@frontmcp/sdk 0.6.0 → 0.6.2

package/src/transport/flows/handle.sse.flow.js

@@ -1,197 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.stateSchema = exports.plan = void 0;
-const tslib_1 = require("tslib");
-const common_1 = require("../../common");
-const zod_1 = require("zod");
-const session_id_utils_1 = require("../../auth/session/utils/session-id.utils");
-exports.plan = {
-    pre: ['parseInput', 'router'],
-    execute: ['onInitialize', 'onMessage', 'onElicitResult'],
-    post: [],
-    finalize: ['cleanup'],
-};
-// Relaxed session schema for state - payload is optional when using mcp-session-id header directly
-const stateSessionSchema = zod_1.z.object({
-    id: zod_1.z.string(),
-    payload: zod_1.z
-        .object({
-        nodeId: zod_1.z.string(),
-        authSig: zod_1.z.string(),
-        uuid: zod_1.z.string().uuid(),
-        iat: zod_1.z.number(),
-        protocol: zod_1.z.enum(['legacy-sse', 'sse', 'streamable-http', 'stateful-http', 'stateless-http']).optional(),
-        isPublic: zod_1.z.boolean().optional(),
-        platformType: zod_1.z
-            .enum(['openai', 'claude', 'gemini', 'cursor', 'continue', 'cody', 'generic-mcp', 'ext-apps', 'unknown'])
-            .optional(),
-    })
-        .optional(),
-});
-exports.stateSchema = zod_1.z.object({
-    token: zod_1.z.string(),
-    session: stateSessionSchema,
-    requestType: zod_1.z.enum(['initialize', 'message', 'elicitResult']).optional(),
-});
-const name = 'handle:legacy-sse';
-const { Stage } = (0, common_1.FlowHooksOf)(name);
-let HandleSseFlow = class HandleSseFlow extends common_1.FlowBase {
-    async parseInput() {
-        const { request } = this.rawInput;
-        const authorization = request[common_1.ServerRequestTokens.auth];
-        const { token } = authorization;
-        // CRITICAL: The mcp-session-id header is the client's reference to their session.
-        // We MUST use this exact ID for transport registry lookup.
-        //
-        // Priority 1: Use mcp-session-id header if present (client's session ID for lookup)
-        //             This is the ID the client received from initialize and is referencing.
-        // Priority 2: Use session from authorization if header matches or is absent
-        // Priority 3: Create new session (first request - no header, no authorization.session)
-        const raw = request.headers?.['mcp-session-id'];
-        const rawMcpSessionHeader = typeof raw === 'string' ? raw : undefined;
-        const mcpSessionHeader = (0, common_1.validateMcpSessionHeader)(rawMcpSessionHeader);
-        // If client sent a header but validation failed, return 404
-        if (raw !== undefined && !mcpSessionHeader) {
-            this.respond(common_1.httpRespond.sessionNotFound('invalid session id'));
-            return;
-        }
-        let session;
-        if (mcpSessionHeader) {
-            // Client sent session ID - ALWAYS use it for transport lookup
-            // If authorization.session exists and matches, use its payload for protocol detection
-            // If authorization.session differs or is missing, still use header ID (payload may be undefined)
-            if (authorization.session?.id === mcpSessionHeader) {
-                session = authorization.session;
-            }
-            else {
-                session = { id: mcpSessionHeader };
-            }
-        }
-        else if (authorization.session) {
-            // No header but authorization has session - use it (shouldn't happen in normal flow)
-            session = authorization.session;
-        }
-        else {
-            // No session - create new one (initialize request)
-            session = (0, session_id_utils_1.createSessionId)('legacy-sse', token, {
-                userAgent: request.headers?.['user-agent'],
-                platformDetectionConfig: this.scope.metadata.transport?.platformDetection,
-            });
-        }
-        this.state.set(exports.stateSchema.parse({ token, session }));
-    }
-    async router() {
-        const { request } = this.rawInput;
-        const scope = this.scope;
-        const requestPath = (0, common_1.normalizeEntryPrefix)(request.path);
-        const prefix = (0, common_1.normalizeEntryPrefix)(scope.entryPath);
-        const scopePath = (0, common_1.normalizeScopeBase)(scope.routeBase);
-        const basePath = `${prefix}${scopePath}`;
-        if (requestPath === `${basePath}/sse`) {
-            this.state.set('requestType', 'initialize');
-        }
-        else if (requestPath === `${basePath}/message`) {
-            this.state.set('requestType', 'message');
-        }
-    }
-    async onInitialize() {
-        const transportService = this.scope.transportService;
-        const { request, response } = this.rawInput;
-        const { token, session } = this.state.required;
-        const transport = await transportService.createTransporter('sse', token, session.id, response);
-        await transport.initialize(request, response);
-        this.handled();
-    }
-    async onElicitResult() {
-        // const transport = await transportService.getTransporter('sse', token, session.id);
-        // if (!transport) {
-        //   this.respond(httpRespond.rpcError('session not initialized'));
-        //   return;
-        // }
-        // await transport.handleRequest(request, response);
-        this.fail(new Error('Not implemented'));
-    }
-    async onMessage() {
-        const transportService = this.scope.transportService;
-        const logger = this.scopeLogger.child('handle:legacy-sse:onMessage');
-        const { request, response } = this.rawInput;
-        const { token, session } = this.state.required;
-        const transport = await transportService.getTransporter('sse', token, session.id);
-        if (!transport) {
-            // Check if session was ever created to differentiate error types per MCP Spec 2025-11-25
-            const wasCreated = transportService.wasSessionCreated('sse', token, session.id);
-            const body = request.body;
