@cyanheads/congressgov-mcp-server 0.6.0 → 0.7.1

package/changelog/0.3.x/0.3.13.md

@@ -0,0 +1,20 @@
+---
+summary: Daily record articles rendering fix, content[] parity for roll-votes/daily-record/crs-reports, core 0.5.3 bump with parseEnvConfig adoption and Docs Sync step
+breaking: false
+---
+
+# 0.3.13 — 2026-04-20
+
+### Fixed
+
+- Fixed `congressgov_daily_record` `articles` operation rendering every item as a bare `### 1. Item` with no fields. The `/daily-congressional-record/{v}/{i}/articles` endpoint wraps articles in section objects (`[{ name, sectionArticles: [...] }]`); the shared `renderDailyRecordItem` looked for volume/issue fields that don't exist on section wrappers, so section name, article title, page range, and text URLs were all invisible. The service now flattens sections at fetch time — each article carries a `sectionName` field and the `pagination.count` from upstream (which counts articles, not sections) matches `data.length` — and a dedicated `renderDailyArticleItem` renders title, section, page range, and PDF/Formatted Text URLs. Closes [#3](https://github.com/cyanheads/congressgov-mcp-server/issues/3)
+- Surfaced missing fields in three tool renderers. These fields were present in `structuredContent` but never rendered to `content[]`, so MCP clients that forward only `content[]` (Claude Desktop, VS Code Copilot, Cursor) saw less data than clients that forward `structuredContent` (Claude Code):
+  - `congressgov_roll_votes` list — now renders `legislationUrl` (direct link to the bill), `sourceDataURL` (clerk.house.gov XML), `updateDate`, and `identifier`
+  - `congressgov_daily_record` list/issues — now renders `updateDate`
+  - `congressgov_crs_reports` list — now renders `contentType`, `status`, and `version`
+
+### Changed
+
+- Bumped `@cyanheads/mcp-ts-core` from `^0.5.2` to `^0.5.3`
+- Migrated `src/config/server-config.ts` from `ServerConfigSchema.parse(process.env)` to `parseEnvConfig` (added in framework 0.5.0). Validation errors now name the actual env var at fault (`CONGRESS_API_KEY`) instead of the internal Zod path (`apiKey`)
+- Adopted the `check-docs-sync` script from framework 0.5.3 — `scripts/check-docs-sync.ts` verifies `CLAUDE.md` and `AGENTS.md` stay byte-identical, wired into `devcheck` as a new `Docs Sync` step. Resolved pre-existing drift between the two files

package/changelog/0.3.x/0.3.14.md

@@ -0,0 +1,30 @@
+---
+summary: Adopt @cyanheads/mcp-ts-core 0.5.3 → 0.7.0 (18 intermediate releases); directory-based changelog system; landing page with sourceUrl overrides; three new skills synced (api-linter, security-pass, release-and-publish)
+breaking: false
+---
+
+# 0.3.14 — 2026-04-24
+
+Maintenance release. Pulls in the full 0.6.x + 0.7.0 arc of `@cyanheads/mcp-ts-core` — landing page, SEP-1649 Server Card, stricter linter, new error helpers, skill/script sync infrastructure — and migrates this repo to the directory-based changelog convention the framework now recommends. No tool or resource behavior changes; every definition exercised clean via field-test.
+
+## Added
+
+- **Directory-based changelog** — migrated every historical release from the monolithic `CHANGELOG.md` into per-version files under `changelog/<major.minor>.x/<version>.md` (17 files across `0.1.x`, `0.2.x`, `0.3.x`). `CHANGELOG.md` is now an auto-generated navigation index. `changelog/template.md` is the pristine format reference. New `bun run changelog:build` / `bun run changelog:check` scripts wired in; `changelog:check` runs as a devcheck step that hard-fails on drift.
+- **Landing page view-source integration** (`src/index.ts`) — HTTP-mode landing page now advertises this repo as `landing.repoRoot` and each definition carries a `sourceUrl` override pointing at its real file. The framework's default auto-derivation (`<repoRoot>/blob/main/src/mcp-server/<kind>/definitions/<kebab-of-name>.ts`) doesn't match this server's file layout because filenames strip the `congressgov_` name prefix — the inline `withSource()` helper supplies the actual path so view-source links resolve on GitHub.
+- **Three new skills synced from the framework**: `api-linter` (lint-rule reference for `format-parity` / `schema-*` / `name-*` / `server-json-*` diagnostics), `security-pass` (8-axis MCP security audit), `release-and-publish` (post-wrapup ship workflow for npm / MCP Registry / GHCR).
+- **`scripts/build-changelog.ts`** + **`scripts/check-skills-sync.ts`** synced from the framework (Phase C of the `maintenance` skill). Devcheck picks up `Skills Sync` and `Changelog Sync` steps as warnings/errors when mirrors drift.
+- **GitHub issue templates** at `.github/ISSUE_TEMPLATE/` for bug reports, feature requests, and template config (labels auto-apply, PAT placeholder redaction guidance in the body).
+
+## Changed
+
+- **`@cyanheads/mcp-ts-core` `^0.5.3` → `^0.7.0`** — single jump across 18 releases. Framework changes adopted automatically (logic throws / framework catches, auto-instrumentation, startup definition lint, the recursive `describe-on-fields` rule, flattened ZodError messages in `McpError.message`, structured `data.issues`). No breaking changes. No handler or tool-schema edits required.
+- **`@biomejs/biome` `^2.4.12` → `^2.4.13`**, **`vitest` `^4.1.4` → `^4.1.5`** — patch bumps via `bun update --latest`.
+- **`scripts/devcheck.ts`**, **`scripts/lint-mcp.ts`**, **`scripts/tree.ts`** — resynced from the framework package. `devcheck` picks up new `Skills Sync` + `Changelog Sync` steps, a regex-escape security fix in the color helper, and an audit-connection-failure detection branch. `lint-mcp` now validates `server.json` + `package.json` alongside tool/resource/prompt definitions. `tree` collapses the new `changelog/<series>/` per-version files for readability.
+- **Skills refreshed from the framework package** (Phase A of `maintenance`): `add-app-tool`, `add-prompt`, `add-resource`, `add-service`, `add-tool`, `api-context`, `api-utils`, `design-mcp-server`, `field-test`, `maintenance`, `polish-docs-meta`, `report-issue-framework`, `report-issue-local`, `setup`. Mirrors at `.claude/skills/` and `.agents/skills/` re-propagated (Phase B). Local `devcheck` + `migrate-mcp-ts-template` skills preserved.
+- **`CLAUDE.md` + `AGENTS.md`** — adopted framework-authored template updates: `security-pass` slotted into the "What's Next?" sequence, skill table gained `api-linter` / `security-pass` / `release-and-publish` / `add-app-tool`, agent-directory note now points at the `maintenance` skill for auto-sync, Changelog section added describing the new directory-based format, checklist expanded with form-client optional-object guard and external-API-wrapping bullets (the latter particularly relevant for this Congress.gov wrapper — upstream sparsity, nullability, sparse-payload test coverage).
+- **`package.json` scripts** — added `changelog:build` + `changelog:check`.
+- **`docs/tree.md`** — regenerated to reflect the new `changelog/` layout and synced skill set.
+
+## Notes
+
+- Filed [cyanheads/mcp-ts-core#64](https://github.com/cyanheads/mcp-ts-core/issues/64) on a transient `ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING` failure seen running `bun run test` on Node 25 — the framework's `./vitest.config` export resolves to a raw `.ts` file inside `node_modules`, which Node's type-stripper refuses to process. Workaround for this server today: `NODE_OPTIONS=--no-experimental-strip-types bun run test` if the error recurs. Tests pass cleanly as-is in our CI.

