actual-mcp-server 0.7.13 → 0.8.1

package/README.md

@@ -473,6 +473,7 @@ All configuration is via environment variables. Copy `.env.example` to `.env` to
 | `OIDC_ALLOW_INSECURE_ISSUER` | `false` | No | Allow a plaintext (http) OIDC issuer on a trusted network (#244). Off by default (http issuer refused at startup); set `true` only for local/LAN testing |
 | `OIDC_RESOURCE` | _(none)_ | No | Expected `aud` claim in JWT (your client ID) |
 | `OIDC_ACCEPTED_AUDIENCES` | _(none)_ | No | Extra accepted `aud` values beyond `OIDC_RESOURCE`, comma-separated (#245). For IdPs that put the client-id in `aud` (e.g. Authentik). Strict allowlist, never a wildcard |
+| `OIDC_JWKS_TRUSTED_HOSTS` | _(none)_ | No | Opt-in cross-origin JWKS hosts, comma-separated `host` or `host:port` (#254). For IdPs whose `jwks_uri` lives on another host, e.g. Google needs `www.googleapis.com`. Exact match, no wildcards; empty default keeps same-origin-only |
 | `OIDC_SCOPES` | _(none)_ | No | Comma-separated required scopes; leave empty for Casdoor |
 | `AUTH_BUDGET_ACL` | _(none)_ | No | Per-user budget ACL; see [AI Client Setup](docs/guides/AI_CLIENT_SETUP.md#oidc-authentication-multi-user) |
 | `MCP_ENABLE_HTTPS` | `false` | No | Enable native TLS. Requires `MCP_HTTPS_CERT` and `MCP_HTTPS_KEY` |
@@ -718,4 +719,4 @@ The software is provided **as-is**, without warranty of any kind. The author acc
 
 ---
 
-**Version:** 0.7.13 | **Tool Count:** 71 (verified LibreChat-compatible)
+**Version:** 0.8.1 | **Tool Count:** 71 (verified LibreChat-compatible)

package/dist/package.json

@@ -1,7 +1,7 @@
 {
     "name": "actual-mcp-server",
     "displayName": "Actual MCP Server",
-    "version": "0.7.13",
+    "version": "0.8.1",
     "engines": {
         "node": ">=22.0.0",
         "npm": ">=10.0.0"
@@ -30,7 +30,7 @@
         "verify-tools": "npm run build && node scripts/verify-tools.js",
         "check:coverage": "node scripts/list-actual-api-methods.mjs",
         "direct-sync": "node scripts/direct-sync/bank-sync-direct.mjs",
-        "test:unit-js": "node tests/unit/transactions_create.test.js && node tests/unit/generated_tools.smoke.test.js && node tests/unit/schema_validation.test.js && node tests/unit/config_https_validation.test.js && node tests/unit/config_data_dir.test.js && node tests/unit/config_drift.test.js && node tests/unit/port_alignment.test.js && node tests/unit/dockerfile_data_dir_alignment.test.js && node tests/unit/unraid_template_alignment.test.js && node tests/unit/entrypoint_invariants.test.js && node tests/unit/compose_profile_sync.test.js && node tests/unit/advertised_tools_sync.test.js && node tests/unit/knip_config.test.js && node tests/unit/readme_stats_sync.test.js && node tests/unit/config_insecure_upstream.test.js && node tests/unit/auth_posture.test.js && node tests/unit/auth_posture_wiring.test.js && node tests/unit/auth-acl.test.js && node tests/unit/bug76.test.js && node tests/unit/budgets_setAmount.test.js && node tests/unit/budgets_transfer.test.js && node tests/unit/transactions_uncategorized.test.js && node tests/unit/httpServer_session_init.test.js && node tests/unit/httpServer_session_not_found.test.js && node tests/unit/manual_mcp_client_retry.test.js && node tests/unit/manual_mcp_client_session.test.js && node tests/unit/manual_mcp_client_circuit.test.js && node tests/unit/manual_runner_killswitch.test.js && node tests/unit/adapter_auth_rate_limit.test.js && node tests/unit/adapter_session_reuse.test.js && node tests/unit/retry_classifier.test.js && node tests/unit/adapter_module_surface.test.js && node tests/unit/adapter_nonidempotent_no_retry.test.js && node tests/unit/pool_liveness.test.js && node tests/unit/pool_shutdown_all.test.js && node tests/unit/query_where_operators.test.js && node tests/unit/query_run_validation.test.js && node tests/unit/adapter_with_write_session.test.js && node tests/unit/category_groups_delete.test.js && node tests/unit/rules_delete.test.js && node tests/unit/schedules_delete.test.js && node tests/unit/payees_delete.test.js && node tests/unit/rules_create_or_update.test.js && node tests/unit/unhandled-rejection.test.js && node tests/unit/rejection-allowlist-purity.test.js && node tests/unit/httpServer_bearer_auth.test.js && node tests/unit/httpServer_oidc_audience.test.js && node tests/unit/httpServer_oidc_auth_verification.test.js && node tests/unit/httpServer_oidc_jwks_discovery.test.js && node tests/unit/httpServer_body_limit.test.js && node tests/unit/httpServer_bind_host.test.js && node tests/unit/adapter_write_pool_cooperation.test.js && node tests/unit/budget_acl_enforcement.test.js && node tests/unit/budget_preference_store.test.js && node tests/unit/budget_preference_restore.test.js && node tests/unit/tags_list.test.js && node tests/unit/tags_create.test.js && node tests/unit/tags_update.test.js && node tests/unit/tags_delete.test.js && node tests/unit/notes_get.test.js && node tests/unit/notes_update.test.js && node tests/unit/payees_common_list.test.js && node tests/unit/transactions_update_guard.test.js && node tests/unit/entities_search.test.js && node tests/unit/transactions_import_schema.test.js && node tests/unit/tool_schema_shape.test.js && node tests/unit/zod_error_format.test.js && node tests/unit/tool_count_sync.test.js && node tests/unit/stdio_transport.test.js && node tests/unit/logger_structured.test.js && node tests/unit/logger_redaction.test.js && node tests/unit/logger_correlation.test.js && node tests/unit/check_coverage.test.js",
+        "test:unit-js": "node tests/unit/transactions_create.test.js && node tests/unit/generated_tools.smoke.test.js && node tests/unit/schema_validation.test.js && node tests/unit/config_https_validation.test.js && node tests/unit/config_data_dir.test.js && node tests/unit/config_drift.test.js && node tests/unit/port_alignment.test.js && node tests/unit/dockerfile_data_dir_alignment.test.js && node tests/unit/unraid_template_alignment.test.js && node tests/unit/entrypoint_invariants.test.js && node tests/unit/compose_profile_sync.test.js && node tests/unit/advertised_tools_sync.test.js && node tests/unit/knip_config.test.js && node tests/unit/readme_stats_sync.test.js && node tests/unit/config_insecure_upstream.test.js && node tests/unit/workflow_release_guards.test.js && node tests/unit/bot_target_branch.test.js && node tests/unit/auth_posture.test.js && node tests/unit/auth_posture_wiring.test.js && node tests/unit/auth-acl.test.js && node tests/unit/bug76.test.js && node tests/unit/budgets_setAmount.test.js && node tests/unit/budgets_transfer.test.js && node tests/unit/transactions_uncategorized.test.js && node tests/unit/httpServer_session_init.test.js && node tests/unit/httpServer_session_not_found.test.js && node tests/unit/manual_mcp_client_retry.test.js && node tests/unit/manual_mcp_client_session.test.js && node tests/unit/manual_mcp_client_circuit.test.js && node tests/unit/manual_runner_killswitch.test.js && node