@planu/cli 4.13.0 → 5.0.0

package/dist/tools/validate.js

@@ -1,11 +1,64 @@
 /* eslint-disable max-lines -- validate coordinates multiple legacy gate payloads in one tool. */
 // tools/validate.ts — Compare spec vs implementation (SPEC-595: elicitation on failures)
 // Uses the validator engine to check coverage, missing items, quality issues.
+var __addDisposableResource = (this && this.__addDisposableResource) || function (env, value, async) {
+    if (value !== null && value !== void 0) {
+        if (typeof value !== "object" && typeof value !== "function") throw new TypeError("Object expected.");
+        var dispose, inner;
+        if (async) {
+            if (!Symbol.asyncDispose) throw new TypeError("Symbol.asyncDispose is not defined.");
+            dispose = value[Symbol.asyncDispose];
+        }
+        if (dispose === void 0) {
+            if (!Symbol.dispose) throw new TypeError("Symbol.dispose is not defined.");
+            dispose = value[Symbol.dispose];
+            if (async) inner = dispose;
+        }
+        if (typeof dispose !== "function") throw new TypeError("Object not disposable.");
+        if (inner) dispose = function() { try { inner.call(this); } catch (e) { return Promise.reject(e); } };
+        env.stack.push({ value: value, dispose: dispose, async: async });
+    }
+    else if (async) {
+        env.stack.push({ async: true });
+    }
+    return value;
+};
+var __disposeResources = (this && this.__disposeResources) || (function (SuppressedError) {
+    return function (env) {
+        function fail(e) {
+            env.error = env.hasError ? new SuppressedError(e, env.error, "An error was suppressed during disposal.") : e;
+            env.hasError = true;
+        }
+        var r, s = 0;
+        function next() {
+            while (r = env.stack.pop()) {
+                try {
+                    if (!r.async && s === 1) return s = 0, env.stack.push(r), Promise.resolve().then(next);
+                    if (r.dispose) {
+                        var result = r.dispose.call(r.value);
+                        if (r.async) return s |= 2, Promise.resolve(result).then(next, function(e) { fail(e); return next(); });
+                    }
+                    else s |= 1;
+                }
+                catch (e) {
+                    fail(e);
+                }
+            }
+            if (s === 1) return env.hasError ? Promise.reject(env.error) : Promise.resolve();
+            if (env.hasError) throw env.error;
+        }
+        return next();
+    };
+})(typeof SuppressedError === "function" ? SuppressedError : function (error, suppressed, message) {
+    var e = new Error(message);
+    return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
+});
 import { elicitOrFallback, buildEnumSchema } from '../engine/elicitation/elicit-helper.js';
 import { compactObj } from '../engine/compact-obj.js';
 import { resolveProjectId, missingProjectIdError } from './resolve-project-id.js';
 import { specStore, knowledgeStore } from '../storage/index.js';
 import { validateSpec, generateDoR, generateDoD } from '../engine/validator.js';
+import { isBlockingQualitySeverity } from '../engine/validator/dor-dod.js';
 import { calcQualityScore } from '../engine/auditor-scoring.js';
 import { dispatchFeedbackEvent } from './learn.js';
 import { t, ti } from '../i18n/index.js';
@@ -22,11 +75,216 @@ import { runLintCheck } from './validate-lint.js';
 import { checkPlanuUncommittedChanges, runAssuranceGates } from './validate-assurance.js';
 import { applyValidateStructuredCompat } from './validate-structured-compat.js';
 import { getToolExecutionSignal } from './safe-handler.js';
+import { DurableJobRuntime, publicJobCursor } from '../engine/execution/job-runtime.js';
+import { scheduleValidateJobExecution } from '../engine/execution/validate-job-executor.js';
+import { createPendingValidationSubmission } from '../engine/validation/durable-validation.js';
+import { PROJECT_ID as CANONICAL_PROJECT_ID } from '../engine/validation/validation-receipt-codec.js';
+import { acquireLock, releaseLock } from '../engine/safety/cross-process-lock.js';
+import { getRuntimePolicy } from '../engine/runtime-policy.js';
+import { resolveValidationWorktree, ValidationWorktreeError, } from '../engine/validation/validation-worktree.js';
