@typeship-ax/mcp 0.9.1 → 0.19.0

package/src/errors.ts

@@ -1,5 +1,5 @@
 // typeship — typed error classes.
-// Generated by typeship — https://typeship.dev — do not edit by hand.
+// Generated by typeship — https://typeship.dev
 
 import { ApiError, type ResponseMeta } from "./core/http.js";
 import type { ErrorModel, ErrorModelRead } from "./types.js";
@@ -77,6 +77,16 @@ export class RateLimitedError extends ApiError<429, ErrorModelRead> {
   }
 }
 
+/**
+ * An unexpected error prevented the request from completing.
+ * Raised for HTTP 500 responses.
+ */
+export class InternalServerError extends ApiError<500, ErrorModelRead> {
+  constructor(body: ErrorModelRead, response: ResponseMeta) {
+    super("An unexpected error prevented the request from completing.", 500, body, response);
+  }
+}
+
 /**
  * Unexpected error.
  * Raised for "default" responses.
@@ -88,41 +98,41 @@ export class ApiResponseError extends ApiError<number, ErrorModelRead> {
 }
 
 /**
- * The plan does not include another project or the requested target configuration.
- * Raised for HTTP 402 responses.
+ * No such resource in this account.
+ * Raised for HTTP 404 responses.
  */
-export class PaymentRequiredError extends ApiError<402, ErrorModelRead> {
+export class NotFoundError extends ApiError<404, ErrorModelRead> {
   constructor(body: ErrorModelRead, response: ResponseMeta) {
-    super("The plan does not include another project or the requested target configuration.", 402, body, response);
+    super("No such resource in this account.", 404, body, response);
   }
 }
 
 /**
- * Project setup failed unexpectedly; the key reservation is released.
- * Raised for HTTP 500 responses.
+ * The plan does not include another project or the requested target configuration.
+ * Raised for HTTP 402 responses.
  */
-export class InternalServerError extends ApiError<500, ErrorModelRead> {
+export class PaymentRequiredError extends ApiError<402, ErrorModelRead> {
   constructor(body: ErrorModelRead, response: ResponseMeta) {
-    super("Project setup failed unexpectedly; the key reservation is released.", 500, body, response);
+    super("The plan does not include another project or the requested target configuration.", 402, body, response);
   }
 }
 
 /**
- * No such resource in this account.
- * Raised for HTTP 404 responses.
+ * The resource changed since the ETag supplied in If-Match. No write was applied.
+ * Raised for HTTP 412 responses.
  */
-export class NotFoundError extends ApiError<404, ErrorModelRead> {
+export class PreconditionFailedError extends ApiError<412, ErrorModelRead> {
   constructor(body: ErrorModelRead, response: ResponseMeta) {
-    super("No such resource in this account.", 404, body, response);
+    super("The resource changed since the ETag supplied in If-Match. No write was applied.", 412, body, response);
   }
 }
 
 /**
- * The Project was saved, but an obsolete release pull request could not be retired.
+ * Dependent work failed while completing the request.
  * Raised for HTTP 502 responses.
  */
 export class BadGatewayError extends ApiError<502, ErrorModelRead> {
   constructor(body: ErrorModelRead, response: ResponseMeta) {
-    super("The Project was saved, but an obsolete release pull request could not be retired.", 502, body, response);
+    super("Dependent work failed while completing the request.", 502, body, response);
   }
 }

package/src/index.ts

@@ -1,5 +1,5 @@
 // typeship — client entry point.
-// Generated by typeship — https://typeship.dev — do not edit by hand.
+// Generated by typeship — https://typeship.dev
 
 import {
   HttpCore,
@@ -22,8 +22,8 @@ import { AccountResource } from "./resources/account.js";
 import { ApiKeysResource } from "./resources/api-keys.js";
 
 /** This package's version, also sent as the `User-Agent`. */
-export const VERSION = "0.9.1";
-const USER_AGENT = "@typeship-ax/mcp/0.9.1 (typeship)";
+export const VERSION = "0.19.0";
+const USER_AGENT = "@typeship-ax/mcp/0.19.0";
 
 export interface ClientOptions {
   /** Override the server URL. Default: `https://typeship.dev/api/v1` */
@@ -79,10 +79,10 @@ export interface ClientOptions {
 }
 
