Adopt the MCP 2026-07-28 spec in the TypeScript server (SDK v2)

[JaviMaligno]

Migrates the TypeScript implementation to @modelcontextprotocol/server v2, which implements the 2026-07-28 protocol revision. The mechanical parts came from the official codemod; everything else is by hand.

Part of #4. Python is not touched here — it follows in its own PR, as does the multi-database work (#5), which is why the SDK migration goes first: the tool signatures only get rewritten once.

Existing users are not affected, and this proves it

The obvious worry with a revision that drops the initialize handshake is that every installed client breaks. It does not: a v2 server is dual-era and still answers the legacy handshake, while 2026-capable clients negotiate through server/discover.

Rather than take the migration guide’s word for it, src/__tests__/legacy-client.test.ts spawns the built dist/index.js as a subprocess over stdio and drives it with a v1 SDK client — the same code path Claude Desktop, Cursor and Smithery use today. It asserts the handshake completes and all 14 tools list.

What else is in here, and why

None of this is padding — the migration could not be verified without it:

• zod 3 → 4 (v2 requires >=4.2). This renamed ZodError.errors to .issues, which broke config validation.
• Node engine >=20, matching what the SDK and the CI runner already require.
• Six pre-existing type errors fixed. npm run typecheck was never run in CI, so it had accumulated unused imports and interfaces returned where a Record<string, unknown> was declared (interfaces carry no implicit index signature). Unrelated to the SDK, but typecheck had to pass for the migration to mean anything. typecheck is now a CI step.
• createServer() split out of index.ts into server.ts, so a test can build a server without the entry point’s side effects (settings validation, process.exit, stdio connect).
• The first tests on the TypeScript side at all — there were none — and the continue-on-error: true that let npm test fail silently in CI is gone.
• Version aligned. It had drifted three ways: package.json 0.2.0, the code 0.10.0, npm 1.0.1. All now 1.1.0, with a test that fails if they separate again. Pick a different number before publishing if you disagree.

Verification

npm run typecheck   # clean
npm run build       # ok
npm test            # 10 passed (3 files)

The legacy-client test needs a build first, so pretest now runs npm run build.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LVnEdm6smNC5ZJzghc7WRY