db-mcp 1.0.2 → 1.1.0

package/dist/http-VSB7DBJR.js

@@ -0,0 +1,1541 @@
+import './chunk-4IA3DB5C.js';
+import { createModuleLogger, DbMcpError, ERROR_CODES } from './chunk-AOUL5SHS.js';
+import express from 'express';
+import { localhostHostValidation } from '@modelcontextprotocol/sdk/server/middleware/hostHeaderValidation.js';
+import cors from 'cors';
+import { randomUUID } from 'crypto';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { SSEServerTransport } from '@modelcontextprotocol/sdk/server/sse.js';
+import { isInitializeRequest } from '@modelcontextprotocol/sdk/types.js';
+import * as jose from 'jose';
+
+// src/auth/middleware/extraction.ts
+function extractBearerToken(authHeader) {
+  if (!authHeader) {
+    return null;
+  }
+  const parts = authHeader.split(" ");
+  const scheme = parts[0];
+  const tokenPart = parts[1];
+  if (parts.length !== 2 || scheme?.toLowerCase() !== "bearer") {
+    return null;
+  }
+  if (tokenPart === void 0) {
+    return null;
+  }
+  const token = tokenPart.trim();
+  return token.length > 0 ? token : null;
+}
+
+// src/auth/errors.ts
+var OAuthError = class extends DbMcpError {
+  /** HTTP status code for this error */
+  httpStatus;
+  /** WWW-Authenticate header value */
+  wwwAuthenticate;
+  constructor(message, code, httpStatus, details, wwwAuthenticate) {
+    super(message, code, "authentication" /* AUTHENTICATION */, { details });
+    this.name = "OAuthError";
+    this.httpStatus = httpStatus;
+    this.wwwAuthenticate = wwwAuthenticate;
+  }
+};
+var TokenMissingError = class extends OAuthError {
+  constructor(realm = "db-mcp") {
+    super(
+      "No access token provided",
+      ERROR_CODES.AUTH.TOKEN_MISSING.full,
+      401,
+      void 0,
+      `Bearer realm="${realm}"`
+    );
+    this.name = "TokenMissingError";
+  }
+};
+var InvalidTokenError = class extends OAuthError {
+  constructor(message = "Invalid access token", details) {
+    super(
+      message,
+      ERROR_CODES.AUTH.TOKEN_INVALID.full,
+      401,
+      details,
+      'Bearer error="invalid_token"'
+    );
+    this.name = "InvalidTokenError";
+  }
+};
+var TokenExpiredError = class extends OAuthError {
+  constructor(expiredAt) {
+    super(
+      "Access token has expired",
+      ERROR_CODES.AUTH.TOKEN_EXPIRED.full,
+      401,
+      expiredAt ? { expiredAt: expiredAt.toISOString() } : void 0,
+      'Bearer error="invalid_token", error_description="Token has expired"'
+    );
+    this.name = "TokenExpiredError";
+  }
+};
+var InvalidSignatureError = class extends OAuthError {
+  constructor(message = "Token signature verification failed") {
+    super(
+      message,
+      ERROR_CODES.AUTH.SIGNATURE_INVALID.full,
+      401,
+      void 0,
+      'Bearer error="invalid_token", error_description="Signature verification failed"'
+    );
+    this.name = "InvalidSignatureError";
+  }
+};
+var AuthServerDiscoveryError = class extends OAuthError {
+  constructor(serverUrl, cause) {
+    super(
+      `Failed to discover authorization server metadata: ${serverUrl}`,
+      ERROR_CODES.AUTH.DISCOVERY_FAILED.full,
+      500,
+      {
+        serverUrl,
+        cause: cause?.message
+      }
+    );
+    this.name = "AuthServerDiscoveryError";
+  }
+};
+var JwksFetchError = class extends OAuthError {
+  constructor(jwksUri, cause) {
+    super(
+      `Failed to fetch JWKS: ${jwksUri}`,
+      ERROR_CODES.AUTH.JWKS_FETCH_FAILED.full,
+      500,
+      {
+        jwksUri,
+        cause: cause?.message
+      }
+    );
+    this.name = "JwksFetchError";
+  }
+};
+function isOAuthError(error) {
+  return error instanceof OAuthError;
+}
+
+// src/auth/scopes/constants.ts
+var SCOPES = {
+  /** Read-only access to all databases */
+  READ: "read",
+  /** Read and write access to all databases */
+  WRITE: "write",
+  /** Administrative access */
+  ADMIN: "admin"};
+var BASE_SCOPES = ["read", "write", "admin", "full"];
+var SCOPE_PATTERNS = {
+  /** Database-specific access pattern */
+  DATABASE: /^db:([a-zA-Z0-9_-]+)$/,
+  /** Table-specific access pattern */
+  TABLE: /^table:([a-zA-Z0-9_-]+):([a-zA-Z0-9_-]+)$/
+};
+var SUPPORTED_SCOPES = [
+  "read",
+  "write",
+  "admin",
+  "full",
+  "db:{database}",
+  "table:{database}:{table}"
+];
+function parseScopes(scopeString) {
+  return scopeString.split(/\s+/).map((s) => s.trim()).filter((s) => s.length > 0);
+}
+
+// src/auth/scopes/mapping.ts
+var TOOL_GROUP_SCOPES = {
+  core: SCOPES.READ,
+  json: SCOPES.READ,
+  text: SCOPES.READ,
+  stats: SCOPES.READ,
+  vector: SCOPES.READ,
+  geo: SCOPES.READ,
+  introspection: SCOPES.READ,
+  migration: SCOPES.WRITE,
+  admin: SCOPES.ADMIN,
+  codemode: SCOPES.ADMIN
+};
+var groupsForScope = (maxScope) => {
+  const hierarchy = {
+    read: 0,
+    write: 1,
+    admin: 2,
+    full: 3
+  };
+  const maxLevel = hierarchy[maxScope];
+  return Object.entries(TOOL_GROUP_SCOPES).filter(([, scope]) => hierarchy[scope] <= maxLevel).map(([group]) => group);
+};
+groupsForScope(SCOPES.READ);
+groupsForScope(SCOPES.WRITE);
+groupsForScope(SCOPES.ADMIN);
+
+// src/auth/middleware/express-auth.ts
+var logger = createModuleLogger("AUTH");
+function isPublicPath(path, publicPaths) {
+  if (path.startsWith("/.well-known/")) {
+    return true;
+  }
+  for (const pattern of publicPaths) {
+    if (pattern === path) {
+      return true;
+    }
+    if (pattern.endsWith("/*")) {
+      const prefix = pattern.slice(0, -2);
+      if (path === prefix || path.startsWith(prefix + "/")) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+function createAuthMiddleware(config) {
+  const { tokenValidator, resourceServer, publicPaths = [] } = config;
+  return async (req, res, next) => {
+    const requestId = crypto.randomUUID();
+    req.requestId = requestId;
+    if (isPublicPath(req.path, publicPaths)) {
+      logger.info(`Public path accessed: ${req.path}`, {