 /**
- * typeship — v0.9.1
+ * typeship — v0.19.0
  *
  * Resolve an OpenAPI or GraphQL Definition, diagnose it, and keep every
- * selected SDK, CLI, and MCP Target current.
+ * selected CLI, MCP, and SDK Target current.
  *
  * Every operation but one requires a bearer credential: an organization
  * API key from the console, or an OAuth access token carrying the operation's
@@ -90,6 +90,10 @@ export interface ClientOptions {
  * consent. OAuth grants cannot switch organizations after consent. A browser
  * session is not a credential for this API. The exception is POST /generate,
  * which works anonymously with the free plan's limits.
+ *
+ * Examples use Parcel, a fictional delivery service. Replace its domains,
+ * repository names, and resource identifiers with your own. The hosted
+ * petstore Definition is a runnable sample.
  */
 export class TypeshipClient {
   readonly generate: GenerateResource;

package/src/mcp-protocol.ts

@@ -1,5 +1,6 @@
 /**
- * MCP 2026-07-28 for a tools-only server. Generated by typeship — https://typeship.dev
+ * MCP tools server with a 2025-11-25 handshake adapter and a 2026-07-28 core.
+ * Generated by typeship — https://typeship.dev
  *
  * The protocol layer shared by the MCP server in every generated package and
  * by typeship's hosted endpoint: JSON-RPC shape checks, the per-request _meta
@@ -19,10 +20,9 @@ import { dateKindOf, relativeDate } from "./dates.js";
 import { docsReadTarget, resolveDocsContentUrl, searchConnectedGuides } from "./docs.js";
 
 export const MCP_PROTOCOL_VERSION = "2026-07-28";
-/** Revisions served. Legacy (initialize-handshake) revisions are not; an
- * initialize request gets an error naming this list, as the spec asks of
- * modern-only servers. */
-export const SUPPORTED_PROTOCOL_VERSIONS: readonly string[] = [MCP_PROTOCOL_VERSION];
+export const LEGACY_PROTOCOL_VERSION = "2025-11-25";
+/** The modern model and the supported initialize-handshake wire revision. */
+export const SUPPORTED_PROTOCOL_VERSIONS: readonly string[] = [MCP_PROTOCOL_VERSION, LEGACY_PROTOCOL_VERSION];
 
 export const META_VERSION = "io.modelcontextprotocol/protocolVersion";
 export const META_CLIENT_CAPS = "io.modelcontextprotocol/clientCapabilities";
@@ -241,7 +241,7 @@ export function checkRequestMeta(request: JsonRpcMessage): RpcOutcome | { versio
   if (typeof version !== "string") {
     return rpcError(request.id, -32602, "Invalid params: params._meta[\"" + META_VERSION + "\"] is required on every request (MCP " + MCP_PROTOCOL_VERSION + ").", 400);
   }
-  if (!SUPPORTED_PROTOCOL_VERSIONS.includes(version)) {
+  if (version !== MCP_PROTOCOL_VERSION) {
     return rpcError(request.id, -32022, "Unsupported protocol version", 400, { supported: SUPPORTED_PROTOCOL_VERSIONS, requested: version });
   }
   if (caps === null || typeof caps !== "object" || Array.isArray(caps)) {
@@ -271,6 +271,16 @@ export function checkRequestHeaders(headers: { get(name: string): string | null
   const id = message.id;
   const version = headers.get("mcp-protocol-version");
   const bodyVersion = (message.params?._meta as Record<string, unknown> | undefined)?.[META_VERSION];
+  if (version !== null && !SUPPORTED_PROTOCOL_VERSIONS.includes(version)) return rpcError(id, -32022, "Unsupported protocol version", 400, { supported: SUPPORTED_PROTOCOL_VERSIONS, requested: version });
+  if (message.method === "initialize" || version === LEGACY_PROTOCOL_VERSION) {
+    if (bodyVersion !== undefined || headers.get("mcp-method") !== null || headers.get("mcp-name") !== null) {
+      return rpcError(id, -32020, "Header mismatch: initialize-handshake requests cannot carry modern protocol metadata or routing headers.", 400);
+    }
+    if (version !== null && version !== LEGACY_PROTOCOL_VERSION) {
+      return rpcError(id, -32022, "Unsupported initialize-handshake protocol version", 400, { supported: [LEGACY_PROTOCOL_VERSION], requested: version });
+    }
+    return null;
+  }
   if (version === null) return rpcError(id, -32020, "Header mismatch: MCP-Protocol-Version header is required", 400);
   if (typeof bodyVersion === "string" && version !== bodyVersion) {
     return rpcError(id, -32020, "Header mismatch: MCP-Protocol-Version header '" + version + "' does not match body value '" + bodyVersion + "'", 400);
@@ -302,7 +312,34 @@ export function takeCancelled(id: unknown): boolean {
 
