@sendinel/mcp-server 1.0.231 → 1.0.233

package/build/lib/approval-classes.d.ts

@@ -1,5 +1,6 @@
 import { type ApprovalClass, type ApprovalLevel } from '@sendinel/domain';
 import { type HumanDecisionIdentity } from './approval-human-eligibility.js';
+import { type PersonConnectionGate } from './credential-gate-table.js';
 export { APPROVAL_CLASSES, approvalClass } from '@sendinel/domain';
 export type { ApprovalClass, ApprovalLevel } from '@sendinel/domain';
 export type EffectiveApproval = {
@@ -8,6 +9,8 @@ export type EffectiveApproval = {
     class: ApprovalClass | undefined;
     level: ApprovalLevel;
     applied: boolean;
+    /** #4857: set only when the table's person column let a Default-level person call through without a click. */
+    personGate?: PersonConnectionGate;
 };
 /** No transport-supplied role or preference grants authority: verify the live person grant. */
 export declare function personApprovalLevel(ctx?: HumanDecisionIdentity | undefined, action?: string): Promise<ApprovalLevel | null>;

package/build/lib/approval-classes.js

@@ -1,8 +1,11 @@
-import { approvalClass, isApprovalLevel, matchSendAllowlist, readContactTestStatus } from '@sendinel/domain';
+import { approvalClass, campaignMatchesTrigger, isApprovalLevel, matchSendAllowlist, normalizeTriggerList, readContactTestStatus } from '@sendinel/domain';
 import { adminDb, requestContext } from '../db.js';
 import { getProjectId } from '../project.js';
 import { humanApprovalEligible } from './approval-human-eligibility.js';
 import { getApprovalTier } from './action-approvals.js';
+import { isHumanRequestableAdminTool } from './admin-tools.js';
+import { personConnectionGate } from './credential-gate-table.js';
+import { sandboxAutoApproveUnavailableReason } from './sandbox-approvals.js';
 export { APPROVAL_CLASSES, approvalClass } from '@sendinel/domain';
 /** No transport-supplied role or preference grants authority: verify the live person grant. */
 export async function personApprovalLevel(ctx = requestContext(), action = 'get_approval_level') {
@@ -75,6 +78,71 @@ async function exemptTargets(action, params, ctx) {
         return false;
     }
 }
+/**
+ * #4857: would this event enroll anyone? Mirrors event intake: active triggered campaigns in this
+ * project, matched on the event, its data and the contact's stored tags. True only when every read
+ * succeeded and nothing matched; any error, short page or unexpected value is false (keep the prompt).
+ */
+async function eventMatchesNoSendingCampaign(params) {
+    const email = typeof params.email === 'string' ? params.email.trim().toLowerCase() : '';
+    const event = typeof params.event === 'string' ? params.event.trim() : '';
+    const data = params.data;
+    if (!email || !event || (data !== undefined && (data === null || typeof data !== 'object' || Array.isArray(data))))
+        return false;
+    const client = adminDb().schema('email');
+    const projectId = getProjectId();
+    const contact = await client.from('subscribers').select('tags').eq('project_id', projectId).eq('email', email).maybeSingle();
+    if (contact.error)
+        return false;
+    // Intake matches on stored tags plus request tags; the MCP tool sends none today, but any it ever
+    // forwards are included here, and a malformed value keeps the prompt.
+    if (params.tags !== undefined && !Array.isArray(params.tags))
+        return false;
+    const tags = normalizeTriggerList([...(Array.isArray(contact.data?.tags) ? contact.data.tags : []), ...(Array.isArray(params.tags) ? params.tags : [])]);
+    const campaigns = [];
+    let total = -1;
+    for (let page = 0; page < 100 && campaigns.length !== total; page++) {
+        const { data: rows, error, count } = await client.from('campaigns')
+            .select('id, trigger_event_name, trigger_tag, trigger_config', { count: 'exact' })
+            .eq('project_id', projectId).eq('status', 'active').eq('type', 'triggered')
+            .order('id', { ascending: true }).range(campaigns.length, campaigns.length + 999);
+        if (error || !Array.isArray(rows) || typeof count !== 'number' || (total !== -1 && count !== total))
+            return false;
