@sendinel/mcp-server 1.0.165 → 1.0.167

package/build/tools/analytics.js

@@ -6,9 +6,9 @@ import { z } from 'zod';
 import { db, adminDb, requestContext } from '../db.js';
 import { getProjectId } from '../project.js';
 import { resolveProjectClient } from '../byod-client.js';
-import { decrypt } from '../crypto.js';
 import { logAudit } from '../audit.js';
 import { dbToolError, toolError } from '../lib/db-error.js';
+import { storedDomainDns, storedDnsReasons } from '../lib/domain-health.js';
 const txt = (text) => ({ content: [{ type: 'text', text }] });
 const j = (data) => txt(JSON.stringify(data, null, 2));
 const percent = (rate) => `${(rate * 100).toFixed(1)}%`;
@@ -579,21 +579,22 @@ export function registerAnalyticsTools(server) {
             idempotentHint: true,
             openWorldHint: false,
         },
-        description: 'SPF/DKIM/DMARC status and warmup progress for a site',
+        description: 'Stored domain_health SPF/DKIM/DMARC history and warmup progress for a site. Each row adds a DNS summary with verification_source and checked_at; null means unchecked, never verified.',
         inputSchema: {
             site_id: z.string().uuid().describe('Site UUID'),
             days: z.number().int().min(1).max(90).optional().describe('Recent days to return, default 7'),
         },
     }, async ({ site_id, days = 7 }) => {
-        const { data, error } = await db()
+        const { data, error } = await db().schema('email')
             .from('domain_health')
-            .select('*')
+            .select('*, sites!inner(project_id)')
             .eq('site_id', site_id)
-            .order('check_date', { ascending: false })
+            .eq('sites.project_id', getProjectId())
+            .order('check_date', { ascending: false }).order('created_at', { ascending: false }).order('id', { ascending: false })
             .limit(days);
         if (error)
-            return { content: [{ type: 'text', text: `Error: ${dbToolError(error).error}` }] };
-        return { content: [{ type: 'text', text: JSON.stringify(data, null, 2) }] };
+            return toolError(dbToolError(error, 'Unable to load domain health'));
+        return j((data ?? []).map(({ sites: _sites, ...row }) => ({ ...row, dns: storedDomainDns(row) })));
     });
     server.registerTool('get_engagement_insights', {
         title: 'Get Engagement Insights',
@@ -700,9 +701,9 @@ export function registerAnalyticsTools(server) {
             readOnlyHint: true,
             destructiveHint: false,
             idempotentHint: true,
-            openWorldHint: true,
+            openWorldHint: false,
         },
-        description: 'Run a deliverability check for a site: DNS records (SPF/DKIM/DMARC), warmup status, bounce/complaint rates, and risk assessment',
+        description: 'Read stored domain_health DNS observations (SPF/DKIM/DMARC), warmup status, bounce/complaint rates and risk assessment. Uses the same DNS source as refresh_domain_dns, get_domain_health and list_domains; null means unchecked. No live provider or DNS calls.',
         inputSchema: {
             site_id: z.string().uuid(),
         },
@@ -717,95 +718,25 @@ export function registerAnalyticsTools(server) {
         if (siteErr || !site)
             return txt(`Error: Site not found — ${(siteErr ? dbToolError(siteErr).error : undefined) ?? 'not found'}`);
         const domain = site.sending_domain;
-        const dnsResults = { spf: null, dkim: null, dmarc: null };
-        let verificationSource = 'dns_lookup';
-        let resendDomainStatus = null;
-        // Try Resend domain verification API first — avoids false negatives from
-        // raw DNS lookups (Resend uses varying DKIM selectors per domain vintage).
-        try {
-            // Resolve Resend API key: site key → project key → env
-            let apiKey = null;
-            const { data: siteRow } = await adminDb()
-                .from('sites')
-                .select('provider_api_key_enc')
-                .eq('id', site_id)
-                .eq('project_id', projectId)
-                .maybeSingle();
-            if (siteRow?.provider_api_key_enc) {
-                apiKey = decrypt(siteRow.provider_api_key_enc);
-            }
-            else {
-                const { data: projRow } = await adminDb()
-                    .from('projects')
-                    .select('provider_api_key_enc')
-                    .eq('id', projectId)
-                    .maybeSingle();
-                if (projRow?.provider_api_key_enc) {
-                    apiKey = decrypt(projRow.provider_api_key_enc);
-                }
-                else if (process.env.RESEND_API_KEY) {
-                    apiKey = process.env.RESEND_API_KEY;
-                }
-            }
-            if (apiKey) {
-                const { Resend } = await import('resend');
-                const resend = new Resend(apiKey);
-                const { data: domainList } = await resend.domains.list();
-                const domains = domainList?.data ?? [];
-                const match = domains.find((d) => d.name === domain);
-                if (match) {
-                    resendDomainStatus = match.status;
-                    if (match.status === 'verified') {
-                        verificationSource = 'resend_api';
-                        dnsResults.spf = { found: true, verified_by: 'resend_api', note: 'Resend handles SPF authentication at infrastructure level' };
-                        dnsResults.dkim = { found: true, verified_by: 'resend_api', note: 'DKIM signing managed by Resend (selector may vary)' };
