@frontmcp/sdk 1.5.6 → 1.6.0

package/transport/mcp-20260728/client/mcp-stateless.client.d.ts

@@ -0,0 +1,157 @@
+/**
+ * MCP client for protocol revision 2026-07-28.
+ *
+ * The upstream `@modelcontextprotocol/sdk` client speaks at most `2025-11-25`,
+ * so talking to a 2026 server needs its own implementation. It is small on
+ * purpose — the revision is stateless, so there is no session, no handshake and
+ * no reconnect logic to manage. What it DOES own is the three behaviours a
+ * conforming client must implement:
+ *
+ * - **Request metadata.** Per-request `_meta` plus the mirrored
+ *   `MCP-Protocol-Version` / `Mcp-Method` / `Mcp-Name` / `Mcp-Param-*` headers.
+ * - **MRTR.** An `input_required` result is answered by gathering the requested
+ *   input and re-issuing the ORIGINAL request — with a NEW JSON-RPC id and the
+ *   `requestState` echoed back verbatim.
+ * - **Tasks.** A `resultType: "task"` handle is polled through `tasks/get`
+ *   until it reaches a terminal state, answering `input_required` along the way
+ *   via `tasks/update`.
+ *
+ * @module transport/mcp-20260728/client
+ */
+import { type Implementation } from '@frontmcp/protocol';
+import { TERMINAL_TASK_STATUSES } from '../tasks-extension';
+/** Answers the client supplies when a server asks for input via MRTR. */
+export interface McpStatelessInputHandlers {
+    /** Handle an `elicitation/create` request. */
+    onElicit?: (params: Record<string, unknown>) => Promise<Record<string, unknown>> | Record<string, unknown>;
+    /** Handle a `sampling/createMessage` request. */
+    onSample?: (params: Record<string, unknown>) => Promise<Record<string, unknown>> | Record<string, unknown>;
+    /** Handle a `roots/list` request. */
+    onListRoots?: () => Promise<{
+        roots: Array<{
+            uri: string;
+            name?: string;
+        }>;
+    }> | {
+        roots: Array<{
+            uri: string;
+            name?: string;
+        }>;
+    };
+}
+export interface McpStatelessClientOptions {
+    /** The MCP endpoint URL. */
+    url: string;
+    clientInfo?: Implementation;
+    /** Capabilities declared on EVERY request (they are per-request in this revision). */
+    capabilities?: Record<string, unknown>;
+    /** Extra headers (e.g. `Authorization`) sent with every request. */
+    headers?: Record<string, string>;
+    /** Log level to opt into; omit to receive no `notifications/message`. */
+    logLevel?: string;
+    /** Called for every notification received on a response stream. */
+    onNotification?: (notification: {
+        method: string;
+        params?: Record<string, unknown>;
+    }) => void;
+    /** How the client answers MRTR input requests. */
+    handlers?: McpStatelessInputHandlers;
+    /** Maximum MRTR round trips before giving up, guarding against a server that never settles. */
+    maxInputRounds?: number;
+    /**
+     * Per-request timeout in milliseconds.
+     *
+     * Without one an unreachable or hung remote leaves every call pending
+     * forever — including the `server/discover` probe used to negotiate the
+     * protocol, which would then never fall back.
+     */
+    requestTimeoutMs?: number;
+    /** Injected for tests. */
+    fetchImpl?: typeof fetch;
+}
+export declare class McpStatelessError extends Error {
+    readonly code: number;
+    readonly data?: unknown | undefined;
+    constructor(code: number, message: string, data?: unknown | undefined);
+}
+export declare class McpStatelessClient {
+    private nextId;
+    private readonly options;
+    /** Cached tool input schemas, needed to derive `Mcp-Param-*` headers. */
+    private toolSchemas;
+    constructor(options: McpStatelessClientOptions);
+    private get fetchImpl();
+    /** Ask the server which versions, capabilities and identity it offers. */
+    discover(): Promise<Record<string, unknown>>;
+    /**
+     * List tools, dropping any whose `x-mcp-header` annotations are invalid.
+     *
+     * The spec requires this: one malformed tool definition must not prevent the
+     * other tools from being used, so the offender is excluded and logged rather
+     * than failing the call.
+     */
+    listTools(): Promise<Array<Record<string, unknown>>>;
+    callTool(name: string, args?: Record<string, unknown>): Promise<Record<string, unknown>>;
+    readResource(uri: string): Promise<Record<string, unknown>>;
+    listResources(): Promise<Record<string, unknown>>;
+    listPrompts(): Promise<Record<string, unknown>>;
+    getPrompt(name: string, args?: Record<string, string>): Promise<Record<string, unknown>>;
+    /**
+     * Issue a request, resolving MRTR round trips and task handles transparently.
+     *
+     * The caller sees a single promise for the FINAL result, which is the whole
+     * point of centralising this: every entry point would otherwise need its own
+     * retry loop.
+     */
+    request(method: string, params?: Record<string, unknown>): Promise<Record<string, unknown>>;
+    /** Fulfil each `inputRequests` entry using the configured handlers. */
+    private gatherInputs;
+    /**
+     * Poll a task handle to a terminal state, answering mid-flight input requests.
+     *
+     * Honours the server's `pollIntervalMs` hint rather than picking our own
+     * cadence — the server knows how long its work takes.
+     */
+    private awaitTask;
+    /** Cancel a running task. */
+    cancelTask(taskId: string): Promise<void>;
+    /**
+     * Open a `subscriptions/listen` stream.
+     *
+     * Resolves once the server acknowledges the subscription, so callers know
+     * which notification types were actually honoured before they start waiting
+     * on them.
+     */
+    listen(notifications: Record<string, unknown>, onNotification: (notification: {
+        method: string;
+        params?: Record<string, unknown>;
+    }) => void): Promise<{
+        acknowledged: Record<string, unknown>;
+        close: () => void;
+    }>;
+    /** Build and issue one JSON-RPC request, returning its result. */
+    private send;
+    /** Assemble the JSON-RPC body and its mirrored HTTP headers. */
+    private buildRequest;
+    private deriveName;
+    /**
+     * Read either framing the server may choose.
+     *
+     * A JSON body is the response outright; an SSE body carries this request's
+     * notifications followed by the final response, so notifications are forwarded
+     * as they arrive and the terminating message is returned.
+     */
+    private readResponse;
+    /** Drain an SSE body, handing each decoded JSON message to `onMessage`. */
+    private pumpSse;
+    private warn;
+}
+/** Convenience: the capability object a client declaring the tasks extension sends. */
+export declare const TASKS_CLIENT_CAPABILITY: {
+    extensions: {
+        "io.modelcontextprotocol/tasks": {};
+    };
+};
+/** Re-exported so callers can check task terminality without importing the extension module. */
+export { TERMINAL_TASK_STATUSES };
+//# sourceMappingURL=mcp-stateless.client.d.ts.map

