fixing jsonSchema validation by using zod

specs/001-mock-gds-server/tasks.md

@@ -19,11 +19,11 @@
 
 **Purpose**: Project initialization and basic structure from plan.md
 
-- [ ] T001 Initialize Node.js 20 project with package.json including @modelcontextprotocol/sdk, ioredis, pino dependencies
-- [ ] T002 Create project directory structure: src/{tools,data,session,validation,utils}/, tests/{integration,unit,fixtures}/, docker/
-- [ ] T003 [P] Configure ESLint and Prettier for code quality in .eslintrc.json and .prettierrc
-- [ ] T004 [P] Create .dockerignore and .gitignore files for build optimization
-- [ ] T005 [P] Create docker-compose.yaml with Valkey service configuration (port 6379, persistence enabled)
+- [X] T001 Initialize Node.js 20 project with package.json including @modelcontextprotocol/sdk, ioredis, pino dependencies
+- [X] T002 Create project directory structure: src/{tools,data,session,validation,utils}/, tests/{integration,unit,fixtures}/, docker/
+- [X] T003 [P] Configure ESLint and Prettier for code quality in .eslintrc.json and .prettierrc
+- [X] T004 [P] Create .dockerignore and .gitignore files for build optimization
+- [X] T005 [P] Create docker-compose.yaml with Valkey service configuration (port 6379, persistence enabled)
 
 ---
 
@@ -33,15 +33,15 @@
 
 **⚠️ CRITICAL**: No user story work can begin until this phase is complete
 
-- [ ] T006 Implement Pino structured logger setup in src/utils/logger.js with configurable log levels
-- [ ] T007 [P] Implement error handling utilities in src/utils/errors.js with MCP error codes
-- [ ] T008 [P] Create Valkey client wrapper in src/session/storage.js with connection pooling and error handling
-- [ ] T009 [P] Implement JSON schema validators in src/validation/validators.js using native validation
-- [ ] T010 [P] Create MCP tool schemas in src/validation/schemas.js based on contracts/mcp-tools.md
-- [ ] T011 Create session lifecycle manager in src/session/manager.js with TTL management (1 hour default)
-- [ ] T012 [P] Implement PNR generation utilities in src/data/pnr.js with TEST- prefix and base32 encoding
-- [ ] T013 Initialize MCP server in src/server.js with @modelcontextprotocol/sdk Server class
-- [ ] T014 Create MCP server entry point in src/index.js with stdio transport and error handling
+- [X] T006 Implement Pino structured logger setup in src/utils/logger.js with configurable log levels
+- [X] T007 [P] Implement error handling utilities in src/utils/errors.js with MCP error codes
+- [X] T008 [P] Create Valkey client wrapper in src/session/storage.js with connection pooling and error handling
+- [X] T009 [P] Implement JSON schema validators in src/validation/validators.js using native validation
+- [X] T010 [P] Create MCP tool schemas in src/validation/schemas.js based on contracts/mcp-tools.md
+- [X] T011 Create session lifecycle manager in src/session/manager.js with TTL management (1 hour default)
+- [X] T012 [P] Implement PNR generation utilities in src/data/pnr.js with TEST- prefix and base32 encoding
+- [X] T013 Initialize MCP server in src/server.js with @modelcontextprotocol/sdk Server class
+- [X] T014 Create MCP server entry point in src/index.js with stdio transport and error handling
 
 **Checkpoint**: Foundation ready - user story implementation can now begin in parallel
 
@@ -55,35 +55,35 @@
 
 ### Core Data for User Story 1
 
-- [ ] T015 [P] [US1] Create airports mock data in src/data/airports.js with 100+ major airports (IATA codes, names, cities, timezones, coordinates)
-- [ ] T016 [P] [US1] Create airlines mock data in src/data/airlines.js with 30+ carriers (IATA codes, names, countries)
-- [ ] T017 [US1] Implement flight data generator in src/data/flights.js with deterministic pricing, duration calculation, and availability logic
+- [X] T015 [P] [US1] Create airports mock data in src/data/airports.js with 100+ major airports (IATA codes, names, cities, timezones, coordinates)
+- [X] T016 [P] [US1] Create airlines mock data in src/data/airlines.js with 30+ carriers (IATA codes, names, countries)
+- [X] T017 [US1] Implement flight data generator in src/data/flights.js with deterministic pricing, duration calculation, and availability logic
 
 ### Flight Search Tool
 
-- [ ] T018 [US1] Implement searchFlights tool handler in src/tools/flights.js with input validation (origin, destination, departureDate, passengers, cabin)
-- [ ] T019 [US1] Add flight search result generation with 3-5 mock flights per search, realistic schedules (6am-10pm departures), and price ranges ($200-$800 economy, $800-$2000 business, $2500+ first)
-- [ ] T020 [US1] Implement seat availability simulation (90% available, 10% sold out) and booking class assignment. **Note**: Implements infinite inventory model where concurrent bookings on same flight both succeed. This aligns with spec.md edge case discussion and is appropriate for mock server testing scope.
+- [X] T018 [US1] Implement searchFlights tool handler in src/tools/flights.js with input validation (origin, destination, departureDate, passengers, cabin)
+- [X] T019 [US1] Add flight search result generation with 3-5 mock flights per search, realistic schedules (6am-10pm departures), and price ranges ($200-$800 economy, $800-$2000 business, $2500+ first)
+- [X] T020 [US1] Implement seat availability simulation (90% available, 10% sold out) and booking class assignment. **Note**: Implements infinite inventory model where concurrent bookings on same flight both succeed. This aligns with spec.md edge case discussion and is appropriate for mock server testing scope.
 
