@frihet/mcp-server 1.16.3 → 1.16.5

package/dist/__tests__/mutation-unwrap-and-schema-regression.test.js

@@ -1,164 +0,0 @@
-/**
- * Regression tests for the "invoices INOPERABLE via MCP" bug set (LANE B1).
- *
- * Two independent bugs made every WRITE path fail MCP output validation while
- * reads (fixed in #64) worked:
- *
- *   BUG-1 (envelope leak on mutations): create/update/action client methods
- *     called `this.request(...)` (RAW) instead of `this.requestUnwrapped(...)`.
- *     The live Frihet `/v1` API wraps EVERY mutation in `{ data, meta }`
- *     (publicApi.ts: 201/PUT/PATCH → `{ data: <resource>, meta }`; action POSTs
- *     → `actionResponse = { data: actionResult, meta }`). The raw envelope went
- *     straight into `structuredContent`, so `id`/`clientName`/`items`/`success`
- *     all read as `undefined` and the tool's outputSchema rejected the call.
- *
- *   BUG-2 (output schemas too strict): list/search item schemas required fields
- *     that `fields=` projections and drafts legitimately omit (`GET
- *     /invoices?fields=id,total` → `{ id }`-shaped rows), and `actionResultOutput`
- *     required `success`+`id` that action endpoints never return in full.
- *
- * Part A boots a `node:http` mock backend that mimics the LIVE mutation envelope
- * and drives a REAL `FrihetClient` (same pattern as
- * get-envelope-unwrap-regression.test.ts) — it would fail before the BUG-1 fix.
- * Part B pins the relaxed schemas against the real projected/draft/action shapes
- * — it would fail before the BUG-2 fix. The final guard asserts the schemas are
- * still strict enough to REJECT a raw envelope, so removing the unwrap regresses.
- *
- * Run: npm test (after build)
- */
-import { test, describe, before, after } from "node:test";
-import assert from "node:assert/strict";
-import { createServer } from "node:http";
-import { FrihetClient } from "../client.js";
-import { invoiceItemOutput, paginatedOutput, actionResultOutput, creditNoteResultOutput, } from "../tools/shared.js";
-// ── Mock ERP backend: every mutation wraps its result in { data, meta } ──
-let server;
-let baseUrl;
-function envelope(data, meta = { requestId: "test" }) {
-    return { data, meta };
-}
-const FULL_INVOICE = {
-    id: "inv_new",
-    clientName: "Acme Corp",
-    items: [{ description: "Consulting", quantity: 1, unitPrice: 100 }],
-    status: "draft",
-    taxRate: 21,
-};
-const FULL_CLIENT = { id: "cli_new", name: "Acme Corp", email: "billing@acme.example" };
-async function readBody(req) {
-    return new Promise((resolve) => {
-        req.on("data", () => { });
-        req.on("end", () => resolve());
-    });
-}
-before(async () => {
-    server = createServer(async (req, res) => {
-        await readBody(req);
-        const url = new URL(req.url ?? "/", "http://localhost");
-        res.setHeader("Content-Type", "application/json");
-        const send = (status, body) => {
-            res.statusCode = status;
-            res.end(JSON.stringify(body));
-        };
-        // create invoice (201) — main-resource envelope
-        if (url.pathname === "/invoices" && req.method === "POST") {
-            return send(201, envelope(FULL_INVOICE));
-        }
-        // update invoice (PATCH) — main-resource envelope
-        if (url.pathname === "/invoices/inv_new" && req.method === "PATCH") {
-            return send(200, envelope({ ...FULL_INVOICE, status: "sent" }));
-        }
-        // mark paid (POST action, 200) — action envelope, NO id, has success/status/paidAt
-        if (url.pathname === "/invoices/inv_new/paid" && req.method === "POST") {
-            return send(200, envelope({ success: true, status: "paid", paidAt: "2026-07-10" }));
-        }
-        // credit note (POST action) — action envelope with { success, creditNote }
-        if (url.pathname === "/invoices/inv_new/credit-note" && req.method === "POST") {
-            return send(201, envelope({
-                success: true,
-                creditNote: { id: "cn_1", documentNumber: "CN-FRI-0001", originalInvoiceId: "inv_new", reason: "error", fullCredit: true },
-            }));
-        }
-        // create client (201) — sibling-resource envelope (proves the fix is systemic)
-        if (url.pathname === "/clients" && req.method === "POST") {
-            return send(201, envelope(FULL_CLIENT));
-        }
-        res.statusCode = 404;
-        return send(404, { error: "not_found" });
-    });
-    await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
-    const { port } = server.address();
-    baseUrl = `http://127.0.0.1:${port}`;
-});
-after(async () => {
-    await new Promise((resolve) => server.close(() => resolve()));
-});
-function makeClient() {
-    return new FrihetClient("fri_test_key", baseUrl);
-}
-function assertNoEnvelopeLeak(result) {
-    assert.equal(typeof result, "object");
-    assert.ok(result !== null);
-    assert.equal("data" in result, false, "envelope 'data' key must NOT leak into the mutation result");
-    assert.equal("meta" in result, false, "envelope 'meta' key must NOT leak into the mutation result");
-}
-describe("BUG-1 — mutation client methods unwrap the { data, meta } envelope", () => {
-    test("createInvoice unwraps + validates against invoiceItemOutput", async () => {
-        const result = await makeClient().createInvoice(FULL_INVOICE);
-        assertNoEnvelopeLeak(result);
-        assert.equal(result.id, "inv_new");
-        assert.equal(invoiceItemOutput.safeParse(result).success, true);
-    });
-    test("updateInvoice unwraps the envelope", async () => {
-        const result = await makeClient().updateInvoice("inv_new", { status: "sent" });
-        assertNoEnvelopeLeak(result);
-        assert.equal(result.status, "sent");
-    });
-    test("markInvoicePaid unwraps to the action result (success/status/paidAt)", async () => {
-        const result = await makeClient().markInvoicePaid("inv_new");
-        assertNoEnvelopeLeak(result);
-        assert.equal(result.success, true);
-        assert.equal(actionResultOutput.safeParse(result).success, true);
-    });
-    test("createCreditNote unwraps to { success, creditNote }", async () => {
-        const result = await makeClient().createCreditNote("inv_new", { reason: "error" });
-        assertNoEnvelopeLeak(result);
-        assert.equal(creditNoteResultOutput.safeParse(result).success, true);
-    });
-    test("createClient unwraps — the fix is systemic across resources", async () => {
-        const result = await makeClient().createClient(FULL_CLIENT);
-        assertNoEnvelopeLeak(result);
-        assert.equal(result.id, "cli_new");
-    });
-});
-describe("BUG-2 — output schemas tolerate projections, drafts, and action shapes", () => {
-    const listOf = (rows) => ({ data: rows, total: rows.length, limit: 20, offset: 0 });
-    test("list schema accepts a fields=id,total projection ({ id } / { id,total } rows)", () => {
-        const schema = paginatedOutput(invoiceItemOutput);
-        assert.equal(schema.safeParse(listOf([{ id: "e2e-invoice-4" }])).success, true);
-        assert.equal(schema.safeParse(listOf([{ id: "a", total: 5 }, { id: "b" }])).success, true);
-    });
-    test("invoiceItemOutput accepts a draft (no items) and a null clientName", () => {
-        assert.equal(invoiceItemOutput.safeParse({ id: "inv_draft" }).success, true);
-        assert.equal(invoiceItemOutput.safeParse({ id: "inv_draft", clientName: null }).success, true);
-    });
-    test("actionResultOutput accepts the already-paid shape ({ message, status }) and the happy path", () => {
-        assert.equal(actionResultOutput.safeParse({ message: "Invoice already marked as paid", status: "paid" }).success, true);
-        assert.equal(actionResultOutput.safeParse({ success: true, status: "paid", paidAt: "2026-07-10" }).success, true);
-    });
-    test("creditNoteResultOutput accepts the { success, creditNote } action shape", () => {
-        assert.equal(creditNoteResultOutput.safeParse({
-            success: true,
-            creditNote: { id: "cn_1", documentNumber: "CN-1" },
-        }).success, true);
-    });
-    test("GUARD: invoiceItemOutput still REJECTS a raw { data, meta } envelope (id stays required)", () => {
-        // `id` stays required precisely so create/update/get can't silently surface
-        // the envelope if a future edit drops requestUnwrapped — the envelope has no
-        // top-level `id`. actionResultOutput is deliberately permissive (all fields
-        // optional so already-paid `{ message, status }` validates), so for ACTION
-        // paths the unwrap pinned in Part A — not the schema — is the envelope guard.
-        assert.equal(invoiceItemOutput.safeParse({ data: FULL_INVOICE, meta: {} }).success, false);
-    });
-});
-//# sourceMappingURL=mutation-unwrap-and-schema-regression.test.js.map

