URLCode 0.6.0

What's Changed

• docs: point at extension-bundles@v0.5.9, not the stale v0.5.1 by @jimhoyd in #521
• fix: warn in nextSteps when --with pins deprecated npm extensions by @jimhoyd in #523
• Make the AI starter truly minimal by @jimhoyd in #525
• fix: make urlcode init --with bundle-only, auto-resolving extension-bundles@v by @jimhoyd in #526
• Clarify Actions workflow roles and gates by @jimhoyd in #535
• fix(auth): raise password-hash contention wait budget for slow CI runners (#506) by @jimhoyd in #536
• fix(ui): make isMarkup survive cross-bundle module instance boundaries (#524) by @jimhoyd in #537
• fix(core): improve extension-bundle discovery, error messages, and docs (#530, #534, #531) by @jimhoyd in #538
• fix(store,forms): guard stale-lock reclaim and refresh the CSRF binding cookie by @jimhoyd in #593
• ci: cut duplicated CI work and widen the core boundary check by @jimhoyd in #596
• docs: drift sweep for starter, init --with, versions and monorepo prose by @jimhoyd in #597
• fix(auth,core): client keys, reset budget, waitlist notice, audit deployment advisories by @jimhoyd in #604
• fix: bound author regex cost in the pattern guard, agents policy and forms by @jimhoyd in #598
• fix(core): make extension bundle verification failures diagnosable (#579) by @jimhoyd in #601
• docs: use apex URLCode AI MCP endpoint by @jimhoyd in #578
• Declarative-first recipes, review signals and planner ranking by @jimhoyd in #605
• fix: agent guidance truth and implementation-derived consistency checks by @jimhoyd in #606
• fix(core): actionable authoring errors, strict request fixtures and JSON 422s by @jimhoyd in #607
• fix(core): show function and reload errors in dev, and real errors over MCP by @jimhoyd in #602
• ci: scope workspace verification to releases by @jimhoyd in #609
• fix: align the starter and local-install path with the running release by @jimhoyd in #600
• ci: scope expensive PR smoke checks by @jimhoyd in #611
• ci: align workflow display names by @jimhoyd in #612
• ci: separate extension and compatibility proofs by @jimhoyd in #613
• docs: stabilize llms bundle header by @jimhoyd in #619
• fix(store): let the short-link click counter update a readOnly collection by @jimhoyd in #620
• refactor: isolate CI and release verification seams by @jimhoyd in #622
• fix(core): refuse non-default compression config and relabel route throttle on serverless by @jimhoyd in #623
• feat(core): add public @jimhoyd/urlcode/skills export by @jimhoyd in #627
• fix: express constant middleware-recipe/cookbook responses via respond by @jimhoyd in #630
• docs: onboarding docs sweep — concepts page, task-first index, split YAML reference by @jimhoyd in #621
• fix(core): canonical verb-first MCP tool vocabulary with legacy aliases (#590) by @jimhoyd in #633
• fix(core): bind extension catalog commit field to attestation source digest by @jimhoyd in #636
• feat(auth): bearer/API-key authentication by @jimhoyd in #635
• fix(auth): close register-duplicate session cookie leak, scope sign-in-code issuance per client (#548) by @jimhoyd in #641
• fix(forms): use core's shared pattern guard instead of a drifted copy by @jimhoyd in #624
• feat(ui): publish ui-presentation as a separate signed catalog entry (#522) by @jimhoyd in #643
• chore: collapse release path to core-only and prune unused release/CI tooling by @jimhoyd in #642
• feat(mcp): add a declarative MCP tool server extension package by @jimhoyd in #625
• CLI: --version, per-command help, and TTY-readable dev/serve/init output by @jimhoyd in #628
• docs: consolidate production-gate lists and move dated backlogs out of the public tree by @jimhoyd in #632
• fix: route bundle-only sites to a bundle-aware CLI, not npx urlcode-ui/urlcode-auth by @jimhoyd in #644
• fix(core): let a client register .mcp.json before urlcode init runs (#542) by @jimhoyd in #634
• fix: exclude examples/*/dist build artifacts from npm pack by @jimhoyd in #631
• core: offline extension-bundle acquisition (cache-first, --bundle-release-path) by @jimhoyd in #637
• refactor: consolidate CLI, bundle, and agent asset seams by @jimhoyd in #646
• ci,build: pin the 22.13 package floor, share tsconfigs, phase in checkJs by @jimhoyd in #640
• fix(core): consolidate shipped-skill file list between skills.ts and agent-context.ts by @jimhoyd in #648
• feat: add safe extension release trains by @jimhoyd in #647
• ui: compile kitCss from Tailwind and ship a French kit catalogue by @jimhoyd in #649
• fix(core): distinguish identifier references from literal data in constant-response heuristic by @jimhoyd in #650
• chore: consolidate duplicated CI-report and release-template helpers (#569) by @jimhoyd in #652
• core,auth: expose an authorized extension's principal to route function/middleware context by @jimhoyd in #653
• Add create-extension scaffolding CLI with --from fork support by @jimhoyd in #655
• feat(mcp): resources/prompts, outputSchema, and list pagination (#626) by @jimhoyd in #654
• fix(core): skip Node's own strictContentLength self-check on 22.13.0-22.14.x by @jimhoyd in #657
• feat(mcp): promote mcp to init --with and the signed extension-bundles release by @jimhoyd in #656
• refactor: simplify extension catalog releases by @jimhoyd in #658
• fix(auth): correct false sync-test claim in check-sqlite.mjs comment by @jimhoyd in #660
• chore: rename extension release workflows by @jimhoyd in #661
• refactor: rename extension artifacts by @jimhoyd in #662
• refactor!: one add-on shape, composeHost, site layout, extensions/artifacts add/remove by @jimhoyd in #663
• build(release)!: merge a version bump, main releases itself by @jimhoyd in #664
• feat: urlcode upgrade by @jimhoyd in #665
• release: v0.6.0 by @jimhoyd in #667
• fix: Windows test and path failures from the 0.6.0 release matrix by @jimhoyd in #668
• fix(core): mcp imports agent-context from source, not the built package by @jimhoyd in #669
• test: close the served site before removing it in the add-on integration test by @jimhoyd in #673

Full Changelog: v0.5.9...v0.6.0