@cyanheads/mcp-ts-core 0.13.9 → 0.13.10

package/dist/mcp-server/handlerContext.d.ts

@@ -6,7 +6,7 @@
  */
 import type { ServerContext } from '@modelcontextprotocol/server';
 import { type Context } from '../core/context.js';
-import { type InputRequiredGate } from './inputRequired.js';
+import { type ClientCapabilityView, type RequestStateSealer } from './inputRequired.js';
 import { type NotifierSources, type OptionalNotifiers } from './notifications.js';
 import type { InputHandlingOptions } from './tools/utils/inputPrevalidation.js';
 import type { StorageService } from '../storage/core/StorageService.js';
@@ -28,6 +28,12 @@ export interface HandlerServices {
      */
     input?: InputHandlingOptions;
     logger: Logger;
+    /**
+     * Seals the `requestState` a handler returns with `ctx.requestInput(...)`,
+     * built from `MCP_REQUEST_STATE_KEY`. Absent when no key is configured, and
+     * the state then leaves as the handler wrote it.
+     */
+    requestState?: RequestStateSealer;
     storage: StorageService;
 }
 /** What a factory derives once per request from the SDK's `ServerContext`. */
@@ -41,8 +47,6 @@ export interface HandlerRequest {
     mcpReq: ServerContext['mcpReq'] | undefined;
     /** The delivery path `ctx.notify*` takes for this request's era. */
     notifiers: OptionalNotifiers;
-    /** The raw SDK session token — log correlation uses it in every mode. */
-    sdkSessionId: string | undefined;
     /**
      * What `ctx.sessionId` surfaces: a session with request-spanning lifetime
      * (stateful HTTP, or `auto` resolving to it), or the SDK's per-request token
@@ -61,21 +65,30 @@ export interface HandlerRequest {
  */
 export declare function resolveHandlerRequest(serverContext: ServerContext | undefined, services: HandlerServices, notifiers: NotifierSources): HandlerRequest;
 /**
- * The `parentContext` of a request's tracing context: the SDK request id and
- * the raw session id when present. Raw handler input is deliberately not part
- * of it — the context spreads into the completion log and can carry caller
- * PII or secrets; sizes and parameter names are recorded as metric attributes
- * by the execution measurement instead.
+ * The `parentContext` of a request's tracing context — for a tool call, a
+ * resource read, and a `prompts/get` alike: the SDK request id when the client
+ * sent a string id (otherwise the context generates one) and the raw session
+ * id when present. That id is the one the call's log records carry and its
+ * error `data.requestId` returns (#576). Raw handler input is deliberately not
+ * part of it — the context spreads into the completion log and can carry
+ * caller PII or secrets; sizes and parameter names are recorded as metric
+ * attributes by the execution measurement instead.
  */
-export declare function handlerParentContext(request: HandlerRequest): Partial<Pick<RequestContext, 'requestId' | 'sessionId'>>;
+export declare function handlerParentContext(serverContext: ServerContext | undefined): Partial<Pick<RequestContext, 'requestId' | 'sessionId'>>;
 /**
  * Builds the handler `Context`. Called from inside the execution span so
  * `ctx.traceId` / `ctx.spanId` — and the child logger built from them — name
  * the span the handler runs in rather than the enclosing request span (#296).
  * `attachTypedFail` adds `ctx.fail` when the definition declares an error
- * contract; otherwise the context is unchanged. `inputGate` is the
- * connection's client-capability check, which `ctx.requestInput` runs on the
- * result it builds (#379); the context is unchanged without one.
+ * contract; otherwise the context is unchanged.
+ *
+ * `capabilityView` is the instance's view of its client's declared
+ * capabilities (#580), resolved once here into the value
+ * `ctx.clientCapabilities` carries, the filter over `ctx.inputs` applies
+ * (#496), and — on a 2025-era instance — the gate `ctx.requestInput` runs on
+ * the result it builds (#379). Without a view the request has none:
+ * `ctx.clientCapabilities` is `undefined`, no response reaches `ctx.inputs`,
+ * and nothing gates `ctx.requestInput`.
