@sendinel/mcp-server 1.0.169 → 1.0.171

package/build/tools/analytics.js

@@ -1,3 +1,4 @@
+import { literalIlikePattern } from '@sendinel/domain';
 import { isSentRow } from "@sendinel/domain";
 import { readPeriodCampaigns, campaignPeriodFields, filterPlanContacts } from "@sendinel/domain";
 import { isTrueConversionEvent, TRUE_CONVERSION_DEFINITION } from "@sendinel/domain";
@@ -221,9 +222,9 @@ export function registerAnalyticsTools(server) {
             .order('created_at', { ascending: false })
             .limit(limit);
         if (event_name)
-            query = query.ilike('event_name', `%${event_name}%`);
+            query = query.ilike('event_name', literalIlikePattern(event_name));
         if (email)
-            query = query.ilike('email', `%${email}%`);
+            query = query.ilike('email', literalIlikePattern(email));
         if (source)
             query = query.eq('source', source);
         if (site_id)

package/build/tools/campaigns.js

@@ -813,6 +813,16 @@ export function registerCampaignTools(server) {
             window: z.enum(['today', 'tomorrow', '7d', '30d']).optional().default('today'),
         },
     }, async ({ site_id, window }) => {
+        const { data: site, error: siteError } = await db()
+            .from('sites')
+            .select('id')
+            .eq('id', site_id)
+            .eq('project_id', getProjectId())
+            .maybeSingle();
+        if (siteError)
+            return dbErrorResult(siteError);
+        if (!site)
+            return toolError({ error: 'Site not found', code: 'not_found' });
         const { start, end } = getScheduleWindowBounds(window ?? 'today');
         const { data, error } = await db()
             .from('campaign_enrollments')
@@ -824,7 +834,7 @@ export function registerCampaignTools(server) {
             .eq('campaigns.site_id', site_id)
             .order('next_send_at', { ascending: true });
         if (error)
-            return txt(`Error: ${dbToolError(error).error}`);
+            return dbErrorResult(error);
         const campaigns = groupScheduleByCampaign((data ?? []));
         const total_sends_scheduled = campaigns.reduce((sum, campaign) => sum + campaign.total_sends_scheduled, 0);
         return j({

