@carbonvoice/cv-mcp-server 2.8.0 → 2.8.14

package/dist/transports/http/streamable.js

@@ -10,20 +10,25 @@ const cors_1 = __importDefault(require("cors"));
 const express_1 = __importDefault(require("express"));
 const helmet_1 = __importDefault(require("helmet"));
 const serve_favicon_1 = __importDefault(require("serve-favicon"));
-const bearerAuth_js_1 = require("@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js");
 const streamableHttp_js_1 = require("@modelcontextprotocol/sdk/server/streamableHttp.js");
 const types_js_1 = require("@modelcontextprotocol/sdk/types.js");
-const _1 = require(".");
 const constants_1 = require("./constants");
+const transport_send_diagnostics_1 = require("./diagnostics/transport-send-diagnostics");
+const middleware_1 = require("./middleware");
 const session_1 = require("./session");
 const session_config_1 = require("./session/session.config");
 const utils_1 = require("./utils");
+const request_context_1 = require("./utils/request-context");
 const auth_1 = require("../../auth");
 const config_1 = require("../../config");
 const cv_api_1 = require("../../cv-api");
 const server_1 = __importDefault(require("../../server"));
 const utils_2 = require("../../utils");
 const app = (0, express_1.default)();
+// TODO: REMOVE THIS AFTER DEBUGGING
+const transportDiagnostics = (0, transport_send_diagnostics_1.createTransportSendDiagnostics)({
+    enabled: config_1.env.MCP_TRANSPORT_DIAGNOSTICS_ENABLED,
+});
 app.set('x-powered-by', false);
 // Trust proxy for rate limiting - only trust localhost and private networks
 app.set('trust proxy', ['loopback', 'linklocal', 'uniquelocal']);
@@ -36,17 +41,24 @@ if (fs_1.default.existsSync(faviconPath)) {
 app.use((0, cors_1.default)());
 // Security middlewares
 app.use((0, helmet_1.default)());
-app.use(_1.rateLimitMiddleware);
+app.use(middleware_1.rateLimitMiddleware);
 app.use(express_1.default.json({ limit: '1mb' }));
 // Add request ID middleware
-app.use(_1.addRequestIdMiddleware);
+app.use(middleware_1.addRequestIdMiddleware);
 // Request logging middleware (includes session metrics)
-app.use(_1.logRequest);
+app.use(middleware_1.logRequest);
 let carbonVoiceApiHealth = {
     isHealthy: (0, config_1.isTestEnvironment)() ? true : false, // Assume healthy in test mode
     lastChecked: new Date().toISOString(),
     apiUrl: config_1.env.CARBON_VOICE_BASE_URL,
 };
+const resourceMetadataUrl = config_1.env.MCP_RESOURCE_METADATA_URL;
+const oauthTokenVerifier = (0, auth_1.createOAuthTokenVerifier)();
+const authWithAbsoluteMetadata = (0, middleware_1.requireBearerAuthWithAbsoluteMetadata)({
+    verifier: oauthTokenVerifier,
+    requiredScopes: constants_1.REQUIRED_SCOPES,
+    resourceMetadataUrl,
+});
 app.get('/health', (req, res) => {
     const response = {
         status: carbonVoiceApiHealth.isHealthy ? 'healthy' : 'degraded',
@@ -80,8 +92,8 @@ app.get('/info', (req, res) => {
     res.status(200).send('OK');
 });
 // Protected resource metadata (OAuth 2.1 RFC9728 compliant)
-app.get('/.well-known/oauth-protected-resource', _1.wellKnownCorsHeaders, _1.oauthProtectedResource);
-app.get('/.well-known/oauth-authorization-server', _1.wellKnownCorsHeaders, _1.oauthAuthorizationServer);
+app.get('/.well-known/oauth-protected-resource', middleware_1.wellKnownCorsHeaders, middleware_1.oauthProtectedResource);
+app.get('/.well-known/oauth-authorization-server', middleware_1.wellKnownCorsHeaders, middleware_1.oauthAuthorizationServer);
 // Handle HEAD requests without auth
 app.head('/', (req, res) => {
     const mcpProtocolVersion = req.headers['mcp-protocol-version'] || types_js_1.LATEST_PROTOCOL_VERSION;
@@ -92,9 +104,13 @@ app.head('/', (req, res) => {
         .end();
 });
 async function handleSessionRequest(req, res, session) {
-    var _a;
