@mcpdesc/validator 0.11.0 → 0.12.0-rc.1

package/CHANGELOG.md

@@ -8,6 +8,28 @@ Dates for published releases are the UTC publication dates recorded by npm.
 
 ## [Unreleased]
 
+## [0.12.0-rc.1] - 2026-09-09
+
+### Added
+
+- Added the immutable stable `0.8.0` selector, its frozen conformance fixtures,
+  and component reference resolution with terminal-target provenance.
+
+### Changed
+
+- Advanced active runtime support to RC.4 and stable `0.8.0`, deprecated RC.4,
+  and retired RC.3 from current registries, declarations, bundles, and package
+  contents while retaining its immutable source and fixtures in Git.
+
+## [0.11.1] - 2026-09-08
+
+### Fixed
+
+- Added terminal-target provenance to RC.4 component reference resolution and
+	enabled RC.4 through the public resolver. This is an approved additive
+	tooling-metadata correction; schemas, conformance results, diagnostics, and
+	frozen fixtures are unchanged.
+
 ## [0.11.0] - 2026-09-08
 
 ### Added
@@ -31,8 +53,6 @@ Dates for published releases are the UTC publication dates recorded by npm.
 - Narrowed active runtime support to RC.2 and RC.3 and marked RC.2 deprecated.
 - Excluded retired runtime snapshots from generated bundles and package
 	contents while retaining their source and frozen fixtures in Git.
-- Removed the retained snapshot-intake manifest; intake bundles are disposable
-	inputs and imported bytes remain protected by the snapshot integrity manifest.
 
 ## [0.10.0] - 2026-09-07
 
@@ -96,10 +116,9 @@ Dates for published releases are the UTC publication dates recorded by npm.
 
 ### Changed
 
-- Moved package maintenance and publication from the MCP Description
-	specification repository to the MCP Description tooling repository without
-	changing public APIs, immutable snapshots, diagnostics, or validation
-	behavior.
+- Updated shipped repository metadata and provenance files to identify the MCP
+	Description tooling repository as the package maintenance location. Public
+	APIs, immutable snapshots, diagnostics, and validation behavior are unchanged.
 
 ## [0.6.0] - 2026-09-02
 
@@ -155,7 +174,9 @@ Dates for published releases are the UTC publication dates recorded by npm.
 - Added synchronous structural and semantic validation for parsed JavaScript values with deterministic diagnostics and exact selector dispatch.
 - Added ESM browser support, TypeScript declarations, embedded schema provenance, frozen fixtures, and package-content checks.
 
-[Unreleased]: https://github.com/mcpdesc/core/compare/validator-v0.11.0...HEAD
+[Unreleased]: https://github.com/mcpdesc/core/compare/validator-v0.12.0-rc.1...HEAD
+[0.12.0-rc.1]: https://github.com/mcpdesc/core/compare/validator-v0.11.1...validator-v0.12.0-rc.1
+[0.11.1]: https://github.com/mcpdesc/core/compare/validator-v0.11.0...validator-v0.11.1
 [0.11.0]: https://github.com/mcpdesc/core/compare/validator-v0.10.1...validator-v0.11.0
 [0.10.1]: https://github.com/mcpdesc/core/compare/validator-v0.10.0...validator-v0.10.1
 [0.10.0]: https://github.com/mcpdesc/core/compare/validator-v0.9.0...validator-v0.10.0

package/README.md

@@ -10,7 +10,7 @@ snapshots. The package:
 
 Use it when accepting, generating, migrating, or transforming MCP Description
 documents and you need to know whether the result conforms to a specific
-published draft or release candidate. It validates MCP Description documents,
+published draft, release candidate, or stable version. It validates MCP Description documents,
 not live MCP servers or MCP protocol messages.
 
