v0.1.13: Truncation signaling, input bounds, content parity

Truncation signaling, input bounds, content parity

Six collection tools now surface the upstream limitExceeded flag; content[] preserves exact values and explicit null/empty state across the tool surface.

Added:

• limitExceeded: boolean on onebusaway_list_agencies, onebusaway_find_routes, onebusaway_search_stops, onebusaway_search_routes, onebusaway_list_routes_for_agency, onebusaway_get_vehicles (#18)
• onebusaway_find_routes optional latSpan/lonSpan bounding-box inputs (#18)

Fixed:

• Geographic/positive-count bounds on lat/lon/radius/maxCount across onebusaway_find_stops, onebusaway_find_routes, onebusaway_search_stops, onebusaway_search_routes (#19)
• content[] renders exact coordinates/distances (no toFixed/Math.round) and explicit none for absent fields via shared format-helpers.ts, across nearly the full tool surface (#21)

325 tests pass; bun run devcheck clean.

CHANGELOG v0.1.13

v0.1.12: Trip blockId, schedule derivation, and routeShortName fixes

Trip blockId, schedule derivation, and routeShortName fixes

Three data-mapping bugs found black-box testing the hosted instance: a dropped output field, an empty schedule result, and a recurring empty-string fallback bug.

Added:

• get_trip output gains a nullable blockId, resolved from tripRef.blockId — previously unobtainable, leaving onebusaway_get_block unreachable (#15)

Fixed:

• get_trip routeShortName no longer returns "" — new firstNonEmpty() helper skips empty strings the way ?? skips null/undefined (#15)
• get_schedule_for_route no longer returns zero trips for an operating route — derives trips from stopTripGroupings when entry.trips is empty (#20)
• firstNonEmpty() applied to four more call sites: normalizeRoute, getArrivals, getVehicles, getScheduleForStop (#23)

272 tests pass; bun run devcheck clean.

CHANGELOG v0.1.12

v0.1.11: Rate-limit and null-data fixes, mcp-ts-core ^0.10.14, supply-chain hardening

Rate-limit and null-data fixes, mcp-ts-core ^0.10.14, supply-chain hardening

Bug fixes for arrivals rate-limiting and null-response crashes, plus routine framework and dependency maintenance.

Added:

• Not-found discovery hints — data.recovery.hint names the tool to find a valid ID, keyed by contract reason (#17)
• Supply-chain install guard — bunfig.toml 3-day release-age hold plus Socket security scanner on install
• .github/SECURITY.md disclosure policy; .github/FUNDING.yml; .gitattributes LF/generated-file normalization

Changed:

• Dockerfile pins oven/bun:1.3.14, adds BuildKit cache mounts, builds with --ignore-scripts
• package.json author normalized; packageManager bun@1.3.2 → 1.3.14; LICENSE year 2025 → 2026

Fixed:

• onebusaway_get_arrivals rate-limit retries now retryable: false — a single shared API key makes a 429 a global budget, not a per-caller quota (#16)
• Null resp.data crashes across 8 ID-lookup methods now throw clean NotFound instead of falling through to ServiceUnavailable (#22)

Dependency bumps:

• @cyanheads/mcp-ts-core ^0.10.9 → ^0.10.14
• @socketsecurity/bun-security-scanner (new) ^1.1.2
• js-yaml 3.14.2 → 3.15.0 (transitive) — clears GHSA-h67p-54hq-rp68
• bun (packageManager) 1.3.2 → 1.3.14

265 tests pass; bun run devcheck clean.

CHANGELOG v0.1.11

v0.1.10: mcp-ts-core ^0.10.9 maintenance

mcp-ts-core ^0.10.9 maintenance

Framework-only upkeep — re-sync to @cyanheads/mcp-ts-core ^0.10.9 (0.10.7 → 0.10.9); no server behavior change.

Dependency bumps:

• @cyanheads/mcp-ts-core ^0.10.6 → ^0.10.9
• @types/node ^25.9.3 → ^26.0.0
• vitest ^4.1.8 → ^4.1.9

Added:

• check-dependency-specifiers devcheck gate — fails floating specifiers in package.json deps and bun.lock workspaces (cyanheads/mcp-ts-core#246)
• Plugin-manifest checks in lint:packaging, gated by devcheck.config.json packaging.pluginManifests (cyanheads/mcp-ts-core#240)

Changed:

• Fresh-scaffold devcheck guards skip git-dependent checks outside a repo (cyanheads/mcp-ts-core#237, #242, #243)
• Synced skills/** to ^0.10.9 — api-context documents ctx.content; git-wrapup/orchestrations v1.4

248 tests pass; bun run devcheck clean.

v0.1.9: mcp-ts-core ^0.10.6, server identity, Docker healthcheck, MCPB cleaner

mcp-ts-core ^0.10.6, server identity, Docker healthcheck, MCPB cleaner

Maintenance release: framework adoption plus an explicit server identity, a container healthcheck, and a post-pack bundle cleaner.

