@cyanheads/pubmed-mcp-server 2.10.12 → 2.10.14

package/changelog/2.9.x/2.9.0.md

@@ -0,0 +1,21 @@
+---
+summary: "find_related: offset pagination, multi-source provider fallback (NCBI → EuropePMC → OpenAlex); europepmc_search: date-sort advisory for PPR-only results"
+breaking: false
+security: false
+---
+
+# 2.9.0 — 2026-06-09
+
+## Added
+
+- **`pubmed_find_related`**: `offset` input parameter (0-based, default 0) enables paging past the first result window — mirrors `pubmed_search_articles` semantics ([#36](https://github.com/cyanheads/pubmed-mcp-server/issues/36)).
+- **`pubmed_find_related`**: `format()` header now emits `**Returned:** N | **Offset:** Z` alongside the existing `**Relationship:**` line, matching `search_articles` header parity ([#36](https://github.com/cyanheads/pubmed-mcp-server/issues/36)).
+- **`pubmed_find_related`**: multi-source provider fallback — NCBI eLink (primary) → Europe PMC → OpenAlex; first success wins, no merging ([#63](https://github.com/cyanheads/pubmed-mcp-server/issues/63)).
+  - `similar`: NCBI `pubmed_pubmed` → OpenAlex `related_works`.
+  - `cited_by`: NCBI `citedin` → Europe PMC `/MED/{pmid}/citations` → OpenAlex `cites:`.
+  - `references`: NCBI `refs` (PMC-indexed only) → Europe PMC `/MED/{pmid}/references` → OpenAlex `referenced_works`. Supersedes the notice-only mitigation for non-PMC sources — actual coverage now served by EPMC/OpenAlex when NCBI has no PMC-indexed reference list.
+  - Provenance surfaced in `enrichment.source` (`"ncbi"` | `"europepmc"` | `"openalex"`); a notice is appended to `enrichment` only when a non-primary provider answered.
+  - Records without a PMID are dropped, never minted.
+- **`src/services/openalex/`**: new OpenAlex API client — PMID→OA ID resolve, `related_works`/`referenced_works` batch PMID round-trip, `cites:` filter for `cited_by` ([#63](https://github.com/cyanheads/pubmed-mcp-server/issues/63)).
+- **`src/services/europe-pmc/`**: `citations(pmid, options)` and `references(pmid, options)` methods added to the existing Europe PMC integration ([#63](https://github.com/cyanheads/pubmed-mcp-server/issues/63)).
+- **`pubmed_europepmc_search`**: advisory notice via `ctx.enrich.notice()` when `sort` targets a date field (e.g. `P_PDATE_D`) and the effective sources are preprint-only (`PPR`) — EPMC accepts but silently ignores date sort on PPR records; notice names `firstPublicationDate` as the populated field available for page-local client-side sorting ([#67](https://github.com/cyanheads/pubmed-mcp-server/issues/67)).

package/changelog/2.9.x/2.9.1.md

@@ -0,0 +1,12 @@
+---
+summary: "fix(fetch_fulltext): element-citation references now delimited; PMC page/bibliographic tokens preserved verbatim"
+breaking: false
+security: false
+---
+
+# 2.9.1 — 2026-06-09
+
+## Fixed
+
+- **`pubmed_fetch_fulltext`** (`includeReferences: true`): structured `<element-citation>` references now render field-by-field with separators — author names joined with `, `, typed `<pub-id>` nodes labeled (`PMID`, `DOI`, `PMCID`), fields separated by spaces. `<mixed-citation>` rendering is unchanged. ([#69](https://github.com/cyanheads/pubmed-mcp-server/issues/69))
+- **`pubmed_fetch_fulltext`**: PMC JATS ordered parser (`orderedXmlParser`) now runs with `parseTagValue: false` — page tokens like `4002.e26` are preserved verbatim instead of being coerced to `4.002e+29`; zero-padded values retain their leading zeros. The regular parser (esearch/esummary numeric counts) is untouched. ([#69](https://github.com/cyanheads/pubmed-mcp-server/issues/69))

package/changelog/2.9.x/2.9.10.md

@@ -0,0 +1,15 @@
+---
+summary: "pubmed_fetch_fulltext: EPMC/PMCID query builders fixed, front-matter-only records fall through the retrieval chain instead of being dropped, pmcids input reaches Unpaywall via a resolved DOI, and Unpaywall articles carry a pmcId backlink. Dead 404-handling branches removed from the Europe PMC and OpenAlex clients."
+breaking: false
+security: false
+---
+
+# 2.9.10 — 2026-07-26
+
+## Fixed
+
+- **`pubmed_europepmc_search` / `pubmed_fetch_fulltext` EPMC query builders** — `EXT_ID:"<pmid>" AND SRC:MED` and `PMCID:"PMC<digits>" AND SRC:PMC` matched zero records: Europe PMC requires identifier tokens combined with `AND SRC:` to be unquoted, and the canonical record for a PMCID lookup has `source: MED`, so `SRC:PMC` excluded the very record being sought. Query builders now emit `EXT_ID:<pmid> AND SRC:MED` and `PMCID:<PMC<digits>>` (the `SRC:PMC` filter dropped); `pubmed_europepmc_search`'s `query` `.describe()` updated to match. ([#85](https://github.com/cyanheads/pubmed-mcp-server/issues/85))
+- **`pubmed_fetch_fulltext` front-matter-only PMC/EPMC records** — a PMC article with front matter and abstract but no `<body>` (publishers that block full-text XML download still return a populated `<front>`) was previously demoted like any other retrieved article. It's now detected pre-filter and routed through the fallback chain like a miss, so a later tier can still recover it. New `no-body` member on the `UnavailableReasonSchema` and `TierOutcomeSchema` output enums, plus an `enrichment.notice` naming the affected id(s) when no tier recovers a copy. ([#86](https://github.com/cyanheads/pubmed-mcp-server/issues/86))
+- **`pubmed_fetch_fulltext` `pmcids` input skipped Unpaywall entirely** — PMC/EPMC misses on `pmcids` input never reached the Unpaywall fallback tier because the DOI needed to query it was never resolved. Now threads the DOI from the Europe PMC hit (when present) or the NCBI ID Converter through to Unpaywall. ([#88](https://github.com/cyanheads/pubmed-mcp-server/issues/88))
+- **Unpaywall articles from `pmcids` input lacked a PMCID backlink** — `UnpaywallArticleSchema` gains an optional `pmcId` field so a batch's `articles[]` and `unavailable[]` key on the same identifier for `pmcids` input; `format()`'s heading and metadata block now surface the PMCID when present. ([#92](https://github.com/cyanheads/pubmed-mcp-server/issues/92))
+- **Europe PMC / OpenAlex 404 handling** — `fetchWithTimeout` throws a status-mapped `McpError` for any non-2xx response rather than returning the failing `Response`, so the `response.status === 404` / `!response.ok` branches in `src/services/europe-pmc/api-client.ts` and `src/services/openalex/api-client.ts` (plus four sibling methods) were unreachable; a genuine 404 was rethrown as a generic error and surfaced as `service-error` instead of the documented `no-fulltext`/`null` outcome. Converted to catch-block classification on `error.code`, and corrected the test mocks that had resolved with a non-2xx `Response`. ([#90](https://github.com/cyanheads/pubmed-mcp-server/issues/90))

