fix: preserve v1 library host compatibility

CHANGELOG.md

@@ -16,10 +16,11 @@ All notable changes to this project will be documented in this file. The format
 ### Changed
 
 - [#366](https://github.com/mohanagy/miftah/issues/366) Completed the capability-gated MRTR confirmation boundary with packaged modern-client evidence, authenticated profile-context binding, deterministic one-time replay rejection, explicit cancelled audit outcomes, request-scoped upstream cleanup, and documented safe fallbacks. The experimental Tasks extension remains unimplemented after evaluating startup, OAuth, diagnostics, audit export, and recovery; Miftah makes no Tasks interoperability claim.
-- [#363](https://github.com/mohanagy/miftah/issues/363) Replaced the monolithic MCP TypeScript SDK v1 dependency with the stable v2 split packages and migrated runtime schemas to Zod 4. Runtime consumers receive only `client`, `core`, and `server`; the Node adapter and frozen legacy server remain build/test dependencies. Direct consumers of the old monolithic SDK deep imports must move to the corresponding split package. The CLI bundles the v2 Node adapter with patched `@hono/node-server` and Hono builds so a fresh Miftah install does not inherit the Node package's still-vulnerable 1.x adapter range; custom embedding hosts own their direct Node adapter version. Confirmation-required tools, resources, prompts, and profile transitions now use the v2 `input_required` flow with integrity-bound one-time continuation state across request-scoped modern HTTP instances, while the SDK legacy shim preserves form elicitation for initialized clients. Native OAuth callback completion now carries the authorization-server issuer required by the v2 provider contract; Miftah continues to validate and round-trip that issuer without exposing tokens or client secrets.
+- [#363](https://github.com/mohanagy/miftah/issues/363) Replaced Miftah's runtime use of the monolithic MCP TypeScript SDK v1 with the stable v2 split packages and migrated runtime schemas to Zod 4. The compatible monolithic SDK remains an installed dependency solely for the documented v1 `createMiftahRuntime(...).connect(new StdioServerTransport())` host path through the 1.x line; its removal remains deferred to the evidence-backed major-version gate [#388](https://github.com/mohanagy/miftah/issues/388). The frozen legacy server remains a build/test dependency. The published package pins patched `@hono/node-server` and Hono releases so the retained v1 SDK cannot resolve the unsafe 1.x adapter range, and the CLI bundles those same patched builds; custom embedding hosts own their direct `@modelcontextprotocol/node` version. Confirmation-required tools, resources, prompts, and profile transitions now use the v2 `input_required` flow with integrity-bound one-time continuation state across request-scoped modern HTTP instances, while the SDK legacy shim preserves form elicitation for initialized clients. Native OAuth callback completion now carries the authorization-server issuer required by the v2 provider contract; Miftah continues to validate and round-trip that issuer without exposing tokens or client secrets.
 
 ### Fixed
 
+- [#391](https://github.com/mohanagy/miftah/issues/391) Preserved the documented v1 library STDIO host path through 1.x by retaining the compatible MCP SDK v1 package alongside Miftah's v2 runtime packages and compiling the exact legacy `StdioServerTransport` consumer from a freshly installed release tarball. Exact patched Hono and Node adapter runtime dependencies prevent the retained SDK from selecting its unsafe 1.x adapter range. The v2 `createMiftahServerFactory` path remains preferred; removal of the v1 host dependency requires the future major-version gate [#388](https://github.com/mohanagy/miftah/issues/388).
 - [#384](https://github.com/mohanagy/miftah/issues/384) Made continuation tamper coverage deterministic by mutating a decoded signature byte and re-encoding it canonically, so every test input changes authenticated bytes rather than possibly changing only unused base64url padding bits.
 
 ### Security

docs/library-api.md

@@ -24,7 +24,7 @@
 | `generateConfigSchema` | Generates the editor-facing JSON Schema for the configuration contract. |
 | `presetConfig` | Creates a supported configuration preset in memory. |
 
-`createMiftahRuntime` returns `MiftahRuntime`, which exposes the resolved `config`, `connect(transport)`, and `close()` methods for hosts that own a specific transport lifecycle. `createMiftahServerFactory` is the preferred boundary for the SDK v2 serving entries because every factory invocation creates a fresh prepared Miftah server whose upstreams close with that server. Both functions accept `MiftahRuntimeOptions`, including the modern profile-context boundary described below. The removed monolithic `@modelcontextprotocol/sdk` package is not part of the supported dependency surface. Miftah's CLI bundles the v2 Node adapter with its patched Hono adapter because `@modelcontextprotocol/node@2.0.0` still advertises an unsafe 1.x adapter range; embedding hosts import and version their own `@modelcontextprotocol/node` package when adapting a custom Node HTTP server.
+`createMiftahRuntime` returns `MiftahRuntime`, which exposes the resolved `config`, `connect(transport)`, and `close()` methods for hosts that own a specific transport lifecycle. The documented SDK v1 `StdioServerTransport` path remains supported through the 1.x line, and Miftah retains the compatible monolithic SDK dependency for that path. Its removal is deferred to the evidence-backed major-version gate [#388](https://github.com/mohanagy/miftah/issues/388). The package also pins patched `@hono/node-server` and Hono runtime releases so that retained SDK cannot select its unsafe 1.x adapter range. `createMiftahServerFactory` is the preferred boundary for SDK v2 serving because every factory invocation creates a fresh prepared Miftah server whose upstreams close with that server. Both functions accept `MiftahRuntimeOptions`, including the modern profile-context boundary described below. Miftah's CLI bundles the same patched Hono adapter; embedding hosts import and version their own `@modelcontextprotocol/node` package when adapting a custom Node HTTP server.
 
 ```ts
 import { serveStdio } from "@modelcontextprotocol/server/stdio";
@@ -36,6 +36,16 @@ const server = serveStdio(createMiftahServerFactory("./miftah.json"));
 await server.close();
 ```
 
+Existing v1 library hosts may retain their 1.0 integration through the 1.x line:
+
+```ts
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { createMiftahRuntime } from "@lubab/miftah";
+
+const runtime = await createMiftahRuntime("./miftah.json");
+await runtime.connect(new StdioServerTransport());
+```
+
 For a custom HTTP host, pass the same factory to `createMcpHandler` from `@modelcontextprotocol/server` and adapt the web handler with `toNodeHandler` from `@modelcontextprotocol/node` when using Node's HTTP server.
 
 ## MCP protocol compatibility matrix