eval-quality 1.4.2 → 3.0.0

package/dist/core/seal/plan-index.d.ts

@@ -1,5 +1,5 @@
 /** resolves a pointer to its step and operation; nothing about reachability. */
-import type { AnyOperation, CommandOperation, InterfaceKindName, Operation, PermittedInterface } from '../schemas/interface.ts';
+import type { AnyOperation, CommandOperation, InterfaceKindName, McpOperation, Operation, PermittedInterface } from '../schemas/interface.ts';
 import type { InteractionStep } from '../schemas/plan.ts';
 import { type EvidenceChannelName, type InputChannelName } from '../schemas/pointer.ts';
 /**
@@ -17,13 +17,13 @@ export declare const decodeTail: (tailSource: string) => readonly string[];
 export type EvidenceTarget = {
     stepId: string;
     channel: EvidenceChannelName;
-    transportChannel: InputChannelName | null;
+    inputChannel: InputChannelName | null;
     artifactId: string | null;
     tail: readonly string[];
 };
 /**
  * Parses one `InteractionPointer` string (`INTERACTION_POINTER_PATTERN` in
- * `pointer.ts`) into its step id, channel, transport channel, and tail, using
+ * `pointer.ts`) into its step id, channel, input channel, and tail, using
  * the schema's own channel partition so this accepts exactly what
  * `InteractionPointer.safeParse` accepts. A should-never-happen precondition
  * violation throws `TypeError`, per `digest.ts`'s precedent.
@@ -38,14 +38,15 @@ export declare function parseEvidenceTarget(pointer: string): EvidenceTarget;
  *
  * `operationOf` stays narrow on purpose. It hands a resolved `Operation` to
  * every downstream consumer, so widening its return type to the operation
- * union would retype seventeen files at once. A command operation resolves to
- * `undefined` from it and to a value from `commandOperationOf`, and each
- * caller that has to branch reads the declaring kind first.
+ * union would retype seventeen files at once. A command operation and a tool
+ * call each resolve to `undefined` from it and to a value from their own
+ * accessor, and each caller that has to branch reads the declaring kind first.
  */
 export type PlanIndex = {
     stepOf: (stepId: string) => InteractionStep | undefined;
     operationOf: (operationId: string) => Operation | undefined;
     commandOperationOf: (operationId: string) => CommandOperation | undefined;
+    mcpOperationOf: (operationId: string) => McpOperation | undefined;
     interfaceKindOf: (operationId: string) => InterfaceKindName | undefined;
     stepsUsing: (operationId: string) => readonly InteractionStep[];
 };
@@ -70,9 +71,17 @@ export declare function buildPlanIndex(interactionPlan: readonly InteractionStep
 export declare function resolveStep(index: PlanIndex, stepId: string): InteractionStep;
 /**
  * The declared operation of whichever kind, for the callers that read only
- * fields both shapes carry. Callers reading a kind-specific field ask
+ * fields all three shapes carry. Callers reading a kind-specific field ask
  * `interfaceKindOf` first and then take the matching accessor.
  */
 export declare const anyOperationOf: (index: PlanIndex, operationId: string) => AnyOperation | undefined;
-/** Resolves an operation id through the index or throws. See `resolveStep`. */
-export declare function resolveOperation(index: PlanIndex, operationId: string): Operation;
+/**
+ * Resolves an operation id through the index or throws. See `resolveStep`.
+ *
+ * Reads all three maps. It read `operationOf` alone, so it threw for a command
+ * operation and then for a tool call with the message "the permitted interfaces
+ * do not declare it", which is false: they declare it, and a different accessor
+ * holds it. Callers narrow with the operation predicates in
+ * `core/declared-inputs.ts`.
+ */
+export declare function resolveOperation(index: PlanIndex, operationId: string): AnyOperation;

