@try-works/dsh-tool-mode 0.0.0-stage → 0.5.44

package/lib/mcp/sdk-v2.js

@@ -0,0 +1,204 @@
+/**
+ * Official SDK v2 serving adapter, not a second business dispatcher.
+ *
+ * Upstream main inspected at 9bc40e903fde15534ec06ff4c1347d47000dbe16:
+ * https://github.com/modelcontextprotocol/typescript-sdk/blob/9bc40e903fde15534ec06ff4c1347d47000dbe16/docs/serving/http.md
+ * That revision's packages/server/package.json is 2.3.1; runtime uses the exact
+ * npm release @modelcontextprotocol/server@2.3.1 (not a floating git dependency).
+ * Registry provenance: https://registry.npmjs.org/@modelcontextprotocol/server/2.3.1
+ * tarball SHA-1 a15440d5c06f3bad67360952fe58e6965b4a4ac7; integrity
+ * sha512-e59MfWuSssj6DoQ96JCTqdW1AXT5/XtnTl0WWd6MU1Ka434fFUGGosCLJbGNySDhHGvxQWoRWK137FXYFkYNWw==
+ * Protocol revision: 2026-07-28. Legacy handshakes/sessions are deliberately refused.
+ */
+import { createMcpHandler, fromJsonSchema, McpServer } from '@modelcontextprotocol/server';
+import { toolErrorResult } from "./protocol.js";
+/**
+ * Construct official serving around a caller already verified by the transport.
+ * No credentials or grants are accepted from JSON-RPC params. Each factory call
+ * reads the LIVE surface and creates a fresh server; business execution and its
+ * accounting remain exclusively in host.callTool / createMcpHost.
+ */
+export function createSdkV2Handler(host, caller, incoming) {
+    return createMcpHandler(({ authInfo }) => {
+        if (authInfo?.clientId !== caller.clientId) {
+            throw new Error('SDK serving requires the transport-verified caller');
+        }
+        const server = new McpServer(host.serverInfo, {
+            supportedProtocolVersions: ['2026-07-28'],
+            // Keep tools/list available for an empty caller-specific catalog; SDK
+            // handlers otherwise appear only after the first registerTool call.
+            capabilities: { tools: { listChanged: false } },
+        });
+        for (const tool of [...host.listTools()].sort((a, b) => a.name.localeCompare(b.name))) {
+            if (!caller.allowedTools.includes(tool.name) || tool.importedFromMcp)
+                continue;
+            server.registerTool(tool.name, {
+                ...tool.title === undefined ? {} : { title: tool.title },
+                description: tool.description,
+                inputSchema: fromJsonSchema(tool.inputSchema),
+                // A definition with no declared result shape must register no
+                // outputSchema: the SDK's output validator converts ANY registered
+                // outputSchema plus an undefined structuredContent into a tool error
+                // ("has an output schema but no structured content was provided"),
+                // while the protocol dispatch serves the same host outcome as a
+                // content-only success (server.ts). An empty schema is the
+                // schema-less sentinel.
+                ...tool.outputSchema === undefined || Object.keys(tool.outputSchema).length === 0
+                    ? {}
+                    : { outputSchema: fromJsonSchema(tool.outputSchema) },
+            }, async (args, ctx) => {
+                const outcome = await host.callTool(tool.name, args, ctx.mcpReq.signal, caller);
+                if (outcome.isError === true) {
+                    // An application failure is a tool-error RESULT (P26-04), clamped
+                    // exactly like the protocol dispatch clamps it: toolErrorResult
+                    // bounds the message to 2000 chars + '…' (protocol.ts:358-365).
+                    // The installed SDK's CallToolResult.content is mutable, so the
+                    // readonly payload content is copied, as the denied-call path does.
+                    const failure = toolErrorResult(outcome.text);
+                    return { isError: failure.isError, content: [...failure.content] };
+                }
+                // The pinned 2026-07-28 schema types structuredContent as `unknown` —
+                // ANY JSON value (object, array, string, number, boolean, null:
+                // docs/tool-mode/specs/mcp-2026-07-28/schema.ts CallToolResult). The
+                // installed SDK's CallToolResultSchema is z.ZodUnknown and its 2026-era
+                // projection is identity, so no runtime guard or cast is needed;
+                // undefined means "no structured value" and is omitted.
