@wootsup/mcp 0.3.0 → 0.4.0

package/dist/modules/apimapper/list-footer.d.ts

@@ -0,0 +1,27 @@
+/**
+ * The row count at/above which the toolkit switches to the 2000-char compact
+ * level (per DETAIL_LIMITS: 21+ items → compact). Kept in sync with the
+ * toolkit's documented thresholds.
+ */
+export declare const COMPACT_ROW_THRESHOLD = 21;
+/**
+ * Build the overflow note for a list of `count` rows of `entity` (e.g.
+ * "connections", "flows", "library items"). Returns "" when the list is small
+ * enough that the toolkit renders it without compaction (no truncation risk).
+ */
+export declare function listOverflowNote(count: number, entity: string): string;
+/**
+ * Append the overflow note to `footer` when `count` rows would be compacted.
+ * Returns `footer` unchanged for small lists. Safe to call unconditionally
+ * from a list tool's footer construction.
+ */
+export declare function withOverflowFooter(footer: string, count: number, entity: string): string;
+/**
+ * F198 (Desktop-E2E #2 forensics, 2026-06-12): the honest "N more" note for a
+ * list that was hard-CAPPED by the requested `limit` — i.e. `totalMatched`
+ * exceeded `limit`, so `totalMatched - limit` rows were dropped from the slice.
+ * Unlike `listOverflowNote` (which fires on the COMPACT render threshold), this
+ * fires on real data loss so the agent knows to narrow or raise the limit.
+ * Returns "" when nothing was dropped.
+ */
+export declare function truncatedByLimitNote(totalMatched: number, limit: number, entity: string): string;

package/dist/modules/apimapper/list-footer.js

@@ -0,0 +1,57 @@
+// src/modules/apimapper/list-footer.ts — Minor (2026-06-10)
+//
+// The @getimo/mcp-toolkit `tableResult` renders the LLM-visible ASCII table at
+// a detail level chosen by row count: 1-5 → full (8000 chars), 6-20 → standard
+// (4000), 21+ → compact (2000). In compact mode a long list is silently
+// truncated to 2000 chars — the LLM sees the first rows and may conclude
+// "that's the whole list". This helper appends an honest
+// "… N items shown — use filters to narrow" note to a list tool's footer when
+// the row count crosses the compaction threshold, so the agent knows to
+// filter rather than assume completeness.
+/**
+ * The row count at/above which the toolkit switches to the 2000-char compact
+ * level (per DETAIL_LIMITS: 21+ items → compact). Kept in sync with the
+ * toolkit's documented thresholds.
+ */
+export const COMPACT_ROW_THRESHOLD = 21;
+/**
+ * Build the overflow note for a list of `count` rows of `entity` (e.g.
+ * "connections", "flows", "library items"). Returns "" when the list is small
+ * enough that the toolkit renders it without compaction (no truncation risk).
+ */
+export function listOverflowNote(count, entity) {
+    if (count < COMPACT_ROW_THRESHOLD) {
+        return "";
+    }
+    return (`… ${count} ${entity} shown in a compact table (the LLM-visible text is ` +
+        `capped, so some rows may be truncated) — use filters to narrow ` +
+        `(e.g. source / name_query) rather than assuming this is the full set.`);
+}
+/**
+ * Append the overflow note to `footer` when `count` rows would be compacted.
+ * Returns `footer` unchanged for small lists. Safe to call unconditionally
+ * from a list tool's footer construction.
+ */
+export function withOverflowFooter(footer, count, entity) {
+    const note = listOverflowNote(count, entity);
+    if (note === "") {
+        return footer;
+    }
+    return footer ? `${footer}\n${note}` : note;
+}
+/**
+ * F198 (Desktop-E2E #2 forensics, 2026-06-12): the honest "N more" note for a
+ * list that was hard-CAPPED by the requested `limit` — i.e. `totalMatched`
+ * exceeded `limit`, so `totalMatched - limit` rows were dropped from the slice.
+ * Unlike `listOverflowNote` (which fires on the COMPACT render threshold), this
+ * fires on real data loss so the agent knows to narrow or raise the limit.
+ * Returns "" when nothing was dropped.
+ */
+export function truncatedByLimitNote(totalMatched, limit, entity) {
+    const dropped = totalMatched - limit;
+    if (dropped <= 0)
+        return "";
+    return (`${dropped} more ${entity} not shown — filter with name_query or raise the limit ` +
+        `(showing ${limit} of ${totalMatched}).`);
+}
+//# sourceMappingURL=list-footer.js.map

package/dist/modules/apimapper/list-footer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-footer.js","sourceRoot":"","sources":["../../../src/modules/apimapper/list-footer.ts"],"names":[],"mappings":"AAAA,4DAA4D;AAC5D,EAAE;AACF,+EAA+E;AAC/E,+EAA+E;AAC/E,wEAAwE;AACxE,yEAAyE;AACzE,yDAAyD;AACzD,8EAA8E;AAC9E,wEAAwE;AACxE,0CAA0C;AAE1C;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAExC;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,MAAc;IAC5D,IAAI,KAAK,GAAG,qBAAqB,EAAE,CAAC;QAClC,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,CACL,KAAK,KAAK,IAAI,MAAM,qDAAqD;QACzE,iEAAiE;QACjE,uEAAuE,CACxE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAc,EACd,KAAa,EACb,MAAc;IAEd,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC7C,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAChB,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,YAAoB,EACpB,KAAa,EACb,MAAc;IAEd,MAAM,OAAO,GAAG,YAAY,GAAG,KAAK,CAAC;IACrC,IAAI,OAAO,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IAC5B,OAAO,CACL,GAAG,OAAO,SAAS,MAAM,yDAAyD;QAClF,YAAY,KAAK,OAAO,YAAY,IAAI,CACzC,CAAC;AACJ,CAAC"}