 ### Flight Booking Tool
 
-- [ ] T021 [US1] Implement bookFlight tool handler in src/tools/flights.js with passenger validation (firstName, lastName, email, phone)
-- [ ] T022 [US1] Add flight booking creation logic: validate flight selection, generate PNR via src/data/pnr.js, persist to Valkey with key gds:session:{sessionId}:booking:{pnr}
-- [ ] T023 [US1] Implement PNR storage structure in Valkey with FlightSegment, Passenger, pricing, status fields per data-model.md
-- [ ] T024 [US1] Add session booking tracking: update gds:session:{sessionId}:bookings set and increment bookingCount
+- [X] T021 [US1] Implement bookFlight tool handler in src/tools/flights.js with passenger validation (firstName, lastName, email, phone)
+- [X] T022 [US1] Add flight booking creation logic: validate flight selection, generate PNR via src/data/pnr.js, persist to Valkey with key gds:session:{sessionId}:booking:{pnr}
+- [X] T023 [US1] Implement PNR storage structure in Valkey with FlightSegment, Passenger, pricing, status fields per data-model.md
+- [X] T024 [US1] Add session booking tracking: update gds:session:{sessionId}:bookings set and increment bookingCount
 
 ### Booking Management Tools
 
-- [ ] T025 [US1] Implement retrieveBooking tool handler in src/tools/bookings.js with PNR validation and Valkey lookup
-- [ ] T026 [US1] Add booking retrieval logic: fetch from gds:session:{sessionId}:booking:{pnr}, return complete booking details with all segments
-- [ ] T027 [US1] Implement cancelBooking tool handler in src/tools/bookings.js with status transition validation (confirmed→cancelled only)
-- [ ] T028 [US1] Add cancellation logic: update booking status to 'cancelled', persist timestamp, return confirmation
+- [X] T025 [US1] Implement retrieveBooking tool handler in src/tools/bookings.js with PNR validation and Valkey lookup
+- [X] T026 [US1] Add booking retrieval logic: fetch from gds:session:{sessionId}:booking:{pnr}, return complete booking details with all segments
+- [X] T027 [US1] Implement cancelBooking tool handler in src/tools/bookings.js with status transition validation (confirmed→cancelled only)
+- [X] T028 [US1] Add cancellation logic: update booking status to 'cancelled', persist timestamp, return confirmation
 
 ### MCP Server Integration
 
-- [ ] T029 [US1] Register searchFlights, bookFlight, retrieveBooking, cancelBooking tools in src/server.js with tool handlers
-- [ ] T030 [US1] Add request/response logging for all flight operations with session ID, operation type, parameters, and response times
-- [ ] T031 [US1] Implement error handling for invalid airport codes, invalid dates, validation failures with specific error messages per FR-014
+- [X] T029 [US1] Register searchFlights, bookFlight, retrieveBooking, cancelBooking tools in src/server.js with tool handlers
+- [X] T030 [US1] Add request/response logging for all flight operations with session ID, operation type, parameters, and response times
+- [X] T031 [US1] Implement error handling for invalid airport codes, invalid dates, validation failures with specific error messages per FR-014
 
 **FR-015 Coverage Note**: Multi-step booking workflows (search → price verification → select → confirm) are implemented through the task sequence T018-T028. The searchFlights tool (T018-T020) enables price verification, bookFlight (T021-T024) handles selection and confirmation, and retrieveBooking (T025-T026) supports workflow verification.
 
@@ -99,29 +99,102 @@
 
 ### Session Infrastructure
 
-- [ ] T032 [US4] Implement session creation logic in src/session/manager.js: generate UUID v4 session ID on MCP connection initialization
-- [ ] T033 [US4] Add session metadata storage in Valkey at gds:session:{sessionId} with createdAt, expiresAt, lastActivity, bookingCount, searchCount fields
-- [ ] T034 [US4] Implement session TTL management: set EXPIRE on session keys (default 3600 seconds), refresh on activity
-- [ ] T035 [US4] Add session validation middleware in src/session/manager.js: verify session exists and not expired before tool execution
+- [X] T032 [US4] Implement session creation logic in src/session/manager.js: generate UUID v4 session ID on MCP connection initialization
+- [X] T033 [US4] Add session metadata storage in Valkey at gds:session:{sessionId} with createdAt, expiresAt, lastActivity, bookingCount, searchCount fields
+- [X] T034 [US4] Implement session TTL management: set EXPIRE on session keys (default 3600 seconds), refresh on activity
+- [X] T035 [US4] Add session validation middleware in src/session/manager.js: verify session exists and not expired before tool execution
 
 ### Session Isolation
 
-- [ ] T036 [US4] Implement session-scoped key prefixing in src/session/storage.js: all Valkey keys include session ID for isolation
-- [ ] T037 [US4] Update booking storage to enforce session scope: gds:session:{sessionId}:booking:{pnr} pattern in all tools
-- [ ] T038 [US4] Add session cleanup on expiry: implement background job or TTL-based cleanup for expired session data
-- [ ] T039 [US4] Implement session statistics tracking: maintain gds:stats:sessions:active set, update gds:stats:bookings:total counter
+- [X] T036 [US4] Implement session-scoped key prefixing in src/session/storage.js: all Valkey keys include session ID for isolation
+- [X] T037 [US4] Update booking storage to enforce session scope: gds:session:{sessionId}:booking:{pnr} pattern in all tools
+- [X] T038 [US4] Add session cleanup on expiry: implement background job or TTL-based cleanup for expired session data
+- [X] T039 [US4] Implement session statistics tracking: maintain gds:stats:sessions:active set, update gds:stats:bookings:total counter
 
 ### Session Validation
 
-- [ ] T040 [US4] Add cross-session isolation validation in retrieveBooking tool: verify PNR belongs to current session before returning
-- [ ] T041 [US4] Implement session activity tracking in src/session/manager.js: update lastActivity timestamp on every tool call
-- [ ] T042 [US4] Add session error responses for expired/invalid sessions with clear messages "Session expired" or "Session not found"
+- [X] T040 [US4] Add cross-session isolation validation in retrieveBooking tool: verify PNR belongs to current session before returning
+- [X] T041 [US4] Implement session activity tracking in src/session/manager.js: update lastActivity timestamp on every tool call
+- [X] T042 [US4] Add session error responses for expired/invalid sessions with clear messages "Session expired" or "Session not found"
 
 **Checkpoint**: Multiple MCP sessions can now run concurrently with complete isolation - bookings in one session never appear in another session.
 
