@1mcp/agent 0.29.0 → 0.29.1

package/build/transport/http/restorableStreamableTransport.d.ts

@@ -7,84 +7,41 @@ export interface RestorationInfo {
     isRestored: boolean;
     sessionId?: string;
 }
-/**
- * Result type for operations that may fail.
- * Uses discriminated union to make invalid states unrepresentable.
- */
-export type OperationResult = {
-    success: true;
-    error?: never;
-} | {
-    success: false;
-    error: string;
-};
 /**
  * RestorableStreamableHTTPServerTransport extends the MCP SDK's StreamableHTTPServerTransport
- * to provide proper session restoration capabilities with type-safe access to internal properties.
+ * to track whether a transport was restored from persistent storage.
  *
- * This wrapper class encapsulates the initialization logic needed for restored sessions,
- * providing a clean interface that's less likely to break with SDK updates.
+ * This is a minimal wrapper that only adds restoration tracking. Session ID management
+ * is handled entirely through the SDK's public `sessionIdGenerator` callback - when
+ * restoring a session, we pass a generator that returns the stored session ID.
  *
  * @remarks
- * The class works by:
- * 1. Storing a restored sessionId that overrides the SDK's getter
- * 2. Providing methods to safely access and modify internal SDK properties
- * 3. Returning success/failure status from operations for proper error handling
+ * The restoration flow works as follows:
+ * 1. Create transport with `sessionIdGenerator: () => storedSessionId`
+ * 2. Connect transport to ServerManager
+ * 3. Call virtualInitialize() which triggers SDK's handleRequest
+ * 4. SDK calls sessionIdGenerator() internally to get the session ID
+ * 5. Call markAsRestored() to indicate successful restoration
  *
  * @example
  * ```typescript
- * // SessionService handles the full restoration flow:
  * const transport = new RestorableStreamableHTTPServerTransport({
  *   sessionIdGenerator: () => originalSessionId,
  * });
- * const initResult = transport.markAsInitialized();
- * transport.setSessionId(originalSessionId);
+ * // After successful virtual initialize...
+ * transport.markAsRestored();
  * // Now transport.isRestored() returns true
  * ```
  */
 export declare class RestorableStreamableHTTPServerTransport extends StreamableHTTPServerTransport {
     private _isRestored;
-    private _restoredSessionId?;
-    /**
-     * Sets the sessionId for a restored session.
-     *
-     * When restoring a session, we need to ensure the sessionId is available immediately
-     * without waiting for the sessionIdGenerator to be called by the SDK. This method
-     * directly sets the sessionId on the underlying transport.
-     *
-     * @param sessionId - The sessionId to set for the restored session
-     * @returns OperationResult indicating success or failure with error details
-     */
-    setSessionId(sessionId: string): OperationResult;
     /**
-     * Override sessionId getter to return restored sessionId if available.
-     *
-     * This ensures that even if the underlying transport hasn't generated the sessionId yet,
-     * we return the correct restored sessionId. If no restored session ID exists, delegates
-     * to the parent class's getter by manually accessing the property descriptor.
-     *
-     * @remarks
-     * We cannot use `super.sessionId` directly because this override shadows the parent's
-     * getter. Instead, we use Object.getOwnPropertyDescriptor to access the parent's
-     * property descriptor and call its getter with the correct context.
-     *
-     * Type assertion to `object` is safe here because we know the prototype chain exists:
-     * this -> RestorableStreamableHTTPServerTransport -> StreamableHTTPServerTransport -> Object.prototype
-     * Object.getOwnPropertyDescriptor requires an object type, and TypeScript cannot infer this
-     * from the double getPrototypeOf call.
-     */
-    get sessionId(): string | undefined;
-    /**
-     * Marks the transport as initialized for restored sessions.
-     *
-     * When restoring a session, the client won't send an initialize request again
-     * because from the client's perspective, the session is already initialized.
-     * The MCP SDK checks the _initialized flag and rejects requests if it's false.
-     * This method safely sets that flag to allow the restored session to work.
+     * Marks this transport as having been restored from persistent storage.
      *
-     * @returns OperationResult indicating success or failure with error details
+     * This should be called after successful virtual initialization to indicate
+     * that the transport is ready to handle requests for a restored session.
      */
-    markAsInitialized(): OperationResult;
+    markAsRestored(): void;
     /**
      * Returns whether this transport was created for a restored session.
      *

package/build/transport/http/restorableStreamableTransport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"restorableStreamableTransport.d.ts","sourceRoot":"","sources":["../../../src/transport/http/restorableStreamableTransport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAKnG;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnG;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAAa,uCAAwC,SAAQ,6BAA6B;IACxF,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,kBAAkB,CAAC,CAAS;IAEpC;;;;;;;;;OASG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe;IAwBhD;;;;;;;;;;;;;;;;OAgBG;IACH,IAAa,SAAS,IAAI,MAAM,GAAG,SAAS,CAiB3C;IAED;;;;;;;;;OASG;IACH,iBAAiB,IAAI,eAAe;IAyBpC;;;;OAIG;IACH,UAAU,IAAI,OAAO;IAIrB;;;;OAIG;IACH,kBAAkB,IAAI,eAAe;CAUtC"}
+{"version":3,"file":"restorableStreamableTransport.d.ts","sourceRoot":"","sources":["../../../src/transport/http/restorableStreamableTransport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAEnG;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBAAa,uCAAwC,SAAQ,6BAA6B;IACxF,OAAO,CAAC,WAAW,CAAS;IAE5B;;;;;OAKG;IACH,cAAc,IAAI,IAAI;IAItB;;;;OAIG;IACH,UAAU,IAAI,OAAO;IAIrB;;;;OAIG;IACH,kBAAkB,IAAI,eAAe;CAMtC"}

package/build/transport/http/restorableStreamableTransport.js

@@ -1,133 +1,40 @@
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
-import logger from '../../logger/logger.js';
 /**
  * RestorableStreamableHTTPServerTransport extends the MCP SDK's StreamableHTTPServerTransport
- * to provide proper session restoration capabilities with type-safe access to internal properties.
