sentinelayer-cli 0.43.0 → 0.45.0

package/src/mcp/session-stdio-server.js

@@ -13,6 +13,19 @@ import { eventMatchesAgent } from "../session/listener.js";
 import { isSessionControlEvent } from "../session/control-events.js";
 import { buildObservations } from "../session/recall/observations.js";
 import { createMemoryService } from "../engram/index.js";
+import {
+  AdmissionCredentialRefused,
+  assertCanonicalAgentId,
+  canonicalAgentId,
+  withAgentAdmission,
+} from "../session/admission-auth.js";
+import { hasStoredAdmissionCredentials, storedAdmissionAgentsForSession } from "../session/admission.js";
+import { sessionRouteClass } from "../session/route-classes.js";
+import {
+  SESSION_REACTION_TYPES,
+  isSessionReactionType,
+  submitSessionReaction,
+} from "../session/reactions.js";
 import {
   createSessionMessageAction,
   listSessionMessageActions,
@@ -44,9 +57,12 @@ const SESSION_MESSAGE_ACTION_TYPES = new Set([
   "reply",
   "like",
   "dislike",
+  "unlike",
+  "undislike",
   "disregard",
   "view",
 ]);
+const SESSION_REACT_TYPES = Object.freeze(["ack", ...SESSION_REACTION_TYPES]);
 const SESSION_MESSAGE_ACTION_ALIASES = new Map([["comment", "reply"]]);
 
 function normalizeString(value) {
@@ -701,6 +717,25 @@ async function runSessionAction({
   const normalizedActionType = normalizeSessionMessageActionType(actionType || input.actionType || input.action_type);
   const target = requireSessionActionTarget(input);
   const normalizedNote = truncateText(note || input.note || input.message || input.text || "").text;
+  if (isSessionReactionType(normalizedActionType)) {
+    // The same path as the native CLI: canonical fail-closed admission, a fresh
+    // operation key per new intent (an explicit idempotencyKey is a retry), and a
+    // truthful outcome. The raw agent id is passed so a non-canonical spelling is
+    // refused rather than silently aliased.
+    return submitSessionReaction({
+      surface: "mcp",
+      sessionId,
+      agentId: normalizeString(input.agentId || input.agent_id || input.agent),
+      reaction: normalizedActionType,
+      ...target,
+      note: normalizedNote,
+      idempotencyKey: normalizeString(input.idempotencyKey || input.idempotency_key),
+      targetPath,
+      timeoutMs: normalizePositiveInteger(input.timeoutMs || input.timeout_ms, 15_000),
+      dryRun: Boolean(input.dryRun || input.dry_run),
+      createSessionMessageActionFn,
+    });
+  }
   const idempotencyKey =
     normalizeString(input.idempotencyKey || input.idempotency_key) ||
     defaultActionIdempotencyKey({
@@ -858,6 +893,67 @@ async function persistSessionEvent({
   };
 }
 
