actual-mcp-server 0.8.17 → 0.9.1

package/README.md

@@ -8,8 +8,8 @@
 [![npm downloads](https://img.shields.io/npm/dm/actual-mcp-server)](https://www.npmjs.com/package/actual-mcp-server)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![Node.js Version](https://img.shields.io/badge/node-%3E%3D22.0.0-brightgreen)](https://nodejs.org/)
-[![TypeScript](https://img.shields.io/badge/TypeScript-6.0-blue)](https://www.typescriptlang.org/)
-[![MCP Protocol](https://img.shields.io/badge/MCP-1.29-orange)](https://modelcontextprotocol.io/)
+[![TypeScript](https://img.shields.io/badge/TypeScript-7.0-blue)](https://www.typescriptlang.org/)
+[![MCP Protocol](https://img.shields.io/badge/MCP-1.30-orange)](https://modelcontextprotocol.io/)
 [![Docker Pulls](https://img.shields.io/docker/pulls/agigante80/actual-mcp-server)](https://hub.docker.com/r/agigante80/actual-mcp-server)
 [![Docker Image Size](https://img.shields.io/docker/image-size/agigante80/actual-mcp-server/latest)](https://hub.docker.com/r/agigante80/actual-mcp-server)
 [![Unraid Community Apps](https://img.shields.io/badge/Unraid-Community%20Apps-f15a2c?logo=unraid&logoColor=white)](https://ca.unraid.net/apps/actual-mcp-server-0bghkvs0c7c8bg)
@@ -326,11 +326,13 @@ For Claude Desktop (stdio), restart Claude after upgrading.
 |------|-------------|
 | `actual_transactions_get` | Get transactions for an account |
 | `actual_transactions_filter` | Filter with advanced criteria |
-| `actual_transactions_create` | Create new transaction(s) |
+| `actual_transactions_create` | Create new transaction(s), including splits (pass a `subtransactions` array) |
 | `actual_transactions_import` | Import and reconcile transactions |
-| `actual_transactions_update` | Update a transaction |
+| `actual_transactions_update` | Update a transaction, or edit the children of an existing split via `subtransactions` |
 | `actual_transactions_delete` | Delete a transaction |
 
+> **Split transactions:** pass a `subtransactions` array (each child needs an `amount` in integer cents; `category` and `notes` are optional). The child amounts must sum to the parent `amount` (the server does not enforce this, so the tool does). A split parent carries no category of its own: put categories on the children. `actual_transactions_update` can edit the children of a transaction that is ALREADY a split; converting a plain transaction into a split via update is not supported (create it as a split instead). Note: `actual_transactions_import` forwards a `subtransactions` array to the API but does NOT apply the sum check, so use `actual_transactions_create` for guaranteed-balanced splits.
+
 **Utility (1)**
 
 | Tool | Description |
@@ -447,7 +449,7 @@ All configuration is via environment variables. Copy `.env.example` to `.env` to
 |----------|---------|----------|-------------|
 | **Actual Budget Connection** ||||
 | `ACTUAL_SERVER_URL` | _(none)_ | Yes | URL of your Actual Budget server. Use the same URL you type in your browser: `http://localhost:5006` (local), `http://192.168.1.x:5006` (network), `https://actual.yourdomain.com` (domain), or `http://actual:5006` (container name if on the same Docker network) |
-| `ACTUAL_PASSWORD` | _(none)_ | Yes | Password for Actual Budget server |
+| `ACTUAL_PASSWORD` | _(none)_ | Yes | Login password for your Actual Budget **server**, the one you type on its own login screen. Not the same as `ACTUAL_BUDGET_PASSWORD` (which decrypts an E2E-encrypted budget) and unrelated to `AUTH_PROVIDER=oidc` (which controls how MCP *clients* authenticate to this server, not how this server authenticates to Actual). This server always signs in to Actual with a password, so upstream password login must stay enabled |
 | `ACTUAL_BUDGET_SYNC_ID` | _(none)_ | Yes | Budget Sync ID from Actual (Settings then Sync ID) |
 | `ACTUAL_BUDGET_PASSWORD` | _(none)_ | No | Optional encryption password for encrypted budgets |
 | `ALLOW_INSECURE_UPSTREAM` | `false` | No | Allow an `http://` upstream even when `ACTUAL_BUDGET_PASSWORD` is set (#161). Off by default so a plaintext upstream plus an encryption password is refused |
@@ -727,4 +729,4 @@ The software is provided **as-is**, without warranty of any kind. The author acc
 