package/changelog/0.3.x/0.3.15.md

@@ -0,0 +1,28 @@
+---
+summary: "Adopt @cyanheads/mcp-ts-core ^0.7.0 → ^0.8.19 — typed error contracts, ctx.fail/recoveryFor, canvas + spillover. Engines bumped to Bun ≥1.3.0 / Node ≥24.0.0; Docker base oven/bun:1 → oven/bun:1.3. New Framework Antipatterns devcheck step."
+breaking: false
+security: false
+---
+
+# 0.3.15 — 2026-05-08
+
+Maintenance release. Pulls in the full 0.8.x arc of `@cyanheads/mcp-ts-core` — typed error contracts, `ctx.fail` / `ctx.recoveryFor`, DataCanvas + `spillover()`, telemetry dashboard scaffolding — plus the engine + Docker base bumps from framework 0.8.19. Tool and resource handlers are unchanged; this server doesn't yet declare `errors[]` contracts or use canvas, but the framework surface is now available to adopt incrementally.
+
+## Added
+
+- **Framework Antipatterns devcheck step** — new `scripts/check-framework-antipatterns.ts` (mirrored from framework 0.8.x) wired in via `scripts/devcheck.ts`. Three rules guard against SDK-coupling shortcuts in framework consumers: `inputSchema-downgrade`, `inputSchema-mutation`, `transport-text-match`. Runs standalone (`bun run scripts/check-framework-antipatterns.ts`) or as part of `bun run devcheck`.
+- **`scripts/split-changelog.ts`** — synced from the framework. One-shot migration helper for the directory-based changelog convention; retained alongside `build-changelog.ts` for parity with upstream.
+- **Three new skills synced from the framework**: `api-canvas` (Tier 3 SQL/analytical workspace primitive — `acquire → registerTable → query → export`, plus `spillover()` for inline-preview-with-canvas-overflow patterns), `api-telemetry` (catalog of every span, metric, attribute, completion-log field, env var, and runtime caveat the framework emits), `tool-defs-analysis` (read-only audit of MCP definition language across the surface — voice, leaks, defaults, recovery hints, output descriptions).
+- **`scripts/build-changelog.ts` `security: boolean` frontmatter** — pairs with the `## Security` section to render a `🛡️ Security` badge in the rollup. Both flags render in fixed order (`· ⚠️ Breaking · 🛡️ Security`) when set. Validated like `breaking` (must be literal `true`/`false`).
+
+## Changed
+
+- **`@cyanheads/mcp-ts-core` `^0.7.0` → `^0.8.19`** — single jump across 19 releases. Notable framework additions now available to adopt: declarative `errors[]` contracts on tool/resource definitions with typed `ctx.fail(reason)` and `ctx.recoveryFor(reason)`, `httpErrorFromResponse` / `httpStatusToErrorCode` utilities, `partialResult` / `failureEntrySchema` typed succeeded/failed pattern, three more error factories (`internalError`, `serializationError`, `databaseError`), DataCanvas (`@cyanheads/mcp-ts-core/canvas`) with `spillover()` and `inferSchemaFromRows`. `MCP_AUTH_MODE=none` over HTTP now defaults `tenantId` to `'default'` so `ctx.state` works without minting JWTs (closes [cyanheads/mcp-ts-core#87](https://github.com/cyanheads/mcp-ts-core/issues/87)). No breaking changes; no handler edits required for this server.
+- **Engines bumped:** `node` `>=22.0.0` → `>=24.0.0`, `bun` `>=1.2.0` → `>=1.3.0`, mirrored from framework 0.8.19. `packageManager` already pinned at `bun@1.3.2`.
+- **Dockerfile base image** `oven/bun:1` → `oven/bun:1.3` (build + runtime stages) to align with the engines floor.
+- **`@biomejs/biome` `^2.4.13` → `^2.4.14`**, **`@types/node` `^25.6.0` → `^25.6.2`**, **`tsc-alias` `^1.8.16` → `^1.8.17`** — patch bumps via `bun update --latest`.
+- **`scripts/devcheck.ts`** + **`scripts/build-changelog.ts`** — resynced from the framework package. Devcheck picks up the new `Framework Antipatterns` step (between `MCP Definitions` and `Docs Sync`); `build-changelog` parses the new `security` frontmatter flag.
+- **Skills refreshed from the framework package** (Phase A of `maintenance`): `add-service`, `add-tool`, `api-config`, `api-context`, `api-errors`, `api-linter`, `api-services`, `api-utils`, `api-workers`, `design-mcp-server`, `field-test`, `maintenance`, `release-and-publish`, `report-issue-framework`, `report-issue-local`, `security-pass`, `setup`. Mirrors at `.claude/skills/` and `.agents/skills/` re-propagated (Phase B). Local `devcheck` + `migrate-mcp-ts-template` skills preserved.
+- **`CLAUDE.md` + `AGENTS.md`** — adopted framework-authored template updates: `api-canvas` / `api-telemetry` / `tool-defs-analysis` slotted into the skill table, changelog frontmatter section now documents `security: boolean`, references to engines floor + skill set match the new framework baseline.
+- **`README.md` MCP SDK badge** `^1.27.1` → `^1.29.0` to match the version `@cyanheads/mcp-ts-core` actually pulls in.
+- **`changelog/template.md`** — refreshed to the framework's current authoring guide (added `security` frontmatter slot, expanded "Audience / Tone / Cut" prose).

package/changelog/0.3.x/0.3.16.md

@@ -0,0 +1,34 @@
+---
+summary: "Identifier-rich notFound errors with English-ordinal congress numbers, upstream casing normalized (bioguideID/URL/cmte_rpt_id → camelCase), bill summaries rendered HTML→Markdown, regex-validated resource params, empty-result recovery hint."
+breaking: false
+security: false
+---
+
+# 0.3.16 — 2026-05-08
+
+Quality-of-life pass on tool output and error messages. No new tools, no API changes.
+
+## Added
+
+- **`tryNotFound` service helper** — wraps generic upstream 404s into descriptive `notFound` errors carrying every identifier the caller supplied. Bill / law / member / committee / vote / nomination / nominee batch / daily-record / CRS report / committee report endpoints now surface messages like `Bill HR 3076 not found in the 119th Congress.` instead of `Not found.`. Includes an English `ordinal()` helper (`119` → `119th`).
+- **HTML → Markdown rendering for bill summaries** — `renderSummaryItem` in `format-helpers.ts` now converts upstream `<p>` / `<strong>` / `<em>` / anchor tags + named entities to structured Markdown. Previously stripped to plain text, losing paragraph breaks, emphasis, and links.
+- **Empty-result recovery hint** — `renderList` appends `Try broadening the filters — widen the date range, drop the type/chamber/state constraint, or remove the date window entirely.` when no items match. Improves agent recovery on overly-narrow queries.
+- **Shared `BILL_TYPE_CODES` constant** in `services/congress-api/types.ts` — single source for the `hr | s | hjres | sjres | hconres | sconres | hres | sres` enum, consumed by `bill-lookup.tool.ts`, `bill-summaries.tool.ts`, and `bill.resource.ts`. Removes three copies of the literal array.
+
+## Changed
+
+- **Field casing normalized to match the rest of the API surface:**
+  - `congressgov_roll_votes` operation `members` — `bioguideID` → `bioguideId`.
+  - `congressgov_crs_reports` operations `list` / `get` — `relatedMaterials[].URL` → `url`.
+  - `congressgov_committee_reports` operation `list` — `cmte_rpt_id` → `cmteRptId`.
+- **Resource params now strictly validated:**
+  - `congress://bill/{congress}/{billType}/{billNumber}` — `congress` and `billNumber` regex `^\d+$`; `billType` constrained to `BILL_TYPE_CODES`.
+  - `congress://committee/{committeeCode}` — regex `^[hsj][a-z0-9]{3,8}$` with `'h' (House), 's' (Senate), or 'j' (Joint)` hint.
+  - `congress://member/{bioguideId}` — regex `^[A-Z]\d{6}$`.
+- **`congress://committee/{committeeCode}` resource** now exposes top-level `name` (extracted from `history[0].officialName` / `libraryOfCongressName`) and `chamber` (inferred from the code's first letter) alongside the upstream payload.
+- **`CongressDetail` type** corrected to upstream shape: `congress: number` → `number: number`; `endYear` / `startYear` are `string`; new optional `updateDate` and `url`. `current-congress.resource.ts` log statement now reads `congress.number`.
+- **Tool / prompt descriptions tightened** — `congressgov_bill_summaries` now points one-bill queries at `congressgov_bill_lookup`; `congressgov_daily_record` lists the operation hierarchy explicitly; `congressgov_enacted_laws` moves `pub` / `priv` glossary into the `lawType` field describe; `congressgov_senate_nominations` lists operations upfront. `congressgov_bill_analysis` prompt adds `congressgov_committee_reports`; `congressgov_legislative_research` prompt adds an explicit bill-detail step.
+
+## Fixed
+
+- `getNominee` no longer shadows the new `ordinal()` helper — its `ordinal: number` parameter is now `ordinalNum`.

