chore(release): 0.11.5 — server requests across HTTP sessions

CLAUDE.md and AGENTS.md also record the .github/ files now in the init copy set.

Author: cyanheads

AGENTS.md

@@ -1,7 +1,7 @@
 # Developer Protocol
 
 **Package:** `@cyanheads/mcp-ts-core`
-**Version:** 0.11.4
+**Version:** 0.11.5
 **Engines:** Bun ≥1.3.0, Node ≥24.0.0
 **MCP SDK:** `@modelcontextprotocol/sdk` ^1.30.0
 **Zod:** ^4.4.3
@@ -22,7 +22,7 @@ This package serves two consumer paths. When making changes, know which audience
 | **Direct package import** — existing project pulls in the package | `bun add @cyanheads/mcp-ts-core` → `import { createApp, tool, z } from '@cyanheads/mcp-ts-core'` | Public API surface (`src/`) — existing consumers feel changes immediately on upgrade |
 | **Init-scaffolded server** — fresh project bootstrapped from this repo's templates | `bunx @cyanheads/mcp-ts-core init [name]` copies `templates/` into the new directory | `templates/` — only affects newly scaffolded servers, not existing ones |
 
-Both paths share the same public API. Init copies starter `package.json`, configs (`tsconfig`, `biome.json`, `vitest.config.ts`, `devcheck.config.json`, `bunfig.toml`), `.env.example`, `Dockerfile`, `LICENSE`, `.gitattributes`, `CLAUDE.md`/`AGENTS.md`, example definitions and tests, framework `scripts/`, and external-audience `skills/`. `_`-prefixed files (e.g. `_.gitignore`) drop the prefix on copy. Existing files are never overwritten; `init` without a name scaffolds in place (upgrade flow). After init, consult the `setup` skill.
+Both paths share the same public API. Init copies starter `package.json`, configs (`tsconfig`, `biome.json`, `vitest.config.ts`, `devcheck.config.json`, `bunfig.toml`), `.env.example`, `Dockerfile`, `LICENSE`, `.gitattributes`, `CLAUDE.md`/`AGENTS.md`, `.github/` (issue forms, `CONTRIBUTING.md`, `CODE_OF_CONDUCT.md`, `SECURITY.md`), example definitions and tests, framework `scripts/`, and external-audience `skills/`. `_`-prefixed files (e.g. `_.gitignore`) drop the prefix on copy. Existing files are never overwritten; `init` without a name scaffolds in place (upgrade flow). After init, consult the `setup` skill.
 
 ---
 

CHANGELOG.md

@@ -1,7 +1,7 @@
 # Developer Protocol
 
 **Package:** `@cyanheads/mcp-ts-core`
-**Version:** 0.11.4
+**Version:** 0.11.5
 **Engines:** Bun ≥1.3.0, Node ≥24.0.0
 **MCP SDK:** `@modelcontextprotocol/sdk` ^1.30.0
 **Zod:** ^4.4.3
@@ -22,7 +22,7 @@ This package serves two consumer paths. When making changes, know which audience
 | **Direct package import** — existing project pulls in the package | `bun add @cyanheads/mcp-ts-core` → `import { createApp, tool, z } from '@cyanheads/mcp-ts-core'` | Public API surface (`src/`) — existing consumers feel changes immediately on upgrade |
 | **Init-scaffolded server** — fresh project bootstrapped from this repo's templates | `bunx @cyanheads/mcp-ts-core init [name]` copies `templates/` into the new directory | `templates/` — only affects newly scaffolded servers, not existing ones |
 
-Both paths share the same public API. Init copies starter `package.json`, configs (`tsconfig`, `biome.json`, `vitest.config.ts`, `devcheck.config.json`, `bunfig.toml`), `.env.example`, `Dockerfile`, `LICENSE`, `.gitattributes`, `CLAUDE.md`/`AGENTS.md`, example definitions and tests, framework `scripts/`, and external-audience `skills/`. `_`-prefixed files (e.g. `_.gitignore`) drop the prefix on copy. Existing files are never overwritten; `init` without a name scaffolds in place (upgrade flow). After init, consult the `setup` skill.
+Both paths share the same public API. Init copies starter `package.json`, configs (`tsconfig`, `biome.json`, `vitest.config.ts`, `devcheck.config.json`, `bunfig.toml`), `.env.example`, `Dockerfile`, `LICENSE`, `.gitattributes`, `CLAUDE.md`/`AGENTS.md`, `.github/` (issue forms, `CONTRIBUTING.md`, `CODE_OF_CONDUCT.md`, `SECURITY.md`), example definitions and tests, framework `scripts/`, and external-audience `skills/`. `_`-prefixed files (e.g. `_.gitignore`) drop the prefix on copy. Existing files are never overwritten; `init` without a name scaffolds in place (upgrade flow). After init, consult the `setup` skill.
 
