@12-apps/mcp 1.5.0 → 1.5.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@12-apps/mcp",
-  "version": "1.5.0",
+  "version": "1.5.2",
   "type": "module",
   "description": "App-agnostic MCP server core: generate one MCP tool per OpenAPI operation and proxy each call to the endpoint carrying the caller's bearer token (permission passthrough). Also ships the reusable AI-connect onboarding UI at @12-apps/mcp/react.",
   "exports": {
@@ -17,8 +17,8 @@
   },
   "dependencies": {
     "@mui/icons-material": "^6.5.0",
-    "@12-apps/onboarding": "^1.5.0",
-    "@12-apps/ui": "^1.5.0",
+    "@12-apps/onboarding": "^1.5.2",
+    "@12-apps/ui": "^1.5.2",
     "react": "^19.2.0"
   },
   "peerDependencies": {
@@ -26,7 +26,7 @@
   },
   "devDependencies": {
     "@mui/material": "^6.5.0",
-    "@12-apps/typescript-config": "^1.5.0",
+    "@12-apps/typescript-config": "^1.5.3",
     "@types/node": "^22.15.3",
     "@types/react": "19.2.2",
     "eslint": "^9.39.1",
@@ -52,6 +52,14 @@
     "prisma",
     "*.js",
     "*.mjs",
-    "*.md"
+    "*.md",
+    "!eslint.config.js",
+    "!**/__tests__/**",
+    "!**/tests/**",
+    "!**/*.test.*",
+    "!**/*.spec.*",
+    "!**/*.stories.*",
+    "!**/*.test-story.*",
+    "!**/test-helpers.*"
   ]
 }

package/src/auth/authorization-server-metadata.test.ts

@@ -1,71 +0,0 @@
-import { describe, expect, it } from "vitest";
-
-import { buildAuthorizationServerMetadata } from "./authorization-server-metadata";
-// Barrel import (deliverable 2.2): the builder must be re-exported from the
-// package entry so the future `@12-apps/mcp` extraction inherits both halves.
-import { buildAuthorizationServerMetadata as buildFromBarrel } from "../index";
-
-describe("buildAuthorizationServerMetadata", () => {
-  it("derives every endpoint from the issuer and fixes the RFC 8414 arrays", () => {
-    const meta = buildAuthorizationServerMetadata({
-      issuer: "https://app.example.com",
-      scopesSupported: ["mcp:read", "mcp:write"],
-    });
-
-    expect(meta.issuer).toBe("https://app.example.com");
-    expect(meta.authorization_endpoint).toBe(
-      "https://app.example.com/api/oauth/authorize",
-    );
-    expect(meta.token_endpoint).toBe("https://app.example.com/api/oauth/token");
-    expect(meta.registration_endpoint).toBe(
-      "https://app.example.com/api/oauth/register",
-    );
-    expect(meta.jwks_uri).toBe("https://app.example.com/.well-known/jwks.json");
-
-    // Fixed per the OAuth 2.1 + PKCE contract — must never drift.
-    expect(meta.response_types_supported).toEqual(["code"]);
-    expect(meta.grant_types_supported).toEqual([
-      "authorization_code",
-      "refresh_token",
-    ]);
-    expect(meta.code_challenge_methods_supported).toEqual(["S256"]);
-    expect(meta.token_endpoint_auth_methods_supported).toEqual([
-      "none",
-      "client_secret_basic",
-    ]);
-  });
-
-  it("passes the supplied scopes through to scopes_supported", () => {
-    const meta = buildAuthorizationServerMetadata({
-      issuer: "https://tenant.futuredrink.com.br",
-      scopesSupported: ["mcp:read"],
-    });
-
-    expect(meta.scopes_supported).toEqual(["mcp:read"]);
-    // Endpoints stay on the supplied issuer origin.
-    expect(meta.issuer).toBe("https://tenant.futuredrink.com.br");
-    expect(meta.authorization_endpoint).toBe(
-      "https://tenant.futuredrink.com.br/api/oauth/authorize",
-    );
-  });
-
-  it("honours a custom token_endpoint_auth_methods override", () => {
-    const meta = buildAuthorizationServerMetadata({
-      issuer: "https://app.example.com",
-      scopesSupported: ["mcp:read", "mcp:write"],
-      tokenEndpointAuthMethods: ["none"],
-    });
-
-    expect(meta.token_endpoint_auth_methods_supported).toEqual(["none"]);
-  });
-
-  it("is re-exported from the package barrel", () => {
-    expect(buildFromBarrel).toBe(buildAuthorizationServerMetadata);
-
-    const meta = buildFromBarrel({
-      issuer: "https://app.example.com",
-      scopesSupported: ["mcp:read", "mcp:write"],
-    });
-    expect(meta.code_challenge_methods_supported).toEqual(["S256"]);
-  });
-});

