@vostride/agent-qa-mcp 0.2.3 → 0.2.4

package/dist/index.d.ts

@@ -1,21 +1,8 @@
-import { StandardSchemaWithJSON, McpServer, McpRequestContext, CallToolResult, RequestMetaEnvelope, ResourceTemplate, ResourceMetadata, ReadResourceTemplateCallback, Variables, ReadResourceResult, ToolAnnotations } from '@modelcontextprotocol/server';
+import { McpServer, McpRequestContext, StandardSchemaWithJSON, CallToolResult, RequestMetaEnvelope, ResourceTemplate, ResourceMetadata, ReadResourceTemplateCallback, Variables, ReadResourceResult, ToolAnnotations } from '@modelcontextprotocol/server';
 import { FunctionRegistry } from '@vostride/agent-qa-agent';
-import { FunctionCaller, RiskActionDescriptor, Job } from '@vostride/agent-qa-schema';
+import { FunctionCaller, RiskActionDescriptor } from '@vostride/agent-qa-schema';
 import * as _modelcontextprotocol_node from '@modelcontextprotocol/node';
 
-/**
- * The tokenless dashboard live page for one run: `<base>/runs/<runId>/live` (D-08).
- *
- * TRAILING SLASHES ARE COLLAPSED rather than tolerated. An operator writing
- * `baseUrl: http://dash.internal/` is writing the same base as one who did not, and a `//` in the
- * middle of a path is a different path to some proxies — so the composition normalises instead of
- * producing two addresses for one dashboard.
- *
- * THE RUN ID IS PERCENT-ENCODED, which is a no-op for every id this system mints (`runIdSchema`
- * refuses any id the path layer would have to rewrite) and is written anyway: this function is
- * exported, and a caller composing a link for an id that came from somewhere else should not be the
- * one place a path segment escapes unencoded.
- */
 declare function liveRunLinkOf(base: string, runId: string): string;
 /**
  * The human-readable line a carrier result carries when a base exists.
@@ -30,33 +17,7 @@ declare function liveRunLinkOf(base: string, runId: string): string;
  * read as broken the moment the run ended, which is precisely when a person follows it.
  */
 declare function liveLinkLine(url: string): string;
-/**
- * What a carrier result says when no dashboard base exists ANYWHERE (RESEARCH Open Question 3).
- *
- * It names the config knob an operator sets to point this host at a dashboard (the 387 D-10
- * mechanism). It contains no URL — an absence that fabricated an address would be worse than no
- * line at all.
- */
 declare const LIVE_LINK_ABSENT_LINE = "no dashboard configured \u2014 set services.dashboard.baseUrl";
-/**
- * What a carrier result says when a dashboard base EXISTS but this result names no run to link to
- * (2026-09-01, Phase 408 plan 10, WR-03 · T-408-22).
- *
- * A SECOND NAMED ABSENCE, BECAUSE THERE ARE TWO DISTINCT FACTS. `carrierRunIdOf`
- * (`catalog.ts`) is DEFENSIVE ON BOTH ARMS by design and can honestly answer `undefined` — the
- * `runIdFrom: 'output'` arm reads an op's own result, which is a `RunStartAcknowledgement` today
- * and could be a fold's arm tomorrow, and the documented treatment of a shape it cannot read is a
- * named absence rather than a crash. Until this constant existed, that arm printed
- * `LIVE_LINK_ABSENT_LINE` — so a host that HAS `services.dashboard.baseUrl` set told the caller,
- * and the model reading the result, to set a value already set and pointed at the wrong knob. That
- * is a FALSE STATEMENT on a model-readable channel in a milestone whose law is honest absence, and
- * a wrong sentence is worse than a vague one because a model will act on it.
- *
- * IT NAMES NO CONFIG KNOB, deliberately: there is nothing for the operator to set. The dashboard is
- * configured; this particular result simply is not about a run. And it CONTAINS NO URL, the same
- * property `LIVE_LINK_ABSENT_LINE` above is held to — an absence that fabricated an address would
- * be the dishonesty this file exists to remove.
- */
 declare const LIVE_LINK_NO_RUN_LINE = "no run to link to \u2014 this result names no run id";
 /**
  * How a HOST answers "which dashboard is this process pointed at".
@@ -73,56 +34,75 @@ declare const LIVE_LINK_NO_RUN_LINE = "no run to link to \u2014 this result name
 interface LiveLinkSupplier {
     readonly dashboardBaseUrl: () => string | undefined;
 }
+declare function liveLinkLineFor(base: string | undefined, runId: string | undefined): string;
+
+declare const AGENT_QA_MCP_SERVER_VERSION = "2.0.0";
+/** What a host must supply to build a server for one caller. */
+interface AgentQaMcpServerDeps {
+    readonly registry: FunctionRegistry;
+    readonly caller: FunctionCaller;
+    readonly maskText: (text: string) => string;
+    readonly liveLink?: LiveLinkSupplier;
+}
+declare function buildAgentQaMcpServer(deps: AgentQaMcpServerDeps): McpServer;
+
+declare const AGENT_QA_MCP_INSTRUCTIONS: string;
+
+type AgentQaMcpDepsResolver = (ctx: McpRequestContext) => AgentQaMcpServerDeps;
+declare function createAgentQaMcpNodeHandler(resolveDeps: AgentQaMcpDepsResolver): _modelcontextprotocol_node.NodeMcpRequestHandler;
+
+/** A JSON-Schema document as it travels: an ordinary object, with nothing runnable on it. */
+type JsonDocument = Record<string, unknown>;
 /**
- * The one line a carrier result carries, given whatever the host's supplier answers.
+ * Drop `$schema`, which the SDK's conversion stamps and the registry's projection does not.
  *
- * COMPOSED HERE so the "base or named absence" decision has exactly one implementation. It is the
- * decision the whole file exists for, and a second copy of it — in the catalog, in a command, in a
- * later carrier — is the copy that fabricates a URL from an empty string.
+ * A DIALECT MARKER, not content: it says which JSON Schema draft the document speaks and describes
+ * nothing about the contract. Removing it is the one normalisation this file performs, and it is
+ * called out rather than buried because a normalisation that removed content would be the way to
+ * make a drift cell pass over real drift.
+ */
+declare function withoutDialect(document: unknown): JsonDocument;
+/**
+ * Drop the `type: "object"` the SDK stamps onto a COMPOSITION root.
  *
- * A BLANK BASE IS AN ABSENT BASE. A configured `baseUrl: ""` (or a whitespace-only one) is somebody
- * who has not pointed this host anywhere, and composing `"/runs/x/live"` from it would produce a
- * relative fragment that reads as a link in a transcript and resolves against nothing.
+ * The second and last normalisation, and it is as narrow as the first. `standardSchemaToJsonSchema`
+ * stamps `type: "object"` on a typeless root it can prove is object-shaped — a `oneOf` whose every
+ * member is `type: "object"`, which is exactly what a zod discriminated union emits. The SDK's own
+ * comment calls the stamp "redundant-but-valid", and a document is not changed by adding a
+ * constraint every one of its branches already imposes.
  *
- * THE GUARD ORDER IS THE FIX, NOT AN ACCIDENT (2026-09-01, plan 10, WR-03). The BASE is tested
- * first: with no base anywhere, "no dashboard configured" is the true and the more actionable
- * sentence whatever the run id is, so the both-absent case answers with the fact an operator can do
- * something about. Only with a base PRESENT does a missing run id become the fact worth naming, and
- * that arm answers `LIVE_LINK_NO_RUN_LINE`. Swapping these two lines back reinstates the false
- * sentence a configured host used to receive.
+ * IT IS GATED ON THE COMPOSITION KEYWORD, so a genuine `type` disagreement still reds: the only
+ * case dropped is a root that carries `oneOf`/`anyOf` AND the stamp, which is the one case the SDK
+ * manufactures. An ungated `delete document.type` would have made the whole drift cell blind to a
+ * contract whose root type actually moved.
  */
-declare function liveLinkLineFor(base: string | undefined, runId: string | undefined): string;
+declare function stripRedundantObjectStamp(document: JsonDocument): JsonDocument;
+/**
+ * One union arm of a fold's composed contract, with the fold's discriminant taken back out.
