@nifrajs/mcp 2.3.0 → 2.5.0

package/dist/http.d.ts

@@ -14,11 +14,19 @@ export interface McpHttpOptions {
     readonly features?: McpServerFeatures;
     /** Shown on the GET health page so each host can describe itself. */
     readonly health?: string;
+    /**
+     * Origin allowlist for the DNS-rebinding guard. Omit (the default) to allow any origin - the right
+     * choice for a public, unauthenticated docs server that can't enumerate its browser clients' origins.
+     * Set it (e.g. a localhost origin for a hardened local host) to reject any other browser origin with 403.
+     */
+    readonly allowedOrigins?: readonly string[];
 }
 /**
  * Handle one MCP request over HTTP against the given `tools`/`features`. POST a JSON-RPC body → JSON-RPC
  * response; GET → a plain-text health page; OPTIONS → CORS preflight. Never throws - a bad body becomes a
- * JSON-RPC parse error. The dispatch is the shared, transport-agnostic {@link handleRpc}.
+ * JSON-RPC parse error. Dual-era: a modern (2026-07-28) POST that mirrors its method/name/version into
+ * headers is validated against the body before dispatch and gets spec HTTP statuses; legacy requests are
+ * served unchanged. The dispatch is the shared, transport-agnostic {@link handleRpc}.
  */
 export declare function respondMcpHttp(request: Request, tools: McpTool[], serverInfo: {
     name: string;

package/dist/http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAGL,KAAK,iBAAiB,EACtB,KAAK,OAAO,EAEb,MAAM,eAAe,CAAA;AAWtB,MAAM,WAAW,cAAc;IAC7B,iEAAiE;IACjE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,kFAAkF;IAClF,QAAQ,CAAC,QAAQ,CAAC,EAAE,iBAAiB,CAAA;IACrC,qEAAqE;IACrE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB;AAuDD;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,OAAO,EAAE,EAChB,UAAU,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAC7C,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,QAAQ,CAAC,CAgCnB"}
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAKL,KAAK,iBAAiB,EACtB,KAAK,OAAO,EAGb,MAAM,eAAe,CAAA;AAsCtB,MAAM,WAAW,cAAc;IAC7B,iEAAiE;IACjE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,kFAAkF;IAClF,QAAQ,CAAC,QAAQ,CAAC,EAAE,iBAAiB,CAAA;IACrC,qEAAqE;IACrE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAC5C;AAgHD;;;;;;GAMG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,OAAO,EAAE,EAChB,UAAU,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAC7C,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,QAAQ,CAAC,CA0DnB"}

package/dist/http.js

@@ -6,12 +6,36 @@
  * becomes a JSON-RPC parse error. Pass the tools (and optional {@link McpServerFeatures} for resources /
  * prompts / the MCP Apps `ui://` widgets) so each host supplies its own corpus/source behind one core.
  */
-import { handleRpc, rpcError, } from "./protocol.js";
-const CORS = {
-    "access-control-allow-origin": "*",
+import { handleRpc, MCP_ERROR, modernVersionOf, rpcError, } from "./protocol.js";
+// Headers on every response. `access-control-allow-headers` lists the request headers a browser MCP client
+// (claude.ai, ChatGPT) actually sends: `mcp-protocol-version` (required per POST since 2025-06-18),
+// `mcp-method`/`mcp-name` (the 2026-07-28 request-metadata mirror), `authorization` (OAuth-protected hosts),
+// plus `accept`/`last-event-id`. Omit any and the CORS preflight fails, so the connector never loads.
+const CORS_BASE = {
     "access-control-allow-methods": "POST, GET, OPTIONS",
-    "access-control-allow-headers": "content-type",
+    "access-control-allow-headers": "content-type, authorization, mcp-protocol-version, mcp-session-id, mcp-method, mcp-name, accept, last-event-id",
+    "access-control-expose-headers": "mcp-protocol-version, mcp-session-id",
+    "access-control-max-age": "86400",
 };
+/**
+ * Resolve the CORS/Origin headers for one request against the host's `allowedOrigins` policy, or `null`
+ * when the request's `Origin` is present but not allowed - the caller then answers 403, per the
+ * Streamable-HTTP DNS-rebinding rule ("Servers MUST validate the `Origin` header ... respond with 403").
+ * With no policy (the default) every origin is allowed and reflected as `*` - correct for a public,
+ * secret-free, unauthenticated server, whose browser clients send arbitrary origins we can't enumerate.
+ */
+function corsFor(request, allowedOrigins) {
+    if (allowedOrigins === undefined)
+        return { ...CORS_BASE, "access-control-allow-origin": "*" };
+    const origin = request.headers.get("origin");
+    // A caller with no Origin (curl, server-to-server) can't mount a DNS-rebinding attack - allow it.
+    if (origin === null)
+        return { ...CORS_BASE, vary: "Origin" };
+    if (allowedOrigins.includes(origin)) {
+        return { ...CORS_BASE, "access-control-allow-origin": origin, vary: "Origin" };
+    }
+    return null;
+}
 const DEFAULT_MAX_BODY_BYTES = 1_000_000;
 const TEXT_DECODER = new TextDecoder();
 function parseContentLength(value) {
@@ -67,22 +91,89 @@ async function readJsonBounded(request, maxBytes) {
         return { ok: false, status: 400 };
     }
 }
+const SENTINEL_PREFIX = "=?base64?";
+const SENTINEL_SUFFIX = "?=";
+/** Decode the Streamable-HTTP `=?base64?...?=` header sentinel (used when a name/uri isn't header-safe).
+ * A plain value passes through; a malformed sentinel is returned as-is so validation still fails closed. */
+function decodeSentinel(value) {
+    if (value === null)
+        return null;
+    if (!value.startsWith(SENTINEL_PREFIX) || !value.endsWith(SENTINEL_SUFFIX))
+        return value;
+    const encoded = value.slice(SENTINEL_PREFIX.length, value.length - SENTINEL_SUFFIX.length);
+    try {
+        return TEXT_DECODER.decode(Uint8Array.from(atob(encoded), (ch) => ch.charCodeAt(0)));
+    }
+    catch {
+        return value;
+    }
+}
+/** Validate a modern (2026-07-28) request's mirrored headers against its body: `MCP-Protocol-Version`,
+ * `Mcp-Method`, and - for name-bearing methods - `Mcp-Name` MUST match, else a `HeaderMismatch` the caller
+ * returns as 400. Stops an intermediary from routing on a header while the server acts on a different body. */
+function modernHeaderMismatch(request, message, bodyVersion) {
+    const rid = message.id ?? null;
+    const headerVersion = request.headers.get("mcp-protocol-version");
+    if (headerVersion === null || headerVersion !== bodyVersion) {
+        return rpcError(rid, MCP_ERROR.HEADER_MISMATCH, "MCP-Protocol-Version header missing or mismatched");
+    }
+    const method = typeof message.method === "string" ? message.method : "";
+    const headerMethod = request.headers.get("mcp-method");
+    if (headerMethod === null || headerMethod !== method) {
+        return rpcError(rid, MCP_ERROR.HEADER_MISMATCH, "Mcp-Method header missing or mismatched");
+    }
+    if (method === "tools/call" || method === "resources/read" || method === "prompts/get") {
+        const bodyName = method === "resources/read" ? message.params?.uri : message.params?.name;
+        const headerName = decodeSentinel(request.headers.get("mcp-name"));
+        if (headerName === null || typeof bodyName !== "string" || headerName !== bodyName) {
+            return rpcError(rid, MCP_ERROR.HEADER_MISMATCH, "Mcp-Name header missing or mismatched");
+        }
+    }
+    return null;
+}
+/** HTTP status for a modern request's dispatch result: 400 for version/header errors, 404 for an unknown
+ * method, 200 otherwise (in-band tool errors are ordinary JSON-RPC results and stay 200). */
+function modernErrorStatus(response) {
+    if (!("error" in response))
+        return 200;
+    const { code } = response.error;
+    if (code === MCP_ERROR.UNSUPPORTED_VERSION || code === MCP_ERROR.HEADER_MISMATCH)
+        return 400;
+    return code === -32601 ? 404 : 200;
+}
 /**
  * Handle one MCP request over HTTP against the given `tools`/`features`. POST a JSON-RPC body → JSON-RPC
  * response; GET → a plain-text health page; OPTIONS → CORS preflight. Never throws - a bad body becomes a
- * JSON-RPC parse error. The dispatch is the shared, transport-agnostic {@link handleRpc}.
+ * JSON-RPC parse error. Dual-era: a modern (2026-07-28) POST that mirrors its method/name/version into
+ * headers is validated against the body before dispatch and gets spec HTTP statuses; legacy requests are
+ * served unchanged. The dispatch is the shared, transport-agnostic {@link handleRpc}.
  */
 export async function respondMcpHttp(request, tools, serverInfo, options = {}) {
+    const cors = corsFor(request, options.allowedOrigins);
+    if (cors === null) {
+        // Origin present but not allowlisted: reject before the body is ever read (DNS-rebinding guard). No
+        // `id` (no request parsed) and no CORS headers - a disallowed origin gets nothing to work with.
+        return Response.json(rpcError(null, -32600, "origin not allowed"), { status: 403 });
+    }
     if (request.method === "OPTIONS")
-        return new Response(null, { status: 204, headers: CORS });
+        return new Response(null, { status: 204, headers: cors });
     if (request.method === "GET") {
+        // The 2026-07-28 revision removed the GET SSE stream; a client probing for it (`Accept:
+        // text/event-stream`) gets 405 so its transport fallback fires. A plain browser/monitor GET still
+        // gets the human-readable health page.
+        if ((request.headers.get("accept") ?? "").includes("text/event-stream")) {
+            return new Response("event stream not supported", {
+                status: 405,
+                headers: { allow: "POST, GET", ...cors },
+            });
+        }
         return new Response(options.health ??
-            "MCP server - POST JSON-RPC 2.0 here (methods: initialize, tools/list, tools/call).", { headers: { "content-type": "text/plain; charset=utf-8", ...CORS } });
+            "MCP server - POST JSON-RPC 2.0 here (methods: initialize, tools/list, tools/call).", { headers: { "content-type": "text/plain; charset=utf-8", ...cors } });
     }
     if (request.method !== "POST") {
         return new Response("method not allowed", {
             status: 405,
-            headers: { allow: "POST, GET", ...CORS },
+            headers: { allow: "POST, GET", ...cors },
         });
     }
     const parsed = await readJsonBounded(request, options.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES);
@@ -90,18 +181,30 @@ export async function respondMcpHttp(request, tools, serverInfo, options = {}) {
         if (parsed.status === 413) {
             return Response.json(rpcError(null, -32000, "payload too large"), {
                 status: 413,
-                headers: CORS,
+                headers: cors,
             });
         }
-        return Response.json(rpcError(null, -32700, "parse error"), { status: 400, headers: CORS });
+        return Response.json(rpcError(null, -32700, "parse error"), { status: 400, headers: cors });
     }
     const message = parsed.value;
+    const bodyVersion = modernVersionOf(message.params);
+    // Mirror the protocol version back for intermediaries (SHOULD, 2025-06-18+); absent is fine.
+    const echoVersion = request.headers.get("mcp-protocol-version");
+    const headers = echoVersion !== null ? { ...cors, "mcp-protocol-version": echoVersion } : cors;
+    if (bodyVersion !== undefined) {
+        // Modern request: header/body mirror MUST agree. Reject divergence with 400 before dispatch.
+        const headerError = modernHeaderMismatch(request, message, bodyVersion);
+        if (headerError !== null)
+            return Response.json(headerError, { status: 400, headers });
+    }
     const response = await handleRpc(message, tools, serverInfo, options.features ?? {}, {
         signal: request.signal,
     });
-    // A notification (no id) yields null - acknowledge with 204, no body.
+    // A notification (no id) yields null - acknowledge with 202 Accepted and no body (Streamable-HTTP).
     if (response === null)
-        return new Response(null, { status: 204, headers: CORS });
-    return Response.json(response, { headers: CORS });
+        return new Response(null, { status: 202, headers });
+    // Modern requests carry spec HTTP statuses (400 version/header, 404 unknown method); legacy stays 200.
+    const status = bodyVersion !== undefined ? modernErrorStatus(response) : 200;
+    return Response.json(response, { status, headers });
 }
 //# sourceMappingURL=http.js.map

