@sendinel/mcp-server 1.0.221 → 1.0.223

package/build/lib/action-approvals.d.ts

@@ -1,6 +1,7 @@
 import type { DecisionEvidence } from './approval-elicitation-evidence.js';
 import { type AutoApproveUnavailableReason } from './sandbox-approvals.js';
 export { isApprovalGatedAction } from './approval-actions.js';
+export { assertResourcesBelongToActiveProject, ResourceProjectRefusal } from './resource-project.js';
 /**
  * Action approval tiers:
  *

package/build/lib/action-approvals.js

@@ -17,7 +17,9 @@ import { captureApprovalSnapshot, withoutApprovalSnapshot, withoutApprovalDispla
 import { fireWebhookEvent } from './webhook-events.js';
 import { offerApprovalApp } from './approval-app.js';
 import { elicitApproval } from './approval-elicitation.js';
-import { toolError, formatZodError } from './db-error.js';
+import { toolError, formatZodError, plainRefusalResult } from './db-error.js';
+import { assertResourcesBelongToActiveProject, ResourceProjectRefusal } from './resource-project.js';
+export { assertResourcesBelongToActiveProject, ResourceProjectRefusal } from './resource-project.js';
 export function getApprovalTier(action, params) {
     // #4308 / #4214: a request-only connection cannot bypass approval via autonomous/preview modes.
     const scopes = requestContext()?.scopes;
@@ -356,6 +358,8 @@ export async function requestApproval(action, params, apiKeyId, channelContext,
     const actor = requestContext();
     // Ignore any model-supplied reserved field; freeze facts read by the server.
     const cleanParams = withoutApprovalSnapshot(params);
+    // #4447: refuse a resource outside the active project before anything is stored, sent or auto-approved.
+    await assertResourcesBelongToActiveProject(action, cleanParams);
     const snapshot = { ...await captureSnapshot(action, cleanParams), ...(effective.applied ? { approval_class: effective.class, approval_channel_rule: effective.channelRule } : {}),
         ...(display && 'recipient_count' in display ? { display_recipient_count: display.recipient_count } : {}) };
     if (typeof display?.merge_variable_summary === 'string') {
@@ -704,7 +708,15 @@ export function withApproval(action, handler, options = {}) {
         if (decision.tier !== 'autonomous') {
             if (!approval_id) {
                 const display = options.display ? await options.display(params) : undefined;
-                return toolText(JSON.stringify(await requestApproval(action, params, undefined, channelContext, display), null, 2));
+                try {
+                    return toolText(JSON.stringify(await requestApproval(action, params, undefined, channelContext, display), null, 2));
+                }
+                catch (error) {
+                    // The plain sentence, unchanged: no approval row exists to describe.
+                    if (error instanceof ResourceProjectRefusal)
+                        return plainRefusalResult(error.message);
+                    throw error;
+                }
             }
             const check = await checkApproval(approval_id, { consume: true, action, params });
             decidedBy = check.decided_by;

package/build/lib/db-error.d.ts

@@ -28,6 +28,21 @@ export declare function toolError(body: unknown): {
         text: string;
     }[];
 };
+/**
+ * An expected, caller-safe refusal whose message is the whole answer (#4447). Handlers throw it
+ * from deep helpers; withToolErrors and withApproval return the sentence unchanged instead of
+ * mapping it to a generic database error or wrapping it in a JSON envelope.
+ */
+export declare class PlainToolRefusal extends Error {
+}
+/** The refusal as tool text with isError, exempt from JSON re-coding by codedToolResult. */
+export declare function plainRefusalResult(message: string): {
+    isError: true;
+    content: {
+        type: 'text';
+        text: string;
+    }[];
+};
 /** A table known to block a delete. `count` is best-effort; it may throw or return null. */
 export interface DeleteBlocker {
     table: string;

package/build/lib/db-error.js

@@ -47,6 +47,20 @@ export function dbToolError(error, message = 'Unable to complete database operat
 export function toolError(body) {
     return { isError: true, content: [{ type: 'text', text: JSON.stringify(body, null, 2) }] };
 }
+/**
+ * An expected, caller-safe refusal whose message is the whole answer (#4447). Handlers throw it
+ * from deep helpers; withToolErrors and withApproval return the sentence unchanged instead of
+ * mapping it to a generic database error or wrapping it in a JSON envelope.
+ */
+export class PlainToolRefusal extends Error {
+}
+const plainRefusalResults = new WeakSet();
+/** The refusal as tool text with isError, exempt from JSON re-coding by codedToolResult. */
+export function plainRefusalResult(message) {
+    const result = { isError: true, content: [{ type: 'text', text: message }] };
+    plainRefusalResults.add(result);
+    return result;
+}
 /**
  * A DELETE refused by a foreign key (23503) is a conflict ("something still uses this"), not a
  * missing record. Returns null for any other error so callers fall through to their normal path.
@@ -239,6 +253,8 @@ export function toolErrorClass(body) {
 }
 /** Add a stable class to refusals without dropping existing fields or success data. */
 export function codedToolResult(result) {
+    if (plainRefusalResults.has(result))
+        return result;
     let failed = result.isError === true;
     const content = result.content.map(block => {
         if (block.type !== 'text' || typeof block.text !== 'string')
@@ -293,6 +309,8 @@ export function withToolErrors(handler) {
         catch (error) {
             if (error instanceof McpError && error.code === ErrorCode.UrlElicitationRequired)
                 throw error;
+            if (error instanceof PlainToolRefusal)
+                return plainRefusalResult(error.message);
             return codedToolResult(dbErrorResult(error));
         }
     };

