sap-ai-dev-toolkit 0.9.9917 → 0.9.9920

package/scripts/check-live-integration.mjs

@@ -0,0 +1,151 @@
+#!/usr/bin/env node
+// Separate from run-live-integration: fixed metadata tools, GET-only management transport.
+import { fetch as undiciFetch } from 'undici';
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { InMemoryTransport } from '@modelcontextprotocol/sdk/inMemory.js';
+import { createIntegrationServer } from '../src/integration-server.mjs';
+import { resolveIntegrationConfig } from '../src/integration-config.mjs';
+import { readStoredIntegrationKeys } from '../src/integration-credentials.mjs';
+
+function options(argv) {
+  const result = { window_minutes: 60, top: 3, json: false };
+  for (let i = 0; i < argv.length; i += 1) {
+    const option = argv[i];
+    if (option === '--json') result.json = true;
+    else if (option === '--window-minutes' || option === '--top') {
+      const value = Number(argv[++i]);
+      const maximum = option === '--top' ? 5 : 31 * 24 * 60;
+      if (!Number.isInteger(value) || value < 1 || value > maximum) throw new Error(`${option} must be an integer from 1 to ${maximum}`);
+      result[option === '--top' ? 'top' : 'window_minutes'] = value;
+    } else throw new Error(`Unsupported argument ${option}`);
+  }
+  return result;
+}
+const pick = (value, names) => Object.fromEntries(names.filter(name => value?.[name] !== undefined).map(name => [name, value[name]]));
+const page = (value, itemFields) => ({ ...pick(value, ['returned', 'total', 'complete', 'stop_reason', 'consistency', 'source_result', 'source_results', 'outcome', 'window']),
+  resumable: typeof value.next_cursor === 'string', items: (value.items ?? []).map(item => pick(item, itemFields)) });
+const sourceFailure = value => {
+  if (!value || typeof value !== 'object') return false;
+  if (['unauthenticated', 'forbidden', 'unavailable', 'error'].includes(value.result)) return true;
+  return Object.values(value).some(entry => entry && typeof entry === 'object' && sourceFailure(entry));
+};
+
+async function main() {
+  const args = options(process.argv.slice(2));
+  const now = Date.now();
+  const window = { from: new Date(now - args.window_minutes * 60000).toISOString(), to: new Date(now).toISOString() };
+  const env = process.env;
+  const config = resolveIntegrationConfig(env, { stored: readStoredIntegrationKeys(env) });
+  const sides = Object.entries(config).filter(([, side]) => side && typeof side === 'object' && typeof side.url === 'string');
+  const tokenUrls = new Set(sides.map(([, side]) => side.tokenUrl).filter(Boolean));
+  const origins = new Set(sides.map(([, side]) => new URL(side.url).origin));
+  // AEM uses one fixed public cloud origin; no caller-supplied origin is accepted.
+  if (config.aem) origins.add('https://api.solace.cloud');
+  const requests = { management_gets: 0, token_posts: 0 };
+  const guardedFetch = async (input, init = {}) => {
+    const target = new URL(typeof input === 'string' || input instanceof URL ? input : input.url);
+    const method = (init.method ?? 'GET').toUpperCase();
+    if (method === 'POST' && tokenUrls.has(target.href)) requests.token_posts += 1;
+    else if (method === 'GET' && origins.has(target.origin)) requests.management_gets += 1;
+    else throw new Error('Read-only checker rejected a non-GET management request or unbound origin');
+    if (target.username || target.password || target.hash) throw new Error('Read-only checker rejected an unsafe request URL');
+    if (init.redirect && init.redirect !== 'manual') throw new Error('Read-only checker rejected redirect following');
+    return undiciFetch(input, { ...init, redirect: 'manual' });
+  };
+  const runtime = createIntegrationServer({ env, fetchImpl: guardedFetch });
+  const [a, b] = InMemoryTransport.createLinkedPair();
+  const client = new Client({ name: 'read-only-integration-check', version: '1.0.0' });
+  const report = { mode: 'read_only', environment: runtime.connectionSummary.environment ?? 'default', window,
+    meaning: 'Exit 0 means requested configured core reads/schema checks executed, not a healthy landscape.', checks: [], optional_live_verification: {}, requests };
+  let coreFailed = false;
+  try {
+    await runtime.server.connect(b); await client.connect(a);
+    const names = new Set((await client.listTools()).tools.map(tool => tool.name));
+    const call = async (name, input = {}, { core = true, project = value => value, validate = value => value && typeof value === 'object' } = {}) => {
+      if (!names.has(name)) {
+        report.checks.push({ tool: name, result: 'skipped', reason: 'not_configured_or_not_registered' });
+        return null;
+      }
+      try {
+        const response = await client.callTool({ name, arguments: input });
+        if (response.isError) {
+          const status = /\bHTTP (\d{3})\b/.exec(response.content?.[0]?.text ?? '')?.[1];
+          report.checks.push({ tool: name, result: 'failed', ...(status ? { http_status: Number(status) } : {}), error: 'Tool read failed; response body withheld.' });
+          if (core) coreFailed = true;
+          return null;
+        }
+        const value = JSON.parse(response.content[0].text);
+        if (!validate(value)) throw new Error('contract_error');
+        const failed = sourceFailure(value);
+        report.checks.push({ tool: name, result: failed ? 'partial_or_failed_source' : 'executed', evidence: project(value) });
+        if (core && (failed || value.outcome === 'partial' && value.metrics_complete === false)) coreFailed = true;
+        return value;
+      } catch {
+        report.checks.push({ tool: name, result: 'failed', error: 'Read or contract failure; response body withheld.' });
+        if (core) coreFailed = true;
+        return null;
+      }
+    };
+    const isPage = value => Array.isArray(value.items) && Number.isInteger(value.returned) && value.returned === value.items.length
