@mcpdesc/validator 0.5.0 → 0.6.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/CHANGELOG.md +18 -1
  2. package/README.md +15 -7
  3. package/package.json +6 -1
package/CHANGELOG.md CHANGED
@@ -8,6 +8,22 @@ Dates for published releases are the UTC publication dates recorded by npm.
8
8
 
9
9
  ## [Unreleased]
10
10
 
11
+ ## [0.6.0] - 2026-09-02
12
+
13
+ ### Added
14
+
15
+ - Added `@mcpdesc/validator/browser` as a descriptive strict-CSP alias for the existing `@mcpdesc/validator/standalone` implementation, with the same API and declarations.
16
+ - Added blocked-code-generation validation coverage, including document-provided schemas, plus esbuild, Vite, runtime-AJV exclusion, and packed-export checks.
17
+
18
+ ### Changed
19
+
20
+ - Documented the strict-CSP and runtime-compilation behavior of the default, browser, and standalone entries. The default and standalone exports remain unchanged, and no conditional browser export was added.
21
+
22
+ ### Bundle size
23
+
24
+ - Before this change, the generated standalone artifact was 1,730,897 bytes (195,998 bytes gzip). After adding the zero-source-file browser alias it remains 1,730,897 bytes (195,998 bytes gzip). Minified esbuild bundles of `/browser` and `/standalone` are both 1,752,417 bytes (0-byte delta); the minified Vite `/browser` bundle is 2,088,016 bytes in the same development environment.
25
+ - A metadata-only entry was evaluated but not added. The current public metadata is coupled to the cumulative snapshot registry, and splitting it would introduce another declaration and synchronization boundary without an approved consumer or measured package-level benefit.
26
+
11
27
  ## [0.5.0] - 2026-08-31
12
28
 
13
29
  ### Added
@@ -46,7 +62,8 @@ Dates for published releases are the UTC publication dates recorded by npm.
46
62
  - Added synchronous structural and semantic validation for parsed JavaScript values with deterministic diagnostics and exact selector dispatch.
47
63
  - Added ESM browser support, TypeScript declarations, embedded schema provenance, frozen fixtures, and package-content checks.
48
64
 
49
- [Unreleased]: https://github.com/mcpdesc/mcpdesc-specification/compare/validator-v0.5.0...HEAD
65
+ [Unreleased]: https://github.com/mcpdesc/mcpdesc-specification/compare/validator-v0.6.0...HEAD
66
+ [0.6.0]: https://github.com/mcpdesc/mcpdesc-specification/compare/validator-v0.5.0...validator-v0.6.0
50
67
  [0.5.0]: https://github.com/mcpdesc/mcpdesc-specification/compare/17cc533e79b19ea2dbc1edcf06e30ba68a7d9b79...validator-v0.5.0
51
68
  [0.4.0]: https://www.npmjs.com/package/@mcpdesc/validator/v/0.4.0
52
69
  [0.3.0]: https://github.com/mcpdesc/mcpdesc-specification/releases/tag/validator-v0.3.0
package/README.md CHANGED
@@ -2,7 +2,7 @@
2
2
 
3
3
  Isomorphic structural and semantic validation for immutable MCP Description specification snapshots.
4
4
 
5
- Version `0.5.0` cumulatively supports these immutable snapshots and is prepared for npm `latest` after the RC.1 specification tag and package tarball are reviewed.
5
+ Version `0.6.0` cumulatively supports these immutable snapshots.
6
6
 
7
7
  | Selector | Tag | Embedded schema SHA-256 |
8
8
  |---|---|---|
@@ -32,15 +32,23 @@ Callers provide an already parsed JavaScript value. JSON and YAML parsing are ou
32
32
 
33
33
  The `options` argument and exact `specification` selector are required. The unqualified selector `0.8.0` is intentionally unsupported because draft and release-candidate iterations are immutable compatibility contracts.
34
34
 
35
- ### Strict CSP browsers
35
+ ### Entry points
36
36
 
37
- Browser applications that prohibit dynamic code generation can use the CSP-safe standalone entry:
37
+ | Entry | Strict CSP without `unsafe-eval` | Fixed MCP Description schemas | Document-provided schemas |
38
+ |---|---|---|---|
39
+ | `@mcpdesc/validator` | No | Compiled by AJV at runtime | Compiled or interpreted at runtime |
40
+ | `@mcpdesc/validator/browser` | Yes | Precompiled during package development | Interpreted at runtime |
41
+ | `@mcpdesc/validator/standalone` | Yes | Precompiled during package development | Interpreted at runtime |
42
+
43
+ Browser applications that prohibit dynamic code generation should use the descriptive CSP-safe browser entry:
38
44
 
