@zuplo/cli 6.69.10 → 6.70.0

package/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/streamableHttp.d.ts

@@ -0,0 +1,122 @@
+/**
+ * Node.js HTTP Streamable HTTP Server Transport
+ *
+ * This is a thin wrapper around `WebStandardStreamableHTTPServerTransport` that provides
+ * compatibility with Node.js HTTP server (IncomingMessage/ServerResponse).
+ *
+ * For web-standard environments (Cloudflare Workers, Deno, Bun), use `WebStandardStreamableHTTPServerTransport` directly.
+ */
+import { IncomingMessage, ServerResponse } from 'node:http';
+import { Transport } from '../shared/transport.js';
+import { AuthInfo } from './auth/types.js';
+import { MessageExtraInfo, JSONRPCMessage, RequestId } from '../types.js';
+import { WebStandardStreamableHTTPServerTransportOptions, EventStore, StreamId, EventId } from './webStandardStreamableHttp.js';
+export type { EventStore, StreamId, EventId };
+/**
+ * Configuration options for StreamableHTTPServerTransport
+ *
+ * This is an alias for WebStandardStreamableHTTPServerTransportOptions for backward compatibility.
+ */
+export type StreamableHTTPServerTransportOptions = WebStandardStreamableHTTPServerTransportOptions;
+/**
+ * Server transport for Streamable HTTP: this implements the MCP Streamable HTTP transport specification.
+ * It supports both SSE streaming and direct HTTP responses.
+ *
+ * This is a wrapper around `WebStandardStreamableHTTPServerTransport` that provides Node.js HTTP compatibility.
+ * It uses the `@hono/node-server` library to convert between Node.js HTTP and Web Standard APIs.
+ *
+ * Usage example:
+ *
+ * ```typescript
+ * // Stateful mode - server sets the session ID
+ * const statefulTransport = new StreamableHTTPServerTransport({
+ *   sessionIdGenerator: () => randomUUID(),
+ * });
+ *
+ * // Stateless mode - explicitly set session ID to undefined
+ * const statelessTransport = new StreamableHTTPServerTransport({
+ *   sessionIdGenerator: undefined,
+ * });
+ *
+ * // Using with pre-parsed request body
+ * app.post('/mcp', (req, res) => {
+ *   transport.handleRequest(req, res, req.body);
+ * });
+ * ```
+ *
+ * In stateful mode:
+ * - Session ID is generated and included in response headers
+ * - Session ID is always included in initialization responses
+ * - Requests with invalid session IDs are rejected with 404 Not Found
+ * - Non-initialization requests without a session ID are rejected with 400 Bad Request
+ * - State is maintained in-memory (connections, message history)
+ *
+ * In stateless mode:
+ * - No Session ID is included in any responses
+ * - No session validation is performed
+ */
+export declare class StreamableHTTPServerTransport implements Transport {
+    private _webStandardTransport;
+    private _requestListener;
+    private _requestContext;
+    constructor(options?: StreamableHTTPServerTransportOptions);
+    /**
+     * Gets the session ID for this transport instance.
+     */
+    get sessionId(): string | undefined;
+    /**
+     * Sets callback for when the transport is closed.
+     */
+    set onclose(handler: (() => void) | undefined);
+    get onclose(): (() => void) | undefined;
+    /**
+     * Sets callback for transport errors.
+     */
+    set onerror(handler: ((error: Error) => void) | undefined);
+    get onerror(): ((error: Error) => void) | undefined;
+    /**
+     * Sets callback for incoming messages.
+     */
+    set onmessage(handler: ((message: JSONRPCMessage, extra?: MessageExtraInfo) => void) | undefined);
+    get onmessage(): ((message: JSONRPCMessage, extra?: MessageExtraInfo) => void) | undefined;
+    /**
+     * Starts the transport. This is required by the Transport interface but is a no-op
+     * for the Streamable HTTP transport as connections are managed per-request.
+     */
+    start(): Promise<void>;
+    /**
+     * Closes the transport and all active connections.