+      && (value.total === null || Number.isFinite(value.total) && value.total >= 0) && typeof value.complete === 'boolean'
+      && (value.next_cursor === null || typeof value.next_cursor === 'string') && typeof value.stop_reason === 'string';
+    const connection = await call('integration_connection_info', { verify: true }, { core: false, validate: value => value.verification && typeof value.verification.ok === 'boolean' });
+    if (!connection || ['cpi', 'apim', 'devhub'].some(side => config[side] && sourceFailure(connection.verification[side]))) coreFailed = true;
+    if (config.cpi) {
+      const logs = await call('cpi_list_message_logs', { ...window, top: args.top }, { validate: isPage,
+        project: value => page(value, ['MessageGuid', 'CorrelationId', 'ApplicationMessageId', 'Status', 'LogStart', 'LogEnd', 'IntegrationArtifact']) });
+      await call('cpi_get_message_statistics', window, { validate: value => value.count_by_status && typeof value.complete === 'boolean' });
+      const guid = logs?.items?.[0]?.MessageGuid;
+      if (guid) {
+        await call('cpi_list_message_log_runs', { message_guid: guid, top: args.top }, { validate: isPage, project: value => page(value, ['Id', 'RunStart', 'RunStop', 'OverallState']) });
+        await call('cpi_get_message_log_steps', { message_guid: guid, top: args.top }, { validate: isPage,
+          project: value => ({ ...page(value, ['StepId', 'ModelStepId', 'Activity', 'Status', 'StepStart', 'StepStop']), run: pick(value.run, ['Id', 'RunStart', 'RunStop', 'OverallState']) }) });
+      } else report.checks.push({ tool: 'cpi_get_message_log_steps', result: 'untested', reason: 'No message fixture in the fixed window.' });
+      await call('cpi_list_runtime_artifacts', { top: args.top }, { validate: isPage, project: value => page(value, ['Id', 'Version', 'Status', 'Type', 'DeployedOn']) });
+      await call('cpi_get_jms_broker_status');
+      await call('cpi_list_jms_queues', { top: args.top }, { validate: isPage, project: value => page(value, ['Name', 'State', 'Active', 'NumbOfMsgs', 'Size', 'FillGrade']) });
+      const stores = await call('cpi_list_data_stores', { overdue_only: true, top: args.top }, { validate: isPage,
+        project: value => page(value, ['DataStoreName', 'IntegrationFlow', 'Type', 'Visibility', 'NumberOfMessages', 'NumberOfOverdueMessages']) });
+      const store = stores?.items?.[0];
+      if (store) await call('cpi_list_data_store_entries', { data_store: store.DataStoreName, integration_flow: store.IntegrationFlow, type: store.Type ?? '', top: args.top },
+        { validate: isPage, project: value => ({ ...page(value, ['Id', 'Status', 'MessageId', 'DueAt', 'CreatedAt', 'RetainUntil']), store: value.store }) });
+      await call('cpi_get_certificate_health', { top: args.top }, { validate: isPage,
+        project: value => ({ ...page(value, ['Alias', 'Type', 'KeyType', 'ValidNotBefore', 'ValidNotAfter', 'days_remaining', 'validity']), evaluated_at: value.evaluated_at }) });
+      await call('cpi_get_operational_summary', window);
+    }
+    if (config.apim) {
+      await call('apim_get_analytics', window, { validate: value => typeof value.complete === 'boolean' && typeof value.outcome === 'string' });
+      await call('apim_get_analytics_series', { ...window, granularity: 'hour', top: args.top }, { validate: isPage });
+      await call('apim_get_api_error_breakdown', { ...window, top: args.top }, { validate: isPage });
+    }
+    // Fixed optional read catalog. Missing credentials are unverified, not a failed entitlement check.
+    const optionalReads = [
+      ['ans', 'ans_list_subscriptions'], ['ans', 'ans_list_conditions'], ['ans', 'ans_list_action_metadata'],
+      ['ctms', 'ctms_list_nodes'], ['aem', 'aem_list_brokers'], ['aem_semp', 'aem_list_queues'],
+      ['open_connectors', 'open_connectors_list_instances'], ['edge', 'edge_list_message_logs']
+    ];
+    for (const [side, name] of optionalReads) {
+      if (!config[side] || !names.has(name)) { report.optional_live_verification[side] = 'live_unverified'; continue; }
+      const value = await call(name, { ...(side === 'edge' ? window : {}), top: args.top }, { core: false, validate: isPage });
+      report.optional_live_verification[side] = value && !sourceFailure(value) ? 'read_exercised' : 'live_unverified';
+    }
+    if (config.edge) await call('edge_get_api_metadata', {}, { core: false });
+    if (config.event_mesh?.probeQueueName) {
+      const value = await call('event_mesh_get_queue', { name: config.event_mesh.probeQueueName }, { core: false });
+      report.optional_live_verification.event_mesh = value && !sourceFailure(value) ? 'read_exercised' : 'live_unverified';
+    } else report.optional_live_verification.event_mesh = 'live_unverified';
+    report.core_reads_executed = !coreFailed;
+    if (args.json) console.log(JSON.stringify(report, null, 2));
+    else {
+      console.log(`Read-only Integration Suite check: ${report.core_reads_executed ? 'core reads executed' : 'core read/contract failures'}`);
+      console.log(`Window ${window.from} to ${window.to}; ${requests.management_gets} management GETs, ${requests.token_posts} token POSTs.`);
+      for (const check of report.checks) console.log(`${check.tool}: ${check.result}`);
+      console.log('This is not a health sign-off; inspect degraded/unknown signals and optional live_unverified entries with --json.');
+    }
+  } finally { await client.close().catch(() => {}); await runtime.close(); }
+  if (coreFailed) process.exitCode = 1;
+}
+main().catch(() => {
+  console.error('Read-only Integration Suite check could not initialize or complete. Credential values and response bodies are withheld; check host configuration and service access.');
+  process.exitCode = 1;
+});

