@sendinel/mcp-server 1.0.0

package/build/lib/social-engine/prompt-builder.d.ts

@@ -0,0 +1,13 @@
+import type { SocialArchetype } from "./archetypes.js";
+import type { SocialBrief, SocialPostPlatform } from "./types.js";
+export interface SocialPromptInput {
+    brief: SocialBrief;
+    platform: SocialPostPlatform;
+    archetype: SocialArchetype;
+    /** Output of buildBrandContext() — org mission/audience/differentiators. */
+    brandContext: string;
+    /** Output of buildVoicePrompt() — tone, sign-off, anti-patterns. */
+    voiceRules: string;
+}
+export declare function buildSocialSystemPrompt(input: SocialPromptInput): string;
+export declare function buildSocialUserPrompt(input: SocialPromptInput): string;

package/build/lib/social-engine/prompt-builder.js

@@ -0,0 +1,80 @@
+// Multi-layer social prompt builder (#1360) — mirrors Synchronex's Luca
+// pipeline: per-role content rules, a short-form voice guide, platform-native
+// formatting, and the [BRAND CONTEXT]/[VOICE RULES] blocks Sendinel already
+// derives from the Brand Brain — composed into one system prompt instead of a
+// single "write a post about X" line. Pure string assembly: the caller owns
+// the model call, so this whole layer is unit-testable for free.
+// Mirror of packages/dashboard/lib/social-engine/prompt-builder.ts.
+import { buildPlatformRuleBlock, getPlatformConstraints } from "./platform-constraints.js";
+// Hard rules per structural role — the depth that separates creator-grade
+// copy from generic marketing. Mirrors Luca's per-role rules.
+const ROLE_RULES = {
+    hook: "HOOK: 12 words or fewer. Must work standing alone — assume nothing after it gets read. No questions unless the archetype's formula is a question. Never start with 'I'm excited' or any announcement filler.",
+    pain: "PAIN: name the specific annoyance in the reader's words, not category language. 'Your welcome email goes out 40 minutes late' beats 'engagement challenges'.",
+    proof: "PROOF: exactly one concrete number or named outcome. Never vague comparatives — 'faster', 'better', 'easier' are banned in this role.",
+    solution: "SOLUTION: what changes for the reader, not what the product has. One sentence of mechanism is allowed; zero feature lists.",
+    story: "STORY: one scene, told in sequence, with one unglamorous concrete detail that proves you were there. No moral until the end.",
+    steps: "STEPS: numbered. Each step starts with a verb and is doable today. No step over two lines. 3–5 steps total.",
+    question: "QUESTION: end on one genuine question the reader can answer from experience. Not 'thoughts?' — ask about THEIR practice.",
+    cta: "CTA: one action, stated plainly. No 'don't miss out', no urgency theater. A soft CTA ('worth a look if X') is fine where the platform culture expects it.",
+};
+const SHORT_FORM_VOICE_GUIDE = `[SHORT-FORM VOICE GUIDE]
+- Write like a person typing to a smart friend, not a brand publishing.
+- Short sentences. Vary rhythm. One idea per line where line breaks are allowed.
+- Cut adjectives; prefer a concrete noun or number.
+- Banned everywhere: "game-changer", "unlock", "elevate", "revolutionize", "seamless", "supercharge", "delve", "in today's fast-paced world".
+- No corporate transitions ("furthermore", "additionally", "moreover").
+- Specifics beat claims: name the tool, the number, the day of the week.`;
+export function buildSocialSystemPrompt(input) {
+    const { archetype, platform, brief } = input;
+    const roleBlock = archetype.structure.map((role) => `- ${ROLE_RULES[role]}`).join("\n");
+    const mediaInstruction = brief.format === "carousel"
+        ? `Also return a "media_plan": { "kind": "carousel", "frames": [4–7 frames of { "order", "headline" (max 8 words), "support_text" (max 20 words), "visual_direction" (one concrete art note) }] }. Frame 1 is the hook frame.`
+        : brief.format === "single_image"
+            ? `Also return a "media_plan": { "kind": "single_image", "image_direction": one concrete art-direction sentence (subject, composition, mood — no abstract concepts) }.`
+            : brief.format === "video_script"
+                ? `Also return a "media_plan": { "kind": "video_script", "image_direction": one sentence describing the opening shot }.`
+                : "";
+    return `You are a top-tier ${platform} creator writing for one specific brand. You write platform-native posts that real creators would publish — never marketing copy wearing a costume.
+
+${input.brandContext}
+
+${input.voiceRules}
+
+[ARCHETYPE: ${archetype.name}]
+Hook formula to adapt (never copy verbatim): "${archetype.hook_formula}"
+Why it works: ${archetype.neurodesign_trigger}.
+Write in the spirit of: ${archetype.reference_creators.join(", ")}.
+${archetype.voice_notes}
+
+[STRUCTURE — follow these roles in order]
+${roleBlock}
+
+${SHORT_FORM_VOICE_GUIDE}
+
+[PLATFORM RULES]
+${buildPlatformRuleBlock(platform)}
+
+[OUTPUT]
+Return ONLY valid JSON, no markdown fences:
+{
+  "variants": [
+    { "label": "A", "angle": "<one line: the angle this take uses>", "hook": "...", "body": "...", "cta": "...", "hashtags": ["..."] },
+    { "label": "B", ... },
+    { "label": "C", ... }
+  ]
+}
+${mediaInstruction}
+The three variants must take genuinely different angles (e.g. outcome-led vs. pain-led vs. story-led) — not the same post reworded. "body" may contain \\n for line breaks where the platform allows them. ${archetype.structure.includes("cta") ? "" : `This archetype ends without a CTA — return "cta": "".`}`;
+}
+export function buildSocialUserPrompt(input) {
+    const { brief, platform } = input;
+    const constraints = getPlatformConstraints(platform);
+    return `Goal of this post: ${brief.goal}
+${brief.audience ? `Audience override for this post: ${brief.audience}\n` : ""}${brief.style ? `Style note from the user: ${brief.style}\n` : ""}Format: ${brief.format}
+
+Source material (adapt, never excerpt):
+${brief.source_content.slice(0, 2000)}
+
+Write the ${platform} post now — full caption must land under ${constraints.maxChars} characters including hashtags. Return the JSON only.`;
+}

