@vostride/agent-qa-mcp 0.1.20 → 0.2.1

package/dist/index.cjs

@@ -20,1122 +20,2189 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
-  AGENT_QA_SCHEMA_REFERENCES: () => AGENT_QA_SCHEMA_REFERENCES,
-  DEFAULT_MCP_HOST: () => DEFAULT_MCP_HOST,
-  DEFAULT_MCP_PATH: () => DEFAULT_MCP_PATH,
-  DEFAULT_MCP_PORT: () => DEFAULT_MCP_PORT,
-  MCP_STDIO_STARTUP_MESSAGE: () => MCP_STDIO_STARTUP_MESSAGE,
-  SCHEMA_REFERENCE_NAMES: () => SCHEMA_REFERENCE_NAMES,
-  VALIDATION_KINDS: () => VALIDATION_KINDS,
-  classifyRunFailureFromDashboardData: () => classifyRunFailureFromDashboardData,
-  createAgentQaMcpServer: () => createAgentQaMcpServer,
-  createLocalMcpHttpHandler: () => createLocalMcpHttpHandler,
-  createMcpServer: () => createMcpServer,
-  resolveDashboardApiUrl: () => resolveDashboardApiUrl,
-  resolveLocalMcpEndpoint: () => resolveLocalMcpEndpoint,
-  resolveMcpEndpointShape: () => resolveMcpEndpointShape,
-  startMcpServer: () => startMcpServer,
-  validateAgentQaDefinition: () => validateAgentQaDefinition
+  AGENT_QA_COMPOSED_CONTRACTS: () => AGENT_QA_COMPOSED_CONTRACTS,
+  AGENT_QA_MCP_INSTRUCTIONS: () => AGENT_QA_MCP_INSTRUCTIONS,
+  AGENT_QA_MCP_SERVER_VERSION: () => AGENT_QA_MCP_SERVER_VERSION,
+  AGENT_QA_OP_CONTRACTS: () => AGENT_QA_OP_CONTRACTS,
+  AGENT_QA_TOOL_PROJECTIONS: () => AGENT_QA_TOOL_PROJECTIONS,
+  APP_NEGOTIATION_CLIENT_CAPABILITIES_KEY: () => APP_NEGOTIATION_CLIENT_CAPABILITIES_KEY,
+  APP_RESOURCE_MIME_TYPE: () => APP_RESOURCE_MIME_TYPE,
+  APP_RESOURCE_NAME: () => APP_RESOURCE_NAME,
+  APP_RESOURCE_URI_TEMPLATE: () => APP_RESOURCE_URI_TEMPLATE,
+  APP_WRAPPER_APP_NAME: () => APP_WRAPPER_APP_NAME,
+  APP_WRAPPER_APP_VERSION: () => APP_WRAPPER_APP_VERSION,
+  APP_WRAPPER_CONNECTING_HINT: () => APP_WRAPPER_CONNECTING_HINT,
+  APP_WRAPPER_CONNECTING_MESSAGE: () => APP_WRAPPER_CONNECTING_MESSAGE,
+  APP_WRAPPER_EXPIRED_HINT: () => APP_WRAPPER_EXPIRED_HINT,
+  APP_WRAPPER_EXPIRED_MESSAGE: () => APP_WRAPPER_EXPIRED_MESSAGE,
+  APP_WRAPPER_LIVE_MESSAGE: () => APP_WRAPPER_LIVE_MESSAGE,
+  APP_WRAPPER_LOAD_TIMEOUT_MS: () => APP_WRAPPER_LOAD_TIMEOUT_MS,
+  APP_WRAPPER_PERMANENT_LINK_LABEL: () => APP_WRAPPER_PERMANENT_LINK_LABEL,
+  APP_WRAPPER_RUN_ENDED_MESSAGE: () => APP_WRAPPER_RUN_ENDED_MESSAGE,
+  APP_WRAPPER_STATES: () => APP_WRAPPER_STATES,
+  APP_WRAPPER_UI_PROTOCOL_VERSION: () => APP_WRAPPER_UI_PROTOCOL_VERSION,
+  APP_WRAPPER_UNREACHABLE_MESSAGE: () => APP_WRAPPER_UNREACHABLE_MESSAGE,
+  AppResourceNegotiationError: () => AppResourceNegotiationError,
+  AppResourceOriginSpanError: () => AppResourceOriginSpanError,
+  AppResourceReadError: () => AppResourceReadError,
+  AppResourceUriError: () => AppResourceUriError,
+  DEGRADED_OUTPUT_CONTRACTS: () => DEGRADED_OUTPUT_CONTRACTS,
+  JOB_STATUS_TO_MCP_TASK_STATE: () => JOB_STATUS_TO_MCP_TASK_STATE,
+  LIVE_LINK_ABSENT_LINE: () => LIVE_LINK_ABSENT_LINE,
+  LIVE_LINK_NO_RUN_LINE: () => LIVE_LINK_NO_RUN_LINE,
+  MCP_APPS_EXTENSION_ID: () => MCP_APPS_EXTENSION_ID,
+  McpProjectionError: () => McpProjectionError,
+  UNPROJECTED_OPS: () => UNPROJECTED_OPS,
+  V1_TOOL_MIGRATION_MAP: () => V1_TOOL_MIGRATION_MAP,
+  advertisedContracts: () => advertisedContracts,
+  appResourceUriFor: () => appResourceUriFor,
+  armWithoutDiscriminant: () => armWithoutDiscriminant,
+  buildAgentQaMcpServer: () => buildAgentQaMcpServer,
+  compositionOf: () => compositionOf,
+  createAgentQaMcpNodeHandler: () => createAgentQaMcpNodeHandler,
+  createAppResourceReadHandler: () => createAppResourceReadHandler,
+  foldArmFindings: () => foldArmFindings,
+  liveLinkLine: () => liveLinkLine,
+  liveLinkLineFor: () => liveLinkLineFor,
+  liveRunLinkOf: () => liveRunLinkOf,
+  maskedToolResult: () => maskedToolResult,
+  negotiatedAppsExtension: () => negotiatedAppsExtension,
+  parseAppUri: () => parseAppUri,
+  projectJobAsTask: () => projectJobAsTask,
+  registerAppResources: () => registerAppResources,
+  renderAppWrapperPage: () => renderAppWrapperPage,
+  stripRedundantObjectStamp: () => stripRedundantObjectStamp,
+  toRegisterToolConfig: () => toRegisterToolConfig,
+  withoutDialect: () => withoutDialect,
+  withoutLegacyResultWrap: () => withoutLegacyResultWrap
 });
 module.exports = __toCommonJS(index_exports);
 
-// src/server.ts
-var import_stdio = require("@modelcontextprotocol/sdk/server/stdio.js");
-var import_agent_qa_core3 = require("@vostride/agent-qa-core");
+// src/catalog.ts
+var import_server3 = require("@modelcontextprotocol/server");
+var import_agent_qa_agent3 = require("@vostride/agent-qa-agent");
 
-// src/agent-qa-server.ts
-var import_promises = require("fs/promises");
-var import_node_path = require("path");
-var import_mcp = require("@modelcontextprotocol/sdk/server/mcp.js");
-var import_agent_qa_core2 = require("@vostride/agent-qa-core");
-var import_agent_qa_ids2 = require("@vostride/agent-qa-ids");
-var import_yaml = require("yaml");
-var import_zod = require("zod");
+// src/app-resource.ts
+var import_server = require("@modelcontextprotocol/server");
+var import_agent_qa_agent = require("@vostride/agent-qa-agent");
+var import_agent_qa_schema = require("@vostride/agent-qa-schema");
 
-// src/schema-reference.ts
-var import_agent_qa_core = require("@vostride/agent-qa-core");
-var import_agent_qa_ids = require("@vostride/agent-qa-ids");
-var SCHEMA_REFERENCE_NAMES = ["config", "test", "suite", "hooks", "ids"];
-var VALIDATION_KINDS = ["config", "test", "suite", "hooks"];
-var AGENT_QA_SCHEMA_REFERENCES = {
-  config: {
-    name: "agent-qa config",
-    rootKeys: ["workspace", "services", "registry", "use", "analytics"],
-    services: {
-      dashboard: ["port", "dbPath", "artifactsDir"],
-      mcp: ["enabled", "transport", "host", "port", "path"],
-      cache: ["dir", "ttl"],
-      logging: ["level"],
-      recording: ["enabled"],
-      accessibility: ["enabled", "standard", "runAfter", "failOnViolation", "disableRules", "exclude"],
-      memory: ["enabled", "provider", "dir", "minTrust", "maxInjections", "curatorEnabled"]
-    },
-    mcpLocalOnly: {
-      transports: ["http", "stdio"],
-      hosts: ["localhost", "127.0.0.1", "::1"],
-      defaultPort: 3471,
-      defaultPath: "/mcp"
-    }
-  },
-  test: {
-    name: "agent-qa test YAML",
-    requiredKeys: ["test-id", "name", "target", "steps"],
-    optionalKeys: ["context", "use", "meta", "setup", "teardown"],
-    idType: "test",
-    hookReferences: "setup and teardown arrays must contain canonical h_ hook IDs.",
-    stepFormats: ["string", "object with step/timeout/retries/screenshot/capture/maxAttempts"]
-  },
-  suite: {
-    name: "agent-qa suite YAML",
-    requiredKeys: ["name", "target", "tests"],
-    optionalKeys: ["suite-id", "context", "setup", "teardown", "use"],
-    idType: "suite",
-    testReference: "Each tests[] entry uses { test: path, id: canonical t_ test ID }.",
-    hookReferences: "setup and teardown arrays must contain canonical h_ hook IDs."
-  },
-  hooks: {
-    name: "agent-qa hooks file",
-    rootKeys: ["hooks"],
-    hookKeys: ["id", "name", "runtime", "file", "deps", "packageFile", "timeout", "network"],
-    idType: "hook",
-    runtimes: ["node", "bun", "python", "bash"]
-  },
-  ids: {
-    name: "agent-qa canonical IDs",
-    instruction: "Generate IDs with agent_qa_generate_id or `agent-qa ids generate <type>`; never hand-write IDs.",
-    contracts: (0, import_agent_qa_ids.getEntityIdContracts)()
-  }
+// src/app-wrapper.ts
+var APP_WRAPPER_STATES = [
+  "connecting",
+  "live",
+  "expired",
+  "unreachable-origin",
+  "run-ended"
+];
+var APP_WRAPPER_CONNECTING_MESSAGE = "connecting to the live view\u2026";
+var APP_WRAPPER_CONNECTING_HINT = "if the pane does not appear, open it in your browser";
+var APP_WRAPPER_LIVE_MESSAGE = "live";
+var APP_WRAPPER_EXPIRED_MESSAGE = "live link expired";
+var APP_WRAPPER_EXPIRED_HINT = "ask to watch again \u2014 a fresh watch mints a new link";
+var APP_WRAPPER_UNREACHABLE_MESSAGE = "this host can't reach the live view \u2014 open it in your browser";
+var APP_WRAPPER_RUN_ENDED_MESSAGE = "this run is not live \u2014 open it in your browser";
+var APP_WRAPPER_PERMANENT_LINK_LABEL = "open in your browser";
+var APP_WRAPPER_LOAD_TIMEOUT_MS = 1e4;
+var APP_WRAPPER_UI_PROTOCOL_VERSION = "2026-01-26";
+var APP_WRAPPER_APP_NAME = "agent-qa-live-view";
+var APP_WRAPPER_APP_VERSION = "1.0.0";
+var STYLE = `
+  :root { color-scheme: dark light }
+  html, body { margin: 0; height: 100%; background: #0b0d10; }
+  main { display: grid; grid-template-rows: auto 1fr auto auto; height: 100%; font: 14px/1.5 ui-sans-serif, system-ui, sans-serif; color: #c9d1d9; }
+  header { display: flex; gap: .75rem; align-items: center; padding: .5rem .75rem; }
+  header:empty { display: none; }
+  iframe { border: 0; width: 100%; height: 100%; display: none; background: #0b0d10; }
+  main[data-app-state="live"] iframe { display: block; }
+  main[data-app-state="live"] p[data-app-message] { display: none; }
+  main[data-app-state="live"] p[data-app-hint] { display: none; }
+  p[data-app-message] { margin: 0; padding: .5rem .75rem; }
+  p[data-app-hint] { margin: 0; padding: 0 .75rem .5rem; opacity: .75; }
+  p[data-app-hint]:empty { display: none; }
+  footer { padding: .5rem .75rem; }
+  select[hidden], a[hidden] { display: none; }
+`;
+var MESSAGES = {
+  connecting: APP_WRAPPER_CONNECTING_MESSAGE,
+  live: APP_WRAPPER_LIVE_MESSAGE,
+  expired: APP_WRAPPER_EXPIRED_MESSAGE,
+  "unreachable-origin": APP_WRAPPER_UNREACHABLE_MESSAGE,
+  "run-ended": APP_WRAPPER_RUN_ENDED_MESSAGE
 };
-var VALIDATION_SCHEMAS = {
-  config: import_agent_qa_core.AgentQaConfigSchema,
-  test: import_agent_qa_core.TestDefinitionSchema,
-  suite: import_agent_qa_core.SuiteDefinitionSchema,
-  hooks: import_agent_qa_core.HooksFileSchema
+var HINTS = {
+  connecting: APP_WRAPPER_CONNECTING_HINT,
+  live: "",
+  expired: APP_WRAPPER_EXPIRED_HINT,
+  "unreachable-origin": "",
+  "run-ended": ""
 };
-function validateAgentQaDefinition(kind, definition) {
-  const result = VALIDATION_SCHEMAS[kind].safeParse(definition);
-  if (result.success) {
-    return {
-      valid: true,
-      kind,
-      issues: []
-    };
+function httpPermanentLink(value) {
+  if (typeof value !== "string") return void 0;
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch {
+    return void 0;
   }
-  return {
-    valid: false,
-    kind,
-    issues: result.error.issues.map((issue) => ({
-      path: issue.path.map(String).join(".") || "(root)",
-      message: issue.message
-    }))
+  return parsed.protocol === "http:" || parsed.protocol === "https:" ? value : void 0;
+}
+function renderAppWrapperPage(input) {
+  const scriptLiteral = (value) => JSON.stringify(value).replaceAll("<", "\\u003c");
+  const attributeText = (value) => value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
+  const now = input.now ?? Date.now();
+  const live = input.runLive && input.mints.length > 0;
+  const mints = live ? input.mints : [];
+  const lowestExpiry = mints.reduce(
+    (lowest, mint) => mint.expiresAt < lowest ? mint.expiresAt : lowest,
+    Number.POSITIVE_INFINITY
+  );
+  const expired = live && lowestExpiry <= now;
+  const expiresInMs = expired || !live ? 0 : Math.max(0, lowestExpiry - now);
+  const initialState = !live ? "run-ended" : expired ? "expired" : "connecting";
+  const mintsLiteral = (expired ? [] : mints).map(
+    (mint) => `{handle:${scriptLiteral(String(mint.handle))},url:${scriptLiteral(mint.liveUrl)},kind:${scriptLiteral(mint.streamKind)}}`
+  ).join(",");
+  const permanentLink = httpPermanentLink(input.permanentLink);
+  const permanentLinkSlot = permanentLink === void 0 ? "" : '<a data-app-permanent-link rel="noreferrer" target="_blank" href="' + attributeText(permanentLink) + '">' + attributeText(APP_WRAPPER_PERMANENT_LINK_LABEL) + "</a>";
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>agent-qa live run</title>
+<style>${STYLE}</style>
+</head>
+<body>
+<main data-app-state="${initialState}">
+<header><select data-app-handle-picker hidden></select></header>
+${live && !expired ? '<iframe data-app-live-frame sandbox="allow-scripts" referrerpolicy="no-referrer" title="agent-qa live view"></iframe>' : ""}
+<p data-app-message>${MESSAGES[initialState]}</p>
+<p data-app-hint>${HINTS[initialState]}</p>
+<footer>${permanentLinkSlot}</footer>
+</main>
+<script>
+(function () {
+  var mints = [${mintsLiteral}];
+  var runId = ${scriptLiteral(input.runId)};
+  var expiresInMs = ${String(expiresInMs)};
+  var loadTimeoutMs = ${String(APP_WRAPPER_LOAD_TIMEOUT_MS)};
+  var messages = {
+    connecting: ${scriptLiteral(APP_WRAPPER_CONNECTING_MESSAGE)},
+    live: ${scriptLiteral(APP_WRAPPER_LIVE_MESSAGE)},
+    expired: ${scriptLiteral(APP_WRAPPER_EXPIRED_MESSAGE)},
+    'unreachable-origin': ${scriptLiteral(APP_WRAPPER_UNREACHABLE_MESSAGE)},
+    'run-ended': ${scriptLiteral(APP_WRAPPER_RUN_ENDED_MESSAGE)}
+  };
+  var hints = {
+    connecting: ${scriptLiteral(APP_WRAPPER_CONNECTING_HINT)},
+    live: '',
+    expired: ${scriptLiteral(APP_WRAPPER_EXPIRED_HINT)},
+    'unreachable-origin': '',
+    'run-ended': ''
   };
+
+  var root = document.querySelector('[data-app-state]');
+  var frame = document.querySelector('[data-app-live-frame]');
+  var picker = document.querySelector('[data-app-handle-picker]');
+  var message = document.querySelector('[data-app-message]');
+  var hint = document.querySelector('[data-app-hint]');
+
+  // WHICH RUN, as an attribute rather than as prose. Identity is not run STATE (D-11 forbids the
+  // second, not the first), and it enters through setAttribute from an escaped literal, so a run
+  // id can never become markup no matter what it spells.
+  root.setAttribute('data-app-run-id', runId);
+
+  // The state machine is an ATTRIBUTE plus two textContent writes, exactly as the embed page's is:
+  // a state a person can read off the DOM is a state a cell can assert without screenshotting, and
+  // text that arrives through textContent can never become markup.
+  function setState(state) {
+    root.setAttribute('data-app-state', state);
+    message.textContent = messages[state] || '';
+    hint.textContent = hints[state] || '';
+  }
+
+  // ---- The minimal ui/initialize handshake (ext-apps spec shape) -------------------------------
+  //
+  // HAND-ROLLED AND DELIBERATELY ISOLATED IN THIS ONE BLOCK. The ext-apps package
+  // declares a peer on the v1 monolith SDK, so importing its app-bridge into production would drag
+  // a second SDK generation in (Pitfall 3) \u2014 and this page has no bundler anyway. RESEARCH
+  // assumption A5 rated the method-name and field spellings MEDIUM (single spec fetch), and plan
+  // 02's coverage entry D9 deferred the adjudication to plan 06.
+  //
+  // PLAN 06 MEASURED IT, AND IT HAD DRIFTED. Against the installed
+  // @modelcontextprotocol/ext-apps@1.7.5's own generated schema, McpUiInitializeRequest.params
+  // requires THREE members: protocolVersion, appInfo and appCapabilities. This block sent only the
+  // first, so a host validating the request against the published schema would have rejected the
+  // handshake outright, and the failure would have looked like a host that simply does not support
+  // Apps. The two missing members are now sent, and ext-apps-constants.test.ts cell (4d) derives
+  // the required list FROM the shipped schema rather than restating it, so the next spec change
+  // reds here instead of on a user's machine.
+  //
+  // IT STILL ASKS FOR NOTHING. appCapabilities is deliberately empty: this document exposes no
+  // tools, requests no display mode and declares no experimental feature (the schema requires no
+  // member of it). No permissions, no re-mint (D-10) \u2014 it announces that this document is ready,
+  // which is all a wrapper that renders no run state of its own has to say.
+  try {
+    if (window.parent !== window) {
+      window.parent.postMessage({
+        jsonrpc: '2.0',
+        id: 'ui-init-1',
+        method: 'ui/initialize',
+        params: {
+          protocolVersion: ${scriptLiteral(APP_WRAPPER_UI_PROTOCOL_VERSION)},
+          appInfo: { name: ${scriptLiteral(APP_WRAPPER_APP_NAME)}, version: ${scriptLiteral(APP_WRAPPER_APP_VERSION)} },
+          appCapabilities: {}
+        }
+      }, '*');
+    }
+  } catch (e) { /* a host that refuses the message changes nothing about what this page shows */ }
+
+  if (mints.length === 0) {
+    // Either D-07's honest terminal/unknown state or D-10's expired one \u2014 both were decided by the
+    // RENDERER and are already in the markup. No src was ever assigned, so there is no blank frame
+    // to mistake for a stalled one, and nothing below this line can move the document off them.
