ast-mcp-server 0.13.1 → 0.14.1

package/CHANGELOG.md

@@ -6,18 +6,40 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
-## [0.13.1] - 2026-09-01
+## [0.14.1] — not yet published (2026-10-26)
+
+### Security
+
+- Deduplicated `zod` in the lockfile to the patched `4.6.7` (GHSA-mrhx-c7xc-m3w5). The `@modelcontextprotocol/sdk` range `^3.25 || ^4.0` had kept a second, vulnerable `4.4.3` copy beside the direct dependency; `yarn audit` did not report it. No runtime code or advertised tool contract changes.
+
+## [0.14.0] — published to `latest` and `next`, registry verified (2026-10-25)
+
+### Changed
+
+- Migrated schema validation to Zod 4 (`^4.6.7`). The published `tools/list` contract changes shape and Zod's validation error messages differ: tool input schemas no longer all declare `additionalProperties: false` (16 of 16 before, 1 of 16 now), shared `$ref` definitions are inlined (27 before, 0 now), the serialized `tools/list` grows from 100,923 to 126,562 bytes, integer fields declare a maximum of 9007199254740991, and UUID fields gain a `pattern`. Clients that cache or diff the advertised schemas should refresh them.
+
+### Security
+
+- Upgraded `@modelcontextprotocol/sdk` to `^1.32.1` (GHSA-6qxp-vccf-f47h), `body-parser` to 2.4.0, and `zod` to 4.6.7 for the memory-exhaustion advisory, and raised the `hono` and `fast-uri` resolutions to 4.13.13 and 3.1.9. `yarn audit` reports no suggestions.
+
+### Release status
+
+- npm published immutable `0.14.0` bytes with integrity `sha512-+g1GpmB9ZMd4tB/z7o75AZ4LdnqEn+MQDiRh0LDBV2j4xb9iKB8XMoiME47tW0u2HgfxWsKtQBChGxfnrz3dVw==`. Public-registry verification passed; `latest` and `next` both resolve to `0.14.0`; and npm `gitHead`, the annotated `v0.14.0` tag, and the GitHub Release target exact commit `f6e64751398f69eb3f0f1abc808f4221f7d2bc52`.
+- Publish run `40232707904` reported its readback as ambiguous because of registry lag although npm had accepted the version; verification `40249874010` and promotion `40255528749` are green and authoritative.
+
+## [0.13.1] — published to `latest` and `next`, registry verified (2026-09-01)
 
 ### Fixed
 
-- The DeepSeek Harness adapter now opts into a bounded canonical-JSON text projection when a successful MCP result has structured data but no ordinary text, preserving lossless `structuredContent` while making native Agent/Session results useful and durable. The mandatory pinned-host smoke freezes the public 0.13.0 RED baseline and verifies the corrected candidate across the next model request, persisted `tool/result`, cold replay, guarded catalog, and cleanup readback.
-- `ast_explore` now publishes its complete object input schema while retaining all cross-field runtime rejection, and `ast_get_impact` no longer advertises one false output shape across JSON and TOON. The pinned Harness gate binds the public empty-schema RED to candidate registry/native parity and unchanged hashes for the other 14 model schemas.
+- The DeepSeek Harness adapter now opts into a bounded canonical-JSON text projection when a successful MCP result has structured data but no ordinary text, preserving lossless `structuredContent` while making native Agent/Session results useful and durable. The mandatory pinned-host smoke freezes the public 0.13.0 RED baseline and verifies the released correction across the next model request, persisted `tool/result`, cold replay, guarded catalog, and cleanup readback.
+- `ast_explore` now publishes its complete object input schema while retaining all cross-field runtime rejection, and `ast_get_impact` no longer advertises one false output shape across JSON and TOON. The pinned Harness gate binds the public empty-schema RED to released registry/native parity and unchanged hashes for the other 14 model schemas.
 - Timeout ownership is now explicit across the Harness, queue, and AST worker: the shipped outer timeout exceeds the complete queue/execution/margin budget, deterministic slow work returns bounded AST-owned operational errors, queued work never starts after its deadline, cancellation remains correlated across worker generations, and cleanup proves zero active work, held requests, listeners, or owned processes.
 - Harness lifecycle handling now converges deterministically through MCP removal and reconnect, rejects retired-generation effects, preserves AST `REQUEST_CANCELLED` authority separately from bridge transport observations, and completes correlated shutdown without residual state. The pinned native and rendered-GUI gates verify the `15→0→15` catalog sequence, request/header identity, secret-safe diagnostics, and ordered cleanup that still runs every owner check after an earlier cleanup failure.
 
