actual-mcp-server 0.22.0 → 0.22.1

package/README.md

@@ -781,7 +781,7 @@ The software is provided **as-is**, without warranty of any kind. The author acc
 
 ---
 
-**Version:** 0.22.0 | **Tool Count:** 81 (verified LibreChat-compatible)
+**Version:** 0.22.1 | **Tool Count:** 81 (verified LibreChat-compatible)
 
 ## Sponsor
 

package/dist/src/lib/actual-adapter.js

@@ -389,13 +389,29 @@ export async function withActualApi(rawOperation) {
     // Denial here means the lock is never acquired and no upstream resource is
     // touched.
     _enforceBudgetAcl();
-    // #276: on the FIRST successful op, warn (once) if the Actual server version is outside
-    // the range this build supports. It runs inside the op while the connection is live and
-    // reuses it via rawGetServerVersion (NOT the withActualApi-wrapped getServerVersion, which
-    // would re-enter the lock). The once-guard flips its flag synchronously, so this never
-    // repeats per session or op. It is advisory: it never throws and never blocks the op.
-    const operation = async () => {
-        const result = await rawOperation();
+    // #276: on the FIRST successful op, warn (once) if the Actual server version is outside the
+    // range this build supports, reusing the live connection via rawGetServerVersion (NOT the
+    // withActualApi-wrapped getServerVersion, which would re-enter the lock).
+    //
+    // It runs AFTER withOpTimeout, not inside it. Review caught that bounding the probe was not
+    // enough while it still sat inside the operation's own timeout: its 5 seconds came out of the
+    // operation's 30, so an op that took more than ~25s and SUCCEEDED was still reported to the
+    // caller as "Actual API operation timed out", and on a deliberately lowered
+    // ACTUAL_OP_TIMEOUT_MS the probe alone could consume the entire budget. The timeout text is
+    // classed transient, so it would also drop the pooled connection. Still inside withApiLock,
+    // because it needs the connection the operation established.
+    //
+    // WHAT THIS DOES AND DOES NOT BUY, stated precisely because the first version of this comment
+    // overclaimed. The probe can no longer FAIL an operation that succeeded. It can still SLOW one,
+    // by up to SERVER_VERSION_PROBE_TIMEOUT_MS, and that bound is FIXED: it does not scale down
+    // with ACTUAL_OP_TIMEOUT_MS, so an operator who sets the 250ms floor for a fast-fail posture
+    // still pays up to ~5s of api-mutex hold against a stalled /info, and on the legacy path can
+    // pay it twice in one call (the pre-download site, then here). It is bounded and finite (at
+    // most MAX_PROBE_ATTEMPTS times per process, then never again), which is the trade being made:
+    // a diagnostic that is occasionally slow beats one that is silently disabled by a single
+    // transient failure, which is what the previous design did.
+    const runOperation = async () => {
+        const result = await withOpTimeout(rawOperation);
         await checkServerVersionOnce(() => rawGetServerVersion(), logger);
         return result;
     };
@@ -411,7 +427,7 @@ export async function withActualApi(rawOperation) {
                 // #390: verify the singleton holds THIS session's budget before the operation runs.
                 // Inside the lock, so no other session can change it in between.
