@typeship-ax/mcp 0.10.0 → 0.20.0

package/dist/mcp-protocol.js

@@ -1,5 +1,6 @@
 /**
- * MCP 2026-07-28 for a tools-only server. Generated by typeship — https://typeship.dev
+ * MCP tools server with a 2025-11-25 handshake adapter and a 2026-07-28 core.
+ * Generated by typeship — https://typeship.dev
  *
  * The protocol layer shared by the MCP server in every generated package and
  * by typeship's hosted endpoint: JSON-RPC shape checks, the per-request _meta
@@ -17,10 +18,9 @@
 import { dateKindOf, relativeDate } from "./dates.js";
 import { docsReadTarget, resolveDocsContentUrl, searchConnectedGuides } from "./docs.js";
 export const MCP_PROTOCOL_VERSION = "2026-07-28";
-/** Revisions served. Legacy (initialize-handshake) revisions are not; an
- * initialize request gets an error naming this list, as the spec asks of
- * modern-only servers. */
-export const SUPPORTED_PROTOCOL_VERSIONS = [MCP_PROTOCOL_VERSION];
+export const LEGACY_PROTOCOL_VERSION = "2025-11-25";
+/** The modern model and the supported initialize-handshake wire revision. */
+export const SUPPORTED_PROTOCOL_VERSIONS = [MCP_PROTOCOL_VERSION, LEGACY_PROTOCOL_VERSION];
 export const META_VERSION = "io.modelcontextprotocol/protocolVersion";
 export const META_CLIENT_CAPS = "io.modelcontextprotocol/clientCapabilities";
 export const META_SERVER_INFO = "io.modelcontextprotocol/serverInfo";
@@ -98,7 +98,7 @@ export function checkRequestMeta(request) {
     if (typeof version !== "string") {
         return rpcError(request.id, -32602, "Invalid params: params._meta[\"" + META_VERSION + "\"] is required on every request (MCP " + MCP_PROTOCOL_VERSION + ").", 400);
     }
-    if (!SUPPORTED_PROTOCOL_VERSIONS.includes(version)) {
+    if (version !== MCP_PROTOCOL_VERSION) {
         return rpcError(request.id, -32022, "Unsupported protocol version", 400, { supported: SUPPORTED_PROTOCOL_VERSIONS, requested: version });
     }
     if (caps === null || typeof caps !== "object" || Array.isArray(caps)) {
@@ -127,6 +127,17 @@ export function checkRequestHeaders(headers, message) {
     const id = message.id;
     const version = headers.get("mcp-protocol-version");
     const bodyVersion = message.params?._meta?.[META_VERSION];
+    if (version !== null && !SUPPORTED_PROTOCOL_VERSIONS.includes(version))
+        return rpcError(id, -32022, "Unsupported protocol version", 400, { supported: SUPPORTED_PROTOCOL_VERSIONS, requested: version });
+    if (message.method === "initialize" || version === LEGACY_PROTOCOL_VERSION) {
+        if (bodyVersion !== undefined || headers.get("mcp-method") !== null || headers.get("mcp-name") !== null) {
+            return rpcError(id, -32020, "Header mismatch: initialize-handshake requests cannot carry modern protocol metadata or routing headers.", 400);
+        }
+        if (version !== null && version !== LEGACY_PROTOCOL_VERSION) {
+            return rpcError(id, -32022, "Unsupported initialize-handshake protocol version", 400, { supported: [LEGACY_PROTOCOL_VERSION], requested: version });
+        }
+        return null;
+    }
     if (version === null)
         return rpcError(id, -32020, "Header mismatch: MCP-Protocol-Version header is required", 400);
     if (typeof bodyVersion === "string" && version !== bodyVersion) {
@@ -157,7 +168,39 @@ export function takeCancelled(id) {
     return (typeof id === "string" || typeof id === "number") && cancelled.delete(id);
 }
 // ---- dispatch ------------------------------------------------------------------
-export async function handleRpc(server, incoming) {
+/** One stdio process owns its handshake state. HTTP instead carries the
+ * negotiated revision on each request and never needs a server session. */
+export function createStdioRpcHandler(server) {
+    let version;
+    let initialized = false;
+    let initializing = false;
+    return async (incoming) => {
+        const request = asJsonRpc(incoming);
+        if (isRpcOutcome(request))
+            return request;
+        if (request.method === "initialize") {
+            if (version || initializing)
+                return rpcError(request.id, -32600, "This connection has already selected its MCP protocol.", 400, { supported: SUPPORTED_PROTOCOL_VERSIONS });
