@ibm/ibmi-mcp-server 0.1.0

package/dist/mcp-server/transports/auth/lib/authTypes.d.ts

@@ -0,0 +1,15 @@
+/**
+ * @fileoverview Shared types for authentication middleware.
+ * @module src/mcp-server/transports/auth/core/auth.types
+ */
+import type { AuthInfo as SdkAuthInfo } from "@modelcontextprotocol/sdk/server/auth/types.js";
+/**
+ * Defines the structure for authentication information derived from a token.
+ * It extends the base SDK type to include common optional claims and IBM i specific context.
+ */
+export type AuthInfo = SdkAuthInfo & {
+    subject?: string;
+    ibmiToken?: string;
+    ibmiHost?: string;
+};
+//# sourceMappingURL=authTypes.d.ts.map

package/dist/mcp-server/transports/auth/lib/authTypes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authTypes.d.ts","sourceRoot":"","sources":["../../../../../src/mcp-server/transports/auth/lib/authTypes.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,QAAQ,IAAI,WAAW,EAAE,MAAM,gDAAgD,CAAC;AAE9F;;;GAGG;AACH,MAAM,MAAM,QAAQ,GAAG,WAAW,GAAG;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC"}

package/dist/mcp-server/transports/auth/lib/authTypes.js

@@ -0,0 +1,9 @@
+/**
+ * @fileoverview Shared types for authentication middleware.
+ * @module src/mcp-server/transports/auth/core/auth.types
+ */
+export {};
+// The declaration for `http.IncomingMessage` is no longer needed here,
+// as the new architecture avoids direct mutation where possible and handles
+// the attachment within the Hono context.
+//# sourceMappingURL=authTypes.js.map

package/dist/mcp-server/transports/auth/lib/authTypes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authTypes.js","sourceRoot":"","sources":["../../../../../src/mcp-server/transports/auth/lib/authTypes.ts"],"names":[],"mappings":"AAAA;;;GAGG;;AAeH,uEAAuE;AACvE,4EAA4E;AAC5E,0CAA0C"}

package/dist/mcp-server/transports/auth/lib/authUtils.d.ts

@@ -0,0 +1,19 @@
+/**
+ * @fileoverview Provides utility functions for authorization, specifically for
+ * checking token scopes against required permissions for a given operation.
+ * @module src/mcp-server/transports/auth/core/authUtils
+ */
+/**
+ * Checks if the current authentication context contains all the specified scopes.
+ * This function is designed to be called within tool or resource handlers to
+ * enforce scope-based access control. It retrieves the authentication information
+ * from `authContext` (AsyncLocalStorage).
+ *
+ * @param requiredScopes - An array of scope strings that are mandatory for the operation.
+ * @throws {McpError} Throws an error with `BaseErrorCode.INTERNAL_ERROR` if the
+ *   authentication context is missing, which indicates a server configuration issue.
+ * @throws {McpError} Throws an error with `BaseErrorCode.FORBIDDEN` if one or
+ *   more required scopes are not present in the validated token.
+ */
+export declare function withRequiredScopes(requiredScopes: string[]): void;
+//# sourceMappingURL=authUtils.d.ts.map

package/dist/mcp-server/transports/auth/lib/authUtils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authUtils.d.ts","sourceRoot":"","sources":["../../../../../src/mcp-server/transports/auth/lib/authUtils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,cAAc,EAAE,MAAM,EAAE,GAAG,IAAI,CAuDjE"}

package/dist/mcp-server/transports/auth/lib/authUtils.js

@@ -0,0 +1,53 @@
+/**
+ * @fileoverview Provides utility functions for authorization, specifically for
+ * checking token scopes against required permissions for a given operation.
+ * @module src/mcp-server/transports/auth/core/authUtils
+ */
+import { JsonRpcErrorCode, McpError } from "../../../../types-global/errors.js";
+import { logger, requestContextService } from "../../../../utils/index.js";
+import { authContext } from "./authContext.js";
+/**
+ * Checks if the current authentication context contains all the specified scopes.
+ * This function is designed to be called within tool or resource handlers to
+ * enforce scope-based access control. It retrieves the authentication information
+ * from `authContext` (AsyncLocalStorage).
+ *
+ * @param requiredScopes - An array of scope strings that are mandatory for the operation.
+ * @throws {McpError} Throws an error with `BaseErrorCode.INTERNAL_ERROR` if the
+ *   authentication context is missing, which indicates a server configuration issue.
+ * @throws {McpError} Throws an error with `BaseErrorCode.FORBIDDEN` if one or
+ *   more required scopes are not present in the validated token.
+ */
+export function withRequiredScopes(requiredScopes) {
+    const operationName = "withRequiredScopesCheck";
+    const initialContext = requestContextService.createRequestContext({
+        operation: operationName,
+        requiredScopes,
+    });
+    logger.debug(initialContext, "Performing scope authorization check.");
+    const store = authContext.getStore();
+    if (!store || !store.authInfo) {
+        logger.crit(initialContext, "Authentication context is missing in withRequiredScopes. This is a server configuration error.");
+        // This is a server-side logic error; the auth middleware should always populate this.
+        throw new McpError(JsonRpcErrorCode.InternalError, "Authentication context is missing. This indicates a server configuration error.", {
+            ...initialContext,
+            error: "AuthStore not found in AsyncLocalStorage.",
+        });
+    }
+    const { scopes: grantedScopes, clientId, subject } = store.authInfo;
+    const grantedScopeSet = new Set(grantedScopes);
+    const missingScopes = requiredScopes.filter((scope) => !grantedScopeSet.has(scope));
+    const finalContext = {
+        ...initialContext,
+        grantedScopes,
+        clientId,
+        subject,
+    };
+    if (missingScopes.length > 0) {
+        const errorContext = { ...finalContext, missingScopes };
+        logger.warning(errorContext, "Authorization failed: Missing required scopes.");
+        throw new McpError(JsonRpcErrorCode.Forbidden, `Insufficient permissions. Missing required scopes: ${missingScopes.join(", ")}`, errorContext);
+    }
+    logger.debug(finalContext, "Scope authorization successful.");
+}
+//# sourceMappingURL=authUtils.js.map

