@anton.andrusenko/shopify-mcp-admin 2.2.1 → 2.3.0

package/dist/index.js

@@ -1,8 +1,12 @@
 #!/usr/bin/env node
 import {
   clearFallbackContext,
+  correlationMiddleware,
+  createLogger,
   createMultiTenantContext,
   createShopifyClient,
+  flushLogs,
+  generateCorrelationId,
   getRequestContext,
   getShopifyClient,
   getStoreAlerts,
@@ -14,14 +18,17 @@ import {
   getStorePolicies,
   getStoreShipping,
   getStoreTaxes,
+  initSentry,
   isMultiTenantContext,
   registerAllTools,
   requestContextStorage,
   sanitizeErrorMessage,
+  sentryErrorHandler,
+  sentryRequestMiddleware,
   setCurrentContextKey,
   setFallbackContext,
   validateShopifyToken
-} from "./chunk-LMFNHULG.js";
+} from "./chunk-RBXQOPVF.js";
 import {
   disconnectPrisma,
   getPrismaClient,
@@ -30,7 +37,7 @@ import {
 } from "./chunk-JU5IFCVJ.js";
 import {
   createJsonRpcError
-} from "./chunk-PQKNBYJN.js";
+} from "./chunk-EQUN4XCH.js";
 import {
   getConfig,
   log,
@@ -49,172 +56,6 @@ import { readFileSync as readFileSync2 } from "fs";
 import { dirname as dirname2, join as join2 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
-// src/monitoring/sentry.ts
-import * as Sentry from "@sentry/node";
-function initSentry(options) {
-  const { dsn, environment = "production", release } = options;
-  if (!dsn) {
-    return;
-  }
-  Sentry.init({
-    dsn,
-    environment,
-    // Sample 10% of transactions for performance monitoring (AC-13.7.4)
-    tracesSampleRate: 0.1,
-    // Release tracking for deployment correlation
-    release: release || "unknown",
-    // Sanitize sensitive data before sending to Sentry
-    beforeSend(event) {
-      if (event.request?.headers) {
-        const sensitiveHeaders = [
-          "authorization",
-          "x-api-key",
-          "cookie",
-          "x-shopify-access-token",
-          "x-shopify-hmac-sha256"
-        ];
-        for (const header of sensitiveHeaders) {
-          delete event.request.headers[header];
-        }
-      }
-      if (event.request?.data) {
-        const data = event.request.data;
-        const sensitiveKeys = ["token", "password", "secret", "key", "access_token"];
-        for (const key of Object.keys(data)) {
-          if (sensitiveKeys.some((sensitive) => key.toLowerCase().includes(sensitive))) {
-            data[key] = "[REDACTED]";
-          }
-        }
-      }
-      if (event.message) {
-        event.message = sanitizeErrorMessage2(event.message);
-      }
-      if (event.exception?.values) {
-        for (const exception of event.exception.values) {
-          if (exception.value) {
-            exception.value = sanitizeErrorMessage2(exception.value);
-          }
-        }
-      }
-      return event;
-    },
-    // Integrations
-    integrations: [
-      // Capture uncaught exceptions and unhandled rejections
-      Sentry.onUncaughtExceptionIntegration(),
-      Sentry.onUnhandledRejectionIntegration(),
-      // Capture HTTP request data
-      Sentry.requestDataIntegration(),
-      // Deduplicate similar errors
-      Sentry.dedupeIntegration()
-    ]
-  });
-}
-function sanitizeErrorMessage2(message) {
-  const patterns = [
-    /shpat_[a-zA-Z0-9]+/g,
-    /shpua_[a-zA-Z0-9]+/g,
-    /Bearer\s+[a-zA-Z0-9_-]+/g,
-    /access_token[=:]\s*[a-zA-Z0-9_-]+/gi,
-    /client_secret[=:]\s*[a-zA-Z0-9_-]+/gi,
-    /sk_live_[a-zA-Z0-9_-]+/g
-  ];
-  let sanitized = message;
-  for (const pattern of patterns) {
-    sanitized = sanitized.replace(pattern, "[REDACTED]");
-  }
-  return sanitized;
-}
-function sentryRequestMiddleware(req, res, next) {
-  const context = getRequestContext();
-  if (context) {
-    if (context.correlationId) {
-      Sentry.setTag("correlationId", context.correlationId);
-      Sentry.setContext("request", {
-        correlationId: context.correlationId
-      });
-    }
-    if (isMultiTenantContext(context) && context.tenantId) {
-      Sentry.setTag("tenantId", context.tenantId);
-      Sentry.setContext("tenant", {
-        tenantId: context.tenantId
-      });
-    }
-    if (context.shopDomain) {
-      Sentry.setTag("shopDomain", context.shopDomain);
-    }
-  }
-  Sentry.setContext("http", {
-    method: req.method,
-    url: req.url,
-    path: req.path,
-    query: req.query,
-    userAgent: req.get("user-agent"),
-    ip: req.ip
-  });
-  Sentry.addBreadcrumb({
-    category: "http",
-    message: `${req.method} ${req.path}`,
-    level: "info",
-    data: {
-      method: req.method,
-      path: req.path
-      // statusCode will be updated when response finishes (see below)
-    }
-  });
-  res.on("finish", () => {
-    Sentry.addBreadcrumb({
-      category: "http",
-      message: `${req.method} ${req.path} - ${res.statusCode}`,
-      level: res.statusCode >= 400 ? "error" : "info",
-      data: {
-        method: req.method,
-        path: req.path,
-        statusCode: res.statusCode
-      }
-    });
-  });
-  next();
-}
-function sentryErrorHandler(error, req, _res, next) {
-  Sentry.captureException(error, {
-    tags: {
-      path: req.path,
-      method: req.method
-    },
-    extra: {
-      url: req.url,
-      query: req.query,
-      body: req.body
-    }
-  });
-  next(error);
-}
-function captureError(error, context) {
-  const requestContext = getRequestContext();
-  Sentry.withScope((scope) => {
-    if (requestContext?.correlationId) {
-      scope.setTag("correlationId", requestContext.correlationId);
-      scope.setContext("request", {
-        correlationId: requestContext.correlationId
-      });
-    }
-    if (requestContext && isMultiTenantContext(requestContext) && requestContext.tenantId) {
-      scope.setTag("tenantId", requestContext.tenantId);
-      scope.setContext("tenant", {
-        tenantId: requestContext.tenantId
-      });
-    }
-    if (requestContext?.shopDomain) {
-      scope.setTag("shopDomain", requestContext.shopDomain);
-    }
-    if (context) {
-      scope.setContext("additional", context);
-    }
-    Sentry.captureException(error);
-  });
-}
-
 // src/server.ts
 import { createRequire } from "module";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -790,7 +631,7 @@ function createStdioTransport() {
 }
 
 // src/transports/http.ts
-import { randomUUID as randomUUID3 } from "crypto";
+import { randomUUID as randomUUID2 } from "crypto";
 import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
@@ -805,194 +646,6 @@ import { z } from "zod";
 
 // src/middleware/tenant-auth.ts
 import { TenantStatus } from "@prisma/client";
-
-// src/logging/structured-logger.ts
-import {
-  pino as createPino,
-  destination as pinoDestination,
-  transport as pinoTransport
-} from "pino";
-var SANITIZATION_PATTERNS = [
-  { pattern: /shpat_[a-zA-Z0-9]+/g, replacement: "[REDACTED]" },
-  { pattern: /shpua_[a-zA-Z0-9]+/g, replacement: "[REDACTED]" },
-  { pattern: /Bearer\s+[a-zA-Z0-9_-]+/g, replacement: "Bearer [REDACTED]" },
-  { pattern: /access_token[=:]\s*[a-zA-Z0-9_-]+/gi, replacement: "access_token=[REDACTED]" },
-  { pattern: /client_secret[=:]\s*[a-zA-Z0-9_-]+/gi, replacement: "client_secret=[REDACTED]" },
-  { pattern: /sk_live_[a-zA-Z0-9_-]+/g, replacement: "[REDACTED]" }
-];
-function sanitizeText(text) {
-  let result = text;
-  for (const { pattern, replacement } of SANITIZATION_PATTERNS) {
-    result = result.replace(pattern, replacement);
-  }
-  return result;
-}
-function sanitizeObject(obj, seen = /* @__PURE__ */ new WeakSet()) {
-  if (typeof obj === "string") {
-    return sanitizeText(obj);
-  }
-  if (obj === null || typeof obj !== "object") {
-    return obj;
-  }
-  if (seen.has(obj)) {
-    return "[Circular]";
-  }
-  seen.add(obj);
-  if (Array.isArray(obj)) {
-    return obj.map((item) => sanitizeObject(item, seen));
-  }
-  const result = {};
-  for (const [key, value] of Object.entries(obj)) {
-    result[key] = sanitizeObject(value, seen);
-  }
-  return result;
-}
-function getInstanceId() {
-  return process.env.INSTANCE_ID || process.env.HOSTNAME || "unknown";
-}
-function getLogLevel() {