package/dist/__tests__/mutation-unwrap-and-schema-regression.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"mutation-unwrap-and-schema-regression.test.js","sourceRoot":"","sources":["../../src/__tests__/mutation-unwrap-and-schema-regression.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,YAAY,EAAe,MAAM,WAAW,CAAC;AAGtD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAE5B,4EAA4E;AAE5E,IAAI,MAAc,CAAC;AACnB,IAAI,OAAe,CAAC;AAEpB,SAAS,QAAQ,CAAC,IAAa,EAAE,OAAgC,EAAE,SAAS,EAAE,MAAM,EAAE;IACpF,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,YAAY,GAAG;IACnB,EAAE,EAAE,SAAS;IACb,UAAU,EAAE,WAAW;IACvB,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;IACnE,MAAM,EAAE,OAAO;IACf,OAAO,EAAE,EAAE;CACZ,CAAC;AACF,MAAM,WAAW,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;AAExF,KAAK,UAAU,QAAQ,CAAC,GAAwC;IAC9D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACzB,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,IAAI,EAAE;IAChB,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACvC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QACpB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACxD,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,IAAa,EAAE,EAAE;YAC7C,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC;YACxB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAChC,CAAC,CAAC;QAEF,gDAAgD;QAChD,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1D,OAAO,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;QAC3C,CAAC;QACD,kDAAkD;QAClD,IAAI,GAAG,CAAC,QAAQ,KAAK,mBAAmB,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YACnE,OAAO,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,GAAG,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAClE,CAAC;QACD,mFAAmF;QACnF,IAAI,GAAG,CAAC,QAAQ,KAAK,wBAAwB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACvE,OAAO,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;QACtF,CAAC;QACD,2EAA2E;QAC3E,IAAI,GAAG,CAAC,QAAQ,KAAK,+BAA+B,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC9E,OAAO,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC;gBACxB,OAAO,EAAE,IAAI;gBACb,UAAU,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE;aAC3H,CAAC,CAAC,CAAC;QACN,CAAC;QACD,+EAA+E;QAC/E,IAAI,GAAG,CAAC,QAAQ,KAAK,UAAU,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACzD,OAAO,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;QAC1C,CAAC;QACD,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;QACrB,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7E,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAC;IACjD,OAAO,GAAG,oBAAoB,IAAI,EAAE,CAAC;AACvC,CAAC,CAAC,CAAC;AAEH,KAAK,CAAC,KAAK,IAAI,EAAE;IACf,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AACtE,CAAC,CAAC,CAAC;AAEH,SAAS,UAAU;IACjB,OAAO,IAAI,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAe;IAC3C,MAAM,CAAC,KAAK,CAAC,OAAO,MAAM,EAAE,QAAQ,CAAC,CAAC;IACtC,MAAM,CAAC,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;IAC3B,MAAM,CAAC,KAAK,CAAC,MAAM,IAAK,MAAiB,EAAE,KAAK,EAAE,4DAA4D,CAAC,CAAC;IAChH,MAAM,CAAC,KAAK,CAAC,MAAM,IAAK,MAAiB,EAAE,KAAK,EAAE,4DAA4D,CAAC,CAAC;AAClH,CAAC;AAED,QAAQ,CAAC,oEAAoE,EAAE,GAAG,EAAE;IAClF,IAAI,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAC9D,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,KAAK,CAAE,MAAyB,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QACvD,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/E,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,KAAK,CAAE,MAA6B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACtF,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QAC7D,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,KAAK,CAAE,MAA+B,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC7D,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC,gBAAgB,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACnF,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QAC5D,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,KAAK,CAAE,MAAyB,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,wEAAwE,EAAE,GAAG,EAAE;IACtF,MAAM,MAAM,GAAG,CAAC,IAAe,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IAE/F,IAAI,CAAC,+EAA+E,EAAE,GAAG,EAAE;QACzF,MAAM,MAAM,GAAG,eAAe,CAAC,iBAAiB,CAAC,CAAC;QAClD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAChF,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC7F,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC9E,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC7E,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACjG,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,4FAA4F,EAAE,GAAG,EAAE;QACtG,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,gCAAgC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACxH,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACpH,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,yEAAyE,EAAE,GAAG,EAAE;QACnF,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,SAAS,CAAC;YAC5C,OAAO,EAAE,IAAI;YACb,UAAU,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE;SACnD,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,0FAA0F,EAAE,GAAG,EAAE;QACpG,4EAA4E;QAC5E,6EAA6E;QAC7E,4EAA4E;QAC5E,2EAA2E;QAC3E,8EAA8E;QAC9E,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC7F,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/observability-redaction.test.d.ts

