Critical fixes:
- C-01: Extract enforceAccess() into access.ts, use in both registry.execute() and subscribe()
- C-02: Add validateOrThrow() to subscribe() (was missing input validation)
- C-03: Add .catch() handlers to PendingRequestMap.setupSubscriptions() IIFEs
- C-04: MCP adapter now throws CallError on isError: true instead of returning success envelope
- C-05: Replace bare 'EXECUTION_ERROR' string literals with InfrastructureErrorCode.EXECUTION_ERROR enum
High-priority fixes:
- H-01: Remove customAuth stub from AccessControlSchema (was defined but never enforced)
- H-02: Add metadata field to CallRequestedEvent and propagate through buildCallHandler
- H-03: Remove dead stream/pubsub stubs from OperationContext type
- H-04: MCP handler now accepts OperationContext parameter (was discarding it)
- H-05: Use spec.info.version in OpenAPI adapter, config.version in MCP adapter (was hard-coded 1.0.0)
- H-06: FromOpenAPIFile now throws clear error when node:fs/promises unavailable (was unhandled crash)
glm-5.1
a2f64f1dcb