@fruggr/zendesk-mcp-server 2.24.0 → 3.0.0

package/dist/index.js

@@ -22,7 +22,6 @@ import remarkRehype from "remark-rehype";
 import remarkStringify from "remark-stringify";
 import { unified } from "unified";
 import { StdioServerTransport } from "@modelcontextprotocol/server/stdio";
-import { NodeStreamableHTTPServerTransport } from "@modelcontextprotocol/node";
 //#region src/utils/logger.ts
 const SEVERITY = {
 	debug: 0,
@@ -119,53 +118,16 @@ const createLogger = (level) => {
 };
 //#endregion
 //#region src/utils/env.ts
-const LEGACY_NAMES = /* @__PURE__ */ new Map([
-	["OAUTH_TOKEN_FILE", "ZENDESK_TOKEN_FILE"],
-	["OAUTH_CALLBACK_PORT", "ZENDESK_OAUTH_CALLBACK_PORT"],
-	["LISTEN_HOST", "HOST"],
-	["RESPONSE_CHARACTER_LIMIT", "ZENDESK_CHARACTER_LIMIT"],
-	["RESPONSE_MAX_BYTES", "ZENDESK_MAX_RESPONSE_BYTES"],
-	["ATTACHMENT_MAX_BYTES", "ZENDESK_MAX_ATTACHMENT_BYTES"],
-	["EMBEDDED_IMAGES_MAX", "ZENDESK_MAX_EMBEDDED_IMAGES"],
-	["COMMENT_MAX_PAGES", "ZENDESK_MAX_COMMENT_PAGES"],
-	["TICKET_FIELD_SCAN_MAX_PAGES", "ZENDESK_TICKET_FIELD_SCAN_MAX_PAGES"],
-	["ARTICLE_RESOURCES_SCAN_MAX_PAGES", "ZENDESK_ARTICLE_RESOURCES_SCAN_MAX_PAGES"],
-	["REORDER_CONFIRM_THRESHOLD", "ZENDESK_REORDER_CONFIRM_THRESHOLD"]
-]);
-const warned = /* @__PURE__ */ new Set();
-const warnDeprecated = (legacy, current) => {
-	if (warned.has(legacy)) return;
-	warned.add(legacy);
-	try {
-		console.error(`[zendesk-mcp] [warn] deprecated_env_var name=${legacy} replacement=${current} removal=3.0.0`);
-	} catch {}
-};
 /**
-* Reads `name`, falling back to the legacy name it replaced. `name` in the result
-* is the variable the value came from, so an error about it names what the
-* operator actually set.
+* Reads `name` from the environment. `name` in the result is the variable the
+* value came from, so an error about it names what the operator actually set.
+* Every variable goes through here, so a future rename has a single place to
+* map the old name (AGENTS.md, "Environment variables").
 */
-const readEnv = (name) => {
-	const value = process.env[name];
-	const legacy = LEGACY_NAMES.get(name);
-	if (legacy === void 0) return {
-		name,
-		value
-	};
-	const legacyValue = process.env[legacy];
-	if (legacyValue === void 0) return {
-		name,
-		value
-	};
-	warnDeprecated(legacy, name);
-	return value === void 0 ? {
-		name: legacy,
-		value: legacyValue
-	} : {
-		name,
-		value
-	};
-};
+const readEnv = (name) => ({
+	name,
+	value: process.env[name]
+});
 //#endregion
 //#region src/constants.ts
 const positiveIntEnv = (name, fallback) => {
@@ -193,6 +155,15 @@ const getOAuthUrls = (subdomain) => ({
 	tokenUrl: `https://${subdomain}.zendesk.com/oauth/tokens`
 });
 //#endregion
+//#region src/utils/html.ts
+/**
+* Escape a string for safe interpolation into HTML text/attribute context.
+* Both the stdio callback page and the HTTP consent page echo
+* attacker-controllable values (an OAuth `error_description`, a client name
+* from a fetched metadata document); without escaping these are an XSS sink.