@@ -1,13 +0,0 @@
-/**
- * Trust test — no government ID, credential, or banking identifier may ever
- * reach the external Langfuse observability service.
- *
- * Regression guard for the P0 finding (Codex audit 2026-06-22): the Langfuse
- * tracer captured the RAW tool output BEFORE the OpenAI profile redaction
- * wrapper ran, so taxId/secret/IBAN leaked into traces in every profile mode.
- * The fix moved redaction INTO buildTracePayload, so the trace copy is redacted
- * unconditionally. This test fails if any sensitive value survives into the
- * serialized ingestion batch.
- */
-export {};
-//# sourceMappingURL=observability-redaction.test.d.ts.map

package/dist/__tests__/observability-redaction.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"observability-redaction.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/observability-redaction.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG"}

package/dist/__tests__/observability-redaction.test.js

@@ -1,94 +0,0 @@
-/**
- * Trust test — no government ID, credential, or banking identifier may ever
- * reach the external Langfuse observability service.
- *
- * Regression guard for the P0 finding (Codex audit 2026-06-22): the Langfuse
- * tracer captured the RAW tool output BEFORE the OpenAI profile redaction
- * wrapper ran, so taxId/secret/IBAN leaked into traces in every profile mode.
- * The fix moved redaction INTO buildTracePayload, so the trace copy is redacted
- * unconditionally. This test fails if any sensitive value survives into the
- * serialized ingestion batch.
- */
-import { describe, test } from "node:test";
-import assert from "node:assert/strict";
-import { buildTracePayload } from "../observability.js";
-import { redactClone, SENSITIVE_FIELD_NAMES } from "../redaction.js";
-const SECRETS = {
-    taxId: "B12345678",
-    nif: "12345678Z",
-    secret: "whsec_live_DEADBEEFCAFE",
-    iban: "ES9121000418450200051332",
-    passport: "PAX9988776",
-    apiKey: "fri_live_TOPSECRET",
-    accessToken: "ya29.A0ARrdaM-TOKEN",
-    password: "hunter2",
-};
-const SECRET_VALUES = Object.values(SECRETS);
-/** A realistic MCP tool result: structuredContent + a serialized JSON text block. */
-function mcpResultWithSecrets() {
-    return {
-        content: [{ type: "text", text: JSON.stringify({ id: "cli_1", ...SECRETS }) }],
-        structuredContent: {
-            client: { id: "cli_1", name: "Acme", ...SECRETS },
-            webhooks: [{ id: "wh_1", url: "https://x.test", secret: SECRETS.secret }],
-        },
-    };
-}
-function assertNoSecrets(serialized) {
-    for (const v of SECRET_VALUES) {
-        assert.ok(!serialized.includes(v), `sensitive value leaked into trace payload: ${v}`);
-    }
-}
-describe("observability redaction", () => {
-    test("buildTracePayload strips PII/credentials from output (success path)", () => {
-        const now = new Date("2026-06-22T10:00:00.000Z");
-        const batch = buildTracePayload({
-            toolName: "get_client",
-            input: { id: "cli_1", taxId: SECRETS.taxId },
-            output: mcpResultWithSecrets(),
-            isError: false,
-            startTime: now,
-            endTime: now,
-            traceId: "trace_1",
-            spanId: "span_1",
-            stub: null,
-        });
-        assertNoSecrets(JSON.stringify(batch));
-    });
-    test("buildTracePayload strips PII from input args even on the error path", () => {
-        const now = new Date("2026-06-22T10:00:00.000Z");
-        const batch = buildTracePayload({
-            toolName: "create_client",
-            input: { name: "Acme", ...SECRETS },
-            output: undefined,
-            isError: true,
-            // an error message that echoes the request body must not leak either
-            errorMessage: `Backend rejected payload: {"taxId":"${SECRETS.taxId}","secret":"${SECRETS.secret}"}`,
-            startTime: now,
-            endTime: now,
-            traceId: "trace_2",
-            spanId: "span_2",
-            stub: null,
-        });
-        assertNoSecrets(JSON.stringify(batch));
-    });
-    test("redactClone never mutates its argument", () => {
-        const original = mcpResultWithSecrets();
-        const before = JSON.stringify(original);
-        redactClone(original);
-        assert.equal(JSON.stringify(original), before, "redactClone must not mutate input");
-    });
-    test("redactClone preserves non-sensitive fields", () => {
-        const cloned = redactClone({ id: "cli_1", name: "Acme", total: 100, taxId: SECRETS.taxId });
-        assert.equal(cloned.id, "cli_1");
-        assert.equal(cloned.name, "Acme");
-        assert.equal(cloned.total, 100);
-        assert.notEqual(cloned.taxId, SECRETS.taxId);
-    });
-    test("the sensitive field set covers the critical Trust fields", () => {
-        for (const f of ["taxId", "secret", "iban", "apiKey", "accessToken", "password"]) {
-            assert.ok(SENSITIVE_FIELD_NAMES.includes(f), `missing critical sensitive field: ${f}`);
-        }
-    });
-});
-//# sourceMappingURL=observability-redaction.test.js.map

