@mongodb-js/mcp-http-runners 3.0.0-prerelease.2 → 3.0.0-prerelease.3

package/dist/index.d.ts

@@ -1,6 +1,8 @@
 export type { StreamableHttpRunnerOptions } from "./streamableHttpRunner.js";
 export { StreamableHttpRunner } from "./streamableHttpRunner.js";
 export { MCPHttpServer, type MCPHttpServerOptions } from "./mcpHttpServer.js";
+export { LegacyMcpHttpHandler, type LegacyMcpHttpHandlerOptions, type LegacySessionOptions, } from "./legacyMcpHttpHandler.js";
+export { SessionStore, SessionLimitExceededError, SessionRejectedError, createDefaultSessionStore, type ISessionStore, type SessionStoreConstructorArgs, type CreateSessionStoreFn, } from "@mongodb-js/mcp-core";
 export { MonitoringServer, type MonitoringServerOptions } from "./monitoringServer.js";
 export { ExpressBasedHttpServer, type ExpressBasedHttpServerOptions } from "./expressBasedHttpServer.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AAG7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAGjE,OAAO,EAAE,aAAa,EAAE,KAAK,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,KAAK,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAGvF,OAAO,EAAE,sBAAsB,EAAE,KAAK,6BAA6B,EAAE,MAAM,6BAA6B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AAG7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAGjE,OAAO,EAAE,aAAa,EAAE,KAAK,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EACH,oBAAoB,EACpB,KAAK,2BAA2B,EAChC,KAAK,oBAAoB,GAC5B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACH,YAAY,EACZ,yBAAyB,EACzB,oBAAoB,EACpB,yBAAyB,EACzB,KAAK,aAAa,EAClB,KAAK,2BAA2B,EAChC,KAAK,oBAAoB,GAC5B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,KAAK,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAGvF,OAAO,EAAE,sBAAsB,EAAE,KAAK,6BAA6B,EAAE,MAAM,6BAA6B,CAAC"}

package/dist/index.js

@@ -2,6 +2,9 @@
 export { StreamableHttpRunner } from "./streamableHttpRunner.js";
 // HTTP Servers
 export { MCPHttpServer } from "./mcpHttpServer.js";
+export { LegacyMcpHttpHandler, } from "./legacyMcpHttpHandler.js";
+// Session lifecycle primitives live in @mongodb-js/mcp-core; re-export for convenience.
+export { SessionStore, SessionLimitExceededError, SessionRejectedError, createDefaultSessionStore, } from "@mongodb-js/mcp-core";
 export { MonitoringServer } from "./monitoringServer.js";
 // Express HTTP Server base
 export { ExpressBasedHttpServer } from "./expressBasedHttpServer.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,qCAAqC;AACrC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,eAAe;AACf,OAAO,EAAE,aAAa,EAA6B,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAgC,MAAM,uBAAuB,CAAC;AAEvF,2BAA2B;AAC3B,OAAO,EAAE,sBAAsB,EAAsC,MAAM,6BAA6B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,qCAAqC;AACrC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,eAAe;AACf,OAAO,EAAE,aAAa,EAA6B,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EACH,oBAAoB,GAGvB,MAAM,2BAA2B,CAAC;AACnC,wFAAwF;AACxF,OAAO,EACH,YAAY,EACZ,yBAAyB,EACzB,oBAAoB,EACpB,yBAAyB,GAI5B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAgC,MAAM,uBAAuB,CAAC;AAEvF,2BAA2B;AAC3B,OAAO,EAAE,sBAAsB,EAAsC,MAAM,6BAA6B,CAAC"}

package/dist/legacyMcpHttpHandler.d.ts

@@ -0,0 +1,88 @@
+import { NodeStreamableHTTPServerTransport } from "@modelcontextprotocol/node";
+import type express from "express";
+import type { ILogger, TransportRequestContext, HttpServerOptions, BaseServer } from "@mongodb-js/mcp-types";
+import { type ISessionStore } from "@mongodb-js/mcp-core";
+/** Builds a fresh request-scoped server for a legacy request. */
+export type LegacyServerFactory = (request: TransportRequestContext) => Promise<BaseServer>;
+/** Tunables forwarded to the {@link SessionStore}. */
+export type LegacySessionOptions = {
+    maxSessions?: number;
+    idleTimeoutMS?: number;
+    notificationTimeoutMS?: number;
+    evictionIdleGraceMS?: number;
+};
+export type LegacyMcpHttpHandlerOptions = {
+    /** Builds a fresh request-scoped server for the legacy session. */
+    createServer: LegacyServerFactory;
+    logger: ILogger;
+    http: HttpServerOptions;
+    /** Session store backing the legacy sessionful path (auth-aware or durable). */
+    sessionStore: ISessionStore<NodeStreamableHTTPServerTransport>;
+};
+/**
+ * The contract {@link MCPHttpServer.createLegacyHandler} returns for 2025-era
+ * serving. It is deliberately transport-shaped so alternative implementations
+ * (a different transport, a distributed session store, ...) can be returned by
+ * overriding `createLegacyHandler`.
+ */
+export interface LegacyMcpHandler {
+    /** Serves one 2025-era HTTP request (POST/GET/DELETE) to `/mcp`. */
+    handle(req: express.Request, res: express.Response): Promise<void>;
+    /** Releases any held resources (e.g. live sessions) on shutdown. */
+    close(): Promise<void>;
+}
+/**
+ * Serves 2025-era (legacy) MCP requests over streamable HTTP **sessionfully**.