+*/
+const escapeHtml = (value) => value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+//#endregion
 //#region src/auth/oauth-scopes.ts
 /**
 * The OAuth scope the server asks Zendesk for, and the one predicate that
@@ -260,13 +231,6 @@ const callbackPortInUseError = (port, cause) => Object.assign(/* @__PURE__ */ ne
 	code: "EADDRINUSE",
 	cause
 });
-/**
-* Escape a string for safe interpolation into HTML text/attribute context.
-* The local callback server echoes attacker-controllable values (the OAuth
-* `error_description` query param, token-exchange error bodies) back into the
-* browser response; without escaping these are a reflected-XSS sink.
-*/
-const escapeHtml = (value) => value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 const errorPage = (title, detail) => `<html><body><h1>${escapeHtml(title)}</h1>${detail === void 0 ? "" : `<p>${escapeHtml(detail)}</p>`}</body></html>`;
 const SUCCESS_PAGE = "<html><body><h1>Authentication successful!</h1><p>You can close this tab and return to your AI assistant.</p><p>This tab will auto-close in <span id=\"t\">10</span>s.</p><script>let n=10;const el=document.getElementById(\"t\");const i=setInterval(()=>{n--;el.textContent=n;if(n<=0){clearInterval(i);window.close();}},1000);<\/script></body></html>";
 const generateCodeVerifier = () => randomBytes(32).toString("base64url");
@@ -871,7 +835,22 @@ const ConfigSchema = z.object({
 	* because they send no Origin header.
 	*/
 	corsOrigins: z.array(z.string().url().transform((value) => new URL(value).origin).refine((origin) => origin !== "null", { message: "CORS origin must be an http(s) URL with a host" })).default([]),
-	callbackPort: z.number().int().min(1).max(65535).optional()
+	callbackPort: z.number().int().min(1).max(65535).optional(),
+	/**
+	* HTTP only: the authorization server's master secret (`OAUTH_MASTER_SECRET`),
+	* or a file holding it. Both optional: when absent, one is generated and
+	* persisted in the config dir. Belongs to this server, not to Zendesk, hence
+	* no `ZENDESK_` prefix. Validated (length, base64) where it is used, so a
+	* value never reaches a schema error message.
+	*/
+	oauthMasterSecret: z.string().optional(),
+	oauthMasterSecretFile: z.string().min(1).optional(),
+	/** HTTP only: the grant store URI; defaults to a file in the config dir. */
+	oauthStore: z.string().url().optional(),
+	/** HTTP only: CIMD client ids added to the consent-skip allowlist. */
+	oauthTrustedClients: z.array(z.string().url()).default([]),
+	/** HTTP only: whether the built-in allowlist (claude.ai, ChatGPT) applies. */
+	defaultTrustedClients: z.boolean().default(true)
 });
 const DIGITS_ONLY = /^\d+$/;
 const parsePort = (raw, label) => {
@@ -909,6 +888,13 @@ const CLI_OPTIONS = {
 		multiple: true
 	},
 	"callback-port": { type: "string" },
+	"oauth-master-secret-file": { type: "string" },
+	"oauth-store": { type: "string" },
+	"oauth-trusted-client": {
+		type: "string",
+		multiple: true
+	},
+	"no-default-trusted-clients": { type: "boolean" },
 	"read-only": { type: "boolean" },
 	"no-topology": { type: "boolean" },
 	"no-promoted-articles": { type: "boolean" },
@@ -925,14 +911,18 @@ const FIELD_BY_FLAG = /* @__PURE__ */ new Map([
 	["transport", "transport"],
 	["host", "host"],
 	["public-url", "publicUrl"],
-	["cors-origin", "corsOrigins"]
+	["cors-origin", "corsOrigins"],
+	["oauth-master-secret-file", "oauthMasterSecretFile"],
