@cyanheads/mcp-ts-core 0.11.5 → 0.12.1

package/templates/AGENTS.md

@@ -4,7 +4,7 @@
 **Version:** 0.1.0
 **Framework:** [@cyanheads/mcp-ts-core](https://www.npmjs.com/package/@cyanheads/mcp-ts-core) `^{{FRAMEWORK_VERSION}}`
 **Engines:** Bun ≥1.3.0, Node ≥24.0.0
-**MCP SDK:** `@modelcontextprotocol/sdk` {{MCP_SDK_VERSION}}
+**MCP SDK:** `@modelcontextprotocol/server` {{MCP_SDK_VERSION}}
 **Zod:** {{ZOD_VERSION}}
 
 > **Read the framework docs first:** `node_modules/@cyanheads/mcp-ts-core/CLAUDE.md` contains the full API reference — builders, Context, error codes, exports, patterns. This file covers server-specific conventions only.
@@ -48,7 +48,7 @@ Tailor suggestions to what's actually missing or stale — don't recite the full
 - **Logic throws, framework catches.** Tool/resource handlers are pure — throw on failure, no `try/catch`. Plain `Error` is fine; the framework catches, classifies, and formats. Use error factories (`notFound()`, `validationError()`, etc.) when the error code matters.
 - **Use `ctx.log`** for request-scoped logging. No `console` calls.
 - **Use `ctx.state`** for tenant-scoped storage. Never access persistence directly.
-- **Check `ctx.elicit`** for presence before calling.
+- **Need input the caller didn't supply?** `return ctx.requestInput(...)` and read `ctx.inputs` when the handler is re-entered. Never `await` for user input mid-handler.
 - **Secrets in env vars only** — never hardcoded.
 - **Close the loop on issues.** When implementing work tracked by a GitHub issue, comment on the issue with what landed and close it. Do both — a comment without a close leaves stale issues open; a close without a comment leaves no record of what shipped. The comment is for future readers — state the concrete changes, not the conversation that produced them.
 
@@ -181,13 +181,13 @@ Handlers receive a unified `ctx` object. Key properties:
 
 | Property | Description |
 |:---------|:------------|
-| `ctx.log` | Request-scoped logger — `.debug()`, `.info()`, `.notice()`, `.warning()`, `.error()`. Auto-correlates requestId, traceId, tenantId. |
+| `ctx.log` | Request-scoped logger — `.debug()`, `.info()`, `.notice()`, `.warning()`, `.error()`. Auto-correlates requestId, traceId, tenantId. Dual-sink: Pino **and** `notifications/message` to the client, so treat it as client-visible. |
 | `ctx.state` | Tenant-scoped KV — `.get(key)`, `.set(key, value, { ttl? })`, `.delete(key)`, `.getMany(keys)`, `.list(prefix, { cursor, limit })`. Accepts any serializable value. |
-| `ctx.elicit` | Ask user for structured input — form call `(message, schema)` or `.url(message, url)` for an external link. **Check for presence first:** `if (ctx.elicit) { ... }` |
+| `ctx.requestInput` | Suspend and ask the caller for more input — `return ctx.requestInput({ inputRequests: { key: inputRequired.elicit({ message, requestedSchema }) } })`. Never returns; the handler is re-entered with the answers. Always present. |
+| `ctx.inputs` | Reader over a retried request's responses — `.accepted(key, schema)`, `.view(key)`, `.state()`, `.dropped`. Empty on the first round. |
 | `ctx.enrich` | Success-path agent context (empty-result notices, query echo, pagination totals) — `ctx.enrich(...)` or `.notice()` / `.total()` / `.echo()` / `.truncated()`. Reaches `structuredContent` and `content[]`; lands only when the definition declares an `enrichment` block (no-op otherwise). |
 | `ctx.content` | Non-text content blocks — `.image(data, mimeType)`, `.audio(data, mimeType)`, or `ctx.content(block)` for a raw block. Prepended to `content[]` after `format()`; never enters `structuredContent`. |
 | `ctx.signal` | `AbortSignal` for cancellation. |
-| `ctx.progress` | Task progress (present when `task: true`) — `.setTotal(n)`, `.increment()`, `.update(message)`. |
 | `ctx.requestId` | Unique request ID. |
 | `ctx.tenantId` | Tenant ID from JWT; `'default'` for stdio or HTTP with auth off. |
 