  */
-export declare function buildHandlerContext(request: HandlerRequest, services: HandlerServices, spanContext: RequestContext, errors: readonly ErrorContract[] | undefined, inputGate?: InputRequiredGate, uri?: URL): Context;
+export declare function buildHandlerContext(request: HandlerRequest, services: HandlerServices, spanContext: RequestContext, errors: readonly ErrorContract[] | undefined, capabilityView?: ClientCapabilityView, uri?: URL): Context;
 //# sourceMappingURL=handlerContext.d.ts.map

package/dist/mcp-server/handlerContext.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handlerContext.d.ts","sourceRoot":"","sources":["../../src/mcp-server/handlerContext.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAGlE,OAAO,EAAmB,KAAK,OAAO,EAAiB,MAAM,mBAAmB,CAAC;AACjF,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,iBAAiB,EAEvB,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gDAAgD,CAAC;AAE3F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAEzE,wDAAwD;AACxD,MAAM,WAAW,eAAe;IAC9B;;;;;OAKG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC;;;OAGG;IACH,KAAK,CAAC,EAAE,oBAAoB,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,cAAc,CAAC;CACzB;AAED,8EAA8E;AAC9E,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC;IAC5C,oEAAoE;IACpE,SAAS,EAAE,iBAAiB,CAAC;IAC7B,yEAAyE;IACzE,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC;;;;;OAKG;IACH,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,qFAAqF;IACrF,MAAM,EAAE,WAAW,CAAC;CACrB;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,aAAa,EAAE,aAAa,GAAG,SAAS,EACxC,QAAQ,EAAE,eAAe,EACzB,SAAS,EAAE,eAAe,GACzB,cAAc,CAiBhB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,WAAW,GAAG,WAAW,CAAC,CAAC,CAM1D;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,cAAc,EACvB,QAAQ,EAAE,eAAe,EACzB,WAAW,EAAE,cAAc,EAC3B,MAAM,EAAE,SAAS,aAAa,EAAE,GAAG,SAAS,EAC5C,SAAS,CAAC,EAAE,iBAAiB,EAC7B,GAAG,CAAC,EAAE,GAAG,GACR,OAAO,CAqBT"}
+{"version":3,"file":"handlerContext.d.ts","sourceRoot":"","sources":["../../src/mcp-server/handlerContext.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAGlE,OAAO,EAAmB,KAAK,OAAO,EAAiB,MAAM,mBAAmB,CAAC;AACjF,OAAO,EACL,KAAK,oBAAoB,EAIzB,KAAK,kBAAkB,EACxB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,iBAAiB,EAEvB,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gDAAgD,CAAC;AAE3F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAEzE,wDAAwD;AACxD,MAAM,WAAW,eAAe;IAC9B;;;;;OAKG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC;;;OAGG;IACH,KAAK,CAAC,EAAE,oBAAoB,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,OAAO,EAAE,cAAc,CAAC;CACzB;AAED,8EAA8E;AAC9E,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC;IAC5C,oEAAoE;IACpE,SAAS,EAAE,iBAAiB,CAAC;IAC7B;;;;;OAKG;IACH,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,qFAAqF;IACrF,MAAM,EAAE,WAAW,CAAC;CACrB;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,aAAa,EAAE,aAAa,GAAG,SAAS,EACxC,QAAQ,EAAE,eAAe,EACzB,SAAS,EAAE,eAAe,GACzB,cAAc,CAehB;AAOD;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,aAAa,EAAE,aAAa,GAAG,SAAS,GACvC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,WAAW,GAAG,WAAW,CAAC,CAAC,CAO1D;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,cAAc,EACvB,QAAQ,EAAE,eAAe,EACzB,WAAW,EAAE,cAAc,EAC3B,MAAM,EAAE,SAAS,aAAa,EAAE,GAAG,SAAS,EAC5C,cAAc,CAAC,EAAE,oBAAoB,EACrC,GAAG,CAAC,EAAE,GAAG,GACR,OAAO,CAyBT"}

package/dist/mcp-server/handlerContext.js

@@ -6,7 +6,7 @@
  */
 import { config } from '../config/index.js';
 import { attachTypedFail, createContext } from '../core/context.js';
-import { createContextInputs, createRequestInput, } from './inputRequired.js';
+import { createContextInputs, createInputRequiredGate, createRequestInput, } from './inputRequired.js';
 import { selectNotifiers, } from './notifications.js';
 import { resolveSessionMode } from './types.js';
 /**
@@ -17,32 +17,39 @@ import { resolveSessionMode } from './types.js';
  */
 export function resolveHandlerRequest(serverContext, services, notifiers) {
     const mcpReq = serverContext?.mcpReq;
-    const sdkSessionId = typeof serverContext?.sessionId === 'string' ? serverContext.sessionId : undefined;
+    const sdkSessionId = sdkSessionIdOf(serverContext);
     const isStatefulMode = resolveSessionMode(config.mcpSessionMode) === 'stateful';
     const hasNoAuthPipeline = config.mcpTransportType === 'stdio' || config.mcpAuthMode === 'none';
     return {
         defaultTenantId: hasNoAuthPipeline ? 'default' : undefined,
         mcpReq,
         notifiers: selectNotifiers(notifiers, mcpReq),
-        sdkSessionId,
         sessionId: sdkSessionId && (isStatefulMode || services.exposeStatelessSessionId === true)
             ? sdkSessionId
             : undefined,
         signal: mcpReq?.signal ?? new AbortController().signal,
     };
 }
+/** The raw SDK session token of a request, when it carries one. */
+function sdkSessionIdOf(serverContext) {
+    return typeof serverContext?.sessionId === 'string' ? serverContext.sessionId : undefined;
+}
 /**
- * The `parentContext` of a request's tracing context: the SDK request id and
- * the raw session id when present. Raw handler input is deliberately not part
- * of it — the context spreads into the completion log and can carry caller
- * PII or secrets; sizes and parameter names are recorded as metric attributes
- * by the execution measurement instead.
+ * The `parentContext` of a request's tracing context — for a tool call, a
+ * resource read, and a `prompts/get` alike: the SDK request id when the client
+ * sent a string id (otherwise the context generates one) and the raw session
+ * id when present. That id is the one the call's log records carry and its
+ * error `data.requestId` returns (#576). Raw handler input is deliberately not
+ * part of it — the context spreads into the completion log and can carry
+ * caller PII or secrets; sizes and parameter names are recorded as metric
+ * attributes by the execution measurement instead.
  */
-export function handlerParentContext(request) {
-    const requestId = request.mcpReq?.id;
+export function handlerParentContext(serverContext) {
+    const requestId = serverContext?.mcpReq?.id;
+    const sessionId = sdkSessionIdOf(serverContext);
     return {
         ...(typeof requestId === 'string' && { requestId }),
-        ...(request.sdkSessionId && { sessionId: request.sdkSessionId }),
+        ...(sessionId && { sessionId }),
     };
 }
 /**
@@ -50,21 +57,29 @@ export function handlerParentContext(request) {
  * `ctx.traceId` / `ctx.spanId` — and the child logger built from them — name
  * the span the handler runs in rather than the enclosing request span (#296).
  * `attachTypedFail` adds `ctx.fail` when the definition declares an error
- * contract; otherwise the context is unchanged. `inputGate` is the
- * connection's client-capability check, which `ctx.requestInput` runs on the
- * result it builds (#379); the context is unchanged without one.