+	["oauth-store", "oauthStore"],
+	["oauth-trusted-client", "oauthTrustedClients"]
 ]);
 const STANDALONE_EFFECTS = /* @__PURE__ */ new Map([
 	["read-only", { readOnly: true }],
 	["no-topology", { topology: false }],
 	["no-promoted-articles", { promotedArticles: false }],
 	["dev", { dev: true }],
-	["print-tools", { printTools: true }]
+	["print-tools", { printTools: true }],
+	["no-default-trusted-clients", { defaultTrustedClients: false }]
 ]);
 const parseCliArgs = (args) => {
 	const { values, positionals } = parseArgs({
@@ -956,8 +946,9 @@ const parseCliArgs = (args) => {
 	if (values["callback-port"] !== void 0) result.callbackPort = parsePort(values["callback-port"], "--callback-port");
 	return result;
 };
+const splitList = (raw) => (raw ?? "").split(",").map((s) => s.trim()).filter((s) => s.length > 0);
 const resolveTransportSettings = (cli) => {
-	const corsFromEnv = (process.env["CORS_ORIGIN"] ?? "").split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+	const corsFromEnv = splitList(process.env["CORS_ORIGIN"]);
 	return {
 		transport: cli.transport ?? requireNonEmptyEnv("TRANSPORT") ?? "stdio",
 		host: cli.host ?? requireNonEmptyEnv("LISTEN_HOST") ?? "0.0.0.0",
@@ -966,6 +957,13 @@ const resolveTransportSettings = (cli) => {
 		corsOrigins: [...cli.corsOrigins ?? [], ...corsFromEnv]
 	};
 };
+const resolveOAuthServerSettings = (cli) => ({
+	oauthMasterSecret: requireNonEmptyEnv("OAUTH_MASTER_SECRET"),
+	oauthMasterSecretFile: cli.oauthMasterSecretFile ?? requireNonEmptyEnv("OAUTH_MASTER_SECRET_FILE"),
+	oauthStore: cli.oauthStore ?? requireNonEmptyEnv("OAUTH_STORE"),
+	oauthTrustedClients: [...cli.oauthTrustedClients ?? [], ...splitList(readEnv("OAUTH_TRUSTED_CLIENTS").value)],
+	defaultTrustedClients: cli.defaultTrustedClients
+});
 const loadConfig = (argv = process.argv.slice(2)) => {
 	const cli = parseCliArgs(argv);
 	const subdomain = cli.subdomain ?? requireNonEmptyEnv("ZENDESK_SUBDOMAIN") ?? "";
@@ -988,7 +986,8 @@ const loadConfig = (argv = process.argv.slice(2)) => {
 		dev: cli.dev ?? false,
 		printTools: cli.printTools ?? false,
 		callbackPort,
-		...resolveTransportSettings(cli)
+		...resolveTransportSettings(cli),
+		...resolveOAuthServerSettings(cli)
 	});
 };
 //#endregion
@@ -5537,358 +5536,34 @@ const renderToolSurface = (config, tools) => {
 	].join("\n");
 };
 //#endregion
-//#region src/transports/http.ts
-const WILDCARD_HOSTS = /* @__PURE__ */ new Set([
-	"0.0.0.0",
-	"::",
-	"*"
-]);
-const TRAILING_SLASHES = /\/+$/;
-const DEFAULT_BROWSER_MCP_CLIENT_ORIGINS = [
-	"https://chatgpt.com",
-	"https://chat.openai.com",
-	"https://claude.ai",
-	"https://gemini.google.com",
-	"https://copilot.microsoft.com",
-	"https://www.perplexity.ai",
-	"https://chat.mistral.ai",
-	"https://grok.com"
-];
-const CORS_ALLOWED_METHODS = "GET, POST, DELETE, OPTIONS";
-const CORS_ALLOWED_HEADERS = "Authorization, Content-Type, Accept, mcp-session-id, mcp-protocol-version, last-event-id";
-const CORS_EXPOSE_HEADERS = "mcp-session-id";
-const CORS_MAX_AGE = "600";
-const LOCALHOST_HOSTNAMES = /* @__PURE__ */ new Set([
-	"localhost",
-	"127.0.0.1",
-	"[::1]"
-]);
-const ALLOWED_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:"]);
+//#region src/transports/http-peers.ts
 /**
-* Returns the origin string to reflect in `Access-Control-Allow-Origin`, or
-* `undefined` if the origin is not allowed.