package/src/auth/resource-metadata.test.ts

@@ -1,46 +0,0 @@
-import { describe, expect, it } from "vitest";
-
-import { bearerChallenge, buildProtectedResourceMetadata } from "./resource-metadata";
-
-describe("buildProtectedResourceMetadata", () => {
-  it("emits the RFC 9728 fields", () => {
-    const meta = buildProtectedResourceMetadata({
-      resource: "https://app.example.com/api/mcp",
-      authorizationServers: ["https://app.example.com"],
-      scopesSupported: ["mcp:read"],
-    });
-    expect(meta).toEqual({
-      resource: "https://app.example.com/api/mcp",
-      authorization_servers: ["https://app.example.com"],
-      bearer_methods_supported: ["header"],
-      scopes_supported: ["mcp:read"],
-    });
-  });
-
-  it("omits scopes when not provided", () => {
-    const meta = buildProtectedResourceMetadata({
-      resource: "r",
-      authorizationServers: ["a"],
-    });
-    expect(meta.scopes_supported).toBeUndefined();
-  });
-});
-
-describe("bearerChallenge", () => {
-  it("points at the resource metadata and carries the error", () => {
-    const challenge = bearerChallenge({
-      resourceMetadataUrl: "https://app.example.com/.well-known/oauth-protected-resource",
-      error: "invalid_token",
-      errorDescription: "expired",
-    });
-    expect(challenge).toBe(
-      'Bearer resource_metadata="https://app.example.com/.well-known/oauth-protected-resource", error="invalid_token", error_description="expired"',
-    );
-  });
-
-  it("emits a bare challenge when no error is given", () => {
-    expect(bearerChallenge({ resourceMetadataUrl: "https://x/.well-known/oauth-protected-resource" })).toBe(
-      'Bearer resource_metadata="https://x/.well-known/oauth-protected-resource"',
-    );
-  });
-});