+ *
+ * `required: []` is DROPPED rather than kept, and the case is real rather than defensive:
+ * `config.undo.propose` takes an all-optional input, so its own projection carries no `required`
+ * key at all while the extended arm carries `['action']` — and removing the discriminant from that
+ * leaves an empty array where the other side has nothing. JSON Schema reads an absent `required`
+ * and an empty one identically, so the two documents agree; keeping the empty array would have
+ * failed the cell on a difference that describes no difference.
+ */
+declare function armWithoutDiscriminant(arm: JsonDocument, discriminant: string): JsonDocument;
+declare function foldArmFindings(listed: JsonDocument, discriminant: string, opId: string, own: JsonDocument): readonly string[];
+declare function withoutLegacyResultWrap(document: unknown): JsonDocument;
 
 /**
  * What a tool DOES, coarsely — the axis annotations are derived along (`projection.ts`).
  *
  * `read` answers; `workflow` changes something in the call (a test file, a run, knowledge,
- * configuration). `apply` is the sovereign mark door alone: since 432-12 (D-05/D-14) no tool files a
- * proposal and no tool asks for a confirmation, and `apply` names only the mark door, which lands a
- * mark's gold, evidence and fix in the call. Its credential check left with the MCP bearer
- * credential (432-21, D-12), so `apply` is now a name for that one door and gates nothing.
- *
- * KEPT, DATED 2026-10-02 (432-42 census decision): the member is not renamed. It is a published MCP
- * contract value (`mapping-bump-guard.test.ts` pins `kind: 'apply'` on `agent_qa_mark_run`, and the
- * projection derives annotations from it); no D-decision renames a published name here, and the
- * word now means "the mark door applies its fix in the call", which is true. It asks nothing.
+ * configuration). `apply` names the mark door, which records the mark and applies its fix in the
+ * call and asks nothing.
  */
 type ToolProjectionKind = 'read' | 'workflow' | 'apply';
-/**
- * How a tool's arms compose — DERIVED from the entry, never stated a second time on it.
- *
- * `single` is a 1:1 projection. `union` is D-01's declared fold: several sibling ops behind one
- * discriminated-union input, the arm selected by a literal. `pipeline` is D-02's one read door:
- * two ops invoked in sequence, the first one's answer choosing whether the second runs at all.
- *
- * A third field on the entry would have been a third thing to keep in step with the first two, and
- * the failure it would have hidden is a fold declared `single` — which registers a tool advertising
- * one arm's contract while the guard reports two arms and agrees with itself.
- */
 type ToolComposition = 'single' | 'union' | 'pipeline';
 /** One declared tool. */
 interface ToolProjection {
-    /** Curated `verb_noun` name per spec section 3.3 (D-04). The bump guard pins the exact list. */
+    /** Curated `verb_noun` name per spec section 3.3. */
     readonly name: string;
     /** The registry op ids this tool projects. Length 1 = 1:1; length > 1 = a declared fold. */
     readonly ops: readonly string[];
@@ -134,70 +114,14 @@ interface ToolProjection {
      * than assumed from `ops.length > 1`.
      */
     readonly discriminant?: string;
-    /**
-     * This tool CARRIES the live-view MCP App (2026-08-31, Phase 408 plan 01 · D-05 / MCPA-01).
-     *
-     * ITS PRESENCE IS THE SIGNAL, exactly as `discriminant`'s above is. A carrier is a tool whose
-     * declaration references the `ui://` App resource, so a host that negotiated the Apps extension
-     * can render the run's live view beside the result; a tool without this member references
-     * nothing, and `projection.ts` derives an ABSENT `_meta` for it rather than an empty one. Spelled
-     * per entry rather than inferred from a name, a kind or an op id, because the census that
-     * enumerates carriers reads THIS field — and a predicate over names would be a second, unwritten
-     * declaration of which doors reach a credential channel (the 399.1 lesson).
-     *
-     * `resource` names which `ui://` template the reference points at; one template exists today and
-     * the field is spelled anyway, so a second App is an added member here rather than a second
-     * meaning for a boolean.
-     *
-     * `runIdFrom` names where the CONCRETE runId for a per-call reference is found — on the call's
-     * input or in the op's own result. `agent_qa_start_run` answers a `RunStartAcknowledgement`
-     * carrying the id the run was given, so its reference is derivable only from the OUTPUT;
-     * `agent_qa_get_run_digest` is asked about a run by id, so its reference is derivable from the
-     * INPUT, which is what makes it the late-attach door (D-07).
-     *
-     * THE TASK-SHAPE QUESTION D-05 LEFT OPEN IS CLOSED, and closed by measurement rather than by
-     * preference: the task seam is dormant — "It registers nothing, advertises nothing and routes
-     * nothing" (task-seam.ts:21-23, and catalog.ts:34-36 states the matching absence) — so both
-     * carriers are plain tools answering immediate results, and there is no task completion or
-     * status poll for a reference to ride. (2026-08-31; the 2.0.0 core SDK has since grown the Tasks
-     * vocabulary, which makes the seam's own dated deferral stale at the SDK layer and changes
-     * nothing here: registering Tasks is not this phase's job.)
-     */
     readonly ui?: {
         readonly resource: 'live-run';
         readonly runIdFrom: 'input' | 'output';
     };
-    /**
-     * 2026-09-28 (431 D-05): the result-size hint, advertised as `_meta[MAX_RESULT_SIZE_META_KEY]`.
-     * Present only on reads whose one-shot answer can outgrow a host's default result budget.
-     */
     readonly maxResultSizeChars?: number;
 }
 /** The composition, read off the entry. See {@link ToolComposition}. */
 declare function compositionOf(projection: ToolProjection): ToolComposition;
-/**
- * The live input/output contracts of one projected op.
- *
- * WHY THIS TABLE EXISTS AT ALL, since it looks like a second declaration of something the registry
- * already knows. It is not: `FunctionSpec` — the record holding the LIVE validators — deliberately
- * never leaves the function layer's own directory (T-384-01 / T-384-14), and what a surface can see
- * through `registry.list(caller)` is a `FunctionDeclaration` whose `input`/`output` are already
- * INERT JSON-Schema projections. D-16 mechanic (a) needs the live Standard-Schema objects, so the
- * projection names them here, imported from the ONE module the ops themselves import them from.
- * Drift is therefore impossible in the only sense that matters: this is not a copy of the contract,
- * it is the same object, so the schema advertised in `tools/list` and the schema `invokeFunction`
- * validates with are one thing that cannot disagree.
- *
- * The alternative — `fromJsonSchema(declaration.output)` — was available and rejected: it is a
- * SECOND conversion recipe beside the SDK's own, and the anti-pattern this phase's research names
- * first is exactly two recipes for one conversion.
- *
- * The field type is the SDK's `StandardSchemaWithJSON` and NOT a zod type, which is the same
- * decision seen from the other side: this package's runtime dependency allow-list is exactly the
- * two protocol packages (D-20), so naming a validator library here — even in a type position, which
- * the dependency lint reads no differently — would reopen the collapse the phase exists to make.
- * A zod 4.4 schema satisfies the interface, which is the whole of what either side needs to know.
- */
 interface ToolOpContracts {
     readonly input: StandardSchemaWithJSON;
     readonly output: StandardSchemaWithJSON;
@@ -209,307 +133,25 @@ interface ToolOpContracts {
  * drift apart silently.
  */
 declare const AGENT_QA_OP_CONTRACTS: Readonly<Record<string, ToolOpContracts>>;
-/**
- * THE CATALOGUE. Twenty tools, and the bump guard pins this exact list by name and by op set.
- * (Sixteen until 2026-09-28, when 431 D-01 added the eight discovery reads; twenty-four until
- * 2026-09-30, when 432-12 removed the four proposal tools.)
- *
- * The read side is D-02: one universal entity door plus the reads a workflow needs mid-flight and
- * the 431 discovery reads. The write side changes things IN THE CALL (432 D-05/D-14): every
- * `workflow` entry writes what it names and answers what it changed, and nothing waits for a second
- * call. There is no apply tool, no `confirmed` input and no elicitation; the mark door is the one
- * `apply` entry, and since 432-21 (D-12) it checks no credential.
