n8n-mcp-community 0.1.0 → 0.1.2

package/CHANGELOG.md

@@ -6,6 +6,59 @@ All notable changes to this project will be documented here. The format follows
 
 ## [Unreleased]
 
+## [0.1.2] - Frozen release candidate
+
+Version 0.1.2 is a frozen release candidate. Availability is established only
+by matching npm provenance, GitHub Release assets and signatures, and MCP
+Registry readbacks; this immutable entry is not rewritten after publication.
+
+### Security
+
+- The transitive `fast-uri` dependency is updated past
+  GHSA-v2hh-gcrm-f6hx, and `@hono/node-server` is overridden to the patched
+  2.x line for GHSA-frvp-7c67-39w9. The affected HTTP adapter is unused by
+  this stdio-only server. The project and bundled MCPB trees audit clean, but
+  npm does not inherit dependency-package overrides: a disposable downstream
+  consumer resolves the reviewed 1.19.15 backport through MCP SDK 1.29.0.
+  The gate accepts only the exact known advisory or a fully clean advisory
+  readback while registry metadata converges, and closure still requires a clean
+  no-override audit of the published 0.1.2 consumer.
+
+### Changed
+
+- All 44 MCP-visible tool definitions now state their specific purpose, safe
+  usage boundary, named sibling alternatives, behavior, and return semantics.
+- Every top-level input and output field now publishes a meaningful JSON Schema
+  description, including the dedicated `n8n_introspect` result contract.
+- Every generic tool now publishes its own required `data` result contract, and
+  an exact normalized `tools/list` metadata fingerprint prevents semantic drift.
+- Workflow create/update now express the two-number node position as a bounded
+  homogeneous JSON Schema array. Runtime validation is unchanged, while Codex
+  can expose both tools instead of rejecting the tuple-form `items` array.
+- Fork pull requests use a complete keyless contributor gate. Only trusted
+  maintainer pushes can authenticate and approve an exact artifact baseline.
+- Installation documentation no longer treats a source-tree version as proof
+  that npm, GitHub, signatures, provenance, or Registry publication occurred.
+- Private Glama review captures are excluded from the public Git boundary.
+
+## [0.1.1] - 2026-07-21
+
+### Security
+
+- npm publication is now exclusively GitHub OIDC trusted publishing: the
+  v0.1.0 first-publish bootstrap token binding was removed from the release
+  workflow, and the release policy fails closed on any npm token reference.
+
+### Changed
+
+- Documentation now describes the published state: the README leads with the
+  pinned exact-version `npx` quick start, states up front that the safety
+  modes are progressive rather than restrictive, and the installation,
+  client, compatibility, and FAQ guides replace pre-release "planned"
+  wording with the released routes.
+- Release-asset links use the stable latest-release URL so documentation
+  links remain valid across versions.
+
 ## [0.1.0] - 2026-07-20
 
 ### Added
@@ -112,5 +165,7 @@ All notable changes to this project will be documented here. The format follows
   credentials, keys, and generated release artifacts cannot survive in that
   publishable history; authenticated public release receipts remain supported.
 
-[Unreleased]: https://github.com/drzamarian/n8n-mcp-community/compare/v0.1.0...HEAD
+[Unreleased]: #unreleased
+[0.1.2]: #012---frozen-release-candidate
+[0.1.1]: https://github.com/drzamarian/n8n-mcp-community/releases/tag/v0.1.1
 [0.1.0]: https://github.com/drzamarian/n8n-mcp-community/releases/tag/v0.1.0

package/CONTRIBUTING.md

@@ -21,14 +21,22 @@ Node.js 22 and 24 are the supported development lines.
 
 ```bash
 npm ci
-npm run check
+npm run verify:contributor
 ```
 
-The complete gate covers formatting, dependency licenses and notices, strict
-TypeScript, the full automated test suite, a real stdio inventory check, and the
-production build.
+The keyless contributor gate covers formatting, dependency licenses and notices,
+strict TypeScript, the full automated test suite, real stdio inventories, package
+and MCPB construction, a disposable downstream-consumer audit, and the production
+build. It deliberately does not authenticate or approve the maintainer's exact
+artifact baseline.
 Run `npm run sbom > sbom.cdx.json` when reviewing dependency changes.
 