-            if (wasCreated) {
-                // Session existed but was terminated/evicted → HTTP 404 (client should re-initialize)
-                logger.info('Session expired - client should re-initialize', {
-                    sessionId: session.id?.slice(0, 20),
-                    tokenHash: token.slice(0, 8),
-                    method: body?.['method'],
-                    requestId: body?.['id'],
-                });
-                this.respond(common_1.httpRespond.sessionExpired('session expired'));
-            }
-            else {
-                // Session was never created → HTTP 404 (per user requirement: invalid/missing session = 404)
-                logger.warn('Session not initialized - client attempted request without initializing', {
-                    sessionId: session.id?.slice(0, 20),
-                    tokenHash: token.slice(0, 8),
-                    method: body?.['method'],
-                    requestId: body?.['id'],
-                    userAgent: request.headers?.['user-agent']?.slice(0, 50),
-                });
-                this.respond(common_1.httpRespond.sessionNotFound('session not initialized'));
-            }
-            return;
-        }
-        await transport.handleRequest(request, response);
-        this.handled();
-    }
-};
-tslib_1.__decorate([
-    Stage('parseInput'),
-    tslib_1.__metadata("design:type", Function),
-    tslib_1.__metadata("design:paramtypes", []),
-    tslib_1.__metadata("design:returntype", Promise)
-], HandleSseFlow.prototype, "parseInput", null);
-tslib_1.__decorate([
-    Stage('router'),
-    tslib_1.__metadata("design:type", Function),
-    tslib_1.__metadata("design:paramtypes", []),
-    tslib_1.__metadata("design:returntype", Promise)
-], HandleSseFlow.prototype, "router", null);
-tslib_1.__decorate([
-    Stage('onInitialize', {
-        filter: ({ state: { requestType } }) => requestType === 'initialize',
-    }),
-    tslib_1.__metadata("design:type", Function),
-    tslib_1.__metadata("design:paramtypes", []),
-    tslib_1.__metadata("design:returntype", Promise)
-], HandleSseFlow.prototype, "onInitialize", null);
-tslib_1.__decorate([
-    Stage('onElicitResult', {
-        filter: ({ state: { requestType } }) => requestType === 'elicitResult',
-    }),
-    tslib_1.__metadata("design:type", Function),
-    tslib_1.__metadata("design:paramtypes", []),
-    tslib_1.__metadata("design:returntype", Promise)
-], HandleSseFlow.prototype, "onElicitResult", null);
-tslib_1.__decorate([
-    Stage('onMessage', {
-        filter: ({ state: { requestType } }) => requestType === 'message',
-    }),
-    tslib_1.__metadata("design:type", Function),
-    tslib_1.__metadata("design:paramtypes", []),
-    tslib_1.__metadata("design:returntype", Promise)
-], HandleSseFlow.prototype, "onMessage", null);
-HandleSseFlow = tslib_1.__decorate([
-    (0, common_1.Flow)({
-        name,
-        access: 'authorized',
-        inputSchema: common_1.httpInputSchema,
-        outputSchema: common_1.httpOutputSchema,
-        plan: exports.plan,
-    })
-], HandleSseFlow);
-exports.default = HandleSseFlow;
-//# sourceMappingURL=handle.sse.flow.js.map

package/src/transport/flows/handle.sse.flow.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"handle.sse.flow.js","sourceRoot":"","sources":["../../../../src/transport/flows/handle.sse.flow.ts"],"names":[],"mappings":";;;;AAAA,yCAesB;AACtB,6BAAwB;AAExB,gFAA4E;AAE/D,QAAA,IAAI,GAAG;IAClB,GAAG,EAAE,CAAC,YAAY,EAAE,QAAQ,CAAC;IAC7B,OAAO,EAAE,CAAC,cAAc,EAAE,WAAW,EAAE,gBAAgB,CAAC;IACxD,IAAI,EAAE,EAAE;IACR,QAAQ,EAAE,CAAC,SAAS,CAAC;CACc,CAAC;AAEtC,mGAAmG;AACnG,MAAM,kBAAkB,GAAG,OAAC,CAAC,MAAM,CAAC;IAClC,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE;IACd,OAAO,EAAE,OAAC;SACP,MAAM,CAAC;QACN,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE;QAClB,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE;QACnB,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;QACvB,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE;QACf,QAAQ,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,KAAK,EAAE,iBAAiB,EAAE,eAAe,EAAE,gBAAgB,CAAC,CAAC,CAAC,QAAQ,EAAE;QACxG,QAAQ,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAChC,YAAY,EAAE,OAAC;aACZ,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;aACxG,QAAQ,EAAE;KACd,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC;AAEU,QAAA,WAAW,GAAG,OAAC,CAAC,MAAM,CAAC;IAClC,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE;IACjB,OAAO,EAAE,kBAAkB;IAC3B,WAAW,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC1E,CAAC,CAAC;AAEH,MAAM,IAAI,GAAG,mBAA4B,CAAC;AAC1C,MAAM,EAAE,KAAK,EAAE,GAAG,IAAA,oBAAW,EAAC,IAAI,CAAC,CAAC;AAqBrB,IAAM,aAAa,GAAnB,MAAM,aAAc,SAAQ,iBAAqB;IAExD,AAAN,KAAK,CAAC,UAAU;QACd,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAElC,MAAM,aAAa,GAAG,OAAO,CAAC,4BAAmB,CAAC,IAAI,CAAkB,CAAC;QACzE,MAAM,EAAE,KAAK,EAAE,GAAG,aAAa,CAAC;QAEhC,kFAAkF;QAClF,2DAA2D;QAC3D,EAAE;QACF,oFAAoF;QACpF,qFAAqF;QACrF,4EAA4E;QAC5E,uFAAuF;QACvF,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,gBAAgB,CAAC,CAAC;QAChD,MAAM,mBAAmB,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QACtE,MAAM,gBAAgB,GAAG,IAAA,iCAAwB,EAAC,mBAAmB,CAAC,CAAC;QAEvE,4DAA4D;QAC5D,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3C,IAAI,CAAC,OAAO,CAAC,oBAAW,CAAC,eAAe,CAAC,oBAAoB,CAAC,CAAC,CAAC;YAChE,OAAO;QACT,CAAC;QAED,IAAI,OAAoF,CAAC;QAEzF,IAAI,gBAAgB,EAAE,CAAC;YACrB,8DAA8D;YAC9D,sFAAsF;YACtF,iGAAiG;YACjG,IAAI,aAAa,CAAC,OAAO,EAAE,EAAE,KAAK,gBAAgB,EAAE,CAAC;gBACnD,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC;YAClC,CAAC;iBAAM,CAAC;gBACN,OAAO,GAAG,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC;YACrC,CAAC;QACH,CAAC;aAAM,IAAI,aAAa,CAAC,OAAO,EAAE,CAAC;YACjC,qFAAqF;YACrF,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,mDAAmD;YACnD,OAAO,GAAG,IAAA,kCAAe,EAAC,YAAY,EAAE,KAAK,EAAE;gBAC7C,SAAS,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,YAAY,CAAuB;gBAChE,uBAAuB,EAAG,IAAI,CAAC,KAAe,CAAC,QAAQ,CAAC,SAAS,EAAE,iBAAiB;aACrF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,mBAAW,