package/changelog/0.3.x/0.3.17.md

@@ -0,0 +1,28 @@
+---
+summary: "Adopt @cyanheads/mcp-ts-core ^0.8.19 → ^0.9.1: server-level `instructions` field surfaced on initialize, tool input-validation errors switch from `new Error` to the `validationError` factory, fetchResponse drops stale 404/429 status-code probing in favor of the framework's typed HTTP→McpError mapping."
+breaking: false
+security: false
+---
+
+# 0.3.17 — 2026-05-16
+
+Framework uptake release: `@cyanheads/mcp-ts-core ^0.8.19 → ^0.9.1` (15 intermediate releases, including the breaking 0.9.0 cut). No tool/resource surface changes; behavioral changes are limited to error-code mapping and the new `initialize` instructions payload.
+
+## Added
+
+- **Server-level `instructions`** ([mcp-ts-core#91](https://github.com/cyanheads/mcp-ts-core/issues/91)) — `createApp({ instructions })` in `src/index.ts` returns a one-paragraph orientation on every MCP `initialize` response. Spec-compliant clients forward it to the model as session-level context, replacing what previously would've leaked into every tool description. Covers domain (Congress.gov API v3), no-keyword-search semantics, and identifier conventions (`congress/billType/billNumber`, `bioguideId`, committee chamber-prefix codes).
+
+## Changed
+
+- **Tool input-validation errors use the `validationError` factory** across all 10 tool handlers (`bill-lookup`, `bill-summaries`, `committee-lookup`, `committee-reports`, `crs-reports`, `daily-record`, `enacted-laws`, `member-lookup`, `roll-votes`, `senate-nominations`). Previously `throw new Error(...)`, which the framework classified as `InternalError` (`-32603`). Now surfaces as JSON-RPC `ValidationError` (`-32602`) with structured `error.data` carrying the offending field names — proper error code for the failure mode and machine-actionable context for callers.
+- **`CongressApiService.fetchResponse` drops stale status-code probing.** Was unwrapping `error.data.statusCode === 404 / 429` from a generic `ServiceUnavailable` envelope; framework now maps HTTP status → typed `McpError` directly (`404 → NotFound`, `429 → RateLimited`, `5xx → ServiceUnavailable/InternalError/Timeout`). Local catch keeps only the `RateLimited` rewrap — preserves the domain-specific quota message (`5,000 requests/hour`); 404 rewrapping continues at call sites via `tryNotFound()` with identifier-rich data.
+- **`scripts/devcheck.ts` `bun outdated` parser fixed** (mirrors [mcp-ts-core#0.9.1](https://github.com/cyanheads/mcp-ts-core/blob/main/changelog/0.9.x/0.9.1.md)). `bun outdated` emits markdown rows (`| pkg | ... |`) with an empty leading cell, so `split('|')[0]` was always empty and the allowlist never matched. Now reads index `[1]` and strips the trailing `(dev|peer|prod|optional)` workspace marker.
+- **`scripts/build-changelog.ts` summary cap `250 → 350` chars** (mirrors [mcp-ts-core#129](https://github.com/cyanheads/mcp-ts-core/issues/129)). 250 was clipping operator-relevant context from rollup summaries. `changelog/template.md` updated in lockstep.
+- **Test mocks include `headers: new Headers()`** in `okJson` / `errorResponse` helpers — required because `fetchWithTimeout` reads response headers (status mapping, `Retry-After`). The CRS-outage 500 test now asserts `InternalError` instead of `ServiceUnavailable` to match the framework's tightened classification of HTML-bodied 500s.
+- **Skills re-synced from framework** — refreshed `add-tool`, `api-auth`, `api-config`, `api-errors`, `api-linter`, `api-workers`, `design-mcp-server`, `field-test`, `polish-docs-meta`, `security-pass`, `tool-defs-analysis`, plus the bundled `polish-docs-meta/references/` README/package-meta templates. Mirrored to `.claude/skills` and `.agents/skills`.
+- **README** — `OTEL_ENABLED` row now links to framework telemetry docs.
+- **Dependency bumps:**
+  - `@cyanheads/mcp-ts-core` `^0.8.19 → ^0.9.1`
+  - `@biomejs/biome` `^2.4.14 → ^2.4.15`
+  - `@types/node` `^25.6.2 → ^25.8.0`
+  - `vitest` `^4.1.5 → ^4.1.6`

package/changelog/0.3.x/0.3.18.md

@@ -0,0 +1,18 @@
+---
+summary: "Fix `congressgov_member_lookup` list to build the combined `/member/congress/{c}/{state}/{district}` URL instead of rejecting the filter combo, and classify upstream `500 (DoesNotExist)` bodies as `NotFound` across all endpoints (not just CRS) — affects `congressgov_committee_lookup` reports/bills/nominations sub-resources."
+breaking: false
+security: false
+---
+
+# 0.3.18 — 2026-05-20
+
+## Fixed
+
+- **`congressgov_member_lookup` list** ([#12](https://github.com/cyanheads/congressgov-mcp-server/issues/12)) — combining `congress` with `stateCode` (and optionally `district`) now hits `/member/congress/{congress}/{stateCode}[/{district}]` instead of throwing `validationError`. Congress.gov supports the nested path; the prior guard was wrong. `CongressApiService.listMembers` builds the path with a `/member/congress/{congress}` prefix when `congress` is set, then appends `stateCode` / `district` segments.
+- **`congressgov_committee_lookup` sub-resources** ([#10](https://github.com/cyanheads/congressgov-mcp-server/issues/10)) — missing committee codes on `reports`, `bills`, `nominations`, and `house-communication` sub-resources now surface as `NotFound` with the committee identifier in `error.data`. Congress.gov returns an HTTP `500` with a Django `Committee matching query does not exist. (DoesNotExist)` body for these — `CongressApiService.tryNotFound` now classifies that pattern as `NotFound`, generalizing the same handling previously inlined only in `getCrsReport`. `isMissingEntityErrorBody` regex extended to match `does not exist` alongside `not found` / `no data`.
+
+## Changed
+
+- **Dependency bumps:**
+  - `@types/node` `^25.8.0 → ^25.9.1`
+  - `vitest` `^4.1.6 → ^4.1.7`

