langflow-mcp-server 4.11.0 → 4.12.2

package/dist/index.js

@@ -14,10 +14,14 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LangflowMCPServer = exports.LangflowClient = void 0;
+exports.LangflowMCPHttpServer = exports.LangflowMCPServerConsolidated = exports.LangflowMCPServer = exports.LangflowClient = void 0;
 __exportStar(require("./types"), exports);
 var langflow_client_1 = require("./services/langflow-client");
 Object.defineProperty(exports, "LangflowClient", { enumerable: true, get: function () { return langflow_client_1.LangflowClient; } });
 var server_1 = require("./mcp/server");
 Object.defineProperty(exports, "LangflowMCPServer", { enumerable: true, get: function () { return server_1.LangflowMCPServer; } });
+var server_consolidated_1 = require("./mcp/server-consolidated");
+Object.defineProperty(exports, "LangflowMCPServerConsolidated", { enumerable: true, get: function () { return server_consolidated_1.LangflowMCPServerConsolidated; } });
+var http_1 = require("./mcp/http");
+Object.defineProperty(exports, "LangflowMCPHttpServer", { enumerable: true, get: function () { return http_1.LangflowMCPHttpServer; } });
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,0CAAwB;AACxB,8DAA4D;AAAnD,iHAAA,cAAc,OAAA;AACvB,uCAAiD;AAAxC,2GAAA,iBAAiB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,0CAAwB;AACxB,8DAA4D;AAAnD,iHAAA,cAAc,OAAA;AACvB,uCAAiD;AAAxC,2GAAA,iBAAiB,OAAA;AAC1B,iEAA0E;AAAjE,oIAAA,6BAA6B,OAAA;AACtC,mCAAmD;AAA1C,6GAAA,qBAAqB,OAAA"}

package/dist/mcp/http.d.ts

@@ -0,0 +1,69 @@
+import type { AddressInfo } from 'node:net';
+import type { Transport } from '@modelcontextprotocol/sdk/shared/transport.js';
+interface McpServerInstance {
+    connectTransport(transport: Transport): Promise<void>;
+    shutdown(): Promise<void>;
+}
+export interface LangflowMCPHttpServerOptions {
+    host?: string;
+    port?: number;
+    authToken?: string;
+    allowedOrigins?: string[];
+    enableJsonResponse?: boolean;
+    maxSessions?: number;
+    sessionIdleTimeoutMs?: number;
+    maxConcurrentRequests?: number;
+    maxConcurrentBodyBytes?: number;
+    requestBodyTimeoutMs?: number;
+    shutdownTimeoutMs?: number;
+    createMcpServer: () => McpServerInstance;
+}
+export declare class LangflowMCPHttpServer {
+    private readonly host;
+    private readonly port;
+    private readonly authToken?;
+    private readonly allowedOrigins;
+    private readonly enableJsonResponse;
+    private readonly maxSessions;
+    private readonly sessionIdleTimeoutMs;
+    private readonly maxConcurrentRequests;
+    private readonly maxConcurrentBodyBytes;
+    private readonly requestBodyTimeoutMs;
+    private readonly shutdownTimeoutMs;
+    private readonly createMcpServer;
+    private readonly httpServer;
+    private readonly sockets;
+    private readonly sessions;
+    private readonly activeRequests;
+    private activeBodyBytes;
+    private pendingSessions;
+    private lifecycle;
+    private sessionSweep?;
+    private startPromise?;
+    private shutdownPromise?;
+    constructor(options: LangflowMCPHttpServerOptions);
+    getAddress(): AddressInfo | null;
+    start(): Promise<void>;
+    shutdown(): Promise<void>;
+    private acceptRequest;
+    private performShutdown;
+    private waitForCompletion;
+    private closeHttpServer;
+    private handleRequest;
+    private handlePost;
+    private handleSessionRequest;
+    private createSession;
+    private closeSession;
+    private readJsonBody;
+    private readBodyContent;
+    private handleSessionTransport;
+    private startSessionSweep;
+    private stopSessionSweep;
+    private isAuthorized;
+    private isAllowedOrigin;
+    private setCorsHeaders;
+    private sendJson;
+    private sendError;
+}
+export {};
+//# sourceMappingURL=http.d.ts.map