+function refuseOutsideAdmission(reason) {
+  throw new AdmissionCredentialRefused(
+    `This tool runs for an agent on this machine and needs an admission it can bind to: ${reason}. ` +
+      `It will not fall back to other credentials.`,
+    { reason: "session_admission_not_bound" },
+  );
+}
+
+/**
+ * An agent context is a process that acts for an agent: SENTINELAYER_AGENT_ID is set, or
+ * this machine stores any agent admission credential (usable or not).
+ */
+export async function isAgentContext({ env = process.env } = {}) {
+  return Boolean(normalizeString(env.SENTINELAYER_AGENT_ID)) || (await hasStoredAdmissionCredentials());
+}
+
+/**
+ * The one credential policy for local MCP session tools, by the tool's class in
+ * SESSION_ROUTE_CLASSES (src/session/route-classes.js):
+ *   - exempt-local tools, and every tool outside an agent context: run as before
+ *   - owner tools: refused in an agent context
+ *   - the session stores an admission on this machine (in any state): the tool binds to the
+ *     admission of the agent it names (input agentId, else SENTINELAYER_AGENT_ID) and runs
+ *     inside its scope; naming no agent, an agent holding none of the session's admissions,
+ *     or an expired, malformed or mis-bound admission is refused before any request
+ *   - the session stores none: legacy-data-plane tools run as before; control, owner and
+ *     unclassified (including newly added) tools are refused before any request
+ */
+export async function runInSessionToolContext(name, input = {}, run, { env = process.env } = {}) {
+  const routeClass = sessionRouteClass(`mcp:${name}`);
+  if (routeClass === "exempt-local") return run(input);
+  if (!(await isAgentContext({ env }))) return run(input);
+  if (routeClass === "owner") refuseOutsideAdmission("owner actions are not available to agents");
+  const sessionId = normalizeString(input.sessionId || input.session_id || input.session);
+  if (!sessionId) refuseOutsideAdmission("no session id was given");
+  const stored = await storedAdmissionAgentsForSession(sessionId);
+  if (stored.length === 0) {
+    if (routeClass === "legacy-data-plane") return run(input);
+    refuseOutsideAdmission(`session ${sessionId} stores no admission on this machine and "${name}" needs one`);
+  }
+  const raw = normalizeString(input.agentId || input.agent_id || input.agent) || normalizeString(env.SENTINELAYER_AGENT_ID);
+  if (!raw) refuseOutsideAdmission("no agent id was given");
+  // One canonical identity for authorisation and execution (see admission-auth.js).
+  assertCanonicalAgentId(raw, "agentId");
+  const agentId = canonicalAgentId(raw);
+  if (!stored.includes(agentId)) {
+    refuseOutsideAdmission(`agent "${agentId}" holds none of the admissions stored for session ${sessionId}`);
+  }
+  // live: runs inside the admission scope; an expired, malformed or mis-bound one is refused there.
+  // The file was seen above, so one removed since then refuses too: never a fallback.
+  return withAgentAdmission(sessionId, agentId, () => run(input), { requireStored: true });
+}
+
+export function routeAgentToolsThroughAdmission(handlers, { env = process.env } = {}) {
+  for (const name of Object.keys(handlers)) {
+    const run = handlers[name];
+    handlers[name] = (input = {}) => runInSessionToolContext(name, input, run, { env });
+  }
+  return handlers;
+}
+
 export function createSessionMcpToolHandlers({
   targetPath = process.cwd(),
   pollSessionEventsFn = pollSessionEvents,
@@ -897,7 +993,7 @@ export function createSessionMcpToolHandlers({
       verified: false,
     };
   };
-  return {
+  const handlers = {
     async poll_inbox(input = {}) {
       const sessionId = requireSessionId(input);
       const agentId = requireAgentId(input);
@@ -1105,8 +1201,8 @@ export function createSessionMcpToolHandlers({
 
     async session_react(input = {}) {
       const reaction = normalizeSessionMessageActionType(input.reaction || input.actionType || input.action_type);
-      if (!["ack", "like", "dislike"].includes(reaction)) {
-        throw new Error("reaction must be one of: ack, like, dislike.");
+      if (!SESSION_REACT_TYPES.includes(reaction)) {
+        throw new Error(`reaction must be one of: ${SESSION_REACT_TYPES.join(", ")}.`);
       }
       return runSessionAction({
         input,
@@ -1267,6 +1363,7 @@ export function createSessionMcpToolHandlers({
       });
     },
   };
+  return routeAgentToolsThroughAdmission(handlers);
 }
 