+            initializing = true;
+            const result = await handleRpc(server, request);
+            initializing = false;
+            if (result.status === 200)
+                version = LEGACY_PROTOCOL_VERSION;
+            return result;
+        }
+        if (version === LEGACY_PROTOCOL_VERSION) {
+            if (request.method === "notifications/initialized" && request.id === undefined)
+                initialized = true;
+            if (!initialized && request.id !== undefined && request.method !== "ping")
+                return rpcError(request.id, -32600, "Send notifications/initialized before calling MCP methods.", 400);
+        }
+        else if (request.params?._meta?.[META_VERSION] === MCP_PROTOCOL_VERSION) {
+            version = MCP_PROTOCOL_VERSION;
+        }
+        return handleRpc(server, request, version);
+    };
+}
+export async function handleRpc(server, incoming, protocolVersion) {
     const parsed = asJsonRpc(incoming);
     if (isRpcOutcome(parsed))
         return parsed;
@@ -172,20 +215,46 @@ export async function handleRpc(server, incoming) {
         }
         return { message: null, status: 202 };
     }
-    // Legacy clients open with initialize; name what we do speak so their one
-    // visible error is actionable (spec: modern-only servers SHOULD do this).
+    // Only the wire envelope differs. Tool execution and authorization below
+    // remain shared with modern clients.
     if (request.method === "initialize") {
-        return rpcError(id, -32601, "This server speaks MCP " + SUPPORTED_PROTOCOL_VERSIONS.join(", ") + " only (stateless, no initialize handshake). Upgrade the client, or send requests with params._meta[\"" + META_VERSION + "\"].", 400, { supported: SUPPORTED_PROTOCOL_VERSIONS });
+        const params = request.params;
+        if (params?._meta?.[META_VERSION] !== undefined)
+            return rpcError(id, -32602, "initialize cannot carry modern protocol metadata.", 400);
+        const info = params?.clientInfo;
+        if (!params || typeof params.protocolVersion !== "string" || !params.capabilities || typeof params.capabilities !== "object" || Array.isArray(params.capabilities) ||
+            !info || typeof info !== "object" || Array.isArray(info) || typeof info.name !== "string" || typeof info.version !== "string") {
+            return rpcError(id, -32602, "initialize requires protocolVersion, capabilities, and clientInfo with name and version.", 400);
+        }
+        if (params.protocolVersion !== LEGACY_PROTOCOL_VERSION)
+            return rpcError(id, -32022, "Unsupported initialize-handshake protocol version", 400, { supported: [LEGACY_PROTOCOL_VERSION], requested: params.protocolVersion });
+        return { status: 200, message: { jsonrpc: "2.0", id, result: {
+                    protocolVersion: LEGACY_PROTOCOL_VERSION,
+                    capabilities: { tools: {} },
+                    serverInfo: server.serverInfo,
+                    ...(server.instructions ? { instructions: server.instructions } : {}),
+                } } };
+    }
+    const legacy = protocolVersion === LEGACY_PROTOCOL_VERSION;
+    if (legacy) {
+        const meta = request.params?._meta;
+        if (meta?.[META_VERSION] !== undefined || meta?.[META_CLIENT_CAPS] !== undefined || request.params?.inputResponses !== undefined || request.method === "server/discover") {
+            return rpcError(id, -32602, "Modern protocol metadata and methods cannot be used on an initialize-handshake connection.", 400);
+        }
+    }
+    else {
+        const meta = checkRequestMeta(request);
+        if ("status" in meta)
+            return meta;
     }
-    const meta = checkRequestMeta(request);
-    if ("status" in meta)
-        return meta;
     const complete = (result) => ({
-        message: { jsonrpc: "2.0", id, result: { resultType: "complete", ...result, _meta: { [META_SERVER_INFO]: server.serverInfo } } },
+        message: { jsonrpc: "2.0", id, result: legacy ? result : { resultType: "complete", ...result, _meta: { [META_SERVER_INFO]: server.serverInfo } } },
         status: 200,
     });
     const cacheScope = server.cacheScope ?? "public";
