@vostride/agent-qa-mcp 0.1.21 → 0.2.2

package/dist/index.d.ts

@@ -1,139 +1,1019 @@
-import * as _modelcontextprotocol_sdk_server_mcp from '@modelcontextprotocol/sdk/server/mcp';
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-import { AnalyticsService, AnalyticsServiceConfig, AnalyticsEventProperties } from '@vostride/agent-qa-core';
-import * as _vostride_agent_qa_ids from '@vostride/agent-qa-ids';
-import { EntityIdType } from '@vostride/agent-qa-ids';
-import { IncomingMessage, ServerResponse } from 'node:http';
+import { StandardSchemaWithJSON, McpServer, McpRequestContext, CallToolResult, RequestMetaEnvelope, ResourceTemplate, ResourceMetadata, ReadResourceTemplateCallback, Variables, ReadResourceResult, ToolAnnotations } from '@modelcontextprotocol/server';
+import { FunctionRegistry } from '@vostride/agent-qa-agent';
+import { FunctionCaller, RiskActionDescriptor, Job } from '@vostride/agent-qa-schema';
+import * as _modelcontextprotocol_node from '@modelcontextprotocol/node';
 
-declare const SCHEMA_REFERENCE_NAMES: readonly ["config", "test", "suite", "hooks", "ids"];
-type SchemaReferenceName = typeof SCHEMA_REFERENCE_NAMES[number];
-declare const VALIDATION_KINDS: readonly ["config", "test", "suite", "hooks"];
-type ValidationKind = typeof VALIDATION_KINDS[number];
-declare const AGENT_QA_SCHEMA_REFERENCES: {
-    readonly config: {
-        readonly name: "agent-qa config";
-        readonly rootKeys: readonly ["workspace", "services", "registry", "use", "analytics"];
-        readonly services: {
-            readonly dashboard: readonly ["port", "dbPath", "artifactsDir"];
-            readonly mcp: readonly ["enabled", "transport", "host", "port", "path"];
-            readonly cache: readonly ["dir", "ttl"];
-            readonly logging: readonly ["level"];
-            readonly recording: readonly ["enabled"];
-            readonly accessibility: readonly ["enabled", "standard", "runAfter", "failOnViolation", "disableRules", "exclude"];
-            readonly memory: readonly ["enabled", "provider", "dir", "minTrust", "maxInjections", "curatorEnabled"];
-        };
-        readonly mcpLocalOnly: {
-            readonly transports: readonly ["http", "stdio"];
-            readonly hosts: readonly ["localhost", "127.0.0.1", "::1"];
-            readonly defaultPort: 3471;
-            readonly defaultPath: "/mcp";
-        };
-    };
-    readonly test: {
-        readonly name: "agent-qa test YAML";
-        readonly requiredKeys: readonly ["test-id", "name", "target", "steps"];
-        readonly optionalKeys: readonly ["context", "use", "meta", "setup", "teardown"];
-        readonly idType: EntityIdType;
-        readonly hookReferences: "setup and teardown arrays must contain canonical h_ hook IDs.";
-        readonly stepFormats: readonly ["string", "object with step/timeout/retries/screenshot/capture/maxAttempts"];
-    };
-    readonly suite: {
-        readonly name: "agent-qa suite YAML";
-        readonly requiredKeys: readonly ["name", "target", "tests"];
-        readonly optionalKeys: readonly ["suite-id", "context", "setup", "teardown", "use"];
-        readonly idType: EntityIdType;
-        readonly testReference: "Each tests[] entry uses { test: path, id: canonical t_ test ID }.";
-        readonly hookReferences: "setup and teardown arrays must contain canonical h_ hook IDs.";
-    };
-    readonly hooks: {
-        readonly name: "agent-qa hooks file";
-        readonly rootKeys: readonly ["hooks"];
-        readonly hookKeys: readonly ["id", "name", "runtime", "file", "deps", "packageFile", "timeout", "network"];
-        readonly idType: EntityIdType;
-        readonly runtimes: readonly ["node", "bun", "python", "bash"];
+/**
+ * The tokenless dashboard live page for one run: `<base>/runs/<runId>/live` (D-08).
+ *
+ * TRAILING SLASHES ARE COLLAPSED rather than tolerated. An operator writing
+ * `baseUrl: http://dash.internal/` is writing the same base as one who did not, and a `//` in the
+ * middle of a path is a different path to some proxies — so the composition normalises instead of
+ * producing two addresses for one dashboard.
+ *
+ * THE RUN ID IS PERCENT-ENCODED, which is a no-op for every id this system mints (`runIdSchema`
+ * refuses any id the path layer would have to rewrite) and is written anyway: this function is
+ * exported, and a caller composing a link for an id that came from somewhere else should not be the
+ * one place a path segment escapes unencoded.
+ */
+declare function liveRunLinkOf(base: string, runId: string): string;
+/**
+ * The human-readable line a carrier result carries when a base exists.
+ *
+ * AN EXPORTED TEMPLATE RATHER THAN A STRING EACH CALL SITE COMPOSES, so a cell asserts the SAME
+ * sentence the surface prints. Two carriers and two hosts print this; four hand-written spellings
+ * would be four things to keep in step, and the drift would be invisible because nobody diffs two
+ * tool results.
+ *
+ * IT NAMES BOTH READINGS OF THE ONE PAGE — watching a run that is going, and reviewing one that has
+ * finished — because the address is the same either way and a line that promised only "live" would
+ * read as broken the moment the run ended, which is precisely when a person follows it.
+ */
+declare function liveLinkLine(url: string): string;
+/**
+ * What a carrier result says when no dashboard base exists ANYWHERE (RESEARCH Open Question 3).
+ *
+ * It names the config knob an operator sets to point this host at a dashboard (the 387 D-10
+ * mechanism). It contains no URL — an absence that fabricated an address would be worse than no
+ * line at all.
+ */
+declare const LIVE_LINK_ABSENT_LINE = "no dashboard configured \u2014 set services.dashboard.baseUrl";
+/**
+ * What a carrier result says when a dashboard base EXISTS but this result names no run to link to
+ * (2026-09-01, Phase 408 plan 10, WR-03 · T-408-22).
+ *
+ * A SECOND NAMED ABSENCE, BECAUSE THERE ARE TWO DISTINCT FACTS. `carrierRunIdOf`
+ * (`catalog.ts`) is DEFENSIVE ON BOTH ARMS by design and can honestly answer `undefined` — the
+ * `runIdFrom: 'output'` arm reads an op's own result, which is a `RunStartAcknowledgement` today
+ * and could be a fold's arm tomorrow, and the documented treatment of a shape it cannot read is a
+ * named absence rather than a crash. Until this constant existed, that arm printed
+ * `LIVE_LINK_ABSENT_LINE` — so a host that HAS `services.dashboard.baseUrl` set told the caller,
+ * and the model reading the result, to set a value already set and pointed at the wrong knob. That
+ * is a FALSE STATEMENT on a model-readable channel in a milestone whose law is honest absence, and
+ * a wrong sentence is worse than a vague one because a model will act on it.
+ *
+ * IT NAMES NO CONFIG KNOB, deliberately: there is nothing for the operator to set. The dashboard is
+ * configured; this particular result simply is not about a run. And it CONTAINS NO URL, the same
+ * property `LIVE_LINK_ABSENT_LINE` above is held to — an absence that fabricated an address would
+ * be the dishonesty this file exists to remove.
+ */
+declare const LIVE_LINK_NO_RUN_LINE = "no run to link to \u2014 this result names no run id";
+/**
+ * How a HOST answers "which dashboard is this process pointed at".
+ *
+ * A FACTORY, NOT A STRING, on `commands/dashboard.ts`'s own reasoning about the same value: the
+ * server has not bound a port when the host is composed, and an ephemeral port (`port: 0`) is a
+ * real posture in this suite and in tests. A value captured at composition time would be a guess; a
+ * factory read per result is the truth.
+ *
+ * `undefined` is the degenerate case rather than a second branch: a host that supplies no supplier
+ * at all and a supplier that answers `undefined` are the same fact — no dashboard — and they take
+ * the same path to the same line.
+ */
+interface LiveLinkSupplier {
+    readonly dashboardBaseUrl: () => string | undefined;
+}
+/**
+ * The one line a carrier result carries, given whatever the host's supplier answers.
+ *
+ * COMPOSED HERE so the "base or named absence" decision has exactly one implementation. It is the
+ * decision the whole file exists for, and a second copy of it — in the catalog, in a command, in a
+ * later carrier — is the copy that fabricates a URL from an empty string.
+ *
+ * A BLANK BASE IS AN ABSENT BASE. A configured `baseUrl: ""` (or a whitespace-only one) is somebody
+ * who has not pointed this host anywhere, and composing `"/runs/x/live"` from it would produce a
+ * relative fragment that reads as a link in a transcript and resolves against nothing.
