actual-mcp-server 0.12.0 → 0.13.0

package/README.md

@@ -312,10 +312,10 @@ For Claude Desktop (stdio), restart Claude after upgrading.
 |------|-------------|
 | `actual_accounts_list` | List all accounts |
 | `actual_accounts_create` | Create new account |
-| `actual_accounts_update` | Update account details |
+| `actual_accounts_update` | Update account details. An id that does not exist is refused rather than creating a partial record |
 | `actual_accounts_delete` | Permanently delete account |
 | `actual_accounts_close` | Close account. An account with NO transactions is REMOVED by Actual, not closed |
-| `actual_accounts_reopen` | Reopen closed account |
+| `actual_accounts_reopen` | Reopen closed account. An id that is not an account is refused rather than creating one |
 | `actual_accounts_get_balance` | Get account balance at a date |
 
 ### Transactions (14)
@@ -406,10 +406,10 @@ For Claude Desktop (stdio), restart Claude after upgrading.
 | `actual_budgets_get_all` | List available budget files |
 | `actual_budgets_getMonths` | List budget months |
 | `actual_budgets_getMonth` | Get budget for a specific month |
-| `actual_budgets_setAmount` | Set category budget amount |
+| `actual_budgets_setAmount` | Set category budget amount. The month must be one the budget has (see `actual_budgets_getMonths`) |
 | `actual_budgets_transfer` | Transfer amount between categories |
 | `actual_budgets_setCarryover` | Enable/disable carryover |
-| `actual_budgets_holdForNextMonth` | Hold funds for next month |
+| `actual_budgets_holdForNextMonth` | Hold funds for next month. Actual clamps the hold to what is left to budget, so the response reports the amount actually held |
 | `actual_budgets_resetHold` | Reset hold status |
 | `actual_budgets_export` | Export the active budget as a `.zip` into `ACTUAL_EXPORT_DIR`; returns path, byte size and sha256, never the file contents |
 | `actual_budgets_import` | Restore a budget from an Actual `.zip` or a YNAB4/YNAB5 export. **Destructive:** the budget id comes from the archive, so re-importing an export *replaces* that budget's data rather than making a copy. Also loads the imported budget, changing the session's active budget |
@@ -774,7 +774,7 @@ The software is provided **as-is**, without warranty of any kind. The author acc
 
 ---
 
-**Version:** 0.12.0 | **Tool Count:** 74 (verified LibreChat-compatible)
+**Version:** 0.13.0 | **Tool Count:** 74 (verified LibreChat-compatible)
 