     switch (request.method) {
+        case "ping":
+            return legacy ? complete({}) : rpcError(id, -32601, "Method not found: ping", 404);
         case "server/discover":
             return complete({
                 supportedVersions: SUPPORTED_PROTOCOL_VERSIONS,
@@ -195,7 +264,7 @@ export async function handleRpc(server, incoming) {
                 cacheScope,
             });
         case "tools/list":
-            return complete({ tools: server.listTools(), ttlMs: server.toolsTtlMs, cacheScope });
+            return complete({ tools: server.listTools(), ...(!legacy ? { ttlMs: server.toolsTtlMs, cacheScope } : {}) });
         case "tools/call": {
             const name = request.params?.name;
             if (typeof name !== "string")
@@ -229,7 +298,7 @@ export async function handleRpc(server, incoming) {
             catch (error) {
                 if (!(error instanceof McpAccountLinkRequired))
                     throw error;
-                const caps = (request.params?._meta)[META_CLIENT_CAPS];
+                const caps = legacy ? {} : (request.params?._meta)[META_CLIENT_CAPS];
                 const urlMode = caps.elicitation?.url;
                 if (urlMode === null || typeof urlMode !== "object" || Array.isArray(urlMode)) {
                     const unsupported = textError("Connect your API account using an MCP client that supports browser account-linking prompts (URL-mode elicitation), then retry.", "ACCOUNT_LINK_REQUIRED");
@@ -997,7 +1066,8 @@ export function argumentsError(op, issues) {
 }
 // ---- results: projection, size cap, envelopes ------------------------------------
 /** Keep only `paths` of a value: arrays item by item, objects by dotted
- * path; scalars untouched. Same rule as the CLI's --fields. */
+ * path, including paths through arrays (`items.id` keeps each item's id);
+ * scalars untouched. Same rule as the CLI's --fields. */
 export function projectFields(value, paths) {
     if (paths === null)
         return value;
@@ -1005,26 +1075,25 @@ export function projectFields(value, paths) {
         return value.map((v) => projectFields(v, paths));
     if (value === null || typeof value !== "object")
         return value;
+    const groups = new Map();
+    for (const [key, ...rest] of paths) {
+        if (key === undefined)
+            continue;
+        const group = groups.get(key);
+        if (group)
+            group.push(rest);
+        else
+            groups.set(key, [rest]);
+    }
     const out = {};
-    for (const path of paths) {
-        let cursor = value;
-        for (const key of path) {
-            if (cursor === null || typeof cursor !== "object" || Array.isArray(cursor)) {
-                cursor = undefined;
-                break;
-            }
-            cursor = cursor[key];
-        }
-        if (cursor === undefined)
+    for (const [key, rests] of groups) {
+        const child = value[key];
+        if (child === undefined)
             continue;
-        let target = out;
-        for (const key of path.slice(0, -1)) {
-            const next = target[key];
-            if (next === undefined || next === null || typeof next !== "object" || Array.isArray(next))
-                target[key] = {};
-            target = target[key];
-        }
-        target[path[path.length - 1]] = cursor;
+        if (rests.some((rest) => rest.length === 0))
+            out[key] = child;
+        else if (child !== null && typeof child === "object")
+            out[key] = projectFields(child, rests);
     }
     return out;
 }
@@ -1102,7 +1171,9 @@ export function pageOutcome(items, nextPage, options = {}) {
     return { text: JSON.stringify(structured), isError: false, structured };
 }
 /** Placeholder for a value cut from an oversized object result. */
-const omittedMarker = (key, chars) => "[omitted: " + chars.toLocaleString("en-US") + " characters. Pass fields=[\"" + key + "\"] to fetch this key alone.]";
+const omittedMarker = (key, chars, maxChars) => chars > maxChars
+    ? "[omitted: " + chars.toLocaleString("en-US") + " characters, more than the cap on its own. Pass fields with dotted paths inside it, such as [\"" + key + ".id\"], or request a smaller page.]"
