chore(release): prepare mcp_dart 2.4.3

.github/workflows/test_core.yml

@@ -111,6 +111,7 @@ jobs:
         version:
           - 2.2.2
           - 2.3.0
+          - 2.4.2
 
     steps:
       - name: Checkout code

CHANGELOG.md

@@ -1,11 +1,20 @@
-## Unreleased
+## 2.4.3
 
 ### Added
 
 - Shipped agent skills for building MCP servers, building clients, and
   Streamable HTTP deployment and authentication; install them with
   `dart run skills@ get`.
 
+### Fixed
+
+- Corrected IO stream transport examples to use byte streams.
+
+### Compatibility
+
+- Public APIs, protocol behavior, and the minimum Dart 3.4 requirement are
+  unchanged. The separately versioned CLI remains at 0.2.1.
+
 ## 2.4.2
 
 `mcp_dart 2.4.2` prevents unbounded buffering of incoming stdio and IO stream

README.md

@@ -15,12 +15,12 @@ extensions, host UI behavior, an authorization-server implementation, JSON
 Schema external-reference resolution, and custom JSON Schema vocabularies.
 
 > [!IMPORTANT]
-> This release is `mcp_dart 2.4.2`. The separately versioned stable CLI remains
+> This release is `mcp_dart 2.4.3`. The separately versioned stable CLI remains
 > `mcp_dart_cli 0.2.1`, which requires `mcp_dart ^2.4.2`.
 > Current source passes every scored requirement in the official alpha.11 MCP
 > `2025-11-25` and `2026-07-28` client and server sets, including all 25
 > required 2026 authorization scenarios, plus bidirectional published
-> TypeScript SDK 2.2.0 and Python SDK 2.1.1 interoperability.
+> TypeScript SDK 2.2.0 and Python SDK 2.3.0 interoperability.
 
 ## SDK Tier 1 target
 
@@ -40,7 +40,7 @@ The public maintenance contract is documented in the
 
 | Package | Minimum Dart SDK |
 | --- | --- |
-| `mcp_dart 2.4.2` | 3.4 |
+| `mcp_dart 2.4.3` | 3.4 |
 | `mcp_dart_cli 0.2.1` | 3.12 |
 
 SDK-only generated projects retain the SDK's Dart 3.4 minimum. CLI projects
@@ -65,7 +65,7 @@ important:
 
 ```yaml
 dependencies:
-  mcp_dart: ^2.4.2
+  mcp_dart: ^2.4.3
 ```
 
 The snippets below use the current stable SDK line. Package versions
@@ -107,7 +107,7 @@ commands.
   core conformance claim.
 - Automated MCP 2025-11-25 and MCP 2026-07-28 conformance, bidirectional
   published TypeScript SDK 2.2.0 interoperability, bidirectional Python SDK
-  2.1.1 interoperability, real-browser transport tests, a real Flutter Web
+  2.3.0 interoperability, real-browser transport tests, a real Flutter Web
   service integration in Chrome, deterministic widget tests, and an
   independent pinned JSON Schema Test Suite gate.
 - `mcp_dart 2.4.2` bounds incoming stdio and IO stream messages to 10 MiB by
@@ -117,7 +117,7 @@ commands.
 - Hardened Streamable HTTP access and JSON-RPC error diagnostics, plus the
   deprecated, opt-in legacy HTTP+SSE client with
   same-origin routing and bidirectional interoperability against official
-  TypeScript SDK 1.30.0 and Python SDK 2.1.1 peers.
+  TypeScript SDK 1.32.1 and Python SDK 2.3.0 peers.
 
 MCP has three roles: a host owns the user experience, a client connects that
 host to one server, and a server exposes tools, resources, and prompts. A host
@@ -253,7 +253,7 @@ surface. Re-check both packages' current releases before a production decision.
 - [Versioning policy](https://github.com/leehack/mcp_dart/blob/main/VERSIONING.md)
 - [Tier 1 roadmap](https://github.com/leehack/mcp_dart/blob/main/ROADMAP.md)
 - [SDK on pub.dev](https://pub.dev/packages/mcp_dart)
-- [2.4.2 API reference](https://pub.dev/documentation/mcp_dart/2.4.2/)
+- [2.4.3 API reference](https://pub.dev/documentation/mcp_dart/2.4.3/)
 - [Changelog](https://github.com/leehack/mcp_dart/blob/main/CHANGELOG.md)
 - [MCP 2026-07-28 specification](https://modelcontextprotocol.io/specification/2026-07-28)
 - [MCP 2025-11-25 specification](https://modelcontextprotocol.io/specification/2025-11-25)

