@cyanheads/pubmed-mcp-server 1.0.16 → 1.1.2

package/dist/mcp-server/transports/authentication/authContext.js

@@ -0,0 +1,24 @@
+/**
+ * @fileoverview Defines the AsyncLocalStorage context for authentication information.
+ * This module provides a mechanism to store and retrieve authentication details
+ * (like scopes and client ID) across asynchronous operations, making it available
+ * from the middleware layer down to the tool and resource handlers without
+ * drilling props.
+ *
+ * @module src/mcp-server/transports/authentication/authContext
+ */
+import { AsyncLocalStorage } from "async_hooks";
+/**
+ * An instance of AsyncLocalStorage to hold the authentication context (`AuthStore`).
+ * This allows `authInfo` to be accessible throughout the async call chain of a request
+ * after being set in the authentication middleware.
+ *
+ * @example
+ * // In middleware:
+ * await authContext.run({ authInfo }, next);
+ *
+ * // In a deeper handler:
+ * const store = authContext.getStore();
+ * const scopes = store?.authInfo.scopes;
+ */
+export const authContext = new AsyncLocalStorage();

package/dist/mcp-server/transports/authentication/authMiddleware.d.ts

@@ -1,5 +1,5 @@
 /**
- * @fileoverview MCP Authentication Middleware for Bearer Token Validation (JWT).
+ * @fileoverview MCP Authentication Middleware for Bearer Token Validation (JWT) for Hono.
  *
  * This middleware validates JSON Web Tokens (JWT) passed via the 'Authorization' header
  * using the 'Bearer' scheme (e.g., "Authorization: Bearer <your_token>").
@@ -7,23 +7,29 @@
  * in the configuration (`config.mcpAuthSecretKey`).
  *
  * If the token is valid, an object conforming to the MCP SDK's `AuthInfo` type
- * (expected to contain `token`, `clientId`, and `scopes`) is attached to `req.auth`.
- * If the token is missing, invalid, or expired, it sends an HTTP 401 Unauthorized response.
+ * is attached to `c.env.incoming.auth`. This direct attachment to the raw Node.js
+ * request object is for compatibility with the underlying SDK transport, which is
+ * not Hono-context-aware.
+ * If the token is missing, invalid, or expired, it returns an HTTP 401 Unauthorized response.
  *
  * @see {@link https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/docs/specification/2025-03-26/basic/authorization.mdx | MCP Authorization Specification}
  * @module src/mcp-server/transports/authentication/authMiddleware
  */
-import { NextFunction, Request, Response } from "express";
-import { AuthInfo } from "@modelcontextprotocol/sdk/server/auth/types.js";
-declare global {
-    namespace Express {
-        interface Request {
-            /** Authentication information derived from the JWT, conforming to MCP SDK's AuthInfo. */
-            auth?: AuthInfo;
-        }
-    }
-}
+import { HttpBindings } from "@hono/node-server";
+import { Context, Next } from "hono";
 /**
- * Express middleware for verifying JWT Bearer token authentication.
+ * Validates the presence of the MCP_AUTH_SECRET_KEY at startup.
+ * This should be called once when the application is initializing.
  */
-export declare function mcpAuthMiddleware(req: Request, res: Response, next: NextFunction): void;
+export declare function initializeAuthMiddleware(): void;
+/**
+ * Hono middleware for verifying JWT Bearer token authentication.
+ * It attaches authentication info to `c.env.incoming.auth` for SDK compatibility with the node server.
+ */
+export declare function mcpAuthMiddleware(c: Context<{
+    Bindings: HttpBindings;
+}>, next: Next): Promise<void | (Response & import("hono").TypedResponse<{
+    error: string;
+}, 500, "json">) | (Response & import("hono").TypedResponse<{
+    error: string;
+}, 401, "json">)>;

