@cyanheads/pubmed-mcp-server 1.2.3 → 1.3.0

package/dist/utils/scheduling/scheduler.js

@@ -0,0 +1,150 @@
+/**
+ * @fileoverview Provides a singleton service for scheduling and managing cron jobs.
+ * This service wraps the 'node-cron' library to offer a unified interface for
+ * defining, starting, stopping, and listing recurring tasks within the application.
+ * @module src/utils/scheduling/scheduler
+ */
+import cron, { createTask } from "node-cron";
+import { logger } from "../internal/index.js";
+import { requestContextService } from "../internal/requestContext.js";
+/**
+ * A singleton service for scheduling and managing cron jobs.
+ */
+export class SchedulerService {
+    /** @private */
+    constructor() {
+        this.jobs = new Map();
+        logger.info("SchedulerService initialized.", {
+            requestId: "scheduler-init",
+            timestamp: new Date().toISOString(),
+        });
+    }
+    /**
+     * Gets the singleton instance of the SchedulerService.
+     * @returns The singleton SchedulerService instance.
+     */
+    static getInstance() {
+        if (!SchedulerService.instance) {
+            SchedulerService.instance = new SchedulerService();
+        }
+        return SchedulerService.instance;
+    }
+    /**
+     * Schedules a new job.
+     *
+     * @param id - A unique identifier for the job.
+     * @param schedule - The cron pattern for the schedule (e.g., '* * * * *').
+     * @param taskFunction - The function to execute on schedule. It receives a RequestContext.
+     * @param description - A description of the job.
+     * @returns The newly created Job object.
+     */
+    schedule(id, schedule, taskFunction, description) {
+        if (this.jobs.has(id)) {
+            throw new Error(`Job with ID '${id}' already exists.`);
+        }
+        if (!cron.validate(schedule)) {
+            throw new Error(`Invalid cron schedule: ${schedule}`);
+        }
+        const task = createTask(schedule, async () => {
+            const job = this.jobs.get(id);
+            if (job && job.isRunning) {
+                logger.warning(`Job '${id}' is already running. Skipping this execution.`, {
+                    requestId: `job-skip-${id}`,
+                    timestamp: new Date().toISOString(),
+                });
+                return;
+            }
+            if (job) {
+                job.isRunning = true;
+            }
+            const context = requestContextService.createRequestContext({
+                jobId: id,
+                schedule,
+            });
+            logger.info(`Starting job '${id}'...`, context);
+            try {
+                await Promise.resolve(taskFunction(context));
+                logger.info(`Job '${id}' completed successfully.`, context);
+            }
+            catch (error) {
+                logger.error(`Job '${id}' failed.`, error, context);
+            }
+            finally {
+                if (job) {
+                    job.isRunning = false;
+                }
+            }
+        });
+        const newJob = {
+            id,
+            schedule,
+            description,
+            task,
+            isRunning: false,
+        };
+        this.jobs.set(id, newJob);
+        logger.info(`Job '${id}' scheduled: ${description}`, {
+            requestId: `job-schedule-${id}`,
+            timestamp: new Date().toISOString(),
+        });
+        return newJob;
+    }
+    /**
+     * Starts a scheduled job.
+     * @param id - The ID of the job to start.
+     */
+    start(id) {
+        const job = this.jobs.get(id);
+        if (!job) {
+            throw new Error(`Job with ID '${id}' not found.`);
+        }
+        job.task.start();
+        logger.info(`Job '${id}' started.`, {
+            requestId: `job-start-${id}`,
+            timestamp: new Date().toISOString(),
+        });
+    }
+    /**
+     * Stops a scheduled job.
+     * @param id - The ID of the job to stop.
+     */
+    stop(id) {
+        const job = this.jobs.get(id);
+        if (!job) {
+            throw new Error(`Job with ID '${id}' not found.`);
+        }
+        job.task.stop();
+        logger.info(`Job '${id}' stopped.`, {
+            requestId: `job-stop-${id}`,
+            timestamp: new Date().toISOString(),
+        });
+    }
+    /**
+     * Removes a job from the scheduler. The job is stopped before being removed.
+     * @param id - The ID of the job to remove.
+     */
+    remove(id) {
+        const job = this.jobs.get(id);
+        if (!job) {
+            throw new Error(`Job with ID '${id}' not found.`);
+        }
+        job.task.stop();
+        this.jobs.delete(id);
+        logger.info(`Job '${id}' removed.`, {
+            requestId: `job-remove-${id}`,
+            timestamp: new Date().toISOString(),
+        });
+    }
+    /**
+     * Gets a list of all scheduled jobs.
+     * @returns An array of all Job objects.
+     */
+    listJobs() {
+        return Array.from(this.jobs.values());
+    }
+}
+/**
+ * The singleton instance of the SchedulerService.
+ * Use this instance for all job scheduling operations.
+ */
+export const schedulerService = SchedulerService.getInstance();

