@j0hanz/fetch-url-mcp 1.10.4 → 1.10.5

package/README.md

@@ -477,7 +477,7 @@ For more info, see [Kilo Code docs](https://kilocode.ai/docs).
 - Fetch documentation pages, blog posts, or reference material into Markdown before sending them to an LLM.
 - Retrieve repository-hosted content from GitHub, GitLab, Bitbucket, or Gists and let the server rewrite page URLs to raw endpoints when possible.
 - Reuse cached Markdown through `internal://cache/{namespace}/{hash}` or bypass the cache with `forceRefresh` for time-sensitive pages.
-- Use task mode for large pages or slower sites when the inline response would otherwise be truncated or delayed.
+- Use task mode for large pages or slower sites when the fetch might otherwise be delayed, cancelled, or better handled asynchronously.
 
 ## Architecture
 
@@ -525,16 +525,14 @@ For more info, see [Kilo Code docs](https://kilocode.ai/docs).
 
 #### `fetch-url`
 
-Fetch public webpages and convert HTML into AI-readable Markdown. The tool is read-only, does not execute page JavaScript, can bypass the cache with `forceRefresh`, and supports optional task mode for larger or slower fetches.
+Fetch public webpages and convert HTML into AI-readable Markdown. The tool is read-only, does not execute page JavaScript, can bypass the cache with `forceRefresh`, and supports optional task mode for larger or slower fetches. `forceRefresh` refreshes cached content only; it does not bypass fetch or inline truncation limits.
 
-| Parameter          | Type      | Required | Description                                                                                 |
-| ------------------ | --------- | -------- | ------------------------------------------------------------------------------------------- |
-| `url`              | `string`  | yes      | Target URL. Max 2048 chars.                                                                 |
-| `skipNoiseRemoval` | `boolean` | no       | Preserve navigation/footers (disable noise filtering).                                      |
-| `forceRefresh`     | `boolean` | no       | Bypass cache and fetch fresh content.                                                       |
-| `maxInlineChars`   | `integer` | no       | Inline markdown limit (0-10485760, 0=unlimited). Lower of this or the global limit applies. |
+| Parameter      | Type      | Required | Description                           |
+| -------------- | --------- | -------- | ------------------------------------- |
+| `url`          | `string`  | yes      | Target URL. Max 2048 chars.           |
+| `forceRefresh` | `boolean` | no       | Bypass cache and fetch fresh content. |
 
-The response is returned as MCP text content and, when validation succeeds, as `structuredContent` containing `url`, `resolvedUrl`, `finalUrl`, `title`, `metadata`, `markdown`, `fromCache`, `fetchedAt`, `contentSize`, and `truncated`.
+The response is returned as MCP text content and, when validation succeeds, as `structuredContent` containing `url`, `resolvedUrl`, `finalUrl`, `title`, `metadata`, `markdown`, `fromCache`, `fetchedAt`, `contentSize`, and `truncated`. A `truncated: true` result means the content hit server-enforced fetch or inline limits; `forceRefresh` does not remove that limit.
 
 ```text
 1. [Client] -- tools/call {name: "fetch-url", arguments} --> [Server]

package/dist/http/auth.d.ts

@@ -21,6 +21,7 @@ declare class HostOriginPolicy {
 }
 export declare const hostOriginPolicy: HostOriginPolicy;
 export declare function assertHttpModeConfiguration(): void;
+export declare const DEFAULT_MCP_PROTOCOL_VERSION = "2025-11-25";
 export declare const SUPPORTED_MCP_PROTOCOL_VERSIONS: Set<string>;
 interface McpProtocolVersionCheckOptions {
     expectedVersion?: string;

package/dist/http/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/http/auth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEjE,OAAO,EACL,iBAAiB,EAElB,MAAM,iDAAiD,CAAC;AACzD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gDAAgD,CAAC;AAO/E,OAAO,EAEL,KAAK,cAAc,EAIpB,MAAM,cAAc,CAAC;AAMtB,cAAM,UAAU;IAId,MAAM,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO;CAuBrC;AAED,eAAO,MAAM,UAAU,YAAmB,CAAC;AAS3C,cAAM,sBAAuB,SAAQ,iBAAiB;IAElD,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE;gBAAjC,cAAc,EAAE,SAAS,MAAM,EAAE,EAC1C,OAAO,SAAuB;CAKjC;AAED,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,sBAAsB,CAEjC;AAwCD,cAAM,gBAAgB;IACpB,QAAQ,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO;IA2BtC,OAAO,CAAC,iBAAiB;IAMzB,OAAO,CAAC,oBAAoB;IAwB5B,OAAO,CAAC,aAAa;IAwBrB,OAAO,CAAC,oBAAoB;IAI5B,OAAO,CAAC,MAAM;CAQf;AAED,eAAO,MAAM,gBAAgB,kBAAyB,CAAC;AAMvD,wBAAgB,2BAA2B,IAAI,IAAI,CA2BlD;AAOD,eAAO,MAAM,+BAA+B,aAE1C,CAAC;AAEH,UAAU,8BAA8B;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAUD,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,OAAO,CAAC,EAAE,8BAA8B,GACvC,OAAO,CAwBT;AAED,wBAAgB,sBAAsB,IAAI,OAAO,CAEhD;AAQD,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,QAAQ,GAAG,SAAS,GACzB,MAAM,GAAG,IAAI,CAWf;AASD