+        total = count;
+        campaigns.push(...rows);
+        if (!rows.length || campaigns.length > total)
+            break;
+    }
+    if (campaigns.length !== total)
+        return false;
+    return !campaigns.some(campaign => campaignMatchesTrigger(campaign, { event, tags, data: (data ?? null) }));
+}
+/**
+ * #4857: the person column of CREDENTIAL_GATE_TABLE. Returns the gate that lets this one call run
+ * without a click, or null to keep today's prompt. Never for admin request-only tools; only on a
+ * project that reads as not a sandbox (sandbox auto-approve stays as it is).
+ */
+async function personGateReason(action, params, ctx) {
+    const gate = personConnectionGate(action);
+    if (!gate || isHumanRequestableAdminTool(action))
+        return null;
+    try {
+        if (action === 'set_link_domain' && params.publish_dns !== undefined && params.publish_dns !== false)
+            return null;
+        if (gate === 'allowlisted_recipients' && (typeof params.to !== 'string' || params.cc !== undefined || params.bcc !== undefined))
+            return null;
+        if (await sandboxAutoApproveUnavailableReason(getProjectId(), action) !== 'not_sandbox')
+            return null;
+        if (gate === 'config')
+            return gate;
+        if (gate === 'allowlisted_recipients')
+            return await safeAddresses([params.to], ctx) ? gate : null;
+        return await eventMatchesNoSendingCampaign(params) ? gate : null;
+    }
+    catch {
+        return null;
+    }
+}
 /** One decision function. Lookup errors preserve today's tier, including preview exceptions. */
 export async function effectiveApproval(action, params = {}, ctx = requestContext()) {
     const baseline = getApprovalTier(action, params) !== 'autonomous';
@@ -87,20 +155,23 @@ export async function effectiveApproval(action, params = {}, ctx = requestContex
         kind = 'S';
     // Live trigger edits have an additional domain gate even under the legacy autonomous mode.
     const triggerGate = ['update_campaign', 'set_campaign_trigger'].includes(action) && !!params.previous_campaign && !!params.updates;
-    const prompt = level === 'ask_every_time' ? true : level === 'auto' ? (kind === 'F' || kind === 'D') : (baseline || triggerGate) && !exempt;
-    return { prompt, class: kind, level, applied: true,
+    // #4857: Default level only; Ask every time and Auto keep their own rules.
+    const personGate = level === 'default' && baseline && !triggerGate && !exempt ? await personGateReason(action, params, ctx) : null;
+    const prompt = level === 'ask_every_time' ? true : level === 'auto' ? (kind === 'F' || kind === 'D') : (baseline || triggerGate) && !exempt && !personGate;
+    return { prompt, class: kind, level, applied: true, ...(personGate ? { personGate } : {}),
         channelRule: level === 'ask_every_time' && (kind === 'S' || kind === 'F' || (kind === 'E' && !exempt)) ? 'human_only' : 'any' };
 }
 /** Audit must succeed before a level can authorize execution. Never turn an audit failure into a send. */
 export async function auditApprovalLevel(action, decision) {
-    if (decision.prompt || !decision.applied || (decision.level === 'default' && decision.class !== 'T' && decision.class !== 'E'))
+    if (decision.prompt || !decision.applied || (decision.level === 'default' && decision.class !== 'T' && decision.class !== 'E' && !decision.personGate))
         return;
     const ctx = requestContext();
     const { error } = await adminDb().schema('email').from('audit_log').insert({
         project_id: getProjectId(), actor_type: 'user', actor_id: ctx.actorId,
         action: 'approval.level_applied', resource_type: 'approval',
         details: { action, class: decision.class, level: decision.level, user_id: ctx.actorId,
-            connection_id: `oauth:${ctx.oauthTokenId}`, reason: 'level' },
+            connection_id: `oauth:${ctx.oauthTokenId}`, reason: decision.personGate ? 'person_gate' : 'level',
+            ...(decision.personGate ? { gate: decision.personGate, policy: 'credential_gate_table' } : {}) },
     });
     if (error)
         throw new Error('Could not record your approval level. Nothing was run.');

