @@ export async function approveApproval(approvalId, transportClientName) {
         if (!await humanApprovalEligible(approval.action, projectId, actor)) {
             return refuse('approval_forbidden', 'This approval requires a person with the required project role.');
         }
+        if (approval.params?.__approval_snapshot?.approval_channel_rule === 'human_only' || (await effectiveApproval(approval.action, approval.params)).channelRule === 'human_only') {
+            return refuse('human_decision_required', 'Use the dashboard link or confirm with your typed reply in chat.');
+        }
         const name = await clientName(transportClientName);
         const now = new Date().toISOString();
         const decision = client.from('action_approvals')

package/build/lib/campaign-trigger-approval.js

@@ -1,10 +1,11 @@
+import { effectiveApproval } from './approval-classes.js';
 import { isApplyingTesterRequest } from './tester-policy.js';
 import { isDeepStrictEqual } from 'node:util';
 import { campaignTriggerChanges, campaignTriggerRevision, triggerChangeNeedsApproval } from '@sendinel/domain';
 import { db } from '../db.js';
 import { getProjectId } from '../project.js';
 import { logAudit } from '../audit.js';
-import { assertChannelCanExecute, currentChannelContext, checkApproval } from './action-approvals.js';
+import { approvalSatisfied, assertChannelCanExecute, currentChannelContext, checkApproval } from './action-approvals.js';
 export const TRIGGER_EDIT_SELECT = 'id, name, type, status, trigger_type, trigger_event_name, trigger_tag, trigger_config, period_key, updated_at';
 export const campaignEditError = (error, code) => ({ error, code });
 /** All writes include the revision used for the approval decision, including ungated drafts. */
@@ -23,13 +24,16 @@ export async function finishCampaignEdit(action, input, existing, updates, reque
     if (campaignTriggerChanges(existing, updates) && !['draft', 'active', 'paused'].includes(existing.status)) {
         return campaignEditError(`Cannot change a ${existing.status} campaign trigger`, 'INVALID_STATUS');
     }
-    if (isApplyingTesterRequest(action) || !triggerChangeNeedsApproval(existing, updates))
+    if (approvalSatisfied(action) || isApplyingTesterRequest(action) || !triggerChangeNeedsApproval(existing, updates))
         return writeEdit(input.campaign_id, existing, updates);
     const params = { campaign_id: input.campaign_id, input, previous_campaign: existing, updates };
     const context = currentChannelContext();
-    const decision = assertChannelCanExecute(action, params, context);
+    const decision = await assertChannelCanExecute(action, params, context);
     if (!decision.allowed)
         return campaignEditError(decision.reason ?? 'Channel cannot request approval', 'FORBIDDEN');
+    const effective = await effectiveApproval(action, params);
+    if (effective.applied && effective.level === 'auto' && !effective.prompt)
+        return writeEdit(input.campaign_id, existing, updates);
     // This trigger policy requires a human decision even if the integration uses autonomous mode.
     return request(params);
 }
@@ -57,7 +61,7 @@ export async function resumeCampaignEdit(action, approvalId, input) {
     }
     if (!Number.isFinite(Date.parse(approval.expires_at)) || Date.parse(approval.expires_at) <= Date.now())
         return campaignEditError('Approval expired', 'APPROVAL_EXPIRED');
-    const decision = assertChannelCanExecute(action, params, currentChannelContext());
+    const decision = await assertChannelCanExecute(action, params, currentChannelContext());
     if (!decision.allowed)
         return campaignEditError(decision.reason ?? 'Channel cannot use approval', 'FORBIDDEN');
     const check = await checkApproval(approvalId, { consume: true, action, params });

package/build/lib/db-error.js

@@ -94,6 +94,7 @@ export const API_USAGE_ERROR_CODE_MAP = {
     'validation_failed': 'validation_failed',
     'approval_not_cancellable': 'conflict',
     'approval_not_pending': 'conflict',
+    'human_decision_required': 'forbidden',
     '23505': 'conflict',
     'conflict': 'conflict',
     'content_changed_since_approval': 'conflict',

package/build/server.js

@@ -1,3 +1,4 @@
+import { isApprovalGatedAction } from './lib/approval-actions.js';
 import { withToolErrors, toolError, installToolErrorBoundary } from './lib/db-error.js';
 import { installApprovalCapabilityProbe } from './lib/approval-capabilities.js';
 import { installApprovalApp } from './lib/approval-app.js';
@@ -7,7 +8,7 @@ import { TESTER_REQUEST_TOOLS } from './lib/tester-policy.js';
 import { testerRequestTool } from './lib/tester-requests.js';
 export { TESTER_REQUEST_TOOLS } from './lib/tester-policy.js';
 import { ADMIN_TOOLS, isHumanRequestableAdminTool } from './lib/admin-tools.js';
-import { withApproval, isApprovalGatedAction } from './lib/action-approvals.js';
+import { withPreviewApproval, withApproval } from './lib/action-approvals.js';
 import { registerAgentMailboxTools } from './tools/agent-mailboxes.js';
 import { registerAnalyticsTools } from './tools/analytics.js';
 import { registerCampaignTools } from './tools/campaigns.js';
@@ -318,6 +319,10 @@ function createScopeProxy(server, scopes, toolGroup, allowedTools) {
                         if (wouldBlock)
                             return; // omit from tool list entirely
                     }
+                    if (isApprovalGatedAction(name)) {
+                        const originalHandler = handler;
+                        handler = (args, extra) => withPreviewApproval(name, originalHandler)(args, extra);
+                    }
                     // ── Scope enforcement (only when scopes are provided) ─────────────
                     if (scopes !== null) {
                         const required = getRequiredScope(name);

