@iworkforces/tracelattice 2.0.7 → 2.1.1

package/dist/cli.js

@@ -2,6 +2,7 @@
 import * as __rspack_external_valibot from "valibot";
 import * as __rspack_external_node_crypto_2e7c4b46 from "node:crypto";
 import * as __rspack_external_node_http_e245b239 from "node:http";
+import * as __rspack_external_node_string_decoder_69b9bd04 from "node:string_decoder";
 import * as __rspack_external_node_async_hooks_4d8b1b4a from "node:async_hooks";
 import * as __rspack_external__tmcp_adapter_valibot_0faddfa6 from "@tmcp/adapter-valibot";
 import * as __rspack_external__tmcp_transport_stdio_98e5584f from "@tmcp/transport-stdio";
@@ -132,13 +133,9 @@ __webpack_require__.d(__webpack_exports__, {
     PERSISTENCE_DRAIN: 'PERSISTENCE_DRAIN',
     PERSISTENCE_SESSION_ADMISSION_CLOSED: 'PERSISTENCE_SESSION_ADMISSION_CLOSED',
     PERSISTENCE_SESSION_BARRIER_REENTRANCY: 'PERSISTENCE_SESSION_BARRIER_REENTRANCY',
-    ASYNC_RESET_REQUIRED: 'ASYNC_RESET_REQUIRED',
-    PERSISTENCE_CAPABILITY_UNSUPPORTED: 'PERSISTENCE_CAPABILITY_UNSUPPORTED',
     PERSISTENCE_SCOPE_MISMATCH: 'PERSISTENCE_SCOPE_MISMATCH',
     PERSISTENCE_UNAVAILABLE: 'PERSISTENCE_UNAVAILABLE',
-    PERSISTENCE_COMPATIBILITY: 'PERSISTENCE_COMPATIBILITY',
-    PERSISTENCE_IMPORT_REQUIRED: 'PERSISTENCE_IMPORT_REQUIRED',
-    PERSISTENCE_LEGACY_AMBIGUITY: 'PERSISTENCE_LEGACY_AMBIGUITY'
+    PERSISTENCE_COMPATIBILITY: 'PERSISTENCE_COMPATIBILITY'
 };
 /**
  * All known warning codes as a const object.
@@ -209,7 +206,7 @@ class ConfigurationError extends SequentialThinkingError {
  *
  * @example
  * ```typescript
- * const tool = registry.getTool('non-existent-tool');
+ * const tool = registry.get('non-existent-tool');
  * if (!tool) {
  *   throw new ToolNotFoundError('non-existent-tool');
  * }
@@ -244,7 +241,7 @@ class ConfigurationError extends SequentialThinkingError {
  *
  * @example
  * ```typescript
- * const skill = registry.getSkill('non-existent-skill');
+ * const skill = registry.get('non-existent-skill');
  * if (!skill) {
  *   throw new SkillNotFoundError('non-existent-skill');
  * }
@@ -380,7 +377,7 @@ class ConfigurationError extends SequentialThinkingError {
  *
  * @example
  * ```typescript
- * if (registry.hasSkill(skill.name)) {
+ * if (registry.has(skill.name)) {
  *   throw new DuplicateSkillError(skill.name);
  * }
  * ```
@@ -438,7 +435,7 @@ class ConfigurationError extends SequentialThinkingError {
  *
  * @example
  * ```typescript
- * if (registry.hasTool(tool.name)) {
+ * if (registry.has(tool.name)) {
  *   throw new DuplicateToolError(tool.name);
  * }
  * ```
@@ -752,28 +749,6 @@ class PersistenceClosedError extends SequentialThinkingError {
         this.cause = cause;
     }
 }
-/** Error raised when legacy files require an explicit one-way import. */ class PersistenceImportRequiredError extends SequentialThinkingError {
-    sourcePath;
-    legacyArtifacts;
-    constructor(sourcePath, legacyArtifacts){
-        super(`Legacy persistence at '${sourcePath}' requires explicit import`, ERROR_CODES.PERSISTENCE_IMPORT_REQUIRED);
-        this.name = 'PersistenceImportRequiredError';
-        this.sourcePath = sourcePath;
-        this.legacyArtifacts = [
-            ...legacyArtifacts
-        ];
-    }
-}
-/** Error raised when legacy bytes do not identify one durable namespace. */ class PersistenceLegacyAmbiguityError extends SequentialThinkingError {
-    sourcePath;
-    detail;
-    constructor(sourcePath, detail){
-        super(`Legacy persistence at '${sourcePath}' is ambiguous: ${detail}`, ERROR_CODES.PERSISTENCE_LEGACY_AMBIGUITY);
-        this.name = 'PersistenceLegacyAmbiguityError';
-        this.sourcePath = sourcePath;
-        this.detail = detail;
-    }
-}
 /**
  * Type guard to check if an error has a specific error code.