39
45
  ```js
40
- import { validateMcpDescription } from '@mcpdesc/validator/standalone';
46
+ import { validateMcpDescription } from '@mcpdesc/validator/browser';
41
47
  ```
42
48
 
43
- It has the same synchronous API, selectors, diagnostics, and offline external-reference behavior as the default entry. Fixed MCP Description schemas and JSON Schema meta-schemas are precompiled during package development; document-provided Tool and Elicitation schemas use the package's interpreted JSON Schema dependency, so the shipped file contains no `eval` or `new Function`. This compatibility entry is larger and slower than the default AJV-based entry and is JavaScript, not WASM.
49
+ The `/browser` entry is a public alias for the existing `/standalone` implementation. `/standalone` remains supported for backward compatibility. Both have the same synchronous API, selectors, diagnostics, and offline external-reference behavior as the default entry. Fixed MCP Description schemas and JSON Schema meta-schemas are precompiled during package development; document-provided Tool and Elicitation schemas use the package's interpreted JSON Schema dependency, so neither entry uses `eval` or `new Function` or requires `unsafe-eval`. These entries are larger and slower than the default AJV-based entry and are JavaScript, not WASM.
50
+
51
+ The default entry remains unchanged and uses AJV runtime compilation. Applications that need dynamic schema compilation can use it where their runtime policy permits dynamic code generation. Importing it may fail when a browser enforces strict CSP. The package intentionally does not select a different implementation through conditional exports; consumers choose the required behavior explicitly.
44
52
 
45
53
  ## Snapshot resolution
46
54
 
@@ -101,7 +109,7 @@ The package exports frozen `supportedSpecifications`, `supportedProtocolVersions
101
109
 
102
110
  npm package SemVer tracks implementation releases independently from specification snapshot identity. Adding a later snapshot is additive: it must use a sibling implementation and selector rather than changing an existing snapshot's schema, semantics, metadata, fixtures, or results.
103
111
 
104
- The runtime bundles its schema, performs no network fetches for external schema references, and imports no Node.js built-ins. Unresolved external Tool-schema references produce incomplete-validation warnings and are preserved. Both ESM entry points support Node.js 20 or later and browser bundlers.
112
+ The runtime bundles its schema, performs no network fetches for external schema references, and imports no Node.js built-ins. Unresolved external Tool-schema references produce incomplete-validation warnings and are preserved. All three ESM entry points support Node.js 20 or later and browser bundlers.
105
113
 
106
114
  ## Snapshot lifecycle
107
115
 
@@ -127,4 +135,4 @@ npm run test:browser --workspace @mcpdesc/validator
127
135
  npm run test:package --workspace @mcpdesc/validator
128
136
  ```
129
137
 
130
- The package test runs each immutable snapshot against its own frozen valid, invalid, and warning fixture corpus. YAML source fixtures are decoded by the test harness before validation; the public API continues to accept parsed JavaScript values only. The other checks compile the declarations, build all runtime snapshots for a browser target, and inspect `npm pack --dry-run --json` against the intended tarball contents, including all runtime snapshots and exclusion of test snapshots.
138
+ The package test runs each immutable snapshot against its own frozen valid, invalid, and warning fixture corpus. YAML source fixtures are decoded by the test harness before validation; the public API continues to accept parsed JavaScript values only. The other checks compile the declarations, bundle the public browser entry with esbuild and Vite, reject runtime AJV compiler inputs and dynamic code generation in those bundles, and inspect `npm pack --dry-run --json` against the intended tarball contents and declared export targets.
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@mcpdesc/validator",
3
- "version": "0.5.0",
3
+ "version": "0.6.0",
4
4
  "description": "Structural and semantic validation for MCP Description snapshots",
5
5
  "type": "module",
6
6
  "types": "./index.d.ts",
@@ -18,6 +18,10 @@
18
18
  "types": "./index.d.ts",
19
19
  "import": "./src/index.js"
20
20
  },
21
+ "./browser": {
22
+ "types": "./index.d.ts",
23
+ "import": "./standalone.js"
24
+ },
21
25
  "./standalone": {
22
26
  "types": "./index.d.ts",
23
27
  "import": "./standalone.js"
@@ -51,6 +55,7 @@
51
55
  "devDependencies": {
52
56
  "esbuild": "^0.25.0",
53
57
  "typescript": "^5.9.0",
58
+ "vite": "^6.4.3",
54
59
  "yaml": "^2.9.0"
55
60
  }
56
61
  }