Summary

This PR brings @khandrew1 SDK v2 migration from #710 upstream together with the core-only protocol dependency-isolation

Problem

Andrew's v2 migration changes App and AppBridge to inherit the official SDK Client and Server. Because ext-apps is one npm package, server-only consumers can then install and bundle the client role as well.

flowchart LR
  Consumer["server-only consumer"] --> ExtServer["ext-apps/server"]
  ExtServer --> App["app.ts"]
  App --> Client["@modelcontextprotocol/client"]
  ExtServer --> Server["@modelcontextprotocol/server"]

Proposed architecture

This alternative owns a small Apps-specific JSON-RPC lifecycle and depends only on public @modelcontextprotocol/core schemas. Official clients and servers remain compatible through structural interfaces.

as suggested by @felixweinberger on slack

flowchart TB
  AppConsumer["App consumer"] --> App["ext-apps App"]
  App --> Protocol["ext-apps Apps protocol"]
  Protocol --> Core["@modelcontextprotocol/core"]

  ServerConsumer["Server consumer"] --> ExtServer["ext-apps/server"]
  ExtServer --> Core
  ServerConsumer --> Server["@modelcontextprotocol/server"]

  Host["Host / AppBridge"] -. "optional structural adapter" .-> Client["@modelcontextprotocol/client"]
  Client --> Core
  Server --> Core

Implementation

• Preserves @khandrew1 v2 migration.
• Replaces role inheritance with an ext-apps-owned protocol-neutral JSON-RPC base.
• Keeps ui/initialize / ui/notifications/initialized as the only iframe handshake.
• Adds structural McpClientLike and McpServerLike interfaces verified against official v2 classes.
• Moves shared constants and types into neutral modules.
• Removes client and server from published peers; examples declare role-specific dependencies.
• Adds packed-install, declaration-graph, and bundle-metafile isolation tests.

Tradeoff

This provides the strongest dependency isolation: app-only consumers do not install the server, and server-only consumers do not install the client. The tradeoff is that ext-apps owns protocol lifecycle code that must stay aligned with the official SDK.

The alternative using the official public Protocol base in #720 is available for direct comparison.

Verification

• npm test: 398 passed, 1 skipped
• Focused Protocol/App/AppBridge compatibility suite: 171 passed
• npm run build
• npm run build:all
• TypeDoc validation
• Packed dependency-isolation and bundle-graph checks
• Functional integration-server E2E: 5 passed