@orkestrel/mcp 0.0.36 → 0.0.38

package/dist/src/server/index.d.cts

@@ -170,8 +170,8 @@ export declare function createMCPContinuation(secret: TokenSecret): MCPContinuat
  * comparison; a missing, mismatched, or invalidly encoded value returns HTTP `400` + `-32020`.
  * A protocol header naming a modern revision holds the request to that revision whatever shape
  * its body arrived in, so a body with no parsable modern `_meta` returns HTTP `400` + `-32602`.
- * Headerless `initialize` is accepted, while every other headerless request needs a live legacy
- * session to supply its pinned version. A legacy-shaped request carrying a protocol header is
+ * Headerless `initialize` and id-bearing legacy `ping` are accepted; other headerless requests
+ * need a live legacy session to supply its pinned version. A legacy-shaped request carrying a protocol header is
  * otherwise admitted only for a legacy revision; a revision this server does not implement
  * returns HTTP `400` + `-32022` whose `supported` names the legacy revisions this door accepts.
  * A present origin must occur in `origin.origins` unless validation is
@@ -282,7 +282,9 @@ export declare function createMCPRoutes<TState = unknown>(mcp: MCPDispatcherInte
  *   readSessionHeader}: a valid id touches the entry and sets `context.state.session`; an
  *   absent / unknown id whose (guarded) body parses to an `initialize` request ({@link
  *   isInitializeRequest}) mints a fresh {@link MCPSession} (`crypto.randomUUID()`, the `session`
- *   options group) and sets `context.state.session`; neither → {@link rejectUnknownSession}
+ *   options group) and sets `context.state.session`. An id-bearing legacy `ping` with no
+ *   session header passes through without session state, a supplied protocol header, or a
+ *   response stamp. Other unresolved requests → {@link rejectUnknownSession}
  *   (`404`). The
  *   minted entry pins the negotiated legacy revision, which is supplied to a later headerless
  *   live-session request. It then
@@ -713,8 +715,8 @@ export declare interface HTTPTransportOptions<TState = unknown> extends HTTPHand
  * {@link import('@orkestrel/mcp').decodeSentinel} before the comparison, so a peer that had
  * to encode its value still matches; a sentinel whose payload is invalid decodes to nothing
  * and therefore mismatches, which is how an invalid header value is refused. A legacy request
- * body requires a protocol header after initialization. Messages name the expected value but
- * never echo the client-supplied one.
+ * body requires a protocol header except for `initialize` and an id-bearing legacy `ping`.
+ * Messages name the expected value but never echo the client-supplied one.
  *
  * The expectation a live session supplies is a different rule over a different input, so it
  * is {@link inferSessionHeaderIssue} rather than a second arm of this one.

