v4.5.0

Content Packs — deploy and publish curated portal content. A new content_packs tool group
drives Zuar Portal's native Content Pack feature: browse the library of shareable bundles (pages,
blocks, queries, datasources, themes, partials, snippets, assets), import one into this portal
(remapping object IDs and assigning your own database connection to its data sources), and publish a
selection of your own objects to a Content Pack Repository. This is the portal side of the Zuar
Runner lineage/health system — the Lineage Explorer and Runner Health dashboards ship as a content
pack, and these tools deploy them.

Added

• content_packs tool group (src/tools/content-pack-tools.ts), gated like the rest of the
  server (import/export are data-domain writes, delete is admin; all support dry_run):
  • list_content_packs — browse the pack library (filter by search/tags/portal_version).
  • sync_content_packs — refresh the library from connected repositories.
  • preview_content_pack — analyze a pack against this portal (NEW/CONFLICT per object; which
    datasources need a connection; which chatbot blocks need an LLM).
  • import_content_pack — deploy a pack: previews it (fresh, never cache-stale), then builds the
    per-object import plan for you (one database_connection_id applied to every datasource the
    import writes, llm_connection_id to chatbot blocks only, conflict policy for CONFLICT objects;
    a per-item override naming an unknown export_id is refused, not silently dropped), with a
    dry_run that surfaces datasources and chatbot blocks left without a connection based on the
    RESOLVED action per object. When version control is on, every object the import creates or
    overwrites is mirrored to the local VC repo — overwrites are baselined before the write — so
    restore_resource can roll a pack import back.
  • list_pack_entities — browse this portal's objects for packaging.
  • export_content_pack — publish a selection to a repository; dependencies are resolved
    automatically by driving the pack builder with one add-transition per explicit object (explicit
    vs auto counts reported).
  • delete_content_pack — unpublish a pack (admin + confirm:true, dry_run rehearsal).
• lineage-health skill (.claude/skills/lineage-health/SKILL.md): answers data-lineage and
  pipeline-health questions from the deployed Lineage Explorer / Runner Health dashboards — the
  runner.* and runner_health_mqb.* schema, the block's edge-table columns, and ready SQL recipes
  for upstream/downstream, impact-on-analytics, unused tables, depth, and failing/stale jobs.

Fixed

• package-lock.json version was stale. Its root version fields still read 4.3.0 while
  package.json had moved to 4.4.0 and then 4.5.0 — both releases bumped the manifest without the
  lockfile. Regenerated with npm install --package-lock-only: two lines, no dependency changes.
• .gitignore now covers the loose material that collects in a working checkout — stray skill
  drafts (SKILL.md, SKILL-1.md, SKILL (1).md, context/SKILL*.md), the vendored
  swagger-ui-bundle.js, the local reference/Portal_Docs/ docs checkout, and the
  customer-specific reference/migration-retro.md. The skill drafts were the real hazard: they are
  older, pre-scrub copies of skills already tracked under .claude/skills/, and still name a
  customer that the tracked versions had generalized. The patterns are anchored, so nothing already
  tracked is shadowed.

Changed

• The committed CLAUDE.md no longer names this repo's own portal binding; the binding lives only
  in the gitignored .zuar-portal/config.json (#12).
• npm audit: hono and ip-address bumped within their existing semver ranges (2 moderate,
  3 high advisories; lockfile-only, no dependency-range changes).
• package.json homepage / repository / bugs re-pointed at the public repo — the 4.4.1
  change had regressed to the private slug during the 4.5.0 branch merge (caught by the
  publish leak gate, which refused to push).

Removed

• Duplicate repo-local skill copies under .claude/skills/ (#9).

v4.4.1

Public release mirror + dependency audit fixes. Customers now get the server from the public
repo zuarbase/Zuar-Portal-MCP-Public, a release-snapshot mirror of this one: each stable tag is
published there as a single squashed commit (+ tag + GitHub Release with the .mcpb), never the
development history. scripts/publish-public.sh builds the snapshot from git archive of the tag,
strips everything in .publicignore, runs a leak gate (private slugs, hostnames, token shapes) and
refuses to push on any hit; .github/workflows/publish-public.yml runs it when a Release is
published here.

Changed

• package.json homepage / repository / bugs and the README / docs install links now point at
  the public repo — that is the URL customers can actually reach.
• npm audit: fast-uri, brace-expansion, @hono/node-server, @modelcontextprotocol/sdk bumped
  (shipped on main after 4.4.0 without a version bump; this release carries them).

Added

• .publicignore, scripts/publish-public.sh, .github/workflows/publish-public.yml — the mirror.