ai-capability-framework 1.1.0 → 1.1.2

package/CHANGELOG.md

@@ -4,6 +4,32 @@ All notable public changes to AI Capability Framework are documented here.
 
 ## Unreleased
 
+## 1.1.2 - 2026-10-26
+
+- Cleared the full development and optional-SDK dependency advisory backlog with
+  targeted compatible updates, including MCP/HTTP, test, documentation, source-map and
+  compression dependencies. Full-tree audits now accompany production audits.
+- Raised the optional MCP SDK minimum to 1.32.0 and tested 1.32.0 and 1.32.2 through
+  actual in-memory SDK clients. Corrected the private SDK bridge to convert JSON schemas
+  into SDK-supported schemas and describe the returned runtime envelope. Authorization,
+  approval requirements and commit exclusion are unchanged.
+- Preserved the 1.1.1 Zod and URI fixes. Existing consumer lockfiles need their own
+  targeted update and audit; see
+  [security update instructions](SECURITY.md#dependency-security-updates).
+  Lexical/native discovery still requires no optional SDK or model for retrieval.
+
+## 1.1.1 - 2026-10-26
+
+- Updated locked `fast-uri` to 3.1.9 and Zod to 4.6.7. The optional Zod peer now
+  requires 4.6.6 or newer, addressing URI normalization advisories and oversized
+  collection validation resource consumption. Lexical/native users do not need Zod.
+- Added weekly Dependabot npm update PRs for both packages, with manual review and CI
+  required. No automatic merge or publication is configured.
+- Added bounded dependency regressions and installed-consumer security checks. See
+  [consumer update instructions](SECURITY.md#dependency-security-updates): existing
+  application lockfiles require their own dependency refresh. Host input limits remain
+  necessary. Framework APIs, retrieval and authorization behavior are unchanged.
+
 ## 1.1.0 - 2026-10-17
 
 - Fixed the installed CLI's POSIX symlink entrypoint so `npx aicf` runs commands instead

package/SECURITY.md

@@ -41,6 +41,67 @@ redacted or removed to protect users.
 - MCP server integrations and caller-provided identity context.
 - Host policy, auth, storage, and provider adapter hooks.
 
+## Dependency Security Updates
+
+Version 1.1.2 updates the full repository dependency tree, including development tools
+and optional MCP/HTTP integrations. The optional MCP SDK now requires 1.32.0 or newer;
+the repository tests 1.32.0 and locks 1.32.2. Full and production audits run for both
+packages. The dependency updates preserve the existing runtime and discovery contracts.
+
+Version 1.1.1 raises the optional Zod minimum to 4.6.6 and updates the repository's
+locked Zod to 4.6.7 and `fast-uri` to 3.1.9. Zod's collection-validation issue can
+consume excessive memory; the `fast-uri` advisories concern URI normalization and
+reference handling. See the
+[Zod advisory](https://github.com/advisories/GHSA-mrhx-c7xc-m3w5) and
+[URI advisory](https://github.com/advisories/GHSA-w74x-v6f9-j3xg).
+
+Publishing a framework patch does not rewrite an application's existing lockfile. Update
+and verify your application dependencies:
+
+```sh
+npm install ai-capability-framework@1.1.2
+npm update fast-uri
+npm ls fast-uri zod
+npm audit
+```
+
+If your application already uses Zod, also update it:
+
+```sh
+npm install zod@^4.6.6
+```
+
+If your application uses MCP, update its existing SDK and compatible HTTP dependency
+resolutions, then inspect every nested resolution:
+
+```sh
+npm install @modelcontextprotocol/sdk@^1.32.2
+npm update proxy-addr hono @hono/node-server ip-address body-parser qs
+npm ls @modelcontextprotocol/sdk proxy-addr hono @hono/node-server ip-address body-parser qs
+npm audit
+```
+
+Verify that no old nested resolutions remain. Relevant security floors are `proxy-addr`
+2.0.8, Hono 4.13.11, Hono Node adapter 1.19.15, `ip-address` 10.7.4, `body-parser` 2.4.0
+and `qs` 6.16.1. A newer compatible parent may be required when a parent pins an
+affected version exactly. Keep host authentication, trusted-proxy configuration and
+request limits explicit; these updates do not configure them.
+
+Then repeat the dependency listing, audit and application tests. `npm update fast-uri`
+selects a compatible patched release within the installed dependency ranges; for the
+framework's current Ajv resolution this is 3.1.9. Do not use a forced major upgrade or
+assume a clean new installation repairs a different application's pinned dependency
+tree. Lexical/native discovery needs neither Zod nor an optional provider SDK.
+
+Maintain host request-size and collection limits. A patched validator does not turn an
+unbounded application schema into a bounded one.
+
+Dependabot monitors npm dependencies in both packages and proposes weekly version
+updates on Monday at 05:00 Europe/London. Security alerts and security-update PRs
+operate separately from that weekly schedule. Dependency PRs require review and passing
+CI; they do not merge or publish automatically. The existing weekly audit remains
+enabled.
+
 ## Public Safety
 
