@cyanheads/mcp-ts-core 0.11.4 → 0.12.0

package/dist/mcp-server/transports/http/sessionStore.js

@@ -1,13 +1,23 @@
 /**
- * @fileoverview Simple in-memory session store for MCP HTTP transport.
- * Implements session management as per MCP Spec 2025-06-18.
- * @see {@link https://modelcontextprotocol.io/specification/2025-06-18/basic/transports#session-management | MCP Session Management}
+ * @fileoverview In-memory session registry for the HTTP transport's sessionful
+ * (2025-era) arm.
+ *
+ * The SDK's streamable HTTP transport owns the protocol side of a session — it
+ * mints the ID, rejects unknown ones, stamps `Mcp-Session-Id`, and answers
+ * DELETE. This store owns what the SDK deliberately does not: binding a session
+ * to the authenticated identity that created it, capping concurrent sessions,
+ * expiring idle ones, and holding the `McpServer` + transport pair that serves
+ * the session for its lifetime.
+ *
+ * The 2026-07-28 revision has no session at all, so nothing here applies to it.
+ *
+ * @see {@link https://modelcontextprotocol.io/specification/2026-07-28/basic/transports | MCP Transports}
  * @module src/mcp-server/transports/http/sessionStore
  */
 import { validateSessionIdFormat } from '../../../mcp-server/transports/http/sessionIdUtils.js';
 import { invalidParams, serviceUnavailable } from '../../../types-global/errors.js';
 import { logger } from '../../../utils/internal/logger.js';
-import { requestContextService } from '../../../utils/internal/requestContext.js';
+import { requestContextService, withExtra } from '../../../utils/internal/requestContext.js';
 import { ATTR_MCP_SESSION_EVENT } from '../../../utils/telemetry/attributes.js';
 import { createCounter, createHistogram } from '../../../utils/telemetry/metrics.js';
 let sessionEventCounter;
@@ -21,10 +31,6 @@ function getSessionMetrics() {
 export function initSessionMetrics() {
     getSessionMetrics();
 }
-/**
- * Simple in-memory session store for stateful MCP sessions.
- * In production, consider using Redis or another persistent store.
- */
 /** Default maximum number of concurrent sessions before new ones are rejected. */
 const DEFAULT_MAX_SESSIONS = 10_000;
 export class SessionStore {
@@ -36,169 +42,89 @@ export class SessionStore {
         this.staleTimeout = staleTimeoutMs;
         this.maxSessions = maxSessions;
         // Clean up stale sessions every minute. unref() prevents blocking graceful shutdown.
-        this.cleanupInterval = setInterval(() => this.cleanupStaleSessions(), 60_000);
+        this.cleanupInterval = setInterval(() => void this.cleanupStaleSessions(), 60_000);
         this.cleanupInterval.unref?.();
     }
     /**
-     * Stops the cleanup interval and clears all sessions.
+     * Stops the cleanup interval and closes every live connection.
      * Call this during transport shutdown to prevent resource leaks.
      */
-    destroy() {
+    async destroy() {
         clearInterval(this.cleanupInterval);
-        for (const session of this.sessions.values())
-            this.abortSessionRequests(session);
+        const connections = [...this.sessions.values()].map((session) => session.connection);
         this.sessions.clear();
+        await Promise.allSettled(connections.map((connection) => closeConnection(connection)));
     }
     /**
-     * Creates or retrieves a session with optional identity binding.
-     * If identity is provided, binds the session to prevent cross-tenant/client hijacking.
+     * Throws before a new session's protocol instances are built when the server
+     * is already at capacity — allocating them first and discarding them is the
+     * expensive way to answer 503.
      *
-     * @param sessionId - The session identifier
-     * @param identity - Optional identity info (tenantId, clientId, subject)
-     * @returns The session object
-     * @throws {McpError} If session ID format is invalid
+     * @throws {McpError} `ServiceUnavailable` when at `maxSessions`.
+     */
+    assertCapacity() {
+        if (this.sessions.size < this.maxSessions)
+            return;
+        const context = requestContextService.createRequestContext({
+            operation: 'SessionStore.assertCapacity',
+            additionalContext: {
+                currentSessions: this.sessions.size,
+                maxSessions: this.maxSessions,
+            },
+        });
+        logger.warning('Session capacity reached, rejecting new session', context);
+        throw serviceUnavailable(`Maximum session capacity reached (${this.maxSessions}). Try again later.`, context);
+    }
+    /**
+     * Records a session the SDK transport just initialized, binding it to the
+     * identity that created it.
+     *
+     * @throws {McpError} `InvalidParams` when the session ID format is invalid,
+     *   `ServiceUnavailable` when at capacity.
      */
-    getOrCreate(sessionId, identity) {
-        // Validate session ID format to prevent injection attacks
+    register(sessionId, connection, identity) {
         if (!validateSessionIdFormat(sessionId)) {
             const context = requestContextService.createRequestContext({
-                operation: 'SessionStore.getOrCreate',
-                sessionIdPrefix: sessionId.substring(0, 16),
+                operation: 'SessionStore.register',
+                additionalContext: { sessionIdPrefix: sessionId.substring(0, 16) },
             });
             logger.warning('Invalid session ID format rejected', context);
             throw invalidParams('Invalid session ID format. Session IDs must be 64 hexadecimal characters.', context);
         }
-        let session = this.sessions.get(sessionId);
-        if (!session) {
-            // Enforce maximum session capacity to prevent unbounded memory growth
-            if (this.sessions.size >= this.maxSessions) {
-                const context = requestContextService.createRequestContext({
-                    operation: 'SessionStore.getOrCreate',
-                    currentSessions: this.sessions.size,
-                    maxSessions: this.maxSessions,
-                });
-                logger.warning('Session capacity reached, rejecting new session', context);
-                throw serviceUnavailable(`Maximum session capacity reached (${this.maxSessions}). Try again later.`, context);
-            }
-            // Build session object conditionally to satisfy exactOptionalPropertyTypes.
