@1mcp/agent 0.10.3 → 0.12.0

package/build/transport/http/routes/oauthRoutes.js

@@ -0,0 +1,132 @@
+import bodyParser from 'body-parser';
+import { randomUUID } from 'node:crypto';
+import logger from '../../../logger/logger.js';
+import { ServerConfigManager } from '../../../core/server/serverConfig.js';
+import { AUTH_CONFIG, RATE_LIMIT_CONFIG } from '../../../constants.js';
+import rateLimit from 'express-rate-limit';
+/**
+ * Sets up OAuth 2.1 and related endpoints on the Express app.
+ *
+ * This function registers all OAuth 2.1 endpoints (authorization, token, metadata, registration)
+ * and MCP resource metadata endpoints on the provided Express application. It uses the provided
+ * AuthManager for all authentication and token operations.
+ *
+ * @param app - The Express application instance
+ * @param authManager - The AuthManager instance for OAuth/session logic
+ */
+export function setupOAuthRoutes(app, authManager) {
+    const configManager = ServerConfigManager.getInstance();
+    const DEFAULT_REDIRECT_PATH = '/oauth/callback';
+    // Rate limiter: 10 requests per minute per IP for sensitive endpoints
+    const oauthLimiter = rateLimit({
+        windowMs: RATE_LIMIT_CONFIG.OAUTH.WINDOW_MS,
+        max: RATE_LIMIT_CONFIG.OAUTH.MAX,
+        standardHeaders: true,
+        legacyHeaders: false,
+        message: RATE_LIMIT_CONFIG.OAUTH.MESSAGE,
+    });
+    /**
+     * Helper to build the OAuth issuer URL from the incoming request.
+     * Uses protocol and host headers for correct environment support.
+     */
+    function getIssuer(req) {
+        // X-Forwarded-Proto/Host for proxies, fallback to req.protocol/host
+        const proto = req.headers['x-forwarded-proto'] || req.protocol;
+        const host = req.headers['x-forwarded-host'] || req.get('host');
+        return `${proto}://${host}`;
+    }
+    // /authorize endpoint (auto-approve)
+    app.get('/authorize', oauthLimiter, (req, res) => {
+        logger.info('[OAuth] /authorize request', { query: req.query, headers: req.headers });
+        const { response_type, client_id, redirect_uri, state, resource, code_challenge: _code_challenge, code_challenge_method: _code_challenge_method, } = req.query;
+        if (response_type !== 'code' || !client_id) {
+            logger.warn('[OAuth] /authorize invalid request', { response_type, client_id });
+            res.status(400).json({ error: 'invalid_request' });
+            return;
+        }
+        // Accept S256 or plain for code_challenge_method (not enforced for local dev)
+        // Use default redirect URI if not provided
+        const issuer = getIssuer(req);
+        const defaultRedirect = `${issuer}${DEFAULT_REDIRECT_PATH}`;
+        const redirect = typeof redirect_uri === 'string' ? redirect_uri : defaultRedirect;
+        const code = authManager.createAuthCode(client_id, redirect, typeof resource === 'string' ? resource : '');
+        // Build redirect URL
+        const url = new URL(redirect);
+        url.searchParams.set('code', code);
+        if (state)
+            url.searchParams.set('state', state);
+        logger.info('[OAuth] /authorize success', { client_id, code, redirect: url.toString() });
+        res.redirect(url.toString());
+    });
+    // /token endpoint
+    app.post('/token', oauthLimiter, bodyParser.urlencoded({ extended: false }), (req, res) => {
+        logger.info('[OAuth] /token request', { body: req.body, headers: req.headers });
+        const { grant_type, code, client_id, redirect_uri, resource } = req.body;
+        if (grant_type !== 'authorization_code' || !code || !client_id) {
+            logger.warn('[OAuth] /token invalid request', { grant_type, code: !!code, client_id });
+            res.status(400).json({ error: 'invalid_request' });
+            return;
+        }
+        const accessToken = authManager.exchangeCodeForToken(code, client_id, redirect_uri, resource);
+        if (!accessToken) {
+            logger.warn('[OAuth] /token invalid grant', { code, client_id });
+            res.status(400).json({ error: 'invalid_grant' });
+            return;
+        }
+        const ttlMs = configManager.getOAuthTokenTtlMs();
+        logger.info('[OAuth] /token success', { client_id, accessToken });
+        res.json({
+            access_token: accessToken,
+            token_type: 'Bearer',
+            expires_in: ttlMs / 1000,
+            scope: '',
+        });
+    });
+    // OAuth 2.0 Authorization Server Metadata (RFC8414)
+    app.get('/.well-known/oauth-authorization-server', (req, res) => {
+        logger.info('[OAuth] metadata request', { url: req.url });
+        const issuer = getIssuer(req);
+        res.json({
+            issuer,
+            authorization_endpoint: `${issuer}/authorize`,
+            token_endpoint: `${issuer}/token`,
+            registration_endpoint: `${issuer}/register`,
+            response_types_supported: ['code'],
+            grant_types_supported: ['authorization_code'],
+            code_challenge_methods_supported: ['S256', 'plain'],
+            token_endpoint_auth_methods_supported: ['none'],
+        });
+    });
+    // MCP Resource Metadata (RFC9728)
+    app.get('/mcp-resource-metadata', (req, res) => {
+        logger.info('[OAuth] resource metadata request', { url: req.url });
+        const issuer = getIssuer(req);
+        res.json({
+            authorization_servers: [`${issuer}/.well-known/oauth-authorization-server`],
+            resource: issuer,
+        });
+    });
+    // OAuth 2.0 Protected Resource Metadata (RFC9728) well-known endpoint
+    app.get('/.well-known/oauth-protected-resource', (req, res) => {
+        logger.info('[OAuth] protected resource metadata request', { url: req.url });
+        const issuer = getIssuer(req);
+        res.json({
+            authorization_servers: [`${issuer}/.well-known/oauth-authorization-server`],
+            resource: issuer,
+        });
+    });
+    // OAuth 2.0 Dynamic Client Registration (RFC7591)
+    app.post('/register', oauthLimiter, bodyParser.json(), (req, res) => {
+        logger.info('[OAuth] client registration request', { body: req.body });
+        // Accept any registration, auto-approve
+        const clientId = AUTH_CONFIG.PREFIXES.CLIENT_ID + randomUUID();
+        logger.info('[OAuth] client registration success', { clientId });
+        res.status(201).json({
+            client_id: clientId,
+            client_id_issued_at: Math.floor(Date.now() / 1000),
+            token_endpoint_auth_method: 'none',
+            ...req.body,
+        });
+    });
+}
+//# sourceMappingURL=oauthRoutes.js.map

