feat: explore_api result analysis in atp-compiler

[encodedz]

Summary

Adds the discovery-side counterpart to analyzeApiCalls: a client/gateway that proxies a remote ATP server it doesn't run itself (e.g. mcp-gateway talking to hosted ATP endpoints) needs to re-check an explore_api result against its own grant model before handing it to an agent. Today that means hand-rolling ATP's directory/function result shape and /apiGroup/... path convention client-side. This moves that parsing into atp-compiler, where analyzeApiCalls already lives for the mirror-image case (execute_code's request payload instead of explore_api's response payload).

New exports (@mondaydotcomorg/atp-compiler)

• collectExploreOperations(result: ExploreResult): DetectedApiCall[] — every {apiGroup, operationId} leaf reachable in a directory listing or direct function result.
• collectExploreOperationsFromValue(value: unknown): DetectedApiCall[] — same, over an already-JSON-parsed payload that may be a single result or an array (mirrors explore_api's paths: string | string[] input).
• filterExploreResult(result, allowedOperations): ExploreResult | null — narrows a result to an allow-list. A denied function result returns null rather than a synthesized stand-in, mirroring ExplorerService.explore()'s own convention in atp-server — callers decide how "not visible" should look on the wire.
• filterExploreResultValue(value, allowedOperations): unknown — same, over the array/single-result payload shape.

Notes

• Reuses DetectedApiCall (already exported from analyzeApiCalls) rather than introducing a parallel type, since both are the same {apiGroup, operationId} identity.
• Pure, no I/O — same contract as analyzeApiCalls. Callers own resolving the allow-list and deciding what a null becomes on the wire.
• Directory listings are only ever narrowed at the level being explored; subdirectories are left alone and get filtered again on the caller's next explore_api call into them (no eager recursion/guessing).

Test plan

• yarn jest in packages/atp-compiler — 351/351 passing (15 new)
• yarn lint (tsc --noEmit) clean
• yarn build clean
• eslint 'packages/atp-compiler/src/**/*.ts' — zero new warnings/errors (all findings pre-existing, none in the new file)
• prettier --check clean

🤖 Generated with Claude Code

Related: https://monday.monday.com/boards/4775886076/views/106679500/pulses/12733098176