 ---
 

CLAUDE.md

@@ -5,7 +5,7 @@
 
 <div align="center">
 
-[![Version](https://img.shields.io/badge/Version-0.11.4-blue.svg?style=flat-square)](./CHANGELOG.md) [![License](https://img.shields.io/badge/License-Apache%202.0-orange.svg?style=flat-square)](./LICENSE) [![MCP Spec](https://img.shields.io/badge/MCP%20Spec-2025--11--25-8A2BE2.svg?style=flat-square)](https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/docs/specification/2025-11-25/changelog.mdx)
+[![Version](https://img.shields.io/badge/Version-0.11.5-blue.svg?style=flat-square)](./CHANGELOG.md) [![License](https://img.shields.io/badge/License-Apache%202.0-orange.svg?style=flat-square)](./LICENSE) [![MCP Spec](https://img.shields.io/badge/MCP%20Spec-2025--11--25-8A2BE2.svg?style=flat-square)](https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/docs/specification/2025-11-25/changelog.mdx)
 
 [![MCP SDK](https://img.shields.io/badge/MCP%20SDK-^1.30.0-green.svg?style=flat-square)](https://modelcontextprotocol.io/) [![TypeScript](https://img.shields.io/badge/TypeScript-^7.0.2-3178C6.svg?style=flat-square)](https://www.typescriptlang.org/) [![Bun](https://img.shields.io/badge/Bun-v1.3.0%2B-blueviolet.svg?style=flat-square)](https://bun.sh/)
 

README.md

@@ -0,0 +1,28 @@
+---
+summary: "Server-initiated requests survive the stateful HTTP request boundary, so ctx.elicit completes over Streamable HTTP instead of stranding the handler; init scaffolds the .github community-health files."
+breaking: false
+security: false
+agent-notes: |
+  An `init` run — including in place, since `init` only skips files that already
+  exist — now writes `.github/CONTRIBUTING.md`, `CODE_OF_CONDUCT.md`, and
+  `SECURITY.md`. `SECURITY.md` ships a `[your-contact-email]` placeholder and
+  `CONTRIBUTING.md` a commented-out PR-policy line; fill both in.
+---
+
+# 0.11.5 — 2026-08-12
+
+## Added
+
+- **`.github/` community-health files scaffold with `init`** — `CONTRIBUTING.md`, `CODE_OF_CONDUCT.md`, and `SECURITY.md` under `templates/.github/`, alongside the issue forms already there. This repo gains its own two and enables blank issues, so a report fitting neither form has a path.
+
+## Changed
+
+- **`changelog/template.md`'s authoring guide states the length ceiling** — bullet shape, ~40 words or two sentences, a list of what to cut, and a worked example of the same fact at both sizes. `templates/changelog/template.md` mirrors it and `git-wrapup` 1.10 carries the matching tone rule.
+- **`api-canvas` 2.1** — the dataframe trio ships together wherever canvas is integrated: `dataframe_query` and `dataframe_describe` are both required, and `dataframe_drop` is opt-in behind a server env var, registered via `disabledTool()` while the flag is off.
+- **`design-mcp-server` 2.21** — a server name must not overclaim breadth on either axis (one provider's API is not aggregation; one jurisdiction belongs in the name), and the tool prefix is a separate identifier that a later repo rename need not move.
+- **`bun run test:package` typechecks, builds, and tests a scaffold installed from the packed tarball**, offline, so an undeclared template import can no longer resolve through the repository. A packaging test also pins `--omit=peer` onto both Dockerfiles' production install and OTEL add.
+
+## Fixed
+
+- **`ctx.elicit` completes over stateful Streamable HTTP.** Server-initiated requests now carry a session-unique wire ID registered on the `SessionStore`, so a response arriving on a later POST reaches the `Server` awaiting it rather than the fresh per-request instance handling that POST.
+- **A terminated or stale HTTP session settles its pending server requests** with a `ConnectionClosed` error, instead of leaving the handler awaiting a response that can no longer arrive.

changelog/0.11.x/0.11.5.md

@@ -1,6 +1,6 @@
 {
   "name": "@cyanheads/mcp-ts-core",
-  "version": "0.11.4",
+  "version": "0.11.5",
   "mcpName": "io.github.cyanheads/mcp-ts-core",
   "description": "Agent-native TypeScript framework for building MCP servers. Declarative definitions with auth, multi-backend storage, OpenTelemetry, and first-class support for Bun/Node/Cloudflare Workers.",
   "files": [

docs/tree.md

@@ -6,14 +6,14 @@
     "url": "https://github.com/cyanheads/mcp-ts-core",
     "source": "github"
   },
-  "version": "0.11.4",
+  "version": "0.11.5",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@cyanheads/mcp-ts-core",
       "runtimeHint": "bun",
-      "version": "0.11.4",
+      "version": "0.11.5",
       "packageArguments": [
         {
           "type": "positional",
@@ -42,7 +42,7 @@
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@cyanheads/mcp-ts-core",
       "runtimeHint": "bun",
-      "version": "0.11.4",
+      "version": "0.11.5",
       "packageArguments": [
         {
           "type": "positional",