+        code: "AUTH_PUBLIC_PATH",
+        requestId,
+        path: req.path
+      });
+      next();
+      return;
+    }
+    const token = extractBearerToken(req.headers.authorization);
+    if (!token) {
+      const error = new TokenMissingError(resourceServer.getResourceUri());
+      logger.warning("No access token provided", {
+        code: ERROR_CODES.AUTH.TOKEN_MISSING.full,
+        requestId,
+        path: req.path
+      });
+      res.status(error.httpStatus);
+      res.setHeader("WWW-Authenticate", error.wwwAuthenticate ?? "");
+      res.json({
+        error: "unauthorized",
+        error_description: error.message
+      });
+      return;
+    }
+    const result = await tokenValidator.validate(token);
+    if (!result.valid) {
+      logger.warning(
+        `Token validation failed: ${result.error ?? "Unknown error"}`,
+        {
+          code: result.errorCode ?? ERROR_CODES.AUTH.TOKEN_INVALID.full,
+          requestId,
+          path: req.path
+        }
+      );
+      res.status(401);
+      res.setHeader(
+        "WWW-Authenticate",
+        resourceServer.getWWWAuthenticateHeader("invalid_token", result.error)
+      );
+      res.json({
+        error: "invalid_token",
+        error_description: result.error
+      });
+      return;
+    }
+    const claims = result.claims;
+    if (!claims) {
+      res.status(500).json({ error: "internal_error" });
+      return;
+    }
+    req.auth = claims;
+    req.accessToken = token;
+    logger.info(`Request authenticated: ${claims.sub}`, {
+      code: "AUTH_SUCCESS",
+      requestId,
+      sub: claims.sub,
+      scopes: claims.scopes.length,
+      path: req.path
+    });
+    next();
+  };
+}
+
+// src/auth/middleware/express-scopes.ts
+createModuleLogger("AUTH");
+function oauthErrorHandler(error, _req, res, next) {
+  if (isOAuthError(error)) {
+    res.status(error.httpStatus);
+    if (error.wwwAuthenticate) {
+      res.setHeader("WWW-Authenticate", error.wwwAuthenticate);
+    }
+    res.json({
+      error: error.code,
+      error_description: error.message
+    });
+    return;
+  }
+  next(error);
+}
+
+// src/transports/http/types.ts
+var DEFAULT_RATE_LIMIT_WINDOW_MS = 6e4;
+var DEFAULT_RATE_LIMIT_MAX = 100;
+var DEFAULT_MAX_BODY_BYTES = 1048576;
+var DEFAULT_HSTS_MAX_AGE = 31536e3;
+var JSONRPC_SERVER_ERROR = -32e3;
+var JSONRPC_INTERNAL_ERROR = -32603;
+var HTTP_REQUEST_TIMEOUT_MS = 12e4;
+var HTTP_KEEP_ALIVE_TIMEOUT_MS = 65e3;
+var HTTP_HEADERS_TIMEOUT_MS = 66e3;
+function getClientIp(req, trustProxy) {
+  if (trustProxy) {
+    const forwarded = req.headers["x-forwarded-for"];
+    if (typeof forwarded === "string") {
+      const firstIp = forwarded.split(",")[0]?.trim();
+      if (firstIp) return firstIp;
+    }
+  }
+  return req.ip ?? req.socket.remoteAddress ?? "unknown";
+}
+function setupSecurityHeaders(state) {
+  if (!state.app) return;
+  state.app.use((_req, res, next) => {
+    res.setHeader("X-Content-Type-Options", "nosniff");
+    res.setHeader("X-Frame-Options", "DENY");
+    res.setHeader("Cache-Control", "no-store, no-cache, must-revalidate");
+    res.setHeader(
+      "Content-Security-Policy",
+      "default-src 'none'; frame-ancestors 'none'"
+    );
+    res.setHeader(
+      "Permissions-Policy",
+      "camera=(), microphone=(), geolocation=()"
+    );
+    res.setHeader("Referrer-Policy", "no-referrer");
+    if (state.config.enableHSTS) {
+      const maxAge = state.config.hstsMaxAge ?? DEFAULT_HSTS_MAX_AGE;
+      res.setHeader(
+        "Strict-Transport-Security",
+        `max-age=${String(maxAge)}; includeSubDomains`
+      );
+    }
+    next();
+  });
+}
+function matchesCorsOrigin(origin, pattern) {
+  if (pattern === "*") return true;
+  if (pattern.startsWith("*.")) {
+    const domain = pattern.slice(1);
+    return origin.endsWith(domain) && origin.length > domain.length;
+  }
+  return origin === pattern;
+}
+function setupCors(state) {
+  if (!state.app) return;
+  const corsOrigins = state.config.corsOrigins ?? ["*"];
+  const isWildcard = corsOrigins.includes("*");
+  state.app.use((req, res, next) => {
+    const origin = req.headers.origin;
+    if (isWildcard) {
+      res.setHeader("Access-Control-Allow-Origin", "*");
+    } else if (origin && corsOrigins.some((pattern) => matchesCorsOrigin(origin, pattern))) {
+      res.setHeader("Access-Control-Allow-Origin", origin);
+      res.setHeader("Vary", "Origin");
+      res.setHeader("Access-Control-Allow-Credentials", "true");
+    }
+    res.setHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS");
+    res.setHeader(
+      "Access-Control-Allow-Headers",
+      "Content-Type, Accept, Authorization, mcp-session-id, Last-Event-ID, mcp-protocol-version"
+    );
+    res.setHeader("Access-Control-Expose-Headers", "mcp-session-id");
+    if (req.method === "OPTIONS") {
+      res.setHeader("Access-Control-Max-Age", "86400");
+      res.status(204).end();
+      return;
+    }
+    next();
+  });
+  if (state.config.cors) {
+    state.app.use(cors(state.config.cors));
+  }
+}
+function setupRateLimiting(state) {
+  if (!state.app) return;
+  const windowMs = DEFAULT_RATE_LIMIT_WINDOW_MS;
+  const maxRequests = process.env["MCP_RATE_LIMIT_MAX"] ? parseInt(process.env["MCP_RATE_LIMIT_MAX"], 10) : DEFAULT_RATE_LIMIT_MAX;
+  const trustProxy = state.config.trustProxy ?? false;
+  state.rateLimitCleanupTimer = setInterval(() => {
+    const now = Date.now();
+    for (const [ip, entry] of state.rateLimitMap) {
+      if (now >= entry.resetAt) {
+        state.rateLimitMap.delete(ip);
+      }
+    }
+  }, windowMs);
+  state.rateLimitCleanupTimer.unref();
+  state.app.use((req, res, next) => {
+    if (req.path === "/health") {
+      next();
+      return;
+    }
+    const ip = getClientIp(req, trustProxy);
+    const now = Date.now();
