@iris-eval/mcp-server 0.5.0 → 0.6.0

package/dist/tools/list-rules.js

@@ -33,13 +33,13 @@ export function registerListRulesTool(server, customRuleStore) {
             '',
             'Behavior. Pure read of ~/.iris/custom-rules.json (in-memory cached; no disk read per call after server boot). No mutation, no external network. Tenant-scoped in Cloud tier; OSS returns all rules for the single local tenant. Rate-limited to 20 req/min on HTTP MCP, unlimited on stdio. Returns in <5ms.',
             '',
-            'Output shape. Returns JSON: `{ "rules": [{ "id": "rule-XXXX", "name", "description?", "evalType", "severity", "definition": { type, config, weight? }, "enabled": boolean, "deployedAt": ISO timestamp, "sourceMomentId?": string }], "total": number, "enabled_count": number }`. Empty array + total=0 when no rules deployed.',
+            'Output shape. Returns JSON: `{ "rules": [{ "id": "rule-XXXX", "name", "description", "evalType", "severity", "definition": { name, type, config, weight? }, "enabled": boolean, "createdAt": ISO timestamp, "updatedAt": ISO timestamp, "version": number, "sourceMomentId?": string }], "total": number, "enabled_count": number }`. Empty array + total=0 when no rules deployed. A deployed rule fires only on evaluate_output calls whose eval_type equals its evalType (or eval_type="all", which runs every bundle).',
             '',
             'Use when you need to know what custom rules are currently live (before calling evaluate_output, before deploying a similar rule to avoid duplicates, or when building a dashboard view). Filter with `eval_type` to scope to a specific category, or `enabled_only: true` to exclude disabled rules. Use get_traces to see trace data; use evaluate_output to run scoring; use list_rules only when you need the RULE INVENTORY.',
             '',
             "Don't use to count traces or evals (that's get_traces). Don't use to inspect built-in (non-custom) rules — those ship with the iris binary and are listed in docs/api-reference.md, not in the rule store. Don't use to deploy a rule (use deploy_rule); don't use to remove one (use delete_rule).",
             '',
-            'Parameters. eval_type filter is exact-match against each rule\'s evalType field (no wildcards). enabled_only excludes rules that are deployed-but-disabled (toggled via the dashboard\'s rule-list affordance — there\'s no MCP toggle tool in v0.4). Both filters are AND-combined when both are set. Both are optional; with no filter, all rules return. Defaults: eval_type=undefined (no filter), enabled_only=false (returns all rules including disabled).',
+            'Parameters. eval_type filter is exact-match against each rule\'s evalType field (no wildcards). enabled_only excludes rules that are deployed-but-disabled — a rule is disabled without deleting it via delete_rule with `enabled: false` (and re-enabled with `enabled: true`), or from the dashboard; disabled rules stay in the store with their history but do not fire. Both filters are AND-combined when both are set. Both are optional; with no filter, all rules return. Defaults: eval_type=undefined (no filter), enabled_only=false (returns all rules including disabled).',
             '',
             "Error modes. Returns empty list if the rule store file doesn't exist (first run). Returns 429 if HTTP rate limit exceeded. Never throws on valid input.",
         ].join('\n'),

