@clien-ai/mcp 0.14.0 → 0.15.1

package/dist/types/receipt-url.js

@@ -0,0 +1,105 @@
+/**
+ * FUL-1219 / FUL-1225: which stored source URLs and platform labels an MCP channel may SHOW, and how a
+ * receipt whose URL the projection withheld still answers the questions its URL used to answer.
+ *
+ * Imports nothing, so `hypothesis-semantics.ts` (which `report.ts` imports) can read it too.
+ *
+ * ⚠️ THE MARKERS BELOW ARE TRUSTED ONLY ON PROJECTED DATA. `projectReportDataForMcp` deletes any
+ * stored copy before it sets them, so a reader must be handed the output of exactly one projection:
+ * on unprojected report JSON a forged `urlWithheld` would read as a reachable receipt.
+ */
+/**
+ * The `href` of a stored source URL an MCP channel may show, or null.
+ *
+ * The producer writes each URL through `normalizeUrl` (`agent/src/exa-fetch-tool.ts`), i.e. a WHATWG
+ * `URL` serialisation, which is always printable ASCII. So a stored URL with any other character —
+ * a newline, a tab, a bidi or zero-width mark, a `←` — was not written by the producer and is
+ * refused. `new URL()` alone would NOT refuse it: the parser silently strips tabs and newlines, so
+ * the raw string would pass and reach `structuredContent` unchanged. Also refuses non-http(s) and
+ * credential-carrying URLs.
+ */
+export function safeSourceUrl(value) {
+    if (typeof value !== 'string' || !/^https?:\/\/[\x21-\x7e]+$/i.test(value))
+        return null;
+    return isSafeHttpDestination(value) ? new URL(value).href : null;
+}
+/**
+ * FUL-1225: a stored `platform` label an MCP channel may show: printable ASCII on one line (space
+ * allowed), else null. Anything else (a newline, a bidi or zero-width mark) was not a host label.
+ */
+export function safeSourcePlatform(value) {
+    return typeof value === 'string' && /^[\x20-\x7e]*$/.test(value) ? value : null;
+}
+/**
+ * FUL-534's reachability test: a non-credentialed http(s) URL the WHATWG parser accepts. Decides
+ * whether a receipt earns its GROUNDED / Cited presentation. It is deliberately NOT the display
+ * test ({@link safeSourceUrl}): tightening it would downgrade claims, which FUL-1225 must not do.
+ */
+export function isSafeHttpDestination(value) {
+    if (typeof value !== 'string' || !/^https?:\/\//i.test(value))
+        return false;
+    try {
+        const url = new URL(value);
+        return (url.protocol === 'http:' || url.protocol === 'https:') && !url.username && !url.password;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Set by the projection on a `reportEvidence` or persona-source row whose URL it blanked
+ * (`url: ''`) because the URL is unsafe to show, while the stored URL still passed
+ * {@link isSafeHttpDestination}. It means "still a receipt, link withheld".
+ */
+export const RECEIPT_URL_WITHHELD_KEY = 'urlWithheld';
+/**
+ * Set beside {@link RECEIPT_URL_WITHHELD_KEY}: the withheld URL's hostname (ASCII by WHATWG
+ * construction, and re-checked). Integrity checks that compare hosts (`sameNamedVendor`) read it,
+ * so withholding a URL for display never changes an integrity or coverage decision.
+ */
+export const RECEIPT_URL_WITHHELD_HOST_KEY = 'urlWithheldHost';
+/** The hostname the projection preserves for a withheld URL, or null. */
+export function withheldUrlHost(value) {
+    if (!isSafeHttpDestination(value))
+        return null;
+    const host = new URL(value).hostname;
+    return /^[a-z0-9.-]+$/.test(host) ? host : null;
+}
+function asRow(row) {
+    return row !== null && typeof row === 'object' && !Array.isArray(row) ? row : null;
+}
+function isWithheld(record) {
+    return record[RECEIPT_URL_WITHHELD_KEY] === true && record.url === '';
+}
+/**
+ * FUL-534 + FUL-1225: does a receipt row have a safe destination, shown or withheld? Every
+ * receipt-granting reader calls this instead of testing `row.url`, so blanking an unprintable URL
+ * never changes a claim's state or tally.