+                return {
+                    content: [{ type: 'text', text: outcome.text }],
+                    ...outcome.structured === undefined ? {} : { structuredContent: outcome.structured },
+                };
+            });
+        }
+        // Withheld known tools must remain invisible to tools/list, but SEC-03
+        // requires policy denials in the tool-error lane. Override only this fresh
+        // request's denied-call handler; accepted calls retain McpServer's genuine
+        // registration/input/output pipeline. The shared host boundary owns the
+        // refusal and its accounting; no unauthorized tool is ever registered.
+        if (incoming !== undefined) {
+            const deniedName = incoming.params?.name;
+            /**
+             * A name the host KNOWS but withheld is not an unknown method. The SDK only
+             * registers published tools, so it would answer its own "Tool … not found"
+             * before the host can explain the publication decision. This request-scoped
+             * override returns the recorded reason in the tool-error lane; the tool is
+             * still never registered, so it remains invisible to tools/list.
+             */
+            if (incoming.method === 'tools/call' && typeof deniedName === 'string') {
+                const withheldReason = host.withheldReason?.(deniedName);
+                if (withheldReason !== undefined) {
+                    server.server.setRequestHandler('tools/call', async (request, ctx) => {
+                        if (request.params.name !== deniedName)
+                            throw new Error('request-specific withheld name changed');
+                        const outcome = await host.callTool(deniedName, request.params.arguments ?? {}, ctx.mcpReq.signal, caller);
+                        // callTool answers a known withheld name with isError:true. If a host
+                        // ever accepted it, the publication decision is inconsistent; do not
+                        // turn that into a success here.
+                        if (outcome.isError !== true)
+                            throw new Error('host accepted a withheld tool');
+                        return { isError: true, content: [...toolErrorResult(outcome.text).content] };
+                    });
+                }
+            }
+            if (incoming.method === 'tools/call' && typeof deniedName === 'string'
+                && !caller.allowedTools.includes(deniedName)
+                && host.listTools().some(tool => tool.name === deniedName && !tool.importedFromMcp)) {
+                server.server.setRequestHandler('tools/call', async (request, ctx) => {
+                    if (request.params.name !== deniedName)
+                        throw new Error('request-specific denial name changed');
+                    const outcome = await host.callTool(deniedName, request.params.arguments ?? {}, ctx.mcpReq.signal, caller);
+                    if (outcome.isError !== true)
+                        throw new Error('host accepted a tool outside the authenticated grant');
+                    return { isError: true, content: [...toolErrorResult(outcome.text).content] };
+                });
+            }
+        }
+        return server;
+    }, {
+        legacy: 'reject',
+        // NEVER 'json': that mode silently drops mid-call notifications. Auto keeps
+        // every message, upgrading the response to SSE if one is emitted.
+        responseMode: 'auto',
+    });
+}
+/**
+ * Live Fetch face. The per-request SDK handler belongs to the response body:
+ * close it on drain, cancellation, abort or error, never when fetch returns SSE.
+ * Linking a controller also makes a Web reader's cancel abort business execution.
