macp-sdk-typescript 0.6.0 → 0.7.1

package/CHANGELOG.md

@@ -4,6 +4,29 @@ All notable changes to `macp-sdk-typescript` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the
 project uses [Semantic Versioning](https://semver.org/).
 
+## [0.7.1](https://github.com/multiagentcoordinationprotocol/macp-sdk-typescript/compare/v0.7.0...v0.7.1) (2026-08-31)
+
+
+### Bug Fixes
+
+* validate explicit empty-string sessionId, and freeze the commitment field set ([#52](https://github.com/multiagentcoordinationprotocol/macp-sdk-typescript/issues/52)) ([5e4dc25](https://github.com/multiagentcoordinationprotocol/macp-sdk-typescript/commit/5e4dc25389d948570afbd9653cfd52bc12e97150)), closes [#47](https://github.com/multiagentcoordinationprotocol/macp-sdk-typescript/issues/47) [#48](https://github.com/multiagentcoordinationprotocol/macp-sdk-typescript/issues/48)
+
+## [0.7.0](https://github.com/multiagentcoordinationprotocol/macp-sdk-typescript/compare/v0.6.0...v0.7.0) (2026-08-30)
+
+
+### ⚠ BREAKING CHANGES
+
+* RFC-MACP-0013 canonical commitment hash ([#45](https://github.com/multiagentcoordinationprotocol/macp-sdk-typescript/issues/45))
+
+### Features
+
+* RFC-MACP-0013 canonical commitment hash ([#45](https://github.com/multiagentcoordinationprotocol/macp-sdk-typescript/issues/45)) ([2af3c51](https://github.com/multiagentcoordinationprotocol/macp-sdk-typescript/commit/2af3c5156e5831a4d2767175fd8f3154e34ec1af))
+
+
+### Bug Fixes
+
+* reject non-object supersedes instead of silently dropping it ([#49](https://github.com/multiagentcoordinationprotocol/macp-sdk-typescript/issues/49)) ([b4a68e3](https://github.com/multiagentcoordinationprotocol/macp-sdk-typescript/commit/b4a68e3f6059d968dabc3f6b43c5e8033fb4957c))
+
 ## [0.6.0](https://github.com/multiagentcoordinationprotocol/macp-sdk-typescript/compare/v0.5.0...v0.6.0) (2026-07-10)
 
 

package/dist/base-session.js

@@ -26,7 +26,7 @@ class BaseSession {
     projection;
     constructor(client, options = {}) {
         this.client = client;
-        if (options.sessionId)
+        if (options.sessionId !== undefined)
             (0, validation_1.validateSessionId)(options.sessionId);
         this.sessionId = options.sessionId ?? (0, envelope_1.newSessionId)();
         this.modeVersion = options.modeVersion ?? constants_1.DEFAULT_MODE_VERSION;

