@eclipse-glsp/server-mcp 2.7.0-next.9 → 2.7.0

package/lib/util/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/util/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;kFAckF;AAElF,cAAc,iBAAiB,CAAC;AAChC,cAAc,YAAY,CAAC"}

package/lib/util/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/util/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;kFAckF;;;;;;;;;;;;;;;;AAElF,kDAAgC;AAChC,6CAA2B"}

package/lib/util/markdown-util.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"markdown-util.d.ts","sourceRoot":"","sources":["../../src/util/markdown-util.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;kFAckF;AAElF;;GAEG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,MAAM,CAwB9E"}

package/lib/util/markdown-util.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"markdown-util.js","sourceRoot":"","sources":["../../src/util/markdown-util.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;kFAckF;;AAKlF,gEAwBC;AA3BD;;GAEG;AACH,SAAgB,0BAA0B,CAAC,IAA2B;IAClE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACf,OAAO,EAAE,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;IAC/C,MAAM,YAAY,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;IAEnE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAwB,EAAE,EAAE;QACnD,MAAM,SAAS,GAAG,OAAO;aACpB,GAAG,CAAC,MAAM,CAAC,EAAE;;YACV,MAAM,KAAK,GAAG,MAAA,GAAG,CAAC,MAAM,CAAC,mCAAI,EAAE,CAAC;YAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YACxD,CAAC;YACD,+EAA+E;YAC/E,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC/C,CAAC,CAAC;aACD,IAAI,CAAC,KAAK,CAAC,CAAC;QACjB,OAAO,KAAK,SAAS,IAAI,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,SAAS,EAAE,YAAY,EAAE,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC7D,CAAC"}

package/lib/util/mcp-util.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"mcp-util.d.ts","sourceRoot":"","sources":["../../src/util/mcp-util.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;kFAckF;AAElF;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAGxE"}

package/lib/util/mcp-util.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"mcp-util.js","sourceRoot":"","sources":["../../src/util/mcp-util.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;kFAckF;;AAOlF,4CAGC;AARD;;;;GAIG;AACH,SAAgB,gBAAgB,CAAC,IAAY,EAAE,OAAiB;IAC5D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,OAAO,mBAAmB,IAAI,eAAe,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AACnG,CAAC"}

package/src/index.ts

@@ -1,24 +0,0 @@
-/********************************************************************************
- * Copyright (c) 2025-2026 EclipseSource and others.
- *
- * This program and the accompanying materials are made available under the
- * terms of the Eclipse Public License v. 2.0 which is available at
- * http://www.eclipse.org/legal/epl-2.0.
- *
- * This Source Code may also be made available under the following Secondary
- * Licenses when the conditions for such availability set forth in the Eclipse
- * Public License v. 2.0 are satisfied: GNU General Public License, version 2
- * with the GNU Classpath Exception which is available at
- * https://www.gnu.org/software/classpath/license.html.
- *
- * SPDX-License-Identifier: EPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0
- ********************************************************************************/
-export * from './prompts';
-export * from './resources';
-export * from './server';
-export * from './tools';
-export * from './util';
-// Module classes — exported here (not from `./server`) to avoid circular imports through
-// the handler barrels which the modules consume.
-export * from './server/mcp-diagram-module';
-export * from './server/mcp-server-module';