package/dist/mcp-server/transports/authentication/authMiddleware.js

@@ -1,5 +1,5 @@
 /**
- * @fileoverview MCP Authentication Middleware for Bearer Token Validation (JWT).
+ * @fileoverview MCP Authentication Middleware for Bearer Token Validation (JWT) for Hono.
  *
  * This middleware validates JSON Web Tokens (JWT) passed via the 'Authorization' header
  * using the 'Bearer' scheme (e.g., "Authorization: Bearer <your_token>").
@@ -7,8 +7,10 @@
  * in the configuration (`config.mcpAuthSecretKey`).
  *
  * If the token is valid, an object conforming to the MCP SDK's `AuthInfo` type
- * (expected to contain `token`, `clientId`, and `scopes`) is attached to `req.auth`.
- * If the token is missing, invalid, or expired, it sends an HTTP 401 Unauthorized response.
+ * is attached to `c.env.incoming.auth`. This direct attachment to the raw Node.js
+ * request object is for compatibility with the underlying SDK transport, which is
+ * not Hono-context-aware.
+ * If the token is missing, invalid, or expired, it returns an HTTP 401 Unauthorized response.
  *
  * @see {@link https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/docs/specification/2025-03-26/basic/authorization.mdx | MCP Authorization Specification}
  * @module src/mcp-server/transports/authentication/authMiddleware
@@ -16,76 +18,78 @@
 import jwt from "jsonwebtoken";
 import { config, environment } from "../../../config/index.js";
 import { logger, requestContextService } from "../../../utils/index.js";
-// Startup Validation: Validate secret key presence on module load.
-if (environment === "production" && !config.mcpAuthSecretKey) {
-    logger.fatal("CRITICAL: MCP_AUTH_SECRET_KEY is not set in production environment. Authentication cannot proceed securely.");
-    throw new Error("MCP_AUTH_SECRET_KEY must be set in production environment for JWT authentication.");
-}
-else if (!config.mcpAuthSecretKey) {
-    logger.warning("MCP_AUTH_SECRET_KEY is not set. Authentication middleware will bypass checks (DEVELOPMENT ONLY). This is insecure for production.");
+import { authContext } from "./authContext.js";
+/**
+ * Validates the presence of the MCP_AUTH_SECRET_KEY at startup.
+ * This should be called once when the application is initializing.
+ */
+export function initializeAuthMiddleware() {
+    const context = requestContextService.createRequestContext({
+        operation: "initializeAuthMiddleware",
+    });
+    if (environment === "production" && !config.mcpAuthSecretKey) {
+        logger.fatal("CRITICAL: MCP_AUTH_SECRET_KEY is not set in production environment. Authentication cannot proceed securely.", context);
+        throw new Error("MCP_AUTH_SECRET_KEY must be set in production environment for JWT authentication.");
+    }
+    else if (!config.mcpAuthSecretKey) {
+        logger.warning("MCP_AUTH_SECRET_KEY is not set. Authentication middleware will bypass checks (DEVELOPMENT ONLY). This is insecure for production.", context);
+    }
+    else {
+        logger.debug("Auth middleware secret key check passed.", context);
+    }
 }
 /**
- * Express middleware for verifying JWT Bearer token authentication.
+ * Hono middleware for verifying JWT Bearer token authentication.
+ * It attaches authentication info to `c.env.incoming.auth` for SDK compatibility with the node server.
  */
-export function mcpAuthMiddleware(req, res, next) {
+export async function mcpAuthMiddleware(c, next) {
     const context = requestContextService.createRequestContext({
         operation: "mcpAuthMiddleware",
-        method: req.method,
-        path: req.path,
+        method: c.req.method,
+        path: c.req.path,
     });
     logger.debug("Running MCP Authentication Middleware (Bearer Token Validation)...", context);
+    const reqWithAuth = c.env.incoming;
     // Development Mode Bypass
