@sendinel/mcp-server 1.0.214 → 1.0.215

package/README.md

@@ -18,7 +18,7 @@ preserves REST outcomes, and redacts failures. See the
 [event-triggered campaign guide](../../docs/event-triggered-campaigns.md) for
 inputs, idempotency, subscription requirements, and conditional step examples.
 
-Sendinel currently exposes 35 tool groups and 352 tools (gateway mode exposes 4 meta-tools, sharing how_to with full mode). These counts are checked against the tool registry in CI, so this table matches what ships.
+Sendinel currently exposes 35 tool groups and 356 tools (gateway mode exposes 4 meta-tools, sharing how_to with full mode). These counts are checked against the tool registry in CI, so this table matches what ships.
 
 | Group | Count | Purpose |
 |-------|-------|---------|
@@ -35,19 +35,19 @@ Sendinel currently exposes 35 tool groups and 352 tools (gateway mode exposes 4
 | `compound` | 4 | Higher-level campaign/template/site setup and delivery diagnosis workflows |
 | `connector` | 6 | BYOD connector status, table discovery, schema/view setup, mapping, resync |
 | `contacts` | 40 | Subscriber CRUD, saved views, tags, email log, suppression, merge, timeline |
-| `content` | 14 | Content blocks, gated asset links, blog ingest and auto-publish, sources |
+| `content` | 15 | Content blocks, gated asset links, blog ingest and auto-publish, sources |
 | `data` | 19 | Platform connectors, imports, API keys, migration jobs, notifications, tenant export |
 | `data-proposals` | 3 | Data-derived campaign proposal generation, listing, approval |
 | `delivery-ops` | 25 | Domains, DNSBL, deliverability diagnostics, queue, DLQ, exports, blackout dates, abuse overrides |
 | `drafts` | 6 | Draft create/approve/reject and draft-to-campaign promotion |
-| `forms` | 3 | Form creation, listing, stats |
+| `forms` | 5 | Form creation, listing, stats |
 | `gdpr` | 4 | Contact data deletion and GDPR log |
 | `landing-pages` | 5 | Landing page CRUD |
 | `lists` | 7 | Static contact lists and membership management |
 | `newsletters` | 12 | Newsletter publications, issues, subscribers, scheduling, sending, stats |
 | `org` | 24 | Team members, plan usage/limits, audit log, model registry, white-label, support tickets, outbound digest, provider switching |
 | `segments` | 6 | Audience builder: create, edit, natural-language generation, preview |
-| `short-links` | 3 | Short links, click stats, QR codes |
+| `short-links` | 4 | Short links, click stats, QR codes |
 | `signatures` | 7 | Sending signature blocks |
 | `sites` | 7 | Site, sender, and brand voice management |
 | `skills` | 3 | Operator skills catalog |

package/build/lib/approval-actions.js

@@ -1,4 +1,9 @@
 export const GATED_ACTIONS = new Set([
+    // #4392: edits and reversible archive/disable transitions affect public visitors.
+    'update_form',
+    'archive_form',
+    'update_short_link',
+    'update_asset_link',
     'set_link_domain', // domain routing and optional customer DNS writes, one approval
     'recheck_domain_dns', // live provider verification may request an EE certificate
     'draft_agent_reply',

package/build/lib/survey-link-resolver.js

@@ -14,6 +14,7 @@ export async function resolveSurveyShortLink(sb, projectId, surveyId) {
         .from('short_links')
         .select('id, slug, project_id')
         .eq('id', survey.short_link_id)
+        .is('disabled_at', null)
         .eq('project_id', projectId)
         .maybeSingle();
     return link?.slug ? `${appBaseUrl()}/s/${link.slug}` : null;

package/build/server.js

@@ -120,7 +120,7 @@ const WRITE_TOOLS = new Set([
     'trigger_automation', 'enroll_automation', 'create_escalation_ladder', 'enroll_in_escalation_ladder',
     'update_scoring_rules', 'register_domain', 'publish_dmarc_record',
     'update_warmup_schedule', 'pause_warmup', 'resume_warmup',
-    'create_form', 'invite_team_member',
+    'create_form', 'update_form', 'archive_form', 'invite_team_member',
     'remove_team_member', 'set_team_member_role', 'set_member_project_access',
     'set_active_project',
     'resend_invitation', 'revoke_invitation',
@@ -129,7 +129,7 @@ const WRITE_TOOLS = new Set([
     'create_api_key', 'revoke_api_key', 'mark_notifications_read',
     'migrate_campaigns_from', 'start_platform_migration',
     'create_content_block', 'delete_content_block', 'trigger_content_pipeline',
-    'create_asset_link',
+    'create_asset_link', 'update_asset_link',
     'set_white_label_settings', 'add_white_label_domain',
     'create_blog_post',
     'generate_blog_post_image',
@@ -141,7 +141,7 @@ const WRITE_TOOLS = new Set([
     'create_custom_webhook', 'rotate_custom_webhook_secret',
     'update_brand_voice', 'promote_draft_to_campaign',
     'propose_campaign_from_data', 'approve_data_proposal',
-    'create_survey', 'update_survey', 'create_short_link', 'generate_qr_code',
+    'create_survey', 'update_survey', 'create_short_link', 'update_short_link', 'generate_qr_code',
     'create_signature', 'update_signature',
     'mark_ai_work_item_seen', 'snooze_ai_work_item', 'dismiss_ai_work_item',
     'submit_ai_context_event',