+    return;
+  }
+
+  // ---- Reachability, once per ORIGIN (see the header's measured note) ---------------------------
+  //
+  // Memoised deliberately, and ONLY ON SUCCESS. The picker swaps among panes that share one
+  // origin, so after the first ANSWERING pane every swap is served from this map and issues NO
+  // network request at all (D-06/D-10's zero re-mints, zero calls, which the DOM cell counts) \u2014 a
+  // property that rides entirely on caching the true. The catch arm therefore FORGETS the entry
+  // before answering false: a refusal is a fact about one moment, not about the origin, and every
+  // mint on a render shares one origin, so a cached false was total and permanent. See the header.
+  var reach = {};
+  function reachable(url) {
+    var origin;
+    try { origin = new URL(url).origin; } catch (e) { return Promise.resolve(false); }
+    if (reach[origin] === undefined) {
+      reach[origin] = fetch(origin + '/', { mode: 'no-cors', cache: 'no-store' })
+        .then(function () { return true; })
+        .catch(function () { delete reach[origin]; return false; });
+    }
+    return reach[origin];
+  }
+
+  var attachId = 0;
+
+  function attach(mint) {
+    // THE EXPIRED STATE IS TERMINAL, AND THIS IS THE ONE PLACE IT COULD BE LEFT (D-10). The
+    // picker's change handler \u2014 and nothing else \u2014 can reach this function after the one-shot
+    // expiry timer has fired; without this line the next statements would set the connecting state
+    // and assign an aged token over a document that had already told the truth, and no timer would
+    // ever correct it. The identical predicate inside settle() stays where it is: it closes the
+    // OTHER door, a probe or a frame load that was already in flight when the timer fired, so
+    // neither guard makes the other dead.
+    if (root.getAttribute('data-app-state') === 'expired') return;
+    var mine = (attachId += 1);
+    var loaded = false;
+    var settled = false;
+
+    function settle(state) {
+      if (settled || mine !== attachId) return;
+      if (root.getAttribute('data-app-state') === 'expired') return;
+      settled = true;
+      setState(state);
+    }
+
+    setState('connecting');
+    // THE ONLY PLACE A TOKEN IS WRITTEN. It goes into the frame's src and nowhere else.
+    frame.src = mint.url;
+
+    frame.addEventListener('error', function () { settle('unreachable-origin'); }, { once: true });
+    frame.addEventListener('load', function () {
+      // NECESSARY, NOT SUFFICIENT: Chromium fires this for a refused connection too (header note),
+      // so the probe is what decides \u2014 a frame that loaded on an origin nothing answered for is an
+      // error page, and calling that 'live' is the failure this arm exists to prevent.
+      loaded = true;
+      reachable(mint.url).then(function (ok) { settle(ok ? 'live' : 'unreachable-origin'); });
+    }, { once: true });
+
+    reachable(mint.url).then(function (ok) {
+      if (!ok) settle('unreachable-origin');
+      else if (loaded) settle('live');
+    });
+
+    // D-11's REQUIRED arm for the origin that never answers at all: a black-holed host fires no
+    // error and never loads, so silence past this bound is itself the signal, named rather than
+    // left as a spinner.
+    setTimeout(function () { settle('unreachable-origin'); }, loadTimeoutMs);
+  }
+
+  // D-10: the deadline was computed at RENDER time and arrives as a delta, so the host's own clock
+  // never enters the comparison. When it fires the document says so and stops \u2014 nothing here mints.
+  if (expiresInMs > 0) {
+    setTimeout(function () {
+      attachId += 1;
+      // Unconditional: the script returned above when mints was empty, and a non-empty mints is
+      // exactly the condition under which the renderer emits the iframe, so there is no reachable
+      // state in which this callback runs without a frame to strip.
+      frame.removeAttribute('src');
+      // The picker is an affordance of the EMBEDDED variant; when the variant is gone the
+      // affordance goes with it, so the control a person can reach and the state the document is in
+      // cannot disagree.
+      picker.setAttribute('disabled', '');
+      setState('expired');
+    }, expiresInMs);
+  }
+
+  // D-06/D-10: the picker swaps among tokens ALREADY minted for this render. It never mints, and
+  // there is no bridge here that could ask anyone to \u2014 a fresh watch call is what re-mints.
+  for (var i = 0; i < mints.length; i += 1) {
+    var option = document.createElement('option');
+    option.value = String(i);
+    option.textContent = 'handle ' + mints[i].handle;
+    picker.appendChild(option);
+  }
+  if (mints.length > 1) picker.removeAttribute('hidden');
+  picker.addEventListener('change', function () {
+    var chosen = mints[Number(picker.value)];
+    if (chosen !== undefined) attach(chosen);
+  });
+
+  attach(mints[0]);
+}());
+</script>
+</body>
+</html>
+`;
+}
+
+// src/live-link.ts
+function liveRunLinkOf(base, runId) {
+  return `${base.replace(/\/+$/u, "")}/runs/${encodeURIComponent(runId)}/live`;
+}
+function liveLinkLine(url) {
+  return `watch live or review: ${url}`;
+}
+var LIVE_LINK_ABSENT_LINE = "no dashboard configured \u2014 set services.dashboard.baseUrl";
+var LIVE_LINK_NO_RUN_LINE = "no run to link to \u2014 this result names no run id";
+function liveLinkLineFor(base, runId) {
+  if (base === void 0 || base.trim() === "") return LIVE_LINK_ABSENT_LINE;
+  if (runId === void 0 || runId === "") return LIVE_LINK_NO_RUN_LINE;
+  return liveLinkLine(liveRunLinkOf(base.trim(), runId));
 }
 
-// src/agent-qa-server.ts
-var DISCOVERY = {
-  name: "agent-qa",
-  purpose: "Author, validate, run, and triage agent-qa tests through local trusted MCP.",
-  tools: [
-    "agent_qa_discover",
-    "agent_qa_get_config",
-    "agent_qa_schema_reference",
-    "agent_qa_validate_definition",
-    "agent_qa_generate_id",
-    "agent_qa_validate_id",
-    "agent_qa_list_tests",
-    "agent_qa_read_test",
-    "agent_qa_validate_test",
-    "agent_qa_create_test",
-    "agent_qa_update_test",
-    "agent_qa_delete_test",
-    "agent_qa_list_suites",
-    "agent_qa_read_suite",
-    "agent_qa_validate_suite",
-    "agent_qa_create_suite",
-    "agent_qa_update_suite",
-    "agent_qa_delete_suite",
-    "agent_qa_list_hooks",
-    "agent_qa_read_hook",
-    "agent_qa_create_hook",
-    "agent_qa_update_hook",
-    "agent_qa_delete_hook",
-    "agent_qa_run_hook",
-    "agent_qa_enqueue_test_run",
-    "agent_qa_enqueue_suite_run",
-    "agent_qa_get_run",
-    "agent_qa_get_run_steps",
-    "agent_qa_get_run_logs",
-    "agent_qa_get_run_execution_logs",
-    "agent_qa_get_run_artifact",
-    "agent_qa_cancel_run",
-    "agent_qa_classify_failure"
-  ],
-  resources: SCHEMA_REFERENCE_NAMES.map((name) => `agent-qa://schema/${name}`),
-  prompts: ["agent_qa_authoring_context"],
-  phases: {
-    current: "discovery-schema-id-contracts",
-    next: ["authoring tools", "run execution and triage tools"]
+// src/app-resource.ts
+var MCP_APPS_EXTENSION_ID = "io.modelcontextprotocol/ui";
+var APP_RESOURCE_MIME_TYPE = "text/html;profile=mcp-app";
+var APP_RESOURCE_URI_TEMPLATE = "ui://agent-qa/live-run/{runId}";
+function appResourceUriFor(runId) {
+  return APP_RESOURCE_URI_TEMPLATE.replace("{runId}", encodeURIComponent(runId));
+}
+var APP_RESOURCE_NAME = "agent_qa_live_run_app";
+var APP_RESOURCE_TITLE = "agent-qa live run";
+var APP_RESOURCE_DESCRIPTION = "The live view for one run, as an MCP App: a sandboxed page embedding the run's live preview for each member handle. Rendered fresh on every read.";
+var APP_URI_PREFIX = "ui://agent-qa/live-run/";
+function parseAppUri(href) {
+  if (!href.startsWith(APP_URI_PREFIX)) return void 0;
+  const tail = href.slice(APP_URI_PREFIX.length);
+  if (tail === "") return void 0;
+  let decoded;
+  try {
+    decoded = decodeURIComponent(tail);
+  } catch {
+    return void 0;
+  }
+  const parsed = import_agent_qa_schema.RunsLiveUrlInputSchema.safeParse({ runId: decoded });
+  if (!parsed.success) return void 0;
+  return { runId: parsed.data.runId };
+}
+var APP_NEGOTIATION_CLIENT_CAPABILITIES_KEY = import_server.CLIENT_CAPABILITIES_META_KEY;
+function negotiatedAppsExtension(ctx) {
+  const envelope = ctx?.mcpReq?.envelope;
+  if (envelope === void 0) return false;
+  const capabilities = envelope[APP_NEGOTIATION_CLIENT_CAPABILITIES_KEY];
+  const extensions = capabilities?.extensions;
+  if (extensions === void 0) return false;
+  return Object.hasOwn(extensions, MCP_APPS_EXTENSION_ID);
+}
+var AppResourceNegotiationError = class extends Error {
+  constructor() {
+    super(
+      `this resource is an MCP App: it is served only to a client that declared the ${MCP_APPS_EXTENSION_ID} extension in its capabilities`
+    );
+    this.name = "AppResourceNegotiationError";
   }
 };
-function jsonContent(value) {
-  return {
-    content: [{
-      type: "text",
-      text: JSON.stringify(value, null, 2)
-    }]
-  };
+var AppResourceUriError = class extends Error {
+  constructor(detail) {
+    super(`${detail} is not a canonical ui://agent-qa/live-run address`);
+    this.name = "AppResourceUriError";
+  }
+};
+var AppResourceReadError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "AppResourceReadError";
+  }
+};
+var AppResourceOriginSpanError = class extends Error {
+  constructor(origins) {
+    super(
+      `this App document would span ${origins.length} origins (${[...origins].sort().join(", ")}) and one frame allowance covers one: refusing to serve a document whose panes it could not all reach`
+    );
+    this.name = "AppResourceOriginSpanError";
+  }
+};
+function isNotLiveRefusal(error) {
+  return error instanceof import_agent_qa_agent.UnknownRunError || error instanceof import_agent_qa_agent.LiveViewUnavailableError || error instanceof import_agent_qa_agent.FunctionNotBoundError;
 }
-function errorContent(message) {
-  return {
-    isError: true,
-    content: [{
-      type: "text",
-      text: message
-    }]
+async function announcedRoster(invoke, runId) {
+  const stream = await invoke(import_agent_qa_agent.RUNS_EVENTS_FUNCTION_ID, { runId });
+  const iterable = stream;
+  if (iterable === void 0 || typeof iterable[Symbol.asyncIterator] !== "function") {
+    return void 0;
+  }
+  const iterator = iterable[Symbol.asyncIterator]();
+  try {
+    const first = await iterator.next();
+    if (first.done === true) return void 0;
+    return (0, import_agent_qa_schema.handleRosterOf)(first.value);
+  } finally {
+    await iterator.return?.(void 0);
+  }
+}
+function createAppResourceReadHandler(deps) {
+  return async (uri, _variables, ctx) => {
+    if (!negotiatedAppsExtension(ctx)) throw new AppResourceNegotiationError();
+    const parsed = parseAppUri(uri.href);
+    if (parsed === void 0) {
+      throw new AppResourceUriError(deps.maskText(uri.href));
+    }
+    const { runId } = parsed;
+    let roster;
+    let notLive = false;
+    try {
+      roster = await announcedRoster(deps.invoke, runId);
+    } catch (err) {
+      if (!isNotLiveRefusal(err)) {
+        throw new AppResourceReadError(
+          deps.maskText(err instanceof Error ? err.message : String(err))
+        );
+      }
+      notLive = true;
+    }
+    const rosterToMint = roster === void 0 || roster.length === 0 ? [0] : roster;
+    const mints = [];
+    if (!notLive) {
+      for (const handle of rosterToMint) {
+        let minted;
+        try {
+          minted = await deps.invoke(import_agent_qa_agent.RUNS_LIVE_URL_FUNCTION_ID, {
+            runId,
+            handle
+          });
+        } catch (err) {
+          if (!isNotLiveRefusal(err)) {
+            throw new AppResourceReadError(
+              deps.maskText(err instanceof Error ? err.message : String(err))
+            );
+          }
+          continue;
+        }
+        mints.push({
+          handle: minted.handle,
+          liveUrl: minted.liveUrl,
+          expiresAt: minted.expiresAt,
+          streamKind: minted.stream.kind
+        });
+      }
+    }
+    const base = deps.liveLink?.dashboardBaseUrl();
+    const permanentLink = base === void 0 || base.trim() === "" ? void 0 : liveRunLinkOf(base.trim(), runId);
+    const frameOrigins = [
+      ...new Set(
+        mints.map((mint) => originOf(mint.liveUrl)).filter((origin) => origin !== void 0)
+      )
+    ];
+    if (frameOrigins.length > 1) throw new AppResourceOriginSpanError(frameOrigins);
+    const frameDomain = frameOrigins[0];
+    const html = renderAppWrapperPage({
+      runId,
+      mints,
+      permanentLink,
+      runLive: mints.length > 0
+    });
+    return {
+      contents: [
+        {
+          // Re-formatted through the codec's own vocabulary rather than echoed, so the address a
+          // caller reads back is the canonical one.
+          uri: `${APP_URI_PREFIX}${runId}`,
+          mimeType: APP_RESOURCE_MIME_TYPE,
+          text: html,
+          // The host's default is `frame-src 'none'`, so an App that names no frame domain paints
+          // a BLOCKED inner frame — the blank pane criterion 2 forbids (Pitfall 1). The allowed
+          // origin is the minted link's OWN origin rather than a separately configured one, so the
+          // allow can never be broader than the document needs (T-408-05). `frameDomain` is the ONE
+          // distinct origin `frameOrigins` above resolved over EVERY mint (IN-02) — not `mints[0]`'s,
+          // which was the same answer only by a fact held in another package.
+          //
+          // TWO ABSENCES, NOT ONE (corrected 2026-09-01, 408 gap round; `408-VERIFICATION.md` W-4 /
+          // `408-REVIEW.md` WR-03). This comment used to read "with no mints there is no inner
+          // frame, and the block is omitted rather than emitted empty", which describes only the
+          // FIRST of two conditions that both reach `frameDomain === undefined`. They are different
+          // questions with different served documents, and collapsing them told a reader about a
+          // state the code does not produce:
+          //   - `mints.length` asks whether there is anything to render at all. Zero mints means
+          //     `runLive` is `false`, the wrapper emits no `<iframe data-app-live-frame>`, and the
+          //     omitted `csp` block allows nothing because nothing needs allowing. Honest.
+          //   - `frameOrigins[0]` is the SEPARATE question of whether any surviving mint yielded a
+          //     parseable origin to put in `_meta.ui.csp`. With `mints.length > 0` and every
+          //     `originOf(mint.liveUrl)` answering `undefined`, `runLive` is `true` — the document
+          //     DOES emit the iframe and DOES assign `frame.src` — while the `csp` block is omitted,
+          //     so a conformant host falls back to `frame-src 'none'` and the pane is blocked and
+          //     blank. Not honest, and the sentence above never mentioned it.
+          //   WHY NO SHIPPED PORT REACHES IT: `runs.liveurl` would have to answer a `liveUrl` that
+          //   is not a parseable URL, and no shipped port does. The verifier measured this as
+          //   unreachable and classified W-4 as a documentation finding rather than a gap; the
+          //   wrapper's probe/timeout arm would in any case settle `unreachable-origin` with the
+          //   permanent link rather than leave a blank pane under a progress claim, so SC2 survives
+          //   even on the unreachable path.
+          //
+          // THE INVARIANT IS UNASSERTED, AND THAT IS A DATED DEFERRAL RATHER THAN A SILENCE
+          // (2026-09-01, 408 gap round). "Every mint that survives into `runLive` has a nameable
+          // origin" is asserted nowhere today — not here, not in `renderAppWrapperPage`, not in a
+          // cell. It is the natural candidate and it is NOT taken in this round, because this round
+          // is a gap-closure round whose whole reported gap is documentation integrity.
+          //   THE RULE THAT MAKES THAT CONSISTENT, because the neighbouring round looks
+          //   contradictory and a reader is entitled to it: THIS ROUND CHANGES WHAT THE SYSTEM
+          //   SAYS, NEVER WHAT IT DOES. 408-16 task 1 does edit a runtime file — `config.ts` — but
+          //   it only adds words to an error that was already being thrown on exactly the inputs it
+          //   was already thrown on; no parse outcome moves in either direction and no input that
+          //   succeeded now fails. Asserting the invariant here would add a NEW failure mode to a
+          //   path that currently succeeds. Operator-facing error prose is in scope because it is
+          //   prose; a new runtime invariant is out of scope because it is behaviour. That is the
+          //   whole distinction, and it is what makes W-2 closable in this round and W-4's
+          //   invariant half not.
+          //
+          // AND THE NEW PROSE CENSUS DOES NOT COVER THIS, which is the question the gap brief asks
+          // by name. `__tests__/withdrawn-claim-census.test.ts` gates ONE withdrawn security claim
+          // about the token channel, keyed on a channel cue bound to an exclusivity cue; W-4 is a
+          // different species — a comment that CONFLATES two conditions rather than one that
+          // over-claims a control — and widening that census to "any comment that conflates two
+          // conditions" is not mechanizable, and a vocabulary that tried would red on honest prose,
+          // which this round's own prohibition forbids.
+          //
+          // `connectDomains` NAMES THE SAME ONE ORIGIN, AND IT IS NOT OPTIONAL (408 plan 06 Task 2,
+          // MEASURED 2026-08-31). ext-apps' shipped schema documents `connectDomains` as mapping to
+          // `connect-src` with "empty or omitted -> no network connections (secure default)", and
+          // 408-02 D-H gave this wrapper a no-cors probe of the frame's origin — because Chromium
+          // fires `load` for a REFUSED connection, so `load` alone would label an error page `live`.
+          // With only `frameDomains` declared, a conformant host serves the App under
+          // `connect-src 'none'`, the probe is blocked before it leaves the document, and the
+          // wrapper settles in `unreachable-origin` for a live view that is perfectly reachable —
+          // measured in `app-host-harness.test.ts`, with Chromium naming the directive in its own
+          // console. That is not a blank frame, but it is a lie with a sentence attached, which is
+          // worse: it tells a person to go somewhere else while the pixels are right there.
+          //
+          // It is exactly as narrow as the frame allowance — the same single minted origin, never a
+          // wildcard and never a second configured value — so the App can reach the one host it
+          // embeds and nothing else.
+          ...frameDomain === void 0 ? {} : {
+            _meta: {
+              ui: { csp: { frameDomains: [frameDomain], connectDomains: [frameDomain] } }
+            }
+          }
+        }
+      ]
+    };
   };
 }
-function categorizeMcpTool(name) {
-  if (name === "agent_qa_discover") return "discovery";
-  if (name.includes("schema") || name.includes("definition") || name.includes("config")) return "schema";
-  if (name.includes("_id")) return "id";
-  if (name.includes("_hook")) return "hook";
-  if (name.includes("classify")) return "triage";
-  if (name.includes("_run") || name.includes("_logs") || name.includes("_artifact") || name.includes("_fix") || name.includes("_failure")) return "run";
-  if (name.includes("_test") || name.includes("_suite")) return "authoring";
-  return "unknown";
+function originOf(liveUrl) {
+  try {
+    return new URL(liveUrl).origin;
+  } catch {
+    return void 0;
+  }
+}
+function registerAppResources(server, deps) {
+  const declared = deps.registry.list(deps.caller);
+  const mint = declared.find((candidate) => candidate.id === import_agent_qa_agent.RUNS_LIVE_URL_FUNCTION_ID);
+  const roster = declared.find((candidate) => candidate.id === import_agent_qa_agent.RUNS_EVENTS_FUNCTION_ID);
+  if (mint === void 0 || roster === void 0) return [];
+  if (mint.bindingStatus !== "bound") return [];
+  const read = createAppResourceReadHandler({
+    // The wall, bound once: every mint crosses `invokeFunction` with this host's registry and this
+    // caller, so input validation and the binding check run exactly as they do for a tool call.
