@neverinfamous/postgres-mcp 2.0.0 → 2.2.0

package/dist/server/McpServer.d.ts

@@ -25,7 +25,7 @@ export declare class PostgresMcpServer {
     /**
      * Register all tools, resources, and prompts
      */
-    private registerComponents;
+    registerComponents(): void;
     /**
      * Start the server with stdio transport
      */

package/dist/server/McpServer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"McpServer.d.ts","sourceRoot":"","sources":["../../src/server/McpServer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAK1D,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,eAAe,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC;AAED;;GAEG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,SAAS,CAAY;IAC7B,OAAO,CAAC,OAAO,CAAkB;IACjC,OAAO,CAAC,YAAY,CAAmB;IACvC,OAAO,CAAC,SAAS,CAAqC;gBAE1C,MAAM,EAAE,YAAY;IA+BhC;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAqB1B;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAY5B;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAa3B;;OAEG;IACH,YAAY,IAAI,SAAS;IAIzB;;OAEG;IACH,UAAU,IAAI,eAAe;IAI7B;;OAEG;IACH,eAAe,IAAI,gBAAgB;CAGpC"}
+{"version":3,"file":"McpServer.d.ts","sourceRoot":"","sources":["../../src/server/McpServer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAK1D,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,eAAe,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC;AAED;;GAEG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,SAAS,CAAY;IAC7B,OAAO,CAAC,OAAO,CAAkB;IACjC,OAAO,CAAC,YAAY,CAAmB;IACvC,OAAO,CAAC,SAAS,CAAqC;gBAE1C,MAAM,EAAE,YAAY;IA8BhC;;OAEG;IACI,kBAAkB,IAAI,IAAI;IAqBjC;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAY5B;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAa3B;;OAEG;IACH,YAAY,IAAI,SAAS;IAIzB;;OAEG;IACH,UAAU,IAAI,eAAe;IAI7B;;OAEG;IACH,eAAe,IAAI,gBAAgB;CAGpC"}

package/dist/server/McpServer.js

@@ -31,8 +31,7 @@ export class PostgresMcpServer {
             instructions: SERVER_INSTRUCTIONS,
         });
         // Connect the logger to the underlying MCP server for protocol logging
-        // The McpServer.server property exposes the low-level Server instance
-        logger.setMcpServer(this.mcpServer.server);
+        logger.setMcpServer(this.mcpServer);
         logger.setLoggerName(config.name);
         logger.info("MCP Server initialized", {
             name: config.name,

package/dist/server/McpServer.js.map

@@ -1 +1 @@
-{"version":3,"file":"McpServer.js","sourceRoot":"","sources":["../../src/server/McpServer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAGjF,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AASzE;;GAEG;AACH,MAAM,OAAO,iBAAiB;IACpB,SAAS,CAAY;IACrB,OAAO,CAAkB;IACzB,YAAY,CAAmB;IAC/B,SAAS,GAAgC,IAAI,CAAC;IAEtD,YAAY,MAAoB;QAC9B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,YAAY,GAAG,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAEvD,4EAA4E;QAC5E,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAC5B;YACE,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,EACD;YACE,YAAY,EAAE;gBACZ,OAAO,EAAE,EAAE;aACZ;YACD,YAAY,EAAE,mBAAmB;SAClC,CACF,CAAC;QAEF,uEAAuE;QACvE,sEAAsE;QACtE,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAElC,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE;YACpC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,MAAM;YACvC,YAAY,EAAE,CAAC,SAAS,CAAC;SAC1B,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,kBAAkB;QACxB,kCAAkC;QAClC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QAE3E,qBAAqB;QACrB,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAE/C,mBAAmB;QACnB,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAE7C,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,IAAI,CAAC;QACtD,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,CAAC,MAAM,CAAC;QACnE,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC,MAAM,CAAC;QAE/D,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE;YACnC,KAAK,EAAE,SAAS;YAChB,SAAS,EAAE,aAAa;YACxB,OAAO,EAAE,WAAW;SACrB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK;QACT,0BAA0B;QAC1B,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAE1B,+BAA+B;QAC/B,IAAI,CAAC,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAE5C,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAE7C,MAAM,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;IACzD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI;QACR,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QAEtC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE;gBACpC,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;aAChE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;OAEG;IACH,YAAY;QACV,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED;;OAEG;IACH,UAAU;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,eAAe;QACb,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;CACF"}
