@postman-cse/onboarding-bootstrap 2.5.0 → 2.6.0

package/dist/action.cjs

@@ -296954,12 +296954,36 @@ function buildOperationScript(operation, index, warnings) {
     '    if (mediaType === "application/json" && gqlBody.data !== undefined && gqlBody.data !== null && pm.response.code !== 200) { pm.expect.fail("a GraphQL response carrying data over application/json must be HTTP 200; got " + pm.response.code); }',
     "});"
   );
+  lines.push(
+    `pm.test(${JSON.stringify(`[${label}] GraphQL response map follows the spec response format`)}, function () {`,
+    '    var extraKeys = Object.keys(gqlBody).filter(function (key) { return key !== "data" && key !== "errors" && key !== "extensions"; });',
+    '    if (extraKeys.length > 0) pm.expect.fail("the GraphQL response map must not contain entries other than data, errors, and extensions (GraphQL spec 7.1): " + extraKeys.join(", "));',
+    '    if (Object.prototype.hasOwnProperty.call(gqlBody, "extensions") && (typeof gqlBody.extensions !== "object" || gqlBody.extensions === null || Array.isArray(gqlBody.extensions))) pm.expect.fail("the GraphQL extensions entry must be a map (GraphQL spec 7.1)");',
+    '    if (!Object.prototype.hasOwnProperty.call(gqlBody, "data") && (!Array.isArray(gqlBody.errors) || gqlBody.errors.length === 0)) pm.expect.fail("a GraphQL request-error result (no data entry) must carry a non-empty errors list (GraphQL spec 7.1)");',
+    "});"
+  );
   lines.push(
     `pm.test(${JSON.stringify(`[${label}] GraphQL errors are well-formed and not a total failure`)}, function () {`,
     "    var errors = gqlBody.errors;",
     "    if (errors === undefined || errors === null) return;",
     `    pm.expect(errors, "GraphQL 'errors' must be an array when present").to.be.an("array");`,
-    '    errors.forEach(function (err) { pm.expect(err, "each GraphQL error must carry a message").to.be.an("object").that.has.property("message"); });',
+    "    errors.forEach(function (err, errIndex) {",
+    '      pm.expect(err, "each GraphQL error must carry a message").to.be.an("object").that.has.property("message");',
+    '      if (typeof err.message !== "string") pm.expect.fail("errors[" + errIndex + "].message must be a string (GraphQL spec 7.1.2)");',
+    "      if (err.locations !== undefined && err.locations !== null) {",
+    '        if (!Array.isArray(err.locations)) { pm.expect.fail("errors[" + errIndex + "].locations must be a list (GraphQL spec 7.1.2)"); return; }',
+    "        err.locations.forEach(function (loc, locIndex) {",
+    '          var locLabel = "errors[" + errIndex + "].locations[" + locIndex + "]";',
+    '          if (!loc || typeof loc !== "object" || Array.isArray(loc)) { pm.expect.fail(locLabel + " must be a map with line and column (GraphQL spec 7.1.2)"); return; }',
+    '          if (!Number.isInteger(loc.line) || loc.line < 1 || !Number.isInteger(loc.column) || loc.column < 1) pm.expect.fail(locLabel + " line and column must be positive integers starting from 1 (GraphQL spec 7.1.2)");',
+    "        });",
+    "      }",
+    "      if (err.path !== undefined && err.path !== null) {",
+    '        if (!Array.isArray(err.path)) { pm.expect.fail("errors[" + errIndex + "].path must be a list of path segments (GraphQL spec 7.1.2)"); return; }',
+    '        err.path.forEach(function (segment, segIndex) { if (typeof segment !== "string" && !Number.isInteger(segment)) pm.expect.fail("errors[" + errIndex + "].path[" + segIndex + "] must be a string field name or an integer list index (GraphQL spec 7.1.2)"); });',
+    "      }",
+    '      if (err.extensions !== undefined && err.extensions !== null && (typeof err.extensions !== "object" || Array.isArray(err.extensions))) pm.expect.fail("errors[" + errIndex + "].extensions must be a map (GraphQL spec 7.1.2)");',
+    "    });",
     "    var hasData = gqlBody.data !== undefined && gqlBody.data !== null;",
     '    if (!hasData && errors.length > 0) { pm.expect.fail("GraphQL request returned errors and no data: " + JSON.stringify(errors)); }',
     "});"
@@ -297794,6 +297818,71 @@ function createGrpcScript(spec) {
     '    else if (!/^[\\x20-\\x7e]*$/.test(value)) pm.expect.fail(label + " " + key + " value must be printable ASCII (gRPC ASCII-Value)");',
     "  });",
     "}",
+    // grpc-status-details-bin carries a base64-encoded google.rpc.Status protobuf
+    // (the gRPC richer-error model). The sandbox has no protobuf runtime, so the
+    // script walks the protobuf wire format directly: base64 -> bytes -> tagged
+    // fields (varint / 64-bit / length-delimited / 32-bit). Groups (wire types
+    // 3/4) are proto2-deprecated and never emitted by google.rpc.Status.
+    "function grpcB64Bytes(value) {",
+    '  var clean = String(value).replace(/\\s+/g, "").replace(/-/g, "+").replace(/_/g, "/");',
+    "  if (clean.length % 4 === 1 || !/^[A-Za-z0-9+/]*={0,2}$/.test(clean)) return null;",
+    '  var alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";',
+    '  var unpadded = clean.replace(/=+$/, ""); var bytes = []; var buffer = 0; var bits = 0;',
+    "  for (var i = 0; i < unpadded.length; i++) {",
+    "    var idx = alphabet.indexOf(unpadded.charAt(i));",
+    "    if (idx === -1) return null;",
+    "    buffer = (buffer << 6) | idx; bits += 6;",
+    "    if (bits >= 8) { bits -= 8; bytes.push((buffer >> bits) & 0xff); }",
+    "  }",
+    "  return bytes;",
+    "}",
+    "function grpcPbVarint(bytes, pos) {",
+    "  var value = 0; var shift = 0;",
+    "  while (pos < bytes.length) {",
+    "    var b = bytes[pos]; pos += 1;",
+    "    value += (b & 0x7f) * Math.pow(2, shift); shift += 7;",
+    "    if ((b & 0x80) === 0) return value > 9007199254740991 ? null : { value: value, pos: pos };",
+    "    if (shift > 63) return null;",
+    "  }",
+    "  return null;",
+    "}",
+    "function grpcPbFields(bytes) {",
+    "  var pos = 0; var fields = [];",
+    "  while (pos < bytes.length) {",
+    "    var tag = grpcPbVarint(bytes, pos); if (!tag) return null;",
+    "    pos = tag.pos;",
+    "    var fieldNumber = Math.floor(tag.value / 8); var wire = tag.value % 8;",
+    "    if (fieldNumber < 1) return null;",
+    "    if (wire === 0) { var varint = grpcPbVarint(bytes, pos); if (!varint) return null; fields.push({ field: fieldNumber, wire: 0, value: varint.value }); pos = varint.pos; }",
+    "    else if (wire === 1) { if (pos + 8 > bytes.length) return null; fields.push({ field: fieldNumber, wire: 1 }); pos += 8; }",
+    "    else if (wire === 2) { var len = grpcPbVarint(bytes, pos); if (!len) return null; pos = len.pos; if (pos + len.value > bytes.length) return null; fields.push({ field: fieldNumber, wire: 2, bytes: bytes.slice(pos, pos + len.value) }); pos += len.value; }",
+    "    else if (wire === 5) { if (pos + 4 > bytes.length) return null; fields.push({ field: fieldNumber, wire: 5 }); pos += 4; }",
+    "    else return null;",
+    "  }",
+    "  return fields;",
+    "}",
+    "function grpcCheckStatusDetailsBin(entry) {",
+    '  if (!entry || entry.value === undefined || entry.value === null || String(entry.value) === "") return;',
+    "  var detailBytes = grpcB64Bytes(entry.value);",
+    '  if (!detailBytes) { pm.expect.fail("grpc-status-details-bin trailer must carry base64-encoded bytes but was " + JSON.stringify(String(entry.value))); return; }',
+    "  var statusFields = grpcPbFields(detailBytes);",
+    '  if (!statusFields) { pm.expect.fail("grpc-status-details-bin does not decode as a protobuf wire message (google.rpc.Status)"); return; }',
+    "  statusFields.forEach(function (statusField) {",
+    "    if (statusField.field === 1) {",
+    '      if (statusField.wire !== 0) { pm.expect.fail("google.rpc.Status.code (field 1) in grpc-status-details-bin must be varint-encoded"); return; }',
+    '      if (statusField.value < 0 || statusField.value > 16) pm.expect.fail("google.rpc.Status.code in grpc-status-details-bin must be a canonical gRPC code 0-16 but was " + statusField.value);',
+    '      else if (statusField.value !== pm.response.code) pm.expect.fail("google.rpc.Status.code in grpc-status-details-bin (" + statusField.value + ") disagrees with the reported status code (" + pm.response.code + ")");',
+    "    } else if (statusField.field === 2) {",
+    '      if (statusField.wire !== 2) pm.expect.fail("google.rpc.Status.message (field 2) in grpc-status-details-bin must be length-delimited");',
+    "    } else if (statusField.field === 3) {",
+    '      if (statusField.wire !== 2) { pm.expect.fail("google.rpc.Status.details (field 3) in grpc-status-details-bin must be length-delimited google.protobuf.Any messages"); return; }',
+    "      var anyFields = grpcPbFields(statusField.bytes);",
+    '      if (!anyFields) { pm.expect.fail("google.rpc.Status.details entry in grpc-status-details-bin is not a decodable google.protobuf.Any message"); return; }',
+    "      var hasTypeUrl = anyFields.some(function (anyField) { return anyField.field === 1 && anyField.wire === 2 && anyField.bytes.length > 0; });",
+    '      if (!hasTypeUrl) pm.expect.fail("google.protobuf.Any in grpc-status-details-bin details must carry a non-empty type_url (field 1)");',
+    "    }",
+    "  });",
+    "}",
     `pm.test('gRPC status is OK for ' + grpcSpec.methodPath, function () {`,
     '  pm.expect(pm.response.code, "gRPC call for " + grpcSpec.methodPath + " returned " + grpcStatusName() + " (" + pm.response.code + ")").to.eql(0);',
