db-mcp 4.0.0 → 5.0.1

package/dist/codemode/sandbox-factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox-factory.d.ts","sourceRoot":"","sources":["../../src/codemode/sandbox-factory.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE7E;;GAEG;AACH,MAAM,MAAM,WAAW,GAAG,SAAS,CAAC;AAEpC;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,OAAO,CACL,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1B,SAAS,IAAI,OAAO,CAAC;IACrB,OAAO,IAAI,IAAI,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,UAAU,IAAI,IAAI,CAAC;IACnB,OAAO,CACL,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1B,QAAQ,IAAI;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9D,OAAO,IAAI,IAAI,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AAKD;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAK7D;AAED;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,WAAW,CAEnD;AAED;;GAEG;AACH,wBAAgB,wBAAwB,IAAI,WAAW,EAAE,CAExD;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,IAAI,CAAC,EAAE,WAAW,EAClB,OAAO,CAAC,EAAE,cAAc,GACvB,QAAQ,CASV;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,CAAC,EAAE,WAAW,EAClB,WAAW,CAAC,EAAE,WAAW,EACzB,cAAc,CAAC,EAAE,cAAc,GAC9B,YAAY,CASd;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,WAAW,GAAG,eAAe,CAQtE"}
+{"version":3,"file":"sandbox-factory.d.ts","sourceRoot":"","sources":["../../src/codemode/sandbox-factory.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAG7E;;GAEG;AACH,MAAM,MAAM,WAAW,GAAG,SAAS,CAAC;AAEpC;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,OAAO,CACL,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1B,SAAS,IAAI,OAAO,CAAC;IACrB,OAAO,IAAI,IAAI,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,UAAU,IAAI,IAAI,CAAC;IACnB,OAAO,CACL,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1B,QAAQ,IAAI;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9D,OAAO,IAAI,IAAI,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AAKD;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAK7D;AAED;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,WAAW,CAEnD;AAED;;GAEG;AACH,wBAAgB,wBAAwB,IAAI,WAAW,EAAE,CAExD;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,IAAI,CAAC,EAAE,WAAW,EAClB,OAAO,CAAC,EAAE,cAAc,GACvB,QAAQ,CASV;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,CAAC,EAAE,WAAW,EAClB,WAAW,CAAC,EAAE,WAAW,EACzB,cAAc,CAAC,EAAE,cAAc,GAC9B,YAAY,CASd;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,WAAW,GAAG,eAAe,CAQtE"}

package/dist/codemode/sandbox.d.ts

@@ -6,9 +6,6 @@
  */
 import type ivm from "isolated-vm";
 import { type SandboxOptions, type PoolOptions, type SandboxResult } from "./types.js";
-/**
- * A sandboxed execution context using isolated-vm
- */
 export declare class CodeModeSandbox {
     private readonly options;
     private disposed;