package/changelog/2.9.x/2.9.2.md

@@ -0,0 +1,21 @@
+---
+summary: "mcp-ts-core ^0.10.5: ctx.enrich.total(), z.stringbool(), server identity fields; totalCount enrichment rename; .mcpbignore anchored"
+breaking: false
+security: false
+---
+
+# 2.9.2 — 2026-06-11
+
+## Changed
+
+- **`totalFound` enrichment key renamed to `totalCount`** across `pubmed_search_articles`, `pubmed_find_related`, `pubmed_lookup_mesh`, and `pubmed_europepmc_search`. Pagination overshoot notices updated to reference `totalCount`. This key appears in `structuredContent` enrichment blocks and is consumed by agents reading result-set metadata.
+- **`PUBMED_EUROPEPMC_ENABLED` now uses `z.stringbool()` semantics.** Accepts `true/false/1/0/yes/no/on/off` (case-insensitive); `yes` and `on` now parse truthy. Unrecognized values fail at startup instead of silently coercing to `false`. Previously only `true`/`1` were truthy.
+- **Server identity fields added to `createApp()`**: `name`, `title`, `websiteUrl`, and `description` are now set, surfaced in the `initialize` response and `/.well-known/mcp.json`.
+- **`.mcpbignore` dev-dir patterns anchored to root**: `/.claude/`, `/.agents/`, `/skills/` now use leading `/` so they cannot strip nested `node_modules` runtime paths.
+- **`ctx.enrich.total()` migration**: enrichment total counts are now set via the framework's `ctx.enrich.total()` helper rather than as inline `totalFound` fields in the `ctx.enrich()` call.
+
+## Dependencies
+
+- `@cyanheads/mcp-ts-core` ^0.9.21 → ^0.10.5
+- `sanitize-html` ^2.17.4 → ^2.17.5
+- `@types/node` ^25.9.2 → ^25.9.3

package/changelog/2.9.x/2.9.3.md

@@ -0,0 +1,11 @@
+---
+summary: "serverInfo title corrected to machine name pubmed-mcp-server"
+breaking: false
+security: false
+---
+
+# 2.9.3 — 2026-06-11
+
+## Fixed
+
+- **`createApp()` `title`** corrected to `pubmed-mcp-server` (was the Title Case display string `'PubMed MCP Server'` introduced in 2.9.2). MCP clients display `serverInfo.title` in their UI — this aligns the displayed name with the machine name convention.

package/changelog/2.9.x/2.9.4.md

@@ -0,0 +1,24 @@
+---
+summary: "mcp-ts-core ^0.10.6: post-pack bundle cleaner, packaging identity checks; lint-packaging checks 8–9 synced; orchestrations skill v1.3"
+breaking: false
+security: false
+---
+
+# 2.9.4 — 2026-06-11
+
+## Changed
+
+- **`src/index.ts`** — removed `websiteUrl` and `description` from `createApp()` options; canonical source is `package.json` (framework derives description from it); identity pair `name`/`title` both set to `'pubmed-mcp-server'`.
+- **`scripts/lint-packaging.ts`** — synced from mcp-ts-core 0.10.6 template: adds check 8 (post-bundle content guard: flags `node_modules/**` agent-doc entries in built `.mcpb`) and check 9 (entrypoint identity: `name`/`title` in `createApp()` / `createWorkerHandler()` and `manifest.json` `display_name` must equal the unscoped package name). `checkBundleContent` refactored to accept raw content string; `KNOWN_DEV_DIRS` / `CRITICAL_RUNTIME_PATHS` / `AGENT_DOC_ENTRY` exported for unit testing.
+- **`package.json` `bundle` script** — appended `&& bun run scripts/clean-mcpb.ts dist/pubmed-mcp-server.mcpb` after `mcpb pack`; strips dependency-shipped agent docs from the bundle.
+- **`skills/orchestrations` v1.3** — Phase 4 close-loop wording: one what-landed comment per shipped issue, then a bare close; bare "Fixed in v\<version\>" trailer replaced.
+- **`skills/polish-docs-meta` v2.7** — adds `name`/`title` identity requirement and updated `bundle` description.
+- **`CLAUDE.md` / `AGENTS.md`** — framework version `^0.10.5 → ^0.10.6`; identity example corrected; `bundle` description updated.
+
+## Added
+
+- **`scripts/clean-mcpb.ts`** — post-pack bundle cleaner: runs `mcpb clean`, then strips `node_modules/**` agent-doc entries (`skills/`, `.claude/`, `.agents/` trees and `SKILL.md` files) that root-anchored `.mcpbignore` patterns cannot reach. Wired into the `bundle` script. (mcp-ts-core [#230](https://github.com/cyanheads/mcp-ts-core/issues/230))
+
+## Dependencies
+
+- `@cyanheads/mcp-ts-core` ^0.10.5 → ^0.10.6

package/changelog/2.9.x/2.9.5.md

@@ -0,0 +1,20 @@
+---
+summary: "Fixes: transient NCBI eutils 500s now reclassify to ServiceUnavailable and retry; pubmed_lookup_mesh returns the canonical MeSH DescriptorUI with a new entrezUid field"
+breaking: false
+security: false
+---
+
+# 2.9.5 — 2026-06-13
+
+## Fixed
+
+- **`NcbiApiClient` eutils 500 retry** — `getRequest`/`postRequest` now issue plain `fetch` (via a shared `buildTimeoutSignal` helper) instead of `fetchWithTimeout`, which threw on any non-2xx before the status could be read. The `if (!response.ok)` reclassification in `makeRequest` is now reachable, so NCBI's transient HTTP 500s map to `ServiceUnavailable` and are retried by `NcbiService.withRetry`; HTTP 501 stays `InternalError` (not transient). ([#70](https://github.com/cyanheads/pubmed-mcp-server/issues/70))
+- **`pubmed_lookup_mesh` `meshId`** — now returns the canonical MeSH DescriptorUI (e.g. `D003924`) instead of NCBI's Entrez UID. `decodeMeshDescriptorUi` maps the 8-digit UID's two-digit prefix to its letter (`67→C`, `68→D`, `81→Q`); non-decodable UIDs (e.g. 7-digit supplementary-concept IDs) fall back to the raw value. ([#71](https://github.com/cyanheads/pubmed-mcp-server/issues/71))
+
+## Added
+
+- **`pubmed_lookup_mesh` `entrezUid`** — new output field carrying the raw NCBI Entrez UID, the join key for E-utilities (`eSummary`/`eFetch` `db=mesh`); rendered in `format()` as **Entrez UID**. ([#71](https://github.com/cyanheads/pubmed-mcp-server/issues/71))
+
+## Dependencies
+
+- `@biomejs/biome` ^2.4.16 → ^2.5.0