package/dist/mcp-server/transports/auth/lib/authUtils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authUtils.js","sourceRoot":"","sources":["../../../../../src/mcp-server/transports/auth/lib/authUtils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAAC,cAAwB;IACzD,MAAM,aAAa,GAAG,yBAAyB,CAAC;IAChD,MAAM,cAAc,GAAG,qBAAqB,CAAC,oBAAoB,CAAC;QAChE,SAAS,EAAE,aAAa;QACxB,cAAc;KACf,CAAC,CAAC;IAEH,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,uCAAuC,CAAC,CAAC;IAEtE,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,EAAE,CAAC;IAErC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CACT,cAAc,EACd,gGAAgG,CACjG,CAAC;QACF,sFAAsF;QACtF,MAAM,IAAI,QAAQ,CAChB,gBAAgB,CAAC,aAAa,EAC9B,iFAAiF,EACjF;YACE,GAAG,cAAc;YACjB,KAAK,EAAE,2CAA2C;SACnD,CACF,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC;IACpE,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;IAE/C,MAAM,aAAa,GAAG,cAAc,CAAC,MAAM,CACzC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CACvC,CAAC;IAEF,MAAM,YAAY,GAAG;QACnB,GAAG,cAAc;QACjB,aAAa;QACb,QAAQ;QACR,OAAO;KACR,CAAC;IAEF,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,YAAY,GAAG,EAAE,GAAG,YAAY,EAAE,aAAa,EAAE,CAAC;QACxD,MAAM,CAAC,OAAO,CACZ,YAAY,EACZ,gDAAgD,CACjD,CAAC;QACF,MAAM,IAAI,QAAQ,CAChB,gBAAgB,CAAC,SAAS,EAC1B,sDAAsD,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAChF,YAAY,CACb,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,iCAAiC,CAAC,CAAC;AAChE,CAAC"}

package/dist/mcp-server/transports/auth/strategies/authStrategy.d.ts

@@ -0,0 +1,18 @@
+/**
+ * @fileoverview Defines the interface for all authentication strategies.
+ * This interface establishes a contract for verifying authentication tokens,
+ * ensuring that any authentication method (JWT, OAuth, etc.) can be used
+ * interchangeably by the core authentication middleware.
+ * @module src/mcp-server/transports/auth/strategies/AuthStrategy
+ */
+import type { AuthInfo } from "../lib/authTypes.js";
+export interface AuthStrategy {
+    /**
+     * Verifies an authentication token.
+     * @param token The raw token string extracted from the request.
+     * @returns A promise that resolves with the AuthInfo on successful verification.
+     * @throws {McpError} if the token is invalid, expired, or fails verification for any reason.
+     */
+    verify(token: string): Promise<AuthInfo>;
+}
+//# sourceMappingURL=authStrategy.d.ts.map

package/dist/mcp-server/transports/auth/strategies/authStrategy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authStrategy.d.ts","sourceRoot":"","sources":["../../../../../src/mcp-server/transports/auth/strategies/authStrategy.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAEpD,MAAM,WAAW,YAAY;IAC3B;;;;;OAKG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC1C"}

package/dist/mcp-server/transports/auth/strategies/authStrategy.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=authStrategy.js.map

package/dist/mcp-server/transports/auth/strategies/authStrategy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authStrategy.js","sourceRoot":"","sources":["../../../../../src/mcp-server/transports/auth/strategies/authStrategy.ts"],"names":[],"mappings":""}

package/dist/mcp-server/transports/auth/strategies/ibmiTokenStrategy.d.ts

@@ -0,0 +1,21 @@
+/**
+ * @fileoverview IBM i token authentication strategy implementation.
+ * Validates custom IBM i bearer tokens generated by TokenManager against
+ * authenticated connection pools. This strategy integrates the existing
+ * TokenManager system with the MCP authentication framework.
+ * @module src/mcp-server/transports/auth/strategies/IBMiTokenStrategy
+ */
+import type { AuthInfo } from "../lib/authTypes.js";
+import type { AuthStrategy } from "./authStrategy.js";
+export declare class IBMiTokenStrategy implements AuthStrategy {
+    private tokenManager;
+    constructor();
+    /**
+     * Verifies an IBM i authentication token using the TokenManager
+     * @param token - The raw IBM i token string extracted from the Bearer header
+     * @returns A promise that resolves with AuthInfo on successful verification
+     * @throws {McpError} if the token is invalid, expired, or fails verification
+     */
+    verify(token: string): Promise<AuthInfo>;
+}
+//# sourceMappingURL=ibmiTokenStrategy.d.ts.map