package/dist/utils/security/sanitization.js

@@ -121,14 +121,25 @@ export class Sanitization {
     sanitizeHtml(input, config) {
         if (!input)
             return "";
-        const effectiveConfig = { ...this.defaultHtmlSanitizeConfig, ...config };
+        const effectiveConfig = {
+            allowedTags: config?.allowedTags ?? this.defaultHtmlSanitizeConfig.allowedTags,
+            allowedAttributes: config?.allowedAttributes ??
+                this.defaultHtmlSanitizeConfig.allowedAttributes,
+            transformTags: config?.transformTags, // Can be undefined
+            preserveComments: config?.preserveComments ??
+                this.defaultHtmlSanitizeConfig.preserveComments,
+        };
         const options = {
             allowedTags: effectiveConfig.allowedTags,
             allowedAttributes: effectiveConfig.allowedAttributes,
             transformTags: effectiveConfig.transformTags,
         };
         if (effectiveConfig.preserveComments) {
-            options.allowedTags = [...(options.allowedTags || []), "!--"];
+            // Ensure allowedTags is an array before spreading
+            const baseTags = Array.isArray(options.allowedTags)
+                ? options.allowedTags
+                : [];
+            options.allowedTags = [...baseTags, "!--"];
         }
         return sanitizeHtml(input, options);
     }
@@ -144,14 +155,18 @@ export class Sanitization {
     sanitizeString(input, options = {}) {
         if (!input)
             return "";
-        switch (options.context) {
-            case "html":
-                return this.sanitizeHtml(input, {
-                    allowedTags: options.allowedTags,
-                    allowedAttributes: options.allowedAttributes
-                        ? this.convertAttributesFormat(options.allowedAttributes)
-                        : undefined,
-                });
+        const context = options.context ?? "text";
+        switch (context) {
+            case "html": {
+                const config = {};
+                if (options.allowedTags) {
+                    config.allowedTags = options.allowedTags;
+                }
+                if (options.allowedAttributes) {
+                    config.allowedAttributes = this.convertAttributesFormat(options.allowedAttributes);
+                }
+                return this.sanitizeHtml(input, config);
+            }
             case "attribute":
                 return sanitizeHtml(input, { allowedTags: [], allowedAttributes: {} });
             case "url":
@@ -233,7 +248,6 @@ export class Sanitization {
             rootDir: options.rootDir ? path.resolve(options.rootDir) : undefined,
         };
         let wasAbsoluteInitially = false;
-        let convertedToRelative = false;
         try {
             if (!input || typeof input !== "string")
                 throw new Error("Invalid path input: must be a non-empty string.");
@@ -262,8 +276,7 @@ export class Sanitization {
             else {
                 if (path.isAbsolute(normalized)) {
                     if (!effectiveOptions.allowAbsolute) {
-                        finalSanitizedPath = normalized.replace(/^(?:[A-Za-z]:)?[/\\]+/, "");
-                        convertedToRelative = true;
+                        throw new Error("Absolute paths are disallowed by current options.");
                     }
                     else {
                         finalSanitizedPath = normalized;
@@ -355,7 +368,7 @@ export class Sanitization {
             throw new McpError(BaseErrorCode.VALIDATION_ERROR, "Invalid number value (NaN or Infinity).", { input });
         }
         let clamped = false;
-        let originalValueForLog = value;
+        const originalValueForLog = value;