  */ function isErrorCode(err, code) {
@@ -920,8 +895,8 @@ Reasoning Enhancement Parameters:
 - merge_branch_ids: Branch IDs merged into current context
 - meta_observation: Observation about reasoning process (with thought_type 'meta')
 - reasoning_depth: How deep to reason: 'shallow' (quick), 'moderate' (default), 'deep' (thorough)
-- session_id: (Optional) Unique identifier to scope thought history, branches, and statistics to an isolated session. When provided, all state is scoped to this session ID. When omitted, uses shared global state (backward compatible). Format: alphanumeric, hyphens, underscores, 1-100 chars.
-- reset_state: (Optional) When true, clears all state for the target session (or global state if no session_id) before processing the current thought. Use this to start a fresh reasoning chain without accumulated state from previous chains.
+- session_id: Required unique identifier that scopes thought history, branches, and statistics to an explicit session. Format: alphanumeric, hyphens, underscores, 1-100 chars; the retired value __global__ is rejected.
+- reset_state: (Optional) When true, clears all state for the required session_id before processing the current thought. Use this to start a fresh reasoning chain without accumulated state from previous chains.
 
 Response Enrichment:
 - When reasoning fields are set, response includes confidence_signals (depth, revision/branch count, type distribution, avg confidence, structural_quality, quality_components) and reasoning_stats (hypothesis tracking)
@@ -1170,6 +1145,7 @@ You should:
  *   thought: 'I need to analyze the problem',
  *   thought_number: 1,
  *   total_thoughts: 5,
+ *   session_id: 'analysis-task',
  *   next_thought_needed: true,
  *   available_mcp_tools: ['Read', 'Write', 'Grep']
  * });
@@ -1226,7 +1202,7 @@ You should:
         'moderate',
         'deep'
     ]), valibot__rspack_import_0.description('Effort signal: how deep reasoning should go'))),
-    session_id: valibot__rspack_import_0.optional(valibot__rspack_import_0.pipe(valibot__rspack_import_0.string(), valibot__rspack_import_0.regex(/^[a-zA-Z0-9_-]+$/, 'Session ID must contain only letters, numbers, hyphens, and underscores'), valibot__rspack_import_0.minLength(1), valibot__rspack_import_0.maxLength(100), valibot__rspack_import_0.description('Optional session identifier for state isolation. When provided, thought history, branches, and statistics are scoped to this session. Omitting preserves global behavior.'))),
+    session_id: valibot__rspack_import_0.pipe(valibot__rspack_import_0.string(), valibot__rspack_import_0.regex(/^[a-zA-Z0-9_-]+$/, 'Session ID must contain only letters, numbers, hyphens, and underscores'), valibot__rspack_import_0.minLength(1), valibot__rspack_import_0.maxLength(100), valibot__rspack_import_0.notValue('__global__', "Session ID '__global__' is retired; use an explicit named session"), valibot__rspack_import_0.description('Required session identifier for state isolation. Thought history, branches, and statistics are scoped to this explicit named session.')),
     reset_state: valibot__rspack_import_0.optional(valibot__rspack_import_0.pipe(valibot__rspack_import_0.boolean(), valibot__rspack_import_0.description('When true, clears all state for the target session before processing this thought. The thought is then processed as the first in a fresh session.'))),
     tool_name: valibot__rspack_import_0.optional(valibot__rspack_import_0.pipe(valibot__rspack_import_0.string(), valibot__rspack_import_0.minLength(1), valibot__rspack_import_0.description('Name of the tool being invoked (for tool_call thoughts)'))),
     tool_arguments: valibot__rspack_import_0.optional(valibot__rspack_import_0.pipe(valibot__rspack_import_0.record(valibot__rspack_import_0.string(), valibot__rspack_import_0.unknown()), valibot__rspack_import_0.description('Arguments passed to the tool (for tool_call thoughts)'))),
@@ -1326,7 +1302,7 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 },
-"E"(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+"q"(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 
 // EXPORTS
 __webpack_require__.d(__webpack_exports__, {
@@ -1390,7 +1366,6 @@ var schema = __webpack_require__("R");
  * @remarks
  * **Security Features:**
  * - Session ID validation (alphanumeric, max 64 chars)
- * - Query parameter sanitization (whitelist allowed keys)
  * - Rate limiting per IP (configurable, default 100 req/min)
  * - CORS origin validation
  *
@@ -1414,14 +1389,6 @@ var schema = __webpack_require__("R");
         return this._level;
     }
 }
-/**
- * Allowed query parameter names (whitelist for security).
