@nitrostack/core 1.0.14 → 1.0.16

package/dist/core/protocol/modern-v2.adapter.js

@@ -0,0 +1,939 @@
+/**
+ * Modern (2026-07-28) protocol adapter.
+ *
+ * Binds the NitroStack registry to the official `@modelcontextprotocol/server`
+ * v2 engine:
+ *
+ * - HTTP: `createMcpHandler(() => buildServer())` wrapped with
+ *   `toNodeHandler(...)` from `@modelcontextprotocol/node`, mounted on the
+ *   Express app. Stateless per-request serving, `server/discover`, per-request
+ *   `_meta` envelope, `Mcp-Method`/`Mcp-Name` headers, and cache hints are all
+ *   provided by the SDK.
+ * - stdio: `serveStdio(() => buildServer())` from `@modelcontextprotocol/server/stdio`.
+ *
+ * The SDK stamps `_meta['io.modelcontextprotocol/serverInfo']` on every 2026
+ * response from the `Implementation` handed to `new McpServer(...)`.
+ *
+ * The v2 packages are loaded lazily (dynamic `import`) so a default (legacy)
+ * install never touches them and existing Jest suites never load v2. The SDK's
+ * types use minified re-exports, so this file types the SDK surface loosely at
+ * the boundary while keeping NitroStack's own objects strongly typed.
+ *
+ * @module
+ */
+import { MODERN_PROTOCOL_VERSION } from './version.js';
+import { resolveToolCacheHint, resolveResourceCacheHint } from './features/cache-hints.js';
+import { convertToModernJsonSchema } from './features/schema.js';
+import { extractTraceContext } from './features/trace-context.js';
+import { buildExtensionsMap } from './features/extensions.js';
+import { mapToJsonRpcError } from './features/errors.js';
+import { isInputRequired } from './features/mrtr.js';
+import { isMcpAppMode, isOpenAiMode } from '../app-mode.js';
+import { TaskContext, TaskAugmentationRequiredError } from '../task.js';
+/** Meta-key constants (SEP-2575 / SEP-414) used to read the request envelope. */
+const META = {
+    PROTOCOL_VERSION: 'io.modelcontextprotocol/protocolVersion',
+    CLIENT_INFO: 'io.modelcontextprotocol/clientInfo',
+    CLIENT_CAPABILITIES: 'io.modelcontextprotocol/clientCapabilities',
+};
+export class ModernProtocolAdapter {
+    registry;
+    options;
+    era = 'modern';
+    handler;
+    stdioHandle;
+    serverSdkPromise;
+    taskManager;
+    constructor(registry, options = { legacyMode: 'reject' }) {
+        this.registry = registry;
+        this.options = options;
+        this.taskManager = options.taskManager;
+    }
+    loadServerSdk() {
+        if (!this.serverSdkPromise) {
+            this.serverSdkPromise = import('@modelcontextprotocol/server');
+        }
+        return this.serverSdkPromise;
+    }
+    // ==========================================================================
+    // Server construction (called per request by the SDK factory)
+    // ==========================================================================
+    async buildServer() {
+        const sdk = await this.loadServerSdk();
+        const config = this.registry.config;
+        const extensions = this.advertisedExtensions();
+        const serverOptions = {
+            cacheHints: this.buildServerCacheHints(),
+        };
+        if (Object.keys(extensions).length > 0) {
+            // Advertise the SEP-2133 extensions map on server/discover capabilities.
+            serverOptions.capabilities = { extensions };
+        }
+        const server = new sdk.McpServer({ name: config.name, version: config.version }, serverOptions);
+        await this.registerTools(server, sdk);
+        await this.registerResources(server, sdk);
+        await this.registerPrompts(server, sdk);
+        return server;
+    }
+    /** Server-level per-operation cache hints for list/discover results. */
+    buildServerCacheHints() {
+        // Conservative shared default for list surfaces; per-resource hints still win.
