@cyanheads/mcp-ts-core 0.13.7 → 0.13.9

package/scripts/lint-mcp.ts

@@ -12,6 +12,11 @@
  *   3. Extracts exported definitions by duck-typing (has name/handler/input etc.)
  *   4. Feeds them into `validateDefinitions()`
  *
+ * A definition file whose `import()` rejects, and a `server.json` that exists
+ * but does not parse, are errors (`definition-import-failed`,
+ * `server-json-parse`): what they declare cannot be checked, so the run fails
+ * instead of passing without them. The remaining files are still linted.
+ *
  * Runtime-agnostic: works with bun, tsx, and Node.js (via ts-node/esm).
  *
  * Rule knobs come from the project's `devcheck.config.json` `lint` block, so one
@@ -20,7 +25,7 @@
  * @module scripts/lint-mcp
  */
 import { existsSync, readdirSync, readFileSync } from 'node:fs';
-import { join, resolve } from 'node:path';
+import { join, relative, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 // ---------------------------------------------------------------------------
@@ -100,19 +105,64 @@ function discoverFiles(): string[] {
   return [...new Set(files)];
 }
 
+// ---------------------------------------------------------------------------
+// Load failures
+// ---------------------------------------------------------------------------
+
+/** Where the rule reference lives — the breadcrumb `validateDefinitions()` appends too. */
+const SKILL_REFERENCE_PATH = 'framework-skills/api-linter/SKILL.md';
+
+/** A file the CLI could not load, shaped like the diagnostics it is printed beside. */
+interface LoadFailure {
+  message: string;
+  rule: 'definition-import-failed' | 'server-json-parse';
+}
+
+/**
+ * The text of a thrown value. An `AggregateError` keeps its causes in `errors`
+ * — Bun rejects a definition that fails to transpile with one whose own message
+ * only counts them ("2 errors building …") — so each cause is appended.
+ */
+function describeError(err: unknown): string {
+  if (!(err instanceof Error)) return String(err);
+  const message = err.message || err.name;
+  if (!(err instanceof AggregateError) || err.errors.length === 0) return message;
+  return `${message} (${err.errors.map(describeError).join('; ')})`;
+}
+
+function loadFailure(rule: LoadFailure['rule'], file: string, err: unknown): LoadFailure {
+  const anchor = rule === 'server-json-parse' ? 'server-json-rules' : rule;
+  return {
+    rule,
+    message: `${file}: ${describeError(err)}\nSee: ${SKILL_REFERENCE_PATH}#${anchor}`,
+  };
+}
+
 // ---------------------------------------------------------------------------
 // Main
 // ---------------------------------------------------------------------------
 
-/** Try to read and parse a JSON file. Returns undefined on failure. */
-function tryReadJson(path: string): unknown {
+/** A parsed JSON file, or the error an existing one failed to read or parse with. */
+type JsonRead = { ok: true; value: unknown } | { ok: false; error: unknown };
+
+/** Reads and parses a JSON file. `undefined` when the file does not exist. */
+function readJson(path: string): JsonRead | undefined {
+  if (!existsSync(path)) return;
   try {
-    if (!existsSync(path)) return;
-    return JSON.parse(readFileSync(path, 'utf-8'));
-  } catch (err) {
-    console.warn(`Warning: Failed to parse ${path}: ${err instanceof Error ? err.message : err}`);
+    return { ok: true, value: JSON.parse(readFileSync(path, 'utf-8')) };
+  } catch (error) {
+    return { ok: false, error };
+  }
+}
+
+/** Try to read and parse a JSON file. Returns undefined when absent, and warns when unparseable. */
+function tryReadJson(path: string): unknown {
+  const read = readJson(path);
+  if (read?.ok === false) {
+    console.warn(`Warning: Failed to parse ${path}: ${describeError(read.error)}`);
     return;
   }
+  return read?.value;
 }
 
 /** The `lint` block of `devcheck.config.json`, as far as this script reads it. */
@@ -149,12 +199,17 @@ export function readLintOptions(configPath = resolve('devcheck.config.json')): L
 
 async function main(): Promise<void> {
   const files = discoverFiles();
+  const failures: LoadFailure[] = [];
 
