actual-mcp-server 0.6.37 → 0.6.41

package/README.md

@@ -750,4 +750,4 @@ The software is provided **as-is**, without warranty of any kind. The author acc
 
 ---
 
-**Version:** 0.6.37 | **Tool Count:** 70 (verified LibreChat-compatible)
+**Version:** 0.6.41 | **Tool Count:** 70 (verified LibreChat-compatible)

package/dist/package.json

@@ -1,7 +1,7 @@
 {
     "name": "actual-mcp-server",
     "displayName": "Actual MCP Server",
-    "version": "0.6.37",
+    "version": "0.6.41",
     "engines": {
         "node": ">=20.0.0",
         "npm": ">=10.0.0"
@@ -71,14 +71,6 @@
     "optionalDependencies": {
         "prom-client": "*"
     },
-    "overrides": {
-        "ajv": "8.18.0",
-        "qs": "6.14.2",
-        "fast-uri": "^3.1.2"
-    },
-    "comments": {
-        "security-overrides": "ajv>=8.18.0 (CVE alert #21), qs>=6.14.2 (alert #17), fast-uri>=3.1.2 (GHSA-q3j6-qgpj-74h6 + GHSA-v39h-62p7-jpjc)"
-    },
     "devDependencies": {
         "@playwright/test": "^1.60.0",
         "@types/express": "^5.0.3",

package/dist/src/lib/actual-adapter.js

@@ -1037,6 +1037,18 @@ export async function updateTransactionBatch(updates) {
 export async function deleteTransaction(id) {
     observability.incrementToolCall('actual.transactions.delete').catch(() => { });
     return queueWriteOperation(async () => {
+        // Pre-flight existence check: the raw API silently no-ops on a missing id and would
+        // otherwise report success for a delete that removed nothing. A targeted ActualQL
+        // query by id keeps this cheap (indexed lookup, not a full-table scan).
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const { q } = (await import('@actual-app/api'));
+        const found = await withConcurrency(() => retry(async () => {
+            const res = (await rawRunQuery(q('transactions').filter({ id }).select(['id'])));
+            return Array.isArray(res?.data) && res.data.length > 0;
+        }, { retries: 2, backoffMs: 200 }));
+        if (!found) {
+            throw new Error(`Transaction "${id}" not found. Use actual_transactions_get to list transactions.`);
+        }
         // Non-idempotent: do not retry (#165). A retry after a lost-response would
         // re-issue the delete against an already-removed record and surface a
         // confusing "not found" even though the first attempt succeeded.

package/dist/src/tools/category_groups_delete.js

@@ -20,10 +20,9 @@ const tool = {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any
             const groupExists = groups.some((g) => g.id === input.id);
             if (!groupExists) {
-                return {
-                    error: notFoundMsg('Category group', input.id, 'actual_category_groups_get'),
-                    success: false,
-                };
+                // Throw (not return {success:false}) so a non-existent id surfaces as an MCP
+                // error, consistent with every other delete tool's not-found behavior.
+                throw new Error(notFoundMsg('Category group', input.id, 'actual_category_groups_get'));
             }
             await rawDeleteCategoryGroup(input.id);
             return { success: true };

package/dist/src/tools/payees_delete.js

@@ -1,8 +1,5 @@
 import { z } from 'zod';
 import adapter from '../lib/actual-adapter.js';
-import api from '@actual-app/api';
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-const { deletePayee: rawDeletePayee } = api;
 const InputSchema = z.object({
     id: z.string().describe('Payee ID to delete'),
 });
@@ -12,12 +9,13 @@ const tool = {
     inputSchema: InputSchema,
     call: async (args, _meta) => {
         const input = InputSchema.parse(args || {});
-        // Single-write tool, but uses withWriteSession for consistency with the other
-        // delete tools and to share the same lock-cycle invariant (#142).
-        return await adapter.withWriteSession(async () => {
-            await rawDeletePayee(input.id);
-            return { success: true };
-        });
+        // Route through the guarded adapter method (pre-flight existence check), not the
+        // raw api.deletePayee. The raw call throws a cryptic "Cannot destructure property
+        // 'transfer_acct' of null" on a non-existent id; adapter.deletePayee returns an
+        // actionable "Payee not found" instead. adapter.deletePayee already runs inside a
+        // single write-queue cycle, preserving the #142 lock invariant.
+        await adapter.deletePayee(input.id);
+        return { success: true };
     },
 };
 export default tool;

