mkbundle 0.2.0__tar.gz → 1.1.21__tar.gz

{mkbundle-0.2.0 → mkbundle-1.1.21}/.gitignore

@@ -10,6 +10,7 @@ build/
 .ruff_cache/
 .pytest_cache/
 .coverage
+web/app/coverage/
 htmlcov/
 
 # Node (web/)
@@ -34,6 +35,10 @@ deploy/backups/
 # Runtime state
 .mklang-platform/
 *.db
+# SQLite in WAL mode, which is what the BFF's session store asks for: running the
+# service or its tests leaves these two beside the ignored database.
+*.db-wal
+*.db-shm
 *.sqlite3
 run-artifacts/
 
@@ -41,3 +46,6 @@ run-artifacts/
 .DS_Store
 .idea/
 .vscode/
+
+# The site pin is data the host pulls — tracked on purpose (deploy-site.yml writes it).
+!deploy/pins/caddy.env

{mkbundle-0.2.0 → mkbundle-1.1.21}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: mkbundle
-Version: 0.2.0
+Version: 1.1.21
 Summary: Build, validate and sign bundles (ADR 0008)
 License-Expression: Apache-2.0
 License-File: LICENSE

{mkbundle-0.2.0 → mkbundle-1.1.21}/README.md

@@ -1,11 +1,18 @@
 # mkbundle — bundle build and validation
 
 The gate between authoring and everything downstream. A bundle that fails here never
-becomes a deployment candidate ([ADR 0008](../../docs/adr/0008-bundles-and-pull-based-deployment.md)).
+becomes a deployment candidate ([ADR 0008](../../docs/adr/0008-bundles-and-pull-based-deployment.md));
+one that passes is what [`mkctl bundle push`](../mkctl/README.md) registers and uploads.
 
 ```
 mkbundle validate <path>...          a workflow, connector manifest, or bundle manifest
-mkbundle build <src> -o <out>        validate a source tree and archive it
+                                     (--kind to skip detection and name the schema)
+mkbundle validate-connectors <dir>   validate every connector manifest in a deployment
+                                     manifest set before a bundle is signed
+mkbundle build <src> -o <out>        validate a source tree and archive it; `-o` is
+                                     `--output`, and omitting it validates without writing.
+                                     A target without a .tar.gz suffix is a directory
+                                     (created if missing); the archive is named in it
 mkbundle inspect <archive>           the manifest and digest of a built bundle
 mkbundle verify <archive>            its signature, and its files against the manifest
 ```
@@ -30,8 +37,9 @@ what actually validated the bundle; an observed one cannot.
 
 ## Identity
 
-A bundle's identity is the sha256 of its canonicalized manifest. Three fields are
-outside that canonical form:
+A bundle's identity is the sha256 of its canonicalized manifest — computed by
+[`mkp-contracts`](../../packages/mkp-contracts/README.md), which is also what the control
+plane recomputes it with. Three fields are outside that canonical form:
 
 | Field       | Why                                                                                     |
 | ----------- | --------------------------------------------------------------------------------------- |
@@ -52,23 +60,24 @@ no filename in the gzip header — so identical content also produces identical
 Schema validation is the shape. These are the rules, and they are build-time because
 each is answerable from the bundle alone (`schema/README.md`):
 