package/scripts/install-local.mjs

@@ -1,6 +1,5 @@
 import { spawn } from 'node:child_process';
-import { lstat } from 'node:fs/promises';
-import { readFile } from 'node:fs/promises';
+import { lstat, readFile, realpath } from 'node:fs/promises';
 import { dirname, join, resolve as resolvePath } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
@@ -18,8 +17,8 @@ function usage() {
     '             for the selected harnesses).',
     '  --link     Installs with npm link instead of a tarball; edits to src/',
     '             and scripts/ take effect immediately without reinstalling.',
-    '  --verify   Verifies the global sap-ai-dev command resolves to this',
-    '             workspace installation.'
+    '  --verify   Verifies the global command, installed package version,',
+    '             and workspace target when using npm link.'
   ].join('\n');
 }
 
@@ -88,10 +87,18 @@ async function verify() {
     console.log(`Expected location:  ${expected}`);
     throw new Error('Global installation does not match the expected npm layout');
   }
+  const installedPackage = JSON.parse(await readFile(join(installedRoot, 'package.json'), 'utf8'));
+  if (installedPackage.name !== pkg.name || installedPackage.version !== pkg.version) {
+    throw new Error(`Installed ${installedPackage.name}@${installedPackage.version} does not match workspace ${pkg.name}@${pkg.version}; run npm run install:local`);
+  }
   if (!await lstat(serverCommand).catch(() => null)) {
     throw new Error(`Global sap-ai-dev command is missing at ${serverCommand}`);
   }
   const stats = await lstat(installedRoot).catch(() => null);
+  if (stats?.isSymbolicLink() && await realpath(installedRoot) !== await realpath(root)) {
+    throw new Error('Global npm link points to a different workspace');
+  }
+  console.log(`Installed version:  ${installedPackage.version}`);
   console.log(`Install mode:       ${stats?.isSymbolicLink() ? 'npm link (live workspace)' : 'tarball (snapshot)'}`);
   return 0;
 }

package/scripts/run-live-integration.mjs

@@ -1,14 +1,16 @@
-// Live end-to-end scenarios (S01–S94) for the Integration Suite companion against a real CPI + APIM tenant.
+// Live end-to-end scenarios for the Integration Suite companion against a real CPI + APIM tenant.
 // WRITES TO THE TENANT: creates a package, iFlows (deployed, one undeployed again), a user credential, a number
 // range, a Partner Directory parameter, API providers, API proxies (with policies), an API product and a key value
-// map, all named with the RUN suffix. There are no delete tools; remove the artifacts in the Integration Suite UI.
+// map, all named with the RUN suffix. APIM products/proxies can be removed with explicit-set deletion tools;
+// CPI design-time artifacts, providers and KVMs still require separate authorized cleanup.
 // Usage: CPI_SERVICE_KEY=… APIM_SERVICE_KEY=… RUN=<unique suffix> npm run test:live:integration
 //        ONLY=S01,S02 limits the run to selected scenarios (later scenarios may depend on earlier ones).
 import { readFile } from 'node:fs/promises';
 import { Client } from '@modelcontextprotocol/sdk/client/index.js';
 import { InMemoryTransport } from '@modelcontextprotocol/sdk/inMemory.js';
 import { createIntegrationServer } from '../src/integration-server.mjs';
-import { INTEGRATION_TOOL_NAMES } from '../src/integration-tools.mjs';
+import { resolveIntegrationConfig } from '../src/integration-config.mjs';
+import { readStoredIntegrationKeys } from '../src/integration-credentials.mjs';
 
 const RUN = process.env.RUN;
 if (!RUN || !/^[A-Za-z0-9]{1,8}$/.test(RUN)) {
@@ -27,10 +29,8 @@ const PROXY = `ZAI_Smoke${RUN}`;
 const PROXY_URL = `ZAI_SmokeUrl${RUN}`;
 const PROXY_ODATA = `ZAI_SmokeOData${RUN}`;
 const PROXY_CPI = `ZAI_SmokeCpi${RUN}`;
-const SECRETS = [process.env.CPI_SERVICE_KEY, process.env.APIM_SERVICE_KEY].flatMap(raw => {
-  const key = JSON.parse(raw);
-  return [key.oauth?.clientsecret, key.clientSecret].filter(Boolean);
-});
+const config = resolveIntegrationConfig(process.env, { stored: readStoredIntegrationKeys() });
+const SECRETS = Object.values(config).filter(Boolean).map(side => side.clientSecret);
 const PRODUCT = `ZAI_SmokeProduct${RUN}`;
 const KVM = `ZAI_SmokeKvm${RUN}`;
 const CREDENTIAL = `ZAI_SMOKE_USER_${RUN}`;
@@ -173,14 +173,15 @@ function timerParameters(address) {
 