 ---
 
-## Phase 5: User Story 2 - Hotel Search and Multi-Service Bundling (Priority: P2)
+## Phase 5: User Story 6 - Remote Access for Distributed Teams (Priority: P2)
+
+**Goal**: Enable remote MCP access over Streamable HTTP (HTTP/1.1 + SSE per MCP 2025-11-25 specification) with rate limiting, CORS, health checks, and comprehensive security.
+
+**Independent Test**: Start server with remote transport enabled, connect from remote MCP client over HTTP/1.1 using SSE for server-to-client messages and POST for client-to-server requests, execute flight search tool with MCP-Protocol-Version header, verify SSE polling pattern with connection closure and retry field, test Last-Event-ID resumption, verify rate limiting enforces 100 req/min default, test CORS preflight with wildcard origin, verify health endpoint returns service status, confirm MCP-Session-Id header management, confirm graceful shutdown preserves active sessions. All operations work independently of other user stories.
+
+### Streamable HTTP Server Setup (MCP 2025-11-25 Compliant)
+
+- [X] T043 [P] [US6] Update package.json with dependencies: @modelcontextprotocol/sdk for StreamableHTTPServerTransport, express for middleware
+- [X] T044 [US6] Create Streamable HTTP server in src/transports/http-server.js using MCP SDK's StreamableHTTPServerTransport (HTTP/1.1 + SSE)
+- [X] T045 [US6] Implement single /mcp endpoint supporting POST (client messages), GET (server message stream), DELETE (session termination) per MCP spec
+- [X] T046 [US6] Add HTTP server lifecycle management: startup on configurable port, graceful shutdown (drain connections, 30s timeout), error handling
+
+### SSE Polling Pattern Implementation (MCP 2025-11-25 Spec)
+
+- [X] T047 [US6] Implement SSE event stream with unique event IDs for resumability in src/transports/sse-handler.js
+- [X] T048 [US6] Add initial SSE event with ID and empty data field to prime client reconnection per MCP polling pattern
+- [X] T049 [US6] Implement connection closure after response with `retry` field (default: 5000ms) to guide client reconnection timing
+- [X] T050 [US6] Add Last-Event-ID header support for stream resumption when clients reconnect after disconnection
+
+### MCP Protocol Version Validation
+
+- [X] T051 [US6] Create protocol version middleware in src/middleware/protocol-version.js
+- [X] T052 [US6] Implement MCP-Protocol-Version header validation: require header on all requests, reject missing/invalid versions with 400 Bad Request
+- [X] T053 [US6] Add supported version check: accept 2025-11-25, reject unsupported versions with clear error message
+
+### Session Management (MCP-Session-Id Header)
+
+- [X] T054 [US6] Implement MCP-Session-Id header handling in src/session/session-manager.js
+- [X] T055 [US6] Add session ID generation on InitializeResult response (cryptographically secure UUID)
+- [X] T056 [US6] Validate MCP-Session-Id on subsequent requests: respond with 404 if session expired/not found
+- [X] T057 [US6] Implement DELETE /mcp handler for explicit session termination
+
+### Rate Limiting
+
+- [X] T058 [P] [US6] Install express-rate-limit package in package.json for IP-based rate limiting
+- [X] T059 [US6] Create rate limiter middleware in src/middleware/rate-limit.js with configurable limits (default: 100 req/min per IP)
+- [X] T060 [US6] Implement rate limit enforcement: return 429 Too Many Requests with Retry-After header when limit exceeded
+- [X] T061 [US6] Add rate limit headers to all responses: X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset
+- [X] T062 [US6] Implement rate limit storage in Valkey: use sliding window counter with key expiration (60s TTL)
+
+### CORS Configuration (Wildcard Policy)
+
+- [X] T063 [P] [US6] Install cors package in package.json for CORS middleware
+- [X] T064 [US6] Create CORS handler in src/middleware/cors.js with permissive wildcard policy (Access-Control-Allow-Origin: *)
+- [X] T065 [US6] Implement CORS preflight handling for OPTIONS requests: return allowed methods (GET, POST, DELETE, OPTIONS), headers (Content-Type, MCP-Session-Id, MCP-Protocol-Version)
+- [X] T066 [US6] Add Origin header validation per MCP security requirement: respond with 403 Forbidden if Origin present and validation fails
+
+### Health Checks
+
+- [X] T067 [US6] Implement health check endpoint in src/remote/health.js returning GET /health with JSON status response
+- [X] T068 [US6] Add service health indicators: Valkey connection status, active session count, uptime, memory usage
+- [X] T069 [US6] Implement readiness check: return 503 Service Unavailable if Valkey is disconnected or critical services unavailable
+- [X] T070 [US6] Add health check logging: log every 10th health check to avoid log spam, log all failed health checks immediately
+
+### Security & Transport Selection
+
+- [X] T071 [US6] Create transport factory in src/transports/factory.js to select stdio or Streamable HTTP based on TRANSPORT environment variable
+- [X] T072 [US6] Implement environment-based configuration in src/config/remote.js: PORT (default: 3000), HOST (default: 127.0.0.1 per MCP security), RATE_LIMIT_MAX, CORS_ORIGINS
+- [X] T073 [US6] Add request logging middleware in src/middleware/logger.js: log method, path, IP, User-Agent, MCP-Protocol-Version, duration, status code
+- [X] T074 [US6] Implement localhost binding (127.0.0.1) by default per MCP security recommendation, document production deployment with reverse proxy
+
+### Integration & Testing Infrastructure
+
+- [X] T075 [US6] Update src/index.js to support dual transport modes: stdio (default) or Streamable HTTP (when TRANSPORT=http or --remote flag)
+- [X] T076 [US6] Add CLI argument parsing in src/index.js: --remote (enable HTTP), --port <number>, --host <address>, --verbose, --log-level <level>
+- [X] T077 [US6] Create remote access example client in tests/fixtures/remote-client.js demonstrating SSE connection, Last-Event-ID resumption, and tool invocation
+- [X] T078 [US6] Add nginx.conf.example in docker/ for optional HTTP/2 upgrade reverse proxy (client-facing HTTP/2, backend HTTP/1.1)
+
+**Checkpoint**: Remote access complete - developers can connect to MCP server over Streamable HTTP (HTTP/1.1 + SSE per MCP 2025-11-25 spec), enforced rate limits, wildcard CORS, MCP-Protocol-Version validation, SSE polling pattern with connection closure, Last-Event-ID resumption, and health monitoring. Transport selection via TRANSPORT env var or --remote flag.
+
+---
+
+## Phase 6: User Story 2 - Hotel Search and Multi-Service Bundling (Priority: P2)
 