 // Re-export for external use (SPEC-018)
 export { validateContractCompliance };
-// SPEC-595: server? param enables elicitation on failures
+const VALIDATION_GATE_TOTAL = 8;
+function createValidationStageRunner(onProgress) {
+    const startedAt = Date.now();
+    let completedGates = 0;
+    return async (phase, command, work) => {
+        const emit = (status) => {
+            onProgress?.({
+                phase,
+                command,
+                durationMs: Date.now() - startedAt,
+                completedGates,
+                totalGates: VALIDATION_GATE_TOTAL,
+                lastProgressAt: new Date().toISOString(),
+                status,
+            });
+        };
+        emit('running');
+        try {
+            const result = await work();
+            completedGates += 1;
+            emit('passed');
+            return result;
+        }
+        catch (error) {
+            completedGates += 1;
+            emit('failed');
+            throw error;
+        }
+    };
+}
+/** Public MCP boundary: persist and acknowledge validation work without running it inline. */
+export async function handleValidate(args) {
+    const projectId = resolveProjectId(args);
+    if (!projectId) {
+        return missingProjectIdError;
+    }
+    if (!CANONICAL_PROJECT_ID.test(projectId)) {
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: '[Planu] Validation requires the canonical project identity. Run init_project with the absolute projectPath to migrate legacy state, then retry validate with projectPath.',
+                },
+            ],
+            isError: true,
+            structuredContent: {
+                error: 'legacy_project_identity',
+                code: 409,
+                context: { projectId, expected: 'canonical-32-hex' },
+                nextAction: {
+                    tool: 'init_project',
+                    arguments: { projectPath: '<absolute-project-path>' },
+                },
+            },
+        };
+    }
+    const [spec, knowledge] = await Promise.all([
+        specStore.getSpec(projectId, args.specId),
+        knowledgeStore.getKnowledge(projectId),
+    ]);
+    if (!spec) {
+        return {
+            content: [{ type: 'text', text: ti('spec.notFound', { id: args.specId }) }],
+            isError: true,
+            structuredContent: {
+                error: 'spec_not_found',
+                code: 404,
+                context: { specId: args.specId, projectId },
+            },
+        };
+    }
+    if (!knowledge) {
+        return {
+            content: [{ type: 'text', text: t('project.notFound') }],
+            isError: true,
+            structuredContent: { error: 'project_not_found', code: 404, context: { projectId } },
+        };
+    }
+    let validationWorktree;
+    try {
+        validationWorktree = await resolveValidationWorktree({
+            requestedProjectPath: args.projectPath ?? knowledge.projectPath,
+            canonicalProjectPath: knowledge.projectPath,
+            canonicalSpecPath: spec.specPath,
+            specId: args.specId,
+        });
+    }
+    catch (error) {
+        return validationWorktreeErrorResult(error, args.specId);
+    }
+    const submissionLock = await acquireValidationSubmissionLock(projectId, args.specId);
+    try {
+        const env_1 = { stack: [], error: void 0, hasError: false };
+        try {
+            const runtime = __addDisposableResource(env_1, new DurableJobRuntime(), false);
+            const active = runtime.list(projectId).find((candidate) => {
+                const payload = candidate.payload;
+                return (['accepted', 'checkpointed', 'running'].includes(candidate.state) &&
+                    payload?.kind === 'validate' &&
+                    payload.input?.specId === args.specId);
+            });
+            if (active) {
+                const activePayload = active.payload;
+                if (activePayload?.validationRootId !== validationWorktree.validationRootId) {
+                    return validationWorktreeErrorResult(new ValidationWorktreeError('VALIDATION_ROOT_BUSY', args.specId), args.specId);
+                }
+                if (active.state === 'accepted' || active.state === 'checkpointed') {