package/dist/mcp/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/mcp/http.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAU,MAAM,UAAU,CAAC;AAIpD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+CAA+C,CAAC;AAE/E,UAAU,iBAAiB;IACzB,gBAAgB,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAID,MAAM,WAAW,4BAA4B;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,EAAE,MAAM,iBAAiB,CAAC;CAC1C;AA6FD,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAW;IAC1C,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAU;IAC7C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAS;IAC9C,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAS;IAC/C,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAS;IAChD,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAS;IAC9C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;IAC3C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA0B;IAC1D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAiB;IAC5C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiC;IAC1D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAgC;IAC/D,OAAO,CAAC,eAAe,CAAK;IAC5B,OAAO,CAAC,eAAe,CAAK;IAC5B,OAAO,CAAC,SAAS,CAA4B;IAC7C,OAAO,CAAC,YAAY,CAAC,CAAiB;IACtC,OAAO,CAAC,YAAY,CAAC,CAAgB;IACrC,OAAO,CAAC,eAAe,CAAC,CAAgB;IAExC,YAAY,OAAO,EAAE,4BAA4B,EAsEhD;IAED,UAAU,IAAI,WAAW,GAAG,IAAI,CAG/B;IAEK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAwC3B;IAEK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAQ9B;IAED,OAAO,CAAC,aAAa;YA+BP,eAAe;YAwBf,iBAAiB;YAiBjB,eAAe;YAsBf,aAAa;YAyEb,UAAU;YAuCV,oBAAoB;YAgBpB,aAAa;YAsEb,YAAY;YAwBZ,YAAY;YAiCZ,eAAe;YAyCf,sBAAsB;IAoBpC,OAAO,CAAC,iBAAiB;IAezB,OAAO,CAAC,gBAAgB;IAMxB,OAAO,CAAC,YAAY;IAKpB,OAAO,CAAC,eAAe;IAKvB,OAAO,CAAC,cAAc;IAStB,OAAO,CAAC,QAAQ;IAMhB,OAAO,CAAC,SAAS;CAiBlB"}

package/dist/mcp/http.js

@@ -0,0 +1,595 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LangflowMCPHttpServer = void 0;
+const node_crypto_1 = require("node:crypto");
+const node_http_1 = require("node:http");
+const types_js_1 = require("@modelcontextprotocol/sdk/types.js");
+const streamableHttp_js_1 = require("@modelcontextprotocol/sdk/server/streamableHttp.js");
+const logger_1 = require("../utils/logger");
+class HttpRequestError extends Error {
+    constructor(statusCode, errorCode, message, headers = {}) {
+        super(message);
+        this.statusCode = statusCode;
+        this.errorCode = errorCode;
+        this.headers = headers;
+        this.name = 'HttpRequestError';
+    }
+}
+const DEFAULT_HOST = '127.0.0.1';
+const DEFAULT_PORT = 3000;
+const MAX_BODY_BYTES = 20 * 1024 * 1024;
+const DEFAULT_MAX_SESSIONS = 100;
+const DEFAULT_SESSION_IDLE_TIMEOUT_MS = 30 * 60 * 1000;
+const DEFAULT_MAX_CONCURRENT_REQUESTS = 100;
+const DEFAULT_MAX_CONCURRENT_BODY_BYTES = 64 * 1024 * 1024;
+const DEFAULT_REQUEST_BODY_TIMEOUT_MS = 30 * 1000;
+const DEFAULT_SHUTDOWN_TIMEOUT_MS = 5 * 1000;
+const MCP_PATH = '/mcp';
+function parsePort(value) {
+    if (value === undefined || value.trim() === '')
+        return DEFAULT_PORT;
+    const port = Number(value);
+    if (!Number.isInteger(port) || port < 0 || port > 65535) {
+        throw new Error('PORT must be an integer between 0 and 65535');
+    }
+    return port;
+}
+function validatePort(port) {
+    if (!Number.isInteger(port) || port < 0 || port > 65535) {
+        throw new Error('PORT must be an integer between 0 and 65535');
+    }
+    return port;
+}
+function parsePositiveInteger(value, fallback, name) {
+    if (value === undefined || value.trim() === '')
+        return fallback;
+    const parsed = Number(value);
+    if (!Number.isSafeInteger(parsed) || parsed < 1) {
+        throw new Error(`${name} must be a positive integer`);
+    }
+    return parsed;
+}
+function validatePositiveInteger(value, name) {
+    if (!Number.isSafeInteger(value) || value < 1) {
+        throw new Error(`${name} must be a positive integer`);
+    }
+    return value;
+}
+function parseOrigins(value) {
+    if (!value)
+        return [];
+    return value
+        .split(',')
+        .map(origin => origin.trim())
+        .filter(Boolean);
+}
+function singleHeader(value) {
+    return Array.isArray(value) ? value[0] : value;
+}
+function isLoopbackHost(host) {
+    const normalized = host.trim().toLowerCase().replace(/^\[|\]$/g, '');
+    return normalized === 'localhost' || normalized === '127.0.0.1' || normalized === '::1';
+}
+class LangflowMCPHttpServer {
+    constructor(options) {
+        this.sockets = new Set();
+        this.sessions = new Map();
+        this.activeRequests = new Set();
+        this.activeBodyBytes = 0;
+        this.pendingSessions = 0;
+        this.lifecycle = 'created';
+        this.host = options.host ?? process.env.HOST ?? DEFAULT_HOST;
+        this.port = options.port === undefined
+            ? parsePort(process.env.PORT)
+            : validatePort(options.port);