package/dist/mcp-server/transports/auth/strategies/ibmiTokenStrategy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ibmiTokenStrategy.d.ts","sourceRoot":"","sources":["../../../../../src/mcp-server/transports/auth/strategies/ibmiTokenStrategy.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtD,qBAAa,iBAAkB,YAAW,YAAY;IACpD,OAAO,CAAC,YAAY,CAAe;;IAgBnC;;;;;OAKG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;CAqD/C"}

package/dist/mcp-server/transports/auth/strategies/ibmiTokenStrategy.js

@@ -0,0 +1,64 @@
+/**
+ * @fileoverview IBM i token authentication strategy implementation.
+ * Validates custom IBM i bearer tokens generated by TokenManager against
+ * authenticated connection pools. This strategy integrates the existing
+ * TokenManager system with the MCP authentication framework.
+ * @module src/mcp-server/transports/auth/strategies/IBMiTokenStrategy
+ */
+import { JsonRpcErrorCode, McpError } from "../../../../types-global/errors.js";
+import { logger, requestContextService } from "../../../../utils/index.js";
+import { TokenManager } from "../../../../ibmi-mcp-server/auth/tokenManager.js";
+export class IBMiTokenStrategy {
+    tokenManager;
+    constructor() {
+        const context = requestContextService.createRequestContext({
+            operation: "IBMiTokenStrategy.constructor",
+        });
+        logger.debug(context, "Initializing IBM i token authentication strategy...");
+        this.tokenManager = TokenManager.getInstance();
+        logger.info(context, "IBM i token strategy initialized successfully");
+    }
+    /**
+     * Verifies an IBM i authentication token using the TokenManager
+     * @param token - The raw IBM i token string extracted from the Bearer header
+     * @returns A promise that resolves with AuthInfo on successful verification
+     * @throws {McpError} if the token is invalid, expired, or fails verification
+     */
+    async verify(token) {
+        const context = requestContextService.createRequestContext({
+            operation: "IBMiTokenStrategy.verify",
+        });
+        logger.debug(context, "Attempting to verify IBM i authentication token");
+        // Use existing TokenManager validation
+        const validation = this.tokenManager.validateToken(token, context);
+        if (!validation.valid || !validation.session) {
+            logger.warning({
+                ...context,
+                tokenPrefix: token.substring(0, 10) + "...",
+                error: validation.error,
+            }, "IBM i token validation failed");
+            throw new McpError(JsonRpcErrorCode.Unauthorized, validation.error || "Invalid IBM i authentication token", {
+                ...context,
+                tokenPrefix: token.substring(0, 10) + "...",
+            });
+        }
+        // Convert to AuthInfo format expected by middleware
+        const authInfo = {
+            token,
+            clientId: validation.session.credentials.user, // Use IBM i username as clientId
+            scopes: ["ibmi:access"], // Standard scope for IBM i access
+            subject: validation.session.credentials.user,
+            // Add IBM i specific context for YAML tools to use
+            ibmiToken: token,
+            ibmiHost: validation.session.credentials.host,
+        };
+        logger.info({
+            ...context,
+            clientId: authInfo.clientId,
+            ibmiHost: validation.session.credentials.host,
+            scopes: authInfo.scopes,
+        }, "IBM i token verification successful");
+        return authInfo;
+    }
+}
+//# sourceMappingURL=ibmiTokenStrategy.js.map

package/dist/mcp-server/transports/auth/strategies/ibmiTokenStrategy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ibmiTokenStrategy.js","sourceRoot":"","sources":["../../../../../src/mcp-server/transports/auth/strategies/ibmiTokenStrategy.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AAItE,MAAM,OAAO,iBAAiB;IACpB,YAAY,CAAe;IAEnC;QACE,MAAM,OAAO,GAAG,qBAAqB,CAAC,oBAAoB,CAAC;YACzD,SAAS,EAAE,+BAA+B;SAC3C,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CACV,OAAO,EACP,qDAAqD,CACtD,CAAC;QAEF,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC,WAAW,EAAE,CAAC;QAE/C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,+CAA+C,CAAC,CAAC;IACxE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,MAAM,OAAO,GAAG,qBAAqB,CAAC,oBAAoB,CAAC;YACzD,SAAS,EAAE,0BAA0B;SACtC,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,iDAAiD,CAAC,CAAC;QAEzE,uCAAuC;QACvC,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAEnE,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YAC7C,MAAM,CAAC,OAAO,CACZ;gBACE,GAAG,OAAO;gBACV,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;gBAC3C,KAAK,EAAE,UAAU,CAAC,KAAK;aACxB,EACD,+BAA+B,CAChC,CAAC;YAEF,MAAM,IAAI,QAAQ,CAChB,gBAAgB,CAAC,YAAY,EAC7B,UAAU,CAAC,KAAK,IAAI,oCAAoC,EACxD;gBACE,GAAG,OAAO;gBACV,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;aAC5C,CACF,CAAC;QACJ,CAAC;QAED,oDAAoD;QACpD,MAAM,QAAQ,GAAa;YACzB,KAAK;YACL,QAAQ,EAAE,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,iCAAiC;YAChF,MAAM,EAAE,CAAC,aAAa,CAAC,EAAE,kCAAkC;YAC3D,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI;YAC5C,mDAAmD;YACnD,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI;SAC9C,CAAC;QAEF,MAAM,CAAC,IAAI,CACT;YACE,GAAG,OAAO;YACV,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,QAAQ,EAAE,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI;YAC7C,MAAM,EAAE,QAAQ,CAAC,MAAM;SACxB,EACD,qCAAqC,CACtC,CAAC;QAEF,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/dist/mcp-server/transports/auth/strategies/jwtStrategy.d.ts