+{"version":3,"file":"McpServer.js","sourceRoot":"","sources":["../../src/server/McpServer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAGjF,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AASzE;;GAEG;AACH,MAAM,OAAO,iBAAiB;IACpB,SAAS,CAAY;IACrB,OAAO,CAAkB;IACzB,YAAY,CAAmB;IAC/B,SAAS,GAAgC,IAAI,CAAC;IAEtD,YAAY,MAAoB;QAC9B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,YAAY,GAAG,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAEvD,4EAA4E;QAC5E,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAC5B;YACE,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,EACD;YACE,YAAY,EAAE;gBACZ,OAAO,EAAE,EAAE;aACZ;YACD,YAAY,EAAE,mBAAmB;SAClC,CACF,CAAC;QAEF,uEAAuE;QACvE,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAElC,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE;YACpC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,MAAM;YACvC,YAAY,EAAE,CAAC,SAAS,CAAC;SAC1B,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACI,kBAAkB;QACvB,kCAAkC;QAClC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QAE3E,qBAAqB;QACrB,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAE/C,mBAAmB;QACnB,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAE7C,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,IAAI,CAAC;QACtD,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,CAAC,MAAM,CAAC;QACnE,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC,MAAM,CAAC;QAE/D,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE;YACnC,KAAK,EAAE,SAAS;YAChB,SAAS,EAAE,aAAa;YACxB,OAAO,EAAE,WAAW;SACrB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK;QACT,0BAA0B;QAC1B,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAE1B,+BAA+B;QAC/B,IAAI,CAAC,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAE5C,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAE7C,MAAM,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;IACzD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI;QACR,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QAEtC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE;gBACpC,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;aAChE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;OAEG;IACH,YAAY;QACV,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED;;OAEG;IACH,UAAU;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,eAAe;QACb,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;CACF"}

package/dist/transports/http.d.ts

@@ -1,9 +1,15 @@
 /**
  * postgres-mcp - HTTP Transport
  *
- * HTTP/SSE transport with OAuth 2.0 support.
+ * Dual-protocol HTTP transport with backward compatibility:
+ * - `/mcp` — Streamable HTTP transport (MCP protocol 2025-11-25)
+ * - `/sse` + `/messages` — Legacy SSE transport (MCP protocol 2024-11-05)
+ *
+ * Includes OAuth 2.0 support, rate limiting, CORS, and security headers.
  */
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
+import type { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
 import type { OAuthResourceServer } from "../auth/OAuthResourceServer.js";
 import type { TokenValidator } from "../auth/TokenValidator.js";
 /**
@@ -51,22 +57,33 @@ export interface HttpTransportConfig {
      * HSTS max-age in seconds (default: 31536000 = 1 year)
      */
     hstsMaxAge?: number;
+    /**
+     * Trust proxy headers for client IP extraction (default: false)
+     * When enabled, uses the leftmost IP from X-Forwarded-For for rate limiting.
+     * Only enable when running behind a trusted reverse proxy.
+     */
+    trustProxy?: boolean;
 }
 /**
  * HTTP Transport for MCP
+ *
+ * Supports two transport protocols simultaneously:
+ * 1. Streamable HTTP (2025-11-25) via `/mcp` — preferred for modern clients
+ * 2. Legacy SSE (2024-11-05) via `/sse` + `/messages` — backward compatibility
  */
 export declare class HttpTransport {
     private server;
     private readonly config;
-    private transport;
     private readonly onConnect?;
+    /** Active transports by session ID (supports both transport types) */
+    private readonly transports;
     private readonly rateLimitMap;
     private rateLimitCleanupInterval;
     private static readonly DEFAULT_RATE_LIMIT_WINDOW_MS;
     private static readonly DEFAULT_RATE_LIMIT_MAX_REQUESTS;
     private static readonly DEFAULT_MAX_BODY_SIZE;
     private static readonly DEFAULT_HSTS_MAX_AGE;
-    constructor(config: HttpTransportConfig, onConnect?: (transport: StreamableHTTPServerTransport) => void);
+    constructor(config: HttpTransportConfig, onConnect?: (transport: Transport) => void | Promise<void>);
     /**
      * Start the HTTP server
      */
@@ -84,18 +101,42 @@ export declare class HttpTransport {
      * @returns true if request should be allowed, false if rate limited
      */
     private checkRateLimit;
+    /**
+     * Extract the client IP address from the request.