- *
- * WHY THERE IS NO PROPOSAL TOOL AT ALL. The inbox's verbs declared a human-origin requirement, so a
- * tool over either decision verb would have listed for every caller and refused every call; the
- * bump guard stated the rule generally until 432-39 deleted the field. 432-12 unprojected the whole
- * inbox and 432-17 deleted it, ops and all (re-spelled 2026-10-02, 432-42).
- */
 declare const AGENT_QA_TOOL_PROJECTIONS: readonly ToolProjection[];
-/**
- * Tool name -> the contract that tool ADVERTISES, where it is not simply its one op's contract.
- *
- * Exactly two reasons an entry exists here, and no third:
- *
- *  1. A UNION FOLD validates with the discriminated union of its arms' own DTOs, composed in
- *     `@vostride/agent-qa-schema` (see `functions/tool-folds.ts` for why it is composed there and
- *     not here). Its output is the union of the arms' own outputs, collapsed when they are one.
- *     Its input is listed as one object by `projection.ts` (2026-10-20, 446-11).
- *  2. THE PIPELINE advertises the FIRST op's contract on both sides: a caller hands `entities.resolve`
- *     the reference it has, and reads back the resolution union — a card, a small disambiguation
- *     set, or an honest miss. `entities.get` runs inside the resolved arm and contributes no shape
- *     of its own, which is why its contract is absent from the advertisement.
- *
- * 2026-10-01 (432-21, D-12): THE MARK DOOR'S ENTRY IS DELETED. It advertised the op's outcome OR the
- * credential refusal (419 D-20); the refusal left with the MCP bearer credential, so the door
- * advertises exactly its op's own contracts and needs no entry. (The D-11 apply envelope it once
- * carried, `proposal_id` and `confirmed`, went with the apply tools in 432-12, D-05/D-14.)
- */
 declare const AGENT_QA_COMPOSED_CONTRACTS: Readonly<Record<string, ToolOpContracts>>;
 /** The contract a tool advertises: its composition when it has one, its one op's otherwise. */
 declare function advertisedContracts(projection: ToolProjection): ToolOpContracts | undefined;
-/**
- * A tool whose advertised OUTPUT cannot be represented as JSON Schema, and therefore ships with no
- * `outputSchema` at all (2026-08-16, D-16's explicit-degradation clause).
- *
- * MEASURED, NOT PREDICTED. `tools/list` converts every `outputSchema` in zod's OUTPUT mode
- * (`mcp-DXXb3Vv3.mjs:1391`, uncaught), and a contract built over a branded id — `z.string()
- * .transform(asRunId)` — makes that conversion throw `Transforms cannot be represented in JSON
- * Schema`. The consequence is not a poorer listing for one tool: the throw takes the WHOLE
- * `tools/list` response down for every caller who can see the tool. Phase 384 hit the same wall from
- * the other side and answered it by projecting both sides in input mode (`declaration-projection.ts`).
- *
- * WHY OMISSION RATHER THAN A SECOND CONVERSION. Advertising the INPUT-mode document as the output
- * would have worked and been a lie of exactly the kind D-16 forbids: a schema derived by a second
- * recipe, no longer the object `invokeFunction` validates with, presented as though it were. What a
- * caller gets instead is `content` plus `structuredContent` and no advertised shape — less, and
- * true. `validateToolOutput` skips a tool with no `outputSchema`, so the result still flows.
- *
- * THE LIST IS TWO-SIDED. `projection.ts` PROBES the conversion for every tool: an undeclared
- * failure throws, and a declared entry whose contract has since become convertible throws too. So
- * this list cannot silently grow and cannot silently rot.
- *
- * 2026-09-28 (431-03): the way off this list is a canonical `OutputContract` from
- * `@vostride/agent-qa-schema` — the op's own runtime schema as validator, with an explicit output
- * document — never a narrowed stand-in authored here. `agent_qa_start_run` keeps its row.
- */
 interface OutputSchemaDegradation {
     readonly tool: string;
     readonly opId: string;
     /** The schema symbol whose transform the converter refused, for a reader chasing the cause. */
     readonly schema: string;
-    /** The converter's own message, verbatim as measured on 2026-08-16. */
+    /** The converter's own message, verbatim. */
     readonly measured: string;
-    readonly adjudication: '397';
 }
 declare const DEGRADED_OUTPUT_CONTRACTS: readonly OutputSchemaDegradation[];
-/**
- * A registry op that this surface deliberately does NOT project, and why (2026-08-16 · D-03/D-15).
- *
- * THE DATED SCOPING NOTE IS THIS TABLE, not a comment beside it. 397's parity suite ranges over the
- * projected set, and a suite that scoped itself to whatever happened to be in the mapping would be
- * discovering an accident rather than honouring a decision. Every op the registry declares appears
- * either above or here — the bump guard asserts that partition against the registry's own
- * enumeration, so a new op cannot land undispositioned.
- *
- * `agent.ask` LEADS THE LIST because its exclusion is the one with a decision behind it (D-03).
- * Projecting the agent's own turn entry over MCP is nested-agent delegation: a caller's tool call
- * would spend this project's model tokens, take the lease the local host holds, and stream through a
- * channel a single `tools/call` round trip has no shape for — four independent reasons, and no MCPS
- * requirement asking for any of them. It is deferred as its own seam rather than left out by
- * oversight, and the deferral is dated so a later reader can tell the two apart.
- *
- * The rest are D-02's line — this surface carries the reads a workflow needs MID-FLIGHT and not the
- * whole catalogue — and the two ops that cannot serve an agent-origin caller at all.
- */
 interface UnprojectedOp {
     readonly opId: string;
     readonly reason: string;
-    /**
-     * Who decided this absence is not a gap.
-     *
-     * 397 for every op that existed when 397's parity walk ruled the whole register (D-15). WIDENED
-     * to admit `'398'` on 2026-08-17 for `agent.explain`, and the widening is the honest move rather
-     * than a convenience: 397 could not have adjudicated an op that did not exist, and stamping this
-     * one `'397'` to keep a literal green would have made the field record a ruling nobody made — the
-     * one thing a provenance column is for. The vocabulary is a CLOSED set and the bump guard pins
-     * which entries carry which adjudicator by name, so it cannot widen again by habit.
-     *
-     * 405-05 adds `runs.artifact` under the SAME `'405'` stamp on the same day and by the same
-     * ruling; the vocabulary does not widen for it.
-     *
-     * WIDENED AGAIN on 2026-08-27 (405-01, D-03) for `runs.detail`, on exactly the 398 and 403
-     * reasoning and for no new one: 397 could not have ruled on an op registered eight phases
-     * later. The bump guard names which entry carries this adjudicator, in both directions, so an
-     * entry stamped `'405'` because it was easier reds there rather than joining a set that has
-     * quietly become "any phase number".
-     *
-     * WIDENED AGAIN on 2026-08-29 (407-01, D-05) for `runs.knowledge`, on exactly that reasoning and
-     * for no new one: 397 could not have ruled on an op registered ten phases later. Membership is
-     * still spelled by op id in the bump guard, in both directions.
-     *
-     * RE-STAMPED on 2026-08-31 (408 D-01): `'403'` LEAVES this vocabulary and `'408'` enters. This is
-     * not a widening and not a rename — it is the provenance moving with the ruling. `runs.liveurl`
-     * was the ONLY `'403'` entry, and its 403 stamp recorded a DEFERRAL ("Phase 408's question");
-     * 408 D-01 answered that question, so the phase that decided this absence is now 408 and saying
-     * `'403'` would credit 403 with a ruling it explicitly declined to make. Leaving `'403'` in a
-     * closed set with no member would also be exactly the empty literal the bump guard's
-     * non-vacuity check passes silently over, which is the hole that check exists to close.