+    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q, _r, _s, _t, _u, _v, _w, _x, _y;
     try {
         const sessionId = (0, utils_1.getOrCreateSessionId)(req);
+        (0, request_context_1.updateRequestContext)({
+            sessionId: sessionId || undefined,
+            userId: (_c = (_b = (_a = req.auth) === null || _a === void 0 ? void 0 : _a.extra) === null || _b === void 0 ? void 0 : _b.user) === null || _c === void 0 ? void 0 : _c.id,
+        });
         if (!session) {
             utils_2.logger.warn('Session not found for request', {
                 sessionId,
@@ -110,11 +126,40 @@ async function handleSessionRequest(req, res, session) {
             return;
         }
         // Record tool call for metrics only when actually executing tools
-        if (((_a = req.body) === null || _a === void 0 ? void 0 : _a.method) === 'tools/call') {
+        if (((_d = req.body) === null || _d === void 0 ? void 0 : _d.method) === 'tools/call') {
             session_1.sessionService.recordToolCall(sessionId);
         }
+        const isToolCall = ((_e = req.body) === null || _e === void 0 ? void 0 : _e.method) === 'tools/call';
+        const toolCallStart = isToolCall ? Date.now() : undefined;
+        if (isToolCall) {
+            transportDiagnostics.trackToolCall(sessionId, (_f = req.body) === null || _f === void 0 ? void 0 : _f.id, {
+                toolName: (_h = (_g = req.body) === null || _g === void 0 ? void 0 : _g.params) === null || _h === void 0 ? void 0 : _h.name,
+                traceId: (0, request_context_1.getTraceId)(),
+                userId: (_l = (_k = (_j = req.auth) === null || _j === void 0 ? void 0 : _j.extra) === null || _k === void 0 ? void 0 : _k.user) === null || _l === void 0 ? void 0 : _l.id,
+            });
+            utils_2.logger.info('TOOL_CALL_TRANSPORT_START', {
+                event: 'TOOL_CALL_TRANSPORT_START',
+                toolName: (_o = (_m = req.body) === null || _m === void 0 ? void 0 : _m.params) === null || _o === void 0 ? void 0 : _o.name,
+                jsonRpcId: (_p = req.body) === null || _p === void 0 ? void 0 : _p.id,
+                sessionId,
+                userId: (_s = (_r = (_q = req.auth) === null || _q === void 0 ? void 0 : _q.extra) === null || _r === void 0 ? void 0 : _r.user) === null || _s === void 0 ? void 0 : _s.id,
+                traceId: (0, request_context_1.getTraceId)(),
+            });
+        }
         await session.transport.handleRequest(req, res, req.body);
+        if (isToolCall && toolCallStart !== undefined) {
+            utils_2.logger.info('TOOL_CALL_TRANSPORT_AWAIT_RESOLVED', {
+                event: 'TOOL_CALL_TRANSPORT_AWAIT_RESOLVED',
+                toolName: (_u = (_t = req.body) === null || _t === void 0 ? void 0 : _t.params) === null || _u === void 0 ? void 0 : _u.name,
+                jsonRpcId: (_v = req.body) === null || _v === void 0 ? void 0 : _v.id,
+                awaitDurationMs: Date.now() - toolCallStart,
+                sessionId,
+                userId: (_y = (_x = (_w = req.auth) === null || _w === void 0 ? void 0 : _w.extra) === null || _x === void 0 ? void 0 : _x.user) === null || _y === void 0 ? void 0 : _y.id,
+                traceId: (0, request_context_1.getTraceId)(),
+            });
+        }
         if (req.method === 'DELETE') {
+            session_1.toolCallQueueService.clearSession(sessionId);
             session_1.sessionService.destroySession(sessionId);
         }
     }
@@ -145,12 +190,154 @@ async function handleSessionRequest(req, res, session) {
         }
     }
 }
-app.post('/', _1.authErrorLogger, (0, bearerAuth_js_1.requireBearerAuth)({
-    verifier: (0, auth_1.createOAuthTokenVerifier)(),
-    requiredScopes: constants_1.REQUIRED_SCOPES,
-    resourceMetadataUrl: 'mcp', // FIXME: Add dynamic resource!