,cAAM,WAAW;IACf,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAEjC;IAEI,YAAY,CAChB,GAAG,EAAE,eAAe,EACpB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,QAAQ,CAAC;IAUpB,OAAO,CAAC,qBAAqB;IAS7B,OAAO,CAAC,sBAAsB;IAiB9B,OAAO,CAAC,kBAAkB;IAW1B,OAAO,CAAC,mBAAmB;IAU3B,OAAO,CAAC,iBAAiB;IAYzB,OAAO,CAAC,SAAS;IAMjB,OAAO,CAAC,uBAAuB;IAgB/B,OAAO,CAAC,kBAAkB;IAiB1B,OAAO,CAAC,mBAAmB;IAsB3B,OAAO,CAAC,oBAAoB;IAS5B,OAAO,CAAC,yBAAyB;YA0BnB,oBAAoB;IA4BlC,OAAO,CAAC,0BAA0B;IAmBlC,OAAO,CAAC,oBAAoB;YAWd,uBAAuB;CAgCtC;AA+BD,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,GAClB,IAAI,CAUN;AAED,wBAAgB,iCAAiC,CAC/C,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,cAAc,EAAE,SAAS,MAAM,EAAE,EACjC,OAAO,SAA+C,GACrD,IAAI,CAYN;AAED,wBAAgB,sCAAsC,CAAC,GAAG,EAAE,eAAe,GAAG;IAC5E,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B,CAeA;AAED,wBAAgB,+BAA+B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAKzE;AAED,eAAO,MAAM,WAAW,aAAoB,CAAC"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/http/auth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEjE,OAAO,EACL,iBAAiB,EAElB,MAAM,iDAAiD,CAAC;AACzD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gDAAgD,CAAC;AAO/E,OAAO,EAEL,KAAK,cAAc,EAIpB,MAAM,cAAc,CAAC;AAMtB,cAAM,UAAU;IAId,MAAM,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO;CAuBrC;AAED,eAAO,MAAM,UAAU,YAAmB,CAAC;AAS3C,cAAM,sBAAuB,SAAQ,iBAAiB;IAElD,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE;gBAAjC,cAAc,EAAE,SAAS,MAAM,EAAE,EAC1C,OAAO,SAAuB;CAKjC;AAED,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,sBAAsB,CAEjC;AAwCD,cAAM,gBAAgB;IACpB,QAAQ,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO;IA2BtC,OAAO,CAAC,iBAAiB;IAMzB,OAAO,CAAC,oBAAoB;IAwB5B,OAAO,CAAC,aAAa;IAwBrB,OAAO,CAAC,oBAAoB;IAI5B,OAAO,CAAC,MAAM;CAQf;AAED,eAAO,MAAM,gBAAgB,kBAAyB,CAAC;AAMvD,wBAAgB,2BAA2B,IAAI,IAAI,CA2BlD;AAMD,eAAO,MAAM,4BAA4B,eAAe,CAAC;AACzD,eAAO,MAAM,+BAA+B,aAE1C,CAAC;AAEH,UAAU,8BAA8B;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAUD,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,OAAO,CAAC,EAAE,8BAA8B,GACvC,OAAO,CAwBT;AAED,wBAAgB,sBAAsB,IAAI,OAAO,CAEhD;AAQD,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,QAAQ,GAAG,SAAS,GACzB,MAAM,GAAG,IAAI,CAWf;AASD,cAAM,WAAW;IACf,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAEjC;IAEI,YAAY,CAChB,GAAG,EAAE,eAAe,EACpB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,QAAQ,CAAC;IAUpB,OAAO,CAAC,qBAAqB;IAS7B,OAAO,CAAC,sBAAsB;IAiB9B,OAAO,CAAC,kBAAkB;IAW1B,OAAO,CAAC,mBAAmB;IAU3B,OAAO,CAAC,iBAAiB;IAYzB,OAAO,CAAC,SAAS;IAMjB,OAAO,CAAC,uBAAuB;IAgB/B,OAAO,CAAC,kBAAkB;IAiB1B,OAAO,CAAC,mBAAmB;IAsB3B,OAAO,CAAC,oBAAoB;IAS5B,OAAO,CAAC,yBAAyB;YA0BnB,oBAAoB;IA4BlC,OAAO,CAAC,0BAA0B;IAmBlC,OAAO,CAAC,oBAAoB;YAWd,uBAAuB;CAgCtC;AA+BD,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,GAClB,IAAI,CAUN;AAED,wBAAgB,iCAAiC,CAC/C,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,cAAc,EAAE,SAAS,MAAM,EAAE,EACjC,OAAO,SAA+C,GACrD,IAAI,CAYN;AAED,wBAAgB,sCAAsC,CAAC,GAAG,EAAE,eAAe,GAAG;IAC5E,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B,CAeA;AAED,wBAAgB,+BAA+B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAKzE;AAED,eAAO,MAAM,WAAW,aAAoB,CAAC"}

package/dist/http/auth.js

@@ -179,7 +179,7 @@ export function assertHttpModeConfiguration() {
 // ---------------------------------------------------------------------------
 // MCP protocol version
 // ---------------------------------------------------------------------------
-const DEFAULT_MCP_PROTOCOL_VERSION = '2025-11-25';
+export const DEFAULT_MCP_PROTOCOL_VERSION = '2025-11-25';
 export const SUPPORTED_MCP_PROTOCOL_VERSIONS = new Set([
     DEFAULT_MCP_PROTOCOL_VERSION,
 ]);

package/dist/http/health.d.ts

@@ -2,6 +2,7 @@ import type { SessionStore } from '../lib/core.js';
 import { type RequestContext } from './helpers.js';
 export declare function resetEventLoopMonitoring(): void;
 export declare function disableEventLoopMonitoring(): void;
+export declare function isVerboseHealthRequest(ctx: RequestContext): boolean;
 export declare function shouldHandleHealthRoute(ctx: RequestContext): boolean;
 export declare function sendHealthRouteResponse(store: SessionStore, ctx: RequestContext, authPresent: boolean): boolean;
 //# sourceMappingURL=health.d.ts.map

package/dist/http/health.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"health.d.ts","sourceRoot":"","sources":["../../src/http/health.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAGnD,OAAO,EAAE,KAAK,cAAc,EAAY,MAAM,cAAc,CAAC;AAY7D,wBAAgB,wBAAwB,IAAI,IAAI,CAI/C;AAED,wBAAgB,0BAA0B,IAAI,IAAI,CAEjD;AAiMD,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAEpE;AAED,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,YAAY,EACnB,GAAG,EAAE,cAAc,EACnB,WAAW,EAAE,OAAO,GACnB,OAAO,CAOT"}
+{"version":3,"file":"health.d.ts","sourceRoot":"","sources":["../../src/http/health.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAGnD,OAAO,EAAE,KAAK,cAAc,EAAY,MAAM,cAAc,CAAC;AAY7D,wBAAgB,wBAAwB,IAAI,IAAI,CAI/C;AAED,wBAAgB,0BAA0B,IAAI,IAAI,CAEjD;AA2JD,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAKnE;AAiCD,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAEpE;AAED,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,YAAY,EACnB,GAAG,EAAE,cAAc,EACnB,WAAW,EAAE,OAAO,GACnB,OAAO,CAOT"}