+        return undefined;
+    }
+    async registerTools(server, sdk) {
+        for (const tool of this.registry.getTools().values()) {
+            const inputSchema = await this.toModernSchema(tool.inputSchema, 'input', sdk);
+            const outputSchema = tool.outputSchema
+                ? await this.toModernSchema(tool.outputSchema, 'output', sdk)
+                : undefined;
+            const config = {
+                description: tool.description,
+                inputSchema,
+            };
+            if (tool.title)
+                config.title = tool.title;
+            if (outputSchema)
+                config.outputSchema = outputSchema;
+            if (tool.annotations)
+                config.annotations = tool.annotations;
+            const meta = {};
+            const cacheHint = resolveToolCacheHint(tool);
+            if (cacheHint)
+                meta['io.modelcontextprotocol/cacheHint'] = cacheHint;
+            if (tool.hasComponent && tool.hasComponent()) {
+                const component = tool.getComponent();
+                const resourceUri = component.getResourceUri();
+                const componentMeta = component.getResourceMetadata();
+                meta['ui/template'] = resourceUri;
+                meta['openai/outputTemplate'] = resourceUri;
+                meta['ui'] = { resourceUri };
+                if (componentMeta) {
+                    if (componentMeta['openai/widgetCSP'] !== undefined) {
+                        meta['openai/widgetCSP'] = componentMeta['openai/widgetCSP'];
+                    }
+                    if (componentMeta['openai/widgetDescription'] !== undefined) {
+                        meta['openai/widgetDescription'] = componentMeta['openai/widgetDescription'];
+                    }
+                    if (componentMeta['openai/widgetPrefersBorder'] !== undefined) {
+                        meta['openai/widgetPrefersBorder'] = componentMeta['openai/widgetPrefersBorder'];
+                    }
+                    if (componentMeta['openai/widgetDomain'] !== undefined) {
+                        meta['openai/widgetDomain'] = componentMeta['openai/widgetDomain'];
+                    }
+                }
+            }
+            else if (tool.widget?.route || tool.outputTemplate) {
+                const route = tool.widget?.route || tool.outputTemplate;
+                const normalized = route?.startsWith('/') ? route : `/${route}`;
+                const resourceUri = `/widgets${normalized}`;
+                meta['ui/template'] = resourceUri;
+                meta['openai/outputTemplate'] = resourceUri;
+                meta['ui'] = { resourceUri };
+            }
+            if (tool.examples) {
+                meta['tool/examples'] = tool.examples;
+            }
+            if (tool.isInitial) {
+                meta['tool/initial'] = true;
+            }
+            if (Object.keys(meta).length > 0) {
+                config._meta = meta;
+            }
+            server.registerTool(tool.name, config, async (args, ctx) => this.runTool(tool, args, ctx, sdk));
+        }
+    }
+    async registerResources(server, sdk) {
+        // Static resources and template resources both flow through registerResource.
+        const templateResources = this.registry.getTemplateResources();
+        for (const resource of this.registry.getResources().values()) {
+            // A template resource is registered via its template URI, not the static map.
+            const isTemplate = resource.uri.includes('{') && resource.uri.includes('}');
+            if (isTemplate)
+                continue;
+            const cacheHint = resolveResourceCacheHint(resource);
+            const config = {
+                description: resource.description,
+                mimeType: resource.mimeType,
+            };
+            if (resource.title)
+                config.title = resource.title;
+            if (cacheHint)
+                config.cacheHint = cacheHint;
+            server.registerResource(resource.name, resource.uri, config, async (uri) => this.readResource(String(uri?.href ?? uri), resource, sdk));
+        }
+        // Template resources keyed by uri template.
+        for (const [uriTemplate, resource] of templateResources.entries()) {
+            const cacheHint = resolveResourceCacheHint(resource);
+            const config = {
+                description: resource.description,
+                mimeType: resource.mimeType,
+            };
+            if (resource.title)
+                config.title = resource.title;
+            if (cacheHint)
+                config.cacheHint = cacheHint;
+            try {
+                const ResourceTemplateCtor = sdk.ResourceTemplate;
+                const template = ResourceTemplateCtor
+                    ? new ResourceTemplateCtor(uriTemplate, { list: undefined })
+                    : uriTemplate;
+                server.registerResource(resource.name, template, config, async (uri) => this.readResource(String(uri?.href ?? uri), resource, sdk));
+            }
+            catch (err) {
+                this.registry.logger.warn('Failed to register modern resource template', {
+                    uriTemplate,
+                    error: err instanceof Error ? err.message : String(err),
+                });
+            }
+        }
+        // Modern SDK v2 strictly validates URIs using `new URL(uri)`. To support custom
+        // or relative URI schemes such as `/widgets/*` used by NitroStudio and MCP Apps,
+        // attach a fallback resources/read handler on the underlying MCP server only when
+        // the server actually has resources registered (otherwise SDK throws capability error).
+        const rawResources = this.registry.getResources();
+        if ((rawResources.size > 0 || templateResources.size > 0) && server.server && typeof server.server.setRequestHandler === 'function') {
+            server.server.setRequestHandler('resources/read', async (request, ctx) => {
+                const reqUri = String(request?.params?.uri ?? '');
+                // 1. Check exact match in registered resources (including path-based URIs like /widgets/...)