 ### Release status
 
-- This is the reviewed `0.13.1` release candidate. Publication to npm `next`, public-registry verification, promotion to `latest`, tagging, and GitHub Release creation remain pending and are not claimed here.
+- npm published immutable `0.13.1` bytes with integrity `sha512-jqgGoYs8fe7J+E25lZusLK4wV6sjM5n5qiWnfe1RJIxOFo1r5nbtcBr1a/fdSWTYf/37bUNkshQp86UrdBHOsA==`. Public-registry verification passed; `latest` and `next` both resolve to `0.13.1`; and npm `gitHead`, the annotated `v0.13.1` tag, and the GitHub Release target exact commit `27b80a3da169b473a3b5c5dfea69ed52903ed4c7`.
+- Main CI `33460585683`, Security `33460585625`, publish `33461292810`, verification `33461385440`, and promotion retry `33461651288` are green. Initial promotion run `33461571363` changed `latest` successfully but its bounded readback timed out; the verified idempotent retry is authoritative.
 
 ## [0.13.0] — published to `latest` and `next`, registry verified (2026-08-29)
 

package/README.md

@@ -46,8 +46,8 @@ Reads can start with a bounded file slice, a compact outline, or exact source on
 - Use `ast_explore` when the question spans discovery and evidence. Its default summary is bounded; use `detail: "context"` for selected source and `detail: "full"` for source plus compiler references.
 - Use `ast_get_outline` for a compact body-free view of a known file without source lines.
 - Use `ast_get_symbol_source` when one declaration or implementation is the required evidence.
-- Use `ast_get_impact` when the exact symbol is known and bounded direct/transitive compiler relationships are needed; it is read-only evidence, not a mutation plan.
-- Use `ast_find_test_candidates` when an exact symbol should map to conservative test candidates. It forces incoming compiler traversal, returns complete relationship paths, and never executes tests.
+- Use `ast_get_impact` when the exact symbol is known and bounded direct/transitive compiler relationships are needed. Check `coverage`, `work`, `truncation`, `incomplete`, and `proven_empty`; this is read-only evidence, not a mutation plan.
+- Use `ast_find_test_candidates` when an exact symbol should map to conservative tests. It admits only complete incoming `reference`, `import`, `export`, `extends`, `implements`, and `call` evidence, returns whole paths, and never executes tests.
 
 `snapshot_state: "fresh"` means that the returned file bytes match the synchronized compiler snapshot. The separate `freshness` object describes the project/session state and preserves causes such as source changes or watcher failure. Neither field means that the project has zero TypeScript diagnostics; use `ast_get_diagnostics` for compiler errors and warnings.
 
@@ -64,7 +64,20 @@ The server exposes evidence labels instead of collapsing every result into an un
 
 Freshness is orthogonal to TypeScript diagnostics. `fresh` means the evidence matches the synchronized snapshot; `pending`, `rebuilding`, `stale`, or `degraded` means the response must not be presented as current compiler evidence. Read tools expose the state, causes (`source_change`, `config_change`, `index_failure`, `watcher_failure`, or `compiler_rebuild`), and bounded `checked_at` timestamp. `ast_get_impact` refuses non-fresh compiler relationships. `ast_explore` returns the state together with `completeness`, `unresolved`, `budget`, and `truncation` metadata rather than silently dropping evidence.
 