package/dist/http/health.js

@@ -103,7 +103,7 @@ function sendHealth(store, res, includeDiagnostics) {
 // ---------------------------------------------------------------------------
 // Health route helpers
 // ---------------------------------------------------------------------------
-function isVerboseHealthRequest(ctx) {
+export function isVerboseHealthRequest(ctx) {
     const value = ctx.url.searchParams.get('verbose');
     if (!value)
         return false;

package/dist/http/helpers.d.ts

@@ -36,6 +36,12 @@ export declare function closeTransportBestEffort(transport: {
 }, context: string): Promise<void>;
 export declare function closeMcpServerBestEffort(server: McpServer, context: string): Promise<void>;
 export declare function createTransportAdapter(transportImpl: StreamableHTTPServerTransport): Transport;
+export type JsonBodyErrorKind = 'payload-too-large' | 'invalid-json' | 'read-failed';
+export declare class JsonBodyError extends Error {
+    readonly kind: JsonBodyErrorKind;
+    constructor(kind: JsonBodyErrorKind, message: string);
+}
+export declare function isJsonBodyError(error: unknown): error is JsonBodyError;
 export declare const DEFAULT_BODY_LIMIT_BYTES: number;
 declare class JsonBodyReader {
     read(req: IncomingMessage, limit?: number, signal?: AbortSignal): Promise<unknown>;

package/dist/http/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../src/http/helpers.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACzE,OAAO,KAAK,EAAE,MAAM,IAAI,WAAW,EAAE,MAAM,YAAY,CAAC;AAKxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACxG,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+CAA+C,CAAC;AAK/E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAQrD,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,WAAW,CAAC;AAcjD,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,eAAe,CAAC;IACrB,GAAG,EAAE,cAAc,CAAC;IACpB,GAAG,EAAE,GAAG,CAAC;IACT,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,oBAAqB,SAAQ,cAAc;IAC1D,IAAI,EAAE,QAAQ,CAAC;CAChB;AAWD,wBAAgB,QAAQ,CACtB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,GACZ,IAAI,CAKN;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAInE;AAED,wBAAgB,SAAS,CACvB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,MAAM,SAAM,EACZ,EAAE,GAAE,SAAgB,GACnB,IAAI,CAMN;AAMD,wBAAgB,cAAc,CAC5B,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,MAAM,GACX,MAAM,GAAG,IAAI,CAIf;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,GAAG,IAAI,CAKnE;AAkBD,wBAAgB,8BAA8B,CAC5C,GAAG,EAAE,eAAe,GACnB,MAAM,GAAG,IAAI,CAKf;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,eAAe,GAAG,IAAI,CAOvD;AAMD,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,eAAe,GAAG;IAC9D,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,MAAM,IAAI,CAAC;CACrB,CA2CA;AAgBD,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,CAoBpE;AAMD,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,MAAM,CAAC,EAAE,WAAW,GACnB,cAAc,GAAG,IAAI,CAkBvB;AAMD,wBAAsB,wBAAwB,CAC5C,SAAS,EAAE;IAAE,KAAK,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,EAC5C,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CAMf;AAED,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,SAAS,EACjB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CAMf;AAED,wBAAgB,sBAAsB,CACpC,aAAa,EAAE,6BAA6B,GAC3C,SAAS,CA4CX;AAkBD,eAAO,MAAM,wBAAwB,QAAc,CAAC;AAMpD,cAAM,cAAc;IACZ,IAAI,CACR,GAAG,EAAE,eAAe,EACpB,KAAK,SAA2B,EAChC,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,OAAO,CAAC;YA2BL,QAAQ;IAgBtB,OAAO,CAAC,mBAAmB;IAmB3B,OAAO,CAAC,mBAAmB;YAYb,aAAa;IAqD3B,OAAO,CAAC,cAAc;CAKvB;AAED,eAAO,MAAM,cAAc,gBAAuB,CAAC"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../src/http/helpers.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACzE,OAAO,KAAK,EAAE,MAAM,IAAI,WAAW,EAAE,MAAM,YAAY,CAAC;AAKxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACxG,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+CAA+C,CAAC;AAK/E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAQrD,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,WAAW,CAAC;AAcjD,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,eAAe,CAAC;IACrB,GAAG,EAAE,cAAc,CAAC;IACpB,GAAG,EAAE,GAAG,CAAC;IACT,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,oBAAqB,SAAQ,cAAc;IAC1D,IAAI,EAAE,QAAQ,CAAC;CAChB;AAWD,wBAAgB,QAAQ,CACtB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,GACZ,IAAI,CAKN;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAInE;AAED,wBAAgB,SAAS,CACvB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,MAAM,SAAM,EACZ,EAAE,GAAE,SAAgB,GACnB,IAAI,CAMN;AAMD,wBAAgB,cAAc,CAC5B,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,MAAM,GACX,MAAM,GAAG,IAAI,CAIf;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,GAAG,IAAI,CAKnE;AAkBD,wBAAgB,8BAA8B,CAC5C,GAAG,EAAE,eAAe,GACnB,MAAM,GAAG,IAAI,CAKf;