package/src/server/index.ts

@@ -1,42 +0,0 @@
-/********************************************************************************
- * Copyright (c) 2026 EclipseSource and others.
- *
- * This program and the accompanying materials are made available under the
- * terms of the Eclipse Public License v. 2.0 which is available at
- * http://www.eclipse.org/legal/epl-2.0.
- *
- * This Source Code may also be made available under the following Secondary
- * Licenses when the conditions for such availability set forth in the Eclipse
- * Public License v. 2.0 are satisfied: GNU General Public License, version 2
- * with the GNU Classpath Exception which is available at
- * https://www.gnu.org/software/classpath/license.html.
- *
- * SPDX-License-Identifier: EPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0
- ********************************************************************************/
-
-export * from './glsp-mcp-server';
-export * from './mcp-diagram-handler-dispatcher';
-export * from './mcp-diagram-prompt-handler-registry';
-export * from './mcp-diagram-resource-handler-registry';
-export * from './mcp-diagram-tool-handler-registry';
-export * from './mcp-handler-shared';
-export * from './mcp-http-transport';
-export * from './mcp-id-alias-service';
-export * from './mcp-input-schemas';
-export * from './mcp-label-provider';
-export * from './mcp-log-level-registry';
-export * from './mcp-logger';
-export * from './mcp-mime-types';
-export * from './mcp-options';
-export * from './mcp-progress-reporter';
-export * from './mcp-prompt-handler';
-export * from './mcp-request-context';
-export * from './mcp-resource-handler';
-export * from './mcp-server-launcher';
-export * from './mcp-session';
-export * from './mcp-tool-handler';
-
-// `mcp-diagram-module` and `mcp-server-module` are intentionally not re-exported here —
-// they import handler classes from `../resources` / `../tools`, which would create a circular
-// import chain through this barrel. They are re-exported from the package root (`src/index.ts`)
-// after the handler barrels finish initializing.