package/build/tools/contacts.js

@@ -2,7 +2,7 @@ import { normalizeTagInput, tagInputWarnings } from '../lib/tags.js';
 import { ResourceTemplate } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { CONTACT_ENRICHMENT_PROVIDERS } from '@desler/models';
 import { createContactEnrichmentAdapters, enrichContactFromConnections, } from '@desler/models/contact-enrichment';
-import { buildPreviewAttentionEnvelope, applySegmentRules, isSegmentRulesError, ContactPropertyAnomalyLogger, normalizeContactProperties, validateContactPropertyPatch, getAttentionDecision, getContactNeighborhood, getScheduledTouches, findContactDuplicateGroups, readAllPages, readAllRows, chunkIds, } from '@sendinel/domain';
+import { buildPreviewAttentionEnvelope, buildSafeIlikeOrFilter, literalIlikePattern, applySegmentRules, isSegmentRulesError, ContactPropertyAnomalyLogger, normalizeContactProperties, validateContactPropertyPatch, getAttentionDecision, getContactNeighborhood, getScheduledTouches, findContactDuplicateGroups, readAllPages, readAllRows, chunkIds, } from '@sendinel/domain';
 import { z } from 'zod';
 import { callSendinelV1 } from '../lib/v1-client.js';
 import { db, projectClientForWriteback } from '../db.js';
@@ -988,9 +988,9 @@ Requirements: urgency without desperation, acknowledge the gap, one clear CTA, v
                 .eq('project_id', projectId)
                 .maybeSingle();
             if (viewError)
-                return txt(`Error: ${dbToolError(viewError).error}`);
+                return dbErrorResult(viewError);
             if (!view)
-                return txt('Error: View not found');
+                return toolError({ error: 'View not found', code: 'not_found' });
             viewFilters = normalizeSubscriberViewFilters(view.filters);
         }
         const viewSearch = viewFilters ? subscriberViewFilterString(viewFilters, 'search') : '';
@@ -1008,7 +1008,7 @@ Requirements: urgency without desperation, acknowledge the gap, one clear CTA, v
         if (viewSiteParam && viewSiteParam !== 'all') {
             const resolved = await resolveSubscriberViewSiteId(projectId, viewSiteParam);
             if (resolved.error)
-                return txt(`Error: ${resolved.error}`);
+                return toolError(resolved);
             viewSiteId = resolved.siteId;
         }
         const embedOk = await hasCompaniesEmbed(projectId);
@@ -1021,16 +1021,18 @@ Requirements: urgency without desperation, acknowledge the gap, one clear CTA, v
             .limit(limit ?? 50);
         if (!include_unsubscribed)
             q = q.eq('global_unsubscribed', false);
-        if (search)
-            q = q.or(`email.ilike.%${search}%,first_name.ilike.%${search}%,last_name.ilike.%${search}%`);
-        if (viewSearch)
-            q = q.or(`email.ilike.%${viewSearch}%,first_name.ilike.%${viewSearch}%,last_name.ilike.%${viewSearch}%`);
+        const searchFilter = buildSafeIlikeOrFilter(['email', 'first_name', 'last_name'], search);
+        const viewSearchFilter = buildSafeIlikeOrFilter(['email', 'first_name', 'last_name'], viewSearch);
+        if (searchFilter)
+            q = q.or(searchFilter);
+        if (viewSearchFilter)
+            q = q.or(viewSearchFilter);
         if (viewTags.length > 0)
             q = q.contains('tags', viewTags);
         if (viewStage)
             q = q.eq('lifecycle_stage', viewStage);
         if (viewCustomPropertyKey && viewCustomPropertyValue && SUBSCRIBER_VIEW_CUSTOM_PROPERTY_KEY_RE.test(viewCustomPropertyKey)) {
-            q = q.filter(subscriberViewCustomPropertyPath(viewCustomPropertyKey), 'ilike', `%${viewCustomPropertyValue}%`);
+            q = q.filter(subscriberViewCustomPropertyPath(viewCustomPropertyKey), 'ilike', literalIlikePattern(viewCustomPropertyValue));
         }
         if (viewFilters && viewFilters.show_test !== true)
             q = q.not('is_test', 'is', true);
@@ -1054,7 +1056,7 @@ Requirements: urgency without desperation, acknowledge the gap, one clear CTA, v
                 .select('contact_id, subscribed')
                 .eq('site_id', statusSiteId);
             if (siteSubscriptionsError)
-                return txt(`Error: ${dbToolError(siteSubscriptionsError).error}`);
+                return dbErrorResult(siteSubscriptionsError);
             if (viewStatus === 'not_subscribed') {
                 const subscribedIds = (siteSubscriptions ?? [])
                     .map((subscription) => subscription.contact_id)
@@ -1086,7 +1088,7 @@ Requirements: urgency without desperation, acknowledge the gap, one clear CTA, v
         }
         const { data, error } = await q;
         if (error)
-            return { content: [{ type: 'text', text: `Error: ${dbToolError(error).error}` }] };
+            return dbErrorResult(error);
         return { content: [{ type: 'text', text: JSON.stringify(data, null, 2) }] };
     });
     server.registerTool('list_subscriber_views', {
@@ -1250,12 +1252,12 @@ Requirements: urgency without desperation, acknowledge the gap, one clear CTA, v
             .eq('project_id', projectId)
             .order('name', { ascending: true })
             .limit(limit ?? 50);
-        if (search) {
-            query = query.or(`name.ilike.%${search}%,domain.ilike.%${search}%`);
-        }
+        const searchFilter = buildSafeIlikeOrFilter(['name', 'domain'], search);
+        if (searchFilter)
+            query = query.or(searchFilter);
         const { data: companies, error } = await query;
         if (error)
-            return txt(`Error: ${dbToolError(error).error}`);
+            return dbErrorResult(error);
         const rows = companies ?? [];
         if (!rows.length)
             return j([]);
@@ -1270,7 +1272,7 @@ Requirements: urgency without desperation, acknowledge the gap, one clear CTA, v
                 .order('id')
                 .range(offset, offset + 999);
             if (subscriberError)
-                return txt(`Error: ${dbToolError(subscriberError).error}`);
+                return dbErrorResult(subscriberError);
             for (const subscriber of subscribers ?? []) {
                 const companyId = typeof subscriber.company_id === 'string' ? subscriber.company_id : null;
                 if (!companyId)
@@ -1638,7 +1640,7 @@ Requirements: urgency without desperation, acknowledge the gap, one clear CTA, v
         if (before)
             q = q.lte('sent_at', before);
         if (subject_contains)
-            q = q.ilike('subject', `%${subject_contains.replace(/[\\%_]/g, (c) => `\\${c}`)}%`);
+            q = q.ilike('subject', literalIlikePattern(subject_contains));
         const { data, error } = await q;
         if (error)
             return { content: [{ type: 'text', text: `Error: ${dbToolError(error).error}` }] };
@@ -2035,10 +2037,12 @@ Requirements: urgency without desperation, acknowledge the gap, one clear CTA, v
         else if (email)
             q = q.eq('email', email);
         else
-            return txt('Provide either contact_id or email.');
+            return toolError({ error: 'Provide either contact_id or email.', code: 'validation_failed' });
         const { data, error } = await q.maybeSingle();
         if (error)
             return txt(`Error: ${dbToolError(error).error}`);
+        if (!data)
+            return toolError({ error: 'Subscriber not found', code: 'not_found' });
         return j(data);
     });
     server.registerTool('enrich_subscriber', {