+ */
+export function receiptRowHasSafeDestination(row) {
+    const record = asRow(row);
+    if (!record)
+        return false;
+    if (isWithheld(record))
+        return true;
+    return isSafeHttpDestination(record.url);
+}
+/** The hostname behind a receipt row's URL, shown or withheld, or null. */
+export function receiptRowHostname(row) {
+    const record = asRow(row);
+    if (!record)
+        return null;
+    if (isWithheld(record)) {
+        const host = record[RECEIPT_URL_WITHHELD_HOST_KEY];
+        return typeof host === 'string' && /^[a-z0-9.-]+$/.test(host) ? host : null;
+    }
+    if (typeof record.url !== 'string')
+        return null;
+    try {
+        return new URL(record.url).hostname;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=receipt-url.js.map

package/dist/types/receipt-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"receipt-url.js","sourceRoot":"","sources":["../../src/types/receipt-url.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACvF,OAAO,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;AAClE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;AACjF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAC3E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;QAC1B,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAA;IAClG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,aAAa,CAAA;AAErD;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,iBAAiB,CAAA;AAE9D,yEAAyE;AACzE,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAC9C,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAe,CAAC,CAAC,QAAQ,CAAA;IAC9C,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;AACjD,CAAC;AAED,SAAS,KAAK,CAAC,GAAY;IACzB,OAAO,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAA8B,CAAC,CAAC,CAAC,IAAI,CAAA;AAC/G,CAAC;AAED,SAAS,UAAU,CAAC,MAA+B;IACjD,OAAO,MAAM,CAAC,wBAAwB,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,GAAG,KAAK,EAAE,CAAA;AACvE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAAC,GAAY;IACvD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAA;IACzB,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACzB,IAAI,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAA;IACnC,OAAO,qBAAqB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;AAC1C,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAA;IACzB,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,MAAM,CAAC,6BAA6B,CAAC,CAAA;QAClD,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;IAC7E,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAC/C,IAAI,CAAC;QAAC,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAA;IAAC,CAAC;AACnE,CAAC"}

package/dist/types/report.js

@@ -13,6 +13,7 @@
  */
 import { z } from 'zod';
 import { CONFIDENCE_BASES, CONFIDENCE_LEVELS, EVIDENCE_SUFFICIENCY_LEVELS, HYPOTHESIS_PRIORITIES, HYPOTHESIS_SEMANTICS_VERSION, LEGACY_HYPOTHESIS_SEMANTICS_VERSION, ROBUSTNESS_OUTCOMES, VERDICT_STATUSES, finalClauseCoverageMatchesIntegrity, hasCoherentRobustnessWorking, hypothesisWebReceiptAuthenticates, normalizeFinalHypothesisState, readRobustnessCounts, reportClaimNeedsIndependentMarketAuthority, robustnessWorkingContradictsSummary, sourceAuthenticatesMarketEconomics, } from '../hypothesis-semantics.js';
+import { RECEIPT_URL_WITHHELD_HOST_KEY, RECEIPT_URL_WITHHELD_KEY, receiptRowHasSafeDestination, safeSourcePlatform, safeSourceUrl, withheldUrlHost, } from './receipt-url.js';
 // ⚠️ A types module importing from `tools/` reads backwards, and it is deliberate.
 // `content-type-display.ts` imports NOTHING — it is the package's content-type vocabulary, which
 // happens to live beside the two renderers that were its first callers, and the FUL-341 coupling
@@ -627,6 +628,78 @@ export const ReportClaimAttestationSchema = z
     quote: z.string().describe('The captured snapshot window an independent judge attested — verbatim from OUR snapshot, no exact claim-span pinned.'),
 })
     .passthrough();
+/**
+ * FUL-1219: why an unverified source sits beside a claim. MIRROR of the agent's
+ * `UNVERIFIED_SOURCE_LABELS`; the coupling test pins the values.
+ */
+export const UNVERIFIED_SOURCE_LABELS = ['paid_market_report', 'company_own_page', 'related_source'];
+/** FUL-1219: MIRROR of the agent's `UNVERIFIED_SOURCE_REASONS` (drop reasons + relevance outcomes). */
+export const UNVERIFIED_SOURCE_REASONS = [
+    'no_snapshot',
+    'self_serving_market_source',
+    'market_source_not_independent',
+    'span_unverified',
+    'no_window',
+    'evidence_gate',
+    'unsupported_clause',
+    'relevance_partial',
+    'relevance_abstained',
+];
+/**
+ * FUL-1219: one labelled page found for a NO_RECEIPT claim that did NOT verify. Never a receipt.