                 await ensureLoadedBudgetMatchesSession();
-                return await withOpTimeout(operation);
+                return await runOperation();
             }
             catch (err) {
                 // Only drop the pool connection on errors that suggest the api
@@ -442,7 +458,7 @@ export async function withActualApi(rawOperation) {
         let forceFullShutdown = false;
         try {
             await initActualApiForOperation();
-            return await withOpTimeout(operation);
+            return await runOperation();
         }
         catch (err) {
             // #419: the stdio keep-alive branch leaves the singleton live; on an
@@ -3002,13 +3018,13 @@ export async function runBankSync(accountId) {
             const reset = error?.details?.rateLimitHeaders?.http_x_ratelimit_account_success_reset;
             const retryIn = reset ? ` Retry in ~${Math.ceil(Number(reset) / 60)} minute(s).` : '';
             throw new Error(`Bank sync failed: GoCardless rate limit exceeded for this account.${retryIn} ` +
-                `(NORDIGEN RATE_LIMIT_EXCEEDED — account success quota exhausted)`);
+                `(NORDIGEN RATE_LIMIT_EXCEEDED: account success quota exhausted)`);
         }
         if (error?.type === 'BankSyncError' ||
             errorMsg.includes('BankSyncError') ||
             errorMsg.includes('NORDIGEN_ERROR') ||
             errorMsg.includes('Failed syncing account')) {
-            throw new Error(`Bank sync failed: Provider error — ${errorMsg}`, { cause: error });
+            throw new Error(`Bank sync failed: Provider error: ${errorMsg}`, { cause: error });
         }
         throw new Error(`Bank sync failed: ${errorMsg}`, { cause: error }); // #452: keep the brand
     }

package/dist/src/lib/budgetLoader.js

@@ -411,13 +411,6 @@ async function trackBudgetMutation(start, describeLoaded, label, verify, onRecor
         throw err;
     }
 }
-/**
- * How long the #453 pre-download version probe may take before it is abandoned. Deliberately a
- * CONSTANT and not an env var: it is an advisory diagnostic, nobody should have to tune it, and
- * a new config key would need to be threaded through config.ts, .env.example and the README
- * table (the config-drift guard enforces all three) to buy nothing.
- */
-const SERVER_VERSION_PROBE_TIMEOUT_MS = 5000;
 /**
  * #394: the same discipline for an IMPORT.
  *
@@ -472,27 +465,23 @@ export async function loadBudgetTracked(syncId, encryptionPassword, label = 'dow
     // Three properties hold it in place:
     //   - OUTSIDE the tracked chain (before the try), because nothing in that chain may take the
     //     api lock or extend the window an abandoned load holds open.
-    //   - BOUNDED by withOpTimeout: this runs inside the process-global api mutex, so an
-    //     unbounded advisory GET would stall every session. If /info is stalled the download was
-    //     going to fail anyway, so the bound costs nothing real.
-    //   - ONCE per process, via the guard's own synchronous flag, which is shared with the post-op
-    //     call site in actual-adapter.ts. Whichever fires first wins; the other becomes a no-op, so
-    //     there is no double warning. This one normally fires first, being earlier.
+    //   - BOUNDED by the GUARD itself, not here. Review of the first version moved it: this runs
+    //     inside the process-global api mutex, so an unbounded advisory GET would stall every
+    //     session, and a bound each call site has to remember is one a call site will forget.
+    //   - ONCE per process ON SUCCESS, and the qualifier matters. The guard's latch is set only
+    //     when a version was actually READ (#453 review: latching on the attempt meant one failed
+    //     probe disabled the warning for the life of the process). It is shared with the post-op
+    //     call site in actual-adapter.ts, so on success whichever fires first wins and the other is
+    //     a no-op, and this one normally fires first, being earlier. On FAILURE both sites keep
+    //     retrying until MAX_PROBE_ATTEMPTS, so an unreachable /info costs up to three bounded
+    //     probes rather than one. That is the deliberate trade: a bounded, finite cost in exchange
+    //     for not being silenced by a single transient failure.
     //
     // `api.getServerVersion` is read at call time (not destructured) so it needs only the server URL
     // that api.init() already established: NO budget has to be loaded, which is what makes a probe
     // before the download possible at all.
-    await checkServerVersionOnce(() => withOpTimeout(() => api
-        .getServerVersion(), 'server-version-probe', 
-    // A SHORT dedicated bound, not the general ACTUAL_OP_TIMEOUT_MS (30s by default).
-    //
-    // Review of the first version caught the reason: `/info` is an unauthenticated GET on a
-    // different route from the sync endpoints, so it can stall while the login and download
-    // are perfectly healthy. At the general bound that stall costs 30s of the process-global
-    // api mutex, and since a failed probe leaves the guard armed it would be paid again on
-    // each of the next two loads. An ADVISORY diagnostic must never be able to do that. If
-    // the probe cannot answer in 5 seconds it has nothing useful to say.
-    SERVER_VERSION_PROBE_TIMEOUT_MS, 'the server-version probe bound (fixed, not configurable)'), log);
+    await checkServerVersionOnce(() => api
+        .getServerVersion(), log);
     try {
         await trackBudgetMutation(
         // #410: no redundant clear here any more. `trackBudgetMutation` owns the clear-before, and

package/dist/src/lib/init-failure.js

@@ -113,15 +113,21 @@ function classifyOne(err) {
         const e = err;
         // `.code` FIRST: upstream's api/download-budget and api/load-budget never let a
         // SyncError escape, they throw a plain Error carrying .code via withErrorCode.
