@sendinel/mcp-server 1.0.9 → 1.0.11

package/build/tools/delivery-ops.js

@@ -1,8 +1,138 @@
 import { z } from 'zod';
-import { db } from '../db.js';
+import dns from 'node:dns/promises';
+import { cancelSendQueueRows, findReplayableEnrollmentDlqRows, listSendQueueRows, replayEnrollmentDlqRows, retrySendQueueRows, } from '@sendinel/domain';
+import { logAudit } from '../audit.js';
+import { adminDb, db } from '../db.js';
+import { assertChannelCanExecute, checkApproval, currentChannelContext, requestApproval } from '../lib/action-approvals.js';
+import { callSendinelV1 } from '../lib/v1-client.js';
 import { getProjectId } from '../project.js';
 const j = (data) => ({ content: [{ type: 'text', text: JSON.stringify(data, null, 2) }] });
+function asRecord(value) {
+    return value && typeof value === 'object' ? value : {};
+}
+function v1ErrorMessage(value) {
+    const body = asRecord(value);
+    return asRecord(body.error).message ?? body.error ?? value;
+}
+async function resolveNameservers(domain) {
+    const labels = domain.toLowerCase().split('.').filter(Boolean);
+    for (let index = 0; index < labels.length - 1; index += 1) {
+        const candidate = labels.slice(index).join('.');
+        try {
+            return { nameservers: await dns.resolveNs(candidate), zone: candidate };
+        }
+        catch {
+            // Try the next parent domain.
+        }
+    }
+    return { nameservers: [], zone: null };
+}
+function detectDnsProvider(nameservers) {
+    const normalized = nameservers.map((value) => value.toLowerCase());
+    if (normalized.some((value) => value.endsWith('.ns.cloudflare.com')))
+        return 'cloudflare';
+    if (normalized.some((value) => value.includes('awsdns')))
+        return 'route53';
+    if (normalized.some((value) => value.includes('googledomains') || value.includes('google')))
+        return 'google';
+    if (normalized.some((value) => value.includes('domaincontrol.com')))
+        return 'godaddy';
+    if (normalized.some((value) => value.includes('registrar-servers.com') || value.includes('namecheap')))
+        return 'namecheap';
+    return 'unknown';
+}
+async function getOrProvisionDmarcInboundToken(projectId) {
+    const sb = adminDb();
+    const { data, error } = await sb.schema('email').from('projects')
+        .select('dmarc_inbound_token').eq('id', projectId).single();
+    if (error)
+        throw new Error(error.message);
+    let token = data?.dmarc_inbound_token;
+    if (!token) {
+        token = crypto.randomUUID().replace(/-/g, '').slice(0, 24);
+        const { error: updateError } = await sb.schema('email').from('projects')
+            .update({ dmarc_inbound_token: token }).eq('id', projectId);
+        if (updateError) {
+            const { data: retry } = await sb.schema('email').from('projects')
+                .select('dmarc_inbound_token').eq('id', projectId).single();
+            token = retry?.dmarc_inbound_token ?? token;
+        }
+    }
+    if (!token)
+        throw new Error('Unable to provision DMARC inbound token');
+    return token;
+}
 export function registerDeliveryOpsTools(server) {
+    server.registerTool('list_blackout_dates', {
+        title: 'List Blackout Dates',
+        annotations: {
+            readOnlyHint: true,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: false,
+        },
+        description: 'List sending blackout dates for this project. The send-enqueue pipeline skips a due send when the contact-local date matches one of these dates.',
+        inputSchema: {},
+    }, async () => {
+        const { data, error } = await db()
+            .from('blackout_dates')
+            .select('id, date, reason, created_at')
+            .eq('project_id', getProjectId())
+            .order('date', { ascending: true });
+        if (error)
+            return j({ error: error.message });
+        return j({ blackout_dates: data ?? [] });
+    });
+    server.registerTool('add_blackout_date', {
+        title: 'Add Blackout Date',
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: false,
+        },
+        description: 'Mark a date as a sending blackout for this project. Calling this again for the same date updates its reason. Due sends are skipped for the contact-local blackout date, not cancelled.',
+        inputSchema: {
+            date: z.string().describe('Date in YYYY-MM-DD format, for example 2026-12-25'),
+            reason: z.string().optional().describe('Optional human-readable reason'),
