@1mcp/agent 0.10.1 → 0.11.0

package/build/server/expressServer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"expressServer.d.ts","sourceRoot":"","sources":["../../src/server/expressServer.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAMpD,qBAAa,aAAa;IACxB,OAAO,CAAC,GAAG,CAAsB;IACjC,OAAO,CAAC,aAAa,CAAgB;gBAEzB,aAAa,EAAE,aAAa;IAQxC,OAAO,CAAC,eAAe;IAOvB,OAAO,CAAC,yBAAyB;IAyFjC,OAAO,CAAC,cAAc;IA8Df,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;CAK/C"}
+{"version":3,"file":"expressServer.d.ts","sourceRoot":"","sources":["../../src/server/expressServer.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAUpD;;;;;;;;;;;;GAYG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,GAAG,CAAsB;IACjC,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,aAAa,CAAsB;IAE3C;;;;;;;OAOG;gBACS,aAAa,EAAE,aAAa;IAaxC;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAQvB;;;;;;;;;OASG;IACH,OAAO,CAAC,WAAW;IAmBnB;;;;;;;;OAQG;IACI,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAO9C;;;;;;;OAOG;IACI,QAAQ,IAAI,IAAI;CAGxB"}

package/build/server/expressServer.js

@@ -1,177 +1,115 @@
-import { randomUUID } from 'node:crypto';
 import express from 'express';
 import bodyParser from 'body-parser';
-import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
-import { SSEServerTransport } from '@modelcontextprotocol/sdk/server/sse.js';
-import { ErrorCode } from '@modelcontextprotocol/sdk/types.js';
+import cors from 'cors';
 import logger from '../logger/logger.js';
-import { SSE_ENDPOINT, MESSAGES_ENDPOINT, STREAMABLE_HTTP_ENDPOINT } from '../constants.js';
-import tagsExtractor from './tagsExtractor.js';
 import errorHandler from './errorHandler.js';
+import { AuthManager } from './auth/authManager.js';
+import { createAuthMiddleware } from './auth/authMiddleware.js';
+import { setupOAuthRoutes } from './routes/oauthRoutes.js';
+import { setupStreamableHttpRoutes } from './routes/streamableHttpRoutes.js';
+import { setupSseRoutes } from './routes/sseRoutes.js';
+import { ServerConfigManager } from './config/serverConfig.js';
+/**
+ * ExpressServer orchestrates the HTTP/SSE transport layer for the MCP server.
+ *
+ * This class manages the Express application, authentication, and route setup.
+ * It provides both HTTP and SSE transport options with optional OAuth 2.1 authentication.
+ *
+ * @example
+ * ```typescript
+ * const serverManager = await setupServer();
+ * const expressServer = new ExpressServer(serverManager);
+ * expressServer.start(3050, 'localhost');
+ * ```
+ */
 export class ExpressServer {
     app;
     serverManager;
+    authManager;
+    configManager;
+    /**
+     * Creates a new ExpressServer instance.
+     *
+     * Initializes the Express application, sets up middleware, authentication,
+     * and configures all routes for MCP transport and OAuth endpoints.
+     *
+     * @param serverManager - The server manager instance for handling MCP operations
+     */
     constructor(serverManager) {
         this.app = express();
         this.serverManager = serverManager;
+        this.configManager = ServerConfigManager.getInstance();
+        // Initialize auth manager with custom session storage path if configured
+        const sessionStoragePath = this.configManager.getSessionStoragePath();
+        this.authManager = new AuthManager(sessionStoragePath);
         this.setupMiddleware();
-        this.setupStreamableHttpRoutes();
-        this.setupSseRoutes();
+        this.setupRoutes();
     }
+    /**
+     * Sets up Express middleware including CORS, body parsing, and error handling.
+     *
+     * Configures the basic middleware stack required for the MCP server:
+     * - CORS for cross-origin requests
+     * - JSON body parsing
+     * - Global error handling
+     */
     setupMiddleware() {
+        this.app.use(cors()); // Allow all origins for local dev
         this.app.use(bodyParser.json());
         // Add error handling middleware
         this.app.use(errorHandler);
     }
-    setupStreamableHttpRoutes() {
-        this.app.post(STREAMABLE_HTTP_ENDPOINT, tagsExtractor, async (req, res) => {
-            try {
-                logger.info('[POST] streamable-http', { query: req.query, body: req.body, headers: req.headers });
-                let transport;
-                const sessionId = req.headers['mcp-session-id'];
-                if (!sessionId) {
-                    const id = randomUUID();
-                    transport = new StreamableHTTPServerTransport({
-                        sessionIdGenerator: () => id,
-                    });
-                    // Use tags from middleware
-                    const tags = res.locals.tags;
-                    await this.serverManager.connectTransport(transport, id, {
-                        tags,
-                        enablePagination: req.query.pagination === 'true',
-                    });
-                    transport.onclose = () => {
-                        this.serverManager.disconnectTransport(id);
-                        logger.info('transport closed', transport.sessionId);
-                    };
-                }
-                else {
-                    const existingTransport = this.serverManager.getTransport(sessionId);
-                    if (existingTransport instanceof StreamableHTTPServerTransport) {
-                        transport = existingTransport;
-                    }
-                    else {
-                        res.status(400).json({
-                            error: {
-                                code: ErrorCode.InvalidParams,
-                                message: 'Session already exists but uses a different transport protocol',
-                            },
-                        });
-                        return;
-                    }
-                }
-                await transport.handleRequest(req, res, req.body);
-            }
-            catch (error) {
-                logger.error('Streamable HTTP error:', error);
-                res.status(500).end();
-            }
-        });
-        this.app.get(STREAMABLE_HTTP_ENDPOINT, async (req, res) => {
-            try {
-                logger.info('[GET] streamable-http', { query: req.query, headers: req.headers });
-                const sessionId = req.headers['mcp-session-id'];
-                if (!sessionId) {