 ---
 
-**Version:** 0.8.17 | **Tool Count:** 71 (verified LibreChat-compatible)
+**Version:** 0.9.1 | **Tool Count:** 71 (verified LibreChat-compatible)

package/dist/src/lib/actual-adapter.js

@@ -1,3 +1,4 @@
+import { subtransactionsSum } from './schemas/common.js';
 import api from '@actual-app/api';
 // @actual-app/api is a CJS package (no "type" field). In NodeNext/ESM context TypeScript
 // cannot expose its named exports via static import syntax. At runtime the default import
@@ -1075,16 +1076,45 @@ export async function updateTransaction(id, fields) {
     return queueWriteOperation(async () => {
         // Pre-flight existence check (#212): the raw API silently no-ops on a missing id,
         // so an update that changed nothing would otherwise be reported as success. A
-        // targeted ActualQL query by id keeps this cheap (indexed lookup).
+        // targeted ActualQL query by id keeps this cheap (indexed lookup). #305 extends
+        // the select to is_parent + amount so the split guards below can run off the
+        // same read (single source; no second out-of-queue read).
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
         const { q } = (await import('@actual-app/api'));
-        const found = await withConcurrency(() => retry(async () => {
-            const res = (await rawRunQuery(q('transactions').filter({ id }).select(['id'])));
-            return Array.isArray(res?.data) && res.data.length > 0;
+        const rows = await withConcurrency(() => retry(async () => {
+            // #305: `.options({ splits: 'all' })` is REQUIRED. The default transactions
+            // query excludes split PARENT rows, so a plain filter(id) returns 0 rows for
+            // a split parent and this pre-flight would wrongly report it "not found"
+            // (which is exactly what broke editing a split). `splits: 'all'` returns
+            // regular transactions, split parents, and split children as flat rows, so
+            // the existence + is_parent + amount read is correct for every kind.
+            const res = (await rawRunQuery(q('transactions').options({ splits: 'all' }).filter({ id }).select(['id', 'is_parent', 'amount'])));
+            return Array.isArray(res?.data) ? res.data : [];
         }, { retries: 2, backoffMs: 200 }));
-        if (!found) {
+        if (rows.length === 0) {
             throw new Error(`Transaction "${id}" not found. Use actual_transactions_get to list transactions.`);
         }
+        // #305: split-edit guards, BEFORE the raw write. Two rules:
+        //   (a) subtransactions may only edit a transaction that is ALREADY a split;
+        //       converting a plain transaction into a split via updateTransaction is
+        //       broken in @actual-app/api 26.7.0 (it strands orphan children), so it
+        //       is rejected here rather than silently corrupting data.
+        //   (b) child amounts must sum to the effective parent amount. The API does
+        //       not enforce this; the ground truth is the caller's new `amount` if
+        //       supplied, else the stored amount read above.
+        const subs = fields?.subtransactions;
+        if (subs) {
+            const row = rows[0];
+            if (row.is_parent !== true) {
+                throw new Error(`Transaction "${id}" is not a split. Converting a plain transaction into a split is not supported here; create the split with actual_transactions_create instead.`);
+            }
+            const providedAmount = fields.amount;
+            const parentAmount = providedAmount != null ? providedAmount : row.amount;
+            const sum = subtransactionsSum(subs);
+            if (sum !== parentAmount) {
+                throw new Error(`Subtransactions must sum to the parent amount. Expected ${parentAmount}, got ${sum}.`);
+            }
+        }
         await withConcurrency(() => retry(() => rawUpdateTransaction(id, fields), { retries: 0, backoffMs: 200, isRetryable: isRetryableError }));
     });
 }
@@ -1105,7 +1135,13 @@ export async function updateTransactionBatch(updates) {
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
         const { q } = (await import('@actual-app/api'));
         const existing = await withConcurrency(() => retry(async () => {
-            const res = (await rawRunQuery(q('transactions').filter({ id: { $oneof: ids } }).select(['id'])));
+            // `.options({ splits: 'all' })` for the same reason as the single-update and
+            // delete pre-flights (#305): the default query omits split PARENT rows, so a
+            // batch touching a split parent would route a perfectly valid id to failed[]
+            // as "not found". Splits themselves stay unsupported in batch (FieldsSchema
+            // strips `subtransactions`); this only ensures a split parent's OTHER fields
+            // are updatable here.
+            const res = (await rawRunQuery(q('transactions').options({ splits: 'all' }).filter({ id: { $oneof: ids } }).select(['id'])));
             return new Set(Array.isArray(res?.data) ? res.data.map((r) => r.id) : []);
         }, { retries: 2, backoffMs: 200 }));
         const succeeded = [];
@@ -1136,7 +1172,12 @@ export async function deleteTransaction(id) {
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
         const { q } = (await import('@actual-app/api'));
         const found = await withConcurrency(() => retry(async () => {
-            const res = (await rawRunQuery(q('transactions').filter({ id }).select(['id'])));
+            // `.options({ splits: 'all' })` is REQUIRED, same as the update pre-flight
+            // above (#305): the default transactions query excludes split PARENT rows,
+            // so without it a split parent reads as non-existent and this check throws
+            // "not found" before the raw delete is ever reached. The effect was that a
+            // split could be created through the tools but never deleted through them.
+            const res = (await rawRunQuery(q('transactions').options({ splits: 'all' }).filter({ id }).select(['id'])));
             return Array.isArray(res?.data) && res.data.length > 0;
         }, { retries: 2, backoffMs: 200 }));
         if (!found) {

