viafrei 1.4.6 → 1.4.9

package/API.md

@@ -9,7 +9,7 @@ the server's own text, reproduced verbatim, because that text is what an
 assistant reads when it decides which tool to call; paraphrasing it here would
 document a different server.
 
-**It is a dated snapshot, taken on 2026-09-29.** Generating this file makes
+**It is a dated snapshot, taken on 2026-10-01.** Generating this file makes
 it impossible for the document and the snapshot to disagree — CI regenerates and
 compares — but it cannot keep the snapshot from ageing against the live server,
 because a capture is a point in time. **The source of truth is the running
@@ -17,11 +17,11 @@ server:** connect any MCP client and call `tools/list`.
 
 | | |
 | --- | --- |
-| Server | `viafrei` 1.4.6 |
+| Server | `viafrei` 1.4.9 |
 | MCP protocol | `2025-06-18` |
 | Streamable HTTP | https://mcp.viafrei.de/mcp |
 | Legacy HTTP+SSE | https://mcp.viafrei.de/sse |
-| Captured from | `https://mcp.viafrei.de/mcp` on 2026-09-29 |
+| Captured from | `https://mcp.viafrei.de/mcp` on 2026-10-01 |
 | Surface | 19 tools, 10 resources, 2 resource templates, 9 prompts |
 | Parameter schemas | JSON Schema draft-07 |
 | Capabilities | `tools`, `resources`, `prompts`, `logging` |
@@ -655,5 +655,5 @@ single call.
 ---
 
 Generated from `catalogue.json` by `scripts/gen-api-doc.mjs`. The snapshot was
-read from `https://mcp.viafrei.de/mcp` on 2026-09-29; no tool was invoked to
+read from `https://mcp.viafrei.de/mcp` on 2026-10-01; no tool was invoked to
 produce it, so no data provider was contacted.

package/CHANGELOG.md

@@ -5,7 +5,199 @@ a Changelog and the versions follow Semantic Versioning.
 
