- Bump @cyanheads/mcp-ts-core ^0.8.15 → ^0.9.1 (0.9.0 Workers-under-nodejs_compat + spec `instructions` field + portability lint family + build-time-only definition linting + SSRF DNS validation in Workers + IPv6 SSRF blocklist + rate-limit metric cardinality bound; 0.9.1 tasks-capability gated on actual task tools, OTel semconv ^1.40 → ^1.41 with stable ATTR_DEPLOYMENT_ENVIRONMENT_NAME, fast-xml-parser pinned 5.7.3)
- Engine floor: node >=22 → >=24, bun >=1.2 → >=1.3; Dockerfile oven/bun:1 → oven/bun:1.3
- Adopt spec `instructions` field on createApp() — search_compounds → per-CID flow and search_assays → get_bioactivity chain forwarded to the model on `initialize`
- Refactor pubchem-client.ts HTTP error classification: drop PubChemNotFoundError class in favor of McpError via httpStatusToErrorCode with { url, status } data; shared isNotFound() predicate keyed on JsonRpcErrorCode.NotFound replaces the per-call-site instanceof checks
- Fix dead /PubChem HTTP 400/ regex in pubchem_get_summary (message format changed during McpError migration) — now checks error.data.status === 400 so the entity-id-not-found-as-400 fallback still maps to null
- Dev deps: @biomejs/biome ^2.4.14 → ^2.4.15, @types/node ^25.6.0 → ^25.8.0, vitest ^4.1.5 → ^4.1.6
- Sync 17 skills from @cyanheads/mcp-ts-core@0.9.1 (added api-telemetry; refreshed api-auth/config/context/errors/linter/utils/workers, add-tool, design-mcp-server, field-test, maintenance, polish-docs-meta, report-issue-framework/local, security-pass, setup, tool-defs-analysis); framework scripts resynced (build-changelog.ts 350-char summary cap, devcheck.ts bun-outdated parser fix)