@cyanheads/mcp-ts-core 0.12.7 → 0.12.9

package/dist/utils/types/guards.d.ts

@@ -54,56 +54,6 @@ export declare function isRecord(value: unknown): value is Record<string, unknow
  * ```
  */
 export declare function hasProperty<K extends PropertyKey>(obj: unknown, key: K): obj is Record<K, unknown>;
-/**
- * Type guard to check if an object has a property of a specific type.
- *
- * @param obj - Object to check
- * @param key - Property key to look for
- * @param typeGuard - Type guard function for the property value
- * @returns True if object has the property and it matches the type
- *
- * @example
- * ```typescript
- * if (hasPropertyOfType(obj, 'count', (v): v is number => typeof v === 'number')) {
- *   // obj.count is now typed as number
- *   console.log(obj.count + 1);
- * }
- * ```
- */
-export declare function hasPropertyOfType<K extends PropertyKey, T>(obj: unknown, key: K, typeGuard: (value: unknown) => value is T): obj is Record<K, T>;
-/**
- * Type guard to check if a value is a string.
- *
- * @param value - Value to check
- * @returns True if value is a string
- *
- * @example
- * ```typescript
- * if (isString(value)) {
- *   // value is now typed as string
- *   console.log(value.toUpperCase());
- * }
- * ```
- */
-export declare function isString(value: unknown): value is string;
-/**
- * Type guard to check if a value is a number.
- *
- * `NaN` is explicitly excluded — `typeof NaN === 'number'` is true in JavaScript,
- * but `NaN` is almost never a valid value in the contexts where this guard is used.
- *
- * @param value - Value to check
- * @returns True if value is a finite or infinite number (excluding NaN)
- *
- * @example
- * ```typescript
- * if (isNumber(value)) {
- *   // value is now typed as number (NaN excluded)
- *   console.log(value.toFixed(2));
- * }
- * ```
- */
-export declare function isNumber(value: unknown): value is number;
 /**
  * Type guard to check if an error is an AggregateError.
  *
@@ -140,22 +90,6 @@ export declare function isAggregateError(error: unknown): error is Error & {
 export declare function isErrorWithCode(error: unknown): error is Error & {
     code: unknown;
 };
-/**
- * Type guard to check if an error has a status property.
- *
- * @param error - Error to check
- * @returns True if error has a status property
- *
- * @example
- * ```typescript
- * if (isErrorWithStatus(error)) {
- *   console.log(`HTTP status: ${error.status}`);
- * }
- * ```
- */
-export declare function isErrorWithStatus(error: unknown): error is Error & {
-    status: unknown;
-};
 /**
  * Safely get a property from an object if it exists.
  *
@@ -170,40 +104,4 @@ export declare function isErrorWithStatus(error: unknown): error is Error & {
  * ```
  */
 export declare function getProperty<K extends PropertyKey>(obj: unknown, key: K): unknown;
-/**
- * Safely get a string property from an object.
- *
- * @param obj - Object to get property from
- * @param key - Property key
- * @returns String value or undefined if property doesn't exist or is not a string
- *
- * @example
- * ```typescript
- * const traceId = getStringProperty(context, 'traceId');
- * if (traceId) {
- *   // traceId is typed as string
- *   console.log(traceId.toUpperCase());
- * }
- * ```
- */
-export declare function getStringProperty<K extends PropertyKey>(obj: unknown, key: K): string | undefined;
-/**
- * Safely get a number property from an object.
- *
- * Returns `undefined` if the property is absent, not a number, or is `NaN`.
- *
- * @param obj - Object to get property from
- * @param key - Property key
- * @returns Number value or undefined if property doesn't exist, is not a number, or is NaN
- *
- * @example
- * ```typescript
- * const retries = getNumberProperty(config, 'maxRetries');
- * if (retries !== undefined) {
- *   // retries is typed as number
- *   console.log(`Max retries: ${retries}`);
- * }
- * ```
- */
-export declare function getNumberProperty<K extends PropertyKey>(obj: unknown, key: K): number | undefined;
 //# sourceMappingURL=guards.d.ts.map

