@bridge_gpt/mcp-server 0.2.37 → 0.2.38

package/build/sfcc/reads-custom-object-def.js

@@ -11,17 +11,31 @@
  * OCAPI's CustomObjectDefinitions resource only exposes operations scoped to
  * a known object_type — there is no top-level list and no bare get-by-type
  * (unlike SystemObjectDefinitions). A caller-supplied object_type is always
- * required; OCAPI cannot enumerate custom object types.
+ * required; OCAPI cannot enumerate custom object type IDs directly.
+ *
+ * That is narrower than "wholly undiscoverable," and the tools below say so:
+ * `system_object_list` at `projection: "full"` returns a distinct
+ * `display_name` and `attribute_definition_count` per custom type, from which a
+ * candidate ID can be derived (e.g. strip spaces from "Product Quality Result"
+ * → "ProductQualityResult") and confirmed by checking that this module's own
+ * `custom_object_definition_attributes_get` returns an attribute count matching
+ * that row's `attribute_definition_count`. This adds no new tool and no new
+ * projection value — it is existing capability, stated accurately.
  *
  * Note: custom object TYPE creation/update is NOT available via OCAPI REST.
  * It is a v2 metadata-import capability (metadata XML → WebDAV → import job).
+ *
+ * Both tools can return complete attribute-definition documents at
+ * `projection: "full"` (BAPI-767). Bridge withholds each attribute's
+ * `default_value` from that response (BAPI-769, `read-body.ts`) — every other
+ * schema field (type, flags, labels) is unaffected.
  */
 import path from "path";
 import { z } from "zod";
 import { ocapiGet, ocapiPost } from "./client.js";
 import { withSfccGate } from "./tool-wrapper.js";
 import { formatOcapiReadFailure, withSfccReadErrorBoundary } from "./read-result.js";
-import { normalizeOcapiBody } from "./ocapi-shape.js";
+import { readSfccBody } from "./read-body.js";
 import { applyProjectionToBody, projectionInputFor, projectionQueryEntries, } from "./read-projection.js";
 import { truncateAndSaveIfNeeded } from "./output.js";
 // ---------------------------------------------------------------------------
@@ -36,18 +50,17 @@ const READ_ANNOTATIONS = {
 // ---------------------------------------------------------------------------
 // Input schemas
 // ---------------------------------------------------------------------------
+const OBJECT_TYPE_DISCOVERY_HINT = 'Known custom object type id (e.g. starting with "c_"). OCAPI cannot enumerate ' +
+    "type IDs directly, but you can discover a candidate via system_object_list at " +
+    "projection=\"full\" (distinct display_name + attribute_definition_count per " +
+    "custom type) and confirm it by checking that this tool's returned attribute " +
+    "count matches that row's attribute_definition_count.";
 const customObjectAttributesGetInput = z.object({
-    object_type: z
-        .string()
-        .describe('Known custom object type identifier, e.g. a custom type id starting with "c_". ' +
-        "OCAPI cannot enumerate custom object types — the type must already be known."),
+    object_type: z.string().describe(OBJECT_TYPE_DISCOVERY_HINT),
     projection: projectionInputFor("attribute_collection"),
 });
 const customObjectAttributeSearchInput = z.object({
-    object_type: z
-        .string()
-        .describe('Known custom object type to search within, e.g. a custom type id starting with "c_". ' +
-        "OCAPI cannot enumerate custom object types — the type must already be known."),
+    object_type: z.string().describe(OBJECT_TYPE_DISCOVERY_HINT),