+     */
+    close(): Promise<void>;
+    /**
+     * Sends a JSON-RPC message through the transport.
+     */
+    send(message: JSONRPCMessage, options?: {
+        relatedRequestId?: RequestId;
+    }): Promise<void>;
+    /**
+     * Handles an incoming HTTP request, whether GET or POST.
+     *
+     * This method converts Node.js HTTP objects to Web Standard Request/Response
+     * and delegates to the underlying WebStandardStreamableHTTPServerTransport.
+     *
+     * @param req - Node.js IncomingMessage, optionally with auth property from middleware
+     * @param res - Node.js ServerResponse
+     * @param parsedBody - Optional pre-parsed body from body-parser middleware
+     */
+    handleRequest(req: IncomingMessage & {
+        auth?: AuthInfo;
+    }, res: ServerResponse, parsedBody?: unknown): Promise<void>;
+    /**
+     * Close an SSE stream for a specific request, triggering client reconnection.
+     * Use this to implement polling behavior during long-running operations -
+     * client will reconnect after the retry interval specified in the priming event.
+     */
+    closeSSEStream(requestId: RequestId): void;
+    /**
+     * Close the standalone GET SSE stream, triggering client reconnection.
+     * Use this to implement polling behavior for server-initiated notifications.
+     */
+    closeStandaloneSSEStream(): void;
+}
+//# sourceMappingURL=streamableHttp.d.ts.map

package/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/streamableHttp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"streamableHttp.d.ts","sourceRoot":"","sources":["../../../src/server/streamableHttp.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAE5D,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC1E,OAAO,EAEH,+CAA+C,EAC/C,UAAU,EACV,QAAQ,EACR,OAAO,EACV,MAAM,gCAAgC,CAAC;AAGxC,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAE9C;;;;GAIG;AACH,MAAM,MAAM,oCAAoC,GAAG,+CAA+C,CAAC;AAEnG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,qBAAa,6BAA8B,YAAW,SAAS;IAC3D,OAAO,CAAC,qBAAqB,CAA2C;IACxE,OAAO,CAAC,gBAAgB,CAAwC;IAEhE,OAAO,CAAC,eAAe,CAAkF;gBAE7F,OAAO,GAAE,oCAAyC;IAoB9D;;OAEG;IACH,IAAI,SAAS,IAAI,MAAM,GAAG,SAAS,CAElC;IAED;;OAEG;IACH,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,EAE5C;IAED,IAAI,OAAO,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAEtC;IAED;;OAEG;IACH,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC,GAAG,SAAS,EAExD;IAED,IAAI,OAAO,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC,GAAG,SAAS,CAElD;IAED;;OAEG;IACH,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,CAAC,EAAE,gBAAgB,KAAK,IAAI,CAAC,GAAG,SAAS,EAE/F;IAED,IAAI,SAAS,IAAI,CAAC,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,CAAC,EAAE,gBAAgB,KAAK,IAAI,CAAC,GAAG,SAAS,CAEzF;IAED;;;OAGG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAI5B;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAI5B;;OAEG;IACG,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,SAAS,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9F;;;;;;;;;OASG;IACG,aAAa,CAAC,GAAG,EAAE,eAAe,GAAG;QAAE,IAAI,CAAC,EAAE,QAAQ,CAAA;KAAE,EAAE,GAAG,EAAE,cAAc,EAAE,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAuBzH;;;;OAIG;IACH,cAAc,CAAC,SAAS,EAAE,SAAS,GAAG,IAAI;IAI1C;;;OAGG;IACH,wBAAwB,IAAI,IAAI;CAGnC"}

package/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/streamableHttp.js

@@ -0,0 +1,165 @@
+"use strict";
+/**
+ * Node.js HTTP Streamable HTTP Server Transport
+ *
+ * This is a thin wrapper around `WebStandardStreamableHTTPServerTransport` that provides
+ * compatibility with Node.js HTTP server (IncomingMessage/ServerResponse).
