n8n-mcp-community 0.1.1 → 0.1.3

package/CHANGELOG.md

@@ -6,6 +6,90 @@ All notable changes to this project will be documented here. The format follows
 
 ## [Unreleased]
 
+## [0.1.3] - Frozen release candidate
+
+Version 0.1.3 is a frozen release candidate. Availability is established only
+by matching npm provenance, GitHub Release assets and signatures, and MCP
+Registry readbacks; this immutable entry is not rewritten after publication.
+
+### Security
+
+- MCP SDK 1.30.0 now permits the patched `@hono/node-server` 2.x line in a
+  clean standalone downstream install, so the temporary package-root override
+  is removed. The no-override consumer gate now rejects every non-zero
+  production audit and every `@hono/node-server` release below 2.0.5 or outside
+  major version 2.
+- Published 0.1.2 installations remain pinned to MCP SDK 1.29.0 and do not gain
+  this corrected downstream resolution. Its former clean-consumer closure path
+  is superseded: upgrade to 0.1.3 only after npm, GitHub, and MCP Registry
+  readbacks all verify that release.
+- The reviewed lockfile resolves `fast-uri` 3.1.5 for
+  [GHSA-7p8r-x3mc-p8w7](https://github.com/advisories/GHSA-7p8r-x3mc-p8w7)
+  (high), `hono` 4.13.0 for
+  [GHSA-8j4g-w8fx-2239](https://github.com/advisories/GHSA-8j4g-w8fx-2239)
+  (moderate), and `ip-address` 10.4.0 for
+  [GHSA-mwp4-54f8-5fhr](https://github.com/advisories/GHSA-mwp4-54f8-5fhr)
+  (high),
+  [GHSA-4xrf-jv44-h6hh](https://github.com/advisories/GHSA-4xrf-jv44-h6hh)
+  (moderate), and
+  [GHSA-22jq-vg5j-6vgg](https://github.com/advisories/GHSA-22jq-vg5j-6vgg)
+  (moderate). Development-only `brace-expansion` 5.0.9 closes
+  [GHSA-mh99-v99m-4gvg](https://github.com/advisories/GHSA-mh99-v99m-4gvg)
+  and
+  [GHSA-rgw5-rvv9-x895](https://github.com/advisories/GHSA-rgw5-rvv9-x895),
+  both high severity.
+- The published 0.1.2 MCPB vendors the earlier advisory-flagged lockfile and
+  should be upgraded only after the 0.1.3 external readbacks agree. The npm
+  tarball does not bundle transitives, so a fresh 0.1.2 npm install currently
+  re-resolves the three runtime packages to patched releases; development-only
+  `brace-expansion` is absent from that consumer graph. Its separate MCP SDK
+  1.29.0 / `@hono/node-server` residual remains until the upgrade.
+
+### Changed
+
+- Downstream dependency verification now fails closed on any advisory instead
+  of retaining the former exact 1.x backport exception.
+- The public synthetic demo now renders 0.1.3 in every version-bearing frame;
+  a version history anchored to the previous annotated release tag must extend
+  without deletion or rewriting and use a unique GIF digest per release. It
+  joins the frame-review, timing, dimension, transcript, and digest checks to
+  reject a version-only bump that silently leaves the animation stale.
+
+## [0.1.2] - Frozen release candidate
+
+Version 0.1.2 is a frozen release candidate. Availability is established only
+by matching npm provenance, GitHub Release assets and signatures, and MCP
+Registry readbacks; this immutable entry is not rewritten after publication.
+
+### Security
+
+- The transitive `fast-uri` dependency is updated past
+  GHSA-v2hh-gcrm-f6hx, and `@hono/node-server` is overridden to the patched
+  2.x line for GHSA-frvp-7c67-39w9. The affected HTTP adapter is unused by
+  this stdio-only server. The project and bundled MCPB trees audit clean, but
+  npm does not inherit dependency-package overrides: a disposable downstream
+  consumer resolves the reviewed 1.19.15 backport through MCP SDK 1.29.0.
+  The gate accepts only the exact known advisory or a fully clean advisory
+  readback while registry metadata converges, and closure still requires a clean
+  no-override audit of the published 0.1.2 consumer.
+
+### Changed
+
+- All 44 MCP-visible tool definitions now state their specific purpose, safe
+  usage boundary, named sibling alternatives, behavior, and return semantics.
+- Every top-level input and output field now publishes a meaningful JSON Schema
+  description, including the dedicated `n8n_introspect` result contract.
+- Every generic tool now publishes its own required `data` result contract, and
+  an exact normalized `tools/list` metadata fingerprint prevents semantic drift.
+- Workflow create/update now express the two-number node position as a bounded
+  homogeneous JSON Schema array. Runtime validation is unchanged, while Codex
+  can expose both tools instead of rejecting the tuple-form `items` array.
+- Fork pull requests use a complete keyless contributor gate. Only trusted
+  maintainer pushes can authenticate and approve an exact artifact baseline.
+- Installation documentation no longer treats a source-tree version as proof
+  that npm, GitHub, signatures, provenance, or Registry publication occurred.
+- Private Glama review captures are excluded from the public Git boundary.
+
 ## [0.1.1] - 2026-07-21
 