     if (!config.mcpAuthSecretKey) {
         if (environment !== "production") {
             logger.warning("Bypassing JWT authentication: MCP_AUTH_SECRET_KEY is not set (DEVELOPMENT ONLY).", context);
-            // Populate req.auth strictly according to SDK's AuthInfo
-            req.auth = {
+            reqWithAuth.auth = {
                 token: "dev-mode-placeholder-token",
                 clientId: "dev-client-id",
                 scopes: ["dev-scope"],
             };
-            // Log dev mode details separately, not attaching to req.auth if not part of AuthInfo
+            const authInfo = reqWithAuth.auth;
             logger.debug("Dev mode auth object created.", {
                 ...context,
-                authDetails: req.auth,
+                authDetails: authInfo,
             });
-            return next();
+            return await authContext.run({ authInfo }, next);
         }
         else {
             logger.error("FATAL: MCP_AUTH_SECRET_KEY is missing in production. Cannot bypass auth.", context);
-            res.status(500).json({
-                error: "Server configuration error: Authentication key missing.",
-            });
-            return;
+            return c.json({ error: "Server configuration error: Authentication key missing." }, 500);
         }
     }
-    const authHeader = req.headers.authorization;
+    const authHeader = c.req.header("Authorization");
     if (!authHeader || !authHeader.startsWith("Bearer ")) {
         logger.warning("Authentication failed: Missing or malformed Authorization header (Bearer scheme required).", context);
-        res.status(401).json({
+        return c.json({
             error: "Unauthorized: Missing or invalid authentication token format.",
-        });
-        return;
+        }, 401);
     }
     const tokenParts = authHeader.split(" ");
     if (tokenParts.length !== 2 || tokenParts[0] !== "Bearer" || !tokenParts[1]) {
         logger.warning("Authentication failed: Malformed Bearer token.", context);
-        res
-            .status(401)
-            .json({ error: "Unauthorized: Malformed authentication token." });
-        return;
+        return c.json({ error: "Unauthorized: Malformed authentication token." }, 401);
     }
     const rawToken = tokenParts[1];
     try {
         const decoded = jwt.verify(rawToken, config.mcpAuthSecretKey);
         if (typeof decoded === "string") {
             logger.warning("Authentication failed: JWT decoded to a string, expected an object payload.", context);
-            res
-                .status(401)
-                .json({ error: "Unauthorized: Invalid token payload format." });
-            return;
+            return c.json({ error: "Unauthorized: Invalid token payload format." }, 401);
         }
-        // Extract and validate fields for SDK's AuthInfo
         const clientIdFromToken = typeof decoded.cid === "string"
             ? decoded.cid
             : typeof decoded.client_id === "string"
@@ -93,12 +97,9 @@ export function mcpAuthMiddleware(req, res, next) {
                 : undefined;
         if (!clientIdFromToken) {
             logger.warning("Authentication failed: JWT 'cid' or 'client_id' claim is missing or not a string.", { ...context, jwtPayloadKeys: Object.keys(decoded) });
-            res.status(401).json({
-                error: "Unauthorized: Invalid token, missing client identifier.",
-            });
-            return;
+            return c.json({ error: "Unauthorized: Invalid token, missing client identifier." }, 401);
         }
-        let scopesFromToken;
+        let scopesFromToken = [];
         if (Array.isArray(decoded.scp) &&
             decoded.scp.every((s) => typeof s === "string")) {
             scopesFromToken = decoded.scp;
@@ -107,46 +108,27 @@ export function mcpAuthMiddleware(req, res, next) {