- */ const ALLOWED_QUERY_PARAMS = new Set([
-    'session',
-    'sessionId',
-    'client',
-    'clientId'
-]);
 /**
  * Rate limit settings (requests per minute per IP).
  */ const RATE_LIMIT_REQUESTS = 100;
@@ -1473,20 +1440,6 @@ class BaseTransport {
         }
         return SESSION_ID_PATTERN.test(sessionId);
     }
-    /**
-	 * Sanitize query parameters by removing any not in whitelist.
-	 *
-	 * @param url - The URL object containing query parameters
-	 * @returns A sanitized record of allowed query parameters
-	 */ sanitizeQueryParams(url) {
-        const sanitized = {};
-        for (const [key, value] of url.searchParams.entries()){
-            if (ALLOWED_QUERY_PARAMS.has(key)) {
-                sanitized[key] = value;
-            }
-        }
-        return sanitized;
-    }
     /**
 	 * Check rate limit for a given IP address.
 	 *
@@ -1725,13 +1678,12 @@ class BaseTransport {
  * Validate and brand a string as a {@link SessionId}.
  *
  * Enforces {@link SESSION_ID_PATTERN} and {@link MAX_SESSION_ID_LENGTH}.
- * The reserved global session sentinel `__global__` is always accepted.
+ * The retired global session sentinel `__global__` is rejected.
  *
  * @throws {ValidationError} when the input is not a valid session id.
  */ function asSessionId(value) {
     if (value === '__global__') {
-        // eslint-disable-next-line no-restricted-syntax -- branding constructor, cannot self-reference
-        return value;
+        throw new errors/* .ValidationError */.yI('session_id', "reserved value '__global__' is retired; use an explicit named session");
     }
     if (typeof value !== 'string' || value.length === 0) {
         throw new errors/* .ValidationError */.yI('session_id', 'must be a non-empty string');
@@ -1772,12 +1724,8 @@ class BaseTransport {
 /** Generate a fresh {@link SummaryId}. */ function generateSummaryId() {
     return generateUlid();
 }
-/**
- * Reserved sentinel session id used when callers omit `session_id`.
- *
- * Branded once here so production and test code share one constant
- * instead of casting `'__global__'` ad-hoc.
- */ const GLOBAL_SESSION_ID = asSessionId('__global__');
+
+;// CONCATENATED MODULE: external "node:string_decoder"
 
 ;// CONCATENATED MODULE: ./src/transport/HttpHelpers.ts
 /**
@@ -1788,7 +1736,11 @@ class BaseTransport {
  * HttpTransport and StreamableHttpTransport.
  *
  * @module transport/HttpHelpers
- */ /**
+ */ 
+class RequestBodyAbortedError extends Error {
+    name = 'RequestBodyAbortedError';
+}
+/**
  * Send a JSON-RPC 2.0 error response.
  *
  * Standardizes error response formatting across all transport implementations.