 ### Security
@@ -130,6 +214,8 @@ All notable changes to this project will be documented here. The format follows
   credentials, keys, and generated release artifacts cannot survive in that
   publishable history; authenticated public release receipts remain supported.
 
-[Unreleased]: https://github.com/drzamarian/n8n-mcp-community/compare/v0.1.1...HEAD
+[Unreleased]: #unreleased
+[0.1.3]: #013---frozen-release-candidate
+[0.1.2]: #012---frozen-release-candidate
 [0.1.1]: https://github.com/drzamarian/n8n-mcp-community/releases/tag/v0.1.1
 [0.1.0]: https://github.com/drzamarian/n8n-mcp-community/releases/tag/v0.1.0

package/CONTRIBUTING.md

@@ -21,14 +21,22 @@ Node.js 22 and 24 are the supported development lines.
 
 ```bash
 npm ci
-npm run check
+npm run verify:contributor
 ```
 
-The complete gate covers formatting, dependency licenses and notices, strict
-TypeScript, the full automated test suite, a real stdio inventory check, and the
-production build.
+The keyless contributor gate covers formatting, dependency licenses and notices,
+strict TypeScript, the full automated test suite, real stdio inventories, package
+and MCPB construction, a disposable downstream-consumer audit, and the production
+build. It deliberately does not authenticate or approve the maintainer's exact
+artifact baseline.
 Run `npm run sbom > sbom.cdx.json` when reviewing dependency changes.
 
+Pull requests from forks run only this keyless gate; GitHub does not expose the
+operator-held artifact-approval secret to fork workflows. After review, the
+maintainer regenerates the exact baseline, approves it interactively, and runs
+`npm run verify`. Release and publication workflows accept only that keyed path;
+the contributor gate cannot authorize an artifact, tag, or release.
+
 ## Branch and commit conventions
 
 - Create a focused branch from `dev`: `feat/<topic>`, `fix/<topic>`,

package/README.md

@@ -2,7 +2,7 @@
 
 **A security-focused Model Context Protocol server for self-hosted n8n Community Edition.**
 
-Connect an MCP client to the **full n8n management surface**: create, edit,
+Connect an MCP client to a **bounded 44-tool n8n Community Edition management surface**: create, edit,
 activate, and delete workflows, update individual nodes surgically, and manage
 executions, credentials, tags, users, diagnostics, and instance metadata — 44
 carefully bounded tools in total. Safety here is **progressive, not
@@ -11,12 +11,12 @@ and `unsafe` unlocks every tool with an exact per-call confirmation phrase for
 each destructive operation. It starts offline, uses the supported n8n Public
 API, and never sends workflow data to an external AI provider.
 