         if (min !== undefined && value < min) {
             value = min;
             clamped = true;
@@ -399,8 +412,8 @@ export class Sanitization {
         try {
             if (!input || typeof input !== "object")
                 return input;
-            const clonedInput = typeof structuredClone === "function"
-                ? structuredClone(input)
+            const clonedInput = typeof globalThis.structuredClone === "function"
+                ? globalThis.structuredClone(input)
                 : JSON.parse(JSON.stringify(input));
             this.redactSensitiveFields(clonedInput);
             return clonedInput;
@@ -428,8 +441,12 @@ export class Sanitization {
         for (const key in obj) {
             if (Object.prototype.hasOwnProperty.call(obj, key)) {
                 const value = obj[key];
-                const lowerKey = key.toLowerCase();
-                const isSensitive = this.sensitiveFields.some((field) => lowerKey.includes(field));
+                // Split camelCase and snake_case/kebab-case keys into words
+                const keyWords = key
+                    .replace(/([A-Z])/g, " $1") // Add space before uppercase letters
+                    .toLowerCase()
+                    .split(/[\s_-]+/); // Split by space, underscore, or hyphen
+                const isSensitive = keyWords.some((word) => this.sensitiveFields.includes(word));
                 if (isSensitive) {
                     obj[key] = "[REDACTED]";
                 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyanheads/pubmed-mcp-server",
-  "version": "1.2.3",
+  "version": "1.3.0",
   "description": "A Model Context Protocol (MCP) server enabling AI agents to intelligently search, retrieve, and analyze biomedical literature from PubMed via NCBI E-utilities. Built on the mcp-ts-template for robust, production-ready performance.",
   "main": "dist/index.js",
   "files": [
@@ -32,31 +32,33 @@
     "inspector": "mcp-inspector --config mcp.json --server pubmed-mcp-server"
   },
   "dependencies": {
-    "@hono/node-server": "^1.14.4",
-    "@modelcontextprotocol/sdk": "^1.13.0",
+    "@hono/node-server": "^1.15.0",
+    "@modelcontextprotocol/sdk": "^1.17.0",
     "@types/jsonwebtoken": "^9.0.10",
-    "@types/node": "^24.0.3",
+    "@types/node": "^24.1.0",
     "@types/sanitize-html": "^2.16.0",
     "@types/validator": "13.15.2",
-    "axios": "^1.10.0",
+    "axios": "^1.11.0",
+    "chart.js": "^4.5.0",
+    "chartjs-node-canvas": "^5.0.0",
     "chrono-node": "^2.8.3",
+    "citation-js": "^0.7.20",
     "dotenv": "^16.5.0",
     "fast-xml-parser": "^5.2.5",
-    "hono": "^4.8.2",
-    "jose": "^6.0.11",
+    "hono": "^4.8.4",
+    "jose": "^6.0.12",
     "jsonwebtoken": "^9.0.2",
-    "openai": "^5.6.0",
+    "node-cron": "^4.2.1",
+    "openai": "^5.10.2",
     "partial-json": "^0.1.7",
     "sanitize-html": "^2.17.0",
     "tiktoken": "^1.0.21",
     "ts-node": "^10.9.2",
     "typescript": "^5.8.3",
     "validator": "13.15.15",
-    "chart.js": "^4.5.0",
-    "chartjs-node-canvas": "^5.0.0",
     "winston": "^3.17.0",
     "winston-transport": "^4.9.0",
-    "zod": "^3.25.67"
+    "zod": "^3.25.74"
   },
   "keywords": [
     "mcp",
@@ -97,8 +99,10 @@
   },
   "devDependencies": {
     "@types/js-yaml": "^4.0.9",
+    "@types/node-cron": "^3.0.11",
     "js-yaml": "^4.1.0",
-    "prettier": "^3.5.3",
-    "typedoc": "^0.28.5"
+    "patch-package": "^8.0.0",
+    "prettier": "^3.6.2",
+    "typedoc": "^0.28.8"
   }
 }

package/dist/mcp-server/transports/auth/core/authTypes.js

@@ -1,5 +0,0 @@
-/**
- * @fileoverview Shared types for authentication middleware.
- * @module src/mcp-server/transports/auth/core/auth.types
- */
-export {};