-*
-* The returned value is **never the raw `Origin` request header**. It comes
-* from one of three sanitization points:
-*
-*   1. An entry of the hardcoded `DEFAULT_BROWSER_MCP_CLIENT_ORIGINS` array.
-*   2. An entry of the operator-configured `extraOrigins` array.
-*   3. A loopback origin rebuilt from validated URL components after the
-*      hostname has been allowlisted against `LOCALHOST_HOSTNAMES`.
-*
-* This shape keeps the dataflow from request header to response header
-* gated by a constant allowlist, which is the pattern CodeQL's
-* `js/cors-misconfiguration-for-credentials` rule recognises as safe when
-* combined with `Access-Control-Allow-Credentials: true`.
+* Packages only the HTTP transport uses, shipped as optional peer dependencies so
+* a stdio install (npx, bunx) never downloads them. Inlined from `package.json` at
+* build time, so a version bump there is the only edit. Rationale:
+* docs/decisions/oauth-authorization-server.md (Packaging).
 */
-const resolveAllowedOrigin = (origin, extraOrigins) => {
-	const defaultMatch = DEFAULT_BROWSER_MCP_CLIENT_ORIGINS.find((entry) => entry === origin);
-	if (defaultMatch) return defaultMatch;
-	const extraMatch = extraOrigins?.find((entry) => entry === origin);
-	if (extraMatch) return extraMatch;
+const HTTP_PEERS = {
+	"@modelcontextprotocol/node": "^2.0.0",
+	"jose": "^6.2.12",
+	"oidc-provider": "~9.12.2"
+};
+const installCommand = () => ["npm install @fruggr/zendesk-mcp-server", ...Object.entries(HTTP_PEERS).map(([name, range]) => `${name}@${range}`)].join(" ");
+const missingPeers = (err) => {
+	if (err?.code !== "ERR_MODULE_NOT_FOUND") return [];
+	const message = String(err.message);
+	return Object.keys(HTTP_PEERS).filter((name) => message.includes(`'${name}'`));
+};
+/** Import the HTTP transport, turning a missing optional peer into an actionable error. */
+const loadHttpTransport = async (importer = () => import("./http-BXXDmcaZ.js")) => {
 	try {
-		const url = new URL(origin);
-		if (!ALLOWED_PROTOCOLS.has(url.protocol)) return void 0;
-		if (!LOCALHOST_HOSTNAMES.has(url.hostname)) return void 0;
-		const port = url.port || (url.protocol === "https:" ? "443" : "80");
-		return `${url.protocol}//${url.hostname}:${port}`;
-	} catch {
-		return;
-	}
-};
-const applyCorsHeaders = (req, res, extraOrigins) => {
-	const requestOrigin = req.headers["origin"];
-	if (typeof requestOrigin !== "string" || requestOrigin.length === 0) return;
-	const allowedOrigin = resolveAllowedOrigin(requestOrigin, extraOrigins);
-	if (!allowedOrigin) return;
-	res.setHeader("Access-Control-Allow-Origin", allowedOrigin);
-	res.setHeader("Vary", "Origin");
-	res.setHeader("Access-Control-Allow-Credentials", "true");
-	res.setHeader("Access-Control-Expose-Headers", CORS_EXPOSE_HEADERS);
-};
-const handleCorsPreflight = (req, res, extraOrigins) => {
-	if (req.method !== "OPTIONS") return false;
-	applyCorsHeaders(req, res, extraOrigins);
-	if (res.getHeader("Access-Control-Allow-Origin")) {
-		res.setHeader("Access-Control-Allow-Methods", CORS_ALLOWED_METHODS);
-		res.setHeader("Access-Control-Allow-Headers", CORS_ALLOWED_HEADERS);
-		res.setHeader("Access-Control-Max-Age", CORS_MAX_AGE);
-	}
-	res.writeHead(204);
-	res.end();
-	return true;
-};
-const resolveResourceUrl = (config, logger = silentLogger) => {
-	if (config.publicUrl) return config.publicUrl.replace(TRAILING_SLASHES, "");
-	if (!WILDCARD_HOSTS.has(config.host)) return `http://${config.host}:${config.port}`;
-	logger.warn("public_url_unset", {
-		host: config.host,
-		advertised: `http://${config.host}:${config.port}`,
-		hint: "OAuth discovery will advertise a non-routable resource identifier and spec-compliant MCP clients may refuse the connection. Set PUBLIC_URL (or --public-url) to the URL clients use to reach this server (e.g. https://your-host.example.com)."
