@mcpdesc/validator 0.5.0 → 0.7.0

package/CHANGELOG.md

@@ -6,7 +6,30 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this package follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 Dates for published releases are the UTC publication dates recorded by npm.
 
-## [Unreleased]
+## [0.7.0] - 2026-09-02
+
+### Changed
+
+- Moved package maintenance and publication from the MCP Description
+	specification repository to the MCP Description tooling repository without
+	changing public APIs, immutable snapshots, diagnostics, or validation
+	behavior.
+
+## [0.6.0] - 2026-09-02
+
+### Added
+
+- Added `@mcpdesc/validator/browser` as a descriptive strict-CSP alias for the existing `@mcpdesc/validator/standalone` implementation, with the same API and declarations.
+- Added blocked-code-generation validation coverage, including document-provided schemas, plus esbuild, Vite, runtime-AJV exclusion, and packed-export checks.
+
+### Changed
+
+- Documented the strict-CSP and runtime-compilation behavior of the default, browser, and standalone entries. The default and standalone exports remain unchanged, and no conditional browser export was added.
+
+### Bundle size
+
+- Before this change, the generated standalone artifact was 1,730,897 bytes (195,998 bytes gzip). After adding the zero-source-file browser alias it remains 1,730,897 bytes (195,998 bytes gzip). Minified esbuild bundles of `/browser` and `/standalone` are both 1,752,417 bytes (0-byte delta); the minified Vite `/browser` bundle is 2,088,016 bytes in the same development environment.
+- A metadata-only entry was evaluated but not added. The current public metadata is coupled to the cumulative snapshot registry, and splitting it would introduce another declaration and synchronization boundary without an approved consumer or measured package-level benefit.
 
 ## [0.5.0] - 2026-08-31
 
@@ -46,7 +69,9 @@ Dates for published releases are the UTC publication dates recorded by npm.
 - Added synchronous structural and semantic validation for parsed JavaScript values with deterministic diagnostics and exact selector dispatch.
 - Added ESM browser support, TypeScript declarations, embedded schema provenance, frozen fixtures, and package-content checks.
 
-[Unreleased]: https://github.com/mcpdesc/mcpdesc-specification/compare/validator-v0.5.0...HEAD
+[Unreleased]: https://github.com/mcpdesc/core/compare/validator-v0.7.0...HEAD
+[0.7.0]: https://github.com/mcpdesc/core/releases/tag/validator-v0.7.0
+[0.6.0]: https://github.com/mcpdesc/mcpdesc-specification/compare/validator-v0.5.0...validator-v0.6.0
 [0.5.0]: https://github.com/mcpdesc/mcpdesc-specification/compare/17cc533e79b19ea2dbc1edcf06e30ba68a7d9b79...validator-v0.5.0
 [0.4.0]: https://www.npmjs.com/package/@mcpdesc/validator/v/0.4.0
 [0.3.0]: https://github.com/mcpdesc/mcpdesc-specification/releases/tag/validator-v0.3.0

package/MODIFICATIONS.md

@@ -4,6 +4,15 @@ This file records material imported from `cisco-open/mcptoolkit-contract` and su
 
 The exact source repository and commit are recorded in [`ORIGIN.md`](ORIGIN.md).
 
+## Validator repository migration — 2026-09-02
+
+The complete `@mcpdesc/validator@0.6.0` package source and package-local tests
+were moved from `mcpdesc/mcpdesc-specification` commit
+`6eb1b54330f8b7dc11468c7e31614214c7521cd0` into `mcpdesc/core`. Package metadata,
+release documentation, and repository guidance were updated for the new
+maintenance location. Existing immutable snapshot implementations, embedded
+schemas, frozen fixtures, diagnostics, and runtime behavior were not changed.
+
 ## Repository bootstrap — 2026-07-28
 
 | File or path | Change | Reason |

package/ORIGIN.md

@@ -1,11 +1,30 @@
 # Origin and provenance
 
-MCP Description v0.7.0 originated in the Cisco Open `mcptoolkit-contract` repository and remains the current stable release as of 2026-07-28; its canonical source stays there.
+## Validator repository migration
 
-This repository is the development home for v0.8.0 and later community work.
-The transition changes future development and governance only — it is **not** a
-copyright assignment or donation, and it does not transfer Cisco's copyright in
-existing contributions.
+`@mcpdesc/validator` versions through `0.6.0` were maintained in the MCP
+Description specification repository. Version `0.7.0` moves the package to the
+MCP Description tooling repository without changing its public API or the
+behavior and bytes of its published immutable snapshot implementations.
+
+| Field | Value |
+|---|---|
+| Source repository | `https://github.com/mcpdesc/mcpdesc-specification` |
+| Source commit | `6eb1b54330f8b7dc11468c7e31614214c7521cd0` |
+| Source package | `packages/validator` (`@mcpdesc/validator@0.6.0`) |
+| Destination repository | `https://github.com/mcpdesc/core` |
+| Destination package | `packages/validator` |
+| Migration date | `2026-09-02` |
+
+The specification repository continues to own normative text, canonical
+schemas, and mutable draft fixtures. This package owns executable validation,
+immutable runtime snapshots, frozen package-test fixtures, and its public API.
+
+MCP Description v0.7.0 originated in the Cisco Open `mcptoolkit-contract`
+repository and remains the current stable release as of 2026-07-28. The
+specification repository imported that material as the basis for v0.8.0
+community work and created the validator package from it. Neither repository
+migration is a copyright assignment or donation.
 
