@mcpdesc/validator 0.10.1 → 0.11.1

package/CHANGELOG.md

@@ -8,6 +8,31 @@ Dates for published releases are the UTC publication dates recorded by npm.
 
 ## [Unreleased]
 
+## [0.11.1] - 2026-09-08
+
+### Fixed
+
+- Added terminal-target provenance to RC.4 component reference resolution and
+	enabled RC.4 through the public resolver. This is an approved additive
+	tooling-metadata correction; schemas, conformance results, diagnostics, and
+	frozen fixtures are unchanged.
+
+## [0.11.0] - 2026-09-08
+
+### Added
+
+- Added the immutable `0.8.0-rc.4` selector, including protocol-independent
+	root info metadata behavior and its frozen conformance fixture corpus.
+
+### Changed
+
+- Narrowed active runtime support to RC.3 and RC.4, deprecated RC.3, and removed
+	RC.2 from current registries, declarations, generated bundles, and package
+	contents while retaining its immutable source and fixtures in Git.
+- Kept component reference resolution on RC.3 because RC.4's snapshot resolver
+	does not expose the terminal-target provenance required by the public result
+	contract.
+
 ## [0.10.1] - 2026-09-07
 
 ### Changed
@@ -139,7 +164,9 @@ Dates for published releases are the UTC publication dates recorded by npm.
 - Added synchronous structural and semantic validation for parsed JavaScript values with deterministic diagnostics and exact selector dispatch.
 - Added ESM browser support, TypeScript declarations, embedded schema provenance, frozen fixtures, and package-content checks.
 
-[Unreleased]: https://github.com/mcpdesc/core/compare/validator-v0.10.1...HEAD
+[Unreleased]: https://github.com/mcpdesc/core/compare/validator-v0.11.1...HEAD
+[0.11.1]: https://github.com/mcpdesc/core/compare/validator-v0.11.0...validator-v0.11.1
+[0.11.0]: https://github.com/mcpdesc/core/compare/validator-v0.10.1...validator-v0.11.0
 [0.10.1]: https://github.com/mcpdesc/core/compare/validator-v0.10.0...validator-v0.10.1
 [0.10.0]: https://github.com/mcpdesc/core/compare/validator-v0.9.0...validator-v0.10.0
 [0.9.0]: https://github.com/mcpdesc/core/compare/validator-v0.8.0...validator-v0.9.0

package/README.md

@@ -25,7 +25,7 @@ npm install @mcpdesc/validator
 import { validateMcpDescription } from '@mcpdesc/validator';
 
 const result = validateMcpDescription(parsedDocument, {
-  specification: '0.8.0-rc.2',
+  specification: '0.8.0-rc.4',
 });
 
 for (const diagnostic of result.diagnostics) {
@@ -48,15 +48,18 @@ The package supports these immutable selectors, newest first:
 
 | Selector | First validator release | Embedded schema SHA-256 |
 |---|---|---|
-| `0.8.0-rc.3` | `0.10.0` | `a9c3ff77ba37c72362909f538f6e957d055e6fdb372f8b3d529e3651af3fecf4` |
-| `0.8.0-rc.2` (deprecated) | `0.9.0` | `40f6775dde052224114e91d6aa484d826eecf56b77f7ac87b4cf707ffbcb6ce8` |
+| `0.8.0-rc.4` | `0.11.0` | `d38e54db859813b63be2a5c91dde91250035f18bcb5910208cf71fa6875d6eef` |
+| `0.8.0-rc.3` (deprecated) | `0.10.0` | `a9c3ff77ba37c72362909f538f6e957d055e6fdb372f8b3d529e3651af3fecf4` |
 
 The validator package embeds the schema and executable behavior for each
-selector. RC.2 remains available for migration compatibility; new integrations
-should select RC.3. Earlier selectors remain available by pinning an older
+selector. RC.3 remains available for migration compatibility; new integrations
+should select RC.4. Earlier selectors remain available by pinning an older
 immutable validator release. npm integrity and trusted-publishing provenance identify released
 package bytes; specification repository tags and commits are informational.
 
