conduyt-mcp 4.17.0 → 4.18.0

package/dist/tools/reply-capture.d.ts

@@ -22,8 +22,23 @@ import { ConduytClient } from "../client.js";
  *  - 503 — the shared email-provider allowance is busy with customer sends.
  *    Retry in a moment; it says nothing about the domain's health.
  *
- * Removal is IRREVERSIBLE for in-flight threads: replies to emails already
- * sent go to an address that no longer routes, so they are lost. Hence the
- * confirm gate below.
+ * Removal semantics (#39 drain, shipped 2026-08-07) — branch by state:
+ *  - LIVE (provider-backed): DRAIN. Sending stops immediately, the
+ *    address keeps receiving for a 30-day window (late replies still
+ *    land on the timeline), then it parks. The name is permanently
+ *    retired — no account can ever set it up again.
+ *  - LIVE legacy row with no stored provider id: immediate removal, NO
+ *    drain (threading stops at once); providerCleanup='manual' and the
+ *    name stays reusable.
+ *  - DEGRADED (provider reports it can no longer receive): same drain
+ *    lifecycle and same permanent retirement, but NO delivery guarantee
+ *    during the window — receiving was already broken.
+ *  - PENDING setup, a domain the provider has already lost, or a cleanup
+ *    retry: immediate teardown. The registry row is deleted and the name
+ *    is NOT retired — it can be reused.
+ * Sending-domain removal: every capture row EXCEPT a released tombstone
+ * blocks it. Pending/cleanup rows clear through this same remove tool
+ * (self-service); draining/parked rows keep blocking until an operator
+ * releases them after the drain.
  */
 export declare function registerReplyCaptureTools(server: McpServer, client: ConduytClient): void;