             decoded.scope.trim() !== "") {
             scopesFromToken = decoded.scope.split(" ").filter((s) => s);
             if (scopesFromToken.length === 0 && decoded.scope.trim() !== "") {
-                // handles case " " -> [""]
                 scopesFromToken = [decoded.scope.trim()];
             }
-            else if (scopesFromToken.length === 0 && decoded.scope.trim() === "") {
-                // If scope is an empty string, treat as no scopes rather than erroring, or use a default.
-                // Depending on strictness, could also error here. For now, allow empty array if scope was empty string.
-                logger.debug("JWT 'scope' claim was an empty string, resulting in empty scopes array.", context);
-            }
         }
-        else {
-            // If scopes are strictly mandatory and not found or invalid format
-            logger.warning("Authentication failed: JWT 'scp' or 'scope' claim is missing, not an array of strings, or not a valid space-separated string. Assigning default empty array of scopes.", { ...context, jwtPayloadKeys: Object.keys(decoded) });
-            // Default to empty array if scopes are not found or are in an invalid format.
-            // IMPORTANT: Downstream authorization logic MUST be aware of this default.
-            // If specific scopes are mandatory for certain operations, that logic needs to check
-            // for the presence and validity of required scopes in this `scopesFromToken` array.
-            // An empty array here means no specific scopes were granted by this token,
-            // which might restrict access depending on the authorization rules.
-            scopesFromToken = [];
-            // If truly mandatory and must be non-empty for *all* authenticated requests,
-            // an alternative would be to reject the token here:
-            // res.status(401).json({ error: "Unauthorized: Invalid token, missing or invalid scopes." });
-            // return;
+        if (scopesFromToken.length === 0) {
+            logger.warning("Authentication failed: Token resulted in an empty scope array, and scopes are required.", { ...context, jwtPayloadKeys: Object.keys(decoded) });
+            return c.json({ error: "Unauthorized: Token must contain valid, non-empty scopes." }, 401);
         }
-        // Construct req.auth with only the properties defined in SDK's AuthInfo
-        // All other claims from 'decoded' are not part of req.auth for type safety.
-        req.auth = {
+        reqWithAuth.auth = {
             token: rawToken,
             clientId: clientIdFromToken,
             scopes: scopesFromToken,
         };
-        // Log separately if other JWT claims like 'sub' (sessionId) are needed for app logic
         const subClaimForLogging = typeof decoded.sub === "string" ? decoded.sub : undefined;
+        const authInfo = reqWithAuth.auth;
         logger.debug("JWT verified successfully. AuthInfo attached to request.", {
             ...context,
             mcpSessionIdContext: subClaimForLogging,
-            clientId: req.auth.clientId,
-            scopes: req.auth.scopes,
+            clientId: authInfo.clientId,
+            scopes: authInfo.scopes,
         });
-        next();
+        await authContext.run({ authInfo }, next);
     }
     catch (error) {
         let errorMessage = "Invalid token";
@@ -169,6 +151,6 @@ export function mcpAuthMiddleware(req, res, next) {
             errorMessage = "Unknown verification error";
             logger.error("Authentication failed: Unexpected non-error exception during token verification.", { ...context, error });
         }
-        res.status(401).json({ error: `Unauthorized: ${errorMessage}.` });
+        return c.json({ error: `Unauthorized: ${errorMessage}.` }, 401);
     }
 }