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IACxD,CAAC;IAGK,AAAN,KAAK,CAAC,MAAM;QACV,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAClC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAc,CAAC;QAClC,MAAM,WAAW,GAAG,IAAA,6BAAoB,EAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,IAAA,6BAAoB,EAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,IAAA,2BAAkB,EAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,GAAG,MAAM,GAAG,SAAS,EAAE,CAAC;QAEzC,IAAI,WAAW,KAAK,GAAG,QAAQ,MAAM,EAAE,CAAC;YACtC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;QAC9C,CAAC;aAAM,IAAI,WAAW,KAAK,GAAG,QAAQ,UAAU,EAAE,CAAC;YACjD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAKK,AAAN,KAAK,CAAC,YAAY;QAChB,MAAM,gBAAgB,GAAI,IAAI,CAAC,KAAe,CAAC,gBAAgB,CAAC;QAEhE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC5C,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC/C,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,iBAAiB,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC/F,MAAM,SAAS,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAKK,AAAN,KAAK,CAAC,cAAc;QAClB,qFAAqF;QACrF,oBAAoB;QACpB,mEAAmE;QACnE,YAAY;QACZ,IAAI;QACJ,oDAAoD;QACpD,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC1C,CAAC;IAKK,AAAN,KAAK,CAAC,SAAS;QACb,MAAM,gBAAgB,GAAI,IAAI,CAAC,KAAe,CAAC,gBAAgB,CAAC;QAChE,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAErE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC5C,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC/C,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,yFAAyF;YACzF,MAAM,UAAU,GAAG,gBAAgB,CAAC,iBAAiB,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YAChF,MAAM,IAAI,GAAG,OAAO,CAAC,IAA2C,CAAC;YAEjE,IAAI,UAAU,EAAE,CAAC;gBACf,sFAAsF;gBACtF,MAAM,CAAC,IAAI,CAAC,+CAA+C,EAAE;oBAC3D,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;oBACnC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;oBAC5B,MAAM,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC;oBACxB,SAAS,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC;iBACxB,CAAC,CAAC;gBACH,IAAI,CAAC,OAAO,CAAC,oBAAW,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAC9D,CAAC;iBAAM,CAAC;gBACN,6FAA6F;gBAC7F,MAAM,CAAC,IAAI,CAAC,yEAAyE,EAAE;oBACrF,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;oBACnC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;oBAC5B,MAAM,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC;oBACxB,SAAS,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC;oBACvB,SAAS,EAAG,OAAO,CAAC,OAAO,EAAE,CAAC,YAAY,CAAwB,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;iBACjF,CAAC,CAAC;gBACH,IAAI,CAAC,OAAO,CAAC,oBAAW,CAAC,eAAe,CAAC,yBAAyB,CAAC,CAAC,CAAC;YACvE,CAAC;YACD,OAAO;QACT,CAAC;QACD,MAAM,SAAS,CAAC,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;CACF,CAAA;AAlIO;IADL,KAAK,CAAC,YAAY,CAAC;;;;+CA+CnB;AAGK;IADL,KAAK,CAAC,QAAQ,CAAC;;;;2CAcf;AAKK;IAHL,KAAK,CAAC,cAAc,EAAE;QACrB,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,WAAW,KAAK,YAAY;KACrE,CAAC;;;;iDASD;AAKK;IAHL,KAAK,CAAC,gBAAgB,EAAE;QACvB,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,WAAW,KAAK,cAAc;KACvE,CAAC;;;;mDASD;AAKK;IAHL,KAAK,CAAC,WAAW,EAAE;QAClB,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,WAAW,KAAK,SAAS;KAClE,CAAC;;;;8CAqCD;AAnIkB,aAAa;IAPjC,IAAA,aAAI,EAAC;QACJ,IAAI;QACJ,MAAM,EAAE,YAAY;QACpB,WAAW,EAAE,wBAAe;QAC5B,YAAY,EAAE,yBAAgB;QAC9B,IAAI,EAAJ,YAAI;KACL,CAAC;GACmB,aAAa,CAoIjC;kBApIoB,aAAa","sourcesContent":["import {\n  Flow,\n  httpInputSchema,\n  FlowRunOptions,\n  httpOutputSchema,\n  FlowPlan,\n  FlowBase,\n  FlowHooksOf,\n  sessionIdSchema,\n  httpRespond,\n  ServerRequestTokens,\n  Authorization,\n  normalizeEntryPrefix,\n  normalizeScopeBase,\n  validateMcpSessionHeader,\n} from '../../common';\nimport { z } from 'zod';\nimport { Scope } from '../../scope';\nimport { createSessionId } from '../../auth/session/utils/session-id.utils';\n\nexport const plan = {\n  pre: ['parseInput', 'router'],\n  execute: ['onInitialize', 'onMessage', 'onElicitResult'],\n  post: [],\n  finalize: ['cleanup'],\n} as const satisfies FlowPlan<string>;\n\n// Relaxed session schema for state - payload is optional when using mcp-session-id header directly\nconst stateSessionSchema = z.object({\n  id: z.string(),\n  payload: z\n    .object({\n      nodeId: z.string(),\n      authSig: z.string(),\n      uuid: z.string().uuid(),\n      iat: z.number(),\n      protocol: z.enum(['legacy-sse', 'sse', 'streamable-http', 'stateful-http', 'stateless-http']).optional(),\n      isPublic: z.boolean().optional(),\n      platformType: z\n        .enum(['openai', 'claude', 'gemini', 'cursor', 'continue', 'cody', 'generic-mcp', 'ext-apps', 'unknown'])\n        .optional(),\n    })\n    .optional(),\n});\n\nexport const stateSchema = z.object({\n  token: z.string(),\n  session: stateSessionSchema,\n  requestType: z.enum(['initialize', 'message', 'elicitResult']).optional(),\n});\n\nconst name = 'handle:legacy-sse' as const;\nconst { Stage } = FlowHooksOf(name);\n\ndeclare global {\n  interface ExtendFlows {\n    'handle:legacy-sse': FlowRunOptions<\n      HandleSseFlow,\n      typeof plan,\n      typeof httpInputSchema,\n      typeof httpOutputSchema,\n      typeof stateSchema\n    >;\n  }\n}\n\n@Flow({\n  name,\n  access: 'authorized',\n  inputSchema: httpInputSchema,\n  outputSchema: httpOutputSchema,\n  plan,\n})\nexport default class HandleSseFlow extends FlowBase<typeof name> {\n  @Stage('parseInput')\n  async parseInput() {\n    const { request } = this.rawInput;\n\n    const authorization = request[ServerRequestTokens.auth] as Authorization;\n    const { token } = authorization;\n\n    // CRITICAL: The mcp-session-id header is the client's reference to their session.\n    // We MUST use this exact ID for transport registry lookup.\n    //\n    // Priority 1: Use mcp-session-id header if present (client's session ID for lookup)\n    //             This is the ID the client received from initialize and is referencing.\n    // Priority 2: Use session from authorization if header matches or is absent\n    // Priority 3: Create new session (first request - no header, no authorization.session)\n    const raw = request.headers?.