     "});",
@@ -297810,6 +297899,7 @@ function createGrpcScript(spec) {
     '    if (!Number.isInteger(echoedCode) || echoedCode < 0 || echoedCode > 16) pm.expect.fail("grpc-status trailer must be a canonical gRPC code 0-16 but was " + JSON.stringify(echoedStatus.value));',
     '    else if (echoedCode !== pm.response.code) pm.expect.fail("grpc-status trailer (" + echoedCode + ") disagrees with the reported status code (" + pm.response.code + ")");',
     "  }",
+    '  grpcCheckStatusDetailsBin(grpcMetaOne(pm.response.trailers, "grpc-status-details-bin"));',
     "});",
     // Terminal-response-message expectation. unary and client-streaming RPCs
     // return exactly one terminal response message; server/bidi streaming may
@@ -303648,6 +303738,7 @@ function createSoapScript(operation, warnings = []) {
   };
   const responseRegex = operation.expectedResponseElement ? elementPresenceRegex(operation.expectedResponseElement) : "";
   const mediaType = operation.soapVersion === "1.2" ? "application/soap+xml" : "text/xml";
+  const envelopeNs = operation.soapVersion === "1.2" ? "http://www.w3.org/2003/05/soap-envelope" : "http://schemas.xmlsoap.org/soap/envelope/";
   const faultStatusLine = operation.soapVersion === "1.2" ? '  if (faulted && code !== 500 && code !== 400) pm.expect.fail("SOAP 1.2 Faults ride HTTP 500, or 400 for env:Sender faults (SOAP 1.2 Part 2 HTTP binding); got HTTP " + code);' : '  if (faulted && code !== 500) pm.expect.fail("SOAP 1.1 Faults must ride HTTP 500 (WS-I Basic Profile R1126); got HTTP " + code);';
   const lines = [
     `var soap = JSON.parse(${JSON.stringify(JSON.stringify(meta))});`,
@@ -303670,6 +303761,11 @@ function createSoapScript(operation, warnings = []) {
     '  pm.expect(bodyText, "response body is not a SOAP envelope").to.match(matchTag("Envelope"));',
     "});",
     "",
+    `pm.test('SOAP Envelope namespace matches SOAP ${operation.soapVersion}', function () {`,
+    '  if (!matchTag("Envelope").test(bodyText)) return;',
+    `  pm.expect(bodyText.indexOf(${JSON.stringify(envelopeNs)}) !== -1, "SOAP ${operation.soapVersion} envelopes must declare the ${envelopeNs} namespace").to.equal(true);`,
+    "});",
+    "",
     "pm.test('SOAP Body element is present', function () {",
     '  pm.expect(bodyText, "SOAP envelope has no Body element").to.match(matchTag("Body"));',
     "});",
@@ -303687,7 +303783,33 @@ function createSoapScript(operation, warnings = []) {
     "  var code = pm.response.code;",
     faultStatusLine,
     '  if (!faulted && code === 500) pm.expect.fail("HTTP 500 from a SOAP endpoint must carry a SOAP Fault in the body");',
-    "});"
+    "});",
+    // Fault well-formedness (diagnostic companion to the Fault-absence test: a
+    // faulted run already fails, this pinpoints a malformed Fault). SOAP 1.1
+    // section 4.4 requires faultcode + faultstring children; SOAP 1.2 Part 1
+    // section 5.4 requires Code/Value + Reason/Text and pins the top-level
+    // Value QName to the five defined fault codes.
+    ...operation.soapVersion === "1.2" ? [
+      "",
+      "pm.test('SOAP Fault is well-formed for SOAP 1.2', function () {",
+      '  if (!matchTag("Fault").test(bodyText)) return;',
+      '  if (!matchTag("Code").test(bodyText)) { pm.expect.fail("a SOAP 1.2 Fault must carry an env:Code child (SOAP 1.2 Part 1 section 5.4)"); return; }',
+      '  if (!matchTag("Value").test(bodyText)) { pm.expect.fail("a SOAP 1.2 Fault Code must carry an env:Value child (SOAP 1.2 Part 1 section 5.4.1)"); return; }',
+      '  if (!matchTag("Reason").test(bodyText)) pm.expect.fail("a SOAP 1.2 Fault must carry an env:Reason child (SOAP 1.2 Part 1 section 5.4)");',
+      '  else if (!matchTag("Text").test(bodyText)) pm.expect.fail("a SOAP 1.2 Fault Reason must carry an env:Text child (SOAP 1.2 Part 1 section 5.4.2)");',
+      '  var faultValue = (bodyText.match(/<(?:[A-Za-z_][\\w.-]*:)?Value[^>]*>([\\s\\S]*?)<\\//) || [])[1] || "";',
+      '  var faultLocal = faultValue.trim().split(":").pop();',
+      '  var faultCodes = ["VersionMismatch", "MustUnderstand", "DataEncodingUnknown", "Sender", "Receiver"];',
+      '  if (faultLocal && faultCodes.indexOf(faultLocal) === -1) pm.expect.fail("the SOAP 1.2 Fault Code Value must be one of " + faultCodes.join(", ") + " (SOAP 1.2 Part 1 table 4); got " + faultValue.trim());',
+      "});"
+    ] : [
+      "",
+      "pm.test('SOAP Fault is well-formed for SOAP 1.1', function () {",
+      '  if (!matchTag("Fault").test(bodyText)) return;',
+      '  if (!matchTag("faultcode").test(bodyText)) pm.expect.fail("a SOAP 1.1 Fault must carry a faultcode child (SOAP 1.1 section 4.4)");',
+      '  if (!matchTag("faultstring").test(bodyText)) pm.expect.fail("a SOAP 1.1 Fault must carry a faultstring child (SOAP 1.1 section 4.4)");',
+      "});"
+    ]
   ];
   if (responseRegex) {
     lines.push(
@@ -303864,7 +303986,8 @@ function wsBindingKeyValues(channel) {
   const value = asRecord15(wsBinding.value()) ?? {};
   return {
     headers: bindingKeyValues(value.headers),
-    queryParams: bindingKeyValues(value.query)
+    queryParams: bindingKeyValues(value.query),
+    binding: value
   };
 }
 function collectMqttInfo(channel, servers, messagesRaw, documentJson) {
@@ -303938,6 +304061,8 @@ function messageDescriptor2(message, warnings, channelId, defaultContentType, re
   const replySchema = replyByMessageId.get(message.id());
   const ackSchema = xAckSchema ?? replySchema;
   const ackSource = xAckSchema ? "x-ack" : replySchema ? "reply" : void 0;
+  const correlationRaw = asRecord15(rawMessage.correlationId)?.location;
+  const correlationLocation = typeof correlationRaw === "string" ? correlationRaw : void 0;
   const examples = message.examples().all().filter((example) => example.hasPayload());
   const hasExample = examples.length > 0;
   let sample;
@@ -303959,6 +304084,7 @@ function messageDescriptor2(message, warnings, channelId, defaultContentType, re
     payloadSchema,
     ackSchema,
     ackSource,
+    correlationLocation,
     sample,
     hasExample,
     contentKind,
@@ -303971,6 +304097,7 @@ function channelDescriptor(channel, document2, documentJson, defaultContentType,
   const servers = resolveServers(channel, document2);
   const messagesRaw = channel.messages().all();
   const transport = detectTransport(channel, servers, messagesRaw, documentJson, warnings);
+  const parameterNames = Object.keys(asRecord15(channel.json().parameters) ?? {}).sort();
   const serverUrl = servers.find((server) => server.url())?.url() || options.endpointUrl?.trim() || "";
   if (!serverUrl) {
     warnings.push(`ASYNCAPI_NO_SERVER_URL: channel ${channel.id()} has no resolvable server url; the generated request url is derived from the channel address only and must be completed before use`);
@@ -303990,6 +304117,7 @@ function channelDescriptor(channel, document2, documentJson, defaultContentType,
       headers: [],
       queryParams: [],
       mqtt: collectMqttInfo(channel, servers, messagesRaw, documentJson),
+      parameterNames,
       messages,
       warnings
     };
@@ -304004,11 +304132,12 @@ function channelDescriptor(channel, document2, documentJson, defaultContentType,
       queryParams: [],
       socketioNamespace: address.startsWith("/") ? address : `/${address}`,
       socketioPath: DEFAULT_SOCKETIO_PATH,
+      parameterNames,
       messages,
       warnings
     };
   }
-  const { headers, queryParams } = wsBindingKeyValues(channel);
+  const { headers, queryParams, binding } = wsBindingKeyValues(channel);
   return {
     id: channel.id(),
     address,
@@ -304016,6 +304145,8 @@ function channelDescriptor(channel, document2, documentJson, defaultContentType,
     url: joinUrl(serverUrl, address),
     headers,
     queryParams,
+    parameterNames,
+    wsBinding: binding,
     messages,
     warnings
   };
@@ -304453,14 +304584,68 @@ function collectMessageNodeIds(node, ids, path10) {
     if (record) collectMessageNodeIds(record, ids, `${path10}/${i}`);
   });
 }
+function validateChannelParameters(channel, warnings) {
+  const declared = new Set(channel.parameterNames ?? []);
+  const used = /* @__PURE__ */ new Set();
+  for (const match of channel.address.matchAll(/\{([^{}]*)\}/g)) {
+    const name = match[1] ?? "";
+    if (!name) {
+      warnings.push(`ASYNCAPI_CHANNEL_PARAMETER_INVALID: channel ${channel.id} address ${channel.address} contains an empty {} parameter expression`);
+      continue;
+    }
+    used.add(name);
+    if (!declared.has(name)) {
+      warnings.push(`ASYNCAPI_CHANNEL_PARAMETER_UNDECLARED: channel ${channel.id} address parameter {${name}} has no entry in the channel parameters object; AsyncAPI requires every address parameter to be declared`);
+    }
+  }
+  for (const name of declared) {
+    if (!used.has(name)) {
+      warnings.push(`ASYNCAPI_CHANNEL_PARAMETER_UNUSED: channel ${channel.id} declares parameter ${name} that never appears in the channel address ${channel.address}`);
+    }
+  }
+}
+var CORRELATION_LOCATION_GRAMMAR = /^\$message\.(header|payload)#(\/(?:[^~/]|~[01])*)+$/;
+function validateCorrelationLocation(channelId, message, warnings) {
+  if (message.correlationLocation === void 0) return;
+  if (!CORRELATION_LOCATION_GRAMMAR.test(message.correlationLocation)) {
+    warnings.push(
