@carbonvoice/cv-mcp-server 1.1.3 → 2.1.0

package/dist/transports/http/streamable.js

@@ -13,46 +13,15 @@ const streamableHttp_js_1 = require("@modelcontextprotocol/sdk/server/streamable
 const types_js_1 = require("@modelcontextprotocol/sdk/types.js");
 const _1 = require(".");
 const constants_1 = require("./constants");
+const session_1 = require("./session");
+const session_config_1 = require("./session/session.config");
 const utils_1 = require("./utils");
-const auth_middleware_1 = require("../../auth/auth-middleware");
+const auth_1 = require("../../auth");
 const config_1 = require("../../config");
-const constants_2 = require("../../constants");
 const cv_api_1 = require("../../cv-api");
 const server_1 = __importDefault(require("../../server"));
 const utils_2 = require("../../utils");
 const app = (0, express_1.default)();
-const SESSION_TTL_MS = 1000 * 60 * 60 * 1; // 1 hour
-/**
- * Sets standard headers for all requests.
- * @param _req - The request.
- * @param res - The response.
- * @param next - The next handler.
- */
-function standardHeaders(_req, res, next) {
-    // Disables all caching
-    res.set('Cache-Control', 'no-store, no-cache, must-revalidate');
-    res.set('Pragma', 'no-cache');
-    // if (getConfig().baseUrl.startsWith('https://')) {
-    //   // Only connect to this site and subdomains via HTTPS for the next two years
-    //   // and also include in the preload list
-    //   res.set('Strict-Transport-Security', 'max-age=63072000; includeSubDomains; preload');
-    // }
-    // Set Content Security Policy
-    // As an API server, block everything
-    // See: https://stackoverflow.com/a/45631261/2051724
-    res.set('Content-Security-Policy', "default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none';");
-    // Disable browser features
-    res.set('Permissions-Policy', 'accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()');
-    // Never send the Referer header
-    res.set('Referrer-Policy', 'no-referrer');
-    // Prevent browsers from incorrectly detecting non-scripts as scripts
-    res.set('X-Content-Type-Options', 'nosniff');
-    // Disallow attempts to iframe site
-    res.set('X-Frame-Options', 'DENY');
-    // Block pages from loading when they detect reflected XSS attacks
-    res.set('X-XSS-Protection', '1; mode=block');
-    next();
-}
 app.set('x-powered-by', false);
 // Trust proxy for rate limiting - only trust localhost and private networks
 app.set('trust proxy', ['loopback', 'linklocal', 'uniquelocal']);
@@ -69,75 +38,18 @@ app.use((0, express_rate_limit_1.default)({
 app.use(express_1.default.json({ limit: '1mb' }));
 // Add request ID middleware
 app.use(_1.addRequestIdMiddleware);
-// Request logging middleware
+// Request logging middleware (includes session metrics)
 app.use(_1.logRequest);
 let carbonVoiceApiHealth = {
     isHealthy: false,
     lastChecked: new Date().toISOString(),
+    apiUrl: config_1.env.CARBON_VOICE_BASE_URL,
 };
-const sessions = new Map();
-function createSession(transport, req, sessionId) {
-    var _a, _b, _c, _d, _e, _f;
-    // Should never happen
-    if (!((_b = (_a = req.auth) === null || _a === void 0 ? void 0 : _a.extra) === null || _b === void 0 ? void 0 : _b.user)) {
-        throw new Error('User not found in session creation');
-    }
-    // const sessionId = getOrCreateSessionId(req);
-    // Clean up after TTL
-    const timeout = setTimeout(() => {
-        utils_2.logger.info('⏰ Session timeout triggered', { sessionId });
-        destroySession(sessionId);
-    }, SESSION_TTL_MS);
-    const userId = (_d = (_c = req.auth) === null || _c === void 0 ? void 0 : _c.extra) === null || _d === void 0 ? void 0 : _d.user.id;
-    sessions.set(sessionId, {
-        transport,
-        timeout,
-        userId,
-        metrics: {
-            sessionId,
-            userId,
-            createdAt: new Date(),
-            expiresAt: new Date(Date.now() + SESSION_TTL_MS),
-            totalInteractions: 0,
-            totalToolCalls: 0,
-        },
-    });
-    utils_2.logger.info('🆕 Session created', {
-        sessionId,
-        userId: (_f = (_e = req.auth) === null || _e === void 0 ? void 0 : _e.extra) === null || _f === void 0 ? void 0 : _f.user.id,