['mcp-session-id'];\n    const rawMcpSessionHeader = typeof raw === 'string' ? raw : undefined;\n    const mcpSessionHeader = validateMcpSessionHeader(rawMcpSessionHeader);\n\n    // If client sent a header but validation failed, return 404\n    if (raw !== undefined && !mcpSessionHeader) {\n      this.respond(httpRespond.sessionNotFound('invalid session id'));\n      return;\n    }\n\n    let session: { id: string; payload?: z.infer<typeof stateSchema>['session']['payload'] };\n\n    if (mcpSessionHeader) {\n      // Client sent session ID - ALWAYS use it for transport lookup\n      // If authorization.session exists and matches, use its payload for protocol detection\n      // If authorization.session differs or is missing, still use header ID (payload may be undefined)\n      if (authorization.session?.id === mcpSessionHeader) {\n        session = authorization.session;\n      } else {\n        session = { id: mcpSessionHeader };\n      }\n    } else if (authorization.session) {\n      // No header but authorization has session - use it (shouldn't happen in normal flow)\n      session = authorization.session;\n    } else {\n      // No session - create new one (initialize request)\n      session = createSessionId('legacy-sse', token, {\n        userAgent: request.headers?.['user-agent'] as string | undefined,\n        platformDetectionConfig: (this.scope as Scope).metadata.transport?.platformDetection,\n      });\n    }\n\n    this.state.set(stateSchema.parse({ token, session }));\n  }\n\n  @Stage('router')\n  async router() {\n    const { request } = this.rawInput;\n    const scope = this.scope as Scope;\n    const requestPath = normalizeEntryPrefix(request.path);\n    const prefix = normalizeEntryPrefix(scope.entryPath);\n    const scopePath = normalizeScopeBase(scope.routeBase);\n    const basePath = `${prefix}${scopePath}`;\n\n    if (requestPath === `${basePath}/sse`) {\n      this.state.set('requestType', 'initialize');\n    } else if (requestPath === `${basePath}/message`) {\n      this.state.set('requestType', 'message');\n    }\n  }\n\n  @Stage('onInitialize', {\n    filter: ({ state: { requestType } }) => requestType === 'initialize',\n  })\n  async onInitialize() {\n    const transportService = (this.scope as Scope).transportService;\n\n    const { request, response } = this.rawInput;\n    const { token, session } = this.state.required;\n    const transport = await transportService.createTransporter('sse', token, session.id, response);\n    await transport.initialize(request, response);\n    this.handled();\n  }\n\n  @Stage('onElicitResult', {\n    filter: ({ state: { requestType } }) => requestType === 'elicitResult',\n  })\n  async onElicitResult() {\n    // const transport = await transportService.getTransporter('sse', token, session.id);\n    // if (!transport) {\n    //   this.respond(httpRespond.rpcError('session not initialized'));\n    //   return;\n    // }\n    // await transport.handleRequest(request, response);\n    this.fail(new Error('Not implemented'));\n  }\n\n  @Stage('onMessage', {\n    filter: ({ state: { requestType } }) => requestType === 'message',\n  })\n  async onMessage() {\n    const transportService = (this.scope as Scope).transportService;\n    const logger = this.scopeLogger.child('handle:legacy-sse:onMessage');\n\n    const { request, response } = this.rawInput;\n    const { token, session } = this.state.required;\n    const transport = await transportService.getTransporter('sse', token, session.id);\n    if (!transport) {\n      // Check if session was ever created to differentiate error types per MCP Spec 2025-11-25\n      const wasCreated = transportService.wasSessionCreated('sse', token, session.id);\n      const body = request.body as Record<string, unknown> | undefined;\n\n      if (wasCreated) {\n        // Session existed but was terminated/evicted → HTTP 404 (client should re-initialize)\n        logger.info('Session expired - client should re-initialize', {\n          sessionId: session.id?.slice(0, 20),\n          tokenHash: token.slice(0, 8),\n          method: body?.['method'],\n          requestId: body?.['id'],\n        });\n        this.respond(httpRespond.sessionExpired('session expired'));\n      } else {\n        // Session was never created → HTTP 404 (per user requirement: invalid/missing session = 404)\n        logger.warn('Session not initialized - client attempted request without initializing', {\n          sessionId: session.id?.slice(0, 20),\n          tokenHash: token.slice(0, 8),\n          method: body?.['method'],\n          requestId: body?.['id'],\n          userAgent: (request.headers?.['user-agent'] as string | undefined)?.slice(0, 50),\n        });\n        this.respond(httpRespond.sessionNotFound('session not initialized'));\n      }\n      return;\n    }\n    await transport.handleRequest(request, response);\n    this.handled();\n  }\n}\n"]}

package/src/transport/flows/handle.stateless-http.flow.js

@@ -1,102 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.stateSchema = exports.plan = void 0;
-const tslib_1 = require("tslib");
-const common_1 = require("../../common");
-const zod_1 = require("zod");
-const types_js_1 = require("@modelcontextprotocol/sdk/types.js");
-exports.plan = {
-    pre: ['parseInput', 'router'],
-    execute: ['handleRequest'],
-    post: [],
-    finalize: ['cleanup'],
-};
-exports.stateSchema = zod_1.z.object({
-    token: zod_1.z.string().optional(),
-    isAuthenticated: zod_1.z.boolean(),
-    requestType: zod_1.z.enum(['initialize', 'message']).optional(),
-});
-const name = 'handle:stateless-http';
-const { Stage } = (0, common_1.FlowHooksOf)(name);
-let HandleStatelessHttpFlow = class HandleStatelessHttpFlow extends common_1.FlowBase {
-    name = name;
-    async parseInput() {
-        const { request } = this.rawInput;
-        // Check if we have auth info
-        const auth = request[common_1.ServerRequestTokens.auth];
-        const token = auth?.token;
-        const isAuthenticated = !!token && token.length > 0;