+ *
+ * For web-standard environments (Cloudflare Workers, Deno, Bun), use `WebStandardStreamableHTTPServerTransport` directly.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StreamableHTTPServerTransport = void 0;
+const node_server_1 = require("@hono/node-server");
+const webStandardStreamableHttp_js_1 = require("./webStandardStreamableHttp.js");
+/**
+ * Server transport for Streamable HTTP: this implements the MCP Streamable HTTP transport specification.
+ * It supports both SSE streaming and direct HTTP responses.
+ *
+ * This is a wrapper around `WebStandardStreamableHTTPServerTransport` that provides Node.js HTTP compatibility.
+ * It uses the `@hono/node-server` library to convert between Node.js HTTP and Web Standard APIs.
+ *
+ * Usage example:
+ *
+ * ```typescript
+ * // Stateful mode - server sets the session ID
+ * const statefulTransport = new StreamableHTTPServerTransport({
+ *   sessionIdGenerator: () => randomUUID(),
+ * });
+ *
+ * // Stateless mode - explicitly set session ID to undefined
+ * const statelessTransport = new StreamableHTTPServerTransport({
+ *   sessionIdGenerator: undefined,
+ * });
+ *
+ * // Using with pre-parsed request body
+ * app.post('/mcp', (req, res) => {
+ *   transport.handleRequest(req, res, req.body);
+ * });
+ * ```
+ *
+ * In stateful mode:
+ * - Session ID is generated and included in response headers
+ * - Session ID is always included in initialization responses
+ * - Requests with invalid session IDs are rejected with 404 Not Found
+ * - Non-initialization requests without a session ID are rejected with 400 Bad Request
+ * - State is maintained in-memory (connections, message history)
+ *
+ * In stateless mode:
+ * - No Session ID is included in any responses
+ * - No session validation is performed
+ */
+class StreamableHTTPServerTransport {
+    constructor(options = {}) {
+        // Store auth and parsedBody per request for passing through to handleRequest
+        this._requestContext = new WeakMap();
+        this._webStandardTransport = new webStandardStreamableHttp_js_1.WebStandardStreamableHTTPServerTransport(options);
+        // Create a request listener that wraps the web standard transport
+        // getRequestListener converts Node.js HTTP to Web Standard and properly handles SSE streaming
+        // overrideGlobalObjects: false prevents Hono from overwriting global Response, which would
+        // break frameworks like Next.js whose response classes extend the native Response
+        this._requestListener = (0, node_server_1.getRequestListener)(async (webRequest) => {
+            // Get context if available (set during handleRequest)
+            const context = this._requestContext.get(webRequest);
+            return this._webStandardTransport.handleRequest(webRequest, {
+                authInfo: context?.authInfo,
+                parsedBody: context?.parsedBody
+            });
+        }, { overrideGlobalObjects: false });
+    }
+    /**
+     * Gets the session ID for this transport instance.
+     */
+    get sessionId() {
+        return this._webStandardTransport.sessionId;
+    }
+    /**
+     * Sets callback for when the transport is closed.
+     */
+    set onclose(handler) {
+        this._webStandardTransport.onclose = handler;
+    }
+    get onclose() {
+        return this._webStandardTransport.onclose;
+    }
+    /**
+     * Sets callback for transport errors.
+     */
+    set onerror(handler) {
+        this._webStandardTransport.onerror = handler;
+    }
+    get onerror() {
+        return this._webStandardTransport.onerror;
+    }
+    /**
+     * Sets callback for incoming messages.
+     */
+    set onmessage(handler) {
+        this._webStandardTransport.onmessage = handler;
+    }
+    get onmessage() {
+        return this._webStandardTransport.onmessage;
+    }
+    /**
+     * Starts the transport. This is required by the Transport interface but is a no-op
+     * for the Streamable HTTP transport as connections are managed per-request.
+     */
+    async start() {
+        return this._webStandardTransport.start();
+    }
+    /**
+     * Closes the transport and all active connections.