package/src/server/mcp-http-transport-e2e.spec.ts

@@ -1,151 +0,0 @@
-/********************************************************************************
- * Copyright (c) 2026 EclipseSource and others.
- *
- * This program and the accompanying materials are made available under the
- * terms of the Eclipse Public License v. 2.0 which is available at
- * http://www.eclipse.org/legal/epl-2.0.
- *
- * This Source Code may also be made available under the following Secondary
- * Licenses when the conditions for such availability set forth in the Eclipse
- * Public License v. 2.0 are satisfied: GNU General Public License, version 2
- * with the GNU Classpath Exception which is available at
- * https://www.gnu.org/software/classpath/license.html.
- *
- * SPDX-License-Identifier: EPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0
- ********************************************************************************/
-
-import { Logger, NullLogger } from '@eclipse-glsp/server';
-import { Client } from '@modelcontextprotocol/sdk/client/index.js';
-import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-import { expect } from 'chai';
-import { Container, ContainerModule } from 'inversify';
-import * as z from 'zod/v4';
-import { McpHttpTransport } from './mcp-http-transport';
-import { McpServerOptions } from './mcp-options';
-import { rawHttpRequest } from './raw-http.spec';
-
-function buildTransport(): McpHttpTransport {
-    const container = new Container();
-    container.load(
-        new ContainerModule(bind => {
-            bind(Logger).toConstantValue(new NullLogger());
-            const opts = new McpServerOptions();
-            opts.values = {};
-            bind(McpServerOptions).toConstantValue(opts);
-            bind(McpHttpTransport).toSelf().inSingletonScope();
-        })
-    );
-    return container.get<McpHttpTransport>(McpHttpTransport);
-}
-
-/**
- * WN-058 — End-to-end smoke test that boots {@link McpHttpTransport},
- * connects a real SDK MCP client over Streamable HTTP, and exercises a tool
- * round-trip (`echo`). Validates that the transport implements the protocol
- * conformantly without depending on the GLSP handler stack.
- */
-describe('McpHttpTransport (WN-058 e2e — real MCP SDK client over HTTP)', () => {
-    let httpServer: McpHttpTransport | undefined;
-    let client: Client | undefined;
-
-    /**
-     * Idempotent client close: a test that already tore the SDK client down (e.g. after a
-     * spec-mandated DELETE on the same session) leaves the local `client` ref pointing at a
-     * closed instance. `Client.close()` is safe to call twice on the SDK side, but we still
-     * swallow any throw so afterEach is robust under partial-progress failures too.
-     */
-    async function safeClose(target: Client | undefined): Promise<void> {
-        if (!target) return;
-        try {
-            await target.close();
-        } catch {
-            /* ignore — best effort */
-        }
-    }
-
-    afterEach(async () => {
-        await safeClose(client);
-        client = undefined;
-        httpServer?.dispose();
-        httpServer = undefined;
-    });
-
-    it('round-trips tools/list and tools/call against a registered echo tool', async () => {
-        httpServer = buildTransport();
-
-        // Wire one fresh `McpServer` per accepted session, register an `echo` tool,
-        // and let the server attach to the transport. Mirrors what `McpServerLauncher`
-        // does; kept inline here so the test exercises only the transport path.
-        httpServer.onSessionInitialized(session => {
-            const mcpServer = new McpServer({ name: 'glsp-test', version: '1.0.0' }, { capabilities: {} });
-            mcpServer.registerTool(
-                'echo',
-                { description: 'Returns the supplied message verbatim.', inputSchema: { message: z.string() } },
-                async ({ message }) => ({ content: [{ type: 'text', text: message }] })
-            );
-            mcpServer.connect(session);
-        });
-
-        const endpoint = await httpServer.start({
-            port: 0,
-            host: '127.0.0.1',
-            route: '/mcp',
-            name: 'glsp-test',
-            options: { dataMode: 'tools' }
-        });
-        expect(endpoint.url, 'transport must report a URL after start()').to.be.a('string');
-
-        client = new Client({ name: 'wn-058-test-client', version: '1.0.0' });
-        await client.connect(new StreamableHTTPClientTransport(new URL(endpoint.url!)));
-
-        const tools = await client.listTools();
-        expect(tools.tools.map(tool => tool.name)).to.include('echo');
-
-        const result = await client.callTool({ name: 'echo', arguments: { message: 'hello GLSP' } });
-        expect(result.isError).to.not.equal(true);
-        expect(result.content).to.have.lengthOf(1);
-        const [block] = result.content as Array<{ type: string; text?: string }>;
-        expect(block.type).to.equal('text');
-        expect(block.text).to.equal('hello GLSP');
-    });
-
-    it('DELETE /mcp terminates the session; subsequent POSTs with the same id return 404 (§ #5)', async () => {
-        httpServer = buildTransport();
-        httpServer.onSessionInitialized(session => {
-            const mcpServer = new McpServer({ name: 'glsp-test', version: '1.0.0' }, { capabilities: {} });
-            mcpServer.connect(session);
-        });
-        const endpoint = await httpServer.start({
-            port: 0,
-            host: '127.0.0.1',
-            route: '/mcp',
-            name: 'glsp-test',
-            options: { dataMode: 'tools' }
-        });
-
-        client = new Client({ name: 'delete-smoke-test', version: '1.0.0' });
-        const clientTransport = new StreamableHTTPClientTransport(new URL(endpoint.url!));
-        await client.connect(clientTransport);
-        const sessionId = clientTransport.sessionId;
-        expect(sessionId, 'SDK transport should expose the minted session id after initialize').to.be.a('string');
-
-        const { port } = await httpServer.getAddress();
-
-        // 1. Spec § Session Management #5 — DELETE terminates the session.
-        const deleteRes = await rawHttpRequest(port, 'DELETE', { 'mcp-session-id': sessionId! });
-        expect(deleteRes.status, 'DELETE should succeed for an active session').to.be.lessThan(300);
-
-        // 2. After termination, the same id MUST be rejected with 404 (§ #3) — proves the
-        //    session was actually removed, not just acked.
-        const followUp = await rawHttpRequest(
-            port,
-            'POST',
-            { 'mcp-session-id': sessionId! },
-            { jsonrpc: '2.0', id: 1, method: 'tools/list', params: {} }
-        );
-        expect(followUp.status).to.equal(404);
-        const payload = JSON.parse(followUp.body);
-        expect(payload.error.code).to.equal(-32001);
-    });
-});