+    // There is no store, no cache and no second data path.
+    invoke: (opId, input) => (0, import_agent_qa_agent.invokeFunction)(deps.registry, opId, input, deps.caller),
+    maskText: deps.maskText,
+    // Absent stays ABSENT rather than becoming a present `undefined` supplier: the house rule for
+    // an optional member, and the two are the same posture to the read either way.
+    ...deps.liveLink === void 0 ? {} : { liveLink: deps.liveLink }
+  });
+  server.registerResource(
+    APP_RESOURCE_NAME,
+    // `list: undefined` is REQUIRED to be spelled out by the SDK, and here the explicit absence is
+    // load-bearing rather than merely honest: an unlisted template cannot be reached by
+    // enumeration, so no model walking `resources/list` can discover an address whose read mints a
+    // credential (Pitfall 2). Enumerating every watchable run is a listing this surface does not
+    // offer, and this is the line that says so.
+    new import_server.ResourceTemplate(APP_RESOURCE_URI_TEMPLATE, { list: void 0 }),
+    {
+      title: APP_RESOURCE_TITLE,
+      description: APP_RESOURCE_DESCRIPTION,
+      mimeType: APP_RESOURCE_MIME_TYPE
+    },
+    read
+  );
+  return [APP_RESOURCE_URI_TEMPLATE];
 }
-function isErrorResult(value) {
-  return Boolean(value && typeof value === "object" && value.isError === true);
+
+// src/instructions.ts
+var AGENT_QA_MCP_INSTRUCTIONS = [
+  "This project is tested with agent-qa. Read its runs and knowledge only through the agent_qa_* tools on this server, or the agent-qa CLI with --json.",
+  "Never open .agent-qa/, SQLite files, agent-qa-knowledge/memory/index/, memory/queue/, .lease or .epoch, and never list, glob or search those folders: they are agent-qa's runtime state.",
+  "Start with agent_qa_list_runs, then agent_qa_get_run_overview for one run.",
+  "The knowledge guide is agent-qa-knowledge/AGENTS.md; `npx agent-qa skills` lists the skills and their folder."
+].join("\n");
+
+// src/mapping.ts
+var import_agent_qa_schema2 = require("@vostride/agent-qa-schema");
+var MAX_RESULT_SIZE_META_KEY = "anthropic/maxResultSizeChars";
+var RUN_READ_MAX_RESULT_SIZE_CHARS = 1e5;
+function compositionOf(projection) {
+  if (projection.ops.length === 1) return "single";
+  return projection.discriminant === void 0 ? "pipeline" : "union";
 }
-function isDashboardErrorResult(value) {
-  const parsed = parseToolJsonContent(value);
-  return Boolean(parsed && typeof parsed === "object" && parsed.ok === false);
+var AGENT_QA_OP_CONTRACTS = Object.freeze({
+  "runs.mark": Object.freeze({ input: import_agent_qa_schema2.RunsMarkInputSchema, output: import_agent_qa_schema2.RunsMarkOutcomeSchema }),
+  // 2026-09-15, 423-21 D-18: the feedback reads keep their ops' own strict contracts. The preview
+  // takes runs.mark's exact input and answers the read-only plan result.
+  "runs.marks.history": Object.freeze({
+    input: import_agent_qa_schema2.RunsMarksHistoryInputSchema,
+    output: import_agent_qa_schema2.RunsMarksHistoryResultSchema
+  }),
+  "runs.mark.preview": Object.freeze({ input: import_agent_qa_schema2.RunsMarkInputSchema, output: import_agent_qa_schema2.RunsMarkPreviewResultSchema }),
+  "knowledge.gates.list": Object.freeze({
+    input: import_agent_qa_schema2.KnowledgeGatesListInputSchema,
+    output: import_agent_qa_schema2.KnowledgeGatesListResultSchema
+  }),
+  "authoring.draft.write": Object.freeze({
+    input: import_agent_qa_schema2.AuthoringDraftWriteInputSchema,
+    output: import_agent_qa_schema2.AuthoringDraftWriteOutputSchema
+  }),
+  "authoring.draft.edit": Object.freeze({
+    input: import_agent_qa_schema2.AuthoringDraftEditInputSchema,
+    output: import_agent_qa_schema2.AuthoringDraftEditOutputSchema
+  }),
+  "authoring.draft.verify": Object.freeze({
+    input: import_agent_qa_schema2.AuthoringVerifyDraftInputSchema,
+    output: import_agent_qa_schema2.AuthoringVerifyDraftOutputSchema
+  }),
+  "runs.start": Object.freeze({
+    input: import_agent_qa_schema2.RunsStartInputSchema,
+    output: import_agent_qa_schema2.RunStartAcknowledgementSchema
+  }),
+  "config.field.set": Object.freeze({
+    input: import_agent_qa_schema2.ConfigFieldSetInputSchema,
+    output: import_agent_qa_schema2.ConfigChangeOutputSchema
+  }),
+  "config.target.create": Object.freeze({
+    input: import_agent_qa_schema2.ConfigTargetCreateInputSchema,
+    output: import_agent_qa_schema2.ConfigChangeOutputSchema
+  }),
+  "config.target.edit": Object.freeze({
+    input: import_agent_qa_schema2.ConfigTargetEditInputSchema,
+    output: import_agent_qa_schema2.ConfigChangeOutputSchema
+  }),
+  "config.auth.set": Object.freeze({
+    input: import_agent_qa_schema2.ConfigAuthSetInputSchema,
+    output: import_agent_qa_schema2.ConfigChangeOutputSchema
+  }),
+  "config.hook.add": Object.freeze({
+    input: import_agent_qa_schema2.ConfigHookAddInputSchema,
+    output: import_agent_qa_schema2.ConfigChangeOutputSchema
+  }),
+  "config.project.scaffold": Object.freeze({
+    input: import_agent_qa_schema2.ConfigProjectScaffoldInputSchema,
+    output: import_agent_qa_schema2.ConfigChangeOutputSchema
+  }),
+  // 2026-09-30 (432-12 D-05): the three knowledge changes answer what they applied.
+  "knowledge.accept": Object.freeze({
+    input: import_agent_qa_schema2.KnowledgeAcceptChangeInputSchema,
+    output: import_agent_qa_schema2.KnowledgeChangeOutputSchema
+  }),
+  "knowledge.reject": Object.freeze({
+    input: import_agent_qa_schema2.KnowledgeRejectChangeInputSchema,
+    output: import_agent_qa_schema2.KnowledgeChangeOutputSchema
+  }),
+  "knowledge.forget": Object.freeze({
+    input: import_agent_qa_schema2.KnowledgeForgetChangeInputSchema,
+    output: import_agent_qa_schema2.KnowledgeChangeOutputSchema
+  }),
+  "entities.resolve": Object.freeze({
+    input: import_agent_qa_schema2.EntitiesResolveInputSchema,
+    output: import_agent_qa_schema2.EntityCardResolutionSchema
+  }),
+  "entities.get": Object.freeze({
+    input: import_agent_qa_schema2.EntitiesGetInputSchema,
+    output: import_agent_qa_schema2.EntityCardSchema
+  }),
+  // 2026-09-28 (431-03, D-03/D-07): the canonical list contract — `RunsListOutputSchema` as the
+  // validator, the same object `runs.list` enforces with, plus its explicit output document.
+  "runs.list": Object.freeze({
+    input: import_agent_qa_schema2.RunsListInputSchema,
+    output: import_agent_qa_schema2.RunsListOutputContract
+  }),
+  "runs.digest": Object.freeze({
+    input: import_agent_qa_schema2.RunsDigestInputSchema,
+    output: import_agent_qa_schema2.RunDigestSchema
+  }),
+  // 2026-09-28 (431-04 D-04/D-05/D-07): the eight reads keep their ops' own contracts. The
+  // evidence arms use the canonical output contracts, whose validators are the runtime schemas.
+  "knowledge.bundles.list": Object.freeze({
+    input: import_agent_qa_schema2.KnowledgeBundlesListInputSchema,
+    output: import_agent_qa_schema2.KnowledgeBundlesListOutputSchema
+  }),
+  "knowledge.records.inspect": Object.freeze({
+    input: import_agent_qa_schema2.KnowledgeRecordsInspectInputSchema,
+    output: import_agent_qa_schema2.KnowledgeRecordsInspectOutputSchema
+  }),
+  "knowledge.records.diff": Object.freeze({
+    input: import_agent_qa_schema2.KnowledgeRecordsDiffInputSchema,
+    output: import_agent_qa_schema2.KnowledgeRecordsDiffOutputSchema
+  }),
+  "knowledge.record.show": Object.freeze({
+    input: import_agent_qa_schema2.KnowledgeRecordShowInputSchema,
+    output: import_agent_qa_schema2.KnowledgeRecordShowResultSchema
+  }),
+  "knowledge.brief.why": Object.freeze({
+    input: import_agent_qa_schema2.BriefWhyInputSchema,
+    output: import_agent_qa_schema2.BriefWhyResultSchema
+  }),
+  "runs.knowledge": Object.freeze({
+    input: import_agent_qa_schema2.RunsKnowledgeInputSchema,
+    output: import_agent_qa_schema2.RunKnowledgeProjectionSchema
+  }),
+  "runs.overview": Object.freeze({
+    input: import_agent_qa_schema2.RunsOverviewInputSchema,
+    output: import_agent_qa_schema2.RunOverviewProjectionSchema
+  }),
+  "runs.evidence": Object.freeze({
+    input: import_agent_qa_schema2.RunsEvidenceInputSchema,
+    output: import_agent_qa_schema2.RunsEvidenceOutputContract
+  }),
+  "runs.artifact": Object.freeze({
+    input: import_agent_qa_schema2.RunsArtifactInputSchema,
+    output: import_agent_qa_schema2.RunsArtifactOutputContract
+  })
+});
+var AGENT_QA_TOOL_PROJECTIONS = Object.freeze([
+  Object.freeze({
+    name: "agent_qa_write_test",
+    ops: Object.freeze(["authoring.draft.write"]),
+    kind: "workflow"
+  }),
+  Object.freeze({
+    name: "agent_qa_refine_test",
+    ops: Object.freeze(["authoring.draft.edit", "authoring.draft.verify"]),
+    kind: "workflow",
+    discriminant: import_agent_qa_schema2.TOOL_FOLD_DISCRIMINANT
+  }),
+  Object.freeze({
+    name: "agent_qa_start_run",
+    ops: Object.freeze(["runs.start"]),
+    kind: "workflow",
+    // 408 D-05: a run starts and is immediately watchable. The ack carries the runId, so the
+    // per-call reference is derived from the OUTPUT.
+    ui: Object.freeze({ resource: "live-run", runIdFrom: "output" })
+  }),
+  // 2026-09-30 (432-12 D-05): the config change tool writes in the call. The undo arm is gone.
+  Object.freeze({
+    name: "agent_qa_change_config",
+    ops: Object.freeze([
+      "config.field.set",
+      "config.target.create",
+      "config.target.edit",
+      "config.auth.set",
+      "config.hook.add",
+      "config.project.scaffold"
+    ]),
+    kind: "workflow",
+    discriminant: import_agent_qa_schema2.TOOL_FOLD_DISCRIMINANT
+  }),
+  // 2026-09-30 (432-12 D-05/D-09): accept, reject and forget apply in the call. Forget is the
+  // explicit removal; a wrong record is otherwise corrected by new feedback.
+  Object.freeze({
+    name: "agent_qa_change_knowledge",
+    ops: Object.freeze([
+      "knowledge.accept",
+      "knowledge.reject",
+      "knowledge.forget"
+    ]),
+    kind: "workflow",
+    discriminant: import_agent_qa_schema2.TOOL_FOLD_DISCRIMINANT
+  }),
+  Object.freeze({
+    name: "agent_qa_mark_run",
+    ops: Object.freeze(["runs.mark"]),
+    kind: "apply"
+  }),
+  // 2026-09-15, 423-21 D-18: marks history and the mark consequence preview beside the mark
+  // writer. Both are read projections with no apply envelope, so `agent_qa_mark_run` stays the
+  // only door that lands a mark.
+  Object.freeze({
+    name: "agent_qa_get_run_marks",
+    ops: Object.freeze(["runs.marks.history"]),
+    kind: "read"
+  }),
+  Object.freeze({
+    name: "agent_qa_preview_run_mark",
+    ops: Object.freeze(["runs.mark.preview"]),
+    kind: "read"
+  }),
+  Object.freeze({
+    name: "agent_qa_list_knowledge_gates",
+    ops: Object.freeze(["knowledge.gates.list"]),
+    kind: "read"
+  }),
+  // 2026-09-28, 431 D-04: the knowledge reads, named one-to-one with their CLI verbs.
+  Object.freeze({
+    name: "agent_qa_list_knowledge_bundles",
+    ops: Object.freeze(["knowledge.bundles.list"]),
+    kind: "read"
+  }),
+  Object.freeze({
+    name: "agent_qa_inspect_knowledge_records",
+    ops: Object.freeze(["knowledge.records.inspect"]),
+    kind: "read"
+  }),
+  Object.freeze({
+    name: "agent_qa_diff_knowledge_records",
+    ops: Object.freeze(["knowledge.records.diff"]),
+    kind: "read"
+  }),
+  Object.freeze({
+    name: "agent_qa_show_knowledge_record",
+    ops: Object.freeze(["knowledge.record.show"]),
+    kind: "read"
+  }),
+  Object.freeze({
+    name: "agent_qa_explain_brief",
+    ops: Object.freeze(["knowledge.brief.why"]),
+    kind: "read"
+  }),
+  Object.freeze({
+    name: "agent_qa_get_entity",
+    ops: Object.freeze(["entities.resolve", "entities.get"]),
+    kind: "read"
+  }),
+  Object.freeze({
+    name: "agent_qa_list_runs",
+    ops: Object.freeze(["runs.list"]),
+    kind: "read"
+  }),
+  Object.freeze({
+    name: "agent_qa_get_run_digest",
+    ops: Object.freeze(["runs.digest"]),
+    kind: "read",
+    // 408 D-05/D-07: the watch/status read, and therefore the LATE-ATTACH door — a run started
+    // from the CLI, from CI or from the dashboard is watchable through it exactly as an
+    // MCP-started one is, because a viewer attaches and never owns. Its runId is on the INPUT.
+    ui: Object.freeze({ resource: "live-run", runIdFrom: "input" })
+  }),
+  // 2026-09-28, 431 D-05/D-06/D-07: one completed run's whole reads. The overview is the map, run
+  // knowledge the whole used-and-learned projection unchanged, and evidence one addressed document
+  // or blob. All three carry the result-size hint.
+  Object.freeze({
+    name: "agent_qa_get_run_overview",
+    ops: Object.freeze(["runs.overview"]),
+    kind: "read",
+    maxResultSizeChars: RUN_READ_MAX_RESULT_SIZE_CHARS
+  }),
+  Object.freeze({
+    name: "agent_qa_get_run_knowledge",
+    ops: Object.freeze(["runs.knowledge"]),
+    kind: "read",
+    maxResultSizeChars: RUN_READ_MAX_RESULT_SIZE_CHARS
+  }),
+  Object.freeze({
+    name: "agent_qa_get_run_evidence",
+    ops: Object.freeze(["runs.evidence", "runs.artifact"]),
+    kind: "read",
+    discriminant: import_agent_qa_schema2.TOOL_FOLD_DISCRIMINANT,
+    maxResultSizeChars: RUN_READ_MAX_RESULT_SIZE_CHARS
+  })
+]);
+var AGENT_QA_COMPOSED_CONTRACTS = Object.freeze({
+  agent_qa_refine_test: Object.freeze({
+    input: import_agent_qa_schema2.AuthoringRefineFoldInputSchema,
+    output: import_agent_qa_schema2.AuthoringRefineFoldOutputSchema
+  }),
+  agent_qa_change_config: Object.freeze({
+    input: import_agent_qa_schema2.ConfigChangeFoldInputSchema,
+    output: import_agent_qa_schema2.ConfigChangeFoldOutputSchema
+  }),
+  agent_qa_change_knowledge: Object.freeze({
+    input: import_agent_qa_schema2.KnowledgeChangeFoldInputSchema,
+    output: import_agent_qa_schema2.KnowledgeChangeFoldOutputSchema
+  }),
+  // 2026-09-28 (431-04 D-07): the evidence fold, composed in the schema package from both arms'
+  // canonical contracts and routed by full op id.
+  agent_qa_get_run_evidence: Object.freeze({
+    input: import_agent_qa_schema2.RunsEvidenceFoldInputSchema,
+    output: import_agent_qa_schema2.RunsEvidenceFoldOutputContract
+  }),
+  agent_qa_get_entity: Object.freeze({
+    input: import_agent_qa_schema2.EntitiesResolveInputSchema,
+    output: import_agent_qa_schema2.EntityCardResolutionSchema
+  })
+});
+function advertisedContracts(projection) {
+  const composed = AGENT_QA_COMPOSED_CONTRACTS[projection.name];
+  if (composed !== void 0) return composed;
+  const [only] = projection.ops;
+  return only === void 0 ? void 0 : AGENT_QA_OP_CONTRACTS[only];
 }
-function parseToolJsonContent(value) {
-  if (!value || typeof value !== "object") return void 0;
-  const content = value.content;
-  if (!Array.isArray(content)) return void 0;
-  const firstText = content.find(
-    (item) => item && typeof item === "object" && item.type === "text" && typeof item.text === "string"
-  );
-  if (!firstText) return void 0;
+var DEGRADED_OUTPUT_CONTRACTS = Object.freeze([
+  // 397 DISPOSITION (2026-08-16 · D-20): keep-degraded. `agent_qa_start_run` advertises no
+  // `outputSchema` and keeps it that way. The cause is a property of the CONTRACT, not of this
+  // surface — a branded run id is `z.string().transform(asRunId)`, and the converter refuses a
+  // transform because there is no true JSON-Schema for "and then this function runs". The two ways
+  // out are both worse: advertising the input-mode document is the second-recipe lie D-16 forbids,
+  // and un-branding the id to please a converter would spend a type-safety property of the whole
+  // codebase on one surface's listing. 397 rules the degradation ADJUDICATED and CLOSED rather than
+  // pending; re-opening it means changing the contract, which is a golden-diff-visible act. The
+  // absence itself is not re-pinned here — `projection.ts` probes the conversion both ways and the
+  // shipped projection suite owns that fact (RESEARCH Pitfall 9); the conformance suite asserts
+  // only the join.
+  Object.freeze({
+    tool: "agent_qa_start_run",
+    opId: "runs.start",
+    schema: "RunStartAcknowledgementSchema",
+    measured: "Transforms cannot be represented in JSON Schema",
+    adjudication: "397"
+  })
+  // 2026-09-28 (431-03, D-03/D-07 · research A1): the `agent_qa_list_runs` row is REMOVED, not
+  // re-ruled. Its objection stands — no hand-written array schema is advertised. What changed is the
+  // contract: `runs.list` now declares `RunsListOutputContract`, whose validator is the same
+  // `RunsListOutputSchema` object and whose output document is derived from the runtime schema's
+  // own output conversion. It converts cleanly, so the probe in `projection.ts` would refuse the row.
+]);
+var UNPROJECTED_ADJUDICATIONS = Object.freeze(["397", "398", "405", "408", "428"]);
+var UNPROJECTED_OPS = Object.freeze([
+  Object.freeze({
+    opId: "agent.ask",
+    reason: "D-03 (dated 2026-08-15): ask-over-MCP is nested-agent delegation \u2014 trust, token-driven LLM spend, lease interaction and streaming are four separate problems and no MCPS requirement asks for any of them. Deferred as its own seam, not omitted by oversight.",
+    adjudication: "397"
+  }),
+  // 2026-10-01 (432-17, D-05): `proposals.accept` and `proposals.reject` (397, requiresHumanOrigin)
+  // are deleted with the inbox and leave the scoping note.
+  // 2026-10-01 (432-18, D-14/D-15): `grants.revoke` (397, requiresHumanOrigin) and `grants.list`
+  // (397, not a mid-flight read) are deleted with the grant ledger and leave the scoping note.