package/dist/commitment-hash.d.ts

@@ -0,0 +1,41 @@
+import type { CommitmentPayload } from './types';
+/**
+ * Projects a `CommitmentPayload` (this SDK's camelCase shape) to its RFC
+ * 8785 canonical JSON string (snake_case, D2.1) and serializes it directly
+ * — no intermediate object graph — in the fixed member order below.
+ *
+ * Member order is RFC 8785 §3.2.3: object members sorted lexicographically
+ * by UTF-16 code unit on the member name. Every member name here is ASCII
+ * and the field set is frozen (it mirrors `CommitmentPayload`, a stable
+ * wire type), so this order is hard-coded rather than sorted at runtime:
+ * action, authority_scope, commitment_id, configuration_version,
+ * mode_version, outcome_positive, policy_version, reason, then supersedes
+ * last (only when present). Do not "simplify" this to `.localeCompare()` —
+ * that is locale-sensitive and not equivalent to code-unit ordering; it is
+ * moot only because the names above are already in the right order.
+ *
+ * `supersedes` is omitted entirely when `payload.supersedes === undefined`
+ * (D2.3) — including when the payload itself is missing/malformed, `payload
+ * ?? {}` never manufactures a `supersedes` key. An explicit
+ * `supersedes: { sessionId: '', commitmentHash: '' }` is NOT collapsed into
+ * omission; it is present with two empty-string members, `commitment_hash`
+ * before `session_id` (also alphabetical).
+ *
+ * Exported separately from `commitmentHash` so a vector-runner test can
+ * localize a mismatch to projection/JCS (compare this string) vs. digest
+ * (compare the final `sha256:` hash).
+ */
+export declare function canonicalizeCommitmentPayload(payload: CommitmentPayload): string;
+/**
+ * Computes the RFC-MACP-0013 canonical commitment hash for `payload`:
+ * `sha256:` followed by 64 lowercase hex digits of
+ * `SHA-256(LABEL + ':' + JCS(project(payload)))`.
+ *
+ * Never throws (D3), for any input — well-formed or not. Every step that
+ * could plausibly throw on malformed input (unknown-typed field reads,
+ * string iteration, control-character formatting) is guarded in
+ * `canonicalizeCommitmentPayload` / `jcsString` / `jcsBoolean` instead of
+ * being caught here, so a genuine bug in this file shows up as a test
+ * failure rather than being silently swallowed by a catch-all.
+ */
+export declare function commitmentHash(payload: CommitmentPayload): string;