package/src/server/mcp-http-transport.spec.ts

@@ -1,385 +0,0 @@
-/********************************************************************************
- * Copyright (c) 2026 EclipseSource and others.
- *
- * This program and the accompanying materials are made available under the
- * terms of the Eclipse Public License v. 2.0 which is available at
- * http://www.eclipse.org/legal/epl-2.0.
- *
- * This Source Code may also be made available under the following Secondary
- * Licenses when the conditions for such availability set forth in the Eclipse
- * Public License v. 2.0 are satisfied: GNU General Public License, version 2
- * with the GNU Classpath Exception which is available at
- * https://www.gnu.org/software/classpath/license.html.
- *
- * SPDX-License-Identifier: EPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0
- ********************************************************************************/
-
-import { Logger, NullLogger } from '@eclipse-glsp/server';
-import { expect } from 'chai';
-import { Container, ContainerModule } from 'inversify';
-import { McpHttpTransport } from './mcp-http-transport';
-import { McpServerOptions } from './mcp-options';
-import { rawHttpRequest } from './raw-http.spec';
-
-/**
- * Builds a transport instance with a configurable `McpServerOptions` binding so tests can
- * exercise the SDK-level host allowlist (forwarded via `createMcpExpressApp`) and our own
- * Origin allowlist (installed in `configureExpressApp`).
- */
-function buildTransport(optionValues: McpServerOptions['values'] = {}): McpHttpTransport {
-    const container = new Container();
-    container.load(
-        new ContainerModule(bind => {
-            bind(Logger).toConstantValue(new NullLogger());
-            const opts = new McpServerOptions();
-            opts.values = optionValues;
-            bind(McpServerOptions).toConstantValue(opts);
-            bind(McpHttpTransport).toSelf().inSingletonScope();
-        })
-    );
-    return container.get<McpHttpTransport>(McpHttpTransport);
-}
-
-describe('McpHttpTransport (startup smoke test)', () => {
-    let httpServer: McpHttpTransport | undefined;
-
-    afterEach(() => {
-        // Always tear down so a failing assertion does not leak the listening socket.
-        httpServer?.dispose();
-        httpServer = undefined;
-    });
-
-    it('binds an HTTP server on a resolvable port and 127.0.0.1 host', async () => {
-        httpServer = buildTransport();
-
-        const endpoint = await httpServer.start({
-            port: 0,
-            host: '127.0.0.1',
-            route: '/mcp',
-            name: 'test',
-            options: { dataMode: 'tools' }
-        });
-
-        expect(endpoint.url).to.match(/^http:\/\/127\.0\.0\.1:\d+\/mcp$/);
-
-        const address = await httpServer.getAddress();
-        expect(address.address).to.equal('127.0.0.1');
-        expect(address.port).to.be.a('number');
-        expect(address.port).to.be.greaterThan(0);
-    });
-
-    it('exposes the underlying http.Server and Express app after start', async () => {
-        httpServer = buildTransport();
-
-        await httpServer.start({
-            port: 0,
-            host: '127.0.0.1',
-            route: '/mcp',
-            name: 'test',
-            options: { dataMode: 'tools' }
-        });
-
-        expect(httpServer.app).to.not.be.undefined;
-        expect(httpServer.server).to.not.be.undefined;
-        expect(httpServer.server!.listening).to.equal(true);
-    });
-
-    it('closes the underlying http.Server on dispose()', async () => {
-        const local = buildTransport();
-
-        await local.start({
-            port: 0,
-            host: '127.0.0.1',
-            route: '/mcp',
-            name: 'test',
-            options: { dataMode: 'tools' }
-        });
-        const underlying = local.server!;
-        expect(underlying.listening).to.equal(true);
-
-        local.dispose();
-
-        // `Server.close()` is asynchronous — wait for the actual close event.
-        await new Promise<void>(resolve => {
-            if (!underlying.listening) {
