go-live 3/9: lock the v1 dist-tag and deprecate all four packages on npm #1816

Phase 3 of 9 in the v2 go-live runbook — see #1804 (§1, §3). Depends on phase 2. Mostly reversible.

Close the two npm-side traps left open by the 1.0.1 publish.

Status: complete. See the corrections note below — the runbook's v1 tag name and <=1.0.0 range were both wrong.

Tasks

⚠️ Two corrections found while executing this phase.

1. The tag is v1-latest, not v1. npm rejects any dist-tag that parses
   as a SemVer range, and v1 parses as 1.x
   (npm error Tag name must not be a valid SemVer range: v1). This bit
   twice — npm dist-tag add failed, and the --tag v1 merged in chore: pin v1 publishes to the v1 dist-tag #1828 would
   have made the next v1 security release fail to publish outright, at
   release time. Fixed in fix: v1 dist-tag must be v1-latest — npm rejects v1 #1829.
2. The sub-package range is <2.0.0, not <=1.0.0. That range was
   written before phase 2 published 1.0.1 to all three sub-packages, so it
   would have left the version latest resolves to — the one everyone
   installs — un-deprecated.

• --tag v1-latest on v1/main's publish-all (covers the root and, via --workspaces, the three sub-packages). chore: pin v1 publishes to the v1 dist-tag #1828 + fix: v1 dist-tag must be v1-latest — npm rejects v1 #1829.
• Escape hatch: v1-latest → 1.0.1 on all four names, so npm i @modelcontextprotocol/<pkg>@v1-latest resolves consistently and the deprecation message points somewhere real.
• npm deprecate all four names at @<2.0.0. Safe for the sub-packages — no 2.x will ever exist for them, since v2 ships only the root package.

Why --tag v1 is the one to not forget

publish-all has no --tag, so npm assigns latest to whatever it publishes. Once 2.0.0 is out, a 1.0.2 security fix from v1/main would move latest back to 1.0.2 — every npx @modelcontextprotocol/inspector in the world silently reverts to deprecated v1. Nothing enforces this flag, and the cost of forgetting surfaces months later.

The three sub-packages (inspector-client, inspector-server, inspector-cli) are permanently orphaned at 1.0.0 with a live latest tag — v2 publishes only the root package. Without deprecation, people keep installing packages that will never update again.

npm deprecate is retroactive-but-mutable (liftable with an empty message), so it is the reversible step here.