package/dist/core/seal/plan-index.js

@@ -1,5 +1,4 @@
-import { operationsOf } from '../schemas/interface.js';
-import { IDENTIFIER_ROOTED_CHANNEL, INPUT_CHANNELS, SCALAR_CHANNELS, TAIL_BEARING_CHANNELS, TRANSPORT_ROOTED_CHANNEL, } from '../schemas/pointer.js';
+import { IDENTIFIER_ROOTED_CHANNEL, INPUT_CHANNELS, INPUT_ROOTED_CHANNEL, SCALAR_CHANNELS, TAIL_BEARING_CHANNELS, } from '../schemas/pointer.js';
 import { IDENTIFIER_CHARSET_SOURCE } from '../schemas/primitives.js';
 // An RFC 6901 reference token, respelled here because pointer.ts keeps its
 // own TOKEN/TAIL fragments private. IDENTIFIER_CHARSET_SOURCE and the channel
@@ -15,7 +14,7 @@ const alternation = (members) => members.join('|');
 // Named capture groups replace positional indices, avoiding a fragile
 // dependency on `IDENTIFIER_CHARSET_SOURCE` staying free of its own capturing
 // groups.
-const EVIDENCE_TARGET_PATTERN = new RegExp(`^/interactions/(?<stepId>${IDENTIFIER_CHARSET_SOURCE})/(?:(?<tailBearingChannel>${alternation(TAIL_BEARING_CHANNELS)})(?<tailBearingTail>${TAIL_SOURCE})|(?<scalarChannel>${alternation(SCALAR_CHANNELS)})|${TRANSPORT_ROOTED_CHANNEL}/(?<transportChannel>${alternation(INPUT_CHANNELS)})(?<callInputsTail>${TAIL_SOURCE})|${IDENTIFIER_ROOTED_CHANNEL}/(?<artifactId>${IDENTIFIER_CHARSET_SOURCE})(?<artifactTail>${TAIL_SOURCE}))$`);
+const EVIDENCE_TARGET_PATTERN = new RegExp(`^/interactions/(?<stepId>${IDENTIFIER_CHARSET_SOURCE})/(?:(?<tailBearingChannel>${alternation(TAIL_BEARING_CHANNELS)})(?<tailBearingTail>${TAIL_SOURCE})|(?<scalarChannel>${alternation(SCALAR_CHANNELS)})|${INPUT_ROOTED_CHANNEL}/(?<inputChannel>${alternation(INPUT_CHANNELS)})(?<callInputsTail>${TAIL_SOURCE})|${IDENTIFIER_ROOTED_CHANNEL}/(?<artifactId>${IDENTIFIER_CHARSET_SOURCE})(?<artifactTail>${TAIL_SOURCE}))$`);
 const isEvidenceChannel = (value) => TAIL_BEARING_CHANNELS.includes(value) ||
     SCALAR_CHANNELS.includes(value);
 const isInputChannel = (value) => INPUT_CHANNELS.includes(value);
@@ -28,7 +27,7 @@ export const decodeToken = (token) => token.replace(/~1/g, '/').replace(/~0/g, '
 export const decodeTail = (tailSource) => tailSource === '' ? [] : tailSource.slice(1).split('/').map(decodeToken);
 /**
  * Parses one `InteractionPointer` string (`INTERACTION_POINTER_PATTERN` in
- * `pointer.ts`) into its step id, channel, transport channel, and tail, using
+ * `pointer.ts`) into its step id, channel, input channel, and tail, using
  * the schema's own channel partition so this accepts exactly what
  * `InteractionPointer.safeParse` accepts. A should-never-happen precondition
  * violation throws `TypeError`, per `digest.ts`'s precedent.
@@ -47,7 +46,7 @@ export function parseEvidenceTarget(pointer) {
         return {
             stepId,
             channel: groups.scalarChannel,
-            transportChannel: null,
+            inputChannel: null,
             artifactId: null,
             tail: [],
         };
@@ -60,20 +59,20 @@ export function parseEvidenceTarget(pointer) {
         return {
             stepId,
             channel: groups.tailBearingChannel,
-            transportChannel: null,
+            inputChannel: null,
             artifactId: null,
             tail: decodeTail(groups.tailBearingTail ?? ''),
         };
     }
-    if (groups.transportChannel !== undefined) {
-        if (!isInputChannel(groups.transportChannel)) {
+    if (groups.inputChannel !== undefined) {
+        if (!isInputChannel(groups.inputChannel)) {
             // Unreachable: INPUT_CHANNELS is exactly what this group can match.
-            throw new TypeError(`call-inputs evidence target names no transport channel: ${pointer}`);
+            throw new TypeError(`call-inputs evidence target names no input channel: ${pointer}`);
         }
         return {
             stepId,
             channel: 'call-inputs',
-            transportChannel: groups.transportChannel,
+            inputChannel: groups.inputChannel,
             artifactId: null,
             tail: decodeTail(groups.callInputsTail ?? ''),
         };
@@ -82,7 +81,7 @@ export function parseEvidenceTarget(pointer) {
         return {
             stepId,
             channel: IDENTIFIER_ROOTED_CHANNEL,
-            transportChannel: null,
+            inputChannel: null,
             artifactId: groups.artifactId,
             tail: decodeTail(groups.artifactTail ?? ''),
         };
@@ -123,40 +122,73 @@ export function buildPlanIndex(interactionPlan, permittedInterfaces, options = {
     }
     const operations = new Map();
     const commandOperations = new Map();
+    const mcpOperations = new Map();
     const kinds = new Map();
     const duplicateOperationIds = new Set();
+    /**
+     * Records one operation id against the kind that declared it and answers
+     * whether the caller may store the operation. An id two permitted
+     * interfaces both declare is removed from every map instead of being
+     * resolved by array order, so `operationOf` and its two siblings answer
+     * `undefined` for it. One closure serves all three arms: the bookkeeping is
+     * the same for every kind and only the destination map differs.
+     */
+    const claim = (operationId, kind) => {
+        if (kinds.has(operationId) || duplicateOperationIds.has(operationId)) {
+            if (duplicateIds === 'throw') {
+                throw new TypeError(`duplicate operation id across permitted interfaces: ${operationId}`);
+            }