 
 async function deployAndWait(iflowId) {
-  const deployed = ok(await call('cpi_deploy_iflow', { iflow_id: iflowId, wait_seconds: 50, confirmation: `DEPLOY IFLOW ${iflowId}` }), `deploy ${iflowId}`);
-  let status = { Status: deployed.runtime_status, Version: deployed.runtime_version, error_information: deployed.error_information };
-  for (let attempt = 0; attempt < 36 && (deployed.timed_out || status.Status === 'STARTING' || !status.Status); attempt += 1) {
+  let deployed = ok(await call('cpi_deploy_iflow', { iflow_id: iflowId, wait_seconds: 50, confirmation: `DEPLOY IFLOW ${iflowId}` }), `deploy ${iflowId}`);
+  for (let attempt = 0; attempt < 36 && ['pending', 'unverified'].includes(deployed.outcome) && deployed.task_id; attempt += 1) {
     await sleep(5000);
-    status = ok(await call('cpi_get_iflow_runtime_status', { iflow_id: iflowId }), 'status');
-    if (status.Status && status.Status !== 'STARTING') break;
+    deployed = ok(await call('cpi_get_deployment_task', {
+      task_id: deployed.task_id, iflow_id: iflowId, expected_version: deployed.requested_version
+    }), 'deployment task');
   }
-  return { deployed, runtime: status };
+  expect(deployed.outcome === 'succeeded' || deployed.outcome === 'failed' && deployed.runtime_status === 'ERROR', `Deployment not verified: ${JSON.stringify(deployed)}`);
+  return { deployed, runtime: { Status: deployed.runtime_status, Version: deployed.runtime_version, error_information: deployed.error_information } };
 }
 
 // ============================================================ shared
@@ -190,21 +191,12 @@ await scenario('S01', 'connection info reports both sides without secrets', asyn
   return `${info.cpi.host} / ${info.apim.host}`;
 });
 
-await scenario('S02', `tools/list exposes ${INTEGRATION_TOOL_NAMES.length} tools with write annotations`, async () => {
-  const { tools } = await client.listTools();
-  expect(tools.length === INTEGRATION_TOOL_NAMES.length, `expected ${INTEGRATION_TOOL_NAMES.length} tools, got ${tools.length}`);
-  const byName = Object.fromEntries(tools.map(tool => [tool.name, tool]));
-  expect(byName.cpi_update_iflow.annotations.destructiveHint === true, 'update must be destructive');
-  expect(byName.cpi_undeploy_artifact.annotations.destructiveHint === true, 'undeploy must be destructive');
-  expect(byName.cpi_list_packages.annotations.readOnlyHint === true, 'list must be read-only');
-  expect(!tools.some(tool => /delete/i.test(tool.name)), 'no delete tools');
-});
 
 // ============================================================ CPI packages
 await scenario('S03', 'cpi_create_package with wrong confirmation is refused', async () => {
   const result = await call('cpi_create_package', { package_id: PKG, name: 'AI smoke', short_text: 'AI smoke', confirmation: `CREATE CPI PACKAGE WRONG` });
   expect(result.isError && result.text === `confirmation must equal CREATE CPI PACKAGE ${PKG}`, result.text);
-  const packages = ok(await call('cpi_list_packages', { top: 200 }), 'list');
+  const packages = ok(await call('cpi_list_packages', { top: 200 }), 'list').items;
   expect(!packages.some(entry => entry.Id === PKG), 'package must not exist');
 });
 
@@ -220,7 +212,7 @@ await scenario('S05', 'cpi_create_package on an existing id surfaces the tenant
 });
 
 await scenario('S06', 'cpi_list_packages shows the package', async () => {
-  const packages = ok(await call('cpi_list_packages', { top: 200 }), 'list');
+  const packages = ok(await call('cpi_list_packages', { top: 200 }), 'list').items;
   const entry = packages.find(item => item.Id === PKG);
   expect(entry, 'package missing');
   expect(entry.ShortText === 'Created by sap-ai-integration live scenarios', `short text ${entry.ShortText}`);
@@ -247,7 +239,7 @@ await scenario('S08', 'cpi_create_iflow refuses a duplicate id before posting',
 });
 
 await scenario('S09', 'cpi_list_iflows lists the iFlow at 1.0.0', async () => {
-  const iflows = ok(await call('cpi_list_iflows', { package_id: PKG }), 'list');
+  const iflows = ok(await call('cpi_list_iflows', { package_id: PKG }), 'list').items;
   const entry = iflows.find(item => item.Id === IFLOW);
   expect(entry && entry.Version === '1.0.0', JSON.stringify(iflows));
 });
@@ -288,7 +280,7 @@ await scenario('S13', 'cpi_update_iflow_configuration reports an unknown key as
     confirmation: `CONFIGURE IFLOW ${IFLOW}`
   }), 'configure');
   expect(result.updated.length === 1 && result.failed?.key === 'No_Such_Key', JSON.stringify(result));
-  return result.failed.error.slice(0, 120);
+  return JSON.stringify(result.failed);
 });
 
 await scenario('S14', 'cpi_update_iflow rejects a stale expected_version', async () => {
@@ -331,7 +323,7 @@ await scenario('S17', 'cpi_get_iflow_runtime_status reports STARTED at 1.0.1', a
 await scenario('S18', 'cpi_list_service_endpoints returns the iFlow URL', async () => {
   let endpoints = [];
   for (let attempt = 0; attempt < 36 && !endpoints.length; attempt += 1) {
-    endpoints = ok(await call('cpi_list_service_endpoints', { iflow_id: IFLOW }), 'endpoints');
+    endpoints = ok(await call('cpi_list_service_endpoints', { iflow_id: IFLOW }), 'endpoints').items;
     if (!endpoints.length) await sleep(5000);
   }
   const url = endpoints.flatMap(entry => entry.urls).find(value => value.endsWith(`/http/ai/smoke${RUN}`));
@@ -363,7 +355,7 @@ await scenario('S20', 'custom BPMN (timer start) iFlow is created with caller pa
   const xml = timerIflw();
   ok(await call('cpi_create_iflow', { package_id: PKG, iflow_id: IFLOW_TIMER_OK, name: `AI Timer Ok ${RUN}`, template: 'custom', iflw_xml: xml, parameters: timerParameters('https://httpbin.org/anything/timer-ok'), confirmation: `CREATE IFLOW ${IFLOW_TIMER_OK}` }), 'create ok');
   ok(await call('cpi_create_iflow', { package_id: PKG, iflow_id: IFLOW_TIMER_FAIL, name: `AI Timer Fail ${RUN}`, template: 'custom', iflw_xml: xml, parameters: timerParameters('https://httpbin.org/status/500'), confirmation: `CREATE IFLOW ${IFLOW_TIMER_FAIL}` }), 'create fail');
-  const iflows = ok(await call('cpi_list_iflows', { package_id: PKG }), 'list');
+  const iflows = ok(await call('cpi_list_iflows', { package_id: PKG }), 'list').items;
   expect([IFLOW_TIMER_OK, IFLOW_TIMER_FAIL].every(id => iflows.some(entry => entry.Id === id)), 'both listed');
 });
 
@@ -378,7 +370,7 @@ await scenario('S21', 'timer iFlows deploy and start', async () => {
 async function waitForLog(iflowId, status) {
   for (let attempt = 0; attempt < 24; attempt += 1) {
     const result = ok(await call('cpi_list_message_logs', { iflow_id: iflowId, status, top: 5 }), 'logs');
-    if (result.logs.length) return result;
+    if (result.items.length) return result;
     await sleep(5000);
   }
   throw new Error(`no ${status} log for ${iflowId} after 120 s`);
@@ -386,7 +378,7 @@ async function waitForLog(iflowId, status) {
 
 await scenario('S22', 'cpi_list_message_logs finds the COMPLETED timer run', async () => {
   const result = await waitForLog(IFLOW_TIMER_OK, 'COMPLETED');
-  const [log] = result.logs;
+  const [log] = result.items;
   expect(log.Status === 'COMPLETED' && /^\d{4}-\d\d-\d\dT/.test(log.LogStart), JSON.stringify(log));
   ctx.okGuid = log.MessageGuid;
   return `${log.MessageGuid} ${log.LogStart}`;
@@ -394,7 +386,7 @@ await scenario('S22', 'cpi_list_message_logs finds the COMPLETED timer run', asy
 
 await scenario('S23', 'cpi_list_message_logs + cpi_get_message_log return the FAILED run with error text', async () => {
   const result = await waitForLog(IFLOW_TIMER_FAIL, 'FAILED');
-  const detail = ok(await call('cpi_get_message_log', { message_guid: result.logs[0].MessageGuid }), 'detail');
+  const detail = ok(await call('cpi_get_message_log', { message_guid: result.items[0].MessageGuid }), 'detail');
   expect(detail.log.Status === 'FAILED', JSON.stringify(detail.log));
   expect(detail.error_information && /500/.test(detail.error_information), `error text: ${detail.error_information}`);
   return detail.error_information.replace(/\s+/g, ' ').slice(0, 140);
@@ -408,10 +400,11 @@ await scenario('S24', 'cpi_get_message_log for a COMPLETED run has no error text
 });
 
 await scenario('S25', 'cpi_list_message_logs time window filters (from/to)', async () => {
-  const future = ok(await call('cpi_list_message_logs', { iflow_id: IFLOW_TIMER_OK, from: '2099-01-01T00:00:00Z' }), 'future');
-  expect(future.logs.length === 0, 'future window must be empty');
-  const past = ok(await call('cpi_list_message_logs', { iflow_id: IFLOW_TIMER_OK, from: '2020-01-01T00:00:00Z', to: '2099-01-01T00:00:00Z' }), 'past');
-  expect(past.logs.length >= 1, 'wide window must include the run');
+  const future = ok(await call('cpi_list_message_logs', { iflow_id: IFLOW_TIMER_OK, from: '2099-01-01T00:00:00Z', to: '2099-01-02T00:00:00Z' }), 'future');
+  expect(future.items.length === 0, 'future window must be empty');
+  const now = new Date();
+  const past = ok(await call('cpi_list_message_logs', { iflow_id: IFLOW_TIMER_OK, from: new Date(now.getTime() - 86400000).toISOString(), to: now.toISOString() }), 'past');
+  expect(past.items.length >= 1, 'recent window must include the run');
   return `total=${past.total}`;
 });
 