 ## Sponsor
 

package/dist/src/lib/actual-adapter.js

@@ -999,6 +999,21 @@ export async function setBudgetAmount(month, categoryId, amount) {
         if (!exists) {
             throw new Error(`Category "${categoryId}" not found. Use actual_categories_get to list available categories.`);
         }
+        // #361: the MONTH is unvalidated, in format AND range. `api/budget-set-amount` is the
+        // one budget handler that does not call upstream's `validateMonth`, unlike
+        // budget-set-carryover, budget-hold-for-next-month and budget-reset-hold, and the
+        // tool's schema is a bare `z.string().min(1)`, so even 'banana' reaches this point.
+        // Upstream then runs `dbMonth(month)` and INSERTs a row keyed `<month>-<category>`.
+        //
+        // A membership test against the budget's own months covers both halves at once:
+        // upstream's `validateMonth` and `api/budget-months` share the same
+        // `get-budget-bounds()` plus `range()` computation, so this reproduces its range check
+        // exactly, and a malformed string cannot be a member either.
+        const months = await withConcurrency(() => retry(() => rawGetBudgetMonths(), { retries: 2, backoffMs: 200 }));
+        if (Array.isArray(months) && months.length > 0 && !months.includes(String(month))) {
+            throw new Error(`Month "${month}" is not in this budget. It runs from ${months[0]} to ${months[months.length - 1]}. ` +
+                'Use actual_budgets_getMonths to see the months you can budget to.');
+        }
         const result = await withConcurrency(() => retry(() => rawSetBudgetAmount(month, categoryId, amount), { retries: 2, backoffMs: 200, isRetryable: isRetryableError }));
         return result;
     });
@@ -1052,6 +1067,15 @@ export async function createAccount(account, initialBalance) {
 export async function updateAccount(id, fields) {
     observability.incrementToolCall('actual.accounts.update').catch(() => { });
     return queueWriteOperation(async () => {
+        // #360: `db.update` does not run a SQL UPDATE. It sends CRDT messages, and the apply
+        // path INSERTs when the row was absent, so an unknown id CREATES a partial row rather
+        // than matching nothing. Refuse first, the way updateTag and updateRule already do.
+        // A CLOSED account is still updatable: getAccounts filters `tombstone = 0`, not
+        // `closed = 0`, so this refuses only ids that genuinely do not exist.
+        const accounts = await withConcurrency(() => retry(() => rawGetAccounts(), { retries: 2, backoffMs: 200 }));
+        if (!(Array.isArray(accounts) && accounts.some((a) => a?.id === id))) {
+            throw new Error(notFoundMsg('Account', id, 'actual_accounts_list'));
+        }
         await withConcurrency(() => retry(() => rawUpdateAccount(id, fields), { retries: 2, backoffMs: 200, isRetryable: isRetryableError }));
         return null;
     });
@@ -1213,6 +1237,15 @@ export async function deleteTransaction(id) {
 export async function updateCategory(id, fields) {
     observability.incrementToolCall('actual.categories.update').catch(() => { });
     return queueWriteOperation(async () => {
+        // #360: `db.update` does not run a SQL UPDATE. It sends CRDT messages, and the apply
+        // path INSERTs when the row was absent, so an unknown id CREATES a partial row rather
+        // than matching nothing. Refuse first, the way updateTag and updateRule already do.
+        // Called with no argument, upstream returns every category in every group, hidden
+        // included, so a hidden category is not misreported as missing.
+        const categories = await withConcurrency(() => retry(() => rawGetCategories(), { retries: 2, backoffMs: 200 }));
+        if (!(Array.isArray(categories) && categories.some((c) => c?.id === id))) {
+            throw new Error(notFoundMsg('Category', id, 'actual_categories_get'));
+        }
         await withConcurrency(() => retry(() => rawUpdateCategory(id, fields), { retries: 2, backoffMs: 200, isRetryable: isRetryableError }));
     });
 }
@@ -1231,6 +1264,20 @@ export async function deleteCategory(id) {
 export async function updatePayee(id, fields) {
     observability.incrementToolCall('actual.payees.update').catch(() => { });
     return queueWriteOperation(async () => {
+        // #360: `db.update` does not run a SQL UPDATE. It sends CRDT messages, and the apply
+        // path INSERTs when the row was absent, so an unknown id CREATES a partial row rather
+        // than matching nothing. Refuse first, the way updateTag and updateRule already do.
+        // Known edge, and why it is acceptable: `db.getPayees()` excludes a transfer payee whose
+        // linked account has been hard-tombstoned, so such an orphan is refused here as
+        // not-found. A caller CAN hold such an id (transaction rows carry `payee`, and
+        // actual_entities_search and actual_get_id_by_name surface ids too), so this is not
+        // strictly unreachable. It is accepted because updating an orphaned transfer payee,
+        // whose account no longer exists, is not a real workflow, and because the alternative
+        // is leaving four tools able to create phantom rows.
+        const payees = await withConcurrency(() => retry(() => rawGetPayees(), { retries: 2, backoffMs: 200 }));
+        if (!(Array.isArray(payees) && payees.some((p) => p?.id === id))) {
+            throw new Error(notFoundMsg('Payee', id, 'actual_payees_get'));
+        }
         const fieldsObj = fields;
         // Extract `category` — it is NOT a direct column on the payees table in Actual Budget.
         // The "default category" feature is implemented via rules (condition: payee is X → action: set category).
@@ -1418,27 +1465,145 @@ export async function setBudgetCarryover(month, categoryId, flag) {
     });
 }
 /**
- * #357: forwards the two transfer arguments the published API documents.
+ * #357, at the adapter layer since #371.
+ *
+ * Three upstream behaviours have to be handled together, because any one of them rewrites
+ * this function:
  *
- * `closeAccount(id, transferAccountId?, transferCategoryId?)` is the documented
- * signature, and upstream throws `balance is non-zero: transferAccountId is required`
- * when an account with a balance is closed without one. This adapter used to pass the
- * id alone, so an account with a non-zero balance could not be closed through this
- * server at all: the caller was told to supply a parameter no tool accepted.
+ *  (a) `closeAccount` opens with `if (!account || account.closed === 1) return;`, so an
+ *      unknown id or an already-closed account did nothing and reported success.
+ *  (b) `if (numTransactions === 0) await db.deleteAccount({id})`: an account with no
+ *      transactions is TOMBSTONED, not closed, and cannot be reopened.
+ *  (c) a non-zero balance throws `balance is non-zero: transferAccountId is required`, and
+ *      the transfer arguments are documented but were not exposed until #357.
  *
- * Both remain OPTIONAL. A zero-balance account still closes with the id alone.
+ * Read, write and re-read share ONE `queueWriteOperation` cycle. A read-BEFORE is required
+ * (unlike #347's pure verify-after) because (b) makes "absent afterwards" ambiguous: an
+ * account deleted by the close and an id that never existed look identical from a single
+ * post-read.
+ *
+ * WHY THIS LIVES HERE AND NOT IN THE TOOL. It was in the tool until #371. Keeping the read
+ * and the write in one cycle does NOT require the raw api: this is the shape
+ * `mergePayees` already used, and doing it here keeps `retry` on the reads, keeps ONE
+ * observability call site, and leaves no unguarded `adapter.closeAccount` for a future
+ * caller to reach for. The tool maps the outcome below onto its response wording.
  */
 export async function closeAccount(id, transferAccountId, transferCategoryId) {
     observability.incrementToolCall('actual.accounts.close').catch(() => { });
     return queueWriteOperation(async () => {
-        // Non-idempotent: do not retry (#165).
-        await withConcurrency(() => retry(() => rawCloseAccount(id, transferAccountId, transferCategoryId), { retries: 0, backoffMs: 200 }));
+        const before = await withConcurrency(() => retry(() => rawGetAccounts(), { retries: 2, backoffMs: 200 }));
+        const list = Array.isArray(before) ? before : [];
+        const target = list.find((a) => a?.id === id);
+        if (!target) {
+            throw new Error(`Account "${id}" not found. Use actual_accounts_list to see the accounts that exist. ` +
+                'Note that an account closed while it had no transactions was REMOVED by Actual, ' +
+                'not closed, so it will not appear there.');
+        }
+        if (target.closed === true) {
+            // Idempotent and truthful: the requested state already holds, and the caller is told
+            // that nothing changed rather than being implied a state change happened.
+            return { outcome: 'already-closed', name: target.name };
+        }
+        if (transferAccountId) {
+            const destination = list.find((a) => a?.id === transferAccountId);
+            if (!destination) {
+                throw new Error(`Transfer destination account "${transferAccountId}" not found. Use ` +
+                    'actual_accounts_list to pick an account to move the remaining balance to.');
+            }
+            if (destination.closed === true) {
+                throw new Error(`Transfer destination account "${destination.name ?? transferAccountId}" is CLOSED, ` +
+                    'so the closing balance would be moved somewhere hidden from most views. Pick an ' +
+                    'open account, or reopen that one with actual_accounts_reopen first.');
+            }
+        }