package/build/tools/approvals.js

@@ -1,3 +1,5 @@
+import { personApprovalLevel } from '../lib/approval-classes.js';
+import { APPROVAL_LEVEL_MEANING } from '@sendinel/domain';
 import { z } from 'zod';
 import { db } from '../db.js';
 import { getProjectId } from '../project.js';
@@ -9,6 +11,16 @@ import { approvalClientName } from '../lib/approval-capabilities.js';
 const txt = (text) => ({ content: [{ type: 'text', text }] });
 const j = (data) => txt(JSON.stringify(data, null, 2));
 export function registerApprovalTools(server, options) {
+    server.registerTool('get_approval_level', {
+        title: 'Get Approval Level',
+        description: 'Read your own approval setting. Only you can change it in dashboard settings; an AI cannot turn on Auto.',
+        annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+        inputSchema: {},
+    }, async () => {
+        const level = await personApprovalLevel();
+        return j({ level: level ?? 'default', applies_to_connection: level !== null,
+            meaning: level ? APPROVAL_LEVEL_MEANING[level] : 'Your connection keeps its usual approval checks.' });
+    });
     server.registerTool('cancel_approval', {
         title: 'Cancel Approval',
         description: 'Cancel an unexpired, unused pending or approved action approval in this project. Read-scoped OAuth connections can cancel only their own token’s requests; write/admin credentials can cancel any eligible request in this project. Sets it to rejected; cannot approve or undo cancellation.',