package/transport/mcp-20260728/client/mcp-stateless.client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-stateless.client.d.ts","sourceRoot":"","sources":["../../../../src/transport/mcp-20260728/client/mcp-stateless.client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAA0C,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAIjG,OAAO,EAAsB,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAGhF,yEAAyE;AACzE,MAAM,WAAW,yBAAyB;IACxC,8CAA8C;IAC9C,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3G,iDAAiD;IACjD,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3G,qCAAqC;IACrC,WAAW,CAAC,EAAE,MACV,OAAO,CAAC;QAAE,KAAK,EAAE,KAAK,CAAC;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC,GACzD;QAAE,KAAK,EAAE,KAAK,CAAC;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;CACtD;AAED,MAAM,WAAW,yBAAyB;IACxC,4BAA4B;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,sFAAsF;IACtF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,yEAAyE;IACzE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,cAAc,CAAC,EAAE,CAAC,YAAY,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,KAAK,IAAI,CAAC;IAC9F,kDAAkD;IAClD,QAAQ,CAAC,EAAE,yBAAyB,CAAC;IACrC,+FAA+F;IAC/F,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,0BAA0B;IAC1B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,qBAAa,iBAAkB,SAAQ,KAAK;IAExC,QAAQ,CAAC,IAAI,EAAE,MAAM;IAErB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO;gBAFd,IAAI,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM,EACN,IAAI,CAAC,EAAE,OAAO,YAAA;CAK1B;AAUD,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,MAAM,CAAK;IACnB,OAAO,CAAC,QAAQ,CAAC,OAAO,CACI;IAC5B,yEAAyE;IACzE,OAAO,CAAC,WAAW,CAA8B;gBAErC,OAAO,EAAE,yBAAyB;IAU9C,OAAO,KAAK,SAAS,GAEpB;IAED,0EAA0E;IACpE,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAIlD;;;;;;OAMG;IACG,SAAS,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAiBpD,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAI5F,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAI3D,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAIjD,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAI/C,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAIlG;;;;;;OAMG;IACG,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IA6BrG,uEAAuE;YACzD,YAAY;IAkC1B;;;;;OAKG;YACW,SAAS;IAoCvB,6BAA6B;IACvB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/C;;;;;;OAMG;IACG,MAAM,CACV,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACtC,cAAc,EAAE,CAAC,YAAY,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,KAAK,IAAI,GAC3F,OAAO,CAAC;QAAE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,KAAK,EAAE,MAAM,IAAI,CAAA;KAAE,CAAC;IAsDxE,kEAAkE;YACpD,IAAI;IAgClB,gEAAgE;IAChE,OAAO,CAAC,YAAY;IAmCpB,OAAO,CAAC,UAAU;IAMlB;;;;;;OAMG;YACW,YAAY;IAsB1B,2EAA2E;YAC7D,OAAO;IAmCrB,OAAO,CAAC,IAAI;CAGb;AAED,uFAAuF;AACvF,eAAO,MAAM,uBAAuB;;;;CAA+C,CAAC;AAEpF,gGAAgG;AAChG,OAAO,EAAE,sBAAsB,EAAE,CAAC"}