package/dist/mcp-server/transports/auth/strategies/jwt/jwtMiddleware.d.ts

@@ -1,27 +0,0 @@
-/**
- * @fileoverview MCP Authentication Middleware for Bearer Token Validation (JWT) for Hono.
- *
- * This middleware validates JSON Web Tokens (JWT) passed via the 'Authorization' header
- * using the 'Bearer' scheme (e.g., "Authorization: Bearer <your_token>").
- * It verifies the token's signature and expiration using the secret key defined
- * in the configuration (`config.mcpAuthSecretKey`).
- *
- * If the token is valid, an object conforming to the MCP SDK's `AuthInfo` type
- * is attached to `c.env.incoming.auth`. This direct attachment to the raw Node.js
- * request object is for compatibility with the underlying SDK transport, which is
- * not Hono-context-aware.
- * If the token is missing, invalid, or expired, it throws an `McpError`, which is
- * then handled by the centralized `httpErrorHandler`.
- *
- * @see {@link https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/docs/specification/2025-03-26/basic/authorization.mdx | MCP Authorization Specification}
- * @module src/mcp-server/transports/auth/strategies/jwt/jwtMiddleware
- */
-import { HttpBindings } from "@hono/node-server";
-import { Context, Next } from "hono";
-/**
- * Hono middleware for verifying JWT Bearer token authentication.
- * It attaches authentication info to `c.env.incoming.auth` for SDK compatibility with the node server.
- */
-export declare function mcpAuthMiddleware(c: Context<{
-    Bindings: HttpBindings;
-}>, next: Next): Promise<void>;