-	});
-	return `http://${config.host}:${config.port}`;
-};
-const MISSING_BEARER_MESSAGE = "Missing Authorization: Bearer <zendesk-oauth-token> header. HTTP mode requires per-user OAuth 2.1 PKCE - obtain a token from Zendesk via your MCP client.";
-const extractBearer = (request) => {
-	const header = request.headers["authorization"];
-	if (typeof header !== "string") return void 0;
-	if (!header.toLowerCase().startsWith("bearer ")) return void 0;
-	return header.slice(7).trim();
-};
-const buildOAuthMetadata = (config, logger = silentLogger) => {
-	const { authorizeUrl, tokenUrl } = getOAuthUrls(config.subdomain);
-	const issuer = `https://${config.subdomain}.zendesk.com`;
-	const resource = resolveResourceUrl(config, logger);
-	const scopes = () => supportedScopes(config.readOnly);
-	return {
-		protectedResource: {
-			authorization_servers: [issuer],
-			resource,
-			bearer_methods_supported: ["header"],
-			scopes_supported: scopes()
-		},
-		authorizationServer: {
-			issuer,
-			authorization_endpoint: authorizeUrl,
-			token_endpoint: tokenUrl,
-			response_types_supported: ["code"],
-			grant_types_supported: ["authorization_code", "refresh_token"],
-			code_challenge_methods_supported: ["S256"],
-			token_endpoint_auth_methods_supported: ["none"],
-			scopes_supported: scopes()
-		}
-	};
-};
-const sendJson = (res, status, body) => {
-	res.writeHead(status, { "Content-Type": "application/json" });
-	res.end(JSON.stringify(body));
-};
-const sendJsonRpcError = (res, status, code, message, headers = {}) => {
-	res.writeHead(status, {
-		"Content-Type": "application/json",
-		...headers
-	});
-	res.end(JSON.stringify({
-		error: {
-			code,
-			message
-		},
-		id: null,
-		jsonrpc: "2.0"
-	}));
-};
-const failRequest = (res, err) => {
-	const message = err instanceof Error ? err.message : "Internal Server Error";
-	if (!res.headersSent) {
-		sendJsonRpcError(res, 500, -32603, message);
-		return;
-	}
-	if (!res.writableEnded) res.end();
-};
-const sendUnauthorized = (res, resource) => {
-	const wwwAuthenticate = `Bearer resource_metadata="${resource}/.well-known/oauth-protected-resource", error="invalid_token", error_description="${MISSING_BEARER_MESSAGE}"`;
-	sendJsonRpcError(res, 401, -32e3, MISSING_BEARER_MESSAGE, { "WWW-Authenticate": wwwAuthenticate });
-};
-const readJsonBody = (req, maxBodyBytes) => new Promise((resolve) => {
-	const chunks = [];
-	let total = 0;
-	let settled = false;
-	const settle = (result) => {
-		if (settled) return;
-		settled = true;
-		resolve(result);
-	};
-	req.on("data", (chunk) => {
-		total += chunk.length;
-		if (total > maxBodyBytes) {
-			req.removeAllListeners("data");
-			settle({
-				ok: false,
-				status: 413,
-				rpcCode: -32600,
-				message: `Request body exceeds ${maxBodyBytes} bytes.`
-			});
-			return;
-		}
-		chunks.push(chunk);
-	});
-	req.on("end", () => {
-		const raw = Buffer.concat(chunks).toString("utf8");
-		if (!raw) {
-			settle({
-				ok: true,
-				value: void 0
-			});
-			return;
-		}
-		try {
-			settle({
-				ok: true,
-				value: JSON.parse(raw)
-			});
-		} catch {
-			settle({
-				ok: false,
-				status: 400,
-				rpcCode: -32700,
-				message: "Parse error: request body is not valid JSON."