package/build/lib/social-engine/types.d.ts

@@ -0,0 +1,60 @@
+export declare const SOCIAL_POST_PLATFORMS: readonly ["instagram", "linkedin", "twitter", "x", "facebook", "tiktok", "youtube", "pinterest", "threads", "reddit", "bluesky", "google_business"];
+export type SocialPostPlatform = typeof SOCIAL_POST_PLATFORMS[number];
+export type SocialFormat = "text" | "single_image" | "carousel" | "video_script";
+export interface SocialBrief {
+    /** What this post should achieve, in plain language. */
+    goal: string;
+    /** Source material — email content, notes, announcement copy. */
+    source_content: string;
+    /** Optional audience override; Brand Brain audience is the default. */
+    audience?: string;
+    format: SocialFormat;
+    platforms: SocialPostPlatform[];
+    /** Explicit archetype override; otherwise selected from the brief. */
+    archetype_id?: string;
+    /** Optional style note from the user ("more playful", "no emojis"). */
+    style?: string;
+}
+export type VariantLabel = "A" | "B" | "C";
+export interface CarouselFrame {
+    order: number;
+    headline: string;
+    support_text: string;
+    visual_direction: string;
+}
+export interface MediaPlan {
+    kind: Exclude<SocialFormat, "text">;
+    /** Art direction for a single image / video opener. */
+    image_direction?: string;
+    /** Carousel frames, first frame is the hook frame. */
+    frames?: CarouselFrame[];
+}
+export interface SocialVariant {
+    label: VariantLabel;
+    /** The distinct angle this variant takes (one line, for the picker UI). */
+    angle: string;
+    hook: string;
+    body: string;
+    cta: string;
+    hashtags: string[];
+    /** Assembled, platform-formatted caption — what actually gets published. */
+    caption: string;
+}
+export interface SocialPostIR {
+    platform: SocialPostPlatform;
+    archetype_id: string;
+    variants: SocialVariant[];
+    media_plan?: MediaPlan;
+    /** Constraint findings from gen-time validation (empty = clean). */
+    warnings: string[];
+}
+/** Persisted on social_posts.generation — lets a platform segment be
+ *  regenerated independently without touching the others. Captions only;
+ *  rendered video/image is a separate concern. */
+export interface SocialGenerationRecord {
+    brief: SocialBrief;
+    archetype_id: string;
+    /** platform -> IR; keys regenerate independently. */
+    posts: Partial<Record<SocialPostPlatform, SocialPostIR>>;
+    generated_at: string;
+}