-}), _1.addMcpSessionId, async (req, res, next) => {
-    var _a, _b, _c, _d, _e, _f, _g;
+/**
+ * TEMPORARY INCIDENT MITIGATION (Phase 3 guardrail)
+ *
+ * Why this is in streamable.ts for now:
+ * - This logic depends on request/response objects plus session/transport cleanup
+ *   that currently live in this file.
+ * - We are keeping the hotfix close to the route boundary while validating in prod.
+ *
+ * Planned follow-up:
+ * - Extract this block into a dedicated transport orchestration module once production
+ *   evidence confirms the incident is resolved.
+ * - Keep behavior identical during extraction (no functional changes).
+ */
+const hasJsonRpcRequestId = (body) => {
+    if (!body || typeof body !== 'object') {
+        return false;
+    }
+    const candidate = body;
+    return candidate.id !== undefined && candidate.id !== null;
+};
+const getJsonRpcMethod = (body) => {
+    if (!body || typeof body !== 'object') {
+        return undefined;
+    }
+    const candidate = body;
+    return typeof candidate.method === 'string' ? candidate.method : undefined;
+};
+const destroySessionTransportState = (sessionId) => {
+    transportDiagnostics.clearSession(sessionId);
+    session_1.toolCallQueueService.clearSession(sessionId);
+    session_1.sessionService.destroySession(sessionId);
+};
+/**
+ * TEMPORARY SAFETY TIMEOUT FOR REUSED SESSION TRANSPORT CALLS.
+ *
+ * Removes indefinite hangs when transport.handleRequest() never resolves under
+ * high concurrency/race conditions. On timeout we fail deterministically and
+ * clear session-bound transport state so the client can reinitialize.
+ *
+ * Remove after:
+ * - Root cause is permanently fixed in transport/session lifecycle; and
+ * - production can run without timeout-driven cleanup for a sustained window.
+ */
+const executeSessionRequestWithTimeout = async (req, res, session, sessionId) => {
+    var _a, _b, _c, _d, _e, _f;
+    const executionTimeoutMs = config_1.env.MCP_TRANSPORT_EXECUTION_TIMEOUT_MS;
+    const jsonRpcMethod = getJsonRpcMethod(req.body);
+    const jsonRpcId = hasJsonRpcRequestId(req.body)
+        ? req.body.id
+        : undefined;
+    const executionStartedAt = Date.now();
+    const handleRequestPromise = handleSessionRequest(req, res, session);
+    let timeoutHandle;
+    const timeoutPromise = new Promise((resolve) => {
+        timeoutHandle = setTimeout(() => resolve('timeout'), executionTimeoutMs);
+    });
+    // Detect client-side disconnect (e.g. the MCP client's ~120s HTTP timeout
+    // fires before the server can respond). This lets us clean up immediately
+    // instead of waiting for the server-side timeout and the subsequent
+    // MCP_TRANSPORT_SEND_ERROR cascade.
