v0.3.4: mcp-ts-core ^0.12.3 — SDK v2 migration, stateless sessions, devcheck fix

mcp-ts-core ^0.12.3 — SDK v2 migration, stateless sessions, devcheck fix

• Strict, closed 2020-12 tool input schemas reject undeclared argument keys by name (was silently stripped); the call comes back isError with content[0].text naming the key and no structuredContent — a tool result, not a JSON-RPC -32602
• outputSchema now declares the error envelope, and HTTP serves protocol revision 2026-07-28 alongside 2025
• MCP_SESSION_MODE in .env.example set to stateless, matching the Dockerfile — was auto, which resolves to stateful
• scripts/devcheck.ts recognizes Bun 1.4's bun audit output shape — was hard-failing even on transitive-only advisories
• Bun pinned to 1.4.0; skills and CLAUDE.md resynced from the framework
• deps: @cyanheads/mcp-ts-core ^0.11.5 → ^0.12.3 (+ dev-dep bumps)

CHANGELOG v0.3.4

v0.3.3: Well-formed echo sanitization

Well-formed echo sanitization

• Sanitizes seventeen echo sites across four tools and two resources so an unpaired UTF-16 surrogate can't break the JSON-RPC frame for strict clients (#19)
• Repair applies to the echoed copy only — the value sent upstream is untouched, and paired astral characters round-trip byte-identical

CHANGELOG v0.3.3

v0.3.2: Malformed identifier fast-fail

Malformed identifier fast-fail

• Lone UTF-16 surrogate in indicator_code/dimension now fails who_query_indicator_data / who_list_dimension_values on the first attempt with a declared malformed_identifier reason and recovery hint, instead of burning the full retry budget (~6s) on an unclassified URIError (#18)

CHANGELOG v0.3.2

v0.3.1: test infrastructure: four-lane vitest scaffold

test infrastructure: four-lane vitest scaffold

• Adopts unit/smoke/integration/fuzz projects layout: toolContractSuite contract coverage per tool, fuzzTool property runs over the filter/paging input space (#17)
• Fuzz lane found a real defect on first run — #18, deliberately left unfixed in this release
• deps: @vitest/coverage-istanbul ^4.1.10, fast-check ^4.9.0 (dev)

CHANGELOG v0.3.1

v0.3.0: spatialLabel renamed to parentLocation, queryData error classification fix

spatialLabel renamed to parentLocation, queryData error classification fix

• Breaking: who_query_indicator_data's output field spatialLabel is renamed to parentLocation, and a new parentLocationCode is added. spatialLabel never held a label for the row's own spatial entity — it always held the row's parent WHO region (a JPN row carried spatialLabel: "Western Pacific"). A consumer reading it for a country name never had one, and still doesn't. Both fields are omitted (not null) on rows whose spatial dimension is itself a region or aggregate. (#15)
• queryData() now classifies non-2xx responses that aren't OData error envelopes — previously only getJson() had this check, so a non-JSON 4xx from queryData() retried as if transient. Both request paths now share one httpError() classification method. (#16)

CHANGELOG v0.3.0

v0.2.0: Dimension-value paging, breaking 500-value cap

Dimension-value paging, breaking 500-value cap

• Breaking: who_list_dimension_values and the bare who://dimension/{dimensionCode}/values resource cap at 500 values/call (default 100) — GHO (3,103 values) and DHSMICSGEOREGION (4,932) exceed the cap, so full single-call retrieval is no longer possible for either; callers must page with offset (#14)
• who_list_dimension_values gains offset/parent_code paging plus two new paged resource URI templates (#14)
• who_get_indicator_metadata and its resource no longer report roughly 1,300 valid indicators as not found when they lack IndicatorDimension rows (#11)
• README corrects the COUNTRY dimension size (194 to 234 entries)

CHANGELOG v0.2.0

v0.1.15: Offset pagination, deterministic ordering, and fast-failing upstream errors

Offset pagination, deterministic ordering, and fast-failing upstream errors

• who_query_indicator_data and who_search_indicators gain offset-based pagination (offset, hasMore, pageInfo, nextOffset) (#8, #10)
• who_query_indicator_data adds deterministic sort (year_desc default, year_asc) so a capped result is a defined slice, not an arbitrary sample (#13)
• who_query_indicator_data rejects year_from > year_to as a validation error instead of a misleading no_data result (#9)
• GhoService fails fast on deterministic upstream query rejections instead of exhausting retries, and classifies non-2xx responses by status (#12)
• Toolchain/template maintenance: community-health files, Socket security scanner, minimumReleaseAge supply-chain guard, Dockerfile cache mounts, framework skills re-synced
• deps: @cyanheads/mcp-ts-core ^0.10.9 → ^0.11.5

CHANGELOG v0.1.15

v0.1.14: mcp-ts-core ^0.10.9 maintenance

mcp-ts-core ^0.10.9 maintenance

Framework-maintenance sync — no server behavior or tool-surface changes.

Dependency bumps:

• @cyanheads/mcp-ts-core ^0.10.6 → ^0.10.9
• @types/node ^25.9.3 → ^26.0.0
• vitest ^4.1.8 → ^4.1.9

Added:

• Dependency Specifiers devcheck check + scripts/check-dependency-specifiers.ts — rejects floating specifiers (latest/*/dist-tags) in package.json and the bun.lock workspaces map (cyanheads/mcp-ts-core#246).

Changed:

• Packaging check now validates plugin marketplace manifests (.claude-plugin/.codex-plugin) alongside manifest.json/server.json (cyanheads/mcp-ts-core#240).
• Git-dependent checks (TODOs/FIXMEs, Tracked Secrets, Framework Antipatterns) skip cleanly without a .git repo.
• Framework skills re-synced; api-context documents ctx.content.

133 tests pass; bun run devcheck clean.

v0.1.13: mcp-ts-core ^0.10.6, bundle hygiene, server identity

mcp-ts-core ^0.10.6, bundle hygiene, server identity

Framework adoption (^0.9.21 → ^0.10.6) plus the runtime and packaging changes it enables.

Dependency bumps:

• @cyanheads/mcp-ts-core ^0.9.21 → ^0.10.6
• @biomejs/biome ^2.4.16 → ^2.5.0
• @types/node ^25.9.1 → ^25.9.3

Added:

• createApp({ name, title }) — explicit who-gho-mcp-server identity on the initialize response and manifest
• who_query_indicator_data output gains totalCount (alias of totalRows) and optional truncated; emits a truncation enrichment when results are capped
• scripts/clean-mcpb.ts — post-pack cleaner strips node_modules agent-docs the .mcpbignore cannot reach
• Dockerfile HEALTHCHECK (/healthz) and OCI version label
• lint-packaging bundle-content guards; antipattern rule flagging z.coerce.boolean() on env flags

Changed:

• .mcpbignore dev-dir patterns anchored to bundle root
• Vendored skills synced from framework; new techniques skill

133 tests pass; bun run devcheck clean.

v0.1.12: Fix year=0 fabrication for time-independent GHO rows

Fix year=0 fabrication for time-independent GHO rows

normalizeRow now omits the year field when TimeDim is null instead of substituting 0, eliminating fabricated year data for time-independent indicators.

Fixed:

• normalizeRow uses conditional spread so rows with absent TimeDim omit year entirely, not year=0 (#5)
• DataRow.year changed from required number to optional number? (types.ts)
• who_query_indicator_data output schema year changed to z.number().optional(); format() renders — when year is absent (#5)
• Tests added for absent-year rows through handler, format placeholder, and no undefined in output

133 tests pass; bun run devcheck clean.