 ## Install
@@ -25,7 +25,7 @@ npm install @mcpdesc/validator
 import { validateMcpDescription } from '@mcpdesc/validator';
 
 const result = validateMcpDescription(parsedDocument, {
-  specification: '0.8.0-rc.4',
+  specification: '0.8.0',
 });
 
 for (const diagnostic of result.diagnostics) {
@@ -48,22 +48,23 @@ The package supports these immutable selectors, newest first:
 
 | Selector | First validator release | Embedded schema SHA-256 |
 |---|---|---|
-| `0.8.0-rc.4` | `0.11.0` | `d38e54db859813b63be2a5c91dde91250035f18bcb5910208cf71fa6875d6eef` |
-| `0.8.0-rc.3` (deprecated) | `0.10.0` | `a9c3ff77ba37c72362909f538f6e957d055e6fdb372f8b3d529e3651af3fecf4` |
+| `0.8.0` | `0.12.0-rc.1` | `36686f92ba0cc98bde2c34eaad31c0304d6e5cebdd2c4d2be1be06aecef41119` |
+| `0.8.0-rc.4` (deprecated) | `0.11.0` | `d38e54db859813b63be2a5c91dde91250035f18bcb5910208cf71fa6875d6eef` |
 
 The validator package embeds the schema and executable behavior for each
-selector. RC.3 remains available for migration compatibility; new integrations
-should select RC.4. Earlier selectors remain available by pinning an older
+selector. RC.4 remains available for migration compatibility; new integrations
+should select stable `0.8.0`. Earlier selectors remain available by pinning an older
 immutable validator release. npm integrity and trusted-publishing provenance identify released
 package bytes; specification repository tags and commits are informational.
 
-Component reference resolution remains available for RC.3. RC.4 validation is
-supported, but its snapshot resolver does not expose the terminal-target
-provenance required by the package's public resolution result contract.
+Component reference resolution is available for RC.4 and stable `0.8.0` with
+terminal-target provenance for each authored reference.
 
 ## Usage
 
-The `options` argument and exact `specification` selector are required. The unqualified selector `0.8.0` is intentionally unsupported because draft and release-candidate iterations are immutable compatibility contracts.
+The `options` argument and exact `specification` selector are required. Stable,
+draft, and release-candidate selectors remain distinct immutable compatibility
+contracts.
 
 ### Entry points
 
@@ -131,19 +132,19 @@ Structural paths start with AJV's instance path. A `required` error appends its
 
 ## Support metadata
 
-The package exports frozen `supportedSpecifications`, `deprecatedSpecifications`, `supportedProtocolVersions`, and `specificationProvenance` values. Provenance records include the snapshot tag, recorded schema URI, and embedded schema SHA-256 digest. Public validation dispatches through a registry keyed by exact specification selectors. The active selector set is `0.8.0-rc.3` and `0.8.0-rc.4`; `deprecatedSpecifications` contains RC.3. The protocol-version export is the deduplicated union supported by active snapshots.
+The package exports frozen `supportedSpecifications`, `deprecatedSpecifications`, `supportedProtocolVersions`, and `specificationProvenance` values. Provenance records include the snapshot tag, recorded schema URI, and embedded schema SHA-256 digest. Public validation dispatches through a registry keyed by exact specification selectors. The active selector set is `0.8.0-rc.4` and `0.8.0`; `deprecatedSpecifications` contains RC.4. The protocol-version export is the deduplicated union supported by active snapshots.
 
 The package also exports the frozen `mcpExtensionCatalogue` and
-`mcpExtensionMaturity` classifier pinned by the RC.3 snapshot. The catalogue
+`mcpExtensionMaturity` classifier pinned by the stable snapshot. The catalogue
 records its authoritative source, effective date, and official or experimental
 identifier assignments. Catalogue recognition establishes authority and
 maturity only; it does not validate extension-specific settings.
 
 npm package SemVer tracks implementation releases independently from specification snapshot identity. Adding a later snapshot is additive: it must use a sibling implementation and selector rather than changing an existing snapshot's schema, semantics, metadata, fixtures, or results.
 
-The RC.3 component resolver reports authored and terminal target paths for
-successful substitutions. RC.4 component resolution is unavailable because its
-snapshot resolver does not expose that provenance result.
+The RC.4 and stable component resolvers report authored and terminal target paths
+for successful substitutions. Additive tooling corrections that provide this
+metadata are recorded explicitly in the integrity manifest.
 