+ *
+ * THE GUARD ORDER IS THE FIX, NOT AN ACCIDENT (2026-09-01, plan 10, WR-03). The BASE is tested
+ * first: with no base anywhere, "no dashboard configured" is the true and the more actionable
+ * sentence whatever the run id is, so the both-absent case answers with the fact an operator can do
+ * something about. Only with a base PRESENT does a missing run id become the fact worth naming, and
+ * that arm answers `LIVE_LINK_NO_RUN_LINE`. Swapping these two lines back reinstates the false
+ * sentence a configured host used to receive.
+ */
+declare function liveLinkLineFor(base: string | undefined, runId: string | undefined): string;
+
+/**
+ * What a tool DOES, coarsely — the axis annotations are derived along (`projection.ts`).
+ *
+ * `read` answers; `workflow` changes something in the call (a test file, a run, knowledge,
+ * configuration). `apply` is the sovereign mark door alone: since 432-12 (D-05/D-14) no tool files a
+ * proposal and no tool asks for a confirmation, and `apply` names only the mark door, which lands a
+ * mark's gold, evidence and fix in the call. Its credential check left with the MCP bearer
+ * credential (432-21, D-12), so `apply` is now a name for that one door and gates nothing.
+ *
+ * KEPT, DATED 2026-10-02 (432-42 census decision): the member is not renamed. It is a published MCP
+ * contract value (`mapping-bump-guard.test.ts` pins `kind: 'apply'` on `agent_qa_mark_run`, and the
+ * projection derives annotations from it); no D-decision renames a published name here, and the
+ * word now means "the mark door applies its fix in the call", which is true. It asks nothing.
+ */
+type ToolProjectionKind = 'read' | 'workflow' | 'apply';
+/**
+ * How a tool's arms compose — DERIVED from the entry, never stated a second time on it.
+ *
+ * `single` is a 1:1 projection. `union` is D-01's declared fold: several sibling ops behind one
+ * discriminated-union input, the arm selected by a literal. `pipeline` is D-02's one read door:
+ * two ops invoked in sequence, the first one's answer choosing whether the second runs at all.
+ *
+ * A third field on the entry would have been a third thing to keep in step with the first two, and
+ * the failure it would have hidden is a fold declared `single` — which registers a tool advertising
+ * one arm's contract while the guard reports two arms and agrees with itself.
+ */
+type ToolComposition = 'single' | 'union' | 'pipeline';
+/** One declared tool. */
+interface ToolProjection {
+    /** Curated `verb_noun` name per spec section 3.3 (D-04). The bump guard pins the exact list. */
+    readonly name: string;
+    /** The registry op ids this tool projects. Length 1 = 1:1; length > 1 = a declared fold. */
+    readonly ops: readonly string[];
+    readonly kind: ToolProjectionKind;
+    /**
+     * A union fold's discriminant key — absent on a 1:1 tool AND on the pipeline.
+     *
+     * Its presence is what tells a fold from a pipeline, which is why it is spelled per entry rather
+     * than assumed from `ops.length > 1`.
+     */
+    readonly discriminant?: string;
+    /**
+     * This tool CARRIES the live-view MCP App (2026-08-31, Phase 408 plan 01 · D-05 / MCPA-01).
+     *
+     * ITS PRESENCE IS THE SIGNAL, exactly as `discriminant`'s above is. A carrier is a tool whose
+     * declaration references the `ui://` App resource, so a host that negotiated the Apps extension
+     * can render the run's live view beside the result; a tool without this member references
+     * nothing, and `projection.ts` derives an ABSENT `_meta` for it rather than an empty one. Spelled
+     * per entry rather than inferred from a name, a kind or an op id, because the census that
+     * enumerates carriers reads THIS field — and a predicate over names would be a second, unwritten
+     * declaration of which doors reach a credential channel (the 399.1 lesson).
+     *
+     * `resource` names which `ui://` template the reference points at; one template exists today and
+     * the field is spelled anyway, so a second App is an added member here rather than a second
+     * meaning for a boolean.
+     *
+     * `runIdFrom` names where the CONCRETE runId for a per-call reference is found — on the call's
+     * input or in the op's own result. `agent_qa_start_run` answers a `RunStartAcknowledgement`
+     * carrying the id the run was given, so its reference is derivable only from the OUTPUT;
+     * `agent_qa_get_run_digest` is asked about a run by id, so its reference is derivable from the
+     * INPUT, which is what makes it the late-attach door (D-07).
+     *
+     * THE TASK-SHAPE QUESTION D-05 LEFT OPEN IS CLOSED, and closed by measurement rather than by
+     * preference: the task seam is dormant — "It registers nothing, advertises nothing and routes
+     * nothing" (task-seam.ts:21-23, and catalog.ts:34-36 states the matching absence) — so both
+     * carriers are plain tools answering immediate results, and there is no task completion or
+     * status poll for a reference to ride. (2026-08-31; the 2.0.0 core SDK has since grown the Tasks
+     * vocabulary, which makes the seam's own dated deferral stale at the SDK layer and changes
+     * nothing here: registering Tasks is not this phase's job.)
+     */
+    readonly ui?: {
+        readonly resource: 'live-run';
+        readonly runIdFrom: 'input' | 'output';
     };
-    readonly ids: {
-        readonly name: "agent-qa canonical IDs";
-        readonly instruction: "Generate IDs with agent_qa_generate_id or `agent-qa ids generate <type>`; never hand-write IDs.";
-        readonly contracts: _vostride_agent_qa_ids.EntityIdContract[];
+    /**
+     * 2026-09-28 (431 D-05): the result-size hint, advertised as `_meta[MAX_RESULT_SIZE_META_KEY]`.
+     * Present only on reads whose one-shot answer can outgrow a host's default result budget.
+     */
+    readonly maxResultSizeChars?: number;
+}
+/** The composition, read off the entry. See {@link ToolComposition}. */
+declare function compositionOf(projection: ToolProjection): ToolComposition;
+/**
+ * The live input/output contracts of one projected op.
+ *
+ * WHY THIS TABLE EXISTS AT ALL, since it looks like a second declaration of something the registry
+ * already knows. It is not: `FunctionSpec` — the record holding the LIVE validators — deliberately
+ * never leaves the function layer's own directory (T-384-01 / T-384-14), and what a surface can see
+ * through `registry.list(caller)` is a `FunctionDeclaration` whose `input`/`output` are already
+ * INERT JSON-Schema projections. D-16 mechanic (a) needs the live Standard-Schema objects, so the
+ * projection names them here, imported from the ONE module the ops themselves import them from.
+ * Drift is therefore impossible in the only sense that matters: this is not a copy of the contract,
+ * it is the same object, so the schema advertised in `tools/list` and the schema `invokeFunction`
+ * validates with are one thing that cannot disagree.
+ *
+ * The alternative — `fromJsonSchema(declaration.output)` — was available and rejected: it is a
+ * SECOND conversion recipe beside the SDK's own, and the anti-pattern this phase's research names
+ * first is exactly two recipes for one conversion.
+ *
+ * The field type is the SDK's `StandardSchemaWithJSON` and NOT a zod type, which is the same
+ * decision seen from the other side: this package's runtime dependency allow-list is exactly the
+ * two protocol packages (D-20), so naming a validator library here — even in a type position, which
+ * the dependency lint reads no differently — would reopen the collapse the phase exists to make.
+ * A zod 4.4 schema satisfies the interface, which is the whole of what either side needs to know.
+ */
+interface ToolOpContracts {
+    readonly input: StandardSchemaWithJSON;
+    readonly output: StandardSchemaWithJSON;
+}
+/**
+ * Op id -> its live contracts, for every op any declared projection names.
+ *
+ * `catalog.ts` refuses to build a tool whose op is missing from it, so the two tables can never
+ * drift apart silently.
+ */
+declare const AGENT_QA_OP_CONTRACTS: Readonly<Record<string, ToolOpContracts>>;
+/**
+ * THE CATALOGUE. Twenty tools, and the bump guard pins this exact list by name and by op set.
+ * (Sixteen until 2026-09-28, when 431 D-01 added the eight discovery reads; twenty-four until
+ * 2026-09-30, when 432-12 removed the four proposal tools.)
+ *
+ * The read side is D-02: one universal entity door plus the reads a workflow needs mid-flight and
+ * the 431 discovery reads. The write side changes things IN THE CALL (432 D-05/D-14): every
+ * `workflow` entry writes what it names and answers what it changed, and nothing waits for a second
+ * call. There is no apply tool, no `confirmed` input and no elicitation; the mark door is the one
+ * `apply` entry, and since 432-21 (D-12) it checks no credential.
+ *
+ * WHY THERE IS NO PROPOSAL TOOL AT ALL. The inbox's verbs declared a human-origin requirement, so a
+ * tool over either decision verb would have listed for every caller and refused every call; the
+ * bump guard stated the rule generally until 432-39 deleted the field. 432-12 unprojected the whole
+ * inbox and 432-17 deleted it, ops and all (re-spelled 2026-10-02, 432-42).