package/dist/utils/types/guards.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guards.d.ts","sourceRoot":"","sources":["../../../src/utils/types/guards.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;;;;;;;GAaG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAExD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,WAAW,CAAC,CAAC,SAAS,WAAW,EAC/C,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,CAAC,GACL,GAAG,IAAI,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAE3B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,WAAW,EAAE,CAAC,EACxD,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,CAAC,EACN,SAAS,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,KAAK,IAAI,CAAC,GACxC,GAAG,IAAI,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAErB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAExD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAExD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,KAAK,GAAG;IAAE,MAAM,EAAE,OAAO,EAAE,CAAA;CAAE,CAEvF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,KAAK,GAAG;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAElF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,KAAK,GAAG;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,CAEtF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,CAAC,SAAS,WAAW,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,OAAO,CAEhF;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,WAAW,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,MAAM,GAAG,SAAS,CAGjG;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,WAAW,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,MAAM,GAAG,SAAS,CAGjG"}
+{"version":3,"file":"guards.d.ts","sourceRoot":"","sources":["../../../src/utils/types/guards.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;;;;;;;GAaG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAExD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,WAAW,CAAC,CAAC,SAAS,WAAW,EAC/C,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,CAAC,GACL,GAAG,IAAI,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAE3B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,KAAK,GAAG;IAAE,MAAM,EAAE,OAAO,EAAE,CAAA;CAAE,CAEvF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,KAAK,GAAG;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAElF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,CAAC,SAAS,WAAW,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,OAAO,CAEhF"}

package/dist/utils/types/guards.js

@@ -60,62 +60,6 @@ export function isRecord(value) {
 export function hasProperty(obj, key) {
     return isObject(obj) && key in obj;
 }
-/**
- * Type guard to check if an object has a property of a specific type.
- *
- * @param obj - Object to check
- * @param key - Property key to look for
- * @param typeGuard - Type guard function for the property value
- * @returns True if object has the property and it matches the type
- *
- * @example
- * ```typescript
- * if (hasPropertyOfType(obj, 'count', (v): v is number => typeof v === 'number')) {
- *   // obj.count is now typed as number
- *   console.log(obj.count + 1);
- * }
- * ```
- */
-export function hasPropertyOfType(obj, key, typeGuard) {
-    return hasProperty(obj, key) && typeGuard(obj[key]);
-}
-/**
- * Type guard to check if a value is a string.
- *
- * @param value - Value to check
- * @returns True if value is a string
- *
- * @example
- * ```typescript
- * if (isString(value)) {
- *   // value is now typed as string
- *   console.log(value.toUpperCase());
- * }
- * ```
- */
-export function isString(value) {
-    return typeof value === 'string';
-}
-/**
- * Type guard to check if a value is a number.
- *
- * `NaN` is explicitly excluded — `typeof NaN === 'number'` is true in JavaScript,
- * but `NaN` is almost never a valid value in the contexts where this guard is used.
- *
- * @param value - Value to check
- * @returns True if value is a finite or infinite number (excluding NaN)
- *
- * @example
- * ```typescript
- * if (isNumber(value)) {
- *   // value is now typed as number (NaN excluded)
- *   console.log(value.toFixed(2));
- * }
- * ```
- */
-export function isNumber(value) {
-    return typeof value === 'number' && !Number.isNaN(value);
-}
 /**
  * Type guard to check if an error is an AggregateError.
  *
@@ -152,22 +96,6 @@ export function isAggregateError(error) {
 export function isErrorWithCode(error) {
     return error instanceof Error && hasProperty(error, 'code');
 }
-/**
- * Type guard to check if an error has a status property.
- *
- * @param error - Error to check
- * @returns True if error has a status property
- *
- * @example
- * ```typescript
- * if (isErrorWithStatus(error)) {
- *   console.log(`HTTP status: ${error.status}`);
- * }
- * ```
- */
-export function isErrorWithStatus(error) {
-    return error instanceof Error && hasProperty(error, 'status');
-}
 /**
  * Safely get a property from an object if it exists.
  *
@@ -184,46 +112,4 @@ export function isErrorWithStatus(error) {
 export function getProperty(obj, key) {
     return hasProperty(obj, key) ? obj[key] : undefined;
 }
-/**
- * Safely get a string property from an object.
- *
- * @param obj - Object to get property from
- * @param key - Property key
- * @returns String value or undefined if property doesn't exist or is not a string
- *
- * @example
- * ```typescript
- * const traceId = getStringProperty(context, 'traceId');
- * if (traceId) {
- *   // traceId is typed as string
- *   console.log(traceId.toUpperCase());
- * }
- * ```
- */
-export function getStringProperty(obj, key) {
-    const value = getProperty(obj, key);
-    return isString(value) ? value : undefined;
-}
-/**
- * Safely get a number property from an object.
- *
- * Returns `undefined` if the property is absent, not a number, or is `NaN`.
- *
- * @param obj - Object to get property from
- * @param key - Property key
- * @returns Number value or undefined if property doesn't exist, is not a number, or is NaN
- *
- * @example
- * ```typescript
- * const retries = getNumberProperty(config, 'maxRetries');
- * if (retries !== undefined) {
- *   // retries is typed as number
- *   console.log(`Max retries: ${retries}`);
- * }
- * ```
- */
-export function getNumberProperty(obj, key) {
-    const value = getProperty(obj, key);
-    return isNumber(value) ? value : undefined;
-}
 //# sourceMappingURL=guards.js.map

