@frontmcp/sdk 0.5.1 → 0.6.1

package/src/tool/ui/index.js

@@ -10,15 +10,15 @@
  * - **static**: Static widget is pre-compiled at startup, client fetches via resources/read
  * - **hybrid**: Shell (React + renderer) cached at startup, component + data in response
  *
- * NOTE: Core Tool UI functionality has moved to @frontmcp/ui/registry for standalone usage.
- * This module re-exports from @frontmcp/ui/registry for backwards compatibility.
+ * NOTE: Core Tool UI functionality is in @frontmcp/uipack/registry for standalone usage.
+ * This module re-exports from @frontmcp/uipack for backwards compatibility.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.StaticWidgetResourceTemplate = exports.createUIResourceHandler = exports.handleUIResourceRead = exports.resetIdCounter = exports.createTemplateHelpers = exports.jsonEmbed = exports.uniqueId = exports.formatCurrency = exports.formatDate = exports.escapeHtml = exports.buildUIMeta = exports.getUIResourceMimeType = exports.buildStaticWidgetUri = exports.parseWidgetUri = exports.isStaticWidgetUri = exports.isUIResourceUri = exports.UI_RESOURCE_SCHEME = exports.containsMdxSyntax = exports.isReactComponent = exports.hasUIConfig = exports.renderToolTemplate = exports.renderToolTemplateAsync = exports.ToolUIRegistry = void 0;
 // ============================================
-// Core Registry (from @frontmcp/ui/registry)
+// Core Registry (from @frontmcp/uipack/registry)
 // ============================================
-var registry_1 = require("@frontmcp/ui/registry");
+var registry_1 = require("@frontmcp/uipack/registry");
 // Registry
 Object.defineProperty(exports, "ToolUIRegistry", { enumerable: true, get: function () { return registry_1.ToolUIRegistry; } });
 // Template rendering

package/src/tool/ui/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/tool/ui/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;;AAEH,+CAA+C;AAC/C,6CAA6C;AAC7C,+CAA+C;AAC/C,kDAgB+B;AAf7B,WAAW;AACX,0GAAA,cAAc,OAAA;AACd,qBAAqB;AACrB,mHAAA,uBAAuB,OAAA;AACvB,8GAAA,kBAAkB,OAAA;AAClB,uGAAA,WAAW,OAAA;AACX,4GAAA,gBAAgB,OAAA;AAChB,6GAAA,iBAAiB,OAAA;AACjB,gBAAgB;AAChB,8GAAA,kBAAkB,OAAA;AAClB,2GAAA,eAAe,OAAA;AACf,6GAAA,iBAAiB,OAAA;AACjB,0GAAA,cAAc,OAAA;AACd,gHAAA,oBAAoB,OAAA;AACpB,iHAAA,qBAAqB,OAAA;AAgBvB,+CAA+C;AAC/C,iDAAiD;AACjD,+CAA+C;AAC/C,yDAAkD;AAAzC,gHAAA,WAAW,OAAA;AAGpB,+CAA+C;AAC/C,+CAA+C;AAC/C,+CAA+C;AAC/C,uDAQ4B;AAP1B,8GAAA,UAAU,OAAA;AACV,8GAAA,UAAU,OAAA;AACV,kHAAA,cAAc,OAAA;AACd,4GAAA,QAAQ,OAAA;AACR,6GAAA,SAAS,OAAA;AACT,yHAAA,qBAAqB,OAAA;AACrB,kHAAA,cAAc,OAAA;AAGhB,+CAA+C;AAC/C,iCAAiC;AACjC,+CAA+C;AAC/C,yEAAyE;AACzE,6DAAsF;AAA7E,2HAAA,oBAAoB,OAAA;AAAE,8HAAA,uBAAuB,OAAA;AAGtD,uDAAuD;AACvD,+DAAsE;AAA7D,oIAAA,4BAA4B,OAAA","sourcesContent":["/**\n * Tool UI Module\n *\n * Provides UI template rendering and platform-specific metadata generation\n * for MCP tool responses.\n *\n * Three serving modes:\n * - **inline**: HTML is rendered per-request and embedded in _meta['ui/html']\n * - **static**: Static widget is pre-compiled at startup, client fetches via resources/read\n * - **hybrid**: Shell (React + renderer) cached at startup, component + data in response\n *\n * NOTE: Core Tool UI functionality has moved to @frontmcp/ui/registry for standalone usage.\n * This module re-exports from @frontmcp/ui/registry for backwards compatibility.\n */\n\n// ============================================\n// Core Registry (from @frontmcp/ui/registry)\n// ============================================\nexport {\n  // Registry\n  ToolUIRegistry,\n  // Template rendering\n  renderToolTemplateAsync,\n  renderToolTemplate,\n  hasUIConfig,\n  isReactComponent,\n  containsMdxSyntax,\n  // URI utilities\n  UI_RESOURCE_SCHEME,\n  isUIResourceUri,\n  isStaticWidgetUri,\n  parseWidgetUri,\n  buildStaticWidgetUri,\n  getUIResourceMimeType,\n} from '@frontmcp/ui/registry';\n\nexport type {\n  // Registry types\n  RenderOptions,\n  UIRenderResult,\n  CompileStaticWidgetOptions,\n  HybridComponentPayload,\n  BuildHybridComponentPayloadOptions,\n  // Template types\n  RenderTemplateOptions,\n  // URI types\n  ParsedWidgetUri,\n} from '@frontmcp/ui/registry';\n\n// ============================================\n// Platform Adapters (from @frontmcp/ui/adapters)\n// ============================================\nexport { buildUIMeta } from './platform-adapters';\nexport type { UIMetadata, BuildUIMetaOptions } from './platform-adapters';\n\n// ============================================\n// Template Helpers (from @frontmcp/ui/runtime)\n// ============================================\nexport {\n  escapeHtml,\n  formatDate,\n  formatCurrency,\n  uniqueId,\n  jsonEmbed,\n  createTemplateHelpers,\n  resetIdCounter,\n} from './template-helpers';\n\n// ============================================\n// SDK-Specific (MCP Integration)\n// ============================================\n// UI Resource Handler - SDK-specific functions for MCP resource handling\nexport { handleUIResourceRead, createUIResourceHandler } from './ui-resource.handler';\nexport type { UIResourceHandleResult, UIResourceHandlerOptions, HandleUIResourceOptions } from './ui-resource.handler';\n\n// UI Resource Templates (for capability advertisement)\nexport { StaticWidgetResourceTemplate } from './ui-resource-template';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/tool/ui/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;;AAEH,+CAA+C;AAC/C,iDAAiD;AACjD,+CAA+C;AAC/C,sDAgBmC;AAfjC,WAAW;AACX,0GAAA,cAAc,OAAA;AACd,qBAAqB;AACrB,mHAAA,uBAAuB,OAAA;AACvB,8GAAA,kBAAkB,OAAA;AAClB,uGAAA,WAAW,OAAA;AACX,4GAAA,gBAAgB,OAAA;AAChB,6GAAA,iBAAiB,OAAA;AACjB,gBAAgB;AAChB,8GAAA,kBAAkB,OAAA;AAClB,2GAAA,eAAe,OAAA;AACf,6GAAA,iBAAiB,OAAA;AACjB,0GAAA,cAAc,OAAA;AACd,gHAAA,oBAAoB,OAAA;AACpB,iHAAA,qBAAqB,OAAA;AAgBvB,+CAA+C;AAC/C,iDAAiD;AACjD,+CAA+C;AAC/C,yDAAkD;AAAzC,gHAAA,WAAW,OAAA;AAGpB,+CAA+C;AAC/C,+CAA+C;AAC/C,+CAA+C;AAC/C,uDAQ4B;AAP1B,8GAAA,UAAU,OAAA;AACV,8GAAA,UAAU,OAAA;AACV,kHAAA,cAAc,OAAA;AACd,4GAAA,QAAQ,OAAA;AACR,6GAAA,SAAS,OAAA;AACT,yHAAA,qBAAqB,OAAA;AACrB,kHAAA,cAAc,OAAA;AAGhB,+CAA+C;AAC/C,iCAAiC;AACjC,+CAA+C;AAC/C,yEAAyE;AACzE,6DAAsF;AAA7E,2HAAA,oBAAoB,OAAA;AAAE,8HAAA,uBAAuB,OAAA;AAGtD,uDAAuD;AACvD,+DAAsE;AAA7D,oIAAA,4BAA4B,OAAA","sourcesContent":["/**\n * Tool UI Module\n *\n * Provides UI template rendering and platform-specific metadata generation\n * for MCP tool responses.\n *\n * Three serving modes:\n * - **inline**: HTML is rendered per-request and embedded in _meta['ui/html']\n * - **static**: Static widget is pre-compiled at startup, client fetches via resources/read\n * - **hybrid**: Shell (React + renderer) cached at startup, component + data in response\n *\n * NOTE: Core Tool UI functionality is in @frontmcp/uipack/registry for standalone usage.\n * This module re-exports from @frontmcp/uipack for backwards compatibility.\n */\n\n// ============================================\n// Core Registry (from @frontmcp/uipack/registry)\n// ============================================\nexport {\n  // Registry\n  ToolUIRegistry,\n  // Template rendering\n  renderToolTemplateAsync,\n  renderToolTemplate,\n  hasUIConfig,\n  isReactComponent,\n  containsMdxSyntax,\n  // URI utilities\n  UI_RESOURCE_SCHEME,\n  isUIResourceUri,\n  isStaticWidgetUri,\n  parseWidgetUri,\n  buildStaticWidgetUri,\n  getUIResourceMimeType,\n} from '@frontmcp/uipack/registry';\n\nexport type {\n  // Registry types\n  RenderOptions,\n  UIRenderResult,\n  CompileStaticWidgetOptions,\n  HybridComponentPayload,\n  BuildHybridComponentPayloadOptions,\n  // Template types\n  RenderTemplateOptions,\n  // URI types\n  ParsedWidgetUri,\n} from '@frontmcp/uipack/registry';\n\n// ============================================\n// Platform Adapters (from @frontmcp/ui/adapters)\n// ============================================\nexport { buildUIMeta } from './platform-adapters';\nexport type { UIMetadata, BuildUIMetaOptions } from './platform-adapters';\n\n// ============================================\n// Template Helpers (from @frontmcp/ui/runtime)\n// ============================================\nexport {\n  escapeHtml,\n  formatDate,\n  formatCurrency,\n  uniqueId,\n  jsonEmbed,\n  createTemplateHelpers,\n  resetIdCounter,\n} from './template-helpers';\n\n// ============================================\n// SDK-Specific (MCP Integration)\n// ============================================\n// UI Resource Handler - SDK-specific functions for MCP resource handling\nexport { handleUIResourceRead, createUIResourceHandler } from './ui-resource.handler';\nexport type { UIResourceHandleResult, UIResourceHandlerOptions, HandleUIResourceOptions } from './ui-resource.handler';\n\n// UI Resource Templates (for capability advertisement)\nexport { StaticWidgetResourceTemplate } from './ui-resource-template';\n"]}

package/src/tool/ui/platform-adapters.d.ts

@@ -1,10 +1,10 @@
 /**
  * Platform Adapters
  *
- * Re-exports platform adapter functions from @frontmcp/ui/adapters for SDK consumers.
+ * Re-exports platform adapter functions from @frontmcp/uipack/adapters for SDK consumers.
  * This provides a single source of truth for platform-specific metadata building
  * while maintaining backwards compatibility.
  *
  * @see {@link https://docs.agentfront.dev/docs/servers/tools#tool-ui | Tool UI Documentation}
  */
-export { type AIPlatformType, type UIMetadata, type BuildUIMetaOptions, type BuildToolDiscoveryMetaOptions, buildUIMeta, buildToolDiscoveryMeta, buildOpenAICSP, } from '@frontmcp/ui/adapters';
+export { type AIPlatformType, type UIMetadata, type BuildUIMetaOptions, type BuildToolDiscoveryMetaOptions, buildUIMeta, buildToolDiscoveryMeta, buildOpenAICSP, } from '@frontmcp/uipack/adapters';

package/src/tool/ui/platform-adapters.js

@@ -2,7 +2,7 @@
 /**
  * Platform Adapters
  *
- * Re-exports platform adapter functions from @frontmcp/ui/adapters for SDK consumers.
+ * Re-exports platform adapter functions from @frontmcp/uipack/adapters for SDK consumers.
  * This provides a single source of truth for platform-specific metadata building
  * while maintaining backwards compatibility.
  *
@@ -10,8 +10,8 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildOpenAICSP = exports.buildToolDiscoveryMeta = exports.buildUIMeta = void 0;
-// Re-export platform adapter types and functions from @frontmcp/ui
-var adapters_1 = require("@frontmcp/ui/adapters");
+// Re-export platform adapter types and functions from @frontmcp/uipack
+var adapters_1 = require("@frontmcp/uipack/adapters");
 Object.defineProperty(exports, "buildUIMeta", { enumerable: true, get: function () { return adapters_1.buildUIMeta; } });
 Object.defineProperty(exports, "buildToolDiscoveryMeta", { enumerable: true, get: function () { return adapters_1.buildToolDiscoveryMeta; } });
 Object.defineProperty(exports, "buildOpenAICSP", { enumerable: true, get: function () { return adapters_1.buildOpenAICSP; } });