package/dist/commitment-hash.js

@@ -0,0 +1,198 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.canonicalizeCommitmentPayload = canonicalizeCommitmentPayload;
+exports.commitmentHash = commitmentHash;
+/**
+ * RFC-MACP-0013 canonical commitment hashing.
+ *
+ * Computes a deterministic content hash for a `CommitmentPayload` by
+ * projecting it to a frozen snake_case shape, serializing that shape with a
+ * hand-written subset of RFC 8785 (JSON Canonicalization Scheme, "JCS"), and
+ * hashing the labeled preimage with SHA-256.
+ *
+ * Dependency decision (deliberate, not an oversight): this module does NOT
+ * depend on a JCS library. RFC 8785's hardest requirement — canonical
+ * ECMAScript float formatting for JSON numbers — is unreachable here: the
+ * `CommitmentPayload` projection below is a frozen 9-field shape containing
+ * only strings, one boolean, and one optional 2-string nested object. No
+ * JSON numbers, no JSON arrays. That leaves only object-member ordering and
+ * string escaping, both of which are small enough to hand-write and test
+ * directly rather than pull in this SDK's first non-gRPC/proto runtime
+ * dependency. `node:crypto` is a Node builtin, not a dependency.
+ */
+const node_crypto_1 = require("node:crypto");
+/**
+ * Domain-separation label mixed into the hash preimage (RFC-MACP-0013 §4).
+ * Changing this string changes every hash this module produces — that is a
+ * protocol MINOR version bump, not a routine edit.
+ */
+const LABEL = 'macp-commitment-hash/1';
+/**
+ * Escapes a single JSON string value per RFC 8785 §3.2.2.2:
+ *   - short-form escapes for backspace/tab/newline/formfeed/carriage-return,
+ *     `"`, and `\`
+ *   - `\u00xx` (lowercase hex) for other C0 control characters (0x00-0x1F)
+ *   - every other character, including non-ASCII and astral-plane
+ *     codepoints, is emitted literally (NOT escaped).
+ *
+ * Lone surrogates: a bare UTF-16 surrogate code unit not paired into a valid
+ * codepoint is out-of-contract input for this function — a `CommitmentPayload`
+ * should never legitimately contain one, since this SDK's strings originate
+ * from valid UTF-16 sources (JS string literals, JSON-decoded wire payloads,
+ * etc.). If one appears anyway, this function does not detect or escape it
+ * specially: `for (const ch of str)` below yields it as its own one-code-unit
+ * step and it is emitted literally, unescaped, like any other character. The
+ * actual loss happens one step later, in `commitmentHash`, when the finished
+ * JCS string is encoded to bytes via `Buffer.from(preimage, 'utf8')` — Node's
+ * standard lossy UTF-8 encoder silently substitutes a lone surrogate with
+ * U+FFFD (the Unicode replacement character) before hashing. The observable
+ * consequence: a field containing a lone surrogate (e.g. `'\uD800'`) hashes
+ * IDENTICALLY to the same field containing a literal U+FFFD in that position
+ * — pinned by the "lone surrogate" test in commitment-hash.test.ts. This is
+ * an accepted consequence of D3 (never throw on malformed input), not a
+ * claimed point of compatibility (or divergence) with any other
+ * implementation of RFC-MACP-0013.
+ *
+ * `value` is typed `unknown`, not `string`, on purpose: this function is the
+ * single choke point that keeps `commitmentHash` from ever throwing (D3) —
+ * every field of a `CommitmentPayload` flows through here, and at runtime a
+ * decoded or hand-built payload is not guaranteed to actually match its
+ * static type. Non-string input is coerced via `String()` (never a template
+ * literal or `+`, both of which throw on a bare `Symbol`) rather than
+ * rejected — this file does not "fix" a malformed payload into a valid one,
+ * it only guarantees serialization cannot crash.
+ *
+ * Iterates with `for (const ch of str)`, which walks Unicode codepoints, not
+ * UTF-16 code units. Indexing by code unit would split an astral-plane
+ * codepoint's surrogate pair (e.g. U+1F702) and emit half of it — iterating
+ * by codepoint is what keeps a full character, including a surrogate pair,
+ * together as a single loop step so it can be appended whole.
+ */
+function jcsString(value) {
+    const str = typeof value === 'string' ? value : String(value ?? '');
+    let out = '"';
+    for (const ch of str) {
+        switch (ch) {
+            case '"':
+                out += '\\"';
+                break;
+            case '\\':
+                out += '\\\\';
+                break;
+            case '\b':
+                out += '\\b';
+                break;
+            case '\t':
+                out += '\\t';
+                break;
+            case '\n':
+                out += '\\n';
+                break;
+            case '\f':
+                out += '\\f';
+                break;
+            case '\r':
+                out += '\\r';
+                break;
+            default: {
+                // Non-null assertion is safe: `for (const ch of str)` always yields
+                // a non-empty code-point substring, so `codePointAt(0)` can never