package/build/transport/http/routes/oauthRoutes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthRoutes.js","sourceRoot":"","sources":["../../../../src/transport/http/routes/oauthRoutes.ts"],"names":[],"mappings":"AACA,OAAO,UAAU,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,MAAM,MAAM,2BAA2B,CAAC;AAE/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,SAAS,MAAM,oBAAoB,CAAC;AAE3C;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAwB,EAAE,WAAwB;IACjF,MAAM,aAAa,GAAG,mBAAmB,CAAC,WAAW,EAAE,CAAC;IACxD,MAAM,qBAAqB,GAAG,iBAAiB,CAAC;IAEhD,sEAAsE;IACtE,MAAM,YAAY,GAAG,SAAS,CAAC;QAC7B,QAAQ,EAAE,iBAAiB,CAAC,KAAK,CAAC,SAAS;QAC3C,GAAG,EAAE,iBAAiB,CAAC,KAAK,CAAC,GAAG;QAChC,eAAe,EAAE,IAAI;QACrB,aAAa,EAAE,KAAK;QACpB,OAAO,EAAE,iBAAiB,CAAC,KAAK,CAAC,OAAO;KACzC,CAAC,CAAC;IAEH;;;OAGG;IACH,SAAS,SAAS,CAAC,GAAoB;QACrC,oEAAoE;QACpE,MAAM,KAAK,GAAI,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAY,IAAI,GAAG,CAAC,QAAQ,CAAC;QAC3E,MAAM,IAAI,GAAI,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAY,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5E,OAAO,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC;IAC9B,CAAC;IAED,qCAAqC;IACrC,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,YAAY,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/C,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAEtF,MAAM,EACJ,aAAa,EACb,SAAS,EACT,YAAY,EACZ,KAAK,EACL,QAAQ,EACR,cAAc,EAAE,eAAe,EAC/B,qBAAqB,EAAE,sBAAsB,GAC9C,GAAG,GAAG,CAAC,KAAK,CAAC;QAEd,IAAI,aAAa,KAAK,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC;YAChF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QAED,8EAA8E;QAC9E,2CAA2C;QAC3C,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,eAAe,GAAG,GAAG,MAAM,GAAG,qBAAqB,EAAE,CAAC;QAC5D,MAAM,QAAQ,GAAG,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,eAAe,CAAC;QAEnF,MAAM,IAAI,GAAG,WAAW,CAAC,cAAc,CACrC,SAAmB,EACnB,QAAQ,EACR,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAC7C,CAAC;QAEF,qBAAqB;QACrB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,KAAK;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAe,CAAC,CAAC;QAE1D,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACzF,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,kBAAkB;IAClB,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,UAAU,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACxF,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAEhF,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;QAEzE,IAAI,UAAU,KAAK,oBAAoB,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAC/D,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;YACvF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QAED,MAAM,WAAW,GAAG,WAAW,CAAC,oBAAoB,CAAC,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;QAE9F,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;YACjE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,aAAa,CAAC,kBAAkB,EAAE,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;QAElE,GAAG,CAAC,IAAI,CAAC;YACP,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,KAAK,GAAG,IAAI;YACxB,KAAK,EAAE,EAAE;SACV,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,oDAAoD;IACpD,GAAG,CAAC,GAAG,CAAC,yCAAyC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9D,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAE9B,GAAG,CAAC,IAAI,CAAC;YACP,MAAM;YACN,sBAAsB,EAAE,GAAG,MAAM,YAAY;YAC7C,cAAc,EAAE,GAAG,MAAM,QAAQ;YACjC,qBAAqB,EAAE,GAAG,MAAM,WAAW;YAC3C,wBAAwB,EAAE,CAAC,MAAM,CAAC;YAClC,qBAAqB,EAAE,CAAC,oBAAoB,CAAC;YAC7C,gCAAgC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;YACnD,qCAAqC,EAAE,CAAC,MAAM,CAAC;SAChD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,kCAAkC;IAClC,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7C,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAE9B,GAAG,CAAC,IAAI,CAAC;YACP,qBAAqB,EAAE,CAAC,GAAG,MAAM,yCAAyC,CAAC;YAC3E,QAAQ,EAAE,MAAM;SACjB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,sEAAsE;IACtE,GAAG,CAAC,GAAG,CAAC,uCAAuC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5D,MAAM,CAAC,IAAI,CAAC,6CAA6C,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7E,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAE9B,GAAG,CAAC,IAAI,CAAC;YACP,qBAAqB,EAAE,CAAC,GAAG,MAAM,yCAAyC,CAAC;YAC3E,QAAQ,EAAE,MAAM;SACjB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,kDAAkD;IAClD,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAClE,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAEvE,wCAAwC;QACxC,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,SAAS,GAAG,UAAU,EAAE,CAAC;QAE/D,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,SAAS,EAAE,QAAQ;YACnB,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAClD,0BAA0B,EAAE,MAAM;YAClC,GAAG,GAAG,CAAC,IAAI;SACZ,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/build/transport/http/routes/sseRoutes.d.ts