-All reads are budgeted. Callers control pagination and, where applicable, `max_bytes`, `reference_limit`, `max_depth`, `max_nodes`, and `max_edges`; responses report the effective limits and whether a record, byte, depth, edge, invocation, or serialization limit truncated the result. A truncated or unresolved result is incomplete evidence, not an empty negative result. `ast_find_test_candidates` follows the same rule: it accepts only fresh, exact compiler-backed impact, emits direct/transitive evidence and bounded relationship IDs, and never executes tests or guesses from filenames alone. Only a complete authoritative traversal may return `candidates: []` with `proven_empty: true`.
+All reads are budgeted. Callers control pagination and, where applicable, `max_bytes`, `reference_limit`, `max_depth`, `max_nodes`, and `max_edges`; responses report effective limits. A bounded stop is incomplete evidence, not an empty negative result.
+
+Impact has two independent completeness channels:
+
+| Channel           | Evidence                                                                                                                            | Incomplete when                                      |
+| ----------------- | ----------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------- |
+| Semantic coverage | One canonical cell per requested kind, direction, and endpoint class: `not_applicable`, `completed`, `unsupported`, or `unfinished` | Any applicable cell is `unsupported` or `unfinished` |
+| Traversal/work    | `truncation` plus `work.work_limit_reached` and its counters                                                                        | A depth/node/edge/work bound prevents completion     |
+
+`incomplete` is true when either channel is incomplete. `proven_empty` is true only when there are zero edges, every applicable cell completed, and no bound was exhausted. The public seven-kind/default impact request includes `contains`; because no scoped `contains` producer exists, applicable default or explicit containment is `unsupported`, so the result is incomplete even when traversal was not truncated.
+
+`ast_find_test_candidates` deliberately excludes `contains` and fixes the admission scope to six incoming kinds: `reference`, `import`, `export`, `extends`, `implements`, and `call`. It returns `INCOMPLETE_EVIDENCE` before pagination for stale, inexact, unresolved, truncated, work-exhausted, unsupported, or unfinished evidence. Only complete six-kind authority may return `candidates: []` with `completeness.proven_empty: true`; pagination slices deterministic candidates while each proof and the unpaginated `coverage`, `work`, and traversal metadata stay whole.
+
+These fields are additive: existing edge shapes, kind strings, defaults, and public errors remain stable. MCP `ast_get_impact` JSON and TOON represent the same logical coverage/work result; candidate MCP output remains canonical JSON, while read-only batch output may encode that same candidate result as TOON. Property, element, dynamic, computed-key, and external-alternative dispatch remains edge-free and unfinished—this contract does not certify the deferred #219 or #220 classifiers.
 
 ## Why this helps
 
@@ -84,7 +97,7 @@ The included batch benchmark records a 50% reduction in model round-trips and a
 
 ## Supported environment and trust boundary
 
-Published v0.12.0 requires Node.js `>=22.13.0`; its immutable evidence matrix targets exact Node.js 22.13.0 and the current Node.js 24 line. Managed setup-file publication additionally requires GNU coreutils 9.7 `mv` supporting `--update=none-fail`, `--exchange`, `--no-copy`, and `--no-target-directory`, GNU coreutils `ln -L -T`, procfs descriptor paths at `/proc/self/fd`, and `O_DIRECTORY`/`O_NOFOLLOW`. Other Linux architectures or systems without those filesystem primitives, macOS, and Windows remain unverified.
+Published v0.12.0 requires Node.js `>=22.13.0`; its immutable evidence matrix targets exact Node.js 22.13.0 and the current Node.js 24 line. Structural apply and managed setup-file publication are verified only on Linux x64 with GNU coreutils 9.7 `mv` supporting `--update=none-fail`, `--exchange`, `--no-copy`, and `--no-target-directory`, GNU coreutils `ln -L -T`, procfs descriptor paths at `/proc/self/fd`, `O_DIRECTORY`/`O_NOFOLLOW`, and a destination filesystem that passes the owned link/exchange identity probe. A failed or denied primitive blocks mutation before source effects; there is no rename, copy/delete, or pathname-only fallback. Other Linux architectures or systems without this complete matrix, macOS, and Windows remain unverified.
 
 This is a local stdio server. It runs with the invoking user's filesystem permissions, and clients may request any `project_root` that user can access. It does not provide HTTP authentication, sandboxing, tenant isolation, or a remote-service security boundary. Remote, untrusted, and multi-tenant operation is unsupported.
 
@@ -340,7 +353,7 @@ For a local candidate, pack and install its tarball instead:
 
 ```bash
 yarn pack --out ast-mcp-server-%v.tgz
-dsh plugin --profile web add ./ast-mcp-server-0.13.1.tgz
+dsh plugin --profile web add ./ast-mcp-server-0.14.1.tgz
 ```
 
 The first supported surface is **reads + prepare + preview**. Every apply path is
@@ -529,12 +542,13 @@ Apply loads the exact retained postimages, requires the separately supplied revi
 
 ### Guarantee boundary
 
-The server does **not** claim a filesystem-wide transaction:
+The server does **not** claim a filesystem-wide transaction or safety against a continuously mutating writer:
 