+      `ASYNCAPI_CORRELATION_LOCATION_INVALID: message ${message.id} on channel ${channelId} correlationId location ${JSON.stringify(message.correlationLocation)} is not a valid AsyncAPI runtime expression ($message.header#/<pointer> or $message.payload#/<pointer>)`
+    );
+  }
+}
+var SOCKETIO_RESERVED_EVENTS = /* @__PURE__ */ new Set(["connect", "connect_error", "disconnect", "disconnecting", "newListener", "removeListener"]);
+function validateWsBinding(channel, warnings) {
+  const binding = channel.wsBinding;
+  if (!binding) return;
+  const method = binding.method;
+  if (method !== void 0 && (typeof method !== "string" || method !== "GET" && method !== "POST")) {
+    warnings.push(`ASYNCAPI_WS_BINDING_INVALID: channel ${channel.id} ws binding method must be "GET" or "POST" but was ${JSON.stringify(method)}`);
+  }
+  for (const key of ["query", "headers"]) {
+    const schema = binding[key];
+    if (schema === void 0) continue;
+    const record = asRecord16(schema);
+    if (!record || record.type !== void 0 && record.type !== "object") {
+      warnings.push(`ASYNCAPI_WS_BINDING_INVALID: channel ${channel.id} ws binding ${key} must be a Schema Object of type object`);
+    }
+  }
+}
 function instrumentAsyncApiCollection(collection, index) {
   const warnings = [
     ...index.warnings,
     ...index.channels.flatMap((channel) => channel.warnings)
   ];
   for (const channel of index.channels) {
+    validateChannelParameters(channel, warnings);
     if (channel.transport === "mqtt") validateMqttChannel(channel, warnings);
+    if (channel.transport === "ws-raw") validateWsBinding(channel, warnings);
     for (const message of channel.messages) {
+      if (channel.transport === "socketio" && SOCKETIO_RESERVED_EVENTS.has(message.eventName)) {
+        warnings.push(
+          `ASYNCAPI_SOCKETIO_RESERVED_EVENT: message ${message.id} on channel ${channel.id} uses the reserved Socket.IO event name "${message.eventName}"; reserved lifecycle events cannot be emitted or received as application events`
+        );
+      }
+      validateCorrelationLocation(channel.id, message, warnings);
       validateMessage(index, channel.id, message, warnings);
     }
   }
@@ -304638,6 +304823,7 @@ function toolDescriptor(tool, warnings) {
     description: typeof tool.description === "string" ? tool.description : void 0,
     inputSchema,
     outputSchema: asRecord17(tool.outputSchema) ?? void 0,
+    annotations: asRecord17(tool.annotations) ?? void 0,
     sampleArguments: inputSchema ? sampleFromSchema2(inputSchema, 0) : {},
     warnings: toolWarnings
   };
@@ -304838,10 +305024,41 @@ function validateServer(server, warnings) {
     }
   }
 }
+var TOOL_ANNOTATION_BOOLEAN_HINTS = ["readOnlyHint", "destructiveHint", "idempotentHint", "openWorldHint"];
+function validateToolAnnotations(tool, warnings) {
+  if (!tool.annotations) return;
+  for (const hint of TOOL_ANNOTATION_BOOLEAN_HINTS) {
+    const value = tool.annotations[hint];
+    if (value !== void 0 && typeof value !== "boolean") {
+      warnings.push(`MCP_TOOL_ANNOTATION_INVALID: tool ${tool.name} annotations.${hint} must be a boolean (MCP ToolAnnotations); got ${JSON.stringify(value)}`);
+    }
+  }
+  if (tool.annotations.title !== void 0 && typeof tool.annotations.title !== "string") {
+    warnings.push(`MCP_TOOL_ANNOTATION_INVALID: tool ${tool.name} annotations.title must be a string (MCP ToolAnnotations); got ${JSON.stringify(tool.annotations.title)}`);
+  }
+}
+function validateToolOutputSchema(index, tool, warnings) {
+  if (!tool.outputSchema) return;
+  const declaredType = tool.outputSchema.type;
+  if (declaredType !== void 0 && declaredType !== "object") {
+    warnings.push(`MCP_TOOL_OUTPUT_SCHEMA_INVALID: tool ${tool.name} outputSchema type is ${JSON.stringify(declaredType)}; the MCP specification requires tool output schemas to describe the structuredContent object`);
+  }
+  const packed = packSchema(index.documentJson, tool.outputSchema, "3.0", "response");
+  if (packed.unsupported) {
+    const code = isSchemaGraphOverflow(packed) ? "MCP_SCHEMA_NOT_COMPILED" : "MCP_TOOL_OUTPUT_SCHEMA_NOT_VALIDATED";
+    warnings.push(`${code}: tool ${tool.name} outputSchema is not validated (${packed.unsupported})`);
+    return;
+  }
+  if (!compileSchemaValidator(packed.schema)) {
+    warnings.push(`MCP_TOOL_OUTPUT_SCHEMA_NOT_VALIDATED: tool ${tool.name} outputSchema could not be compiled to a validator`);
+  }
+}
 function validateTool(index, tool, warnings) {
   if (!TOOL_NAME_RE.test(tool.name)) {
     warnings.push(`MCP_TOOL_NAME_UNCONVENTIONAL: tool name "${tool.name}" is outside the conventional [A-Za-z0-9_./-]{1,128} identifier set`);
   }
+  validateToolAnnotations(tool, warnings);
+  validateToolOutputSchema(index, tool, warnings);
   if (!tool.inputSchema) return;
   const declaredType = tool.inputSchema.type;
   if (declaredType !== void 0 && declaredType !== "object") {

package/dist/cli.cjs

@@ -295272,12 +295272,36 @@ function buildOperationScript(operation, index, warnings) {
     '    if (mediaType === "application/json" && gqlBody.data !== undefined && gqlBody.data !== null && pm.response.code !== 200) { pm.expect.fail("a GraphQL response carrying data over application/json must be HTTP 200; got " + pm.response.code); }',
     "});"
   );
+  lines.push(
+    `pm.test(${JSON.stringify(`[${label}] GraphQL response map follows the spec response format`)}, function () {`,
+    '    var extraKeys = Object.keys(gqlBody).filter(function (key) { return key !== "data" && key !== "errors" && key !== "extensions"; });',
+    '    if (extraKeys.length > 0) pm.expect.fail("the GraphQL response map must not contain entries other than data, errors, and extensions (GraphQL spec 7.1): " + extraKeys.join(", "));',
+    '    if (Object.prototype.hasOwnProperty.call(gqlBody, "extensions") && (typeof gqlBody.extensions !== "object" || gqlBody.extensions === null || Array.isArray(gqlBody.extensions))) pm.expect.fail("the GraphQL extensions entry must be a map (GraphQL spec 7.1)");',
+    '    if (!Object.prototype.hasOwnProperty.call(gqlBody, "data") && (!Array.isArray(gqlBody.errors) || gqlBody.errors.length === 0)) pm.expect.fail("a GraphQL request-error result (no data entry) must carry a non-empty errors list (GraphQL spec 7.1)");',
+    "});"
+  );
   lines.push(
     `pm.test(${JSON.stringify(`[${label}] GraphQL errors are well-formed and not a total failure`)}, function () {`,
     "    var errors = gqlBody.errors;",
     "    if (errors === undefined || errors === null) return;",
     `    pm.expect(errors, "GraphQL 'errors' must be an array when present").to.be.an("array");`,
-    '    errors.forEach(function (err) { pm.expect(err, "each GraphQL error must carry a message").to.be.an("object").that.has.property("message"); });',
+    "    errors.forEach(function (err, errIndex) {",
+    '      pm.expect(err, "each GraphQL error must carry a message").to.be.an("object").that.has.property("message");',
+    '      if (typeof err.message !== "string") pm.expect.fail("errors[" + errIndex + "].message must be a string (GraphQL spec 7.1.2)");',
+    "      if (err.locations !== undefined && err.locations !== null) {",
+    '        if (!Array.isArray(err.locations)) { pm.expect.fail("errors[" + errIndex + "].locations must be a list (GraphQL spec 7.1.2)"); return; }',
+    "        err.locations.forEach(function (loc, locIndex) {",
+    '          var locLabel = "errors[" + errIndex + "].locations[" + locIndex + "]";',
+    '          if (!loc || typeof loc !== "object" || Array.isArray(loc)) { pm.expect.fail(locLabel + " must be a map with line and column (GraphQL spec 7.1.2)"); return; }',
+    '          if (!Number.isInteger(loc.line) || loc.line < 1 || !Number.isInteger(loc.column) || loc.column < 1) pm.expect.fail(locLabel + " line and column must be positive integers starting from 1 (GraphQL spec 7.1.2)");',
+    "        });",
+    "      }",
+    "      if (err.path !== undefined && err.path !== null) {",
+    '        if (!Array.isArray(err.path)) { pm.expect.fail("errors[" + errIndex + "].path must be a list of path segments (GraphQL spec 7.1.2)"); return; }',
+    '        err.path.forEach(function (segment, segIndex) { if (typeof segment !== "string" && !Number.isInteger(segment)) pm.expect.fail("errors[" + errIndex + "].path[" + segIndex + "] must be a string field name or an integer list index (GraphQL spec 7.1.2)"); });',
+    "      }",
+    '      if (err.extensions !== undefined && err.extensions !== null && (typeof err.extensions !== "object" || Array.isArray(err.extensions))) pm.expect.fail("errors[" + errIndex + "].extensions must be a map (GraphQL spec 7.1.2)");',
+    "    });",
     "    var hasData = gqlBody.data !== undefined && gqlBody.data !== null;",
     '    if (!hasData && errors.length > 0) { pm.expect.fail("GraphQL request returned errors and no data: " + JSON.stringify(errors)); }',
     "});"
@@ -296112,6 +296136,71 @@ function createGrpcScript(spec) {
     '    else if (!/^[\\x20-\\x7e]*$/.test(value)) pm.expect.fail(label + " " + key + " value must be printable ASCII (gRPC ASCII-Value)");',
     "  });",
     "}",
+    // grpc-status-details-bin carries a base64-encoded google.rpc.Status protobuf
+    // (the gRPC richer-error model). The sandbox has no protobuf runtime, so the
+    // script walks the protobuf wire format directly: base64 -> bytes -> tagged
+    // fields (varint / 64-bit / length-delimited / 32-bit). Groups (wire types
+    // 3/4) are proto2-deprecated and never emitted by google.rpc.Status.