+        if (transferCategoryId) {
+            // #359's lesson applied to the only WRITE this path can add. Upstream forwards this id
+            // straight into `transaction-add` unchecked, so a bogus value writes a "Closing
+            // account" transaction carrying a category that does not exist, and syncs it.
+            const categories = await withConcurrency(() => retry(() => rawGetCategories(), { retries: 2, backoffMs: 200 }));
+            const known = Array.isArray(categories) && categories.some((c) => c?.id === transferCategoryId);
+            if (!known) {
+                throw new Error(`Transfer category "${transferCategoryId}" not found. Use actual_categories_get to ` +
+                    'pick a category for the closing transaction, or omit transferCategoryId to leave ' +
+                    'it uncategorised.');
+            }
+        }
+        try {
+            // Non-idempotent: do not retry (#165).
+            await withConcurrency(() => retry(() => rawCloseAccount(id, transferAccountId, transferCategoryId), { retries: 0, backoffMs: 200 }));
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            if (/balance is non-zero/i.test(msg)) {
+                throw new Error(`Account "${target.name ?? id}" has a non-zero balance, so closing it requires ` +
+                    'transferAccountId: the id of the account to move the remaining balance to. ' +
+                    'Optionally pass transferCategoryId to categorise the balancing transaction. ' +
+                    'Use actual_accounts_list to pick a destination.');
+            }
+            throw err;
+        }
+        const after = await withConcurrency(() => retry(() => rawGetAccounts(), { retries: 2, backoffMs: 200 }));
+        const survivor = (Array.isArray(after) ? after : []).find((a) => a?.id === id);
+        if (!survivor) {
+            // (b): upstream tombstoned a zero-transaction account instead of closing it.
+            return { outcome: 'removed', name: target.name };
+        }
+        if (survivor.closed !== true) {
+            throw new Error(`Account "${survivor.name ?? id}" (${id}) is still open after the close. The call was ` +
+                'accepted but had no effect; check the account state in Actual.');
+        }
+        return { outcome: 'closed', name: survivor.name };
     });
 }
+/**
+ * #358, at the adapter layer since #371.
+ *
+ * Upstream `reopenAccount` is a bare `db.update('accounts', {id, closed: 0})`. `db.update`
+ * does not run a SQL UPDATE: it sends CRDT messages, and the apply path INSERTs when the
+ * row was absent. The accounts table has no NOT NULL columns and `tombstone` defaults to 0,
+ * while `getAccounts()` filters `tombstone = 0`, so reopening an id that is not an account
+ * CREATES a visible nameless account that syncs to every client.
+ *
+ * A pre-check is right here and was wrong in #347: there, the caller's intent ("make this
+ * account not exist") could already be satisfied by an absent row, so refusing on absence
+ * would have failed a complete request. Here the intent ("reopen this account") cannot be
+ * satisfied by an absent row, and proceeding actively creates one.
+ *
+ * TWO DELIBERATE LIMITS, carried over from the tool-layer version so they are not
+ * rediscovered as oversights.
+ *
+ * One `queueWriteOperation` keeps this read, write and re-read in a single api lock cycle.
+ * It does NOT serialise against other operations in the same batch: `processWriteQueue`
+ * dispatches with `Promise.allSettled`, so operations queued in the same drain window
+ * interleave at await points. The cycle excludes other SESSIONS, not batch siblings.
+ *
+ * The not-found message covers both reasons an id can be missing (never existed, or removed
+ * by a close while it had no transactions) rather than distinguishing them. `q().withDead()`
+ * would tell them apart by reading tombstoned rows, at the cost of an extra query on the
+ * failure path. Collapsing them was chosen because the message names both cases and the
+ * remedy is the same either way.
+ */
 export async function reopenAccount(id) {
     observability.incrementToolCall('actual.accounts.reopen').catch(() => { });
     return queueWriteOperation(async () => {
+        const before = await withConcurrency(() => retry(() => rawGetAccounts(), { retries: 2, backoffMs: 200 }));
+        const target = (Array.isArray(before) ? before : []).find((a) => a?.id === id);
+        if (!target) {
+            throw new Error(`Account "${id}" not found, so it cannot be reopened. Use actual_accounts_list to see ` +
+                'the accounts that exist. If this account was closed while it had no transactions, ' +
+                'Actual removed it rather than closing it, and it cannot be reopened: create a new ' +
+                'one with actual_accounts_create.');
+        }
         await withConcurrency(() => retry(() => rawReopenAccount(id), { retries: 2, backoffMs: 200 }));
+        const after = await withConcurrency(() => retry(() => rawGetAccounts(), { retries: 2, backoffMs: 200 }));
+        const survivor = (Array.isArray(after) ? after : []).find((a) => a?.id === id);
+        if (!survivor) {
+            throw new Error(`Account "${id}" disappeared while being reopened. Check the account state in Actual.`);
+        }
+        if (survivor.closed === true) {
+            throw new Error(`Account "${survivor.name ?? id}" (${id}) is still closed after the reopen. The call ` +
+                'was accepted but had no effect; check the account state in Actual.');
+        }
     });
 }
 export async function getCategoryGroups() {
@@ -1459,6 +1624,16 @@ export async function createCategoryGroup(group) {
 export async function updateCategoryGroup(id, fields) {
     observability.incrementToolCall('actual.category_groups.update').catch(() => { });
     return queueWriteOperation(async () => {
+        // #360: `db.update` does not run a SQL UPDATE. It sends CRDT messages, and the apply
+        // path INSERTs when the row was absent, so an unknown id CREATES a partial row rather
+        // than matching nothing. Refuse first, the way updateTag and updateRule already do.
+        // Called with no argument, upstream returns all groups including hidden ones, so a
+        // hidden group is not misreported as missing (the same reason category_groups_delete
+        // can rely on this listing).
+        const groups = await withConcurrency(() => retry(() => rawGetCategoryGroups(), { retries: 2, backoffMs: 200 }));
+        if (!(Array.isArray(groups) && groups.some((g) => g?.id === id))) {
+            throw new Error(notFoundMsg('Category group', id, 'actual_category_groups_get'));
+        }
         await withConcurrency(() => retry(() => rawUpdateCategoryGroup(id, fields), { retries: 2, backoffMs: 200, isRetryable: isRetryableError }));
     });
 }
@@ -1598,16 +1773,38 @@ export async function batchBudgetUpdates(fn) {
  * `undefined` is deliberately NOT treated as a refusal: an older or future build
  * that returns nothing must keep working. Only an explicit `false` is a verdict.
  */
+/**
+ * #355, at the adapter layer since #371.
+ *
+ * Upstream has TWO ways of doing less than asked, and only one of them is a boolean:
+ *
+ *   holdForNextMonth:    if (toBudget > 0) { ...; return true; } return false;
+ *   calcBufferedAmount:  amount = Math.min(Math.max(amount, -buffered), Math.max(toBudget, 0));
+ *
+ * So `false` means nothing was held, and `true` can still mean a PARTIAL hold: ask for
+ * 100.00 with 30.00 left to budget and 30.00 is held, silently. Reading `forNextMonth`
+ * before and after settles both from observed state, which is the #347 principle and is
+ * strictly better than trusting either return value.
+ *
+ * Returns the amount ACTUALLY held. The caller compares it with what it requested.
+ */
 export async function holdBudgetForNextMonth(month, amount) {
     observability.incrementToolCall('actual.budgets.holdForNextMonth').catch(() => { });
     return queueWriteOperation(async () => {
+        // `isRetryable` matters here, unlike most read sites: upstream's `api/budget-month` opens
+        // with `validateMonth` and throws for an out-of-range month. Without a classifier,
+        // retry() retries EVERY rejection (see retry.ts), so a deterministic domain error would
+        // cost three upstream calls and 600ms of sleeping inside the api mutex, against the one
+        // withOpTimeout budget this whole callback shares. #177 doctrine: domain errors are
+        // terminal.
+        const before = await withConcurrency(() => retry(() => rawGetBudgetMonth(month), { retries: 2, backoffMs: 200, isRetryable: isRetryableError }));
+        const heldBefore = Number(before?.forNextMonth ?? 0);
         // Non-idempotent: do not retry (#165). `calcBufferedAmount` is ADDITIVE
         // (`return buffered + amount`), so a second attempt after a committed first does not
-        // re-set the buffer, it adds to it. The window is narrow, because the call runs
-        // against local SQLite and no `TRANSIENT_ERROR_PATTERNS` message can arise inside
-        // it, but the operation is non-idempotent by construction and belongs on the same
-        // footing as `deleteRule` and `closeAccount`.
-        return await withConcurrency(() => retry(() => rawHoldBudgetForNextMonth(month, amount), { retries: 0, backoffMs: 200 }));
+        // re-set the buffer, it adds to it.
+        await withConcurrency(() => retry(() => rawHoldBudgetForNextMonth(month, amount), { retries: 0, backoffMs: 200 }));
+        const after = await withConcurrency(() => retry(() => rawGetBudgetMonth(month), { retries: 2, backoffMs: 200, isRetryable: isRetryableError }));
+        return Number(after?.forNextMonth ?? 0) - heldBefore;
     });
 }
 export async function resetBudgetHold(month) {