@@ -303,7 +303,7 @@ Available skills:
 | `api-auth` | Auth modes, scopes, JWT/OAuth |
 | `api-canvas` | DataCanvas: register tabular data, run SQL, export, plus the `spillover()` helper for big result sets — Tier 3 opt-in |
 | `api-config` | AppConfig, parseConfig, env vars |
-| `api-context` | Context interface, logger, state, progress |
+| `api-context` | Context interface, RequestContext, logger, state, multi-round-trip input |
 | `api-errors` | McpError, JsonRpcErrorCode, error patterns |
 | `api-linter` | Definition linter rule catalog — invoked by `bun run lint:mcp` and `devcheck` |
 | `api-mirror` | MirrorService: persistent self-refreshing local mirror (embedded SQLite + FTS5) of a bulk upstream dataset — Tier 3 opt-in |

package/templates/CLAUDE.md

@@ -4,7 +4,7 @@
 **Version:** 0.1.0
 **Framework:** [@cyanheads/mcp-ts-core](https://www.npmjs.com/package/@cyanheads/mcp-ts-core) `^{{FRAMEWORK_VERSION}}`
 **Engines:** Bun ≥1.3.0, Node ≥24.0.0
-**MCP SDK:** `@modelcontextprotocol/sdk` {{MCP_SDK_VERSION}}
+**MCP SDK:** `@modelcontextprotocol/server` {{MCP_SDK_VERSION}}
 **Zod:** {{ZOD_VERSION}}
 
 > **Read the framework docs first:** `node_modules/@cyanheads/mcp-ts-core/CLAUDE.md` contains the full API reference — builders, Context, error codes, exports, patterns. This file covers server-specific conventions only.
@@ -48,7 +48,7 @@ Tailor suggestions to what's actually missing or stale — don't recite the full
 - **Logic throws, framework catches.** Tool/resource handlers are pure — throw on failure, no `try/catch`. Plain `Error` is fine; the framework catches, classifies, and formats. Use error factories (`notFound()`, `validationError()`, etc.) when the error code matters.
 - **Use `ctx.log`** for request-scoped logging. No `console` calls.
 - **Use `ctx.state`** for tenant-scoped storage. Never access persistence directly.
-- **Check `ctx.elicit`** for presence before calling.
+- **Need input the caller didn't supply?** `return ctx.requestInput(...)` and read `ctx.inputs` when the handler is re-entered. Never `await` for user input mid-handler.
 - **Secrets in env vars only** — never hardcoded.
 - **Close the loop on issues.** When implementing work tracked by a GitHub issue, comment on the issue with what landed and close it. Do both — a comment without a close leaves stale issues open; a close without a comment leaves no record of what shipped. The comment is for future readers — state the concrete changes, not the conversation that produced them.
 
@@ -181,13 +181,13 @@ Handlers receive a unified `ctx` object. Key properties:
 
 | Property | Description |
 |:---------|:------------|
-| `ctx.log` | Request-scoped logger — `.debug()`, `.info()`, `.notice()`, `.warning()`, `.error()`. Auto-correlates requestId, traceId, tenantId. |
+| `ctx.log` | Request-scoped logger — `.debug()`, `.info()`, `.notice()`, `.warning()`, `.error()`. Auto-correlates requestId, traceId, tenantId. Dual-sink: Pino **and** `notifications/message` to the client, so treat it as client-visible. |
 | `ctx.state` | Tenant-scoped KV — `.get(key)`, `.set(key, value, { ttl? })`, `.delete(key)`, `.getMany(keys)`, `.list(prefix, { cursor, limit })`. Accepts any serializable value. |
-| `ctx.elicit` | Ask user for structured input — form call `(message, schema)` or `.url(message, url)` for an external link. **Check for presence first:** `if (ctx.elicit) { ... }` |
+| `ctx.requestInput` | Suspend and ask the caller for more input — `return ctx.requestInput({ inputRequests: { key: inputRequired.elicit({ message, requestedSchema }) } })`. Never returns; the handler is re-entered with the answers. Always present. |
+| `ctx.inputs` | Reader over a retried request's responses — `.accepted(key, schema)`, `.view(key)`, `.state()`, `.dropped`. Empty on the first round. |
 | `ctx.enrich` | Success-path agent context (empty-result notices, query echo, pagination totals) — `ctx.enrich(...)` or `.notice()` / `.total()` / `.echo()` / `.truncated()`. Reaches `structuredContent` and `content[]`; lands only when the definition declares an `enrichment` block (no-op otherwise). |
 | `ctx.content` | Non-text content blocks — `.image(data, mimeType)`, `.audio(data, mimeType)`, or `ctx.content(block)` for a raw block. Prepended to `content[]` after `format()`; never enters `structuredContent`. |
 | `ctx.signal` | `AbortSignal` for cancellation. |
-| `ctx.progress` | Task progress (present when `task: true`) — `.setTotal(n)`, `.increment()`, `.update(message)`. |
 | `ctx.requestId` | Unique request ID. |
 | `ctx.tenantId` | Tenant ID from JWT; `'default'` for stdio or HTTP with auth off. |
 
