db-mcp 2.0.0 → 3.0.0

package/dist/audit/logger.d.ts

@@ -0,0 +1,62 @@
+/**
+ * db-mcp — Audit Logger
+ *
+ * Async-buffered JSONL writer for the audit trail. Appends one
+ * JSON object per line to a configurable file path, or writes to
+ * stderr for containerised deployments (`--audit-log stderr`).
+ *
+ * Non-throwing by design: audit failures log to stderr but never
+ * propagate to tool callers.
+ */
+import type { AuditConfig, AuditEntry } from "./types.js";
+export declare class AuditLogger {
+    readonly config: AuditConfig;
+    private buffer;
+    private flushTimer;
+    private activeFlush;
+    private closed;
+    private dirEnsured;
+    private readonly stderrMode;
+    constructor(config: AuditConfig);
+    /**
+     * Eagerly create the log directory and touch the log file on startup.
+     * Provides immediate confirmation that audit is configured correctly.
+     * Non-throwing — falls back silently if the path is inaccessible.
+     */
+    init(): Promise<void>;
+    /**
+     * Append an audit entry to the buffer.
+     * Non-blocking — the entry is serialised and queued; the
+     * actual file write happens on the next flush cycle.
+     */
+    log(entry: AuditEntry): void;
+    /**
+     * Flush the buffer to disk.
+     * Safe to call concurrently — serialises via `this.activeFlush` Promise.
+     */
+    flush(): Promise<void>;
+    /**
+     * Gracefully close the logger — flush remaining entries and stop the timer.
+     */
+    close(): Promise<void>;
+    /**
+     * Read the most recent audit entries from the log file.
+     * Uses a streaming tail-read: only the last TAIL_READ_BYTES (64 KB) are
+     * read from disk, preventing O(n) memory spikes for large audit logs.
+     * Used by the `sqlite://audit` resource.
+     *
+     * @param count Maximum number of entries to return (default 50)
+     */
+    recent(count?: number): Promise<AuditEntry[]>;
+    /**
+     * Ensure the parent directory of the log file exists.
+     */
+    private ensureDirectory;
+    /**
+     * Rotate the log file if it exceeds the configured size limit.
+     * Keeps up to 5 rotated files (`.1` through `.5`); older data is discarded.
+     * Rotation failure is non-fatal — audit must not block tool execution.
+     */
+    private rotateIfNeeded;
+}
+//# sourceMappingURL=logger.d.ts.map

package/dist/audit/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/audit/logger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAsB1D,qBAAa,WAAW;IACtB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAE7B,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,UAAU,CAA+C;IACjE,OAAO,CAAC,WAAW,CAA8B;IACjD,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAU;gBAEzB,MAAM,EAAE,WAAW;IAa/B;;;;OAIG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAgB3B;;;;OAIG;IACH,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI;IAa5B;;;OAGG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAgD5B;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAW5B;;;;;;;OAOG;IACG,MAAM,CAAC,KAAK,GAAE,MAA6B,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAqDzE;;OAEG;YACW,eAAe;IAW7B;;;;OAIG;YACW,cAAc;CAoB7B"}