+    : "[omitted: " + chars.toLocaleString("en-US") + " characters. Pass fields=[\"" + key + "\"] to fetch this key alone.]";
 export function dataOutcome(data, options = {}) {
     const fields = options.fields ?? null;
     const maxChars = options.maxChars ?? DEFAULT_MAX_RESULT_CHARS;
@@ -1143,7 +1214,7 @@ export function dataOutcome(data, options = {}) {
                 out[e.key] = e.v;
         out.truncated = {
             omitted_keys: [...cut.keys()],
-            omitted: Object.fromEntries([...cut].map(([key, chars]) => [key, omittedMarker(key, chars)])),
+            omitted: Object.fromEntries([...cut].map(([key, chars]) => [key, omittedMarker(key, chars, maxChars)])),
             reason: "The result is " + text.length.toLocaleString("en-US") + " characters; results are capped at " + maxChars.toLocaleString("en-US") + ".",
             next_steps: [fieldsHint(false)],
         };
@@ -1321,8 +1392,8 @@ function omittedPlanLimit(ops, requested) {
         error: "PlanLimitError",
         code: "PLAN_LIMIT",
         message: requested
-            ? "The operation " + requested + " exists in the API Definition but was omitted from this generated package by its plan limit."
-            : "Matching operations exist in the API Definition but were omitted from this generated package by its plan limit.",
+            ? "The operation " + requested + " exists in the Spec but was omitted from this generated package by its plan limit."
+            : "Matching operations exist in the Spec but were omitted from this generated package by its plan limit.",
         omitted_operations: ops.map((op) => ({ tool: op.tool, method: op.httpMethod, path: op.path })),
         next_steps: ["Upgrade at https://typeship.dev/pricing and regenerate the package without the operation cap.", "Do not invent or retry an omitted operation against this generated package."],
     };

package/dist/mcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../src/mcp.ts"],"names":[],"mappings":";AAuBA,OAAO,EAAoC,KAAK,aAAa,EAAmB,MAAM,YAAY,CAAC;AAcnG,OAAO,EAA8C,KAAK,6BAA6B,EAAE,KAAK,kCAAkC,EAAE,KAAK,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACpL,YAAY,EAAE,6BAA6B,EAAE,kCAAkC,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC9H,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AA4U3D,MAAM,WAAW,cAAc;IAC7B,aAAa,CAAC,EAAE,6BAA6B,CAAC;IAC9C;kFAC8E;IAC9E,aAAa,CAAC,EAAE,kCAAkC,CAAC;IACnD;;;;iFAI6E;IAC7E,cAAc,CAAC,SAAS,EAAE,YAAY,GAAG,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CACjF;AAED,+EAA+E;AAC/E,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,cAAc,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAMjG;AAED;+EAC+E;AAC/E,wBAAsB,UAAU,CAAC,QAAQ,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAErE"}
+{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../src/mcp.ts"],"names":[],"mappings":";AAuBA,OAAO,EAAoC,KAAK,aAAa,EAAmB,MAAM,YAAY,CAAC;AAenG,OAAO,EAA8C,KAAK,6BAA6B,EAAE,KAAK,kCAAkC,EAAE,KAAK,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACpL,YAAY,EAAE,6BAA6B,EAAE,kCAAkC,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC9H,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AA6V3D,MAAM,WAAW,cAAc;IAC7B,aAAa,CAAC,EAAE,6BAA6B,CAAC;IAC9C;kFAC8E;IAC9E,aAAa,CAAC,EAAE,kCAAkC,CAAC;IACnD;;;;iFAI6E;IAC7E,cAAc,CAAC,SAAS,EAAE,YAAY,GAAG,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CACjF;AAED,+EAA+E;AAC/E,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,cAAc,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAMjG;AAED;+EAC+E;AAC/E,wBAAsB,UAAU,CAAC,QAAQ,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAErE"}

package/dist/mcp.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // typeship — MCP server. Generated by typeship — https://typeship.dev
-// Speaks MCP 2026-07-28 (stateless: per-request _meta, server/discover; no
-// initialize handshake, no sessions); the protocol layer and tool surface
+// Speaks MCP 2026-07-28 and accepts the 2025-11-25 initialize handshake.