-                    res.status(400).json({
-                        error: {
-                            code: ErrorCode.InvalidParams,
-                            message: 'Invalid params: sessionId is required',
-                        },
-                    });
-                    return;
-                }
-                const transport = this.serverManager.getTransport(sessionId);
-                await transport.handleRequest(req, res, req.body);
-            }
-            catch (error) {
-                logger.error('Streamable HTTP error:', error);
-                res.status(500).end();
-            }
-        });
-        this.app.delete(STREAMABLE_HTTP_ENDPOINT, async (req, res) => {
-            try {
-                logger.info('[DELETE] streamable-http', { query: req.query, headers: req.headers });
-                const sessionId = req.headers['mcp-session-id'];
-                if (!sessionId) {
-                    res.status(400).json({
-                        error: {
-                            code: ErrorCode.InvalidParams,
-                            message: 'Invalid params: sessionId is required',
-                        },
-                    });
-                    return;
-                }
-                const transport = this.serverManager.getTransport(sessionId);
-                await transport.handleRequest(req, res);
-            }
-            catch (error) {
-                logger.error('Streamable HTTP error:', error);
-                res.status(500).end();
-            }
-        });
-    }
-    setupSseRoutes() {
-        this.app.get(SSE_ENDPOINT, tagsExtractor, async (req, res) => {
-            try {
-                logger.info('[GET] sse', { query: req.query, headers: req.headers });
-                const transport = new SSEServerTransport(MESSAGES_ENDPOINT, res);
-                // Use tags from middleware
-                const tags = res.locals.tags;
-                // Connect the transport using the server manager
-                await this.serverManager.connectTransport(transport, transport.sessionId, {
-                    tags,
-                    enablePagination: req.query.pagination === 'true',
-                });
-                transport.onclose = () => {
-                    this.serverManager.disconnectTransport(transport.sessionId);
-                    logger.info('transport closed', transport.sessionId);
-                };
-            }
-            catch (error) {
-                logger.error('SSE connection error:', error);
-                res.status(500).end();
-            }
-        });
-        this.app.post(MESSAGES_ENDPOINT, async (req, res) => {
-            try {
-                const sessionId = req.query.sessionId;
-                if (!sessionId) {
-                    res.status(400).json({
-                        error: {
-                            code: ErrorCode.InvalidParams,
-                            message: 'Invalid params: sessionId is required',
-                        },
-                    });
-                    return;
-                }
-                logger.info('message', { body: req.body, sessionId });
-                const transport = this.serverManager.getTransport(sessionId);
-                if (transport instanceof SSEServerTransport) {
-                    await transport.handlePostMessage(req, res, req.body);
-                    return;
-                }
-                res.status(404).json({
-                    error: {
-                        code: ErrorCode.InvalidParams,
-                        message: 'Transport not found',
-                    },
-                });
-            }
-            catch (error) {
-                logger.error('Message handling error:', error);
-                res.status(500).json({
-                    error: {
-                        code: ErrorCode.InternalError,
-                        message: 'Internal server error',
-                    },
-                });
-            }
-        });
+    /**
+     * Sets up all application routes including OAuth and MCP transport endpoints.
+     *
+     * Configures the following route groups:
+     * - OAuth 2.1 endpoints (always available, auth can be disabled)
+     * - Streamable HTTP transport routes with authentication middleware
+     * - SSE transport routes with authentication middleware
+     *
+     * Logs the authentication status for debugging purposes.
+     */
+    setupRoutes() {
+        // Create auth middleware
+        const authMiddleware = createAuthMiddleware(this.authManager);
+        // Setup OAuth routes (always available, but auth can be disabled)
+        setupOAuthRoutes(this.app, this.authManager);
+        // Setup MCP transport routes with auth middleware
+        setupStreamableHttpRoutes(this.app, this.serverManager, authMiddleware);
+        setupSseRoutes(this.app, this.serverManager, authMiddleware);
+        // Log authentication status
+        if (this.authManager.isAuthEnabled()) {
+            logger.info('Authentication enabled - OAuth 2.1 endpoints available');
+        }
+        else {
+            logger.info('Authentication disabled - all endpoints accessible without auth');
+        }
     }
+    /**
+     * Starts the Express server on the specified port and host.
+     *
+     * Binds the Express application to the network interface and logs
+     * the server status including authentication configuration.
+     *
+     * @param port - The port number to listen on
+     * @param host - The host address to bind to
+     */
     start(port, host) {
         this.app.listen(port, host, () => {
-            logger.info(`Server is running on port ${port} with HTTP/SSE and Streamable HTTP transport`);
+            const authStatus = this.authManager.isAuthEnabled() ? 'with authentication' : 'without authentication';
+            logger.info(`Server is running on port ${port} with HTTP/SSE and Streamable HTTP transport ${authStatus}`);
         });
     }
+    /**
+     * Performs graceful shutdown of the Express server.
+     *
+     * Cleans up resources including:
+     * - Authentication manager shutdown
+     * - Session cleanup
+     * - Timer cleanup
+     */
+    shutdown() {
+        this.authManager.shutdown();
+    }
 }
 //# sourceMappingURL=expressServer.js.map