package/dist/audit/types.d.ts

@@ -0,0 +1,112 @@
+/**
+ * db-mcp — Audit Log Types
+ *
+ * Types and configuration for the JSONL audit trail.
+ * Records write/admin tool invocations with timing
+ * and outcome for forensic-grade visibility.
+ */
+/** Category of the audited operation */
+export type AuditCategory = "read" | "write" | "admin" | "auth" | "error";
+/**
+ * Single audit log entry — serialised as one line of JSONL.
+ *
+ * The `backup` field holds the relative path to the pre-mutation snapshot
+ * file when audit backup is enabled, or `undefined` when disabled.
+ */
+export interface AuditEntry {
+    /** ISO 8601 timestamp */
+    timestamp: string;
+    /** Correlates with RequestContext.requestId */
+    requestId: string;
+    /** MCP tool name (e.g. "sqlite_write_query") */
+    tool: string;
+    /** Operation category */
+    category: AuditCategory;
+    /** OAuth scope required for this tool */
+    scope: string;
+    /** OAuth subject claim — null when OAuth is not configured */
+    user: string | null;
+    /** All scopes present on the calling token */
+    scopes: string[];
+    /** Execution duration in milliseconds */
+    durationMs: number;
+    /** Whether the tool executed successfully */
+    success: boolean;
+    /** Error message when success is false */
+    error?: string | undefined;
+    /** Tool input arguments (omitted in redact mode) */
+    args?: Record<string, unknown> | undefined;
+    /** Relative path to the pre-mutation snapshot file; undefined when audit backup is disabled. */
+    backup?: string | undefined;
+    /** Estimated token count of the tool response (~4 bytes per token) */
+    tokenEstimate?: number | undefined;
+}
+/** Audit log configuration */
+export interface AuditConfig {
+    /** Master switch — false means no interceptor is created */
+    enabled: boolean;
+    /** Absolute path to the JSONL output file */
+    logPath: string;
+    /** When true, tool arguments are omitted from entries */
+    redact: boolean;
+    /** When true, read-scoped tools are also logged (default: false) */
+    auditReads: boolean;
+    /** Maximum log file size in bytes before rotation (default: 10MB). 0 = no rotation. */
+    maxSizeBytes: number;
+    /** Pre-mutation backup configuration (optional — backup disabled when absent). */
+    backup?: BackupConfig | undefined;
+}
+/** Pre-mutation backup configuration */
+export interface BackupConfig {
+    /** Enable pre-mutation snapshots */
+    enabled: boolean;
+    /** Include sample data rows in snapshots (default: schema-only) */
+    includeData: boolean;
+    /** Maximum snapshot age in days before cleanup (default: 30) */
+    maxAgeDays: number;
+    /** Maximum number of snapshots to retain (default: 1000) */
+    maxCount: number;
+    /** Maximum table size in bytes for data capture (default: 50MB). Tables exceeding this get DDL-only snapshots. */
+    maxDataSizeBytes: number;
+}
+/** Snapshot metadata stored alongside the DDL capture */
+export interface SnapshotMetadata {
+    /** ISO 8601 timestamp */
+    timestamp: string;
+    /** Tool that triggered the snapshot */
+    tool: string;
+    /** Target object (table, index, view) */
+    target: string;
+    /** Snapshot type: ddl-only or ddl+data */
+    type: "ddl" | "ddl+data";
+    /** Original audit requestId for correlation */
+    requestId: string;
+    /** Size of snapshot file in bytes */
+    sizeBytes: number;
+    /** Snapshot filename (populated by listSnapshots for getSnapshot lookup) */
+    filename?: string;
+    /** Approximate row count at snapshot time */
+    rowCount?: number;
+    /** Whether data capture was skipped due to size exceeding threshold */
+    dataSkipped?: boolean;
+    /** Reason data capture was skipped */
+    dataSkippedReason?: string;
+}
+/** Stored snapshot file content */
+export interface SnapshotContent {
+    /** Snapshot metadata */
+    metadata: SnapshotMetadata;
+    /** CREATE TABLE / CREATE INDEX / CREATE VIEW DDL from sqlite_master */
+    ddl: string;
+    /** Optional INSERT statements for sample data */
+    data?: string | undefined;
+}
+/** Default maximum JSONL audit log size before rotation (10 MB). */
+export declare const DEFAULT_AUDIT_LOG_MAX_SIZE_BYTES: number;
+/** Default maximum table size for data capture in snapshots (50 MB). */
+export declare const DEFAULT_AUDIT_BACKUP_MAX_DATA_SIZE_BYTES: number;
+/** Default maximum snapshot age in days before cleanup. */
+export declare const DEFAULT_AUDIT_BACKUP_MAX_AGE_DAYS = 30;
+/** Default maximum number of snapshots to retain. */
+export declare const DEFAULT_AUDIT_BACKUP_MAX_COUNT = 1000;
+//# sourceMappingURL=types.d.ts.map