+                // actually be `undefined` here — a `?? 0` fallback would be dead
+                // code that misleadingly reads as if codepoints can be absent.
+                const code = ch.codePointAt(0);
+                if (code < 0x20) {
+                    // Other C0 control character with no short form (e.g. U+0000).
+                    out += '\\u' + code.toString(16).padStart(4, '0');
+                }
+                else {
+                    // Printable ASCII, non-ASCII, and astral-plane codepoints alike:
+                    // JCS emits these as literal UTF-8, never escaped.
+                    out += ch;
+                }
+            }
+        }
+    }
+    return out + '"';
+}
+/**
+ * Emits `value` as a JCS boolean literal. `??` (not `||`) materializes an
+ * absent `outcomePositive` as `false` rather than omitting the key (D2.2) —
+ * `||` would also fold an explicit falsy-but-not-nullish value incorrectly
+ * for fields added in the future, so `??` documents the intent even though
+ * `boolean` only has two values today. A non-boolean value (possible only
+ * for a malformed/untyped payload at runtime) is coerced via a truthy check
+ * rather than thrown on, keeping D3 intact.
+ */
+function jcsBoolean(value) {
+    return (value ?? false) ? 'true' : 'false';
+}
+/**
+ * Projects a `CommitmentPayload` (this SDK's camelCase shape) to its RFC
+ * 8785 canonical JSON string (snake_case, D2.1) and serializes it directly
+ * — no intermediate object graph — in the fixed member order below.
+ *
+ * Member order is RFC 8785 §3.2.3: object members sorted lexicographically
+ * by UTF-16 code unit on the member name. Every member name here is ASCII
+ * and the field set is frozen (it mirrors `CommitmentPayload`, a stable
+ * wire type), so this order is hard-coded rather than sorted at runtime:
+ * action, authority_scope, commitment_id, configuration_version,
+ * mode_version, outcome_positive, policy_version, reason, then supersedes
+ * last (only when present). Do not "simplify" this to `.localeCompare()` —
+ * that is locale-sensitive and not equivalent to code-unit ordering; it is
+ * moot only because the names above are already in the right order.
+ *
+ * `supersedes` is omitted entirely when `payload.supersedes === undefined`
+ * (D2.3) — including when the payload itself is missing/malformed, `payload
+ * ?? {}` never manufactures a `supersedes` key. An explicit
+ * `supersedes: { sessionId: '', commitmentHash: '' }` is NOT collapsed into
+ * omission; it is present with two empty-string members, `commitment_hash`
+ * before `session_id` (also alphabetical).
+ *
+ * Exported separately from `commitmentHash` so a vector-runner test can
+ * localize a mismatch to projection/JCS (compare this string) vs. digest
+ * (compare the final `sha256:` hash).
+ */
+function canonicalizeCommitmentPayload(payload) {
+    // D3: a malformed/absent payload must not throw. `{}` lets every field
+    // read below fall through to `jcsString`'s/`jcsBoolean`'s own defensive
+    // coercion instead of dereferencing a null/undefined payload.
+    const p = payload ?? {};
+    const members = [
+        `"action":${jcsString(p.action)}`,
+        `"authority_scope":${jcsString(p.authorityScope)}`,
+        `"commitment_id":${jcsString(p.commitmentId)}`,
+        `"configuration_version":${jcsString(p.configurationVersion)}`,
+        `"mode_version":${jcsString(p.modeVersion)}`,
+        `"outcome_positive":${jcsBoolean(p.outcomePositive)}`,
+        `"policy_version":${jcsString(p.policyVersion ?? '')}`,
+        `"reason":${jcsString(p.reason)}`,
+    ];
+    if (p.supersedes !== undefined) {
+        // Optional chaining tolerates `supersedes` being present but not
+        // actually an object (null, a primitive, ...) on a malformed payload —
+        // it never throws, it just yields `undefined` for the sub-fields, which
+        // `jcsString` then coerces to `""` the same way it handles any other
+        // missing string field.
+        const sup = p.supersedes;
+        members.push(`"supersedes":{"commitment_hash":${jcsString(sup?.commitmentHash)},"session_id":${jcsString(sup?.sessionId)}}`);
+    }
+    return `{${members.join(',')}}`;
+}
+/**
+ * Computes the RFC-MACP-0013 canonical commitment hash for `payload`:
+ * `sha256:` followed by 64 lowercase hex digits of
+ * `SHA-256(LABEL + ':' + JCS(project(payload)))`.
+ *
+ * Never throws (D3), for any input — well-formed or not. Every step that
+ * could plausibly throw on malformed input (unknown-typed field reads,
+ * string iteration, control-character formatting) is guarded in
+ * `canonicalizeCommitmentPayload` / `jcsString` / `jcsBoolean` instead of
+ * being caught here, so a genuine bug in this file shows up as a test
+ * failure rather than being silently swallowed by a catch-all.
+ */
+function commitmentHash(payload) {
+    const jcs = canonicalizeCommitmentPayload(payload);
+    const preimage = `${LABEL}:${jcs}`;
+    const digest = (0, node_crypto_1.createHash)('sha256').update(Buffer.from(preimage, 'utf8')).digest('hex');
+    return `sha256:${digest}`;
+}