-                        dnsResults.dmarc = { found: true, verified_by: 'resend_api', note: 'Domain verified by Resend — DMARC alignment confirmed' };
-                    }
-                }
-            }
-        }
-        catch {
-            // Resend API unavailable or key missing — fall back to DNS lookup
-        }
-        // Fall back to raw DNS checks if Resend API didn't confirm verification
-        if (verificationSource === 'dns_lookup') {
-            try {
-                const dns = await import('dns/promises');
-                try {
-                    const txtRecords = await dns.resolveTxt(domain);
-                    const spfRecord = txtRecords.flat().find((r) => r.startsWith('v=spf1'));
-                    dnsResults.spf = { found: !!spfRecord, record: spfRecord ?? null, includes_resend: spfRecord?.includes('include:amazonses.com') || spfRecord?.includes('include:_spf.resend.com') || false };
-                }
-                catch {
-                    dnsResults.spf = { found: false, error: 'No SPF record found' };
-                }
-                try {
-                    const dmarcRecords = await dns.resolveTxt(`_dmarc.${domain}`);
-                    const dmarcRecord = dmarcRecords.flat().find((r) => r.startsWith('v=DMARC1'));
-                    const policy = dmarcRecord?.match(/p=(\w+)/)?.[1] ?? 'unknown';
-                    dnsResults.dmarc = { found: !!dmarcRecord, record: dmarcRecord ?? null, policy, strict: policy === 'quarantine' || policy === 'reject' };
-                }
-                catch {
-                    dnsResults.dmarc = { found: false, error: 'No DMARC record found' };
-                }
-                try {
-                    const cnames = await dns.resolveCname(`resend._domainkey.${domain}`);
-                    dnsResults.dkim = { found: cnames.length > 0, cname: cnames[0] ?? null };
-                }
-                catch {
-                    dnsResults.dkim = { found: false, error: 'No DKIM CNAME found for resend._domainkey' };
-                }
-            }
-            catch { /* dns module unavailable */ }
-        }
-        const { data: healthRows } = await db()
+        const { data: healthRows, error: healthError } = await db().schema('email')
             .from('domain_health')
-            .select('*')
+            .select('*, sites!inner(project_id)')
             .eq('site_id', site_id)
+            .eq('sites.project_id', projectId)
             .order('check_date', { ascending: false })
+            .order('created_at', { ascending: false }).order('id', { ascending: false })
             .limit(14);
+        if (healthError)
+            return toolError(dbToolError(healthError, 'Unable to load domain health'));
         const health = healthRows ?? [];
         const latest = health[0];
+        const storedDns = storedDomainDns(latest);
+        const verificationSource = storedDns.verification_source;
+        const dnsResults = {
+            spf: { found: storedDns.spf, verified_by: storedDns.spf === true ? verificationSource : null, record: null, includes_resend: null, error: null, note: 'Stored SPF observation; raw DNS was not queried.' },
+            dkim: { found: storedDns.dkim, verified_by: storedDns.dkim === true ? verificationSource : null, cname: null, error: null, note: 'Stored DKIM observation; raw DNS was not queried.' },
+            dmarc: { found: storedDns.dmarc, verified_by: storedDns.dmarc === true ? verificationSource : null, record: null, policy: null, strict: null, error: null, note: 'Stored DMARC observation; raw DNS was not queried.' },
+        };
         const warmupDay = latest?.warmup_day ?? null;
         const warmupLimit = latest?.warmup_daily_limit ?? null;
         const sevenDaysAgo = new Date(Date.now() - 7 * 24 * 60 * 60 * 1000).toISOString();
@@ -821,18 +752,7 @@ export function registerAnalyticsTools(server) {
         const complained = logs.filter(isComplainedRow).length;
         const bounceRate = percentRate(bounced, totalSent, 8) ?? 0;
         const complaintRate = percentRate(complained, totalSent, 8) ?? 0;
-        const risks = [];
-        if (verificationSource === 'dns_lookup') {
-            if (!dnsResults.spf?.found)
-                risks.push('SPF record missing');
-            if (!dnsResults.dkim?.found)
-                risks.push('DKIM not configured');
-            if (!dnsResults.dmarc?.found)
-                risks.push('DMARC record missing');
-        }
-        if (resendDomainStatus && resendDomainStatus !== 'verified') {
-            risks.push(`Resend domain status is '${resendDomainStatus}' — domain verification incomplete`);
-        }
+        const risks = storedDnsReasons(storedDns);
         if (bounceRate > 5)
             risks.push(`HIGH bounce rate: ${bounceRate.toFixed(1)}%`);
         else if (bounceRate > 2)
@@ -846,7 +766,8 @@ export function registerAnalyticsTools(server) {
         return j({
             site: { slug: site.slug, domain, from_email: site.from_email },
             verification_source: verificationSource,
-            resend_domain_status: resendDomainStatus,
+            resend_domain_status: null, // Retained for compatibility; no live Resend query is made.
+            checked_at: storedDns.checked_at,
             dns: dnsResults,
             warmup: { day: warmupDay, daily_limit: warmupLimit, completed: warmupDay ? warmupDay >= 43 : null },
             recent_7d: { total_sent: totalSent, bounced, complained, bounce_rate: `${bounceRate.toFixed(2)}%`, complaint_rate: `${complaintRate.toFixed(3)}%` },