+Pull requests from forks run only this keyless gate; GitHub does not expose the
+operator-held artifact-approval secret to fork workflows. After review, the
+maintainer regenerates the exact baseline, approves it interactively, and runs
+`npm run verify`. Release and publication workflows accept only that keyed path;
+the contributor gate cannot authorize an artifact, tag, or release.
+
 ## Branch and commit conventions
 
 - Create a focused branch from `dev`: `feat/<topic>`, `fix/<topic>`,

package/README.md

@@ -2,20 +2,27 @@
 
 **A security-focused Model Context Protocol server for self-hosted n8n Community Edition.**
 
-Connect an MCP client to n8n through 44 carefully bounded tools for workflows,
-executions, credentials, tags, users, diagnostics, and instance metadata. The
-server starts offline, defaults to read-only, uses the supported n8n Public API,
-and never sends workflow data to an external AI provider.
-
-> **v0.1.0:** install the exact published version or use a source checkout. See
-> [Installation](docs/installation.md) for the pinned npm and signed MCPB
-> options.
+Connect an MCP client to a **bounded 44-tool n8n Community Edition management surface**: create, edit,
+activate, and delete workflows, update individual nodes surgically, and manage
+executions, credentials, tags, users, diagnostics, and instance metadata — 44
+carefully bounded tools in total. Safety here is **progressive, not
+restrictive**: the server defaults to read-only, `write` unlocks authoring,
+and `unsafe` unlocks every tool with an exact per-call confirmation phrase for
+each destructive operation. It starts offline, uses the supported n8n Public
+API, and never sends workflow data to an external AI provider.
+
+> **Release evidence:** install only a version that appears consistently on
+> [npm](https://www.npmjs.com/package/n8n-mcp-community), the
+> [latest GitHub release](https://github.com/drzamarian/n8n-mcp-community/releases/latest),
+> and the MCP Registry entry `io.github.drzamarian/n8n-mcp-community`. A version
+> in the source tree remains a candidate until those external readbacks agree.
+> See [Installation](docs/installation.md).
 
 [Read the synthetic terminal demo transcript](docs/demo-transcript.md). It shows
-the planned exact-version startup, 44-tool inventory, and local Introspect
+the exact-version startup, 44-tool inventory, and local Introspect
 diagnostics using only synthetic identifiers and documented output shapes.
 
-[![Animated synthetic terminal demonstration showing the planned exact-version startup, MCP inventory, and local Introspect result](docs/assets/demo.gif)](docs/demo-transcript.md)
+[![Animated synthetic terminal demonstration showing the exact-version startup, MCP inventory, and local Introspect result](docs/assets/demo.gif)](docs/demo-transcript.md)
 
 ## Why this project
 
@@ -40,31 +47,71 @@ diagnostics using only synthetic identifiers and documented output shapes.
 The current source candidate has been verified with:
 
 - exactly **44 tools**, **5 resources**, and **4 prompts** over real stdio;
-- **271 passing tests** and the complete verification gate on Node.js 22.23.1
+- **291 passing tests** and the complete verification gate on Node.js 22.23.1
   and 24.18.0;
-- zero findings from Gitleaks, Semgrep, Trivy, and both production/full
-  `npm audit` runs; all three source scanners are reproduced in CI, with
-  immutable scanner/action identities;
+- zero findings from Gitleaks, Semgrep, Trivy, and both project-root
+  production/full `npm audit` runs; all three source scanners are reproduced in
+  CI, with immutable scanner/action identities;
+- a separate no-override consumer install that resolves the reviewed
+  `@hono/node-server@1.19.15` backport, accepts only an exact
+  GHSA-frvp-7c67-39w9 advisory or a fully clean advisory readback while registry
+  metadata converges, and proves the stdio runtime and exact 44/5/4 inventory;
 - a reproducible dependency-license gate covering 224 installed package paths;
 - bounded same-origin HTTP contracts and zero-request policy-denial tests;
 - all 44 compiled tool lifecycles on disposable n8n Community 2.30.5 and 2.30.7
   instances with egress isolation, revoked keys, cleanup, and zero residue; and
-- a clean-installed npm tarball plus a byte-reproducible unsigned MCPB with the
-  same compiled runtime and complete production dependency notices.
+- a reviewed offline npm-tarball installation under the project's committed
+  dependency policy, plus a byte-reproducible unsigned MCPB with the same
+  compiled runtime and complete production dependency notices.
 