   // Discover server.json and package.json at project root
-  const serverJson = tryReadJson(resolve('server.json'));
+  const serverJsonRead = readJson(resolve('server.json'));
+  if (serverJsonRead?.ok === false) {
+    failures.push(loadFailure('server-json-parse', 'server.json', serverJsonRead.error));
+  }
+  const serverJson = serverJsonRead?.ok ? serverJsonRead.value : undefined;
   const packageJson = tryReadJson(resolve('package.json')) as { version?: string } | undefined;
 
-  if (files.length === 0 && serverJson == null) {
+  if (files.length === 0 && serverJson == null && failures.length === 0) {
     console.log('No MCP definition files or server.json found. Skipping lint.');
     process.exit(0);
   }
@@ -162,36 +217,42 @@ async function main(): Promise<void> {
   const tools: unknown[] = [];
   const resources: unknown[] = [];
   const prompts: unknown[] = [];
+  let failedImports = 0;
 
   for (const file of files) {
+    let mod: Record<string, unknown>;
     try {
-      const mod = await import(file);
-      for (const exported of Object.values(mod)) {
-        if (isToolLike(exported)) tools.push(exported);
-        else if (isResourceLike(exported)) resources.push(exported);
-        else if (isPromptLike(exported)) prompts.push(exported);
-      }
+      mod = await import(file);
     } catch (err) {
-      console.warn(
-        `Warning: Failed to import ${file}: ${err instanceof Error ? err.message : err}`,
-      );
+      failures.push(loadFailure('definition-import-failed', relative(process.cwd(), file), err));
+      failedImports++;
+      continue;
+    }
+    for (const exported of Object.values(mod)) {
+      if (isToolLike(exported)) tools.push(exported);
+      else if (isResourceLike(exported)) resources.push(exported);
+      else if (isPromptLike(exported)) prompts.push(exported);
     }
   }
 
   const defTotal = tools.length + resources.length + prompts.length;
-  if (defTotal === 0 && serverJson == null) {
+  if (defTotal === 0 && serverJson == null && failures.length === 0) {
     console.log(`Scanned ${files.length} files but found no definitions. Skipping lint.`);
     process.exit(0);
   }
 
   const parts: string[] = [];
-  if (defTotal > 0) {
+  if (defTotal > 0 || failedImports > 0) {
+    const fileCount =
+      failedImports === 0
+        ? `${files.length}`
+        : `${files.length - failedImports} of ${files.length}`;
     parts.push(
-      `${tools.length} tool(s), ${resources.length} resource(s), ${prompts.length} prompt(s) from ${files.length} file(s)`,
+      `${tools.length} tool(s), ${resources.length} resource(s), ${prompts.length} prompt(s) from ${fileCount} file(s)`,
     );
   }
   if (serverJson != null) parts.push('server.json');
-  console.log(`Linting ${parts.join(' + ')}...`);
+  if (parts.length > 0) console.log(`Linting ${parts.join(' + ')}...`);
 
   const report = validateDefinitions({
     tools,
@@ -202,14 +263,15 @@ async function main(): Promise<void> {
     ...readLintOptions(),
   });
 
+  const errors = [...failures, ...report.errors];
   for (const w of report.warnings) {
     console.warn(`  ⚠ [${w.rule}] ${w.message}`);
   }
-  for (const e of report.errors) {
+  for (const e of errors) {
     console.error(`  ✗ [${e.rule}] ${e.message}`);
   }
 