@@ -303,7 +303,7 @@ Available skills:
 | `api-auth` | Auth modes, scopes, JWT/OAuth |
 | `api-canvas` | DataCanvas: register tabular data, run SQL, export, plus the `spillover()` helper for big result sets — Tier 3 opt-in |
 | `api-config` | AppConfig, parseConfig, env vars |
-| `api-context` | Context interface, logger, state, progress |
+| `api-context` | Context interface, RequestContext, logger, state, multi-round-trip input |
 | `api-errors` | McpError, JsonRpcErrorCode, error patterns |
 | `api-linter` | Definition linter rule catalog — invoked by `bun run lint:mcp` and `devcheck` |
 | `api-mirror` | MirrorService: persistent self-refreshing local mirror (embedded SQLite + FTS5) of a bulk upstream dataset — Tier 3 opt-in |

package/templates/tests/resources/echo.resource.test.ts

@@ -16,15 +16,22 @@ describe('echoResource', () => {
   });
 
   it('lists available resources', async () => {
-    // `list` receives the SDK's request-handler extra, not a Context, and may be
-    // async — a minimal literal is enough for a listing that ignores it.
-    const extra = {
-      signal: new AbortController().signal,
-      requestId: 'test',
-      sendNotification: () => Promise.resolve(),
-      sendRequest: () => Promise.resolve({} as never),
-    };
-    const listing = await echoResource.list!(extra);
+    // `list` receives the SDK's `ServerContext`, not a handler `Context`, and
+    // may be async — a minimal literal is enough for a listing that ignores it.
+    const serverContext = {
+      mcpReq: {
+        id: 'test',
+        method: 'resources/list',
+        signal: new AbortController().signal,
+        requestState: () => undefined,
+        send: () => Promise.resolve({} as never),
+        notify: () => Promise.resolve(),
+        log: () => Promise.resolve(),
+        elicitInput: () => Promise.resolve({ action: 'cancel' as const }),
+        requestSampling: () => Promise.reject(new Error('not supported')),
+      },
+    } as unknown as Parameters<NonNullable<typeof echoResource.list>>[0];
+    const listing = await echoResource.list!(serverContext);
     expect(listing.resources).toHaveLength(1);
     expect(listing.resources[0]).toMatchObject({
       uri: 'echo://hello',

package/dist/mcp-server/elicitation.d.ts

@@ -1,64 +0,0 @@
-/**
- * @fileoverview Shared elicitation plumbing for the tool and resource handler
- * factories.
- * @module src/mcp-server/elicitation
- */
-import type { RequestHandlerExtra } from '@modelcontextprotocol/sdk/shared/protocol.js';
-import { type ElicitRequestFormParams, type ElicitRequestURLParams, type ElicitResult, type ServerNotification, type ServerRequest } from '@modelcontextprotocol/sdk/types.js';
-import { type ZodObject, type ZodRawShape } from 'zod';
-import type { ElicitFn } from '../core/context.js';
-type SdkExtra = RequestHandlerExtra<ServerRequest, ServerNotification>;
-/**
- * The elicitation slice of the tool and resource notifier bundles.
- *
- * `elicitInput` and `getClientCapabilities` are bound at registration time to
- * the per-server `Server` instance so `wrapElicit` can gate `ctx.elicit` on the
- * client's advertised capability and forward elicitation requests on the wire.
- * Both are undefined where no connected client is available (the auto-task
- * background path).
- */
-export interface ElicitationNotifiers {
-    /** Bound to `server.server.elicitInput.bind(server.server)`. */
-    elicitInput?: (params: ElicitRequestFormParams | ElicitRequestURLParams) => Promise<ElicitResult>;
-    /** Bound to `server.server.getClientCapabilities.bind(server.server)`. */
-    getClientCapabilities?: () => {
-        elicitation?: unknown;
-    } | undefined;
-    /** Route elicitation through RequestHandlerExtra.sendRequest on per-request servers. */
-    requestScopedElicitation?: boolean;
-}
-/**
- * Validate an accepted elicitation payload against the schema its request
- * advertised.
- *
- * `Server.elicitInput` runs this check itself, but a per-request HTTP server
- * reaches the client through `RequestHandlerExtra.sendRequest` instead and so
- * bypasses it. Raising the SDK's own `InvalidParams` shape here keeps
- * `ctx.elicit`'s failure contract identical on both transports.
- *
- * @param schema - The Zod object the elicitation request was built from.
- * @param content - The `content` of an `accept` response.
- * @throws {McpError} `InvalidParams` when the payload does not satisfy `schema`.
- */
-export declare function assertElicitedContent(schema: ZodObject<ZodRawShape>, content: unknown): void;
-/**
- * Builds `ctx.elicit` from the notifiers bound at registration time.
- *
- * Returns `undefined` when:
- * - `elicitInput` was not bound (auto-task background path, or no server),
- * - the client did not advertise the elicitation capability (checked at
- *   request time, after the initialize handshake populates capabilities).
- *
- * When defined, the returned function is an `ElicitFn`: directly callable for
- * form-mode elicitation (schema converted from ZodObject to the restricted
- * flat JSON Schema the MCP spec requires), plus a `.url(message, url)` helper
- * for URL-mode elicitation (elicitationId generated internally).
- *
- * CRITICAL: `requestedSchema` must be a plain JSON Schema object in the spec's
- * restricted flat form — passing a raw ZodObject causes AJV validation to
- * reject the request on the SDK side. `z.toJSONSchema(schema)` produces the
- * correct shape.
- */
-export declare function wrapElicit(notifiers: ElicitationNotifiers, sdkContext: SdkExtra): ElicitFn | undefined;
-export {};
-//# sourceMappingURL=elicitation.d.ts.map