package/dist/utils/types/guards.js.map

@@ -1 +1 @@
-{"version":3,"file":"guards.js","sourceRoot":"","sources":["../../../src/utils/types/guards.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,WAAW,CACzB,GAAY,EACZ,GAAM;IAEN,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,GAAG,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAY,EACZ,GAAM,EACN,SAAyC;IAEzC,OAAO,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC;AACnC,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,OAAO,KAAK,YAAY,KAAK,IAAI,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC/F,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,OAAO,KAAK,YAAY,KAAK,IAAI,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,OAAO,KAAK,YAAY,KAAK,IAAI,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CAAwB,GAAY,EAAE,GAAM;IACrE,OAAO,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,iBAAiB,CAAwB,GAAY,EAAE,GAAM;IAC3E,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACpC,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7C,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,iBAAiB,CAAwB,GAAY,EAAE,GAAM;IAC3E,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACpC,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7C,CAAC"}
+{"version":3,"file":"guards.js","sourceRoot":"","sources":["../../../src/utils/types/guards.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,WAAW,CACzB,GAAY,EACZ,GAAM;IAEN,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,GAAG,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,OAAO,KAAK,YAAY,KAAK,IAAI,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC/F,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,OAAO,KAAK,YAAY,KAAK,IAAI,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CAAwB,GAAY,EAAE,GAAM;IACrE,OAAO,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyanheads/mcp-ts-core",
-  "version": "0.12.7",
+  "version": "0.12.9",
   "mcpName": "io.github.cyanheads/mcp-ts-core",
   "description": "Agent-native TypeScript framework for MCP servers. Includes runtime infrastructure and agent skills for building, testing, and shipping servers.",
   "files": [
@@ -206,14 +206,14 @@
     "@opentelemetry/exporter-trace-otlp-http": "^0.222.0",
     "@opentelemetry/instrumentation-http": "^0.222.0",
     "@opentelemetry/instrumentation-pino": "^0.68.0",
-    "@opentelemetry/resources": "^2.10.0",
-    "@opentelemetry/sdk-metrics": "^2.10.0",
+    "@opentelemetry/resources": "^2.11.0",
+    "@opentelemetry/sdk-metrics": "^2.11.0",
     "@opentelemetry/sdk-node": "^0.222.0",
-    "@opentelemetry/sdk-trace-node": "^2.10.0",
+    "@opentelemetry/sdk-trace-node": "^2.11.0",
     "@opentelemetry/semantic-conventions": "^1.43.0",
     "@socketsecurity/bun-security-scanner": "^1.1.2",
-    "@supabase/supabase-js": "^2.115.0",
-    "@types/bun": "^1.4.1",
+    "@supabase/supabase-js": "^2.116.0",
+    "@types/bun": "^1.4.2",
     "@types/node": "26.4.0",
     "@types/papaparse": "^5.5.2",
     "@types/sanitize-html": "^2.16.1",
@@ -230,7 +230,7 @@
     "execa": "^10.0.1",
     "fast-check": "^4.9.0",
     "fast-xml-parser": "^5.11.1",
-    "ignore": "^7.0.7",
+    "ignore": "^7.0.9",
     "js-yaml": "^5.4.1",
     "linkedom": "^0.18.13",
     "node-cron": "^4.6.0",
@@ -241,7 +241,7 @@
     "pino-pretty": "^13.1.3",
     "repomix": "^1.18.0",
     "sanitize-html": "^2.17.7",
-    "tsc-alias": "^1.9.2",
+    "tsc-alias": "^1.9.4",
     "typedoc": "^0.28.20",
     "typescript": "^7.0.2",
     "typescript-v6": "npm:typescript@^6.0.3",
@@ -282,7 +282,7 @@
   ],
   "packageManager": "bun@1.4.0",
   "engines": {
-    "bun": ">=1.3.0",
+    "bun": ">=1.4.0",
     "node": ">=24.0.0"
   },
   "depcheck": {
@@ -302,14 +302,14 @@
   "dependencies": {
     "@hono/node-server": "^2.1.1",
     "@modelcontextprotocol/client": "^2.0.0",
-    "@modelcontextprotocol/ext-apps": "^1.7.5",
+    "@modelcontextprotocol/ext-apps": "^2.0.0",
     "@modelcontextprotocol/server": "^2.0.0",
     "@opentelemetry/api": "^1.9.1",
     "dotenv": "^17.4.2",
     "hono": "^4.13.7",
     "jose": "^6.2.12",
     "pino": "^10.3.1",
-    "zod": "^4.5.4"
+    "zod": "^4.6.0"
   },
   "peerDependencies": {
     "@duckdb/node-api": "^1.5.5-r.1",