package/src/dispatch/proxy.test.ts

@@ -1,181 +0,0 @@
-import { describe, expect, it } from "vitest";
-
-import { dispatchTool, DispatchInputError } from "./proxy";
-import type { GeneratedTool } from "../types";
-
-const getTool: GeneratedTool = {
-  name: "getProduct",
-  description: "",
-  method: "GET",
-  path: "/products/{id}",
-  inputSchema: {},
-  annotations: {
-    title: "Fixture tool",
-    readOnlyHint: true,
-    openWorldHint: false,
-    destructiveHint: false,
-  },
-  parameters: [
-    { name: "id", in: "path", required: true, schema: {} },
-    { name: "include", in: "query", required: false, schema: {} },
-    { name: "x-trace", in: "header", required: false, schema: {} },
-  ],
-  bodyProps: [],
-  bodyIsWhole: false,
-  mutating: false,
-  security: [],
-};
-
-const postTool: GeneratedTool = {
-  name: "createProduct",
-  description: "",
-  method: "POST",
-  path: "/products",
-  inputSchema: {},
-  annotations: {
-    title: "Fixture tool",
-    readOnlyHint: false,
-    openWorldHint: true,
-    destructiveHint: false,
-  },
-  parameters: [],
-  bodyProps: ["name", "priceCents"],
-  bodyIsWhole: false,
-  mutating: true,
-  security: [],
-};
-
-interface Captured {
-  url: string;
-  init: RequestInit;
-}
-
-function fakeFetch(
-  status: number,
-  payload: unknown,
-  captured: Captured[],
-): typeof fetch {
-  return (async (url: string, init: RequestInit) => {
-    captured.push({ url, init });
-    return new Response(JSON.stringify(payload), {
-      status,
-      headers: { "content-type": "application/json" },
-    });
-  }) as unknown as typeof fetch;
-}
-
-describe("dispatchTool", () => {
-  it("expands the path, forwards the bearer, and routes query + header args", async () => {
-    const captured: Captured[] = [];
-    const result = await dispatchTool(
-      getTool,
-      { id: "abc 1", include: "variations", "x-trace": "t1" },
-      {
-        baseUrl: "https://app.example.com",
-        bearer: "tok123",
-        fetchImpl: fakeFetch(200, { ok: 1 }, captured),
-      },
-    );
-
-    expect(captured).toHaveLength(1);
-    const { url, init } = captured[0];
-    expect(url).toBe(
-      "https://app.example.com/products/abc%201?include=variations",
-    );
-    const headers = init.headers as Record<string, string>;
-    expect(headers.authorization).toBe("Bearer tok123");
-    expect(headers["x-trace"]).toBe("t1");
-    expect(init.body).toBeUndefined();
-    expect(result.ok).toBe(true);
-    expect(result.status).toBe(200);
-    expect(result.body).toEqual({ ok: 1 });
-  });
-
-  it("sends only known body props as a JSON body for a write", async () => {
-    const captured: Captured[] = [];
-    await dispatchTool(
-      postTool,
-      { name: "Cola", priceCents: 500, sneaky: "drop-me" },
-      {
-        baseUrl: "https://app.example.com",
-        bearer: "t",
-        fetchImpl: fakeFetch(201, {}, captured),
-      },
-    );
-    const { init } = captured[0];
-    expect(init.method).toBe("POST");
-    expect(JSON.parse(init.body as string)).toEqual({
-      name: "Cola",
-      priceCents: 500,
-    });
-    expect((init.headers as Record<string, string>)["content-type"]).toBe(
-      "application/json",
-    );
-  });
-
-  it("throws on a missing required path parameter", async () => {
-    await expect(
-      dispatchTool(
-        getTool,
-        {},
-        {
-          baseUrl: "https://app.example.com",
-          bearer: "t",
-          fetchImpl: fakeFetch(200, {}, []),
-        },
-      ),
-    ).rejects.toBeInstanceOf(DispatchInputError);
-  });
-
-  it("surfaces a non-2xx response as ok:false", async () => {
-    const result = await dispatchTool(
-      getTool,
-      { id: "1" },
-      {
-        baseUrl: "https://app.example.com",
-        bearer: "t",
-        fetchImpl: fakeFetch(403, { error: "forbidden" }, []),
-      },
-    );
-    expect(result.ok).toBe(false);
-    expect(result.status).toBe(403);
-    expect(result.body).toEqual({ error: "forbidden" });
-  });
-
-  // Regression (FUT-105 AC1): the proxy replay must carry the mint origin as the
-  // standard reverse-proxy forwarded headers so the wrapped route reconstructs the
-  // SAME origin the access token's `aud` was minted against. Without these, the
-  // wrapped guard's origin resolver defaults the proto to https and the aud check
-  // fails on an http dev origin → a valid Bearer 401s.
-  it("forwards the baseUrl origin as x-forwarded-proto / x-forwarded-host", async () => {
-    const captured: Captured[] = [];
-    await dispatchTool(
-      getTool,
-      { id: "1" },
-      {
-        baseUrl: "http://localhost:4105",
-        bearer: "t",
-        fetchImpl: fakeFetch(200, {}, captured),
-      },
-    );
-    const headers = captured[0].init.headers as Record<string, string>;
-    expect(headers["x-forwarded-proto"]).toBe("http");
-    expect(headers["x-forwarded-host"]).toBe("localhost:4105");
-  });
-
-  it("derives forwarded proto/host from an https origin with a default port", async () => {
-    const captured: Captured[] = [];
-    await dispatchTool(
-      getTool,
-      { id: "1" },
-      {
-        baseUrl: "https://menu.example.com",
-        bearer: "t",
-        fetchImpl: fakeFetch(200, {}, captured),
-      },
-    );
-    const headers = captured[0].init.headers as Record<string, string>;
-    expect(headers["x-forwarded-proto"]).toBe("https");
-    expect(headers["x-forwarded-host"]).toBe("menu.example.com");
-  });
-});