+    let removeDisconnectListener;
+    const clientDisconnectedPromise = new Promise((resolve) => {
+        const onClose = () => resolve('client_disconnected');
+        req.on('close', onClose);
+        removeDisconnectListener = () => req.off('close', onClose);
+    });
+    const outcome = await Promise.race([
+        handleRequestPromise.then(() => 'completed'),
+        timeoutPromise,
+        clientDisconnectedPromise,
+    ]);
+    if (timeoutHandle) {
+        clearTimeout(timeoutHandle);
+    }
+    removeDisconnectListener === null || removeDisconnectListener === void 0 ? void 0 : removeDisconnectListener();
+    if (outcome === 'completed') {
+        return;
+    }
+    if (outcome === 'client_disconnected') {
+        utils_2.logger.warn('MCP_CLIENT_DISCONNECTED', {
+            event: 'MCP_CLIENT_DISCONNECTED',
+            sessionId,
+            jsonRpcId,
+            jsonRpcMethod,
+            elapsedMs: Date.now() - executionStartedAt,
+            traceId: (0, request_context_1.getTraceId)(),
+            userId: (_c = (_b = (_a = req.auth) === null || _a === void 0 ? void 0 : _a.extra) === null || _b === void 0 ? void 0 : _b.user) === null || _c === void 0 ? void 0 : _c.id,
+        });
+        session_1.sessionService.recordError(sessionId);
+        destroySessionTransportState(sessionId);
+        // Connection is already gone — no response can be sent.
+        void handleRequestPromise.catch((error) => {
+            var _a, _b, _c;
+            utils_2.logger.warn('MCP_CLIENT_DISCONNECTED_LATE_REJECTION', {
+                event: 'MCP_CLIENT_DISCONNECTED_LATE_REJECTION',
+                sessionId,
+                jsonRpcId,
+                jsonRpcMethod,
+                traceId: (0, request_context_1.getTraceId)(),
+                userId: (_c = (_b = (_a = req.auth) === null || _a === void 0 ? void 0 : _a.extra) === null || _b === void 0 ? void 0 : _b.user) === null || _c === void 0 ? void 0 : _c.id,
+                error: error instanceof Error ? error.message : String(error),
+            });
+        });
+        return;
+    }
+    utils_2.logger.warn('MCP_TRANSPORT_EXECUTION_TIMEOUT', {
+        event: 'MCP_TRANSPORT_EXECUTION_TIMEOUT',
+        sessionId,
+        jsonRpcId,
+        jsonRpcMethod,
+        executionTimeoutMs,
+        elapsedMs: Date.now() - executionStartedAt,
+        traceId: (0, request_context_1.getTraceId)(),
+        userId: (_f = (_e = (_d = req.auth) === null || _d === void 0 ? void 0 : _d.extra) === null || _e === void 0 ? void 0 : _e.user) === null || _f === void 0 ? void 0 : _f.id,
+    });
+    session_1.sessionService.recordError(sessionId);
+    destroySessionTransportState(sessionId);
+    if (!res.headersSent) {
+        if (jsonRpcId !== undefined) {
+            res.status(200).json({
+                jsonrpc: '2.0',
+                error: {
+                    code: -32001,
+                    message: 'Request timed out while processing previous session transport work. Please retry.',
+                },
+                id: jsonRpcId,
+            });
+        }
+        else {
+            // Notifications are best-effort and do not require a JSON-RPC response.