package/dist/src/lib/schemas/common.js

@@ -163,6 +163,42 @@ export const offBudgetSchema = z
     .optional()
     .describe('Whether the account is off-budget');
 // ============================================================================
+// SPLIT (SUBTRANSACTION) SCHEMAS (#305)
+// ============================================================================
+/**
+ * A single split child. Only `amount` is required; `category` and `notes` are
+ * optional. Child `account`/`date`/`cleared`/`reconciled` are ALWAYS derived
+ * from the parent by @actual-app/api's `makeChild` (26.7.0), and `payee_name`
+ * is not resolved on children, so extra fields are rejected here (`.strict()`)
+ * to keep the contract honest rather than silently ignored.
+ */
+export const subtransactionSchema = z
+    .object({
+    amount: amountCentsSchema,
+    category: categoryIdSchema.optional(),
+    notes: notesSchema,
+})
+    .strict();
+/**
+ * The `subtransactions` array on a split. Bounded per the project convention of
+ * bounding every array input (cf. transactions_update_batch, entities_search
+ * `.max(100)`, transactions_uncategorized `.max(1000)`).
+ */
+export const subtransactionsArraySchema = z
+    .array(subtransactionSchema)
+    .min(1, 'A split needs at least one subtransaction')
+    .max(100, 'A split cannot exceed 100 subtransactions')
+    .describe('Split children; each amount is integer cents and they must sum to the parent amount');
+/**
+ * Pure sum helper: the single source of CALCULATION for the split amount
+ * invariant (#305). Enforced at two sites (create tool at the Zod layer where
+ * the parent amount is in the input; update adapter against
+ * `fields.amount ?? dbAmount`) so the arithmetic cannot drift between them.
+ */
+export function subtransactionsSum(subs) {
+    return subs.reduce((total, s) => total + s.amount, 0);
+}
+// ============================================================================
 // COMPOSITE SCHEMAS
 // ============================================================================
 /**
@@ -192,6 +228,9 @@ export const CommonSchemas = {
     reconciled: reconciledSchema,
     closed: closedSchema,
     offBudget: offBudgetSchema,
+    // Splits (#305)
+    subtransaction: subtransactionSchema,
+    subtransactions: subtransactionsArraySchema,
 };
 // ============================================================================
 // EXAMPLES