package/dist/modules/apimapper/local-sources.js

@@ -1,8 +1,28 @@
 import { z } from "zod";
-import { formatResult, readOnly } from "@getimo/mcp-toolkit";
+import { formatResult, errorResult, readOnly } from "@getimo/mcp-toolkit";
 import { request } from "./client.js";
 import { restErrorResult } from "./tool-result.js";
 import { encodePathPreservingSlashes } from "./normalizers.js";
+// F157 — content-type / type-id validation, uniform across the three
+// local-source read tools (schema, filter_options, query). Before this the
+// three tools each declared their own `.regex(/^[a-z]+\/[a-z0-9_-]+$/)` which
+// HARD-rejected a bare single-segment type like `post` at the Zod boundary —
+// even though the PHP layer already does a did-you-mean lookup and accepts the
+// platform-qualified form `wordpress/post`. A cold agent that learned `post`
+// from the YOOtheme source dropdown (which shows the bare content-type) got a
+// schema reject with no hint. We now accept BOTH the canonical
+// `platform/type` form AND a bare single segment, and let the server resolve /
+// did-you-mean. The min(1) floor keeps empty-string out.
+const LOCAL_SOURCE_TYPE_RE = /^[a-z]+(\/[a-z0-9_-]+)?$/;
+const LOCAL_SOURCE_TYPE_HINT = 'Local source type id. Canonical form is "platform/type" (e.g., "wordpress/posts", "joomla/articles"); ' +
+    'a bare single segment (e.g., "post") is also accepted and resolved server-side. ' +
+    "Use apimapper_local_source_types to discover the exact ids.";
+function localSourceTypeSchema() {
+    return z
+        .string()
+        .min(1)
+        .regex(LOCAL_SOURCE_TYPE_RE, 'Must be a lowercase "platform/type" (e.g., "wordpress/posts") or a bare single segment (e.g., "post")');
+}
 // rc.13 Welle 3 (2026-05-20) — error branches upgraded to the toolkit's
 // errorResult builder. Object-passthrough judgment (W3.1 note 2): every
 // local-source SUCCESS payload is arbitrary-shape data with NO stable column
@@ -17,7 +37,7 @@ export function registerLocalSourceTools(server) {
     // ── apimapper_local_source_types ───────────────────────────────────
     server.registerTool("apimapper_local_source_types", {
         title: "List Local Source Types",
-        description: "List available local-source types (e.g., wordpress/posts, wordpress/users, joomla/articles). " +
+        description: "List available local-source types (e.g., wordpress/post, wordpress/page, joomla/article, joomla/category). " +
             "Local sources don't need a connection — they query WP/Joomla internal data." +
             "\n\nExample:\n  apimapper_local_source_types({})",
         inputSchema: {},
@@ -40,16 +60,33 @@ export function registerLocalSourceTools(server) {
             "Use apimapper_local_source_types to discover available type IDs first." +
             "\n\nExample:\n  apimapper_local_source_schema({ type_id: 'wordpress/post' })",
         inputSchema: {
-            type_id: z
-                .string()
-                .regex(/^[a-z]+\/[a-z0-9_-]+$/, "Must be in the form 'platform/type', e.g., 'wordpress/posts'")
-                .describe('Local source type id in "platform/type" form (e.g., "wordpress/posts", "joomla/articles"). Use apimapper_local_source_types.'),
+            // F157: lenient validation (canonical "platform/type" OR a bare
+            // single segment like "post") via the shared helper. Optional so the
+            // F69 `content_type`-only call path parses.
+            type_id: localSourceTypeSchema().optional().describe(LOCAL_SOURCE_TYPE_HINT),
+            // F69 (2026-06-10): `content_type` alias. apimapper_local_source_query
+            // (the tool agents reach for first) keys this same value under
+            // `content_type`; agents carried that name over to the schema tool and
+            // hit "Invalid arguments". Accept both — `type_id` is canonical and
+            // wins on conflict. Same lenient validation as `type_id` (F157).
+            content_type: localSourceTypeSchema()
+                .optional()
+                .describe('Alias of `type_id` (the key apimapper_local_source_query uses). `type_id` wins when both are set.'),
         },
         annotations: readOnly({ title: "Get Local Source Schema", openWorld: true }),
-    }, async ({ type_id }) => {
-        const r = await request(`/local-sources/schema/${encodePathPreservingSlashes(type_id)}`);
+    }, async ({ type_id, content_type }) => {
+        const resolvedTypeId = type_id ?? content_type;
+        if (resolvedTypeId === undefined || resolvedTypeId === "") {
+            return errorResult({
+                message: "Provide `type_id` (canonical) or `content_type` (alias) in 'platform/type' form, e.g. 'wordpress/post'.",
+                code: "bad_request",
+                suggestion: "Use apimapper_local_source_types to discover valid type ids.",
+                details: {},
+            });
+        }
+        const r = await request(`/local-sources/schema/${encodePathPreservingSlashes(resolvedTypeId)}`);
         if (!r.success) {
-            return restErrorResult(r, { type_id }, { message: "local source schema failed" });
+            return restErrorResult(r, { type_id: resolvedTypeId }, { message: "local source schema failed" });
         }
         return formatResult(r.data ?? {}, false, { maxChars: 4000 });
     });
@@ -57,22 +94,35 @@ export function registerLocalSourceTools(server) {
     server.registerTool("apimapper_local_source_filter_options", {
         title: "Get Filter Options",
         description: "Fetch dropdown options for a filter on a local source (e.g., available categories/tags)." +
-            "\n\nExample:\n  apimapper_local_source_filter_options({ type: 'wordpress/posts', field: 'category' })",
+            "\n\nExample:\n  apimapper_local_source_filter_options({ type_id: 'wordpress/post', filter_name: 'category' })",
         inputSchema: {
-            type_id: z
-                .string()
-                .regex(/^[a-z]+\/[a-z0-9_-]+$/, "Must be 'platform/type' form")