+            res.status(202).end();
+        }
+    }
+    void handleRequestPromise.catch((error) => {
+        var _a, _b, _c;
+        utils_2.logger.warn('MCP_TRANSPORT_EXECUTION_LATE_REJECTION', {
+            event: 'MCP_TRANSPORT_EXECUTION_LATE_REJECTION',
+            sessionId,
+            jsonRpcId,
+            jsonRpcMethod,
+            traceId: (0, request_context_1.getTraceId)(),
+            userId: (_c = (_b = (_a = req.auth) === null || _a === void 0 ? void 0 : _a.extra) === null || _b === void 0 ? void 0 : _b.user) === null || _c === void 0 ? void 0 : _c.id,
+            error: error instanceof Error ? error.message : String(error),
+        });
+    });
+};
+app.post('/', middleware_1.authErrorLogger, authWithAbsoluteMetadata, middleware_1.addMcpSessionId, async (req, res, next) => {
+    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q, _r, _s, _t, _u, _v, _w, _x, _y, _z, _0, _1, _2, _3, _4, _5;
     try {
         const sessionId = (0, utils_1.getOrCreateSessionId)(req);
         const session = session_1.sessionService.getSession(sessionId);
@@ -169,7 +356,136 @@ app.post('/', _1.authErrorLogger, (0, bearerAuth_js_1.requireBearerAuth)({
                 if (((_a = req.body) === null || _a === void 0 ? void 0 : _a.method) !== 'tools/call') {
                     session_1.sessionService.recordInteraction(sessionId);
                 }
-                await handleSessionRequest(req, res, session);
+                transportDiagnostics.attach(session.transport);
+                const shouldSerializeSessionRequest = req.method === 'POST' &&
+                    !(0, types_js_1.isInitializeRequest)(req.body);
+                if (shouldSerializeSessionRequest) {
+                    const queueTimeoutMs = config_1.env.MCP_SESSION_REQUEST_QUEUE_TIMEOUT_MS;
+                    const jsonRpcMethod = getJsonRpcMethod(req.body);
+                    const jsonRpcId = hasJsonRpcRequestId(req.body)
+                        ? req.body.id
+                        : undefined;
+                    let releaseToolCallSlot;
+                    try {
+                        const { release, waitDurationMs } = await session_1.toolCallQueueService.acquire(sessionId, queueTimeoutMs);
+                        releaseToolCallSlot = release;
+                        utils_2.logger.info('SESSION_REQUEST_QUEUE_ACQUIRED', {
+                            event: 'SESSION_REQUEST_QUEUE_ACQUIRED',
+                            sessionId,
+                            jsonRpcId,
+                            jsonRpcMethod,
+                            toolName: (_c = (_b = req.body) === null || _b === void 0 ? void 0 : _b.params) === null || _c === void 0 ? void 0 : _c.name,
+                            waitDurationMs,
+                            queueTimeoutMs,
+                            traceId: (0, request_context_1.getTraceId)(),
+                            userId: (_f = (_e = (_d = req.auth) === null || _d === void 0 ? void 0 : _d.extra) === null || _e === void 0 ? void 0 : _e.user) === null || _f === void 0 ? void 0 : _f.id,
+                        });
+                        if (jsonRpcMethod === 'tools/call') {
+                            // Backward compatible event kept for existing dashboards.
+                            utils_2.logger.info('TOOL_CALL_QUEUE_ACQUIRED', {
+                                event: 'TOOL_CALL_QUEUE_ACQUIRED',
+                                sessionId,
+                                jsonRpcId,
+                                toolName: (_h = (_g = req.body) === null || _g === void 0 ? void 0 : _g.params) === null || _h === void 0 ? void 0 : _h.name,
+                                waitDurationMs,
+                                queueTimeoutMs,
+                                traceId: (0, request_context_1.getTraceId)(),
+                                userId: (_l = (_k = (_j = req.auth) === null || _j === void 0 ? void 0 : _j.extra) === null || _k === void 0 ? void 0 : _k.user) === null || _l === void 0 ? void 0 : _l.id,
+                            });
+                        }
+                        // Re-fetch the session after waiting in queue: the previous
+                        // request may have timed out and destroyed the session while
+                        // this request was waiting for its slot.
