fix(build): copy schema.json to dist and externalize zod#534
Merged
Conversation
Two packaging bugs: 1. The './schema.json' export pointed to dist/src/generated/schema.json but nothing copied it there (tsc is emitDeclarationOnly, Bun.build doesn't emit JSON). Consumers got ERR_MODULE_NOT_FOUND. Fix: cpSync after tsc runs. 2. zod is a peerDependency but was bundled into every entry point (~270KB each). This causes dual-instance bugs where consumer-side 'instanceof ZodError' and schema.extend() break across boundaries. Fix: add zod to external list for all non-with-deps entries. Bundle size impact: app.js 293952 -> 24561 (-91.6%) app-bridge.js 299517 -> 30112 (-89.9%) react/index.js 295558 -> 26153 (-91.2%) server/index.js 291500 -> 22135 (-92.4%) app-with-deps 321814 -> 321814 (unchanged, intentional)
@modelcontextprotocol/ext-apps
@modelcontextprotocol/server-basic-preact
@modelcontextprotocol/server-basic-react
@modelcontextprotocol/server-basic-solid
@modelcontextprotocol/server-basic-svelte
@modelcontextprotocol/server-basic-vanillajs
@modelcontextprotocol/server-basic-vue
@modelcontextprotocol/server-budget-allocator
@modelcontextprotocol/server-cohort-heatmap
@modelcontextprotocol/server-customer-segmentation
@modelcontextprotocol/server-debug
@modelcontextprotocol/server-map
@modelcontextprotocol/server-pdf
@modelcontextprotocol/server-scenario-modeler
@modelcontextprotocol/server-shadertoy
@modelcontextprotocol/server-sheet-music
@modelcontextprotocol/server-system-monitor
@modelcontextprotocol/server-threejs
@modelcontextprotocol/server-transcript
@modelcontextprotocol/server-video-resource
@modelcontextprotocol/server-wiki-explorer
commit: |
jonathanhefner
approved these changes
Mar 6, 2026
ochafik
added a commit
that referenced
this pull request
Mar 6, 2026
The react-with-deps build entry was introduced in PR #221 (e078250) as a sibling to app-with-deps for CDN/unpkg no-bundler use. But its external array was duplicated without editing — it never dropped @modelcontextprotocol/sdk from externals, so it has shipped byte-identical to ./react for 10 releases (v0.3.1 → v1.2.0). After #534 merged, both entries use ['react', 'react-dom', ...PEER_EXTERNALS] — still identical, just smaller. Delete rather than fix: React apps always use a bundler; the CDN/unpkg use case (HTML-string apps like qr-server) doesn't apply to React hooks. Zero consumers verified (examples/docs/tests/plugins).
ochafik
added a commit
that referenced
this pull request
Mar 10, 2026
#539) * chore: remove dead ./react-with-deps export (copy-paste bug from #221) The react-with-deps build entry was introduced in PR #221 (e078250) as a sibling to app-with-deps for CDN/unpkg no-bundler use. But its external array was duplicated without editing — it never dropped @modelcontextprotocol/sdk from externals, so it has shipped byte-identical to ./react for 10 releases (v0.3.1 → v1.2.0). After #534 merged, both entries use ['react', 'react-dom', ...PEER_EXTERNALS] — still identical, just smaller. Delete rather than fix: React apps always use a bundler; the CDN/unpkg use case (HTML-string apps like qr-server) doesn't apply to React hooks. Zero consumers verified (examples/docs/tests/plugins). * fix: bundle SDK+zod in react-with-deps (keep React external) Reverts the deletion from the previous commit and applies the actual fix. The react-with-deps external array was copy-pasted in PR #221 without dropping PEER_EXTERNALS — now it mirrors app-with-deps: bundles @modelcontextprotocol/sdk + zod for CDN/import-map consumers. React and react-dom MUST remain external — bundling them would cause dual-React-instance hooks errors. Consumer provides them via import map. Before: index.js 26KB == react-with-deps.js 26KB (identical MD5) After: index.js 26KB != react-with-deps.js 323KB (SDK+zod bundled)
ochafik
added a commit
that referenced
this pull request
Mar 10, 2026
Changes since 1.2.0: - fix: bundle SDK+zod in react-with-deps (was byte-identical to ./react) (#539) - fix(build): copy schema.json to dist and externalize zod (#534) - fix: skip debug log for high-frequency tool-input-partial notifications (#546) - fix(deps): drop @hono/node-server override to patch GHSA-wc8c-qw6v-h7f6 (#535) - fix(readme): use picture element for theme-aware logo (#545) - fix(ci): require maintainer association for /update-snapshots trigger (#532) - fix: pre-commit stages only originally-staged files; add .npmrc (#538) - ci: use npm ci with caching, validate typedoc links, align Node versions (#533) - test: exclude screenshot-gen from default E2E run; wire pdf-server tests (#537)
ochafik
pushed a commit
that referenced
this pull request
Mar 10, 2026
The generated schemas compose with schemas imported from
@modelcontextprotocol/sdk/types.js (e.g. z.array(ContentBlockSchema)).