package/build/server/expressServer.js.map

@@ -1 +1 @@
-{"version":3,"file":"expressServer.js","sourceRoot":"","sources":["../../src/server/expressServer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,UAAU,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7E,OAAO,EAAE,SAAS,EAAE,MAAM,oCAAoC,CAAC;AAE/D,OAAO,MAAM,MAAM,qBAAqB,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC5F,OAAO,aAAa,MAAM,oBAAoB,CAAC;AAC/C,OAAO,YAAY,MAAM,mBAAmB,CAAC;AAE7C,MAAM,OAAO,aAAa;IAChB,GAAG,CAAsB;IACzB,aAAa,CAAgB;IAErC,YAAY,aAA4B;QACtC,IAAI,CAAC,GAAG,GAAG,OAAO,EAAE,CAAC;QACrB,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,yBAAyB,EAAE,CAAC;QACjC,IAAI,CAAC,cAAc,EAAE,CAAC;IACxB,CAAC;IAEO,eAAe;QACrB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;QAEhC,gCAAgC;QAChC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC7B,CAAC;IAEO,yBAAyB;QAC/B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE,aAAa,EAAE,KAAK,EAAE,GAAoB,EAAE,GAAqB,EAAE,EAAE;YAC3G,IAAI,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAElG,IAAI,SAAwC,CAAC;gBAC7C,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAuB,CAAC;gBACtE,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;oBACxB,SAAS,GAAG,IAAI,6BAA6B,CAAC;wBAC5C,kBAAkB,EAAE,GAAG,EAAE,CAAC,EAAE;qBAC7B,CAAC,CAAC;oBAEH,2BAA2B;oBAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBAE7B,MAAM,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,SAAS,EAAE,EAAE,EAAE;wBACvD,IAAI;wBACJ,gBAAgB,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,MAAM;qBAClD,CAAC,CAAC;oBAEH,SAAS,CAAC,OAAO,GAAG,GAAG,EAAE;wBACvB,IAAI,CAAC,aAAa,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;wBAC3C,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;oBACvD,CAAC,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,MAAM,iBAAiB,GAAG,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;oBACrE,IAAI,iBAAiB,YAAY,6BAA6B,EAAE,CAAC;wBAC/D,SAAS,GAAG,iBAAiB,CAAC;oBAChC,CAAC;yBAAM,CAAC;wBACN,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;4BACnB,KAAK,EAAE;gCACL,IAAI,EAAE,SAAS,CAAC,aAAa;gCAC7B,OAAO,EAAE,gEAAgE;6BAC1E;yBACF,CAAC,CAAC;wBACH,OAAO;oBACT,CAAC;gBACH,CAAC;gBACD,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YACpD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;gBAC9C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACxB,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,GAAoB,EAAE,GAAqB,EAAE,EAAE;YAC3F,IAAI,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBACjF,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAuB,CAAC;gBACtE,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBACnB,KAAK,EAAE;4BACL,IAAI,EAAE,SAAS,CAAC,aAAa;4BAC7B,OAAO,EAAE,uCAAuC;yBACjD;qBACF,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBACD,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,SAAS,CAAkC,CAAC;gBAC9F,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YACpD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;gBAC9C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACxB,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,wBAAwB,EAAE,KAAK,EAAE,GAAoB,EAAE,GAAqB,EAAE,EAAE;YAC9F,IAAI,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBACpF,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAuB,CAAC;gBACtE,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBACnB,KAAK,EAAE;4BACL,IAAI,EAAE,SAAS,CAAC,aAAa;4BAC7B,OAAO,EAAE,uCAAuC;yBACjD;qBACF,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBACD,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,SAAS,CAAkC,CAAC;gBAC9F,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC1C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;gBAC9C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACxB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,cAAc;QACpB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,aAAa,EAAE,KAAK,EAAE,GAAoB,EAAE,GAAqB,EAAE,EAAE;YAC9F,IAAI,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBACrE,MAAM,SAAS,GAAG,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;gBAEjE,2BAA2B;gBAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;gBAE7B,iDAAiD;gBACjD,MAAM,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE;oBACxE,IAAI;oBACJ,gBAAgB,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,MAAM;iBAClD,CAAC,CAAC;gBAEH,SAAS,CAAC,OAAO,GAAG,GAAG,EAAE;oBACvB,IAAI,CAAC,aAAa,CAAC,mBAAmB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;oBAC5D,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;gBACvD,CAAC,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;gBAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACxB,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,GAAoB,EAAE,GAAqB,EAAE,EAAE;YACrF,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,SAAmB,CAAC;gBAChD,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBACnB,KAAK,EAAE;4BACL,IAAI,EAAE,SAAS,CAAC,aAAa;4BAC7B,OAAO,EAAE,uCAAuC;yBACjD;qBACF,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBAED,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;gBACtD,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;gBAC7D,IAAI,SAAS,YAAY,kBAAkB,EAAE,CAAC;oBAC5C,MAAM,SAAS,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;oBACtD,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE;wBACL,IAAI,EAAE,SAAS,CAAC,aAAa;wBAC7B,OAAO,EAAE,qBAAqB;qBAC/B;iBACF,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;gBAC/C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE;wBACL,IAAI,EAAE,SAAS,CAAC,aAAa;wBAC7B,OAAO,EAAE,uBAAuB;qBACjC;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,IAAY,EAAE,IAAY;QACrC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;YAC/B,MAAM,CAAC,IAAI,CAAC,6BAA6B,IAAI,8CAA8C,CAAC,CAAC;QAC/F,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"expressServer.js","sourceRoot":"","sources":["../../src/server/expressServer.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,UAAU,MAAM,aAAa,CAAC;AACrC,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,OAAO,MAAM,MAAM,qBAAqB,CAAC;AACzC,OAAO,YAAY,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,aAAa;IAChB,GAAG,CAAsB;IACzB,aAAa,CAAgB;IAC7B,WAAW,CAAc;IACzB,aAAa,CAAsB;IAE3C;;;;;;;OAOG;IACH,YAAY,aAA4B;QACtC,IAAI,CAAC,GAAG,GAAG,OAAO,EAAE,CAAC;QACrB,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,aAAa,GAAG,mBAAmB,CAAC,WAAW,EAAE,CAAC;QAEvD,yEAAyE;QACzE,MAAM,kBAAkB,GAAG,IAAI,CAAC,aAAa,CAAC,qBAAqB,EAAE,CAAC;QACtE,IAAI,CAAC,WAAW,GAAG,IAAI,WAAW,CAAC,kBAAkB,CAAC,CAAC;QAEvD,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,WAAW,EAAE,CAAC;IACrB,CAAC;IAED;;;;;;;OAOG;IACK,eAAe;QACrB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,kCAAkC;QACxD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;QAEhC,gCAAgC;QAChC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC7B,CAAC;IAED;;;;;;;;;OASG;IACK,WAAW;QACjB,yBAAyB;QACzB,MAAM,cAAc,GAAG,oBAAoB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAE9D,kEAAkE;QAClE,gBAAgB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAE7C,kDAAkD;QAClD,yBAAyB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;QACxE,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;QAE7D,4BAA4B;QAC5B,IAAI,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,EAAE,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;QACxE,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,IAAY,EAAE,IAAY;QACrC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;YAC/B,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,wBAAwB,CAAC;YACvG,MAAM,CAAC,IAAI,CAAC,6BAA6B,IAAI,gDAAgD,UAAU,EAAE,CAAC,CAAC;QAC7G,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACI,QAAQ;QACb,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;IAC9B,CAAC;CACF"}