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,eAAe,GAAG,IAAI,CAOvD;AAMD,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,eAAe,GAAG;IAC9D,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,MAAM,IAAI,CAAC;CACrB,CA2CA;AAgBD,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,CAoBpE;AAMD,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,MAAM,CAAC,EAAE,WAAW,GACnB,cAAc,GAAG,IAAI,CAkBvB;AAMD,wBAAsB,wBAAwB,CAC5C,SAAS,EAAE;IAAE,KAAK,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,EAC5C,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CAMf;AAED,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,SAAS,EACjB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CAMf;AAED,wBAAgB,sBAAsB,CACpC,aAAa,EAAE,6BAA6B,GAC3C,SAAS,CA4CX;AAMD,MAAM,MAAM,iBAAiB,GACzB,mBAAmB,GACnB,cAAc,GACd,aAAa,CAAC;AAElB,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;gBAErB,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM;CAKrD;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,aAAa,CAEtE;AAED,eAAO,MAAM,wBAAwB,QAAc,CAAC;AAMpD,cAAM,cAAc;IACZ,IAAI,CACR,GAAG,EAAE,eAAe,EACpB,KAAK,SAA2B,EAChC,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,OAAO,CAAC;YA0BL,QAAQ;IAgBtB,OAAO,CAAC,mBAAmB;IAmB3B,OAAO,CAAC,mBAAmB;YAYb,aAAa;IAoD3B,OAAO,CAAC,cAAc;CAKvB;AAED,eAAO,MAAM,cAAc,gBAAuB,CAAC"}

package/dist/http/helpers.js

@@ -240,7 +240,7 @@ export function createTransportAdapter(transportImpl) {
         },
     };
 }
-class JsonBodyError extends Error {
+export class JsonBodyError extends Error {
     kind;
     constructor(kind, message) {
         super(message);
@@ -248,6 +248,9 @@ class JsonBodyError extends Error {
         this.kind = kind;
     }
 }
+export function isJsonBodyError(error) {
+    return error instanceof JsonBodyError;
+}
 export const DEFAULT_BODY_LIMIT_BYTES = 1024 * 1024;
 function isRequestReadAborted(req) {
     return req.destroyed && !req.complete;
@@ -261,7 +264,6 @@ class JsonBodyReader {
         if (contentLengthHeader) {
             const contentLength = Number.parseInt(contentLengthHeader, 10);
             if (Number.isFinite(contentLength) && contentLength > limit) {
-                destroyRequestBestEffort(req);
                 throw new JsonBodyError('payload-too-large', 'Payload too large');
             }
         }
@@ -327,7 +329,6 @@ class JsonBodyReader {
                     const buf = this.normalizeChunk(chunk);
                     size += buf.length;
                     if (size > limit) {
-                        destroyRequestBestEffort(req);
                         callback(new JsonBodyError('payload-too-large', 'Payload too large'));
                         return;
                     }

package/dist/http/native.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"native.d.ts","sourceRoot":"","sources":["../../src/http/native.ts"],"names":[],"mappings":"AAq3BA,wBAAsB,eAAe,IAAI,OAAO,CAAC;IAC/C,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd,CAAC,CA0DD"}
+{"version":3,"file":"native.d.ts","sourceRoot":"","sources":["../../src/http/native.ts"],"names":[],"mappings":"AA69BA,wBAAsB,eAAe,IAAI,OAAO,CAAC;IAC/C,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd,CAAC,CA0DD"}

package/dist/http/native.js

@@ -15,15 +15,11 @@ import { toError } from '../lib/utils.js';
 import { applyHttpServerTuning, drainConnectionsOnShutdown, } from '../lib/utils.js';
 import { isObject } from '../lib/utils.js';
 import { createMcpServerForHttpSession } from '../server.js';
-import { applyInsufficientScopeAuthHeaders, applyUnauthorizedAuthHeaders, assertHttpModeConfiguration, authService, buildAuthFingerprint, buildProtectedResourceMetadataDocument, corsPolicy, ensureMcpProtocolVersion, hostOriginPolicy, isInsufficientScopeError, isOAuthMetadataEnabled, isProtectedResourceMetadataPath, SUPPORTED_MCP_PROTOCOL_VERSIONS, } from './auth.js';
-import { disableEventLoopMonitoring, resetEventLoopMonitoring, sendHealthRouteResponse, shouldHandleHealthRoute, } from './health.js';
-import { buildRequestContext, closeMcpServerBestEffort, closeTransportBestEffort, createRequestAbortSignal, createTransportAdapter, DEFAULT_BODY_LIMIT_BYTES, drainRequest, findDuplicateSingleValueHeader, getHeaderValue, getMcpSessionId, jsonBodyReader, registerInboundBlockList, sendEmpty, sendError, sendJson, } from './helpers.js';
+import { applyInsufficientScopeAuthHeaders, applyUnauthorizedAuthHeaders, assertHttpModeConfiguration, authService, buildAuthFingerprint, buildProtectedResourceMetadataDocument, corsPolicy, DEFAULT_MCP_PROTOCOL_VERSION, ensureMcpProtocolVersion, hostOriginPolicy, isInsufficientScopeError, isOAuthMetadataEnabled, isProtectedResourceMetadataPath, SUPPORTED_MCP_PROTOCOL_VERSIONS, } from './auth.js';
+import { disableEventLoopMonitoring, isVerboseHealthRequest, resetEventLoopMonitoring, sendHealthRouteResponse, shouldHandleHealthRoute, } from './health.js';