package/dist/audit/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/audit/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,wCAAwC;AACxC,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;AAE1E;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,yBAAyB;IACzB,SAAS,EAAE,MAAM,CAAC;IAElB,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;IAElB,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAC;IAEb,yBAAyB;IACzB,QAAQ,EAAE,aAAa,CAAC;IAExB,yCAAyC;IACzC,KAAK,EAAE,MAAM,CAAC;IAEd,8DAA8D;IAC9D,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAEpB,8CAA8C;IAC9C,MAAM,EAAE,MAAM,EAAE,CAAC;IAEjB,yCAAyC;IACzC,UAAU,EAAE,MAAM,CAAC;IAEnB,6CAA6C;IAC7C,OAAO,EAAE,OAAO,CAAC;IAEjB,0CAA0C;IAC1C,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAE3B,oDAAoD;IACpD,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;IAE3C,gGAAgG;IAChG,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAE5B,sEAAsE;IACtE,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACpC;AAED,8BAA8B;AAC9B,MAAM,WAAW,WAAW;IAC1B,4DAA4D;IAC5D,OAAO,EAAE,OAAO,CAAC;IAEjB,6CAA6C;IAC7C,OAAO,EAAE,MAAM,CAAC;IAEhB,yDAAyD;IACzD,MAAM,EAAE,OAAO,CAAC;IAEhB,oEAAoE;IACpE,UAAU,EAAE,OAAO,CAAC;IAEpB,uFAAuF;IACvF,YAAY,EAAE,MAAM,CAAC;IAErB,kFAAkF;IAClF,MAAM,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;CACnC;AAED,wCAAwC;AACxC,MAAM,WAAW,YAAY;IAC3B,oCAAoC;IACpC,OAAO,EAAE,OAAO,CAAC;IAEjB,mEAAmE;IACnE,WAAW,EAAE,OAAO,CAAC;IAErB,gEAAgE;IAChE,UAAU,EAAE,MAAM,CAAC;IAEnB,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAC;IAEjB,kHAAkH;IAClH,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,yDAAyD;AACzD,MAAM,WAAW,gBAAgB;IAC/B,yBAAyB;IACzB,SAAS,EAAE,MAAM,CAAC;IAElB,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAC;IAEb,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAC;IAEf,0CAA0C;IAC1C,IAAI,EAAE,KAAK,GAAG,UAAU,CAAC;IAEzB,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;IAElB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAElB,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,6CAA6C;IAC7C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,uEAAuE;IACvE,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB,sCAAsC;IACtC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,mCAAmC;AACnC,MAAM,WAAW,eAAe;IAC9B,wBAAwB;IACxB,QAAQ,EAAE,gBAAgB,CAAC;IAE3B,uEAAuE;IACvE,GAAG,EAAE,MAAM,CAAC;IAEZ,iDAAiD;IACjD,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3B;AAMD,oEAAoE;AACpE,eAAO,MAAM,gCAAgC,QAAmB,CAAC;AAEjE,wEAAwE;AACxE,eAAO,MAAM,wCAAwC,QAAmB,CAAC;AAEzE,2DAA2D;AAC3D,eAAO,MAAM,iCAAiC,KAAK,CAAC;AAEpD,qDAAqD;AACrD,eAAO,MAAM,8BAA8B,OAAQ,CAAC"}

package/dist/auth/auth-context.d.ts

@@ -0,0 +1,28 @@
+/**
+ * db-mcp — Auth Context (AsyncLocalStorage)
+ *
+ * Provides per-request authentication context threading using Node.js
+ * AsyncLocalStorage. Allows the HTTP transport to store the validated
+ * auth context so that tool handlers can enforce per-tool scopes
+ * without direct parameter coupling through the MCP SDK layer.
+ */
+import type { AuthenticatedContext } from "./middleware/index.js";
+/**
+ * Run a function within an authenticated context.
+ * Called by the HTTP transport after token validation.
+ *
+ * @param context - The validated auth context from middleware
+ * @param fn - The async function to run (MCP SDK request handling)
+ * @returns The result of the wrapped function
+ */
+export declare function runWithAuthContext<T>(context: AuthenticatedContext, fn: () => T): T;
+/**
+ * Get the current request's auth context.
+ * Returns undefined when:
+ * - OAuth is not configured (stdio transport, no auth)
+ * - Called outside of an HTTP request context
+ *
+ * Tool handlers use this to enforce per-tool scope checks.
+ */
+export declare function getAuthContext(): AuthenticatedContext | undefined;
+//# sourceMappingURL=auth-context.d.ts.map

package/dist/auth/auth-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-context.d.ts","sourceRoot":"","sources":["../../src/auth/auth-context.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAQlE;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAClC,OAAO,EAAE,oBAAoB,EAC7B,EAAE,EAAE,MAAM,CAAC,GACV,CAAC,CAEH;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,IAAI,oBAAoB,GAAG,SAAS,CAEjE"}