package/dist/codemode/sandbox.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../src/codemode/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AAEnC,OAAO,EAGL,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,aAAa,EACnB,MAAM,YAAY,CAAC;AAGpB;;GAEG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2B;IACnD,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,eAAe,CAAgB;IAEvC,OAAO;IAIP;;OAEG;IACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,cAAc,GAAG,eAAe;IAQxD;;OAEG;IACG,OAAO,CACX,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,aAAa,CAAC;IAkUzB,gBAAgB,IAAI,MAAM,EAAE;IAI5B,kBAAkB,IAAI,IAAI;IAI1B,SAAS,IAAI,OAAO;IAIpB,OAAO,IAAI,IAAI;CAIhB;AAED;;GAEG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAwB;IAChD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA2B;IAC1D,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAyB;IAClD,OAAO,CAAC,MAAM,CAAC,UAAU,CAAoC;IAC7D,OAAO,CAAC,MAAM,CAAC,YAAY,CAA2B;gBAE1C,WAAW,CAAC,EAAE,WAAW,EAAE,cAAc,CAAC,EAAE,cAAc;IAKtE,MAAM,CAAC,SAAS,IAAI,OAAO,GAAG;WAOjB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAUlC,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAI3B,OAAO,CACX,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,aAAa,CAAC;IAgCzB,OAAO,IAAI,IAAI;IAOf,QAAQ,IAAI;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE;IAS3E,OAAO,IAAI,IAAI;CAGhB"}
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../src/codemode/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AAEnC,OAAO,EAGL,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,aAAa,EACnB,MAAM,YAAY,CAAC;AAcpB,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2B;IACnD,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,eAAe,CAAgB;IAEvC,OAAO;IAIP;;OAEG;IACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,cAAc,GAAG,eAAe;IAQxD;;OAEG;IACG,OAAO,CACX,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,aAAa,CAAC;IAkYzB,gBAAgB,IAAI,MAAM,EAAE;IAI5B,kBAAkB,IAAI,IAAI;IAI1B,SAAS,IAAI,OAAO;IAIpB,OAAO,IAAI,IAAI;CAIhB;AAED;;GAEG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAwB;IAChD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA2B;IAC1D,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAyB;IAClD,OAAO,CAAC,MAAM,CAAC,UAAU,CAAoC;IAC7D,OAAO,CAAC,MAAM,CAAC,YAAY,CAA2B;gBAE1C,WAAW,CAAC,EAAE,WAAW,EAAE,cAAc,CAAC,EAAE,cAAc;IAKtE,MAAM,CAAC,SAAS,IAAI,OAAO,GAAG;WAUjB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAUlC,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAI3B,OAAO,CACX,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,aAAa,CAAC;IAiCzB,OAAO,IAAI,IAAI;IAOf,QAAQ,IAAI;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE;IAS3E,OAAO,IAAI,IAAI;CAGhB"}

package/dist/codemode/security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../src/codemode/security.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,aAAa,EACnB,MAAM,YAAY,CAAC;AAIpB;;GAEG;AACH,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiB;IACxC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAGzB;IACJ,OAAO,CAAC,WAAW,CAAC,CAAkB;gBAE1B,MAAM,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC;IAa5C;;OAEG;IACH,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB;IA2C5C;;;OAGG;IACG,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAsDxD;;OAEG;IACG,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAmB9D;;OAEG;IACH,cAAc,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO;IA8BxC;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,eAAe,GAAG,IAAI;IAqC1C;;OAEG;IACH,qBAAqB,CACnB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,aAAa,EACrB,QAAQ,EAAE,OAAO,EACjB,QAAQ,CAAC,EAAE,MAAM,GAChB,eAAe;IAclB;;OAEG;IACH,iBAAiB,IAAI,IAAI;CAQ1B"}
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../src/codemode/security.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,aAAa,EACnB,MAAM,YAAY,CAAC;AAKpB;;GAEG;AACH,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiB;IACxC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAGzB;IACJ,OAAO,CAAC,WAAW,CAAC,CAAkB;gBAE1B,MAAM,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC;IAa5C;;OAEG;IACH,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB;IA2C5C;;;OAGG;IACG,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAsDxD;;OAEG;IACG,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAmB9D;;OAEG;IACH,cAAc,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO;IA8BxC;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,eAAe,GAAG,IAAI;IAqC1C;;OAEG;IACH,qBAAqB,CACnB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,aAAa,EACrB,QAAQ,EAAE,OAAO,EACjB,QAAQ,CAAC,EAAE,MAAM,GAChB,eAAe;IAclB;;OAEG;IACH,iBAAiB,IAAI,IAAI;CAQ1B"}

package/dist/codemode/types.d.ts

@@ -14,6 +14,8 @@ export interface SandboxOptions {
     timeoutMs?: number;
     /** CPU time limit in milliseconds (default: 10000) */
     cpuLimitMs?: number;
+    /** Whether to hard-fail if isolated-vm is missing rather than fallback to node:vm (default: true) */
+    strictIsolation?: boolean;
 }
 /**
  * Options for the sandbox pool