+import { buildRequestContext, closeMcpServerBestEffort, closeTransportBestEffort, createRequestAbortSignal, createTransportAdapter, DEFAULT_BODY_LIMIT_BYTES, drainRequest, findDuplicateSingleValueHeader, getHeaderValue, getMcpSessionId, isJsonBodyError, jsonBodyReader, registerInboundBlockList, sendEmpty, sendError, sendJson, } from './helpers.js';
 import { createRateLimitManagerImpl, } from './rate-limit.js';
 import { teardownSessionRegistration, teardownSessionResources, } from './session-teardown.js';
-// ---------------------------------------------------------------------------
-// MCP session gateway
-// ---------------------------------------------------------------------------
-const DEFAULT_MCP_PROTOCOL_VERSION = '2025-11-25';
 function resolveRequestedProtocolVersion(body) {
     if (!isObject(body))
         return DEFAULT_MCP_PROTOCOL_VERSION;
@@ -57,6 +53,7 @@ function isPingRequest(method) {
 class McpSessionGateway {
     store;
     createSessionServer;
+    sessionInitTimeouts = new Map();
     constructor(store, createSessionServer) {
         this.store = store;
         this.createSessionServer = createSessionServer;
@@ -89,28 +86,15 @@ class McpSessionGateway {
         const session = sessionId
             ? this.getAuthenticatedSessionById(sessionId, ctx.auth, ctx.res, requestId)
             : undefined;
-        if (sessionId && !session)
-            return;
-        if (!session && isInitNotification) {
-            sendError(ctx.res, -32600, 'Missing session ID', 400, requestId);
+        if (!this.ensurePostSessionAccess({
+            ctx,
+            sessionId,
+            session,
+            requestId,
+            method,
+            isInitNotification,
+        }))
             return;
-        }
-        if (session) {
-            if (!this.ensureSessionProtocolVersion(ctx, session))
-                return;
-            if (!session.protocolInitialized) {
-                const isPing = method !== null && isPingRequest(method);
-                if (!isInitNotification && !isPing) {
-                    sendError(ctx.res, -32600, 'Session not initialized', 400, requestId);
-                    return;
-                }
-            }
-        }
-        else {
-            if (!ensureMcpProtocolVersion(ctx.req, ctx.res)) {
-                return;
-            }
-        }
         if (session && isInitNotification) {
             this.markSessionInitialized(sessionId, session);
             sendEmpty(ctx.res, 202);
@@ -127,14 +111,12 @@ class McpSessionGateway {
         await transport.handleRequest(ctx.req, ctx.res, body);
     }
     async handleGet(ctx) {
-        const sessionId = this.getRequiredSessionId(ctx.req, ctx.res);
-        if (!sessionId)
-            return;
-        const session = this.getAuthenticatedSessionById(sessionId, ctx.auth, ctx.res);
-        if (!session)
-            return;
-        if (!this.ensureSessionProtocolVersion(ctx, session))
+        const sessionState = this.getRequiredAuthenticatedSession(ctx, null, {
+            requireInitialized: true,
+        });
+        if (!sessionState)
             return;
+        const { sessionId, session } = sessionState;
         const acceptHeader = getHeaderValue(ctx.req, 'accept');
         if (!acceptsEventStream(acceptHeader)) {
             sendJson(ctx.res, 406, {
@@ -146,28 +128,54 @@ class McpSessionGateway {
         await session.transport.handleRequest(ctx.req, ctx.res);
     }
     async handleDelete(ctx) {
-        const sessionId = this.getRequiredSessionId(ctx.req, ctx.res);
-        if (!sessionId)
-            return;
-        const session = this.getAuthenticatedSessionById(sessionId, ctx.auth, ctx.res);
-        if (!session)
-            return;
-        if (!this.ensureSessionProtocolVersion(ctx, session))
+        const sessionState = this.getRequiredAuthenticatedSession(ctx, null, {
+            requireInitialized: true,
+        });
+        if (!sessionState)
             return;
+        const { sessionId, session } = sessionState;
         await session.transport.close();
         this.cleanupSessionRecord(sessionId, 'session-delete');
         sendJson(ctx.res, 200, { status: 'closed' });
     }
+    ensurePostSessionAccess(params) {
+        const { ctx, sessionId, session, requestId, method, isInitNotification } = params;
+        if (sessionId && !session)
+            return false;
+        if (!session) {
+            if (isInitNotification) {
+                sendError(ctx.res, -32600, 'Missing session ID', 400, requestId);
+                return false;
+            }
+            return ensureMcpProtocolVersion(ctx.req, ctx.res);
+        }
+        if (!this.ensureSessionProtocolVersion(ctx, session))
+            return false;
+        if (session.protocolInitialized)
+            return true;
+        if (isInitNotification)
+            return true;
+        if (method !== null && isPingRequest(method))
+            return true;
+        sendError(ctx.res, -32600, 'Session not initialized', 400, requestId);
+        return false;
+    }
     async getOrCreateTransport(ctx, requestId) {