-> **v0.1.1 is published:** exact-version npm
-> ([`n8n-mcp-community@0.1.1`](https://www.npmjs.com/package/n8n-mcp-community)
-> with provenance attestations), a signed MCPB in the
-> [v0.1.1 release](https://github.com/drzamarian/n8n-mcp-community/releases/latest),
-> and the MCP Registry entry `io.github.drzamarian/n8n-mcp-community`. See
-> [Installation](docs/installation.md).
+> **Release evidence:** install only a version that appears consistently on
+> [npm](https://www.npmjs.com/package/n8n-mcp-community), the
+> [latest GitHub release](https://github.com/drzamarian/n8n-mcp-community/releases/latest),
+> and the MCP Registry entry `io.github.drzamarian/n8n-mcp-community`. A version
+> in the source tree remains a candidate until those external readbacks agree.
+> See [Installation](docs/installation.md).
 
 [Read the synthetic terminal demo transcript](docs/demo-transcript.md). It shows
 the exact-version startup, 44-tool inventory, and local Introspect
@@ -47,17 +47,21 @@ diagnostics using only synthetic identifiers and documented output shapes.
 The current source candidate has been verified with:
 
 - exactly **44 tools**, **5 resources**, and **4 prompts** over real stdio;
-- **271 passing tests** and the complete verification gate on Node.js 22.23.1
+- **292 passing tests** and the complete verification gate on Node.js 22.23.1
   and 24.18.0;
-- zero findings from Gitleaks, Semgrep, Trivy, and both production/full
-  `npm audit` runs; all three source scanners are reproduced in CI, with
-  immutable scanner/action identities;
+- zero findings from Gitleaks, Semgrep, Trivy, and both project-root
+  production/full `npm audit` runs; all three source scanners are reproduced in
+  CI, with immutable scanner/action identities;
+- a separate no-override consumer install that resolves the patched
+  `@hono/node-server` 2.x line, requires a zero-finding production audit, and
+  proves the stdio runtime and exact 44/5/4 inventory;
 - a reproducible dependency-license gate covering 224 installed package paths;
 - bounded same-origin HTTP contracts and zero-request policy-denial tests;
 - all 44 compiled tool lifecycles on disposable n8n Community 2.30.5 and 2.30.7
   instances with egress isolation, revoked keys, cleanup, and zero residue; and
-- a clean-installed npm tarball plus a byte-reproducible unsigned MCPB with the
-  same compiled runtime and complete production dependency notices.
+- a reviewed offline npm-tarball installation under the project's committed
+  dependency policy, plus a byte-reproducible unsigned MCPB with the same
+  compiled runtime and complete production dependency notices.
 
 Publication proceeds only through the reviewed release procedure: the
 repository-pinned MCPB signing identity, a human artifact-baseline receipt,
@@ -69,14 +73,15 @@ handoff verified byte for byte against the reviewed unsigned candidate.
 Requirements: Node.js 22 or 24, npm, a self-hosted n8n Community Edition
 instance, and an n8n Public API key with only the permissions you need.
 
-Configure your MCP client to run the published exact version:
+First identify a version whose npm provenance and GitHub release assets you have
+verified, then replace `<VERIFIED_VERSION>` below. Keep the pin exact:
 
 ```json
 {
   "mcpServers": {
     "n8n-community": {
       "command": "npx",
-      "args": ["--yes", "n8n-mcp-community@0.1.1"],
+      "args": ["--yes", "n8n-mcp-community@<VERIFIED_VERSION>"],
       "env": {
         "N8N_API_URL": "https://n8n.example.com",
         "N8N_API_KEY": "replace-with-a-dedicated-api-key",
@@ -96,8 +101,7 @@ per-call confirmation phrase. See [Safety modes](#safety-modes).
 
 Restart the MCP client and confirm exactly 44 tools, 5 resources, and 4
 prompts. Compatible desktop clients can instead install the signed MCPB from
-the
-[v0.1.1 release](https://github.com/drzamarian/n8n-mcp-community/releases/latest);
+the [latest verified release](https://github.com/drzamarian/n8n-mcp-community/releases/latest);
 verify its checksum against the release `SHA256SUMS` first.
 
 ## Quick start from source
@@ -106,7 +110,7 @@ Requirements: Node.js 22 or 24, npm, and a Git checkout of this repository.
 