package/build/tools/campaign-sets.js

@@ -289,6 +289,38 @@ export function registerCampaignSetTools(server) {
     }, async (args) => {
         const projectId = getProjectId();
         const { approval_id } = args;
+        async function applyCampaigns(set, ids, approval_id, decidedBy) {
+            const activated = [];
+            const failed = [];
+            for (const c of set.campaigns) {
+                const { error } = await db()
+                    .from('campaigns')
+                    .update({ status: 'active', updated_at: new Date().toISOString() })
+                    .eq('id', c.id)
+                    .eq('project_id', projectId)
+                    .in('status', ['draft', 'paused']);
+                if (error) {
+                    failed.push({ campaign_id: c.id, ...dbToolError(error) });
+                    continue;
+                }
+                activated.push(c.id);
+                fireWebhookEvent('campaign.activated', { campaign_id: c.id, campaign_name: c.name, status: 'active' }).catch(() => { });
+            }
+            await logAudit({ action: 'campaign.set_activated', resourceType: 'campaign_set', resourceId: approval_id, details: { approval_id, decided_by: decidedBy ?? null, activated, failed, source: 'mcp' } }).catch(() => { });
+            return j({
+                activated,
+                failed,
+                ...(set.campaigns.some(c => c.type === 'broadcast') ? {
+                    campaigns: previewOf(set.campaigns.filter(c => activated.includes(c.id)).map(c => ({ ...c, status: 'active' })), set.steps),
+                    broadcast_activation: BROADCAST_ACTIVATION,
+                } : {}),
+                message: failed.length
+                    ? `Activated ${activated.length} of ${ids.length}. ${failed.length} could not be activated; see failed.`
+                    : set.campaigns.some(c => c.type === 'broadcast')
+                        ? `Activated ${activated.length} campaign${activated.length === 1 ? '' : 's'}. ${BROADCAST_ACTIVATION} Triggered campaigns send when their triggers fire.`
+                        : `Activated ${activated.length} campaign${activated.length === 1 ? '' : 's'}. Each sends when its trigger fires for a contact who can get it.`,
+            });
+        }
         if (approval_id) {
             const extras = Object.entries(args).filter(([key, value]) => key !== 'approval_id' && value !== undefined).map(([key]) => key);
             if (extras.length)
@@ -318,36 +350,7 @@ export function registerCampaignSetTools(server) {
             const check = await checkApproval(approval_id, { consume: true, action: 'activate_campaigns', params: stored });
             if (!check.approved)
                 return j({ error: `Approval ${approval_id} is ${check.status}. ${check.status === 'pending' ? 'Waiting for human approval via dashboard.' : 'Request a new approval.'}`, code: 'validation_failed', approval_status: check.status });
-            const activated = [];
-            const failed = [];
-            for (const c of current.campaigns) {
-                const { error } = await db()
-                    .from('campaigns')
-                    .update({ status: 'active', updated_at: new Date().toISOString() })
-                    .eq('id', c.id)
-                    .eq('project_id', projectId)
-                    .in('status', ['draft', 'paused']);
-                if (error) {
-                    failed.push({ campaign_id: c.id, ...dbToolError(error) });
-                    continue;
-                }
-                activated.push(c.id);
-                fireWebhookEvent('campaign.activated', { campaign_id: c.id, campaign_name: c.name, status: 'active' }).catch(() => { });
-            }
-            await logAudit({ action: 'campaign.set_activated', resourceType: 'campaign_set', resourceId: approval_id, details: { approval_id, decided_by: check.decided_by ?? null, activated, failed, source: 'mcp' } }).catch(() => { });
-            return j({
-                activated,
-                failed,
-                ...(current.campaigns.some(c => c.type === 'broadcast') ? {
-                    campaigns: previewOf(current.campaigns.filter(c => activated.includes(c.id)).map(c => ({ ...c, status: 'active' })), current.steps),
-                    broadcast_activation: BROADCAST_ACTIVATION,
-                } : {}),
-                message: failed.length
-                    ? `Activated ${activated.length} of ${ids.length}. ${failed.length} could not be activated; see failed.`
-                    : current.campaigns.some(c => c.type === 'broadcast')
-                        ? `Activated ${activated.length} campaign${activated.length === 1 ? '' : 's'}. ${BROADCAST_ACTIVATION} Triggered campaigns send when their triggers fire.`
-                        : `Activated ${activated.length} campaign${activated.length === 1 ? '' : 's'}. Each sends when its trigger fires for a contact who can get it.`,
-            });
+            return applyCampaigns(current, ids, approval_id, check.decided_by);
         }
         // Call 1: build one approval for the exact set.
         let ids = args.campaign_ids ?? [];
@@ -391,9 +394,11 @@ export function registerCampaignSetTools(server) {
         const contentWarnings = contentWarningView(readiness.warnings, readiness.lookup_errors);
         const approvalParams = { campaign_ids: [...ids].sort(), content_hash: campaignSetContentHash(set.campaigns, set.steps) };
         const channelContext = currentChannelContext();
-        const decision = assertChannelCanExecute('activate_campaigns', approvalParams, channelContext);
+        const decision = await assertChannelCanExecute('activate_campaigns', approvalParams, channelContext);
         if (!decision.allowed)
             return j({ error: decision.reason ?? 'This channel cannot request this action.', code: 'forbidden' });
+        if (decision.tier === 'autonomous')
+            return applyCampaigns(set, ids);
         const names = set.campaigns.map((c) => c.name);
         const approval = await requestApproval('activate_campaigns', approvalParams, undefined, channelContext, {
             campaign_count: set.campaigns.length,