package/dist/decision.js

@@ -16,7 +16,7 @@ class DecisionSession {
     projection = new projections_1.DecisionProjection();
     constructor(client, options = {}) {
         this.client = client;
-        if (options.sessionId)
+        if (options.sessionId !== undefined)
             (0, validation_1.validateSessionId)(options.sessionId);
         this.sessionId = options.sessionId ?? (0, envelope_1.newSessionId)();
         this.modeVersion = options.modeVersion ?? constants_1.DEFAULT_MODE_VERSION;

package/dist/envelope.d.ts

@@ -24,7 +24,10 @@ export declare function inferOutcomePositive(action: string): boolean;
 /**
  * Build a {@link CommitmentRef} pointing at a prior accepted commitment, for
  * use as `buildCommitmentPayload({ supersedes })` (cross-session supersession,
- * RFC-MACP-0001 §7.3). Parity with python-sdk `build_commitment_ref`.
+ * RFC-MACP-0001 §7.3). Use `commitmentHash()` (from `./commitment-hash`) to
+ * produce a valid `commitmentHash` value — this function validates the hash
+ * shape (`sha256:<64 lowercase hex>`) and throws `MacpSessionError` if it
+ * doesn't match. Parity with python-sdk `build_commitment_ref`.
  */
 export declare function buildCommitmentRef(input: {
     sessionId: string;
@@ -56,7 +59,11 @@ export declare function buildCommitmentPayload(input: {
     /**
      * Cross-session supersession (RFC-MACP-0001 §7.3): reference to the prior
      * commitment this one supersedes. Distinct from proposal-mode
-     * `supersedesProposalId`. Absent by default. Backward-compatible.
+     * `supersedesProposalId`. Absent by default. Backward-compatible. A
+     * non-`undefined` value that isn't a `CommitmentRef` object (e.g. `null`,
+     * from a caller bypassing the type system) throws `MacpSessionError`
+     * rather than being silently dropped — see RFC-MACP-0013 reconcile,
+     * 2026-08-30.
      */
     supersedes?: CommitmentRef;
 }): CommitmentPayload;

package/dist/envelope.js

@@ -16,6 +16,8 @@ exports.toProtoPayload = toProtoPayload;
 exports.buildEnvelope = buildEnvelope;
 const node_crypto_1 = require("node:crypto");
 const constants_1 = require("./constants");
+const errors_1 = require("./errors");
+const validation_1 = require("./validation");
 function newSessionId() {
     return (0, node_crypto_1.randomUUID)();
 }
@@ -52,9 +54,13 @@ function inferOutcomePositive(action) {
 /**
  * Build a {@link CommitmentRef} pointing at a prior accepted commitment, for
  * use as `buildCommitmentPayload({ supersedes })` (cross-session supersession,
- * RFC-MACP-0001 §7.3). Parity with python-sdk `build_commitment_ref`.
+ * RFC-MACP-0001 §7.3). Use `commitmentHash()` (from `./commitment-hash`) to
+ * produce a valid `commitmentHash` value — this function validates the hash
+ * shape (`sha256:<64 lowercase hex>`) and throws `MacpSessionError` if it
+ * doesn't match. Parity with python-sdk `build_commitment_ref`.
  */
 function buildCommitmentRef(input) {
+    (0, validation_1.validateCommitmentHash)(input.commitmentHash);
     return { sessionId: input.sessionId, commitmentHash: input.commitmentHash };
 }
 /**
@@ -82,8 +88,16 @@ function buildCommitmentPayload(input) {
         policyVersion: input.policyVersion ?? constants_1.DEFAULT_POLICY_VERSION,
         outcomePositive: input.outcomePositive ?? inferOutcomePositive(input.action),
     };
-    if (input.supersedes)
+    if (input.supersedes !== undefined) {
+        if (typeof input.supersedes !== 'object' || input.supersedes === null) {
+            // `String()`, not `JSON.stringify()`: the latter throws on a bigint,
+            // which would replace this deliberate `MacpSessionError` with an
+            // unrelated `TypeError` for that one input shape.
+            throw new errors_1.MacpSessionError(`supersedes must be a CommitmentRef object, got: ${String(input.supersedes)}`);
+        }
+        (0, validation_1.validateCommitmentHash)(input.supersedes.commitmentHash);
         payload.supersedes = input.supersedes;
+    }
     return payload;
 }
 function buildRoot(uri, name = '') {