+ */
+export async function serveSdkV2Request(host, caller, request, token) {
+    const incoming = await request.clone().json();
+    const handler = createSdkV2Handler(host, caller, incoming);
+    const abort = new AbortController();
+    let reader;
+    let stopped = false;
+    let closing;
+    const close = () => {
+        if (closing === undefined) {
+            stopped = true;
+            request.signal.removeEventListener('abort', onAbort);
+            closing = handler.close();
+        }
+        return closing;
+    };
+    const cancel = async (reason) => {
+        abort.abort(reason);
+        try {
+            await reader?.cancel(reason);
+        }
+        finally {
+            await close();
+        }
+    };
+    const onAbort = () => { void cancel(request.signal.reason).catch(() => { }); };
+    request.signal.addEventListener('abort', onAbort, { once: true });
+    if (request.signal.aborted)
+        onAbort();
+    try {
+        const response = await handler.fetch(new Request(request, { signal: abort.signal }), {
+            authInfo: { token, clientId: caller.clientId, scopes: [] },
+        });
+        if (response.body === null) {
+            await close();
+            return response;
+        }
+        reader = response.body.getReader();
+        if (abort.signal.aborted) {
+            await cancel(abort.signal.reason);
+            throw abort.signal.reason ?? new Error('request aborted');
+        }
+        const body = new ReadableStream({
+            async pull(controller) {
+                try {
+                    const next = await reader.read();
+                    if (stopped) {
+                        controller.close();
+                        return;
+                    }
+                    if (next.done) {
+                        await close();
+                        reader.releaseLock();
+                        controller.close();
+                    }
+                    else {
+                        controller.enqueue(next.value);
+                    }
+                }
+                catch (error) {
+                    await close();
+                    controller.error(error);
+                }
+            },
+            async cancel(reason) { await cancel(reason); },
+        }, { highWaterMark: 0 });
+        return new Response(body, {
+            status: response.status,
+            statusText: response.statusText,
+            headers: response.headers,
+        });
+    }
+    catch (error) {
+        await close();
+        throw error;
+    }
+}
+//# sourceMappingURL=sdk-v2.js.map

package/lib/mcp/server.d.ts

@@ -0,0 +1,149 @@
+/**
+ * MCP method dispatch (MCP-05, MCP-06, MCP-08, MCP-09, MCP-13).
+ *
+ * The server is STATELESS by construction, which is what P26-01 requires: a
+ * `tools/list` or `tools/call` must be processable as the first application
+ * request. There is no session table here to require one, so the requirement is
+ * satisfied by the shape of the code rather than by remembering to skip a check.
+ *
+ * Dispatch resolves ONE authorized definition and calls it through the host's
+ * execution path (MCP-08), rather than reaching into a registry by name — the
+ * difference matters because the host's path applies the grant, the receipt and
+ * the result policy, while a direct lookup would bypass all three.
+ *
+ * @module @try-works/dsh-tool-mode/mcp/server
+ */
+import { type CatalogCachePolicy, type HeaderInput, type WireRequest } from './protocol.ts';
+import type { SubscriptionRegistry } from './subscriptions.ts';
+import type { ExternalCaller } from './client-grant.ts';
+/** One tool as the MCP surface describes it. */
+export interface McpToolDefinition {
+    /** The caller-facing name. */
+    readonly name: string;
+    /** A short human-readable title, when the contract declares one. */
+    readonly title?: string;
+    /** What the tool does, written for a model. */
+    readonly description: string;
+    /** The canonical input schema, JSON Schema 2020-12. */
+    readonly inputSchema: Readonly<Record<string, unknown>>;
+    /** The canonical OUTPUT schema (MCP-09). */
+    readonly outputSchema: Readonly<Record<string, unknown>>;
+    /** Whether this tool was imported from another MCP server. */
+    readonly importedFromMcp: boolean;
+}
+/** The outcome of invoking one tool. */
+export interface ToolInvocationOutcome {
+    /** The finalized, post-policy canonical value. */
+    readonly structured: unknown;
+    /** A bounded, model-readable rendering. */
+    readonly text: string;
+    /** Whether the tool itself failed. */
+    readonly isError?: boolean;
+}
+/** What dispatch needs from the host. */
+export interface McpHost {
+    /** This server's identity, reported in result metadata. */
+    readonly serverInfo: {
+        readonly name: string;
+        readonly version: string;
+    };
+    /**
+     * The catalog caching policy carried on `tools/list` and `server/discover` (P26-14).
+     *
+     * Absent means the unchanged default `{ cacheScope: 'private', ttlMs: 0 }`. The
+     * scope is validated by the host factory; dispatch restates the normalized values on
+     * BOTH cacheable result types.