 export const SESSION_MCP_TOOLS = Object.freeze([
@@ -1419,7 +1516,7 @@ export const SESSION_MCP_TOOLS = Object.freeze([
     name: "session_action",
     title: "Record Senti Session Action",
     description:
-      "Record a low-noise message action such as ack, working_on, disregard, like, dislike, or reply; view advances the monotonic read cursor instead of appending an action.",
+      "Record a low-noise message action such as ack, working_on, disregard, like, dislike, unlike, undislike, or reply; view advances the monotonic read cursor instead of appending an action.",
     inputSchema: {
       type: "object",
       additionalProperties: false,
@@ -1442,7 +1539,7 @@ export const SESSION_MCP_TOOLS = Object.freeze([
     name: "session_react",
     title: "React To Senti Message",
     description:
-      "Acknowledge or react to a target session event with ack, like, or dislike.",
+      "Acknowledge or react to a target session event with ack, like, or dislike, or retract your own like/dislike with unlike/undislike. Reactions report an outcome and an operation key; resend that key as idempotencyKey only to retry the same intent.",
     inputSchema: {
       type: "object",
       additionalProperties: false,
@@ -1450,7 +1547,7 @@ export const SESSION_MCP_TOOLS = Object.freeze([
       properties: {
         sessionId: { type: "string", minLength: 1 },
         agentId: { type: "string", minLength: 1 },
-        reaction: { type: "string", enum: ["ack", "like", "dislike"] },
+        reaction: { type: "string", enum: [...SESSION_REACT_TYPES] },
         targetSequenceId: { type: "integer", minimum: 1 },
         targetCursor: { type: "string" },
         targetActionId: { type: "string" },
@@ -1555,13 +1652,14 @@ export const SESSION_MCP_TOOLS = Object.freeze([
     name: "session_locks",
     title: "List Senti File Locks",
     description:
-      "List active authoritative file leases for a session.",
+      "List active authoritative file leases for a session. In an agent context it runs on the agent's admission (agentId, else SENTINELAYER_AGENT_ID).",
     inputSchema: {
       type: "object",
       additionalProperties: false,
       required: ["sessionId"],
       properties: {
         sessionId: { type: "string", minLength: 1 },
+        agentId: { type: "string", minLength: 1 },
       },
     },
   },
@@ -1642,6 +1740,45 @@ function jsonRpcError(id, code, message, data = undefined) {
   });
 }
 
+// The dispatcher enforces each tool's published policy before its handler runs. A tool that
+// requires human approval is refused: approval would have to be server-validated and bound to the
+// call's arguments, and no such approval exists yet. A runtime-blocked tool is refused too. Refused
+// tools are not advertised by tools/list, and a call to one gets a specific JSON-RPC error.
+export const MCP_HUMAN_APPROVAL_REQUIRED = Object.freeze({ code: -32001, reason: "human_approval_required" });
+export const MCP_TOOL_BLOCKED = Object.freeze({ code: -32002, reason: "tool_blocked" });
+
+function toolRefusal(tool) {
+  const security = isPlainObject(tool?.security) ? tool.security : {};
+  if (security.requires_human_approval === true) return MCP_HUMAN_APPROVAL_REQUIRED.reason;
+  if (tool?.metadata?.bridge === "cli-command" && security.requires_human_approval !== false) {
+    return MCP_HUMAN_APPROVAL_REQUIRED.reason;
+  }
+  if (security.runtime_blocked === true || tool?.metadata?.blocked === true) return MCP_TOOL_BLOCKED.reason;
+  return "";
+}
+
+function terminalCommandFor(tool, toolName) {
+  const cliPath = Array.isArray(tool?.metadata?.cliPath) ? tool.metadata.cliPath : toolName.replace(/^sl\./, "").split(".");
+  return `sl ${cliPath.join(" ")}`;
+}
+
+function refusalError(id, toolName, tool, reason) {
+  if (reason === MCP_HUMAN_APPROVAL_REQUIRED.reason) {
+    return jsonRpcError(
+      id,
+      MCP_HUMAN_APPROVAL_REQUIRED.code,
+      `Human approval is required for ${toolName}. It is not available over the MCP bridge in this version; run \`${terminalCommandFor(tool, toolName)}\` in a terminal instead.`,
+      { reason, tool: toolName },
+    );
+  }
+  return jsonRpcError(
+    id,
+    MCP_TOOL_BLOCKED.code,
+    `${toolName} is not available over the MCP bridge; run \`${terminalCommandFor(tool, toolName)}\` in a terminal instead.`,
+    { reason, tool: toolName },
+  );
+}
+
 export async function handleMcpJsonRpcMessage(
   message,
   {
@@ -1691,7 +1828,7 @@ export async function handleMcpJsonRpcMessage(
   if (method === "tools/list") {
     if (isNotification) return null;
     return jsonRpcSuccess(id, {
-      tools: tools.map((tool) => toMcpTool(tool)),
+      tools: tools.filter((tool) => !toolRefusal(tool)).map((tool) => toMcpTool(tool)),
     });
   }
 