Dependency bumps:

• @cyanheads/mcp-ts-core ^0.9.21 → ^0.10.6
• @biomejs/biome ^2.4.16 → ^2.5.0
• @types/node ^25.9.1 → ^25.9.3

Added:

• MCPB bundle cleaner (scripts/clean-mcpb.ts) — strips node_modules-nested agent docs that root-anchored .mcpbignore patterns cannot reach
• Docker HEALTHCHECK — bun-native fetch to /healthz; org.opencontainers.image.version label from an APP_VERSION build arg

Changed:

• createApp() sets explicit name/title of onebusaway-mcp-server; .codex-plugin displayName drops the npm scope
• Synced skills/** to framework ^0.10.6; new skills/techniques/

248 tests pass; bun run devcheck clean.

v0.1.8: Sound Transit data terms compliance

Sound Transit data terms compliance

Adds a README Data section documenting the Sound Transit Transit Data Terms of Use for the Puget Sound OneBusAway API.

Added:

• README ## Data section — surfaces the Sound Transit Transit Data Terms of Use with key compliance obligations for downstream users (clauses 2, 3, 4, 7). Closes #9.

248 tests pass; bun run devcheck clean.

v0.1.7: Adopt @cyanheads/mcp-ts-core ^0.9.21 with log context fix, secret scrubbing, and fail-fast retries

Adopt @cyanheads/mcp-ts-core ^0.9.21 with log context fix, secret scrubbing, and fail-fast retries

Framework changes adopted from ^0.9.16 → ^0.9.21:

Changed:

• HTTP transport per-request log context — per-request logs and traces carry fresh request + trace/span IDs instead of the frozen boot context.
• fetchWithTimeout secret scrubbing — query-string secrets (e.g. ?api_key=) stripped from error messages and logs.
• withRetry fail-fast — non-retryable errors exit immediately; ctx.fail auto-populates the retryable flag.
• README client-config key renamed from 'onebusaway' to 'onebusaway-mcp-server' in all install examples.
• Synced 8 skills to framework ^0.9.21; new api-mirror and orchestrations skills added.
• New scripts: check-skill-versions.ts, release-github.ts.

Dependencies:

• @cyanheads/mcp-ts-core ^0.9.16 → ^0.9.21
• vitest ^4.1.7 → ^4.1.8

248 tests pass; bun run devcheck clean.

v0.1.6: Service alert + block schedule tools; error-contract fixes

Service alert + block schedule tools; error-contract fixes

Two new tools and two bug fixes across the service layer.

Added:

• onebusaway_get_alert — full service alert detail by situation ID: summary, description, reason, affected stops/routes, consequence, active time windows (#10)
• onebusaway_get_block — full-day vehicle block schedule by block ID; all trips in order with GTFS stop times (#10)

Fixed:

• classifyError() re-throws McpError as-is — previously re-wrapped and dropped data.reason (#12)
• data.reason now populated on all NotFound errors across 8 service methods (#12)
• Null-response guards (resp?.data, resp?.data?.entry) so invalid IDs throw notFound instead of TypeError (#12)
• onebusaway_list_routes_for_agency emits ctx.enrich.notice() on empty result, consistent with other collection tools (#14)

113 tests pass; bun run devcheck clean.

v0.1.5: Enrichment adoption — find/search/arrivals/schedule/vehicles tools

Enrichment adoption — find/search/arrivals/schedule/vehicles tools

All 9 search/list/collection tools now surface a typed enrichment block with query echoes, result counts, and empty-result/truncation guidance. Reaches both structuredContent JSON and content[] markdown trailer.

Added:

• enrichment block on find-stops, find-routes, search-stops, search-routes, get-arrivals, get-vehicles, list-agencies, list-routes-for-agency, get-schedule-for-stop, get-schedule-for-route

Dependency bumps:

• @cyanheads/mcp-ts-core ^0.9.13 → ^0.9.16

102 tests pass; bun run devcheck clean.

v0.1.4: mcp-ts-core ^0.9.13 adoption, dep refresh, landing fix

mcp-ts-core ^0.9.13 adoption, dep refresh, landing fix

Adopts @cyanheads/mcp-ts-core ^0.9.13 from ^0.9.7, refreshes dev deps, and fixes the public hosted catalog's landing inventory gate.

Added:

• HTTP 413 body cap via MCP_HTTP_MAX_BODY_BYTES (default 1 MiB); documented in .env.example
• GET /mcp surfaces package.json keywords alongside name/version/description

Changed:

• landing.requireAuth: false — full tool/resource inventory served without auth gate on the public hosted instance
• HTTP session-init gate — non-initialize requests without Mcp-Session-Id rejected with 400
• httpErrorHandler — 401/403/400/404 use logger.warning instead of full error pipeline with stack traces

Dependency bumps:

• @cyanheads/mcp-ts-core ^0.9.7 → ^0.9.13
• @biomejs/biome ^2.4.7 → ^2.4.16
• @types/node ^25.6.0 → ^25.9.1
• tsc-alias ^1.8.16 → ^1.8.17
• typescript ^5.9.3 → ^6.0.3
• vitest ^4.1.0 → ^4.1.7

77 tests pass; bun run devcheck clean.