@kya-os/mcp-i 1.6.14 → 1.6.16

package/dist/runtime/transports/http/stateless-streamable-http.js

@@ -56,7 +56,7 @@ class StatelessHttpServerTransport extends base_streamable_http_1.BaseHttpServer
         if (requestId === undefined || requestId === null) {
             // In stateless mode, we can't handle notifications without request IDs
             if (this.debug) {
-                console.log("[StatelessHTTP] Dropping notification without request ID");
+                console.error("[StatelessHTTP] Dropping notification without request ID");
             }
             return;
         }
@@ -74,6 +74,13 @@ class StatelessHttpServerTransport extends base_streamable_http_1.BaseHttpServer
                     const responseBody = collector.responses.length === 1
                         ? collector.responses[0]
                         : collector.responses;
+                    // Extract session ID from response for Mcp-Session-Id header (MCP protocol spec)
+                    const firstResponse = collector.responses[0];
+                    const sessionId = firstResponse?.result?.proof?.meta?.sessionId ||
+                        firstResponse?.result?.sessionId;
+                    if (sessionId) {
+                        headers["Mcp-Session-Id"] = sessionId;
+                    }
                     collector.res
                         .writeHead(200, headers)
                         .end(JSON.stringify(responseBody));
@@ -228,7 +235,7 @@ class StatelessStreamableHTTPTransport {
     }
     log(message, ...args) {
         if (this.debug) {
-            console.log(`[StatelessHTTP] ${message}`, ...args);
+            console.error(`[StatelessHTTP] ${message}`, ...args);
         }
     }
     setupMiddleware(bodySizeLimit) {
@@ -306,14 +313,14 @@ class StatelessStreamableHTTPTransport {
     start() {
         const host = this.options.host || "127.0.0.1";
         this.server.listen(this.port, host, () => {
-            console.log(`${cli_icons_1.greenCheck} MCP Server running on http://${host}:${this.port}${this.endpoint}`);
+            console.error(`${cli_icons_1.greenCheck} MCP Server running on http://${host}:${this.port}${this.endpoint}`);
             if (this.oauthProxy && this.debug) {
-                console.log(`🔐 OAuth endpoints available:`);
-                console.log(`   Discovery: http://${host}:${this.port}/.well-known/oauth-authorization-server`);
-                console.log(`   Authorize: http://${host}:${this.port}/oauth2/authorize`);
-                console.log(`   Token: http://${host}:${this.port}/oauth2/token`);
-                console.log(`   Revoke: http://${host}:${this.port}/oauth2/revoke`);
-                console.log(`   Introspect: http://${host}:${this.port}/oauth2/introspect`);
+                console.error(`🔐 OAuth endpoints available:`);
+                console.error(`   Discovery: http://${host}:${this.port}/.well-known/oauth-authorization-server`);
+                console.error(`   Authorize: http://${host}:${this.port}/oauth2/authorize`);
+                console.error(`   Token: http://${host}:${this.port}/oauth2/token`);
+                console.error(`   Revoke: http://${host}:${this.port}/oauth2/revoke`);
+                console.error(`   Introspect: http://${host}:${this.port}/oauth2/introspect`);
             }
             this.setupShutdownHandlers();
         });

package/dist/storage/encryption.js

@@ -92,7 +92,7 @@ class AudienceKeyEncryption {
      */
     static async importPrivateKey(privateKey) {
         const keyBytes = Buffer.from(privateKey, "base64");
-        return await crypto_1.webcrypto.subtle.importKey("raw", keyBytes, {
+        return await crypto_1.webcrypto.subtle.importKey("pkcs8", keyBytes, {
             name: "X25519",
         }, false, ["deriveKey"]);
     }
@@ -107,7 +107,8 @@ class AudienceKeyEncryption {
      * Export private key to base64 string
      */
     static async exportPrivateKey(privateKey) {
-        const keyBytes = await crypto_1.webcrypto.subtle.exportKey("raw", privateKey);
+        // X25519 private keys must be exported in PKCS8 format, not raw
+        const keyBytes = await crypto_1.webcrypto.subtle.exportKey("pkcs8", privateKey);
         return Buffer.from(keyBytes).toString("base64");
     }
 }

package/dist/test/deterministic-keys.d.ts

@@ -27,5 +27,6 @@ export declare function getPredefinedTestIdentities(): Record<string, MockIdenti
 export declare function generateTestNonce(seed?: string): string;
 /**
  * Generate session ID for testing (deterministic if seed provided)
+ * Uses mcpi_test_ prefix to match production format while being identifiable as test sessions
  */
 export declare function generateTestSessionId(seed?: string): string;

package/dist/test/deterministic-keys.js

@@ -93,16 +93,21 @@ function generateTestNonce(seed) {
 }
 /**
  * Generate session ID for testing (deterministic if seed provided)
+ * Uses mcpi_test_ prefix to match production format while being identifiable as test sessions
  */
 function generateTestSessionId(seed) {
     (0, test_environment_1.ensureTestMode)();
     if (seed) {
-        // Deterministic session ID for reproducible tests
-        return `sess_test_${(0, crypto_1.createHash)("sha256")
+        // Deterministic session ID for reproducible tests (uses mcpi_test_ prefix)
+        const hash = (0, crypto_1.createHash)("sha256")
             .update(`session-${seed}-${(0, test_environment_1.getCurrentTestSeed)()}`)
             .digest("hex")
-            .substring(0, 16)}`;
+            .substring(0, 32);
+        // Format as UUID-like structure for consistency with production format
+        return `mcpi_test_${hash.slice(0, 8)}-${hash.slice(8, 12)}-${hash.slice(12, 16)}-${hash.slice(16, 20)}-${hash.slice(20, 32)}`;
     }
     // Random session ID for general testing
-    return `sess_test_${(0, crypto_1.randomBytes)(8).toString("hex")}`;
+    const bytes = (0, crypto_1.randomBytes)(16);
+    const hex = bytes.toString("hex");
+    return `mcpi_test_${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kya-os/mcp-i",
-  "version": "1.6.14",
+  "version": "1.6.16",
   "description": "The TypeScript MCP framework with identity features built-in",
   "type": "commonjs",
   "main": "dist/index.js",
@@ -63,8 +63,8 @@
     "model-context-protocol"
   ],
   "dependencies": {
-    "@kya-os/contracts": "^1.6.17",
-    "@kya-os/mcp-i-core": "^1.3.24",
+    "@kya-os/contracts": "^1.6.19",
+    "@kya-os/mcp-i-core": "^1.3.27",
     "@modelcontextprotocol/sdk": "^1.11.4",
     "@swc/core": "^1.11.24",
     "@types/express": "^5.0.1",