+                const matchingResource = rawResources.get(reqUri);
+                if (matchingResource) {
+                    const resResult = await this.readResource(reqUri, matchingResource, sdk);
+                    const cacheHint = resolveResourceCacheHint(matchingResource);
+                    if (cacheHint) {
+                        return { ...resResult, cacheHint };
+                    }
+                    return resResult;
+                }
+                // 2. Try URL parsing for standard schemes (mcp://, ui://, http://)
+                let parsedUrl;
+                try {
+                    parsedUrl = new URL(reqUri);
+                }
+                catch {
+                    // If not parseable as standard URL, check if any resource matches
+                    for (const [uri, res] of rawResources.entries()) {
+                        if (uri === reqUri || uri.endsWith(reqUri) || reqUri.endsWith(uri)) {
+                            return this.readResource(reqUri, res, sdk);
+                        }
+                    }
+                }
+                if (parsedUrl) {
+                    const registered = server._registeredResources?.[parsedUrl.toString()] ||
+                        rawResources.get(parsedUrl.toString());
+                    if (registered) {
+                        if (typeof registered.readCallback === 'function') {
+                            return registered.readCallback(parsedUrl, ctx);
+                        }
+                        return this.readResource(reqUri, registered, sdk);
+                    }
+                }
+                // 3. Check template resources
+                if (server._registeredResourceTemplates) {
+                    for (const template of Object.values(server._registeredResourceTemplates)) {
+                        const variables = template.resourceTemplate?.uriTemplate?.match?.(reqUri);
+                        if (variables) {
+                            return template.readCallback(reqUri, variables, ctx);
+                        }
+                    }
+                }
+                throw this.toSdkError(new Error(`Resource not found: ${reqUri}`), sdk);
+            });
+        }
+    }
+    async registerPrompts(server, sdk) {
+        for (const prompt of this.registry.getPrompts().values()) {
+            const args = prompt.arguments;
+            const config = { description: prompt.description };
+            if (prompt.title)
+                config.title = prompt.title;
+            if (args && args.length > 0) {
+                const properties = {};
+                const required = [];
+                for (const arg of args) {
+                    properties[arg.name] = {
+                        type: 'string',
+                        description: arg.description,
+                    };
+                    if (arg.required) {
+                        required.push(arg.name);
+                    }
+                }
+                const rawSchema = {
+                    type: 'object',
+                    properties,
+                };
+                if (required.length > 0) {
+                    rawSchema.required = required;
+                }
+                config.argsSchema = sdk.fromJsonSchema ? sdk.fromJsonSchema(rawSchema) : rawSchema;
+                server.registerPrompt(prompt.name, config, async (promptArgs, ctx) => {
+                    const context = this.buildContext(ctx, { toolName: prompt.name });
+                    const messages = await prompt.execute(promptArgs || {}, context);
+                    return {
+                        description: prompt.description,
+                        messages: messages.map((m) => ({
+                            role: m.role,
+                            content: { type: 'text', text: m.content },
+                        })),
+                    };
+                });
+            }
+            else {
+                server.registerPrompt(prompt.name, config, async (ctx) => {
+                    const context = this.buildContext(ctx, { toolName: prompt.name });
+                    const messages = await prompt.execute({}, context);
+                    return {
+                        description: prompt.description,
+                        messages: messages.map((m) => ({
+                            role: m.role,
+                            content: { type: 'text', text: m.content },
+                        })),
+                    };
+                });
+            }
+        }
+    }
+    // ==========================================================================
+    // Handlers
+    // ==========================================================================
+    async runTool(tool, args, ctx, sdk) {
+        const context = this.buildContext(ctx, { toolName: tool.name });
+        const isTaskAugmented = ctx?.task !== undefined || ctx?.mcpReq?.params?.task !== undefined;
+        // Enforce tool-level task support negotiation
+        if (tool.taskSupport === 'required' && !isTaskAugmented) {
+            throw this.toSdkError(new TaskAugmentationRequiredError(), sdk);
+        }
+        if (tool.taskSupport === 'forbidden' && isTaskAugmented) {
+            throw this.toSdkError({
+                code: -32601,
+                message: `Tool '${tool.name}' does not support task augmentation`,
+            }, sdk);
+        }
+        try {
+            const argsRecord = (args || {});
+            const { _meta: metaFromArgs, ...toolArgs } = argsRecord;
+            if (metaFromArgs && typeof metaFromArgs === 'object') {
+                context.metadata = context.metadata || {};
+                const argMeta = metaFromArgs;
+                const rawAuth = argMeta.authorization || argMeta.Authorization;
+                if (rawAuth) {
+                    context.metadata.authorization = rawAuth;
+                    context.metadata.Authorization = rawAuth;
+                }
+                const rawToken = argMeta.token || argMeta._oauth || argMeta.jwtToken;
+                if (rawToken) {
+                    context.metadata.token = rawToken;
+                    context.metadata._oauth = rawToken;
+                }
+            }
+            const result = await tool.execute(toolArgs, context);
+            // MRTR: a handler may pause and ask for more input.
