@iworkforces/tracelattice 2.0.6 → 2.0.8

package/dist/cli.js

@@ -2,6 +2,7 @@
 import * as __rspack_external_valibot from "valibot";
 import * as __rspack_external_node_crypto_2e7c4b46 from "node:crypto";
 import * as __rspack_external_node_http_e245b239 from "node:http";
+import * as __rspack_external_node_string_decoder_69b9bd04 from "node:string_decoder";
 import * as __rspack_external_node_async_hooks_4d8b1b4a from "node:async_hooks";
 import * as __rspack_external__tmcp_adapter_valibot_0faddfa6 from "@tmcp/adapter-valibot";
 import * as __rspack_external__tmcp_transport_stdio_98e5584f from "@tmcp/transport-stdio";
@@ -1326,7 +1327,7 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 },
-"E"(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+"q"(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 
 // EXPORTS
 __webpack_require__.d(__webpack_exports__, {
@@ -1779,6 +1780,8 @@ class BaseTransport {
  * instead of casting `'__global__'` ad-hoc.
  */ const GLOBAL_SESSION_ID = asSessionId('__global__');
 
+;// CONCATENATED MODULE: external "node:string_decoder"
+
 ;// CONCATENATED MODULE: ./src/transport/HttpHelpers.ts
 /**
  * Shared HTTP helper utilities for MCP transport implementations.
@@ -1788,7 +1791,11 @@ class BaseTransport {
  * HttpTransport and StreamableHttpTransport.
  *
  * @module transport/HttpHelpers
- */ /**
+ */ 
+class RequestBodyAbortedError extends Error {
+    name = 'RequestBodyAbortedError';
+}
+/**
  * Send a JSON-RPC 2.0 error response.
  *
  * Standardizes error response formatting across all transport implementations.
@@ -1856,23 +1863,118 @@ class BaseTransport {
  * @param req - The incoming HTTP request
  * @param maxBodySize - Maximum allowed body size in bytes (0 = unlimited)
  * @returns The body string, or `null` if the body exceeded the size limit
- */ async function readRequestBody(req, maxBodySize) {
-    let body = '';
-    let bodySize = 0;
-    for await (const chunk of req){
-        const chunkStr = typeof chunk === 'string' ? chunk : chunk.toString();
-        bodySize += chunkStr.length;
-        if (maxBodySize > 0 && bodySize > maxBodySize) {
-            return null;
-        }
-        body += chunkStr;
-    }
-    return body;
+ */ async function readRequestBody(req, maxBodySize, signal) {
+    return new Promise((resolve, reject)=>{
+        let body = '';
+        let bodySize = 0;
+        let settled = false;
+        const decoder = new __rspack_external_node_string_decoder_69b9bd04.StringDecoder('utf8');
+        const cleanup = ()=>{
+            req.off('data', onData);
+            req.off('end', onEnd);
+            req.off('aborted', onAborted);
+            req.off('close', onAborted);
+            req.off('error', onError);
+            signal?.removeEventListener('abort', onAborted);
+        };
+        const onData = (chunk)=>{
+            if (settled) return;
+            const chunkSize = typeof chunk === 'string' ? Buffer.byteLength(chunk) : chunk.byteLength;
+            bodySize += chunkSize;
+            if (maxBodySize > 0 && bodySize > maxBodySize) {
+                settled = true;
+                cleanup();
+                req.resume();
+                resolve(null);
+                return;
+            }
+            body += typeof chunk === 'string' ? chunk : decoder.write(chunk);
+        };
+        const onEnd = ()=>{
+            if (settled) return;
+            settled = true;
+            cleanup();
+            resolve(body + decoder.end());
+        };
+        const onAborted = ()=>{
+            if (settled) return;
+            settled = true;
+            cleanup();
+            req.resume();
+            reject(new RequestBodyAbortedError());
+        };
+        const onError = (error)=>{
+            if (settled) return;
+            settled = true;
+            cleanup();
+            reject(error);
+        };
+        req.on('data', onData);
+        req.once('end', onEnd);
+        req.once('aborted', onAborted);
+        req.once('close', onAborted);
+        req.once('error', onError);
+        signal?.addEventListener('abort', onAborted, {
+            once: true
+        });
+        if (signal?.aborted) onAborted();
+    });
 }
 
 // EXTERNAL MODULE: ./src/context/RequestContext.ts + 1 modules
 var RequestContext = __webpack_require__("i");