package/build/lib/resource-project.d.ts

@@ -0,0 +1,339 @@
+import { PlainToolRefusal } from './db-error.js';
+/**
+ * #4447: a gated call must only name resources of the project the connection is on.
+ *
+ * `requestApproval` is the one path every gated tool reaches, so the check lives there (before the
+ * snapshot, the approval row, the webhook and the sandbox auto-approve). Handlers that already
+ * validate ownership keep doing so; this closes the ones that never did.
+ *
+ * The registry is keyed by action, then by param path. A path may be nested (`consent.site_id`,
+ * `payload.contact_ids`, `projects[].project_id`); arrays are walked at every level. The static test
+ * `resource-project-registry.test.ts` fails when a UUID field on a gated tool schema is missing here.
+ */
+export declare class ResourceProjectRefusal extends PlainToolRefusal {
+    /** Internal audit context only; never include it in tool output. */
+    readonly ownerProjectId?: string;
+    constructor(message: string, ownerProjectId?: string);
+}
+type Scope = 'project' | 'org';
+export interface Lookup {
+    table: string;
+    /** Column that holds the id named in the call. */
+    column: string;
+    /** `project_id` rows compare with the active project; `org_id` rows with its organization. */
+    scope: Scope;
+    /** Resolve the owner through a parent row (campaign_steps has no project_id). */
+    parent?: {
+        fk: string;
+        table: string;
+    };
+    /** The id is a label inside a JSON column, so it can match several rows (one query per id). */
+    perValue?: boolean;
+}
+declare const RESOURCES: {
+    readonly site: {
+        readonly noun: 'site';
+        readonly lookup: {
+            readonly table: 'sites';
+            readonly column: 'id';
+            readonly scope: 'project';
+        };
+    };
+    readonly campaign: {
+        readonly noun: 'campaign';
+        readonly lookup: {
+            readonly table: 'campaigns';
+            readonly column: 'id';
+            readonly scope: 'project';
+        };
+    };
+    readonly campaign_set: {
+        readonly noun: 'campaign set';
+        readonly lookup: {
+            readonly table: 'campaigns';
+            readonly column: 'metadata->>campaign_set_id';
+            readonly scope: 'project';
+            readonly perValue: true;
+        };
+    };
+    readonly step: {
+        readonly noun: 'campaign step';
+        readonly lookup: {
+            readonly table: 'campaign_steps';
+            readonly column: 'id';
+            readonly scope: 'project';
+            readonly parent: {
+                readonly fk: 'campaign_id';
+                readonly table: 'campaigns';
+            };
+        };
+    };
+    readonly contact: {
+        readonly noun: 'contact';
+        readonly lookup: {
+            readonly table: 'subscribers';
+            readonly column: 'id';
+            readonly scope: 'project';
+        };
+    };
+    readonly segment: {
+        readonly noun: 'segment';
+        readonly lookup: {
+            readonly table: 'segments';
+            readonly column: 'id';
+            readonly scope: 'project';
+        };
+    };
+    readonly list: {
+        readonly noun: 'list';
+        readonly lookup: {
+            readonly table: 'contact_lists';
+            readonly column: 'id';
+            readonly scope: 'project';
+        };
+    };
+    readonly form: {
+        readonly noun: 'form';
+        readonly lookup: {
+            readonly table: 'signup_forms';
+            readonly column: 'id';
+            readonly scope: 'project';
+        };
+    };
+    readonly short_link: {
+        readonly noun: 'short link';
+        readonly lookup: {
+            readonly table: 'short_links';
+            readonly column: 'id';
+            readonly scope: 'project';
+        };
+    };
+    readonly asset_link: {
+        readonly noun: 'asset link';
+        readonly lookup: {
+            readonly table: 'asset_links';
+            readonly column: 'id';
+            readonly scope: 'project';
+        };
+    };
+    readonly domain: {
+        readonly noun: 'domain';
+        readonly lookup: {
+            readonly table: 'domains';
+            readonly column: 'id';
+            readonly scope: 'project';
+        };
+    };
+    readonly message: {
+        readonly noun: 'message';
+        readonly lookup: {
+            readonly table: 'agent_messages';
+            readonly column: 'id';
+            readonly scope: 'project';
+        };
+    };
+    readonly ccpa_request: {
+        readonly noun: 'CCPA request';
+        readonly lookup: {
+            readonly table: 'compliance_requests';
+            readonly column: 'id';
+            readonly scope: 'project';
+        };
+    };
+    readonly connection: {
+        readonly noun: 'connection';
+        readonly lookup: {
+            readonly table: 'platform_connections';
+            readonly column: 'id';
+            readonly scope: 'project';
+        };
+    };
+    readonly import_job: {
+        readonly noun: 'import';
+        readonly lookup: {
+            readonly table: 'import_jobs';
+            readonly column: 'id';
+            readonly scope: 'project';
+        };
+    };
+    readonly api_key: {
+        readonly noun: 'API key';
+        readonly lookup: {
+            readonly table: 'api_keys';
+            readonly column: 'id';
+            readonly scope: 'project';
+        };
+    };
+    readonly ab_test: {
+        readonly noun: 'A/B test';
+        readonly lookup: {
+            readonly table: 'ab_tests';
+            readonly column: 'id';
