Problem
An entry without tools crashes with TypeError (500 to the operator); malformed JSON and unknown keys both return 401 "unknown client key", hiding server misconfig.
Where
src/auth.ts (config unchecked) + src/index.ts (.tools.includes).
Acceptance
Add failing tests first asserting a tools-less entry and malformed JSON each produce a safe config error (no 500, distinguishable from bad-key 401). Then fix.
Problem
An entry without
toolscrashes withTypeError(500 to the operator); malformed JSON and unknown keys both return 401 "unknown client key", hiding server misconfig.Where
src/auth.ts(configunchecked) +src/index.ts(.tools.includes).Acceptance
Add failing tests first asserting a tools-less entry and malformed JSON each produce a safe config error (no 500, distinguishable from bad-key 401). Then fix.