 ;// CONCATENATED MODULE: ./src/transport/HttpRequestLifecycle.ts
+class TrackedPreDispatchLease {
+    _onRelease;
+    _controller = new AbortController();
+    _settled = Promise.withResolvers();
+    _active = true;
+    _cancellationReason = null;
+    constructor(_onRelease){
+        this._onRelease = _onRelease;
+    }
+    get signal() {
+        return this._controller.signal;
+    }
+    get cancellationReason() {
+        return this._cancellationReason;
+    }
+    get settled() {
+        return this._settled.promise;
+    }
+    cancel(reason) {
+        if (!this._active || this._controller.signal.aborted) return;
+        this._cancellationReason = reason;
+        this._controller.abort();
+    }
+    release() {
+        if (!this._active) return;
+        this._active = false;
+        this._onRelease(this);
+        this._settled.resolve();
+    }
+}
+class PreDispatchTracker {
+    _leases = new Set();
+    _accepting = true;
+    acquire() {
+        if (!this._accepting) return null;
+        const lease = new TrackedPreDispatchLease((released)=>this._leases.delete(released));
+        this._leases.add(lease);
+        return lease;
+    }
+    closeAdmission(reason) {
+        this._accepting = false;
+        for (const lease of this._leases)lease.cancel(reason);
+    }
+    async join() {
+        while(this._leases.size > 0){
+            await Promise.all([
+                ...this._leases
+            ].map((lease)=>lease.settled));
+        }
+    }
+}
 /** Maximum number of reporting failures retained for diagnostics. */ const LIFECYCLE_REPORTING_FAILURE_CAPACITY = 32;
 class LifecycleFailureReporter {
     _onFailure;
@@ -1944,14 +2046,27 @@ class AcceptedWorkTracker {
     get size() {
         return this._work.size;
     }
-    track(work) {
+    transfer(lease, start) {
+        lease.signal.throwIfAborted();
+        const reservation = Promise.withResolvers();
+        this._work.add(reservation.promise);
+        lease.release();
+        let work;
+        try {
+            work = start();
+        } catch (error) {
+            this._work.delete(reservation.promise);
+            reservation.resolve();
+            throw error;
+        }
         const observed = work.catch((error)=>{
             this._failureReporter.report(error);
         });
-        this._work.add(observed);
         void observed.then(()=>{
-            this._work.delete(observed);
+            this._work.delete(reservation.promise);
+            reservation.resolve();
         });
+        return work;
     }
     async join() {
         while(this._work.size > 0){
@@ -1964,12 +2079,8 @@ class AcceptedWorkTracker {
 /**
  * Streamable HTTP Transport implementation (MCP spec recommended transport).
  *
- * This transport implements the MCP Streamable HTTP specification, which replaces
- * the deprecated SSE transport as the recommended HTTP-based transport since March 2025.
- *
  * Key features:
  * - POST /mcp for JSON-RPC requests (main MCP endpoint)
- * - GET /mcp for optional SSE server-to-client notifications
  * - Session management via Mcp-Session-Id header
  * - Supports both stateful (session-based) and stateless (per-request) modes
  * - Health endpoints (/health, /ready)
@@ -1993,12 +2104,25 @@ class AcceptedWorkTracker {
 
 
 
+function parseSessionRetentionOptions(options) {
+    const { maxSessions, sessionIdleTimeoutMs, sessionSweepIntervalMs } = options;
+    if (maxSessions === undefined && sessionIdleTimeoutMs === undefined && sessionSweepIntervalMs === undefined) {
+        return null;
+    }
+    if (maxSessions === undefined || !Number.isFinite(maxSessions) || !Number.isInteger(maxSessions) || maxSessions <= 0 || sessionIdleTimeoutMs === undefined || !Number.isFinite(sessionIdleTimeoutMs) || !Number.isInteger(sessionIdleTimeoutMs) || sessionIdleTimeoutMs <= 0 || sessionSweepIntervalMs === undefined || !Number.isFinite(sessionSweepIntervalMs) || !Number.isInteger(sessionSweepIntervalMs) || sessionSweepIntervalMs <= 0) {
+        throw new TypeError('maxSessions, sessionIdleTimeoutMs, and sessionSweepIntervalMs must be provided together as positive integers');
+    }
+    return {
+        maxSessions,
+        sessionIdleTimeoutMs,
+        sessionSweepIntervalMs
+    };
+}
 /**
  * Streamable HTTP Transport for MCP server.
