[timeleft--]

Moves the tic-tac-toe game to the saga a2ui 1.0 release candidate, installed from npm next.

Changes

• @saga-a2ui/react-mcp-stack 0.11.0-rc.1 → 1.0.0-rc.1. All five SDK packages resolve to 1.0.0-rc.1 from the registry, and the lockfile records their integrity.
• @modelcontextprotocol/server and client go to 2.4.0, the versions the stack pins, so the server and the SDK share one copy.
• The root overrides add dompurify 3.4.17 and @hono/node-server 2.1.5, as the SDK's installation guide asks.
• The surface and catalog schemas use the stack's z3 (A2UI's Zod 3). Tool schemas keep zod 4.
• The board view is served at its contract major, operationViewFromHtml({ ..., major: 1 }). Its address is ui://views/<file>.v1.html, so a compatible redeploy keeps the address that hosts already hold.

The game credit still links to the published tutorial; the versioned docs move with 1.0.0.

Checks

npm run check: brand and icon checks, typecheck, game tests (45), worker tests (16), Playwright (15) and the Wrangler dry-run build all pass.

🤖 Generated with Claude Code

[yia-mw-agent]

Helmet-Review-Request: #8 (comment)

Reviewed the full merge-base (b0c49cb, current main) to head diff at 7c66211. The head moved from the queued a5295c1 while the request was pending: I checked out a5295c1 first, then reviewed the extra commit (7c66211, a one-line fix to guided-change/move-list.patch) and the whole PR at 7c66211.

No material defects.

What I checked

• Manifests and lockfile agree: react-mcp-stack 1.0.0-rc.1, MCP server and client 2.4.0, and the dompurify and @hono/node-server overrides. All five SDK packages resolve to 1.0.0-rc.1 from the npm registry with integrity hashes, and npm ci succeeds.
• The z to z3 rename in src/surface.ts and src/catalog.tsx is complete and consistent. Tool schemas keep zod 4. Typecheck passes.
• operationViewFromHtml({ ..., major: 1 }) in server/operations.ts matches the described ui://views/<file>.v1.html address.
• The second commit's z3 change keeps move-list.patch applying: git apply --check is clean in apps/tic-tac-toe/game.
• Game tests 45/45, worker tests 16/16, and the Wrangler dry-run build all pass at 7c66211.

Environment limit

• The reviewer host has no git-lfs, so the dragon PNGs were LFS pointer files. The 10 card.spec.ts icon-digest tests failed on that account, and the other 5 browser tests passed. The failures are all comparisons against ICON_DIGESTS, and this PR touches no icons, .gitattributes or digests. I treat them as environmental, not as a defect in this PR. I also did not run the icon check or the 15-test Playwright suite with real icons.

Non-blocking

• README.md still says the latest tag is "an earlier release". Once 1.0.0 is promoted, that sentence will need a revisit.
• npm ci reports 9 high-severity advisories. I did not compare them with main, so this is not a finding against the PR.

[yia-mw-agent]

Reviewed the complete merge-base-to-head diff (base main, merge-base b0c49cb, 8 files) at 7c66211, the live head at start and before submitting. No material defects.

Findings:

• The SDK move to 1.0.0-rc.1 is consistent across root and game manifests and the lockfile. All five @saga-a2ui packages resolve to 1.0.0-rc.1 from the registry with integrity hashes; @modelcontextprotocol/server and client are 2.4.0 and deduped with the stack. npm ls shows the dompurify 3.4.17 and @hono/node-server 2.1.5 overrides applied.
• The z to z3 change in src/catalog.tsx and src/surface.ts is complete for surface and catalog schemas. Tool schemas keep zod 4, and typecheck passes.
• major: 1 in server/operations.ts matches the PR description. The move-list.patch context line is updated to match z3.
• The README version statement is updated to match.

Validation run on the exact head:

• npm ci, brand check, icon check (with the real LFS icons fetched; digests match), typecheck, game tests 45/45, worker tests 16/16, Playwright 15/15, Wrangler dry-run build: all pass.
• The PR's CI check (Pointers, types, Workers tests and build) passes.

Non-blocking notes:

• The README says the latest tag is an earlier release. Revisit that wording when 1.0.0 ships.
• npm audit reports 9 high-severity advisories. I did not compare them with main, so I cannot say whether this PR changes them.

Helmet-Review-Request: #8 (comment)