tests/unit/adapter_auth_rate_limit.test.js && node tests/unit/adapter_session_reuse.test.js && node tests/unit/retry_classifier.test.js && node tests/unit/adapter_module_surface.test.js && node tests/unit/adapter_nonidempotent_no_retry.test.js && node tests/unit/pool_liveness.test.js && node tests/unit/pool_shutdown_all.test.js && node tests/unit/query_where_operators.test.js && node tests/unit/query_run_validation.test.js && node tests/unit/adapter_with_write_session.test.js && node tests/unit/category_groups_delete.test.js && node tests/unit/rules_delete.test.js && node tests/unit/schedules_delete.test.js && node tests/unit/payees_delete.test.js && node tests/unit/rules_create_or_update.test.js && node tests/unit/unhandled-rejection.test.js && node tests/unit/rejection-allowlist-purity.test.js && node tests/unit/httpServer_bearer_auth.test.js && node tests/unit/httpServer_oidc_audience.test.js && node tests/unit/httpServer_oidc_auth_verification.test.js && node tests/unit/httpServer_oidc_jwks_discovery.test.js && node tests/unit/httpServer_body_limit.test.js && node tests/unit/httpServer_bind_host.test.js && node tests/unit/adapter_write_pool_cooperation.test.js && node tests/unit/budget_acl_enforcement.test.js && node tests/unit/budget_preference_store.test.js && node tests/unit/budget_preference_restore.test.js && node tests/unit/tags_list.test.js && node tests/unit/tags_create.test.js && node tests/unit/tags_update.test.js && node tests/unit/tags_delete.test.js && node tests/unit/notes_get.test.js && node tests/unit/notes_update.test.js && node tests/unit/payees_common_list.test.js && node tests/unit/transactions_update_guard.test.js && node tests/unit/entities_search.test.js && node tests/unit/transactions_import_schema.test.js && node tests/unit/tool_schema_shape.test.js && node tests/unit/zod_error_format.test.js && node tests/unit/tool_count_sync.test.js && node tests/unit/stdio_transport.test.js && node tests/unit/logger_structured.test.js && node tests/unit/logger_redaction.test.js && node tests/unit/logger_correlation.test.js && node tests/unit/check_coverage.test.js",
         "test:adapter": "npm run build && node dist/src/tests_adapter_runner.js",
         "test:e2e": "npx playwright test",
         "test:e2e:docker": "./tests/e2e/run-docker-e2e.sh",
@@ -78,7 +78,7 @@
     "devDependencies": {
         "@playwright/test": "^1.60.0",
         "@types/express": "^5.0.3",
-        "@types/node": "^25.9.2",
+        "@types/node": "^26.1.0",
         "knip": "^6.16.1",
         "node-fetch": "^3.3.2",
         "tsconfig-paths": "^4.2.0",

package/dist/src/config.js

@@ -46,6 +46,11 @@ export const configSchema = z.object({
     // Strict closed allowlist: the accepted set is OIDC_RESOURCE plus these; never a
     // wildcard. Default empty, so single-audience deployments are unchanged.
     OIDC_ACCEPTED_AUDIENCES: z.string().optional(),
+    // #254: opt-in allowlist of cross-origin JWKS hosts, comma-separated `host` or
+    // `host:port` entries (e.g. "www.googleapis.com" for a Google issuer). Raw string
+    // here; parsed fail-fast by buildTrustedJwksHosts (oidc-discovery.ts) at the
+    // composition root, per the #245 pattern. Default empty: same-origin only.
+    OIDC_JWKS_TRUSTED_HOSTS: z.string().optional(),
     // Comma-separated required scopes (e.g. "read,write"). Optional.
     OIDC_SCOPES: z.string().optional(),
     // JSON map of principal → budget sync-ID list for per-user budget ACL.