+            operations.delete(operationId);
+            commandOperations.delete(operationId);
+            mcpOperations.delete(operationId);
+            kinds.delete(operationId);
+            duplicateOperationIds.add(operationId);
+            return false;
+        }
+        kinds.set(operationId, kind);
+        return true;
+    };
     for (const iface of permittedInterfaces) {
-        for (const operation of operationsOf(iface)) {
-            if (kinds.has(operation.operationId) ||
-                duplicateOperationIds.has(operation.operationId)) {
-                if (duplicateIds === 'throw') {
-                    throw new TypeError(`duplicate operation id across permitted interfaces: ${operation.operationId}`);
+        // Narrowed on the interface's own kind before its operations are read.
+        // Each branch of `PermittedInterface` declares its own `operations`
+        // element type, so an arm that narrowed first iterates
+        // `CommandOperation`, `McpOperation` or `Operation` and stores it with
+        // no cast. Widening through `operationsOf` first discards that
+        // correlation, and no later kind test recovers it. `web` shares the api
+        // map: it carries the api operation shape and every consumer of a
+        // resolved operation reads the same declared fields off both.
+        switch (iface.kind) {
+            case 'cli':
+                for (const operation of iface.operations) {
+                    if (claim(operation.operationId, iface.kind))
+                        commandOperations.set(operation.operationId, operation);
                 }
-                operations.delete(operation.operationId);
-                commandOperations.delete(operation.operationId);
-                kinds.delete(operation.operationId);
-                duplicateOperationIds.add(operation.operationId);
-            }
-            else {
-                kinds.set(operation.operationId, iface.kind);
-                // Sorted into the two maps by the interface's own kind rather
-                // than by probing the operation for a field: `web` and `mcp`
-                // carry the api operation shape and belong in the same map as
-                // `api`, since every consumer of a resolved operation reads
-                // the same declared fields off all three.
-                if (iface.kind === 'cli') {
-                    commandOperations.set(operation.operationId, operation);
+                continue;
+            case 'mcp':
+                for (const operation of iface.operations) {
+                    if (claim(operation.operationId, iface.kind))
+                        mcpOperations.set(operation.operationId, operation);
                 }
-                else {
-                    operations.set(operation.operationId, operation);
+                continue;
+            case 'api':
+            case 'web':
+                for (const operation of iface.operations) {
+                    if (claim(operation.operationId, iface.kind))
+                        operations.set(operation.operationId, operation);
                 }
-            }
+                continue;
         }
+        // Reachable only once a fifth kind joins the union, and then `iface` is
+        // no longer `never` and this line fails the typecheck. That is the
+        // forcing function the three hand-narrowed casts did not have: a kind
+        // with no arm above was sorted into the api map by exhaustion.
+        iface;
     }
     return {
         stepOf: (stepId) => steps.get(stepId),
         operationOf: (operationId) => operations.get(operationId),
         commandOperationOf: (operationId) => commandOperations.get(operationId),
+        mcpOperationOf: (operationId) => mcpOperations.get(operationId),
         interfaceKindOf: (operationId) => kinds.get(operationId),
         stepsUsing: (operationId) => stepsByOperation.get(operationId) ?? [],
     };
@@ -177,13 +209,23 @@ export function resolveStep(index, stepId) {
 }
 /**
  * The declared operation of whichever kind, for the callers that read only
- * fields both shapes carry. Callers reading a kind-specific field ask
+ * fields all three shapes carry. Callers reading a kind-specific field ask
  * `interfaceKindOf` first and then take the matching accessor.
  */
-export const anyOperationOf = (index, operationId) => index.operationOf(operationId) ?? index.commandOperationOf(operationId);
-/** Resolves an operation id through the index or throws. See `resolveStep`. */
+export const anyOperationOf = (index, operationId) => index.operationOf(operationId) ??
+    index.commandOperationOf(operationId) ??
+    index.mcpOperationOf(operationId);
+/**
+ * Resolves an operation id through the index or throws. See `resolveStep`.
+ *
+ * Reads all three maps. It read `operationOf` alone, so it threw for a command
+ * operation and then for a tool call with the message "the permitted interfaces
+ * do not declare it", which is false: they declare it, and a different accessor
+ * holds it. Callers narrow with the operation predicates in
+ * `core/declared-inputs.ts`.
+ */
 export function resolveOperation(index, operationId) {
-    const operation = index.operationOf(operationId);
+    const operation = anyOperationOf(index, operationId);
     if (operation === undefined) {
         throw new TypeError(`step names an operation the permitted interfaces do not declare: ${operationId}`);
     }