package/dist/src/server/index.d.ts

@@ -170,8 +170,8 @@ export declare function createMCPContinuation(secret: TokenSecret): MCPContinuat
  * comparison; a missing, mismatched, or invalidly encoded value returns HTTP `400` + `-32020`.
  * A protocol header naming a modern revision holds the request to that revision whatever shape
  * its body arrived in, so a body with no parsable modern `_meta` returns HTTP `400` + `-32602`.
- * Headerless `initialize` is accepted, while every other headerless request needs a live legacy
- * session to supply its pinned version. A legacy-shaped request carrying a protocol header is
+ * Headerless `initialize` and id-bearing legacy `ping` are accepted; other headerless requests
+ * need a live legacy session to supply its pinned version. A legacy-shaped request carrying a protocol header is
  * otherwise admitted only for a legacy revision; a revision this server does not implement
  * returns HTTP `400` + `-32022` whose `supported` names the legacy revisions this door accepts.
  * A present origin must occur in `origin.origins` unless validation is
@@ -282,7 +282,9 @@ export declare function createMCPRoutes<TState = unknown>(mcp: MCPDispatcherInte
  *   readSessionHeader}: a valid id touches the entry and sets `context.state.session`; an
  *   absent / unknown id whose (guarded) body parses to an `initialize` request ({@link
  *   isInitializeRequest}) mints a fresh {@link MCPSession} (`crypto.randomUUID()`, the `session`
- *   options group) and sets `context.state.session`; neither → {@link rejectUnknownSession}
+ *   options group) and sets `context.state.session`. An id-bearing legacy `ping` with no
+ *   session header passes through without session state, a supplied protocol header, or a
+ *   response stamp. Other unresolved requests → {@link rejectUnknownSession}
  *   (`404`). The
  *   minted entry pins the negotiated legacy revision, which is supplied to a later headerless
  *   live-session request. It then
@@ -713,8 +715,8 @@ export declare interface HTTPTransportOptions<TState = unknown> extends HTTPHand
  * {@link import('@orkestrel/mcp').decodeSentinel} before the comparison, so a peer that had
  * to encode its value still matches; a sentinel whose payload is invalid decodes to nothing
  * and therefore mismatches, which is how an invalid header value is refused. A legacy request
- * body requires a protocol header after initialization. Messages name the expected value but
- * never echo the client-supplied one.
+ * body requires a protocol header except for `initialize` and an id-bearing legacy `ping`.
+ * Messages name the expected value but never echo the client-supplied one.
  *
  * The expectation a live session supplies is a different rule over a different input, so it
  * is {@link inferSessionHeaderIssue} rather than a second arm of this one.