-            // Identity is bound atomically as a snapshot on creation.
-            const hasIdentity = !!(identity?.tenantId || identity?.clientId || identity?.subject);
-            const now = new Date();
-            const newSession = {
-                id: sessionId,
-                createdAt: now,
-                lastAccessedAt: now,
-                identityBound: hasIdentity,
-                inFlightRequests: new Map(),
-            };
-            // Only set identity fields if they have actual values (not undefined)
-            if (identity?.tenantId)
-                newSession.tenantId = identity.tenantId;
-            if (identity?.clientId)
-                newSession.clientId = identity.clientId;
-            if (identity?.subject)
-                newSession.subject = identity.subject;
-            session = newSession;
-            this.sessions.set(sessionId, session);
-            getSessionMetrics().sessionEventCounter.add(1, { [ATTR_MCP_SESSION_EVENT]: 'created' });
-            const context = requestContextService.createRequestContext({
-                operation: 'SessionStore.create',
-                sessionId,
-                tenantId: identity?.tenantId,
-            });
-            logger.debug('Session created with identity binding', context);
-        }
-        else {
-            session.lastAccessedAt = new Date();
-            // Bind identity atomically on first authenticated request after an
-            // unauthenticated session creation. All fields are snapshotted together
-            // to prevent chimeric identities from per-field races.
-            if (identity && !session.identityBound) {
-                const hasIdentity = !!(identity.tenantId || identity.clientId || identity.subject);
-                if (hasIdentity) {
-                    if (identity.tenantId)
-                        session.tenantId = identity.tenantId;
-                    if (identity.clientId)
-                        session.clientId = identity.clientId;
-                    if (identity.subject)
-                        session.subject = identity.subject;
-                    session.identityBound = true;
-                    const context = requestContextService.createRequestContext({
-                        operation: 'SessionStore.bindIdentity',
-                        sessionId,
-                        tenantId: identity.tenantId,
-                    });
-                    logger.debug('Session identity bound atomically on authenticated request', context);
-                }
-            }
-        }
-        return session;
-    }
-    /** Stores capabilities only after the initialize response succeeded. */
-    setClientCapabilities(sessionId, capabilities) {
-        const session = this.sessions.get(sessionId);
-        if (session)
-            session.clientCapabilities = capabilities;
+        this.assertCapacity();
+        // Identity is bound atomically as a snapshot on creation.
+        const hasIdentity = !!(identity?.tenantId || identity?.clientId || identity?.subject);
+        const now = new Date();
+        const session = {
+            connection,
+            createdAt: now,
+            lastAccessedAt: now,
+            identityBound: hasIdentity,
+        };
+        if (identity?.tenantId)
+            session.tenantId = identity.tenantId;
+        if (identity?.clientId)
+            session.clientId = identity.clientId;
+        if (identity?.subject)
+            session.subject = identity.subject;
+        this.sessions.set(sessionId, session);
+        getSessionMetrics().sessionEventCounter.add(1, { [ATTR_MCP_SESSION_EVENT]: 'created' });
+        logger.debug('Session created with identity binding', requestContextService.createRequestContext({
+            operation: 'SessionStore.register',
+            parentContext: { sessionId },
+            ...(identity?.tenantId && { tenantId: identity.tenantId }),
+        }));
     }
     /**
-     * Builds the minimal state hooks restored onto the next per-request server.
-     * The session ID remains the isolation boundary for both capability state
-     * and cancellation routing.
+     * The live connection for a session, touching its access time.
+     * Call {@link isValidForIdentity} first — this performs no ownership check.
      */
-    createProtocolSessionHooks(sessionId) {
+    getConnection(sessionId) {
         const session = this.sessions.get(sessionId);
         if (!session)
             return;
-        return {
-            ...(session.clientCapabilities && { clientCapabilities: session.clientCapabilities }),
-            registerRequest: (requestId) => this.registerRequest(sessionId, requestId),
-        };
-    }
-    /** Aborts all active handlers with the matching JSON-RPC request ID. */
-    cancelRequest(sessionId, requestId, reason) {
-        const controllers = this.sessions
-            .get(sessionId)
-            ?.inFlightRequests.get(this.requestKey(requestId));
-        if (!controllers || controllers.size === 0)
-            return false;
-        const abortReason = new DOMException(reason || 'MCP request cancelled', 'AbortError');
-        for (const controller of controllers)
-            controller.abort(abortReason);
-        return true;
-    }
-    requestKey(requestId) {
-        return `${typeof requestId}:${String(requestId)}`;
-    }
-    registerRequest(sessionId, requestId) {
-        const session = this.sessions.get(sessionId);
-        const controller = new AbortController();
-        if (!session) {
-            return { signal: controller.signal, unregister: () => undefined };
-        }
-        const key = this.requestKey(requestId);
-        const controllers = session.inFlightRequests.get(key) ?? new Set();
-        controllers.add(controller);
-        session.inFlightRequests.set(key, controllers);
-        let registered = true;
-        return {
-            signal: controller.signal,
-            unregister: () => {
-                if (!registered)
-                    return;
-                registered = false;
-                controllers.delete(controller);
-                if (controllers.size === 0)
-                    session.inFlightRequests.delete(key);
-            },
-        };
-    }
-    abortSessionRequests(session) {
-        const reason = new DOMException('MCP session ended', 'AbortError');
-        for (const controllers of session.inFlightRequests.values()) {
-            for (const controller of controllers)
-                controller.abort(reason);
-        }
-        session.inFlightRequests.clear();
+        session.lastAccessedAt = new Date();
+        return session.connection;
     }
     /**
      * Validates a session with identity binding checks.