package/src/openapi/generate.test.ts

@@ -1,219 +0,0 @@
-import { describe, expect, it } from "vitest";
-
-import { generateTools, type OpenApiDocument } from "./generate";
-
-const doc: OpenApiDocument = {
-  paths: {
-    "/products/{id}": {
-      get: {
-        operationId: "getProduct",
-        summary: "Fetch a product",
-        "x-mcp-tool-annotations": {
-          title: "Fixture tool",
-          readOnlyHint: true,
-          openWorldHint: false,
-          destructiveHint: false,
-        },
-        parameters: [
-          {
-            name: "id",
-            in: "path",
-            required: true,
-            schema: { type: "string" },
-          },
-          {
-            name: "include",
-            in: "query",
-            required: false,
-            schema: { type: "string" },
-          },
-        ],
-        responses: {
-          "200": {
-            content: { "application/json": { schema: { type: "object" } } },
-          },
-        },
-        security: [{ bearerAuth: [] }],
-      },
-    },
-    "/products": {
-      post: {
-        summary: "Create a product",
-        "x-mcp-tool-annotations": {
-          title: "Fixture tool",
-          readOnlyHint: false,
-          openWorldHint: true,
-          destructiveHint: false,
-        },
-        requestBody: {
-          required: true,
-          content: {
-            "application/json": {
-              schema: {
-                type: "object",
-                required: ["name"],
-                properties: {
-                  name: { type: "string" },
-                  priceCents: { type: "integer" },
-                },
-              },
-            },
-          },
-        },
-      },
-      get: {
-        operationId: "listProducts",
-        tags: ["internal"],
-        "x-mcp-tool-annotations": {
-          title: "Fixture tool",
-          readOnlyHint: true,
-          openWorldHint: false,
-          destructiveHint: false,
-        },
-      },
-    },
-  },
-};
-
-describe("generateTools", () => {
-  it("maps a GET operation with path + query params", () => {
-    const tools = generateTools(doc);
-    const get = tools.find((t) => t.name === "getProduct");
-    expect(get).toBeDefined();
-    expect(get?.method).toBe("GET");
-    expect(get?.path).toBe("/products/{id}");
-    expect(get?.mutating).toBe(false);
-    expect(get?.description).toBe("Fetch a product");
-    expect(get?.security).toEqual(["bearerAuth"]);
-    expect(get?.annotations).toEqual({
-      title: "Fixture tool",
-      readOnlyHint: true,
-      openWorldHint: false,
-      destructiveHint: false,
-    });
-    // path param is required even though only query is marked optional
-    expect(get?.inputSchema.required).toEqual(["id"]);
-    expect(Object.keys(get?.inputSchema.properties as object)).toEqual([
-      "id",
-      "include",
-    ]);
-    expect(get?.parameters.map((p) => `${p.in}:${p.name}`)).toEqual([
-      "path:id",
-      "query:include",
-    ]);
-    expect(get?.bodyProps).toEqual([]);
-    expect(get?.outputSchema).toEqual({ type: "object" });
-  });
-
-  it("flattens an object request body and records bodyProps + required", () => {
-    const post = generateTools(doc).find(
-      (t) => t.path === "/products" && t.method === "POST",
-    );
-    expect(post?.mutating).toBe(true);
-    expect(post?.name).toBe("post_products"); // no operationId -> slug
-    expect(post?.bodyProps).toEqual(["name", "priceCents"]);
-    expect(post?.bodyIsWhole).toBe(false);
-    expect(post?.inputSchema.required).toEqual(["name"]);
-    expect(Object.keys(post?.inputSchema.properties as object)).toEqual([
-      "name",
-      "priceCents",
-    ]);
-  });
-
-  it("excludes operations by tag", () => {
-    const names = generateTools(doc, { excludeTags: ["internal"] }).map(
-      (t) => t.name,
-    );
-    expect(names).not.toContain("listProducts");
-  });
-
-  it("filters by method", () => {
-    const methods = generateTools(doc, { includeMethods: ["get"] }).map(
-      (t) => t.method,
-    );
-    expect(new Set(methods)).toEqual(new Set(["GET"]));
-  });
-
-  it("is deterministic across calls", () => {
-    expect(generateTools(doc)).toEqual(generateTools(doc));
-  });
-
-  it("exposes a non-object body as a single verbatim property", () => {
-    const wholeBodyDoc: OpenApiDocument = {
-      paths: {
-        "/raw": {
-          post: {
-            operationId: "postRaw",
-            "x-mcp-tool-annotations": {
-              title: "Fixture tool",
-              readOnlyHint: false,
-              openWorldHint: false,
-              destructiveHint: false,
-            },
-            requestBody: {
-              required: true,
-              content: { "application/json": { schema: { type: "array" } } },
-            },
-          },
-        },
-      },
-    };
-    const tool = generateTools(wholeBodyDoc)[0];
-    expect(tool.bodyIsWhole).toBe(true);
-    expect(tool.bodyProps).toEqual([]);
-    expect(tool.inputSchema.required).toEqual(["body"]);
-    expect(
-      (tool.inputSchema.properties as Record<string, unknown>).body,
-    ).toEqual({ type: "array" });
-  });
-
-  it("rejects operations whose review hints were not explicitly audited", () => {
-    const unaudited: OpenApiDocument = {
-      paths: { "/unsafe-default": { get: { operationId: "unsafeDefault" } } },
-    };
-    expect(() => generateTools(unaudited)).toThrow(
-      /must explicitly set readOnlyHint, openWorldHint, and destructiveHint/,
-    );
-  });
-
-  it("rejects an operation with no human-readable annotations title", () => {
-    const untitled: OpenApiDocument = {
-      paths: {
-        "/untitled": {
-          get: {
-            operationId: "untitled",
-            "x-mcp-tool-annotations": {
-              readOnlyHint: true,
-              openWorldHint: false,
-              destructiveHint: false,
-            } as never,
-          },
-        },
-      },
-    };
-    expect(() => generateTools(untitled)).toThrow(
-      /must set a human-readable annotations.title/,
-    );
-  });
-
-  it("carries the response-redaction list onto the generated tool", () => {
-    const redacting: OpenApiDocument = {
-      paths: {
-        "/suppliers": {
-          get: {
-            operationId: "listSuppliers",
-            "x-mcp-tool-annotations": {
-              title: "List suppliers",
-              readOnlyHint: true,
-              openWorldHint: false,
-              destructiveHint: false,
-            },
-            "x-mcp-redact-response": ["data.taxId"],
-          },
-        },
-      },
-    };
-    const [tool] = generateTools(redacting);
-    expect(tool?.redactResponse).toEqual(["data.taxId"]);
-  });
-});