package/dist/src/tools/transactions_create.js

@@ -1,7 +1,8 @@
 import { z } from 'zod';
 import adapter from '../lib/actual-adapter.js';
-import { CommonSchemas } from '../lib/schemas/common.js';
-const InputSchema = z.object({
+import { CommonSchemas, subtransactionsSum } from '../lib/schemas/common.js';
+const InputSchema = z
+    .object({
     account: CommonSchemas.accountId,
     date: CommonSchemas.date,
     amount: CommonSchemas.amountCents,
@@ -11,6 +12,31 @@ const InputSchema = z.object({
     category: CommonSchemas.categoryId.optional(),
     cleared: CommonSchemas.cleared,
     imported_id: z.string().optional().describe('Original imported transaction ID'),
+    subtransactions: CommonSchemas.subtransactions
+        .optional()
+        .describe('Split this transaction: child amounts (integer cents) must sum to `amount`. Put categories on the children, not the parent.'),
+})
+    // #305: cross-field split rules. The API does NOT enforce the sum invariant
+    // (a mismatch is stored and only flagged in the app), and a split parent
+    // carries no category (it moves to the children), so both are enforced here.
+    .superRefine((val, ctx) => {
+    if (!val.subtransactions)
+        return;
+    if (val.category != null) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['category'],
+            message: 'A split parent carries no category; put categories on the subtransactions instead.',
+        });
+    }
+    const sum = subtransactionsSum(val.subtransactions);
+    if (sum !== val.amount) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['subtransactions'],
+            message: `Subtransactions must sum to the parent amount. Expected ${val.amount}, got ${sum}.`,
+        });
+    }
 });
 const tool = {
     name: 'actual_transactions_create',
@@ -18,11 +44,15 @@ const tool = {
     inputSchema: InputSchema,
     call: async (args, _meta) => {
         const input = InputSchema.parse(args || {});
+        // #305: a split parent must carry is_parent so @actual-app/api links the
+        // children (without it the subtransactions are ignored). The sum invariant
+        // and the no-parent-category rule were already enforced by the schema above.
+        const payload = input.subtransactions ? { ...input, is_parent: true } : input;
         try {
             // Use addTransactions - it reliably creates transactions.
             // Note: API may return "ok" string instead of a UUID depending on server version.
             // "ok" is a valid success indicator — the transaction WAS created.
-            const result = await adapter.addTransactions(input);
+            const result = await adapter.addTransactions(payload);
             if (!result || result.length === 0) {
                 return {
                     success: false,

package/dist/src/tools/transactions_update.js

@@ -1,5 +1,6 @@
 import { z } from 'zod';
 import adapter from '../lib/actual-adapter.js';
+import { CommonSchemas } from '../lib/schemas/common.js';
 const InputSchema = z.object({
     id: z.string().optional().describe('Transaction ID to update (optional for smoke tests, required for actual usage)'),
     fields: z.object({
@@ -15,6 +16,14 @@ const InputSchema = z.object({
         transfer_id: z.string().nullable().optional().describe('Transfer transaction ID if this is a transfer'),
         cleared: z.boolean().nullable().optional().describe('Whether transaction is cleared'),
         reconciled: z.boolean().nullable().optional().describe('Whether transaction is reconciled'),
+        // #305: edit the children of an EXISTING split. The child amounts must sum
+        // to the parent amount; the target must already be a split. Both are
+        // enforced in the adapter pre-flight (it reads is_parent + amount), because
+        // the parent amount is not part of this input. Converting a plain
+        // transaction into a split here is rejected (unsupported by the API).
+        subtransactions: CommonSchemas.subtransactions
+            .optional()
+            .describe('Replace the children of an existing split; amounts must sum to the parent amount. To create a split, use actual_transactions_create.'),
     }).describe('Fields to update'),
 });
 const tool = {