-                .describe('Local source type id in "platform/type" form. Use apimapper_local_source_types.'),
+            // F157: lenient validation via the shared helper; optional for the
+            // F69 `content_type`-only path.
+            type_id: localSourceTypeSchema().optional().describe(LOCAL_SOURCE_TYPE_HINT),
+            // F69 (2026-06-10): `content_type` alias — same rationale as
+            // local_source_schema. `type_id` is canonical and wins on conflict.
+            content_type: localSourceTypeSchema()
+                .optional()
+                .describe('Alias of `type_id` (the key apimapper_local_source_query uses). `type_id` wins when both are set.'),
             filter_name: z
                 .string()
                 .regex(/^[a-z_]+$/, "Must be lowercase with underscores")
                 .describe('Filter field name (e.g., "category", "tag", "author")'),
         },
         annotations: readOnly({ title: "Get Local Source Filter Options", openWorld: true }),
-    }, async ({ type_id, filter_name }) => {
-        const r = await request(`/local-sources/filter-options/${encodePathPreservingSlashes(type_id)}/${encodeURIComponent(filter_name)}`);
+    }, async ({ type_id, content_type, filter_name }) => {
+        const resolvedTypeId = type_id ?? content_type;
+        if (resolvedTypeId === undefined || resolvedTypeId === "") {
+            return errorResult({
+                message: "Provide `type_id` (canonical) or `content_type` (alias) in 'platform/type' form, e.g. 'wordpress/post'.",
+                code: "bad_request",
+                suggestion: "Use apimapper_local_source_types to discover valid type ids.",
+                details: { filter_name },
+            });
+        }
+        const r = await request(`/local-sources/filter-options/${encodePathPreservingSlashes(resolvedTypeId)}/${encodeURIComponent(filter_name)}`);
         if (!r.success) {
-            return restErrorResult(r, { type_id, filter_name }, { message: "local source filter options failed" });
+            return restErrorResult(r, { type_id: resolvedTypeId, filter_name }, { message: "local source filter options failed" });
         }
         return formatResult(r.data ?? {}, false, { maxChars: 4000 });
     });
@@ -86,12 +136,19 @@ export function registerLocalSourceTools(server) {
             "the matching items in one call. Body uses camelCase `contentType` (FlowExecutor node-data " +
             "convention). For AI agents: prefer a higher `limit` (up to 500) over iterating with " +
             "`offset` — most installs fit comfortably in a single page." +
-            "\n\nExample:\n  apimapper_local_source_query({ contentType: 'wordpress/posts', limit: 100 })",
+            "\n\nExample:\n  apimapper_local_source_query({ content_type: 'wordpress/posts', limit: 100 })",
         inputSchema: {
-            content_type: z
-                .string()
-                .regex(/^[a-z]+\/[a-z0-9_-]+$/, "Must be 'platform/type' form")
-                .describe('Content type in "platform/type" form (e.g., "wordpress/posts"). Use apimapper_local_source_types.'),
+            // F4 + F157: lenient validation via the shared helper — canonical
+            // "platform/type" OR a bare single segment ("post"). The strict
+            // slash-only regex used to reject a bare "post" at the schema boundary
+            // BEFORE the server's structured `invalid_content_type` error (P0-C5)
+            // could fire; the helper accepts both and lets the server stay the
+            // authority on content-type validity (empty string is still rejected).
+            content_type: localSourceTypeSchema().describe('Content type. Canonical form "platform/type" (e.g., "wordpress/posts"); a bare single ' +
+                'segment (e.g., "post") is also accepted — the server canonicalizes it and, if it ' +
+                "can't, replies with a structured invalid_content_type error listing the valid types " +
+                "and a did-you-mean. Use apimapper_local_source_types. " +
+                "Sent on the wire as camelCase `contentType` (FlowExecutor node-data convention)."),
             filters: z
                 .record(z.string(), z.unknown())
                 .optional()
@@ -120,19 +177,19 @@ export function registerLocalSourceTools(server) {
             body.sort = orderby;
         const r = await request("/local-sources/query", { method: "POST", body: JSON.stringify(body) });
         if (!r.success) {
-            // F-A5-02: on 403 feature-gate response the PHP body carries
-            // `error_code` + `upgrade` hints — surface them to the agent (in the
-            // errorResult details) so it can route the user to the upgrade flow
-            // instead of a generic error.
-            const dataObj = r.data && typeof r.data === "object"
-                ? r.data
-                : {};
+            // F-A5-02 / F4 / F11 (2026-06-09): on a non-2xx the structured PHP body
+            // lives in `r.errorBody` (NOT `r.data`, which is undefined on failure —
+            // the old read was a no-op). `restErrorResult` now lifts the server's
+            // `error_code` + `valid_types` + `suggestion` (e.g. invalid_content_type
+            // 400, P0-C5) verbatim. Here we additionally thread the 403 feature-gate
+            // `upgrade` hint into the details so the agent can route the user to the
+            // upgrade flow.
+            const errBody = r.errorBody ?? {};
             return restErrorResult(r, {
                 content_type,
                 limit,
                 offset,
-                error_code: typeof dataObj.error_code === "string" ? dataObj.error_code : undefined,
-                upgrade: dataObj.upgrade,
+                ...(errBody.upgrade !== undefined ? { upgrade: errBody.upgrade } : {}),
             }, { message: "local source query failed" });
         }
         const items = Array.isArray(r.data?.items) ? r.data.items : [];