-  const level = process.env.LOG_LEVEL?.toLowerCase();
-  if (level === "debug" || level === "info" || level === "warn" || level === "error") {
-    return level;
-  }
-  return "info";
-}
-function isDevelopment() {
-  return process.env.NODE_ENV === "development";
-}
-function createTransport() {
-  if (isDevelopment()) {
-    try {
-      return {
-        target: "pino-pretty",
-        options: {
-          destination: 2,
-          // stderr (fd 2)
-          colorize: true,
-          translateTime: "HH:MM:ss.l",
-          ignore: "pid,hostname"
-        }
-      };
-    } catch {
-      return void 0;
-    }
-  }
-  return void 0;
-}
-function createBasePinoLogger() {
-  const level = getLogLevel();
-  const transport = createTransport();
-  const instanceId = getInstanceId();
-  const options = {
-    level,
-    // ISO 8601 timestamp format (AC-13.1.3)
-    timestamp: () => `,"time":"${(/* @__PURE__ */ new Date()).toISOString()}"`,
-    // Format level as string instead of number
-    formatters: {
-      level: (label) => ({ level: label })
-    },
-    // Base bindings (can be overridden by child loggers)
-    // Story 13.5: Add instance ID for multi-instance deployment identification
-    base: {
-      instanceId
-      // AC-13.5.1: Instance ID for load balancer distribution verification
-    }
-  };
-  if (transport) {
-    return createPino(options, pinoTransport(transport));
-  }
-  return createPino(options, pinoDestination({ dest: 2, sync: false }));
-}
-var basePinoLogger = createBasePinoLogger();
-function createLogger(module) {
-  function getContextFields() {
-    const context = getRequestContext();
-    const fields = { module };
-    if (context) {
-      if (context.correlationId) {
-        fields.correlationId = context.correlationId;
-      }
-      if (context.shopDomain) {
-        fields.shopDomain = context.shopDomain;
-      }
-      if (isMultiTenantContext(context)) {
-        fields.tenantId = context.tenantId;
-      }
-    }
-    return fields;
-  }
-  function mergeData(data) {
-    const contextFields = getContextFields();
-    if (data) {
-      const sanitizedData = sanitizeObject(data);
-      return { ...contextFields, ...sanitizedData };
-    }
-    return contextFields;
-  }
-  function formatError(error) {
-    return {
-      error: {
-        name: error.name,
-        message: sanitizeText(error.message),
-        stack: error.stack ? sanitizeText(error.stack) : void 0
-      }
-    };
-  }
-  const logger3 = {
-    debug: (msg, data) => {
-      basePinoLogger.debug(mergeData(data), sanitizeText(msg));
-    },
-    info: (msg, data) => {
-      basePinoLogger.info(mergeData(data), sanitizeText(msg));
-    },
-    warn: (msg, data) => {
-      basePinoLogger.warn(mergeData(data), sanitizeText(msg));
-    },
-    error: (msg, error, data) => {
-      const merged = mergeData(data);
-      if (error) {
-        Object.assign(merged, formatError(error));
-        captureError(error, data);
-      }
-      basePinoLogger.error(merged, sanitizeText(msg));
-    },
-    child: (bindings) => {
-      const childModule = bindings.module || module;
-      const childLogger = createLogger(childModule);
-      const originalMergeData = mergeData;
-      const enhancedMergeData = (data) => {
-        const base = originalMergeData(data);
-        const sanitizedBindings = sanitizeObject(bindings);
-        return { ...base, ...sanitizedBindings };
-      };
-      return {
-        debug: (msg, data) => {
-          basePinoLogger.debug(enhancedMergeData(data), sanitizeText(msg));
-        },
-        info: (msg, data) => {
-          basePinoLogger.info(enhancedMergeData(data), sanitizeText(msg));
-        },
-        warn: (msg, data) => {
-          basePinoLogger.warn(enhancedMergeData(data), sanitizeText(msg));
-        },
-        error: (msg, error, data) => {
-          const merged = enhancedMergeData(data);
-          if (error) {
-            Object.assign(merged, formatError(error));
-          }
-          basePinoLogger.error(merged, sanitizeText(msg));
-        },
-        child: childLogger.child
-      };
-    }
-  };
-  return logger3;
-}
-function flushLogs() {
-  basePinoLogger.flush();
-}
-
-// src/middleware/tenant-auth.ts
 var logger = createLogger("middleware/tenant-auth");
 async function requireTenantAuth(req, res, next) {
   try {
@@ -2231,6 +1884,7 @@ function createShopsRouter(options) {
 // src/api/keys.ts
 import { Router as Router3 } from "express";
 import { z as z3 } from "zod";
+var logger2 = createLogger("api/keys");
 var DEFAULT_SCOPES = ["*"];
 var createKeySchema = z3.object({
   name: z3.string().min(1, "Name is required").max(100, "Name must be 100 characters or less"),
@@ -2329,6 +1983,114 @@ function createKeysRouter(options) {
       });
     }
   });
+  router.get("/:keyId/metrics", async (req, res) => {
+    try {
+      const tenantId = req.tenantContext?.tenantId;
+      if (!tenantId) {
+        return res.status(401).json({
+          error: "Unauthorized",
+          message: "Tenant context not found"
+        });
+      }
+      const { keyId } = req.params;
+      const key = await prisma2.apiKey.findFirst({
+        where: {
+          id: keyId,
+          tenantId,
+          revokedAt: null
+        },
+        select: { id: true }
+      });
+      if (!key) {
+        return res.status(404).json({
+          error: "Not Found",
+          message: "API key not found"
+        });
+      }
+      const now = /* @__PURE__ */ new Date();
+      const sevenDaysAgo = new Date(now);
+      sevenDaysAgo.setDate(sevenDaysAgo.getDate() - 7);
+      const thirtyDaysAgo = new Date(now);
+      thirtyDaysAgo.setDate(thirtyDaysAgo.getDate() - 30);
+      const baseWhere = {
+        tenantId,
+        apiKeyId: keyId
+      };
+      const queryStartTime = Date.now();
+      const [calls7d, calls30d, totalCalls, successCount, avgDuration, lastUsed] = await Promise.all([
+        // Calls in last 7 days
+        prisma2.toolExecutionLog.count({
+          where: {
+            ...baseWhere,
+            createdAt: { gte: sevenDaysAgo }
+          }
+        }),
+        // Calls in last 30 days
+        prisma2.toolExecutionLog.count({
+          where: {
+            ...baseWhere,
+            createdAt: { gte: thirtyDaysAgo }
+          }
+        }),
+        // Total calls (for success rate calculation)
+        prisma2.toolExecutionLog.count({
+          where: {
+            ...baseWhere,
+            createdAt: { gte: sevenDaysAgo }
+          }
+        }),
+        // Success count (for success rate calculation)
+        prisma2.toolExecutionLog.count({
+          where: {
+            ...baseWhere,
+            createdAt: { gte: sevenDaysAgo },
+            status: "SUCCESS"
+          }
+        }),
+        // Average duration
+        prisma2.toolExecutionLog.aggregate({
+          where: {
+            ...baseWhere,
+            createdAt: { gte: sevenDaysAgo },
+            durationMs: { not: null }
+          },
+          _avg: { durationMs: true }
+        }),
+        // Most recent execution
+        prisma2.toolExecutionLog.findFirst({
+          where: baseWhere,
+          orderBy: { createdAt: "desc" },
+          select: { createdAt: true }
+        })
+      ]);
+      const successRate = totalCalls > 0 ? successCount / totalCalls * 100 : 0;
+      const queryDuration = Date.now() - queryStartTime;
+      if (queryDuration > 200) {
+        logger2.warn("API key metrics query exceeded 200ms", {
+          keyId,
+          tenantId,
+          durationMs: queryDuration
+        });
+      }
+      const response = {
+        calls7d,
+        calls30d,
+        successRate: Math.round(successRate * 10) / 10,
+        // Round to 1 decimal place
+        avgDurationMs: Math.round(avgDuration._avg.durationMs ?? 0),
+        lastUsedAt: lastUsed?.createdAt.toISOString() ?? null
+      };
+      return res.json(response);
+    } catch (error) {
+      logger2.error("metrics endpoint error", error, {