+// HTTP is stateless (no sessions); the protocol layer and tool surface
 // live in ./mcp-protocol.js, shared with typeship's hosted endpoint. Two
 // transports, zero dependencies:
 //   node mcp.js            stdio (newline-delimited JSON-RPC 2.0)
@@ -21,8 +21,9 @@ import { homedir, tmpdir } from "node:os";
 import { basename, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { TypeshipClient, formatDebugEvent } from "./index.js";
+import { asApiResult } from "./core/http.js";
 import { GLOBALS, OMITTED_OPS, OPS, buildArgs } from "./ops.js";
-import { DEFAULT_MAX_RESULT_CHARS, SUPPORTED_PROTOCOL_VERSIONS, McpAccountLinkRequired, argumentsError, asJsonRpc, binaryOutcome, callSharedTool, checkRequestHeaders, dataOutcome, errorOutcome, handleRpc, isRpcOutcome, pageOutcome, parseIncludeList, prepareCall, resolveReferences, serverInstructions, takeCancelled, textError, toolDefinitions, visibleOps, } from "./mcp-protocol.js";
+import { DEFAULT_MAX_RESULT_CHARS, SUPPORTED_PROTOCOL_VERSIONS, McpAccountLinkRequired, argumentsError, asJsonRpc, binaryOutcome, callSharedTool, checkRequestHeaders, createStdioRpcHandler, dataOutcome, errorOutcome, handleRpc, isRpcOutcome, pageOutcome, parseIncludeList, prepareCall, resolveReferences, serverInstructions, takeCancelled, textError, toolDefinitions, visibleOps, } from "./mcp-protocol.js";
 import { fetchDocsText } from "./docs.js";
 import { assertCredentialDestination, assertStoredIdentity } from "./oauth-session.js";
 import { createCredentialStore } from "./credential-storage.js";
@@ -33,14 +34,14 @@ export { McpAccountLinkRequired } from "./mcp-protocol.js";
 const BIN = "typeship";
 const PKG_NAME = "@typeship-ax/mcp";
 const SERVER_NAME = "typeship-mcp";
-const SERVER_VERSION = "0.10.0";
+const SERVER_VERSION = "0.20.0";
 /** The MCP client's announced name (clientInfo in request _meta), for the User-Agent. */
 let MCP_CLIENT_NAME = null;
 function noteClientInfo(message) {
     const meta = message?.params?._meta;
     const name = meta?.["io.modelcontextprotocol/clientInfo"]?.name;
-    if (typeof name === "string" && name && name !== MCP_CLIENT_NAME) {
-        MCP_CLIENT_NAME = name.slice(0, 60);
+    if (typeof name === "string" && name) {
+        MCP_CLIENT_NAME = name.replace(/[\s;()]+/g, "_").slice(0, 60);
     }
 }
 const DEFAULT_BASE_URL = "https://typeship.dev/api/v1";
@@ -56,7 +57,7 @@ const TOOL_MODE = "meta";
 /** Project-supplied guidance appended to the server instructions. */
 const CUSTOM_INSTRUCTIONS = null;
 /** The tool that returns the caller (the CLI's whoami target), named in the instructions. */
-const IDENTITY_TOOL = "account_retrieve";
+const IDENTITY_TOOL = null;
 /** Surface switches: reads only, and/or a subset of resources or tools.
  * Flags win over the environment. */
 const ARGV = process.argv.slice(2);
@@ -144,7 +145,7 @@ function makeClient(op) {
         options.debug = (event) => process.stderr.write(formatDebugEvent(BIN + "-mcp", event) + "\n");
     }
     // The local MCP server identifies itself (surface + the client it serves, when announced).
-    options.defaultHeaders = { "User-Agent": PKG_NAME + "-mcp/" + SERVER_VERSION + " (typeship" + (MCP_CLIENT_NAME ? "; client=" + MCP_CLIENT_NAME : "") + ")" };
+    options.defaultHeaders = { "User-Agent": PKG_NAME + "-mcp/" + SERVER_VERSION + (MCP_CLIENT_NAME ? " (client=" + MCP_CLIENT_NAME + ")" : "") };
     // Keep the SDK's machine-token cache while re-evaluating local configuration.
     const key = createHash("sha256").update(JSON.stringify([options, config, profile?.name, stored?.oauth?.sessionId, null, process.env["TYPESHIP_DEBUG"]])).digest("hex");
     if (clientInstance && clientKey === key)
@@ -173,8 +174,9 @@ async function callOperationRaw(op, rawArgs, remote, client) {
     const { args, fields, maxChars } = prepared.call;
     const values = {};
     for (const p of op.params) {
-        if (args[p.name] !== undefined)
-            values[p.name] = args[p.name];
+        const argument = p.kind === "header" && p.name === "If-Match" ? "if_match" : p.name;
+        if (args[argument] !== undefined)
+            values[p.name] = args[argument];
     }
     // File arguments are local paths on this machine; unreadable ones are
     // argument errors, reported before anything is sent.