+        // `Object.hasOwn`, never a bare truthiness test on the lookup: these are object literals, so
+        // they inherit Object.prototype and an error carrying `code: 'constructor'` (or 'toString',
+        // 'valueOf') would match, returning a `cause` that is not an InitFailureCause and a sentence
+        // that is `undefined`. The stdio handler would then answer a tool call with
+        // `{ isError: true, content: [{ type: 'text', text: undefined }] }`. Pre-existing from #438,
+        // but #452 is what routes EVERY stdio tool error through here, so it is reachable now.
         const code = typeof e?.code === 'string' ? e.code : undefined;
-        if (code && REASON_TO_CAUSE[code])
+        if (code && Object.hasOwn(REASON_TO_CAUSE, code))
             return done(REASON_TO_CAUSE[code]);
-        if (code && SYSTEM_CODE_TO_CAUSE[code])
+        if (code && Object.hasOwn(SYSTEM_CODE_TO_CAUSE, code))
             return done(SYSTEM_CODE_TO_CAUSE[code]);
         // `.reason` only as a defensive fallback, for a SyncError that reaches us by
         // some path that does not go through those two handlers.
         const reason = typeof e?.reason === 'string' ? e.reason : undefined;
-        if (reason && REASON_TO_CAUSE[reason])
+        if (reason && Object.hasOwn(REASON_TO_CAUSE, reason))
             return done(REASON_TO_CAUSE[reason]);
         const message = typeof e?.message === 'string' ? e.message : '';
         // Our OWN synthesized post-condition error (#396) embeds the upstream reason
@@ -130,7 +136,7 @@ function classifyOne(err) {
         // handled only the upstream shapes would answer `unknown` for exactly the
         // failures this ticket is about.
         const embedded = /Upstream reason: \[([a-z-]+)\]/.exec(message)?.[1];
-        if (embedded && REASON_TO_CAUSE[embedded])
+        if (embedded && Object.hasOwn(REASON_TO_CAUSE, embedded))
             return done(REASON_TO_CAUSE[embedded]);
         // Last resort, message shapes. `network-failure` is tested BEFORE the auth
         // wording because upstream reports an unreachable server as

package/dist/src/lib/server-version-guard.js

@@ -11,12 +11,19 @@
  *  - The comparator is PURE (no I/O, no logging), so its truth table is unit-testable.
  *  - It FAILS OPEN: an unparseable version produces no warning. A spurious warning on a
  *    healthy deployment would be worse than staying quiet.
- *  - The firing is a per-PROCESS once-guard: the flag is flipped SYNCHRONOUSLY before any
- *    await, so the check runs exactly once no matter how many ops or sessions occur, and it
- *    reuses the connection the triggering op already established (no extra auth burst,
- *    avoiding the #127/#134 class). There is NO boot-time probe: index.ts deliberately has
- *    no startup connection, and a naive boot call would double-init then be torn down by
- *    shutdownActualApi.
+ *  - The firing is a per-PROCESS once-guard ON SUCCESS, and the qualifier is #453's change:
+ *    `checked` is set only once a version has actually been READ, with `inFlight` providing the
+ *    concurrency property the old synchronous latch provided and `attempts` capping the retries
+ *    at MAX_PROBE_ATTEMPTS. A FAILING probe is therefore retried up to that cap instead of
+ *    silencing the warning for the life of the process, which is what the synchronous latch did
+ *    once the probe moved ahead of the first budget download. There are TWO call sites now: the
+ *    pre-download one in budgetLoader (which issues its own bounded /info read) and the original
+ *    post-op one in withActualApi (which reuses the connection the triggering op established, so
+ *    it adds no auth burst, avoiding the #127/#134 class). NEITHER call site bounds its reader:
+ *    the bound lives in `raceWithBound` below, deliberately, so the set of call sites cannot
+ *    matter. Do not delete it on the strength of a caller looking safe. There is still NO boot-time probe:
+ *    index.ts deliberately has no startup connection, and a naive boot call would double-init
+ *    then be torn down by shutdownActualApi.