-  if (report.passed) {
+  if (errors.length === 0) {
     if (report.warnings.length > 0) {
       console.log(`\nPassed with ${report.warnings.length} warning(s).`);
     } else {
@@ -217,9 +279,7 @@ async function main(): Promise<void> {
     }
     process.exit(0);
   } else {
-    console.error(
-      `\nFailed: ${report.errors.length} error(s), ${report.warnings.length} warning(s).`,
-    );
+    console.error(`\nFailed: ${errors.length} error(s), ${report.warnings.length} warning(s).`);
     process.exit(1);
   }
 }

package/scripts/lint-packaging.ts

@@ -59,6 +59,22 @@
  *      package's headline version on GitHub and npmjs.com and ships in the
  *      tarball, so a half-finished bump is publicly visible. Skipped when the
  *      README, the badge, or the package version is absent (issue #418).
+ *  13. npm `files` excludes the built bundle: when `manifest.json` exists and
+ *      `package.json` `files` covers `dist/` wholesale, it must also carry
+ *      `"!dist/*.mcpb"`. The `bundle` script writes the `.mcpb` into `dist/`,
+ *      so without the entry a release that bundles before publishing ships the
+ *      server and its production dependencies inside the npm tarball
+ *      (issue #469). Skipped when `manifest.json` or `files` is absent.
+ *  14. manifest.json version parity: `version` must equal `package.json`'s, the
+ *      same rule check 10 applies to the plugin manifests — the bundle's install
+ *      dialog shows it. Skipped when `manifest.json` or the package version is
+ *      absent.
+ *  15. Dockerfile build platform: every stage that runs `bun run build` must
+ *      start `FROM --platform=$BUILDPLATFORM`. Without it the non-native leg of
+ *      a multi-arch `docker buildx` build runs under QEMU, where bun >= 1.4
+ *      aborts inside the build and no image publishes for either architecture —
+ *      and the image publishes last, after npm and the MCP Registry. Skipped
+ *      when there is no `Dockerfile` or no stage builds.
  *
  * Every check skips cleanly when its input is absent — consumers who deleted
  * `manifest.json` for an HTTP-only deploy, or who haven't built a bundle,
@@ -97,6 +113,7 @@ interface Manifest {
   name?: string;
   server?: { mcp_config?: { args?: unknown[]; env?: Record<string, string> } };
   user_config?: Record<string, ManifestUserConfigEntry>;
+  version?: unknown;
 }
 
 const USER_CONFIG_REF = /^\$\{user_config\.([\w-]+)\}$/;
@@ -742,6 +759,76 @@ export function checkReadmeVersionBadge(readme: string, packageVersion?: string)
   ];
 }
 