package/dist/src/lib/oidc-discovery.js

@@ -14,12 +14,14 @@ import { createModuleLogger } from './loggerFactory.js';
  *   - the resolved `jwks_uri` must be https and on the SAME host as the issuer, so
  *     a tampered or misconfigured discovery document cannot point key fetching at
  *     an attacker-controlled host. Cross-host issuers (for example Google, which
- *     serves keys from googleapis.com) are intentionally not auto-trusted; that is
- *     a separate, configurable follow-up (#245).
+ *     serves keys from googleapis.com) are never auto-trusted; the operator can
+ *     allowlist specific cross-origin JWKS hosts via OIDC_JWKS_TRUSTED_HOSTS
+ *     (#254, opt-in, exact host:port match, https required unconditionally).
  *
- * The pure helpers (assertSecureIssuer, resolveJwksUri) are unit-tested without a
- * network; discoverJwksUri wraps them around a single startup fetch and fails
- * closed on any problem.
+ * The helpers (assertSecureIssuer, buildTrustedJwksHosts, resolveJwksUri) are
+ * network-free and unit-tested directly (resolveJwksUri logs on the allowlist
+ * accept path, otherwise side-effect free); discoverJwksUri wraps them around a
+ * single startup fetch and fails closed on any problem.
  */
 const logger = createModuleLogger('OIDC_DISCOVERY');
 const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '::1', '[::1]']);
@@ -28,6 +30,47 @@ const DISCOVERY_TIMEOUT_MS = 10_000;
 export function isLoopbackHost(host) {
     return host ? LOOPBACK_HOSTS.has(host.toLowerCase()) : false;
 }
+/**
+ * Parse OIDC_JWKS_TRUSTED_HOSTS (comma-separated `host` or `host:port`
+ * entries) into a normalized, deduplicated allowlist (#254). Mirrors the #245
+ * buildAcceptedAudiences pattern: config stays a raw string, parsing happens
+ * here, and the result is threaded as a parameter. Entries are trimmed,
+ * lowercased, and empties dropped, then validated by a URL round-trip: an
+ * entry must equal `new URL('https://' + entry).host`, which rejects in one
+ * rule everything that could never match a real jwks_uri host: schemes,
+ * paths, credentials, wildcards, whitespace, empty or non-numeric ports,
+ * default-port `:443` suffixes (URL.host elides them, so such an entry would
+ * be silently inert), raw-unicode IDN (URL.host is punycode), and unbracketed
+ * IPv6. THROWS on the first invalid entry so a misconfigured allowlist fails
+ * fast at startup instead of silently failing closed at the first
+ * cross-origin issuer.
+ */
+export function buildTrustedJwksHosts(configured) {
+    if (!configured)
+        return [];
+    const entries = configured
+        .split(',')
+        .map((entry) => entry.trim().toLowerCase())
+        .filter(Boolean);
+    for (const entry of entries) {
+        let canonical;
+        try {
+            canonical = new URL(`https://${entry}`).host;
+        }
+        catch {
+            canonical = undefined;
+        }
+        // WHATWG URL does not forbid "*" in a hostname, so the round-trip alone
+        // would let a wildcard through; there is deliberately no wildcard matching.
+        if (entry.includes('*') || canonical !== entry) {
+            throw new Error(`OIDC_JWKS_TRUSTED_HOSTS entry is invalid: "${entry}". Entries must be canonical URL ` +
+                'hosts: a bare lowercase hostname, optionally with a NON-default port (host:port; ' +
+                '":443" is elided by URL parsing and would never match), no scheme, path, ' +
+                'credentials, or wildcards; IDN as punycode; IPv6 in brackets.');
+        }
+    }
+    return Array.from(new Set(entries));
+}
 /**
  * Parse and validate the issuer URL. Throws unless it is https, or an explicit
  * loopback host (local dev). Returns the parsed URL.