+    let entry = state.rateLimitMap.get(ip);
+    if (!entry || now >= entry.resetAt) {
+      entry = { count: 0, resetAt: now + windowMs };
+      state.rateLimitMap.set(ip, entry);
+    }
+    entry.count++;
+    if (entry.count > maxRequests) {
+      const retryAfter = Math.ceil((entry.resetAt - now) / 1e3);
+      res.setHeader("Retry-After", String(retryAfter));
+      res.status(429).json({
+        error: "Too Many Requests",
+        retryAfter
+      });
+      return;
+    }
+    next();
+  });
+}
+
+// src/transports/http/type-adapters.ts
+function asIncoming(req) {
+  return req;
+}
+function asServerResponse(res) {
+  return res;
+}
+
+// src/transports/http/session.ts
+var logger3 = createModuleLogger("HTTP");
+async function setupStatelessEndpoints(state) {
+  if (!state.app || !state.mcpServer) {
+    throw new DbMcpError(
+      "Transport or server not initialized",
+      ERROR_CODES.SERVER.TRANSPORT_ERROR.full,
+      "internal" /* INTERNAL */
+    );
+  }
+  state.statelessTransport = new StreamableHTTPServerTransport({
+    enableJsonResponse: true
+  });
+  state.statelessTransport.onclose ??= () => {
+    logger3.debug("Stateless transport closed", {
+      code: "HTTP_STATELESS_CLOSE"
+    });
+  };
+  await state.mcpServer.connect(
+    state.statelessTransport
+  );
+  logger3.info("Stateless transport connected", { code: "HTTP_STATELESS" });
+  state.app.post("/mcp", (req, res) => {
+    if (!state.statelessTransport) {
+      res.status(500).json({ error: "Transport not initialized" });
+      return;
+    }
+    void state.statelessTransport.handleRequest(
+      asIncoming(req),
+      asServerResponse(res),
+      req.body
+    );
+  });
+  state.app.get("/mcp", (_req, res) => {
+    res.status(405).json({
+      jsonrpc: "2.0",
+      error: {
+        code: JSONRPC_SERVER_ERROR,
+        message: "SSE streaming not available in stateless mode"
+      },
+      id: null
+    });
+  });
+  state.app.delete("/mcp", (_req, res) => {
+    res.status(204).end();
+  });
+}
+function setupStatefulEndpoints(state) {
+  if (!state.app || !state.mcpServer) {
+    throw new DbMcpError(
+      "Transport or server not initialized",
+      ERROR_CODES.SERVER.TRANSPORT_ERROR.full,
+      "internal" /* INTERNAL */
+    );
+  }
+  const server = state.mcpServer;
+  state.app.post("/mcp", (req, res) => {
+    const sessionId = req.headers["mcp-session-id"];
+    if (sessionId && state.sseTransports.has(sessionId)) {
+      res.status(400).json({
+        jsonrpc: "2.0",
+        error: {
+          code: JSONRPC_SERVER_ERROR,
+          message: "Bad Request: Session exists but uses a different transport protocol"
+        },
+        id: null
+      });
+      return;
+    }
+    const isNewSessionRequest = (body) => {
+      if (isInitializeRequest(body)) {
+        return true;
+      }
+      if (Array.isArray(body) && body.length > 0) {
+        return isInitializeRequest(body[0]);
+      }
+      return false;
+    };
+    void (async () => {
+      try {
+        let httpTransport;
+        if (sessionId && state.transports.has(sessionId)) {
+          httpTransport = state.transports.get(sessionId);
+        } else if (sessionId === void 0 && isNewSessionRequest(req.body)) {
+          const newTransport = new StreamableHTTPServerTransport({
+            sessionIdGenerator: () => randomUUID(),
+            onsessioninitialized: (sid) => {
+              logger3.info("HTTP session initialized", {
+                code: "HTTP_SESSION_INIT",
+                sessionId: sid
+              });
+              state.transports.set(sid, newTransport);
+            }
+          });
+          newTransport.onclose = () => {
+            const sid = newTransport.sessionId;
+            if (sid !== void 0 && state.transports.has(sid)) {
+              logger3.info("HTTP transport closed", {
+                code: "HTTP_SESSION_CLOSE",
+                sessionId: sid
+              });
+              state.transports.delete(sid);
+            }
+          };
+          try {
+            await server.connect(
+              newTransport
+            );
+          } catch {
+            await server.close();
+            await server.connect(
+              newTransport
+            );
+          }
+          await newTransport.handleRequest(
+            asIncoming(req),
+            asServerResponse(res),
+            req.body
+          );
+          return;
+        } else {
+          res.status(400).json({
+            jsonrpc: "2.0",
+            error: {
+              code: JSONRPC_SERVER_ERROR,
+              message: "Bad Request: No valid session ID provided"
+            },
+            id: null
+          });
+          return;
+        }
+        if (httpTransport !== void 0) {
+          await httpTransport.handleRequest(
+            asIncoming(req),
+            asServerResponse(res),
+            req.body
+          );
+        }
+      } catch (error) {
+        logger3.error("Error handling MCP request", {
+          code: ERROR_CODES.SERVER.TRANSPORT_ERROR.full,
+          error: error instanceof Error ? error : void 0
+        });
+        if (!res.headersSent) {
+          res.status(500).json({
+            jsonrpc: "2.0",
+            error: {
+              code: JSONRPC_INTERNAL_ERROR,
+              message: "Internal server error"
+            },
+            id: null
+          });
+        }
+      }
+    })();
+  });
+  state.app.get("/mcp", (req, res) => {
+    const sessionId = req.headers["mcp-session-id"];
+    if (sessionId === void 0 || !state.transports.has(sessionId)) {
+      res.status(400).send("Invalid or missing session ID");
+      return;
+    }
+    const lastEventId = req.headers["last-event-id"];
+    if (lastEventId !== void 0) {
+      logger3.debug("Client reconnecting with Last-Event-ID", {
+        code: "HTTP_SSE_RECONNECT",