+/** The `files` entry that keeps the `bundle` script's `dist/<name>.mcpb` out of the npm tarball. */
+const BUNDLE_EXCLUSION = '!dist/*.mcpb';
+
+/**
+ * Check 13: a `files` allowlist that covers `dist/` wholesale must exclude the
+ * `.mcpb` the `bundle` script writes there. npm and Bun both honor `!` entries
+ * in `files`, and both ignore `.npmignore` once `files` is set, so the entry is
+ * the only place the exclusion can live. The caller runs this only when
+ * `manifest.json` exists — a project without one never builds a bundle.
+ */
+export function checkBundleExcludedFromFiles(files: unknown): string[] {
+  if (!Array.isArray(files)) return [];
+  const entries = files.filter((entry): entry is string => typeof entry === 'string');
+
+  const coversDist = entries.some(
+    (entry) => entry.replace(/^\.\//, '').replace(/\/(?:\*\*(?:\/\*)?|\*)?$/, '') === 'dist',
+  );
+  if (!coversDist) return [];
+  if (entries.includes(BUNDLE_EXCLUSION) || entries.includes('!dist/**/*.mcpb')) return [];
+
+  return [
+    `package.json "files" covers dist/ without "${BUNDLE_EXCLUSION}" — the bundle script writes ` +
+      `dist/<name>.mcpb, so a release that bundles before publishing ships it in the npm tarball; ` +
+      `add "${BUNDLE_EXCLUSION}" to "files"`,
+  ];
+}
+
+/**
+ * Check 14: manifest.json `version` must equal `package.json`'s. Skipped when
+ * the package version is absent — the same fail-safe as checks 10 and 12.
+ */
+export function checkManifestVersion(manifest: Manifest, packageVersion?: string): string[] {
+  if (!packageVersion || manifest.version === packageVersion) return [];
+  return [
+    manifest.version === undefined
+      ? `manifest.json has no "version" — must declare the package.json version "${packageVersion}"`
+      : `manifest.json "version" is "${String(manifest.version)}" — must equal the package.json version "${packageVersion}"`,
+  ];
+}
+
+const DOCKERFILE_FROM = /^\s*FROM\s/i;
+const DOCKERFILE_BUILD_PLATFORM = /--platform=\$\{?BUILDPLATFORM\}?(?:\s|$)/;
+const DOCKERFILE_BUILD_STEP = /\bbun run (?:re)?build\b/;
+
+/**
+ * Check 15: every Dockerfile stage that runs `bun run build` must be pinned to
+ * the build platform. Stages are split at `FROM` lines; comment lines are
+ * ignored so a note mentioning the build does not count as one.
+ */
+export function checkDockerfileBuildPlatform(dockerfile: string): string[] {
+  const stages: { from: string; line: number; builds: boolean }[] = [];
+  for (const [index, line] of dockerfile.split('\n').entries()) {
+    if (DOCKERFILE_FROM.test(line)) {
+      stages.push({ from: line.trim(), line: index + 1, builds: false });
+    } else if (!line.trimStart().startsWith('#') && DOCKERFILE_BUILD_STEP.test(line)) {
+      const stage = stages.at(-1);
+      if (stage) stage.builds = true;
+    }
+  }
+
+  return stages
+    .filter((stage) => stage.builds && !DOCKERFILE_BUILD_PLATFORM.test(stage.from))
+    .map(
+      (stage) =>
+        `Dockerfile:${stage.line} "${stage.from}" runs \`bun run build\` without --platform=$BUILDPLATFORM — ` +
+        `a multi-arch buildx build then runs it under QEMU, where bun aborts and no image publishes; ` +
+        `start the build stage with "FROM --platform=$BUILDPLATFORM" and copy dist/ into a separate runtime stage`,
+    );
+}
+
 /** Read `packaging.pluginManifests` from devcheck.config.json; default on. */
 function pluginManifestsEnabled(): boolean {
   const cfg = tryReadJson<{ packaging?: { pluginManifests?: boolean } }>(
@@ -755,7 +842,9 @@ async function main(): Promise<void> {
   const warnings: string[] = [];
   const notes: string[] = [];
 
-  const pkg = tryReadJson<{ name?: string; version?: string }>(resolve('package.json'));
+  const pkg = tryReadJson<{ files?: unknown; name?: string; version?: string }>(
+    resolve('package.json'),
+  );
   const unscopedName = pkg?.name?.split('/').pop();
 
   // ── Manifest-dependent checks (1–4 + manifest identity) ──
@@ -826,6 +915,9 @@ async function main(): Promise<void> {
     if (unscopedName) {
       errors.push(...checkManifestIdentity(manifest, unscopedName));
     }
+
+    errors.push(...checkManifestVersion(manifest, pkg?.version));
+    errors.push(...checkBundleExcludedFromFiles(pkg?.files));
   } else {
     notes.push('No manifest.json — skipping manifest/server.json alignment checks.');
   }
@@ -874,6 +966,12 @@ async function main(): Promise<void> {
     }
   }
 
+  // ── Dockerfile build platform (check 15) ──
+  const dockerfilePath = resolve('Dockerfile');
+  if (existsSync(dockerfilePath)) {
+    errors.push(...checkDockerfileBuildPlatform(readFileSync(dockerfilePath, 'utf-8')));
+  }
+
   // ── README version badge (check 12) ──
   const readmePath = resolve('README.md');
   if (existsSync(readmePath)) {