package/changelog/2.9.x/2.9.6.md

@@ -0,0 +1,22 @@
+---
+summary: "Output cleanups: convert_ids accepts mixed PMC/bare-digit batches; europepmc_search and fetch_articles strip leaked markup and decode entities; europepmc_search splits its silent-rejection diagnosis from its recovery hint; lookup_mesh drops non-navigable SCR tree pointers"
+breaking: false
+security: false
+---
+
+# 2.9.6 — 2026-06-18
+
+## Fixed
+
+- **`pubmed_convert_ids` mixed PMCID batches** — `NcbiService.idConvert` now canonicalizes bare-digit PMCIDs to `PMC`+digits before the PMC ID Converter call, so a batch mixing `PMC3531190` and `3531190` resolves like a homogeneous one instead of being rejected wholesale (HTTP 400). The `pmcid` format hint (both `ID_CONVERT_FORMAT_HINTS` and the tool's `ids` `.describe()`) now states bare digits are accepted. ([#73](https://github.com/cyanheads/pubmed-mcp-server/issues/73))
+- **`pubmed_europepmc_search` `abstractSnippet`** — normalized to display-ready plain text via a new `toDisplayText` helper: strips structural JATS/HTML tags, decodes HTML entities, and removes soft hyphens (U+00AD) before truncation, so the snippet budget holds text rather than markup and stray soft hyphens don't corrupt token matching. ([#74](https://github.com/cyanheads/pubmed-mcp-server/issues/74))
+- **`pubmed_fetch_articles` `grantList`** — `extractGrants` now decodes the residual `&` that NCBI's double-encoding leaves after the XML parser's single decode pass, so `grantId`/`acronym`/`agency`/`country` surface as `CSR&D` rather than `CSR&D`. ([#74](https://github.com/cyanheads/pubmed-mcp-server/issues/74))
+- **`pubmed_europepmc_search` silent-rejection error** — the version-only-envelope throw now passes a distinct diagnosis as the message and an actionable next step as `recovery.hint`, instead of the same string for both. Previously the framework rendered byte-identical `Error:`/`Recovery:` blocks. ([#75](https://github.com/cyanheads/pubmed-mcp-server/issues/75))
+- **`pubmed_lookup_mesh` `treeNumbers`** — `extractTreeNumbers` now drops `@`-prefixed values, which supplementary concept records (SCRs) surface in the `TreeNum` field as non-navigable mapped-heading pointers (e.g. `@218176`). `treeNumbers` now holds only real tree numbers and is omitted for SCRs; its `.describe()` documents this. ([#76](https://github.com/cyanheads/pubmed-mcp-server/issues/76))
+
+## Dependencies
+
+- `defuddle` ^0.18.1 → ^0.19.0
+- `fast-xml-parser` ^5.8.0 → ^5.9.2
+- `vitest` ^4.1.8 → ^4.1.9
+- `@vitest/coverage-istanbul` ^4.1.8 → ^4.1.9

package/changelog/2.9.x/2.9.7.md

@@ -0,0 +1,26 @@
+---
+summary: "Adopt mcp-ts-core 0.10.9: devcheck gains a Dependency Specifiers guard (floating latest/*/dist-tags) and plugin-manifest checks in lint:packaging; fresh-scaffold git guards; 14 skills re-synced; dependency refresh"
+breaking: false
+security: false
+---
+
+# 2.9.7 — 2026-06-20
+
+## Added
+
+- **`Dependency Specifiers` devcheck step** — new `scripts/check-dependency-specifiers.ts` (flag `--no-dep-specifiers`) hard-fails on floating specifiers (`latest`, `*`, `next`/`beta`/`canary`/`rc`) in `package.json`'s dependency sections and `bun.lock`'s `workspaces` map, catching the case where `bun update --latest` writes a literal `latest` dist-tag into the lock and lets the next `bun install` re-resolve past the manifest range. Static and local — runs in the default and `--fast` passes. ([mcp-ts-core#246](https://github.com/cyanheads/mcp-ts-core/issues/246))
+- **Plugin marketplace manifest checks in `lint:packaging`** — `scripts/lint-packaging.ts` check 10 validates `.claude-plugin/plugin.json`, `.codex-plugin/plugin.json`, and `.codex-plugin/mcp.json`: non-empty descriptions, display fields carrying the unscoped machine name, and the `npx -y` install arg carrying the full scoped package name. Gated by the new `devcheck.config.json` `packaging.pluginManifests` flag (default on; set here). ([mcp-ts-core#240](https://github.com/cyanheads/mcp-ts-core/issues/240))
+
+## Changed
+
+- **14 `skills/<name>/SKILL.md` re-synced** from mcp-ts-core 0.10.7–0.10.9 — `metadata.version` bumps and body drift: `add-tool` 2.14→2.15, `api-auth` 1.1→1.2, `api-canvas` 1.6→1.7, `api-config` 1.7→1.8, `api-context` 1.8→1.9, `api-errors` 1.6→1.7, `api-services` 1.3→1.4, `api-telemetry` 1.0→1.2, `field-test` 2.5→2.6, `git-wrapup` 1.2→1.4, `orchestrations` 1.3→1.4, `polish-docs-meta` 2.7→2.9, `report-issue-local` 1.5→1.6, `tool-defs-analysis` 1.2→1.3.
+
+## Fixed
+
+- **Fresh-scaffold devcheck guards** — `devcheck.ts` (TODOs/FIXMEs, Tracked Secrets, Framework Antipatterns), `check-framework-antipatterns.ts`, and `build-changelog.ts --check` now skip cleanly when `.git` is absent, and `check-skill-versions.ts` skips a `SKILL.md` deleted from the worktree, instead of exiting 128 / crashing with ENOENT. ([mcp-ts-core#242](https://github.com/cyanheads/mcp-ts-core/issues/242), [#243](https://github.com/cyanheads/mcp-ts-core/issues/243), [#237](https://github.com/cyanheads/mcp-ts-core/issues/237))
+
+## Dependencies
+
+- `@cyanheads/mcp-ts-core` ^0.10.6 → ^0.10.9
+- `fast-xml-parser` ^5.9.2 → ^5.9.3
+- `@types/node` ^25.9.3 → ^26.0.0

package/changelog/2.9.x/2.9.8.md

@@ -0,0 +1,15 @@
+---
+summary: "pubmed_fetch_fulltext surfaces a recovery notice when a sections filter removes every body section from an article that had one — naming the requested terms and affected article ids, still returning the article; detected on both the PMC and Europe PMC paths. Adopts mcp-ts-core 0.10.10."
+breaking: false
+security: false
+---
+
+# 2.9.8 — 2026-06-30
+
+## Added
+
+- **`pubmed_fetch_fulltext` section-filter-miss notice** — when a `sections` filter removes every body section from an article that had sections upstream, the tool surfaces a recovery notice via a new `enrichment.notice` block (emitted through `ctx.enrich.notice`) instead of silently returning an empty body. The notice names the requested section terms and the affected article id(s), distinguishes a filtered-empty body from one absent upstream, and suggests retrying without `sections` or filtering on broader headings (Introduction, Methods, Results, Discussion). The article is still returned with its empty body — not an error — and the miss is detected on both the PMC EFetch and Europe PMC paths. ([#80](https://github.com/cyanheads/pubmed-mcp-server/issues/80))
+
+## Dependencies
+
+- `@cyanheads/mcp-ts-core` ^0.10.9 → ^0.10.10 (framework js-yaml v4→v5 migration and biome 2.5.1; no consumer change — this server installs no js-yaml directly)