+ * contract; otherwise the context is unchanged.
+ *
+ * `capabilityView` is the instance's view of its client's declared
+ * capabilities (#580), resolved once here into the value
+ * `ctx.clientCapabilities` carries, the filter over `ctx.inputs` applies
+ * (#496), and — on a 2025-era instance — the gate `ctx.requestInput` runs on
+ * the result it builds (#379). Without a view the request has none:
+ * `ctx.clientCapabilities` is `undefined`, no response reaches `ctx.inputs`,
+ * and nothing gates `ctx.requestInput`.
  */
-export function buildHandlerContext(request, services, spanContext, errors, inputGate, uri) {
+export function buildHandlerContext(request, services, spanContext, errors, capabilityView, uri) {
     const { mcpReq, notifiers } = request;
+    const clientCapabilities = capabilityView?.capabilities(mcpReq);
     return attachTypedFail(createContext({
         appContext: spanContext,
+        clientCapabilities,
         defaultTenantId: request.defaultTenantId,
         logger: services.logger,
         storage: services.storage,
         signal: request.signal,
         sessionId: request.sessionId,
-        inputs: createContextInputs(mcpReq),
-        requestInput: createRequestInput(inputGate),
+        inputs: createContextInputs(mcpReq, clientCapabilities),
+        requestInput: createRequestInput(capabilityView?.era === 'legacy' ? createInputRequiredGate(clientCapabilities) : undefined),
         ...(mcpReq?.log && { wireLog: mcpReq.log }),
         notifyPromptListChanged: notifiers.notifyPromptListChanged,
         notifyResourceListChanged: notifiers.notifyResourceListChanged,

package/dist/mcp-server/handlerContext.js.map

@@ -1 +1 @@
-{"version":3,"file":"handlerContext.js","sourceRoot":"","sources":["../../src/mcp-server/handlerContext.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAgB,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACjF,OAAO,EACL,mBAAmB,EACnB,kBAAkB,GAEnB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAGL,eAAe,GAChB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAgD3D;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,aAAwC,EACxC,QAAyB,EACzB,SAA0B;IAE1B,MAAM,MAAM,GAAG,aAAa,EAAE,MAAM,CAAC;IACrC,MAAM,YAAY,GAChB,OAAO,aAAa,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACrF,MAAM,cAAc,GAAG,kBAAkB,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,UAAU,CAAC;IAChF,MAAM,iBAAiB,GAAG,MAAM,CAAC,gBAAgB,KAAK,OAAO,IAAI,MAAM,CAAC,WAAW,KAAK,MAAM,CAAC;IAC/F,OAAO;QACL,eAAe,EAAE,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QAC1D,MAAM;QACN,SAAS,EAAE,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC;QAC7C,YAAY;QACZ,SAAS,EACP,YAAY,IAAI,CAAC,cAAc,IAAI,QAAQ,CAAC,wBAAwB,KAAK,IAAI,CAAC;YAC5E,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,SAAS;QACf,MAAM,EAAE,MAAM,EAAE,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC,MAAM;KACvD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAuB;IAEvB,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;IACrC,OAAO;QACL,GAAG,CAAC,OAAO,SAAS,KAAK,QAAQ,IAAI,EAAE,SAAS,EAAE,CAAC;QACnD,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;KACjE,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAuB,EACvB,QAAyB,EACzB,WAA2B,EAC3B,MAA4C,EAC5C,SAA6B,EAC7B,GAAS;IAET,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IACtC,OAAO,eAAe,CACpB,aAAa,CAAC;QACZ,UAAU,EAAE,WAAW;QACvB,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM,EAAE,mBAAmB,CAAC,MAAM,CAAC;QACnC,YAAY,EAAE,kBAAkB,CAAC,SAAS,CAAC;QAC3C,GAAG,CAAC,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;QAC3C,uBAAuB,EAAE,SAAS,CAAC,uBAAuB;QAC1D,yBAAyB,EAAE,SAAS,CAAC,yBAAyB;QAC9D,qBAAqB,EAAE,SAAS,CAAC,qBAAqB;QACtD,qBAAqB,EAAE,SAAS,CAAC,qBAAqB;QACtD,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,CAAC;KACpB,CAAC,EACF,MAAM,CACP,CAAC;AACJ,CAAC"}
+{"version":3,"file":"handlerContext.js","sourceRoot":"","sources":["../../src/mcp-server/handlerContext.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAgB,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACjF,OAAO,EAEL,mBAAmB,EACnB,uBAAuB,EACvB,kBAAkB,GAEnB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAGL,eAAe,GAChB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAoD3D;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,aAAwC,EACxC,QAAyB,EACzB,SAA0B;IAE1B,MAAM,MAAM,GAAG,aAAa,EAAE,MAAM,CAAC;IACrC,MAAM,YAAY,GAAG,cAAc,CAAC,aAAa,CAAC,CAAC;IACnD,MAAM,cAAc,GAAG,kBAAkB,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,UAAU,CAAC;IAChF,MAAM,iBAAiB,GAAG,MAAM,CAAC,gBAAgB,KAAK,OAAO,IAAI,MAAM,CAAC,WAAW,KAAK,MAAM,CAAC;IAC/F,OAAO;QACL,eAAe,EAAE,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QAC1D,MAAM;QACN,SAAS,EAAE,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC;QAC7C,SAAS,EACP,YAAY,IAAI,CAAC,cAAc,IAAI,QAAQ,CAAC,wBAAwB,KAAK,IAAI,CAAC;YAC5E,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,SAAS;QACf,MAAM,EAAE,MAAM,EAAE,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC,MAAM;KACvD,CAAC;AACJ,CAAC;AAED,mEAAmE;AACnE,SAAS,cAAc,CAAC,aAAwC;IAC9D,OAAO,OAAO,aAAa,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5F,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAClC,aAAwC;IAExC,MAAM,SAAS,GAAG,aAAa,EAAE,MAAM,EAAE,EAAE,CAAC;IAC5C,MAAM,SAAS,GAAG,cAAc,CAAC,aAAa,CAAC,CAAC;IAChD,OAAO;QACL,GAAG,CAAC,OAAO,SAAS,KAAK,QAAQ,IAAI,EAAE,SAAS,EAAE,CAAC;QACnD,GAAG,CAAC,SAAS,IAAI,EAAE,SAAS,EAAE,CAAC;KAChC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAuB,EACvB,QAAyB,EACzB,WAA2B,EAC3B,MAA4C,EAC5C,cAAqC,EACrC,GAAS;IAET,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IACtC,MAAM,kBAAkB,GAAG,cAAc,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;IAChE,OAAO,eAAe,CACpB,aAAa,CAAC;QACZ,UAAU,EAAE,WAAW;QACvB,kBAAkB;QAClB,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM,EAAE,mBAAmB,CAAC,MAAM,EAAE,kBAAkB,CAAC;QACvD,YAAY,EAAE,kBAAkB,CAC9B,cAAc,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,uBAAuB,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,SAAS,CAC3F;QACD,GAAG,CAAC,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;QAC3C,uBAAuB,EAAE,SAAS,CAAC,uBAAuB;QAC1D,yBAAyB,EAAE,SAAS,CAAC,yBAAyB;QAC9D,qBAAqB,EAAE,SAAS,CAAC,qBAAqB;QACtD,qBAAqB,EAAE,SAAS,CAAC,qBAAqB;QACtD,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,CAAC;KACpB,CAAC,EACF,MAAM,CACP,CAAC;AACJ,CAAC"}

package/dist/mcp-server/inputRequired.d.ts

@@ -15,10 +15,15 @@
  * returns against 2025-era clients by issuing real `elicitation/create` /
  * `sampling/createMessage` / `roots/list` requests and re-entering the handler.
  *
+ * What a handler reads back is bounded by what its client declared: the
+ * per-request capability view (#580) decides which responses reach
+ * `ctx.inputs` (#496), and an opt-in key seals the `requestState` a handler
+ * returns so a retry can only echo what this server minted.
+ *
  * @see {@link https://modelcontextprotocol.io/specification/2026-07-28/basic/patterns/mrtr | MCP Multi-Round-Trip Requests}
  * @module src/mcp-server/inputRequired
  */
-import { acceptedContent, type ClientCapabilities, type InputRequiredResult, type ServerContext } from '@modelcontextprotocol/server';
+import { acceptedContent, type ClientCapabilities, type InputRequiredResult, type InputResponses, type McpServer, type ServerContext } from '@modelcontextprotocol/server';
 import type { ContextInputs, RequestInputFn } from '../core/context.js';
 import { McpError } from '../types-global/errors.js';
 /**
@@ -37,6 +42,46 @@ export declare class InputRequiredSignal extends Error {
 }
 /** Narrows an unknown thrown value to the input-required control-flow signal. */
 export declare function isInputRequiredSignal(error: unknown): error is InputRequiredSignal;
+/**
+ * What one server instance can see of its client's declared capabilities,
+ * resolved per request. One view is built per instance, from the era the
+ * instance serves — never from whether a request happens to carry an envelope
+ * key, since the SDK lifts reserved `_meta` keys off 2025-era messages too.
+ *
+ * `ctx.clientCapabilities`, the 2025-era refusal `ctx.requestInput` raises
+ * (#379), and the filter over `ctx.inputs` (#496) all read the one value this
+ * resolves for a request, so the three can never disagree.
+ */
+export interface ClientCapabilityView {
+    /**
+     * The capabilities the request's client declared: `{}` when it declared
+     * none, `undefined` when the instance holds no view at all — a 2025-era
+     * request served per-request, whose instance never processed `initialize`.
+     */
+    capabilities(mcpReq: ServerContext['mcpReq'] | undefined): ClientCapabilities | undefined;
+    /**
+     * The era the instance serves. Only a `legacy` instance gates
+     * `ctx.requestInput` in the framework; a `modern` one is gated by the SDK
+     * after the handler returns (`-32021`).
+     */
+    readonly era: 'legacy' | 'modern';
+}
+/**
+ * The view for one instance: on a 2025-era instance the `initialize`-declared
+ * value, read through the instance on every call so an `initialize` that lands
+ * after registration is seen; on a 2026-07-28 instance the request's own
+ * `io.modelcontextprotocol/clientCapabilities` envelope key, which the SDK has
+ * validated before dispatch. `getClientCapabilities()` is not used there — a
+ * 2026-07-28 stdio instance never has it backfilled.
+ */
+export declare function clientCapabilityView(era: 'legacy' | 'modern', server: McpServer): ClientCapabilityView;
+/**
+ * The framework-owned `data.reason` on an input request this connection cannot
+ * serve. It joins `invalid_arguments` as a reserved reason: a definition cannot
+ * declare it in `errors[]`, because it names a property of the connection
+ * rather than a domain outcome.
+ */
+export declare const CLIENT_CAPABILITY_MISSING_REASON = "client_capability_missing";
 /**
  * Decides whether a handler's `input_required` return can be served on this
  * connection: the `McpError` the caller receives instead, or `undefined` to
@@ -45,7 +90,9 @@ export declare function isInputRequiredSignal(error: unknown): error is InputReq
  */
 export type InputRequiredGate = (result: InputRequiredResult, fallbackHint?: string) => McpError | undefined;
 /**
- * Builds the gate for one connection from its declared client capabilities.
