v0.1.13: NFIP paging fix + dataframe_query truncation disclosure

NFIP paging fix + dataframe_query truncation disclosure

Large NFIP canvas queries now page 5x faster; capped SQL results disclose truncation with continuation guidance.

Fixed:

• fema_search_nfip: canvas PAGE_SIZE raised 1,000 → 5,000 — a ~49,785-row query now completes in ~10 fetches instead of ~50, well inside typical transport timeouts (#16)
• fema_dataframe_query: capped results now disclose truncated/shown/cap in structuredContent and a LIMIT/OFFSET continuation notice in content[]; rows/query descriptions corrected (#19)

81 tests pass; bun run devcheck clean.

CHANGELOG v0.1.13

v0.1.12: declaration-level pagination + rendering fixes

declaration-level pagination + rendering fixes

fema_search_disasters now reports true declaration counts; two content[] rendering gaps fixed.

Added:

• fema_search_disasters: total_declarations — distinct-declaration count before offset/limit paging (#17)

Changed:

• fema_search_disasters: ctx.enrich.total() now reports unique declarations instead of raw area-rows; header reads "N of T unique declaration(s)" (#17)

Fixed:

• fema_query_dataset: format() rendered only the first 6 fields per row past 50 results — all selected fields now render (#18)
• fema_get_housing_assistance: disaster number was dropped from content[] for sparse records missing state, in both owner and renter sections (#20)

Dependencies:

• @cyanheads/mcp-ts-core ^0.10.10 → ^0.10.14
• packageManager bun@1.3.11 → bun@1.3.14
• Supply-chain hardening: bunfig minimumReleaseAge hold, Socket install scanner, SECURITY.md

78 tests pass; bun run devcheck clean.

CHANGELOG v0.1.12

v0.1.11: Typed error contracts on canvas + service throw sites

Typed error contracts on canvas + service throw sites

Two-issue fix batch closing gaps between declared error contracts and what tools actually return.

Fixed:

• fema_dataframe_describe / fema_dataframe_query throw a typed canvas_unavailable ServiceUnavailable error instead of an untyped InternalError when DataCanvas is disabled, with a recovery hint pointing at fema_search_nfip / fema_query_dataset (#14)
• OpenFemaService.fetchDataset surfaces declared recovery hints for unknown_dataset and invalid_filter at the throw site; the raw upstream name field is dropped from invalid_filter error data (#15)

75 tests pass; bun run devcheck clean.

v0.1.10: State validation, declaration-type fixes, audit clean

State validation, declaration-type fixes, audit clean

Three-issue fix batch plus a routine mcp-ts-core bump that clears the dependency audit.

Changed:

• fema_search_nfip zip_code tightened to exactly 5 digits

Fixed:

• Declaration-type render prefixes — fema_search_disasters and fema_get_disaster render the real declaration_type (FM-, EM-, DR-) instead of a hardcoded DR-; PA and housing tools use a type-agnostic Disaster # label (#11)
• invalid_state validation now consistent across all four state-scoped tools — fema_get_public_assistance, fema_get_housing_assistance, fema_search_nfip (#12)
• fema_search_nfip throws no_results instead of a silent 0-of-0 success (#13)

Security:

• bun audit 7 → 0 advisories — hono resolved to 4.12.27 (1 high, 4 moderate CORS/GHSA advisories cleared), transitive esbuild resolution dropped (1 low advisory cleared)

Dependency bumps:

• @cyanheads/mcp-ts-core ^0.10.9 → ^0.10.10
• @biomejs/biome ^2.5.0 → ^2.5.2
• @types/node ^26.0.0 → ^26.1.0
• tsc-alias ^1.8.17 → ^1.9.0

73 tests pass; bun run devcheck clean.

v0.1.9: mcp-ts-core ^0.10.9 adoption

mcp-ts-core ^0.10.9 adoption

Maintenance release picking up the framework upgrade: two Canvas fixes, two new devcheck guards, and a dependency refresh.

Fixed:

• Canvas describe({ tableName }) — filtered describe no longer raises a DuckDB Binder Error on ambiguous table_name (mcp-ts-core #235).
• Canvas SQL gate — a SELECT-shaped statement that fails to prepare (bad column/function) now throws invalid_sql with the binder detail instead of non_select_statement (mcp-ts-core #236).

Added:

• check-dependency-specifiers devcheck step — fails on floating specifiers (latest, *, pre-release tags) in package.json and bun.lock workspaces (mcp-ts-core #246).
• Plugin marketplace manifest checks in lint-packaging.ts, gated by packaging.pluginManifests (mcp-ts-core #240).

Dependency bumps:

• @cyanheads/mcp-ts-core ^0.10.6 → ^0.10.9
• @duckdb/node-api ^1.5.3-r.3 → ^1.5.4-r.1
• @biomejs/biome ^2.4.16 → ^2.5.0
• @types/node ^25.9.3 → ^26.0.0
• vitest ^4.1.8 → ^4.1.9

63 tests pass; bun run devcheck clean.

v0.1.8: mcp-ts-core ^0.10.6 adoption

mcp-ts-core ^0.10.6 adoption

Maintenance release adopting the framework upgrade: server identity fields, capped-result disclosure, and the post-pack bundle cleaner.