 **Goal**: Enable developers to test hotel search and multi-service booking workflows. Search hotels, create hotel bookings, and bundle hotels with flights under single PNR.
 
@@ -129,34 +202,34 @@
 
 ### Hotel Data
 
-- [ ] T043 [P] [US2] Create hotels mock data in src/data/hotels.js with 50+ properties across major cities (names, chains, star ratings, addresses, amenities)
-- [ ] T044 [US2] Implement hotel data generator with realistic pricing tiers: budget $80-$150, midrange $150-$300, luxury $300-$800 per night
+- [X] T079 [P] [US2] Create hotels mock data in src/data/hotels.js with 50+ properties across major cities (names, chains, star ratings, addresses, amenities)
+- [X] T080 [US2] Implement hotel data generator with realistic pricing tiers: budget $80-$150, midrange $150-$300, luxury $300-$800 per night
 
 ### Hotel Search Tool
 
-- [ ] T045 [US2] Implement searchHotels tool handler in src/tools/hotels.js with input validation (cityCode, checkInDate, checkOutDate, guests)
-- [ ] T046 [US2] Add hotel search result generation: 5-10 properties per search, calculate nights and total prices, include amenities (WiFi, parking, breakfast, gym, pool)
-- [ ] T047 [US2] Implement date validation: checkInDate < checkOutDate, minimum 1 night stay, no past dates
+- [X] T081 [US2] Implement searchHotels tool handler in src/tools/hotels.js with input validation (cityCode, checkInDate, checkOutDate, guests)
+- [X] T082 [US2] Add hotel search result generation: 5-10 properties per search, calculate nights and total prices, include amenities (WiFi, parking, breakfast, gym, pool)
+- [X] T083 [US2] Implement date validation: checkInDate < checkOutDate, minimum 1 night stay, no past dates
 
 ### Hotel Booking Tool
 
-- [ ] T048 [US2] Implement bookHotel tool handler in src/tools/hotels.js with guest validation and room selection
-- [ ] T049 [US2] Add hotel booking creation: generate or use existing PNR, persist HotelReservation to Valkey with check-in/check-out dates, room type, pricing
-- [ ] T050 [US2] Implement multi-service bundling logic in src/tools/hotels.js: add hotel to existing PNR if provided, create new PNR if not
+- [X] T084 [US2] Implement bookHotel tool handler in src/tools/hotels.js with guest validation and room selection
+- [X] T085 [US2] Add hotel booking creation: generate or use existing PNR, persist HotelReservation to Valkey with check-in/check-out dates, room type, pricing
+- [X] T086 [US2] Implement multi-service bundling logic in src/tools/hotels.js: add hotel to existing PNR if provided, create new PNR if not
 
 ### Multi-Service Integration
 
-- [ ] T051 [US2] Update PNR structure in src/data/pnr.js to support multiple service segments: flights[], hotels[], cars[] arrays
-- [ ] T052 [US2] Implement total price calculation across all segments: sum flight prices + hotel prices, update PNR totalPrice field
-- [ ] T053 [US2] Add date consistency validation: hotel dates should overlap with flight dates, warn if hotel is outside travel period
-- [ ] T054 [US2] Update retrieveBooking tool in src/tools/bookings.js to return complete multi-service itineraries with all segment types
-- [ ] T055 [US2] Register searchHotels and bookHotel tools in src/server.js with tool handlers
+- [X] T087 [US2] Update PNR structure in src/data/pnr.js to support multiple service segments: flights[], hotels[], cars[] arrays
+- [X] T088 [US2] Implement total price calculation across all segments: sum flight prices + hotel prices, update PNR totalPrice field
+- [X] T089 [US2] Add date consistency validation: hotel dates should overlap with flight dates, warn if hotel is outside travel period
+- [X] T090 [US2] Update retrieveBooking tool in src/tools/bookings.js to return complete multi-service itineraries with all segment types
+- [X] T091 [US2] Register searchHotels and bookHotel tools in src/server.js with tool handlers
 
 **Checkpoint**: Developers can now search hotels, create hotel bookings, and bundle hotels with flights. Both flight-only and flight+hotel bookings work independently.
 