+     */
+    readonly cachePolicy?: CatalogCachePolicy;
+    /**
+     * The tools this caller may see, in deterministic order (MCP-06).
+     * @returns the authorized definitions.
+     */
+    listTools(): readonly McpToolDefinition[];
+    /**
+     * Why a tool the host KNOWS is absent from this caller's catalog.
+     *
+     * Absent/undefined means genuinely unknown. The dispatcher consults this before
+     * reporting invalid params, so a withholding decision reaches the caller as a
+     * tool error with its recorded reason rather than as a protocol "not found".
+     * @param name - the tool name the caller asked for.
+     * @returns the recorded reason, or undefined when the host has no such tool.
+     */
+    withheldReason?(name: string): string | undefined;
+    /**
+     * Invoke one authorized tool through the host execution path (MCP-08).
+     * @param name - the tool name.
+     * @param args - the tool arguments.
+     * @param signal - the caller's abort signal.
+     * @param caller - the AUTHENTICATED external caller and its derived grant (SEC-04),
+     *   resolved by the transport; absent for non-HTTP transports that carry no client.
+     * @returns the outcome.
+     */
+    callTool(name: string, args: Readonly<Record<string, unknown>>, signal: AbortSignal, caller?: ExternalCaller): Promise<ToolInvocationOutcome>;
+    /**
+     * Explicit catalog facts (P26-14): profile/model availability and extension
+     * generation. Read per discovery request and attached under a namespaced
+     * `_meta` key so it is never a hidden per-connection mutation.
+     */
+    catalogFacts?(): Record<string, unknown>;
+}
+/** One dispatched response. */
+export interface DispatchResult {
+    /** The response envelope to send, or undefined for a notification. */
+    readonly response?: Record<string, unknown>;
+    /** The HTTP status the transport should use. */
+    readonly httpStatus: number;
+    /**
+     * Notifications the transport must deliver after the response (P26-09).
+     *
+     * Carried on the result rather than written into the body, because a notification
+     * is a separate message: embedding one inside a result would produce a frame that
+     * is not a valid result and not a valid notification.
+     */
+    readonly followUp?: readonly Record<string, unknown>[];
+}
+/**
+ * Project a definition into the MCP tool shape.
+ *
+ * `outputSchema` is taken from the resolved definition rather than from DSH's
+ * model-facing `schemas()` projection, which intentionally omits `output`: a
+ * schema-only export built from that projection would be missing the very field
+ * MCP-09 requires.
+ * @param definition - the resolved definition.
+ * @returns the MCP tool descriptor.
+ */
+export declare function toMcpTool(definition: McpToolDefinition): Record<string, unknown>;
+/**
+ * Dispatch one request.
+ *
+ * Stateless: nothing is retained between calls, so a valid request works as the
+ * first one.
+ * @param request - the parsed request.
+ * @param host - the host surface.
+ * @param options - headers and the caller's abort signal.
+ * @returns the response and the HTTP status.
+ */
+export declare function dispatch(request: WireRequest, host: McpHost, options?: {
+    readonly headers?: HeaderInput;
+    readonly signal?: AbortSignal;
+    /** Whether the transport checks headers at all; stdio has none to check. */
+    readonly checkHeaders?: boolean;
+    /**
+     * The catalog subscription registry (P26-09).
+     *
+     * Optional so a host that offers no subscriptions does not have to construct one;
+     * subscriptions/listen then reports the method as unsupported rather than
+     * accepting a subscription it cannot serve.
+     */
+    readonly subscriptions?: SubscriptionRegistry;
+    /** The authenticated client, which a subscription is bound to. */
+    readonly clientId?: string;
+    /**
+     * The authenticated external caller and its derived grant (SEC-04).
+     *
+     * Resolved by the TRANSPORT after authentication, never read from the request body:
+     * a caller cannot supply or forge its own identity or grant (BASE-05).