package/dist/index.d.ts

@@ -12,4 +12,4 @@ export type { ScoringPolicy } from './core/schemas/scoring-policy.ts';
 export type { SealedEvaluatorBrief } from './core/schemas/sealed-evaluator-brief.ts';
 export type { SealedRunRecord } from './core/schemas/sealed-run-record.ts';
 export type { FixtureReset, ManifestationWitness, SensitivityWitness, SensitivityWitnessLeg, WitnessChannel, WitnessInputs, } from './core/schemas/sensitivity-witness.ts';
-export declare const VERSION = "1.4.2";
+export declare const VERSION = "3.0.0";

package/dist/index.js

@@ -19,4 +19,4 @@
 // subpath, where AD-37 puts the conformance definition an adapter author
 // reads; the reference adapters stay at `eval-quality/adapters`.
 export * from './application/index.js';
-export const VERSION = '1.4.2';
+export const VERSION = '3.0.0';

package/dist/ports/environment-probe-port.d.ts

@@ -4,25 +4,34 @@
  * identifier to an authorized target is the adapter's job, from configuration
  * outside the contract.
  *
- * Four rules an implementation MUST follow. Prose here because `ports/` holds
- * no logic; `src/testing/probe-conformance.ts` is the executable half.
+ * Four rules an implementation MUST follow, whichever mechanism it speaks.
+ * Prose here because `ports/` holds no logic; `src/testing/probe-conformance.ts`
+ * is the executable half.
  *
- * 1. Apply the policy before any network call, and again to every redirect
- *    target.
- * 2. Issue the request against the address the policy validated
- *    (`canonicalAddress`), keep the original host in the `Host` header, and
- *    verify TLS against that host. Never re-resolve a hostname after
- *    validation: re-resolving between the check and the connection is the
- *    classic way past an allowlist like this one. Where a host resolves to
- *    several addresses, validate each and connect only to a validated one.
+ * 1. Apply the policy before anything reaches the system under test, and again
+ *    to every target the first one leads to. On HTTP that second clause is
+ *    every redirect; on a mechanism that starts a process it is every process
+ *    the authorization causes to run.
+ * 2. Act on exactly what the policy validated, and revalidate nothing away.
+ *    Over HTTP: issue the request against the validated address
+ *    (`canonicalAddress`), keep the original host in the `Host` header, verify
+ *    TLS against that host, and never re-resolve a hostname after validation,
+ *    since re-resolving between the check and the connection is the classic
+ *    way past an allowlist like this one; where a host resolves to several
+ *    addresses, validate each and connect only to a validated one. Over a
+ *    mechanism that starts a process: spawn the authorized target with an argv
+ *    array and never through a shell, so no declared value can become a
+ *    metacharacter, and pass only the environment the mapping declares.
  * 3. A policy denial throws `forbidden-target`; a cap throws
- *    `budget-exhausted`; an abort throws `aborted`; a transport failure throws
- *    `port-failure`.
- * 4. Every response the server returns is an observation, at any status. A 4xx
- *    or 5xx resolves to a schema-valid `ProbeObservation`, since AD-10's
- *    "every declared seeded fault being observed to fire" reads the status as
- *    payload. Throw on a non-2xx and a seeded fault goes invisible, which
- *    makes the whole pre-flight vacuous.
+ *    `budget-exhausted`; an abort throws `aborted`; a failure to reach the
+ *    system at all throws `port-failure`.
+ * 4. Every answer the system returns is an observation, whatever it says. A
+ *    4xx or 5xx, a non-zero exit, and a tool result flagged as an error all
+ *    resolve to a schema-valid `ProbeObservation`, since AD-10's "every
+ *    declared seeded fault being observed to fire" reads the answer as
+ *    payload. Throw on one of those and a seeded fault goes invisible, which
+ *    makes the whole pre-flight vacuous. What throws under rule 3 is the case
+ *    where nothing answered.
  */
 import { ProbeObservation, ProbeRequest } from '../core/schemas/port-messages.ts';
 import type { PortMethod } from './port.ts';
@@ -78,6 +87,15 @@ export declare const probeParsers: {
                 kind: import("zod").ZodLiteral<"absent">;
             }, import("zod/v4/core").$strict>], "kind">;
         }, import("zod/v4/core").$strict>;
+    }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+        probeId: import("zod").ZodString;
+        interfaceId: import("zod").ZodString;
+        operationId: import("zod").ZodString;
+        kind: import("zod").ZodLiteral<"mcp">;
+        toolName: import("zod").ZodString;
+        channels: import("zod").ZodObject<{
+            arguments: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodType<import("../core/schemas/primitives.ts").JsonValue, unknown, import("zod/v4/core").$ZodTypeInternals<import("../core/schemas/primitives.ts").JsonValue, unknown>>>;