package/dist/src/tools/accounts_close.js

@@ -1,9 +1,5 @@
 import { z } from 'zod';
 import adapter from '../lib/actual-adapter.js';
-import * as observability from '../observability.js';
-import api from '@actual-app/api';
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-const { getAccounts: rawGetAccounts, getCategories: rawGetCategories, closeAccount: rawCloseAccount } = api;
 const InputSchema = z
     .object({
     id: z.string().min(1).max(64).describe('Account ID to close'),
@@ -33,40 +29,13 @@ const InputSchema = z
     }
 });
 /**
- * #357: three defects on one code path, fixed together because any one of them
- * rewrites this handler.
+ * #357. The three defects (silent no-op on unknown or already-closed, close-deletes a
+ * zero-transaction account, and the documented transfer arguments that were not exposed)
+ * are handled in `adapter.closeAccount`, which reads, writes and re-reads in one write-queue
+ * cycle and returns WHICH of the three outcomes happened.
  *
- * (a) FALSE SUCCESS. Upstream `closeAccount` opens with
- *     `if (!account || account.closed === 1) { return; }`, so closing an unknown id
- *     or an already-closed account did nothing and reported success. Same upstream
- *     early-return that produced #347.
- *
- * (b) CLOSE CAN DELETE. `if (numTransactions === 0) { await db.deleteAccount({id}); }`.
- *     An account with no transactions is TOMBSTONED rather than closed, it disappears
- *     from every listing, and `actual_accounts_reopen` cannot bring it back. The old
- *     description promised "their transaction history is preserved", which is false in
- *     exactly this case. The repo already knew: tests/manual/tests/account.js adds a
- *     dummy transaction with a comment explaining it.
- *
- * (c) A BALANCE MADE IT UNCLOSABLE. `transferAccountId` and `transferCategoryId` are
- *     documented parameters, the schema did not accept them, and upstream throws
- *     `balance is non-zero: transferAccountId is required` without them. The caller
- *     was told to supply something no tool would take.
- *
- * The read, the write and the verification run inside ONE `withWriteSession` cycle
- * (#142). A read-BEFORE is required here, unlike #347's pure verify-after, because (b)
- * makes "absent afterwards" ambiguous: an account deleted by the close and an id that
- * never existed look identical from a single post-read.
- *
- * Going through the raw api inside the session means this path no longer gets the
- * adapter's `retry`. That is inherent to the #142 pattern, shared with every tool using
- * it, and it is the half of #368 that still stands. The per-tool counter is NOT lost:
- * it is incremented in the handler below.
- *
- * Already-closed is reported as success rather than as an error, deliberately. The
- * caller's intent ("this account should be closed") is already satisfied, which is the
- * same idempotence argument #347 used for delete. What changes is that the response no
- * longer CLAIMS a state change that did not happen.
+ * #371 moved that logic there from this file. This tool now owns only the published schema
+ * and the response wording, which is where the rest of the tool surface keeps them.
  */
 const tool = {
     name: 'actual_accounts_close',
@@ -78,95 +47,25 @@ const tool = {
     inputSchema: InputSchema,
     call: async (args, _meta) => {
         const input = InputSchema.parse(args || {});
-        // #368: the adapter method that used to own this counter is no longer on the path,
-        // because this tool reads and writes through the raw api inside one session. Counting
-        // here keeps `actual.accounts.close` honest; the retry half of #368 still stands.
-        observability.incrementToolCall('actual.accounts.close').catch(() => { });
-        return await adapter.withWriteSession(async () => {
-            const before = (await rawGetAccounts());
-            const target = Array.isArray(before) ? before.find((a) => a?.id === input.id) : undefined;
-            if (!target) {
-                throw new Error(`Account "${input.id}" not found. Use actual_accounts_list to see the accounts that ` +
-                    'exist. Note that an account closed while it had no transactions was REMOVED by ' +
-                    'Actual, not closed, so it will not appear there.');
-            }
-            if (target.closed === true) {
-                // Idempotent and truthful: the requested state already holds, and the response
-                // says so instead of implying this call changed anything.
+        const result = await adapter.closeAccount(input.id, input.transferAccountId, input.transferCategoryId);
+        const name = result.name ?? input.id;
+        switch (result.outcome) {
+            case 'already-closed':
                 return {
                     success: true,
                     alreadyClosed: true,
-                    message: `Account "${target.name ?? input.id}" was already closed. Nothing changed.`,
+                    message: `Account "${name}" was already closed. Nothing changed.`,
                 };
-            }
-            if (input.transferAccountId) {
-                const destination = Array.isArray(before)
-                    ? before.find((a) => a?.id === input.transferAccountId)
-                    : undefined;
-                if (!destination) {
-                    throw new Error(`Transfer destination account "${input.transferAccountId}" not found. Use ` +
-                        'actual_accounts_list to pick an account to move the remaining balance to.');
-                }
-                if (destination.closed === true) {
-                    // The balancing transaction would land in a closed account, where it is hidden
-                    // from most views. Upstream does not stop this; refusing is the kinder answer.
-                    throw new Error(`Transfer destination account "${destination.name ?? input.transferAccountId}" is ` +
-                        'CLOSED, so the closing balance would be moved somewhere hidden from most views. ' +
-                        'Pick an open account, or reopen that one with actual_accounts_reopen first.');
-                }
-            }
-            if (input.transferCategoryId) {
-                // #359's lesson, applied to the only NEW write this change adds. Upstream forwards
-                // this id straight into `transaction-add` without checking it (api.ts's
-                // account-close passes it as `categoryId`, and addTransaction is a bare batch
-                // update), so a bogus value writes a "Closing account" transaction carrying a
-                // category that does not exist, and syncs it to every client. Same dangling
-                // reference the transactions_create guard exists to prevent.
-                const categories = (await rawGetCategories());
-                const categoryExists = Array.isArray(categories)
-                    ? categories.some((c) => c?.id === input.transferCategoryId)
-                    : false;
-                if (!categoryExists) {
-                    throw new Error(`Transfer category "${input.transferCategoryId}" not found. Use ` +
-                        'actual_categories_get to pick a category for the closing transaction, or omit ' +
-                        'transferCategoryId to leave it uncategorised.');
-                }
-            }
-            try {
-                await rawCloseAccount(input.id, input.transferAccountId, input.transferCategoryId);
-            }
-            catch (err) {
-                const msg = err instanceof Error ? err.message : String(err);
-                if (/balance is non-zero/i.test(msg)) {
-                    // Translate upstream's message into one the caller can act on, now that the
-                    // parameter it asks for actually exists on this tool.
-                    throw new Error(`Account "${target.name ?? input.id}" has a non-zero balance, so closing it requires ` +
-                        'transferAccountId: the id of the account to move the remaining balance to. ' +
-                        'Optionally pass transferCategoryId to categorise the balancing transaction. ' +
-                        'Use actual_accounts_list to pick a destination.');
-                }
-                throw err;
-            }
-            // Verify the effect rather than the call returning (#347).
-            const after = (await rawGetAccounts());
-            const survivor = Array.isArray(after) ? after.find((a) => a?.id === input.id) : undefined;
-            if (!survivor) {
-                // Defect (b): upstream tombstones a zero-transaction account instead of closing
-                // it. Saying so is the whole point; the old description claimed the opposite.
+            case 'removed':
                 return {
                     success: true,
                     removed: true,
-                    message: `Account "${target.name ?? input.id}" had no transactions, so Actual REMOVED it ` +
-                        'rather than closing it. It will not appear in actual_accounts_list and cannot be ' +
-                        'reopened.',
+                    message: `Account "${name}" had no transactions, so Actual REMOVED it rather than closing ` +
+                        'it. It will not appear in actual_accounts_list and cannot be reopened.',
                 };
-            }
-            if (survivor.closed !== true) {
-                throw new Error(`Account "${survivor.name ?? input.id}" (${input.id}) is still open after the close. ` +
-                    'The call was accepted but had no effect; check the account state in Actual.');
-            }
-            return { success: true, closed: true };
-        });
+            default:
+                return { success: true, closed: true };
+        }
     },
 };
 export default tool;