package/dist/mcp-server/elicitation.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"elicitation.d.ts","sourceRoot":"","sources":["../../src/mcp-server/elicitation.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,YAAY,EAEjB,KAAK,kBAAkB,EACvB,KAAK,aAAa,EACnB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAgB,KAAK,SAAS,EAAE,KAAK,WAAW,EAAE,MAAM,KAAK,CAAC;AAErE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAGlD,KAAK,QAAQ,GAAG,mBAAmB,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC;AAEvE;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC,gEAAgE;IAChE,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,uBAAuB,GAAG,sBAAsB,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IAClG,0EAA0E;IAC1E,qBAAqB,CAAC,EAAE,MAAM;QAAE,WAAW,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,SAAS,CAAC;IACpE,wFAAwF;IACxF,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,SAAS,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAU5F;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,UAAU,CACxB,SAAS,EAAE,oBAAoB,EAC/B,UAAU,EAAE,QAAQ,GACnB,QAAQ,GAAG,SAAS,CAgCtB"}

package/dist/mcp-server/elicitation.js

@@ -1,81 +0,0 @@
-/**
- * @fileoverview Shared elicitation plumbing for the tool and resource handler
- * factories.
- * @module src/mcp-server/elicitation
- */
-import { ElicitResultSchema, } from '@modelcontextprotocol/sdk/types.js';
-import { toJSONSchema } from 'zod';
-import { invalidParams } from '../types-global/errors.js';
-/**
- * Validate an accepted elicitation payload against the schema its request
- * advertised.
- *
- * `Server.elicitInput` runs this check itself, but a per-request HTTP server
- * reaches the client through `RequestHandlerExtra.sendRequest` instead and so
- * bypasses it. Raising the SDK's own `InvalidParams` shape here keeps
- * `ctx.elicit`'s failure contract identical on both transports.
- *
- * @param schema - The Zod object the elicitation request was built from.
- * @param content - The `content` of an `accept` response.
- * @throws {McpError} `InvalidParams` when the payload does not satisfy `schema`.
- */
-export function assertElicitedContent(schema, content) {
-    const parsed = schema.safeParse(content);
-    if (parsed.success)
-        return;
-    throw invalidParams('Elicitation response content does not match the requested schema.', {
-        reason: 'elicitation_response_invalid',
-        issues: parsed.error.issues.map((issue) => ({
-            path: issue.path.join('.'),
-            code: issue.code,
-        })),
-    });
-}
-/**
- * Builds `ctx.elicit` from the notifiers bound at registration time.
- *
- * Returns `undefined` when:
- * - `elicitInput` was not bound (auto-task background path, or no server),
- * - the client did not advertise the elicitation capability (checked at
- *   request time, after the initialize handshake populates capabilities).
- *
- * When defined, the returned function is an `ElicitFn`: directly callable for
- * form-mode elicitation (schema converted from ZodObject to the restricted
- * flat JSON Schema the MCP spec requires), plus a `.url(message, url)` helper
- * for URL-mode elicitation (elicitationId generated internally).
- *
- * CRITICAL: `requestedSchema` must be a plain JSON Schema object in the spec's
- * restricted flat form — passing a raw ZodObject causes AJV validation to
- * reject the request on the SDK side. `z.toJSONSchema(schema)` produces the
- * correct shape.
- */
-export function wrapElicit(notifiers, sdkContext) {
-    const { elicitInput, getClientCapabilities } = notifiers;
-    if (typeof elicitInput !== 'function')
-        return;
-    // Capability check runs at request time (not registration time) so that
-    // capabilities populated during the initialize handshake are visible.
-    if (!getClientCapabilities?.()?.elicitation)
-        return;
-    const send = (params) => {
-        if (!notifiers.requestScopedElicitation)
-            return elicitInput(params);
-        return sdkContext.sendRequest({ method: 'elicitation/create', params }, ElicitResultSchema);
-    };
-    const formFn = async (msg, schema) => {
-        const requestedSchema = toJSONSchema(schema);
-        const result = await send({ mode: 'form', message: msg, requestedSchema });
-        if (notifiers.requestScopedElicitation && result.action === 'accept' && result.content) {
-            assertElicitedContent(schema, result.content);
-        }
-        return result;
-    };
-    const urlFn = (msg, url) => {
-        const elicitationId = crypto.randomUUID();
-        return send({ mode: 'url', message: msg, elicitationId, url });
-    };
-    const elicitFn = formFn;
-    elicitFn.url = urlFn;
-    return elicitFn;
-}
-//# sourceMappingURL=elicitation.js.map