+ * to track whether a transport was restored from persistent storage.
  *
- * This wrapper class encapsulates the initialization logic needed for restored sessions,
- * providing a clean interface that's less likely to break with SDK updates.
+ * This is a minimal wrapper that only adds restoration tracking. Session ID management
+ * is handled entirely through the SDK's public `sessionIdGenerator` callback - when
+ * restoring a session, we pass a generator that returns the stored session ID.
  *
  * @remarks
- * The class works by:
- * 1. Storing a restored sessionId that overrides the SDK's getter
- * 2. Providing methods to safely access and modify internal SDK properties
- * 3. Returning success/failure status from operations for proper error handling
+ * The restoration flow works as follows:
+ * 1. Create transport with `sessionIdGenerator: () => storedSessionId`
+ * 2. Connect transport to ServerManager
+ * 3. Call virtualInitialize() which triggers SDK's handleRequest
+ * 4. SDK calls sessionIdGenerator() internally to get the session ID
+ * 5. Call markAsRestored() to indicate successful restoration
  *
  * @example
  * ```typescript
- * // SessionService handles the full restoration flow:
  * const transport = new RestorableStreamableHTTPServerTransport({
  *   sessionIdGenerator: () => originalSessionId,
  * });
- * const initResult = transport.markAsInitialized();
- * transport.setSessionId(originalSessionId);
+ * // After successful virtual initialize...
+ * transport.markAsRestored();
  * // Now transport.isRestored() returns true
  * ```
  */
 export class RestorableStreamableHTTPServerTransport extends StreamableHTTPServerTransport {
     _isRestored = false;
-    _restoredSessionId;
     /**
-     * Sets the sessionId for a restored session.
+     * Marks this transport as having been restored from persistent storage.
      *
-     * When restoring a session, we need to ensure the sessionId is available immediately
-     * without waiting for the sessionIdGenerator to be called by the SDK. This method
-     * directly sets the sessionId on the underlying transport.
-     *
-     * @param sessionId - The sessionId to set for the restored session
-     * @returns OperationResult indicating success or failure with error details
-     */
-    setSessionId(sessionId) {
-        this._restoredSessionId = sessionId;
-        try {
-            // Access the underlying _webStandardTransport where sessionId is stored
-            // StreamableHTTPServerTransport is a wrapper with getter-only sessionId
-            // The actual sessionId is on _webStandardTransport which allows setting
-            const internalTransport = this;
-            const webStandardTransport = internalTransport._webStandardTransport;
-            if (webStandardTransport) {
-                webStandardTransport.sessionId = sessionId;
-                return { success: true };
-            }
-            return {
-                success: false,
-                error: 'No webStandardTransport found - SDK internal structure may have changed or transport is not properly initialized',
-            };
-        }
-        catch (error) {
-            const errorMessage = error instanceof Error ? error.message : String(error);
-            logger.warn(`Failed to set sessionId "${sessionId}" on underlying transport: ${errorMessage}`);
-            return { success: false, error: errorMessage };
-        }
-    }
-    /**
-     * Override sessionId getter to return restored sessionId if available.
-     *
-     * This ensures that even if the underlying transport hasn't generated the sessionId yet,
-     * we return the correct restored sessionId. If no restored session ID exists, delegates
-     * to the parent class's getter by manually accessing the property descriptor.
-     *
-     * @remarks
-     * We cannot use `super.sessionId` directly because this override shadows the parent's
-     * getter. Instead, we use Object.getOwnPropertyDescriptor to access the parent's
-     * property descriptor and call its getter with the correct context.
-     *
-     * Type assertion to `object` is safe here because we know the prototype chain exists:
-     * this -> RestorableStreamableHTTPServerTransport -> StreamableHTTPServerTransport -> Object.prototype
-     * Object.getOwnPropertyDescriptor requires an object type, and TypeScript cannot infer this
-     * from the double getPrototypeOf call.
-     */
-    get sessionId() {
-        // First check if we have a restored sessionId
-        if (this._restoredSessionId) {
-            return this._restoredSessionId;
-        }
-        // Otherwise delegate to parent class's getter directly
-        // Use Object.getOwnPropertyDescriptor to get the parent's property descriptor
-        // and call the getter with the parent's context
-        // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
-        const proto = Object.getPrototypeOf(Object.getPrototypeOf(this));
-        if (!proto)
-            return undefined;
-        const descriptor = Object.getOwnPropertyDescriptor(proto, 'sessionId');
-        if (descriptor?.get) {
-            // eslint-disable-next-line @typescript-eslint/no-unsafe-return
-            return descriptor.get.call(this);
-        }
-        return undefined;
-    }
-    /**
-     * Marks the transport as initialized for restored sessions.
