fix(client): clear resumption state on empty SSE event IDs

[znnnnnnn-wil]

Summary

Fixes #2769.

An explicitly empty SSE id: is a last-event-ID reset, not an absent ID. The truthy event.id guard currently ignores that reset and reuses the previous token on reconnect.

• Update the token and call onresumptiontoken('') when the ID is explicitly empty.
• Clear POST-stream resumability when no usable token remains. Standalone GET streams still reconnect, without Last-Event-ID.
• Preserve the previous token when an event omits the ID field.
• Add four regression cases and a client patch changeset.

The tests exercise the real SSE parser through the transport with mocked fetch and fake timers: GET header/callback behavior for empty versus absent IDs, and POST stream termination with an empty ID both with and without an earlier non-empty ID. The original empty-ID regression failed before the fix.

This follows the WHATWG SSE empty-ID semantics. ID-only blocks without a dispatched data event and retry-accounting changes in #2684 are outside this PR's scope.

Verification

On Windows, Node.js 22.19.0:

• Client tests: 38 files, 881 tests passed (including 73 Streamable HTTP tests).
• Client typecheck and ESLint: passed.
• Core and client builds: passed.
• Changed files formatted with Prettier; package-wide Prettier check passed with --end-of-line auto because the checkout uses Windows line endings.
• git diff --check: passed.

AI assistance was used for investigation, implementation, tests, and this PR description.

[changeset-bot]

🦋 Changeset detected

Latest commit: bf24200

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 6 packages

Name	Type
@modelcontextprotocol/client	Patch
@modelcontextprotocol/codemod	Patch
@modelcontextprotocol/core	Patch
@modelcontextprotocol/server-legacy	Patch
@modelcontextprotocol/server	Patch
@modelcontextprotocol/core-internal	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/@modelcontextprotocol/client@2771

@modelcontextprotocol/codemod

npm i https://pkg.pr.new/@modelcontextprotocol/codemod@2771

@modelcontextprotocol/core

npm i https://pkg.pr.new/@modelcontextprotocol/core@2771

@modelcontextprotocol/server

npm i https://pkg.pr.new/@modelcontextprotocol/server@2771

@modelcontextprotocol/server-legacy

npm i https://pkg.pr.new/@modelcontextprotocol/server-legacy@2771

@modelcontextprotocol/express

npm i https://pkg.pr.new/@modelcontextprotocol/express@2771

@modelcontextprotocol/fastify

npm i https://pkg.pr.new/@modelcontextprotocol/fastify@2771

@modelcontextprotocol/hono

npm i https://pkg.pr.new/@modelcontextprotocol/hono@2771

@modelcontextprotocol/node

npm i https://pkg.pr.new/@modelcontextprotocol/node@2771

commit: bf24200

[znnnnnnn-wil]

@felixweinberger Hey Felix, would you mind taking a look at this when you get a chance? It fixes the empty SSE id: resumption case from #2769. All checks are green. Thanks!

[erekola]

I checked the ID-only case that the description leaves for a follow-up, using the locked eventsource-parser 3.0.6. The difference survives chunk splitting: id:\ndata: \n\n emits an event with an empty ID, while id:\n\n emits no event at all. Chunk splitting made no difference. Here is the reduced parser probe:

import { EventSourceParserStream } from 'eventsource-parser/stream';

for (const reset of ['id:\ndata: \n\n', 'id:\n\n']) {
  const input = `id: old\ndata: \n\n${reset}`;
  for (const chunks of [[input], [...input]]) {
    let token;
    const source = new ReadableStream({
      start(controller) {
        for (const chunk of chunks) controller.enqueue(chunk);
        controller.close();
      }
    });
    for await (const event of source.pipeThrough(new EventSourceParserStream())) {
      if (event.id !== undefined) token = event.id;
    }
    console.log(JSON.stringify({ reset, chunks: chunks.length, token }));
  }
}

The first two runs end with token: "", the last two with token: "old". This gives the follow-up a small reproducer at the parser boundary. I haven't run the client suite. This probes parser behavior only. AI assistance was used for the probe and this comment.