package/transport/mcp-20260728/discover.d.ts

@@ -0,0 +1,28 @@
+/**
+ * `server/discover` — protocol 2026-07-28, SEP-2575.
+ *
+ * Servers MUST implement this RPC. It advertises the versions the server
+ * speaks, its capabilities, and its instructions — the payload `initialize`
+ * used to return, minus everything that only made sense for a session.
+ *
+ * Clients MAY skip it entirely and negotiate inline via per-request `_meta`,
+ * which is why it must be cheap and side-effect free.
+ */
+import { type DiscoverResult, type ServerCapabilities20260728 } from '@frontmcp/protocol';
+import { type Scope } from '../../scope';
+/**
+ * Project the scope's capability set into the 2026-07-28 shape.
+ *
+ * The only structural change is `extensions`: this revision promotes optional
+ * MCP extensions out of `experimental` into a first-class field, so anything
+ * the scope already advertises is merged with the server-level extension list.
+ */
+export declare function buildDiscoverCapabilities(scope: Scope): ServerCapabilities20260728;
+/**
+ * Build the `server/discover` result body.
+ *
+ * `resultType`, `_meta.serverInfo`, `ttlMs` and `cacheScope` are added by the
+ * shared result decorator, so this returns only the method-specific fields.
+ */
+export declare function buildDiscoverResult(scope: Scope, instructions?: string): Omit<DiscoverResult, keyof object>;
+//# sourceMappingURL=discover.d.ts.map

package/transport/mcp-20260728/discover.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discover.d.ts","sourceRoot":"","sources":["../../../src/transport/mcp-20260728/discover.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,KAAK,cAAc,EAAE,KAAK,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAE1F,OAAO,EAAE,KAAK,KAAK,EAAE,MAAM,aAAa,CAAC;AAIzC;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,KAAK,GAAG,0BAA0B,CAmBlF;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,KAAK,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,MAAM,MAAM,CAAC,CAQ3G"}