-     */
-    readonly adjudication: UnprojectedAdjudication;
 }
-/** The closed adjudicator vocabulary as a runtime tuple; the type above is derived from it. */
-declare const UNPROJECTED_ADJUDICATIONS: readonly ["397", "398", "405", "408", "428"];
-type UnprojectedAdjudication = (typeof UNPROJECTED_ADJUDICATIONS)[number];
 declare const UNPROJECTED_OPS: readonly UnprojectedOp[];
 
-/** Which of D-13's three closed answers a retired v1 name gets. */
-type V1MigrationArm = 'renamed-to' | 'retired' | 'pending';
-/** One retired v1 tool name and its ruled disposition. */
-interface V1ToolMigrationEntry {
-    /** The v1 tool name, verbatim from the inventory's tool table. */
-    readonly v1Name: string;
-    readonly arm: V1MigrationArm;
-    /** The live v2 tool that carries this capability. Present ONLY on `renamed-to`. */
-    readonly v2Tool?: string;
-    /** The inventory's ruled reason, dated. Never empty. */
-    readonly note: string;
-    /** What to call instead. Present on `retired` and `pending`; a `renamed-to` row's route is its tool. */
-    readonly route?: string;
-    /** The milestone that owns the absence. Present ONLY on `pending`. */
-    readonly owner?: string;
-}
-/**
- * THE MAP. One entry per v1 tool, in the inventory's original row order.
- *
- * The order is the inventory's rather than alphabetical, and the bump guard pins the SORTED set
- * separately — order is a reading convenience here and a pinned fact nowhere, which is why nothing
- * below depends on it.
- */
-declare const V1_TOOL_MIGRATION_MAP: readonly V1ToolMigrationEntry[];
-
-/**
- * The version this server reports.
- *
- * A constant here and NOT the package version read off disk: reading `package.json` at runtime is a
- * host capability this package does not have and must not acquire (its runtime dependency allow-list
- * is the two protocol packages, D-20). Plan 05 decides whether the host should pass its own version
- * in, which is the only place that fact honestly lives.
- */
-declare const AGENT_QA_MCP_SERVER_VERSION = "2.0.0";
-/** What a host must supply to build a server for one caller. */
-interface AgentQaMcpServerDeps {
-    /** The composed function registry. Built by the HOST, never by this package (D-09). */
-    readonly registry: FunctionRegistry;
-    /**
-     * WHO this server answers as. Minted by the composition root and passed through untouched to
-     * `invokeFunction`. Since 432-20 (D-12) nothing here reads it to decide what to list or serve;
-     * its `surface` and `origin` reach only the receipts that already consume them. Since 432-21 no
-     * field of it is a credential this package reads.
-     */
-    readonly caller: FunctionCaller;
-    /**
-     * How text leaving this process is masked (threat T-396-01).
-     *
-     * REQUIRED, not optional, and the reason is a measured one rather than a preference: the defect
-     * class this replaces (T-395-R5-10, closed in 395's final round) was a credential reaching an MCP
-     * caller verbatim through an error serialization. An optional masker is absent exactly where
-     * nobody thought to pass one, which is the same place the leak was found.
-     */
-    readonly maskText: (text: string) => string;
-    /**
-     * Which dashboard this process is pointed at, for D-08's permanent link (408 plan 03).
-     *
-     * OPTIONAL, AND ITS ABSENCE IS THE DEGENERATE CASE RATHER THAN A SECOND BRANCH: a host that
-     * supplies nothing and a supplier that answers `undefined` are the same fact — no dashboard is
-     * configured and none is running here — and both take the same path to the same named-absence
-     * line. There is no arm below that asks which of the two happened, deliberately: a distinction
-     * nothing acts on is a distinction that eventually acquires a wrong action.
-     *
-     * A FACTORY, NOT A STRING, because on the co-hosted composition the bound origin does not exist
-     * until a port has been bound — `commands/dashboard.ts` composes this host before it listens.
-     */
-    readonly liveLink?: LiveLinkSupplier;
-}
-/**
- * Build the server this caller sees.
- *
- * The listing is read through `registry.list(deps.caller)` — the registry's own view of itself for
- * this host — so `summary` and `risk` describe the composition in front of the caller rather than a
- * table in this package that could describe a different one. The view is the same for every caller
- * (432-20, D-12).
- */
-declare function buildAgentQaMcpServer(deps: AgentQaMcpServerDeps): McpServer;
-
-declare const AGENT_QA_MCP_INSTRUCTIONS: string;
-
-/**
- * How a host composes the server for one request.
- *
- * It takes the SDK's own construction context, so a per-request fact such as `era` arrives here
- * rather than being read back out of a header inside a tool handler. What it returns is the same
- * `deps` a stdio host composes, which is what keeps ONE `buildAgentQaMcpServer` shape across both
- * transports. 2026-10-02 (432-42, D-12): nothing about the caller decides what it may see; the
- * shipped host passes one fixed tokenless caller.
- */
-type AgentQaMcpDepsResolver = (ctx: McpRequestContext) => AgentQaMcpServerDeps;
-/**
- * A Node request handler serving this catalog over stateless streamable HTTP.
- *
- * The factory is re-run per request, which is the SDK's own model and not an inefficiency to route
- * around: a per-request instance is what makes a caller's tool set a property of that caller rather
- * than of whoever connected first, and it is why absence stays structural on this transport too.
- *
- * IT TAKES A RESOLVER AND NOT A FIXED `deps` (plan 05). 2026-10-02 (432-42, D-12/D-13): the
- * bearer check that once sat in front of this handler is deleted with MCP tokens (432-21); what
- * stays in front of it is the host's Host and Origin guard on the loopback listener. The resolver
- * receives the SDK context and builds the instance; it reads no header and verifies nothing.
- *
- * A host with one fixed caller passes `() => deps` — the static case is the degenerate resolver,
- * not a second signature to keep in step.
- */
-declare function createAgentQaMcpNodeHandler(resolveDeps: AgentQaMcpDepsResolver): _modelcontextprotocol_node.NodeMcpRequestHandler;
-
-/** A JSON-Schema document as it travels: an ordinary object, with nothing runnable on it. */
-type JsonDocument = Record<string, unknown>;
-/**
- * Drop `$schema`, which the SDK's conversion stamps and the registry's projection does not.
- *
- * A DIALECT MARKER, not content: it says which JSON Schema draft the document speaks and describes
- * nothing about the contract. Removing it is the one normalisation this file performs, and it is
- * called out rather than buried because a normalisation that removed content would be the way to
- * make a drift cell pass over real drift.
- */
-declare function withoutDialect(document: unknown): JsonDocument;
-/**
- * Drop the `type: "object"` the SDK stamps onto a COMPOSITION root.
- *
- * The second and last normalisation, and it is as narrow as the first. `standardSchemaToJsonSchema`
- * stamps `type: "object"` on a typeless root it can prove is object-shaped — a `oneOf` whose every
- * member is `type: "object"`, which is exactly what a zod discriminated union emits. The SDK's own
- * comment calls the stamp "redundant-but-valid", and a document is not changed by adding a
- * constraint every one of its branches already imposes.
- *
- * IT IS GATED ON THE COMPOSITION KEYWORD, so a genuine `type` disagreement still reds: the only
- * case dropped is a root that carries `oneOf`/`anyOf` AND the stamp, which is the one case the SDK
- * manufactures. An ungated `delete document.type` would have made the whole drift cell blind to a
- * contract whose root type actually moved.
- */
-declare function stripRedundantObjectStamp(document: JsonDocument): JsonDocument;
-/**
- * One union arm of a fold's composed contract, with the fold's discriminant taken back out.
- *
- * `required: []` is DROPPED rather than kept, and the case is real rather than defensive:
- * `config.undo.propose` takes an all-optional input, so its own projection carries no `required`
- * key at all while the extended arm carries `['action']` — and removing the discriminant from that
- * leaves an empty array where the other side has nothing. JSON Schema reads an absent `required`
- * and an empty one identically, so the two documents agree; keeping the empty array would have
- * failed the cell on a difference that describes no difference.
- */
-declare function armWithoutDiscriminant(arm: JsonDocument, discriminant: string): JsonDocument;
-/**
- * What a fold's one listed object leaves out of, or adds to, one arm's own contract.