package/scripts/release-github.ts

@@ -18,6 +18,15 @@
  * The framework itself has no `manifest.json`/`.mcpb`, so the attach path is
  * skipped here but scaffolded servers that do have a manifest get the full flow.
  *
+ * Before any `gh` call it validates the tag — `--notes-from-tag` publishes the
+ * message verbatim as the release body, so a malformed tag becomes a malformed
+ * public release. `--check` runs only that validation, for use right after
+ * `git tag -a` and before the tag is pushed. The rules are the ones the
+ * `release-and-publish` skill states for the annotation: an annotated tag, a
+ * subject of at most 72 characters with no version and no `;`, flat bullets
+ * with no section headers, no signature block leaked into the body, and the
+ * `[CHANGELOG v<version>](…)` link as the final line.
+ *
  * @module scripts/release-github
  *
  * @example
@@ -25,6 +34,10 @@
  * // bun run release:github
  *
  * @example
+ * // Validate the tag annotation only (exit 1 on a violation, no gh calls):
+ * // bun run release:github -- --check
+ *
+ * @example
  * // Dry-run — print the command that would be executed without running it:
  * // bun run release:github -- --dry-run
  */
@@ -33,8 +46,86 @@ import { spawnSync } from 'node:child_process';
 import { existsSync, readFileSync } from 'node:fs';
 import { resolve } from 'node:path';
 import process from 'node:process';
+import { fileURLToPath } from 'node:url';
 
 const DRY_RUN = process.argv.includes('--dry-run');
+const CHECK_ONLY = process.argv.includes('--check');
+
+/** A tag subject longer than this reads as a digest, not a release title. */
+const MAX_SUBJECT_LENGTH = 72;
+
+/**
+ * Section headers belong in the changelog entry, never in the tag body: a
+ * markdown heading, a Keep a Changelog section name, or any other line that is
+ * not a bullet and ends in a colon (`Dependency bumps:`, `Highlights:`).
+ */
+const SECTION_HEADER =
+  /^(?:#{1,6}\s.*|(?:Added|Changed|Deprecated|Removed|Fixed|Security|Dependencies)\s*:?|[^\s\-*+[].*:)$/;
+
+/** The parts of an annotated tag that become the GitHub Release title and body. */
+export interface TagMessage {
+  body: string;
+  /** `git for-each-ref %(objecttype)` — `tag` for an annotated tag, `commit` for a lightweight one. */
+  objectType: string;
+  subject: string;
+}
+
+/**
+ * Validates a tag annotation against the release-body rules. Returns one
+ * message per violation; an empty array means the tag is publishable.
+ */
+export function checkTagMessage(tag: TagMessage, version: string): string[] {
+  if (tag.objectType !== 'tag') {
+    return [
+      `v${version} is a lightweight tag — recreate it annotated: git tag -a v${version} -F <file>`,
+    ];
+  }
+
+  const errors: string[] = [];
+  const { subject } = tag;
+  if (subject.length > MAX_SUBJECT_LENGTH) {
+    errors.push(
+      `subject is ${subject.length} characters — keep it one short theme (≤${MAX_SUBJECT_LENGTH}); the bullets carry the digest`,
+    );
+  }
+  if (subject.includes(version)) {
+    errors.push(
+      `subject contains the version "${version}" — GitHub prepends "v${version}:" to the title`,
+    );
+  }
+  if (subject.includes(';')) {
+    errors.push('subject contains ";" — one theme, not a list of changes');
+  }
+
+  if (tag.body.includes('-----BEGIN')) {
+    errors.push(
+      'body contains a signature block — the signature did not parse (usually --cleanup=verbatim); recreate the tag with --cleanup=whitespace before it is pushed',
+    );
+  }
+
+  const lines = tag.body
+    .split('\n')
+    .map((line) => line.trim())
+    .filter((line) => line.length > 0);
+  const headers = lines.filter((line) => SECTION_HEADER.test(line));
+  if (headers.length > 0) {
+    errors.push(
+      `body has section headers (${headers.map((h) => `"${h}"`).join(', ')}) — flat bullets only; sections belong in the changelog entry`,
+    );
+  }
+
+  const escaped = version.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const changelogLink = new RegExp(
+    `^\\[CHANGELOG v${escaped}\\]\\(\\S+/changelog/\\d+\\.\\d+\\.x/${escaped}\\.md\\)`,
+  );
+  if (!changelogLink.test(lines.at(-1) ?? '')) {
+    errors.push(
+      `final line is not the changelog link — end the body with "[CHANGELOG v${version}](https://github.com/<OWNER>/<REPO>/blob/main/changelog/<major.minor>.x/${version}.md)"`,
+    );
+  }
+
+  return errors;
+}
 