package/dist/codemode/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/codemode/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAMnD;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,wCAAwC;IACxC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sDAAsD;IACtD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,kDAAkD;IAClD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8CAA8C;IAC9C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,cAAc,CAI5D,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,WAAW,CAItD,CAAC;AAMF;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,sCAAsC;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,+CAA+C;IAC/C,OAAO,EAAE,OAAO,CAAC;IACjB,iDAAiD;IACjD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gCAAgC;IAChC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,8BAA8B;IAC9B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,qBAAqB;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,wBAAwB;IACxB,OAAO,EAAE,gBAAgB,CAAC;CAC3B;AAMD;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,mDAAmD;IACnD,aAAa,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,sBAAsB,EAAE,MAAM,CAAC;IAC/B,mDAAmD;IACnD,aAAa,EAAE,MAAM,CAAC;IACtB,gCAAgC;IAChC,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;GAEG;AACH,eAAO,MAAM,uBAAuB,EAAE,cAkCrC,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,yCAAyC;IACzC,KAAK,EAAE,OAAO,CAAC;IACf,iCAAiC;IACjC,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,0BAA0B;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,4CAA4C;IAC5C,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,mCAAmC;IACnC,SAAS,EAAE,IAAI,CAAC;IAChB,qDAAqD;IACrD,WAAW,EAAE,MAAM,CAAC;IACpB,uBAAuB;IACvB,MAAM,EAAE,aAAa,CAAC;IACtB,wCAAwC;IACxC,QAAQ,EAAE,OAAO,CAAC;CACnB;AAMD;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,sBAAsB;IACtB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uCAAuC;IACvC,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,kCAAkC;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,iCAAiC;IACjC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gCAAgC;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qBAAqB;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,wBAAwB;IACxB,OAAO,EAAE,gBAAgB,CAAC;CAC3B;AAMD;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,kDAAkD;IAClD,EAAE,EAAE,MAAM,CAAC;IACX,4CAA4C;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,MAAM,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,IAAI,EAAE,OAAO,EAAE,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,0BAA0B;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,mDAAmD;IACnD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gCAAgC;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/codemode/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAMnD;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,wCAAwC;IACxC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sDAAsD;IACtD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qGAAqG;IACrG,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,kDAAkD;IAClD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8CAA8C;IAC9C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,cAAc,CAK5D,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,WAAW,CAItD,CAAC;AAMF;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,sCAAsC;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,+CAA+C;IAC/C,OAAO,EAAE,OAAO,CAAC;IACjB,iDAAiD;IACjD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gCAAgC;IAChC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,8BAA8B;IAC9B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,qBAAqB;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,wBAAwB;IACxB,OAAO,EAAE,gBAAgB,CAAC;CAC3B;AAMD;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,mDAAmD;IACnD,aAAa,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,sBAAsB,EAAE,MAAM,CAAC;IAC/B,mDAAmD;IACnD,aAAa,EAAE,MAAM,CAAC;IACtB,gCAAgC;IAChC,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;GAEG;AACH,eAAO,MAAM,uBAAuB,EAAE,cAkCrC,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,yCAAyC;IACzC,KAAK,EAAE,OAAO,CAAC;IACf,iCAAiC;IACjC,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,0BAA0B;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,4CAA4C;IAC5C,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,mCAAmC;IACnC,SAAS,EAAE,IAAI,CAAC;IAChB,qDAAqD;IACrD,WAAW,EAAE,MAAM,CAAC;IACpB,uBAAuB;IACvB,MAAM,EAAE,aAAa,CAAC;IACtB,wCAAwC;IACxC,QAAQ,EAAE,OAAO,CAAC;CACnB;AAMD;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,sBAAsB;IACtB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uCAAuC;IACvC,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,kCAAkC;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,iCAAiC;IACjC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gCAAgC;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qBAAqB;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,wBAAwB;IACxB,OAAO,EAAE,gBAAgB,CAAC;CAC3B;AAMD;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,kDAAkD;IAClD,EAAE,EAAE,MAAM,CAAC;IACX,4CAA4C;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,MAAM,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,IAAI,EAAE,OAAO,EAAE,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,0BAA0B;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,mDAAmD;IACnD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gCAAgC;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB"}

package/dist/constants/server-instructions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-instructions.d.ts","sourceRoot":"","sources":["../../src/constants/server-instructions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;GAGG;AACH,eAAO,MAAM,YAAY,g2BAoBwC,CAAC;AAElE;;;;GAIG;AACH,eAAO,MAAM,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAs3BnD,CAAC"}
+{"version":3,"file":"server-instructions.d.ts","sourceRoot":"","sources":["../../src/constants/server-instructions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;GAGG;AACH,eAAO,MAAM,YAAY,g2BAoBwC,CAAC;AAElE;;;;GAIG;AACH,eAAO,MAAM,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAy1BnD,CAAC"}