+    "function grpcB64Bytes(value) {",
+    '  var clean = String(value).replace(/\\s+/g, "").replace(/-/g, "+").replace(/_/g, "/");',
+    "  if (clean.length % 4 === 1 || !/^[A-Za-z0-9+/]*={0,2}$/.test(clean)) return null;",
+    '  var alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";',
+    '  var unpadded = clean.replace(/=+$/, ""); var bytes = []; var buffer = 0; var bits = 0;',
+    "  for (var i = 0; i < unpadded.length; i++) {",
+    "    var idx = alphabet.indexOf(unpadded.charAt(i));",
+    "    if (idx === -1) return null;",
+    "    buffer = (buffer << 6) | idx; bits += 6;",
+    "    if (bits >= 8) { bits -= 8; bytes.push((buffer >> bits) & 0xff); }",
+    "  }",
+    "  return bytes;",
+    "}",
+    "function grpcPbVarint(bytes, pos) {",
+    "  var value = 0; var shift = 0;",
+    "  while (pos < bytes.length) {",
+    "    var b = bytes[pos]; pos += 1;",
+    "    value += (b & 0x7f) * Math.pow(2, shift); shift += 7;",
+    "    if ((b & 0x80) === 0) return value > 9007199254740991 ? null : { value: value, pos: pos };",
+    "    if (shift > 63) return null;",
+    "  }",
+    "  return null;",
+    "}",
+    "function grpcPbFields(bytes) {",
+    "  var pos = 0; var fields = [];",
+    "  while (pos < bytes.length) {",
+    "    var tag = grpcPbVarint(bytes, pos); if (!tag) return null;",
+    "    pos = tag.pos;",
+    "    var fieldNumber = Math.floor(tag.value / 8); var wire = tag.value % 8;",
+    "    if (fieldNumber < 1) return null;",
+    "    if (wire === 0) { var varint = grpcPbVarint(bytes, pos); if (!varint) return null; fields.push({ field: fieldNumber, wire: 0, value: varint.value }); pos = varint.pos; }",
+    "    else if (wire === 1) { if (pos + 8 > bytes.length) return null; fields.push({ field: fieldNumber, wire: 1 }); pos += 8; }",
+    "    else if (wire === 2) { var len = grpcPbVarint(bytes, pos); if (!len) return null; pos = len.pos; if (pos + len.value > bytes.length) return null; fields.push({ field: fieldNumber, wire: 2, bytes: bytes.slice(pos, pos + len.value) }); pos += len.value; }",
+    "    else if (wire === 5) { if (pos + 4 > bytes.length) return null; fields.push({ field: fieldNumber, wire: 5 }); pos += 4; }",
+    "    else return null;",
+    "  }",
+    "  return fields;",
+    "}",
+    "function grpcCheckStatusDetailsBin(entry) {",
+    '  if (!entry || entry.value === undefined || entry.value === null || String(entry.value) === "") return;',
+    "  var detailBytes = grpcB64Bytes(entry.value);",
+    '  if (!detailBytes) { pm.expect.fail("grpc-status-details-bin trailer must carry base64-encoded bytes but was " + JSON.stringify(String(entry.value))); return; }',
+    "  var statusFields = grpcPbFields(detailBytes);",
+    '  if (!statusFields) { pm.expect.fail("grpc-status-details-bin does not decode as a protobuf wire message (google.rpc.Status)"); return; }',
+    "  statusFields.forEach(function (statusField) {",
+    "    if (statusField.field === 1) {",
+    '      if (statusField.wire !== 0) { pm.expect.fail("google.rpc.Status.code (field 1) in grpc-status-details-bin must be varint-encoded"); return; }',
+    '      if (statusField.value < 0 || statusField.value > 16) pm.expect.fail("google.rpc.Status.code in grpc-status-details-bin must be a canonical gRPC code 0-16 but was " + statusField.value);',
+    '      else if (statusField.value !== pm.response.code) pm.expect.fail("google.rpc.Status.code in grpc-status-details-bin (" + statusField.value + ") disagrees with the reported status code (" + pm.response.code + ")");',
+    "    } else if (statusField.field === 2) {",
+    '      if (statusField.wire !== 2) pm.expect.fail("google.rpc.Status.message (field 2) in grpc-status-details-bin must be length-delimited");',
+    "    } else if (statusField.field === 3) {",
+    '      if (statusField.wire !== 2) { pm.expect.fail("google.rpc.Status.details (field 3) in grpc-status-details-bin must be length-delimited google.protobuf.Any messages"); return; }',
+    "      var anyFields = grpcPbFields(statusField.bytes);",
+    '      if (!anyFields) { pm.expect.fail("google.rpc.Status.details entry in grpc-status-details-bin is not a decodable google.protobuf.Any message"); return; }',
+    "      var hasTypeUrl = anyFields.some(function (anyField) { return anyField.field === 1 && anyField.wire === 2 && anyField.bytes.length > 0; });",
+    '      if (!hasTypeUrl) pm.expect.fail("google.protobuf.Any in grpc-status-details-bin details must carry a non-empty type_url (field 1)");',
+    "    }",
+    "  });",
+    "}",
     `pm.test('gRPC status is OK for ' + grpcSpec.methodPath, function () {`,
     '  pm.expect(pm.response.code, "gRPC call for " + grpcSpec.methodPath + " returned " + grpcStatusName() + " (" + pm.response.code + ")").to.eql(0);',
     "});",
@@ -296128,6 +296217,7 @@ function createGrpcScript(spec) {
     '    if (!Number.isInteger(echoedCode) || echoedCode < 0 || echoedCode > 16) pm.expect.fail("grpc-status trailer must be a canonical gRPC code 0-16 but was " + JSON.stringify(echoedStatus.value));',
     '    else if (echoedCode !== pm.response.code) pm.expect.fail("grpc-status trailer (" + echoedCode + ") disagrees with the reported status code (" + pm.response.code + ")");',
     "  }",
+    '  grpcCheckStatusDetailsBin(grpcMetaOne(pm.response.trailers, "grpc-status-details-bin"));',
     "});",
     // Terminal-response-message expectation. unary and client-streaming RPCs
     // return exactly one terminal response message; server/bidi streaming may
@@ -301966,6 +302056,7 @@ function createSoapScript(operation, warnings = []) {
   };
   const responseRegex = operation.expectedResponseElement ? elementPresenceRegex(operation.expectedResponseElement) : "";
   const mediaType = operation.soapVersion === "1.2" ? "application/soap+xml" : "text/xml";
+  const envelopeNs = operation.soapVersion === "1.2" ? "http://www.w3.org/2003/05/soap-envelope" : "http://schemas.xmlsoap.org/soap/envelope/";
   const faultStatusLine = operation.soapVersion === "1.2" ? '  if (faulted && code !== 500 && code !== 400) pm.expect.fail("SOAP 1.2 Faults ride HTTP 500, or 400 for env:Sender faults (SOAP 1.2 Part 2 HTTP binding); got HTTP " + code);' : '  if (faulted && code !== 500) pm.expect.fail("SOAP 1.1 Faults must ride HTTP 500 (WS-I Basic Profile R1126); got HTTP " + code);';
   const lines = [
     `var soap = JSON.parse(${JSON.stringify(JSON.stringify(meta))});`,
@@ -301988,6 +302079,11 @@ function createSoapScript(operation, warnings = []) {
     '  pm.expect(bodyText, "response body is not a SOAP envelope").to.match(matchTag("Envelope"));',
     "});",
     "",
+    `pm.test('SOAP Envelope namespace matches SOAP ${operation.soapVersion}', function () {`,
+    '  if (!matchTag("Envelope").test(bodyText)) return;',
+    `  pm.expect(bodyText.indexOf(${JSON.stringify(envelopeNs)}) !== -1, "SOAP ${operation.soapVersion} envelopes must declare the ${envelopeNs} namespace").to.equal(true);`,
+    "});",
+    "",
     "pm.test('SOAP Body element is present', function () {",
     '  pm.expect(bodyText, "SOAP envelope has no Body element").to.match(matchTag("Body"));',
     "});",
@@ -302005,7 +302101,33 @@ function createSoapScript(operation, warnings = []) {
     "  var code = pm.response.code;",
     faultStatusLine,
     '  if (!faulted && code === 500) pm.expect.fail("HTTP 500 from a SOAP endpoint must carry a SOAP Fault in the body");',
-    "});"
+    "});",
+    // Fault well-formedness (diagnostic companion to the Fault-absence test: a
+    // faulted run already fails, this pinpoints a malformed Fault). SOAP 1.1
+    // section 4.4 requires faultcode + faultstring children; SOAP 1.2 Part 1
+    // section 5.4 requires Code/Value + Reason/Text and pins the top-level
+    // Value QName to the five defined fault codes.