+     * When trustProxy is enabled, uses the leftmost IP from X-Forwarded-For.
+     * Falls back to req.socket.remoteAddress.
+     */
+    private getClientIp;
+    /**
+     * Read and parse JSON body from an incoming request.
+     * Returns undefined for GET/DELETE/OPTIONS (no body expected).
+     * Enforces maxBodySize limit while streaming to prevent memory exhaustion.
+     */
+    private readBody;
     /**
      * Handle incoming HTTP request
      */
     private handleRequest;
     /**
-     * Handle SSE connection request
+     * Handle Streamable HTTP requests on `/mcp`.
+     *
+     * Supports GET (SSE stream), POST (initialize + messages), DELETE (terminate).
+     * Session management is handled via the `Mcp-Session-Id` header.
      */
-    private handleSSERequest;
+    private handleStreamableRequest;
     /**
-     * Handle MCP message request
+     * Handle legacy SSE connection request (GET /sse).
+     *
+     * Creates an SSEServerTransport that establishes an event stream and
+     * directs the client to POST messages to `/messages?sessionId=<id>`.
      */
-    private handleMessageRequest;
+    private handleLegacySSERequest;
+    /**
+     * Handle legacy message request (POST /messages?sessionId=<id>).
+     *
+     * Routes the message to the correct SSEServerTransport instance.
+     */
+    private handleLegacyMessageRequest;
     /**
      * Handle protected resource metadata endpoint
      */
@@ -104,6 +145,10 @@ export declare class HttpTransport {
      * Handle health check endpoint
      */
     private handleHealthCheck;
+    /**
+     * Handle root info endpoint — helpful for browser visitors and debugging
+     */
+    private handleRootInfo;
     /**
      * Set security headers for all responses
      */
@@ -116,12 +161,12 @@ export declare class HttpTransport {
      */
     private setCorsHeaders;
     /**
-     * Get the underlying transport
+     * Get all active transports (for testing/introspection)
      */
-    getTransport(): StreamableHTTPServerTransport | null;
+    getTransports(): Map<string, StreamableHTTPServerTransport | SSEServerTransport>;
 }
 /**
  * Create an HTTP transport instance
  */
-export declare function createHttpTransport(config: HttpTransportConfig, onConnect?: (transport: StreamableHTTPServerTransport) => void): HttpTransport;
+export declare function createHttpTransport(config: HttpTransportConfig, onConnect?: (transport: Transport) => void): HttpTransport;
 //# sourceMappingURL=http.d.ts.map

package/dist/transports/http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/transports/http.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAShE;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,wBAAwB;IACxB,IAAI,EAAE,MAAM,CAAC;IAEb,2CAA2C;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,uCAAuC;IACvC,cAAc,CAAC,EAAE,mBAAmB,CAAC;IAErC,yEAAyE;IACzE,cAAc,CAAC,EAAE,cAAc,CAAC;IAEhC,2CAA2C;IAC3C,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IAEvB,0DAA0D;IAC1D,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAE/B,uCAAuC;IACvC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IAMvB;;;OAGG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAE1B;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B;;OAEG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAUD;;GAEG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,MAAM,CAAgD;IAC9D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsB;IAC7C,OAAO,CAAC,SAAS,CAA8C;IAC/D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAEjB;IAGV,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqC;IAClE,OAAO,CAAC,wBAAwB,CAA+B;IAG/D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,4BAA4B,CAAS;IAC7D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,+BAA+B,CAAO;IAC9D