@@ -1856,23 +1808,118 @@ class BaseTransport {
  * @param req - The incoming HTTP request
  * @param maxBodySize - Maximum allowed body size in bytes (0 = unlimited)
  * @returns The body string, or `null` if the body exceeded the size limit
- */ async function readRequestBody(req, maxBodySize) {
-    let body = '';
-    let bodySize = 0;
-    for await (const chunk of req){
-        const chunkStr = typeof chunk === 'string' ? chunk : chunk.toString();
-        bodySize += chunkStr.length;
-        if (maxBodySize > 0 && bodySize > maxBodySize) {
-            return null;
-        }
-        body += chunkStr;
-    }
-    return body;
+ */ async function readRequestBody(req, maxBodySize, signal) {
+    return new Promise((resolve, reject)=>{
+        let body = '';
+        let bodySize = 0;
+        let settled = false;
+        const decoder = new __rspack_external_node_string_decoder_69b9bd04.StringDecoder('utf8');
+        const cleanup = ()=>{
+            req.off('data', onData);
+            req.off('end', onEnd);
+            req.off('aborted', onAborted);
+            req.off('close', onAborted);
+            req.off('error', onError);
+            signal?.removeEventListener('abort', onAborted);
+        };
+        const onData = (chunk)=>{
+            if (settled) return;
+            const chunkSize = typeof chunk === 'string' ? Buffer.byteLength(chunk) : chunk.byteLength;
+            bodySize += chunkSize;
+            if (maxBodySize > 0 && bodySize > maxBodySize) {
+                settled = true;
+                cleanup();
+                req.resume();
+                resolve(null);
+                return;
+            }
+            body += typeof chunk === 'string' ? chunk : decoder.write(chunk);
+        };
+        const onEnd = ()=>{
+            if (settled) return;
+            settled = true;
+            cleanup();
+            resolve(body + decoder.end());
+        };
+        const onAborted = ()=>{
+            if (settled) return;
+            settled = true;
+            cleanup();
+            req.resume();
+            reject(new RequestBodyAbortedError());
+        };
+        const onError = (error)=>{
+            if (settled) return;
+            settled = true;
+            cleanup();
+            reject(error);
+        };
+        req.on('data', onData);
+        req.once('end', onEnd);
+        req.once('aborted', onAborted);
+        req.once('close', onAborted);
+        req.once('error', onError);
+        signal?.addEventListener('abort', onAborted, {
+            once: true
+        });
+        if (signal?.aborted) onAborted();
+    });
 }
 
 // EXTERNAL MODULE: ./src/context/RequestContext.ts + 1 modules
 var RequestContext = __webpack_require__("i");
 ;// CONCATENATED MODULE: ./src/transport/HttpRequestLifecycle.ts
+class TrackedPreDispatchLease {
+    _onRelease;
+    _controller = new AbortController();
+    _settled = Promise.withResolvers();
+    _active = true;
+    _cancellationReason = null;
+    constructor(_onRelease){
+        this._onRelease = _onRelease;
+    }
+    get signal() {
+        return this._controller.signal;
+    }
+    get cancellationReason() {
+        return this._cancellationReason;
+    }
+    get settled() {
+        return this._settled.promise;
+    }
+    cancel(reason) {
+        if (!this._active || this._controller.signal.aborted) return;
+        this._cancellationReason = reason;
+        this._controller.abort();
+    }
+    release() {
+        if (!this._active) return;
+        this._active = false;
+        this._onRelease(this);
+        this._settled.resolve();
+    }
+}
+class PreDispatchTracker {
+    _leases = new Set();
+    _accepting = true;
+    acquire() {
+        if (!this._accepting) return null;
+        const lease = new TrackedPreDispatchLease((released)=>this._leases.delete(released));
+        this._leases.add(lease);
+        return lease;
+    }
+    closeAdmission(reason) {
+        this._accepting = false;
+        for (const lease of this._leases)lease.cancel(reason);
+    }
+    async join() {
+        while(this._leases.size > 0){
+            await Promise.all([
+                ...this._leases
+            ].map((lease)=>lease.settled));
+        }
+    }
+}
 /** Maximum number of reporting failures retained for diagnostics. */ const LIFECYCLE_REPORTING_FAILURE_CAPACITY = 32;
 class LifecycleFailureReporter {
     _onFailure;
@@ -1944,14 +1991,27 @@ class AcceptedWorkTracker {
     get size() {
         return this._work.size;
     }
-    track(work) {
+    transfer(lease, start) {
+        lease.signal.throwIfAborted();
+        const reservation = Promise.withResolvers();
+        this._work.add(reservation.promise);
+        lease.release();
+        let work;
+        try {
+            work = start();
+        } catch (error) {
+            this._work.delete(reservation.promise);
+            reservation.resolve();
+            throw error;
+        }
         const observed = work.catch((error)=>{
             this._failureReporter.report(error);
         });
-        this._work.add(observed);
         void observed.then(()=>{
-            this._work.delete(observed);
+            this._work.delete(reservation.promise);
+            reservation.resolve();
         });
+        return work;
     }
     async join() {
         while(this._work.size > 0){
@@ -1964,12 +2024,8 @@ class AcceptedWorkTracker {
 /**
  * Streamable HTTP Transport implementation (MCP spec recommended transport).