 Publication proceeds only through the reviewed release procedure: the
 repository-pinned MCPB signing identity, a human artifact-baseline receipt,
 tag-scoped protected-environment approval, and an externally signed MCPB
 handoff verified byte for byte against the reviewed unsigned candidate.
 
-## Quick start from source
+## Quick start
 
 Requirements: Node.js 22 or 24, npm, a self-hosted n8n Community Edition
 instance, and an n8n Public API key with only the permissions you need.
 
+First identify a version whose npm provenance and GitHub release assets you have
+verified, then replace `<VERIFIED_VERSION>` below. Keep the pin exact:
+
+```json
+{
+  "mcpServers": {
+    "n8n-community": {
+      "command": "npx",
+      "args": ["--yes", "n8n-mcp-community@<VERIFIED_VERSION>"],
+      "env": {
+        "N8N_API_URL": "https://n8n.example.com",
+        "N8N_API_KEY": "replace-with-a-dedicated-api-key",
+        "N8N_MCP_MODE": "read-only"
+      }
+    }
+  }
+}
+```
+
+`read-only` is the recommended starting point, not a capability ceiling: the
+same 44-tool surface includes full workflow authoring. Set
+`N8N_MCP_MODE=write` to create and edit workflows, nodes, credentials, and
+tags, or `N8N_MCP_MODE=unsafe` to enable every tool — activation, deletion,
+retries, and the other destructive operations, each still guarded by an exact
+per-call confirmation phrase. See [Safety modes](#safety-modes).
+
+Restart the MCP client and confirm exactly 44 tools, 5 resources, and 4
+prompts. Compatible desktop clients can instead install the signed MCPB from
+the [latest verified release](https://github.com/drzamarian/n8n-mcp-community/releases/latest);
+verify its checksum against the release `SHA256SUMS` first.
+
+## Quick start from source
+
+Requirements: Node.js 22 or 24, npm, and a Git checkout of this repository.
+
 ```bash
 npm ci
-npm run build
+npm run verify:contributor
 ```
 
 Configure your MCP client to run the compiled stdio entry point:
@@ -89,7 +136,7 @@ Restart the MCP client and list tools. The server can initialize and expose its
 inventory without n8n credentials; connected tools validate the URL and API key
 only when called.
 
-The release provides both a signed MCPB for compatible clients and
+Verified releases provide both a signed MCPB for compatible clients and
 exact-version `npx` configuration for portability. `@latest`, global installs,
 and `curl | shell` are not reproducible defaults. See
 [Installation](docs/installation.md) for the release policy and client-specific
@@ -241,12 +288,13 @@ Read the complete [security model](docs/security-model.md) and use
 
 ```bash
 npm ci
-npm run check
+npm run verify:contributor
 npm run sbom > sbom.cdx.json
 ```
 
-`npm run check` verifies formatting, dependency licenses/notices, strict
-TypeScript, all tests, the compiled runtime, and documentation inventory parity.
+`npm run verify:contributor` runs the complete keyless contributor gate,
+including formatting, dependency licenses/notices, strict TypeScript, all
+tests, the compiled runtime, and documentation inventory parity.
 See [CONTRIBUTING.md](CONTRIBUTING.md) before opening a change.
 
 ## Scope and non-affiliation
@@ -257,7 +305,7 @@ API. The project does not redistribute the `n8n-nodes-base` catalog and does not
 use browser cookies, interactive session routes, or runtime package downloads to
 construct one.
 