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAW;IACxD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAY;gBAGtD,MAAM,EAAE,mBAAmB,EAC3B,SAAS,CAAC,EAAE,CAAC,SAAS,EAAE,6BAA6B,KAAK,IAAI;IAqBhE;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAmC5B;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAkB3B;;OAEG;IACH,OAAO,CAAC,YAAY;IAgBpB;;;OAGG;IACH,OAAO,CAAC,cAAc;IAgCtB;;OAEG;YACW,aAAa;IAmI3B;;OAEG;YACW,gBAAgB;IAkB9B;;OAEG;YACW,oBAAoB;IAalC;;OAEG;IACH,OAAO,CAAC,+BAA+B;IAYvC;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAUzB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IA6B1B;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IA2BtB;;OAEG;IACH,YAAY,IAAI,6BAA6B,GAAG,IAAI;CAGrD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,mBAAmB,EAC3B,SAAS,CAAC,EAAE,CAAC,SAAS,EAAE,6BAA6B,KAAK,IAAI,GAC7D,aAAa,CAEf"}
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/transports/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAQH,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAE7E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+CAA+C,CAAC;AAC/E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAShE;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,wBAAwB;IACxB,IAAI,EAAE,MAAM,CAAC;IAEb,2CAA2C;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,uCAAuC;IACvC,cAAc,CAAC,EAAE,mBAAmB,CAAC;IAErC,yEAAyE;IACzE,cAAc,CAAC,EAAE,cAAc,CAAC;IAEhC,2CAA2C;IAC3C,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IAEvB,0DAA0D;IAC1D,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAE/B,uCAAuC;IACvC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IAMvB;;;OAGG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAE1B;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B;;OAEG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAUD;;;;;;GAMG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,MAAM,CAAgD;IAC9D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsB;IAC7C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAiD;IAE5E,sEAAsE;IACtE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAGvB;IAGJ,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqC;IAClE,OAAO,CAAC,wBAAwB,CAA+B;IAG/D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,4BAA4B,CAAS;IAC7D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,+BAA+B,CAAO;IAC9D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAW;IACxD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAY;gBAGtD,MAAM,EAAE,mBAAmB,EAC3B,SAAS,CAAC,EAAE,CAAC,SAAS,EAAE,SAAS,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAsB5D;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAmC5B;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IA4B3B;;OAEG;IACH,OAAO,CAAC,YAAY;IAgBpB;;;OAGG;IACH,OAAO,CAAC,cAAc;IAgCtB;;;;OAIG;IACH,OAAO,CAAC,WAAW;IAWnB;;;;OAIG;YACW,QAAQ;IAyDtB;;OAEG;YACW,aAAa;IA+H3B;;;;;OAKG;YACW,uBAAuB;IA+HrC;;;;;OAKG;IACH,OAAO,CAAC,sBAAsB;IAuB9B;;;;OAIG;YACW,0BAA0B;IAuCxC;;OAEG;IACH,OAAO,CAAC,+BAA+B;IAYvC;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAWzB;;OAEG;IACH,OAAO,CAAC,cAAc;IAuBtB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IA+B1B;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IA+BtB;;OAEG;IACH,aAAa,IAAI,GAAG,CAClB,MAAM,EACN,6BAA6B,GAAG,kBAAkB,CACnD;CAGF;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,mBAAmB,EAC3B,SAAS,CAAC,EAAE,CAAC,SAAS,EAAE,SAAS,KAAK,IAAI,GACzC,aAAa,CAEf"}

package/dist/transports/http.js

@@ -1,21 +1,33 @@
 /**
  * postgres-mcp - HTTP Transport
  *
- * HTTP/SSE transport with OAuth 2.0 support.
+ * Dual-protocol HTTP transport with backward compatibility:
+ * - `/mcp` — Streamable HTTP transport (MCP protocol 2025-11-25)
+ * - `/sse` + `/messages` — Legacy SSE transport (MCP protocol 2024-11-05)
+ *
+ * Includes OAuth 2.0 support, rate limiting, CORS, and security headers.