 // ---- dispatch ------------------------------------------------------------------
 
-export async function handleRpc(server: McpServer, incoming: unknown): Promise<RpcOutcome> {
+/** One stdio process owns its handshake state. HTTP instead carries the
+ * negotiated revision on each request and never needs a server session. */
+export function createStdioRpcHandler(server: McpServer): (incoming: unknown) => Promise<RpcOutcome> {
+  let version: string | undefined;
+  let initialized = false;
+  let initializing = false;
+  return async (incoming) => {
+    const request = asJsonRpc(incoming);
+    if (isRpcOutcome(request)) return request;
+    if (request.method === "initialize") {
+      if (version || initializing) return rpcError(request.id, -32600, "This connection has already selected its MCP protocol.", 400, { supported: SUPPORTED_PROTOCOL_VERSIONS });
+      initializing = true;
+      const result = await handleRpc(server, request);
+      initializing = false;
+      if (result.status === 200) version = LEGACY_PROTOCOL_VERSION;
+      return result;
+    }
+    if (version === LEGACY_PROTOCOL_VERSION) {
+      if (request.method === "notifications/initialized" && request.id === undefined) initialized = true;
+      if (!initialized && request.id !== undefined && request.method !== "ping") return rpcError(request.id, -32600, "Send notifications/initialized before calling MCP methods.", 400);
+    } else if ((request.params?._meta as Record<string, unknown> | undefined)?.[META_VERSION] === MCP_PROTOCOL_VERSION) {
+      version = MCP_PROTOCOL_VERSION;
+    }
+    return handleRpc(server, request, version);
+  };
+}
+
+export async function handleRpc(server: McpServer, incoming: unknown, protocolVersion?: string | null): Promise<RpcOutcome> {
   const parsed = asJsonRpc(incoming);
   if (isRpcOutcome(parsed)) return parsed;
   const request = parsed;
@@ -317,24 +354,45 @@ export async function handleRpc(server: McpServer, incoming: unknown): Promise<R
     return { message: null, status: 202 };
   }
 
-  // Legacy clients open with initialize; name what we do speak so their one
-  // visible error is actionable (spec: modern-only servers SHOULD do this).
+  // Only the wire envelope differs. Tool execution and authorization below
+  // remain shared with modern clients.
   if (request.method === "initialize") {
-    return rpcError(id, -32601,
-      "This server speaks MCP " + SUPPORTED_PROTOCOL_VERSIONS.join(", ") + " only (stateless, no initialize handshake). Upgrade the client, or send requests with params._meta[\"" + META_VERSION + "\"].",
-      400, { supported: SUPPORTED_PROTOCOL_VERSIONS });
+    const params = request.params;
+    if ((params?._meta as Record<string, unknown> | undefined)?.[META_VERSION] !== undefined) return rpcError(id, -32602, "initialize cannot carry modern protocol metadata.", 400);
+    const info = params?.clientInfo as Record<string, unknown> | undefined;
+    if (!params || typeof params.protocolVersion !== "string" || !params.capabilities || typeof params.capabilities !== "object" || Array.isArray(params.capabilities) ||
+      !info || typeof info !== "object" || Array.isArray(info) || typeof info.name !== "string" || typeof info.version !== "string") {
+      return rpcError(id, -32602, "initialize requires protocolVersion, capabilities, and clientInfo with name and version.", 400);
+    }
+    if (params.protocolVersion !== LEGACY_PROTOCOL_VERSION) return rpcError(id, -32022, "Unsupported initialize-handshake protocol version", 400, { supported: [LEGACY_PROTOCOL_VERSION], requested: params.protocolVersion });
+    return { status: 200, message: { jsonrpc: "2.0", id, result: {
+      protocolVersion: LEGACY_PROTOCOL_VERSION,
+      capabilities: { tools: {} },
+      serverInfo: server.serverInfo,
+      ...(server.instructions ? { instructions: server.instructions } : {}),
+    } } };
+  }
+
+  const legacy = protocolVersion === LEGACY_PROTOCOL_VERSION;
+  if (legacy) {
+    const meta = request.params?._meta as Record<string, unknown> | undefined;
+    if (meta?.[META_VERSION] !== undefined || meta?.[META_CLIENT_CAPS] !== undefined || request.params?.inputResponses !== undefined || request.method === "server/discover") {
+      return rpcError(id, -32602, "Modern protocol metadata and methods cannot be used on an initialize-handshake connection.", 400);
+    }
+  } else {
+    const meta = checkRequestMeta(request);
+    if ("status" in meta) return meta;
   }
 