package/scripts/devcheck.ts

@@ -437,7 +437,8 @@ interface OutdatedRow {
   current: string;
   /** The declared key when attribution is unambiguous, else null. */
   declaredKey: string | null;
-  group: DependencyGroup | null;
+  /** The block the row belongs to; `bun outdated` leaves `prod` rows unmarked. */
+  group: DependencyGroup;
   /** The row verbatim, used to key the rendered rewrite back to its line. */
   line: string;
   /** First cell as printed, marker included. */
@@ -457,11 +458,11 @@ interface OutdatedRow {
  */
 function attributeOutdatedRow(
   target: string,
-  group: DependencyGroup | null,
+  group: DependencyGroup,
   current: string,
 ): Pick<OutdatedRow, 'candidates' | 'declaredKey'> {
   const matches = DECLARED_DEPENDENCIES.filter(
-    (declared) => declared.target === target && (group === null || declared.group === group),
+    (declared) => declared.target === target && declared.group === group,
   );
   const candidates = matches.map((declared) => declared.key);
   if (candidates.length <= 1) return { candidates, declaredKey: candidates[0] ?? null };
@@ -481,7 +482,7 @@ function parseOutdatedRows(output: string): OutdatedRow[] {
     const rawName = cells[1] ?? '';
     // Skip table chrome: header row and separator (e.g., "---")
     if (!rawName || rawName === 'Package' || /^-+$/.test(rawName)) continue;
-    const group = (OUTDATED_GROUP_MARKER.exec(rawName)?.[1] ?? null) as DependencyGroup | null;
+    const group = (OUTDATED_GROUP_MARKER.exec(rawName)?.[1] ?? 'prod') as DependencyGroup;
     const target = rawName.replace(OUTDATED_GROUP_MARKER, '');
     const current = cells[2] ?? '';
     const update = (cells[3] ?? '').replace(/\*/g, '').trim();
@@ -514,7 +515,7 @@ function renderOutdatedTable(output: string): string {
     const row = attributed.get(line);
     let display = cell.trim();
     if (row?.declaredKey && row.declaredKey !== row.target) {
-      display = row.group ? `${row.declaredKey} (${row.group})` : row.declaredKey;
+      display = row.group === 'prod' ? row.declaredKey : `${row.declaredKey} (${row.group})`;
     }
     return { line, display };
   });
@@ -552,9 +553,12 @@ function renderOutdatedTable(output: string): string {
  * Parses `bun audit` output and classifies high/critical vulnerabilities as
  * direct (in our package.json) or upstream (transitive dependency we can't fix).
  *
- * Bun audit format per vulnerability block:
- *   <package>  <version-range>        ← header (no indent, 2+ spaces before range)
- *     <parent> › <child> [› ...]      ← dependency path (indented, › = transitive)
+ * Bun audit format per vulnerability block — Bun 1.4 changed the header token
+ * and the path separator, so both shapes are accepted:
+ *   <package>  <version-range>        ← header, Bun <1.4 (no indent, 2+ spaces before range)
+ *   <package>@<version>               ← header, Bun ≥1.4
+ *     <parent> › <child> [› ...]      ← dependency path (indented; › or, Bun ≥1.4, > = transitive)
+ *     (direct dependency)             ← dependency path of a direct dependency, Bun ≥1.4
  *     <severity>: <description>       ← advisory (indented)
  *
  * Returns null if parsing yields no results (caller should fall back to default behavior).
@@ -567,8 +571,10 @@ function classifyAuditVulns(output: string): { direct: string[]; upstream: strin
     let i = 0;
 
     while (i < lines.length) {
-      // Package header: non-indented, name followed by 2+ spaces then version constraint
-      const pkgMatch = lines[i]?.match(/^([@\w][\w./-]*)\s{2,}(.+)$/);
+      // Package header: non-indented `name  range` (2+ spaces, Bun <1.4) or
+      // `name@version` (Bun ≥1.4). A scoped name leads with `@`, so only a
+      // later `@` splits the Bun 1.4 form.
+      const pkgMatch = lines[i]?.match(/^(@?\w[\w./-]*)(?:\s{2,}|@)(\S.*)$/);
       if (!pkgMatch) {
         i++;
         continue;
@@ -593,14 +599,15 @@ function classifyAuditVulns(output: string): { direct: string[]; upstream: strin
 
       if (!hasHighCritical) continue;
 
