SDK v2 migration (behavior-neutral, versionNegotiation: 'legacy') (#1624)

Migrate all three clients + core + test-servers from
@modelcontextprotocol/sdk@1.29 to SDK v2 (2.0.0-beta.4), keeping behavior
identical against legacy (2025-11-25) servers. Foundation for the SDK V2 +
New Spec stack.

Packages
- Split @modelcontextprotocol/sdk -> @modelcontextprotocol/client (Client,
  transports, OAuth, error taxonomy, protocol types) + core (Zod schemas);
  stdio -> client/stdio, Ajv -> client/validators/ajv. Test-servers ->
  @modelcontextprotocol/server (+ server-legacy/sse). Deterministic import
  rewrite (schemas -> core, everything else -> client); the codemod misroutes
  client code to /server so it was not used for path routing.
- new Client(..., { versionNegotiation: { mode: 'legacy' } }) — nothing
  2026-era goes on the wire.

Runtime (core/mcp/inspectorClient.ts)
- Error taxonomy: McpError -> ProtocolError, ErrorCode -> ProtocolErrorCode;
  RequestTimeout -> SdkError/SdkErrorCode.
- Handlers take method strings; task methods (tasks/*, notifications/tasks/*)
  use the 3-arg custom form (excluded from v2's spec-method set).
- Legacy tasks kept working (per project requirement): requestor tasks re-
  implemented over raw client.request + explicit deprecated schemas;
  experimental.tasks.callToolStream replaced by a local pollTaskToolCall
  async generator (with _progressHandlers revival so task-execution progress
  still reaches the caller). Receiver (server-initiated) tasks: the v2 Client
  validates a sampling/elicit handler result and rejects the legacy { task }
  response with -32602 — installReceiverTaskResponseBypass swaps the wrapped
  entry in the private _requestHandlers map for the task-augmented branch so
  { task } reaches the wire (fixes server-initiated sampling-via-task).
- Pagination: list verbs use raw client.request({method}, List*ResultSchema)
  for single-page behavior (v2's client.listX() auto-aggregate all pages).

Web / auth / apps
- Rename local JsonSchemaType -> InspectorFormSchema + add toFormSchema()
  structural narrowing at the SDK-schema -> form boundary.
- ext-apps still peers on SDK v1: one compat boundary with documented casts
  (remove when ext-apps#702 lands a v2 peer).
- OAuth provider saveClientInformation reconciled with v2's
  OAuthClientInformationContext; InvalidClientMetadataError re-homed as a
  local class (server-legacy/auth is not browser-safe).
- vitest.shared.mts dedupes @modelcontextprotocol/client+core to one copy so
  vi.mock intercepts the SUT's import.

Accepted v2 behavior changes (per #1624 / spec §9.2): unknown-tool call
rejects with -32602; cancellation is stream-abort (no guaranteed
notifications/cancelled frame); output-schema strictness restored via the
Inspector's own Ajv check on the default path.

npm run ci green: validate (web 3087 / cli 212 / tui 274 / launcher 5),
coverage (>=90 per-file, all clients), smoke (launcher/cli/web), storybook
(410).

Closes #1624

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

clients/web/src/test/integration/mcp/inspectorClient.test.ts

@@ -63,16 +63,16 @@ import type {
   Task,
   Tool,
   Resource,
-  ResourceTemplate,
+  ResourceTemplateType as ResourceTemplate,
   Prompt,
   Progress,
   ContentBlock,
-} from "@modelcontextprotocol/sdk/types.js";
+} from "@modelcontextprotocol/client";
 import {
   RELATED_TASK_META_KEY,
-  McpError,
-  ErrorCode,
-} from "@modelcontextprotocol/sdk/types.js";
+  SdkError,
+  SdkErrorCode,
+} from "@modelcontextprotocol/client";
 
 /** Get all tools from the client via listTools() (paginates if needed). */
 async function getAllTools(client: InspectorClient): Promise<Tool[]> {
@@ -310,7 +310,7 @@ describe("InspectorClient", () => {
       };
       const fakeFactory = () => ({
         transport:
-          hangingTransport as unknown as import("@modelcontextprotocol/sdk/shared/transport.js").Transport,
+          hangingTransport as unknown as import("@modelcontextprotocol/client").Transport,
       });
       client = new InspectorClient(
         { type: "streamable-http", url: "http://localhost:1/never" },
@@ -358,7 +358,7 @@ describe("InspectorClient", () => {
       };
       const fakeFactory = () => ({
         transport:
-          unauthorizedTransport as unknown as import("@modelcontextprotocol/sdk/shared/transport.js").Transport,
+          unauthorizedTransport as unknown as import("@modelcontextprotocol/client").Transport,
       });
       client = new InspectorClient(
         { type: "streamable-http", url: "http://localhost:8081/mcp" },
@@ -967,20 +967,13 @@ describe("InspectorClient", () => {
     });
 