+        correlationId: req.headers["x-correlation-id"]
+      });
+      return res.status(500).json({
+        error: "Internal Server Error",
+        message: "Failed to compute API key metrics"
+      });
+    }
+  });
   router.delete("/:keyId", async (req, res) => {
     try {
       const tenantId = req.tenantContext?.tenantId;
@@ -2467,13 +2229,14 @@ function createAuthRouter(_config) {
           }
         }
       }
+      const sameSiteSetting = isProduction ? "none" : "lax";
       res.cookie("session_id", sessionId, {
         httpOnly: true,
         // Prevents JavaScript access (XSS protection)
         secure: isProduction,
-        // HTTPS only in production
-        sameSite: "lax",
-        // CSRF protection
+        // HTTPS only in production (required for SameSite=None)
+        sameSite: sameSiteSetting,
+        // 'none' in production for Claude.ai OAuth iframe compatibility
         path: "/",
         // Explicitly set path
         domain: cookieDomain,
@@ -2527,7 +2290,7 @@ function createAuthRouter(_config) {
         res.clearCookie("session_id", {
           httpOnly: true,
           secure: isProduction,
-          sameSite: "lax",
+          sameSite: isProduction ? "none" : "lax",
           path: "/",
           domain: cookieDomain
         });
@@ -2555,7 +2318,7 @@ function createAuthRouter(_config) {
         res.clearCookie("session_id", {
           httpOnly: true,
           secure: isProduction,
-          sameSite: "lax",
+          sameSite: isProduction ? "none" : "lax",
           path: "/",
           domain: cookieDomain
         });
@@ -2575,9 +2338,36 @@ function createAuthRouter(_config) {
 // src/api/activity.ts
 import { Router as Router5 } from "express";
 import { z as z5 } from "zod";
+var logger3 = createLogger("api/activity");
 var usageSummaryQuerySchema = z5.object({
   months: z5.coerce.number().int().min(1).max(24).default(6)
 });
+var activityLogsQuerySchema = z5.object({
+  page: z5.coerce.number().int().min(1).default(1),
+  limit: z5.coerce.number().int().min(1).transform((val) => Math.min(val, 100)).default(50),
+  toolName: z5.string().optional(),
+  clientType: z5.enum(["api_key", "oauth_client"]).optional(),
+  oauthClientId: z5.string().uuid("Invalid OAuth client ID format").optional(),
+  apiKeyId: z5.string().uuid("Invalid API key ID format").optional(),
+  shopId: z5.string().uuid("Invalid shop ID format").optional(),
+  status: z5.enum(["SUCCESS", "ERROR", "VALIDATION_ERROR", "AUTH_ERROR", "TIMEOUT"]).optional(),
+  startDate: z5.string().datetime().optional(),
+  endDate: z5.string().datetime().optional()
+}).refine(
+  (data) => {
+    if (data.startDate && data.endDate) {
+      return new Date(data.endDate) >= new Date(data.startDate);
+    }
+    return true;
+  },
+  {
+    message: "endDate must be greater than or equal to startDate",
+    path: ["endDate"]
+  }
+);
+var activityStatsQuerySchema = z5.object({
+  period: z5.enum(["7d", "30d", "90d"]).default("7d")
+});
 function startOfMonth(d) {
   const out = new Date(d);
   out.setDate(1);
@@ -2640,18 +2430,293 @@ function createActivityRouter() {
       };
       return res.json(response);
     } catch (error) {
-      console.error("[ACTIVITY API] usage-summary error:", error);
+      logger3.error("usage-summary error", error);
       return res.status(500).json({
         error: "Internal Server Error",
         message: "Failed to compute usage summary"
       });
     }
   });
+  router.get("/logs", async (req, res) => {
+    try {
+      const tenantId = req.tenantContext?.tenantId;
+      if (!tenantId) {
+        return res.status(401).json({
+          error: "Unauthorized",
+          message: "Tenant context not found"
+        });
+      }
+      const parsed = activityLogsQuerySchema.safeParse(req.query);
+      if (!parsed.success) {
+        return res.status(400).json({
+          error: "Validation Error",
+          message: "Invalid query parameters",
+          details: parsed.error.errors
+        });
+      }
+      const {
+        page,
+        limit,
+        toolName,
+        clientType,
+        oauthClientId,
+        apiKeyId,
+        shopId,
+        status,
+        startDate,
+        endDate
+      } = parsed.data;
+      const where = {
+        tenantId,
+        ...toolName && { toolName },
+        ...clientType && { clientType },
+        ...oauthClientId && { oauthClientId },
+        ...apiKeyId && { apiKeyId },
+        ...shopId && { shopId },
+        ...status && { status },
+        ...(startDate || endDate) && {
+          createdAt: {
+            ...startDate && { gte: new Date(startDate) },
+            ...endDate && { lte: new Date(endDate) }
+          }
+        }
+      };
+      const skip = (page - 1) * limit;
+      const take = limit;
+      const [logs, total] = await Promise.all([
+        prisma2.toolExecutionLog.findMany({
+          where,
+          skip,
+          take,
+          orderBy: { createdAt: "desc" },
+          select: {
+            id: true,
+            toolName: true,
+            toolModule: true,
+            status: true,
+            clientType: true,
+            oauthClientId: true,
+            apiKeyId: true,
+            shopDomain: true,
+            durationMs: true,
+            createdAt: true
+          }
+        }),
+        prisma2.toolExecutionLog.count({ where })
+      ]);
+      const clientIds = /* @__PURE__ */ new Set();
+      logs.forEach((log3) => {
+        if (log3.oauthClientId) clientIds.add(log3.oauthClientId);
+        if (log3.apiKeyId) clientIds.add(log3.apiKeyId);
+      });
+      const [oauthClients, apiKeys] = await Promise.all([
+        clientIds.size > 0 && logs.some((log3) => log3.oauthClientId) ? prisma2.oAuthClient.findMany({
+          where: {
+            id: { in: Array.from(clientIds) }
+          },
+          select: { id: true, clientName: true }
+        }) : Promise.resolve([]),
+        clientIds.size > 0 && logs.some((log3) => log3.apiKeyId) ? prisma2.apiKey.findMany({
+          where: {
+            id: { in: Array.from(clientIds) },
+            tenantId
+          },
+          select: { id: true, name: true }
+        }) : Promise.resolve([])
+      ]);
+      const clientNameMap = /* @__PURE__ */ new Map();
+      oauthClients.forEach((client) => {
+        clientNameMap.set(client.id, client.clientName);
+      });
+      apiKeys.forEach((key) => {
+        clientNameMap.set(key.id, key.name);
+      });
+      const responseLogs = logs.filter((log3) => log3.createdAt && !isNaN(new Date(log3.createdAt).getTime())).map((log3) => ({
+        id: log3.id,
+        toolName: log3.toolName,
+        toolModule: log3.toolModule ?? void 0,
+        status: log3.status,
+        clientType: log3.clientType,
+        clientName: log3.oauthClientId ? clientNameMap.get(log3.oauthClientId) : log3.apiKeyId ? clientNameMap.get(log3.apiKeyId) : void 0,
+        shopDomain: log3.shopDomain ?? void 0,
+        durationMs: log3.durationMs ?? void 0,
+        createdAt: new Date(log3.createdAt).toISOString()
+      }));
+      const response = {
+        logs: responseLogs,
+        pagination: {
+          page,
+          limit,
+          total,
+          hasMore: skip + take < total
+        }
+      };
+      return res.json(response);
+    } catch (error) {
+      logger3.error("logs endpoint error", error, {
+        correlationId: req.headers["x-correlation-id"]
+      });
+      return res.status(500).json({
+        error: "Internal Server Error",
+        message: "Failed to fetch activity logs"
+      });
+    }
+  });
+  router.get("/stats", async (req, res) => {
+    try {
+      const tenantId = req.tenantContext?.tenantId;
+      if (!tenantId) {
+        return res.status(401).json({
+          error: "Unauthorized",
+          message: "Tenant context not found"
+        });
+      }
+      const parsed = activityStatsQuerySchema.safeParse(req.query);
+      if (!parsed.success) {
+        return res.status(400).json({