@@ -62,11 +105,16 @@ export function assertSecureIssuer(issuer, allowInsecure = false) {
     return url;
 }
 /**
- * Pure: resolve and validate the `jwks_uri` from a parsed discovery document
- * against the issuer. Throws (fail closed) if it is missing, not https, carries
- * embedded credentials, or is not same-origin (scheme + host + port) with the issuer.
+ * Network-free: resolve and validate the `jwks_uri` from a parsed discovery
+ * document against the issuer. Throws (fail closed) if it is missing, not
+ * https, carries embedded credentials, or is not same-origin (scheme + host +
+ * port) with the issuer, UNLESS the jwks host is explicitly listed in
+ * `trustedHosts` (#254): an allowlisted cross-origin jwks_uri is accepted,
+ * must still be https (no OIDC_ALLOW_INSECURE_ISSUER or loopback exemption on
+ * the cross-origin path), and the acceptance is audit-logged (the one side
+ * effect of this function).
  */
-export function resolveJwksUri(discoveryDoc, issuer, allowInsecure = false) {
+export function resolveJwksUri(discoveryDoc, issuer, allowInsecure = false, trustedHosts = []) {
     const issuerUrl = assertSecureIssuer(issuer, allowInsecure);
     if (!discoveryDoc || typeof discoveryDoc !== 'object') {
         throw new Error('OIDC discovery document is empty or not an object');
@@ -92,8 +140,34 @@ export function resolveJwksUri(discoveryDoc, issuer, allowInsecure = false) {
     // same host is a different service, so comparing origins keeps the guarantee the
     // security review asked for. Both are https here, so this is effectively host+port.
     if (jwks.origin.toLowerCase() !== issuerUrl.origin.toLowerCase()) {
-        throw new Error(`OIDC "jwks_uri" origin (${jwks.origin}) does not match the issuer origin (${issuerUrl.origin}); ` +
-            'refusing a cross-origin key fetch. A cross-host issuer (e.g. Google) needs an explicit trusted-host allowlist (#245).');
+        // #254: opt-in escape hatch for legitimately cross-host IdPs (Google serves
+        // JWKS from www.googleapis.com). Matching is on URL.host (hostname PLUS any
+        // non-default port), exact and lowercased: a bare-host entry does not trust
+        // odd ports on that host, preserving this file's origin-level strictness.
+        // Empty allowlist (the default) makes this branch behave exactly as before.
+        const jwksHost = jwks.host.toLowerCase();
+        if (!trustedHosts.includes(jwksHost)) {
+            throw new Error(`OIDC "jwks_uri" origin (${jwks.origin}) does not match the issuer origin (${issuerUrl.origin}); ` +
+                `refusing a cross-origin key fetch. Checked host "${jwksHost}" against ` +
+                `OIDC_JWKS_TRUSTED_HOSTS [${trustedHosts.join(', ')}]; matching is exact on host:port ` +
+                '(#254). A cross-host issuer (e.g. Google) needs its JWKS host explicitly allowlisted.');
+        }
+        // An allowlisted CROSS-ORIGIN fetch must be https, with no exemption: not
+        // for OIDC_ALLOW_INSECURE_ISSUER (the #244 opt-out covers a same-origin LAN
+        // issuer, never third-party key hosts) and not for loopback (a shared-host
+        // process could bind the port). Without this, combining the two opt-ins
+        // would newly permit a plaintext cross-origin key fetch that pre-#254 code
+        // always refused.
+        if (jwks.protocol !== 'https:') {
+            throw new Error(`OIDC cross-origin "jwks_uri" allowed by OIDC_JWKS_TRUSTED_HOSTS must use https (got ${jwks.protocol}); ` +
+                'the OIDC_ALLOW_INSECURE_ISSUER opt-out never extends to cross-origin key fetches (#254).');
+        }
+        // Audit trail: a normally-rejected cross-origin trust was relaxed by operator config.