package/build/tools/campaigns.js

@@ -12,6 +12,7 @@ import { stripActiveEmailContent, assertSendAccepted, providerSendError, sendErr
 // packages/domain/src/index.ts.
 import { ensureReplyActionSecretConfigured, mintReplyAction, } from '@sendinel/domain/reply-actions';
 import { finishCampaignEdit, resumeCampaignEdit, TRIGGER_EDIT_SELECT } from '../lib/campaign-trigger-approval.js';
+import { validTimezone } from '@sendinel/domain';
 import { adminDb, db, requestContext } from '../db.js';
 import { getProjectId } from '../project.js';
 import { dbErrorResult, dbToolError, toolError } from '../lib/db-error.js';
@@ -172,6 +173,23 @@ export function campaignTriggerKind(campaign) {
         return 'tag';
     return 'manual';
 }
+const SEND_WINDOW_TIMEZONE_WARNING = 'This campaign has a send window but no timezone, so contacts without one are judged in UTC. Set a campaign or site timezone.';
+async function campaignTimezoneWarnings(campaign) {
+    if (validTimezone(campaign.timezone))
+        return [];
+    if (!campaign.send_window && campaign.send_window_inherit === false)
+        return [];
+    let site = null;
+    if (campaign.site_id) {
+        const { data, error } = await db().from('sites').select('send_window, timezone')
+            .eq('id', campaign.site_id).eq('project_id', getProjectId()).maybeSingle();
+        if (error)
+            return ['Could not check the site send-window timezone. Read the site and verify its timezone.'];
+        site = data;
+    }
+    const sendWindow = campaign.send_window ?? (campaign.send_window_inherit !== false ? site?.send_window : null);
+    return sendWindow && !validTimezone(site?.timezone) ? [SEND_WINDOW_TIMEZONE_WARNING] : [];
+}
 async function campaignTriggerOutput(campaign) {
     let seenEvents;
     const config = normalizeTriggerConfig(campaign.trigger_config);
@@ -875,7 +893,8 @@ export function registerCampaignTools(server) {
             .single();
         if (error)
             return { content: [{ type: 'text', text: `Error: ${dbToolError(error).error}` }] };
-        return { content: [{ type: 'text', text: JSON.stringify({ ...data, requires_approval_description: ACTIVATION_APPROVAL_DESCRIPTION, fires_on: buildCampaignFiresOn(data), trigger_diagnostics: buildCampaignTriggerDiagnostics(data) }, null, 2) }] };
+        const warnings = await campaignTimezoneWarnings(data);
+        return { content: [{ type: 'text', text: JSON.stringify({ ...data, requires_approval_description: ACTIVATION_APPROVAL_DESCRIPTION, fires_on: buildCampaignFiresOn(data), trigger_diagnostics: buildCampaignTriggerDiagnostics(data), ...(warnings.length ? { warnings } : {}) }, null, 2) }] };
     });
     const propertyConditions = z.array(z.union([
         z.object({ key: z.string(), op: z.enum(['eq', 'neq']), value: z.string() }).strict(),
@@ -1036,7 +1055,7 @@ export function registerCampaignTools(server) {
             const approvalParams = { campaign_id, status };
             if (!approval_id) {
                 const channelContext = currentChannelContext();
-                const decision = assertChannelCanExecute('update_campaign_status', approvalParams, channelContext);
+                const decision = await assertChannelCanExecute('update_campaign_status', approvalParams, channelContext);
                 if (!decision.allowed)
                     return txt(decision.reason ?? 'This channel cannot request this action.');
                 if (decision.tier !== 'autonomous') {
@@ -1347,7 +1366,7 @@ export function registerCampaignTools(server) {
             });
         }
         const channelContext = currentChannelContext();
-        const decision = assertChannelCanExecute('broadcast_to_segment', approvalParams, channelContext);
+        const decision = await assertChannelCanExecute('broadcast_to_segment', approvalParams, channelContext);
         if (!decision.allowed)
             return txt(decision.reason ?? 'This channel cannot request this action.');
         if (decision.tier !== 'autonomous') {
@@ -1443,29 +1462,7 @@ export function registerCampaignTools(server) {
     }, async (args) => {
         const projectId = getProjectId();
         const { approval_id } = args;
-        // ── Call 2: execute exactly the approved, frozen payload. Nothing else is trusted. ──
-        if (approval_id) {
-            const extras = Object.entries(args).filter(([key, value]) => key !== 'approval_id' && value !== undefined).map(([key]) => key);
-            if (extras.length) {
-                return j({ error: `Call send_broadcast with only approval_id to send. Remove: ${extras.join(', ')}. To change anything, start over without approval_id.`, code: 'APPROVAL_CALL_TAKES_ONLY_APPROVAL_ID' });
-            }
-            const { data: row, error: rowErr } = await db()
-                .from('action_approvals')
-                .select('params')
-                .eq('id', approval_id)
-                .eq('project_id', projectId)
-                .eq('action', 'send_broadcast')
-                .maybeSingle();
-            if (rowErr)
-                return j({ ...dbToolError(rowErr), code: 'APPROVAL_LOOKUP_FAILED' });
-            if (!row)
-                return txt(`Approval ${approval_id} is not_found. Request a new approval.`);
-            const stored = (row.params ?? {});
-            const check = await checkApproval(approval_id, { consume: true, action: 'send_broadcast', params: stored });
-            if (!check.approved) {
-                return txt(`Approval ${approval_id} is ${check.status}. ${check.status === 'pending' ? 'Waiting for human approval via dashboard.' : 'Request a new approval.'}`);
-            }
-            const payload = (stored.payload ?? {});
+        async function applyBroadcast(payload, approval_id, decidedBy) {
             const contactIds = Array.isArray(payload.contact_ids) ? payload.contact_ids.map(String) : [];
             if (payload.send_at && new Date(payload.send_at).getTime() <= Date.now()) {
                 // An approved future time that has now passed: send right away rather than silently skip.
@@ -1495,7 +1492,7 @@ export function registerCampaignTools(server) {
                 action: 'campaign.send_broadcast',
                 resourceType: 'campaign',
                 resourceId: executed.campaignId,
-                details: { approval_id, decided_by: check.decided_by ?? null, site_id: payload.site_id, segment_id: payload.segment_id ?? null, contacts_enrolled: executed.enrolled, send_at: payload.send_at ?? null, source: 'mcp' },
+                details: { approval_id, decided_by: decidedBy ?? null, site_id: payload.site_id, segment_id: payload.segment_id ?? null, contacts_enrolled: executed.enrolled, send_at: payload.send_at ?? null, source: 'mcp' },
             }).catch(() => { });
             fireWebhookEvent('campaign.activated', {
                 campaign_id: executed.campaignId,
@@ -1516,6 +1513,30 @@ export function registerCampaignTools(server) {
                     : `Sending: "${payload.subject}" is going to ${executed.enrolled} people now. Delivery happens over the next few minutes; check the campaign for results.`,