+            if (isInputRequired(result)) {
+                return sdk.inputRequired({
+                    inputRequests: result.inputRequests,
+                    requestState: result.requestState,
+                    message: result.message,
+                });
+            }
+            const response = {
+                content: [
+                    {
+                        type: 'text',
+                        text: typeof result === 'string' ? result : JSON.stringify(result, null, 2),
+                    },
+                ],
+            };
+            if (tool.hasComponent()) {
+                const component = tool.getComponent();
+                response.structuredContent = (await component.transformData(result, context));
+                const widgetMeta = ((await component.getWidgetMeta(result, context)) || {});
+                response._meta = widgetMeta;
+                if (isMcpAppMode()) {
+                    if (!widgetMeta.ui) {
+                        widgetMeta.ui = { resourceUri: component.getResourceUri() };
+                    }
+                    else if (typeof widgetMeta.ui === 'object' && !('resourceUri' in widgetMeta.ui)) {
+                        widgetMeta.ui.resourceUri = component.getResourceUri();
+                    }
+                }
+                if (isOpenAiMode() && !widgetMeta['openai/outputTemplate']) {
+                    widgetMeta['openai/outputTemplate'] = component.getResourceUri();
+                }
+            }
+            return response;
+        }
+        catch (error) {
+            const mapped = mapToJsonRpcError(error);
+            context.logger.error(`Tool execution failed (modern): ${tool.name}`, { error: mapped.message });
+            // Tool failures are returned as isError results, not JSON-RPC errors.
+            return {
+                content: [{ type: 'text', text: `Error: ${mapped.message}` }],
+                isError: true,
+            };
+        }
+    }
+    /**
+     * Translate a NitroStack/handler error into an SDK error carrying the right
+     * JSON-RPC code for the modern era. Prefers the v2 SDK error classes (so the
+     * SDK serializes `error.code` correctly); falls back to a plain `Error` with
+     * a numeric `code` property the SDK also recognizes.
+     */
+    toSdkError(error, sdk) {
+        const mapped = mapToJsonRpcError(error);
+        // -32602 is the SEP-2164 code for a missing resource and for invalid params;
+        // InvalidParamsError takes a message and serializes with the right code.
+        const Ctor = mapped.code === -32602
+            ? sdk.InvalidParamsError || sdk.ResourceNotFoundError
+            : mapped.code === -32601
+                ? sdk.MethodNotFoundError
+                : sdk.InternalError;
+        if (Ctor) {
+            try {
+                return new Ctor(mapped.message, mapped.data);
+            }
+            catch {
+                /* fall through */
+            }
+        }
+        const err = new Error(mapped.message);
+        err.code = mapped.code;
+        if (mapped.data !== undefined)
+            err.data = mapped.data;
+        return err;
+    }
+    async readResource(uri, resource, sdk) {
+        const context = this.registry.createExecutionContext({
+            extra: { protocolVersion: MODERN_PROTOCOL_VERSION },
+        });
+        let content;
+        try {
+            content = await resource.fetch(context, uri);
+        }
+        catch (error) {
+            // SEP-2164: surface the correct JSON-RPC code on the modern path
+            // (ResourceNotFound → -32602 Invalid Params, not the 2025-era -32002).
+            throw this.toSdkError(error, sdk);
+        }
+        const mimeType = resource.mimeType || 'text/plain';
+        let entry;
+        switch (content.type) {
+            case 'text':
+                entry = { uri, mimeType, text: content.data };
+                break;
+            case 'binary':
+                entry = { uri, mimeType: resource.mimeType || 'application/octet-stream', blob: content.data.toString('base64') };
+                break;
+            case 'json':
+                entry = { uri, mimeType: resource.mimeType || 'application/json', text: JSON.stringify(content.data, null, 2) };
+                break;
+            default:
+                entry = { uri, mimeType: resource.mimeType || 'application/json', text: JSON.stringify(content, null, 2) };
+        }
+        const widgetMeta = resource.getWidgetReadMeta?.();
+        if (widgetMeta && Object.keys(widgetMeta).length > 0) {
+            entry._meta = widgetMeta;
+        }
+        return { contents: [entry] };
+    }
+    // ==========================================================================
+    // Context bridging (per-request envelope → ExecutionContext)
+    // ==========================================================================
+    buildContext(ctx, opts) {
+        const mcpReq = ctx?.mcpReq ?? {};
+        const meta = mcpReq._meta ?? {};
+        const envelope = mcpReq.envelope ?? {};
+        const readEnvelope = (bareKey, prefixedKey) => envelope[prefixedKey] ?? envelope[bareKey] ?? meta[prefixedKey] ?? meta[bareKey];
+        const protocolVersion = readEnvelope('protocolVersion', META.PROTOCOL_VERSION) ?? MODERN_PROTOCOL_VERSION;
+        const clientInfo = readEnvelope('clientInfo', META.CLIENT_INFO);
+        const clientCapabilities = readEnvelope('clientCapabilities', META.CLIENT_CAPABILITIES);
+        let requestState;
+        try {
+            requestState = typeof mcpReq.requestState === 'function' ? mcpReq.requestState() : mcpReq.requestState;
+        }
+        catch {
+            requestState = undefined;
+        }
+        const trace = extractTraceContext({ ...meta, ...envelope });
+        const inputResponses = mcpReq.inputResponses;
+        const authInfo = readEnvelope('auth', 'io.modelcontextprotocol/auth') ??
