senado-br-mcp 3.15.2 → 3.15.3

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 Sidney Bissoli
+Copyright (c) 2026 Sidney da Silva Pereira Bissoli
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -149,7 +149,7 @@ Claude Code auto-discovers it when you work in this repo. To use it elsewhere, c
 - **Runtime:** Cloudflare Workers (ESM)
 - **Transport:** Streamable HTTP (MCP spec 2025-03-26) via `createMcpHandler` from `agents/mcp`
 - **Protocol:** MCP over JSON-RPC — `/mcp` handles the full public server; `/mcp/openai-app-v2` exposes a curated 27-tool profile plus a shared MCP Apps widget for OpenAI app review/submission (`/mcp/openai-app` remains as a legacy alias)
-- **SDK:** `@modelcontextprotocol/server` 2.x (per-request McpServer instances; the v1 `@modelcontextprotocol/sdk` remains only as a peer of `agents`, dev-time)
+- **SDK:** `@modelcontextprotocol/server` 2.x (per-request McpServer instances; the v1 `@modelcontextprotocol/sdk` is not installed — `agents` still lists it as a peer, satisfied via `legacy-peer-deps`)
 - **Validation:** Zod schemas for all tool inputs
 - **Caching:** 2-layer (L0 memory + L1 Cache API) with SHA-256 keying
 - **e-Cidadania store:** D1 database refreshed by a Cron Trigger (every 2h) — list tools read from D1 with a live-scrape fallback and a staleness flag; detail tools stay live with write-through (see [e-Cidadania](#e-cidadania-d1-backed-cron-refreshed))
@@ -270,6 +270,21 @@ npm run deploy
 | `/metrics` | GET | JSON counters: requests, tool calls, cache hits/misses, upstream calls/retries/errors, auth failures (always public) |
 | `/.well-known/mcp/server-card.json` | GET | MCP server card for directory scanners (Smithery): `serverInfo`, `authentication`, tools/resources/prompts — generated from the live `full` profile by `@sbissoli/mcp-surface/card` (always public) |
 
+### Surface fingerprint, checkable from the registry
+
+Every release publishes, in its [MCP Registry](https://registry.modelcontextprotocol.io) entry,
+the sha256 of the surface `/mcp` serves (`initialize`, tools, resources, prompts of the `full`
+profile) and which methods answer there without a credential. A surface change without a
+version bump fails the build; the fingerprint in the registry lets a client check the same thing
+on its own side. Canonical form and procedure:
+[SPEC.md of `@sbissoli/mcp-surface`](https://github.com/SidneyBissoli/mcp-br-commons/blob/main/packages/mcp-surface/SPEC.md).
+To check it yourself (Node 18+, no dependencies):
+
+```sh
+curl -sO https://raw.githubusercontent.com/SidneyBissoli/mcp-br-commons/main/packages/mcp-surface/exemplos/verify.mjs
+node verify.mjs io.github.SidneyBissoli/senado-br-mcp-cloudflare
+```
+
 ## MCP Request Examples
 
 All requests go to `POST /mcp` with JSON-RPC 2.0 format.

package/dist/landing.js

@@ -35,7 +35,7 @@ function seoHead() {
         inLanguage: "pt-BR",
         offers: { "@type": "Offer", price: "0", priceCurrency: "USD" },
         license: "https://opensource.org/licenses/MIT",
-        author: { "@type": "Person", name: "Sidney Bissoli" },
+        author: { "@type": "Person", name: "Sidney da Silva Pereira Bissoli" },
         codeRepository: GITHUB_URL,
     };
     return `  <meta name="description" content="${RESUMO}">

package/dist/legal.js

@@ -71,7 +71,7 @@ const privacyBody = `
     <p>The service queries official public Senate endpoints and runs on Cloudflare infrastructure. It does not sell personal information. It may disclose operational information when required by law or to protect the service from abuse.</p>
 
     <h2>Your choices and contact</h2>
-    <p>Do not send sensitive personal information to the service. The service operator and contact for privacy requests is Sidney Bissoli, reachable at <a href="mailto:${CONTACT_EMAIL}">${CONTACT_EMAIL}</a>. You may ask about privacy or request deletion of operational data that may be associated with you. Because the service primarily handles public data and aggregate logs, some records may not be individually identifiable.</p>
+    <p>Do not send sensitive personal information to the service. The service operator and contact for privacy requests is Sidney da Silva Pereira Bissoli, reachable at <a href="mailto:${CONTACT_EMAIL}">${CONTACT_EMAIL}</a>. You may ask about privacy or request deletion of operational data that may be associated with you. Because the service primarily handles public data and aggregate logs, some records may not be individually identifiable.</p>
 
     <h2>Changes</h2>
     <p>This policy may be updated as the service evolves. The date above identifies the current version.</p>

package/dist/version.js

@@ -1,3 +1,3 @@
 /** Single source of truth for the server version (kept in sync with package.json). */
-export const VERSION = "3.15.2";
+export const VERSION = "3.15.3";
 export const USER_AGENT = `senado-br-mcp/${VERSION} (+https://senado.sidneybissoli.com; sbissoli76@gmail.com)`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "senado-br-mcp",
-  "version": "3.15.2",
+  "version": "3.15.3",
   "description": "MCP server for Brazilian Senate open data — runs hosted on Cloudflare Workers or locally via npx (stdio)",
   "license": "MIT",
   "type": "module",
@@ -26,7 +26,7 @@
     "version": "node scripts/sync-version.mjs && git add -u",
     "typecheck": "tsc --noEmit && tsc -p scripts/tsconfig.json",
     "test": "vitest run",
-    "surface:lock": "mcp-surface travar --cmd \"vitest run tests/surface-lock.test.ts\"",
+    "surface:lock": "mcp-surface travar --cmd \"vitest run tests/surface-lock.test.ts\" && mcp-surface registro --perfil full --tool senado_estrutura_organizacional --args \"{\\\"unidade\\\":\\\"DGER\\\"}\"",
     "test:watch": "vitest",
     "test:contract": "vitest run -c vitest.contract.config.ts",
     "contract:refresh": "tsx scripts/contract/refresh-fixtures.ts",
@@ -60,9 +60,8 @@
   "devDependencies": {
     "@cloudflare/workers-types": "^5.20260830.1",
     "@modelcontextprotocol/client": "^2.0.0",
-    "@modelcontextprotocol/sdk": "^1.30.0",
     "@sbissoli/mcp-evals": "^0.2.1",
-    "@sbissoli/mcp-surface": "^0.3.0",
+    "@sbissoli/mcp-surface": "^0.5.0",
     "@types/node": "^26.5.1",
     "agents": "^0.26.0",
     "exceljs": "^4.4.0",
@@ -73,15 +72,7 @@
     "wrangler": "^4.127.1"
   },
   "overrides": {
-    "fast-uri": "^4.1.5",
-    "hono": "^4.12.27",
-    "@hono/node-server": "^1.19.13",
-    "express-rate-limit": "^8.5.2",
-    "ip-address": "^10.2.0",
-    "qs": "^6.16.0",
     "path-to-regexp": "^8.4.2",
-    "lodash": "^4.18.1",
-    "js-yaml": "^4.2.0",
     "undici": "^7.28.0",
     "ws": "^8.21.0",
     "picomatch": "^4.0.4",