package/build/lib/social-engine/types.js

@@ -0,0 +1,19 @@
+// Social engine IR — the structured output of social generation (#1360).
+// Mirror of packages/dashboard/lib/social-engine/types.ts for the MCP server
+// package. The dashboard sources SocialPostPlatform from @/lib/social-posts;
+// the MCP package has no path alias, so the platform list lives here and every
+// engine file imports it from "./types.js".
+export const SOCIAL_POST_PLATFORMS = [
+    "instagram",
+    "linkedin",
+    "twitter",
+    "x",
+    "facebook",
+    "tiktok",
+    "youtube",
+    "pinterest",
+    "threads",
+    "reddit",
+    "bluesky",
+    "google_business",
+];

package/build/lib/url-validation.d.ts

@@ -0,0 +1,3 @@
+export declare function isSafeRedirectUrl(url: unknown): url is string;
+export declare function isAllowedHttpsHostUrl(url: unknown, allowedDomains: readonly string[]): url is string;
+export declare function normalizeActiveCampaignAccountUrl(accountUrl: string): string;

package/build/lib/url-validation.js

@@ -0,0 +1,51 @@
+export function isSafeRedirectUrl(url) {
+    if (typeof url !== 'string' || !url)
+        return false;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return false;
+    }
+    if (parsed.protocol !== 'https:')
+        return false;
+    if (parsed.username || parsed.password)
+        return false;
+    const host = parsed.hostname.toLowerCase().replace(/^\[|\]$/g, '');
+    if (host === 'localhost' ||
+        host.endsWith('.localhost') ||
+        host === '0.0.0.0' ||
+        host === '::1' ||
+        /^127\./.test(host) ||
+        /^10\./.test(host) ||
+        /^169\.254\./.test(host) ||
+        /^192\.168\./.test(host) ||
+        /^172\.(1[6-9]|2\d|3[01])\./.test(host) ||
+        /^fc[0-9a-f]{0,2}:/i.test(host) ||
+        /^fd[0-9a-f]{0,2}:/i.test(host) ||
+        /^fe80:/i.test(host)) {
+        return false;
+    }
+    return true;
+}
+export function isAllowedHttpsHostUrl(url, allowedDomains) {
+    if (!isSafeRedirectUrl(url))
+        return false;
+    const parsed = new URL(url);
+    const host = parsed.hostname.toLowerCase().replace(/^\[|\]$/g, '');
+    return allowedDomains.some((domain) => {
+        const normalized = domain.toLowerCase().replace(/^\.+/, '');
+        return host === normalized || host.endsWith(`.${normalized}`);
+    });
+}
+export function normalizeActiveCampaignAccountUrl(accountUrl) {
+    const raw = String(accountUrl ?? '').trim().replace(/^https?:\/\//, '').replace(/\/+$/, '');
+    if (!raw)
+        throw new Error('ActiveCampaign account URL is required');
+    const base = raw.includes('/api/3') ? `https://${raw}` : `https://${raw}/api/3`;
+    if (!isAllowedHttpsHostUrl(base, ['activehosted.com', 'api-ac.com'])) {
+        throw new Error('ActiveCampaign account URL is not allowed');
+    }
+    return base;
+}

package/build/lib/voice.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Brand voice prompt builder for AI email generation.
+ * Mirror of packages/dashboard/lib/voice.ts for the MCP server package.
+ */
+interface BrandVoiceConfig {
+    tone?: string;
+    greeting_style?: string;
+    sign_off?: string;
+    rules?: string[];
+    anti_patterns?: string[];
+    max_paragraphs?: number;
+}
+export interface BrandSettings {
+    mission?: string;
+    audience?: string;
+    tone_words?: string[];
+    forbidden_phrases?: string[];
+    differentiators?: string;
+    default_signoff_name?: string;
+    ps_line?: string;
+}
+export declare function buildVoicePrompt(siteVoice: Record<string, unknown> | null | undefined, projectSettings?: BrandSettings | null): string;
+export declare function buildEmailSystemPrompt(brandContext: string, voicePrompt: string): string;
+export declare const KNOWN_VARIABLES: Set<string>;
+export declare const STOCK_PHRASES: string[];
+export interface ValidationResult {
+    valid: boolean;
+    errors: string[];
+    warnings: string[];
+}
+export declare function validateTemplate(html: string, voiceConfig?: BrandVoiceConfig | null): ValidationResult;
+export {};