+Component reference resolution is available for RC.3 and RC.4 with
+terminal-target provenance for each authored reference.
+
 ## Usage
 
 The `options` argument and exact `specification` selector are required. The unqualified selector `0.8.0` is intentionally unsupported because draft and release-candidate iterations are immutable compatibility contracts.
@@ -127,20 +130,19 @@ Structural paths start with AJV's instance path. A `required` error appends its
 
 ## Support metadata
 
-The package exports frozen `supportedSpecifications`, `deprecatedSpecifications`, `supportedProtocolVersions`, and `specificationProvenance` values. Provenance records include the snapshot tag, recorded schema URI, and embedded schema SHA-256 digest. Public validation dispatches through a registry keyed by exact specification selectors. The active selector set is `0.8.0-rc.2` and `0.8.0-rc.3`; `deprecatedSpecifications` contains RC.2. The protocol-version export is the deduplicated union supported by active snapshots.
+The package exports frozen `supportedSpecifications`, `deprecatedSpecifications`, `supportedProtocolVersions`, and `specificationProvenance` values. Provenance records include the snapshot tag, recorded schema URI, and embedded schema SHA-256 digest. Public validation dispatches through a registry keyed by exact specification selectors. The active selector set is `0.8.0-rc.3` and `0.8.0-rc.4`; `deprecatedSpecifications` contains RC.3. The protocol-version export is the deduplicated union supported by active snapshots.
 
-RC.2 and RC.3 also export the frozen `mcpExtensionCatalogue` and
-`mcpExtensionMaturity` classifier. The catalogue pins its authoritative source,
-effective date, and official or experimental identifier assignments. Catalogue
-recognition establishes authority and maturity only; it does not validate
-extension-specific settings.
+The package also exports the frozen `mcpExtensionCatalogue` and
+`mcpExtensionMaturity` classifier pinned by the RC.3 snapshot. The catalogue
+records its authoritative source, effective date, and official or experimental
+identifier assignments. Catalogue recognition establishes authority and
+maturity only; it does not validate extension-specific settings.
 
 npm package SemVer tracks implementation releases independently from specification snapshot identity. Adding a later snapshot is additive: it must use a sibling implementation and selector rather than changing an existing snapshot's schema, semantics, metadata, fixtures, or results.
 
-The RC.2 and RC.3 component resolvers report authored and terminal target
-paths for successful substitutions. The additive tooling corrections do not
-change snapshot schemas, validation results, diagnostics, or fixtures and are
-recorded in the integrity manifest.
+The RC.3 and RC.4 component resolvers report authored and terminal target paths
+for successful substitutions. Additive tooling corrections that provide this
+metadata are recorded explicitly in the integrity manifest.
 
 The runtime bundles its schema, performs no network fetches for external schema references, and imports no Node.js built-ins. Unresolved external Tool-schema references produce incomplete-validation warnings and are preserved. All three ESM entry points support Node.js 20 or later and browser bundlers.
 

package/index.d.ts

@@ -1,4 +1,4 @@
-export type McpDescriptionSpecification = '0.8.0-rc.2' | '0.8.0-rc.3';
+export type McpDescriptionSpecification = '0.8.0-rc.3' | '0.8.0-rc.4';
 
 export type SupportedProtocolVersion =
   | '2024-11-05'
@@ -38,7 +38,7 @@ export interface McpDescriptionComponentResolutionResult {
 }
 
 export interface ResolveMcpDescriptionComponentReferencesOptions {
-  readonly specification: '0.8.0-rc.2' | '0.8.0-rc.3';
+  readonly specification: '0.8.0-rc.3' | '0.8.0-rc.4';
 }
 
 export type McpExtensionMaturity = 'official' | 'experimental' | 'uncatalogued';
@@ -56,16 +56,16 @@ export interface McpExtensionCatalogue {
 }
 