+        }, import("zod/v4/core").$strict>;
     }, import("zod/v4/core").$strict>], "kind">;
     readonly response: import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
         probeId: import("zod").ZodString;
@@ -128,5 +146,20 @@ export declare const probeParsers: {
         }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
             kind: import("zod").ZodLiteral<"absent">;
         }, import("zod/v4/core").$strict>], "kind">>;
+    }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+        probeId: import("zod").ZodString;
+        interfaceId: import("zod").ZodString;
+        operationId: import("zod").ZodString;
+        kind: import("zod").ZodLiteral<"mcp">;
+        isError: import("zod").ZodBoolean;
+        result: import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
+            kind: import("zod").ZodLiteral<"json">;
+            value: import("zod").ZodType<import("../core/schemas/primitives.ts").JsonValue, unknown, import("zod/v4/core").$ZodTypeInternals<import("../core/schemas/primitives.ts").JsonValue, unknown>>;
+        }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+            kind: import("zod").ZodLiteral<"text">;
+            value: import("zod").ZodString;
+        }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+            kind: import("zod").ZodLiteral<"absent">;
+        }, import("zod/v4/core").$strict>], "kind">;
     }, import("zod/v4/core").$strict>], "kind">;
 };

package/dist/ports/environment-probe-port.js

@@ -4,25 +4,34 @@
  * identifier to an authorized target is the adapter's job, from configuration
  * outside the contract.
  *
- * Four rules an implementation MUST follow. Prose here because `ports/` holds
- * no logic; `src/testing/probe-conformance.ts` is the executable half.
+ * Four rules an implementation MUST follow, whichever mechanism it speaks.
+ * Prose here because `ports/` holds no logic; `src/testing/probe-conformance.ts`
+ * is the executable half.
  *
- * 1. Apply the policy before any network call, and again to every redirect
- *    target.
- * 2. Issue the request against the address the policy validated
- *    (`canonicalAddress`), keep the original host in the `Host` header, and
- *    verify TLS against that host. Never re-resolve a hostname after
- *    validation: re-resolving between the check and the connection is the
- *    classic way past an allowlist like this one. Where a host resolves to
- *    several addresses, validate each and connect only to a validated one.
+ * 1. Apply the policy before anything reaches the system under test, and again
+ *    to every target the first one leads to. On HTTP that second clause is
+ *    every redirect; on a mechanism that starts a process it is every process
+ *    the authorization causes to run.
+ * 2. Act on exactly what the policy validated, and revalidate nothing away.
+ *    Over HTTP: issue the request against the validated address
+ *    (`canonicalAddress`), keep the original host in the `Host` header, verify
+ *    TLS against that host, and never re-resolve a hostname after validation,
+ *    since re-resolving between the check and the connection is the classic
+ *    way past an allowlist like this one; where a host resolves to several
+ *    addresses, validate each and connect only to a validated one. Over a
+ *    mechanism that starts a process: spawn the authorized target with an argv
+ *    array and never through a shell, so no declared value can become a
+ *    metacharacter, and pass only the environment the mapping declares.
  * 3. A policy denial throws `forbidden-target`; a cap throws
- *    `budget-exhausted`; an abort throws `aborted`; a transport failure throws
- *    `port-failure`.
- * 4. Every response the server returns is an observation, at any status. A 4xx
- *    or 5xx resolves to a schema-valid `ProbeObservation`, since AD-10's
- *    "every declared seeded fault being observed to fire" reads the status as
- *    payload. Throw on a non-2xx and a seeded fault goes invisible, which
- *    makes the whole pre-flight vacuous.
+ *    `budget-exhausted`; an abort throws `aborted`; a failure to reach the
+ *    system at all throws `port-failure`.
+ * 4. Every answer the system returns is an observation, whatever it says. A
+ *    4xx or 5xx, a non-zero exit, and a tool result flagged as an error all
+ *    resolve to a schema-valid `ProbeObservation`, since AD-10's "every
+ *    declared seeded fault being observed to fire" reads the answer as
+ *    payload. Throw on one of those and a seeded fault goes invisible, which
+ *    makes the whole pre-flight vacuous. What throws under rule 3 is the case
+ *    where nothing answered.
  */
 import { ProbeObservation, ProbeRequest, } from '../core/schemas/port-messages.js';
 /** the boundary parsers `application/` and the conformance suite validate with. */