The SDK constructs its schemas via `import * as z from 'zod/v4'`, but
our generated schema.ts used `import { z } from "zod"` — which returns
the v3 API when the consumer has zod 3.25.x installed.
Mixing v3-created and v4-created schema instances throws at parse time
with errors like `keyValidator._parse is not a function` because zod v4
dropped the `_parse` / `_parseSync` internals that v3 wrappers call.
This was masked before #534 because zod was bundled — all schema
creation shared the same inlined zod copy. Externalizing zod exposed
the mismatch on consumers pinned to zod 3.x (e.g. anthropics/apps).
The `zod/v4` subpath is exported by both zod 3.25+ and zod 4.x, so the
existing peerDependency range `^3.25.0 || ^4.0.0` is preserved.
https://claude.ai/code/session_013xQUegrvVGct5xpqeSL5av
ochafik
added a commit
that referenced
this pull request
Mar 10, 2026
The generated schemas compose with schemas imported from
@modelcontextprotocol/sdk/types.js (e.g. z.array(ContentBlockSchema)).
The SDK constructs its schemas via `import * as z from 'zod/v4'`, but
our generated schema.ts used `import { z } from "zod"` — which returns
the v3 API when the consumer has zod 3.25.x installed.
Mixing v3-created and v4-created schema instances throws at parse time
with errors like `keyValidator._parse is not a function` because zod v4
dropped the `_parse` / `_parseSync` internals that v3 wrappers call.
This was masked before #534 because zod was bundled — all schema
creation shared the same inlined zod copy. Externalizing zod exposed
the mismatch on consumers pinned to zod 3.x (e.g. anthropics/apps).
The `zod/v4` subpath is exported by both zod 3.25+ and zod 4.x, so the
existing peerDependency range `^3.25.0 || ^4.0.0` is preserved.
https://claude.ai/code/session_013xQUegrvVGct5xpqeSL5av
Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two focused packaging fixes in
build.bun.ts.Bug 1:
./schema.jsonexport was brokenpackage.jsonexports"./schema.json": "./dist/src/generated/schema.json"but nothing copied the file there —tscisemitDeclarationOnlyandBun.builddoesn't emit JSON assets. Consumers importing@modelcontextprotocol/ext-apps/schema.jsongotERR_MODULE_NOT_FOUND.Fix:
cpSyncthe file aftertscruns.Bug 2:
zodbundled despite being a peerDependencyzodis declared as a peer inpackage.jsonbut was absent from everyexternallist inbuild.bun.ts, so it was bundled into every entry point. This causes dual-instance bugs: consumer-sideinstanceof ZodErrorchecks andschema.extend()calls break when operating across two separate zod runtimes.Fix: Add
zodto theexternallist for all non-*-with-depsentries.app-with-depsintentionally bundles everything and is left unchanged.Bundle size impact
app.jsapp-bridge.jsreact/index.jsserver/index.jsapp-with-deps.jsTotal shipped JS: ~1.50 MB → ~0.42 MB
Verification