-     *
-     * When restoring a session, the client won't send an initialize request again
-     * because from the client's perspective, the session is already initialized.
-     * The MCP SDK checks the _initialized flag and rejects requests if it's false.
-     * This method safely sets that flag to allow the restored session to work.
-     *
-     * @returns OperationResult indicating success or failure with error details
+     * This should be called after successful virtual initialization to indicate
+     * that the transport is ready to handle requests for a restored session.
      */
-    markAsInitialized() {
-        try {
-            // Use type-safe interface to access internal SDK properties
-            // MCP SDK private property _initialized is not exposed in public types
-            const internalTransport = this;
-            // Accessing private SDK property for session restoration functionality
-            if (internalTransport._initialized !== undefined) {
-                // Setting private SDK property to mark session as initialized for restoration
-                internalTransport._initialized = true;
-            }
-            // Note: If _initialized is undefined, we still mark as restored since the SDK may have changed
-            // This provides graceful degradation while allowing session restoration to proceed
-            this._isRestored = true;
-            logger.debug('Transport marked as initialized for restored session');
-            return { success: true };
-        }
-        catch (error) {
-            const errorMessage = error instanceof Error ? error.message : String(error);
-            logger.warn(`Failed to mark transport as initialized: ${errorMessage}`);
-            this._isRestored = false;
-            return { success: false, error: errorMessage };
-        }
+    markAsRestored() {
+        this._isRestored = true;
     }
     /**
      * Returns whether this transport was created for a restored session.
@@ -143,12 +50,9 @@ export class RestorableStreamableHTTPServerTransport extends StreamableHTTPServe
      * @returns Object containing restoration metadata
      */
     getRestorationInfo() {
-        // Use type-safe interface to access potentially private sessionId
-        const internalTransport = this;
         return {
             isRestored: this._isRestored,
-            // Accessing potentially private sessionId property for debugging
-            sessionId: internalTransport.sessionId,
+            sessionId: this.sessionId,
         };
     }
 }

package/build/transport/http/restorableStreamableTransport.js.map

@@ -1 +1 @@
-{"version":3,"file":"restorableStreamableTransport.js","sourceRoot":"","sources":["../../../src/transport/http/restorableStreamableTransport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAEnG,OAAO,MAAM,MAAM,uBAAuB,CAAC;AAkB3C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,OAAO,uCAAwC,SAAQ,6BAA6B;IAChF,WAAW,GAAG,KAAK,CAAC;IACpB,kBAAkB,CAAU;IAEpC;;;;;;;;;OASG;IACH,YAAY,CAAC,SAAiB;QAC5B,IAAI,CAAC,kBAAkB,GAAG,SAAS,CAAC;QACpC,IAAI,CAAC;YACH,wEAAwE;YACxE,wEAAwE;YACxE,wEAAwE;YACxE,MAAM,iBAAiB,GAAG,IAA8C,CAAC;YACzE,MAAM,oBAAoB,GAAG,iBAAiB,CAAC,qBAAqB,CAAC;YACrE,IAAI,oBAAoB,EAAE,CAAC;gBACzB,oBAAoB,CAAC,SAAS,GAAG,SAAS,CAAC;gBAC3C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC3B,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EACH,kHAAkH;aACrH,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5E,MAAM,CAAC,IAAI,CAAC,4BAA4B,SAAS,8BAA8B,YAAY,EAAE,CAAC,CAAC;YAC/F,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;QACjD,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,IAAa,SAAS;QACpB,8CAA8C;QAC9C,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,kBAAkB,CAAC;QACjC,CAAC;QACD,uDAAuD;QACvD,8EAA8E;QAC9E,gDAAgD;QAChD,mEAAmE;QACnE,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;QACjE,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QACvE,IAAI,UAAU,EAAE,GAAG,EAAE,CAAC;YACpB,+DAA+D;YAC/D,OAAO,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;;;OASG;IACH,iBAAiB;QACf,IAAI,CAAC;YACH,4DAA4D;YAC5D,uEAAuE;YACvE,MAAM,iBAAiB,GAAG,IAA8C,CAAC;YAEzE,uEAAuE;YACvE,IAAI,iBAAiB,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACjD,8EAA8E;gBAC9E,iBAAiB,CAAC,YAAY,GAAG,IAAI,CAAC;YACxC,CAAC;YACD,+FAA+F;YAC/F,mFAAmF;YAEnF,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YACxB,MAAM,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAC;YACrE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5E,MAAM,CAAC,IAAI,CAAC,4CAA4C,YAAY,EAAE,CAAC,CAAC;YACxE,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;YACzB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