-    });
-    return sessionId;
-}
-function destroySession(sessionId) {
-    utils_2.logger.info('🔚 Destroying session', { sessionId });
-    const session = sessions.get(sessionId);
-    if (session && !session.destroying) {
-        // Mark session as being destroyed to prevent recursive calls
-        session.destroying = true;
-        const {} = session.metrics;
-        clearTimeout(session.timeout);
-        session.transport.close();
-        sessions.delete(sessionId);
-        const durationInSeconds = (new Date().getTime() - session.metrics.createdAt.getTime()) / 1000;
-        utils_2.logger.info('❌ Session destroyed', {
-            sessionId,
-            duration: (0, utils_2.formatTimeToHuman)(durationInSeconds),
-            createdAt: session.metrics.createdAt.toISOString(),
-            expiresAt: session.metrics.expiresAt.toISOString(),
-            totalInteractions: session.metrics.totalInteractions,
-            totalToolCalls: session.metrics.totalToolCalls,
-            userId: session.userId,
-        });
-    }
-    else if (session === null || session === void 0 ? void 0 : session.destroying) {
-        utils_2.logger.debug('Session already being destroyed, skipping', { sessionId });
-    }
-}
 app.get('/health', (req, res) => {
     const response = {
         status: carbonVoiceApiHealth.isHealthy ? 'healthy' : 'degraded',
         timestamp: new Date().toISOString(),
-        uptime: (0, utils_2.formatProcessUptime)(),
+        uptime: (0, utils_2.getProcessUptime)(),
         dependencies: {
             carbonVoiceApi: {
                 status: carbonVoiceApiHealth.isHealthy ? 'healthy' : 'unhealthy',
@@ -177,111 +89,142 @@ app.head('/', _1.logRequest, (req, res) => {
         .set('MCP-Protocol-Version', mcpProtocolVersion)
         .end();
 });
-// Single shared transport for all requests
-// const sharedTransport = new StreamableHTTPServerTransport({
-//   sessionIdGenerator: undefined, // Stateless
-//   enableJsonResponse: true,
-// });
-// Add error handling
-// sharedTransport.onerror = (error) => {
-//   logger.error('🚨 Transport error', { error: error.message });
-// };
-// sharedTransport.onclose = () => {
-//   logger.info('🔴 Transport closed for all requests');
-// };
 async function handleSessionRequest(req, res, session) {
-    var _a, _b, _c, _d;
-    if (!session) {
-        utils_2.logger.warn('❌ Session ID not found', {
-            sessionId: (0, utils_1.getOrCreateSessionId)(req),
-            userId: (_c = (_b = (_a = req.auth) === null || _a === void 0 ? void 0 : _a.extra) === null || _b === void 0 ? void 0 : _b.user) === null || _c === void 0 ? void 0 : _c.id,
-            headers: req.headers,
-        });
-        res.status(404).json({
-            jsonrpc: '2.0',
+    var _a;
+    try {
+        const sessionId = (0, utils_1.getOrCreateSessionId)(req);
+        if (!session) {
+            utils_2.logger.warn('Session not found for request', {
+                sessionId,
+            });
+            res.status(404).json({
+                jsonrpc: '2.0',
+                error: {
+                    code: 404,
+                    message: 'Session not found. Please reinitialize.',
+                },
+                id: null,
+            });
+            return;
+        }
+        // Record tool call for metrics only when actually executing tools
+        if (((_a = req.body) === null || _a === void 0 ? void 0 : _a.method) === 'tools/call') {
+            session_1.sessionService.recordToolCall(sessionId);
+        }
+        await session.transport.handleRequest(req, res, req.body);
+        if (req.method === 'DELETE') {
+            session_1.sessionService.destroySession(sessionId);
+        }
+    }
+    catch (err) {
+        const sessionId = (0, utils_1.getOrCreateSessionId)(req);
+        // Record error in session metrics
+        if (sessionId) {
+            session_1.sessionService.recordError(sessionId);
+        }
+        utils_2.logger.error('❌ Error in handleSessionRequest', {
             error: {
-                code: 404,
-                message: 'Session ID not found. Please reinitialize.',