package/src/tool/ui/platform-adapters.js.map

@@ -1 +1 @@
-{"version":3,"file":"platform-adapters.js","sourceRoot":"","sources":["../../../../src/tool/ui/platform-adapters.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;AAEH,mEAAmE;AACnE,kDAQ+B;AAH7B,uGAAA,WAAW,OAAA;AACX,kHAAA,sBAAsB,OAAA;AACtB,0GAAA,cAAc,OAAA","sourcesContent":["/**\n * Platform Adapters\n *\n * Re-exports platform adapter functions from @frontmcp/ui/adapters for SDK consumers.\n * This provides a single source of truth for platform-specific metadata building\n * while maintaining backwards compatibility.\n *\n * @see {@link https://docs.agentfront.dev/docs/servers/tools#tool-ui | Tool UI Documentation}\n */\n\n// Re-export platform adapter types and functions from @frontmcp/ui\nexport {\n  type AIPlatformType,\n  type UIMetadata,\n  type BuildUIMetaOptions,\n  type BuildToolDiscoveryMetaOptions,\n  buildUIMeta,\n  buildToolDiscoveryMeta,\n  buildOpenAICSP,\n} from '@frontmcp/ui/adapters';\n"]}
+{"version":3,"file":"platform-adapters.js","sourceRoot":"","sources":["../../../../src/tool/ui/platform-adapters.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;AAEH,uEAAuE;AACvE,sDAQmC;AAHjC,uGAAA,WAAW,OAAA;AACX,kHAAA,sBAAsB,OAAA;AACtB,0GAAA,cAAc,OAAA","sourcesContent":["/**\n * Platform Adapters\n *\n * Re-exports platform adapter functions from @frontmcp/uipack/adapters for SDK consumers.\n * This provides a single source of truth for platform-specific metadata building\n * while maintaining backwards compatibility.\n *\n * @see {@link https://docs.agentfront.dev/docs/servers/tools#tool-ui | Tool UI Documentation}\n */\n\n// Re-export platform adapter types and functions from @frontmcp/uipack\nexport {\n  type AIPlatformType,\n  type UIMetadata,\n  type BuildUIMetaOptions,\n  type BuildToolDiscoveryMetaOptions,\n  buildUIMeta,\n  buildToolDiscoveryMeta,\n  buildOpenAICSP,\n} from '@frontmcp/uipack/adapters';\n"]}

package/src/tool/ui/template-helpers.d.ts

@@ -1,17 +1,15 @@
 /**
  * Template Helpers
  *
- * Re-exports template helper utilities from @frontmcp/ui/runtime.
+ * Re-exports template helper utilities from @frontmcp/ui.
  * Also provides individual helper functions for backwards compatibility.
  *
  * @see {@link https://docs.agentfront.dev/docs/servers/tools#tool-ui | Tool UI Documentation}
  */
 import type { TemplateHelpers } from '../../common/metadata/tool-ui.metadata';
-export { createTemplateHelpers } from '@frontmcp/ui/runtime';
-/**
- * Escape HTML special characters to prevent XSS.
- */
-export declare function escapeHtml(str: string): string;
+import { escapeHtml } from '@frontmcp/uipack/utils';
+export { createTemplateHelpers } from '@frontmcp/uipack/runtime';
+export { escapeHtml };
 /**
  * Format a date for display.
  * @param date - Date object or ISO string
@@ -36,7 +34,7 @@ export declare function uniqueId(prefix?: string): string;
 export declare function jsonEmbed(data: unknown): string;
 /**
  * Create a TemplateHelpers object with all helper functions.
- * @deprecated Use createTemplateHelpers from @frontmcp/ui/runtime instead
+ * @deprecated Use createTemplateHelpers from @frontmcp/uipack/runtime instead
  */
 export declare function createTemplateHelpersLocal(): TemplateHelpers;
 /**

package/src/tool/ui/template-helpers.js

@@ -2,43 +2,26 @@
 /**
  * Template Helpers
  *
- * Re-exports template helper utilities from @frontmcp/ui/runtime.
+ * Re-exports template helper utilities from @frontmcp/ui.
  * Also provides individual helper functions for backwards compatibility.
  *
  * @see {@link https://docs.agentfront.dev/docs/servers/tools#tool-ui | Tool UI Documentation}
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createTemplateHelpers = void 0;
-exports.escapeHtml = escapeHtml;
+exports.escapeHtml = exports.createTemplateHelpers = void 0;
 exports.formatDate = formatDate;
 exports.formatCurrency = formatCurrency;
 exports.uniqueId = uniqueId;
 exports.jsonEmbed = jsonEmbed;
 exports.createTemplateHelpersLocal = createTemplateHelpersLocal;
 exports.resetIdCounter = resetIdCounter;
-// Re-export createTemplateHelpers from @frontmcp/ui
-var runtime_1 = require("@frontmcp/ui/runtime");
+// Import escapeHtml from @frontmcp/uipack/utils - single source of truth (no React needed)
+const utils_1 = require("@frontmcp/uipack/utils");
+Object.defineProperty(exports, "escapeHtml", { enumerable: true, get: function () { return utils_1.escapeHtml; } });
+// Re-export createTemplateHelpers from @frontmcp/uipack (no React needed)
+var runtime_1 = require("@frontmcp/uipack/runtime");
 Object.defineProperty(exports, "createTemplateHelpers", { enumerable: true, get: function () { return runtime_1.createTemplateHelpers; } });
-// ============================================
-// Individual Helper Functions (Backwards Compatibility)
-// ============================================
-// These are exported individually for SDK consumers who import them directly.
-// For new code, prefer using createTemplateHelpers() instead.
 let idCounter = 0;
-/**
- * Escape HTML special characters to prevent XSS.
- */
-function escapeHtml(str) {
-    if (typeof str !== 'string') {
-        return String(str ?? '');
-    }
-    return str
-        .replace(/&/g, '&')
-        .replace(/</g, '&lt;')
-        .replace(/>/g, '&gt;')
-        .replace(/"/g, '&quot;')
-        .replace(/'/g, '&#039;');
-}
 /**
  * Format a date for display.
  * @param date - Date object or ISO string
@@ -91,11 +74,11 @@ function jsonEmbed(data) {
 }
 /**
  * Create a TemplateHelpers object with all helper functions.
- * @deprecated Use createTemplateHelpers from @frontmcp/ui/runtime instead
+ * @deprecated Use createTemplateHelpers from @frontmcp/uipack/runtime instead
  */
 function createTemplateHelpersLocal() {
     return {
-        escapeHtml,
+        escapeHtml: utils_1.escapeHtml,
         formatDate,
         formatCurrency,
         uniqueId,

package/src/tool/ui/template-helpers.js.map

@@ -1 +1 @@
-{"version":3,"file":"template-helpers.js","sourceRoot":"","sources":["../../../../src/tool/ui/template-helpers.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAkBH,gCAUC;AAOD,gCAgBC;AAOD,wCAKC;AAMD,4BAEC;AAMD,8BAMC;AAMD,gEAQC;AAMD,wCAEC;AArGD,oDAAoD;AACpD,gDAA6D;AAApD,gHAAA,qBAAqB,OAAA;AAE9B,+CAA+C;AAC/C,wDAAwD;AACxD,+CAA+C;AAC/C,8EAA8E;AAC9E,8DAA8D;AAE9D,IAAI,SAAS,GAAG,CAAC,CAAC;AAElB;;GAEG;AACH,SAAgB,UAAU,CAAC,GAAW;IACpC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,GAAG;SACP,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,SAAgB,UAAU,CAAC,IAAmB,EAAE,MAAe;IAC7D,MAAM,CAAC,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3D,IAAI,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QACvB,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IAED,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,KAAK;YACR,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;QACzB,KAAK,MAAM;YACT,OAAO,CAAC,CAAC,kBAAkB,EAAE,CAAC;QAChC,KAAK,UAAU;YACb,OAAO,CAAC,CAAC,cAAc,EAAE,CAAC;QAC5B;YACE,OAAO,CAAC,CAAC,kBAAkB,EAAE,CAAC;IAClC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAgB,cAAc,CAAC,MAAc,EAAE,QAAQ,GAAG,KAAK;IAC7D,OAAO,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE;QACpC,KAAK,EAAE,UAAU;QACjB,QAAQ;KACT,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,SAAgB,QAAQ,CAAC,MAAM,GAAG,KAAK;IACrC,OAAO,GAAG,MAAM,IAAI,EAAE,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED;;;GAGG;AACH,SAAgB,SAAS,CAAC,IAAa;IACrC,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SACxB,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;SACxB,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;SACxB,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;SACxB,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,SAAgB,0BAA0B;IACxC,OAAO;QACL,UAAU;QACV,UAAU;QACV,cAAc;QACd,QAAQ;QACR,SAAS;KACV,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAgB,cAAc;IAC5B,SAAS,GAAG,CAAC,CAAC;AAChB,CAAC","sourcesContent":["/**\n * Template Helpers\n *\n * Re-exports template helper utilities from @frontmcp/ui/runtime.\n * Also provides individual helper functions for backwards compatibility.\n *\n * @see {@link https://docs.agentfront.dev/docs/servers/tools#tool-ui | Tool UI Documentation}\n */\n\nimport type { TemplateHelpers } from '../../common/metadata/tool-ui.metadata';\n\n// Re-export createTemplateHelpers from @frontmcp/ui\nexport { createTemplateHelpers } from '@frontmcp/ui/runtime';\n\n// ============================================\n// Individual Helper Functions (Backwards Compatibility)\n// ============================================\n// These are exported individually for SDK consumers who import them directly.\n// For new code, prefer using createTemplateHelpers() instead.\n\nlet idCounter = 0;\n\n/**\n * Escape HTML special characters to prevent XSS.\n */\nexport function escapeHtml(str: string): string {\n  if (typeof str !== 'string') {\n    return String(str ?? '');\n  }\n  return str\n    .replace(/&/g, '&amp;')\n    .replace(/</g, '&lt;')\n    .replace(/>/g, '&gt;')\n    .replace(/\"/g, '&quot;')\n    .replace(/'/g, '&#039;');\n}\n\n/**\n * Format a date for display.\n * @param date - Date object or ISO string\n * @param format - Optional format: 'iso', 'time', 'datetime', or default (localized date)\n */\nexport function formatDate(date: Date | string, format?: string): string {\n  const d = typeof date === 'string' ? new Date(date) : date;\n  if (isNaN(d.getTime())) {\n    return String(date);\n  }\n\n  switch (format) {\n    case 'iso':\n      return d.toISOString();\n    case 'time':\n      return d.toLocaleTimeString();\n    case 'datetime':\n      return d.toLocaleString();\n    default:\n      return d.toLocaleDateString();\n  }\n}\n\n/**\n * Format a number as currency.\n * @param amount - The numeric amount\n * @param currency - ISO 4217 currency code (default: 'USD')\n */\nexport function formatCurrency(amount: number, currency = 'USD'): string {\n  return new Intl.NumberFormat('en-US', {\n    style: 'currency',\n    currency,\n  }).format(amount);\n}\n\n/**\n * Generate a unique ID for DOM elements.\n * @param prefix - Optional prefix for the ID\n */\nexport function uniqueId(prefix = 'mcp'): string {\n  return `${prefix}-${++idCounter}-${Date.now().toString(36)}`;\n}\n\n/**\n * Safely embed JSON data in HTML.\n * Escapes characters that could break out of script tags or HTML.\n */\nexport function jsonEmbed(data: unknown): string {\n  return JSON.stringify(data)\n    .replace(/</g, '\\\\u003c')\n    .replace(/>/g, '\\\\u003e')\n    .replace(/&/g, '\\\\u0026')\n    .replace(/'/g, '\\\\u0027');\n}\n\n/**\n * Create a TemplateHelpers object with all helper functions.\n * @deprecated Use createTemplateHelpers from @frontmcp/ui/runtime instead\n */\nexport function createTemplateHelpersLocal(): TemplateHelpers {\n  return {\n    escapeHtml,\n    formatDate,\n    formatCurrency,\n    uniqueId,\n    jsonEmbed,\n  };\n}\n\n/**\n * Reset the ID counter (useful for testing).\n * @internal\n */\nexport function resetIdCounter(): void {\n  idCounter = 0;\n}\n"]}
+{"version":3,"file":"template-helpers.js","sourceRoot":"","sources":["../../../../src/tool/ui/template-helpers.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAyBH,gCAgBC;AAOD,wCAKC;AAMD,4BAEC;AAMD,8BAMC;AAMD,gEAQC;AAMD,wCAEC;AA5FD,2FAA2F;AAC3F,kDAAoD;AAY3C,2FAZA,kBAAU,OAYA;AAVnB,0EAA0E;AAC1E,oDAAiE;AAAxD,gHAAA,qBAAqB,OAAA;AAW9B,IAAI,SAAS,GAAG,CAAC,CAAC;AAElB;;;;GAIG;AACH,SAAgB,UAAU,CAAC,IAAmB,EAAE,MAAe;IAC7D,MAAM,CAAC,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3D,IAAI,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QACvB,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IAED,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,KAAK;YACR,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;QACzB,KAAK,MAAM;YACT,OAAO,CAAC,CAAC,kBAAkB,EAAE,CAAC;QAChC,KAAK,UAAU;YACb,OAAO,CAAC,CAAC,cAAc,EAAE,CAAC;QAC5B;YACE,OAAO,CAAC,CAAC,kBAAkB,EAAE,CAAC;IAClC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAgB,cAAc,CAAC,MAAc,EAAE,QAAQ,GAAG,KAAK;IAC7D,OAAO,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE;QACpC,KAAK,EAAE,UAAU;QACjB,QAAQ;KACT,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,SAAgB,QAAQ,CAAC,MAAM,GAAG,KAAK;IACrC,OAAO,GAAG,MAAM,IAAI,EAAE,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED;;;GAGG;AACH,SAAgB,SAAS,CAAC,IAAa;IACrC,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SACxB,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;SACxB,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;SACxB,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;SACxB,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,SAAgB,0BAA0B;IACxC,OAAO;QACL,UAAU,EAAV,kBAAU;QACV,UAAU;QACV,cAAc;QACd,QAAQ;QACR,SAAS;KACV,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAgB,cAAc;IAC5B,SAAS,GAAG,CAAC,CAAC;AAChB,CAAC","sourcesContent":["/**\n * Template Helpers\n *\n * Re-exports template helper utilities from @frontmcp/ui.\n * Also provides individual helper functions for backwards compatibility.\n *\n * @see {@link https://docs.agentfront.dev/docs/servers/tools#tool-ui | Tool UI Documentation}\n */\n\nimport type { TemplateHelpers } from '../../common/metadata/tool-ui.metadata';\n// Import escapeHtml from @frontmcp/uipack/utils - single source of truth (no React needed)\nimport { escapeHtml } from '@frontmcp/uipack/utils';\n\n// Re-export createTemplateHelpers from @frontmcp/uipack (no React needed)\nexport { createTemplateHelpers } from '@frontmcp/uipack/runtime';\n\n// ============================================\n// Individual Helper Functions (Backwards Compatibility)\n// ============================================\n// These are exported individually for SDK consumers who import them directly.\n// For new code, prefer using createTemplateHelpers() instead.\n\n// Re-export escapeHtml for backwards compatibility\nexport { escapeHtml };\n\nlet idCounter = 0;\n\n/**\n * Format a date for display.\n * @param date - Date object or ISO string\n * @param format - Optional format: 'iso', 'time', 'datetime', or default (localized date)\n */\nexport function formatDate(date: Date | string, format?: string): string {\n  const d = typeof date === 'string' ? new Date(date) : date;\n  if (isNaN(d.getTime())) {\n    return String(date);\n  }\n\n  switch (format) {\n    case 'iso':\n      return d.toISOString();\n    case 'time':\n      return d.toLocaleTimeString();\n    case 'datetime':\n      return d.toLocaleString();\n    default:\n      return d.toLocaleDateString();\n  }\n}\n\n/**\n * Format a number as currency.\n * @param amount - The numeric amount\n * @param currency - ISO 4217 currency code (default: 'USD')\n */\nexport function formatCurrency(amount: number, currency = 'USD'): string {\n  return new Intl.NumberFormat('en-US', {\n    style: 'currency',\n    currency,\n  }).format(amount);\n}\n\n/**\n * Generate a unique ID for DOM elements.\n * @param prefix - Optional prefix for the ID\n */\nexport function uniqueId(prefix = 'mcp'): string {\n  return `${prefix}-${++idCounter}-${Date.now().toString(36)}`;\n}\n\n/**\n * Safely embed JSON data in HTML.\n * Escapes characters that could break out of script tags or HTML.\n */\nexport function jsonEmbed(data: unknown): string {\n  return JSON.stringify(data)\n    .replace(/</g, '\\\\u003c')\n    .replace(/>/g, '\\\\u003e')\n    .replace(/&/g, '\\\\u0026')\n    .replace(/'/g, '\\\\u0027');\n}\n\n/**\n * Create a TemplateHelpers object with all helper functions.\n * @deprecated Use createTemplateHelpers from @frontmcp/uipack/runtime instead\n */\nexport function createTemplateHelpersLocal(): TemplateHelpers {\n  return {\n    escapeHtml,\n    formatDate,\n    formatCurrency,\n    uniqueId,\n    jsonEmbed,\n  };\n}\n\n/**\n * Reset the ID counter (useful for testing).\n * @internal\n */\nexport function resetIdCounter(): void {\n  idCounter = 0;\n}\n"]}

