chore(openai): OpenAI submission fixes

apps/api/src/mcp/tools/media.ts

@@ -225,15 +225,15 @@ export function registerMediaTools(server: McpToolRegistrar): void {
         "seal_media",
         {
             description:
-                "Locks a media item to mark it for persistence. Once sealed, the item can no longer be modified.",
+                "Finalizes a temporary upload for retention, preventing automatic cleanup. Public uploads become publicly accessible. Already sealed items are returned unchanged.",
             inputSchema: {
                 mediaId: z.string().describe("ID of the media item to seal"),
             },
             outputSchema: mediaSchema,
             annotations: {
                 title: "Seal media",
                 readOnlyHint: false,
-                destructiveHint: false,
+                destructiveHint: true,
                 openWorldHint: true,
             },
         },

packages/integration-tests/src/mcp.ts

@@ -413,6 +413,20 @@ export async function runMcpIntegrationTests(
         );
         log("PASS MCP initialize and complete tool inventory");
 
+        const sealTool = object(
+            listedTools.tools.find(
+                (tool) => object(tool).name === "seal_media",
+            ),
+            "seal_media definition",
+        );
+        const sealAnnotations = object(
+            sealTool.annotations,
+            "seal_media annotations",
+        );
+        assert.equal(sealAnnotations.readOnlyHint, false);
+        assert.equal(sealAnnotations.destructiveHint, true);
+        assert.equal(sealAnnotations.openWorldHint, true);
+
         const originalSettings = await getMediaSettings();
         settingsToRestore = originalSettings;
         const changedSettings = {
@@ -509,6 +523,10 @@ export async function runMcpIntegrationTests(
 
         const sealed = await client.callTool("seal_media", { mediaId });
         assert.equal(sealed.mediaId, mediaId);
+        assert.equal(sealed.access, "private");
+        const sealedAgain = await client.callTool("seal_media", { mediaId });
+        assert.equal(sealedAgain.mediaId, mediaId);
+        assert.equal(sealedAgain.access, "private");
         const retrieved = await client.callTool("get_media", { mediaId });
         assert.equal(retrieved.mediaId, mediaId);
         assert.equal(retrieved.originalFileName, filename);