@onemrvapublic/design-system-mcp-server 2.0.1-rc.1

package/dist/index.js

@@ -0,0 +1,999 @@
+#!/usr/bin/env node
+import { randomUUID, timingSafeEqual } from 'crypto';
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { SSEServerTransport } from '@modelcontextprotocol/sdk/server/sse.js';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { CallToolRequestSchema, ListToolsRequestSchema, isInitializeRequest, } from '@modelcontextprotocol/sdk/types.js';
+import { ComponentScanner } from './component-scanner.js';
+import { handleToolCall } from './tools.js';
+import { getTools } from './tool-registry.js';
+import { recordToolCall, recordQuestion, getMetricsSnapshot, renderPrometheusMetrics, serializeMetrics, loadMetrics, } from './metrics.js';
+import path from 'path';
+import { fileURLToPath } from 'url';
+import fs from 'fs';
+import express from 'express';
+const PACKAGE_NAME = '@onemrvapublic/design-system-mcp-server';
+const PACKAGE_VERSION = '2.0.0';
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+const MCP_DATA_DIR = path.resolve(__dirname, '../mcp-data');
+const MCP_DATA_FILES = [
+    'codebase.json',
+    'components.json',
+    'tokens.json',
+    'styles.json',
+    'icons.json',
+    'sync-status.json',
+];
+// Parse a numeric env var, falling back to `fallback` (with a stderr warning)
+// when it is unset/blank or does not resolve to a finite number.
+function readNumericEnv(name, fallback) {
+    const raw = process.env[name];
+    if (raw === undefined || raw.trim() === '') {
+        return fallback;
+    }
+    const parsed = Number(raw);
+    if (!Number.isFinite(parsed)) {
+        logInfo(`[MCP] Warning: invalid ${name}="${raw}", falling back to ${fallback}.`);
+        return fallback;
+    }
+    return parsed;
+}
+const PORT = Math.trunc(readNumericEnv('PORT', 3001));
+const DS_PATH = process.env.DESIGN_SYSTEM_PATH || '';
+const API_KEY = (process.env.MCP_API_KEY || '').trim();
+// Separate key for admin endpoints (/metrics, /health, /rescan). Falls back to
+// MCP_API_KEY when unset.
+const ADMIN_KEY = (process.env.MCP_ADMIN_KEY || '').trim();
+const METRICS_FILE = (process.env.MCP_METRICS_FILE || '').trim();
+const METRICS_FLUSH_MS = Math.max(1000, readNumericEnv('MCP_METRICS_FLUSH_MS', 60000));
+const ALLOW_UNAUTHENTICATED_HTTP = (process.env.MCP_ALLOW_UNAUTHENTICATED_HTTP || 'false').toLowerCase() ===
+    'true';
+const MAX_HTTP_SESSIONS = Math.max(1, readNumericEnv('MCP_MAX_HTTP_SESSIONS', 100));
+const RATE_LIMIT_WINDOW_MS = Math.max(1000, readNumericEnv('MCP_RATE_LIMIT_WINDOW_MS', 60000));
+const RATE_LIMIT_MAX_REQUESTS = Math.max(1, readNumericEnv('MCP_RATE_LIMIT_MAX_REQUESTS', 300));
+const CLI_TRANSPORT_ARG = getCliOption('transport');
+const CLI_DATA_SOURCE_ARG = getCliOption('data-source');
+const CLI_WATCH_ENABLED = getCliFlag('watch');
+const TRANSPORT_MODE = parseTransportMode(CLI_TRANSPORT_ARG || process.env.MCP_TRANSPORT || 'stdio');
+// `let`: demoted to mcp-data below if `live` is set but the DS source is absent.
+let DATA_SOURCE_MODE = parseDataSourceMode(CLI_DATA_SOURCE_ARG || process.env.MCP_DATA_SOURCE || 'auto');
+const AUTO_RESCAN_ENABLED = CLI_WATCH_ENABLED ||
+    (process.env.MCP_AUTO_RESCAN || 'false').toLowerCase() === 'true';
+const ENABLE_LEGACY_SSE = (process.env.MCP_ENABLE_LEGACY_SSE || 'false').toLowerCase() === 'true';
+process.env.MCP_DATA_SOURCE = DATA_SOURCE_MODE;
+function logInfo(message) {
+    process.stderr.write(`${message}\n`);
+}
+function parseTransportMode(rawMode) {
+    const value = rawMode.trim().toLowerCase();
+    if (value === 'stdio' || value === 'http' || value === 'both') {
+        return value;
+    }
+    if (value === 'sse' || value === 'streamable' || value === 'server') {
+        return 'http';
+    }
+    logInfo(`[MCP] Unknown transport mode "${rawMode}", falling back to "stdio".`);
+    return 'stdio';
+}
+function parseDataSourceMode(rawMode) {
+    const value = rawMode.trim().toLowerCase();
+    if (value === 'auto' || value === 'mcp-data' || value === 'live') {
+        return value;
+    }
+    logInfo(`[MCP] Unknown data source mode "${rawMode}", falling back to "auto".`);
+    return 'auto';