 The runtime bundles its schema, performs no network fetches for external schema references, and imports no Node.js built-ins. Unresolved external Tool-schema references produce incomplete-validation warnings and are preserved. All three ESM entry points support Node.js 20 or later and browser bundlers.
 

package/index.d.ts

@@ -1,4 +1,4 @@
-export type McpDescriptionSpecification = '0.8.0-rc.3' | '0.8.0-rc.4';
+export type McpDescriptionSpecification = '0.8.0-rc.4' | '0.8.0';
 
 export type SupportedProtocolVersion =
   | '2024-11-05'
@@ -38,7 +38,7 @@ export interface McpDescriptionComponentResolutionResult {
 }
 
 export interface ResolveMcpDescriptionComponentReferencesOptions {
-  readonly specification: '0.8.0-rc.3';
+  readonly specification: '0.8.0-rc.4' | '0.8.0';
 }
 
 export type McpExtensionMaturity = 'official' | 'experimental' | 'uncatalogued';
@@ -56,16 +56,16 @@ export interface McpExtensionCatalogue {
 }
 
 export interface SpecificationProvenance {
-  readonly '0.8.0-rc.3': {
-    readonly snapshotTag: 'v0.8.0-rc.3';
-    readonly schemaUri: 'https://mcpdesc.org/schema/mcp-description/0.8.0-rc.3.json';
-    readonly schemaSha256: 'a9c3ff77ba37c72362909f538f6e957d055e6fdb372f8b3d529e3651af3fecf4';
-  };
   readonly '0.8.0-rc.4': {
     readonly snapshotTag: 'v0.8.0-rc.4';
     readonly schemaUri: 'https://mcpdesc.org/schema/mcp-description/0.8.0-rc.4.json';
     readonly schemaSha256: 'd38e54db859813b63be2a5c91dde91250035f18bcb5910208cf71fa6875d6eef';
   };
+  readonly '0.8.0': {
+    readonly snapshotTag: 'v0.8.0';
+    readonly schemaUri: 'https://mcpdesc.org/schema/mcp-description/0.8.0.json';
+    readonly schemaSha256: '36686f92ba0cc98bde2c34eaad31c0304d6e5cebdd2c4d2be1be06aecef41119';
+  };
 }
 
 export interface ResolveMcpDescriptionSpecificationOptions {
@@ -89,8 +89,8 @@ export type McpDescriptionSpecificationResolution =
   | ResolvedMcpDescriptionSpecification
   | UnresolvedMcpDescriptionSpecification;
 
-export declare const supportedSpecifications: readonly ['0.8.0-rc.3', '0.8.0-rc.4'];
-export declare const deprecatedSpecifications: readonly ['0.8.0-rc.3'];
+export declare const supportedSpecifications: readonly ['0.8.0-rc.4', '0.8.0'];
+export declare const deprecatedSpecifications: readonly ['0.8.0-rc.4'];
 
 export declare const supportedProtocolVersions: readonly [
   '2024-11-05',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcpdesc/validator",
-  "version": "0.11.0",
+  "version": "0.12.0-rc.1",
   "description": "Structural and semantic validation for MCP Description snapshots",
   "type": "module",
   "types": "./index.d.ts",
@@ -31,8 +31,8 @@
   },
   "files": [
     "src/index.js",
-    "src/snapshots/0.8.0-rc.3",
     "src/snapshots/0.8.0-rc.4",
+    "src/snapshots/0.8.0",
     "standalone.js",
     "index.d.ts",
     "CHANGELOG.md",

package/src/index.js

@@ -1,29 +1,31 @@
-import * as rc3 from './snapshots/0.8.0-rc.3/index.js';
 import * as rc4 from './snapshots/0.8.0-rc.4/index.js';
-import { resolveComponentReferences as resolveRc3ComponentReferences } from './snapshots/0.8.0-rc.3/semantic.js';
+import * as stable from './snapshots/0.8.0/index.js';
+import { resolveComponentReferences as resolveRc4ComponentReferences } from './snapshots/0.8.0-rc.4/semantic.js';
+import { resolveComponentReferences as resolveStableComponentReferences } from './snapshots/0.8.0/semantic.js';
 import {
   mcpExtensionCatalogue,
   mcpExtensionMaturity
-} from './snapshots/0.8.0-rc.3/semantic.js';
+} from './snapshots/0.8.0/semantic.js';
 
 export { mcpExtensionCatalogue, mcpExtensionMaturity };
 
