@frontmcp/sdk 1.5.7 → 1.6.1

package/transport/mcp-20260728/result-decorator.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Result shaping for protocol 2026-07-28.
+ *
+ * Three additions ride on every response of this revision:
+ * - `resultType` — REQUIRED on all results, so the client can tell a final
+ *   result from an MRTR interim one without guessing.
+ * - `_meta["io.modelcontextprotocol/serverInfo"]` — the identity that used to
+ *   arrive once via `initialize`.
+ * - `ttlMs` + `cacheScope` — REQUIRED on `CacheableResult` methods only.
+ *
+ * Applied at the dispatcher boundary rather than inside each handler, so the
+ * existing handlers (shared with every older transport) stay untouched and no
+ * legacy response can accidentally grow these fields.
+ */
+import { type Implementation } from '@frontmcp/protocol';
+export interface DecorateResultOptions {
+    /** JSON-RPC method that produced this result. */
+    method: string;
+    /** Server identity advertised back to the client. */
+    serverInfo: Implementation;
+    /**
+     * `private` when the payload may vary by authorization context, `public` when
+     * it is identical for every caller. Getting this wrong lets a shared proxy
+     * serve one tenant's tool list to another, so the default is `private`.
+     */
+    cacheScope?: 'public' | 'private';
+    /** Override for the per-method TTL default. */
+    ttlMs?: number;
+    /**
+     * OpenTelemetry context to echo back (SEP-414).
+     *
+     * Propagating `traceparent` on the response lets a client stitch its span to
+     * the server's without an out-of-band correlation id.
+     */
+    traceContext?: Record<string, string>;
+}
+/** Attach the 2026-07-28 envelope fields to a handler's raw result. */
+export declare function decorateResult(result: Record<string, unknown>, options: DecorateResultOptions): Record<string, unknown>;
+/**
+ * Sort list entries by name so repeated calls agree byte-for-byte.
+ *
+ * 2026-07-28 asks servers to return `tools/list` in a deterministic order so
+ * clients can cache and so an LLM's prompt cache keeps hitting. Registration
+ * order is already stable in practice, but it shifts the moment a tool is
+ * registered dynamically — sorting makes the guarantee explicit.
+ *
+ * Applied only on the 2026 path; older revisions keep their existing order.
+ *
+ * Ordering is guaranteed WITHIN a page. Concatenating paginated pages does not
+ * yield a globally sorted list — the cursor defines page boundaries, and this
+ * sorts each page as it is returned.
+ */
+export declare function orderListResult(method: string, result: Record<string, unknown>): Record<string, unknown>;
+/**
+ * Choose a cache scope for a request.
+ *
+ * Anonymous/public traffic carries no per-user variation and is safe to share;
+ * anything tied to a token is `private` so intermediaries cannot cross
+ * authorization contexts.
+ */
+export declare function resolveCacheScope(isAnonymous: boolean): 'public' | 'private';
+//# sourceMappingURL=result-decorator.d.ts.map

package/transport/mcp-20260728/result-decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"result-decorator.d.ts","sourceRoot":"","sources":["../../../src/transport/mcp-20260728/result-decorator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAI5E,MAAM,WAAW,qBAAqB;IACpC,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,qDAAqD;IACrD,UAAU,EAAE,cAAc,CAAC;IAC3B;;;;OAIG;IACH,UAAU,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IAClC,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC;AAED,uEAAuE;AACvE,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,OAAO,EAAE,qBAAqB,GAC7B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAsBzB;AAUD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAcxG;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,OAAO,GAAG,QAAQ,GAAG,SAAS,CAE5E"}