 ## Source import
 
@@ -17,4 +36,7 @@ existing contributions.
 | Method | History-preserving filtered import (`git-filter-repo`); commit hashes rewritten by path filtering |
 | Imported paths | `spec/**`, `schemas/mcp-description/**`, `schemas/latest.json`, `LICENSE`, `NOTICE` |
 
-The imported v0.7.0 JSON Schemas are preserved byte-for-byte. The v0.7.0 specification text is not stored in this repository; its canonical source is the upstream repository above, and [`spec/0.7.0/`](spec/0.7.0/) points to it. Changes to imported material are recorded in [`MODIFICATIONS.md`](MODIFICATIONS.md) and Git history.
+The imported v0.7.0 JSON Schemas are preserved byte-for-byte in their immutable
+validator snapshots. The v0.7.0 specification text is not stored here; its
+canonical source remains the upstream repository above. Changes to imported
+material are recorded in [`MODIFICATIONS.md`](MODIFICATIONS.md) and Git history.

package/README.md

@@ -2,7 +2,9 @@
 
 Isomorphic structural and semantic validation for immutable MCP Description specification snapshots.
 
-Version `0.5.0` cumulatively supports these immutable snapshots and is prepared for npm `latest` after the RC.1 specification tag and package tarball are reviewed.
+Version `0.7.0` cumulatively supports these immutable snapshots. This release
+moves package maintenance from the MCP Description specification repository to
+the MCP Description tooling repository without changing conformance behavior.
 
 | Selector | Tag | Embedded schema SHA-256 |
 |---|---|---|
@@ -32,15 +34,23 @@ Callers provide an already parsed JavaScript value. JSON and YAML parsing are ou
 
 The `options` argument and exact `specification` selector are required. The unqualified selector `0.8.0` is intentionally unsupported because draft and release-candidate iterations are immutable compatibility contracts.
 
-### Strict CSP browsers
+### Entry points
 
-Browser applications that prohibit dynamic code generation can use the CSP-safe standalone entry:
+| Entry | Strict CSP without `unsafe-eval` | Fixed MCP Description schemas | Document-provided schemas |
+|---|---|---|---|
+| `@mcpdesc/validator` | No | Compiled by AJV at runtime | Compiled or interpreted at runtime |
+| `@mcpdesc/validator/browser` | Yes | Precompiled during package development | Interpreted at runtime |
+| `@mcpdesc/validator/standalone` | Yes | Precompiled during package development | Interpreted at runtime |
+
+Browser applications that prohibit dynamic code generation should use the descriptive CSP-safe browser entry:
 
 ```js
-import { validateMcpDescription } from '@mcpdesc/validator/standalone';
+import { validateMcpDescription } from '@mcpdesc/validator/browser';
 ```
 
-It has the same synchronous API, selectors, diagnostics, and offline external-reference behavior as the default entry. Fixed MCP Description schemas and JSON Schema meta-schemas are precompiled during package development; document-provided Tool and Elicitation schemas use the package's interpreted JSON Schema dependency, so the shipped file contains no `eval` or `new Function`. This compatibility entry is larger and slower than the default AJV-based entry and is JavaScript, not WASM.
+The `/browser` entry is a public alias for the existing `/standalone` implementation. `/standalone` remains supported for backward compatibility. Both have the same synchronous API, selectors, diagnostics, and offline external-reference behavior as the default entry. Fixed MCP Description schemas and JSON Schema meta-schemas are precompiled during package development; document-provided Tool and Elicitation schemas use the package's interpreted JSON Schema dependency, so neither entry uses `eval` or `new Function` or requires `unsafe-eval`. These entries are larger and slower than the default AJV-based entry and are JavaScript, not WASM.
+
+The default entry remains unchanged and uses AJV runtime compilation. Applications that need dynamic schema compilation can use it where their runtime policy permits dynamic code generation. Importing it may fail when a browser enforces strict CSP. The package intentionally does not select a different implementation through conditional exports; consumers choose the required behavior explicitly.
 
 ## Snapshot resolution
 
@@ -101,11 +111,12 @@ The package exports frozen `supportedSpecifications`, `supportedProtocolVersions
 
 npm package SemVer tracks implementation releases independently from specification snapshot identity. Adding a later snapshot is additive: it must use a sibling implementation and selector rather than changing an existing snapshot's schema, semantics, metadata, fixtures, or results.
 