package/changelog/0.3.x/0.3.19.md

@@ -0,0 +1,36 @@
+---
+summary: "Closes every open issue: domain renderers for member/nomination/vote/committee, `order` sort on `bill_lookup` and `roll_votes`, chamber inference on `committee_lookup`, partitioned-form hints for `senate_nominations`, and upstream-data normalization (CRS dedup/scheme, committee-report ISO dates, `/text` limit+1)."
+breaking: false
+security: false
+---
+
+# 0.3.19 — 2026-05-20
+
+No surface removals; additive params default to existing behavior and format upgrades preserve previously-rendered fields.
+
+## Added
+
+- **`order: 'recent' | 'oldest'` on `congressgov_bill_lookup` list** ([#23](https://github.com/cyanheads/congressgov-mcp-server/issues/23)) — sorts by `updateDate`; defaults to `recent`. Implemented server-side via `?sort=updateDate desc|asc` on `/bill/{c}[/{t}]`. `ListBillsParams` gains optional `sort`.
+- **`order: 'recent' | 'oldest'` on `congressgov_roll_votes` list** ([#23](https://github.com/cyanheads/congressgov-mcp-server/issues/23)) — Congress.gov ignores sort params on `/house-vote/{c}/{s}`, so `recent` (default) is implemented client-side via probe-count → fetch-tail → reverse. `offset` is interpreted in the reversed view; `offset=0` always returns the most recent page.
+- **Chamber inference on `congressgov_committee_lookup`** ([#9](https://github.com/cyanheads/congressgov-mcp-server/issues/9)) — `get`, `bills`, `reports`, and `nominations` no longer require `chamber`. `inferChamberFromCode` derives it from the first letter of `committeeCode` (`h` → house, `s` → senate, `j` → joint); pass `chamber` explicitly to override. `list` still uses chamber as a filter.
+- **Domain renderers replacing raw camelCase dumps** ([#18](https://github.com/cyanheads/congressgov-mcp-server/issues/18)) — `renderMemberDetail`, `renderRollVoteDetail`, `renderNominationListItem` / `renderNominationDetail`, `renderCommitteeListItem`, `renderCommitteeReportListItem`, `renderAmendmentItem`, `renderBillTextItem`, `renderBillSubresourceSummaryItem`. Each `formatXxx` exports route detail and list paths through the new renderers.
+- **Parent-nomination partitioned-form hint** ([#13](https://github.com/cyanheads/congressgov-mcp-server/issues/13), [#14](https://github.com/cyanheads/congressgov-mcp-server/issues/14)) — `senate_nominations get` on a multi-part parent (e.g. `PN851`, `partNumber=00` with no `nominees` array) appends a callout in detail rendering. Sub-resource calls (`actions`/`committees`/`hearings`/`nominees`) against a bare parent attach an `emptyHint` that surfaces in the empty-result formatter, pointing callers at the partitioned form (`851-1`, `851-2`, …).
+- **Opt-in `emptyHint` on `renderList`** ([#22](https://github.com/cyanheads/congressgov-mcp-server/issues/22)) — formatters now pass context-specific recovery text per call. Replaces the hardcoded "broaden the filters" advice that was irrelevant on most sub-resource operations (`cosponsors`, `nominees`, `actions`, `text`, …).
+
+## Changed
+
+- **`stripHtml` preserves paragraph and line breaks by default** ([#17](https://github.com/cyanheads/congressgov-mcp-server/issues/17)) — `<br>` → `\n`, `</p>` → `\n\n`; previously collapsed everything to one line. Compact-field-display callers pass `{ inline: true }` to keep the one-line behavior. Bill summaries now render with paragraph structure intact.
+- **`formatMembers` dispatches per-row across mixed bill+amendment lists** ([#6](https://github.com/cyanheads/congressgov-mcp-server/issues/6)) — amendments (identified by `amendmentNumber`) render with chamber-aware heading (e.g. "Senate Amendment 1234") inferred from the URL path (`samdt`/`hamdt`) and latest-action metadata, instead of `### N. Untitled`.
+- **`formatNominations` renders `nominationType` as a readable label** ([#16](https://github.com/cyanheads/congressgov-mcp-server/issues/16)) — `{isCivilian: true}` → "Civilian", `{isMilitary: true}` → "Military". Replaces the stringified inline-object dump on both list and detail paths.
+- **`formatCommitteeReports` list uses citation-first heading** ([#19](https://github.com/cyanheads/congressgov-mcp-server/issues/19)) — surfaces `citation`, `congress`, `chamber`, `type`, `number`, `updateDate` (and `part` when ≠ `"1"`). Upstream omits `title` on list rows; this gives callers identifying metadata to drill in.
+- **`renderCrsReportItem` omits the summary line when absent** ([#25](https://github.com/cyanheads/congressgov-mcp-server/issues/25)) — drops the `_Summary not available._` placeholder that previously appeared on every sparse row.
+- **`pickBillListRenderer` detects bill-text and bill-subresource-summary shapes** ([#17](https://github.com/cyanheads/congressgov-mcp-server/issues/17), [#20](https://github.com/cyanheads/congressgov-mcp-server/issues/20)) — text rows render as `### N. <type>` (e.g. "Enrolled Bill") with each format URL as a labeled link; summaries render via `htmlToMarkdown` so `<p>` / `<strong>` survive.
+- **`congressgov_bill_lookup` date-filter description corrected** ([#15](https://github.com/cyanheads/congressgov-mcp-server/issues/15)) — `fromDateTime` / `toDateTime` filter by the bill's `updateDate` (when Congress.gov last touched the record), not `latestAction.actionDate`. README updated in lockstep.
+- **`congressgov_senate_nominations` description documents partitioned-form semantics** ([#13](https://github.com/cyanheads/congressgov-mcp-server/issues/13), [#14](https://github.com/cyanheads/congressgov-mcp-server/issues/14)) — multi-part parents (e.g. `PN851`) carry no own activity; actions/committees/hearings/nominees live on partitioned children. `get` on a parent that lacks a `nominees` array signals the partitioned form is needed.
+- **`congressgov_enacted_laws` description clarifies value relative to `bill_lookup`** ([#24](https://github.com/cyanheads/congressgov-mcp-server/issues/24)) — `list` is the unique surface (filters bills by enactment status + law type, which `bill_lookup` can't); `get` mirrors `bill_lookup`'s bill detail. Points callers at `bill_lookup` as canonical for detail.
+
+## Fixed
+
+- **`congress-api-service.normalizeCrsReport`** ([#5](https://github.com/cyanheads/congressgov-mcp-server/issues/5), [#21](https://github.com/cyanheads/congressgov-mcp-server/issues/21)) — `relatedMaterials[]` dedupes by URL (upstream returns duplicates with mixed casing); the report's own `url` field gets `https://` prepended when it ships schemeless (`www.congress.gov/...`).
+- **`congressgov_bill_lookup text` returns exactly `limit` items** ([#4](https://github.com/cyanheads/congressgov-mcp-server/issues/4)) — `/bill/{c}/{t}/{n}/text` consistently returns `limit+1`; `fetchList` truncates to the requested page size so pagination is consistent across the surface.
+- **`congressgov_committee_lookup reports` returns ISO-8601 `updateDate`** ([#7](https://github.com/cyanheads/congressgov-mcp-server/issues/7)) — upstream emits `"YYYY-MM-DD HH:MM:SS+00:00"` on this endpoint only; `normalizeCommitteeReportSubresource` rewrites to `YYYY-MM-DDTHH:MM:SSZ` so callers see one shape across the surface.