+  Object.freeze({
+    opId: "runs.get",
+    reason: "not a mid-flight workflow read per D-02 \u2014 the entity door renders a run's card and the digest carries what triage needs; 397 adjudicates",
+    adjudication: "397"
+  }),
+  Object.freeze({
+    opId: "runs.events",
+    reason: "not a mid-flight workflow read per D-02, and a stream op besides: a `tools/call` is one round trip and has no shape for a resumable event feed; 397 adjudicates",
+    adjudication: "397"
+  }),
+  Object.freeze({
+    opId: "runs.postprocessing",
+    reason: "not a mid-flight workflow read per D-02; 397 adjudicates",
+    adjudication: "397"
+  }),
+  Object.freeze({
+    opId: "runs.detail",
+    reason: "D-03 (dated 2026-08-27, 405-01): not a mid-flight workflow read per D-02 \u2014 this is a COMPLETED run's projected step tree, read by the durable run-detail page, and the entity door already renders a run's card while the digest carries what triage needs. The whole projection of a run is also a large one-shot payload with no shape a `tools/call` round trip wants. Deferred as its own seam, not omitted.",
+    adjudication: "405"
+  }),
+  Object.freeze({
+    opId: "runs.liveurl",
+    reason: "D-03 (dated 2026-08-25, 403-01): the op MINTS A CREDENTIAL \u2014 a short-lived, view-scoped capability token for a running browser. Whether an agent-origin MCP caller may mint one, and what it may hand it to, is Phase 408's question (the MCP App embed); projecting it here would answer that question by accident. Deferred as its own seam, not omitted. ANSWERED (dated 2026-08-31, 408 D-01): the deferral above is discharged, and the ruling is INTERNAL MINT ONLY. The MCP server invokes this op BY REFERENCE, inside its App-rendering path and nowhere else, and the minted token lands only in the host-rendered HTML of the unlisted `ui://agent-qa/live-run/{runId}` App resource \u2014 never in tool-result text a model reads. Projecting a mint tool stays REJECTED: a live credential in model context is the T-395-R5-10 shape, and masking it would leave a tool that hands back nothing a host could use. The op therefore STAYS unprojected BY RULING rather than by deferral \u2014 answered on the record, never silently reclassified. RE-GROUNDED (dated 2026-09-01, 408 gap round, road `demote`; the full ruling is in `app-resource.ts`'s header). The answer above STANDS and one half of its stated property is corrected rather than deleted. Whether the document this server serves is host-rendered HTML or text a model consumes is a property of the CALLER, not of this server, so the \"never in tool-result text a model reads\" half over-claimed. What this server guarantees is narrower and it is verifiable: it writes the token into exactly one place, the frame src of the document the `ui://` read serves, and that door is reachable by any caller of a composition whose mint is bound (dated 2026-10-01, 432-20/432-21, D-12: the scope gate that once also bounded it is deleted for every caller, and the loopback bind and the Host/Origin guards still bound who can reach it). The op STAYS unprojected on exactly the same footing, and the reason is unchanged and STRONGER rather than weaker: a projected mint tool would put the credential on a channel a model consumes BY DEFAULT, on every call, for every caller, whereas the `ui://` read is an unlisted address a caller must already know and deliberately ask for.",
+    adjudication: "408"
+  }),
+  Object.freeze({
+    opId: "editor.liveurl",
+    reason: "D-07 (dated 2026-09-25, 428): the op MINTS A CREDENTIAL \u2014 a view credential for a live EDITOR session, which is private to the dashboard page that owns it; it is reachable only through the dashboard door and never through an MCP tool or the MCP App live-run resource. Projecting it would give an agent a watch carrier for a draft execution, which the owner declined in D-07. Unprojected by ruling, not by deferral.",
+    adjudication: "428"
+  }),
+  Object.freeze({
+    opId: "config.get",
+    reason: "not a mid-flight workflow read per D-02; 397 adjudicates",
+    adjudication: "397"
+  }),
+  Object.freeze({
+    opId: "analysis.get",
+    reason: "not a mid-flight workflow read per D-02; 397 adjudicates",
+    adjudication: "397"
+  }),
+  Object.freeze({
+    opId: "authoring.funnel.get",
+    reason: "not a mid-flight workflow read per D-02; 397 adjudicates",
+    adjudication: "397"
+  }),
+  Object.freeze({
+    opId: "quarantine.add",
+    reason: "not a mid-flight workflow write per D-02; 397 adjudicates",
+    adjudication: "397"
+  }),
+  Object.freeze({
+    opId: "quarantine.release",
+    reason: "not a mid-flight workflow write per D-02; 397 adjudicates",
+    adjudication: "397"
+  }),
+  Object.freeze({
+    opId: "quarantine.list",
+    reason: "not a mid-flight workflow read per D-02; 397 adjudicates",
+    adjudication: "397"
+  }),
+  // 398 D-09 (dated 2026-08-17): the twentieth entry, and the FIRST op ever dispositioned here that
+  // 397 did not rule on — because it did not exist then. Its exclusion is argued rather than scoped,
+  // which is why it does not take the mid-flight line: `agent.explain` answers "what can you do",
+  // and 397 already ruled the v1 discovery tool NOT a gap on this surface, because the protocol
+  // answers machine discovery itself. Projecting it anyway would be the third answer that ruling
+  // refuses.
+  Object.freeze({
+    opId: "agent.explain",
+    reason: "D-09 (dated 2026-08-17): the protocol answers machine discovery itself \u2014 `tools/list` plus SEP-2575 `server/discover` \u2014 and 398's `init --agent` manifest answers agent discovery from the committed catalog. This op answers a PERSON asking in prose, which is a third question with a third audience. 397 ruled the v1 discovery TOOL not-a-gap on exactly this reasoning; projecting the op would reinstate it under a new name.",
+    adjudication: "398"
+  })
+  // 2026-09-30 (432-12 D-05): the five pre-432 proposal ops went off the catalogue with their
+  // tools. 2026-10-01 (432-17 D-05): they are deleted from the registry and leave the scoping note.
+]);
+var PROJECTED_RULING_ADDENDA = Object.freeze([
+  Object.freeze({
+    opId: "knowledge.bundles.list",
+    ruledBy: "397",
+    ruling: "not a mid-flight workflow read per D-02; 397 adjudicates",
+    addendum: "D-01/D-04 (dated 2026-09-28, 431-04): projected as `agent_qa_list_knowledge_bundles`. A coding agent in a fresh workspace reads knowledge only through structured channels, so the committed-knowledge reads are served here rather than left to files; this supersedes the 2026-09-14 decision that projected the six safe reads only, whose no-search half stands (D-09)."
+  }),
+  Object.freeze({
+    opId: "knowledge.records.inspect",
+    ruledBy: "397",
+    ruling: "not a mid-flight workflow read per D-02; 397 adjudicates",
+    addendum: "D-01/D-04 (dated 2026-09-28, 431-04): projected as `agent_qa_inspect_knowledge_records`. A coding agent in a fresh workspace reads knowledge only through structured channels, so the committed-knowledge reads are served here rather than left to files; this supersedes the 2026-09-14 decision that projected the six safe reads only, whose no-search half stands (D-09)."
+  }),
+  Object.freeze({
+    opId: "knowledge.records.diff",
+    ruledBy: "397",
+    ruling: "not a mid-flight workflow read per D-02; 397 adjudicates",
+    addendum: "D-01/D-04 (dated 2026-09-28, 431-04): projected as `agent_qa_diff_knowledge_records`. A coding agent in a fresh workspace reads knowledge only through structured channels, so the committed-knowledge reads are served here rather than left to files; this supersedes the 2026-09-14 decision that projected the six safe reads only, whose no-search half stands (D-09)."
+  }),
+  Object.freeze({
+    opId: "knowledge.record.show",
+    ruledBy: "397",
+    ruling: "not a mid-flight workflow read per D-02; 397 adjudicates",
+    addendum: "D-01/D-04 (dated 2026-09-28, 431-04): projected as `agent_qa_show_knowledge_record`. A coding agent in a fresh workspace reads knowledge only through structured channels, so the committed-knowledge reads are served here rather than left to files; this supersedes the 2026-09-14 decision that projected the six safe reads only, whose no-search half stands (D-09)."
+  }),
+  Object.freeze({
+    opId: "knowledge.brief.why",
+    ruledBy: "397",
+    ruling: "not a mid-flight workflow read per D-02; 397 adjudicates",
+    addendum: "D-01/D-04 (dated 2026-09-28, 431-04): projected as `agent_qa_explain_brief`. A coding agent in a fresh workspace reads knowledge only through structured channels, so the committed-knowledge reads are served here rather than left to files; this supersedes the 2026-09-14 decision that projected the six safe reads only, whose no-search half stands (D-09)."
+  }),
+  Object.freeze({
+    opId: "runs.knowledge",
+    ruledBy: "407",
+    ruling: "D-05 (dated 2026-08-29, 407-01): not a mid-flight workflow read per D-02 \u2014 this is a COMPLETED run's used-and-learned projection, read by the durable Knowledge tab, and it is unprojected on exactly the footing its sibling `runs.detail` is. It carries every step's three served brief channels, each one's serve-time retrieval trace and the truncated candidate ledger beside it, so it is a large one-shot payload with no shape a `tools/call` round trip wants \u2014 larger than the step tree, not smaller. A planner mid-flight also has no use for what a FINISHED run was briefed with; the entity door already renders a record's card and the digest carries what triage needs. Deferred as its own seam, not omitted.",
+    addendum: "D-05 (dated 2026-09-28, 431-04): projected as `agent_qa_get_run_knowledge`, answering the whole `runs.knowledge` projection unchanged; the owner declined a step filter. The size objection above is answered in these terms: `agent_qa_get_run_overview` is the entry point that maps a run without bodies, `agent_qa_explain_brief` and `agent_qa_show_knowledge_record` are the drill-down, and the tool carries a 100000-character result-size hint so a host keeps the one-shot answer whole."
+  }),
+  Object.freeze({
+    opId: "runs.evidence",
+    ruledBy: "423",
+    ruling: "D-04 (dated 2026-09-15, 423-21): not a mid-flight workflow read per D-02 \u2014 this is one COMPLETED run step's parsed evidence document (console, network, variables, accessibility or ARIA), read by the dashboard evidence tabs, and it is unprojected on exactly the footing its sibling `runs.detail` is. A network document alone may carry hundreds of records, so it is a large one-shot payload with no shape a `tools/call` round trip wants, and a planner mid-flight has no use for a finished step's captured traffic. The raw SHA bytes stay on `runs.artifact` and the two HTTP doors. Deferred as its own seam, not omitted.",
+    addendum: "D-07 (dated 2026-09-28, 431-04): projected as the `runs.evidence` arm of `agent_qa_get_run_evidence`. A caller asks for ONE step document by the exact address `agent_qa_get_run_overview` supplies, so the answer is one addressed document rather than a run's captured traffic. Masking is unchanged: the op stays on the cold read-scope allowlist. The tool carries the 100000-character result-size hint."
+  }),
+  Object.freeze({
+    opId: "runs.artifact",
+    ruledBy: "405",
+    ruling: "D-12/D-13 (dated 2026-08-27, 405-05): not a mid-flight workflow read per D-02 \u2014 this resolves ONE completed run's content-addressed evidence blob, and its result is a base64 body. A `tools/call` round trip is the wrong carriage for bytes: a conversation cannot render a PNG, and a tool that returned one would spend a context window on a payload no reader can read. The two HTTP doors are its carriage, and 408's embed is the surface that renders it. Deferred as its own seam, not omitted. Phase 424 (dated 2026-09-20): the recording fact rides runs.detail; runs.artifact answers a bounded slice when range is supplied; pulling a whole recording through unary base64 is permitted and not recommended; no recording tool is projected because the MX ceiling of 22 is fully allocated.",
+    addendum: "D-07 (dated 2026-09-28, 431-04): projected as the `runs.artifact` arm of `agent_qa_get_run_evidence`. The blob is addressed by the sha the overview supplies, with no step-to-sha lookup inside the tool, and the rendering objection is answered by the image result arm 431-05 adds. The Phase 424 note that the MX ceiling of 22 was fully allocated is superseded: the ceiling is 24 (D-01)."
+  })
+]);
+
+// src/masked-result.ts
+var import_agent_qa_schema3 = require("@vostride/agent-qa-schema");
+var WITHHELD_TEXT = "This result could not be returned: part of its output could not be masked in place \u2014 a value whose hidden form would not be the same kind of value, or two names that mask to one name \u2014 so the unmasked object was withheld rather than served.";
+var UnmaskableValueError = class extends Error {
+};
+function maskJsonLeaves(value, maskText) {
+  if (typeof value === "string") return maskText(value);
+  if (value === null) return null;
+  if (Array.isArray(value)) {
+    return value.map((entry) => maskJsonLeaves(entry, maskText));
+  }
+  if (typeof value === "object") {
+    const masked = {};
+    for (const [key, entry] of Object.entries(value)) {
+      const maskedKey = maskText(key);
+      if (Object.hasOwn(masked, maskedKey)) {
+        throw new UnmaskableValueError("two keys of one object mask to the same name");
+      }
+      Object.defineProperty(masked, maskedKey, {
+        value: maskJsonLeaves(entry, maskText),
+        enumerable: true,
+        writable: true,
+        configurable: true
+      });
+    }
+    return masked;
+  }
+  const spelling = JSON.stringify(value) ?? "null";
+  if (maskText(spelling) !== spelling) {
+    throw new UnmaskableValueError("a non-string leaf spells a registered value");
+  }
+  return value;
+}
+function maskJsonDocument(output, maskText) {
+  const serialized = JSON.stringify(output) ?? "null";
+  let parsed;
+  try {
+    parsed = JSON.parse(serialized);
+  } catch {
+    return void 0;
+  }
+  let value;
   try {
-    return JSON.parse(firstText.text);
+    value = maskJsonLeaves(parsed, maskText);
   } catch {
     return void 0;
   }
+  const text = JSON.stringify(value);
+  if (text === void 0) return void 0;
+  return { value, text };
 }
-function categorizeMcpError(errOrResult) {
-  if (errOrResult instanceof import_zod.z.ZodError) return "validation";
-  const parsed = parseToolJsonContent(errOrResult);
-  const candidate = parsed && typeof parsed === "object" ? parsed : void 0;
-  if (candidate && candidate.ok === false) return "dashboard_error";
-  if (errOrResult instanceof Error) return "tool_error";
-  if (isErrorResult(errOrResult)) return "tool_error";
-  return "unknown";
+function maskedToolResult(output, maskText) {
+  const masked = maskJsonDocument(output, maskText);
+  if (masked === void 0) {
+    return {
+      content: [{ type: "text", text: WITHHELD_TEXT }],
+      isError: true
+    };
+  }
+  return {
+    content: [{ type: "text", text: masked.text }],
+    structuredContent: masked.value
+  };
 }
-function extractExplicitCanonicalRunId(input) {
-  if (!input || typeof input !== "object" || Array.isArray(input)) return void 0;
-  const runId = input.runId;
-  return typeof runId === "string" && (0, import_agent_qa_ids2.isCanonicalId)("run", runId) ? runId : void 0;
+function maskedToolError(err, maskText) {
+  const message = err instanceof Error ? err.message : String(err);
+  return {
+    content: [
+      {
+        type: "text",
+        text: maskText(message)
+      }
+    ],
+    isError: true
+  };
 }
-function extractSuccessfulEnqueueRunId(result) {
-  if (isErrorResult(result)) return void 0;
-  const parsed = parseToolJsonContent(result);
-  const container = parsed && typeof parsed === "object" ? parsed : void 0;
-  if (!container) return void 0;
-  const body = container.body && typeof container.body === "object" ? container.body : container;
-  for (const key of ["runId", "id", "parentRunId"]) {
-    const value = body[key];
-    if (typeof value === "string" && (0, import_agent_qa_ids2.isCanonicalId)("run", value)) return value;
+var RUN_EVIDENCE_IMAGE_TYPES = /* @__PURE__ */ new Set(["image/png", "image/jpeg"]);
+var RUN_EVIDENCE_IMAGE_TEXT_MARKER = "[image attached as image content]";
+var PNG_SIGNATURE = [137, 80, 78, 71, 13, 10, 26, 10];
+var PNG_IEND_TRAILER = [
+  0,
+  0,
+  0,
+  0,
+  73,
+  69,
+  78,
+  68,
+  174,
+  66,
+  96,
+  130
+];
+var JPEG_START = [255, 216, 255];
+var JPEG_END = [255, 217];
+var CANONICAL_BASE64 = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/;
+function refusalText(refusal, contentType) {
+  switch (refusal) {
+    case "artifact-range-fragment":
+      return "artifact-range-fragment: agent_qa_get_run_evidence returns a screenshot only as one complete PNG or JPEG image, and this range covers part of one. Call runs.artifact without a range.";
+    case "artifact-not-image":
+      return `artifact-not-image: this artifact is ${contentType ?? "not typed"}, not a PNG or JPEG screenshot, and agent_qa_get_run_evidence relays no other artifact bytes. Read a step document through action runs.evidence.`;
+    case "artifact-image-invalid":
+      return "artifact-image-invalid: the artifact is typed as an image, but its bytes are not one complete PNG or JPEG, so they were not returned.";
+    case "artifact-image-withheld":
+      return "artifact-image-withheld: masking changed the encoded screenshot, so neither the image nor its bytes were returned.";
   }
-  return void 0;
 }
-function resolveDashboardApiUrl(dashboardUrl, apiPath) {
-  const base = dashboardUrl.endsWith("/") ? dashboardUrl : `${dashboardUrl}/`;
-  const normalizedPath = apiPath.startsWith("/") ? apiPath.slice(1) : apiPath;
-  return new URL(normalizedPath, base).toString();
+function hasBytesAt(bytes, expected, offset) {
+  if (offset < 0 || bytes.length < offset + expected.length) return false;
+  return expected.every((byte, index) => bytes[offset + index] === byte);
 }
-function withQuery(path, query) {
-  const params = new URLSearchParams();
-  for (const [key, value] of Object.entries(query)) {
-    if (value !== void 0) params.set(key, String(value));
+function isCompleteImage(contentType, bytes) {
+  if (contentType === "image/png") {
+    return hasBytesAt(bytes, PNG_SIGNATURE, 0) && hasBytesAt(bytes, PNG_IEND_TRAILER, bytes.length - PNG_IEND_TRAILER.length);
   }
-  const queryString = params.toString();
-  return queryString ? `${path}?${queryString}` : path;
+  return hasBytesAt(bytes, JPEG_START, 0) && hasBytesAt(bytes, JPEG_END, bytes.length - JPEG_END.length);
 }
-async function callDashboardApi(input) {
-  const response = await fetch(resolveDashboardApiUrl(input.dashboardUrl, input.path), {
-    method: input.method ?? "GET",
-    headers: input.body === void 0 ? void 0 : { "content-type": "application/json" },
-    body: input.body === void 0 ? void 0 : JSON.stringify(input.body)
+function decodeCanonicalBase64(text) {
+  if (!CANONICAL_BASE64.test(text)) return void 0;
+  let binary;
+  try {
+    binary = atob(text);
+  } catch {
+    return void 0;
+  }
+  if (btoa(binary) !== text) return void 0;
+  return Uint8Array.from(binary, (char) => char.charCodeAt(0));
+}
+function coversWholeBlob(artifact) {
+  if (artifact.range === void 0) {
+    return artifact.totalLength === void 0 || artifact.totalLength === artifact.byteLength;
+  }
+  return artifact.totalLength !== void 0 && artifact.range.start === 0 && artifact.range.end === artifact.totalLength - 1 && artifact.byteLength === artifact.totalLength;
+}
+function decorateRunEvidenceImage(input) {
+  const { result } = input;
+  if (result.isError === true) return result;
+  const refuse = (refusal, contentType) => ({
+    content: [{ type: "text", text: input.maskText(refusalText(refusal, contentType)) }],
+    isError: true,
+    ...result._meta === void 0 ? {} : { _meta: result._meta }
   });
-  const text = await response.text();
-  let body = null;
-  if (text.length > 0) {
-    try {
-      body = JSON.parse(text);
-    } catch {
-      body = text;
-    }
+  const parsed = import_agent_qa_schema3.RunsArtifactResultSchema.safeParse(input.output);
+  if (!parsed.success) return refuse("artifact-image-invalid");
+  const artifact = parsed.data;
+  if (!RUN_EVIDENCE_IMAGE_TYPES.has(artifact.contentType)) {
+    return refuse("artifact-not-image", artifact.contentType);
+  }
+  if (!coversWholeBlob(artifact)) return refuse("artifact-range-fragment");
+  const masked = result.structuredContent;
+  if (masked?.bytesBase64 !== artifact.bytesBase64 || masked.contentType !== artifact.contentType) {
+    return refuse("artifact-image-withheld");
   }
+  const bytes = decodeCanonicalBase64(artifact.bytesBase64);
+  if (bytes === void 0 || bytes.length !== artifact.byteLength || !isCompleteImage(artifact.contentType, bytes)) {
+    return refuse("artifact-image-invalid");
+  }
+  const text = JSON.stringify({ ...masked, bytesBase64: RUN_EVIDENCE_IMAGE_TEXT_MARKER });
   return {
-    ok: response.ok,
-    status: response.status,
-    body
+    ...result,
+    content: [
+      ...result.content.map((block) => block.type === "text" ? { type: "text", text } : block),
+      { type: "image", data: artifact.bytesBase64, mimeType: artifact.contentType }
+    ]
   };
 }
-function collectStrings(value, output = [], limit = 80) {
-  if (output.length >= limit) return output;
-  if (typeof value === "string" && value.trim().length > 0) {
-    output.push(value);
-  } else if (Array.isArray(value)) {
-    for (const item of value) collectStrings(item, output, limit);
-  } else if (value && typeof value === "object") {
-    for (const child of Object.values(value)) collectStrings(child, output, limit);
-  }
-  return output;
+
+// src/migration-map.ts
+var V1_TOOL_MIGRATION_MAP = Object.freeze([
+  // 1
+  Object.freeze({
+    v1Name: "agent_qa_discover",
+    arm: "retired",
+    note: "not-a-gap (397, 2026-08-16): the protocol answers discovery itself, so a hand-written catalogue tool beside it would be a second, drifting answer to one question.",
+    route: "`tools/list` (plus SEP-2575 `server/discover`) answers machine discovery; 398's build-time capability catalog, carried by `agent-qa init --agent`, answers the human-facing version."