@@ -0,0 +1,4 @@
+import express from 'express';
+import { ServerManager } from '../../../core/server/serverManager.js';
+export declare function setupSseRoutes(app: express.Application, serverManager: ServerManager, authMiddleware: express.RequestHandler): void;
+//# sourceMappingURL=sseRoutes.d.ts.map

package/build/transport/http/routes/sseRoutes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sseRoutes.d.ts","sourceRoot":"","sources":["../../../../src/transport/http/routes/sseRoutes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAK9B,OAAO,EAAE,aAAa,EAAE,MAAM,uCAAuC,CAAC;AAGtE,wBAAgB,cAAc,CAC5B,GAAG,EAAE,OAAO,CAAC,WAAW,EACxB,aAAa,EAAE,aAAa,EAC5B,cAAc,EAAE,OAAO,CAAC,cAAc,GACrC,IAAI,CA8DN"}

package/build/transport/http/routes/sseRoutes.js

@@ -0,0 +1,64 @@
+import { SSEServerTransport } from '@modelcontextprotocol/sdk/server/sse.js';
+import { ErrorCode } from '@modelcontextprotocol/sdk/types.js';
+import logger from '../../../logger/logger.js';
+import { SSE_ENDPOINT, MESSAGES_ENDPOINT } from '../../../constants.js';
+import tagsExtractor from '../../../utils/tagsExtractor.js';
+export function setupSseRoutes(app, serverManager, authMiddleware) {
+    app.get(SSE_ENDPOINT, authMiddleware, tagsExtractor, async (req, res) => {
+        try {
+            logger.info('[GET] sse', { query: req.query, headers: req.headers });
+            const transport = new SSEServerTransport(MESSAGES_ENDPOINT, res);
+            // Use tags from middleware
+            const tags = res.locals.tags;
+            // Connect the transport using the server manager
+            await serverManager.connectTransport(transport, transport.sessionId, {
+                tags,
+                enablePagination: req.query.pagination === 'true',
+            });
+            transport.onclose = () => {
+                serverManager.disconnectTransport(transport.sessionId);
+                // Note: ServerManager already logs the disconnection
+            };
+        }
+        catch (error) {
+            logger.error('SSE connection error:', error);
+            res.status(500).end();
+        }
+    });
+    app.post(MESSAGES_ENDPOINT, authMiddleware, async (req, res) => {
+        try {
+            const sessionId = req.query.sessionId;
+            if (!sessionId) {
+                res.status(400).json({
+                    error: {
+                        code: ErrorCode.InvalidParams,
+                        message: 'Invalid params: sessionId is required',
+                    },
+                });
+                return;
+            }
+            logger.info('message', { body: req.body, sessionId });
+            const transport = serverManager.getTransport(sessionId);
+            if (transport instanceof SSEServerTransport) {
+                await transport.handlePostMessage(req, res, req.body);
+                return;
+            }
+            res.status(404).json({
+                error: {
+                    code: ErrorCode.InvalidParams,
+                    message: 'Transport not found',
+                },
+            });
+        }
+        catch (error) {
+            logger.error('Message handling error:', error);
+            res.status(500).json({
+                error: {
+                    code: ErrorCode.InternalError,
+                    message: 'Internal server error',
+                },
+            });
+        }
+    });
+}
+//# sourceMappingURL=sseRoutes.js.map