-| Rule                         | What it catches                                          |
-| ---------------------------- | -------------------------------------------------------- |
-| `missing-idempotency-key`    | An `effect: write` action with no key — see below        |
-| `machine-missing`            | An mklang step pointing outside the bundle               |
-| `machine-check`              | A machine `mklang check` rejects                         |
-| `spec-mismatch`              | Machines targeting different language spec versions      |
-| `undeclared-connection`      | A connection used but not in `requires`                  |
-| `undeclared-secret`          | A secretRef used but not in `requires`                   |
-| `unknown-connector`          | A connector not pinned in `lock.connectors`              |
-| `connector-version-mismatch` | A pin that disagrees with the catalog                    |
-| `unknown-action`             | An action the connector manifest does not have           |
-| `duplicate-step-id`          | Two steps sharing an id within a workflow                |
-| `wait-declares-both`         | A `wait` with both `duration` and `until_event`          |
-| `wait-declares-nothing`      | A `wait` with neither, so nothing says what it waits for |
-| `machine-gate-unresolvable`  | A machine gating on a hook the platform cannot answer    |
-| `duplicate-workflow-name`    | Two workflows sharing a name within the bundle           |
-| `schema`                     | A document that does not match its contract              |
+| Rule                              | What it catches                                                                                                                               |
+| --------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- |
+| `missing-idempotency-key`         | An `effect: write` action with no key — see below                                                                                             |
+| `machine-missing`                 | An mklang step pointing outside the bundle                                                                                                    |
+| `machine-check`                   | A machine `mklang check` rejects                                                                                                              |
+| `spec-mismatch`                   | Machines targeting different language spec versions                                                                                           |
+| `undeclared-connection`           | A connection used but not in `requires`                                                                                                       |
+| `undeclared-secret`               | A secretRef used but not in `requires`                                                                                                        |
+| `unknown-connector`               | A connector not pinned in `lock.connectors`                                                                                                   |
+| `connector-version-mismatch`      | A pin that disagrees with the catalog                                                                                                         |
+| `unknown-action`                  | An action the connector manifest does not have                                                                                                |
+| `duplicate-step-id`               | Two steps sharing an id within a workflow                                                                                                     |
+| `wait-declares-both`              | A `wait` with both `duration` and `until_event`                                                                                               |
+| `wait-declares-nothing`           | A `wait` with neither, so nothing says what it waits for                                                                                      |
+| `connector-timeout-out-of-bounds` | A connector step `timeout` above 300 s, zero, or not a duration ([ADR 0033](../../docs/adr/0033-a-connector-step-timeout-bounds-its-call.md)) |
+| `machine-gate-unresolvable`       | A machine gating on a hook the platform cannot answer                                                                                         |
+| `duplicate-workflow-name`         | Two workflows sharing a name within the bundle                                                                                                |
+| `schema`                          | A document that does not match its contract                                                                                                   |
 
 `missing-idempotency-key` is the one that matters most. Durable execution is
 at-least-once for external effects ([ADR 0009](../../docs/adr/0009-durable-execution-engine.md)

{mkbundle-0.2.0 → mkbundle-1.1.21}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "mkbundle"
-version = "0.2.0"
+version = "1.1.21"
 description = "Build, validate and sign bundles (ADR 0008)"
 license = "Apache-2.0"
 license-files = ["LICENSE"]

{mkbundle-0.2.0 → mkbundle-1.1.21}/src/mkbundle/__init__.py

@@ -9,4 +9,4 @@ that name belongs to its roles, its settings and its services rather than to one
 its tools.
 """
 
-__version__ = "0.1.0"
+__version__ = "1.1.21"

{mkbundle-0.2.0 → mkbundle-1.1.21}/src/mkbundle/build.py

@@ -186,12 +186,10 @@ def _assemble(
     spec_versions = sorted(set(specs.values()))
     if not spec_versions:
         declared_spec = bundle.declared.get("lock", {}).get("spec")
-        if not declared_spec:
-            raise BuildError(
-                "the bundle has no machines, so `lock.spec` cannot be observed — "
-                "declare it in bundle.yaml or add a machine"
-            )
-        spec_versions = [str(declared_spec)]
+        # An explicit no-workload bundle has no machine from which to observe a spec.
+        # Keep its identity deterministic without making ordinary source manifests
+        # declare a produced lock field.
+        spec_versions = [str(declared_spec or "0.3")]
 
     contents: dict[str, Any] = {
         "workflows": [_file_entry(bundle, p) for p in bundle.workflows],
@@ -232,7 +230,14 @@ def _write_archive(
     archive is what makes "nothing is rebuilt on promote" checkable rather than
     merely asserted.
     """
-    target = output / f"{bundle.project}-{digest[:12]}.tar.gz" if output.is_dir() else output
+    # A target without a suffix is a directory to fill, not a file to write:
+    # `-o out/` loses its trailing slash inside Path, so on a fresh checkout
+    # `is_dir()` alone wrote a single extensionless file named `out`.
+    if output.is_dir() or not output.suffix:
+        output.mkdir(parents=True, exist_ok=True)
+        target = output / f"{bundle.project}-{digest[:12]}.tar.gz"
+    else:
+        target = output
     target.parent.mkdir(parents=True, exist_ok=True)
 
     full_manifest = json.dumps(

{mkbundle-0.2.0 → mkbundle-1.1.21}/src/mkbundle/cli.py

@@ -1,4 +1,4 @@
-"""The `mkp` command line.
+"""The `mkbundle` command line.
 