package/build/tools/content.js

@@ -143,6 +143,48 @@ export function registerContentTools(server) {
         const appUrl = process.env.NEXT_PUBLIC_APP_URL ?? process.env.SENDINEL_APP_URL ?? 'https://sendinel.ai';
         return j({ asset_link: { ...data, url: `${appUrl.replace(/\/$/, '')}/a/${data.slug}` } });
     });
+    server.registerTool('update_asset_link', {
+        title: 'Update Asset Link',
+        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+        description: 'Update a project asset link or reversibly archive/restore it. Keeps its slug and view history. Requires approval in standard mode.',
+        inputSchema: {
+            asset_link_id: z.string().uuid(),
+            title: z.string().min(1).max(255).optional(),
+            asset_url: z.string().url().max(2000).optional(),
+            gate_headline: z.string().max(255).optional(),
+            gate_body: z.string().max(1000).optional(),
+            source_attribution: z.string().max(500).optional(),
+            status: z.enum(['draft', 'active', 'archived']).optional(),
+            approval_id: z.string().uuid().optional(),
+        },
+    }, withApproval('update_asset_link', async ({ asset_link_id, title, asset_url, gate_headline, gate_body, source_attribution, status }) => {
+        for (const [field, value] of Object.entries({ title, source_attribution, gate_headline, gate_body })) {
+            const error = refuseActiveTextFields(field, value);
+            if (error)
+                return j({ error, code: 'validation_failed' });
+        }
+        if (asset_url !== undefined) {
+            try {
+                assertHttpUrl(asset_url);
+            }
+            catch {
+                return j({ error: 'asset_url must use http or https', code: 'validation_failed' });
+            }
+        }
+        const patch = Object.fromEntries(Object.entries({ title, asset_url, gate_headline, gate_body, source_attribution, status })
+            .filter(([, value]) => value !== undefined));
+        if (!Object.keys(patch).length)
+            return j({ error: 'Provide at least one asset link field to update', code: 'validation_failed' });
+        const { data, error } = await db().from('asset_links').update({ ...patch, updated_at: new Date().toISOString() })
+            .eq('id', asset_link_id).eq('project_id', getProjectId()).select().maybeSingle();
+        if (error)
+            return j(dbToolError(error));
+        if (!data)
+            return j({ error: 'Asset link not found', code: 'NOT_FOUND' });
+        await logAudit({ action: 'asset_link.updated', resourceType: 'asset_link', resourceId: asset_link_id, details: patch });
+        const appUrl = (process.env.NEXT_PUBLIC_APP_URL ?? process.env.SENDINEL_APP_URL ?? 'https://sendinel.ai').replace(/\/$/, '');
+        return j({ asset_link: { ...data, url: `${appUrl}/a/${data.slug}` } });
+    }));
     server.registerTool('list_asset_links', {
         title: 'List Asset Links',
         annotations: {