         const sessionId = getMcpSessionId(ctx.req);
         if (sessionId) {
             const fingerprint = buildAuthFingerprint(ctx.auth);
             return this.getExistingTransport(sessionId, fingerprint, ctx.res, requestId);
         }
-        if (!isMcpRequestBody(ctx.body) || !isInitializeRequest(ctx.body)) {
+        if (!isMcpRequestBody(ctx.body)) {
             sendError(ctx.res, -32600, 'Missing session ID', 400, requestId);
             return null;
         }
+        if (!isInitializeRequest(ctx.body)) {
+            sendError(ctx.res, ctx.body.method === 'initialize' ? -32602 : -32600, ctx.body.method === 'initialize'
+                ? 'Invalid initialize request'
+                : 'Missing session ID', 400, requestId);
+            return null;
+        }
         const negotiatedProtocolVersion = resolveRequestedProtocolVersion(ctx.body);
         if (!negotiatedProtocolVersion) {
             sendError(ctx.res, -32602, `Unsupported protocolVersion; supported versions: ${[...SUPPORTED_MCP_PROTOCOL_VERSIONS].join(', ')}`, 400, requestId);
@@ -188,6 +196,21 @@ class McpSessionGateway {
         this.store.touch(sessionId);
         return session.transport;
     }
+    getRequiredAuthenticatedSession(ctx, requestId = null, options) {
+        const sessionId = this.getRequiredSessionId(ctx.req, ctx.res, requestId);
+        if (!sessionId)
+            return null;
+        const session = this.getAuthenticatedSessionById(sessionId, ctx.auth, ctx.res, requestId);
+        if (!session)
+            return null;
+        if (!this.ensureSessionProtocolVersion(ctx, session))
+            return null;
+        if (options?.requireInitialized && !session.protocolInitialized) {
+            sendError(ctx.res, -32600, 'Session not initialized', 400, requestId);
+            return null;
+        }
+        return { sessionId, session };
+    }
     getRequiredSessionId(req, res, requestId = null) {
         const sessionId = getMcpSessionId(req);
         if (sessionId)
@@ -219,6 +242,7 @@ class McpSessionGateway {
         if (!session.protocolInitialized) {
             session.protocolInitialized = true;
         }
+        this.clearSessionInitTimeout(sessionId);
         if (sessionId)
             this.store.touch(sessionId);
     }
@@ -244,17 +268,24 @@ class McpSessionGateway {
             sessionIdGenerator: () => newSessionId,
         });
         const initTimeout = setTimeout(() => {
-            if (!tracker.isInitialized()) {
-                tracker.releaseSlot();
-                void closeTransportBestEffort(transportImpl, 'session-init-timeout');
-                void closeMcpServerBestEffort(sessionServer, 'session-init-timeout');
+            const session = this.store.get(newSessionId);
+            if (session) {
+                if (session.protocolInitialized) {
+                    this.clearSessionInitTimeout(newSessionId);
+                    return;
+                }
+                this.cleanupSessionRecord(newSessionId, 'session-init-timeout');
+                return;
             }
+            tracker.releaseSlot();
+            void closeTransportBestEffort(transportImpl, 'session-init-timeout');
+            void closeMcpServerBestEffort(sessionServer, 'session-init-timeout');
         }, config.server.sessionInitTimeoutMs);
         initTimeout.unref();
         transportImpl.onclose = () => {
             clearTimeout(initTimeout);
-            if (!tracker.isInitialized())
-                tracker.releaseSlot();
+            this.sessionInitTimeouts.delete(newSessionId);
+            tracker.releaseSlot();
         };
         try {
             const transport = createTransportAdapter(transportImpl);
@@ -267,7 +298,6 @@ class McpSessionGateway {
             void closeMcpServerBestEffort(sessionServer, 'session-connect-failed');
             throw err;
         }
-        tracker.markInitialized();
         tracker.releaseSlot();
         this.store.set(newSessionId, {
             server: sessionServer,
@@ -278,6 +308,7 @@ class McpSessionGateway {
             negotiatedProtocolVersion,
             authFingerprint,
         });
+        this.sessionInitTimeouts.set(newSessionId, initTimeout);
         registerMcpSessionServer(newSessionId, sessionServer);
         transportImpl.onclose = composeCloseHandlers(transportImpl.onclose, () => {
             this.cleanupSessionRecord(newSessionId, 'session-close');
@@ -285,6 +316,7 @@ class McpSessionGateway {
         return transportImpl;
     }
     cleanupSessionRecord(sessionId, context) {
+        this.clearSessionInitTimeout(sessionId);
         const session = this.store.remove(sessionId);
         if (!session)
             return;
@@ -293,6 +325,15 @@ class McpSessionGateway {
             closeServerReason: `${context}-server`,
         });
     }
+    clearSessionInitTimeout(sessionId) {
+        if (!sessionId)
+            return;
+        const timeout = this.sessionInitTimeouts.get(sessionId);
