db-mcp 3.0.2 → 5.0.0

package/dist/{http-HWTUVFIA.js → http-ZDMK46QU.js}

@@ -1,4 +1,4 @@
-import { createModuleLogger, DbMcpError, runWithAuthContext, ERROR_CODES, logger, SUPPORTED_SCOPES, scopesGrantToolAccess, InsufficientScopeError, hasAdminScope, hasReadScope, isOAuthError, BASE_SCOPES, AuthServerDiscoveryError, JwksFetchError, parseScopes, TokenExpiredError, InvalidSignatureError, InvalidTokenError, TokenMissingError } from './chunk-L552U3QS.js';
+import { createModuleLogger, DbMcpError, ErrorCategory, metrics, runWithAuthContext, ERROR_CODES, logger, ConfigurationError, SUPPORTED_SCOPES, scopesGrantToolAccess, InsufficientScopeError, hasAdminScope, hasReadScope, isOAuthError, BASE_SCOPES, AuthServerDiscoveryError, JwksFetchError, parseScopes, TokenExpiredError, InvalidSignatureError, InvalidTokenError, TokenMissingError } from './chunk-XLIYO3YA.js';
 import express from 'express';
 import { localhostHostValidation } from '@modelcontextprotocol/sdk/server/middleware/hostHeaderValidation.js';
 import cors from 'cors';
@@ -148,6 +148,9 @@ var JSONRPC_INTERNAL_ERROR = -32603;
 var HTTP_REQUEST_TIMEOUT_MS = 12e4;
 var HTTP_KEEP_ALIVE_TIMEOUT_MS = 65e3;
 var HTTP_HEADERS_TIMEOUT_MS = 66e3;
+var SESSION_TIMEOUT_MS = 30 * 60 * 1e3;
+var SESSION_SWEEP_INTERVAL_MS = 1 * 60 * 1e3;
+var SESSION_ABSOLUTE_TTL_MS = 24 * 60 * 60 * 1e3;
 function setupSecurityHeaders(state) {
   if (!state.app) return;
   state.app.disable("x-powered-by");
@@ -251,7 +254,12 @@ function setupRateLimiting(state) {
     skip: (req) => req.path === "/health",
     handler: (_req, res, _next, options) => {
       res.status(options.statusCode).json({
-        error: "Too Many Requests"
+        success: false,
+        error: "Too Many Requests",
+        code: "RATE_LIMIT_ERROR",
+        category: "rate_limit",
+        suggestion: "Wait before retrying. Reduce request frequency or configure MCP_RATE_LIMIT_MAX.",
+        recoverable: true
       });
     }
   });
@@ -273,7 +281,7 @@ async function setupStatelessEndpoints(state) {
     throw new DbMcpError(
       "Transport or server not initialized",
       ERROR_CODES.SERVER.TRANSPORT_ERROR.full,
-      "internal" /* INTERNAL */
+      ErrorCategory.INTERNAL
     );
   }
   state.statelessTransport = new StreamableHTTPServerTransport({
@@ -354,15 +362,49 @@ function isValidSessionId(id) {
   if (id.length !== 36) return false;
   return /^[0-9a-fA-F-]{36}$/.test(id);
 }
+function touchSession(state, sessionId) {
+  state.sessionLastActivity.set(sessionId, Date.now());
+}
 function setupStatefulEndpoints(state) {
   if (!state.app || !state.mcpServer) {
     throw new DbMcpError(
       "Transport or server not initialized",
       ERROR_CODES.SERVER.TRANSPORT_ERROR.full,
-      "internal" /* INTERNAL */
+      ErrorCategory.INTERNAL
     );
   }
   const server = state.mcpServer;
+  const sessionSweepTimer = setInterval(() => {
+    const now = Date.now();
+    for (const [sid, lastActivity] of state.sessionLastActivity) {
+      const idleMs = now - lastActivity;
+      if (idleMs <= SESSION_TIMEOUT_MS) continue;
+      if ((state.sessionLocks.get(sid) ?? 0) > 0) continue;
+      if (state.transports.has(sid)) {
+        logger5.info("Expiring idle HTTP session", {
+          code: "HTTP_SESSION_EXPIRE",
+          sessionId: sid,
+          idleMinutes: Math.round(idleMs / 6e4)
+        });
+        const t = state.transports.get(sid);
+        if (t) {
+          void t.close();
+        }
+      }
+      if (state.sseTransports.has(sid)) {
+        logger5.info("Expiring idle SSE session", {
+          code: "SSE_SESSION_EXPIRE",
+          sessionId: sid,
+          idleMinutes: Math.round(idleMs / 6e4)
+        });
+        const t = state.sseTransports.get(sid);
+        if (t) {
+          void t.close();
+        }
+      }
+    }
+  }, SESSION_SWEEP_INTERVAL_MS);
+  sessionSweepTimer.unref();