@@ -449,7 +442,7 @@ await scenario('S29', 'apim_create_api_provider creates an On-Premise provider w
 });
 
 await scenario('S30', 'apim_list_api_providers lists both providers', async () => {
-  const providers = ok(await call('apim_list_api_providers', { top: 200 }), 'list');
+  const providers = ok(await call('apim_list_api_providers', { top: 200 }), 'list').items;
   expect([PROVIDER, PROVIDER_ONPREM].every(name => providers.some(entry => entry.name === name)), JSON.stringify(providers.map(entry => entry.name)));
 });
 
@@ -457,7 +450,7 @@ await scenario('S30', 'apim_list_api_providers lists both providers', async () =
 await scenario('S31', 'apim_create_api_proxy fails for a missing provider before importing', async () => {
   const result = await call('apim_create_api_proxy', { name: `${PROXY}x`, base_path: `/ai/missing${RUN}`, service_type: 'rest', target: { provider: 'ZAI_NO_SUCH_PROVIDER', relative_path: '/x' }, confirmation: `CREATE API PROXY ${PROXY}x` });
   expect(result.isError && result.text === 'API provider ZAI_NO_SUCH_PROVIDER does not exist; create it with apim_create_api_provider', result.text);
-  const proxies = ok(await call('apim_list_api_proxies', { top: 200 }), 'list');
+  const proxies = ok(await call('apim_list_api_proxies', { top: 200 }), 'list').items;
   expect(!proxies.some(entry => entry.name === `${PROXY}x`), 'proxy must not exist');
 });
 
@@ -543,7 +536,7 @@ await scenario('S39', 'APIM in front of CPI: proxy to the iFlow endpoint reaches
 });
 
 await scenario('S40', 'apim_list_api_proxies shows all smoke proxies deployed', async () => {
-  const proxies = ok(await call('apim_list_api_proxies', { top: 200 }), 'list');
+  const proxies = ok(await call('apim_list_api_proxies', { top: 200 }), 'list').items;
   const mine = proxies.filter(entry => [PROXY, PROXY_URL, PROXY_ODATA, PROXY_CPI].includes(entry.name));
   expect(mine.length === 4, JSON.stringify(mine));
   return mine.map(entry => `${entry.name}:${entry.state}`).join(', ');
@@ -612,12 +605,12 @@ await scenario('S46', 'iFlow with Unicode description, POST receiver and static
     template_parameters: { sender_path: `/ai/post${RUN}`, receiver_address: 'https://httpbin.org/anything/post', receiver_query: 'static=1&mode=test', receiver_method: 'POST', receiver_proxy_type: 'internet', receiver_authentication: 'None', receiver_timeout_ms: 20000 },
     confirmation: `CREATE IFLOW ${IFLOW_POST}`
   }), 'create');
-  const listed = ok(await call('cpi_list_iflows', { package_id: PKG }), 'list').find(entry => entry.Id === IFLOW_POST);
+  const listed = ok(await call('cpi_list_iflows', { package_id: PKG }), 'list').items.find(entry => entry.Id === IFLOW_POST);
   expect(listed?.Name === ASCII_NAME, `name read back ${listed?.Name}`);
   expect(listed?.Description === UNICODE_DESCRIPTION, `description read back ${listed?.Description}`);
   const { runtime } = await deployAndWait(IFLOW_POST);
   expect(runtime.Status === 'STARTED', JSON.stringify(runtime));
-  const endpoints = ok(await call('cpi_list_service_endpoints', { iflow_id: IFLOW_POST }), 'endpoints');
+  const endpoints = ok(await call('cpi_list_service_endpoints', { iflow_id: IFLOW_POST }), 'endpoints').items;
   ctx.postEndpoint = endpoints.flatMap(entry => entry.urls)[0] ?? ctx.cpiEndpoint.replace(`/http/ai/smoke${RUN}`, `/http/ai/post${RUN}`);
   return `description "${listed.Description}"`;
 });
@@ -664,7 +657,7 @@ await scenario('S50', 'large script (57 KiB): truncated in the listing, complete
 await scenario('S51', 'rename through cpi_update_iflow keeps version chain consistent', async () => {
   const renamed = ok(await call('cpi_update_iflow', { iflow_id: IFLOW_POST, expected_version: '1.0.2', name: `${ASCII_NAME} v2`, files: [{ path: 'src/main/resources/script/marker.groovy', content: '// marker v2\n' }], confirmation: `UPDATE IFLOW ${IFLOW_POST}` }), 'update');
   expect(renamed.new_version === '1.0.3', JSON.stringify(renamed));
-  const listed = ok(await call('cpi_list_iflows', { package_id: PKG }), 'list').find(entry => entry.Id === IFLOW_POST);
+  const listed = ok(await call('cpi_list_iflows', { package_id: PKG }), 'list').items.find(entry => entry.Id === IFLOW_POST);
   expect(listed.Name === `${ASCII_NAME} v2` && listed.Version === '1.0.3', JSON.stringify(listed));
 });
 