-        this.state.set(exports.stateSchema.parse({
-            token: token || undefined,
-            isAuthenticated,
-        }));
-    }
-    async router() {
-        const { request } = this.rawInput;
-        const body = request.body;
-        const method = body?.method;
-        // Use method-based detection for routing (more permissive than strict schema)
-        // The actual schema validation happens in the MCP SDK's transport layer
-        if (method === 'initialize') {
-            this.state.set('requestType', 'initialize');
-        }
-        else if (method && types_js_1.RequestSchema.safeParse(request.body).success) {
-            this.state.set('requestType', 'message');
-        }
-        else {
-            this.respond(common_1.httpRespond.rpcError('Invalid Request'));
-        }
-    }
-    async handleRequest() {
-        const transportService = this.scope.transportService;
-        const { request, response } = this.rawInput;
-        const { token, isAuthenticated, requestType } = this.state;
-        // Get or create the stateless transport
-        // For anonymous: shared singleton transport
-        // For authenticated: singleton per token
-        const transport = isAuthenticated && token
-            ? await transportService.getOrCreateAuthenticatedStatelessTransport('stateless-http', token, response)
-            : await transportService.getOrCreateAnonymousStatelessTransport('stateless-http', response);
-        // For stateless mode, inject the well-known session ID
-        // This satisfies the MCP SDK's session header requirement while keeping requests stateless
-        if (!request.headers['mcp-session-id']) {
-            request.headers['mcp-session-id'] = '__stateless__';
-        }
-        if (requestType === 'initialize') {
-            await transport.initialize(request, response);
-        }
-        else {
-            await transport.handleRequest(request, response);
-        }
-        this.handled();
-    }
-};
-tslib_1.__decorate([
-    Stage('parseInput'),
-    tslib_1.__metadata("design:type", Function),
-    tslib_1.__metadata("design:paramtypes", []),
-    tslib_1.__metadata("design:returntype", Promise)
-], HandleStatelessHttpFlow.prototype, "parseInput", null);
-tslib_1.__decorate([
-    Stage('router'),
-    tslib_1.__metadata("design:type", Function),
-    tslib_1.__metadata("design:paramtypes", []),
-    tslib_1.__metadata("design:returntype", Promise)
-], HandleStatelessHttpFlow.prototype, "router", null);
-tslib_1.__decorate([
-    Stage('handleRequest'),
-    tslib_1.__metadata("design:type", Function),
-    tslib_1.__metadata("design:paramtypes", []),
-    tslib_1.__metadata("design:returntype", Promise)
-], HandleStatelessHttpFlow.prototype, "handleRequest", null);
-HandleStatelessHttpFlow = tslib_1.__decorate([
-    (0, common_1.Flow)({
-        name,
-        plan: exports.plan,
-        access: 'public', // Can be accessed without full auth
-        inputSchema: common_1.httpInputSchema,
-        outputSchema: common_1.httpOutputSchema,
-    })
-], HandleStatelessHttpFlow);
-exports.default = HandleStatelessHttpFlow;
-//# sourceMappingURL=handle.stateless-http.flow.js.map

package/src/transport/flows/handle.stateless-http.flow.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"handle.stateless-http.flow.js","sourceRoot":"","sources":["../../../../src/transport/flows/handle.stateless-http.flow.ts"],"names":[],"mappings":";;;;AAAA,yCAWsB;AACtB,6BAAwB;AACxB,iEAAmE;AAGtD,QAAA,IAAI,GAAG;IAClB,GAAG,EAAE,CAAC,YAAY,EAAE,QAAQ,CAAC;IAC7B,OAAO,EAAE,CAAC,eAAe,CAAC;IAC1B,IAAI,EAAE,EAAE;IACR,QAAQ,EAAE,CAAC,SAAS,CAAC;CACc,CAAC;AAEzB,QAAA,WAAW,GAAG,OAAC,CAAC,MAAM,CAAC;IAClC,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,eAAe,EAAE,OAAC,CAAC,OAAO,EAAE;IAC5B,WAAW,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC1D,CAAC,CAAC;AAEH,MAAM,IAAI,GAAG,uBAAgC,CAAC;AAC9C,MAAM,EAAE,KAAK,EAAE,GAAG,IAAA,oBAAW,EAAC,IAAI,CAAC,CAAC;AAqBrB,IAAM,uBAAuB,GAA7B,MAAM,uBAAwB,SAAQ,iBAAqB;IACxE,IAAI,GAAG,IAAI,CAAC;IAGN,AAAN,KAAK,CAAC,UAAU;QACd,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAElC,6BAA6B;QAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,4BAAmB,CAAC,IAAI,CAA8B,CAAC;QAC5E,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,CAAC;QAC1B,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QAEpD,IAAI,CAAC,KAAK,CAAC,GAAG,CACZ,mBAAW,CAAC,KAAK,CAAC;YAChB,KAAK,EAAE,KAAK,IAAI,SAAS;YACzB,eAAe;SAChB,CAAC,CACH,CAAC;IACJ,CAAC;IAGK,AAAN,KAAK,CAAC,MAAM;QACV,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAClC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAuC,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,CAAC;QAE5B,8EAA8E;QAC9E,wEAAwE;QACxE,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;QAC9C,CAAC;aAAM,IAAI,MAAM,IAAI,wBAAa,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YACnE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;QAC3C,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,OAAO,CAAC,oBAAW,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAGK,AAAN,KAAK,CAAC,aAAa;QACjB,MAAM,gBAAgB,GAAI,IAAI,CAAC,KAAe,CAAC,gBAAgB,CAAC;QAChE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC5C,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QAE3D,wCAAwC;QACxC,4CAA4C;QAC5C,yCAAyC;QACzC,MAAM,SAAS,GACb,eAAe,IAAI,KAAK;YACtB,CAAC,CAAC,MAAM,gBAAgB,CAAC,0CAA0C,CAAC,gBAAgB,EAAE,KAAK,EAAE,QAAQ,CAAC;YACtG,CAAC,CAAC,MAAM,gBAAgB,CAAC,sCAAsC,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QAEhG,uDAAuD;QACvD,2FAA2F;QAC3F,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACvC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,eAAe,CAAC;QACtD,CAAC;QAED,IAAI,WAAW,KAAK,YAAY,EAAE,CAAC;YACjC,MAAM,SAAS,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAChD,CAAC;aAAM,CAAC;YACN,MAAM,SAAS,CAAC,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACnD,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;CACF,CAAA;AA7DO;IADL,KAAK,CAAC,YAAY,CAAC;;;;yDAenB;AAGK;IADL,KAAK,CAAC,QAAQ,CAAC;;;;qDAef;AAGK;IADL,KAAK,CAAC,eAAe,CAAC;;;;4DA2BtB;AAhEkB,uBAAuB;IAP3C,IAAA,aAAI,EAAC;QACJ,IAAI;QACJ,IAAI,EAAJ,YAAI;QACJ,MAAM,EAAE,QAAQ,EAAE,oCAAoC;QACtD,WAAW,EAAE,wBAAe;QAC5B,YAAY,EAAE,yBAAgB;KAC/B,CAAC;GACmB,uBAAuB,CAiE3C;kBAjEoB,uBAAuB","sourcesContent":["import {\n  Flow,\n  httpInputSchema,\n  FlowRunOptions,\n  httpOutputSchema,\n  FlowPlan,\n  FlowBase,\n  FlowHooksOf,\n  httpRespond,\n  ServerRequestTokens,\n  Authorization,\n} from '../../common';\nimport { z } from 'zod';\nimport { RequestSchema } from '@modelcontextprotocol/sdk/types.js';\nimport { Scope } from '../../scope';\n\nexport const plan = {\n  pre: ['parseInput', 'router'],\n  execute: ['handleRequest'],\n  post: [],\n  finalize: ['cleanup'],\n} as const satisfies FlowPlan<string>;\n\nexport const stateSchema = z.object({\n  token: z.string().optional(),\n  isAuthenticated: z.boolean(),\n  requestType: z.enum(['initialize', 'message']).optional(),\n});\n\nconst name = 'handle:stateless-http' as const;\nconst { Stage } = FlowHooksOf(name);\n\ndeclare global {\n  interface ExtendFlows {\n    'handle:stateless-http': FlowRunOptions<\n      HandleStatelessHttpFlow,\n      typeof plan,\n      typeof httpInputSchema,\n      typeof httpOutputSchema,\n      typeof stateSchema\n    >;\n  }\n}\n\n@Flow({\n  name,\n  plan,\n  access: 'public', // Can be accessed without full auth\n  inputSchema: httpInputSchema,\n  outputSchema: httpOutputSchema,\n})\nexport default class HandleStatelessHttpFlow extends FlowBase<typeof name> {\n  name = name;\n\n  @Stage('parseInput')\n  async parseInput() {\n    const { request } = this.rawInput;\n\n    // Check if we have auth info\n    const auth = request[ServerRequestTokens.auth] as Authorization | undefined;\n    const token = auth?.token;\n    const isAuthenticated = !!token && token.length > 0;\n\n    this.state.set(\n      stateSchema.parse({\n        token: token || undefined,\n        isAuthenticated,\n      }),\n    );\n  }\n\n  @Stage('router')\n  async router() {\n    const { request } = this.rawInput;\n    const body = request.body as { method?: string } | undefined;\n    const method = body?.method;\n\n    // Use method-based detection for routing (more permissive than strict schema)\n    // The actual schema validation happens in the MCP SDK's transport layer\n    if (method === 'initialize') {\n      this.state.set('requestType', 'initialize');\n    } else if (method && RequestSchema.safeParse(request.body).success) {\n      this.state.set('requestType', 'message');\n    } else {\n      this.respond(httpRespond.rpcError('Invalid Request'));\n    }\n  }\n\n  @Stage('handleRequest')\n  async handleRequest() {\n    const transportService = (this.scope as Scope).transportService;\n    const { request, response } = this.rawInput;\n    const { token, isAuthenticated, requestType } = this.state;\n\n    // Get or create the stateless transport\n    // For anonymous: shared singleton transport\n    // For authenticated: singleton per token\n    const transport =\n      isAuthenticated && token\n        ? await transportService.getOrCreateAuthenticatedStatelessTransport('stateless-http', token, response)\n        : await transportService.getOrCreateAnonymousStatelessTransport('stateless-http', response);\n\n    // For stateless mode, inject the well-known session ID\n    // This satisfies the MCP SDK's session header requirement while keeping requests stateless\n    if (!request.headers['mcp-session-id']) {\n      request.headers['mcp-session-id'] = '__stateless__';\n    }\n\n    if (requestType === 'initialize') {\n      await transport.initialize(request, response);\n    } else {\n      await transport.handleRequest(request, response);\n    }\n\n    this.handled();\n  }\n}\n"]}

package/src/transport/flows/handle.streamable-http.flow.js

@@ -1,315 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.stateSchema = exports.plan = void 0;
-const tslib_1 = require("tslib");
-const common_1 = require("../../common");
-const zod_1 = require("zod");
-const types_js_1 = require("@modelcontextprotocol/sdk/types.js");
-const session_id_utils_1 = require("../../auth/session/utils/session-id.utils");
-exports.plan = {
-    pre: ['parseInput', 'router'],
-    execute: ['onInitialize', 'onMessage', 'onElicitResult', 'onSseListener'],
-    post: [],
-    finalize: ['cleanup'],
-};
-// Relaxed session schema for state - payload is optional when using mcp-session-id header directly
-const stateSessionSchema = zod_1.z.object({
-    id: zod_1.z.string(),
-    payload: zod_1.z
-        .object({
-        nodeId: zod_1.z.string(),
-        authSig: zod_1.z.string(),
-        uuid: zod_1.z.string().uuid(),
-        iat: zod_1.z.number(),
-        protocol: zod_1.z.enum(['legacy-sse', 'sse', 'streamable-http', 'stateful-http', 'stateless-http']).optional(),
-        isPublic: zod_1.z.boolean().optional(),
-        platformType: zod_1.z
-            .enum(['openai', 'claude', 'gemini', 'cursor', 'continue', 'cody', 'generic-mcp', 'ext-apps', 'unknown'])
-            .optional(),
-    })
-        .optional(),
-});
-exports.stateSchema = zod_1.z.object({
-    token: zod_1.z.string(),
-    session: stateSessionSchema,
-    requestType: zod_1.z.enum(['initialize', 'message', 'elicitResult', 'sseListener']).optional(),
-});
-const name = 'handle:streamable-http';
-const { Stage } = (0, common_1.FlowHooksOf)(name);
-let HandleStreamableHttpFlow = class HandleStreamableHttpFlow extends common_1.FlowBase {
-    name = name;
-    async parseInput() {
-        const { request } = this.rawInput;
-        console.log('[DEBUG] parseInput: starting');
-        const authorization = request[common_1.ServerRequestTokens.auth];
-        console.log('[DEBUG] parseInput: authorization =', authorization
-            ? {
-                hasToken: !!authorization.token,
-                hasSession: !!authorization.session,
-                sessionId: authorization.session?.id?.slice(0, 30),
-            }
-            : 'undefined');
-        const { token } = authorization;
-        // CRITICAL: The mcp-session-id header is the client's reference to their session.