package/transport/mcp-20260728/dispatcher.d.ts

@@ -0,0 +1,77 @@
+import { type FrontMcpContext } from '../../context';
+import { type Scope } from '../../scope';
+import { type RequestNotificationSink } from './request-notifications';
+import { type JsonRpcErrorPayload } from './request-validation';
+export interface DispatchOptions {
+    scope: Scope;
+    /** The validated JSON-RPC request body. */
+    body: Record<string, unknown>;
+    /** Capabilities the client declared in this request's `_meta`. */
+    clientCapabilities: Record<string, unknown>;
+    /** Ambient request context, used to carry the MRTR exchange to `elicit()`. */
+    frontmcpContext?: FrontMcpContext;
+    /** Auth info forwarded to the shared handlers. */
+    authInfo?: Record<string, unknown>;
+    /** True when the caller is unauthenticated, which makes results publicly cacheable. */
+    isAnonymous: boolean;
+    signal?: AbortSignal;
+    /** Lazily composed instructions for `server/discover`. */
+    composeInstructions?: () => string | undefined;
+    /** Collects `notifications/message` + `notifications/progress` for this request. */
+    notificationSink?: RequestNotificationSink;
+    /** OpenTelemetry context echoed back on the result (SEP-414). */
+    traceContext?: Record<string, string>;
+}
+export type DispatchResult = {
+    kind: 'result';
+    result: Record<string, unknown>;
+} | {
+    kind: 'error';
+    status: number;
+    error: JsonRpcErrorPayload;
+};
+/**
+ * Requests that MAY return an `InputRequiredResult`.
+ *
+ * The spec enumerates these three and adds "Servers MUST NOT send
+ * `InputRequiredResult` responses on any other client requests."
+ */
+export declare const MRTR_CAPABLE_METHODS: readonly ["tools/call", "prompts/get", "resources/read"];
+/**
+ * Identify the caller for `requestState` binding.
+ *
+ * Falls back to a fixed anonymous marker rather than a random value: public
+ * servers must still be able to redeem their own state on the retry, and there
+ * is no principal to separate anonymous callers by.
+ */
+export declare function resolvePrincipal(authInfo: Record<string, unknown> | undefined): string;
+/**
+ * Identify the caller for TASK ownership.
+ *
+ * Stricter than {@link resolvePrincipal}: a public-mode server mints an
+ * anonymous bootstrap token per request, which is a fine binding for a
+ * short-lived `requestState` but must NOT be mistaken for an identity that can
+ * own a durable task. Anonymous callers resolve to `'anonymous'` so task
+ * creation is refused rather than pooled across unrelated users.
+ */
+export declare function resolveTaskPrincipal(authInfo: Record<string, unknown> | undefined, isAnonymous?: boolean): string;
+/**
+ * Map a thrown error onto a JSON-RPC error payload.
+ *
+ * The one substantive change from earlier revisions is resource-not-found:
+ * `-32002` was retired in favour of `-32602` to align with JSON-RPC. Because
+ * the shared handlers still raise the old code (they serve legacy clients too),
+ * the translation happens here rather than at the source.
+ */
+export declare function toJsonRpcError(error: unknown): {
+    status: number;
+    error: JsonRpcErrorPayload;
+};
+/**
+ * Dispatch one 2026-07-28 JSON-RPC request.
+ *
+ * `subscriptions/listen` is NOT handled here — it needs to own the HTTP
+ * response as a stream, so the flow handles it before calling in.
+ */
+export declare function dispatch20260728(options: DispatchOptions): Promise<DispatchResult>;
+//# sourceMappingURL=dispatcher.d.ts.map

package/transport/mcp-20260728/dispatcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatcher.d.ts","sourceRoot":"","sources":["../../../src/transport/mcp-20260728/dispatcher.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,OAAO,EAAE,KAAK,KAAK,EAAE,MAAM,aAAa,CAAC;AAMzC,OAAO,EAAE,KAAK,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAEvE,OAAO,EAAE,KAAK,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAWhE,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,KAAK,CAAC;IACb,2CAA2C;IAC3C,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,kEAAkE;IAClE,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,8EAA8E;IAC9E,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,uFAAuF;IACvF,WAAW,EAAE,OAAO,CAAC;IACrB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,0DAA0D;IAC1D,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IAC/C,oFAAoF;IACpF,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IAC3C,iEAAiE;IACjE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GACnD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,mBAAmB,CAAA;CAAE,CAAC;AAElE;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,0DAA2D,CAAC;AAE7F;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,MAAM,CAWtF;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAAE,WAAW,UAAQ,GAAG,MAAM,CAS/G;AAqGD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,mBAAmB,CAAA;CAAE,CA2B7F;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAqKxF"}

package/transport/mcp-20260728/header-codec.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Value encoding for the mirrored HTTP headers of protocol 2026-07-28.
+ *
+ * HTTP field values are limited to visible ASCII, so a tool name, resource URI,
+ * or parameter value that falls outside that set travels Base64-wrapped in the
+ * `=?base64?…?=` sentinel. Servers MUST decode before comparing to the body —
+ * a naive string compare would reject every conforming client that had to
+ * encode, and would accept a crafted literal that merely LOOKS encoded.
+ */
+/** True when `value` is wrapped in the (case-sensitive, lowercase) sentinel. */
+export declare function isSentinelEncoded(value: string): boolean;
+/**
+ * Decode a mirrored header value.
+ *
+ * Returns `undefined` when the sentinel is present but the payload is not valid
+ * Base64/UTF-8 — the caller turns that into a `HeaderMismatch` rather than
+ * silently comparing garbage.
+ */
+export declare function decodeHeaderValue(value: string): string | undefined;
+/** Encode a value for a mirrored header, wrapping it only when necessary. */
+export declare function encodeHeaderValue(value: string): string;
+/** True when a raw header value contains octets HTTP does not permit. */
+export declare function hasInvalidHeaderChars(value: string): boolean;
+/**
+ * Compare a decoded header value against the value found in the request body.
+ *
+ * Numbers are compared numerically per the spec note (`42` and `42.0` are
+ * equal); booleans use their lowercase spelling; everything else is an exact
+ * string match.
+ */
+export declare function headerMatchesBodyValue(headerValue: string, bodyValue: unknown): boolean;
+//# sourceMappingURL=header-codec.d.ts.map