package/build/server/routes/oauthRoutes.d.ts

@@ -0,0 +1,14 @@
+import express from 'express';
+import { AuthManager } from '../auth/authManager.js';
+/**
+ * Sets up OAuth 2.1 and related endpoints on the Express app.
+ *
+ * This function registers all OAuth 2.1 endpoints (authorization, token, metadata, registration)
+ * and MCP resource metadata endpoints on the provided Express application. It uses the provided
+ * AuthManager for all authentication and token operations.
+ *
+ * @param app - The Express application instance
+ * @param authManager - The AuthManager instance for OAuth/session logic
+ */
+export declare function setupOAuthRoutes(app: express.Application, authManager: AuthManager): void;
+//# sourceMappingURL=oauthRoutes.d.ts.map

package/build/server/routes/oauthRoutes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthRoutes.d.ts","sourceRoot":"","sources":["../../../src/server/routes/oauthRoutes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAI9B,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAKrD;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,WAAW,EAAE,WAAW,EAAE,WAAW,GAAG,IAAI,CAsJzF"}

package/build/server/routes/oauthRoutes.js

@@ -0,0 +1,132 @@
+import bodyParser from 'body-parser';
+import { randomUUID } from 'node:crypto';
+import logger from '../../logger/logger.js';
+import { ServerConfigManager } from '../config/serverConfig.js';
+import { AUTH_CONFIG, RATE_LIMIT_CONFIG } from '../../constants.js';
+import rateLimit from 'express-rate-limit';
+/**
+ * Sets up OAuth 2.1 and related endpoints on the Express app.
+ *
+ * This function registers all OAuth 2.1 endpoints (authorization, token, metadata, registration)
+ * and MCP resource metadata endpoints on the provided Express application. It uses the provided
+ * AuthManager for all authentication and token operations.
+ *
+ * @param app - The Express application instance
+ * @param authManager - The AuthManager instance for OAuth/session logic
+ */
+export function setupOAuthRoutes(app, authManager) {
+    const configManager = ServerConfigManager.getInstance();
+    const DEFAULT_REDIRECT_PATH = '/oauth/callback';
+    // Rate limiter: 10 requests per minute per IP for sensitive endpoints
+    const oauthLimiter = rateLimit({
+        windowMs: RATE_LIMIT_CONFIG.OAUTH.WINDOW_MS,
+        max: RATE_LIMIT_CONFIG.OAUTH.MAX,
+        standardHeaders: true,
+        legacyHeaders: false,
+        message: RATE_LIMIT_CONFIG.OAUTH.MESSAGE,
+    });
+    /**
+     * Helper to build the OAuth issuer URL from the incoming request.
+     * Uses protocol and host headers for correct environment support.
+     */
+    function getIssuer(req) {
+        // X-Forwarded-Proto/Host for proxies, fallback to req.protocol/host
+        const proto = req.headers['x-forwarded-proto'] || req.protocol;
+        const host = req.headers['x-forwarded-host'] || req.get('host');
+        return `${proto}://${host}`;
+    }
+    // /authorize endpoint (auto-approve)
+    app.get('/authorize', oauthLimiter, (req, res) => {
+        logger.info('[OAuth] /authorize request', { query: req.query, headers: req.headers });
+        const { response_type, client_id, redirect_uri, state, resource, code_challenge: _code_challenge, code_challenge_method: _code_challenge_method, } = req.query;
+        if (response_type !== 'code' || !client_id) {
+            logger.warn('[OAuth] /authorize invalid request', { response_type, client_id });
+            res.status(400).json({ error: 'invalid_request' });
+            return;
+        }
+        // Accept S256 or plain for code_challenge_method (not enforced for local dev)
+        // Use default redirect URI if not provided
+        const issuer = getIssuer(req);
+        const defaultRedirect = `${issuer}${DEFAULT_REDIRECT_PATH}`;
+        const redirect = typeof redirect_uri === 'string' ? redirect_uri : defaultRedirect;