package/dist/src/tools/transactions_update_batch.js

@@ -36,7 +36,7 @@ const InputSchema = z.object({
 });
 const tool = {
     name: 'actual_transactions_update_batch',
-    description: `Update multiple transactions in a single call. Accepts up to 50 {id, fields} pairs. Each update is applied independently: partial failures are reported per-item so you know exactly which succeeded and which failed.
+    description: `Update multiple transactions in a single call. Accepts up to 50 {id, fields} pairs. Each update is applied independently: partial failures are reported per-item so you know exactly which succeeded and which failed. Splits are not supported here: a subtransactions field is ignored in batch. Use actual_transactions_update to edit an existing split's children.
 
 Returns: { succeeded: [{id}], failed: [{id, error}], total, successCount, failureCount }
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "actual-mcp-server",
   "displayName": "Actual MCP Server",
-  "version": "0.8.17",
+  "version": "0.9.1",
   "engines": {
     "node": ">=22.0.0",
     "npm": ">=10.0.0"
@@ -30,7 +30,7 @@
     "verify-tools": "npm run build && node scripts/verify-tools.js",
     "check:coverage": "node scripts/list-actual-api-methods.mjs",
     "direct-sync": "node scripts/direct-sync/bank-sync-direct.mjs",
-    "test:unit-js": "node tests/unit/transactions_create.test.js && node tests/unit/generated_tools.smoke.test.js && node tests/unit/schema_validation.test.js && node tests/unit/schema_json_openai_compat.test.js && node tests/unit/config_https_validation.test.js && node tests/unit/config_data_dir.test.js && node tests/unit/config_drift.test.js && node tests/unit/port_alignment.test.js && node tests/unit/dockerfile_data_dir_alignment.test.js && node tests/unit/unraid_template_alignment.test.js && node tests/unit/entrypoint_invariants.test.js && node tests/unit/compose_profile_sync.test.js && node tests/unit/advertised_tools_sync.test.js && node tests/unit/knip_config.test.js && node tests/unit/readme_stats_sync.test.js && node tests/unit/config_insecure_upstream.test.js && node tests/unit/workflow_release_guards.test.js && node tests/unit/bot_target_branch.test.js && node tests/unit/auth_posture.test.js && node tests/unit/auth_posture_wiring.test.js && node tests/unit/auth-acl.test.js && node tests/unit/bug76.test.js && node tests/unit/budgets_setAmount.test.js && node tests/unit/budgets_transfer.test.js && node tests/unit/transactions_uncategorized.test.js && node tests/unit/httpServer_session_init.test.js && node tests/unit/httpServer_session_not_found.test.js && node tests/unit/manual_mcp_client_retry.test.js && node tests/unit/manual_mcp_client_session.test.js && node tests/unit/manual_mcp_client_circuit.test.js && node tests/unit/manual_runner_killswitch.test.js && node tests/unit/adapter_auth_rate_limit.test.js && node tests/unit/adapter_session_reuse.test.js && node tests/unit/retry_classifier.test.js && node tests/unit/adapter_module_surface.test.js && node tests/unit/adapter_nonidempotent_no_retry.test.js && node tests/unit/pool_liveness.test.js && node tests/unit/pool_shutdown_all.test.js && node tests/unit/query_where_operators.test.js && node tests/unit/query_run_validation.test.js && node tests/unit/adapter_with_write_session.test.js && node tests/unit/category_groups_delete.test.js && node tests/unit/rules_delete.test.js && node tests/unit/schedules_delete.test.js && node tests/unit/payees_delete.test.js && node tests/unit/rules_create_or_update.test.js && node tests/unit/unhandled-rejection.test.js && node tests/unit/rejection-allowlist-purity.test.js && node