package/transport/mcp-20260728/header-codec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"header-codec.d.ts","sourceRoot":"","sources":["../../../src/transport/mcp-20260728/header-codec.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,gFAAgF;AAChF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAMxD;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAanE;AAED,6EAA6E;AAC7E,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAIvD;AAKD,yEAAyE;AACzE,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAU5D;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,OAAO,CASvF"}

package/transport/mcp-20260728/index.d.ts

@@ -0,0 +1,22 @@
+/**
+ * MCP protocol revision 2026-07-28 support.
+ *
+ * Everything in here is additive: a request is only routed through this module
+ * when it explicitly declares the 2026-07-28 revision (or uses a method that
+ * exists only in it). Every earlier revision keeps its original code path.
+ *
+ * @module transport/mcp-20260728
+ */
+export * from './protocol-20260728.constants';
+export * from './header-codec';
+export * from './request-validation';
+export * from './request-state';
+export * from './request-notifications';
+export * from './result-decorator';
+export * from './discover';
+export * from './mrtr';
+export * from './subscriptions';
+export * from './tasks-extension';
+export * from './dispatcher';
+export * from './client';
+//# sourceMappingURL=index.d.ts.map

package/transport/mcp-20260728/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/transport/mcp-20260728/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,cAAc,+BAA+B,CAAC;AAC9C,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,YAAY,CAAC;AAC3B,cAAc,QAAQ,CAAC;AACvB,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,UAAU,CAAC"}