+          error: "Validation Error",
+          message: "Invalid query parameters",
+          details: parsed.error.errors
+        });
+      }
+      const { period } = parsed.data;
+      const now = /* @__PURE__ */ new Date();
+      const days = period === "7d" ? 7 : period === "30d" ? 30 : 90;
+      const startDate = new Date(now);
+      startDate.setDate(startDate.getDate() - days);
+      const baseWhere = {
+        tenantId,
+        createdAt: { gte: startDate }
+      };
+      const [totalCalls, successCount, avgDuration, topTools, byClientGroup, byShopGroup] = await Promise.all([
+        // Total calls
+        prisma2.toolExecutionLog.count({ where: baseWhere }),
+        // Success count
+        prisma2.toolExecutionLog.count({
+          where: {
+            ...baseWhere,
+            status: "SUCCESS"
+          }
+        }),
+        // Average duration
+        prisma2.toolExecutionLog.aggregate({
+          where: baseWhere,
+          _avg: { durationMs: true }
+        }),
+        // Top 10 tools
+        prisma2.toolExecutionLog.groupBy({
+          by: ["toolName"],
+          where: baseWhere,
+          _count: { id: true },
+          orderBy: { _count: { id: "desc" } },
+          take: 10
+        }),
+        // By client
+        prisma2.toolExecutionLog.groupBy({
+          by: ["clientType", "oauthClientId", "apiKeyId"],
+          where: baseWhere,
+          _count: { id: true }
+        }),
+        // By shop
+        prisma2.toolExecutionLog.groupBy({
+          by: ["shopDomain"],
+          where: {
+            ...baseWhere,
+            shopDomain: { not: null }
+          },
+          _count: { id: true }
+        })
+      ]);
+      const byDayRaw = await prisma2.$queryRaw`
+        SELECT 
+          date_trunc('day', created_at)::date AS date,
+          COUNT(*)::bigint AS calls,
+          COUNT(*) FILTER (WHERE status != 'SUCCESS')::bigint AS errors
+        FROM tool_execution_logs
+        WHERE tenant_id = ${tenantId}
+          AND created_at >= ${startDate}
+        GROUP BY 1
+        ORDER BY 1 ASC
+      `;
+      const clientIds = /* @__PURE__ */ new Set();
+      byClientGroup.forEach((group) => {
+        if (group.oauthClientId) clientIds.add(group.oauthClientId);
+        if (group.apiKeyId) clientIds.add(group.apiKeyId);
+      });
+      const [oauthClients, apiKeys] = await Promise.all([
+        clientIds.size > 0 && byClientGroup.some((g) => g.oauthClientId) ? prisma2.oAuthClient.findMany({
+          where: {
+            id: { in: Array.from(clientIds) }
+          },
+          select: { id: true, clientName: true }
+        }) : Promise.resolve([]),
+        clientIds.size > 0 && byClientGroup.some((g) => g.apiKeyId) ? prisma2.apiKey.findMany({
+          where: {
+            id: { in: Array.from(clientIds) },
+            tenantId
+          },
+          select: { id: true, name: true }
+        }) : Promise.resolve([])
+      ]);
+      const clientNameMap = /* @__PURE__ */ new Map();
+      oauthClients.forEach((client) => {
+        clientNameMap.set(client.id, client.clientName);
+      });
+      apiKeys.forEach((key) => {
+        clientNameMap.set(key.id, key.name);
+      });
+      const successRate = totalCalls > 0 ? successCount / totalCalls * 100 : 0;
+      const avgDurationMs = avgDuration._avg.durationMs ?? 0;
+      const topToolsFormatted = topTools.map((tool) => ({
+        name: tool.toolName,
+        calls: tool._count.id
+      }));
+      const byClientFormatted = byClientGroup.map((group) => ({
+        clientId: group.oauthClientId ?? void 0,
+        clientName: group.oauthClientId ? clientNameMap.get(group.oauthClientId) : void 0,
+        apiKeyId: group.apiKeyId ?? void 0,
+        keyName: group.apiKeyId ? clientNameMap.get(group.apiKeyId) : void 0,
+        type: group.clientType === "oauth_client" ? "oauth" : "api_key",
+        calls: group._count.id
+      }));
+      const byShopFormatted = byShopGroup.filter((group) => group.shopDomain).map((group) => ({
+        shopDomain: group.shopDomain,
+        calls: group._count.id
+      }));
+      const byDayFormatted = byDayRaw.filter((row) => row.date && !isNaN(new Date(row.date).getTime())).map((row) => ({
+        date: new Date(row.date).toISOString().split("T")[0],
+        // YYYY-MM-DD
+        calls: Number(row.calls),
+        errors: Number(row.errors)
+      }));
+      const response = {
+        period,
+        totalCalls,
+        successRate: Math.round(successRate * 100) / 100,
+        // Round to 2 decimal places
+        avgDurationMs: Math.round(avgDurationMs),
+        topTools: topToolsFormatted,
+        byClient: byClientFormatted,
+        byShop: byShopFormatted,
+        byDay: byDayFormatted
+      };
+      return res.json(response);
+    } catch (error) {
+      logger3.error("stats endpoint error", error, {
+        correlationId: req.headers["x-correlation-id"]
+      });
+      return res.status(500).json({
+        error: "Internal Server Error",
+        message: "Failed to compute activity statistics"
+      });
+    }
+  });
   return router;
 }
 
 // src/api/oauth-clients.ts
 import { Router as Router6 } from "express";
+var logger4 = createLogger("api/oauth-clients");
 var OAUTH_CLIENT_REVOKE_ACTION = "oauth_client:revoke";
 function createOAuthClientsRouter(options) {
   const { auditLogger: auditLogger2 } = options;
@@ -2676,6 +2741,129 @@ function createOAuthClientsRouter(options) {
       });
     }
   });
+  router.get("/:clientId/metrics", async (req, res) => {
+    try {
+      const tenantId = req.tenantContext?.tenantId;
+      if (!tenantId) {
+        return res.status(401).json({
+          error: "Unauthorized",
+          message: "Tenant context not found"
+        });
+      }
+      const { clientId } = req.params;
+      const clientExists = await prisma2.oAuthRefreshToken.findFirst({
+        where: {
+          clientId,
+          tenantId,
+          revokedAt: null
+        }
+      });
+      if (!clientExists) {
+        return res.status(404).json({
+          error: "Not Found",
+          message: "OAuth client not found or no active tokens"
+        });
+      }
+      const now = /* @__PURE__ */ new Date();
+      const sevenDaysAgo = new Date(now);
+      sevenDaysAgo.setDate(sevenDaysAgo.getDate() - 7);
+      const thirtyDaysAgo = new Date(now);
+      thirtyDaysAgo.setDate(thirtyDaysAgo.getDate() - 30);
+      const baseWhere = {
+        tenantId,
+        oauthClientId: clientId
+      };
+      const queryStartTime = Date.now();
+      const [calls7d, calls30d, totalCalls, successCount, avgDuration, topTools, lastUsed] = await Promise.all([
+        // Calls in last 7 days
+        prisma2.toolExecutionLog.count({
+          where: {
+            ...baseWhere,
+            createdAt: { gte: sevenDaysAgo }
+          }
+        }),
+        // Calls in last 30 days
+        prisma2.toolExecutionLog.count({
+          where: {
+            ...baseWhere,
+            createdAt: { gte: thirtyDaysAgo }
+          }
+        }),
+        // Total calls (for success rate calculation)
+        prisma2.toolExecutionLog.count({
+          where: {
+            ...baseWhere,
+            createdAt: { gte: sevenDaysAgo }
+          }
+        }),
+        // Success count (for success rate calculation)
+        prisma2.toolExecutionLog.count({
+          where: {
+            ...baseWhere,
+            createdAt: { gte: sevenDaysAgo },
+            status: "SUCCESS"
+          }
+        }),
+        // Average duration
+        prisma2.toolExecutionLog.aggregate({
+          where: {
+            ...baseWhere,
+            createdAt: { gte: sevenDaysAgo },
+            durationMs: { not: null }
+          },
+          _avg: { durationMs: true }
+        }),
+        // Top 3 tools by call count in last 7 days
+        prisma2.toolExecutionLog.groupBy({
+          by: ["toolName"],
+          where: {
+            ...baseWhere,
+            createdAt: { gte: sevenDaysAgo }
+          },