package/dist/tools/log-trace.js

@@ -59,7 +59,7 @@ export function registerLogTraceTool(server, storage) {
             '',
             'Sibling tools — evaluate_output runs heuristic scoring on the trace; evaluate_with_llm_judge runs semantic LLM-based scoring; verify_citations checks citation grounding; get_traces queries stored traces; delete_trace removes a single trace; list_rules / deploy_rule / delete_rule manage custom evaluation rules. log_trace is the WRITE path that records executions; everything else reads, scores, or manages around it.',
             '',
-            'Behavior. Writes one row to Iris storage (SQLite by default; Postgres in Cloud tier). When IRIS_OTEL_ENDPOINT is set, ALSO fires a best-effort async export to the configured OTLP/HTTP collector (Jaeger, Tempo, Datadog OTLP, OTEL Collector). The OTel export is fire-and-forget — its success does not affect the tool response; failures are logged but the trace is still stored locally. No authentication in stdio mode; HTTP mode requires Bearer token. Rate-limited to 20 req/min on HTTP MCP, unlimited on stdio. Not idempotent: each call mints a fresh trace_id, so resubmitting the same payload creates a duplicate trace.',
+            'Behavior. Writes one row to Iris storage (SQLite by default; Postgres in Cloud tier). When IRIS_OTEL_ENDPOINT is set, ALSO fires a best-effort async export to the configured OTLP/HTTP collector (Jaeger, Tempo, Datadog OTLP, OTEL Collector). The OTel export is fire-and-forget — its success does not affect the tool response; failures are logged but the trace is still stored locally. No authentication in stdio mode. HTTP mode requires a Bearer token ONLY when --api-key / IRIS_API_KEY is set (recommended); with no key configured the auth middleware is a pass-through and writes are unauthenticated — a default HTTP server is protected by its loopback bind (127.0.0.1) and Origin validation, not by a credential. Rate-limited to 20 req/min on HTTP MCP, unlimited on stdio. Not idempotent: each call mints a fresh trace_id, so resubmitting the same payload creates a duplicate trace.',
             '',
             'Output shape. Returns a JSON string: `{ "trace_id": "<32-hex>", "status": "stored" }`. The trace_id is the key you pass to evaluate_output or get_traces afterwards.',
             '',
@@ -72,9 +72,10 @@ export function registerLogTraceTool(server, storage) {
             'Error modes. Throws on missing agent_name. Throws on malformed span or tool_call objects (Zod rejects). Returns 500 on storage failure (disk full, DB locked). Never blocks on the agent — returns within ~50ms for typical payloads.',
         ].join('\n'),
         // Strict at the MCP boundary (unknown args rejected, not stripped).
-        // The dashboard's HTTP ingest builds its own schema FROM this shape
-        // (dashboard/validation.ts) and keeps default stripping there on
-        // purpose — it relies on it to discard a client-supplied trace_id.
+        // The dashboard's HTTP ingest builds its own — equally strict —
+        // schema FROM this shape (dashboard/validation.ts): a client-supplied
+        // trace_id is rejected there with a 400 whose message says the server
+        // mints it, exactly as this tool mints its own in the handler below.
         inputSchema: strictInput(logTraceInputShape),
         annotations: {
             readOnlyHint: false, // Writes a row to storage

package/dist/tools/strict-input.d.ts

@@ -1,2 +1,3 @@
 import { z } from 'zod';
 export declare function strictInput<T extends z.ZodRawShape>(shape: T): z.ZodObject<{ -readonly [P in keyof T]: T[P]; }, z.core.$strict>;
+export declare function strictNested<T extends z.ZodRawShape>(shape: T, container: string): z.ZodObject<{ -readonly [P in keyof T]: T[P]; }, z.core.$strict>;

package/dist/tools/strict-input.js

@@ -33,3 +33,28 @@ export function strictInput(shape) {
             : undefined,
     });
 }
+/*
+ * The same contract ONE LEVEL DOWN, for structured nested objects — a
+ * custom_rules[] entry, deploy_rule's `definition`. Top-level strictness
+ * shipped in 0.5.0 and stopped there, so `custom_rules: [{ name, type,
+ * config, wieght: 5 }]` still parsed cleanly with `wieght` discarded: the
+ * rule ran at the default weight and the score moved for a reason nothing
+ * in the response could show (#376). Free-form record fields (a rule's
+ * `config`, trace `metadata`, span `attributes`) are deliberately NOT
+ * strict — arbitrary keys there are the documented contract.
+ *
+ * `container` names the object in the message ("a custom_rules entry");
+ * the SDK appends the path (`at custom_rules.0`) so the caller sees
+ * exactly which entry to fix.
+ */
+export function strictNested(shape, container) {
+    const validKeys = Object.keys(shape).join(', ');
+    return z.strictObject(shape, {
+        error: (issue) => issue.code === 'unrecognized_keys'
+            ? `Unknown key(s) in ${container}: ${issue.keys.map((k) => `"${k}"`).join(', ')}. ` +
+                `Valid keys: ${validKeys}. ` +
+                'Unknown keys are rejected rather than silently dropped, so a misspelled key ' +
+                'cannot change how the rule scores — check the spelling and retry.'
+            : undefined,
+    });
+}