+ *
+ * The 2026-07-28 protocol is stateless and carries client identity per request
+ * in the `_meta` envelope. The 2025 protocol is not: it declares the client's
+ * negotiated capabilities (incl. `elicitation`) in the `initialize` handshake
+ * and delivers elicitation as real server→client requests. Both need a live,
+ * correlated transport, which is exactly what the SDK's legacy elicitation
+ * shim relies on. The SDK's `legacy: 'stateless'` mode cannot do that (each
+ * request gets a fresh instance: no capabilities, no return channel).
+ *
+ * This handler owns that sessionful lifecycle: an `initialize` POST creates a
+ * session (a connected transport/server pair), later requests and the SSE idle
+ * stream reuse the session's transport (the shim's return channel), and a
+ * DELETE closes it. Sessions are bounded by the injected `sessionStore`.
+ * Keeping it isolated from {@link MCPHttpServer} leaves the modern stateless
+ * path clean.
+ */
+export declare class LegacyMcpHttpHandler implements LegacyMcpHandler {
+    private readonly createServer;
+    private readonly logger;
+    private readonly http;
+    private readonly sessions;
+    constructor({ createServer, logger, http, sessionStore }: LegacyMcpHttpHandlerOptions);
+    /** Closes every live session (e.g. on server shutdown). */
+    close(): Promise<void>;
+    private buildTransportContext;
+    /** Reports a session error the way main did: same codes, messages, and statuses. */
+    private reportSessionError;
+    /**
+     * Keeps the session's SSE idle stream alive through proxies and reaps dead
+     * clients: pings every 30s and closes the transport after 3 consecutive
+     * failures. Not started in JSON response mode, where connections are
+     * short-lived and pings aren't needed.
+     */
+    private startKeepAliveLoop;
+    /**
+     * Creates a fresh session: builds a request-scoped server, connects it to a
+     * sessionful streamable HTTP transport (so `initialize` negotiates and the
+     * SDK keeps the client's capabilities on the connected server), and stores
+     * the transport so later requests and the SSE idle stream reuse it (the
+     * return channel the legacy elicitation shim needs).
+     */
+    private createSession;
+    /**
+     * Serves a 2025-era request. POSTs that carry no session begin a new session
+     * (the `initialize` handshake); POSTs/GETs/DELETEs that carry a session id
+     * are routed to the stored transport, preserving the client's negotiated
+     * state and providing the SSE return channel for server→client requests.
+     */
+    handle(req: express.Request, res: express.Response): Promise<void>;
+    /** Routes a session-carrying request to its live transport; reports a session error when missing. */
+    private handleSessionRequest;
+}
+//# sourceMappingURL=legacyMcpHttpHandler.d.ts.map

package/dist/legacyMcpHttpHandler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacyMcpHttpHandler.d.ts","sourceRoot":"","sources":["../src/legacyMcpHttpHandler.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iCAAiC,EAAE,MAAM,4BAA4B,CAAC;AAC/E,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,EACR,OAAO,EACP,uBAAuB,EAEvB,iBAAiB,EACjB,UAAU,EACb,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAA6B,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAwBrF,iEAAiE;AACjE,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,EAAE,uBAAuB,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;AAE5F,sDAAsD;AACtD,MAAM,MAAM,oBAAoB,GAAG;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACtC,mEAAmE;IACnE,YAAY,EAAE,mBAAmB,CAAC;IAClC,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,EAAE,iBAAiB,CAAC;IACxB,gFAAgF;IAChF,YAAY,EAAE,aAAa,CAAC,iCAAiC,CAAC,CAAC;CAClE,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC7B,oEAAoE;IACpE,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,oEAAoE;IACpE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,oBAAqB,YAAW,gBAAgB;IACzD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAsB;IACnD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAU;IACjC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAoB;IACzC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmD;gBAEhE,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,2BAA2B;IAOrF,2DAA2D;IAC9C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAInC,OAAO,CAAC,qBAAqB;IAa7B,oFAAoF;IACpF,OAAO,CAAC,kBAAkB;IAsC1B;;;;;OAKG;YACW,kBAAkB;IAgDhC;;;;;;OAMG;YACW,aAAa;IA8D3B;;;;;OAKG;IACU,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAkE/E,qGAAqG;YACvF,oBAAoB;CA0BrC"}

package/dist/legacyMcpHttpHandler.js

@@ -0,0 +1,294 @@
+import { isInitializeRequest } from "@modelcontextprotocol/server";
+import { NodeStreamableHTTPServerTransport } from "@modelcontextprotocol/node";
+import { LogId, getRandomUUID, requestIdAttr } from "@mongodb-js/mcp-core";
+import { SessionLimitExceededError } from "@mongodb-js/mcp-core";
+import { sleep } from "./utils.js";
+/**
+ * Session error codes as they were served to 2025-era clients on main; the
+ * shared constants were removed from mcp-core with the session surface, so
+ * the legacy path keeps its wire contract locally.
+ */
+const JSON_RPC_ERROR_CODE_SESSION_ID_REQUIRED = -32001;
+const JSON_RPC_ERROR_CODE_SESSION_ID_INVALID = -32002;
+const JSON_RPC_ERROR_CODE_SESSION_NOT_FOUND = -32003;
+const JSON_RPC_ERROR_CODE_INVALID_REQUEST = -32004;
+const JSON_RPC_ERROR_CODE_DISALLOWED_EXTERNAL_SESSION = -32005;
+const JSON_RPC_ERROR_CODE_SESSION_LIMIT_EXCEEDED = -32006;
+/**
+ * Serves 2025-era (legacy) MCP requests over streamable HTTP **sessionfully**.