package/build/lib/voice.js

@@ -0,0 +1,140 @@
+/**
+ * Brand voice prompt builder for AI email generation.
+ * Mirror of packages/dashboard/lib/voice.ts for the MCP server package.
+ */
+const DEFAULT_VOICE = {
+    tone: "Direct. Warm. Zero corporate. Write like you're sending a quick email to someone you respect but haven't met in person yet.",
+    greeting_style: 'Hey {{first_name}},',
+    sign_off: "— Kevin",
+    rules: [
+        "First name always. Never \"Dear Valued User\" or \"Hi there.\"",
+        "Short sentences. If a paragraph hits 3 sentences, break it.",
+        "One CTA per email. One. Don't make them choose.",
+        "Plain text wins. HTML is just for the button.",
+        "No exclamation marks unless something genuinely warrants one.",
+        'No "just checking in" or "hope this finds you well."',
+        "Say what it is, why it matters, what to do. Done.",
+    ],
+    anti_patterns: [
+        "emojis in body text",
+        "stock phrases",
+        "walls of text",
+        "multiple asks or CTAs",
+        "em dashes (—)",
+    ],
+    max_paragraphs: 5,
+};
+export function buildVoicePrompt(siteVoice, projectSettings) {
+    const v = { ...DEFAULT_VOICE };
+    if (projectSettings) {
+        if (projectSettings.tone_words?.length) {
+            v.tone = `${projectSettings.tone_words.join('. ')}. Write like you're emailing someone you respect.`;
+        }
+        if (projectSettings.default_signoff_name) {
+            v.sign_off = `- ${projectSettings.default_signoff_name}`;
+        }
+        if (projectSettings.forbidden_phrases?.length) {
+            v.anti_patterns = [...v.anti_patterns, ...projectSettings.forbidden_phrases];
+        }
+    }
+    if (siteVoice && Object.keys(siteVoice).length > 0) {
+        const sv = siteVoice;
+        if (sv.tone)
+            v.tone = sv.tone;
+        if (sv.greeting_style)
+            v.greeting_style = sv.greeting_style;
+        if (sv.sign_off)
+            v.sign_off = sv.sign_off;
+        if (sv.rules?.length)
+            v.rules = sv.rules;
+        if (sv.anti_patterns?.length)
+            v.anti_patterns = sv.anti_patterns;
+        if (sv.max_paragraphs)
+            v.max_paragraphs = sv.max_paragraphs;
+    }
+    const lines = [
+        "BRAND VOICE RULES (you MUST follow these):",
+        `- Tone: ${v.tone}`,
+        `- Greeting: "${v.greeting_style}" — never "Dear" or formal salutations`,
+        `- Sign off: "${v.sign_off}" (no title, no logo, no social links)`,
+        ...v.rules.map((r) => `- ${r}`),
+        `- Maximum ${v.max_paragraphs} short paragraphs.`,
+        `- NEVER use: ${v.anti_patterns.join(", ")}.`,
+    ];
+    return lines.join("\n");
+}
+export function buildEmailSystemPrompt(brandContext, voicePrompt) {
+    return `You are an expert email copywriter writing for a specific brand. ${brandContext}.
+
+${voicePrompt}
+
+Return a JSON object with keys: "subject" (string), "body_html" (string, clean HTML email with inline styles), "body_text" (string, plain text version). Return ONLY valid JSON, no explanation. Use {{first_name}} as the personalization variable for the recipient's name.`;
+}
+export const KNOWN_VARIABLES = new Set([
+    "first_name",
+    "last_name",
+    "email",
+    "unsubscribe_url",
+]);
+export const STOCK_PHRASES = [
+    "just checking in",
+    "hope this finds you well",
+    "hope you're doing well",
+    "dear valued",
+    "dear customer",
+    "dear user",
+    "hi there",
+    "to whom it may concern",
+    "we are pleased to",
+    "we are excited to",
+    "don't hesitate to",
+    "please do not hesitate",
+];
+export function validateTemplate(html, voiceConfig) {
+    const errors = [];
+    const warnings = [];
+    const varPattern = /\{\{(\w+)\}\}/g;
+    let match;
+    while ((match = varPattern.exec(html)) !== null) {
+        if (!KNOWN_VARIABLES.has(match[1])) {
+            errors.push(`Unknown variable: {{${match[1]}}}`);
+        }
+    }
+    const unclosed = html.match(/\{\{[^}]*$/gm);
+    if (unclosed) {
+        errors.push("Unclosed template variable bracket detected");
+    }
+    const textContent = html.replace(/<[^>]+>/g, " ").toLowerCase();
+    const exclamations = (textContent.match(/!/g) || []).length;
+    if (exclamations > 1) {
+        warnings.push(`${exclamations} exclamation marks found — voice guide limits to max 1`);
+    }
+    for (const phrase of STOCK_PHRASES) {
+        if (textContent.includes(phrase)) {
+            warnings.push(`Stock phrase detected: "${phrase}"`);
+        }
+    }
+    const hrefPattern = /href=["']([^"'#]+)["']/gi;
+    const hrefs = new Set();
+    let hrefMatch;
+    while ((hrefMatch = hrefPattern.exec(html)) !== null) {
+        const url = hrefMatch[1];
+        if (!url.startsWith("mailto:") &&
+            !url.includes("unsubscribe") &&
+            !url.includes("preferences")) {
+            hrefs.add(url);
+        }
+    }
+    if (hrefs.size > 2) {
+        warnings.push(`${hrefs.size} distinct CTA links found — voice guide recommends one CTA per email`);
+    }
+    const signOff = voiceConfig?.sign_off || DEFAULT_VOICE.sign_off;
+    if (signOff && !html.includes(signOff) && !html.includes(signOff.replace("—", "–"))) {
+        warnings.push(`Missing expected sign-off: "${signOff}"`);
+    }
+    return {
+        valid: errors.length === 0,
+        errors,
+        warnings,
+    };
+}