package/dist/tools/trace-link.d.ts

@@ -0,0 +1,7 @@
+import type { IStorageAdapter } from '../types/query.js';
+import type { EvalResult } from '../types/eval.js';
+import type { TenantId } from '../types/tenant.js';
+export declare function unknownTraceMessage(traceId: string): string;
+export declare function assertTraceExists(storage: IStorageAdapter, tenantId: TenantId, traceId: string): Promise<void>;
+/** insertEvalResult with the foreign-key race translated into the same clear message. */
+export declare function insertLinkedEvalResult(storage: IStorageAdapter, tenantId: TenantId, result: EvalResult): Promise<void>;

package/dist/tools/trace-link.js

@@ -0,0 +1,39 @@
+/*
+ * Linking an evaluation to a trace that does not exist.
+ *
+ * eval_results.trace_id is a foreign key. Passing an unknown trace_id to
+ * evaluate_output used to run the whole evaluation and then fail at the
+ * INSERT with SQLite's own words — "FOREIGN KEY constraint failed" — which
+ * names no field, no value and no fix (#376). Worse for the paid tools:
+ * evaluate_with_llm_judge had already spent the provider call by the time
+ * the insert refused it.
+ *
+ * Two layers, because a check-then-insert has a gap: the pre-check refuses
+ * BEFORE any work (and before any money) with the trace_id named; the
+ * insert wrapper translates the constraint error for the race where the
+ * trace is deleted between the check and the write.
+ */
+export function unknownTraceMessage(traceId) {
+    return (`trace_id "${traceId}" does not match any stored trace, so the evaluation cannot be linked to it. ` +
+        'Nothing was evaluated or written. Pass the trace_id returned by log_trace (or listed by get_traces), ' +
+        'or omit trace_id to store an unlinked evaluation.');
+}
+export async function assertTraceExists(storage, tenantId, traceId) {
+    const trace = await storage.getTrace(tenantId, traceId);
+    if (!trace)
+        throw new Error(unknownTraceMessage(traceId));
+}
+/** insertEvalResult with the foreign-key race translated into the same clear message. */
+export async function insertLinkedEvalResult(storage, tenantId, result) {
+    try {
+        await storage.insertEvalResult(tenantId, result);
+    }
+    catch (err) {
+        const code = err.code;
+        const message = err instanceof Error ? err.message : String(err);
+        if (result.trace_id && (code === 'SQLITE_CONSTRAINT_FOREIGNKEY' || /FOREIGN KEY constraint failed/i.test(message))) {
+            throw new Error(unknownTraceMessage(result.trace_id));
+        }
+        throw err;
+    }
+}

package/dist/tools/verify-citations.d.ts

@@ -1,3 +1,22 @@
 import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import type { IStorageAdapter } from '../types/query.js';
+/**
+ * `passed: true` with `overall_score: null` is the honest answer when there
+ * was nothing to judge (no citations, none resolved). It is NOT the honest
+ * answer when citations resolved and the judge then failed on every one —
+ * a wrong API key, a model the provider refused, a parse failure — because
+ * the caller reads "passed" and ships. That case is an error naming the
+ * cause; nothing is stored. (v0.6.0 acceptance pass, observation 3.)
+ */
+export declare function assertJudgeRan(result: {
+    totalResolved: number;
+    totalJudged: number;
+    citations: ReadonlyArray<{
+        resolveStatus: string;
+        resolveError?: {
+            kind: string;
+            message: string;
+        };
+    }>;
+}): void;
 export declare function registerVerifyCitationsTool(server: McpServer, storage: IStorageAdapter): void;