-The v0.1.0 surface intentionally excludes arbitrary workflow execution,
+The v0.1.2 candidate surface intentionally excludes arbitrary workflow execution,
 credential/workflow transfer, folders, data tables, beta evaluation endpoints,
 and execution annotations. See the [roadmap](ROADMAP.md) for the annotation
 proposal retained outside the release target.

package/SECURITY.md

@@ -6,16 +6,15 @@ before public disclosure.
 
 ## Supported versions
 
-No public version is supported until the first signed release. After release,
-the latest maintained minor line will receive security fixes. Older lines may be
-asked to upgrade when a safe backport is impractical.
+The latest maintained minor line — currently 0.1.x — receives security fixes.
+Older lines may be asked to upgrade when a safe backport is impractical.
 
 ## Report a vulnerability
 
-Use GitHub's **Security → Report a vulnerability** form. This repository will
-not be published until GitHub private vulnerability reporting is enabled and
-verified. Do not open a public issue with exploit details, credentials, workflow
-payloads, or identifying instance data.
+Use GitHub's **Security → Report a vulnerability** form; private vulnerability
+reporting is enabled and verified for this repository. Do not open a public
+issue with exploit details, credentials, workflow payloads, or identifying
+instance data.
 
 If the private form is unavailable, open a public issue containing only the
 sentence “Private security contact requested.” Do not include technical details

package/dist/introspect/contracts.js

@@ -219,17 +219,28 @@ const DurationMetricsSchema = z.object({
     p99Ms: z.number().nonnegative().nullable(),
 });
 export const IntrospectResultSchema = z.object({
-    schemaVersion: z.literal(INTROSPECT_SCHEMA_VERSION),
-    engineVersion: z.literal(INTROSPECT_ENGINE_VERSION),
-    status: z.enum(["complete", "partial"]),
-    profile: z.enum(["quick", "deep"]),
-    workflow: z.object({
+    schemaVersion: z
+        .literal(INTROSPECT_SCHEMA_VERSION)
+        .describe("Version of the stable structured introspect result contract."),
+    engineVersion: z
+        .literal(INTROSPECT_ENGINE_VERSION)
+        .describe("Version of the deterministic local analysis engine that produced this result."),
+    status: z
+        .enum(["complete", "partial"])
+        .describe("Whether all requested bounded evidence was collected and analyzed."),
+    profile: z
+        .enum(["quick", "deep"])
+        .describe("Effective quick or deep analysis profile used for this result."),
+    workflow: z
+        .object({
         id: z.string(),
         label: z.string().optional(),
         active: z.boolean(),
         nodeCount: z.number().int().nonnegative(),
-    }),
-    sample: z.object({
+    })
+        .describe("Sanitized identity and basic structure of the inspected workflow."),
+    sample: z
+        .object({
         lookbackHours: z.number().int().positive(),
         maxExecutions: z.number().int().positive(),
         metadataExecutions: z.number().int().nonnegative(),
@@ -249,8 +260,10 @@ export const IntrospectResultSchema = z.object({
         ]),
         oldestStartedAt: z.string().nullable(),
         newestStartedAt: z.string().nullable(),
-    }),
-    summary: z.object({
+    })
+        .describe("Exact execution-history scope, ordering confidence, requests, and byte budget used."),
+    summary: z
+        .object({
         findingCounts: z.object({
             critical: z.number().int().nonnegative(),
             high: z.number().int().nonnegative(),
@@ -271,8 +284,10 @@ export const IntrospectResultSchema = z.object({
             omittedCount: z.number().int().nonnegative(),
             truncated: z.boolean(),
         }),
-    }),
-    metrics: z.object({
+    })
+        .describe("Counts of findings, rule outcomes, and any details omitted by output bounds."),
+    metrics: z
+        .object({
         statusCounts: StatusCountsSchema,
         successRate: z.number().min(0).max(1).nullable(),
         duration: DurationMetricsSchema,
@@ -296,14 +311,24 @@ export const IntrospectResultSchema = z.object({
             sampledErrors: z.number().int().nonnegative(),
         }))
             .max(100),
-    }),
-    findings: z.array(FindingSchema).max(1_000),
-    ruleCoverage: z.array(RuleCoverageSchema).max(100),
+    })
+        .describe("Factual status, duration, node-timing, and value-free error-cluster measurements."),
+    findings: z
+        .array(FindingSchema)
+        .max(1_000)
+        .describe("Ordered deterministic findings retained within the configured output limit."),
+    ruleCoverage: z
+        .array(RuleCoverageSchema)
+        .max(100)
+        .describe("Per-rule outcome and completeness evidence, including omitted finding counts."),
     limitations: z
         .array(z.object({ code: z.enum(INTROSPECT_LIMITATION_CODES), message: z.string() }))
-        .max(100),
-    guidance: z.object({
+        .max(100)
+        .describe("Collection or analysis limitations that constrain interpretation of this result."),
+    guidance: z
+        .object({
         instanceSecurityTool: z.literal("n8n_audit_generate"),
         message: z.string(),
-    }),
+    })
+        .describe("Boundary guidance pointing to the separate instance-level n8n security audit tool."),
 });