  *
- * This transport implements the MCP Streamable HTTP specification, which replaces
- * the deprecated SSE transport as the recommended HTTP-based transport since March 2025.
- *
  * Key features:
  * - POST /mcp for JSON-RPC requests (main MCP endpoint)
- * - GET /mcp for optional SSE server-to-client notifications
  * - Session management via Mcp-Session-Id header
  * - Supports both stateful (session-based) and stateless (per-request) modes
  * - Health endpoints (/health, /ready)
@@ -2011,8 +2067,7 @@ function parseSessionRetentionOptions(options) {
  * Streamable HTTP Transport for MCP server.
  *
  * This transport implements the MCP Streamable HTTP specification,
- * providing JSON-RPC over HTTP with optional session management
- * and server-to-client SSE notification streams.
+ * providing JSON-RPC over HTTP with optional session management.
  *
  * @remarks
  * **Security Features (inherited from BaseTransport):**
@@ -2024,13 +2079,11 @@ function parseSessionRetentionOptions(options) {
  *
  * **MCP Streamable HTTP Spec Compliance:**
  * - POST /mcp — JSON-RPC method calls
- * - GET /mcp — SSE notification stream (server-to-client)
  * - Mcp-Session-Id header for session management
  * - Content-Type: application/json for JSON-RPC responses
- * - Content-Type: text/event-stream for SSE notification streams
  *
  * **HTTP Status Code Mapping:**
- * - 200: Success (JSON-RPC response or SSE stream)
+ * - 200: Success (JSON-RPC response)
  * - 202: Accepted (JSON-RPC notification, no response body)
  * - 204: CORS Preflight (empty body)
  * - 400: Bad Request (invalid JSON, invalid session ID)
@@ -2060,6 +2113,7 @@ function parseSessionRetentionOptions(options) {
     _metricsProvider;
     _lifecycleFailureReporter;
     _acceptedWork;
+    _preDispatch = new PreDispatchTracker();
     _sessionRetention;
     _sessionSweepIntervalId = null;
     _stopPromise = null;
@@ -2142,15 +2196,18 @@ function parseSessionRetentionOptions(options) {
             }
         });
     }
-    /**
-	 * Route and handle incoming HTTP requests.
-	 */ async _handleRequest(req, res) {
+    _recordRequestMetrics(res) {
         const startTime = Date.now();
         this._metrics?.counter('streamable_http_requests_total', 1, {}, 'Total Streamable HTTP transport requests');
         res.once('finish', ()=>{
             const durationSeconds = (Date.now() - startTime) / 1000;
             this._metrics?.histogram('streamable_http_request_duration_seconds', durationSeconds, {});
         });
+    }
+    /**
+	 * Route and handle incoming HTTP requests.
+	 */ async _handleRequest(req, res) {
+        this._recordRequestMetrics(res);
         // Host validation
         if (!this.validateHostHeader(req)) {
             this._sendJsonRpcError(res, 403, -32000, 'Forbidden - invalid host header');
@@ -2201,16 +2258,20 @@ function parseSessionRetentionOptions(options) {
         // MCP endpoint routing
         if (urlPath === this._path) {
             if (req.method === 'POST') {
-                this._acceptedWork.track(this._handleMcpPost(req, res));
-                return;
-            }
-            if (req.method === 'GET') {
-                this._handleMcpGet(req, res);
+                const lease = this._preDispatch.acquire();
+                if (!lease) {
+                    const responseFinalizer = new ResponseFinalizer(res, this._lifecycleFailureReporter);
+                    responseFinalizer.finalize((response)=>{
+                        this._sendJsonRpcError(response, 503, -32603, 'Server is shutting down');
+                    });
+                    return;
+                }
+                await this._handleMcpPost(req, res, lease);
                 return;
             }
             res.writeHead(405, {
                 'Content-Type': 'application/json',
-                Allow: 'GET, POST'
+                Allow: 'POST'
             });
             res.end(JSON.stringify({
                 jsonrpc: '2.0',
@@ -2244,6 +2305,28 @@ function parseSessionRetentionOptions(options) {
             error
         }));
     }
+    _parseJsonRpcRequest(body, responseFinalizer) {
+        let rawBody;
+        try {
+            rawBody = JSON.parse(body);
+        } catch  {
+            responseFinalizer.finalize((response)=>{
+                this._sendJsonRpcError(response, 200, -32700, 'Parse error');
+            });
+            return null;
+        }
+        const parseResult = (0,external_valibot_.safeParse)(schema/* .JsonRpcRequestSchema */.Uv, rawBody);
+        const rawId = rawBody && typeof rawBody === 'object' && 'id' in rawBody ? rawBody.id ?? null : null;
+        if (!parseResult.success) {
+            responseFinalizer.finalize((response)=>{
+                this._sendJsonRpcError(response, 200, -32600, 'Invalid Request', rawId, {
+                    data: parseResult.issues
+                });
+            });
+            return null;
+        }
+        return parseResult.output;
+    }
     /**
 	 * Handle POST /mcp — JSON-RPC method calls.