             });
         }
+        // ── Call 2: execute exactly the approved, frozen payload. Nothing else is trusted. ──
+        if (approval_id) {
+            const extras = Object.entries(args).filter(([key, value]) => key !== 'approval_id' && value !== undefined).map(([key]) => key);
+            if (extras.length) {
+                return j({ error: `Call send_broadcast with only approval_id to send. Remove: ${extras.join(', ')}. To change anything, start over without approval_id.`, code: 'APPROVAL_CALL_TAKES_ONLY_APPROVAL_ID' });
+            }
+            const { data: row, error: rowErr } = await db()
+                .from('action_approvals')
+                .select('params')
+                .eq('id', approval_id)
+                .eq('project_id', projectId)
+                .eq('action', 'send_broadcast')
+                .maybeSingle();
+            if (rowErr)
+                return j({ ...dbToolError(rowErr), code: 'APPROVAL_LOOKUP_FAILED' });
+            if (!row)
+                return txt(`Approval ${approval_id} is not_found. Request a new approval.`);
+            const stored = (row.params ?? {});
+            const check = await checkApproval(approval_id, { consume: true, action: 'send_broadcast', params: stored });
+            if (!check.approved) {
+                return txt(`Approval ${approval_id} is ${check.status}. ${check.status === 'pending' ? 'Waiting for human approval via dashboard.' : 'Request a new approval.'}`);
+            }
+            return applyBroadcast((stored.payload ?? {}), approval_id, check.decided_by);
+        }
         // ── Call 1: resolve, render, count, request approval. Sends nothing. ──
         const { audience, segment_id, brief, html, subject, body_text, site_id, send_at, name, send_class, brand_asset_ids } = args;
         if (Boolean(audience) === Boolean(segment_id))
@@ -1622,9 +1643,11 @@ export function registerCampaignTools(server) {
         };
         const approvalParams = { payload };
         const channelContext = currentChannelContext();
-        const decision = assertChannelCanExecute('send_broadcast', approvalParams, channelContext);
+        const decision = await assertChannelCanExecute('send_broadcast', approvalParams, channelContext);
         if (!decision.allowed)
             return txt(decision.reason ?? 'This channel cannot request this action.');
+        if (decision.tier === 'autonomous')
+            return applyBroadcast(payload);
         const approval = await requestApproval('send_broadcast', approvalParams, undefined, channelContext, {
             subject: content.subject,
             segment_name: segment_id ? segmentName : null,
@@ -2092,7 +2115,7 @@ Adapt your tone accordingly:
         const channelContext = currentChannelContext();
         let needsApproval = false;
         if (confirmed) {
-            const decision = assertChannelCanExecute('launch_campaign', requestParams, channelContext);
+            const decision = await assertChannelCanExecute('launch_campaign', requestParams, channelContext);
             if (!decision.allowed)
                 return txt(decision.reason ?? 'This channel cannot request this action.');
             needsApproval = decision.tier !== 'autonomous';
@@ -3186,7 +3209,7 @@ Return ONLY valid JSON with this exact shape:
         if (activate && confirmed) {
             const approvalParams = { site_id, name, type, steps, segment_id, sends_per_hour, activate, send_class, unsub_footer_template, reentry_mode, period_key, ...triggerInput };
             const channelContext = currentChannelContext();
-            const decision = assertChannelCanExecute('create_campaign_with_content', { activate }, channelContext);
+            const decision = await assertChannelCanExecute('create_campaign_with_content', { activate }, channelContext);
             if (!decision.allowed)
                 return txt(decision.reason ?? 'This channel cannot request this action.');
             if (decision.tier !== 'autonomous') {
@@ -3553,7 +3576,7 @@ Return ONLY valid JSON with this exact shape:
     server.registerTool('set_campaign_trigger', {
         title: 'Set Campaign Trigger',
         annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
-        description: 'Send timing: the first step of an event-triggered product journey sends right away when it has no delay; later steps and delayed first steps wait for the site send window (contact zone, then campaign zone, then UTC). Set or clear what a campaign fires on: trigger event name, tag, date_field, contact_event, or trigger_config events/tags and where event-data filter. Bind billing, payment failed, dunning or trial ending mail to an event trigger such as invoice_payment_failed or trial_ending. Drafts save directly; active/paused campaigns require standard human approval. Archived/completed campaigns cannot change. Returns saved trigger fields, derived trigger_kind, fires_on and trigger_diagnostics (including unseen-event warnings).',
+        description: 'Send timing: the first step of an event-triggered product journey sends right away when it has no delay; later steps and delayed first steps wait for the site send window (contact zone, then campaign zone, then site zone, then UTC). Set or clear what a campaign fires on: trigger event name, tag, date_field, contact_event, or trigger_config events/tags and where event-data filter. Bind billing, payment failed, dunning or trial ending mail to an event trigger such as invoice_payment_failed or trial_ending. Drafts save directly; active/paused campaigns require standard human approval. Archived/completed campaigns cannot change. Returns saved trigger fields, derived trigger_kind, fires_on and trigger_diagnostics (including unseen-event warnings).',
         inputSchema: {
             ...reentryFields,
             campaign_id: z.string().uuid().optional(),
@@ -3640,7 +3663,10 @@ Return ONLY valid JSON with this exact shape:
     }, async ({ approval_id, ...input }) => {
         if (approval_id) {
             const result = await resumeCampaignEdit('update_campaign', approval_id, input);
-            return j(result.error ? result : { ...result, ...await campaignTriggerOutput(result) });
+            if (result.error)
+                return j(result);
+            const warnings = await campaignTimezoneWarnings(result);
+            return j({ ...result, ...await campaignTriggerOutput(result), ...(warnings.length ? { warnings } : {}) });
         }
         const { campaign_id, name, site_id, segment_id, send_at, topic, trigger_event_name, trigger_tag, trigger_type, trigger_config, type, sends_per_hour, send_in_contact_timezone, send_class, unsub_footer_template, reentry_mode, period_key } = input;
         if (!campaign_id)
@@ -3759,7 +3785,7 @@ Return ONLY valid JSON with this exact shape:
             ...data,
             fires_on: buildCampaignFiresOn(data),
             trigger_diagnostics: diagnostics,
-            warnings: diagnostics,
+            warnings: [...diagnostics, ...await campaignTimezoneWarnings(data)],
             ...(warning ? { warning } : {}),
         });
     });