package/src/tool/ui/ui-resource.handler.d.ts

@@ -24,7 +24,7 @@
  */
 import type { ReadResourceResult } from '@modelcontextprotocol/sdk/types.js';
 import type { AIPlatformType } from '../../notification/notification.service';
-import { type ToolUIRegistry } from '@frontmcp/ui/registry';
+import { type ToolUIRegistry } from '@frontmcp/uipack/registry';
 /**
  * Result of handling a UI resource request
  */

package/src/tool/ui/ui-resource.handler.js

@@ -26,16 +26,16 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.handleUIResourceRead = handleUIResourceRead;
 exports.createUIResourceHandler = createUIResourceHandler;
-const ui_1 = require("@frontmcp/ui");
-const registry_1 = require("@frontmcp/ui/registry");
+const base_template_1 = require("@frontmcp/uipack/base-template");
+const registry_1 = require("@frontmcp/uipack/registry");
 /**
  * Generate a placeholder widget HTML that reads from window.openai.toolOutput.
  *
- * Delegates to @frontmcp/ui's createDefaultBaseTemplate which provides:
+ * Delegates to @frontmcp/uipack's createDefaultBaseTemplate which provides:
  * - Tailwind CSS with @theme configuration
  * - Platform polyfills (callTool, detectMcpSession, getToolOutput)
  * - Polling for toolOutput injection
- * - Default JSON renderer (data-type-specific renderers are in @frontmcp/ui)
+ * - Default JSON renderer (data-type-specific renderers are in @frontmcp/uipack)
  *
  * This is returned when the static widget URI is fetched before the tool is called.
  * OpenAI caches this HTML, so it must be dynamic (read toolOutput at runtime).
@@ -44,7 +44,7 @@ const registry_1 = require("@frontmcp/ui/registry");
  * @returns HTML string with a dynamic widget that renders toolOutput
  */
 function generatePlaceholderWidget(toolName) {
-    return (0, ui_1.createDefaultBaseTemplate)({ toolName });
+    return (0, base_template_1.createDefaultBaseTemplate)({ toolName });
 }
 /**
  * Handle a UI resource read request