package/dist/mcp-server/transports/auth/strategies/jwt/jwtMiddleware.js

@@ -1,149 +0,0 @@
-/**
- * @fileoverview MCP Authentication Middleware for Bearer Token Validation (JWT) for Hono.
- *
- * This middleware validates JSON Web Tokens (JWT) passed via the 'Authorization' header
- * using the 'Bearer' scheme (e.g., "Authorization: Bearer <your_token>").
- * It verifies the token's signature and expiration using the secret key defined
- * in the configuration (`config.mcpAuthSecretKey`).
- *
- * If the token is valid, an object conforming to the MCP SDK's `AuthInfo` type
- * is attached to `c.env.incoming.auth`. This direct attachment to the raw Node.js
- * request object is for compatibility with the underlying SDK transport, which is
- * not Hono-context-aware.
- * If the token is missing, invalid, or expired, it throws an `McpError`, which is
- * then handled by the centralized `httpErrorHandler`.
- *
- * @see {@link https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/docs/specification/2025-03-26/basic/authorization.mdx | MCP Authorization Specification}
- * @module src/mcp-server/transports/auth/strategies/jwt/jwtMiddleware
- */
-import { jwtVerify } from "jose";
-import { config, environment } from "../../../../../config/index.js";
-import { logger, requestContextService } from "../../../../../utils/index.js";
-import { BaseErrorCode, McpError } from "../../../../../types-global/errors.js";
-import { authContext } from "../../core/authContext.js";
-// Startup Validation: Validate secret key presence on module load.
-if (config.mcpAuthMode === "jwt") {
-    if (environment === "production" && !config.mcpAuthSecretKey) {
-        logger.fatal("CRITICAL: MCP_AUTH_SECRET_KEY is not set in production environment for JWT auth. Authentication cannot proceed securely.");
-        throw new Error("MCP_AUTH_SECRET_KEY must be set in production environment for JWT authentication.");
-    }
-    else if (!config.mcpAuthSecretKey) {
-        logger.warning("MCP_AUTH_SECRET_KEY is not set. JWT auth middleware will bypass checks (DEVELOPMENT ONLY). This is insecure for production.");
-    }
-}
-/**
- * Hono middleware for verifying JWT Bearer token authentication.
- * It attaches authentication info to `c.env.incoming.auth` for SDK compatibility with the node server.
- */
-export async function mcpAuthMiddleware(c, next) {
-    const context = requestContextService.createRequestContext({
-        operation: "mcpAuthMiddleware",
-        method: c.req.method,
-        path: c.req.path,
-    });
-    logger.debug("Running MCP Authentication Middleware (Bearer Token Validation)...", context);
-    const reqWithAuth = c.env.incoming;
-    // If JWT auth is not enabled, skip the middleware.
-    if (config.mcpAuthMode !== "jwt") {
-        return await next();
-    }
-    // Development Mode Bypass
-    if (!config.mcpAuthSecretKey) {
-        if (environment !== "production") {
-            logger.warning("Bypassing JWT authentication: MCP_AUTH_SECRET_KEY is not set (DEVELOPMENT ONLY).", context);
-            reqWithAuth.auth = {
-                token: "dev-mode-placeholder-token",
-                clientId: "dev-client-id",
-                scopes: ["dev-scope"],
-            };
-            const authInfo = reqWithAuth.auth;
-            logger.debug("Dev mode auth object created.", {
-                ...context,
-                authDetails: authInfo,
-            });
-            return await authContext.run({ authInfo }, next);
-        }
-        else {
-            logger.error("FATAL: MCP_AUTH_SECRET_KEY is missing in production. Cannot bypass auth.", context);
-            throw new McpError(BaseErrorCode.INTERNAL_ERROR, "Server configuration error: Authentication key missing.");
-        }
-    }
-    const secretKey = new TextEncoder().encode(config.mcpAuthSecretKey);