package/dist/auth/authorization-server-discovery.d.ts

@@ -0,0 +1,90 @@
+/**
+ * db-mcp - Authorization Server Discovery (RFC 8414)
+ *
+ * Discovers and caches OAuth 2.1 Authorization Server Metadata
+ * as specified in RFC 8414.
+ *
+ * @see https://datatracker.ietf.org/doc/html/rfc8414
+ */
+import type { AuthorizationServerMetadata, AuthServerDiscoveryConfig } from "./types.js";
+/**
+ * Authorization Server Metadata Discovery
+ *
+ * Fetches and caches OAuth 2.1 authorization server metadata
+ * from the /.well-known/oauth-authorization-server endpoint.
+ */
+export declare class AuthorizationServerDiscovery {
+    private readonly authServerUrl;
+    private readonly cacheTtl;
+    private readonly timeout;
+    private cachedMetadata;
+    private cacheExpiry;
+    constructor(config: AuthServerDiscoveryConfig);
+    /**
+     * Discover authorization server metadata
+     *
+     * Fetches from /.well-known/oauth-authorization-server
+     * Results are cached for cacheTtl seconds.
+     *
+     * @returns Authorization server metadata
+     * @throws AuthServerDiscoveryError if discovery fails
+     */
+    discover(): Promise<AuthorizationServerMetadata>;
+    /**
+     * Validate required metadata fields per RFC 8414
+     */
+    private validateMetadata;
+    /**
+     * Get cached metadata (throws if not discovered)
+     */
+    getMetadata(): AuthorizationServerMetadata;
+    /**
+     * Get JWKS URI from metadata
+     *
+     * @throws Error if metadata not discovered or jwks_uri not present
+     */
+    getJwksUri(): string;
+    /**
+     * Get token endpoint from metadata
+     */
+    getTokenEndpoint(): string;
+    /**
+     * Get issuer from metadata
+     */
+    getIssuer(): string;
+    /**
+     * Get registration endpoint from metadata (RFC 7591)
+     *
+     * @returns Registration endpoint or null if not supported
+     */
+    getRegistrationEndpoint(): string | null;
+    /**
+     * Check if dynamic client registration is supported
+     */
+    supportsClientRegistration(): boolean;
+    /**
+     * Get supported scopes from metadata
+     */
+    getSupportedScopes(): string[];
+    /**
+     * Check if a specific scope is supported
+     */
+    isScopeSupported(scope: string): boolean;
+    /**
+     * Clear cached metadata
+     */
+    clearCache(): void;
+    /**
+     * Check if cache is valid
+     */
+    isCacheValid(): boolean;
+    /**
+     * Get the authorization server URL
+     */
+    getAuthServerUrl(): string;
+}
+/**
+ * Create an Authorization Server Discovery instance
+ */
+export declare function createAuthServerDiscovery(authServerUrl: string, options?: Partial<Omit<AuthServerDiscoveryConfig, "authServerUrl">>): AuthorizationServerDiscovery;
+//# sourceMappingURL=authorization-server-discovery.d.ts.map

package/dist/auth/authorization-server-discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-server-discovery.d.ts","sourceRoot":"","sources":["../../src/auth/authorization-server-discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,2BAA2B,EAC3B,yBAAyB,EAC1B,MAAM,YAAY,CAAC;AAWpB;;;;;GAKG;AACH,qBAAa,4BAA4B;IACvC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IAEjC,OAAO,CAAC,cAAc,CAA4C;IAClE,OAAO,CAAC,WAAW,CAAK;gBAEZ,MAAM,EAAE,yBAAyB;IAgC7C;;;;;;;;OAQG;IACG,QAAQ,IAAI,OAAO,CAAC,2BAA2B,CAAC;IAqEtD;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAyCxB;;OAEG;IACH,WAAW,IAAI,2BAA2B;IAW1C;;;;OAIG;IACH,UAAU,IAAI,MAAM;IAcpB;;OAEG;IACH,gBAAgB,IAAI,MAAM;IAI1B;;OAEG;IACH,SAAS,IAAI,MAAM;IAInB;;;;OAIG;IACH,uBAAuB,IAAI,MAAM,GAAG,IAAI;IAIxC;;OAEG;IACH,0BAA0B,IAAI,OAAO;IAIrC;;OAEG;IACH,kBAAkB,IAAI,MAAM,EAAE;IAI9B;;OAEG;IACH,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAMxC;;OAEG;IACH,UAAU,IAAI,IAAI;IAQlB;;OAEG;IACH,YAAY,IAAI,OAAO;IAIvB;;OAEG;IACH,gBAAgB,IAAI,MAAM;CAG3B;AAMD;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,aAAa,EAAE,MAAM,EACrB,OAAO,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,yBAAyB,EAAE,eAAe,CAAC,CAAC,GAClE,4BAA4B,CAM9B"}