 ```bash
 npm ci
-npm run build
+npm run verify:contributor
 ```
 
 Configure your MCP client to run the compiled stdio entry point:
@@ -131,7 +135,7 @@ Restart the MCP client and list tools. The server can initialize and expose its
 inventory without n8n credentials; connected tools validate the URL and API key
 only when called.
 
-The release provides both a signed MCPB for compatible clients and
+Verified releases provide both a signed MCPB for compatible clients and
 exact-version `npx` configuration for portability. `@latest`, global installs,
 and `curl | shell` are not reproducible defaults. See
 [Installation](docs/installation.md) for the release policy and client-specific
@@ -283,12 +287,13 @@ Read the complete [security model](docs/security-model.md) and use
 
 ```bash
 npm ci
-npm run check
+npm run verify:contributor
 npm run sbom > sbom.cdx.json
 ```
 
-`npm run check` verifies formatting, dependency licenses/notices, strict
-TypeScript, all tests, the compiled runtime, and documentation inventory parity.
+`npm run verify:contributor` runs the complete keyless contributor gate,
+including formatting, dependency licenses/notices, strict TypeScript, all
+tests, the compiled runtime, and documentation inventory parity.
 See [CONTRIBUTING.md](CONTRIBUTING.md) before opening a change.
 
 ## Scope and non-affiliation
@@ -299,7 +304,7 @@ API. The project does not redistribute the `n8n-nodes-base` catalog and does not
 use browser cookies, interactive session routes, or runtime package downloads to
 construct one.
 
-The v0.1.1 surface intentionally excludes arbitrary workflow execution,
+The v0.1.3 candidate surface intentionally excludes arbitrary workflow execution,
 credential/workflow transfer, folders, data tables, beta evaluation endpoints,
 and execution annotations. See the [roadmap](ROADMAP.md) for the annotation
 proposal retained outside the release target.

package/SECURITY.md

@@ -6,16 +6,15 @@ before public disclosure.
 
 ## Supported versions
 
-No public version is supported until the first signed release. After release,
-the latest maintained minor line will receive security fixes. Older lines may be
-asked to upgrade when a safe backport is impractical.
+The latest maintained minor line — currently 0.1.x — receives security fixes.
+Older lines may be asked to upgrade when a safe backport is impractical.
 
 ## Report a vulnerability
 
-Use GitHub's **Security → Report a vulnerability** form. This repository will
-not be published until GitHub private vulnerability reporting is enabled and
-verified. Do not open a public issue with exploit details, credentials, workflow
-payloads, or identifying instance data.
+Use GitHub's **Security → Report a vulnerability** form; private vulnerability
+reporting is enabled and verified for this repository. Do not open a public
+issue with exploit details, credentials, workflow payloads, or identifying
+instance data.
 
 If the private form is unavailable, open a public issue containing only the
 sentence “Private security contact requested.” Do not include technical details

package/THIRD_PARTY_NOTICES.md

@@ -11,13 +11,13 @@ LICENSE or NOTICE file. They are exact-pinned in the lockfile, are not present
 in the runtime package or MCPB, and are accepted only at the listed version,
 license, repository, and integrity hash:
 
-| Package                 | License      | Upstream repository                                                                             |
+| Package                 | License      | Source or immutable package record                                                              |
 | ----------------------- | ------------ | ----------------------------------------------------------------------------------------------- |
 | `@humanfs/types@0.15.0` | Apache-2.0   | [humanwhocodes/humanfs](https://github.com/humanwhocodes/humanfs)                               |
 | `esrecurse@4.3.0`       | BSD-2-Clause | [estools/esrecurse](https://github.com/estools/esrecurse)                                       |