+                message: err instanceof Error ? err.message : String(err),
+                stack: err instanceof Error ? err.stack : undefined,
             },
-            id: null,
+            method: req.method,
+            url: req.url,
+            sessionId,
         });
-        return;
-    }
-    session.metrics.totalInteractions++;
-    if (((_d = req.body) === null || _d === void 0 ? void 0 : _d.method) === 'tools/call') {
-        session.metrics.totalToolCalls++;
+        if (!res.headersSent) {
+            res.status(500).json({
+                jsonrpc: '2.0',
+                error: {
+                    code: -32603,
+                    message: 'Internal server error',
+                },
+                id: null,
+            });
+        }
     }
-    utils_2.logger.info('🔁 Reusing session', session.metrics);
-    return session.transport.handleRequest(req, res, req.body);
 }
 app.post('/', _1.authErrorLogger, (0, bearerAuth_js_1.requireBearerAuth)({
-    verifier: (0, auth_middleware_1.createOAuthTokenVerifier)(),
+    verifier: (0, auth_1.createOAuthTokenVerifier)(),
     requiredScopes: constants_1.REQUIRED_SCOPES,
     resourceMetadataUrl: 'mcp', // FIXME: Add dynamic resource!
 }), _1.addMcpSessionId, async (req, res, next) => {
-    var _a, _b, _c, _d, _e, _f;
+    var _a, _b, _c, _d, _e, _f, _g;
     try {
         const sessionId = (0, utils_1.getOrCreateSessionId)(req);
-        const session = sessions.get(sessionId);
+        const session = session_1.sessionService.getSession(sessionId);
         // Reuse existing session
         if (session) {
-            // logger.info('🔁 Reusing session', { sessionId });
-            // await sessions
-            //   .get(sessionId)!
-            //   .transport!.handleRequest(req, res, req.body);
-            // return;
-            await handleSessionRequest(req, res, session);
-            return;
+            // Check if session is expired
+            if (session_1.sessionService.isSessionExpired(sessionId)) {
+                utils_2.logger.warn('Session expired, destroying and creating new one', {
+                    sessionId,
+                });
+                session_1.sessionService.destroySession(sessionId);
+            }
+            else {
+                // Record interaction and reuse session
+                // Don't record interaction for tool calls as they'll be recorded separately
+                if (((_a = req.body) === null || _a === void 0 ? void 0 : _a.method) !== 'tools/call') {
+                    session_1.sessionService.recordInteraction(sessionId);
+                }
+                await handleSessionRequest(req, res, session);
+                return;
+            }
         }
         // Create New Session
         if ((0, types_js_1.isInitializeRequest)(req.body)) {
             const transport = new streamableHttp_js_1.StreamableHTTPServerTransport({
                 sessionIdGenerator: () => (0, utils_1.getOrCreateSessionId)(req),
-                // sessionIdGenerator: undefined,
                 onsessioninitialized: (sessionId) => {
-                    // const user = req.auth?.extra?.user;
                     var _a, _b, _c;
-                    utils_2.logger.info('🆕 New session initialized', {
+                    utils_2.logger.info('New session initialized', {
                         sessionId,
-                        requestorHeaders: (0, utils_2.obfuscateAuthHeaders)(req.headers),
                         userId: (_c = (_b = (_a = req.auth) === null || _a === void 0 ? void 0 : _a.extra) === null || _b === void 0 ? void 0 : _b.user) === null || _c === void 0 ? void 0 : _c.id,
                     });
-                    createSession(transport, req, sessionId);
+                    try {
+                        session_1.sessionService.createSession(transport, req, sessionId);
+                    }
+                    catch (error) {
+                        utils_2.logger.error('Failed to create session', {
+                            sessionId,
+                            error: error instanceof Error ? error.message : String(error),
+                        });
+                        // Close transport if session creation fails