package/dist/http.js.map

@@ -1 +1 @@
-{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,SAAS,EAIT,QAAQ,GACT,MAAM,eAAe,CAAA;AAEtB,MAAM,IAAI,GAA2B;IACnC,6BAA6B,EAAE,GAAG;IAClC,8BAA8B,EAAE,oBAAoB;IACpD,8BAA8B,EAAE,cAAc;CAC/C,CAAA;AAED,MAAM,sBAAsB,GAAG,SAAS,CAAA;AACxC,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAA;AAWtC,SAAS,kBAAkB,CAAC,KAAa;IACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IACxC,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,CAAA;QACtC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,SAAS,CAAA;QAC5C,MAAM,GAAG,MAAM,GAAG,EAAE,GAAG,KAAK,CAAA;QAC5B,IAAI,MAAM,GAAG,MAAM,CAAC,gBAAgB;YAAE,OAAO,MAAM,CAAC,iBAAiB,CAAA;IACvE,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,OAAgB,EAChB,QAAgB;IAEhB,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;IACtD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAA;QAC3C,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAA;QAC3D,IAAI,MAAM,GAAG,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAA;IAC1D,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;IACzB,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAA;IAEpD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAA;IAC/B,MAAM,MAAM,GAAiB,EAAE,CAAA;IAC/B,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,SAAS,CAAC;QACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;QAC3C,IAAI,IAAI;YAAE,MAAK;QACf,KAAK,IAAI,KAAK,CAAC,UAAU,CAAA;QACzB,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;YACrB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAA;YACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAA;QACnC,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACpB,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;IACnC,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QACxB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAA;IAC5B,CAAC;IACD,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAY,EAAE,CAAA;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAA;IACnC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAgB,EAChB,KAAgB,EAChB,UAA6C,EAC7C,UAA0B,EAAE;IAE5B,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAC3F,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC7B,OAAO,IAAI,QAAQ,CACjB,OAAO,CAAC,MAAM;YACZ,oFAAoF,EACtF,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,GAAG,IAAI,EAAE,EAAE,CACtE,CAAA;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,OAAO,IAAI,QAAQ,CAAC,oBAAoB,EAAE;YACxC,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE;SACzC,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,YAAY,IAAI,sBAAsB,CAAC,CAAA;IAC7F,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC1B,OAAO,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,mBAAmB,CAAC,EAAE;gBAChE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,IAAI;aACd,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7F,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAuB,CAAA;IAC9C,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE;QACnF,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAA;IACF,sEAAsE;IACtE,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAChF,OAAO,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;AACnD,CAAC"}
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,SAAS,EAGT,SAAS,EAGT,eAAe,EACf,QAAQ,GACT,MAAM,eAAe,CAAA;AAEtB,2GAA2G;AAC3G,oGAAoG;AACpG,6GAA6G;AAC7G,sGAAsG;AACtG,MAAM,SAAS,GAA2B;IACxC,8BAA8B,EAAE,oBAAoB;IACpD,8BAA8B,EAC5B,gHAAgH;IAClH,+BAA+B,EAAE,sCAAsC;IACvE,wBAAwB,EAAE,OAAO;CAClC,CAAA;AAED;;;;;;GAMG;AACH,SAAS,OAAO,CACd,OAAgB,EAChB,cAA6C;IAE7C,IAAI,cAAc,KAAK,SAAS;QAAE,OAAO,EAAE,GAAG,SAAS,EAAE,6BAA6B,EAAE,GAAG,EAAE,CAAA;IAC7F,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC5C,kGAAkG;IAClG,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,GAAG,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;IAC5D,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,GAAG,SAAS,EAAE,6BAA6B,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;IAChF,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,sBAAsB,GAAG,SAAS,CAAA;AACxC,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAA;AAiBtC,SAAS,kBAAkB,CAAC,KAAa;IACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IACxC,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,CAAA;QACtC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,SAAS,CAAA;QAC5C,MAAM,GAAG,MAAM,GAAG,EAAE,GAAG,KAAK,CAAA;QAC5B,IAAI,MAAM,GAAG,MAAM,CAAC,gBAAgB;YAAE,OAAO,MAAM,CAAC,iBAAiB,CAAA;IACvE,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,OAAgB,EAChB,QAAgB;IAEhB,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;IACtD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAA;QAC3C,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAA;QAC3D,IAAI,MAAM,GAAG,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAA;IAC1D,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;IACzB,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAA;IAEpD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAA;IAC/B,MAAM,MAAM,GAAiB,EAAE,CAAA;IAC/B,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,SAAS,CAAC;QACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;QAC3C,IAAI,IAAI;YAAE,MAAK;QACf,KAAK,IAAI,KAAK,CAAC,UAAU,CAAA;QACzB,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;YACrB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAA;YACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAA;QACnC,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACpB,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;IACnC,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QACxB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAA;IAC5B,CAAC;IACD,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAY,EAAE,CAAA;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAA;IACnC,CAAC;AACH,CAAC;AAED,MAAM,eAAe,GAAG,WAAW,CAAA;AACnC,MAAM,eAAe,GAAG,IAAI,CAAA;AAE5B;4GAC4G;AAC5G,SAAS,cAAc,CAAC,KAAoB;IAC1C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC/B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC;QAAE,OAAO,KAAK,CAAA;IACxF,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;IAC1F,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;+GAE+G;AAC/G,SAAS,oBAAoB,CAC3B,OAAgB,EAChB,OAAuB,EACvB,WAAmB;IAEnB,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,IAAI,IAAI,CAAA;IAC9B,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAA;IACjE,IAAI,aAAa,KAAK,IAAI,IAAI,aAAa,KAAK,WAAW,EAAE,CAAC;QAC5D,OAAO,QAAQ,CACb,GAAG,EACH,SAAS,CAAC,eAAe,EACzB,mDAAmD,CACpD,CAAA;IACH,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;IACvE,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;IACtD,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;QACrD,OAAO,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,eAAe,EAAE,yCAAyC,CAAC,CAAA;IAC5F,CAAC;IACD,IAAI,MAAM,KAAK,YAAY,IAAI,MAAM,KAAK,gBAAgB,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;QACvF,MAAM,QAAQ,GAAG,MAAM,KAAK,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAA;QACzF,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAA;QAClE,IAAI,UAAU,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;YACnF,OAAO,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAA;QAC1F,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;6FAC6F;AAC7F,SAAS,iBAAiB,CAAC,QAAyB;IAClD,IAAI,CAAC,CAAC,OAAO,IAAI,QAAQ,CAAC;QAAE,OAAO,GAAG,CAAA;IACtC,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAA;IAC/B,IAAI,IAAI,KAAK,SAAS,CAAC,mBAAmB,IAAI,IAAI,KAAK,SAAS,CAAC,eAAe;QAAE,OAAO,GAAG,CAAA;IAC5F,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAA;AACpC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAgB,EAChB,KAAgB,EAChB,UAA6C,EAC7C,UAA0B,EAAE;IAE5B,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,cAAc,CAAC,CAAA;IACrD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,oGAAoG;QACpG,gGAAgG;QAChG,OAAO,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IACrF,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAC3F,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC7B,wFAAwF;QACxF,kGAAkG;QAClG,uCAAuC;QACvC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACxE,OAAO,IAAI,QAAQ,CAAC,4BAA4B,EAAE;gBAChD,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE;aACzC,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,IAAI,QAAQ,CACjB,OAAO,CAAC,MAAM;YACZ,oFAAoF,EACtF,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,GAAG,IAAI,EAAE,EAAE,CACtE,CAAA;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,OAAO,IAAI,QAAQ,CAAC,oBAAoB,EAAE;YACxC,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE;SACzC,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,YAAY,IAAI,sBAAsB,CAAC,CAAA;IAC7F,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC1B,OAAO,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,mBAAmB,CAAC,EAAE;gBAChE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,IAAI;aACd,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7F,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAuB,CAAA;IAC9C,MAAM,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IACnD,6FAA6F;IAC7F,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAA;IAC/D,MAAM,OAAO,GAAG,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,sBAAsB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IAC9F,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,6FAA6F;QAC7F,MAAM,WAAW,GAAG,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,CAAA;QACvE,IAAI,WAAW,KAAK,IAAI;YAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;IACvF,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE;QACnF,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAA;IACF,oGAAoG;IACpG,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;IAC1E,uGAAuG;IACvG,MAAM,MAAM,GAAG,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;IAC5E,OAAO,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;AACrD,CAAC"}

package/dist/protocol.d.ts

@@ -9,7 +9,20 @@
  * for the widget to render, and `initialize` advertises the `io.modelcontextprotocol/ui` extension. All of
  * it is additive - a tool whose handler returns a plain `string` behaves exactly as before.
  */
-export declare const PROTOCOL_VERSION = "2024-11-05";
+/** The protocol revision this server advertises by default. A handshake-era version - the HTTP transport
+ * still uses `initialize`; current clients reach it through their backward-compatibility fallback.
+ * `initialize` echoes the client's own requested version instead when it's one this server also speaks
+ * ({@link SUPPORTED_PROTOCOL_VERSIONS}). */
+export declare const PROTOCOL_VERSION = "2025-06-18";
+/** The stateless per-request revision (2026-07-28+). A request carrying its version in `_meta`
+ * (`io.modelcontextprotocol/protocolVersion`) is served in modern mode; an `initialize` request stays
+ * legacy. This server is dual-era: `handleRpc` answers both on the same dispatch, per request. */
+export declare const MODERN_PROTOCOL_VERSION = "2026-07-28";
+/** MCP-reserved JSON-RPC error codes (2026-07-28 error-code policy carves out -32020..-32099 for the spec). */
+export declare const MCP_ERROR: {
+    readonly HEADER_MISMATCH: -32020;
+    readonly UNSUPPORTED_VERSION: -32022;
+};
 /** The MIME type a UI resource MUST use so a host recognizes it as an MCP App widget (SEP-1865). */
 export declare const UI_MIME = "text/html;profile=mcp-app";
 /** The `capabilities.extensions` key advertising UI support in the `initialize` result (SEP-1865). */
@@ -96,6 +109,9 @@ export interface McpServerFeatures {
     readonly ui?: {
         readonly mimeTypes?: readonly string[];
     };
+    /** Natural-language guidance for LLMs on how to use this server. Surfaced in the modern
+     * `server/discover` result (2026-07-28); legacy `initialize` does not carry it. */
+    readonly instructions?: string;
 }
 export interface JsonRpcRequest {
     readonly jsonrpc?: string;
@@ -118,10 +134,11 @@ export type JsonRpcResponse = {
     error: {
         code: number;
         message: string;
+        data?: unknown;
     };
 };
 export declare const rpcResult: (id: JsonRpcId, value: unknown) => JsonRpcResponse;
-export declare const rpcError: (id: JsonRpcId, code: number, message: string) => JsonRpcResponse;
+export declare const rpcError: (id: JsonRpcId, code: number, message: string, data?: unknown) => JsonRpcResponse;
 export interface McpProtocolState {
     readonly activeRequests: Map<string, AbortController>;
 }
@@ -131,6 +148,9 @@ export interface McpProtocolOptions {
     readonly sendNotification?: (notification: JsonRpcNotification) => void;
 }
 export declare function createMcpProtocolState(): McpProtocolState;
+/** The protocol version a modern (2026-07-28+) request declares in `_meta`, or `undefined` for a legacy
+ * request. Its presence is what puts the dispatch in modern mode for that one request. */
+export declare function modernVersionOf(params: Record<string, unknown> | undefined): string | undefined;
 /**
  * Dispatch one JSON-RPC message against the given tools. Returns the response, or `null` for a
  * notification (no reply). Tool errors are reported in-band (`isError`) so the agent can react to them.