package/transport/mcp-20260728/mrtr.d.ts

@@ -0,0 +1,143 @@
+/**
+ * Multi Round-Trip Requests (MRTR) — protocol 2026-07-28, SEP-2322.
+ *
+ * ## How a round trip works
+ *
+ * 1. The tool calls `this.elicit(...)` / `this.sample(...)` / `this.listRoots()`.
+ *    No response is recorded for that call yet, so the exchange records the
+ *    pending request and throws {@link InputRequiredSignal}.
+ * 2. The dispatcher turns the signal into an `InputRequiredResult`
+ *    (`resultType: "input_required"`) carrying `inputRequests` and an opaque,
+ *    integrity-protected `requestState`.
+ * 3. The client gathers the input and re-issues the SAME request (with a NEW
+ *    JSON-RPC id) carrying `inputResponses` + the echoed `requestState`.
+ * 4. The entry runs again from the top. This time each call finds a recorded
+ *    answer and returns it inline, so execution proceeds.
+ *
+ * Entries are therefore replayed, not resumed — which is why keys are derived
+ * from the call ORDER (`elicit-1`, `sampling-1`, `roots-1`, …) rather than
+ * randomly: the second run must line its calls up with the first run's answers.
+ *
+ * `requestState` accumulates every answer gathered so far, so a multi-step tool
+ * converges even if the client only echoes the most recent `inputResponses`.
+ * It is signed and bound to the caller and the originating request — see
+ * {@link ./request-state}.
+ */
+import type { InputResponses } from '@frontmcp/protocol';
+import { type ElicitStatus } from '../../elicitation';
+import { InputRequiredSignal } from '../../errors';
+import { type RequestStateBinding } from './request-state';
+/** Requests the client may be asked to fulfil, and the capability each needs. */
+declare const CAPABILITY_FOR_KIND: {
+    readonly elicitation: {
+        readonly capability: "elicitation";
+        readonly required: {
+            readonly elicitation: {
+                readonly form: {};
+            };
+        };
+    };
+    readonly sampling: {
+        readonly capability: "sampling";
+        readonly required: {
+            readonly sampling: {};
+        };
+    };
+    readonly roots: {
+        readonly capability: "roots";
+        readonly required: {
+            readonly roots: {};
+        };
+    };
+};
+export type MrtrRequestKind = keyof typeof CAPABILITY_FOR_KIND;
+/** Shape recorded for a pending elicitation before it becomes an input request. */
+export interface PendingElicitation {
+    message: string;
+    requestedSchema: Record<string, unknown>;
+    mode?: 'form' | 'url';
+    url?: string;
+}
+/** Parameters for a `sampling/createMessage` input request. */
+export interface PendingSampling {
+    messages: unknown[];
+    maxTokens: number;
+    systemPrompt?: string;
+    modelPreferences?: Record<string, unknown>;
+    temperature?: number;
+    stopSequences?: string[];
+    includeContext?: 'none' | 'thisServer' | 'allServers';
+    metadata?: Record<string, unknown>;
+}
+/** The client's answer to a `sampling/createMessage` request. */
+export interface SamplingAnswer {
+    role: string;
+    content: unknown;
+    model?: string;
+    stopReason?: string;
+}
+/** The client's answer to a `roots/list` request. */
+export interface RootsAnswer {
+    roots: Array<{
+        uri: string;
+        name?: string;
+    }>;
+}
+/**
+ * Per-request bookkeeping for one MRTR exchange.
+ *
+ * Lives on the `FrontMcpContext` for the duration of a single dispatch, so
+ * `elicit()` / `sample()` / `listRoots()` deep inside an entry can reach it
+ * without threading it through every flow stage.
+ */
+export declare class MrtrExchange {
+    /** Answers already supplied by the client, keyed by input-request key. */
+    private readonly responses;
+    /** Requests raised during THIS run that the client still has to answer. */
+    private readonly pending;
+    /** Per-kind call counters, used to derive stable keys across a replay. */
+    private readonly counters;
+    readonly clientCapabilities: Record<string, unknown>;
+    private readonly binding;
+    constructor(params: {
+        /** `inputResponses` from the request params. */
+        inputResponses?: InputResponses;
+        /** Answers carried over from earlier rounds via a verified `requestState`. */
+        carriedResponses?: InputResponses;
+        /** Capabilities the client declared for this request. */
+        clientCapabilities: Record<string, unknown>;
+        /** Principal + request digest that new state will be bound to. */
+        binding: RequestStateBinding;
+    });
+    /** True when the client declared the capability a given request kind needs. */
+    supports(kind: MrtrRequestKind): boolean;
+    /** True when the client declared support for elicitation in this request. */
+    supportsElicitation(mode?: 'form' | 'url'): boolean;
+    /**
+     * Look up a recorded answer for the next call of `kind`, or record the
+     * request and unwind.
+     *
+     * The spec forbids asking for something the client never said it supports, so
+     * an undeclared capability fails fast with `-32021` rather than emitting an
+     * `inputRequests` entry the client cannot honor.
+     */
+    private resolve;
+    /** Resolve the next `elicit()` call. */
+    resolveElicitation(pending: PendingElicitation): {
+        status: ElicitStatus;
+        content?: unknown;
+    };
+    /** Resolve the next `sample()` call. */
+    resolveSampling(pending: PendingSampling): SamplingAnswer;
+    /** Resolve the next `listRoots()` call. */
+    resolveRoots(): RootsAnswer;
+}
+/**
+ * Build the `InputRequiredResult` body for a raised signal.
+ *
+ * `resultType` is set here rather than by the generic result decorator because
+ * an interim result is precisely the case the decorator must not overwrite.
+ */
+export declare function buildInputRequiredResult(signal: InputRequiredSignal): Record<string, unknown>;
+export {};
+//# sourceMappingURL=mrtr.d.ts.map

package/transport/mcp-20260728/mrtr.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mrtr.d.ts","sourceRoot":"","sources":["../../../src/transport/mcp-20260728/mrtr.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EAAiB,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAExE,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAgC,MAAM,cAAc,CAAC;AACjF,OAAO,EAAsB,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAE/E,iFAAiF;AACjF,QAAA,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;CAIf,CAAC;AAEX,MAAM,MAAM,eAAe,GAAG,MAAM,OAAO,mBAAmB,CAAC;AAE/D,mFAAmF;AACnF,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,+DAA+D;AAC/D,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,GAAG,YAAY,GAAG,YAAY,CAAC;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,iEAAiE;AACjE,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,qDAAqD;AACrD,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC9C;AAiBD;;;;;;GAMG;AACH,qBAAa,YAAY;IACvB,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiB;IAE3C,2EAA2E;IAC3E,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAE7C,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA8E;IAEvG,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAErD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsB;gBAElC,MAAM,EAAE;QAClB,gDAAgD;QAChD,cAAc,CAAC,EAAE,cAAc,CAAC;QAChC,8EAA8E;QAC9E,gBAAgB,CAAC,EAAE,cAAc,CAAC;QAClC,yDAAyD;QACzD,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC5C,kEAAkE;QAClE,OAAO,EAAE,mBAAmB,CAAC;KAC9B;IAQD,+EAA+E;IAC/E,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO;IAKxC,6EAA6E;IAC7E,mBAAmB,CAAC,IAAI,GAAE,MAAM,GAAG,KAAc,GAAG,OAAO;IAY3D;;;;;;;OAOG;IACH,OAAO,CAAC,OAAO;IA0Bf,wCAAwC;IACxC,kBAAkB,CAAC,OAAO,EAAE,kBAAkB,GAAG;QAAE,MAAM,EAAE,YAAY,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE;IAmB5F,wCAAwC;IACxC,eAAe,CAAC,OAAO,EAAE,eAAe,GAAG,cAAc;IAkBzD,2CAA2C;IAC3C,YAAY,IAAI,WAAW;CAK5B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAM7F"}