+            ctx?.http?.authInfo ??
+            mcpReq?.http?.authInfo ??
+            ctx?.authInfo ??
+            ctx?.auth;
+        const rawHeaders = {};
+        const reqHeaders = ctx?.http?.req?.headers ||
+            ctx?.http?.headers ||
+            ctx?.headers ||
+            mcpReq?.headers ||
+            ctx?.req?.headers;
+        if (reqHeaders) {
+            if (typeof reqHeaders.forEach === 'function') {
+                reqHeaders.forEach((val, key) => {
+                    rawHeaders[key.toLowerCase()] = val;
+                    rawHeaders[key] = val;
+                });
+            }
+            else if (typeof reqHeaders.entries === 'function') {
+                for (const [k, v] of reqHeaders.entries()) {
+                    rawHeaders[k.toLowerCase()] = v;
+                    rawHeaders[k] = v;
+                }
+            }
+            else if (typeof reqHeaders === 'object') {
+                for (const [k, v] of Object.entries(reqHeaders)) {
+                    rawHeaders[k.toLowerCase()] = String(v);
+                    rawHeaders[k] = String(v);
+                }
+            }
+        }
+        if (ctx?.http?.req?.headers?.get && typeof ctx.http.req.headers.get === 'function') {
+            const authHeader = ctx.http.req.headers.get('authorization') || ctx.http.req.headers.get('Authorization');
+            if (authHeader) {
+                rawHeaders.authorization = authHeader;
+                rawHeaders.Authorization = authHeader;
+            }
+        }
+        const rawAuth = rawHeaders.authorization ||
+            rawHeaders.Authorization ||
+            (authInfo?.token ? `Bearer ${authInfo.token}` : undefined) ||
+            meta?.authorization ||
+            meta?.Authorization;
+        let rawToken = authInfo?.token ||
+            meta?.token ||
+            meta?._oauth ||
+            meta?.jwtToken ||
+            meta?._meta?.jwtToken ||
+            meta?._meta?.token;
+        if (!rawToken && rawAuth && typeof rawAuth === 'string' && rawAuth.startsWith('Bearer ')) {
+            rawToken = rawAuth.substring(7).trim();
+        }
+        const metadata = {
+            ...rawHeaders,
+            ...meta,
+        };
+        if (rawAuth) {
+            metadata.authorization = rawAuth;
+            metadata.Authorization = rawAuth;
+        }
+        if (rawToken) {
+            metadata.token = rawToken;
+            metadata._oauth = rawToken;
+            metadata.jwtToken = rawToken;
+        }
+        return this.registry.createExecutionContext({
+            toolName: opts.toolName,
+            metadata,
+            extra: {
+                protocolVersion,
+                clientInfo,
+                clientCapabilities,
+                requestState,
+                inputResponses,
+                trace,
+                auth: authInfo ? this.mapAuthInfo(authInfo) : undefined,
+            },
+        });
+    }
+    mapAuthInfo(authInfo) {
+        const user = authInfo.user || authInfo.tokenPayload || authInfo;
+        return {
+            subject: authInfo.subject ?? user.sub ?? authInfo.clientId ?? authInfo.client_id ?? authInfo.extra?.sub,
+            clientId: authInfo.clientId ?? authInfo.client_id ?? user.client_id,
+            scopes: authInfo.scopes ?? (typeof authInfo.scope === 'string' ? authInfo.scope.split(' ') : authInfo.scope) ?? [],
+            claims: authInfo.claims ?? authInfo.extra ?? user,
+            tokenPayload: authInfo.tokenPayload ?? user,
+            exp: authInfo.exp ?? user.exp,
+            iat: authInfo.iat ?? user.iat,
+            iss: authInfo.iss ?? user.iss,
+        };
+    }
+    async toModernSchema(schema, root, sdk) {
+        // NitroStack ships Zod v3, which the v2 SDK cannot ingest directly (it only
+        // accepts Zod >= 4.2.0 or a `fromJsonSchema(...)`-wrapped JSON Schema). So
+        // always lift the schema (Zod or pre-built JSON) to JSON Schema 2020-12
+        // (SEP-2106, preserving composition/$defs) and wrap it with `fromJsonSchema`
+        // when available so the SDK validates against it.
+        const json = await convertToModernJsonSchema(schema, { root });
+        if (sdk.fromJsonSchema) {
+            try {
+                return sdk.fromJsonSchema(json);
+            }
+            catch {
+                /* fall through to raw json */
+            }
+        }
+        return json;
+    }
+    // ==========================================================================
+    // Transport wiring
+    // ==========================================================================
+    /**
+     * Build the stateless per-request Node HTTP handler for the modern engine.