+ * MIRROR of the agent's `ReportClaimUnverifiedSourceSchema`. `label` and `reason` stay strict so an
+ * unknown value is never rendered as a guess; the claim-level `.catch(undefined)` absorbs it.
+ */
+export const ReportClaimUnverifiedSourceSchema = z
+    .object({
+    sourceId: z
+        .string()
+        .describe('Pointer ("RUVS-s{n}") into `unverifiedEvidence`. NOT a receipt and never an "RRCP-" id: the page did not verify, and the claim\'s `state` is unchanged by it.'),
+    label: z
+        .enum(UNVERIFIED_SOURCE_LABELS)
+        .describe('Why the page is shown although it did not verify: paid_market_report (a report seller), company_own_page (the subject\'s own site), related_source (on-topic but does not fully support the claim).'),
+    reason: z
+        .enum(UNVERIFIED_SOURCE_REASONS)
+        .describe('The code-owned rejection behind the label (a verifier drop reason or a relevance outcome).'),
+})
+    .passthrough();
+/**
+ * FUL-1219: the `unverifiedEvidence` index an `RUVS-s{n}` id points at, or null. Anchored on
+ * `RUVS-`, so a receipt id (`RRCP-s0`) never resolves into the unverified pool. The schema types
+ * `sourceId` as any string, so every reader resolves through this, never a prefix-stripped index.
+ */
+export function parseUnverifiedSourceId(sourceId) {
+    if (typeof sourceId !== 'string')
+        return null;
+    const match = /^RUVS-s(0|[1-9]\d*)$/.exec(sourceId);
+    if (!match)
+        return null;
+    const index = Number(match[1]);
+    return Number.isSafeInteger(index) ? index : null;
+}
+/**
+ * FUL-1219: whether a report claim is model-ATTESTED — stored `NO_RECEIPT` with an attestation
+ * marker whose `sourceId` and `quote` are both non-blank strings. MIRROR of the app's
+ * `isModelAttestedClaim` (`app/lib/validation/claim-states.ts`).
+ *
+ * ⚠️ Such a claim renders `cited → RRCP-s{n} (NOT a receipt)`. An unverified-source line beside
+ * "cited" would read as support (plan stop condition (d)), so every MCP reader of
+ * `unverifiedSources` skips an attested claim, exactly as the app's `claimUnverifiedSources` does.
+ * Keyed on the marker, not on whether the attested receipt resolves: the app does the same.
+ */
+export function isModelAttestedReportClaim(claim) {
+    if (claim === null || typeof claim !== 'object' || Array.isArray(claim))
+        return false;
+    const { state, attestation } = claim;
+    if (state !== 'NO_RECEIPT' || attestation === null || typeof attestation !== 'object')
+        return false;
+    const { sourceId, quote } = attestation;
+    return typeof sourceId === 'string' && sourceId.trim().length > 0 &&
+        typeof quote === 'string' && quote.trim().length > 0;
+}
+// FUL-1219 / FUL-1225: the URL display and reachability helpers live in `receipt-url.ts` (it imports
+// nothing, so `hypothesis-semantics.ts` can read them too); re-exported for this module's callers.
+export { RECEIPT_URL_WITHHELD_HOST_KEY, RECEIPT_URL_WITHHELD_KEY, isSafeHttpDestination, receiptRowHasSafeDestination, safeSourcePlatform, safeSourceUrl, } from './receipt-url.js';
 /**
  * A single REPORT-level (market/competitor) claim. Shape mirrors {@link ClaimSchema}
  * but carries a `section` instead of a `personaId` — report claims are not attributed
@@ -657,6 +730,24 @@ export const ReportClaimSchema = z
         .optional()
         .describe('Further receipts for this same GROUNDED claim ("RRCP-s{n}" + verbatim span), each independently code-verified and judged relevant. At most 2; absent on older reports.'),
     attestation: ReportClaimAttestationSchema.optional().describe('MODEL_ATTESTED marker on a NO_RECEIPT claim (forward-prep; presence never implies grounding).'),
+    // Per entry, like the app reader: a label a newer producer adds drops only its own entry, so an
+    // older published client keeps every label it knows on that claim.