package/build/tools/approvals.js

@@ -23,7 +23,7 @@ export function registerApprovalTools(server, options) {
     });
     server.registerTool('cancel_approval', {
         title: 'Cancel Approval',
-        description: 'Cancel an unexpired, unused pending or approved action approval in this project. Read-scoped OAuth connections can cancel only their own token’s requests; write/admin credentials can cancel any eligible request in this project. Sets it to rejected; cannot approve or undo cancellation.',
+        description: 'Cancel an unexpired, unused pending or approved action approval in this project. Read-scoped OAuth connections can cancel only their own token’s requests; write/admin credentials can cancel any eligible request in this project. Sets it to rejected and records who cancelled and the request channel in the audit; check_approval returns that cancellation attribution. Cannot approve or undo cancellation.',
         annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
         inputSchema: { approval_id: z.string().uuid() },
     }, async ({ approval_id }) => {
@@ -77,14 +77,15 @@ export function registerApprovalTools(server, options) {
             idempotentHint: true,
             openWorldHint: false,
         },
-        description: 'List unexpired pending approval requests for this project. Expired rows are excluded even before the expiry cron runs.',
-        inputSchema: {},
-    }, async () => {
+        description: 'List unexpired, unused approval requests for this project. Defaults to pending; pass status: approved to find approved-but-unused requests, including sandbox auto-approvals, to execute or cancel. Expired and used rows are excluded.',
+        inputSchema: { status: z.enum(['pending', 'approved']).optional().describe('Default pending. Use approved to find unused approvals, including sandbox auto-approvals.') },
+    }, async ({ status }) => {
         const { data, error } = await db()
             .from('action_approvals')
             .select('id, action, tier, channel, summary, status, requested_at, expires_at, decided_via, decided_by')
             .eq('project_id', getProjectId())
-            .eq('status', 'pending')
+            .eq('status', status ?? 'pending')
+            .is('used_at', null)
             .gt('expires_at', new Date().toISOString())
             .order('requested_at', { ascending: false })
             .limit(25);