+     * Returned so an existing Express host (NitroStack's `StreamableHttpTransport`)
+     * can route its `/mcp` endpoint to it, keeping one Express app and one set of
+     * OAuth/docs routes.
+     */
+    /**
+     * Build (once) the web-standard v2 handler `{ fetch, close, notify, bus }`
+     * returned by `createMcpHandler`. Idempotent: repeated calls reuse the same
+     * handler so a single notify bus backs `subscriptions/listen`.
+     */
+    async getHttpHandler() {
+        if (!this.handler) {
+            const sdk = await this.loadServerSdk();
+            const rawHandler = sdk.createMcpHandler(() => this.buildServer(), {
+                legacy: this.options.legacyMode,
+                onerror: (error) => {
+                    this.registry.logger.error('Modern MCP handler error', { error: error.message });
+                },
+            });
+            const rawFetch = rawHandler.fetch;
+            this.handler = {
+                ...rawHandler,
+                fetch: async (request, requestOptions) => {
+                    if (request.headers.get('mcp-method') === 'ping') {
+                        try {
+                            const clone = request.clone();
+                            const json = (await clone.json());
+                            return new Response(JSON.stringify({ jsonrpc: '2.0', id: json?.id ?? null, result: {} }), {
+                                status: 200,
+                                headers: { 'Content-Type': 'application/json' },
+                            });
+                        }
+                        catch {
+                            return new Response(JSON.stringify({ jsonrpc: '2.0', id: null, result: {} }), {
+                                status: 200,
+                                headers: { 'Content-Type': 'application/json' },
+                            });
+                        }
+                    }
+                    // Pre-dispatch wire interceptor for tasks methods and task-augmented tools/call
+                    if (this.taskManager) {
+                        try {
+                            const clone = request.clone();
+                            const body = (await clone.json());
+                            const taskResponse = await this.handleTaskPreDispatch(body, request);
+                            if (taskResponse) {
+                                return new Response(JSON.stringify(taskResponse), {
+                                    status: 200,
+                                    headers: { 'Content-Type': 'application/json' },
+                                });
+                            }
+                        }
+                        catch {
+                            // Not JSON or cannot intercept; let rawFetch handle
+                        }
+                    }
+                    return rawFetch(request, requestOptions);
+                },
+            };
+        }
+        return this.handler;
+    }
+    extractAccessContext(req, parsedBody) {
+        const reqAny = req;
+        const auth = reqAny?.auth || reqAny?.user;
+        const userId = auth?.sub || auth?.userId || auth?.id;
+        const tenantId = auth?.tenantId || auth?.orgId;
+        const sessionId = reqAny?.headers?.['mcp-session-id'] || reqAny?.get?.('mcp-session-id');
+        if (!userId && !tenantId && !sessionId) {
+            return undefined;
+        }
+        return { userId, tenantId, sessionId };
+    }
+    async handleTaskPreDispatch(body, req) {
+        if (!this.taskManager || !body || typeof body !== 'object')
+            return null;
+        const { method, params, id } = body;
+        const accessContext = this.extractAccessContext(req, body);
+        // 1. tasks/get
+        if (method === 'tasks/get') {
+            const taskId = params?.taskId;
+            if (!taskId) {
+                return { jsonrpc: '2.0', id: id ?? null, error: { code: -32602, message: 'Invalid params: taskId is required' } };
+            }
+            try {
+                const entry = this.taskManager.getEntry(taskId, accessContext);
+                const resultPayload = { ...entry.data };
+                if (entry.data.status === 'completed' && entry.result !== undefined) {
+                    resultPayload.result = entry.result;
+                }
+                if (entry.data.status === 'failed' && entry.error !== undefined) {
+                    resultPayload.error = entry.error;
+                }
+                return { jsonrpc: '2.0', id: id ?? null, result: resultPayload };
+            }
+            catch (err) {
+                return { jsonrpc: '2.0', id: id ?? null, error: { code: err.code || -32602, message: err.message || 'Task not found' } };
+            }
+        }
+        // 2. tasks/cancel
+        if (method === 'tasks/cancel') {
+            const taskId = params?.taskId;
+            if (!taskId) {
+                return { jsonrpc: '2.0', id: id ?? null, error: { code: -32602, message: 'Invalid params: taskId is required' } };
+            }
+            try {
+                const taskData = this.taskManager.cancelTask(taskId, accessContext);
+                return { jsonrpc: '2.0', id: id ?? null, result: taskData };
+            }
+            catch (err) {
+                return { jsonrpc: '2.0', id: id ?? null, error: { code: err.code || -32602, message: err.message || 'Task not found' } };
