@sendinel/mcp-server 1.0.89 → 1.0.91

package/build/anthropic-model.d.ts

@@ -1,4 +1,4 @@
-export { FALLBACK_MODEL_IDS, HAIKU_4_5_MODEL_ID, MODEL_REGISTRY, ROLE, getAnthropicFastModelId, getAnthropicHaiku45ModelId, getAnthropicFrontierModelId, getAnthropicModelId, getAnthropicReasoningModelId, getModelIdForRole, resolveModel, type ModelMetadata, type ModelRole, type ResolvedModel, } from '@desler/models';
+export { FALLBACK_MODEL_IDS, HAIKU_4_5_MODEL_ID, MODEL_REGISTRY, ROLE, getAnthropicFastModelId, getAnthropicHaiku45ModelId, getAnthropicFrontierModelId, getAnthropicModelId, getAnthropicReasoningModelId, getModelIdForRole, resolveModel, parseModelJson, type ModelMetadata, type ModelRole, type ResolvedModel, } from '@desler/models';
 import { type ModelRole, type ResolvedModel } from '@desler/models';
 export declare const DEFAULT_ANTHROPIC_MODEL_ID: string;
 export declare const DEFAULT_ANTHROPIC_FAST_MODEL_ID: string;

package/build/anthropic-model.js

@@ -1,4 +1,4 @@
-export { FALLBACK_MODEL_IDS, HAIKU_4_5_MODEL_ID, MODEL_REGISTRY, ROLE, getAnthropicFastModelId, getAnthropicHaiku45ModelId, getAnthropicFrontierModelId, getAnthropicModelId, getAnthropicReasoningModelId, getModelIdForRole, resolveModel, } from '@desler/models';
+export { FALLBACK_MODEL_IDS, HAIKU_4_5_MODEL_ID, MODEL_REGISTRY, ROLE, getAnthropicFastModelId, getAnthropicHaiku45ModelId, getAnthropicFrontierModelId, getAnthropicModelId, getAnthropicReasoningModelId, getModelIdForRole, resolveModel, parseModelJson, } from '@desler/models';
 import { MODEL_REGISTRY, resolveModel } from '@desler/models';
 import { adminDb } from './db.js';
 export const DEFAULT_ANTHROPIC_MODEL_ID = MODEL_REGISTRY.default.id;

package/build/audit.js

@@ -36,6 +36,7 @@ export async function logAudit(opts) {
         resource_id: opts.resourceId ?? null,
         details: {
             ...(opts.details ?? {}),
+            ...(context?.actorType === 'synchronex_scoped_jwt' ? { kid: context.kid ?? null } : {}),
             ...(context?.workspaceId ? { workspace_id: context.workspaceId } : {}),
             // #4004: same actor + agent identity the dashboard records in api_usage. Only fields known for
             // this request are written; nothing is defaulted.

package/build/auth.d.ts

@@ -8,6 +8,7 @@ export interface ApiKeyInfo {
     authMethod?: 'api_key' | 'scoped_jwt';
     actsAsUserId?: string | null;
     workspaceId?: string | null;
+    kid?: string | null;
 }
 export declare class McpAuthenticationError extends Error {
     readonly status: 401 | 403 | 503;

package/build/auth.js

@@ -1,3 +1,4 @@
+import { decodeProtectedHeader, errors } from 'jose';
 import { adminDb } from './db.js';
 import { ALL_TOOL_GROUPS } from './server.js';
 import { looksLikeScopedJwt, scopedJwtVerificationEnabled, verifyScopedToken, } from './scoped-token.js';
@@ -82,7 +83,15 @@ export async function authenticateBearer(token, overrideProjectId) {
         try {
             claims = await verifyScopedToken(token);
         }
-        catch {
+        catch (error) {
+            let kid = null;
+            try {
+                const header = decodeProtectedHeader(token);
+                kid = typeof header.kid === 'string' ? header.kid.slice(0, 64) : null;
+            }
+            catch { /* Unreadable headers have an unknown key id. */ }
+            const code = error instanceof errors.JOSEError ? error.code : null;
+            console.warn('[scoped-jwt] verification failed', { kid, code });
             throw new McpAuthenticationError('Invalid or expired token', 401, 'INVALID_SCOPED_TOKEN');
         }
         if (claims.scope === 'data'
@@ -107,6 +116,7 @@ export async function authenticateBearer(token, overrideProjectId) {
             action: 'mcp.authenticate',
             resource_type: 'mcp_transport',
             details: {
+                kid: claims.kid ?? null,
                 workspace_id: claims.workspaceId,
                 token_scope: claims.scope,
             },
@@ -120,6 +130,7 @@ export async function authenticateBearer(token, overrideProjectId) {
             authMethod: 'scoped_jwt',
             actsAsUserId: claims.userId,
             workspaceId: claims.workspaceId,
+            kid: claims.kid,
         };
     }
     let info = await validateKey(token);