-- Replacement is atomic per file where the local filesystem provides atomic rename.
-- A multi-file apply has a short interval in which some replacements may already be visible.
-- Rollback is best effort and refuses to overwrite a file changed by another writer after replacement.
-- MCP and CLI apply share a fail-closed filesystem lock keyed by canonical `tsconfig.json` when they use the same state directory. It does not coordinate editors, NFS writers, or hostile external processes.
+- Each replacement exchanges and authenticates one staged/destination pair. Multi-file apply remains sequential, so earlier postimages may be visible before later files commit.
+- Reverse rollback restores only an exact operation-owned pair. Lost ownership preserves the observable entries and returns `AMBIGUOUS_APPLY`; it never falls back to pathname replacement.
+- Creation is no-clobber. Once a created inode is published, a later failure cannot safely infer unlink ownership, so the destination and hidden stage are preserved and rollback fails closed as ambiguous.
+- MCP and CLI apply share a fail-closed filesystem lock keyed by canonical `tsconfig.json` when they use the same state directory. It does not coordinate editors, NFS writers, writers using another configuration, or hostile external processes.
+- Deterministic promise barriers prove the tested publication/rollback interleavings. They are a threat-boundary test seam, not a global atomicity or continuous-writer guarantee.
 - Receipt persistence runs before that lock is released. If receipt storage fails after source replacement, apply exits non-zero and reports that verified postimages may be present; retry recovers the receipt only when the complete workspace exactly matches the reviewed post-workspace fingerprint.
 - A hard process crash can leave a stale lock. Remove it only after inspecting its metadata and proving no apply is running; exact complete postimages can then recover the receipt, while partial or divergent state remains a conflict.
 - Source encoding support is UTF-8, with or without BOM. Unsupported encodings are rejected.

package/cordis.patch.yml

@@ -3,7 +3,7 @@
 # Mounts the packaged `ast-mcp-server` stdio command through the official
 # `@deepseek-ai/dsh-mcp-client` bridge. Harness does not resolve MCP binaries
 # from PATH, so the entrypoint is resolved relative to the profile directory
-# (`baseUrl`), where `dsh plugin --profile <name> add ./ast-mcp-server-0.13.1.tgz`
+# (`baseUrl`), where `dsh plugin --profile <name> add ./ast-mcp-server-0.14.1.tgz`
 # installs a locally packed package as a dependency.
 #
 # First-slice surface: reads + prepare + preview. Every apply path is denied

package/dist/batch/schema.js

@@ -20,7 +20,7 @@ const BatchStepSchema = z
     .object({
     id: z.string().regex(/^[A-Za-z][A-Za-z0-9_-]{0,63}$/),
     tool: BatchToolSchema,
-    input: z.record(z.unknown()).default({}),
+    input: z.record(z.string(), z.unknown()).default({}),
     foreach: z
         .object({ $ref: z.string().min(1) })
         .strict()