+        logger.info('cross-origin JWKS host allowed by OIDC_JWKS_TRUSTED_HOSTS', {
+            issuerOrigin: issuerUrl.origin,
+            jwksHost,
+            jwksUri: jwks.toString(),
+        });
     }
     return jwks.toString();
 }
@@ -102,7 +176,7 @@ export function resolveJwksUri(discoveryDoc, issuer, allowInsecure = false) {
  * Fails closed on any problem (non-https issuer, redirect, non-200, bad JSON,
  * missing/invalid/cross-host jwks_uri). `fetchImpl` is injectable for testing.
  */
-export async function discoverJwksUri(issuer, allowInsecure = false, fetchImpl = fetch) {
+export async function discoverJwksUri(issuer, allowInsecure = false, trustedHosts = [], fetchImpl = fetch) {
     assertSecureIssuer(issuer, allowInsecure);
     const base = issuer.endsWith('/') ? issuer.slice(0, -1) : issuer;
     const discoveryUrl = `${base}/.well-known/openid-configuration`;
@@ -126,7 +200,7 @@ export async function discoverJwksUri(issuer, allowInsecure = false, fetchImpl =
     catch {
         throw new Error(`OIDC discovery document at ${discoveryUrl} is not valid JSON`);
     }
-    const jwksUri = resolveJwksUri(doc, issuer, allowInsecure);
+    const jwksUri = resolveJwksUri(doc, issuer, allowInsecure, trustedHosts);
     logger.info('Resolved JWKS URI from OIDC discovery', { jwksUri });
     return jwksUri;
 }

package/dist/src/server/httpServer.js

@@ -13,7 +13,7 @@ import config from '../config.js';
 import { createRemoteJWKSet, jwtVerify } from 'jose';
 import { MCPAuthTokenVerificationError } from 'mcp-auth';
 import { createMcpAuth } from '../auth/setup.js';
-import { discoverJwksUri } from '../lib/oidc-discovery.js';
+import { discoverJwksUri, buildTrustedJwksHosts } from '../lib/oidc-discovery.js';
 import { buildAcceptedAudiences } from '../lib/oidc-audiences.js';
 import { budgetAclMiddleware } from '../auth/budget-acl.js';
 import * as https from 'node:https';
@@ -83,7 +83,10 @@ advertisedUrl) {
             // closed on a non-https issuer, a cross-origin redirect, a missing/invalid
             // jwks_uri, or a jwks_uri on a different host than the issuer. jose's
             // createRemoteJWKSet then fetches the keys lazily and caches them.
-            const jwksUri = await discoverJwksUri(config.OIDC_ISSUER, config.OIDC_ALLOW_INSECURE_ISSUER);
+            // #254: opt-in cross-origin JWKS trusted hosts (e.g. Google serves keys from
+            // www.googleapis.com). Parsed fail-fast here at the composition root and
+            // threaded as a parameter; empty (the default) keeps same-origin-only.