+     */
+    async close() {
+        return this._webStandardTransport.close();
+    }
+    /**
+     * Sends a JSON-RPC message through the transport.
+     */
+    async send(message, options) {
+        return this._webStandardTransport.send(message, options);
+    }
+    /**
+     * Handles an incoming HTTP request, whether GET or POST.
+     *
+     * This method converts Node.js HTTP objects to Web Standard Request/Response
+     * and delegates to the underlying WebStandardStreamableHTTPServerTransport.
+     *
+     * @param req - Node.js IncomingMessage, optionally with auth property from middleware
+     * @param res - Node.js ServerResponse
+     * @param parsedBody - Optional pre-parsed body from body-parser middleware
+     */
+    async handleRequest(req, res, parsedBody) {
+        // Store context for this request to pass through auth and parsedBody
+        // We need to intercept the request creation to attach this context
+        const authInfo = req.auth;
+        // Create a custom handler that includes our context
+        // overrideGlobalObjects: false prevents Hono from overwriting global Response, which would
+        // break frameworks like Next.js whose response classes extend the native Response
+        const handler = (0, node_server_1.getRequestListener)(async (webRequest) => {
+            return this._webStandardTransport.handleRequest(webRequest, {
+                authInfo,
+                parsedBody
+            });
+        }, { overrideGlobalObjects: false });
+        // Delegate to the request listener which handles all the Node.js <-> Web Standard conversion
+        // including proper SSE streaming support
+        await handler(req, res);
+    }
+    /**
+     * Close an SSE stream for a specific request, triggering client reconnection.
+     * Use this to implement polling behavior during long-running operations -
+     * client will reconnect after the retry interval specified in the priming event.
+     */
+    closeSSEStream(requestId) {
+        this._webStandardTransport.closeSSEStream(requestId);
+    }
+    /**
+     * Close the standalone GET SSE stream, triggering client reconnection.
+     * Use this to implement polling behavior for server-initiated notifications.
+     */
+    closeStandaloneSSEStream() {
+        this._webStandardTransport.closeStandaloneSSEStream();
+    }
+}
+exports.StreamableHTTPServerTransport = StreamableHTTPServerTransport;
+//# sourceMappingURL=streamableHttp.js.map

package/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/streamableHttp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"streamableHttp.js","sourceRoot":"","sources":["../../../src/server/streamableHttp.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAGH,mDAAuD;AAIvD,iFAMwC;AAYxC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAa,6BAA6B;IAMtC,YAAY,UAAgD,EAAE;QAH9D,6EAA6E;QACrE,oBAAe,GAAoE,IAAI,OAAO,EAAE,CAAC;QAGrG,IAAI,CAAC,qBAAqB,GAAG,IAAI,uEAAwC,CAAC,OAAO,CAAC,CAAC;QAEnF,kEAAkE;QAClE,8FAA8F;QAC9F,2FAA2F;QAC3F,kFAAkF;QAClF,IAAI,CAAC,gBAAgB,GAAG,IAAA,gCAAkB,EACtC,KAAK,EAAE,UAAmB,EAAE,EAAE;YAC1B,sDAAsD;YACtD,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACrD,OAAO,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,UAAU,EAAE;gBACxD,QAAQ,EAAE,OAAO,EAAE,QAAQ;gBAC3B,UAAU,EAAE,OAAO,EAAE,UAAU;aAClC,CAAC,CAAC;QACP,CAAC,EACD,EAAE,qBAAqB,EAAE,KAAK,EAAE,CACnC,CAAC;IACN,CAAC;IAED;;OAEG;IACH,IAAI,SAAS;QACT,OAAO,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,IAAI,OAAO,CAAC,OAAiC;QACzC,IAAI,CAAC,qBAAqB,CAAC,OAAO,GAAG,OAAO,CAAC;IACjD,CAAC;IAED,IAAI,OAAO;QACP,OAAO,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,IAAI,OAAO,CAAC,OAA6C;QACrD,IAAI,CAAC,qBAAqB,CAAC,OAAO,GAAG,OAAO,CAAC;IACjD,CAAC;IAED,IAAI,OAAO;QACP,OAAO,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,IAAI,SAAS,CAAC,OAAkF;QAC5F,IAAI,CAAC,qBAAqB,CAAC,SAAS,GAAG,OAAO,CAAC;IACnD,CAAC;IAED,IAAI,SAAS;QACT,OAAO,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC;IAChD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,KAAK;QACP,OAAO,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK;QACP,OAAO,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI,CAAC,OAAuB,EAAE,OAA0C;QAC1E,OAAO,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,aAAa,CAAC,GAA0C,EAAE,GAAmB,EAAE,UAAoB;QACrG,qEAAqE;QACrE,mEAAmE;QACnE,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC;QAE1B,oDAAoD;QACpD,2FAA2F;QAC3F,kFAAkF;QAClF,MAAM,OAAO,GAAG,IAAA,gCAAkB,EAC9B,KAAK,EAAE,UAAmB,EAAE,EAAE;YAC1B,OAAO,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,UAAU,EAAE;gBACxD,QAAQ;gBACR,UAAU;aACb,CAAC,CAAC;QACP,CAAC,EACD,EAAE,qBAAqB,EAAE,KAAK,EAAE,CACnC,CAAC;QAEF,6FAA6F;QAC7F,yCAAyC;QACzC,MAAM,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED;;;;OAIG;IACH,cAAc,CAAC,SAAoB;QAC/B,IAAI,CAAC,qBAAqB,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;IACzD,CAAC;IAED;;;OAGG;IACH,wBAAwB;QACpB,IAAI,CAAC,qBAAqB,CAAC,wBAAwB,EAAE,CAAC;IAC1D,CAAC;CACJ;AAzID,sEAyIC"}

package/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/webStandardStreamableHttp.d.ts

@@ -0,0 +1,268 @@
+/**
+ * Web Standards Streamable HTTP Server Transport
+ *
+ * This is the core transport implementation using Web Standard APIs (Request, Response, ReadableStream).
+ * It can run on any runtime that supports Web Standards: Node.js 18+, Cloudflare Workers, Deno, Bun, etc.
+ *
+ * For Node.js Express/HTTP compatibility, use `StreamableHTTPServerTransport` which wraps this transport.
+ */
+import { Transport } from '../shared/transport.js';
+import { AuthInfo } from './auth/types.js';
+import { MessageExtraInfo, JSONRPCMessage, RequestId } from '../types.js';
+export type StreamId = string;
+export type EventId = string;
+/**
+ * Interface for resumability support via event storage
+ */
+export interface EventStore {
+    /**
+     * Stores an event for later retrieval
+     * @param streamId ID of the stream the event belongs to
+     * @param message The JSON-RPC message to store
+     * @returns The generated event ID for the stored event
+     */
+    storeEvent(streamId: StreamId, message: JSONRPCMessage): Promise<EventId>;
+    /**
+     * Get the stream ID associated with a given event ID.
+     * @param eventId The event ID to look up
+     * @returns The stream ID, or undefined if not found
+     *
+     * Optional: If not provided, the SDK will use the streamId returned by
+     * replayEventsAfter for stream mapping.
+     */
+    getStreamIdForEventId?(eventId: EventId): Promise<StreamId | undefined>;
+    replayEventsAfter(lastEventId: EventId, { send }: {
+        send: (eventId: EventId, message: JSONRPCMessage) => Promise<void>;
+    }): Promise<StreamId>;
+}
+/**
+ * Configuration options for WebStandardStreamableHTTPServerTransport
+ */
+export interface WebStandardStreamableHTTPServerTransportOptions {
+    /**
+     * Function that generates a session ID for the transport.
+     * The session ID SHOULD be globally unique and cryptographically secure (e.g., a securely generated UUID, a JWT, or a cryptographic hash)
+     *
+     * If not provided, session management is disabled (stateless mode).