+                        transport.close();
+                    }
                 },
                 enableJsonResponse: true,
             });
             transport.onclose = () => {
-                utils_2.logger.info('🔴 Transport onclose triggered', {
+                utils_2.logger.debug('Transport closed', {
                     sessionId: transport.sessionId,
-                    hasSessionId: !!transport.sessionId,
                 });
-                if (transport.sessionId)
-                    destroySession(transport.sessionId);
+                if (transport.sessionId) {
+                    session_1.sessionService.destroySession(transport.sessionId);
+                }
             };
             // Add error handling for the transport
             transport.onerror = (error) => {
-                var _a;
-                utils_2.logger.error('🚨 Transport error occurred', {
+                utils_2.logger.error('Transport error', {
                     sessionId: transport.sessionId,
-                    sessionMetrics: (_a = sessions.get(transport.sessionId)) === null || _a === void 0 ? void 0 : _a.metrics,
                     error: {
                         message: error.message,
                         name: error.name,
-                        stack: error.stack,
                     },
                 });
+                // Record error in session metrics
+                if (transport.sessionId) {
+                    session_1.sessionService.recordError(transport.sessionId);
+                }
             };
             await server_1.default.connect(transport);
             await transport.handleRequest(req, res, req.body);
             return;
-            // const session = sessions.get(transport!.sessionId!);
-            // await handleSessionRequest(req, res, session!);
         }
         // No session ID and no initialize request
-        // Should never happen since we are gonna always have a session ID
         utils_2.logger.warn('❌ Session ID not found', {
             sessionId,
-            userId: (_c = (_b = (_a = req.auth) === null || _a === void 0 ? void 0 : _a.extra) === null || _b === void 0 ? void 0 : _b.user) === null || _c === void 0 ? void 0 : _c.id,
+            userId: (_d = (_c = (_b = req.auth) === null || _b === void 0 ? void 0 : _b.extra) === null || _c === void 0 ? void 0 : _c.user) === null || _d === void 0 ? void 0 : _d.id,
             headers: req.headers,
         });
         res.status(404).json({
@@ -292,9 +235,6 @@ app.post('/', _1.authErrorLogger, (0, bearerAuth_js_1.requireBearerAuth)({
             },
             id: null,
         });
-        return;
-        // await handleSessionRequest(req, res, sessions.get(sessionId));
-        // await sharedTransport.handleRequest(req, res, req.body);
     }
     catch (error) {
         utils_2.logger.error('❌ Error in POST  handler', {
@@ -306,17 +246,28 @@ app.post('/', _1.authErrorLogger, (0, bearerAuth_js_1.requireBearerAuth)({
             url: req.url,
             sessionId: (0, utils_1.getOrCreateSessionId)(req),
             hasInitializeRequest: (0, types_js_1.isInitializeRequest)(req.body),
-            userId: (_f = (_e = (_d = req.auth) === null || _d === void 0 ? void 0 : _d.extra) === null || _e === void 0 ? void 0 : _e.user) === null || _f === void 0 ? void 0 : _f.id,
+            userId: (_g = (_f = (_e = req.auth) === null || _e === void 0 ? void 0 : _e.extra) === null || _f === void 0 ? void 0 : _f.user) === null || _g === void 0 ? void 0 : _g.id,
         });
         next(error);
     }
 });
 // GET/DELETE : server-to-client (SSE) and session termination
+app.get('/', _1.authErrorLogger, (0, bearerAuth_js_1.requireBearerAuth)({
+    verifier: (0, auth_1.createOAuthTokenVerifier)(),
+    requiredScopes: constants_1.REQUIRED_SCOPES,
+    resourceMetadataUrl: 'mcp', // FIXME: Add dynamic resource!
+}), _1.addMcpSessionId, handleSessionRequestGetDelete);
+app.delete('/', _1.authErrorLogger, (0, bearerAuth_js_1.requireBearerAuth)({
+    verifier: (0, auth_1.createOAuthTokenVerifier)(),
+    requiredScopes: constants_1.REQUIRED_SCOPES,
+    resourceMetadataUrl: 'mcp', // FIXME: Add dynamic resource!