+        if (!timeout)
+            return;
+        clearTimeout(timeout);
+        this.sessionInitTimeouts.delete(sessionId);
+    }
     reserveCapacity(res, requestId) {
         const allowed = ensureSessionCapacity({
             store: this.store,
@@ -439,19 +480,6 @@ class HttpDispatcher {
         }
     }
 }
-// ---------------------------------------------------------------------------
-// Verbose health helper (local to dispatcher)
-// ---------------------------------------------------------------------------
-function isVerboseHealthRequest(ctx) {
-    const value = ctx.url.searchParams.get('verbose');
-    if (!value)
-        return false;
-    const normalized = value.trim().toLowerCase();
-    return normalized === '1' || normalized === 'true';
-}
-// ---------------------------------------------------------------------------
-// Request pipeline
-// ---------------------------------------------------------------------------
 class HttpRequestPipeline {
     rateLimiter;
     dispatcher;
@@ -469,59 +497,15 @@ class HttpRequestPipeline {
                 operationId: requestId,
                 ...(sessionId ? { sessionId } : {}),
             }, async () => {
-                const duplicateHeader = findDuplicateSingleValueHeader(rawReq);
-                if (duplicateHeader) {
-                    sendJson(rawRes, 400, {
-                        error: `Duplicate ${duplicateHeader} header is not allowed`,
-                    });
-                    drainRequest(rawReq);
+                if (this.rejectDuplicateHeaders(rawReq, rawRes))
                     return;
-                }
-                const ctx = buildRequestContext(rawReq, rawRes, signal);
-                if (!ctx) {
-                    drainRequest(rawReq);
+                const ctx = this.buildContext(rawReq, rawRes, signal);
+                if (!ctx)
                     return;
-                }
-                if (!hostOriginPolicy.validate(ctx)) {
-                    drainRequest(rawReq);
-                    return;
-                }
-                if (corsPolicy.handle(ctx)) {
-                    drainRequest(rawReq);
+                if (!this.applyRequestGuards(ctx, rawReq))
                     return;
-                }
-                if (!this.rateLimiter.check(ctx)) {
-                    drainRequest(rawReq);
+                if (!(await this.populateRequestBody(ctx, rawReq)))
                     return;
-                }
-                if (ctx.method === 'POST') {
-                    try {
-                        ctx.body = await jsonBodyReader.read(ctx.req, DEFAULT_BODY_LIMIT_BYTES, ctx.signal);
-                    }
-                    catch {
-                        if (ctx.url.pathname === '/mcp') {
-                            sendError(ctx.res, -32700, 'Parse error', 400, null);
-                        }
-                        else {
-                            sendJson(ctx.res, 400, {
-                                error: 'Invalid JSON or Payload too large',
-                            });
-                        }
-                        drainRequest(rawReq);
-                        return;
-                    }
-                }
-                else {
-                    const contentLengthHeader = getHeaderValue(rawReq, 'content-length');
-                    const transferEncodingHeader = getHeaderValue(rawReq, 'transfer-encoding');
-                    const hasRequestBody = (contentLengthHeader !== null &&
-                        Number.parseInt(contentLengthHeader, 10) > 0) ||
-                        transferEncodingHeader !== null;
-                    if (hasRequestBody) {
-                        drainRequest(rawReq);
-                    }
-                    ctx.body = undefined;
-                }
                 await this.dispatcher.dispatch(ctx);
             });
         }
@@ -529,6 +513,87 @@ class HttpRequestPipeline {
             cleanup();
         }
     }
+    rejectDuplicateHeaders(rawReq, rawRes) {
+        const duplicateHeader = findDuplicateSingleValueHeader(rawReq);
+        if (!duplicateHeader)
+            return false;
+        sendJson(rawRes, 400, {
+            error: `Duplicate ${duplicateHeader} header is not allowed`,
+        });
+        drainRequest(rawReq);
+        return true;
+    }
+    buildContext(rawReq, rawRes, signal) {
+        const ctx = buildRequestContext(rawReq, rawRes, signal);
+        if (ctx)
+            return ctx;
+        drainRequest(rawReq);
+        return null;
+    }
+    applyRequestGuards(ctx, rawReq) {
+        if (!hostOriginPolicy.validate(ctx)) {
+            drainRequest(rawReq);
+            return false;
+        }
+        if (corsPolicy.handle(ctx)) {
+            drainRequest(rawReq);
+            return false;
+        }
+        if (!this.rateLimiter.check(ctx)) {
+            drainRequest(rawReq);
+            return false;
+        }