-  const meta = checkRequestMeta(request);
-  if ("status" in meta) return meta;
-
   const complete = (result: Record<string, unknown>): RpcOutcome => ({
-    message: { jsonrpc: "2.0", id, result: { resultType: "complete", ...result, _meta: { [META_SERVER_INFO]: server.serverInfo } } },
+    message: { jsonrpc: "2.0", id, result: legacy ? result : { resultType: "complete", ...result, _meta: { [META_SERVER_INFO]: server.serverInfo } } },
     status: 200,
   });
   const cacheScope = server.cacheScope ?? "public";
 
   switch (request.method) {
+    case "ping":
+      return legacy ? complete({}) : rpcError(id, -32601, "Method not found: ping", 404);
     case "server/discover":
       return complete({
         supportedVersions: SUPPORTED_PROTOCOL_VERSIONS,
@@ -344,7 +402,7 @@ export async function handleRpc(server: McpServer, incoming: unknown): Promise<R
         cacheScope,
       });
     case "tools/list":
-      return complete({ tools: server.listTools(), ttlMs: server.toolsTtlMs, cacheScope });
+      return complete({ tools: server.listTools(), ...(!legacy ? { ttlMs: server.toolsTtlMs, cacheScope } : {}) });
     case "tools/call": {
       const name = request.params?.name;
       if (typeof name !== "string") return rpcError(id, -32602, "tools/call requires a tool name", 400);
@@ -371,7 +429,7 @@ export async function handleRpc(server: McpServer, incoming: unknown): Promise<R
       try { outcome = await server.callTool(name, args); }
       catch (error) {
         if (!(error instanceof McpAccountLinkRequired)) throw error;
-        const caps = (request.params?._meta as Record<string, unknown>)[META_CLIENT_CAPS] as { elicitation?: { url?: unknown } };
+        const caps = legacy ? {} : (request.params?._meta as Record<string, unknown>)[META_CLIENT_CAPS] as { elicitation?: { url?: unknown } };
         const urlMode = caps.elicitation?.url;
         if (urlMode === null || typeof urlMode !== "object" || Array.isArray(urlMode)) {
           const unsupported = textError("Connect your API account using an MCP client that supports browser account-linking prompts (URL-mode elicitation), then retry.", "ACCOUNT_LINK_REQUIRED");
@@ -1185,26 +1243,24 @@ export function argumentsError(op: { tool: string }, issues: ArgumentIssue[]): T
 // ---- results: projection, size cap, envelopes ------------------------------------
 
 /** Keep only `paths` of a value: arrays item by item, objects by dotted
- * path; scalars untouched. Same rule as the CLI's --fields. */
+ * path, including paths through arrays (`items.id` keeps each item's id);
+ * scalars untouched. Same rule as the CLI's --fields. */
 export function projectFields(value: unknown, paths: string[][] | null): unknown {
   if (paths === null) return value;
   if (Array.isArray(value)) return value.map((v) => projectFields(v, paths));
   if (value === null || typeof value !== "object") return value;
+  const groups = new Map<string, string[][]>();
+  for (const [key, ...rest] of paths) {
+    if (key === undefined) continue;
+    const group = groups.get(key);
+    if (group) group.push(rest); else groups.set(key, [rest]);
+  }
   const out: Record<string, unknown> = {};
-  for (const path of paths) {
-    let cursor: unknown = value;
-    for (const key of path) {
-      if (cursor === null || typeof cursor !== "object" || Array.isArray(cursor)) { cursor = undefined; break; }
-      cursor = (cursor as Record<string, unknown>)[key];
-    }
-    if (cursor === undefined) continue;
-    let target = out;
-    for (const key of path.slice(0, -1)) {
-      const next = target[key];
-      if (next === undefined || next === null || typeof next !== "object" || Array.isArray(next)) target[key] = {};
-      target = target[key] as Record<string, unknown>;
-    }
-    target[path[path.length - 1]!] = cursor;
+  for (const [key, rests] of groups) {
+    const child = (value as Record<string, unknown>)[key];
+    if (child === undefined) continue;
+    if (rests.some((rest) => rest.length === 0)) out[key] = child;
+    else if (child !== null && typeof child === "object") out[key] = projectFields(child, rests);
   }
   return out;
 }
@@ -1296,8 +1352,9 @@ export function pageOutcome(items: unknown[], nextPage: Record<string, unknown>
 }
 