+}
+function getCliOption(name) {
+    const direct = `--${name}`;
+    const withValue = `${direct}=`;
+    for (let i = 0; i < process.argv.length; i++) {
+        const arg = process.argv[i];
+        if (arg === direct && process.argv[i + 1]) {
+            return process.argv[i + 1];
+        }
+        if (arg.startsWith(withValue)) {
+            return arg.slice(withValue.length);
+        }
+    }
+    return undefined;
+}
+function getCliFlag(name) {
+    const direct = `--${name}`;
+    const withValue = `${direct}=`;
+    for (const arg of process.argv) {
+        if (arg === direct) {
+            return true;
+        }
+        if (arg.startsWith(withValue)) {
+            const value = arg.slice(withValue.length).trim().toLowerCase();
+            return value !== 'false' && value !== '0' && value !== 'no';
+        }
+    }
+    return false;
+}
+function findDesignSystemPath() {
+    if (DS_PATH && fs.existsSync(DS_PATH)) {
+        return DS_PATH;
+    }
+    const possiblePaths = [
+        path.resolve(__dirname, '../../../@onemrvapublic/design-system'),
+        path.resolve(process.cwd(), 'node_modules/@onemrvapublic/design-system'),
+        path.resolve(__dirname, '../../../projects/onemrva/design-system'),
+        path.resolve(__dirname, '../../../../design-system'),
+        '/app/design-system',
+    ];
+    for (const testPath of possiblePaths) {
+        if (fs.existsSync(testPath)) {
+            return testPath;
+        }
+    }
+    return path.resolve(__dirname, '../../../projects/onemrva/design-system');
+}
+const DESIGN_SYSTEM_PATH = findDesignSystemPath();
+const sseSessions = new Map();
+const streamableSessions = new Map();
+let stdioSession = null;
+let httpServer;
+let shutdownInProgress = false;
+const liveWatchers = [];
+let watchedPaths = [];
+let rescanDebounceTimer = null;
+let liveRescanInProgress = false;
+let liveRescanQueued = false;
+let rateTrackerSweepTimer = null;
+let sessionSweepTimer = null;
+let metricsFlushTimer = null;
+const connectionStats = {
+    accepted: 0,
+    closed: 0,
+    badMessageRequests: 0,
+    messageErrors: 0,
+    rateLimitedRequests: 0,
+};
+const requestRateTracker = new Map();
+const DESIGN_SYSTEM_PATH_EXISTS = fs.existsSync(DESIGN_SYSTEM_PATH);
+const AVAILABLE_MCP_DATA_FILES = MCP_DATA_FILES.filter(fileName => fs.existsSync(path.join(MCP_DATA_DIR, fileName)));
+const HAS_MCP_DATA = AVAILABLE_MCP_DATA_FILES.length > 0;
+const HAS_MCP_CODEBASE = fs.existsSync(path.join(MCP_DATA_DIR, 'codebase.json'));
+// Demote `live` to `mcp-data` when the DS source is absent but a snapshot is
+// bundled — keeps the server usable detached from the DS repo, no FATAL exit.
+if (DATA_SOURCE_MODE === 'live' &&
+    !DESIGN_SYSTEM_PATH_EXISTS &&
+    HAS_MCP_CODEBASE) {
+    logInfo(`[MCP] "live" requested but DESIGN_SYSTEM_PATH is absent (${DESIGN_SYSTEM_PATH}). ` +
+        'Demoting to "mcp-data" — DS knowledge stays available from the synced snapshot; live rescan is disabled.');
+    DATA_SOURCE_MODE = 'mcp-data';
+    process.env.MCP_DATA_SOURCE = 'mcp-data';
+}
+const SHOULD_USE_MCP_DATA = DATA_SOURCE_MODE === 'mcp-data' ||
+    (DATA_SOURCE_MODE === 'auto' && HAS_MCP_CODEBASE);
+const LIVE_SCAN_ENABLED = DATA_SOURCE_MODE === 'live' ||
+    (DATA_SOURCE_MODE === 'auto' && !HAS_MCP_CODEBASE);
+async function closeServerSession(session) {
+    await Promise.allSettled([session.transport.close(), session.server.close()]);
+}
+function collectSessionCloseOps(sessions, closeOps) {
+    for (const [sessionId, session] of sessions) {
+        sessions.delete(sessionId);
+        closeOps.push(session.transport.close());
+        closeOps.push(session.server.close());
+    }
+}
+function readJsonIfExists(filePath) {
+    if (!fs.existsSync(filePath)) {
+        return null;
+    }
+    try {
+        return JSON.parse(fs.readFileSync(filePath, 'utf-8'));
+    }
+    catch (error) {
+        logInfo(`[MCP] Warning: could not parse ${path.basename(filePath)}: ${error instanceof Error ? error.message : String(error)}`);
+        return null;
+    }
+}
+// Persist usage KPIs to MCP_METRICS_FILE so they survive restarts.