-			});
-		}
-	});
-	req.on("error", () => settle({
-		ok: false,
-		status: 400,
-		rpcCode: -32600,
-		message: "Request body could not be read."
-	}));
-});
-const respondBodyError = (req, res, failure) => {
-	const headers = failure.status === 413 ? { Connection: "close" } : {};
-	sendJsonRpcError(res, failure.status, failure.rpcCode, failure.message, headers);
-	if (failure.status === 413) {
-		if (res.writableFinished) req.destroy();
-		else res.once("finish", () => req.destroy());
+		return await importer();
+	} catch (err) {
+		const missing = missingPeers(err);
+		if (missing.length === 0) throw err;
+		throw new Error(`The HTTP transport needs optional packages that are not installed (missing: ${missing.join(", ")}). Install them next to the server:\n  ${installCommand()}\nstdio does not need them. See docs/http-deployment.md.`, { cause: err });
 	}
 };
-const SESSION_IDLE_TIMEOUT_MS = 18e5;
-const SESSION_SWEEP_INTERVAL_MS = 6e4;
-const startHttpTransport = async (config, logger = silentLogger, options = {}) => {
-	const metadata = buildOAuthMetadata(config, logger);
-	const sessions = /* @__PURE__ */ new Map();
-	const idleTimeoutMs = options.sessionIdleTimeoutMs ?? SESSION_IDLE_TIMEOUT_MS;
-	const maxBodyBytes = options.maxBodyBytes ?? 4194304;
-	const dispatchToSession = async (req, res, sessionId, bearer) => {
-		const session = sessions.get(sessionId);
-		if (!session) return false;
-		session.auth.bearer = bearer;
-		session.lastActivityAt = Date.now();
-		const body = req.method === "POST" ? await readJsonBody(req, maxBodyBytes) : {
-			ok: true,
-			value: void 0
-		};
-		if (!body.ok) {
-			respondBodyError(req, res, body);
-			return true;
-		}
-		await session.transport.handleRequest(req, res, body.value);
-		return true;
-	};
-	const handleMcpRequest = async (req, res) => {
-		const bearer = extractBearer(req);
-		if (!bearer) {
-			sendUnauthorized(res, metadata.protectedResource.resource);
-			return;
-		}
-		const sessionId = typeof req.headers["mcp-session-id"] === "string" ? req.headers["mcp-session-id"] : void 0;
-		if (sessionId && await dispatchToSession(req, res, sessionId, bearer)) return;
-		if (req.method !== "POST") {
-			sendJsonRpcError(res, 400, -32e3, "No active session; initialize via POST first.");
-			return;
-		}
-		const body = await readJsonBody(req, maxBodyBytes);
-		if (!body.ok) {
-			respondBodyError(req, res, body);
-			return;
-		}
-		const auth = { bearer };
-		const server = createMcpServer(config, () => auth.bearer, logger);
-		const transport = new NodeStreamableHTTPServerTransport({
-			sessionIdGenerator: () => randomUUID(),
-			onsessioninitialized: (newId) => {
-				sessions.set(newId, {
-					transport,
-					auth,
-					lastActivityAt: Date.now(),
-					close: async () => {
-						await transport.close();
-						await server.close();
-					}
-				});
-			}
-		});
-		transport.onclose = () => {
-			if (transport.sessionId) sessions.delete(transport.sessionId);
-		};
-		await server.connect(transport);