+            readonly scope: 'project';
+        };
+    };
+    readonly webhook: {
+        readonly noun: 'webhook subscription';
+        readonly lookup: {
+            readonly table: 'webhook_subscriptions';
+            readonly column: 'id';
+            readonly scope: 'project';
+        };
+    };
+    readonly social_post: {
+        readonly noun: 'social post';
+        readonly lookup: {
+            readonly table: 'social_posts';
+            readonly column: 'id';
+            readonly scope: 'project';
+        };
+    };
+    readonly custom_field: {
+        readonly noun: 'custom field';
+        readonly lookup: {
+            readonly table: 'custom_field_definitions';
+            readonly column: 'id';
+            readonly scope: 'project';
+        };
+    };
+    readonly view: {
+        readonly noun: 'saved view';
+        readonly lookup: {
+            readonly table: 'subscriber_list_views';
+            readonly column: 'id';
+            readonly scope: 'project';
+        };
+    };
+    readonly block: {
+        readonly noun: 'content block';
+        readonly lookup: {
+            readonly table: 'content_blocks';
+            readonly column: 'id';
+            readonly scope: 'project';
+        };
+    };
+    readonly page: {
+        readonly noun: 'landing page';
+        readonly lookup: {
+            readonly table: 'landing_pages';
+            readonly column: 'id';
+            readonly scope: 'project';
+        };
+    };
+    readonly newsletter: {
+        readonly noun: 'newsletter';
+        readonly lookup: {
+            readonly table: 'newsletters';
+            readonly column: 'id';
+            readonly scope: 'project';
+        };
+    };
+    readonly issue: {
+        readonly noun: 'newsletter issue';
+        readonly lookup: {
+            readonly table: 'newsletter_issues';
+            readonly column: 'id';
+            readonly scope: 'project';
+        };
+    };
+    readonly template: {
+        readonly noun: 'template';
+        readonly lookup: {
+            readonly table: 'campaign_templates';
+            readonly column: 'id';
+            readonly scope: 'project';
+        };
+    };
+    readonly signature: {
+        readonly noun: 'signature';
+        readonly lookup: {
+            readonly table: 'signature_blocks';
+            readonly column: 'id';
+            readonly scope: 'project';
+        };
+    };
+    readonly draft: {
+        readonly noun: 'draft';
+        readonly lookup: {
+            readonly table: 'ai_drafts';
+            readonly column: 'id';
+            readonly scope: 'project';
+        };
+    };
+    readonly brand_asset: {
+        readonly noun: 'brand asset';
+        readonly lookup: {
+            readonly table: 'brand_media_assets';
+            readonly column: 'id';
+            readonly scope: 'project';
+        };
+    };
+    readonly mcp_connection: {
+        readonly noun: 'MCP connection';
+        readonly lookup: {
+            readonly table: 'mcp_oauth_tokens';
+            readonly column: 'id';
+            readonly scope: 'project';
+        };
+    };
+    readonly invitation: {
+        readonly noun: 'invitation';
+        readonly lookup: {
+            readonly table: 'org_invitations';
+            readonly column: 'id';
+            readonly scope: 'org';
+        };
+    };
+    readonly user: {
+        readonly noun: 'user';
+        readonly lookup: {
+            readonly table: 'org_members';
+            readonly column: 'user_id';
+            readonly scope: 'org';
+        };
+    };
+    readonly project: {
+        readonly noun: 'project';
+        readonly lookup: {
+            readonly table: 'projects';
+            readonly column: 'id';
+            readonly scope: 'org';
+        };
+    };
+    readonly org: {
+        readonly noun: 'organization';
+    };
+    readonly saved_credential: {
+        readonly noun: 'credential';
+    };
+};
+export type ResourceKey = keyof typeof RESOURCES;
+/**
+ * Action -> param path -> resource. Paths are relative to the params given to requestApproval.
+ * Order is the order refusals are reported in. `[]` is a readability marker; arrays are always walked.
+ */
+export declare const RESOURCE_PARAM_REGISTRY: Readonly<Record<string, Readonly<Record<string, ResourceKey>>>>;
+/** Paths registered for an action, in report order (empty when the action names no resource). */
+export declare function resourceParamPaths(action: string): string[];
+export interface ResourceRef {
+    key: ResourceKey;
+    noun: string;
+    value: string | null;
+    lookup?: Lookup;
+}
+/**
+ * Every registered resource the call names, in registry order and de-duplicated. Pure: no reads.
+ * Also used by tests to seed exactly the rows a call needs.
+ */
+export declare function collectResourceRefs(action: string, params: Record<string, unknown>): ResourceRef[];
+/**
+ * Refuse a gated call that names a resource outside the project this connection is on (#4447).
+ * Reads with the service-role client because the project-scoped client cannot see another
+ * project's row; selects only ids and project_id/org_id. Fails closed.
+ * Missing, malformed and foreign ids share one sentence to avoid an existence oracle.
+ *
+ * Throws ResourceProjectRefusal whose message is the plain sentence for the caller; returns when
+ * every named resource is in the active project, or when the call names no registered resource.
+ */
+export declare function assertResourcesBelongToActiveProject(action: string, params: Record<string, unknown>): Promise<void>;
+export {};