+        this.authToken = options.authToken ?? (process.env.AUTH_TOKEN?.trim() || undefined);
+        this.allowedOrigins = options.allowedOrigins ?? parseOrigins(process.env.MCP_ALLOWED_ORIGINS);
+        this.enableJsonResponse = options.enableJsonResponse ?? process.env.MCP_HTTP_JSON_RESPONSES === 'true';
+        this.maxSessions = validatePositiveInteger(options.maxSessions ?? parsePositiveInteger(process.env.MCP_MAX_SESSIONS, DEFAULT_MAX_SESSIONS, 'MCP_MAX_SESSIONS'), 'maxSessions');
+        this.sessionIdleTimeoutMs = validatePositiveInteger(options.sessionIdleTimeoutMs ?? parsePositiveInteger(process.env.MCP_SESSION_IDLE_TIMEOUT_MS, DEFAULT_SESSION_IDLE_TIMEOUT_MS, 'MCP_SESSION_IDLE_TIMEOUT_MS'), 'sessionIdleTimeoutMs');
+        this.maxConcurrentRequests = validatePositiveInteger(options.maxConcurrentRequests ?? parsePositiveInteger(process.env.MCP_MAX_CONCURRENT_REQUESTS, DEFAULT_MAX_CONCURRENT_REQUESTS, 'MCP_MAX_CONCURRENT_REQUESTS'), 'maxConcurrentRequests');
+        this.maxConcurrentBodyBytes = validatePositiveInteger(options.maxConcurrentBodyBytes ?? parsePositiveInteger(process.env.MCP_MAX_CONCURRENT_BODY_BYTES, DEFAULT_MAX_CONCURRENT_BODY_BYTES, 'MCP_MAX_CONCURRENT_BODY_BYTES'), 'maxConcurrentBodyBytes');
+        if (this.maxConcurrentBodyBytes < MAX_BODY_BYTES) {
+            throw new Error(`maxConcurrentBodyBytes must be at least ${MAX_BODY_BYTES}`);
+        }
+        this.requestBodyTimeoutMs = validatePositiveInteger(options.requestBodyTimeoutMs ?? parsePositiveInteger(process.env.MCP_REQUEST_BODY_TIMEOUT_MS, DEFAULT_REQUEST_BODY_TIMEOUT_MS, 'MCP_REQUEST_BODY_TIMEOUT_MS'), 'requestBodyTimeoutMs');
+        this.shutdownTimeoutMs = validatePositiveInteger(options.shutdownTimeoutMs ?? parsePositiveInteger(process.env.MCP_SHUTDOWN_TIMEOUT_MS, DEFAULT_SHUTDOWN_TIMEOUT_MS, 'MCP_SHUTDOWN_TIMEOUT_MS'), 'shutdownTimeoutMs');
+        this.createMcpServer = options.createMcpServer;
+        if (this.allowedOrigins.includes('*')) {
+            throw new Error('MCP_ALLOWED_ORIGINS must contain exact origins; wildcard origins are not allowed');
+        }
+        if (!isLoopbackHost(this.host) && !this.authToken) {
+            throw new Error('AUTH_TOKEN is required when HTTP mode binds to a non-loopback host');
+        }
+        this.httpServer = (0, node_http_1.createServer)((request, response) => this.acceptRequest(request, response));
+        this.httpServer.on('connection', socket => {
+            this.sockets.add(socket);
+            socket.once('close', () => this.sockets.delete(socket));
+        });
+    }
+    getAddress() {
+        const address = this.httpServer.address();
+        return address && typeof address !== 'string' ? address : null;
+    }
+    async start() {
+        if (this.lifecycle !== 'created') {
+            throw new Error('HTTP server is already running');
+        }
+        this.lifecycle = 'starting';
+        const listenPromise = new Promise((resolve, reject) => {
+            const onError = (error) => {
+                this.httpServer.off('listening', onListening);
+                reject(error);
+            };
+            const onListening = () => {
+                this.httpServer.off('error', onError);
+                resolve();
+            };
+            this.httpServer.once('error', onError);
+            this.httpServer.once('listening', onListening);
+            this.httpServer.listen(this.port, this.host);
+        });
+        this.startPromise = listenPromise;
+        try {
+            await listenPromise;
+            if (this.lifecycle !== 'starting') {
+                await this.closeHttpServer();
+                return;
+            }
+            this.lifecycle = 'running';
+            this.startSessionSweep();
+        }
+        catch (error) {
+            this.lifecycle = 'stopped';
+            throw error;
+        }
+        finally {
+            if (this.startPromise === listenPromise)
+                this.startPromise = undefined;
+        }
+        const address = this.getAddress();
+        logger_1.logger.info(`Langflow MCP server running on Streamable HTTP at ${this.host}:${address?.port ?? this.port}${MCP_PATH}`);
+    }
+    async shutdown() {
+        if (this.shutdownPromise)
+            return this.shutdownPromise;
+        if (this.lifecycle === 'stopped')
+            return;
+        this.lifecycle = 'stopping';