 | `flora-colossus@2.0.0`  | MIT          | [MarshallOfSound/flora-colossus](https://github.com/MarshallOfSound/flora-colossus/tree/v2.0.0) |
 | `imurmurhash@0.1.4`     | MIT          | [jensyt/imurmurhash-js](https://github.com/jensyt/imurmurhash-js)                               |
-| `keyv@4.5.4`            | MIT          | [jaredwray/keyv](https://github.com/jaredwray/keyv)                                             |
+| `keyv@4.5.4`            | MIT          | [npm registry record](https://registry.npmjs.org/keyv/4.5.4)                                    |
 | `natural-compare@1.4.0` | MIT          | [litejs/natural-compare-lite](https://github.com/litejs/natural-compare-lite)                   |
 
 Their exact SHA-512 integrity values are enforced in
@@ -26,9 +26,10 @@ or notice-file change fails the gate and requires a new review. A package with a
 missing notice file can never use this exception when it is a runtime dependency
 or bundled into a release artifact.
 
-Complete license texts are available from the linked upstream repositories and
-the SPDX identifiers above. The final MCPB must independently preserve the
-license and notice files for every dependency it actually bundles.
+Complete license texts are identified by the SPDX expressions above. The linked
+source repositories or immutable package records preserve provenance for the
+reviewed versions. The final MCPB must independently preserve the license and
+notice files for every dependency it actually bundles.
 
 `minimatch@10.2.5` is another development-only ESLint dependency and is licensed
 under the permissive Blue Oak Model License 1.0.0. Its installed package includes

package/dist/introspect/contracts.js

@@ -219,17 +219,28 @@ const DurationMetricsSchema = z.object({
     p99Ms: z.number().nonnegative().nullable(),
 });
 export const IntrospectResultSchema = z.object({
-    schemaVersion: z.literal(INTROSPECT_SCHEMA_VERSION),
-    engineVersion: z.literal(INTROSPECT_ENGINE_VERSION),
-    status: z.enum(["complete", "partial"]),
-    profile: z.enum(["quick", "deep"]),
-    workflow: z.object({
+    schemaVersion: z
+        .literal(INTROSPECT_SCHEMA_VERSION)
+        .describe("Version of the stable structured introspect result contract."),
+    engineVersion: z
+        .literal(INTROSPECT_ENGINE_VERSION)
+        .describe("Version of the deterministic local analysis engine that produced this result."),
+    status: z
+        .enum(["complete", "partial"])
+        .describe("Whether all requested bounded evidence was collected and analyzed."),
+    profile: z
+        .enum(["quick", "deep"])
+        .describe("Effective quick or deep analysis profile used for this result."),
+    workflow: z
+        .object({
         id: z.string(),
         label: z.string().optional(),
         active: z.boolean(),
         nodeCount: z.number().int().nonnegative(),
-    }),
-    sample: z.object({
+    })
+        .describe("Sanitized identity and basic structure of the inspected workflow."),
+    sample: z
+        .object({
         lookbackHours: z.number().int().positive(),
         maxExecutions: z.number().int().positive(),
         metadataExecutions: z.number().int().nonnegative(),
@@ -249,8 +260,10 @@ export const IntrospectResultSchema = z.object({
         ]),
         oldestStartedAt: z.string().nullable(),
         newestStartedAt: z.string().nullable(),
-    }),
-    summary: z.object({
+    })
+        .describe("Exact execution-history scope, ordering confidence, requests, and byte budget used."),
+    summary: z
+        .object({
         findingCounts: z.object({
             critical: z.number().int().nonnegative(),
             high: z.number().int().nonnegative(),
@@ -271,8 +284,10 @@ export const IntrospectResultSchema = z.object({
             omittedCount: z.number().int().nonnegative(),
             truncated: z.boolean(),
         }),
-    }),
-    metrics: z.object({
+    })