   state.app.post("/mcp", (req, res) => {
     const sessionId = req.headers["mcp-session-id"];
     if (sessionId !== void 0 && !isValidSessionId(sessionId)) {
@@ -412,10 +454,23 @@ function setupStatefulEndpoints(state) {
             });
             return;
           }
+          const createdAt = state.sessionCreatedAt.get(sessionId) ?? Date.now();
+          if (Date.now() - createdAt > SESSION_ABSOLUTE_TTL_MS) {
+            res.status(401).json({
+              jsonrpc: "2.0",
+              error: {
+                code: JSONRPC_SERVER_ERROR,
+                message: "Unauthorized: Session absolute TTL expired"
+              },
+              id: null
+            });
+            return;
+          }
+          touchSession(state, sessionId);
           httpTransport = existingTransport;
         } else if (sessionId === void 0 && isNewSessionRequest(req.body)) {
           const maxSessions = state.config.maxSessions ?? 1e3;
-          if (state.transports.size >= maxSessions) {
+          if (state.transports.size + state.sseTransports.size >= maxSessions) {
             res.status(429).json({
               jsonrpc: "2.0",
               error: {
@@ -434,6 +489,8 @@ function setupStatefulEndpoints(state) {
                 sessionId: sid
               });
               state.transports.set(sid, newTransport);
+              touchSession(state, sid);
+              state.sessionCreatedAt.set(sid, Date.now());
               state.sessionOwners.set(sid, req.auth?.sub);
             }
           });
@@ -446,6 +503,12 @@ function setupStatefulEndpoints(state) {
               });
               state.transports.delete(sid);
               state.sessionOwners.delete(sid);
+              state.sessionLastActivity.delete(sid);
+              state.sessionCreatedAt.delete(sid);
+              state.sessionLocks.delete(sid);
+              if ("subscriptionManager" in server) {
+                server.subscriptionManager.unsubscribeSession(sid);
+              }
             }
           };
           await connectionMutex.acquire().then(async (release) => {
@@ -489,11 +552,28 @@ function setupStatefulEndpoints(state) {
               release();
             }
           });
-          await newTransport.handleRequest(
-            asIncoming(req),
-            asServerResponse(res),
-            req.body
-          );
+          const activeSid = newTransport.sessionId;
+          try {
+            if (activeSid) {
+              const count = state.sessionLocks.get(activeSid) ?? 0;
+              state.sessionLocks.set(activeSid, count + 1);
+            }
+            await newTransport.handleRequest(
+              asIncoming(req),
+              asServerResponse(res),
+              req.body
+            );
+          } finally {
+            if (activeSid) {
+              const count = state.sessionLocks.get(activeSid) ?? 0;
+              if (count > 1) {
+                state.sessionLocks.set(activeSid, count - 1);
+              } else {
+                state.sessionLocks.delete(activeSid);
+              }
+              touchSession(state, activeSid);
+            }
+          }
           return;
         } else {
           res.status(400).json({
@@ -507,11 +587,28 @@ function setupStatefulEndpoints(state) {
           return;
         }
         if (httpTransport !== void 0) {
-          await httpTransport.handleRequest(
-            asIncoming(req),
-            asServerResponse(res),
-            req.body
-          );
+          const activeSid = sessionId;
+          try {
+            if (activeSid) {
+              const count = state.sessionLocks.get(activeSid) ?? 0;
+              state.sessionLocks.set(activeSid, count + 1);
+            }
+            await httpTransport.handleRequest(
+              asIncoming(req),
+              asServerResponse(res),
+              req.body
+            );