+        const shutdownPromise = this.performShutdown();
+        this.shutdownPromise = shutdownPromise;
+        await shutdownPromise;
+    }
+    acceptRequest(request, response) {
+        if (this.lifecycle !== 'running') {
+            request.resume();
+            this.sendError(response, 503, -32000, 'MCP server is shutting down');
+            return;
+        }
+        if (this.activeRequests.size >= this.maxConcurrentRequests) {
+            request.resume();
+            this.sendError(response, 429, -32000, 'Too many concurrent MCP requests', { 'Retry-After': '1' });
+            return;
+        }
+        const promise = this.handleRequest(request, response);
+        const activeRequest = { request, response, promise };
+        this.activeRequests.add(activeRequest);
+        void promise
+            .catch(error => {
+            logger_1.logger.error('MCP HTTP request failed unexpectedly:', error);
+            if (!response.headersSent) {
+                this.sendError(response, 500, -32603, 'Internal server error');
+            }
+            else if (!response.writableEnded) {
+                response.destroy(error instanceof Error ? error : undefined);
+            }
+        })
+            .finally(() => {
+            this.activeRequests.delete(activeRequest);
+        });
+    }
+    async performShutdown() {
+        this.stopSessionSweep();
+        if (this.startPromise) {
+            await this.waitForCompletion(this.startPromise);
+        }
+        const sessions = Array.from(this.sessions.values());
+        this.sessions.clear();
+        for (const session of sessions)
+            session.closing = true;
+        const sessionCleanup = Promise.allSettled(sessions.map(session => this.closeSession(session)));
+        await this.waitForCompletion(sessionCleanup);
+        for (const activeRequest of this.activeRequests) {
+            activeRequest.request.destroy();
+            activeRequest.response.destroy();
+        }
+        for (const socket of this.sockets)
+            socket.destroy();
+        await this.closeHttpServer();
+        this.lifecycle = 'stopped';
+    }
+    async waitForCompletion(promise) {
+        let timer;
+        try {
+            await Promise.race([
+                promise,
+                new Promise(resolve => {
+                    timer = setTimeout(resolve, this.shutdownTimeoutMs);
+                    timer.unref();
+                })
+            ]);
+        }
+        catch (error) {
+            logger_1.logger.error('MCP HTTP cleanup failed:', error);
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+        }
+    }
+    async closeHttpServer() {
+        if (!this.httpServer.listening)
+            return;
+        const closePromise = new Promise((resolve, reject) => {
+            this.httpServer.close(error => {
+                if (error && error.code !== 'ERR_SERVER_NOT_RUNNING') {
+                    reject(error);
+                    return;
+                }
+                resolve();
+            });
+        });
+        this.httpServer.closeAllConnections();
+        this.httpServer.closeIdleConnections();
+        for (const socket of this.sockets)
+            socket.destroy();
+        await this.waitForCompletion(closePromise);
+        this.httpServer.closeAllConnections();
+        this.httpServer.closeIdleConnections();
+        for (const socket of this.sockets)
+            socket.destroy();
+    }
+    async handleRequest(request, response) {
+        this.setCorsHeaders(request, response);
+        const requestPath = new URL(request.url ?? '/', 'http://localhost').pathname;
+        if (requestPath === '/health' && request.method === 'GET') {
+            this.sendJson(response, 200, { status: 'ok' });
+            return;
+        }
+        if (requestPath !== MCP_PATH) {
+            request.resume();
+            this.sendError(response, 404, -32601, 'Not found');
+            return;
+        }
+        if (!this.isAllowedOrigin(request)) {
+            request.resume();
+            this.sendError(response, 403, -32000, 'Origin is not allowed');
+            return;
+        }
+        if (request.method === 'OPTIONS') {
+            request.resume();
+            response.statusCode = 204;
+            response.setHeader('Allow', 'GET, POST, DELETE, OPTIONS');