package/transport/mcp-20260728/protocol-20260728.constants.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Every revision this server speaks, newest first.
+ *
+ * Advertised verbatim by `server/discover` and echoed in the `supported` array
+ * of an `UnsupportedProtocolVersionError`. The older entries are load-bearing:
+ * dropping one would strand every client that negotiated it.
+ */
+export declare const FRONTMCP_SUPPORTED_PROTOCOL_VERSIONS: readonly ["2026-07-28", "2025-11-25", "2025-06-18", "2025-03-26", "2024-11-05"];
+/**
+ * Revisions handled by the pre-existing session/`initialize` pipeline.
+ *
+ * A request declaring one of these is NOT claimed by the 2026 path, which is
+ * what keeps the old behaviour bit-for-bit identical.
+ */
+export declare const LEGACY_PROTOCOL_VERSIONS: string[];
+/** Methods that exist only in 2026-07-28. */
+export declare const PROTOCOL_20260728_ONLY_METHODS: string[];
+/** HTTP header names mirrored from the JSON-RPC body (SEP-2243). */
+export declare const MCP_HEADERS: {
+    readonly protocolVersion: "mcp-protocol-version";
+    readonly method: "mcp-method";
+    readonly name: "mcp-name";
+    /** Prefix for `x-mcp-header`-derived parameter headers. */
+    readonly paramPrefix: "mcp-param-";
+};
+/** Methods whose `Mcp-Name` header is sourced from `params.name`. */
+export declare const NAME_FROM_PARAMS_NAME: string[];
+/** Methods whose `Mcp-Name` header is sourced from `params.uri`. */
+export declare const NAME_FROM_PARAMS_URI: string[];
+/**
+ * Default `ttlMs` per cacheable method.
+ *
+ * Conservative on purpose: list endpoints change rarely and benefit most from
+ * caching, while `resources/read` is content that a server may regenerate, so
+ * it defaults to "revalidate every time" rather than risking a stale read.
+ */
+export declare const DEFAULT_CACHE_TTL_MS: Record<string, number>;
+/** Methods whose results MUST carry `ttlMs` + `cacheScope` (`CacheableResult`). */
+export declare const CACHEABLE_METHODS: string[];
+/**
+ * MCP extensions this server advertises under `capabilities.extensions`.
+ *
+ * Keys follow the `_meta` naming rules (mandatory reverse-DNS prefix).
+ */
+export declare const ADVERTISED_EXTENSIONS: Record<string, Record<string, unknown>>;
+//# sourceMappingURL=protocol-20260728.constants.d.ts.map

package/transport/mcp-20260728/protocol-20260728.constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol-20260728.constants.d.ts","sourceRoot":"","sources":["../../../src/transport/mcp-20260728/protocol-20260728.constants.ts"],"names":[],"mappings":"AAOA;;;;;;GAMG;AACH,eAAO,MAAM,oCAAoC,iFAMvC,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,UAAyE,CAAC;AAE/G,6CAA6C;AAC7C,eAAO,MAAM,8BAA8B,UAA8C,CAAC;AAE1F,oEAAoE;AACpE,eAAO,MAAM,WAAW;;;;IAItB,2DAA2D;;CAEnD,CAAC;AAEX,qEAAqE;AACrE,eAAO,MAAM,qBAAqB,UAAgC,CAAC;AAEnE,oEAAoE;AACpE,eAAO,MAAM,oBAAoB,UAAqB,CAAC;AAEvD;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAOvD,CAAC;AAEF,mFAAmF;AACnF,eAAO,MAAM,iBAAiB,UAAoC,CAAC;AAEnE;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzE,CAAC"}