  *
  * This transport implements the MCP Streamable HTTP specification,
- * providing JSON-RPC over HTTP with optional session management
- * and server-to-client SSE notification streams.
+ * providing JSON-RPC over HTTP with optional session management.
  *
  * @remarks
  * **Security Features (inherited from BaseTransport):**
@@ -2010,13 +2134,11 @@ class AcceptedWorkTracker {
  *
  * **MCP Streamable HTTP Spec Compliance:**
  * - POST /mcp — JSON-RPC method calls
- * - GET /mcp — SSE notification stream (server-to-client)
  * - Mcp-Session-Id header for session management
  * - Content-Type: application/json for JSON-RPC responses
- * - Content-Type: text/event-stream for SSE notification streams
  *
  * **HTTP Status Code Mapping:**
- * - 200: Success (JSON-RPC response or SSE stream)
+ * - 200: Success (JSON-RPC response)
  * - 202: Accepted (JSON-RPC notification, no response body)
  * - 204: CORS Preflight (empty body)
  * - 400: Bad Request (invalid JSON, invalid session ID)
@@ -2046,8 +2168,12 @@ class AcceptedWorkTracker {
     _metricsProvider;
     _lifecycleFailureReporter;
     _acceptedWork;
+    _preDispatch = new PreDispatchTracker();
+    _sessionRetention;
+    _sessionSweepIntervalId = null;
     _stopPromise = null;
     constructor(options = {}){
+        const sessionRetention = parseSessionRetentionOptions(options);
         super(options);
         this._path = options.path ?? '/mcp';
         this._stateful = options.stateful ?? true;
@@ -2057,12 +2183,17 @@ class AcceptedWorkTracker {
         this._requestTimeout = options.requestTimeout ?? 30000;
         this._metrics = options.metrics;
         this._metricsProvider = options.metricsProvider ?? null;
+        this._sessionRetention = sessionRetention;
         this._lifecycleFailureReporter = new LifecycleFailureReporter((error)=>{
             this.log('error', 'Streamable HTTP request lifecycle failed', {
                 error: (0,errors/* .getErrorMessage */.u1)(error)
             });
         });
         this._acceptedWork = new AcceptedWorkTracker(this._lifecycleFailureReporter);
+        if (this._stateful && sessionRetention) {
+            this._sessionSweepIntervalId = setInterval(()=>this._sweepExpiredSessions(), sessionRetention.sessionSweepIntervalMs);
+            this._sessionSweepIntervalId.unref();
+        }
     }
     _requireMcpServer() {
         if (!this._mcpServer) {
@@ -2120,15 +2251,18 @@ class AcceptedWorkTracker {
             }
         });
     }
-    /**
-	 * Route and handle incoming HTTP requests.
-	 */ async _handleRequest(req, res) {
+    _recordRequestMetrics(res) {
         const startTime = Date.now();
         this._metrics?.counter('streamable_http_requests_total', 1, {}, 'Total Streamable HTTP transport requests');
         res.once('finish', ()=>{
             const durationSeconds = (Date.now() - startTime) / 1000;
             this._metrics?.histogram('streamable_http_request_duration_seconds', durationSeconds, {});
         });
+    }
+    /**
+	 * Route and handle incoming HTTP requests.