+        .describe("Counts of findings, rule outcomes, and any details omitted by output bounds."),
+    metrics: z
+        .object({
         statusCounts: StatusCountsSchema,
         successRate: z.number().min(0).max(1).nullable(),
         duration: DurationMetricsSchema,
@@ -296,14 +311,24 @@ export const IntrospectResultSchema = z.object({
             sampledErrors: z.number().int().nonnegative(),
         }))
             .max(100),
-    }),
-    findings: z.array(FindingSchema).max(1_000),
-    ruleCoverage: z.array(RuleCoverageSchema).max(100),
+    })
+        .describe("Factual status, duration, node-timing, and value-free error-cluster measurements."),
+    findings: z
+        .array(FindingSchema)
+        .max(1_000)
+        .describe("Ordered deterministic findings retained within the configured output limit."),
+    ruleCoverage: z
+        .array(RuleCoverageSchema)
+        .max(100)
+        .describe("Per-rule outcome and completeness evidence, including omitted finding counts."),
     limitations: z
         .array(z.object({ code: z.enum(INTROSPECT_LIMITATION_CODES), message: z.string() }))
-        .max(100),
-    guidance: z.object({
+        .max(100)
+        .describe("Collection or analysis limitations that constrain interpretation of this result."),
+    guidance: z
+        .object({
         instanceSecurityTool: z.literal("n8n_audit_generate"),
         message: z.string(),
-    }),
+    })
+        .describe("Boundary guidance pointing to the separate instance-level n8n security audit tool."),
 });

package/dist/security/redaction.js

@@ -38,6 +38,8 @@ const VALUE_REDACTIONS = [
     [/\bpix[\s:-]*[\w.@-]{8,}/gi, "[PIX]"],
     [/\b(?:[A-Z0-9]+_)*(?:SECRET|TOKEN|API_KEY)(?:_[A-Z0-9]+)+\b/gi, "[SECRET]"],
 ];
+const OPAQUE_PATH_CHARACTERS = /^[A-Za-z0-9._~+/=-]+$/;
+const OPAQUE_HEXADECIMAL_PATH = /^[A-Fa-f0-9]{24,64}$/;
 const INJECTION_PATTERNS = [
     [
         /\b(?:ignore|disregard|forget|override)\s+(?:all\s+)?(?:previous|prior|above)\s+instructions?\b/gi,
@@ -46,6 +48,12 @@ const INJECTION_PATTERNS = [
     [/\b(?:system|assistant|developer)\s*:\s/gi, "[FILTERED-ROLE]: "],
     [/<\/?(?:system|assistant|developer|prompt|instructions?)>/gi, "[FILTERED-TAG]"],
 ];
+export class OutputLimitError extends Error {
+    constructor() {
+        super("The sanitized result exceeds the output limit. Use narrower filters or pagination.");
+        this.name = "OutputLimitError";
+    }
+}
 function compareStrings(left, right) {
     return left < right ? -1 : left > right ? 1 : 0;
 }
@@ -77,6 +85,24 @@ function redactUrlCredential(value) {
     // quantifier is bounded so a long delimiter-free run cannot force quadratic backtracking.
     return value.replace(/([A-Za-z][A-Za-z0-9+.-]{0,31}:\/\/)[^/?#\s]+@/g, "$1[REDACTED]@");
 }
+function looksLikeOpaquePathSegment(value) {
+    if (value.length < 24 || !OPAQUE_PATH_CHARACTERS.test(value))
+        return false;
+    // Encoding-aware detection closes the entropy blind spot for fixed-width hexadecimal IDs:
+    // repeated hex digits can carry 96+ bits while scoring below the generic Shannon threshold.
+    if (OPAQUE_HEXADECIMAL_PATH.test(value))
+        return true;
+    const frequencies = new Map();
+    for (const character of value) {
+        frequencies.set(character, (frequencies.get(character) ?? 0) + 1);
+    }
+    let entropy = 0;
+    for (const count of frequencies.values()) {
+        const probability = count / value.length;
+        entropy -= probability * Math.log2(probability);
+    }
+    return entropy >= (value.length >= 32 ? 3.5 : 4);
+}
 function sanitizeString(value, structuralKey) {
     const boundedInput = value.length > 131_072 ? value.slice(0, 131_072) : value;
     const normalizedInput = boundedInput.normalize("NFKC");
@@ -150,10 +176,11 @@ function sanitizeString(value, structuralKey) {
     }
     return { value: output, redacted };
 }
-function sanitizeValue(value, state, depth, structuralKey, preserveChildKeys = false, sensitiveDescriptor = false) {