package/changelog/2.9.x/2.9.9.md

@@ -0,0 +1,35 @@
+---
+summary: "pubmed_lookup_mesh gets true upstream totalCount plus offset/nextOffset pagination; pubmed_lookup_citation stops false-flagging authors ranked 4th or later; pubmed_spell_check threads ctx.signal into ESpell. Adopts mcp-ts-core 0.11.0."
+breaking: false
+security: false
+---
+
+# 2.9.9 — 2026-07-26
+
+## Added
+
+- **`pubmed_lookup_mesh` offset pagination** — new `offset` input (default `0`) and `nextOffset` output let callers page past the `maxResults` cap; `nextOffset` is omitted on the last page as the end-of-results signal. ([#84](https://github.com/cyanheads/pubmed-mcp-server/issues/84))
+
+## Changed
+
+- **`pubmed_lookup_mesh` `totalCount`** now reports the true upstream match count from `eSearch`'s `count` field instead of the number of records returned on the page. ([#82](https://github.com/cyanheads/pubmed-mcp-server/issues/82))
+
+## Fixed
+
+- **`pubmed_lookup_mesh` pinned exact-match double-serve** — the exact-descriptor match is now held back on every page it ranks into, not just the first; a page consisting solely of the already-served pinned match returns an explanatory `enrichment.notice` instead of an empty or duplicated result. ([#91](https://github.com/cyanheads/pubmed-mcp-server/issues/91))
+- **`pubmed_lookup_citation` false `author_mismatch` warning** — the mismatch check now verifies the queried author against the full author roster (`authorNames`) instead of the `authors` display string, which truncates to three names plus "et al." and was flagging genuine fourth-or-later authors as mismatches. `ESummaryDocumentSummary` parsing and `ParsedBriefSummary` gain an `authorNames: string[]` field alongside the existing `authors` display string. ([#87](https://github.com/cyanheads/pubmed-mcp-server/issues/87))
+- **`pubmed_spell_check` dropped `ctx.signal`** — the handler now passes `{ signal: ctx.signal }` into `eSpell`, so request cancellation reaches the NCBI ESpell call. Also fixes a stale `pubmed_spell` log message to `pubmed_spell_check`. ([#89](https://github.com/cyanheads/pubmed-mcp-server/issues/89))
+- **`pubmed_format_citations` description** — replaced "styles"/"style" with "formats"/"format" for accuracy.
+- **Noisy error-path telemetry on expected 404s** — `expectedStatuses` added to the `fetchWithTimeout` call sites in `src/services/europe-pmc/api-client.ts` (404), `src/services/openalex/api-client.ts` (404), and `src/services/unpaywall/unpaywall-service.ts` (404, 422), so upstream responses these services already treat as expected "not found" outcomes no longer classify as errors.
+
+## Dependencies
+
+- `@cyanheads/mcp-ts-core` ^0.10.10 → ^0.11.0
+- `typescript` ^6.0.3 → ^7.0.2
+- `bun` (packageManager) 1.3.2 → 1.3.14; `engines.bun` floor relaxed `>=1.3.2` → `>=1.3.0`
+- `@biomejs/biome` ^2.5.0 → ^2.5.5, `@types/node` ^26.0.0 → ^26.1.1, `@vitest/coverage-istanbul`/`vitest` ^4.1.9 → ^4.1.10, `fast-check` ^4.8.0 → ^4.9.0, `ignore` ^7.0.5 → ^7.0.6, `tsc-alias` ^1.8.17 → ^1.9.1
+- `defuddle` ^0.19.0 → ^0.19.2, `fast-xml-parser` ^5.9.3 → ^5.10.1, `linkedom` ^0.18.12 → ^0.18.13, `sanitize-html` ^2.17.5 → ^2.17.6
+- Added `@socketsecurity/bun-security-scanner` ^1.1.2 as a dev dependency, wired as the `bunfig.toml` `[install.security]` scanner and a `devcheck.config.json` known-dep entry
+- New `package.json` `overrides` block pins nested transitive copies: `@hono/node-server` ^2.0.11, `brace-expansion` ^2.1.2, `fast-uri` ^3.1.4, `postcss` ^8.5.22
+- `Dockerfile` — `oven/bun:1.3` → `oven/bun:1.3.14` (build and production stages), `bun install` steps gain `--ignore-scripts` and a BuildKit cache mount on `/root/.bun/install/cache`
+- `bunfig.toml` — `install.minimumReleaseAge` set to 259200s (3 days), excluding `@cyanheads/mcp-ts-core`

package/changelog/template.md

@@ -0,0 +1,151 @@
+---
+# FORMAT REFERENCE — do not edit. Copy this file to
+# `changelog/<major.minor>.x/<version>.md` (e.g. `changelog/0.8.x/0.8.6.md`)
+# to author a new release. Set that file's H1 to `# <version> — YYYY-MM-DD`
+# with a concrete date.
+
+# Required. One-line GitHub Release-style headline. 350 character cap — a
+# ceiling, not a target. Default short and scannable. Don't pad, don't stitch
+# unrelated changes with commas/semicolons into an inventory — pick the one
+# headline the release is about. Quotes required: unquoted YAML treats
+# `: ` inside the value as a key separator and fails GitHub's strict parser.
+summary: ""
+
+# Set `true` when consumers must change code to upgrade: API removals,
+# signature changes, config renames, behavior changes that break existing
+# usage. Flagged as `Breaking` in the rollup.
+breaking: false
+
+# Set `true` ONLY for a security fix in THIS project's own source code — a
+# vulnerability or hardening in code you ship. A dependency or transitive CVE
+# bump is routine maintenance, NOT a security release: record it under
+# `## Dependencies` (with the advisory ID) and leave this `false`. When true,
+# pairs with the `## Security` section below and flags `Security` in the rollup.
+security: false
+
+# Optional free-form notes for maintenance agents processing this release.
+# Not rendered in CHANGELOG — consumed by agents running `maintenance` on
+# downstream servers. ADOPTION STEPS ONLY — new files to create, fields to
+# populate, one-time migration steps. Never a second rendering of the body:
+# if a body bullet already says it, name the bullet's symbol instead of
+# re-explaining. Omit the field entirely when there's nothing to say.
+# agent-notes: |
+#   <instructions for downstream maintenance agents>
+---
+
+# <version> — YYYY-MM-DD
+
+<!--
+  AUTHORING GUIDE — applies to the new per-version file you create from this
+  template.
+
+  Audience: someone scanning release notes to decide what affects them. Lead
+  each bullet with the symbol or concept name in **bold** so they can skip
+  what's irrelevant and zoom in on what's not.
+
+  Tone: terse, fact-dense, not verbose. Bullet shape: **symbol** + what
+  changed + at most one consumer-facing caveat. One sentence by default, two
+  when the second carries weight — a bullet past ~40 words or three sentences
+  is wrong. The depth lives one hop away: the linked issue carries the why,
+  the commit diff carries the how. The changelog names what changed and what
+  a consumer does about it; a reader who wants mechanism opens the link.
+
+  Model length on THIS guide, never on the previous entry — entries modeled
+  on entries compound.
+
+  Cut (each has shipped as a wall of text; these are the cruft):
+  - History/justification narration — how the bug worked, why the old
+    behavior was wrong. One short clause at most; the issue carries the story.
+  - Design-rationale defense — "chosen over Y because…", "guarding the
+    getter is not enough…". That is the author arguing with a reviewer;
+    reviewers read the PR, not the changelog.
+  - Defensive unchanged-clauses — "X is unchanged", "byte-identical to
+    <prev>". Keep one only where its absence would cause a real misread,
+    as a short parenthetical.
+  - Edge-case inventories — marker lists, not-flagged lists, escape tables.
+    Tests and the issue carry those.
+  - Mechanism walkthroughs (JSDoc, CLAUDE.md/AGENTS.md, or the relevant
+    skill own those), ceremonial framings ("This release introduces…"),
+    backwards-compat paragraphs, file-by-file test enumerations. Prefer
+    code/symbol names over English re-explanations.
+
+  Verified ≠ included: the every-claim-verified-from-the-diff rule bounds
+  the TRUTH of what you write, never the AMOUNT.
+
+  Example — same fact, right size:
+
+    TOO LONG: **`fetchWithTimeout`'s `timeoutMs` bounds the whole exchange**
+    (#341). `fetch` resolves once headers arrive and the deadline was
+    cleared as the helper returned, so a peer that answered promptly and
+    then stalled the stream held the request open indefinitely. A 2xx
+    carrying a body now comes back as a passthrough wrapper that disarms
+    the deadline when the body closes, errors, or is cancelled; …
+    [+90 more words of mechanism and edge cases]
+
+    RIGHT: **`fetchWithTimeout`'s `timeoutMs` now bounds the whole
+    exchange, not just the headers** (#341). A stalled body aborts with
+    the same `Timeout` error; the returned `Response` is a wrapper, so
+    identity assertions (`toBe(response)`) no longer hold.
+
+  Narrative intro: skip by default. Add one short sentence only when the
+  release theme genuinely needs framing the bullets can't carry. When many
+  bullets share one upgrade consequence, state it ONCE — intro line or
+  agent-notes — never per bullet.
+
+  Sections: Keep a Changelog order — Added, Changed, Deprecated, Removed,
+  Fixed, Security. Include only sections with entries; delete the rest
+  (including the commented-out scaffolding below). Don't ship empty headers.
+
+  Include: every distinct fact a reader needs to adopt or audit the release —
+  new exports, signatures, lint rule IDs, env vars, breaking changes, version
+  bumps on shipped skills. Nothing more.
+
+  Links: link issues, PRs, docs, or skills where they help a reader jump to
+  context. Once per item per entry — don't re-link the same issue in summary,
+  narrative, and bullet. Skip links for inline symbol names; code spans speak
+  for themselves.
+
+  Issue/PR URLs: use full URLs. GitHub's bare `#NN` auto-link only resolves
+  inside its own UI, not in npm reads or local editors.
+
+      [#38](https://github.com/cyanheads/mcp-ts-core/issues/38)   ← issue
+      [#42](https://github.com/cyanheads/mcp-ts-core/pull/42)     ← PR
+
+  Verify numbers exist before linking (`gh issue view NN`, `gh pr view NN`).
+  Never speculate on a future number — `#42` for an upcoming PR silently
+  resolves to whatever real item already owns 42, and timeline previews pull
+  in that unrelated item's metadata.
+
+  TAG ANNOTATIONS — the annotated tag body renders as the GitHub Release body
+  via `gh release create --notes-from-tag`. It is a condensed digest of this
+  entry, never a copy, and its format is owned by the `release-and-publish`
+  skill (step 4, "Create the annotated tag"): a short subject line without the
+  version, flat headline bullets — no Keep-a-Changelog section headers, no
+  gates line — at most one deps line, issue backlinks, and the changelog link
+  last. In release-PR mode the `git-wrapup` skill authors those bullets as the
+  PR body's `## Changes` and the tag copies them.
+-->
+
+## Added
+
+-
+
+## Changed
+
+-
+
+<!-- ## Deprecated
+
+- -->
+
+<!-- ## Removed
+
+- -->
+
+## Fixed
+
+-
+
+<!-- ## Security
+
+- -->