 ## [Unreleased]
 
-Nothing yet.
+## [1.4.9] - 2026-10-01
+
+**Mirrors the server.** The bridge is versioned to match the ViaFrei MCP server
+it relays to, and prod moved to 1.4.9; this release carries the three changes
+that had been waiting under `[Unreleased]` for a number to mirror. The shipped
+reference was re-captured from the running server at the cut, and the probe that
+did it reported the surface **unchanged** — only the version string and the
+capture date moved.
+
+### Added
+
+- **The sources page is now checked against the catalogue snapshot** (`scripts/check-sources.mjs`,
+  `npm run check:sources`), in CI and in the publish workflow (#32).
+
+  `SOURCES.md` states counts *about the server* — how many tools it exposes, how many are
+  read-only, which are fuel and therefore excluded from its spot check. Nothing compared
+  them with `catalogue.json`, which ships in the same tarball and holds the answers, and
+  the page spent two releases describing a server it no longer matched.
+
+  **Offline on purpose, and that is what makes it worth having.** Both files already ship
+  together, so this needs no network and runs on every push rather than at the cut. It
+  would have caught all three defects of the previous entry, including the one that got
+  past a first review round: the **derived** call count is computed as read-only minus the
+  excluded fuel tools, never read from the prose, because that is the one number on the
+  page a reader might act on.
+
+  The licence arm is the one that matters: a fuel tool present in the snapshot and not
+  named by the page is a failure, because that exclusion is an MTS-K condition rather
+  than a convenience, and a tool counts as fuel-constrained if its NAME says so **or**
+  its DESCRIPTION names the provider — measured on this snapshot, both fuel tools name
+  theirs in prose and no other tool does, so a rename alone cannot hide one. `npm run
+  test:sources` prints the case count; no number is written here, because this entry's
+  first draft stated one and it was stale within the round.
+
+  Two limits are pinned rather than assumed. A fuel rule gone inert REFUSES (exit 2)
+  instead of reporting an empty excluded set. And a tool renamed away from `fuel` *whose
+  description also stops naming the provider* matches neither arm and is not on the floor,
+  so that one still fails through the arithmetic, with a message about a call count rather
+  than about an unprotected tool. That is the honest reach of two text rules, and the
+  weaker behaviour is asserted rather than hoped for.
+
+- **A cut-time probe that compares the shipped reference with the running server**
+  (`scripts/probe-catalogue.mjs`, `npm run probe:catalogue`; `--write` re-captures) (#33).
+
+  At the 1.4.6 cut the shipped reference described server 1.3.22 and omitted a tool the
+  server exposed. `check:docs` passed throughout — it proves `API.md` matches
+  `catalogue.json`, so **a stale pair passes together**. Nothing compared either with the
+  server.
+
+  **It is deliberately not a CI step.** This repository's test posture is that CI reaches
+  nothing, which is why every other check here is offline; a comparison with the running
+  server needs a network call, so this is run by a person at the cut and is the only
+  script here that touches the network. It is named `probe:` rather than `check:` so that
+  distinction is visible in `package.json`.
+
+  Read-only: `initialize` and the four list calls, **no tool invoked**, session deleted
+  afterwards. That is a licence requirement and not courtesy — the fuel source sets a
+  per-station floor.
+
+  **Its report distinguishes WRONG from DATED**, because those are the two real histories
+  and they need different remedies: 1.4.6's reference omitted a tool, which misleads a
+  reader about what they are holding; 1.4.8's had only a stale version string. Reporting
+  one as the other would be worse than no probe. Ten self-test cases, none of which touch
+  the network — every one runs against a local stub — including both halves of that
+  distinction, an empty list refused rather than compared equal, and `--write` proved to
+  produce a snapshot the comparator then accepts.
+
+- **`runToolAsync`** in `scripts/tools.mjs`, with the same deadline and refusal as
+  `runTool`. The synchronous runner blocks the caller's event loop, so a caller that is
+  itself serving the child cannot use it — the probe's self-test serves a stub in-process
+  and spawns the probe against it, and every case deadlocked until this existed. Added to
+  the one `SPAWNERS` array the bare-name sweep derives from, so it is covered by the same
+  rule as its sibling rather than being a quiet exemption.
+
+### Fixed
+
+- **Both CI deprecation warnings, in both workflows.** `build-and-test` was emitting two
+  notices: the Node-20 runtime of `actions/checkout@v4` and `actions/setup-node@v4` is
+  deprecated and GitHub is already forcing those actions onto Node 24, and the
+  `ubuntu-latest` label migrates to Ubuntu 26 from 2026-10-19.
+
+  **The warning named one workflow; the measurement named two.** `publish.yml` pinned both
+  actions by commit sha, which looked like the careful half of the repository — but
+  `action.yml` at each of those pinned shas declares `using: node20`. So the workflow that
+  publishes to npm was on the deprecated runtime too and said nothing about it, because a
+  sha pin does not report its own age. A fix confined to `ci.yml` would have cleared the
+  log and left the publish path exactly where it was.
+
+  Both files now pin the same runner image, `ubuntu-24.04`, and the same two actions by
+  sha: checkout **v7.0.1** and setup-node **v7.0.0**, resolved from the API rather than
+  transcribed, and each verified to declare `using: node24` at the sha actually pinned —
+  which is what closes the notice rather than deferring it. That also leaves one version
+  of each action in the repository instead of two.
+
+  **v7, not v5, and it is a three-major move.** v5 clears today's warning and leaves this
+  repository two majors behind the same deadline. The first draft of this entry described
+  v7.0.0's release notes and called them the only behaviour change — true of that release,
+  false of the upgrade, and the paragraph's whole job is to justify the size of the jump.