+function sanitizeValue(value, state, depth, structuralKey, preserveChildKeys = false, sensitiveDescriptor = false, treatSensitiveKeyAsStructural = false) {
     state.nodes += 1;
     if (state.nodes > 20_000 || depth > 20) {
         state.redacted = true;
+        state.structurallyReduced = true;
         return "[TRUNCATED]";
     }
     if (typeof value === "string") {
@@ -165,18 +192,22 @@ function sanitizeValue(value, state, depth, structuralKey, preserveChildKeys = f
         return value;
     if (Array.isArray(value)) {
         const limit = Math.min(value.length, 1_000);
-        if (limit < value.length)
+        if (limit < value.length) {
             state.redacted = true;
+            state.structurallyReduced = true;
+        }
         return value
             .slice(0, limit)
             .map((item) => sanitizeValue(item, state, depth + 1, structuralKey, false, sensitiveDescriptor));
     }
     if (typeof value === "bigint") {
         state.redacted = true;
+        state.structurallyReduced = true;
         return value.toString();
     }
     if (typeof value !== "object") {
         state.redacted = true;
+        state.structurallyReduced = true;
         return "[UNSUPPORTED]";
     }
     const prototype = Reflect.getPrototypeOf(value);
@@ -185,6 +216,7 @@ function sanitizeValue(value, state, depth, structuralKey, preserveChildKeys = f
         value instanceof Set ||
         (prototype !== Object.prototype && prototype !== null)) {
         state.redacted = true;
+        state.structurallyReduced = true;
         return "[UNSUPPORTED_OBJECT]";
     }
     const output = Object.create(null);
@@ -192,50 +224,75 @@ function sanitizeValue(value, state, depth, structuralKey, preserveChildKeys = f
     const sensitiveSibling = entries.some(([key, candidate]) => (key === "key" || key === "name") &&
         typeof candidate === "string" &&
         SENSITIVE_KEY.test(candidate));
-    for (const [key, child] of entries.slice(0, 1_000)) {
+    const originalKeys = new Set(entries.map(([key]) => key));
+    for (const [entryIndex, [key, child]] of entries.slice(0, 1_000).entries()) {
         if (PROTOTYPE_KEY.test(key)) {
             state.redacted = true;
             continue;
         }
-        if (!preserveChildKeys && SENSITIVE_KEY.test(key) && !STRUCTURAL_IDENTIFIER_KEY.test(key)) {
-            output[key] = "[REDACTED]";
+        const sanitizedKey = sanitizeString(key);
+        let outputKey = key;
+        if (sanitizedKey.redacted) {
+            let placeholderIndex = entryIndex + 1;
+            do {
+                outputKey = `[REDACTED_KEY_${placeholderIndex}]`;
+                placeholderIndex += 1;
+            } while (originalKeys.has(outputKey) || Object.hasOwn(output, outputKey));
+            state.redacted = true;
+            state.structurallyReduced = true;
+        }
+        if (!treatSensitiveKeyAsStructural &&
+            !preserveChildKeys &&
+            SENSITIVE_KEY.test(key) &&
+            !STRUCTURAL_IDENTIFIER_KEY.test(key)) {
+            output[outputKey] = "[REDACTED]";
             state.redacted = true;
             continue;
         }
         if (sensitiveDescriptor && SENSITIVE_DESCRIPTOR_VALUE_KEY.test(key)) {
-            output[key] = "[REDACTED]";
+            output[outputKey] = "[REDACTED]";
             state.redacted = true;
             continue;
         }
         if (sensitiveDescriptor && child !== null && typeof child === "object") {
-            output[key] = "[REDACTED]";
+            output[outputKey] = "[REDACTED]";
             state.redacted = true;
             continue;
         }
         if (key === "value" && sensitiveSibling) {
-            output[key] = "[REDACTED]";
+            output[outputKey] = "[REDACTED]";
             state.redacted = true;
             continue;
         }
-        if (preserveChildKeys && SENSITIVE_KEY.test(key)) {
+        if (preserveChildKeys &&