+        sessionId,
+        lastEventId
+      });
+    }
+    const httpTransport = state.transports.get(sessionId);
+    if (httpTransport !== void 0) {
+      void httpTransport.handleRequest(asIncoming(req), asServerResponse(res));
+    }
+  });
+  state.app.delete("/mcp", (req, res) => {
+    const sessionId = req.headers["mcp-session-id"];
+    if (sessionId === void 0 || !state.transports.has(sessionId)) {
+      res.status(400).send("Invalid or missing session ID");
+      return;
+    }
+    logger3.info("Session termination requested", {
+      code: "HTTP_SESSION_DELETE",
+      sessionId
+    });
+    const httpTransport = state.transports.get(sessionId);
+    if (httpTransport !== void 0) {
+      void httpTransport.handleRequest(asIncoming(req), asServerResponse(res));
+    }
+  });
+}
+function setupLegacySSEEndpoints(state) {
+  if (!state.app || !state.mcpServer) return;
+  const server = state.mcpServer;
+  state.app.get("/sse", (req, res) => {
+    logger3.info("Legacy SSE connection requested", {
+      code: "SSE_CONNECT"
+    });
+    const sseTransport = new SSEServerTransport(
+      "/messages",
+      asServerResponse(res)
+    );
+    void (async () => {
+      try {
+        state.sseTransports.set(sseTransport.sessionId, sseTransport);
+        sseTransport.onclose = () => {
+          logger3.info("Legacy SSE transport closed", {
+            code: "SSE_CLOSE",
+            sessionId: sseTransport.sessionId
+          });
+          state.sseTransports.delete(sseTransport.sessionId);
+        };
+        try {
+          await server.connect(
+            sseTransport
+          );
+        } catch {
+          await server.close();
+          await server.connect(
+            sseTransport
+          );
+        }
+      } catch (error) {
+        logger3.error("Error starting SSE transport", {
+          code: ERROR_CODES.SERVER.TRANSPORT_ERROR.full,
+          error: error instanceof Error ? error : void 0
+        });
+        if (!res.headersSent) {
+          res.status(500).end();
+        }
+      }
+    })();
+    req.on("close", () => {
+      state.sseTransports.delete(sseTransport.sessionId);
+    });
+  });
+  state.app.post("/messages", (req, res) => {
+    const sessionId = typeof req.query["sessionId"] === "string" ? req.query["sessionId"] : void 0;
+    if (!sessionId) {
+      res.status(400).json({
+        jsonrpc: "2.0",
+        error: {
+          code: JSONRPC_SERVER_ERROR,
+          message: "Missing sessionId parameter"
+        },
+        id: null
+      });
+      return;
+    }
+    const sseTransport = state.sseTransports.get(sessionId);
+    if (!sseTransport) {
+      res.status(404).json({
+        jsonrpc: "2.0",
+        error: {
+          code: JSONRPC_SERVER_ERROR,
+          message: "No transport found for sessionId"
+        },
+        id: null
+      });
+      return;
+    }
+    void sseTransport.handlePostMessage(
+      asIncoming(req),
+      asServerResponse(res),
+      req.body
+    );
+  });
+}
+
+// src/auth/oauth-resource-server.ts
+var logger4 = createModuleLogger("AUTH");
+var OAuthResourceServer = class {
+  config;
+  metadata = null;
+  constructor(config) {
+    this.config = {
+      resource: config.resource,
+      authorizationServers: config.authorizationServers,
+      scopesSupported: config.scopesSupported.length > 0 ? config.scopesSupported : [...SUPPORTED_SCOPES],
+      bearerMethodsSupported: config.bearerMethodsSupported ?? ["header"]
+    };
+    logger4.info(
+      `OAuth Resource Server initialized for: ${this.config.resource}`,
+      { code: "AUTH_INIT" }
+    );
+  }
+  /**
+   * Get the Protected Resource Metadata document
+   *
+   * @returns RFC 9728 compliant metadata
+   */
+  getMetadata() {
+    this.metadata ??= this.buildMetadata();
+    return this.metadata;
+  }
+  /**
+   * Build the Protected Resource Metadata document
+   */
+  buildMetadata() {
+    return {
+      resource: this.config.resource,
+      authorization_servers: this.config.authorizationServers,
+      scopes_supported: this.config.scopesSupported,
+      bearer_methods_supported: this.config.bearerMethodsSupported,
+      resource_documentation: `${this.config.resource}/docs`,
+      resource_signing_alg_values_supported: ["RS256", "ES256"]
+    };
+  }
+  /**
+   * Get Express request handler for the metadata endpoint
+   *
+   * Serves: GET /.well-known/oauth-protected-resource
+   */
+  getMetadataHandler() {
+    return (_req, res) => {
+      const metadata = this.getMetadata();
+      res.setHeader("Content-Type", "application/json");
+      res.setHeader("Cache-Control", "public, max-age=3600");
+      res.json(metadata);
+      logger4.info("Protected Resource Metadata served", {
+        code: "AUTH_METADATA_SERVED"
+      });
+    };
+  }
+  /**
+   * Generate WWW-Authenticate header for 401 responses
+   *
+   * @param error - Error type for the header
+   * @param errorDescription - Human-readable error description
+   * @returns WWW-Authenticate header value
+   */
+  getWWWAuthenticateHeader(error, errorDescription) {
+    const parts = [`Bearer realm="${this.config.resource}"`];
+    if (error) {
+      parts.push(`error="${error}"`);
+    }
+    if (errorDescription) {
+      parts.push(`error_description="${errorDescription}"`);
+    }
+    return parts.join(", ");
+  }
+  /**
+   * Get the resource URI
+   */
+  getResourceUri() {
+    return this.config.resource;
+  }
+  /**
+   * Get the authorization servers
+   */
+  getAuthorizationServers() {
+    return [...this.config.authorizationServers];
+  }
+  /**
+   * Get supported scopes
+   */
+  getSupportedScopes() {
+    return [...this.config.scopesSupported];
+  }
+  /**
+   * Check if a scope is supported by this resource server.
+   * Validates standard scopes and dynamic patterns (db:*, table:*:*).