+     */
+    readonly caller?: ExternalCaller;
+}): Promise<DispatchResult>;
+//# sourceMappingURL=server.d.ts.map

package/lib/mcp/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAaL,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,WAAW,EACjB,MAAM,eAAe,CAAA;AACtB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAEvD,gDAAgD;AAChD,MAAM,WAAW,iBAAiB;IAChC,8BAA8B;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,oEAAoE;IACpE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,+CAA+C;IAC/C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,uDAAuD;IACvD,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IACvD,4CAA4C;IAC5C,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IACxD,8DAA8D;IAC9D,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAA;CAClC;AAED,wCAAwC;AACxC,MAAM,WAAW,qBAAqB;IACpC,kDAAkD;IAClD,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;IAC5B,2CAA2C;IAC3C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,sCAAsC;IACtC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAC3B;AAED,yCAAyC;AACzC,MAAM,WAAW,OAAO;IACtB,2DAA2D;IAC3D,QAAQ,CAAC,UAAU,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IACxE;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,kBAAkB,CAAA;IACzC;;;OAGG;IACH,SAAS,IAAI,SAAS,iBAAiB,EAAE,CAAA;IACzC;;;;;;;;OAQG;IACH,cAAc,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;IACjD;;;;;;;;OAQG;IACH,QAAQ,CACN,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACvC,MAAM,EAAE,WAAW,EACnB,MAAM,CAAC,EAAE,cAAc,GACtB,OAAO,CAAC,qBAAqB,CAAC,CAAA;IACjC;;;;OAIG;IACH,YAAY,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACzC;AAED,+BAA+B;AAC/B,MAAM,WAAW,cAAc;IAC7B,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC3C,gDAAgD;IAChD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAA;CACvD;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,UAAU,EAAE,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAQhF;AAoBD;;;;;;;;;GASG;AACH,wBAAsB,QAAQ,CAC5B,OAAO,EAAE,WAAW,EACpB,IAAI,EAAE,OAAO,EACb,OAAO,GAAE;IACP,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAA;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;IAC7B,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAA;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,oBAAoB,CAAA;IAC7C,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAA;CAC5B,GACL,OAAO,CAAC,cAAc,CAAC,CAgJzB"}

package/lib/mcp/server.js

@@ -0,0 +1,302 @@
+/**
+ * MCP method dispatch (MCP-05, MCP-06, MCP-08, MCP-09, MCP-13).
+ *
+ * The server is STATELESS by construction, which is what P26-01 requires: a
+ * `tools/list` or `tools/call` must be processable as the first application
+ * request. There is no session table here to require one, so the requirement is
+ * satisfied by the shape of the code rather than by remembering to skip a check.
+ *
+ * Dispatch resolves ONE authorized definition and calls it through the host's
+ * execution path (MCP-08), rather than reaching into a registry by name — the
+ * difference matters because the host's path applies the grant, the receipt and
+ * the result policy, while a direct lookup would bypass all three.
+ *
+ * @module @try-works/dsh-tool-mode/mcp/server
+ */
+import { assertHeadersMatch, cacheableResultFields, implementedCapabilities, SUPPORTED_PROTOCOL_VERSIONS, ERROR_CODES, errorResponse, negotiateVersion, parseRequestMetadata, successResult, toolErrorResult, unsupportedRequiredCapabilities, WireError, } from "./protocol.js";
+/**
+ * Project a definition into the MCP tool shape.
+ *
+ * `outputSchema` is taken from the resolved definition rather than from DSH's
+ * model-facing `schemas()` projection, which intentionally omits `output`: a
+ * schema-only export built from that projection would be missing the very field
+ * MCP-09 requires.
+ * @param definition - the resolved definition.
+ * @returns the MCP tool descriptor.
+ */
+export function toMcpTool(definition) {
+    return {
+        name: definition.name,
+        ...definition.title === undefined ? {} : { title: definition.title },
+        description: definition.description,
+        inputSchema: definition.inputSchema,
+        outputSchema: definition.outputSchema,
+    };
+}
+/**
+ * Attach the host's explicit catalog facts to a discovery result (P26-14).
+ * @param result - the method-specific result.
+ * @param host - the host that may expose facts.
+ * @returns the result with a namespaced `_meta` entry, or unchanged.