package/dist/src/tools/rules_delete.js

@@ -20,10 +20,9 @@ const tool = {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any
             const ruleExists = allRules.some((r) => r.id === input.id);
             if (!ruleExists) {
-                return {
-                    error: notFoundMsg('Rule', input.id, 'actual_rules_get'),
-                    success: false,
-                };
+                // Throw (not return {success:false}) so a non-existent id surfaces as an MCP
+                // error, consistent with every other delete tool's not-found behavior.
+                throw new Error(notFoundMsg('Rule', input.id, 'actual_rules_get'));
             }
             await rawDeleteRule(input.id);
             return { success: true };

package/dist/src/tools/schedules_delete.js

@@ -23,10 +23,9 @@ const tool = {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any
             const scheduleExists = schedules.some((s) => s.id === input.id);
             if (!scheduleExists) {
-                return {
-                    error: notFoundMsg('Schedule', input.id, 'actual_schedules_get'),
-                    success: false,
-                };
+                // Throw (not return {success:false}) so a non-existent id surfaces as an MCP
+                // error, consistent with every other delete tool's not-found behavior.
+                throw new Error(notFoundMsg('Schedule', input.id, 'actual_schedules_get'));
             }
             try {
                 await rawDeleteSchedule(input.id);
@@ -35,10 +34,9 @@ const tool = {
             catch (err) {
                 const msg = err instanceof Error ? err.message : String(err);
                 if (msg.includes('NOT NULL constraint') || msg.includes('messages_crdt')) {
-                    return {
-                        error: constraintErrorMsg('Schedule', input.id, 'actual_schedules_get'),
-                        success: false,
-                    };
+                    // Translate the raw SQLite constraint error into an actionable message, thrown
+                    // for the same consistency reason as the not-found case above.
+                    throw new Error(constraintErrorMsg('Schedule', input.id, 'actual_schedules_get'));
                 }
                 throw err;
             }

package/dist/src/tools/transactions_delete.js

@@ -6,9 +6,8 @@ const InputSchema = z.object({
 const tool = {
     name: 'actual_transactions_delete',
     description: 'Delete a transaction from Actual Budget by its ID. ' +
-        'Note: if the transaction does not exist, the call will still return { success: true } ' +
-        'because the Actual Budget API does not distinguish between a successful delete and a no-op. ' +
-        'Use actual_transactions_filter to verify the transaction exists before deleting. ' +
+        'If the transaction does not exist, the call returns an actionable "not found" error ' +
+        '(the adapter verifies existence first, since the raw Actual Budget API silently no-ops on a missing id). ' +
         'This permanently removes the transaction and updates account balances accordingly. This operation cannot be undone.',
     inputSchema: InputSchema,
     call: async (args, _meta) => {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "actual-mcp-server",
   "displayName": "Actual MCP Server",
-  "version": "0.6.37",
+  "version": "0.6.41",
   "engines": {
     "node": ">=20.0.0",
     "npm": ">=10.0.0"
@@ -71,14 +71,6 @@
   "optionalDependencies": {
     "prom-client": "*"
   },
-  "overrides": {
-    "ajv": "8.18.0",
-    "qs": "6.14.2",
-    "fast-uri": "^3.1.2"
-  },
-  "comments": {
-    "security-overrides": "ajv>=8.18.0 (CVE alert #21), qs>=6.14.2 (alert #17), fast-uri>=3.1.2 (GHSA-q3j6-qgpj-74h6 + GHSA-v39h-62p7-jpjc)"
-  },
   "devDependencies": {
     "@playwright/test": "^1.60.0",
     "@types/express": "^5.0.3",