 Security fixes should preserve the repository boundary:

package/dist/mcp-server/sdk.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sdk.d.ts","sourceRoot":"","sources":["../../src/mcp-server/sdk.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAEV,2BAA2B,EAC3B,0BAA0B,EAC3B,MAAM,YAAY,CAAC;AAEpB,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,0BAA0B,CAAC,CA8BrC"}
+{"version":3,"file":"sdk.d.ts","sourceRoot":"","sources":["../../src/mcp-server/sdk.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAEV,2BAA2B,EAC3B,0BAA0B,EAC3B,MAAM,YAAY,CAAC;AAEpB,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,0BAA0B,CAAC,CAuCrC"}

package/dist/mcp-server/sdk.js

@@ -1,8 +1,18 @@
+import { loadOptionalProviderDependency } from "../providers/shared/optional-dependency.js";
 export async function registerAicfMcpTools(options) {
     const server = asMcpSdkServer(options.mcpServer);
     const list = await options.aicfServer.listTools(options.request ?? {});
+    const convertSchema = isProtocolBackedServer(options.mcpServer)
+        ? (await loadOptionalProviderDependency({
+            dependencyName: "zod",
+            provider: "mcp"
+        })).fromJSONSchema
+        : undefined;
+    // Convert the complete list before registration so unsupported schemas cannot
+    // leave a partially registered SDK server. Structural host adapters keep JSON Schema.
+    const configs = list.tools.map((tool) => toolConfig(tool, convertSchema));
     const toolNames = [];
-    for (const tool of list.tools) {
+    for (const [index, tool] of list.tools.entries()) {
         const handler = async (args, extra) => {
             return options.aicfServer.callTool({
                 ...(isRecord(options.request) ? options.request : {}),
@@ -15,7 +25,7 @@ export async function registerAicfMcpTools(options) {
             });
         };
         if (server.registerTool) {
-            server.registerTool(tool.name, toolConfig(tool), handler);
+            server.registerTool(tool.name, configs[index], handler);
         }
         else if (server.tool) {
             server.tool(tool.name, tool.description, tool.inputSchema, handler);
@@ -27,16 +37,39 @@ export async function registerAicfMcpTools(options) {
         toolNames
     };
 }
-function toolConfig(tool) {
+function toolConfig(tool, convertSchema) {
     return {
         _meta: tool._meta,
         annotations: tool.annotations,
         description: tool.description,
-        inputSchema: tool.inputSchema,
-        outputSchema: tool.outputSchema,
+        inputSchema: convertSchema ? convertSchema(tool.inputSchema) : tool.inputSchema,
+        // MCP structuredContent contains the runtime envelope, whose data is the
+        // manifest output. Validate that wire shape rather than the unwrapped data.
+        outputSchema: convertSchema && tool.outputSchema ? convertSchema({
+            type: "object",
+            properties: {
+                schemaVersion: { const: "1.0" },
+                capabilityId: { type: "string" },
+                capabilityVersion: { type: "string" },
+                operation: { enum: ["read", "prepare"] },
+                requestId: { type: "string" },
+                runId: { type: "string" },
+                status: { enum: ["success", "prepared", "approval_required", "denied", "failed", "unavailable", "validation_error"] },
+                data: tool.outputSchema
+            },
+            // Protocol errors use a minimal envelope without capability data or identity.
+            // The executor still validates successful data against the manifest schema.
+            required: ["schemaVersion", "status"],
+            additionalProperties: true
+        }) : tool.outputSchema,
         title: tool.title
     };
 }
+function isProtocolBackedServer(server) {
+    return isRecord(server) && isRecord(server.server)
+        && typeof server.server.setRequestHandler === "function"
+        && typeof server.connect === "function";
+}
 function asMcpSdkServer(server) {
     if (!isRecord(server)) {
         throw new Error("MCP SDK server must be an object.");

package/docs/mcp-server-runtime.md

@@ -66,6 +66,14 @@ remain authoritative.
 caller-provided MCP SDK server object that exposes `registerTool()` or `tool()`. It does
 not import MCP transports or create a long-running process.
 