@@ -680,15 +673,15 @@ await scenario('S53', 'message log filters: COMPLETED for the POST iFlow, top=1,
   let completed;
   for (let attempt = 0; attempt < 18; attempt += 1) {
     completed = ok(await call('cpi_list_message_logs', { iflow_id: IFLOW_POST, status: 'COMPLETED', top: 50 }), 'completed');
-    if (completed.logs.length >= 3) break;
+    if (completed.items.length >= 3) break;
     await sleep(5000);
   }
-  expect(completed.logs.length >= 3 && completed.logs.every(log => log.Status === 'COMPLETED'), `${completed.logs.length} logs`);
+  expect(completed.items.length >= 3 && completed.items.every(log => log.Status === 'COMPLETED'), `${completed.items.length} logs`);
   const one = ok(await call('cpi_list_message_logs', { iflow_id: IFLOW_POST, top: 1 }), 'top1');
-  expect(one.returned === 1 && one.total >= completed.logs.length, JSON.stringify({ returned: one.returned, total: one.total }));
-  const past = ok(await call('cpi_list_message_logs', { iflow_id: IFLOW_POST, to: '2020-01-01T00:00:00Z' }), 'past');
-  expect(past.logs.length === 0, 'past window must be empty');
-  const ordered = completed.logs.map(log => log.LogEnd);
+  expect(one.returned === 1 && one.total >= completed.items.length, JSON.stringify({ returned: one.returned, total: one.total }));
+  const past = ok(await call('cpi_list_message_logs', { iflow_id: IFLOW_POST, from: '2019-12-31T00:00:00Z', to: '2020-01-01T00:00:00Z' }), 'past');
+  expect(past.items.length === 0, 'past window must be empty');
+  const ordered = completed.items.map(log => log.LogStart);
   expect(ordered.every((value, index) => index === 0 || ordered[index - 1] >= value), 'logs must be newest first');
   return `total=${one.total}`;
 });
@@ -700,7 +693,7 @@ await scenario('S54', 'receiver HTTP 503 → caller error and FAILED log with th
   const result = await invoke(ctx.cpiEndpoint, { body: '{}', done: response => response.status >= 500 && response.status !== 503 });
   expect(result.status === 500, `caller got HTTP ${result.status}`);
   const failed = await waitForLog(IFLOW, 'FAILED');
-  const detail = ok(await call('cpi_get_message_log', { message_guid: failed.logs[0].MessageGuid }), 'detail');
+  const detail = ok(await call('cpi_get_message_log', { message_guid: failed.items[0].MessageGuid }), 'detail');
   expect(/503/.test(detail.error_information || ''), `error ${detail.error_information}`);
   return detail.error_information.replace(/\s+/g, ' ').slice(0, 120);
 });
@@ -720,7 +713,7 @@ await scenario('S55', 'missing security material → FAILED log names the creden
   const result = await invoke(endpoint, { body: '{}', done: response => response.status !== 404 && response.status !== 503 });
   expect(result.status >= 500, `caller got HTTP ${result.status}`);
   const failed = await waitForLog(IFLOW_CRED, 'FAILED');
-  const detail = ok(await call('cpi_get_message_log', { message_guid: failed.logs[0].MessageGuid }), 'detail');
+  const detail = ok(await call('cpi_get_message_log', { message_guid: failed.items[0].MessageGuid }), 'detail');
   expect(/ZAI_MISSING_CRED|credential/i.test(detail.error_information || ''), `error ${detail.error_information}`);
   return detail.error_information.replace(/\s+/g, ' ').slice(0, 120);
 });
@@ -776,7 +769,7 @@ await scenario('S61', 'apim_update_api_proxy moves a proxy to a new base path',
 });
 
 await scenario('S62', 'apim_get_api_proxy runtime_url uses the default virtual host and base path', async () => {
-  const hosts = ok(await call('apim_list_virtual_hosts'), 'hosts');
+  const hosts = ok(await call('apim_list_virtual_hosts'), 'hosts').items;
   const host = hosts.find(entry => entry.isDefault);
   const proxy = ok(await call('apim_get_api_proxy', { name: PROXY_CPI_PROVIDER }), 'get');
   expect(proxy.runtime_url === `https://${host.virtual_host}/ai/cpiprov${RUN}`, `${proxy.runtime_url} vs ${host.virtual_host}`);
@@ -784,7 +777,7 @@ await scenario('S62', 'apim_get_api_proxy runtime_url uses the default virtual h
 
 await scenario('S63', 'apim_list_api_proxies honours top', async () => {
   const one = ok(await call('apim_list_api_proxies', { top: 1 }), 'list');
-  expect(one.length === 1, `${one.length} proxies`);
+  expect(one.returned === 1, `${one.returned} proxies`);
 });
 
 await scenario('S64', 'XML-special title/description are escaped in the bundle and read back exactly', async () => {
@@ -819,7 +812,7 @@ await scenario('S67', 'API provider input validation rejects bad combinations',
     const result = await call('apim_create_api_provider', { ...args, confirmation: `CREATE API PROVIDER ${args.name}` });
     expect(result.isError, `accepted ${JSON.stringify(args)}`);
   }
-  const providers = ok(await call('apim_list_api_providers', { top: 200 }), 'list');
+  const providers = ok(await call('apim_list_api_providers', { top: 200 }), 'list').items;
   expect(!providers.some(entry => /^ZAIBAD/.test(entry.name)), 'invalid provider was created');
 });
 