package/build/tools/connector.js

@@ -97,7 +97,7 @@ async function authorizeConnectorMutation(action, confirmed, approvalId, approva
         });
     }
     const channelContext = currentChannelContext();
-    const decision = assertChannelCanExecute(action, approvalParams, channelContext);
+    const decision = await assertChannelCanExecute(action, approvalParams, channelContext);
     if (!decision.allowed)
         return j({ error: decision.reason ?? 'This channel cannot request this action.' });
     if (decision.tier === 'autonomous')

package/build/tools/contacts.js

@@ -2471,7 +2471,7 @@ Requirements: urgency without desperation, acknowledge the gap, one clear CTA, v
         const inactive = (contacts ?? []).filter((c) => !suppressedSet.has(c.email));
         if (!dry_run && inactive.length > 0) {
             const channelContext = currentChannelContext();
-            const decision = assertChannelCanExecute('identify_inactive', approvalParams, channelContext);
+            const decision = await assertChannelCanExecute('identify_inactive', approvalParams, channelContext);
             if (!decision.allowed)
                 return txt(decision.reason ?? 'This channel cannot request this action.');
             if (decision.tier !== 'autonomous') {
@@ -2686,7 +2686,7 @@ Requirements: urgency without desperation, acknowledge the gap, one clear CTA, v
         };
         if (!approval_id) {
             const channelContext = currentChannelContext();
-            const decision = assertChannelCanExecute('merge_subscribers', { target_id, source_ids }, channelContext);
+            const decision = await assertChannelCanExecute('merge_subscribers', { target_id, source_ids }, channelContext);
             if (!decision.allowed)
                 return txt(decision.reason ?? 'This channel cannot request this action.');
             const approval = await requestApproval('merge_subscribers', approvalParams, undefined, channelContext);

package/build/tools/data.js

@@ -421,7 +421,7 @@ export function registerDataTools(server) {
                 });
             }
             const channelContext = currentChannelContext();
-            const decision = assertChannelCanExecute('delete_provider_credential', approvalParams, channelContext);
+            const decision = await assertChannelCanExecute('delete_provider_credential', approvalParams, channelContext);
             if (!decision.allowed)
                 return j({ error: decision.reason ?? 'This channel cannot request this action.' });
             if (decision.tier !== 'autonomous') {
@@ -868,7 +868,7 @@ export function registerDataTools(server) {
             }
             const approvalParams = { connection_id };
             const channelContext = currentChannelContext();
-            const decision = assertChannelCanExecute('rotate_custom_webhook_secret', approvalParams, channelContext);
+            const decision = await assertChannelCanExecute('rotate_custom_webhook_secret', approvalParams, channelContext);
             if (!decision.allowed)
                 return j({ error: decision.reason ?? 'This channel cannot request this action.' });
             if (decision.tier !== 'autonomous') {

package/build/tools/delivery-ops.js

@@ -1034,7 +1034,7 @@ export function registerDeliveryOpsTools(server) {
             });
         }
         const channelContext = currentChannelContext();
-        const decision = assertChannelCanExecute('publish_dmarc_record', approvalParams, channelContext);
+        const decision = await assertChannelCanExecute('publish_dmarc_record', approvalParams, channelContext);
         if (!decision.allowed)
             return j({ error: decision.reason ?? 'This channel cannot request this action.' });
         if (decision.tier !== 'autonomous') {