+ */
+declare const AGENT_QA_TOOL_PROJECTIONS: readonly ToolProjection[];
+/**
+ * Tool name -> the contract that tool ADVERTISES, where it is not simply its one op's contract.
+ *
+ * Exactly two reasons an entry exists here, and no third:
+ *
+ *  1. A UNION FOLD validates with the discriminated union of its arms' own DTOs, composed in
+ *     `@vostride/agent-qa-schema` (see `functions/tool-folds.ts` for why it is composed there and
+ *     not here). Its output is the union of the arms' own outputs, collapsed when they are one.
+ *     Its input is listed as one object by `projection.ts` (2026-10-20, 446-11).
+ *  2. THE PIPELINE advertises the FIRST op's contract on both sides: a caller hands `entities.resolve`
+ *     the reference it has, and reads back the resolution union — a card, a small disambiguation
+ *     set, or an honest miss. `entities.get` runs inside the resolved arm and contributes no shape
+ *     of its own, which is why its contract is absent from the advertisement.
+ *
+ * 2026-10-01 (432-21, D-12): THE MARK DOOR'S ENTRY IS DELETED. It advertised the op's outcome OR the
+ * credential refusal (419 D-20); the refusal left with the MCP bearer credential, so the door
+ * advertises exactly its op's own contracts and needs no entry. (The D-11 apply envelope it once
+ * carried, `proposal_id` and `confirmed`, went with the apply tools in 432-12, D-05/D-14.)
+ */
+declare const AGENT_QA_COMPOSED_CONTRACTS: Readonly<Record<string, ToolOpContracts>>;
+/** The contract a tool advertises: its composition when it has one, its one op's otherwise. */
+declare function advertisedContracts(projection: ToolProjection): ToolOpContracts | undefined;
+/**
+ * A tool whose advertised OUTPUT cannot be represented as JSON Schema, and therefore ships with no
+ * `outputSchema` at all (2026-08-16, D-16's explicit-degradation clause).
+ *
+ * MEASURED, NOT PREDICTED. `tools/list` converts every `outputSchema` in zod's OUTPUT mode
+ * (`mcp-DXXb3Vv3.mjs:1391`, uncaught), and a contract built over a branded id — `z.string()
+ * .transform(asRunId)` — makes that conversion throw `Transforms cannot be represented in JSON
+ * Schema`. The consequence is not a poorer listing for one tool: the throw takes the WHOLE
+ * `tools/list` response down for every caller who can see the tool. Phase 384 hit the same wall from
+ * the other side and answered it by projecting both sides in input mode (`declaration-projection.ts`).
+ *
+ * WHY OMISSION RATHER THAN A SECOND CONVERSION. Advertising the INPUT-mode document as the output
+ * would have worked and been a lie of exactly the kind D-16 forbids: a schema derived by a second
+ * recipe, no longer the object `invokeFunction` validates with, presented as though it were. What a
+ * caller gets instead is `content` plus `structuredContent` and no advertised shape — less, and
+ * true. `validateToolOutput` skips a tool with no `outputSchema`, so the result still flows.
+ *
+ * THE LIST IS TWO-SIDED. `projection.ts` PROBES the conversion for every tool: an undeclared
+ * failure throws, and a declared entry whose contract has since become convertible throws too. So
+ * this list cannot silently grow and cannot silently rot.
+ *
+ * 2026-09-28 (431-03): the way off this list is a canonical `OutputContract` from
+ * `@vostride/agent-qa-schema` — the op's own runtime schema as validator, with an explicit output
+ * document — never a narrowed stand-in authored here. `agent_qa_start_run` keeps its row.
+ */
+interface OutputSchemaDegradation {
+    readonly tool: string;
+    readonly opId: string;
+    /** The schema symbol whose transform the converter refused, for a reader chasing the cause. */
+    readonly schema: string;
+    /** The converter's own message, verbatim as measured on 2026-08-16. */
+    readonly measured: string;
+    readonly adjudication: '397';
+}
+declare const DEGRADED_OUTPUT_CONTRACTS: readonly OutputSchemaDegradation[];
+/**
+ * A registry op that this surface deliberately does NOT project, and why (2026-08-16 · D-03/D-15).
+ *
+ * THE DATED SCOPING NOTE IS THIS TABLE, not a comment beside it. 397's parity suite ranges over the
+ * projected set, and a suite that scoped itself to whatever happened to be in the mapping would be
+ * discovering an accident rather than honouring a decision. Every op the registry declares appears
+ * either above or here — the bump guard asserts that partition against the registry's own
+ * enumeration, so a new op cannot land undispositioned.
+ *
+ * `agent.ask` LEADS THE LIST because its exclusion is the one with a decision behind it (D-03).
+ * Projecting the agent's own turn entry over MCP is nested-agent delegation: a caller's tool call
+ * would spend this project's model tokens, take the lease the local host holds, and stream through a
+ * channel a single `tools/call` round trip has no shape for — four independent reasons, and no MCPS
+ * requirement asking for any of them. It is deferred as its own seam rather than left out by
+ * oversight, and the deferral is dated so a later reader can tell the two apart.
+ *
+ * The rest are D-02's line — this surface carries the reads a workflow needs MID-FLIGHT and not the
+ * whole catalogue — and the two ops that cannot serve an agent-origin caller at all.
+ */
+interface UnprojectedOp {
+    readonly opId: string;
+    readonly reason: string;
+    /**
+     * Who decided this absence is not a gap.
+     *
+     * 397 for every op that existed when 397's parity walk ruled the whole register (D-15). WIDENED
+     * to admit `'398'` on 2026-08-17 for `agent.explain`, and the widening is the honest move rather
+     * than a convenience: 397 could not have adjudicated an op that did not exist, and stamping this
+     * one `'397'` to keep a literal green would have made the field record a ruling nobody made — the
+     * one thing a provenance column is for. The vocabulary is a CLOSED set and the bump guard pins
+     * which entries carry which adjudicator by name, so it cannot widen again by habit.
+     *
+     * 405-05 adds `runs.artifact` under the SAME `'405'` stamp on the same day and by the same
+     * ruling; the vocabulary does not widen for it.
+     *
+     * WIDENED AGAIN on 2026-08-27 (405-01, D-03) for `runs.detail`, on exactly the 398 and 403
+     * reasoning and for no new one: 397 could not have ruled on an op registered eight phases
+     * later. The bump guard names which entry carries this adjudicator, in both directions, so an
+     * entry stamped `'405'` because it was easier reds there rather than joining a set that has
+     * quietly become "any phase number".
+     *
+     * WIDENED AGAIN on 2026-08-29 (407-01, D-05) for `runs.knowledge`, on exactly that reasoning and
+     * for no new one: 397 could not have ruled on an op registered ten phases later. Membership is
+     * still spelled by op id in the bump guard, in both directions.
+     *
+     * RE-STAMPED on 2026-08-31 (408 D-01): `'403'` LEAVES this vocabulary and `'408'` enters. This is
+     * not a widening and not a rename — it is the provenance moving with the ruling. `runs.liveurl`
+     * was the ONLY `'403'` entry, and its 403 stamp recorded a DEFERRAL ("Phase 408's question");
+     * 408 D-01 answered that question, so the phase that decided this absence is now 408 and saying
+     * `'403'` would credit 403 with a ruling it explicitly declined to make. Leaving `'403'` in a
+     * closed set with no member would also be exactly the empty literal the bump guard's
+     * non-vacuity check passes silently over, which is the hole that check exists to close.
+     */
+    readonly adjudication: UnprojectedAdjudication;
+}
+/** The closed adjudicator vocabulary as a runtime tuple; the type above is derived from it. */
+declare const UNPROJECTED_ADJUDICATIONS: readonly ["397", "398", "405", "408", "428"];
+type UnprojectedAdjudication = (typeof UNPROJECTED_ADJUDICATIONS)[number];
+declare const UNPROJECTED_OPS: readonly UnprojectedOp[];
+
+/** Which of D-13's three closed answers a retired v1 name gets. */
+type V1MigrationArm = 'renamed-to' | 'retired' | 'pending';
+/** One retired v1 tool name and its ruled disposition. */
+interface V1ToolMigrationEntry {
+    /** The v1 tool name, verbatim from the inventory's tool table. */
+    readonly v1Name: string;
+    readonly arm: V1MigrationArm;
+    /** The live v2 tool that carries this capability. Present ONLY on `renamed-to`. */
+    readonly v2Tool?: string;
+    /** The inventory's ruled reason, dated. Never empty. */
+    readonly note: string;
+    /** What to call instead. Present on `retired` and `pending`; a `renamed-to` row's route is its tool. */
+    readonly route?: string;
+    /** The milestone that owns the absence. Present ONLY on `pending`. */
+    readonly owner?: string;
+}
+/**
+ * THE MAP. One entry per v1 tool, in the inventory's original row order.