@@ -0,0 +1,8 @@
+import type { AuthInfo } from "../lib/authTypes.js";
+import type { AuthStrategy } from "./authStrategy.js";
+export declare class JwtStrategy implements AuthStrategy {
+    private readonly secretKey;
+    constructor();
+    verify(token: string): Promise<AuthInfo>;
+}
+//# sourceMappingURL=jwtStrategy.d.ts.map

package/dist/mcp-server/transports/auth/strategies/jwtStrategy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwtStrategy.d.ts","sourceRoot":"","sources":["../../../../../src/mcp-server/transports/auth/strategies/jwtStrategy.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtD,qBAAa,WAAY,YAAW,YAAY;IAC9C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoB;;IAkCxC,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;CA2H/C"}

package/dist/mcp-server/transports/auth/strategies/jwtStrategy.js

@@ -0,0 +1,118 @@
+/**
+ * @fileoverview Implements the JWT authentication strategy.
+ * This module provides a concrete implementation of the AuthStrategy for validating
+ * JSON Web Tokens (JWTs). It encapsulates all logic related to JWT verification,
+ * including secret key management and payload validation.
+ * @module src/mcp-server/transports/auth/strategies/JwtStrategy
+ */
+import { jwtVerify } from "jose";
+import { config, environment } from "../../../../config/index.js";
+import { JsonRpcErrorCode, McpError } from "../../../../types-global/errors.js";
+import { ErrorHandler, logger, requestContextService } from "../../../../utils/index.js";
+export class JwtStrategy {
+    secretKey;
+    constructor() {
+        const context = requestContextService.createRequestContext({
+            operation: "JwtStrategy.constructor",
+        });
+        logger.debug(context, "Initializing JwtStrategy...");
+        if (config.mcpAuthMode === "jwt") {
+            if (environment === "production" && !config.mcpAuthSecretKey) {
+                logger.fatal(context, "CRITICAL: MCP_AUTH_SECRET_KEY is not set in production for JWT auth.");
+                throw new McpError(JsonRpcErrorCode.ConfigurationError, "MCP_AUTH_SECRET_KEY must be set for JWT auth in production.", context);
+            }
+            else if (!config.mcpAuthSecretKey) {
+                logger.warning(context, "MCP_AUTH_SECRET_KEY is not set. JWT auth will be bypassed (DEV ONLY).");
+                this.secretKey = null;
+            }
+            else {
+                logger.info(context, "JWT secret key loaded successfully.");
+                this.secretKey = new TextEncoder().encode(config.mcpAuthSecretKey);
+            }
+        }
+        else {
+            this.secretKey = null;
+        }
+    }
+    async verify(token) {
+        const context = requestContextService.createRequestContext({
+            operation: "JwtStrategy.verify",
+        });
+        logger.debug(context, "Attempting to verify JWT.");
+        // Handle development mode bypass
+        if (!this.secretKey) {
+            if (environment !== "production") {
+                logger.warning(context, "Bypassing JWT verification: No secret key (DEV ONLY).");
+                return {
+                    token: "dev-mode-placeholder-token",
+                    clientId: config.devMcpClientId || "dev-client-id",
+                    scopes: config.devMcpScopes || ["dev-scope"],
+                };
+            }
+            // This path is defensive. The constructor should prevent this state in production.
+            logger.crit(context, "Auth secret key is missing in production.");
+            throw new McpError(JsonRpcErrorCode.ConfigurationError, "Auth secret key is missing in production. This indicates a server configuration error.", context);
+        }
+        try {
+            const { payload: decoded } = await jwtVerify(token, this.secretKey);
+            logger.debug({
+                ...context,
+                claims: decoded,
+            }, "JWT signature verified successfully.");
+            const clientId = typeof decoded.cid === "string"
+                ? decoded.cid
+                : typeof decoded.client_id === "string"
+                    ? decoded.client_id
+                    : undefined;
+            if (!clientId) {
+                logger.warning(context, "Invalid token: missing 'cid' or 'client_id' claim.");
+                throw new McpError(JsonRpcErrorCode.Unauthorized, "Invalid token: missing 'cid' or 'client_id' claim.", context);
+            }
+            let scopes = [];
+            if (Array.isArray(decoded.scp) &&
+                decoded.scp.every((s) => typeof s === "string")) {
+                scopes = decoded.scp;
+            }
+            else if (typeof decoded.scope === "string" && decoded.scope.trim()) {
+                scopes = decoded.scope.split(" ").filter(Boolean);
+            }
+            if (scopes.length === 0) {
+                logger.warning(context, "Invalid token: missing or empty 'scp' or 'scope' claim.");
+                throw new McpError(JsonRpcErrorCode.Unauthorized, "Token must contain valid, non-empty scopes.", context);
+            }
+            const authInfo = {
+                token,
+                clientId,
+                scopes,
+                subject: decoded.sub,
+            };
+            logger.info({
+                ...context,
+                clientId,
+                scopes,
+            }, "JWT verification successful.");
+            return authInfo;
+        }
+        catch (error) {
+            // If the error is already a structured McpError, re-throw it directly.
+            if (error instanceof McpError) {
+                throw error;
+            }
+            const message = error instanceof Error && error.name === "JWTExpired"
+                ? "Token has expired."
+                : "Token verification failed.";
+            logger.warning({
+                ...context,
+                errorName: error instanceof Error ? error.name : "Unknown",
+            }, `JWT verification failed: ${message}`);
+            throw ErrorHandler.handleError(error, {
+                operation: "JwtStrategy.verify",
+                context,
+                rethrow: true,
+                errorCode: JsonRpcErrorCode.Unauthorized,
+                errorMapper: () => new McpError(JsonRpcErrorCode.Unauthorized, message, context),
+            });
+        }
+    }
+}
+//# sourceMappingURL=jwtStrategy.js.map

