feat: migrate pi-mcp-adapter to MCP SDK v2 beta.5

[mattzcarey]

Summary

Migrates pi-mcp-adapter's MCP client from the v1 @modelcontextprotocol/sdk API to exact-pinned @modelcontextprotocol/client@2.0.0-beta.5. Test fixtures and the interactive visualizer use @modelcontextprotocol/server@2.0.0-beta.5.

The branch is rebased onto current main, including the isolated programmatic config and per-adapter OAuth runtime work from #86.

Changes

• Replaces deep v1 imports with the split v2 client package and its /stdio and /validators/ajv exports.
• Moves request and notification handlers to v2 method-string registration and updates the callTool signature.
• Replaces v1 error classes with ProtocolError and SdkHttpError while preserving narrow stale-session recovery.
• Migrates the interactive visualizer and real stdio test fixtures to the v2 server package and zod v4 schemas.
• Removes the unused @modelcontextprotocol/node runtime dependency and exact-pins the beta packages.
• Enables SDK v2 automatic protocol negotiation and modern input_required fulfillment, while retaining byte-clean fallback to 2025-era servers.

OAuth

• Propagates RFC 9207 iss from both the localhost callback and pasted redirect URLs.
• Keeps a bare-code flow pending when the authorization server requires iss, so the user can paste the full redirect URL without restarting.
• Round-trips SEP-2352 issuer stamps and registration metadata without writing config-supplied client secrets to disk.
• Keeps callback discovery, state, and PKCE data isolated to each createMcpAdapter() OAuth runtime; callback discovery is cleared after token issuance so later PRM changes are rediscovered.
• Prevents a secretless pre-registered issuer stub from triggering an invalid_client refresh that clears valid credentials.
• Preserves expires_in: 0 as expired rather than converting it to a token with no expiry.
• Rejects late credential writes after a flow has been canceled or its runtime has stopped.

Conformance and CI

Adds an official MCP client conformance harness that drives the adapter's real McpServerManager, OAuth provider, auth flow, and localhost callback server.

npm run test:conformance runs all 26 scenarios from @modelcontextprotocol/conformance@0.1.16 sequentially to avoid false callback-port contention:

• 21 pass cleanly.
• 5 reviewed gaps are recorded in a fail-closed baseline: auth/basic-cimd, auth/scope-step-up, auth/2025-03-26-oauth-metadata-backcompat, auth/client-credentials-jwt, and auth/cross-app-access-complete-flow.
• Unexpected failures and stale baseline entries fail the run.

A new GitHub Actions workflow runs the same type, unit, OAuth, conformance, example-build, and package checks used locally.

Verification

• npm ci
• npx tsc --noEmit
• npm test: 70 files, 669 tests passing (including probe/live negotiation regressions)
• npm run test:oauth: 107 tests passing
• npm run test:conformance: 26 scenarios passing or matching the reviewed baseline
• npm run --prefix examples/interactive-visualizer build
• npm pack --dry-run: 50 runtime files

Live checker smoke test

Against https://mcp-checker.val.run/:

• /mcp and /auto/mcp negotiate 2026-07-28.
• /2026-07-28/mcp connects as modern-only.
• /2025-11-25/mcp falls back to the legacy era.
• All four expose the expected six tools, checker://about resource, and test-plan prompt.