 	 *
@@ -2252,65 +2335,67 @@ function parseSessionRetentionOptions(options) {
 	 * - Returns Mcp-Session-Id header for new sessions (stateful mode)
 	 * - Validates Mcp-Session-Id for existing sessions (stateful mode)
 	 * - Content-Type: application/json for responses
-	 */ async _handleMcpPost(req, res) {
+	 */ async _handleMcpPost(req, res, lease) {
         this._requestCount++;
         this._activeRequests++;
         const responseFinalizer = new ResponseFinalizer(res, this._lifecycleFailureReporter);
         let acceptedSession = null;
+        const onAborted = ()=>lease.cancel('peer');
+        req.once('aborted', onAborted);
         const timeout = setTimeout(()=>{
             responseFinalizer.finalize((response)=>{
                 this._sendJsonRpcError(response, 500, -32603, 'Request timeout');
             });
+            lease.cancel('timeout');
         }, this._requestTimeout);
         try {
             // Read request body with size limit
-            const body = await readRequestBody(req, this._bodySizeLimitEnabled ? this._maxBodySize : 0);
+            const body = await readRequestBody(req, this._bodySizeLimitEnabled ? this._maxBodySize : 0, lease.signal);
             if (body === null) {
                 responseFinalizer.finalize((response)=>{
                     this._sendJsonRpcError(response, 413, -32000, 'Request body too large');
                 });
                 return;
             }
-            // Parse JSON
-            let rawBody;
-            try {
-                rawBody = JSON.parse(body);
-            } catch  {
-                responseFinalizer.finalize((response)=>{
-                    this._sendJsonRpcError(response, 200, -32700, 'Parse error');
-                });
-                return;
-            }
-            // Validate JSON-RPC schema
-            const parseResult = (0,external_valibot_.safeParse)(schema/* .JsonRpcRequestSchema */.Uv, rawBody);
-            const rawId = rawBody && typeof rawBody === 'object' && 'id' in rawBody ? rawBody.id ?? null : null;
-            if (!parseResult.success) {
-                responseFinalizer.finalize((response)=>{
-                    this._sendJsonRpcError(response, 200, -32600, 'Invalid Request', rawId, {
-                        data: parseResult.issues
-                    });
-                });
-                return;
-            }
-            const jsonRpcRequest = parseResult.output;
+            const jsonRpcRequest = this._parseJsonRpcRequest(body, responseFinalizer);
+            if (jsonRpcRequest === null) return;
             const session = this._acceptPostSession(req, responseFinalizer);
             if (!session) return;
             acceptedSession = session.state;
             // Check if MCP server is ready
             if (!this._mcpServer) {
+                const requestId = 'id' in jsonRpcRequest ? jsonRpcRequest.id ?? null : null;
                 responseFinalizer.finalize((response)=>{
-                    this._sendJsonRpcError(response, 503, -32603, 'Server not ready', jsonRpcRequest?.id ?? null);
+                    this._sendJsonRpcError(response, 503, -32603, 'Server not ready', requestId);
                 });
                 return;
             }
-            await this._receiveAndFinalize(jsonRpcRequest, session.id, responseFinalizer);
+            req.off('aborted', onAborted);
+            const acceptedWork = this._acceptedWork.transfer(lease, ()=>this._receiveAndFinalize(jsonRpcRequest, session.id, responseFinalizer).catch((error)=>{
+                    responseFinalizer.finalize((response)=>{
+                        this._sendJsonRpcError(response, 200, -32603, 'Internal error', null, {
+                            data: (0,errors/* .getErrorMessage */.u1)(error)
+                        });
+                    });
+                }));
+            await acceptedWork;
         } catch (error) {
+            if (lease.signal.aborted) {
+                if (lease.cancellationReason === 'shutdown') {
+                    responseFinalizer.finalize((response)=>{
+                        this._sendJsonRpcError(response, 503, -32603, 'Server is shutting down');
+                    });
+                }
+                return;
+            }
             responseFinalizer.finalize((response)=>{
                 this._sendJsonRpcError(response, 200, -32603, 'Internal error', null, {
                     data: (0,errors/* .getErrorMessage */.u1)(error)
                 });
             });
         } finally{
+            req.off('aborted', onAborted);
+            lease.release();
             if (acceptedSession) acceptedSession.acceptedPostCount--;
             clearTimeout(timeout);
             this._activeRequests--;
@@ -2363,82 +2448,6 @@ function parseSessionRetentionOptions(options) {
             httpResponse.end();
         });
     }
-    /**
-	 * Handle GET /mcp — Optional SSE notification stream.