Added:

• totalCount enrichment on the four capped-list tools (fema_search_disasters, fema_get_public_assistance, fema_get_housing_assistance, fema_query_dataset) via ctx.enrich.total() — distinguishes a capped result from a complete one.
• scripts/clean-mcpb.ts — post-pack bundle cleaner wired into the bundle script.

Changed:

• createApp() sets explicit name/title = fema-mcp-server so the display name is the hyphenated repo name.
• lint-packaging.ts gains the post-bundle content guard and identity checks.
• Project skills re-synced to framework 0.10.2–0.10.6.

Dependency bumps:

• @cyanheads/mcp-ts-core ^0.10.1 → ^0.10.6
• @types/node ^25.9.2 → ^25.9.3
• hono 4.12.24 → 4.12.25 (transitive)

63 tests pass; bun run devcheck clean.

v0.1.7: NFIP canvas staging, county FIPS normalization, dataset error cleanup

NFIP canvas staging, county FIPS normalization, dataset error cleanup

NFIP query results now page to the full matching set before staging to canvas (bounded by 50k cap), so canvas SQL aggregations see the complete dataset. Three related fixes land together.

Fixed:

• fema_search_nfip canvas staging pages the full matching result set via $skip, not just limit rows; input.limit controls the inline preview only; truncated reflects cap-hit vs. exhaustion; canvas_id/canvas_table omitted when not spilled (#5)
  • OpenFEMA 503 HTML responses now classify as retryable ServiceUnavailable instead of unknown_dataset
  • Canvas pagination drops $orderby (sorted deep pagination times out upstream; SQL ORDER BY runs at query time)
• fema_search_nfip county code auto-normalizes 3-digit codes to 5-digit state+county FIPS when state is provided (#6)
• fema_query_dataset unknown-dataset error no longer leaks transport detail; data.reason contract unchanged (#10)

63 tests pass; bun run devcheck clean.

v0.1.6: ValidationError audit and mcp-ts-core ^0.10.1

ValidationError audit and mcp-ts-core ^0.10.1

Domain-validation failures across fema_search_disasters, fema_get_public_assistance,
fema_dataframe_query, fema_query_dataset, and the OData service layer now surface
ValidationError instead of InvalidParams. Framework adoption picks up the DataCanvas
SQL gate hardening.

Changed:

• fema_search_disasters, fema_get_public_assistance, fema_dataframe_query, fema_query_dataset — error contracts corrected to ValidationError for input/domain failures
• openfema-service — OData 400 responses raised via validationError() for consistency

Security:

• DataCanvas SQL gate (cyanheads/mcp-ts-core#210) — non-preparable statements (e.g. bare PRAGMA) now return the documented non_select_statement ValidationError instead of InternalError; pragma_* table functions denied.

Dependency bumps:

• @cyanheads/mcp-ts-core ^0.9.21 → ^0.10.1

59 tests pass; bun run devcheck clean.

v0.1.5: ia_declared IHP flag fix, OR rollup, declaration-level pagination

ia_declared IHP flag fix, OR rollup, declaration-level pagination

Corrects ia_declared to map to ihProgramDeclared (IHP flag, not the legacy iaProgramDeclared
which is false for major declarations since ~2012). Adds OR rollup across all area rows.
Fixes limit/offset in fema_search_disasters to paginate declarations, not area-rows.

Fixed:

• ia_declared uses ihProgramDeclared across fema_search_disasters, fema_get_disaster,
  fema://disaster/{number} resource, and fema_get_housing_assistance recovery text (#7)
• OR rollup for program flags across all designated-area rows (#7)
• fema_search_disasters limit/offset now pages deduplicated declarations (not area-rows);
  designated_area_count reflects the true per-disaster area total (#8)
• RawDisasterDeclaration interface missing ihProgramDeclared field (#7)

59 tests pass; bun run devcheck clean.

v0.1.4: Three API error-handling fixes

Three API error-handling fixes

fema_get_disaster and fema://disaster/{number} now short-circuit for
disaster numbers above 32767 (OpenFEMA Int16 ceiling), returning a clean
not_found instead of a raw type-mismatch API error. (#2)

The service layer sanitizes all 400 responses: Int16 overflow messages
become actionable range errors; other OData parse errors strip internal
position offsets and undefined codes. (#4)

No-results recovery hints for fema_search_disasters,
fema_get_public_assistance, and fema_get_housing_assistance are now
embedded in data.recovery.hint so structuredContent consumers receive
them (ctx.enrich.notice is unreachable on the error path). (#3)

Fixed:

• fema_get_disaster / fema://disaster/{number}: Int16 range guard — numbers > 32767 return not_found without calling the API (#2)
• fema_search_disasters / fema_get_public_assistance / fema_get_housing_assistance: recovery guidance now in data.recovery.hint, present in structuredContent (#3)
• fema_query_dataset: raw OData 400 errors sanitized into actionable messages before surfacing to callers (#4)

50 tests pass; bun run devcheck clean.