-      // Direct if: the vulnerable package is in our package.json,
-      // or any dependency path lacks › (meaning it's not pulled in transitively)
+      // Direct if: the vulnerable package is in our package.json, or any
+      // dependency path lacks a transitive separator — U+203A `›` (Bun <1.4)
+      // or `>` (Bun ≥1.4). Bun 1.4's literal `(direct dependency)` path has neither.
       const pkgName = pkg ?? '';
-      const isDirect = DIRECT_DEPS.has(pkgName) || paths.some((p) => !p.includes('\u203a'));
+      const isDirect = DIRECT_DEPS.has(pkgName) || paths.some((p) => !/[\u203a>]/.test(p));
       if (isDirect) {
         direct.push(`${pkgName} ${versionRange}`);
       } else {
-        const via = paths[0]?.split(/\s*\u203a\s*/)[0] ?? 'unknown';
+        const via = paths[0]?.split(/\s*[\u203a>]\s*/)[0] ?? 'unknown';
         upstream.push(`${pkgName} ${versionRange} (via ${via})`);
       }
     }

package/skills/add-provider/SKILL.md

@@ -4,7 +4,7 @@ description: >
   Add a new storage or service provider to the core package. Use when implementing a new backend for StorageService (e.g., a new database) or a new service provider (e.g., a new LLM backend).
 metadata:
   author: cyanheads
-  version: "1.0"
+  version: "1.1"
   audience: internal
   type: reference
 ---
@@ -53,7 +53,20 @@ Provider file location and naming differ by domain:
 1. **Identify the provider interface** — read the interface file for the target domain
    (see table above).
 2. **Create the provider file** following the file convention for its domain (see above).
-3. **Implement the interface** — all methods must be implemented.
+3. **Implement the interface** — all methods must be implemented. Storage providers build
+   on `src/storage/core/providerHelpers.ts` rather than re-deriving what the existing
+   providers share:
+
+   - `getManyViaGet` / `setManyViaSet` / `deleteManyViaDelete` — the batch methods as a
+     parallel fan-out over the single-key methods, for backends with no native batch API.
+   - `encodeEnvelope` / `decodeEnvelope` — the TTL envelope for backends with no TTL of their
+     own (R2, filesystem). `decodeEnvelope` returns `{ kind: 'expired' }` so the provider can
+     delete on read, returns pre-envelope JSON as a plain value, and throws `SyntaxError` on
+     invalid JSON so the provider can attach the key to the error it raises.
+   - `paginateSortedKeys` — one `list()` page over an already-sorted key set, with the cursor
+     for the page that follows.
+   - `escapeLikePattern` — escapes `%`, `_`, and `\` in a prefix before a SQL `LIKE`.
+
 4. **Lazy-load dependencies** if Tier 3:
 
    ```typescript
@@ -94,7 +107,7 @@ Provider file location and naming differ by domain:
    `isServerless()` guard:
 
    ```typescript
-   // src/storage/core/storageFactory.ts ~line 112
+   // src/storage/core/storageFactory.ts
    !['in-memory', 'cloudflare-r2', 'cloudflare-kv', 'cloudflare-d1'].includes(providerType)
    ```
 
@@ -115,9 +128,10 @@ Provider file location and naming differ by domain:
 - [ ] Registered in the correct factory for the domain (see Step 5)
 - [ ] Storage: provider string added to `z.enum` in `src/config/index.ts`
 - [ ] Storage: Worker-compatible array in `storageFactory.ts` updated if applicable
+- [ ] Storage: batch, TTL envelope, paging, and `LIKE` escaping come from `providerHelpers.ts`, not a local copy
 - [ ] Speech: `provider` literal added to `SpeechProviderConfig` union in `types.ts`
 - [ ] LLM: `src/core/app.ts` instantiation logic updated if adding a second LLM provider
 - [ ] Optional peer dependency added to both `peerDependencies` and `peerDependenciesMeta` in `package.json` if Tier 3
 - [ ] `bun run rebuild` succeeds
 - [ ] `bun run devcheck` passes
-- [ ] Test file created at `src/storage/providers/{{name}}/{{name}}Provider.test.ts` (or equivalent path for the domain) and `bun run test` passes
+- [ ] Tests added under `tests/unit/storage/providers/{{providerName}}/` (storage) or `tests/unit/services/{{domain}}/providers/{{provider-name}}.provider.test.ts` (LLM / speech), and `bun run test` passes

package/skills/add-tool/SKILL.md

@@ -4,7 +4,7 @@ description: >
   Scaffold a new MCP tool definition. Use when the user asks to add a tool, create a new tool, or implement a new capability for the server.
 metadata:
   author: cyanheads
-  version: "2.22"
+  version: "2.23"
   audience: external
   type: reference
 ---
@@ -26,9 +26,9 @@ Tools use the `tool()` builder from `@cyanheads/mcp-ts-core`. Each tool lives in
 
 Tools use lowercase snake_case with a canonical server/domain prefix: `{server}_{verb}_{noun}` — 3 words.
 