+function writeMetricsFile() {
+    if (!METRICS_FILE) {
+        return;
+    }
+    try {
+        fs.mkdirSync(path.dirname(METRICS_FILE), { recursive: true });
+        const tmp = `${METRICS_FILE}.${process.pid}.tmp`;
+        fs.writeFileSync(tmp, JSON.stringify(serializeMetrics()), 'utf-8');
+        fs.renameSync(tmp, METRICS_FILE);
+    }
+    catch (error) {
+        console.error('[MCP] Failed to persist metrics:', error);
+    }
+}
+function startMetricsPersistence() {
+    if (!METRICS_FILE) {
+        return;
+    }
+    const data = readJsonIfExists(METRICS_FILE);
+    if (data && loadMetrics(data)) {
+        logInfo(`[MCP] Restored usage metrics from ${METRICS_FILE}`);
+    }
+    metricsFlushTimer = setInterval(writeMetricsFile, METRICS_FLUSH_MS);
+    metricsFlushTimer.unref();
+}
+function getRuntimeSummary() {
+    const syncedCodebase = readJsonIfExists(path.join(MCP_DATA_DIR, 'codebase.json'));
+    const syncStatus = readJsonIfExists(path.join(MCP_DATA_DIR, 'sync-status.json'));
+    const summarizeSyncedCodebase = (codebase) => ({
+        components: Array.isArray(codebase.components)
+            ? codebase.components.length
+            : 0,
+        jsonForms: Array.isArray(codebase.jsonforms)
+            ? codebase.jsonforms.length
+            : 0,
+        themeUtilities: Array.isArray(codebase.theme) ? codebase.theme.length : 0,
+        source: 'mcp-data/codebase.json',
+        mcpDataFiles: AVAILABLE_MCP_DATA_FILES,
+        lastFigmaSync: syncStatus?.lastFigmaSync ?? null,
+        figmaStats: syncStatus?.stats ?? null,
+    });
+    if (SHOULD_USE_MCP_DATA && syncedCodebase) {
+        return summarizeSyncedCodebase(syncedCodebase);
+    }
+    if (LIVE_SCAN_ENABLED && DESIGN_SYSTEM_PATH_EXISTS) {
+        const summary = scanner.getSummary();
+        return {
+            components: summary.components,
+            jsonForms: summary.jsonForms,
+            themeUtilities: summary.themeUtilities,
+            source: 'live-scan',
+            mcpDataFiles: AVAILABLE_MCP_DATA_FILES,
+            lastFigmaSync: syncStatus?.lastFigmaSync ?? null,
+            figmaStats: syncStatus?.stats ?? null,
+        };
+    }
+    if (syncedCodebase) {
+        return summarizeSyncedCodebase(syncedCodebase);
+    }
+    return {
+        components: 0,
+        jsonForms: 0,
+        themeUtilities: 0,
+        source: 'none',
+        mcpDataFiles: AVAILABLE_MCP_DATA_FILES,
+        lastFigmaSync: syncStatus?.lastFigmaSync ?? null,
+        figmaStats: syncStatus?.stats ?? null,
+    };
+}
+function createMcpServer() {
+    const server = new Server({
+        name: PACKAGE_NAME,
+        version: PACKAGE_VERSION,
+    }, {
+        capabilities: {
+            tools: {},
+        },
+    });
+    server.setRequestHandler(ListToolsRequestSchema, async () => ({
+        tools: getTools(),
+    }));
+    server.setRequestHandler(CallToolRequestSchema, async (request) => {
+        const startedAt = Date.now();
+        // IDE/agent from the initialize handshake.
+        const client = server.getClientVersion()?.name ?? 'unknown';
+        try {
+            const result = await handleToolCall(request, scanner);
+            const ok = !result.isError;
+            recordToolCall(request.params.name, Date.now() - startedAt, ok, client);
+            if (ok) {
+                recordQuestion(request.params.name, request.params.arguments);
+            }
+            return result;
+        }
+        catch (err) {
+            recordToolCall(request.params.name, Date.now() - startedAt, false, client);
+            console.error(`[MCP] Tool "${request.params.name}" failed:`, err);
+            return {
+                content: [
+                    {
+                        type: 'text',
+                        text: `Internal error in tool "${request.params.name}": ${err instanceof Error ? err.message : String(err)}`,
+                    },
+                ],
+                isError: true,
+            };
+        }
+    });
+    server.onerror = error => {
+        console.error('[MCP Error]', error);
+    };
+    return server;
+}
+const scanner = new ComponentScanner(DESIGN_SYSTEM_PATH);
+const HTTP_MODE_ENABLED = TRANSPORT_MODE === 'http' || TRANSPORT_MODE === 'both';
+const STDIO_MODE_ENABLED = TRANSPORT_MODE === 'stdio' || TRANSPORT_MODE === 'both';
+async function rescan() {
+    if (!LIVE_SCAN_ENABLED) {
+        throw new Error('Live rescan is disabled while using synced mcp-data as the active source. Set MCP_DATA_SOURCE=live and restart if you need runtime scanning.');
+    }
+    if (!DESIGN_SYSTEM_PATH_EXISTS) {
+        throw new Error('Live rescan unavailable: DESIGN_SYSTEM_PATH is not mounted. The server is currently running from synced mcp-data only.');
+    }
+    logInfo('[MCP] Rescan triggered...');
+    const result = await scanner.rescan();
+    logInfo(`[MCP] Rescan complete: ${result.components} components, ${result.renderers} renderers, ${result.theme} theme utilities`);
+    return result;
+}
+function getLiveWatchPaths() {
+    const candidates = [
+        DESIGN_SYSTEM_PATH,
+        path.resolve(DESIGN_SYSTEM_PATH, 'theme'),