package/dist/src/tools/accounts_reopen.js

@@ -1,9 +1,5 @@
 import { z } from 'zod';
 import adapter from '../lib/actual-adapter.js';
-import * as observability from '../observability.js';
-import api from '@actual-app/api';
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-const { getAccounts: rawGetAccounts, reopenAccount: rawReopenAccount } = api;
 const InputSchema = z.object({
     // Bounded, because the id is echoed into the error message and into the structured
     // logs. Not tightened to CommonSchemas.accountId (a UUID) here: several fixtures use
@@ -11,58 +7,13 @@ const InputSchema = z.object({
     id: z.string().min(1).max(64).describe('Account ID to reopen'),
 });
 /**
- * #358: this tool used to call reopen and return `{success: true}` unconditionally.
- * For an id that is not an account, that was not merely a false success: it CREATED
- * a nameless account.
+ * #358. The guard lives in `adapter.reopenAccount`, which reads, writes and re-reads inside
+ * one write-queue cycle. See that function for why a pre-check is right here and was wrong
+ * in #347.
  *
- * Verified in upstream source (26.8.0). `reopenAccount` is a bare update:
- *
- *   async function reopenAccount({ id }) { await db.update('accounts', { id, closed: 0 }); }
- *
- * `db.update` does not run a SQL UPDATE. It sends CRDT messages, and `apply()` in
- * loot-core/src/server/sync/index.ts picks INSERT when the row was absent from the
- * pre-read:
- *
- *   INSERT INTO accounts (id, closed) VALUES (?, ?)
- *
- * The accounts table has no NOT NULL columns and `tombstone` defaults to 0, while
- * `getAccounts()` selects `WHERE a.tombstone = 0`. So the phantom row is a fully
- * visible account with a null name, and because it is a CRDT message it SYNCS to
- * every other client on the budget.
- *
- * WHY A PRE-CHECK HERE, WHEN #347 DELIBERATELY REJECTED ONE.
- *
- * The two cases look identical and are not. In #347 the caller's intent ("make this
- * account not exist") could ALREADY be satisfied by an absent row, so refusing on
- * absence would have failed a request that was in fact complete. Here the caller's
- * intent ("reopen this account") cannot possibly be satisfied by an absent row, and
- * proceeding actively creates one. Refusing is the only correct answer.
- *
- * The post-verify is kept as well, so the success claim is about observed state
- * rather than about the call having returned. Read, write and re-read all run inside
- * ONE `withWriteSession` cycle (#142), which keeps them in a single api lock cycle
- * rather than three.
- *
- * What that does NOT give, stated precisely because an overstated guarantee gets relied
- * on: `processWriteQueue` dispatches a batch with `Promise.allSettled`, so operations
- * queued in the same drain window still interleave at await points. The single cycle
- * excludes other SESSIONS, not other operations in the same batch. A concurrent
- * close of the same account can therefore still land between this read and this write.
- *
- * TWO DELIBERATE LIMITS, recorded so they are not mistaken for oversights.
- *
- * The not-found message covers both reasons an id can be missing (never existed, or
- * removed by a close while it had no transactions) rather than distinguishing them.
- * `q().withDead()` would tell them apart by reading tombstoned rows, at the cost of an
- * extra query on the failure path. Collapsing them was chosen because the message names
- * both cases and the remedy is the same either way. If that proves confusing in
- * practice, `withDead()` is the tool to reach for.
- *
- * Going through the raw api inside the session means this path no longer gets the
- * adapter's `retry`. That is inherent to the #142 pattern, shared with every other tool
- * using it (`rules_delete`, `schedules_delete`, `category_groups_delete`), and it is the
- * half of #368 that still stands. The per-tool counter is NOT lost: it is incremented in
- * the handler below.
+ * #371 moved it there from this file. The read-then-write property never needed the raw
+ * api: doing it in the adapter keeps `retry` on the reads, keeps one observability call
+ * site, and leaves no unguarded `adapter.reopenAccount` for a future caller to reach for.
  */
 const tool = {
     name: 'actual_accounts_reopen',
@@ -74,32 +25,8 @@ const tool = {
     inputSchema: InputSchema,
     call: async (args, _meta) => {
         const input = InputSchema.parse(args || {});
-        // #368: the adapter method that used to own this counter is no longer on the path,
-        // because this tool reads and writes through the raw api inside one session. Counting
-        // here keeps `actual.accounts.reopen` honest; the retry half of #368 still stands.
-        observability.incrementToolCall('actual.accounts.reopen').catch(() => { });
-        return await adapter.withWriteSession(async () => {
-            const before = (await rawGetAccounts());
-            const target = Array.isArray(before) ? before.find((a) => a?.id === input.id) : undefined;
-            if (!target) {
-                throw new Error(`Account "${input.id}" not found, so it cannot be reopened. Use actual_accounts_list to ` +
-                    'see the accounts that exist. If this account was closed while it had no transactions, ' +
-                    'Actual removed it rather than closing it, and it cannot be reopened: create a new one ' +
-                    'with actual_accounts_create.');
-            }
-            await rawReopenAccount(input.id);
-            // Verify the effect rather than the call returning. Same reasoning as #347.
-            const after = (await rawGetAccounts());
-            const survivor = Array.isArray(after) ? after.find((a) => a?.id === input.id) : undefined;
-            if (!survivor) {
-                throw new Error(`Account "${input.id}" disappeared while being reopened. Check the account state in Actual.`);
-            }
-            if (survivor.closed === true) {
-                throw new Error(`Account "${survivor.name ?? input.id}" (${input.id}) is still closed after the reopen. ` +
-                    'The call was accepted but had no effect; check the account state in Actual.');
-            }
-            return { success: true };
-        });
+        await adapter.reopenAccount(input.id);
+        return { success: true };
     },
 };
 export default tool;