 // ── Helpers ───────────────────────────────────────────────────────────────────
 
@@ -107,15 +198,34 @@ function main(): void {
   if (!subject) {
     console.error(
       `Tag ${tag} not found locally or has no subject line. ` +
-        `Create the annotated tag first: git tag -a ${tag} -m "..."`,
+        `Create the annotated tag first: git tag -a ${tag} -F <file>`,
     );
     process.exit(1);
   }
 
+  // 3. Validate the annotation — it becomes the public release body verbatim
+  const errors = checkTagMessage(
+    {
+      subject,
+      body: run('git', ['for-each-ref', `refs/tags/${tag}`, '--format=%(contents:body)']),
+      objectType: run('git', ['for-each-ref', `refs/tags/${tag}`, '--format=%(objecttype)']),
+    },
+    version,
+  );
+  if (errors.length > 0) {
+    console.error(`Tag ${tag} is not publishable:`);
+    for (const error of errors) console.error(`  ✗ ${error}`);
+    process.exit(1);
+  }
+  if (CHECK_ONLY) {
+    console.log(`Tag ${tag} OK.`);
+    return;
+  }
+
   const title = `${tag}: ${subject}`;
   const hasMcpb = existsSync('manifest.json');
 
-  // 3. Build the gh release create command
+  // 4. Build the gh release create command
   const createArgs = [
     'release',
     'create',
@@ -152,7 +262,7 @@ function main(): void {
     console.log('  asset: dist/*.mcpb');
   }
 
-  // 4. Try to create the release
+  // 5. Try to create the release
   const createResult = gh(createArgs, { required: false });
 
   if (!createResult.startsWith('__ERROR__:')) {
@@ -170,7 +280,7 @@ function main(): void {
     process.exit(1);
   }
 
-  // 5. Release already exists — repair: upload asset (if applicable) and set title.
+  // 6. Release already exists — repair: upload asset (if applicable) and set title.
   console.log(`Release ${tag} already exists. Repairing…`);
 
   if (hasMcpb) {
@@ -184,4 +294,6 @@ function main(): void {
   console.log(`Release ${tag} repaired.`);
 }
 
-main();
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  main();
+}

package/templates/.env.example

@@ -31,12 +31,16 @@ MCP_SESSION_MODE=stateless          # stateful | stateless | auto. Set here, not
 # MCP_LOG_LEVEL=info                # debug | info | notice | warning | error
 # MCP_LOG_RATE_LIMIT_THRESHOLD=10   # Max emissions per level+message per window; 0 disables
 # MCP_LOG_RATE_LIMIT_WINDOW_MS=60000
+# LOG_TOOL_FAILURE_PAYLOADS=false            # Log failed tool calls' arguments + result (key-name redaction only;
+                                             # secrets in free-form values are kept). Reaches stderr, files, and OTLP
+# LOG_TOOL_FAILURE_PAYLOAD_MAX_BYTES=16384   # Per-payload cap, UTF-8 bytes
 
 # ── Telemetry ─────────────────────────────────────────────────────────
 # OTEL_ENABLED=false                          # Enable OpenTelemetry (default: false)
 # OTEL_EXPORTER_OTLP_ENDPOINT=               # OTLP base URL (e.g., http://localhost:4318); traces → /v1/traces, metrics → /v1/metrics
 # OTEL_EXPORTER_OTLP_TRACES_ENDPOINT=        # Overrides the base for traces; used as-is
 # OTEL_EXPORTER_OTLP_METRICS_ENDPOINT=       # Overrides the base for metrics; used as-is
+# OTEL_EXPORTER_OTLP_LOGS_ENDPOINT=          # Opt-in log export (e.g., http://localhost:4318/v1/logs); the base never enables it
 