package/build/lib/webhook-events.d.ts

@@ -0,0 +1,15 @@
+export type WebhookEvent = 'campaign.activated' | 'campaign.completed' | 'campaign.paused' | 'email.delivered' | 'email.bounced' | 'email.complained' | 'bounce_rate.warning' | 'domain.dns_lost' | 'approval.requested' | 'approval.decided' | 'social.post.created' | 'social.post.updated' | 'social.post.scheduled' | 'social.post.published' | 'social.post.failed' | 'social.post.archived';
+/**
+ * Fire a webhook event to all active subscriptions matching the event type.
+ * Non-blocking — failures are logged to webhook_deliveries for retry.
+ *
+ * Uses the project's own DB for subscription lookup (BYOD-aware),
+ * and fire-and-forget HTTP delivery.
+ */
+export declare function fireWebhookEvent(event: WebhookEvent, data: Record<string, unknown>, projectId?: string): Promise<number>;
+export declare function validateWebhookUrl(url: string): {
+    valid: boolean;
+    reason?: string;
+};
+/** Generate a random webhook signing secret */
+export declare function generateWebhookSecret(): string;

package/build/lib/webhook-events.js

@@ -0,0 +1,120 @@
+import { createHmac, randomUUID } from 'node:crypto';
+import { db } from '../db.js';
+import { getProjectId } from '../project.js';
+/**
+ * Fire a webhook event to all active subscriptions matching the event type.
+ * Non-blocking — failures are logged to webhook_deliveries for retry.
+ *
+ * Uses the project's own DB for subscription lookup (BYOD-aware),
+ * and fire-and-forget HTTP delivery.
+ */
+export async function fireWebhookEvent(event, data, projectId) {
+    const pid = projectId ?? getProjectId();
+    // Look up active subscriptions matching this event
+    const { data: subs, error } = await db()
+        .from('webhook_subscriptions')
+        .select('id, url, secret')
+        .eq('project_id', pid)
+        .eq('active', true)
+        .contains('events', [event]);
+    if (error || !subs?.length)
+        return 0;
+    const timestamp = new Date().toISOString();
+    const payload = {
+        ...data,
+        data,
+        event,
+        event_type: event,
+        id: randomUUID(),
+        occurred_at: timestamp,
+        project_id: pid,
+        timestamp,
+    };
+    const body = JSON.stringify(payload);
+    let delivered = 0;
+    for (const sub of subs) {
+        try {
+            // HMAC-SHA256 signature (same pattern as Svix/Stripe webhook signing)
+            const signature = createHmac('sha256', sub.secret)
+                .update(body)
+                .digest('hex');
+            const res = await fetch(sub.url, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'X-Sendinel-Event': event,
+                    'X-Sendinel-Signature': `sha256=${signature}`,
+                    'X-Sendinel-Timestamp': payload.timestamp,
+                },
+                body,
+                signal: AbortSignal.timeout(10_000), // 10s timeout
+            });
+            // Log delivery
+            await db().from('webhook_deliveries').insert({
+                subscription_id: sub.id,
+                event,
+                payload,
+                status_code: res.status,
+                attempts: 1,
+                exhausted: res.ok,
+            });
+            if (res.ok)
+                delivered++;
+        }
+        catch (err) {
+            // Log failed delivery for retry
+            await db().from('webhook_deliveries').insert({
+                subscription_id: sub.id,
+                event,
+                payload,
+                status_code: null,
+                attempts: 1,
+                next_retry_at: new Date(Date.now() + 60_000).toISOString(), // retry in 1 min
+            }).catch(() => { }); // don't fail the whole loop
+        }
+    }
+    return delivered;
+}