package/transport/mcp-20260728/subscriptions.d.ts

@@ -0,0 +1,47 @@
+/**
+ * `subscriptions/listen` — protocol 2026-07-28, SEP-2575.
+ *
+ * Replaces the standalone HTTP GET stream and the
+ * `resources/subscribe` / `resources/unsubscribe` RPC pair with ONE long-lived
+ * POST-response stream. Two rules shape the implementation:
+ *
+ * - **Opt-in only.** The server MUST NOT push a notification type the client
+ *   did not name in the request's filter.
+ * - **Acknowledge first.** The acknowledgement MUST be the first message
+ *   carrying the subscription's id, so a client never sees a change
+ *   notification before it knows which of its requests was honored.
+ *
+ * The stream is produced as an `AsyncIterable<Uint8Array>` of SSE frames rather
+ * than by writing to a runtime-specific response object, so the same code
+ * renders on Node and on a Web `Response` body.
+ */
+import { type SubscriptionFilter } from '@frontmcp/protocol';
+import { type Scope } from '../../scope';
+export interface SubscriptionStreamOptions {
+    scope: Scope;
+    /** JSON-RPC id of the `subscriptions/listen` request; doubles as the stream id. */
+    subscriptionId: string | number;
+    /** Notification types the client asked for. */
+    requested: SubscriptionFilter;
+    /** Fires when the client disconnects so the registry listeners are released. */
+    signal?: AbortSignal;
+}
+/**
+ * Narrow the client's filter to what this scope can actually deliver.
+ *
+ * A server that has no prompts cannot honor `promptsListChanged`; the spec says
+ * to omit it from the acknowledgement rather than accept and stay silent, so
+ * the client knows not to wait for it.
+ */
+export declare function resolveAcknowledgedFilter(scope: Scope, requested: SubscriptionFilter): SubscriptionFilter;
+/**
+ * Build the SSE body for a `subscriptions/listen` request.
+ *
+ * Returns the acknowledged filter alongside the stream so the caller can log or
+ * assert on it without consuming the stream.
+ */
+export declare function createSubscriptionStream(options: SubscriptionStreamOptions): {
+    acknowledged: SubscriptionFilter;
+    stream: AsyncIterable<Uint8Array>;
+};
+//# sourceMappingURL=subscriptions.d.ts.map

package/transport/mcp-20260728/subscriptions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"subscriptions.d.ts","sourceRoot":"","sources":["../../../src/transport/mcp-20260728/subscriptions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAwD,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAEnH,OAAO,EAAE,KAAK,KAAK,EAAE,MAAM,aAAa,CAAC;AAKzC,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,KAAK,CAAC;IACb,mFAAmF;IACnF,cAAc,EAAE,MAAM,GAAG,MAAM,CAAC;IAChC,+CAA+C;IAC/C,SAAS,EAAE,kBAAkB,CAAC;IAC9B,gFAAgF;IAChF,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,kBAAkB,GAAG,kBAAkB,CAiBzG;AAsBD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,yBAAyB,GAAG;IAC5E,YAAY,EAAE,kBAAkB,CAAC;IACjC,MAAM,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;CACnC,CA2GA"}

