Version Packages

examples/nextjs-basic/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @senderkit-examples/nextjs-basic
 
+## 0.0.15
+
+### Patch Changes
+
+- Updated dependencies [ca9d5ec]
+  - @senderkit/sdk@0.14.0
+
 ## 0.0.14
 
 ### Patch Changes

examples/nextjs-basic/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@senderkit-examples/nextjs-basic",
-  "version": "0.0.14",
+  "version": "0.0.15",
   "private": true,
   "scripts": {
     "dev": "next dev",

examples/node-basic/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @senderkit-examples/node-basic
 
+## 0.0.15
+
+### Patch Changes
+
+- Updated dependencies [ca9d5ec]
+  - @senderkit/sdk@0.14.0
+
 ## 0.0.14
 
 ### Patch Changes

examples/node-basic/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@senderkit-examples/node-basic",
-  "version": "0.0.14",
+  "version": "0.0.15",
   "private": true,
   "type": "module",
   "scripts": {

packages/cli/CHANGELOG.md

@@ -1,5 +1,34 @@
 # @senderkit/cli
 
+## 0.9.0
+
+### Minor Changes
+
+- ca9d5ec: MCP manifest fixes from the 2026-07-31 connectors-directory audit — the shared
+  manifest now states the real wire contract, so the hosted server no longer needs
+  app-side overrides for these:
+
+  - **`ToolAnnotations` widened to admit non-destructive writes.** The union was
+    `readOnlyHint: true` XOR `destructiveHint: true`, but MCP also has additive,
+    non-destructive writes (`destructiveHint: false`) — e.g. the app's
+    `templates_create` / `inbound_addresses_create`. `destructiveHint` now accepts
+    either boolean (still exactly one hint per tool).
+  - **cc/bcc descriptions no longer leak CLI input conventions.** On the MCP wire
+    these fields are plain JSON arrays; "(CLI: comma-separated or JSON array)" is
+    gone from the manifest, and the schema now also enforces the API's 50-recipient
+    cap (`maxItems: 50`). The CLI keeps documenting comma-separated input in its
+    own flag help via the new `Command.flagHelp` per-flag override.
+  - **List limits are bounded.** `messagesListInput.limit` advertises the service
+    clamp (1-200, default 50) instead of an unbounded positive int, and
+    `inboundMessagesListInput.limit` now enforces the 1-100 bounds its description
+    already claimed. Out-of-range values fail at the schema instead of being
+    silently clamped server-side.
+
+### Patch Changes
+
+- Updated dependencies [ca9d5ec]
+  - @senderkit/sdk@0.14.0
+
 ## 0.8.0
 
 ### Minor Changes

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@senderkit/cli",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "SenderKit command-line interface and MCP server — send notifications and inspect templates/messages from your terminal or AI assistant.",
   "license": "MIT",
   "homepage": "https://github.com/senderkit/senderkit-sdk#readme",

packages/sdk/CHANGELOG.md

@@ -1,5 +1,29 @@
 # @senderkit/sdk
 
+## 0.14.0
+
+### Minor Changes
+
+- ca9d5ec: MCP manifest fixes from the 2026-07-31 connectors-directory audit — the shared
+  manifest now states the real wire contract, so the hosted server no longer needs
+  app-side overrides for these:
+
+  - **`ToolAnnotations` widened to admit non-destructive writes.** The union was
+    `readOnlyHint: true` XOR `destructiveHint: true`, but MCP also has additive,
+    non-destructive writes (`destructiveHint: false`) — e.g. the app's
+    `templates_create` / `inbound_addresses_create`. `destructiveHint` now accepts
+    either boolean (still exactly one hint per tool).
+  - **cc/bcc descriptions no longer leak CLI input conventions.** On the MCP wire
+    these fields are plain JSON arrays; "(CLI: comma-separated or JSON array)" is
+    gone from the manifest, and the schema now also enforces the API's 50-recipient
+    cap (`maxItems: 50`). The CLI keeps documenting comma-separated input in its
+    own flag help via the new `Command.flagHelp` per-flag override.
+  - **List limits are bounded.** `messagesListInput.limit` advertises the service
+    clamp (1-200, default 50) instead of an unbounded positive int, and
+    `inboundMessagesListInput.limit` now enforces the 1-100 bounds its description
+    already claimed. Out-of-range values fail at the schema instead of being
+    silently clamped server-side.
+
 ## 0.13.0
 
 ### Minor Changes

packages/sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@senderkit/sdk",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "description": "Official TypeScript SDK for SenderKit — notification infrastructure for modern SaaS apps.",
   "license": "MIT",
   "homepage": "https://github.com/senderkit/senderkit-sdk#readme",