+        return true;
+    }
+    async populateRequestBody(ctx, rawReq) {
+        if (ctx.method !== 'POST') {
+            this.clearUnexpectedRequestBody(ctx, rawReq);
+            return true;
+        }
+        try {
+            ctx.body = await jsonBodyReader.read(ctx.req, DEFAULT_BODY_LIMIT_BYTES, ctx.signal);
+            return true;
+        }
+        catch (error) {
+            const bodyErrorKind = isJsonBodyError(error) ? error.kind : null;
+            if (ctx.url.pathname === '/mcp') {
+                switch (bodyErrorKind) {
+                    case 'payload-too-large':
+                        sendError(ctx.res, -32600, 'Request body too large', 413, null);
+                        break;
+                    case 'read-failed':
+                        if (!rawReq.destroyed) {
+                            sendError(ctx.res, -32600, 'Request body read failed', 400, null);
+                        }
+                        break;
+                    case 'invalid-json':
+                    default:
+                        sendError(ctx.res, -32700, 'Parse error', 400, null);
+                        break;
+                }
+            }
+            else {
+                sendJson(ctx.res, bodyErrorKind === 'payload-too-large' ? 413 : 400, {
+                    error: bodyErrorKind === 'payload-too-large'
+                        ? 'Payload too large'
+                        : 'Invalid JSON',
+                });
+            }
+            drainRequest(rawReq);
+            return false;
+        }
+    }
+    clearUnexpectedRequestBody(ctx, rawReq) {
+        const contentLengthHeader = getHeaderValue(rawReq, 'content-length');
+        const transferEncodingHeader = getHeaderValue(rawReq, 'transfer-encoding');
+        const hasRequestBody = (contentLengthHeader !== null &&
+            Number.parseInt(contentLengthHeader, 10) > 0) ||
+            transferEncodingHeader !== null;
+        if (hasRequestBody) {
+            drainRequest(rawReq);
+        }
+        ctx.body = undefined;
+    }
 }
 // ---------------------------------------------------------------------------
 // Server bootstrap

package/dist/lib/core.d.ts

@@ -1,5 +1,6 @@
 import { type McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-import { type StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import type { SessionEntry } from './session.js';
+import type { SessionStore } from './session.js';
 export declare const serverVersion: string;
 type LogLevel = 'debug' | 'info' | 'warn' | 'error';
 type McpLogLevel = 'debug' | 'info' | 'notice' | 'warning' | 'error' | 'critical' | 'alert' | 'emergency';
@@ -213,46 +214,10 @@ export declare function logError(message: string, error?: Error | LogMetadata):
 export declare function getMcpLogLevel(sessionId?: string): McpLogLevel;
 export declare function setLogLevel(level: string, sessionId?: string): void;
 export declare function redactUrl(rawUrl: string): string;
-export interface SessionEntry {
-    readonly server: McpServer;
-    readonly transport: StreamableHTTPServerTransport;
-    createdAt: number;
-    lastSeen: number;
-    protocolInitialized: boolean;
-    negotiatedProtocolVersion: string;
-    authFingerprint: string;
-}
-export interface SessionStore {
-    get: (sessionId: string) => SessionEntry | undefined;
-    touch: (sessionId: string) => void;
-    set: (sessionId: string, entry: SessionEntry) => void;
-    remove: (sessionId: string) => SessionEntry | undefined;
-    size: () => number;
-    inFlight: () => number;
-    incrementInFlight: () => void;
-    decrementInFlight: () => void;
-    clear: () => SessionEntry[];
-    evictExpired: () => SessionEntry[];
-    evictOldest: () => SessionEntry | undefined;
-}
-interface SlotTracker {
-    readonly releaseSlot: () => void;
-    readonly markInitialized: () => void;
-    readonly isInitialized: () => boolean;
-}
-type CloseHandler = (() => void) | undefined;
-export declare function composeCloseHandlers(first: CloseHandler, second: CloseHandler): CloseHandler;
+export type { SessionEntry, SessionStore } from './session.js';
+export { composeCloseHandlers, createSessionStore, createSlotTracker, ensureSessionCapacity, reserveSessionSlot, } from './session.js';
 export declare function startSessionCleanupLoop(store: SessionStore, sessionTtlMs: number, options?: {
     onEvictSession?: (session: SessionEntry) => Promise<void> | void;
     cleanupIntervalMs?: number;
 }): AbortController;
-export declare function createSessionStore(sessionTtlMs: number): SessionStore;
-export declare function createSlotTracker(store: SessionStore): SlotTracker;
-export declare function reserveSessionSlot(store: SessionStore, maxSessions: number): boolean;
-export declare function ensureSessionCapacity({ store, maxSessions, evictOldest, }: {
-    store: SessionStore;
-    maxSessions: number;
-    evictOldest: (store: SessionStore) => boolean;
-}): boolean;
-export {};
 //# sourceMappingURL=core.d.ts.map