+    ...operation.soapVersion === "1.2" ? [
+      "",
+      "pm.test('SOAP Fault is well-formed for SOAP 1.2', function () {",
+      '  if (!matchTag("Fault").test(bodyText)) return;',
+      '  if (!matchTag("Code").test(bodyText)) { pm.expect.fail("a SOAP 1.2 Fault must carry an env:Code child (SOAP 1.2 Part 1 section 5.4)"); return; }',
+      '  if (!matchTag("Value").test(bodyText)) { pm.expect.fail("a SOAP 1.2 Fault Code must carry an env:Value child (SOAP 1.2 Part 1 section 5.4.1)"); return; }',
+      '  if (!matchTag("Reason").test(bodyText)) pm.expect.fail("a SOAP 1.2 Fault must carry an env:Reason child (SOAP 1.2 Part 1 section 5.4)");',
+      '  else if (!matchTag("Text").test(bodyText)) pm.expect.fail("a SOAP 1.2 Fault Reason must carry an env:Text child (SOAP 1.2 Part 1 section 5.4.2)");',
+      '  var faultValue = (bodyText.match(/<(?:[A-Za-z_][\\w.-]*:)?Value[^>]*>([\\s\\S]*?)<\\//) || [])[1] || "";',
+      '  var faultLocal = faultValue.trim().split(":").pop();',
+      '  var faultCodes = ["VersionMismatch", "MustUnderstand", "DataEncodingUnknown", "Sender", "Receiver"];',
+      '  if (faultLocal && faultCodes.indexOf(faultLocal) === -1) pm.expect.fail("the SOAP 1.2 Fault Code Value must be one of " + faultCodes.join(", ") + " (SOAP 1.2 Part 1 table 4); got " + faultValue.trim());',
+      "});"
+    ] : [
+      "",
+      "pm.test('SOAP Fault is well-formed for SOAP 1.1', function () {",
+      '  if (!matchTag("Fault").test(bodyText)) return;',
+      '  if (!matchTag("faultcode").test(bodyText)) pm.expect.fail("a SOAP 1.1 Fault must carry a faultcode child (SOAP 1.1 section 4.4)");',
+      '  if (!matchTag("faultstring").test(bodyText)) pm.expect.fail("a SOAP 1.1 Fault must carry a faultstring child (SOAP 1.1 section 4.4)");',
+      "});"
+    ]
   ];
   if (responseRegex) {
     lines.push(
@@ -302182,7 +302304,8 @@ function wsBindingKeyValues(channel) {
   const value = asRecord15(wsBinding.value()) ?? {};
   return {
     headers: bindingKeyValues(value.headers),
-    queryParams: bindingKeyValues(value.query)
+    queryParams: bindingKeyValues(value.query),
+    binding: value
   };
 }
 function collectMqttInfo(channel, servers, messagesRaw, documentJson) {
@@ -302256,6 +302379,8 @@ function messageDescriptor2(message, warnings, channelId, defaultContentType, re
   const replySchema = replyByMessageId.get(message.id());
   const ackSchema = xAckSchema ?? replySchema;
   const ackSource = xAckSchema ? "x-ack" : replySchema ? "reply" : void 0;
+  const correlationRaw = asRecord15(rawMessage.correlationId)?.location;
+  const correlationLocation = typeof correlationRaw === "string" ? correlationRaw : void 0;
   const examples = message.examples().all().filter((example) => example.hasPayload());
   const hasExample = examples.length > 0;
   let sample;
@@ -302277,6 +302402,7 @@ function messageDescriptor2(message, warnings, channelId, defaultContentType, re
     payloadSchema,
     ackSchema,
     ackSource,
+    correlationLocation,
     sample,
     hasExample,
     contentKind,
@@ -302289,6 +302415,7 @@ function channelDescriptor(channel, document2, documentJson, defaultContentType,
   const servers = resolveServers(channel, document2);
   const messagesRaw = channel.messages().all();
   const transport = detectTransport(channel, servers, messagesRaw, documentJson, warnings);
+  const parameterNames = Object.keys(asRecord15(channel.json().parameters) ?? {}).sort();
   const serverUrl = servers.find((server) => server.url())?.url() || options.endpointUrl?.trim() || "";
   if (!serverUrl) {
     warnings.push(`ASYNCAPI_NO_SERVER_URL: channel ${channel.id()} has no resolvable server url; the generated request url is derived from the channel address only and must be completed before use`);
@@ -302308,6 +302435,7 @@ function channelDescriptor(channel, document2, documentJson, defaultContentType,
       headers: [],
       queryParams: [],
       mqtt: collectMqttInfo(channel, servers, messagesRaw, documentJson),
+      parameterNames,
       messages,
       warnings
     };
@@ -302322,11 +302450,12 @@ function channelDescriptor(channel, document2, documentJson, defaultContentType,
       queryParams: [],
       socketioNamespace: address.startsWith("/") ? address : `/${address}`,
       socketioPath: DEFAULT_SOCKETIO_PATH,
+      parameterNames,
       messages,
       warnings
     };
   }
-  const { headers, queryParams } = wsBindingKeyValues(channel);
+  const { headers, queryParams, binding } = wsBindingKeyValues(channel);
   return {
     id: channel.id(),
     address,
@@ -302334,6 +302463,8 @@ function channelDescriptor(channel, document2, documentJson, defaultContentType,
     url: joinUrl(serverUrl, address),
     headers,
     queryParams,
+    parameterNames,
+    wsBinding: binding,
     messages,
     warnings
   };
@@ -302771,14 +302902,68 @@ function collectMessageNodeIds(node, ids, path8) {
     if (record) collectMessageNodeIds(record, ids, `${path8}/${i}`);
   });
 }
+function validateChannelParameters(channel, warnings) {
+  const declared = new Set(channel.parameterNames ?? []);
+  const used = /* @__PURE__ */ new Set();
+  for (const match of channel.address.matchAll(/\{([^{}]*)\}/g)) {
+    const name = match[1] ?? "";
+    if (!name) {
+      warnings.push(`ASYNCAPI_CHANNEL_PARAMETER_INVALID: channel ${channel.id} address ${channel.address} contains an empty {} parameter expression`);
+      continue;
+    }
+    used.add(name);
+    if (!declared.has(name)) {
+      warnings.push(`ASYNCAPI_CHANNEL_PARAMETER_UNDECLARED: channel ${channel.id} address parameter {${name}} has no entry in the channel parameters object; AsyncAPI requires every address parameter to be declared`);
+    }
+  }
+  for (const name of declared) {
+    if (!used.has(name)) {
+      warnings.push(`ASYNCAPI_CHANNEL_PARAMETER_UNUSED: channel ${channel.id} declares parameter ${name} that never appears in the channel address ${channel.address}`);
+    }
+  }
+}
+var CORRELATION_LOCATION_GRAMMAR = /^\$message\.(header|payload)#(\/(?:[^~/]|~[01])*)+$/;
+function validateCorrelationLocation(channelId, message, warnings) {
+  if (message.correlationLocation === void 0) return;
+  if (!CORRELATION_LOCATION_GRAMMAR.test(message.correlationLocation)) {
+    warnings.push(
+      `ASYNCAPI_CORRELATION_LOCATION_INVALID: message ${message.id} on channel ${channelId} correlationId location ${JSON.stringify(message.correlationLocation)} is not a valid AsyncAPI runtime expression ($message.header#/<pointer> or $message.payload#/<pointer>)`
+    );
+  }
+}
+var SOCKETIO_RESERVED_EVENTS = /* @__PURE__ */ new Set(["connect", "connect_error", "disconnect", "disconnecting", "newListener", "removeListener"]);
+function validateWsBinding(channel, warnings) {
+  const binding = channel.wsBinding;
+  if (!binding) return;
+  const method = binding.method;
+  if (method !== void 0 && (typeof method !== "string" || method !== "GET" && method !== "POST")) {
+    warnings.push(`ASYNCAPI_WS_BINDING_INVALID: channel ${channel.id} ws binding method must be "GET" or "POST" but was ${JSON.stringify(method)}`);
+  }
+  for (const key of ["query", "headers"]) {
+    const schema = binding[key];
+    if (schema === void 0) continue;
+    const record = asRecord16(schema);
+    if (!record || record.type !== void 0 && record.type !== "object") {
+      warnings.push(`ASYNCAPI_WS_BINDING_INVALID: channel ${channel.id} ws binding ${key} must be a Schema Object of type object`);
+    }
+  }
+}
 function instrumentAsyncApiCollection(collection, index) {
   const warnings = [
     ...index.warnings,
     ...index.channels.flatMap((channel) => channel.warnings)
   ];
   for (const channel of index.channels) {
+    validateChannelParameters(channel, warnings);
     if (channel.transport === "mqtt") validateMqttChannel(channel, warnings);
+    if (channel.transport === "ws-raw") validateWsBinding(channel, warnings);