+          } finally {
+            if (activeSid) {
+              const count = state.sessionLocks.get(activeSid) ?? 0;
+              if (count > 1) {
+                state.sessionLocks.set(activeSid, count - 1);
+              } else {
+                state.sessionLocks.delete(activeSid);
+              }
+              touchSession(state, activeSid);
+            }
+          }
         }
       } catch (error) {
         logger5.error("Error handling MCP request", {
@@ -546,6 +643,12 @@ function setupStatefulEndpoints(state) {
       res.status(403).send("Forbidden: session belongs to a different client");
       return;
     }
+    const createdAt = state.sessionCreatedAt.get(sessionId) ?? Date.now();
+    if (Date.now() - createdAt > SESSION_ABSOLUTE_TTL_MS) {
+      res.status(401).send("Unauthorized: Session absolute TTL expired");
+      return;
+    }
+    touchSession(state, sessionId);
     const lastEventId = req.headers["last-event-id"];
     if (lastEventId !== void 0) {
       logger5.debug("Client reconnecting with Last-Event-ID", {
@@ -555,7 +658,24 @@ function setupStatefulEndpoints(state) {
       });
     }
     if (httpTransport !== void 0) {
-      void httpTransport.handleRequest(asIncoming(req), asServerResponse(res));
+      void (async () => {
+        try {
+          const count = state.sessionLocks.get(sessionId) ?? 0;
+          state.sessionLocks.set(sessionId, count + 1);
+          await httpTransport.handleRequest(
+            asIncoming(req),
+            asServerResponse(res)
+          );
+        } finally {
+          const count = state.sessionLocks.get(sessionId) ?? 0;
+          if (count > 1) {
+            state.sessionLocks.set(sessionId, count - 1);
+          } else {
+            state.sessionLocks.delete(sessionId);
+          }
+          touchSession(state, sessionId);
+        }
+      })();
     }
   });
   state.app.delete("/mcp", (req, res) => {
@@ -578,9 +698,27 @@ function setupStatefulEndpoints(state) {
       sessionId
     });
     if (httpTransport !== void 0) {
-      void httpTransport.handleRequest(asIncoming(req), asServerResponse(res));
+      void (async () => {
+        try {
+          const count = state.sessionLocks.get(sessionId) ?? 0;
+          state.sessionLocks.set(sessionId, count + 1);
+          await httpTransport.handleRequest(
+            asIncoming(req),
+            asServerResponse(res)
+          );
+        } finally {
+          const count = state.sessionLocks.get(sessionId) ?? 0;
+          if (count > 1) {
+            state.sessionLocks.set(sessionId, count - 1);
+          } else {
+            state.sessionLocks.delete(sessionId);
+          }
+          touchSession(state, sessionId);
+        }
+      })();
     }
   });
+  return sessionSweepTimer;
 }
 var logger6 = createModuleLogger("HTTP");
 var connectionMutex2 = new Mutex();
@@ -598,6 +736,8 @@ function setupLegacySSEEndpoints(state) {
     void (async () => {
       try {
         state.sseTransports.set(sseTransport.sessionId, sseTransport);
+        touchSession(state, sseTransport.sessionId);
+        state.sessionCreatedAt.set(sseTransport.sessionId, Date.now());
         state.sessionOwners.set(sseTransport.sessionId, req.auth?.sub);
         sseTransport.onclose = () => {
           logger6.info("Legacy SSE transport closed", {
@@ -606,6 +746,11 @@ function setupLegacySSEEndpoints(state) {
           });
           state.sseTransports.delete(sseTransport.sessionId);
           state.sessionOwners.delete(sseTransport.sessionId);
+          state.sessionLastActivity.delete(sseTransport.sessionId);
+          state.sessionCreatedAt.delete(sseTransport.sessionId);
+          if ("subscriptionManager" in server) {
+            server.subscriptionManager.unsubscribeSession(sseTransport.sessionId);
+          }
         };
         const origSend = sseTransport.send.bind(sseTransport);