tests/unit/httpServer_bearer_auth.test.js && node tests/unit/httpServer_oidc_audience.test.js && node tests/unit/httpServer_oidc_auth_verification.test.js && node tests/unit/httpServer_oidc_jwks_discovery.test.js && node tests/unit/httpServer_body_limit.test.js && node tests/unit/httpServer_bind_host.test.js && node tests/unit/adapter_write_pool_cooperation.test.js && node tests/unit/budget_acl_enforcement.test.js && node tests/unit/budget_preference_store.test.js && node tests/unit/budget_preference_restore.test.js && node tests/unit/tags_list.test.js && node tests/unit/tags_create.test.js && node tests/unit/tags_update.test.js && node tests/unit/tags_delete.test.js && node tests/unit/notes_get.test.js && node tests/unit/notes_update.test.js && node tests/unit/payees_common_list.test.js && node tests/unit/transactions_update_guard.test.js && node tests/unit/entities_search.test.js && node tests/unit/transactions_import_schema.test.js && node tests/unit/tool_schema_shape.test.js && node tests/unit/zod_error_format.test.js && node tests/unit/tool_count_sync.test.js && node tests/unit/stdio_transport.test.js && node tests/unit/logger_structured.test.js && node tests/unit/logger_redaction.test.js && node tests/unit/logger_correlation.test.js && node tests/unit/check_coverage.test.js && node tests/unit/adapter_op_timeout.test.js && node tests/unit/adapter_write_queue_wakeup.test.js && node tests/unit/ci_workflow_guards.test.js && node tests/unit/node_version_guard.test.js && node tests/unit/node_version_drift.test.js && node tests/unit/observability_smoke.test.js && node tests/unit/residue_pattern.test.js && node tests/unit/dual_transport_gate.test.js && node tests/unit/manual_assertions_use_helper.test.js && node tests/unit/server_version_guard.test.js && node tests/unit/payee_rules_reference_filter.test.js && node tests/unit/oidc_metadata_discovery.test.js && node tests/unit/httpServer_oauth_metadata_route.test.js && node tests/unit/httpServer_mcp_info_route.test.js && node tests/unit/residue_sweep_balance_account.test.js && node tests/unit/tool_factory.test.js && node tests/unit/budget_registry_parse.test.js",
+    "test:unit-js": "node tests/unit/transactions_create.test.js && node tests/unit/generated_tools.smoke.test.js && node tests/unit/schema_validation.test.js && node tests/unit/schema_json_openai_compat.test.js && node tests/unit/config_https_validation.test.js && node tests/unit/config_data_dir.test.js && node tests/unit/config_drift.test.js && node tests/unit/port_alignment.test.js && node tests/unit/dockerfile_data_dir_alignment.test.js && node tests/unit/unraid_template_alignment.test.js && node tests/unit/entrypoint_invariants.test.js && node tests/unit/compose_profile_sync.test.js && node tests/unit/advertised_tools_sync.test.js && node tests/unit/knip_config.test.js && node tests/unit/readme_stats_sync.test.js && node tests/unit/config_insecure_upstream.test.js && node tests/unit/workflow_release_guards.test.js && node tests/unit/bot_target_branch.test.js && node tests/unit/auth_posture.test.js && node tests/unit/auth_posture_wiring.test.js && node tests/unit/auth-acl.test.js && node tests/unit/bug76.test.js && node tests/unit/budgets_setAmount.test.js && node tests/unit/budgets_transfer.test.js && node tests/unit/transactions_uncategorized.test.js && node tests/unit/httpServer_session_init.test.js && node tests/unit/httpServer_session_not_found.test.js && node tests/unit/manual_mcp_client_retry.test.js && node tests/unit/manual_mcp_client_session.test.js && node tests/unit/manual_mcp_client_circuit.test.js && node tests/unit/manual_runner_killswitch.test.js && node