package/dist/__tests__/observability-redaction.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"observability-redaction.test.js","sourceRoot":"","sources":["../../src/__tests__/observability-redaction.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,MAAM,MAAM,oBAAoB,CAAC;AAExC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAErE,MAAM,OAAO,GAAG;IACd,KAAK,EAAE,WAAW;IAClB,GAAG,EAAE,WAAW;IAChB,MAAM,EAAE,yBAAyB;IACjC,IAAI,EAAE,0BAA0B;IAChC,QAAQ,EAAE,YAAY;IACtB,MAAM,EAAE,oBAAoB;IAC5B,WAAW,EAAE,qBAAqB;IAClC,QAAQ,EAAE,SAAS;CACpB,CAAC;AACF,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAE7C,qFAAqF;AACrF,SAAS,oBAAoB;IAC3B,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC,EAAE,CAAC;QAC9E,iBAAiB,EAAE;YACjB,MAAM,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE;YACjD,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,gBAAgB,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;SAC1E;KACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,UAAkB;IACzC,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QAC9B,MAAM,CAAC,EAAE,CACP,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,EACvB,8CAA8C,CAAC,EAAE,CAClD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,IAAI,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC/E,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,iBAAiB,CAAC;YAC9B,QAAQ,EAAE,YAAY;YACtB,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE;YAC5C,MAAM,EAAE,oBAAoB,EAAE;YAC9B,OAAO,EAAE,KAAK;YACd,SAAS,EAAE,GAAG;YACd,OAAO,EAAE,GAAG;YACZ,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;QACH,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC/E,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,iBAAiB,CAAC;YAC9B,QAAQ,EAAE,eAAe;YACzB,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE;YACnC,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,IAAI;YACb,qEAAqE;YACrE,YAAY,EAAE,uCAAuC,OAAO,CAAC,KAAK,eAAe,OAAO,CAAC,MAAM,IAAI;YACnG,SAAS,EAAE,GAAG;YACd,OAAO,EAAE,GAAG;YACZ,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;QACH,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAClD,MAAM,QAAQ,GAAG,oBAAoB,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACxC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACtB,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,mCAAmC,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACtD,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAA4B,CAAC;QACvH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACjC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAClC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAChC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,0DAA0D,EAAE,GAAG,EAAE;QACpE,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,CAAC,EAAE,CAAC;YACjF,MAAM,CAAC,EAAE,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,qCAAqC,CAAC,EAAE,CAAC,CAAC;QACzF,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/openai-grouped-compose.test.d.ts

@@ -1,26 +0,0 @@
-/**
- * Tests for the OpenAI × grouped tool-exposure COMPOSITION.
- *
- * openai-mcp.frihet.io now runs BOTH profiles: the OpenAI-safe profile
- * (53 reviewed tools, redaction, openWorldHint justification) AND the grouped
- * progressive-disclosure profile (terse descriptions + 3 discovery meta-tools).
- *
- * This is the Trust-Area-critical surface that the ChatGPT app review covers, so
- * the three invariants below are asserted explicitly:
- *
- *   (1) The 3 grouped meta-tools (search_tools, describe_tool, list_tool_groups)
- *       are PRESENT in OpenAI mode — they register against the real server and
- *       bypass the OpenAI allow-list gate. Live surface = 53 + 3 = 56 tools.
- *   (2) Every one of the 53 reviewed tools has a COLLAPSED (terse) description
- *       AND still carries the per-tool openWorldHint rationale marker that OpenAI
- *       app review requires.
- *   (3) The grouped catalog (what search_tools / describe_tool / list_tool_groups
- *       surface) contains ONLY the 53 reviewed tools — a tool outside the reviewed
- *       set is never returned by search_tools and is rejected by describe_tool.
- *
- * Composition order under test mirrors the worker/stdio init wiring:
- *   applyToolExposureProfile(server, { allowlist }) FIRST (innermost),
- *   applyOpenAIProfile(server) SECOND (outermost).
- */
-export {};
-//# sourceMappingURL=openai-grouped-compose.test.d.ts.map

package/dist/__tests__/openai-grouped-compose.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"openai-grouped-compose.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/openai-grouped-compose.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG"}