 Three verbs: validate a document, build a bundle, inspect a built one. One tool
 rather than a builder and a separate validator, because the rules would otherwise
@@ -17,6 +17,7 @@ from mkp_contracts import schemas
 from mkp_contracts.canonical import manifest_digest
 
 from . import build as build_module
+from .catalog import load as load_catalog
 from .errors import BuildError, Report
 
 
@@ -34,15 +35,19 @@ def main(argv: list[str] | None = None) -> int:
     subparsers = parser.add_subparsers(dest="command", required=True)
 
     validate = subparsers.add_parser(
-        "validate", help="validate a workflow, connector manifest, or bundle manifest"
+        "validate", help="validate a workflow, connector, bundle, or report manifest"
     )
     validate.add_argument("paths", nargs="+", type=Path)
     validate.add_argument(
         "--kind",
-        choices=schemas.KINDS,
+        choices=schemas.DOCUMENT_KINDS,
         help="skip detection and validate against this schema",
     )
 
+    subparsers.add_parser(
+        "validate-connectors", help="validate every connector manifest in a manifest set"
+    ).add_argument("directory", type=Path)
+
     build = subparsers.add_parser("build", help="validate a bundle source tree and archive it")
     build.add_argument("src", type=Path)
     build.add_argument(
@@ -72,6 +77,8 @@ def main(argv: list[str] | None = None) -> int:
     try:
         if args.command == "validate":
             return _validate(args)
+        if args.command == "validate-connectors":
+            return _validate_connectors(args)
         if args.command == "build":
             return _build(args)
         if args.command == "verify":
@@ -101,6 +108,31 @@ def _validate(args: argparse.Namespace) -> int:
     return _report(report, args.format, ok_message=f"{len(args.paths)} document(s) valid")
 
 
+def _validate_connectors(args: argparse.Namespace) -> int:
+    report = Report()
+    try:
+        manifests = load_catalog(args.directory)
+    except BuildError as exc:
+        report.fail("connector-manifests", str(exc), path=str(args.directory))
+        return _report(report, args.format, ok_message="connector manifests valid")
+    if not manifests:
+        report.fail(
+            "empty-connector-manifests",
+            "no connector manifests found",
+            path=str(args.directory),
+        )
+    for name, connector in manifests.items():
+        document = schemas.load_document(connector.path)
+        report.extend(schemas.validate_document(document, "connector", path=str(connector.path)))
+        if connector.path.parent.name != name:
+            report.fail(
+                "catalog-name-mismatch",
+                f"manifest name {name!r} does not match its directory",
+                path=str(connector.path),
+            )
+    return _report(report, args.format, ok_message=f"{len(manifests)} connector manifest(s) valid")
+
+
 def _build(args: argparse.Namespace) -> int:
     connectors = args.connectors
     if connectors is None:
@@ -195,7 +227,7 @@ def _emit_error(message: str, output_format: str) -> None:
     if output_format == "json":
         print(json.dumps({"ok": False, "error": message}, indent=2))
     else:
-        print(f"mkp: {message}", file=sys.stderr)
+        print(f"mkbundle: {message}", file=sys.stderr)
 
 
 if __name__ == "__main__":

{mkbundle-0.2.0 → mkbundle-1.1.21}/src/mkbundle/rules.py

@@ -18,7 +18,9 @@ from pathlib import Path
 from typing import Any
 
 import yaml
+from mkp_contracts import connectors as connector_contracts
 from mkp_contracts import expressions, gates
+from mkp_contracts.capabilities import machine_tool_refusal
 
 from .catalog import Connector
 from .errors import Report
@@ -101,6 +103,7 @@ def check_workflow(
     _declared_names(workflow, path, declared_connections, declared_secrets, report)
     _connector_actions(steps, path, connector_pins, catalog, report)
     _waits_are_decidable(steps, path, report)
+    _connector_timeouts_within_cap(steps, path, report)
     _expressions_are_evaluable(workflow, path, report)
     _schedule_can_satisfy_inputs(workflow, path, report)
 