package/build/tools/gdpr.js

@@ -2,7 +2,7 @@ import { z } from 'zod';
 import { db } from '../db.js';
 import { getProjectId } from '../project.js';
 import { logAudit } from '../audit.js';
-import { assertChannelCanExecute, currentChannelContext, requestApproval, checkApproval } from '../lib/action-approvals.js';
+import { approvalSatisfied, assertChannelCanExecute, currentChannelContext, requestApproval, checkApproval } from '../lib/action-approvals.js';
 import { dbToolError } from '../lib/db-error.js';
 const txt = (text) => ({ content: [{ type: 'text', text }] });
 const j = (data) => txt(JSON.stringify(data, null, 2));
@@ -35,7 +35,7 @@ export function registerGdprTools(server) {
         // Human approval required (always, even in autonomous mode — protected tier)
         if (!approval_id) {
             const channelContext = currentChannelContext();
-            const decision = assertChannelCanExecute('delete_subscriber_data', approvalParams, channelContext);
+            const decision = await assertChannelCanExecute('delete_subscriber_data', approvalParams, channelContext);
             if (!decision.allowed)
                 return txt(decision.reason ?? 'This channel cannot request this action.');
             const approval = await requestApproval('delete_subscriber_data', approvalParams, undefined, channelContext);
@@ -182,20 +182,22 @@ export function registerGdprTools(server) {
                 request_type: request.request_type,
                 email: request.email,
             };
-            if (!approval_id) {
-                const channelContext = currentChannelContext();
-                const decision = assertChannelCanExecute('action_ccpa_request', approvalParams, channelContext);
-                if (!decision.allowed)
-                    return txt(decision.reason ?? 'This channel cannot request this action.');
-                return j(await requestApproval('action_ccpa_request', approvalParams, undefined, channelContext));
-            }
-            const check = await checkApproval(approval_id, {
-                consume: true,
-                action: 'action_ccpa_request',
-                params: approvalParams,
-            });
-            if (!check.approved) {
-                return txt(`Approval ${approval_id} is ${check.status}. ${check.status === 'pending' ? 'Waiting for human approval via dashboard.' : 'Request a new approval.'}`);
+            if (!approvalSatisfied('action_ccpa_request')) {
+                if (!approval_id) {
+                    const channelContext = currentChannelContext();
+                    const decision = await assertChannelCanExecute('action_ccpa_request', approvalParams, channelContext);
+                    if (!decision.allowed)
+                        return txt(decision.reason ?? 'This channel cannot request this action.');
+                    return j(await requestApproval('action_ccpa_request', approvalParams, undefined, channelContext));
+                }
+                const check = await checkApproval(approval_id, {
+                    consume: true,
+                    action: 'action_ccpa_request',
+                    params: approvalParams,
+                });
+                if (!check.approved) {
+                    return txt(`Approval ${approval_id} is ${check.status}. ${check.status === 'pending' ? 'Waiting for human approval via dashboard.' : 'Request a new approval.'}`);
+                }
             }
             const { data: contact, error: contactErr } = await db()
                 .from('subscribers')

package/build/tools/lists.js

@@ -242,7 +242,7 @@ export function registerListTools(server) {
             });
         }
         const channelContext = currentChannelContext();
-        const decision = assertChannelCanExecute('add_list_members', approvalParams, channelContext);
+        const decision = await assertChannelCanExecute('add_list_members', approvalParams, channelContext);
         if (!decision.allowed)
             return txt(decision.reason ?? 'This channel cannot request this action.');
         if (decision.tier !== 'autonomous') {
@@ -318,7 +318,7 @@ export function registerListTools(server) {
             });
         }
         const channelContext = currentChannelContext();
-        const decision = assertChannelCanExecute('remove_list_members', approvalParams, channelContext);
+        const decision = await assertChannelCanExecute('remove_list_members', approvalParams, channelContext);
         if (!decision.allowed)
             return txt(decision.reason ?? 'This channel cannot request this action.');
         if (decision.tier !== 'autonomous') {
@@ -400,7 +400,7 @@ export function registerListTools(server) {
             });
         }
         const channelContext = currentChannelContext();
-        const decision = assertChannelCanExecute('add_list_members_by_filter', approvalParams, channelContext);
+        const decision = await assertChannelCanExecute('add_list_members_by_filter', approvalParams, channelContext);
         if (!decision.allowed)
             return txt(decision.reason ?? 'This channel cannot request this action.');
         if (decision.tier !== 'autonomous') {

package/build/tools/org.js

@@ -239,7 +239,7 @@ export function registerOrgTools(server) {
                 return j({ error: 'Cannot remove the last owner', code: 'LAST_OWNER' });
         }
         const channelContext = currentChannelContext();
-        const decision = assertChannelCanExecute('remove_team_member', approvalParams, channelContext);
+        const decision = await assertChannelCanExecute('remove_team_member', approvalParams, channelContext);
         if (!decision.allowed)
             return j({ error: decision.reason ?? 'This channel cannot request this action.' });
         if (decision.tier !== 'autonomous') {
@@ -308,7 +308,7 @@ export function registerOrgTools(server) {
             });
         }
         const channelContext = currentChannelContext();
-        const decision = assertChannelCanExecute('set_team_member_role', approvalParams, channelContext);
+        const decision = await assertChannelCanExecute('set_team_member_role', approvalParams, channelContext);
         if (!decision.allowed)
             return j({ error: decision.reason ?? 'This channel cannot request this action.' });
         if (decision.tier !== 'autonomous') {