 export interface SpecificationProvenance {
-  readonly '0.8.0-rc.2': {
-    readonly snapshotTag: 'v0.8.0-rc.2';
-    readonly schemaUri: 'https://mcpdesc.org/schema/mcp-description/0.8.0-rc.2.json';
-    readonly schemaSha256: '40f6775dde052224114e91d6aa484d826eecf56b77f7ac87b4cf707ffbcb6ce8';
-  };
   readonly '0.8.0-rc.3': {
     readonly snapshotTag: 'v0.8.0-rc.3';
     readonly schemaUri: 'https://mcpdesc.org/schema/mcp-description/0.8.0-rc.3.json';
     readonly schemaSha256: 'a9c3ff77ba37c72362909f538f6e957d055e6fdb372f8b3d529e3651af3fecf4';
   };
+  readonly '0.8.0-rc.4': {
+    readonly snapshotTag: 'v0.8.0-rc.4';
+    readonly schemaUri: 'https://mcpdesc.org/schema/mcp-description/0.8.0-rc.4.json';
+    readonly schemaSha256: 'd38e54db859813b63be2a5c91dde91250035f18bcb5910208cf71fa6875d6eef';
+  };
 }
 
 export interface ResolveMcpDescriptionSpecificationOptions {
@@ -89,8 +89,8 @@ export type McpDescriptionSpecificationResolution =
   | ResolvedMcpDescriptionSpecification
   | UnresolvedMcpDescriptionSpecification;
 
-export declare const supportedSpecifications: readonly ['0.8.0-rc.2', '0.8.0-rc.3'];
-export declare const deprecatedSpecifications: readonly ['0.8.0-rc.2'];
+export declare const supportedSpecifications: readonly ['0.8.0-rc.3', '0.8.0-rc.4'];
+export declare const deprecatedSpecifications: readonly ['0.8.0-rc.3'];
 
 export declare const supportedProtocolVersions: readonly [
   '2024-11-05',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcpdesc/validator",
-  "version": "0.10.1",
+  "version": "0.11.1",
   "description": "Structural and semantic validation for MCP Description snapshots",
   "type": "module",
   "types": "./index.d.ts",
@@ -31,8 +31,8 @@
   },
   "files": [
     "src/index.js",
-    "src/snapshots/0.8.0-rc.2",
     "src/snapshots/0.8.0-rc.3",
+    "src/snapshots/0.8.0-rc.4",
     "standalone.js",
     "index.d.ts",
     "CHANGELOG.md",

package/src/index.js

@@ -1,31 +1,31 @@
-import * as rc2 from './snapshots/0.8.0-rc.2/index.js';
 import * as rc3 from './snapshots/0.8.0-rc.3/index.js';
-import { resolveComponentReferences as resolveRc2ComponentReferences } from './snapshots/0.8.0-rc.2/semantic.js';
+import * as rc4 from './snapshots/0.8.0-rc.4/index.js';
 import { resolveComponentReferences as resolveRc3ComponentReferences } from './snapshots/0.8.0-rc.3/semantic.js';
+import { resolveComponentReferences as resolveRc4ComponentReferences } from './snapshots/0.8.0-rc.4/semantic.js';
 import {
   mcpExtensionCatalogue,
   mcpExtensionMaturity
-} from './snapshots/0.8.0-rc.2/semantic.js';
+} from './snapshots/0.8.0-rc.3/semantic.js';
 
 export { mcpExtensionCatalogue, mcpExtensionMaturity };
 
 const snapshots = Object.freeze({
-  [rc2.specification]: rc2,
-  [rc3.specification]: rc3
+  [rc3.specification]: rc3,
+  [rc4.specification]: rc4
 });
 
 const componentResolvers = Object.freeze({
-  '0.8.0-rc.2': resolveRc2ComponentReferences,
-  '0.8.0-rc.3': resolveRc3ComponentReferences
+  '0.8.0-rc.3': resolveRc3ComponentReferences,
+  '0.8.0-rc.4': resolveRc4ComponentReferences
 });
 