package/dist/mcp-server/transports/auth/strategies/jwtStrategy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwtStrategy.js","sourceRoot":"","sources":["../../../../../src/mcp-server/transports/auth/strategies/jwtStrategy.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAI/E,MAAM,OAAO,WAAW;IACL,SAAS,CAAoB;IAE9C;QACE,MAAM,OAAO,GAAG,qBAAqB,CAAC,oBAAoB,CAAC;YACzD,SAAS,EAAE,yBAAyB;SACrC,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,6BAA6B,CAAC,CAAC;QAErD,IAAI,MAAM,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;YACjC,IAAI,WAAW,KAAK,YAAY,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;gBAC7D,MAAM,CAAC,KAAK,CACV,OAAO,EACP,sEAAsE,CACvE,CAAC;gBACF,MAAM,IAAI,QAAQ,CAChB,gBAAgB,CAAC,kBAAkB,EACnC,6DAA6D,EAC7D,OAAO,CACR,CAAC;YACJ,CAAC;iBAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;gBACpC,MAAM,CAAC,OAAO,CACZ,OAAO,EACP,uEAAuE,CACxE,CAAC;gBACF,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;YACxB,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,qCAAqC,CAAC,CAAC;gBAC5D,IAAI,CAAC,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACxB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,MAAM,OAAO,GAAG,qBAAqB,CAAC,oBAAoB,CAAC;YACzD,SAAS,EAAE,oBAAoB;SAChC,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,2BAA2B,CAAC,CAAC;QAEnD,iCAAiC;QACjC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,IAAI,WAAW,KAAK,YAAY,EAAE,CAAC;gBACjC,MAAM,CAAC,OAAO,CACZ,OAAO,EACP,uDAAuD,CACxD,CAAC;gBACF,OAAO;oBACL,KAAK,EAAE,4BAA4B;oBACnC,QAAQ,EAAE,MAAM,CAAC,cAAc,IAAI,eAAe;oBAClD,MAAM,EAAE,MAAM,CAAC,YAAY,IAAI,CAAC,WAAW,CAAC;iBAC7C,CAAC;YACJ,CAAC;YACD,mFAAmF;YACnF,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,2CAA2C,CAAC,CAAC;YAClE,MAAM,IAAI,QAAQ,CAChB,gBAAgB,CAAC,kBAAkB,EACnC,wFAAwF,EACxF,OAAO,CACR,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACpE,MAAM,CAAC,KAAK,CACV;gBACE,GAAG,OAAO;gBACV,MAAM,EAAE,OAAO;aAChB,EACD,sCAAsC,CACvC,CAAC;YAEF,MAAM,QAAQ,GACZ,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;gBAC7B,CAAC,CAAC,OAAO,CAAC,GAAG;gBACb,CAAC,CAAC,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ;oBACrC,CAAC,CAAC,OAAO,CAAC,SAAS;oBACnB,CAAC,CAAC,SAAS,CAAC;YAElB,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,CAAC,OAAO,CACZ,OAAO,EACP,oDAAoD,CACrD,CAAC;gBACF,MAAM,IAAI,QAAQ,CAChB,gBAAgB,CAAC,YAAY,EAC7B,oDAAoD,EACpD,OAAO,CACR,CAAC;YACJ,CAAC;YAED,IAAI,MAAM,GAAa,EAAE,CAAC;YAC1B,IACE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC;gBAC1B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAC/C,CAAC;gBACD,MAAM,GAAG,OAAO,CAAC,GAAe,CAAC;YACnC,CAAC;iBAAM,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;gBACrE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACpD,CAAC;YAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,MAAM,CAAC,OAAO,CACZ,OAAO,EACP,yDAAyD,CAC1D,CAAC;gBACF,MAAM,IAAI,QAAQ,CAChB,gBAAgB,CAAC,YAAY,EAC7B,6CAA6C,EAC7C,OAAO,CACR,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GAAa;gBACzB,KAAK;gBACL,QAAQ;gBACR,MAAM;gBACN,OAAO,EAAE,OAAO,CAAC,GAAG;aACrB,CAAC;YACF,MAAM,CAAC,IAAI,CACT;gBACE,GAAG,OAAO;gBACV,QAAQ;gBACR,MAAM;aACP,EACD,8BAA8B,CAC/B,CAAC;YACF,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uEAAuE;YACvE,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;gBAC9B,MAAM,KAAK,CAAC;YACd,CAAC;YAED,MAAM,OAAO,GACX,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY;gBACnD,CAAC,CAAC,oBAAoB;gBACtB,CAAC,CAAC,4BAA4B,CAAC;YAEnC,MAAM,CAAC,OAAO,CACZ;gBACE,GAAG,OAAO;gBACV,SAAS,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;aAC3D,EACD,4BAA4B,OAAO,EAAE,CACtC,CAAC;YAEF,MAAM,YAAY,CAAC,WAAW,CAAC,KAAK,EAAE;gBACpC,SAAS,EAAE,oBAAoB;gBAC/B,OAAO;gBACP,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,gBAAgB,CAAC,YAAY;gBACxC,WAAW,EAAE,GAAG,EAAE,CAChB,IAAI,QAAQ,CAAC,gBAAgB,CAAC,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC;aAChE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}