@@ -211,6 +137,9 @@ export class SessionStore {
      * 4. Client ID match (if session has clientId)
      * 5. Subject match (if session has subject)
      *
+     * Binds the identity atomically on the first authenticated request when the
+     * session was created unauthenticated.
+     *
      * @param sessionId - The session identifier
      * @param identity - The identity to validate against (from auth)
      * @returns True if session is valid and matches identity
@@ -222,20 +151,40 @@ export class SessionStore {
         }
         // Check staleness
         if (Date.now() - session.lastAccessedAt.getTime() > this.staleTimeout) {
-            this.terminate(sessionId);
+            void this.terminate(sessionId);
             return false;
         }
         // If session has no identity bound, allow (backwards compatibility / no-auth mode)
         if (!session.tenantId && !session.clientId && !session.subject) {
+            // Bind atomically on the first authenticated request after an
+            // unauthenticated creation. All fields are snapshotted together to
+            // prevent chimeric identities from per-field races.
+            if (identity && !session.identityBound) {
+                const hasIdentity = !!(identity.tenantId || identity.clientId || identity.subject);
+                if (hasIdentity) {
+                    if (identity.tenantId)
+                        session.tenantId = identity.tenantId;
+                    if (identity.clientId)
+                        session.clientId = identity.clientId;
+                    if (identity.subject)
+                        session.subject = identity.subject;
+                    session.identityBound = true;
+                    logger.debug('Session identity bound atomically on authenticated request', requestContextService.createRequestContext({
+                        operation: 'SessionStore.bindIdentity',
+                        parentContext: { sessionId },
+                        ...(identity.tenantId && { tenantId: identity.tenantId }),
+                    }));
+                }
+            }
             return true;
         }
         // Lazy-create context only when a warning is likely
         const warn = (message, extra) => {
             const context = requestContextService.createRequestContext({
                 operation: 'SessionStore.isValidForIdentity',
-                sessionId,
+                parentContext: { sessionId },
             });
-            logger.warning(message, extra ? { ...context, ...extra } : context);
+            logger.warning(message, extra ? withExtra(context, extra) : context);
         };
         // If request has no identity but session does, reject (security: session was authenticated)
         if (!identity) {
@@ -273,51 +222,46 @@ export class SessionStore {
         return true;
     }
     /**
-     * Terminates a session.
-     * @param sessionId - The session identifier
+     * Terminates a session and closes its connection.
+     * Idempotent — the SDK transport's own DELETE path also calls this via
+     * `onsessionclosed`, after the request that triggered it already removed it.
      */
-    terminate(sessionId) {
+    async terminate(sessionId) {
         const session = this.sessions.get(sessionId);
-        if (session) {
-            this.abortSessionRequests(session);
-            this.sessions.delete(sessionId);
-            const metrics = getSessionMetrics();
-            metrics.sessionEventCounter.add(1, { [ATTR_MCP_SESSION_EVENT]: 'terminated' });
-            metrics.sessionDuration.record((Date.now() - session.createdAt.getTime()) / 1000);
-            const context = requestContextService.createRequestContext({
-                operation: 'SessionStore.terminate',
-                sessionId,
-            });
-            logger.info('Session terminated', context);
-        }
+        if (!session)
+            return;
+        this.sessions.delete(sessionId);
+        const metrics = getSessionMetrics();
+        metrics.sessionEventCounter.add(1, { [ATTR_MCP_SESSION_EVENT]: 'terminated' });
+        metrics.sessionDuration.record((Date.now() - session.createdAt.getTime()) / 1000);
+        logger.info('Session terminated', requestContextService.createRequestContext({
+            operation: 'SessionStore.terminate',
+            parentContext: { sessionId },
+        }));
+        await closeConnection(session.connection);
     }
-    /**
-     * Cleans up stale sessions that haven't been accessed recently.
-     */
-    cleanupStaleSessions() {
+    /** Cleans up stale sessions that haven't been accessed recently. */
+    async cleanupStaleSessions() {
         const now = Date.now();
-        let cleanedCount = 0;
+        const stale = [];
         const metrics = getSessionMetrics();
         for (const [id, session] of this.sessions.entries()) {
             if (now - session.lastAccessedAt.getTime() > this.staleTimeout) {
-                this.abortSessionRequests(session);
                 metrics.sessionDuration.record((now - session.createdAt.getTime()) / 1000);
                 this.sessions.delete(id);
-                cleanedCount++;
+                stale.push(session);
             }
         }
-        if (cleanedCount > 0) {
-            metrics.sessionEventCounter.add(cleanedCount, {
-                [ATTR_MCP_SESSION_EVENT]: 'stale_cleanup',
-            });
-            const context = requestContextService.createRequestContext({
-                operation: 'SessionStore.cleanup',
-            });
-            logger.debug('Cleaned up stale sessions', {
-                ...context,
-                count: cleanedCount,
-            });
-        }
+        if (stale.length === 0)
+            return;
+        metrics.sessionEventCounter.add(stale.length, {
+            [ATTR_MCP_SESSION_EVENT]: 'stale_cleanup',
+        });
+        logger.debug('Cleaned up stale sessions', requestContextService.createRequestContext({
+            operation: 'SessionStore.cleanup',
+            additionalContext: { count: stale.length },
+        }));
+        await Promise.allSettled(stale.map((session) => closeConnection(session.connection)));
     }
     /**
      * Gets the current number of active sessions.