 ---
 
-## Phase 6: User Story 3 - Car Rental and Complete Travel Package (Priority: P3)
+## Phase 7: User Story 3 - Car Rental and Complete Travel Package (Priority: P3)
 
 **Goal**: Complete the full travel package capability by adding car rentals. Search cars, create car bookings, and bundle with flights+hotels for complete end-to-end travel itineraries.
 
@@ -164,33 +237,33 @@
 
 ### Car Rental Data
 
-- [ ] T056 [P] [US3] Create car rental mock data in src/data/cars.js with 6+ rental companies (Hertz, Avis, Enterprise codes and names)
-- [ ] T057 [US3] Implement car rental data generator with vehicle classes: economy $35-$50, midsize $50-$80, SUV/luxury $100-$150 per day
+- [X] T092 [P] [US3] Create car rental mock data in src/data/cars.js with 6+ rental companies (Hertz, Avis, Enterprise codes and names)
+- [X] T093 [US3] Implement car rental data generator with vehicle classes: economy $35-$50, midsize $50-$80, SUV/luxury $100-$150 per day
 
 ### Car Rental Search Tool
 
-- [ ] T058 [US3] Implement searchCars tool handler in src/tools/cars.js with input validation (pickupLocation, pickupDate, dropoffLocation, dropoffDate)
-- [ ] T059 [US3] Add car search result generation: 4-6 vehicle classes per search, calculate rental days and total prices, include vehicle specs and mileage policies
-- [ ] T060 [US3] Implement date validation: pickupDate < dropoffDate, minimum 1 day rental, location validation (airport/city codes)
+- [X] T094 [US3] Implement searchCars tool handler in src/tools/cars.js with input validation (pickupLocation, pickupDate, dropoffLocation, dropoffDate)
+- [X] T095 [US3] Add car search result generation: 4-6 vehicle classes per search, calculate rental days and total prices, include vehicle specs and mileage policies
+- [X] T096 [US3] Implement date validation: pickupDate < dropoffDate, minimum 1 day rental, location validation (airport/city codes)
 
 ### Car Rental Booking Tool
 
-- [ ] T061 [US3] Implement bookCar tool handler in src/tools/cars.js with driver validation and vehicle selection
-- [ ] T062 [US3] Add car rental booking creation: generate or use existing PNR, persist CarRental to Valkey with pickup/dropoff details, vehicle class, pricing
-- [ ] T063 [US3] Implement car bundling logic in src/tools/cars.js: add car to existing PNR, validate dates align with flight arrival/departure
+- [X] T097 [US3] Implement bookCar tool handler in src/tools/cars.js with driver validation and vehicle selection
+- [X] T098 [US3] Add car rental booking creation: generate or use existing PNR, persist CarRental to Valkey with pickup/dropoff details, vehicle class, pricing
+- [X] T099 [US3] Implement car bundling logic in src/tools/cars.js: add car to existing PNR, validate dates align with flight arrival/departure
 
 ### Complete Package Integration
 
-- [ ] T064 [US3] Update total price calculation in src/data/pnr.js to include car rental prices: sum flights + hotels + cars
-- [ ] T065 [US3] Add chronological itinerary ordering in retrieveBooking: sort segments by date/time (flight arrival → car pickup → hotel check-in → hotel check-out → car dropoff → return flight)
-- [ ] T066 [US3] Implement date consistency validation for cars: pickup should align with flight arrival, dropoff should align with departure
-- [ ] T067 [US3] Register searchCars and bookCar tools in src/server.js with tool handlers
+- [X] T100 [US3] Update total price calculation in src/data/pnr.js to include car rental prices: sum flights + hotels + cars
+- [X] T101 [US3] Add chronological itinerary ordering in retrieveBooking: sort segments by date/time (flight arrival → car pickup → hotel check-in → hotel check-out → car dropoff → return flight)
+- [X] T102 [US3] Implement date consistency validation for cars: pickup should align with flight arrival, dropoff should align with departure
+- [X] T103 [US3] Register searchCars and bookCar tools in src/server.js with tool handlers
 
 **Checkpoint**: Full GDS capability is now complete - developers can create comprehensive travel packages with flights, hotels, and cars all bundled under one PNR.
 
 ---
 
-## Phase 7: User Story 5 - Realistic Test Data for Demonstrations (Priority: P3)
+## Phase 8: User Story 5 - Realistic Test Data for Demonstrations (Priority: P3)
 
 **Goal**: Polish mock data quality to enable professional sales demonstrations and training scenarios with recognizable brands, realistic pricing, and diverse route coverage.
 
@@ -198,76 +271,76 @@
 
 ### Enhanced Mock Data Quality
 
-- [ ] T068 [P] [US5] Expand airports mock data in src/data/airports.js to include 50+ international hubs (London LHR, Paris CDG, Tokyo NRT, Dubai DXB, etc.)
-- [ ] T069 [P] [US5] Add major hotel chains to src/data/hotels.js: Marriott, Hilton, Hyatt, IHG properties in 20+ major cities worldwide
-- [ ] T070 [P] [US5] Enhance airline data in src/data/airlines.js with international carriers: British Airways, Virgin Atlantic, Lufthansa, Emirates, ANA, JAL
+- [X] T104 [P] [US5] Expand airports mock data in src/data/airports.js to include 50+ international hubs (London LHR, Paris CDG, Tokyo NRT, Dubai DXB, etc.)
+- [X] T105 [P] [US5] Add major hotel chains to src/data/hotels.js: Marriott, Hilton, Hyatt, IHG properties in 20+ major cities worldwide
+- [X] T106 [P] [US5] Enhance airline data in src/data/airlines.js with international carriers: British Airways, Virgin Atlantic, Lufthansa, Emirates, ANA, JAL
 