+  }),
+  // 2
+  Object.freeze({
+    v1Name: "agent_qa_get_config",
+    arm: "retired",
+    note: "A4 adjudication (2026-08-17, phase 398 plan 02): the inventory rules this row `n/a -> projected by 396`, but `config.get` is in UNPROJECTED_OPS after 396 plan 04 \u2014 not a mid-flight workflow read per D-02 \u2014 so there is no live tool to rename to.",
+    route: "no MCP tool reads configuration; the workspace posture an agent needs reaches it through `agent-qa init --agent`'s manifest (398 D-16), by env-ref name and never by value."
+  }),
+  // 3
+  Object.freeze({
+    v1Name: "agent_qa_schema_reference",
+    arm: "retired",
+    note: "not-a-gap (397, 2026-08-16): a served COPY of a contract is exactly the drift that advertising the live contract replaced.",
+    route: "every tool advertises its op's live `inputSchema`/`outputSchema` in `tools/list` (396 D-16), so a caller reads the contract the gate actually validates with; a fold lists its arms' fields as one object, and its `action` field says which fields each action takes."
+  }),
+  // 4
+  Object.freeze({
+    v1Name: "agent_qa_validate_definition",
+    arm: "retired",
+    note: "not-a-gap (397, 2026-08-16): a standalone linter over arbitrary text is a second validator that can disagree with the one that gates writes.",
+    route: "validation reaches a caller as `authoring.draft.verify`'s verdict inside the authoring funnel \u2014 the verify arm of `agent_qa_refine_test`."
+  }),
+  // 5
+  Object.freeze({
+    v1Name: "agent_qa_generate_id",
+    arm: "retired",
+    note: "not-a-gap (397, 2026-08-16): died with the CRUD model. Minting a canonical id on a surface is what 394-11 removed from the CLI, for this same reason.",
+    route: "ids are minted host-side where the entity is written; a caller names what it wants and reads the id back off the entity card `agent_qa_get_entity` returns."
+  }),
+  // 6
+  Object.freeze({
+    v1Name: "agent_qa_validate_id",
+    arm: "retired",
+    note: "not-a-gap (397, 2026-08-16): died with the CRUD model. A standalone validator would be a second answer to a question already answered at every parse point.",
+    route: "the one URI codec (`packages/schema/src/entity/uri.ts`) validates every `agentqa://` reference as it is parsed, including the one `agent_qa_get_entity` resolves."
+  }),
+  // 7
+  Object.freeze({
+    v1Name: "agent_qa_list_tests",
+    arm: "pending",
+    note: "gap (397, 2026-08-16): nothing in the registry enumerates the test corpus \u2014 `entities.resolve` resolves a reference to an entity, which is a different question.",
+    route: "until the owning milestone mints `entities.list`, a known reference resolves through `agent_qa_get_entity`; enumeration has no tool.",
+    owner: "M5 (live view & run invocation)"
+  }),
+  // 8
+  Object.freeze({
+    v1Name: "agent_qa_read_test",
+    arm: "renamed-to",
+    v2Tool: "agent_qa_get_entity",
+    note: "projected by 396 (inventory row 8, 2026-08-16): `entities.get` is D-02's universal entity read, kind TST, behind the one read door."
+  }),
+  // 9
+  Object.freeze({
+    v1Name: "agent_qa_validate_test",
+    arm: "retired",
+    note: "not-a-gap (397, 2026-08-16): row 4's ruling. `authoring.draft.verify` is the only validator, and it validates a draft in the funnel rather than arbitrary text a caller pasted.",
+    route: "the verify arm of `agent_qa_refine_test` returns the same verdict that gates the write."
+  }),
+  // 10
+  Object.freeze({
+    v1Name: "agent_qa_create_test",
+    arm: "renamed-to",
+    v2Tool: "agent_qa_write_test",
+    note: "projected by 396 (inventory row 10, 2026-08-16): `authoring.draft.write` is workflow-coarse and verifies a draft rather than performing v1's blind write, so the input shape differs. Since 2026-10-02 (432-40, D-06) it writes the test file in the call unless a keep-gate rejected the draft."
+  }),
+  // 11
+  Object.freeze({
+    v1Name: "agent_qa_update_test",
+    arm: "renamed-to",
+    v2Tool: "agent_qa_refine_test",
+    note: "projected by 396 (inventory row 11, 2026-08-16): `authoring.draft.edit` is the edit arm of the refine fold, selected by the fold discriminant."
+  }),
+  // 12
+  Object.freeze({
+    v1Name: "agent_qa_delete_test",
+    arm: "retired",
+    note: "not-a-gap (397, 2026-08-16): a rule, not an absence. MCPS-02 forbids a surface delete verb for irreversible deletes.",
+    route: "removing a committed test is a repository edit a person makes and reviews; no surface has a delete door and none is coming."
+  }),
+  // 13
+  Object.freeze({
+    v1Name: "agent_qa_list_suites",
+    arm: "pending",
+    note: `gap (397, 2026-08-16): folded into row 7's verb \u2014 enumerating the corpus answers "which tests exist, and in which files". A suite is a file, so this is not a second registry.`,
+    route: "until `entities.list` lands, suite membership is read from the workspace files themselves; the TST records inside them resolve through `agent_qa_get_entity`.",
+    owner: "M5 (live view & run invocation)"
+  }),
+  // 14
+  Object.freeze({
+    v1Name: "agent_qa_read_suite",
+    arm: "retired",
+    note: "not-a-gap (397, 2026-08-16): there is no suite RECORD to read. `ENTITY_KINDS` has no suite kind and a suite is a committed file addressed by workspace path.",
+    route: "the TST records inside a suite are `agent_qa_get_entity`'s job; the file itself is read from the workspace."
+  }),
+  // 15
+  Object.freeze({
+    v1Name: "agent_qa_validate_suite",
+    arm: "retired",
+    note: "not-a-gap (397, 2026-08-16): row 4's ruling \u2014 one validator, inside the funnel.",
+    route: "the verify arm of `agent_qa_refine_test` validates the draft that joins the suite file."
+  }),
+  // 16
+  Object.freeze({
+    v1Name: "agent_qa_create_suite",
+    arm: "retired",
+    note: "not-a-gap (397, 2026-08-16): a suite is a committed file the authoring funnel writes. A blind create is the v1 write the verified authoring funnel replaced (re-spelled 2026-10-02, 432-40, D-06: the funnel writes in the call).",
+    route: "`agent_qa_write_test` names the suite file a draft joins and writes it in the call, unless a keep-gate rejected the draft."
+  }),
+  // 17
+  Object.freeze({
+    v1Name: "agent_qa_update_suite",
+    arm: "retired",
+    note: "not-a-gap (397, 2026-08-16): row 16's ruling, through the edit arm instead of the write (re-spelled 2026-10-02, 432-40, D-06: the edit lands in the call).",
+    route: "`agent_qa_refine_test` edits the written test; the suite file changes in the call."
+  }),
+  // 18
+  Object.freeze({
+    v1Name: "agent_qa_delete_suite",
+    arm: "retired",
+    note: "not-a-gap (397, 2026-08-16): row 12's MCPS-02 rule, applied to the file rather than the record.",
+    route: "removing a suite file is a repository edit a person makes and reviews; no surface door exists."
+  }),
+  // 19
+  Object.freeze({
+    v1Name: "agent_qa_list_hooks",
+    arm: "pending",
+    note: "gap (397, 2026-08-16, corrected the same day): the 396 reason overstated `config.get`, which projects the resolved CONFIG's leaves; hook definitions live in the separate `workspace.hooksFile`, so no registered op reads them today.",
+    route: "until the owning milestone re-opens the hook execution model, hooks are read from `workspace.hooksFile` in the workspace; no tool enumerates them.",
+    owner: "M7 (skills layer)"
+  }),
+  // 20
+  Object.freeze({
+    v1Name: "agent_qa_read_hook",
+    arm: "pending",
+    note: "gap (397, 2026-08-16): with row 19, ONE hook-read verb and not two. What `config.get` shows is `workspace.hooksFile` \u2014 the path, not the hooks.",
+    route: "until that verb lands, a single hook is read from the hooks file itself; no tool projects it.",
+    owner: "M7 (skills layer)"
+  }),
+  // 21
+  Object.freeze({
+    v1Name: "agent_qa_create_hook",
+    arm: "renamed-to",
+    v2Tool: "agent_qa_change_config",
+    note: "projected by 396 (inventory row 21, 2026-08-16): `config.hook.add` is an arm of the config fold. Since 2026-09-30 (432-12, D-05) the fold is `agent_qa_change_config` and the hook is written in the call, with the files it changed on the answer."
+  }),
+  // 22
+  Object.freeze({
+    v1Name: "agent_qa_update_hook",
+    arm: "pending",
+    note: "gap (397, 2026-08-16): `config.field.set` reaches any schema-addressable CONFIG path and the hooks file is not one, so an existing hook has no edit verb. Minting one now would pin an edit shape to a contract the owning milestone revisits.",
+    route: "adding a hook goes through `agent_qa_change_config`; editing an existing one is a hooks-file edit a person makes until the owner rules on the verb.",
+    owner: "M7 (skills layer)"
+  }),
+  // 23
+  Object.freeze({
+    v1Name: "agent_qa_delete_hook",
+    arm: "retired",
+    note: "not-a-gap (397, 2026-08-16): row 12's MCPS-02 rule.",
+    route: "removing a hook is an edit to the hooks file that a person makes and reviews."
+  }),
+  // 24
+  Object.freeze({
+    v1Name: "agent_qa_run_hook",
+    arm: "retired",
+    note: `not-a-gap (397, 2026-08-16): a hook's whole contract is "runs at this lifecycle point". Invoking one by name from a surface is arbitrary script execution decoupled from the lifecycle that gives it meaning \u2014 the private-power shape M4 abolished.`,
+    route: "hooks run at their declared lifecycle points during a run started by `agent_qa_start_run`; nothing invokes one out of band."
+  }),
+  // 25
+  Object.freeze({
+    v1Name: "agent_qa_enqueue_test_run",
+    arm: "renamed-to",
+    v2Tool: "agent_qa_start_run",
+    note: "projected by 396 (inventory row 25, 2026-08-16): `runs.start` is workflow-coarse, and the test scope is an argument rather than a tool of its own."
+  }),
+  // 26
+  Object.freeze({
+    v1Name: "agent_qa_enqueue_suite_run",
+    arm: "renamed-to",
+    v2Tool: "agent_qa_start_run",
+    note: "projected by 396 (inventory row 26, 2026-08-16): the SAME op as row 25 at suite scope, which is why D-01 allows one tool over both."
+  }),
+  // 27
+  Object.freeze({
+    v1Name: "agent_qa_get_run",
+    arm: "retired",
+    note: "A4 adjudication (2026-08-17, phase 398 plan 02): the inventory rules this row `n/a -> projected by 396`, but `runs.get` is in UNPROJECTED_OPS after 396 plan 04 \u2014 not a mid-flight workflow read per D-02 \u2014 so there is no live tool to rename to.",
+    route: "the entity door renders a run's card: `agent_qa_get_entity` on the run reference. `agent_qa_list_runs` enumerates recent runs."
+  }),
+  // 28
+  Object.freeze({
+    v1Name: "agent_qa_get_run_steps",
+    arm: "retired",
+    note: "A4 adjudication (2026-08-17, phase 398 plan 02): ruled `n/a -> projected by 396` against `runs.get`/`runs.events`, both of which are in UNPROJECTED_OPS \u2014 `runs.events` is a stream op besides, and a `tools/call` is one round trip with no shape for a resumable feed.",
+    route: "`agent_qa_get_run_digest` carries what triage needs from a run, including its steps' outcome; the run's card comes from `agent_qa_get_entity`."
+  }),
+  // 29
+  Object.freeze({
+    v1Name: "agent_qa_get_run_logs",
+    arm: "retired",
+    note: "A4 adjudication (2026-08-17, phase 398 plan 02): ruled `n/a -> projected by 396` against `runs.events`, which is in UNPROJECTED_OPS as a stream op with no single-round-trip shape.",
+    route: "`agent_qa_get_run_digest` carries the triage-relevant remainder of a run; the full event feed is read from the run artifacts on disk, not over this surface."
+  }),
+  // 30
+  Object.freeze({
+    v1Name: "agent_qa_get_run_execution_logs",
+    arm: "retired",
+    note: "A4 adjudication (2026-08-17, phase 398 plan 02): row 29's reading \u2014 `runs.events` is unprojected, so the second logs alias has no live tool either.",
+    route: "`agent_qa_get_run_digest` for triage; execution logs live in the run's artifacts on disk."
+  }),
+  // 31
+  Object.freeze({
+    v1Name: "agent_qa_get_run_artifact",
+    arm: "pending",
+    note: "gap (397, 2026-08-16): artifact bytes over a tool result is a disclosure surface nobody has scoped, so the read is routed WITH that scoping rather than minted without it \u2014 an artifact read without it is the gap made worse.",
+    route: "until the owning milestone ships artifact resolution, artifacts are read from the run directory on disk; `agent_qa_get_run_digest` names what a run produced.",
+    owner: "M5 (artifact resolution route)"
+  }),
+  // 32
+  Object.freeze({
+    v1Name: "agent_qa_cancel_run",
+    arm: "pending",
+    note: "gap (397, 2026-08-16): ruled a REAL gap as `runs.cancel` and routed to its owner rather than minted in 397, because D-17 binds the adjudicator too.",
+    route: "until `runs.cancel` lands, a run is stopped by the host that started it; this surface starts runs through `agent_qa_start_run` and cannot stop one.",
+    owner: "M5 (live-view control arbiter)"
+  }),
+  // 33
+  Object.freeze({
+    v1Name: "agent_qa_classify_failure",
+    arm: "retired",
+    note: "not-a-gap (397, 2026-08-16): classification on demand over dashboard-fetched data is the private data path M4 abolished, not a capability that went missing.",
+    route: "`analysis.get` reads the verdict the `analyze-run` job produced; over this surface the triage answer is `agent_qa_get_run_digest`."
+  })
+]);
+
+// src/projection.ts
+var JSON_SCHEMA_CONVERSION_TARGET = "draft-2020-12";
+function isReadOnly(specs) {
+  return specs.every((spec) => spec.risk.readOnly === true);
 }
-function classifyByNeedle(haystack, evidence, needles, category, confidence) {
-  const match = needles.find((needle) => haystack.includes(needle));
-  if (!match) return null;
-  const matchingEvidence = evidence.find((item) => item.toLowerCase().includes(match)) ?? evidence[0] ?? match;
+function deriveAnnotations(specs) {
+  const readOnlyHint = isReadOnly(specs);
   return {
-    category,
-    confidence,
-    evidence: [matchingEvidence].filter(Boolean).slice(0, 5),
-    recentRelatedCount: 0
+    readOnlyHint,
+    destructiveHint: specs.some((spec) => spec.risk.destructive === true),
+    idempotentHint: readOnlyHint
   };
 }
-function classifyRunFailureFromDashboardData(input) {
-  const run = input.runDetail && typeof input.runDetail === "object" ? input.runDetail.run : void 0;
-  const status = run && typeof run === "object" ? run.status : void 0;
-  const evidence = collectStrings([input.runDetail, input.artifact, input.logs, input.executionLogs]);
-  const haystack = evidence.join("\n").toLowerCase();
-  const recentRelatedCount = Array.isArray(input.recentRuns?.runs) ? input.recentRuns.runs.length : 0;
-  if (status && status !== "failed") {
-    return {
-      category: "passed",
-      confidence: 0.95,
-      evidence: [`Run status is ${String(status)}.`],
-      recentRelatedCount
-    };
+function describe(projection, specs) {
+  const composition = compositionOf(projection);
+  if (composition === "single") return specs[0].summary;
+  const arms = specs.map((spec) => `${spec.id}: ${spec.summary}`).join("\n");
+  if (composition === "pipeline") {
+    return `${arms}
+These run in the order listed; the second runs only when the first resolves.`;
+  }
+  return `${arms}
+Select one with "${projection.discriminant}", whose value is the op id above.`;
+}
+function degradationSentence(degradation) {
+  return `
+This tool advertises no outputSchema: its result contract (${degradation.schema}) contains a construct JSON Schema cannot represent, and a narrowed stand-in would describe a shape nothing produces. The result still arrives as structuredContent.`;
+}
+function probeOutputSchema(projection, output) {
+  const declared = DEGRADED_OUTPUT_CONTRACTS.find((entry) => entry.tool === projection.name);
+  let failure;
+  try {
+    output["~standard"].jsonSchema.output({ target: JSON_SCHEMA_CONVERSION_TARGET });
+  } catch (err) {
+    failure = err instanceof Error ? err.message : String(err);
+  }
+  if (failure === void 0) {
+    if (declared === void 0) return output;
+    throw new McpProjectionError(
+      projection.name,
+      `is listed in DEGRADED_OUTPUT_CONTRACTS for ${declared.schema}, but that contract now converts cleanly in output mode; remove the entry so the schema is advertised again`
+    );
+  }
+  if (declared === void 0) {
+    throw new McpProjectionError(
+      projection.name,
+      `advertises an output contract JSON Schema cannot represent (${failure}). Declare it in DEGRADED_OUTPUT_CONTRACTS with the measured message, or give the op a contract that converts \u2014 an unrepresentable outputSchema throws inside tools/list and takes the whole listing down for every caller`
+    );
+  }
+  return void 0;
+}
+function toRegisterToolConfig(projection, specs, advertised, maskText) {
+  if (specs.length === 0) {
+    throw new McpProjectionError(
+      projection.name,
+      "projects no ops; a tool with no arm has nothing to validate against and nothing to call"
+    );
   }
-  const checks = [
-    [["timed out", "timeout"], "timeout", 0.9],
-    [["appium server failed", "appium"], "appium_startup", 0.9],
-    [["browser closed", "target page, context or browser has been closed", "browser disconnect"], "browser_disconnect", 0.85],
-    [["hook_not_runnable", "hook failed", "hook registry", "hook"], "hook_failure", 0.8],
-    [["not found", "no element", "strict mode violation", "selector"], "element_not_found", 0.8],
-    [["assert", "expected", "verify"], "assertion_failure", 0.75],
-    [["econnrefused", "enotfound", "network", "docker"], "infrastructure", 0.7]
-  ];
-  for (const [needles, category, confidence] of checks) {
-    const result = classifyByNeedle(haystack, evidence, needles, category, confidence);
-    if (result) return { ...result, recentRelatedCount };
+  if (specs.length !== projection.ops.length) {
+    throw new McpProjectionError(
+      projection.name,
+      `declares ${projection.ops.length} ops but was derived from ${specs.length}`
+    );
   }
+  const outputSchema = probeOutputSchema(projection, advertised.output);
+  const degradation = outputSchema === void 0 ? DEGRADED_OUTPUT_CONTRACTS.find((entry) => entry.tool === projection.name) : void 0;
+  const description = describe(projection, specs);
+  const meta = listingMeta(projection);
+  const fold = compositionOf(projection) === "union";
+  const inputSchema = fold ? flatFoldInput(projection, advertised.input) : advertised.input;
+  if (fold) inputSchema["~standard"].jsonSchema.input({ target: JSON_SCHEMA_CONVERSION_TARGET });
   return {
-    category: "unknown_failure",
-    confidence: 0.3,
-    evidence: evidence.slice(0, 5),
-    recentRelatedCount
+    title: projection.name,
+    description: maskText(
+      degradation === void 0 ? description : description + degradationSentence(degradation)
+    ),
+    inputSchema,
+    ...outputSchema === void 0 ? {} : { outputSchema },
+    annotations: deriveAnnotations(specs),
+    // 408 D-05: the App reference, DERIVED from the projection's own carrier declaration by the
+    // same pipeline that derives the annotations above — never a pair of tool names written here.