@@ -327,4 +271,16 @@ export class SessionStore {
         return this.sessions.size;
     }
 }
+/** Closes a session's server and transport, tolerating either one throwing. */
+export async function closeConnection(connection) {
+    const results = await Promise.allSettled([
+        connection.transport.close(),
+        connection.server.close(),
+    ]);
+    for (const result of results) {
+        if (result.status === 'rejected') {
+            logger.warning(`Failed to close a session surface: ${result.reason instanceof Error ? result.reason.message : String(result.reason)}`);
+        }
+    }
+}
 //# sourceMappingURL=sessionStore.js.map

package/dist/mcp-server/transports/http/sessionStore.js.map

@@ -1 +1 @@
-{"version":3,"file":"sessionStore.js","sourceRoot":"","sources":["../../../../src/mcp-server/transports/http/sessionStore.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAAE,uBAAuB,EAAE,MAAM,gDAAgD,CAAC;AACzF,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC7E,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAE9E,IAAI,mBAAiE,CAAC;AACtE,IAAI,eAA+D,CAAC;AAEpE,SAAS,iBAAiB;IACxB,mBAAmB,KAAK,aAAa,CACnC,qBAAqB,EACrB,0BAA0B,EAC1B,UAAU,CACX,CAAC;IACF,eAAe,KAAK,eAAe,CACjC,sBAAsB,EACtB,+CAA+C,EAC/C,GAAG,CACJ,CAAC;IACF,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,CAAC;AAClD,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,kBAAkB;IAChC,iBAAiB,EAAE,CAAC;AACtB,CAAC;AAkCD;;;GAGG;AACH,kFAAkF;AAClF,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAEpC,MAAM,OAAO,YAAY;IACf,QAAQ,GAAyB,IAAI,GAAG,EAAE,CAAC;IAC3C,YAAY,CAAS;IACrB,WAAW,CAAS;IACpB,eAAe,CAAiC;IAExD,YAAY,cAAsB,EAAE,WAAW,GAAW,oBAAoB;QAC5E,IAAI,CAAC,YAAY,GAAG,cAAc,CAAC;QACnC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,qFAAqF;QACrF,IAAI,CAAC,eAAe,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,MAAM,CAAC,CAAC;QAC9E,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,EAAE,CAAC;IACjC,CAAC;IAED;;;OAGG;IACH,OAAO;QACL,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACpC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE;YAAE,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACjF,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;IAED;;;;;;;;OAQG;IACH,WAAW,CAAC,SAAiB,EAAE,QAA0B;QACvD,0DAA0D;QAC1D,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,MAAM,OAAO,GAAG,qBAAqB,CAAC,oBAAoB,CAAC;gBACzD,SAAS,EAAE,0BAA0B;gBACrC,eAAe,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC;aAC5C,CAAC,CAAC;YACH,MAAM,CAAC,OAAO,CAAC,oCAAoC,EAAE,OAAO,CAAC,CAAC;YAC9D,MAAM,aAAa,CACjB,2EAA2E,EAC3E,OAAO,CACR,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAE3C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,sEAAsE;YACtE,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC3C,MAAM,OAAO,GAAG,qBAAqB,CAAC,oBAAoB,CAAC;oBACzD,SAAS,EAAE,0BAA0B;oBACrC,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;oBACnC,WAAW,EAAE,IAAI,CAAC,WAAW;iBAC9B,CAAC,CAAC;gBACH,MAAM,CAAC,OAAO,CAAC,iDAAiD,EAAE,OAAO,CAAC,CAAC;gBAC3E,MAAM,kBAAkB,CACtB,qCAAqC,IAAI,CAAC,WAAW,qBAAqB,EAC1E,OAAO,CACR,CAAC;YACJ,CAAC;YAED,4EAA4E;YAC5E,0DAA0D;YAC1D,MAAM,WAAW,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,QAAQ,IAAI,QAAQ,EAAE,QAAQ,IAAI,QAAQ,EAAE,OAAO,CAAC,CAAC;YACtF,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,UAAU,GAAY;gBAC1B,EAAE,EAAE,SAAS;gBACb,SAAS,EAAE,GAAG;gBACd,cAAc,EAAE,GAAG;gBACnB,aAAa,EAAE,WAAW;gBAC1B,gBAAgB,EAAE,IAAI,GAAG,EAAE;aAC5B,CAAC;YAEF,sEAAsE;YACtE,IAAI,QAAQ,EAAE,QAAQ;gBAAE,UAAU,CAAC,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;YAChE,IAAI,QAAQ,EAAE,QAAQ;gBAAE,UAAU,CAAC,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;YAChE,IAAI,QAAQ,EAAE,OAAO;gBAAE,UAAU,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;YAE7D,OAAO,GAAG,UAAU,CAAC;YACrB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACtC,iBAAiB,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;YACxF,MAAM,OAAO,GAAG,qBAAqB,CAAC,oBAAoB,CAAC;gBACzD,SAAS,EAAE,qBAAqB;gBAChC,SAAS;gBACT,QAAQ,EAAE,QAAQ,EAAE,QAAQ;aAC7B,CAAC,CAAC;YACH,MAAM,CAAC,KAAK,CAAC,uCAAuC,EAAE,OAAO,CAAC,CAAC;QACjE,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,cAAc,GAAG,IAAI,IAAI,EAAE,CAAC;YAEpC,mEAAmE;YACnE,wEAAwE;YACxE,uDAAuD;YACvD,IAAI,QAAQ,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;gBACvC,MAAM,WAAW,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACnF,IAAI,WAAW,EAAE,CAAC;oBAChB,IAAI,QAAQ,CAAC,QAAQ;wBAAE,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;oBAC5D,IAAI,QAAQ,CAAC,QAAQ;wBAAE,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;oBAC5D,IAAI,QAAQ,CAAC,OAAO;wBAAE,OAAO,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;oBACzD,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;oBAC7B,MAAM,OAAO,GAAG,qBAAqB,CAAC,oBAAoB,CAAC;wBACzD,SAAS,EAAE,2BAA2B;wBACtC,SAAS;wBACT,QAAQ,EAAE,QAAQ,CAAC,QAAQ;qBAC5B,CAAC,CAAC;oBACH,MAAM,CAAC,KAAK,CAAC,4DAA4D,EAAE,OAAO,CAAC,CAAC;gBACtF,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,wEAAwE;IACxE,qBAAqB,CAAC,SAAiB,EAAE,YAAgC;QACvE,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,OAAO;YAAE,OAAO,CAAC,kBAAkB,GAAG,YAAY,CAAC;IACzD,CAAC;IAED;;;;OAIG;IACH,0BAA0B,CAAC,SAAiB;QAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO;YAAE,OAAO;QAErB,OAAO;YACL,GAAG,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,EAAE,CAAC;YACrF,eAAe,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,SAAS,CAAC;SAC3E,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,aAAa,CAAC,SAAiB,