-The runtime bundles its schema, performs no network fetches for external schema references, and imports no Node.js built-ins. Unresolved external Tool-schema references produce incomplete-validation warnings and are preserved. Both ESM entry points support Node.js 20 or later and browser bundlers.
+The runtime bundles its schema, performs no network fetches for external schema references, and imports no Node.js built-ins. Unresolved external Tool-schema references produce incomplete-validation warnings and are preserved. All three ESM entry points support Node.js 20 or later and browser bundlers.
 
 ## Snapshot lifecycle
 
-For each approved specification snapshot, maintainers:
+For each approved specification snapshot, maintainers import artifacts from an
+exact specification repository tag or commit and then:
 
 1. Add a versioned implementation under `src/snapshots/<selector>/` with its exact selector, snapshot tag, embedded schema, schema SHA-256 digest, and semantic rules. Existing snapshot directories remain unchanged.
 2. Freeze the matching fixture corpus under `test/snapshots/<selector>/fixtures/`. Package tests must not read mutable `spec/draft/fixtures/` for an already published selector.
@@ -114,7 +125,15 @@ For each approved specification snapshot, maintainers:
 
 The test snapshots are repository-only development assets and are excluded from the npm tarball. Runtime snapshot implementations and embedded schemas do ship so installed packages remain self-contained.
 
-Supporting code does not authorize publication. During release review, a maintainer explicitly decides the validator package version and intended npm dist-tag so the reviewed specification-tag commit contains the chosen package metadata. Only after that specification snapshot is tagged does a maintainer review the tarball and push an annotated `validator-v<semver>` tag. The trusted-publishing workflow requires that exact tag/package version match, reruns the package checks, and publishes SemVer prereleases with npm `next` or stable versions with `latest`. Repository scripts and other CI workflows do not choose versions, create release tags, or publish packages. No package version or publication choice for a later draft is made by this lifecycle description.
+Specification approval and imported supporting code do not authorize package
+publication. During release review, a maintainer explicitly decides the
+validator package version and npm dist-tag, reviews the exact imported source
+and frozen fixture provenance, runs the full checks, and inspects the tarball.
+The trusted-publishing workflow requires an annotated
+`validator-v<semver>` tag whose version matches this package and whose commit is
+the current `origin/main` tip. It publishes SemVer prereleases with npm `next`
+and stable versions with `latest`. Scripts and other CI workflows do not choose
+versions, create tags, or publish packages.
 
 ## Development checks
 
@@ -127,4 +146,4 @@ npm run test:browser --workspace @mcpdesc/validator
 npm run test:package --workspace @mcpdesc/validator
 ```
 
-The package test runs each immutable snapshot against its own frozen valid, invalid, and warning fixture corpus. YAML source fixtures are decoded by the test harness before validation; the public API continues to accept parsed JavaScript values only. The other checks compile the declarations, build all runtime snapshots for a browser target, and inspect `npm pack --dry-run --json` against the intended tarball contents, including all runtime snapshots and exclusion of test snapshots.
+The package test runs each immutable snapshot against its own frozen valid, invalid, and warning fixture corpus. YAML source fixtures are decoded by the test harness before validation; the public API continues to accept parsed JavaScript values only. The other checks compile the declarations, bundle the public browser entry with esbuild and Vite, reject runtime AJV compiler inputs and dynamic code generation in those bundles, and inspect `npm pack --dry-run --json` against the intended tarball contents and declared export targets.

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "@mcpdesc/validator",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "description": "Structural and semantic validation for MCP Description snapshots",
   "type": "module",
   "types": "./index.d.ts",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/mcpdesc/mcpdesc-specification.git",
+    "url": "git+https://github.com/mcpdesc/core.git",
     "directory": "packages/validator"
   },
   "engines": {
@@ -18,6 +18,10 @@
       "types": "./index.d.ts",
       "import": "./src/index.js"
     },
+    "./browser": {
+      "types": "./index.d.ts",
+      "import": "./standalone.js"
+    },
     "./standalone": {
       "types": "./index.d.ts",
       "import": "./standalone.js"
@@ -37,7 +41,9 @@
   ],
   "scripts": {
     "build:standalone": "node scripts/build-standalone.mjs",
-    "test": "npm run build:standalone && node --test test/*.test.js && npm run test:types && npm run test:browser && npm run test:package",
+    "check:snapshots": "node scripts/check-snapshot-integrity.mjs",
+    "import:snapshot": "node scripts/import-snapshot.mjs",
+    "test": "npm run check:snapshots && npm run build:standalone && node --test test/*.test.js && npm run test:types && npm run test:browser && npm run test:package",
     "test:browser": "node scripts/check-browser-bundle.mjs",
     "test:package": "node scripts/check-package.mjs",
     "test:types": "tsc --project test/types/tsconfig.json && node scripts/check-declarations.mjs"
@@ -51,6 +57,7 @@
   "devDependencies": {
     "esbuild": "^0.25.0",
     "typescript": "^5.9.0",
+    "vite": "^6.4.3",
     "yaml": "^2.9.0"
   }
 }