+    unverifiedSources: z
+        .array(z.unknown())
+        .transform((items) => items.flatMap((item) => {
+        const parsed = ReportClaimUnverifiedSourceSchema.safeParse(item);
+        return parsed.success ? [parsed.data] : [];
+    }))
+        .optional()
+        .catch(undefined)
+        .describe('Pages the research found for a NO_RECEIPT claim that did NOT verify, each labelled with why ("RUVS-s{n}" into unverifiedEvidence). Never receipts: they change no state and count toward no grounded number. Absent on older reports.'),
+    unverifiedSourcesOmitted: z
+        .number()
+        .int()
+        .positive()
+        .optional()
+        .catch(undefined)
+        .describe('How many further unverified sources were found beyond the three listed. Absent when none.'),
 })
     .passthrough();
 /**
@@ -698,6 +789,23 @@ export const ReportEvidenceSchema = z
     marketEconomicsAuthority: z.enum(['independent', 'commercial_report_seller', 'unknown']).optional(),
 })
     .passthrough();
+/**
+ * FUL-1219: one row of `unverifiedEvidence`, the pool "RUVS-s{n}" indexes. MIRROR of the agent's
+ * `UnverifiedEvidenceSourceSchema`, with the same lenient scalars as {@link ReportEvidenceSchema}.
+ * Deliberately a separate pool from `reportEvidence`: nothing here is a receipt. No quote, no
+ * title.
+ */
+export const UnverifiedEvidenceSchema = z
+    .object({
+    section: ReportClaimSectionSchema,
+    url: z.string().describe('The captured page URL (normalised by the producer).'),
+    platform: z.string().describe('The host the page came from.'),
+    retrievedAt: z.string().describe('ISO-8601 timestamp of when the page was captured (our run time, NOT a publication date).'),
+    contentType: z.string().optional().describe('Durable content-type stamped from the source by code; absent means unclassified.'),
+    publisherSubjectRelationship: z.enum(['independent', 'self', 'unknown']).optional(),
+    marketEconomicsAuthority: z.enum(['independent', 'commercial_report_seller', 'unknown']).optional(),
+})
+    .passthrough();
 /**
  * FUL-586's completeness confession — see the field's doc comment on
  * {@link ResearchReportDataSchema} for what it means and why it crosses to this surface.
@@ -1081,7 +1189,16 @@ export const ResearchReportDataSchema = z
     reportEvidence: z
         .array(ReportEvidenceSchema)
         .optional()
-        .describe('The reportClaims receipt pool: cached market/competitor evidence pages ("RRCP-s{n}" indexes this array) with the verbatim highlight a claim\'s span was matched against.'),
+        .describe('The reportClaims receipt pool: cached market/competitor evidence pages ("RRCP-s{n}" indexes this array) with the verbatim highlight a claim\'s span was matched against. A row with `url: ""` and `urlWithheld: true` (plus `urlWithheldHost`) is still a receipt whose stored URL was unsafe to show; its claims keep their state.'),
+    /**
+     * FUL-1219: the pool behind `reportClaims[].unverifiedSources`. Soft per row so one bad row
+     * becomes a hole and every other "RUVS-s{n}" keeps its index.
+     */
+    unverifiedEvidence: z
+        .array(UnverifiedEvidenceSchema.optional().catch(undefined))
+        .optional()
+        .catch(undefined)
+        .describe('Pages found but NOT verified ("RUVS-s{n}" indexes this array). Never receipts; kept apart from reportEvidence so no receipt pointer resolves here. Absent on older reports.'),
     /**
      * FUL-586 — what this run FAILED to deliver.