+}), _1.addMcpSessionId, handleSessionRequestGetDelete);
 // GET/DELETE : server-to-client (SSE) and session termination
 async function handleSessionRequestGetDelete(req, res) {
+    var _a;
     try {
         const sessionId = (0, utils_1.getOrCreateSessionId)(req);
-        const session = sessions.get(sessionId);
+        const session = session_1.sessionService.getSession(sessionId);
         if (!session) {
             utils_2.logger.warn('Invalid or missing session ID', { sessionId });
             res.status(404).json({
@@ -329,276 +280,97 @@ async function handleSessionRequestGetDelete(req, res) {
             });
             return;
         }
+        // Check if session is expired
+        if (session_1.sessionService.isSessionExpired(sessionId)) {
+            utils_2.logger.warn('Session expired, destroying', { sessionId });
+            session_1.sessionService.destroySession(sessionId);
+            res.status(404).json({
+                jsonrpc: '2.0',
+                error: {
+                    code: 404,
+                    message: 'Session expired. Please reinitialize.',
+                },
+                id: null,
+            });
+            return;
+        }
+        // Record interaction for metrics
+        // Don't record interaction for tool calls as they'll be recorded separately
+        if (((_a = req.body) === null || _a === void 0 ? void 0 : _a.method) !== 'tools/call') {
+            session_1.sessionService.recordInteraction(sessionId);
+        }
         await session.transport.handleRequest(req, res, req.body);
         if (req.method === 'DELETE') {
-            destroySession(sessionId);
+            session_1.sessionService.destroySession(sessionId);
         }
     }
     catch (err) {
+        const sessionId = (0, utils_1.getOrCreateSessionId)(req);
+        // Record error in session metrics
+        if (sessionId) {
+            session_1.sessionService.recordError(sessionId);
+        }
         utils_2.logger.error('❌ Error in handleSessionRequestGetDelete', {
             error: {
                 message: err instanceof Error ? err.message : String(err),
                 stack: err instanceof Error ? err.stack : undefined,
             },
+            method: req.method,
+            url: req.url,
+            sessionId,
         });
+        if (!res.headersSent) {
+            res.status(500).json({
+                jsonrpc: '2.0',
+                error: {
+                    code: -32603,
+                    message: 'Internal server error',
+                },
+                id: null,
+            });
+        }
     }
 }
-// GET/DELETE : server-to-client (SSE) and session termination
-app.get('/', _1.authErrorLogger, (0, bearerAuth_js_1.requireBearerAuth)({
-    verifier: (0, auth_middleware_1.createOAuthTokenVerifier)(),
-    requiredScopes: constants_1.REQUIRED_SCOPES,
-    resourceMetadataUrl: 'mcp', // FIXME: Add dynamic resource!
-}), _1.addMcpSessionId, handleSessionRequestGetDelete);
-app.delete('/', _1.authErrorLogger, (0, bearerAuth_js_1.requireBearerAuth)({
-    verifier: (0, auth_middleware_1.createOAuthTokenVerifier)(),
-    requiredScopes: constants_1.REQUIRED_SCOPES,
-    resourceMetadataUrl: 'mcp', // FIXME: Add dynamic resource!
-}), _1.addMcpSessionId, handleSessionRequestGetDelete);
-// app.get(
-//   '/',
-//   authErrorLogger,
-//   requireBearerAuth({
-//     verifier: createOAuthTokenVerifier(),
-//     requiredScopes: REQUIRED_SCOPES,
-//     resourceMetadataUrl: 'mcp', // FIXME: Add dynamic resource!
-//   }),
-//   addMcpSessionId,
-//   (req: AuthenticatedRequest, res: Response) => {
-//     return handleSessionRequest(
-//       req,
-//       res,
-//       sessions.get(getOrCreateSessionId(req)),
-//     );
-//   },
-// );
-// app.delete(
-//   '/',
-//   authErrorLogger,
-//   requireBearerAuth({
-//     verifier: createOAuthTokenVerifier(),
-//     requiredScopes: REQUIRED_SCOPES,
-//     resourceMetadataUrl: 'mcp', // FIXME: Add dynamic resource!