package/dist/config/server-config.d.ts

@@ -6,18 +6,18 @@
  */
 import { z } from '@cyanheads/mcp-ts-core';
 declare const ServerConfigSchema: z.ZodObject<{
-    apiKey: z.ZodPreprocess<z.ZodOptional<z.ZodString>, unknown>;
+    apiKey: z.ZodOptional<z.ZodString>;
     toolIdentifier: z.ZodDefault<z.ZodString>;
-    adminEmail: z.ZodPreprocess<z.ZodOptional<z.ZodEmail>, unknown>;
+    adminEmail: z.ZodOptional<z.ZodEmail>;
     requestDelayMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     maxConcurrent: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     maxRetries: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     timeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     totalDeadlineMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
-    unpaywallEmail: z.ZodPreprocess<z.ZodOptional<z.ZodEmail>, unknown>;
+    unpaywallEmail: z.ZodOptional<z.ZodEmail>;
     unpaywallTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     europepmcEnabled: z.ZodDefault<z.ZodCodec<z.ZodString, z.ZodBoolean>>;
-    europepmcEmail: z.ZodPreprocess<z.ZodOptional<z.ZodEmail>, unknown>;
+    europepmcEmail: z.ZodOptional<z.ZodEmail>;
     europepmcRequestDelayMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     europepmcMaxRetries: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     europepmcTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;

package/dist/config/server-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-config.d.ts","sourceRoot":"","sources":["../../src/config/server-config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,wBAAwB,CAAC;AAoB3C,QAAA,MAAM,kBAAkB;;;;;;;;;;;;;;;;iBA4DtB,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAI9D,wBAAgB,eAAe,IAAI,YAAY,CA8B9C"}
+{"version":3,"file":"server-config.d.ts","sourceRoot":"","sources":["../../src/config/server-config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,wBAAwB,CAAC;AAG3C,QAAA,MAAM,kBAAkB;;;;;;;;;;;;;;;;iBA8DtB,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAI9D,wBAAgB,eAAe,IAAI,YAAY,CA+B9C"}

package/dist/config/server-config.js

@@ -6,28 +6,10 @@
  */
 import { z } from '@cyanheads/mcp-ts-core';
 import { parseEnvConfig } from '@cyanheads/mcp-ts-core/config';
-/**
- * Treats an unset env var (`undefined`), a set-but-empty env var (`""`), and
- * an unsubstituted MCPB placeholder (`${user_config.X}`) identically. Without
- * this, `NCBI_ADMIN_EMAIL=` would fail `z.email()` validation instead of being
- * interpreted as "no admin email configured". The placeholder case occurs when
- * a Claude Desktop / MCPB host installs the bundle and the user leaves an
- * optional `user_config` field blank — the literal `${user_config.X}` string
- * is passed through to the process instead of being substituted, which would
- * otherwise crash `z.email()` on the next config load.
- */
-const PLACEHOLDER_PATTERN = /^\$\{[^}]+\}$/;
-const emptyAsUndefined = (v) => {
-    if (v === '')
-        return;
-    if (typeof v === 'string' && PLACEHOLDER_PATTERN.test(v))
-        return;
-    return v;
-};
 const ServerConfigSchema = z.object({
-    apiKey: z.preprocess(emptyAsUndefined, z.string().optional()).describe('NCBI API key'),
+    apiKey: z.string().optional().describe('NCBI API key'),
     toolIdentifier: z.string().default('pubmed-mcp-server').describe('NCBI tool identifier'),
-    adminEmail: z.preprocess(emptyAsUndefined, z.email().optional()).describe('Admin contact email'),
+    adminEmail: z.email().optional().describe('Admin contact email'),
     requestDelayMs: z.coerce.number().min(50).max(5000).default(334).describe('Request delay in ms'),
     maxConcurrent: z.coerce
         .number()
@@ -49,7 +31,8 @@ const ServerConfigSchema = z.object({
         .default(60000)
         .describe('Total deadline across all retry attempts for one NCBI call, in ms'),
     unpaywallEmail: z
-        .preprocess(emptyAsUndefined, z.email().optional())
+        .email()
+        .optional()
         .describe('Email for Unpaywall API (enables non-PMC full-text fallback when set)'),
     unpaywallTimeoutMs: z.coerce
         .number()
@@ -62,7 +45,8 @@ const ServerConfigSchema = z.object({
         .default(true)
         .describe('Enable Europe PMC search tool and `pubmed_fetch_fulltext` JATS fallback chain. Set false to fully disable EPMC calls.'),
     europepmcEmail: z
-        .preprocess(emptyAsUndefined, z.email().optional())
+        .email()
+        .optional()
         .describe('Optional contact email sent with Europe PMC requests'),
     europepmcRequestDelayMs: z.coerce
         .number()
@@ -106,10 +90,11 @@ export function getServerConfig() {
         /**
          * An API key raises NCBI's rate ceiling from ~3 req/s to ~10 req/s. If the
          * operator hasn't explicitly overridden the delay, tighten from the 334ms
-         * safe default to 100ms when a key is present.
+         * safe default to 100ms when a key is present. A set-but-blank delay counts
+         * as not overridden, matching how `parseEnvConfig` reads it.
          */
         _config =
-            parsed.apiKey && process.env.NCBI_REQUEST_DELAY_MS === undefined
+            parsed.apiKey && !process.env.NCBI_REQUEST_DELAY_MS?.trim()
                 ? { ...parsed, requestDelayMs: 100 }
                 : parsed;
     }