+	 */ async _handleRequest(req, res) {
+        this._recordRequestMetrics(res);
         // Host validation
         if (!this.validateHostHeader(req)) {
             this._sendJsonRpcError(res, 403, -32000, 'Forbidden - invalid host header');
@@ -2179,16 +2313,20 @@ class AcceptedWorkTracker {
         // MCP endpoint routing
         if (urlPath === this._path) {
             if (req.method === 'POST') {
-                this._acceptedWork.track(this._handleMcpPost(req, res));
-                return;
-            }
-            if (req.method === 'GET') {
-                this._handleMcpGet(req, res);
+                const lease = this._preDispatch.acquire();
+                if (!lease) {
+                    const responseFinalizer = new ResponseFinalizer(res, this._lifecycleFailureReporter);
+                    responseFinalizer.finalize((response)=>{
+                        this._sendJsonRpcError(response, 503, -32603, 'Server is shutting down');
+                    });
+                    return;
+                }
+                await this._handleMcpPost(req, res, lease);
                 return;
             }
             res.writeHead(405, {
                 'Content-Type': 'application/json',
-                Allow: 'GET, POST'
+                Allow: 'POST'
             });
             res.end(JSON.stringify({
                 jsonrpc: '2.0',
@@ -2222,6 +2360,28 @@ class AcceptedWorkTracker {
             error
         }));
     }
+    _parseJsonRpcRequest(body, responseFinalizer) {
+        let rawBody;
+        try {
+            rawBody = JSON.parse(body);
+        } catch  {
+            responseFinalizer.finalize((response)=>{
+                this._sendJsonRpcError(response, 200, -32700, 'Parse error');
+            });
+            return null;
+        }
+        const parseResult = (0,external_valibot_.safeParse)(schema/* .JsonRpcRequestSchema */.Uv, rawBody);
+        const rawId = rawBody && typeof rawBody === 'object' && 'id' in rawBody ? rawBody.id ?? null : null;
+        if (!parseResult.success) {
+            responseFinalizer.finalize((response)=>{
+                this._sendJsonRpcError(response, 200, -32600, 'Invalid Request', rawId, {
+                    data: parseResult.issues
+                });
+            });
+            return null;
+        }
+        return parseResult.output;
+    }
     /**
 	 * Handle POST /mcp — JSON-RPC method calls.
 	 *
@@ -2230,77 +2390,96 @@ class AcceptedWorkTracker {
 	 * - Returns Mcp-Session-Id header for new sessions (stateful mode)
 	 * - Validates Mcp-Session-Id for existing sessions (stateful mode)
 	 * - Content-Type: application/json for responses
-	 */ async _handleMcpPost(req, res) {
+	 */ async _handleMcpPost(req, res, lease) {
         this._requestCount++;
         this._activeRequests++;
         const responseFinalizer = new ResponseFinalizer(res, this._lifecycleFailureReporter);
+        let acceptedSession = null;
+        const onAborted = ()=>lease.cancel('peer');
+        req.once('aborted', onAborted);
         const timeout = setTimeout(()=>{
             responseFinalizer.finalize((response)=>{
                 this._sendJsonRpcError(response, 500, -32603, 'Request timeout');
             });
+            lease.cancel('timeout');
         }, this._requestTimeout);
         try {
             // Read request body with size limit
-            const body = await readRequestBody(req, this._bodySizeLimitEnabled ? this._maxBodySize : 0);
+            const body = await readRequestBody(req, this._bodySizeLimitEnabled ? this._maxBodySize : 0, lease.signal);
             if (body === null) {
                 responseFinalizer.finalize((response)=>{
                     this._sendJsonRpcError(response, 413, -32000, 'Request body too large');
                 });
                 return;
             }
-            // Parse JSON
-            let rawBody;
-            try {
-                rawBody = JSON.parse(body);
-            } catch  {
+            const jsonRpcRequest = this._parseJsonRpcRequest(body, responseFinalizer);
+            if (jsonRpcRequest === null) return;
+            const session = this._acceptPostSession(req, responseFinalizer);
+            if (!session) return;
+            acceptedSession = session.state;
+            // Check if MCP server is ready
+            if (!this._mcpServer) {
+                const requestId = 'id' in jsonRpcRequest ? jsonRpcRequest.id ?? null : null;
                 responseFinalizer.finalize((response)=>{