-Examples: `pubmed_search_articles`, `pubmed_fetch_fulltext`, `clinicaltrials_find_studies`.
+Examples: `pubmed_search_articles`, `pubmed_fetch_fulltext`, `clinicaltrials_find_eligible`.
 
-The server prefix uses the canonical platform/brand name, not an abbreviation (`patentsview_` not `patents_`, `clinicaltrials_` not `ct_`). When a name resists the schema — can't pick a verb, noun feels generic, wants 4+ segments — that's usually a signal the scope is fuzzy; split the tool, rename, or reconsider.
+The server prefix is judged on clarity, not length: the brand name or the plain well-known word for the domain both pass (`pubmed_`, `patents_`); an abbreviation fails only when it reads as something else out of context (`loc_`, `ct_`). A fourth segment is fine when the noun is inherently two words (`openfda_search_device_clearances`). When a name resists the schema — can't pick a verb, noun feels generic, the *verb* wants a second word — that's usually a signal the scope is fuzzy; split the tool, rename, or reconsider.
 
 For shape selection (Workflow or Instruction variants — standard single-action tools are the default), see the `design-mcp-server` skill's Tool shapes section.
 
@@ -774,7 +774,7 @@ Large payloads burn the agent's context window. Default to curated summaries; of
 - **Lists**: Return top N with a total count and pagination cursor, not unbounded arrays
 - **Large objects**: Return key fields by default; accept a `fields` or `verbose` parameter for full data
 - **Binary/blob content**: Return metadata and a reference, not the raw content
-- **Analytical working sets**: When upstream returns more *analytical* rows (data an agent would SQL — aggregate, group, join) than fit in context, `DataCanvas` (`ctx.core.canvas?`, Tier 3 — opt-in via `CANVAS_PROVIDER_TYPE=duckdb`) lets you register the rows and return the `canvas_id` plus a preview so the agent can run SQL to slice down without a re-fetch. The `spillover()` helper (`@cyanheads/mcp-ts-core/canvas`) automates the overflow case: drain rows up to a character budget for the inline preview, auto-register the full source on overflow, return both as a discriminated union. **Two gates:** it must be analytical, not a discovery/search surface of categorical metadata (those don't earn a canvas regardless of row count — use MCP-side list filtering or pagination); and a tool emitting a `canvas_id` MUST be paired with a registered `dataframe_query` tool, or the handle is unreachable. Compute distributions or refinement hints across the full result — not the preview — so the agent gets honest aggregate signal on the rows it didn't read. See `api-canvas` for the register / query / export pattern and the spillover flow.
+- **Analytical working sets**: When upstream returns more *analytical* rows (data an agent would SQL — aggregate, group, join) than fit in context, `DataCanvas` (`core.canvas`, wired in `setup()` via `setCanvas`; Tier 3 — opt-in via `CANVAS_PROVIDER_TYPE=duckdb`) lets you register the rows and return the `canvas_id` plus a preview so the agent can run SQL to slice down without a re-fetch. The `spillover()` helper (`@cyanheads/mcp-ts-core/canvas`) automates the overflow case: drain rows up to a character budget for the inline preview, auto-register the full source on overflow, return both as a discriminated union. **Two gates:** it must be analytical, not a discovery/search surface of categorical metadata (those don't earn a canvas regardless of row count — use MCP-side list filtering or pagination); and a tool emitting a `canvas_id` MUST be paired with a registered `dataframe_query` tool, or the handle is unreachable. Compute distributions or refinement hints across the full result — not the preview — so the agent gets honest aggregate signal on the rows it didn't read. See `api-canvas` for the register / query / export pattern and the spillover flow.
 - **One large document**: When a single call returns one document-shaped record (not a row set) that can overflow context, return a section *outline* — top-level keys + per-section byte size — and let the agent re-call with `sections: [...]` for only what it needs, instead of truncating one surface. `outlineOnOverflow()` with `OUTLINE_VARIANT` / `selectSections()` / `formatOutline()` (`@cyanheads/mcp-ts-core/utils`) measures the payload and returns a `full | outline` result. Declare the tool's `output` as a flat `z.object` with a `kind` discriminator and presence-based optional arms (fold in `OUTLINE_VARIANT.shape.sections` / `.notice`) — `tool()` rejects a `z.discriminatedUnion` output — and render each arm on field presence in `format()` so parity holds. Pure measure + key-slice — Workers-portable, unlike canvas `spillover()`. Use for one fat record; use `spillover()` for a row collection. See the `techniques` skill's `outline-on-overflow` reference.
 