  */
 import { SUPPORTED_ACTUAL_SERVER_RANGE } from './constants.js';
 import { INSTALLED_API_VERSION } from './installed-api-version.js';
@@ -99,11 +106,63 @@ export function checkServerVersion(running, range = SUPPORTED_ACTUAL_SERVER_RANG
 // ---------------------------------------------------------------------------
 // Per-process once-guard.
 // ---------------------------------------------------------------------------
+/**
+ * How long a version probe may take before it is abandoned. Deliberately a CONSTANT and not an
+ * env var: it is an advisory diagnostic, nobody should have to tune it, and a new config key would
+ * need threading through config.ts, .env.example and the README table (the config-drift guard
+ * enforces all three) to buy nothing. 5 seconds is far more than a healthy /info needs.
+ */
+export const SERVER_VERSION_PROBE_TIMEOUT_MS = 5000;
 let checked = false; // a version WAS read and judged: never check again
 let inFlight = false; // a check is running right now: a concurrent caller must not duplicate it
 let attempts = 0; // failed attempts, so an unreachable /info cannot be probed forever
 /** Failed probes tolerated before the check gives up for the process. */
 const MAX_PROBE_ATTEMPTS = 3;
+/**
+ * Bound the read WITHOUT importing `withOpTimeout`.
+ *
+ * The obvious implementation reuses that helper, and review caught what it drags in: `opTimeout`
+ * imports `config.ts`, which Zod-validates the environment AT MODULE LOAD and hard-exits when it
+ * is missing. That breaks this module's own design note, that the comparator is PURE and
+ * unit-testable without I/O, and it makes `tests/unit/server_version_guard.test.js` unable to
+ * load at all without an environment.
+ *
+ * ONE CORRECTION to how this was first justified, since a wrong reason in a comment outlives the
+ * observation that produced it: the original wording claimed the import turned the unit chain
+ * "red locally, green in CI". The chain ALREADY dies without env vars, earlier, at
+ * `config_https_validation.test.js`. So the import does not change what the chain does on a bare
+ * machine. The property is still worth enforcing (a pure comparator that any harness can import
+ * and test in isolation), the drama was not.
+ *
+ * So the bound is an inline race with a fixed constant, and this module keeps importing nothing
+ * but its two pure siblings. The timer is always cleared, so a fast read leaves nothing pending
+ * to hold the process open.
+ */
+async function raceWithBound(read) {
+    let timer;
+    try {
+        return await Promise.race([
+            read(),
+            new Promise((_resolve, reject) => {
+                timer = setTimeout(() => reject(new Error(`server-version probe exceeded ${SERVER_VERSION_PROBE_TIMEOUT_MS}ms`)), SERVER_VERSION_PROBE_TIMEOUT_MS);
+                // NOT unref'd, and that is deliberate. `unref` was the first instinct ("never hold the
+                // process open for an advisory diagnostic") and it quietly breaks the bound: an unref'd
+                // timer does not keep the event loop alive, so in a process with nothing else pending
+                // Node exits before it fires and the race never rejects. The test that pins this bound
+                // caught exactly that, as an unsettled top-level await. A live server always has other
+                // work, so it would have fired there and the hazard would have stayed hidden.
+                //
+                // The cost of keeping it ref'd is bounded by construction: at most
+                // SERVER_VERSION_PROBE_TIMEOUT_MS, and the `finally` below clears it as soon as the read
+                // answers, so a healthy probe leaves nothing pending at all.
+            }),
+        ]);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}
 /**
  * Run the compatibility check at most once per process. Call this from inside a successful
  * `withActualApi` operation (while the connection is live), passing a function that reads the
@@ -129,13 +188,19 @@ bundledApi = INSTALLED_API_VERSION) {
     // the process, including #276's surviving post-op call site. The deployment that silenced it
     // is precisely the one the guard exists for.
     //
+    // THE BOUND IS APPLIED HERE, not by the caller. It started at the call sites and review was
+    // right that prose cannot hold it: `inFlight` is cleared in a `finally`, so a reader whose
+    // promise NEVER settles leaves it true for the life of the process and permanently disables the
+    // warning, which is the very failure this rework removed, just relocated. Bounding inside makes
+    // the set of call sites stop mattering, the same argument #393 used for the abandoned-load wait.