 ### Route-Specific Pricing
 
-- [ ] T071 [US5] Implement distance-based pricing in src/data/flights.js: calculate flight distance from coordinates, apply pricing tiers (short-haul $200-$400, medium-haul $400-$800, long-haul $800-$2000)
-- [ ] T072 [US5] Add realistic flight durations per route in src/data/flights.js: JFK-LAX ~6 hours, JFK-LHR ~7 hours, LAX-TYO ~12 hours
-- [ ] T073 [US5] Implement time-of-day departure variety: morning (6-9am), midday (9am-2pm), afternoon (2-5pm), evening (5-10pm) for realistic schedule diversity
+- [X] T107 [US5] Implement distance-based pricing in src/data/flights.js: calculate flight distance from coordinates, apply pricing tiers (short-haul $200-$400, medium-haul $400-$800, long-haul $800-$2000)
+- [X] T108 [US5] Add realistic flight durations per route in src/data/flights.js: JFK-LAX ~6 hours, JFK-LHR ~7 hours, LAX-TYO ~12 hours
+- [X] T109 [US5] Implement time-of-day departure variety: morning (6-9am), midday (9am-2pm), afternoon (2-5pm), evening (5-10pm) for realistic schedule diversity
 
 ### Premium Cabin Classes
 
-- [ ] T074 [US5] Add premium cabin pricing in src/data/flights.js: economy baseline, premium economy +40%, business +200%, first class +400%
-- [ ] T075 [US5] Implement cabin-specific availability and booking classes: Y/B/M for economy, W for premium economy, J/C for business, F/A for first
-- [ ] T076 [US5] Add cabin-specific amenities in flight results: economy (standard seat), business (lie-flat, lounge access), first (suites, premium dining)
+- [X] T110 [US5] Add premium cabin pricing in src/data/flights.js: economy baseline, premium economy +40%, business +200%, first class +400%
+- [X] T111 [US5] Implement cabin-specific availability and booking classes: Y/B/M for economy, W for premium economy, J/C for business, F/A for first
+- [X] T112 [US5] Add cabin-specific amenities in flight results: economy (standard seat), business (lie-flat, lounge access), first (suites, premium dining)
 
 ### Demo Scenarios Configuration
 
-- [ ] T077 [US5] Create demo seed data option in src/data/flights.js: when MOCK_DATA_SEED=demo, return curated high-quality results for common demo routes
-- [ ] T078 [US5] Add configurable response delay in src/utils/logger.js via MOCK_RESPONSE_DELAY env var to simulate realistic search response times during demos
-- [ ] T079 [US5] Implement metadata tagging in all responses: add "data_source": "mock" field to all search results and bookings per FR-012
+- [X] T113 [US5] Create demo seed data option in src/data/flights.js: when MOCK_DATA_SEED=demo, return curated high-quality results for common demo routes
+- [X] T114 [US5] Add configurable response delay in src/utils/logger.js via MOCK_RESPONSE_DELAY env var to simulate realistic search response times during demos
+- [X] T115 [US5] Implement metadata tagging in all responses: add "data_source": "mock" field to all search results and bookings per FR-012
 
 **Checkpoint**: Mock data is now demo-quality - professional appearance, recognizable brands, realistic pricing suitable for sales presentations and training without requiring explanations.
 
 ---
 
-## Phase 8: Additional Booking Management (Supporting Tools)
+## Phase 9: Additional Booking Management (Supporting Tools)
 
 **Goal**: Add convenience tool for listing all bookings in a session (supports User Stories 1-4).
 
 **Independent Test**: Create multiple bookings (flights, hotels, cars) in a session, call listBookings tool, verify it returns all PNRs created in the session with summary information. Provides developers quick overview of session state.
 
-- [ ] T080 [US1] Implement listBookings tool handler in src/tools/bookings.js to retrieve all PNRs in current session
-- [ ] T081 [US1] Add booking list query: read gds:session:{sessionId}:bookings set, fetch summary for each PNR (pnr, status, createdAt, totalPrice, segment counts)
-- [ ] T082 [US1] Register listBookings tool in src/server.js with tool handler
-- [ ] T083 [US1] Add pagination support for listBookings if session has 10+ bookings: limit and offset parameters
+- [X] T116 [US1] Implement listBookings tool handler in src/tools/bookings.js to retrieve all PNRs in current session
+- [X] T117 [US1] Add booking list query: read gds:session:{sessionId}:bookings set, fetch summary for each PNR (pnr, status, createdAt, totalPrice, segment counts)
+- [X] T118 [US1] Register listBookings tool in src/server.js with tool handler
+- [X] T119 [US1] Add pagination support for listBookings if session has 10+ bookings: limit and offset parameters
 
 ---
 
-## Phase 9: Docker Packaging
+## Phase 10: Docker Packaging
 
 **Purpose**: Container packaging for deployment and distribution
 
-- [ ] T084 Create multi-stage Dockerfile in docker/Dockerfile: builder stage (install deps, copy source) and production stage (Node.js 20 Alpine, non-root user)
-- [ ] T085 Create docker-bake.hcl in docker/ for multi-platform builds: linux/amd64 and linux/arm64 targets
-- [ ] T086 [P] Add health check to Dockerfile: verify Valkey connection and MCP server readiness
-- [ ] T087 [P] Create .env.example file with all configuration variables documented (MCP, Valkey, logging, mock data settings)
-- [ ] T088 Update docker-compose.yaml to include gds-mock-mcp service with Valkey dependency and environment variable mapping
-- [ ] T089 Add build and run scripts in package.json: npm run docker:build, npm run docker:run, npm run docker:down
+- [X] T120 Create multi-stage Dockerfile in docker/Dockerfile: builder stage (install deps, copy source) and production stage (Node.js 20 Alpine, non-root user)
+- [X] T121 Create docker-bake.hcl in docker/ for multi-platform builds: linux/amd64 and linux/arm64 targets
+- [X] T122 [P] Add health check to Dockerfile: verify Valkey connection and MCP server readiness
+- [X] T123 [P] Create .env.example file with all configuration variables documented (MCP, Valkey, logging, mock data settings)
+- [X] T124 Update docker-compose.yaml to include gds-mock-mcp service with Valkey dependency and environment variable mapping
+- [X] T125 Add build and run scripts in package.json: npm run docker:build, npm run docker:run, npm run docker:down
 