package/src/openapi/refs.test.ts

@@ -1,80 +0,0 @@
-import { describe, expect, it } from "vitest";
-
-import { inlineSchemaRefs, UnsupportedSchemaError } from "./refs";
-
-describe("inlineSchemaRefs", () => {
-  it("returns a flat schema structurally unchanged (no-op)", () => {
-    const flat = {
-      $schema: "https://json-schema.org/draft/2020-12/schema",
-      type: "object",
-      properties: { data: { type: "array", items: { type: "string" } } },
-      required: ["data"],
-      additionalProperties: false,
-    };
-    expect(inlineSchemaRefs(flat)).toEqual(flat);
-  });
-
-  it("inlines a $defs reference and drops the $defs container", () => {
-    const schema = {
-      type: "object",
-      properties: { card: { $ref: "#/$defs/Card" } },
-      $defs: {
-        Card: { type: "object", properties: { last4: { type: "string" } } },
-      },
-    };
-    expect(inlineSchemaRefs(schema)).toEqual({
-      type: "object",
-      properties: { card: { type: "object", properties: { last4: { type: "string" } } } },
-    });
-  });
-
-  it("resolves diamond reuse (same def on sibling branches) without a cycle error", () => {
-    const schema = {
-      type: "object",
-      properties: {
-        a: { $ref: "#/$defs/Widget" },
-        b: { $ref: "#/$defs/Widget" },
-      },
-      $defs: { Widget: { type: "object", properties: { x: { type: "string" } } } },
-    };
-    const inlined = inlineSchemaRefs(schema) as {
-      properties: { a: unknown; b: unknown };
-    };
-    expect(inlined.properties.a).toEqual({ type: "object", properties: { x: { type: "string" } } });
-    expect(inlined.properties.a).toEqual(inlined.properties.b);
-  });
-
-  it("supports #/definitions and #/components/schemas pointers", () => {
-    const legacy = {
-      type: "object",
-      properties: { v: { $ref: "#/definitions/V" } },
-      definitions: { V: { type: "number" } },
-    };
-    expect(inlineSchemaRefs(legacy)).toEqual({
-      type: "object",
-      properties: { v: { type: "number" } },
-    });
-  });
-
-  it("throws on a recursive schema", () => {
-    const recursive = {
-      type: "object",
-      properties: { child: { $ref: "#/$defs/Node" } },
-      $defs: {
-        Node: { type: "object", properties: { next: { $ref: "#/$defs/Node" } } },
-      },
-    };
-    expect(() => inlineSchemaRefs(recursive)).toThrow(UnsupportedSchemaError);
-    expect(() => inlineSchemaRefs(recursive)).toThrow(/Recursive schema not supported: Node/);
-  });
-
-  it("throws on an unresolved reference", () => {
-    expect(() => inlineSchemaRefs({ $ref: "#/$defs/Missing" })).toThrow(/Unresolved \$ref/);
-  });
-
-  it("throws on an unsupported (external) pointer", () => {
-    expect(() => inlineSchemaRefs({ $ref: "https://example.com/schema.json" })).toThrow(
-      /Unsupported \$ref pointer/,
-    );
-  });
-});