+ *
+ * The order is the inventory's rather than alphabetical, and the bump guard pins the SORTED set
+ * separately — order is a reading convenience here and a pinned fact nowhere, which is why nothing
+ * below depends on it.
+ */
+declare const V1_TOOL_MIGRATION_MAP: readonly V1ToolMigrationEntry[];
+
+/**
+ * The version this server reports.
+ *
+ * A constant here and NOT the package version read off disk: reading `package.json` at runtime is a
+ * host capability this package does not have and must not acquire (its runtime dependency allow-list
+ * is the two protocol packages, D-20). Plan 05 decides whether the host should pass its own version
+ * in, which is the only place that fact honestly lives.
+ */
+declare const AGENT_QA_MCP_SERVER_VERSION = "2.0.0";
+/** What a host must supply to build a server for one caller. */
+interface AgentQaMcpServerDeps {
+    /** The composed function registry. Built by the HOST, never by this package (D-09). */
+    readonly registry: FunctionRegistry;
+    /**
+     * WHO this server answers as. Minted by the composition root and passed through untouched to
+     * `invokeFunction`. Since 432-20 (D-12) nothing here reads it to decide what to list or serve;
+     * its `surface` and `origin` reach only the receipts that already consume them. Since 432-21 no
+     * field of it is a credential this package reads.
+     */
+    readonly caller: FunctionCaller;
+    /**
+     * How text leaving this process is masked (threat T-396-01).
+     *
+     * REQUIRED, not optional, and the reason is a measured one rather than a preference: the defect
+     * class this replaces (T-395-R5-10, closed in 395's final round) was a credential reaching an MCP
+     * caller verbatim through an error serialization. An optional masker is absent exactly where
+     * nobody thought to pass one, which is the same place the leak was found.
+     */
+    readonly maskText: (text: string) => string;
+    /**
+     * Which dashboard this process is pointed at, for D-08's permanent link (408 plan 03).
+     *
+     * OPTIONAL, AND ITS ABSENCE IS THE DEGENERATE CASE RATHER THAN A SECOND BRANCH: a host that
+     * supplies nothing and a supplier that answers `undefined` are the same fact — no dashboard is
+     * configured and none is running here — and both take the same path to the same named-absence
+     * line. There is no arm below that asks which of the two happened, deliberately: a distinction
+     * nothing acts on is a distinction that eventually acquires a wrong action.
+     *
+     * A FACTORY, NOT A STRING, because on the co-hosted composition the bound origin does not exist
+     * until a port has been bound — `commands/dashboard.ts` composes this host before it listens.
+     */
+    readonly liveLink?: LiveLinkSupplier;
+}
+/**
+ * Build the server this caller sees.
+ *
+ * The listing is read through `registry.list(deps.caller)` — the registry's own view of itself for
+ * this host — so `summary` and `risk` describe the composition in front of the caller rather than a
+ * table in this package that could describe a different one. The view is the same for every caller
+ * (432-20, D-12).
+ */
+declare function buildAgentQaMcpServer(deps: AgentQaMcpServerDeps): McpServer;
+
+declare const AGENT_QA_MCP_INSTRUCTIONS: string;
+
+/**
+ * How a host composes the server for one request.
+ *
+ * It takes the SDK's own construction context, so a per-request fact such as `era` arrives here
+ * rather than being read back out of a header inside a tool handler. What it returns is the same
+ * `deps` a stdio host composes, which is what keeps ONE `buildAgentQaMcpServer` shape across both
+ * transports. 2026-10-02 (432-42, D-12): nothing about the caller decides what it may see; the
+ * shipped host passes one fixed tokenless caller.
+ */
+type AgentQaMcpDepsResolver = (ctx: McpRequestContext) => AgentQaMcpServerDeps;
+/**
+ * A Node request handler serving this catalog over stateless streamable HTTP.
+ *
+ * The factory is re-run per request, which is the SDK's own model and not an inefficiency to route
+ * around: a per-request instance is what makes a caller's tool set a property of that caller rather
+ * than of whoever connected first, and it is why absence stays structural on this transport too.
+ *
+ * IT TAKES A RESOLVER AND NOT A FIXED `deps` (plan 05). 2026-10-02 (432-42, D-12/D-13): the
+ * bearer check that once sat in front of this handler is deleted with MCP tokens (432-21); what
+ * stays in front of it is the host's Host and Origin guard on the loopback listener. The resolver
+ * receives the SDK context and builds the instance; it reads no header and verifies nothing.
+ *
+ * A host with one fixed caller passes `() => deps` — the static case is the degenerate resolver,
+ * not a second signature to keep in step.
+ */
+declare function createAgentQaMcpNodeHandler(resolveDeps: AgentQaMcpDepsResolver): _modelcontextprotocol_node.NodeMcpRequestHandler;
+
+/** A JSON-Schema document as it travels: an ordinary object, with nothing runnable on it. */
+type JsonDocument = Record<string, unknown>;
+/**
+ * Drop `$schema`, which the SDK's conversion stamps and the registry's projection does not.
+ *
+ * A DIALECT MARKER, not content: it says which JSON Schema draft the document speaks and describes
+ * nothing about the contract. Removing it is the one normalisation this file performs, and it is
+ * called out rather than buried because a normalisation that removed content would be the way to
+ * make a drift cell pass over real drift.
+ */
+declare function withoutDialect(document: unknown): JsonDocument;
+/**
+ * Drop the `type: "object"` the SDK stamps onto a COMPOSITION root.
+ *
+ * The second and last normalisation, and it is as narrow as the first. `standardSchemaToJsonSchema`
+ * stamps `type: "object"` on a typeless root it can prove is object-shaped — a `oneOf` whose every
+ * member is `type: "object"`, which is exactly what a zod discriminated union emits. The SDK's own
+ * comment calls the stamp "redundant-but-valid", and a document is not changed by adding a
+ * constraint every one of its branches already imposes.
+ *
+ * IT IS GATED ON THE COMPOSITION KEYWORD, so a genuine `type` disagreement still reds: the only
+ * case dropped is a root that carries `oneOf`/`anyOf` AND the stamp, which is the one case the SDK
+ * manufactures. An ungated `delete document.type` would have made the whole drift cell blind to a
+ * contract whose root type actually moved.
+ */
+declare function stripRedundantObjectStamp(document: JsonDocument): JsonDocument;
+/**
+ * One union arm of a fold's composed contract, with the fold's discriminant taken back out.
+ *
+ * `required: []` is DROPPED rather than kept, and the case is real rather than defensive:
+ * `config.undo.propose` takes an all-optional input, so its own projection carries no `required`
+ * key at all while the extended arm carries `['action']` — and removing the discriminant from that
+ * leaves an empty array where the other side has nothing. JSON Schema reads an absent `required`
+ * and an empty one identically, so the two documents agree; keeping the empty array would have
+ * failed the cell on a difference that describes no difference.
+ */
+declare function armWithoutDiscriminant(arm: JsonDocument, discriminant: string): JsonDocument;
+/**
+ * What a fold's one listed object leaves out of, or adds to, one arm's own contract.
+ *
+ * 2026-10-20 (446-11, D-25): a fold lists one object instead of its union, so an arm is no longer
+ * a member to compare whole. It is covered when the `discriminant` enum names it, every field it
+ * takes is listed with its own shape (the listing may add a description, never drop one), and the
+ * listing requires nothing the arm does not. That a call is still validated arm by arm is the
+ * C446-TOOL-SCHEMA counter-cell's claim, not this lens's.
+ */
+declare function foldArmFindings(listed: JsonDocument, discriminant: string, opId: string, own: JsonDocument): readonly string[];
+/**
+ * Undo the SEP-2106 legacy `{ result }` wrap the SDK's 2025-11-25 codec puts around a non-object
+ * output root (2026-09-28, 431-03).
+ *
+ * A transport artifact, like the two stamps above: the 2026-07-28 codec advertises a list's array
+ * root as-is, while the 2025-11-25 codec projects it to `{ type: 'object', properties: { result },
+ * required: ['result'] }` and wraps `structuredContent` to match. Gated to exactly that document —
+ * nothing but those three keys (and a dialect marker), one property named `result`, and a wrapped
+ * root that is not itself an object — so an op whose real output is an object with a `result`
+ * field is left alone. Apply it BEFORE `withoutDialect`: the wrapped root keeps its own `$schema`.
+ */
+declare function withoutLegacyResultWrap(document: unknown): JsonDocument;
+
+/**
+ * Mask once, and answer both channels from the one masked value.
+ *
+ * `structuredContent` IS the masked value and `content` is its serialization, which is the whole
+ * point: the object a machine reads and the text a person reads agree about what was hidden,
+ * because there is only one masking and one document. One exception: the evidence image arm
+ * replaces `bytesBase64` in the text with a marker, while `structuredContent` keeps the bytes.
