v2.0.0 — MCP SDK Upgrade, Zod 4, Express 5, Circuit Breakers

What's Changed

Breaking Changes (Internal)

• MCP SDK 1.26.0 → 1.27.1 with registerTool/registerPrompt/registerResource APIs (v2-ready)
• Zod 3.22.4 → 4.3.6 (required for MCP SDK v2 compatibility)
• Express 4.18.2 → 5.2.1 (async error handling, deprecated method removal)
• SSE transport deprecated → Streamable HTTP (/mcp) is now the primary transport

New Features

• Circuit breaker state machine (CLOSED/OPEN/HALF_OPEN) on OpenRouter API, PGlite DB, and embedding calls
• Exponential backoff with jitter via withRetry() utility
• Model tier fallback when circuits trip (HIGH_COST → LOW_COST → VERY_LOW_COST)
• Prompt registration via server.registerPrompt() (3 prompts)
• Resource registration via server.registerResource() (9 resources)
• z.object() auto-wrapping in tool registration for SDK v2 compatibility

Bug Fixes

• PGlite multi-statement SQL in fallback initialization path (job_events, tool_observations, graph_nodes, graph_edges)
• Corrupted ~/.zero/db recovery
• Critical npm audit vulnerabilities (fast-xml-parser RangeError DoS, axios prototype pollution, tar hardlink traversal)
• Zod 4 z.record() single-argument breaking change
• Zod 4 .default({}) nested schema resolution via pipe pattern

Dependencies

Package	Before	After
@modelcontextprotocol/sdk	1.26.0	1.27.1
zod	3.22.4	4.3.6
express	4.18.2	5.2.1
@electric-sql/pglite	0.3.14	0.3.14 (unchanged)

Test Results

• 37 unit tests passing (23 core + 14 config)
• 17 circuit breaker tests passing
• MCP STDIO protocol verified
• Database initialization verified (primary + fallback paths)

Install: npm install @terminals-tech/openrouter-agents@2.0.0

Full Changelog: v1.16.0...v2.0.0