package/dist/filtering/tool-constants.d.ts

@@ -4,7 +4,7 @@
  * Defines the tool groups and meta-groups used for filtering.
  *
  * GROUP TOOLS (adapter-registered, accessible via Code Mode sqlite.help()):
- *   core: 21 tools (core/queries.ts, core/tables.ts, core/indexes.ts, core/convenience.ts, core/triggers.ts, core/constraints.ts, core/datetime.ts, core/alter-table.ts)
+ *   core: 25 tools (core/queries.ts, core/tables.ts, core/indexes.ts, core/convenience.ts, core/triggers.ts, core/constraints.ts, core/datetime.ts, core/alter-table.ts, core/versioning.ts)
  *   json: 25 tools (json-operations/crud+query+transform+security+diff.ts, json-helpers/read+write.ts)
  *   text: 15 WASM / 20 Native (text/regex+formatting+search+validate+sentiment.ts, fts.ts)
  *   stats: 17 WASM / 23 Native (stats/basic+advanced.ts, inference/, anomaly-detection.ts, schema-risks.ts, native: window.ts)
@@ -15,17 +15,17 @@
  *   introspection: 10 tools (introspection/graph/tools.ts, analysis/constraints+risks+snapshot+diff.ts, diagnostics/storage+indexes+query-plan.ts)
  *   migration: 6 tools (migration/tracking.ts) — opt-in
  *   codemode: 1 tool (codemode.ts)
- *   Subtotal: 139 WASM / 166 Native (excluding Code Mode)
+ *   Subtotal: 143 WASM / 170 Native (excluding Code Mode)
  *
  * AUDIT & ADMIN TOOLS (server-level, MCP-only — NOT exposed in Code Mode):
  *   7 tools (server/registration/audit-tools.ts, admin-tools.ts)
  *
  * TOOL COUNT TAXONOMY:
- *   Group tools:  166 Native / 139 WASM  (10 groups excluding Code Mode)
+ *   Group tools:  170 Native / 143 WASM  (10 groups excluding Code Mode)
  *   Audit tools:    7 Native /   7 WASM  (MCP-only)
- *   Inventory:    173 Native / 146 WASM  (Group + Audit)
+ *   Inventory:    177 Native / 150 WASM  (Group + Audit)
  *   Built-in:       4 /   4              (server_info, health, adapters, execute_code)
- *   MCP total:    177 Native / 150 WASM  (tools/list response)
+ *   MCP total:    181 Native / 154 WASM  (tools/list response)
  */
 import type { ToolGroup, MetaGroup } from "../types/index.js";
 /**

package/dist/filtering/tool-constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool-constants.d.ts","sourceRoot":"","sources":["../../src/filtering/tool-constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9D;;GAEG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,EAYtC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,CA+MnD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,CAiCtD,CAAC"}
+{"version":3,"file":"tool-constants.d.ts","sourceRoot":"","sources":["../../src/filtering/tool-constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9D;;GAEG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,EAYtC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,CAmNnD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,CAiCtD,CAAC"}