+        },
+    }, async ({ date, reason }) => {
+        if (Number.isNaN(new Date(`${date}T00:00:00Z`).getTime())) {
+            return j({ error: 'date must be a valid YYYY-MM-DD date' });
+        }
+        const { data, error } = await db()
+            .from('blackout_dates')
+            .upsert({ project_id: getProjectId(), date, reason: reason?.trim() || null }, { onConflict: 'project_id,date' })
+            .select('id, date, reason, created_at')
+            .single();
+        if (error)
+            return j({ error: error.message });
+        return j({ blackout_date: data });
+    });
+    server.registerTool('remove_blackout_date', {
+        title: 'Remove Blackout Date',
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: true,
+            idempotentHint: false,
+            openWorldHint: false,
+        },
+        description: 'Remove a sending blackout date for this project by id. Use list_blackout_dates first to find the id.',
+        inputSchema: {
+            id: z.string().uuid(),
+        },
+    }, async ({ id }) => {
+        const { error, count } = await db()
+            .from('blackout_dates')
+            .delete({ count: 'exact' })
+            .eq('id', id)
+            .eq('project_id', getProjectId());
+        if (error)
+            return j({ error: error.message });
+        if (!count)
+            return j({ error: 'Blackout date not found', code: 'NOT_FOUND' });
+        return j({ removed: true, id });
+    });
     server.registerTool('refresh_domain_dns', {
         title: 'Refresh Domain DNS',
         annotations: {
@@ -228,6 +358,199 @@ export function registerDeliveryOpsTools(server) {
             return j({ error: error.message });
         return j({ dlq: data ?? [], count: data?.length ?? 0 });
     });
+    server.registerTool('get_enrollment_dlq', {
+        title: 'Get Enrollment DLQ',
+        annotations: {
+            readOnlyHint: true,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: false,
+        },
+        description: 'List campaign enrollments that failed every retry and stopped sending. Use replay_enrollment_dlq_rows to preview and re-enter them into active sending.',
+        inputSchema: {
+            site_id: z.string().uuid().optional(),
+            limit: z.number().int().min(1).max(50).default(20).optional(),
+            unresolved_only: z.boolean().default(true).optional(),
+        },
+    }, async ({ site_id, limit = 20, unresolved_only = true }) => {
+        const projectId = getProjectId();
+        let query = db().from('enrollment_dlq')
+            .select('id, enrollment_id, campaign_id, contact_id, enrollment_snapshot, final_error, attempts, created_at, resolved, resolved_at')
+            .eq('project_id', projectId)
+            .order('created_at', { ascending: false })
+            .limit(limit);
+        if (site_id)
+            query = query.eq('site_id', site_id);
+        if (unresolved_only)
+            query = query.eq('resolved', false);
+        const { data, error } = await query;
+        if (error)
+            return j({ error: error.message });
+        return j({ dlq: data ?? [], count: data?.length ?? 0 });
+    });
+    server.registerTool('get_send_queue_rows', {
+        title: 'Get Send Queue Rows',
+        annotations: {
+            readOnlyHint: true,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: false,
+        },
+        description: 'List individual queued sends with status, attempts, the latest error, and next retry time. Use this when aggregate queue counts do not explain which recipients are still waiting.',
+        inputSchema: {
+            site_id: z.string().uuid().optional(),
+            campaign_id: z.string().uuid().optional(),
+            status: z.array(z.enum(['pending', 'processing', 'retry'])).optional(),
+            limit: z.number().int().min(1).max(200).optional().default(50),
+        },
+    }, async ({ site_id, campaign_id, status, limit = 50 }) => {
+        try {
+            const { rows } = await listSendQueueRows({
+                projectId: getProjectId(),
+                siteId: site_id,
+                campaignId: campaign_id,
+                status,
+                limit,
+            }, db());
+            return j({ rows, count: rows.length });
+        }
+        catch (error) {
+            return j({ error: error instanceof Error ? error.message : 'Queue query failed' });
+        }
+    });