-                    this._sendJsonRpcError(response, 200, -32700, 'Parse error');
+                    this._sendJsonRpcError(response, 503, -32603, 'Server not ready', requestId);
                 });
                 return;
             }
-            // Validate JSON-RPC schema
-            const parseResult = (0,external_valibot_.safeParse)(schema/* .JsonRpcRequestSchema */.Uv, rawBody);
-            const rawId = rawBody && typeof rawBody === 'object' && 'id' in rawBody ? rawBody.id ?? null : null;
-            if (!parseResult.success) {
-                responseFinalizer.finalize((response)=>{
-                    this._sendJsonRpcError(response, 200, -32600, 'Invalid Request', rawId, {
-                        data: parseResult.issues
+            req.off('aborted', onAborted);
+            const acceptedWork = this._acceptedWork.transfer(lease, ()=>this._receiveAndFinalize(jsonRpcRequest, session.id, responseFinalizer).catch((error)=>{
+                    responseFinalizer.finalize((response)=>{
+                        this._sendJsonRpcError(response, 200, -32603, 'Internal error', null, {
+                            data: (0,errors/* .getErrorMessage */.u1)(error)
+                        });
                     });
-                });
-                return;
-            }
-            const jsonRpcRequest = parseResult.output;
-            // Session management (stateful mode)
-            let sessionId;
-            if (this._stateful) {
-                const sessionResult = this._resolveSession(req);
-                if (typeof sessionResult !== 'string') {
+                }));
+            await acceptedWork;
+        } catch (error) {
+            if (lease.signal.aborted) {
+                if (lease.cancellationReason === 'shutdown') {
                     responseFinalizer.finalize((response)=>{
-                        this._sendJsonRpcError(response, sessionResult.statusCode, sessionResult.code, sessionResult.message);
+                        this._sendJsonRpcError(response, 503, -32603, 'Server is shutting down');
                     });
-                    return;
                 }
-                sessionId = sessionResult;
-            }
-            // Check if MCP server is ready
-            if (!this._mcpServer) {
-                responseFinalizer.finalize((response)=>{
-                    this._sendJsonRpcError(response, 503, -32603, 'Server not ready', jsonRpcRequest?.id ?? null);
-                });
                 return;
             }
-            await this._receiveAndFinalize(jsonRpcRequest, sessionId, responseFinalizer);
-        } catch (error) {
             responseFinalizer.finalize((response)=>{
                 this._sendJsonRpcError(response, 200, -32603, 'Internal error', null, {
                     data: (0,errors/* .getErrorMessage */.u1)(error)
                 });
             });
         } finally{
+            req.off('aborted', onAborted);
+            lease.release();
+            if (acceptedSession) acceptedSession.acceptedPostCount--;
             clearTimeout(timeout);
             this._activeRequests--;
         }
     }
+    _acceptPostSession(req, responseFinalizer) {
+        if (!this._stateful) return {
+            id: undefined,
+            state: null
+        };
+        if (this.isShuttingDown) {
+            responseFinalizer.finalize((response)=>{
+                this._sendJsonRpcError(response, 503, -32603, 'Server is shutting down');
+            });
+            return null;
+        }
+        const session = this._resolveSession(req);
+        if (!('state' in session)) {
+            responseFinalizer.finalize((response)=>{
+                this._sendJsonRpcError(response, session.statusCode, session.code, session.message);
+            });
+            return null;
+        }
+        session.state.acceptedPostCount++;
+        return {
+            id: session.id,
+            state: session.state
+        };
+    }
     async _receiveAndFinalize(jsonRpcRequest, sessionId, responseFinalizer) {
         const owner = this._stateful ? sessionId ?? (0,__rspack_external_node_crypto_2e7c4b46.randomUUID)() : (0,__rspack_external_node_crypto_2e7c4b46.randomUUID)();
         const response = await (0,RequestContext/* .runWithContext */.Vo)({
@@ -2324,82 +2503,6 @@ class AcceptedWorkTracker {
             httpResponse.end();
         });
     }
-    /**
-	 * Handle GET /mcp — Optional SSE notification stream.