package/build/lib/resource-project.js

@@ -0,0 +1,331 @@
+import { chunkIds, parseSavedCredentialId } from '@sendinel/domain';
+import { adminDb } from '../db.js';
+import { getProjectId } from '../project.js';
+import { PlainToolRefusal } from './db-error.js';
+/**
+ * #4447: a gated call must only name resources of the project the connection is on.
+ *
+ * `requestApproval` is the one path every gated tool reaches, so the check lives there (before the
+ * snapshot, the approval row, the webhook and the sandbox auto-approve). Handlers that already
+ * validate ownership keep doing so; this closes the ones that never did.
+ *
+ * The registry is keyed by action, then by param path. A path may be nested (`consent.site_id`,
+ * `payload.contact_ids`, `projects[].project_id`); arrays are walked at every level. The static test
+ * `resource-project-registry.test.ts` fails when a UUID field on a gated tool schema is missing here.
+ */
+export class ResourceProjectRefusal extends PlainToolRefusal {
+    /** Internal audit context only; never include it in tool output. */
+    ownerProjectId;
+    constructor(message, ownerProjectId) {
+        super(message);
+        this.name = 'ResourceProjectRefusal';
+        Object.defineProperty(this, 'ownerProjectId', { value: ownerProjectId, enumerable: false });
+    }
+}
+// Every table and column below was confirmed against packages/supabase/migrations.
+const RESOURCES = {
+    site: { noun: 'site', lookup: { table: 'sites', column: 'id', scope: 'project' } },
+    campaign: { noun: 'campaign', lookup: { table: 'campaigns', column: 'id', scope: 'project' } },
+    // Sets are a label in campaigns.metadata (campaign-sets.ts), not a table of their own.
+    campaign_set: { noun: 'campaign set', lookup: { table: 'campaigns', column: 'metadata->>campaign_set_id', scope: 'project', perValue: true } },
+    step: { noun: 'campaign step', lookup: { table: 'campaign_steps', column: 'id', scope: 'project', parent: { fk: 'campaign_id', table: 'campaigns' } } },
+    contact: { noun: 'contact', lookup: { table: 'subscribers', column: 'id', scope: 'project' } },
+    segment: { noun: 'segment', lookup: { table: 'segments', column: 'id', scope: 'project' } },
+    list: { noun: 'list', lookup: { table: 'contact_lists', column: 'id', scope: 'project' } },
+    form: { noun: 'form', lookup: { table: 'signup_forms', column: 'id', scope: 'project' } },
+    short_link: { noun: 'short link', lookup: { table: 'short_links', column: 'id', scope: 'project' } },
+    asset_link: { noun: 'asset link', lookup: { table: 'asset_links', column: 'id', scope: 'project' } },
+    domain: { noun: 'domain', lookup: { table: 'domains', column: 'id', scope: 'project' } },
+    message: { noun: 'message', lookup: { table: 'agent_messages', column: 'id', scope: 'project' } },
+    ccpa_request: { noun: 'CCPA request', lookup: { table: 'compliance_requests', column: 'id', scope: 'project' } },
+    connection: { noun: 'connection', lookup: { table: 'platform_connections', column: 'id', scope: 'project' } },
+    import_job: { noun: 'import', lookup: { table: 'import_jobs', column: 'id', scope: 'project' } },
+    api_key: { noun: 'API key', lookup: { table: 'api_keys', column: 'id', scope: 'project' } },
+    ab_test: { noun: 'A/B test', lookup: { table: 'ab_tests', column: 'id', scope: 'project' } },
+    webhook: { noun: 'webhook subscription', lookup: { table: 'webhook_subscriptions', column: 'id', scope: 'project' } },
+    // Both tables carry project_id and org_id; their handlers filter on project_id.
+    social_post: { noun: 'social post', lookup: { table: 'social_posts', column: 'id', scope: 'project' } },
+    custom_field: { noun: 'custom field', lookup: { table: 'custom_field_definitions', column: 'id', scope: 'project' } },
+    view: { noun: 'saved view', lookup: { table: 'subscriber_list_views', column: 'id', scope: 'project' } },
+    block: { noun: 'content block', lookup: { table: 'content_blocks', column: 'id', scope: 'project' } },
+    page: { noun: 'landing page', lookup: { table: 'landing_pages', column: 'id', scope: 'project' } },
+    newsletter: { noun: 'newsletter', lookup: { table: 'newsletters', column: 'id', scope: 'project' } },
+    issue: { noun: 'newsletter issue', lookup: { table: 'newsletter_issues', column: 'id', scope: 'project' } },
+    template: { noun: 'template', lookup: { table: 'campaign_templates', column: 'id', scope: 'project' } },
+    signature: { noun: 'signature', lookup: { table: 'signature_blocks', column: 'id', scope: 'project' } },
+    draft: { noun: 'draft', lookup: { table: 'ai_drafts', column: 'id', scope: 'project' } },
+    brand_asset: { noun: 'brand asset', lookup: { table: 'brand_media_assets', column: 'id', scope: 'project' } },
+    mcp_connection: { noun: 'MCP connection', lookup: { table: 'mcp_oauth_tokens', column: 'id', scope: 'project' } },
+    // Organization-scoped rows: no project_id, so the owner is the organization.
+    invitation: { noun: 'invitation', lookup: { table: 'org_invitations', column: 'id', scope: 'org' } },
+    user: { noun: 'user', lookup: { table: 'org_members', column: 'user_id', scope: 'org' } },
+    project: { noun: 'project', lookup: { table: 'projects', column: 'id', scope: 'org' } },
+    // The id is the organization itself; it is compared with the active project's org_id.
+    org: { noun: 'organization' },
+    // `platform:<uuid>` or `import:<uuid>`; expanded into connection / import_job below.
+    saved_credential: { noun: 'credential' },
+};
+/**
+ * Action -> param path -> resource. Paths are relative to the params given to requestApproval.
+ * Order is the order refusals are reported in. `[]` is a readability marker; arrays are always walked.
+ */
+export const RESOURCE_PARAM_REGISTRY = {
+    action_ccpa_request: { request_id: 'ccpa_request' },
+    activate_campaigns: { campaign_set_id: 'campaign_set', campaign_ids: 'campaign' },
+    add_list_members: { list_id: 'list', contact_ids: 'contact' },
+    add_list_members_by_filter: { list_id: 'list' },
+    archive_form: { form_id: 'form' },
+    broadcast_to_segment: { site_id: 'site', segment_id: 'segment', 'brand_asset_ids[]': 'brand_asset' },
+    bulk_update_subscribers: { contact_ids: 'contact' },
+    create_agent_mailbox: { mcp_connection_id: 'mcp_connection', site_id: 'site' },