@@ -212,6 +215,28 @@ def _waits_are_decidable(
             )
 
 
+def _connector_timeouts_within_cap(
+    steps: list[tuple[dict[str, Any], str]], path: str, report: Report
+) -> None:
+    """A connector step's `timeout` bounds its HTTP call, up to the platform cap (ADR 0033).
+
+    Refused here rather than clamped at run time: a bundle asking for more than the cap is
+    a bundle whose author expects a call the runner will not wait for. The runner refuses
+    the same step terminally, because a bundle signed before this rule is still loadable.
+    """
+    for step, location in steps:
+        if step.get("kind") != "connector" or "timeout" not in step:
+            continue
+        refusal = connector_contracts.connector_timeout_refusal(step["timeout"])
+        if refusal:
+            report.fail(
+                "connector-timeout-out-of-bounds",
+                f"step {step.get('id')!r}: {refusal}",
+                path=path,
+                location=f"{location}.timeout",
+            )
+
+
 def _step_ids_unique(steps: list[tuple[dict[str, Any], str]], path: str, report: Report) -> None:
     seen: dict[str, str] = {}
     for step, location in steps:
@@ -372,6 +397,13 @@ def check_machine_gates(text: str, path: str) -> Report:
     for state_id, state in states.items():
         if not isinstance(state, dict):
             continue
+        if state.get("tool") is not None:
+            report.fail(
+                "machine-tool-forbidden",
+                machine_tool_refusal(str(state["tool"])),
+                path=path,
+                location=f"states.{state_id}.tool",
+            )
         for index, gate in enumerate(state.get("gates") or []):
             if not isinstance(gate, dict):
                 continue

{mkbundle-0.2.0 → mkbundle-1.1.21}/tests/conftest.py

@@ -29,6 +29,24 @@ def valid_bundle() -> Path:
     return VALID
 
 
+@pytest.fixture
+def empty_bundle(tmp_path: Path) -> Path:
+    root = tmp_path / "empty"
+    (root / "workflows").mkdir(parents=True)
+    (root / "machines").mkdir()
+    (root / "assets").mkdir()
+    (root / "bundle.yaml").write_text(
+        "schema_version: 1\n"
+        "project: empty\n"
+        "lock:\n"
+        "  connectors: {}\n"
+        "requires:\n"
+        "  connections: []\n",
+        encoding="utf-8",
+    )
+    return root
+
+
 @pytest.fixture
 def variant(tmp_path: Path) -> Callable[[Callable[[Path], None]], Path]:
     """A copy of the valid bundle with one thing changed."""

{mkbundle-0.2.0 → mkbundle-1.1.21}/tests/fixtures/connectors/microsoft-graph/connector.yaml

@@ -12,7 +12,7 @@ egress:
 auth:
   kind: oauth2_authcode
   authorize_url: https://login.microsoftonline.com/common/oauth2/v2.0/authorize
-  token_url: https://login.microsoftonline.com/common/oauth2/v2.0/token
+  token_url: https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token
   scopes:
     - Mail.ReadWrite
     - Mail.Send

{mkbundle-0.2.0 → mkbundle-1.1.21}/tests/test_build.py

@@ -19,6 +19,16 @@ def test_valid_bundle_builds(valid_bundle: Path, connectors: Path) -> None:
     assert len(result.digest) == 64
 
 
+def test_explicit_empty_bundle_builds(empty_bundle: Path, connectors: Path) -> None:
+    """An organisation with no enabled plugins still needs a signed deployable pointer."""
+    result = build_module.build(empty_bundle, connectors_dir=connectors)
+
+    assert result.report.ok, [str(f) for f in result.report.failures]
+    assert result.manifest["contents"]["workflows"] == []
+    assert result.manifest["contents"]["machines"] == []
+    assert result.manifest["lock"]["spec"] == "0.3"
+
+
 def test_manifest_records_what_the_build_observed(valid_bundle: Path, connectors: Path) -> None:
     manifest = build_module.build(valid_bundle, connectors_dir=connectors).manifest
 
