feat: form-mode cost confirmation via MCP elicitations

[barryroodt]

Stacked on #358. Please review that one first. This diff is against barryroodt/ai-1044-dual-era-serving at 851f01e. Merging this PR only opens a release PR. It does not ship the package.

What changed

This adds Human Confirmation for create_project and create_branch through MCP form elicitations, replacing the bypassable confirm_cost path on capable clients (AI-886).

• mcp-utils owns the policy seam, signed Continuation State, replay protection, 120-second expiry, and handler plumbing. State keys must contain at least 32 bytes.
• Supabase adds cost policies, stdio wiring, and the per-connection --disable-elicitations option from AI-1045. The platform PR handles disable_elicitations.
• formDeliveryAvailable distinguishes BASE legacy clients, form-capable legacy clients, and generic clients without changing the optional Tool.formatResult contract.

The cost payload includes the live rate, a continuous-run projection, and its assumption. The prose remains PLACEHOLDER-COPY behind Design/PM sign-off, so tests pin the facts rather than the wording.

The branch is 20 commits atop #358. Earlier amended intermediates mean old review-thread SHAs may be superseded.

Behavior contracts

Clients without form support plus opted-out connections keep the existing confirm_cost behavior. The complete BASE tools/list response contains 29 tools and hashes to SHA-256 7327d077b6bdacccfa9f5853d489be6a81f2b2763ca0cc344e0bb4e8fd47371d. Exact legacy text assertions also preserve execute_sql as {result:string} and its untrusted-data boundary.

On form-capable connections, confirm_cost is hidden from discovery but remains callable with migration guidance. Decline and cancel are structured terminal variants. Expiry returns recovery guidance. Tampered state, including an edited readable exp, remains an SDK-owned -32602.

humanConfirmationEnabled === false fails protected paid tools closed while ordinary tools continue working. The gate runs before replay consumption, so an in-flight confirmation can resume with the same state inside its TTL. Generic gate telemetry uses reason: gate; serving-path telemetry preserves the capability-specific reason.

Legacy-era sessions take capabilities from the initialize handshake. Legacy-wire results project through the contextual output schema.

Verification

Final tree c5660c99c301922139a045e0c44ef49ec4223f60:

• format:check: clean across 100 files
• build: all three packages typecheck and build
• mcp-utils: 69/69
• mcp-server-supabase: 279/279 non-environmental tests, including stdio integration 21/21, Supabase elicitations 26/26, cost policies 15/15, and the legacy server suite 123/123
• Packed platform consumer: 3/3
• @supabase/mcp-server-postgrest: the same pre-existing 7/7 localhost :54321 failures at BASE and head

Five Anthropic-key e2e tests were excluded locally because ANTHROPIC_API_KEY was missing. The real-Claude prompt-injection e2e passed 1/1 earlier in this branch's review, before the final local review. This verification does not claim a fresh pass at the current head.

A five-lane review covered correctness/contracts, security, tests, spec compliance, and structural simplification. The initial verdict was NOT_READY; all nine synthesized findings and one post-fix telemetry issue were fixed. The final verdict is READY with no critical or important findings.

Notes for reviewers

The runtime owns minting and verification because SDK v1's createRequestStateCodec hard-reads Date.now() and does not expose typed failure causes. The implementation remains byte-compatible, with codec parity and replay boundaries covered independently. Request-state parsing, replay, codecs, and handlers now have separate responsibilities, and SDK input uses InputResponseView.

A fresh pnpm install breaks under Corepack's floating pnpm 11.16. The repo uses pnpm 10.33.2 through mise; moving the build-script policy for pnpm 11 remains a follow-up.

Please leave release.yml and the release PR out of this change. The publish-preview label records the pkg.pr.new URL for the platform stack.

Part of AI-1091

[pkg-pr-new]

Open in StackBlitz

pnpm add https://pkg.pr.new/@supabase/mcp-server-postgrest@c5660c9

pnpm add https://pkg.pr.new/@supabase/mcp-server-supabase@c5660c9

pnpm add https://pkg.pr.new/@supabase/mcp-utils@c5660c9

commit: c5660c9