package/dist/src/tools/budgets_holdForNextMonth.js

@@ -1,44 +1,22 @@
 import { z } from 'zod';
 import adapter from '../lib/actual-adapter.js';
-import * as observability from '../observability.js';
-import api from '@actual-app/api';
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-const { getBudgetMonth: rawGetBudgetMonth, holdBudgetForNextMonth: rawHold } = api;
 const InputSchema = z.object({
     month: z.string().regex(/^\d{4}-(0[1-9]|1[0-2])$/, 'month must be in YYYY-MM format').describe('Budget month in YYYY-MM format'),
     // #355: upstream rejects a non-positive amount with
     // APIError('Amount to hold needs to be greater than 0') BEFORE it ever reaches
     // holdForNextMonth, so the schema rejects it here instead: same answer, no wasted
-    // round trip, and the message names the field. No working client can be sending a
-    // value upstream already refuses.
+    // round trip, and the message names the field.
     amount: z.number().int().positive('amount must be greater than 0 (integer cents)')
         .describe('Amount in cents to hold for next month. Must be greater than 0.'),
 });
 /**
- * #355: report the amount actually held, not the fact that the call returned.
+ * #355. `adapter.holdBudgetForNextMonth` reads `forNextMonth` before and after the write and
+ * returns the amount ACTUALLY held, because upstream can do less than asked in two ways: it
+ * holds nothing when the month has no positive To Budget, and it silently CLAMPS the hold to
+ * whatever is left. A boolean catches the first and misses the second.
  *
- * There are TWO ways this operation quietly does less than asked, and a boolean only
- * catches one of them.
- *
- *   upstream holdForNextMonth:
- *     if (toBudget > 0) { await setBuffer(month, calcBufferedAmount(...)); return true; }
- *     return false;
- *
- *   calcBufferedAmount:
- *     amount = Math.min(Math.max(amount, -buffered), Math.max(toBudget, 0));
- *
- * So `false` means nothing was held, and `true` can still mean a PARTIAL hold: ask for
- * 100.00 when only 30.00 is left to budget and 30.00 is held, silently, with a `true`.
- * Reporting plain success for that is the same defect in a different costume.
- *
- * Reading `forNextMonth` (the buffered amount) before and after settles both cases from
- * observed state rather than from a return value, which is the #347 principle. Both
- * reads and the write share ONE `withWriteSession` cycle (#142).
- *
- * Cost and trade-off, recorded: two extra reads on a low-frequency budget tool, and the
- * raw-call path forgoes the adapter's retry, which is inherent to the #142 pattern and is
- * the half of #368 that still stands. The per-tool counter is NOT lost: it is incremented
- * in the handler below.
+ * #371 moved that logic into the adapter from this file. This tool owns the schema and the
+ * wording of the three answers: held in full, held in part, held nothing.
  */
 const tool = {
     name: 'actual_budgets_holdForNextMonth',
@@ -50,34 +28,23 @@ const tool = {
     inputSchema: InputSchema,
     call: async (args, _meta) => {
         const input = InputSchema.parse(args || {});
-        // #368: the adapter method that used to own this counter is no longer on the path,
-        // because this tool reads and writes through the raw api inside one session. Counting
-        // here keeps `actual.budgets.holdForNextMonth` honest; the retry half of #368 stands.
-        observability.incrementToolCall('actual.budgets.holdForNextMonth').catch(() => { });
-        return await adapter.withWriteSession(async () => {
-            const before = (await rawGetBudgetMonth(input.month));
-            const heldBefore = Number(before?.forNextMonth ?? 0);
-            await rawHold(input.month, input.amount);
-            const after = (await rawGetBudgetMonth(input.month));
-            const heldAfter = Number(after?.forNextMonth ?? 0);
-            const held = heldAfter - heldBefore;
-            if (held <= 0) {
-                throw new Error(`Nothing was held for ${input.month}: that month has no positive amount left to budget, ` +
-                    'so there is nothing to carry into next month. Budget less to categories in that month, ' +
-                    'or check it with actual_budgets_getMonth first.');
-            }
-            if (held < input.amount) {
-                return {
-                    success: true,
-                    partial: true,
-                    requested: input.amount,
-                    held,
-                    message: `Held ${held} of the requested ${input.amount} cents for ${input.month}. Actual clamps ` +
-                        'the hold to the amount still left to budget in that month.',
-                };
-            }
-            return { success: true, held };
-        });
+        const held = await adapter.holdBudgetForNextMonth(input.month, input.amount);
+        if (held <= 0) {
+            throw new Error(`Nothing was held for ${input.month}: that month has no positive amount left to budget, ` +
+                'so there is nothing to carry into next month. Budget less to categories in that month, ' +
+                'or check it with actual_budgets_getMonth first.');
+        }
+        if (held < input.amount) {
+            return {
+                success: true,
+                partial: true,
+                requested: input.amount,
+                held,
+                message: `Held ${held} of the requested ${input.amount} cents for ${input.month}. Actual clamps ` +
+                    'the hold to the amount still left to budget in that month.',
+            };
+        }
+        return { success: true, held };
     },
 };
 export default tool;