+    // The conditional spread is the house absent-field rule: a non-carrier's config has no `_meta`
+    // key at all.
+    //
+    // NOT MASKED, and it joins the two exemptions the header names for their reason rather than by
+    // analogy. `resourceUri` is the address constant this package publishes — a declared literal in
+    // this repository's own source, exactly like the `title` above it — and a masker that rewrote
+    // it would point every host at an address the resource codec refuses, which is the tool-rename
+    // failure with a URI scheme attached. Nothing interpolated into it comes from a caller, from
+    // storage or from a resolved value; the run id never appears here, because this is the
+    // TEMPLATE and a per-call reference is composed downstream. The result-size hint (431 D-05) is
+    // a declared constant too, and rides the same record (`listingMeta`).
+    ...meta === void 0 ? {} : { _meta: meta }
+  };
+}
+function listingMeta(projection) {
+  const meta = {
+    ...projection.ui === void 0 ? {} : { ui: { resourceUri: APP_RESOURCE_URI_TEMPLATE } },
+    ...projection.maxResultSizeChars === void 0 ? {} : { [MAX_RESULT_SIZE_META_KEY]: projection.maxResultSizeChars }
   };
+  return Object.keys(meta).length === 0 ? void 0 : meta;
 }
-function maskSensitive(value, parentKey = "") {
-  const authRedacted = (0, import_agent_qa_core2.redactAuthStateValue)(value);
-  const lower = parentKey.toLowerCase();
-  if (typeof authRedacted === "string" && authRedacted !== value) {
-    return authRedacted;
+function flatFoldInput(projection, input) {
+  const standard = input["~standard"];
+  return {
+    "~standard": {
+      version: standard.version,
+      vendor: standard.vendor,
+      validate: (value, options) => standard.validate(value, options),
+      jsonSchema: {
+        input: (options) => flatFoldDocument(projection, standard.jsonSchema.input(options)),
+        output: (options) => standard.jsonSchema.output(options)
+      }
+    }
+  };
+}
+function flatFoldDocument(projection, document) {
+  const key = projection.discriminant;
+  const { oneOf, type: _type, ...rest } = document;
+  const arms = Array.isArray(oneOf) ? oneOf : [];
+  const unsupported = ["anyOf", "allOf", "properties"].filter((name) => rest[name] !== void 0);
+  if (arms.length !== projection.ops.length || unsupported.length > 0) {
+    throw new McpProjectionError(
+      projection.name,
+      `has an input contract that is not a ${projection.ops.length}-arm union of objects, so it cannot be listed as one object`
+    );
   }
-  if (typeof authRedacted === "string" && (lower.includes("key") || lower.includes("token") || lower.includes("secret") || lower.includes("password"))) {
-    return authRedacted.length > 8 ? `${authRedacted.slice(0, 3)}****${authRedacted.slice(-4)}` : "****";
+  const ops = [];
+  const fields = /* @__PURE__ */ new Map();
+  let actionNote;
+  let strict = true;
+  for (const arm of arms) {
+    const properties2 = arm.properties ?? {};
+    const opId = properties2[key]?.const;
+    if (arm.type !== "object" || typeof opId !== "string" || !projection.ops.includes(opId)) {
+      throw new McpProjectionError(
+        projection.name,
+        `has a union arm that is not an object selected by a declared ${key}`
+      );
+    }
+    ops.push(opId);
+    if (arm.additionalProperties !== false) strict = false;
+    actionNote ??= properties2[key]?.description;
+    const required2 = arm.required ?? [];
+    for (const [name, schema] of Object.entries(properties2)) {
+      if (name === key) continue;
+      const field = fields.get(name) ?? { shapes: [], notes: [], usedBy: [], requiredBy: [] };
+      const { description, ...shape } = schema;
+      if (!field.shapes.some((seen) => JSON.stringify(seen) === JSON.stringify(shape))) {
+        field.shapes.push(shape);
+      }
+      if (typeof description === "string" && !field.notes.includes(description)) {
+        field.notes.push(description);
+      }
+      field.usedBy.push(opId);
+      if (required2.includes(name)) field.requiredBy.push(opId);
+      fields.set(name, field);
+    }
   }
-  if (Array.isArray(authRedacted)) return authRedacted.map((item) => maskSensitive(item, parentKey));
-  if (authRedacted && typeof authRedacted === "object") {
-    return Object.fromEntries(
-      Object.entries(authRedacted).map(([key, child]) => [key, maskSensitive(child, key)])
+  const perAction = ops.map((opId) => {
+    const taken = [...fields].filter(([, field]) => field.usedBy.includes(opId));
+    const listed = taken.map(
+      ([name, field]) => field.requiredBy.includes(opId) ? name : `${name} (optional)`
     );
+    return `${opId} takes ${listed.length === 0 ? "no other field" : listed.join(", ")}.`;
+  });
+  const properties = {
+    [key]: {
+      type: "string",
+      enum: ops,
+      description: [actionNote, ...perAction].filter(Boolean).join(" ")
+    }
+  };
+  const required = [key];
+  for (const [name, field] of fields) {
+    const scope = field.usedBy.length === ops.length ? "every action" : `${field.usedBy.join(" or ")} only`;
+    const need = field.requiredBy.length === 0 ? "optional" : field.requiredBy.length === field.usedBy.length ? "required" : `required for ${field.requiredBy.join(" or ")}`;
+    const shape = field.shapes.length === 1 ? field.shapes[0] : { anyOf: field.shapes };
+    const description = [...field.notes, `For ${scope}; ${need}.`].join(" ");
+    properties[name] = { ...shape, description };
+    if (field.requiredBy.length === ops.length) required.push(name);
   }
-  return authRedacted;
+  return {
+    ...rest,
+    type: "object",
+    properties,
+    required,
+    ...strict ? { additionalProperties: false } : {}
+  };
 }
-async function readConfig(configPath) {
-  const path = (0, import_node_path.resolve)(configPath ?? "agent-qa.config.yaml");
-  const content = await (0, import_promises.readFile)(path, "utf-8");
-  const raw = (0, import_yaml.parse)(content) ?? {};
-  const validation = import_agent_qa_core2.AgentQaConfigSchema.safeParse(raw);
-  const record = raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
-  const registry = record.registry && typeof record.registry === "object" && !Array.isArray(record.registry) ? record.registry : {};
-  const services = record.services && typeof record.services === "object" && !Array.isArray(record.services) ? record.services : {};
+var McpProjectionError = class extends Error {
+  constructor(toolName, detail) {
+    super(`${toolName} ${detail}`);
+    this.toolName = toolName;
+    this.name = "McpProjectionError";
+  }
+};
+
+// src/resources.ts
+var import_server2 = require("@modelcontextprotocol/server");
+var import_agent_qa_agent2 = require("@vostride/agent-qa-agent");
+var import_agent_qa_schema4 = require("@vostride/agent-qa-schema");
+var ENTITIES_GET_OP_ID = "entities.get";
+var ENTITY_RESOURCE_MIME_TYPE = "application/json";
+function templateFor(kind) {
+  const segment = import_agent_qa_schema4.ENTITY_URI_SEGMENTS[kind];
   return {
-    path,
-    raw: maskSensitive(raw),
-    valid: validation.success,
-    issues: validation.success ? [] : validation.error.issues.map((issue) => ({
-      path: issue.path.map(String).join(".") || "(root)",
-      message: issue.message
-    })),
-    summary: {
-      workspaceConfigured: Boolean(record.workspace),
-      serviceKeys: Object.keys(services),
-      targetNames: Object.keys(registry.targets ?? {}),
-      deviceNames: Object.keys(registry.devices ?? {}),
-      providerNames: Object.keys(registry.providers ?? {}),
-      llmNames: Array.isArray(registry.llms) ? registry.llms.map((llm) => llm && typeof llm === "object" ? llm.name : void 0).filter((name) => typeof name === "string") : []
-    }
+    kind,
+    segment,
+    name: `agent_qa_entity_${segment}`,
+    uriTemplate: `agentqa://${segment}/{id}`,
+    title: `agent-qa ${segment} entity`,
+    // Authored prose about a KIND, not about any entity's content — the same class of string as a
+    // tool's curated title, so it is not masked. Nothing interpolated here comes from storage.
+    description: `The entity card for one ${segment} addressed by its canonical agentqa:// URI (for example agentqa://${segment}/${kind}-001). Resolved through the entities read op.`
   };
 }
-function createAgentQaMcpServer(options = {}) {
-  const server = new import_mcp.McpServer({
-    name: "agent-qa",
-    version: (0, import_agent_qa_core2.getAgentQaVersion)()
-  });
-  const analyticsService = options.analyticsService ?? (0, import_agent_qa_core2.createAnalyticsService)({ config: options.analyticsConfig });
-  const analyticsTransport = options.transport ?? "stdio";
-  const registerAnalyticsTool = (name, definition, handler) => server.registerTool(name, definition, (async (input, extra) => {
-    const startedAt = Date.now();
-    let result;
-    let thrown;
+var ENTITY_RESOURCE_TEMPLATES = import_agent_qa_schema4.ENTITY_KINDS.map(templateFor);
+var EntityResourceUriError = class extends Error {
+  constructor(detail) {
+    super(`${detail} is not a canonical agentqa:// entity address`);
+    this.name = "EntityResourceUriError";
+  }
+};
+var EntityResourceReadError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "EntityResourceReadError";
+  }
+};
+function createEntityResourceReadHandler(deps) {
+  return async (uri) => {
+    const parsed = (0, import_agent_qa_schema4.parseEntityUri)(uri.href);
+    if (parsed === void 0) {
+      throw new EntityResourceUriError(deps.maskText(uri.href));
+    }
+    let card;
     try {
-      result = await handler(input, extra);
-      return result;
+      card = await deps.invoke(ENTITIES_GET_OP_ID, { ref: parsed.shortId });
     } catch (err) {
-      thrown = err;
-      throw err;
-    } finally {
-      const isError = thrown !== void 0 || isErrorResult(result) || isDashboardErrorResult(result);
-      const explicitRunId = extractExplicitCanonicalRunId(input);
-      const enqueueRunId = !isError && (name === "agent_qa_enqueue_test_run" || name === "agent_qa_enqueue_suite_run") ? extractSuccessfulEnqueueRunId(result) : void 0;
-      try {
-        if (options.analyticsConfig?.analytics?.privacy !== true) {
-          const standardProperties = options.analyticsStandardProperties ?? await (0, import_agent_qa_core2.resolveAnalyticsStandardProperties)({ surface: "mcp" });
-          const event = (0, import_agent_qa_core2.buildAnalyticsEvent)({
-            name: "agent-qa.mcp.tool.invoked",
-            properties: {
-              ...standardProperties,
-              surface: standardProperties.surface ?? "mcp",
-              tool_name: name,
-              mcp_tool_category: categorizeMcpTool(name),
-              mcp_tool_status: isError ? "error" : "success",
-              duration_ms: Math.max(0, Date.now() - startedAt),
-              mcp_transport: analyticsTransport,
-              ...isError ? { mcp_error_category: categorizeMcpError(thrown ?? result) } : {},
-              ...explicitRunId ?? enqueueRunId ? { run_id: explicitRunId ?? enqueueRunId } : {}
-            }
-          });
-          if (options.analyticsService) {
-            await analyticsService.capture(event).catch(() => {
-            });
-          } else {
-            await (0, import_agent_qa_core2.captureAnalytics)(event, {
-              config: options.analyticsConfig,
-              surface: "mcp"
-            }).catch(() => {
-            });
-          }
+      throw new EntityResourceReadError(
+        deps.maskText(err instanceof Error ? err.message : String(err))
+      );
+    }
+    const masked = maskJsonDocument(card, deps.maskText);
+    if (masked === void 0) {
+      throw new EntityResourceReadError(
+        "This entity could not be returned: part of its card could not be masked in place, so the unmasked record was withheld rather than served."
+      );
+    }
+    return {
+      contents: [
+        {
+          // Re-FORMATTED through the codec rather than echoed: the address a caller reads back is
+          // the canonical one, so `agentqa://memory/MEM-1` answers about `MEM-001` and says so.
+          uri: (0, import_agent_qa_schema4.formatEntityUri)(parsed.kind, parsed.shortId),
+          mimeType: ENTITY_RESOURCE_MIME_TYPE,
+          text: masked.text
         }
-      } catch {
-      }
+      ]
+    };
+  };
+}
+function registerEntityResources(server, deps) {
+  const declaration = deps.registry.list(deps.caller).find((candidate) => candidate.id === ENTITIES_GET_OP_ID);
+  if (declaration === void 0) return [];
+  const read = createEntityResourceReadHandler({
+    // The wall, bound once: every template's read crosses `invokeFunction` with this host's
+    // registry and this caller, so input validation and the binding check run exactly as they do
+    // for a tool call.
+    invoke: (opId, input) => (0, import_agent_qa_agent2.invokeFunction)(deps.registry, opId, input, deps.caller),
+    maskText: deps.maskText
+  });
+  for (const template of ENTITY_RESOURCE_TEMPLATES) {
+    server.registerResource(
+      template.name,
+      // `list: undefined` is REQUIRED to be spelled out by the SDK, and the value is the honest
+      // one: enumerating every entity of a kind is a listing this surface does not offer, and the
+      // SDK asks for the explicit `undefined` precisely so that absence is a decision.
+      new import_server2.ResourceTemplate(template.uriTemplate, { list: void 0 }),
+      // v2 requires the metadata argument; it is not optional the way it was in v1.
+      {
+        title: template.title,
+        description: template.description,
+        mimeType: ENTITY_RESOURCE_MIME_TYPE
+      },
+      read
+    );
+  }
+  return ENTITY_RESOURCE_TEMPLATES;
+}
+
+// src/catalog.ts
+var AGENT_QA_MCP_SERVER_VERSION = "2.0.0";
+function resolveSpecs(projection, declarations) {
+  const specs = [];
+  for (const opId of projection.ops) {
+    const resolved = declarations.get(opId);
+    if (resolved === void 0) return void 0;
+    specs.push(resolved);
+  }
+  return specs;
+}
+function selectFoldArm(projection, args) {
+  const key = projection.discriminant;
+  const record = args ?? {};
+  const selected = record[key];
+  if (typeof selected !== "string" || !projection.ops.includes(selected)) {
+    throw new McpProjectionError(
+      projection.name,
+      `was called with ${key}=${JSON.stringify(selected)}, which is not one of the ops it declares`
+    );
+  }
+  const { [key]: _arm, ...input } = record;
+  return { opId: selected, input };
+}
+function resolvedCardId(resolution) {
+  if (typeof resolution !== "object" || resolution === null) return void 0;
+  const record = resolution;
+  if (record.kind !== "resolved") return void 0;
+  const card = record.card;
+  return typeof card?.id === "string" ? card.id : void 0;
+}
+async function runProjection(projection, args, invoke) {
+  switch (compositionOf(projection)) {
+    case "single":
+      return { opId: projection.ops[0], output: await invoke(projection.ops[0], args) };
+    case "union": {
+      const arm = selectFoldArm(projection, args);
+      return { opId: arm.opId, output: await invoke(arm.opId, arm.input) };
     }
-  }));
-  const dashboardUrlField = import_zod.z.string().url().optional().describe("Dashboard base URL; defaults to the MCP server dashboard URL.");
-  const dashboardUrlFor = (inputUrl) => {
-    const dashboardUrl = inputUrl ?? options.dashboardUrl;
-    if (!dashboardUrl) {
-      throw new Error("dashboardUrl is required for authoring tools. Start MCP via `agent-qa dashboard` or pass dashboardUrl.");
+    case "pipeline": {
+      const resolution = await invoke(projection.ops[0], args);
+      const id = resolvedCardId(resolution);
+      if (id === void 0) return { opId: projection.ops[0], output: resolution };
+      const card = await invoke(projection.ops[1], { ref: id });
+      return { opId: projection.ops[1], output: { ...resolution, card } };
     }
-    return dashboardUrl;
+  }
+}
+function carrierRunIdOf(projection, args, output) {
+  const source = projection.ui?.runIdFrom === "output" ? output : args;
+  const runId = source?.runId;
+  return typeof runId === "string" && runId !== "" ? runId : void 0;
+}
+function decorateCarrierResult(input) {
+  if (input.projection.ui === void 0) return input.result;
+  if (input.result.isError === true) return input.result;
+  const runId = carrierRunIdOf(input.projection, input.args, input.output);
+  const line = liveLinkLineFor(input.liveLink?.dashboardBaseUrl(), runId);
+  return {
+    ...input.result,
+    content: [...input.result.content, { type: "text", text: input.maskText(line) }],
+    ...runId === void 0 ? {} : { _meta: { ...input.result._meta, ui: { resourceUri: appResourceUriFor(runId) } } }
   };
-  const dashboardTool = async (dashboardUrl, path, method, body) => {
+}
+function createProjectionHandler(projection, invoke, maskText, liveLink) {
+  return async (args) => {
     try {
-      const result = await callDashboardApi({
-        dashboardUrl: dashboardUrlFor(dashboardUrl),
-        path,
-        method,
-        body
+      const { opId, output } = await runProjection(projection, args, invoke);
+      const masked = maskedToolResult(output, maskText);
+      const result = opId === import_agent_qa_agent3.RUNS_ARTIFACT_FUNCTION_ID ? decorateRunEvidenceImage({ result: masked, output, maskText }) : masked;
+      return decorateCarrierResult({
+        result,
+        projection,
+        args,
+        output,
+        maskText,
+        ...liveLink === void 0 ? {} : { liveLink }
       });
-      return jsonContent((0, import_agent_qa_core2.redactAuthStateValue)(result));
     } catch (err) {
-      return errorContent(err instanceof Error ? err.message : String(err));
+      return maskedToolError(err, maskText);
     }
   };
-  registerAnalyticsTool(
-    "agent_qa_discover",
-    {
-      title: "Discover agent-qa MCP capabilities",
-      description: "Return structured metadata for agent-qa MCP tools, resources, prompts, and current rollout scope.",
-      inputSchema: {}
-    },
-    async () => jsonContent({
-      ...DISCOVERY,
-      endpoint: options.endpointUrl,
-      dashboard: options.dashboardUrl,
-      configPath: options.configPath
-    })
-  );
-  registerAnalyticsTool(
-    "agent_qa_get_config",
-    {
-      title: "Inspect agent-qa config",
-      description: "Read the active agent-qa config and return a masked raw config plus targets/devices/providers summary.",
-      inputSchema: {
-        configPath: import_zod.z.string().optional().describe("Config path; defaults to the MCP server config path or agent-qa.config.yaml"),
-        section: import_zod.z.enum(["raw", "summary"]).optional().describe("Return full masked raw config or summary only")
-      }
-    },
-    async ({ configPath, section }) => {
-      const config = await readConfig(configPath ?? options.configPath);
-      return jsonContent(section === "summary" ? { path: config.path, valid: config.valid, issues: config.issues, summary: config.summary } : config);
+}
+var TOOLS_CALL_METHOD = "tools/call";
+function callToolName(request) {
+  if (typeof request !== "object" || request === null) return void 0;
+  const params = request.params;
+  if (typeof params !== "object" || params === null) return void 0;
+  const name = params.name;
+  return typeof name === "string" ? name : void 0;
+}
+function v1MigrationEntryFor(toolName) {
+  return V1_TOOL_MIGRATION_MAP.find((entry) => entry.v1Name === toolName);
+}
+function v1RedirectFor(toolName, registered) {
+  if (registered.has(toolName)) return void 0;
+  return v1MigrationEntryFor(toolName);
+}
+function v1InputShapeNote(projection) {
+  switch (compositionOf(projection)) {
+    case "single":
+      return "it takes one input object";
+    case "union":
+      return `set \`${projection.discriminant}\` to one of ${projection.ops.map((op) => `\`${op}\``).join(", ")} and pass that arm's own fields`;
+    case "pipeline":
+      return "it takes one entity reference and answers the card that reference resolves to";
+  }
+}
+function v1RedirectMessage(entry, visibleTarget) {
+  const opening = `\`${entry.v1Name}\` is a retired agent-qa v1 tool name and is not served.`;
+  if (entry.arm === "renamed-to") {
+    if (visibleTarget === void 0) {
+      return `${opening} Call \`tools/list\` for the tools you may call on this server, and \`agent-qa init --agent\` for this workspace's capability manifest, which carries the v1 tool-name migration map.`;
     }
-  );
-  registerAnalyticsTool(
-    "agent_qa_schema_reference",
-    {
-      title: "Get agent-qa schema reference",
-      description: "Return structured references for config, test YAML, suite YAML, hooks, or canonical IDs.",
-      inputSchema: {
-        schema: import_zod.z.enum(SCHEMA_REFERENCE_NAMES).describe("Reference name to return")
-      }
-    },
-    async ({ schema }) => jsonContent(AGENT_QA_SCHEMA_REFERENCES[schema])
-  );
-  registerAnalyticsTool(
-    "agent_qa_validate_definition",
-    {
-      title: "Validate agent-qa definition",
-      description: "Validate config/test/suite/hooks objects with the same core schemas agent-qa uses.",
-      inputSchema: {
-        kind: import_zod.z.enum(VALIDATION_KINDS).describe("Definition kind"),
-        definition: import_zod.z.unknown().describe("Parsed config/test/suite/hooks object")
-      }
-    },
-    async ({ kind, definition }) => jsonContent(validateAgentQaDefinition(kind, definition))
-  );
-  registerAnalyticsTool(
-    "agent_qa_generate_id",
+    return `${opening} The capability it named is now \`${visibleTarget.name}\`. ${entry.note} Its input shape is not v1's \u2014 ${v1InputShapeNote(visibleTarget)}; \`tools/list\` advertises the contract the call is validated against.`;
+  }
+  if (entry.arm === "pending") {
+    const owned = entry.owner === void 0 ? "" : ` The capability it named is a known gap owned by ${entry.owner}.`;
+    const until = entry.route === void 0 ? "" : ` Until then: ${entry.route}`;
+    return `${opening}${owned} ${entry.note}${until}`;
+  }
+  return `${opening} ${entry.note}${entry.route === void 0 ? "" : ` Instead: ${entry.route}`}`;
+}
+function installV1NameRedirect(server, deps) {
+  const dispatch = server.server;
+  const sdkHandler = dispatch._requestHandlers?.get(TOOLS_CALL_METHOD);
+  if (typeof sdkHandler !== "function") {
+    throw new McpProjectionError(
+      TOOLS_CALL_METHOD,
+      "has no installed request handler to wrap; the SDK no longer registers tool dispatch where this package reads it, so the retired-v1-name redirect cannot be placed"
+    );
+  }
+  dispatch.removeRequestHandler(TOOLS_CALL_METHOD);
+  dispatch.setRequestHandler(TOOLS_CALL_METHOD, (request, ctx) => {
+    const name = callToolName(request);
+    const entry = name === void 0 ? void 0 : v1RedirectFor(name, deps.registered);
+    if (entry === void 0) return sdkHandler(request, ctx);
+    const target = entry.arm === "renamed-to" && entry.v2Tool !== void 0 && deps.registered.has(entry.v2Tool) ? AGENT_QA_TOOL_PROJECTIONS.find((projection) => projection.name === entry.v2Tool) : void 0;
+    throw new import_server3.ProtocolError(
+      import_server3.ProtocolErrorCode.InvalidParams,
+      deps.maskText(v1RedirectMessage(entry, target))
+    );
+  });
+}
+function buildAgentQaMcpServer(deps) {
+  const server = new import_server3.McpServer(
+    { name: "agent-qa", version: AGENT_QA_MCP_SERVER_VERSION },
     {
-      title: "Generate canonical agent-qa ID",
-      description: "Generate a canonical id-agent backed ID for a test, suite, hook, run, or observation.",
-      inputSchema: {
-        type: import_zod.z.enum(import_agent_qa_ids2.ENTITY_ID_TYPES).describe("ID entity type")
-      }
-    },
-    async ({ type }) => {
-      const idType = type;
-      return jsonContent({
-        id: (0, import_agent_qa_ids2.generateCanonicalId)(idType),
-        type: idType,
-        contract: (0, import_agent_qa_ids2.getEntityIdContract)(idType)
-      });
+      capabilities: {
+        tools: {},
+        resources: {},
+        // 408 D-04: the official MCP Apps extension, ADVERTISED rather than assumed. Extensions are
+        // bilateral opt-in — a client declares support in the `io.modelcontextprotocol/
+        // clientCapabilities` envelope it sends on every request, and reads the server's set back
+        // from discovery — so a server that renders App HTML without naming the extension here is
+        // one no host will ever ask for it. The value is an empty record because this extension
+        // carries no server-side options; what it says is that this endpoint speaks it at all.