- *
- * 2026-10-20 (446-11, D-25): a fold lists one object instead of its union, so an arm is no longer
- * a member to compare whole. It is covered when the `discriminant` enum names it, every field it
- * takes is listed with its own shape (the listing may add a description, never drop one), and the
- * listing requires nothing the arm does not. That a call is still validated arm by arm is the
- * C446-TOOL-SCHEMA counter-cell's claim, not this lens's.
- */
-declare function foldArmFindings(listed: JsonDocument, discriminant: string, opId: string, own: JsonDocument): readonly string[];
-/**
- * Undo the SEP-2106 legacy `{ result }` wrap the SDK's 2025-11-25 codec puts around a non-object
- * output root (2026-09-28, 431-03).
- *
- * A transport artifact, like the two stamps above: the 2026-07-28 codec advertises a list's array
- * root as-is, while the 2025-11-25 codec projects it to `{ type: 'object', properties: { result },
- * required: ['result'] }` and wraps `structuredContent` to match. Gated to exactly that document —
- * nothing but those three keys (and a dialect marker), one property named `result`, and a wrapped
- * root that is not itself an object — so an op whose real output is an object with a `result`
- * field is left alone. Apply it BEFORE `withoutDialect`: the wrapped root keeps its own `$schema`.
- */
-declare function withoutLegacyResultWrap(document: unknown): JsonDocument;
-
 /**
  * Mask once, and answer both channels from the one masked value.
  *
@@ -520,35 +162,11 @@ declare function withoutLegacyResultWrap(document: unknown): JsonDocument;
  */
 declare function maskedToolResult(output: unknown, maskText: (text: string) => string): CallToolResult;
 
-/**
- * The official MCP Apps extension id (spec revision 2026-01-26).
- *
- * RESTATED LOCALLY RATHER THAN IMPORTED, and the reason is a measured peer conflict:
- * `@modelcontextprotocol/ext-apps` declares `peerDependencies: { '@modelcontextprotocol/sdk':
- * '^1.29.0' }` — the v1 monolith — while this package ships the 2.0.0 split SDK, so importing its
- * `/server` entry would drag a second SDK generation into production (Pitfall 3). The string is
- * therefore ours, and Plan 06's census pins it against ext-apps' shipped schema so a typo'd
- * reverse-DNS id cannot fail silently as "never negotiated".
- */
 declare const MCP_APPS_EXTENSION_ID = "io.modelcontextprotocol/ui";
 /** The media type an App resource is served as. Restated locally for the reason above. */
 declare const APP_RESOURCE_MIME_TYPE = "text/html;profile=mcp-app";
 /** The published App address. ONE template, per run — the runId is the only variable. */
 declare const APP_RESOURCE_URI_TEMPLATE = "ui://agent-qa/live-run/{runId}";
-/**
- * The template EXPANDED for one concrete run (408 plan 03, D-05).
- *
- * WHY THIS IS A FUNCTION AND NOT A STRING EACH CALLER COMPOSES. `projection.ts` advertises the
- * TEMPLATE on a carrier tool's `_meta`, and a carrier RESULT advertises the concrete address of the
- * run it just named — two spellings of one address, in two files, that would be free to disagree
- * about the scheme, the namespace or the segment order. Expanding through the template constant
- * makes drift impossible: there is one place the address is written down and one rule for filling
- * it in.
- *
- * ENCODED WITH `encodeURIComponent`, which is the exact inverse of the `decodeURIComponent` the one
- * codec above applies — so `parseAppUri(appResourceUriFor(id)).runId === id` for every id, and an
- * address this package composes is one this package can read back.
- */
 declare function appResourceUriFor(runId: string): string;
 /** The registered resource name. Prefixed like the tools, so one namespace reads as one server. */
 declare const APP_RESOURCE_NAME = "agent_qa_live_run_app";
@@ -568,20 +186,6 @@ declare const APP_RESOURCE_NAME = "agent_qa_live_run_app";
 declare function parseAppUri(href: string): {
     readonly runId: string;
 } | undefined;
-/**
- * The envelope member carrying the request's declared client capabilities.
- *
- * MEASURED, NOT GUESSED, and re-exported from the SDK rather than restated as a literal so a
- * spelling drift is a compile error instead of a gate that silently answers "never negotiated".
- * The measurement (2026-08-31, `src/__tests__/app-negotiation.test.ts`) drove a real
- * `@modelcontextprotocol/client@2.0.0` against `createAgentQaMcpNodeHandler` over a loopback
- * socket and read the resource-read context back out of the handler:
- *
- *   ctx.mcpReq.envelope['io.modelcontextprotocol/clientCapabilities'].extensions['io.modelcontextprotocol/ui']
- *
- * That cell is the living record — it asserts the path against the wire, so an SDK that moves the
- * member reds it rather than quietly turning this gate into a blanket refusal.
- */
 declare const APP_NEGOTIATION_CLIENT_CAPABILITIES_KEY = "io.modelcontextprotocol/clientCapabilities";
 /**
  * The ONE member of the SDK's read context this module reads.
@@ -596,39 +200,7 @@ interface AppReadContext {
         readonly envelope?: Partial<RequestMetaEnvelope>;
     };
 }
-/**
- * Did THIS request declare the MCP Apps extension?
- *
- * FAIL-CLOSED at every step: no context, no envelope, no capabilities member, no `extensions`
- * record, or an `extensions` record without our id all answer `false`. The question is "is there
- * evidence this caller negotiated the extension", and absence of evidence is not evidence — which
- * matters most for the case the measurement surfaced, where a 2025-era caller carries no envelope
- * at all and would otherwise be waved through by a predicate written as "not explicitly absent".
- *
- * WHAT FAILING CLOSED HERE DOES AND DOES NOT PROTECT (dated 2026-09-01, 408 gap round, road
- * `demote` — the full ruling is in this file's header). The predicate is still fail-closed AS A
- * PREDICATE, and every clause above is unchanged. What is CORRECTED is the reading that failing
- * closed here protects the credential. It does not. The value read below is composed by the
- * caller in its own per-request `_meta` and forwarded by the SDK unauthenticated
- * (`_inputRequestCapabilityView` returns it verbatim; `checkInboundEnvelope` checks shape only),
- * so a `false` answer means "this caller did not SAY it can render an App" — a host-capability
- * fact — and never "this caller is not authorized to hold a live-view credential". What bounds
- * the credential is `bindingStatus === 'bound'` and the local network controls D-13 keeps; the
- * scope check that once sat beside it is deleted (432-20, D-12). See header clause 5.
- *
- * `RequestMetaEnvelope` is an intentionally EMPTY augmentable type in the shipped d.mts, so the
- * envelope is read through one narrow cast at this single seam rather than by widening the SDK's
- * types somewhere a second reader would have to find.
- */
 declare function negotiatedAppsExtension(ctx: AppReadContext | undefined): boolean;
-/**
- * A read refused because the request never declared the Apps extension (clause 3 of the ruling
- * in this file's header; D-09, T-408-01).
- *
- * IT NAMES THE EXTENSION AND CARRIES NOTHING ELSE. The message is authored prose plus a constant
- * this repository owns, so there is nothing caller-supplied in it to mask and — the point of the
- * whole arm — nothing minted in it to leak, because it is thrown before the first mint.
- */
 declare class AppResourceNegotiationError extends Error {
     constructor();
 }
@@ -636,37 +208,9 @@ declare class AppResourceNegotiationError extends Error {
 declare class AppResourceUriError extends Error {
     constructor(detail: string);
 }
-/**
- * A refusal from the App read that is NOT a run-liveness fact.
- *
- * Deliberately narrow: absence of a live session is rendered, never thrown (D-07), so anything that
- * reaches this class is a genuine failure of the read — a missing scope, an unknown op, a broken
- * composition — and it carries its message masked for the same reason `resources.ts`'s does.
- */
 declare class AppResourceReadError extends Error {
     constructor(message: string);
 }
-/**
- * A document whose panes would span more than one origin (IN-02, T-408-26; added 2026-09-01).
- *
- * THE INVARIANT THIS SERVES USED TO BE AN ASSUMPTION. The `_meta.ui.csp` block below was derived
- * from `mints[0]` alone, which is correct today only because `runs.liveurl` reads
- * `liveView.origin()` once per invocation — a fact held in ANOTHER package, which nothing on that
- * line checked. A composition that ever minted across origins would have shipped a frame allowance
- * covering the first pane and blocking every other one: a blank inner frame, which is the exact
- * failure this milestone exists to remove, arriving silently.