package/build/lib/credential-gate-table.d.ts

@@ -20,13 +20,48 @@
  *
  * This table decides only whether a person must click. It never decides whether a credential
  * may call a tool at all: agentConnectionAllowsTool / testerConnectionAllowsTool still refuse
- * every delete, send, access and import tool for those connections. Person connections, API
- * keys and service credentials do not use this table.
+ * every delete, send, access and import tool for those connections. API keys and service
+ * credentials do not use this table. Person connections read only the `person` column of a row
+ * (#4857, below).
  */
 export type CredentialGate = 'autonomous' | 'draft_only' | 'gated' | 'protected';
-export declare const CREDENTIAL_GATE_TABLE: Readonly<Record<string, CredentialGate>>;
+/**
+ * #4857 person connections: the person column of the same table. Kevin, 2026-11-12 (applying his
+ * 11-04 rule): a person's own connection gets NO prompt except for sends to real outside people
+ * and deletes/data loss; sends only to the org's own test/allowlisted addresses need no prompt.
+ *
+ * A row is either a tier string (the person tier is unchanged) or { credential, person }:
+ * credential is the agent/tester tier above, person names the check below. The person column is
+ * read only for a verified person-role OAuth connection at the Default approval level
+ * (effectiveApproval in approval-classes.ts), only on a project that reads as NOT a sandbox, and
+ * never for one of the admin request-only tools. Each person value names the tool's gated form and the
+ * check that lets one call through without a click; every check fails closed (a read error or a
+ * missing value keeps today's prompt) and every call it lets through writes an
+ * approval.level_applied audit row with reason "person_gate" before it runs:
+ *
+ *   event_no_send_match     no prompt when the event matches no active triggered campaign (read
+ *                           with the intake matcher and the contact's stored tags); a match keeps
+ *                           the existing recipient check (self, allowlist or saved test contact)
+ *   allowlisted_recipients  no prompt when every recipient is the person's login email or is on a
+ *                           loaded projects.send_allowlist / organizations.send_allowlist
+ *   config                  a settings change that cannot send to a person or delete data
+ *                           (set_link_domain only without publish_dns: true)
+ *
+ * A row without a person column keeps today's person tier (getApprovalTier plus the #4436 level rules).
+ * Drafts, steps, consented single contacts and other config writes already need no person click.
+ */
+export type PersonConnectionGate = 'event_no_send_match' | 'allowlisted_recipients' | 'config';
+export type CredentialGateRow = {
+    readonly credential: CredentialGate;
+    readonly person: PersonConnectionGate;
+};
+export declare const CREDENTIAL_GATE_TABLE: Readonly<Record<string, CredentialGate | CredentialGateRow>>;
 /** Undefined means unclassified, which every caller must treat as gated. */
 export declare function credentialGateClass(tool: string): CredentialGate | undefined;
+/** #4857: the person column of a row. Undefined means keep the person's existing tier. */
+export declare function personConnectionGate(tool: string): PersonConnectionGate | undefined;
+/** Every row with a person column, derived from the one table (tests and docs). */
+export declare function personConnectionGateRows(): Record<string, PersonConnectionGate>;
 /**
  * Param forms of autonomous/draft_only tester setup tools that still need a person. Each returns a
  * reason when gated. A value that is not exactly the safe value is gated (fail closed).