package/dist/modules/apimapper/local-sources.js.map

@@ -1 +1 @@
-{"version":3,"file":"local-sources.js","sourceRoot":"","sources":["../../../src/modules/apimapper/local-sources.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAE/D,wEAAwE;AACxE,wEAAwE;AACxE,6EAA6E;AAC7E,qEAAqE;AACrE,0EAA0E;AAC1E,iFAAiF;AACjF,yEAAyE;AACzE,8EAA8E;AAC9E,8EAA8E;AAC9E,4EAA4E;AAE5E,MAAM,UAAU,wBAAwB,CAAC,MAAqB;IAC5D,sEAAsE;IACtE,MAAM,CAAC,YAAY,CACjB,8BAA8B,EAC9B;QACE,KAAK,EAAE,yBAAyB;QAChC,WAAW,EACT,+FAA+F;YAC/F,6EAA6E;YAC7E,kDAAkD;QACpD,WAAW,EAAE,EAAE;QACf,WAAW,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;KAC7E,EACD,KAAK,IAAI,EAAE;QACT,MAAM,CAAC,GAAG,MAAM,OAAO,CAAwB,sBAAsB,CAAC,CAAC;QACvE,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YACf,OAAO,eAAe,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACjF,CAAC,CACF,CAAC;IAEF,sEAAsE;IACtE,4EAA4E;IAC5E,0EAA0E;IAC1E,0CAA0C;IAC1C,MAAM,CAAC,YAAY,CACjB,+BAA+B,EAC/B;QACE,KAAK,EAAE,yBAAyB;QAChC,WAAW,EAAE,qEAAqE;YAClF,wEAAwE;YACxE,8EAA8E;QAC9E,WAAW,EAAE;YACX,OAAO,EAAE,CAAC;iBACP,MAAM,EAAE;iBACR,KAAK,CAAC,uBAAuB,EAAE,8DAA8D,CAAC;iBAC9F,QAAQ,CAAC,8HAA8H,CAAC;SAC5I;QACD,WAAW,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;KAC7E,EACD,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;QACpB,MAAM,CAAC,GAAG,MAAM,OAAO,CAAU,yBAAyB,2BAA2B,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAClG,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YACf,OAAO,eAAe,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,OAAO,YAAY,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/D,CAAC,CACF,CAAC;IAEF,sEAAsE;IACtE,MAAM,CAAC,YAAY,CACjB,uCAAuC,EACvC;QACE,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EACT,0FAA0F;YAC1F,uGAAuG;QACzG,WAAW,EAAE;YACX,OAAO,EAAE,CAAC;iBACP,MAAM,EAAE;iBACR,KAAK,CAAC,uBAAuB,EAAE,8BAA8B,CAAC;iBAC9D,QAAQ,CAAC,iFAAiF,CAAC;YAC9F,WAAW,EAAE,CAAC;iBACX,MAAM,EAAE;iBACR,KAAK,CAAC,WAAW,EAAE,oCAAoC,CAAC;iBACxD,QAAQ,CAAC,uDAAuD,CAAC;SACrE;QACD,WAAW,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;KACrF,EACD,KAAK,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE;QACjC,MAAM,CAAC,GAAG,MAAM,OAAO,CACrB,iCAAiC,2BAA2B,CAAC,OAAO,CAAC,IAAI,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAC3G,CAAC;QACF,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YACf,OAAO,eAAe,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC,CAAC;QACzG,CAAC;QACD,OAAO,YAAY,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/D,CAAC,CACF,CAAC;IAEF,sEAAsE;IACtE,MAAM,CAAC,YAAY,CACjB,8BAA8B,EAC9B;QACE,KAAK,EAAE,yBAAyB;QAChC,kEAAkE;QAClE,mEAAmE;QACnE,mEAAmE;QACnE,WAAW,EACT,4FAA4F;YAC5F,4FAA4F;YAC5F,sFAAsF;YACtF,4DAA4D;YAC5D,8FAA8F;QAChG,WAAW,EAAE;YACX,YAAY,EAAE,CAAC;iBACZ,MAAM,EAAE;iBACR,KAAK,CAAC,uBAAuB,EAAE,8BAA8B,CAAC;iBAC9D,QAAQ,CAAC,mGAAmG,CAAC;YAChH,OAAO,EAAE,CAAC;iBACP,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;iBAC/B,QAAQ,EAAE;iBACV,QAAQ,CAAC,8DAA8D,CAAC;YAC3E,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,CACpD,wGAAwG,CACzG;YACD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAC3C,uLAAuL,CACxL;YACD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;YAC7E,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC;SAC3E;QACD,WAAW,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;KACxE,EACD,KAAK,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE;QACjE,0EAA0E;QAC1E,kEAAkE;QAClE,yEAAyE;QACzE,wEAAwE;QACxE,+CAA+C;QAC/C,MAAM,IAAI,GAA4B;YACpC,WAAW,EAAE,YAAY,EAAE,4BAA4B;YACvD,KAAK;YACL,MAAM;YACN,aAAa,EAAE,KAAK;SACrB,CAAC;QACF,IAAI,OAAO;YAAE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACpC,IAAI,OAAO;YAAE,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC;QACjC,MAAM,CAAC,GAAG,MAAM,OAAO,CAMrB,sBAAsB,EACtB,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAC/C,CAAC;QACF,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YACf,6DAA6D;YAC7D,qEAAqE;YACrE,oEAAoE;YACpE,8BAA8B;YAC9B,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;gBAClD,CAAC,CAAE,CAAC,CAAC,IAAgC;gBACrC,CAAC,