package/dist/protocol.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../src/protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,eAAO,MAAM,gBAAgB,eAAe,CAAA;AAE5C,oGAAoG;AACpG,eAAO,MAAM,OAAO,8BAA8B,CAAA;AAClD,sGAAsG;AACtG,eAAO,MAAM,gBAAgB,+BAA+B,CAAA;AAE5D,KAAK,SAAS,GAAG,MAAM,GAAG,MAAM,CAAA;AAChC,KAAK,SAAS,GAAG,SAAS,GAAG,IAAI,CAAA;AACjC,KAAK,aAAa,GAAG,MAAM,GAAG,MAAM,CAAA;AAEpC,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAA;IACtC,QAAQ,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;CACpE;AAED,kGAAkG;AAClG,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,eAAe,EAAE,CAAA;IAC7C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACpD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACxC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAC3B;AAED;;+EAE+E;AAC/E,6GAA6G;AAC7G,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAA;IAC/B,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAA;IAClC,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAA;CACjC;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC7C,QAAQ,CAAC,WAAW,CAAC,EAAE,kBAAkB,CAAA;IACzC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACxC,QAAQ,CAAC,OAAO,EAAE,CAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,EAAE,cAAc,KACpB,OAAO,CAAC,MAAM,GAAG,aAAa,CAAC,CAAA;CACrC;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,oFAAoF;IACpF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,OAAO,CAAC;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACpF;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAAA;IACnC,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CACnE;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS;QAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;QACrB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;QAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAC5B,EAAE,CAAA;IACH,QAAQ,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,SAAS,gBAAgB,EAAE,CAAC,CAAA;CAC1F;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,WAAW,EAAE,CAAA;IAC3C,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,SAAS,EAAE,CAAA;IACvC;8CAC0C;IAC1C,QAAQ,CAAC,EAAE,CAAC,EAAE;QAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAA;CACzD;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,EAAE,CAAC,EAAE,SAAS,CAAA;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC1C;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC1C;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,EAAE,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAClD;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,EAAE,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAA;AAE/E,eAAO,MAAM,SAAS,GAAI,IAAI,SAAS,EAAE,OAAO,OAAO,KAAG,eAIxD,CAAA;AACF,eAAO,MAAM,QAAQ,GAAI,IAAI,SAAS,EAAE,MAAM,MAAM,EAAE,SAAS,MAAM,KAAG,eAItE,CAAA;AAEF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;CACtD;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAA;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;IAC7B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC,YAAY,EAAE,mBAAmB,KAAK,IAAI,CAAA;CACxE;AAED,wBAAgB,sBAAsB,IAAI,gBAAgB,CAEzD;AAiED;;;GAGG;AACH,wBAAsB,SAAS,CAC7B,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,SAAS,OAAO,EAAE,EACzB,UAAU,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAC7C,QAAQ,GAAE,iBAAsB,EAChC,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CA0LjC"}
+{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../src/protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;;4CAG4C;AAC5C,eAAO,MAAM,gBAAgB,eAAe,CAAA;AAU5C;;kGAEkG;AAClG,eAAO,MAAM,uBAAuB,eAAe,CAAA;AACnD,+GAA+G;AAC/G,eAAO,MAAM,SAAS;;;CAAoE,CAAA;AAI1F,oGAAoG;AACpG,eAAO,MAAM,OAAO,8BAA8B,CAAA;AAClD,sGAAsG;AACtG,eAAO,MAAM,gBAAgB,+BAA+B,CAAA;AAE5D,KAAK,SAAS,GAAG,MAAM,GAAG,MAAM,CAAA;AAChC,KAAK,SAAS,GAAG,SAAS,GAAG,IAAI,CAAA;AACjC,KAAK,aAAa,GAAG,MAAM,GAAG,MAAM,CAAA;AAEpC,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAA;IACtC,QAAQ,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;CACpE;AAED,kGAAkG;AAClG,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,eAAe,EAAE,CAAA;IAC7C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACpD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACxC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAC3B;AAED;;+EAE+E;AAC/E,6GAA6G;AAC7G,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAA;IAC/B,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAA;IAClC,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAA;CACjC;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC7C,QAAQ,CAAC,WAAW,CAAC,EAAE,kBAAkB,CAAA;IACzC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACxC,QAAQ,CAAC,OAAO,EAAE,CAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,EAAE,cAAc,KACpB,OAAO,CAAC,MAAM,GAAG,aAAa,CAAC,CAAA;CACrC;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,oFAAoF;IACpF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,OAAO,CAAC;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACpF;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAAA;IACnC,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CACnE;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS;QAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;QACrB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;QAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAC5B,EAAE,CAAA;IACH,QAAQ,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,SAAS,gBAAgB,EAAE,CAAC,CAAA;CAC1F;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,WAAW,EAAE,CAAA;IAC3C,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,SAAS,EAAE,CAAA;IACvC;8CAC0C;IAC1C,QAAQ,CAAC,EAAE,CAAC,EAAE;QAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAA;IACxD;uFACmF;IACnF,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAC/B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,EAAE,CAAC,EAAE,SAAS,CAAA;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC1C;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC1C;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,EAAE,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAClD;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,EAAE,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,CAAA;AAE/F,eAAO,MAAM,SAAS,GAAI,IAAI,SAAS,EAAE,OAAO,OAAO,KAAG,eAIxD,CAAA;AACF,eAAO,MAAM,QAAQ,GACnB,IAAI,SAAS,EACb,MAAM,MAAM,EACZ,SAAS,MAAM,EACf,OAAO,OAAO,KACb,eAID,CAAA;AAEF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;CACtD;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAA;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;IAC7B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC,YAAY,EAAE,mBAAmB,KAAK,IAAI,CAAA;CACxE;AAED,wBAAgB,sBAAsB,IAAI,gBAAgB,CAEzD;AAgBD;0FAC0F;AAC1F,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAG/F;AAiFD;;;GAGG;AACH,wBAAsB,SAAS,CAC7B,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,SAAS,OAAO,EAAE,EACzB,UAAU,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAC7C,QAAQ,GAAE,iBAAsB,EAChC,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAoPjC"}

package/dist/protocol.js

@@ -9,7 +9,27 @@
  * for the widget to render, and `initialize` advertises the `io.modelcontextprotocol/ui` extension. All of
  * it is additive - a tool whose handler returns a plain `string` behaves exactly as before.
  */
-export const PROTOCOL_VERSION = "2024-11-05";
+/** The protocol revision this server advertises by default. A handshake-era version - the HTTP transport
+ * still uses `initialize`; current clients reach it through their backward-compatibility fallback.
+ * `initialize` echoes the client's own requested version instead when it's one this server also speaks
+ * ({@link SUPPORTED_PROTOCOL_VERSIONS}). */
+export const PROTOCOL_VERSION = "2025-06-18";
+/** The handshake-era revisions this server speaks. `initialize` echoes the client's requested
+ * `protocolVersion` when it's in this set (the smoothest negotiation), else answers {@link PROTOCOL_VERSION}. */
+const SUPPORTED_PROTOCOL_VERSIONS = new Set([
+    "2024-11-05",
+    "2025-03-26",
+    "2025-06-18",
+    "2025-11-25",
+]);
+/** The stateless per-request revision (2026-07-28+). A request carrying its version in `_meta`
+ * (`io.modelcontextprotocol/protocolVersion`) is served in modern mode; an `initialize` request stays
+ * legacy. This server is dual-era: `handleRpc` answers both on the same dispatch, per request. */
+export const MODERN_PROTOCOL_VERSION = "2026-07-28";
+/** MCP-reserved JSON-RPC error codes (2026-07-28 error-code policy carves out -32020..-32099 for the spec). */
+export const MCP_ERROR = { HEADER_MISMATCH: -32020, UNSUPPORTED_VERSION: -32022 };
+const META_PROTOCOL_VERSION = "io.modelcontextprotocol/protocolVersion";
+const META_SERVER_INFO = "io.modelcontextprotocol/serverInfo";
 /** The MIME type a UI resource MUST use so a host recognizes it as an MCP App widget (SEP-1865). */
 export const UI_MIME = "text/html;profile=mcp-app";
 /** The `capabilities.extensions` key advertising UI support in the `initialize` result (SEP-1865). */
@@ -19,10 +39,10 @@ export const rpcResult = (id, value) => ({
     id,
     result: value,
 });
-export const rpcError = (id, code, message) => ({
+export const rpcError = (id, code, message, data) => ({
     jsonrpc: "2.0",
     id,
-    error: { code, message },
+    error: data !== undefined ? { code, message, data } : { code, message },
 });
 export function createMcpProtocolState() {
     return { activeRequests: new Map() };
@@ -32,11 +52,20 @@ function requestKey(id) {
         return `s:${id}`;
     return typeof id === "number" && Number.isFinite(id) ? `n:${id}` : undefined;
 }
-function progressTokenOf(params) {
+function metaObject(params) {
     const meta = params?._meta;
-    if (typeof meta !== "object" || meta === null || Array.isArray(meta))
-        return undefined;
-    const token = meta.progressToken;
+    return typeof meta === "object" && meta !== null && !Array.isArray(meta)
+        ? meta
+        : undefined;
+}
+/** The protocol version a modern (2026-07-28+) request declares in `_meta`, or `undefined` for a legacy
+ * request. Its presence is what puts the dispatch in modern mode for that one request. */
+export function modernVersionOf(params) {
+    const version = metaObject(params)?.[META_PROTOCOL_VERSION];
+    return typeof version === "string" ? version : undefined;
+}
+function progressTokenOf(params) {
+    const token = metaObject(params)?.progressToken;
     return typeof token === "string" || (typeof token === "number" && Number.isFinite(token))
         ? token
         : undefined;
@@ -70,6 +99,22 @@ function compactDescription(description) {
         return sentence;
     return `${sentence.slice(0, 117).trimEnd()}...`;
 }
+/** Freshness hint for the static docs corpus - a modern client MAY cache list/read results this long. */
+const DEFAULT_CACHE_TTL_MS = 3_600_000;
+/** Wrap a result in the 2026-07-28 completion envelope: `resultType`, a self-identifying `serverInfo`
+ * under `_meta`, and - for the cacheable list/read methods - a public freshness hint. Legacy results skip
+ * this entirely and keep their exact pre-2026-07-28 shape. */
+function withEnvelope(value, serverInfo, cacheable) {
+    const existingMeta = typeof value._meta === "object" && value._meta !== null && !Array.isArray(value._meta)
+        ? value._meta
+        : undefined;
+    return {
+        ...value,
+        resultType: "complete",
+        _meta: { ...(existingMeta ?? {}), [META_SERVER_INFO]: serverInfo },
+        ...(cacheable ? { ttlMs: DEFAULT_CACHE_TTL_MS, cacheScope: "public" } : {}),
+    };
+}
 /** Normalize a handler's return into the `tools/call` result object. A `string` becomes a single text
  * block (base-MCP behavior, unchanged); a {@link McpToolResult} passes `content`/`structuredContent`
  * through, and inherits the tool descriptor's `_meta` (the `ui.resourceUri` link) when it sets none. */
@@ -99,10 +144,29 @@ export async function handleRpc(message, tools, serverInfo, features = {}, optio
     const resources = features.resources ?? [];
     const prompts = features.prompts ?? [];
     const state = options.state ?? createMcpProtocolState();
+    // A request that declares its version in `_meta` is a modern (2026-07-28+) request. We speak exactly one
+    // modern revision; any other declared version is rejected so the client can retry with a supported one.
+    const requestedVersion = modernVersionOf(params);
+    const isModern = requestedVersion !== undefined;
+    if (isModern && requestedVersion !== MODERN_PROTOCOL_VERSION) {
+        return rpcError(rid, MCP_ERROR.UNSUPPORTED_VERSION, "Unsupported protocol version", {
+            supported: [MODERN_PROTOCOL_VERSION],
+            requested: requestedVersion,
+        });
+    }
+    // Modern results carry the completion envelope; legacy results keep their exact prior shape. Every data
+    // case returns through `reply` so the one `isModern` decision drives the whole response shape.
+    const reply = (value, cacheable = false) => rpcResult(rid, isModern ? withEnvelope(value, serverInfo, cacheable) : value);
     switch (method) {
-        case "initialize":
+        case "initialize": {
+            // Handshake version negotiation: answer with the client's requested version when we speak it too,
+            // otherwise our default. The client then decides whether our answer is acceptable.
+            const requested = params?.protocolVersion;
+            const protocolVersion = typeof requested === "string" && SUPPORTED_PROTOCOL_VERSIONS.has(requested)
+                ? requested
+                : PROTOCOL_VERSION;
             return rpcResult(rid, {
-                protocolVersion: PROTOCOL_VERSION,
+                protocolVersion,
                 capabilities: {
                     tools: {},
                     ...(resources.length > 0 ? { resources: {} } : {}),
@@ -117,6 +181,26 @@ export async function handleRpc(message, tools, serverInfo, features = {}, optio
                 },
                 serverInfo,
             });
+        }
+        case "server/discover":
+            // The modern capability/identity probe (replaces `initialize` for 2026-07-28 clients). Always
+            // enveloped and cacheable - it is a modern-only RPC.
+            return rpcResult(rid, withEnvelope({
+                supportedVersions: [MODERN_PROTOCOL_VERSION],
+                capabilities: {
+                    tools: {},
+                    ...(resources.length > 0 ? { resources: {} } : {}),
+                    ...(prompts.length > 0 ? { prompts: {} } : {}),
+                    ...(features.ui !== undefined
+                        ? {
+                            extensions: {
+                                [UI_EXTENSION_KEY]: { mimeTypes: features.ui.mimeTypes ?? [UI_MIME] },
+                            },
+                        }
+                        : {}),
+                },
+                ...(features.instructions !== undefined ? { instructions: features.instructions } : {}),
+            }, serverInfo, true));
         case "notifications/initialized":
             return null;
         case "notifications/cancelled": {
@@ -128,7 +212,7 @@ export async function handleRpc(message, tools, serverInfo, features = {}, optio
         case "ping":
             return rpcResult(rid, {});
         case "tools/list":
-            return rpcResult(rid, params?.compact === true
+            return reply(params?.compact === true
                 ? {
                     tools: tools.map((t) => ({
                         name: t.name,
@@ -143,13 +227,13 @@ export async function handleRpc(message, tools, serverInfo, features = {}, optio
                         ...(t.annotations !== undefined ? { annotations: t.annotations } : {}),
                         ...(t._meta !== undefined ? { _meta: t._meta } : {}),
                     })),
-                });
+                }, true);
         case "tools/describe": {
             const name = params?.name;
             const tool = tools.find((t) => t.name === name);
             if (!tool)
                 return rpcError(rid, -32602, `unknown tool: ${String(name)}`);
-            return rpcResult(rid, {
+            return reply({
                 tool: {
                     name: tool.name,
                     description: tool.description,
@@ -203,17 +287,17 @@ export async function handleRpc(message, tools, serverInfo, features = {}, optio
                 if (controller.signal.aborted)
                     throw new DOMException("cancelled", "AbortError");
                 reportProgress(1, 1);
-                return rpcResult(rid, toolCallResult(result, tool));
+                return reply(toolCallResult(result, tool));
             }
             catch (err) {
                 if (controller.signal.aborted) {
-                    return rpcResult(rid, {
+                    return reply({
                         content: [{ type: "text", text: abortMessage(controller.signal) }],
                         isError: true,
                     });
                 }
                 const msg = err instanceof Error ? err.message : String(err);
-                return rpcResult(rid, { content: [{ type: "text", text: `Error: ${msg}` }], isError: true });
+                return reply({ content: [{ type: "text", text: `Error: ${msg}` }], isError: true });
             }
             finally {
                 cleanupAbort();
@@ -223,7 +307,7 @@ export async function handleRpc(message, tools, serverInfo, features = {}, optio
             }
         }
         case "resources/list":
-            return rpcResult(rid, {
+            return reply({
                 resources: resources.map((r) => ({
                     uri: r.uri,
                     name: r.name,
@@ -231,7 +315,7 @@ export async function handleRpc(message, tools, serverInfo, features = {}, optio
                     ...(r.mimeType !== undefined ? { mimeType: r.mimeType } : {}),
                     ...(r._meta !== undefined ? { _meta: r._meta } : {}),
                 })),
-            });
+            }, true);
         case "resources/read": {
             const uri = params?.uri;
             const resource = resources.find((r) => r.uri === uri);
@@ -239,7 +323,7 @@ export async function handleRpc(message, tools, serverInfo, features = {}, optio
                 return rpcError(rid, -32602, `unknown resource: ${String(uri)}`);
             try {
                 const content = await resource.read();
-                return rpcResult(rid, {
+                return reply({
                     contents: [
                         {
                             uri: resource.uri,
@@ -248,7 +332,7 @@ export async function handleRpc(message, tools, serverInfo, features = {}, optio
                             ...(resource._meta !== undefined ? { _meta: resource._meta } : {}),
                         },
                     ],
-                });
+                }, true);
             }
             catch {
                 // Don't surface the raw read error - it can leak a filesystem path. Return a generic message.
@@ -256,13 +340,13 @@ export async function handleRpc(message, tools, serverInfo, features = {}, optio
             }
         }
         case "prompts/list":
-            return rpcResult(rid, {
+            return reply({
                 prompts: prompts.map((p) => ({
                     name: p.name,
                     description: p.description,
                     ...(p.arguments !== undefined ? { arguments: p.arguments } : {}),
                 })),
-            });
+            }, true);
         case "prompts/get": {
             const name = params?.name;
             const prompt = prompts.find((p) => p.name === name);
@@ -270,7 +354,7 @@ export async function handleRpc(message, tools, serverInfo, features = {}, optio
                 return rpcError(rid, -32602, `unknown prompt: ${String(name)}`);
             const args = params?.arguments ?? {};
             try {
-                return rpcResult(rid, {
+                return reply({
                     description: prompt.description,
                     messages: await prompt.handler(args),
                 });