package/src/tool/ui/ui-resource.handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"ui-resource.handler.js","sourceRoot":"","sources":["../../../../src/tool/ui/ui-resource.handler.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;;AAkEH,oDAgEC;AAkBD,0DAYC;AA5JD,qCAAyD;AACzD,oDAQ+B;AA0B/B;;;;;;;;;;;;;;GAcG;AACH,SAAS,yBAAyB,CAAC,QAAgB;IACjD,OAAO,IAAA,8BAAyB,EAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,oBAAoB,CAClC,GAAW,EACX,QAAwB,EACxB,YAA6B;IAE7B,qCAAqC;IACrC,IAAI,CAAC,IAAA,0BAAe,EAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,yCAAyC;IACzC,MAAM,QAAQ,GAAG,IAAA,gCAAqB,EAAC,YAAY,CAAC,CAAC;IAErD,sDAAsD;IACtD,2CAA2C;IAC3C,MAAM,YAAY,GAAG,IAAA,yBAAc,EAAC,GAAG,CAAC,CAAC;IACzC,IAAI,YAAY,EAAE,CAAC;QACjB,qEAAqE;QACrE,qFAAqF;QACrF,MAAM,YAAY,GAAG,QAAQ,CAAC,eAAe,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QACrE,IAAI,YAAY,EAAE,CAAC;YACjB,qEAAqE;YACrE,qEAAqE;YACrE,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE;oBACN,QAAQ,EAAE;wBACR;4BACE,GAAG;4BACH,QAAQ;4BACR,IAAI,EAAE,YAAY;yBACnB;qBACF;iBACF;aACF,CAAC;QACJ,CAAC;QAED,sEAAsE;QACtE,uEAAuE;QACvE,oCAAoC;QACpC,EAAE;QACF,uEAAuE;QACvE,kEAAkE;QAClE,MAAM,IAAI,GAAG,yBAAyB,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAE9D,OAAO;YACL,OAAO,EAAE,IAAI;YACb,MAAM,EAAE;gBACN,QAAQ,EAAE;oBACR;wBACE,GAAG;wBACH,QAAQ;wBACR,IAAI,EAAE,IAAI;qBACX;iBACF;aACF;SACF,CAAC;IACJ,CAAC;IAED,iCAAiC;IACjC,OAAO;QACL,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,mCAAmC,GAAG,yCAAyC;KACvF,CAAC;AACJ,CAAC;AAYD;;;;;GAKG;AACH,SAAgB,uBAAuB,CAAC,OAAiC;IACvE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAEtC,OAAO,SAAS,gBAAgB,CAAC,GAAW;QAC1C,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAEnD,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,IAAI,OAAO,EAAE,CAAC;YAC9C,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC7B,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC","sourcesContent":["/**\n * UI Resource Handler\n *\n * Handles resources/read requests for ui:// URIs, serving widget HTML\n * from the ToolUIRegistry.\n *\n * Supported URI format:\n * - ui://widget/{toolName}.html - Static widget HTML (pre-compiled at startup)\n *\n * The static widget is registered at server startup for tools with\n * `servingMode: 'static'`. The widget HTML includes the FrontMCP Bridge\n * which reads tool output from the platform context at runtime.\n *\n * @example\n * ```typescript\n * // Client requests widget HTML (OpenAI discovery)\n * const result = await client.readResource({\n *   uri: 'ui://widget/get_weather.html'\n * });\n *\n * // Returns pre-compiled widget with FrontMCP Bridge\n * // Widget reads tool output from window.openai.toolOutput at runtime\n * ```\n */\n\nimport type { ReadResourceResult } from '@modelcontextprotocol/sdk/types.js';\nimport type { AIPlatformType } from '../../notification/notification.service';\nimport { createDefaultBaseTemplate } from '@frontmcp/ui';\nimport {\n  type ToolUIRegistry,\n  UI_RESOURCE_SCHEME,\n  isUIResourceUri,\n  isStaticWidgetUri,\n  parseWidgetUri,\n  getUIResourceMimeType,\n  type ParsedWidgetUri,\n} from '@frontmcp/ui/registry';\n\n/**\n * Result of handling a UI resource request\n */\nexport interface UIResourceHandleResult {\n  /** Whether the URI was handled */\n  handled: boolean;\n  /** The resource result if handled successfully */\n  result?: ReadResourceResult;\n  /** Error message if handling failed */\n  error?: string;\n}\n\n/**\n * Options for handling a UI resource read request\n */\nexport interface HandleUIResourceOptions {\n  /** The UI resource URI */\n  uri: string;\n  /** The ToolUIRegistry containing cached HTML */\n  registry: ToolUIRegistry;\n  /** Platform type of the connected client */\n  platformType?: AIPlatformType;\n}\n\n/**\n * Generate a placeholder widget HTML that reads from window.openai.toolOutput.\n *\n * Delegates to @frontmcp/ui's createDefaultBaseTemplate which provides:\n * - Tailwind CSS with @theme configuration\n * - Platform polyfills (callTool, detectMcpSession, getToolOutput)\n * - Polling for toolOutput injection\n * - Default JSON renderer (data-type-specific renderers are in @frontmcp/ui)\n *\n * This is returned when the static widget URI is fetched before the tool is called.\n * OpenAI caches this HTML, so it must be dynamic (read toolOutput at runtime).\n *\n * @param toolName - The name of the tool\n * @returns HTML string with a dynamic widget that renders toolOutput\n */\nfunction generatePlaceholderWidget(toolName: string): string {\n  return createDefaultBaseTemplate({ toolName });\n}\n\n/**\n * Handle a UI resource read request\n *\n * @param uri - The UI resource URI\n * @param registry - The ToolUIRegistry containing cached HTML\n * @param platformType - Optional platform type for dynamic MIME type selection\n * @returns Handle result with content or error\n */\nexport function handleUIResourceRead(\n  uri: string,\n  registry: ToolUIRegistry,\n  platformType?: AIPlatformType,\n): UIResourceHandleResult {\n  // Check if this is a UI resource URI\n  if (!isUIResourceUri(uri)) {\n    return { handled: false };\n  }\n\n  // Get the platform-appropriate MIME type\n  const mimeType = getUIResourceMimeType(platformType);\n\n  // Try static widget URI (ui://widget/{toolName}.html)\n  // This is used by OpenAI at discovery time\n  const widgetParsed = parseWidgetUri(uri);\n  if (widgetParsed) {\n    // Check for pre-compiled static widget from the developer's template\n    // Static widgets are compiled at server startup for tools with servingMode: 'static'\n    const cachedWidget = registry.getStaticWidget(widgetParsed.toolName);\n    if (cachedWidget) {\n      // Return the developer's actual template (SSR'd React/MDX component)\n      // This template includes the FrontMCP Bridge for runtime data access\n      return {\n        handled: true,\n        result: {\n          contents: [\n            {\n              uri,\n              mimeType,\n              text: cachedWidget,\n            },\n          ],\n        },\n      };\n    }\n\n    // Fallback to dynamic placeholder widget if no pre-compiled template.\n    // This is returned when the tool doesn't have a UI template configured\n    // or uses a different serving mode.\n    //\n    // OpenAI caches widget HTML from outputTemplate URI, so we must return\n    // a template that reads from window.openai.toolOutput at runtime.\n    const html = generatePlaceholderWidget(widgetParsed.toolName);\n\n    return {\n      handled: true,\n      result: {\n        contents: [\n          {\n            uri,\n            mimeType,\n            text: html,\n          },\n        ],\n      },\n    };\n  }\n\n  // Unknown UI resource URI format\n  return {\n    handled: true,\n    error: `Invalid UI resource URI format: ${uri}. Expected: ui://widget/{toolName}.html`,\n  };\n}\n\n/**\n * Options for creating a UI resource handler\n */\nexport interface UIResourceHandlerOptions {\n  /** ToolUIRegistry instance */\n  registry: ToolUIRegistry;\n  /** Optional custom error handler */\n  onError?: (error: string, uri: string) => void;\n}\n\n/**\n * Create a UI resource handler function\n *\n * @param options - Handler options\n * @returns Handler function that can be used in the read-resource flow\n */\nexport function createUIResourceHandler(options: UIResourceHandlerOptions) {\n  const { registry, onError } = options;\n\n  return function handleUIResource(uri: string): UIResourceHandleResult {\n    const result = handleUIResourceRead(uri, registry);\n\n    if (result.handled && result.error && onError) {\n      onError(result.error, uri);\n    }\n\n    return result;\n  };\n}\n"]}
+{"version":3,"file":"ui-resource.handler.js","sourceRoot":"","sources":["../../../../src/tool/ui/ui-resource.handler.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;;AAkEH,oDAgEC;AAkBD,0DAYC;AA5JD,kEAA2E;AAC3E,wDAQmC;AA0BnC;;;;;;;;;;;;;;GAcG;AACH,SAAS,yBAAyB,CAAC,QAAgB;IACjD,OAAO,IAAA,yCAAyB,EAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,oBAAoB,CAClC,GAAW,EACX,QAAwB,EACxB,YAA6B;IAE7B,qCAAqC;IACrC,IAAI,CAAC,IAAA,0BAAe,EAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,yCAAyC;IACzC,MAAM,QAAQ,GAAG,IAAA,gCAAqB,EAAC,YAAY,CAAC,CAAC;IAErD,sDAAsD;IACtD,2CAA2C;IAC3C,MAAM,YAAY,GAAG,IAAA,yBAAc,EAAC,GAAG,CAAC,CAAC;IACzC,IAAI,YAAY,EAAE,CAAC;QACjB,qEAAqE;QACrE,qFAAqF;QACrF,MAAM,YAAY,GAAG,QAAQ,CAAC,eAAe,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QACrE,IAAI,YAAY,EAAE,CAAC;YACjB,qEAAqE;YACrE,qEAAqE;YACrE,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE;oBACN,QAAQ,EAAE;wBACR;4BACE,GAAG;4BACH,QAAQ;4BACR,IAAI,EAAE,YAAY;yBACnB;qBACF;iBACF;aACF,CAAC;QACJ,CAAC;QAED,sEAAsE;QACtE,uEAAuE;QACvE,oCAAoC;QACpC,EAAE;QACF,uEAAuE;QACvE,kEAAkE;QAClE,MAAM,IAAI,GAAG,yBAAyB,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAE9D,OAAO;YACL,OAAO,EAAE,IAAI;YACb,MAAM,EAAE;gBACN,QAAQ,EAAE;oBACR;wBACE,GAAG;wBACH,QAAQ;wBACR,IAAI,EAAE,IAAI;qBACX;iBACF;aACF;SACF,CAAC;IACJ,CAAC;IAED,iCAAiC;IACjC,OAAO;QACL,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,mCAAmC,GAAG,yCAAyC;KACvF,CAAC;AACJ,CAAC;AAYD;;;;;GAKG;AACH,SAAgB,uBAAuB,CAAC,OAAiC;IACvE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAEtC,OAAO,SAAS,gBAAgB,CAAC,GAAW;QAC1C,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAEnD,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,IAAI,OAAO,EAAE,CAAC;YAC9C,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC7B,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC","sourcesContent":["/**\n * UI Resource Handler\n *\n * Handles resources/read requests for ui:// URIs, serving widget HTML\n * from the ToolUIRegistry.\n *\n * Supported URI format:\n * - ui://widget/{toolName}.html - Static widget HTML (pre-compiled at startup)\n *\n * The static widget is registered at server startup for tools with\n * `servingMode: 'static'`. The widget HTML includes the FrontMCP Bridge\n * which reads tool output from the platform context at runtime.\n *\n * @example\n * ```typescript\n * // Client requests widget HTML (OpenAI discovery)\n * const result = await client.readResource({\n *   uri: 'ui://widget/get_weather.html'\n * });\n *\n * // Returns pre-compiled widget with FrontMCP Bridge\n * // Widget reads tool output from window.openai.toolOutput at runtime\n * ```\n */\n\nimport type { ReadResourceResult } from '@modelcontextprotocol/sdk/types.js';\nimport type { AIPlatformType } from '../../notification/notification.service';\nimport { createDefaultBaseTemplate } from '@frontmcp/uipack/base-template';\nimport {\n  type ToolUIRegistry,\n  UI_RESOURCE_SCHEME,\n  isUIResourceUri,\n  isStaticWidgetUri,\n  parseWidgetUri,\n  getUIResourceMimeType,\n  type ParsedWidgetUri,\n} from '@frontmcp/uipack/registry';\n\n/**\n * Result of handling a UI resource request\n */\nexport interface UIResourceHandleResult {\n  /** Whether the URI was handled */\n  handled: boolean;\n  /** The resource result if handled successfully */\n  result?: ReadResourceResult;\n  /** Error message if handling failed */\n  error?: string;\n}\n\n/**\n * Options for handling a UI resource read request\n */\nexport interface HandleUIResourceOptions {\n  /** The UI resource URI */\n  uri: string;\n  /** The ToolUIRegistry containing cached HTML */\n  registry: ToolUIRegistry;\n  /** Platform type of the connected client */\n  platformType?: AIPlatformType;\n}\n\n/**\n * Generate a placeholder widget HTML that reads from window.openai.toolOutput.\n *\n * Delegates to @frontmcp/uipack's createDefaultBaseTemplate which provides:\n * - Tailwind CSS with @theme configuration\n * - Platform polyfills (callTool, detectMcpSession, getToolOutput)\n * - Polling for toolOutput injection\n * - Default JSON renderer (data-type-specific renderers are in @frontmcp/uipack)\n *\n * This is returned when the static widget URI is fetched before the tool is called.\n * OpenAI caches this HTML, so it must be dynamic (read toolOutput at runtime).\n *\n * @param toolName - The name of the tool\n * @returns HTML string with a dynamic widget that renders toolOutput\n */\nfunction generatePlaceholderWidget(toolName: string): string {\n  return createDefaultBaseTemplate({ toolName });\n}\n\n/**\n * Handle a UI resource read request\n *\n * @param uri - The UI resource URI\n * @param registry - The ToolUIRegistry containing cached HTML\n * @param platformType - Optional platform type for dynamic MIME type selection\n * @returns Handle result with content or error\n */\nexport function handleUIResourceRead(\n  uri: string,\n  registry: ToolUIRegistry,\n  platformType?: AIPlatformType,\n): UIResourceHandleResult {\n  // Check if this is a UI resource URI\n  if (!isUIResourceUri(uri)) {\n    return { handled: false };\n  }\n\n  // Get the platform-appropriate MIME type\n  const mimeType = getUIResourceMimeType(platformType);\n\n  // Try static widget URI (ui://widget/{toolName}.html)\n  // This is used by OpenAI at discovery time\n  const widgetParsed = parseWidgetUri(uri);\n  if (widgetParsed) {\n    // Check for pre-compiled static widget from the developer's template\n    // Static widgets are compiled at server startup for tools with servingMode: 'static'\n    const cachedWidget = registry.getStaticWidget(widgetParsed.toolName);\n    if (cachedWidget) {\n      // Return the developer's actual template (SSR'd React/MDX component)\n      // This template includes the FrontMCP Bridge for runtime data access\n      return {\n        handled: true,\n        result: {\n          contents: [\n            {\n              uri,\n              mimeType,\n              text: cachedWidget,\n            },\n          ],\n        },\n      };\n    }\n\n    // Fallback to dynamic placeholder widget if no pre-compiled template.\n    // This is returned when the tool doesn't have a UI template configured\n    // or uses a different serving mode.\n    //\n    // OpenAI caches widget HTML from outputTemplate URI, so we must return\n    // a template that reads from window.openai.toolOutput at runtime.\n    const html = generatePlaceholderWidget(widgetParsed.toolName);\n\n    return {\n      handled: true,\n      result: {\n        contents: [\n          {\n            uri,\n            mimeType,\n            text: html,\n          },\n        ],\n      },\n    };\n  }\n\n  // Unknown UI resource URI format\n  return {\n    handled: true,\n    error: `Invalid UI resource URI format: ${uri}. Expected: ui://widget/{toolName}.html`,\n  };\n}\n\n/**\n * Options for creating a UI resource handler\n */\nexport interface UIResourceHandlerOptions {\n  /** ToolUIRegistry instance */\n  registry: ToolUIRegistry;\n  /** Optional custom error handler */\n  onError?: (error: string, uri: string) => void;\n}\n\n/**\n * Create a UI resource handler function\n *\n * @param options - Handler options\n * @returns Handler function that can be used in the read-resource flow\n */\nexport function createUIResourceHandler(options: UIResourceHandlerOptions) {\n  const { registry, onError } = options;\n\n  return function handleUIResource(uri: string): UIResourceHandleResult {\n    const result = handleUIResourceRead(uri, registry);\n\n    if (result.handled && result.error && onError) {\n      onError(result.error, uri);\n    }\n\n    return result;\n  };\n}\n"]}

package/src/transport/adapters/transport.streamable-http.adapter.js

@@ -55,6 +55,7 @@ class TransportStreamableHttpAdapter extends transport_local_adapter_1.LocalTran
             }
             return originalWrite.call(this, chunk, encodingOrCb, cb);
         };
+        // eslint-disable-next-line @typescript-eslint/no-this-alias
         const adapter = this;
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
         res.end = function (chunk, encodingOrCb, cb) {