package/dist/security/redaction.js

@@ -38,6 +38,8 @@ const VALUE_REDACTIONS = [
     [/\bpix[\s:-]*[\w.@-]{8,}/gi, "[PIX]"],
     [/\b(?:[A-Z0-9]+_)*(?:SECRET|TOKEN|API_KEY)(?:_[A-Z0-9]+)+\b/gi, "[SECRET]"],
 ];
+const OPAQUE_PATH_CHARACTERS = /^[A-Za-z0-9._~+/=-]+$/;
+const OPAQUE_HEXADECIMAL_PATH = /^[A-Fa-f0-9]{24,64}$/;
 const INJECTION_PATTERNS = [
     [
         /\b(?:ignore|disregard|forget|override)\s+(?:all\s+)?(?:previous|prior|above)\s+instructions?\b/gi,
@@ -46,6 +48,12 @@ const INJECTION_PATTERNS = [
     [/\b(?:system|assistant|developer)\s*:\s/gi, "[FILTERED-ROLE]: "],
     [/<\/?(?:system|assistant|developer|prompt|instructions?)>/gi, "[FILTERED-TAG]"],
 ];
+export class OutputLimitError extends Error {
+    constructor() {
+        super("The sanitized result exceeds the output limit. Use narrower filters or pagination.");
+        this.name = "OutputLimitError";
+    }
+}
 function compareStrings(left, right) {
     return left < right ? -1 : left > right ? 1 : 0;
 }
@@ -77,6 +85,24 @@ function redactUrlCredential(value) {
     // quantifier is bounded so a long delimiter-free run cannot force quadratic backtracking.
     return value.replace(/([A-Za-z][A-Za-z0-9+.-]{0,31}:\/\/)[^/?#\s]+@/g, "$1[REDACTED]@");
 }
+function looksLikeOpaquePathSegment(value) {
+    if (value.length < 24 || !OPAQUE_PATH_CHARACTERS.test(value))
+        return false;
+    // Encoding-aware detection closes the entropy blind spot for fixed-width hexadecimal IDs:
+    // repeated hex digits can carry 96+ bits while scoring below the generic Shannon threshold.
+    if (OPAQUE_HEXADECIMAL_PATH.test(value))
+        return true;
+    const frequencies = new Map();
+    for (const character of value) {
+        frequencies.set(character, (frequencies.get(character) ?? 0) + 1);
+    }
+    let entropy = 0;
+    for (const count of frequencies.values()) {
+        const probability = count / value.length;
+        entropy -= probability * Math.log2(probability);
+    }
+    return entropy >= (value.length >= 32 ? 3.5 : 4);
+}
 function sanitizeString(value, structuralKey) {
     const boundedInput = value.length > 131_072 ? value.slice(0, 131_072) : value;
     const normalizedInput = boundedInput.normalize("NFKC");
@@ -150,10 +176,11 @@ function sanitizeString(value, structuralKey) {
     }
     return { value: output, redacted };
 }
-function sanitizeValue(value, state, depth, structuralKey, preserveChildKeys = false, sensitiveDescriptor = false) {
+function sanitizeValue(value, state, depth, structuralKey, preserveChildKeys = false, sensitiveDescriptor = false, treatSensitiveKeyAsStructural = false) {
     state.nodes += 1;
     if (state.nodes > 20_000 || depth > 20) {
         state.redacted = true;
+        state.structurallyReduced = true;
         return "[TRUNCATED]";
     }
     if (typeof value === "string") {
@@ -165,18 +192,22 @@ function sanitizeValue(value, state, depth, structuralKey, preserveChildKeys = f
         return value;
     if (Array.isArray(value)) {
         const limit = Math.min(value.length, 1_000);
-        if (limit < value.length)
+        if (limit < value.length) {
             state.redacted = true;
+            state.structurallyReduced = true;
+        }
         return value
             .slice(0, limit)
             .map((item) => sanitizeValue(item, state, depth + 1, structuralKey, false, sensitiveDescriptor));
     }
     if (typeof value === "bigint") {
         state.redacted = true;