CAAC,EAAE,CAAC;YACP,OAAO,eAAe,CAAC,CAAC,EAAE;gBACtB,YAAY;gBACZ,KAAK;gBACL,MAAM;gBACN,UAAU,EACR,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;gBACzE,OAAO,EAAE,OAAO,CAAC,OAAO;aACzB,EAAE,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,OAAO,YAAY,CACjB;YACE,EAAE,EAAE,IAAI;YACR,YAAY;YACZ,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI,KAAK,CAAC,MAAM;YACpC,QAAQ,EAAE,KAAK,CAAC,MAAM;YACtB,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YACzB,IAAI,EAAE,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,uBAAuB,KAAK,CAAC,MAAM,SAAS,CAAC,CAAC,CAAC,SAAS;SACnF,EACD,KAAK,EACL,EAAE,QAAQ,EAAE,IAAI,EAAE,CACnB,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"local-sources.js","sourceRoot":"","sources":["../../../src/modules/apimapper/local-sources.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAE/D,qEAAqE;AACrE,2EAA2E;AAC3E,8EAA8E;AAC9E,6EAA6E;AAC7E,+EAA+E;AAC/E,6EAA6E;AAC7E,8EAA8E;AAC9E,+DAA+D;AAC/D,+EAA+E;AAC/E,yDAAyD;AACzD,MAAM,oBAAoB,GAAG,0BAA0B,CAAC;AACxD,MAAM,sBAAsB,GAC1B,wGAAwG;IACxG,kFAAkF;IAClF,6DAA6D,CAAC;AAEhE,SAAS,qBAAqB;IAC5B,OAAO,CAAC;SACL,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,KAAK,CACJ,oBAAoB,EACpB,uGAAuG,CACxG,CAAC;AACN,CAAC;AAED,wEAAwE;AACxE,wEAAwE;AACxE,6EAA6E;AAC7E,qEAAqE;AACrE,0EAA0E;AAC1E,iFAAiF;AACjF,yEAAyE;AACzE,8EAA8E;AAC9E,8EAA8E;AAC9E,4EAA4E;AAE5E,MAAM,UAAU,wBAAwB,CAAC,MAAqB;IAC5D,sEAAsE;IACtE,MAAM,CAAC,YAAY,CACjB,8BAA8B,EAC9B;QACE,KAAK,EAAE,yBAAyB;QAChC,WAAW,EACT,6GAA6G;YAC7G,6EAA6E;YAC7E,kDAAkD;QACpD,WAAW,EAAE,EAAE;QACf,WAAW,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;KAC7E,EACD,KAAK,IAAI,EAAE;QACT,MAAM,CAAC,GAAG,MAAM,OAAO,CAAwB,sBAAsB,CAAC,CAAC;QACvE,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YACf,OAAO,eAAe,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACjF,CAAC,CACF,CAAC;IAEF,sEAAsE;IACtE,4EAA4E;IAC5E,0EAA0E;IAC1E,0CAA0C;IAC1C,MAAM,CAAC,YAAY,CACjB,+BAA+B,EAC/B;QACE,KAAK,EAAE,yBAAyB;QAChC,WAAW,EAAE,qEAAqE;YAClF,wEAAwE;YACxE,8EAA8E;QAC9E,WAAW,EAAE;YACX,gEAAgE;YAChE,qEAAqE;YACrE,4CAA4C;YAC5C,OAAO,EAAE,qBAAqB,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sBAAsB,CAAC;YAC5E,uEAAuE;YACvE,+DAA+D;YAC/D,uEAAuE;YACvE,oEAAoE;YACpE,iEAAiE;YACjE,YAAY,EAAE,qBAAqB,EAAE;iBAClC,QAAQ,EAAE;iBACV,QAAQ,CAAC,mGAAmG,CAAC;SACjH;QACD,WAAW,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;KAC7E,EACD,KAAK,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE;QAClC,MAAM,cAAc,GAAG,OAAO,IAAI,YAAY,CAAC;QAC/C,IAAI,cAAc,KAAK,SAAS,IAAI,cAAc,KAAK,EAAE,EAAE,CAAC;YAC1D,OAAO,WAAW,CAAC;gBACjB,OAAO,EAAE,yGAAyG;gBAClH,IAAI,EAAE,aAAa;gBACnB,UAAU,EAAE,8DAA8D;gBAC1E,OAAO,EAAE,EAAE;aACZ,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,OAAO,CAAU,yBAAyB,2BAA2B,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;QACzG,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YACf,OAAO,eAAe,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,OAAO,YAAY,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/D,CAAC,CACF,CAAC;IAEF,sEAAsE;IACtE,MAAM,CAAC,YAAY,CACjB,uCAAuC,EACvC;QACE,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EACT,0FAA0F;YAC1F,+GAA+G;QACjH,WAAW,EAAE;YACX,mEAAmE;YACnE,gCAAgC;YAChC,OAAO,EAAE,qBAAqB,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sBAAsB,CAAC;YAC5E,6DAA6D;YAC7D,oEAAoE;YACpE,YAAY,EAAE,qBAAqB,EAAE;iBAClC,QAAQ,EAAE;iBACV,QAAQ,CAAC,mGAAmG,CAAC;YAChH,WAAW,EAAE,CAAC;iBACX,MAAM,EAAE;iBACR,KAAK,CAAC,WAAW,EAAE,oCAAoC,CAAC;iBACxD,QAAQ,CAAC,uDAAuD,CAAC;SACrE;QACD,WAAW,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;KACrF,EACD,KAAK,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,EAAE,EAAE;QAC/C,MAAM,cAAc,GAAG,OAAO,IAAI,YAAY,CAAC;QAC/C,IAAI,cAAc,KAAK,SAAS,IAAI,cAAc,KAAK,EAAE,EAAE,CAAC;YAC1D,OAAO,WAAW,CAAC;gBACjB,OAAO,EAAE,yGAAyG;gBAClH,IAAI,EAAE,aAAa;gBACnB,UAAU,EAAE,8DAA8D;gBAC1E,OAAO,EAAE,EAAE,WAAW,EAAE;aACzB,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,OAAO,CACrB,iCAAiC,2BAA2B,CAAC,cAAc,CAAC,IAAI,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAClH,CAAC;QACF,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YACf,OAAO,eAAe,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC,CAAC;QACzH,CAAC;QACD,OAAO,YAAY,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/D,CAAC,CACF,CAAC;IAEF,sEAAsE;IACtE,MAAM,CAAC,YAAY,CACjB,8BAA8B,EAC9B;QACE,KAAK,EAAE,yBAAyB;QAChC,kEAAkE;QAClE,mEAAmE;QACnE,mEAAmE;QACnE,WAAW,EACT,4FAA4F;YAC5F,4FAA4F;YAC5F,sFAAsF;YACtF,4DAA4D;YAC5D,+FAA+F;QACjG,WAAW,EAAE;YACX,kEAAkE;YAClE,gEAAgE;YAChE,uEAAuE;YACvE,sEAAsE;YACtE,mEAAmE;YACnE,uEAAuE;YACvE,YAAY,EAAE,qBAAqB,EAAE,CAAC,QAAQ,CAC5C,wFAAwF;gBACtF,mFAAmF;gBACnF,sFAAsF;gBACtF,wDAAwD;gBACxD,kFAAkF,CACrF;YACD,OAAO,EAAE,CAAC;iBACP,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;iBAC/B,QAAQ,EAAE;iBACV,QAAQ,CAAC,8DAA8D,CAAC;YAC3E,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,CACpD,wGAAwG,CACzG;YACD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAC3C,uLAAuL,CACxL;YACD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;YAC7E,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC;SAC3E;QACD,WAAW,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;KACxE,EACD,KAAK,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE;QACjE,0EAA0E;QAC1E,kEAAkE;QAClE,yEAAyE;QACzE,wEAAwE;QACxE,+CAA+C;QAC/C,MAAM,IAAI,GAA4B;YACpC,WAAW,EAAE,YAAY,EAAE,4BAA4B;YACvD,KAAK;YACL,MAAM;YACN,aAAa,EAAE,KAAK;SACrB,CAAC;QACF,IAAI,OAAO;YAAE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACpC,IAAI,OAAO;YAAE,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC;QACjC,MAAM,CAAC,GAAG,MAAM,OAAO,CAMrB,sBAAsB,EACtB,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAC/C,CAAC;QACF,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YACf,wEAAwE;YACxE,wEAAwE;YACxE,sEAAsE;YACtE,yEAAyE;YACzE,yEAAyE;YACzE,yEAAyE;YACzE,gBAAgB;YAChB,MAAM,OAAO,GAAG,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC;YAClC,OAAO,eAAe,CAAC,CAAC,EAAE;gBACtB,YAAY;gBACZ,KAAK;gBACL,MAAM;gBACN,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACvE,EAAE,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,OAAO,YAAY,CACjB;YACE,EAAE,EAAE,IAAI;YACR,YAAY;YACZ,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI,KAAK,CAAC,MAAM;YACpC,QAAQ,EAAE,KAAK,CAAC,MAAM;YACtB,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YACzB,IAAI,EAAE,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,uBAAuB,KAAK,CAAC,MAAM,SAAS,CAAC,CAAC,CAAC,SAAS;SACnF,EACD,KAAK,EACL,EAAE,QAAQ,EAAE,IAAI,EAAE,CACnB,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/modules/apimapper/mcp-client-identity.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Sanitize a raw `name/version` identity into a header-safe string.
+ *
+ * - Strips CR/LF and other ASCII control chars (header-injection defense).
+ * - Collapses runs of whitespace to single spaces and trims.
+ * - Caps the length to {@link MAX_CLIENT_LEN}.
+ * - Returns `null` for empty / whitespace-only input.
+ *
+ * @param raw the candidate identity string (may be undefined)
+ * @returns a sanitized non-empty string, or null
+ */
+export declare function sanitizeMcpClient(raw: string | undefined | null): string | null;
+/**
+ * Build a `name/version` identity from the SDK `Implementation` shape and
+ * stash it for the outbound chokepoint. Called once after the stdio handshake.
+ *
+ * Empty / missing clientInfo → the slot stays null and no header is attached.
+ *
+ * @param info the connecting client's implementation info (name+version),
+ *             or undefined when the SDK could not determine it.
+ */
+export declare function setMcpClient(info: {
+    name?: string;
+    version?: string;
+} | undefined): void;
+/**
+ * The sanitized connected-client identity, or null when no client info was
+ * available. Read by `performFetch` to attach the `X-MCP-Client` header.
+ */
+export declare function getMcpClient(): string | null;
+/** Test-only reset of the module-scoped slot. */
+export declare function __resetMcpClientForTests(): void;

