toolnexus 0.25.0 → 0.26.0

package/src/client.ts

@@ -227,6 +227,12 @@ export type MetricEvent =
       promptTokens: number
       completionTokens: number
       error?: string
+      /** L1: how many questions were asked. */
+      questions: number
+      /** L1: sha256 hex of `canonicalRequest(model, questions)` ("" when unencodable). */
+      questionsHash: string
+      /** True when the decision came from the classifier cache and no request was sent. */
+      cached: boolean
     }
   // `warning`, never `error`: a degenerate-criteria report is advisory, and a consumer that
   // counts "has an error" as a failure must not count this.

package/src/judge.ts

@@ -12,8 +12,10 @@ import {
   Decision,
   type DecisionAnswer,
   type NoulCriteria,
-  type Question,
+  type AnyQuestion,
   type RecordedDecision,
+  isRawAnswer,
+  raw as rawQ,
   noul as noulQ,
   choice as choiceQ,
   score as scoreQ,
@@ -25,7 +27,7 @@ import type { Request } from "./types.js"
 /** One named question of an ordered question list. */
 export interface NamedQuestion {
   name: string
-  question: Question
+  question: AnyQuestion
 }
 
 /** `noul` question with a name. Name the state field it judges in `instructions`. */
@@ -41,9 +43,15 @@ export function score(name: string, instructions: string, levels: string[]): Nam
   return { name, question: scoreQ(instructions, levels) }
 }
 
+/** A raw question with a name: a System One type the library does not model (e.g. `box`), sent
+ * as written. Its answer decodes to a raw answer `{type, value}`. */
+export function raw(name: string, type: string, instructions: string, criteria?: unknown): NamedQuestion {
+  return { name, question: rawQ(type, instructions, criteria) }
+}
+
 /** Ordered list -> the §8B questions map. A duplicate name is an error naming it. */
-export function questionMap(questions: readonly NamedQuestion[]): Record<string, Question> {
-  const out: Record<string, Question> = {}
+export function questionMap(questions: readonly NamedQuestion[]): Record<string, AnyQuestion> {
+  const out: Record<string, AnyQuestion> = {}
   for (const { name, question } of questions) {
     if (Object.prototype.hasOwnProperty.call(out, name)) throw new Error(`duplicate question name ${JSON.stringify(name)}`)
     out[name] = question
@@ -93,6 +101,13 @@ function noulBand(p: number, b: Bands): Band {
 }
 
 function wrap(a: DecisionAnswer, b: Bands): Answer {
+  if (isRawAnswer(a)) {
+    // An unmodelled answer type is never sure: there is no number to band.
+    const out = { ...(a as object), sure: false } as Answer
+    Object.defineProperty(out, "value", { value: () => 0, enumerable: false })
+    Object.defineProperty(out, "pick", { value: () => "", enumerable: false })
+    return out
+  }
   const extra =
     a.type === "noul"
       ? { band: noulBand(a.noul, b) }

package/src/serve.ts

@@ -233,6 +233,13 @@ export async function startA2AServer(opts: StartServerOptions): Promise<ServeHan
     // per request (stateless — sessionIdGenerator undefined). Checked first so
     // `/mcp` is never shadowed by the A2A POST handler.
     if (mcp && req.url && (req.url === "/mcp" || req.url.startsWith("/mcp?"))) {
+      // Stateless profile: no server-initiated SSE stream exists, so only POST is
+      // served. Refuse anything else at once (§7C) instead of holding a GET open.
+      if (req.method !== "POST") {
+        res.writeHead(405, { Allow: "POST" })
+        res.end()
+        return
+      }
       void (async () => {
         const body = req.method === "POST" ? await readBody(req) : ""
         const parsed = body ? safeJson(body) : undefined