     query: z.union([z.string(), z.record(z.string(), z.any())]).describe("Search query. A plain string is a case-insensitive substring match across " +
         "id and display_name; a structured OCAPI query object passes through unchanged."),
     start: z.number().optional().describe("Zero-based offset for paging."),
@@ -86,7 +99,7 @@ function buildCustomObjectAttributesGetHandler(gateDeps, getDocsDir) {
         if (!result.ok) {
             return formatOcapiReadFailure(result);
         }
-        const normalized = normalizeOcapiBody(result.body);
+        const normalized = readSfccBody(result.body);
         const text = JSON.stringify(normalized, null, 2);
         const dir = path.join(await getDocsDir(), "sfcc");
         return saveAndReturn(text, dir, `custom-object-def-attributes-${safeType(object_type)}-${safeTimestamp()}.json`, normalized.page);
@@ -112,7 +125,7 @@ function buildCustomObjectAttributeSearchHandler(gateDeps, getDocsDir) {
         if (!result.ok) {
             return formatOcapiReadFailure(result);
         }
-        const normalized = normalizeOcapiBody(result.body);
+        const normalized = readSfccBody(result.body);
         const text = JSON.stringify(normalized, null, 2);
         const dir = path.join(await getDocsDir(), "sfcc");
         return saveAndReturn(text, dir, `custom-object-def-search-${safeType(object_type)}-${safeTimestamp()}.json`, normalized.page);
@@ -127,20 +140,19 @@ export function registerSfccCustomObjectDefReadTools(registerTool, deps) {
     const { gateDeps, getDocsDir } = deps;
     registerTool("custom_object_definition_attributes_get", {
         description: "Retrieve attribute definitions for a KNOWN custom object type via " +
-            "GET /custom_object_definitions/{type}/attribute_definitions. " +
-            "Returns each attribute's full schema by default. " +
-            "OCAPI cannot enumerate types — object_type is required. " +
-            "Type creation is v2 metadata-import only. Oversized payloads auto-saved locally.",
+            "GET /custom_object_definitions/{type}/attribute_definitions " +
+            "(default_value withheld). OCAPI cannot enumerate type IDs directly; " +
+            "derive one via system_object_list (projection=full, attribute_definition_count), " +
+            "confirm here. Type creation is v2 metadata-import only.",
         inputSchema: customObjectAttributesGetInput,
         annotations: READ_ANNOTATIONS,
     }, buildCustomObjectAttributesGetHandler(gateDeps, getDocsDir));
     registerTool("custom_object_definition_attribute_search", {
         description: "Search attribute definitions within a KNOWN custom object type via " +
-            "POST /custom_object_definitions/{type}/attribute_definition_search. " +
-            "Returns each attribute's full schema by default. " +
-            "OCAPI cannot enumerate types; object_type is required. " +
-            "Pass a string or OCAPI query. Type creation is v2 metadata-import only. " +
-            "Oversized results auto-saved locally.",
+            "POST /custom_object_definitions/{type}/attribute_definition_search " +
+            "(default_value withheld). OCAPI cannot enumerate type IDs directly; " +
+            "derive one via system_object_list (projection=full, attribute_definition_count), " +
+            "confirm here. Type creation is v2 metadata-import only.",
         inputSchema: customObjectAttributeSearchInput,
         annotations: READ_ANNOTATIONS,
     }, buildCustomObjectAttributeSearchHandler(gateDeps, getDocsDir));