+    server.registerTool('retry_send_queue_rows', {
+        title: 'Retry Send Queue Rows',
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: false,
+        },
+        description: 'Make selected unclaimed retry rows eligible for the next processing tick without inserting another queue row or resetting attempt limits.',
+        inputSchema: {
+            site_id: z.string().uuid(),
+            campaign_id: z.string().uuid().optional(),
+            queue_ids: z.array(z.string().uuid()).min(1).max(200).optional(),
+        },
+    }, async ({ site_id, campaign_id, queue_ids }) => {
+        try {
+            const { retriedCount } = await retrySendQueueRows({
+                projectId: getProjectId(),
+                siteId: site_id,
+                campaignId: campaign_id,
+                queueIds: queue_ids,
+            }, db());
+            await logAudit({
+                action: 'send_queue.retry',
+                resourceType: 'site',
+                resourceId: site_id,
+                details: { retried_count: retriedCount, campaign_id: campaign_id ?? null },
+            });
+            return j({ retried_count: retriedCount });
+        }
+        catch (error) {
+            return j({ error: error instanceof Error ? error.message : 'Queue retry failed' });
+        }
+    });
+    server.registerTool('cancel_send_queue_rows', {
+        title: 'Cancel Send Queue Rows',
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: true,
+            idempotentHint: true,
+            openWorldHint: false,
+        },
+        description: 'Cancel selected unclaimed pending or retry rows, mark their queued email logs failed, and release their enrollment claims. Rows held by a processor are not changed.',
+        inputSchema: {
+            site_id: z.string().uuid(),
+            campaign_id: z.string().uuid().optional(),
+            queue_ids: z.array(z.string().uuid()).min(1).max(200).optional(),
+        },
+    }, async ({ site_id, campaign_id, queue_ids }) => {
+        try {
+            const { cancelledCount } = await cancelSendQueueRows({
+                projectId: getProjectId(),
+                siteId: site_id,
+                campaignId: campaign_id,
+                queueIds: queue_ids,
+            }, db());
+            await logAudit({
+                action: 'send_queue.cancel',
+                resourceType: 'site',
+                resourceId: site_id,
+                details: { cancelled_count: cancelledCount, campaign_id: campaign_id ?? null },
+            });
+            return j({ cancelled_count: cancelledCount });
+        }
+        catch (error) {
+            return j({ error: error instanceof Error ? error.message : 'Queue cancellation failed' });
+        }
+    });
+    server.registerTool('replay_enrollment_dlq_rows', {
+        title: 'Replay Enrollment DLQ Rows',
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: false,
+            idempotentHint: false,
+            openWorldHint: false,
+        },
+        description: 'Re-enter dead-lettered campaign enrollments into active sending, which can cause real emails to send on the next queue tick. Call once without confirmed to preview the matched count, then call again with confirmed=true to replay them.',
+        inputSchema: {
+            site_id: z.string().uuid(),
+            max_count: z.number().int().min(1).max(1000).default(100).optional(),
+            failed_after: z.string().datetime().optional(),
+            confirmed: z.boolean().optional().default(false)
+                .describe('Two-call confirmation. First call previews the matched rows; confirmed=true replays them.'),
+        },
+    }, async ({ site_id, max_count = 100, failed_after, confirmed = false }) => {
+        const projectId = getProjectId();
+        if (!confirmed) {
+            try {
+                const { rows } = await findReplayableEnrollmentDlqRows({
+                    projectId,
+                    siteId: site_id,
+                    maxCount: max_count,
+                    failedAfter: failed_after,
+                }, db());
+                return j({
+                    confirmation_required: true,
+                    tool: 'replay_enrollment_dlq_rows',
+                    site_id,
+                    matched_count: rows.length,
+                    preview: rows,
+                    message: rows.length === 0
+                        ? 'No unresolved enrollment DLQ rows match this filter — nothing to replay.'