+            response.setHeader('Access-Control-Allow-Methods', 'GET, POST, DELETE, OPTIONS');
+            response.setHeader('Access-Control-Allow-Headers', 'Authorization, Content-Type, Mcp-Session-Id, MCP-Protocol-Version, Last-Event-ID');
+            response.end();
+            return;
+        }
+        if (!['GET', 'POST', 'DELETE'].includes(request.method ?? '')) {
+            request.resume();
+            response.setHeader('Allow', 'GET, POST, DELETE, OPTIONS');
+            this.sendError(response, 405, -32601, 'Method not allowed');
+            return;
+        }
+        if (!this.isAuthorized(request)) {
+            request.resume();
+            this.sendError(response, 401, -32000, 'Unauthorized', { 'WWW-Authenticate': 'Bearer' });
+            return;
+        }
+        response.setHeader('Cache-Control', 'no-cache, no-transform');
+        response.setHeader('X-Accel-Buffering', 'no');
+        try {
+            if (request.method === 'POST') {
+                await this.handlePost(request, response);
+                return;
+            }
+            await this.handleSessionRequest(request, response);
+        }
+        catch (error) {
+            if (response.headersSent) {
+                logger_1.logger.error('MCP HTTP request failed after response headers were sent');
+                return;
+            }
+            if (error instanceof HttpRequestError) {
+                this.sendError(response, error.statusCode, error.errorCode, error.message, error.headers);
+                return;
+            }
+            logger_1.logger.error('MCP HTTP request failed');
+            this.sendError(response, 500, -32603, 'Internal server error');
+        }
+    }
+    async handlePost(request, response) {
+        let body;
+        try {
+            body = await this.readJsonBody(request);
+        }
+        catch (error) {
+            request.resume();
+            throw error;
+        }
+        if (Array.isArray(body)) {
+            this.sendError(response, 400, -32600, 'Batch JSON-RPC requests are not supported');
+            return;
+        }
+        const sessionId = singleHeader(request.headers['mcp-session-id']);
+        if (sessionId) {
+            const session = this.sessions.get(sessionId);
+            if (!session) {
+                this.sendError(response, 404, -32001, 'Session not found');
+                return;
+            }
+            await this.handleSessionTransport(session, request, response, body);
+            return;
+        }
+        if (!(0, types_js_1.isInitializeRequest)(body)) {
+            this.sendError(response, 400, -32000, 'A valid MCP initialize request is required');
+            return;
+        }
+        const session = await this.createSession();
+        try {
+            await this.handleSessionTransport(session, request, response, body);
+        }
+        catch (error) {
+            await this.closeSession(session);
+            throw error;
+        }
+    }
+    async handleSessionRequest(request, response) {
+        const sessionId = singleHeader(request.headers['mcp-session-id']);
+        if (!sessionId) {
+            this.sendError(response, 400, -32000, 'Mcp-Session-Id header is required');
+            return;
+        }
+        const session = this.sessions.get(sessionId);
+        if (!session) {
+            this.sendError(response, 404, -32001, 'Session not found');
+            return;
+        }
+        await this.handleSessionTransport(session, request, response);
+    }
+    async createSession() {
+        if (this.sessions.size + this.pendingSessions >= this.maxSessions) {
+            throw new HttpRequestError(429, -32000, 'Maximum MCP session limit reached', { 'Retry-After': '1' });
+        }
+        this.pendingSessions += 1;
+        let reservationReleased = false;
+        const releaseReservation = () => {
+            if (reservationReleased)
+                return;
+            reservationReleased = true;
+            this.pendingSessions -= 1;
+        };
+        let server;
+        let session;
+        try {
+            server = this.createMcpServer();
+            const transport = new streamableHttp_js_1.StreamableHTTPServerTransport({
+                sessionIdGenerator: () => (0, node_crypto_1.randomUUID)(),