package/dist/services/authenticated-publication.js

@@ -0,0 +1,181 @@
+import { createHash, randomUUID } from "node:crypto";
+import { spawn } from "node:child_process";
+import { constants } from "node:fs";
+import { lstat, mkdir, open, readFile, rm, writeFile } from "node:fs/promises";
+import path from "node:path";
+function sameStat(left, right) {
+    const fields = ["dev", "ino", "size", "mode", "mtimeNs", "ctimeNs"];
+    return fields.every((field) => left[field] === right[field]);
+}
+export async function snapshotHeldFile(handle) {
+    const before = await handle.stat({ bigint: true });
+    if (!before.isFile() || before.size > BigInt(Number.MAX_SAFE_INTEGER))
+        throw new Error("Publication descriptor cannot be authenticated");
+    const bytes = await readFile(`/proc/self/fd/${handle.fd}`);
+    const after = await handle.stat({ bigint: true });
+    if (!after.isFile() || !sameStat(before, after))
+        throw new Error("Publication descriptor changed during read");
+    return {
+        dev: after.dev.toString(),
+        ino: after.ino.toString(),
+        sha256: createHash("sha256").update(bytes).digest("hex"),
+        mode: Number(after.mode & 511n),
+    };
+}
+function equal(left, right) {
+    return (left !== undefined &&
+        right !== undefined &&
+        left.dev === right.dev &&
+        left.ino === right.ino &&
+        left.sha256 === right.sha256 &&
+        left.mode === right.mode);
+}
+async function entry(directory, basename) {
+    const target = `/proc/self/fd/${directory.fd}/${basename}`;
+    let handle;
+    try {
+        handle = await open(target, constants.O_RDONLY | constants.O_NOFOLLOW);
+        const snapshot = await snapshotHeldFile(handle);
+        const current = await lstat(target, { bigint: true });
+        return current.dev.toString() === snapshot.dev && current.ino.toString() === snapshot.ino
+            ? snapshot
+            : undefined;
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw error;
+    }
+    finally {
+        await handle?.close();
+    }
+}
+export async function runPublicationPrimitive(executable, args, fds) {
+    await new Promise((resolve, reject) => {
+        const child = spawn(executable, args, {
+            env: { LANG: "C", LC_ALL: "C", PATH: "/usr/bin:/bin" },
+            shell: false,
+            stdio: ["ignore", "ignore", "pipe", ...fds],
+            windowsHide: true,
+        });
+        let failure;
+        let stderrBytes = 0;
+        const fail = (message, cause) => {
+            if (failure)
+                return;
+            failure = new Error(message, cause === undefined ? undefined : { cause });
+            child.kill("SIGKILL");
+        };
+        const timeout = setTimeout(() => fail("Publication primitive timed out"), 5_000);
+        child.stderr.on("data", (chunk) => {
+            stderrBytes += chunk.byteLength;
+            if (stderrBytes > 4_096)
+                fail("Publication primitive stderr exceeded limit");
+        });
+        child.on("error", (error) => fail("Publication primitive unavailable", error));
+        child.on("close", (code, signal) => {
+            clearTimeout(timeout);
+            if (failure)
+                reject(failure);
+            else if (code === 0 && signal === null)
+                resolve();
+            else
+                reject(new Error(`Publication primitive failed (${signal ?? code ?? "unknown"})`));
+        });
+    });
+}
+export const exchangeDirectoryEntries = (directory, left, right) => runPublicationPrimitive("/usr/bin/mv", ["--exchange", "--no-copy", "-T", "--", `/proc/self/fd/3/${left}`, `/proc/self/fd/3/${right}`], [directory.fd]);
+export const linkHeldFile = (source, directory, basename) => runPublicationPrimitive("/usr/bin/ln", ["-L", "-T", "--", "/proc/self/fd/3", `/proc/self/fd/4/${basename}`], [source.fd, directory.fd]);
+export async function removeOwnedPublicationEntry(directory, basename, expected) {
+    if (!equal(await entry(directory, basename), expected))
+        return false;
+    await rm(`/proc/self/fd/${directory.fd}/${basename}`);
+    return (await entry(directory, basename)) === undefined;
+}
+export async function rollbackOwnedCommit(token, hooks = {}) {
+    if (token.kind === "creation")
+        return { state: "ambiguous", phase: "rollback" };
+    await hooks.beforeRollback?.();
+    if (!equal(await entry(token.directory, token.destinationBasename), token.destinationIdentity) ||
+        !equal(await entry(token.directory, token.displacedBasename), token.displacedIdentity))
+        return { state: "ambiguous", phase: "rollback" };
+    await exchangeDirectoryEntries(token.directory, token.displacedBasename, token.destinationBasename).catch(() => undefined);
+    const restored = equal(await entry(token.directory, token.destinationBasename), token.displacedIdentity) &&
+        equal(await entry(token.directory, token.displacedBasename), token.destinationIdentity);
+    if (!restored)
+        return { state: "ambiguous", phase: "rollback" };
+    return { state: "rolled_back", reason: "conflict" };
+}
+export async function publishAuthenticated(plan) {
+    if (process.platform !== "linux")
+        return { state: "pre_effect", reason: "unsupported" };
+    await plan.beforePublish?.();
+    if (plan.kind === "creation") {
+        await linkHeldFile(plan.stage, plan.directory, plan.destinationBasename).catch(() => undefined);
+        const destination = await entry(plan.directory, plan.destinationBasename);
+        if (equal(destination, plan.stageIdentity))
+            return {
+                state: "committed",
+                token: {
+                    kind: "creation",
+                    directory: plan.directory,
+                    destinationBasename: plan.destinationBasename,
+                    destinationIdentity: plan.stageIdentity,
+                },
+            };
+        if (destination?.dev === plan.stageIdentity.dev && destination.ino === plan.stageIdentity.ino)
+            return { state: "ambiguous", phase: "commit" };
+        return { state: "pre_effect", reason: destination ? "conflict" : "unsupported" };
+    }
+    await exchangeDirectoryEntries(plan.directory, plan.stageBasename, plan.destinationBasename).catch(() => undefined);
+    const destination = await entry(plan.directory, plan.destinationBasename);
+    const displaced = await entry(plan.directory, plan.stageBasename);
+    if (equal(destination, plan.stageIdentity) && displaced) {
+        const token = {
+            kind: "replacement",
+            directory: plan.directory,
+            destinationBasename: plan.destinationBasename,
+            displacedBasename: plan.stageBasename,
+            destinationIdentity: destination,
+            displacedIdentity: displaced,
+        };
+        const held = plan.preimage && (await snapshotHeldFile(plan.preimage));
+        if (equal(displaced, plan.preimageIdentity) && equal(held, plan.preimageIdentity))
+            return { state: "committed", token };
+        return rollbackOwnedCommit(token, plan);
+    }
+    if (equal(destination, plan.preimageIdentity) && equal(displaced, plan.stageIdentity))
+        return { state: "pre_effect", reason: "unsupported" };
+    return { state: "ambiguous", phase: "commit" };
+}
+export async function probePublicationCapability(parent) {
+    const probe = path.join(parent, `.ast-publication-probe-${randomUUID()}`);
+    const handles = [];
+    try {
+        await mkdir(probe);
+        const directory = await open(probe, "r");
+        handles.push(directory);
+        for (const [name, bytes] of [
+            ["stage", "stage"],
+            ["replacement", "replacement"],
+        ])
+            await writeFile(path.join(probe, name), bytes);
+        const stage = await open(path.join(probe, "stage"), "r");
+        handles.push(stage);
+        const replacement = await open(path.join(probe, "replacement"), "r");
+        handles.push(replacement);
+        const stageIdentity = await snapshotHeldFile(stage);
+        const replacementIdentity = await snapshotHeldFile(replacement);
+        await linkHeldFile(stage, directory, "created");
+        if (!equal(await entry(directory, "created"), stageIdentity))
+            throw new Error("Link unsupported");
+        await exchangeDirectoryEntries(directory, "replacement", "created");
+        if (!equal(await entry(directory, "created"), replacementIdentity) ||
+            !equal(await entry(directory, "replacement"), stageIdentity))
+            throw new Error("Publication exchange unsupported");
+    }
+    finally {
+        await Promise.allSettled(handles.map((handle) => handle.close()));
+        await rm(probe, { recursive: true, force: true });
+    }
+}