+        path.resolve(DESIGN_SYSTEM_PATH, '../jsonforms'),
+        path.resolve(DESIGN_SYSTEM_PATH, '../theme'),
+        path.resolve(DESIGN_SYSTEM_PATH, '../demos/src/app/demos'),
+    ];
+    const seen = new Set();
+    const available = [];
+    for (const candidate of candidates) {
+        const resolved = path.resolve(candidate);
+        if (seen.has(resolved)) {
+            continue;
+        }
+        seen.add(resolved);
+        if (fs.existsSync(resolved)) {
+            available.push(resolved);
+        }
+    }
+    return available;
+}
+async function runQueuedLiveRescan(reason) {
+    if (liveRescanInProgress) {
+        liveRescanQueued = true;
+        return;
+    }
+    liveRescanInProgress = true;
+    try {
+        logInfo(`[MCP] Auto rescan triggered (${reason})...`);
+        const result = await scanner.rescan();
+        logInfo(`[MCP] Auto rescan complete: ${result.components} components, ${result.renderers} renderers, ${result.theme} theme utilities`);
+    }
+    catch (error) {
+        console.error('[MCP] Auto rescan failed:', error);
+    }
+    finally {
+        liveRescanInProgress = false;
+        if (liveRescanQueued) {
+            liveRescanQueued = false;
+            queueLiveRescan('queued file changes');
+        }
+    }
+}
+function queueLiveRescan(reason) {
+    if (rescanDebounceTimer) {
+        clearTimeout(rescanDebounceTimer);
+    }
+    rescanDebounceTimer = setTimeout(() => {
+        rescanDebounceTimer = null;
+        void runQueuedLiveRescan(reason);
+    }, 700);
+}
+function startLiveRescanWatchers() {
+    watchedPaths = getLiveWatchPaths();
+    if (watchedPaths.length === 0) {
+        logInfo('[MCP] Auto rescan enabled, but no source paths were found to watch.');
+        return;
+    }
+    for (const watchPath of watchedPaths) {
+        try {
+            const watcher = fs.watch(watchPath, { recursive: true }, (_eventType, fileName) => {
+                const suffix = fileName ? `/${fileName}` : '';
+                queueLiveRescan(`${watchPath}${suffix}`);
+            });
+            watcher.on('error', error => {
+                console.error(`[MCP] Watcher error on ${watchPath}:`, error);
+            });
+            liveWatchers.push(watcher);
+            logInfo(`[MCP] Watching: ${watchPath}`);
+        }
+        catch (error) {
+            console.error(`[MCP] Failed to watch ${watchPath}:`, error);
+        }
+    }
+    if (liveWatchers.length > 0) {
+        logInfo(`[MCP] Live auto rescan enabled (${liveWatchers.length} watcher${liveWatchers.length === 1 ? '' : 's'}).`);
+        return;
+    }
+    logInfo('[MCP] Auto rescan requested but no watchers could be started.');
+}
+// Keys the request presents (x-mcp-api-key and/or Authorization: Bearer).
+function candidateKeys(req) {
+    const keys = [];
+    const headerKey = req.header('x-mcp-api-key');
+    if (headerKey) {
+        keys.push(headerKey);
+    }
+    const authHeader = req.header('authorization');
+    if (authHeader?.startsWith('Bearer ')) {
+        keys.push(authHeader.slice('Bearer '.length).trim());
+    }
+    return keys;
+}
+// Constant-time compare (length check leaks length only).
+function keyEquals(candidate, key) {
+    if (!key) {
+        return false;
+    }
+    const a = Buffer.from(candidate);
+    const b = Buffer.from(key);
+    return a.length === b.length && timingSafeEqual(a, b);
+}
+// Valid if the request presents any of `accepted`. Empty set -> open.
+function accepts(req, accepted) {
+    const keys = accepted.filter(Boolean);
+    if (keys.length === 0) {
+        return true;
+    }
+    return candidateKeys(req).some(c => keys.some(k => keyEquals(c, k)));
+}
+function deny(res) {
+    connectionStats.badMessageRequests += 1;
+    res.status(401).json({ error: 'unauthorized' });
+}
+// /mcp: client key only. Unset MCP_API_KEY -> /mcp open; admin stays protected.
+function requireClientKey(req, res, next) {
+    if (accepts(req, [API_KEY])) {
+        next();
+    }
+    else {
+        deny(res);
+    }
+}
+// Admin endpoints: the admin key only (falls back to the shared key if no
+// separate admin key is set), so a teammate's client key cannot reach them.
+function requireAdminKey(req, res, next) {
+    if (accepts(req, [ADMIN_KEY || API_KEY])) {
+        next();
+    }
+    else {
+        deny(res);
+    }
+}
+function getRequestClientKey(req) {
+    return req.ip || req.socket.remoteAddress || 'unknown';
+}
+function requireRateLimit(req, res, next) {
+    const now = Date.now();
+    const clientKey = getRequestClientKey(req);
+    const existing = requestRateTracker.get(clientKey);
+    if (!existing || now - existing.windowStart >= RATE_LIMIT_WINDOW_MS) {
+        requestRateTracker.set(clientKey, { count: 1, windowStart: now });
+        next();
+        return;
+    }
+    if (existing.count >= RATE_LIMIT_MAX_REQUESTS) {
+        connectionStats.rateLimitedRequests += 1;
+        res.status(429).json({ error: 'rate limit exceeded' });
+        return;
+    }
+    existing.count += 1;
+    next();
+}
+// Drop rate-tracker entries whose window has fully expired so the Map cannot
+// grow unbounded from one-off client IPs.