+ *
+ * The 2026-07-28 protocol is stateless and carries client identity per request
+ * in the `_meta` envelope. The 2025 protocol is not: it declares the client's
+ * negotiated capabilities (incl. `elicitation`) in the `initialize` handshake
+ * and delivers elicitation as real server→client requests. Both need a live,
+ * correlated transport, which is exactly what the SDK's legacy elicitation
+ * shim relies on. The SDK's `legacy: 'stateless'` mode cannot do that (each
+ * request gets a fresh instance: no capabilities, no return channel).
+ *
+ * This handler owns that sessionful lifecycle: an `initialize` POST creates a
+ * session (a connected transport/server pair), later requests and the SSE idle
+ * stream reuse the session's transport (the shim's return channel), and a
+ * DELETE closes it. Sessions are bounded by the injected `sessionStore`.
+ * Keeping it isolated from {@link MCPHttpServer} leaves the modern stateless
+ * path clean.
+ */
+export class LegacyMcpHttpHandler {
+    constructor({ createServer, logger, http, sessionStore }) {
+        this.createServer = createServer;
+        this.logger = logger;
+        this.http = http;
+        this.sessions = sessionStore;
+    }
+    /** Closes every live session (e.g. on server shutdown). */
+    async close() {
+        await this.sessions.closeAllSessions();
+    }
+    buildTransportContext(req) {
+        return {
+            headers: req.headers,
+            query: req.query,
+            // The explicit auth state of this request. Legacy serving does not
+            // normalize authInfo itself; hosts supply it via `req.auth` when
+            // using authenticated mode.
+            authInfo: req.auth
+                ? { mode: "authenticated", state: req.auth }
+                : { mode: "unauthenticated" },
+        };
+    }
+    /** Reports a session error the way main did: same codes, messages, and statuses. */
+    reportSessionError(res, errorCode) {
+        let message;
+        let statusCode = 400;
+        switch (errorCode) {
+            case JSON_RPC_ERROR_CODE_SESSION_ID_REQUIRED:
+                message = "session id is required";
+                break;
+            case JSON_RPC_ERROR_CODE_SESSION_ID_INVALID:
+                message = "session id is invalid";
+                break;
+            case JSON_RPC_ERROR_CODE_INVALID_REQUEST:
+                message = "invalid request";
+                break;
+            case JSON_RPC_ERROR_CODE_SESSION_NOT_FOUND:
+                message = "session not found";
+                statusCode = 404;
+                break;
+            case JSON_RPC_ERROR_CODE_DISALLOWED_EXTERNAL_SESSION:
+                message = "cannot provide sessionId when externally managed sessions are disabled";
+                break;
+            case JSON_RPC_ERROR_CODE_SESSION_LIMIT_EXCEEDED:
+                message = "server has reached the maximum number of concurrent sessions, try again later";
+                statusCode = 503;
+                break;
+            default:
+                message = "unknown error";
+                statusCode = 500;
+        }
+        res.status(statusCode).json({
+            jsonrpc: "2.0",
+            error: {
+                code: errorCode,
+                message,
+            },
+        });
+    }
+    /**
+     * Keeps the session's SSE idle stream alive through proxies and reaps dead
+     * clients: pings every 30s and closes the transport after 3 consecutive
+     * failures. Not started in JSON response mode, where connections are
+     * short-lived and pings aren't needed.
+     */
+    async startKeepAliveLoop({ transport, signal, }) {
+        if (this.http.responseType === "json") {
+            return;
+        }
+        let failedPings = 0;
+        while (!signal.aborted) {
+            try {
+                this.logger.debug({
+                    id: LogId.streamableHttpTransportKeepAlive,
+                    context: "streamableHttpTransport",
+                    message: "Sending ping",
+                });
+                await transport.send({
+                    jsonrpc: "2.0",
+                    method: "ping",
+                });
+                failedPings = 0;
+            }
+            catch (err) {
+                try {
+                    failedPings++;
+                    this.logger.warning({
+                        id: LogId.streamableHttpTransportKeepAliveFailure,
+                        context: "streamableHttpTransport",
+                        message: `Error sending ping (attempt #${failedPings}): ${err instanceof Error ? err.message : String(err)}`,
+                    });
+                    if (failedPings > 3) {
+                        await transport.close();
+                        return;
+                    }
+                }
+                catch {
+                    // Ignore the error of the transport close
+                }
+            }
+            await sleep(30000, { signal });
+        }
+    }
+    /**
+     * Creates a fresh session: builds a request-scoped server, connects it to a
+     * sessionful streamable HTTP transport (so `initialize` negotiates and the
+     * SDK keeps the client's capabilities on the connected server), and stores
+     * the transport so later requests and the SSE idle stream reuse it (the
+     * return channel the legacy elicitation shim needs).
+     */
+    async createSession(req) {
+        const sessionId = getRandomUUID();
+        const transport = new NodeStreamableHTTPServerTransport({
+            sessionIdGenerator: () => sessionId,
+            enableJsonResponse: this.http.responseType === "json",
+        });
+        const server = (await this.createServer(this.buildTransportContext(req)));
+        // Admit (check cap, evict LRU idle victim). A rejection admits nothing.
+        try {
+            await this.sessions.addSession({ sessionId, transport, logger: this.logger, headers: req.headers });
+        }
+        catch (error) {
+            // Dispose the un-connected server we built for a rejected session.