 const schemaUris = Object.freeze({
-  '0.8.0-rc.2': 'https://mcpdesc.org/schema/mcp-description/0.8.0-rc.2.json',
-  '0.8.0-rc.3': 'https://mcpdesc.org/schema/mcp-description/0.8.0-rc.3.json'
+  '0.8.0-rc.3': 'https://mcpdesc.org/schema/mcp-description/0.8.0-rc.3.json',
+  '0.8.0-rc.4': 'https://mcpdesc.org/schema/mcp-description/0.8.0-rc.4.json'
 });
 
 export const supportedSpecifications = Object.freeze(Object.keys(snapshots));
-export const deprecatedSpecifications = Object.freeze(['0.8.0-rc.2']);
+export const deprecatedSpecifications = Object.freeze(['0.8.0-rc.3']);
 export const supportedProtocolVersions = Object.freeze([
   ...new Set(Object.values(snapshots).flatMap((snapshot) => snapshot.supportedProtocolVersions))
 ]);

package/src/snapshots/{0.8.0-rc.2 → 0.8.0-rc.4}/base.js

@@ -691,11 +691,6 @@ function validateVersionSpecificSemantics(document, rel, diagnostics) {
     }
   }
 
-  checkMinimumVersion('info', ['info'], document.info ?? {}, 'title', '2025-06-18', rootScope);
-  checkMinimumVersion('info', ['info'], document.info ?? {}, 'description', '2025-11-25', rootScope);
-  checkMinimumVersion('info', ['info'], document.info ?? {}, 'icons', '2025-11-25', rootScope);
-  checkMinimumVersion('info', ['info'], document.info ?? {}, 'websiteUrl', '2025-11-25', rootScope);
-
   (document.transports ?? []).forEach((transport, index) => {
     const scope = effectiveScope(document, transport, rootScope);
     if (transport.type === 'streamable-http') {

package/src/snapshots/{0.8.0-rc.2 → 0.8.0-rc.4}/index.js

@@ -3,9 +3,9 @@ import {
   validateMcpdesc08Document
 } from './semantic.js';
 
-export const specification = '0.8.0-rc.2';
-export const snapshotTag = 'v0.8.0-rc.2';
-export const schemaSha256 = '40f6775dde052224114e91d6aa484d826eecf56b77f7ac87b4cf707ffbcb6ce8';
+export const specification = '0.8.0-rc.4';
+export const snapshotTag = 'v0.8.0-rc.4';
+export const schemaSha256 = 'd38e54db859813b63be2a5c91dde91250035f18bcb5910208cf71fa6875d6eef';
 export { supportedProtocolVersions };
 
 export function validate(document) {

package/src/snapshots/{0.8.0-rc.2 → 0.8.0-rc.4}/schema.json

@@ -1,8 +1,8 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://mcpdesc.org/schema/mcp-description/0.8.0-rc.2.json",
-  "title": "MCP Description",
-  "description": "MCP Description 0.8.0 Release Candidate 2 (v0.8.0-rc.2; prerelease).",
+  "$id": "https://mcpdesc.org/schema/mcp-description/0.8.0-rc.4.json",
+  "title": "MCP Server Description (mcpdesc format)",
+  "description": "A static, curated description of what an MCP server offers. Uses MCP-native terminology, an OpenAPI-aligned info and security structure, and support for multiple transports, protocol revisions, and specification extensions. Supports MCP protocol revisions 2024-11-05, 2025-03-26, 2025-06-18, 2025-11-25, and 2026-07-28.",
   "type": "object",
   "required": [
     "mcpdesc",

package/src/snapshots/{0.8.0-rc.2 → 0.8.0-rc.4}/semantic.js

@@ -1,4 +1,4 @@
-// Validate the immutable 0.8.0-rc.2 snapshot using only snapshot-local artifacts.
+// Validate the immutable 0.8.0-rc.4 snapshot using only snapshot-local artifacts.
 
 import Ajv from 'ajv';
 import Ajv2020 from 'ajv/dist/2020.js';