+        state.structurallyReduced = true;
         return value.toString();
     }
     if (typeof value !== "object") {
         state.redacted = true;
+        state.structurallyReduced = true;
         return "[UNSUPPORTED]";
     }
     const prototype = Reflect.getPrototypeOf(value);
@@ -185,6 +216,7 @@ function sanitizeValue(value, state, depth, structuralKey, preserveChildKeys = f
         value instanceof Set ||
         (prototype !== Object.prototype && prototype !== null)) {
         state.redacted = true;
+        state.structurallyReduced = true;
         return "[UNSUPPORTED_OBJECT]";
     }
     const output = Object.create(null);
@@ -192,50 +224,75 @@ function sanitizeValue(value, state, depth, structuralKey, preserveChildKeys = f
     const sensitiveSibling = entries.some(([key, candidate]) => (key === "key" || key === "name") &&
         typeof candidate === "string" &&
         SENSITIVE_KEY.test(candidate));
-    for (const [key, child] of entries.slice(0, 1_000)) {
+    const originalKeys = new Set(entries.map(([key]) => key));
+    for (const [entryIndex, [key, child]] of entries.slice(0, 1_000).entries()) {
         if (PROTOTYPE_KEY.test(key)) {
             state.redacted = true;
             continue;
         }
-        if (!preserveChildKeys && SENSITIVE_KEY.test(key) && !STRUCTURAL_IDENTIFIER_KEY.test(key)) {
-            output[key] = "[REDACTED]";
+        const sanitizedKey = sanitizeString(key);
+        let outputKey = key;
+        if (sanitizedKey.redacted) {
+            let placeholderIndex = entryIndex + 1;
+            do {
+                outputKey = `[REDACTED_KEY_${placeholderIndex}]`;
+                placeholderIndex += 1;
+            } while (originalKeys.has(outputKey) || Object.hasOwn(output, outputKey));
+            state.redacted = true;
+            state.structurallyReduced = true;
+        }
+        if (!treatSensitiveKeyAsStructural &&
+            !preserveChildKeys &&
+            SENSITIVE_KEY.test(key) &&
+            !STRUCTURAL_IDENTIFIER_KEY.test(key)) {
+            output[outputKey] = "[REDACTED]";
             state.redacted = true;
             continue;
         }
         if (sensitiveDescriptor && SENSITIVE_DESCRIPTOR_VALUE_KEY.test(key)) {
-            output[key] = "[REDACTED]";
+            output[outputKey] = "[REDACTED]";
             state.redacted = true;
             continue;
         }
         if (sensitiveDescriptor && child !== null && typeof child === "object") {
-            output[key] = "[REDACTED]";
+            output[outputKey] = "[REDACTED]";
             state.redacted = true;
             continue;
         }
         if (key === "value" && sensitiveSibling) {
-            output[key] = "[REDACTED]";
+            output[outputKey] = "[REDACTED]";
             state.redacted = true;
             continue;
         }
-        if (preserveChildKeys && SENSITIVE_KEY.test(key)) {
+        if (preserveChildKeys &&
+            (SENSITIVE_KEY.test(key) || (structuralKey === "properties" && sanitizedKey.redacted))) {
             if (structuralKey === "properties" && child !== null && typeof child === "object") {
-                output[key] = sanitizeValue(child, state, depth + 1, key, false, true);
+                output[outputKey] = sanitizeValue(child, state, depth + 1, key, false, true);
             }
             else {
-                output[key] = "[REDACTED]";
+                output[outputKey] = "[REDACTED]";