+        extensions: { [MCP_APPS_EXTENSION_ID]: {} }
+      },
+      // 433-33 (G-433-9): init's pointer, on the one channel every MCP host receives.
+      instructions: AGENT_QA_MCP_INSTRUCTIONS
     }
   );
-  registerAnalyticsTool(
-    "agent_qa_validate_id",
-    {
-      title: "Validate canonical agent-qa ID",
-      description: "Validate canonical id-agent backed IDs and return the expected contract.",
-      inputSchema: {
-        type: import_zod.z.enum(import_agent_qa_ids2.ENTITY_ID_TYPES).describe("ID entity type"),
-        id: import_zod.z.string().describe("ID to validate")
-      }
-    },
-    async ({ type, id }) => {
-      const idType = type;
-      const contract = (0, import_agent_qa_ids2.getEntityIdContract)(idType);
-      const valid = (0, import_agent_qa_ids2.isCanonicalId)(idType, id);
-      return jsonContent({
-        valid,
-        id,
-        type: idType,
-        contract,
-        message: valid ? "ID is canonical." : `Expected ${contract.prefixWithSeparator} followed by ${contract.words} id-agent words.`
-      });
+  const invoke = (opId, input) => (0, import_agent_qa_agent3.invokeFunction)(deps.registry, opId, input, deps.caller);
+  const declarations = /* @__PURE__ */ new Map();
+  for (const declaration of deps.registry.list(deps.caller)) {
+    const contracts = AGENT_QA_OP_CONTRACTS[declaration.id];
+    if (contracts === void 0) continue;
+    declarations.set(declaration.id, {
+      id: declaration.id,
+      summary: declaration.summary,
+      risk: declaration.risk,
+      input: contracts.input,
+      output: contracts.output
+    });
+  }
+  const registered = /* @__PURE__ */ new Set();
+  for (const projection of AGENT_QA_TOOL_PROJECTIONS) {
+    if (registered.has(projection.name)) {
+      throw new McpProjectionError(
+        projection.name,
+        "is declared twice in the mapping table; another projection already occupies that name"
+      );
     }
-  );
-  registerAnalyticsTool(
-    "agent_qa_list_tests",
-    {
-      title: "List agent-qa tests",
-      description: "List tests through the dashboard API using dashboard workspace discovery.",
-      inputSchema: { dashboardUrl: dashboardUrlField }
-    },
-    async ({ dashboardUrl }) => dashboardTool(dashboardUrl, "/api/tests")
-  );
-  registerAnalyticsTool(
-    "agent_qa_read_test",
-    {
-      title: "Read agent-qa test",
-      description: "Read a test by canonical test ID through the dashboard API.",
-      inputSchema: {
-        dashboardUrl: dashboardUrlField,
-        testId: import_zod.z.string().describe("Canonical t_ test ID")
-      }
-    },
-    async ({ dashboardUrl, testId }) => dashboardTool(dashboardUrl, `/api/tests/${encodeURIComponent(testId)}`)
-  );
-  registerAnalyticsTool(
-    "agent_qa_validate_test",
-    {
-      title: "Validate agent-qa test YAML",
-      description: "Validate test YAML through the dashboard test-file manager.",
-      inputSchema: {
-        dashboardUrl: dashboardUrlField,
-        content: import_zod.z.string().describe("Test YAML content"),
-        filePath: import_zod.z.string().optional().describe("Optional file path for suite/test routing hints")
-      }
-    },
-    async ({ dashboardUrl, content, filePath }) => dashboardTool(dashboardUrl, "/api/tests/validate", "POST", { content, filePath })
-  );
-  registerAnalyticsTool(
-    "agent_qa_create_test",
-    {
-      title: "Create agent-qa test",
-      description: "Create a test file through the dashboard workspace-safe file manager.",
-      inputSchema: {
-        dashboardUrl: dashboardUrlField,
-        path: import_zod.z.string().describe("Workspace-relative test path matched by workspace.testMatch"),
-        content: import_zod.z.string().describe("Test YAML content")
-      }
-    },
-    async ({ dashboardUrl, path, content }) => dashboardTool(dashboardUrl, "/api/tests", "POST", { path, content })
-  );
-  registerAnalyticsTool(
-    "agent_qa_update_test",
-    {
-      title: "Update agent-qa test",
-      description: "Update a test by canonical test ID through the dashboard API.",
-      inputSchema: {
-        dashboardUrl: dashboardUrlField,
-        testId: import_zod.z.string().describe("Canonical t_ test ID"),
-        content: import_zod.z.string().describe("Replacement test YAML content")
-      }
-    },
-    async ({ dashboardUrl, testId, content }) => dashboardTool(dashboardUrl, `/api/tests/${encodeURIComponent(testId)}`, "PUT", { content })
-  );
-  registerAnalyticsTool(
-    "agent_qa_delete_test",
-    {
-      title: "Delete agent-qa test",
-      description: "Delete a test by canonical test ID through the dashboard API.",
-      inputSchema: {
-        dashboardUrl: dashboardUrlField,
-        testId: import_zod.z.string().describe("Canonical t_ test ID")
-      }
-    },
-    async ({ dashboardUrl, testId }) => dashboardTool(dashboardUrl, `/api/tests/${encodeURIComponent(testId)}`, "DELETE")
-  );
-  registerAnalyticsTool(
-    "agent_qa_list_suites",
-    {
-      title: "List agent-qa suites",
-      description: "List suites through the dashboard API using dashboard workspace discovery.",
-      inputSchema: { dashboardUrl: dashboardUrlField }
-    },
-    async ({ dashboardUrl }) => dashboardTool(dashboardUrl, "/api/suites")
-  );
-  registerAnalyticsTool(
-    "agent_qa_read_suite",
-    {
-      title: "Read agent-qa suite",
-      description: "Read a suite by canonical suite ID through the dashboard API.",
-      inputSchema: {
-        dashboardUrl: dashboardUrlField,
-        suiteId: import_zod.z.string().describe("Canonical s_ suite ID")
-      }
-    },
-    async ({ dashboardUrl, suiteId }) => dashboardTool(dashboardUrl, `/api/suites/${encodeURIComponent(suiteId)}`)
-  );
-  registerAnalyticsTool(
-    "agent_qa_validate_suite",
-    {
-      title: "Validate agent-qa suite YAML",
-      description: "Validate suite YAML through the dashboard suite-file manager.",
-      inputSchema: {
-        dashboardUrl: dashboardUrlField,
-        content: import_zod.z.string().describe("Suite YAML content")
-      }
-    },
-    async ({ dashboardUrl, content }) => dashboardTool(dashboardUrl, "/api/suites/validate", "POST", { content })
-  );
-  registerAnalyticsTool(
-    "agent_qa_create_suite",
-    {
-      title: "Create agent-qa suite",
-      description: "Create a suite file through the dashboard workspace-safe suite manager.",
-      inputSchema: {
-        dashboardUrl: dashboardUrlField,
-        path: import_zod.z.string().describe("Workspace-relative suite path matched by workspace.suiteMatch"),
-        content: import_zod.z.string().describe("Suite YAML content")
-      }
-    },
-    async ({ dashboardUrl, path, content }) => dashboardTool(dashboardUrl, "/api/suites", "POST", { path, content })
-  );
-  registerAnalyticsTool(
-    "agent_qa_update_suite",
-    {
-      title: "Update agent-qa suite",
-      description: "Update a suite by canonical suite ID through the dashboard API.",
-      inputSchema: {
-        dashboardUrl: dashboardUrlField,
-        suiteId: import_zod.z.string().describe("Canonical s_ suite ID"),
-        content: import_zod.z.string().describe("Replacement suite YAML content")
-      }
-    },
-    async ({ dashboardUrl, suiteId, content }) => dashboardTool(dashboardUrl, `/api/suites/${encodeURIComponent(suiteId)}`, "PUT", { content })
-  );
-  registerAnalyticsTool(
-    "agent_qa_delete_suite",
-    {
-      title: "Delete agent-qa suite",
-      description: "Delete a suite through the dashboard API. Prefer suiteId; path is supported for the dashboard delete route.",
-      inputSchema: {
-        dashboardUrl: dashboardUrlField,
-        suiteId: import_zod.z.string().optional().describe("Canonical s_ suite ID"),
-        path: import_zod.z.string().optional().describe("Workspace-relative suite path")
-      }
-    },
-    async ({ dashboardUrl, suiteId, path }) => {
-      if (path) return dashboardTool(dashboardUrl, `/api/suites/${encodeURIComponent(path)}`, "DELETE");
-      if (!suiteId) return errorContent("Either suiteId or path is required.");
-      let readResult;
-      try {
-        readResult = await callDashboardApi({
-          dashboardUrl: dashboardUrlFor(dashboardUrl),
-          path: `/api/suites/${encodeURIComponent(suiteId)}`
-        });
-      } catch (err) {
-        return errorContent(err instanceof Error ? err.message : String(err));
+    for (const opId of projection.ops) {
+      if (AGENT_QA_OP_CONTRACTS[opId] === void 0) {
+        throw new McpProjectionError(
+          projection.name,
+          `names op ${opId}, which has no entry in the contract table`
+        );
       }
-      if (!readResult.ok || !readResult.body || typeof readResult.body !== "object") return jsonContent(readResult);
-      const foundPath = readResult.body.path;
-      if (typeof foundPath !== "string") return errorContent("Suite read response did not include a path.");
-      return dashboardTool(dashboardUrl, `/api/suites/${encodeURIComponent(foundPath)}`, "DELETE");
     }
-  );
-  registerAnalyticsTool(
-    "agent_qa_list_hooks",
-    {
-      title: "List agent-qa hooks",
-      description: "List hooks through the dashboard hook registry API.",
-      inputSchema: { dashboardUrl: dashboardUrlField }
-    },
-    async ({ dashboardUrl }) => dashboardTool(dashboardUrl, "/api/hooks")
-  );
-  registerAnalyticsTool(
-    "agent_qa_read_hook",
-    {
-      title: "Read agent-qa hook",
-      description: "Read hook metadata and source by canonical hook ID.",
-      inputSchema: {
-        dashboardUrl: dashboardUrlField,
-        hookId: import_zod.z.string().describe("Canonical h_ hook ID")
-      }
-    },
-    async ({ dashboardUrl, hookId }) => dashboardTool(dashboardUrl, `/api/hooks/${encodeURIComponent(hookId)}`)
-  );
-  registerAnalyticsTool(
-    "agent_qa_create_hook",
-    {
-      title: "Create agent-qa hook",
-      description: "Create a hook through the dashboard hook registry API.",
-      inputSchema: {
-        dashboardUrl: dashboardUrlField,
-        payload: import_zod.z.record(import_zod.z.string(), import_zod.z.unknown()).describe("Dashboard HookMutationRequest payload")
-      }
-    },
-    async ({ dashboardUrl, payload }) => dashboardTool(dashboardUrl, "/api/hooks", "POST", payload)
-  );
-  registerAnalyticsTool(
-    "agent_qa_update_hook",
-    {
-      title: "Update agent-qa hook",
-      description: "Update a hook through the dashboard hook registry API.",
-      inputSchema: {
-        dashboardUrl: dashboardUrlField,
-        hookId: import_zod.z.string().describe("Canonical h_ hook ID"),
-        payload: import_zod.z.record(import_zod.z.string(), import_zod.z.unknown()).describe("Dashboard HookMutationRequest payload")
-      }
-    },
-    async ({ dashboardUrl, hookId, payload }) => dashboardTool(dashboardUrl, `/api/hooks/${encodeURIComponent(hookId)}`, "PUT", payload)
-  );
-  registerAnalyticsTool(
-    "agent_qa_delete_hook",
-    {
-      title: "Delete agent-qa hook",
-      description: "Delete a hook through the dashboard hook registry API.",
-      inputSchema: {
-        dashboardUrl: dashboardUrlField,
-        hookId: import_zod.z.string().describe("Canonical h_ hook ID"),
-        force: import_zod.z.boolean().optional().describe("Delete even when references exist")
-      }
-    },
-    async ({ dashboardUrl, hookId, force }) => dashboardTool(dashboardUrl, `/api/hooks/${encodeURIComponent(hookId)}${force ? "?force=true" : ""}`, "DELETE")
-  );
-  registerAnalyticsTool(
-    "agent_qa_run_hook",
-    {
-      title: "Run agent-qa hook",
-      description: "Run a hook through the dashboard hook execution API.",
-      inputSchema: {
-        dashboardUrl: dashboardUrlField,
-        hookId: import_zod.z.string().describe("Canonical h_ hook ID"),
-        payload: import_zod.z.record(import_zod.z.string(), import_zod.z.unknown()).optional().describe("Dashboard HookRunRequest payload")
-      }
-    },
-    async ({ dashboardUrl, hookId, payload }) => dashboardTool(dashboardUrl, `/api/hooks/${encodeURIComponent(hookId)}/run`, "POST", payload ?? {})
-  );
-  registerAnalyticsTool(
-    "agent_qa_enqueue_test_run",
-    {
-      title: "Enqueue agent-qa test run",
-      description: "Queue a test run through the dashboard run trigger API and return the canonical run ID.",
-      inputSchema: {
-        dashboardUrl: dashboardUrlField,
-        file: import_zod.z.string().optional().describe("Workspace-relative test file path"),
-        patterns: import_zod.z.array(import_zod.z.string()).optional().describe("Optional test patterns"),
-        noCache: import_zod.z.boolean().optional(),
-        noMemory: import_zod.z.boolean().optional(),
-        local: import_zod.z.boolean().optional()
-      }
-    },
-    async ({ dashboardUrl, file, patterns, noCache, noMemory, local }) => dashboardTool(dashboardUrl, "/api/runs/trigger", "POST", { file, patterns, noCache, noMemory, local, triggerSource: "mcp" })
-  );
-  registerAnalyticsTool(
-    "agent_qa_enqueue_suite_run",
-    {
-      title: "Enqueue agent-qa suite run",
-      description: "Queue a suite run through the dashboard run trigger API and return parent run context.",
-      inputSchema: {
-        dashboardUrl: dashboardUrlField,
-        file: import_zod.z.string().describe("Workspace-relative suite file path"),
-        noCache: import_zod.z.boolean().optional(),
-        noMemory: import_zod.z.boolean().optional(),
-        local: import_zod.z.boolean().optional()
-      }
-    },
-    async ({ dashboardUrl, file, noCache, noMemory, local }) => dashboardTool(dashboardUrl, "/api/runs/trigger", "POST", { file, noCache, noMemory, local, triggerSource: "mcp" })
-  );
-  registerAnalyticsTool(
-    "agent_qa_get_run",
-    {
-      title: "Get agent-qa run",
-      description: "Get run detail, steps, attempts, and suite child context through the dashboard API.",
-      inputSchema: {
-        dashboardUrl: dashboardUrlField,
-        runId: import_zod.z.string().describe("Canonical r_ run ID")
-      }
-    },
-    async ({ dashboardUrl, runId }) => dashboardTool(dashboardUrl, `/api/runs/${encodeURIComponent(runId)}`)
-  );
-  registerAnalyticsTool(
-    "agent_qa_get_run_steps",
-    {
-      title: "Get agent-qa run steps",
-      description: "Get run steps through the dashboard API.",
-      inputSchema: {
-        dashboardUrl: dashboardUrlField,
-        runId: import_zod.z.string().describe("Canonical r_ run ID")
-      }
-    },
-    async ({ dashboardUrl, runId }) => dashboardTool(dashboardUrl, `/api/runs/${encodeURIComponent(runId)}/steps`)
-  );
-  registerAnalyticsTool(
-    "agent_qa_get_run_logs",
-    {
-      title: "Get agent-qa run logs",
-      description: "Get run log rows through the dashboard API.",
-      inputSchema: {
-        dashboardUrl: dashboardUrlField,
-        runId: import_zod.z.string().describe("Canonical r_ run ID"),
-        stepId: import_zod.z.string().optional(),
-        level: import_zod.z.string().optional(),
-        source: import_zod.z.string().optional(),
-        limit: import_zod.z.number().int().positive().optional(),
-        offset: import_zod.z.number().int().min(0).optional()
-      }
-    },
-    async ({ dashboardUrl, runId, stepId, level, source, limit, offset }) => dashboardTool(
-      dashboardUrl,
-      withQuery(`/api/runs/${encodeURIComponent(runId)}/logs`, { stepId, level, source, limit, offset })
-    )
-  );
-  registerAnalyticsTool(
-    "agent_qa_get_run_execution_logs",
-    {
-      title: "Get agent-qa execution logs",
-      description: "Get structured execution logs through the dashboard API.",
-      inputSchema: {
-        dashboardUrl: dashboardUrlField,
-        runId: import_zod.z.string().describe("Canonical r_ run ID"),
-        stepId: import_zod.z.string().optional(),
-        type: import_zod.z.string().optional()
-      }
-    },
-    async ({ dashboardUrl, runId, stepId, type }) => dashboardTool(
-      dashboardUrl,
-      withQuery(`/api/runs/${encodeURIComponent(runId)}/execution-logs`, { stepId, type })
-    )
-  );
-  registerAnalyticsTool(
-    "agent_qa_get_run_artifact",
-    {
-      title: "Get agent-qa run artifact bundle",
-      description: "Get sanitized run artifact bundle, child artifacts, and missing artifact sections.",
-      inputSchema: {