+        const code = authManager.createAuthCode(client_id, redirect, typeof resource === 'string' ? resource : '');
+        // Build redirect URL
+        const url = new URL(redirect);
+        url.searchParams.set('code', code);
+        if (state)
+            url.searchParams.set('state', state);
+        logger.info('[OAuth] /authorize success', { client_id, code, redirect: url.toString() });
+        res.redirect(url.toString());
+    });
+    // /token endpoint
+    app.post('/token', oauthLimiter, bodyParser.urlencoded({ extended: false }), (req, res) => {
+        logger.info('[OAuth] /token request', { body: req.body, headers: req.headers });
+        const { grant_type, code, client_id, redirect_uri, resource } = req.body;
+        if (grant_type !== 'authorization_code' || !code || !client_id) {
+            logger.warn('[OAuth] /token invalid request', { grant_type, code: !!code, client_id });
+            res.status(400).json({ error: 'invalid_request' });
+            return;
+        }
+        const accessToken = authManager.exchangeCodeForToken(code, client_id, redirect_uri, resource);
+        if (!accessToken) {
+            logger.warn('[OAuth] /token invalid grant', { code, client_id });
+            res.status(400).json({ error: 'invalid_grant' });
+            return;
+        }
+        const ttlMs = configManager.getOAuthTokenTtlMs();
+        logger.info('[OAuth] /token success', { client_id, accessToken });
+        res.json({
+            access_token: accessToken,
+            token_type: 'Bearer',
+            expires_in: ttlMs / 1000,
+            scope: '',
+        });
+    });
+    // OAuth 2.0 Authorization Server Metadata (RFC8414)
+    app.get('/.well-known/oauth-authorization-server', (req, res) => {
+        logger.info('[OAuth] metadata request', { url: req.url });
+        const issuer = getIssuer(req);
+        res.json({
+            issuer,
+            authorization_endpoint: `${issuer}/authorize`,
+            token_endpoint: `${issuer}/token`,
+            registration_endpoint: `${issuer}/register`,
+            response_types_supported: ['code'],
+            grant_types_supported: ['authorization_code'],
+            code_challenge_methods_supported: ['S256', 'plain'],
+            token_endpoint_auth_methods_supported: ['none'],
+        });
+    });
+    // MCP Resource Metadata (RFC9728)
+    app.get('/mcp-resource-metadata', (req, res) => {
+        logger.info('[OAuth] resource metadata request', { url: req.url });
+        const issuer = getIssuer(req);
+        res.json({
+            authorization_servers: [`${issuer}/.well-known/oauth-authorization-server`],
+            resource: issuer,
+        });
+    });
+    // OAuth 2.0 Protected Resource Metadata (RFC9728) well-known endpoint
+    app.get('/.well-known/oauth-protected-resource', (req, res) => {
+        logger.info('[OAuth] protected resource metadata request', { url: req.url });
+        const issuer = getIssuer(req);
+        res.json({
+            authorization_servers: [`${issuer}/.well-known/oauth-authorization-server`],
+            resource: issuer,
+        });
+    });
+    // OAuth 2.0 Dynamic Client Registration (RFC7591)
+    app.post('/register', oauthLimiter, bodyParser.json(), (req, res) => {
+        logger.info('[OAuth] client registration request', { body: req.body });
+        // Accept any registration, auto-approve
+        const clientId = AUTH_CONFIG.PREFIXES.CLIENT_ID + randomUUID();
+        logger.info('[OAuth] client registration success', { clientId });
+        res.status(201).json({
+            client_id: clientId,
+            client_id_issued_at: Math.floor(Date.now() / 1000),
+            token_endpoint_auth_method: 'none',
+            ...req.body,
+        });
+    });
+}
+//# sourceMappingURL=oauthRoutes.js.map