+                    scheduleValidateJobExecution(projectId, active.workspaceId);
+                }
+                return validationAcceptedResult(active, projectId, runtime);
+            }
+            const job = createPendingValidationSubmission({
+                runtime,
+                canonicalProjectId: projectId,
+                spec: {
+                    id: args.specId,
+                    projectPath: validationWorktree.projectPath,
+                    specPath: validationWorktree.relativeSpecPath,
+                    validationRootId: validationWorktree.validationRootId,
+                },
+                deadlineAt: Date.now() + getRuntimePolicy().validation.defaultDeadlineMs,
+            });
+            if (job.state === 'accepted' || job.state === 'checkpointed') {
+                scheduleValidateJobExecution(projectId, job.workspaceId);
+            }
+            return validationAcceptedResult(job, projectId, runtime);
+        }
+        catch (e_1) {
+            env_1.error = e_1;
+            env_1.hasError = true;
+        }
+        finally {
+            __disposeResources(env_1);
+        }
+    }
+    finally {
+        await releaseLock(submissionLock);
+    }
+}
+function validationWorktreeErrorResult(error, specId) {
+    const failure = error instanceof ValidationWorktreeError
+        ? error
+        : new ValidationWorktreeError('VALIDATION_ROOT_NOT_GIT_WORKTREE', specId);
+    return {
+        content: [{ type: 'text', text: failure.message }],
+        isError: true,
+        structuredContent: {
+            error: 'validation_worktree_rejected',
+            code: failure.code,
+            context: {
+                specId: failure.specId,
+                ...(failure.relativeSpecPath ? { path: failure.relativeSpecPath } : {}),
+            },
+        },
+    };
+}
+async function acquireValidationSubmissionLock(projectId, specId) {
+    const policy = getRuntimePolicy().validation;
+    const deadlineAt = Date.now() + policy.submissionLockWaitMs;
+    while (Date.now() < deadlineAt) {
+        const handle = await acquireLock(projectId, `${specId}-validation-submit`, {
+            reason: 'durable-validation-submit',
+        });
+        if (handle) {
+            return handle;
+        }
+        const remainingMs = deadlineAt - Date.now();
+        if (remainingMs > 0) {
+            await new Promise((resolve) => setTimeout(resolve, Math.min(policy.submissionLockPollMs, remainingMs)));
+        }
+    }
+    throw new Error('[Planu] Timed out waiting for the validation submission lock');
+}
+function validationAcceptedResult(job, projectId, runtime) {
+    const observation = runtime.observe(job);
+    const accepted = {
+        schemaVersion: 1,
+        operationId: job.id,
+        projectId,
+        workspaceId: job.workspaceId,
+        state: job.state,
+        submittedAt: job.createdAt,
+        cursor: publicJobCursor(observation),
+        queue: observation.queue,
+        terminalStates: ['completed', 'failed', 'cancelled', 'dead-letter'],
+        resultSchema: 'validate-completion/v1',
+        observation: {
+            get: 'get_job',
+            watch: 'watch_job',
+            cancel: 'cancel_job',
+            restart: 'restart_job',
+        },
+    };
+    return {
+        content: [{ type: 'text', text: `Validation accepted as durable job ${job.id}.` }],
+        structuredContent: accepted,
+    };
+}
+// SPEC-595: server? param enables elicitation for direct internal/test execution.
 // eslint-disable-next-line max-lines-per-function -- validate orchestrates many existing gates in one handler.
-export async function handleValidate(args, server) {
+export async function executeValidate(args, server, onProgress) {
     const { specId } = args;
     const projectId = resolveProjectId(args);
     if (!projectId) {
@@ -58,49 +316,56 @@ export async function handleValidate(args, server) {
             },
         };
     }
-    const projectPath = knowledge.projectPath;
+    const projectPath = args.projectPath ?? knowledge.projectPath;
+    const executionSpec = args.specPath ? { ...spec, specPath: args.specPath } : spec;
+    const runStage = createValidationStageRunner(onProgress);
     // SPEC-1017: fail closed when planu/ contains non-canonical artifacts.