 ---
 
-## Phase 10: Documentation & Polish
+## Phase 11: Documentation & Polish
 
 **Purpose**: User-facing documentation, validation, and final polish
 
-- [ ] T090 [P] Create comprehensive README.md: installation instructions, configuration reference, Docker usage, MCP tool documentation, troubleshooting guide
-- [ ] T091 [P] Add SAFETY_DISCLAIMER.md: prominent "FOR TESTING AND DEMO PURPOSES ONLY" notice, explanation of TEST- prefix, no real transactions guarantee
+- [X] T126 [P] Create comprehensive README.md: installation instructions, configuration reference, Docker usage, MCP tool documentation, troubleshooting guide
+- [X] T127 [P] Add SAFETY_DISCLAIMER.md: prominent "FOR TESTING AND DEMO PURPOSES ONLY" notice, explanation of TEST- prefix, no real transactions guarantee
 
 **Success Criteria Alignment**: The README (T090) and quickstart guide (T091) should emphasize:
 - **SC-006**: Professional, demo-quality data requiring zero disclaimers or explanations during sales demonstrations
 - **SC-007**: Clear documentation enabling new developers to understand GDS workflows within 15 minutes using realistic examples as learning material
 
 These documentation objectives ensure the mock server serves both testing and training purposes effectively.
-- [ ] T092 [P] Create CHANGELOG.md documenting feature implementation and version history
-- [ ] T093 [P] Add inline code documentation: JSDoc comments for all public functions, tool handlers, data generators
-- [ ] T094 Validate quickstart.md examples: test all example commands in quickstart.md work correctly with current implementation
-- [ ] T095 Add logging coverage review: ensure all operations log appropriately (search, book, retrieve, cancel, errors) with sufficient detail per FR-013
-- [ ] T096 Perform security review: verify no production credentials, no external API calls, TEST- prefix enforcement, non-root Docker user per Constitution Principle III
-- [ ] T097 Run constitution compliance check: verify all 6 principles (MCP protocol, mock data realism, no real transactions, tool architecture, session management, observability)
+- [X] T128 [P] Create CHANGELOG.md documenting feature implementation and version history
+- [X] T129 [P] Add inline code documentation: JSDoc comments for all public functions, tool handlers, data generators
+- [X] T130 Validate quickstart.md examples: test all example commands in quickstart.md work correctly with current implementation
+- [X] T131 Add logging coverage review: ensure all operations log appropriately (search, book, retrieve, cancel, errors) with sufficient detail per FR-013
+- [X] T132 Perform security review: verify no production credentials, no external API calls, TEST- prefix enforcement, non-root Docker user per Constitution Principle III
+- [X] T133 Run constitution compliance check: verify all 6 principles (MCP protocol, mock data realism, no real transactions, tool architecture, session management, observability)
 
 ---
 
@@ -311,13 +384,15 @@ These documentation objectives ensure the mock server serves both testing and tr
 
 **User Story 1**: T015 [P] + T016 [P] (data files), then T018-T031 sequentially
 
-**User Story 2**: T043 [P] can run in parallel with US1 tasks
+**User Story 6**: T043 [P] + T058 [P] + T063 [P] can run in parallel with US1 tasks
 
-**User Story 3**: T056 [P] + T057 [P] can run in parallel with US1/US2 tasks
+**User Story 2**: T079 [P] can run in parallel with US1/US6 tasks
 
-**User Story 5**: T068 [P] + T069 [P] + T070 [P] can run in parallel
+**User Story 3**: T092 [P] + T093 [P] can run in parallel with US1/US2/US6 tasks
 
-**User Stories across teams**: Once Foundational complete, different developers can work on US1, US2, US3, US4, US5 in parallel
+**User Story 5**: T104 [P] + T105 [P] + T106 [P] can run in parallel
+
+**User Stories across teams**: Once Foundational complete, different developers can work on US1, US2, US3, US4, US5, US6 in parallel
 
 ---
 
@@ -332,14 +407,17 @@ Task T015-T031: Flight search and booking implementation
 # Developer B: User Story 4 (Session Management)
 Task T032-T042: Concurrent session isolation
 
-# Developer C: User Story 2 (Hotels)
-Task T043-T055: Hotel search and bundling
+# Developer C: User Story 6 (Remote Access)
+Task T043-T078: Streamable HTTP transport with SSE polling
 
-# Developer D: User Story 3 (Cars)
-Task T056-T067: Car rental integration
+# Developer D: User Story 2 (Hotels)
+Task T079-T091: Hotel search and bundling
 