-    const authHeader = c.req.header("Authorization");
-    if (!authHeader || !authHeader.startsWith("Bearer ")) {
-        logger.warning("Authentication failed: Missing or malformed Authorization header (Bearer scheme required).", context);
-        throw new McpError(BaseErrorCode.UNAUTHORIZED, "Missing or invalid authentication token format.");
-    }
-    const tokenParts = authHeader.split(" ");
-    if (tokenParts.length !== 2 || tokenParts[0] !== "Bearer" || !tokenParts[1]) {
-        logger.warning("Authentication failed: Malformed Bearer token.", context);
-        throw new McpError(BaseErrorCode.UNAUTHORIZED, "Malformed authentication token.");
-    }
-    const rawToken = tokenParts[1];
-    try {
-        const { payload: decoded } = await jwtVerify(rawToken, secretKey);
-        const clientIdFromToken = typeof decoded.cid === "string"
-            ? decoded.cid
-            : typeof decoded.client_id === "string"
-                ? decoded.client_id
-                : undefined;
-        if (!clientIdFromToken) {
-            logger.warning("Authentication failed: JWT 'cid' or 'client_id' claim is missing or not a string.", { ...context, jwtPayloadKeys: Object.keys(decoded) });
-            throw new McpError(BaseErrorCode.UNAUTHORIZED, "Invalid token, missing client identifier.");
-        }
-        let scopesFromToken = [];
-        if (Array.isArray(decoded.scp) &&
-            decoded.scp.every((s) => typeof s === "string")) {
-            scopesFromToken = decoded.scp;
-        }
-        else if (typeof decoded.scope === "string" &&
-            decoded.scope.trim() !== "") {
-            scopesFromToken = decoded.scope.split(" ").filter((s) => s);
-            if (scopesFromToken.length === 0 && decoded.scope.trim() !== "") {
-                scopesFromToken = [decoded.scope.trim()];
-            }
-        }
-        if (scopesFromToken.length === 0) {
-            logger.warning("Authentication failed: Token resulted in an empty scope array, and scopes are required.", { ...context, jwtPayloadKeys: Object.keys(decoded) });
-            throw new McpError(BaseErrorCode.UNAUTHORIZED, "Token must contain valid, non-empty scopes.");
-        }
-        reqWithAuth.auth = {
-            token: rawToken,
-            clientId: clientIdFromToken,
-            scopes: scopesFromToken,
-        };
-        const subClaimForLogging = typeof decoded.sub === "string" ? decoded.sub : undefined;
-        const authInfo = reqWithAuth.auth;
-        logger.debug("JWT verified successfully. AuthInfo attached to request.", {
-            ...context,
-            mcpSessionIdContext: subClaimForLogging,
-            clientId: authInfo.clientId,
-            scopes: authInfo.scopes,
-        });
-        await authContext.run({ authInfo }, next);
-    }
-    catch (error) {
-        let errorMessage = "Invalid token.";
-        let errorCode = BaseErrorCode.UNAUTHORIZED;
-        if (error instanceof Error && error.name === "JWTExpired") {
-            errorMessage = "Token expired.";
-            logger.warning("Authentication failed: Token expired.", {
-                ...context,
-                errorName: error.name,
-            });
-        }
-        else if (error instanceof Error) {
-            errorMessage = `Invalid token: ${error.message}`;
-            logger.warning(`Authentication failed: ${errorMessage}`, {
-                ...context,
-                errorName: error.name,
-            });
-        }
-        else {
-            errorMessage = "Unknown verification error.";
-            errorCode = BaseErrorCode.INTERNAL_ERROR;
-            logger.error("Authentication failed: Unexpected non-error exception during token verification.", { ...context, error });
-        }
-        throw new McpError(errorCode, errorMessage);
-    }
-}