-	 *
-	 * Per the MCP Streamable HTTP spec, clients may open a GET request
-	 * to receive server-initiated notifications as SSE events.
-	 * Requires a valid Mcp-Session-Id in stateful mode.
-	 */ _handleMcpGet(req, res) {
-        if (!this._stateful) {
-            // SSE notification streams require stateful mode
-            res.writeHead(405, {
-                'Content-Type': 'application/json',
-                Allow: 'POST'
-            });
-            res.end(JSON.stringify({
-                jsonrpc: '2.0',
-                id: null,
-                error: {
-                    code: -32601,
-                    message: 'GET not supported in stateless mode'
-                }
-            }));
-            return;
-        }
-        // Require Mcp-Session-Id for GET requests
-        const sessionId = this._getSessionIdFromHeader(req);
-        if (!sessionId) {
-            res.writeHead(400, {
-                'Content-Type': 'application/json'
-            });
-            res.end(JSON.stringify({
-                jsonrpc: '2.0',
-                id: null,
-                error: {
-                    code: -32600,
-                    message: 'Missing Mcp-Session-Id header'
-                }
-            }));
-            return;
-        }
-        const session = this._sessions.get(asSessionId(sessionId));
-        if (!session) {
-            res.writeHead(404, {
-                'Content-Type': 'application/json'
-            });
-            res.end(JSON.stringify({
-                jsonrpc: '2.0',
-                id: null,
-                error: {
-                    code: -32001,
-                    message: 'Session not found'
-                }
-            }));
-            return;
-        }
-        // Set SSE headers
-        res.writeHead(200, {
-            'Content-Type': 'text/event-stream',
-            'Cache-Control': 'no-cache',
-            Connection: 'keep-alive',
-            'Mcp-Session-Id': sessionId
-        });
-        // Send initial connected event
-        this._sendSseEvent(res, 'connected', {
-            sessionId,
-            timestamp: Date.now()
-        });
-        // Track this notification stream
-        session.notificationStreams.add(res);
-        session.lastActivityAt = Date.now();
-        this._updateSessionMetrics();
-        // Handle client disconnect
-        req.on('close', ()=>{
-            session.notificationStreams.delete(res);
-            this._updateSessionMetrics();
-        });
-    }
     /**
 	 * Resolve or create a session for a stateful request.
 	 *
@@ -2419,7 +2522,10 @@ class AcceptedWorkTracker {
             const session = this._sessions.get(asSessionId(headerSessionId));
             if (session) {
                 session.lastActivityAt = Date.now();
-                return headerSessionId;
+                return {
+                    id: session.id,
+                    state: session
+                };
             }
             // Unknown session ID — per spec, return 404
             return {
@@ -2429,17 +2535,48 @@ class AcceptedWorkTracker {
             };
         }
         // No session header — create new session
-        const newSessionId = this._sessionIdGenerator();
+        if (this._sessionRetention && this._sessions.size >= this._sessionRetention.maxSessions) {
+            return {
+                statusCode: 503,
+                code: -32000,
+                message: 'Session capacity reached'
+            };
+        }
+        const newSessionId = asSessionId(this._sessionIdGenerator());
+        const now = Date.now();
         const sessionState = {
             id: newSessionId,
-            createdAt: Date.now(),
-            lastActivityAt: Date.now(),
-            notificationStreams: new Set()
+            createdAt: now,
+            lastActivityAt: now,
+            acceptedPostCount: 0
         };
-        this._sessions.set(asSessionId(newSessionId), sessionState);
+        this._sessions.set(newSessionId, sessionState);
         this.log('info', `New session created: ${newSessionId}`);
         this._updateSessionMetrics();
-        return newSessionId;
+        return {
+            id: newSessionId,
+            state: sessionState
+        };
+    }
+    _sweepExpiredSessions() {
+        if (!this._sessionRetention) return;
+        const now = Date.now();
+        for (const [sessionId, session] of this._sessions){
+            if (session.acceptedPostCount === 0 && now - session.lastActivityAt >= this._sessionRetention.sessionIdleTimeoutMs) {
+                this._disposeSession(sessionId);
+            }
+        }
+    }
+    _disposeSession(sessionId) {
+        if (!this._sessions.delete(sessionId)) return;
+        this._updateSessionMetrics();
+    }
+    _stopSessionSweep() {
+        const interval = this._sessionSweepIntervalId;
+        if (!interval) return;
+        interval.unref();
+        clearInterval(interval);
+        this._sessionSweepIntervalId = null;
     }
     /**
 	 * Extract Mcp-Session-Id from request headers.
