@mcpdesc/validator 0.6.0 → 0.7.1

package/CHANGELOG.md

@@ -8,6 +8,23 @@ Dates for published releases are the UTC publication dates recorded by npm.
 
 ## [Unreleased]
 
+## [0.7.1] - 2026-09-02
+
+### Changed
+
+- Added an explicit package-specific homepage and expanded the README with the
+	validator's purpose, boundaries, result model, installation, and newest-first
+	snapshot support.
+
+## [0.7.0] - 2026-09-02
+
+### Changed
+
+- Moved package maintenance and publication from the MCP Description
+	specification repository to the MCP Description tooling repository without
+	changing public APIs, immutable snapshots, diagnostics, or validation
+	behavior.
+
 ## [0.6.0] - 2026-09-02
 
 ### Added
@@ -62,7 +79,9 @@ Dates for published releases are the UTC publication dates recorded by npm.
 - Added synchronous structural and semantic validation for parsed JavaScript values with deterministic diagnostics and exact selector dispatch.
 - Added ESM browser support, TypeScript declarations, embedded schema provenance, frozen fixtures, and package-content checks.
 
-[Unreleased]: https://github.com/mcpdesc/mcpdesc-specification/compare/validator-v0.6.0...HEAD
+[Unreleased]: https://github.com/mcpdesc/core/compare/validator-v0.7.1...HEAD
+[0.7.1]: https://github.com/mcpdesc/core/compare/validator-v0.7.0...validator-v0.7.1
+[0.7.0]: https://github.com/mcpdesc/core/releases/tag/validator-v0.7.0
 [0.6.0]: https://github.com/mcpdesc/mcpdesc-specification/compare/validator-v0.5.0...validator-v0.6.0
 [0.5.0]: https://github.com/mcpdesc/mcpdesc-specification/compare/17cc533e79b19ea2dbc1edcf06e30ba68a7d9b79...validator-v0.5.0
 [0.4.0]: https://www.npmjs.com/package/@mcpdesc/validator/v/0.4.0

package/MODIFICATIONS.md

@@ -4,6 +4,15 @@ This file records material imported from `cisco-open/mcptoolkit-contract` and su
 
 The exact source repository and commit are recorded in [`ORIGIN.md`](ORIGIN.md).
 
+## Validator repository migration — 2026-09-02
+
+The complete `@mcpdesc/validator@0.6.0` package source and package-local tests
+were moved from `mcpdesc/mcpdesc-specification` commit
+`6eb1b54330f8b7dc11468c7e31614214c7521cd0` into `mcpdesc/core`. Package metadata,
+release documentation, and repository guidance were updated for the new
+maintenance location. Existing immutable snapshot implementations, embedded
+schemas, frozen fixtures, diagnostics, and runtime behavior were not changed.
+
 ## Repository bootstrap — 2026-07-28
 
 | File or path | Change | Reason |

package/ORIGIN.md

@@ -1,11 +1,30 @@
 # Origin and provenance
 
-MCP Description v0.7.0 originated in the Cisco Open `mcptoolkit-contract` repository and remains the current stable release as of 2026-07-28; its canonical source stays there.
+## Validator repository migration
 
-This repository is the development home for v0.8.0 and later community work.
-The transition changes future development and governance only — it is **not** a
-copyright assignment or donation, and it does not transfer Cisco's copyright in
-existing contributions.
+`@mcpdesc/validator` versions through `0.6.0` were maintained in the MCP
+Description specification repository. Version `0.7.0` moves the package to the
+MCP Description tooling repository without changing its public API or the
+behavior and bytes of its published immutable snapshot implementations.
+
+| Field | Value |
+|---|---|
+| Source repository | `https://github.com/mcpdesc/mcpdesc-specification` |
+| Source commit | `6eb1b54330f8b7dc11468c7e31614214c7521cd0` |
+| Source package | `packages/validator` (`@mcpdesc/validator@0.6.0`) |
+| Destination repository | `https://github.com/mcpdesc/core` |
+| Destination package | `packages/validator` |
+| Migration date | `2026-09-02` |
+
+The specification repository continues to own normative text, canonical
+schemas, and mutable draft fixtures. This package owns executable validation,
+immutable runtime snapshots, frozen package-test fixtures, and its public API.
+
+MCP Description v0.7.0 originated in the Cisco Open `mcptoolkit-contract`
+repository and remains the current stable release as of 2026-07-28. The
+specification repository imported that material as the basis for v0.8.0
+community work and created the validator package from it. Neither repository
+migration is a copyright assignment or donation.
 