-                resolve();
-                return;
-            }
-            underlying.once('close', () => resolve());
-        });
-        expect(underlying.listening).to.equal(false);
-    });
-
-    it('rejects start() with an actionable error when the requested port is already in use', async () => {
-        // First transport: bind a random port so we know exactly which port is taken.
-        const first = buildTransport();
-        await first.start({
-            port: 0,
-            host: '127.0.0.1',
-            route: '/mcp',
-            name: 'first',
-            options: { dataMode: 'tools' }
-        });
-        const taken = (await first.getAddress()).port;
-
-        // Second transport: try to bind the same port → EADDRINUSE.
-        const second = buildTransport();
-        try {
-            await expectStartToReject(second, taken);
-        } finally {
-            first.dispose();
-            second.dispose();
-        }
-    });
-
-    async function expectStartToReject(transport: McpHttpTransport, takenPort: number): Promise<void> {
-        let error: Error | undefined;
-        try {
-            await transport.start({
-                port: takenPort,
-                host: '127.0.0.1',
-                route: '/mcp',
-                name: 'second',
-                options: { dataMode: 'tools' }
-            });
-        } catch (err: unknown) {
-            error = err as Error;
-        }
-        expect(error, 'expected start() to reject').to.not.equal(undefined);
-        // The actionable hint must name the offending host:port AND point at the override path.
-        expect(error!.message).to.include(`127.0.0.1:${takenPort}`);
-        expect(error!.message).to.include('mcpServer.port');
-        expect(error!.message).to.match(/already in use/);
-    }
-});
-
-describe('McpHttpTransport (Origin/Host validation — DNS-rebinding mitigation)', () => {
-    let httpServer: McpHttpTransport | undefined;
-
-    afterEach(() => {
-        httpServer?.dispose();
-        httpServer = undefined;
-    });
-
-    it('rejects requests with a Host header outside the allowlist', async () => {
-        httpServer = buildTransport({ allowedHosts: ['127.0.0.1', 'localhost'] });
-        await httpServer.start({ port: 0, host: '127.0.0.1', route: '/mcp', name: 'test', options: {} });
-        const port = (await httpServer.getAddress()).port;
-
-        const res = await rawHttpRequest(port, 'POST', { Host: 'evil.example' }, {});
-
-        expect(res.status).to.equal(403);
-        expect(res.body).to.match(/Host/);
-    });
-
-    it('accepts requests whose Host header matches the allowlist', async () => {
-        httpServer = buildTransport({ allowedHosts: ['127.0.0.1', 'localhost'] });
-        await httpServer.start({ port: 0, host: '127.0.0.1', route: '/mcp', name: 'test', options: {} });
-        const port = (await httpServer.getAddress()).port;
-
-        // No `mcp-session-id` header on a non-init body → session-id gate rejects with 400
-        // (not the middleware's 403). What matters here is that we got *past* the middleware.
-        const res = await rawHttpRequest(port, 'POST', { Host: `127.0.0.1:${port}` }, {});
-
-        expect(res.status).to.not.equal(403);
-    });
-
-    it('rejects requests whose Origin header is outside an explicit allowlist', async () => {
-        httpServer = buildTransport({
-            allowedHosts: ['127.0.0.1', 'localhost'],
-            allowedOrigins: ['https://my-frontend.example']
-        });
-        await httpServer.start({ port: 0, host: '127.0.0.1', route: '/mcp', name: 'test', options: {} });
-        const port = (await httpServer.getAddress()).port;
-
-        const res = await rawHttpRequest(port, 'POST', { Host: '127.0.0.1', Origin: 'https://evil.example' }, {});
-
-        expect(res.status).to.equal(403);
-        expect(res.body).to.match(/Origin/);
-    });
-
-    it('skips Origin checks when allowedOrigins is undefined (desktop-IDE default)', async () => {
-        httpServer = buildTransport({ allowedHosts: ['127.0.0.1', 'localhost'] });