+          _count: { id: true },
+          orderBy: { _count: { id: "desc" } },
+          take: 3
+        }),
+        // Most recent execution
+        prisma2.toolExecutionLog.findFirst({
+          where: baseWhere,
+          orderBy: { createdAt: "desc" },
+          select: { createdAt: true }
+        })
+      ]);
+      const successRate = totalCalls > 0 ? successCount / totalCalls * 100 : 0;
+      const topToolsFormatted = topTools.map((tool) => ({
+        name: tool.toolName,
+        calls: tool._count.id
+      }));
+      const queryDuration = Date.now() - queryStartTime;
+      if (queryDuration > 200) {
+        logger4.warn("OAuth client metrics query exceeded 200ms", {
+          clientId,
+          tenantId,
+          durationMs: queryDuration
+        });
+      }
+      const response = {
+        calls7d,
+        calls30d,
+        successRate: Math.round(successRate * 10) / 10,
+        // Round to 1 decimal place
+        avgDurationMs: Math.round(avgDuration._avg.durationMs ?? 0),
+        topTools: topToolsFormatted,
+        lastUsedAt: lastUsed?.createdAt.toISOString() ?? null
+      };
+      return res.json(response);
+    } catch (error) {
+      logger4.error("metrics endpoint error", error, {
+        correlationId: req.headers["x-correlation-id"]
+      });
+      return res.status(500).json({
+        error: "Internal Server Error",
+        message: "Failed to compute OAuth client metrics"
+      });
+    }
+  });
   router.delete("/:clientId", async (req, res) => {
     try {
       const tenantId = req.tenantContext?.tenantId;
@@ -2826,7 +3014,7 @@ var oauthClientsRouter = createOAuthClientsRouter({
 });
 
 // src/lifecycle/shutdown.ts
-var logger2 = createLogger("lifecycle/shutdown");
+var logger5 = createLogger("lifecycle/shutdown");
 var ShutdownManager = class {
   /** Current shutdown state */
   _state = "running";
@@ -2956,20 +3144,20 @@ var ShutdownManager = class {
    */
   registerSignalHandlers() {
     process.on("SIGTERM", () => {
-      logger2.info("Received SIGTERM signal");
+      logger5.info("Received SIGTERM signal");
       this.initiateShutdown().catch((error) => {
-        logger2.error("Shutdown failed", error instanceof Error ? error : void 0);
+        logger5.error("Shutdown failed", error instanceof Error ? error : void 0);
         process.exit(1);
       });
     });
     process.on("SIGINT", () => {
-      logger2.info("Received SIGINT signal");
+      logger5.info("Received SIGINT signal");
       this.initiateShutdown().catch((error) => {
-        logger2.error("Shutdown failed", error instanceof Error ? error : void 0);
+        logger5.error("Shutdown failed", error instanceof Error ? error : void 0);
         process.exit(1);
       });
     });
-    logger2.debug("Signal handlers registered (SIGTERM, SIGINT)");
+    logger5.debug("Signal handlers registered (SIGTERM, SIGINT)");
   }
   /**
    * Initiate graceful shutdown
@@ -2987,13 +3175,13 @@ var ShutdownManager = class {
    */
   async initiateShutdown() {
     if (this.shutdownInProgress) {
-      logger2.debug("Shutdown already in progress, ignoring duplicate call");
+      logger5.debug("Shutdown already in progress, ignoring duplicate call");
       return;
     }
     this.shutdownInProgress = true;
     this._state = "draining";
     this.drainingStartedAt = /* @__PURE__ */ new Date();
-    logger2.info("Shutdown initiated", {
+    logger5.info("Shutdown initiated", {
       drainTimeoutMs: this.drainTimeoutMs,
       activeConnections: this.getRemainingConnections()
     });
@@ -3009,11 +3197,11 @@ var ShutdownManager = class {
     }
     if (this.mcpSessionsCleanup) {
       try {
-        logger2.debug("Closing MCP sessions");
+        logger5.debug("Closing MCP sessions");
         await this.withTimeout(this.mcpSessionsCleanup(), 5e3, "MCP sessions cleanup");
-        logger2.debug("MCP sessions closed");
+        logger5.debug("MCP sessions closed");
       } catch (error) {
-        logger2.error("Failed to close MCP sessions", error instanceof Error ? error : void 0);
+        logger5.error("Failed to close MCP sessions", error instanceof Error ? error : void 0);
       }
     }
     const summary = await this.runCleanupCallbacks();
@@ -3031,14 +3219,14 @@ var ShutdownManager = class {
         resolve();
         return;
       }
-      logger2.debug("Stopping HTTP server from accepting new connections");
+      logger5.debug("Stopping HTTP server from accepting new connections");
       this.httpServer.close((error) => {
         if (error) {
           if (error.code !== "ERR_SERVER_NOT_RUNNING") {
-            logger2.warn("HTTP server close error", { error: error.message });
+            logger5.warn("HTTP server close error", { error: error.message });
           }
         }
-        logger2.debug("HTTP server stopped accepting connections");
+        logger5.debug("HTTP server stopped accepting connections");
         resolve();
       });
     });
@@ -3051,7 +3239,7 @@ var ShutdownManager = class {
     while (this.getRemainingConnections() > 0) {
       await new Promise((resolve) => setTimeout(resolve, pollInterval));
     }
-    logger2.debug("All connections drained");
+    logger5.debug("All connections drained");
   }
   /**
    * Create drain timeout promise
@@ -3059,7 +3247,7 @@ var ShutdownManager = class {
   createDrainTimeout() {
     return new Promise((resolve) => {
       this.drainTimeoutTimer = setTimeout(() => {
-        logger2.warn("Drain timeout reached, proceeding with shutdown", {
+        logger5.warn("Drain timeout reached, proceeding with shutdown", {
           remainingConnections: this.getRemainingConnections(),
           drainTimeoutMs: this.drainTimeoutMs
         });
@@ -3074,7 +3262,7 @@ var ShutdownManager = class {
   async runCleanupCallbacks() {
     const drainTimeMs = this.drainingStartedAt ? Date.now() - this.drainingStartedAt.getTime() : 0;
     let cleanupErrors = 0;
-    logger2.debug("Running cleanup callbacks", {
+    logger5.debug("Running cleanup callbacks", {
       count: this.cleanupCallbacks.length
     });
     for (let i = 0; i < this.cleanupCallbacks.length; i++) {
@@ -3087,7 +3275,7 @@ var ShutdownManager = class {
         );
       } catch (error) {
         cleanupErrors++;
-        logger2.error(
+        logger5.error(
           `Cleanup callback ${i + 1} failed`,
           error instanceof Error ? error : void 0
         );
@@ -3121,7 +3309,7 @@ var ShutdownManager = class {
    * Log final shutdown summary
    */
   logShutdownSummary(summary) {
-    logger2.info("Shutdown complete", {
+    logger5.info("Shutdown complete", {
       drainTimeMs: summary.drainTimeMs,
       cleanupCallbacksRun: summary.cleanupCallbacksRun,
       cleanupErrors: summary.cleanupErrors,
@@ -3208,36 +3396,6 @@ var ShutdownManager = class {
 };
 var shutdownManager = new ShutdownManager();
 
-// src/logging/correlation.ts
-import { randomUUID as randomUUID2 } from "crypto";
-var CORRELATION_ID_HEADER = "X-Correlation-ID";
-var UUID_V4_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
-function generateCorrelationId() {
-  return randomUUID2();
-}
-function isValidCorrelationId(id) {
-  return UUID_V4_REGEX.test(id);
-}
-function correlationMiddleware(req, res, next) {
-  const headerValue = req.headers[CORRELATION_ID_HEADER.toLowerCase()];
-  let correlationId;
-  if (headerValue && isValidCorrelationId(headerValue)) {
-    correlationId = headerValue;
-  } else {
-    correlationId = generateCorrelationId();
-  }
-  res.locals.correlationId = correlationId;
-  if (typeof res.set === "function") {
-    res.set(
-      CORRELATION_ID_HEADER,
-      correlationId
-    );
-  } else {
-    res.setHeader(CORRELATION_ID_HEADER, correlationId);
-  }
-  next();
-}
-
 // src/metrics/registry.ts
 import { Counter, Gauge, Histogram, Registry, collectDefaultMetrics } from "prom-client";
 var METRICS_PREFIX = "shopify_mcp_";
@@ -3920,10 +4078,10 @@ var OAuthDiscoveryService = class {