package/build/tools/forms.js

@@ -2,8 +2,29 @@ import { z } from 'zod';
 import { db } from '../db.js';
 import { getProjectId } from '../project.js';
 import { assertHttpUrl } from '../lib/url-validation.js';
+import { withApproval } from '../lib/action-approvals.js';
+import { logAudit } from '../audit.js';
 import { dbToolError } from '../lib/db-error.js';
 const j = (data) => ({ content: [{ type: 'text', text: JSON.stringify(data, null, 2) }] });
+function validateFields(fields) {
+    if (!fields.length)
+        return 'fields must contain at least one field';
+    const names = new Set();
+    for (const field of fields) {
+        if (typeof field.name !== 'string' || !/^[a-z][a-z0-9_]{0,49}$/.test(field.name) ||
+            typeof field.type !== 'string' || !['email', 'text', 'textarea', 'select', 'checkbox', 'number', 'tel', 'url', 'date'].includes(field.type)) {
+            return 'Each field needs a name (lowercase snake_case) and a supported type';
+        }
+        if (names.has(field.name))
+            return `Duplicate field name: ${field.name}`;
+        names.add(field.name);
+    }
+    // The public handler always reads fields.email to identify the subscriber.
+    if (!fields.some(field => field.name === 'email' && field.type === 'email')) {
+        return 'fields must include an email field named email';
+    }
+    return null;
+}
 export function registerFormTools(server) {
     server.registerTool('list_forms', {
         title: 'List Forms',
@@ -70,22 +91,9 @@ export function registerFormTools(server) {
             form_type: z.enum(['signup', 'management']).optional(),
         },
     }, async ({ site_id, name, fields, redirect_url, double_opt_in, form_type }) => {
-        if (!fields.length)
-            return j({ error: 'fields must contain at least one field', code: 'validation_failed' });
-        const names = new Set();
-        for (const field of fields) {
-            if (typeof field.name !== 'string' || !/^[a-z][a-z0-9_]{0,49}$/.test(field.name) ||
-                typeof field.type !== 'string' || !['email', 'text', 'textarea', 'select', 'checkbox', 'number', 'tel', 'url', 'date'].includes(field.type)) {
-                return j({ error: 'Each field needs a name (lowercase snake_case) and a supported type', code: 'validation_failed' });
-            }
-            if (names.has(field.name))
-                return j({ error: `Duplicate field name: ${field.name}`, code: 'validation_failed' });
-            names.add(field.name);
-        }
-        // The public handler always reads fields.email to identify the subscriber.
-        if (!fields.some(field => field.name === 'email' && field.type === 'email')) {
-            return j({ error: 'fields must include an email field named email', code: 'validation_failed' });
-        }
+        const fieldsError = validateFields(fields);
+        if (fieldsError)
+            return j({ error: fieldsError, code: 'validation_failed' });
         if (redirect_url !== undefined) {
             try {
                 assertHttpUrl(redirect_url);
@@ -105,4 +113,87 @@ export function registerFormTools(server) {
             return j({ ...dbToolError(error), code: 'INTERNAL_ERROR' });
         return j({ form: data });
     });
+    server.registerTool('update_form', {
+        title: 'Update Form',
+        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+        description: 'Update a project form without changing its slug or submissions. Settings edits preserve other settings. Requires approval in standard mode.',
+        inputSchema: {
+            form_id: z.string().uuid(),
+            name: z.string().min(1).optional(),
+            fields: z.array(z.record(z.string(), z.unknown())).optional(),
+            redirect_url: z.string().url().optional(),
+            double_opt_in: z.boolean().optional(),
+            status: z.enum(['active', 'archived']).optional(),
+            approval_id: z.string().uuid().optional(),
+        },
+    }, withApproval('update_form', async ({ form_id, name, fields, redirect_url, double_opt_in, status }) => {
+        if (fields !== undefined) {
+            const error = validateFields(fields);
+            if (error)
+                return j({ error, code: 'validation_failed' });
+        }
+        if (redirect_url !== undefined) {
+            try {
+                assertHttpUrl(redirect_url);
+            }
+            catch {
+                return j({ error: 'redirect_url must use http or https', code: 'validation_failed' });
+            }
+        }
+        const projectId = getProjectId();
+        const { data: form, error: readError } = await db().from('signup_forms').select('id, settings')
+            .eq('id', form_id).eq('project_id', projectId).maybeSingle();
+        if (readError)
+            return j(dbToolError(readError));
+        if (!form)
+            return j({ error: 'Form not found', code: 'NOT_FOUND' });
+        const patch = {};
+        if (name !== undefined)
+            patch.name = name;
+        if (fields !== undefined)
+            patch.fields = fields;
+        if (status !== undefined)
+            patch.status = status;
+        const settingsChanged = redirect_url !== undefined || double_opt_in !== undefined;
+        if (settingsChanged) {
+            patch.settings = { ...form.settings,
+                ...(redirect_url !== undefined ? { redirect_url } : {}),
+                ...(double_opt_in !== undefined ? { double_opt_in } : {}),
+            };
+        }
+        if (!Object.keys(patch).length)
+            return j({ error: 'Provide at least one form field to update', code: 'validation_failed' });
+        patch.updated_at = new Date().toISOString();
+        let query = db().from('signup_forms').update(patch).eq('id', form_id).eq('project_id', projectId);
+        // Do not overwrite a concurrent settings edit with the earlier JSON snapshot.
+        if (settingsChanged)
+            query = query.eq('settings', JSON.stringify(form.settings));
+        const { data, error } = await query.select().maybeSingle();
+        if (error)
+            return j(dbToolError(error));
+        if (!data)
+            return j({ error: 'Form changed; read it again before retrying', code: 'conflict' });
+        await logAudit({ action: 'form.updated', resourceType: 'form', resourceId: form_id, details: patch });
+        return j({ form: data });
+    }));
+    server.registerTool('archive_form', {
+        title: 'Archive Form',
+        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+        description: 'Reversibly archive a project form, or restore it with archived=false. Keeps submissions. Requires approval in standard mode.',
+        inputSchema: {
+            form_id: z.string().uuid(),
+            archived: z.boolean().optional().default(true),
+            approval_id: z.string().uuid().optional(),
+        },
+    }, withApproval('archive_form', async ({ form_id, archived = true }) => {
+        const status = archived ? 'archived' : 'active';
+        const { data, error } = await db().from('signup_forms').update({ status, updated_at: new Date().toISOString() })
+            .eq('id', form_id).eq('project_id', getProjectId()).select().maybeSingle();
+        if (error)
+            return j(dbToolError(error));
+        if (!data)
+            return j({ error: 'Form not found', code: 'NOT_FOUND' });
+        await logAudit({ action: 'form.updated', resourceType: 'form', resourceId: form_id, details: { status } });
+        return j({ form: data });
+    }));
 }