package/dist/testing/conformance.d.ts

@@ -7,14 +7,15 @@ export type ConformanceOutcome = {
     readonly passed: boolean;
     readonly detail: string;
 };
-export type ConformancePort = 'corpus' | 'clock' | 'file-system' | 'environment-probe' | 'command-probe';
+export type ConformancePort = 'corpus' | 'clock' | 'file-system' | 'environment-probe' | 'command-probe' | 'mcp-probe';
 /** how many outcomes a complete run of each port produces. Asserted as literals by fixture 58. */
 export declare const CONFORMANCE_OUTCOME_COUNTS: {
     readonly corpus: 6;
     readonly clock: 6;
     readonly 'file-system': 12;
     readonly 'environment-probe': 19;
-    readonly 'command-probe': 15;
+    readonly 'command-probe': 16;
+    readonly 'mcp-probe': 14;
 };
 export type ConformanceReport = {
     readonly subject: string;

package/dist/testing/conformance.js

@@ -19,7 +19,8 @@ export const CONFORMANCE_OUTCOME_COUNTS = {
     clock: 6,
     'file-system': 12,
     'environment-probe': 19,
-    'command-probe': 15,
+    'command-probe': 16,
+    'mcp-probe': 14,
 };
 /** "Promptly" with no bound is unfalsifiable. One second clears any real adapter's abort latency and sits well inside a default test timeout. */
 export const DEFAULT_ABORT_BUDGET_MS = 1000;

package/dist/testing/index.d.ts

@@ -13,7 +13,7 @@
 export type { RuntimeFaultCode } from '../core/schemas/faults.ts';
 export { RUNTIME_FAULT_CODES, RuntimeFault } from '../core/schemas/faults.ts';
 export type { ClockReadRequest, ClockReadResponse, CorpusResolveRequest, CorpusResolveResponse, FileReadRequest, FileReadResponse, FileWriteRequest, FileWriteResponse, ProbeObservation, ProbeObservedBody, ProbeRequest, ProbeRequestBody, } from '../core/schemas/port-messages.ts';
-export type { CommandTargetAuthorization, CommandTargetPolicy, ProbeTargetAuthorization, ProbeTargetPolicy, } from '../core/schemas/probe-policy.ts';
+export type { CommandTargetAuthorization, CommandTargetPolicy, McpTargetAuthorization, McpTargetPolicy, ProbeTargetAuthorization, ProbeTargetPolicy, } from '../core/schemas/probe-policy.ts';
 export type { ClockPort } from '../ports/clock-port.ts';
 export { clockReadParsers } from '../ports/clock-port.ts';
 export type { CorpusPort } from '../ports/corpus-port.ts';
@@ -24,5 +24,5 @@ export type { FileSystemPort } from '../ports/file-system-port.ts';
 export { fileReadParsers, fileWriteParsers, } from '../ports/file-system-port.ts';
 export type { BuiltSubject, ConformanceOutcome, ConformancePort, ConformanceReport, PortSubject, ScenarioKind, } from './conformance.ts';
 export { CONFORMANCE_OUTCOME_COUNTS, formatConformanceReport, runClockPortConformance, runCorpusPortConformance, runFileSystemPortConformance, } from './conformance.ts';
-export type { CommandProbeSubject, ProbeSubject } from './probe-conformance.ts';
-export { runCommandLineProbeConformance, runEnvironmentProbePortConformance, } from './probe-conformance.ts';
+export type { CommandProbeSubject, McpProbeSubject, ProbeSubject, } from './probe-conformance.ts';
+export { runCommandLineProbeConformance, runEnvironmentProbePortConformance, runMcpProbeConformance, } from './probe-conformance.ts';