@@ -1700,6 +1837,18 @@ export async function handleMcpJsonRpcMessage(
     const toolName = normalizeString(message.params?.name);
     const args = isPlainObject(message.params?.arguments) ? message.params.arguments : {};
     const handler = handlers[toolName];
+    const tool = (Array.isArray(tools) ? tools : []).find((candidate) => normalizeString(candidate?.name) === toolName);
+    const refusal = typeof handler === "function" && tool ? toolRefusal(tool) : "";
+    if (refusal) {
+      return refusalError(id, toolName, tool, refusal);
+    }
+    if (typeof handler === "function" && !tool) {
+      // a handler without a published definition has no policy to check: refused
+      return jsonRpcSuccess(
+        id,
+        buildToolResult({ ok: false, reason: "unknown_tool", tool: toolName }, { isError: true }),
+      );
+    }
     if (typeof handler !== "function") {
       return jsonRpcSuccess(
         id,

package/src/mcp/smoke.js

@@ -1,5 +1,11 @@
 import process from "node:process";
 
+import {
+  CredentialDestinationRefused,
+  credentialedRequest,
+  isCredential,
+  userCredential,
+} from "../auth/credential-destinations.js";
 import { DEFAULT_REQUEST_TIMEOUT_MS } from "../auth/http.js";
 import { requestHostedMcpAccessToken } from "./token-service.js";
 
@@ -75,7 +81,7 @@ function summarizeJsonRpcError(error, secrets = []) {
 async function postJsonRpc({
   fetchImpl,
   url,
-  accessToken,
+  credential,
   payload,
   timeoutMs,
   redactionSecrets = [],
@@ -83,15 +89,18 @@ async function postJsonRpc({
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
   try {
-    const response = await fetchImpl(url, {
-      method: "POST",
-      headers: {
-        Authorization: `Bearer ${accessToken}`,
-        "Content-Type": "application/json",
+    // fetchImpl is the transport credentialedRequest calls, after its origin check.
+    const response = await credentialedRequest(
+      credential,
+      url,
+      {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(payload),
+        signal: controller.signal,
       },
-      body: JSON.stringify(payload),
-      signal: controller.signal,
-    });
+      { fetchImpl },
+    );
     const text = await response.text().catch(() => "");
     let json = null;
     if (text) {
@@ -108,6 +117,7 @@ async function postJsonRpc({
       detail: json ? "" : redactMcpSmokeText(text, redactionSecrets),
     };
   } catch (error) {
+    if (error instanceof CredentialDestinationRefused) throw error;
     const aborted = Boolean(error) && error.name === "AbortError";
     return {
       reached: false,
@@ -172,6 +182,12 @@ export async function runHostedMcpSmoke({
   if (!accessToken) {
     throw new Error("Hosted MCP token mint succeeded but returned no access token.");
   }
+  // The minted bearer as a credential: the mint's own hosted MCP credential, or the bare token bound
+  // to the configured API. Any other credential (an agent's admission, say) is not accepted here.
+  if (minted.credential !== undefined && !(isCredential(minted.credential) && minted.credential.source === "hosted_mcp")) {
+    throw new TypeError("The hosted MCP mint must return a hosted MCP credential.");
+  }
+  const credential = minted.credential || (await userCredential(accessToken, { env, homeDir, source: "hosted_mcp" }));
   const redactionSecrets = [accessToken];
 
   const mcpUrl = joinUrl(minted.apiUrl, "/mcp");
@@ -181,7 +197,7 @@ export async function runHostedMcpSmoke({
   const toolsResponse = await postJsonRpc({
     fetchImpl,
     url: mcpUrl,
-    accessToken,
+    credential,
     timeoutMs: normalizedTimeoutMs,
     redactionSecrets,
     payload: {
@@ -247,7 +263,7 @@ export async function runHostedMcpSmoke({
       const eventsResponse = await postJsonRpc({
         fetchImpl,
         url: mcpUrl,
-        accessToken,
+        credential,
         timeoutMs: normalizedTimeoutMs,
         redactionSecrets,
         payload: {

package/src/mcp/token-service.js

@@ -1,5 +1,6 @@
 import process from "node:process";
 
+import { credentialFor, isAuthenticated, userCredential } from "../auth/credential-destinations.js";
 import { DEFAULT_REQUEST_TIMEOUT_MS, requestJsonMutation } from "../auth/http.js";
 import {
   DEFAULT_API_TOKEN_TTL_DAYS,
@@ -39,12 +40,6 @@ function buildApiPath(apiUrl, pathSuffix) {
   return `${base}/${suffix}`;
 }
 