package/dist/protocol.js.map

@@ -1 +1 @@
-{"version":3,"file":"protocol.js","sourceRoot":"","sources":["../src/protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAA;AAE5C,oGAAoG;AACpG,MAAM,CAAC,MAAM,OAAO,GAAG,2BAA2B,CAAA;AAClD,sGAAsG;AACtG,MAAM,CAAC,MAAM,gBAAgB,GAAG,4BAA4B,CAAA;AA2G5D,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,EAAa,EAAE,KAAc,EAAmB,EAAE,CAAC,CAAC;IAC5E,OAAO,EAAE,KAAK;IACd,EAAE;IACF,MAAM,EAAE,KAAK;CACd,CAAC,CAAA;AACF,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,EAAa,EAAE,IAAY,EAAE,OAAe,EAAmB,EAAE,CAAC,CAAC;IAC1F,OAAO,EAAE,KAAK;IACd,EAAE;IACF,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;CACzB,CAAC,CAAA;AAYF,MAAM,UAAU,sBAAsB;IACpC,OAAO,EAAE,cAAc,EAAE,IAAI,GAAG,EAAE,EAAE,CAAA;AACtC,CAAC;AAED,SAAS,UAAU,CAAC,EAAW;IAC7B,IAAI,OAAO,EAAE,KAAK,QAAQ;QAAE,OAAO,KAAK,EAAE,EAAE,CAAA;IAC5C,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;AAC9E,CAAC;AAED,SAAS,eAAe,CAAC,MAA2C;IAClE,MAAM,IAAI,GAAG,MAAM,EAAE,KAAK,CAAA;IAC1B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAA;IACtF,MAAM,KAAK,GAAI,IAAgC,CAAC,aAAa,CAAA;IAC7D,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACvF,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,SAAS,CAAA;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,MAA2C;IACrE,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,CAAA;IAC7B,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;AAC7E,CAAC;AAED,SAAS,eAAe,CAAC,MAA+B,EAAE,KAAsB;IAC9E,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,GAAG,EAAE,GAAE,CAAC,CAAA;IACzC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC1B,OAAO,GAAG,EAAE,GAAE,CAAC,CAAA;IACjB,CAAC;IACD,MAAM,KAAK,GAAG,GAAS,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACpD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IACvD,OAAO,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;AACzD,CAAC;AAED,SAAS,YAAY,CAAC,MAAmB;IACvC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;IAC5B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,cAAc,MAAM,EAAE,CAAA;IAClF,OAAO,WAAW,CAAA;AACpB,CAAC;AAED,SAAS,kBAAkB,CAAC,WAAmB;IAC7C,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;IACpD,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAA;IAChD,MAAM,QAAQ,GAAG,WAAW,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,GAAG,CAAC,CAAC,CAAA;IAC3E,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG;QAAE,OAAO,QAAQ,CAAA;IAC3C,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,CAAA;AACjD,CAAC;AAED;;wGAEwG;AACxG,SAAS,cAAc,CAAC,MAA8B,EAAE,IAAa;IACnE,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAA;IACpF,MAAM,IAAI,GACR,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;QACpD,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE;QACpD,CAAC,CAAC,SAAS,CAAA;IACf,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE;QAC7B,GAAG,CAAC,MAAM,CAAC,iBAAiB,KAAK,SAAS;YACxC,CAAC,CAAC,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE;YACjD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,OAAuB,EACvB,KAAyB,EACzB,UAA6C,EAC7C,WAA8B,EAAE,EAChC,UAA8B,EAAE;IAEhC,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IACtC,MAAM,cAAc,GAAG,EAAE,KAAK,SAAS,CAAA;IACvC,MAAM,GAAG,GAAG,EAAE,IAAI,IAAI,CAAA;IACtB,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAA;IAC1C,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,sBAAsB,EAAE,CAAA;IAEvD,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,YAAY;YACf,OAAO,SAAS,CAAC,GAAG,EAAE;gBACpB,eAAe,EAAE,gBAAgB;gBACjC,YAAY,EAAE;oBACZ,KAAK,EAAE,EAAE;oBACT,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAClD,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC9C,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,SAAS;wBAC3B,CAAC,CAAC;4BACE,UAAU,EAAE;gCACV,CAAC,gBAAgB,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,EAAE;6BACtE;yBACF;wBACH,CAAC,CAAC,EAAE,CAAC;iBACR;gBACD,UAAU;aACX,CAAC,CAAA;QACJ,KAAK,2BAA2B;YAC9B,OAAO,IAAI,CAAA;QACb,KAAK,yBAAyB,CAAC,CAAC,CAAC;YAC/B,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;YACzC,IAAI,GAAG,KAAK,SAAS;gBAAE,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAA;YACvF,OAAO,IAAI,CAAA;QACb,CAAC;QACD,KAAK,MAAM;YACT,OAAO,SAAS,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;QAC3B,KAAK,YAAY;YACf,OAAO,SAAS,CACd,GAAG,EACH,MAAM,EAAE,OAAO,KAAK,IAAI;gBACtB,CAAC,CAAC;oBACE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;wBACvB,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,WAAW,EAAE,kBAAkB,CAAC,CAAC,CAAC,WAAW,CAAC;qBAC/C,CAAC,CAAC;iBACJ;gBACH,CAAC,CAAC;oBACE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;wBACvB,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;wBAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;wBAC1B,GAAG,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACtE,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACrD,CAAC,CAAC;iBACJ,CACN,CAAA;QACH,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,CAAA;YACzB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;YAC/C,IAAI,CAAC,IAAI;gBAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,iBAAiB,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YACxE,OAAO,SAAS,CAAC,GAAG,EAAE;gBACpB,IAAI,EAAE;oBACJ,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5E,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC3D;aACF,CAAC,CAAA;QACJ,CAAC;QACD,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,CAAA;YACzB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;YAC/C,IAAI,CAAC,IAAI;gBAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,iBAAiB,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YACxE,MAAM,IAAI,GAAI,MAAM,EAAE,SAAqC,IAAI,EAAE,CAAA;YACjE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;YACxC,MAAM,GAAG,GAAG,UAAU,CAAC,EAAE,CAAC,CAAA;YAC1B,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;YAChE,IAAI,GAAG,KAAK,SAAS;gBAAE,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;YAChE,MAAM,aAAa,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;YAC7C,IAAI,YAAY,GAAG,MAAM,CAAC,iBAAiB,CAAA;YAC3C,MAAM,cAAc,GAAG,CAAC,QAAgB,EAAE,KAAc,EAAQ,EAAE;gBAChE,IACE,aAAa,KAAK,SAAS;oBAC3B,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;oBAC1B,QAAQ,IAAI,YAAY;oBACxB,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAChD,CAAC;oBACD,OAAM;gBACR,CAAC;gBACD,YAAY,GAAG,QAAQ,CAAA;gBACvB,OAAO,CAAC,gBAAgB,EAAE,CAAC;oBACzB,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,wBAAwB;oBAChC,MAAM,EAAE;wBACN,aAAa;wBACb,QAAQ;wBACR,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC1C;iBACF,CAAC,CAAA;YACJ,CAAC,CAAA;YACD,IAAI,CAAC;gBACH,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;gBACpB,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;oBAAE,MAAM,IAAI,YAAY,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;gBAChF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;oBACtC,MAAM,EAAE,UAAU,CAAC,MAAM;oBACzB,SAAS,EAAE,GAAG;oBACd,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzD,cAAc;iBACf,CAAC,CAAA;gBACF,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;oBAAE,MAAM,IAAI,YAAY,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;gBAChF,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;gBACpB,OAAO,SAAS,CAAC,GAAG,EAAE,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;YACrD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBAC9B,OAAO,SAAS,CAAC,GAAG,EAAE;wBACpB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;wBAClE,OAAO,EAAE,IAAI;qBACd,CAAC,CAAA;gBACJ,CAAC;gBACD,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBAC5D,OAAO,SAAS,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;YAC9F,CAAC;oBAAS,CAAC;gBACT,YAAY,EAAE,CAAA;gBACd,IAAI,GAAG,KAAK,SAAS,IAAI,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,UAAU,EAAE,CAAC;oBACtE,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBAClC,CAAC;YACH,CAAC;QACH,CAAC;QACD,KAAK,gBAAgB;YACnB,OAAO,SAAS,CAAC,GAAG,EAAE;gBACpB,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAC/B,GAAG,EAAE,CAAC,CAAC,GAAG;oBACV,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,GAAG,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtE,GAAG,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7D,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACrD,CAAC,CAAC;aACJ,CAAC,CAAA;QACJ,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,MAAM,GAAG,GAAG,MAAM,EAAE,GAAG,CAAA;YACvB,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAA;YACrD,IAAI,CAAC,QAAQ;gBAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,qBAAqB,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YAC/E,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;gBACrC,OAAO,SAAS,CAAC,GAAG,EAAE;oBACpB,QAAQ,EAAE;wBACR;4BACE,GAAG,EAAE,QAAQ,CAAC,GAAG;4BACjB,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,IAAI,YAAY;4BAC/D,IAAI,EAAE,OAAO,CAAC,IAAI;4BAClB,GAAG,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;yBACnE;qBACF;iBACF,CAAC,CAAA;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,8FAA8F;gBAC9F,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,4BAA4B,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACzE,CAAC;QACH,CAAC;QACD,KAAK,cAAc;YACjB,OAAO,SAAS,CAAC,GAAG,EAAE;gBACpB,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAC3B,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,GAAG,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACjE,CAAC,CAAC;aACJ,CAAC,CAAA;QACJ,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,CAAA;YACzB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;YACnD,IAAI,CAAC,MAAM;gBAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,mBAAmB,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YAC5E,MAAM,IAAI,GAAI,MAAM,EAAE,SAAqC,IAAI,EAAE,CAAA;YACjE,IAAI,CAAC;gBACH,OAAO,SAAS,CAAC,GAAG,EAAE;oBACpB,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,QAAQ,EAAE,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;iBACrC,CAAC,CAAA;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBAC5D,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;YACnC,CAAC;QACH,CAAC;QACD;YACE,IAAI,cAAc;gBAAE,OAAO,IAAI,CAAA;YAC/B,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,qBAAqB,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IACvE,CAAC;AACH,CAAC"}