                 state.redacted = true;
             }
             continue;
         }
-        output[key] = sanitizeValue(child, state, depth + 1, key, STRUCTURAL_MAP_KEY.test(key), false);
+        output[outputKey] = sanitizeValue(child, state, depth + 1, key, STRUCTURAL_MAP_KEY.test(key), false);
     }
-    if (entries.length > 1_000)
+    if (entries.length > 1_000) {
         state.redacted = true;
+        state.structurallyReduced = true;
+    }
     return output;
 }
-export function sanitizeForOutput(value) {
-    const state = { nodes: 0, redacted: false };
-    return { data: sanitizeValue(value, state, 0), redacted: state.redacted, untrusted: true };
+export function sanitizeForOutputDetailed(value, options = {}) {
+    const state = { nodes: 0, redacted: false, structurallyReduced: false };
+    const data = sanitizeValue(value, state, 0, undefined, false, false, options.preserveValidatedRootRecordValues ?? false);
+    return {
+        output: { data, redacted: state.redacted, untrusted: true },
+        structurallyReduced: state.structurallyReduced,
+    };
+}
+export function sanitizeForOutput(value, options = {}) {
+    return sanitizeForOutputDetailed(value, options).output;
 }
 export function sanitizeLabelForOutput(value, maxLength = 120) {
     const normalized = value.slice(0, 4_096).normalize("NFKC").slice(0, 4_096);
@@ -244,10 +301,29 @@ export function sanitizeLabelForOutput(value, maxLength = 120) {
         ? sanitized
         : `${sanitized.slice(0, Math.max(0, maxLength - 1))}\u2026`;
 }
+export function sanitizePathSegmentForOutput(value, maxLength = 64) {
+    const normalized = value.slice(0, 4_096).normalize("NFKC").slice(0, 4_096);
+    if (SENSITIVE_KEY.test(normalized) ||
+        PROTOTYPE_KEY.test(normalized) ||
+        looksLikeOpaquePathSegment(normalized)) {
+        return { value: "[REDACTED]", redacted: true };
+    }
+    const sanitized = sanitizeString(normalized);
+    const compact = sanitized.value.replace(/\s+/g, " ").trim();
+    if (sanitized.redacted || compact.length === 0) {
+        return { value: "[REDACTED]", redacted: true };
+    }
+    return {
+        value: compact.length <= maxLength
+            ? compact
+            : `${compact.slice(0, Math.max(0, maxLength - 1))}\u2026`,
+        redacted: compact.length > maxLength,
+    };
+}
 export function boundedJson(value, maxBytes = 256 * 1024) {
     const text = JSON.stringify(value, null, 2);
     if (Buffer.byteLength(text) > maxBytes) {
-        throw new Error("The sanitized result exceeds the output limit. Use narrower filters or pagination.");
+        throw new OutputLimitError();
     }
     return text;
 }

package/dist/tools/common.js

@@ -23,32 +23,3 @@ export function requireSafeAscii(value, label, maximumLength = 256) {
     }
     return value;
 }
-export function projectMetadata(value) {
-    const source = z.record(z.unknown()).parse(value);
-    const allowed = [
-        "id",
-        "name",
-        "type",
-        "active",
-        "isArchived",
-        "createdAt",
-        "updatedAt",
-        "versionId",
-        "workflowId",
-        "status",
-        "startedAt",
-        "stoppedAt",
-        "mode",
-        "finished",
-        "retryOf",
-        "retrySuccessId",
-        "role",
-        "disabled",
-    ];
-    const output = {};
-    for (const key of allowed) {
-        if (Object.hasOwn(source, key))
-            output[key] = source[key];
-    }
-    return output;
-}