refactor: replace yup and front-matter, upgrade MCP to 2.x

[yanglbme]

Summary

Replace a few outdated dependencies and tighten types. Follow-up commit restores form validation and front-matter fallbacks found in review.

• Form validation uses shared Zod instead of yup / @vee-validate/yup, wrapped with a local toTypedSchema (__type: 'VVTypedSchema') so vee-validate still shows field errors on blur and submit.
• YAML front matter is parsed locally with js-yaml. Markdown * lists are treated as sequences; invalid YAML keeps the original document instead of stripping the fence.
• MCP server moves from @modelcontextprotocol/sdk 1.x to @modelcontextprotocol/server 2.0.0.
• $cose and Qiniu region no longer rely on any; tokenTools uses TextEncoder + btoa while keeping the public API.
• Upload dialog adds a DialogDescription (a11y). Changelog records Vite 8; custom-upload docs prefer fetch and call out axios / CryptoJS / Buffer as compatibility aliases.

Type of Change

• Bug fix
• New feature
• Breaking change
• Refactor
• Documentation
• Workflow / tooling

Test Procedure

• pnpm run type-check (web + core/shared/api/mcp + vscode)
• pnpm web build
• pnpm vscode build
• pnpm --filter @md/web exec vitest run src/lib/form-schema.test.ts
• pnpm --filter @md/core exec vitest run src/utils/front-matter.test.ts
• Open an image-host form: leave a required field empty, Tab away — the field should show an error (no ZodError in the console)
• Confirm YAML front matter with tags: + * item still extracts metadata
• Confirm broken YAML between --- fences still appears in the preview body
• If you use custom upload scripts: util.tokenTools.utf16to8 / base64encode / safe64 names are unchanged (emoji HMAC may differ from the old CESU-8 encoder)

Pre-flight Checklist

• Type-check and package builds pass locally
• Public custom-upload docs updated where aliases could confuse users
• No secrets committed
• CI is green

[github-actions]

🚀 Cloudflare Workers Preview has been successfully deployed!

Preview URL: https://md-pr-1927.doocs.workers.dev

_{Built with commit 08fc9a6}

[github-actions]

🚀 Surge Preview has been successfully deployed!

Preview URL: https://doocs-md-preview-pr-1927.surge.sh

_{Built with commit 08fc9a6}

[Copilot]

Pull request overview

This PR refactors several dependency integrations across the monorepo to remove/unblock older packages and tighten typing, primarily in the web app’s form validation, the core renderer’s front-matter handling, and the MCP server package.

Changes:

• Replaces yup + @vee-validate/yup form schemas with shared Zod helpers (requiredString / optionalString) across multiple web dialogs.
• Removes front-matter in @md/core and adds a local js-yaml-based YAML front matter parser + tests.
• Migrates @md/mcp-server from @modelcontextprotocol/sdk 1.x to @modelcontextprotocol/server 2.x and updates Zod schema wiring.

Reviewed changes

Copilot reviewed 33 out of 35 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
pnpm-workspace.yaml	Removes overrides/patch entries tied to removed deps; adds zod to catalog.
pnpm-lock.yaml	Lockfile updates reflecting dependency migrations (yup/front-matter/sdk removal; zod/js-yaml additions).
patches/front-matter@4.0.2.patch	Deletes patch for removed front-matter dependency.
packages/shared/src/utils/tokenTools.ts	Replaces legacy UTF/base64 implementation with TextEncoder + btoa while keeping public API.
packages/shared/src/utils/tokenTools.test.ts	Adds byte-identity tests vs legacy implementation (Qiniu token compatibility).
packages/mcp-server/src/index.ts	Updates MCP server imports and converts input schema definition to a Zod object.
packages/mcp-server/package.json	Switches MCP dependency to @modelcontextprotocol/server and uses catalog Zod.
packages/core/src/utils/front-matter.ts	Adds local YAML front-matter parsing via js-yaml.
packages/core/src/utils/front-matter.test.ts	Adds tests for YAML fence parsing, CRLF/BOM, and non-object YAML docs.
packages/core/src/renderer/renderer.test.ts	Updates renderer test to assert returned YAML data from front matter parsing.
packages/core/src/renderer/renderer-impl.ts	Replaces front-matter usage with new parseFrontMatter helper.
packages/core/package.json	Removes front-matter; adds js-yaml + @types/js-yaml.
docs/custom-upload.md	Updates examples to prefer fetch and clarifies compatibility aliases.
CHANGELOG.md	Updates Vite version mention from v7 to v8.
apps/web/src/types/global.d.ts	Tightens window globals typing (e.g., $cose, __MP_Editor_JSAPI__) and converts to module augmentation style.
apps/web/src/types/cose.ts	Introduces typed interface for the injected doocs/cose window API.
apps/web/src/services/upload/providers.ts	Removes any cast for Qiniu region by building a typed config object.
apps/web/src/lib/form-schema.ts	Adds shared Zod schema helpers for optional/required strings.
apps/web/src/components/editor/editor-header/PostTaskDialog.vue	Replaces any task status typing with CoseTaskStatus and safer optional chaining.
apps/web/src/components/editor/editor-header/PostInfo.vue	Tightens $cose usage and avoids any platform mapping.
apps/web/src/components/editor/dialogs/upload-providers/*.vue	Migrates upload-provider validation schemas from yup to Zod.
apps/web/src/components/editor/dialogs/upload-providers/UploadProviderForm.vue	Loosens validationSchema prop typing and forwards schema into vee-validate Form.
apps/web/src/components/editor/dialogs/MpAccountConfigDialog.vue	Migrates schema to Zod and parses submit values with Zod.
apps/web/src/components/editor/dialogs/MarketplaceDialog.vue	Migrates marketplace publish form schema to Zod.
apps/web/package.json	Removes yup deps and adds Zod (catalog).

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

🗑️ Cloudflare Workers preview deployment has been cleaned up.