+            }
+        }
+        // 3. tasks/update
+        if (method === 'tasks/update') {
+            const taskId = params?.taskId;
+            if (!taskId) {
+                return { jsonrpc: '2.0', id: id ?? null, error: { code: -32602, message: 'Invalid params: taskId is required' } };
+            }
+            try {
+                const taskData = this.taskManager.updateStatus(taskId, params.status || 'working', params.statusMessage, accessContext);
+                return { jsonrpc: '2.0', id: id ?? null, result: taskData };
+            }
+            catch (err) {
+                return { jsonrpc: '2.0', id: id ?? null, error: { code: err.code || -32602, message: err.message || 'Failed to update task' } };
+            }
+        }
+        // 4. tasks/result (legacy 2025-06-18 only; rejected in modern 2026-07-28)
+        if (method === 'tasks/result') {
+            return {
+                jsonrpc: '2.0',
+                id: id ?? null,
+                error: {
+                    code: -32601,
+                    message: "Method 'tasks/result' is not supported in MCP 2026-07-28; use 'tasks/get' with embedded results.",
+                },
+            };
+        }
+        // 5. tasks/list (removed in modern 2026-07-28)
+        if (method === 'tasks/list') {
+            return {
+                jsonrpc: '2.0',
+                id: id ?? null,
+                error: {
+                    code: -32601,
+                    message: "Method 'tasks/list' is not supported in modern stateless MCP 2026-07-28.",
+                },
+            };
+        }
+        // 6. tools/call with task augmentation OR mandatory task support check
+        if (method === 'tools/call' && params) {
+            const toolName = params.name;
+            const tool = this.registry.getTools().get(toolName);
+            if (!tool)
+                return null; // Let standard flow handle tool not found
+            const isTaskAugmented = params.task !== undefined;
+            // Enforcement: if taskSupport === 'required' and not task-augmented
+            if (!isTaskAugmented && tool.taskSupport === 'required') {
+                return {
+                    jsonrpc: '2.0',
+                    id: id ?? null,
+                    error: { code: -32600, message: `Task augmentation required for tools/call requests on tool '${toolName}'` },
+                };
+            }
+            // If task-augmented:
+            if (isTaskAugmented) {
+                if (tool.taskSupport === 'forbidden') {
+                    return {
+                        jsonrpc: '2.0',
+                        id: id ?? null,
+                        error: { code: -32601, message: `Tool '${toolName}' does not support task augmentation` },
+                    };
+                }
+                const taskData = this.taskManager.createTask(params.task, toolName, accessContext);
+                const taskId = taskData.taskId;
+                const taskContext = new TaskContext(this.taskManager, taskId);
+                const executionContext = this.registry.createExecutionContext({
+                    toolName,
+                    extra: {
+                        task: taskContext,
+                    },
+                });
+                executionContext.task = taskContext;
+                const tm = this.taskManager;
+                // Run tool asynchronously in the background
+                Promise.resolve().then(async () => {
+                    try {
+                        const argsRecord = (params.arguments || {});
+                        const { _meta: _, ...toolArgs } = argsRecord;
+                        const toolResult = await tool.execute(toolArgs, executionContext);
+                        if (tm.hasTask(taskId)) {
+                            const current = tm.getTask(taskId);
+                            if (current.status !== 'cancelled') {
+                                tm.completeTask(taskId, toolResult, undefined, accessContext);
+                            }
+                        }
+                    }
+                    catch (err) {
+                        if (tm.hasTask(taskId)) {
+                            const current = tm.getTask(taskId);
+                            if (current.status !== 'cancelled') {
+                                tm.failTask(taskId, { code: err.code || -32603, message: err.message || String(err) }, undefined, accessContext);
+                            }
+                        }
+                    }
+                });
+                // Return CreateTaskResult immediately
+                return {
+                    jsonrpc: '2.0',
+                    id: id ?? null,
+                    result: {
+                        task: taskData,
+                        resultType: 'task',
+                    },
+                };
+            }
+        }
+        return null;
+    }
+    async createNodeHandler() {
+        const node = (await import('@modelcontextprotocol/node'));
+        const handler = await this.getHttpHandler();
+        const nodeHandler = node.toNodeHandler(handler);
+        return (req, res) => {
+            // Express bodyParser/json middleware may have already consumed the request
+            // stream and populated `req.body`. Pass `req.body` so `toWebRequest` uses
+            // the parsed body rather than reading an already-drained request stream.