     for (const message of channel.messages) {
+      if (channel.transport === "socketio" && SOCKETIO_RESERVED_EVENTS.has(message.eventName)) {
+        warnings.push(
+          `ASYNCAPI_SOCKETIO_RESERVED_EVENT: message ${message.id} on channel ${channel.id} uses the reserved Socket.IO event name "${message.eventName}"; reserved lifecycle events cannot be emitted or received as application events`
+        );
+      }
+      validateCorrelationLocation(channel.id, message, warnings);
       validateMessage(index, channel.id, message, warnings);
     }
   }
@@ -302956,6 +303141,7 @@ function toolDescriptor(tool, warnings) {
     description: typeof tool.description === "string" ? tool.description : void 0,
     inputSchema,
     outputSchema: asRecord17(tool.outputSchema) ?? void 0,
+    annotations: asRecord17(tool.annotations) ?? void 0,
     sampleArguments: inputSchema ? sampleFromSchema2(inputSchema, 0) : {},
     warnings: toolWarnings
   };
@@ -303156,10 +303342,41 @@ function validateServer(server, warnings) {
     }
   }
 }
+var TOOL_ANNOTATION_BOOLEAN_HINTS = ["readOnlyHint", "destructiveHint", "idempotentHint", "openWorldHint"];
+function validateToolAnnotations(tool, warnings) {
+  if (!tool.annotations) return;
+  for (const hint of TOOL_ANNOTATION_BOOLEAN_HINTS) {
+    const value = tool.annotations[hint];
+    if (value !== void 0 && typeof value !== "boolean") {
+      warnings.push(`MCP_TOOL_ANNOTATION_INVALID: tool ${tool.name} annotations.${hint} must be a boolean (MCP ToolAnnotations); got ${JSON.stringify(value)}`);
+    }
+  }
+  if (tool.annotations.title !== void 0 && typeof tool.annotations.title !== "string") {
+    warnings.push(`MCP_TOOL_ANNOTATION_INVALID: tool ${tool.name} annotations.title must be a string (MCP ToolAnnotations); got ${JSON.stringify(tool.annotations.title)}`);
+  }
+}
+function validateToolOutputSchema(index, tool, warnings) {
+  if (!tool.outputSchema) return;
+  const declaredType = tool.outputSchema.type;
+  if (declaredType !== void 0 && declaredType !== "object") {
+    warnings.push(`MCP_TOOL_OUTPUT_SCHEMA_INVALID: tool ${tool.name} outputSchema type is ${JSON.stringify(declaredType)}; the MCP specification requires tool output schemas to describe the structuredContent object`);
+  }
+  const packed = packSchema(index.documentJson, tool.outputSchema, "3.0", "response");
+  if (packed.unsupported) {
+    const code = isSchemaGraphOverflow(packed) ? "MCP_SCHEMA_NOT_COMPILED" : "MCP_TOOL_OUTPUT_SCHEMA_NOT_VALIDATED";
+    warnings.push(`${code}: tool ${tool.name} outputSchema is not validated (${packed.unsupported})`);
+    return;
+  }
+  if (!compileSchemaValidator(packed.schema)) {
+    warnings.push(`MCP_TOOL_OUTPUT_SCHEMA_NOT_VALIDATED: tool ${tool.name} outputSchema could not be compiled to a validator`);
+  }
+}
 function validateTool(index, tool, warnings) {
   if (!TOOL_NAME_RE.test(tool.name)) {
     warnings.push(`MCP_TOOL_NAME_UNCONVENTIONAL: tool name "${tool.name}" is outside the conventional [A-Za-z0-9_./-]{1,128} identifier set`);
   }
+  validateToolAnnotations(tool, warnings);
+  validateToolOutputSchema(index, tool, warnings);
   if (!tool.inputSchema) return;
   const declaredType = tool.inputSchema.type;
   if (declaredType !== void 0 && declaredType !== "object") {

package/dist/index.cjs

@@ -296971,12 +296971,36 @@ function buildOperationScript(operation, index, warnings) {
     '    if (mediaType === "application/json" && gqlBody.data !== undefined && gqlBody.data !== null && pm.response.code !== 200) { pm.expect.fail("a GraphQL response carrying data over application/json must be HTTP 200; got " + pm.response.code); }',
     "});"
   );
+  lines.push(
+    `pm.test(${JSON.stringify(`[${label}] GraphQL response map follows the spec response format`)}, function () {`,
+    '    var extraKeys = Object.keys(gqlBody).filter(function (key) { return key !== "data" && key !== "errors" && key !== "extensions"; });',
+    '    if (extraKeys.length > 0) pm.expect.fail("the GraphQL response map must not contain entries other than data, errors, and extensions (GraphQL spec 7.1): " + extraKeys.join(", "));',
+    '    if (Object.prototype.hasOwnProperty.call(gqlBody, "extensions") && (typeof gqlBody.extensions !== "object" || gqlBody.extensions === null || Array.isArray(gqlBody.extensions))) pm.expect.fail("the GraphQL extensions entry must be a map (GraphQL spec 7.1)");',
+    '    if (!Object.prototype.hasOwnProperty.call(gqlBody, "data") && (!Array.isArray(gqlBody.errors) || gqlBody.errors.length === 0)) pm.expect.fail("a GraphQL request-error result (no data entry) must carry a non-empty errors list (GraphQL spec 7.1)");',
+    "});"
+  );
   lines.push(
     `pm.test(${JSON.stringify(`[${label}] GraphQL errors are well-formed and not a total failure`)}, function () {`,
     "    var errors = gqlBody.errors;",
     "    if (errors === undefined || errors === null) return;",
     `    pm.expect(errors, "GraphQL 'errors' must be an array when present").to.be.an("array");`,
-    '    errors.forEach(function (err) { pm.expect(err, "each GraphQL error must carry a message").to.be.an("object").that.has.property("message"); });',
+    "    errors.forEach(function (err, errIndex) {",
+    '      pm.expect(err, "each GraphQL error must carry a message").to.be.an("object").that.has.property("message");',
+    '      if (typeof err.message !== "string") pm.expect.fail("errors[" + errIndex + "].message must be a string (GraphQL spec 7.1.2)");',
+    "      if (err.locations !== undefined && err.locations !== null) {",
+    '        if (!Array.isArray(err.locations)) { pm.expect.fail("errors[" + errIndex + "].locations must be a list (GraphQL spec 7.1.2)"); return; }',
+    "        err.locations.forEach(function (loc, locIndex) {",
+    '          var locLabel = "errors[" + errIndex + "].locations[" + locIndex + "]";',
+    '          if (!loc || typeof loc !== "object" || Array.isArray(loc)) { pm.expect.fail(locLabel + " must be a map with line and column (GraphQL spec 7.1.2)"); return; }',
+    '          if (!Number.isInteger(loc.line) || loc.line < 1 || !Number.isInteger(loc.column) || loc.column < 1) pm.expect.fail(locLabel + " line and column must be positive integers starting from 1 (GraphQL spec 7.1.2)");',
+    "        });",
+    "      }",
+    "      if (err.path !== undefined && err.path !== null) {",
+    '        if (!Array.isArray(err.path)) { pm.expect.fail("errors[" + errIndex + "].path must be a list of path segments (GraphQL spec 7.1.2)"); return; }',
+    '        err.path.forEach(function (segment, segIndex) { if (typeof segment !== "string" && !Number.isInteger(segment)) pm.expect.fail("errors[" + errIndex + "].path[" + segIndex + "] must be a string field name or an integer list index (GraphQL spec 7.1.2)"); });',
+    "      }",
+    '      if (err.extensions !== undefined && err.extensions !== null && (typeof err.extensions !== "object" || Array.isArray(err.extensions))) pm.expect.fail("errors[" + errIndex + "].extensions must be a map (GraphQL spec 7.1.2)");',
+    "    });",
     "    var hasData = gqlBody.data !== undefined && gqlBody.data !== null;",
     '    if (!hasData && errors.length > 0) { pm.expect.fail("GraphQL request returned errors and no data: " + JSON.stringify(errors)); }',
     "});"
@@ -297811,6 +297835,71 @@ function createGrpcScript(spec) {
     '    else if (!/^[\\x20-\\x7e]*$/.test(value)) pm.expect.fail(label + " " + key + " value must be printable ASCII (gRPC ASCII-Value)");',
     "  });",
     "}",
+    // grpc-status-details-bin carries a base64-encoded google.rpc.Status protobuf
+    // (the gRPC richer-error model). The sandbox has no protobuf runtime, so the
+    // script walks the protobuf wire format directly: base64 -> bytes -> tagged
+    // fields (varint / 64-bit / length-delimited / 32-bit). Groups (wire types
+    // 3/4) are proto2-deprecated and never emitted by google.rpc.Status.