+function sweepRateTracker() {
+    const now = Date.now();
+    for (const [clientKey, entry] of requestRateTracker) {
+        if (now - entry.windowStart >= RATE_LIMIT_WINDOW_MS) {
+            requestRateTracker.delete(clientKey);
+        }
+    }
+}
+function startRateTrackerSweep() {
+    if (rateTrackerSweepTimer) {
+        return;
+    }
+    const sweepInterval = Math.max(RATE_LIMIT_WINDOW_MS, 30000);
+    rateTrackerSweepTimer = setInterval(sweepRateTracker, sweepInterval);
+    // Never keep the event loop alive just for the sweep.
+    rateTrackerSweepTimer.unref();
+}
+function enforceSessionCapacity(res) {
+    const activeSessions = sseSessions.size + streamableSessions.size;
+    if (activeSessions < MAX_HTTP_SESSIONS) {
+        return true;
+    }
+    connectionStats.badMessageRequests += 1;
+    res.status(503).json({ error: 'maximum MCP session capacity reached' });
+    return false;
+}
+function readSessionIdFromQuery(req) {
+    const value = req.query.sessionId;
+    if (typeof value === 'string') {
+        return value;
+    }
+    if (Array.isArray(value) && typeof value[0] === 'string') {
+        return value[0];
+    }
+    return undefined;
+}
+function readSessionIdFromHeader(req) {
+    const value = req.header('mcp-session-id');
+    return value?.trim() || undefined;
+}
+async function cleanupSseSession(sessionId, reason) {
+    const session = sseSessions.get(sessionId);
+    if (!session) {
+        return;
+    }
+    sseSessions.delete(sessionId);
+    connectionStats.closed += 1;
+    await closeServerSession(session);
+    logInfo(`[MCP] SSE session closed (${reason}, ${sseSessions.size} remaining)`);
+}
+async function cleanupStreamableSession(sessionId, reason) {
+    if (!sessionId) {
+        return;
+    }
+    const session = streamableSessions.get(sessionId);
+    if (!session) {
+        return;
+    }
+    streamableSessions.delete(sessionId);
+    connectionStats.closed += 1;
+    await closeServerSession(session);
+    logInfo(`[MCP] Streamable HTTP session closed (${reason}, ${streamableSessions.size} remaining)`);
+}
+// Reap sessions idle past the TTL so abandoned/half-closed clients cannot
+// accumulate and eventually exhaust MAX_HTTP_SESSIONS (503 for everyone).
+const SESSION_IDLE_MS = Math.max(60000, readNumericEnv('MCP_SESSION_IDLE_MS', 1800000));
+function sweepIdleSessions() {
+    const now = Date.now();
+    for (const [sessionId, session] of streamableSessions) {
+        if (now - session.lastActivity >= SESSION_IDLE_MS) {
+            void cleanupStreamableSession(sessionId, 'idle timeout');
+        }
+    }
+    for (const [sessionId, session] of sseSessions) {
+        if (now - session.lastActivity >= SESSION_IDLE_MS) {
+            void cleanupSseSession(sessionId, 'idle timeout');
+        }
+    }
+}
+function startSessionSweep() {
+    if (sessionSweepTimer) {
+        return;
+    }
+    sessionSweepTimer = setInterval(sweepIdleSessions, Math.min(SESSION_IDLE_MS, 60000));
+    sessionSweepTimer.unref();
+}
+const app = express();
+// Behind the OpenShift router: trust its X-Forwarded-For so the rate limiter
+// keys on the real client IP, not one shared router-IP bucket.
+app.set('trust proxy', readNumericEnv('MCP_TRUST_PROXY_HOPS', 1));
+app.disable('x-powered-by');
+app.use('/mcp', express.json({ limit: '2mb' }));
+app.use(['/health', '/rescan', '/mcp', '/sse', '/messages'], requireRateLimit);
+// Liveness probe, no auth (no runtime detail exposed).
+app.get('/livez', (_req, res) => {
+    res.json({ status: 'ok', uptime: process.uptime() });
+});
+app.get('/health', requireAdminKey, (_req, res) => {
+    const summary = getRuntimeSummary();
+    const autoRescanActive = AUTO_RESCAN_ENABLED && LIVE_SCAN_ENABLED && liveWatchers.length > 0;
+    res.json({
+        status: 'ok',
+        uptime: process.uptime(),
+        mode: TRANSPORT_MODE,
+        dataSourceMode: DATA_SOURCE_MODE,
+        liveScanEnabled: LIVE_SCAN_ENABLED,
+        autoRescanEnabled: AUTO_RESCAN_ENABLED,
+        autoRescanActive,
+        watchPaths: watchedPaths,
+        liveScanAvailable: DESIGN_SYSTEM_PATH_EXISTS,
+        mcpDataAvailable: HAS_MCP_DATA,
+        dataSource: summary.source,
+        mcpDataFiles: summary.mcpDataFiles,
+        connections: {
+            sse: sseSessions.size,
+            streamableHttp: streamableSessions.size,
+            stdio: stdioSession ? 1 : 0,
+        },
+        connectionStats,
+        usage: getMetricsSnapshot(),
+        components: summary.components,
+        jsonForms: summary.jsonForms,
+        themeUtilities: summary.themeUtilities,
+        figmaSync: {
+            lastSync: summary.lastFigmaSync,
+            stats: summary.figmaStats,
+        },
+    });
+});
+// Usage KPIs. JSON, or Prometheus with ?format=prometheus.