-        dashboardUrl: dashboardUrlField,
-        runId: import_zod.z.string().describe("Canonical r_ run ID")
-      }
-    },
-    async ({ dashboardUrl, runId }) => dashboardTool(dashboardUrl, `/api/runs/${encodeURIComponent(runId)}/artifact`)
-  );
-  registerAnalyticsTool(
-    "agent_qa_cancel_run",
-    {
-      title: "Cancel agent-qa run",
-      description: "Cancel a pending or running run through the dashboard queue.",
-      inputSchema: {
-        dashboardUrl: dashboardUrlField,
-        runId: import_zod.z.string().describe("Canonical r_ run ID")
-      }
-    },
-    async ({ dashboardUrl, runId }) => dashboardTool(dashboardUrl, `/api/runs/${encodeURIComponent(runId)}/cancel`, "POST", {})
-  );
-  registerAnalyticsTool(
-    "agent_qa_classify_failure",
-    {
-      title: "Classify agent-qa failure",
-      description: "Classify a failed run using dashboard run detail, artifacts, logs, execution logs, and recent related runs.",
-      inputSchema: {
-        dashboardUrl: dashboardUrlField,
-        runId: import_zod.z.string().describe("Canonical r_ run ID")
-      }
-    },
-    async ({ dashboardUrl, runId }) => {
-      try {
-        const baseUrl = dashboardUrlFor(dashboardUrl);
-        const runDetail = await callDashboardApi({ dashboardUrl: baseUrl, path: `/api/runs/${encodeURIComponent(runId)}` });
-        const artifact = await callDashboardApi({ dashboardUrl: baseUrl, path: `/api/runs/${encodeURIComponent(runId)}/artifact` });
-        const logs = await callDashboardApi({ dashboardUrl: baseUrl, path: `/api/runs/${encodeURIComponent(runId)}/logs` });
-        const executionLogs = await callDashboardApi({ dashboardUrl: baseUrl, path: `/api/runs/${encodeURIComponent(runId)}/execution-logs` });
-        const runName = runDetail.body && typeof runDetail.body === "object" && runDetail.body.run && typeof runDetail.body.run?.name === "string" ? runDetail.body.run.name : void 0;
-        const recentRuns = runName ? await callDashboardApi({ dashboardUrl: baseUrl, path: withQuery("/api/runs", { name: runName, limit: 5 }) }) : { ok: true, status: 200, body: { runs: [] } };
-        return jsonContent({
-          runId,
-          classification: classifyRunFailureFromDashboardData({
-            runDetail: runDetail.body,
-            artifact: artifact.body,
-            logs: logs.body,
-            executionLogs: executionLogs.body,
-            recentRuns: recentRuns.body
-          }),
-          sources: {
-            run: { ok: runDetail.ok, status: runDetail.status },
-            artifact: { ok: artifact.ok, status: artifact.status },
-            logs: { ok: logs.ok, status: logs.status },
-            executionLogs: { ok: executionLogs.ok, status: executionLogs.status },
-            recentRuns: { ok: recentRuns.ok, status: recentRuns.status }
-          }
-        });
-      } catch (err) {
-        return errorContent(err instanceof Error ? err.message : String(err));
-      }
+    const advertised = advertisedContracts(projection);
+    if (advertised === void 0) {
+      throw new McpProjectionError(
+        projection.name,
+        "has no advertised contract; a multi-arm tool needs an entry in AGENT_QA_COMPOSED_CONTRACTS"
+      );
     }
-  );
-  for (const schema of SCHEMA_REFERENCE_NAMES) {
-    server.registerResource(
-      `agent_qa.schema.${schema}`,
-      `agent-qa://schema/${schema}`,
-      {
-        title: `agent-qa ${schema} schema reference`,
-        description: `Structured agent-qa reference for ${schema}.`,
-        mimeType: "application/json"
-      },
-      async (uri) => ({
-        contents: [{
-          uri: uri.href,
-          mimeType: "application/json",
-          text: JSON.stringify(AGENT_QA_SCHEMA_REFERENCES[schema], null, 2)
-        }]
-      })
+    const specs = resolveSpecs(projection, declarations);
+    if (specs === void 0) continue;
+    registered.add(projection.name);
+    const config = toRegisterToolConfig(projection, specs, advertised, deps.maskText);
+    server.registerTool(
+      projection.name,
+      config,
+      createProjectionHandler(projection, invoke, deps.maskText, deps.liveLink)
     );
   }
-  server.registerPrompt(
-    "agent_qa_authoring_context",
-    {
-      title: "agent-qa authoring context",
-      description: "Prompt context for agents writing agent-qa tests and suites.",
-      argsSchema: {}
-    },
-    async () => ({
-      messages: [{
-        role: "user",
-        content: {
-          type: "text",
-          text: [
-            "Use agent-qa MCP tools before editing files.",
-            "Call agent_qa_get_config to inspect targets/devices/providers.",
-            "Call agent_qa_generate_id for test, suite, hook, run, and observation IDs.",
-            "Call agent_qa_validate_definition before saving config, test, suite, or hooks YAML.",
-            `Canonical ID contracts: ${JSON.stringify((0, import_agent_qa_ids2.getEntityIdContracts)())}`
-          ].join("\n")
-        }
-      }]
-    })
-  );
+  installV1NameRedirect(server, { registered, maskText: deps.maskText });
+  registerEntityResources(server, {
+    registry: deps.registry,
+    caller: deps.caller,
+    maskText: deps.maskText
+  });
+  registerAppResources(server, {
+    registry: deps.registry,
+    caller: deps.caller,
+    maskText: deps.maskText,
+    // 408 plan 03 (D-08): the SAME supplier the carrier decoration reads, so the anchor inside the
+    // App document and the line beside a tool result name one page for one run.
+    ...deps.liveLink === void 0 ? {} : { liveLink: deps.liveLink }
+  });
   return server;
 }
 
-// src/server.ts
-var MCP_STDIO_STARTUP_MESSAGE = "agent-qa MCP server running over stdio. Waiting for MCP client messages on stdin. Stdout is reserved for MCP protocol traffic.";
-function createMcpServer(options = {}) {
-  return createAgentQaMcpServer(options);
-}
-async function startMcpServer(options = {}) {
-  const { startupOutput, ...serverOptions } = options;
-  const server = createMcpServer({ ...serverOptions, transport: "stdio" });
-  const transport = new import_stdio.StdioServerTransport();
-  await server.connect(transport);
-  try {
-    startupOutput?.write(`${MCP_STDIO_STARTUP_MESSAGE}
-`);
-  } catch {
-  }
-  try {
-    if (options.analyticsConfig?.analytics?.privacy !== true) {
-      const standardProperties = options.analyticsStandardProperties ?? await (0, import_agent_qa_core3.resolveAnalyticsStandardProperties)({ surface: "mcp" });
-      const event = (0, import_agent_qa_core3.buildAnalyticsEvent)({
-        name: "agent-qa.mcp.server.lifecycle",
-        properties: {
-          ...standardProperties,
-          surface: standardProperties.surface ?? "mcp",
-          mcp_server_state: "started",
-          mcp_transport: "stdio"
-        }
-      });
-      if (options.analyticsService) {
-        await options.analyticsService.capture(event).catch(() => {
-        });
-      } else {
-        await (0, import_agent_qa_core3.captureAnalytics)(event, {
-          config: options.analyticsConfig,
-          surface: "mcp"
-        }).catch(() => {
-        });
-      }
-    }
-  } catch {
-  }
+// src/http.ts
+var import_server4 = require("@modelcontextprotocol/server");
+var import_node = require("@modelcontextprotocol/node");
+function createAgentQaMcpNodeHandler(resolveDeps) {
+  return (0, import_node.toNodeHandler)((0, import_server4.createMcpHandler)((ctx) => buildAgentQaMcpServer(resolveDeps(ctx))));
 }
 
-// src/local-http.ts
-var import_streamableHttp = require("@modelcontextprotocol/sdk/server/streamableHttp.js");
-var DEFAULT_MCP_HOST = "127.0.0.1";
-var DEFAULT_MCP_PORT = 3471;
-var DEFAULT_MCP_PATH = "/mcp";
-function normalizePath(path) {
-  if (!path) return DEFAULT_MCP_PATH;
-  return path.startsWith("/") ? path : `/${path}`;
+// src/conformance-support.ts
+function withoutDialect(document) {
+  const { $schema: _dialect, ...rest } = document ?? {};
+  return stripRedundantObjectStamp(rest);
 }
-function jsonRpcError(res, status, message) {
-  res.writeHead(status, {
-    "Content-Type": "application/json",
-    "Access-Control-Allow-Origin": "*"
-  });
-  res.end(JSON.stringify({
-    jsonrpc: "2.0",
-    error: {
-      code: -32e3,
-      message
-    },
-    id: null
-  }));
+function stripRedundantObjectStamp(document) {
+  const composed = document.oneOf !== void 0 || document.anyOf !== void 0;
+  if (!composed || document.type !== "object") return document;
+  const { type: _stamp, ...rest } = document;
+  return rest;
 }
-function resolveLocalMcpEndpoint(config = {}) {
-  const transport = config.transport ?? "http";
-  const host = config.host ?? DEFAULT_MCP_HOST;
-  const port = config.port ?? DEFAULT_MCP_PORT;
-  const path = normalizePath(config.path);
-  const displayHost = host === "::1" ? "[::1]" : host;
-  return {
-    enabled: config.enabled !== false,
-    transport,
-    host,
-    port,
-    path,
-    url: `http://${displayHost}:${port}${path}`
-  };
-}
-function resolveMcpEndpointShape(endpoint) {
-  return {
-    mcp_host_kind: ["127.0.0.1", "localhost", "::1"].includes(endpoint.host) ? "loopback" : "other",
-    mcp_port_kind: endpoint.port === DEFAULT_MCP_PORT ? "default" : "custom",
-    mcp_path_kind: endpoint.path === DEFAULT_MCP_PATH ? "default" : "custom"
-  };
+function armWithoutDiscriminant(arm, discriminant) {
+  const properties = { ...arm.properties ?? {} };
+  delete properties[discriminant];
+  const required = (arm.required ?? []).filter((key) => key !== discriminant);
+  const rebuilt = { ...arm, properties, required };
+  if (required.length === 0) delete rebuilt.required;
+  return rebuilt;
 }
-function createLocalMcpHttpHandler(options = {}) {
-  const endpoint = resolveLocalMcpEndpoint(options.endpoint);
-  const baseHost = endpoint.host === "::1" ? "[::1]" : endpoint.host;
-  return async (req, res) => {
-    const requestUrl = new URL(req.url ?? "/", `http://${baseHost}:${endpoint.port}`);
-    if (requestUrl.pathname !== endpoint.path) {
-      jsonRpcError(res, 404, `MCP endpoint is available at ${endpoint.path}`);
-      return;
+function foldArmFindings(listed, discriminant, opId, own) {
+  const findings = [];
+  for (const key of ["oneOf", "anyOf", "allOf"]) {
+    if (listed[key] !== void 0) findings.push(`the listing carries a top-level ${key}`);
+  }
+  if (listed.type !== "object") findings.push("the listing is not type object");
+  const properties = listed.properties ?? {};
+  const selector = properties[discriminant]?.enum;
+  if (!Array.isArray(selector) || !selector.includes(opId)) {
+    findings.push(`${discriminant} does not list ${opId}`);
+  }
+  const ownProperties = own.properties ?? {};
+  for (const [name, field] of Object.entries(ownProperties)) {
+    const shown = properties[name];
+    if (shown === void 0) {
+      findings.push(`${name} is not listed`);
+      continue;
     }
-    if (req.method === "OPTIONS") {
-      res.writeHead(204, {
-        "Access-Control-Allow-Origin": "*",
-        "Access-Control-Allow-Methods": "GET, POST, DELETE, OPTIONS",
-        "Access-Control-Allow-Headers": "Content-Type, MCP-Protocol-Version, mcp-session-id"
-      });
-      res.end();
-      return;
+    const { description: ownNote, ...ownShape } = field;
+    const { description: shownNote, ...shownShape } = shown;
+    const merged = Array.isArray(shownShape.anyOf) && Object.keys(shownShape).length === 1;
+    const shapes = merged ? [shownShape, ...shownShape.anyOf] : [shownShape];
+    if (!shapes.some((shape) => JSON.stringify(shape) === JSON.stringify(ownShape))) {
+      findings.push(`${name} is listed with another shape`);
     }
-    const server = createAgentQaMcpServer({
-      configPath: options.configPath,
-      dashboardUrl: options.dashboardUrl,
-      endpointUrl: endpoint.url,
-      analyticsConfig: options.analyticsConfig,
-      transport: "http"
-    });
-    const transport = new import_streamableHttp.StreamableHTTPServerTransport({
-      sessionIdGenerator: void 0
-    });
-    try {
-      await server.connect(transport);
-      await transport.handleRequest(req, res);
-      res.on("close", () => {
-        void transport.close();
-        void server.close();
-      });
-    } catch (err) {
-      void transport.close();
-      void server.close();
-      if (!res.headersSent) {
-        jsonRpcError(
-          res,
-          500,
-          err instanceof Error ? err.message : "Internal MCP server error"
-        );
-      }
+    const kept = typeof shownNote === "string" && shownNote.includes(String(ownNote));
+    if (typeof ownNote === "string" && !kept) {
+      findings.push(`${name} lost its own description`);
     }
+  }
+  const allowed = /* @__PURE__ */ new Set([discriminant, ...own.required ?? []]);
+  for (const name of listed.required ?? []) {
+    if (!allowed.has(name)) findings.push(`the listing requires ${name}, which ${opId} does not`);
+  }
+  if (own.additionalProperties === false && listed.additionalProperties !== false) {
+    findings.push("the listing admits fields no arm takes");
+  }
+  return findings;
+}
+function withoutLegacyResultWrap(document) {
+  const wrapper = document ?? {};
+  const keys = Object.keys(wrapper).filter((key) => key !== "$schema").sort();
+  if (keys.join(",") !== "properties,required,type" || wrapper.type !== "object") return wrapper;
+  const properties = wrapper.properties;
+  const required = wrapper.required;
+  if (Object.keys(properties ?? {}).join(",") !== "result") return wrapper;
+  if (!Array.isArray(required) || required.length !== 1 || required[0] !== "result") return wrapper;
+  const natural = properties.result;
+  if (typeof natural !== "object" || natural === null || natural.type === "object") return wrapper;
+  return natural;
+}
+
+// src/task-seam.ts
+var JOB_STATUS_TO_MCP_TASK_STATE = {
+  // The four checkpoint boundaries. One answer, four times, on purpose.
+  queued: "working",
+  authored: "working",
+  bundling: "working",
+  committing: "working",
+  // The three terminal states, kept apart.
+  done: "completed",
+  failed: "failed",
+  cancelled: "cancelled"
+};
+function projectJobAsTask(job) {
+  return {
+    taskId: job.id,
+    status: JOB_STATUS_TO_MCP_TASK_STATE[job.status],
+    statusMessage: job.summary,
+    createdAt: job.createdAt,
+    lastUpdatedAt: job.updatedAt
   };
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  AGENT_QA_SCHEMA_REFERENCES,
-  DEFAULT_MCP_HOST,
-  DEFAULT_MCP_PATH,
-  DEFAULT_MCP_PORT,
-  MCP_STDIO_STARTUP_MESSAGE,
-  SCHEMA_REFERENCE_NAMES,
-  VALIDATION_KINDS,
-  classifyRunFailureFromDashboardData,
-  createAgentQaMcpServer,
-  createLocalMcpHttpHandler,
-  createMcpServer,
-  resolveDashboardApiUrl,
-  resolveLocalMcpEndpoint,
-  resolveMcpEndpointShape,
-  startMcpServer,
-  validateAgentQaDefinition
+  AGENT_QA_COMPOSED_CONTRACTS,
+  AGENT_QA_MCP_INSTRUCTIONS,
+  AGENT_QA_MCP_SERVER_VERSION,
+  AGENT_QA_OP_CONTRACTS,
+  AGENT_QA_TOOL_PROJECTIONS,
+  APP_NEGOTIATION_CLIENT_CAPABILITIES_KEY,
+  APP_RESOURCE_MIME_TYPE,
+  APP_RESOURCE_NAME,
+  APP_RESOURCE_URI_TEMPLATE,
+  APP_WRAPPER_APP_NAME,
+  APP_WRAPPER_APP_VERSION,
+  APP_WRAPPER_CONNECTING_HINT,
+  APP_WRAPPER_CONNECTING_MESSAGE,
+  APP_WRAPPER_EXPIRED_HINT,
+  APP_WRAPPER_EXPIRED_MESSAGE,
+  APP_WRAPPER_LIVE_MESSAGE,
+  APP_WRAPPER_LOAD_TIMEOUT_MS,
+  APP_WRAPPER_PERMANENT_LINK_LABEL,
+  APP_WRAPPER_RUN_ENDED_MESSAGE,
+  APP_WRAPPER_STATES,
+  APP_WRAPPER_UI_PROTOCOL_VERSION,
+  APP_WRAPPER_UNREACHABLE_MESSAGE,
+  AppResourceNegotiationError,
+  AppResourceOriginSpanError,
+  AppResourceReadError,
+  AppResourceUriError,
+  DEGRADED_OUTPUT_CONTRACTS,
+  JOB_STATUS_TO_MCP_TASK_STATE,
+  LIVE_LINK_ABSENT_LINE,
+  LIVE_LINK_NO_RUN_LINE,
+  MCP_APPS_EXTENSION_ID,
+  McpProjectionError,
+  UNPROJECTED_OPS,
+  V1_TOOL_MIGRATION_MAP,
+  advertisedContracts,
+  appResourceUriFor,
+  armWithoutDiscriminant,
+  buildAgentQaMcpServer,
+  compositionOf,
+  createAgentQaMcpNodeHandler,
+  createAppResourceReadHandler,
+  foldArmFindings,
+  liveLinkLine,
+  liveLinkLineFor,
+  liveRunLinkOf,
+  maskedToolResult,
+  negotiatedAppsExtension,
+  parseAppUri,
+  projectJobAsTask,
+  registerAppResources,
+  renderAppWrapperPage,
+  stripRedundantObjectStamp,
+  toRegisterToolConfig,
+  withoutDialect,
+  withoutLegacyResultWrap
 });
 //# sourceMappingURL=index.cjs.map