package/dist/mcp-server/transports/auth/strategies/oauthStrategy.d.ts

@@ -0,0 +1,8 @@
+import type { AuthInfo } from "../lib/authTypes.js";
+import type { AuthStrategy } from "./authStrategy.js";
+export declare class OauthStrategy implements AuthStrategy {
+    private readonly jwks;
+    constructor();
+    verify(token: string): Promise<AuthInfo>;
+}
+//# sourceMappingURL=oauthStrategy.d.ts.map

package/dist/mcp-server/transports/auth/strategies/oauthStrategy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthStrategy.d.ts","sourceRoot":"","sources":["../../../../../src/mcp-server/transports/auth/strategies/oauthStrategy.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtD,qBAAa,aAAc,YAAW,YAAY;IAChD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAwC;;IAuDvD,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;CAmG/C"}

package/dist/mcp-server/transports/auth/strategies/oauthStrategy.js

@@ -0,0 +1,118 @@
+/**
+ * @fileoverview Implements the OAuth 2.1 authentication strategy.
+ * This module provides a concrete implementation of the AuthStrategy for validating
+ * JWTs against a remote JSON Web Key Set (JWKS), as is common in OAuth 2.1 flows.
+ * @module src/mcp-server/transports/auth/strategies/OauthStrategy
+ */
+import { createRemoteJWKSet, jwtVerify } from "jose";
+import { config } from "../../../../config/index.js";
+import { JsonRpcErrorCode, McpError } from "../../../../types-global/errors.js";
+import { ErrorHandler, logger, requestContextService } from "../../../../utils/index.js";
+export class OauthStrategy {
+    jwks;
+    constructor() {
+        const context = requestContextService.createRequestContext({
+            operation: "OauthStrategy.constructor",
+        });
+        logger.debug(context, "Initializing OauthStrategy...");
+        if (config.mcpAuthMode !== "oauth") {
+            // This check is for internal consistency, so a standard Error is acceptable here.
+            throw new Error("OauthStrategy instantiated for non-oauth auth mode.");
+        }
+        if (!config.oauthIssuerUrl || !config.oauthAudience) {
+            logger.fatal(context, "CRITICAL: OAUTH_ISSUER_URL and OAUTH_AUDIENCE must be set for OAuth mode.");
+            // This is a user-facing configuration error, so McpError is appropriate.
+            throw new McpError(JsonRpcErrorCode.ConfigurationError, "OAUTH_ISSUER_URL and OAUTH_AUDIENCE must be set for OAuth mode.", context);
+        }
+        try {
+            const jwksUrl = new URL(config.oauthJwksUri ||
+                `${config.oauthIssuerUrl.replace(/\/$/, "")}/.well-known/jwks.json`);
+            this.jwks = createRemoteJWKSet(jwksUrl, {
+                cooldownDuration: 300000, // 5 minutes
+                timeoutDuration: 5000, // 5 seconds
+            });
+            logger.info(context, `JWKS client initialized for URL: ${jwksUrl.href}`);
+        }
+        catch (error) {
+            logger.fatal({
+                ...context,
+                error: error,
+            }, "Failed to initialize JWKS client.");
+            // This is a critical startup failure, so a specific McpError is warranted.
+            throw new McpError(JsonRpcErrorCode.ServiceUnavailable, "Could not initialize JWKS client for OAuth strategy.", {
+                ...context,
+                originalError: error instanceof Error ? error.message : "Unknown",
+            });
+        }
+    }
+    async verify(token) {
+        const context = requestContextService.createRequestContext({
+            operation: "OauthStrategy.verify",
+        });
+        logger.debug(context, "Attempting to verify OAuth token via JWKS.");
+        try {
+            const { payload } = await jwtVerify(token, this.jwks, {
+                issuer: config.oauthIssuerUrl,
+                audience: config.oauthAudience,
+            });
+            logger.debug({
+                ...context,
+                claims: payload,
+            }, "OAuth token signature verified successfully.");
+            // Robust scope parsing (mirroring JwtStrategy):
+            let scopes = [];
+            // Check for 'scp' claim (array format)
+            if (Array.isArray(payload.scp) &&
+                payload.scp.every((s) => typeof s === "string")) {
+                scopes = payload.scp;
+                // Check for 'scope' claim (space-delimited string format)
+            }
+            else if (typeof payload.scope === "string" && payload.scope.trim()) {
+                scopes = payload.scope.split(" ").filter(Boolean);
+            }
+            if (scopes.length === 0) {
+                logger.warning(context, "Invalid token: missing or empty 'scope' claim.");
+                throw new McpError(JsonRpcErrorCode.Unauthorized, "Token must contain valid, non-empty scopes.", context);
+            }
+            const clientId = typeof payload.client_id === "string" ? payload.client_id : undefined;
+            if (!clientId) {
+                logger.warning(context, "Invalid token: missing 'client_id' claim.");
+                throw new McpError(JsonRpcErrorCode.Unauthorized, "Token must contain a 'client_id' claim.", context);
+            }
+            const authInfo = {
+                token,
+                clientId,
+                scopes,
+                subject: typeof payload.sub === "string" ? payload.sub : undefined,
+            };
+            logger.info({
+                ...context,
+                clientId,
+                scopes,
+            }, "OAuth token verification successful.");
+            return authInfo;
+        }
+        catch (error) {
+            // If the error is already a structured McpError, re-throw it directly.
+            if (error instanceof McpError) {
+                throw error;
+            }
+            const message = error instanceof Error && error.name === "JWTExpired"
+                ? "Token has expired."
+                : "OAuth token verification failed.";
+            logger.warning({
+                ...context,
+                errorName: error instanceof Error ? error.name : "Unknown",
+            }, `OAuth token verification failed: ${message}`);
+            // For all other errors, use the ErrorHandler to wrap them.
+            throw ErrorHandler.handleError(error, {
+                operation: "OauthStrategy.verify",
+                context,
+                rethrow: true,
+                errorCode: JsonRpcErrorCode.Unauthorized,
+                errorMapper: () => new McpError(JsonRpcErrorCode.Unauthorized, message, context),
+            });
+        }
+    }
+}
+//# sourceMappingURL=oauthStrategy.js.map