+app.get('/metrics', requireAdminKey, (req, res) => {
+    const wantsPrometheus = req.query.format === 'prometheus' ||
+        (req.header('accept') || '').includes('text/plain');
+    if (wantsPrometheus) {
+        res.type('text/plain; version=0.0.4').send(renderPrometheusMetrics());
+        return;
+    }
+    res.json(getMetricsSnapshot());
+});
+app.post('/rescan', requireAdminKey, async (_req, res) => {
+    try {
+        const result = await rescan();
+        res.json({ status: 'ok', ...result });
+    }
+    catch (err) {
+        res.status(500).json({ error: String(err) });
+    }
+});
+app.all('/mcp', requireClientKey, async (req, res) => {
+    if (!HTTP_MODE_ENABLED) {
+        res.status(404).json({ error: 'http transport is disabled' });
+        return;
+    }
+    let createdSession;
+    try {
+        const sessionId = readSessionIdFromHeader(req);
+        if (sessionId && sseSessions.has(sessionId)) {
+            connectionStats.badMessageRequests += 1;
+            res.status(400).json({
+                jsonrpc: '2.0',
+                error: {
+                    code: -32000,
+                    message: 'session exists but uses legacy SSE transport',
+                },
+                id: null,
+            });
+            return;
+        }
+        let session = sessionId ? streamableSessions.get(sessionId) : undefined;
+        if (session) {
+            session.lastActivity = Date.now();
+        }
+        if (!session) {
+            if (sessionId) {
+                connectionStats.badMessageRequests += 1;
+                res.status(404).json({
+                    jsonrpc: '2.0',
+                    error: {
+                        code: -32000,
+                        message: 'session not found',
+                    },
+                    id: null,
+                });
+                return;
+            }
+            if (req.method !== 'POST' || !isInitializeRequest(req.body)) {
+                connectionStats.badMessageRequests += 1;
+                res.status(400).json({
+                    jsonrpc: '2.0',
+                    error: {
+                        code: -32000,
+                        message: 'no valid session and no initialize request',
+                    },
+                    id: null,
+                });
+                return;
+            }
+            if (!enforceSessionCapacity(res)) {
+                return;
+            }
+            const server = createMcpServer();
+            const transport = new StreamableHTTPServerTransport({
+                sessionIdGenerator: () => randomUUID(),
+                onsessioninitialized: initializedSessionId => {
+                    streamableSessions.set(initializedSessionId, {
+                        transport,
+                        server,
+                        lastActivity: Date.now(),
+                    });
+                    connectionStats.accepted += 1;
+                    logInfo(`[MCP] Streamable HTTP session opened (${initializedSessionId})`);
+                },
+            });
+            transport.onerror = error => {
+                console.error('[MCP] Streamable HTTP transport error:', error);
+            };
+            transport.onclose = () => {
+                void cleanupStreamableSession(transport.sessionId, 'client disconnected');
+            };
+            await server.connect(transport);
+            session = { transport, server, lastActivity: Date.now() };
+            createdSession = session;
+        }
+        await session.transport.handleRequest(req, res, req.body);
+    }
+    catch (err) {
+        connectionStats.messageErrors += 1;
+        console.error('[MCP] Error handling /mcp request:', err);
+        if (createdSession) {
+            await closeServerSession(createdSession);
+        }
+        if (!res.headersSent) {
+            res.status(500).json({
+                jsonrpc: '2.0',
+                error: {
+                    code: -32603,
+                    message: 'internal error',
+                },
+                id: null,
+            });
+        }
+    }
+});
+if (ENABLE_LEGACY_SSE) {
+    app.get('/sse', requireClientKey, async (req, res) => {
+        if (!HTTP_MODE_ENABLED) {
+            res.status(404).json({ error: 'http transport is disabled' });
+            return;
+        }
+        if (!enforceSessionCapacity(res)) {
+            return;
+        }
+        logInfo(`[MCP] New legacy SSE connection from ${req.ip}`);
+        const transport = new SSEServerTransport('/messages', res);
+        const server = createMcpServer();
+        const sessionId = transport.sessionId;
+        sseSessions.set(sessionId, { transport, server, lastActivity: Date.now() });
+        connectionStats.accepted += 1;
+        res.once('close', () => {
+            void cleanupSseSession(sessionId, 'client disconnected');
+        });
+        try {
+            await server.connect(transport);
+        }
+        catch (err) {
+            await cleanupSseSession(sessionId, 'connect failure');
+            console.error('[MCP] Failed to establish SSE connection:', err);
+            if (!res.headersSent) {
+                res.status(500).json({ error: 'failed to establish SSE connection' });
+            }
+        }
+    });
+    app.post('/messages', requireClientKey, async (req, res) => {
+        if (!HTTP_MODE_ENABLED) {
+            res.status(404).json({ error: 'http transport is disabled' });
+            return;
+        }
+        const sessionId = readSessionIdFromQuery(req);
+        if (!sessionId) {
+            connectionStats.badMessageRequests += 1;
+            res.status(400).json({ error: 'sessionId is required' });
+            return;
+        }
+        if (streamableSessions.has(sessionId)) {
+            connectionStats.badMessageRequests += 1;
+            res.status(400).json({ error: 'session uses streamable HTTP transport' });
+            return;
+        }
+        const session = sseSessions.get(sessionId);
+        if (!session) {
+            connectionStats.badMessageRequests += 1;
+            res.status(404).json({ error: 'session not found' });
+            return;
+        }
+        session.lastActivity = Date.now();
+        try {
+            await session.transport.handlePostMessage(req, res);
+        }
+        catch (err) {
+            connectionStats.messageErrors += 1;
+            console.error('[MCP] Error handling legacy SSE message:', err);
+            if (!res.headersSent) {
+                res.status(500).json({ error: 'internal error' });
+            }
+        }
+    });
+}
+// Final error handler — maps thrown/forwarded errors (incl. body-parser
+// SyntaxError / PayloadTooLarge) to a clean JSON-RPC-shaped response with no
+// stack trace. Must stay AFTER all routes so Express routes errors here.