package/dist/__tests__/openai-grouped-compose.test.js

@@ -1,245 +0,0 @@
-/**
- * Tests for the OpenAI × grouped tool-exposure COMPOSITION.
- *
- * openai-mcp.frihet.io now runs BOTH profiles: the OpenAI-safe profile
- * (53 reviewed tools, redaction, openWorldHint justification) AND the grouped
- * progressive-disclosure profile (terse descriptions + 3 discovery meta-tools).
- *
- * This is the Trust-Area-critical surface that the ChatGPT app review covers, so
- * the three invariants below are asserted explicitly:
- *
- *   (1) The 3 grouped meta-tools (search_tools, describe_tool, list_tool_groups)
- *       are PRESENT in OpenAI mode — they register against the real server and
- *       bypass the OpenAI allow-list gate. Live surface = 53 + 3 = 56 tools.
- *   (2) Every one of the 53 reviewed tools has a COLLAPSED (terse) description
- *       AND still carries the per-tool openWorldHint rationale marker that OpenAI
- *       app review requires.
- *   (3) The grouped catalog (what search_tools / describe_tool / list_tool_groups
- *       surface) contains ONLY the 53 reviewed tools — a tool outside the reviewed
- *       set is never returned by search_tools and is rejected by describe_tool.
- *
- * Composition order under test mirrors the worker/stdio init wiring:
- *   applyToolExposureProfile(server, { allowlist }) FIRST (innermost),
- *   applyOpenAIProfile(server) SECOND (outermost).
- */
-import { describe, test } from "node:test";
-import assert from "node:assert/strict";
-import { applyOpenAIProfile, OPENAI_REVIEWED_TOOL_ALLOWLIST, OPENAI_ALLOWED_TOOL_COUNT, } from "../openai-profile.js";
-import { applyToolExposureProfile, GROUPED_META_TOOL_COUNT } from "../tool-exposure.js";
-import { registerAllTools } from "../tools/register-all.js";
-import { registerAllPrompts } from "../prompts/register-all.js";
-import { registerAllResources } from "../resources/register-all.js";
-class StubMcpServer {
-    tools = new Map();
-    prompts = [];
-    resources = [];
-    registerTool(name, config, handler) {
-        this.tools.set(name, { name, config, handler });
-    }
-    registerPrompt(name) {
-        this.prompts.push(name);
-    }
-    registerResource(name) {
-        this.resources.push(name);
-    }
-}
-/** Client that returns a payload carrying sensitive fields (to test redaction). */
-function makeClient() {
-    return new Proxy({}, {
-        get: (_target, prop) => async (input) => {
-            if (prop === "createClient") {
-                return {
-                    id: "cli_compose",
-                    name: "Compose Test Corp",
-                    email: "test@example.com",
-                    taxId: "B12345678",
-                    secret: "should-not-leak",
-                };
-            }
-            return { data: [], total: 0, limit: 10, offset: 0, input };
-        },
-    });
-}
-const asMcp = (s) => s;
-/**
- * Build a server with BOTH profiles composed in the production order:
- * grouped (allow-list) first, OpenAI second.
- */
-function makeComposedServer() {
-    const server = new StubMcpServer();
-    // 1. grouped FIRST (innermost) — meta-tools bypass the OpenAI gate; catalog
-    //    pinned to the reviewed allow-list.
-    applyToolExposureProfile(asMcp(server), {
-        allowlist: OPENAI_REVIEWED_TOOL_ALLOWLIST,
-    });
-    // 2. OpenAI SECOND (outermost) — gate/redact/annotate, then collapse.
-    applyOpenAIProfile(asMcp(server));
-    registerAllTools(asMcp(server), makeClient());
-    registerAllResources(asMcp(server));
-    registerAllPrompts(asMcp(server));
-    return server;
-}
-const META_TOOLS = ["list_tool_groups", "search_tools", "describe_tool"];
-/** Tools that exist on the full server but must NEVER surface in the composed one. */
-const NON_REVIEWED_TOOLS = [
-    "get_quarterly_taxes",
-    "get_invoice_einvoice",
-    "send_einvoice",
-    "validate_einvoice_xml",
-    "create_reservation",
-    "payroll_export",
-    "invite_team_member",
-    "get_modelo_303_summary",
-];
-describe("openai × grouped composition: invariant (1) — meta-tools present, 53+3 surface", () => {
-    test("registers exactly 53 reviewed tools + 3 meta-tools (56 total)", () => {
-        const server = makeComposedServer();
-        assert.equal(GROUPED_META_TOOL_COUNT, 3);
-        assert.equal(OPENAI_ALLOWED_TOOL_COUNT, 53, "advertised reviewed count stays 53");
-        assert.equal(server.tools.size, OPENAI_ALLOWED_TOOL_COUNT + GROUPED_META_TOOL_COUNT, "live surface must be the 53 reviewed tools + 3 meta-tools");
-        assert.equal(server.tools.size, 56);
-        // Prompts still hidden in OpenAI mode.
-        assert.equal(server.prompts.length, 0);
-        // Resources are hidden too: full-server static fiscal/compliance resources
-        // are outside the reviewed ChatGPT app surface.
-        assert.equal(server.resources.length, 0);
-    });
-    test("all 3 discovery meta-tools materialise by name despite the OpenAI allow-list", () => {
-        const server = makeComposedServer();
-        for (const meta of META_TOOLS) {
-            assert.equal(server.tools.has(meta), true, `${meta} must survive OpenAI filtering in the composed surface`);
-        }
-    });
-    test("non-reviewed tools are dropped entirely (defence: openai gate)", () => {
-        const server = makeComposedServer();
-        for (const name of NON_REVIEWED_TOOLS) {
-            assert.equal(server.tools.has(name), false, `${name} must NOT be exposed in the composed OpenAI surface`);
-        }
-    });
-    test("meta-tools are read-only, closed-world catalog lookups (NOT openWorldHint)", () => {
-        const server = makeComposedServer();
-        for (const meta of META_TOOLS) {
-            const ann = server.tools.get(meta).config.annotations;
-            assert.equal(ann?.readOnlyHint, true, `${meta} must be read-only`);
-            assert.equal(ann?.openWorldHint, false, `${meta} must be closed-world`);
-            // Their descriptions carry an explicit closed-world rationale already (so
-            // the OpenAI rationale-injector does not double-append).
-            assert.match(server.tools.get(meta).config.description, /openWorldHint: false/, `${meta} description must state the closed-world rationale`);
-        }
-    });
-});
-describe("openai × grouped composition: invariant (2) — collapsed + openWorldHint on all 53", () => {
-    test("every reviewed tool is collapsed AND carries an openWorldHint rationale", () => {
-        const server = makeComposedServer();
-        let reviewedCount = 0;
-        for (const [name, tool] of server.tools) {
-            if (META_TOOLS.includes(name))
-                continue;
-            reviewedCount += 1;
-            const desc = tool.config.description;
-            // Collapsed: terse "[group] summary — full schema via describe_tool('name')."
-            assert.match(desc, /^\[[a-z]+\] /, `${name} description must start with the [group] collapsed prefix`);
-            assert.ok(desc.includes(`describe_tool('${name}')`), `${name} description must point to describe_tool`);