package/dist/mcp-server/transports/auth/strategies/oauthStrategy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthStrategy.js","sourceRoot":"","sources":["../../../../../src/mcp-server/transports/auth/strategies/oauthStrategy.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAmB,MAAM,MAAM,CAAC;AACtE,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAI/E,MAAM,OAAO,aAAa;IACP,IAAI,CAAwC;IAE7D;QACE,MAAM,OAAO,GAAG,qBAAqB,CAAC,oBAAoB,CAAC;YACzD,SAAS,EAAE,2BAA2B;SACvC,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,+BAA+B,CAAC,CAAC;QAEvD,IAAI,MAAM,CAAC,WAAW,KAAK,OAAO,EAAE,CAAC;YACnC,kFAAkF;YAClF,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;YACpD,MAAM,CAAC,KAAK,CACV,OAAO,EACP,2EAA2E,CAC5E,CAAC;YACF,yEAAyE;YACzE,MAAM,IAAI,QAAQ,CAChB,gBAAgB,CAAC,kBAAkB,EACnC,iEAAiE,EACjE,OAAO,CACR,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,MAAM,CAAC,YAAY;gBACjB,GAAG,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,wBAAwB,CACtE,CAAC;YACF,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC,OAAO,EAAE;gBACtC,gBAAgB,EAAE,MAAM,EAAE,YAAY;gBACtC,eAAe,EAAE,IAAI,EAAE,YAAY;aACpC,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,oCAAoC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CACV;gBACE,GAAG,OAAO;gBACV,KAAK,EAAE,KAAc;aACtB,EACD,mCAAmC,CACpC,CAAC;YACF,2EAA2E;YAC3E,MAAM,IAAI,QAAQ,CAChB,gBAAgB,CAAC,kBAAkB,EACnC,sDAAsD,EACtD;gBACE,GAAG,OAAO;gBACV,aAAa,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;aAClE,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,MAAM,OAAO,GAAG,qBAAqB,CAAC,oBAAoB,CAAC;YACzD,SAAS,EAAE,sBAAsB;SAClC,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,4CAA4C,CAAC,CAAC;QAEpE,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAoB,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE;gBACrE,MAAM,EAAE,MAAM,CAAC,cAAe;gBAC9B,QAAQ,EAAE,MAAM,CAAC,aAAc;aAChC,CAAC,CAAC;YACH,MAAM,CAAC,KAAK,CACV;gBACE,GAAG,OAAO;gBACV,MAAM,EAAE,OAAO;aAChB,EACD,8CAA8C,CAC/C,CAAC;YAEF,gDAAgD;YAChD,IAAI,MAAM,GAAa,EAAE,CAAC;YAC1B,uCAAuC;YACvC,IACE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC;gBACzB,OAAO,CAAC,GAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAC9D,CAAC;gBACD,MAAM,GAAG,OAAO,CAAC,GAAe,CAAC;gBACjC,0DAA0D;YAC5D,CAAC;iBAAM,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;gBACrE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACpD,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,MAAM,CAAC,OAAO,CACZ,OAAO,EACP,gDAAgD,CACjD,CAAC;gBACF,MAAM,IAAI,QAAQ,CAChB,gBAAgB,CAAC,YAAY,EAC7B,6CAA6C,EAC7C,OAAO,CACR,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GACZ,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YACxE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,2CAA2C,CAAC,CAAC;gBACrE,MAAM,IAAI,QAAQ,CAChB,gBAAgB,CAAC,YAAY,EAC7B,yCAAyC,EACzC,OAAO,CACR,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GAAa;gBACzB,KAAK;gBACL,QAAQ;gBACR,MAAM;gBACN,OAAO,EAAE,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;aACnE,CAAC;YACF,MAAM,CAAC,IAAI,CACT;gBACE,GAAG,OAAO;gBACV,QAAQ;gBACR,MAAM;aACP,EACD,sCAAsC,CACvC,CAAC;YACF,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uEAAuE;YACvE,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;gBAC9B,MAAM,KAAK,CAAC;YACd,CAAC;YAED,MAAM,OAAO,GACX,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY;gBACnD,CAAC,CAAC,oBAAoB;gBACtB,CAAC,CAAC,kCAAkC,CAAC;YAEzC,MAAM,CAAC,OAAO,CACZ;gBACE,GAAG,OAAO;gBACV,SAAS,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;aAC3D,EACD,oCAAoC,OAAO,EAAE,CAC9C,CAAC;YAEF,2DAA2D;YAC3D,MAAM,YAAY,CAAC,WAAW,CAAC,KAAK,EAAE;gBACpC,SAAS,EAAE,sBAAsB;gBACjC,OAAO;gBACP,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,gBAAgB,CAAC,YAAY;gBACxC,WAAW,EAAE,GAAG,EAAE,CAChB,IAAI,QAAQ,CAAC,gBAAgB,CAAC,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC;aAChE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}