+ * Builds the gate for one request from the capabilities its client declared —
+ * the value the instance's {@link ClientCapabilityView} resolved, which
+ * `ctx.clientCapabilities` carries too.
  *
  * Only the 2025-era arm needs it. There the refusal is produced by the SDK's
  * legacy shim, which runs *above* the handler callback on the result that
@@ -57,16 +104,16 @@ export type InputRequiredGate = (result: InputRequiredResult, fallbackHint?: str
  * the SDK itself, which raises `MissingRequiredClientCapabilityError`
  * (`-32021`) — that arm takes no gate.
  *
- * `clientCapabilities()` returning `undefined` is the per-request legacy case:
- * an instance that never saw an `initialize` holds no capability view, so every
- * embedded request is refused, and the message and hint say so.
+ * `declared` being `undefined` is the per-request legacy case: an instance that
+ * never saw an `initialize` holds no capability view, so every embedded
+ * request is refused, and the message and hint say so.
  *
  * The hint ends at reconnecting (#495). Whether the caller could instead
  * supply the answer as an argument is the handler's knowledge, not the gate's:
  * a consent gate deliberately has no such field, so the gate appends a
  * fallback only when the handler passed one.
  */
-export declare function createInputRequiredGate(clientCapabilities: () => ClientCapabilities | undefined): InputRequiredGate;
+export declare function createInputRequiredGate(declared: ClientCapabilities | undefined): InputRequiredGate;
 /**
  * Builds `ctx.requestInput`. Always present — a handler may request input on
  * any transport and either era; whether the round trip is served by the client
@@ -85,16 +132,81 @@ export declare function createInputRequiredGate(clientCapabilities: () => Client
  */
 export declare function createRequestInput(gate?: InputRequiredGate): RequestInputFn;
 /**
- * Builds the `ctx.inputs` reader over a retried request's `inputResponses`.
+ * The entries of `responses` the client's declared capabilities cover, at the
+ * same mode level the gate applies to requests ({@link responseRequirement},
+ * {@link isDeclared}), or `undefined` when none survives.
+ *
+ * The SDK lifts `inputResponses` off every client request, a first call and a
+ * 2025-era request included, so a client can arrive pre-answered with no
+ * `input_required` result ever sent. An answer the client's modes do not cover
+ * cannot have come from a round this server asked for: on the 2025 arm the
+ * legacy shim only issues requests the connection declared, and on 2026-07-28
+ * the SDK refuses an embedded request the envelope does not cover. Dropping
+ * those closes the pre-answered consent-gate bypass — a URL-only client's form
+ * answer included — without touching a legitimate round. With no view
+ * (`declared` undefined) nothing survives, and an entry the SDK's classifier
+ * cannot read as any kind has no capability to justify it either.
+ */
+export declare function declaredResponses(responses: InputResponses | Record<string, unknown> | undefined, declared: ClientCapabilities | undefined): Record<string, unknown> | undefined;
+/**
+ * Builds the `ctx.inputs` reader over a retried request's `inputResponses`,
+ * keeping only the answers `declared` covers ({@link declaredResponses}).
  *
  * Values arrive from the client and are never re-validated by the SDK — pass a
  * schema to `accepted()` wherever the content matters.
  */
-export declare function createContextInputs(mcpReq: ServerContext['mcpReq'] | undefined): ContextInputs;
+export declare function createContextInputs(mcpReq: ServerContext['mcpReq'] | undefined, declared: ClientCapabilities | undefined): ContextInputs;
 /**
  * The `ctx.inputs` reader over an explicit set of responses — what
  * {@link createContextInputs} builds from the SDK request, and what the test
  * kit builds from seeded `inputResponses` / `requestState`.
  */
 export declare function contextInputsFrom(responses: Parameters<typeof acceptedContent>[0], dropped: string[], state: ContextInputs['state']): ContextInputs;
+/**
+ * Seals the `requestState` handlers return and verifies it when a retry
+ * echoes it back. Built once per process from `MCP_REQUEST_STATE_KEY`; the
+ * handler factories seal each input-required signal through
+ * {@link sealThrown}, and every `McpServer` gets
+ * {@link RequestStateSealer.verify} as `ServerOptions.requestState.verify`.
+ */
+export interface RequestStateSealer {
+    /**
+     * The `input_required` result a factory returns, its string `requestState`
+     * minted into the codec's signed envelope, bound to the request's
+     * authenticated principal. A result carrying no state is returned as is.
+     */
+    seal(result: InputRequiredResult, ctx: ServerContext): Promise<InputRequiredResult>;
+    /**
+     * Resolves with the handler's original string, or throws — a forged,
+     * tampered, expired, other-principal, or other-key state. The SDK answers a
+     * throw as `-32602` with `data.reason: 'invalid_request_state'` before the
+     * handler runs, and reports only the codec's opaque reason to `onerror`.
+     */
+    verify(state: string, ctx: ServerContext): Promise<unknown>;
+}
+/**
+ * The process's sealer, or `undefined` when no key is configured — in which
+ * case nothing reaches the SDK and handlers read the raw wire string, exactly
+ * as before the option existed. There is deliberately no per-process random
+ * key: a 2026-07-28 retry can land on another instance or outlive a restart,
+ * and every instance that may receive an echoed state needs the same key.
+ *
+ * @throws {McpError} `ConfigurationError` naming `MCP_REQUEST_STATE_KEY` when
+ *   the key is shorter than 32 UTF-8 bytes. The key itself is never included.
+ */
+export declare function createRequestStateSealer(key: string | undefined): RequestStateSealer | undefined;
+/**
+ * What a handler factory rethrows for a value its handler threw: an
+ * input-required signal carrying its `requestState` sealed when `sealer` is
+ * configured, anything else unchanged.