package/build/transport/http/routes/sseRoutes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sseRoutes.js","sourceRoot":"","sources":["../../../../src/transport/http/routes/sseRoutes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7E,OAAO,EAAE,SAAS,EAAE,MAAM,oCAAoC,CAAC;AAC/D,OAAO,MAAM,MAAM,2BAA2B,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAExE,OAAO,aAAa,MAAM,iCAAiC,CAAC;AAE5D,MAAM,UAAU,cAAc,CAC5B,GAAwB,EACxB,aAA4B,EAC5B,cAAsC;IAEtC,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,KAAK,EAAE,GAAoB,EAAE,GAAqB,EAAE,EAAE;QACzG,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACrE,MAAM,SAAS,GAAG,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;YAEjE,2BAA2B;YAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;YAE7B,iDAAiD;YACjD,MAAM,aAAa,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE;gBACnE,IAAI;gBACJ,gBAAgB,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,MAAM;aAClD,CAAC,CAAC;YAEH,SAAS,CAAC,OAAO,GAAG,GAAG,EAAE;gBACvB,aAAa,CAAC,mBAAmB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;gBACvD,qDAAqD;YACvD,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;YAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,cAAc,EAAE,KAAK,EAAE,GAAoB,EAAE,GAAqB,EAAE,EAAE;QAChG,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,SAAmB,CAAC;YAChD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE;wBACL,IAAI,EAAE,SAAS,CAAC,aAAa;wBAC7B,OAAO,EAAE,uCAAuC;qBACjD;iBACF,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;YACtD,MAAM,SAAS,GAAG,aAAa,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;YAExD,IAAI,SAAS,YAAY,kBAAkB,EAAE,CAAC;gBAC5C,MAAM,SAAS,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;gBACtD,OAAO;YACT,CAAC;YAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE;oBACL,IAAI,EAAE,SAAS,CAAC,aAAa;oBAC7B,OAAO,EAAE,qBAAqB;iBAC/B;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;YAC/C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE;oBACL,IAAI,EAAE,SAAS,CAAC,aAAa;oBAC7B,OAAO,EAAE,uBAAuB;iBACjC;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/build/transport/http/routes/streamableHttpRoutes.d.ts

@@ -0,0 +1,4 @@
+import express from 'express';
+import { ServerManager } from '../../../core/server/serverManager.js';
+export declare function setupStreamableHttpRoutes(app: express.Application, serverManager: ServerManager, authMiddleware: express.RequestHandler): void;
+//# sourceMappingURL=streamableHttpRoutes.d.ts.map

package/build/transport/http/routes/streamableHttpRoutes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"streamableHttpRoutes.d.ts","sourceRoot":"","sources":["../../../../src/transport/http/routes/streamableHttpRoutes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAM9B,OAAO,EAAE,aAAa,EAAE,MAAM,uCAAuC,CAAC;AAGtE,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,OAAO,CAAC,WAAW,EACxB,aAAa,EAAE,aAAa,EAC5B,cAAc,EAAE,OAAO,CAAC,cAAc,GACrC,IAAI,CA6HN"}

package/build/transport/http/routes/streamableHttpRoutes.js

@@ -0,0 +1,121 @@
+import { randomUUID } from 'node:crypto';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { ErrorCode } from '@modelcontextprotocol/sdk/types.js';
+import logger from '../../../logger/logger.js';
+import { STREAMABLE_HTTP_ENDPOINT } from '../../../constants.js';
+import tagsExtractor from '../../../utils/tagsExtractor.js';
+export function setupStreamableHttpRoutes(app, serverManager, authMiddleware) {
+    app.post(STREAMABLE_HTTP_ENDPOINT, authMiddleware, tagsExtractor, async (req, res) => {
+        try {
+            logger.info('[POST] streamable-http', { query: req.query, body: req.body, headers: req.headers });
+            let transport;
+            const sessionId = req.headers['mcp-session-id'];
+            if (!sessionId) {
+                const id = randomUUID();
+                transport = new StreamableHTTPServerTransport({
+                    sessionIdGenerator: () => id,
+                });
+                // Use tags from middleware
+                const tags = res.locals.tags;
+                await serverManager.connectTransport(transport, id, {
+                    tags,
+                    enablePagination: req.query.pagination === 'true',
+                });
+                transport.onclose = () => {
+                    serverManager.disconnectTransport(id);
+                    // Note: ServerManager already logs the disconnection
+                };
+            }
+            else {
+                const existingTransport = serverManager.getTransport(sessionId);
+                if (!existingTransport) {
+                    res.status(404).json({
+                        error: {
+                            code: ErrorCode.InvalidParams,
+                            message: 'No active streamable HTTP session found for the provided sessionId',
+                        },
+                    });
+                    return;
+                }
+                if (existingTransport instanceof StreamableHTTPServerTransport) {
+                    transport = existingTransport;
+                }
+                else {
+                    res.status(400).json({
+                        error: {
+                            code: ErrorCode.InvalidParams,
+                            message: 'Session already exists but uses a different transport protocol',
+                        },
+                    });
+                    return;
+                }
+            }
+            await transport.handleRequest(req, res, req.body);
+        }
+        catch (error) {
+            logger.error('Streamable HTTP error:', error);
+            res.status(500).end();
+        }
+    });
+    app.get(STREAMABLE_HTTP_ENDPOINT, authMiddleware, async (req, res) => {
+        try {
+            logger.info('[GET] streamable-http', { query: req.query, headers: req.headers });
+            const sessionId = req.headers['mcp-session-id'];
+            if (!sessionId) {
+                res.status(400).json({
+                    error: {
+                        code: ErrorCode.InvalidParams,
+                        message: 'Invalid params: sessionId is required',
+                    },
+                });
+                return;
+            }
+            const transport = serverManager.getTransport(sessionId);
+            if (!transport) {
+                res.status(404).json({
+                    error: {
+                        code: ErrorCode.InvalidParams,
+                        message: 'No active streamable HTTP session found for the provided sessionId',
+                    },
+                });
+                return;
+            }
+            await transport.handleRequest(req, res, req.body);
+        }
+        catch (error) {
+            logger.error('Streamable HTTP error:', error);
+            res.status(500).end();
+        }
+    });
+    app.delete(STREAMABLE_HTTP_ENDPOINT, authMiddleware, async (req, res) => {
+        try {
+            logger.info('[DELETE] streamable-http', { query: req.query, headers: req.headers });
+            const sessionId = req.headers['mcp-session-id'];
+            if (!sessionId) {
+                res.status(400).json({
+                    error: {
+                        code: ErrorCode.InvalidParams,
+                        message: 'Invalid params: sessionId is required',
+                    },
+                });
+                return;
+            }
+            const transport = serverManager.getTransport(sessionId);
+            if (!transport) {
+                res.status(404).json({
+                    error: {
+                        code: ErrorCode.InvalidParams,
+                        message: 'No active streamable HTTP session found for the provided sessionId',
+                    },
+                });
+                return;
+            }
+            await transport.handleRequest(req, res);
+        }
+        catch (error) {
+            logger.error('Streamable HTTP error:', error);
+            res.status(500).end();
+        }
+    });
+}
+//# sourceMappingURL=streamableHttpRoutes.js.map