package/src/transport/adapters/transport.streamable-http.adapter.js.map

@@ -1 +1 @@
-{"version":3,"file":"transport.streamable-http.adapter.js","sourceRoot":"","sources":["../../../../src/transport/adapters/transport.streamable-http.adapter.ts"],"names":[],"mappings":";;;AAAA,0FAAmG;AAGnG,uEAAkE;AAGlE,+BAAsC;AACtC,wDAAgD;AAGhD;;;;;GAKG;AACI,MAAM,yBAAyB,GAAG,CACvC,aAA4B,EAC5B,SAAiB,EACW,EAAE;IAC9B,OAAO,aAAa,KAAK,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;AAC1E,CAAC,CAAC;AALW,QAAA,yBAAyB,6BAKpC;AAEF,MAAa,8BAA+B,SAAQ,+CAAoD;IAC7F,eAAe,CAAC,SAAiB,EAAE,QAAwB;QAClE,MAAM,kBAAkB,GAAG,IAAA,iCAAyB,EAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAE/E,OAAO,IAAI,iDAA6B,CAAC;YACvC,kBAAkB;YAClB,eAAe,EAAE,GAAG,EAAE;gBACpB,kBAAkB;YACpB,CAAC;YACD,oBAAoB,EAAE,CAAC,SAAS,EAAE,EAAE;gBAClC,IAAI,SAAS,EAAE,CAAC;oBACd,OAAO,CAAC,GAAG,CAAC,wBAAwB,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;gBAChE,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;gBAC/C,CAAC;YACH,CAAC;YACD,wFAAwF;YACxF,kFAAkF;YAClF,4DAA4D;YAC5D,UAAU,EAAE,SAAS;SACtB,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,GAA+B,EAAE,GAAmB;QAC7D,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAE/B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6CAA6C,EAAE;YAC9D,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YAC1C,UAAU,EAAG,GAAG,CAAC,IAA4B,EAAE,MAAM;SACtD,CAAC,CAAC;QAEH,0DAA0D;QAC1D,MAAM,aAAa,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAqB,CAAC;QAC9D,MAAM,WAAW,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAmB,CAAC;QACxD,IAAI,YAAY,GAAG,EAAE,CAAC;QAEtB,8DAA8D;QAC9D,GAAG,CAAC,KAAK,GAAG,UAAgC,KAAU,EAAE,YAAkB,EAAE,EAAQ;YAClF,IAAI,KAAK,EAAE,CAAC;gBACV,YAAY,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAChH,CAAC;YACD,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;QAC3D,CAAqB,CAAC;QAEtB,MAAM,OAAO,GAAG,IAAI,CAAC;QACrB,8DAA8D;QAC9D,GAAG,CAAC,GAAG,GAAG,UAAgC,KAAW,EAAE,YAAkB,EAAE,EAAQ;YACjF,IAAI,KAAK,EAAE,CAAC;gBACV,YAAY,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAChH,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,6CAA6C,EAAE;gBACjE,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,OAAO,EAAE,GAAG,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE;gBACjC,WAAW,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC;aACzC,CAAC,CAAC;YACH,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;QACzD,CAAmB,CAAC;QAEpB,OAAO,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,GAA+B,EAAE,GAAmB;QACtE,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC/B,EAAE;QACF,qEAAqE;QACrE,kCAAkC;QAClC,uFAAuF;QACvF,sBAAsB;QACtB,IAAI;QAEJ,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAChD,CAAC;aAAM,CAAC;YACN,IAAI,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnC,OAAO;YACT,CAAC;YACD,OAAO,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,gBAA2B,EAC3B,OAAe,EACf,eAAkB;QAElB,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CACvB,IAAA,4BAAU,EAAC,IAAI,CAAC,YAAY,EAAE,oBAAoB,EAAE;YAClD,OAAO;YACP,eAAe,EAAE,IAAA,iBAAY,EAAC,eAAsB,CAAC;SACtD,CAAC,EACF,EAAE,gBAAgB,EAAE,CACrB,CAAC;QAEF,OAAO,IAAI,OAAO,CAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3D,IAAI,CAAC,aAAa,GAAG;gBACnB,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE;oBAClB,OAAO,CAAC,MAA8B,CAAC,CAAC;oBACxC,IAAI,CAAC,aAAa,GAAG,SAAS,CAAC;gBACjC,CAAC;gBACD,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE;oBACd,MAAM,CAAC,GAAG,CAAC,CAAC;oBACZ,IAAI,CAAC,aAAa,GAAG,SAAS,CAAC;gBACjC,CAAC;aACF,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AA3GD,wEA2GC","sourcesContent":["import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';\nimport { TransportType, TypedElicitResult } from '../transport.types';\nimport { AuthenticatedServerRequest } from '../../server/server.types';\nimport { LocalTransportAdapter } from './transport.local.adapter';\nimport { RequestId } from '@modelcontextprotocol/sdk/types.js';\nimport { ZodType } from 'zod';\nimport { toJSONSchema } from 'zod/v4';\nimport { rpcRequest } from '../transport.error';\nimport { ServerResponse } from '../../common';\n\n/**\n * Stateless HTTP requests must be able to send multiple initialize calls without\n * tripping the MCP transport's \"already initialized\" guard. The upstream SDK\n * treats any transport with a session ID generator as stateful, so we disable\n * session generation entirely for stateless transports.\n */\nexport const resolveSessionIdGenerator = (\n  transportType: TransportType,\n  sessionId: string,\n): (() => string) | undefined => {\n  return transportType === 'stateless-http' ? undefined : () => sessionId;\n};\n\nexport class TransportStreamableHttpAdapter extends LocalTransportAdapter<StreamableHTTPServerTransport> {\n  override createTransport(sessionId: string, response: ServerResponse): StreamableHTTPServerTransport {\n    const sessionIdGenerator = resolveSessionIdGenerator(this.key.type, sessionId);\n\n    return new StreamableHTTPServerTransport({\n      sessionIdGenerator,\n      onsessionclosed: () => {\n        // this.destroy();\n      },\n      onsessioninitialized: (sessionId) => {\n        if (sessionId) {\n          console.log(`session initialized: ${sessionId.slice(0, 40)}`);\n        } else {\n          console.log(`stateless session initialized`);\n        }\n      },\n      // Disable eventStore to prevent priming events - Claude.ai's client doesn't handle them\n      // The priming event has empty data with no `event:` type, which violates MCP spec\n      // (\"Event types MUST be message\") and confuses some clients\n      eventStore: undefined,\n    });\n  }\n\n  initialize(req: AuthenticatedServerRequest, res: ServerResponse): Promise<void> {\n    this.ensureAuthInfo(req, this);\n\n    this.logger.info('[StreamableHttpAdapter] initialize() called', {\n      method: req.method,\n      sessionId: this.key.sessionId.slice(0, 30),\n      bodyMethod: (req.body as { method?: string })?.method,\n    });\n\n    // Intercept response to log what gets sent back to client\n    const originalWrite = res.write.bind(res) as typeof res.write;\n    const originalEnd = res.end.bind(res) as typeof res.end;\n    let responseBody = '';\n\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    res.write = function (this: ServerResponse, chunk: any, encodingOrCb?: any, cb?: any): boolean {\n      if (chunk) {\n        responseBody += typeof chunk === 'string' ? chunk : Buffer.isBuffer(chunk) ? chunk.toString() : String(chunk);\n      }\n      return originalWrite.call(this, chunk, encodingOrCb, cb);\n    } as typeof res.write;\n\n    const adapter = this;\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    res.end = function (this: ServerResponse, chunk?: any, encodingOrCb?: any, cb?: any): ServerResponse {\n      if (chunk) {\n        responseBody += typeof chunk === 'string' ? chunk : Buffer.isBuffer(chunk) ? chunk.toString() : String(chunk);\n      }\n      adapter.logger.info('[StreamableHttpAdapter] initialize response', {\n        statusCode: res.statusCode,\n        headers: res.getHeaders?.() ?? {},\n        bodyPreview: responseBody.slice(0, 1000),\n      });\n      return originalEnd.call(this, chunk, encodingOrCb, cb);\n    } as typeof res.end;\n\n    return this.transport.handleRequest(req, res, req.body);\n  }\n\n  async handleRequest(req: AuthenticatedServerRequest, res: ServerResponse): Promise<void> {\n    this.ensureAuthInfo(req, this);\n    //\n    // if ((await this.isInitialized) && isInitializeRequest(req.body)) {\n    //   await this.transport.close();\n    //   this.isInitialized = this.connectStreamableTransport(req.authSession.session!.id);\n    //   await this.ready;\n    // }\n\n    if (req.method === 'GET') {\n      return this.transport.handleRequest(req, res);\n    } else {\n      if (this.handleIfElicitResult(req)) {\n        return;\n      }\n      return this.transport.handleRequest(req, res, req.body);\n    }\n  }\n\n  async sendElicitRequest<T extends ZodType>(\n    relatedRequestId: RequestId,\n    message: string,\n    requestedSchema: T,\n  ): Promise<TypedElicitResult<T>> {\n    await this.transport.send(\n      rpcRequest(this.newRequestId, 'elicitation/create', {\n        message,\n        requestedSchema: toJSONSchema(requestedSchema as any),\n      }),\n      { relatedRequestId },\n    );\n\n    return new Promise<TypedElicitResult<T>>((resolve, reject) => {\n      this.elicitHandler = {\n        resolve: (result) => {\n          resolve(result as TypedElicitResult<T>);\n          this.elicitHandler = undefined;\n        },\n        reject: (err) => {\n          reject(err);\n          this.elicitHandler = undefined;\n        },\n      };\n    });\n  }\n}\n"]}
+{"version":3,"file":"transport.streamable-http.adapter.js","sourceRoot":"","sources":["../../../../src/transport/adapters/transport.streamable-http.adapter.ts"],"names":[],"mappings":";;;AAAA,0FAAmG;AAGnG,uEAAkE;AAGlE,+BAAsC;AACtC,wDAAgD;AAGhD;;;;;GAKG;AACI,MAAM,yBAAyB,GAAG,CACvC,aAA4B,EAC5B,SAAiB,EACW,EAAE;IAC9B,OAAO,aAAa,KAAK,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;AAC1E,CAAC,CAAC;AALW,QAAA,yBAAyB,6BAKpC;AAEF,MAAa,8BAA+B,SAAQ,+CAAoD;IAC7F,eAAe,CAAC,SAAiB,EAAE,QAAwB;QAClE,MAAM,kBAAkB,GAAG,IAAA,iCAAyB,EAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAE/E,OAAO,IAAI,iDAA6B,CAAC;YACvC,kBAAkB;YAClB,eAAe,EAAE,GAAG,EAAE;gBACpB,kBAAkB;YACpB,CAAC;YACD,oBAAoB,EAAE,CAAC,SAAS,EAAE,EAAE;gBAClC,IAAI,SAAS,EAAE,CAAC;oBACd,OAAO,CAAC,GAAG,CAAC,wBAAwB,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;gBAChE,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;gBAC/C,CAAC;YACH,CAAC;YACD,wFAAwF;YACxF,kFAAkF;YAClF,4DAA4D;YAC5D,UAAU,EAAE,SAAS;SACtB,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,GAA+B,EAAE,GAAmB;QAC7D,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAE/B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6CAA6C,EAAE;YAC9D,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YAC1C,UAAU,EAAG,GAAG,CAAC,IAA4B,EAAE,MAAM;SACtD,CAAC,CAAC;QAEH,0DAA0D;QAC1D,MAAM,aAAa,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAqB,CAAC;QAC9D,MAAM,WAAW,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAmB,CAAC;QACxD,IAAI,YAAY,GAAG,EAAE,CAAC;QAEtB,8DAA8D;QAC9D,GAAG,CAAC,KAAK,GAAG,UAAgC,KAAU,EAAE,YAAkB,EAAE,EAAQ;YAClF,IAAI,KAAK,EAAE,CAAC;gBACV,YAAY,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAChH,CAAC;YACD,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;QAC3D,CAAqB,CAAC;QAEtB,4DAA4D;QAC5D,MAAM,OAAO,GAAG,IAAI,CAAC;QACrB,8DAA8D;QAC9D,GAAG,CAAC,GAAG,GAAG,UAAgC,KAAW,EAAE,YAAkB,EAAE,EAAQ;YACjF,IAAI,KAAK,EAAE,CAAC;gBACV,YAAY,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAChH,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,6CAA6C,EAAE;gBACjE,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,OAAO,EAAE,GAAG,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE;gBACjC,WAAW,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC;aACzC,CAAC,CAAC;YACH,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;QACzD,CAAmB,CAAC;QAEpB,OAAO,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,GAA+B,EAAE,GAAmB;QACtE,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC/B,EAAE;QACF,qEAAqE;QACrE,kCAAkC;QAClC,uFAAuF;QACvF,sBAAsB;QACtB,IAAI;QAEJ,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAChD,CAAC;aAAM,CAAC;YACN,IAAI,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnC,OAAO;YACT,CAAC;YACD,OAAO,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,gBAA2B,EAC3B,OAAe,EACf,eAAkB;QAElB,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CACvB,IAAA,4BAAU,EAAC,IAAI,CAAC,YAAY,EAAE,oBAAoB,EAAE;YAClD,OAAO;YACP,eAAe,EAAE,IAAA,iBAAY,EAAC,eAAsB,CAAC;SACtD,CAAC,EACF,EAAE,gBAAgB,EAAE,CACrB,CAAC;QAEF,OAAO,IAAI,OAAO,CAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3D,IAAI,CAAC,aAAa,GAAG;gBACnB,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE;oBAClB,OAAO,CAAC,MAA8B,CAAC,CAAC;oBACxC,IAAI,CAAC,aAAa,GAAG,SAAS,CAAC;gBACjC,CAAC;gBACD,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE;oBACd,MAAM,CAAC,GAAG,CAAC,CAAC;oBACZ,IAAI,CAAC,aAAa,GAAG,SAAS,CAAC;gBACjC,CAAC;aACF,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AA5GD,wEA4GC","sourcesContent":["import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';\nimport { TransportType, TypedElicitResult } from '../transport.types';\nimport { AuthenticatedServerRequest } from '../../server/server.types';\nimport { LocalTransportAdapter } from './transport.local.adapter';\nimport { RequestId } from '@modelcontextprotocol/sdk/types.js';\nimport { ZodType } from 'zod';\nimport { toJSONSchema } from 'zod/v4';\nimport { rpcRequest } from '../transport.error';\nimport { ServerResponse } from '../../common';\n\n/**\n * Stateless HTTP requests must be able to send multiple initialize calls without\n * tripping the MCP transport's \"already initialized\" guard. The upstream SDK\n * treats any transport with a session ID generator as stateful, so we disable\n * session generation entirely for stateless transports.\n */\nexport const resolveSessionIdGenerator = (\n  transportType: TransportType,\n  sessionId: string,\n): (() => string) | undefined => {\n  return transportType === 'stateless-http' ? undefined : () => sessionId;\n};\n\nexport class TransportStreamableHttpAdapter extends LocalTransportAdapter<StreamableHTTPServerTransport> {\n  override createTransport(sessionId: string, response: ServerResponse): StreamableHTTPServerTransport {\n    const sessionIdGenerator = resolveSessionIdGenerator(this.key.type, sessionId);\n\n    return new StreamableHTTPServerTransport({\n      sessionIdGenerator,\n      onsessionclosed: () => {\n        // this.destroy();\n      },\n      onsessioninitialized: (sessionId) => {\n        if (sessionId) {\n          console.log(`session initialized: ${sessionId.slice(0, 40)}`);\n        } else {\n          console.log(`stateless session initialized`);\n        }\n      },\n      // Disable eventStore to prevent priming events - Claude.ai's client doesn't handle them\n      // The priming event has empty data with no `event:` type, which violates MCP spec\n      // (\"Event types MUST be message\") and confuses some clients\n      eventStore: undefined,\n    });\n  }\n\n  initialize(req: AuthenticatedServerRequest, res: ServerResponse): Promise<void> {\n    this.ensureAuthInfo(req, this);\n\n    this.logger.info('[StreamableHttpAdapter] initialize() called', {\n      method: req.method,\n      sessionId: this.key.sessionId.slice(0, 30),\n      bodyMethod: (req.body as { method?: string })?.method,\n    });\n\n    // Intercept response to log what gets sent back to client\n    const originalWrite = res.write.bind(res) as typeof res.write;\n    const originalEnd = res.end.bind(res) as typeof res.end;\n    let responseBody = '';\n\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    res.write = function (this: ServerResponse, chunk: any, encodingOrCb?: any, cb?: any): boolean {\n      if (chunk) {\n        responseBody += typeof chunk === 'string' ? chunk : Buffer.isBuffer(chunk) ? chunk.toString() : String(chunk);\n      }\n      return originalWrite.call(this, chunk, encodingOrCb, cb);\n    } as typeof res.write;\n\n    // eslint-disable-next-line @typescript-eslint/no-this-alias\n    const adapter = this;\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    res.end = function (this: ServerResponse, chunk?: any, encodingOrCb?: any, cb?: any): ServerResponse {\n      if (chunk) {\n        responseBody += typeof chunk === 'string' ? chunk : Buffer.isBuffer(chunk) ? chunk.toString() : String(chunk);\n      }\n      adapter.logger.info('[StreamableHttpAdapter] initialize response', {\n        statusCode: res.statusCode,\n        headers: res.getHeaders?.() ?? {},\n        bodyPreview: responseBody.slice(0, 1000),\n      });\n      return originalEnd.call(this, chunk, encodingOrCb, cb);\n    } as typeof res.end;\n\n    return this.transport.handleRequest(req, res, req.body);\n  }\n\n  async handleRequest(req: AuthenticatedServerRequest, res: ServerResponse): Promise<void> {\n    this.ensureAuthInfo(req, this);\n    //\n    // if ((await this.isInitialized) && isInitializeRequest(req.body)) {\n    //   await this.transport.close();\n    //   this.isInitialized = this.connectStreamableTransport(req.authSession.session!.id);\n    //   await this.ready;\n    // }\n\n    if (req.method === 'GET') {\n      return this.transport.handleRequest(req, res);\n    } else {\n      if (this.handleIfElicitResult(req)) {\n        return;\n      }\n      return this.transport.handleRequest(req, res, req.body);\n    }\n  }\n\n  async sendElicitRequest<T extends ZodType>(\n    relatedRequestId: RequestId,\n    message: string,\n    requestedSchema: T,\n  ): Promise<TypedElicitResult<T>> {\n    await this.transport.send(\n      rpcRequest(this.newRequestId, 'elicitation/create', {\n        message,\n        requestedSchema: toJSONSchema(requestedSchema as any),\n      }),\n      { relatedRequestId },\n    );\n\n    return new Promise<TypedElicitResult<T>>((resolve, reject) => {\n      this.elicitHandler = {\n        resolve: (result) => {\n          resolve(result as TypedElicitResult<T>);\n          this.elicitHandler = undefined;\n        },\n        reject: (err) => {\n          reject(err);\n          this.elicitHandler = undefined;\n        },\n      };\n    });\n  }\n}\n"]}