package/dist/mcp-server/elicitation.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"elicitation.js","sourceRoot":"","sources":["../../src/mcp-server/elicitation.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAIL,kBAAkB,GAGnB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,YAAY,EAAoC,MAAM,KAAK,CAAC;AAGrE,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAsBzD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAA8B,EAAE,OAAgB;IACpF,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO;IAC3B,MAAM,aAAa,CAAC,mEAAmE,EAAE;QACvF,MAAM,EAAE,8BAA8B;QACtC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC1C,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;YAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;SACjB,CAAC,CAAC;KACJ,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,UAAU,CACxB,SAA+B,EAC/B,UAAoB;IAEpB,MAAM,EAAE,WAAW,EAAE,qBAAqB,EAAE,GAAG,SAAS,CAAC;IACzD,IAAI,OAAO,WAAW,KAAK,UAAU;QAAE,OAAO;IAE9C,wEAAwE;IACxE,sEAAsE;IACtE,IAAI,CAAC,qBAAqB,EAAE,EAAE,EAAE,WAAW;QAAE,OAAO;IAEpD,MAAM,IAAI,GAAG,CACX,MAAwD,EACjC,EAAE;QACzB,IAAI,CAAC,SAAS,CAAC,wBAAwB;YAAE,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC;QACpE,OAAO,UAAU,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC;IAC9F,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,KAAK,EAAE,GAAW,EAAE,MAA8B,EAAyB,EAAE;QAC1F,MAAM,eAAe,GAAG,YAAY,CAAC,MAAM,CAA+C,CAAC;QAC3F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC,CAAC;QAC3E,IAAI,SAAS,CAAC,wBAAwB,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACvF,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,CAAC,GAAW,EAAE,GAAW,EAAyB,EAAE;QAChE,MAAM,aAAa,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC;IACjE,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAkB,CAAC;IACpC,QAAQ,CAAC,GAAG,GAAG,KAAK,CAAC;IACrB,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/mcp-server/protocolSession.d.ts

@@ -1,34 +0,0 @@
-/**
- * @fileoverview Request-spanning protocol state hooks for transports that
- * create a fresh MCP SDK server for every request.
- *
- * The SDK stores negotiated capabilities and cancellation controllers on a
- * `Server` instance. Streamable HTTP deliberately cannot reuse that instance
- * across requests (GHSA-345p-7cg4-v4c7), so the framework carries only the
- * minimal session state needed by handler contexts through these hooks.
- *
- * @module src/mcp-server/protocolSession
- */
-import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-import type { ClientCapabilities, RequestId } from '@modelcontextprotocol/sdk/types.js';
-/** A cancellation signal registered for one in-flight JSON-RPC request. */
-export interface ProtocolRequestRegistration {
-    /** Aborted when a matching `notifications/cancelled` reaches the session. */
-    signal: AbortSignal;
-    /** Removes only this registration; safe to call more than once. */
-    unregister: () => void;
-}
-/**
- * State restored onto a per-request server from its durable HTTP session.
- * Undefined for stdio and stateless HTTP, where no cross-request restoration
- * is necessary or possible.
- */
-export interface ProtocolSessionHooks {
-    /** Capabilities captured from the successful initialize request. */
-    clientCapabilities?: ClientCapabilities;
-    /** Registers a tool/resource request for cross-request cancellation. */
-    registerRequest?: (requestId: RequestId) => ProtocolRequestRegistration;
-}
-/** Factory shared by stdio (no hooks) and per-request HTTP servers. */
-export type McpServerFactory = (session?: ProtocolSessionHooks) => Promise<McpServer>;
-//# sourceMappingURL=protocolSession.d.ts.map