+                enableJsonResponse: this.enableJsonResponse,
+                allowedOrigins: this.allowedOrigins.length > 0 ? this.allowedOrigins : undefined,
+                enableDnsRebindingProtection: this.allowedOrigins.length > 0,
+                onsessioninitialized: sessionId => {
+                    releaseReservation();
+                    if (session && this.lifecycle === 'running' && !session.closing) {
+                        this.sessions.set(sessionId, session);
+                        session.lastActivityAt = Date.now();
+                    }
+                }
+            });
+            session = {
+                server,
+                transport,
+                lastActivityAt: Date.now(),
+                activeRequests: 0,
+                closing: false,
+                closeInitiated: false
+            };
+            transport.onclose = () => {
+                releaseReservation();
+                const sessionId = transport.sessionId;
+                if (sessionId && this.sessions.get(sessionId) === session) {
+                    this.sessions.delete(sessionId);
+                }
+                if (!session || session.closeInitiated)
+                    return;
+                const currentSession = session;
+                currentSession.closeInitiated = true;
+                currentSession.closing = true;
+                const shutdownPromise = Promise.resolve()
+                    .then(() => currentSession.server.shutdown())
+                    .catch(error => {
+                    logger_1.logger.error('MCP session shutdown failed:', error);
+                });
+                currentSession.closePromise = shutdownPromise;
+            };
+            await server.connectTransport(transport);
+            if (this.lifecycle !== 'running') {
+                await this.closeSession(session);
+                throw new HttpRequestError(503, -32000, 'MCP server is shutting down');
+            }
+            return session;
+        }
+        catch (error) {
+            if (session)
+                await this.closeSession(session);
+            releaseReservation();
+            throw error;
+        }
+    }
+    async closeSession(session) {
+        if (session.closePromise) {
+            await session.closePromise;
+            return;
+        }
+        session.closing = true;
+        session.closeInitiated = true;
+        const sessionId = session.transport.sessionId;
+        if (sessionId && this.sessions.get(sessionId) === session) {
+            this.sessions.delete(sessionId);
+        }
+        const closePromise = (async () => {
+            try {
+                await session.transport.close();
+            }
+            finally {
+                await session.server.shutdown();
+            }
+        })();
+        session.closePromise = closePromise;
+        await closePromise;
+    }
+    async readJsonBody(request) {
+        const contentLength = singleHeader(request.headers['content-length']);
+        if (contentLength !== undefined) {
+            const declaredLength = Number(contentLength);
+            if (!Number.isSafeInteger(declaredLength) || declaredLength < 0) {
+                throw new HttpRequestError(400, -32700, 'Invalid Content-Length');
+            }
+            if (declaredLength > MAX_BODY_BYTES) {
+                throw new HttpRequestError(413, -32000, 'Request body is too large');
+            }
+        }
+        const bodyPromise = this.readBodyContent(request, contentLength);
+        let timer;
+        try {
+            return await Promise.race([
+                bodyPromise,
+                new Promise((_, reject) => {
+                    timer = setTimeout(() => {
+                        request.destroy();
+                        reject(new HttpRequestError(408, -32000, 'Request body timed out'));
+                    }, this.requestBodyTimeoutMs);
+                    timer.unref();
+                })
+            ]);
+        }
+        catch (error) {
+            void bodyPromise.catch(() => undefined);
+            throw error;
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+        }
+    }
+    async readBodyContent(request, contentLength) {
+        const declaredLength = contentLength === undefined ? 0 : Number(contentLength);
+        let reservedBytes = 0;