+{"version":3,"file":"protocol.js","sourceRoot":"","sources":["../src/protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;;4CAG4C;AAC5C,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAA;AAC5C;iHACiH;AACjH,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC;IAC1C,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,YAAY;CACb,CAAC,CAAA;AAEF;;kGAEkG;AAClG,MAAM,CAAC,MAAM,uBAAuB,GAAG,YAAY,CAAA;AACnD,+GAA+G;AAC/G,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,eAAe,EAAE,CAAC,KAAK,EAAE,mBAAmB,EAAE,CAAC,KAAK,EAAW,CAAA;AAC1F,MAAM,qBAAqB,GAAG,yCAAyC,CAAA;AACvE,MAAM,gBAAgB,GAAG,oCAAoC,CAAA;AAE7D,oGAAoG;AACpG,MAAM,CAAC,MAAM,OAAO,GAAG,2BAA2B,CAAA;AAClD,sGAAsG;AACtG,MAAM,CAAC,MAAM,gBAAgB,GAAG,4BAA4B,CAAA;AA8G5D,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,EAAa,EAAE,KAAc,EAAmB,EAAE,CAAC,CAAC;IAC5E,OAAO,EAAE,KAAK;IACd,EAAE;IACF,MAAM,EAAE,KAAK;CACd,CAAC,CAAA;AACF,MAAM,CAAC,MAAM,QAAQ,GAAG,CACtB,EAAa,EACb,IAAY,EACZ,OAAe,EACf,IAAc,EACG,EAAE,CAAC,CAAC;IACrB,OAAO,EAAE,KAAK;IACd,EAAE;IACF,KAAK,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;CACxE,CAAC,CAAA;AAYF,MAAM,UAAU,sBAAsB;IACpC,OAAO,EAAE,cAAc,EAAE,IAAI,GAAG,EAAE,EAAE,CAAA;AACtC,CAAC;AAED,SAAS,UAAU,CAAC,EAAW;IAC7B,IAAI,OAAO,EAAE,KAAK,QAAQ;QAAE,OAAO,KAAK,EAAE,EAAE,CAAA;IAC5C,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;AAC9E,CAAC;AAED,SAAS,UAAU,CACjB,MAA2C;IAE3C,MAAM,IAAI,GAAG,MAAM,EAAE,KAAK,CAAA;IAC1B,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QACtE,CAAC,CAAE,IAAgC;QACnC,CAAC,CAAC,SAAS,CAAA;AACf,CAAC;AAED;0FAC0F;AAC1F,MAAM,UAAU,eAAe,CAAC,MAA2C;IACzE,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,qBAAqB,CAAC,CAAA;IAC3D,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;AAC1D,CAAC;AAED,SAAS,eAAe,CAAC,MAA2C;IAClE,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,aAAa,CAAA;IAC/C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACvF,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,SAAS,CAAA;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,MAA2C;IACrE,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,CAAA;IAC7B,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;AAC7E,CAAC;AAED,SAAS,eAAe,CAAC,MAA+B,EAAE,KAAsB;IAC9E,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,GAAG,EAAE,GAAE,CAAC,CAAA;IACzC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC1B,OAAO,GAAG,EAAE,GAAE,CAAC,CAAA;IACjB,CAAC;IACD,MAAM,KAAK,GAAG,GAAS,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACpD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IACvD,OAAO,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;AACzD,CAAC;AAED,SAAS,YAAY,CAAC,MAAmB;IACvC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;IAC5B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,cAAc,MAAM,EAAE,CAAA;IAClF,OAAO,WAAW,CAAA;AACpB,CAAC;AAED,SAAS,kBAAkB,CAAC,WAAmB;IAC7C,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;IACpD,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAA;IAChD,MAAM,QAAQ,GAAG,WAAW,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,GAAG,CAAC,CAAC,CAAA;IAC3E,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG;QAAE,OAAO,QAAQ,CAAA;IAC3C,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,CAAA;AACjD,CAAC;AAED,yGAAyG;AACzG,MAAM,oBAAoB,GAAG,SAAS,CAAA;AAEtC;;8DAE8D;AAC9D,SAAS,YAAY,CACnB,KAA8B,EAC9B,UAA6C,EAC7C,SAAkB;IAElB,MAAM,YAAY,GAChB,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;QACpF,CAAC,CAAE,KAAK,CAAC,KAAiC;QAC1C,CAAC,CAAC,SAAS,CAAA;IACf,OAAO;QACL,GAAG,KAAK;QACR,UAAU,EAAE,UAAU;QACtB,KAAK,EAAE,EAAE,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,UAAU,EAAE;QAClE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5E,CAAA;AACH,CAAC;AAED;;wGAEwG;AACxG,SAAS,cAAc,CAAC,MAA8B,EAAE,IAAa;IACnE,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAA;IACpF,MAAM,IAAI,GACR,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;QACpD,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE;QACpD,CAAC,CAAC,SAAS,CAAA;IACf,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE;QAC7B,GAAG,CAAC,MAAM,CAAC,iBAAiB,KAAK,SAAS;YACxC,CAAC,CAAC,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE;YACjD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,OAAuB,EACvB,KAAyB,EACzB,UAA6C,EAC7C,WAA8B,EAAE,EAChC,UAA8B,EAAE;IAEhC,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IACtC,MAAM,cAAc,GAAG,EAAE,KAAK,SAAS,CAAA;IACvC,MAAM,GAAG,GAAG,EAAE,IAAI,IAAI,CAAA;IACtB,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAA;IAC1C,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,sBAAsB,EAAE,CAAA;IAEvD,yGAAyG;IACzG,wGAAwG;IACxG,MAAM,gBAAgB,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;IAChD,MAAM,QAAQ,GAAG,gBAAgB,KAAK,SAAS,CAAA;IAC/C,IAAI,QAAQ,IAAI,gBAAgB,KAAK,uBAAuB,EAAE,CAAC;QAC7D,OAAO,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,mBAAmB,EAAE,8BAA8B,EAAE;YAClF,SAAS,EAAE,CAAC,uBAAuB,CAAC;YACpC,SAAS,EAAE,gBAAgB;SAC5B,CAAC,CAAA;IACJ,CAAC;IACD,wGAAwG;IACxG,+FAA+F;IAC/F,MAAM,KAAK,GAAG,CAAC,KAA8B,EAAE,SAAS,GAAG,KAAK,EAAmB,EAAE,CACnF,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;IAE/E,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,kGAAkG;YAClG,mFAAmF;YACnF,MAAM,SAAS,GAAG,MAAM,EAAE,eAAe,CAAA;YACzC,MAAM,eAAe,GACnB,OAAO,SAAS,KAAK,QAAQ,IAAI,2BAA2B,CAAC,GAAG,CAAC,SAAS,CAAC;gBACzE,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,gBAAgB,CAAA;YACtB,OAAO,SAAS,CAAC,GAAG,EAAE;gBACpB,eAAe;gBACf,YAAY,EAAE;oBACZ,KAAK,EAAE,EAAE;oBACT,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAClD,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC9C,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,SAAS;wBAC3B,CAAC,CAAC;4BACE,UAAU,EAAE;gCACV,CAAC,gBAAgB,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,EAAE;6BACtE;yBACF;wBACH,CAAC,CAAC,EAAE,CAAC;iBACR;gBACD,UAAU;aACX,CAAC,CAAA;QACJ,CAAC;QACD,KAAK,iBAAiB;YACpB,8FAA8F;YAC9F,qDAAqD;YACrD,OAAO,SAAS,CACd,GAAG,EACH,YAAY,CACV;gBACE,iBAAiB,EAAE,CAAC,uBAAuB,CAAC;gBAC5C,YAAY,EAAE;oBACZ,KAAK,EAAE,EAAE;oBACT,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAClD,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC9C,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,SAAS;wBAC3B,CAAC,CAAC;4BACE,UAAU,EAAE;gCACV,CAAC,gBAAgB,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,EAAE;6BACtE;yBACF;wBACH,CAAC,CAAC,EAAE,CAAC;iBACR;gBACD,GAAG,CAAC,QAAQ,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxF,EACD,UAAU,EACV,IAAI,CACL,CACF,CAAA;QACH,KAAK,2BAA2B;YAC9B,OAAO,IAAI,CAAA;QACb,KAAK,yBAAyB,CAAC,CAAC,CAAC;YAC/B,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;YACzC,IAAI,GAAG,KAAK,SAAS;gBAAE,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAA;YACvF,OAAO,IAAI,CAAA;QACb,CAAC;QACD,KAAK,MAAM;YACT,OAAO,SAAS,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;QAC3B,KAAK,YAAY;YACf,OAAO,KAAK,CACV,MAAM,EAAE,OAAO,KAAK,IAAI;gBACtB,CAAC,CAAC;oBACE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;wBACvB,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,WAAW,EAAE,kBAAkB,CAAC,CAAC,CAAC,WAAW,CAAC;qBAC/C,CAAC,CAAC;iBACJ;gBACH,CAAC,CAAC;oBACE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;wBACvB,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;wBAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;wBAC1B,GAAG,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACtE,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACrD,CAAC,CAAC;iBACJ,EACL,IAAI,CACL,CAAA;QACH,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,CAAA;YACzB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;YAC/C,IAAI,CAAC,IAAI;gBAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,iBAAiB,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YACxE,OAAO,KAAK,CAAC;gBACX,IAAI,EAAE;oBACJ,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5E,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC3D;aACF,CAAC,CAAA;QACJ,CAAC;QACD,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,CAAA;YACzB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;YAC/C,IAAI,CAAC,IAAI;gBAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,iBAAiB,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YACxE,MAAM,IAAI,GAAI,MAAM,EAAE,SAAqC,IAAI,EAAE,CAAA;YACjE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;YACxC,MAAM,GAAG,GAAG,UAAU,CAAC,EAAE,CAAC,CAAA;YAC1B,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;YAChE,IAAI,GAAG,KAAK,SAAS;gBAAE,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;YAChE,MAAM,aAAa,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;YAC7C,IAAI,YAAY,GAAG,MAAM,CAAC,iBAAiB,CAAA;YAC3C,MAAM,cAAc,GAAG,CAAC,QAAgB,EAAE,KAAc,EAAQ,EAAE;gBAChE,IACE,aAAa,KAAK,SAAS;oBAC3B,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;oBAC1B,QAAQ,IAAI,YAAY;oBACxB,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAChD,CAAC;oBACD,OAAM;gBACR,CAAC;gBACD,YAAY,GAAG,QAAQ,CAAA;gBACvB,OAAO,CAAC,gBAAgB,EAAE,CAAC;oBACzB,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,wBAAwB;oBAChC,MAAM,EAAE;wBACN,aAAa;wBACb,QAAQ;wBACR,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC1C;iBACF,CAAC,CAAA;YACJ,CAAC,CAAA;YACD,IAAI,CAAC;gBACH,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;gBACpB,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;oBAAE,MAAM,IAAI,YAAY,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;gBAChF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;oBACtC,MAAM,EAAE,UAAU,CAAC,MAAM;oBACzB,SAAS,EAAE,GAAG;oBACd,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzD,cAAc;iBACf,CAAC,CAAA;gBACF,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;oBAAE,MAAM,IAAI,YAAY,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;gBAChF,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;gBACpB,OAAO,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;YAC5C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBAC9B,OAAO,KAAK,CAAC;wBACX,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;wBAClE,OAAO,EAAE,IAAI;qBACd,CAAC,CAAA;gBACJ,CAAC;gBACD,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBAC5D,OAAO,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;YACrF,CAAC;oBAAS,CAAC;gBACT,YAAY,EAAE,CAAA;gBACd,IAAI,GAAG,KAAK,SAAS,IAAI,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,UAAU,EAAE,CAAC;oBACtE,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBAClC,CAAC;YACH,CAAC;QACH,CAAC;QACD,KAAK,gBAAgB;YACnB,OAAO,KAAK,CACV;gBACE,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAC/B,GAAG,EAAE,CAAC,CAAC,GAAG;oBACV,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,GAAG,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtE,GAAG,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7D,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACrD,CAAC,CAAC;aACJ,EACD,IAAI,CACL,CAAA;QACH,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,MAAM,GAAG,GAAG,MAAM,EAAE,GAAG,CAAA;YACvB,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAA;YACrD,IAAI,CAAC,QAAQ;gBAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,qBAAqB,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YAC/E,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;gBACrC,OAAO,KAAK,CACV;oBACE,QAAQ,EAAE;wBACR;4BACE,GAAG,EAAE,QAAQ,CAAC,GAAG;4BACjB,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,IAAI,YAAY;4BAC/D,IAAI,EAAE,OAAO,CAAC,IAAI;4BAClB,GAAG,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;yBACnE;qBACF;iBACF,EACD,IAAI,CACL,CAAA;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,8FAA8F;gBAC9F,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,4BAA4B,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACzE,CAAC;QACH,CAAC;QACD,KAAK,cAAc;YACjB,OAAO,KAAK,CACV;gBACE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAC3B,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,GAAG,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACjE,CAAC,CAAC;aACJ,EACD,IAAI,CACL,CAAA;QACH,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,CAAA;YACzB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;YACnD,IAAI,CAAC,MAAM;gBAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,mBAAmB,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YAC5E,MAAM,IAAI,GAAI,MAAM,EAAE,SAAqC,IAAI,EAAE,CAAA;YACjE,IAAI,CAAC;gBACH,OAAO,KAAK,CAAC;oBACX,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,QAAQ,EAAE,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;iBACrC,CAAC,CAAA;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBAC5D,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;YACnC,CAAC;QACH,CAAC;QACD;YACE,IAAI,cAAc;gBAAE,OAAO,IAAI,CAAA;YAC/B,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,qBAAqB,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IACvE,CAAC;AACH,CAAC"}