+                        : `Replaying will re-enter ${rows.length} enrollment(s) into active sending, which can trigger real sends. Call again with confirmed=true to proceed.`,
+                });
+            }
+            catch (error) {
+                return j({ error: error instanceof Error ? error.message : 'Replay preview failed' });
+            }
+        }
+        try {
+            const { replayedCount, skippedCount } = await replayEnrollmentDlqRows({
+                projectId,
+                siteId: site_id,
+                maxCount: max_count,
+                failedAfter: failed_after,
+            }, db());
+            await logAudit({
+                action: 'enrollment_dlq.replay',
+                resourceType: 'site',
+                resourceId: site_id,
+                details: {
+                    replayed_count: replayedCount,
+                    skipped_count: skippedCount,
+                    max_count,
+                    failed_after: failed_after ?? null,
+                },
+            });
+            return j({ ok: true, replayed_count: replayedCount, skipped_count: skippedCount });
+        }
+        catch (error) {
+            return j({ error: error instanceof Error ? error.message : 'Replay failed' });
+        }
+    });
     server.registerTool('get_scoring_rules', {
         title: 'Get Scoring Rules',
         annotations: {
@@ -468,4 +791,188 @@ export function registerDeliveryOpsTools(server) {
             return j({ error: linkErr.message });
         return j({ ok: true, site_id: site.id, domain: created });
     });
+    server.registerTool('get_dmarc_status', {
+        title: 'Get DMARC Status',
+        annotations: {
+            readOnlyHint: true,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: true,
+        },
+        description: "Return the inbound DMARC RUA address, Cloudflare publish setup state, and monitor state for this project (or a specific site's sending domain).",
+        inputSchema: {
+            site_id: z.string().uuid().optional()
+                .describe('Site to scope the sending-domain setup metadata to. Omit for the project default.'),
+        },
+    }, async ({ site_id }) => {
+        const projectId = getProjectId();
+        const central = adminDb();
+        const { data: sites, error: siteError } = await db().schema('email').from('sites')
+            .select('id, sending_domain').eq('active', true).eq('project_id', projectId).order('name');
+        if (siteError)
+            return j({ error: siteError.message });
+        const selectedSite = site_id ? (sites ?? []).find((site) => site.id === site_id) : null;
+        if (site_id && !selectedSite)
+            return j({ error: 'site_id is not a valid site for this project', status: 400 });
+        try {
+            const [{ data: project, error: projectError }, { data: monitors, error: monitorError }] = await Promise.all([
+                central.schema('email').from('projects').select('org_id').eq('id', projectId).maybeSingle(),
+                central.schema('email').from('dmarc_monitors').select('domain, status')
+                    .eq('project_id', projectId).order('created_at', { ascending: false }),
+            ]);
+            if (projectError)
+                throw new Error(projectError.message);
+            if (monitorError)
+                throw new Error(monitorError.message);
+            const token = await getOrProvisionDmarcInboundToken(projectId);
+            const sendingDomains = (sites ?? []).map((site) => String(site.sending_domain ?? '').trim().toLowerCase()).filter(Boolean);
+            const domain = selectedSite?.sending_domain ?? sendingDomains[0] ?? null;
+            const ns = domain ? await resolveNameservers(domain) : { nameservers: [], zone: null };
+            const dnsProvider = detectDnsProvider(ns.nameservers);
+            let cloudflareConnected = false;
+            if (project?.org_id && dnsProvider === 'cloudflare') {
+                const { data: connection, error: connectionError } = await central.schema('email')
+                    .from('cloudflare_oauth_connections').select('id').eq('org_id', project.org_id).maybeSingle();
+                if (connectionError)
+                    throw new Error(connectionError.message);
+                cloudflareConnected = Boolean(connection?.id);
+            }
+            const monitorRows = (monitors ?? []).map((monitor) => ({
+                domain: monitor.domain,
+                status: monitor.status,
+                rua_record: 'v=DMARC1; p=none; rua=mailto:dmarc@sendinel.ai',
+                report_destination: 'dmarc@sendinel.ai',
+            }));