+                        const freshSession = session_1.sessionService.getSession(sessionId);
+                        if (!freshSession) {
+                            const jsonRpcId2 = hasJsonRpcRequestId(req.body)
+                                ? req.body.id
+                                : undefined;
+                            utils_2.logger.warn('SESSION_DESTROYED_WHILE_QUEUED', {
+                                event: 'SESSION_DESTROYED_WHILE_QUEUED',
+                                sessionId,
+                                jsonRpcId: jsonRpcId2,
+                                jsonRpcMethod,
+                                traceId: (0, request_context_1.getTraceId)(),
+                                userId: (_p = (_o = (_m = req.auth) === null || _m === void 0 ? void 0 : _m.extra) === null || _o === void 0 ? void 0 : _o.user) === null || _p === void 0 ? void 0 : _p.id,
+                            });
+                            if (!res.headersSent) {
+                                if (jsonRpcId2 !== undefined) {
+                                    res.status(200).json({
+                                        jsonrpc: '2.0',
+                                        error: {
+                                            code: -32001,
+                                            message: 'Session was destroyed while request was queued. Please reinitialize.',
+                                        },
+                                        id: jsonRpcId2,
+                                    });
+                                }
+                                else {
+                                    res.status(404).json({
+                                        jsonrpc: '2.0',
+                                        error: {
+                                            code: 404,
+                                            message: 'Session not found. Please reinitialize.',
+                                        },
+                                        id: null,
+                                    });
+                                }
+                            }
+                            return;
+                        }
+                        await executeSessionRequestWithTimeout(req, res, freshSession, sessionId);
+                    }
+                    catch (error) {
+                        if (error instanceof session_1.ToolCallQueueTimeoutError) {
+                            utils_2.logger.warn('SESSION_REQUEST_QUEUE_TIMEOUT', {
+                                event: 'SESSION_REQUEST_QUEUE_TIMEOUT',
+                                sessionId,
+                                jsonRpcId,
+                                jsonRpcMethod,
+                                toolName: (_r = (_q = req.body) === null || _q === void 0 ? void 0 : _q.params) === null || _r === void 0 ? void 0 : _r.name,
+                                queueTimeoutMs,
+                                traceId: (0, request_context_1.getTraceId)(),
+                                userId: (_u = (_t = (_s = req.auth) === null || _s === void 0 ? void 0 : _s.extra) === null || _t === void 0 ? void 0 : _t.user) === null || _u === void 0 ? void 0 : _u.id,
+                            });
+                            if (jsonRpcMethod === 'tools/call') {
+                                // Backward compatible event kept for existing dashboards.
+                                utils_2.logger.warn('TOOL_CALL_QUEUE_TIMEOUT', {
+                                    event: 'TOOL_CALL_QUEUE_TIMEOUT',
+                                    sessionId,
+                                    jsonRpcId,
+                                    toolName: (_w = (_v = req.body) === null || _v === void 0 ? void 0 : _v.params) === null || _w === void 0 ? void 0 : _w.name,
+                                    queueTimeoutMs,
+                                    traceId: (0, request_context_1.getTraceId)(),
+                                    userId: (_z = (_y = (_x = req.auth) === null || _x === void 0 ? void 0 : _x.extra) === null || _y === void 0 ? void 0 : _y.user) === null || _z === void 0 ? void 0 : _z.id,
+                                });
+                            }
+                            if (!res.headersSent) {
+                                if (jsonRpcId !== undefined) {
+                                    res.status(200).json({
+                                        jsonrpc: '2.0',
+                                        error: {
+                                            code: -32001,
+                                            message: 'Request timed out while waiting for previous request in this session.',
+                                        },
+                                        id: jsonRpcId,
+                                    });
+                                }
+                                else {
+                                    res.status(202).end();
+                                }
+                            }
+                        }
+                        else {
+                            throw error;
+                        }
+                    }
+                    finally {
+                        releaseToolCallSlot === null || releaseToolCallSlot === void 0 ? void 0 : releaseToolCallSlot();