-	 *
-	 * Per the MCP Streamable HTTP spec, clients may open a GET request
-	 * to receive server-initiated notifications as SSE events.
-	 * Requires a valid Mcp-Session-Id in stateful mode.
-	 */ _handleMcpGet(req, res) {
-        if (!this._stateful) {
-            // SSE notification streams require stateful mode
-            res.writeHead(405, {
-                'Content-Type': 'application/json',
-                Allow: 'POST'
-            });
-            res.end(JSON.stringify({
-                jsonrpc: '2.0',
-                id: null,
-                error: {
-                    code: -32601,
-                    message: 'GET not supported in stateless mode'
-                }
-            }));
-            return;
-        }
-        // Require Mcp-Session-Id for GET requests
-        const sessionId = this._getSessionIdFromHeader(req);
-        if (!sessionId) {
-            res.writeHead(400, {
-                'Content-Type': 'application/json'
-            });
-            res.end(JSON.stringify({
-                jsonrpc: '2.0',
-                id: null,
-                error: {
-                    code: -32600,
-                    message: 'Missing Mcp-Session-Id header'
-                }
-            }));
-            return;
-        }
-        const session = this._sessions.get(asSessionId(sessionId));
-        if (!session) {
-            res.writeHead(404, {
-                'Content-Type': 'application/json'
-            });
-            res.end(JSON.stringify({
-                jsonrpc: '2.0',
-                id: null,
-                error: {
-                    code: -32001,
-                    message: 'Session not found'
-                }
-            }));
-            return;
-        }
-        session.lastActivityAt = Date.now();
-        // Set SSE headers
-        res.writeHead(200, {
-            'Content-Type': 'text/event-stream',
-            'Cache-Control': 'no-cache',
-            Connection: 'keep-alive',
-            'Mcp-Session-Id': sessionId
-        });
-        // Send initial connected event
-        this._sendSseEvent(res, 'connected', {
-            sessionId,
-            timestamp: Date.now()
-        });
-        // Track this notification stream
-        session.notificationStreams.add(res);
-        this._updateSessionMetrics();
-        // Handle client disconnect
-        req.on('close', ()=>{
-            session.notificationStreams.delete(res);
-            this._updateSessionMetrics();
-        });
-    }
     /**
 	 * Resolve or create a session for a stateful request.
 	 *
@@ -2484,7 +2493,6 @@ function parseSessionRetentionOptions(options) {
             id: newSessionId,
             createdAt: now,
             lastActivityAt: now,
-            notificationStreams: new Set(),
             acceptedPostCount: 0
         };
         this._sessions.set(newSessionId, sessionState);
@@ -2505,17 +2513,7 @@ function parseSessionRetentionOptions(options) {
         }
     }
     _disposeSession(sessionId) {
-        const session = this._sessions.get(sessionId);
-        if (!session) return;
-        this._sessions.delete(sessionId);
-        for (const stream of session.notificationStreams){
-            try {
-                stream.end();
-            } catch (error) {
-                this._lifecycleFailureReporter.report(error);
-            }
-        }
-        session.notificationStreams.clear();
+        if (!this._sessions.delete(sessionId)) return;
         this._updateSessionMetrics();
     }
     _stopSessionSweep() {
@@ -2534,31 +2532,6 @@ function parseSessionRetentionOptions(options) {
         }
         return undefined;
     }
-    /**
-	 * Send an SSE event to a specific client response stream.
-	 */ _sendSseEvent(res, event, data) {
-        try {
-            res.write(`event: ${event}\n`);
-            res.write(`data: ${JSON.stringify(data)}\n\n`);
-        } catch  {
-        // Client disconnected — ignore
-        }
-    }
-    /**
-	 * Broadcast a notification to all SSE streams in a given session.