+            await server.close().catch(() => undefined);
+            throw error;
+        }
+        const keepAliveController = new AbortController();
+        void this.startKeepAliveLoop({ transport, signal: keepAliveController.signal });
+        // When the transport closes (client disconnect or store-initiated
+        // eviction/timeout), tear down the server and remove the session.
+        transport.onclose = () => {
+            keepAliveController.abort();
+            void server
+                .close()
+                .catch((error) => {
+                this.logger.error({
+                    id: LogId.streamableHttpTransportCloseFailure,
+                    context: "streamableHttpTransport",
+                    message: `Error closing legacy session ${sessionId}: ${error instanceof Error ? error.message : String(error)}`,
+                });
+            })
+                .finally(() => {
+                // The store removes the session before it closes the
+                // transport, so on store-initiated closes (eviction, idle
+                // timeout) the session is already gone — nothing to do.
+                if (!this.sessions.hasSession(sessionId)) {
+                    return;
+                }
+                this.sessions.closeSession({ sessionId, reason: "transport_closed" }).catch((error) => {
+                    this.logger.error({
+                        id: LogId.streamableHttpTransportCloseFailure,
+                        context: "streamableHttpTransport",
+                        message: `Error removing legacy session ${sessionId}: ${error instanceof Error ? error.message : String(error)}`,
+                    });
+                });
+            });
+        };
+        try {
+            await server.connect(transport);
+        }
+        catch (error) {
+            // Don't leave a never-connected session registered; closing the
+            // transport triggers the onclose teardown above.
+            await this.sessions.closeSession({ sessionId, reason: "unknown" }).catch(() => undefined);
+            await server.close().catch(() => undefined);
+            throw error;
+        }
+        return transport;
+    }
+    /**
+     * Serves a 2025-era request. POSTs that carry no session begin a new session
+     * (the `initialize` handshake); POSTs/GETs/DELETEs that carry a session id
+     * are routed to the stored transport, preserving the client's negotiated
+     * state and providing the SSE return channel for server→client requests.
+     */
+    async handle(req, res) {
+        const sessionId = req.headers["mcp-session-id"];
+        if (req.method === "GET") {
+            // The SSE idle stream only exists in SSE response mode.
+            if (this.http.responseType === "json") {
+                res.status(405).set("Allow", ["POST", "DELETE"]).send("Method Not Allowed");
+                return;
+            }
+            await this.handleSessionRequest(req, res, sessionId);
+            return;
+        }
+        if (req.method === "DELETE") {
+            await this.handleSessionRequest(req, res, sessionId);
+            return;
+        }
+        // POST /mcp.
+        if (sessionId && typeof sessionId !== "string") {
+            this.reportSessionError(res, JSON_RPC_ERROR_CODE_SESSION_ID_INVALID);
+            return;
+        }
+        if (isInitializeRequest(req.body)) {
+            if (sessionId) {
+                // This shim has no externally managed sessions; a client-provided
+                // session id on initialize is rejected as on main.
+                this.logger.debug({
+                    id: LogId.streamableHttpTransportDisallowedExternalSessionError,
+                    context: "streamableHttpTransport",
+                    message: `Client provided session ID ${sessionId} on initialize, but externally managed sessions are not supported`,
+                    attributes: { ...requestIdAttr(req.headers) },
+                });
+                this.reportSessionError(res, JSON_RPC_ERROR_CODE_DISALLOWED_EXTERNAL_SESSION);
+                return;
+            }
+            let transport;
+            try {
+                transport = await this.createSession(req);
+            }
+            catch (error) {
+                if (error instanceof SessionLimitExceededError) {
+                    this.logger.warning({
+                        id: LogId.streamableHttpTransportRequestFailure,
+                        context: "streamableHttpTransport",
+                        message: `Rejecting legacy session startup: ${error.message}`,
+                        attributes: { ...requestIdAttr(req.headers) },
+                    });
+                    this.reportSessionError(res, JSON_RPC_ERROR_CODE_SESSION_LIMIT_EXCEEDED);
+                    return;
+                }
+                throw error;
+            }
+            await transport.handleRequest(req, res, req.body);
+            return;
+        }