package/dist/{http-2WGR3E5K.js → http-2XDGZF4F.js}

@@ -1,4 +1,4 @@
-import { createModuleLogger, DbMcpError, metrics, runWithAuthContext, ERROR_CODES, logger, SUPPORTED_SCOPES, scopesGrantToolAccess, InsufficientScopeError, hasAdminScope, hasReadScope, isOAuthError, BASE_SCOPES, AuthServerDiscoveryError, JwksFetchError, parseScopes, TokenExpiredError, InvalidSignatureError, InvalidTokenError, TokenMissingError } from './chunk-Y57WFKAP.js';
+import { createModuleLogger, DbMcpError, ErrorCategory, metrics, runWithAuthContext, ERROR_CODES, logger, ConfigurationError, SUPPORTED_SCOPES, scopesGrantToolAccess, InsufficientScopeError, hasAdminScope, hasReadScope, isOAuthError, BASE_SCOPES, AuthServerDiscoveryError, JwksFetchError, parseScopes, TokenExpiredError, InvalidSignatureError, InvalidTokenError, TokenMissingError } from './chunk-XLIYO3YA.js';
 import express from 'express';
 import { localhostHostValidation } from '@modelcontextprotocol/sdk/server/middleware/hostHeaderValidation.js';
 import cors from 'cors';
@@ -148,6 +148,9 @@ var JSONRPC_INTERNAL_ERROR = -32603;
 var HTTP_REQUEST_TIMEOUT_MS = 12e4;
 var HTTP_KEEP_ALIVE_TIMEOUT_MS = 65e3;
 var HTTP_HEADERS_TIMEOUT_MS = 66e3;
+var SESSION_TIMEOUT_MS = 30 * 60 * 1e3;
+var SESSION_SWEEP_INTERVAL_MS = 1 * 60 * 1e3;
+var SESSION_ABSOLUTE_TTL_MS = 24 * 60 * 60 * 1e3;
 function setupSecurityHeaders(state) {
   if (!state.app) return;
   state.app.disable("x-powered-by");
@@ -251,7 +254,12 @@ function setupRateLimiting(state) {
     skip: (req) => req.path === "/health",
     handler: (_req, res, _next, options) => {
       res.status(options.statusCode).json({
-        error: "Too Many Requests"
+        success: false,
+        error: "Too Many Requests",
+        code: "RATE_LIMIT_ERROR",
+        category: "rate_limit",
+        suggestion: "Wait before retrying. Reduce request frequency or configure MCP_RATE_LIMIT_MAX.",
+        recoverable: true
       });
     }
   });
@@ -273,7 +281,7 @@ async function setupStatelessEndpoints(state) {
     throw new DbMcpError(
       "Transport or server not initialized",
       ERROR_CODES.SERVER.TRANSPORT_ERROR.full,
-      "internal" /* INTERNAL */
+      ErrorCategory.INTERNAL
     );
   }
   state.statelessTransport = new StreamableHTTPServerTransport({
@@ -354,15 +362,49 @@ function isValidSessionId(id) {
   if (id.length !== 36) return false;
   return /^[0-9a-fA-F-]{36}$/.test(id);
 }
+function touchSession(state, sessionId) {
+  state.sessionLastActivity.set(sessionId, Date.now());
+}
 function setupStatefulEndpoints(state) {
   if (!state.app || !state.mcpServer) {
     throw new DbMcpError(
       "Transport or server not initialized",
       ERROR_CODES.SERVER.TRANSPORT_ERROR.full,
-      "internal" /* INTERNAL */
+      ErrorCategory.INTERNAL
     );
   }
   const server = state.mcpServer;
+  const sessionSweepTimer = setInterval(() => {
+    const now = Date.now();
+    for (const [sid, lastActivity] of state.sessionLastActivity) {
+      const idleMs = now - lastActivity;
+      if (idleMs <= SESSION_TIMEOUT_MS) continue;
+      if ((state.sessionLocks.get(sid) ?? 0) > 0) continue;
+      if (state.transports.has(sid)) {
+        logger5.info("Expiring idle HTTP session", {
+          code: "HTTP_SESSION_EXPIRE",
+          sessionId: sid,
+          idleMinutes: Math.round(idleMs / 6e4)
+        });
+        const t = state.transports.get(sid);
+        if (t) {
+          void t.close();
+        }
+      }
+      if (state.sseTransports.has(sid)) {
+        logger5.info("Expiring idle SSE session", {
+          code: "SSE_SESSION_EXPIRE",
+          sessionId: sid,
+          idleMinutes: Math.round(idleMs / 6e4)
+        });
+        const t = state.sseTransports.get(sid);
+        if (t) {
+          void t.close();
+        }
+      }
+    }
+  }, SESSION_SWEEP_INTERVAL_MS);
+  sessionSweepTimer.unref();
   state.app.post("/mcp", (req, res) => {
     const sessionId = req.headers["mcp-session-id"];
     if (sessionId !== void 0 && !isValidSessionId(sessionId)) {
@@ -412,10 +454,23 @@ function setupStatefulEndpoints(state) {
             });
             return;
           }
+          const createdAt = state.sessionCreatedAt.get(sessionId) ?? Date.now();