-	 *
-	 * @param sessionId - Target session ID
-	 * @param event - SSE event name
-	 * @param data - Event payload
-	 */ broadcastToSession(sessionId, event, data) {
-        const session = this._sessions.get(asSessionId(sessionId));
-        if (!session) {
-            return;
-        }
-        for (const stream of session.notificationStreams){
-            this._sendSseEvent(stream, event, data);
-        }
-    }
     /**
 	 * Handle GET /metrics endpoint.
 	 */ _handleMetrics(res) {
@@ -2617,11 +2590,6 @@ function parseSessionRetentionOptions(options) {
 	 * Update session-related metrics.
 	 */ _updateSessionMetrics() {
         this._metrics?.gauge('streamable_http_active_sessions', this._sessions.size, {}, 'Active Streamable HTTP sessions');
-        let totalStreams = 0;
-        for (const session of this._sessions.values()){
-            totalStreams += session.notificationStreams.size;
-        }
-        this._metrics?.gauge('streamable_http_notification_streams', totalStreams, {}, 'Active SSE notification streams');
     }
     /**
 	 * Stop transport server with graceful shutdown.
@@ -2630,6 +2598,7 @@ function parseSessionRetentionOptions(options) {
 	 */ stop(timeout) {
         if (this._stopPromise) return this._stopPromise;
         this._isShuttingDown = true;
+        this._preDispatch.closeAdmission('shutdown');
         this._stopRateLimitCleanup();
         this._stopSessionSweep();
         const shutdownTimeout = timeout ?? 30000;
@@ -2665,7 +2634,7 @@ function parseSessionRetentionOptions(options) {
         });
         const stopPromise = Promise.all([
             serverClosed,
-            this._acceptedWork.join()
+            this._preDispatch.join().then(()=>this._acceptedWork.join())
         ]).then(()=>{
             this.log('info', 'Streamable HTTP transport stopped');
         });
@@ -3144,7 +3113,7 @@ if (shouldShowVersion) {
     process.exit(0);
 }
 async function main() {
-    const transportType = process.env.TRANSPORT_TYPE || 'stdio';
+    const transportType = process.env.TRACELATTICE_TRANSPORT_TYPE || 'stdio';
     const adapter = new __rspack_external__tmcp_adapter_valibot_0faddfa6.ValibotJsonSchemaAdapter();
     const server = new __rspack_external_tmcp.McpServer({
         name: CLI_NAME,
@@ -3179,17 +3148,17 @@ async function main() {
 /**
  * Start Streamable HTTP transport (MCP spec recommended)
  */ async function startStreamableHttpTransport(server, thinkingServer, lifecycle) {
-    const { StreamableHttpTransport } = await Promise.resolve(/* import() */).then(__webpack_require__.bind(__webpack_require__, "E"));
-    const port = parseInt(process.env.STREAMABLE_HTTP_PORT || '9007', 10);
-    const host = process.env.STREAMABLE_HTTP_HOST || 'localhost';
+    const { StreamableHttpTransport } = await Promise.resolve(/* import() */).then(__webpack_require__.bind(__webpack_require__, "q"));
+    const port = parseInt(process.env.TRACELATTICE_STREAMABLE_HTTP_PORT || '9007', 10);
+    const host = process.env.TRACELATTICE_STREAMABLE_HTTP_HOST || 'localhost';
     const transportMetrics = thinkingServer.getContainer().resolve('Metrics');
-    const stateful = process.env.STREAMABLE_HTTP_STATEFUL !== 'false';
+    const stateful = process.env.TRACELATTICE_STREAMABLE_HTTP_STATEFUL !== 'false';
     const streamableTransport = new StreamableHttpTransport({
         port,
         host,
-        corsOrigin: process.env.CORS_ORIGIN || '*',
-        enableCors: process.env.ENABLE_CORS !== 'false',
-        allowedHosts: process.env.ALLOWED_HOSTS?.split(',').map((hostValue)=>hostValue.trim()),
+        corsOrigin: process.env.TRACELATTICE_CORS_ORIGIN || '*',
+        enableCors: process.env.TRACELATTICE_ENABLE_CORS !== 'false',
+        allowedHosts: process.env.TRACELATTICE_ALLOWED_HOSTS?.split(',').map((hostValue)=>hostValue.trim()),
         metrics: transportMetrics,
         stateful
     });