package/src/transport/flows/handle.sse.flow.js

@@ -47,7 +47,14 @@ let HandleSseFlow = class HandleSseFlow extends common_1.FlowBase {
         //             This is the ID the client received from initialize and is referencing.
         // Priority 2: Use session from authorization if header matches or is absent
         // Priority 3: Create new session (first request - no header, no authorization.session)
-        const mcpSessionHeader = request.headers?.['mcp-session-id'];
+        const raw = request.headers?.['mcp-session-id'];
+        const rawMcpSessionHeader = typeof raw === 'string' ? raw : undefined;
+        const mcpSessionHeader = (0, common_1.validateMcpSessionHeader)(rawMcpSessionHeader);
+        // If client sent a header but validation failed, return 404
+        if (raw !== undefined && !mcpSessionHeader) {
+            this.respond(common_1.httpRespond.sessionNotFound('invalid session id'));
+            return;
+        }
         let session;
         if (mcpSessionHeader) {
             // Client sent session ID - ALWAYS use it for transport lookup
@@ -68,7 +75,7 @@ let HandleSseFlow = class HandleSseFlow extends common_1.FlowBase {
             // No session - create new one (initialize request)
             session = (0, session_id_utils_1.createSessionId)('legacy-sse', token, {
                 userAgent: request.headers?.['user-agent'],
-                platformDetectionConfig: this.scope.metadata?.session?.platformDetection,
+                platformDetectionConfig: this.scope.metadata.transport?.platformDetection,
             });
         }
         this.state.set(exports.stateSchema.parse({ token, session }));