package/dist/server.d.ts

@@ -34,6 +34,11 @@ export interface CreateMcpServerOptions {
     readonly health?: string;
     /** Max JSON-RPC body size in bytes (default 1 MB). */
     readonly maxBodyBytes?: number;
+    /** Natural-language guidance for LLMs, surfaced in the modern `server/discover` result (2026-07-28). */
+    readonly instructions?: string;
+    /** Origin allowlist for the DNS-rebinding guard. Omit to allow any origin; set it to reject other
+     * browser origins with 403 (e.g. a hardened, non-public mount). */
+    readonly allowedOrigins?: readonly string[];
 }
 export interface McpServer {
     readonly tools: McpTool[];

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,OAAO,EAEb,MAAM,eAAe,CAAA;AACtB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAE5C,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAA;IACnC,6FAA6F;IAC7F,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,SAAS,EAAE,CAAA;IACvC,8CAA8C;IAC9C,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,WAAW,EAAE,CAAA;IAC3C,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,SAAS,EAAE,CAAA;IACvC,4BAA4B;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,sDAAsD;IACtD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAC/B;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAA;IACpC,QAAQ,CAAC,UAAU,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IACtD,qGAAqG;IACrG,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC1C,mGAAmG;IACnG,MAAM,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAA;CACjE;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,sBAAsB,GAAG,SAAS,CAwBvE"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,OAAO,EAEb,MAAM,eAAe,CAAA;AACtB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAE5C,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAA;IACnC,6FAA6F;IAC7F,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,SAAS,EAAE,CAAA;IACvC,8CAA8C;IAC9C,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,WAAW,EAAE,CAAA;IAC3C,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,SAAS,EAAE,CAAA;IACvC,4BAA4B;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,sDAAsD;IACtD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,wGAAwG;IACxG,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B;uEACmE;IACnE,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAC5C;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAA;IACpC,QAAQ,CAAC,UAAU,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IACtD,qGAAqG;IACrG,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC1C,mGAAmG;IACnG,MAAM,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAA;CACjE;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,sBAAsB,GAAG,SAAS,CA0BvE"}

package/dist/server.js

@@ -32,6 +32,7 @@ export function createMcpServer(opts) {
         ...(resources.length > 0 ? { resources } : {}),
         ...(opts.prompts !== undefined ? { prompts: opts.prompts } : {}),
         ...(widgets.length > 0 ? { ui: { mimeTypes: [UI_MIME] } } : {}),
+        ...(opts.instructions !== undefined ? { instructions: opts.instructions } : {}),
     };
     return {
         tools,
@@ -41,6 +42,7 @@ export function createMcpServer(opts) {
             features,
             ...(opts.health !== undefined ? { health: opts.health } : {}),
             ...(opts.maxBodyBytes !== undefined ? { maxBodyBytes: opts.maxBodyBytes } : {}),
+            ...(opts.allowedOrigins !== undefined ? { allowedOrigins: opts.allowedOrigins } : {}),
         }),
         handle: (message) => handleRpc(message, tools, serverInfo, features),
     };

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAC1C,OAAO,EACL,SAAS,EAOT,OAAO,GACR,MAAM,eAAe,CAAA;AA4BtB,MAAM,UAAU,eAAe,CAAC,IAA4B;IAC1D,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAA;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAA;IAClC,sGAAsG;IACtG,gDAAgD;IAChD,MAAM,SAAS,GAAkB,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAA;IAC/F,MAAM,UAAU,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAA;IAC7D,MAAM,QAAQ,GAAsB;QAClC,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChE,CAAA;IACD,OAAO;QACL,KAAK;QACL,QAAQ;QACR,UAAU;QACV,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CACjB,cAAc,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE;YACzC,QAAQ;YACR,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChF,CAAC;QACJ,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC;KACrE,CAAA;AACH,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAC1C,OAAO,EACL,SAAS,EAOT,OAAO,GACR,MAAM,eAAe,CAAA;AAiCtB,MAAM,UAAU,eAAe,CAAC,IAA4B;IAC1D,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAA;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAA;IAClC,sGAAsG;IACtG,gDAAgD;IAChD,MAAM,SAAS,GAAkB,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAA;IAC/F,MAAM,UAAU,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAA;IAC7D,MAAM,QAAQ,GAAsB;QAClC,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChF,CAAA;IACD,OAAO;QACL,KAAK;QACL,QAAQ;QACR,UAAU;QACV,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CACjB,cAAc,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE;YACzC,QAAQ;YACR,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtF,CAAC;QACJ,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC;KACrE,CAAA;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nifrajs/mcp",
-  "version": "2.3.0",
+  "version": "2.5.0",
   "description": "Build MCP servers - and MCP Apps (interactive `ui://` widgets, SEP-1865) - for a nifra app. The transport-agnostic JSON-RPC core (also used by `@nifrajs/cli`'s dev MCP), a Streamable-HTTP handler you mount at `POST /mcp`, and `defineMcpWidget`/`defineMcpTool` for tool results that render real UI in MCP hosts.",
   "keywords": [
     "bun",

package/src/http.ts

@@ -10,15 +10,45 @@
 import {
   handleRpc,
   type JsonRpcRequest,
+  type JsonRpcResponse,
+  MCP_ERROR,
   type McpServerFeatures,
   type McpTool,
+  modernVersionOf,
   rpcError,
 } from "./protocol.ts"
 