package/build/tools/automations.js

@@ -135,7 +135,7 @@ export function registerAutomationTools(server) {
         },
         description: 'Enroll a subscriber into active triggered automation campaigns. Match by campaign_id, trigger_event_name, or trigger_tag. Safe to call repeatedly.',
         inputSchema: {
-            approval_id: z.string().uuid().optional().describe('Get this by calling once without it, then have a human approve the returned approve_url. Re-call with the same arguments plus this approval_id to run the action.'),
+            approval_id: z.string().uuid().optional().describe('Get this by calling once without it, then have a human approve the returned approve_url. Re-call with only approval_id to run the action.'),
             subscriber_id: z.string().uuid().describe('Subscriber/contact UUID to enroll'),
             campaign_id: z.string().uuid().optional().describe('Specific triggered campaign UUID'),
             site_id: z.string().uuid().optional().describe('Optional site scope when matching by trigger'),
@@ -217,7 +217,7 @@ export function registerAutomationTools(server) {
         },
         description: 'Enroll a subscriber into an active triggered campaign that has escalation ladder steps. Reuses enroll_automation suppression and unsubscribe checks.',
         inputSchema: {
-            approval_id: z.string().uuid().optional().describe('Get this by calling once without it, then have a human approve the returned approve_url. Re-call with the same arguments plus this approval_id to run the action.'),
+            approval_id: z.string().uuid().optional().describe('Get this by calling once without it, then have a human approve the returned approve_url. Re-call with only approval_id to run the action.'),
             subscriber_id: z.string().uuid().describe('Subscriber/contact UUID to enroll'),
             campaign_id: z.string().uuid().describe('Triggered campaign UUID with ladder steps'),
             next_send_at: z.string().datetime().optional().describe('First eligible send time. Defaults to now.'),

package/build/tools/brand-kit.js

@@ -39,7 +39,7 @@ export function registerBrandKitTools(server) {
         },
         description: 'Import raw Brand Core / Brand Brain / Content Library / Brand Kit markdown text into the current project.',
         inputSchema: {
-            approval_id: z.string().uuid().optional().describe('Get this by calling once without it, then have a human approve the returned approve_url. Re-call with the same arguments plus this approval_id to run the action.'),
+            approval_id: z.string().uuid().optional().describe('Get this by calling once without it, then have a human approve the returned approve_url. Re-call with only approval_id to run the action.'),
             text: z.string().min(1).describe('Raw markdown text from the Brand Core / Brand Kit companion output.'),
         },
     }, withApproval('import_brand_kit_text', async ({ text }) => {

package/build/tools/campaign-sets.d.ts

@@ -6,6 +6,7 @@ type CampaignSetRow = {
     trigger_event_name: string | null;
     trigger_tag: string | null;
     trigger_config?: unknown;
+    trigger_type?: string | null;
     send_class: string | null;
     site_id: string;
     type?: string;