+    create_blog_post: { site_id: 'site' },
+    create_campaign_with_content: { site_id: 'site', segment_id: 'segment' },
+    delete_campaign: { campaign_id: 'campaign', campaign_ids: 'campaign' },
+    delete_campaign_step: { step_id: 'step', step_ids: 'step' },
+    delete_content_block: { block_id: 'block', block_ids: 'block' },
+    delete_custom_field: { id: 'custom_field', ids: 'custom_field' },
+    delete_landing_page: { page_id: 'page', page_ids: 'page' },
+    delete_list: { list_id: 'list', list_ids: 'list' },
+    delete_provider_credential: { org_id: 'org', credential_id: 'saved_credential' },
+    delete_segment: { segment_id: 'segment', segment_ids: 'segment' },
+    delete_signature: { id: 'signature', ids: 'signature' },
+    delete_social_post: { post_id: 'social_post', post_ids: 'social_post' },
+    delete_subscriber_data: { contact_id: 'contact', contact_ids: 'contact' },
+    delete_subscriber_view: { view_id: 'view', view_ids: 'view' },
+    delete_template: { id: 'template', ids: 'template' },
+    delete_webhook_subscription: { subscription_id: 'webhook', subscription_ids: 'webhook' },
+    disconnect_platform: { org_id: 'org', connection_id: 'connection' },
+    draft_agent_reply: { message_id: 'message' },
+    emit_contact_event: { 'consent.site_id': 'site' },
+    enroll_automation: { subscriber_id: 'contact', campaign_id: 'campaign', site_id: 'site' },
+    enroll_contact: { campaign_id: 'campaign', contact_id: 'contact' },
+    enroll_in_escalation_ladder: { subscriber_id: 'contact', campaign_id: 'campaign' },
+    enroll_segment: { campaign_id: 'campaign', site_id: 'site' },
+    identify_inactive: { site_id: 'site' },
+    identify_subscriber: { site_id: 'site' },
+    import_subscribers: { site_id: 'site' },
+    invite_team_member: { 'project_ids[]': 'project' },
+    launch_campaign: { site_id: 'site', segment_id: 'segment', 'generated.contact_ids': 'contact' },
+    merge_subscribers: { target_id: 'contact', 'source_ids[]': 'contact' },
+    promote_ab_winner: { test_id: 'ab_test' },
+    recheck_domain_dns: { domain_id: 'domain' },
+    remove_list_members: { list_id: 'list', contact_ids: 'contact' },
+    remove_team_member: { org_id: 'org', user_id: 'user' },
+    replay_enrollment_dlq_rows: { site_id: 'site' },
+    reply_to_comment: { target_member_id: 'user' },
+    revoke_api_key: { key_id: 'api_key' },
+    revoke_invitation: { org_id: 'org', invitation_id: 'invitation' },
+    rotate_custom_webhook_secret: { connection_id: 'connection' },
+    schedule_newsletter_issue: { newsletter_id: 'newsletter', issue_id: 'issue' },
+    schedule_social_post: { campaign_id: 'campaign' },
+    send_awaiting_reply: { site_id: 'site', template_id: 'template' },
+    send_broadcast: {
+        site_id: 'site', segment_id: 'segment', 'brand_asset_ids[]': 'brand_asset',
+        'payload.site_id': 'site', 'payload.segment_id': 'segment', 'payload.brand_asset_ids[]': 'brand_asset',
+        'payload.contact_ids': 'contact',
+    },
+    send_newsletter_issue: { newsletter_id: 'newsletter', issue_id: 'issue' },
+    send_sms: { site_id: 'site', contact_id: 'contact' },
+    send_sms_campaign: { site_id: 'site', segment_id: 'segment' },
+    send_test_email: { site_id: 'site', step_id: 'step', draft_id: 'draft' },
+    send_transactional: { site_id: 'site', template_id: 'template' },
+    set_campaign_trigger: { campaign_id: 'campaign', 'input.campaign_id': 'campaign' },
+    set_contact_sms_consent: { contact_id: 'contact' },
+    set_link_domain: { site_id: 'site' },
+    set_member_project_access: { org_id: 'org', user_id: 'user', 'projects[].project_id': 'project' },
+    set_team_member_role: { org_id: 'org', user_id: 'user' },
+    start_provider_switch: { site_id: 'site' },
+    tenant_export_full: { siteId: 'site' },
+    update_asset_link: { asset_link_id: 'asset_link' },
+    update_campaign: {
+        campaign_id: 'campaign', site_id: 'site', segment_id: 'segment',
+        'input.campaign_id': 'campaign', 'input.site_id': 'site', 'input.segment_id': 'segment',
+        'updates.site_id': 'site', 'updates.segment_id': 'segment',
+    },
+    update_campaign_status: { campaign_id: 'campaign' },
+    update_form: { form_id: 'form' },
+    update_landing_page: { page_id: 'page', site_id: 'site', form_id: 'form' },
+    update_short_link: { short_link_id: 'short_link' },
+    update_webhook_subscription: { subscription_id: 'webhook' },
+};
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** Paths registered for an action, in report order (empty when the action names no resource). */
+export function resourceParamPaths(action) {
+    return Object.keys(RESOURCE_PARAM_REGISTRY[action] ?? {});
+}
+/** Every value at `path`, walking arrays at each level. Absent fields yield nothing. */
+function valuesAt(value, segments, out) {
+    if (Array.isArray(value)) {
+        for (const item of value)
+            valuesAt(item, segments, out);
+        return;
+    }
+    if (segments.length === 0) {
+        out.push(value);
+        return;
+    }
+    if (!value || typeof value !== 'object')
+        return;
+    const [head, ...rest] = segments;
+    if (!Object.prototype.hasOwnProperty.call(value, head))
+        return;
+    valuesAt(value[head], rest, out);
+}
+/** `value` is null when the text can never be an id (reported as not found, never queried). */
+function refsFor(key, raw) {
+    const spec = RESOURCES[key];
+    if (typeof raw !== 'string')
+        return [{ key, noun: spec.noun, value: null }];
+    if (key === 'saved_credential') {
+        const parsed = parseSavedCredentialId(raw);
+        if (!parsed)
+            return [{ key, noun: spec.noun, value: null }];
+        const target = parsed.source === 'platform' ? 'connection' : 'import_job';
+        return [{ key: target, noun: spec.noun, value: parsed.rowId, lookup: RESOURCES[target].lookup }];
+    }
+    return [{ key, noun: spec.noun, value: UUID.test(raw) ? raw : null, lookup: spec.lookup }];
+}
+class LookupFailure extends Error {
+}
+const adminEmail = () => adminDb().schema('email');
+async function must(query) {
+    const { data, error } = await query;
+    if (error)
+        throw new LookupFailure('lookup failed');
+    return data;
+}
+/** id -> the project or organization ids that own it. A missing id has no entry. */
+async function owners(lookup, values) {
