Release v1.2.0: post search, Markdown bodies, client hardening

[dkships]

Summary

• Adds search_posts. The Publisher API spec has a full-text /posts/search endpoint the server never wrapped.
• get_post returns the body as Markdown by default. Substack sends a JSON-encoded ProseMirror string (42KB on one sampled post vs 16KB as Markdown). bodyFormat: "prosemirror" keeps the old output; "none" returns metadata only.
• Fixes found by running the server against mocks and the live API:
  • Network failures now say why (DNS, refused) instead of fetch failed.
  • API keys are redacted from error text, including when a truncated body would cut a key in half.
  • Cancelled tool calls abort the request instead of running to the 30s timeout.
  • Env vars that map to the same publication name no longer register twice.
  • 2026-13-45 dates and .. slugs are rejected before they hit the API.
• Tool results are compact JSON, about half the tokens.
• Tool descriptions match live responses: list_posts endDate is exclusive, next is null on the last page, and subscriber counts have no free field.
• Requires Node 22+ (18 and 20 are EOL). CI runs 22 and 24 on setup-node@v7. SDK 1.30.0 passes the runtime audit, so this supersedes Bump the minor-and-patch group across 1 directory with 4 updates #15 and Bump actions/setup-node from 6 to 7 #13.

Write endpoints in the spec (subscriber import, comp subscriptions) are left out on purpose. The server stays read-only.

Type of change

• Bug fix
• New feature
• Docs
• Security / dependency update

Checklist

• npm run build passes locally
• npm audit shows no high/critical advisories
• Tested against a real Substack Publisher API key (all 7 tools over stdio)
• CHANGELOG.md updated
• No API keys, subscriber data, or .env contents in the diff or description

🤖 Generated with Claude Code