package/build/transport/http/routes/streamableHttpRoutes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"streamableHttpRoutes.js","sourceRoot":"","sources":["../../../../src/transport/http/routes/streamableHttpRoutes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,SAAS,EAAE,MAAM,oCAAoC,CAAC;AAC/D,OAAO,MAAM,MAAM,2BAA2B,CAAC;AAC/C,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAEjE,OAAO,aAAa,MAAM,iCAAiC,CAAC;AAE5D,MAAM,UAAU,yBAAyB,CACvC,GAAwB,EACxB,aAA4B,EAC5B,cAAsC;IAEtC,GAAG,CAAC,IAAI,CACN,wBAAwB,EACxB,cAAc,EACd,aAAa,EACb,KAAK,EAAE,GAAoB,EAAE,GAAqB,EAAE,EAAE;QACpD,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAElG,IAAI,SAAwC,CAAC;YAC7C,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAuB,CAAC;YAEtE,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;gBACxB,SAAS,GAAG,IAAI,6BAA6B,CAAC;oBAC5C,kBAAkB,EAAE,GAAG,EAAE,CAAC,EAAE;iBAC7B,CAAC,CAAC;gBAEH,2BAA2B;gBAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;gBAE7B,MAAM,aAAa,CAAC,gBAAgB,CAAC,SAAS,EAAE,EAAE,EAAE;oBAClD,IAAI;oBACJ,gBAAgB,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,MAAM;iBAClD,CAAC,CAAC;gBAEH,SAAS,CAAC,OAAO,GAAG,GAAG,EAAE;oBACvB,aAAa,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;oBACtC,qDAAqD;gBACvD,CAAC,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,iBAAiB,GAAG,aAAa,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;gBAChE,IAAI,CAAC,iBAAiB,EAAE,CAAC;oBACvB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBACnB,KAAK,EAAE;4BACL,IAAI,EAAE,SAAS,CAAC,aAAa;4BAC7B,OAAO,EAAE,oEAAoE;yBAC9E;qBACF,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBACD,IAAI,iBAAiB,YAAY,6BAA6B,EAAE,CAAC;oBAC/D,SAAS,GAAG,iBAAiB,CAAC;gBAChC,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBACnB,KAAK,EAAE;4BACL,IAAI,EAAE,SAAS,CAAC,aAAa;4BAC7B,OAAO,EAAE,gEAAgE;yBAC1E;qBACF,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;YACH,CAAC;YAED,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;YAC9C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,cAAc,EAAE,KAAK,EAAE,GAAoB,EAAE,GAAqB,EAAE,EAAE;QACtG,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAEjF,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAuB,CAAC;YACtE,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE;wBACL,IAAI,EAAE,SAAS,CAAC,aAAa;wBAC7B,OAAO,EAAE,uCAAuC;qBACjD;iBACF,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,MAAM,SAAS,GAAG,aAAa,CAAC,YAAY,CAAC,SAAS,CAAkC,CAAC;YACzF,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE;wBACL,IAAI,EAAE,SAAS,CAAC,aAAa;wBAC7B,OAAO,EAAE,oEAAoE;qBAC9E;iBACF,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;YAC9C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,wBAAwB,EAAE,cAAc,EAAE,KAAK,EAAE,GAAoB,EAAE,GAAqB,EAAE,EAAE;QACzG,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAEpF,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAuB,CAAC;YACtE,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE;wBACL,IAAI,EAAE,SAAS,CAAC,aAAa;wBAC7B,OAAO,EAAE,uCAAuC;qBACjD;iBACF,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,MAAM,SAAS,GAAG,aAAa,CAAC,YAAY,CAAC,SAAS,CAAkC,CAAC;YACzF,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE;wBACL,IAAI,EAAE,SAAS,CAAC,aAAa;wBAC7B,OAAO,EAAE,oEAAoE;qBAC9E;iBACF,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;YAC9C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/build/transport/http/server.d.ts