+            (SENSITIVE_KEY.test(key) || (structuralKey === "properties" && sanitizedKey.redacted))) {
             if (structuralKey === "properties" && child !== null && typeof child === "object") {
-                output[key] = sanitizeValue(child, state, depth + 1, key, false, true);
+                output[outputKey] = sanitizeValue(child, state, depth + 1, key, false, true);
             }
             else {
-                output[key] = "[REDACTED]";
+                output[outputKey] = "[REDACTED]";
                 state.redacted = true;
             }
             continue;
         }
-        output[key] = sanitizeValue(child, state, depth + 1, key, STRUCTURAL_MAP_KEY.test(key), false);
+        output[outputKey] = sanitizeValue(child, state, depth + 1, key, STRUCTURAL_MAP_KEY.test(key), false);
     }
-    if (entries.length > 1_000)
+    if (entries.length > 1_000) {
         state.redacted = true;
+        state.structurallyReduced = true;
+    }
     return output;
 }
-export function sanitizeForOutput(value) {
-    const state = { nodes: 0, redacted: false };
-    return { data: sanitizeValue(value, state, 0), redacted: state.redacted, untrusted: true };
+export function sanitizeForOutputDetailed(value, options = {}) {
+    const state = { nodes: 0, redacted: false, structurallyReduced: false };
+    const data = sanitizeValue(value, state, 0, undefined, false, false, options.preserveValidatedRootRecordValues ?? false);
+    return {
+        output: { data, redacted: state.redacted, untrusted: true },
+        structurallyReduced: state.structurallyReduced,
+    };
+}
+export function sanitizeForOutput(value, options = {}) {
+    return sanitizeForOutputDetailed(value, options).output;
 }
 export function sanitizeLabelForOutput(value, maxLength = 120) {
     const normalized = value.slice(0, 4_096).normalize("NFKC").slice(0, 4_096);
@@ -244,10 +301,29 @@ export function sanitizeLabelForOutput(value, maxLength = 120) {
         ? sanitized
         : `${sanitized.slice(0, Math.max(0, maxLength - 1))}\u2026`;
 }
+export function sanitizePathSegmentForOutput(value, maxLength = 64) {
+    const normalized = value.slice(0, 4_096).normalize("NFKC").slice(0, 4_096);
+    if (SENSITIVE_KEY.test(normalized) ||
+        PROTOTYPE_KEY.test(normalized) ||
+        looksLikeOpaquePathSegment(normalized)) {
+        return { value: "[REDACTED]", redacted: true };
+    }
+    const sanitized = sanitizeString(normalized);
+    const compact = sanitized.value.replace(/\s+/g, " ").trim();
+    if (sanitized.redacted || compact.length === 0) {
+        return { value: "[REDACTED]", redacted: true };
+    }
+    return {
+        value: compact.length <= maxLength
+            ? compact
+            : `${compact.slice(0, Math.max(0, maxLength - 1))}\u2026`,
+        redacted: compact.length > maxLength,
+    };
+}
 export function boundedJson(value, maxBytes = 256 * 1024) {
     const text = JSON.stringify(value, null, 2);
     if (Buffer.byteLength(text) > maxBytes) {
-        throw new Error("The sanitized result exceeds the output limit. Use narrower filters or pagination.");
+        throw new OutputLimitError();
     }
     return text;
 }

package/dist/tools/common.js

@@ -23,32 +23,3 @@ export function requireSafeAscii(value, label, maximumLength = 256) {
     }
     return value;
 }
-export function projectMetadata(value) {
-    const source = z.record(z.unknown()).parse(value);
-    const allowed = [
-        "id",
-        "name",
-        "type",
-        "active",
-        "isArchived",
-        "createdAt",
-        "updatedAt",
-        "versionId",
-        "workflowId",
-        "status",
-        "startedAt",
-        "stoppedAt",
-        "mode",
-        "finished",
-        "retryOf",
-        "retrySuccessId",
-        "role",
-        "disabled",
-    ];
-    const output = {};
-    for (const key of allowed) {
-        if (Object.hasOwn(source, key))
-            output[key] = source[key];
-    }
-    return output;
-}