+     */
+    sessionIdGenerator?: () => string;
+    /**
+     * A callback for session initialization events
+     * This is called when the server initializes a new session.
+     * Useful in cases when you need to register multiple mcp sessions
+     * and need to keep track of them.
+     * @param sessionId The generated session ID
+     */
+    onsessioninitialized?: (sessionId: string) => void | Promise<void>;
+    /**
+     * A callback for session close events
+     * This is called when the server closes a session due to a DELETE request.
+     * Useful in cases when you need to clean up resources associated with the session.
+     * Note that this is different from the transport closing, if you are handling
+     * HTTP requests from multiple nodes you might want to close each
+     * WebStandardStreamableHTTPServerTransport after a request is completed while still keeping the
+     * session open/running.
+     * @param sessionId The session ID that was closed
+     */
+    onsessionclosed?: (sessionId: string) => void | Promise<void>;
+    /**
+     * If true, the server will return JSON responses instead of starting an SSE stream.
+     * This can be useful for simple request/response scenarios without streaming.
+     * Default is false (SSE streams are preferred).
+     */
+    enableJsonResponse?: boolean;
+    /**
+     * Event store for resumability support
+     * If provided, resumability will be enabled, allowing clients to reconnect and resume messages
+     */
+    eventStore?: EventStore;
+    /**
+     * List of allowed host header values for DNS rebinding protection.
+     * If not specified, host validation is disabled.
+     * @deprecated Use external middleware for host validation instead.
+     */
+    allowedHosts?: string[];
+    /**
+     * List of allowed origin header values for DNS rebinding protection.
+     * If not specified, origin validation is disabled.
+     * @deprecated Use external middleware for origin validation instead.
+     */
+    allowedOrigins?: string[];
+    /**
+     * Enable DNS rebinding protection (requires allowedHosts and/or allowedOrigins to be configured).
+     * Default is false for backwards compatibility.
+     * @deprecated Use external middleware for DNS rebinding protection instead.
+     */
+    enableDnsRebindingProtection?: boolean;
+    /**
+     * Retry interval in milliseconds to suggest to clients in SSE retry field.
+     * When set, the server will send a retry field in SSE priming events to control
+     * client reconnection timing for polling behavior.
+     */
+    retryInterval?: number;
+}
+/**
+ * Options for handling a request
+ */
+export interface HandleRequestOptions {
+    /**
+     * Pre-parsed request body. If provided, the transport will use this instead of parsing req.json().
+     * Useful when using body-parser middleware that has already parsed the body.
+     */
+    parsedBody?: unknown;
+    /**
+     * Authentication info from middleware. If provided, will be passed to message handlers.
+     */
+    authInfo?: AuthInfo;
+}
+/**
+ * Server transport for Web Standards Streamable HTTP: this implements the MCP Streamable HTTP transport specification
+ * using Web Standard APIs (Request, Response, ReadableStream).
+ *
+ * This transport works on any runtime that supports Web Standards: Node.js 18+, Cloudflare Workers, Deno, Bun, etc.