  */
+import { randomUUID } from "node:crypto";
 import { createServer, } from "node:http";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
+import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
 import { validateAuth, formatOAuthError, } from "../auth/middleware.js";
 import { runWithAuthContext } from "../auth/auth-context.js";
 import { logger } from "../utils/logger.js";
 /**
  * HTTP Transport for MCP
+ *
+ * Supports two transport protocols simultaneously:
+ * 1. Streamable HTTP (2025-11-25) via `/mcp` — preferred for modern clients
+ * 2. Legacy SSE (2024-11-05) via `/sse` + `/messages` — backward compatibility
  */
 export class HttpTransport {
     server = null;
     config;
-    transport = null;
     onConnect;
+    /** Active transports by session ID (supports both transport types) */
+    transports = new Map();
     // Rate limiting state
     rateLimitMap = new Map();
     rateLimitCleanupInterval = null;
@@ -36,6 +48,7 @@ export class HttpTransport {
             maxBodySize: config.maxBodySize ?? HttpTransport.DEFAULT_MAX_BODY_SIZE,
             enableHSTS: config.enableHSTS ?? false,
             hstsMaxAge: config.hstsMaxAge ?? HttpTransport.DEFAULT_HSTS_MAX_AGE,
+            trustProxy: config.trustProxy ?? false,
         };
         if (onConnect) {
             this.onConnect = onConnect;
@@ -81,6 +94,16 @@ export class HttpTransport {
             clearInterval(this.rateLimitCleanupInterval);
             this.rateLimitCleanupInterval = null;
         }
+        // Close all active transports
+        for (const [sessionId, transport] of this.transports) {
+            try {
+                await transport.close();
+            }
+            catch {
+                logger.warn("Error closing transport during shutdown", { sessionId });
+            }
+        }
+        this.transports.clear();
         return new Promise((resolve) => {
             if (this.server) {
                 this.server.close(() => {
@@ -120,7 +143,7 @@ export class HttpTransport {
         if (!this.config.enableRateLimit) {
             return true;
         }
-        const clientIp = req.socket.remoteAddress ?? "unknown";
+        const clientIp = this.getClientIp(req);
         const now = Date.now();
         const windowMs = this.config.rateLimitWindowMs ??
             HttpTransport.DEFAULT_RATE_LIMIT_WINDOW_MS;
@@ -139,6 +162,75 @@ export class HttpTransport {
         entry.count++;
         return true;
     }
+    /**
+     * Extract the client IP address from the request.
+     * When trustProxy is enabled, uses the leftmost IP from X-Forwarded-For.
+     * Falls back to req.socket.remoteAddress.
+     */
+    getClientIp(req) {
+        if (this.config.trustProxy) {
+            const forwarded = req.headers["x-forwarded-for"];
+            if (typeof forwarded === "string") {
+                const firstIp = forwarded.split(",")[0]?.trim();
+                if (firstIp)
+                    return firstIp;
+            }
+        }
+        return req.socket.remoteAddress ?? "unknown";
+    }
+    /**
+     * Read and parse JSON body from an incoming request.
+     * Returns undefined for GET/DELETE/OPTIONS (no body expected).
+     * Enforces maxBodySize limit while streaming to prevent memory exhaustion.