      *
@@ -1251,18 +1368,6 @@ export function projectReportDataForMcp(raw) {
     const asProjectionRecord = (value) => value !== null && typeof value === 'object' && !Array.isArray(value)
         ? value
         : null;
-    const safeProjectionUrl = (value) => {
-        if (typeof value !== 'string' || !/^https?:\/\//i.test(value))
-            return false;
-        try {
-            const url = new URL(value);
-            return (url.protocol === 'http:' || url.protocol === 'https:') &&
-                !url.username && !url.password;
-        }
-        catch {
-            return false;
-        }
-    };
     const hasProjectionVisibleContent = (value) => typeof value === 'string' &&
         value.replace(/[\p{C}\p{Z}\p{Default_Ignorable_Code_Point}]/gu, '').length > 0;
     const hasHighlights = Object.prototype.hasOwnProperty.call(record, 'interviewHighlights');
@@ -1270,6 +1375,7 @@ export function projectReportDataForMcp(raw) {
     const hasClaims = Object.prototype.hasOwnProperty.call(record, 'claims');
     const hasReportClaims = Object.prototype.hasOwnProperty.call(record, 'reportClaims');
     const hasReportEvidence = Object.prototype.hasOwnProperty.call(record, 'reportEvidence');
+    const hasUnverifiedEvidence = Object.prototype.hasOwnProperty.call(record, 'unverifiedEvidence');
     const hasReportTitle = Object.prototype.hasOwnProperty.call(record, 'reportTitle');
     const hasOverview = Object.prototype.hasOwnProperty.call(record, 'marketOverview') ||
         Object.prototype.hasOwnProperty.call(record, 'communityOverview');
@@ -1285,7 +1391,7 @@ export function projectReportDataForMcp(raw) {
         typeof methodology === 'object' &&
         !Array.isArray(methodology) &&
         Object.prototype.hasOwnProperty.call(methodology, 'redditRetrieval');
-    if (!hasHighlights && !hasRedditNote && !hasHypothesisResults && !hasClaims && !hasReportClaims && !hasReportEvidence && !hasOverview && !hasReportTitle && !hasCrossCutting && !hasPersonas && !hasForumResearch && !hasHypothesisSemanticsVersion && !hasDecisionSpineMetadata)
+    if (!hasHighlights && !hasRedditNote && !hasHypothesisResults && !hasClaims && !hasReportClaims && !hasReportEvidence && !hasUnverifiedEvidence && !hasOverview && !hasReportTitle && !hasCrossCutting && !hasPersonas && !hasForumResearch && !hasHypothesisSemanticsVersion && !hasDecisionSpineMetadata)
         return raw;
     const projected = { ...record };
     // These fields authenticate producer-owned repair, but are not report evidence and never cross
@@ -1314,6 +1420,27 @@ export function projectReportDataForMcp(raw) {
         if (!source)
             return rawSource;
         const next = { ...source };
+        // FUL-1225: a URL the display check refuses is blanked, with the host-derived `platform`, so
+        // no channel carries it. The row itself stays, so every RRCP-s{n} / RCP-p{i}-s{j} keeps its
+        // index, and the markers keep FUL-534's reachability answer and the hostname for every
+        // receipt-granting or host-comparing reader (`receiptRowHasSafeDestination`,
+        // `receiptRowHostname`): no claim or integrity decision changes. Stored markers are untrusted.
+        delete next[RECEIPT_URL_WITHHELD_KEY];
+        delete next[RECEIPT_URL_WITHHELD_HOST_KEY];
+        if (Object.prototype.hasOwnProperty.call(source, 'url') && source.url !== '' && !safeSourceUrl(source.url)) {
+            next.url = '';
+            if (Object.prototype.hasOwnProperty.call(source, 'platform'))
+                next.platform = '';
+            const host = withheldUrlHost(source.url);
+            if (host !== null) {
+                next[RECEIPT_URL_WITHHELD_KEY] = true;
+                next[RECEIPT_URL_WITHHELD_HOST_KEY] = host;
+            }
+        }
+        else if (Object.prototype.hasOwnProperty.call(source, 'platform') && safeSourcePlatform(source.platform) === null) {
+            // A platform label that is not printable ASCII on one line reaches no channel either.
+            next.platform = '';
+        }
         if (Object.prototype.hasOwnProperty.call(source, 'quote')) {
             if (typeof source.quote === 'string' && !isDisplaySuitableExcerpt(source.quote)) {
                 // `undefined` is absent on the JSON wire but remains distinguishable from a historical
@@ -1413,6 +1540,14 @@ export function projectReportDataForMcp(raw) {
                     if (!thread)
                         return rawThread;
                     const nextThread = { ...thread };
+                    // FUL-1225: a thread URL is display-only (every forum receipt renders from its cached
+                    // excerpt without one), so an unsafe one is simply dropped.
+                    if (Object.prototype.hasOwnProperty.call(thread, 'url') && thread.url !== '' && !safeSourceUrl(thread.url)) {
+                        delete nextThread.url;
+                    }
+                    if (Object.prototype.hasOwnProperty.call(thread, 'platform') && safeSourcePlatform(thread.platform) === null) {
+                        delete nextThread.platform;
+                    }
                     if (Array.isArray(thread.relevantQuotes)) {
                         nextThread.relevantQuotes = thread.relevantQuotes.filter(isDisplaySuitableExcerpt);
                     }
@@ -1471,6 +1606,66 @@ export function projectReportDataForMcp(raw) {
         delete next.attestation;
         return next;
     };
+    // FUL-1219: an unverified-evidence row whose URL is not a plain, credential-free, printable-ASCII
+    // http(s) URL becomes a hole, so no channel carries it and every other RUVS-s{n} keeps its index. A
+    // kept row carries only its declared keys: the pool is text-free by contract, and anything else is
+    // untrusted JSON.