+    const scopeColumn = lookup.scope === 'project' ? 'project_id' : 'org_id';
+    const found = new Map();
+    const add = (id, owner) => {
+        if (typeof id !== 'string' || typeof owner !== 'string')
+            return;
+        found.set(id, [...(found.get(id) ?? []), owner]);
+    };
+    if (lookup.perValue) {
+        for (const value of values) {
+            const rows = await must(adminEmail().from(lookup.table).select(`id, ${scopeColumn}`).eq(lookup.column, value));
+            for (const row of rows ?? [])
+                add(value, row[scopeColumn]);
+        }
+        return found;
+    }
+    for (const chunk of chunkIds(values)) {
+        if (lookup.parent) {
+            const { fk, table } = lookup.parent;
+            const children = await must(adminEmail().from(lookup.table).select(`${lookup.column}, ${fk}`).in(lookup.column, chunk));
+            const parentIds = [...new Set((children ?? []).map(row => row[fk]).filter((id) => typeof id === 'string'))];
+            const parents = new Map();
+            for (const parentChunk of chunkIds(parentIds)) {
+                const rows = await must(adminEmail().from(table).select(`id, ${scopeColumn}`).in('id', parentChunk));
+                for (const row of rows ?? [])
+                    if (typeof row.id === 'string' && typeof row[scopeColumn] === 'string')
+                        parents.set(row.id, row[scopeColumn]);
+            }
+            for (const row of children ?? [])
+                add(row[lookup.column], parents.get(row[fk]));
+            continue;
+        }
+        const rows = await must(adminEmail().from(lookup.table).select(`${lookup.column}, ${scopeColumn}`).in(lookup.column, chunk));
+        for (const row of rows ?? [])
+            add(row[lookup.column], row[scopeColumn]);
+    }
+    return found;
+}
+/**
+ * Every registered resource the call names, in registry order and de-duplicated. Pure: no reads.
+ * Also used by tests to seed exactly the rows a call needs.
+ */
+export function collectResourceRefs(action, params) {
+    const registered = RESOURCE_PARAM_REGISTRY[action];
+    const refs = [];
+    if (!registered)
+        return refs;
+    const seen = new Set();
+    for (const [path, key] of Object.entries(registered)) {
+        const raw = [];
+        valuesAt(params, path.replace(/\[\]/g, '').split('.'), raw);
+        for (const value of raw) {
+            if (value === undefined || value === null || value === '')
+                continue;
+            for (const ref of refsFor(key, value)) {
+                const id = `${ref.key}:${ref.value ?? `invalid:${String(value)}`}`;
+                if (seen.has(id))
+                    continue;
+                seen.add(id);
+                refs.push(ref);
+            }
+        }
+    }
+    return refs;
+}
+const FAILED_CLOSED = 'Could not check which project the resources in this request belong to, so no approval was requested. Try again.';
+const NOT_FOUND = "I can't find that item in this project.";
+/**
+ * Refuse a gated call that names a resource outside the project this connection is on (#4447).
+ * Reads with the service-role client because the project-scoped client cannot see another
+ * project's row; selects only ids and project_id/org_id. Fails closed.
+ * Missing, malformed and foreign ids share one sentence to avoid an existence oracle.
+ *
+ * Throws ResourceProjectRefusal whose message is the plain sentence for the caller; returns when
+ * every named resource is in the active project, or when the call names no registered resource.
+ */
+export async function assertResourcesBelongToActiveProject(action, params) {
+    const refs = collectResourceRefs(action, params);
+    if (refs.length === 0)
+        return;
+    // Malformed ids cannot exist; refuse before even reading the active project.
+    if (refs[0].value === null)
+        throw new ResourceProjectRefusal(NOT_FOUND);
+    try {
+        const projectId = getProjectId();
+        const active = await must(adminEmail().from('projects').select('id, org_id').eq('id', projectId).maybeSingle());
+        if (active?.id !== projectId || typeof active.org_id !== 'string')
+            throw new LookupFailure('active project unavailable');
+        const byKey = new Map();
+        for (const ref of refs) {
+            if (ref.value === null || ref.key === 'org')
+                continue;
+            let values = byKey.get(ref.key);
+            if (!values) {
+                values = new Set();
+                byKey.set(ref.key, values);
+            }
+            values.add(ref.value);
+        }
+        const found = new Map();
+        // Resolve lazily in registry order so a later lookup failure cannot hide the first refusal.
+        for (const ref of refs) {
+            if (ref.value === null)
+                throw new ResourceProjectRefusal(NOT_FOUND);
+            if (ref.key === 'org') {
+                if (ref.value === active.org_id)
+                    continue;
+                // No foreign-only reads: their timing or failures could reveal whether an id exists.
+                throw new ResourceProjectRefusal(NOT_FOUND);
+            }
+            const lookup = RESOURCES[ref.key].lookup;
+            if (!found.has(ref.key))
+                found.set(ref.key, await owners(lookup, [...byKey.get(ref.key)]));
+            const ownerIds = found.get(ref.key)?.get(ref.value);
+            if (!ownerIds?.length)
+                throw new ResourceProjectRefusal(NOT_FOUND);
+            const home = lookup.scope === 'project' ? projectId : active.org_id;
+            if (ownerIds.includes(home))
+                continue;
+            if (lookup.scope === 'org') {
+                throw new ResourceProjectRefusal(NOT_FOUND);
+            }
+            // Keep the owner id for internal audit without a foreign-only project/name lookup.
+            throw new ResourceProjectRefusal(NOT_FOUND, ownerIds[0]);
+        }
+    }
+    catch (error) {
+        if (error instanceof ResourceProjectRefusal)
+            throw error;
+        // Never describe an id as missing because a read failed, and never let the call continue.
+        console.warn('[mcp] Resource project check could not complete; refusing the request.');
+        throw new ResourceProjectRefusal(FAILED_CLOSED);
+    }
+}