+     */
+    async readBody(req, res) {
+        if (req.method === "GET" ||
+            req.method === "DELETE" ||
+            req.method === "OPTIONS") {
+            return undefined;
+        }
+        const maxBodySize = this.config.maxBodySize ?? HttpTransport.DEFAULT_MAX_BODY_SIZE;
+        return new Promise((resolve, reject) => {
+            const chunks = [];
+            let receivedBytes = 0;
+            let limitExceeded = false;
+            req.on("data", (chunk) => {
+                if (limitExceeded)
+                    return;
+                receivedBytes += chunk.length;
+                if (receivedBytes > maxBodySize) {
+                    limitExceeded = true;
+                    req.destroy();
+                    if (!res.headersSent) {
+                        res.writeHead(413, { "Content-Type": "application/json" });
+                        res.end(JSON.stringify({
+                            error: "payload_too_large",
+                            error_description: `Request body exceeds maximum size of ${String(maxBodySize)} bytes.`,
+                        }));
+                    }
+                    reject(new Error("Payload too large"));
+                    return;
+                }
+                chunks.push(chunk);
+            });
+            req.on("end", () => {
+                if (limitExceeded)
+                    return;
+                const raw = Buffer.concat(chunks).toString("utf-8");
+                if (!raw) {
+                    resolve(undefined);
+                    return;
+                }
+                try {
+                    resolve(JSON.parse(raw));
+                }
+                catch {
+                    reject(new Error("Invalid JSON in request body"));
+                }
+            });
+            req.on("error", reject);
+        });
+    }
     /**
      * Handle incoming HTTP request
      */
@@ -162,10 +254,9 @@ export class HttpTransport {
             }));
             return;
         }
-        // Check body size — two-layer enforcement:
-        // 1. Content-Length header for fast rejection of well-behaved clients
-        // 2. Streaming byte tracking for missing/spoofed headers and chunked encoding
-        const maxBodySize = this.config.maxBodySize ?? 1048576;
+        // Check body size — fast rejection via Content-Length header.
+        // Streaming byte tracking for spoofed/missing headers is handled inside readBody().
+        const maxBodySize = this.config.maxBodySize ?? HttpTransport.DEFAULT_MAX_BODY_SIZE;
         const contentLength = parseInt(req.headers["content-length"] ?? "0", 10);
         if (contentLength > maxBodySize) {
             res.writeHead(413, { "Content-Type": "application/json" });
@@ -175,28 +266,6 @@ export class HttpTransport {
             }));
             return;
         }
-        // Streaming body size enforcement — track actual received bytes
-        // Guard: only attach if req supports event listeners (real IncomingMessage)
-        let receivedBytes = 0;
-        let bodyLimitExceeded = false;
-        if (typeof req.on === "function") {
-            req.on("data", (chunk) => {
-                receivedBytes += chunk.length;
-                if (receivedBytes > maxBodySize && !bodyLimitExceeded) {
-                    bodyLimitExceeded = true;
-                    req.destroy();
-                    if (!res.headersSent) {
-                        res.writeHead(413, { "Content-Type": "application/json" });
-                        res.end(JSON.stringify({
-                            error: "payload_too_large",
-                            error_description: `Request body exceeds maximum size of ${String(maxBodySize)} bytes.`,
-                        }));
-                    }
-                }
-            });
-        }
-        if (bodyLimitExceeded)
-            return;
         const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
         // Handle well-known endpoints
         if (url.pathname === "/.well-known/oauth-protected-resource") {
@@ -208,6 +277,11 @@ export class HttpTransport {
             this.handleHealthCheck(res);
             return;
         }
+        // Root info endpoint
+        if (url.pathname === "/" && req.method === "GET") {
+            this.handleRootInfo(res);
+            return;
+        }
         // Authenticate if OAuth is configured and path is not public
         let authCtx;
         if (this.config.resourceServer && this.config.tokenValidator) {
@@ -231,12 +305,22 @@ export class HttpTransport {
         }
         // Dispatch MCP requests — wrap in auth context if OAuth is active
         const dispatch = async () => {
+            // =====================================================================
+            // Streamable HTTP Transport (Protocol 2025-11-25) — canonical endpoint
+            // =====================================================================
+            if (url.pathname === "/mcp") {
+                await this.handleStreamableRequest(req, res);
+                return;
+            }
+            // =====================================================================
+            // Legacy SSE Transport (Protocol 2024-11-05) — backward compatibility
+            // =====================================================================
             if (url.pathname === "/sse") {
-                await this.handleSSERequest(req, res);
+                this.handleLegacySSERequest(req, res);
                 return;
             }
             if (url.pathname === "/messages") {
-                await this.handleMessageRequest(req, res);
+                await this.handleLegacyMessageRequest(req, res, url);
                 return;
             }
             res.writeHead(404);
@@ -249,32 +333,171 @@ export class HttpTransport {
             await dispatch();
         }
     }
+    // ===========================================================================
+    // Streamable HTTP Transport (Protocol 2025-11-25)
+    // ===========================================================================
+    /**
+     * Handle Streamable HTTP requests on `/mcp`.