package/dist/handoff.js

@@ -16,7 +16,7 @@ class HandoffSession {
     projection = new handoff_1.HandoffProjection();
     constructor(client, options = {}) {
         this.client = client;
-        if (options.sessionId)
+        if (options.sessionId !== undefined)
             (0, validation_1.validateSessionId)(options.sessionId);
         this.sessionId = options.sessionId ?? (0, envelope_1.newSessionId)();
         this.modeVersion = options.modeVersion ?? constants_1.DEFAULT_MODE_VERSION;

package/dist/index.d.ts

@@ -1,6 +1,7 @@
 export { Auth, type AuthConfig, type BearerAuthOptions } from './auth';
 export * from './base-session';
 export * from './client';
+export { commitmentHash } from './commitment-hash';
 export * from './constants';
 export * from './decision';
 export * from './envelope';

package/dist/index.js

@@ -36,7 +36,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.agent = exports.VERSION = exports.Auth = void 0;
+exports.agent = exports.VERSION = exports.commitmentHash = exports.Auth = void 0;
 // Auth: export only the public constructors and types. The helpers
 // `validateAuth`, `authSender`, `assertSenderMatchesIdentity`, and
 // `metadataFromAuth` are SDK-internal — importable from the `./auth`
@@ -46,6 +46,13 @@ var auth_1 = require("./auth");
 Object.defineProperty(exports, "Auth", { enumerable: true, get: function () { return auth_1.Auth; } });
 __exportStar(require("./base-session"), exports);
 __exportStar(require("./client"), exports);
+// Commitment hash: export only `commitmentHash`. `canonicalizeCommitmentPayload`
+// is the projection/JCS half of the algorithm — importable from the
+// `./commitment-hash` submodule (as the vector-runner tests do) but kept off
+// the top-level surface to match python-sdk's public API, which does not
+// expose its `canonical_projection` equivalent either.
+var commitment_hash_1 = require("./commitment-hash");
+Object.defineProperty(exports, "commitmentHash", { enumerable: true, get: function () { return commitment_hash_1.commitmentHash; } });
 __exportStar(require("./constants"), exports);
 __exportStar(require("./decision"), exports);
 __exportStar(require("./envelope"), exports);

package/dist/proposal.js

@@ -16,7 +16,7 @@ class ProposalSession {
     projection = new proposal_1.ProposalProjection();
     constructor(client, options = {}) {
         this.client = client;
-        if (options.sessionId)
+        if (options.sessionId !== undefined)
             (0, validation_1.validateSessionId)(options.sessionId);
         this.sessionId = options.sessionId ?? (0, envelope_1.newSessionId)();
         this.modeVersion = options.modeVersion ?? constants_1.DEFAULT_MODE_VERSION;

package/dist/quorum.js

@@ -16,7 +16,7 @@ class QuorumSession {
     projection = new quorum_1.QuorumProjection();
     constructor(client, options = {}) {
         this.client = client;
-        if (options.sessionId)
+        if (options.sessionId !== undefined)
             (0, validation_1.validateSessionId)(options.sessionId);
         this.sessionId = options.sessionId ?? (0, envelope_1.newSessionId)();
         this.modeVersion = options.modeVersion ?? constants_1.DEFAULT_MODE_VERSION;

package/dist/task.js

@@ -16,7 +16,7 @@ class TaskSession {
     projection = new task_1.TaskProjection();
     constructor(client, options = {}) {
         this.client = client;
-        if (options.sessionId)
+        if (options.sessionId !== undefined)
             (0, validation_1.validateSessionId)(options.sessionId);
         this.sessionId = options.sessionId ?? (0, envelope_1.newSessionId)();
         this.modeVersion = options.modeVersion ?? constants_1.DEFAULT_MODE_VERSION;