package/src/transport/flows/handle.sse.flow.js.map

@@ -1 +1 @@
-{"version":3,"file":"handle.sse.flow.js","sourceRoot":"","sources":["../../../../src/transport/flows/handle.sse.flow.ts"],"names":[],"mappings":";;;;AAAA,yCAcsB;AACtB,6BAAwB;AAExB,gFAA4E;AAE/D,QAAA,IAAI,GAAG;IAClB,GAAG,EAAE,CAAC,YAAY,EAAE,QAAQ,CAAC;IAC7B,OAAO,EAAE,CAAC,cAAc,EAAE,WAAW,EAAE,gBAAgB,CAAC;IACxD,IAAI,EAAE,EAAE;IACR,QAAQ,EAAE,CAAC,SAAS,CAAC;CACc,CAAC;AAEtC,mGAAmG;AACnG,MAAM,kBAAkB,GAAG,OAAC,CAAC,MAAM,CAAC;IAClC,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE;IACd,OAAO,EAAE,OAAC;SACP,MAAM,CAAC;QACN,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE;QAClB,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE;QACnB,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;QACvB,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE;QACf,QAAQ,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,KAAK,EAAE,iBAAiB,EAAE,eAAe,EAAE,gBAAgB,CAAC,CAAC,CAAC,QAAQ,EAAE;QACxG,QAAQ,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAChC,YAAY,EAAE,OAAC;aACZ,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;aACxG,QAAQ,EAAE;KACd,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC;AAEU,QAAA,WAAW,GAAG,OAAC,CAAC,MAAM,CAAC;IAClC,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE;IACjB,OAAO,EAAE,kBAAkB;IAC3B,WAAW,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC1E,CAAC,CAAC;AAEH,MAAM,IAAI,GAAG,mBAA4B,CAAC;AAC1C,MAAM,EAAE,KAAK,EAAE,GAAG,IAAA,oBAAW,EAAC,IAAI,CAAC,CAAC;AAqBrB,IAAM,aAAa,GAAnB,MAAM,aAAc,SAAQ,iBAAqB;IAExD,AAAN,KAAK,CAAC,UAAU;QACd,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAElC,MAAM,aAAa,GAAG,OAAO,CAAC,4BAAmB,CAAC,IAAI,CAAkB,CAAC;QACzE,MAAM,EAAE,KAAK,EAAE,GAAG,aAAa,CAAC;QAEhC,kFAAkF;QAClF,2DAA2D;QAC3D,EAAE;QACF,oFAAoF;QACpF,qFAAqF;QACrF,4EAA4E;QAC5E,uFAAuF;QACvF,MAAM,gBAAgB,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,gBAAgB,CAAuB,CAAC;QAEnF,IAAI,OAAoF,CAAC;QAEzF,IAAI,gBAAgB,EAAE,CAAC;YACrB,8DAA8D;YAC9D,sFAAsF;YACtF,iGAAiG;YACjG,IAAI,aAAa,CAAC,OAAO,EAAE,EAAE,KAAK,gBAAgB,EAAE,CAAC;gBACnD,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC;YAClC,CAAC;iBAAM,CAAC;gBACN,OAAO,GAAG,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC;YACrC,CAAC;QACH,CAAC;aAAM,IAAI,aAAa,CAAC,OAAO,EAAE,CAAC;YACjC,qFAAqF;YACrF,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,mDAAmD;YACnD,OAAO,GAAG,IAAA,kCAAe,EAAC,YAAY,EAAE,KAAK,EAAE;gBAC7C,SAAS,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,YAAY,CAAuB;gBAChE,uBAAuB,EAAG,IAAI,CAAC,KAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,iBAAiB;aACpF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,mBAAW,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IACxD,CAAC;IAGK,AAAN,KAAK,CAAC,MAAM;QACV,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAClC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAc,CAAC;QAClC,MAAM,WAAW,GAAG,IAAA,6BAAoB,EAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,IAAA,6BAAoB,EAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,IAAA,2BAAkB,EAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,GAAG,MAAM,GAAG,SAAS,EAAE,CAAC;QAEzC,IAAI,WAAW,KAAK,GAAG,QAAQ,MAAM,EAAE,CAAC;YACtC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;QAC9C,CAAC;aAAM,IAAI,WAAW,KAAK,GAAG,QAAQ,UAAU,EAAE,CAAC;YACjD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAKK,AAAN,KAAK,CAAC,YAAY;QAChB,MAAM,gBAAgB,GAAI,IAAI,CAAC,KAAe,CAAC,gBAAgB,CAAC;QAEhE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC5C,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC/C,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,iBAAiB,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC/F,MAAM,SAAS,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAKK,AAAN,KAAK,CAAC,cAAc;QAClB,qFAAqF;QACrF,oBAAoB;QACpB,mEAAmE;QACnE,YAAY;QACZ,IAAI;QACJ,oDAAoD;QACpD,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC1C,CAAC;IAKK,AAAN,KAAK,CAAC,SAAS;QACb,MAAM,gBAAgB,GAAI,IAAI,CAAC,KAAe,CAAC,gBAAgB,CAAC;QAChE,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAErE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC5C,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC/C,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,yFAAyF;YACzF,MAAM,UAAU,GAAG,gBAAgB,CAAC,iBAAiB,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YAChF,MAAM,IAAI,GAAG,OAAO,CAAC,IAA2C,CAAC;YAEjE,IAAI,UAAU,EAAE,CAAC;gBACf,sFAAsF;gBACtF,MAAM,CAAC,IAAI,CAAC,+CAA+C,EAAE;oBAC3D,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;oBACnC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;oBAC5B,MAAM,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC;oBACxB,SAAS,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC;iBACxB,CAAC,CAAC;gBACH,IAAI,CAAC,OAAO,CAAC,oBAAW,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAC9D,CAAC;iBAAM,CAAC;gBACN,6FAA6F;gBAC7F,MAAM,CAAC,IAAI,CAAC,yEAAyE,EAAE;oBACrF,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;oBACnC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;oBAC5B,MAAM,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC;oBACxB,SAAS,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC;oBACvB,SAAS,EAAG,OAAO,CAAC,OAAO,EAAE,CAAC,YAAY,CAAwB,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;iBACjF,CAAC,CAAC;gBACH,IAAI,CAAC,OAAO,CAAC,oBAAW,CAAC,eAAe,CAAC,yBAAyB,CAAC,CAAC,CAAC;YACvE,CAAC;YACD,OAAO;QACT,CAAC;QACD,MAAM,SAAS,CAAC,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;CACF,CAAA;AA1HO;IADL,KAAK,CAAC,YAAY,CAAC;;;;+CAuCnB;AAGK;IADL,KAAK,CAAC,QAAQ,CAAC;;;;2CAcf;AAKK;IAHL,KAAK,CAAC,cAAc,EAAE;QACrB,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,WAAW,KAAK,YAAY;KACrE,CAAC;;;;iDASD;AAKK;IAHL,KAAK,CAAC,gBAAgB,EAAE;QACvB,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,WAAW,KAAK,cAAc;KACvE,CAAC;;;;mDASD;AAKK;IAHL,KAAK,CAAC,WAAW,EAAE;QAClB,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,WAAW,KAAK,SAAS;KAClE,CAAC;;;;8CAqCD;AA3HkB,aAAa;IAPjC,IAAA,aAAI,EAAC;QACJ,IAAI;QACJ,MAAM,EAAE,YAAY;QACpB,WAAW,EAAE,wBAAe;QAC5B,YAAY,EAAE,yBAAgB;QAC9B,IAAI,EAAJ,YAAI;KACL,CAAC;GACmB,aAAa,CA4HjC;kBA5HoB,aAAa","sourcesContent":["import {\n  Flow,\n  httpInputSchema,\n  FlowRunOptions,\n  httpOutputSchema,\n  FlowPlan,\n  FlowBase,\n  FlowHooksOf,\n  sessionIdSchema,\n  httpRespond,\n  ServerRequestTokens,\n  Authorization,\n  normalizeEntryPrefix,\n  normalizeScopeBase,\n} from '../../common';\nimport { z } from 'zod';\nimport { Scope } from '../../scope';\nimport { createSessionId } from '../../auth/session/utils/session-id.utils';\n\nexport const plan = {\n  pre: ['parseInput', 'router'],\n  execute: ['onInitialize', 'onMessage', 'onElicitResult'],\n  post: [],\n  finalize: ['cleanup'],\n} as const satisfies FlowPlan<string>;\n\n// Relaxed session schema for state - payload is optional when using mcp-session-id header directly\nconst stateSessionSchema = z.object({\n  id: z.string(),\n  payload: z\n    .object({\n      nodeId: z.string(),\n      authSig: z.string(),\n      uuid: z.string().uuid(),\n      iat: z.number(),\n      protocol: z.enum(['legacy-sse', 'sse', 'streamable-http', 'stateful-http', 'stateless-http']).optional(),\n      isPublic: z.boolean().optional(),\n      platformType: z\n        .enum(['openai', 'claude', 'gemini', 'cursor', 'continue', 'cody', 'generic-mcp', 'ext-apps', 'unknown'])\n        .optional(),\n    })\n    .optional(),\n});\n\nexport const stateSchema = z.object({\n  token: z.string(),\n  session: stateSessionSchema,\n  requestType: z.enum(['initialize', 'message', 'elicitResult']).optional(),\n});\n\nconst name = 'handle:legacy-sse' as const;\nconst { Stage } = FlowHooksOf(name);\n\ndeclare global {\n  interface ExtendFlows {\n    'handle:legacy-sse': FlowRunOptions<\n      HandleSseFlow,\n      typeof plan,\n      typeof httpInputSchema,\n      typeof httpOutputSchema,\n      typeof stateSchema\n    >;\n  }\n}\n\n@Flow({\n  name,\n  access: 'authorized',\n  inputSchema: httpInputSchema,\n  outputSchema: httpOutputSchema,\n  plan,\n})\nexport default class HandleSseFlow extends FlowBase<typeof name> {\n  @Stage('parseInput')\n  async parseInput() {\n    const { request } = this.rawInput;\n\n    const authorization = request[ServerRequestTokens.auth] as Authorization;\n    const { token } = authorization;\n\n    // CRITICAL: The mcp-session-id header is the client's reference to their session.\n    // We MUST use this exact ID for transport registry lookup.\n    //\n    // Priority 1: Use mcp-session-id header if present (client's session ID for lookup)\n    //             This is the ID the client received from initialize and is referencing.\n    // Priority 2: Use session from authorization if header matches or is absent\n    // Priority 3: Create new session (first request - no header, no authorization.session)\n    const mcpSessionHeader = request.headers?.['mcp-session-id'] as string | undefined;\n\n    let session: { id: string; payload?: z.infer<typeof stateSchema>['session']['payload'] };\n\n    if (mcpSessionHeader) {\n      // Client sent session ID - ALWAYS use it for transport lookup\n      // If authorization.session exists and matches, use its payload for protocol detection\n      // If authorization.session differs or is missing, still use header ID (payload may be undefined)\n      if (authorization.session?.id === mcpSessionHeader) {\n        session = authorization.session;\n      } else {\n        session = { id: mcpSessionHeader };\n      }\n    } else if (authorization.session) {\n      // No header but authorization has session - use it (shouldn't happen in normal flow)\n      session = authorization.session;\n    } else {\n      // No session - create new one (initialize request)\n      session = createSessionId('legacy-sse', token, {\n        userAgent: request.headers?.['user-agent'] as string | undefined,\n        platformDetectionConfig: (this.scope as Scope).metadata?.session?.platformDetection,\n      });\n    }\n\n    this.state.set(stateSchema.parse({ token, session }));\n  }\n\n  @Stage('router')\n  async router() {\n    const { request } = this.rawInput;\n    const scope = this.scope as Scope;\n    const requestPath = normalizeEntryPrefix(request.path);\n    const prefix = normalizeEntryPrefix(scope.entryPath);\n    const scopePath = normalizeScopeBase(scope.routeBase);\n    const basePath = `${prefix}${scopePath}`;\n\n    if (requestPath === `${basePath}/sse`) {\n      this.state.set('requestType', 'initialize');\n    } else if (requestPath === `${basePath}/message`) {\n      this.state.set('requestType', 'message');\n    }\n  }\n\n  @Stage('onInitialize', {\n    filter: ({ state: { requestType } }) => requestType === 'initialize',\n  })\n  async onInitialize() {\n    const transportService = (this.scope as Scope).transportService;\n\n    const { request, response } = this.rawInput;\n    const { token, session } = this.state.required;\n    const transport = await transportService.createTransporter('sse', token, session.id, response);\n    await transport.initialize(request, response);\n    this.handled();\n  }\n\n  @Stage('onElicitResult', {\n    filter: ({ state: { requestType } }) => requestType === 'elicitResult',\n  })\n  async onElicitResult() {\n    // const transport = await transportService.getTransporter('sse', token, session.id);\n    // if (!transport) {\n    //   this.respond(httpRespond.rpcError('session not initialized'));\n    //   return;\n    // }\n    // await transport.handleRequest(request, response);\n    this.fail(new Error('Not implemented'));\n  }\n\n  @Stage('onMessage', {\n    filter: ({ state: { requestType } }) => requestType === 'message',\n  })\n  async onMessage() {\n    const transportService = (this.scope as Scope).transportService;\n    const logger = this.scopeLogger.child('handle:legacy-sse:onMessage');\n\n    const { request, response } = this.rawInput;\n    const { token, session } = this.state.required;\n    const transport = await transportService.getTransporter('sse', token, session.id);\n    if (!transport) {\n      // Check if session was ever created to differentiate error types per MCP Spec 2025-11-25\n      const wasCreated = transportService.wasSessionCreated('sse', token, session.id);\n      const body = request.body as Record<string, unknown> | undefined;\n\n      if (wasCreated) {\n        // Session existed but was terminated/evicted → HTTP 404 (client should re-initialize)\n        logger.info('Session expired - client should re-initialize', {\n          sessionId: session.id?.slice(0, 20),\n          tokenHash: token.slice(0, 8),\n          method: body?.['method'],\n          requestId: body?.['id'],\n        });\n        this.respond(httpRespond.sessionExpired('session expired'));\n      } else {\n        // Session was never created → HTTP 404 (per user requirement: invalid/missing session = 404)\n        logger.warn('Session not initialized - client attempted request without initializing', {\n          sessionId: session.id?.slice(0, 20),\n          tokenHash: token.slice(0, 8),\n          method: body?.['method'],\n          requestId: body?.['id'],\n          userAgent: (request.headers?.['user-agent'] as string | undefined)?.slice(0, 50),\n        });\n        this.respond(httpRespond.sessionNotFound('session not initialized'));\n      }\n      return;\n    }\n    await transport.handleRequest(request, response);\n    this.handled();\n  }\n}\n"]}
+{"version":3,"file":"handle.sse.flow.js","sourceRoot":"","sources":["../../../../src/transport/flows/handle.sse.flow.ts"],"names":[],"mappings":";;;;AAAA,yCAesB;AACtB,6BAAwB;AAExB,gFAA4E;AAE/D,QAAA,IAAI,GAAG;IAClB,GAAG,EAAE,CAAC,YAAY,EAAE,QAAQ,CAAC;IAC7B,OAAO,EAAE,CAAC,cAAc,EAAE,WAAW,EAAE,gBAAgB,CAAC;IACxD,IAAI,EAAE,EAAE;IACR,QAAQ,EAAE,CAAC,SAAS,CAAC;CACc,CAAC;AAEtC,mGAAmG;AACnG,MAAM,kBAAkB,GAAG,OAAC,CAAC,MAAM,CAAC;IAClC,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE;IACd,OAAO,EAAE,OAAC;SACP,MAAM,CAAC;QACN,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE;QAClB,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE;QACnB,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;QACvB,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE;QACf,QAAQ,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,KAAK,EAAE,iBAAiB,EAAE,eAAe,EAAE,gBAAgB,CAAC,CAAC,CAAC,QAAQ,EAAE;QACxG,QAAQ,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAChC,YAAY,EAAE,OAAC;aACZ,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;aACxG,QAAQ,EAAE;KACd,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC;AAEU,QAAA,WAAW,GAAG,OAAC,CAAC,MAAM,CAAC;IAClC,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE;IACjB,OAAO,EAAE,kBAAkB;IAC3B,WAAW,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC1E,CAAC,CAAC;AAEH,MAAM,IAAI,GAAG,mBAA4B,CAAC;AAC1C,MAAM,EAAE,KAAK,EAAE,GAAG,IAAA,oBAAW,EAAC,IAAI,CAAC,CAAC;AAqBrB,IAAM,aAAa,GAAnB,MAAM,aAAc,SAAQ,iBAAqB;IAExD,AAAN,KAAK,CAAC,UAAU;QACd,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAElC,MAAM,aAAa,GAAG,OAAO,CAAC,4BAAmB,CAAC,IAAI,CAAkB,CAAC;QACzE,MAAM,EAAE,KAAK,EAAE,GAAG,aAAa,CAAC;QAEhC,kFAAkF;QAClF,2DAA2D;QAC3D,EAAE;QACF,oFAAoF;QACpF,qFAAqF;QACrF,4EAA4E;QAC5E,uFAAuF;QACvF,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,gBAAgB,CAAC,CAAC;QAChD,MAAM,mBAAmB,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QACtE,MAAM,gBAAgB,GAAG,IAAA,iCAAwB,EAAC,mBAAmB,CAAC,CAAC;QAEvE,4DAA4D;QAC5D,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3C,IAAI,CAAC,OAAO,CAAC,oBAAW,CAAC,eAAe,CAAC,oBAAoB,CAAC,CAAC,CAAC;YAChE,OAAO;QACT,CAAC;QAED,IAAI,OAAoF,CAAC;QAEzF,IAAI,gBAAgB,EAAE,CAAC;YACrB,8DAA8D;YAC9D,sFAAsF;YACtF,iGAAiG;YACjG,IAAI,aAAa,CAAC,OAAO,EAAE,EAAE,KAAK,gBAAgB,EAAE,CAAC;gBACnD,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC;YAClC,CAAC;iBAAM,CAAC;gBACN,OAAO,GAAG,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC;YACrC,CAAC;QACH,CAAC;aAAM,IAAI,aAAa,CAAC,OAAO,EAAE,CAAC;YACjC,qFAAqF;YACrF,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,mDAAmD;YACnD,OAAO,GAAG,IAAA,kCAAe,EAAC,YAAY,EAAE,KAAK,EAAE;gBAC7C,SAAS,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,YAAY,CAAuB;gBAChE,uBAAuB,EAAG,IAAI,CAAC,KAAe,CAAC,QAAQ,CAAC,SAAS,EAAE,iBAAiB;aACrF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,mBAAW,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IACxD,CAAC;IAGK,AAAN,KAAK,CAAC,MAAM;QACV,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAClC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAc,CAAC;QAClC,MAAM,WAAW,GAAG,IAAA,6BAAoB,EAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,IAAA,6BAAoB,EAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,IAAA,2BAAkB,EAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,GAAG,MAAM,GAAG,SAAS,EAAE,CAAC;QAEzC,IAAI,WAAW,KAAK,GAAG,QAAQ,MAAM,EAAE,CAAC;YACtC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;QAC9C,CAAC;aAAM,IAAI,WAAW,KAAK,GAAG,QAAQ,UAAU,EAAE,CAAC;YACjD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAKK,AAAN,KAAK,CAAC,YAAY;QAChB,MAAM,gBAAgB,GAAI,IAAI,CAAC,KAAe,CAAC,gBAAgB,CAAC;QAEhE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC5C,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC/C,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,iBAAiB,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC/F,MAAM,SAAS,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAKK,AAAN,KAAK,CAAC,cAAc;QAClB,qFAAqF;QACrF,oBAAoB;QACpB,mEAAmE;QACnE,YAAY;QACZ,IAAI;QACJ,oDAAoD;QACpD,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC1C,CAAC;IAKK,AAAN,KAAK,CAAC,SAAS;QACb,MAAM,gBAAgB,GAAI,IAAI,CAAC,KAAe,CAAC,gBAAgB,CAAC;QAChE,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAErE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC5C,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC/C,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,yFAAyF;YACzF,MAAM,UAAU,GAAG,gBAAgB,CAAC,iBAAiB,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YAChF,MAAM,IAAI,GAAG,OAAO,CAAC,IAA2C,CAAC;YAEjE,IAAI,UAAU,EAAE,CAAC;gBACf,sFAAsF;gBACtF,MAAM,CAAC,IAAI,CAAC,+CAA+C,EAAE;oBAC3D,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;oBACnC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;oBAC5B,MAAM,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC;oBACxB,SAAS,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC;iBACxB,CAAC,CAAC;gBACH,IAAI,CAAC,OAAO,CAAC,oBAAW,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAC9D,CAAC;iBAAM,CAAC;gBACN,6FAA6F;gBAC7F,MAAM,CAAC,IAAI,CAAC,yEAAyE,EAAE;oBACrF,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;oBACnC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;oBAC5B,MAAM,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC;oBACxB,SAAS,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC;oBACvB,SAAS,EAAG,OAAO,CAAC,OAAO,EAAE,CAAC,YAAY,CAAwB,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;iBACjF,CAAC,CAAC;gBACH,IAAI,CAAC,OAAO,CAAC,oBAAW,CAAC,eAAe,CAAC,yBAAyB,CAAC,CAAC,CAAC;YACvE,CAAC;YACD,OAAO;QACT,CAAC;QACD,MAAM,SAAS,CAAC,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;CACF,CAAA;AAlIO;IADL,KAAK,CAAC,YAAY,CAAC;;;;+CA+CnB;AAGK;IADL,KAAK,CAAC,QAAQ,CAAC;;;;2CAcf;AAKK;IAHL,KAAK,CAAC,cAAc,EAAE;QACrB,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,WAAW,KAAK,YAAY;KACrE,CAAC;;;;iDASD;AAKK;IAHL,KAAK,CAAC,gBAAgB,EAAE;QACvB,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,WAAW,KAAK,cAAc;KACvE,CAAC;;;;mDASD;AAKK;IAHL,KAAK,CAAC,WAAW,EAAE;QAClB,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,WAAW,KAAK,SAAS;KAClE,CAAC;;;;8CAqCD;AAnIkB,aAAa;IAPjC,IAAA,aAAI,EAAC;QACJ,IAAI;QACJ,MAAM,EAAE,YAAY;QACpB,WAAW,EAAE,wBAAe;QAC5B,YAAY,EAAE,yBAAgB;QAC9B,IAAI,EAAJ,YAAI;KACL,CAAC;GACmB,aAAa,CAoIjC;kBApIoB,aAAa","sourcesContent":["import {\n  Flow,\n  httpInputSchema,\n  FlowRunOptions,\n  httpOutputSchema,\n  FlowPlan,\n  FlowBase,\n  FlowHooksOf,\n  sessionIdSchema,\n  httpRespond,\n  ServerRequestTokens,\n  Authorization,\n  normalizeEntryPrefix,\n  normalizeScopeBase,\n  validateMcpSessionHeader,\n} from '../../common';\nimport { z } from 'zod';\nimport { Scope } from '../../scope';\nimport { createSessionId } from '../../auth/session/utils/session-id.utils';\n\nexport const plan = {\n  pre: ['parseInput', 'router'],\n  execute: ['onInitialize', 'onMessage', 'onElicitResult'],\n  post: [],\n  finalize: ['cleanup'],\n} as const satisfies FlowPlan<string>;\n\n// Relaxed session schema for state - payload is optional when using mcp-session-id header directly\nconst stateSessionSchema = z.object({\n  id: z.string(),\n  payload: z\n    .object({\n      nodeId: z.string(),\n      authSig: z.string(),\n      uuid: z.string().uuid(),\n      iat: z.number(),\n      protocol: z.enum(['legacy-sse', 'sse', 'streamable-http', 'stateful-http', 'stateless-http']).optional(),\n      isPublic: z.boolean().optional(),\n      platformType: z\n        .enum(['openai', 'claude', 'gemini', 'cursor', 'continue', 'cody', 'generic-mcp', 'ext-apps', 'unknown'])\n        .optional(),\n    })\n    .optional(),\n});\n\nexport const stateSchema = z.object({\n  token: z.string(),\n  session: stateSessionSchema,\n  requestType: z.enum(['initialize', 'message', 'elicitResult']).optional(),\n});\n\nconst name = 'handle:legacy-sse' as const;\nconst { Stage } = FlowHooksOf(name);\n\ndeclare global {\n  interface ExtendFlows {\n    'handle:legacy-sse': FlowRunOptions<\n      HandleSseFlow,\n      typeof plan,\n      typeof httpInputSchema,\n      typeof httpOutputSchema,\n      typeof stateSchema\n    >;\n  }\n}\n\n@Flow({\n  name,\n  access: 'authorized',\n  inputSchema: httpInputSchema,\n  outputSchema: httpOutputSchema,\n  plan,\n})\nexport default class HandleSseFlow extends FlowBase<typeof name> {\n  @Stage('parseInput')\n  async parseInput() {\n    const { request } = this.rawInput;\n\n    const authorization = request[ServerRequestTokens.auth] as Authorization;\n    const { token } = authorization;\n\n    // CRITICAL: The mcp-session-id header is the client's reference to their session.\n    // We MUST use this exact ID for transport registry lookup.\n    //\n    // Priority 1: Use mcp-session-id header if present (client's session ID for lookup)\n    //             This is the ID the client received from initialize and is referencing.\n    // Priority 2: Use session from authorization if header matches or is absent\n    // Priority 3: Create new session (first request - no header, no authorization.session)\n    const raw = request.headers?.['mcp-session-id'];\n    const rawMcpSessionHeader = typeof raw === 'string' ? raw : undefined;\n    const mcpSessionHeader = validateMcpSessionHeader(rawMcpSessionHeader);\n\n    // If client sent a header but validation failed, return 404\n    if (raw !== undefined && !mcpSessionHeader) {\n      this.respond(httpRespond.sessionNotFound('invalid session id'));\n      return;\n    }\n\n    let session: { id: string; payload?: z.infer<typeof stateSchema>['session']['payload'] };\n\n    if (mcpSessionHeader) {\n      // Client sent session ID - ALWAYS use it for transport lookup\n      // If authorization.session exists and matches, use its payload for protocol detection\n      // If authorization.session differs or is missing, still use header ID (payload may be undefined)\n      if (authorization.session?.id === mcpSessionHeader) {\n        session = authorization.session;\n      } else {\n        session = { id: mcpSessionHeader };\n      }\n    } else if (authorization.session) {\n      // No header but authorization has session - use it (shouldn't happen in normal flow)\n      session = authorization.session;\n    } else {\n      // No session - create new one (initialize request)\n      session = createSessionId('legacy-sse', token, {\n        userAgent: request.headers?.['user-agent'] as string | undefined,\n        platformDetectionConfig: (this.scope as Scope).metadata.transport?.platformDetection,\n      });\n    }\n\n    this.state.set(stateSchema.parse({ token, session }));\n  }\n\n  @Stage('router')\n  async router() {\n    const { request } = this.rawInput;\n    const scope = this.scope as Scope;\n    const requestPath = normalizeEntryPrefix(request.path);\n    const prefix = normalizeEntryPrefix(scope.entryPath);\n    const scopePath = normalizeScopeBase(scope.routeBase);\n    const basePath = `${prefix}${scopePath}`;\n\n    if (requestPath === `${basePath}/sse`) {\n      this.state.set('requestType', 'initialize');\n    } else if (requestPath === `${basePath}/message`) {\n      this.state.set('requestType', 'message');\n    }\n  }\n\n  @Stage('onInitialize', {\n    filter: ({ state: { requestType } }) => requestType === 'initialize',\n  })\n  async onInitialize() {\n    const transportService = (this.scope as Scope).transportService;\n\n    const { request, response } = this.rawInput;\n    const { token, session } = this.state.required;\n    const transport = await transportService.createTransporter('sse', token, session.id, response);\n    await transport.initialize(request, response);\n    this.handled();\n  }\n\n  @Stage('onElicitResult', {\n    filter: ({ state: { requestType } }) => requestType === 'elicitResult',\n  })\n  async onElicitResult() {\n    // const transport = await transportService.getTransporter('sse', token, session.id);\n    // if (!transport) {\n    //   this.respond(httpRespond.rpcError('session not initialized'));\n    //   return;\n    // }\n    // await transport.handleRequest(request, response);\n    this.fail(new Error('Not implemented'));\n  }\n\n  @Stage('onMessage', {\n    filter: ({ state: { requestType } }) => requestType === 'message',\n  })\n  async onMessage() {\n    const transportService = (this.scope as Scope).transportService;\n    const logger = this.scopeLogger.child('handle:legacy-sse:onMessage');\n\n    const { request, response } = this.rawInput;\n    const { token, session } = this.state.required;\n    const transport = await transportService.getTransporter('sse', token, session.id);\n    if (!transport) {\n      // Check if session was ever created to differentiate error types per MCP Spec 2025-11-25\n      const wasCreated = transportService.wasSessionCreated('sse', token, session.id);\n      const body = request.body as Record<string, unknown> | undefined;\n\n      if (wasCreated) {\n        // Session existed but was terminated/evicted → HTTP 404 (client should re-initialize)\n        logger.info('Session expired - client should re-initialize', {\n          sessionId: session.id?.slice(0, 20),\n          tokenHash: token.slice(0, 8),\n          method: body?.['method'],\n          requestId: body?.['id'],\n        });\n        this.respond(httpRespond.sessionExpired('session expired'));\n      } else {\n        // Session was never created → HTTP 404 (per user requirement: invalid/missing session = 404)\n        logger.warn('Session not initialized - client attempted request without initializing', {\n          sessionId: session.id?.slice(0, 20),\n          tokenHash: token.slice(0, 8),\n          method: body?.['method'],\n          requestId: body?.['id'],\n          userAgent: (request.headers?.['user-agent'] as string | undefined)?.slice(0, 50),\n        });\n        this.respond(httpRespond.sessionNotFound('session not initialized'));\n      }\n      return;\n    }\n    await transport.handleRequest(request, response);\n    this.handled();\n  }\n}\n"]}