package/dist/mcp-server/protocolSession.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"protocolSession.d.ts","sourceRoot":"","sources":["../../src/mcp-server/protocolSession.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,KAAK,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,oCAAoC,CAAC;AAExF,2EAA2E;AAC3E,MAAM,WAAW,2BAA2B;IAC1C,6EAA6E;IAC7E,MAAM,EAAE,WAAW,CAAC;IACpB,mEAAmE;IACnE,UAAU,EAAE,MAAM,IAAI,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,oEAAoE;IACpE,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,wEAAwE;IACxE,eAAe,CAAC,EAAE,CAAC,SAAS,EAAE,SAAS,KAAK,2BAA2B,CAAC;CACzE;AAED,uEAAuE;AACvE,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,CAAC,EAAE,oBAAoB,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC"}

package/dist/mcp-server/protocolSession.js

@@ -1,13 +0,0 @@
-/**
- * @fileoverview Request-spanning protocol state hooks for transports that
- * create a fresh MCP SDK server for every request.
- *
- * The SDK stores negotiated capabilities and cancellation controllers on a
- * `Server` instance. Streamable HTTP deliberately cannot reuse that instance
- * across requests (GHSA-345p-7cg4-v4c7), so the framework carries only the
- * minimal session state needed by handler contexts through these hooks.
- *
- * @module src/mcp-server/protocolSession
- */
-export {};
-//# sourceMappingURL=protocolSession.js.map

package/dist/mcp-server/protocolSession.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"protocolSession.js","sourceRoot":"","sources":["../../src/mcp-server/protocolSession.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG"}

package/dist/mcp-server/tasks/core/evictingTaskMessageQueue.d.ts

@@ -1,53 +0,0 @@
-/**
- * @fileoverview A TaskMessageQueue wrapper that expires a task's queue on the
- * same schedule as the task itself.
- *
- * The SDK's `InMemoryTaskMessageQueue` deletes a queue only in `dequeueAll`,
- * which the SDK calls on `tasks/result` retrieval and `tasks/cancel`. Both
- * `enqueue` and `dequeue` allocate-and-keep a queue for any taskId they touch,
- * so a client that abandons a task — never fetching its result, never
- * cancelling — strands that queue and any messages in it for the life of the
- * process. Nothing in the SDK parallels the task store's TTL.
- *
- * @experimental These APIs are experimental and may change without notice.
- * @module src/mcp-server/tasks/core/evictingTaskMessageQueue
- */
-import type { QueuedMessage, TaskMessageQueue } from './taskTypes.js';
-/**
- * Wraps a {@link TaskMessageQueue} so each task's queue is reclaimed once its
- * TTL elapses.
- *
- * Eviction is lazy and traffic-driven rather than timer-based: a deadline is
- * refreshed whenever a task's queue is touched, expired queues are dropped on
- * the next operation, and `dequeueAll` releases the deadline outright. That
- * keeps the wrapper free of per-task timers and correct on runtimes where a
- * timer would never fire.
- *
- * @experimental
- */
-export declare class EvictingTaskMessageQueue implements TaskMessageQueue {
-    private readonly inner;
-    private readonly ttlMs;
-    private readonly deadlines;
-    /**
-     * @param inner - Queue to delegate to.
-     * @param ttlMs - Lifetime of an untouched queue. A non-positive value
-     *   disables eviction, matching a task store configured without a TTL.
-     */
-    constructor(inner: TaskMessageQueue, ttlMs: number);
-    private get evicts();
-    /**
-     * Drain queues whose deadline has passed, then extend `taskId`'s.
-     *
-     * `dequeueAll` is the inner queue's only delete path, so it doubles as the
-     * eviction primitive here — dropping the messages and the map entry in one
-     * call.
-     */
-    private expireAndTouch;
-    enqueue(taskId: string, message: QueuedMessage, sessionId?: string, maxSize?: number): Promise<void>;
-    dequeue(taskId: string, sessionId?: string): Promise<QueuedMessage | undefined>;
-    dequeueAll(taskId: string, sessionId?: string): Promise<QueuedMessage[]>;
-    /** Number of queues currently tracked for eviction. Exposed for tests. */
-    get trackedCount(): number;
-}
-//# sourceMappingURL=evictingTaskMessageQueue.d.ts.map