- *
- * WHY REFUSAL RATHER THAN A WIDER ALLOWANCE. Naming every origin in `frameDomains` would keep the
- * document renderable, but it would also make the allowance a function of how many panes happened
- * to be minted — precisely the "never broader than the document needs" property T-408-05 pins.
- * This module's own reasoning is that the allow is as narrow as the document needs; a document that
- * needs two origins is a composition this server does not know how to serve narrowly, and saying so
- * is honest absence rather than a silent widening.
- *
- * ITS MESSAGE CARRIES NO CALLER TEXT AND NO CREDENTIAL. The origins are host-composed and
- * `originOf` returns an origin only — never the path and never the fragment the token lives in — so
- * there is nothing here to mask and nothing here to leak.
- */
 declare class AppResourceOriginSpanError extends Error {
     constructor(origins: readonly string[]);
 }
@@ -676,19 +220,6 @@ interface AppResourceReadDeps {
     readonly invoke: AppResourceInvoke;
     /** How CALLER text leaving this handler is masked. Required — see the header's channel split. */
     readonly maskText: (text: string) => string;
-    /**
-     * Which dashboard this process is pointed at, for D-08's permanent link (408 plan 03).
-     *
-     * OPTIONAL, and its absence is a real posture rather than a gap: a composition that knows of no
-     * dashboard renders the wrapper with NO anchor at all, which is what plan 01 shipped and what the
-     * honest-absence law requires — a link to nothing is the dishonesty this milestone removes.
-     *
-     * THIS IS THE ONE SLOT WHOSE ABSENCE COSTS A PERSON SOMETHING, which is why it is wired rather
-     * than left where plan 01 left it: the wrapper's `expired` and `unreachable-origin` states are
-     * D-11's answers for "the embed cannot show you this", and both of them are supposed to hand a
-     * person the browser instead. A wrapper reaching those states with no link is a dead end wearing
-     * an honest sentence.
-     */
     readonly liveLink?: LiveLinkSupplier;
 }
 /**
@@ -698,20 +229,6 @@ interface AppResourceReadDeps {
  * observable independently of registration — the two halves fail in different directions.
  */
 declare function createAppResourceReadHandler(deps: AppResourceReadDeps): (uri: URL, variables: Variables, ctx: AppReadContext) => Promise<ReadResourceResult>;
-/**
- * The slice of `McpServer` this module uses.
- *
- * The same narrow structural type `resources.ts` declares, spelled with the SDK's own
- * `ResourceTemplate` / `ResourceMetadata` / `ReadResourceTemplateCallback` — so a cell can observe
- * the registration without assembling a protocol server while a real `McpServer` still satisfies
- * it. Read that module's note before narrowing any member here: a hand-narrowed config or a
- * `readonly` result array makes `McpServer` unassignable and the compiler names the wrong cause.
- *
- * THE READ CALLBACK IS THE SDK'S OWN `ReadResourceTemplateCallback` AND NOT A LOCAL NARROWING, for
- * the reason 408 plan 02 needed a third argument at all: the negotiation evidence arrives in the
- * SDK's read CONTEXT, so a slice that spelled the callback `(uri) => …` would have declared the
- * one parameter the gate reads out of existence.
- */
 interface AppResourceRegistrar {
     registerResource(name: string, template: ResourceTemplate, config: ResourceMetadata, read: ReadResourceTemplateCallback): unknown;
 }
@@ -720,113 +237,23 @@ interface AppResourceDeps {
     readonly registry: FunctionRegistry;
     readonly caller: FunctionCaller;
     readonly maskText: (text: string) => string;
-    /** D-08's base supplier, passed straight through to the read. See {@link AppResourceReadDeps}. */
     readonly liveLink?: LiveLinkSupplier;
 }
-/**
- * Register the App template when this composition can honestly serve it, and answer what it
- * registered.
- *
- * Returns the registered template URIs rather than nothing, for `resources.ts`'s reason: "registered
- * none" and "registered one" are the two halves of the claim, and a caller that had to inspect a
- * server to tell them apart could only ever test one of them.
- *
- * TWO CONDITIONS, BOTH READ OFF THE REGISTRY'S OWN DECLARATIONS (D-02/D-03), AND NEITHER ABOUT THE
- * CALLER (432-20, D-12 deleted the third, a `visibleToCaller` scope check):
- *
- *  1. Both ops this surface reads through — the mint and the roster read — are declared here. A
- *     composition that registered neither has no App to offer.
- *  2. The mint is BOUND in this composition. This is D-03's floor made structural: the standalone
- *     `agent-qa mcp` process composes no `liveView` port, so its `runs.liveurl` is declared-and-
- *     unbound and every mint there would refuse by name. Registering an App on that host would
- *     advertise an address whose every read is honestly empty — so it registers nothing at all,
- *     and the link-out is that host's whole answer. On a co-hosted composition the same three
- *     lines register it, by composition rather than by configuration.
- *
- * A composition that fails any of them gets NO template and NO error — the same answer `catalog.ts`
- * gives a tool whose op is missing, because refusing to build would take an entire MCP connection
- * down over one unavailable capability.
- */
 declare function registerAppResources(server: AppResourceRegistrar, deps: AppResourceDeps): readonly string[];
 
-/**
- * Every value `[data-app-state]` can take (D-11's closed set).
- *
- * Exported for the reason `LIVE_EMBED_STATES` is: the DOM cells range over this list, so a state
- * added to the page without a cell is a visible diff rather than an unobserved arm.
- */
 declare const APP_WRAPPER_STATES: readonly ["connecting", "live", "expired", "unreachable-origin", "run-ended"];
 type AppWrapperState = (typeof APP_WRAPPER_STATES)[number];
 /** What the page says while the inner frame has not painted yet. */
 declare const APP_WRAPPER_CONNECTING_MESSAGE = "connecting to the live view\u2026";
-/**
- * The second line under `connecting`, and the WHOLE of what an initial render says on a host that
- * never runs this document's script (WR-10, RESEARCH assumption A1; the cell is
- * `app-wrapper-dom.test.ts` cell (7)).
- *
- * Named for the same reason every other absence here is named: a document that says only that it is
- * connecting has made a promise its own script has to keep, and under a host CSP of
- * `script-src 'none'` there is no script to keep it. The sentence therefore points at the ONE
- * useful action available with no script at all — the permanent link rendered directly beneath it,
- * which is now markup rather than something the script assigns. One useful action, no apology.
- */
 declare const APP_WRAPPER_CONNECTING_HINT = "if the pane does not appear, open it in your browser";
 /** What the page says once the inner frame has loaded on an origin this host can reach. */
 declare const APP_WRAPPER_LIVE_MESSAGE = "live";
-/**
- * What an elapsed live link says (D-10).
- *
- * The wrapper's own sentence rather than the embed page's `link expired`, because the two are about
- * different things: the embed says its socket was refused, and this says the link this App was
- * rendered with has aged out.
- */
 declare const APP_WRAPPER_EXPIRED_MESSAGE = "live link expired";
-/**
- * The second half of the expired state, and the WHOLE of D-10's refresh story (D-10).
- *
- * There is no re-mint inside this sandbox and there is never going to be one — a UI-initiated mint
- * door was rejected precisely because its model-context hygiene is per-host behaviour nobody here
- * controls. What replaces it is this sentence: the way to a fresh token is another watch call, one
- * the person can simply ask for, and saying so is the difference between a dead end and a next
- * move. Separate from the message above so the DOM can show both and a cell can assert each.
- */
 declare const APP_WRAPPER_EXPIRED_HINT = "ask to watch again \u2014 a fresh watch mints a new link";
-/**
- * The REQUIRED unreachable-origin sentence (D-11), spelled EXACTLY as CONTEXT ratified it.
- *
- * A host running somewhere that cannot route to a loopback dashboard origin must say so and offer
- * the browser, never show a blank inner frame. This string is a contract: the DOM cells assert
- * against this constant, so the sentence and the assertion can never drift apart.