package/dist/config/server-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"server-config.js","sourceRoot":"","sources":["../../src/config/server-config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,wBAAwB,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAE/D;;;;;;;;;GASG;AACH,MAAM,mBAAmB,GAAG,eAAe,CAAC;AAC5C,MAAM,gBAAgB,GAAG,CAAC,CAAU,EAAE,EAAE;IACtC,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO;IACrB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO;IACjE,OAAO,CAAC,CAAC;AACX,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,UAAU,CAAC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC;IACtF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC;IACxF,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC,gBAAgB,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC;IAChG,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC;IAChG,aAAa,EAAE,CAAC,CAAC,MAAM;SACpB,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;SACP,OAAO,CAAC,CAAC,CAAC;SACV,QAAQ,CAAC,wCAAwC,CAAC;IACrD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC;IACtF,SAAS,EAAE,CAAC,CAAC,MAAM;SAChB,MAAM,EAAE;SACR,GAAG,CAAC,IAAI,CAAC;SACT,GAAG,CAAC,MAAM,CAAC;SACX,OAAO,CAAC,KAAK,CAAC;SACd,QAAQ,CAAC,gCAAgC,CAAC;IAC7C,eAAe,EAAE,CAAC,CAAC,MAAM;SACtB,MAAM,EAAE;SACR,GAAG,CAAC,IAAI,CAAC;SACT,GAAG,CAAC,MAAM,CAAC;SACX,OAAO,CAAC,KAAK,CAAC;SACd,QAAQ,CAAC,mEAAmE,CAAC;IAChF,cAAc,EAAE,CAAC;SACd,UAAU,CAAC,gBAAgB,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC;SAClD,QAAQ,CAAC,uEAAuE,CAAC;IACpF,kBAAkB,EAAE,CAAC,CAAC,MAAM;SACzB,MAAM,EAAE;SACR,GAAG,CAAC,IAAI,CAAC;SACT,GAAG,CAAC,MAAM,CAAC;SACX,OAAO,CAAC,KAAK,CAAC;SACd,QAAQ,CAAC,2EAA2E,CAAC;IACxF,gBAAgB,EAAE,CAAC;SAChB,UAAU,EAAE;SACZ,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CACP,uHAAuH,CACxH;IACH,cAAc,EAAE,CAAC;SACd,UAAU,CAAC,gBAAgB,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC;SAClD,QAAQ,CAAC,sDAAsD,CAAC;IACnE,uBAAuB,EAAE,CAAC,CAAC,MAAM;SAC9B,MAAM,EAAE;SACR,GAAG,CAAC,EAAE,CAAC;SACP,GAAG,CAAC,IAAI,CAAC;SACT,OAAO,CAAC,GAAG,CAAC;SACZ,QAAQ,CAAC,qDAAqD,CAAC;IAClE,mBAAmB,EAAE,CAAC,CAAC,MAAM;SAC1B,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;SACP,OAAO,CAAC,CAAC,CAAC;SACV,QAAQ,CAAC,mDAAmD,CAAC;IAChE,kBAAkB,EAAE,CAAC,CAAC,MAAM;SACzB,MAAM,EAAE;SACR,GAAG,CAAC,IAAI,CAAC;SACT,GAAG,CAAC,MAAM,CAAC;SACX,OAAO,CAAC,KAAK,CAAC;SACd,QAAQ,CAAC,sDAAsD,CAAC;CACpE,CAAC,CAAC;AAIH,IAAI,OAAiC,CAAC;AAEtC,MAAM,UAAU,eAAe;IAC7B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,cAAc,CAAC,kBAAkB,EAAE;YAChD,MAAM,EAAE,cAAc;YACtB,cAAc,EAAE,sBAAsB;YACtC,UAAU,EAAE,kBAAkB;YAC9B,cAAc,EAAE,uBAAuB;YACvC,aAAa,EAAE,qBAAqB;YACpC,UAAU,EAAE,kBAAkB;YAC9B,SAAS,EAAE,iBAAiB;YAC5B,eAAe,EAAE,wBAAwB;YACzC,cAAc,EAAE,iBAAiB;YACjC,kBAAkB,EAAE,sBAAsB;YAC1C,gBAAgB,EAAE,mBAAmB;YACrC,cAAc,EAAE,iBAAiB;YACjC,uBAAuB,EAAE,4BAA4B;YACrD,mBAAmB,EAAE,uBAAuB;YAC5C,kBAAkB,EAAE,sBAAsB;SAC3C,CAAC,CAAC;QACH;;;;WAIG;QACH,OAAO;YACL,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,SAAS;gBAC9D,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,cAAc,EAAE,GAAG,EAAE;gBACpC,CAAC,CAAC,MAAM,CAAC;IACf,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"server-config.js","sourceRoot":"","sources":["../../src/config/server-config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,wBAAwB,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAE/D,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC;IACtD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC;IACxF,UAAU,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC;IAChE,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC;IAChG,aAAa,EAAE,CAAC,CAAC,MAAM;SACpB,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;SACP,OAAO,CAAC,CAAC,CAAC;SACV,QAAQ,CAAC,wCAAwC,CAAC;IACrD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC;IACtF,SAAS,EAAE,CAAC,CAAC,MAAM;SAChB,MAAM,EAAE;SACR,GAAG,CAAC,IAAI,CAAC;SACT,GAAG,CAAC,MAAM,CAAC;SACX,OAAO,CAAC,KAAK,CAAC;SACd,QAAQ,CAAC,gCAAgC,CAAC;IAC7C,eAAe,EAAE,CAAC,CAAC,MAAM;SACtB,MAAM,EAAE;SACR,GAAG,CAAC,IAAI,CAAC;SACT,GAAG,CAAC,MAAM,CAAC;SACX,OAAO,CAAC,KAAK,CAAC;SACd,QAAQ,CAAC,mEAAmE,CAAC;IAChF,cAAc,EAAE,CAAC;SACd,KAAK,EAAE;SACP,QAAQ,EAAE;SACV,QAAQ,CAAC,uEAAuE,CAAC;IACpF,kBAAkB,EAAE,CAAC,CAAC,MAAM;SACzB,MAAM,EAAE;SACR,GAAG,CAAC,IAAI,CAAC;SACT,GAAG,CAAC,MAAM,CAAC;SACX,OAAO,CAAC,KAAK,CAAC;SACd,QAAQ,CAAC,2EAA2E,CAAC;IACxF,gBAAgB,EAAE,CAAC;SAChB,UAAU,EAAE;SACZ,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CACP,uHAAuH,CACxH;IACH,cAAc,EAAE,CAAC;SACd,KAAK,EAAE;SACP,QAAQ,EAAE;SACV,QAAQ,CAAC,sDAAsD,CAAC;IACnE,uBAAuB,EAAE,CAAC,CAAC,MAAM;SAC9B,MAAM,EAAE;SACR,GAAG,CAAC,EAAE,CAAC;SACP,GAAG,CAAC,IAAI,CAAC;SACT,OAAO,CAAC,GAAG,CAAC;SACZ,QAAQ,CAAC,qDAAqD,CAAC;IAClE,mBAAmB,EAAE,CAAC,CAAC,MAAM;SAC1B,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;SACP,OAAO,CAAC,CAAC,CAAC;SACV,QAAQ,CAAC,mDAAmD,CAAC;IAChE,kBAAkB,EAAE,CAAC,CAAC,MAAM;SACzB,MAAM,EAAE;SACR,GAAG,CAAC,IAAI,CAAC;SACT,GAAG,CAAC,MAAM,CAAC;SACX,OAAO,CAAC,KAAK,CAAC;SACd,QAAQ,CAAC,sDAAsD,CAAC;CACpE,CAAC,CAAC;AAIH,IAAI,OAAiC,CAAC;AAEtC,MAAM,UAAU,eAAe;IAC7B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,cAAc,CAAC,kBAAkB,EAAE;YAChD,MAAM,EAAE,cAAc;YACtB,cAAc,EAAE,sBAAsB;YACtC,UAAU,EAAE,kBAAkB;YAC9B,cAAc,EAAE,uBAAuB;YACvC,aAAa,EAAE,qBAAqB;YACpC,UAAU,EAAE,kBAAkB;YAC9B,SAAS,EAAE,iBAAiB;YAC5B,eAAe,EAAE,wBAAwB;YACzC,cAAc,EAAE,iBAAiB;YACjC,kBAAkB,EAAE,sBAAsB;YAC1C,gBAAgB,EAAE,mBAAmB;YACrC,cAAc,EAAE,iBAAiB;YACjC,uBAAuB,EAAE,4BAA4B;YACrD,mBAAmB,EAAE,uBAAuB;YAC5C,kBAAkB,EAAE,sBAAsB;SAC3C,CAAC,CAAC;QACH;;;;;WAKG;QACH,OAAO;YACL,MAAM,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE;gBACzD,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,cAAc,EAAE,GAAG,EAAE;gBACpC,CAAC,CAAC,MAAM,CAAC;IACf,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/index.js