 ## MCP-side list filtering

package/skills/api-config/SKILL.md

@@ -4,7 +4,7 @@ description: >
   Reference for core and server configuration in `@cyanheads/mcp-ts-core`. Covers env var tables with defaults, priority order, server-specific Zod schema pattern, and Workers lazy-parsing requirement.
 metadata:
   author: cyanheads
-  version: "1.15"
+  version: "1.16"
   audience: external
   type: reference
 ---
@@ -95,7 +95,6 @@ await createApp({
 | `MCP_HTTP_RESUMABILITY` | `mcpHttpResumability` | `true` | SSE stream replay under stateful HTTP. On by default — selecting a session mode is the opt-in. Kill switch only; no effect on stateless serving or the session-less 2026-07-28 era |
 | `MCP_HTTP_RESUMABILITY_MAX_EVENTS` | `mcpHttpResumabilityMaxEvents` | `512` | Events retained per session for replay; oldest evicted first. Lower it on a server whose tools return large results |
 | `MCP_HTTP_RESUMABILITY_TTL_MS` | `mcpHttpResumabilityTtlMs` | `300000` | 5 min; how long a retained event stays replayable |
-| `MCP_RESPONSE_VERBOSITY` | `mcpResponseVerbosity` | `standard` | `minimal` \| `standard` \| `full` |
 | `MCP_ALLOWED_ORIGINS` | `mcpAllowedOrigins` | — | Comma-separated list; omit to allow all |
 | `MCP_SERVER_RESOURCE_IDENTIFIER` | `mcpServerResourceIdentifier` | — | RFC 8707 resource indicator URL |
 | `MCP_PUBLIC_URL` | `mcpPublicUrl` | — | Public-facing origin for reverse proxies (Cloudflare Tunnel, nginx, ALB) so emitted URLs carry the correct scheme |
@@ -131,19 +130,6 @@ await createApp({
 | `DEV_MCP_CLIENT_ID` | `devMcpClientId` | — | Dev-only: override client ID |
 | `DEV_MCP_SCOPES` | `devMcpScopes` | — | Dev-only: comma-separated scope overrides |
 
-#### OAuth proxy (optional sub-object)
-
-Activated when `OAUTH_PROXY_AUTHORIZATION_URL` or `OAUTH_PROXY_TOKEN_URL` is set.
-
-| Env Var | `AppConfig` field | Notes |
-|:--------|:-----------------|:------|
-| `OAUTH_PROXY_AUTHORIZATION_URL` | `oauthProxy.authorizationUrl` | Proxy authorization endpoint |
-| `OAUTH_PROXY_TOKEN_URL` | `oauthProxy.tokenUrl` | Proxy token endpoint |
-| `OAUTH_PROXY_REVOCATION_URL` | `oauthProxy.revocationUrl` | Optional |
-| `OAUTH_PROXY_ISSUER_URL` | `oauthProxy.issuerUrl` | Optional |
-| `OAUTH_PROXY_SERVICE_DOCUMENTATION_URL` | `oauthProxy.serviceDocumentationUrl` | Optional |
-| `OAUTH_PROXY_DEFAULT_CLIENT_REDIRECT_URIS` | `oauthProxy.defaultClientRedirectUris` | Comma-separated list |
-
 ---
 
 ### Storage
@@ -174,13 +160,13 @@ Activated when `OAUTH_PROXY_AUTHORIZATION_URL` or `OAUTH_PROXY_TOKEN_URL` is set
 
 #### Supabase (optional sub-object)
 
-Activated when both `SUPABASE_URL` and `SUPABASE_ANON_KEY` are set.
+Activated when `SUPABASE_URL` is set.
 
 | Env Var | `AppConfig` field | Notes |
 |:--------|:-----------------|:------|
 | `SUPABASE_URL` | `supabase.url` | Required to activate |
-| `SUPABASE_ANON_KEY` | `supabase.anonKey` | Required to activate |
-| `SUPABASE_SERVICE_ROLE_KEY` | `supabase.serviceRoleKey` | Optional; elevated access |
+| `SUPABASE_SERVICE_ROLE_KEY` | `supabase.serviceRoleKey` | Required by the `supabase` storage provider (admin client) |
+| `SUPABASE_ANON_KEY` | `supabase.anonKey` | Optional; for the server's own public client — the framework never reads it |
 