-        // We MUST use this exact ID for transport registry lookup.
-        //
-        // Priority 1: Use mcp-session-id header if present (client's session ID for lookup)
-        //             This is the ID the client received from initialize and is referencing.
-        // Priority 2: Use session from authorization if header matches or is absent
-        // Priority 3: Create new session (first request - no header, no authorization.session)
-        const raw = request.headers?.['mcp-session-id'];
-        const rawMcpSessionHeader = typeof raw === 'string' ? raw : undefined;
-        const mcpSessionHeader = (0, common_1.validateMcpSessionHeader)(rawMcpSessionHeader);
-        // If client sent a header but validation failed, return 404
-        if (raw !== undefined && !mcpSessionHeader) {
-            this.respond(common_1.httpRespond.sessionNotFound('invalid session id'));
-            return;
-        }
-        let session;
-        if (mcpSessionHeader) {
-            // Client sent session ID - ALWAYS use it for transport lookup
-            // If authorization.session exists and matches, use its payload for protocol detection
-            // If authorization.session differs or is missing, still use header ID (payload may be undefined)
-            if (authorization.session?.id === mcpSessionHeader) {
-                session = authorization.session;
-            }
-            else {
-                session = { id: mcpSessionHeader };
-            }
-        }
-        else if (authorization.session) {
-            // No header but authorization has session - use it (shouldn't happen in normal flow)
-            session = authorization.session;
-        }
-        else {
-            // No session - create new one (initialize request)
-            session = (0, session_id_utils_1.createSessionId)('streamable-http', token, {
-                userAgent: request.headers?.['user-agent'],
-                platformDetectionConfig: this.scope.metadata.transport?.platformDetection,
-            });
-        }
-        this.state.set(exports.stateSchema.parse({ token, session }));
-    }
-    async router() {
-        const { request } = this.rawInput;
-        // GET requests are SSE listener streams - no body expected
-        // Per MCP spec, clients can open SSE stream with GET + Accept: text/event-stream
-        if (request.method.toUpperCase() === 'GET') {
-            this.state.set('requestType', 'sseListener');
-            return;
-        }
-        // POST requests have MCP JSON-RPC body
-        const body = request.body;
-        const method = body?.method;
-        // Use method-based detection for routing (more permissive than strict schema)
-        // The actual schema validation happens in the MCP SDK's transport layer
-        if (method === 'initialize') {
-            this.state.set('requestType', 'initialize');
-        }
-        else if (types_js_1.ElicitResultSchema.safeParse(request.body).success) {
-            this.state.set('requestType', 'elicitResult');
-        }
-        else if (method && types_js_1.RequestSchema.safeParse(request.body).success) {
-            this.state.set('requestType', 'message');
-        }
-        else {
-            this.respond(common_1.httpRespond.rpcError('Invalid Request'));
-        }
-    }
-    async onInitialize() {
-        const transportService = this.scope.transportService;
-        const logger = this.scope.logger.child('handle:streamable-http:onInitialize');
-        const { request, response } = this.rawInput;
-        const { token, session } = this.state.required;
-        logger.info('onInitialize: creating transport', {
-            sessionId: session.id.slice(0, 30),
-            hasToken: !!token,
-            tokenPrefix: token?.slice(0, 10),
-        });
-        try {
-            const transport = await transportService.createTransporter('streamable-http', token, session.id, response);
-            logger.info('onInitialize: transport created, calling initialize');
-            await transport.initialize(request, response);
-            logger.info('onInitialize: completed successfully');
-            this.handled();
-        }
-        catch (error) {
-            // FlowControl is expected control flow (from this.handled()), not an error
-            if (error instanceof common_1.FlowControl) {
-                throw error;
-            }
-            logger.error('onInitialize: failed', {
-                error: error instanceof Error ? error.message : String(error),
-                stack: error instanceof Error ? error.stack : undefined,
-            });
-            throw error;
-        }
-    }
-    async onElicitResult() {
-        this.fail(new Error('Not implemented'));
-    }
-    async onMessage() {
-        const transportService = this.scope.transportService;
-        const logger = this.scopeLogger.child('handle:streamable-http:onMessage');
-        const { request, response } = this.rawInput;
-        const { token, session } = this.state.required;
-        // 1. Try to get existing transport from memory
-        let transport = await transportService.getTransporter('streamable-http', token, session.id);
-        // 2. If not in memory, check if session exists in Redis and recreate
-        if (!transport) {
-            try {
-                const storedSession = await transportService.getStoredSession('streamable-http', token, session.id);
-                if (storedSession) {
-                    logger.info('Recreating transport from Redis session', {
-                        sessionId: session.id?.slice(0, 20),
-                        createdAt: storedSession.createdAt,
-                    });
-                    transport = await transportService.recreateTransporter('streamable-http', token, session.id, storedSession, response);
-                }
-            }
-            catch (error) {
-                // Log and fall through to 404 logic - transport remains undefined
-                logger.warn('Failed to recreate transport from stored session', {
-                    sessionId: session.id?.slice(0, 20),
-                    error: error instanceof Error ? error.message : String(error),
-                });
-            }
-        }
-        if (!transport) {
-            // Check if session was ever created to differentiate error types per MCP Spec 2025-11-25