package/dist/tools/verify-citations.js

@@ -4,6 +4,7 @@ import { verifyCitations } from '../eval/citation-verify/verifier.js';
 import { findPricing } from '../eval/llm-judge/pricing.js';
 import { generateEvalId } from '../utils/ids.js';
 import { strictInput } from './strict-input.js';
+import { assertTraceExists, insertLinkedEvalResult } from './trace-link.js';
 const inputSchema = {
     output: z.string().min(1).describe('The agent output containing citations to verify'),
     model: z
@@ -19,7 +20,7 @@ const inputSchema = {
     max_citations: z.number().int().positive().max(50).optional().describe('Max citations to verify (extras skipped); default 20'),
     per_source_timeout_ms: z.number().int().positive().optional().describe('Per-URL fetch timeout; default 10_000'),
     per_source_max_bytes: z.number().int().positive().optional().describe('Per-URL body cap; default 5MB'),
-    trace_id: z.string().optional().describe('Link verification result to a trace'),
+    trace_id: z.string().optional().describe('Link verification result to a stored trace (id from log_trace / get_traces); an unknown id is rejected before any fetch or judge call'),
 };
 function inferProvider(model) {
     const pricing = findPricing(model);
@@ -48,6 +49,25 @@ function resolveDomainAllowlist(paramValue) {
     }
     return fromEnv.length > 0 ? fromEnv : undefined;
 }
+/**
+ * `passed: true` with `overall_score: null` is the honest answer when there
+ * was nothing to judge (no citations, none resolved). It is NOT the honest
+ * answer when citations resolved and the judge then failed on every one —
+ * a wrong API key, a model the provider refused, a parse failure — because
+ * the caller reads "passed" and ships. That case is an error naming the
+ * cause; nothing is stored. (v0.6.0 acceptance pass, observation 3.)
+ */
+export function assertJudgeRan(result) {
+    if (result.totalResolved === 0 || result.totalJudged > 0)
+        return;
+    const judgeFailures = result.citations.filter((c) => c.resolveStatus === 'ok' && c.resolveError);
+    if (judgeFailures.length === 0)
+        return;
+    const kinds = [...new Set(judgeFailures.map((c) => c.resolveError.kind))].join(', ');
+    const first = judgeFailures[0].resolveError.message;
+    throw new Error(`verify_citations could not judge any of the ${result.totalResolved} resolved citation(s): the judge failed on every one (${kinds}). ` +
+        `Nothing was verified and nothing was stored, so there is no verdict. First error: ${first}`);
+}
 export function registerVerifyCitationsTool(server, storage) {
     server.registerTool('verify_citations', {
         title: 'Verify Citations',
@@ -64,9 +84,9 @@ export function registerVerifyCitationsTool(server, storage) {
             "",
             "Don't use when the agent output has no citations at all (overall_score will be null; the tool degrades gracefully but a heuristic rule is cheaper). Don't use without allow_fetch=true or IRIS_CITATION_ALLOW_FETCH=1 — the tool refuses outbound HTTP unless explicitly enabled. Don't use with an open allowlist + untrusted output on the public internet; you are effectively running a user-directed fetcher. For stricter safety set IRIS_CITATION_DOMAINS to a curated list.",
             '',
-            'Parameters. model is required; provider auto-detected from model name (override only for ambiguous IDs). allow_fetch=false by default — outbound HTTP is REFUSED unless explicitly true OR IRIS_CITATION_ALLOW_FETCH=1 env. domain_allowlist suffix-matches hostnames (e.g., "wikipedia.org" allows en.wikipedia.org); merged with IRIS_CITATION_DOMAINS env (UNION — either source permits). max_citations defaults 20, hard cap 50 (extras are skipped silently, NOT errored — check total_citations_found in the response if precise). max_cost_usd_total defaults $1.00 — the pipeline stops mid-citation when the next judge call would exceed the cap (returns partial verdicts). per_source_timeout_ms defaults 10000 (10s); per_source_max_bytes defaults 5MB (truncates at boundary, judges still run on truncated content). trace_id optional but recommended. Defaults: max_citations=20, max_cost_usd_total=$1.00, per_source_timeout_ms=10000, per_source_max_bytes=5242880, allow_fetch=false.',