package/build/sfcc/reads-site-preference.js

@@ -24,11 +24,18 @@
  * It is also, for now, accidentally protective. A name-heuristic scan of all 19
  * preference groups on the tested sandbox found secret-named preferences in six
  * of them — including one literally named `client_id` — and none of them expose
- * a value through this endpoint. No redaction seam is built here because there
- * is no value-bearing path to redact. If OCAPI ever starts returning values,
+ * a value through this endpoint. If OCAPI ever starts returning values here,
  * redaction must be added on the raw body BEFORE normalization, serialization,
  * truncation, or save, so one placement covers both the inline response and the
- * docs/tmp/sfcc/ save path.
+ * docs/tmp/sfcc/ save path — exactly the `readSfccBody` seam these three
+ * handlers already route through (BAPI-769).
+ *
+ * That value-bearing route already exists elsewhere: `SitePreferences`
+ * attribute-definition reads via `system_object_attribute_search` (with
+ * `object_type: "SitePreferences"`) can return each preference's
+ * `default_value`, and `readSfccBody` withholds it there today. This module's
+ * three preference-value tools remain ids-only for the reason stated above —
+ * OCAPI's `preference_search` itself never returns a value, `select` or not.
  *
  * NOTE: SCAPI Preferences API (sfcc.preferences) is intentionally NOT used.
  * This keeps the tool context on the OCAPI Data API, preserving the single
@@ -40,7 +47,7 @@ import { z } from "zod";
 import { ocapiGet, ocapiPost } from "./client.js";
 import { withSfccGate } from "./tool-wrapper.js";
 import { formatOcapiReadFailure, formatSfccReadFailure, withSfccReadErrorBoundary, } from "./read-result.js";
-import { normalizeOcapiBody } from "./ocapi-shape.js";
+import { readSfccBody } from "./read-body.js";
 import { projectionInputFor, projectionQueryEntries } from "./read-projection.js";
 import { truncateAndSaveIfNeeded } from "./output.js";
 // ---------------------------------------------------------------------------
@@ -145,7 +152,7 @@ export function buildSitePreferenceGetHandler(gateDeps, getDocsDir) {
         if (!result.ok) {
             return formatOcapiReadFailure(result);
         }
-        const normalized = normalizeOcapiBody(result.body);
+        const normalized = readSfccBody(result.body);
         const text = JSON.stringify(normalized, null, 2);
         const dir = path.join(await getDocsDir(), "sfcc");
         return saveAndReturn(text, dir, `site-preference-get-${safeGroup(group)}-${safeTimestamp()}.json`, normalized.page);
@@ -173,7 +180,7 @@ export function buildSitePreferenceSearchHandler(gateDeps, getDocsDir) {
         if (!result.ok) {
             return formatOcapiReadFailure(result);
         }
-        const normalized = normalizeOcapiBody(result.body);
+        const normalized = readSfccBody(result.body);
         const text = JSON.stringify(normalized, null, 2);
         const dir = path.join(await getDocsDir(), "sfcc");
         return saveAndReturn(text, dir, `site-preference-search-${safeGroup(group)}-${safeTimestamp()}.json`, normalized.page);
@@ -196,7 +203,7 @@ export function buildSitePreferenceGroupListHandler(gateDeps, getDocsDir) {
         if (!result.ok) {
             return formatOcapiReadFailure(result);
         }
-        const normalized = normalizeOcapiBody(result.body);
+        const normalized = readSfccBody(result.body);
         const text = JSON.stringify(normalized, null, 2);
         const dir = path.join(await getDocsDir(), "sfcc");
         return saveAndReturn(text, dir, `site-preference-group-list-${safeTimestamp()}.json`, normalized.page);