-    const strictLayoutError = await validateStrictLayoutOrError({
+    const strictLayoutError = await runStage('layout', 'validate strict layout', () => validateStrictLayoutOrError({
         projectPath,
         specId,
-        specPath: spec.specPath,
-    });
+        specPath: executionSpec.specPath,
+    }));
     if (strictLayoutError !== null) {
         return strictLayoutError;
     }
-    const result = await validateSpec(spec, projectPath);
-    const graphCoverage = await buildGraphCoverageReport({ projectId, projectPath, specId });
-    const dor = generateDoR(spec);
-    const dod = await generateDoD(spec, result, undefined, projectPath);
+    const result = await runStage('spec-scan', 'validate spec implementation', () => validateSpec(executionSpec, projectPath));
+    const graphCoverage = await runStage('graph', 'validate graph coverage', () => buildGraphCoverageReport({ projectId, projectPath, specId }));
+    const { dor, dod } = await runStage('definitions', 'validate ready and done definitions', async () => ({
+        dor: generateDoR(executionSpec),
+        dod: await generateDoD(executionSpec, result, undefined, projectPath),
+    }));
     const implementationQualityScore = calcQualityScore(result.qualityIssues);
     const auditedFiles = [...new Set(result.qualityIssues.map((i) => i.file))];
-    const { conventionViolations, regressionDetected } = await scanProjectConventions(projectId, projectPath);
-    const lintCheck = await runLintCheck(projectPath, knowledge.lintCommand ?? null, {
+    const { conventionViolations, regressionDetected } = await runStage('conventions', 'validate project conventions', () => scanProjectConventions(projectId, projectPath));
+    const lintCheck = await runStage('lint', knowledge.lintCommand ?? 'pnpm lint', () => runLintCheck(projectPath, knowledge.lintCommand ?? null, {
         projectId,
         specId,
-    });
-    const assuranceGates = runAssuranceGates(projectPath);
-    const minimalityReport = await buildMinimalityReport({
-        projectPath,
-        specId,
-        risk: spec.risk,
-        title: spec.title,
-        missing: result.missing,
-        extra: result.extra,
-        qualityIssues: result.qualityIssues,
-    });
+        maximumTimeoutMs: getRuntimePolicy().validation.durableLintTimeoutMs,
+    }));
+    const { assuranceGates, minimalityReport } = await runStage('assurance', 'validate assurance and minimality', async () => ({
+        assuranceGates: runAssuranceGates(projectPath),
+        minimalityReport: await buildMinimalityReport({
+            projectPath,
+            specId,
+            risk: executionSpec.risk,
+            title: executionSpec.title,
+            missing: result.missing,
+            extra: result.extra,
+            qualityIssues: result.qualityIssues,
+        }),
+    }));
     // SPEC-1050: Generate a mandatory implementation-review artifact.