package/build/tools/drafts.js

@@ -3,7 +3,22 @@ import { db } from '../db.js';
 import { getProjectId } from '../project.js';
 import { checkPlanLimit } from '../plan-limits.js';
 import { recordBrandAssetUsage } from '../lib/brand-asset-usage.js';
-import { dbToolError } from '../lib/db-error.js';
+import { dbErrorResult, dbToolError, toolError } from '../lib/db-error.js';
+// Called only after the conditional write matched no pending draft. Keep the
+// status predicate on the write so concurrent decisions cannot overwrite one another.
+async function draftDecisionMiss(draftId) {
+    const { data, error } = await db()
+        .from('ai_drafts')
+        .select('id')
+        .eq('id', draftId)
+        .eq('project_id', getProjectId())
+        .maybeSingle();
+    if (error)
+        return dbErrorResult(error);
+    return data
+        ? toolError({ error: 'Draft is no longer pending', code: 'conflict' })
+        : toolError({ error: 'Draft not found', code: 'not_found' });
+}
 export function registerDraftTools(server) {
     server.registerTool('create_draft', {
         title: 'Create Draft',
@@ -230,11 +245,11 @@ export function registerDraftTools(server) {
             .eq('project_id', getProjectId())
             .eq('status', 'pending')
             .select()
-            .single();
+            .maybeSingle();
         if (error)
-            return { content: [{ type: 'text', text: `Error: ${dbToolError(error).error}` }] };
+            return dbErrorResult(error);
         if (!data)
-            return { content: [{ type: 'text', text: 'Draft not found or not in pending status.' }] };
+            return draftDecisionMiss(draft_id);
         return { content: [{ type: 'text', text: JSON.stringify(data, null, 2) }] };
     });
     server.registerTool('reject_draft', {
@@ -258,11 +273,11 @@ export function registerDraftTools(server) {
             .eq('project_id', getProjectId())
             .eq('status', 'pending')
             .select()
-            .single();
+            .maybeSingle();
         if (error)
-            return { content: [{ type: 'text', text: `Error: ${dbToolError(error).error}` }] };
+            return dbErrorResult(error);
         if (!data)
-            return { content: [{ type: 'text', text: 'Draft not found or not in pending status.' }] };
+            return draftDecisionMiss(draft_id);
         return { content: [{ type: 'text', text: JSON.stringify(data, null, 2) }] };
     });
 }

package/build/tools/gdpr.js

@@ -1,3 +1,4 @@
+import { literalIlikePattern } from '@sendinel/domain';
 import { z } from 'zod';
 import { db } from '../db.js';
 import { getProjectId } from '../project.js';
@@ -104,7 +105,7 @@ export function registerGdprTools(server) {
         if (request_type)
             query = query.eq('request_type', request_type);
         if (search)
-            query = query.ilike('email', `%${search}%`);
+            query = query.ilike('email', literalIlikePattern(search));
         const { data, error } = await query
             .order('created_at', { ascending: false })
             .limit(limit ?? 50);

package/build/tools/lists.js

@@ -1,3 +1,4 @@
+import { literalIlikePattern } from '@sendinel/domain';
 import { z } from 'zod';
 import { applySegmentRules, buildSegmentBaseQuery, evaluateSegmentRules, hydrateEmailSendsContacts, isSegmentRulesError, normalizeSegmentRulesToTree, readAllRows, } from '@sendinel/domain';
 import { db } from '../db.js';
@@ -93,7 +94,7 @@ export function registerListTools(server) {
             .eq('project_id', projectId);
         const trimmedSearch = search?.trim();
         if (trimmedSearch)
-            query = query.ilike('name', `%${trimmedSearch}%`);
+            query = query.ilike('name', literalIlikePattern(trimmedSearch));
         const { data, error } = await query
             .order('created_at', { ascending: false })
             .limit(limit);

package/build/tools/templates.js

@@ -1,3 +1,4 @@
+import { literalIlikePattern } from '@sendinel/domain';
 import { withApproval } from '../lib/action-approvals.js';
 import { snapshotTemplateVersion, versionHasBodySnapshot } from '@sendinel/domain';
 import { z } from 'zod';
@@ -89,7 +90,7 @@ export function registerTemplateTools(server) {
         if (category)
             query = query.eq('category', category);
         if (search)
-            query = query.ilike('name', `%${search}%`);
+            query = query.ilike('name', literalIlikePattern(search));
         const { data, error } = await query;
         if (error)
             return j(dbToolError(error));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sendinel/mcp-server",
-  "version": "1.0.169",
+  "version": "1.0.171",
   "description": "AI-controlled email operations control plane for campaigns, contacts, segments, analytics, and multi-provider sending via MCP.",
   "mcpName": "ai.sendinel/mcp-server",
   "type": "module",