+app.use((err, req, res, _next) => {
+    connectionStats.messageErrors += 1;
+    const errRecord = err && typeof err === 'object'
+        ? err
+        : {};
+    const rawStatus = typeof errRecord.status === 'number'
+        ? errRecord.status
+        : typeof errRecord.statusCode === 'number'
+            ? errRecord.statusCode
+            : undefined;
+    const isPayloadTooLarge = rawStatus === 413 || errRecord.type === 'entity.too.large';
+    const isBadJson = err instanceof SyntaxError || errRecord.type === 'entity.parse.failed';
+    const status = isPayloadTooLarge
+        ? 413
+        : isBadJson
+            ? 400
+            : rawStatus && rawStatus >= 400 && rawStatus < 600
+                ? rawStatus
+                : 500;
+    const code = isBadJson ? -32700 : isPayloadTooLarge ? -32600 : -32603;
+    const message = isPayloadTooLarge
+        ? 'request payload too large'
+        : isBadJson
+            ? 'invalid JSON payload'
+            : 'internal error';
+    logInfo(`[MCP] Request error on ${req.method} ${req.path}: ${err instanceof Error ? err.message : String(err)}`);
+    if (res.headersSent) {
+        return;
+    }
+    res.status(status).json({
+        jsonrpc: '2.0',
+        error: { code, message },
+        id: null,
+    });
+});
+async function startStdioTransport() {
+    if (!STDIO_MODE_ENABLED) {
+        return;
+    }
+    const transport = new StdioServerTransport();
+    const server = createMcpServer();
+    stdioSession = { transport, server };
+    transport.onclose = () => {
+        connectionStats.closed += 1;
+        stdioSession = null;
+        logInfo('[MCP] stdio transport closed');
+        if (!HTTP_MODE_ENABLED) {
+            void shutdown('STDIO_CLOSED');
+        }
+    };
+    transport.onerror = error => {
+        connectionStats.messageErrors += 1;
+        console.error('[MCP] stdio transport error:', error);
+    };
+    await server.connect(transport);
+    connectionStats.accepted += 1;
+    logInfo('[MCP] stdio transport ready');
+}
+function startHttpTransport() {
+    if (!HTTP_MODE_ENABLED) {
+        return Promise.resolve();
+    }
+    startRateTrackerSweep();
+    startSessionSweep();
+    return new Promise((resolve, reject) => {
+        const server = app.listen(PORT, '0.0.0.0', () => {
+            httpServer = server;
+            logInfo(`[MCP] HTTP server listening on http://0.0.0.0:${PORT}`);
+            logInfo('[MCP] Health: GET /health');
+            logInfo('[MCP] Streamable HTTP: ALL /mcp');
+            if (ENABLE_LEGACY_SSE) {
+                logInfo('[MCP] Legacy SSE: GET /sse + POST /messages');
+            }
+            if (API_KEY) {
+                logInfo(`[MCP] Auth: /mcp requires the client key${ADMIN_KEY ? '; admin endpoints require the admin key' : ''}`);
+            }
+            else if (ADMIN_KEY) {
+                logInfo('[MCP] Auth: /mcp is open; admin endpoints (/metrics, /health, /rescan) require the admin key');
+            }
+            else if (ALLOW_UNAUTHENTICATED_HTTP) {
+                logInfo('[MCP] WARNING: all HTTP endpoints are open (no keys set)');
+            }
+            resolve();
+        });
+        server.once('error', reject);
+    });
+}
+async function main() {
+    logInfo(`Design System Path: ${DESIGN_SYSTEM_PATH}${DESIGN_SYSTEM_PATH_EXISTS ? '' : ' (not found)'}`);
+    logInfo(`[MCP] Starting with transport mode "${TRANSPORT_MODE}"${CLI_TRANSPORT_ARG ? ' (from CLI)' : ''}`);
+    logInfo(`[MCP] Data source mode "${DATA_SOURCE_MODE}"${CLI_DATA_SOURCE_ARG ? ' (from CLI)' : ''}`);
+    if (HTTP_MODE_ENABLED &&
+        !API_KEY &&
+        !ADMIN_KEY &&
+        !ALLOW_UNAUTHENTICATED_HTTP) {
+        console.error('[MCP] FATAL: HTTP transport has no keys. Set MCP_ADMIN_KEY (leaves /mcp open, protects /metrics|/health|/rescan), or MCP_API_KEY (keys /mcp too), or MCP_ALLOW_UNAUTHENTICATED_HTTP=true.');
+        process.exit(1);
+    }
+    if (DATA_SOURCE_MODE === 'mcp-data' && !HAS_MCP_CODEBASE) {
+        console.error('[MCP] FATAL: MCP_DATA_SOURCE is set to "mcp-data" but mcp-data/codebase.json is missing. Run `npm run sync:mcp` first.');