+ */
+declare function maskedToolResult(output: unknown, maskText: (text: string) => string): CallToolResult;
+
+/**
+ * The official MCP Apps extension id (spec revision 2026-01-26).
+ *
+ * RESTATED LOCALLY RATHER THAN IMPORTED, and the reason is a measured peer conflict:
+ * `@modelcontextprotocol/ext-apps` declares `peerDependencies: { '@modelcontextprotocol/sdk':
+ * '^1.29.0' }` — the v1 monolith — while this package ships the 2.0.0 split SDK, so importing its
+ * `/server` entry would drag a second SDK generation into production (Pitfall 3). The string is
+ * therefore ours, and Plan 06's census pins it against ext-apps' shipped schema so a typo'd
+ * reverse-DNS id cannot fail silently as "never negotiated".
+ */
+declare const MCP_APPS_EXTENSION_ID = "io.modelcontextprotocol/ui";
+/** The media type an App resource is served as. Restated locally for the reason above. */
+declare const APP_RESOURCE_MIME_TYPE = "text/html;profile=mcp-app";
+/** The published App address. ONE template, per run — the runId is the only variable. */
+declare const APP_RESOURCE_URI_TEMPLATE = "ui://agent-qa/live-run/{runId}";
+/**
+ * The template EXPANDED for one concrete run (408 plan 03, D-05).
+ *
+ * WHY THIS IS A FUNCTION AND NOT A STRING EACH CALLER COMPOSES. `projection.ts` advertises the
+ * TEMPLATE on a carrier tool's `_meta`, and a carrier RESULT advertises the concrete address of the
+ * run it just named — two spellings of one address, in two files, that would be free to disagree
+ * about the scheme, the namespace or the segment order. Expanding through the template constant
+ * makes drift impossible: there is one place the address is written down and one rule for filling
+ * it in.
+ *
+ * ENCODED WITH `encodeURIComponent`, which is the exact inverse of the `decodeURIComponent` the one
+ * codec above applies — so `parseAppUri(appResourceUriFor(id)).runId === id` for every id, and an
+ * address this package composes is one this package can read back.
+ */
+declare function appResourceUriFor(runId: string): string;
+/** The registered resource name. Prefixed like the tools, so one namespace reads as one server. */
+declare const APP_RESOURCE_NAME = "agent_qa_live_run_app";
+/**
+ * The ONE parser of a `ui://` app address.
+ *
+ * TOTAL AND UNDECORATED: it answers the run id or `undefined`, and it never explains which clause
+ * refused — the caller-facing sentence is the read handler's, phrased once.
+ *
+ * THE RUN ID IS JUDGED BY THE MINT OP'S OWN INPUT CONTRACT, not by a pattern this file invented.
+ * `RunsLiveUrlInputSchema` carries `runIdSchema` — the codec that decides whether a string may name
+ * this run's own directory, so an address carrying `..`, a path separator or a control character is
+ * refused here by exactly the rule that refuses it everywhere else. Stated the other way round,
+ * which is the honest reading: an app address is well-formed precisely when the op this read mints
+ * through would accept the run it names, so the two can never disagree about one string.
+ */
+declare function parseAppUri(href: string): {
+    readonly runId: string;
+} | undefined;
+/**
+ * The envelope member carrying the request's declared client capabilities.
+ *
+ * MEASURED, NOT GUESSED, and re-exported from the SDK rather than restated as a literal so a
+ * spelling drift is a compile error instead of a gate that silently answers "never negotiated".
+ * The measurement (2026-08-31, `src/__tests__/app-negotiation.test.ts`) drove a real
+ * `@modelcontextprotocol/client@2.0.0` against `createAgentQaMcpNodeHandler` over a loopback
+ * socket and read the resource-read context back out of the handler:
+ *
+ *   ctx.mcpReq.envelope['io.modelcontextprotocol/clientCapabilities'].extensions['io.modelcontextprotocol/ui']
+ *
+ * That cell is the living record — it asserts the path against the wire, so an SDK that moves the
+ * member reds it rather than quietly turning this gate into a blanket refusal.
+ */
+declare const APP_NEGOTIATION_CLIENT_CAPABILITIES_KEY = "io.modelcontextprotocol/clientCapabilities";
+/**
+ * The ONE member of the SDK's read context this module reads.
+ *
+ * Declared structurally rather than as `Pick<ServerContext, 'mcpReq'>` for a reason a cell feels
+ * immediately: the SDK's context carries a dozen live functions, and a predicate whose input
+ * cannot be written down without them is a predicate only the wire can test. `ServerContext` is
+ * assignable to this, so the production call site still hands over the SDK's own object untouched.
+ */
+interface AppReadContext {
+    readonly mcpReq?: {
+        readonly envelope?: Partial<RequestMetaEnvelope>;
     };
-};
-interface ValidationIssue {
-    path: string;
-    message: string;
 }
-interface DefinitionValidationResult {
-    valid: boolean;
-    kind: ValidationKind;
-    issues: ValidationIssue[];
+/**
+ * Did THIS request declare the MCP Apps extension?
+ *
+ * FAIL-CLOSED at every step: no context, no envelope, no capabilities member, no `extensions`
+ * record, or an `extensions` record without our id all answer `false`. The question is "is there
+ * evidence this caller negotiated the extension", and absence of evidence is not evidence — which
+ * matters most for the case the measurement surfaced, where a 2025-era caller carries no envelope
+ * at all and would otherwise be waved through by a predicate written as "not explicitly absent".
+ *
+ * WHAT FAILING CLOSED HERE DOES AND DOES NOT PROTECT (dated 2026-09-01, 408 gap round, road
+ * `demote` — the full ruling is in this file's header). The predicate is still fail-closed AS A
+ * PREDICATE, and every clause above is unchanged. What is CORRECTED is the reading that failing
+ * closed here protects the credential. It does not. The value read below is composed by the
+ * caller in its own per-request `_meta` and forwarded by the SDK unauthenticated
+ * (`_inputRequestCapabilityView` returns it verbatim; `checkInboundEnvelope` checks shape only),
+ * so a `false` answer means "this caller did not SAY it can render an App" — a host-capability
+ * fact — and never "this caller is not authorized to hold a live-view credential". What bounds
+ * the credential is `bindingStatus === 'bound'` and the local network controls D-13 keeps; the
+ * scope check that once sat beside it is deleted (432-20, D-12). See header clause 5.
+ *
+ * `RequestMetaEnvelope` is an intentionally EMPTY augmentable type in the shipped d.mts, so the
+ * envelope is read through one narrow cast at this single seam rather than by widening the SDK's
+ * types somewhere a second reader would have to find.
+ */
+declare function negotiatedAppsExtension(ctx: AppReadContext | undefined): boolean;
+/**
+ * A read refused because the request never declared the Apps extension (clause 3 of the ruling
+ * in this file's header; D-09, T-408-01).
+ *
+ * IT NAMES THE EXTENSION AND CARRIES NOTHING ELSE. The message is authored prose plus a constant
+ * this repository owns, so there is nothing caller-supplied in it to mask and — the point of the
+ * whole arm — nothing minted in it to leak, because it is thrown before the first mint.
+ */
+declare class AppResourceNegotiationError extends Error {
+    constructor();
+}
+/** An address the one codec does not recognise. */
+declare class AppResourceUriError extends Error {
+    constructor(detail: string);
+}
+/**
+ * A refusal from the App read that is NOT a run-liveness fact.
+ *
+ * Deliberately narrow: absence of a live session is rendered, never thrown (D-07), so anything that
+ * reaches this class is a genuine failure of the read — a missing scope, an unknown op, a broken
+ * composition — and it carries its message masked for the same reason `resources.ts`'s does.
+ */
+declare class AppResourceReadError extends Error {
+    constructor(message: string);
+}
+/**
+ * A document whose panes would span more than one origin (IN-02, T-408-26; added 2026-09-01).
+ *
+ * THE INVARIANT THIS SERVES USED TO BE AN ASSUMPTION. The `_meta.ui.csp` block below was derived
+ * from `mints[0]` alone, which is correct today only because `runs.liveurl` reads
+ * `liveView.origin()` once per invocation — a fact held in ANOTHER package, which nothing on that
+ * line checked. A composition that ever minted across origins would have shipped a frame allowance
+ * covering the first pane and blocking every other one: a blank inner frame, which is the exact
+ * failure this milestone exists to remove, arriving silently.
+ *
+ * WHY REFUSAL RATHER THAN A WIDER ALLOWANCE. Naming every origin in `frameDomains` would keep the
+ * document renderable, but it would also make the allowance a function of how many panes happened
+ * to be minted — precisely the "never broader than the document needs" property T-408-05 pins.
