@george43g/mcp-kit 1.0.0 → 2.0.0

package/README.md

@@ -145,6 +145,52 @@ buildDispatcher: 1 devOnly tool(s) registered with no devOnlyEnabled predicate:
 **Migration is one line** — pass the predicate, as shown in *Dev-only tools*
 above. If you have no `devOnly` tools, there is nothing to do.
 
+### Upgrading to 2.0.0 — declare `@george43g/robustness` yourself
+
+**`robustness` moved from `dependencies` to `peerDependencies`.** If your app
+already depends on `@george43g/robustness` directly — as every known consumer
+does, and as the generated template does — **there is nothing to do**. If it does
+not, add it.
+
+```jsonc
+// your package.json
+"dependencies": {
+  "@george43g/robustness": ">=0.13.0 <1"   // or a caret; any 0.x satisfies the peer
+}
+```
+
+**What this fixes, and it is not cosmetic.** As a plain dependency with a
+*floor*, mcp-kit could resolve its **own second copy** of robustness whenever the
+app's range and mcp-kit's stopped overlapping. The logger keeps prefix and file
+state at module scope, so two copies means **two independent loggers**:
+`setLogFilePrefix` in your app cannot reach the instance mcp-kit's `perf()` spans
+write through, and dispatch spans silently land in the shared `$TMPDIR/mcp/`
+bucket no matter how correctly your app brands itself.
+
+That was live in **1.0.0**, whose floor was `>=0.12.0 <1`: an app on `^0.11.0`
+that bumped mcp-kit alone got exactly this split. **2.0.0 removes the failure
+mode by construction** — a peer is supplied by the consumer, so there is only
+ever one instance. The peer range is deliberately wide (`>=0.11.0 <1`, every
+symbol mcp-kit imports exists at 0.11.0), so no consumer is forced to move.
+
+`tui-kit` has always declared robustness this way; mcp-kit was the outlier.
+
+Verify with the one line that settles it:
+
+```sh
+grep -oE "@george43g/robustness@[0-9.]+" pnpm-lock.yaml | sort -u
+```
+
+One line is correct. Two means something still resolves its own copy.
+
+**The generalisable lesson:** a plain dependency with a *wide* range behaves like
+a peer — right up until the ranges stop overlapping. Two individually safe
+changes (raising a floor, cutting a major) were jointly hazardous. Found by
+`up-bank-mcp`.
+Found by `up-bank-mcp` as range arithmetic over the published manifests.
+**Not yet observed in a resolved tree by anyone** — treat the ordering as cheap
+insurance rather than a reproduction.
+
 **Why a throw and not a flipped default.** Before 1.0.0, omitting the predicate
 left dev-only tools *callable* — hidden from `tools/list` and answering by name.
 Two consumers hit that independently, and one measured a dev-only log reader

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@george43g/mcp-kit",
-  "version": "1.0.0",
+  "version": "2.0.0",
   "description": "MCP server building blocks: tool registry types, dispatcher with timeout/perf/abort/error-wrap baked in, stdio + Streamable HTTP transports, sanitize() for user content, UUID-gated prompt-injection helpers.",
   "type": "module",
   "license": "MIT",
@@ -51,12 +51,12 @@
     "test:coverage": "vitest run --coverage"
   },
   "dependencies": {
-    "@george43g/robustness": ">=0.12.0 <1",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "zod": "^3.23.0",
     "zod-to-json-schema": "^3.25.0"
   },
   "devDependencies": {
+    "@george43g/robustness": "workspace:*",
     "@george43g/tsconfig": "workspace:*",
     "@george43g/vitest-config": "workspace:*",
     "@semantic-release/changelog": "^6.0.3",
@@ -68,5 +68,8 @@
     "semantic-release-monorepo": "^8.0.2",
     "typescript": "^5.7.0",
     "vitest": "^3.2.7"
+  },
+  "peerDependencies": {
+    "@george43g/robustness": ">=0.11.0 <1"
   }
 }