+     *
+     * Supports GET (SSE stream), POST (initialize + messages), DELETE (terminate).
+     * Session management is handled via the `Mcp-Session-Id` header.
+     */
+    async handleStreamableRequest(req, res) {
+        const sessionId = req.headers["mcp-session-id"];
+        // For non-POST requests (GET for SSE stream, DELETE for session termination),
+        // delegate directly to the transport if we have a valid session
+        if (req.method !== "POST") {
+            if (sessionId && this.transports.has(sessionId)) {
+                const existing = this.transports.get(sessionId);
+                if (existing instanceof StreamableHTTPServerTransport) {
+                    await existing.handleRequest(req, res);
+                    return;
+                }
+            }
+            res.writeHead(400, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({
+                jsonrpc: "2.0",
+                error: {
+                    code: -32000,
+                    message: "Bad Request: No valid session ID provided",
+                },
+                id: null,
+            }));
+            return;
+        }
+        // POST requests — pre-parse the body so the SDK receives parsed JSON
+        let body;
+        try {
+            body = await this.readBody(req, res);
+        }
+        catch (readError) {
+            // readBody rejects with "Payload too large" after sending 413 to client
+            if (readError instanceof Error &&
+                readError.message === "Payload too large") {
+                return;
+            }
+            res.writeHead(400, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({
+                jsonrpc: "2.0",
+                error: { code: -32700, message: "Parse error: Invalid JSON" },
+                id: null,
+            }));
+            return;
+        }
+        // Existing session — route to the correct transport
+        if (sessionId && this.transports.has(sessionId)) {
+            const existing = this.transports.get(sessionId);
+            if (existing instanceof StreamableHTTPServerTransport) {
+                await existing.handleRequest(req, res, body);
+                return;
+            }
+            // Session exists but uses legacy SSE transport
+            res.writeHead(400, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({
+                jsonrpc: "2.0",
+                error: {
+                    code: -32000,
+                    message: "Bad Request: Session exists but uses a different transport protocol",
+                },
+                id: null,
+            }));
+            return;
+        }
+        // No session ID — must be an initialization request
+        if (!sessionId && isInitializeRequest(body)) {
+            const newTransport = new StreamableHTTPServerTransport({
+                sessionIdGenerator: () => randomUUID(),
+                onsessioninitialized: (newSessionId) => {
+                    logger.debug("Streamable HTTP session initialized", {
+                        sessionId: newSessionId,
+                    });
+                    this.transports.set(newSessionId, newTransport);
+                },
+            });
+            // Clean up on close
+            newTransport.onclose = () => {
+                const sid = newTransport.sessionId;
+                if (sid && this.transports.has(sid)) {
+                    logger.debug("Streamable HTTP transport closed", {
+                        sessionId: sid,
+                    });
+                    this.transports.delete(sid);
+                }
+            };
+            // Connect MCP server to this transport (must complete before handling request)
+            if (this.onConnect) {
+                await this.onConnect(newTransport);
+            }
+            // Handle request with pre-parsed body
+            await newTransport.handleRequest(req, res, body);
+            return;
+        }
+        // POST without session ID and not an initialization request
+        res.writeHead(400, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({
+            jsonrpc: "2.0",
+            error: {
+                code: -32000,
+                message: "Bad Request: No valid session ID provided",
+            },
+            id: null,
+        }));
+    }
+    // ===========================================================================
+    // Legacy SSE Transport (Protocol 2024-11-05)
+    // ===========================================================================
     /**
-     * Handle SSE connection request
+     * Handle legacy SSE connection request (GET /sse).
+     *
+     * Creates an SSEServerTransport that establishes an event stream and
+     * directs the client to POST messages to `/messages?sessionId=<id>`.