-//   }),
-//   addMcpSessionId,
-//   (req: AuthenticatedRequest, res: Response) => {
-//     destroySession(getOrCreateSessionId(req));
-//   },
-// );
-// For stateless servers, GET should return 405 Method Not Allowed
-// app.get('/', (req, res) => {
-//   logger.warn('GET request to  (not supported in stateless mode)');
-//   res.writeHead(405, {
-//     'Content-Type': 'application/json',
-//     Allow: 'POST',
-//   });
-//   res.end(
-//     JSON.stringify({
-//       jsonrpc: '2.0',
-//       error: {
-//         code: -32601, // "Method not found"
-//         message: 'GET not supported in stateless mode; use POST at ',
-//       },
-//       id: null,
-//     }),
-//   );
-//   return;
-// });
-// For stateless servers, DELETE should return 405 Method Not Allowed
-// app.delete('/', (req, res) => {
-//   logger.warn('DELETE request to  (not supported in stateless mode)');
-//   res.status(405).json({
-//     jsonrpc: '2.0',
-//     error: {
-//       code: -32000,
-//       message: "Method not allowed. Stateless server doesn't support sessions.",
-//     },
-//     id: null,
-//   });
-// });
-// POST : client-to-server (with authentication)
-// app.post(
-//   'x',
-//   async (req: AuthenticatedRequest, res: Response, next: NextFunction) => {
-//     logger.warn('Verifying access token');
-//     verifyAccessToken(req, res, next);
-//     logger.warn('Access token verified');
-//     try {
-//       // if (req.headers) {
-//       //   throw new UnauthorizedException();
-//       // }
-//       const sessionId = getOrCreateSessionId(req);
-//       // Reuse existing session
-//       if (sessionId && sessions.has(sessionId)) {
-//         logger.info('Reusing session', { sessionId });
-//         await sessions
-//           .get(sessionId)!
-//           .transport!.handleRequest(req, res, req.body);
-//         return;
-//       }
-//       // Create New Session
-//       if (!sessionId && isInitializeRequest(req.body)) {
-//         const requestorHeaders = req.headers;
-//         // TODO: The place I can see info about client is: user-agent
-//         const transport = new StreamableHTTPServerTransport({
-//           sessionIdGenerator: () => randomUUID(),
-//           onsessioninitialized: (transportSessionId: string) => {
-//             logger.info('New session initialized', {
-//               sessionId: transportSessionId,
-//               requestorHeaders,
-//               userId: req.auth?.extra?.user?.id,
-//             });
-//             const sessionId = createSession(transport!, req.auth?.extra?.user);
-//             if (req.auth?.extra?.user) {
-//               setUserContext(sessionId, req.auth?.extra?.user);
-//             }
-//           },
-//           enableJsonResponse: true,
-//         });
-//         transport.onclose = () => {
-//           if (transport!.sessionId) destroySession(transport!.sessionId);
-//         };
-//         await server.connect(transport);
-//         await transport.handleRequest(req, res, req.body);
-//         return;
-//       }
-//       // No session ID and no initialize request
-//       logger.warn('Bad request: No valid session ID provided', {
-//         sessionId,
-//         headers: req.headers,
-//       });
-//       res.status(404).json({
-//         jsonrpc: '2.0',
-//         error: {
-//           code: 404,
-//           message:
-//             'Session Not Found or Expired. Please reinitialize with a new session ID.',
-//         },
-//         id: null,
-//       });
-//     } catch (err) {
-//       logger.error('Error handling request', { error: err });
-//       return next(err);
-//     }
-//   },
-// );
-// GET/DELETE : server-to-client (SSE) and session termination
-// async function handleSessionRequestWasWorking(
-//   req: AuthenticatedRequest,
-//   res: Response,
-//   next: NextFunction,
-// ) {
-//   try {
-//     // const sessionId = getOrCreateSessionId(req);