package/src/server/manifest.test.ts

@@ -1,71 +0,0 @@
-import { describe, expect, it } from "vitest";
-
-import { buildManifest, serializeManifest } from "./manifest";
-import type { GeneratedTool } from "../types";
-
-function tool(name: string): GeneratedTool {
-  return {
-    name,
-    description: `desc ${name}`,
-    method: "GET",
-    path: `/${name}`,
-    inputSchema: { type: "object", properties: {} },
-    annotations: {
-      readOnlyHint: true,
-      openWorldHint: false,
-      destructiveHint: false,
-    },
-    parameters: [],
-    bodyProps: [],
-    bodyIsWhole: false,
-    mutating: false,
-    security: [],
-  };
-}
-
-describe("buildManifest", () => {
-  it("sorts tools by name regardless of input order", () => {
-    const manifest = buildManifest(
-      [tool("charlie"), tool("alpha"), tool("bravo")],
-      {
-        version: 1,
-        source: "test",
-      },
-    );
-    expect(manifest.tools.map((t) => t.name)).toEqual([
-      "alpha",
-      "bravo",
-      "charlie",
-    ]);
-    expect(manifest.version).toBe(1);
-    expect(manifest.source).toBe("test");
-  });
-});
-
-describe("serializeManifest", () => {
-  it("is deterministic and ends with a trailing newline", () => {
-    const a = serializeManifest(
-      buildManifest([tool("b"), tool("a")], { version: 1, source: "s" }),
-    );
-    const b = serializeManifest(
-      buildManifest([tool("a"), tool("b")], { version: 1, source: "s" }),
-    );
-    expect(a).toBe(b);
-    expect(a.endsWith("\n")).toBe(true);
-  });
-
-  it("deep-sorts object keys so key order never churns the diff", () => {
-    const t1 = tool("x");
-    const t2: GeneratedTool = { ...tool("x") };
-    // Same data, different key insertion order in inputSchema.
-    t1.inputSchema = { type: "object", properties: { b: {}, a: {} } };
-    t2.inputSchema = { properties: { a: {}, b: {} }, type: "object" };
-    const s1 = serializeManifest(
-      buildManifest([t1], { version: 1, source: "s" }),
-    );
-    const s2 = serializeManifest(
-      buildManifest([t2], { version: 1, source: "s" }),
-    );
-    expect(s1).toBe(s2);
-  });
-});