tests/unit/adapter_auth_rate_limit.test.js && node tests/unit/adapter_session_reuse.test.js && node tests/unit/retry_classifier.test.js && node tests/unit/adapter_module_surface.test.js && node tests/unit/adapter_nonidempotent_no_retry.test.js && node tests/unit/pool_liveness.test.js && node tests/unit/pool_shutdown_all.test.js && node tests/unit/query_where_operators.test.js && node tests/unit/query_run_validation.test.js && node tests/unit/adapter_with_write_session.test.js && node tests/unit/category_groups_delete.test.js && node tests/unit/rules_delete.test.js && node tests/unit/schedules_delete.test.js && node tests/unit/payees_delete.test.js && node tests/unit/rules_create_or_update.test.js && node tests/unit/unhandled-rejection.test.js && node tests/unit/rejection-allowlist-purity.test.js && node tests/unit/httpServer_bearer_auth.test.js && node tests/unit/httpServer_oidc_audience.test.js && node tests/unit/httpServer_oidc_auth_verification.test.js && node tests/unit/httpServer_oidc_jwks_discovery.test.js && node tests/unit/httpServer_body_limit.test.js && node tests/unit/httpServer_bind_host.test.js && node tests/unit/adapter_write_pool_cooperation.test.js && node tests/unit/budget_acl_enforcement.test.js && node tests/unit/budget_preference_store.test.js && node tests/unit/budget_preference_restore.test.js && node tests/unit/tags_list.test.js && node tests/unit/tags_create.test.js && node tests/unit/tags_update.test.js && node tests/unit/tags_delete.test.js && node tests/unit/notes_get.test.js && node tests/unit/notes_update.test.js && node tests/unit/payees_common_list.test.js && node tests/unit/transactions_update_guard.test.js && node tests/unit/transactions_update_splits.test.js && node tests/unit/entities_search.test.js && node tests/unit/transactions_import_schema.test.js && node tests/unit/tool_schema_shape.test.js && node tests/unit/zod_error_format.test.js && node tests/unit/tool_count_sync.test.js && node tests/unit/stdio_transport.test.js && node tests/unit/logger_structured.test.js && node tests/unit/logger_redaction.test.js && node tests/unit/logger_correlation.test.js && node tests/unit/check_coverage.test.js && node tests/unit/adapter_op_timeout.test.js && node tests/unit/adapter_write_queue_wakeup.test.js && node tests/unit/ci_workflow_guards.test.js && node tests/unit/node_version_guard.test.js && node tests/unit/node_version_drift.test.js && node tests/unit/observability_smoke.test.js && node tests/unit/residue_pattern.test.js && node tests/unit/dual_transport_gate.test.js && node tests/unit/manual_assertions_use_helper.test.js && node tests/unit/server_version_guard.test.js && node tests/unit/payee_rules_reference_filter.test.js && node tests/unit/oidc_metadata_discovery.test.js && node tests/unit/httpServer_oauth_metadata_route.test.js && node tests/unit/httpServer_mcp_info_route.test.js && node tests/unit/residue_sweep_balance_account.test.js && node tests/unit/tool_factory.test.js && node tests/unit/budget_registry_parse.test.js",
     "test:adapter": "npm run build && node dist/src/tests_adapter_runner.js",
     "test:e2e": "npx playwright test",
     "test:e2e:docker": "./tests/e2e/run-docker-e2e.sh",
@@ -65,7 +65,7 @@
   },
   "dependencies": {
     "@actual-app/api": "^26.7.0",
-    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@modelcontextprotocol/sdk": "^1.30.0",
     "debug": "^4.4.3",
     "dotenv": "^17.4.2",
     "express": "^5.2.1",
@@ -86,7 +86,7 @@
     "knip": "^6.16.1",
     "node-fetch": "^3.3.2",
     "tsconfig-paths": "^4.2.0",
-    "typescript": "^6.0.3"
+    "typescript": "^7.0.2"
   },
   "license": "MIT",
   "keywords": [