-//     // if (!sessionId || !sessions.has(sessionId)) {
-//     //   logger.warn('Invalid or missing session ID', { sessionId });
-//     //   res.status(404).json({
-//     //     jsonrpc: '2.0',
-//     //     error: {
-//     //       code: 404,
-//     //       message: 'Session not found. Please reinitialize.',
-//     //     },
-//     //     id: null,
-//     //   });
-//     //   return;
-//     // }
-//     // Add SSE-specific headers for GET requests (which are used for SSE)
-//     if (req.method === 'GET') {
-//       res.setHeader('Content-Type', 'text/event-stream');
-//       res.setHeader('Cache-Control', 'no-cache');
-//       res.setHeader('Connection', 'keep-alive');
-//       res.setHeader('Access-Control-Allow-Origin', '*');
-//       res.setHeader('Access-Control-Allow-Headers', 'Cache-Control');
-//       res.setHeader('Access-Control-Allow-Credentials', 'true');
-//     }
-//     // const transport = sessions.get(sessionId)!.transport;
-//     await sharedTransport.handleRequest(req, res, req.body);
-//     // if (req.method === 'DELETE') {
-//     //   // destroySession(sessionId);
-//     // }
-//   } catch (err) {
-//     logger.error('❌ Error in handleSessionRequest', {
-//       error: {
-//         message: err instanceof Error ? err.message : String(err),
-//         stack: err instanceof Error ? err.stack : undefined,
-//       },
-//       method: req.method,
-//       url: req.url,
-//       sessionId: getOrCreateSessionId(req),
-//     });
-//     next(err);
-//   }
-// }
-// app.get('/oauth/authorize', (req, res) => {
-//   logger.info('OAuth authorize!!!', {
-//     url: req.url,
-//     method: req.method,
-//     headers: req.headers,
-//   });
-//   throw new Error('Not implemented');
-// });
-// Error handler middleware
-// app.use((err: Error, req: Request, res: Response, _next: NextFunction) => {
-//   if (err instanceof HttpError) {
-//     res.status(err.status).json({
-//       jsonrpc: '2.0',
-//       error: { code: err.status, message: err.message },
-//       id: null,
-//     });
-//     return;
-//   }
-//   logger.error('Unhandled error', {
-//     error: { ...err, stack: err.stack },
-//     errorMessage: err.message,
-//     url: req.url,
-//     method: req.method,
-//   });
-//   if (!res.headersSent) {
-//     res.status(500).json({
-//       jsonrpc: '2.0',
-//       error: { code: -32603, message: 'Internal server error' },
-//       id: null,
-//     });
-//   }
-// });
 // Graceful shutdown
 function shutdown() {
     utils_2.logger.info('Shutting down server...');
     // Clear the heartbeat interval
     clearInterval(heartbeatInterval);
-    // Clean up all sessions
-    for (const sessionId of sessions.keys()) {
-        destroySession(sessionId);
-    }
+    // Clean up all sessions using the enhanced service
+    const totalSessions = session_1.sessionService.getSessionCount();
+    utils_2.logger.info('Cleaning up sessions before shutdown', { totalSessions });
+    session_1.sessionService.clearAllSessions();
     process.exit(0);
 }
 process.on('SIGINT', shutdown);
 process.on('SIGTERM', shutdown);
 process.once('SIGUSR2', () => {
     utils_2.logger.info('SIGUSR2 received, shutting down...');
-    // shutdown();
-    // After cleanup, re-emit the signal to let nodemon restart the process
+    shutdown();
     process.kill(process.pid, 'SIGUSR2');
 });
 // Start server
 const PORT = config_1.env.PORT || 3005;
 const serverInstance = app.listen(PORT, async () => {
-    // Connect server once at startup
-    // await server.connect(sharedTransport);
     // Initialize Carbon Voice API health status
-    const isApiWorking = await (0, cv_api_1.isCarbonVoiceApiWorking)();
+    const status = await (0, cv_api_1.getCarbonVoiceApiStatus)();
     carbonVoiceApiHealth = {
-        isHealthy: isApiWorking,
+        ...status,
         lastChecked: new Date().toISOString(),
     };
-    const logLevel = isApiWorking ? 'info' : 'warn';