package/dist/auth/errors.d.ts

@@ -0,0 +1,74 @@
+/**
+ * db-mcp - OAuth Error Classes
+ *
+ * Module-prefixed error classes for OAuth 2.1 authentication
+ * and authorization failures.
+ */
+import { DbMcpError } from "../utils/errors/index.js";
+/**
+ * Base class for OAuth-related errors
+ */
+export declare class OAuthError extends DbMcpError {
+    /** HTTP status code for this error */
+    readonly httpStatus: number;
+    /** WWW-Authenticate header value */
+    readonly wwwAuthenticate?: string | undefined;
+    constructor(message: string, code: string, httpStatus: number, details?: Record<string, unknown>, wwwAuthenticate?: string);
+}
+/**
+ * Token is missing from the request
+ */
+export declare class TokenMissingError extends OAuthError {
+    constructor(realm?: string);
+}
+/**
+ * Token is invalid (malformed, wrong format, etc.)
+ */
+export declare class InvalidTokenError extends OAuthError {
+    constructor(message?: string, details?: Record<string, unknown>);
+}
+/**
+ * Token has expired
+ */
+export declare class TokenExpiredError extends OAuthError {
+    constructor(expiredAt?: Date);
+}
+/**
+ * Token signature is invalid
+ */
+export declare class InvalidSignatureError extends OAuthError {
+    constructor(message?: string);
+}
+/**
+ * Token does not have required scope
+ */
+export declare class InsufficientScopeError extends OAuthError {
+    constructor(_requiredScope: string | string[], _providedScopes?: string[]);
+}
+/**
+ * Failed to discover authorization server metadata
+ */
+export declare class AuthServerDiscoveryError extends OAuthError {
+    constructor(serverUrl: string, cause?: Error);
+}
+/**
+ * Failed to fetch JWKS
+ */
+export declare class JwksFetchError extends OAuthError {
+    constructor(jwksUri: string, cause?: Error);
+}
+/**
+ * Failed to register client
+ */
+export declare class ClientRegistrationError extends OAuthError {
+    constructor(message: string, details?: Record<string, unknown>);
+}
+/**
+ * Check if an error is an OAuth error
+ */
+export declare function isOAuthError(error: unknown): error is OAuthError;
+/**
+ * Get WWW-Authenticate header for an OAuth error
+ */
+export declare function getWWWAuthenticateHeader(error: OAuthError, realm?: string): string;
+//# sourceMappingURL=errors.d.ts.map

package/dist/auth/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/auth/errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAiB,MAAM,0BAA0B,CAAC;AAOrE;;GAEG;AACH,qBAAa,UAAW,SAAQ,UAAU;IACxC,sCAAsC;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,oCAAoC;IACpC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;gBAG5C,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,eAAe,CAAC,EAAE,MAAM;CAO3B;AAMD;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,UAAU;gBACnC,KAAK,SAAW;CAU7B;AAED;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,UAAU;gBAE7C,OAAO,SAAyB,EAChC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAWpC;AAED;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,UAAU;gBACnC,SAAS,CAAC,EAAE,IAAI;CAU7B;AAED;;GAEG;AACH,qBAAa,qBAAsB,SAAQ,UAAU;gBACvC,OAAO,SAAwC;CAU5D;AAMD;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,UAAU;gBACxC,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,EAAE,eAAe,CAAC,EAAE,MAAM,EAAE;CAU1E;AAMD;;GAEG;AACH,qBAAa,wBAAyB,SAAQ,UAAU;gBAC1C,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK;CAY7C;AAED;;GAEG;AACH,qBAAa,cAAe,SAAQ,UAAU;gBAChC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK;CAY3C;AAED;;GAEG;AACH,qBAAa,uBAAwB,SAAQ,UAAU;gBACzC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAI/D;AAMD;;GAEG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,UAAU,CAEhE;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,UAAU,EACjB,KAAK,SAAW,GACf,MAAM,CAER"}

