release: promote TypeMCP 0.2.2 examples remediation

.github/workflows/release-promotion.yml

@@ -0,0 +1,23 @@
+name: Release promotion
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  release-promotion:
+    name: release-promotion
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require dev as the promotion source
+        run: test "${{ github.head_ref }}" = "dev"
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: npm run check

.github/workflows/verify.yml

@@ -25,3 +25,4 @@ jobs:
       - run: npm run example:policy
       - run: npm run example:typemcp
       - run: npm run example:bridge
+      - run: npm run audit:prod

README.md

@@ -30,19 +30,24 @@ These examples show declaration and adapter boundaries, not a full hosted applic
 - The bridge is in-process only. It adapts a decorated TypeMCP class to LangChain tools; it does not create an MCP client or network connection.
 - No model provider is configured. Add a model only in your application after deciding its credentials, authorization, and runtime policy.
 
+## Dependency-security boundary
+
+These examples use the published `@theorvane/type-mcp@^0.2.2` remediation. Its consumer-enforceable dependency contract resolves `@modelcontextprotocol/sdk@1.30.0` and `@hono/node-server@2.0.12`; `npm run audit:prod` verifies the installed production graph with no local npm override.
+
 ## Development
 
 ```bash
 npm run lint
 npm run build
 npm test
+npm run audit:prod
 npm run check
 ```
 
 ## Packages
 
 - [`@theorvane/type-chain`](https://www.npmjs.com/package/@theorvane/type-chain) `0.1.1`
-- [`@theorvane/type-mcp`](https://www.npmjs.com/package/@theorvane/type-mcp) `0.2.0`
+- [`@theorvane/type-mcp`](https://www.npmjs.com/package/@theorvane/type-mcp) `0.2.2` or later within the `0.2.x` range
 
 ## License
 

package.json

@@ -8,8 +8,9 @@
 		"node": ">=20"
 	},
 	"scripts": {
+		"audit:prod": "npm audit --omit=dev --audit-level=low",
 		"build": "tsc --noEmit",
-		"check": "npm run format:check && npm run build && npm test",
+		"check": "npm run format:check && npm run build && npm test && npm run audit:prod",
 		"example:typechain": "tsx examples/typechain-tool-definition.ts",
 		"example:policy": "tsx examples/typechain-policy-guard.ts",
 		"example:typemcp": "tsx examples/typemcp-server-definition.ts",
@@ -22,7 +23,7 @@
 	"dependencies": {
 		"@langchain/core": "^1.2.3",
 		"@theorvane/type-chain": "^0.1.1",
-		"@theorvane/type-mcp": "^0.2.0",
+		"@theorvane/type-mcp": "^0.2.2",
 		"langchain": "^1.5.4",
 		"zod": "^4.4.3"
 	},

test/dependency-security.test.ts

@@ -0,0 +1,33 @@
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { describe, expect, it } from "vitest";
+
+const repositoryRoot = resolve(fileURLToPath(new URL("..", import.meta.url)));
+
+type Lockfile = {
+	readonly packages: Record<string, { readonly version?: string }>;
+};
+
+describe("production dependency security", () => {
+	it("uses the published TypeMCP remediation without a local override", () => {
+		const packageJson = JSON.parse(
+			readFileSync(resolve(repositoryRoot, "package.json"), "utf8"),
+		) as {
+			readonly dependencies?: {
+				readonly "@theorvane/type-mcp"?: string;
+			};
+		};
+		const lockfile = JSON.parse(
+			readFileSync(resolve(repositoryRoot, "package-lock.json"), "utf8"),
+		) as Lockfile;
+
+		expect(packageJson.dependencies?.["@theorvane/type-mcp"]).toBe("^0.2.2");
+		expect(
+			lockfile.packages["node_modules/@modelcontextprotocol/sdk"]?.version,
+		).toBe("1.30.0");
+		expect(lockfile.packages["node_modules/@hono/node-server"]?.version).toBe(
+			"2.0.12",
+		);
+	});
+});