package/dist/mcp-server/transports/authentication/authUtils.d.ts

@@ -0,0 +1,18 @@
+/**
+ * @fileoverview Provides utility functions for authorization, specifically for
+ * checking token scopes against required permissions for a given operation.
+ * @module src/mcp-server/transports/authentication/authUtils
+ */
+/**
+ * Checks if the current authentication context contains all the specified scopes.
+ * This function is designed to be called within tool or resource handlers to
+ * enforce scope-based access control. It retrieves the authentication information
+ * from `authContext` (AsyncLocalStorage).
+ *
+ * @param requiredScopes - An array of scope strings that are mandatory for the operation.
+ * @throws {McpError} Throws an error with `BaseErrorCode.INTERNAL_ERROR` if the
+ *   authentication context is missing, which indicates a server configuration issue.
+ * @throws {McpError} Throws an error with `BaseErrorCode.FORBIDDEN` if one or
+ *   more required scopes are not present in the validated token.
+ */
+export declare function withRequiredScopes(requiredScopes: string[]): void;

package/dist/mcp-server/transports/authentication/authUtils.js

@@ -0,0 +1,45 @@
+/**
+ * @fileoverview Provides utility functions for authorization, specifically for
+ * checking token scopes against required permissions for a given operation.
+ * @module src/mcp-server/transports/authentication/authUtils
+ */
+import { BaseErrorCode, McpError } from "../../../types-global/errors.js";
+import { logger, requestContextService } from "../../../utils/index.js";
+import { authContext } from "./authContext.js";
+/**
+ * Checks if the current authentication context contains all the specified scopes.
+ * This function is designed to be called within tool or resource handlers to
+ * enforce scope-based access control. It retrieves the authentication information
+ * from `authContext` (AsyncLocalStorage).
+ *
+ * @param requiredScopes - An array of scope strings that are mandatory for the operation.
+ * @throws {McpError} Throws an error with `BaseErrorCode.INTERNAL_ERROR` if the
+ *   authentication context is missing, which indicates a server configuration issue.
+ * @throws {McpError} Throws an error with `BaseErrorCode.FORBIDDEN` if one or
+ *   more required scopes are not present in the validated token.
+ */
+export function withRequiredScopes(requiredScopes) {
+    const store = authContext.getStore();
+    if (!store || !store.authInfo) {
+        // This is a server-side logic error; the auth middleware should always populate this.
+        throw new McpError(BaseErrorCode.INTERNAL_ERROR, "Authentication context is missing. This indicates a server configuration error.", requestContextService.createRequestContext({
+            operation: "withRequiredScopesCheck",
+            error: "AuthStore not found in AsyncLocalStorage.",
+        }));
+    }
+    const { scopes: grantedScopes, clientId } = store.authInfo;
+    const grantedScopeSet = new Set(grantedScopes);
+    const missingScopes = requiredScopes.filter((scope) => !grantedScopeSet.has(scope));
+    if (missingScopes.length > 0) {
+        const context = requestContextService.createRequestContext({
+            operation: "withRequiredScopesCheck",
+            required: requiredScopes,
+            granted: grantedScopes,
+            missing: missingScopes,
+            clientId: clientId,
+            subject: store.authInfo.subject,
+        });
+        logger.warning("Authorization failed: Missing required scopes.", context);
+        throw new McpError(BaseErrorCode.FORBIDDEN, `Insufficient permissions. Missing required scopes: ${missingScopes.join(", ")}`, { requiredScopes, missingScopes });
+    }
+}

package/dist/mcp-server/transports/authentication/oauthMiddleware.d.ts

@@ -0,0 +1,24 @@
+/**
+ * @fileoverview Hono middleware for OAuth 2.1 Bearer Token validation.
+ * This middleware extracts a JWT from the Authorization header, validates it against
+ * a remote JWKS (JSON Web Key Set), and checks its issuer and audience claims.
+ * On success, it populates an AuthInfo object and stores it in an AsyncLocalStorage
+ * context for use in downstream handlers.
+ *
+ * @module src/mcp-server/transports/authentication/oauthMiddleware
+ */
+import { HttpBindings } from "@hono/node-server";
+import { Context, Next } from "hono";
+/**
+ * Hono middleware for verifying OAuth 2.1 JWT Bearer tokens.
+ * It validates the token and uses AsyncLocalStorage to pass auth info.
+ * @param c - The Hono context object.
+ * @param next - The function to call to proceed to the next middleware.
+ */
+export declare function oauthMiddleware(c: Context<{
+    Bindings: HttpBindings;
+}>, next: Next): Promise<(Response & import("hono").TypedResponse<{
+    error: string;
+}, 500, "json">) | (Response & import("hono").TypedResponse<{
+    error: string;
+}, 401, "json">) | undefined>;