;QACjD,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,UAAU;QACR,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED;;;;OAIG;IACH,kBAAkB;QAChB,kEAAkE;QAClE,MAAM,iBAAiB,GAAG,IAA8C,CAAC;QAEzE,OAAO;YACL,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,iEAAiE;YACjE,SAAS,EAAE,iBAAiB,CAAC,SAAS;SACvC,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"restorableStreamableTransport.js","sourceRoot":"","sources":["../../../src/transport/http/restorableStreamableTransport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAWnG;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,OAAO,uCAAwC,SAAQ,6BAA6B;IAChF,WAAW,GAAG,KAAK,CAAC;IAE5B;;;;;OAKG;IACH,cAAc;QACZ,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IAC1B,CAAC;IAED;;;;OAIG;IACH,UAAU;QACR,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED;;;;OAIG;IACH,kBAAkB;QAChB,OAAO;YACL,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;IACJ,CAAC;CACF"}

package/build/transport/http/routes/sseRoutes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sseRoutes.d.ts","sourceRoot":"","sources":["../../../../src/transport/http/routes/sseRoutes.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,wBAAwB,EAAE,MAAM,oDAAoD,CAAC;AAC9F,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAYlE,OAAO,EAAW,cAAc,EAAY,MAAM,EAAE,MAAM,SAAS,CAAC;AAEpE,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,aAAa,EAC5B,cAAc,EAAE,cAAc,EAC9B,sBAAsB,CAAC,EAAE,cAAc,EACvC,iBAAiB,CAAC,EAAE,wBAAwB,EAC5C,cAAc,CAAC,EAAE,MAAM,GACtB,IAAI,CA6GN"}
+{"version":3,"file":"sseRoutes.d.ts","sourceRoot":"","sources":["../../../../src/transport/http/routes/sseRoutes.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,wBAAwB,EAAE,MAAM,oDAAoD,CAAC;AAC9F,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAalE,OAAO,EAAW,cAAc,EAAY,MAAM,EAAE,MAAM,SAAS,CAAC;AAEpE,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,aAAa,EAC5B,cAAc,EAAE,cAAc,EAC9B,sBAAsB,CAAC,EAAE,cAAc,EACvC,iBAAiB,CAAC,EAAE,wBAAwB,EAC5C,cAAc,CAAC,EAAE,MAAM,GACtB,IAAI,CA6GN"}

package/build/transport/http/routes/sseRoutes.js

@@ -3,6 +3,7 @@ import { ErrorCode } from '@modelcontextprotocol/sdk/types.js';
 import { MESSAGES_ENDPOINT, SSE_ENDPOINT } from '../../../constants.js';
 import { ServerStatus } from '../../../core/types/index.js';
 import logger from '../../../logger/logger.js';
+import { LoggingSSEServerTransport } from '../../../transport/http/loggingSseTransport.js';
 import { getPresetName, getTagExpression, getTagFilterMode, getTagQuery, getValidatedTags, } from '../../../transport/http/middlewares/scopeAuthMiddleware.js';
 import tagsExtractor from '../../../transport/http/middlewares/tagsExtractor.js';
 export function setupSseRoutes(router, serverManager, authMiddleware, availabilityMiddleware, asyncOrchestrator, customTemplate) {
@@ -13,7 +14,7 @@ export function setupSseRoutes(router, serverManager, authMiddleware, availabili
     }
     router.get(SSE_ENDPOINT, ...middlewares, async (req, res) => {
         try {
-            const transport = new SSEServerTransport(MESSAGES_ENDPOINT, res);
+            const transport = new LoggingSSEServerTransport(MESSAGES_ENDPOINT, res);
             // Use validated tags and tag expression from scope auth middleware
             const tags = getValidatedTags(res);
             const tagExpression = getTagExpression(res);

package/build/transport/http/routes/sseRoutes.js.map

@@ -1 +1 @@
-{"version":3,"file":"sseRoutes.js","sourceRoot":"","sources":["../../../../src/transport/http/routes/sseRoutes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7E,OAAO,EAAE,SAAS,EAAE,MAAM,oCAAoC,CAAC;AAE/D,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAGpE,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,MAAM,MAAM,uBAAuB,CAAC;AAC3C,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,WAAW,EACX,gBAAgB,GACjB,MAAM,wDAAwD,CAAC;AAChE,OAAO,aAAa,MAAM,kDAAkD,CAAC;AAI7E,MAAM,UAAU,cAAc,CAC5B,MAAc,EACd,aAA4B,EAC5B,cAA8B,EAC9B,sBAAuC,EACvC,iBAA4C,EAC5C,cAAuB;IAEvB,MAAM,WAAW,GAAG,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;IAEpD,0CAA0C;IAC1C,IAAI,sBAAsB,EAAE,CAAC;QAC3B,WAAW,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,WAAW,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC7E,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;YAEjE,mEAAmE;YACnE,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACnC,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YAC5C,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YAC5C,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;YAClC,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;YAEtC,iDAAiD;YACjD,MAAM,aAAa,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE;gBACnE,IAAI;gBACJ,aAAa;gBACb,aAAa;gBACb,QAAQ;gBACR,UAAU;gBACV,gBAAgB,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,MAAM;gBACjD,cAAc;aACf,CAAC,CAAC;YAEH,wDAAwD;YACxD,IAAI,iBAAiB,EAAE,CAAC;gBACtB,MAAM,iBAAiB,GAAG,aAAa,CAAC,SAAS,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;gBACvE,IAAI,iBAAiB,EAAE,CAAC;oBACtB,iBAAiB,CAAC,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;oBAC7D,MAAM,CAAC,KAAK,CAAC,2DAA2D,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC;gBACjG,CAAC;YACH,CAAC;YAED,kDAAkD;YAClD,MAAM,iBAAiB,GAAG,WAAW,CAAC,GAAG,EAAE;gBACzC,IAAI,CAAC;oBACH,4DAA4D;oBAC5D,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBAC/B,CAAC;gBAAC,OAAO,MAAM,EAAE,CAAC;oBAChB,kDAAkD;oBAClD,MAAM,CAAC,KAAK,CAAC,oCAAoC,SAAS,CAAC,SAAS,sBAAsB,CAAC,CAAC;oBAC5F,aAAa,CAAC,iBAAiB,CAAC,CAAC;oBACjC,aAAa,CAAC,mBAAmB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;gBACzD,CAAC;YACH,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,kCAAkC;YAE7C,SAAS,CAAC,OAAO,GAAG,GAAG,EAAE;gBACvB,aAAa,CAAC,iBAAiB,CAAC,CAAC;gBACjC,aAAa,CAAC,mBAAmB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;gBACvD,qDAAqD;YACvD,CAAC,CAAC;YAEF,SAAS,CAAC,OAAO,GAAG,CAAC,KAAK,EAAE,EAAE;gBAC5B,aAAa,CAAC,iBAAiB,CAAC,CAAC;gBACjC,MAAM,CAAC,KAAK,CAAC,mCAAmC,SAAS,CAAC,SAAS,GAAG,EAAE,KAAK,CAAC,CAAC;gBAC/E,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;gBAC5D,IAAI,MAAM,EAAE,CAAC;oBACX,MAAM,CAAC,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC;oBACnC,MAAM,CAAC,SAAS,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC/E,CAAC;YACH,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;YAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,WAAW,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACnF,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,SAAmB,CAAC;YAChD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE;wBACL,IAAI,EAAE,SAAS,CAAC,aAAa;wBAC7B,OAAO,EAAE,uCAAuC;qBACjD;iBACF,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,MAAM,SAAS,GAAG,aAAa,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;YAExD,IAAI,SAAS,YAAY,kBAAkB,EAAE,CAAC;gBAC5C,MAAM,SAAS,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;gBACtD,OAAO;YACT,CAAC;YAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE;oBACL,IAAI,EAAE,SAAS,CAAC,aAAa;oBAC7B,OAAO,EAAE,qBAAqB;iBAC/B;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;YAC/C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE;oBACL,IAAI,EAAE,SAAS,CAAC,aAAa;oBAC7B,OAAO,EAAE,uBAAuB;iBACjC;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"sseRoutes.js","sourceRoot":"","sources":["../../../../src/transport/http/routes/sseRoutes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7E,OAAO,EAAE,SAAS,EAAE,MAAM,oCAAoC,CAAC;AAE/D,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAGpE,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,MAAM,MAAM,uBAAuB,CAAC;AAC3C,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,WAAW,EACX,gBAAgB,GACjB,MAAM,wDAAwD,CAAC;AAChE,OAAO,aAAa,MAAM,kDAAkD,CAAC;AAI7E,MAAM,UAAU,cAAc,CAC5B,MAAc,EACd,aAA4B,EAC5B,cAA8B,EAC9B,sBAAuC,EACvC,iBAA4C,EAC5C,cAAuB;IAEvB,MAAM,WAAW,GAAG,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;IAEpD,0CAA0C;IAC1C,IAAI,sBAAsB,EAAE,CAAC;QAC3B,WAAW,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,WAAW,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC7E,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,yBAAyB,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;YAExE,mEAAmE;YACnE,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACnC,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YAC5C,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YAC5C,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;YAClC,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;YAEtC,iDAAiD;YACjD,MAAM,aAAa,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE;gBACnE,IAAI;gBACJ,aAAa;gBACb,aAAa;gBACb,QAAQ;gBACR,UAAU;gBACV,gBAAgB,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,MAAM;gBACjD,cAAc;aACf,CAAC,CAAC;YAEH,wDAAwD;YACxD,IAAI,iBAAiB,EAAE,CAAC;gBACtB,MAAM,iBAAiB,GAAG,aAAa,CAAC,SAAS,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;gBACvE,IAAI,iBAAiB,EAAE,CAAC;oBACtB,iBAAiB,CAAC,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;oBAC7D,MAAM,CAAC,KAAK,CAAC,2DAA2D,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC;gBACjG,CAAC;YACH,CAAC;YAED,kDAAkD;YAClD,MAAM,iBAAiB,GAAG,WAAW,CAAC,GAAG,EAAE;gBACzC,IAAI,CAAC;oBACH,4DAA4D;oBAC5D,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBAC/B,CAAC;gBAAC,OAAO,MAAM,EAAE,CAAC;oBAChB,kDAAkD;oBAClD,MAAM,CAAC,KAAK,CAAC,oCAAoC,SAAS,CAAC,SAAS,sBAAsB,CAAC,CAAC;oBAC5F,aAAa,CAAC,iBAAiB,CAAC,CAAC;oBACjC,aAAa,CAAC,mBAAmB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;gBACzD,CAAC;YACH,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,kCAAkC;YAE7C,SAAS,CAAC,OAAO,GAAG,GAAG,EAAE;gBACvB,aAAa,CAAC,iBAAiB,CAAC,CAAC;gBACjC,aAAa,CAAC,mBAAmB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;gBACvD,qDAAqD;YACvD,CAAC,CAAC;YAEF,SAAS,CAAC,OAAO,GAAG,CAAC,KAAK,EAAE,EAAE;gBAC5B,aAAa,CAAC,iBAAiB,CAAC,CAAC;gBACjC,MAAM,CAAC,KAAK,CAAC,mCAAmC,SAAS,CAAC,SAAS,GAAG,EAAE,KAAK,CAAC,CAAC;gBAC/E,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;gBAC5D,IAAI,MAAM,EAAE,CAAC;oBACX,MAAM,CAAC,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC;oBACnC,MAAM,CAAC,SAAS,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC/E,CAAC;YACH,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;YAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,WAAW,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACnF,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,SAAmB,CAAC;YAChD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE;wBACL,IAAI,EAAE,SAAS,CAAC,aAAa;wBAC7B,OAAO,EAAE,uCAAuC;qBACjD;iBACF,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,MAAM,SAAS,GAAG,aAAa,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;YAExD,IAAI,SAAS,YAAY,kBAAkB,EAAE,CAAC;gBAC5C,MAAM,SAAS,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;gBACtD,OAAO;YACT,CAAC;YAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE;oBACL,IAAI,EAAE,SAAS,CAAC,aAAa;oBAC7B,OAAO,EAAE,qBAAqB;iBAC/B;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;YAC/C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE;oBACL,IAAI,EAAE,SAAS,CAAC,aAAa;oBAC7B,OAAO,EAAE,uBAAuB;iBACjC;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/build/transport/http/routes/streamableHttpRoutes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"streamableHttpRoutes.d.ts","sourceRoot":"","sources":["../../../../src/transport/http/routes/streamableHttpRoutes.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,wBAAwB,EAAE,MAAM,oDAAoD,CAAC;AAC9F,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAWlE,OAAO,EAAE,2BAA2B,EAAE,MAAM,4DAA4D,CAAC;AAEzG,OAAO,EAAE,cAAc,EAAE,MAAM,6CAA6C,CAAC;AAE7E,OAAO,EAAW,cAAc,EAAY,MAAM,EAAE,MAAM,SAAS,CAAC;AAsDpE,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,aAAa,EAC5B,iBAAiB,EAAE,2BAA2B,EAC9C,cAAc,EAAE,cAAc,EAC9B,sBAAsB,CAAC,EAAE,cAAc,EACvC,iBAAiB,CAAC,EAAE,wBAAwB,EAC5C,cAAc,CAAC,EAAE,MAAM,EACvB,sBAAsB,CAAC,EAAE,cAAc,GACtC,IAAI,CAqJN"}
+{"version":3,"file":"streamableHttpRoutes.d.ts","sourceRoot":"","sources":["../../../../src/transport/http/routes/streamableHttpRoutes.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,wBAAwB,EAAE,MAAM,oDAAoD,CAAC;AAC9F,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAWlE,OAAO,EAAE,2BAA2B,EAAE,MAAM,4DAA4D,CAAC;AAGzG,OAAO,EAAE,cAAc,EAAE,MAAM,6CAA6C,CAAC;AAG7E,OAAO,EAAW,cAAc,EAAY,MAAM,EAAE,MAAM,SAAS,CAAC;AA2JpE,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,aAAa,EAC5B,iBAAiB,EAAE,2BAA2B,EAC9C,cAAc,EAAE,cAAc,EAC9B,sBAAsB,CAAC,EAAE,cAAc,EACvC,iBAAiB,CAAC,EAAE,wBAAwB,EAC5C,cAAc,CAAC,EAAE,MAAM,EACvB,sBAAsB,CAAC,EAAE,cAAc,GACtC,IAAI,CAyKN"}

package/build/transport/http/routes/streamableHttpRoutes.js

@@ -1,11 +1,100 @@
 import { randomUUID } from 'node:crypto';
-import { ErrorCode } from '@modelcontextprotocol/sdk/types.js';
-import { AUTH_CONFIG, STREAMABLE_HTTP_ENDPOINT } from '../../../constants.js';
+import { AUTH_CONFIG, MCP_SERVER_NAME, MCP_SERVER_VERSION, STREAMABLE_HTTP_ENDPOINT } from '../../../constants.js';
 import logger from '../../../logger/logger.js';
 import { getPresetName, getTagExpression, getTagFilterMode, getTagQuery, getValidatedTags, } from '../../../transport/http/middlewares/scopeAuthMiddleware.js';
 import tagsExtractor from '../../../transport/http/middlewares/tagsExtractor.js';
+import { RestorableStreamableHTTPServerTransport } from '../../../transport/http/restorableStreamableTransport.js';
 import { extractContextFromMeta } from '../../../transport/http/utils/contextExtractor.js';
+import { sendBadRequest, sendInternalError, sendNotFound } from '../../../transport/http/utils/httpErrorHandler.js';
 import { SessionService } from '../../../transport/http/utils/sessionService.js';
+import { logError, logWarn } from '../../../transport/http/utils/unifiedLogger.js';
+/**
+ * Type guard to check if a request body is an initialize request.
+ */
+function isInitializeRequest(body) {
+    return (typeof body === 'object' &&
+        body !== null &&
+        'method' in body &&
+        body.method === 'initialize' &&
+        'jsonrpc' in body &&
+        body.jsonrpc === '2.0');
+}
+/**
+ * Extract protocol version from initialize request body.