package/changelog/0.3.x/0.3.2.md

@@ -0,0 +1,12 @@
+---
+summary: Restored idempotentHint:true on all tool annotations, dropped Cloudflare KV/R2/D1 from README, 5xx retry test fix
+breaking: false
+---
+
+# 0.3.2 — 2026-03-24
+
+### Changed
+
+- Restored explicit `idempotentHint: true` on all tool annotations
+- Removed Cloudflare KV/R2/D1 from README storage backends list
+- Updated 5xx retry test to verify retry count and mock `text()` method

package/changelog/0.3.x/0.3.20.md

@@ -0,0 +1,22 @@
+---
+summary: "Strict newest-first sort on `congressgov_roll_votes`, restored sub-resource rendering on `congressgov_senate_nominations`, empty-page disambiguation in list output, ISO 8601 validation on date filters, and a `Search:` echo line on every list response so callers can confirm what was filtered."
+breaking: false
+security: false
+---
+
+# 0.3.20 — 2026-05-20
+
+## Added
+
+- **`Search:` echo line on every list response** — list output now leads with `_Search: <scope> (filter=value, …)_` so the caller can confirm what was searched, even when results are empty. Renders the filters actually applied (congress, billType, date range, state, etc.).
+- **ISO 8601 validation on `fromDateTime` / `toDateTime`** — `congressgov_bill_lookup` and `congressgov_bill_summaries` now reject malformed date-times up front with an actionable message, instead of forwarding them and surfacing the opaque upstream 400.
+- **Tighter output schemas across all ten tools** — list operations declare `data` + `pagination` (`count`, `nextOffset`); detail operations declare the entity key (`bill`, `member`, `committee`, `vote`, `nomination`, `report`, `law`). Replaces the prior catch-all `passthrough` declarations.
+
+## Changed
+
+- **`congressgov_roll_votes` `order='recent'` is strictly newest-first** ([#27](https://github.com/cyanheads/congressgov-mcp-server/issues/27)) — fetches the full session, sorts by `updateDate` descending, then pages. Late-edited votes now land at the top instead of getting buried by the upstream's opaque insertion order. Typical sessions cost 1–3 upstream requests; subsequent pages are dispatched in parallel.
+- **`congressgov_senate_nominations` sub-resources render properly again** ([#26](https://github.com/cyanheads/congressgov-mcp-server/issues/26)) — `actions` rows show date + text + type, `committees` rows show committee name + activities, `nominees` rows show full name + ordinal + state, `hearings` rows show citation + chamber + date. Fixes the v0.3.19 regression where every sub-resource row rendered as bare `### N. Nomination` with all useful fields dropped.
+- **Empty paginated pages are now distinguishable from "0 total"** ([#28](https://github.com/cyanheads/congressgov-mcp-server/issues/28)) — when the page is past the end of a non-empty result set, output now reads `_Page is empty — offset is past the end of N total items._` instead of just `**N results**` with no items.
+- **`congressgov_committee_lookup` description documents `bills` sub-resource sparsity** ([#29](https://github.com/cyanheads/congressgov-mcp-server/issues/29)) — calls out that upstream omits titles on this endpoint and points callers at `congressgov_bill_lookup get` per row for titles and policy area.
+- **`congressgov_enacted_laws` description rewritten** — drops the prior "for symmetry" framing of `get` and describes what the payload actually is: the origin bill record with the public/private law citation on its `laws` array.
+- **Bill and CRS report detail views lead with a title-first header** — bill detail shows congress, chamber, policy area, dates, and latest action up top; CRS report detail shows type, status, version, dates, and authors up top. Replaces the prior raw field dump.

package/changelog/0.3.x/0.3.21.md

@@ -0,0 +1,15 @@
+---
+summary: "mcp-ts-core ^0.9.1 → ^0.9.6, zod added as direct dep, manifest.json + .mcpbignore scaffolded for MCPB bundle support, install badges added to README."
+breaking: false
+security: false
+---
+
+# 0.3.21 — 2026-05-23
+
+## Changed
+
+- **`@cyanheads/mcp-ts-core` `^0.9.1` → `^0.9.6`** — picks up upstream fixes and additions across the minor series.
+- **`zod` `^4.4.3` added as direct dep** — was previously a transitive peer; now explicit in `dependencies`.
+- **`manifest.json` scaffolded** — MCPB bundle metadata for one-click install in Claude Desktop. Env var: `CONGRESS_API_KEY` (optional). `bun run bundle` produces `dist/congressgov-mcp-server.mcpb`.
+- **`.mcpbignore` added** — excludes `node_modules/`, `src/`, scripts, and dev files from the bundle artifact.
+- **Install badges added to README** — Claude Desktop (`.mcpb`), Cursor, and VS Code deep-link badges.

package/changelog/0.3.x/0.3.22.md

@@ -0,0 +1,29 @@
+---
+summary: "mcp-ts-core ^0.9.6 → ^0.9.13, MCP_HTTP_MAX_BODY_BYTES 413 body cap, HTTP session-init gate, quieter 401/403/400/404 logging, GET /mcp surfaces package.json keywords, manifest.json and keyword alignment"
+breaking: false
+security: true
+---
+
+# 0.3.22 — 2026-05-28
+
+## Changed
+
+- **`@cyanheads/mcp-ts-core` `^0.9.6` → `^0.9.13`** — framework adoption across the 0.9.7–0.9.13 series.
+- **`landing.requireAuth: false`** — explicit opt-in added to `src/index.ts` after 0.9.13 changed the default to auth-gated when `MCP_AUTH_MODE` is `jwt` or `oauth`; preserves public landing inventory for `none`-auth deployments.
+- **`manifest.json`** — description updated to match `package.json`; `repository`, `homepage`, and `license` fields added; `CONGRESS_API_KEY` user_config entry gains `"default": ""`.
+- **`package.json` keywords** — `bun`, `stdio`, `streamable-http` added; now surfaced via `GET /mcp` (0.9.12 framework feature).
+- **`.env.example`** — `MCP_HTTP_MAX_BODY_BYTES` commented entry added (configurable 413 body cap, default 1 MiB).
+
+## Security
+
+- **`MCP_HTTP_MAX_BODY_BYTES` inbound body cap** (via framework 0.9.13) — oversized requests rejected with HTTP 413 before the MCP transport allocates. Default 1 MiB; set to `0` to disable.
+- **HTTP session-init gate** (via framework 0.9.10) — stateful HTTP mode rejects non-`initialize` requests missing `Mcp-Session-Id` with HTTP 400.
+
+## Fixed
+
+- **Quieter expected-error logging** (via framework 0.9.10) — 401, 403, 400, and 404 responses now use `warning`-level logging instead of full stack traces.
+
+## Dependency bumps
+
+- `@cyanheads/mcp-ts-core` `^0.9.6` → `^0.9.13`
+- `@biomejs/biome` `^2.4.15` → `^2.4.16`