-function toAuthHeader(token) {
-  return {
-    Authorization: `Bearer ${String(token || "").trim()}`,
-  };
-}
-
 function applyScope(body, { scope = "", scopes } = {}) {
   const normalizedScope = String(scope || "").trim();
   const normalizedScopes = Array.isArray(scopes)
@@ -118,7 +113,7 @@ export async function requestHostedMcpAccessToken({
     tokenTtlDays,
     homeDir,
   });
-  if (!session || !session.token) {
+  if (!isAuthenticated(session)) {
     throw new Error(`Not authenticated. Run \`${authLoginHint()}\` first.`);
   }
 
@@ -135,17 +130,20 @@ export async function requestHostedMcpAccessToken({
     {
       method: "POST",
       operationName: "mcp-token-mint",
-      headers: toAuthHeader(session.token),
+      credential: await credentialFor(session, { env, homeDir }),
       body,
       timeoutMs: normalizedTimeoutMs,
     }
   );
+  const accessToken = String(response.access_token || "");
 
   return {
     apiUrl: session.apiUrl,
     authSource: session.source,
     rotated: Boolean(session.rotated),
-    accessToken: String(response.access_token || ""),
+    accessToken,
+    // the minted bearer, bound to the configured API like the token that minted it
+    credential: await userCredential(accessToken, { env, homeDir, source: "hosted_mcp" }),
     tokenType: String(response.token_type || "Bearer"),
     expiresIn: Number(response.expires_in || 0),
     expiresAt: String(response.expires_at || ""),

package/src/memory/retrieval.js

@@ -1,6 +1,8 @@
 import fsp from "node:fs/promises";
 import path from "node:path";
 
+import { credentialedRequest } from "../auth/credential-destinations.js";
+
 function normalizeString(value) {
   return String(value || "").trim();
 }
@@ -506,6 +508,7 @@ export async function queryHybridRetriever({
   provider = "local",
   apiEndpoint = "",
   apiKey = "",
+  credential = null,
   fetchImpl = globalThis.fetch,
 } = {}) {
   const normalizedProvider = normalizeString(provider).toLowerCase() || "local";
@@ -534,12 +537,18 @@ export async function queryHybridRetriever({
   }
 
   try {
-    const response = await fetchImpl(String(apiEndpoint), {
+    // The user's credential goes only to its own origin (credentialedRequest); a dedicated memory
+    // API key is that service's own key, sent to the endpoint configured for it.
+    const send = (init) =>
+      credential
+        ? credentialedRequest(credential, String(apiEndpoint), init, { fetchImpl })
+        : fetchImpl(String(apiEndpoint), {
+            ...init,
+            headers: { ...init.headers, ...(normalizeString(apiKey) ? { authorization: `Bearer ${apiKey}` } : {}) },
+          });
+    const response = await send({
       method: "POST",
-      headers: {
-        "content-type": "application/json",
-        ...(normalizeString(apiKey) ? { authorization: `Bearer ${apiKey}` } : {}),
-      },
+      headers: { "content-type": "application/json" },
       body: JSON.stringify({
         query: normalizeString(query),
         limit: Math.max(1, Math.floor(normalizeNumber(limit, 12))),

package/src/pocket/ring-owner.js

@@ -1,5 +1,6 @@
 import process from "node:process";
 
+import { checkedTransport, credentialFor, gatewayCredential, isAuthenticated } from "../auth/credential-destinations.js";
 import { requestJsonMutation } from "../auth/http.js";
 import { resolveActiveAuthSession } from "../auth/service.js";
 
@@ -16,14 +17,12 @@ function normalizeString(value) {
 
 /**
  * Resolve the pocket-gateway base URL — DISTINCT from the senti apiUrl (do NOT reuse resolveApiUrl; that is the API host).
- * Precedence: env SENTI_POCKET_URL -> env POCKET_GATEWAY_URL -> a config value if the caller passed one. Absent -> "".
+ * Precedence: env SENTI_POCKET_URL -> a config value if the caller passed one. Absent -> "". The user's token is only
+ * sent to the SENTI_POCKET_URL origin (src/auth/credential-destinations.js).
  * A present value MUST be an http(s) URL (fail-closed on a bogus scheme). Trailing slashes trimmed.
  */
 export function resolvePocketGatewayUrl({ env = process.env, configUrl = "" } = {}) {
-  const raw =
-    normalizeString(env.SENTI_POCKET_URL) ||
-    normalizeString(env.POCKET_GATEWAY_URL) ||
-    normalizeString(configUrl);
+  const raw = normalizeString(env.SENTI_POCKET_URL) || normalizeString(configUrl);
   if (!raw) return "";
   if (!/^https?:\/\//i.test(raw)) throw new Error("pocket gateway URL must be an http(s) URL");
   return raw.replace(/\/+$/, "");
@@ -74,9 +73,15 @@ export async function ringOwner(
   }
 