ROADMAP.md

@@ -10,7 +10,9 @@ through the
 
 ## Current baseline
 
-- Stable `mcp_dart 2.4.2` and `mcp_dart_cli 0.2.1` releases.
+- SDK 2.4.3 release preparation adds packaged agent skills and documentation
+  fixes. Published stable releases remain `mcp_dart 2.4.2` and
+  `mcp_dart_cli 0.2.1` until publication is verified.
 - SDK 2.4.2 fixes unbounded incoming stdio and IO stream buffering. See
   [GHSA-92g6-8c2f-55w5](https://github.com/leehack/mcp_dart/security/advisories/GHSA-92g6-8c2f-55w5)
   for affected versions and upgrade guidance.

doc/examples.md

@@ -141,8 +141,8 @@ dart run example/client_sse.dart
 - Session management
 - A real initialization, tool-list, and tool-call flow
 - Explicit Host and Origin allowlists for DNS-rebinding protection
-- Process smoke tests and bidirectional official TypeScript SDK 1.30.0 and
-  Python SDK 2.1.1 SSE interoperability tests
+- Process smoke tests and bidirectional official TypeScript SDK 1.32.1 and
+  Python SDK 2.3.0 SSE interoperability tests
 
 ### Streamable HTTP
 

doc/getting-started.md

@@ -8,7 +8,7 @@ Add the MCP Dart SDK to your `pubspec.yaml`:
 
 ```yaml
 dependencies:
-  mcp_dart: ^2.4.2
+  mcp_dart: ^2.4.3
 ```
 
 Then run:

doc/interoperability.md

@@ -25,15 +25,15 @@ For MCP 2026-07-28 coverage, see the
 | Dart client -> Dart server | Legacy HTTP+SSE | MCP 2025-11-25 | [`test/client/sse_client_test.dart`](../test/client/sse_client_test.dart), [`test/interop/browser_legacy_sse_client_test.dart`](../test/interop/browser_legacy_sse_client_test.dart), [`example/server_sse.dart`](../example/server_sse.dart), [`example/client_sse.dart`](../example/client_sse.dart) | Verified in source | Covers endpoint discovery, same-origin redirect-free POST routing, initialization, tool listing, tool execution, clean shutdown, and real-Chrome client lifecycle behavior. HTTP+SSE is deprecated; use Streamable HTTP for new integrations. |
 | Dart client -> TypeScript SDK server | stdio | MCP 2025-11-25 | [`test/interop/dart_client_with_ts_server_test.dart`](../test/interop/dart_client_with_ts_server_test.dart), [`test/interop/ts/`](../test/interop/ts/) | Verified | Requires the TypeScript fixture to be built before running the tagged interop tests. |
 | Dart client -> TypeScript SDK server | Streamable HTTP | MCP 2025-11-25 | [`test/interop/dart_client_with_ts_server_test.dart`](../test/interop/dart_client_with_ts_server_test.dart), [`test/interop/ts/`](../test/interop/ts/) | Verified | Covers tool calls and stale preconfigured session-id recovery. |
-| Dart SDK ↔ TypeScript SDK 1.30.0 | Legacy HTTP+SSE | MCP 2025-11-25 | [`test/interop/dart_client_with_ts_server_test.dart`](../test/interop/dart_client_with_ts_server_test.dart), [`test/interop/ts/src/server.ts`](../test/interop/ts/src/server.ts), [`test/interop/ts/src/legacy_sse_client.ts`](../test/interop/ts/src/legacy_sse_client.ts) | Verified | The deprecated official TypeScript `SSEServerTransport` and `SSEClientTransport` each complete initialization, tool listing, and a tool call with the corresponding Dart peer over real loopback HTTP+SSE. |
+| Dart SDK ↔ TypeScript SDK 1.32.1 | Legacy HTTP+SSE | MCP 2025-11-25 | [`test/interop/dart_client_with_ts_server_test.dart`](../test/interop/dart_client_with_ts_server_test.dart), [`test/interop/ts/src/server.ts`](../test/interop/ts/src/server.ts), [`test/interop/ts/src/legacy_sse_client.ts`](../test/interop/ts/src/legacy_sse_client.ts) | Verified | The deprecated official TypeScript `SSEServerTransport` and `SSEClientTransport` each complete initialization, tool listing, and a tool call with the corresponding Dart peer over real loopback HTTP+SSE. |
 | TypeScript SDK client -> Dart server | stdio | MCP 2025-11-25 | [`test/interop/ts_client_with_dart_server_test.dart`](../test/interop/ts_client_with_dart_server_test.dart), [`test/interop/test_dart_server.dart`](../test/interop/test_dart_server.dart) | Verified | Runs the compiled TypeScript client fixture against a Dart server process and checks that an official TS client can list tools immediately after the lifecycle handshake. |
 | TypeScript SDK client -> Dart server | Streamable HTTP | MCP 2025-11-25 | [`test/interop/ts_client_with_dart_server_test.dart`](../test/interop/ts_client_with_dart_server_test.dart), [`test/interop/test_dart_server.dart`](../test/interop/test_dart_server.dart) | Verified | Includes official TS Streamable HTTP client lifecycle coverage, pre-`initialized` operation rejection, GET SSE streams, and `Last-Event-ID` replay behavior. |
 | TypeScript SDK client -> Dart server | Streamable HTTP | MCP 2026-07-28 | [`test/interop/ts_2026_07_28/`](../test/interop/ts_2026_07_28/), [`tool/testing/run_ts_2026_07_28_interop.dart`](../tool/testing/run_ts_2026_07_28_interop.dart), [`interop_2026_07_28.yml`](../.github/workflows/interop_2026_07_28.yml) | Verified | Published `@modelcontextprotocol/client@2.2.0` negotiates the post-#3002 wire with a spec-correct Dart server and covers discovery, routing headers, tool calls, multi-round input, progress, subscriptions, and cancellation. |
 | Dart MCP 2026-07-28 client -> TypeScript SDK server | Streamable HTTP | MCP 2026-07-28 | [`test/interop/ts_2026_07_28/src/server.mjs`](../test/interop/ts_2026_07_28/src/server.mjs), [`tool/testing/run_ts_2026_07_28_interop.dart`](../tool/testing/run_ts_2026_07_28_interop.dart), [`interop_2026_07_28.yml`](../.github/workflows/interop_2026_07_28.yml) | Verified | Uses published `@modelcontextprotocol/server@2.2.0` through its `createMcpHandler` entry; covers `server/discover`, `tools/list`, `tools/call`, one-time `HeaderMismatch` metadata refresh and retry, MCP 2026-07-28 `input_required`, request-stream cancellation, and post-cancellation recovery. |
 | Dart client -> Python MCP server | stdio | Server-dependent | [`doc/transports.md`](transports.md#connect-to-python-server) | Documented recipe | The transport can spawn Python servers over stdio; the MCP 2025-11-25 recipe remains separate from the MCP 2026-07-28 fixture. |
-| Python SDK 2.1.1 client -> Dart server | Streamable HTTP | MCP 2026-07-28 | [`test/interop/python_2026_07_28/`](../test/interop/python_2026_07_28/), [`tool/testing/run_python_2026_07_28_interop.dart`](../tool/testing/run_python_2026_07_28_interop.dart), [`interop_2026_07_28.yml`](../.github/workflows/interop_2026_07_28.yml) | Verified | Published `mcp==2.1.1` negotiates the canonical post-#3002 discovery wire and covers discovery, tool listing, and tool execution. |