@@ -0,0 +1,69 @@
+import { ServerManager } from '../../core/server/serverManager.js';
+/**
+ * ExpressServer orchestrates the HTTP/SSE transport layer for the MCP server.
+ *
+ * This class manages the Express application, authentication, and route setup.
+ * It provides both HTTP and SSE transport options with optional OAuth 2.1 authentication.
+ *
+ * @example
+ * ```typescript
+ * const serverManager = await setupServer();
+ * const expressServer = new ExpressServer(serverManager);
+ * expressServer.start(3050, 'localhost');
+ * ```
+ */
+export declare class ExpressServer {
+    private app;
+    private serverManager;
+    private authManager;
+    private configManager;
+    /**
+     * Creates a new ExpressServer instance.
+     *
+     * Initializes the Express application, sets up middleware, authentication,
+     * and configures all routes for MCP transport and OAuth endpoints.
+     *
+     * @param serverManager - The server manager instance for handling MCP operations
+     */
+    constructor(serverManager: ServerManager);
+    /**
+     * Sets up Express middleware including CORS, body parsing, and error handling.
+     *
+     * Configures the basic middleware stack required for the MCP server:
+     * - CORS for cross-origin requests
+     * - JSON body parsing
+     * - Global error handling
+     */
+    private setupMiddleware;
+    /**
+     * Sets up all application routes including OAuth and MCP transport endpoints.
+     *
+     * Configures the following route groups:
+     * - OAuth 2.1 endpoints (always available, auth can be disabled)
+     * - Streamable HTTP transport routes with authentication middleware
+     * - SSE transport routes with authentication middleware
+     *
+     * Logs the authentication status for debugging purposes.
+     */
+    private setupRoutes;
+    /**
+     * Starts the Express server on the specified port and host.
+     *
+     * Binds the Express application to the network interface and logs
+     * the server status including authentication configuration.
+     *
+     * @param port - The port number to listen on
+     * @param host - The host address to bind to
+     */
+    start(port: number, host: string): void;
+    /**
+     * Performs graceful shutdown of the Express server.
+     *
+     * Cleans up resources including:
+     * - Authentication manager shutdown
+     * - Session cleanup
+     * - Timer cleanup
+     */
+    shutdown(): void;
+}
+//# sourceMappingURL=server.d.ts.map

package/build/transport/http/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/transport/http/server.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AAUnE;;;;;;;;;;;;GAYG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,GAAG,CAAsB;IACjC,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,aAAa,CAAsB;IAE3C;;;;;;;OAOG;gBACS,aAAa,EAAE,aAAa;IAaxC;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAQvB;;;;;;;;;OASG;IACH,OAAO,CAAC,WAAW;IAmBnB;;;;;;;;OAQG;IACI,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAO9C;;;;;;;OAOG;IACI,QAAQ,IAAI,IAAI;CAGxB"}