package/dist/mcp-server/transports/auth/strategies/oauth/oauthMiddleware.d.ts

@@ -1,20 +0,0 @@
-/**
- * @fileoverview Hono middleware for OAuth 2.1 Bearer Token validation.
- * This middleware extracts a JWT from the Authorization header, validates it against
- * a remote JWKS (JSON Web Key Set), and checks its issuer and audience claims.
- * On success, it populates an AuthInfo object and stores it in an AsyncLocalStorage
- * context for use in downstream handlers.
- *
- * @module src/mcp-server/transports/auth/strategies/oauth/oauthMiddleware
- */
-import { HttpBindings } from "@hono/node-server";
-import { Context, Next } from "hono";
-/**
- * Hono middleware for verifying OAuth 2.1 JWT Bearer tokens.
- * It validates the token and uses AsyncLocalStorage to pass auth info.
- * @param c - The Hono context object.
- * @param next - The function to call to proceed to the next middleware.
- */
-export declare function oauthMiddleware(c: Context<{
-    Bindings: HttpBindings;
-}>, next: Next): Promise<void>;

package/dist/mcp-server/transports/auth/strategies/oauth/oauthMiddleware.js

@@ -1,124 +0,0 @@
-/**
- * @fileoverview Hono middleware for OAuth 2.1 Bearer Token validation.
- * This middleware extracts a JWT from the Authorization header, validates it against
- * a remote JWKS (JSON Web Key Set), and checks its issuer and audience claims.
- * On success, it populates an AuthInfo object and stores it in an AsyncLocalStorage
- * context for use in downstream handlers.
- *
- * @module src/mcp-server/transports/auth/strategies/oauth/oauthMiddleware
- */
-import { createRemoteJWKSet, jwtVerify } from "jose";
-import { config } from "../../../../../config/index.js";
-import { BaseErrorCode, McpError } from "../../../../../types-global/errors.js";
-import { logger, requestContextService } from "../../../../../utils/index.js";
-import { ErrorHandler } from "../../../../../utils/internal/errorHandler.js";
-import { authContext } from "../../core/authContext.js";
-// --- Startup Validation ---
-// Ensures that necessary OAuth configuration is present when the mode is 'oauth'.
-if (config.mcpAuthMode === "oauth") {
-    if (!config.oauthIssuerUrl) {
-        throw new Error("OAUTH_ISSUER_URL must be set when MCP_AUTH_MODE is 'oauth'");
-    }
-    if (!config.oauthAudience) {
-        throw new Error("OAUTH_AUDIENCE must be set when MCP_AUTH_MODE is 'oauth'");
-    }
-    logger.info("OAuth 2.1 mode enabled. Verifying tokens against issuer.", requestContextService.createRequestContext({
-        issuer: config.oauthIssuerUrl,
-        audience: config.oauthAudience,
-    }));
-}
-// --- JWKS Client Initialization ---
-// The remote JWK set is fetched and cached to avoid network calls on every request.
-let jwks;
-if (config.mcpAuthMode === "oauth" && config.oauthIssuerUrl) {
-    try {
-        const jwksUrl = new URL(config.oauthJwksUri ||
-            `${config.oauthIssuerUrl.replace(/\/$/, "")}/.well-known/jwks.json`);
-        jwks = createRemoteJWKSet(jwksUrl, {
-            cooldownDuration: 300000, // 5 minutes
-            timeoutDuration: 5000, // 5 seconds
-        });
-        logger.info(`JWKS client initialized for URL: ${jwksUrl.href}`, requestContextService.createRequestContext({
-            operation: "oauthMiddlewareSetup",
-        }));
-    }
-    catch (error) {
-        logger.fatal("Failed to initialize JWKS client.", error, requestContextService.createRequestContext({
-            operation: "oauthMiddlewareSetup",
-        }));
-        // Prevent server from starting if JWKS setup fails in oauth mode
-        process.exit(1);
-    }
-}
-/**
- * Hono middleware for verifying OAuth 2.1 JWT Bearer tokens.
- * It validates the token and uses AsyncLocalStorage to pass auth info.
- * @param c - The Hono context object.
- * @param next - The function to call to proceed to the next middleware.
- */
-export async function oauthMiddleware(c, next) {
-    // If OAuth is not the configured auth mode, skip this middleware.
-    if (config.mcpAuthMode !== "oauth") {
-        return await next();
-    }
-    const context = requestContextService.createRequestContext({
-        operation: "oauthMiddleware",
-        httpMethod: c.req.method,
-        httpPath: c.req.path,
-    });
-    if (!jwks) {
-        // This should not happen if startup validation is correct, but it's a safeguard.
-        // This should not happen if startup validation is correct, but it's a safeguard.
-        throw new McpError(BaseErrorCode.CONFIGURATION_ERROR, "OAuth middleware is active, but JWKS client is not initialized.", context);
-    }
-    const authHeader = c.req.header("Authorization");
-    if (!authHeader || !authHeader.startsWith("Bearer ")) {
-        throw new McpError(BaseErrorCode.UNAUTHORIZED, "Missing or invalid token format.");
-    }
-    const token = authHeader.substring(7);
-    try {
-        const { payload } = await jwtVerify(token, jwks, {
-            issuer: config.oauthIssuerUrl,
-            audience: config.oauthAudience,
-        });
-        // The 'scope' claim is typically a space-delimited string in OAuth 2.1.
-        const scopes = typeof payload.scope === "string" ? payload.scope.split(" ") : [];
-        if (scopes.length === 0) {
-            logger.warning("Authentication failed: Token contains no scopes, but scopes are required.", { ...context, jwtPayloadKeys: Object.keys(payload) });
-            throw new McpError(BaseErrorCode.UNAUTHORIZED, "Token must contain valid, non-empty scopes.");
-        }
-        const clientId = typeof payload.client_id === "string" ? payload.client_id : undefined;
-        if (!clientId) {
-            logger.warning("Authentication failed: OAuth token 'client_id' claim is missing or not a string.", { ...context, jwtPayloadKeys: Object.keys(payload) });
-            throw new McpError(BaseErrorCode.UNAUTHORIZED, "Invalid token, missing client identifier.");
-        }
-        const authInfo = {
-            token,
-            clientId,
-            scopes,
-            subject: typeof payload.sub === "string" ? payload.sub : undefined,
-        };
-        // Attach to the raw request for potential legacy compatibility and
-        // store in AsyncLocalStorage for modern, safe access in handlers.
-        c.env.incoming.auth = authInfo;
-        await authContext.run({ authInfo }, next);
-    }
-    catch (error) {
-        if (error instanceof Error && error.name === "JWTExpired") {
-            logger.warning("Authentication failed: OAuth token expired.", context);
-            throw new McpError(BaseErrorCode.UNAUTHORIZED, "Token expired.");
-        }
-        const handledError = ErrorHandler.handleError(error, {
-            operation: "oauthMiddleware",
-            context,
-            rethrow: false, // We will throw a new McpError below
-        });
-        // Ensure we always throw an McpError for consistency
-        if (handledError instanceof McpError) {
-            throw handledError;
-        }
-        else {
-            throw new McpError(BaseErrorCode.UNAUTHORIZED, `Unauthorized: ${handledError.message || "Invalid token"}`, { originalError: handledError.name });
-        }
-    }
-}