+            'Parameters. model is required; provider auto-detected from model name (override only for ambiguous IDs). allow_fetch=false by default — outbound HTTP is REFUSED unless explicitly true OR IRIS_CITATION_ALLOW_FETCH=1 env. domain_allowlist suffix-matches hostnames (e.g., "wikipedia.org" allows en.wikipedia.org); merged with IRIS_CITATION_DOMAINS env (UNION — either source permits). max_citations defaults 20, hard cap 50 (extras are skipped silently, NOT errored — check total_citations_found in the response if precise). max_cost_usd_total defaults $1.00 — the pipeline stops mid-citation when the next judge call would exceed the cap (returns partial verdicts). per_source_timeout_ms defaults 10000 (10s); per_source_max_bytes defaults 5MB (truncates at boundary, judges still run on truncated content); independently of that, the judge reads at most the first 12,000 characters of each fetched source, and the per-citation cost estimate is taken on that truncated prompt, not on the full body. trace_id optional but recommended. Defaults: max_citations=20, max_cost_usd_total=$1.00, per_source_timeout_ms=10000, per_source_max_bytes=5242880, allow_fetch=false.',
             '',
-            'Error modes. Throws when the API key env var is missing. Throws "Unknown model" on unsupported model IDs. Per-citation errors are collected (resolve_error.kind = bad_scheme / ssrf / not_allowed_domain / timeout / too_large / bad_status / redirect_loop / not_text / fetch_disabled / malformed_judge_response / cost_cap_reached / unresolvable_kind) and returned in the response rather than thrown. An empty output or output with zero extractable citations returns overall_score=null + passed=true (nothing to fail).',
+            'Error modes. Throws when the API key env var is missing. Throws "Unknown model" on unsupported model IDs. Throws when trace_id does not match a stored trace (checked before any fetch or judge call; nothing is written). Per-citation errors are collected (resolve_error.kind = bad_scheme / ssrf / not_allowed_domain / timeout / too_large / bad_status / redirect_loop / not_text / fetch_disabled / malformed_judge_response / cost_cap_reached / unresolvable_kind) and returned in the response rather than thrown. An empty output or output with zero extractable citations returns overall_score=null + passed=true (nothing to fail).',
         ].join('\n'),
         inputSchema: strictInput(inputSchema),
         annotations: {
@@ -80,6 +100,10 @@ export function registerVerifyCitationsTool(server, storage) {
         const apiKey = resolveApiKey(provider);
         const allowFetch = resolveAllowFetch(args.allow_fetch);
         const domainAllowlist = resolveDomainAllowlist(args.domain_allowlist);
+        // Refused before any fetch or judge call spends anything (#376).
+        if (args.trace_id) {
+            await assertTraceExists(storage, LOCAL_TENANT, args.trace_id);
+        }
         const result = await verifyCitations({
             output: args.output,
             provider,
@@ -92,12 +116,13 @@ export function registerVerifyCitationsTool(server, storage) {
             perSourceTimeoutMs: args.per_source_timeout_ms,
             perSourceMaxBytes: args.per_source_max_bytes,
         });
+        assertJudgeRan(result);
         const evalId = generateEvalId();
         const score = result.overallScore ?? 0;
         // Persist so dashboard can surface. eval_type='custom' — same
         // rationale as evaluate_with_llm_judge (spans all 4 heuristic
         // categories). rule_results[0] carries per-citation summary.
-        await storage.insertEvalResult(LOCAL_TENANT, {
+        await insertLinkedEvalResult(storage, LOCAL_TENANT, {
             id: evalId,
             trace_id: args.trace_id,
             eval_type: 'custom',
@@ -142,7 +167,19 @@ export function registerVerifyCitationsTool(server, storage) {
                             },
                             resolve_status: c.resolveStatus,
                             resolve_error: c.resolveError,
-                            source: c.source,
+                            // Mapped to the documented snake_case keys. The verifier's
+                            // internal shape is camelCase (contentType, bytesFetched) and
+                            // used to be passed through verbatim, so a client parsing
+                            // `source.content_type` per the description read undefined.
+                            source: c.source
+                                ? {
+                                    url: c.source.url,
+                                    status: c.source.status,
+                                    content_type: c.source.contentType,
+                                    bytes_fetched: c.source.bytesFetched,
+                                    truncated: c.source.truncated,
+                                }
+                                : undefined,
                             judge: c.judge
                                 ? {
                                     supported: c.judge.supported,