-        await httpServer.start({ port: 0, host: '127.0.0.1', route: '/mcp', name: 'test', options: {} });
-        const port = (await httpServer.getAddress()).port;
-
-        // With allowedOrigins undefined, ANY Origin (or none) is allowed past the middleware.
-        const res = await rawHttpRequest(port, 'POST', { Host: '127.0.0.1', Origin: 'https://anything.example' }, {});
-
-        expect(res.status).to.not.equal(403);
-    });
-});
-
-describe('McpHttpTransport (session-id validation per MCP Streamable HTTP § Session Management)', () => {
-    let httpServer: McpHttpTransport | undefined;
-
-    afterEach(() => {
-        httpServer?.dispose();
-        httpServer = undefined;
-    });
-
-    async function startTransport(): Promise<number> {
-        httpServer = buildTransport({ allowedHosts: ['127.0.0.1', 'localhost'] });
-        await httpServer.start({ port: 0, host: '127.0.0.1', route: '/mcp', name: 'test', options: {} });
-        return (await httpServer.getAddress()).port;
-    }
-
-    it('rejects a non-initialize POST without an Mcp-Session-Id header with 400 (§ #2)', async () => {
-        const port = await startTransport();
-
-        const res = await rawHttpRequest(port, 'POST', {}, { jsonrpc: '2.0', id: 1, method: 'tools/list', params: {} });
-
-        expect(res.status).to.equal(400);
-        const payload = JSON.parse(res.body);
-        expect(payload.jsonrpc).to.equal('2.0');
-        // eslint-disable-next-line no-null/no-null -- JSON-RPC 2.0 § 5 mandates `null` for unattributable error responses.
-        expect(payload.id).to.equal(null);
-        expect(payload.error.code).to.equal(-32000);
-        expect(payload.error.message).to.match(/No valid session ID/);
-    });
-
-    it('rejects a POST with an unknown Mcp-Session-Id with 404 (§ #3)', async () => {
-        const port = await startTransport();
-
-        const res = await rawHttpRequest(
-            port,
-            'POST',
-            { 'mcp-session-id': 'no-such-session' },
-            { jsonrpc: '2.0', id: 1, method: 'tools/list', params: {} }
-        );
-
-        expect(res.status).to.equal(404);
-        const payload = JSON.parse(res.body);
-        expect(payload.jsonrpc).to.equal('2.0');
-        // eslint-disable-next-line no-null/no-null -- JSON-RPC 2.0 § 5 mandates `null` for unattributable error responses.
-        expect(payload.id).to.equal(null);
-        expect(payload.error.code).to.equal(-32001);
-        expect(payload.error.message).to.match(/Session not found/i);
-    });
-
-    it('rejects an initialize POST that carries an unknown Mcp-Session-Id with 404 (§ #3 — must not silently mint)', async () => {
-        const port = await startTransport();
-
-        const initBody = {
-            jsonrpc: '2.0',
-            id: 1,
-            method: 'initialize',
-            params: {
-                protocolVersion: '2025-06-18',
-                capabilities: {},
-                clientInfo: { name: 'test', version: '0.0.1' }
-            }
-        };
-
-        const res = await rawHttpRequest(port, 'POST', { 'mcp-session-id': 'stale-session' }, initBody);
-
-        expect(res.status).to.equal(404);
-        const payload = JSON.parse(res.body);
-        expect(payload.error.code).to.equal(-32001);
-    });
-
-    it('rejects a GET (SSE stream) with an unknown Mcp-Session-Id with the JSON-RPC envelope', async () => {
-        const port = await startTransport();
-
-        const res = await rawHttpRequest(port, 'GET', { 'mcp-session-id': 'no-such-session' });
-
-        expect(res.status).to.equal(404);
-        const payload = JSON.parse(res.body);
-        expect(payload.error.code).to.equal(-32001);
-        // eslint-disable-next-line no-null/no-null -- JSON-RPC 2.0 § 5 mandates `null` for unattributable error responses.
-        expect(payload.id).to.equal(null);
-    });
-
-    it('rejects a DELETE without an Mcp-Session-Id header with the JSON-RPC envelope', async () => {
-        const port = await startTransport();
-
-        const res = await rawHttpRequest(port, 'DELETE', {});
-
-        expect(res.status).to.equal(400);