+   */
+  isScopeSupported(scope) {
+    if (BASE_SCOPES.includes(scope)) {
+      return true;
+    }
+    if (this.config.scopesSupported.includes(scope)) {
+      return true;
+    }
+    if (SCOPE_PATTERNS.DATABASE.test(scope)) {
+      return true;
+    }
+    if (SCOPE_PATTERNS.TABLE.test(scope)) {
+      return true;
+    }
+    return false;
+  }
+  /**
+   * Get the well-known metadata endpoint path
+   */
+  getWellKnownPath() {
+    return "/.well-known/oauth-protected-resource";
+  }
+  /**
+   * Clear cached metadata (useful when configuration changes)
+   */
+  clearCache() {
+    this.metadata = null;
+  }
+};
+
+// src/auth/authorization-server-discovery.ts
+var logger5 = createModuleLogger("AUTH");
+var AuthorizationServerDiscovery = class {
+  authServerUrl;
+  cacheTtl;
+  timeout;
+  cachedMetadata = null;
+  cacheExpiry = 0;
+  constructor(config) {
+    this.authServerUrl = config.authServerUrl.replace(/\/+$/, "");
+    this.cacheTtl = config.cacheTtl ?? 3600;
+    this.timeout = config.timeout ?? 5e3;
+    logger5.info(
+      `Authorization Server Discovery initialized for: ${this.authServerUrl}`,
+      { code: "AUTH_INIT" }
+    );
+  }
+  /**
+   * Discover authorization server metadata
+   *
+   * Fetches from /.well-known/oauth-authorization-server
+   * Results are cached for cacheTtl seconds.
+   *
+   * @returns Authorization server metadata
+   * @throws AuthServerDiscoveryError if discovery fails
+   */
+  async discover() {
+    if (this.cachedMetadata && Date.now() < this.cacheExpiry) {
+      logger5.info("Using cached authorization server metadata", {
+        code: "AUTH_CACHE_HIT"
+      });
+      return this.cachedMetadata;
+    }
+    const metadataUrl = `${this.authServerUrl}/.well-known/oauth-authorization-server`;
+    logger5.info(`Fetching authorization server metadata from: ${metadataUrl}`, {
+      code: "AUTH_DISCOVERY"
+    });
+    try {
+      const controller = new AbortController();
+      const timeoutId = setTimeout(() => controller.abort(), this.timeout);
+      const response = await fetch(metadataUrl, {
+        method: "GET",
+        headers: {
+          Accept: "application/json"
+        },
+        signal: controller.signal
+      });
+      clearTimeout(timeoutId);
+      if (!response.ok) {
+        throw new DbMcpError(
+          `HTTP ${String(response.status)}: ${response.statusText}`,
+          ERROR_CODES.AUTH.DISCOVERY_FAILED.full,
+          "connection" /* CONNECTION */
+        );
+      }
+      const metadata = await response.json();
+      this.validateMetadata(metadata);
+      this.cachedMetadata = metadata;
+      this.cacheExpiry = Date.now() + this.cacheTtl * 1e3;
+      logger5.info(
+        `Authorization server metadata cached for ${String(this.cacheTtl)}s`,
+        { code: "AUTH_DISCOVERY_SUCCESS" }
+      );
+      return metadata;
+    } catch (error) {
+      const cause = error instanceof Error ? error : new Error(String(error));
+      logger5.error(
+        `Failed to discover authorization server: ${this.authServerUrl}`,
+        {
+          code: ERROR_CODES.AUTH.DISCOVERY_FAILED.full,
+          operation: "discover",
+          entityId: this.authServerUrl,
+          error: cause
+        }
+      );
+      throw new AuthServerDiscoveryError(this.authServerUrl, cause);
+    }
+  }
+  /**
+   * Validate required metadata fields per RFC 8414
+   */
+  validateMetadata(metadata) {
+    if (!metadata.issuer) {
+      throw new DbMcpError(
+        "Missing required field: issuer",
+        "AUTH_DISCOVERY_INVALID",
+        "validation" /* VALIDATION */
+      );
+    }
+    if (!metadata.token_endpoint) {
+      throw new DbMcpError(
+        "Missing required field: token_endpoint",
+        "AUTH_DISCOVERY_INVALID",
+        "validation" /* VALIDATION */
+      );
+    }
+    const expectedIssuer = this.authServerUrl;
+    if (metadata.issuer !== expectedIssuer) {
+      logger5.warning(
+        `Issuer mismatch: expected ${expectedIssuer}, got ${metadata.issuer}`,
+        { code: "AUTH_ISSUER_MISMATCH" }
+      );
+    }
+  }
+  /**
+   * Get cached metadata (throws if not discovered)
+   */
+  getMetadata() {
+    if (!this.cachedMetadata) {
+      throw new DbMcpError(
+        "Authorization server metadata not yet discovered. Call discover() first.",
+        "AUTH_DISCOVERY_REQUIRED",
+        "internal" /* INTERNAL */
+      );
+    }
+    return this.cachedMetadata;
+  }
+  /**
+   * Get JWKS URI from metadata
+   *
+   * @throws Error if metadata not discovered or jwks_uri not present
+   */
+  getJwksUri() {
+    const metadata = this.getMetadata();
+    if (!metadata.jwks_uri) {
+      throw new DbMcpError(
+        "Authorization server does not provide jwks_uri",
+        "AUTH_DISCOVERY_INVALID",
+        "validation" /* VALIDATION */
+      );
+    }
+    return metadata.jwks_uri;
+  }
+  /**
+   * Get token endpoint from metadata
+   */
+  getTokenEndpoint() {
+    return this.getMetadata().token_endpoint;
+  }
+  /**
+   * Get issuer from metadata
+   */
+  getIssuer() {
+    return this.getMetadata().issuer;
+  }
+  /**
+   * Get registration endpoint from metadata (RFC 7591)
+   *
+   * @returns Registration endpoint or null if not supported
+   */
+  getRegistrationEndpoint() {
+    return this.getMetadata().registration_endpoint ?? null;
+  }
+  /**
+   * Check if dynamic client registration is supported
+   */
+  supportsClientRegistration() {
+    return this.getRegistrationEndpoint() !== null;
+  }
+  /**
+   * Get supported scopes from metadata
+   */
+  getSupportedScopes() {
+    return this.getMetadata().scopes_supported ?? [];
+  }
+  /**
+   * Check if a specific scope is supported
+   */
+  isScopeSupported(scope) {