package/dist/src/server/index.js

@@ -1,5 +1,5 @@
 import { PROCESS_GRACE } from "@orkestrel/process";
-import { HTTPClientTransport, JSONRPC_INVALID_PARAMS, JSONRPC_INVALID_REQUEST, JSONRPC_METHOD_NOT_FOUND, JSONRPC_PARSE_ERROR, MCP_HANDSHAKE_VERSION, MCP_HEADER_MISMATCH, MCP_LOOKUP_PAGES, MCP_META_VERSION, MCP_METHOD_HEADER, MCP_MISSING_CAPABILITY, MCP_NAME_HEADER, MCP_PARAM_PREFIX, MCP_PROTOCOL_VERSION_HEADER, MCP_SESSION_HEADER, MCP_UNSUPPORTED_VERSION, MCP_WEBSOCKET_SUBPROTOCOL, SUPPORTED_LEGACY_PROTOCOL_VERSIONS, bindServer, buildHeaderParameters, buildJSONRPCError, decodeEvent, decodeSentinel, deliverMessage, extractToolSchema, inferRequestEra, isInitializeRequest, isJSONRPCInvocation, isMCPLegacyVersion, isMCPModernVersion, isModernRequest, parseJSONRPCMessage, parseRequestContext, renderHeaderValue } from "../core/index.js";
+import { HTTPClientTransport, JSONRPC_INVALID_PARAMS, JSONRPC_INVALID_REQUEST, JSONRPC_METHOD_NOT_FOUND, JSONRPC_PARSE_ERROR, MCP_HANDSHAKE_VERSION, MCP_HEADER_MISMATCH, MCP_LOOKUP_PAGES, MCP_META_VERSION, MCP_METHOD_HEADER, MCP_MISSING_CAPABILITY, MCP_NAME_HEADER, MCP_PARAM_PREFIX, MCP_PROTOCOL_VERSION_HEADER, MCP_SESSION_HEADER, MCP_UNSUPPORTED_VERSION, MCP_WEBSOCKET_SUBPROTOCOL, SUPPORTED_LEGACY_PROTOCOL_VERSIONS, bindServer, buildHeaderParameters, buildJSONRPCError, decodeEvent, decodeSentinel, deliverMessage, extractToolSchema, inferRequestEra, isInitializeRequest, isJSONRPCInvocation, isMCPLegacyVersion, isMCPModernVersion, isModernRequest, isPingRequest, parseJSONRPCMessage, parseRequestContext, renderHeaderValue } from "../core/index.js";
 import { isError, isObject, isRecord, isString, parseJSON, sanitizeBudget } from "@orkestrel/contract";
 import { createStream, signToken, verifyToken } from "@orkestrel/server";
 import { Emitter } from "@orkestrel/emitter";
@@ -371,8 +371,8 @@ function inferHeaderTarget(request) {
 * {@link import('@orkestrel/mcp').decodeSentinel} before the comparison, so a peer that had
 * to encode its value still matches; a sentinel whose payload is invalid decodes to nothing
 * and therefore mismatches, which is how an invalid header value is refused. A legacy request
-* body requires a protocol header after initialization. Messages name the expected value but
-* never echo the client-supplied one.
+* body requires a protocol header except for `initialize` and an id-bearing legacy `ping`.
+* Messages name the expected value but never echo the client-supplied one.
 *
 * The expectation a live session supplies is a different rule over a different input, so it
 * is {@link inferSessionHeaderIssue} rather than a second arm of this one.
@@ -390,7 +390,7 @@ function inferHeaderTarget(request) {
 function inferHeaderIssue(request, invocation) {
 	const protocol = request.headers.get(MCP_PROTOCOL_VERSION_HEADER);
 	if (!isModernRequest(invocation)) {
-		if (isInitializeRequest(invocation) || protocol !== null) return void 0;
+		if (isInitializeRequest(invocation) || isPingRequest(invocation) || protocol !== null) return void 0;
 		return {
 			header: "MCP-Protocol-Version",
 			reason: "missing",
@@ -718,8 +718,8 @@ var HTTPDisconnect = class {
 * comparison; a missing, mismatched, or invalidly encoded value returns HTTP `400` + `-32020`.
 * A protocol header naming a modern revision holds the request to that revision whatever shape
 * its body arrived in, so a body with no parsable modern `_meta` returns HTTP `400` + `-32602`.
-* Headerless `initialize` is accepted, while every other headerless request needs a live legacy
-* session to supply its pinned version. A legacy-shaped request carrying a protocol header is
+* Headerless `initialize` and id-bearing legacy `ping` are accepted; other headerless requests
+* need a live legacy session to supply its pinned version. A legacy-shaped request carrying a protocol header is
 * otherwise admitted only for a legacy revision; a revision this server does not implement
 * returns HTTP `400` + `-32022` whose `supported` names the legacy revisions this door accepts.
 * A present origin must occur in `origin.origins` unless validation is
@@ -1978,7 +1978,9 @@ function createStdioServer(mcp, options) {
 *   readSessionHeader}: a valid id touches the entry and sets `context.state.session`; an
 *   absent / unknown id whose (guarded) body parses to an `initialize` request ({@link
 *   isInitializeRequest}) mints a fresh {@link MCPSession} (`crypto.randomUUID()`, the `session`
-*   options group) and sets `context.state.session`; neither → {@link rejectUnknownSession}
+*   options group) and sets `context.state.session`. An id-bearing legacy `ping` with no
+*   session header passes through without session state, a supplied protocol header, or a
+*   response stamp. Other unresolved requests → {@link rejectUnknownSession}
 *   (`404`). The
 *   minted entry pins the negotiated legacy revision, which is supplied to a later headerless
 *   live-session request. It then
@@ -2107,7 +2109,13 @@ function createMCPSession(options) {
 					version: inferLegacyVersion(parsed)
 				};
 				entry = created;
-			} else return rejectUnknownSession();
+			} else if (id === void 0 && isPingRequest(parsed)) return next(new Request(context.url, {
+				method: "POST",
+				headers: request.headers,
+				body: text,
+				signal: request.signal
+			}));
+			else return rejectUnknownSession();
 		}
 		if (!Reflect.set(context.state, "session", entry.session)) throw new Error("MCP session state is not writable");
 		const headers = new Headers(request.headers);