package/build/transport/http/server.js

@@ -0,0 +1,115 @@
+import express from 'express';
+import bodyParser from 'body-parser';
+import cors from 'cors';
+import logger from '../../logger/logger.js';
+import errorHandler from './errorHandler.js';
+import { AuthManager } from '../../auth/authManager.js';
+import { createAuthMiddleware } from '../../auth/authMiddleware.js';
+import { setupOAuthRoutes } from './routes/oauthRoutes.js';
+import { setupStreamableHttpRoutes } from './routes/streamableHttpRoutes.js';
+import { setupSseRoutes } from './routes/sseRoutes.js';
+import { ServerConfigManager } from '../../core/server/serverConfig.js';
+/**
+ * ExpressServer orchestrates the HTTP/SSE transport layer for the MCP server.
+ *
+ * This class manages the Express application, authentication, and route setup.
+ * It provides both HTTP and SSE transport options with optional OAuth 2.1 authentication.
+ *
+ * @example
+ * ```typescript
+ * const serverManager = await setupServer();
+ * const expressServer = new ExpressServer(serverManager);
+ * expressServer.start(3050, 'localhost');
+ * ```
+ */
+export class ExpressServer {
+    app;
+    serverManager;
+    authManager;
+    configManager;
+    /**
+     * Creates a new ExpressServer instance.
+     *
+     * Initializes the Express application, sets up middleware, authentication,
+     * and configures all routes for MCP transport and OAuth endpoints.
+     *
+     * @param serverManager - The server manager instance for handling MCP operations
+     */
+    constructor(serverManager) {
+        this.app = express();
+        this.serverManager = serverManager;
+        this.configManager = ServerConfigManager.getInstance();
+        // Initialize auth manager with custom session storage path if configured
+        const sessionStoragePath = this.configManager.getSessionStoragePath();
+        this.authManager = new AuthManager(sessionStoragePath);
+        this.setupMiddleware();
+        this.setupRoutes();
+    }
+    /**
+     * Sets up Express middleware including CORS, body parsing, and error handling.
+     *
+     * Configures the basic middleware stack required for the MCP server:
+     * - CORS for cross-origin requests
+     * - JSON body parsing
+     * - Global error handling
+     */
+    setupMiddleware() {
+        this.app.use(cors()); // Allow all origins for local dev
+        this.app.use(bodyParser.json());
+        // Add error handling middleware
+        this.app.use(errorHandler);
+    }
+    /**
+     * Sets up all application routes including OAuth and MCP transport endpoints.
+     *
+     * Configures the following route groups:
+     * - OAuth 2.1 endpoints (always available, auth can be disabled)
+     * - Streamable HTTP transport routes with authentication middleware
+     * - SSE transport routes with authentication middleware
+     *
+     * Logs the authentication status for debugging purposes.
+     */
+    setupRoutes() {
+        // Create auth middleware
+        const authMiddleware = createAuthMiddleware(this.authManager);
+        // Setup OAuth routes (always available, but auth can be disabled)
+        setupOAuthRoutes(this.app, this.authManager);
+        // Setup MCP transport routes with auth middleware
+        setupStreamableHttpRoutes(this.app, this.serverManager, authMiddleware);
+        setupSseRoutes(this.app, this.serverManager, authMiddleware);
+        // Log authentication status
+        if (this.authManager.isAuthEnabled()) {
+            logger.info('Authentication enabled - OAuth 2.1 endpoints available');
+        }
+        else {
+            logger.info('Authentication disabled - all endpoints accessible without auth');
+        }
+    }
+    /**
+     * Starts the Express server on the specified port and host.
+     *
+     * Binds the Express application to the network interface and logs
+     * the server status including authentication configuration.
+     *
+     * @param port - The port number to listen on
+     * @param host - The host address to bind to
+     */
+    start(port, host) {
+        this.app.listen(port, host, () => {
+            const authStatus = this.authManager.isAuthEnabled() ? 'with authentication' : 'without authentication';
+            logger.info(`Server is running on port ${port} with HTTP/SSE and Streamable HTTP transport ${authStatus}`);
+        });
+    }
+    /**
+     * Performs graceful shutdown of the Express server.
+     *
+     * Cleans up resources including:
+     * - Authentication manager shutdown
+     * - Session cleanup
+     * - Timer cleanup
+     */
+    shutdown() {
+        this.authManager.shutdown();
+    }
+}
+//# sourceMappingURL=server.js.map

package/build/transport/http/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../../src/transport/http/server.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,UAAU,MAAM,aAAa,CAAC;AACrC,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,OAAO,MAAM,MAAM,wBAAwB,CAAC;AAC5C,OAAO,YAAY,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAExE;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,aAAa;IAChB,GAAG,CAAsB;IACzB,aAAa,CAAgB;IAC7B,WAAW,CAAc;IACzB,aAAa,CAAsB;IAE3C;;;;;;;OAOG;IACH,YAAY,aAA4B;QACtC,IAAI,CAAC,GAAG,GAAG,OAAO,EAAE,CAAC;QACrB,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,aAAa,GAAG,mBAAmB,CAAC,WAAW,EAAE,CAAC;QAEvD,yEAAyE;QACzE,MAAM,kBAAkB,GAAG,IAAI,CAAC,aAAa,CAAC,qBAAqB,EAAE,CAAC;QACtE,IAAI,CAAC,WAAW,GAAG,IAAI,WAAW,CAAC,kBAAkB,CAAC,CAAC;QAEvD,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,WAAW,EAAE,CAAC;IACrB,CAAC;IAED;;;;;;;OAOG;IACK,eAAe;QACrB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,kCAAkC;QACxD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;QAEhC,gCAAgC;QAChC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC7B,CAAC;IAED;;;;;;;;;OASG;IACK,WAAW;QACjB,yBAAyB;QACzB,MAAM,cAAc,GAAG,oBAAoB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAE9D,kEAAkE;QAClE,gBAAgB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAE7C,kDAAkD;QAClD,yBAAyB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;QACxE,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;QAE7D,4BAA4B;QAC5B,IAAI,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,EAAE,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;QACxE,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,IAAY,EAAE,IAAY;QACrC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;YAC/B,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,wBAAwB,CAAC;YACvG,MAAM,CAAC,IAAI,CAAC,6BAA6B,IAAI,gDAAgD,UAAU,EAAE,CAAC,CAAC;QAC7G,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACI,QAAQ;QACb,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;IAC9B,CAAC;CACF"}