+            return j({
+                inbound_address: `dmarc+${token}@sendinel.ai`,
+                setup: {
+                    domain,
+                    cloudflare_connected: cloudflareConnected,
+                    can_publish_cloudflare: cloudflareConnected,
+                    dns_provider: dnsProvider,
+                    dns_zone: ns.zone,
+                },
+                monitors: selectedSite?.sending_domain
+                    ? monitorRows.filter((monitor) => monitor.domain === selectedSite.sending_domain)
+                    : monitorRows,
+                auth_record_errors: [],
+            });
+        }
+        catch (error) {
+            return j({ error: error instanceof Error ? error.message : 'DMARC status query failed' });
+        }
+    });
+    server.registerTool('list_dmarc_reports', {
+        title: 'List DMARC Reports',
+        annotations: {
+            readOnlyHint: true,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: true,
+        },
+        description: 'List aggregate DMARC (RUA) report summaries ingested for this project. Raw XML is excluded.',
+        inputSchema: {
+            site_id: z.string().uuid().optional(),
+            domain: z.string().optional().describe('Filter to a policy_domain from the reports.'),
+            start_date: z.string().datetime().optional(),
+            end_date: z.string().datetime().optional(),
+            cursor: z.string().optional().describe('created_at cursor from a previous page.'),
+            limit: z.number().int().min(1).max(200).optional().default(50),
+        },
+    }, async ({ site_id, domain, start_date, end_date, cursor, limit }) => {
+        const pageLimit = limit ?? 50;
+        let query = db().schema('email').from('dmarc_reports')
+            .select('id, site_id, org_name, report_id, period_begin, period_end, policy_domain, policy_p, policy_sp, policy_pct, total_messages, pass_count, fail_count, created_at')
+            .eq('project_id', getProjectId())
+            .order('created_at', { ascending: false })
+            .limit(pageLimit + 1);
+        if (site_id)
+            query = query.eq('site_id', site_id);
+        if (domain)
+            query = query.eq('policy_domain', domain);
+        if (start_date)
+            query = query.gte('period_begin', new Date(start_date).toISOString());
+        if (end_date)
+            query = query.lte('period_begin', new Date(end_date).toISOString());
+        if (cursor)
+            query = query.lt('created_at', cursor);
+        const { data, error } = await query;
+        if (error)
+            return j({ error: 'Query failed', status: 500 });
+        const rows = (data ?? []);
+        const hasMore = rows.length > pageLimit;
+        const reports = hasMore ? rows.slice(0, pageLimit) : rows;
+        return j({
+            reports,
+            pagination: {
+                cursor: hasMore && reports.length > 0 ? reports[reports.length - 1].created_at : null,
+                has_more: hasMore,
+                limit: pageLimit,
+            },
+        });
+    });
+    server.registerTool('publish_dmarc_record', {
+        title: 'Publish DMARC Record',
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: true,
+            idempotentHint: true,
+            openWorldHint: true,
+        },
+        description: "Merge Sendinel's inbound RUA address into a sending domain's _dmarc TXT record via the organization's connected Cloudflare zone. Previews the exact merged record before writing; writing requires approval.",
+        inputSchema: {
+            domain: z.string().min(1)
+                .describe('Active sending domain for this project, managed by a connected Cloudflare zone.'),
+            confirmed: z.boolean().optional().default(false)
+                .describe('Two-call confirmation. First call previews the merged record, second call with confirmed=true writes it.'),
+            approval_id: z.string().uuid().optional()
+                .describe('Approval token from a previous confirmed call without approval_id.'),
+        },
+    }, async ({ domain, confirmed, approval_id }) => {
+        const approvalParams = { domain };
+        const preview = await callSendinelV1('/api/v1/dmarc/publish-cloudflare', {
+            method: 'POST',
+            body: { domain, dry_run: true },
+        });
+        if (!preview.ok) {
+            return j({ error: v1ErrorMessage(preview.error), status: preview.status });
+        }
+        const previewBody = asRecord(preview.data);
+        if (!confirmed) {
+            return j({
+                confirmation_required: true,
+                tool: 'publish_dmarc_record',