+        if (!sessionId) {
+            this.reportSessionError(res, JSON_RPC_ERROR_CODE_INVALID_REQUEST);
+            return;
+        }
+        await this.handleSessionRequest(req, res, sessionId);
+    }
+    /** Routes a session-carrying request to its live transport; reports a session error when missing. */
+    async handleSessionRequest(req, res, sessionId) {
+        if (!sessionId) {
+            this.reportSessionError(res, JSON_RPC_ERROR_CODE_SESSION_ID_REQUIRED);
+            return;
+        }
+        if (typeof sessionId !== "string") {
+            this.reportSessionError(res, JSON_RPC_ERROR_CODE_SESSION_ID_INVALID);
+            return;
+        }
+        const transport = await this.sessions.getSession(sessionId, req.headers);
+        if (!transport) {
+            this.logger.debug({
+                id: LogId.streamableHttpTransportSessionNotFound,
+                context: "streamableHttpTransport",
+                message: `Session with ID ${sessionId} not found`,
+                attributes: { ...requestIdAttr(req.headers) },
+            });
+            this.reportSessionError(res, JSON_RPC_ERROR_CODE_SESSION_NOT_FOUND);
+            return;
+        }
+        await transport.handleRequest(req, res, req.body);
+    }
+}
+//# sourceMappingURL=legacyMcpHttpHandler.js.map

package/dist/legacyMcpHttpHandler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacyMcpHttpHandler.js","sourceRoot":"","sources":["../src/legacyMcpHttpHandler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,iCAAiC,EAAE,MAAM,4BAA4B,CAAC;AAS/E,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC3E,OAAO,EAAE,yBAAyB,EAAsB,MAAM,sBAAsB,CAAC;AACrF,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAEnC;;;;GAIG;AACH,MAAM,uCAAuC,GAAG,CAAC,KAAK,CAAC;AACvD,MAAM,sCAAsC,GAAG,CAAC,KAAK,CAAC;AACtD,MAAM,qCAAqC,GAAG,CAAC,KAAK,CAAC;AACrD,MAAM,mCAAmC,GAAG,CAAC,KAAK,CAAC;AACnD,MAAM,+CAA+C,GAAG,CAAC,KAAK,CAAC;AAC/D,MAAM,0CAA0C,GAAG,CAAC,KAAK,CAAC;AA4C1D;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,oBAAoB;IAM7B,YAAY,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAA+B;QACjF,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,QAAQ,GAAG,YAAY,CAAC;IACjC,CAAC;IAED,2DAA2D;IACpD,KAAK,CAAC,KAAK;QACd,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;IAC3C,CAAC;IAEO,qBAAqB,CAAC,GAAoB;QAC9C,OAAO;YACH,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,KAAK,EAAE,GAAG,CAAC,KAAsD;YACjE,mEAAmE;YACnE,iEAAiE;YACjE,4BAA4B;YAC5B,QAAQ,EAAG,GAAoD,CAAC,IAAI;gBAChE,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAG,GAAmD,CAAC,IAAI,EAAE;gBAC7F,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE;SACpC,CAAC;IACN,CAAC;IAED,oFAAoF;IAC5E,kBAAkB,CAAC,GAAqB,EAAE,SAAiB;QAC/D,IAAI,OAAe,CAAC;QACpB,IAAI,UAAU,GAAG,GAAG,CAAC;QAErB,QAAQ,SAAS,EAAE,CAAC;YAChB,KAAK,uCAAuC;gBACxC,OAAO,GAAG,wBAAwB,CAAC;gBACnC,MAAM;YACV,KAAK,sCAAsC;gBACvC,OAAO,GAAG,uBAAuB,CAAC;gBAClC,MAAM;YACV,KAAK,mCAAmC;gBACpC,OAAO,GAAG,iBAAiB,CAAC;gBAC5B,MAAM;YACV,KAAK,qCAAqC;gBACtC,OAAO,GAAG,mBAAmB,CAAC;gBAC9B,UAAU,GAAG,GAAG,CAAC;gBACjB,MAAM;YACV,KAAK,+CAA+C;gBAChD,OAAO,GAAG,wEAAwE,CAAC;gBACnF,MAAM;YACV,KAAK,0CAA0C;gBAC3C,OAAO,GAAG,+EAA+E,CAAC;gBAC1F,UAAU,GAAG,GAAG,CAAC;gBACjB,MAAM;YACV;gBACI,OAAO,GAAG,eAAe,CAAC;gBAC1B,UAAU,GAAG,GAAG,CAAC;QACzB,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC;YACxB,OAAO,EAAE,KAAK;YACd,KAAK,EAAE;gBACH,IAAI,EAAE,SAAS;gBACf,OAAO;aACV;SACJ,CAAC,CAAC;IACP,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,kBAAkB,CAAC,EAC7B,SAAS,EACT,MAAM,GAIT;QACG,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;YACpC,OAAO;QACX,CAAC;QAED,IAAI,WAAW,GAAG,CAAC,CAAC;QAEpB,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,IAAI,CAAC;gBACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;oBACd,EAAE,EAAE,KAAK,CAAC,gCAAgC;oBAC1C,OAAO,EAAE,yBAAyB;oBAClC,OAAO,EAAE,cAAc;iBAC1B,CAAC,CAAC;gBAEH,MAAM,SAAS,CAAC,IAAI,CAAC;oBACjB,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,MAAM;iBACjB,CAAC,CAAC;gBACH,WAAW,GAAG,CAAC,CAAC;YACpB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,IAAI,CAAC;oBACD,WAAW,EAAE,CAAC;oBACd,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;wBAChB,EAAE,EAAE,KAAK,CAAC,uCAAuC;wBACjD,OAAO,EAAE,yBAAyB;wBAClC,OAAO,EAAE,gCAAgC,WAAW,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;qBAC/G,CAAC,CAAC;oBAEH,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;wBAClB,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;wBACxB,OAAO;oBACX,CAAC;gBACL,CAAC;gBAAC,MAAM,CAAC;oBACL,0CAA0C;gBAC9C,CAAC;YACL,CAAC;YAED,MAAM,KAAK,CAAC,KAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACpC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,aAAa,CAAC,GAAoB;QAC5C,MAAM,SAAS,GAAG,aAAa,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,IAAI,iCAAiC,CAAC;YACpD,kBAAkB,EAAE,GAAW,EAAE,CAAC,SAAS;YAC3C,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,KAAK,MAAM;SACxD,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAgC,CAAC;QAEzG,wEAAwE;QACxE,IAAI,CAAC;YACD,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACxG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