package/dist/modules/apimapper/mcp-client-identity.js

@@ -0,0 +1,70 @@
+// src/modules/apimapper/mcp-client-identity.ts
+//
+// Connected-client identity carrier (Task Q1).
+//
+// The MCP SDK exposes the connecting AI client's name+version via
+// `server.server.getClientVersion()` AFTER the stdio handshake completes.
+// We stash a sanitized `name/version` string in a module-scoped slot here so
+// the outbound REST chokepoint (`performFetch` in client.ts) can attach it as
+// the `X-MCP-Client` header on every request — WITHOUT a circular import
+// between `index.ts` (which owns the server) and `client.ts` (which owns the
+// fetch). `index.ts` calls `setMcpClient()` once post-connect; `client.ts`
+// calls `getMcpClient()` per request.
+//
+// The value is attacker-INFLUENCEABLE (any MCP client picks its own
+// clientInfo), so we treat it as untrusted: strip CR/LF (header-injection
+// defense), collapse internal control chars, and cap the length. The REST
+// side maps it to a known provider slug and NEVER renders the raw string.
+/** Max wire length for the X-MCP-Client header value. Generous but bounded. */
+const MAX_CLIENT_LEN = 128;
+let currentClient = null;
+/**
+ * Sanitize a raw `name/version` identity into a header-safe string.
+ *
+ * - Strips CR/LF and other ASCII control chars (header-injection defense).
+ * - Collapses runs of whitespace to single spaces and trims.
+ * - Caps the length to {@link MAX_CLIENT_LEN}.
+ * - Returns `null` for empty / whitespace-only input.
+ *
+ * @param raw the candidate identity string (may be undefined)
+ * @returns a sanitized non-empty string, or null
+ */
+export function sanitizeMcpClient(raw) {
+    if (typeof raw !== "string")
+        return null;
+    // eslint-disable-next-line no-control-regex -- intentional: strip ASCII control chars (CR/LF header injection)
+    const stripped = raw.replace(/[\u0000-\u001f\u007f]/g, " ").replace(/\s+/g, " ").trim();
+    if (stripped.length === 0)
+        return null;
+    return stripped.slice(0, MAX_CLIENT_LEN);
+}
+/**
+ * Build a `name/version` identity from the SDK `Implementation` shape and
+ * stash it for the outbound chokepoint. Called once after the stdio handshake.
+ *
+ * Empty / missing clientInfo → the slot stays null and no header is attached.
+ *
+ * @param info the connecting client's implementation info (name+version),
+ *             or undefined when the SDK could not determine it.
+ */
+export function setMcpClient(info) {
+    const name = typeof info?.name === "string" ? info.name.trim() : "";
+    if (!name) {
+        currentClient = null;
+        return;
+    }
+    const version = typeof info?.version === "string" && info.version.trim() ? info.version.trim() : "unknown";
+    currentClient = sanitizeMcpClient(`${name}/${version}`);
+}
+/**
+ * The sanitized connected-client identity, or null when no client info was
+ * available. Read by `performFetch` to attach the `X-MCP-Client` header.
+ */
+export function getMcpClient() {
+    return currentClient;
+}
+/** Test-only reset of the module-scoped slot. */
+export function __resetMcpClientForTests() {
+    currentClient = null;
+}
+//# sourceMappingURL=mcp-client-identity.js.map

package/dist/modules/apimapper/mcp-client-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-client-identity.js","sourceRoot":"","sources":["../../../src/modules/apimapper/mcp-client-identity.ts"],"names":[],"mappings":"AAAA,+CAA+C;AAC/C,EAAE;AACF,+CAA+C;AAC/C,EAAE;AACF,kEAAkE;AAClE,0EAA0E;AAC1E,6EAA6E;AAC7E,8EAA8E;AAC9E,yEAAyE;AACzE,6EAA6E;AAC7E,2EAA2E;AAC3E,sCAAsC;AACtC,EAAE;AACF,oEAAoE;AACpE,0EAA0E;AAC1E,0EAA0E;AAC1E,0EAA0E;AAE1E,+EAA+E;AAC/E,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,IAAI,aAAa,GAAkB,IAAI,CAAC;AAExC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAA8B;IAC9D,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,+GAA+G;IAC/G,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACxF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,IAAqD;IAChF,MAAM,IAAI,GAAG,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,aAAa,GAAG,IAAI,CAAC;QACrB,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,IAAI,EAAE,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3G,aAAa,GAAG,iBAAiB,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,wBAAwB;IACtC,aAAa,GAAG,IAAI,CAAC;AACvB,CAAC"}

package/dist/modules/apimapper/merge-constants.d.ts

@@ -0,0 +1,6 @@
+export declare const MERGE_STRATEGIES: readonly ["concat", "join"];
+export type MergeStrategyCanonical = (typeof MERGE_STRATEGIES)[number];
+export declare const MERGE_STRATEGIES_INPUT: readonly ["join", "concat", "append"];
+export type MergeStrategyInput = (typeof MERGE_STRATEGIES_INPUT)[number];
+export declare const MERGE_JOIN_TYPES: readonly ["left", "right", "inner", "outer"];
+export type MergeJoinType = (typeof MERGE_JOIN_TYPES)[number];