       // Used by ChatGPT for automatic client registration
       registration_endpoint: `${this.baseUrl}/oauth/register`,
       // Supported authentication methods at token endpoint
-      // Client authentication is required for token exchange
       // "client_secret_post" - credentials in request body (client_id, client_secret)
       // "client_secret_basic" - credentials in Authorization header (Basic auth)
-      token_endpoint_auth_methods_supported: ["client_secret_post", "client_secret_basic"],
+      // "none" - public client with PKCE only (required for Claude.ai)
+      token_endpoint_auth_methods_supported: ["client_secret_post", "client_secret_basic", "none"],
       // Supported grant types
       // authorization_code: Standard OAuth 2.0 flow with PKCE
       // refresh_token: For obtaining new access tokens
@@ -3931,6 +4089,9 @@ var OAuthDiscoveryService = class {
       // Response types for authorization endpoint
       // "code" for authorization code flow
       response_types_supported: ["code"],
+      // Response modes for authorization endpoint
+      // "query" returns code in URL query string (standard for auth code flow)
+      response_modes_supported: ["query"],
       // PKCE code challenge methods supported (when PKCE is used)
       // S256 is the only method supported - plain is NOT allowed
       // Note: PKCE is optional for confidential clients (with client_secret)
@@ -4014,6 +4175,7 @@ var CLIENT_SECRET_BYTES = 16;
 var BCRYPT_COST_FACTOR2 = 12;
 var DEFAULT_GRANT_TYPES = ["authorization_code", "refresh_token"];
 var DEFAULT_SCOPES3 = ["mcp:full"];
+var PUBLIC_CLIENT_MARKER = "PUBLIC_CLIENT:none";
 var OAuthRegistrationService = class {
   prisma;
   /**
@@ -4084,22 +4246,40 @@ var OAuthRegistrationService = class {
    * hashed secret in the database, and returns RFC 7591 compliant
    * response with the plaintext secret (one-time reveal).
    *
+   * Supports both confidential clients (with client_secret) and
+   * public clients (token_endpoint_auth_method: "none", uses PKCE).
+   *
    * @param request - RFC 7591 client registration request
    * @returns RFC 7591 compliant registration response
    *
    * @throws Error if database operation fails
    *
    * @example
+   * // Confidential client (default)
    * const response = await service.registerClient({
    *   client_name: "ChatGPT MCP Client",
    *   redirect_uris: ["https://chatgpt.com/aip/g/callback"]
    * });
-   * // response.client_secret is only returned once!
+   *
+   * @example
+   * // Public client (no secret, uses PKCE) - required for Claude.ai
+   * const response = await service.registerClient({
+   *   client_name: "Claude AI",
+   *   redirect_uris: ["https://claude.ai/api/mcp/auth_callback"],
+   *   token_endpoint_auth_method: "none"
+   * });
    */
   async registerClient(request) {
     const clientId = this.generateClientId();
-    const clientSecret = this.generateClientSecret();
-    const clientSecretHash = await this.hashClientSecret(clientSecret);
+    const isPublicClient = request.token_endpoint_auth_method === "none";
+    let clientSecret;
+    let clientSecretHash;
+    if (isPublicClient) {
+      clientSecretHash = PUBLIC_CLIENT_MARKER;
+    } else {
+      clientSecret = this.generateClientSecret();
+      clientSecretHash = await this.hashClientSecret(clientSecret);
+    }
     const grantTypes = request.grant_types?.length ? request.grant_types : DEFAULT_GRANT_TYPES;
     const client = await this.prisma.oAuthClient.create({
       data: {
@@ -4111,10 +4291,8 @@ var OAuthRegistrationService = class {
         scopes: DEFAULT_SCOPES3
       }
     });
-    return {
+    const response = {
       client_id: clientId,
-      client_secret: clientSecret,
-      // One-time reveal!
       client_name: request.client_name,
       redirect_uris: request.redirect_uris,
       grant_types: grantTypes,
@@ -4122,6 +4300,10 @@ var OAuthRegistrationService = class {
       client_secret_expires_at: 0
       // Per RFC 7591 Section 3.2.1: 0 means no expiry
     };
+    if (clientSecret) {
+      response.client_secret = clientSecret;
+    }
+    return response;
   }
   /**
    * Find a client by client_id
@@ -4632,15 +4814,16 @@ var OAuthTokenService = class {
   /**
    * Authenticate a client from request
    *
-   * Supports two authentication methods:
+   * Supports three authentication methods:
    * - client_secret_post: client_id and client_secret in request body
    * - client_secret_basic: HTTP Basic auth header
+   * - none: public client (no secret), requires PKCE - used by Claude.ai
    *
    * Per RFC 6749 Section 2.3.1
    *
    * @param params - Token request parameters (may contain client_id/secret)
    * @param authorizationHeader - Authorization header value (if present)
-   * @returns Authenticated client entity
+   * @returns Authenticated client entity with isPublicClient flag
    * @throws OAuthTokenError if authentication fails
    */
   async authenticateClient(params, authorizationHeader) {
@@ -4675,15 +4858,18 @@ var OAuthTokenService = class {
       has_client_secret: !!clientSecret,
       secret_length: clientSecret?.length || 0
     });
-    if (!clientId || !clientSecret) {
-      log2.warn("Client authentication failed: missing credentials", {
-        has_client_id: !!clientId,
+    if (!clientId) {
+      clientId = params.client_id;
+    }
+    if (!clientId) {
+      log2.warn("Client authentication failed: missing client_id", {
+        has_client_id: false,
         has_client_secret: !!clientSecret,
         auth_method: authMethod
       });
       throw new OAuthTokenError(
         "invalid_client",
-        "Client authentication required. Provide client_id and client_secret.",
+        "Client authentication required. Provide client_id.",
         401
       );
     }
@@ -4696,6 +4882,31 @@ var OAuthTokenService = class {
       });
       throw new OAuthTokenError("invalid_client", "Unknown client_id", 401);
     }
+    const isPublicClient = client.clientSecretHash === PUBLIC_CLIENT_MARKER;
+    if (isPublicClient) {
+      log2.info("Public client authenticated (no secret required, PKCE enforced)", {
+        client_id: clientId,
+        client_name: client.clientName,
+        auth_method: "none"
+      });
+      return {
+        clientId: client.clientId,
+        clientSecretHash: client.clientSecretHash,
+        clientName: client.clientName,
+        isPublicClient: true
+      };
+    }
+    if (!clientSecret) {
+      log2.warn("Client authentication failed: missing client_secret for confidential client", {
+        client_id: clientId,
+        client_name: client.clientName
+      });
+      throw new OAuthTokenError(
+        "invalid_client",
+        "Client authentication required. Provide client_id and client_secret.",
+        401
+      );
+    }
     const isValidSecret = await bcrypt5.compare(clientSecret, client.clientSecretHash);
     if (!isValidSecret) {
       log2.warn("Client authentication failed: invalid client_secret", {
@@ -4712,7 +4923,8 @@ var OAuthTokenService = class {
     return {
       clientId: client.clientId,
       clientSecretHash: client.clientSecretHash,
-      clientName: client.clientName
+      clientName: client.clientName,
+      isPublicClient: false
     };
   }
   // ===========================================================================
@@ -4850,6 +5062,19 @@ var OAuthTokenService = class {
       });
       throw new OAuthTokenError("invalid_grant", "Authorization code has already been used");
     }
+    const client = await this.prisma.oAuthClient.findUnique({
+      where: { clientId }
+    });
+    const isPublicClient = client?.clientSecretHash === PUBLIC_CLIENT_MARKER;
+    if (isPublicClient && !authCode.codeChallenge) {
+      log2.warn("Token exchange failed: public client did not use PKCE", {
+        client_id: clientId
+      });
+      throw new OAuthTokenError(
+        "invalid_grant",
+        "Public clients must use PKCE. No code_challenge was provided during authorization."