,mEAAmE;YACnE,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC5C,MAAM,KAAK,CAAC;QAChB,CAAC;QAED,MAAM,mBAAmB,GAAG,IAAI,eAAe,EAAE,CAAC;QAClD,KAAK,IAAI,CAAC,kBAAkB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,mBAAmB,CAAC,MAAM,EAAE,CAAC,CAAC;QAChF,kEAAkE;QAClE,kEAAkE;QAClE,SAAS,CAAC,OAAO,GAAG,GAAS,EAAE;YAC3B,mBAAmB,CAAC,KAAK,EAAE,CAAC;YAC5B,KAAK,MAAM;iBACN,KAAK,EAAE;iBACP,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACtB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;oBACd,EAAE,EAAE,KAAK,CAAC,mCAAmC;oBAC7C,OAAO,EAAE,yBAAyB;oBAClC,OAAO,EAAE,gCAAgC,SAAS,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;iBAClH,CAAC,CAAC;YACP,CAAC,CAAC;iBACD,OAAO,CAAC,GAAG,EAAE;gBACV,qDAAqD;gBACrD,0DAA0D;gBAC1D,wDAAwD;gBACxD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;oBACvC,OAAO;gBACX,CAAC;gBACD,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;oBAC3F,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;wBACd,EAAE,EAAE,KAAK,CAAC,mCAAmC;wBAC7C,OAAO,EAAE,yBAAyB;wBAClC,OAAO,EAAE,iCAAiC,SAAS,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;qBACnH,CAAC,CAAC;gBACP,CAAC,CAAC,CAAC;YACP,CAAC,CAAC,CAAC;QACX,CAAC,CAAC;QAEF,IAAI,CAAC;YACD,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,gEAAgE;YAChE,iDAAiD;YACjD,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC1F,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC5C,MAAM,KAAK,CAAC;QAChB,CAAC;QAED,OAAO,SAAS,CAAC;IACrB,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,MAAM,CAAC,GAAoB,EAAE,GAAqB;QAC3D,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAEhD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACvB,wDAAwD;YACxD,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;gBACpC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;gBAC5E,OAAO;YACX,CAAC;YACD,MAAM,IAAI,CAAC,oBAAoB,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;YACrD,OAAO;QACX,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,oBAAoB,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;YACrD,OAAO;QACX,CAAC;QAED,aAAa;QACb,IAAI,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC7C,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,sCAAsC,CAAC,CAAC;YACrE,OAAO;QACX,CAAC;QAED,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,IAAI,SAAS,EAAE,CAAC;gBACZ,kEAAkE;gBAClE,mDAAmD;gBACnD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;oBACd,EAAE,EAAE,KAAK,CAAC,qDAAqD;oBAC/D,OAAO,EAAE,yBAAyB;oBAClC,OAAO,EAAE,8BAA8B,SAAS,mEAAmE;oBACnH,UAAU,EAAE,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;iBAChD,CAAC,CAAC;gBACH,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,+CAA+C,CAAC,CAAC;gBAC9E,OAAO;YACX,CAAC;YAED,IAAI,SAA4C,CAAC;YACjD,IAAI,CAAC;gBACD,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,IAAI,KAAK,YAAY,yBAAyB,EAAE,CAAC;oBAC7C,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;wBAChB,EAAE,EAAE,KAAK,CAAC,qCAAqC;wBAC/C,OAAO,EAAE,yBAAyB;wBAClC,OAAO,EAAE,qCAAqC,KAAK,CAAC,OAAO,EAAE;wBAC7D,UAAU,EAAE,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;qBAChD,CAAC,CAAC;oBACH,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,0CAA0C,CAAC,CAAC;oBACzE,OAAO;gBACX,CAAC;gBACD,MAAM,KAAK,CAAC;YAChB,CAAC;YACD,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YAClD,OAAO;QACX,CAAC;QAED,IAAI,CAAC,SAAS,EAAE,CAAC;YACb,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,mCAAmC,CAAC,CAAC;YAClE,OAAO;QACX,CAAC;QAED,MAAM,IAAI,CAAC,oBAAoB,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IACzD,CAAC;IAED,qGAAqG;IAC7F,KAAK,CAAC,oBAAoB,CAC9B,GAAoB,EACpB,GAAqB,EACrB,SAAwC;QAExC,IAAI,CAAC,SAAS,EAAE,CAAC;YACb,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,uCAAuC,CAAC,CAAC;YACtE,OAAO;QACX,CAAC;QACD,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAChC,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,sCAAsC,CAAC,CAAC;YACrE,OAAO;QACX,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACzE,IAAI,CAAC,SAAS,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;gBACd,EAAE,EAAE,KAAK,CAAC,sCAAsC;gBAChD,OAAO,EAAE,yBAAyB;gBAClC,OAAO,EAAE,mBAAmB,SAAS,YAAY;gBACjD,UAAU,EAAE,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;aAChD,CAAC,CAAC;YACH,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,qCAAqC,CAAC,CAAC;YACpE,OAAO;QACX,CAAC;QACD,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC;CACJ"}

package/dist/mcpHttpServer.d.ts

@@ -1,6 +1,7 @@
-import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
-import type { ICompositeLogger, IMetrics, DefaultMetricDefinitions, TransportRequestContext, ISessionStore, HttpServerOptions, SessionManagementOptions, SessionServer } from "@mongodb-js/mcp-types";
+import { type McpHttpHandler } from "@modelcontextprotocol/server";
+import type { ICompositeLogger, IMetrics, DefaultMetricDefinitions, TransportRequestContext, HttpServerOptions, BaseServer } from "@mongodb-js/mcp-types";
 import { ExpressBasedHttpServer } from "./expressBasedHttpServer.js";
+import { type LegacyMcpHandler, type LegacySessionOptions } from "./legacyMcpHttpHandler.js";
 /**
  * Options for creating an MCPHttpServer instance.