package/dist/mcp-server/transports/authentication/oauthMiddleware.js

@@ -0,0 +1,109 @@
+/**
+ * @fileoverview Hono middleware for OAuth 2.1 Bearer Token validation.
+ * This middleware extracts a JWT from the Authorization header, validates it against
+ * a remote JWKS (JSON Web Key Set), and checks its issuer and audience claims.
+ * On success, it populates an AuthInfo object and stores it in an AsyncLocalStorage
+ * context for use in downstream handlers.
+ *
+ * @module src/mcp-server/transports/authentication/oauthMiddleware
+ */
+import { createRemoteJWKSet, jwtVerify } from "jose";
+import { config } from "../../../config/index.js";
+import { BaseErrorCode, McpError } from "../../../types-global/errors.js";
+import { ErrorHandler } from "../../../utils/internal/errorHandler.js";
+import { logger, requestContextService } from "../../../utils/index.js";
+import { authContext } from "./authContext.js";
+// --- Startup Validation ---
+// Ensures that necessary OAuth configuration is present when the mode is 'oauth'.
+if (config.mcpAuthMode === "oauth") {
+    if (!config.oauthIssuerUrl) {
+        throw new Error("OAUTH_ISSUER_URL must be set when MCP_AUTH_MODE is 'oauth'");
+    }
+    if (!config.oauthAudience) {
+        throw new Error("OAUTH_AUDIENCE must be set when MCP_AUTH_MODE is 'oauth'");
+    }
+    logger.info("OAuth 2.1 mode enabled. Verifying tokens against issuer.", requestContextService.createRequestContext({
+        issuer: config.oauthIssuerUrl,
+        audience: config.oauthAudience,
+    }));
+}
+// --- JWKS Client Initialization ---
+// The remote JWK set is fetched and cached to avoid network calls on every request.
+let jwks;
+if (config.mcpAuthMode === "oauth" && config.oauthIssuerUrl) {
+    try {
+        const jwksUrl = new URL(config.oauthJwksUri ||
+            `${config.oauthIssuerUrl.replace(/\/$/, "")}/.well-known/jwks.json`);
+        jwks = createRemoteJWKSet(jwksUrl, {
+            cooldownDuration: 300000, // 5 minutes
+            timeoutDuration: 5000, // 5 seconds
+        });
+        logger.info(`JWKS client initialized for URL: ${jwksUrl.href}`, requestContextService.createRequestContext({
+            operation: "oauthMiddlewareSetup",
+        }));
+    }
+    catch (error) {
+        logger.fatal("Failed to initialize JWKS client.", error, requestContextService.createRequestContext({
+            operation: "oauthMiddlewareSetup",
+        }));
+        // Prevent server from starting if JWKS setup fails in oauth mode
+        process.exit(1);
+    }
+}
+/**
+ * Hono middleware for verifying OAuth 2.1 JWT Bearer tokens.
+ * It validates the token and uses AsyncLocalStorage to pass auth info.
+ * @param c - The Hono context object.
+ * @param next - The function to call to proceed to the next middleware.
+ */
+export async function oauthMiddleware(c, next) {
+    const context = requestContextService.createRequestContext({
+        operation: "oauthMiddleware",
+        httpMethod: c.req.method,
+        httpPath: c.req.path,
+    });
+    if (!jwks) {
+        // This should not happen if startup validation is correct, but it's a safeguard.
+        const error = new McpError(BaseErrorCode.CONFIGURATION_ERROR, "OAuth middleware is active, but JWKS client is not initialized.", context);
+        ErrorHandler.handleError(error, { operation: "oauthMiddleware", context });
+        return c.json({ error: "Server configuration error." }, 500);
+    }
+    const authHeader = c.req.header("Authorization");
+    if (!authHeader || !authHeader.startsWith("Bearer ")) {
+        return c.json({ error: "Unauthorized: Missing or invalid token format." }, 401);
+    }
+    const token = authHeader.substring(7);
+    try {
+        const { payload } = await jwtVerify(token, jwks, {
+            issuer: config.oauthIssuerUrl,
+            audience: config.oauthAudience,
+        });
+        // The 'scope' claim is typically a space-delimited string in OAuth 2.1.
+        const scopes = typeof payload.scope === "string" ? payload.scope.split(" ") : [];
+        const clientId = typeof payload.client_id === "string" ? payload.client_id : undefined;
+        if (!clientId) {
+            logger.warning("Authentication failed: OAuth token 'client_id' claim is missing or not a string.", { ...context, jwtPayloadKeys: Object.keys(payload) });
+            return c.json({ error: "Unauthorized: Invalid token, missing client identifier." }, 401);
+        }
+        const authInfo = {
+            token,
+            clientId,
+            scopes,
+            subject: typeof payload.sub === "string" ? payload.sub : undefined,
+        };
+        // Attach to the raw request for potential legacy compatibility and
+        // store in AsyncLocalStorage for modern, safe access in handlers.
+        c.env.incoming.auth = authInfo;
+        await authContext.run({ authInfo }, next);
+    }
+    catch (error) {
+        logger.warning("OAuth token validation failed", {
+            ...context,
+            errorName: error.name,
+            errorMessage: error.message,
+        });
+        // The `jose` library provides specific error codes like 'ERR_JWT_EXPIRED' or 'ERR_JWS_INVALID'
+        const message = `Unauthorized: ${error.message || "Invalid token"}`;
+        return c.json({ error: message }, 401);
+    }
+}