package/build/tools/campaign-sets.js

@@ -5,11 +5,11 @@ import { db } from '../db.js';
 import { getProjectId } from '../project.js';
 import { checkPlanLimit } from '../plan-limits.js';
 import { validateTemplate } from '../lib/voice.js';
-import { approvalExcerpt, assertChannelCanExecute, checkApproval, currentChannelContext, requestApproval } from '../lib/action-approvals.js';
+import { approvalNext, approvalExcerpt, assertChannelCanExecute, checkApproval, currentChannelContext, requestApproval } from '../lib/action-approvals.js';
 import { generateEmailFromBrief } from '../lib/email-generation.js';
 import { fireWebhookEvent } from '../lib/webhook-events.js';
 import { logAudit } from '../audit.js';
-import { applyCampaignTargetingFields } from './campaigns.js';
+import { applyCampaignTargetingFields, campaignTriggerKind } from './campaigns.js';
 import { checkCampaignContent, contentNotReadyResponse, contentWarningView, summarizeContentWarnings } from '../lib/content-sources.js';
 import { captureBroadcastAudience } from '../lib/approval-snapshot.js';
 import { dbToolError } from '../lib/db-error.js';
@@ -94,7 +94,7 @@ export function previewOf(campaigns, steps) {
 export async function loadSet(projectId, campaignIds) {
     const { data: campaigns, error } = await db()
         .from('campaigns')
-        .select('id, name, type, segment_id, status, trigger_event_name, trigger_tag, trigger_config, send_class, site_id')
+        .select('id, name, type, segment_id, status, trigger_type, trigger_event_name, trigger_tag, trigger_config, send_class, site_id')
         .eq('project_id', projectId)
         .in('id', campaignIds);
     if (error)
@@ -343,6 +343,9 @@ export function registerCampaignSetTools(server) {
             if (current.campaigns.length !== ids.length || campaignSetContentHash(current.campaigns, current.steps) !== stored.content_hash) {
                 return j({ error: 'A campaign or email changed (or was deleted) after approval. Nothing was activated. Request a new approval.', code: 'CONTENT_CHANGED_SINCE_APPROVAL' });
             }
+            if (current.campaigns.some(c => c.type === 'triggered' && campaignTriggerKind(c) === 'manual' && !c.segment_id)) {
+                return j({ error: 'this campaign has no trigger, so it would never fire', code: 'validation_failed' });
+            }
             // Same content gate as the request, so a bad email can't ride through on an old approval.
             const readiness = await checkCampaignContent(projectId, current.campaigns, current.steps);
             if (readiness.blocking.length)
@@ -375,6 +378,10 @@ export function registerCampaignSetTools(server) {
         const notReady = set.campaigns.filter((c) => !['draft', 'paused'].includes(c.status));
         if (notReady.length)
             return j({ error: 'Only draft or paused campaigns can be activated here.', code: 'NOT_ACTIVATABLE', campaigns: notReady.map((c) => ({ id: c.id, name: c.name, status: c.status })) });
+        const triggerless = set.campaigns.filter(c => c.type === 'triggered' && campaignTriggerKind(c) === 'manual' && !c.segment_id);
+        if (triggerless.length)
+            return j({ error: 'this campaign has no trigger, so it would never fire', code: 'validation_failed',
+                campaigns: triggerless.map(c => ({ id: c.id, name: c.name })) });
         const empty = set.campaigns.filter((c) => !set.steps.some((s) => s.campaign_id === c.id));
         if (empty.length)
             return j({ error: 'Some campaigns have no emails yet.', code: 'NO_EMAILS', campaigns: empty.map((c) => ({ id: c.id, name: c.name })) });
@@ -410,7 +417,7 @@ export function registerCampaignSetTools(server) {
             ...approval,
             campaigns: previewOf(set.campaigns, set.steps),
             ...(contentWarnings.length ? { content_warnings: contentWarnings } : {}),
-            next: 'Show the person the campaigns above and approve_url. After approval, call activate_campaigns with only approval_id.',
+            next: approvalNext('activate_campaigns', approval),
         });
     });
 }