@@ -211,9 +213,21 @@ async function callOperationRaw(op, rawArgs, remote, client) {
     const shape = { fields, maxChars, pagination: op.pagination, args };
     try {
         const target = client[op.resource];
-        const result = await target[op.method](...callArgs);
+        let result = await asApiResult(target[op.method](...callArgs));
         if (!result.ok)
             return errorOutcome(result.error, errorContext);
+        if (op.httpMethod === "POST" && op.path === "/projects/{project_id}/generate") {
+            const batch = result.data;
+            const generations = client.generations;
+            const completed = [];
+            for (const generation of batch.data) {
+                const waited = await asApiResult(generations.wait(generation.id));
+                if (!waited.ok)
+                    return errorOutcome(waited.error, errorContext);
+                completed.push(waited.data);
+            }
+            result = { ...result, data: { ...batch, data: completed } };
+        }
         if (op.paginated) {
             const page = result.data;
             return pageOutcome(page.items, page.nextPageParams(), { ...shape, requestId: page.response.requestId });
@@ -281,7 +295,13 @@ const LOCAL_CREDENTIALS = LOCAL_PROCESS && !ARGV.includes("--http");
  * only on a local server (mcpExposed), writes are out under --read-only,
  * and --tools narrows to a subset. A hidden operation is unknown to
  * tools/call and execute alike. */
-const MCP_OPS = visibleOps(OPS, { readOnly: READ_ONLY, include: INCLUDE, uploads: LOCAL_PROCESS });
+const MCP_OPS = visibleOps(OPS, { readOnly: READ_ONLY, include: INCLUDE, uploads: LOCAL_PROCESS }).map((op) => {
+    const properties = op.inputSchema.properties;
+    if (!properties || !Object.hasOwn(properties, "If-Match"))
+        return op;
+    const { ["If-Match"]: ifMatch, ...rest } = properties;
+    return { ...op, inputSchema: { ...op.inputSchema, properties: { ...rest, if_match: ifMatch } } };
+});
 const HIDDEN_WRITES = READ_ONLY ? visibleOps(OPS, { include: INCLUDE, uploads: LOCAL_PROCESS }).length - MCP_OPS.length : 0;
 const HAS_UPLOADS = MCP_OPS.some((op) => op.bodyKind === "multipart" || op.bodyKind === "binary");
 /** A local file as an upload part (multipart field or raw body). */
@@ -408,7 +428,7 @@ async function authorizedHttp(request, authorizer, credentialsFor, apiBaseUrl) {
         return json(404, { error: "Unknown MCP endpoint." });
     if (request.method !== "POST") {
         // GET streams, DELETE (session end) and Mcp-Session-Id belong to earlier
-        // revisions; the spec asks modern-only servers to answer 405.
+        // revisions; this stateless transport answers 405 instead.
         return json(405, { error: "POST JSON-RPC messages to this endpoint (MCP " + SUPPORTED_PROTOCOL_VERSIONS[0] + ", stateless)." }, { Allow: "POST, OPTIONS" });
     }
     let principal;
@@ -449,9 +469,8 @@ async function authorizedHttp(request, authorizer, credentialsFor, apiBaseUrl) {
     const parsed = asJsonRpc(incoming);
     if (isRpcOutcome(parsed))
         return json(parsed.status, parsed.message);
-    // Header/body agreement is checked for requests; the spec defines no
-    // header requirements for notification POSTs.
-    if (parsed.id !== undefined && parsed.id !== null && parsed.method !== "initialize") {
+    // Validate the selected wire revision before dispatching a request.