package/dist/mcp-server/tasks/core/evictingTaskMessageQueue.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"evictingTaskMessageQueue.d.ts","sourceRoot":"","sources":["../../../../src/mcp-server/tasks/core/evictingTaskMessageQueue.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEtE;;;;;;;;;;;GAWG;AACH,qBAAa,wBAAyB,YAAW,gBAAgB;IAS7D,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,KAAK;IATxB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA6B;IAEvD;;;;OAIG;IACH,YACmB,KAAK,EAAE,gBAAgB,EACvB,KAAK,EAAE,MAAM,EAC5B;IAEJ,OAAO,KAAK,MAAM,GAEjB;IAED;;;;;;OAMG;YACW,cAAc;IAatB,OAAO,CACX,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,aAAa,EACtB,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAGf;IAEK,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAGpF;IAEK,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAG7E;IAED,0EAA0E;IAC1E,IAAI,YAAY,IAAI,MAAM,CAEzB;CACF"}

package/dist/mcp-server/tasks/core/evictingTaskMessageQueue.js

@@ -1,65 +0,0 @@
-/**
- * Wraps a {@link TaskMessageQueue} so each task's queue is reclaimed once its
- * TTL elapses.
- *
- * Eviction is lazy and traffic-driven rather than timer-based: a deadline is
- * refreshed whenever a task's queue is touched, expired queues are dropped on
- * the next operation, and `dequeueAll` releases the deadline outright. That
- * keeps the wrapper free of per-task timers and correct on runtimes where a
- * timer would never fire.
- *
- * @experimental
- */
-export class EvictingTaskMessageQueue {
-    inner;
-    ttlMs;
-    deadlines = new Map();
-    /**
-     * @param inner - Queue to delegate to.
-     * @param ttlMs - Lifetime of an untouched queue. A non-positive value
-     *   disables eviction, matching a task store configured without a TTL.
-     */
-    constructor(inner, ttlMs) {
-        this.inner = inner;
-        this.ttlMs = ttlMs;
-    }
-    get evicts() {
-        return this.ttlMs > 0;
-    }
-    /**
-     * Drain queues whose deadline has passed, then extend `taskId`'s.
-     *
-     * `dequeueAll` is the inner queue's only delete path, so it doubles as the
-     * eviction primitive here — dropping the messages and the map entry in one
-     * call.
-     */
-    async expireAndTouch(taskId) {
-        if (!this.evicts)
-            return;
-        const now = Date.now();
-        for (const [id, deadline] of this.deadlines) {
-            if (now < deadline)
-                continue;
-            this.deadlines.delete(id);
-            await this.inner.dequeueAll(id);
-        }
-        this.deadlines.set(taskId, now + this.ttlMs);
-    }
-    async enqueue(taskId, message, sessionId, maxSize) {
-        await this.expireAndTouch(taskId);
-        await this.inner.enqueue(taskId, message, sessionId, maxSize);
-    }
-    async dequeue(taskId, sessionId) {
-        await this.expireAndTouch(taskId);
-        return await this.inner.dequeue(taskId, sessionId);
-    }
-    async dequeueAll(taskId, sessionId) {
-        this.deadlines.delete(taskId);
-        return await this.inner.dequeueAll(taskId, sessionId);
-    }
-    /** Number of queues currently tracked for eviction. Exposed for tests. */
-    get trackedCount() {
-        return this.deadlines.size;
-    }
-}
-//# sourceMappingURL=evictingTaskMessageQueue.js.map

package/dist/mcp-server/tasks/core/evictingTaskMessageQueue.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"evictingTaskMessageQueue.js","sourceRoot":"","sources":["../../../../src/mcp-server/tasks/core/evictingTaskMessageQueue.ts"],"names":[],"mappings":"AAgBA;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,wBAAwB;IAShB,KAAK;IACL,KAAK;IATP,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEvD;;;;OAIG;IACH,YACmB,KAAuB,EACvB,KAAa;qBADb,KAAK;qBACL,KAAK;IACrB,CAAC;IAEJ,IAAY,MAAM;QAChB,OAAO,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;IACxB,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,cAAc,CAAC,MAAc;QACzC,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO;QAEzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAC5C,IAAI,GAAG,GAAG,QAAQ;gBAAE,SAAS;YAC7B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC1B,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAClC,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,OAAO,CACX,MAAc,EACd,OAAsB,EACtB,SAAkB,EAClB,OAAgB;QAEhB,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,SAAkB;QAC9C,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,SAAkB;QACjD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9B,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACxD,CAAC;IAED,0EAA0E;IAC1E,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;IAC7B,CAAC;CACF"}