@@ -2450,31 +2587,6 @@ class AcceptedWorkTracker {
         }
         return undefined;
     }
-    /**
-	 * Send an SSE event to a specific client response stream.
-	 */ _sendSseEvent(res, event, data) {
-        try {
-            res.write(`event: ${event}\n`);
-            res.write(`data: ${JSON.stringify(data)}\n\n`);
-        } catch  {
-        // Client disconnected — ignore
-        }
-    }
-    /**
-	 * Broadcast a notification to all SSE streams in a given session.
-	 *
-	 * @param sessionId - Target session ID
-	 * @param event - SSE event name
-	 * @param data - Event payload
-	 */ broadcastToSession(sessionId, event, data) {
-        const session = this._sessions.get(asSessionId(sessionId));
-        if (!session) {
-            return;
-        }
-        for (const stream of session.notificationStreams){
-            this._sendSseEvent(stream, event, data);
-        }
-    }
     /**
 	 * Handle GET /metrics endpoint.
 	 */ _handleMetrics(res) {
@@ -2533,11 +2645,6 @@ class AcceptedWorkTracker {
 	 * Update session-related metrics.
 	 */ _updateSessionMetrics() {
         this._metrics?.gauge('streamable_http_active_sessions', this._sessions.size, {}, 'Active Streamable HTTP sessions');
-        let totalStreams = 0;
-        for (const session of this._sessions.values()){
-            totalStreams += session.notificationStreams.size;
-        }
-        this._metrics?.gauge('streamable_http_notification_streams', totalStreams, {}, 'Active SSE notification streams');
     }
     /**
 	 * Stop transport server with graceful shutdown.
@@ -2546,20 +2653,13 @@ class AcceptedWorkTracker {
 	 */ stop(timeout) {
         if (this._stopPromise) return this._stopPromise;
         this._isShuttingDown = true;
+        this._preDispatch.closeAdmission('shutdown');
         this._stopRateLimitCleanup();
+        this._stopSessionSweep();
         const shutdownTimeout = timeout ?? 30000;
-        // Close all SSE notification streams
-        for (const session of this._sessions.values()){
-            for (const stream of session.notificationStreams){
-                try {
-                    stream.end();
-                } catch  {
-                // Ignore errors
-                }
-            }
-            session.notificationStreams.clear();
+        for (const sessionId of this._sessions.keys()){
+            this._disposeSession(sessionId);
         }
-        this._sessions.clear();
         const server = this._server;
         const serverClosed = new Promise((resolve, reject)=>{
             if (!server?.listening) {
@@ -2589,7 +2689,7 @@ class AcceptedWorkTracker {
         });
         const stopPromise = Promise.all([
             serverClosed,
-            this._acceptedWork.join()
+            this._preDispatch.join().then(()=>this._acceptedWork.join())
         ]).then(()=>{
             this.log('info', 'Streamable HTTP transport stopped');
         });
@@ -3103,7 +3203,7 @@ async function main() {
 /**
  * Start Streamable HTTP transport (MCP spec recommended)
  */ async function startStreamableHttpTransport(server, thinkingServer, lifecycle) {
-    const { StreamableHttpTransport } = await Promise.resolve(/* import() */).then(__webpack_require__.bind(__webpack_require__, "E"));
+    const { StreamableHttpTransport } = await Promise.resolve(/* import() */).then(__webpack_require__.bind(__webpack_require__, "q"));
     const port = parseInt(process.env.STREAMABLE_HTTP_PORT || '9007', 10);
     const host = process.env.STREAMABLE_HTTP_HOST || 'localhost';
     const transportMetrics = thinkingServer.getContainer().resolve('Metrics');