         sseTransport.send = async (message) => {
@@ -666,6 +811,8 @@ function setupLegacySSEEndpoints(state) {
     req.on("close", () => {
       state.sseTransports.delete(sseTransport.sessionId);
       state.sessionOwners.delete(sseTransport.sessionId);
+      state.sessionLastActivity.delete(sseTransport.sessionId);
+      state.sessionCreatedAt.delete(sseTransport.sessionId);
     });
   });
   state.app.post("/messages", (req, res) => {
@@ -704,6 +851,7 @@ function setupLegacySSEEndpoints(state) {
       });
       return;
     }
+    touchSession(state, sessionId);
     void sseTransport.handlePostMessage(
       asIncoming(req),
       asServerResponse(res),
@@ -852,7 +1000,7 @@ var AuthorizationServerDiscovery = class {
       const url = new URL(this.authServerUrl);
       const isLocalDev = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
       if (!isLocalDev) {
-        throw new Error(
+        throw new ConfigurationError(
           `Security: Authorization server URL must use HTTPS in production. Got: ${this.authServerUrl}. Set NODE_ENV=development to allow HTTP for local testing.`
         );
       }
@@ -897,7 +1045,7 @@ var AuthorizationServerDiscovery = class {
         throw new DbMcpError(
           `HTTP ${String(response.status)}: ${response.statusText}`,
           ERROR_CODES.AUTH.DISCOVERY_FAILED.full,
-          "connection" /* CONNECTION */
+          ErrorCategory.CONNECTION
         );
       }
       const metadata = await response.json();
@@ -931,14 +1079,14 @@ var AuthorizationServerDiscovery = class {
       throw new DbMcpError(
         "Missing required field: issuer",
         "AUTH_DISCOVERY_INVALID",
-        "validation" /* VALIDATION */
+        ErrorCategory.VALIDATION
       );
     }
     if (!metadata.token_endpoint) {
       throw new DbMcpError(
         "Missing required field: token_endpoint",
         "AUTH_DISCOVERY_INVALID",
-        "validation" /* VALIDATION */
+        ErrorCategory.VALIDATION
       );
     }
     try {
@@ -948,7 +1096,7 @@ var AuthorizationServerDiscovery = class {
       throw new DbMcpError(
         "Invalid URL format in metadata fields",
         "AUTH_DISCOVERY_INVALID",
-        "validation" /* VALIDATION */
+        ErrorCategory.VALIDATION
       );
     }
     const expectedIssuer = this.authServerUrl;
@@ -956,7 +1104,7 @@ var AuthorizationServerDiscovery = class {
       throw new DbMcpError(
         `Issuer validation failed. Per RFC 8414 \xA73.3, the issuer MUST be identical to the authorization server URL.`,
         "AUTH_ISSUER_MISMATCH",
-        "validation" /* VALIDATION */
+        ErrorCategory.VALIDATION
       );
     }
   }
@@ -968,7 +1116,7 @@ var AuthorizationServerDiscovery = class {
       throw new DbMcpError(
         "Authorization server metadata not yet discovered. Call discover() first.",
         "AUTH_DISCOVERY_REQUIRED",
-        "internal" /* INTERNAL */
+        ErrorCategory.INTERNAL
       );
     }
     return this.cachedMetadata;
@@ -984,7 +1132,7 @@ var AuthorizationServerDiscovery = class {
       throw new DbMcpError(
         "Authorization server does not provide jwks_uri",
         "AUTH_DISCOVERY_INVALID",
-        "validation" /* VALIDATION */
+        ErrorCategory.VALIDATION
       );
     }
     return metadata.jwks_uri;
@@ -1076,7 +1224,7 @@ var TokenValidator = class _TokenValidator {
       const url = new URL(config.jwksUri);
       const isLocalDev = url.hostname === "localhost" || url.hostname === "127.0.0.1";
       if (!isLocalDev) {
-        throw new Error(
+        throw new ConfigurationError(
           `Security: JWKS URI must use HTTPS in production. Got: ${config.jwksUri}. Set ALLOW_HTTP_JWKS=true to allow HTTP for local testing.`
         );
       }
@@ -1286,7 +1434,7 @@ function applyAuthMiddleware(state) {
   const corsOrigins = state.config.corsOrigins ?? [];