-    const validationReport = await writeImplementationReviewReport({
+    const validationReport = await runStage('compliance', 'validate spec compliance', () => writeImplementationReviewReport({
         projectId,
         specId,
-        spec,
+        spec: executionSpec,
         projectPath,
         score: result.score,
         lintPassed: lintCheck.passed,
         conventionRegression: regressionDetected,
         minimalityReport: minimalityReport ?? undefined,
         signal: getToolExecutionSignal(),
-    });
+    }));
     const effectiveResult = buildEffectiveValidationResult(result, validationReport.specCompliance);
     const qualityGateSummary = buildQualityGateSummary({
         conventionViolations,
@@ -112,7 +377,7 @@ export async function handleValidate(args, server) {
     });
     const output = {
         specId,
-        title: spec.title,
+        title: executionSpec.title,
         score: effectiveResult.score,
         fieldsImplemented: effectiveResult.fieldsImplemented,
         fieldsTotal: effectiveResult.fieldsTotal,
@@ -441,17 +706,35 @@ function buildCompactSummary(specId, score, passedCount, failedCount, totalCrite
     };
 }
 function buildValidateStructuredContent(args) {
-    const failedDorItems = args.dor.items.filter((item) => item.status === 'failed').slice(0, 5);
+    const failedDorItems = args.dor.items
+        .filter((item) => item.status === 'failed')
+        .slice(0, 5)
+        .map((item) => ({
+        id: item.id,
+        description: item.description,
+        category: item.category,
+        status: item.status,
+        required: item.required,
+    }));
     const failedDodItems = args.dod.items
         .filter((item) => item.required === true && item.status !== 'passed')
-        .slice(0, 5);
+        .slice(0, 5)
+        .map((item) => ({
+        id: item.id,
+        description: item.description,
+        category: item.category,
+        status: item.status,
+        required: item.required,
+    }));
     const failedGates = args.validationReport.gates.filter((gate) => !gate.passed);
     const minimalityBlockingFindings = args.minimalityReport?.findings.filter((finding) => finding.blocksDone) ?? [];
     const blockers = [
         ...args.result.missing.map((missing) => `missing: ${missing}`),
         ...args.indeterminate.map((item) => `indeterminate: ${item}`),
         ...args.qualityGateSummary.failures.map((failure) => `gate: ${failure}`),
-        ...args.qualityIssues.map((issue) => `${issue.rule}: ${issue.message}`),
+        ...args.qualityIssues
+            .filter((issue) => isBlockingQualitySeverity(issue.severity))
+            .map((issue) => `${issue.rule}: ${issue.message}`),
     ];
     const risks = [
         ...args.conventionCompliance.violations.map((violation) => violation.message),
@@ -542,7 +825,12 @@ function buildValidateStructuredContent(args) {
                 blocked: args.minimalityReport.blocked,
                 findingCount: args.minimalityReport.findings.length,
                 blockingFindingCount: minimalityBlockingFindings.length,
-                blockingFindingsTop5: minimalityBlockingFindings.slice(0, 5),
+                blockingFindingsTop5: minimalityBlockingFindings.slice(0, 5).map((finding) => ({
+                    ruleId: finding.ruleId,
+                    target: finding.target,
+                    evidence: finding.evidence,
+                    blocksDone: finding.blocksDone,
+                })),
             }
             : undefined,
         graphCoverage: {

package/dist/transports/http-transport.js

@@ -11,6 +11,23 @@ import { compactToolsListMessage, isToolsListResponse, } from '../engine/compact
 const MAX_BODY_BYTES = 5 * 1024 * 1024; // 5MB
 const SHUTDOWN_GRACE_MS = 5_000;
 const sessions = new Map();
+function observeHttpDisconnect(req, res) {
+    const controller = new AbortController();
+    const abort = () => {
+        if (!res.writableEnded && !controller.signal.aborted) {
+            controller.abort(new Error('HTTP client disconnected'));
+        }
+    };
+    req.once('aborted', abort);
+    res.once('close', abort);
+    return {
+        signal: controller.signal,
+        dispose: () => {
+            req.off('aborted', abort);
+            res.off('close', abort);
+        },
+    };
+}
 async function handleNodeTransportRequest(transport, req, res, parsedBody) {
     // The SDK's Node wrapper pins @hono/node-server 1.x. Adapt the Web Standard
     // transport here so the published package executes against our direct Hono 2 dependency.