-		await transport.handleRequest(req, res, body.value);
-	};
-	const staticGetRoutes = {
-		"/.well-known/oauth-protected-resource": metadata.protectedResource,
-		"/.well-known/oauth-authorization-server": metadata.authorizationServer,
-		"/healthz": {
-			status: "ok",
-			subdomain: config.subdomain
-		}
-	};
-	const requestListener = async (req, res) => {
-		try {
-			if (handleCorsPreflight(req, res, config.corsOrigins)) return;
-			applyCorsHeaders(req, res, config.corsOrigins);
-			const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
-			const staticRoute = req.method === "GET" ? staticGetRoutes[url.pathname] : void 0;
-			if (staticRoute) {
-				sendJson(res, 200, staticRoute);
-				return;
-			}
-			if (url.pathname === "/mcp") {
-				await handleMcpRequest(req, res);
-				return;
-			}
-			res.writeHead(404, { "Content-Type": "application/json" });
-			res.end(JSON.stringify({
-				error: "Not found",
-				path: url.pathname
-			}));
-		} catch (err) {
-			failRequest(res, err);
-		}
-	};
-	const httpServer = createServer((req, res) => {
-		requestListener(req, res);
-	});
-	await new Promise((resolve, reject) => {
-		httpServer.once("error", reject);
-		httpServer.listen(config.port, config.host, () => {
-			httpServer.off("error", reject);
-			resolve();
-		});
-	});
-	const addr = httpServer.address();
-	const boundPort = typeof addr === "object" && addr !== null ? addr.port : config.port;
-	logger.info("http_transport_ready", {
-		host: config.host,
-		port: boundPort
-	});
-	const sweepIdleSessions = async () => {
-		const cutoff = Date.now() - idleTimeoutMs;
-		for (const [id, session] of sessions) {
-			if (session.lastActivityAt > cutoff) continue;
-			sessions.delete(id);
-			try {
-				await session.close();
-			} catch (err) {
-				logger.warn("session_close_failed", {
-					sessionId: id,
-					error: err instanceof Error ? err.message : String(err)
-				});
-			}
-		}
-	};
-	const sweeper = setInterval(() => void sweepIdleSessions(), options.sweepIntervalMs ?? SESSION_SWEEP_INTERVAL_MS);
-	sweeper.unref();
-	return {
-		port: boundPort,
-		close: async () => {
-			clearInterval(sweeper);
-			await Promise.all([...sessions.values()].map((session) => session.close()));
-			sessions.clear();
-			httpServer.closeAllConnections();
-			await new Promise((resolve, reject) => {
-				httpServer.close((err) => err ? reject(err) : resolve());
-			});
-		}
-	};
-};
 //#endregion
 //#region src/utils/shutdown.ts
 /**
@@ -6011,6 +5686,7 @@ const main = async () => {
 		return;
 	}
 	if (config.dev) logger.warn("dev_mode_ignored_http");
+	const { startHttpTransport } = await loadHttpTransport();
 	const http = await startHttpTransport(config, logger);
 	installShutdown({
 		watchStdin: false,
@@ -6023,4 +5699,4 @@ main().catch((error) => {
 	process.exit(1);
 });
 //#endregion
-export {};
+export { configDir as a, requestedScope as c, getOAuthUrls as d, silentLogger as f, deadlineSignal as i, supportedScopes as l, zendeskGet as n, generateCodeChallenge as o, REQUEST_TIMEOUT_MS as r, generateCodeVerifier as s, createMcpServer as t, escapeHtml as u };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fruggr/zendesk-mcp-server",