+ * This module's own reasoning is that the allow is as narrow as the document needs; a document that
+ * needs two origins is a composition this server does not know how to serve narrowly, and saying so
+ * is honest absence rather than a silent widening.
+ *
+ * ITS MESSAGE CARRIES NO CALLER TEXT AND NO CREDENTIAL. The origins are host-composed and
+ * `originOf` returns an origin only — never the path and never the fragment the token lives in — so
+ * there is nothing here to mask and nothing here to leak.
+ */
+declare class AppResourceOriginSpanError extends Error {
+    constructor(origins: readonly string[]);
+}
+/** The host-bound `(registry, caller)` closure over `invokeFunction`. */
+type AppResourceInvoke = (opId: string, input: unknown) => Promise<unknown>;
+interface AppResourceReadDeps {
+    readonly invoke: AppResourceInvoke;
+    /** How CALLER text leaving this handler is masked. Required — see the header's channel split. */
+    readonly maskText: (text: string) => string;
+    /**
+     * Which dashboard this process is pointed at, for D-08's permanent link (408 plan 03).
+     *
+     * OPTIONAL, and its absence is a real posture rather than a gap: a composition that knows of no
+     * dashboard renders the wrapper with NO anchor at all, which is what plan 01 shipped and what the
+     * honest-absence law requires — a link to nothing is the dishonesty this milestone removes.
+     *
+     * THIS IS THE ONE SLOT WHOSE ABSENCE COSTS A PERSON SOMETHING, which is why it is wired rather
+     * than left where plan 01 left it: the wrapper's `expired` and `unreachable-origin` states are
+     * D-11's answers for "the embed cannot show you this", and both of them are supposed to hand a
+     * person the browser instead. A wrapper reaching those states with no link is a dead end wearing
+     * an honest sentence.
+     */
+    readonly liveLink?: LiveLinkSupplier;
+}
+/**
+ * Build the App read.
+ *
+ * Exported so a cell can drive it without a server, and so the parse/mint/render behaviour is
+ * observable independently of registration — the two halves fail in different directions.
+ */
+declare function createAppResourceReadHandler(deps: AppResourceReadDeps): (uri: URL, variables: Variables, ctx: AppReadContext) => Promise<ReadResourceResult>;
+/**
+ * The slice of `McpServer` this module uses.
+ *
+ * The same narrow structural type `resources.ts` declares, spelled with the SDK's own
+ * `ResourceTemplate` / `ResourceMetadata` / `ReadResourceTemplateCallback` — so a cell can observe
+ * the registration without assembling a protocol server while a real `McpServer` still satisfies
+ * it. Read that module's note before narrowing any member here: a hand-narrowed config or a
+ * `readonly` result array makes `McpServer` unassignable and the compiler names the wrong cause.
+ *
+ * THE READ CALLBACK IS THE SDK'S OWN `ReadResourceTemplateCallback` AND NOT A LOCAL NARROWING, for
+ * the reason 408 plan 02 needed a third argument at all: the negotiation evidence arrives in the
+ * SDK's read CONTEXT, so a slice that spelled the callback `(uri) => …` would have declared the
+ * one parameter the gate reads out of existence.
+ */
+interface AppResourceRegistrar {
+    registerResource(name: string, template: ResourceTemplate, config: ResourceMetadata, read: ReadResourceTemplateCallback): unknown;
 }
-declare function validateAgentQaDefinition(kind: ValidationKind, definition: unknown): DefinitionValidationResult;
+/** Exactly what this module needs from the host — the same record `catalog.ts` already holds. */
+interface AppResourceDeps {
+    readonly registry: FunctionRegistry;
+    readonly caller: FunctionCaller;
+    readonly maskText: (text: string) => string;
+    /** D-08's base supplier, passed straight through to the read. See {@link AppResourceReadDeps}. */
+    readonly liveLink?: LiveLinkSupplier;
+}
+/**
+ * Register the App template when this composition can honestly serve it, and answer what it
+ * registered.
+ *
+ * Returns the registered template URIs rather than nothing, for `resources.ts`'s reason: "registered
+ * none" and "registered one" are the two halves of the claim, and a caller that had to inspect a
+ * server to tell them apart could only ever test one of them.
+ *
+ * TWO CONDITIONS, BOTH READ OFF THE REGISTRY'S OWN DECLARATIONS (D-02/D-03), AND NEITHER ABOUT THE
+ * CALLER (432-20, D-12 deleted the third, a `visibleToCaller` scope check):
+ *
+ *  1. Both ops this surface reads through — the mint and the roster read — are declared here. A
+ *     composition that registered neither has no App to offer.
+ *  2. The mint is BOUND in this composition. This is D-03's floor made structural: the standalone
+ *     `agent-qa mcp` process composes no `liveView` port, so its `runs.liveurl` is declared-and-
+ *     unbound and every mint there would refuse by name. Registering an App on that host would
+ *     advertise an address whose every read is honestly empty — so it registers nothing at all,
+ *     and the link-out is that host's whole answer. On a co-hosted composition the same three
+ *     lines register it, by composition rather than by configuration.
+ *
+ * A composition that fails any of them gets NO template and NO error — the same answer `catalog.ts`
+ * gives a tool whose op is missing, because refusing to build would take an entire MCP connection
+ * down over one unavailable capability.
+ */
+declare function registerAppResources(server: AppResourceRegistrar, deps: AppResourceDeps): readonly string[];
 
-interface AgentQaMcpServerOptions {
-    configPath?: string;
-    dashboardUrl?: string;
-    endpointUrl?: string;
-    analyticsService?: AnalyticsService;
-    analyticsConfig?: AnalyticsServiceConfig;
-    analyticsStandardProperties?: AnalyticsEventProperties;
-    transport?: 'stdio' | 'http';
-}
-declare function resolveDashboardApiUrl(dashboardUrl: string, apiPath: string): string;
-type FailureCategory = 'passed' | 'timeout' | 'appium_startup' | 'browser_disconnect' | 'element_not_found' | 'assertion_failure' | 'hook_failure' | 'infrastructure' | 'unknown_failure';
-interface FailureClassification {
-    category: FailureCategory;
-    confidence: number;
-    evidence: string[];
-    recentRelatedCount: number;
-}
-declare function classifyRunFailureFromDashboardData(input: {
-    runDetail: unknown;
-    artifact?: unknown;
-    logs?: unknown;
-    executionLogs?: unknown;
-    recentRuns?: unknown;
-}): FailureClassification;
-declare function createAgentQaMcpServer(options?: AgentQaMcpServerOptions): McpServer;
+/**
+ * Every value `[data-app-state]` can take (D-11's closed set).
+ *
+ * Exported for the reason `LIVE_EMBED_STATES` is: the DOM cells range over this list, so a state
+ * added to the page without a cell is a visible diff rather than an unobserved arm.
+ */
+declare const APP_WRAPPER_STATES: readonly ["connecting", "live", "expired", "unreachable-origin", "run-ended"];
+type AppWrapperState = (typeof APP_WRAPPER_STATES)[number];
+/** What the page says while the inner frame has not painted yet. */
+declare const APP_WRAPPER_CONNECTING_MESSAGE = "connecting to the live view\u2026";
+/**
+ * The second line under `connecting`, and the WHOLE of what an initial render says on a host that
+ * never runs this document's script (WR-10, RESEARCH assumption A1; the cell is
+ * `app-wrapper-dom.test.ts` cell (7)).
+ *
+ * Named for the same reason every other absence here is named: a document that says only that it is
+ * connecting has made a promise its own script has to keep, and under a host CSP of
+ * `script-src 'none'` there is no script to keep it. The sentence therefore points at the ONE
+ * useful action available with no script at all — the permanent link rendered directly beneath it,
+ * which is now markup rather than something the script assigns. One useful action, no apology.
+ */
+declare const APP_WRAPPER_CONNECTING_HINT = "if the pane does not appear, open it in your browser";
+/** What the page says once the inner frame has loaded on an origin this host can reach. */
+declare const APP_WRAPPER_LIVE_MESSAGE = "live";
+/**
+ * What an elapsed live link says (D-10).
+ *
+ * The wrapper's own sentence rather than the embed page's `link expired`, because the two are about
+ * different things: the embed says its socket was refused, and this says the link this App was
+ * rendered with has aged out.
+ */
+declare const APP_WRAPPER_EXPIRED_MESSAGE = "live link expired";
+/**
+ * The second half of the expired state, and the WHOLE of D-10's refresh story (D-10).
+ *
+ * There is no re-mint inside this sandbox and there is never going to be one — a UI-initiated mint
+ * door was rejected precisely because its model-context hygiene is per-host behaviour nobody here
+ * controls. What replaces it is this sentence: the way to a fresh token is another watch call, one
+ * the person can simply ask for, and saying so is the difference between a dead end and a next
+ * move. Separate from the message above so the DOM can show both and a cell can assert each.