package/build/lib/summarize-step-for-status.d.ts

@@ -0,0 +1,3 @@
+export declare function extractStepLinks(bodyHtml: string): string[];
+export declare function extractStepPreheader(bodyHtml: string): string | null;
+export declare function summarizeStepForStatus(step: Record<string, unknown>): Record<string, unknown>;

package/build/lib/summarize-step-for-status.js

@@ -0,0 +1,41 @@
+const HREF_RE = /<a\b[^>]*?\shref\s*=\s*(?:"([^"]*)"|'([^']*)')/gi;
+const PREHEADER_RE = /^\s*<span\b[^>]*\bstyle\s*=\s*(?:"[^"]*display:\s*none[^"]*"|'[^']*display:\s*none[^']*')[^>]*>([\s\S]*?)<\/span>/i;
+function htmlUnescape(text) {
+    return text
+        .replace(/&amp;/g, '&')
+        .replace(/&lt;/g, '<')
+        .replace(/&gt;/g, '>')
+        .replace(/&quot;/g, '"')
+        .replace(/&#39;/g, "'");
+}
+export function extractStepLinks(bodyHtml) {
+    const links = [];
+    const seen = new Set();
+    HREF_RE.lastIndex = 0;
+    let match;
+    while ((match = HREF_RE.exec(bodyHtml)) !== null) {
+        const href = match[1] ?? match[2] ?? '';
+        if (!seen.has(href)) {
+            seen.add(href);
+            links.push(href);
+        }
+    }
+    return links;
+}
+export function extractStepPreheader(bodyHtml) {
+    const match = bodyHtml.match(PREHEADER_RE);
+    if (!match)
+        return null;
+    return htmlUnescape(match[1]);
+}
+export function summarizeStepForStatus(step) {
+    const { body_html, body_text, blocks, ...rest } = step;
+    const bodyHtml = typeof body_html === 'string' ? body_html : '';
+    return {
+        ...rest,
+        subject: step.subject,
+        preheader: bodyHtml ? extractStepPreheader(bodyHtml) : null,
+        links: extractStepLinks(bodyHtml),
+        body_length: bodyHtml.length,
+    };
+}