package/dist/mcp-server/tasks/core/sessionAwareTaskStore.d.ts

@@ -1,70 +0,0 @@
-/**
- * @fileoverview A TaskStore wrapper that enforces session ownership on top of
- * the SDK's InMemoryTaskStore (which ignores sessionId parameters).
- *
- * This ensures that in HTTP mode, tasks created by one session cannot be
- * accessed by another session, even when using the in-memory store.
- *
- * @experimental These APIs are experimental and may change without notice.
- * @module src/mcp-server/tasks/core/sessionAwareTaskStore
- */
-import type { Request, RequestId, Result } from '@modelcontextprotocol/sdk/types.js';
-import { type CreateTaskOptions, type Task, type TaskStore } from './taskTypes.js';
-/**
- * Wraps an InMemoryTaskStore to add session ownership enforcement.
- *
- * Tracks which session created each task and rejects access from
- * non-owning sessions. Tasks created without a sessionId are accessible
- * by any session (backwards-compatible with stdio/unauth flows).
- *
- * @experimental
- */
-export declare class SessionAwareTaskStore implements TaskStore {
-    private readonly inner;
-    /**
-     * Maps taskId -> owning sessionId and the deadline past which the row is
-     * reclaimable.
-     *
-     * The inner store drops a task once its TTL elapses, so an ownership row
-     * that outlives it is pure leak — one permanent entry per task call, since
-     * every HTTP request transport carries a sessionId. Mirroring the inner
-     * store's own expiry keeps this map's lifetime bounded by the tasks it
-     * describes. `Infinity` covers a task created without a TTL, which the
-     * inner store likewise never evicts.
-     */
-    private readonly ownership;
-    constructor(inner: TaskStore);
-    /**
-     * Owning session for a task, or `undefined` when unowned or expired.
-     * Prunes the row on the way past — a lazy sweep costs one comparison on a
-     * path that is already touching the entry.
-     */
-    private ownerOf;
-    /**
-     * Refresh a row's deadline, mirroring the inner store's TTL reset. The TTL
-     * is fixed when the task is created, so this needs no read of the inner
-     * store.
-     */
-    private touch;
-    /** Drop every expired row. Runs on task creation, where the map grows. */
-    private sweepExpired;
-    createTask(taskParams: CreateTaskOptions, requestId: RequestId, request: Request, sessionId?: string): Promise<Task>;
-    getTask(taskId: string, sessionId?: string): Promise<Task | null>;
-    storeTaskResult(taskId: string, status: 'completed' | 'failed', result: Result, sessionId?: string): Promise<void>;
-    getTaskResult(taskId: string, sessionId?: string): Promise<Result>;
-    updateTaskStatus(taskId: string, status: Task['status'], statusMessage?: string, sessionId?: string): Promise<void>;
-    listTasks(cursor?: string, sessionId?: string): Promise<{
-        tasks: Task[];
-        nextCursor?: string;
-    }>;
-    /**
-     * Validates that the caller's session matches the task's owner.
-     * Tasks created without a sessionId are accessible by any session.
-     *
-     * Once the row expires this falls through rather than throwing, so a probe
-     * for an evicted taskId gets the inner store's uniform not-found instead of
-     * a `Forbidden` that would confirm the id had once existed.
-     */
-    private assertOwnership;
-}
-//# sourceMappingURL=sessionAwareTaskStore.d.ts.map

package/dist/mcp-server/tasks/core/sessionAwareTaskStore.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sessionAwareTaskStore.d.ts","sourceRoot":"","sources":["../../../../src/mcp-server/tasks/core/sessionAwareTaskStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,oCAAoC,CAAC;AAGrF,OAAO,EAAE,KAAK,iBAAiB,EAAc,KAAK,IAAI,EAAE,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE/F;;;;;;;;GAQG;AACH,qBAAa,qBAAsB,YAAW,SAAS;IAiBzC,OAAO,CAAC,QAAQ,CAAC,KAAK;IAhBlC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,QAAQ,CAAC,SAAS,CAGtB;IAEJ,YAA6B,KAAK,EAAE,SAAS,EAAI;IAEjD;;;;OAIG;IACH,OAAO,CAAC,OAAO;IAUf;;;;OAIG;IACH,OAAO,CAAC,KAAK;IAMb,0EAA0E;IAC1E,OAAO,CAAC,YAAY;IAOd,UAAU,CACd,UAAU,EAAE,iBAAiB,EAC7B,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,OAAO,EAChB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAYf;IAEK,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAGtE;IAEK,eAAe,CACnB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,WAAW,GAAG,QAAQ,EAC9B,MAAM,EAAE,MAAM,EACd,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAMf;IAEK,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAGvE;IAEK,gBAAgB,CACpB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,EACtB,aAAa,CAAC,EAAE,MAAM,EACtB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAKf;IAEK,SAAS,CACb,MAAM,CAAC,EAAE,MAAM,EACf,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC;QAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAYjD;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;CAOxB"}