package/build/server/routes/oauthRoutes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthRoutes.js","sourceRoot":"","sources":["../../../src/server/routes/oauthRoutes.ts"],"names":[],"mappings":"AACA,OAAO,UAAU,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,MAAM,MAAM,wBAAwB,CAAC;AAE5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACpE,OAAO,SAAS,MAAM,oBAAoB,CAAC;AAE3C;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAwB,EAAE,WAAwB;IACjF,MAAM,aAAa,GAAG,mBAAmB,CAAC,WAAW,EAAE,CAAC;IACxD,MAAM,qBAAqB,GAAG,iBAAiB,CAAC;IAEhD,sEAAsE;IACtE,MAAM,YAAY,GAAG,SAAS,CAAC;QAC7B,QAAQ,EAAE,iBAAiB,CAAC,KAAK,CAAC,SAAS;QAC3C,GAAG,EAAE,iBAAiB,CAAC,KAAK,CAAC,GAAG;QAChC,eAAe,EAAE,IAAI;QACrB,aAAa,EAAE,KAAK;QACpB,OAAO,EAAE,iBAAiB,CAAC,KAAK,CAAC,OAAO;KACzC,CAAC,CAAC;IAEH;;;OAGG;IACH,SAAS,SAAS,CAAC,GAAoB;QACrC,oEAAoE;QACpE,MAAM,KAAK,GAAI,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAY,IAAI,GAAG,CAAC,QAAQ,CAAC;QAC3E,MAAM,IAAI,GAAI,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAY,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5E,OAAO,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC;IAC9B,CAAC;IAED,qCAAqC;IACrC,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,YAAY,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/C,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAEtF,MAAM,EACJ,aAAa,EACb,SAAS,EACT,YAAY,EACZ,KAAK,EACL,QAAQ,EACR,cAAc,EAAE,eAAe,EAC/B,qBAAqB,EAAE,sBAAsB,GAC9C,GAAG,GAAG,CAAC,KAAK,CAAC;QAEd,IAAI,aAAa,KAAK,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC;YAChF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QAED,8EAA8E;QAC9E,2CAA2C;QAC3C,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,eAAe,GAAG,GAAG,MAAM,GAAG,qBAAqB,EAAE,CAAC;QAC5D,MAAM,QAAQ,GAAG,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,eAAe,CAAC;QAEnF,MAAM,IAAI,GAAG,WAAW,CAAC,cAAc,CACrC,SAAmB,EACnB,QAAQ,EACR,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAC7C,CAAC;QAEF,qBAAqB;QACrB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,KAAK;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAe,CAAC,CAAC;QAE1D,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACzF,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,kBAAkB;IAClB,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,UAAU,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACxF,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAEhF,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;QAEzE,IAAI,UAAU,KAAK,oBAAoB,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAC/D,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;YACvF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QAED,MAAM,WAAW,GAAG,WAAW,CAAC,oBAAoB,CAAC,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;QAE9F,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;YACjE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,aAAa,CAAC,kBAAkB,EAAE,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;QAElE,GAAG,CAAC,IAAI,CAAC;YACP,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,KAAK,GAAG,IAAI;YACxB,KAAK,EAAE,EAAE;SACV,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,oDAAoD;IACpD,GAAG,CAAC,GAAG,CAAC,yCAAyC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9D,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAE9B,GAAG,CAAC,IAAI,CAAC;YACP,MAAM;YACN,sBAAsB,EAAE,GAAG,MAAM,YAAY;YAC7C,cAAc,EAAE,GAAG,MAAM,QAAQ;YACjC,qBAAqB,EAAE,GAAG,MAAM,WAAW;YAC3C,wBAAwB,EAAE,CAAC,MAAM,CAAC;YAClC,qBAAqB,EAAE,CAAC,oBAAoB,CAAC;YAC7C,gCAAgC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;YACnD,qCAAqC,EAAE,CAAC,MAAM,CAAC;SAChD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,kCAAkC;IAClC,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7C,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAE9B,GAAG,CAAC,IAAI,CAAC;YACP,qBAAqB,EAAE,CAAC,GAAG,MAAM,yCAAyC,CAAC;YAC3E,QAAQ,EAAE,MAAM;SACjB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,sEAAsE;IACtE,GAAG,CAAC,GAAG,CAAC,uCAAuC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5D,MAAM,CAAC,IAAI,CAAC,6CAA6C,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7E,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAE9B,GAAG,CAAC,IAAI,CAAC;YACP,qBAAqB,EAAE,CAAC,GAAG,MAAM,yCAAyC,CAAC;YAC3E,QAAQ,EAAE,MAAM;SACjB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,kDAAkD;IAClD,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAClE,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAEvE,wCAAwC;QACxC,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,SAAS,GAAG,UAAU,EAAE,CAAC;QAE/D,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,SAAS,EAAE,QAAQ;YACnB,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAClD,0BAA0B,EAAE,MAAM;YAClC,GAAG,GAAG,CAAC,IAAI;SACZ,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/build/server/routes/sseRoutes.d.ts

