[timeleft--]

Moves Ansari from SAGA 1.0.0-rc.1 to the stable 1.0.x release on npm.

Change

• The stack @saga-a2ui/react-mcp-stack is pinned to 1.0.1. It pins its siblings at their own exact versions: core, components and react at 1.0.0, and mcp at 1.0.2.
• Independent versions. SAGA now versions its packages independently, so Ansari's "one SAGA version" rule is replaced. Every SAGA package must resolve to exactly the version its dependents pin, and the stack must resolve to the direct pin.
  • scripts/check-release.mjs reads those pins from the lockfile's snapshots.
  • test/packaging.test.ts checks each package's npm version and integrity (read with npm view), the exact pins in the installed tree, and per-package licence notices.
  • A new release test covers independently versioned siblings. It fails under the previous rule.
• Also: app version 0.17.2, and the README and walkthrough describe the install.

What 1.0.x brings

• major is now required on views (Ansari already passes major: 1), and the stacks no longer export z (Ansari never used it).
• A request body over the 4 MiB limit now gets a readable 413 when a Node client talks to the Node listener directly.

Verification

• pnpm install --frozen-lockfile --strict-peer-dependencies --filter ansari-mcp... succeeds, and the lockfile records the npm integrity of all five packages.
• pnpm mcp verify passes: lint, typecheck, 146 tests and 78 browser checks.
• bash apps/mcp/scripts/verify-container.sh passes; the container serves ui://views/answer-card.v1.html.
• pnpm check:release passes for dev, beta and production, verifying all five packages against the npm registry.
• A 4 MiB tools/call gets 413 Payload Too Large on both the modern and the older-host path, from the built Node server.

🤖 Generated with Claude Code

[yia-mw-agent]

Helmet-Review-Request: #15 (comment)

Reviewed the full merge-base-to-head diff (base develop at 5904323 = merge-base, 8 files) at f34b552, which was also the live head at start and before submitting. No material defects.

What I checked:

• Pins: package.json pins the stack at 1.0.1; the lockfile resolves core/components/react 1.0.0 and mcp 1.0.2, each with registry integrity. apps/mcp/src/version.ts and package.json agree on 0.17.2. No stale 0.17.1 or 1.0.0-rc.1 reference remains outside historical test fixtures.
• check-release.mjs: the per-package uniqueness check, the owner-to-sibling pin check via sagaPins (parses the real snapshot entries, including peer suffixes) and the stack-vs-direct-pin check are correct. The old one-version rule is replaced rather than weakened: a skewed pin or a second resolved version still fails.
• Tests: packaging.test.ts expected versions and integrity match the lockfile; release.test.ts adds the independent-siblings case and updates the wrong-pin message match.
• Docs: README and walkthrough text match the new pins.

Validation run locally on the exact head:

• pnpm install --frozen-lockfile --strict-peer-dependencies --filter ansari-mcp... succeeded.
• apps/mcp: lint, typecheck and pnpm test all pass (146/146).
• node scripts/check-release.mjs --target dev|beta|production all pass, with the registry verified for all five packages on beta and production.
• GitHub checks "MCP application" and "gitleaks" are SUCCESS.

Non-blocking: I did not rerun the browser suite or the container smoke test locally; the PR reports them and the CI "MCP application" check passed.