-const CORS: Record<string, string> = {
-  "access-control-allow-origin": "*",
+// Headers on every response. `access-control-allow-headers` lists the request headers a browser MCP client
+// (claude.ai, ChatGPT) actually sends: `mcp-protocol-version` (required per POST since 2025-06-18),
+// `mcp-method`/`mcp-name` (the 2026-07-28 request-metadata mirror), `authorization` (OAuth-protected hosts),
+// plus `accept`/`last-event-id`. Omit any and the CORS preflight fails, so the connector never loads.
+const CORS_BASE: Record<string, string> = {
   "access-control-allow-methods": "POST, GET, OPTIONS",
-  "access-control-allow-headers": "content-type",
+  "access-control-allow-headers":
+    "content-type, authorization, mcp-protocol-version, mcp-session-id, mcp-method, mcp-name, accept, last-event-id",
+  "access-control-expose-headers": "mcp-protocol-version, mcp-session-id",
+  "access-control-max-age": "86400",
+}
+
+/**
+ * Resolve the CORS/Origin headers for one request against the host's `allowedOrigins` policy, or `null`
+ * when the request's `Origin` is present but not allowed - the caller then answers 403, per the
+ * Streamable-HTTP DNS-rebinding rule ("Servers MUST validate the `Origin` header ... respond with 403").
+ * With no policy (the default) every origin is allowed and reflected as `*` - correct for a public,
+ * secret-free, unauthenticated server, whose browser clients send arbitrary origins we can't enumerate.
+ */
+function corsFor(
+  request: Request,
+  allowedOrigins: readonly string[] | undefined,
+): Record<string, string> | null {
+  if (allowedOrigins === undefined) return { ...CORS_BASE, "access-control-allow-origin": "*" }
+  const origin = request.headers.get("origin")
+  // A caller with no Origin (curl, server-to-server) can't mount a DNS-rebinding attack - allow it.
+  if (origin === null) return { ...CORS_BASE, vary: "Origin" }
+  if (allowedOrigins.includes(origin)) {
+    return { ...CORS_BASE, "access-control-allow-origin": origin, vary: "Origin" }
+  }
+  return null
 }
 
 const DEFAULT_MAX_BODY_BYTES = 1_000_000
@@ -31,6 +61,12 @@ export interface McpHttpOptions {
   readonly features?: McpServerFeatures
   /** Shown on the GET health page so each host can describe itself. */
   readonly health?: string
+  /**
+   * Origin allowlist for the DNS-rebinding guard. Omit (the default) to allow any origin - the right
+   * choice for a public, unauthenticated docs server that can't enumerate its browser clients' origins.
+   * Set it (e.g. a localhost origin for a hardened local host) to reject any other browser origin with 403.
+   */
+  readonly allowedOrigins?: readonly string[]
 }
 
 function parseContentLength(value: string): number | undefined {
@@ -86,10 +122,69 @@ async function readJsonBounded(
   }
 }
 
+const SENTINEL_PREFIX = "=?base64?"
+const SENTINEL_SUFFIX = "?="
+
+/** Decode the Streamable-HTTP `=?base64?...?=` header sentinel (used when a name/uri isn't header-safe).
+ * A plain value passes through; a malformed sentinel is returned as-is so validation still fails closed. */
+function decodeSentinel(value: string | null): string | null {
+  if (value === null) return null
+  if (!value.startsWith(SENTINEL_PREFIX) || !value.endsWith(SENTINEL_SUFFIX)) return value
+  const encoded = value.slice(SENTINEL_PREFIX.length, value.length - SENTINEL_SUFFIX.length)
+  try {
+    return TEXT_DECODER.decode(Uint8Array.from(atob(encoded), (ch) => ch.charCodeAt(0)))
+  } catch {
+    return value
+  }
+}
+
+/** Validate a modern (2026-07-28) request's mirrored headers against its body: `MCP-Protocol-Version`,
+ * `Mcp-Method`, and - for name-bearing methods - `Mcp-Name` MUST match, else a `HeaderMismatch` the caller
+ * returns as 400. Stops an intermediary from routing on a header while the server acts on a different body. */
+function modernHeaderMismatch(
+  request: Request,
+  message: JsonRpcRequest,
+  bodyVersion: string,
+): JsonRpcResponse | null {
+  const rid = message.id ?? null
+  const headerVersion = request.headers.get("mcp-protocol-version")
+  if (headerVersion === null || headerVersion !== bodyVersion) {
+    return rpcError(
+      rid,
+      MCP_ERROR.HEADER_MISMATCH,
+      "MCP-Protocol-Version header missing or mismatched",
+    )
+  }
+  const method = typeof message.method === "string" ? message.method : ""
+  const headerMethod = request.headers.get("mcp-method")
+  if (headerMethod === null || headerMethod !== method) {
+    return rpcError(rid, MCP_ERROR.HEADER_MISMATCH, "Mcp-Method header missing or mismatched")
+  }
+  if (method === "tools/call" || method === "resources/read" || method === "prompts/get") {
+    const bodyName = method === "resources/read" ? message.params?.uri : message.params?.name
+    const headerName = decodeSentinel(request.headers.get("mcp-name"))
+    if (headerName === null || typeof bodyName !== "string" || headerName !== bodyName) {
+      return rpcError(rid, MCP_ERROR.HEADER_MISMATCH, "Mcp-Name header missing or mismatched")
+    }
+  }
+  return null
+}
+
+/** HTTP status for a modern request's dispatch result: 400 for version/header errors, 404 for an unknown
+ * method, 200 otherwise (in-band tool errors are ordinary JSON-RPC results and stay 200). */
+function modernErrorStatus(response: JsonRpcResponse): number {
+  if (!("error" in response)) return 200
+  const { code } = response.error
+  if (code === MCP_ERROR.UNSUPPORTED_VERSION || code === MCP_ERROR.HEADER_MISMATCH) return 400
+  return code === -32601 ? 404 : 200
+}
+
 /**
  * Handle one MCP request over HTTP against the given `tools`/`features`. POST a JSON-RPC body → JSON-RPC
  * response; GET → a plain-text health page; OPTIONS → CORS preflight. Never throws - a bad body becomes a
- * JSON-RPC parse error. The dispatch is the shared, transport-agnostic {@link handleRpc}.
+ * JSON-RPC parse error. Dual-era: a modern (2026-07-28) POST that mirrors its method/name/version into
+ * headers is validated against the body before dispatch and gets spec HTTP statuses; legacy requests are
+ * served unchanged. The dispatch is the shared, transport-agnostic {@link handleRpc}.
  */
 export async function respondMcpHttp(
   request: Request,
@@ -97,18 +192,33 @@ export async function respondMcpHttp(
   serverInfo: { name: string; version: string },
   options: McpHttpOptions = {},
 ): Promise<Response> {
-  if (request.method === "OPTIONS") return new Response(null, { status: 204, headers: CORS })
+  const cors = corsFor(request, options.allowedOrigins)
+  if (cors === null) {
+    // Origin present but not allowlisted: reject before the body is ever read (DNS-rebinding guard). No
+    // `id` (no request parsed) and no CORS headers - a disallowed origin gets nothing to work with.
+    return Response.json(rpcError(null, -32600, "origin not allowed"), { status: 403 })
+  }
+  if (request.method === "OPTIONS") return new Response(null, { status: 204, headers: cors })
   if (request.method === "GET") {
+    // The 2026-07-28 revision removed the GET SSE stream; a client probing for it (`Accept:
+    // text/event-stream`) gets 405 so its transport fallback fires. A plain browser/monitor GET still
+    // gets the human-readable health page.
+    if ((request.headers.get("accept") ?? "").includes("text/event-stream")) {
+      return new Response("event stream not supported", {
+        status: 405,
+        headers: { allow: "POST, GET", ...cors },
+      })
+    }
     return new Response(
       options.health ??
         "MCP server - POST JSON-RPC 2.0 here (methods: initialize, tools/list, tools/call).",
-      { headers: { "content-type": "text/plain; charset=utf-8", ...CORS } },
+      { headers: { "content-type": "text/plain; charset=utf-8", ...cors } },
     )
   }
   if (request.method !== "POST") {
     return new Response("method not allowed", {
       status: 405,
-      headers: { allow: "POST, GET", ...CORS },
+      headers: { allow: "POST, GET", ...cors },
     })
   }
   const parsed = await readJsonBounded(request, options.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES)
@@ -116,16 +226,27 @@ export async function respondMcpHttp(
     if (parsed.status === 413) {
       return Response.json(rpcError(null, -32000, "payload too large"), {
         status: 413,
-        headers: CORS,
+        headers: cors,
       })
     }
-    return Response.json(rpcError(null, -32700, "parse error"), { status: 400, headers: CORS })
+    return Response.json(rpcError(null, -32700, "parse error"), { status: 400, headers: cors })
   }
   const message = parsed.value as JsonRpcRequest
+  const bodyVersion = modernVersionOf(message.params)
+  // Mirror the protocol version back for intermediaries (SHOULD, 2025-06-18+); absent is fine.
+  const echoVersion = request.headers.get("mcp-protocol-version")
+  const headers = echoVersion !== null ? { ...cors, "mcp-protocol-version": echoVersion } : cors
+  if (bodyVersion !== undefined) {
+    // Modern request: header/body mirror MUST agree. Reject divergence with 400 before dispatch.
+    const headerError = modernHeaderMismatch(request, message, bodyVersion)
+    if (headerError !== null) return Response.json(headerError, { status: 400, headers })
+  }
   const response = await handleRpc(message, tools, serverInfo, options.features ?? {}, {
     signal: request.signal,
   })
-  // A notification (no id) yields null - acknowledge with 204, no body.
-  if (response === null) return new Response(null, { status: 204, headers: CORS })
-  return Response.json(response, { headers: CORS })
+  // A notification (no id) yields null - acknowledge with 202 Accepted and no body (Streamable-HTTP).
+  if (response === null) return new Response(null, { status: 202, headers })
+  // Modern requests carry spec HTTP statuses (400 version/header, 404 unknown method); legacy stays 200.
+  const status = bodyVersion !== undefined ? modernErrorStatus(response) : 200
+  return Response.json(response, { status, headers })
 }

package/src/protocol.ts

@@ -10,7 +10,28 @@
  * it is additive - a tool whose handler returns a plain `string` behaves exactly as before.
  */
 
-export const PROTOCOL_VERSION = "2024-11-05"
+/** The protocol revision this server advertises by default. A handshake-era version - the HTTP transport
+ * still uses `initialize`; current clients reach it through their backward-compatibility fallback.
+ * `initialize` echoes the client's own requested version instead when it's one this server also speaks
+ * ({@link SUPPORTED_PROTOCOL_VERSIONS}). */
+export const PROTOCOL_VERSION = "2025-06-18"
+/** The handshake-era revisions this server speaks. `initialize` echoes the client's requested
+ * `protocolVersion` when it's in this set (the smoothest negotiation), else answers {@link PROTOCOL_VERSION}. */
+const SUPPORTED_PROTOCOL_VERSIONS = new Set([
+  "2024-11-05",
+  "2025-03-26",
+  "2025-06-18",
+  "2025-11-25",
+])
+
+/** The stateless per-request revision (2026-07-28+). A request carrying its version in `_meta`
+ * (`io.modelcontextprotocol/protocolVersion`) is served in modern mode; an `initialize` request stays
+ * legacy. This server is dual-era: `handleRpc` answers both on the same dispatch, per request. */
+export const MODERN_PROTOCOL_VERSION = "2026-07-28"
+/** MCP-reserved JSON-RPC error codes (2026-07-28 error-code policy carves out -32020..-32099 for the spec). */
+export const MCP_ERROR = { HEADER_MISMATCH: -32020, UNSUPPORTED_VERSION: -32022 } as const
+const META_PROTOCOL_VERSION = "io.modelcontextprotocol/protocolVersion"
+const META_SERVER_INFO = "io.modelcontextprotocol/serverInfo"
 
 /** The MIME type a UI resource MUST use so a host recognizes it as an MCP App widget (SEP-1865). */
 export const UI_MIME = "text/html;profile=mcp-app"
@@ -103,6 +124,9 @@ export interface McpServerFeatures {
   /** Advertise the MCP Apps UI extension in `initialize`. Present when the server serves `ui://` widgets;
    * `mimeTypes` defaults to `[UI_MIME]`. */
   readonly ui?: { readonly mimeTypes?: readonly string[] }
+  /** Natural-language guidance for LLMs on how to use this server. Surfaced in the modern
+   * `server/discover` result (2026-07-28); legacy `initialize` does not carry it. */
+  readonly instructions?: string
 }
 
 export interface JsonRpcRequest {
@@ -120,17 +144,22 @@ export interface JsonRpcNotification {
 
 export type JsonRpcResponse =
   | { jsonrpc: "2.0"; id: JsonRpcId; result: unknown }
-  | { jsonrpc: "2.0"; id: JsonRpcId; error: { code: number; message: string } }
+  | { jsonrpc: "2.0"; id: JsonRpcId; error: { code: number; message: string; data?: unknown } }
 
 export const rpcResult = (id: JsonRpcId, value: unknown): JsonRpcResponse => ({
   jsonrpc: "2.0",
   id,
   result: value,
 })
-export const rpcError = (id: JsonRpcId, code: number, message: string): JsonRpcResponse => ({
+export const rpcError = (
+  id: JsonRpcId,
+  code: number,
+  message: string,
+  data?: unknown,
+): JsonRpcResponse => ({
   jsonrpc: "2.0",
   id,
-  error: { code, message },
+  error: data !== undefined ? { code, message, data } : { code, message },
 })
 
 export interface McpProtocolState {
@@ -152,10 +181,24 @@ function requestKey(id: unknown): string | undefined {
   return typeof id === "number" && Number.isFinite(id) ? `n:${id}` : undefined
 }
 