+    "function grpcB64Bytes(value) {",
+    '  var clean = String(value).replace(/\\s+/g, "").replace(/-/g, "+").replace(/_/g, "/");',
+    "  if (clean.length % 4 === 1 || !/^[A-Za-z0-9+/]*={0,2}$/.test(clean)) return null;",
+    '  var alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";',
+    '  var unpadded = clean.replace(/=+$/, ""); var bytes = []; var buffer = 0; var bits = 0;',
+    "  for (var i = 0; i < unpadded.length; i++) {",
+    "    var idx = alphabet.indexOf(unpadded.charAt(i));",
+    "    if (idx === -1) return null;",
+    "    buffer = (buffer << 6) | idx; bits += 6;",
+    "    if (bits >= 8) { bits -= 8; bytes.push((buffer >> bits) & 0xff); }",
+    "  }",
+    "  return bytes;",
+    "}",
+    "function grpcPbVarint(bytes, pos) {",
+    "  var value = 0; var shift = 0;",
+    "  while (pos < bytes.length) {",
+    "    var b = bytes[pos]; pos += 1;",
+    "    value += (b & 0x7f) * Math.pow(2, shift); shift += 7;",
+    "    if ((b & 0x80) === 0) return value > 9007199254740991 ? null : { value: value, pos: pos };",
+    "    if (shift > 63) return null;",
+    "  }",
+    "  return null;",
+    "}",
+    "function grpcPbFields(bytes) {",
+    "  var pos = 0; var fields = [];",
+    "  while (pos < bytes.length) {",
+    "    var tag = grpcPbVarint(bytes, pos); if (!tag) return null;",
+    "    pos = tag.pos;",
+    "    var fieldNumber = Math.floor(tag.value / 8); var wire = tag.value % 8;",
+    "    if (fieldNumber < 1) return null;",
+    "    if (wire === 0) { var varint = grpcPbVarint(bytes, pos); if (!varint) return null; fields.push({ field: fieldNumber, wire: 0, value: varint.value }); pos = varint.pos; }",
+    "    else if (wire === 1) { if (pos + 8 > bytes.length) return null; fields.push({ field: fieldNumber, wire: 1 }); pos += 8; }",
+    "    else if (wire === 2) { var len = grpcPbVarint(bytes, pos); if (!len) return null; pos = len.pos; if (pos + len.value > bytes.length) return null; fields.push({ field: fieldNumber, wire: 2, bytes: bytes.slice(pos, pos + len.value) }); pos += len.value; }",
+    "    else if (wire === 5) { if (pos + 4 > bytes.length) return null; fields.push({ field: fieldNumber, wire: 5 }); pos += 4; }",
+    "    else return null;",
+    "  }",
+    "  return fields;",
+    "}",
+    "function grpcCheckStatusDetailsBin(entry) {",
+    '  if (!entry || entry.value === undefined || entry.value === null || String(entry.value) === "") return;',
+    "  var detailBytes = grpcB64Bytes(entry.value);",
+    '  if (!detailBytes) { pm.expect.fail("grpc-status-details-bin trailer must carry base64-encoded bytes but was " + JSON.stringify(String(entry.value))); return; }',
+    "  var statusFields = grpcPbFields(detailBytes);",
+    '  if (!statusFields) { pm.expect.fail("grpc-status-details-bin does not decode as a protobuf wire message (google.rpc.Status)"); return; }',
+    "  statusFields.forEach(function (statusField) {",
+    "    if (statusField.field === 1) {",
+    '      if (statusField.wire !== 0) { pm.expect.fail("google.rpc.Status.code (field 1) in grpc-status-details-bin must be varint-encoded"); return; }',
+    '      if (statusField.value < 0 || statusField.value > 16) pm.expect.fail("google.rpc.Status.code in grpc-status-details-bin must be a canonical gRPC code 0-16 but was " + statusField.value);',
+    '      else if (statusField.value !== pm.response.code) pm.expect.fail("google.rpc.Status.code in grpc-status-details-bin (" + statusField.value + ") disagrees with the reported status code (" + pm.response.code + ")");',
+    "    } else if (statusField.field === 2) {",
+    '      if (statusField.wire !== 2) pm.expect.fail("google.rpc.Status.message (field 2) in grpc-status-details-bin must be length-delimited");',
+    "    } else if (statusField.field === 3) {",
+    '      if (statusField.wire !== 2) { pm.expect.fail("google.rpc.Status.details (field 3) in grpc-status-details-bin must be length-delimited google.protobuf.Any messages"); return; }',
+    "      var anyFields = grpcPbFields(statusField.bytes);",
+    '      if (!anyFields) { pm.expect.fail("google.rpc.Status.details entry in grpc-status-details-bin is not a decodable google.protobuf.Any message"); return; }',
+    "      var hasTypeUrl = anyFields.some(function (anyField) { return anyField.field === 1 && anyField.wire === 2 && anyField.bytes.length > 0; });",
+    '      if (!hasTypeUrl) pm.expect.fail("google.protobuf.Any in grpc-status-details-bin details must carry a non-empty type_url (field 1)");',
+    "    }",
+    "  });",
+    "}",
     `pm.test('gRPC status is OK for ' + grpcSpec.methodPath, function () {`,
     '  pm.expect(pm.response.code, "gRPC call for " + grpcSpec.methodPath + " returned " + grpcStatusName() + " (" + pm.response.code + ")").to.eql(0);',
     "});",
@@ -297827,6 +297916,7 @@ function createGrpcScript(spec) {
     '    if (!Number.isInteger(echoedCode) || echoedCode < 0 || echoedCode > 16) pm.expect.fail("grpc-status trailer must be a canonical gRPC code 0-16 but was " + JSON.stringify(echoedStatus.value));',
     '    else if (echoedCode !== pm.response.code) pm.expect.fail("grpc-status trailer (" + echoedCode + ") disagrees with the reported status code (" + pm.response.code + ")");',
     "  }",
+    '  grpcCheckStatusDetailsBin(grpcMetaOne(pm.response.trailers, "grpc-status-details-bin"));',
     "});",
     // Terminal-response-message expectation. unary and client-streaming RPCs
     // return exactly one terminal response message; server/bidi streaming may
@@ -303665,6 +303755,7 @@ function createSoapScript(operation, warnings = []) {
   };
   const responseRegex = operation.expectedResponseElement ? elementPresenceRegex(operation.expectedResponseElement) : "";
   const mediaType = operation.soapVersion === "1.2" ? "application/soap+xml" : "text/xml";
+  const envelopeNs = operation.soapVersion === "1.2" ? "http://www.w3.org/2003/05/soap-envelope" : "http://schemas.xmlsoap.org/soap/envelope/";
   const faultStatusLine = operation.soapVersion === "1.2" ? '  if (faulted && code !== 500 && code !== 400) pm.expect.fail("SOAP 1.2 Faults ride HTTP 500, or 400 for env:Sender faults (SOAP 1.2 Part 2 HTTP binding); got HTTP " + code);' : '  if (faulted && code !== 500) pm.expect.fail("SOAP 1.1 Faults must ride HTTP 500 (WS-I Basic Profile R1126); got HTTP " + code);';
   const lines = [
     `var soap = JSON.parse(${JSON.stringify(JSON.stringify(meta))});`,
@@ -303687,6 +303778,11 @@ function createSoapScript(operation, warnings = []) {
     '  pm.expect(bodyText, "response body is not a SOAP envelope").to.match(matchTag("Envelope"));',
     "});",
     "",
+    `pm.test('SOAP Envelope namespace matches SOAP ${operation.soapVersion}', function () {`,
+    '  if (!matchTag("Envelope").test(bodyText)) return;',
+    `  pm.expect(bodyText.indexOf(${JSON.stringify(envelopeNs)}) !== -1, "SOAP ${operation.soapVersion} envelopes must declare the ${envelopeNs} namespace").to.equal(true);`,
+    "});",
+    "",
     "pm.test('SOAP Body element is present', function () {",
     '  pm.expect(bodyText, "SOAP envelope has no Body element").to.match(matchTag("Body"));',
     "});",
@@ -303704,7 +303800,33 @@ function createSoapScript(operation, warnings = []) {
     "  var code = pm.response.code;",
     faultStatusLine,
     '  if (!faulted && code === 500) pm.expect.fail("HTTP 500 from a SOAP endpoint must carry a SOAP Fault in the body");',
-    "});"
+    "});",
+    // Fault well-formedness (diagnostic companion to the Fault-absence test: a
+    // faulted run already fails, this pinpoints a malformed Fault). SOAP 1.1
+    // section 4.4 requires faultcode + faultstring children; SOAP 1.2 Part 1
+    // section 5.4 requires Code/Value + Reason/Text and pins the top-level
+    // Value QName to the five defined fault codes.
+    ...operation.soapVersion === "1.2" ? [
+      "",
+      "pm.test('SOAP Fault is well-formed for SOAP 1.2', function () {",
+      '  if (!matchTag("Fault").test(bodyText)) return;',
+      '  if (!matchTag("Code").test(bodyText)) { pm.expect.fail("a SOAP 1.2 Fault must carry an env:Code child (SOAP 1.2 Part 1 section 5.4)"); return; }',
+      '  if (!matchTag("Value").test(bodyText)) { pm.expect.fail("a SOAP 1.2 Fault Code must carry an env:Value child (SOAP 1.2 Part 1 section 5.4.1)"); return; }',
+      '  if (!matchTag("Reason").test(bodyText)) pm.expect.fail("a SOAP 1.2 Fault must carry an env:Reason child (SOAP 1.2 Part 1 section 5.4)");',
+      '  else if (!matchTag("Text").test(bodyText)) pm.expect.fail("a SOAP 1.2 Fault Reason must carry an env:Text child (SOAP 1.2 Part 1 section 5.4.2)");',
+      '  var faultValue = (bodyText.match(/<(?:[A-Za-z_][\\w.-]*:)?Value[^>]*>([\\s\\S]*?)<\\//) || [])[1] || "";',
+      '  var faultLocal = faultValue.trim().split(":").pop();',
+      '  var faultCodes = ["VersionMismatch", "MustUnderstand", "DataEncodingUnknown", "Sender", "Receiver"];',
+      '  if (faultLocal && faultCodes.indexOf(faultLocal) === -1) pm.expect.fail("the SOAP 1.2 Fault Code Value must be one of " + faultCodes.join(", ") + " (SOAP 1.2 Part 1 table 4); got " + faultValue.trim());',
+      "});"
+    ] : [
+      "",
+      "pm.test('SOAP Fault is well-formed for SOAP 1.1', function () {",
+      '  if (!matchTag("Fault").test(bodyText)) return;',
+      '  if (!matchTag("faultcode").test(bodyText)) pm.expect.fail("a SOAP 1.1 Fault must carry a faultcode child (SOAP 1.1 section 4.4)");',
+      '  if (!matchTag("faultstring").test(bodyText)) pm.expect.fail("a SOAP 1.1 Fault must carry a faultstring child (SOAP 1.1 section 4.4)");',
+      "});"
+    ]
   ];
   if (responseRegex) {