- */
 declare const APP_WRAPPER_UNREACHABLE_MESSAGE = "this host can't reach the live view \u2014 open it in your browser";
-/**
- * What a run with no live session on this host says (D-07).
- *
- * Not an error and not a blank frame — and it points at the way to see the run anyway, which is
- * the permanent link rendered directly beneath it. A run that has finished still HAPPENED, and the
- * dashboard's own page is where its history lives.
- */
 declare const APP_WRAPPER_RUN_ENDED_MESSAGE = "this run is not live \u2014 open it in your browser";
-/** The label on the permanent link-out slot, when one is composed (D-08). */
 declare const APP_WRAPPER_PERMANENT_LINK_LABEL = "open in your browser";
-/**
- * How long silence from the inner frame is allowed to last before it is named (D-11, T-408-08).
- *
- * Exported because the DOM cell must wait on the page's OWN bound rather than on a number a test
- * file guessed. Ten seconds is chosen against the two shapes this arm exists for: a black-holed
- * origin never answers at all, and a slow-but-reachable dashboard on loopback answers in
- * milliseconds — there is no realistic case in between, so a longer bound would only make a person
- * stare at a spinner for longer before reading the same sentence.
- */
 declare const APP_WRAPPER_LOAD_TIMEOUT_MS = 10000;
-/**
- * The MCP Apps protocol version this wrapper announces in its `ui/initialize` request.
- *
- * MEASURED, not guessed (408-06 Task 1): `@modelcontextprotocol/ext-apps@1.7.5` carries exactly
- * two protocol versions — `2025-11-21` and `2026-01-26` — and `2026-01-26` is the one its
- * `AppBridge` treats as latest. `ext-apps-constants.test.ts` pins the spelling against the
- * package's own shipped schema, so this literal cannot drift from the vocabulary in silence.
- */
 declare const APP_WRAPPER_UI_PROTOCOL_VERSION = "2026-01-26";
 /**
  * What this document calls itself to a host (`ui/initialize`'s required `appInfo`).
@@ -837,13 +264,6 @@ declare const APP_WRAPPER_UI_PROTOCOL_VERSION = "2026-01-26";
 declare const APP_WRAPPER_APP_NAME = "agent-qa-live-view";
 /** The wrapper's own version, bumped only when the handshake it performs changes. */
 declare const APP_WRAPPER_APP_VERSION = "1.0.0";
-/**
- * ONE minted view onto ONE member handle of the run.
- *
- * `liveUrl` carries its token in the FRAGMENT (403 D-04), so this value is the only place a live
- * credential exists on this page — it is written into the frame's `src` and nowhere else: not into
- * the document text, not into the picker's labels, not into any attribute a host serialises back.
- */
 interface AppWrapperMint {
     readonly handle: number;
     readonly liveUrl: string;
@@ -852,40 +272,15 @@ interface AppWrapperMint {
 }
 interface AppWrapperInput {
     readonly runId: string;
-    /** One mint per handle on the run's announced roster. Empty is the D-07 not-live case. */
     readonly mints: readonly AppWrapperMint[];
-    /** The tokenless dashboard page (D-08). `undefined` when no dashboard origin is composable. */
+    /** The tokenless dashboard page. `undefined` when no dashboard origin is composable. */
     readonly permanentLink: string | undefined;
     /** Whether this host holds a live session for the run at all. `false` renders `run-ended`. */
     readonly runLive: boolean;
-    /**
-     * The instant this document is being built, in ms-epoch (D-10).
-     *
-     * A PARAMETER rather than a `Date.now()` call, for the reason every clock in this repository is a
-     * port: the expiry arm is the one thing this renderer decides about time, and a cell that cannot
-     * choose "now" could only ever assert the arm it happened to land in. Defaults to the wall clock,
-     * so the read handler passes nothing and gets the honest answer.
-     */
     readonly now?: number;
 }
-/**
- * Render the App wrapper for one run.
- *
- * The whole document, every time — there is no partial render and no update path, because D-10's
- * answer to a stale App is a FRESH read that mints again rather than a credential machine inside
- * the sandbox.
- */
 declare function renderAppWrapperPage(input: AppWrapperInput): string;
 
-/**
- * Everything the derivation reads about ONE op, assembled by `catalog.ts`.
- *
- * The two halves come from two places on purpose. `summary` and `risk` are read
- * off the registry's own declaration for this host, so they describe the composition a caller is
- * actually talking to; `input` and `output` are the live contracts named by the mapping table,
- * because the registry deliberately publishes only inert projections of those (T-384-14). Nothing
- * in this record is authored by this package — it is two views of the op, joined by its id.
- */
 interface ProjectedOpSpec {
     readonly id: string;
     readonly summary: string;
@@ -905,46 +300,8 @@ interface RegisterToolConfig {
     readonly inputSchema: StandardSchemaWithJSON;
     readonly outputSchema?: StandardSchemaWithJSON;
     readonly annotations: ToolAnnotations;
-    /**
-     * The SDK's own extension slot, carrying the live-view App reference for a CARRIER tool
-     * (2026-08-31, Phase 408 plan 01 · D-05/D-09 · MCPA-01).
-     *
-     * OPTIONAL, and its absence is a decision in the same sense `outputSchema`'s is: a tool that
-     * declares no `ui` member gets no `_meta` KEY at all rather than a `_meta` whose `ui` is
-     * `undefined`, because the two are different documents on the wire and only the first is honest
-     * about a tool that references no App.
-     *
-     * WHAT IT IS ON THE LISTING CHANNEL: inert metadata. Extensions are bilateral opt-in, so a host
-     * that never negotiated `io.modelcontextprotocol/ui` ignores this field by definition — it acts
-     * on nothing here, which is what makes "the App attaches only when the host negotiated" true of
-     * every channel that ACTS without needing a listing that varies per connection (SEP-2567 removed
-     * that, and the per-request factory context carries no client capabilities to key one on). The
-     * channels that act are gated where the capabilities actually arrive: in request handling.
-     */
     readonly _meta?: Record<string, unknown>;
 }
-/**
- * Derive one tool's `registerTool` config.
- *
- * `advertised` is passed IN rather than looked up here so this module stays a derivation over
- * values: `catalog.ts` owns the join between the mapping's data and this host's registry, and a
- * second lookup inside the derivation would be a second chance for the two to disagree.
- *
- * `maskText` is a REQUIRED parameter and covers the DERIVED prose. The reason is the fresh wound
- * this phase inherits: 395 closed a high-severity defect where a credential reached an MCP caller
- * through a serialization nobody had thought of as an output channel. A description is composed
- * from op summaries, and a summary is prose somebody may one day interpolate a resolved value into;
- * routing it through the masker costs nothing on the ordinary path and closes the channel
- * structurally rather than by remembering. Optionality is the failure mode here — an optional
- * masker is a masker that is absent exactly where nobody looked — so the parameter has no default
- * and the type refuses a call that omits it.
- *
- * TWO THINGS ARE DELIBERATELY NOT MASKED, and both would be damage rather than safety. The `title`
- * is the curated tool NAME from the mapping table: a declared constant in this repository's own
- * source, never data, and a masker that rewrote it would rename the tool a caller must call. The
- * SCHEMAS are contracts rather than text — masking one would corrupt the very object
- * `invokeFunction` validates against, and they carry field names and types, not values.
- */
 declare function toRegisterToolConfig(projection: ToolProjection, specs: readonly ProjectedOpSpec[], advertised: ToolOpContracts, maskText: (text: string) => string): RegisterToolConfig;
 /** A projection that cannot be derived honestly, named with the tool it is about. */
 declare class McpProjectionError extends Error {
@@ -952,68 +309,4 @@ declare class McpProjectionError extends Error {
     constructor(toolName: string, detail: string);
 }
 
-/**
- * The MCP task states this projection can produce.
- *
- * Four of the wire's five. The fifth, `input_required`, is deliberately absent from the table
- * below and NOT from this union: it is a real state of the protocol that no agent-qa job status
- * currently means, and a future status that did mean it should be able to say so by adding one row
- * rather than by widening a type.