+ *
+ * The factories call it inside the measured region, where the signal is
+ * rethrown. Minting can reject — WebCrypto failing, or no request context for
+ * the principal binding — and a rejection there would escape the factory with
+ * no error envelope, no failure record, and no request id. It resolves to an
+ * `InternalError` instead, so the call fails through the family's ordinary
+ * error path; the codec's error rides as `cause` into the server log only, and
+ * no part of the key reaches it.
+ */
+export declare function sealThrown(thrown: unknown, sealer: RequestStateSealer | undefined, ctx: ServerContext): Promise<unknown>;
 //# sourceMappingURL=inputRequired.d.ts.map

package/dist/mcp-server/inputRequired.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inputRequired.d.ts","sourceRoot":"","sources":["../../src/mcp-server/inputRequired.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EACL,eAAe,EACf,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EAIxB,KAAK,aAAa,EAEnB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAoB,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAEtE;;;;;;;GAOG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAIhC,QAAQ,CAAC,MAAM,EAAE,mBAAmB;IAHhD,wEAAwE;IACxE,QAAQ,CAAC,qBAAqB,OAAiB;IAE/C,YAAqB,MAAM,EAAE,mBAAmB,EAG/C;CACF;AAED,iFAAiF;AACjF,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,mBAAmB,CAOlF;AAwED;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAC9B,MAAM,EAAE,mBAAmB,EAC3B,YAAY,CAAC,EAAE,MAAM,KAClB,QAAQ,GAAG,SAAS,CAAC;AAE1B;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,uBAAuB,CACrC,kBAAkB,EAAE,MAAM,kBAAkB,GAAG,SAAS,GACvD,iBAAiB,CA8BnB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,CAAC,EAAE,iBAAiB,GAAG,cAAc,CAO3E;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,GAAG,SAAS,GAAG,aAAa,CAM9F;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC,CAAC,CAAC,EAChD,OAAO,EAAE,MAAM,EAAE,EACjB,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC,GAC5B,aAAa,CAaf"}
+{"version":3,"file":"inputRequired.d.ts","sourceRoot":"","sources":["../../src/mcp-server/inputRequired.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EACL,eAAe,EAEf,KAAK,kBAAkB,EAEvB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EAInB,KAAK,SAAS,EACd,KAAK,aAAa,EAEnB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEvE,OAAO,EAIL,QAAQ,EACT,MAAM,0BAA0B,CAAC;AAElC;;;;;;;GAOG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAIhC,QAAQ,CAAC,MAAM,EAAE,mBAAmB;IAHhD,wEAAwE;IACxE,QAAQ,CAAC,qBAAqB,OAAiB;IAE/C,YAAqB,MAAM,EAAE,mBAAmB,EAG/C;CACF;AAED,iFAAiF;AACjF,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,mBAAmB,CAOlF;AAMD;;;;;;;;;GASG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,YAAY,CAAC,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,GAAG,SAAS,GAAG,kBAAkB,GAAG,SAAS,CAAC;IAC1F;;;;OAIG;IACH,QAAQ,CAAC,GAAG,EAAE,QAAQ,GAAG,QAAQ,CAAC;CACnC;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,QAAQ,GAAG,QAAQ,EACxB,MAAM,EAAE,SAAS,GAChB,oBAAoB,CAWtB;AAMD;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,8BAA8B,CAAC;AA+D5E;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAC9B,MAAM,EAAE,mBAAmB,EAC3B,YAAY,CAAC,EAAE,MAAM,KAClB,QAAQ,GAAG,SAAS,CAAC;AAE1B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,kBAAkB,GAAG,SAAS,GACvC,iBAAiB,CA6BnB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,CAAC,EAAE,iBAAiB,GAAG,cAAc,CAO3E;AAqDD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC/D,QAAQ,EAAE,kBAAkB,GAAG,SAAS,GACvC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAOrC;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,GAAG,SAAS,EAC3C,QAAQ,EAAE,kBAAkB,GAAG,SAAS,GACvC,aAAa,CAMf;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC,CAAC,CAAC,EAChD,OAAO,EAAE,MAAM,EAAE,EACjB,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC,GAC5B,aAAa,CAaf;AAiBD;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,IAAI,CAAC,MAAM,EAAE,mBAAmB,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACpF;;;;;OAKG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7D;AAaD;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,kBAAkB,GAAG,SAAS,CAoBhG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,OAAO,EACf,MAAM,EAAE,kBAAkB,GAAG,SAAS,EACtC,GAAG,EAAE,aAAa,GACjB,OAAO,CAAC,OAAO,CAAC,CAWlB"}

package/dist/mcp-server/inputRequired.js

@@ -15,11 +15,16 @@
  * returns against 2025-era clients by issuing real `elicitation/create` /
  * `sampling/createMessage` / `roots/list` requests and re-entering the handler.
  *
+ * What a handler reads back is bounded by what its client declared: the
+ * per-request capability view (#580) decides which responses reach
+ * `ctx.inputs` (#496), and an opt-in key seals the `requestState` a handler
+ * returns so a retry can only echo what this server minted.
+ *
  * @see {@link https://modelcontextprotocol.io/specification/2026-07-28/basic/patterns/mrtr | MCP Multi-Round-Trip Requests}
  * @module src/mcp-server/inputRequired
  */
-import { acceptedContent, inputRequired, inputResponse, } from '@modelcontextprotocol/server';
-import { JsonRpcErrorCode, McpError } from '../types-global/errors.js';
+import { acceptedContent, CLIENT_CAPABILITIES_META_KEY, createRequestStateCodec, inputRequired, inputResponse, } from '@modelcontextprotocol/server';
+import { configurationError, internalError, JsonRpcErrorCode, McpError, } from '../types-global/errors.js';
 /**
  * Thrown by `ctx.requestInput(...)` and caught by the handler factories, which
  * return the carried `input_required` result to the SDK instead of a normal
@@ -45,6 +50,23 @@ export function isInputRequiredSignal(error) {
             error !== null &&
             error.isInputRequiredSignal === true));
 }
+/**
+ * The view for one instance: on a 2025-era instance the `initialize`-declared
+ * value, read through the instance on every call so an `initialize` that lands
+ * after registration is seen; on a 2026-07-28 instance the request's own
+ * `io.modelcontextprotocol/clientCapabilities` envelope key, which the SDK has
+ * validated before dispatch. `getClientCapabilities()` is not used there — a
+ * 2026-07-28 stdio instance never has it backfilled.