package/dist/testing/index.js

@@ -16,4 +16,4 @@ export { corpusResolveParsers } from '../ports/corpus-port.js';
 export { probeParsers } from '../ports/environment-probe-port.js';
 export { fileReadParsers, fileWriteParsers, } from '../ports/file-system-port.js';
 export { CONFORMANCE_OUTCOME_COUNTS, formatConformanceReport, runClockPortConformance, runCorpusPortConformance, runFileSystemPortConformance, } from './conformance.js';
-export { runCommandLineProbeConformance, runEnvironmentProbePortConformance, } from './probe-conformance.js';
+export { runCommandLineProbeConformance, runEnvironmentProbePortConformance, runMcpProbeConformance, } from './probe-conformance.js';

package/dist/testing/probe-conformance.d.ts

@@ -4,24 +4,44 @@
  * since only it knows how its own interface-to-target mapping is wired.
  *
  * `runEnvironmentProbePortConformance` is the `api` arm: thirteen assertions,
- * every scenario HTTP (redirects, methods, schemes, an anomalous status).
- * `runCommandLineProbeConformance` is the `cli` arm, added once
- * `CommandTargetPolicy` gave the mechanism something to authorize: an
- * unmapped interface, an unmapped executable, an unauthorized subcommand path,
- * a non-zero exit read as an observation, a shell-metacharacter argument
- * proven to reach the process as one literal token rather than a shell
- * expansion, a declared artifact captured, and both caps enforced. The two
- * arms are separate functions rather than one, because their subjects need
+ * every scenario HTTP (an authorized target reached, an anomalous status read
+ * as an observation, an unmapped interface, four denied address classes, a
+ * method, a scheme, a redirect revalidated and refused, and three caps).
+ * `runCommandLineProbeConformance` is the `cli` arm: ten, over an authorized
+ * invocation, a non-zero exit read as an observation, an unmapped interface, an
+ * unmapped executable, an unauthorized subcommand path, an unpermitted
+ * environment key, a shell-metacharacter argument proven to reach the process
+ * as one literal token rather than a shell expansion, a declared artifact
+ * captured, and both caps.
+ * `runMcpProbeConformance` is the `mcp` arm: eight, over an authorized tool
+ * call, a tool-reported error read as an observation, an unmapped interface, an
+ * unauthorized tool, a declared argument proven to cross the JSON-RPC frame
+ * unchanged, the structured result the operation's descriptor describes, and
+ * both caps.
+ *
+ * Every field an authorization scopes owes a denial, which is the largest term
+ * in the three counts: an HTTP authorization scopes the interface, four
+ * address classes, the method and the scheme; a command authorization the
+ * interface, the executable, the subcommand path and the permitted environment
+ * keys; a tool-server authorization the interface and the tool. Each arm then adds the caps its
+ * mechanism can be made to exceed and the answers it has to read as
+ * observations.
+ *
+ * The arms are separate functions rather than one, because their subjects need
  * disjoint fixtures (an HTTP redirect chain has no command analogue, and a
- * subcommand allowlist has no HTTP one) and a subject presenting for one
- * mechanism is not asked to fake the other's scenarios.
+ * subcommand allowlist has no tool-call one) and a subject presenting for one
+ * mechanism is not asked to fake another's scenarios. What they do share is
+ * the machinery below `ArmAssertion`: one assertion shape generic over the
+ * subject type, one runner, one resolve-side checker and one call-count
+ * checker, so a fourth mechanism writes its subject and its list and nothing
+ * else.
  *
- * Each assertion in either arm builds its own `'resolves'` subject and reads
+ * Each assertion in every arm builds its own `'resolves'` subject and reads
  * `underlyingCalls()` from a counter starting at zero, so every count below is
  * absolute.
  */
 import type { ProbeRequest } from '../core/schemas/port-messages.ts';
-import type { CommandTargetPolicy, ProbeTargetPolicy } from '../core/schemas/probe-policy.ts';
+import type { CommandTargetPolicy, McpTargetPolicy, ProbeTargetPolicy } from '../core/schemas/probe-policy.ts';
 import type { ConformanceReport, PortSubject } from './conformance.ts';
 export type ProbeSubject = PortSubject<ProbeRequest> & {
     readonly policy: ProbeTargetPolicy;
@@ -72,6 +92,8 @@ export type CommandProbeSubject = PortSubject<ProbeRequest> & {
     readonly unmappedExecutableRequest: ProbeRequest;
     /** an interface-executable pair the policy names, with a subcommandPath no authorization for it permits. */