      */
-    async handleSSERequest(req, res) {
-        // Create new transport for this connection
-        // Note: Do NOT call transport.start() here - the MCP SDK's Server.connect()
-        // calls start() internally, and calling it twice throws "Transport already started"
-        const transport = new StreamableHTTPServerTransport();
-        this.transport = transport;
+    handleLegacySSERequest(_req, res) {
+        logger.debug("Legacy SSE connection established");
+        const transport = new SSEServerTransport("/messages", res);
+        this.transports.set(transport.sessionId, transport);
+        // Clean up on disconnect
+        res.on("close", () => {
+            logger.debug("Legacy SSE transport closed", {
+                sessionId: transport.sessionId,
+            });
+            this.transports.delete(transport.sessionId);
+        });
+        // Connect MCP server to this transport
         if (this.onConnect) {
-            this.onConnect(transport);
+            void this.onConnect(transport);
         }
-        // Handle the request (keeps connection open for SSE)
-        await transport.handleRequest(req, res);
     }
     /**
-     * Handle MCP message request
+     * Handle legacy message request (POST /messages?sessionId=<id>).
+     *
+     * Routes the message to the correct SSEServerTransport instance.
      */
-    async handleMessageRequest(req, res) {
-        if (!this.transport) {
-            res.writeHead(400);
-            res.end(JSON.stringify({ error: "No active connection" }));
+    async handleLegacyMessageRequest(req, res, url) {
+        const sessionId = url.searchParams.get("sessionId");
+        if (!sessionId) {
+            res.writeHead(400, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "Missing sessionId parameter" }));
+            return;
+        }
+        const transport = this.transports.get(sessionId);
+        if (!transport) {
+            res.writeHead(404, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "No transport found for sessionId" }));
+            return;
+        }
+        if (!(transport instanceof SSEServerTransport)) {
+            res.writeHead(400, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({
+                error: "Session exists but uses a different transport protocol. Use /mcp instead.",
+            }));
             return;
         }
-        await this.transport.handleRequest(req, res);
+        await transport.handlePostMessage(req, res);
     }
+    // ===========================================================================
+    // Utility Endpoints
+    // ===========================================================================
     /**
      * Handle protected resource metadata endpoint
      */
@@ -296,8 +519,31 @@ export class HttpTransport {
         res.end(JSON.stringify({
             status: "healthy",
             timestamp: new Date().toISOString(),
+            oauthEnabled: !!this.config.resourceServer,
+        }));
+    }
+    /**
+     * Handle root info endpoint — helpful for browser visitors and debugging
+     */
+    handleRootInfo(res) {
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({
+            name: "postgres-mcp",
+            description: "PostgreSQL MCP Server with dual HTTP transport",
+            endpoints: {
+                "POST /mcp": "JSON-RPC requests (Streamable HTTP, MCP 2025-11-25)",
+                "GET /mcp": "SSE stream for server-to-client notifications",
+                "DELETE /mcp": "Session termination",
+                "GET /sse": "Legacy SSE connection (MCP 2024-11-05)",
+                "POST /messages": "Legacy SSE message endpoint",
+                "GET /health": "Health check",
+            },
+            documentation: "https://github.com/neverinfamous/postgres-mcp",
         }));
     }
+    // ===========================================================================
+    // Security Headers
+    // ===========================================================================
     /**
      * Set security headers for all responses
      */
@@ -312,6 +558,8 @@ export class HttpTransport {
         res.setHeader("Content-Security-Policy", "default-src 'none'; frame-ancestors 'none'");
         // Restrict browser features not needed by an API server
         res.setHeader("Permissions-Policy", "camera=(), microphone=(), geolocation=()");
+        // Prevent referrer leakage — API server does not need referrers
+        res.setHeader("Referrer-Policy", "no-referrer");
         // HTTP Strict Transport Security (for HTTPS deployments)
         if (this.config.enableHSTS) {
             const maxAge = this.config.hstsMaxAge ?? HttpTransport.DEFAULT_HSTS_MAX_AGE;
@@ -341,11 +589,14 @@ export class HttpTransport {
             }
         }
     }
+    // ===========================================================================
+    // Accessors
+    // ===========================================================================
     /**
-     * Get the underlying transport
+     * Get all active transports (for testing/introspection)
      */
-    getTransport() {
-        return this.transport;
+    getTransports() {
+        return this.transports;
     }
 }
 /**