package/build/db.d.ts

@@ -44,6 +44,7 @@ export declare function runWithClient<T>(client: any, fn: () => Promise<T>, requ
     agentLabel?: string | null;
     keyId?: string | null;
     workspaceId?: string | null;
+    kid?: string | null;
     v1Caller?: V1Caller;
 }): Promise<T>;
 export declare function runWithToolContext<T>(toolGroup: string, toolName: string, fn: () => Promise<T> | T): Promise<T>;
@@ -65,6 +66,7 @@ export declare function requestContext(): {
     agentLabel?: string | null;
     keyId?: string | null;
     workspaceId?: string | null;
+    kid?: string | null;
     v1Caller?: V1Caller;
 } | undefined;
 export declare function projectClientForWriteback(): any | null;

package/build/db.js

@@ -75,6 +75,7 @@ export function requestContext() {
             agentLabel: ctx.agentLabel,
             keyId: ctx.keyId,
             workspaceId: ctx.workspaceId,
+            kid: ctx.kid,
             v1Caller: ctx.v1Caller,
         }
         : undefined;

package/build/index.js

@@ -115,6 +115,7 @@ async function runHttp() {
             actorId: info.actsAsUserId ?? null,
             authKind: info.authMethod === 'scoped_jwt' ? 'scoped_jwt' : 'api_key',
             workspaceId: info.workspaceId ?? null,
+            kid: info.kid ?? null,
         });
     });
     app.get('/health', (_req, res) => res.json({ ok: true }));

package/build/scoped-token.d.ts

@@ -1,6 +1,7 @@
 export declare const SCOPED_TOKEN_SCOPES: readonly ['data', 'service:provision'];
 export type ScopedTokenScope = (typeof SCOPED_TOKEN_SCOPES)[number];
 export type ScopedTokenClaims = {
+    kid: string | null;
     userId: string;
     projectId: string | null;
     workspaceId: string | null;

package/build/scoped-token.js

@@ -1,4 +1,4 @@
-import { createRemoteJWKSet, jwtVerify } from 'jose';
+import { createRemoteJWKSet, decodeProtectedHeader, jwtVerify } from 'jose';
 const ISSUER = 'synchronex';
 const AUDIENCE = 'sendinel';
 const ALGORITHM = 'RS256';
@@ -50,7 +50,9 @@ export async function verifyScopedToken(token) {
     if (payload.workspace_id !== null && payload.workspace_id !== undefined && typeof payload.workspace_id !== 'string') {
         throw new Error('Scoped token workspace claim is invalid');
     }
+    const { kid } = decodeProtectedHeader(token);
     return {
+        kid: typeof kid === 'string' ? kid : null,
         userId,
         projectId,
         workspaceId,

package/build/tools/compound.js

@@ -4,7 +4,7 @@ import Anthropic from '@anthropic-ai/sdk';
 import { adminDb, db } from '../db.js';
 import { getProjectId } from '../project.js';
 import { buildVoicePrompt, deriveTemplateVariables } from '../lib/voice.js';
-import { getAnthropicFastModelId } from '../anthropic-model.js';
+import { parseModelJson, getAnthropicFastModelId } from '../anthropic-model.js';
 import { BLOCK_GENERATION_SCHEMA, blocksToHtml, blocksToText, normalizeComposerBlocks } from '../lib/composer-blocks.js';
 // Haiku 5.5 (fast role) thinks before answering; thinking counts toward max_tokens (#4193).
 const FAST_MIN_MAX_TOKENS = 8000;
@@ -34,16 +34,10 @@ function getAnthropicClient() {
     return new Anthropic({ apiKey });
 }
 function extractJsonArray(raw) {
-    const match = raw.match(/\[[\s\S]*\]/);
-    if (!match)
-        throw new Error('No JSON array in response');
-    return JSON.parse(match[0]);
+    return parseModelJson(raw, { kind: 'array' });
 }
 function extractJsonObject(raw) {
-    const match = raw.match(/\{[\s\S]*\}/);
-    if (!match)
-        throw new Error('No JSON object in response');
-    return JSON.parse(match[0]);
+    return parseModelJson(raw, { kind: 'object' });
 }
 export function registerCompoundTools(server) {
     server.registerTool('setup_campaign_from_brief', {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sendinel/mcp-server",
-  "version": "1.0.89",
+  "version": "1.0.91",
   "description": "AI-controlled email operations control plane for campaigns, contacts, segments, analytics, and multi-provider sending via MCP.",
   "mcpName": "ai.sendinel/mcp-server",
   "type": "module",