package/transport/mcp-20260728/tasks-extension.d.ts

@@ -0,0 +1,90 @@
+/**
+ * `io.modelcontextprotocol/tasks` extension — protocol 2026-07-28, SEP-2663.
+ *
+ * Tasks moved out of the core protocol into an official extension and were
+ * redesigned:
+ *
+ * - The blocking `tasks/result` is gone; clients poll `tasks/get`.
+ * - `tasks/list` is gone entirely.
+ * - `tasks/update` is new — it feeds `inputResponses` to a task that has paused
+ *   in `input_required`, which is how a long-running operation does
+ *   human-in-the-loop without a second connection.
+ * - Servers MAY return a task handle unsolicited; there is no per-request
+ *   `params.task` opt-in any more. The gate is the CLIENT declaring the
+ *   extension in its per-request capabilities.
+ *
+ * The wire shape also renames `ttl` → `ttlMs` and `pollInterval` → `pollIntervalMs`,
+ * and a task-bearing response is discriminated by `resultType: "task"` rather
+ * than by a `task` field on a normal result.
+ */
+import { type Scope } from '../../scope';
+import { type TaskRecord } from '../../task/task.types';
+/** Extension identifier, as declared in capabilities. */
+export declare const TASKS_EXTENSION_ID = "io.modelcontextprotocol/tasks";
+/** RPCs this extension defines. */
+export declare const TASKS_EXTENSION_METHODS: string[];
+/** Terminal statuses — a task in one of these never changes again. */
+export declare const TERMINAL_TASK_STATUSES: string[];
+/** True when the client declared support for the tasks extension on this request. */
+export declare function clientSupportsTasks(clientCapabilities: Record<string, unknown>): boolean;
+/**
+ * Project a stored task onto the 2026-07-28 `Task` wire shape.
+ *
+ * `result` / `error` only appear once the task is terminal, and `inputRequests`
+ * only while it is paused waiting for the client — mirroring what the client is
+ * actually allowed to act on at each point in the lifecycle.
+ */
+export declare function taskToWire20260728(record: TaskRecord): Record<string, unknown>;
+/**
+ * Build the `CreateTaskResult` a server returns instead of an inline result.
+ *
+ * Discriminated by `resultType: "task"`, which is why the shared result
+ * decorator must not overwrite it.
+ */
+export declare function buildCreateTaskResult(record: TaskRecord): Record<string, unknown>;
+/**
+ * Derive the owner key a task is stored under.
+ *
+ * 2026-07-28 has no protocol-level sessions, so a task must be keyed by
+ * something that survives across independent requests — the authenticated
+ * principal. Anonymous callers have no such identity: two unrelated users would
+ * share one key and could read each other's task results, so tasks are refused
+ * rather than silently pooled.
+ */
+export declare function resolveTaskOwner(principal: string): {
+    ok: true;
+    owner: string;
+} | {
+    ok: false;
+    reason: string;
+};
+export type TasksDispatchOutcome = {
+    kind: 'result';
+    result: Record<string, unknown>;
+} | {
+    kind: 'error';
+    status: number;
+    error: {
+        code: number;
+        message: string;
+        data?: unknown;
+    };
+};
+export interface TasksDispatchOptions {
+    scope: Scope;
+    method: string;
+    params: Record<string, unknown>;
+    /** Owner key the task is stored under (see {@link resolveTaskOwner}). */
+    owner: string;
+    /** Re-runs a resumed task in the background. */
+    resume: (record: TaskRecord) => Promise<void>;
+}
+/**
+ * Serve `tasks/get`, `tasks/update` and `tasks/cancel`.
+ *
+ * These read and mutate the SAME store the 2025-era task methods use, so a
+ * task created under either revision is visible to the other — only the wire
+ * shape and the method set differ.
+ */
+export declare function dispatchTasksMethod(options: TasksDispatchOptions): Promise<TasksDispatchOutcome>;
+//# sourceMappingURL=tasks-extension.d.ts.map

package/transport/mcp-20260728/tasks-extension.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tasks-extension.d.ts","sourceRoot":"","sources":["../../../src/transport/mcp-20260728/tasks-extension.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,KAAK,KAAK,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAExD,yDAAyD;AACzD,eAAO,MAAM,kBAAkB,kCAAkC,CAAC;AAElE,mCAAmC;AACnC,eAAO,MAAM,uBAAuB,UAAgD,CAAC;AAErF,sEAAsE;AACtE,eAAO,MAAM,sBAAsB,UAAuC,CAAC;AAE3E,qFAAqF;AACrF,wBAAgB,mBAAmB,CAAC,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAIxF;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAuB9E;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAKjF;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAS/G;AAED,MAAM,MAAM,oBAAoB,GAC5B;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GACnD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,CAAC;AAEhG,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,KAAK,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAC;IACd,gDAAgD;IAChD,MAAM,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAID;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA0EtG"}

package/transport/mcp-handlers/call-tool-request.handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"call-tool-request.handler.d.ts","sourceRoot":"","sources":["../../../src/transport/mcp-handlers/call-tool-request.handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,cAAc,EACpB,MAAM,oBAAoB,CAAC;AAW5B,OAAO,EAAE,KAAK,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAE/E,MAAM,CAAC,OAAO,UAAU,sBAAsB,CAAC,EAC7C,KAAK,GACN,EAAE,iBAAiB,GAAG,UAAU,CAAC,eAAe,EAAE,cAAc,CAAC,CAyEjE"}
+{"version":3,"file":"call-tool-request.handler.d.ts","sourceRoot":"","sources":["../../../src/transport/mcp-handlers/call-tool-request.handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,cAAc,EACpB,MAAM,oBAAoB,CAAC;AAa5B,OAAO,EAAE,KAAK,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAE/E,MAAM,CAAC,OAAO,UAAU,sBAAsB,CAAC,EAC7C,KAAK,GACN,EAAE,iBAAiB,GAAG,UAAU,CAAC,eAAe,EAAE,cAAc,CAAC,CAmFjE"}