     lines.push(
@@ -303881,7 +304003,8 @@ function wsBindingKeyValues(channel) {
   const value = asRecord15(wsBinding.value()) ?? {};
   return {
     headers: bindingKeyValues(value.headers),
-    queryParams: bindingKeyValues(value.query)
+    queryParams: bindingKeyValues(value.query),
+    binding: value
   };
 }
 function collectMqttInfo(channel, servers, messagesRaw, documentJson) {
@@ -303955,6 +304078,8 @@ function messageDescriptor2(message, warnings, channelId, defaultContentType, re
   const replySchema = replyByMessageId.get(message.id());
   const ackSchema = xAckSchema ?? replySchema;
   const ackSource = xAckSchema ? "x-ack" : replySchema ? "reply" : void 0;
+  const correlationRaw = asRecord15(rawMessage.correlationId)?.location;
+  const correlationLocation = typeof correlationRaw === "string" ? correlationRaw : void 0;
   const examples = message.examples().all().filter((example) => example.hasPayload());
   const hasExample = examples.length > 0;
   let sample;
@@ -303976,6 +304101,7 @@ function messageDescriptor2(message, warnings, channelId, defaultContentType, re
     payloadSchema,
     ackSchema,
     ackSource,
+    correlationLocation,
     sample,
     hasExample,
     contentKind,
@@ -303988,6 +304114,7 @@ function channelDescriptor(channel, document2, documentJson, defaultContentType,
   const servers = resolveServers(channel, document2);
   const messagesRaw = channel.messages().all();
   const transport = detectTransport(channel, servers, messagesRaw, documentJson, warnings);
+  const parameterNames = Object.keys(asRecord15(channel.json().parameters) ?? {}).sort();
   const serverUrl = servers.find((server) => server.url())?.url() || options.endpointUrl?.trim() || "";
   if (!serverUrl) {
     warnings.push(`ASYNCAPI_NO_SERVER_URL: channel ${channel.id()} has no resolvable server url; the generated request url is derived from the channel address only and must be completed before use`);
@@ -304007,6 +304134,7 @@ function channelDescriptor(channel, document2, documentJson, defaultContentType,
       headers: [],
       queryParams: [],
       mqtt: collectMqttInfo(channel, servers, messagesRaw, documentJson),
+      parameterNames,
       messages,
       warnings
     };
@@ -304021,11 +304149,12 @@ function channelDescriptor(channel, document2, documentJson, defaultContentType,
       queryParams: [],
       socketioNamespace: address.startsWith("/") ? address : `/${address}`,
       socketioPath: DEFAULT_SOCKETIO_PATH,
+      parameterNames,
       messages,
       warnings
     };
   }
-  const { headers, queryParams } = wsBindingKeyValues(channel);
+  const { headers, queryParams, binding } = wsBindingKeyValues(channel);
   return {
     id: channel.id(),
     address,
@@ -304033,6 +304162,8 @@ function channelDescriptor(channel, document2, documentJson, defaultContentType,
     url: joinUrl(serverUrl, address),
     headers,
     queryParams,
+    parameterNames,
+    wsBinding: binding,
     messages,
     warnings
   };
@@ -304470,14 +304601,68 @@ function collectMessageNodeIds(node, ids, path10) {
     if (record) collectMessageNodeIds(record, ids, `${path10}/${i}`);
   });
 }
+function validateChannelParameters(channel, warnings) {
+  const declared = new Set(channel.parameterNames ?? []);
+  const used = /* @__PURE__ */ new Set();
+  for (const match of channel.address.matchAll(/\{([^{}]*)\}/g)) {
+    const name = match[1] ?? "";
+    if (!name) {
+      warnings.push(`ASYNCAPI_CHANNEL_PARAMETER_INVALID: channel ${channel.id} address ${channel.address} contains an empty {} parameter expression`);
+      continue;
+    }
+    used.add(name);
+    if (!declared.has(name)) {
+      warnings.push(`ASYNCAPI_CHANNEL_PARAMETER_UNDECLARED: channel ${channel.id} address parameter {${name}} has no entry in the channel parameters object; AsyncAPI requires every address parameter to be declared`);
+    }
+  }
+  for (const name of declared) {
+    if (!used.has(name)) {
+      warnings.push(`ASYNCAPI_CHANNEL_PARAMETER_UNUSED: channel ${channel.id} declares parameter ${name} that never appears in the channel address ${channel.address}`);
+    }
+  }
+}
+var CORRELATION_LOCATION_GRAMMAR = /^\$message\.(header|payload)#(\/(?:[^~/]|~[01])*)+$/;
+function validateCorrelationLocation(channelId, message, warnings) {
+  if (message.correlationLocation === void 0) return;
+  if (!CORRELATION_LOCATION_GRAMMAR.test(message.correlationLocation)) {
+    warnings.push(
+      `ASYNCAPI_CORRELATION_LOCATION_INVALID: message ${message.id} on channel ${channelId} correlationId location ${JSON.stringify(message.correlationLocation)} is not a valid AsyncAPI runtime expression ($message.header#/<pointer> or $message.payload#/<pointer>)`
+    );
+  }
+}
+var SOCKETIO_RESERVED_EVENTS = /* @__PURE__ */ new Set(["connect", "connect_error", "disconnect", "disconnecting", "newListener", "removeListener"]);
+function validateWsBinding(channel, warnings) {
+  const binding = channel.wsBinding;
+  if (!binding) return;
+  const method = binding.method;
+  if (method !== void 0 && (typeof method !== "string" || method !== "GET" && method !== "POST")) {
+    warnings.push(`ASYNCAPI_WS_BINDING_INVALID: channel ${channel.id} ws binding method must be "GET" or "POST" but was ${JSON.stringify(method)}`);
+  }
+  for (const key of ["query", "headers"]) {
+    const schema = binding[key];
+    if (schema === void 0) continue;
+    const record = asRecord16(schema);
+    if (!record || record.type !== void 0 && record.type !== "object") {
+      warnings.push(`ASYNCAPI_WS_BINDING_INVALID: channel ${channel.id} ws binding ${key} must be a Schema Object of type object`);
+    }
+  }
+}
 function instrumentAsyncApiCollection(collection, index) {
   const warnings = [
     ...index.warnings,
     ...index.channels.flatMap((channel) => channel.warnings)
   ];
   for (const channel of index.channels) {
+    validateChannelParameters(channel, warnings);
     if (channel.transport === "mqtt") validateMqttChannel(channel, warnings);
+    if (channel.transport === "ws-raw") validateWsBinding(channel, warnings);
     for (const message of channel.messages) {
+      if (channel.transport === "socketio" && SOCKETIO_RESERVED_EVENTS.has(message.eventName)) {
+        warnings.push(
+          `ASYNCAPI_SOCKETIO_RESERVED_EVENT: message ${message.id} on channel ${channel.id} uses the reserved Socket.IO event name "${message.eventName}"; reserved lifecycle events cannot be emitted or received as application events`
+        );
+      }
+      validateCorrelationLocation(channel.id, message, warnings);
       validateMessage(index, channel.id, message, warnings);
     }
   }
@@ -304655,6 +304840,7 @@ function toolDescriptor(tool, warnings) {
     description: typeof tool.description === "string" ? tool.description : void 0,
     inputSchema,
     outputSchema: asRecord17(tool.outputSchema) ?? void 0,
+    annotations: asRecord17(tool.annotations) ?? void 0,
     sampleArguments: inputSchema ? sampleFromSchema2(inputSchema, 0) : {},
     warnings: toolWarnings
   };
@@ -304855,10 +305041,41 @@ function validateServer(server, warnings) {
     }
   }
 }
+var TOOL_ANNOTATION_BOOLEAN_HINTS = ["readOnlyHint", "destructiveHint", "idempotentHint", "openWorldHint"];
+function validateToolAnnotations(tool, warnings) {
+  if (!tool.annotations) return;
+  for (const hint of TOOL_ANNOTATION_BOOLEAN_HINTS) {
+    const value = tool.annotations[hint];
+    if (value !== void 0 && typeof value !== "boolean") {
+      warnings.push(`MCP_TOOL_ANNOTATION_INVALID: tool ${tool.name} annotations.${hint} must be a boolean (MCP ToolAnnotations); got ${JSON.stringify(value)}`);
+    }
+  }
+  if (tool.annotations.title !== void 0 && typeof tool.annotations.title !== "string") {
+    warnings.push(`MCP_TOOL_ANNOTATION_INVALID: tool ${tool.name} annotations.title must be a string (MCP ToolAnnotations); got ${JSON.stringify(tool.annotations.title)}`);
+  }
+}
+function validateToolOutputSchema(index, tool, warnings) {
+  if (!tool.outputSchema) return;
+  const declaredType = tool.outputSchema.type;
+  if (declaredType !== void 0 && declaredType !== "object") {
+    warnings.push(`MCP_TOOL_OUTPUT_SCHEMA_INVALID: tool ${tool.name} outputSchema type is ${JSON.stringify(declaredType)}; the MCP specification requires tool output schemas to describe the structuredContent object`);
+  }
+  const packed = packSchema(index.documentJson, tool.outputSchema, "3.0", "response");
+  if (packed.unsupported) {
+    const code = isSchemaGraphOverflow(packed) ? "MCP_SCHEMA_NOT_COMPILED" : "MCP_TOOL_OUTPUT_SCHEMA_NOT_VALIDATED";
+    warnings.push(`${code}: tool ${tool.name} outputSchema is not validated (${packed.unsupported})`);
+    return;
+  }
+  if (!compileSchemaValidator(packed.schema)) {
+    warnings.push(`MCP_TOOL_OUTPUT_SCHEMA_NOT_VALIDATED: tool ${tool.name} outputSchema could not be compiled to a validator`);
+  }
+}
 function validateTool(index, tool, warnings) {
   if (!TOOL_NAME_RE.test(tool.name)) {
     warnings.push(`MCP_TOOL_NAME_UNCONVENTIONAL: tool name "${tool.name}" is outside the conventional [A-Za-z0-9_./-]{1,128} identifier set`);
   }
+  validateToolAnnotations(tool, warnings);
+  validateToolOutputSchema(index, tool, warnings);
   if (!tool.inputSchema) return;
   const declaredType = tool.inputSchema.type;
   if (declaredType !== void 0 && declaredType !== "object") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@postman-cse/onboarding-bootstrap",
-  "version": "2.5.0",
+  "version": "2.6.0",
   "description": "Bootstrap Postman workspaces, specs, and collections from OpenAPI.",
   "type": "module",
   "main": "dist/index.cjs",