+            const jwksUri = await discoverJwksUri(config.OIDC_ISSUER, config.OIDC_ALLOW_INSECURE_ISSUER, buildTrustedJwksHosts(config.OIDC_JWKS_TRUSTED_HOSTS));
             const jwks = createRemoteJWKSet(new URL(jwksUri));
             const customJwtVerify = async (token) => {
                 // Enforce the audience claim (#160, OWASP A07). Without it, any

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "actual-mcp-server",
   "displayName": "Actual MCP Server",
-  "version": "0.7.13",
+  "version": "0.8.1",
   "engines": {
     "node": ">=22.0.0",
     "npm": ">=10.0.0"
@@ -30,7 +30,7 @@
     "verify-tools": "npm run build && node scripts/verify-tools.js",
     "check:coverage": "node scripts/list-actual-api-methods.mjs",
     "direct-sync": "node scripts/direct-sync/bank-sync-direct.mjs",
-    "test:unit-js": "node tests/unit/transactions_create.test.js && node tests/unit/generated_tools.smoke.test.js && node tests/unit/schema_validation.test.js && node tests/unit/config_https_validation.test.js && node tests/unit/config_data_dir.test.js && node tests/unit/config_drift.test.js && node tests/unit/port_alignment.test.js && node tests/unit/dockerfile_data_dir_alignment.test.js && node tests/unit/unraid_template_alignment.test.js && node tests/unit/entrypoint_invariants.test.js && node tests/unit/compose_profile_sync.test.js && node tests/unit/advertised_tools_sync.test.js && node tests/unit/knip_config.test.js && node tests/unit/readme_stats_sync.test.js && node tests/unit/config_insecure_upstream.test.js && node tests/unit/auth_posture.test.js && node tests/unit/auth_posture_wiring.test.js && node tests/unit/auth-acl.test.js && node tests/unit/bug76.test.js && node tests/unit/budgets_setAmount.test.js && node tests/unit/budgets_transfer.test.js && node tests/unit/transactions_uncategorized.test.js && node tests/unit/httpServer_session_init.test.js && node tests/unit/httpServer_session_not_found.test.js && node tests/unit/manual_mcp_client_retry.test.js && node tests/unit/manual_mcp_client_session.test.js && node tests/unit/manual_mcp_client_circuit.test.js && node tests/unit/manual_runner_killswitch.test.js && node tests/unit/adapter_auth_rate_limit.test.js && node tests/unit/adapter_session_reuse.test.js && node tests/unit/retry_classifier.test.js && node tests/unit/adapter_module_surface.test.js && node tests/unit/adapter_nonidempotent_no_retry.test.js && node tests/unit/pool_liveness.test.js && node tests/unit/pool_shutdown_all.test.js && node tests/unit/query_where_operators.test.js && node tests/unit/query_run_validation.test.js && node tests/unit/adapter_with_write_session.test.js && node tests/unit/category_groups_delete.test.js && node tests/unit/rules_delete.test.js && node tests/unit/schedules_delete.test.js && node tests/unit/payees_delete.test.js && node tests/unit/rules_create_or_update.test.js && node tests/unit/unhandled-rejection.test.js && node tests/unit/rejection-allowlist-purity.test.js && node tests/unit/httpServer_bearer_auth.test.js && node tests/unit/httpServer_oidc_audience.test.js && node tests/unit/httpServer_oidc_auth_verification.test.js && node tests/unit/httpServer_oidc_jwks_discovery.test.js && node tests/unit/httpServer_body_limit.test.js && node tests/unit/httpServer_bind_host.test.js && node tests/unit/adapter_write_pool_cooperation.test.js && node tests/unit/budget_acl_enforcement.test.js && node tests/unit/budget_preference_store.test.js && node tests/unit/budget_preference_restore.test.js && node tests/unit/tags_list.test.js && node tests/unit/tags_create.test.js && node tests/unit/tags_update.test.js && node tests/unit/tags_delete.test.js && node tests/unit/notes_get.test.js && node tests/unit/notes_update.test.js && node tests/unit/payees_common_list.test.js && node tests/unit/transactions_update_guard.test.js && node tests/unit/entities_search.test.js && node tests/unit/transactions_import_schema.test.js && node tests/unit/tool_schema_shape.test.js && node tests/unit/zod_error_format.test.js && node tests/unit/tool_count_sync.test.js && node tests/unit/stdio_transport.test.js && node tests/unit/logger_structured.test.js && node tests/unit/logger_redaction.test.js && node tests/unit/logger_correlation.test.js && node tests/unit/check_coverage.test.js",