   const isPubliclyExposed = state.config.oauth.enabled || state.config.noAuthEnforcement;
   if (corsOrigins.includes("*") && isPubliclyExposed) {
-    throw new Error(
+    throw new ConfigurationError(
       "Security: CORS wildcard origin ('*') is forbidden when authentication is enabled or enforcement is explicitly disabled. Configure explicit origins via --cors-origins for production deployments."
     );
   }
@@ -1435,7 +1583,7 @@ function applyScopeEnforcementMiddleware(state) {
 async function setupOAuth(state, resourceUri) {
   logger10.info("Setting up OAuth 2.1...", { code: "HTTP_OAUTH_SETUP" });
   if (state.config.oauth.enabled && !state.config.oauth.audience) {
-    throw new Error(
+    throw new ConfigurationError(
       "Security: OAuth audience must be explicitly configured when OAuth is enabled."
     );
   }
@@ -1489,6 +1637,8 @@ var logger11 = createModuleLogger("HTTP");
 var HttpTransport = class {
   /** Internal state shared with session/middleware/oauth modules */
   state;
+  /** Sweep timer for session timeout cleanup */
+  sweepTimer = null;
   constructor(config) {
     this.state = {
       config: {
@@ -1502,6 +1652,9 @@ var HttpTransport = class {
       transports: /* @__PURE__ */ new Map(),
       sseTransports: /* @__PURE__ */ new Map(),
       sessionOwners: /* @__PURE__ */ new Map(),
+      sessionLastActivity: /* @__PURE__ */ new Map(),
+      sessionCreatedAt: /* @__PURE__ */ new Map(),
+      sessionLocks: /* @__PURE__ */ new Map(),
       statelessTransport: null,
       resourceServer: null,
       authServerDiscovery: null,
@@ -1530,7 +1683,7 @@ var HttpTransport = class {
         throw new DbMcpError(
           "trustedProxyIps cannot be an empty array if specified",
           "CONFIG_ERROR",
-          "config" /* CONFIGURATION */
+          ErrorCategory.CONFIGURATION
         );
       }
       this.state.app.set("trust proxy", this.state.config.trustedProxyIps);
@@ -1549,7 +1702,7 @@ var HttpTransport = class {
       throw new DbMcpError(
         "HTTP transport is enabled without authentication. You must configure OAuth (--oauth-enabled) or explicitly bypass this check with --no-auth-enforcement.",
         "AUTH_REQUIRED",
-        "config" /* CONFIGURATION */
+        ErrorCategory.CONFIGURATION
       );
     }
     if (this.state.config.oauth.enabled) {
@@ -1590,6 +1743,12 @@ var HttpTransport = class {
     });
     applyAuthMiddleware(this.state);
     applyScopeEnforcementMiddleware(this.state);
+    if (this.state.config.metricsExport === "prometheus") {
+      this.state.app.get("/metrics", (_req, res) => {
+        res.set("Content-Type", "text/plain");
+        res.send(metrics.toPrometheus());
+      });
+    }
     const oauthEnabled = this.state.config.oauth?.enabled ?? false;
     let lastNoAuthWarning = 0;
     this.state.app.use((req, _res, next) => {
@@ -1617,7 +1776,7 @@ var HttpTransport = class {
     if (this.state.config.stateless) {
       await setupStatelessEndpoints(this.state);
     } else {
-      setupStatefulEndpoints(this.state);
+      this.sweepTimer = setupStatefulEndpoints(this.state);
     }
     if (!this.state.config.stateless) {
       setupLegacySSEEndpoints(this.state);
@@ -1642,7 +1801,7 @@ var HttpTransport = class {
       throw new DbMcpError(
         "Transport not initialized. Call initialize() first.",
         ERROR_CODES.SERVER.START_FAILED.full,
-        "internal" /* INTERNAL */
+        ErrorCategory.INTERNAL
       );
     }
     return new Promise((resolve, reject) => {
@@ -1682,6 +1841,10 @@ var HttpTransport = class {
    * Stop the server and close all active sessions
    */
   async stop() {
+    if (this.sweepTimer) {
+      clearInterval(this.sweepTimer);
+      this.sweepTimer = null;
+    }
     for (const [sessionId, transport] of this.state.transports) {
       try {
         logger11.debug("Closing transport", {