@@ -873,7 +866,7 @@ await scenario('S72', 'message log lookups: malformed GUID rejected, unknown GUI
 await scenario('S73', 'deploy and configure of a missing iFlow fail cleanly', async () => {
   cleanError(await call('cpi_deploy_iflow', { iflow_id: 'Z_AI_No_Such_Flow', wait_seconds: 5, confirmation: 'DEPLOY IFLOW Z_AI_No_Such_Flow' }), /^CPI /);
   const configured = ok(await call('cpi_update_iflow_configuration', { iflow_id: 'Z_AI_No_Such_Flow', parameters: [{ key: 'A', value: 'b' }], confirmation: 'CONFIGURE IFLOW Z_AI_No_Such_Flow' }), 'configure');
-  expect(configured.updated.length === 0 && /^CPI PUT/.test(configured.failed?.error || ''), JSON.stringify(configured));
+  expect(configured.updated.length === 0 && configured.failed?.status === 404, JSON.stringify(configured));
 });
 
 await scenario('S74', 'update with a missing iFlow fails without writing', async () => {
@@ -903,7 +896,7 @@ await scenario('S76', 'CPI-runtime API provider read back has no secrets and Int
 });
 
 await scenario('S77', 'service endpoints without a filter include every HTTPS iFlow of this run', async () => {
-  const endpoints = ok(await call('cpi_list_service_endpoints'), 'endpoints');
+  const endpoints = ok(await call('cpi_list_service_endpoints'), 'endpoints').items;
   const urls = endpoints.flatMap(entry => entry.urls);
   for (const suffix of [`/http/ai/smoke${RUN}`, `/http/ai/post${RUN}`]) expect(urls.some(url => url.endsWith(suffix)), `missing ${suffix}`);
   return `${endpoints.length} endpoints`;
@@ -937,7 +930,7 @@ await scenario('S81', 'odata_get readers list entity sets from both $metadata do
 
 await scenario('S82', 'cpi_list_runtime_artifacts and cpi_list_package_artifacts show this run', async () => {
   const runtime = ok(await call('cpi_list_runtime_artifacts', { top: 200 }), 'runtime');
-  const artifacts = runtime.artifacts ?? runtime;
+  const artifacts = runtime.items;
   expect(JSON.stringify(artifacts).includes(IFLOW), `${IFLOW} not deployed in runtime list`);
   const contents = ok(await call('cpi_list_package_artifacts', { package_id: PKG }), 'package');
   expect(JSON.stringify(contents).includes(IFLOW), 'package contents miss the iFlow');
@@ -946,7 +939,7 @@ await scenario('S82', 'cpi_list_runtime_artifacts and cpi_list_package_artifacts
 await scenario('S83', 'cpi_get_message_log_steps returns the steps of a runtime call', async () => {
   expect(ctx.directGuid, 'needs S41');
   const steps = ok(await call('cpi_get_message_log_steps', { message_guid: ctx.directGuid }), 'steps');
-  expect(JSON.stringify(steps).length > 50, JSON.stringify(steps));
+  expect(Array.isArray(steps.items) && steps.returned === steps.items.length, JSON.stringify(steps));
   return JSON.stringify(steps).slice(0, 160);
 });
 
@@ -983,8 +976,8 @@ await scenario('S86', 'cpi_set_number_range creates a range and reads it back',
 await scenario('S87', 'cpi_set_partner_parameter creates and updates a string parameter', async () => {
   ok(await call('cpi_set_partner_parameter', { pid: PARTNER, id: 'ReceiverAddress', type: 'string', value: 'https://a.example', confirmation: `SET PARTNER PARAMETER ${PARTNER}/ReceiverAddress` }), 'create');
   ok(await call('cpi_set_partner_parameter', { pid: PARTNER, id: 'ReceiverAddress', type: 'string', value: 'https://b.example', confirmation: `SET PARTNER PARAMETER ${PARTNER}/ReceiverAddress` }), 'update');
-  const listed = ok(await call('cpi_list_partner_parameters', { pid: PARTNER }), 'list');
-  expect(JSON.stringify(listed).includes('https://b.example'), JSON.stringify(listed).slice(0, 300));
+  const listed = ok(await call('cpi_list_partner_parameters', { pid: PARTNER, type: 'string' }), 'list');
+  expect(listed.items.some(entry => entry.Id === 'ReceiverAddress'), JSON.stringify(listed).slice(0, 300));
 });
 
 await scenario('S88', 'apim_create_key_value_map (encrypted) and set entries; values never returned', async () => {
@@ -1065,8 +1058,7 @@ await scenario('S94', 'integration_connection_info verify: both sides sign in an
   return `CPI: ${summary(verification.cpi)} | APIM: ${summary(verification.apim)}`;
 });
 
-await scenario('S80', `after all writes: ${INTEGRATION_TOOL_NAMES.length} tools, both sides configured, no secrets emitted`, async () => {
-  expect((await client.listTools()).tools.length === INTEGRATION_TOOL_NAMES.length, 'tool count changed');
+await scenario('S80', 'after all writes: core sides remain configured and tool outputs contain no secrets', async () => {
   const info = ok(await call('integration_connection_info'), 'info');
   expect(info.cpi.configured && info.apim.configured, 'side lost');
   return `${results.filter(result => result.status === 'PASS').length} passed so far; every tool output scanned for ${SECRETS.length} secrets`;