Migrate to SDK v2 with official Protocol and isolated role peers

[tonxxd]

Summary

This PR brings @khandrew1 SDK v2 migration from #710 upstream together with Felix's public-Protocol port and the role-isolated optional peers alternative

Problem

The migration to SDK v2 makes both role packages peers of one ext-apps package. A server entry point also imported constants through app.ts, creating a server → app → client edge.

flowchart LR
  Consumer["server-only consumer"] --> ServerEntry["ext-apps/server"]
  ServerEntry --> App["app.js"]
  App --> Client["@modelcontextprotocol/client"]
  ServerEntry --> Server["@modelcontextprotocol/server"]

Loading

Proposed architecture

This alternative reuses the official public Protocol base while isolating each entry point to its matching optional role peer.

flowchart TB
  subgraph ClientSide["App / host entry points"]
    AppEntry[". / react"] -. "optional peer" .-> Client["@modelcontextprotocol/client"]
    BridgeEntry["app-bridge"] -. "optional peer" .-> Client
  end

  subgraph ServerSide["Server entry point"]
    ServerEntry["server"] -. "optional peer" .-> Server["@modelcontextprotocol/server"]
  end

  AppEntry --> Core["@modelcontextprotocol/core"]
  BridgeEntry --> Core
  ServerEntry --> Core

Loading

Consumer	Installs	Does not install or bundle
App / host	ext-apps + client + core	server
MCP server	ext-apps + server + core	client

Implementation

• Preserves @khandrew1 v2 migration.
• Ports App and AppBridge to the official Protocol<BaseContext>.
• Preserves the Apps-only ui/initialize handshake used by v1 hosts.
• Moves resource constants and shared core wire types into neutral modules.
• Marks client and server peers optional.
• Adds packed app/host-only and server-only compile/install/bundle assertions.
• Clears dist before builds so stale role edges cannot enter published packages.

Upstream SDK status

The public Protocol export was merged in typescript-sdk#2501 after 2.0.0-beta.4 was published. Per the maintainer's note, it will be in the next beta.

This draft temporarily uses the pkg.pr.new artifacts for #2501. Before merge, replace those preview specifications with the next published beta and regenerate the lockfile.

Tradeoff

This keeps request lifecycle, cancellation, validation, and transport behavior in the official SDK. Consumers still install the one role package used by their entry point. The core-only alternative in #719 avoids both role packages but owns more protocol code in ext-apps.

Verification

• npm run build
• npm run build:all
• npm test: 392 passed, 1 skipped
• Packed dependency-isolation compile/install/bundle checks
• TypeDoc validation
• Prettier and git diff --check