+                    }
+                }
+                else {
+                    await handleSessionRequest(req, res, session);
+                }
                 return;
             }
         }
@@ -193,14 +509,21 @@ app.post('/', _1.authErrorLogger, (0, bearerAuth_js_1.requireBearerAuth)({
                 enableJsonResponse: true,
             });
             transport.onclose = () => {
-                utils_2.logger.debug('🔌 Transport closed');
+                utils_2.logger.debug('🔌 Transport closed', {
+                    event: 'MCP_TRANSPORT_CLOSED',
+                    sessionId: transport.sessionId,
+                });
                 if (transport.sessionId) {
+                    transportDiagnostics.clearSession(transport.sessionId);
+                    session_1.toolCallQueueService.clearSession(transport.sessionId);
                     session_1.sessionService.destroySession(transport.sessionId);
                 }
             };
             // Add error handling for the transport
             transport.onerror = (error) => {
                 utils_2.logger.error('🔴 Transport error', {
+                    event: 'MCP_TRANSPORT_ERROR',
+                    sessionId: transport.sessionId,
                     error: {
                         message: error.message,
                         name: error.name,
@@ -211,6 +534,7 @@ app.post('/', _1.authErrorLogger, (0, bearerAuth_js_1.requireBearerAuth)({
                     session_1.sessionService.recordError(transport.sessionId);
                 }
             };
+            transportDiagnostics.attach(transport);
             await server_1.default.connect(transport);
             await transport.handleRequest(req, res, req.body);
             return;
@@ -218,7 +542,7 @@ app.post('/', _1.authErrorLogger, (0, bearerAuth_js_1.requireBearerAuth)({
         // No session ID and no initialize request
         utils_2.logger.warn('❌ Session ID not found', {
             sessionId,
-            userId: (_d = (_c = (_b = req.auth) === null || _b === void 0 ? void 0 : _b.extra) === null || _c === void 0 ? void 0 : _c.user) === null || _d === void 0 ? void 0 : _d.id,
+            userId: (_2 = (_1 = (_0 = req.auth) === null || _0 === void 0 ? void 0 : _0.extra) === null || _1 === void 0 ? void 0 : _1.user) === null || _2 === void 0 ? void 0 : _2.id,
             headers: req.headers,
         });
         res.status(404).json({
@@ -240,30 +564,35 @@ app.post('/', _1.authErrorLogger, (0, bearerAuth_js_1.requireBearerAuth)({
             url: req.url,
             sessionId: (0, utils_1.getOrCreateSessionId)(req),
             hasInitializeRequest: (0, types_js_1.isInitializeRequest)(req.body),
-            userId: (_g = (_f = (_e = req.auth) === null || _e === void 0 ? void 0 : _e.extra) === null || _f === void 0 ? void 0 : _f.user) === null || _g === void 0 ? void 0 : _g.id,
+            userId: (_5 = (_4 = (_3 = req.auth) === null || _3 === void 0 ? void 0 : _3.extra) === null || _4 === void 0 ? void 0 : _4.user) === null || _5 === void 0 ? void 0 : _5.id,
         });
         next(error);
     }
 });
 // GET/DELETE : server-to-client (SSE) and session termination
-app.get('/', _1.authErrorLogger, (0, bearerAuth_js_1.requireBearerAuth)({
-    verifier: (0, auth_1.createOAuthTokenVerifier)(),
-    requiredScopes: constants_1.REQUIRED_SCOPES,
-    resourceMetadataUrl: 'mcp', // FIXME: Add dynamic resource!
-}), _1.addMcpSessionId, handleSessionRequestGetDelete);
-app.delete('/', _1.authErrorLogger, (0, bearerAuth_js_1.requireBearerAuth)({
-    verifier: (0, auth_1.createOAuthTokenVerifier)(),
-    requiredScopes: constants_1.REQUIRED_SCOPES,
-    resourceMetadataUrl: 'mcp', // FIXME: Add dynamic resource!
-}), _1.addMcpSessionId, handleSessionRequestGetDelete);
+app.get('/', middleware_1.authErrorLogger, authWithAbsoluteMetadata, middleware_1.addMcpSessionId, handleSessionRequestGetDelete);
+app.delete('/', middleware_1.authErrorLogger, authWithAbsoluteMetadata, middleware_1.addMcpSessionId, handleSessionRequestGetDelete);
 // GET/DELETE : server-to-client (SSE) and session termination
 async function handleSessionRequestGetDelete(req, res) {
-    var _a;
+    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k;
     try {
         const sessionId = (0, utils_1.getOrCreateSessionId)(req);
         const session = session_1.sessionService.getSession(sessionId);
         if (!session) {
-            utils_2.logger.warn('Invalid or missing session ID', { sessionId });
+            const isSseGet = req.method === 'GET';
+            utils_2.logger.warn(isSseGet
+                ? 'MCP SSE GET: session not in store (404 — client should reinitialize)'
+                : 'Session not in store (404)', {
+                event: 'MCP_SSE_SESSION_GONE',
+                reason: 'not_in_store',
+                httpMethod: req.method,
+                sessionId,
+                userId: (_c = (_b = (_a = req.auth) === null || _a === void 0 ? void 0 : _a.extra) === null || _b === void 0 ? void 0 : _b.user) === null || _c === void 0 ? void 0 : _c.id,
+                traceId: (0, request_context_1.getTraceId)(),
+                hint: isSseGet
+                    ? 'Idle TTL elapsed, max wall-clock age reached, cleanup, or never initialized.'