- */
-type McpTaskState = 'working' | 'input_required' | 'completed' | 'failed' | 'cancelled';
-/**
- * The whole mapping, as data.
- *
- * `as const satisfies Record<JobStatus, McpTaskState>` is what makes this exhaustive AT COMPILE
- * TIME: add an eighth member to `JobStatus` and this object stops satisfying the record, so the
- * build fails at the one place that has to make a decision about it. The alternative — a `switch`
- * with a `default` — is the same table with a hole in it, and the hole answers `working` for a
- * status nobody has thought about yet, which is the wrong answer precisely when it matters.
- *
- * Exported because the table IS the reconciliation D-12 asks to be pinned, and a later phase
- * registering the extension will read it rather than restate it.
- */
-declare const JOB_STATUS_TO_MCP_TASK_STATE: {
-    readonly queued: "working";
-    readonly authored: "working";
-    readonly bundling: "working";
-    readonly committing: "working";
-    readonly done: "completed";
-    readonly failed: "failed";
-    readonly cancelled: "cancelled";
-};
-/**
- * What one job looks like to a remote poller.
- *
- * Field names are the wire's (`taskId`, `statusMessage`, `lastUpdatedAt`) rather than the job
- * record's, because this record's whole purpose is to be handed OUT: naming it after the source
- * would push the rename onto the registration, which is the step this seam exists to make trivial.
- * `lastUpdatedAt` carries `Job.updatedAt` verbatim; only the label differs.
- */
-interface McpTaskProjection {
-    readonly taskId: string;
-    readonly status: McpTaskState;
-    /** The job's own one-line summary. The only prose that crosses. */
-    readonly statusMessage: string;
-    readonly createdAt: string;
-    readonly lastUpdatedAt: string;
-}
-/**
- * Project one job record into the task view.
- *
- * Total, pure, synchronous, and deliberately narrow. `attempts`, `kind`, `runRef` and
- * `conclusionKind` are NOT carried, and their absence is asserted by an exact-key cell rather than
- * left to be noticed: `attempts` is the retry discipline's private counter, and `conclusionKind` is
- * internal vocabulary (`knowledge_skipped_draft`, `insufficient_model_output`) that means nothing to
- * a caller outside this system. A projection that leaks the source record's shape is not a
- * projection; it is the coupling with an extra step.
- *
- * NOTHING IS MASKED HERE, and that is a statement rather than an oversight. This function is called
- * by nothing — it registers no handler and returns no result to any transport — so there is no
- * output channel to mask. Whoever eventually registers it inherits the masking obligation every
- * other handler in this package carries, because `statusMessage` is a job's own summary text and
- * summaries are prose somebody may one day interpolate a resolved value into.
- */
-declare function projectJobAsTask(job: Job): McpTaskProjection;
-
-export { AGENT_QA_COMPOSED_CONTRACTS, AGENT_QA_MCP_INSTRUCTIONS, AGENT_QA_MCP_SERVER_VERSION, AGENT_QA_OP_CONTRACTS, AGENT_QA_TOOL_PROJECTIONS, APP_NEGOTIATION_CLIENT_CAPABILITIES_KEY, APP_RESOURCE_MIME_TYPE, APP_RESOURCE_NAME, APP_RESOURCE_URI_TEMPLATE, APP_WRAPPER_APP_NAME, APP_WRAPPER_APP_VERSION, APP_WRAPPER_CONNECTING_HINT, APP_WRAPPER_CONNECTING_MESSAGE, APP_WRAPPER_EXPIRED_HINT, APP_WRAPPER_EXPIRED_MESSAGE, APP_WRAPPER_LIVE_MESSAGE, APP_WRAPPER_LOAD_TIMEOUT_MS, APP_WRAPPER_PERMANENT_LINK_LABEL, APP_WRAPPER_RUN_ENDED_MESSAGE, APP_WRAPPER_STATES, APP_WRAPPER_UI_PROTOCOL_VERSION, APP_WRAPPER_UNREACHABLE_MESSAGE, type AgentQaMcpDepsResolver, type AgentQaMcpServerDeps, type AppReadContext, type AppResourceDeps, type AppResourceInvoke, AppResourceNegotiationError, AppResourceOriginSpanError, type AppResourceReadDeps, AppResourceReadError, type AppResourceRegistrar, AppResourceUriError, type AppWrapperInput, type AppWrapperMint, type AppWrapperState, DEGRADED_OUTPUT_CONTRACTS, JOB_STATUS_TO_MCP_TASK_STATE, type JsonDocument, LIVE_LINK_ABSENT_LINE, LIVE_LINK_NO_RUN_LINE, type LiveLinkSupplier, MCP_APPS_EXTENSION_ID, McpProjectionError, type McpTaskProjection, type McpTaskState, type OutputSchemaDegradation, type ProjectedOpSpec, type RegisterToolConfig, type ToolComposition, type ToolOpContracts, type ToolProjection, type ToolProjectionKind, UNPROJECTED_OPS, type UnprojectedOp, type V1MigrationArm, type V1ToolMigrationEntry, V1_TOOL_MIGRATION_MAP, advertisedContracts, appResourceUriFor, armWithoutDiscriminant, buildAgentQaMcpServer, compositionOf, createAgentQaMcpNodeHandler, createAppResourceReadHandler, foldArmFindings, liveLinkLine, liveLinkLineFor, liveRunLinkOf, maskedToolResult, negotiatedAppsExtension, parseAppUri, projectJobAsTask, registerAppResources, renderAppWrapperPage, stripRedundantObjectStamp, toRegisterToolConfig, withoutDialect, withoutLegacyResultWrap };
+export { AGENT_QA_COMPOSED_CONTRACTS, AGENT_QA_MCP_INSTRUCTIONS, AGENT_QA_MCP_SERVER_VERSION, AGENT_QA_OP_CONTRACTS, AGENT_QA_TOOL_PROJECTIONS, APP_NEGOTIATION_CLIENT_CAPABILITIES_KEY, APP_RESOURCE_MIME_TYPE, APP_RESOURCE_NAME, APP_RESOURCE_URI_TEMPLATE, APP_WRAPPER_APP_NAME, APP_WRAPPER_APP_VERSION, APP_WRAPPER_CONNECTING_HINT, APP_WRAPPER_CONNECTING_MESSAGE, APP_WRAPPER_EXPIRED_HINT, APP_WRAPPER_EXPIRED_MESSAGE, APP_WRAPPER_LIVE_MESSAGE, APP_WRAPPER_LOAD_TIMEOUT_MS, APP_WRAPPER_PERMANENT_LINK_LABEL, APP_WRAPPER_RUN_ENDED_MESSAGE, APP_WRAPPER_STATES, APP_WRAPPER_UI_PROTOCOL_VERSION, APP_WRAPPER_UNREACHABLE_MESSAGE, type AgentQaMcpDepsResolver, type AgentQaMcpServerDeps, type AppReadContext, type AppResourceDeps, type AppResourceInvoke, AppResourceNegotiationError, AppResourceOriginSpanError, type AppResourceReadDeps, AppResourceReadError, type AppResourceRegistrar, AppResourceUriError, type AppWrapperInput, type AppWrapperMint, type AppWrapperState, DEGRADED_OUTPUT_CONTRACTS, type JsonDocument, LIVE_LINK_ABSENT_LINE, LIVE_LINK_NO_RUN_LINE, type LiveLinkSupplier, MCP_APPS_EXTENSION_ID, McpProjectionError, type OutputSchemaDegradation, type ProjectedOpSpec, type RegisterToolConfig, type ToolComposition, type ToolOpContracts, type ToolProjection, type ToolProjectionKind, UNPROJECTED_OPS, type UnprojectedOp, advertisedContracts, appResourceUriFor, armWithoutDiscriminant, buildAgentQaMcpServer, compositionOf, createAgentQaMcpNodeHandler, createAppResourceReadHandler, foldArmFindings, liveLinkLine, liveLinkLineFor, liveRunLinkOf, maskedToolResult, negotiatedAppsExtension, parseAppUri, registerAppResources, renderAppWrapperPage, stripRedundantObjectStamp, toRegisterToolConfig, withoutDialect, withoutLegacyResultWrap };