---
summary: Empty server handler init fix, OpenTelemetry API moved to optional peer dep, expanded unit and integration test coverage
breaking: false
---

# 0.2.6 — 2026-03-28

Handler initialization for empty servers, OTel API moved to peer deps, and comprehensive test coverage expansion.

## Fixed

- **Empty/task-only server handler initialization** — `ToolRegistry`, `ResourceRegistry`, and `PromptRegistry` now call the SDK's `setToolRequestHandlers()` / `setResourceRequestHandlers()` / `setPromptRequestHandlers()` up front before registering definitions. Previously, servers with zero standard tools (or only task tools) would not expose `tools/list`, `resources/list`, or `prompts/list` handlers, causing clients to get method-not-found errors.

## Changed

- **`@opentelemetry/api` moved to optional peer dependency** — Reduces mandatory install footprint for servers that don't use OpenTelemetry. The package is still required when `OTEL_ENABLED=true`.

## Tests

- **New unit tests** — `sessionAwareTaskStore.test.ts` (session ownership enforcement), `checkScopes.test.ts` (dynamic scope checking), `httpTransport.lifecycle.test.ts` (port retry and shutdown lifecycle), `protectedResourceMetadata.test.ts` (OAuth protected resource metadata), `sessionIdUtils.runtime.test.ts` (Web Crypto session ID fallback), `mockContext.test.ts` (mock context logger, state, progress helpers), `retry.test.ts` (retry helper with backoff, jitter, cancellation, abort signal), `instrumentation.lifecycle.test.ts` (OTel init/shutdown, cloud provider detection, timeout handling).
- **New test helper** — `default-server-mcp.ts` with shared MCP surface assertions for capabilities, discovery, protocol errors, and task operations.
- **Expanded integration tests** — HTTP auth (protected resource metadata, SSE rejection), HTTP sessions (DELETE without session ID), HTTP transport (MCP surface, protocol version rejection, origin rejection), stdio (MCP surface assertions).
- **Expanded unit tests** — Tool registration (task-only registry handler init), storage factory (Cloudflare R2/KV/D1 serverless providers, Supabase client injection, filesystem serverless rejection).