+ */
+declare const APP_WRAPPER_EXPIRED_HINT = "ask to watch again \u2014 a fresh watch mints a new link";
+/**
+ * The REQUIRED unreachable-origin sentence (D-11), spelled EXACTLY as CONTEXT ratified it.
+ *
+ * A host running somewhere that cannot route to a loopback dashboard origin must say so and offer
+ * the browser, never show a blank inner frame. This string is a contract: the DOM cells assert
+ * against this constant, so the sentence and the assertion can never drift apart.
+ */
+declare const APP_WRAPPER_UNREACHABLE_MESSAGE = "this host can't reach the live view \u2014 open it in your browser";
+/**
+ * What a run with no live session on this host says (D-07).
+ *
+ * Not an error and not a blank frame — and it points at the way to see the run anyway, which is
+ * the permanent link rendered directly beneath it. A run that has finished still HAPPENED, and the
+ * dashboard's own page is where its history lives.
+ */
+declare const APP_WRAPPER_RUN_ENDED_MESSAGE = "this run is not live \u2014 open it in your browser";
+/** The label on the permanent link-out slot, when one is composed (D-08). */
+declare const APP_WRAPPER_PERMANENT_LINK_LABEL = "open in your browser";
+/**
+ * How long silence from the inner frame is allowed to last before it is named (D-11, T-408-08).
+ *
+ * Exported because the DOM cell must wait on the page's OWN bound rather than on a number a test
+ * file guessed. Ten seconds is chosen against the two shapes this arm exists for: a black-holed
+ * origin never answers at all, and a slow-but-reachable dashboard on loopback answers in
+ * milliseconds — there is no realistic case in between, so a longer bound would only make a person
+ * stare at a spinner for longer before reading the same sentence.
+ */
+declare const APP_WRAPPER_LOAD_TIMEOUT_MS = 10000;
+/**
+ * The MCP Apps protocol version this wrapper announces in its `ui/initialize` request.
+ *
+ * MEASURED, not guessed (408-06 Task 1): `@modelcontextprotocol/ext-apps@1.7.5` carries exactly
+ * two protocol versions — `2025-11-21` and `2026-01-26` — and `2026-01-26` is the one its
+ * `AppBridge` treats as latest. `ext-apps-constants.test.ts` pins the spelling against the
+ * package's own shipped schema, so this literal cannot drift from the vocabulary in silence.
+ */
+declare const APP_WRAPPER_UI_PROTOCOL_VERSION = "2026-01-26";
+/**
+ * What this document calls itself to a host (`ui/initialize`'s required `appInfo`).
+ *
+ * Exported so a cell asserts the SAME bytes the page posts, per this file's standing rule that a
+ * value a person or a host can observe is never restated in a test.
+ */
+declare const APP_WRAPPER_APP_NAME = "agent-qa-live-view";
+/** The wrapper's own version, bumped only when the handshake it performs changes. */
+declare const APP_WRAPPER_APP_VERSION = "1.0.0";
+/**
+ * ONE minted view onto ONE member handle of the run.
+ *
+ * `liveUrl` carries its token in the FRAGMENT (403 D-04), so this value is the only place a live
+ * credential exists on this page — it is written into the frame's `src` and nowhere else: not into
+ * the document text, not into the picker's labels, not into any attribute a host serialises back.
+ */
+interface AppWrapperMint {
+    readonly handle: number;
+    readonly liveUrl: string;
+    readonly expiresAt: number;
+    readonly streamKind: string;
+}
+interface AppWrapperInput {
+    readonly runId: string;
+    /** One mint per handle on the run's announced roster. Empty is the D-07 not-live case. */
+    readonly mints: readonly AppWrapperMint[];
+    /** The tokenless dashboard page (D-08). `undefined` when no dashboard origin is composable. */
+    readonly permanentLink: string | undefined;
+    /** Whether this host holds a live session for the run at all. `false` renders `run-ended`. */
+    readonly runLive: boolean;
+    /**
+     * The instant this document is being built, in ms-epoch (D-10).
+     *
+     * A PARAMETER rather than a `Date.now()` call, for the reason every clock in this repository is a
+     * port: the expiry arm is the one thing this renderer decides about time, and a cell that cannot
+     * choose "now" could only ever assert the arm it happened to land in. Defaults to the wall clock,
+     * so the read handler passes nothing and gets the honest answer.
+     */
+    readonly now?: number;
+}
+/**
+ * Render the App wrapper for one run.
+ *
+ * The whole document, every time — there is no partial render and no update path, because D-10's
+ * answer to a stale App is a FRESH read that mints again rather than a credential machine inside
+ * the sandbox.
+ */
+declare function renderAppWrapperPage(input: AppWrapperInput): string;
 
-declare const MCP_STDIO_STARTUP_MESSAGE = "agent-qa MCP server running over stdio. Waiting for MCP client messages on stdin. Stdout is reserved for MCP protocol traffic.";
-interface StartMcpServerOptions extends AgentQaMcpServerOptions {
-    startupOutput?: Pick<NodeJS.WritableStream, 'write'>;
+/**
+ * Everything the derivation reads about ONE op, assembled by `catalog.ts`.
+ *
+ * The two halves come from two places on purpose. `summary` and `risk` are read
+ * off the registry's own declaration for this host, so they describe the composition a caller is
+ * actually talking to; `input` and `output` are the live contracts named by the mapping table,
+ * because the registry deliberately publishes only inert projections of those (T-384-14). Nothing
+ * in this record is authored by this package — it is two views of the op, joined by its id.
+ */
+interface ProjectedOpSpec {
+    readonly id: string;
+    readonly summary: string;
+    readonly risk: RiskActionDescriptor;
+    readonly input: StandardSchemaWithJSON;
+    readonly output: StandardSchemaWithJSON;
+}
+/**
+ * Exactly the `registerTool` config fields this projection derives.
+ *
+ * `outputSchema` is OPTIONAL, and its absence is a decision rather than a gap — see
+ * `DEGRADED_OUTPUT_CONTRACTS` and `probeOutputSchema` below.
+ */
+interface RegisterToolConfig {
+    readonly title: string;
+    readonly description: string;
+    readonly inputSchema: StandardSchemaWithJSON;
+    readonly outputSchema?: StandardSchemaWithJSON;
+    readonly annotations: ToolAnnotations;
+    /**
+     * The SDK's own extension slot, carrying the live-view App reference for a CARRIER tool
+     * (2026-08-31, Phase 408 plan 01 · D-05/D-09 · MCPA-01).
+     *
+     * OPTIONAL, and its absence is a decision in the same sense `outputSchema`'s is: a tool that
+     * declares no `ui` member gets no `_meta` KEY at all rather than a `_meta` whose `ui` is
+     * `undefined`, because the two are different documents on the wire and only the first is honest
+     * about a tool that references no App.
+     *
+     * WHAT IT IS ON THE LISTING CHANNEL: inert metadata. Extensions are bilateral opt-in, so a host
+     * that never negotiated `io.modelcontextprotocol/ui` ignores this field by definition — it acts
+     * on nothing here, which is what makes "the App attaches only when the host negotiated" true of
+     * every channel that ACTS without needing a listing that varies per connection (SEP-2567 removed
+     * that, and the per-request factory context carries no client capabilities to key one on). The
+     * channels that act are gated where the capabilities actually arrive: in request handling.
+     */
+    readonly _meta?: Record<string, unknown>;
+}
+/**
+ * Derive one tool's `registerTool` config.
+ *
+ * `advertised` is passed IN rather than looked up here so this module stays a derivation over
+ * values: `catalog.ts` owns the join between the mapping's data and this host's registry, and a
+ * second lookup inside the derivation would be a second chance for the two to disagree.
+ *
+ * `maskText` is a REQUIRED parameter and covers the DERIVED prose. The reason is the fresh wound
+ * this phase inherits: 395 closed a high-severity defect where a credential reached an MCP caller
+ * through a serialization nobody had thought of as an output channel. A description is composed
+ * from op summaries, and a summary is prose somebody may one day interpolate a resolved value into;
+ * routing it through the masker costs nothing on the ordinary path and closes the channel
+ * structurally rather than by remembering. Optionality is the failure mode here — an optional
+ * masker is a masker that is absent exactly where nobody looked — so the parameter has no default
+ * and the type refuses a call that omits it.
+ *
+ * TWO THINGS ARE DELIBERATELY NOT MASKED, and both would be damage rather than safety. The `title`
+ * is the curated tool NAME from the mapping table: a declared constant in this repository's own
+ * source, never data, and a masker that rewrote it would rename the tool a caller must call. The
+ * SCHEMAS are contracts rather than text — masking one would corrupt the very object
+ * `invokeFunction` validates against, and they carry field names and types, not values.