@@ -24,7 +41,7 @@ function setSecurityHeaders(res) {
 function setCorsHeaders(res, corsOrigin) {
     res.setHeader('Access-Control-Allow-Origin', corsOrigin);
     res.setHeader('Access-Control-Allow-Methods', 'GET, POST, DELETE, OPTIONS');
-    res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Accept, Authorization, x-api-key, mcp-session-id, Mcp-Session-Id, Last-Event-ID, x-planu-license-key');
+    res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Accept, Authorization, x-api-key, mcp-session-id, Mcp-Session-Id, Last-Event-ID');
     res.setHeader('Access-Control-Expose-Headers', 'Content-Type, mcp-session-id, Mcp-Session-Id');
 }
 function handleHealth(res) {
@@ -43,7 +60,7 @@ const SERVER_CARD = JSON.stringify({
     authentication: { required: false },
     capabilities: { tools: true, resources: true, prompts: false },
     installation: {
-        npm: 'npx -y @planu/cli@latest',
+        npm: `npx -y @planu/cli@${PLANU_VERSION}`,
         docker: 'docker run -i --rm ghcr.io/planu-dev/planu',
     },
 });
@@ -71,7 +88,7 @@ async function readBody(req) {
         req.on('error', reject);
     });
 }
-async function handlePost(req, res, sessionId, serverFactory) {
+async function handlePost(req, res, sessionId, serverFactory, requestSignal) {
     let body;
     try {
         body = await readBody(req);
@@ -90,16 +107,14 @@ async function handlePost(req, res, sessionId, serverFactory) {
         res.end(JSON.stringify({ error: 'Invalid JSON in request body' }));
         return;
     }
-    // Existing session — wrap in session context for per-session license
+    // Existing session — preserve isolated cancellation and identity context.
     if (sessionId) {
         const entry = sessions.get(sessionId);
         if (entry) {
-            await runWithSessionContext({ sessionId, licenseKey: entry.licenseKey }, () => handleNodeTransportRequest(entry.transport, req, res, parsedBody));
+            await runWithSessionContext({ sessionId, signal: requestSignal }, () => handleNodeTransportRequest(entry.transport, req, res, parsedBody));
             return;
         }
     }
-    // Extract per-session license key from HTTP header (hosted multi-tenant mode)
-    const licenseKey = req.headers['x-planu-license-key']?.trim() ?? undefined;
     // New session — create transport and connect a new server instance
     const transport = new WebStandardStreamableHTTPServerTransport({
         sessionIdGenerator: () => randomUUID(),
@@ -113,79 +128,85 @@ async function handlePost(req, res, sessionId, serverFactory) {
     };
     const sessionServer = serverFactory();
     await sessionServer.connect(transport);
-    await runWithSessionContext({ sessionId: transport.sessionId ?? sessionId ?? 'unknown', licenseKey }, () => handleNodeTransportRequest(transport, req, res, parsedBody));
+    await runWithSessionContext({ sessionId: transport.sessionId ?? sessionId ?? 'unknown', signal: requestSignal }, () => handleNodeTransportRequest(transport, req, res, parsedBody));
     const newSessionId = transport.sessionId;
     if (newSessionId) {
-        sessions.set(newSessionId, { transport, server: sessionServer, licenseKey });
+        sessions.set(newSessionId, { transport, server: sessionServer });
     }
 }
 async function handleMcpRequest(req, res, serverFactory, corsOrigin) {
-    setSecurityHeaders(res);
-    if (corsOrigin) {
-        setCorsHeaders(res, corsOrigin);
-    }
-    // OAuth 2.1 Bearer token validation (SPEC-161)
-    const oauthConfig = loadOAuthConfig();
-    if (oauthConfig.enabled) {
-        const token = extractBearerToken(req.headers.authorization);
-        if (!token) {
-            res.writeHead(401, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ error: 'Unauthorized', message: 'Bearer token required' }));
-            return;
+    const cancellation = observeHttpDisconnect(req, res);
+    try {
+        setSecurityHeaders(res);
+        if (corsOrigin) {
+            setCorsHeaders(res, corsOrigin);
         }
-        const authResult = await validateToken(token, oauthConfig);
-        if (!authResult.valid) {
-            res.writeHead(401, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ error: 'Unauthorized', message: authResult.reason }));
+        // OAuth 2.1 Bearer token validation (SPEC-161)
+        const oauthConfig = loadOAuthConfig();
+        if (oauthConfig.enabled) {
+            const token = extractBearerToken(req.headers.authorization);
+            if (!token) {
+                res.writeHead(401, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: 'Unauthorized', message: 'Bearer token required' }));
+                return;