EAAE,SAAoB,EAAE,MAAe;QACpE,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ;aAC9B,GAAG,CAAC,SAAS,CAAC;YACf,EAAE,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAEzD,MAAM,WAAW,GAAG,IAAI,YAAY,CAAC,MAAM,IAAI,uBAAuB,EAAE,YAAY,CAAC,CAAC;QACtF,KAAK,MAAM,UAAU,IAAI,WAAW;YAAE,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,UAAU,CAAC,SAAoB;QACrC,OAAO,GAAG,OAAO,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;IACpD,CAAC;IAEO,eAAe,CAAC,SAAiB,EAAE,SAAoB;QAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;QACpE,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,EAAmB,CAAC;QACpF,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC5B,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC/C,IAAI,UAAU,GAAG,IAAI,CAAC;QAEtB,OAAO;YACL,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,UAAU,EAAE,GAAG,EAAE;gBACf,IAAI,CAAC,UAAU;oBAAE,OAAO;gBACxB,UAAU,GAAG,KAAK,CAAC;gBACnB,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;gBAC/B,IAAI,WAAW,CAAC,IAAI,KAAK,CAAC;oBAAE,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACnE,CAAC;SACF,CAAC;IACJ,CAAC;IAEO,oBAAoB,CAAC,OAAgB;QAC3C,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,mBAAmB,EAAE,YAAY,CAAC,CAAC;QACnE,KAAK,MAAM,WAAW,IAAI,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,EAAE,CAAC;YAC5D,KAAK,MAAM,UAAU,IAAI,WAAW;gBAAE,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;IACnC,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,kBAAkB,CAAC,SAAiB,EAAE,QAA0B;QAC9D,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAC;QACf,CAAC;QAED,kBAAkB;QAClB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YACtE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,mFAAmF;QACnF,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YAC/D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,oDAAoD;QACpD,MAAM,IAAI,GAAG,CAAC,OAAe,EAAE,KAA+B,EAAE,EAAE;YAChE,MAAM,OAAO,GAAG,qBAAqB,CAAC,oBAAoB,CAAC;gBACzD,SAAS,EAAE,iCAAiC;gBAC5C,SAAS;aACV,CAAC,CAAC;YACH,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACtE,CAAC,CAAC;QAEF,4FAA4F;QAC5F,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,6DAA6D,CAAC,CAAC;YACpE,iBAAiB,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;YACzF,OAAO,KAAK,CAAC;QACf,CAAC;QAED,sFAAsF;QACtF,IAAI,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;YAC/D,IAAI,CAAC,sDAAsD,EAAE;gBAC3D,aAAa,EAAE,OAAO,CAAC,QAAQ;gBAC/B,aAAa,EAAE,QAAQ,CAAC,QAAQ;aACjC,CAAC,CAAC;YACH,iBAAiB,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;YACzF,OAAO,KAAK,CAAC;QACf,CAAC;QAED,sFAAsF;QACtF,IAAI,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;YAC/D,IAAI,CAAC,sDAAsD,EAAE;gBAC3D,aAAa,EAAE,OAAO,CAAC,QAAQ;gBAC/B,aAAa,EAAE,QAAQ,CAAC,QAAQ;aACjC,CAAC,CAAC;YACH,iBAAiB,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;YACzF,OAAO,KAAK,CAAC;QACf,CAAC;QAED,oFAAoF;QACpF,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC5D,IAAI,CAAC,uDAAuD,EAAE;gBAC5D,cAAc,EAAE,OAAO,CAAC,OAAO;gBAC/B,cAAc,EAAE,QAAQ,CAAC,OAAO;aACjC,CAAC,CAAC;YACH,iBAAiB,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;YACzF,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,SAAS,CAAC,SAAiB;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;YACnC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAChC,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;YACpC,OAAO,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC;YAC/E,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;YAClF,MAAM,OAAO,GAAG,qBAAqB,CAAC,oBAAoB,CAAC;gBACzD,SAAS,EAAE,wBAAwB;gBACnC,SAAS;aACV,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAED;;OAEG;IACK,oBAAoB;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,YAAY,GAAG,CAAC,CAAC;QAErB,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;QACpC,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;YACpD,IAAI,GAAG,GAAG,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC/D,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;gBACnC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;gBAC3E,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACzB,YAAY,EAAE,CAAC;YACjB,CAAC;QACH,CAAC;QAED,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,CAAC,mBAAmB,CAAC,GAAG,CAAC,YAAY,EAAE;gBAC5C,CAAC,sBAAsB,CAAC,EAAE,eAAe;aAC1C,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,qBAAqB,CAAC,oBAAoB,CAAC;gBACzD,SAAS,EAAE,sBAAsB;aAClC,CAAC,CAAC;YACH,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE;gBACxC,GAAG,OAAO;gBACV,KAAK,EAAE,YAAY;aACpB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,eAAe;QACb,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;IAC5B,CAAC;CACF"}
+{"version":3,"file":"sessionStore.js","sourceRoot":"","sources":["../../../../src/mcp-server/transports/http/sessionStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAOH,OAAO,EAAE,uBAAuB,EAAE,MAAM,gDAAgD,CAAC;AACzF,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC7E,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,oCAAoC,CAAC;AACtF,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAE9E,IAAI,mBAAiE,CAAC;AACtE,IAAI,eAA+D,CAAC;AAEpE,SAAS,iBAAiB;IACxB,mBAAmB,KAAK,aAAa,CACnC,qBAAqB,EACrB,0BAA0B,EAC1B,UAAU,CACX,CAAC;IACF,eAAe,KAAK,eAAe,CACjC,sBAAsB,EACtB,+CAA+C,EAC/C,GAAG,CACJ,CAAC;IACF,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,CAAC;AAClD,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,kBAAkB;IAChC,iBAAiB,EAAE,CAAC;AACtB,CAAC;AAqCD,kFAAkF;AAClF,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAEpC,MAAM,OAAO,YAAY;IACf,QAAQ,GAAyB,IAAI,GAAG,EAAE,CAAC;IAC3C,YAAY,CAAS;IACrB,WAAW,CAAS;IACpB,eAAe,CAAiC;IAExD,YAAY,cAAsB,EAAE,WAAW,GAAW,oBAAoB;QAC5E,IAAI,CAAC,YAAY,GAAG,cAAc,CAAC;QACnC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,qFAAqF;QACrF,IAAI,CAAC,eAAe,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,oBAAoB,EAAE,EAAE,MAAM,CAAC,CAAC;QACnF,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,EAAE,CAAC;IACjC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO;QACX,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACpC,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACrF,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,MAAM,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACzF,CAAC;IAED;;;;;;OAMG;IACH,cAAc;QACZ,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW;YAAE,OAAO;QAClD,MAAM,OAAO,GAAG,qBAAqB,CAAC,oBAAoB,CAAC;YACzD,SAAS,EAAE,6BAA6B;YACxC,iBAAiB,EAAE;gBACjB,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;gBACnC,WAAW,EAAE,IAAI,CAAC,WAAW;aAC9B;SACF,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,iDAAiD,EAAE,OAAO,CAAC,CAAC;QAC3E,MAAM,kBAAkB,CACtB,qCAAqC,IAAI,CAAC,WAAW,qBAAqB,EAC1E,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,QAAQ,CAAC,SAAiB,EAAE,UAA6B,EAAE,QAA0B;QACnF,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,MAAM,OAAO,GAAG,qBAAqB,CAAC,oBAAoB,CAAC;gBACzD,SAAS,EAAE,uBAAuB;gBAClC,iBAAiB,EAAE,EAAE,eAAe,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;aACnE,CAAC,CAAC;YACH,MAAM,CAAC,OAAO,CAAC,oCAAoC,EAAE,OAAO,CAAC,CAAC;YAC9D,MAAM,aAAa,CACjB,2EAA2E,EAC3E,OAAO,CACR,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,cAAc,EAAE,CAAC;QAEtB,0DAA0D;QAC1D,MAAM,WAAW,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,QAAQ,IAAI,QAAQ,EAAE,QAAQ,IAAI,QAAQ,EAAE,OAAO,CAAC,CAAC;QACtF,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAY;YACvB,UAAU;YACV,SAAS,EAAE,GAAG;YACd,cAAc,EAAE,GAAG;YACnB,aAAa,EAAE,WAAW;SAC3B,CAAC;QACF,IAAI,QAAQ,EAAE,QAAQ;YAAE,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;QAC7D,IAAI,QAAQ,EAAE,QAAQ;YAAE,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;QAC7D,IAAI,QAAQ,EAAE,OAAO;YAAE,OAAO,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;QAE1D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACtC,iBAAiB,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;QACxF,MAAM,CAAC,KAAK,CACV,uCAAuC,EACvC,qBAAqB,CAAC,oBAAoB,CAAC;YACzC,SAAS,EAAE,uBAAuB;YAClC,aAAa,EAAE,EAAE,SAAS,EAAE;YAC5B,GAAG,CAAC,QAAQ,EAAE,QAAQ,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;SAC3D,CAAC,CACH,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,aAAa,CAAC,SAAiB;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,OAAO,CAAC,cAAc,GAAG,IAAI,IAAI,EAAE,CAAC;QACpC,OAAO,OAAO,CAAC,UAAU,CAAC;IAC5B,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,kBAAkB,CAAC,SAAiB,EAAE,QAA0B;QAC9D,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAC;QACf,CAAC;QAED,kBAAkB;QAClB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YACtE,KAAK,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YAC/B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,mFAAmF;QACnF,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YAC/D,8DAA8D;YAC9D,mEAAmE;YACnE,oDAAoD;YACpD,IAAI,QAAQ,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;gBACvC,MAAM,WAAW,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACnF,IAAI,WAAW,EAAE,CAAC;oBAChB,IAAI,QAAQ,CAAC,QAAQ;wBAAE,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;oBAC5D,IAAI,QAAQ,CAAC,QAAQ;wBAAE,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;oBAC5D,IAAI,QAAQ,CAAC,OAAO;wBAAE,OAAO,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;oBACzD,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;oBAC7B,MAAM,CAAC,KAAK,CACV,4DAA4D,EAC5D,qBAAqB,CAAC,oBAAoB,CAAC;wBACzC,SAAS,EAAE,2BAA2B;wBACtC,aAAa,EAAE,EAAE,SAAS,EAAE;wBAC5B,GAAG,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;qBAC1D,CAAC,CACH,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,oDAAoD;QACpD,MAAM,IAAI,GAAG,CAAC,OAAe,EAAE,KAA+B,EAAE,EAAE;YAChE,MAAM,OAAO,GAAG,qBAAqB,CAAC,oBAAoB,CAAC;gBACzD,SAAS,EAAE,iCAAiC;gBAC5C,aAAa,EAAE,EAAE,SAAS,EAAE;aAC7B,CAAC,CAAC;YACH,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACvE,CAAC,CAAC;QAEF,4FAA4F;QAC5F,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,6DAA6D,CAAC,CAAC;YACpE,iBAAiB,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;YACzF,OAAO,KAAK,CAAC;QACf,CAAC;QAED,sFAAsF;QACtF,IAAI,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;YAC/D,IAAI,CAAC,sDAAsD,EAAE;gBAC3D,aAAa,EAAE,OAAO,CAAC,QAAQ;gBAC/B,aAAa,EAAE,QAAQ,CAAC,QAAQ;aACjC,CAAC,CAAC;YACH,iBAAiB,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;YACzF,OAAO,KAAK,CAAC;QACf,CAAC;QAED,sFAAsF;QACtF,IAAI,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;YAC/D,IAAI,CAAC,sDAAsD,EAAE;gBAC3D,aAAa,EAAE,OAAO,CAAC,QAAQ;gBAC/B,aAAa,EAAE,QAAQ,CAAC,QAAQ;aACjC,CAAC,CAAC;YACH,iBAAiB,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;YACzF,OAAO,KAAK,CAAC;QACf,CAAC;QAED,oFAAoF;QACpF,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC5D,IAAI,CAAC,uDAAuD,EAAE;gBAC5D,cAAc,EAAE,OAAO,CAAC,OAAO;gBAC/B,cAAc,EAAE,QAAQ,CAAC,OAAO;aACjC,CAAC,CAAC;YACH,iBAAiB,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;YACzF,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS,CAAC,SAAiB;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO;YAAE,OAAO;QAErB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;QACpC,OAAO,