+    "test:unit-js": "node tests/unit/transactions_create.test.js && node tests/unit/generated_tools.smoke.test.js && node tests/unit/schema_validation.test.js && node tests/unit/config_https_validation.test.js && node tests/unit/config_data_dir.test.js && node tests/unit/config_drift.test.js && node tests/unit/port_alignment.test.js && node tests/unit/dockerfile_data_dir_alignment.test.js && node tests/unit/unraid_template_alignment.test.js && node tests/unit/entrypoint_invariants.test.js && node tests/unit/compose_profile_sync.test.js && node tests/unit/advertised_tools_sync.test.js && node tests/unit/knip_config.test.js && node tests/unit/readme_stats_sync.test.js && node tests/unit/config_insecure_upstream.test.js && node tests/unit/workflow_release_guards.test.js && node tests/unit/bot_target_branch.test.js && node tests/unit/auth_posture.test.js && node tests/unit/auth_posture_wiring.test.js && node tests/unit/auth-acl.test.js && node tests/unit/bug76.test.js && node tests/unit/budgets_setAmount.test.js && node tests/unit/budgets_transfer.test.js && node tests/unit/transactions_uncategorized.test.js && node tests/unit/httpServer_session_init.test.js && node tests/unit/httpServer_session_not_found.test.js && node tests/unit/manual_mcp_client_retry.test.js && node tests/unit/manual_mcp_client_session.test.js && node tests/unit/manual_mcp_client_circuit.test.js && node tests/unit/manual_runner_killswitch.test.js && node tests/unit/adapter_auth_rate_limit.test.js && node tests/unit/adapter_session_reuse.test.js && node tests/unit/retry_classifier.test.js && node tests/unit/adapter_module_surface.test.js && node tests/unit/adapter_nonidempotent_no_retry.test.js && node tests/unit/pool_liveness.test.js && node tests/unit/pool_shutdown_all.test.js && node tests/unit/query_where_operators.test.js && node tests/unit/query_run_validation.test.js && node tests/unit/adapter_with_write_session.test.js && node tests/unit/category_groups_delete.test.js && node tests/unit/rules_delete.test.js && node tests/unit/schedules_delete.test.js && node tests/unit/payees_delete.test.js && node tests/unit/rules_create_or_update.test.js && node tests/unit/unhandled-rejection.test.js && node tests/unit/rejection-allowlist-purity.test.js && node tests/unit/httpServer_bearer_auth.test.js && node tests/unit/httpServer_oidc_audience.test.js && node tests/unit/httpServer_oidc_auth_verification.test.js && node tests/unit/httpServer_oidc_jwks_discovery.test.js && node tests/unit/httpServer_body_limit.test.js && node tests/unit/httpServer_bind_host.test.js && node tests/unit/adapter_write_pool_cooperation.test.js && node tests/unit/budget_acl_enforcement.test.js && node tests/unit/budget_preference_store.test.js && node tests/unit/budget_preference_restore.test.js && node tests/unit/tags_list.test.js && node tests/unit/tags_create.test.js && node tests/unit/tags_update.test.js && node tests/unit/tags_delete.test.js && node tests/unit/notes_get.test.js && node tests/unit/notes_update.test.js && node tests/unit/payees_common_list.test.js && node tests/unit/transactions_update_guard.test.js && node tests/unit/entities_search.test.js && node tests/unit/transactions_import_schema.test.js && node tests/unit/tool_schema_shape.test.js && node tests/unit/zod_error_format.test.js && node tests/unit/tool_count_sync.test.js && node tests/unit/stdio_transport.test.js && node tests/unit/logger_structured.test.js && node tests/unit/logger_redaction.test.js && node tests/unit/logger_correlation.test.js && node tests/unit/check_coverage.test.js",
     "test:adapter": "npm run build && node dist/src/tests_adapter_runner.js",
     "test:e2e": "npx playwright test",
     "test:e2e:docker": "./tests/e2e/run-docker-e2e.sh",
@@ -78,7 +78,7 @@
   "devDependencies": {
     "@playwright/test": "^1.60.0",
     "@types/express": "^5.0.3",
-    "@types/node": "^25.9.2",
+    "@types/node": "^26.1.0",
     "knip": "^6.16.1",
     "node-fetch": "^3.3.2",
     "tsconfig-paths": "^4.2.0",