package/dist/modules/apimapper/merge-constants.js

@@ -0,0 +1,26 @@
+// src/modules/apimapper/merge-constants.ts — single source of merge enums.
+//
+// F156 — before this module the merge `strategy` + `joinType` enums were
+// declared THREE times with divergent values:
+//   • node-schema.ts mergeNodeSchema: strategy ['concat','join'],
+//     joinType ['left','right','inner','outer']  (the raw-graph write path)
+//   • workflows.ts MergeSpec / flow_change_merge_strategy: strategy
+//     ['join','concat','append'], joinType ['left','inner']  (composite path)
+// A cold agent that learned `joinType:'outer'` from one path got a hard Zod
+// reject on the other, and `append` was accepted in one place but not the
+// other. Centralising the enums here removes that drift.
+//
+// Wire contract (ground truth — MergeNodeExecutor.php:50 + the FlowCompiler
+// normaliser): the backend persists only 'concat' / 'join'. 'append' is a
+// customer-facing UI alias that normalizeMergeStrategy() folds to 'concat'.
+//
+//   - MERGE_STRATEGIES        = the CANONICAL set the raw node schema enforces.
+//   - MERGE_STRATEGIES_INPUT  = the canonical set PLUS the 'append' alias, for
+//                               the agent-facing composite tools that accept it
+//                               and normalize down to 'concat'.
+//   - MERGE_JOIN_TYPES        = the full SQL-style join kinds the executor
+//                               supports (left/right/inner/outer).
+export const MERGE_STRATEGIES = ["concat", "join"];
+export const MERGE_STRATEGIES_INPUT = ["join", "concat", "append"];
+export const MERGE_JOIN_TYPES = ["left", "right", "inner", "outer"];
+//# sourceMappingURL=merge-constants.js.map

package/dist/modules/apimapper/merge-constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"merge-constants.js","sourceRoot":"","sources":["../../../src/modules/apimapper/merge-constants.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,EAAE;AACF,yEAAyE;AACzE,8CAA8C;AAC9C,kEAAkE;AAClE,4EAA4E;AAC5E,oEAAoE;AACpE,8EAA8E;AAC9E,4EAA4E;AAC5E,0EAA0E;AAC1E,yDAAyD;AACzD,EAAE;AACF,4EAA4E;AAC5E,0EAA0E;AAC1E,4EAA4E;AAC5E,EAAE;AACF,gFAAgF;AAChF,+EAA+E;AAC/E,gFAAgF;AAChF,gEAAgE;AAChE,2EAA2E;AAC3E,mEAAmE;AAEnE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAU,CAAC;AAG5D,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAC;AAG5E,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAU,CAAC"}

package/dist/modules/apimapper/node-schema.d.ts

@@ -35,7 +35,13 @@ export declare const filterNodeSchema: z.ZodObject<{
         y: z.ZodNumber;
     }, z.core.$strip>;
     data: z.ZodObject<{
-        conditions: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        conditions: z.ZodArray<z.ZodObject<{
+            field: z.ZodString;
+            operator: z.ZodEnum<{
+                [x: string]: string;
+            }>;
+            value: z.ZodOptional<z.ZodUnknown>;
+        }, z.core.$loose>>;
         logic: z.ZodOptional<z.ZodEnum<{
             or: "or";
             and: "and";
@@ -75,6 +81,16 @@ export declare const mergeNodeSchema: z.ZodObject<{
         }>>;
     }, z.core.$loose>;
 }, z.core.$strip>;
+export declare const OUTPUT_NODE_TYPES: readonly ["output", "output-yootheme", "output-shortcode"];
+export type OutputNodeType = (typeof OUTPUT_NODE_TYPES)[number];
+/**
+ * True when a node is any kind of terminal output node. Mirrors
+ * FlowCompiler::isOutputNodeType (PHP). Accepts a minimal `{ type }` shape so
+ * it works on both strict FlowNodes and loose wire objects.
+ */
+export declare function isOutputNode(node: {
+    type?: unknown;
+} | null | undefined): boolean;
 export declare const outputNodeSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     id: z.ZodString;
     type: z.ZodLiteral<"output">;
@@ -143,7 +159,13 @@ export declare const nodeSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
         y: z.ZodNumber;
     }, z.core.$strip>;
     data: z.ZodObject<{
-        conditions: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        conditions: z.ZodArray<z.ZodObject<{
+            field: z.ZodString;
+            operator: z.ZodEnum<{
+                [x: string]: string;
+            }>;
+            value: z.ZodOptional<z.ZodUnknown>;
+        }, z.core.$loose>>;
         logic: z.ZodOptional<z.ZodEnum<{
             or: "or";
             and: "and";
@@ -240,6 +262,34 @@ export declare const edgeSchema: z.ZodObject<{
     targetHandle: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type FlowEdge = z.infer<typeof edgeSchema>;
+/**
+ * Stamp a stable `id` on every edge that lacks one, at the create/update wire
+ * boundary (flow_create / flow_update / graph_preview / graph_validate).
+ *
+ * Why this exists (F5, 2026-06-09): `edgeSchema` marks `id` OPTIONAL — the AI
+ * legitimately omits it — but the React-Flow runtime + the backend graph
+ * validator key edges by `id` and reject an id-less edge with a misleading
+ * "connectivity" error. Rather than make `id` required at the schema (which
+ * would force every caller to invent ids), we generate a deterministic one
+ * here so BOTH the schema and the runtime accept id-less edges. `buildFlowGraph`
+ * already emits ids for its synthetic graphs; this closes the gap for
+ * hand-authored `flow_create` / `flow_update` graphs.
+ *
+ * Id shape: `e-<source>-<target>` (matches the convention `buildFlowGraph`
+ * already uses). Parallel edges between the same node pair — e.g. the two
+ * inputs of a merge node — get a `-2`, `-3`, … suffix. A generated id never
+ * collides with a caller-supplied id (or an already-generated one): the suffix
+ * search skips any id already taken in this batch.
+ *
+ * Pure + non-mutating: returns a NEW array of NEW edge objects; the input is
+ * left untouched. A non-array input yields `[]` (defensive — the wire boundary
+ * already validated, but a direct programmatic caller might not have).
+ */
+export declare function ensureEdgeIds<E extends {
+    id?: unknown;
+    source?: unknown;
+    target?: unknown;
+}>(edges: E[]): E[];
 /**
  * W1.18 (F-32): case-insensitive substring filter applied in-memory after
  * the upstream list fetch.