+                domain,
+                dns_zone: previewBody.dns_zone,
+                record_name: previewBody.record_name,
+                record_content: previewBody.record_content,
+                message: `Publishing will write this exact TXT record for ${previewBody.record_name} in the organization's Cloudflare zone. Call again with confirmed=true to proceed.`,
+            });
+        }
+        const channelContext = currentChannelContext();
+        const decision = assertChannelCanExecute('publish_dmarc_record', approvalParams, channelContext);
+        if (!decision.allowed)
+            return j({ error: decision.reason ?? 'This channel cannot request this action.' });
+        if (decision.tier !== 'autonomous') {
+            if (!approval_id) {
+                const approval = await requestApproval('publish_dmarc_record', approvalParams, undefined, channelContext);
+                return j(approval);
+            }
+            const check = await checkApproval(approval_id, {
+                consume: true,
+                action: 'publish_dmarc_record',
+                params: approvalParams,
+            });
+            if (!check.approved) {
+                return j({ error: `Approval ${approval_id} is ${check.status}.`, status: check.status });
+            }
+        }
+        const result = await callSendinelV1('/api/v1/dmarc/publish-cloudflare', {
+            method: 'POST',
+            body: { domain, dry_run: false },
+        });
+        if (!result.ok)
+            return j({ error: v1ErrorMessage(result.error), status: result.status });
+        return j(result.data);
+    });
 }

package/build/tools/forms.js

@@ -11,10 +11,10 @@ export function registerFormTools(server) {
             idempotentHint: true,
             openWorldHint: false,
         },
-        description: 'List signup forms with field and submission counts.',
+        description: 'List forms with destination, field, and submission counts.',
         inputSchema: { site_id: z.string().uuid().optional() },
     }, async ({ site_id }) => {
-        let query = db().from('signup_forms').select('id, name, slug, fields, status, submissions, site_id, created_at').eq('project_id', getProjectId()).order('created_at', { ascending: false });
+        let query = db().from('signup_forms').select('id, name, slug, fields, status, submissions, site_id, form_type, created_at').eq('project_id', getProjectId()).order('created_at', { ascending: false });
         if (site_id)
             query = query.eq('site_id', site_id);
         const { data, error } = await query;
@@ -58,19 +58,20 @@ export function registerFormTools(server) {
             idempotentHint: false,
             openWorldHint: false,
         },
-        description: 'Create a signup form.',
+        description: "Create an embeddable form. destination 'signup' (default) creates/updates a subscriber on submission; destination 'management' looks up an existing contact by the submitted email and merges the other submitted fields into that contact's custom_properties -- it never creates a new contact.",
         inputSchema: {
             site_id: z.string().uuid(),
             name: z.string().min(1),
             fields: z.array(z.record(z.string(), z.unknown())),
             redirect_url: z.string().url().optional(),
             double_opt_in: z.boolean().optional(),
+            form_type: z.enum(['signup', 'management']).optional(),
         },
-    }, async ({ site_id, name, fields, redirect_url, double_opt_in }) => {
+    }, async ({ site_id, name, fields, redirect_url, double_opt_in, form_type }) => {
         const slug = name.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 80);
         const { data, error } = await db().from('signup_forms')
-            .insert({ project_id: getProjectId(), site_id, name, slug, fields, settings: { redirect_url: redirect_url ?? null, double_opt_in: double_opt_in ?? false }, status: 'active' })
-            .select('id, name, slug, fields, status')
+            .insert({ project_id: getProjectId(), site_id, name, slug, fields, settings: { redirect_url: redirect_url ?? null, double_opt_in: double_opt_in ?? false }, form_type: form_type ?? 'signup', status: 'active' })
+            .select('id, name, slug, fields, status, form_type')
             .single();
         if (error)
             return j({ error: error.message });

package/build/tools/gateway.d.ts

@@ -0,0 +1,6 @@
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export interface GatewayOptions {
+    scopes?: string[];
+    toolGroups?: string[];
+}
+export declare function registerGatewayTools(server: McpServer, options: GatewayOptions): void;