package/dist/mcp-server/transports/authentication/types.d.ts

@@ -0,0 +1,17 @@
+/**
+ * @fileoverview Shared types for authentication middleware.
+ * @module src/mcp-server/transports/authentication/types
+ */
+import type { AuthInfo as SdkAuthInfo } from "@modelcontextprotocol/sdk/server/auth/types.js";
+/**
+ * Defines the structure for authentication information derived from a token.
+ * It extends the base SDK type to include common optional claims.
+ */
+export type AuthInfo = SdkAuthInfo & {
+    subject?: string;
+};
+declare module "http" {
+    interface IncomingMessage {
+        auth?: AuthInfo;
+    }
+}

package/dist/mcp-server/transports/authentication/types.js

@@ -0,0 +1,5 @@
+/**
+ * @fileoverview Shared types for authentication middleware.
+ * @module src/mcp-server/transports/authentication/types
+ */
+export {};

package/dist/mcp-server/transports/httpTransport.d.ts

@@ -1,7 +1,7 @@
 /**
- * @fileoverview Handles the setup and management of the Streamable HTTP MCP transport.
+ * @fileoverview Handles the setup and management of the Streamable HTTP MCP transport using Hono.
  * Implements the MCP Specification 2025-03-26 for Streamable HTTP.
- * This includes creating an Express server, configuring middleware (CORS, Authentication),
+ * This includes creating a Hono server, configuring middleware (CORS, Authentication),
  * defining request routing for the single MCP endpoint (POST/GET/DELETE),
  * managing server-side sessions, handling Server-Sent Events (SSE) for streaming,
  * and binding to a network port with retry logic for port conflicts.
@@ -10,6 +10,7 @@
  * https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/docs/specification/2025-03-26/basic/transports.mdx#streamable-http
  * @module src/mcp-server/transports/httpTransport
  */
+import { ServerType } from "@hono/node-server";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { RequestContext } from "../../utils/index.js";
 /**
@@ -17,7 +18,7 @@ import { RequestContext } from "../../utils/index.js";
  *
  * @param createServerInstanceFn - An asynchronous factory function that returns a new `McpServer` instance.
  * @param parentContext - Logging context from the main server startup process.
- * @returns A promise that resolves when the HTTP server is successfully listening.
+ * @returns A promise that resolves with the Node.js `http.Server` instance when the HTTP server is successfully listening.
  * @throws {Error} If the server fails to start after all port retries.
  */
-export declare function startHttpTransport(createServerInstanceFn: () => Promise<McpServer>, parentContext: RequestContext): Promise<void>;
+export declare function startHttpTransport(createServerInstanceFn: () => Promise<McpServer>, parentContext: RequestContext): Promise<ServerType>;