package/dist/index.js

@@ -1,4 +1,4 @@
-export { DEFAULT_CONFIG, DbMcpServer, createServer } from './chunk-37G4DLL6.js';
-export { DatabaseAdapter } from './chunk-W5WQVNVX.js';
-export { NAME, VERSION } from './chunk-E5IESRTK.js';
-export { ALL_TOOL_GROUPS, AuthenticationError, AuthorizationError, ConnectionError, DbMcpError, META_GROUPS, QueryError, TOOL_GROUPS, ValidationError, filterTools, getFilterSummary, getToolFilterFromEnv, isToolEnabled, parseToolFilter } from './chunk-L552U3QS.js';
+export { DEFAULT_CONFIG, DbMcpServer, createServer } from './chunk-LLIAIJPO.js';
+export { DatabaseAdapter } from './chunk-27C5EE6U.js';
+export { NAME, VERSION } from './chunk-2TYICG7B.js';
+export { ALL_TOOL_GROUPS, AuthenticationError, AuthorizationError, ConnectionError, DbMcpError, META_GROUPS, QueryError, TOOL_GROUPS, ValidationError, filterTools, getFilterSummary, getToolFilterFromEnv, isToolEnabled, parseToolFilter } from './chunk-XLIYO3YA.js';

package/dist/observability/metrics.d.ts

@@ -0,0 +1,36 @@
+/**
+ * db-mcp — Observability Metrics
+ *
+ * In-memory streaming metrics aggregator for tools and resources.
+ * Uses a zero-dependency circular buffer to estimate latency percentiles
+ * (p50, p95, p99) without memory bloat.
+ */
+import type { SystemDb } from "./system-db.js";
+export interface MetricSummary {
+    calls: number;
+    errors: number;
+    tokens: number;
+    p50: number;
+    p95: number;
+    p99: number;
+}
+export interface ResourceMetricSummary {
+    reads: number;
+}
+export declare class MetricsRegistry {
+    private tools;
+    private resources;
+    private systemDb;
+    private flushTimer;
+    setSystemDb(systemDb: SystemDb): void;
+    private loadHistorical;
+    private startFlushTimer;
+    private flushToDb;
+    close(): void;
+    recordToolCall(toolName: string, durationMs: number, success: boolean, tokens?: number): void;
+    recordResourceRead(uri: string): void;
+    getSummary(): Record<string, unknown>;
+    toPrometheus(): string;
+}
+export declare const metrics: MetricsRegistry;
+//# sourceMappingURL=metrics.d.ts.map

package/dist/observability/metrics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metrics.d.ts","sourceRoot":"","sources":["../../src/observability/metrics.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAK/C,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;CACf;AA+ED,qBAAa,eAAe;IAC1B,OAAO,CAAC,KAAK,CAAiC;IAC9C,OAAO,CAAC,SAAS,CAAqC;IACtD,OAAO,CAAC,QAAQ,CAAyB;IACzC,OAAO,CAAC,UAAU,CAA+C;IAEjE,WAAW,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI;IAMrC,OAAO,CAAC,cAAc;IAsCtB,OAAO,CAAC,eAAe;IAYvB,OAAO,CAAC,SAAS;IAiCjB,KAAK,IAAI,IAAI;IAQb,cAAc,CACZ,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,SAAI,GACT,IAAI;IASP,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IASrC,UAAU,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAkBrC,YAAY,IAAI,MAAM;CAwCvB;AAGD,eAAO,MAAM,OAAO,iBAAwB,CAAC"}

package/dist/observability/system-db.d.ts

@@ -0,0 +1,13 @@
+import type { Database } from "better-sqlite3";
+export interface SystemDbConfig {
+    dbPath: string;
+}
+export declare class SystemDb {
+    private db;
+    private readonly config;
+    constructor(config: SystemDbConfig);
+    init(): Promise<void>;
+    getDb(): Database;
+    close(): void;
+}
+//# sourceMappingURL=system-db.d.ts.map

package/dist/observability/system-db.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-db.d.ts","sourceRoot":"","sources":["../../src/observability/system-db.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAM/C,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,QAAQ;IACnB,OAAO,CAAC,EAAE,CAAyB;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiB;gBAE5B,MAAM,EAAE,cAAc;IAI5B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAmF3B,KAAK,IAAI,QAAQ;IAOjB,KAAK,IAAI,IAAI;CAMd"}