package/build/sfcc/reads-system-object.js

@@ -8,13 +8,18 @@
  *
  * All tools are read-only, run behind the T1 call-time gate, and route
  * oversized payloads through the sfcc/output.ts truncate-and-save seam.
+ *
+ * `system_object_attribute_search` can return complete attribute-definition
+ * documents at `projection: "full"` (BAPI-767). Bridge withholds each
+ * attribute's `default_value` from that response (BAPI-769, `read-body.ts`) —
+ * every other schema field (type, flags, labels) is unaffected.
  */
 import path from "path";
 import { z } from "zod";
 import { ocapiGet, ocapiPost } from "./client.js";
 import { withSfccGate } from "./tool-wrapper.js";
 import { formatOcapiReadFailure, withSfccReadErrorBoundary } from "./read-result.js";
-import { normalizeOcapiBody } from "./ocapi-shape.js";
+import { readSfccBody } from "./read-body.js";
 import { applyProjectionToBody, projectionInputFor, projectionQueryEntries, } from "./read-projection.js";
 import { truncateAndSaveIfNeeded } from "./output.js";
 // ---------------------------------------------------------------------------
@@ -86,7 +91,7 @@ function buildSystemObjectListHandler(gateDeps, getDocsDir) {
         if (!result.ok) {
             return formatOcapiReadFailure(result);
         }
-        const normalized = normalizeOcapiBody(result.body);
+        const normalized = readSfccBody(result.body);
         const text = JSON.stringify(normalized, null, 2);
         const dir = path.join(await getDocsDir(), "sfcc");
         return saveAndReturn(text, dir, `system-object-list-${safeTimestamp()}.json`, normalized.page);
@@ -100,7 +105,7 @@ function buildSystemObjectGetHandler(gateDeps, getDocsDir) {
         if (!result.ok) {
             return formatOcapiReadFailure(result);
         }
-        const normalized = normalizeOcapiBody(result.body);
+        const normalized = readSfccBody(result.body);
         const text = JSON.stringify(normalized, null, 2);
         const dir = path.join(await getDocsDir(), "sfcc");
         return saveAndReturn(text, dir, `system-object-get-${safeType(object_type)}-${safeTimestamp()}.json`, normalized.page);
@@ -126,7 +131,7 @@ function buildSystemObjectAttributeSearchHandler(gateDeps, getDocsDir) {
         if (!result.ok) {
             return formatOcapiReadFailure(result);
         }
-        const normalized = normalizeOcapiBody(result.body);
+        const normalized = readSfccBody(result.body);
         const text = JSON.stringify(normalized, null, 2);
         const dir = path.join(await getDocsDir(), "sfcc");
         return saveAndReturn(text, dir, `system-object-search-${safeType(object_type)}-${safeTimestamp()}.json`, normalized.page);
@@ -159,7 +164,8 @@ export function registerSystemObjectReadTools(registerTool, deps) {
     registerTool("system_object_attribute_search", {
         description: "Search attribute definitions for a system object type. Read-only. " +
             "POST /system_object_definitions/{type}/attribute_definition_search. " +
-            "Use for targeted c_ attribute lookups; returns each attribute's full schema by default. " +
+            "Use for targeted c_ attribute lookups; returns each attribute's schema " +
+            "by default (default_value withheld). " +
             "Pass a plain string for text search or a structured OCAPI query. " +
             "Oversized results auto-saved locally.",
         inputSchema: systemObjectAttributeSearchInput,

package/build/sfcc/write-result.js

@@ -6,15 +6,19 @@
  * their own 403/fault/success response logic, guaranteeing a consistent surface
  * across every write tool.
  *
- * Successful results are unchanged and never gain `isError`. Every *failure*
- * branch — including the 403 write-grant remediation, which used to be prose —
- * now returns the universal nested envelope from `sfcc-result.ts`, so
- * `result.isError === true` is total across a write tool's post-transport
- * failures as well as its pre-transport ones.
+ * Successful results never gain `isError`, but their echoed `body` is redacted
+ * (BAPI-769): an attribute-definition write's success body can carry the same
+ * `default_value` a read can, so it is withheld via `read-body.ts`'s
+ * `redactSfccBody` before serialization. Every other *failure* branch —
+ * including the 403 write-grant remediation, which used to be prose — returns
+ * the universal nested envelope from `sfcc-result.ts`, so `result.isError ===
+ * true` is total across a write tool's post-transport failures as well as its
+ * pre-transport ones.
  */
 import { writeGrantForbiddenResult } from "./write-grants.js";
 import { DEFAULT_OCAPI_VERSION } from "./config.js";
 import { formatSfccWriteFailure } from "./sfcc-result.js";
+import { redactSfccBody } from "./read-body.js";
 /** Wrap text in the standard MCP text-result shape (success path only). */
 function textResult(text) {
     return { content: [{ type: "text", text }] };
@@ -54,7 +58,12 @@ function ocapiWriteFaultMessage(body, status) {
  *
  *  - `403` → the unified failure carrying the paste-ready write-grant
  *    remediation as structured data (via write-grants.ts).
- *  - success → JSON with `status`, `outcome`, and `body`; no `isError`.
+ *  - success → JSON with `status`, `outcome`, and `body`; no `isError`. `body`
+ *    is redacted (BAPI-769) before serialization: a successful
+ *    attribute-definition PUT/PATCH echoes the updated resource in the same
+ *    shape a GET returns, so it can carry a real `default_value` exactly like a
+ *    read can — `redactSfccBody` withholds it here the same way `readSfccBody`
+ *    withholds it on the read path. Every other key survives untouched.
  *  - other failure → the unified `OCAPI_WRITE_ERROR` failure, source `ocapi`,
  *    with the structured fault mapping and the upstream body under
  *    `error.details`.
@@ -76,7 +85,7 @@ export function formatOcapiWriteToolResult(result, operation, path, ocapiVersion
         return textResult(JSON.stringify({
             status: result.status,
             outcome: result.outcome,
-            body: result.body,
+            body: redactSfccBody(result.body),
         }));
     }
     return formatSfccWriteFailure({