package/dist/auth/middleware/core.d.ts

@@ -0,0 +1,22 @@
+import type { TokenClaims } from "../types.js";
+import type { TokenValidator } from "../token-validator.js";
+export interface AuthenticatedContext {
+    /** Whether request is authenticated */
+    authenticated: boolean;
+    /** Token claims (if authenticated) */
+    claims?: TokenClaims | undefined;
+    /** Token scopes (convenience) */
+    scopes: string[];
+    /** Client IP address for rate limiting fallback */
+    clientIp?: string | undefined;
+}
+export declare function createAuthenticatedContext(authHeader: string | undefined, tokenValidator: TokenValidator): Promise<AuthenticatedContext>;
+export declare function validateAuth(authHeader: string | undefined, tokenValidator: TokenValidator, options?: {
+    required?: boolean;
+    requiredScopes?: string[];
+}): Promise<AuthenticatedContext>;
+export declare function formatOAuthError(error: unknown): {
+    status: number;
+    body: object;
+};
+//# sourceMappingURL=core.d.ts.map

package/dist/auth/middleware/core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../../../src/auth/middleware/core.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAS5D,MAAM,WAAW,oBAAoB;IACnC,uCAAuC;IACvC,aAAa,EAAE,OAAO,CAAC;IAEvB,sCAAsC;IACtC,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IAEjC,iCAAiC;IACjC,MAAM,EAAE,MAAM,EAAE,CAAC;IAEjB,mDAAmD;IACnD,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/B;AAED,wBAAsB,0BAA0B,CAC9C,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,cAAc,EAAE,cAAc,GAC7B,OAAO,CAAC,oBAAoB,CAAC,CAkB/B;AAED,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,cAAc,EAAE,cAAc,EAC9B,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;CAAO,GAC9D,OAAO,CAAC,oBAAoB,CAAC,CAiC/B;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd,CAsCA"}

package/dist/auth/middleware/express-auth.d.ts

@@ -0,0 +1,13 @@
+import type { RequestHandler } from "express";
+import type { TokenValidator } from "../token-validator.js";
+import type { OAuthResourceServer } from "../oauth-resource-server.js";
+export interface AuthMiddlewareConfig {
+    /** Token validator instance */
+    tokenValidator: TokenValidator;
+    /** Resource server instance (for WWW-Authenticate header) */
+    resourceServer: OAuthResourceServer;
+    /** Paths that bypass authentication (e.g., '/.well-known/*', '/health') */
+    publicPaths?: string[];
+}
+export declare function createAuthMiddleware(config: AuthMiddlewareConfig): RequestHandler;
+//# sourceMappingURL=express-auth.d.ts.map

package/dist/auth/middleware/express-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"express-auth.d.ts","sourceRoot":"","sources":["../../../src/auth/middleware/express-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAmC,cAAc,EAAE,MAAM,SAAS,CAAC;AAC/E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAOvE,MAAM,WAAW,oBAAoB;IACnC,+BAA+B;IAC/B,cAAc,EAAE,cAAc,CAAC;IAE/B,6DAA6D;IAC7D,cAAc,EAAE,mBAAmB,CAAC;IAEpC,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAuBD,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,oBAAoB,GAC3B,cAAc,CAuFhB"}

package/dist/auth/middleware/express-scopes.d.ts

@@ -0,0 +1,6 @@
+import type { Request, Response, NextFunction, RequestHandler } from "express";
+export declare function requireScope(scope: string): RequestHandler;
+export declare function requireAnyScope(scopes: string[]): RequestHandler;
+export declare function requireToolScope(toolName: string): RequestHandler;
+export declare function oauthErrorHandler(error: Error, _req: Request, res: Response, next: NextFunction): void;
+//# sourceMappingURL=express-scopes.d.ts.map

package/dist/auth/middleware/express-scopes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"express-scopes.d.ts","sourceRoot":"","sources":["../../../src/auth/middleware/express-scopes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAO/E,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,CAqC1D;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,cAAc,CA4ChE;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,CAqCjE;AAED,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,KAAK,EACZ,IAAI,EAAE,OAAO,EACb,GAAG,EAAE,QAAQ,EACb,IAAI,EAAE,YAAY,GACjB,IAAI,CAgBN"}