+ * Similar to contextExtractor pattern - extract directly from req.body.params
+ */
+function extractProtocolVersion(body) {
+    try {
+        const reqBody = body;
+        if (reqBody?.params?.protocolVersion && typeof reqBody.params.protocolVersion === 'string') {
+            return reqBody.params.protocolVersion;
+        }
+        return null;
+    }
+    catch (error) {
+        logWarn('Failed to extract protocol version from request body', {
+            reason: 'Request body structure incompatible',
+            context: { error },
+        });
+        return null;
+    }
+}
+/**
+ * Wraps an Express response to log when status >= 400 is set.
+ * This catches SDK responses that don't throw errors.
+ */
+function wrapResponseForLogging(req, res, sessionId) {
+    const originalStatus = res.status.bind(res);
+    const originalJson = res.json.bind(res);
+    let logged = false;
+    const logIfNeeded = (responseBody) => {
+        if (logged || res.statusCode < 400)
+            return;
+        logged = true;
+        const level = res.statusCode >= 500 ? 'error' : 'warn';
+        const logFn = level === 'error' ? logError : logWarn;
+        logFn(`HTTP error ${res.statusCode}`, {
+            method: req.method,
+            path: req.path,
+            sessionId,
+            statusCode: res.statusCode,
+            reason: 'SDK request validation failed',
+        });
+        // Log request/response details at debug level for troubleshooting
+        logger.debug('SDK error details', {
+            sessionId,
+            requestBody: req.body,
+            responseBody,
+        });
+    };
+    // Intercept res.status() to detect when error codes are set
+    res.status = function (code) {
+        const result = originalStatus(code);
+        if (code >= 400) {
+            logIfNeeded();
+        }
+        return result;
+    };
+    // Intercept res.json() to capture response body for error logging
+    res.json = function (body) {
+        if (res.statusCode >= 400) {
+            logIfNeeded(body);
+        }
+        return originalJson(body);
+    };
+    // Intercept res.writeHead() - SDK uses this via Hono adapter
+    /* eslint-disable @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument */
+    const origWriteHead = res.writeHead.bind(res);
+    res.writeHead = function (statusCode, ...rest) {
+        if (statusCode >= 400) {
+            res.statusCode = statusCode;
+            logIfNeeded();
+        }
+        return origWriteHead(statusCode, ...rest);
+    };
+    /* eslint-enable @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument */
+    return res;
+}
 /**
  * Builds the inbound connection config from request data.
  *
@@ -63,10 +152,12 @@ export function setupStreamableHttpRoutes(router, serverManager, sessionReposito
     router.post(STREAMABLE_HTTP_ENDPOINT, ...middlewares, async (req, res) => {
         try {
             let transport;
+            let actualSessionId;
             const sessionId = req.headers['mcp-session-id'];
             if (!sessionId) {
                 // Generate new session ID
                 const id = AUTH_CONFIG.SERVER.STREAMABLE_SESSION.ID_PREFIX + randomUUID();
+                actualSessionId = id;
                 const config = buildConfigFromRequest(res, req, customTemplate);
                 // Extract context from _meta field (from STDIO proxy)
                 const context = extractContextFromMeta(req);
@@ -78,31 +169,69 @@ export function setupStreamableHttpRoutes(router, serverManager, sessionReposito
                 }
             }
             else {
+                actualSessionId = sessionId;
                 transport = await sessionService.getSession(sessionId);
                 if (!transport) {
-                    // Session restoration failed - create new session with provided ID (handles proxy use case)
-                    logger.error(`Session restoration failed for ${sessionId}, creating new session as fallback`);
-                    const config = buildConfigFromRequest(res, req, customTemplate);
-                    // Extract context from _meta field (from STDIO proxy)
-                    const context = extractContextFromMeta(req);
-                    const createResult = await sessionService.createSession(config, context || undefined, sessionId);
-                    transport = createResult.transport;
-                    // Log warning if session was not persisted
-                    if (!createResult.persisted) {
-                        logger.warn(`Fallback session ${sessionId} was created but not persisted: ${createResult.persistenceError}`);
+                    // Session doesn't exist - only allow creation via initialize request
+                    if (isInitializeRequest(req.body)) {
+                        // Allow creating new session with specific ID via initialize
+                        logger.info(`Creating new session ${sessionId} via initialize request`);
+                        const config = buildConfigFromRequest(res, req, customTemplate);
+                        // Extract context from _meta field (from STDIO proxy)
+                        const context = extractContextFromMeta(req);
+                        const createResult = await sessionService.createSession(config, context || undefined, sessionId);
+                        transport = createResult.transport;
+                        // Log warning if session was not persisted
+                        if (!createResult.persisted) {
+                            logger.warn(`New session ${sessionId} was created but not persisted: ${createResult.persistenceError}`);
+                        }
                     }
+                    else {
+                        // Non-initialize request for non-existent session → 404
+                        sendNotFound(res, 'Session not found. Send an initialize request first to create a new session.', {
+                            sessionId,
+                        });
+                        return;
+                    }
+                }
+            }
+            // Wrap response to catch SDK errors
+            const wrappedRes = wrapResponseForLogging(req, res, actualSessionId);
+            // Check if this is an initialize request
+            const isInitialize = isInitializeRequest(req.body);
+            const protocolVersion = isInitialize ? extractProtocolVersion(req.body) : null;
+            // Log request details for debugging restored sessions
+            if (transport instanceof RestorableStreamableHTTPServerTransport && transport.isRestored()) {