package/build/sfcc/writes-custom-object-def.js

@@ -8,7 +8,10 @@
  * Both tools write ATTRIBUTE DEFINITIONS on an already-known custom object type.
  * Custom object TYPE creation is intentionally NOT attempted: OCAPI cannot
  * create custom object types (that is a v2 metadata-import capability), so the
- * type must pre-exist. Mirrors reads-custom-object-def.ts.
+ * type must pre-exist. OCAPI also cannot enumerate custom object type IDs
+ * directly — see reads-custom-object-def.ts for the `system_object_list` +
+ * `projection: "full"` discovery path a caller can use to find one before
+ * writing to it. Mirrors reads-custom-object-def.ts.
  *
  * Every handler is call-time gated by `withSfccGate`, sandbox-guarded via
  * `rejectIfNotSandboxForWrite`, and routes its OCAPI result through
@@ -31,7 +34,8 @@ const createCustomObjectAttributeDefinitionInput = z.object({
     object_type: z
         .string()
         .describe('Known custom object type identifier (must already exist). OCAPI cannot ' +
-        "enumerate or create custom object types — only attribute definitions on a known type."),
+        "create types, and cannot enumerate type IDs directly — only attribute " +
+        "definitions on a known type."),
     attribute_id: z
         .string()
         .describe("URL attribute-definition id. If the body also carries `id`, it must match."),