package/dist/auth/middleware/extraction.d.ts

@@ -0,0 +1,2 @@
+export declare function extractBearerToken(authHeader: string | undefined): string | null;
+//# sourceMappingURL=extraction.d.ts.map

package/dist/auth/middleware/extraction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extraction.d.ts","sourceRoot":"","sources":["../../../src/auth/middleware/extraction.ts"],"names":[],"mappings":"AAAA,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B,MAAM,GAAG,IAAI,CAmBf"}

package/dist/auth/middleware/index.d.ts

@@ -0,0 +1,5 @@
+export * from "./extraction.js";
+export * from "./core.js";
+export * from "./express-auth.js";
+export * from "./express-scopes.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/middleware/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/middleware/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,WAAW,CAAC;AAC1B,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC"}

package/dist/auth/oauth-resource-server.d.ts

@@ -0,0 +1,74 @@
+/**
+ * db-mcp - OAuth Protected Resource Server (RFC 9728)
+ *
+ * Implements the OAuth 2.1 Protected Resource Metadata endpoint
+ * as specified in RFC 9728.
+ *
+ * @see https://datatracker.ietf.org/doc/html/rfc9728
+ */
+import type { RequestHandler } from "express";
+import type { ProtectedResourceMetadata, ResourceServerConfig } from "./types.js";
+/**
+ * OAuth 2.1 Protected Resource Server
+ *
+ * Provides Protected Resource Metadata (RFC 9728) for MCP authorization.
+ */
+export declare class OAuthResourceServer {
+    private readonly config;
+    private metadata;
+    constructor(config: ResourceServerConfig);
+    /**
+     * Get the Protected Resource Metadata document
+     *
+     * @returns RFC 9728 compliant metadata
+     */
+    getMetadata(): ProtectedResourceMetadata;
+    /**
+     * Build the Protected Resource Metadata document
+     */
+    private buildMetadata;
+    /**
+     * Get Express request handler for the metadata endpoint
+     *
+     * Serves: GET /.well-known/oauth-protected-resource
+     */
+    getMetadataHandler(): RequestHandler;
+    /**
+     * Generate WWW-Authenticate header for 401 responses
+     *
+     * @param error - Error type for the header
+     * @param errorDescription - Human-readable error description
+     * @returns WWW-Authenticate header value
+     */
+    getWWWAuthenticateHeader(error?: string, errorDescription?: string): string;
+    /**
+     * Get the resource URI
+     */
+    getResourceUri(): string;
+    /**
+     * Get the authorization servers
+     */
+    getAuthorizationServers(): string[];
+    /**
+     * Get supported scopes
+     */
+    getSupportedScopes(): string[];
+    /**
+     * Check if a scope is supported by this resource server.
+     * Validates standard scopes and dynamic patterns (db:*, table:*:*).
+     */
+    isScopeSupported(scope: string): boolean;
+    /**
+     * Get the well-known metadata endpoint path
+     */
+    getWellKnownPath(): string;
+    /**
+     * Clear cached metadata (useful when configuration changes)
+     */
+    clearCache(): void;
+}
+/**
+ * Create an OAuth Resource Server instance
+ */
+export declare function createOAuthResourceServer(config: ResourceServerConfig): OAuthResourceServer;
+//# sourceMappingURL=oauth-resource-server.d.ts.map

package/dist/auth/oauth-resource-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-resource-server.d.ts","sourceRoot":"","sources":["../../src/auth/oauth-resource-server.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,KAAK,EACV,yBAAyB,EACzB,oBAAoB,EACrB,MAAM,YAAY,CAAC;AAUpB;;;;GAIG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiC;IACxD,OAAO,CAAC,QAAQ,CAA0C;gBAE9C,MAAM,EAAE,oBAAoB;IAiBxC;;;;OAIG;IACH,WAAW,IAAI,yBAAyB;IAKxC;;OAEG;IACH,OAAO,CAAC,aAAa;IAWrB;;;;OAIG;IACH,kBAAkB,IAAI,cAAc;IAcpC;;;;;;OAMG;IACH,wBAAwB,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM;IAkB3E;;OAEG;IACH,cAAc,IAAI,MAAM;IAIxB;;OAEG;IACH,uBAAuB,IAAI,MAAM,EAAE;IAInC;;OAEG;IACH,kBAAkB,IAAI,MAAM,EAAE;IAI9B;;;OAGG;IACH,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAcxC;;OAEG;IACH,gBAAgB,IAAI,MAAM;IAI1B;;OAEG;IACH,UAAU,IAAI,IAAI;CAGnB;AAMD;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,oBAAoB,GAC3B,mBAAmB,CAErB"}