-            const wasCreated = await transportService.wasSessionCreatedAsync('streamable-http', token, session.id);
-            const body = request.body;
-            if (wasCreated) {
-                // Session existed but was terminated/evicted → HTTP 404 (client should re-initialize)
-                logger.info('Session expired - client should re-initialize', {
-                    sessionId: session.id?.slice(0, 20),
-                    tokenHash: token.slice(0, 8),
-                    method: body?.['method'],
-                    requestId: body?.['id'],
-                    mcpSessionId: request.headers?.['mcp-session-id'],
-                });
-                this.respond(common_1.httpRespond.sessionExpired('session expired'));
-            }
-            else {
-                // Session was never created → HTTP 404 (per user requirement: invalid/missing session = 404)
-                logger.warn('Session not initialized - client attempted request without initializing', {
-                    sessionId: session.id?.slice(0, 20),
-                    tokenHash: token.slice(0, 8),
-                    method: body?.['method'],
-                    requestId: body?.['id'],
-                    mcpSessionId: request.headers?.['mcp-session-id'],
-                    userAgent: request.headers?.['user-agent']?.slice(0, 50),
-                });
-                this.respond(common_1.httpRespond.sessionNotFound('session not initialized'));
-            }
-            return;
-        }
-        try {
-            await transport.handleRequest(request, response);
-            this.handled();
-        }
-        catch (error) {
-            // FlowControl is expected control flow, not an error
-            if (!(error instanceof common_1.FlowControl)) {
-                const body = request.body;
-                logger.error('handleRequest failed', {
-                    error: error instanceof Error ? { name: error.name, message: error.message, stack: error.stack } : error,
-                    method: body?.['method'],
-                    id: body?.['id'],
-                    sessionId: session.id?.slice(0, 20),
-                });
-            }
-            throw error;
-        }
-    }
-    async onSseListener() {
-        const transportService = this.scope.transportService;
-        const logger = this.scopeLogger.child('handle:streamable-http:onSseListener');
-        const { request, response } = this.rawInput;
-        const { token, session } = this.state.required;
-        // 1. Try to get existing transport from memory
-        let transport = await transportService.getTransporter('streamable-http', token, session.id);
-        // 2. If not in memory, check if session exists in Redis and recreate
-        if (!transport) {
-            try {
-                const storedSession = await transportService.getStoredSession('streamable-http', token, session.id);
-                if (storedSession) {
-                    logger.info('Recreating transport from Redis session for SSE listener', {
-                        sessionId: session.id?.slice(0, 20),
-                        createdAt: storedSession.createdAt,
-                    });
-                    transport = await transportService.recreateTransporter('streamable-http', token, session.id, storedSession, response);
-                }
-            }
-            catch (error) {
-                // Log and fall through to 404 logic - transport remains undefined
-                logger.warn('Failed to recreate transport from stored session for SSE listener', {
-                    sessionId: session.id?.slice(0, 20),
-                    error: error instanceof Error ? error.message : String(error),
-                });
-            }
-        }
-        if (!transport) {
-            this.respond(common_1.httpRespond.notFound('Session not found'));
-            return;
-        }
-        // Forward GET request to transport (opens SSE stream for server→client notifications)
-        await transport.handleRequest(request, response);
-        this.handled();
-    }
-};
-tslib_1.__decorate([
-    Stage('parseInput'),
-    tslib_1.__metadata("design:type", Function),
-    tslib_1.__metadata("design:paramtypes", []),
-    tslib_1.__metadata("design:returntype", Promise)
-], HandleStreamableHttpFlow.prototype, "parseInput", null);
-tslib_1.__decorate([
-    Stage('router'),
-    tslib_1.__metadata("design:type", Function),
-    tslib_1.__metadata("design:paramtypes", []),
-    tslib_1.__metadata("design:returntype", Promise)
-], HandleStreamableHttpFlow.prototype, "router", null);
-tslib_1.__decorate([
-    Stage('onInitialize', {
-        filter: ({ state: { requestType } }) => requestType === 'initialize',
-    }),
-    tslib_1.__metadata("design:type", Function),
-    tslib_1.__metadata("design:paramtypes", []),
-    tslib_1.__metadata("design:returntype", Promise)
-], HandleStreamableHttpFlow.prototype, "onInitialize", null);
-tslib_1.__decorate([
-    Stage('onElicitResult', {
-        filter: ({ state: { requestType } }) => requestType === 'elicitResult',
-    }),
-    tslib_1.__metadata("design:type", Function),
-    tslib_1.__metadata("design:paramtypes", []),
-    tslib_1.__metadata("design:returntype", Promise)
-], HandleStreamableHttpFlow.prototype, "onElicitResult", null);
-tslib_1.__decorate([
-    Stage('onMessage', {
-        filter: ({ state: { requestType } }) => requestType === 'message',
-    }),
-    tslib_1.__metadata("design:type", Function),
-    tslib_1.__metadata("design:paramtypes", []),
-    tslib_1.__metadata("design:returntype", Promise)
-], HandleStreamableHttpFlow.prototype, "onMessage", null);
-tslib_1.__decorate([
-    Stage('onSseListener', {
-        filter: ({ state: { requestType } }) => requestType === 'sseListener',
-    }),
-    tslib_1.__metadata("design:type", Function),
-    tslib_1.__metadata("design:paramtypes", []),
-    tslib_1.__metadata("design:returntype", Promise)
-], HandleStreamableHttpFlow.prototype, "onSseListener", null);
-HandleStreamableHttpFlow = tslib_1.__decorate([
-    (0, common_1.Flow)({
-        name,
-        plan: exports.plan,
-        access: 'authorized',
-        inputSchema: common_1.httpInputSchema,
-        outputSchema: common_1.httpOutputSchema,
-    })
-], HandleStreamableHttpFlow);
-exports.default = HandleStreamableHttpFlow;
-//# sourceMappingURL=handle.streamable-http.flow.js.map