@@ -38,6 +38,7 @@ const tools = [
 await createApp({
     name: 'pubmed-mcp-server',
     title: 'pubmed-mcp-server',
+    sessionMode: 'stateless',
     tools,
     resources: [databaseInfoResource],
     prompts: [researchPlanPrompt],

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;GAGG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,0DAA0D,CAAC;AAC9F,OAAO,EAAE,oBAAoB,EAAE,MAAM,8DAA8D,CAAC;AACpG,OAAO,EAAE,cAAc,EAAE,MAAM,oDAAoD,CAAC;AACpF,OAAO,EAAE,iBAAiB,EAAE,MAAM,uDAAuD,CAAC;AAC1F,OAAO,EAAE,iBAAiB,EAAE,MAAM,uDAAuD,CAAC;AAC1F,OAAO,EAAE,eAAe,EAAE,MAAM,qDAAqD,CAAC;AACtF,OAAO,EAAE,mBAAmB,EAAE,MAAM,yDAAyD,CAAC;AAC9F,OAAO,EAAE,kBAAkB,EAAE,MAAM,wDAAwD,CAAC;AAC5F,OAAO,EAAE,cAAc,EAAE,MAAM,oDAAoD,CAAC;AACpF,OAAO,EAAE,wBAAwB,EAAE,MAAM,+DAA+D,CAAC;AACzG,OAAO,EAAE,yBAAyB,EAAE,MAAM,gEAAgE,CAAC;AAC3G,OAAO,EAAE,kBAAkB,EAAE,MAAM,wDAAwD,CAAC;AAC5F,OAAO,EAAE,cAAc,EAAE,MAAM,oDAAoD,CAAC;AACpF,OAAO,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAEjF,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;AACjC,MAAM,KAAK,GAAG;IACZ,kBAAkB;IAClB,iBAAiB;IACjB,iBAAiB;IACjB,mBAAmB;IACnB,eAAe;IACf,cAAc;IACd,cAAc;IACd,kBAAkB;IAClB,cAAc;IACd,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,yBAAyB,EAAE,wBAAwB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;CAC1F,CAAC;AAEF,MAAM,SAAS,CAAC;IACd,IAAI,EAAE,mBAAmB;IACzB,KAAK,EAAE,mBAAmB;IAC1B,KAAK;IACL,SAAS,EAAE,CAAC,oBAAoB,CAAC;IACjC,OAAO,EAAE,CAAC,kBAAkB,CAAC;IAC7B,YAAY,EACV,2vBAA2vB;IAC7vB,OAAO,EAAE;QACP,WAAW,EAAE,KAAK;QAClB,OAAO,EACL,uGAAuG;QACzG,QAAQ,EAAE,gDAAgD;QAC1D,KAAK,EAAE;YACL,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,kCAAkC,EAAE,QAAQ,EAAE,IAAI,EAAE;YAC7E;gBACE,KAAK,EAAE,kBAAkB;gBACzB,IAAI,EAAE,8CAA8C;gBACpD,QAAQ,EAAE,IAAI;aACf;YACD;gBACE,KAAK,EAAE,qBAAqB;gBAC5B,IAAI,EAAE,gDAAgD;gBACtD,QAAQ,EAAE,IAAI;aACf;YACD,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,4BAA4B,EAAE,QAAQ,EAAE,IAAI,EAAE;SAC9E;QACD,UAAU,EAAE;YACV,YAAY,EAAE,mBAAmB;YACjC,gBAAgB,EAAE,iBAAiB;YACnC,eAAe,EAAE,iBAAiB;SACnC;KACF;IACD,KAAK;QACH,eAAe,EAAE,CAAC;QAClB,oBAAoB,EAAE,CAAC;QACvB,oBAAoB,EAAE,CAAC;QACvB,mBAAmB,EAAE,CAAC;IACxB,CAAC;CACF,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;GAGG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,0DAA0D,CAAC;AAC9F,OAAO,EAAE,oBAAoB,EAAE,MAAM,8DAA8D,CAAC;AACpG,OAAO,EAAE,cAAc,EAAE,MAAM,oDAAoD,CAAC;AACpF,OAAO,EAAE,iBAAiB,EAAE,MAAM,uDAAuD,CAAC;AAC1F,OAAO,EAAE,iBAAiB,EAAE,MAAM,uDAAuD,CAAC;AAC1F,OAAO,EAAE,eAAe,EAAE,MAAM,qDAAqD,CAAC;AACtF,OAAO,EAAE,mBAAmB,EAAE,MAAM,yDAAyD,CAAC;AAC9F,OAAO,EAAE,kBAAkB,EAAE,MAAM,wDAAwD,CAAC;AAC5F,OAAO,EAAE,cAAc,EAAE,MAAM,oDAAoD,CAAC;AACpF,OAAO,EAAE,wBAAwB,EAAE,MAAM,+DAA+D,CAAC;AACzG,OAAO,EAAE,yBAAyB,EAAE,MAAM,gEAAgE,CAAC;AAC3G,OAAO,EAAE,kBAAkB,EAAE,MAAM,wDAAwD,CAAC;AAC5F,OAAO,EAAE,cAAc,EAAE,MAAM,oDAAoD,CAAC;AACpF,OAAO,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAEjF,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;AACjC,MAAM,KAAK,GAAG;IACZ,kBAAkB;IAClB,iBAAiB;IACjB,iBAAiB;IACjB,mBAAmB;IACnB,eAAe;IACf,cAAc;IACd,cAAc;IACd,kBAAkB;IAClB,cAAc;IACd,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,yBAAyB,EAAE,wBAAwB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;CAC1F,CAAC;AAEF,MAAM,SAAS,CAAC;IACd,IAAI,EAAE,mBAAmB;IACzB,KAAK,EAAE,mBAAmB;IAC1B,WAAW,EAAE,WAAW;IACxB,KAAK;IACL,SAAS,EAAE,CAAC,oBAAoB,CAAC;IACjC,OAAO,EAAE,CAAC,kBAAkB,CAAC;IAC7B,YAAY,EACV,2vBAA2vB;IAC7vB,OAAO,EAAE;QACP,WAAW,EAAE,KAAK;QAClB,OAAO,EACL,uGAAuG;QACzG,QAAQ,EAAE,gDAAgD;QAC1D,KAAK,EAAE;YACL,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,kCAAkC,EAAE,QAAQ,EAAE,IAAI,EAAE;YAC7E;gBACE,KAAK,EAAE,kBAAkB;gBACzB,IAAI,EAAE,8CAA8C;gBACpD,QAAQ,EAAE,IAAI;aACf;YACD;gBACE,KAAK,EAAE,qBAAqB;gBAC5B,IAAI,EAAE,gDAAgD;gBACtD,QAAQ,EAAE,IAAI;aACf;YACD,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,4BAA4B,EAAE,QAAQ,EAAE,IAAI,EAAE;SAC9E;QACD,UAAU,EAAE;YACV,YAAY,EAAE,mBAAmB;YACjC,gBAAgB,EAAE,iBAAiB;YACnC,eAAe,EAAE,iBAAiB;SACnC;KACF;IACD,KAAK;QACH,eAAe,EAAE,CAAC;QAClB,oBAAoB,EAAE,CAAC;QACvB,oBAAoB,EAAE,CAAC;QACvB,mBAAmB,EAAE,CAAC;IACxB,CAAC;CACF,CAAC,CAAC"}