+
+  The jump was therefore checked mechanically instead, which is shorter and re-runnable:
+  **diff the declared input sets at the two shas.** Across v4.4.0 → v7.0.0 setup-node
+  removes exactly one input, `always-auth`, and adds `package-manager-cache`; checkout
+  removes and adds none. Between them the two workflows pass four inputs — `node-version`,
+  `registry-url`, `cache` and `fetch-depth` — and all four are still declared, so the
+  `registry-url` → `.npmrc` path the publish depends on is intact.
+
+  The breaking changes the intervening majors do declare are inert here, by enumeration
+  rather than by assumption: setup-node v5's automatic package-manager detection and v6's
+  narrowing of it to npm cannot apply, because both jobs pass `cache: npm` explicitly and
+  this `package.json` has no `packageManager` field; checkout v5's minimum runner version
+  (2.327.1) is far below what GitHub-hosted runners run; checkout v7's refusal to check out
+  a fork's head applies to `pull_request_target` and `workflow_run`, neither of which
+  appears anywhere under `.github/`; and setup-node v7's removal of the dummy
+  `NODE_AUTH_TOKEN` export is an **improvement** on this path — that variable appears
+  nowhere in either workflow, and upstream's own pull request says the dummy value could
+  corrupt an `.npmrc` during an OIDC publish, which is how publishing here works.
+
+  One is named rather than waved past, because it touches the publish gate. checkout v6
+  moved the persisted git credential into a separate file, and `publish.yml` runs one git
+  command that touches the remote after checkout: the `git fetch origin main` the
+  tag-containment guard needs (the step's other two, a `rev-parse` and a `merge-base`, are
+  local). This repository is public, so that fetch succeeds with or without a credential;
+  and if it ever did not, the guard exits **2** and refuses to publish rather than
+  publishing a commit `main` does not contain. Fail-closed, so the bad outcome is a blocked
+  release and never a wrong one. It is also the one step a `workflow_dispatch` dry run
+  cannot exercise, since the guard is gated on a tag.
+
+  A floating tag is what hid this, so nothing here floats: all four `- uses:` lines in the
+  repository are now `@<sha> # vX.Y.Z`, and neither `runs-on` is a label that can change
+  under a workflow nobody re-read.
+
+  Written while prod and the registry were both at 1.4.8, so this said "no version bump:
+  there is no number to mirror". Prod moved to 1.4.9 before the cut, so the number now
+  exists and this ships under it.
+
+- **`SOURCES.md` claimed a measurement that stopped being true, and the stale half is
+  a licence condition.** The page said its status column was measured by calling
+  "fifteen of the server's sixteen read-only tools — every one except
+  `find_cheapest_fuel`". As of the 2026-09-29 capture shipped alongside it, the server
+  exposes nineteen tools, seventeen of them read-only, and — this is the part that
+  matters — a **second** fuel tool, `find_fuel_station`.
+
+  The exclusion of `find_cheapest_fuel` is not a convenience: MTS-K sets a minimum
+  interval per station and its terms make needless querying a real risk to the access
+  itself. That reasoning applies to `find_fuel_station` identically, and the page did
+  not name it, so a reader following the page's own method would have called a fuel
+  tool the page meant to exclude.
+
+  The measurement is now scoped to the date and the server it was taken against, the
+  growth since is stated, and **both** fuel tools are named as excluded. It is
+  deliberately **not** re-run: that would still cost **fifteen** live calls against
+  real providers to re-confirm statuses already known — the same fifteen as at the
+  original measurement, because the one read-only tool the server gained is the
+  second fuel tool and is excluded. Sixteen minus one was fifteen; seventeen minus
+  two is fifteen again. Dated on purpose, and said out loud — a measurement carried forward under a present-tense sentence is
+  the failure that section exists to avoid.
+
+  Not released on its own: when it was written prod was at 1.4.8, already published, and
+  putting the package a patch ahead of the endpoint it relays to would have been worse than
+  waiting. It rode the next version sync, which is this one.
+
+## [1.4.8] - 2026-09-29
+
+**A version-sync release.** The bridge is published at the version the ViaFrei server
+is serving, so that `npx viafrei@X.Y.Z` and the endpoint it relays to are named by one
+number. `mcp.viafrei.de` moved to `1.4.8`, so the bridge follows. 1.4.7 is absent from
+the registry for the same reason 1.4.0–1.4.5 were: that platform version carried no
+bridge change.
+
+**Nothing in the bridge changed at all** — not the runtime, not the tooling, not a
+gate. The diff against 1.4.6 is the three version fields plus the re-captured API
+reference. If 1.4.6 works for you, this is the same code under a number that matches
+the server.
+
+### Changed
+
+- **The API reference is re-captured at 1.4.8** (`API.md`, `catalogue.json`). Unlike
+  1.4.6's re-capture, this one is only a date and a version string: the server's
+  surface did **not** change between 1.4.6 and 1.4.8. Verified rather than assumed —
+  the same 19 tools, 10 resources, 2 resource templates and 9 prompts, with no tool
+  added or removed, no description altered and no `required` list moved, compared
+  field-by-field against the stored snapshot before the new one was written.
+
+  That distinction is the whole reason this entry says so out loud. At 1.4.6 the
+  shipped reference was *wrong* — it omitted a tool the server exposed. Here it was
+  merely *old*. The two need different remedies and only one of them is honest in each
+  case, so which one applied is recorded rather than left for a reader to guess.
+
+  Captured read-only: `initialize`, `tools/list`, `resources/list`,
+  `resources/templates/list`, `prompts/list`. No tool was invoked, so no data provider
+  was contacted, and the session was deleted afterwards. The two substitutions the
+  snapshot documents are unchanged and asserted on the way in and out: 19 of 19
+  `$schema` URIs dropped, exactly 2 long patterns stored as `patternLength`.
 