+    if (parsed.id !== undefined && parsed.id !== null) {
         const mismatch = checkRequestHeaders(request.headers, parsed);
         if (mismatch)
             return json(mismatch.status, mismatch.message);
@@ -459,7 +478,7 @@ async function authorizedHttp(request, authorizer, credentialsFor, apiBaseUrl) {
     noteClientInfo(parsed);
     let outcome;
     try {
-        outcome = await handleRpc(serverFor(remote), parsed);
+        outcome = await handleRpc(serverFor(remote), parsed, request.headers.get("mcp-protocol-version"));
     }
     catch (e) {
         return json(500, { jsonrpc: "2.0", id: parsed.id ?? null, error: { code: -32603, message: "Internal error" } });
@@ -505,6 +524,7 @@ async function startStdio() {
     const rl = createInterface({ input: process.stdin });
     const write = (message) => process.stdout.write(JSON.stringify(message) + "\n");
     const server = serverFor();
+    const dispatch = createStdioRpcHandler(server);
     rl.on("line", (line) => {
         const trimmed = line.trim();
         if (trimmed === "")
@@ -519,7 +539,7 @@ async function startStdio() {
         }
         const id = incoming !== null && typeof incoming === "object" && !Array.isArray(incoming) ? incoming.id : undefined;
         noteClientInfo(incoming);
-        void handleRpc(server, incoming)
+        void dispatch(incoming)
             .then((outcome) => {
             if (outcome.message === null)
                 return;

package/dist/ops.d.ts

@@ -12,6 +12,8 @@ export interface ParamSpec {
      * value — JSON if it parses, else the raw text. */
     type: "string" | "number" | "boolean" | "array" | "object" | "json" | "file";
     required: boolean;
+    /** A JSON body flag accepts the literal null as JSON null. */
+    nullable?: boolean;
     enum?: string[];
     /** Element type of an "array" param: what each repeated/comma value coerces to. */
     items?: {
@@ -107,9 +109,11 @@ export interface OpSpec {
     /** What the tool returns (JSON Schema 2020-12), when the spec documents
      * a success body; paginated tools describe { items, hasMore, nextPage }. */
     outputSchema?: Record<string, unknown>;
+    /** File array used by CLI --out, independent of the agent schema budget. */
+    fileBundleProperty?: string;
 }
 export declare const OPS: OpSpec[];
-/** Operations present in the API Definition but omitted by this
+/** Operations present in the API Spec but omitted by this
  * generation's operation cap. Kept deliberately small: enough for honest
  * discovery and PLAN_LIMIT errors, never enough to call an absent method. */
 export type OmittedOpSpec = Pick<OpSpec, "resource" | "method" | "command" | "commandAlias" | "tool" | "httpMethod" | "path" | "summary" | "description" | "toolDescription" | "paginated" | "select" | "safety" | "auth" | "security" | "params" | "inputSchema">;

package/dist/ops.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ops.d.ts","sourceRoot":"","sources":["../src/ops.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,SAAS;IACxB,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,2CAA2C;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,+CAA+C;IAC/C,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC3C;;;uDAGmD;IACnD,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC;IAC7E,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,mFAAmF;IACnF,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACvF,yFAAyF;IACzF,MAAM,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;4DACwD;IACxD,OAAO,CAAC,EAAE,KAAK,GAAG;QAChB,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,EAAE,EAAE,MAAM,CAAC;QACX,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,CAAC;CACH;AAED,MAAM,WAAW,MAAM;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1B,6EAA6E;IAC7E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;6EACyE;IACzE,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;IACtC,uDAAuD;IACvD,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,WAAW,GAAG,QAAQ,GAAG,MAAM,GAAG,IAAI,CAAC;IACnE;0BACsB;IACtB,GAAG,EAAE,OAAO,CAAC;IACb,SAAS,EAAE,OAAO,CAAC;IACnB;kEAC8D;IAC9D,MAAM,EAAE,OAAO,CAAC;IAChB,oEAAoE;IACpE,OAAO,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,GAAG,UAAU,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,CAAC;IACrG,iEAAiE;IACjE,UAAU,EAAE,OAAO,CAAC;IACpB,qEAAqE;IACrE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,yDAAyD;IACzD,KAAK,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,kBAAkB,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IACjI,qFAAqF;IACrF,UAAU,CAAC,EAAE;QACX,KAAK