package/dist/services/europe-pmc/europe-pmc-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"europe-pmc-service.d.ts","sourceRoot":"","sources":["../../../src/services/europe-pmc/europe-pmc-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAgBH,OAAO,KAAK,EAAE,QAAQ,EAAgB,MAAM,4CAA4C,CAAC;AAGzF,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EACV,uBAAuB,EAEvB,kBAAkB,EAElB,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,EAErB,qBAAqB,EACrB,eAAe,EAChB,MAAM,YAAY,CAAC;AAkDpB;;;;;;;;;GASG;AACH,qBAAa,gBAAgB;IAIzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAL7B,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAY;IAE7C,YACmB,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE,qBAAqB,EAC5B,UAAU,EAAE,MAAM,EAQpC;IAED;;;OAGG;IACG,MAAM,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA6F1E;IAED;;;;;;;;;;OAUG;IACG,YAAY,CAChB,IAAI,EAAE,SAAS,kBAAkB,EAAE,EACnC,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAQ/B;IAED;;;;;;;OAOG;IACG,WAAW,CACf,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,eAAe,EACvB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,uBAAuB,CAAC,CAgBlC;IAED;;;;;;;;;;OAUG;IACH,SAAS,CACP,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,sBAAsB,CAAC,CAQjC;IAED;;;;;;;;;;OAUG;IACH,UAAU,CACR,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,sBAAsB,CAAC,CAQjC;IAED;;;;;OAKG;YACW,iBAAiB;IAsE/B;;;;;;;;OAQG;IACH,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CA8BlD;IAED;;;;OAIG;YACW,SAAS;CAoDxB;AAMD;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAyB3C;AAED,6EAA6E;AAC7E,wBAAgB,mBAAmB,IAAI,gBAAgB,GAAG,SAAS,CAElE"}
+{"version":3,"file":"europe-pmc-service.d.ts","sourceRoot":"","sources":["../../../src/services/europe-pmc/europe-pmc-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAeH,OAAO,KAAK,EAAE,QAAQ,EAAgB,MAAM,4CAA4C,CAAC;AAEzF,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EACV,uBAAuB,EAEvB,kBAAkB,EAElB,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,EAErB,qBAAqB,EACrB,eAAe,EAChB,MAAM,YAAY,CAAC;AA2CpB;;;;;;;;;GASG;AACH,qBAAa,gBAAgB;IAIzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAL7B,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAY;IAE7C,YACmB,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE,qBAAqB,EAC5B,UAAU,EAAE,MAAM,EAQpC;IAED;;;OAGG;IACG,MAAM,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA6F1E;IAED;;;;;;;;;;OAUG;IACG,YAAY,CAChB,IAAI,EAAE,SAAS,kBAAkB,EAAE,EACnC,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAQ/B;IAED;;;;;;;OAOG;IACG,WAAW,CACf,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,eAAe,EACvB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,uBAAuB,CAAC,CAgBlC;IAED;;;;;;;;;;OAUG;IACH,SAAS,CACP,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,sBAAsB,CAAC,CAQjC;IAED;;;;;;;;;;OAUG;IACH,UAAU,CACR,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,sBAAsB,CAAC,CAQjC;IAED;;;;;OAKG;YACW,iBAAiB;IAsE/B;;;;;;;;OAQG;IACH,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CA8BlD;IAED;;;;OAIG;YACW,SAAS;CAoDxB;AAMD;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAyB3C;AAED,6EAA6E;AAC7E,wBAAgB,mBAAmB,IAAI,gBAAgB,GAAG,SAAS,CAElE"}

package/dist/services/europe-pmc/europe-pmc-service.js

@@ -13,23 +13,16 @@
  *
  * @module src/services/europe-pmc/europe-pmc-service
  */
-import { internalError, JsonRpcErrorCode, McpError, serializationError, validationError, } from '@cyanheads/mcp-ts-core/errors';
-import { logger, requestContextService } from '@cyanheads/mcp-ts-core/utils';
+import { internalError, McpError, serializationError, validationError, } from '@cyanheads/mcp-ts-core/errors';
+import { defaultIsTransient, logger, requestContextService } from '@cyanheads/mcp-ts-core/utils';
 // biome-ignore lint/suspicious/noDeprecatedImports: staying on in-tree XMLValidator — see ncbi/response-handler.ts
 import { XMLParser, XMLValidator } from 'fast-xml-parser';
 import { getServerConfig } from '../../config/server-config.js';
 import { recoveryFor } from '../error-contracts.js';
 import { ORDERED_XML_PARSER_OPTIONS } from '../ncbi/parsing/ordered-xml-parser-options.js';
 import { ensureArray } from '../ncbi/parsing/xml-helpers.js';
-import { isTransient } from '../retry-policy.js';
 import { EuropePmcApiClient } from './api-client.js';
 import { EuropePmcRequestQueue } from './request-queue.js';
-/** Retryable transient codes — same set NCBI uses. */
-const RETRYABLE_CODES = new Set([
-    JsonRpcErrorCode.ServiceUnavailable,
-    JsonRpcErrorCode.Timeout,
-    JsonRpcErrorCode.RateLimited,
-]);
 const MAX_BACKOFF_MS = 30_000;
 function abortableSleep(ms, signal) {
     if (!signal)
@@ -352,7 +345,7 @@ export class EuropePmcService {
                     throw signal.reason;
                 if (!(error instanceof McpError))
                     throw error;
-                if (!isTransient(error, RETRYABLE_CODES))
+                if (!defaultIsTransient(error))
                     throw error;
                 if (attempt < this.maxRetries) {
                     const baseDelay = Math.min(1000 * 2 ** attempt, MAX_BACKOFF_MS);