+                    : undefined,
+            });
             res.status(404).json({
                 jsonrpc: '2.0',
                 error: {
@@ -276,7 +605,14 @@ async function handleSessionRequestGetDelete(req, res) {
         }
         // Check if session is expired
         if (session_1.sessionService.isSessionExpired(sessionId)) {
-            utils_2.logger.warn('Session expired, destroying', { sessionId });
+            utils_2.logger.warn('MCP session expired (metrics); destroying', {
+                event: 'MCP_SSE_SESSION_GONE',
+                reason: 'expired',
+                httpMethod: req.method,
+                sessionId,
+                userId: (_f = (_e = (_d = req.auth) === null || _d === void 0 ? void 0 : _d.extra) === null || _e === void 0 ? void 0 : _e.user) === null || _f === void 0 ? void 0 : _f.id,
+                traceId: (0, request_context_1.getTraceId)(),
+            });
             session_1.sessionService.destroySession(sessionId);
             res.status(404).json({
                 jsonrpc: '2.0',
@@ -288,21 +624,26 @@ async function handleSessionRequestGetDelete(req, res) {
             });
             return;
         }
+        (0, request_context_1.updateRequestContext)({
+            sessionId: sessionId || undefined,
+            userId: (_j = (_h = (_g = req.auth) === null || _g === void 0 ? void 0 : _g.extra) === null || _h === void 0 ? void 0 : _h.user) === null || _j === void 0 ? void 0 : _j.id,
+        });
         // Record interaction for metrics
         // Don't record interaction for tool calls as they'll be recorded separately
-        if (((_a = req.body) === null || _a === void 0 ? void 0 : _a.method) !== 'tools/call') {
+        if (((_k = req.body) === null || _k === void 0 ? void 0 : _k.method) !== 'tools/call') {
             session_1.sessionService.recordInteraction(sessionId);
         }
         await session.transport.handleRequest(req, res, req.body);
         if (req.method === 'DELETE') {
+            session_1.toolCallQueueService.clearSession(sessionId);
             session_1.sessionService.destroySession(sessionId);
         }
     }
     catch (err) {
-        const sessionId = (0, utils_1.getOrCreateSessionId)(req);
+        const sessionIdForErr = (0, utils_1.getOrCreateSessionId)(req);
         // Record error in session metrics
-        if (sessionId) {
-            session_1.sessionService.recordError(sessionId);
+        if (sessionIdForErr) {
+            session_1.sessionService.recordError(sessionIdForErr);
         }
         utils_2.logger.error('❌ Error in handleSessionRequestGetDelete', {
             error: {
@@ -311,7 +652,7 @@ async function handleSessionRequestGetDelete(req, res) {
             },
             method: req.method,
             url: req.url,
-            sessionId,
+            sessionId: sessionIdForErr,
         });
         if (!res.headersSent) {
             res.status(500).json({
@@ -368,6 +709,7 @@ if (!(0, config_1.isTestEnvironment)()) {
                 ttlMs: sessionConfig.ttlMs,
                 maxSessions: sessionConfig.maxSessions,
                 cleanupIntervalMs: sessionConfig.cleanupIntervalMs,
+                maxWallClockAgeMs: sessionConfig.maxWallClockAgeMs,
             },
         });
     });