package/dist/types/decision-moment.d.ts

@@ -69,6 +69,14 @@ export interface DecisionMomentDetail extends DecisionMoment {
             skipReason?: string;
         }>;
         suggestions: string[];
+        /**
+         * Rules that HARD-FAILED this evaluation — a critical safety rule
+         * (no_pii / no_injection_patterns / no_blocklist_words) or a deployed
+         * rule with severity high/critical. Present only when the veto fired;
+         * absent means nothing vetoed, or the row predates migration 006. This
+         * is what lets a surface distinguish "vetoed" from "scored low".
+         */
+        criticalFailures?: string[];
         createdAt?: string;
     }>;
     /** Full input (uncompressed). */

package/dist/types/eval.d.ts

@@ -1,4 +1,12 @@
 export type EvalType = 'completeness' | 'relevance' | 'safety' | 'cost' | 'custom';
+/**
+ * What an EvalResult can be tagged as: a single bundle (EvalType), or
+ * 'all' — evaluate_output's eval_type="all", which runs every bundle in one
+ * pass and reports a per-category breakdown beside the overall verdict.
+ * Kept apart from EvalType on purpose: rules are deployed and registered
+ * under a real bundle, never under 'all'.
+ */
+export type EvalResultType = EvalType | 'all';
 export interface EvalRule {
     name: string;
     description: string;
@@ -49,6 +57,20 @@ export interface EvalContext {
 }
 export interface EvalRuleResult {
     ruleName: string;
+    /**
+     * Deployed rule id (rule-<hex>) when the rule came from the custom-rule
+     * store. Absent for built-in rules and for inline custom_rules. Names are
+     * not unique — a same-name redeploy with replace:true mints a new id, and
+     * stores written before the same-name guard may hold duplicates — so this
+     * is the field that tells two same-named results apart (#373).
+     */
+    ruleId?: string;
+    /**
+     * The bundle this rule belongs to. Present only on eval_type="all"
+     * results, where rule_results spans every bundle and a reader needs to
+     * regroup them.
+     */
+    category?: EvalType;
     passed: boolean;
     score: number;
     message: string;
@@ -57,10 +79,24 @@ export interface EvalRuleResult {
     configInvalid?: boolean;
     budgetExceeded?: boolean;
 }
+/**
+ * Per-bundle verdict inside an eval_type="all" result. Same semantics as a
+ * single-bundle EvalResult (threshold + critical veto), computed over that
+ * bundle's rules only.
+ */
+export interface EvalCategoryResult {
+    score: number;
+    passed: boolean;
+    rules_evaluated: number;
+    rules_skipped: number;
+    insufficient_data: boolean;
+    critical_failures?: string[];
+    critical_skipped?: string[];
+}
 export interface EvalResult {
     id: string;
     trace_id?: string;
-    eval_type: EvalType;
+    eval_type: EvalResultType;
     output_text: string;
     expected_text?: string;
     score: number;
@@ -78,6 +114,29 @@ export interface EvalResult {
      * "committed a hard violation".
      */
     critical_failures?: string[];
+    /**
+     * Names of critical rules that were SKIPPED and therefore did not judge
+     * this output (present only when non-empty). Almost always a sandbox
+     * budget breach — a regex killed mid-backtrack, which an adversary can
+     * provoke deliberately by crafting output that stalls a known pattern.
+     *
+     * This is the fail-open seam between the release's two headline features:
+     * a budget-killed critical rule does NOT veto, so the evaluation can
+     * return passed=true with no `critical_failures` at all. That is
+     * deliberate (failing closed would let the same adversary force false
+     * violations on benign output), but a consumer that must fail closed
+     * needs to see it WITHOUT walking rule_results[].budgetExceeded. Treat a
+     * non-empty `critical_skipped` as "unknown", not as "clean".
+     */
+    critical_skipped?: string[];
+    /**
+     * Per-bundle breakdown, present only when eval_type is 'all'. Keyed by
+     * bundle; a bundle with no rules at all (nothing deployed under "custom"
+     * and no inline custom_rules) is absent rather than reported as
+     * insufficient. Response-only — not persisted as a column; the stored
+     * rule_results carry a `category` per rule so a reader can regroup.
+     */
+    categories?: Partial<Record<EvalType, EvalCategoryResult>>;
 }
 export type CustomRuleType = 'regex_match' | 'regex_no_match' | 'min_length' | 'max_length' | 'contains_keywords' | 'excludes_keywords' | 'json_schema' | 'cost_threshold';
 export interface CustomRuleDefinition {