package/dist/auth/scope-map.d.ts

@@ -0,0 +1,24 @@
+/**
+ * db-mcp — Tool Scope Map
+ *
+ * Builds a reverse lookup from tool name to required OAuth scope
+ * by inverting TOOL_GROUPS × TOOL_GROUP_SCOPES. Computed once at
+ * module load for O(1) per-call lookup.
+ */
+/**
+ * Register a tool's required scope dynamically.
+ * Replaces the old static group derivation.
+ */
+export declare function registerToolScope(toolName: string, scope: string): void;
+/**
+ * Get the required scope for a tool by name.
+ *
+ * @param toolName - The MCP tool name (e.g., "sqlite_read_query")
+ * @returns The required scope, or "admin" as a fail-closed default for unknown tools
+ */
+export declare function getRequiredScope(toolName: string): string;
+/**
+ * Get the full tool-to-scope map (for testing/debugging).
+ */
+export declare function getToolScopeMap(): ReadonlyMap<string, string>;
+//# sourceMappingURL=scope-map.d.ts.map

package/dist/auth/scope-map.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-map.d.ts","sourceRoot":"","sources":["../../src/auth/scope-map.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAUH;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAOvE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED;;GAEG;AACH,wBAAgB,eAAe,IAAI,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAE7D"}

package/dist/auth/scopes/constants.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Standard OAuth scopes for db-mcp
+ */
+export declare const SCOPES: {
+    /** Read-only access to all databases */
+    readonly READ: "read";
+    /** Read and write access to all databases */
+    readonly WRITE: "write";
+    /** Administrative access */
+    readonly ADMIN: "admin";
+    /** Unrestricted access to all operations */
+    readonly FULL: "full";
+};
+export type StandardScope = (typeof SCOPES)[keyof typeof SCOPES];
+/**
+ * Base scopes supported by the server
+ */
+export declare const BASE_SCOPES: readonly ["read", "write", "admin", "full"];
+/**
+ * Scope patterns (regex patterns for validation)
+ */
+export declare const SCOPE_PATTERNS: {
+    /** Read-only access */
+    readonly READ: "read";
+    /** Read and write access */
+    readonly WRITE: "write";
+    /** Administrative access */
+    readonly ADMIN: "admin";
+    /** Unrestricted access */
+    readonly FULL: "full";
+};
+/**
+ * All supported scope patterns for metadata
+ */
+export declare const SUPPORTED_SCOPES: readonly ["read", "write", "admin", "full"];
+/**
+ * Parse a scope string (space-delimited) into an array
+ */
+export declare function parseScopes(scopeString: string): string[];
+//# sourceMappingURL=constants.d.ts.map

package/dist/auth/scopes/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/auth/scopes/constants.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,eAAO,MAAM,MAAM;IACjB,wCAAwC;;IAExC,6CAA6C;;IAE7C,4BAA4B;;IAE5B,4CAA4C;;CAEpC,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,MAAM,CAAC,CAAC,MAAM,OAAO,MAAM,CAAC,CAAC;AAEjE;;GAEG;AACH,eAAO,MAAM,WAAW,6CAA8C,CAAC;AAEvE;;GAEG;AACH,eAAO,MAAM,cAAc;IACzB,uBAAuB;;IAEvB,4BAA4B;;IAE5B,4BAA4B;;IAE5B,0BAA0B;;CAElB,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,gBAAgB,6CAA8C,CAAC;AAE5E;;GAEG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAKzD"}

package/dist/auth/scopes/display.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Get human-readable display name for a scope
+ */
+export declare function getScopeDisplayName(scope: string): string;
+//# sourceMappingURL=display.d.ts.map

package/dist/auth/scopes/display.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"display.d.ts","sourceRoot":"","sources":["../../../src/auth/scopes/display.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAazD"}