package/build/utils/clientFiltering.d.ts

@@ -1,5 +1,5 @@
 import { ServerCapabilities } from '@modelcontextprotocol/sdk/types.js';
-import { Clients } from '../types.js';
+import { Clients } from '../core/types/index.js';
 /**
  * Filters clients by tags
  * @param clients Record of client instances

package/build/utils/clientFiltering.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"clientFiltering.d.ts","sourceRoot":"","sources":["../../src/utils/clientFiltering.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAGtC;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAyB9E;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,kBAAkB,GAAG,OAAO,CAwBvG;AAED,KAAK,YAAY,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC;AAElD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,OAAO,EAAE,YAAY,EAAE,GAAG,YAAY,CAItE;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,oBAAoB,EAAE,kBAAkB,GAAG,YAAY,CAYrF;AAED;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,YAAY,CAYpD"}
+{"version":3,"file":"clientFiltering.d.ts","sourceRoot":"","sources":["../../src/utils/clientFiltering.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAGjD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAyB9E;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,kBAAkB,GAAG,OAAO,CAwBvG;AAED,KAAK,YAAY,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC;AAElD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,OAAO,EAAE,YAAY,EAAE,GAAG,YAAY,CAItE;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,oBAAoB,EAAE,kBAAkB,GAAG,YAAY,CAYrF;AAED;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,YAAY,CAYpD"}

package/build/utils/errorHandling.d.ts

@@ -50,6 +50,7 @@ export declare function formatErrorResponse(error: any): {
 };
 /**
  * Extracts client name and resource name from a URI
+ * Uses robust parsing to handle edge cases where separator might appear in resource names.
  * @param uri The URI to parse
  * @param separator The separator used in the URI
  * @returns An object with clientName and resourceName

package/build/utils/errorHandling.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errorHandling.d.ts","sourceRoot":"","sources":["../../src/utils/errorHandling.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAuB,MAAM,iBAAiB,CAAC;AAE9E;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,IAAI,SAAS,GAAG,EAAE,EACrD,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,EACjC,YAAY,EAAE,MAAM,GACnB,CAAC,GAAG,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAkB/B;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,GAAG,YAAY,CAUjF;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,CAAC,SAAS,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAE/G;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAKnD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAKtD;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,GAAG,SAAS,CAK/D;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,GAAG,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,GAAG,CAAA;CAAE,CAa7F;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAWrG"}
+{"version":3,"file":"errorHandling.d.ts","sourceRoot":"","sources":["../../src/utils/errorHandling.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAuB,MAAM,iBAAiB,CAAC;AAE9E;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,IAAI,SAAS,GAAG,EAAE,EACrD,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,EACjC,YAAY,EAAE,MAAM,GACnB,CAAC,GAAG,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAkB/B;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,GAAG,YAAY,CAUjF;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,CAAC,SAAS,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAE/G;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAKnD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAKtD;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,GAAG,SAAS,CAK/D;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,GAAG,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,GAAG,CAAA;CAAE,CAa7F;AAED;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAyCrG"}

package/build/utils/errorHandling.js

@@ -102,19 +102,43 @@ export function formatErrorResponse(error) {
 }
 /**
  * Extracts client name and resource name from a URI
+ * Uses robust parsing to handle edge cases where separator might appear in resource names.
  * @param uri The URI to parse
  * @param separator The separator used in the URI
  * @returns An object with clientName and resourceName
  * @throws InvalidRequestError if the URI is invalid
  */
 export function parseUri(uri, separator) {
-    const parts = uri.split(separator);
-    if (parts.length !== 2) {
-        throw new InvalidRequestError(`Invalid URI format: ${uri}`);
+    // Validate inputs
+    if (!uri || typeof uri !== 'string') {
+        throw new InvalidRequestError('URI must be a non-empty string');
+    }
+    if (!separator || typeof separator !== 'string') {
+        throw new InvalidRequestError('Separator must be a non-empty string');
+    }
+    // Find the first occurrence of the separator
+    const separatorIndex = uri.indexOf(separator);
+    if (separatorIndex === -1) {
+        throw new InvalidRequestError(`Invalid URI format: missing separator '${separator}' in '${uri}'`);
+    }
+    if (separatorIndex === 0) {
+        throw new InvalidRequestError(`Invalid URI format: URI cannot start with separator '${separator}'`);
+    }
+    if (separatorIndex === uri.length - separator.length) {
+        throw new InvalidRequestError(`Invalid URI format: URI cannot end with separator '${separator}'`);
+    }
+    const clientName = uri.substring(0, separatorIndex);
+    const resourceName = uri.substring(separatorIndex + separator.length);
+    // Validate extracted parts
+    if (!clientName.trim()) {
+        throw new InvalidRequestError('Client name cannot be empty');
+    }
+    if (!resourceName.trim()) {
+        throw new InvalidRequestError('Resource name cannot be empty');
     }
     return {
-        clientName: parts[0],
-        resourceName: parts[1],
+        clientName,
+        resourceName,
     };
 }
 //# sourceMappingURL=errorHandling.js.map