-            // Terse: collapsed line is short, NOT a multi-paragraph bilingual blob.
-            assert.ok(desc.length < 400, `${name} description must be collapsed (terse), got length ${desc.length}`);
-            // openWorldHint rationale marker survives the collapse.
-            assert.ok(desc.includes("openWorldHint"), `${name} collapsed description must still carry an openWorldHint rationale`);
-            // Annotation must be an explicit boolean (never null) per OpenAI review.
-            assert.equal(typeof tool.config.annotations?.["openWorldHint"], "boolean", `${name} must have an explicit boolean openWorldHint annotation`);
-        }
-        assert.equal(reviewedCount, OPENAI_ALLOWED_TOOL_COUNT, "must cover all 53 reviewed tools");
-    });
-    test("open-world tools keep openWorldHint:true rationale; read tools keep false", () => {
-        const server = makeComposedServer();
-        // The 4 reviewed open-world tools carry the true rationale (and not false).
-        for (const name of ["send_invoice", "send_quote", "create_webhook", "update_webhook"]) {
-            const tool = server.tools.get(name);
-            assert.equal(tool.config.annotations?.["openWorldHint"], true, `${name} annotation true`);
-            assert.match(tool.config.description, /openWorldHint: true/, `${name} collapsed description must state openWorldHint: true`);
-            assert.doesNotMatch(tool.config.description, /openWorldHint: false/, `${name} must not also claim false`);
-        }
-        // A read-only tool carries the false rationale.
-        const li = server.tools.get("list_invoices");
-        assert.match(li.config.description, /openWorldHint: false/);
-        assert.doesNotMatch(li.config.description, /openWorldHint: true/);
-    });
-    test("collapse does not break OpenAI redaction / input-strip / annotation behavior", async () => {
-        const server = makeComposedServer();
-        // Government IDs stripped from input schema.
-        assert.equal("taxId" in (server.tools.get("create_client").config.inputSchema ?? {}), false);
-        assert.equal("to" in (server.tools.get("send_invoice").config.inputSchema ?? {}), false);
-        assert.equal("secret" in (server.tools.get("create_webhook").config.inputSchema ?? {}), false);
-        // Output redaction wrapper survives the collapse (handler still redacts).
-        const result = await server.tools.get("create_client").handler({ name: "Compose Test Corp" });
-        const serialized = JSON.stringify(result);
-        assert.equal(serialized.includes("taxId"), false);
-        assert.equal(serialized.includes("B12345678"), false);
-        assert.equal(serialized.includes("should-not-leak"), false);
-    });
-});
-describe("openai × grouped composition: invariant (3) — catalog is allow-list-only", () => {
-    test("list_tool_groups counts exactly the 53 reviewed tools", async () => {
-        const server = makeComposedServer();
-        const res = await server.tools.get("list_tool_groups").handler({});
-        const payload = JSON.parse(res.content[0].text);
-        assert.equal(payload.totalTools, OPENAI_ALLOWED_TOOL_COUNT);
-        const sum = payload.groups.reduce((acc, g) => acc + g.toolCount, 0);
-        assert.equal(sum, OPENAI_ALLOWED_TOOL_COUNT, "group counts must sum to 53");
-        assert.ok(payload.groups.every((g) => g.toolCount > 0), "no empty groups listed");
-        // Reviewed surface has no fiscal/stay/pos/hr tools → those groups must be absent.
-        for (const forbidden of ["fiscal", "stay", "pos", "hr", "banking"]) {
-            assert.ok(!payload.groups.some((g) => g.group === forbidden), `group ${forbidden} must not appear (no reviewed tools in it)`);
-        }
-    });
-    test("search_tools NEVER returns a tool outside the reviewed allow-list (browse all)", async () => {
-        const server = makeComposedServer();
-        // Empty query + huge limit = browse the entire catalog.
-        const res = await server.tools.get("search_tools").handler({ query: "", limit: 500 });
-        const payload = JSON.parse(res.content[0].text);
-        assert.equal(payload.count, OPENAI_ALLOWED_TOOL_COUNT, "browse-all returns exactly the 53");
-        const leaks = payload.tools.filter((t) => !OPENAI_REVIEWED_TOOL_ALLOWLIST.has(t.name));
-        assert.deepEqual(leaks, [], "search_tools must not surface any non-reviewed tool");
-    });
-    test("search_tools for a fiscal term yields nothing (fiscal tools are not in the catalog)", async () => {
-        const server = makeComposedServer();
-        // 'modelo 303' would top-rank get_modelo_303_summary on the full grouped
-        // server. Here that tool is NOT in the catalog, so it must not appear.
-        const res = await server.tools.get("search_tools").handler({ query: "modelo 303 verifactu" });
-        const payload = JSON.parse(res.content[0].text);
-        const leaks = payload.tools.filter((t) => !OPENAI_REVIEWED_TOOL_ALLOWLIST.has(t.name));
-        assert.deepEqual(leaks, [], "no fiscal/non-reviewed tool may be returned");
-        assert.ok(!payload.tools.some((t) => t.name === "get_modelo_303_summary"), "get_modelo_303_summary (non-reviewed) must never surface");
-    });
-    test("search_tools group filter cannot reach a non-reviewed group", async () => {
-        const server = makeComposedServer();
-        // Even explicitly asking for the fiscal group returns nothing, because no
-        // fiscal tool was catalogued.
-        const res = await server.tools.get("search_tools").handler({
-            query: "",
-            group: "fiscal",
-            limit: 100,
-        });
-        const payload = JSON.parse(res.content[0].text);
-        assert.equal(payload.tools.length, 0, "fiscal group is empty in the reviewed catalog");
-    });
-    test("describe_tool serves reviewed tools but REJECTS any tool outside the 53", async () => {
-        const server = makeComposedServer();
-        // A reviewed tool resolves.
-        const ok = await server.tools.get("describe_tool").handler({ name: "list_invoices" });
-        const okPayload = JSON.parse(ok.content[0].text);
-        assert.equal(ok.isError, undefined);
-        assert.equal(okPayload.name, "list_invoices");
-        // Every non-reviewed tool is rejected (not in the catalog).
-        for (const name of NON_REVIEWED_TOOLS) {
-            const res = await server.tools.get("describe_tool").handler({ name });
-            assert.equal(res.isError, true, `describe_tool('${name}') must error — not in reviewed catalog`);
-            const payload = JSON.parse(res.content[0].text);
-            assert.match(payload.error, /No tool named/);
-            // Suggestions can only ever be reviewed tools — never a leak.
-            for (const s of payload.suggestions) {
-                assert.ok(OPENAI_REVIEWED_TOOL_ALLOWLIST.has(s), `describe_tool suggestion '${s}' must be a reviewed tool, not a leak`);
-            }
-        }
-    });
-});
-//# sourceMappingURL=openai-grouped-compose.test.js.map