 # ── Server-specific ──────────────────────────────────────────────────
 # Add your server's environment variables below

package/templates/Dockerfile

@@ -56,8 +56,15 @@ LABEL org.opencontainers.image.licenses="Apache-2.0"
 LABEL org.opencontainers.image.version="${APP_VERSION}"
 LABEL org.opencontainers.image.source=""
 
-# Copy dependency manifests
-COPY package.json bun.lock ./
+# Copy dependency manifests. `bunfig.toml` rides along so every install below
+# passes its release-age gate and security scanner, as a local install does.
+COPY package.json bun.lock bunfig.toml ./
+
+# The scanner bunfig.toml names is a devDependency, and Bun installs a missing
+# scanner through the same production-filtered install, which omits it and
+# aborts. Seed it from the build stage's full install instead. Remove this line
+# together with the scanner if bunfig.toml stops naming one.
+COPY --from=build /usr/src/app/node_modules/@socketsecurity/bun-security-scanner ./node_modules/@socketsecurity/bun-security-scanner
 
 # Install only production dependencies, ignoring any lifecycle scripts (like 'prepare')
 # that are not needed in the final production image.
@@ -72,19 +79,33 @@ RUN --mount=type=cache,target=/root/.bun/install/cache \
 # Conditionally install OpenTelemetry optional peer dependencies (Tier 3).
 # Installed by default. Omit them for a leaner image at build time
 # with: docker build --build-arg OTEL_ENABLED=false
+# Each package is requested at the range the installed framework declares in
+# `peerDependencies`, so the resolution stays inside the framework's tested
+# peer range; a name with no declared range fails the build.
 ARG OTEL_ENABLED=true
 RUN --mount=type=cache,target=/root/.bun/install/cache \
     if [ "$OTEL_ENABLED" = "true" ]; then \
-      bun add --omit=dev --omit=peer --ignore-scripts @hono/otel \
-        @opentelemetry/instrumentation-http \
+      specs=$(bun -e ' \
+        const { peerDependencies: peers } = await Bun.file("node_modules/@cyanheads/mcp-ts-core/package.json").json(); \
+        const names = process.argv.slice(1); \
+        const missing = names.filter((name) => !peers?.[name]); \
+        if (missing.length > 0) throw new Error(`no peerDependencies range for ${missing.join(", ")}`); \
+        console.log(names.map((name) => `${name}@${peers[name]}`).join(" ")); \
+      ' \
+        @hono/otel \
+        @opentelemetry/api-logs \
+        @opentelemetry/exporter-logs-otlp-http \
         @opentelemetry/exporter-metrics-otlp-http \
         @opentelemetry/exporter-trace-otlp-http \
+        @opentelemetry/instrumentation-http \
         @opentelemetry/instrumentation-pino \
         @opentelemetry/resources \
+        @opentelemetry/sdk-logs \
         @opentelemetry/sdk-metrics \
         @opentelemetry/sdk-node \
         @opentelemetry/sdk-trace-node \
-        @opentelemetry/semantic-conventions; \
+        @opentelemetry/semantic-conventions) \
+      && bun add --omit=dev --omit=peer --ignore-scripts $specs; \
     fi
 
 # Copy the compiled application code from the build stage
@@ -128,7 +149,6 @@ ENV MCP_TRANSPORT_TYPE="http"
 ENV MCP_SESSION_MODE="stateless"
 ENV MCP_LOG_LEVEL="info"
 ENV LOGS_DIR="/var/log/{{PACKAGE_NAME}}"
-ENV MCP_FORCE_CONSOLE_LOGGING="true"
 
 # Expose the port the server listens on
 EXPOSE ${MCP_HTTP_PORT}

package/templates/_.mcpbignore

@@ -3,6 +3,8 @@
 /.claude/
 /.agents/
 /framework-skills/
+/docs/idea.md
+/logs/
 /Dockerfile
 /bun.lock
 /bunfig.toml

package/templates/package.json

@@ -12,6 +12,7 @@
   "files": [
     "changelog/",
     "dist/",
+    "!dist/*.mcpb",
     "README.md",
     "LICENSE",
     "CLAUDE.md",