+          if (Date.now() - createdAt > SESSION_ABSOLUTE_TTL_MS) {
+            res.status(401).json({
+              jsonrpc: "2.0",
+              error: {
+                code: JSONRPC_SERVER_ERROR,
+                message: "Unauthorized: Session absolute TTL expired"
+              },
+              id: null
+            });
+            return;
+          }
+          touchSession(state, sessionId);
           httpTransport = existingTransport;
         } else if (sessionId === void 0 && isNewSessionRequest(req.body)) {
           const maxSessions = state.config.maxSessions ?? 1e3;
-          if (state.transports.size >= maxSessions) {
+          if (state.transports.size + state.sseTransports.size >= maxSessions) {
             res.status(429).json({
               jsonrpc: "2.0",
               error: {
@@ -434,6 +489,8 @@ function setupStatefulEndpoints(state) {
                 sessionId: sid
               });
               state.transports.set(sid, newTransport);
+              touchSession(state, sid);
+              state.sessionCreatedAt.set(sid, Date.now());
               state.sessionOwners.set(sid, req.auth?.sub);
             }
           });
@@ -446,6 +503,9 @@ function setupStatefulEndpoints(state) {
               });
               state.transports.delete(sid);
               state.sessionOwners.delete(sid);
+              state.sessionLastActivity.delete(sid);
+              state.sessionCreatedAt.delete(sid);
+              state.sessionLocks.delete(sid);
               if ("subscriptionManager" in server) {
                 server.subscriptionManager.unsubscribeSession(sid);
               }
@@ -492,11 +552,28 @@ function setupStatefulEndpoints(state) {
               release();
             }
           });
-          await newTransport.handleRequest(
-            asIncoming(req),
-            asServerResponse(res),
-            req.body
-          );
+          const activeSid2 = newTransport.sessionId;
+          try {
+            if (activeSid2) {
+              const count = state.sessionLocks.get(activeSid2) ?? 0;
+              state.sessionLocks.set(activeSid2, count + 1);
+            }
+            await newTransport.handleRequest(
+              asIncoming(req),
+              asServerResponse(res),
+              req.body
+            );
+          } finally {
+            if (activeSid2) {
+              const count = state.sessionLocks.get(activeSid2) ?? 0;
+              if (count > 1) {
+                state.sessionLocks.set(activeSid2, count - 1);
+              } else {
+                state.sessionLocks.delete(activeSid2);
+              }
+              touchSession(state, activeSid2);
+            }
+          }
           return;
         } else {
           res.status(400).json({
@@ -509,12 +586,27 @@ function setupStatefulEndpoints(state) {
           });
           return;
         }
-        if (httpTransport !== void 0) {
+        const activeSid = sessionId;
+        try {
+          if (activeSid) {
+            const count = state.sessionLocks.get(activeSid) ?? 0;
+            state.sessionLocks.set(activeSid, count + 1);
+          }
           await httpTransport.handleRequest(
             asIncoming(req),
             asServerResponse(res),
             req.body
           );
+        } finally {
+          if (activeSid) {
+            const count = state.sessionLocks.get(activeSid) ?? 0;
+            if (count > 1) {
+              state.sessionLocks.set(activeSid, count - 1);
+            } else {
+              state.sessionLocks.delete(activeSid);
+            }
+            touchSession(state, activeSid);
+          }
         }
       } catch (error) {
         logger5.error("Error handling MCP request", {
@@ -549,6 +641,12 @@ function setupStatefulEndpoints(state) {
       res.status(403).send("Forbidden: session belongs to a different client");
       return;
     }
+    const createdAt = state.sessionCreatedAt.get(sessionId) ?? Date.now();
+    if (Date.now() - createdAt > SESSION_ABSOLUTE_TTL_MS) {
+      res.status(401).send("Unauthorized: Session absolute TTL expired");
+      return;
+    }
+    touchSession(state, sessionId);
     const lastEventId = req.headers["last-event-id"];
     if (lastEventId !== void 0) {