@@ -93,3 +103,16 @@ def test_without_a_catalog_the_skipped_rules_are_named(valid_bundle: Path) -> No
 
     assert result.report.ok
     assert any("missing-idempotency-key" in rule for rule in result.report.skipped_rules)
+
+
+def test_a_directory_output_that_does_not_exist_yet_is_still_a_directory(
+    valid_bundle: Path, connectors: Path, tmp_path: Path
+) -> None:
+    """`-o out/` on a fresh checkout used to write a single extensionless file
+    named `out` — Path drops the trailing slash, so `is_dir()` was the only
+    signal and a not-yet-created directory failed it."""
+    out = tmp_path / "out"
+    result = build_module.build(valid_bundle, connectors_dir=connectors, output=out)
+    assert result.archive is not None
+    assert result.archive.parent == out
+    assert result.archive.name.endswith(".tar.gz")

mkbundle-1.1.21/tests/test_machine_capabilities.py

@@ -0,0 +1,15 @@
+"""Build-time capability admission uses the runner's closed policy."""
+
+import pytest
+
+from mkbundle.rules import check_machine_gates
+
+
+@pytest.mark.parametrize("tool", ["read_file", "write_file", "calc", "search", "plugin"])
+def test_machine_tool_is_refused_at_build_time(tool):
+    report = check_machine_gates(f"states:\n  read:\n    tool: {tool}\n", "machine.mkl")
+    assert not report.ok
+
+
+def test_judgement_machine_remains_valid():
+    assert check_machine_gates("states:\n  decide:\n    execution: classify\n", "m.mkl").ok

{mkbundle-0.2.0 → mkbundle-1.1.21}/tests/test_rules.py

@@ -79,6 +79,22 @@ def test_undeclared_connection_fails(
     assert "undeclared-connection" in rules_broken(variant(undeclare), connectors)
 
 
+def test_an_mklang_connection_must_be_declared(
+    variant: Callable[[Callable[[Path], None]], Path], connectors: Path
+) -> None:
+    def add_mklang_connection(root: Path) -> None:
+        def mutate(document: dict) -> None:
+            for step in document["steps"]:
+                if step.get("kind") == "mklang":
+                    step["connection"] = "llm"
+                    return
+            raise AssertionError("no mklang step")
+
+        edit_yaml(root / "workflows" / "triage.yaml", mutate)
+
+    assert "undeclared-connection" in rules_broken(variant(add_mklang_connection), connectors)
+
+
 def test_undeclared_secret_fails(
     variant: Callable[[Callable[[Path], None]], Path], connectors: Path
 ) -> None:
@@ -184,6 +200,34 @@ def test_a_wait_with_one_of_the_two_is_accepted(
     assert not {"wait-declares-both", "wait-declares-nothing"} & broken
 
 
+def _connector_timeout(duration: str) -> Callable[[Path], None]:
+    def declare(root: Path) -> None:
+        def mutate(document: dict) -> None:
+            step = document["steps"][0]
+            assert step["kind"] == "connector"
+            step["timeout"] = duration
+
+        edit_yaml(root / "workflows" / "triage.yaml", mutate)
+
+    return declare
+
+
+def test_a_connector_timeout_above_the_cap_fails(
+    variant: Callable[[Callable[[Path], None]], Path], connectors: Path
+) -> None:
+    """ADR 0033: refused where it is written, not clamped where nobody sees it. A bundle
+    asking for ten minutes would otherwise get five, and learn it from a failed run."""
+    broken = rules_broken(variant(_connector_timeout("PT600S")), connectors)
+    assert "connector-timeout-out-of-bounds" in broken
+
+
+def test_a_connector_timeout_within_the_cap_is_accepted(
+    variant: Callable[[Callable[[Path], None]], Path], connectors: Path
+) -> None:
+    broken = rules_broken(variant(_connector_timeout("PT120S")), connectors)
+    assert "connector-timeout-out-of-bounds" not in broken
+
+
 def test_malformed_workflow_fails_on_schema(
     variant: Callable[[Callable[[Path], None]], Path], connectors: Path
 ) -> None:

mkbundle-1.1.21/tests/test_validate.py

@@ -0,0 +1,126 @@
+"""Schema validation, and the worked examples the schemas ship with.
+
+`schema/README.md` says the examples are fixtures used by the validator tests.
+This is that claim, made true.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+from mkp_contracts import schemas
+
+from mkbundle.cli import main
+
+EXAMPLES = {
+    "workflow-triage-inbound.yaml": "workflow",
+    "connector-slack.yaml": "connector",
+    "bundle.json": "bundle",
+    "report-manifest.json": "report_manifest",
+}
+
+
+@pytest.mark.parametrize(("filename", "kind"), sorted(EXAMPLES.items()))
+def test_worked_examples_validate(filename: str, kind: str) -> None:
+    path = schemas.schema_dir() / "examples" / filename
+    document = schemas.load_document(path)
+
+    assert schemas.detect_kind(document) == kind
+    report = schemas.validate_document(document, kind, path=filename)
+    assert report.ok, [str(f) for f in report.failures]
+
+
+def test_kind_detection_needs_no_annotation() -> None:
+    assert schemas.detect_kind({"steps": []}) == "workflow"
+    assert schemas.detect_kind({"actions": {}, "auth": {}}) == "connector"
+    assert schemas.detect_kind({"contents": {}, "lock": {}}) == "bundle"
+    assert schemas.detect_kind({"run_id": "r", "claims": [], "sources": []}) == "report_manifest"
+    assert schemas.detect_kind({"unrelated": True}) is None
+
+
+def test_workflow_repeat_requires_a_bound_and_decidable_loop() -> None:
+    document = {
+        "schema_version": 1,
+        "name": "revision_loop",
+        "steps": [
+            {
+                "id": "review_loop",
+                "kind": "repeat",
+                "until": "{{ steps.review.result.done == true }}",
+                "max_iterations": 3,
+                "steps": [
+                    {"id": "review", "kind": "wait", "duration": "PT1S"},
+                ],
+            }
+        ],
+    }
+
+    report = schemas.validate_document(document, "workflow", path="repeat.yaml")
+    assert report.ok, [str(f) for f in report.failures]
+
+
+def test_cli_validate_accepts_the_examples() -> None:
+    examples = schemas.schema_dir() / "examples"
+    assert main(["validate", *[str(p) for p in sorted(examples.iterdir())]]) == 0
+
+
+def test_cli_validate_rejects_a_broken_document(tmp_path: Path) -> None:
+    broken = tmp_path / "workflow.yaml"
+    broken.write_text("schema_version: 1\nname: no_steps\nsteps: []\n")
+
+    assert main(["validate", str(broken)]) == 1
+
+
+def test_cli_reports_a_document_it_cannot_place(tmp_path: Path) -> None:
+    unknown = tmp_path / "thing.yaml"
+    unknown.write_text("some: value\n")
+
+    assert main(["validate", str(unknown)]) == 1
+
+
+def test_validate_connectors_checks_every_manifest(tmp_path: Path) -> None:
+    connector = tmp_path / "alpha"
+    connector.mkdir()
+    (connector / "connector.yaml").write_text(
+        "schema_version: 1\n"
+        "name: alpha\n"
+        "version: 1\n"
+        "title: Alpha\n"
+        "auth:\n  kind: none\n"
+        "actions:\n"
+        "  ping:\n"
+        "    summary: Ping\n"
+        "    method: GET\n"
+        "    path: /ping\n"
+        "    effect: read\n",
+        encoding="utf-8",
+    )
+
+    assert main(["validate-connectors", str(tmp_path)]) == 0
+
+
+def test_validate_connectors_fails_on_empty_directory(tmp_path: Path) -> None:
+    assert main(["validate-connectors", str(tmp_path)]) == 1
+
+
+def test_validate_connectors_refuses_a_url_from_input_that_writes(tmp_path: Path) -> None:
+    """ADR 0032: the builder refuses what the runner would refuse at load."""
+    connector = tmp_path / "alpha"
+    connector.mkdir()
+    (connector / "connector.yaml").write_text(
+        "schema_version: 1\n"
+        "name: alpha\n"
+        "version: 1\n"
+        "title: Alpha\n"
+        "auth:\n  kind: none\n"
+        "actions:\n"
+        "  fetch:\n"
+        "    summary: Fetch\n"
+        "    method: POST\n"
+        "    url_from_input: target\n"
+        "    effect: read\n",
+        encoding="utf-8",
+    )
+
+    assert main(["validate-connectors", str(tmp_path)]) == 1