+ */
+declare function toRegisterToolConfig(projection: ToolProjection, specs: readonly ProjectedOpSpec[], advertised: ToolOpContracts, maskText: (text: string) => string): RegisterToolConfig;
+/** A projection that cannot be derived honestly, named with the tool it is about. */
+declare class McpProjectionError extends Error {
+    readonly toolName: string;
+    constructor(toolName: string, detail: string);
 }
-declare function createMcpServer(options?: AgentQaMcpServerOptions): _modelcontextprotocol_sdk_server_mcp.McpServer;
-declare function startMcpServer(options?: StartMcpServerOptions): Promise<void>;
 
-declare const DEFAULT_MCP_HOST = "127.0.0.1";
-declare const DEFAULT_MCP_PORT = 3471;
-declare const DEFAULT_MCP_PATH = "/mcp";
-type LocalMcpTransport = 'http' | 'stdio';
-interface LocalMcpEndpointConfig {
-    enabled?: boolean;
-    transport?: LocalMcpTransport;
-    host?: string;
-    port?: number;
-    path?: string;
-}
-interface LocalMcpEndpoint {
-    enabled: boolean;
-    transport: LocalMcpTransport;
-    host: string;
-    port: number;
-    path: string;
-    url: string;
-}
-interface McpHttpHandlerOptions {
-    endpoint?: Partial<LocalMcpEndpoint>;
-    dashboardUrl?: string;
-    configPath?: string;
-    analyticsConfig?: AgentQaMcpServerOptions['analyticsConfig'];
-}
-interface LocalMcpEndpointShape {
-    mcp_host_kind: 'loopback' | 'other';
-    mcp_port_kind: 'default' | 'custom';
-    mcp_path_kind: 'default' | 'custom';
-}
-declare function resolveLocalMcpEndpoint(config?: LocalMcpEndpointConfig): LocalMcpEndpoint;
-declare function resolveMcpEndpointShape(endpoint: Pick<LocalMcpEndpoint, 'host' | 'port' | 'path'>): LocalMcpEndpointShape;
-declare function createLocalMcpHttpHandler(options?: McpHttpHandlerOptions): (req: IncomingMessage, res: ServerResponse) => Promise<void>;
+/**
+ * The MCP task states this projection can produce.
+ *
+ * Four of the wire's five. The fifth, `input_required`, is deliberately absent from the table
+ * below and NOT from this union: it is a real state of the protocol that no agent-qa job status
+ * currently means, and a future status that did mean it should be able to say so by adding one row
+ * rather than by widening a type.
+ */
+type McpTaskState = 'working' | 'input_required' | 'completed' | 'failed' | 'cancelled';
+/**
+ * The whole mapping, as data.
+ *
+ * `as const satisfies Record<JobStatus, McpTaskState>` is what makes this exhaustive AT COMPILE
+ * TIME: add an eighth member to `JobStatus` and this object stops satisfying the record, so the
+ * build fails at the one place that has to make a decision about it. The alternative — a `switch`
+ * with a `default` — is the same table with a hole in it, and the hole answers `working` for a
+ * status nobody has thought about yet, which is the wrong answer precisely when it matters.
+ *
+ * Exported because the table IS the reconciliation D-12 asks to be pinned, and a later phase
+ * registering the extension will read it rather than restate it.
+ */
+declare const JOB_STATUS_TO_MCP_TASK_STATE: {
+    readonly queued: "working";
+    readonly authored: "working";
+    readonly bundling: "working";
+    readonly committing: "working";
+    readonly done: "completed";
+    readonly failed: "failed";
+    readonly cancelled: "cancelled";
+};
+/**
+ * What one job looks like to a remote poller.
+ *
+ * Field names are the wire's (`taskId`, `statusMessage`, `lastUpdatedAt`) rather than the job
+ * record's, because this record's whole purpose is to be handed OUT: naming it after the source
+ * would push the rename onto the registration, which is the step this seam exists to make trivial.
+ * `lastUpdatedAt` carries `Job.updatedAt` verbatim; only the label differs.
+ */
+interface McpTaskProjection {
+    readonly taskId: string;
+    readonly status: McpTaskState;
+    /** The job's own one-line summary. The only prose that crosses. */
+    readonly statusMessage: string;
+    readonly createdAt: string;
+    readonly lastUpdatedAt: string;
+}
+/**
+ * Project one job record into the task view.
+ *
+ * Total, pure, synchronous, and deliberately narrow. `attempts`, `kind`, `runRef` and
+ * `conclusionKind` are NOT carried, and their absence is asserted by an exact-key cell rather than
+ * left to be noticed: `attempts` is the retry discipline's private counter, and `conclusionKind` is
+ * internal vocabulary (`knowledge_skipped_draft`, `insufficient_model_output`) that means nothing to
+ * a caller outside this system. A projection that leaks the source record's shape is not a
+ * projection; it is the coupling with an extra step.
+ *
+ * NOTHING IS MASKED HERE, and that is a statement rather than an oversight. This function is called
+ * by nothing — it registers no handler and returns no result to any transport — so there is no
+ * output channel to mask. Whoever eventually registers it inherits the masking obligation every
+ * other handler in this package carries, because `statusMessage` is a job's own summary text and
+ * summaries are prose somebody may one day interpolate a resolved value into.
+ */
+declare function projectJobAsTask(job: Job): McpTaskProjection;
 
-export { AGENT_QA_SCHEMA_REFERENCES, type AgentQaMcpServerOptions, DEFAULT_MCP_HOST, DEFAULT_MCP_PATH, DEFAULT_MCP_PORT, type DefinitionValidationResult, type FailureCategory, type FailureClassification, type LocalMcpEndpoint, type LocalMcpEndpointConfig, type LocalMcpEndpointShape, type LocalMcpTransport, MCP_STDIO_STARTUP_MESSAGE, type McpHttpHandlerOptions, SCHEMA_REFERENCE_NAMES, type SchemaReferenceName, type StartMcpServerOptions, VALIDATION_KINDS, type ValidationIssue, type ValidationKind, classifyRunFailureFromDashboardData, createAgentQaMcpServer, createLocalMcpHttpHandler, createMcpServer, resolveDashboardApiUrl, resolveLocalMcpEndpoint, resolveMcpEndpointShape, startMcpServer, validateAgentQaDefinition };
+export { AGENT_QA_COMPOSED_CONTRACTS, AGENT_QA_MCP_INSTRUCTIONS, AGENT_QA_MCP_SERVER_VERSION, AGENT_QA_OP_CONTRACTS, AGENT_QA_TOOL_PROJECTIONS, APP_NEGOTIATION_CLIENT_CAPABILITIES_KEY, APP_RESOURCE_MIME_TYPE, APP_RESOURCE_NAME, APP_RESOURCE_URI_TEMPLATE, APP_WRAPPER_APP_NAME, APP_WRAPPER_APP_VERSION, APP_WRAPPER_CONNECTING_HINT, APP_WRAPPER_CONNECTING_MESSAGE, APP_WRAPPER_EXPIRED_HINT, APP_WRAPPER_EXPIRED_MESSAGE, APP_WRAPPER_LIVE_MESSAGE, APP_WRAPPER_LOAD_TIMEOUT_MS, APP_WRAPPER_PERMANENT_LINK_LABEL, APP_WRAPPER_RUN_ENDED_MESSAGE, APP_WRAPPER_STATES, APP_WRAPPER_UI_PROTOCOL_VERSION, APP_WRAPPER_UNREACHABLE_MESSAGE, type AgentQaMcpDepsResolver, type AgentQaMcpServerDeps, type AppReadContext, type AppResourceDeps, type AppResourceInvoke, AppResourceNegotiationError, AppResourceOriginSpanError, type AppResourceReadDeps, AppResourceReadError, type AppResourceRegistrar, AppResourceUriError, type AppWrapperInput, type AppWrapperMint, type AppWrapperState, DEGRADED_OUTPUT_CONTRACTS, JOB_STATUS_TO_MCP_TASK_STATE, type JsonDocument, LIVE_LINK_ABSENT_LINE, LIVE_LINK_NO_RUN_LINE, type LiveLinkSupplier, MCP_APPS_EXTENSION_ID, McpProjectionError, type McpTaskProjection, type McpTaskState, type OutputSchemaDegradation, type ProjectedOpSpec, type RegisterToolConfig, type ToolComposition, type ToolOpContracts, type ToolProjection, type ToolProjectionKind, UNPROJECTED_OPS, type UnprojectedOp, type V1MigrationArm, type V1ToolMigrationEntry, V1_TOOL_MIGRATION_MAP, advertisedContracts, appResourceUriFor, armWithoutDiscriminant, buildAgentQaMcpServer, compositionOf, createAgentQaMcpNodeHandler, createAppResourceReadHandler, foldArmFindings, liveLinkLine, liveLinkLineFor, liveRunLinkOf, maskedToolResult, negotiatedAppsExtension, parseAppUri, projectJobAsTask, registerAppResources, renderAppWrapperPage, stripRedundantObjectStamp, toRegisterToolConfig, withoutDialect, withoutLegacyResultWrap };