SDK v2 migration (behavior-neutral, versionNegotiation: 'legacy') (#1624)

Migrate all three clients + core + test-servers from
@modelcontextprotocol/sdk@1.29 to SDK v2 (2.0.0-beta.4), keeping behavior
identical against legacy (2025-11-25) servers. Foundation for the SDK V2 +
New Spec stack.

Packages
- Split @modelcontextprotocol/sdk -> @modelcontextprotocol/client (Client,
  transports, OAuth, error taxonomy, protocol types) + core (Zod schemas);
  stdio -> client/stdio, Ajv -> client/validators/ajv. Test-servers ->
  @modelcontextprotocol/server (+ server-legacy/sse). Deterministic import
  rewrite (schemas -> core, everything else -> client); the codemod misroutes
  client code to /server so it was not used for path routing.
- new Client(..., { versionNegotiation: { mode: 'legacy' } }) — nothing
  2026-era goes on the wire.

Runtime (core/mcp/inspectorClient.ts)
- Error taxonomy: McpError -> ProtocolError, ErrorCode -> ProtocolErrorCode;
  RequestTimeout -> SdkError/SdkErrorCode.
- Handlers take method strings; task methods (tasks/*, notifications/tasks/*)
  use the 3-arg custom form (excluded from v2's spec-method set).
- Legacy tasks kept working (per project requirement): requestor tasks re-
  implemented over raw client.request + explicit deprecated schemas;
  experimental.tasks.callToolStream replaced by a local pollTaskToolCall
  async generator (with _progressHandlers revival so task-execution progress
  still reaches the caller). Receiver (server-initiated) tasks: the v2 Client
  validates a sampling/elicit handler result and rejects the legacy { task }
  response with -32602 — installReceiverTaskResponseBypass swaps the wrapped
  entry in the private _requestHandlers map for the task-augmented branch so
  { task } reaches the wire (fixes server-initiated sampling-via-task).
- Pagination: list verbs use raw client.request({method}, List*ResultSchema)
  for single-page behavior (v2's client.listX() auto-aggregate all pages).

Web / auth / apps
- Rename local JsonSchemaType -> InspectorFormSchema + add toFormSchema()
  structural narrowing at the SDK-schema -> form boundary.
- ext-apps still peers on SDK v1: one compat boundary with documented casts
  (remove when ext-apps#702 lands a v2 peer).
- OAuth provider saveClientInformation reconciled with v2's
  OAuthClientInformationContext; InvalidClientMetadataError re-homed as a
  local class (server-legacy/auth is not browser-safe).
- vitest.shared.mts dedupes @modelcontextprotocol/client+core to one copy so
  vi.mock intercepts the SUT's import.

Accepted v2 behavior changes (per #1624 / spec §9.2): unknown-tool call
rejects with -32602; cancellation is stream-abort (no guaranteed
notifications/cancelled frame); output-schema strictness restored via the
Inspector's own Ajv check on the default path.

npm run ci green: validate (web 3087 / cli 212 / tui 274 / launcher 5),
coverage (>=90 per-file, all clients), smoke (launcher/cli/web), storybook
(410).

Closes #1624

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

test-servers/src/test-server-oauth.ts

@@ -152,7 +152,10 @@ function setupMetadataEndpoints(
         const requestBaseUrl = `${req.protocol}://${req.get("host")}`;
         const actualIssuerUrl = config.issuerUrl ?? new URL(requestBaseUrl);
         const metadata = {
-          issuer: actualIssuerUrl.href.replace(/\/$/, "") + "/",
+          // RFC 8414 §3.3: the issuer MUST be identical to the base URL the
+          // well-known path was appended to — i.e. no trailing slash. SDK v2's
+          // client enforces this exactly (IssuerMismatchError otherwise).
+          issuer: actualIssuerUrl.href.replace(/\/$/, ""),
           authorization_endpoint: new URL("/oauth/authorize", actualIssuerUrl)
             .href,
           token_endpoint: new URL("/oauth/token", actualIssuerUrl).href,
@@ -160,7 +163,10 @@ function setupMetadataEndpoints(
           response_types_supported: ["code"],
           grant_types_supported: ["authorization_code", "refresh_token"],
           code_challenge_methods_supported: ["S256"],
-          token_endpoint_auth_methods_supported: ["client_secret_basic", "none"],
+          token_endpoint_auth_methods_supported: [
+            "client_secret_basic",
+            "none",
+          ],
           ...(config.supportDCR && {
             registration_endpoint: new URL("/oauth/register", actualIssuerUrl)
               .href,
@@ -180,12 +186,10 @@ function setupMetadataEndpoints(
     "/.well-known/oauth-protected-resource",
     (req: Request, res: Response) => {
       const requestBaseUrl = `${req.protocol}://${req.get("host")}`;
-      const resourceUrl =
-        config.resource ?? new URL("/", requestBaseUrl).href;
-      const localAsUrl = (config.issuerUrl ?? new URL(requestBaseUrl)).href.replace(
-        /\/$/,
-        "",
-      );
+      const resourceUrl = config.resource ?? new URL("/", requestBaseUrl).href;
+      const localAsUrl = (
+        config.issuerUrl ?? new URL(requestBaseUrl)
+      ).href.replace(/\/$/, "");
       const authorizationServers =
         mode === "protected-resource"
           ? (config.authorizationServers ?? [])
@@ -278,7 +282,11 @@ async function parseAuthorizationRequest(
   }
 
   if (response_type !== "code") {
-    return { ok: false, status: 400, body: { error: "unsupported_response_type" } };
+    return {
+      ok: false,
+      status: 400,
+      body: { error: "unsupported_response_type" },
+    };
   }
 
   const client = await findClient(client_id, config);
@@ -286,10 +294,7 @@ async function parseAuthorizationRequest(
     return { ok: false, status: 400, body: { error: "invalid_client" } };
   }
 
-  if (
-    client.redirectUris &&
-    !client.redirectUris.includes(redirect_uri)
-  ) {
+  if (client.redirectUris && !client.redirectUris.includes(redirect_uri)) {
     return {
       ok: false,
       status: 400,
@@ -874,7 +879,10 @@ export function buildScopeRequirementRegistry(
   }
   for (const template of config.resourceTemplates ?? []) {
     if (template.requiredScopes?.length) {
-      registry.resourceTemplates.set(template.uriTemplate, template.requiredScopes);
+      registry.resourceTemplates.set(
+        template.uriTemplate,
+        template.requiredScopes,
+      );
     }
   }
 
@@ -967,14 +975,15 @@ export function createScopeCheckMiddleware(
       return next();
     }
 
-    const granted =
-      oauthReq.oauthTokenScopes ?? getAccessTokenScopes(token);
+    const granted = oauthReq.oauthTokenScopes ?? getAccessTokenScopes(token);
     if (tokenHasRequiredScopes(granted, requiredScopes)) {
       return next();
     }
 
     const grantedSet = new Set(granted);
-    const missingScopes = requiredScopes.filter((scope) => !grantedSet.has(scope));
+    const missingScopes = requiredScopes.filter(
+      (scope) => !grantedSet.has(scope),
+    );
     const scopeHeader = missingScopes.join(" ") || requiredScopes.join(" ");
     res.status(403);
     res.setHeader("Content-Type", "application/json");