package/build/tools/campaigns.js

@@ -36,6 +36,7 @@ import { checkCampaignMergeVariables, persistMergeVariableWarnings, summarizeMer
 import { recordBrandAssetUsage } from '../lib/brand-asset-usage.js';
 import { BLOCK_GENERATION_SCHEMA, blocksToHtml, blocksToText, normalizeComposerBlocks } from '../lib/composer-blocks.js';
 import { callSendinelV1 } from '../lib/v1-client.js';
+import { summarizeStepForStatus } from '../lib/summarize-step-for-status.js';
 import { countUniqueEngagementByCampaign } from '../lib/campaign-engagement.js';
 const txt = (text) => ({ content: [{ type: 'text', text }] });
 const j = (data) => txt(JSON.stringify(data, null, 2));
@@ -4028,9 +4029,13 @@ Return ONLY valid JSON with this exact shape:
             idempotentHint: true,
             openWorldHint: false,
         },
-        description: 'Get full campaign details including all steps, enrollment counts and derived trigger_kind (event/tag/date_field/contact_event/manual), saved trigger_type, trigger_event_name, trigger_tag, trigger_config (including where filter), fires_on and trigger_diagnostics. Read what event a dunning campaign fires on; use set_campaign_trigger to change it. trigger_kind is the canonical answer to what fires the campaign; trigger_type is the stored schedule mode and stays "manual" for event and tag triggers. ' + ACTIVATION_APPROVAL_DESCRIPTION,
-        inputSchema: { campaign_id: z.string().uuid(), period: z.string().min(1).optional().describe("Return results for one enrollment period; totals remain all-time.") },
-    }, async ({ campaign_id, period }) => {
+        description: 'Get full campaign details including all steps, enrollment counts and derived trigger_kind (event/tag/date_field/contact_event/manual), saved trigger_type, trigger_event_name, trigger_tag, trigger_config (including where filter), fires_on and trigger_diagnostics. Read what event a dunning campaign fires on; use set_campaign_trigger to change it. trigger_kind is the canonical answer to what fires the campaign; trigger_type is the stored schedule mode and stays "manual" for event and tag triggers. Optional include_bodies (default true): when false, each step returns subject, preheader, links and body_length instead of body_html, body_text, and blocks. ' + ACTIVATION_APPROVAL_DESCRIPTION,
+        inputSchema: {
+            campaign_id: z.string().uuid(),
+            period: z.string().min(1).optional().describe("Return results for one enrollment period; totals remain all-time."),
+            include_bodies: z.boolean().optional().default(true).describe('When false, each step returns subject, preheader, links and body_length instead of body_html/body_text/blocks. Default true.'),
+        },
+    }, async ({ campaign_id, period, include_bodies }) => {
         const projectId = getProjectId();
         const { data: campaign, error: campErr } = await db()
             .from('campaigns')
@@ -4100,6 +4105,7 @@ Return ONLY valid JSON with this exact shape:
         const queuedCount = queuedEmailCount ?? 0;
         const failedCount = failedSendCount ?? 0;
         const unresolvedCount = dlqUnresolvedCount ?? 0;
+        const mappedSteps = (steps ?? []).map((step) => ({ ...step, ...stepMultiEventRulesView(step), ...stepAbsenceRuleView(step), total_sent: stepMetrics.sent.get(step.id) ?? 0 }));
         return j({
             ...campaignMetricsView(campaign),
             merge_variable_warnings: campaign.metadata?.merge_variable_warnings ?? [],
@@ -4109,7 +4115,7 @@ Return ONLY valid JSON with this exact shape:
             total_sent: periods?.totals?.sent ?? sentCount ?? 0,
             ...(periods?.totals ? { unique_opened: periods.totals.opened, unique_clicked: periods.totals.clicked } : {}),
             ...campaignPeriodFields(periods, period),
-            steps: (steps ?? []).map((step) => ({ ...step, ...stepMultiEventRulesView(step), ...stepAbsenceRuleView(step), total_sent: stepMetrics.sent.get(step.id) ?? 0 })),
+            steps: include_bodies === false ? mappedSteps.map(summarizeStepForStatus) : mappedSteps,
             active_enrollments: enrollCount ?? 0,
             send_incomplete: queuedCount > 0 || failedCount > 0 || outstandingRows.length > 0 || unresolvedCount > 0,
             queued_email_count: queuedCount,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sendinel/mcp-server",
-  "version": "1.0.221",
+  "version": "1.0.223",
   "description": "AI-controlled email operations control plane for campaigns, contacts, segments, analytics, and multi-provider sending via MCP.",
   "mcpName": "ai.sendinel/mcp-server",
   "type": "module",