 ## Source import
 
@@ -17,4 +36,7 @@ existing contributions.
 | Method | History-preserving filtered import (`git-filter-repo`); commit hashes rewritten by path filtering |
 | Imported paths | `spec/**`, `schemas/mcp-description/**`, `schemas/latest.json`, `LICENSE`, `NOTICE` |
 
-The imported v0.7.0 JSON Schemas are preserved byte-for-byte. The v0.7.0 specification text is not stored in this repository; its canonical source is the upstream repository above, and [`spec/0.7.0/`](spec/0.7.0/) points to it. Changes to imported material are recorded in [`MODIFICATIONS.md`](MODIFICATIONS.md) and Git history.
+The imported v0.7.0 JSON Schemas are preserved byte-for-byte in their immutable
+validator snapshots. The v0.7.0 specification text is not stored here; its
+canonical source remains the upstream repository above. Changes to imported
+material are recorded in [`MODIFICATIONS.md`](MODIFICATIONS.md) and Git history.

package/README.md

@@ -1,34 +1,60 @@
 # @mcpdesc/validator
 
-Isomorphic structural and semantic validation for immutable MCP Description specification snapshots.
+Validate parsed MCP Description documents against exact, immutable specification
+snapshots. The package:
 
-Version `0.6.0` cumulatively supports these immutable snapshots.
+- checks document structure against the snapshot's embedded JSON Schema;
+- applies semantic rules that JSON Schema alone cannot express;
+- returns deterministic error and warning diagnostics with document paths; and
+- runs synchronously and offline in Node.js 20+ and browser bundles.
 
-| Selector | Tag | Embedded schema SHA-256 |
-|---|---|---|
-| `0.8.0-draft.1` | `v0.8.0-draft.1` | `4ceb6042c3fd31703199cd3db869ec5c35c17d2fe9ab7b2f5b96a2a3af0cebe4` |
-| `0.8.0-draft.2` | `v0.8.0-draft.2` | `ab692c1a5a0f7e5f29be1940aa8c64a56d4620be0a19d00cf0a64680b7e517fa` |
-| `0.8.0-draft.3` | `v0.8.0-draft.3` | `8823c1f1946360b2a44d00920e2092e5e4acd139a1964befad4eb0bf3ce96002` |
-| `0.8.0-draft.4` | `v0.8.0-draft.4` | `93ed03f74059b5b3ce7509a96b59161bdab2c3cf7734397a9bec5a7588d0b03b` |
-| `0.8.0-rc.1` | `v0.8.0-rc.1` | `936a0f24ade501fcabf3d6498c0440c445daa672a575573a35954cee49430ac4` |
+Use it when accepting, generating, migrating, or transforming MCP Description
+documents and you need to know whether the result conforms to a specific
+published draft or release candidate. It validates MCP Description documents,
+not live MCP servers or MCP protocol messages.
 
-Repository changes alone do not publish the package or create specification or validator tags.
+## Install
 
-## Usage
+```bash
+npm install @mcpdesc/validator
+```
+
+## Quick start
 
 ```js
 import { validateMcpDescription } from '@mcpdesc/validator';
 
 const result = validateMcpDescription(parsedDocument, {
-  specification: '0.8.0-rc.1'
+  specification: '0.8.0-rc.1',
 });
 
+for (const diagnostic of result.diagnostics) {
+  console.log(diagnostic.severity, diagnostic.path, diagnostic.message);
+}
+
 if (!result.valid) {
-  console.error(result.diagnostics);
+  // At least one error diagnostic was returned.
 }
 ```
 