 ## [1.4.6] - 2026-09-29
 
@@ -1259,6 +1451,7 @@ for it, so the number is free; the bridge will use it when the platform does.
   commits, and a squash makes them unreachable from `main` - which would turn
   the check red on `main` for everybody, for something no contributor did.
 
+[1.4.9]: https://github.com/mavrovde/viafrei-bridge/releases/tag/v1.4.9
 [1.3.22]: https://github.com/mavrovde/viafrei-bridge/releases/tag/v1.3.22
 [1.3.16]: https://github.com/mavrovde/viafrei-bridge/releases/tag/v1.3.16
 [1.3.15]: https://github.com/mavrovde/viafrei-bridge/releases/tag/v1.3.15

package/SOURCES.md

@@ -134,13 +134,32 @@ one labelled `not re-measured`** was checked by calling the public endpoint on
 **2026-09-27** and reading which source the answer named. A source can be licensed, cleared and loaded and still not answer
 a question today; where that is so, this page says it.
 
-The measurement was taken by calling **fifteen of the server's sixteen read-only
-tools — every one except `find_cheapest_fuel`** — once each, and reading
-`_meta.sources` out of the result: not by reading the code, and not by asking
-whether a feed was running. Thirteen sources were named by at least one answer.
-The tool not called is the one whose row is deliberately not re-measured, and
-the count above says so rather than absorbing it: a status this page cannot stand behind is
-worse than an honest gap.
+The measurement was taken **on 2026-09-27**, when the server exposed sixteen
+read-only tools, by calling **fifteen of them — every one except
+`find_cheapest_fuel`** — once each, and reading `_meta.sources` out of the result:
+not by reading the code, and not by asking whether a feed was running. Thirteen
+sources were named by at least one answer. The tool not called is the one whose row
+is deliberately not re-measured, and the count says so rather than absorbing it: a
+status this page cannot stand behind is worse than an honest gap.
+
+**The server has grown since that measurement, and this page has not re-run it.**
+As of the 2026-09-29 capture shipped alongside this page it exposes nineteen tools,
+seventeen of them read-only, including a SECOND fuel tool, `find_fuel_station`.
+That one is excluded from any spot check for exactly the same reason
+`find_cheapest_fuel` is, and the reason is a licence condition rather
+than a convenience: MTS-K sets a minimum interval per station and its terms make
+needless querying a real risk to the access itself. **Both fuel tools are excluded,
+not one.**
+
+The sentence above therefore describes what was measured on 2026-09-27 and not what
+the server offers today. Re-running it would still mean **fifteen** live calls
+against real providers — the same fifteen, because the one read-only tool the server
+gained is the second fuel tool, and that one is excluded. Sixteen read-only minus one
+fuel tool was fifteen; seventeen minus two is fifteen again. Those calls would
+re-confirm statuses this page already knows, so it is dated on purpose rather than
+refreshed on a schedule — and dated is said out loud, because a measurement silently
+carried forward under a present-tense sentence is the failure this section exists to
+avoid.
 
 - **live** — an answer came back naming it when this page was checked;
 - **in the service** — licensed and loaded, and the spot check produced no

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "viafrei",
-  "version": "1.4.6",
+  "version": "1.4.9",
   "description": "German traffic, rail, parking, charging, fuel, address and weather data in your AI assistant - MCP, no API key. stdio bridge to the hosted ViaFrei MCP server.",
   "keywords": [
     "mcp",
@@ -75,6 +75,10 @@
     "check:versions": "node scripts/check-versions.mjs",
     "docs:api": "node scripts/gen-api-doc.mjs",
     "check:docs": "node scripts/gen-api-doc.mjs --check",
+    "check:sources": "node scripts/check-sources.mjs",
+    "test:sources": "node scripts/check-sources.test.mjs",
+    "probe:catalogue": "node scripts/probe-catalogue.mjs",
+    "test:probe": "node scripts/probe-catalogue.test.mjs",
     "rules:show": "node scripts/show-rules.mjs"
   },
   "dependencies": {