+            }
+            const authResult = await validateToken(token, oauthConfig);
+            if (!authResult.valid) {
+                res.writeHead(401, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: 'Unauthorized', message: authResult.reason }));
+                return;
+            }
+        }
+        const sessionId = req.headers['mcp-session-id'];
+        // Rate limit per session (or IP for new sessions)
+        const rateLimitKey = sessionId ?? req.socket.remoteAddress ?? 'unknown';
+        const rateResult = checkHttpRateLimit(rateLimitKey);
+        if (!rateResult.allowed) {
+            res.writeHead(429, {
+                'Content-Type': 'application/json',
+                'Retry-After': String(Math.ceil(rateResult.retryAfterMs / 1000)),
+            });
+            res.end(JSON.stringify({ error: 'Too many requests. Try again later.' }));
             return;
         }
-    }
-    const sessionId = req.headers['mcp-session-id'];
-    // Rate limit per session (or IP for new sessions)
-    const rateLimitKey = sessionId ?? req.socket.remoteAddress ?? 'unknown';
-    const rateResult = checkHttpRateLimit(rateLimitKey);
-    if (!rateResult.allowed) {
-        res.writeHead(429, {
-            'Content-Type': 'application/json',
-            'Retry-After': String(Math.ceil(rateResult.retryAfterMs / 1000)),
-        });
-        res.end(JSON.stringify({ error: 'Too many requests. Try again later.' }));
-        return;
-    }
-    if (req.method === 'GET') {
-        res.setHeader('Cache-Control', 'no-store');
-        if (sessionId) {
-            const entry = sessions.get(sessionId);
-            if (entry) {
-                await runWithSessionContext({ sessionId, licenseKey: entry.licenseKey }, () => handleNodeTransportRequest(entry.transport, req, res));
-                return;
+        if (req.method === 'GET') {
+            res.setHeader('Cache-Control', 'no-store');
+            if (sessionId) {
+                const entry = sessions.get(sessionId);
+                if (entry) {
+                    await runWithSessionContext({ sessionId, signal: cancellation.signal }, () => handleNodeTransportRequest(entry.transport, req, res));
+                    return;
+                }
             }
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Missing or invalid session ID' }));
+            return;
         }
-        res.writeHead(400, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({ error: 'Missing or invalid session ID' }));
-        return;
-    }
-    if (req.method === 'DELETE') {
-        if (sessionId) {
-            const entry = sessions.get(sessionId);
-            if (entry) {
-                await entry.transport.close();
-                sessions.delete(sessionId);
-                res.writeHead(200, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ status: 'session closed' }));
-                return;
+        if (req.method === 'DELETE') {
+            if (sessionId) {
+                const entry = sessions.get(sessionId);
+                if (entry) {
+                    await entry.transport.close();
+                    sessions.delete(sessionId);
+                    res.writeHead(200, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ status: 'session closed' }));
+                    return;
+                }
             }
+            res.writeHead(404, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Session not found' }));
+            return;
         }
-        res.writeHead(404, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({ error: 'Session not found' }));
-        return;
+        if (req.method === 'POST') {
+            await handlePost(req, res, sessionId, serverFactory, cancellation.signal);
+            return;
+        }
+        res.writeHead(405, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'Method not allowed' }));
     }
-    if (req.method === 'POST') {
-        await handlePost(req, res, sessionId, serverFactory);
-        return;
+    finally {
+        cancellation.dispose();
     }
-    res.writeHead(405, { 'Content-Type': 'application/json' });
-    res.end(JSON.stringify({ error: 'Method not allowed' }));
 }
 function installToolsListCompaction(transport) {
     const originalSend = transport.send.bind(transport);

package/dist/transports/mcp-types.d.ts

@@ -4,7 +4,5 @@ export type McpServerFactory = () => McpServer;
 export interface SessionEntry {
     transport: WebStandardStreamableHTTPServerTransport;
     server: McpServer;
-    /** Per-session license key from HTTP header (hosted multi-tenant mode) */
-    licenseKey?: string;
 }
 //# sourceMappingURL=mcp-types.d.ts.map