+ */
+export function clientCapabilityView(era, server) {
+    if (era === 'modern') {
+        return {
+            era,
+            capabilities: (mcpReq) => mcpReq?.envelope?.[CLIENT_CAPABILITIES_META_KEY],
+        };
+    }
+    return { era, capabilities: () => server.server.getClientCapabilities() };
+}
 // ---------------------------------------------------------------------------
 // Client-capability gate (#379)
 // ---------------------------------------------------------------------------
@@ -54,7 +76,7 @@ export function isInputRequiredSignal(error) {
  * declare it in `errors[]`, because it names a property of the connection
  * rather than a domain outcome.
  */
-const CLIENT_CAPABILITY_MISSING_REASON = 'client_capability_missing';
+export const CLIENT_CAPABILITY_MISSING_REASON = 'client_capability_missing';
 /**
  * What an embedded request kind requires, mode-aware where the capability is:
  * URL-mode elicitation needs `elicitation.url`, form-mode (or mode-omitted)
@@ -103,7 +125,9 @@ function capabilityPath({ capability, member }) {
     return member === undefined ? capability : `${capability}.${member}`;
 }
 /**
- * Builds the gate for one connection from its declared client capabilities.
+ * Builds the gate for one request from the capabilities its client declared —
+ * the value the instance's {@link ClientCapabilityView} resolved, which
+ * `ctx.clientCapabilities` carries too.
  *
  * Only the 2025-era arm needs it. There the refusal is produced by the SDK's
  * legacy shim, which runs *above* the handler callback on the result that
@@ -115,21 +139,20 @@ function capabilityPath({ capability, member }) {
  * the SDK itself, which raises `MissingRequiredClientCapabilityError`
  * (`-32021`) — that arm takes no gate.
  *
- * `clientCapabilities()` returning `undefined` is the per-request legacy case:
- * an instance that never saw an `initialize` holds no capability view, so every
- * embedded request is refused, and the message and hint say so.
+ * `declared` being `undefined` is the per-request legacy case: an instance that
+ * never saw an `initialize` holds no capability view, so every embedded
+ * request is refused, and the message and hint say so.
  *
  * The hint ends at reconnecting (#495). Whether the caller could instead
  * supply the answer as an argument is the handler's knowledge, not the gate's:
  * a consent gate deliberately has no such field, so the gate appends a
  * fallback only when the handler passed one.
  */
-export function createInputRequiredGate(clientCapabilities) {
+export function createInputRequiredGate(declared) {
     return (result, fallbackHint) => {
         const requests = result.inputRequests;
         if (requests === undefined)
             return;
-        const declared = clientCapabilities();
         for (const [key, entry] of Object.entries(requests)) {
             const requirement = capabilityRequirement(entry);
             if (requirement === undefined || isDeclared(requirement, declared))
@@ -175,14 +198,81 @@ export function createRequestInput(gate) {
         throw new InputRequiredSignal(result);
     };
 }
+// ---------------------------------------------------------------------------
+// ctx.inputs — responses filtered by declared capability (#496)
+// ---------------------------------------------------------------------------
+/** Content block types only a tool-enabled sampling result carries. */
+const TOOL_BLOCK_TYPES = new Set(['tool_use', 'tool_result']);
+/** Whether sampling content — one block or an array — holds a tool block. */
+function carriesToolBlock(content) {
+    return (Array.isArray(content) ? content : [content]).some((block) => typeof block === 'object' &&
+        block !== null &&
+        TOOL_BLOCK_TYPES.has(block.type));
+}
+/**
+ * What one response requires — the response-side twin of
+ * {@link capabilityRequirement}, so an answer needs whatever the request it
+ * answers would have needed. An elicit result carrying `content` is a
+ * form-mode answer and needs `elicitation.form`; one without (a URL-mode
+ * accept, a decline, a cancel) needs `elicitation` in any mode. A sampling
+ * result holding a `tool_use` or `tool_result` block answers a tool-enabled
+ * request and needs `sampling.tools`; any other needs `sampling`. A roots
+ * result needs `roots`. `undefined` for an entry the SDK's classifier reads as
+ * no kind.
+ *
+ * `content` is read off the raw `entry`, not the view: the view keeps it only
+ * when it is an object, while `ctx.inputs.responses` exposes the entry as sent.
+ */
+function responseRequirement(view, entry) {
+    switch (view.kind) {
+        case 'elicit':
+            return entry.content === undefined
+                ? { capability: 'elicitation' }
+                : { capability: 'elicitation', member: 'form' };
+        case 'sampling':
+            return carriesToolBlock(view.result.content)
+                ? { capability: 'sampling', member: 'tools' }
+                : { capability: 'sampling' };
+        case 'roots':
+            return { capability: 'roots' };
+        default:
+            return;
+    }
+}
+/**
+ * The entries of `responses` the client's declared capabilities cover, at the
+ * same mode level the gate applies to requests ({@link responseRequirement},
+ * {@link isDeclared}), or `undefined` when none survives.