     it("should handle tool not found", async () => {
-      const result = await client!.callTool(
-        minimalTool("nonexistent-tool"),
-        {},
-      );
-      // When tool is not found, the SDK returns an error response, not an exception
-      expect(result.success).toBe(true); // SDK returns error in result, not as exception
-      expect(result.result).toHaveProperty("isError", true);
-      expect(result.result).toBeDefined();
-      if (result.result) {
-        expect(result.result).toHaveProperty("content");
-        const content = result.result.content as ContentBlock[];
-        expect(content[0]).toHaveProperty("text");
-        expect((content[0] as { text: string }).text).toContain("not found");
-      }
+      // SDK v2 change (#1624): an unknown-tool call now *rejects* with a
+      // ProtocolError (-32602) instead of resolving an `isError: true` result.
+      // callTool records the failed call and rethrows, so the caller sees a
+      // rejection whose message names the missing tool.
+      await expect(
+        client!.callTool(minimalTool("nonexistent-tool"), {}),
+      ).rejects.toThrow(/not found|unknown tool|nonexistent-tool/i);
     });
 
     it("cancelToolCall() is a no-op (returns false) when no call is in flight", () => {
@@ -994,13 +987,9 @@ describe("InspectorClient", () => {
       );
     });
 
-    it("cancelToolCall() aborts the in-flight call: sends notifications/cancelled, rejects with ToolCallCancelledError, and records no failed call", async () => {
+    it("cancelToolCall() aborts the in-flight call: rejects with ToolCallCancelledError, and records no failed call", async () => {
       const tool = await getTool(client!, "echo");
 
-      const messages: MessageEntry[] = [];
-      client!.addEventListener("message", (event) => {
-        messages.push(event.detail);
-      });
       let failedCallCount = 0;
       client!.addEventListener("toolCallResultChange", (event) => {
         if (!event.detail.success) failedCallCount++;
@@ -1013,14 +1002,14 @@ describe("InspectorClient", () => {
 
       await expect(promise).rejects.toBeInstanceOf(ToolCallCancelledError);
 
-      // The MCP cancellation flow: a notifications/cancelled reaches the server.
-      const cancelled = messages.find(
-        (m) =>
-          m.direction === "notification" &&
-          "method" in m.message &&
-          m.message.method === "notifications/cancelled",
-      );
-      expect(cancelled).toBeDefined();
+      // SDK v2 change (spec §9.2): cancellation now surfaces as a stream/connection
+      // abort rather than a guaranteed `notifications/cancelled` frame. v2's
+      // `callTool` awaits output-validator compilation before it issues the
+      // `tools/call` request, so a synchronous cancel aborts the shared signal
+      // *before* that request registers — the SDK then takes its pre-aborted
+      // early-reject path and emits no cancellation frame. The user-facing
+      // behavior we care about is unchanged: the call rejects with
+      // ToolCallCancelledError and is not recorded as a failed call.
 
       // Cancelling is intentional, so it is not recorded as a failed tool call.
       expect(failedCallCount).toBe(0);
@@ -2427,8 +2416,8 @@ describe("InspectorClient", () => {
       } catch (e) {
         err = e;
       }
-      expect(err).toBeInstanceOf(McpError);
-      expect((err as McpError).code).toBe(ErrorCode.RequestTimeout);
+      expect(err).toBeInstanceOf(SdkError);
+      expect((err as SdkError).code).toBe(SdkErrorCode.RequestTimeout);
 
       await client.disconnect();
       await server.stop();
@@ -2858,7 +2847,7 @@ describe("InspectorClient", () => {
           onerror: undefined,
           onmessage: undefined,
           sessionId: undefined,
-        } as unknown as import("@modelcontextprotocol/sdk/shared/transport.js").Transport,
+        } as unknown as import("@modelcontextprotocol/client").Transport,
       });
       client = new InspectorClient(
         { type: "streamable-http", url: "http://localhost:1/never" },
@@ -2896,7 +2885,7 @@ describe("InspectorClient", () => {
       };
       const factory = () => ({
         transport:
-          transport as unknown as import("@modelcontextprotocol/sdk/shared/transport.js").Transport,
+          transport as unknown as import("@modelcontextprotocol/client").Transport,
       });
       client = new InspectorClient(
         { type: "streamable-http", url: "http://localhost:1/never" },