 /** Placeholder for a value cut from an oversized object result. */
-const omittedMarker = (key: string, chars: number) =>
-  "[omitted: " + chars.toLocaleString("en-US") + " characters. Pass fields=[\"" + key + "\"] to fetch this key alone.]";
+const omittedMarker = (key: string, chars: number, maxChars: number) => chars > maxChars
+  ? "[omitted: " + chars.toLocaleString("en-US") + " characters, more than the cap on its own. Pass fields with dotted paths inside it, such as [\"" + key + ".id\"], or request a smaller page.]"
+  : "[omitted: " + chars.toLocaleString("en-US") + " characters. Pass fields=[\"" + key + "\"] to fetch this key alone.]";
 
 export function dataOutcome(data: unknown, options: ResultOptions = {}): ToolOutcome {
   const fields = options.fields ?? null;
@@ -1336,7 +1393,7 @@ export function dataOutcome(data: unknown, options: ResultOptions = {}): ToolOut
     for (const e of entries) if (!cut.has(e.key)) out[e.key] = e.v;
     out.truncated = {
       omitted_keys: [...cut.keys()],
-      omitted: Object.fromEntries([...cut].map(([key, chars]) => [key, omittedMarker(key, chars)])),
+      omitted: Object.fromEntries([...cut].map(([key, chars]) => [key, omittedMarker(key, chars, maxChars)])),
       reason: "The result is " + text.length.toLocaleString("en-US") + " characters; results are capped at " + maxChars.toLocaleString("en-US") + ".",
       next_steps: [fieldsHint(false)],
     };