package/dist/validation.d.ts

@@ -9,6 +9,7 @@ export declare function validateTtlMs(ttlMs: number): void;
 export declare function validateMaxSuspendMs(maxSuspendMs: number): void;
 export declare function validateParticipants(participants: string[]): void;
 export declare function validateRequiredField(fieldName: string, value: string): void;
+export declare function validateCommitmentHash(value: string, field?: string): void;
 export declare function validateSessionStart(input: {
     intent: string;
     participants: string[];

package/dist/validation.js

@@ -11,6 +11,7 @@ exports.validateTtlMs = validateTtlMs;
 exports.validateMaxSuspendMs = validateMaxSuspendMs;
 exports.validateParticipants = validateParticipants;
 exports.validateRequiredField = validateRequiredField;
+exports.validateCommitmentHash = validateCommitmentHash;
 exports.validateSessionStart = validateSessionStart;
 const errors_1 = require("./errors");
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
@@ -91,6 +92,12 @@ function validateRequiredField(fieldName, value) {
         throw new errors_1.MacpSessionError(`${fieldName} must be non-empty`);
     }
 }
+const COMMITMENT_HASH_RE = /^sha256:[0-9a-f]{64}$/;
+function validateCommitmentHash(value, field = 'commitmentHash') {
+    if (!COMMITMENT_HASH_RE.test(value)) {
+        throw new errors_1.MacpSessionError(`${field} must be 'sha256:' followed by 64 lowercase hex characters, got: ${value}`);
+    }
+}
 function validateSessionStart(input) {
     validateRequiredField('intent', input.intent);
     validateParticipants(input.participants);

package/dist/version.d.ts

@@ -4,4 +4,4 @@
  * Kept in sync with package.json by release-please (see the
  * `x-release-please-version` annotation).
  */
-export declare const VERSION = "0.6.0";
+export declare const VERSION = "0.7.1";

package/dist/version.js

@@ -7,4 +7,4 @@ exports.VERSION = void 0;
  * Kept in sync with package.json by release-please (see the
  * `x-release-please-version` annotation).
  */
-exports.VERSION = '0.6.0'; // x-release-please-version
+exports.VERSION = '0.7.1'; // x-release-please-version

package/dist/watchers.js

@@ -96,6 +96,14 @@ function serverStreamToAsyncGenerator(stream) {
             stream.cancel();
             throw err;
         },
+        // Required since TypeScript 6 / @types/node 26, which make `AsyncGenerator`
+        // extend `AsyncDisposable` (lib.esnext.disposable). Native `async function*`
+        // generators get this for free; this hand-rolled one has to declare it. It
+        // also makes every watcher stream usable with `await using`, which cancels
+        // the underlying gRPC stream on scope exit exactly like `return()` does.
+        async [Symbol.asyncDispose]() {
+            stream.cancel();
+        },
     };
 }
 class ModeRegistryWatcher {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "macp-sdk-typescript",
-  "version": "0.6.0",
+  "version": "0.7.1",
   "description": "TypeScript SDK for the MACP Rust runtime",
   "license": "Apache-2.0",
   "type": "commonjs",
@@ -59,14 +59,14 @@
     "protobufjs": "^8.6.5"
   },
   "devDependencies": {
-    "@types/node": "^22.14.0",
-    "@typescript-eslint/eslint-plugin": "^8.0.0",
-    "@typescript-eslint/parser": "^8.0.0",
-    "@vitest/coverage-v8": "^3.0.0",
-    "eslint": "^9.0.0",
+    "@types/node": "^26.4.0",
+    "@typescript-eslint/eslint-plugin": "^8.68.0",
+    "@typescript-eslint/parser": "^8.68.0",
+    "@vitest/coverage-v8": "^4.1.11",
+    "eslint": "^10.9.1",
     "prettier": "^3.0.0",
     "tsx": "^4.21.0",
-    "typescript": "^5.8.3",
-    "vitest": "^3.0.0"
+    "typescript": "^6.0.3",
+    "vitest": "^4.1.11"
   }
 }