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC;QAC/E,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QAClF,MAAM,CAAC,IAAI,CACT,oBAAoB,EACpB,qBAAqB,CAAC,oBAAoB,CAAC;YACzC,SAAS,EAAE,wBAAwB;YACnC,aAAa,EAAE,EAAE,SAAS,EAAE;SAC7B,CAAC,CACH,CAAC;QACF,MAAM,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC5C,CAAC;IAED,oEAAoE;IAC5D,KAAK,CAAC,oBAAoB;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,KAAK,GAAc,EAAE,CAAC;QAE5B,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;QACpC,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;YACpD,IAAI,GAAG,GAAG,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC/D,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;gBAC3E,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACzB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAE/B,OAAO,CAAC,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE;YAC5C,CAAC,sBAAsB,CAAC,EAAE,eAAe;SAC1C,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CACV,2BAA2B,EAC3B,qBAAqB,CAAC,oBAAoB,CAAC;YACzC,SAAS,EAAE,sBAAsB;YACjC,iBAAiB,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE;SAC3C,CAAC,CACH,CAAC;QACF,MAAM,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACxF,CAAC;IAED;;;OAGG;IACH,eAAe;QACb,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;IAC5B,CAAC;CACF;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,UAA6B;IACjE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;QACvC,UAAU,CAAC,SAAS,CAAC,KAAK,EAAE;QAC5B,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE;KAC1B,CAAC,CAAC;IACH,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACjC,MAAM,CAAC,OAAO,CACZ,sCACE,MAAM,CAAC,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAC/E,EAAE,CACH,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/mcp-server/transports/manager.d.ts

@@ -1,20 +1,28 @@
 import type { AppConfig as AppConfigType } from '../../config/index.js';
 import type { ServerManifest } from '../../core/serverManifest.js';
-import type { McpServerFactory } from '../../mcp-server/protocolSession.js';
-import type { TaskManager } from '../../mcp-server/tasks/core/taskManager.js';
 import type { TransportServer } from '../../mcp-server/transports/ITransport.js';
+import type { FrameworkServerFactory } from '../../mcp-server/types.js';
 import type { logger as LoggerType } from '../../utils/internal/logger.js';
 export declare class TransportManager {
     private config;
     private logger;
     private createMcpServer;
-    private taskManager;
     private manifest;
     private serverInstance;
     private shutdown;
     private heartbeat;
-    constructor(config: AppConfigType, logger: typeof LoggerType, createMcpServer: McpServerFactory, taskManager: TaskManager, manifest: ServerManifest);
+    constructor(config: AppConfigType, logger: typeof LoggerType, createMcpServer: FrameworkServerFactory, manifest: ServerManifest);
     start(): Promise<void>;
+    /**
+     * Periodically pings the client to detect dead connections (orphaned child
+     * processes, crashed hosts).
+     *
+     * Legacy-era connections only: the 2026-07-28 revision removes the
+     * server-to-client request channel, so a server-initiated `ping` has nowhere
+     * to go there. Guarded against re-entry because the factory also runs for a
+     * discarded `server/discover` probe.
+     */
+    private startStdioHeartbeat;
     stop(signal: string): Promise<void>;
     getServer(): TransportServer | null;
 }

package/dist/mcp-server/transports/manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../../../src/mcp-server/transports/manager.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACpE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wCAAwC,CAAC;AAG1E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AAK7E,OAAO,KAAK,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAIvE,qBAAa,gBAAgB;IAMzB,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,eAAe;IACvB,OAAO,CAAC,WAAW;IACnB,OAAO,CAAC,QAAQ;IATlB,OAAO,CAAC,cAAc,CAAgC;IACtD,OAAO,CAAC,QAAQ,CAA6D;IAC7E,OAAO,CAAC,SAAS,CAAiC;IAElD,YACU,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,OAAO,UAAU,EACzB,eAAe,EAAE,gBAAgB,EACjC,WAAW,EAAE,WAAW,EACxB,QAAQ,EAAE,cAAc,EAC9B;IAEE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAkD3B;IAEK,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBxC;IAED,SAAS,IAAI,eAAe,GAAG,IAAI,CAElC;CACF"}
+{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../../../src/mcp-server/transports/manager.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACpE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAG/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AAK7E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,KAAK,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAIvE,qBAAa,gBAAgB;IAMzB,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,eAAe;IACvB,OAAO,CAAC,QAAQ;IARlB,OAAO,CAAC,cAAc,CAAgC;IACtD,OAAO,CAAC,QAAQ,CAA6D;IAC7E,OAAO,CAAC,SAAS,CAAiC;IAElD,YACU,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,OAAO,UAAU,EACzB,eAAe,EAAE,sBAAsB,EACvC,QAAQ,EAAE,cAAc,EAC9B;IAEE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAiC3B;IAED;;;;;;;;OAQG;IACH,OAAO,CAAC,mBAAmB;IAiBrB,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAexC;IAED,SAAS,IAAI,eAAe,GAAG,IAAI,CAElC;CACF"}

package/dist/mcp-server/transports/manager.js

@@ -1,8 +1,3 @@
-/**
- * @fileoverview Manages the lifecycle of the configured MCP transport.