package/dist/src/tools/budgets_setAmount.js

@@ -1,9 +1,19 @@
 import { z } from 'zod';
 import adapter from '../lib/actual-adapter.js';
-const InputSchema = z.object({ month: z.string().min(1), categoryId: z.string().min(1), amount: z.number() });
+const InputSchema = z.object({
+    // #361: this was a bare z.string().min(1), so 'banana' parsed and reached the API. The
+    // regex matches actual_budgets_holdForNextMonth and the other month-taking tools; the
+    // adapter additionally checks the month is one this budget actually has.
+    month: z.string().regex(/^\d{4}-(0[1-9]|1[0-2])$/, 'month must be in YYYY-MM format'),
+    categoryId: z.string().min(1).max(64),
+    amount: z.number().int('amount must be an integer (cents)'),
+});
 const tool = {
     name: 'actual_budgets_setAmount',
-    description: "Set the budgeted amount for a specific category in a given month. Amount in cents (e.g., 50000 = $500). Use this to allocate money to spending categories for budget planning.",
+    description: 'Set the budgeted amount for a specific category in a given month. Amount in cents ' +
+        '(e.g., 50000 = $500). Use this to allocate money to spending categories for budget planning. ' +
+        'The month must be one the budget actually has: Actual allows from three months before the ' +
+        'earliest transaction to twelve months ahead. Use actual_budgets_getMonths to see the range.',
     inputSchema: InputSchema,
     call: async (args, _meta) => {
         const input = InputSchema.parse(args || {});
@@ -13,10 +23,20 @@ const tool = {
         }
         catch (error) {
             const msg = error instanceof Error ? error.message : String(error);
-            // The pre-flight in adapter.setBudgetAmount throws:
-            //   Category "${categoryId}" not found. Use actual_categories_get to list available categories.
-            // That string always contains BOTH "not found" AND "category", so && is the correct operator.
-            if (msg.toLowerCase().includes('not found') && msg.toLowerCase().includes('category')) {
+            const lower = msg.toLowerCase();
+            // Both PRE-FLIGHT refusals from adapter.setBudgetAmount return the same structured
+            // shape, so a caller can handle "you asked for something that does not exist" once
+            // rather than parsing two forms:
+            //
+            //   Category "<id>" not found. Use actual_categories_get ...            (#89)
+            //   Month "<month>" is not in this budget. It runs from X to Y ...      (#361)
+            //
+            // #361 added the second one, and before this it fell through to the rethrow below,
+            // so one tool answered two identical situations in two different shapes. Anything
+            // else (a genuine upstream or transport failure) still throws.
+            const isCategoryRefusal = lower.includes('not found') && lower.includes('category');
+            const isMonthRefusal = lower.includes('not in this budget');
+            if (isCategoryRefusal || isMonthRefusal) {
                 return { success: false, error: msg };
             }
             throw new Error(`Failed to set budget amount: ${msg}`);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "actual-mcp-server",
   "displayName": "Actual MCP Server",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "engines": {
     "node": ">=22.0.0",
     "npm": ">=10.0.0"
@@ -30,7 +30,7 @@
     "verify-tools": "npm run build && node scripts/verify-tools.js",
     "check:coverage": "node scripts/list-actual-api-methods.mjs",
     "direct-sync": "node scripts/direct-sync/bank-sync-direct.mjs",
-    "test:unit-js": "node tests/unit/transactions_create.test.js && node tests/unit/generated_tools.smoke.test.js && node tests/unit/schema_validation.test.js && node tests/unit/schema_json_openai_compat.test.js && node tests/unit/config_https_validation.test.js && node tests/unit/config_data_dir.test.js && node tests/unit/config_drift.test.js && node tests/unit/port_alignment.test.js && node tests/unit/dockerfile_data_dir_alignment.test.js && node tests/unit/unraid_template_alignment.test.js && node tests/unit/entrypoint_invariants.test.js && node tests/unit/compose_profile_sync.test.js && node tests/unit/advertised_tools_sync.test.js && node tests/unit/knip_config.test.js && node tests/unit/readme_stats_sync.test.js && node tests/unit/config_insecure_upstream.test.js && node tests/unit/workflow_release_guards.test.js && node tests/unit/report_train_failure.test.js && node tests/unit/unit_chain_membership.test.js && node tests/unit/api_surface_drift.test.js && node tests/unit/write_effect_audit_staleness.test.js && node tests/unit/api_coverage_baseline.test.js && node tests/unit/train_preflight.test.js && node tests/unit/verify_published_artifacts.test.js && node tests/unit/report_train_stale.test.js && node tests/unit/stdio_framing_check.test.js && node tests/unit/server_info.test.js && node tests/unit/transfers_create.test.js && node tests/unit/bot_target_branch.test.js && node tests/unit/auth_posture.test.js && node tests/unit/auth_posture_wiring.test.js && node tests/unit/auth-acl.test.js && node tests/unit/bug76.test.js && node tests/unit/budgets_setAmount.test.js && node tests/unit/budgets_hold_for_next_month.test.js && node tests/unit/budgets_transfer.test.js && node tests/unit/transactions_uncategorized.test.js && node tests/unit/httpServer_session_init.test.js && node tests/unit/httpServer_session_not_found.test.js && node tests/unit/manual_mcp_client_retry.test.js && node tests/unit/manual_mcp_client_session.test.js && node tests/unit/manual_mcp_client_circuit.test.js && node tests/unit/manual_runner_killswitch.test.js && node tests/unit/adapter_auth_rate_limit.test.js && node tests/unit/adapter_session_reuse.test.js && node tests/unit/retry_classifier.test.js && node tests/unit/adapter_module_surface.test.js && node tests/unit/adapter_nonidempotent_no_retry.test.js && node tests/unit/pool_liveness.test.js && node tests/unit/pool_shutdown_all.test.js && node tests/unit/query_where_operators.test.js && node tests/unit/query_run_validation.test.js && node tests/unit/adapter_with_write_session.test.js && node tests/unit/category_groups_delete.test.js && node tests/unit/rules_delete.test.js && node tests/unit/schedules_delete.test.js && node tests/unit/accounts_delete.test.js && node tests/unit/accounts_close.test.js && node tests/unit/accounts_reopen.test.js && node tests/unit/payees_delete.test.js && node tests/unit/payees_merge.test.js && node tests/unit/rules_create_or_update.test.js && node tests/unit/unhandled-rejection.test.js && node tests/unit/rejection-allowlist-purity.test.js && node tests/unit/httpServer_bearer_auth.test.js && node tests/unit/httpServer_oidc_audience.test.js && node tests/unit/httpServer_oidc_auth_verification.test.js && node tests/unit/httpServer_oidc_jwks_discovery.test.js && node tests/unit/httpServer_body_limit.test.js && node tests/unit/httpServer_bind_host.test.js && node tests/unit/adapter_write_pool_cooperation.test.js && node tests/unit/budget_acl_enforcement.test.js && node tests/unit/budget_preference_store.test.js && node tests/unit/budget_preference_restore.test.js && node tests/unit/tags_list.test.js && node tests/unit/tags_create.test.js && node tests/unit/tags_update.test.js && node tests/unit/tags_delete.test.js && node tests/unit/notes_get.test.js && node tests/unit/notes_update.test.js && node tests/unit/payees_common_list.test.js && node tests/unit/transactions_update_guard.test.js && node tests/unit/transactions_update_splits.test.js && node tests/unit/entities_search.test.js && node tests/unit/transactions_import_schema.test.js && node