+        process.exit(1);
+    }
+    if (DATA_SOURCE_MODE === 'live' && !DESIGN_SYSTEM_PATH_EXISTS) {
+        console.error(`[MCP] FATAL: MCP_DATA_SOURCE is set to "live" but DESIGN_SYSTEM_PATH does not exist: ${DESIGN_SYSTEM_PATH}`);
+        process.exit(1);
+    }
+    if (!DESIGN_SYSTEM_PATH_EXISTS && !HAS_MCP_DATA) {
+        console.error(`[MCP] FATAL: Design system path does not exist and no synced mcp-data is available. Checked path: ${DESIGN_SYSTEM_PATH}`);
+        process.exit(1);
+    }
+    if (LIVE_SCAN_ENABLED && DESIGN_SYSTEM_PATH_EXISTS) {
+        logInfo('Scanning design system components...');
+        await scanner.scan();
+        const summary = scanner.getSummary();
+        logInfo(`Found ${summary.components} components, ${summary.jsonForms} JSON Forms renderers, ${summary.themeUtilities} theme utilities.`);
+        if (summary.components === 0) {
+            console.warn('[MCP] WARNING: No components found — check DESIGN_SYSTEM_PATH');
+        }
+        if (AUTO_RESCAN_ENABLED) {
+            startLiveRescanWatchers();
+        }
+    }
+    else {
+        logInfo(`[MCP] Using synced mcp-data as source of truth (${AVAILABLE_MCP_DATA_FILES.join(', ') || 'none found'}).`);
+        if (AUTO_RESCAN_ENABLED) {
+            logInfo('[MCP] Auto rescan was requested, but it only works in live mode. Start with --data-source=live --watch to enable automatic detection.');
+        }
+    }
+    startMetricsPersistence();
+    await startHttpTransport();
+    await startStdioTransport();
+    if (!HTTP_MODE_ENABLED && !STDIO_MODE_ENABLED) {
+        throw new Error(`No valid transport enabled for mode "${TRANSPORT_MODE}".`);
+    }
+}
+async function shutdown(signal) {
+    if (shutdownInProgress) {
+        return;
+    }
+    shutdownInProgress = true;
+    logInfo(`[MCP] ${signal} received, shutting down...`);
+    // Failsafe: if a transport/server close hangs, force the process out anyway.
+    const forceExitTimer = setTimeout(() => {
+        console.error('[MCP] Forced exit: graceful shutdown timed out.');
+        process.exit(1);
+    }, 5000);
+    forceExitTimer.unref();
+    const closeOps = [];
+    if (httpServer) {
+        closeOps.push(new Promise(resolve => {
+            httpServer?.close(() => resolve(undefined));
+        }));
+    }
+    collectSessionCloseOps(sseSessions, closeOps);
+    collectSessionCloseOps(streamableSessions, closeOps);
+    if (stdioSession) {
+        closeOps.push(stdioSession.transport.close());
+        closeOps.push(stdioSession.server.close());
+        stdioSession = null;
+    }
+    if (rescanDebounceTimer) {
+        clearTimeout(rescanDebounceTimer);
+        rescanDebounceTimer = null;
+    }
+    if (rateTrackerSweepTimer) {
+        clearInterval(rateTrackerSweepTimer);
+        rateTrackerSweepTimer = null;
+    }
+    if (sessionSweepTimer) {
+        clearInterval(sessionSweepTimer);
+        sessionSweepTimer = null;
+    }
+    if (metricsFlushTimer) {
+        clearInterval(metricsFlushTimer);
+        metricsFlushTimer = null;
+    }
+    writeMetricsFile(); // final flush
+    for (const watcher of liveWatchers.splice(0)) {
+        try {
+            watcher.close();
+        }
+        catch (error) {
+            void error;
+        }
+    }
+    await Promise.allSettled(closeOps);
+    clearTimeout(forceExitTimer);
+    process.exit(0);
+}
+process.on('SIGINT', () => {
+    void shutdown('SIGINT');
+});
+process.on('SIGTERM', () => {
+    void shutdown('SIGTERM');
+});
+// Keep the process alive on a stray rejection — just surface it on stderr.
+process.on('unhandledRejection', reason => {
+    console.error('[MCP] Unhandled promise rejection:', reason);
+});
+// A truly uncaught exception leaves us in an unknown state — log then drain.
+process.on('uncaughtException', error => {
+    console.error('[MCP] Uncaught exception:', error);
+    void shutdown('UNCAUGHT_EXCEPTION');
+});
+main().catch(error => {
+    console.error('Fatal error starting server:', error);
+    process.exit(1);
+});
+//# sourceMappingURL=index.js.map