,EAAE,QAAQ,GAAG,kBAAkB,GAAG,MAAM,GAAG,QAAQ,CAAC;QACzD,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IACF;qEACiE;IACjE,IAAI,EAAE,UAAU,GAAG,UAAU,GAAG,MAAM,CAAC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IACtC,kEAAkE;IAClE,iBAAiB,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC;IAC/B,4EAA4E;IAC5E,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,aAAa,CAAC;IACzC,MAAM,EAAE,SAAS,EAAE,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,8EAA8E;IAC9E,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C;gFAC4E;IAC5E,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC;AAED,eAAO,MAAM,GAAG,EAAE,MAAM,EAmCvB,CAAC;AAEF;;6EAE6E;AAC7E,MAAM,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,EACrC,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,cAAc,GAAG,MAAM,GAAG,YAAY,GAC1E,MAAM,GAAG,SAAS,GAAG,aAAa,GAAG,iBAAiB,GAAG,WAAW,GACpE,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,GAAG,QAAQ,GAAG,aAAa,CACrE,CAAC;AAEF,eAAO,MAAM,WAAW,EAAE,aAAa,EAEtC,CAAC;AAEF;qEACqE;AACrE,eAAO,MAAM,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,EAEtF,CAAC;AAEF,wBAAgB,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAE3E;AAED,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAIrF;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CACvB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,QAAQ,CAAC,EAAE,OAAO,EAClB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,EAAE,CAuCX"}
+{"version":3,"file":"ops.d.ts","sourceRoot":"","sources":["../src/ops.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,SAAS;IACxB,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,2CAA2C;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,+CAA+C;IAC/C,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC3C;;;uDAGmD;IACnD,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC;IAC7E,QAAQ,EAAE,OAAO,CAAC;IAClB,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,mFAAmF;IACnF,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACvF,yFAAyF;IACzF,MAAM,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;4DACwD;IACxD,OAAO,CAAC,EAAE,KAAK,GAAG;QAChB,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,EAAE,EAAE,MAAM,CAAC;QACX,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,CAAC;CACH;AAED,MAAM,WAAW,MAAM;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1B,6EAA6E;IAC7E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;6EACyE;IACzE,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;IACtC,uDAAuD;IACvD,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,WAAW,GAAG,QAAQ,GAAG,MAAM,GAAG,IAAI,CAAC;IACnE;0BACsB;IACtB,GAAG,EAAE,OAAO,CAAC;IACb,SAAS,EAAE,OAAO,CAAC;IACnB;kEAC8D;IAC9D,MAAM,EAAE,OAAO,CAAC;IAChB,oEAAoE;IACpE,OAAO,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,GAAG,UAAU,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,CAAC;IACrG,iEAAiE;IACjE,UAAU,EAAE,OAAO,CAAC;IACpB,qEAAqE;IACrE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,yDAAyD;IACzD,KAAK,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,kBAAkB,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IACjI,qFAAqF;IACrF,UAAU,CAAC,EAAE;QACX,KAAK,EAAE,QAAQ,GAAG,kBAAkB,GAAG,MAAM,GAAG,QAAQ,CAAC;QACzD,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IACF;qEACiE;IACjE,IAAI,EAAE,UAAU,GAAG,UAAU,GAAG,MAAM,CAAC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IACtC,kEAAkE;IAClE,iBAAiB,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC;IAC/B,4EAA4E;IAC5E,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,aAAa,CAAC;IACzC,MAAM,EAAE,SAAS,EAAE,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,8EAA8E;IAC9E,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C;gFAC4E;IAC5E,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,4EAA4E;IAC5E,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,eAAO,MAAM,GAAG,EAAE,MAAM,EA0CvB,CAAC;AAEF;;6EAE6E;AAC7E,MAAM,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,EACrC,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,cAAc,GAAG,MAAM,GAAG,YAAY,GAC1E,MAAM,GAAG,SAAS,GAAG,aAAa,GAAG,iBAAiB,GAAG,WAAW,GACpE,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,GAAG,QAAQ,GAAG,aAAa,CACrE,CAAC;AAEF,eAAO,MAAM,WAAW,EAAE,aAAa,EAEtC,CAAC;AAEF;qEACqE;AACrE,eAAO,MAAM,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,EAEtF,CAAC;AAEF,wBAAgB,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAE3E;AAED,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAIrF;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CACvB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,QAAQ,CAAC,EAAE,OAAO,EAClB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,EAAE,CAuCX"}