package/changelog/0.3.x/0.3.23.md

@@ -0,0 +1,25 @@
+---
+summary: "Enrichment adoption on browse/list tools — effectiveQuery, totalCount, and notice now surface in structuredContent and content[]; fixed field-name mismatch that broke structuredContent output on list tools; single-record get paths now populate enrichment"
+breaking: false
+security: false
+agent-notes: |
+  Tool output schema change: the `query` field has been removed from `listOutput` and `listOrDetail` output schemas. Handlers now call `ctx.enrich.echo()`, `ctx.enrich.total()`, and `ctx.enrich.notice()` instead. The `enrichment` block (`effectiveQuery`, `totalCount`, `notice`) surfaces in structuredContent and the content[] markdown trailer. The helper `buildQueryEcho` was renamed to `buildEffectiveQuery`. Single-record get paths on bill-lookup, enacted-laws, member-lookup, and senate-nominations now populate enrichment.
+---
+
+# 0.3.23 — 2026-05-30
+
+## Changed
+
+- **`@cyanheads/mcp-ts-core` `^0.9.13` → `^0.9.16`** — framework adoption across the 0.9.14–0.9.16 series.
+- **Enrichment on browse/list tools** — all 10 tool handlers now call `ctx.enrich.echo()`, `ctx.enrich.total()`, and (on empty results) `ctx.enrich.notice()`. The `enrichment` block (`effectiveQuery`, `totalCount`, `notice`) surfaces in both `structuredContent` JSON and the `content[]` markdown trailer, reaching both Claude Code and Claude Desktop.
+- **`listOutput` / `listOrDetail` output schemas** — the standalone `query` field removed; replaced by the typed `enrichment: listEnrichment` block (`effectiveQuery`, `totalCount`, `notice`). Agents consuming `structuredContent` that previously read `result.query` should read `result.enrichment.effectiveQuery` instead.
+- **`buildQueryEcho` → `buildEffectiveQuery`** — renamed to match enrichment field naming.
+
+## Fixed
+
+- **`structuredContent` output validation on list tools** — the previous `output.query` field name did not match the framework's stored key, which caused validation failures on the affected list-mode tools. The field is now carried through the `enrichment` block, which uses the correct contract.
+- **Single-record get paths** — `bill-lookup`, `enacted-laws`, `member-lookup`, and `senate-nominations` were missing enrichment on their single-record fetch branches. All four now populate `ctx.enrich.echo()` and `ctx.enrich.total(1)` on the detail path.
+
+## Dependency bumps
+
+- `@cyanheads/mcp-ts-core` `^0.9.13` → `^0.9.16`

package/changelog/0.3.x/0.3.24.md

@@ -0,0 +1,20 @@
+---
+summary: "Typed error contracts on all 10 tools, classified upstream errors (no URL leak), and client-side calendar validation for impossible dates"
+breaking: false
+security: false
+---
+
+# 0.3.24 — 2026-05-31
+
+## Added
+
+- **`congressErrorContracts`** — shared `errors[]` array with `not_found`, `rate_limited`, `invalid_request`, and `upstream_error` reason codes; declared on all 10 tool definitions ([#32](https://github.com/cyanheads/congressgov-mcp-server/issues/32)). The service layer populates `data.reason` and `data.recovery.hint` on every raised error, making error responses machine-readable for agents that need to branch on error class.
+
+## Fixed
+
+- **Upstream error classification** — `classifyUpstreamError` in `congress-api-service.ts` now maps all non-2xx responses to classified domain errors: 400 → `invalid_request`, 403 → `invalid_request`, 5xx → `upstream_error` ([#34](https://github.com/cyanheads/congressgov-mcp-server/issues/34)). The internal `api.congress.gov` request URL is no longer echoed in error messages; each error carries `data.reason` + `data.recovery.hint`.
+- **Calendar validation in `validateIsoDateTime`** — `tool-helpers.ts` now rejects impossible dates (Feb 30, month 13, hour 25) client-side via `Date` round-trip check before any upstream call ([#35](https://github.com/cyanheads/congressgov-mcp-server/issues/35)). Previously, shape-valid but calendar-invalid ISO date-times were forwarded to Congress.gov, which returned an opaque HTTP 400.
+
+## Changed
+
+- **`devcheck.config.json`** — added `@cyanheads/mcp-ts-core` to the outdated dependency allowlist; framework released 0.9.18 mid-work; adoption is deferred (Casey-directed). `bun.lock` updated with transitive dependency refresh.

package/changelog/0.3.x/0.3.25.md

@@ -0,0 +1,12 @@
+---
+summary: "roll_votes members roster moved to top-level data[] — aligns with fleet-wide paginated envelope"
+breaking: false
+security: false
+---
+
+# 0.3.25 — 2026-05-31
+
+## Changed
+
+- **`congressgov_roll_votes` `operation=members`** — member roster moved from `vote.results` to top-level `data[]`, matching the fleet-wide `{ data, pagination, totalCount, effectiveQuery }` envelope ([#36](https://github.com/cyanheads/congressgov-mcp-server/issues/36)). `vote` is now a sibling object (same record as `get` returns, minus `results`); `pagination`/`totalCount` count `data`. `operation=get` and `operation=list` are unchanged.
+- **`formatVotes` members branch** — markdown output leads with a vote-context header (roll, congress/session, question, result, legislation), then `Members X–Y of N`, then the roster list. Vote context is still rendered inline — no extra round-trip needed.

package/changelog/0.3.x/0.3.26.md

@@ -0,0 +1,25 @@
+---
+summary: "congressgov_roll_votes: Senate chamber support via LIS XML feed — list/get/members for both chambers"
+breaking: false
+security: false
+---
+
+# 0.3.26 — 2026-05-31
+
+## Added
+
+- **`congressgov_roll_votes` `chamber` parameter** — accepts `'house'` (default, backward-compatible) or `'senate'`. Existing calls that omit `chamber` continue to hit the Congress.gov API unchanged. Resolves [#30](https://github.com/cyanheads/congressgov-mcp-server/issues/30).
+- **`SenateVoteService`** — dedicated client for the Senate's official LIS roll-call XML feed (`senate.gov/legislative/LIS/roll_call_votes/`); used for all Senate operations (the Congress.gov API v3 exposes no Senate vote namespace).
+- **Senate `list` operation** — browses roll call votes for a congress/session by fetching and client-paging the LIS session menu XML.
+- **Senate `get` operation** — returns vote question, date, result, yea/nay/present/not-voting tallies, party breakdown (derived from the member roster — the feed publishes none), and associated bill/nomination/amendment metadata.
+- **Senate `members` operation** — returns each senator's recorded position for a specific vote.
+- **`src/services/senate-lis/parse.ts`** — pure XML-to-domain parsers backed by `fast-xml-parser`; fixture-tested against real LIS feed data.
+- **`src/services/senate-lis/types.ts`** — Senate vote domain types.
+
+## Changed
+
+- **`format-helpers.ts`** — added Senate list, detail, and members renderers alongside existing House renderers.
+
+## Dependencies
+
+- `fast-xml-parser` added at `^5.8.0` (runtime dep; no new optional configuration required).