  */
@@ -8,19 +9,32 @@ export type MCPHttpServerOptions<TMetrics extends DefaultMetricDefinitions = Def
     options: {
         /** HTTP server options */
         http: HttpServerOptions;
-        /** Session management options */
-        session: SessionManagementOptions;
     };
     /** Logger for the server */
     logger: ICompositeLogger;
     /** Metrics instance */
     metrics: IMetrics<TMetrics>;
-    /** Session store for managing transports */
-    sessionStore: ISessionStore<StreamableHTTPServerTransport>;
+    /**
+     * Tunables for the 2025-era (legacy) session lifecycle: the `maxSessions`
+     * cap, the idle/notification timeouts, and the LRU eviction idle grace. See
+     * {@link LegacySessionOptions}.
+     */
+    sessionOptions?: LegacySessionOptions;
 };
 /**
- * HTTP server that handles MCP requests over HTTP using the Streamable HTTP transport.
+ * HTTP server that serves MCP requests over HTTP.
+ *
+ * The 2026-07-28 protocol is served **statelessly** through the SDK's
+ * `createMcpHandler` (`legacy: 'reject'`): each request builds a fresh
+ * request-scoped server and carries client identity per request in the `_meta`
+ * envelope. No per-client sessions, no `mcp-session-id` routing on that path.
  *
+ * 2025-era (legacy) requests are delegated to a sessionful
+ * {@link LegacyMcpHttpHandler} (see its docs for why): the 2025 protocol needs
+ * a live, correlated transport for its `initialize`-declared capabilities and
+ * server→client elicitation, which the SDK's `legacy: 'stateless'` mode cannot
+ * provide. The modern/legacy split is isolated from this class so each path
+ * stays clean.
  *
  * @example
  * ```typescript
@@ -31,56 +45,41 @@ export type MCPHttpServerOptions<TMetrics extends DefaultMetricDefinitions = Def
  * }
  * ```
  */
-export declare abstract class MCPHttpServer<TServer extends SessionServer = SessionServer, TMetrics extends DefaultMetricDefinitions = DefaultMetricDefinitions> extends ExpressBasedHttpServer {
-    private readonly sessionStore;
-    readonly sessionOptions: SessionManagementOptions;
+export declare abstract class MCPHttpServer<TServer extends BaseServer = BaseServer, TMetrics extends DefaultMetricDefinitions = DefaultMetricDefinitions> extends ExpressBasedHttpServer {
+    /** The 2026-07-28 serving entry; modern requests are routed here. */
+    private readonly modernHandler;
+    /** Sessionful 2025-era serving (initialize/SSE/requests carried per session). */
+    private readonly legacyHandler;
     protected readonly metrics: IMetrics<TMetrics>;
-    private readonly pendingInitializations;
-    constructor({ options, logger, metrics, sessionStore }: MCPHttpServerOptions<TMetrics>);
+    constructor({ options, logger, metrics, sessionOptions }: MCPHttpServerOptions<TMetrics>);
     stop(): Promise<void>;
+    /**
+     * Builds the handler that serves 2025-era (legacy) traffic. Subclasses may
+     * override this to plug in an alternative legacy transport/session
+     * implementation; the default returns a {@link LegacyMcpHttpHandler} built
+     * from {@link MCPHttpServer.createServerForRequest}.
+     */
+    protected createLegacyHandler({ logger, http, sessionOptions, }: {
+        logger: ICompositeLogger;
+        http: HttpServerOptions;
+        sessionOptions?: LegacySessionOptions;
+    }): LegacyMcpHandler;
     /**
      * Creates a server instance for a specific request. Override this method
      * in subclasses to customize per-request server creation.
      */
     protected abstract createServerForRequest(request: TransportRequestContext): Promise<TServer>;
-    private reportSessionError;
-    private startKeepAliveLoop;
-    /**
-     * Ensures the session for the given sessionId is initialized, serializing
-     * concurrent initialization attempts so only one runs at a time.
-     *
-     * If a session already exists in the store, this is a no-op.
-     * If another request is already initializing this session, this call waits
-     * for that initialization to complete.
-     * Otherwise, this call performs the initialization.
-     *
-     * After this method resolves, the caller should look up the transport from
-     * the session store via `sessionStore.getSession()`.
-     *
-     * When `isImplicitInitialization` is true, the transport is pre-configured as
-     * initialized (bypassing the MCP initialize handshake) so that it can handle
-     * non-initialize requests immediately. When false, the transport is left in
-     * its default state so it can process the initialize request normally.
-     */
-    private ensureSessionInitialized;
-    /**
-     * Restores the client state negotiated during the session's original
-     * initialization onto an implicitly re-initialized server. The server on
-     * this pod never saw the client's `initialize` request, so without this
-     * it would treat the client as capability-less — e.g. skipping
-     * confirmation elicitation for destructive tools. No-op when the session
-     * store does not persist negotiated client state.
-     */
-    private restoreNegotiatedClientState;
+    /** Request middleware hook for `/mcp`, called after body parse + header validation, before routing. */
+    protected registerMiddlewares(): void;
     /**
-     * Arranges for the client state negotiated by a real `initialize`
-     * exchange to be persisted through the session store, so implicit
-     * re-initializations of this session can restore it. Wraps the
-     * `oninitialized` callback installed by `server.connect`, hence must run
-     * after it.
