From 18e8e4dae721ed2fea4f400ff5d55763095b2dd2 Mon Sep 17 00:00:00 2001
From: Justin Davis <juzzydee@gmail.com>
Date: Mon, 18 May 2026 10:06:18 +1000
Subject: [PATCH] chore(deps): bump rmcp to 1.4 + unpin minor versions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps rmcp from 1.2.0 to 1.4.0 across both the universal dep and the
native-only override. Removes the exact-version pin (`=1.2.0` → `"1.4"`)
so future patch and minor updates flow through normally — the pin was
insurance during the CF migration and isn't earning its keep now.

## Why not dependabot PR #9

The grouped PR only bumped the universal pin (Cargo.toml line 38) and
left the native-only override (line 108) at `=1.2.0`. With cfg-conjoined
exact pins at different versions, Cargo can't resolve a single rmcp
version and the workspace fails to build. Closing #9 in favour of this
manual fix.

## Why floor at 1.4 and not latest (1.7)

rmcp 1.3 removed the default type param from `StreamableHttpService<S>`
(rmcp #758), which means our native HTTPS handler now needs to specify
both generics: `StreamableHttpService<MemoriaServer, LocalSessionManager>`.
Fixed in src/main.rs. Beyond 1.4 there are further API shifts I haven't
audited — floor at 1.4 matches the dependabot ask and keeps the diff
auditable. Future bumps can move forward incrementally.

## Notable upstream changes 1.2 → 1.4

- fix(server): remove initialized notification gate to support
  Streamable HTTP (rmcp #788) — helpful for our HTTPS path
- default session keep_alive to 5 minutes (rmcp #780)
- fix(http): add host check (rmcp #764)
- StreamableHttpService default generic removed (rmcp #758) — the
  type annotation in src/main.rs:1325 absorbs this

## Test plan

- [x] `cargo build` — clean (2 pre-existing dead-code warnings)
- [x] `cargo test` — 49 passed, 0 failed
- [x] `cargo check --target wasm32-unknown-unknown --lib` — clean
- [ ] CI green on PR

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 Cargo.lock  | 14 +++++++-------
 Cargo.toml  |  4 ++--
 src/main.rs |  2 +-
 3 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 30d8278..865c295 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -384,7 +384,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -1398,9 +1398,9 @@ dependencies = [
 
 [[package]]
 name = "rmcp"
-version = "1.2.0"
+version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba6b9d2f0efe2258b23767f1f9e0054cfbcac9c2d6f81a031214143096d7864f"
+checksum = "f542f74cf247da16f19bbc87e298cd201e912314f4083e88cdd671f44f5fcb53"
 dependencies = [
  "async-trait",
  "base64",
@@ -1429,9 +1429,9 @@ dependencies = [
 
 [[package]]
 name = "rmcp-macros"
-version = "1.2.0"
+version = "1.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ab9d95d7ed26ad8306352b0d5f05b593222b272790564589790d210aa15caa9e"
+checksum = "6aefac48c364756e97f04c0401ba3231e8607882c7c1d92da0437dc16307904d"
 dependencies = [
  "darling",
  "proc-macro2",
@@ -1464,7 +1464,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -1812,7 +1812,7 @@ dependencies = [
  "getrandom 0.4.2",
  "once_cell",
  "rustix",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index a327b51..21dcdfe 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -35,7 +35,7 @@ serde_json = "1"
 # transport implementations (which pull in axum/tower/hyper on native)
 # aren't pulled into the universal graph. Native bins re-add them in
 # the cfg-gated block. wasm32 uses just server + macros.
-rmcp = { version = "=1.2.0", default-features = false, features = ["server", "macros"] }
+rmcp = { version = "1.4", default-features = false, features = ["server", "macros"] }
 schemars = "0.8"
 
 # Time, IDs, basic primitives
@@ -105,7 +105,7 @@ tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 # Native MCP transports — adds streamable-HTTP-server (uses hyper/tower)
 # on top of the universal server+macros features. Cargo unions features
 # for the same dep, so the native build gets all four.
-rmcp = { version = "=1.2.0", features = ["transport-io", "transport-streamable-http-server"] }
+rmcp = { version = "1.4", features = ["transport-io", "transport-streamable-http-server"] }
 
 # Memory store (rusqlite — replaced by D1 binding on the worker side)
 rusqlite = { version = "0.31", features = ["bundled"] }
diff --git a/src/main.rs b/src/main.rs
index c94d0b7..50f5be0 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -1322,7 +1322,7 @@ async fn serve_http(
     tracing::info!("OAuth enabled. Client ID: {}", auth_state.client_id());
 
     // Build the request handler that routes between OAuth and MCP
-    let make_handler = move |mcp_svc: StreamableHttpService<MemoriaServer>,
+    let make_handler = move |mcp_svc: StreamableHttpService<MemoriaServer, rmcp::transport::streamable_http_server::session::local::LocalSessionManager>,
                              auth: Arc<auth::AuthState>,
                              limiter: Arc<RateLimiter>,
                              peer_ip: String,