-| Dart MCP 2026-07-28 client -> Python SDK 2.1.1 server | Streamable HTTP | MCP 2026-07-28 | [`test/interop/python_2026_07_28/server.py`](../test/interop/python_2026_07_28/server.py), [`tool/testing/run_python_2026_07_28_interop.dart`](../tool/testing/run_python_2026_07_28_interop.dart), [`interop_2026_07_28.yml`](../.github/workflows/interop_2026_07_28.yml) | Verified | Uses the official Python SDK `mcp==2.1.1` server and covers discovery, protocol selection, `tools/list`, and `tools/call`. |
-| Dart SDK ↔ Python SDK 2.1.1 | Legacy HTTP+SSE | MCP 2025-11-25 | [`test/interop/python_2026_07_28/legacy_sse_client.py`](../test/interop/python_2026_07_28/legacy_sse_client.py), [`test/interop/python_2026_07_28/legacy_sse_server.py`](../test/interop/python_2026_07_28/legacy_sse_server.py), [`tool/testing/run_python_2026_07_28_interop.dart`](../tool/testing/run_python_2026_07_28_interop.dart), [`interop_2026_07_28.yml`](../.github/workflows/interop_2026_07_28.yml) | Verified | Published `mcp==2.1.1` retains the deprecated SSE client and server APIs. Both directions negotiate MCP 2025-11-25 and complete initialization, tool listing, and a tool call over real loopback HTTP+SSE. |
+| Python SDK 2.3.0 client -> Dart server | Streamable HTTP | MCP 2026-07-28 | [`test/interop/python_2026_07_28/`](../test/interop/python_2026_07_28/), [`tool/testing/run_python_2026_07_28_interop.dart`](../tool/testing/run_python_2026_07_28_interop.dart), [`interop_2026_07_28.yml`](../.github/workflows/interop_2026_07_28.yml) | Verified | Published `mcp==2.3.0` negotiates the canonical post-#3002 discovery wire and covers discovery, tool listing, and tool execution. |
+| Dart MCP 2026-07-28 client -> Python SDK 2.3.0 server | Streamable HTTP | MCP 2026-07-28 | [`test/interop/python_2026_07_28/server.py`](../test/interop/python_2026_07_28/server.py), [`tool/testing/run_python_2026_07_28_interop.dart`](../tool/testing/run_python_2026_07_28_interop.dart), [`interop_2026_07_28.yml`](../.github/workflows/interop_2026_07_28.yml) | Verified | Uses the official Python SDK `mcp==2.3.0` server and covers discovery, protocol selection, `tools/list`, and `tools/call`. |
+| Dart SDK ↔ Python SDK 2.3.0 | Legacy HTTP+SSE | MCP 2025-11-25 | [`test/interop/python_2026_07_28/legacy_sse_client.py`](../test/interop/python_2026_07_28/legacy_sse_client.py), [`test/interop/python_2026_07_28/legacy_sse_server.py`](../test/interop/python_2026_07_28/legacy_sse_server.py), [`tool/testing/run_python_2026_07_28_interop.dart`](../tool/testing/run_python_2026_07_28_interop.dart), [`interop_2026_07_28.yml`](../.github/workflows/interop_2026_07_28.yml) | Verified | Published `mcp==2.3.0` retains the deprecated SSE client and server APIs. Both directions negotiate MCP 2025-11-25 and complete initialization, tool listing, and a tool call over real loopback HTTP+SSE. |
 | Dart browser client -> Dart server | Streamable HTTP | MCP 2025-11-25 and MCP 2026-07-28 | [`test/browser/mcp_2026_07_28_streamable_http_test.dart`](../test/browser/mcp_2026_07_28_streamable_http_test.dart), [`tool/testing/run_browser_2026_07_28_interop.dart`](../tool/testing/run_browser_2026_07_28_interop.dart) | Verified | A real Chrome client completes 12 tool-list requests and 12 tool calls in each profile over cross-origin Streamable HTTP. It also proves MCP 2026-07-28 request-stream cancellation and recovery. The MCP 2025-11-25 case waits for response-stream reconnect timers and guards against browser connection-slot exhaustion. |
 | Flutter Web example -> Dart server | Streamable HTTP | MCP 2026-07-28 | [`example/flutter_http_client/test/browser_e2e_test.dart`](../example/flutter_http_client/test/browser_e2e_test.dart), [`tool/testing/run_flutter_web_example_e2e.dart`](../tool/testing/run_flutter_web_example_e2e.dart), [`test_core.yml`](../.github/workflows/test_core.yml) | Verified | The example's real service layer runs in Chrome and completes connection, 12 tool-list requests, 12 tool calls, expected RPC-error recovery, reconnect, a post-reconnect request, and disconnect. Deterministic widget tests cover the UI separately. Flutter Web cannot spawn stdio servers. |
 | MCP Apps host/client metadata | stdio or Streamable HTTP | MCP 2026-07-28 plus `io.modelcontextprotocol/ui` extension | [`doc/mcp-apps.md`](mcp-apps.md), [`example/mcp_apps_helpers_server.dart`](../example/mcp_apps_helpers_server.dart), [`test/types/mcp_ui_test.dart`](../test/types/mcp_ui_test.dart), [`test/server/mcp_ui_test.dart`](../test/server/mcp_ui_test.dart) | Verified | Verified coverage is limited to SDK metadata helpers, serialization, and checked-in examples; host rendering behavior varies by host, so verify UI metadata against your target host. |
@@ -83,7 +83,7 @@ post-cancellation tool calls in addition to discovery and normal tool calls.
 The `Run MCP 2026-07-28 Interop` workflow covers relevant PRs, manual dispatch,
 and a daily schedule on `main`.
 