+ */
+function withCatalogFacts(result, host) {
+    const facts = host.catalogFacts?.();
+    if (facts === undefined)
+        return result;
+    const existing = typeof result._meta === 'object' && result._meta !== null
+        ? result._meta
+        : {};
+    return { ...result, _meta: { ...existing, 'io.try-works/catalog': facts } };
+}
+/**
+ * Dispatch one request.
+ *
+ * Stateless: nothing is retained between calls, so a valid request works as the
+ * first one.
+ * @param request - the parsed request.
+ * @param host - the host surface.
+ * @param options - headers and the caller's abort signal.
+ * @returns the response and the HTTP status.
+ */
+export async function dispatch(request, host, options = {}) {
+    const id = request.id ?? null;
+    try {
+        if (options.checkHeaders === true && options.headers !== undefined) {
+            assertHeadersMatch(options.headers, request);
+        }
+        const metadata = parseRequestMetadata(request.params);
+        negotiateVersion(metadata);
+        // Capabilities the CLIENT requires. A requirement this server cannot meet is
+        // -32021 rather than a silent partial service.
+        const wiring = { subscriptions: options.subscriptions !== undefined };
+        const required = requiredCapabilities(metadata.clientCapabilities);
+        const unsupported = unsupportedRequiredCapabilities(required, wiring);
+        if (unsupported.length > 0) {
+            throw new WireError(ERROR_CODES.unsupportedClientCapability, `the client requires unsupported capability: ${unsupported.join(', ')}`, 
+            /**
+             * THE PINNED SCHEMA'S OWN FIELD NAME, and this was WRONG.
+             *
+             * `MissingRequiredClientCapabilityError` REQUIRES `data.requiredCapabilities`. This
+             * sent `{ unsupported: [...] }`, which Ajv rejects against the pinned definition:
+             *
+             *   INVALID -> /error/data must have required property 'requiredCapabilities'
+             *
+             * It went unnoticed because the GENERIC `JSONRPCErrorResponse` accepts ANY `data`,
+             * every fixture took that path, and no fixture covered `-32021` at all — so the
+             * conformance suite validated a shape the specific error definition forbids.
+             * P26-03 requires `-32021` "and the schema-defined data"; this is that shape.
+             */
+            /**
+             * A `ClientCapabilities` OBJECT, not an array of names — and this was STILL wrong.
+             *
+             * The previous correction fixed the FIELD NAME (`unsupported` -> `requiredCapabilities`)
+             * and left the VALUE as an array of strings. The pinned definition is precise:
+             *
+             *     requiredCapabilities -> $ref ClientCapabilities  (type: object)
+             *
+             * so the shape is `{ sampling: {} }`, a capabilities object keyed by capability name.
+             * Both defects are the same kind — a plausible shape that no fixture covered — and this
+             * one survived the first fix because only a LIVE response validated against the pinned
+             * definition could distinguish an array from an object. The fixture probe never saw it,
+             * and no test asserted the value's TYPE.
+             */
+            { requiredCapabilities: Object.fromEntries(unsupported.map(name => [name, {}])) });
+        }
+        switch (request.method) {
+            case 'server/discover':
+                return {
+                    response: {
+                        jsonrpc: '2.0',
+                        id,
+                        result: successResult(withCatalogFacts(discoverResult(wiring, host.cachePolicy), host), host.serverInfo),
+                    },
+                    httpStatus: 200,
+                };
+            case 'tools/list':
+                return {
+                    response: {
+                        jsonrpc: '2.0',
+                        id,
+                        result: successResult(withCatalogFacts({
+                            // Deterministic ordering (MCP-06): the caller sees a stable list, so
+                            // a client diffing two listings does not see spurious changes.
+                            //
+                            // SEC-04: an AUTHENTICATED external caller sees only its GRANTED
+                            // tools — the list is the client's authorized set, not the operator's
+                            // whole surface. The grant stays the AUTHORITY: calling a
+                            // non-granted tool still yields the grant refusal, this only
+                            // narrows what a client is shown. The caller-less path (stdio /
+                            // native) sees the full surface.