+ *
+ * Usage example:
+ *
+ * ```typescript
+ * // Stateful mode - server sets the session ID
+ * const statefulTransport = new WebStandardStreamableHTTPServerTransport({
+ *   sessionIdGenerator: () => crypto.randomUUID(),
+ * });
+ *
+ * // Stateless mode - explicitly set session ID to undefined
+ * const statelessTransport = new WebStandardStreamableHTTPServerTransport({
+ *   sessionIdGenerator: undefined,
+ * });
+ *
+ * // Hono.js usage
+ * app.all('/mcp', async (c) => {
+ *   return transport.handleRequest(c.req.raw);
+ * });
+ *
+ * // Cloudflare Workers usage
+ * export default {
+ *   async fetch(request: Request): Promise<Response> {
+ *     return transport.handleRequest(request);
+ *   }
+ * };
+ * ```
+ *
+ * In stateful mode:
+ * - Session ID is generated and included in response headers
+ * - Session ID is always included in initialization responses
+ * - Requests with invalid session IDs are rejected with 404 Not Found
+ * - Non-initialization requests without a session ID are rejected with 400 Bad Request
+ * - State is maintained in-memory (connections, message history)
+ *
+ * In stateless mode:
+ * - No Session ID is included in any responses
+ * - No session validation is performed
+ */
+export declare class WebStandardStreamableHTTPServerTransport implements Transport {
+    private sessionIdGenerator;
+    private _started;
+    private _hasHandledRequest;
+    private _streamMapping;
+    private _requestToStreamMapping;
+    private _requestResponseMap;
+    private _initialized;
+    private _enableJsonResponse;
+    private _standaloneSseStreamId;
+    private _eventStore?;
+    private _onsessioninitialized?;
+    private _onsessionclosed?;
+    private _allowedHosts?;
+    private _allowedOrigins?;
+    private _enableDnsRebindingProtection;
+    private _retryInterval?;
+    sessionId?: string;
+    onclose?: () => void;
+    onerror?: (error: Error) => void;
+    onmessage?: (message: JSONRPCMessage, extra?: MessageExtraInfo) => void;
+    constructor(options?: WebStandardStreamableHTTPServerTransportOptions);
+    /**
+     * Starts the transport. This is required by the Transport interface but is a no-op
+     * for the Streamable HTTP transport as connections are managed per-request.
+     */
+    start(): Promise<void>;
+    /**
+     * Helper to create a JSON error response
+     */
+    private createJsonErrorResponse;
+    /**
+     * Validates request headers for DNS rebinding protection.
+     * @returns Error response if validation fails, undefined if validation passes.
+     */
+    private validateRequestHeaders;
+    /**
+     * Handles an incoming HTTP request, whether GET, POST, or DELETE
+     * Returns a Response object (Web Standard)
+     */
+    handleRequest(req: Request, options?: HandleRequestOptions): Promise<Response>;
+    /**
+     * Writes a priming event to establish resumption capability.
+     * Only sends if eventStore is configured (opt-in for resumability) and
+     * the client's protocol version supports empty SSE data (>= 2025-11-25).
+     */
+    private writePrimingEvent;
+    /**
+     * Handles GET requests for SSE stream
+     */
+    private handleGetRequest;
+    /**
+     * Replays events that would have been sent after the specified event ID
+     * Only used when resumability is enabled
+     */
+    private replayEvents;
+    /**
+     * Writes an event to an SSE stream via controller with proper formatting
+     */
+    private writeSSEEvent;
+    /**
+     * Handles unsupported requests (PUT, PATCH, etc.)
+     */
+    private handleUnsupportedRequest;
+    /**
+     * Handles POST requests containing JSON-RPC messages
+     */
+    private handlePostRequest;
+    /**
+     * Handles DELETE requests to terminate sessions
+     */
+    private handleDeleteRequest;
+    /**
+     * Validates session ID for non-initialization requests.
+     * Returns Response error if invalid, undefined otherwise
+     */
+    private validateSession;
+    /**
+     * Validates the MCP-Protocol-Version header on incoming requests.
+     *
+     * For initialization: Version negotiation handles unknown versions gracefully
+     * (server responds with its supported version).
+     *
+     * For subsequent requests with MCP-Protocol-Version header:
+     * - Accept if in supported list
+     * - 400 if unsupported
+     *
+     * For HTTP requests without the MCP-Protocol-Version header:
+     * - Accept and default to the version negotiated at initialization
+     */
+    private validateProtocolVersion;
+    close(): Promise<void>;
+    /**
+     * Close an SSE stream for a specific request, triggering client reconnection.
+     * Use this to implement polling behavior during long-running operations -
+     * client will reconnect after the retry interval specified in the priming event.
+     */
+    closeSSEStream(requestId: RequestId): void;
+    /**
+     * Close the standalone GET SSE stream, triggering client reconnection.
+     * Use this to implement polling behavior for server-initiated notifications.
