feat: add MCP 2026 support

[douglance]

Summary

• add stateless MCP 2026 handling with server/discover, protocol routing, metadata, cache hints, resources, prompts, apps, subscriptions, tasks, and authorization extensions
• add MCP elicitation helpers for form and URL flows, including MRTR and task input resumption
• document the added MCP surface and include a minor changeset

Testing

• pnpm check
• pnpm check:types
• pnpm test src/Mcp.test.ts src/Cli.test-d.ts
• pnpm build
• pnpm test

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/incur@158

commit: 28e187b

[codecov]

Codecov Report

❌ Patch coverage is 86.78899% with 72 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (main@abd9af3). Learn more about missing BASE report.

Files with missing lines	Patch %	Lines
src/Mcp2026.ts	90.90%	26 Missing and 7 partials ⚠️
src/Elicitation.ts	71.69%	10 Missing and 5 partials ⚠️
src/Mcp2026Types.ts	45.83%	11 Missing and 2 partials ⚠️
src/Mcp.ts	87.50%	10 Missing ⚠️
src/Cli.ts	95.83%	1 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #158   +/-   ##
=======================================
  Coverage        ?   94.41%           
=======================================
  Files           ?       35           
  Lines           ?     5196           
  Branches        ?     2026           
=======================================
  Hits            ?     4906           
  Misses          ?      238           
  Partials        ?       52           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[douglance]

Thermo-nuclear maintainability review: blocking on decomposition.

This PR takes src/Mcp.ts from roughly 165 lines to roughly 1,450 lines, crossing the 1,000-line boundary in one change. The new file now owns protocol constants and types, stdio framing, HTTP dispatch, authorization, capability negotiation, tool calls, resources, prompts, completions, task storage/lifecycle, elicitation adapters, caching, and JSON-RPC errors. That is not one cohesive module; it is an MCP subsystem concentrated in a single file.

Please decompose before merge. A clean boundary is: protocol/types, transport/stdio, transport/http, dispatcher, tasks/store, resources-prompts, authorization, and JSON-RPC errors. Keep Mcp.ts as the small public facade that composes those pieces. Mcp.test.ts also grows to about 1,260 lines and should follow the same ownership split.

This is the explicit under-1k to over-1k presumptive blocker. The behavior can stay unchanged, but the subsystem needs real module boundaries first.