package/dist/tools/reply-capture.js

@@ -22,16 +22,31 @@ import { formatResult } from "../client.js";
  *  - 503 — the shared email-provider allowance is busy with customer sends.
  *    Retry in a moment; it says nothing about the domain's health.
  *
- * Removal is IRREVERSIBLE for in-flight threads: replies to emails already
- * sent go to an address that no longer routes, so they are lost. Hence the
- * confirm gate below.
+ * Removal semantics (#39 drain, shipped 2026-08-07) — branch by state:
+ *  - LIVE (provider-backed): DRAIN. Sending stops immediately, the
+ *    address keeps receiving for a 30-day window (late replies still
+ *    land on the timeline), then it parks. The name is permanently
+ *    retired — no account can ever set it up again.
+ *  - LIVE legacy row with no stored provider id: immediate removal, NO
+ *    drain (threading stops at once); providerCleanup='manual' and the
+ *    name stays reusable.
+ *  - DEGRADED (provider reports it can no longer receive): same drain
+ *    lifecycle and same permanent retirement, but NO delivery guarantee
+ *    during the window — receiving was already broken.
+ *  - PENDING setup, a domain the provider has already lost, or a cleanup
+ *    retry: immediate teardown. The registry row is deleted and the name
+ *    is NOT retired — it can be reused.
+ * Sending-domain removal: every capture row EXCEPT a released tombstone
+ * blocks it. Pending/cleanup rows clear through this same remove tool
+ * (self-service); draining/parked rows keep blocking until an operator
+ * releases them after the drain.
  */
 export function registerReplyCaptureTools(server, client) {
-    server.tool("conduyt_reply_capture_get", "Get the account's reply-capture state: whether it is configured and live, the capture domain and reply address, DNS records for a pending setup, and provider health. health='checking' with a healthWarning means the provider is re-checking DNS — capture stays active. degraded=true means the provider can no longer receive on that domain and it must be removed and set up again. needsSupport=true means an operator must reconcile it first. cleanupPending=true means a previous removal did not finish at the provider — call conduyt_reply_capture_remove again to complete it.", {}, async () => {
+    server.tool("conduyt_reply_capture_get", "Get the account's reply-capture state: whether it is configured and live, the capture domain and reply address, DNS records for a pending setup, and provider health. health='checking' with a healthWarning means the provider is re-checking DNS — capture stays active. degraded=true means the provider can no longer receive on that domain and it must be removed and set up again. needsSupport=true means an operator must reconcile it first. cleanupPending=true means a previous removal did not finish at the provider — call conduyt_reply_capture_remove again to complete it. After a removal: draining=true (with drainEndsAt) means the drain window is open — a domain that was live at removal keeps receiving replies until it closes (one that was degraded has no such guarantee); parked=true means it is retired and inbound-inert. Either way that name is permanently unavailable — use suggestedDomain when setting up again.", {}, async () => {
         const result = await client.get("/api/v1/email-domains/reply-capture");
         return formatResult(result);
     });
-    server.tool("conduyt_reply_capture_setup", "Start reply-capture setup: creates the receiving domain at the email provider and returns the DNS records to add. The domain MUST be a strict subdomain of the account's own verified sending domain (omit it to use the suggested 'reply.<sending-domain>'); anything else is refused. Requires a verified sending domain first. After adding the DNS records, call conduyt_reply_capture_verify. A 409 means capture is already configured, a setup is already in progress, or the previous one still needs operator reconciliation.", {
+    server.tool("conduyt_reply_capture_setup", "Start reply-capture setup: creates the receiving domain at the email provider and returns the DNS records to add. The domain MUST be a strict subdomain of the account's own verified sending domain (omit it to use the suggested 'reply.<sending-domain>'); anything else is refused. Requires a verified sending domain first. After adding the DNS records, call conduyt_reply_capture_verify. A 409 means capture is already configured, a setup is already in progress, the previous one still needs operator reconciliation, or the requested name belongs to a retired (drained/parked) domain — retired names are permanently unavailable, so read suggestedDomain from conduyt_reply_capture_get (e.g. 'reply2.<domain>') instead of retrying the old name.", {
         domain: z
             .string()
             // TRIM BEFORE the emptiness check: the API trims and treats a blank
@@ -52,10 +67,10 @@ export function registerReplyCaptureTools(server, client) {
         const result = await client.post("/api/v1/email-domains/reply-capture/verify", {});
         return formatResult(result);
     });
-    server.tool("conduyt_reply_capture_remove", "Remove reply capture: stops using the capture Reply-To on new email, stops matching inbound replies, and deletes the receiving domain at the provider. Replies to emails ALREADY SENT will be lost — there is no undo. Also completes a previously interrupted removal (cleanupPending) without creating anything new. Requires an explicit confirm='REMOVE'. Note: while any reply-capture row exists the sending domain cannot be removed, so this is also the step that unblocks that.", {
+    server.tool("conduyt_reply_capture_remove", "Remove reply capture. Outcome depends on the domain's state. LIVE with a provider-backed setup: it DRAINS — the capture Reply-To stops on new email immediately, but the address keeps receiving for 30 days (drainEndsAt in the response) so late replies to already-sent emails still reach the contact's timeline; after that it parks, and the name is permanently retired (no account can ever set it up again — resuming capture means a NEW subdomain, see suggestedDomain on conduyt_reply_capture_get). LIVE legacy row with no stored provider id: removed immediately with NO drain — reply threading stops at once and the response says providerCleanup='manual' (an operator finishes the provider side); the name stays reusable. DEGRADED: drain lifecycle and permanent retirement, but receiving was already broken, so do NOT promise the 30-day delivery window. PENDING setup, a domain the provider has already lost, or an interrupted-removal retry (cleanupPending): torn down immediately, the row is deleted, and the name stays reusable. Requires an explicit confirm='REMOVE'. Sending-domain removal stays blocked by every capture row except a released tombstone — pending/cleanup rows clear right here, but a draining/parked row keeps blocking until support releases it after the drain.", {
         confirm: z
             .literal("REMOVE")
-            .describe("Must be exactly 'REMOVE'. Hard safety gate: replies to already-sent emails are irrecoverably lost once the capture domain is gone."),
+            .describe("Must be exactly 'REMOVE'. Hard safety gate: sending stops immediately, and a provider-backed live or degraded domain's name is permanently retired — there is no undo on the retirement (a legacy id-less live row instead stops threading at once)."),
     }, async () => {
         const result = await client.del("/api/v1/email-domains/reply-capture");
         return formatResult(result);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "conduyt-mcp",
-  "version": "4.17.0",
+  "version": "4.18.0",
   "description": "MCP server for Conduyt CRM — expose CRM operations as AI-accessible tools",
   "type": "module",
   "main": "dist/index.js",