+ *
+ * The SDK lifts `inputResponses` off every client request, a first call and a
+ * 2025-era request included, so a client can arrive pre-answered with no
+ * `input_required` result ever sent. An answer the client's modes do not cover
+ * cannot have come from a round this server asked for: on the 2025 arm the
+ * legacy shim only issues requests the connection declared, and on 2026-07-28
+ * the SDK refuses an embedded request the envelope does not cover. Dropping
+ * those closes the pre-answered consent-gate bypass — a URL-only client's form
+ * answer included — without touching a legitimate round. With no view
+ * (`declared` undefined) nothing survives, and an entry the SDK's classifier
+ * cannot read as any kind has no capability to justify it either.
+ */
+export function declaredResponses(responses, declared) {
+    if (responses === undefined || declared === undefined)
+        return;
+    const kept = Object.entries(responses).filter(([key, entry]) => {
+        const requirement = responseRequirement(inputResponse(responses, key), entry);
+        return requirement !== undefined && isDeclared(requirement, declared);
+    });
+    return kept.length > 0 ? Object.fromEntries(kept) : undefined;
+}
 /**
- * Builds the `ctx.inputs` reader over a retried request's `inputResponses`.
+ * Builds the `ctx.inputs` reader over a retried request's `inputResponses`,
+ * keeping only the answers `declared` covers ({@link declaredResponses}).
  *
  * Values arrive from the client and are never re-validated by the SDK — pass a
  * schema to `accepted()` wherever the content matters.
  */
-export function createContextInputs(mcpReq) {
-    return contextInputsFrom(mcpReq?.inputResponses, mcpReq?.droppedInputResponseKeys ?? [], () => mcpReq?.requestState());
+export function createContextInputs(mcpReq, declared) {
+    return contextInputsFrom(declaredResponses(mcpReq?.inputResponses, declared), mcpReq?.droppedInputResponseKeys ?? [], () => mcpReq?.requestState());
 }
 /**
  * The `ctx.inputs` reader over an explicit set of responses — what
@@ -201,4 +291,79 @@ export function contextInputsFrom(responses, dropped, state) {
         view: (key) => inputResponse(responses, key),
     };
 }
+// ---------------------------------------------------------------------------
+// requestState sealing (MCP_REQUEST_STATE_KEY)
+// ---------------------------------------------------------------------------
+/**
+ * How long a sealed `requestState` verifies, in seconds. Longer than the SDK
+ * legacy shim's 600 s per-round timeout, so a 2025-era round the shim holds
+ * open never outlives its own state; the codec's 600 s default leaves no
+ * margin.
+ */
+const REQUEST_STATE_TTL_SECONDS = 900;
+/** The shortest key the SDK codec accepts, in UTF-8 bytes. */
+const REQUEST_STATE_KEY_MIN_BYTES = 32;
+/**
+ * The principal a sealed state is bound to: the request's authenticated
+ * `clientId`, `subject`, and `tenantId`, each empty when absent — as they all
+ * are on stdio and under `MCP_AUTH_MODE=none`. The codec stores an HMAC tag of
+ * it, never the value.
+ */
+function principalOf(ctx) {
+    const auth = ctx.http?.authInfo;
+    return JSON.stringify([auth?.clientId ?? '', auth?.subject ?? '', auth?.tenantId ?? '']);
+}
+/**
+ * The process's sealer, or `undefined` when no key is configured — in which
+ * case nothing reaches the SDK and handlers read the raw wire string, exactly
+ * as before the option existed. There is deliberately no per-process random
+ * key: a 2026-07-28 retry can land on another instance or outlive a restart,
+ * and every instance that may receive an echoed state needs the same key.
+ *
+ * @throws {McpError} `ConfigurationError` naming `MCP_REQUEST_STATE_KEY` when
+ *   the key is shorter than 32 UTF-8 bytes. The key itself is never included.
+ */
+export function createRequestStateSealer(key) {
+    if (key === undefined)
+        return;
+    if (new TextEncoder().encode(key).byteLength < REQUEST_STATE_KEY_MIN_BYTES) {
+        throw configurationError(`MCP_REQUEST_STATE_KEY must be at least ${REQUEST_STATE_KEY_MIN_BYTES} bytes. Set a longer random secret, shared by every instance that serves this server, or unset it.`, { variable: 'MCP_REQUEST_STATE_KEY', minimumBytes: REQUEST_STATE_KEY_MIN_BYTES });
+    }
+    const codec = createRequestStateCodec({
+        key,
+        ttlSeconds: REQUEST_STATE_TTL_SECONDS,
+        bind: principalOf,
+    });
+    return {
+        async seal(result, ctx) {
+            if (typeof result.requestState !== 'string')
+                return result;
+            return { ...result, requestState: await codec.mint(result.requestState, ctx) };
+        },
+        verify: (state, ctx) => codec.verify(state, ctx),
+    };
+}
+/**
+ * What a handler factory rethrows for a value its handler threw: an
+ * input-required signal carrying its `requestState` sealed when `sealer` is
+ * configured, anything else unchanged.
+ *
+ * The factories call it inside the measured region, where the signal is
+ * rethrown. Minting can reject — WebCrypto failing, or no request context for
+ * the principal binding — and a rejection there would escape the factory with
+ * no error envelope, no failure record, and no request id. It resolves to an
+ * `InternalError` instead, so the call fails through the family's ordinary
+ * error path; the codec's error rides as `cause` into the server log only, and
+ * no part of the key reaches it.
+ */
+export async function sealThrown(thrown, sealer, ctx) {
+    if (sealer === undefined || !isInputRequiredSignal(thrown))
+        return thrown;
+    try {
+        return new InputRequiredSignal(await sealer.seal(thrown.result, ctx));
+    }
+    catch (error) {
+        return internalError('Could not seal the requestState of an input_required result.', undefined, { cause: error });
+    }
+}
 //# sourceMappingURL=inputRequired.js.map