+                logger.debug('Handling request for restored session', {
+                    sessionId: actualSessionId,
+                    isInitialize,
+                    method: req.body?.method,
+                });
+            }
+            await transport.handleRequest(req, wrappedRes, req.body);
+            // After handleRequest completes for initialize, store the response data
+            if (isInitialize && protocolVersion) {
+                try {
+                    // Store minimal initialize response data for session restoration
+                    // The exact capabilities don't matter for restoration - we just need protocol version and server info
+                    sessionService.storeInitializeResponse(actualSessionId, {
+                        protocolVersion,
+                        capabilities: {}, // Minimal capabilities - actual capabilities are aggregated dynamically
+                        serverInfo: { name: MCP_SERVER_NAME, version: MCP_SERVER_VERSION },
+                    });
+                    logger.debug(`Stored initialize response for session ${actualSessionId}`);
+                }
+                catch (err) {
+                    logger.warn(`Failed to store initialize response for ${actualSessionId}:`, err);
                 }
             }
-            await transport.handleRequest(req, res, req.body);
         }
         catch (error) {
-            const errorMessage = error instanceof Error ? error.message : String(error);
-            logger.error('Streamable HTTP POST error:', { error: errorMessage, sessionId: req.headers['mcp-session-id'] });
-            res.status(500).json({
-                error: {
-                    code: ErrorCode.InternalError,
-                    message: 'An internal server error occurred while processing the request',
-                },
+            sendInternalError(res, error, {
+                method: req.method,
+                path: req.path,
+                sessionId: req.headers['mcp-session-id'],
+                phase: 'handleRequest',
             });
         }
     });
@@ -110,36 +239,26 @@ export function setupStreamableHttpRoutes(router, serverManager, sessionReposito
         try {
             const sessionId = req.headers['mcp-session-id'];
             if (!sessionId) {
-                res.status(400).json({
-                    error: {
-                        code: ErrorCode.InvalidParams,
-                        message: 'Invalid params: sessionId is required',
-                    },
-                });
+                sendBadRequest(res, 'Invalid params: sessionId is required');
                 return;
             }
             const transport = await sessionService.getSession(sessionId);
             if (!transport) {
-                res.status(404).json({
-                    error: {
-                        code: ErrorCode.InvalidParams,
-                        message: 'No active streamable HTTP session found for the provided sessionId',
-                    },
-                });
+                sendNotFound(res, 'No active streamable HTTP session found for the provided sessionId', { sessionId });
                 return;
             }
             // Set up disconnect detection for SSE stream (GET endpoint maintains persistent connection)
             setupDisconnectDetection(req, res, sessionId, serverManager);
-            await transport.handleRequest(req, res, req.body);
+            // Wrap response to catch SDK errors
+            const wrappedRes = wrapResponseForLogging(req, res, sessionId);
+            await transport.handleRequest(req, wrappedRes, req.body);
         }
         catch (error) {
-            const errorMessage = error instanceof Error ? error.message : String(error);
-            logger.error('Streamable HTTP GET error:', { error: errorMessage, sessionId: req.headers['mcp-session-id'] });
-            res.status(500).json({
-                error: {
-                    code: ErrorCode.InternalError,
-                    message: 'An internal server error occurred while processing the request',
-                },
+            sendInternalError(res, error, {
+                method: req.method,
+                path: req.path,
+                sessionId: req.headers['mcp-session-id'],
+                phase: 'handleRequest',
             });
         }
     });
@@ -147,36 +266,26 @@ export function setupStreamableHttpRoutes(router, serverManager, sessionReposito
         try {
             const sessionId = req.headers['mcp-session-id'];
             if (!sessionId) {
-                res.status(400).json({
-                    error: {
-                        code: ErrorCode.InvalidParams,
-                        message: 'Invalid params: sessionId is required',
-                    },
-                });
+                sendBadRequest(res, 'Invalid params: sessionId is required');
                 return;
             }
             const transport = await sessionService.getSession(sessionId);
             if (!transport) {
-                res.status(404).json({
-                    error: {
-                        code: ErrorCode.InvalidParams,
-                        message: 'No active streamable HTTP session found for the provided sessionId',
-                    },
-                });
+                sendNotFound(res, 'No active streamable HTTP session found for the provided sessionId', { sessionId });
                 return;
             }
-            await transport.handleRequest(req, res);
+            // Wrap response to catch SDK errors
+            const wrappedRes = wrapResponseForLogging(req, res, sessionId);
+            await transport.handleRequest(req, wrappedRes);
             // Delete session from storage after explicit delete request
             await sessionService.deleteSession(sessionId);
         }
         catch (error) {
-            const errorMessage = error instanceof Error ? error.message : String(error);
-            logger.error('Streamable HTTP DELETE error:', { error: errorMessage, sessionId: req.headers['mcp-session-id'] });
-            res.status(500).json({
-                error: {
-                    code: ErrorCode.InternalError,
-                    message: 'An internal server error occurred while processing the request',
-                },
+            sendInternalError(res, error, {
+                method: req.method,
+                path: req.path,
+                sessionId: req.headers['mcp-session-id'],
+                phase: 'handleRequest',
             });
         }
     });