{mkbundle-0.2.0 → mkbundle-1.1.21}/tests/test_version.py

@@ -18,3 +18,15 @@ def test_version_prints_the_installed_version(capsys: pytest.CaptureFixture[str]
     # parser's `prog` was `mkp`, `--version` printed it, and the test agreed. `mkp` is
     # the product namespace and never a tool's name (README.md §Stack).
     assert out.strip() == f"mkbundle {importlib.metadata.version('mkbundle')}"
+
+
+def test_errors_speak_in_the_tools_own_name(capsys: pytest.CaptureFixture[str], tmp_path) -> None:
+    # The error path missed the 2026-08-07 rename: `--version` said mkbundle while a
+    # failed build still said `mkp:`. Same rule, other stream.
+    not_a_bundle = tmp_path / "not-a-bundle.tar.gz"
+    not_a_bundle.write_bytes(b"not a gzip at all")
+    code = main(["inspect", str(not_a_bundle)])
+    assert code == 2
+    err = capsys.readouterr().err
+    assert err.startswith("mkbundle: ")
+    assert "mkp:" not in err

{mkbundle-0.2.0 → mkbundle-1.1.21}/uv.lock

@@ -58,7 +58,7 @@ wheels = [
 
 [[package]]
 name = "mkbundle"
-version = "0.2.0"
+version = "1.1.21"
 source = { editable = "." }
 dependencies = [
     { name = "mkp-contracts" },
@@ -85,7 +85,7 @@ dev = [
 
 [[package]]
 name = "mkp-contracts"
-version = "0.2.0"
+version = "1.1.21"
 source = { editable = "../../packages/mkp-contracts" }
 dependencies = [
     { name = "jsonschema" },

mkbundle-0.2.0/tests/test_validate.py

@@ -1,56 +0,0 @@
-"""Schema validation, and the worked examples the schemas ship with.
-
-`schema/README.md` says the examples are fixtures used by the validator tests.
-This is that claim, made true.
-"""
-
-from __future__ import annotations
-
-from pathlib import Path
-
-import pytest
-from mkp_contracts import schemas
-
-from mkbundle.cli import main
-
-EXAMPLES = {
-    "workflow-triage-inbound.yaml": "workflow",
-    "connector-slack.yaml": "connector",
-    "bundle.json": "bundle",
-}
-
-
-@pytest.mark.parametrize(("filename", "kind"), sorted(EXAMPLES.items()))
-def test_worked_examples_validate(filename: str, kind: str) -> None:
-    path = schemas.schema_dir() / "examples" / filename
-    document = schemas.load_document(path)
-
-    assert schemas.detect_kind(document) == kind
-    report = schemas.validate_document(document, kind, path=filename)
-    assert report.ok, [str(f) for f in report.failures]
-
-
-def test_kind_detection_needs_no_annotation() -> None:
-    assert schemas.detect_kind({"steps": []}) == "workflow"
-    assert schemas.detect_kind({"actions": {}, "auth": {}}) == "connector"
-    assert schemas.detect_kind({"contents": {}, "lock": {}}) == "bundle"
-    assert schemas.detect_kind({"unrelated": True}) is None
-
-
-def test_cli_validate_accepts_the_examples() -> None:
-    examples = schemas.schema_dir() / "examples"
-    assert main(["validate", *[str(p) for p in sorted(examples.iterdir())]]) == 0
-
-
-def test_cli_validate_rejects_a_broken_document(tmp_path: Path) -> None:
-    broken = tmp_path / "workflow.yaml"
-    broken.write_text("schema_version: 1\nname: no_steps\nsteps: []\n")
-
-    assert main(["validate", str(broken)]) == 1
-
-
-def test_cli_reports_a_document_it_cannot_place(tmp_path: Path) -> None:
-    unknown = tmp_path / "thing.yaml"
-    unknown.write_text("some: value\n")
-
-    assert main(["validate", str(unknown)]) == 1