 const snapshots = Object.freeze({
-  [rc3.specification]: rc3,
-  [rc4.specification]: rc4
+  [rc4.specification]: rc4,
+  [stable.specification]: stable
 });
 
 const componentResolvers = Object.freeze({
-  '0.8.0-rc.3': resolveRc3ComponentReferences
+  '0.8.0-rc.4': resolveRc4ComponentReferences,
+  '0.8.0': resolveStableComponentReferences
 });
 
 const schemaUris = Object.freeze({
-  '0.8.0-rc.3': 'https://mcpdesc.org/schema/mcp-description/0.8.0-rc.3.json',
-  '0.8.0-rc.4': 'https://mcpdesc.org/schema/mcp-description/0.8.0-rc.4.json'
+  '0.8.0-rc.4': 'https://mcpdesc.org/schema/mcp-description/0.8.0-rc.4.json',
+  '0.8.0': 'https://mcpdesc.org/schema/mcp-description/0.8.0.json'
 });
 
 export const supportedSpecifications = Object.freeze(Object.keys(snapshots));
-export const deprecatedSpecifications = Object.freeze(['0.8.0-rc.3']);
+export const deprecatedSpecifications = Object.freeze(['0.8.0-rc.4']);
 export const supportedProtocolVersions = Object.freeze([
   ...new Set(Object.values(snapshots).flatMap((snapshot) => snapshot.supportedProtocolVersions))
 ]);

package/src/snapshots/{0.8.0-rc.3 → 0.8.0}/base.js

@@ -691,11 +691,6 @@ function validateVersionSpecificSemantics(document, rel, diagnostics) {
     }
   }
 
-  checkMinimumVersion('info', ['info'], document.info ?? {}, 'title', '2025-06-18', rootScope);
-  checkMinimumVersion('info', ['info'], document.info ?? {}, 'description', '2025-11-25', rootScope);
-  checkMinimumVersion('info', ['info'], document.info ?? {}, 'icons', '2025-11-25', rootScope);
-  checkMinimumVersion('info', ['info'], document.info ?? {}, 'websiteUrl', '2025-11-25', rootScope);
-
   (document.transports ?? []).forEach((transport, index) => {
     const scope = effectiveScope(document, transport, rootScope);
     if (transport.type === 'streamable-http') {

package/src/snapshots/{0.8.0-rc.3 → 0.8.0}/index.js

@@ -3,9 +3,9 @@ import {
   validateMcpdesc08Document
 } from './semantic.js';
 
-export const specification = '0.8.0-rc.3';
-export const snapshotTag = 'v0.8.0-rc.3';
-export const schemaSha256 = 'a9c3ff77ba37c72362909f538f6e957d055e6fdb372f8b3d529e3651af3fecf4';
+export const specification = '0.8.0';
+export const snapshotTag = 'v0.8.0';
+export const schemaSha256 = '36686f92ba0cc98bde2c34eaad31c0304d6e5cebdd2c4d2be1be06aecef41119';
 export { supportedProtocolVersions };
 
 export function validate(document) {

package/src/snapshots/{0.8.0-rc.3 → 0.8.0}/schema.json

@@ -1,8 +1,8 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://mcpdesc.org/schema/mcp-description/0.8.0-rc.3.json",
-  "title": "MCP Description",
-  "description": "MCP Description 0.8.0 Release Candidate 3 (v0.8.0-rc.3; prerelease).",
+  "$id": "https://mcpdesc.org/schema/mcp-description/0.8.0.json",
+  "title": "MCP Description (mcpdesc)",
+  "description": "A static, curated format to describe what an MCP server offers. Uses MCP-native terminology, an OpenAPI-aligned info and security structure, and support for multiple transports, protocol revisions, and specification extensions. Supports MCP protocol revisions 2024-11-05, 2025-03-26, 2025-06-18, 2025-11-25, and 2026-07-28.",
   "type": "object",
   "required": [
     "mcpdesc",

package/src/snapshots/{0.8.0-rc.3 → 0.8.0}/semantic.js

@@ -1,4 +1,4 @@
-// Validate the immutable 0.8.0-rc.3 snapshot using only snapshot-local artifacts.
+// Validate the immutable 0.8.0 snapshot using only snapshot-local artifacts.
 