package/changelog/0.3.x/0.3.27.md

@@ -0,0 +1,16 @@
+---
+summary: "committee_lookup: filter param on list for name→code resolution; actionable not-found errors with code-shape hint and list redirect; whitespace guard rejects names passed as committeeCode"
+breaking: false
+security: false
+---
+
+# 0.3.27 — 2026-05-31
+
+## Added
+
+- **`filter` param on `committee_lookup` `operation: 'list'`** — resolves a committee name to `systemCode` client-side. Fetches the full chamber set, applies all-token primary match (order-independent, handles partials), falls back to best-token bigram-Dice similarity when the primary match is empty; fuzzy rows are labeled `approximate`. Never throws on no-match — returns empty data with a notice to call `list` unfiltered. ([#38](https://github.com/cyanheads/congressgov-mcp-server/issues/38))
+
+## Fixed
+
+- **`getCommittee` / `getCommitteeSubResource` not-found errors** now carry the code shape (`hspw00` = chamber prefix + abbreviation + digits) and redirect to `operation: 'list'` with the optional `filter`, matching the pattern of sibling tools (`getMember`, CRS report, nominee batch). ([#37](https://github.com/cyanheads/congressgov-mcp-server/issues/37))
+- **Whitespace guard in `committee_lookup` handler** — a `committeeCode` containing whitespace (a name, not a code) is rejected before the API round-trip with a `validationError` pointing to `operation: 'list'`. ([#37](https://github.com/cyanheads/congressgov-mcp-server/issues/37))

package/changelog/0.3.x/0.3.28.md

@@ -0,0 +1,18 @@
+---
+summary: "adopt @cyanheads/mcp-ts-core 0.9.21 — per-request log context fix, secret-scrubbing in fetchWithTimeout, withRetry fail-fast on non-retryable errors"
+breaking: false
+security: false
+---
+
+# 0.3.28 — 2026-06-02
+
+## Changed
+
+- **`@cyanheads/mcp-ts-core` `^0.9.16` → `^0.9.21`** — HTTP transport per-request log context fix (per-request logs and traces now carry fresh request + trace/span IDs instead of the frozen boot context); `fetchWithTimeout` strips query-string secrets (e.g. `?api_key=`) from error messages and logs; `withRetry` fails fast on non-retryable errors; `ctx.fail` auto-populates the `retryable` flag.
+- **Skills re-synced** — `add-tool`, `add-service`, `api-canvas`, `api-context`, `api-linter`, `api-utils`, `design-mcp-server`, `release-and-publish` updated; `api-mirror` and `orchestrations` skills added.
+- **`scripts/devcheck.ts`** replaced with framework-synced version; `scripts/check-skill-versions.ts` and `scripts/release-github.ts` added.
+
+## Dependencies
+
+- `@cyanheads/mcp-ts-core` `^0.9.16` → `^0.9.21`
+- `vitest` `^4.1.7` → `^4.1.8`

package/changelog/0.3.x/0.3.29.md

@@ -0,0 +1,13 @@
+---
+summary: "congressgov_committee_lookup: auto-resolve name-like committeeCode inputs, schema pattern guard on malformed codes (#39)"
+breaking: false
+security: false
+---
+
+# 0.3.29 — 2026-06-04
+
+## Fixed
+
+- **`congressgov_committee_lookup`** now auto-resolves name-like `committeeCode` inputs (e.g. `"senate banking"`) instead of rejecting them — fetches parent committees, runs the same token-match filter as `operation:'list'`, and proceeds with the resolved code when exactly one match is found; returns candidates when zero or multiple match, with a notice guiding the caller ([#39](https://github.com/cyanheads/congressgov-mcp-server/issues/39)).
+- **`committeeCode` schema** adds a `.regex()` pattern guard that rejects malformed codes at parse time (e.g. `ssbk` with no digit suffix) before any API call is made, surfacing a clear error message with recovery instructions.
+- **`committeeCode` description** updated to document the name-pass-through behavior and 2-digit suffix format requirement.

package/changelog/0.3.x/0.3.3.md

@@ -0,0 +1,11 @@
+---
+summary: Refreshed package descriptions across package.json/server.json/Dockerfile/README; typescript keyword added
+breaking: false
+---
+
+# 0.3.3 — 2026-03-24
+
+### Changed
+
+- Refreshed package description across package.json, server.json, Dockerfile, and README
+- Added `typescript` keyword to package.json

package/changelog/0.3.x/0.3.30.md

@@ -0,0 +1,28 @@
+---
+summary: "Maintenance: @cyanheads/mcp-ts-core ^0.9.21 → ^0.10.6; server identity name/title pair, de-scoped plugin display name, Dockerfile version label + writable data dirs + HEALTHCHECK, post-pack bundle cleaner, anchored .mcpbignore."
+breaking: false
+security: false
+---
+
+# 0.3.30 — 2026-06-11
+
+Framework adoption release — picks up the `@cyanheads/mcp-ts-core` 0.10.x line. No tool, resource, or prompt surface changes; behavior is unchanged.
+
+## Added
+
+- **Server identity pair** — `createApp()` now sets `name` and `title` to `congressgov-mcp-server`, so the unscoped machine name shows on every client surface instead of the npm-scoped package name.
+- **`scripts/clean-mcpb.ts`** — post-pack bundle cleaner wired into the `bundle` script: runs `mcpb clean` then strips `node_modules/**` agent-doc entries (`skills/`, `.claude/`, `.agents/`, `SKILL.md`) that root-anchored `.mcpbignore` patterns cannot reach.
+- **Dockerfile `HEALTHCHECK`** — bun-native `fetch` against `/healthz` every 30s (no `curl`/`wget` dependency on the slim image).
+- **Dockerfile writable data dirs** — pre-creates `/usr/src/app/.cache` and `/usr/src/app/.mirror` owned by the `bun` runtime user, so on-disk SQLite stores open cleanly for the non-root user.
+- **`techniques` skill** — catalog of reusable response/data-shaping patterns (first reference: outline-on-overflow).
+
+## Changed
+
+- **`@cyanheads/mcp-ts-core`** `^0.9.21` → `^0.10.6`. Notable upstream changes consumed on upgrade: env-boolean parsing tightened to Zod `stringbool` (rejects unrecognized values at startup); `ctx.sample`, sampling types, and `RootsRegistry` removed (SEP-2577 — this server used none); `ctx.elicit` now wired on the wire (this server presence-gates none); DataCanvas SQL gate fails closed on non-SELECT and denies `pragma_*`.
+- **`.codex-plugin/plugin.json`** — `interface.displayName` de-scoped from `@cyanheads/congressgov-mcp-server` to `congressgov-mcp-server`.
+- **Dockerfile** — `ARG APP_VERSION` stamps `org.opencontainers.image.version`; the release `docker buildx` passes `--build-arg APP_VERSION`.
+- **`.mcpbignore`** — root-anchored every dev-dir pattern (`/skills/`, `/.claude/`, `/.agents/`, `/Dockerfile`, …) so they can't strip nested `node_modules` runtime paths.
+- **`scripts/lint-packaging.ts`** — adds bundle-content guards (anchoring, critical-path, post-bundle agent-doc) and `name`/`title`/`display_name` identity checks against the unscoped package name.
+- **`scripts/check-framework-antipatterns.ts`** — adds the `coerce-boolean-env-flag` rule (flags `z.coerce.boolean()` in `src/`, recommends `z.stringbool()`); the scanner now skips comment lines.
+- **Framework skills synced** to the 0.10.x bodies (`api-canvas`, `api-context`, `api-linter`, `api-mirror`, `api-testing`, `api-workers`, `polish-docs-meta`, `orchestrations`, and the tool/resource/prompt/service scaffolds).
+- Dependencies: `@types/node` `^25.9.1` → `^25.9.3`.