+    const supportedScopes = this.getSupportedScopes();
+    return supportedScopes.length === 0 || supportedScopes.includes(scope);
+  }
+  /**
+   * Clear cached metadata
+   */
+  clearCache() {
+    this.cachedMetadata = null;
+    this.cacheExpiry = 0;
+    logger5.info("Authorization server metadata cache cleared", {
+      code: "AUTH_CACHE_CLEARED"
+    });
+  }
+  /**
+   * Check if cache is valid
+   */
+  isCacheValid() {
+    return this.cachedMetadata !== null && Date.now() < this.cacheExpiry;
+  }
+  /**
+   * Get the authorization server URL
+   */
+  getAuthServerUrl() {
+    return this.authServerUrl;
+  }
+};
+var logger6 = createModuleLogger("AUTH");
+var TokenValidator = class {
+  /** Resolved configuration with all defaults applied */
+  jwksUri;
+  issuer;
+  audience;
+  clockTolerance;
+  jwksCacheTtl;
+  jwks = null;
+  jwksExpiry = 0;
+  constructor(config) {
+    this.jwksUri = config.jwksUri;
+    this.issuer = config.issuer;
+    this.audience = config.audience;
+    this.clockTolerance = config.clockTolerance ?? 60;
+    this.jwksCacheTtl = config.jwksCacheTtl ?? 3600;
+    logger6.info(`Token Validator initialized for issuer: ${this.issuer}`, {
+      code: "AUTH_INIT"
+    });
+  }
+  /**
+   * Validate an access token
+   *
+   * @param token - The JWT access token
+   * @returns Validation result with claims or error
+   */
+  async validate(token) {
+    try {
+      const jwks = this.getJwks();
+      const { payload } = await jose.jwtVerify(token, jwks, {
+        issuer: this.issuer,
+        audience: this.audience,
+        clockTolerance: this.clockTolerance
+      });
+      const claims = this.extractClaims(payload);
+      logger6.info(`Token validated for subject: ${claims.sub}`, {
+        code: "AUTH_TOKEN_VALID",
+        sub: claims.sub,
+        scopes: claims.scopes.length,
+        exp: new Date(claims.exp * 1e3).toISOString()
+      });
+      return {
+        valid: true,
+        claims
+      };
+    } catch (error) {
+      return this.handleValidationError(error);
+    }
+  }
+  /**
+   * Get or refresh the JWKS
+   */
+  getJwks() {
+    if (this.jwks && Date.now() < this.jwksExpiry) {
+      return this.jwks;
+    }
+    logger6.info(`Fetching JWKS from: ${this.jwksUri}`, {
+      code: "AUTH_JWKS_FETCH"
+    });
+    try {
+      this.jwks = jose.createRemoteJWKSet(new URL(this.jwksUri), {
+        cooldownDuration: 3e4,
+        // 30 seconds between retries
+        cacheMaxAge: this.jwksCacheTtl * 1e3
+      });
+      this.jwksExpiry = Date.now() + this.jwksCacheTtl * 1e3;
+      logger6.info(`JWKS cached for ${String(this.jwksCacheTtl)}s`, {
+        code: "AUTH_JWKS_CACHED"
+      });
+      return this.jwks;
+    } catch (error) {
+      const cause = error instanceof Error ? error : new Error(String(error));
+      logger6.error(`Failed to fetch JWKS: ${this.jwksUri}`, {
+        code: ERROR_CODES.AUTH.JWKS_FETCH_FAILED.full,
+        error: cause
+      });
+      throw new JwksFetchError(this.jwksUri, cause);
+    }
+  }
+  /**
+   * Extract and normalize token claims
+   */
+  extractClaims(payload) {
+    let scopes = [];
+    if (typeof payload["scope"] === "string") {
+      scopes = parseScopes(payload["scope"]);
+    } else if (Array.isArray(payload["scopes"])) {
+      scopes = payload["scopes"].filter(
+        (s) => typeof s === "string"
+      );
+    } else if (Array.isArray(payload["scope"])) {
+      scopes = payload["scope"].filter(
+        (s) => typeof s === "string"
+      );
+    }
+    return {
+      sub: payload.sub ?? "unknown",
+      scopes,
+      exp: payload.exp ?? 0,
+      iat: payload.iat ?? 0,
+      iss: payload.iss,
+      aud: payload.aud,
+      nbf: payload.nbf ?? void 0,
+      jti: payload.jti,
+      client_id: payload["client_id"],
+      // Include all other claims
+      ...payload
+    };
+  }
+  /**
+   * Handle validation errors and convert to TokenValidationResult
+   */
+  handleValidationError(error) {
+    if (error instanceof jose.errors.JWTExpired) {
+      logger6.warning("Token has expired", {
+        code: ERROR_CODES.AUTH.TOKEN_EXPIRED.full,
+        error
+      });
+      return {
+        valid: false,
+        error: "Token has expired",
+        errorCode: ERROR_CODES.AUTH.TOKEN_EXPIRED.full
+      };
+    }
+    if (error instanceof jose.errors.JWTClaimValidationFailed) {
+      logger6.warning(`Token claim validation failed: ${error.message}`, {
+        code: ERROR_CODES.AUTH.TOKEN_INVALID.full,
+        error
+      });
+      return {
+        valid: false,
+        error: `Token claim validation failed: ${error.message}`,
+        errorCode: ERROR_CODES.AUTH.TOKEN_INVALID.full
+      };
+    }
+    if (error instanceof jose.errors.JWSSignatureVerificationFailed) {
+      logger6.warning("Token signature verification failed", {
+        code: ERROR_CODES.AUTH.SIGNATURE_INVALID.full,
+        error
+      });
+      return {
+        valid: false,
+        error: "Token signature verification failed",
+        errorCode: ERROR_CODES.AUTH.SIGNATURE_INVALID.full
+      };
+    }
+    if (error instanceof jose.errors.JWKSNoMatchingKey) {
+      logger6.warning("No matching key found in JWKS", {
+        code: ERROR_CODES.AUTH.TOKEN_INVALID.full,
+        error
+      });
+      return {
+        valid: false,
+        error: "No matching key found in JWKS",
+        errorCode: ERROR_CODES.AUTH.TOKEN_INVALID.full
+      };
+    }
+    const message = error instanceof Error ? error.message : String(error);
+    logger6.error(`Token validation failed: ${message}`, {
+      code: ERROR_CODES.AUTH.TOKEN_INVALID.full,
+      error: error instanceof Error ? error : void 0
+    });
+    return {
+      valid: false,
+      error: `Token validation failed: ${message}`,