 ---
 

package/skills/api-errors/SKILL.md

@@ -4,7 +4,7 @@ description: >
   McpError constructor, JsonRpcErrorCode reference, and error handling patterns for `@cyanheads/mcp-ts-core`. Use when looking up error codes, understanding where errors should be thrown vs. caught, or using ErrorHandler.tryCatch in services.
 metadata:
   author: cyanheads
-  version: "1.9"
+  version: "1.10"
   audience: external
   type: reference
 ---
@@ -363,6 +363,7 @@ Important properties:
 - **`data` propagation is restricted** to explicitly-thrown `McpError.data` and `ZodError.issues`. Auto-classified plain errors (`TypeError`, network errors, etc.) emit `code` + `message` only — no `data` — so internal classification context never leaks to clients.
 - **Recovery hint mirroring is automatic.** When the thrown `McpError` carries `data.recovery.hint`, the handler factory appends it to the `content[]` text so the markdown surface matches the JSON surface. Authors don't need to format the hint manually.
 - **Argument-schema rejection is a tool error with the same envelope.** An unknown root key, a wrong type, a missing required field, or a failed constraint returns `isError: true` with `structuredContent.error.code = -32602` (`InvalidParams`) and the readable `Invalid arguments for tool <name>: …` diagnostic in `content[]`. The handler never runs. Two neighbouring failures keep the protocol error path instead, arriving as a JSON-RPC error rather than a tool result: an unknown or disabled tool name, and a malformed request envelope.
+- **A schema constraint cannot carry a declared reason.** Because the handler never runs, a rejection by `.max()`, `.regex()`, `.min()`, or any other Zod refinement bypasses `errors[]` entirely: it arrives as `InvalidParams` with `data.issues` and no `data.reason`, so a caller has nothing to branch on and gets no recovery hint. Decide per constraint which surface it belongs on. A bound that is purely structural — the input is the wrong shape and no guidance beyond the diagnostic would help — belongs on the schema, where it also advertises itself in `inputSchema`. A bound a caller is expected to recover from belongs in the handler as `ctx.fail('reason', message, ctx.recoveryFor('reason'))` against a declared `errors[]` entry, with the limit restated in the field's `.describe()` so it is still visible before the call. Enforcing the same bound in both places is the trap: the schema wins, and the contract entry becomes unreachable while still reading as covered.
 
 **Handler — throw freely, no try/catch:**
 

package/skills/api-mirror/SKILL.md

@@ -4,7 +4,7 @@ description: >
   Stand up a persistent, self-refreshing local mirror of a bulk upstream dataset with the MirrorService (@cyanheads/mcp-ts-core/mirror). Use when a server wraps a large or slow API and should query a synced local index (embedded SQLite + FTS5) instead of paginating the live API per request.
 metadata:
   author: cyanheads
-  version: "1.1"
+  version: "1.2"
   audience: external
   type: reference
 ---
@@ -81,6 +81,8 @@ Why they can't merge: during a from-scratch init the records aren't ordered by t
 
 For access paths the generic query can't express — junction tables for index-backed multi-value filtering, denormalized counters, bespoke `bm25` weighting — use the **raw handle**: `const db = await mirror.raw();` then run prepared statements against your own auxiliary tables (declare them via a migration). Add the auxiliary DDL in a `migrations` step; maintain it from your `sync` mapping or SQL triggers.
 
+A migration runs identically on first creation and on upgrade: a fresh database runs every migration up to `version` right after the declarative DDL, an existing one runs only those above its stored version. So `up()` must tolerate a database that already has the current declarative shape — `CREATE TABLE IF NOT EXISTS` for auxiliary objects, never an `ALTER` that assumes an older layout of a declared column.
+
 ## Readiness — key off the completion marker, not live status
 
 `status().ready` is `true` once a full sync has **ever completed** (`completedAt != null`), not when `status === 'complete'`. The dataset stays transactionally queryable during a refresh, so a mirror mid-refresh — or one whose last refresh failed — is still ready and should keep serving. Gate the mirror read path on `await mirror.ready()`; fall back to the live API only when it is `false` (cold, never-completed init).

package/skills/api-services/SKILL.md

@@ -4,7 +4,7 @@ description: >
   API reference for built-in service providers (LLM, Speech, Graph). Use when looking up service interfaces, provider capabilities, or integration patterns.
 metadata:
   author: cyanheads
-  version: "1.4"
+  version: "1.5"
   audience: external
   type: reference
 ---

package/skills/api-services/references/speech.md

@@ -24,7 +24,7 @@ The provider interface — implemented by ElevenLabs (TTS) and Whisper (STT):
 | `.getSTTProvider()` | `ISpeechProvider` | Throws `McpError(InvalidRequest)` if no STT provider configured |
 | `.hasTTS()` | `boolean` | Check if TTS is available |
 | `.hasSTT()` | `boolean` | Check if STT is available |
-| `.healthCheck()` | `Promise<{ tts: boolean; stt: boolean }>` | Checks both providers sequentially |
+| `.healthCheck()` | `Promise<{ tts: boolean; stt: boolean }>` | Checks both providers in parallel |
 
 ## Providers
 
@@ -52,7 +52,6 @@ const ttsProvider = speechService.getTTSProvider();
 const ttsResult = await ttsProvider.textToSpeech({
   text: 'Hello, world!',
   voice: { voiceId: 'some-voice-id' },
-  format: 'mp3',
 });
 
 // Speech-to-Text