-The official Python SDK 2.1.1 fixture runs each direction independently:
+The official Python SDK 2.3.0 fixture runs each direction independently:
 
 ```bash
 python3 -m venv .dart_tool/python-2026-interop

doc/mcp-2026-07-28-release-runbook.md

@@ -222,11 +222,11 @@ all required checks green and no unresolved review thread.
 
 On the final release-prep commit:
 
-- Set the root package version to the selected stable SDK version (`2.4.2` for
+- Set the root package version to the selected stable SDK version (`2.4.3` for
   the current follow-up release).
 - Restore root `documentation` and all user-facing repository links to `main`.
 - Replace older dependency snippets in the README, getting-started,
-  quick-reference, and current release docs with `mcp_dart: ^2.4.2`. Preserve
+  quick-reference, and current release docs with `mcp_dart: ^2.4.3`. Preserve
   version-specific historical migration guides.
 - Keep the durable `2026-07-28` document, fixture, command, and workflow names;
   update maturity wording only when it matches the reviewed upstream input.
@@ -243,7 +243,7 @@ On the final release-prep commit:
 - Stop presenting `previewProtocolVersion` as the preferred public name. Keep
   it only as a deprecated alias of `stableProtocolVersion` for prerelease
   adopters, and update examples to use the stable/default constants.
-- Move the relevant root changelog entries under `## 2.4.2` and remove wording
+- Move the relevant root changelog entries under `## 2.4.3` and remove wording
   that presents the stable package itself as a preview. Keep upstream
   release-candidate facts explicit while they remain true.
 - Keep migration and compatibility notes explicit: `McpProtocol.stable`
@@ -252,8 +252,8 @@ On the final release-prep commit:
   link it from the tagged README and changelog.
 - Run `dart pub publish --dry-run` again from a clean checkout of the exact
   release commit. Do not create the release tag until this succeeds.
-- Run the shared metadata validator with `--package mcp_dart --tag v2.4.2`.
-  It must require substantive notes under the exact `## 2.4.2` changelog
+- Run the shared metadata validator with `--package mcp_dart --tag v2.4.3`.
+  It must require substantive notes under the exact `## 2.4.3` changelog
   heading, exact reviewed input versions and pins, and verify that the default
   protocol is `2026-07-28` while the initialization and deprecated compatibility
   aliases remain at `2025-11-25`.
@@ -288,31 +288,32 @@ coordinated prep cannot mix channels.
    reuse an existing tag only when that tag resolves to the exact original
    release commit; the workflow never moves it. Manual dispatch is a recovery
    path only.
-2. Verify tag `v2.4.2`, the GitHub release, and the `Publish to pub.dev` workflow.
+2. Verify tag `v2.4.3`, the GitHub release, and the `Publish to pub.dev` workflow.
    If GitHub release creation fails after the tag was pushed, use **Re-run all
    jobs** on the original failed `Create Release` run so the workflow retains
    the original release commit. Do not start a fresh dispatch after `main`
    advances; it will correctly reject an existing tag that resolves to a
    different commit. If publication fails after the tag was pushed, rerun the
    failed tag-triggered `Publish to pub.dev` workflow; reusing a tag does not
    emit another push event.
-3. Confirm pub.dev shows version `2.4.2`, immutable `v2.4.2` documentation
+3. Confirm pub.dev shows version `2.4.3`, immutable `v2.4.3` documentation
    links, and a successful package analysis. Checked-in links on `main` remain
    pointed at `main`.
-4. Create a clean temporary Dart project, resolve `mcp_dart: ^2.4.2`, and run a
+4. Create a clean temporary Dart project, resolve `mcp_dart: ^2.4.3`, and run a
    minimal MCP 2026-07-28 client/server smoke test using only the published
-   package. For this release, exercise the incoming-message limits through
-   public stdio client, stdio server, and IO stream APIs, including valid
-   custom limits and fatal-overflow shutdown with a blocked outgoing write.
+   package. For this release, verify that all three agent skills are included
+   in the published archive and can be installed with `dart run skills@ get`.
+   Retain public stdio client, stdio server, and IO stream smoke coverage for
+   the incoming-message limits introduced in 2.4.2.
    Confirm the published package earns 160/160 under the current Pana.
 
 Do not start a selected CLI release until the published SDK dependency resolves
 publicly.
 
 ## 5. Prepare and publish `mcp_dart_cli`
 
-Skip this section for the SDK-only 2.4.2 release. The already-published CLI
-remains 0.2.0 and its `^2.3.0` SDK constraint accepts 2.4.2.
+Skip this section for the SDK-only 2.4.3 release. The already-published CLI
+remains 0.2.1 and its `^2.4.2` SDK constraint accepts 2.4.3.
 
 - Set the CLI version and `packageVersion` constant to `0.2.0`, and set
   `generatedSdkConstraint` to `^2.3.0`.