-  "version": "2.24.0",
+  "version": "3.0.0",
   "mcpName": "io.github.fruggr/zendesk-mcp-server",
   "description": "Deep Zendesk MCP server for your AI assistant: search, draft, update and translate Help Center articles and manage Support tickets end to end — comments, triage and image attachments.",
   "type": "module",
@@ -18,6 +18,7 @@
     "typecheck": "node scripts/typecheck.mjs",
     "start": "node dist/index.js",
     "dev": "tsx watch src/index.ts",
+    "dev:http": "tsx src/index.ts --transport http --host 127.0.0.1 --port 3000 --public-url http://localhost:3000 --mode all --namespace tickets --namespace help_center --namespace users --namespace requests",
     "prepare": "npm run build && (lefthook install || true)",
     "prepublishOnly": "npm run build",
     "check": "node scripts/biome.mjs check --error-on-warnings .",
@@ -68,11 +69,10 @@
     "access": "public"
   },
   "engines": {
-    "node": ">=20"
+    "node": ">=22"
   },
-  "packageManager": "pnpm@12.5.1+sha512.e3f305bc784a2bc89f5ad3b6138889470fae8d2af5f36b61216ec91c2c3d64089775f9de38aac331044ea40f245cb0d5666392dfdf65824e1907ef6a2c62de5f",
+  "packageManager": "pnpm@12.6.0+sha512.3ef68f951cb111ac204b4a5a16f0b2ddf0da56a96e0413e81d855d9f0b55ef926714709028e1cd00c405c2c5fb7b9e8ec4dc46777c805d0373c2f2ff00fd20ec",
   "dependencies": {
-    "@modelcontextprotocol/node": "2.0.0",
     "@modelcontextprotocol/server": "2.0.0",
     "cheerio": "1.2.0",
     "hast-util-to-html": "9.0.5",
@@ -89,9 +89,26 @@
     "unified": "11.0.5",
     "zod": "4.6.5"
   },
+  "peerDependencies": {
+    "@modelcontextprotocol/node": "^2.0.0",
+    "jose": "^6.2.12",
+    "oidc-provider": "~9.12.2"
+  },
+  "peerDependenciesMeta": {
+    "@modelcontextprotocol/node": {
+      "optional": true
+    },
+    "jose": {
+      "optional": true
+    },
+    "oidc-provider": {
+      "optional": true
+    }
+  },
   "devDependencies": {
-    "@biomejs/biome": "2.5.13",
+    "@biomejs/biome": "2.5.14",
     "@modelcontextprotocol/client": "2.0.0",
+    "@modelcontextprotocol/node": "2.0.0",
     "@semantic-release/changelog": "^7.0.0",
     "@semantic-release/exec": "^7.1.0",
     "@semantic-release/git": "^11.0.0",
@@ -100,14 +117,17 @@
     "@semantic-release/release-notes-generator": "^14.1.1",
     "@stryker-mutator/core": "^10.0.0",
     "@stryker-mutator/vitest-runner": "^10.0.0",
-    "@tsconfig/node20": "^20.1.9",
+    "@tsconfig/node22": "^22.0.6",
     "@tsconfig/strictest": "^2.0.8",
     "@types/hast": "^3.0.4",
     "@types/node": "^22.15.0",
+    "@types/oidc-provider": "9.12.1",
     "@vitest/coverage-v8": "^5.0.0",
     "conventional-changelog-conventionalcommits": "^10.2.1",
+    "jose": "6.2.12",
     "lefthook": "^2.1.10",
     "msw": "^2.12.13",
+    "oidc-provider": "~9.12.2",
     "semantic-release": "^25.0.3",
     "shx": "^0.4.0",
     "tsdown": "^0.23.0",