+            const parsedBody = req.body !== undefined &&
+                req.body !== null &&
+                typeof req.body === 'object' &&
+                Object.keys(req.body).length > 0
+                ? req.body
+                : undefined;
+            // Handle ping directly for studio heartbeat / health monitoring
+            if (parsedBody && parsedBody.method === 'ping') {
+                res.setHeader('Content-Type', 'application/json');
+                res.status(200).json({
+                    jsonrpc: '2.0',
+                    id: parsedBody.id ?? null,
+                    result: {},
+                });
+                return;
+            }
+            // Pre-dispatch wire interceptor for tasks methods and task-augmented tools/call
+            if (parsedBody && this.taskManager) {
+                const taskResponsePromise = this.handleTaskPreDispatch(parsedBody, req);
+                if (taskResponsePromise) {
+                    Promise.resolve(taskResponsePromise).then((resp) => {
+                        if (resp) {
+                            res.setHeader('Content-Type', 'application/json');
+                            res.status(200).json(resp);
+                        }
+                        else {
+                            nodeHandler(req, res, parsedBody);
+                        }
+                    }).catch((err) => {
+                        res.status(500).json({
+                            jsonrpc: '2.0',
+                            id: parsedBody.id ?? null,
+                            error: { code: -32603, message: err instanceof Error ? err.message : String(err) },
+                        });
+                    });
+                    return;
+                }
+            }
+            Promise.resolve(nodeHandler(req, res, parsedBody)).catch((err) => {
+                this.registry.logger.error('Modern MCP request failed', {
+                    error: err instanceof Error ? err.message : String(err),
+                });
+                if (!res.headersSent) {
+                    res.status(500).json({
+                        jsonrpc: '2.0',
+                        error: { code: -32603, message: 'Internal error' },
+                        id: null,
+                    });
+                }
+            });
+        };
+    }
+    async attachHttp(app, options) {
+        const nodeHandler = await this.createNodeHandler();
+        const endpoint = options.endpoint || '/mcp';
+        if (options.enableCors !== false) {
+            app.use(endpoint, (req, res, next) => {
+                this.applyCorsHeaders(req, res);
+                if (req.method === 'OPTIONS') {
+                    res.status(204).end();
+                    return;
+                }
+                next();
+            });
+        }
+        app.all(endpoint, nodeHandler);
+        this.registry.logger.info(`Modern MCP (${MODERN_PROTOCOL_VERSION}) mounted at ${endpoint}`);
+    }
+    /**
+     * SEP-2243/SEP-2575 CORS: expose and allow the new required request headers
+     * (`MCP-Protocol-Version`, `Mcp-Method`, `Mcp-Name`, and `Mcp-Param-*`).
+     */
+    applyCorsHeaders(req, res) {
+        const origin = req.headers.origin;
+        res.setHeader('Access-Control-Allow-Origin', origin || '*');
+        res.setHeader('Vary', 'Origin');
+        res.setHeader('Access-Control-Allow-Methods', 'GET, POST, DELETE, OPTIONS');
+        res.setHeader('Access-Control-Allow-Headers', [
+            'Content-Type',
+            'Authorization',
+            'MCP-Protocol-Version',
+            'Mcp-Method',
+            'Mcp-Name',
+            'Mcp-Param-*',
+            'Last-Event-ID',
+        ].join(', '));
+        res.setHeader('Access-Control-Expose-Headers', ['MCP-Protocol-Version', 'Mcp-Method', 'Mcp-Name'].join(', '));
+    }
+    async serveStdio() {
+        const stdio = (await import('@modelcontextprotocol/server/stdio'));
+        this.stdioHandle = stdio.serveStdio(() => this.buildServer());
+        this.registry.logger.info(`Modern MCP (${MODERN_PROTOCOL_VERSION}) serving over stdio`);
+    }
+    // ==========================================================================
+    // Notifications (subscriptions/listen bus)
+    // ==========================================================================
+    notifyToolsListChanged() {
+        this.handler?.notify?.toolsChanged?.();
+    }
+    notifyResourcesListChanged() {
+        this.handler?.notify?.resourcesChanged?.();
+    }
+    notifyPromptsListChanged() {
+        this.handler?.notify?.promptsChanged?.();
+    }
+    notifyResourceUpdated(uri) {
+        this.handler?.notify?.resourceUpdated?.(uri);
+    }
+    notifyTaskStatus(taskData) {
+        try {
+            this.handler?.notify?.custom?.('notifications/tasks/status', taskData);
+            this.handler?.bus?.emit?.('task_status', taskData);
+        }
+        catch {
+            /* ignore delivery error if no subscriber is active */
+        }
+    }
+    async close() {
+        try {
+            await this.handler?.close?.();
+        }
+        catch {
+            /* ignore */
+        }
+        try {
+            await this.stdioHandle?.close?.();
+        }
+        catch {
+            /* ignore */
+        }
+        this.handler = undefined;
+        this.stdioHandle = undefined;
+    }
+    /** The extensions map this adapter would advertise (for diagnostics/notes). */
+    advertisedExtensions() {
+        const tools = this.registry.getTools();
+        const hasTasks = Array.from(tools.values()).some((t) => t.taskSupport && t.taskSupport !== 'forbidden');
+        const hasApps = Array.from(tools.values()).some((t) => t.hasComponent());
+        return buildExtensionsMap({ hasTasks, hasApps, declared: this.registry.config.extensions });
+    }
+}
+//# sourceMappingURL=modern-v2.adapter.js.map