- * @module src/mcp-server/transports/manager
- */
-import { EmptyResultSchema } from '@modelcontextprotocol/sdk/types.js';
 import { HeartbeatMonitor } from '../../mcp-server/transports/heartbeat.js';
 import { startHttpTransport } from '../../mcp-server/transports/http/httpServer.js';
 import { startStdioTransport, stopStdioTransport, } from '../../mcp-server/transports/stdio/stdioTransport.js';
@@ -11,54 +6,41 @@ export class TransportManager {
     config;
     logger;
     createMcpServer;
-    taskManager;
     manifest;
     serverInstance = null;
     shutdown = null;
     heartbeat = null;
-    constructor(config, logger, createMcpServer, taskManager, manifest) {
+    constructor(config, logger, createMcpServer, manifest) {
         this.config = config;
         this.logger = logger;
         this.createMcpServer = createMcpServer;
-        this.taskManager = taskManager;
         this.manifest = manifest;
     }
     async start() {
         const context = requestContextService.createRequestContext({
             operation: 'TransportManager.start',
-            transport: this.config.mcpTransportType,
+            additionalContext: { transport: this.config.mcpTransportType },
         });
         this.logger.info(`Starting transport: ${this.config.mcpTransportType}`, context);
         if (this.config.mcpTransportType === 'http') {
-            // HTTP: pass factory so each request gets a fresh McpServer+transport pair
-            // (SDK 1.26.0 security fix — GHSA-345p-7cg4-v4c7)
             const handle = await startHttpTransport(this.createMcpServer, context, this.manifest);
             this.serverInstance = handle.server;
             this.shutdown = (ctx) => handle.stop(ctx);
         }
         else if (this.config.mcpTransportType === 'stdio') {
-            // Stdio: single client, single connection — one server instance is correct
-            const mcpServer = await this.createMcpServer();
-            this.serverInstance = await startStdioTransport(mcpServer, context);
-            // Start heartbeat for stdio transport — periodically pings the client
-            // to detect dead connections (orphaned child processes, crashed hosts).
-            if (this.config.mcpHeartbeatIntervalMs > 0) {
-                const timeoutMs = Math.min(this.config.mcpHeartbeatIntervalMs, 10_000);
-                this.heartbeat = new HeartbeatMonitor({
-                    intervalMs: this.config.mcpHeartbeatIntervalMs,
-                    missThreshold: this.config.mcpHeartbeatMissThreshold,
-                    sendPing: () => mcpServer.server.request({ method: 'ping' }, EmptyResultSchema, {
-                        timeout: timeoutMs,
-                    }),
-                    onDead: () => void this.stop('heartbeat_timeout'),
-                    transport: 'stdio',
-                }, context);
-                this.heartbeat.start();
-            }
+            // `serveStdio` owns the era decision and pins one instance for the
+            // connection, so the factory is where the pinned server becomes visible.
+            const handle = startStdioTransport(async (requestContext) => {
+                const mcpServer = await this.createMcpServer(requestContext);
+                if (requestContext.era === 'legacy')
+                    this.startStdioHeartbeat(mcpServer, context);
+                return mcpServer;
+            }, context);
+            this.serverInstance = handle;
             this.shutdown = async (ctx) => {
                 this.heartbeat?.stop();
                 this.heartbeat = null;
-                await stopStdioTransport(mcpServer, ctx);
+                await stopStdioTransport(handle, ctx);
             };
         }
         else {
@@ -68,18 +50,38 @@ export class TransportManager {
             throw error;
         }
     }
+    /**
+     * Periodically pings the client to detect dead connections (orphaned child
+     * processes, crashed hosts).
+     *
+     * Legacy-era connections only: the 2026-07-28 revision removes the
+     * server-to-client request channel, so a server-initiated `ping` has nowhere
+     * to go there. Guarded against re-entry because the factory also runs for a
+     * discarded `server/discover` probe.
+     */
+    startStdioHeartbeat(mcpServer, context) {
+        if (this.heartbeat || this.config.mcpHeartbeatIntervalMs <= 0)
+            return;
+        const timeoutMs = Math.min(this.config.mcpHeartbeatIntervalMs, 10_000);
+        this.heartbeat = new HeartbeatMonitor({
+            intervalMs: this.config.mcpHeartbeatIntervalMs,
+            missThreshold: this.config.mcpHeartbeatMissThreshold,
+            sendPing: () => mcpServer.server.request({ method: 'ping' }, { timeout: timeoutMs }),
+            onDead: () => void this.stop('heartbeat_timeout'),
+            transport: 'stdio',
+        }, context);
+        this.heartbeat.start();
+    }
     async stop(signal) {
         const context = requestContextService.createRequestContext({
             operation: 'TransportManager.stop',
-            signal,
+            additionalContext: { signal },
         });
         if (!this.shutdown) {
             this.logger.warning('Stop called but no active server instance found.', context);
             return;
         }
         await this.shutdown(context);
-        // Clean up task manager timers to allow clean process exit
-        this.taskManager.cleanup();
         this.serverInstance = null;
         this.shutdown = null;
     }