@@ -0,0 +1,4 @@
+import express from 'express';
+import { ServerManager } from '../../serverManager.js';
+export declare function setupSseRoutes(app: express.Application, serverManager: ServerManager, authMiddleware: express.RequestHandler): void;
+//# sourceMappingURL=sseRoutes.d.ts.map

package/build/server/routes/sseRoutes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sseRoutes.d.ts","sourceRoot":"","sources":["../../../src/server/routes/sseRoutes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAK9B,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAGvD,wBAAgB,cAAc,CAC5B,GAAG,EAAE,OAAO,CAAC,WAAW,EACxB,aAAa,EAAE,aAAa,EAC5B,cAAc,EAAE,OAAO,CAAC,cAAc,GACrC,IAAI,CA8DN"}

package/build/server/routes/sseRoutes.js

@@ -0,0 +1,64 @@
+import { SSEServerTransport } from '@modelcontextprotocol/sdk/server/sse.js';
+import { ErrorCode } from '@modelcontextprotocol/sdk/types.js';
+import logger from '../../logger/logger.js';
+import { SSE_ENDPOINT, MESSAGES_ENDPOINT } from '../../constants.js';
+import tagsExtractor from '../tagsExtractor.js';
+export function setupSseRoutes(app, serverManager, authMiddleware) {
+    app.get(SSE_ENDPOINT, authMiddleware, tagsExtractor, async (req, res) => {
+        try {
+            logger.info('[GET] sse', { query: req.query, headers: req.headers });
+            const transport = new SSEServerTransport(MESSAGES_ENDPOINT, res);
+            // Use tags from middleware
+            const tags = res.locals.tags;
+            // Connect the transport using the server manager
+            await serverManager.connectTransport(transport, transport.sessionId, {
+                tags,
+                enablePagination: req.query.pagination === 'true',
+            });
+            transport.onclose = () => {
+                serverManager.disconnectTransport(transport.sessionId);
+                logger.info('transport closed', transport.sessionId);
+            };
+        }
+        catch (error) {
+            logger.error('SSE connection error:', error);
+            res.status(500).end();
+        }
+    });
+    app.post(MESSAGES_ENDPOINT, authMiddleware, async (req, res) => {
+        try {
+            const sessionId = req.query.sessionId;
+            if (!sessionId) {
+                res.status(400).json({
+                    error: {
+                        code: ErrorCode.InvalidParams,
+                        message: 'Invalid params: sessionId is required',
+                    },
+                });
+                return;
+            }
+            logger.info('message', { body: req.body, sessionId });
+            const transport = serverManager.getTransport(sessionId);
+            if (transport instanceof SSEServerTransport) {
+                await transport.handlePostMessage(req, res, req.body);
+                return;
+            }
+            res.status(404).json({
+                error: {
+                    code: ErrorCode.InvalidParams,
+                    message: 'Transport not found',
+                },
+            });
+        }
+        catch (error) {
+            logger.error('Message handling error:', error);
+            res.status(500).json({
+                error: {
+                    code: ErrorCode.InternalError,
+                    message: 'Internal server error',
+                },
+            });
+        }
+    });
+}
+//# sourceMappingURL=sseRoutes.js.map

package/build/server/routes/sseRoutes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sseRoutes.js","sourceRoot":"","sources":["../../../src/server/routes/sseRoutes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7E,OAAO,EAAE,SAAS,EAAE,MAAM,oCAAoC,CAAC;AAC/D,OAAO,MAAM,MAAM,wBAAwB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAErE,OAAO,aAAa,MAAM,qBAAqB,CAAC;AAEhD,MAAM,UAAU,cAAc,CAC5B,GAAwB,EACxB,aAA4B,EAC5B,cAAsC;IAEtC,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,KAAK,EAAE,GAAoB,EAAE,GAAqB,EAAE,EAAE;QACzG,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACrE,MAAM,SAAS,GAAG,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;YAEjE,2BAA2B;YAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;YAE7B,iDAAiD;YACjD,MAAM,aAAa,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE;gBACnE,IAAI;gBACJ,gBAAgB,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,MAAM;aAClD,CAAC,CAAC;YAEH,SAAS,CAAC,OAAO,GAAG,GAAG,EAAE;gBACvB,aAAa,CAAC,mBAAmB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;gBACvD,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;YACvD,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;YAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,cAAc,EAAE,KAAK,EAAE,GAAoB,EAAE,GAAqB,EAAE,EAAE;QAChG,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,SAAmB,CAAC;YAChD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE;wBACL,IAAI,EAAE,SAAS,CAAC,aAAa;wBAC7B,OAAO,EAAE,uCAAuC;qBACjD;iBACF,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;YACtD,MAAM,SAAS,GAAG,aAAa,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;YAExD,IAAI,SAAS,YAAY,kBAAkB,EAAE,CAAC;gBAC5C,MAAM,SAAS,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;gBACtD,OAAO;YACT,CAAC;YAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE;oBACL,IAAI,EAAE,SAAS,CAAC,aAAa;oBAC7B,OAAO,EAAE,qBAAqB;iBAC/B;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;YAC/C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE;oBACL,IAAI,EAAE,SAAS,CAAC,aAAa;oBAC7B,OAAO,EAAE,uBAAuB;iBACjC;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/build/server/routes/streamableHttpRoutes.d.ts

@@ -0,0 +1,4 @@
+import express from 'express';
+import { ServerManager } from '../../serverManager.js';
+export declare function setupStreamableHttpRoutes(app: express.Application, serverManager: ServerManager, authMiddleware: express.RequestHandler): void;
+//# sourceMappingURL=streamableHttpRoutes.d.ts.map

package/build/server/routes/streamableHttpRoutes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"streamableHttpRoutes.d.ts","sourceRoot":"","sources":["../../../src/server/routes/streamableHttpRoutes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAM9B,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAGvD,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,OAAO,CAAC,WAAW,EACxB,aAAa,EAAE,aAAa,EAC5B,cAAc,EAAE,OAAO,CAAC,cAAc,GACrC,IAAI,CAkGN"}