package/src/server/redact.test.ts

@@ -1,47 +0,0 @@
-import { describe, expect, it } from "vitest";
-
-import { redactResponseBody } from "./redact";
-
-describe("redactResponseBody", () => {
-  it("returns the body unchanged when nothing is redacted", () => {
-    const body = { data: { id: "s1", taxId: "123" } };
-    expect(redactResponseBody(body, undefined)).toBe(body);
-    expect(redactResponseBody(body, [])).toBe(body);
-  });
-
-  it("strips a nested path without touching its siblings", () => {
-    const body = { data: { id: "s1", name: "ACME", taxId: "123" } };
-    expect(redactResponseBody(body, ["data.taxId"])).toEqual({
-      data: { id: "s1", name: "ACME" },
-    });
-  });
-
-  it("applies a path to every element when it lands on an array", () => {
-    const body = {
-      data: [
-        { id: "s1", taxId: "1", postalCode: "01000-000" },
-        { id: "s2", taxId: "2", postalCode: "02000-000" },
-      ],
-      pagination: { total: 2 },
-    };
-    expect(
-      redactResponseBody(body, ["data.taxId", "data.postalCode"]),
-    ).toEqual({ data: [{ id: "s1" }, { id: "s2" }], pagination: { total: 2 } });
-  });
-
-  it("does not mutate the caller's object", () => {
-    const body = { data: { id: "s1", taxId: "123" } };
-    redactResponseBody(body, ["data.taxId"]);
-    expect(body.data.taxId).toBe("123");
-  });
-
-  it("ignores a path that does not exist in the body", () => {
-    const body = { data: { id: "s1" } };
-    expect(redactResponseBody(body, ["data.location.latitude"])).toEqual(body);
-  });
-
-  it("leaves non-object bodies alone", () => {
-    expect(redactResponseBody(null, ["data.taxId"])).toBeNull();
-    expect(redactResponseBody("plain", ["data.taxId"])).toBe("plain");
-  });
-});