+      errorCode: ERROR_CODES.AUTH.TOKEN_INVALID.full
+    };
+  }
+  /**
+   * Refresh the JWKS cache
+   */
+  refreshJwks() {
+    this.jwks = null;
+    this.jwksExpiry = 0;
+    this.getJwks();
+    logger6.info("JWKS cache refreshed", { code: "AUTH_JWKS_REFRESHED" });
+  }
+  /**
+   * Clear the JWKS cache
+   */
+  clearCache() {
+    this.jwks = null;
+    this.jwksExpiry = 0;
+    logger6.info("Token validator cache cleared", {
+      code: "AUTH_CACHE_CLEARED"
+    });
+  }
+  /**
+   * Convert a validation error to the appropriate OAuth error class
+   */
+  static toOAuthError(result) {
+    if (result.errorCode === ERROR_CODES.AUTH.TOKEN_EXPIRED.full) {
+      return new TokenExpiredError();
+    }
+    if (result.errorCode === ERROR_CODES.AUTH.SIGNATURE_INVALID.full) {
+      return new InvalidSignatureError();
+    }
+    return new InvalidTokenError(result.error);
+  }
+};
+
+// src/transports/http/oauth.ts
+var logger7 = createModuleLogger("HTTP");
+function applyAuthMiddleware(state) {
+  if (state.config.oauth.enabled && state.tokenValidator && state.resourceServer && state.app) {
+    const authMiddleware = createAuthMiddleware({
+      tokenValidator: state.tokenValidator,
+      resourceServer: state.resourceServer,
+      publicPaths: ["/health", ...state.config.oauth.publicPaths ?? []]
+    });
+    state.app.use(authMiddleware);
+  } else if (state.config.authToken && state.app) {
+    state.app.use(createSimpleBearerAuth(state.config.authToken));
+    logger7.info("Simple bearer token authentication enabled", {
+      code: "AUTH_BEARER_ENABLED"
+    });
+  } else if (state.app) {
+    logger7.warning(
+      "No authentication configured for HTTP transport. Set --auth-token or --oauth-enabled for production deployments.",
+      { code: "AUTH_NONE" }
+    );
+  }
+}
+function createSimpleBearerAuth(expectedToken) {
+  const publicPaths = ["/health", "/", "/.well-known"];
+  return (req, res, next) => {
+    if (publicPaths.some((p) => req.path === p || req.path.startsWith(`${p}/`))) {
+      next();
+      return;
+    }
+    const authHeader = req.headers.authorization;
+    if (!authHeader?.startsWith("Bearer ")) {
+      res.status(401);
+      res.setHeader("WWW-Authenticate", 'Bearer realm="db-mcp"');
+      res.json({
+        error: "unauthorized",
+        error_description: "Bearer token required"
+      });
+      return;
+    }
+    const token = authHeader.slice(7);
+    if (token !== expectedToken) {
+      logger7.warning("Invalid bearer token rejected", {
+        code: "AUTH_BEARER_REJECTED"
+      });
+      res.status(401);
+      res.setHeader(
+        "WWW-Authenticate",
+        'Bearer realm="db-mcp", error="invalid_token"'
+      );
+      res.json({
+        error: "unauthorized",
+        error_description: "Invalid bearer token"
+      });
+      return;
+    }
+    next();
+  };
+}
+async function setupOAuth(state, resourceUri) {
+  logger7.info("Setting up OAuth 2.1...", { code: "HTTP_OAUTH_SETUP" });
+  state.resourceServer = new OAuthResourceServer({
+    resource: resourceUri,
+    authorizationServers: [state.config.oauth.authorizationServerUrl],
+    scopesSupported: [...SUPPORTED_SCOPES]
+  });
+  state.app?.get(
+    "/.well-known/oauth-protected-resource",
+    state.resourceServer.getMetadataHandler()
+  );
+  state.authServerDiscovery = new AuthorizationServerDiscovery({
+    authServerUrl: state.config.oauth.authorizationServerUrl
+  });
+  try {
+    const metadata = await state.authServerDiscovery.discover();
+    state.tokenValidator = new TokenValidator({
+      jwksUri: state.config.oauth.jwksUri ?? metadata.jwks_uri ?? "",
+      issuer: state.config.oauth.issuer ?? metadata.issuer,
+      audience: state.config.oauth.audience,
+      clockTolerance: state.config.oauth.clockTolerance
+    });
+    logger7.info("OAuth 2.1 setup complete", { code: "HTTP_OAUTH_READY" });
+  } catch (error) {
+    logger7.warning(
+      "Authorization server discovery failed. OAuth validation disabled.",
+      {
+        code: ERROR_CODES.AUTH.DISCOVERY_FAILED.full,
+        error: error instanceof Error ? error : void 0
+      }
+    );
+    if (!state.config.oauth.jwksUri) {
+      logger7.error(
+        "No JWKS URI available. Please provide oauth.jwksUri in config.",
+        { code: ERROR_CODES.AUTH.DISCOVERY_FAILED.full }
+      );
+      throw error;
+    }
+    state.tokenValidator = new TokenValidator({
+      jwksUri: state.config.oauth.jwksUri,
+      issuer: state.config.oauth.issuer ?? state.config.oauth.authorizationServerUrl,
+      audience: state.config.oauth.audience,
+      clockTolerance: state.config.oauth.clockTolerance
+    });
+  }
+}
+
+// src/transports/http/transport.ts
+var logger8 = createModuleLogger("HTTP");
+var HttpTransport = class {
+  /** Internal state shared with session/middleware/oauth modules */
+  state;
+  constructor(config) {
+    this.state = {
+      config: {
+        ...config,
+        host: config.host ?? "0.0.0.0",
+        stateless: config.stateless ?? false,
+        enableHSTS: config.enableHSTS ?? process.env["MCP_ENABLE_HSTS"] === "true"
+      },
+      app: null,
+      httpServer: null,
+      transports: /* @__PURE__ */ new Map(),
+      sseTransports: /* @__PURE__ */ new Map(),
+      statelessTransport: null,
+      resourceServer: null,
+      authServerDiscovery: null,
+      tokenValidator: null,
+      mcpServer: null,
+      rateLimitMap: /* @__PURE__ */ new Map(),
+      rateLimitCleanupTimer: null
+    };
+  }
+  /**
+   * Initialize the transport with the MCP server.
+   *
+   * For stateful mode, the server reference is stored to connect new sessions.
+   * For stateless mode, a single transport is created and connected.