-function progressTokenOf(params: Record<string, unknown> | undefined): ProgressToken | undefined {
+function metaObject(
+  params: Record<string, unknown> | undefined,
+): Record<string, unknown> | undefined {
   const meta = params?._meta
-  if (typeof meta !== "object" || meta === null || Array.isArray(meta)) return undefined
-  const token = (meta as Record<string, unknown>).progressToken
+  return typeof meta === "object" && meta !== null && !Array.isArray(meta)
+    ? (meta as Record<string, unknown>)
+    : undefined
+}
+
+/** The protocol version a modern (2026-07-28+) request declares in `_meta`, or `undefined` for a legacy
+ * request. Its presence is what puts the dispatch in modern mode for that one request. */
+export function modernVersionOf(params: Record<string, unknown> | undefined): string | undefined {
+  const version = metaObject(params)?.[META_PROTOCOL_VERSION]
+  return typeof version === "string" ? version : undefined
+}
+
+function progressTokenOf(params: Record<string, unknown> | undefined): ProgressToken | undefined {
+  const token = metaObject(params)?.progressToken
   return typeof token === "string" || (typeof token === "number" && Number.isFinite(token))
     ? token
     : undefined
@@ -191,6 +234,29 @@ function compactDescription(description: string): string {
   return `${sentence.slice(0, 117).trimEnd()}...`
 }
 
+/** Freshness hint for the static docs corpus - a modern client MAY cache list/read results this long. */
+const DEFAULT_CACHE_TTL_MS = 3_600_000
+
+/** Wrap a result in the 2026-07-28 completion envelope: `resultType`, a self-identifying `serverInfo`
+ * under `_meta`, and - for the cacheable list/read methods - a public freshness hint. Legacy results skip
+ * this entirely and keep their exact pre-2026-07-28 shape. */
+function withEnvelope(
+  value: Record<string, unknown>,
+  serverInfo: { name: string; version: string },
+  cacheable: boolean,
+): Record<string, unknown> {
+  const existingMeta =
+    typeof value._meta === "object" && value._meta !== null && !Array.isArray(value._meta)
+      ? (value._meta as Record<string, unknown>)
+      : undefined
+  return {
+    ...value,
+    resultType: "complete",
+    _meta: { ...(existingMeta ?? {}), [META_SERVER_INFO]: serverInfo },
+    ...(cacheable ? { ttlMs: DEFAULT_CACHE_TTL_MS, cacheScope: "public" } : {}),
+  }
+}
+
 /** Normalize a handler's return into the `tools/call` result object. A `string` becomes a single text
  * block (base-MCP behavior, unchanged); a {@link McpToolResult} passes `content`/`structuredContent`
  * through, and inherits the tool descriptor's `_meta` (the `ui.resourceUri` link) when it sets none. */
@@ -228,10 +294,32 @@ export async function handleRpc(
   const prompts = features.prompts ?? []
   const state = options.state ?? createMcpProtocolState()
 
+  // A request that declares its version in `_meta` is a modern (2026-07-28+) request. We speak exactly one
+  // modern revision; any other declared version is rejected so the client can retry with a supported one.
+  const requestedVersion = modernVersionOf(params)
+  const isModern = requestedVersion !== undefined
+  if (isModern && requestedVersion !== MODERN_PROTOCOL_VERSION) {
+    return rpcError(rid, MCP_ERROR.UNSUPPORTED_VERSION, "Unsupported protocol version", {
+      supported: [MODERN_PROTOCOL_VERSION],
+      requested: requestedVersion,
+    })
+  }
+  // Modern results carry the completion envelope; legacy results keep their exact prior shape. Every data
+  // case returns through `reply` so the one `isModern` decision drives the whole response shape.
+  const reply = (value: Record<string, unknown>, cacheable = false): JsonRpcResponse =>
+    rpcResult(rid, isModern ? withEnvelope(value, serverInfo, cacheable) : value)
+
   switch (method) {
-    case "initialize":
+    case "initialize": {
+      // Handshake version negotiation: answer with the client's requested version when we speak it too,
+      // otherwise our default. The client then decides whether our answer is acceptable.
+      const requested = params?.protocolVersion
+      const protocolVersion =
+        typeof requested === "string" && SUPPORTED_PROTOCOL_VERSIONS.has(requested)
+          ? requested
+          : PROTOCOL_VERSION
       return rpcResult(rid, {
-        protocolVersion: PROTOCOL_VERSION,
+        protocolVersion,
         capabilities: {
           tools: {},
           ...(resources.length > 0 ? { resources: {} } : {}),
@@ -246,6 +334,33 @@ export async function handleRpc(
         },
         serverInfo,
       })
+    }
+    case "server/discover":
+      // The modern capability/identity probe (replaces `initialize` for 2026-07-28 clients). Always
+      // enveloped and cacheable - it is a modern-only RPC.
+      return rpcResult(
+        rid,
+        withEnvelope(
+          {
+            supportedVersions: [MODERN_PROTOCOL_VERSION],
+            capabilities: {
+              tools: {},
+              ...(resources.length > 0 ? { resources: {} } : {}),
+              ...(prompts.length > 0 ? { prompts: {} } : {}),
+              ...(features.ui !== undefined
+                ? {
+                    extensions: {
+                      [UI_EXTENSION_KEY]: { mimeTypes: features.ui.mimeTypes ?? [UI_MIME] },
+                    },
+                  }
+                : {}),
+            },
+            ...(features.instructions !== undefined ? { instructions: features.instructions } : {}),
+          },
+          serverInfo,
+          true,
+        ),
+      )
     case "notifications/initialized":
       return null
     case "notifications/cancelled": {
@@ -256,8 +371,7 @@ export async function handleRpc(
     case "ping":
       return rpcResult(rid, {})
     case "tools/list":
-      return rpcResult(
-        rid,
+      return reply(
         params?.compact === true
           ? {
               tools: tools.map((t) => ({
@@ -274,12 +388,13 @@ export async function handleRpc(
                 ...(t._meta !== undefined ? { _meta: t._meta } : {}),
               })),
             },
+        true,
       )
     case "tools/describe": {
       const name = params?.name
       const tool = tools.find((t) => t.name === name)
       if (!tool) return rpcError(rid, -32602, `unknown tool: ${String(name)}`)
-      return rpcResult(rid, {
+      return reply({
         tool: {
           name: tool.name,
           description: tool.description,
@@ -331,16 +446,16 @@ export async function handleRpc(
         })
         if (controller.signal.aborted) throw new DOMException("cancelled", "AbortError")
         reportProgress(1, 1)
-        return rpcResult(rid, toolCallResult(result, tool))
+        return reply(toolCallResult(result, tool))
       } catch (err) {
         if (controller.signal.aborted) {
-          return rpcResult(rid, {
+          return reply({
             content: [{ type: "text", text: abortMessage(controller.signal) }],
             isError: true,
           })
         }
         const msg = err instanceof Error ? err.message : String(err)
-        return rpcResult(rid, { content: [{ type: "text", text: `Error: ${msg}` }], isError: true })
+        return reply({ content: [{ type: "text", text: `Error: ${msg}` }], isError: true })
       } finally {
         cleanupAbort()
         if (key !== undefined && state.activeRequests.get(key) === controller) {
@@ -349,51 +464,60 @@ export async function handleRpc(
       }
     }
     case "resources/list":
-      return rpcResult(rid, {
-        resources: resources.map((r) => ({
-          uri: r.uri,
-          name: r.name,
-          ...(r.description !== undefined ? { description: r.description } : {}),
-          ...(r.mimeType !== undefined ? { mimeType: r.mimeType } : {}),
-          ...(r._meta !== undefined ? { _meta: r._meta } : {}),
-        })),
-      })
+      return reply(
+        {
+          resources: resources.map((r) => ({
+            uri: r.uri,
+            name: r.name,
+            ...(r.description !== undefined ? { description: r.description } : {}),
+            ...(r.mimeType !== undefined ? { mimeType: r.mimeType } : {}),
+            ...(r._meta !== undefined ? { _meta: r._meta } : {}),
+          })),
+        },
+        true,
+      )
     case "resources/read": {
       const uri = params?.uri
       const resource = resources.find((r) => r.uri === uri)
       if (!resource) return rpcError(rid, -32602, `unknown resource: ${String(uri)}`)
       try {
         const content = await resource.read()
-        return rpcResult(rid, {
-          contents: [
-            {
-              uri: resource.uri,
-              mimeType: content.mimeType ?? resource.mimeType ?? "text/plain",
-              text: content.text,
-              ...(resource._meta !== undefined ? { _meta: resource._meta } : {}),
-            },
-          ],
-        })
+        return reply(
+          {
+            contents: [
+              {
+                uri: resource.uri,
+                mimeType: content.mimeType ?? resource.mimeType ?? "text/plain",
+                text: content.text,
+                ...(resource._meta !== undefined ? { _meta: resource._meta } : {}),
+              },
+            ],
+          },
+          true,
+        )
       } catch {
         // Don't surface the raw read error - it can leak a filesystem path. Return a generic message.
         return rpcError(rid, -32000, `failed to read resource: ${String(uri)}`)
       }
     }
     case "prompts/list":
-      return rpcResult(rid, {
-        prompts: prompts.map((p) => ({
-          name: p.name,
-          description: p.description,
-          ...(p.arguments !== undefined ? { arguments: p.arguments } : {}),
-        })),
-      })
+      return reply(
+        {
+          prompts: prompts.map((p) => ({
+            name: p.name,
+            description: p.description,
+            ...(p.arguments !== undefined ? { arguments: p.arguments } : {}),
+          })),
+        },
+        true,
+      )
     case "prompts/get": {
       const name = params?.name
       const prompt = prompts.find((p) => p.name === name)
       if (!prompt) return rpcError(rid, -32602, `unknown prompt: ${String(name)}`)
       const args = (params?.arguments as Record<string, unknown>) ?? {}
       try {
-        return rpcResult(rid, {
+        return reply({
           description: prompt.description,
           messages: await prompt.handler(args),
         })

package/src/server.ts

@@ -46,6 +46,11 @@ export interface CreateMcpServerOptions {
   readonly health?: string
   /** Max JSON-RPC body size in bytes (default 1 MB). */
   readonly maxBodyBytes?: number
+  /** Natural-language guidance for LLMs, surfaced in the modern `server/discover` result (2026-07-28). */
+  readonly instructions?: string
+  /** Origin allowlist for the DNS-rebinding guard. Omit to allow any origin; set it to reject other
+   * browser origins with 403 (e.g. a hardened, non-public mount). */
+  readonly allowedOrigins?: readonly string[]
 }
 
 export interface McpServer {
@@ -69,6 +74,7 @@ export function createMcpServer(opts: CreateMcpServerOptions): McpServer {
     ...(resources.length > 0 ? { resources } : {}),
     ...(opts.prompts !== undefined ? { prompts: opts.prompts } : {}),
     ...(widgets.length > 0 ? { ui: { mimeTypes: [UI_MIME] } } : {}),
+    ...(opts.instructions !== undefined ? { instructions: opts.instructions } : {}),
   }
   return {
     tools,
@@ -79,6 +85,7 @@ export function createMcpServer(opts: CreateMcpServerOptions): McpServer {
         features,
         ...(opts.health !== undefined ? { health: opts.health } : {}),
         ...(opts.maxBodyBytes !== undefined ? { maxBodyBytes: opts.maxBodyBytes } : {}),
+        ...(opts.allowedOrigins !== undefined ? { allowedOrigins: opts.allowedOrigins } : {}),
       }),
     handle: (message) => handleRpc(message, tools, serverInfo, features),
   }