package/src/transport/flows/handle.streamable-http.flow.js

@@ -40,7 +40,15 @@ let HandleStreamableHttpFlow = class HandleStreamableHttpFlow extends common_1.F
     name = name;
     async parseInput() {
         const { request } = this.rawInput;
+        console.log('[DEBUG] parseInput: starting');
         const authorization = request[common_1.ServerRequestTokens.auth];
+        console.log('[DEBUG] parseInput: authorization =', authorization
+            ? {
+                hasToken: !!authorization.token,
+                hasSession: !!authorization.session,
+                sessionId: authorization.session?.id?.slice(0, 30),
+            }
+            : 'undefined');
         const { token } = authorization;
         // CRITICAL: The mcp-session-id header is the client's reference to their session.
         // We MUST use this exact ID for transport registry lookup.
@@ -49,7 +57,14 @@ let HandleStreamableHttpFlow = class HandleStreamableHttpFlow extends common_1.F
         //             This is the ID the client received from initialize and is referencing.
         // Priority 2: Use session from authorization if header matches or is absent
         // Priority 3: Create new session (first request - no header, no authorization.session)
-        const mcpSessionHeader = request.headers?.['mcp-session-id'];
+        const raw = request.headers?.['mcp-session-id'];
+        const rawMcpSessionHeader = typeof raw === 'string' ? raw : undefined;
+        const mcpSessionHeader = (0, common_1.validateMcpSessionHeader)(rawMcpSessionHeader);
+        // If client sent a header but validation failed, return 404
+        if (raw !== undefined && !mcpSessionHeader) {
+            this.respond(common_1.httpRespond.sessionNotFound('invalid session id'));
+            return;
+        }
         let session;
         if (mcpSessionHeader) {
             // Client sent session ID - ALWAYS use it for transport lookup
@@ -70,7 +85,7 @@ let HandleStreamableHttpFlow = class HandleStreamableHttpFlow extends common_1.F
             // No session - create new one (initialize request)
             session = (0, session_id_utils_1.createSessionId)('streamable-http', token, {
                 userAgent: request.headers?.['user-agent'],
-                platformDetectionConfig: this.scope.metadata?.session?.platformDetection,
+                platformDetectionConfig: this.scope.metadata.transport?.platformDetection,
             });
         }
         this.state.set(exports.stateSchema.parse({ token, session }));
@@ -138,10 +153,31 @@ let HandleStreamableHttpFlow = class HandleStreamableHttpFlow extends common_1.F
         const logger = this.scopeLogger.child('handle:streamable-http:onMessage');
         const { request, response } = this.rawInput;
         const { token, session } = this.state.required;
-        const transport = await transportService.getTransporter('streamable-http', token, session.id);
+        // 1. Try to get existing transport from memory
+        let transport = await transportService.getTransporter('streamable-http', token, session.id);
+        // 2. If not in memory, check if session exists in Redis and recreate
+        if (!transport) {
+            try {
+                const storedSession = await transportService.getStoredSession('streamable-http', token, session.id);
+                if (storedSession) {
+                    logger.info('Recreating transport from Redis session', {
+                        sessionId: session.id?.slice(0, 20),
+                        createdAt: storedSession.createdAt,
+                    });
+                    transport = await transportService.recreateTransporter('streamable-http', token, session.id, storedSession, response);
+                }
+            }
+            catch (error) {
+                // Log and fall through to 404 logic - transport remains undefined
+                logger.warn('Failed to recreate transport from stored session', {
+                    sessionId: session.id?.slice(0, 20),
+                    error: error instanceof Error ? error.message : String(error),
+                });
+            }
+        }
         if (!transport) {
             // Check if session was ever created to differentiate error types per MCP Spec 2025-11-25
-            const wasCreated = transportService.wasSessionCreated('streamable-http', token, session.id);
+            const wasCreated = await transportService.wasSessionCreatedAsync('streamable-http', token, session.id);
             const body = request.body;
             if (wasCreated) {
                 // Session existed but was terminated/evicted → HTTP 404 (client should re-initialize)
@@ -188,10 +224,31 @@ let HandleStreamableHttpFlow = class HandleStreamableHttpFlow extends common_1.F
     }
     async onSseListener() {
         const transportService = this.scope.transportService;
+        const logger = this.scopeLogger.child('handle:streamable-http:onSseListener');
         const { request, response } = this.rawInput;
         const { token, session } = this.state.required;
-        // Get existing transport for this session - SSE listener requires existing session
-        const transport = await transportService.getTransporter('streamable-http', token, session.id);
+        // 1. Try to get existing transport from memory
+        let transport = await transportService.getTransporter('streamable-http', token, session.id);
+        // 2. If not in memory, check if session exists in Redis and recreate
+        if (!transport) {
+            try {
+                const storedSession = await transportService.getStoredSession('streamable-http', token, session.id);
+                if (storedSession) {
+                    logger.info('Recreating transport from Redis session for SSE listener', {
+                        sessionId: session.id?.slice(0, 20),
+                        createdAt: storedSession.createdAt,
+                    });
+                    transport = await transportService.recreateTransporter('streamable-http', token, session.id, storedSession, response);
+                }
+            }
+            catch (error) {
+                // Log and fall through to 404 logic - transport remains undefined
+                logger.warn('Failed to recreate transport from stored session for SSE listener', {
+                    sessionId: session.id?.slice(0, 20),
+                    error: error instanceof Error ? error.message : String(error),
+                });
+            }
+        }
         if (!transport) {
             this.respond(common_1.httpRespond.notFound('Session not found'));
             return;