package/dist/mcp-server/transports/core/autoTransportManager.d.ts

@@ -0,0 +1,48 @@
+/**
+ * @fileoverview Implements the "auto" mode transport manager.
+ * This manager acts as a router, delegating requests to either a stateful or a
+ * stateless manager based on the request's characteristics. It encapsulates the
+ * logic for providing a hybrid session model.
+ * @module src/mcp-server/transports/core/autoTransportManager
+ */
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { RequestContext } from "../../../utils/index.js";
+import { McpTransportRequest } from "./transportRequest.js";
+import { StatefulTransportOptions } from "./statefulTransportManager.js";
+import { TransportManager, TransportResponse } from "./transportTypes.js";
+/**
+ * A transport manager that dynamically handles both stateful and stateless requests.
+ * It inspects each request and routes it to an underlying stateful manager if it
+ * contains a session ID or is an initialization request. Otherwise, it handles
+ * the request ephemerally using a temporary stateless manager.
+ */
+export declare class AutoTransportManager implements TransportManager {
+    private readonly statefulManager;
+    private readonly statelessManager;
+    /**
+     * @param createServerInstanceFn A factory function to create new McpServer instances.
+     * @param options Configuration options, primarily for the underlying stateful manager.
+     */
+    constructor(createServerInstanceFn: () => Promise<McpServer>, options: StatefulTransportOptions);
+    /**
+     * Handles an incoming request by routing it to the appropriate manager.
+     * If the request is an `initialize` request or includes a session ID, it is
+     * delegated to the stateful manager. Otherwise, a new stateless manager is
+     * created to handle the single request.
+     * @param request The standardized transport request object.
+     * @returns A promise that resolves to a TransportResponse object.
+     */
+    handleRequest(request: McpTransportRequest): Promise<TransportResponse>;
+    /**
+     * Delegates a session deletion request to the underlying stateful manager.
+     * @param sessionId The ID of the session to delete.
+     * @param context The request context.
+     * @returns A promise resolving to a TransportResponse confirming closure.
+     */
+    handleDeleteRequest(sessionId: string, context: RequestContext): Promise<TransportResponse>;
+    /**
+     * Shuts down the underlying stateful manager, cleaning up all its resources.
+     */
+    shutdown(): Promise<void>;
+}
+//# sourceMappingURL=autoTransportManager.d.ts.map

package/dist/mcp-server/transports/core/autoTransportManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"autoTransportManager.d.ts","sourceRoot":"","sources":["../../../../src/mcp-server/transports/core/autoTransportManager.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAEL,wBAAwB,EACzB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAE1E;;;;;GAKG;AACH,qBAAa,oBAAqB,YAAW,gBAAgB;IAC3D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA2B;IAC3D,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA4B;IAE7D;;;OAGG;gBAED,sBAAsB,EAAE,MAAM,OAAO,CAAC,SAAS,CAAC,EAChD,OAAO,EAAE,wBAAwB;IAWnC;;;;;;;OAOG;IACG,aAAa,CACjB,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,iBAAiB,CAAC;IAe7B;;;;;OAKG;IACG,mBAAmB,CACvB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,iBAAiB,CAAC;IAI7B;;OAEG;IACG,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAGhC"}