+                            tools: [...host.listTools()]
+                                .filter(tool => options.caller === undefined || options.caller.allowedTools.includes(tool.name))
+                                .sort((left, right) => left.name.localeCompare(right.name))
+                                .map(toMcpTool),
+                            // Required by the schema's CacheableResult; omitting them makes the
+                            // result non-conformant even though the tool list is correct. The
+                            // policy comes from the host (private scope, operator TTL), P26-14.
+                            ...cacheableResultFields(host.cachePolicy),
+                        }, host), host.serverInfo),
+                    },
+                    httpStatus: 200,
+                };
+            case 'subscriptions/listen': {
+                // P26-09. The acknowledgement is returned WITH the result rather than after
+                // it, so the client cannot observe an event before being told what the server
+                // agreed to send.
+                //
+                // A host with no registry reports the method as unsupported rather than
+                // accepting a subscription it cannot serve: an acknowledged subscription that
+                // never fires is indistinguishable from a broken server.
+                if (options.subscriptions === undefined) {
+                    throw new WireError(ERROR_CODES.methodNotFound, 'this server does not offer catalog subscriptions');
+                }
+                const subscription = options.subscriptions.listen(request, options.clientId ?? 'unknown');
+                return {
+                    response: { jsonrpc: '2.0', id, result: successResult(subscription.result, host.serverInfo) },
+                    httpStatus: 200,
+                    followUp: [subscription.acknowledgement],
+                };
+            }
+            case 'tools/call':
+                return await callTool(request, id, host, options.signal ?? new AbortController().signal, options.caller);
+            default:
+                throw new WireError(ERROR_CODES.methodNotFound, `unknown method ${JSON.stringify(request.method)}`);
+        }
+    }
+    catch (error) {
+        const wire = error instanceof WireError
+            ? error
+            : new WireError(ERROR_CODES.internalError, error instanceof Error ? error.message : String(error));
+        // An infrastructure failure must never be turned into a successful domain
+        // payload (MCP-10), so it leaves as a JSON-RPC error.
+        return {
+            response: errorResponse(id, wire),
+            /**
+             * THE PINNED SCHEMA'S OWN `MUST`, read from the schema rather than inferred.
+             *
+             * Three error definitions state it in as many words — "For HTTP, the response status
+             * code MUST be `400 Bad Request`":
+             *
+             *   HeaderMismatchError                  -> -32020
+             *   MissingRequiredClientCapabilityError -> -32021
+             *   UnsupportedProtocolVersionError      -> -32022
+             *
+             * Only the FIRST and `invalidParams` were mapped to 400, so a client requiring an
+             * unsupported capability — or presenting an unsupported protocol version — received an
+             * error body under a 200 status. The suite stayed green either way, so the status was
+             * untested in BOTH directions.
+             *
+             * Kept as a named SET so the next transport-level rejection is a one-line addition
+             * rather than another condition somebody can forget.
+             */
+            httpStatus: TRANSPORT_LEVEL_REJECTIONS.has(wire.code) ? 400 : 200,
+        };
+    }
+}
+/**
+ * The JSON-RPC codes the pinned schema requires be answered with HTTP 400 as well.
+ *
+ * Every one of these definitions says, verbatim: "For HTTP, the response status code MUST
+ * be `400 Bad Request`." Kept as a named set so the rule lives in ONE place and the next
+ * transport-level rejection is an addition rather than another forgotten condition.