-        const payload = JSON.parse(res.body);
-        expect(payload.error.code).to.equal(-32000);
-        // eslint-disable-next-line no-null/no-null -- JSON-RPC 2.0 § 5 mandates `null` for unattributable error responses.
-        expect(payload.id).to.equal(null);
-    });
-
-    // Happy path (initialize POST without session id ⇒ new session) is exercised end-to-end
-    // by `mcp-http-transport-e2e.spec.ts` against a real SDK client; not duplicated here
-    // because asserting it inline requires wiring up an `McpServer` to actually respond.
-});
-
-describe('McpHttpTransport (MCP-Protocol-Version header validation)', () => {
-    let httpServer: McpHttpTransport | undefined;
-
-    afterEach(() => {
-        httpServer?.dispose();
-        httpServer = undefined;
-    });
-
-    async function startTransport(): Promise<number> {
-        httpServer = buildTransport({ allowedHosts: ['127.0.0.1', 'localhost'] });
-        await httpServer.start({ port: 0, host: '127.0.0.1', route: '/mcp', name: 'test', options: {} });
-        return (await httpServer.getAddress()).port;
-    }
-
-    it('rejects a non-initialize POST whose MCP-Protocol-Version is unsupported with HTTP 400', async () => {
-        const port = await startTransport();
-
-        const res = await rawHttpRequest(
-            port,
-            'POST',
-            { 'mcp-session-id': 'doesnt-matter', 'mcp-protocol-version': '1999-01-01' },
-            { jsonrpc: '2.0', id: 1, method: 'tools/list', params: {} }
-        );
-
-        expect(res.status).to.equal(400);
-        const payload = JSON.parse(res.body);
-        expect(payload.jsonrpc).to.equal('2.0');
-        // eslint-disable-next-line no-null/no-null -- JSON-RPC 2.0 § 5 mandates `null` for unattributable error responses.
-        expect(payload.id).to.equal(null);
-        expect(payload.error.code).to.equal(-32000);
-        expect(payload.error.message).to.match(/Unsupported MCP-Protocol-Version/);
-        expect(payload.error.message).to.match(/1999-01-01/);
-        expect(payload.error.message).to.match(/Supported versions/);
-    });
-
-    it('rejects a GET whose MCP-Protocol-Version is unsupported with HTTP 400 (header validated before session lookup)', async () => {
-        const port = await startTransport();
-
-        const res = await rawHttpRequest(port, 'GET', { 'mcp-session-id': 'any', 'mcp-protocol-version': 'bogus' });
-
-        expect(res.status).to.equal(400);
-        const payload = JSON.parse(res.body);
-        expect(payload.error.message).to.match(/Unsupported MCP-Protocol-Version/);
-    });
-
-    it('passes a non-initialize POST through when the MCP-Protocol-Version header is absent (spec defaults to 2025-03-26)', async () => {
-        // Without the header, the protocol-version middleware must let the request through to
-        // the next layer (which then enforces session-id rules). Asserting we hit the 400
-        // session-id error — not the 400 protocol-version error — proves the middleware
-        // didn't short-circuit.
-        const port = await startTransport();
-
-        const res = await rawHttpRequest(port, 'POST', {}, { jsonrpc: '2.0', id: 1, method: 'tools/list', params: {} });
-
-        expect(res.status).to.equal(400);
-        const payload = JSON.parse(res.body);
-        expect(payload.error.message).to.match(/No valid session ID/);
-    });
-
-    it('passes a non-initialize POST through when the MCP-Protocol-Version is one of the supported versions', async () => {
-        // Header is supported → middleware passes → we hit the 400 session-id check, not the
-        // 400 protocol-version check.
-        const port = await startTransport();
-
-        const res = await rawHttpRequest(
-            port,
-            'POST',
-            { 'mcp-protocol-version': '2025-06-18' },
-            { jsonrpc: '2.0', id: 1, method: 'tools/list', params: {} }
-        );
-
-        expect(res.status).to.equal(400);
-        const payload = JSON.parse(res.body);
-        expect(payload.error.message).to.match(/No valid session ID/);
-    });
-});