+    const unverifiedEvidence = Array.isArray(record.unverifiedEvidence)
+        ? record.unverifiedEvidence.map((rawRow) => {
+            const row = asProjectionRecord(rawRow);
+            if (!row || !safeSourceUrl(row.url))
+                return undefined;
+            return Object.fromEntries(Object.keys(UnverifiedEvidenceSchema.shape).filter((key) => key in row).map((key) => [key, key === 'platform' ? safeSourcePlatform(row[key]) ?? '' : row[key]]));
+        })
+        : [];
+    if (hasUnverifiedEvidence) {
+        projected.unverifiedEvidence = Array.isArray(record.unverifiedEvidence) ? unverifiedEvidence : undefined;
+    }
+    // FUL-1219: unverified sources belong only to a plain (non-attested) NO_RECEIPT claim, and each
+    // entry must resolve through the anchored RUVS parser to a surviving pool row of the claim's own
+    // section; a URL already kept for the claim is dropped (parity with the app's
+    // `claimUnverifiedSources`). Only the three entry fields are copied: other keys are untrusted JSON
+    // (FUL-1067). The omitted count survives only beside a kept entry: a bare "+N more" would point at
+    // nothing. The attestation marker is read on the STORED claim as well, because the projection
+    // above may have dropped an unsuitable attestation: the app still badges that claim "Cited".
+    const projectUnverifiedSources = (value, storedClaim) => {
+        const claim = asProjectionRecord(value);
+        if (!claim)
+            return value;
+        const hasEntries = Object.prototype.hasOwnProperty.call(claim, 'unverifiedSources');
+        const hasOmitted = Object.prototype.hasOwnProperty.call(claim, 'unverifiedSourcesOmitted');
+        if (!hasEntries && !hasOmitted)
+            return claim;
+        const next = { ...claim };
+        delete next.unverifiedSources;
+        delete next.unverifiedSourcesOmitted;
+        if (claim.state !== 'NO_RECEIPT')
+            return next;
+        if (isModelAttestedReportClaim(claim) || isModelAttestedReportClaim(storedClaim))
+            return next;
+        const seen = new Set();
+        const kept = (Array.isArray(claim.unverifiedSources) ? claim.unverifiedSources : []).flatMap((raw) => {
+            const entry = asProjectionRecord(raw);
+            const index = parseUnverifiedSourceId(entry?.sourceId);
+            const parsed = ReportClaimUnverifiedSourceSchema.safeParse(entry);
+            const row = index === null ? undefined : unverifiedEvidence[index];
+            if (!parsed.success || !row || row.section !== claim.section)
+                return [];
+            const href = safeSourceUrl(row.url);
+            if (!href || seen.has(href))
+                return [];
+            seen.add(href);
+            return [{ sourceId: parsed.data.sourceId, label: parsed.data.label, reason: parsed.data.reason }];
+        });
+        if (kept.length === 0)
+            return next;
+        next.unverifiedSources = kept;
+        const omitted = claim.unverifiedSourcesOmitted;
+        if (typeof omitted === 'number' && Number.isSafeInteger(omitted) && omitted > 0) {
+            next.unverifiedSourcesOmitted = omitted;
+        }
+        return next;
+    };
     if (hasReportClaims) {
         projected.reportClaims = Array.isArray(record.reportClaims)
             ? record.reportClaims.map((rawClaim) => {
@@ -1536,7 +1731,7 @@ export function projectReportDataForMcp(raw) {
                     return next;
                 }
                 return { ...claim };
-            })
+            }).map((claim, index) => projectUnverifiedSources(claim, record.reportClaims[index]))
             : [];
     }
     if (Object.prototype.hasOwnProperty.call(record, 'claims')) {
@@ -1700,7 +1895,7 @@ export function projectReportDataForMcp(raw) {
                     ? projected.reportEvidence[Number(match[1])]
                     : undefined);
                 return Boolean(source &&
-                    safeProjectionUrl(source.url) &&
+                    receiptRowHasSafeDestination(source) &&
                     (!Object.prototype.hasOwnProperty.call(source, 'quote') ||
                         isDisplaySuitableExcerpt(source.quote)) &&
                     (source.section === 'market' || source.section === 'competitor' || source.section === 'summary'));