package/dist/services/call-spines.js

@@ -17,11 +17,7 @@ export function planCallSpines(root, edges, options) {
     const maxEdges = assertLimit(options.max_edges, 1, "max_edges");
     const accepted = edges.filter(exactCall);
     const freshness = options.freshness?.state ?? edges[0]?.freshness.state;
-    const authorityState = freshness !== "fresh" || accepted.length !== edges.length
-        ? "untrusted"
-        : options.discovery_complete === false
-            ? "incomplete"
-            : "authoritative";
+    const trusted = freshness === "fresh" && accepted.length === edges.length;
     const reasons = new Set();
     const rootKey = endpointKey(root);
     const initial = { endpoint: root, endpoints: [root], relationshipIds: [], depth: 0 };
@@ -82,6 +78,15 @@ export function planCallSpines(root, edges, options) {
         endpoints: record.endpoints,
         relationship_ids: record.relationshipIds,
     }));
+    const reached = new Set(records.keys());
+    const relevantGap = (options.unfinished_gaps ?? []).some((gap) => options.direction === "outgoing"
+        ? reached.has(endpointKey(gap.source))
+        : gap.alternatives.some((alternative) => reached.has(endpointKey(alternative))));
+    const authorityState = !trusted
+        ? "untrusted"
+        : options.discovery_complete === false || relevantGap
+            ? "incomplete"
+            : "authoritative";
     const incomplete = authorityState !== "authoritative" || reasons.size > 0;
     return {
         root,

package/dist/services/context-builder.js

@@ -167,7 +167,8 @@ export async function buildExploreContext(context, request, requestContext = NO_
             max_depth: request.callSpines.maxDepth,
             max_nodes: request.callSpines.maxNodes,
             max_edges: request.callSpines.maxEdges,
-            discovery_complete: !projected.incomplete,
+            discovery_complete: !projected.bounded_incomplete,
+            unfinished_gaps: projected.unfinished_gaps,
             freshness,
         });
     }