package/src/mcp.ts

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // typeship — MCP server. Generated by typeship — https://typeship.dev
-// Speaks MCP 2026-07-28 (stateless: per-request _meta, server/discover; no
-// initialize handshake, no sessions); the protocol layer and tool surface
+// Speaks MCP 2026-07-28 and accepts the 2025-11-25 initialize handshake.
+// HTTP is stateless (no sessions); the protocol layer and tool surface
 // live in ./mcp-protocol.js, shared with typeship's hosted endpoint. Two
 // transports, zero dependencies:
 //   node mcp.js            stdio (newline-delimited JSON-RPC 2.0)
@@ -25,7 +25,7 @@ import { TypeshipClient, formatDebugEvent, type ClientOptions, type DebugEvent }
 import { GLOBALS, OMITTED_OPS, OPS, buildArgs, type OpSpec } from "./ops.js";
 import {
   DEFAULT_MAX_RESULT_CHARS, SUPPORTED_PROTOCOL_VERSIONS, McpAccountLinkRequired, argumentsError, asJsonRpc, binaryOutcome, callSharedTool, checkRequestHeaders,
-  dataOutcome, errorOutcome, handleRpc, isRpcOutcome, pageOutcome, parseIncludeList, prepareCall, resolveReferences, serverInstructions,
+  createStdioRpcHandler, dataOutcome, errorOutcome, handleRpc, isRpcOutcome, pageOutcome, parseIncludeList, prepareCall, resolveReferences, serverInstructions,
   takeCancelled, textError, toolDefinitions, visibleOps,
   type ArgumentIssue, type DocsSource, type McpServer, type OpLike, type RpcOutcome, type ToolOutcome,
 } from "./mcp-protocol.js";
@@ -42,13 +42,13 @@ export { McpAccountLinkRequired } from "./mcp-protocol.js";
 const BIN = "typeship";
 const PKG_NAME = "@typeship-ax/mcp";
 const SERVER_NAME = "typeship-mcp";
-const SERVER_VERSION = "0.9.1";
+const SERVER_VERSION = "0.19.0";
 /** The MCP client's announced name (clientInfo in request _meta), for the User-Agent. */
 let MCP_CLIENT_NAME: string | null = null;
 function noteClientInfo(message: unknown): void {
   const meta = (message as { params?: { _meta?: Record<string, { name?: unknown }> } } | null)?.params?._meta;
   const name = meta?.["io.modelcontextprotocol/clientInfo"]?.name;
-  if (typeof name === "string" && name && name !== MCP_CLIENT_NAME) { MCP_CLIENT_NAME = name.slice(0, 60); }
+  if (typeof name === "string" && name) { MCP_CLIENT_NAME = name.replace(/[\s;()]+/g, "_").slice(0, 60); }
 }
 const DEFAULT_BASE_URL = "https://typeship.dev/api/v1";
 const NAMED_SCHEMES: CredentialSchemes = {"apiKey":{"kind":"bearer","options":["bearerToken"]}};
@@ -146,7 +146,7 @@ function makeClient(op: OpSpec): TypeshipClient {
     options.debug = (event: DebugEvent) => process.stderr.write(formatDebugEvent(BIN + "-mcp", event) + "\n");
   }
   // The local MCP server identifies itself (surface + the client it serves, when announced).
-  options.defaultHeaders = { "User-Agent": PKG_NAME + "-mcp/" + SERVER_VERSION + " (typeship" + (MCP_CLIENT_NAME ? "; client=" + MCP_CLIENT_NAME : "") + ")" };
+  options.defaultHeaders = { "User-Agent": PKG_NAME + "-mcp/" + SERVER_VERSION + (MCP_CLIENT_NAME ? " (client=" + MCP_CLIENT_NAME + ")" : "") };
   // Keep the SDK's machine-token cache while re-evaluating local configuration.
   const key = createHash("sha256").update(JSON.stringify([options, config, profile?.name, stored?.oauth?.sessionId, null, process.env["TYPESHIP_DEBUG"]])).digest("hex");
   if (clientInstance && clientKey === key) return clientInstance;
@@ -176,7 +176,8 @@ async function callOperationRaw(op: OpSpec, rawArgs: Record<string, unknown>, re
   const { args, fields, maxChars } = prepared.call;
   const values: Record<string, unknown> = {};
   for (const p of op.params) {
-    if (args[p.name] !== undefined) values[p.name] = args[p.name];
+    const argument = p.kind === "header" && p.name === "If-Match" ? "if_match" : p.name;
+    if (args[argument] !== undefined) values[p.name] = args[argument];
   }
   // File arguments are local paths on this machine; unreadable ones are
   // argument errors, reported before anything is sent.
@@ -206,8 +207,19 @@ async function callOperationRaw(op: OpSpec, rawArgs: Record<string, unknown>, re
   const shape = { fields, maxChars, pagination: op.pagination, args };
   try {
     const target = (client as unknown as Record<string, Record<string, (...a: unknown[]) => unknown>>)[op.resource]!;
-    const result = await (target[op.method]!(...callArgs) as Promise<{ ok: boolean; data?: unknown; error?: unknown; response?: { requestId?: string } }>);
+    let result = await (target[op.method]!(...callArgs) as Promise<{ ok: boolean; data?: unknown; error?: unknown; response?: { requestId?: string } }>);
     if (!result.ok) return errorOutcome(result.error, errorContext);
+    if (op.httpMethod === "POST" && op.path === "/projects/{project_id}/generations") {
+      const batch = result.data as { data: Array<{ id: string }> };
+      const generations = (client as unknown as { generations: { wait(id: string): Promise<{ ok: boolean; data?: unknown; error?: unknown }> } }).generations;
+      const completed: unknown[] = [];
+      for (const generation of batch.data) {
+        const waited = await generations.wait(generation.id);
+        if (!waited.ok) return errorOutcome(waited.error, errorContext);
+        completed.push(waited.data);
+      }
+      result = { ...result, data: { ...batch, data: completed } };
+    }
     if (op.paginated) {
       const page = result.data as { items: unknown[]; nextPageParams(): Record<string, unknown> | null; response: { requestId?: string } };
       return pageOutcome(page.items, page.nextPageParams(), { ...shape, requestId: page.response.requestId });
@@ -269,7 +281,12 @@ const LOCAL_CREDENTIALS = LOCAL_PROCESS && !ARGV.includes("--http");
  * only on a local server (mcpExposed), writes are out under --read-only,
  * and --tools narrows to a subset. A hidden operation is unknown to
  * tools/call and execute alike. */
-const MCP_OPS = visibleOps(OPS as unknown as OpLike[], { readOnly: READ_ONLY, include: INCLUDE, uploads: LOCAL_PROCESS }) as unknown as OpSpec[];
+const MCP_OPS = (visibleOps(OPS as unknown as OpLike[], { readOnly: READ_ONLY, include: INCLUDE, uploads: LOCAL_PROCESS }) as unknown as OpSpec[]).map((op) => {
+  const properties = op.inputSchema.properties as Record<string, unknown> | undefined;
+  if (!properties || !Object.hasOwn(properties, "If-Match")) return op;
+  const { ["If-Match"]: ifMatch, ...rest } = properties;
+  return { ...op, inputSchema: { ...op.inputSchema, properties: { ...rest, if_match: ifMatch } } };
+});
 const HIDDEN_WRITES = READ_ONLY ? visibleOps(OPS as unknown as OpLike[], { include: INCLUDE, uploads: LOCAL_PROCESS }).length - MCP_OPS.length : 0;
 const HAS_UPLOADS = MCP_OPS.some((op) => op.bodyKind === "multipart" || op.bodyKind === "binary");
 