 import Ajv from 'ajv';
 import Ajv2020 from 'ajv/dist/2020.js';

package/src/snapshots/0.8.0-rc.4/semantic.js

@@ -62,6 +62,7 @@ function componentDiagnostic(code, rel, message, path) {
 export function resolveComponentReferences(document, rel = 'document') {
   const resolved = structuredClone(document);
   const diagnostics = [];
+  const provenance = [];
   let substitutions = 0;
 
   function resolve(reference, expectedNamespace, path, stack = []) {
@@ -75,7 +76,7 @@ export function resolveComponentReferences(document, rel = 'document') {
         `must target #/components/${expectedNamespace}, not #/components/${namespace}`,
         path
       ));
-      return reference;
+      return { value: reference };
     }
 
     const key = `${namespace}/${name}`;
@@ -86,7 +87,7 @@ export function resolveComponentReferences(document, rel = 'document') {
         `forms a cycle through ${[...stack, key].join(' -> ')}`,
         path
       ));
-      return reference;
+      return { value: reference };
     }
 
     const target = document?.components?.[namespace]?.[name];
@@ -97,18 +98,29 @@ export function resolveComponentReferences(document, rel = 'document') {
         `targets missing component ${JSON.stringify(reference.$componentRef)}`,
         path
       ));
-      return reference;
+      return { value: reference };
     }
     substitutions += 1;
     return isReferenceObject(target)
       ? resolve(target, expectedNamespace, path, [...stack, key])
-      : structuredClone(target);
+      : {
+          value: structuredClone(target),
+          targetPath: ['components', namespace, name]
+        };
+  }
+
+  function substitute(reference, expectedNamespace, path, stack = []) {
+    const result = resolve(reference, expectedNamespace, path, stack);
+    if (result.targetPath) {
+      provenance.push({ referencePath: path, targetPath: result.targetPath });
+    }
+    return result.value;
   }
 
   for (const namespace of componentNamespaces) {
     for (const [name, value] of Object.entries(document?.components?.[namespace] ?? {})) {
       if (isReferenceObject(value)) {
-        resolved.components[namespace][name] = resolve(value, namespace, ['components', namespace, name], [`${namespace}/${name}`]);
+        resolved.components[namespace][name] = substitute(value, namespace, ['components', namespace, name], [`${namespace}/${name}`]);
       }
     }
   }
@@ -124,7 +136,7 @@ export function resolveComponentReferences(document, rel = 'document') {
       if (collection === 'tools') {
         for (const field of ['inputSchema', 'outputSchema']) {
           if (isReferenceObject(declaration[field])) {
-            resolvedDeclaration[field] = resolve(declaration[field], 'schemas', [collection, declarationIndex, field]);
+            resolvedDeclaration[field] = substitute(declaration[field], 'schemas', [collection, declarationIndex, field]);
           }
         }
       }
@@ -138,7 +150,7 @@ export function resolveComponentReferences(document, rel = 'document') {
             : 'promptExamples';
       for (const [name, example] of Object.entries(declaration.examples ?? {})) {
         if (isReferenceObject(example)) {
-          resolvedDeclaration.examples[name] = resolve(
+          resolvedDeclaration.examples[name] = substitute(
             example,
             exampleNamespace,
             [collection, declarationIndex, 'examples', name]
@@ -152,7 +164,7 @@ export function resolveComponentReferences(document, rel = 'document') {
     for (const [declarationIndex, declaration] of (document?.[collection] ?? []).entries()) {
       for (const [elicitationIndex, elicitation] of (declaration.elicitations ?? []).entries()) {
         if (isReferenceObject(elicitation.requestedSchema)) {
-          resolved[collection][declarationIndex].elicitations[elicitationIndex].requestedSchema = resolve(
+          resolved[collection][declarationIndex].elicitations[elicitationIndex].requestedSchema = substitute(
             elicitation.requestedSchema,
             'schemas',
             [collection, declarationIndex, 'elicitations', elicitationIndex, 'requestedSchema']
@@ -162,7 +174,7 @@ export function resolveComponentReferences(document, rel = 'document') {
     }
   }
 
-  return { document: resolved, diagnostics, substitutions };
+  return { document: resolved, diagnostics, substitutions, provenance };
 }
 
 function structuralPath(document, error) {