package/transport/mcp-20260728/request-notifications.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Request-scoped notifications for protocol 2026-07-28.
+ *
+ * Two rules from SEP-2575 shape this:
+ *
+ * - `notifications/progress` and `notifications/message` flow on the response
+ *   stream of the request they relate to — never on the `subscriptions/listen`
+ *   stream, and never on a session channel (there are no sessions).
+ * - `logging/setLevel` is gone. The client opts in per request via
+ *   `_meta["io.modelcontextprotocol/logLevel"]`, and a server **MUST NOT** emit
+ *   `notifications/message` for a request that omitted it.
+ *
+ * The sink is attached to the `FrontMcpContext` for the duration of one
+ * dispatch, so `this.notify()` / `this.progress()` deep inside an entry reach it
+ * without any session lookup.
+ */
+import { type LoggingLevel } from '@frontmcp/protocol';
+/** True when `level` is at least as severe as the client's requested minimum. */
+export declare function meetsLogLevel(level: LoggingLevel, minimum: LoggingLevel): boolean;
+export interface QueuedRequestNotification {
+    method: string;
+    params: Record<string, unknown>;
+}
+/**
+ * Collects notifications raised while handling one request and hands them to
+ * the transport in arrival order.
+ *
+ * Deliberately unbounded-but-drained: the transport consumes as it streams, and
+ * a request that ends without streaming simply discards what it buffered (a
+ * client that asked for neither logs nor progress gets neither).
+ */
+export declare class RequestNotificationSink {
+    /** Minimum severity the client opted into, or undefined for "no logs". */
+    private readonly logLevel;
+    /** Progress token from `_meta`, or undefined for "no progress". */
+    private readonly progressToken;
+    private readonly queue;
+    private wake;
+    private finished;
+    constructor(
+    /** Minimum severity the client opted into, or undefined for "no logs". */
+    logLevel: LoggingLevel | undefined, 
+    /** Progress token from `_meta`, or undefined for "no progress". */
+    progressToken: string | number | undefined);
+    /** True when the client opted into anything at all. */
+    get active(): boolean;
+    /**
+     * Queue a log message.
+     *
+     * Dropped outright when the client did not set `logLevel` — the spec makes
+     * that a MUST NOT, not a preference.
+     */
+    log(level: LoggingLevel, logger: string | undefined, data: unknown): boolean;
+    /** Queue a progress notification, if the client supplied a progress token. */
+    progress(progress: number, total?: number, message?: string): boolean;
+    private push;
+    /** Everything queued so far, cleared from the sink. */
+    drain(): QueuedRequestNotification[];
+    /** Signal that no further notifications will be raised. */
+    close(): void;
+    /**
+     * Wait until something is queued or the sink closes.
+     *
+     * Returns immediately when work is already pending, so a fast producer never
+     * makes the consumer sleep on a non-empty queue.
+     */
+    waitForActivity(): Promise<void>;
+    get closed(): boolean;
+}
+//# sourceMappingURL=request-notifications.d.ts.map

package/transport/mcp-20260728/request-notifications.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-notifications.d.ts","sourceRoot":"","sources":["../../../src/transport/mcp-20260728/request-notifications.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAKvD,iFAAiF;AACjF,wBAAgB,aAAa,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAKjF;AAED,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED;;;;;;;GAOG;AACH,qBAAa,uBAAuB;IAMhC,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,aAAa;IARhC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAmC;IACzD,OAAO,CAAC,IAAI,CAA2B;IACvC,OAAO,CAAC,QAAQ,CAAS;;IAGvB,0EAA0E;IACzD,QAAQ,EAAE,YAAY,GAAG,SAAS;IACnD,mEAAmE;IAClD,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAG7D,uDAAuD;IACvD,IAAI,MAAM,IAAI,OAAO,CAEpB;IAED;;;;;OAKG;IACH,GAAG,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO;IAY5E,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO;IAYrE,OAAO,CAAC,IAAI;IAMZ,uDAAuD;IACvD,KAAK,IAAI,yBAAyB,EAAE;IAIpC,2DAA2D;IAC3D,KAAK,IAAI,IAAI;IAKb;;;;;OAKG;IACG,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC;IAUtC,IAAI,MAAM,IAAI,OAAO,CAEpB;CACF"}