package/dist/__tests__/openai-grouped-compose.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"openai-grouped-compose.test.js","sourceRoot":"","sources":["../../src/__tests__/openai-grouped-compose.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,MAAM,MAAM,oBAAoB,CAAC;AAExC,OAAO,EACL,kBAAkB,EAClB,8BAA8B,EAC9B,yBAAyB,GAC1B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AACxF,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAuBpE,MAAM,aAAa;IACjB,KAAK,GAAgC,IAAI,GAAG,EAAE,CAAC;IAC/C,OAAO,GAAa,EAAE,CAAC;IACvB,SAAS,GAAa,EAAE,CAAC;IAEzB,YAAY,CAAC,IAAY,EAAE,MAAkB,EAAE,OAAoB;QACjE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAClD,CAAC;IACD,cAAc,CAAC,IAAY;QACzB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IACD,gBAAgB,CAAC,IAAY;QAC3B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;CACF;AAED,mFAAmF;AACnF,SAAS,UAAU;IACjB,OAAO,IAAI,KAAK,CACd,EAAE,EACF;QACE,GAAG,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,KAAe,EAAE,EAAE;YAChD,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;gBAC5B,OAAO;oBACL,EAAE,EAAE,aAAa;oBACjB,IAAI,EAAE,mBAAmB;oBACzB,KAAK,EAAE,kBAAkB;oBACzB,KAAK,EAAE,WAAW;oBAClB,MAAM,EAAE,iBAAiB;iBAC1B,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;QAC7D,CAAC;KACF,CACe,CAAC;AACrB,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,CAAgB,EAAE,EAAE,CACjC,CAA2E,CAAC;AAE9E;;;GAGG;AACH,SAAS,kBAAkB;IACzB,MAAM,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;IACnC,4EAA4E;IAC5E,wCAAwC;IACxC,wBAAwB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE;QACtC,SAAS,EAAE,8BAA8B;KAC1C,CAAC,CAAC;IACH,sEAAsE;IACtE,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAClC,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;IAC9C,oBAAoB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACpC,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAClC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,kBAAkB,EAAE,cAAc,EAAE,eAAe,CAAU,CAAC;AAElF,sFAAsF;AACtF,MAAM,kBAAkB,GAAG;IACzB,qBAAqB;IACrB,sBAAsB;IACtB,eAAe;IACf,uBAAuB;IACvB,oBAAoB;IACpB,gBAAgB;IAChB,oBAAoB;IACpB,wBAAwB;CAChB,CAAC;AAEX,QAAQ,CAAC,gFAAgF,EAAE,GAAG,EAAE;IAC9F,IAAI,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACzE,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;QAEpC,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,EAAE,oCAAoC,CAAC,CAAC;QAClF,MAAM,CAAC,KAAK,CACV,MAAM,CAAC,KAAK,CAAC,IAAI,EACjB,yBAAyB,GAAG,uBAAuB,EACnD,2DAA2D,CAC5D,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAEpC,uCAAuC;QACvC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACvC,2EAA2E;QAC3E,gDAAgD;QAChD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,8EAA8E,EAAE,GAAG,EAAE;QACxF,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;QACpC,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,MAAM,CAAC,KAAK,CACV,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EACtB,IAAI,EACJ,GAAG,IAAI,wDAAwD,CAChE,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,gEAAgE,EAAE,GAAG,EAAE;QAC1E,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;QACpC,KAAK,MAAM,IAAI,IAAI,kBAAkB,EAAE,CAAC;YACtC,MAAM,CAAC,KAAK,CACV,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EACtB,KAAK,EACL,GAAG,IAAI,qDAAqD,CAC7D,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,4EAA4E,EAAE,GAAG,EAAE;QACtF,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;QACpC,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC,MAAM,CAAC,WAAW,CAAC;YACvD,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,IAAI,oBAAoB,CAAC,CAAC;YACnE,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,IAAI,uBAAuB,CAAC,CAAC;YACxE,0EAA0E;YAC1E,yDAAyD;YACzD,MAAM,CAAC,KAAK,CACV,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC,MAAM,CAAC,WAAW,EAC1C,sBAAsB,EACtB,GAAG,IAAI,oDAAoD,CAC5D,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mFAAmF,EAAE,GAAG,EAAE;IACjG,IAAI,CAAC,yEAAyE,EAAE,GAAG,EAAE;QACnF,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;QACpC,IAAI,aAAa,GAAG,CAAC,CAAC;QAEtB,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACxC,IAAK,UAAgC,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC/D,aAAa,IAAI,CAAC,CAAC;YACnB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;YAErC,8EAA8E;YAC9E,MAAM,CAAC,KAAK,CACV,IAAI,EACJ,cAAc,EACd,GAAG,IAAI,2DAA2D,CACnE,CAAC;YACF,MAAM,CAAC,EAAE,CACP,IAAI,CAAC,QAAQ,CAAC,kBAAkB,IAAI,IAAI,CAAC,EACzC,GAAG,IAAI,0CAA0C,CAClD,CAAC;YACF,wEAAwE;YACxE,MAAM,CAAC,EAAE,CACP,IAAI,CAAC,MAAM,GAAG,GAAG,EACjB,GAAG,IAAI,sDAAsD,IAAI,CAAC,MAAM,EAAE,CAC3E,CAAC;YAEF,wDAAwD;YACxD,MAAM,CAAC,EAAE,CACP,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,EAC9B,GAAG,IAAI,oEAAoE,CAC5E,CAAC;YACF,yEAAyE;YACzE,MAAM,CAAC,KAAK,CACV,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,eAAe,CAAC,EACjD,SAAS,EACT,GAAG,IAAI,yDAAyD,CACjE,CAAC;QACJ,CAAC;QAED,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,yBAAyB,EAAE,kCAAkC,CAAC,CAAC;IAC7F,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,2EAA2E,EAAE,GAAG,EAAE;QACrF,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;QAEpC,4EAA4E;QAC5E,KAAK,MAAM,IAAI,IAAI,CAAC,cAAc,EAAE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,EAAE,CAAC;YACtF,