   const auth = await resolveAuthSession({ cwd, env, autoRotate: false });
-  if (!auth?.token) {
+  if (!isAuthenticated(auth)) {
     throw new Error("Not authenticated. Run `sl auth login` first.");
   }
+  // The user's token, bound to the gateway SENTI_POCKET_URL names; a --gateway-url on any other
+  // origin is refused when the request is sent.
+  const credential = await gatewayCredential(await credentialFor(auth, { env }), { env });
+  if (!credential) {
+    throw new Error("pocket gateway URL not configured. Set SENTI_POCKET_URL to the pocket-gateway base URL.");
+  }
 
   const context = { sessionId: sid };
   if (normalizeString(whatWeNeed)) context.whatWeNeed = normalizeString(whatWeNeed);
@@ -88,10 +93,10 @@ export async function ringOwner(
 
   // requestJsonMutation auto-derives a transport Idempotency-Key from operationName (retry-safe at the wire); the
   // gateway's own ring-level dedupe (PR-B4) keys on body.idempotencyKey OR a content hash, so an identical retry rings once.
-  return requestMutation(`${gw}/dial/ring-owner`, {
+  return checkedTransport(requestMutation)(`${gw}/dial/ring-owner`, {
     method: "POST",
     operationName: "pocket.ring_owner",
-    headers: { Authorization: `Bearer ${auth.token}` },
+    credential,
     body,
   });
 }

package/src/review/ai-review.js

@@ -10,7 +10,7 @@ import {
 import { computeProviderCost } from "../billing/price-book.js";
 import { buildBillingRunId, buildCallIdempotencyKey, sanitizeBillingMetadata } from "../billing/ledger-entry.js";
 import { recordSessionUsage } from "../billing/session-usage.js";
-import { loadConfig } from "../config/service.js";
+import { loadConfig, userConfigValues } from "../config/service.js";
 import { evaluateBudget } from "../cost/budget.js";
 import { appendCostEntry, summarizeCostHistory } from "../cost/history.js";
 import { estimateTokens } from "../cost/tokenizer.js";
@@ -534,7 +534,7 @@ export async function runAiReviewLayer({
     configModel: config.resolved.defaultModelId || DEFAULT_REVIEW_AI_MODEL,
   });
   const explicitApiKey = normalizeString(apiKey);
-  const configuredApiKey = resolveConfiguredApiKey(resolvedProvider, config.resolved);
+  const configuredApiKey = resolveConfiguredApiKey(resolvedProvider, userConfigValues(config));
 
   const prompt = buildAiReviewPrompt({
     targetPath: normalizedTargetPath,

package/src/review/dd-report-email-client.js

@@ -1,5 +1,6 @@
 import crypto from "node:crypto";
 
+import { checkedTransport, credentialFor, isAuthenticated } from "../auth/credential-destinations.js";
 import { resolveActiveAuthSession } from "../auth/service.js";
 import { requestJson } from "../auth/http.js";
 
@@ -97,7 +98,7 @@ export async function sendDdReportEmail({
     });
   }
 
-  if (!session || !session.token) {
+  if (!isAuthenticated(session)) {
     return errorResult({
       runId: normalizedRunId,
       to: normalizedTo,
@@ -116,11 +117,9 @@ export async function sendDdReportEmail({
   });
 
   try {
-    const response = await requestJsonImpl(endpoint, {
+    const response = await checkedTransport(requestJsonImpl)(endpoint, {
       method: "POST",
-      headers: {
-        Authorization: `Bearer ${session.token}`,
-      },
+      credential: await credentialFor(session),
       idempotencyKey,
       body: { to: normalizedTo },
       timeoutMs,