@@ -415,7 +432,7 @@ async function authorizedHttp(request: Request, authorizer: ReturnType<typeof cr
   if (url.pathname !== resource.pathname) return json(404, { error: "Unknown MCP endpoint." });
   if (request.method !== "POST") {
     // GET streams, DELETE (session end) and Mcp-Session-Id belong to earlier
-    // revisions; the spec asks modern-only servers to answer 405.
+    // revisions; this stateless transport answers 405 instead.
     return json(405, { error: "POST JSON-RPC messages to this endpoint (MCP " + SUPPORTED_PROTOCOL_VERSIONS[0] + ", stateless)." }, { Allow: "POST, OPTIONS" });
   }
 
@@ -450,16 +467,15 @@ async function authorizedHttp(request: Request, authorizer: ReturnType<typeof cr
   }
   const parsed = asJsonRpc(incoming);
   if (isRpcOutcome(parsed)) return json(parsed.status, parsed.message);
-  // Header/body agreement is checked for requests; the spec defines no
-  // header requirements for notification POSTs.
-  if (parsed.id !== undefined && parsed.id !== null && parsed.method !== "initialize") {
+  // Validate the selected wire revision before dispatching a request.
+  if (parsed.id !== undefined && parsed.id !== null) {
     const mismatch = checkRequestHeaders(request.headers, parsed);
     if (mismatch) return json(mismatch.status, mismatch.message);
   }
   noteClientInfo(parsed);
   let outcome: RpcOutcome;
   try {
-    outcome = await handleRpc(serverFor(remote), parsed);
+    outcome = await handleRpc(serverFor(remote), parsed, request.headers.get("mcp-protocol-version"));
   } catch (e) {
     return json(500, { jsonrpc: "2.0", id: parsed.id ?? null, error: { code: -32603, message: "Internal error" } });
   }
@@ -510,6 +526,7 @@ async function startStdio(): Promise<void> {
   const rl = createInterface({ input: process.stdin });
   const write = (message: Record<string, unknown>) => process.stdout.write(JSON.stringify(message) + "\n");
   const server = serverFor();
+  const dispatch = createStdioRpcHandler(server);
   rl.on("line", (line) => {
     const trimmed = line.trim();
     if (trimmed === "") return;
@@ -522,7 +539,7 @@ async function startStdio(): Promise<void> {
     }
     const id = incoming !== null && typeof incoming === "object" && !Array.isArray(incoming) ? (incoming as { id?: unknown }).id : undefined;
     noteClientInfo(incoming);
-    void handleRpc(server, incoming)
+    void dispatch(incoming)
       .then((outcome) => {
         if (outcome.message === null) return;
         // A cancelled request gets no response (spec: MUST NOT send further messages).