tests/unit/tool_schema_shape.test.js && node tests/unit/zod_error_format.test.js && node tests/unit/tool_count_sync.test.js && node tests/unit/stdio_transport.test.js && node tests/unit/stdio_budget_switch.test.js && node tests/unit/logger_structured.test.js && node tests/unit/logger_redaction.test.js && node tests/unit/logger_correlation.test.js && node tests/unit/check_coverage.test.js && node tests/unit/adapter_op_timeout.test.js && node tests/unit/adapter_write_queue_wakeup.test.js && node tests/unit/ci_workflow_guards.test.js && node tests/unit/node_version_guard.test.js && node tests/unit/node_version_drift.test.js && node tests/unit/observability_smoke.test.js && node tests/unit/residue_pattern.test.js && node tests/unit/dual_transport_gate.test.js && node tests/unit/manual_assertions_use_helper.test.js && node tests/unit/server_version_guard.test.js && node tests/unit/payee_rules_reference_filter.test.js && node tests/unit/oidc_metadata_discovery.test.js && node tests/unit/httpServer_oauth_metadata_route.test.js && node tests/unit/httpServer_mcp_info_route.test.js && node tests/unit/residue_sweep_balance_account.test.js && node tests/unit/tool_factory.test.js && node tests/unit/budget_registry_parse.test.js && node tests/unit/preferences_get.test.js && node tests/unit/budgets_export.test.js && node tests/unit/budgets_import.test.js && node tests/unit/budgets_import_syncid.test.js && node tests/unit/budget_acl_dynamic.test.js && node tests/unit/budget_acl_identity_map.test.js && node tests/unit/budget_acl_userinfo.test.js && node tests/unit/acl_e2e_fixture_contract.test.js && node tests/unit/budget_acl_middleware.test.js && node tests/unit/rules_stage.test.js",
+    "test:unit-js": "node tests/unit/transactions_create.test.js && node tests/unit/generated_tools.smoke.test.js && node tests/unit/schema_validation.test.js && node tests/unit/schema_json_openai_compat.test.js && node tests/unit/config_https_validation.test.js && node tests/unit/config_data_dir.test.js && node tests/unit/config_drift.test.js && node tests/unit/port_alignment.test.js && node tests/unit/dockerfile_data_dir_alignment.test.js && node tests/unit/unraid_template_alignment.test.js && node tests/unit/entrypoint_invariants.test.js && node tests/unit/compose_profile_sync.test.js && node tests/unit/advertised_tools_sync.test.js && node tests/unit/knip_config.test.js && node tests/unit/readme_stats_sync.test.js && node tests/unit/config_insecure_upstream.test.js && node tests/unit/workflow_release_guards.test.js && node tests/unit/report_train_failure.test.js && node tests/unit/unit_chain_membership.test.js && node tests/unit/api_surface_drift.test.js && node tests/unit/write_effect_audit_staleness.test.js && node tests/unit/write_effect_audit_membership.test.js && node tests/unit/api_coverage_baseline.test.js && node tests/unit/train_preflight.test.js && node tests/unit/verify_published_artifacts.test.js && node tests/unit/report_train_stale.test.js && node tests/unit/stdio_framing_check.test.js && node tests/unit/server_info.test.js && node tests/unit/transfers_create.test.js && node tests/unit/bot_target_branch.test.js && node tests/unit/auth_posture.test.js && node tests/unit/auth_posture_wiring.test.js && node tests/unit/auth-acl.test.js && node tests/unit/bug76.test.js && node tests/unit/budgets_setAmount.test.js && node tests/unit/budgets_hold_for_next_month.test.js && node tests/unit/budgets_transfer.test.js && node tests/unit/transactions_uncategorized.test.js && node tests/unit/httpServer_session_init.test.js && node tests/unit/httpServer_session_not_found.test.js && node tests/unit/manual_mcp_client_retry.test.js && node tests/unit/manual_mcp_client_session.test.js && node tests/unit/manual_mcp_client_circuit.test.js && node tests/unit/manual_runner_killswitch.test.js && node tests/unit/adapter_auth_rate_limit.test.js && node tests/unit/adapter_session_reuse.test.js && node tests/unit/retry_classifier.test.js && node tests/unit/adapter_module_surface.test.js && node tests/unit/adapter_nonidempotent_no_retry.test.js && node tests/unit/pool_liveness.test.js && node tests/unit/pool_shutdown_all.test.js && node tests/unit/query_where_operators.test.js && node tests/unit/query_run_validation.test.js && node tests/unit/adapter_with_write_session.test.js && node tests/unit/category_groups_delete.test.js && node tests/unit/rules_delete.test.js && node tests/unit/schedules_delete.test.js && node tests/unit/accounts_delete.test.js && node tests/unit/update_tools_not_found.test.js && node tests/unit/accounts_close.test.js && node tests/unit/accounts_reopen.test.js && node tests/unit/payees_delete.test.js && node tests/unit/payees_merge.test.js && node tests/unit/rules_create_or_update.test.js && node tests/unit/unhandled-rejection.test.js && node tests/unit/rejection-allowlist-purity.test.js && node tests/unit/httpServer_bearer_auth.test.js && node tests/unit/httpServer_oidc_audience.test.js && node tests/unit/httpServer_oidc_auth_verification.test.js && node tests/unit/httpServer_oidc_jwks_discovery.test.js && node tests/unit/httpServer_body_limit.test.js && node tests/unit/httpServer_bind_host.test.js && node tests/unit/adapter_write_pool_cooperation.test.js && node tests/unit/budget_acl_enforcement.test.js && node tests/unit/budget_preference_store.test.js && node tests/unit/budget_preference_restore.test.js && node tests/unit/tags_list.test.js && node tests/unit/tags_create.test.js && node tests/unit/tags_update.test.js && node tests/unit/tags_delete.test.js && node tests/unit/notes_get.test.js && node tests/unit/notes_update.test.js && node tests/unit/payees_common_list.test.js && node tests/unit/transactions_update_guard.test.js && node tests/unit/transactions_update_splits.test.js && node tests/unit/entities_search.test.js && node tests/unit/transactions_import_schema.test.js && node tests/unit/tool_schema_shape.test.js && node tests/unit/zod_error_format.test.js && node tests/unit/tool_count_sync.test.js && node tests/unit/stdio_transport.test.js && node tests/unit/stdio_budget_switch.test.js && node tests/unit/logger_structured.test.js && node tests/unit/logger_redaction.test.js && node tests/unit/logger_correlation.test.js && node tests/unit/check_coverage.test.js && node tests/unit/adapter_op_timeout.test.js && node tests/unit/adapter_write_queue_wakeup.test.js && node tests/unit/ci_workflow_guards.test.js && node tests/unit/node_version_guard.test.js && node tests/unit/node_version_drift.test.js && node tests/unit/observability_smoke.test.js && node tests/unit/residue_pattern.test.js && node tests/unit/dual_transport_gate.test.js && node tests/unit/manual_assertions_use_helper.test.js && node tests/unit/server_version_guard.test.js && node tests/unit/payee_rules_reference_filter.test.js && node tests/unit/oidc_metadata_discovery.test.js && node tests/unit/httpServer_oauth_metadata_route.test.js && node tests/unit/httpServer_mcp_info_route.test.js && node tests/unit/residue_sweep_balance_account.test.js && node tests/unit/tool_factory.test.js && node tests/unit/budget_registry_parse.test.js && node tests/unit/preferences_get.test.js && node tests/unit/budgets_export.test.js && node tests/unit/budgets_import.test.js && node tests/unit/budgets_import_syncid.test.js && node tests/unit/budget_acl_dynamic.test.js && node tests/unit/budget_acl_identity_map.test.js && node tests/unit/budget_acl_userinfo.test.js && node tests/unit/acl_e2e_fixture_contract.test.js && node tests/unit/budget_acl_middleware.test.js && node tests/unit/rules_stage.test.js",
     "test:adapter": "npm run build && node dist/src/tests_adapter_runner.js",
     "test:e2e": "npx playwright test",
     "test:e2e:docker": "./tests/e2e/run-docker-e2e.sh",