+        const reserveBytes = (bytes) => {
+            if (bytes <= 0)
+                return;
+            if (this.activeBodyBytes + bytes > this.maxConcurrentBodyBytes) {
+                throw new HttpRequestError(429, -32000, 'Too many concurrent request bodies', { 'Retry-After': '1' });
+            }
+            this.activeBodyBytes += bytes;
+            reservedBytes += bytes;
+        };
+        try {
+            reserveBytes(declaredLength);
+            const chunks = [];
+            let totalBytes = 0;
+            for await (const chunk of request) {
+                const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+                totalBytes += buffer.length;
+                if (totalBytes > MAX_BODY_BYTES) {
+                    throw new HttpRequestError(413, -32000, 'Request body is too large');
+                }
+                reserveBytes(totalBytes - reservedBytes);
+                chunks.push(buffer);
+            }
+            if (chunks.length === 0) {
+                throw new HttpRequestError(400, -32700, 'Request body is required');
+            }
+            try {
+                return JSON.parse(Buffer.concat(chunks).toString('utf8'));
+            }
+            catch {
+                throw new HttpRequestError(400, -32700, 'Parse error');
+            }
+        }
+        finally {
+            this.activeBodyBytes -= reservedBytes;
+        }
+    }
+    async handleSessionTransport(session, request, response, body) {
+        if (session.closing || this.lifecycle !== 'running') {
+            throw new HttpRequestError(503, -32000, 'MCP session is closing');
+        }
+        session.activeRequests += 1;
+        session.lastActivityAt = Date.now();
+        try {
+            await session.transport.handleRequest(request, response, body);
+        }
+        finally {
+            session.activeRequests -= 1;
+            session.lastActivityAt = Date.now();
+        }
+    }
+    startSessionSweep() {
+        const intervalMs = Math.min(this.sessionIdleTimeoutMs, 60000);
+        this.sessionSweep = setInterval(() => {
+            const cutoff = Date.now() - this.sessionIdleTimeoutMs;
+            for (const session of this.sessions.values()) {
+                if (!session.closing && session.activeRequests === 0 && session.lastActivityAt <= cutoff) {
+                    void this.closeSession(session).catch(error => {
+                        logger_1.logger.error('Idle MCP session cleanup failed:', error);
+                    });
+                }
+            }
+        }, intervalMs);
+        this.sessionSweep.unref();
+    }
+    stopSessionSweep() {
+        if (!this.sessionSweep)
+            return;
+        clearInterval(this.sessionSweep);
+        this.sessionSweep = undefined;
+    }
+    isAuthorized(request) {
+        if (!this.authToken)
+            return true;
+        return singleHeader(request.headers.authorization) === `Bearer ${this.authToken}`;
+    }
+    isAllowedOrigin(request) {
+        const origin = singleHeader(request.headers.origin);
+        return !origin || this.allowedOrigins.includes(origin);
+    }
+    setCorsHeaders(request, response) {
+        const origin = singleHeader(request.headers.origin);
+        if (origin && this.allowedOrigins.includes(origin)) {
+            response.setHeader('Access-Control-Allow-Origin', origin);
+            response.setHeader('Vary', 'Origin');
+        }
+        response.setHeader('Access-Control-Expose-Headers', 'Mcp-Session-Id');
+    }
+    sendJson(response, statusCode, body) {
+        response.statusCode = statusCode;
+        response.setHeader('Content-Type', 'application/json');
+        response.end(JSON.stringify(body));
+    }
+    sendError(response, statusCode, errorCode, message, headers = {}) {
+        if (response.headersSent)
+            return;
+        response.statusCode = statusCode;
+        response.setHeader('Content-Type', 'application/json');
+        for (const [key, value] of Object.entries(headers))
+            response.setHeader(key, value);
+        response.end(JSON.stringify({
+            jsonrpc: '2.0',
+            error: { code: errorCode, message },
+            id: null
+        }));
+    }
+}
+exports.LangflowMCPHttpServer = LangflowMCPHttpServer;
+//# sourceMappingURL=http.js.map