+     */
+    closeStandaloneSSEStream(): void;
+    send(message: JSONRPCMessage, options?: {
+        relatedRequestId?: RequestId;
+    }): Promise<void>;
+}
+//# sourceMappingURL=webStandardStreamableHttp.d.ts.map

package/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/webStandardStreamableHttp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webStandardStreamableHttp.d.ts","sourceRoot":"","sources":["../../../src/server/webStandardStreamableHttp.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EACH,gBAAgB,EAMhB,cAAc,EAEd,SAAS,EAGZ,MAAM,aAAa,CAAC;AAErB,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC;AAC9B,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC;AAE7B;;GAEG;AACH,MAAM,WAAW,UAAU;IACvB;;;;;OAKG;IACH,UAAU,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE1E;;;;;;;OAOG;IACH,qBAAqB,CAAC,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;IAExE,iBAAiB,CACb,WAAW,EAAE,OAAO,EACpB,EACI,IAAI,EACP,EAAE;QACC,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;KACtE,GACF,OAAO,CAAC,QAAQ,CAAC,CAAC;CACxB;AAgBD;;GAEG;AACH,MAAM,WAAW,+CAA+C;IAC5D;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,MAAM,CAAC;IAElC;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnE;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9D;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAE7B;;;OAGG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IAExB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IAExB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAE1B;;;;OAIG;IACH,4BAA4B,CAAC,EAAE,OAAO,CAAC;IAEvC;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACjC;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB;;OAEG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,qBAAa,wCAAyC,YAAW,SAAS;IAEtE,OAAO,CAAC,kBAAkB,CAA6B;IACvD,OAAO,CAAC,QAAQ,CAAkB;IAClC,OAAO,CAAC,kBAAkB,CAAkB;IAC5C,OAAO,CAAC,cAAc,CAAyC;IAC/D,OAAO,CAAC,uBAAuB,CAAqC;IACpE,OAAO,CAAC,mBAAmB,CAA6C;IACxE,OAAO,CAAC,YAAY,CAAkB;IACtC,OAAO,CAAC,mBAAmB,CAAkB;IAC7C,OAAO,CAAC,sBAAsB,CAAyB;IACvD,OAAO,CAAC,WAAW,CAAC,CAAa;IACjC,OAAO,CAAC,qBAAqB,CAAC,CAA8C;IAC5E,OAAO,CAAC,gBAAgB,CAAC,CAA8C;IACvE,OAAO,CAAC,aAAa,CAAC,CAAW;IACjC,OAAO,CAAC,eAAe,CAAC,CAAW;IACnC,OAAO,CAAC,6BAA6B,CAAU;IAC/C,OAAO,CAAC,cAAc,CAAC,CAAS;IAEhC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;IACrB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACjC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,CAAC,EAAE,gBAAgB,KAAK,IAAI,CAAC;gBAE5D,OAAO,GAAE,+CAAoD;IAYzE;;;OAGG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAO5B;;OAEG;IACH,OAAO,CAAC,uBAAuB;IA0B/B;;;OAGG;IACH,OAAO,CAAC,sBAAsB;IA6B9B;;;OAGG;IACG,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,QAAQ,CAAC;IA0BpF;;;;OAIG;YACW,iBAAiB;IA0B/B;;OAEG;YACW,gBAAgB;IA6E9B;;;OAGG;YACW,YAAY;IAmF1B;;OAEG;IACH,OAAO,CAAC,aAAa;IAqBrB;;OAEG;IACH,OAAO,CAAC,wBAAwB;IAqBhC;;OAEG;YACW,iBAAiB;IAqN/B;;OAEG;YACW,mBAAmB;IAejC;;;OAGG;IACH,OAAO,CAAC,eAAe;IA6BvB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,uBAAuB;IAmBzB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAY5B;;;;OAIG;IACH,cAAc,CAAC,SAAS,EAAE,SAAS,GAAG,IAAI;IAU1C;;;OAGG;IACH,wBAAwB,IAAI,IAAI;IAO1B,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,SAAS,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAiGjG"}