+     * Builds the 2026-07-28 serving entry. One factory backs every modern
+     * request: it constructs a fresh request-scoped server, registers it, and
+     * hands the underlying {@link McpServer} to `createMcpHandler`.
+     * `legacy: 'reject'` means this entry serves ONLY the 2026-07-28 era;
+     * 2025-era traffic is routed to the sessionful legacy handler (see
+     * {@link LegacyMcpHttpHandler}).
      */
-    private captureNegotiatedClientStateOnInitialize;
-    protected setupMiddlewares(): void;
+    protected createModernHandler(): McpHttpHandler;
     protected setupRoutes(): Promise<void>;
     private withErrorHandling;
 }

package/dist/mcpHttpServer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcpHttpServer.d.ts","sourceRoot":"","sources":["../src/mcpHttpServer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAGnG,OAAO,KAAK,EACR,gBAAgB,EAEhB,QAAQ,EACR,wBAAwB,EACxB,uBAAuB,EACvB,aAAa,EACb,iBAAiB,EACjB,wBAAwB,EACxB,aAAa,EAEhB,MAAM,uBAAuB,CAAC;AAgB/B,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAGrE;;GAEG;AACH,MAAM,MAAM,oBAAoB,CAAC,QAAQ,SAAS,wBAAwB,GAAG,wBAAwB,IAAI;IACrG,OAAO,EAAE;QACL,0BAA0B;QAC1B,IAAI,EAAE,iBAAiB,CAAC;QACxB,iCAAiC;QACjC,OAAO,EAAE,wBAAwB,CAAC;KACrC,CAAC;IACF,4BAA4B;IAC5B,MAAM,EAAE,gBAAgB,CAAC;IACzB,uBAAuB;IACvB,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC5B,4CAA4C;IAC5C,YAAY,EAAE,aAAa,CAAC,6BAA6B,CAAC,CAAC;CAC9D,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,8BAAsB,aAAa,CAC/B,OAAO,SAAS,aAAa,GAAG,aAAa,EAC7C,QAAQ,SAAS,wBAAwB,GAAG,wBAAwB,CACtE,SAAQ,sBAAsB;IAC5B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA+C;IAC5E,SAAgB,cAAc,EAAE,wBAAwB,CAAC;IACzD,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC/C,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAoC;gBAE/D,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,oBAAoB,CAAC,QAAQ,CAAC;IAazE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAIlC;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,sBAAsB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC;IAE7F,OAAO,CAAC,kBAAkB;YAsCZ,kBAAkB;IAmDhC;;;;;;;;;;;;;;;;OAgBG;YACW,wBAAwB;IA+ItC;;;;;;;OAOG;YACW,4BAA4B;IAqC1C;;;;;;OAMG;IACH,OAAO,CAAC,wCAAwC;IAyBhD,SAAS,CAAC,gBAAgB,IAAI,IAAI;cAmBT,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IA+FrD,OAAO,CAAC,iBAAiB;CAqC5B"}
+{"version":3,"file":"mcpHttpServer.d.ts","sourceRoot":"","sources":["../src/mcpHttpServer.ts"],"names":[],"mappings":"AAAA,OAAO,EAGH,KAAK,cAAc,EAEtB,MAAM,8BAA8B,CAAC;AAItC,OAAO,KAAK,EACR,gBAAgB,EAChB,QAAQ,EACR,wBAAwB,EACxB,uBAAuB,EACvB,iBAAiB,EACjB,UAAU,EACb,MAAM,uBAAuB,CAAC;AAQ/B,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAwB,KAAK,gBAAgB,EAAE,KAAK,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEnH;;GAEG;AACH,MAAM,MAAM,oBAAoB,CAAC,QAAQ,SAAS,wBAAwB,GAAG,wBAAwB,IAAI;IACrG,OAAO,EAAE;QACL,0BAA0B;QAC1B,IAAI,EAAE,iBAAiB,CAAC;KAC3B,CAAC;IACF,4BAA4B;IAC5B,MAAM,EAAE,gBAAgB,CAAC;IACzB,uBAAuB;IACvB,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC5B;;;;OAIG;IACH,cAAc,CAAC,EAAE,oBAAoB,CAAC;CACzC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,8BAAsB,aAAa,CAC/B,OAAO,SAAS,UAAU,GAAG,UAAU,EACvC,QAAQ,SAAS,wBAAwB,GAAG,wBAAwB,CACtE,SAAQ,sBAAsB;IAC5B,qEAAqE;IACrE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAiB;IAC/C,iFAAiF;IACjF,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAmB;IACjD,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAEnC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,oBAAoB,CAAC,QAAQ,CAAC;IAa3E,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAKlC;;;;;OAKG;IACH,SAAS,CAAC,mBAAmB,CAAC,EAC1B,MAAM,EACN,IAAI,EACJ,cAAc,GACjB,EAAE;QACC,MAAM,EAAE,gBAAgB,CAAC;QACzB,IAAI,EAAE,iBAAiB,CAAC;QACxB,cAAc,CAAC,EAAE,oBAAoB,CAAC;KACzC,GAAG,gBAAgB;IAkBpB;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,sBAAsB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC;IAE7F,uGAAuG;IACvG,SAAS,CAAC,mBAAmB,IAAI,IAAI;IAErC;;;;;;;OAOG;IACH,SAAS,CAAC,mBAAmB,IAAI,cAAc;cAgDtB,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IAiDrD,OAAO,CAAC,iBAAiB;CA0B5B"}