package/changelog/0.3.x/0.3.31.md

@@ -0,0 +1,28 @@
+---
+summary: "Maintenance: @cyanheads/mcp-ts-core ^0.10.6 → ^0.10.9; devcheck gains floating-specifier and plugin-manifest guards, re-synced framework skills and scripts, dependency refresh. No tool/resource/prompt surface changes."
+breaking: false
+security: false
+---
+
+# 0.3.31 — 2026-06-20
+
+Framework maintenance release — tracks the `@cyanheads/mcp-ts-core` 0.10.7–0.10.9 line. No tool, resource, or prompt surface changes; behavior is unchanged.
+
+## Added
+
+- **`scripts/check-dependency-specifiers.ts`** — new `devcheck` step (`Dependency Specifiers`, `--no-dep-specifiers`). Hard-fails on floating specifiers (`latest`, `*`, pre-release dist-tags) in `package.json`'s dependency sections and `bun.lock`'s `workspaces` map, catching the case where `bun update --latest` writes a literal `latest` dist-tag into the lock and lets a later `bun install` re-resolve past the `package.json` range. Static and local — runs in the default and `--fast` passes.
+- **Plugin marketplace manifest checks** — `scripts/lint-packaging.ts` gains check 10, validating `.claude-plugin/plugin.json`, `.codex-plugin/plugin.json`, and `.codex-plugin/mcp.json` for non-empty descriptions and scoped/unscoped identity correctness (display fields carry the unscoped machine name; the `npx -y` install arg carries the full package name). Gated by the new `devcheck.config.json` `packaging.pluginManifests` flag (default on); the `devcheck` Packaging gate now also runs when a plugin manifest is present.
+
+## Changed
+
+- **`@cyanheads/mcp-ts-core`** `^0.10.6` → `^0.10.9`. Notable upstream changes consumed on upgrade: `ctx.content` collector for non-text content blocks (image/audio bytes ride `content[]` only, never `structuredContent`); fresh-scaffold `devcheck` guards skip git-dependent and changelog-sync checks cleanly before `git init`; `check-skill-versions` skips a skill deleted from the worktree instead of crashing; `DuckdbProvider.describe({ tableName })` qualifies its pushed `WHERE` filters (fixes an ambiguous-column binder error on filtered describes); the Canvas SQL gate classifies a SELECT-shaped statement that fails to prepare (bad column/function/expression) as `invalid_sql` with the DuckDB binder detail rather than `non_select_statement`; biome `2.4.16` → `2.5.0`.
+- **`devcheck.config.json`** — added `packaging.pluginManifests: true` to opt into the new plugin-manifest checks.
+- **`scripts/devcheck.ts`, `scripts/build-changelog.ts`, `scripts/check-framework-antipatterns.ts`, `scripts/check-skill-versions.ts`, `scripts/lint-packaging.ts`** — re-synced to the 0.10.x framework bodies (shared `isGitRepo()` skip guard, changelog empty-tree `--check` skip, worktree-deletion guard, plugin-manifest validation).
+- **Framework skills synced** to the 0.10.x bodies (`add-tool`, `api-auth`, `api-canvas`, `api-config`, `api-context`, `api-errors`, `api-services`, `api-telemetry`, `field-test`, `git-wrapup`, `orchestrations`, `polish-docs-meta`, `report-issue-local`, `tool-defs-analysis`).
+
+### Dependency bumps
+
+- `fast-xml-parser` `^5.8.0` → `^5.9.3`
+- `@biomejs/biome` `^2.4.16` → `^2.5.0`
+- `@types/node` `^25.9.3` → `^26.0.0`
+- `vitest` `^4.1.8` → `^4.1.9`

package/changelog/0.3.x/0.3.32.md

@@ -0,0 +1,21 @@
+---
+summary: "congressgov_committee_lookup name filter and resolution now page the full committee set instead of only the first 250; API-key rate-limit docs corrected to 5,000 req/hr; @cyanheads/mcp-ts-core ^0.10.9 → ^0.10.10; bun audit cleared 8 transitive advisories to 0."
+security: true
+---
+
+# 0.3.32 — 2026-06-30
+
+## Fixed
+
+- **`congressgov_committee_lookup`** — the `list` + `filter` path and the name→code resolution path now page the complete committee set (455 for the House, 818 across all chambers) via `pagination.nextOffset` before matching, instead of searching only the first 250 rows. A committee past row 250 — e.g. the Consumer Affairs and Coinage Subcommittee (`hsba02`, ~403 of 455) — was previously dropped with no notice, so the short result read as "doesn't exist." Both call sites share a new `fetchAllCommittees` helper; worst case ≈4 requests (818 ÷ 250). ([#41](https://github.com/cyanheads/congressgov-mcp-server/issues/41))
+- **API-key rate-limit documentation** — corrected from 1,000 to 5,000 req/hr across the config schema `.describe()`, `.env.example`, `server.json`, `manifest.json`, `README.md`, and the agent docs. The in-code limiter and the rate-limit error message were already 5,000; only the docs were stale. ([#42](https://github.com/cyanheads/congressgov-mcp-server/issues/42))
+
+## Security
+
+- **Transitive advisories cleared** — `bun audit` went from 8 advisories (2 high, 6 moderate) to 0. Refreshing the lockfile (`audit:refresh`) re-resolved stale transitive entries to already-patched versions: `vite` `8.0.14` → `8.1.2`, `hono` `4.12.26` → `4.12.27`, `js-yaml` `3.14.2` → `3.15.0`. The advisories came in through build- and test-chain transitives (`vitest`, `depcheck`, `@modelcontextprotocol/sdk`), not through `@cyanheads/mcp-ts-core`'s own code.
+
+## Dependency bumps
+
+- `@cyanheads/mcp-ts-core` `^0.10.9` → `^0.10.10`
+- `@biomejs/biome` `^2.5.0` → `^2.5.1`
+- `@types/node` `^26.0.0` → `^26.0.1`

package/changelog/0.3.x/0.3.4.md

@@ -0,0 +1,18 @@
+---
+summary: list handlers on current/bill-types resources for MCP discovery, CRS notFound on upstream HTTP 500, dep bumps
+breaking: false
+---
+
+# 0.3.4 — 2026-03-26
+
+### Added
+
+- `list` handlers on `congress://current` and `congress://bill-types` resources for MCP resource discovery
+
+### Fixed
+
+- CRS report lookup now returns `notFound` when the upstream API responds with HTTP 500 for nonexistent report IDs
+
+### Changed
+
+- Bumped `@cyanheads/mcp-ts-core` to ^0.1.29, `@biomejs/biome` to ^2.4.9, `vitest` to ^4.1.2

package/changelog/0.3.x/0.3.5.md

@@ -0,0 +1,23 @@
+---
+summary: Ten domain-specific markdown formatters replace the generic formatResult; core 0.1.29 → 0.2.3 bump; report-issue skills added
+breaking: false
+---
+
+# 0.3.5 — 2026-03-28
+
+### Changed
+
+- Rewrote tool output formatting — replaced generic `formatResult` with 10 domain-specific markdown formatters (`formatBills`, `formatMembers`, `formatSummaries`, `formatCommittees`, `formatCommitteeReports`, `formatCrsReports`, `formatDailyRecord`, `formatLaws`, `formatVotes`, `formatNominations`) for richer, more readable LLM output
+- Bumped `@cyanheads/mcp-ts-core` from ^0.1.29 to ^0.2.3
+- Updated `polish-docs-meta` skill to v1.2 — added GitHub repo metadata sync step and description propagation guidance
+
+### Added
+
+- `report-issue-framework` skill for filing bugs against `@cyanheads/mcp-ts-core`
+- `report-issue-local` skill for filing bugs against this server's repo
+- Security overrides for `brace-expansion` (>=2.0.3) and `path-to-regexp` (>=8.4.0)
+- `LOGS_DIR` env var documented in README and skill references
+
+### Removed
+
+- `tsx` dev dependency (no longer needed)