+      );
+    }
     if (authCode.codeChallenge) {
       if (!params.code_verifier) {
         throw new OAuthTokenError(
@@ -5072,7 +5297,10 @@ var clientRegistrationRequestSchema = z6.object({
     invalid_type_error: "redirect_uris must be an array"
   }).min(1, "redirect_uris cannot be empty"),
   grant_types: z6.array(z6.string()).optional(),
-  response_types: z6.array(z6.string()).optional()
+  response_types: z6.array(z6.string()).optional(),
+  // Token endpoint authentication method (RFC 7591)
+  // 'none' = public client (no client_secret, uses PKCE) - required for Claude.ai
+  token_endpoint_auth_method: z6.enum(["client_secret_post", "client_secret_basic", "none"]).optional()
 });
 function validateClientRegistrationRequest(data) {
   const result = clientRegistrationRequestSchema.safeParse(data);
@@ -5101,6 +5329,7 @@ var TokenRefreshService = class {
   cryptoService;
   config;
   refreshInterval = null;
+  clientPool = null;
   constructor(prisma2, cryptoService, config) {
     this.prisma = prisma2;
     this.cryptoService = cryptoService;
@@ -5112,6 +5341,14 @@ var TokenRefreshService = class {
     };
     log.debug("TokenRefreshService initialized");
   }
+  /**
+   * Set the client pool for cache eviction after token refresh
+   * Must be called after both services are initialized to avoid circular dependency
+   */
+  setClientPool(clientPool) {
+    this.clientPool = clientPool;
+    log.debug("TokenRefreshService: client pool reference set");
+  }
   /**
    * Refresh an access token using the refresh token
    *
@@ -5200,6 +5437,12 @@ var TokenRefreshService = class {
         where: { id: shop.id },
         data: updateData
       });
+      if (this.clientPool) {
+        this.clientPool.evict(shop.tenantId, shop.shopDomain);
+        log.debug(
+          `Evicted cached client for ${shop.shopDomain.substring(0, 20)} after token refresh`
+        );
+      }
       log.info(
         `Token refreshed successfully for ${shop.shopDomain.substring(0, 20)} (expires in ${tokenData.expires_in}s)`
       );
@@ -6073,8 +6316,8 @@ async function createHttpTransport(server) {
     );
     log.info(`CORS middleware enabled with ${allowedOrigins.length} allowed origin(s)`);
     app.use((req, res, next) => {
-      const isOAuthPage = req.path.startsWith("/oauth/authorize") || req.path.startsWith("/app/oauth/");
-      const frameAncestors = isOAuthPage ? "frame-ancestors 'self' https://claude.ai https://*.anthropic.com" : "frame-ancestors 'none'";
+      const isOAuthRelatedPage = req.path.startsWith("/oauth/authorize") || req.path.startsWith("/app/oauth/") || req.path.startsWith("/app/login") || req.path === "/app" || req.path === "/app/";
+      const frameAncestors = isOAuthRelatedPage ? "frame-ancestors 'self' https://claude.ai https://*.anthropic.com https://*.claude.ai" : "frame-ancestors 'none'";
       res.setHeader(
         "Content-Security-Policy",
         [
@@ -6086,7 +6329,8 @@ async function createHttpTransport(server) {
           "connect-src 'self' https://*.myshopify.com",
           frameAncestors,
           "base-uri 'self'",
-          "form-action 'self' https://claude.ai"
+          // Allow form submissions to Claude and Anthropic domains for OAuth redirects
+          "form-action 'self' https://claude.ai https://*.claude.ai https://*.anthropic.com"
         ].join("; ")
       );
       next();
@@ -6111,6 +6355,9 @@ async function createHttpTransport(server) {
         clientId: config.SHOPIFY_CLIENT_ID,
         clientSecret: config.SHOPIFY_CLIENT_SECRET
       });
+      if (clientPool) {
+        tokenRefreshService.setClientPool(clientPool);
+      }
       tokenRefreshService.startBackgroundRefresh();
       log.info("TokenRefreshService initialized (background refresh enabled)");
     } else {
@@ -6205,6 +6452,50 @@ async function createHttpTransport(server) {
     }
     next();
   });
+  app.head("/mcp", async (req, res) => {
+    const authHeader = req.headers.authorization;
+    const bearerToken = typeof authHeader === "string" && authHeader.toLowerCase().startsWith("bearer ") ? authHeader.slice(7) : void 0;
+    log.info("[mcp] HEAD /mcp probe request", {
+      hasAuth: !!bearerToken,
+      userAgent: req.headers["user-agent"]
+    });
+    if (!bearerToken) {
+      const wwwAuth2 = oauthDiscoveryService.getWwwAuthenticateHeader(
+        "invalid_token",
+        "Authentication required"
+      );
+      res.setHeader("WWW-Authenticate", wwwAuth2);
+      res.status(401).json({
+        error: "unauthorized",
+        message: "Authentication required. Initiate OAuth flow."