package/dist/server/mcp-server.d.ts

@@ -6,6 +6,7 @@
  */
 import type { McpServerConfig, DatabaseConfig } from "../types/index.js";
 import type { DatabaseAdapter } from "../adapters/database-adapter.js";
+import { SubscriptionManager } from "./subscription-manager.js";
 /**
  * Main db-mcp server class
  *
@@ -18,8 +19,10 @@ export declare class DbMcpServer {
     private config;
     private auditLogger;
     private backupManager;
+    private systemDb;
     private auditInterceptor;
     private auditInitPromise;
+    readonly subscriptionManager: SubscriptionManager;
     constructor(config: McpServerConfig);
     /**
      * Register a database adapter

package/dist/server/mcp-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-server.d.ts","sourceRoot":"","sources":["../../src/server/mcp-server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EACV,eAAe,EACf,cAAc,EAEf,MAAM,mBAAmB,CAAC;AAE3B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAyEvE;;;;GAIG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,MAAM,CAAY;IAC1B,OAAO,CAAC,QAAQ,CAAsC;IACtD,OAAO,CAAC,UAAU,CAAmB;IACrC,OAAO,CAAC,MAAM,CAAkB;IAChC,OAAO,CAAC,WAAW,CAA4B;IAC/C,OAAO,CAAC,aAAa,CAA8B;IACnD,OAAO,CAAC,gBAAgB,CAAiC;IACzD,OAAO,CAAC,gBAAgB,CAA8B;gBAE1C,MAAM,EAAE,eAAe;IAkFnC;;OAEG;IACG,eAAe,CACnB,OAAO,EAAE,eAAe,EACxB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,IAAI,CAAC;IAqDhB;;OAEG;IACH,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS;IAI1D;;OAEG;IACH,WAAW,IAAI,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC;IAI3C;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAiB5B;;OAEG;YACW,UAAU;IAiBxB;;OAEG;YACW,SAAS;IAsDvB;;OAEG;IACG,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAiC/B;;;OAGG;YACW,eAAe;CAmC9B;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,eAAe,GAAG,WAAW,CAEjE;AAED;;GAEG;AACH,eAAO,MAAM,cAAc,EAAE,OAAO,CAAC,eAAe,CAKnD,CAAC"}
+{"version":3,"file":"mcp-server.d.ts","sourceRoot":"","sources":["../../src/server/mcp-server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EACV,eAAe,EACf,cAAc,EAEf,MAAM,mBAAmB,CAAC;AAE3B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAwCvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AA+ChE;;;;GAIG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,MAAM,CAAY;IAC1B,OAAO,CAAC,QAAQ,CAAsC;IACtD,OAAO,CAAC,UAAU,CAAmB;IACrC,OAAO,CAAC,MAAM,CAAkB;IAChC,OAAO,CAAC,WAAW,CAA4B;IAC/C,OAAO,CAAC,aAAa,CAA8B;IACnD,OAAO,CAAC,QAAQ,CAAyB;IACzC,OAAO,CAAC,gBAAgB,CAAiC;IACzD,OAAO,CAAC,gBAAgB,CAA8B;IACtD,SAAgB,mBAAmB,EAAE,mBAAmB,CAAC;gBAE7C,MAAM,EAAE,eAAe;IAyLnC;;OAEG;IACG,eAAe,CACnB,OAAO,EAAE,eAAe,EACxB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,IAAI,CAAC;IAiEhB;;OAEG;IACH,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS;IAI1D;;OAEG;IACH,WAAW,IAAI,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC;IAI3C;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAiB5B;;OAEG;YACW,UAAU;IAiBxB;;OAEG;YACW,SAAS;IAyDvB;;OAEG;IACG,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAwC/B;;;OAGG;YACW,eAAe;CA8C9B;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,eAAe,GAAG,WAAW,CAEjE;AAED;;GAEG;AACH,eAAO,MAAM,cAAc,EAAE,OAAO,CAAC,eAAe,CAKnD,CAAC"}

package/dist/server/registration/admin-tools.d.ts

@@ -0,0 +1,6 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+/**
+ * Register administrative tools
+ */
+export declare function registerAdminTools(server: McpServer): void;
+//# sourceMappingURL=admin-tools.d.ts.map