+// URL validation to prevent SSRF
+const BLOCKED_HOSTS = new Set(['localhost', '127.0.0.1', '0.0.0.0', '::1', '[::1]']);
+const PRIVATE_RANGES = [
+    /^10\./,
+    /^172\.(1[6-9]|2\d|3[0-1])\./,
+    /^192\.168\./,
+    /^169\.254\./,
+    /^fc00:/i,
+    /^fd/i,
+];
+export function validateWebhookUrl(url) {
+    try {
+        const parsed = new URL(url);
+        // Must be HTTPS (except in development)
+        if (parsed.protocol !== 'https:' && process.env.NODE_ENV !== 'development') {
+            return { valid: false, reason: 'URL must use HTTPS' };
+        }
+        // Block private/local hosts
+        if (BLOCKED_HOSTS.has(parsed.hostname)) {
+            return { valid: false, reason: 'URL cannot point to localhost or loopback addresses' };
+        }
+        // Block private IP ranges
+        for (const range of PRIVATE_RANGES) {
+            if (range.test(parsed.hostname)) {
+                return { valid: false, reason: 'URL cannot point to private IP ranges' };
+            }
+        }
+        // Block file:// and other schemes
+        if (!['https:', 'http:'].includes(parsed.protocol)) {
+            return { valid: false, reason: 'URL must use HTTP or HTTPS protocol' };
+        }
+        return { valid: true };
+    }
+    catch {
+        return { valid: false, reason: 'Invalid URL format' };
+    }
+}
+/** Generate a random webhook signing secret */
+export function generateWebhookSecret() {
+    const bytes = new Uint8Array(32);
+    crypto.getRandomValues(bytes);
+    return Array.from(bytes).map(b => b.toString(16).padStart(2, '0')).join('');
+}

package/build/plan-limits.d.ts

@@ -0,0 +1,8 @@
+interface LimitCheck {
+    allowed: boolean;
+    current: number;
+    limit: number;
+    resource: string;
+}
+export declare function checkPlanLimit(resource: 'contacts' | 'monthly_sends' | 'active_campaigns' | 'sites' | 'ai_drafts'): Promise<LimitCheck>;
+export {};

package/build/plan-limits.js

@@ -0,0 +1,9 @@
+import { adminDb } from './db.js';
+import { getProjectId } from './project.js';
+export async function checkPlanLimit(resource) {
+    const { data, error } = await adminDb()
+        .rpc('check_plan_limit', { p_project_id: getProjectId(), p_resource: resource });
+    if (error)
+        throw new Error(`Plan limit check failed: ${error.message}`);
+    return data;
+}

package/build/project.d.ts

@@ -0,0 +1 @@
+export declare function getProjectId(): string;

package/build/project.js

@@ -0,0 +1,9 @@
+import { requestContext } from './db.js';
+export function getProjectId() {
+    // HTTP transport: request-scoped (concurrent multi-tenant safe).
+    // stdio transport: single project per process, set in env at startup.
+    const id = requestContext()?.projectId ?? process.env.SENDINEL_PROJECT_ID;
+    if (!id)
+        throw new Error("SENDINEL_PROJECT_ID env var is required");
+    return id;
+}

package/build/server.d.ts

@@ -0,0 +1,18 @@
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export interface ToolRegistrationOptions {
+    scopes?: string[];
+    toolGroups?: string[];
+}
+declare const GROUP_REGISTRY: Record<string, (server: McpServer) => void>;
+export declare const ALL_TOOL_GROUPS: string[];
+export type ToolGroup = keyof typeof GROUP_REGISTRY;
+export type ToolGroupMap = Record<string, string>;
+export declare function getRequiredScope(name: string): string;
+/**
+ * Collects tool-name → group metadata from the same group registry used by
+ * registerAllTools(). Scope filtering and definition scanning are applied
+ * through the same proxy path as real MCP registration.
+ */
+export declare function getRegisteredToolGroups(options?: ToolRegistrationOptions): ToolGroupMap;
+export declare function registerAllTools(server: McpServer, options?: ToolRegistrationOptions): void;
+export {};