v0.1.4: Restricted-download contract completion and mcp-ts-core 0.12.3 adoption

Restricted-download contract completion and mcp-ts-core 0.12.3 adoption

ia_get_text restricted-item downloads now consistently throw the declared download_forbidden contract: IA answers both 401 and 403 for restricted downloads, both remap, and the recovery hint reaches data.recovery.hint (#7, #12).

• Framework @cyanheads/mcp-ts-core ^0.10.6 → ^0.12.3: MCP SDK v2 dual-era serving (protocol revision 2026-07-28 alongside the 2025 era), strict tool inputs, declared error envelope in the advertised output schema
• Supply-chain guard (3-day release-age hold + Socket install scanner), TypeScript 7 toolchain, devcheck floating-specifier and plugin-manifest gates
• Docker image on Bun 1.4.0 with a native-arch build stage for multi-arch builds
• Community health files (SECURITY, CONTRIBUTING, CODE_OF_CONDUCT); smoke/integration/fuzz test suites plus test:coverage

63 tests pass.

CHANGELOG v0.1.4

v0.1.3: mcp-ts-core 0.10.6 adoption

mcp-ts-core 0.10.6 adoption

Maintenance release adopting @cyanheads/mcp-ts-core ^0.10.6 and the framework primitives it brings — response enrichment, explicit server identity, and a leaner MCPB bundle.

Added:

• ia_find_snapshots emits ctx.enrich.truncated({ shown, cap }) in history mode when results hit limit
• scripts/clean-mcpb.ts post-pack cleaner — mcpb clean prune plus a strip of dependency-shipped agent docs (skills/, .claude/, .agents/, SKILL.md) under node_modules/, with a paired lint:packaging post-bundle check
• Framework antipattern rule flagging z.coerce.boolean() on env flags
• Dockerfile HEALTHCHECK (bun-native fetch on /healthz) and org.opencontainers.image.version label from an APP_VERSION build arg

Changed:

• createApp() sets name/title explicitly to internet-archive-mcp-server
• .mcpbignore agent-doc patterns root-anchored

Dependency bumps:

• @cyanheads/mcp-ts-core ^0.9.21 → ^0.10.6
• @biomejs/biome ^2.4.16 → ^2.5.0
• @types/node ^25.9.2 → ^25.9.3

49 tests pass; bun run devcheck clean.

v0.1.2: SSRF fix, dark-item error, exact-timestamp 404 contract

SSRF fix, dark-item error, exact-timestamp 404 contract

Four bug fixes to the Wayback Machine and IA Metadata service.

Fixed:

• ia_find_snapshots closest mode: SSRF guard now accepts http://web.archive.org/ (Availability API returns http:, not https:); also unblocks ia_get_snapshot on imprecise-timestamp responses (#1)
• ia_get_item: dark/restricted items (is_dark: true) now raise item_not_found instead of returning empty metadata; covers ia_get_item, ia_get_text, and ia://item/{identifier} (#2)
• ia_get_snapshot: exact-timestamp 404 from fetchContent() remapped to no_snapshot_available contract so reason and recovery hint surface correctly (#5)
• ia_get_snapshot resolved_status description clarified: returned by Availability API for imprecise timestamps; assumed 200 for exact 14-digit timestamps (direct path skips Availability API) (#3)

Dependency bumps:

• @types/node ^25.9.1 → ^25.9.2

49 tests pass; bun run devcheck clean.

v0.1.1: First public release — 5 tools, 1 resource over the Wayback Machine and IA library

First public release — 5 tools, 1 resource over the Wayback Machine and IA library

MCP server wrapping the Internet Archive Wayback Machine (CDX + Availability APIs) and IA library (Advanced Search + Metadata APIs). No API key required.

Added:

• ia_find_snapshots — Wayback snapshot discovery; closest or CDX history mode with date/status/MIME filters and resume-key pagination
• ia_get_snapshot — Wayback replay fetch; HTML-to-text extraction capped at IA_MAX_SNAPSHOT_CHARS
• ia_search_items — IA library search (40M+ items) with mediatype, collection, creator, date-range, language, and sort filters
• ia_get_item — IA Metadata API; full title, creator, subjects, collections, license, and per-file download URLs
• ia_get_text — OCR/plain-text fetch with char_offset continuation paging for large documents
• ia://item/{identifier} — MCP resource for Archive item metadata snapshots

Security:

• Wayback SSRF guard — Availability API response URL validated against https://web.archive.org/ before return
• Solr injection prevention — filter values quoted and escaped; date ranges validated against YYYY-MM-DD pattern
• Output cap — snapshot text sliced to IA_MAX_SNAPSHOT_CHARS; status_filter restricted to 3-digit codes

44 tests pass; bun run devcheck clean.