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC;YACrC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,GAAG,IAAI,kBAAkB,CAAC,CAAC;YAC1F,MAAM,CAAC,KAAK,CACV,IAAI,CAAC,MAAM,CAAC,WAAW,EACvB,qBAAqB,EACrB,GAAG,IAAI,uDAAuD,CAC/D,CAAC;YACF,MAAM,CAAC,YAAY,CACjB,IAAI,CAAC,MAAM,CAAC,WAAW,EACvB,sBAAsB,EACtB,GAAG,IAAI,4BAA4B,CACpC,CAAC;QACJ,CAAC;QAED,gDAAgD;QAChD,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,CAAE,CAAC;QAC9C,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,sBAAsB,CAAC,CAAC;QAC5D,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,qBAAqB,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,8EAA8E,EAAE,KAAK,IAAI,EAAE;QAC9F,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;QAEpC,6CAA6C;QAC7C,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,CAAE,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;QAC9F,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAE,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;QAC1F,MAAM,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAE,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;QAEhG,0EAA0E;QAC1E,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,CAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/F,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;QAClD,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC,CAAC;QACtD,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,0EAA0E,EAAE,GAAG,EAAE;IACxF,IAAI,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACpE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAG7C,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,yBAAyB,CAAC,CAAC;QAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QACpE,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,yBAAyB,EAAE,6BAA6B,CAAC,CAAC;QAC5E,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC;QAClF,kFAAkF;QAClF,KAAK,MAAM,SAAS,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;YACnE,MAAM,CAAC,EAAE,CACP,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,EAClD,SAAS,SAAS,4CAA4C,CAC/D,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;QAChG,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;QACpC,wDAAwD;QACxD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACvF,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAG7C,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,yBAAyB,EAAE,mCAAmC,CAAC,CAAC;QAC5F,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,8BAA8B,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACvF,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,EAAE,qDAAqD,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,qFAAqF,EAAE,KAAK,IAAI,EAAE;QACrG,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;QACpC,yEAAyE;QACzE,uEAAuE;QACvE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAC/F,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAE7C,CAAC;QACF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,8BAA8B,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACvF,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,EAAE,6CAA6C,CAAC,CAAC;QAC3E,MAAM,CAAC,EAAE,CACP,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,wBAAwB,CAAC,EAC/D,0DAA0D,CAC3D,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;QACpC,0EAA0E;QAC1E,8BAA8B;QAC9B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAE,CAAC,OAAO,CAAC;YAC1D,KAAK,EAAE,EAAE;YACT,KAAK,EAAE,QAAQ;YACf,KAAK,EAAE,GAAG;SACX,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAyB,CAAC;QACxE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,+CAA+C,CAAC,CAAC;IACzF,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;QAEpC,4BAA4B;QAC5B,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,CAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;QACvF,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAA0C,CAAC;QAC1F,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACpC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QAE9C,4DAA4D;QAC5D,KAAK,MAAM,IAAI,IAAI,kBAAkB,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,CAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YACvE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,kBAAkB,IAAI,yCAAyC,CAAC,CAAC;YACjG,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAG7C,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;YAC7C,8DAA8D;YAC9D,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;gBACpC,MAAM,CAAC,EAAE,CACP,8BAA8B,CAAC,GAAG,CAAC,CAAC,CAAC,EACrC,6BAA6B,CAAC,uCAAuC,CACtE,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/openai-profile.test.d.ts

@@ -1,10 +0,0 @@
-/**
- * Tests for the OpenAI-safe MCP profile.
- *
- * The public ChatGPT app intentionally exposes a narrower tool surface than
- * the full MCP server. This prevents regulated or sensitive workflows added
- * to the general MCP server from becoming part of the OpenAI submission by
- * accident.
- */
-export {};
-//# sourceMappingURL=openai-profile.test.d.ts.map

package/dist/__tests__/openai-profile.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"openai-profile.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/openai-profile.test.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG"}