+    //
     // So: `inFlight` keeps the concurrency property the synchronous latch was actually providing,
     // `checked` is now set only once a version was really read and judged, and `attempts` bounds
     // the retries so an unreachable server costs at most MAX_PROBE_ATTEMPTS extra /info calls per
     // process rather than one per budget load.
     inFlight = true;
     try {
-        const result = await readVersion();
+        const result = await raceWithBound(readVersion);
         if (!result || 'error' in result || typeof result.version !== 'string') {
             attempts++;
             log.debug('[server-version] could not read the Actual server version; skipping the compatibility check');
@@ -147,10 +212,17 @@ bundledApi = INSTALLED_API_VERSION) {
             log.warn(verdict.message);
         }
     }
-    catch {
+    catch (err) {
         // Advisory only: a failure to check must never surface as an error or affect the op.
+        //
+        // NAME THE CAUSE. Once the bound moved inside this function, "probe exceeded 5000ms" became
+        // the most common way through here, and it is indistinguishable from `rawGetServerVersion`
+        // being undefined (it is destructured from `api as any` at module load, so an upstream build
+        // that stops exporting it throws a TypeError down this same path). An operator wondering why
+        // the compatibility warning never appears would have had nothing to go on.
         attempts++;
-        log.debug('[server-version] compatibility check threw; ignored');
+        const reason = err instanceof Error ? err.message : String(err);
+        log.debug(`[server-version] compatibility check failed; ignored: ${reason}`);
     }
     finally {
         inFlight = false;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "actual-mcp-server",
   "displayName": "Actual MCP Server",
-  "version": "0.22.0",
+  "version": "0.22.1",
   "engines": {
     "node": ">=22.0.0",
     "npm": ">=10.0.0"
@@ -30,7 +30,7 @@
     "verify-tools": "npm run build && node scripts/verify-tools.js",
     "check:coverage": "node scripts/list-actual-api-methods.mjs",
     "direct-sync": "node scripts/direct-sync/bank-sync-direct.mjs",
-    "test:unit-js": "node tests/unit/transactions_create.test.js && node tests/unit/transactions_aggregate.test.js && node tests/unit/account_flow_summary.test.js && node tests/unit/recurring_expenses_summary.test.js && node tests/unit/generated_tools.smoke.test.js &&node tests/unit/schema_validation.test.js && node tests/unit/schema_json_openai_compat.test.js && node tests/unit/config_https_validation.test.js && node tests/unit/config_data_dir.test.js && node tests/unit/config_drift.test.js && node tests/unit/port_alignment.test.js && node tests/unit/dockerfile_data_dir_alignment.test.js && node tests/unit/unraid_template_alignment.test.js && node tests/unit/entrypoint_invariants.test.js && node tests/unit/e2e_spec_collection.test.js && node tests/unit/compose_profile_sync.test.js && node tests/unit/advertised_tools_sync.test.js && node tests/unit/new_tool_completeness.test.js && node tests/unit/knip_config.test.js && node tests/unit/readme_stats_sync.test.js && node tests/unit/config_insecure_upstream.test.js && node tests/unit/workflow_release_guards.test.js && node tests/unit/report_train_failure.test.js && node tests/unit/unit_chain_membership.test.js && node tests/unit/api_surface_drift.test.js && node tests/unit/write_effect_audit_staleness.test.js && node tests/unit/write_effect_audit_membership.test.js && node tests/unit/tool_annotations.test.js && node tests/unit/tool_id_schema_drift.test.js && node tests/unit/filter_id_resolution.test.js && node tests/unit/filter_id_tool_wiring.test.js && node tests/unit/api_coverage_baseline.test.js && node tests/unit/train_preflight.test.js && node tests/unit/verify_published_artifacts.test.js && node tests/unit/report_train_stale.test.js && node tests/unit/stdio_framing_check.test.js && node tests/unit/server_info.test.js && node tests/unit/transfers_create.test.js && node tests/unit/bot_target_branch.test.js && node tests/unit/auth_posture.test.js && node tests/unit/auth_posture_wiring.test.js && node tests/unit/auth-acl.test.js && node tests/unit/bug76.test.js && node tests/unit/budgets_setAmount.test.js && node tests/unit/budgets_hold_for_next_month.test.js && node tests/unit/budgets_transfer.test.js && node tests/unit/transactions_uncategorized.test.js && node tests/unit/httpServer_session_init.test.js && node tests/unit/httpServer_session_not_found.test.js && node tests/unit/httpServer_init_failure_report.test.js && node tests/unit/stdio_init_failure_report.test.js && node tests/unit/manual_mcp_client_retry.test.js && node tests/unit/manual_mcp_client_session.test.js && node tests/unit/manual_mcp_client_circuit.test.js && node tests/unit/manual_runner_killswitch.test.js && node tests/unit/adapter_auth_rate_limit.test.js && node tests/unit/adapter_session_reuse.test.js && node tests/unit/retry_classifier.test.js && node tests/unit/adapter_module_surface.test.js && node tests/unit/adapter_nonidempotent_no_retry.test.js && node tests/unit/pool_liveness.test.js && node tests/unit/pool_shutdown_all.test.js && node tests/unit/query_where_operators.test.js && node tests/unit/query_run_validation.test.js && node tests/unit/adapter_with_write_session.test.js && node tests/unit/category_groups_delete.test.js && node tests/unit/rules_delete.test.js && node tests/unit/schedules_delete.test.js && node tests/unit/accounts_delete.test.js && node tests/unit/update_tools_not_found.test.js && node tests/unit/accounts_close.test.js && node tests/unit/accounts_reopen.test.js && node tests/unit/payees_delete.test.js && node tests/unit/payees_merge.test.js && node tests/unit/rules_create_or_update.test.js && node tests/unit/unhandled-rejection.test.js && node tests/unit/rejection-allowlist-purity.test.js && node tests/unit/httpServer_bearer_auth.test.js && node tests/unit/httpServer_oidc_audience.test.js && node tests/unit/httpServer_oidc_auth_verification.test.js && node tests/unit/httpServer_oidc_jwks_discovery.test.js && node tests/unit/httpServer_body_limit.test.js && node tests/unit/httpServer_bind_host.test.js && node tests/unit/adapter_write_pool_cooperation.test.js && node tests/unit/adapter_drain_listing_cache.test.js && node tests/unit/budget_acl_enforcement.test.js && node tests/unit/budget_selection_precondition.test.js && node tests/unit/budget_load_abandonment.test.js && node tests/unit/budget_loader_postcondition.test.js && node tests/unit/budget_loader_import_allowlist.test.js && node tests/unit/budget_import_tracking.test.js && node tests/unit/pool_shutdown_under_lock.test.js && node tests/unit/api_lock_affinity.test.js && node tests/unit/commit_message_closing_keyword.test.js && node tests/unit/write_queue_stranding.test.js && node tests/unit/write_queue_stranded_bound.test.js && node tests/unit/budget_preference_store.test.js && node tests/unit/budget_preference_restore.test.js && node tests/unit/tags_list.test.js && node tests/unit/tags_create.test.js && node tests/unit/tags_update.test.js && node tests/unit/tags_delete.test.js && node tests/unit/notes_get.test.js && node tests/unit/notes_update.test.js && node tests/unit/payees_common_list.test.js && node tests/unit/transactions_update_guard.test.js && node tests/unit/transactions_update_splits.test.js && node tests/unit/entities_search.test.js && node tests/unit/transactions_import_schema.test.js && node tests/unit/tool_schema_shape.test.js && node tests/unit/zod_error_format.test.js && node tests/unit/tool_count_sync.test.js && node tests/unit/stdio_transport.test.js && node tests/unit/stdio_budget_switch.test.js && node tests/unit/logger_structured.test.js && node tests/unit/logger_redaction.test.js && node tests/unit/logger_correlation.test.js && node tests/unit/check_coverage.test.js && node tests/unit/adapter_op_timeout.test.js && node tests/unit/adapter_write_queue_wakeup.test.js && node tests/unit/ci_workflow_guards.test.js && node tests/unit/node_version_guard.test.js && node tests/unit/node_version_drift.test.js && node tests/unit/playwright_version_drift.test.js && node tests/unit/observability_smoke.test.js && node tests/unit/residue_pattern.test.js && node tests/unit/dual_transport_gate.test.js && node tests/unit/manual_assertions_use_helper.test.js && node tests/unit/server_version_guard.test.js && node tests/unit/payee_rules_reference_filter.test.js && node tests/unit/oidc_metadata_discovery.test.js && node tests/unit/httpServer_oauth_metadata_route.test.js && node tests/unit/httpServer_mcp_info_route.test.js && node tests/unit/residue_sweep_balance_account.test.js && node tests/unit/tool_factory.test.js && node tests/unit/budget_registry_parse.test.js && node tests/unit/preferences_get.test.js && node tests/unit/budgets_export.test.js && node tests/unit/budgets_import.test.js && node tests/unit/budgets_import_syncid.test.js && node tests/unit/budget_acl_dynamic.test.js && node tests/unit/budget_acl_identity_map.test.js && node tests/unit/budget_acl_userinfo.test.js && node tests/unit/acl_e2e_fixture_contract.test.js && node tests/unit/budget_acl_middleware.test.js && node tests/unit/rules_stage.test.js",
+    "test:unit-js": "node tests/unit/transactions_create.test.js && node tests/unit/transactions_aggregate.test.js && node tests/unit/account_flow_summary.test.js && node tests/unit/recurring_expenses_summary.test.js && node tests/unit/generated_tools.smoke.test.js &&node tests/unit/schema_validation.test.js && node tests/unit/schema_json_openai_compat.test.js && node tests/unit/config_https_validation.test.js && node tests/unit/config_data_dir.test.js && node tests/unit/config_drift.test.js && node tests/unit/port_alignment.test.js && node tests/unit/dockerfile_data_dir_alignment.test.js && node tests/unit/unraid_template_alignment.test.js && node tests/unit/entrypoint_invariants.test.js && node tests/unit/e2e_spec_collection.test.js && node tests/unit/compose_profile_sync.test.js && node tests/unit/advertised_tools_sync.test.js && node tests/unit/new_tool_completeness.test.js && node tests/unit/knip_config.test.js && node tests/unit/readme_stats_sync.test.js && node tests/unit/config_insecure_upstream.test.js && node tests/unit/workflow_release_guards.test.js && node tests/unit/report_train_failure.test.js && node tests/unit/unit_chain_membership.test.js && node tests/unit/api_surface_drift.test.js && node tests/unit/write_effect_audit_staleness.test.js && node tests/unit/write_effect_audit_membership.test.js && node tests/unit/tool_annotations.test.js && node tests/unit/tool_id_schema_drift.test.js && node tests/unit/filter_id_resolution.test.js && node tests/unit/filter_id_tool_wiring.test.js && node tests/unit/api_coverage_baseline.test.js && node tests/unit/train_preflight.test.js && node tests/unit/verify_published_artifacts.test.js && node tests/unit/report_train_stale.test.js && node tests/unit/stdio_framing_check.test.js && node tests/unit/server_info.test.js && node tests/unit/transfers_create.test.js && node tests/unit/bot_target_branch.test.js && node tests/unit/auth_posture.test.js && node tests/unit/auth_posture_wiring.test.js && node tests/unit/auth-acl.test.js && node tests/unit/bug76.test.js && node tests/unit/budgets_setAmount.test.js && node tests/unit/budgets_hold_for_next_month.test.js && node tests/unit/budgets_transfer.test.js && node tests/unit/transactions_uncategorized.test.js && node tests/unit/httpServer_session_init.test.js && node tests/unit/httpServer_session_not_found.test.js && node tests/unit/httpServer_init_failure_report.test.js && node tests/unit/stdio_init_failure_report.test.js && node tests/unit/manual_mcp_client_retry.test.js && node tests/unit/manual_mcp_client_session.test.js && node tests/unit/manual_mcp_client_circuit.test.js && node tests/unit/manual_runner_killswitch.test.js && node tests/unit/adapter_auth_rate_limit.test.js && node tests/unit/adapter_session_reuse.test.js && node tests/unit/retry_classifier.test.js && node tests/unit/adapter_module_surface.test.js && node tests/unit/adapter_nonidempotent_no_retry.test.js && node tests/unit/pool_liveness.test.js && node tests/unit/pool_shutdown_all.test.js && node tests/unit/query_where_operators.test.js && node tests/unit/query_run_validation.test.js && node tests/unit/adapter_with_write_session.test.js && node tests/unit/category_groups_delete.test.js && node tests/unit/rules_delete.test.js && node tests/unit/schedules_delete.test.js && node tests/unit/accounts_delete.test.js && node tests/unit/update_tools_not_found.test.js && node tests/unit/accounts_close.test.js && node tests/unit/accounts_reopen.test.js && node tests/unit/payees_delete.test.js && node tests/unit/payees_merge.test.js && node tests/unit/rules_create_or_update.test.js && node tests/unit/unhandled-rejection.test.js && node tests/unit/rejection-allowlist-purity.test.js && node tests/unit/httpServer_bearer_auth.test.js && node tests/unit/httpServer_oidc_audience.test.js && node tests/unit/httpServer_oidc_auth_verification.test.js && node tests/unit/httpServer_oidc_jwks_discovery.test.js && node tests/unit/httpServer_body_limit.test.js && node tests/unit/httpServer_bind_host.test.js && node tests/unit/adapter_write_pool_cooperation.test.js && node tests/unit/adapter_drain_listing_cache.test.js && node tests/unit/budget_acl_enforcement.test.js && node tests/unit/budget_selection_precondition.test.js && node tests/unit/budget_load_abandonment.test.js && node tests/unit/budget_loader_postcondition.test.js && node tests/unit/budget_loader_import_allowlist.test.js && node tests/unit/budget_import_tracking.test.js && node tests/unit/pool_shutdown_under_lock.test.js && node tests/unit/api_lock_affinity.test.js && node tests/unit/commit_message_closing_keyword.test.js && node tests/unit/write_queue_stranding.test.js && node tests/unit/write_queue_stranded_bound.test.js && node tests/unit/budget_preference_store.test.js && node tests/unit/budget_preference_restore.test.js && node tests/unit/tags_list.test.js && node tests/unit/tags_create.test.js && node tests/unit/tags_update.test.js && node tests/unit/tags_delete.test.js && node tests/unit/notes_get.test.js && node tests/unit/notes_update.test.js && node tests/unit/payees_common_list.test.js && node tests/unit/transactions_update_guard.test.js && node tests/unit/transactions_update_splits.test.js && node tests/unit/entities_search.test.js && node tests/unit/transactions_import_schema.test.js && node tests/unit/tool_schema_shape.test.js && node tests/unit/zod_error_format.test.js && node tests/unit/tool_count_sync.test.js && node tests/unit/stdio_transport.test.js && node tests/unit/stdio_budget_switch.test.js && node tests/unit/logger_structured.test.js && node tests/unit/logger_redaction.test.js && node tests/unit/logger_correlation.test.js && node tests/unit/check_coverage.test.js && node tests/unit/adapter_op_timeout.test.js && node tests/unit/adapter_write_queue_wakeup.test.js && node tests/unit/ci_workflow_guards.test.js && node tests/unit/node_version_guard.test.js && node tests/unit/node_version_drift.test.js && node tests/unit/playwright_version_drift.test.js && node tests/unit/observability_smoke.test.js && node tests/unit/residue_pattern.test.js && node tests/unit/dual_transport_gate.test.js && node tests/unit/manual_assertions_use_helper.test.js && node tests/unit/server_version_guard.test.js && node tests/unit/server_version_probe_outside_op_timeout.test.js && node tests/unit/payee_rules_reference_filter.test.js && node tests/unit/oidc_metadata_discovery.test.js && node tests/unit/httpServer_oauth_metadata_route.test.js && node tests/unit/httpServer_mcp_info_route.test.js && node tests/unit/residue_sweep_balance_account.test.js && node tests/unit/tool_factory.test.js && node tests/unit/budget_registry_parse.test.js && node tests/unit/preferences_get.test.js && node tests/unit/budgets_export.test.js && node tests/unit/budgets_import.test.js && node tests/unit/budgets_import_syncid.test.js && node tests/unit/budget_acl_dynamic.test.js && node tests/unit/budget_acl_identity_map.test.js && node tests/unit/budget_acl_userinfo.test.js && node tests/unit/acl_e2e_fixture_contract.test.js && node tests/unit/budget_acl_middleware.test.js && node tests/unit/rules_stage.test.js",
     "test:adapter": "npm run build && node dist/src/tests_adapter_runner.js",
     "test:e2e": "npx playwright test",
     "test:e2e:docker": "./tests/e2e/run-docker-e2e.sh",