-    const icon = isApiWorking ? '✅ ' : '⚠️ ';
-    utils_2.logger[logLevel](`${icon} MCP HTTP Server started on port ${PORT}`, {
-        name: constants_2.SERVICE_NAME,
-        version: constants_2.SERVICE_VERSION,
-        processId: process.pid,
-        nodeVersion: process.version,
-        totalSessions: sessions.size,
+    // Initialize and start session cleanup service
+    const sessionConfig = session_config_1.SessionConfig.fromEnv();
+    const sessionLogger = new session_1.SessionLogger();
+    const sessionCleanupService = new session_1.SessionCleanupService(session_1.sessionService, sessionConfig, sessionLogger);
+    sessionCleanupService.start();
+    utils_2.logger.info('🚀 HTTP MCP Server started', {
+        port: PORT,
         carbonVoiceApiHealth,
+        sessionConfig: {
+            ttlMs: sessionConfig.ttlMs,
+            maxSessions: sessionConfig.maxSessions,
+            cleanupIntervalMs: sessionConfig.cleanupIntervalMs,
+        },
     });
 });
 serverInstance.on('error', (error) => {
@@ -611,7 +383,7 @@ process.on('uncaughtException', (error) => {
         stack: error.stack,
         name: error.name,
         processId: process.pid,
-        totalSessions: sessions.size,
+        totalSessions: session_1.sessionService.getAllSessionIds().length,
     });
 });
 process.on('unhandledRejection', (reason, promise) => {
@@ -620,42 +392,27 @@ process.on('unhandledRejection', (reason, promise) => {
         stack: reason instanceof Error ? reason.stack : undefined,
         promise: promise.toString(),
         processId: process.pid,
-        totalSessions: sessions.size,
+        totalSessions: session_1.sessionService.getAllSessionIds().length,
     });
 });
 // Log every 30 seconds to show the server is alive
 const heartbeatInterval = setInterval(async () => {
-    try {
-        const isApiWorking = await (0, cv_api_1.isCarbonVoiceApiWorking)();
-        // Update Carbon Voice API health cache
-        carbonVoiceApiHealth = {
-            isHealthy: isApiWorking,
-            lastChecked: new Date().toISOString(),
-            ...(carbonVoiceApiHealth.error && isApiWorking && { error: undefined }), // Clear error if now healthy
-        };
-        utils_2.logger.info('💓 Server heartbeat', {
-            totalSessions: sessions.size,
-            isCarbonVoiceApiWorking: isApiWorking,
-            uptime: (0, utils_2.formatProcessUptime)(),
-            memoryUsage: process.memoryUsage(),
-        });
-    }
-    catch (error) {
-        // Update cache with error information
-        carbonVoiceApiHealth = {
-            isHealthy: false,
-            lastChecked: new Date().toISOString(),
-            error: error instanceof Error
-                ? error.message
-                : 'Unknown error checking API health',
-        };
-        utils_2.logger.warn('💓 Server heartbeat - Carbon Voice API check failed', {
-            totalSessions: sessions.size,
-            isCarbonVoiceApiWorking: false,
-            uptime: (0, utils_2.formatProcessUptime)(),
-            memoryUsage: process.memoryUsage(),
-            error: carbonVoiceApiHealth.error,
-        });
-    }
+    const status = await (0, cv_api_1.getCarbonVoiceApiStatus)();
+    // Update Carbon Voice API health cache
+    carbonVoiceApiHealth = {
+        isHealthy: status.isHealthy,
+        apiUrl: status.apiUrl,
+        lastChecked: new Date().toISOString(),
+        ...(status.error && { error: status.error }),
+    };
+    const icon = carbonVoiceApiHealth.isHealthy ? '🟢' : '🔴';
+    const logArgs = {
+        totalSessions: session_1.sessionService.getAllSessionIds().length,
+        isCarbonVoiceApiWorking: carbonVoiceApiHealth.isHealthy,
+        uptime: (0, utils_2.getProcessUptime)(),
+        memoryUsage: process.memoryUsage(),
+        carbonVoiceApiHealth,
+    };
+    utils_2.logger.info(`💓 Server heartbeat ${icon}`, logArgs);
 }, 30000);
 //# sourceMappingURL=streamable.js.map