package/build/tools/sites.js

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { validateSiteUnsubscribeSettings } from '@sendinel/domain';
+import { validTimezone, validateSiteUnsubscribeSettings } from '@sendinel/domain';
 import { logAudit } from '../audit.js';
 import { db } from '../db.js';
 import { getProjectId } from '../project.js';
@@ -219,6 +219,7 @@ export function registerSiteTools(server) {
             from_email: z.string().email().optional(),
             from_name: z.string().optional(),
             reply_to: z.string().email().nullable().optional().describe('Where replies to this site\'s email go; null clears it (replies then go to the From address). The previous value is returned as previous_reply_to.'),
+            timezone: z.string().refine(value => validTimezone(value) !== null, 'timezone must be a valid IANA timezone').nullable().optional().describe('Site send-window timezone; null clears it. Returns previous_timezone for undo.'),
             active: z.boolean().optional(),
             physical_address: z.string().trim().min(1).optional().describe('Physical mailing address; unchanged unless explicitly supplied.'),
             unsub_link_enabled: z.boolean().optional().describe('Enable the unsubscribe link in the email footer.'),
@@ -229,7 +230,7 @@ export function registerSiteTools(server) {
             unsub_brand_logo_url: z.string().nullable().optional().describe('HTTP(S) unsubscribe page logo URL; null or blank clears it.'),
             unsub_brand_color: z.string().nullable().optional().describe('Six-digit hex unsubscribe page color; null or blank clears it.'),
         },
-    }, async ({ site_id, name, from_email, from_name, reply_to, active, physical_address, ...unsubscribeInput }) => {
+    }, async ({ site_id, name, from_email, from_name, reply_to, timezone, active, physical_address, ...unsubscribeInput }) => {
         const updates = {};
         if (name)
             updates.name = name;
@@ -239,6 +240,8 @@ export function registerSiteTools(server) {
             updates.from_name = from_name;
         if (reply_to !== undefined)
             updates.reply_to = reply_to;
+        if (timezone !== undefined)
+            updates.timezone = timezone;
         if (active !== undefined)
             updates.active = active;
         if (physical_address !== undefined)
@@ -276,6 +279,15 @@ export function registerSiteTools(server) {
                 return j({ error: 'Site not found', code: 'NOT_FOUND' });
             previousReplyTo = current.reply_to ?? null;
         }
+        let previousTimezone;
+        if (timezone !== undefined) {
+            const { data: current, error } = await sb.from('sites').select('timezone').eq('id', site_id).eq('project_id', projectId).maybeSingle();
+            if (error)
+                return txt(`Error: ${dbToolError(error).error}`);
+            if (!current)
+                return j({ error: 'Site not found', code: 'NOT_FOUND' });
+            previousTimezone = current.timezone ?? null;
+        }
         updates.updated_at = new Date().toISOString();
         let query = sb
             .from('sites')
@@ -286,11 +298,15 @@ export function registerSiteTools(server) {
             query = query.is('unsub_footer_template', null);
         else if (previousTemplate !== undefined)
             query = query.eq('unsub_footer_template', previousTemplate);
+        if (previousTimezone === null)
+            query = query.is('timezone', null);
+        else if (previousTimezone !== undefined)
+            query = query.eq('timezone', previousTimezone);
         const { data, error } = await query.select().maybeSingle();
         if (error)
             return txt(`Error: ${dbToolError(error).error}`);
         if (!data)
-            return j({ error: 'Site not found or footer changed during update. Read the site and retry.', code: 'SITE_CHANGED_OR_NOT_FOUND' });
+            return j({ error: 'Site not found or settings changed during update. Read the site and retry.', code: 'SITE_CHANGED_OR_NOT_FOUND' });
         await logAudit({
             action: 'site.updated', resourceType: 'site', resourceId: site_id,
             details: { fields: Object.keys(updates).filter((field) => field !== 'updated_at') },
@@ -298,6 +314,7 @@ export function registerSiteTools(server) {
         return j({
             ...data,
             ...(previousReplyTo !== undefined ? { previous_reply_to: previousReplyTo } : {}),
+            ...(previousTimezone !== undefined ? { previous_timezone: previousTimezone } : {}),
             ...(previousTemplate !== undefined && previousTemplate !== data.unsub_footer_template
                 ? { previous_unsub_footer_template: previousTemplate } : {}),
         });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sendinel/mcp-server",
-  "version": "1.0.162",
+  "version": "1.0.164",
   "description": "AI-controlled email operations control plane for campaigns, contacts, segments, analytics, and multi-provider sending via MCP.",
   "mcpName": "ai.sendinel/mcp-server",
   "type": "module",