-# Developer E: User Story 5 (Demo Data)
-Task T068-T079: Enhanced mock data quality
+# Developer E: User Story 3 (Cars)
+Task T092-T103: Car rental integration
+
+# Developer F: User Story 5 (Demo Data)
+Task T104-T115: Enhanced mock data quality
 ```
 
 ---
@@ -361,10 +439,11 @@ Task T068-T079: Enhanced mock data quality
 1. Foundation (Setup + Foundational) → T001-T014 complete
 2. **MVP Release**: Add US1 (T015-T031) → Test independently → Deploy v0.1
 3. **Multi-User Release**: Add US4 (T032-T042) → Test concurrency → Deploy v0.2
-4. **Hotel Bundling**: Add US2 (T043-T055) → Test multi-service → Deploy v0.3
-5. **Full Package**: Add US3 (T056-T067) → Test complete packages → Deploy v0.4
-6. **Demo Quality**: Add US5 (T068-T079) → Polish for presentations → Deploy v1.0
-7. Each increment adds value without breaking previous functionality
+4. **Remote Access**: Add US6 (T043-T078) → Test Streamable HTTP + SSE → Deploy v0.3
+5. **Hotel Bundling**: Add US2 (T079-T091) → Test multi-service → Deploy v0.4
+6. **Full Package**: Add US3 (T092-T103) → Test complete packages → Deploy v0.5
+7. **Demo Quality**: Add US5 (T104-T115) → Polish for presentations → Deploy v1.0
+8. Each increment adds value without breaking previous functionality
 
 ### Parallel Team Strategy (For Larger Teams)
 
@@ -372,8 +451,9 @@ Task T068-T079: Enhanced mock data quality
 2. **Week 2-3** (After Foundational complete):
    - **Team A** (2 devs): User Story 1 (T015-T031) - Priority focus
    - **Team B** (1 dev): User Story 4 (T032-T042) - Critical for testing
-   - **Team C** (1 dev): User Story 2 data prep (T043-T044) - Prepare for integration
-3. **Week 4**: Integrate US1+US4, then continue with US2, US3, US5
+   - **Team C** (1 dev): User Story 6 data prep (T043-T046) - Remote transport setup
+   - **Team D** (1 dev): User Story 2 data prep (T079-T080) - Prepare for integration
+3. **Week 4**: Integrate US1+US4+US6, then continue with US2, US3, US5
 4. **Week 5**: Docker packaging, documentation, final polish
 
 ### Priority-Driven Sequential (Small Team)
@@ -381,10 +461,11 @@ Task T068-T079: Enhanced mock data quality
 1. Setup → Foundational (T001-T014)
 2. User Story 1 - P1 (T015-T031) ✅ MVP CHECKPOINT
 3. User Story 4 - P2 (T032-T042) - Enable concurrent testing
-4. User Story 2 - P2 (T043-T055) - Add hotel capability
-5. User Story 3 - P3 (T056-T067) - Complete package
-6. User Story 5 - P3 (T068-T079) - Polish for demos
-7. Docker + Docs (T084-T097)
+4. User Story 6 - P2 (T043-T078) - Enable remote access via Streamable HTTP
+5. User Story 2 - P2 (T079-T091) - Add hotel capability
+6. User Story 3 - P3 (T092-T103) - Complete package
+7. User Story 5 - P3 (T104-T115) - Polish for demos
+8. Docker + Docs (T120-T133)
 
 ---
 
@@ -397,15 +478,17 @@ Task T068-T079: Enhanced mock data quality
 - Phase 2 (Foundational): 9 tasks - BLOCKS ALL USER STORIES
 - Phase 3 (US1 - Flight Booking): 17 tasks - MVP ✅
 - Phase 4 (US4 - Session Management): 11 tasks
-- Phase 5 (US2 - Hotel Bundling): 13 tasks
-- Phase 6 (US3 - Car Rentals): 12 tasks
-- Phase 7 (US5 - Demo Data Quality): 12 tasks
-- Phase 8 (Booking Management): 4 tasks
-- Phase 9 (Docker): 6 tasks
-- Phase 10 (Documentation): 8 tasks
+- Phase 5 (US6 - Remote Access): 36 tasks
+- Phase 6 (US2 - Hotel Bundling): 13 tasks
+- Phase 7 (US3 - Car Rentals): 12 tasks
+- Phase 8 (US5 - Demo Data Quality): 12 tasks
+- Phase 9 (Booking Management): 4 tasks
+- Phase 10 (Docker): 6 tasks
+- Phase 11 (Documentation): 8 tasks
 
 **Task Distribution by User Story**:
-- US1 (Flight Booking - P1): 21 tasks (includes Phase 8)
+- US1 (Flight Booking - P1): 21 tasks (includes Phase 9)
+- US6 (Remote Access - P2): 36 tasks
 - US2 (Hotel Bundling - P2): 13 tasks
 - US3 (Car Rentals - P3): 12 tasks
 - US4 (Session Management - P2): 11 tasks
@@ -422,6 +505,7 @@ Task T068-T079: Enhanced mock data quality
 **Independent Test Criteria per Story**:
 - **US1**: Search flights → book with passengers → retrieve PNR → cancel booking (complete workflow)
 - **US4**: Run 5-10 concurrent sessions, verify zero data leakage between sessions
+- **US6**: Connect via Streamable HTTP → verify SSE polling → test MCP-Protocol-Version validation → test rate limiting
 - **US2**: Search hotels → book hotel-only → bundle hotel with flight → retrieve multi-service PNR
 - **US3**: Search cars → book car-only → add to flight+hotel → retrieve complete package
 - **US5**: Review demo routes (JFK-LAX, JFK-LHR, LAX-TYO), verify professional data quality
@@ -430,8 +514,8 @@ Task T068-T079: Enhanced mock data quality
 - Phase 1: Setup (T001-T005)
 - Phase 2: Foundational (T006-T014)
 - Phase 3: User Story 1 (T015-T031)
-- Phase 9: Docker packaging basics (T084-T089)
-- Phase 10: Essential docs (T090-T091)
+- Phase 10: Docker packaging basics (T120-T125)
+- Phase 11: Essential docs (T126-T127)
 
 **Total MVP Tasks**: 34 tasks
 **MVP delivers**: Fully functional flight search and booking mock server with Docker deployment