package/build/tools/short-links.js

@@ -3,6 +3,8 @@ import { z } from 'zod';
 import { db } from '../db.js';
 import { getProjectId } from '../project.js';
 import { assertHttpUrl, RESERVED_LINK_SLUGS } from '../lib/url-validation.js';
+import { withApproval } from '../lib/action-approvals.js';
+import { logAudit } from '../audit.js';
 import { dbToolError } from '../lib/db-error.js';
 const txt = (text) => ({ content: [{ type: 'text', text }] });
 const j = (data) => txt(JSON.stringify(data, null, 2));
@@ -85,6 +87,42 @@ export function registerShortLinkTools(server) {
             return j({ ...dbToolError(error), code: 'INTERNAL_ERROR' });
         return j({ short_link: data, short_url: `${appBaseUrl()}/s/${data.slug}` });
     });
+    server.registerTool('update_short_link', {
+        title: 'Update Short Link',
+        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+        description: 'Update a project short link or reversibly disable/re-enable it. Keeps click history. Requires approval in standard mode.',
+        inputSchema: {
+            short_link_id: z.string().uuid(),
+            destination_url: z.string().url().optional(),
+            disabled: z.boolean().optional(),
+            reason: z.string().optional(),
+            approval_id: z.string().uuid().optional(),
+        },
+    }, withApproval('update_short_link', async ({ short_link_id, destination_url, disabled, reason }) => {
+        const patch = {};
+        if (destination_url !== undefined) {
+            try {
+                patch.destination_url = assertHttpUrl(destination_url);
+            }
+            catch {
+                return j({ error: 'destination_url must use http or https', code: 'validation_failed' });
+            }
+        }
+        if (disabled !== undefined) {
+            patch.disabled_at = disabled ? new Date().toISOString() : null;
+            patch.disabled_reason = disabled ? reason ?? null : null;
+        }
+        if (!Object.keys(patch).length)
+            return j({ error: 'Provide destination_url or disabled', code: 'validation_failed' });
+        const { data, error } = await db().from('short_links').update(patch)
+            .eq('id', short_link_id).eq('project_id', getProjectId()).select().maybeSingle();
+        if (error)
+            return j(dbToolError(error));
+        if (!data)
+            return j({ error: 'Short link not found', code: 'NOT_FOUND' });
+        await logAudit({ action: 'short_link.updated', resourceType: 'short_link', resourceId: short_link_id, details: patch });
+        return j({ short_link: data, short_url: `${appBaseUrl()}/s/${data.slug}` });
+    }));
     server.registerTool('get_short_link_stats', {
         title: 'Get Short Link Stats',
         annotations: {
@@ -99,7 +137,7 @@ export function registerShortLinkTools(server) {
         const projectId = getProjectId();
         const { data: link, error: linkError } = await db()
             .from('short_links')
-            .select('id, slug, destination_url, click_count, last_clicked_at, created_at')
+            .select('id, slug, destination_url, click_count, last_clicked_at, created_at, disabled_at, disabled_reason')
             .eq('id', short_link_id)
             .eq('project_id', projectId)
             .maybeSingle();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sendinel/mcp-server",
-  "version": "1.0.214",
+  "version": "1.0.215",
   "description": "AI-controlled email operations control plane for campaigns, contacts, segments, analytics, and multi-provider sending via MCP.",
   "mcpName": "ai.sendinel/mcp-server",
   "type": "module",