+      });
+      return;
+    }
+    if (apiKeyService) {
+      try {
+        const { validateMcpBearerToken } = await import("./mcp-auth-CWOWKID3.js");
+        const authResult = await validateMcpBearerToken(
+          `Bearer ${bearerToken}`,
+          apiKeyService,
+          getPrismaClient()
+        );
+        if (authResult.valid) {
+          res.status(200).end();
+          return;
+        }
+      } catch {
+      }
+    }
+    const wwwAuth = oauthDiscoveryService.getWwwAuthenticateHeader(
+      "invalid_token",
+      "Invalid or expired token"
+    );
+    res.setHeader("WWW-Authenticate", wwwAuth);
+    res.status(401).json({
+      error: "unauthorized",
+      message: "Invalid or expired token"
+    });
+  });
   app.post("/mcp", async (req, res) => {
     try {
       const authHeader = req.headers.authorization;
@@ -6252,7 +6543,7 @@ async function createHttpTransport(server) {
           }
           if (sessionContext && methodRequiresShop && isRemote && apiKeyService && clientPool && prisma2 && (!sessionContext.requestContext?.client || !sessionContext.requestContext?.shopDomain)) {
             log.debug(`[mcp] Lazy loading context for existing session: ${sessionPrefix}...`);
-            const { validateMcpBearerToken } = await import("./mcp-auth-F25V6FEY.js");
+            const { validateMcpBearerToken } = await import("./mcp-auth-CWOWKID3.js");
             const authResult = await validateMcpBearerToken(
               req.headers.authorization,
               apiKeyService,
@@ -6356,7 +6647,7 @@ async function createHttpTransport(server) {
       let shopifyClient;
       let multiTenantContext;
       if (isRemote && apiKeyService && clientPool && prisma2) {
-        const { validateMcpBearerToken } = await import("./mcp-auth-F25V6FEY.js");
+        const { validateMcpBearerToken } = await import("./mcp-auth-CWOWKID3.js");
         const authResult = await validateMcpBearerToken(
           req.headers.authorization,
           apiKeyService,
@@ -6447,7 +6738,7 @@ async function createHttpTransport(server) {
         `[mcp] Creating new transport: isInitReq=${isInitReq}, has_tenant=${!!mcpTenantContext}, has_client=${!!shopifyClient}`
       );
       transport = new StreamableHTTPServerTransport({
-        sessionIdGenerator: () => randomUUID3(),
+        sessionIdGenerator: () => randomUUID2(),
         onsessioninitialized: (newSessionId) => {
           log.info(`[mcp] Session initialized: ${newSessionId.substring(0, 8)}...`);
           transports.set(newSessionId, transport);
@@ -6500,7 +6791,7 @@ async function createHttpTransport(server) {
       });
       await server.connect(transport);
       log.info("[mcp] Transport connected to server, handling request...");
-      const tempContextKey = multiTenantContext?.correlationId || randomUUID3();
+      const tempContextKey = multiTenantContext?.correlationId || randomUUID2();
       try {
         if (multiTenantContext) {
           setFallbackContext(tempContextKey, multiTenantContext);
@@ -6639,7 +6930,7 @@ async function createHttpTransport(server) {
     let shopifyClient;
     let multiTenantContext;
     if (isRemote && apiKeyService && clientPool && prisma2) {
-      const { validateMcpBearerToken } = await import("./mcp-auth-F25V6FEY.js");
+      const { validateMcpBearerToken } = await import("./mcp-auth-CWOWKID3.js");
       const authResult = await validateMcpBearerToken(
         req.headers.authorization,
         apiKeyService,
@@ -6804,7 +7095,7 @@ data: ${JSON.stringify({
     const isRemote = isRemoteMode(config);
     const prisma2 = isRemote ? getPrismaClient() : null;
     if (isRemote && apiKeyService && prisma2) {
-      const { validateMcpBearerToken } = await import("./mcp-auth-F25V6FEY.js");
+      const { validateMcpBearerToken } = await import("./mcp-auth-CWOWKID3.js");
       const authResult = await validateMcpBearerToken(
         req.headers.authorization,
         apiKeyService,
@@ -6855,7 +7146,7 @@ data: ${JSON.stringify({
         return;
       }
       if (body.method === "tools/list") {
-        const { getRegisteredTools } = await import("./tools-HVUCP53D.js");
+        const { getRegisteredTools } = await import("./tools-BCI3Z2AW.js");
         const tools = getRegisteredTools();
         const response = {
           jsonrpc: "2.0",
@@ -6893,7 +7184,7 @@ data: ${JSON.stringify({
         return;
       }
       if (body.method === "tools/call" && isRemote && apiKeyService && clientPool && prisma2) {
-        const { validateMcpBearerToken } = await import("./mcp-auth-F25V6FEY.js");
+        const { validateMcpBearerToken } = await import("./mcp-auth-CWOWKID3.js");
         const authResult = await validateMcpBearerToken(
           req.headers.authorization,
           apiKeyService,
@@ -6950,7 +7241,7 @@ data: ${JSON.stringify({
             ),
             correlationId
           };
-          const { getToolByName } = await import("./tools-HVUCP53D.js");
+          const { getToolByName } = await import("./tools-BCI3Z2AW.js");
           const params = body.params;
           const rawToolName = params?.name;
           const toolArgs = params?.arguments || {};
@@ -7143,6 +7434,31 @@ data: ${JSON.stringify({
       });
     }
   });
+  const faviconPngBase64 = "iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAIAAAD8GO2jAAAAKklEQVR42u3NQQkAAAgEsItnQutYzRQ+hMH+S0+dikAgEAgEAoFAIPgSLM8edFuULS3fAAAAAElFTkSuQmCC";
+  app.get("/favicon.ico", (_req, res) => {
+    const faviconBuffer = Buffer.from(faviconPngBase64, "base64");
+    res.setHeader("Content-Type", "image/png");
+    res.setHeader("Content-Length", faviconBuffer.length.toString());
+    res.setHeader("Cache-Control", "public, max-age=86400");
+    res.send(faviconBuffer);
+  });
+  app.get("/favicon.png", (_req, res) => {
+    const faviconBuffer = Buffer.from(faviconPngBase64, "base64");
+    res.setHeader("Content-Type", "image/png");
+    res.setHeader("Content-Length", faviconBuffer.length.toString());
+    res.setHeader("Cache-Control", "public, max-age=86400");
+    res.send(faviconBuffer);
+  });
+  app.get("/favicon.svg", (_req, res) => {
+    const svgFavicon = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32" width="32" height="32">
+      <rect width="32" height="32" rx="6" fill="#96BF48"/>
+      <path d="M10 8h12l2 6v12a2 2 0 0 1-2 2H10a2 2 0 0 1-2-2V14l2-6z" fill="white" stroke="white" stroke-width="1"/>
+      <path d="M12 8v-2a4 4 0 0 1 8 0v2" fill="none" stroke="#96BF48" stroke-width="2" stroke-linecap="round"/>
+    </svg>`;
+    res.setHeader("Content-Type", "image/svg+xml");
+    res.setHeader("Cache-Control", "public, max-age=86400");
+    res.send(svgFavicon);
+  });
   const oauthDiscoveryService = createOAuthDiscoveryService(discoveryBaseUrl);
   app.get("/.well-known/oauth-authorization-server", (_req, res) => {
     const metadata = oauthDiscoveryService.getAuthorizationServerMetadata();
@@ -7184,18 +7500,43 @@ data: ${JSON.stringify({
   const oauthAuthorizeService = createOAuthAuthorizeService(void 0, cryptoService || void 0);
   app.get("/oauth/authorize", async (req, res) => {
     try {
+      const userAgent = req.headers["user-agent"] || "unknown";
+      const origin = req.headers.origin || req.headers.referer || "none";
+      const clientId = req.query.client_id;
+      log.info("[OAuth] GET /oauth/authorize request", {
+        client_id: clientId?.substring(0, 20),
+        has_session_cookie: !!req.cookies?.session_id,
+        origin: typeof origin === "string" ? origin.substring(0, 50) : "none",
+        user_agent: userAgent.substring(0, 80),
+        redirect_uri: req.query.redirect_uri?.substring(0, 80),
+        // Check if this looks like a Claude request
+        is_claude_origin: origin.includes("claude.ai") || origin.includes("anthropic.com")
+      });
       const sessionId = req.cookies?.session_id;
       if (!sessionId) {
+        log.info("[OAuth] No session cookie - redirecting to login", {
+          client_id: clientId?.substring(0, 20),
+          is_iframe: req.headers["sec-fetch-dest"] === "iframe"
+        });
         const returnUrl = `/oauth/authorize?${new URLSearchParams(req.query).toString()}`;
         res.redirect(`/app/login?redirect=${encodeURIComponent(returnUrl)}`);
         return;
       }
       const session = await sessionStore.get(sessionId);
       if (!session || session.expiresAt < Date.now()) {
+        log.info("[OAuth] Session expired or invalid - redirecting to login", {
+          client_id: clientId?.substring(0, 20),
+          session_exists: !!session,
+          expired: session ? session.expiresAt < Date.now() : "N/A"
+        });
         const returnUrl = `/oauth/authorize?${new URLSearchParams(req.query).toString()}`;
         res.redirect(`/app/login?redirect=${encodeURIComponent(returnUrl)}`);
         return;
       }
+      log.info("[OAuth] Valid session found, proceeding with authorization", {
+        client_id: clientId?.substring(0, 20),
+        tenant_id: session.tenantId.substring(0, 8)
+      });
       const validationResult = await oauthAuthorizeService.validateAuthorizationRequest(
         req.query
       );