package/build/lib/credential-gate-table.js

@@ -38,7 +38,7 @@ export const CREDENTIAL_GATE_TABLE = Object.freeze({
     discard_staged_import: 'gated', // discards uploaded data (data loss)
     disconnect_platform: 'gated',
     draft_agent_reply: 'gated',
-    emit_contact_event: 'gated',
+    emit_contact_event: { credential: 'gated', person: 'event_no_send_match' }, // "Saves a contact only. No email is sent." must not ask
     enroll_automation: 'gated',
     enroll_contact: 'gated',
     enroll_in_escalation_ladder: 'gated',
@@ -51,7 +51,7 @@ export const CREDENTIAL_GATE_TABLE = Object.freeze({
     invite_team_member: 'gated',
     launch_campaign: 'gated',
     publish_dmarc_record: 'gated',
-    recheck_domain_dns: 'gated',
+    recheck_domain_dns: { credential: 'gated', person: 'config' }, // live DNS re-check; sends nothing, deletes nothing
     remove_blackout_date: 'gated', // can allow sends on a blocked date
     remove_campaign_branch: 'gated', // removes saved config (delete)
     remove_campaign_goal: 'gated', // removes saved config (delete)
@@ -78,10 +78,10 @@ export const CREDENTIAL_GATE_TABLE = Object.freeze({
     send_sms: 'gated',
     send_sms_campaign: 'gated',
     send_test_email: 'gated',
-    send_transactional: 'gated',
+    send_transactional: { credential: 'gated', person: 'allowlisted_recipients' }, // one `to`, no cc/bcc; an outside address keeps one prompt
     set_connector_mapping: 'gated',
     set_contact_sms_consent: 'gated',
-    set_link_domain: 'gated',
+    set_link_domain: { credential: 'gated', person: 'config' }, // branded link host only; publish_dns: true writes into a DNS zone and keeps the prompt
     set_member_project_access: 'gated',
     set_subscriber_tags: 'gated', // a tag can trigger campaigns that send
     set_team_member_role: 'gated',
@@ -365,7 +365,24 @@ export const CREDENTIAL_GATE_TABLE = Object.freeze({
 });
 /** Undefined means unclassified, which every caller must treat as gated. */
 export function credentialGateClass(tool) {
-    return Object.prototype.hasOwnProperty.call(CREDENTIAL_GATE_TABLE, tool) ? CREDENTIAL_GATE_TABLE[tool] : undefined;
+    if (!Object.prototype.hasOwnProperty.call(CREDENTIAL_GATE_TABLE, tool))
+        return undefined;
+    const row = CREDENTIAL_GATE_TABLE[tool];
+    return typeof row === 'string' ? row : row.credential;
+}
+/** #4857: the person column of a row. Undefined means keep the person's existing tier. */
+export function personConnectionGate(tool) {
+    if (!Object.prototype.hasOwnProperty.call(CREDENTIAL_GATE_TABLE, tool))
+        return undefined;
+    const row = CREDENTIAL_GATE_TABLE[tool];
+    return typeof row === 'string' ? undefined : row.person;
+}
+/** Every row with a person column, derived from the one table (tests and docs). */
+export function personConnectionGateRows() {
+    return Object.fromEntries(Object.keys(CREDENTIAL_GATE_TABLE).flatMap(tool => {
+        const gate = personConnectionGate(tool);
+        return gate ? [[tool, gate]] : [];
+    }));
 }
 /**
  * Param forms of autonomous/draft_only tester setup tools that still need a person. Each returns a

package/build/tools/contacts.js

@@ -605,7 +605,7 @@ async function exportSubscriberData(projectId, contactId) {
 export function registerContactTools(server) {
     server.registerTool('emit_contact_event', {
         title: 'Emit Contact Event',
-        description: 'Record a contact event through POST /api/v1/events and enroll matching active triggered campaigns. Can start real sends; requires standard approval. Returns the REST outcome and sendability unchanged. Does not subscribe the contact or update contact properties.',
+        description: 'Record a contact event through POST /api/v1/events and enroll matching active triggered campaigns. Can start real sends; requires standard approval when it matches a sending campaign (a person connection is not asked when nothing matches). Returns the REST outcome and sendability unchanged. Does not subscribe the contact or update contact properties.',
         annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
         inputSchema: {
             approval_id: z.string().uuid().optional().describe('Call once to request approval, then call again with only approval_id.'),

package/build/tools/delivery-ops.js

@@ -172,7 +172,7 @@ export function registerDeliveryOpsTools(server) {
             idempotentHint: true,
             openWorldHint: true,
         },
-        description: 'Perform a live provider/DNS verification via the domains:write API and persist domain status and Elastic Email tracking observations. Returns Sendinel readiness; raw EE TrackingStatus is advisory and may remain Broken even when ready. Standard approval applies: call without approval_id, then repeat with the same domain_id and the approved approval_id. Failed checks return an error, not a readiness verdict.',
+        description: 'Perform a live provider/DNS verification via the domains:write API and persist domain status and Elastic Email tracking observations. Returns Sendinel readiness; raw EE TrackingStatus is advisory and may remain Broken even when ready. Standard approval applies (a person connection at the Default level runs it without a click): call without approval_id, then repeat with the same domain_id and the approved approval_id. Failed checks return an error, not a readiness verdict.',
         inputSchema: {
             domain_id: z.string().uuid(),
             approval_id: z.string().uuid().optional().describe('Call without this to request approval, then repeat with the approved approval_id.'),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sendinel/mcp-server",
-  "version": "1.0.231",
+  "version": "1.0.233",
   "description": "AI-controlled email operations control plane for campaigns, contacts, segments, analytics, and multi-provider sending via MCP.",
   "mcpName": "ai.sendinel/mcp-server",
   "type": "module",