+Use MCP SDK 1.32.0 or newer; 1.32.0 and 1.32.2 are tested with actual in-memory SDK
+clients. The helper converts JSON schemas for SDK registration and returns the runtime
+envelope as structured content. Registration captures a tool-list snapshot; refresh
+registration when the host changes scopes. Every call still rechecks current
+authorization, so an old registration cannot bypass a revoked permission. Refresh
+existing consumer lockfiles as described in the
+[security policy](../SECURITY.md#dependency-security-updates).
+
 ```ts
 await registerAicfMcpTools({
   aicfServer,

package/docs/release.md

@@ -15,9 +15,9 @@ live trials.
 Use a reviewed pull request, passing hosted Linux Node 20/22/24 checks, merge, and an
 exact-commit manual release dry-run before pushing the matching version tag. Local
 checks do not replace hosted checks. Prereleases publish both packages to `next`,
-preserving `latest` for prereleases. Stable 1.1.0 publishes to `latest` while preserving
-the existing `next` tag and prerelease versions. Verify normal installation as well as
-exact-version registry installs.
+preserving `latest` for prereleases. Stable releases publish to `latest` while
+preserving the existing `next` tag and prerelease versions. Verify normal installation
+as well as exact-version registry installs.
 
 The publication and dry-run workflows run `npm run check` plus certification with
 `VITEST_MAX_WORKERS=2`. Publication is serialized; registry failures fail closed unless
@@ -25,6 +25,13 @@ npm explicitly reports E404 for an absent version. Local npm login is not the OI
 publishing mechanism. Verify package ownership and the trusted publisher for both
 packages before tagging; never substitute a stored npm token.
 
+For dependency security patches, include the
+[consumer lockfile update instructions](../SECURITY.md#dependency-security-updates) and
+verify both an SDK-free consumer and the minimum supported optional peer version.
+Repository lockfile changes alone do not update existing applications. Retain the frozen
+discovery qualification evidence; dependency maintenance does not establish new
+model-quality results.
+
 ## Preflight
 
 - Confirm the release branch contains only public framework material.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai-capability-framework",
-  "version": "1.1.0",
+  "version": "1.1.2",
   "private": false,
   "description": "Provider-agnostic AI capability contracts, runtime controls, evals, and model/provider adapters.",
   "license": "MIT",
@@ -330,13 +330,13 @@
     "@google/genai": ">=2.8.0",
     "@langchain/core": ">=1.1.0 <2",
     "@langfuse/client": ">=5.4.1",
-    "@modelcontextprotocol/sdk": ">=1.29.0",
+    "@modelcontextprotocol/sdk": ">=1.32.0",
     "@openai/agents": ">=0.11.6",
     "@opentelemetry/api": ">=1.9.1",
     "ai": ">=6.0.0",
     "langchain": ">=1.4.0 <2",
     "openai": ">=4.0.0",
-    "zod": ">=4.4.3"
+    "zod": ">=4.6.6"
   },
   "peerDependenciesMeta": {
     "@aws-sdk/client-cloudwatch": {
@@ -402,14 +402,14 @@
     "@aws-sdk/client-kms": "^3.1061.0",
     "@aws-sdk/client-sfn": "^3.1061.0",
     "@aws-sdk/lib-dynamodb": "^3.1061.0",
-    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@modelcontextprotocol/sdk": "^1.32.2",
     "@openai/agents": "^0.11.6",
     "@types/node": "^24.12.4",
     "json-schema-to-typescript": "^15.0.4",
     "prettier": "^3.8.3",
     "typedoc": "^0.28.19",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.8",
-    "zod": "^4.4.3"
+    "vitest": "^4.1.12",
+    "zod": "^4.6.6"
   }
 }