package/dist/server/registration/admin-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-tools.d.ts","sourceRoot":"","sources":["../../../src/server/registration/admin-tools.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAazE;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAkL1D"}

package/dist/server/registration/audit-tools/backup.d.ts

@@ -0,0 +1,8 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { DatabaseAdapter } from "../../../adapters/database-adapter.js";
+import type { BackupManager } from "../../../audit/backup-manager.js";
+/**
+ * Register audit backup tools for snapshot management.
+ */
+export declare function registerAuditBackupTools(server: McpServer, backupManager: BackupManager | null, adaptersMap: Map<string, DatabaseAdapter>): void;
+//# sourceMappingURL=backup.d.ts.map

package/dist/server/registration/audit-tools/backup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup.d.ts","sourceRoot":"","sources":["../../../../src/server/registration/audit-tools/backup.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AAqBtE;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,SAAS,EACjB,aAAa,EAAE,aAAa,GAAG,IAAI,EACnC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,GACxC,IAAI,CAkoBN"}

package/dist/server/registration/audit-tools/helpers.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Force redaction of SQL string literals to prevent secret exposure
+ * in audit logs and backups, regardless of operator configuration.
+ */
+export declare function redactSqlLiterals(text: string): string;
+/**
+ * Validate DDL to prevent execution of unauthorized or destructive statements
+ * during restore operations from tampered backups.
+ */
+export declare function validateDdl(sql: string): void;
+//# sourceMappingURL=helpers.d.ts.map

package/dist/server/registration/audit-tools/helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../../src/server/registration/audit-tools/helpers.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAqB7C"}

package/dist/server/registration/audit-tools/index.d.ts

@@ -0,0 +1,4 @@
+export { registerAuditResource } from "./resource.js";
+export { registerAuditBackupTools } from "./backup.js";
+export { registerAuditSearchTool } from "./search.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/server/registration/audit-tools/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/server/registration/audit-tools/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC"}

package/dist/server/registration/audit-tools/resource.d.ts

@@ -0,0 +1,8 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { BackupManager } from "../../../audit/backup-manager.js";
+import type { AuditLogger } from "../../../audit/logger.js";
+/**
+ * Register the sqlite://audit resource for agent access to audit log.
+ */
+export declare function registerAuditResource(server: McpServer, auditLogger: AuditLogger | null, backupManager: BackupManager | null): void;
+//# sourceMappingURL=resource.d.ts.map

package/dist/server/registration/audit-tools/resource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../../../../src/server/registration/audit-tools/resource.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAI5D;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,SAAS,EACjB,WAAW,EAAE,WAAW,GAAG,IAAI,EAC/B,aAAa,EAAE,aAAa,GAAG,IAAI,GAClC,IAAI,CAuCN"}

package/dist/server/registration/audit-tools/search.d.ts

@@ -0,0 +1,7 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { AuditLogger } from "../../../audit/logger.js";
+/**
+ * Register the sqlite_audit_search tool.
+ */
+export declare function registerAuditSearchTool(server: McpServer, auditLogger: AuditLogger | null): void;
+//# sourceMappingURL=search.d.ts.map

package/dist/server/registration/audit-tools/search.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"search.d.ts","sourceRoot":"","sources":["../../../../src/server/registration/audit-tools/search.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAe5D;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,SAAS,EACjB,WAAW,EAAE,WAAW,GAAG,IAAI,GAC9B,IAAI,CA6EN"}

package/dist/server/registration/help-resources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"help-resources.d.ts","sourceRoot":"","sources":["../../../src/server/registration/help-resources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,KAAK,EAAE,gBAAgB,EAAa,MAAM,sBAAsB,CAAC;AAKxE;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,SAAS,EACjB,UAAU,EAAE,gBAAgB,GAC3B,IAAI,CAiFN"}
+{"version":3,"file":"help-resources.d.ts","sourceRoot":"","sources":["../../../src/server/registration/help-resources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,KAAK,EAAE,gBAAgB,EAAa,MAAM,sBAAsB,CAAC;AAMxE;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,SAAS,EACjB,UAAU,EAAE,gBAAgB,GAC3B,IAAI,CAuFN"}