+ */
+const TRANSPORT_LEVEL_REJECTIONS = new Set([
+    ERROR_CODES.headerMismatch, // -32020
+    ERROR_CODES.unsupportedClientCapability, // -32021
+    ERROR_CODES.unsupportedProtocolVersion, // -32022
+    ERROR_CODES.invalidParams, // -32602, a malformed request shape
+]);
+/** Handle `tools/call`. */
+async function callTool(request, id, host, signal, caller) {
+    const name = request.params?.name;
+    if (typeof name !== 'string' || name.length === 0) {
+        throw new WireError(ERROR_CODES.invalidParams, 'tools/call requires params.name');
+    }
+    const args = request.params?.arguments;
+    if (args !== undefined && (typeof args !== 'object' || args === null || Array.isArray(args))) {
+        throw new WireError(ERROR_CODES.invalidParams, 'tools/call arguments must be an object');
+    }
+    const definition = host.listTools().find(tool => tool.name === name);
+    if (definition === undefined) {
+        const withheldReason = host.withheldReason?.(name);
+        if (withheldReason !== undefined) {
+            // Known but withheld: this is an application outcome with a named reason,
+            // not an unknown method. The tool was never invoked, so no domain success
+            // is fabricated; the envelope is still a successful protocol exchange.
+            return {
+                response: {
+                    jsonrpc: '2.0',
+                    id,
+                    result: successResult(toolErrorResult(`tool ${JSON.stringify(name)} is withheld: ${withheldReason}`), host.serverInfo),
+                },
+                httpStatus: 200,
+            };
+        }
+        // An unknown name is invalid params, not a tool error: nothing was invoked, so
+        // reporting a domain failure would be a fabrication.
+        throw new WireError(ERROR_CODES.invalidParams, `unknown tool ${JSON.stringify(name)}`);
+    }
+    // MCP-13: never re-export an imported MCP tool, or a server could delegate back
+    // into itself through a loop that no caller can see.
+    if (definition.importedFromMcp) {
+        throw new WireError(ERROR_CODES.invalidParams, `tool ${JSON.stringify(name)} was imported from MCP and is not re-exported`);
+    }
+    const outcome = await host.callTool(name, (args ?? {}), signal, caller);
+    const result = outcome.isError === true
+        // An application failure is a tool-error RESULT (P26-04), so the protocol
+        // exchange still succeeded.
+        ? toolErrorResult(outcome.text)
+        : {
+            content: [{ type: 'text', text: outcome.text }],
+            // The finalized, post-policy canonical value (MCP-10).
+            structuredContent: outcome.structured,
+        };
+    return {
+        response: { jsonrpc: '2.0', id, result: successResult(result, host.serverInfo) },
+        httpStatus: 200,
+    };
+}
+/** The `server/discover` result, in the shape the pinned schema requires. */
+function discoverResult(wiring = {}, cachePolicy) {
+    return {
+        // `supportedVersions` is the field the schema defines; there is no
+        // `protocolVersion` on a DiscoverResult, which is the mistake pinning the schema
+        // caught. A client learns the versions the server speaks, not one it picked.
+        supportedVersions: [...SUPPORTED_PROTOCOL_VERSIONS],
+        capabilities: serverCapabilities(wiring),
+        // P26-14: discovery is cacheable too, and it is authorization-filtered by scope.
+        ...cacheableResultFields(cachePolicy),
+    };
+}
+/**
+ * The capabilities this server advertises.
+ *
+ * Derived from the feature matrix rather than restated, so the matrix a client
+ * reads and the capabilities it is offered cannot disagree. P26-12: a feature is
+ * advertised only when it is genuinely implemented.
+ * @returns the `ServerCapabilities` object.
+ */
+function serverCapabilities(wiring = {}) {
+    const implemented = new Set(implementedCapabilities(wiring));
+    return {
+        ...implemented.has('tools') ? { tools: { listChanged: implemented.has('subscriptions/listen') } } : {},
+        ...implemented.has('prompts') ? { prompts: {} } : {},
+        ...implemented.has('resources/subscribe') ? { resources: {} } : {},
+        ...implemented.has('logging') ? { logging: {} } : {},
+    };
+}
+/**
+ * Read the capabilities a client declared as REQUIRED.
+ *
+ * A client may declare capabilities it merely supports; only the required ones can
+ * make a request unserviceable.
+ * @param capabilities - the parsed capability object.
+ * @returns the required capability names.
+ */
+function requiredCapabilities(capabilities) {
+    const required = capabilities.required;
+    if (!Array.isArray(required))
+        return [];
+    return required.filter((name) => typeof name === 'string');
+}
+//# sourceMappingURL=server.js.map