+   *
+   * @param server - The MCP server instance
+   */
+  async initialize(server) {
+    logger8.info("Initializing HTTP transport...", {
+      code: "HTTP_INIT",
+      stateless: this.state.config.stateless
+    });
+    this.state.mcpServer = server;
+    this.state.app = express();
+    this.state.app.use(localhostHostValidation());
+    setupSecurityHeaders(this.state);
+    setupCors(this.state);
+    setupRateLimiting(this.state);
+    const maxBodyBytes = this.state.config.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES;
+    this.state.app.use(
+      express.json({ limit: maxBodyBytes })
+    );
+    const resourceUri = this.state.config.resourceUri ?? `http://localhost:${String(this.state.config.port)}`;
+    if (this.state.config.oauth.enabled) {
+      await setupOAuth(this.state, resourceUri);
+    }
+    this.state.app.get("/health", (_req, res) => {
+      res.json({
+        status: "healthy",
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        oauth: this.state.config.oauth.enabled,
+        mode: this.state.config.stateless ? "stateless" : "stateful",
+        activeSessions: this.state.transports.size
+      });
+    });
+    this.state.app.get("/", (_req, res) => {
+      res.json({
+        name: "db-mcp",
+        description: "SQLite MCP Server with dual HTTP transport",
+        mode: this.state.config.stateless ? "stateless" : "stateful",
+        endpoints: {
+          "POST /mcp": "JSON-RPC requests (Streamable HTTP, MCP 2025-03-26)",
+          "GET /mcp": this.state.config.stateless === true ? "Not available in stateless mode" : "SSE stream for server-to-client notifications",
+          "DELETE /mcp": "Session termination",
+          "GET /sse": "Legacy SSE connection (MCP 2024-11-05)",
+          "POST /messages": "Legacy SSE message endpoint",
+          "GET /health": "Health check"
+        },
+        documentation: "https://github.com/neverinfamous/db-mcp"
+      });
+    });
+    applyAuthMiddleware(this.state);
+    if (this.state.config.stateless) {
+      await setupStatelessEndpoints(this.state);
+    } else {
+      setupStatefulEndpoints(this.state);
+    }
+    if (!this.state.config.stateless) {
+      setupLegacySSEEndpoints(this.state);
+    }
+    this.state.app.use(oauthErrorHandler);
+    this.state.app.use((_req, res) => {
+      res.status(404).json({ error: "Not found" });
+    });
+    logger8.info("HTTP transport initialized", {
+      code: "HTTP_INIT_COMPLETE",
+      port: this.state.config.port,
+      oauth: this.state.config.oauth.enabled,
+      mode: this.state.config.stateless ? "stateless" : "stateful",
+      resourceUri
+    });
+  }
+  /**
+   * Start listening on the configured port
+   */
+  async start() {
+    if (!this.state.app) {
+      throw new DbMcpError(
+        "Transport not initialized. Call initialize() first.",
+        ERROR_CODES.SERVER.START_FAILED.full,
+        "internal" /* INTERNAL */
+      );
+    }
+    return new Promise((resolve, reject) => {
+      try {
+        this.state.httpServer = this.state.app?.listen(
+          this.state.config.port,
+          this.state.config.host ?? "0.0.0.0",
+          () => {
+            if (this.state.httpServer) {
+              this.state.httpServer.setTimeout(HTTP_REQUEST_TIMEOUT_MS);
+              this.state.httpServer.keepAliveTimeout = HTTP_KEEP_ALIVE_TIMEOUT_MS;
+              this.state.httpServer.headersTimeout = HTTP_HEADERS_TIMEOUT_MS;
+            }
+            logger8.info(
+              `HTTP server listening on ${this.state.config.host ?? "0.0.0.0"}:${String(this.state.config.port)}`,
+              {
+                code: "HTTP_SERVER_STARTED",
+                mode: this.state.config.stateless ? "stateless" : "stateful"
+              }
+            );
+            resolve();
+          }
+        ) ?? null;
+        this.state.httpServer?.on("error", (error) => {
+          logger8.error("Failed to start HTTP server", {
+            code: ERROR_CODES.SERVER.START_FAILED.full,
+            error
+          });
+          reject(error);
+        });
+      } catch (error) {
+        reject(error instanceof Error ? error : new Error(String(error)));
+      }
+    });
+  }
+  /**
+   * Stop the server and close all active sessions
+   */
+  async stop() {
+    if (this.state.rateLimitCleanupTimer) {
+      clearInterval(this.state.rateLimitCleanupTimer);
+      this.state.rateLimitCleanupTimer = null;
+    }
+    for (const [sessionId, transport] of this.state.transports) {
+      try {
+        logger8.debug("Closing transport", {
+          code: "HTTP_SESSION_CLEANUP",
+          sessionId
+        });
+        await transport.close();
+      } catch (error) {
+        logger8.error("Error closing transport", {
+          code: ERROR_CODES.SERVER.SHUTDOWN_FAILED.full,
+          sessionId,
+          error: error instanceof Error ? error : void 0
+        });
+      }
+    }
+    this.state.transports.clear();
+    for (const [sessionId, transport] of this.state.sseTransports) {
+      try {
+        logger8.debug("Closing SSE transport", {
+          code: "SSE_SESSION_CLEANUP",
+          sessionId
+        });
+        await transport.close();
+      } catch (error) {
+        logger8.error("Error closing SSE transport", {
+          code: ERROR_CODES.SERVER.SHUTDOWN_FAILED.full,
+          sessionId,
+          error: error instanceof Error ? error : void 0
+        });
+      }
+    }
+    this.state.sseTransports.clear();
+    if (this.state.statelessTransport) {
+      try {
+        await this.state.statelessTransport.close();
+      } catch (error) {
+        logger8.error("Error closing stateless transport", {
+          code: ERROR_CODES.SERVER.SHUTDOWN_FAILED.full,
+          error: error instanceof Error ? error : void 0
+        });
+      }
+    }
+    return new Promise((resolve, reject) => {
+      if (!this.state.httpServer) {
+        resolve();
+        return;
+      }
+      this.state.httpServer.close((error) => {
+        if (error) {
+          logger8.error("Error stopping HTTP server", {
+            code: ERROR_CODES.SERVER.SHUTDOWN_FAILED.full,
+            error
+          });
+          reject(error);
+        } else {
+          logger8.info("HTTP server stopped", { code: "HTTP_SERVER_STOPPED" });
+          resolve();
+        }
+      });
+    });
+  }
+  /**
+   * Get the underlying Express app
+   */
+  getApp() {
+    return this.state.app;
+  }
+  /**
+   * Get the number of active sessions (stateful mode only)
+   */
+  getActiveSessionCount() {
+    return this.state.transports.size;
+  }
+  /**
+   * Get the OAuth Resource Server
+   */
+  getResourceServer() {
+    return this.state.resourceServer;
+  }
+};
+function createHttpTransport(config) {
+  return new HttpTransport(config);
+}
+
+export { HttpTransport, createHttpTransport };