-Callers provide an already parsed JavaScript value. JSON and YAML parsing are outside this package.
+Callers provide an already parsed JavaScript value. JSON and YAML parsing, file
+access, network access, and live-server inspection are outside this package.
+The exact `specification` selector is required so validation never changes when
+a later draft is published.
+
+## Supported snapshots
+
+Version `0.7.1` supports these immutable snapshots, newest first:
+
+| Selector | Tag | Embedded schema SHA-256 |
+|---|---|---|
+| `0.8.0-rc.1` | `v0.8.0-rc.1` | `936a0f24ade501fcabf3d6498c0440c445daa672a575573a35954cee49430ac4` |
+| `0.8.0-draft.4` | `v0.8.0-draft.4` | `93ed03f74059b5b3ce7509a96b59161bdab2c3cf7734397a9bec5a7588d0b03b` |
+| `0.8.0-draft.3` | `v0.8.0-draft.3` | `8823c1f1946360b2a44d00920e2092e5e4acd139a1964befad4eb0bf3ce96002` |
+| `0.8.0-draft.2` | `v0.8.0-draft.2` | `ab692c1a5a0f7e5f29be1940aa8c64a56d4620be0a19d00cf0a64680b7e517fa` |
+| `0.8.0-draft.1` | `v0.8.0-draft.1` | `4ceb6042c3fd31703199cd3db869ec5c35c17d2fe9ab7b2f5b96a2a3af0cebe4` |
+
+## Usage
 
 The `options` argument and exact `specification` selector are required. The unqualified selector `0.8.0` is intentionally unsupported because draft and release-candidate iterations are immutable compatibility contracts.
 
@@ -113,7 +139,8 @@ The runtime bundles its schema, performs no network fetches for external schema
 
 ## Snapshot lifecycle
 
-For each approved specification snapshot, maintainers:
+For each approved specification snapshot, maintainers import artifacts from an
+exact specification repository tag or commit and then:
 
 1. Add a versioned implementation under `src/snapshots/<selector>/` with its exact selector, snapshot tag, embedded schema, schema SHA-256 digest, and semantic rules. Existing snapshot directories remain unchanged.
 2. Freeze the matching fixture corpus under `test/snapshots/<selector>/fixtures/`. Package tests must not read mutable `spec/draft/fixtures/` for an already published selector.
@@ -122,7 +149,15 @@ For each approved specification snapshot, maintainers:
 
 The test snapshots are repository-only development assets and are excluded from the npm tarball. Runtime snapshot implementations and embedded schemas do ship so installed packages remain self-contained.
 
-Supporting code does not authorize publication. During release review, a maintainer explicitly decides the validator package version and intended npm dist-tag so the reviewed specification-tag commit contains the chosen package metadata. Only after that specification snapshot is tagged does a maintainer review the tarball and push an annotated `validator-v<semver>` tag. The trusted-publishing workflow requires that exact tag/package version match, reruns the package checks, and publishes SemVer prereleases with npm `next` or stable versions with `latest`. Repository scripts and other CI workflows do not choose versions, create release tags, or publish packages. No package version or publication choice for a later draft is made by this lifecycle description.
+Specification approval and imported supporting code do not authorize package
+publication. During release review, a maintainer explicitly decides the
+validator package version and npm dist-tag, reviews the exact imported source
+and frozen fixture provenance, runs the full checks, and inspects the tarball.
+The trusted-publishing workflow requires an annotated
+`validator-v<semver>` tag whose version matches this package and whose commit is
+the current `origin/main` tip. It publishes SemVer prereleases with npm `next`
+and stable versions with `latest`. Scripts and other CI workflows do not choose
+versions, create tags, or publish packages.
 
 ## Development checks
 

package/package.json

@@ -1,15 +1,17 @@
 {
   "name": "@mcpdesc/validator",
-  "version": "0.6.0",
+  "version": "0.7.1",
   "description": "Structural and semantic validation for MCP Description snapshots",
   "type": "module",
   "types": "./index.d.ts",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/mcpdesc/mcpdesc-specification.git",
+    "url": "git+https://github.com/mcpdesc/core.git",
     "directory": "packages/validator"
   },
+  "homepage": "https://github.com/mcpdesc/core/tree/main/packages/validator#readme",
+  "bugs": "https://github.com/mcpdesc/core/issues",
   "engines": {
     "node": ">=20"
   },
@@ -41,7 +43,9 @@
   ],
   "scripts": {
     "build:standalone": "node scripts/build-standalone.mjs",
-    "test": "npm run build:standalone && node --test test/*.test.js && npm run test:types && npm run test:browser && npm run test:package",
+    "check:snapshots": "node scripts/check-snapshot-integrity.mjs",
+    "import:snapshot": "node scripts/import-snapshot.mjs",
+    "test": "npm run check:snapshots && npm run build:standalone && node --test test/*.test.js && npm run test:types && npm run test:browser && npm run test:package",
     "test:browser": "node scripts/check-browser-bundle.mjs",
     "test:package": "node scripts/check-package.mjs",
     "test:types": "tsc --project test/types/tsconfig.json && node scripts/check-declarations.mjs"