package/build/tools/gateway.js

@@ -0,0 +1,92 @@
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { InMemoryTransport } from '@modelcontextprotocol/sdk/inMemory.js';
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { z } from 'zod';
+import { getRegisteredToolGroups, registerAllTools } from '../server.js';
+const textResult = (text) => ({ content: [{ type: 'text', text }] });
+const jsonResult = (data) => textResult(JSON.stringify(data, null, 2));
+const notFound = (message) => ({
+    isError: true,
+    content: [{ type: 'text', text: message }],
+});
+async function buildCatalog(options) {
+    const innerServer = new McpServer({ name: 'sendinel-gateway-inner', version: '1.0.0' });
+    registerAllTools(innerServer, { scopes: options.scopes, toolGroups: options.toolGroups });
+    const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
+    const client = new Client({ name: 'sendinel-gateway', version: '1.0.0' });
+    await innerServer.connect(serverTransport);
+    await client.connect(clientTransport);
+    const toolGroupMap = getRegisteredToolGroups({ scopes: options.scopes, toolGroups: options.toolGroups });
+    const { tools } = await client.listTools();
+    const entries = tools
+        .map((tool) => ({
+        name: tool.name,
+        group: toolGroupMap[tool.name] ?? 'unknown',
+        description: tool.description ?? '',
+        inputSchema: tool.inputSchema,
+    }))
+        .sort((a, b) => {
+        const groupCompare = a.group.localeCompare(b.group);
+        return groupCompare !== 0 ? groupCompare : a.name.localeCompare(b.name);
+    });
+    return { client, entries, byName: new Map(entries.map((entry) => [entry.name, entry])) };
+}
+export function registerGatewayTools(server, options) {
+    let catalogPromise = null;
+    const getCatalog = () => (catalogPromise ??= buildCatalog(options));
+    server.registerTool('search_tools', {
+        title: 'Search Tools',
+        description: 'Search the permitted Sendinel MCP tool catalog by keyword and/or group. Returns name, group, and description. Call describe_tool for the full input schema before invoke_tool.',
+        annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+        inputSchema: {
+            query: z.string().optional().describe('Keyword to match against tool name, group, or description'),
+            group: z.string().optional().describe('Restrict results to one tool group, for example campaigns'),
+        },
+    }, async ({ query, group }) => {
+        const catalog = await getCatalog();
+        const q = query?.trim().toLowerCase() ?? '';
+        const requestedGroup = group?.trim();
+        const results = catalog.entries.filter((tool) => {
+            if (requestedGroup && tool.group !== requestedGroup)
+                return false;
+            if (!q)
+                return true;
+            return (tool.name.toLowerCase().includes(q) ||
+                tool.group.toLowerCase().includes(q) ||
+                tool.description.toLowerCase().includes(q));
+        });
+        return jsonResult({
+            tools: results.map(({ name, group, description }) => ({ name, group, description })),
+            total: results.length,
+        });
+    });
+    server.registerTool('describe_tool', {
+        title: 'Describe Tool',
+        description: 'Return one permitted Sendinel MCP tool input schema by name. Call this before invoke_tool so arguments match the real signature.',
+        annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+        inputSchema: {
+            name: z.string().min(1).describe('Tool name to describe'),
+        },
+    }, async ({ name }) => {
+        const catalog = await getCatalog();
+        const entry = catalog.byName.get(name);
+        if (!entry)
+            return notFound(`Tool not found: ${name}`);
+        return jsonResult(entry);
+    });
+    server.registerTool('invoke_tool', {
+        title: 'Invoke Tool',
+        description: 'Execute one permitted Sendinel MCP tool by name with the same scope and approval enforcement as calling it directly. Use search_tools and describe_tool first.',
+        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
+        inputSchema: {
+            name: z.string().min(1).describe('Tool name to invoke'),
+            args: z.record(z.string(), z.unknown()).optional().default({}).describe('Arguments for the target tool'),
+        },
+    }, async ({ name, args }) => {
+        const catalog = await getCatalog();
+        if (!catalog.byName.has(name)) {
+            return notFound(`Tool not found or not permitted: ${name}`);
+        }
+        return await catalog.client.callTool({ name, arguments: args ?? {} });
+    });
+}