package/build/version.generated.js

@@ -1,2 +1,2 @@
 // AUTO-GENERATED — do not edit manually. Regenerate with: npm run build
-export const VERSION = "0.2.37";
+export const VERSION = "0.2.38";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bridge_gpt/mcp-server",
-  "version": "0.2.37",
+  "version": "0.2.38",
   "description": "Bridge API MCP server — exposes Jira endpoints as MCP tools for Claude Code agents",
   "license": "MIT",
   "type": "module",
@@ -29,7 +29,7 @@
     "test": "npm run test:normal && npm run test:module-mocks",
     "test:normal": "node scripts/run-unit-tests.js normal",
     "test:module-mocks": "node scripts/run-unit-tests.js module-mocks",
-    "test:integration": "node --test build/integration/refresh-main.integration.test.js build/integration/command-provisioning.integration.test.js build/integration/start-tickets.integration.test.js build/integration/start-tickets-tier-handoff.integration.test.js build/integration/doctor.integration.test.js build/integration/agent-capabilities.integration.test.js build/integration/conductor-producer.integration.test.js build/integration/conductor-message-relay.integration.test.js build/integration/executor-http-runner.integration.test.js build/integration/executor-job-behaviors.integration.test.js build/integration/executor-recovery-jobs.integration.test.js build/integration/executor-spec-review-prompt.integration.test.js build/integration/resume-pre-spawn.git.integration.test.js build/integration/worker-finalization-origin.integration.test.js build/integration/post-remediation-merge-ci-wait.integration.test.js build/integration/executor-merge-supervision.integration.test.js build/integration/attachment-binary-roundtrip.integration.test.js build/integration/dependent-ticket-fresh-base.integration.test.js build/integration/execute-plan-instructions.integration.test.js build/integration/implement-ticket-finalization-order.integration.test.js build/integration/conductor-bundle-artifacts.integration.test.js build/integration/install-bridge-repo-resolution.integration.test.js build/integration/capability-report-contract.integration.test.js build/integration/request-brainstorm-general.integration.test.js build/integration/request-council-trigger-drop.integration.test.js build/integration/install-bridge-onboarding-launch.integration.test.js build/integration/install-bridge-conductor.integration.test.js build/integration/install-bridge-failure-guards.integration.test.js build/integration/learn-repository-pipeline.integration.test.js build/integration/visual-diff-mcp.integration.test.js build/integration/executor-mcp-provisioning.integration.test.js build/integration/executor-worktree-reentry.integration.test.js build/integration/sfcc-read-error-contract.integration.test.js build/integration/sfcc-response-envelope.integration.test.js build/integration/sfcc-total-error-contract.integration.test.js build/integration/serve-stdio.integration.test.js build/integration/install-alias.integration.test.js build/integration/setup-epic-validation.integration.test.js build/integration/plane-cli.integration.test.js",
+    "test:integration": "node --test build/integration/refresh-main.integration.test.js build/integration/command-provisioning.integration.test.js build/integration/start-tickets.integration.test.js build/integration/start-tickets-tier-handoff.integration.test.js build/integration/doctor.integration.test.js build/integration/agent-capabilities.integration.test.js build/integration/conductor-producer.integration.test.js build/integration/conductor-message-relay.integration.test.js build/integration/executor-http-runner.integration.test.js build/integration/executor-job-behaviors.integration.test.js build/integration/executor-recovery-jobs.integration.test.js build/integration/executor-spec-review-prompt.integration.test.js build/integration/resume-pre-spawn.git.integration.test.js build/integration/worker-finalization-origin.integration.test.js build/integration/post-remediation-merge-ci-wait.integration.test.js build/integration/executor-merge-supervision.integration.test.js build/integration/attachment-binary-roundtrip.integration.test.js build/integration/dependent-ticket-fresh-base.integration.test.js build/integration/execute-plan-instructions.integration.test.js build/integration/implement-ticket-finalization-order.integration.test.js build/integration/conductor-bundle-artifacts.integration.test.js build/integration/install-bridge-repo-resolution.integration.test.js build/integration/capability-report-contract.integration.test.js build/integration/request-brainstorm-general.integration.test.js build/integration/request-council-trigger-drop.integration.test.js build/integration/install-bridge-onboarding-launch.integration.test.js build/integration/install-bridge-conductor.integration.test.js build/integration/install-bridge-failure-guards.integration.test.js build/integration/learn-repository-pipeline.integration.test.js build/integration/visual-diff-mcp.integration.test.js build/integration/executor-mcp-provisioning.integration.test.js build/integration/executor-worktree-reentry.integration.test.js build/integration/sfcc-read-error-contract.integration.test.js build/integration/sfcc-read-surface.integration.test.js build/integration/sfcc-response-envelope.integration.test.js build/integration/sfcc-total-error-contract.integration.test.js build/integration/serve-stdio.integration.test.js build/integration/install-alias.integration.test.js build/integration/setup-epic-validation.integration.test.js build/integration/plane-cli.integration.test.js",
     "test:smoke": "node --test build/integration/packaged-cli-smoke.test.js",
     "canary:agent-capabilities": "npm run build && node scripts/agent-capabilities-canary.mjs",
     "prepublishOnly": "node scripts/bundle-assets.js && npm run build && node scripts/verify-shebang.cjs"