     readonly unauthorizedSubcommandRequest: ProbeRequest;
+    /** authorized in every other respect, declaring one environment key its authorization's permittedEnvironmentKeys omits. */
+    readonly unauthorizedEnvironmentKeyRequest: ProbeRequest;
     /** authorized, and answered by the fixture exiting non-zero. */
     readonly nonZeroExitRequest: ProbeRequest;
     /** authorized, carrying a shell-metacharacter value on one argument channel key. */
@@ -88,9 +110,64 @@ export type CommandProbeSubject = PortSubject<ProbeRequest> & {
     readonly overOutputRequest: ProbeRequest;
 };
 /**
- * Fifteen outcomes: the six shared assertions plus the nine above. Unlike the
+ * Sixteen outcomes: the six shared assertions plus the ten above. Unlike the
  * `api` arm, every cap here has an assertion: a command subject's fixture
  * script can be told to overrun a byte cap directly, with no oversize-request
  * problem to work around.
  */
 export declare function runCommandLineProbeConformance(subject: CommandProbeSubject): Promise<ConformanceReport>;
+/**
+ * The `mcp` arm's subject, on the division the other two draw: the subject
+ * knows how its own mapping is wired and what its fixture server answers, the
+ * suite only knows what each request should produce.
+ *
+ * Two of its requests carry a value the suite has to compare against
+ * something, so the subject publishes that value beside the request. Both
+ * comparisons read a scalar the tool returns rather than a collection: a check
+ * over an empty collection resolves to insufficient evidence, so an assertion
+ * spelled that way would report vacuous and could never witness a dropped
+ * argument or a dropped result.
+ */
+export type McpProbeSubject = PortSubject<ProbeRequest> & {
+    readonly policy: McpTargetPolicy;
+    /** a tool call the policy ALLOWS, against the subject's own fixture server. */
+    readonly authorizedRequest: ProbeRequest;
+    /** an interfaceId no authorization names. */
+    readonly unmappedInterfaceRequest: ProbeRequest;
+    /** an interfaceId the policy names, asking for a toolName its authorization omits. */
+    readonly unauthorizedToolRequest: ProbeRequest;
+    /** authorized, and answered by a tool result carrying the envelope's error flag AND the content the tool reported the failure with, since the assertion checks both survived. */
+    readonly errorResultRequest: ProbeRequest;
+    /** authorized, carrying a metacharacter-bearing value on one argument key. */
+    readonly argumentEchoRequest: ProbeRequest;
+    /** the exact literal `argumentEchoRequest` carries, so the assertion can confirm the tool received it byte for byte. */
+    readonly argumentEchoValue: string;
+    /** the structured-result key the fixture tool publishes that received value under. */
+    readonly argumentEchoResultKey: string;
+    /** authorized, and answered with the structured result the operation's descriptor describes. */
+    readonly structuredResultRequest: ProbeRequest;
+    /** the keys that result carries, so a dropped or emptied result channel fails. */
+    readonly structuredResultKeys: readonly string[];
+    /** authorized against a maxElapsedMs the server is made to answer past. */
+    readonly overElapsedRequest: ProbeRequest;
+    /** authorized against a maxOutputBytes the server is made to write past. */
+    readonly overResultBytesRequest: ProbeRequest;
+};
+/**
+ * Fourteen outcomes: the six shared assertions plus the eight above. Fewer
+ * than either other arm because a tool-server authorization scopes two fields:
+ * one session is opened against one server and every tool it offers belongs to
+ * that server, so the interface identifier is the server identity and the tool
+ * allowlist is the only thing left to deny on.
+ *
+ * Two rules the reference adapter follows are outside what a green run
+ * certifies, and an author reading this should know which. A JSON-RPC error
+ * answering `tools/call` is an observation on the same terms a tool-reported
+ * error is, and the byte cap applies to the server's own stderr as well as its
+ * stdout. Neither has an assertion here, because the derivation above gives
+ * each arm one denial per authorization-scoped field and one assertion per cap
+ * the suite can make a subject exceed, and both of these are a second spelling
+ * of an assertion the arm already carries. The reference adapter's own tests
+ * cover both.
+ */
+export declare function runMcpProbeConformance(subject: McpProbeSubject): Promise<ConformanceReport>;