package/src/server/registry.test.ts

@@ -1,188 +0,0 @@
-import { describe, expect, it } from "vitest";
-
-import { createToolRegistry, HTTP_STATUS_META_KEY } from "./registry";
-import type { GeneratedTool, RequestAuth } from "../types";
-
-const readTool: GeneratedTool = {
-  name: "getThing",
-  description: "Get a thing",
-  method: "GET",
-  path: "/things/{id}",
-  inputSchema: { type: "object", properties: { id: {} }, required: ["id"] },
-  outputSchema: {
-    type: "object",
-    properties: { id: { type: "string" } },
-    required: ["id"],
-  },
-  annotations: {
-    title: "Fixture tool",
-    readOnlyHint: true,
-    openWorldHint: false,
-    destructiveHint: false,
-  },
-  parameters: [{ name: "id", in: "path", required: true, schema: {} }],
-  bodyProps: [],
-  bodyIsWhole: false,
-  mutating: false,
-  security: [],
-};
-
-const writeTool: GeneratedTool = {
-  ...readTool,
-  name: "makeThing",
-  method: "POST",
-  mutating: true,
-  annotations: {
-    title: "Fixture tool",
-    readOnlyHint: false,
-    openWorldHint: false,
-    destructiveHint: false,
-  },
-};
-
-const auth: RequestAuth = { bearer: "tok" };
-
-function okFetch(): typeof fetch {
-  return (async () =>
-    new Response(JSON.stringify({ id: "1" }), {
-      status: 200,
-      headers: { "content-type": "application/json" },
-    })) as unknown as typeof fetch;
-}
-
-function forbiddenFetch(): typeof fetch {
-  return (async () =>
-    new Response(JSON.stringify({ error: "forbidden" }), {
-      status: 403,
-      headers: { "content-type": "application/json" },
-    })) as unknown as typeof fetch;
-}
-
-/** Answers with an arbitrary non-2xx, for asserting the status reaches `_meta`. */
-function statusFetch(status: number): typeof fetch {
-  return (async () =>
-    new Response(JSON.stringify({ error: "nope" }), {
-      status,
-      headers: { "content-type": "application/json" },
-    })) as unknown as typeof fetch;
-}
-
-/** Never reaches the route at all — the dispatch itself throws. */
-function throwingFetch(): typeof fetch {
-  return (async () => {
-    throw new Error("connect ECONNREFUSED");
-  }) as unknown as typeof fetch;
-}
-
-describe("createToolRegistry", () => {
-  it("lists tools as MCP descriptors and honours the visibility filter", () => {
-    const registry = createToolRegistry({
-      tools: [readTool, writeTool],
-      baseUrl: "https://app.example.com",
-      isVisible: (tool) => !tool.mutating,
-    });
-    const names = registry.listTools().map((t) => t.name);
-    expect(names).toEqual(["getThing"]);
-    expect(registry.listTools()[0].inputSchema).toEqual(readTool.inputSchema);
-    expect(registry.listTools()[0].outputSchema).toEqual(readTool.outputSchema);
-    expect(registry.listTools()[0].annotations).toEqual(readTool.annotations);
-  });
-
-  it("strips redacted response fields from both text and structuredContent", async () => {
-    const redactingTool: GeneratedTool = {
-      ...readTool,
-      name: "getSupplier",
-      redactResponse: ["data.taxId"],
-    };
-    const registry = createToolRegistry({
-      tools: [redactingTool],
-      baseUrl: "https://app.example.com",
-      fetchImpl: (async () =>
-        new Response(
-          JSON.stringify({ data: { id: "s1", name: "ACME", taxId: "123" } }),
-          { status: 200, headers: { "content-type": "application/json" } },
-        )) as unknown as typeof fetch,
-    });
-
-    const result = await registry.callTool("getSupplier", { id: "s1" }, auth);
-
-    expect(result.isError).toBe(false);
-    // The agent reads the text block even when it ignores structuredContent, so
-    // the value must be gone from both surfaces.
-    expect(result.content[0]?.text).not.toContain("123");
-    expect(result.content[0]?.text).toContain("ACME");
-    expect(result.structuredContent).toEqual({
-      data: { id: "s1", name: "ACME" },
-    });
-  });
-
-  it("returns an error result for an unknown tool", async () => {
-    const registry = createToolRegistry({
-      tools: [readTool],
-      baseUrl: "https://app.example.com",
-    });
-    const result = await registry.callTool("nope", {}, auth);
-    expect(result.isError).toBe(true);
-    expect(result.content[0].text).toContain("Unknown tool");
-  });
-
-  it("proxies a successful call with text and schema-matching structured content", async () => {
-    const registry = createToolRegistry({
-      tools: [readTool],
-      baseUrl: "https://app.example.com",
-      fetchImpl: okFetch(),
-    });
-    const result = await registry.callTool("getThing", { id: "1" }, auth);
-    expect(result.isError).toBe(false);
-    expect(JSON.parse(result.content[0].text)).toEqual({ id: "1" });
-    expect(result.structuredContent).toEqual({ id: "1" });
-  });
-
-  it("marks an upstream 403 as an error result (authz decided upstream)", async () => {
-    const registry = createToolRegistry({
-      tools: [readTool],
-      baseUrl: "https://app.example.com",
-      fetchImpl: forbiddenFetch(),
-    });
-    const result = await registry.callTool("getThing", { id: "1" }, auth);
-    expect(result.isError).toBe(true);
-    expect(result.content[0].text).toContain("forbidden");
-  });
-
-  // `isError` alone cannot separate "correctly refused" from "actually broken":
-  // a 404 for a missing record and a 500 from a thrown route are the same bit.
-  // Callers that must tell them apart read the status from `_meta`.
-  it.each([403, 404, 422, 500])(
-    "carries the upstream %i in _meta so callers can classify the failure",
-    async (status) => {
-      const result = await createToolRegistry({
-        tools: [readTool],
-        baseUrl: "https://app.example.com",
-        fetchImpl: statusFetch(status),
-      }).callTool("getThing", { id: "1" }, auth);
-      expect(result.isError).toBe(true);
-      expect(result._meta?.[HTTP_STATUS_META_KEY]).toBe(status);
-    },
-  );
-
-  it("omits the status _meta when dispatch never reached the route", async () => {
-    const result = await createToolRegistry({
-      tools: [readTool],
-      baseUrl: "https://app.example.com",
-      fetchImpl: throwingFetch(),
-    }).callTool("getThing", { id: "1" }, auth);
-    expect(result.isError).toBe(true);
-    // No status at all is itself the signal — there was no HTTP answer to bucket.
-    expect(result._meta).toBeUndefined();
-    expect(result.content[0].text).toContain("Tool dispatch failed");
-  });
-
-  it("adds no _meta to a successful call", async () => {
-    const result = await createToolRegistry({
-      tools: [readTool],
-      baseUrl: "https://app.example.com",
-      fetchImpl: okFetch(),
-    }).callTool("getThing", { id: "1" }, auth);
-    expect(result._meta).toBeUndefined();
-  });
-});