package/dist/types/index.d.ts

@@ -1,5 +1,5 @@
 export type { SpanKind, SpanStatus, SpanEvent, ToolCallRecord, TokenUsage, Span, Trace, } from './trace.js';
-export type { EvalType, EvalRule, EvalContext, EvalRuleResult, EvalResult, CustomRuleType, CustomRuleDefinition, } from './eval.js';
+export type { EvalType, EvalResultType, EvalRule, EvalContext, EvalRuleResult, EvalResult, EvalCategoryResult, CustomRuleType, CustomRuleDefinition, } from './eval.js';
 export type { TraceFilter, TraceQueryOptions, TraceQueryResult, DashboardSummary, EvalStatsPeriod, EvalStats, EvalStatsTrendBucket, EvalStatsRuleBreakdown, EvalStatsFailure, IStorageAdapter, } from './query.js';
 export type { IrisConfig } from './config.js';
 export type { TenantId } from './tenant.js';

package/dist/types/query.d.ts

@@ -95,6 +95,31 @@ export interface IStorageAdapter {
     }>;
     getDashboardSummary(tenantId: TenantId, sinceHours?: number): Promise<DashboardSummary>;
     deleteTracesOlderThan(tenantId: TenantId, days: number): Promise<number>;
+    /**
+     * Retention twin of deleteTracesOlderThan for eval_results (#372).
+     * Deleting a trace only NULLs the trace_id on its evaluations (FK ON
+     * DELETE SET NULL), so every eval row — output_text verbatim, including
+     * whatever no_pii flagged — outlived the retention window until this
+     * existed. Cutoff is on created_at.
+     */
+    deleteEvalResultsOlderThan(tenantId: TenantId, days: number): Promise<number>;
+    /**
+     * Delete EVERY trace, span and eval result for the tenant, then compact
+     * the database so the deleted text does not linger in free pages or in
+     * the write-ahead log. Returns what was removed. Deployed rules, the
+     * audit log and preferences are not storage rows and are untouched.
+     */
+    purge(tenantId: TenantId): Promise<{
+        traces: number;
+        evalResults: number;
+    }>;
+    /**
+     * Fold the write-ahead log into the main file and truncate it
+     * (wal_checkpoint TRUNCATE). Best-effort; called after a retention sweep
+     * so rows deleted at startup do not survive as readable text in
+     * iris.db-wal.
+     */
+    checkpoint(): Promise<void>;
     /**
      * Delete a single trace by id. Cascades to spans via FK ON DELETE
      * CASCADE; eval_results get their trace_id set to NULL (so score

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@iris-eval/mcp-server",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Stop shipping agents on vibes. Score every agent output for quality, safety, and cost.",
   "mcpName": "io.github.iris-eval/mcp-server",
   "type": "module",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/iris-eval/mcp-server",
     "source": "github"
   },
-  "version": "0.5.0",
+  "version": "0.6.0",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@iris-eval/mcp-server",
-      "version": "0.5.0",
+      "version": "0.6.0",
       "transport": {
         "type": "stdio"
       },