       logger5.debug("Client reconnecting with Last-Event-ID", {
@@ -557,9 +655,24 @@ function setupStatefulEndpoints(state) {
         lastEventId
       });
     }
-    if (httpTransport !== void 0) {
-      void httpTransport.handleRequest(asIncoming(req), asServerResponse(res));
-    }
+    void (async () => {
+      try {
+        const count = state.sessionLocks.get(sessionId) ?? 0;
+        state.sessionLocks.set(sessionId, count + 1);
+        await httpTransport.handleRequest(
+          asIncoming(req),
+          asServerResponse(res)
+        );
+      } finally {
+        const count = state.sessionLocks.get(sessionId) ?? 0;
+        if (count > 1) {
+          state.sessionLocks.set(sessionId, count - 1);
+        } else {
+          state.sessionLocks.delete(sessionId);
+        }
+        touchSession(state, sessionId);
+      }
+    })();
   });
   state.app.delete("/mcp", (req, res) => {
     const sessionId = req.headers["mcp-session-id"];
@@ -580,10 +693,26 @@ function setupStatefulEndpoints(state) {
       code: "HTTP_SESSION_DELETE",
       sessionId
     });
-    if (httpTransport !== void 0) {
-      void httpTransport.handleRequest(asIncoming(req), asServerResponse(res));
-    }
+    void (async () => {
+      try {
+        const count = state.sessionLocks.get(sessionId) ?? 0;
+        state.sessionLocks.set(sessionId, count + 1);
+        await httpTransport.handleRequest(
+          asIncoming(req),
+          asServerResponse(res)
+        );
+      } finally {
+        const count = state.sessionLocks.get(sessionId) ?? 0;
+        if (count > 1) {
+          state.sessionLocks.set(sessionId, count - 1);
+        } else {
+          state.sessionLocks.delete(sessionId);
+        }
+        touchSession(state, sessionId);
+      }
+    })();
   });
+  return sessionSweepTimer;
 }
 var logger6 = createModuleLogger("HTTP");
 var connectionMutex2 = new Mutex();
@@ -601,6 +730,8 @@ function setupLegacySSEEndpoints(state) {
     void (async () => {
       try {
         state.sseTransports.set(sseTransport.sessionId, sseTransport);
+        touchSession(state, sseTransport.sessionId);
+        state.sessionCreatedAt.set(sseTransport.sessionId, Date.now());
         state.sessionOwners.set(sseTransport.sessionId, req.auth?.sub);
         sseTransport.onclose = () => {
           logger6.info("Legacy SSE transport closed", {
@@ -609,6 +740,8 @@ function setupLegacySSEEndpoints(state) {
           });
           state.sseTransports.delete(sseTransport.sessionId);
           state.sessionOwners.delete(sseTransport.sessionId);
+          state.sessionLastActivity.delete(sseTransport.sessionId);
+          state.sessionCreatedAt.delete(sseTransport.sessionId);
           if ("subscriptionManager" in server) {
             server.subscriptionManager.unsubscribeSession(sseTransport.sessionId);
           }
@@ -672,6 +805,8 @@ function setupLegacySSEEndpoints(state) {
     req.on("close", () => {
       state.sseTransports.delete(sseTransport.sessionId);
       state.sessionOwners.delete(sseTransport.sessionId);
+      state.sessionLastActivity.delete(sseTransport.sessionId);
+      state.sessionCreatedAt.delete(sseTransport.sessionId);
     });
   });
   state.app.post("/messages", (req, res) => {
@@ -710,6 +845,7 @@ function setupLegacySSEEndpoints(state) {
       });
       return;
     }
+    touchSession(state, sessionId);
     void sseTransport.handlePostMessage(
       asIncoming(req),
       asServerResponse(res),
@@ -858,7 +994,7 @@ var AuthorizationServerDiscovery = class {
       const url = new URL(this.authServerUrl);
       const isLocalDev = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
       if (!isLocalDev) {
-        throw new Error(
+        throw new ConfigurationError(
           `Security: Authorization server URL must use HTTPS in production. Got: ${this.authServerUrl}. Set NODE_ENV=development to allow HTTP for local testing.`
         );
       }
@@ -903,7 +1039,7 @@ var AuthorizationServerDiscovery = class {
         throw new DbMcpError(
           `HTTP ${String(response.status)}: ${response.statusText}`,
           ERROR_CODES.AUTH.DISCOVERY_FAILED.full,
-          "connection" /* CONNECTION */
+          ErrorCategory.CONNECTION
         );
       }
       const metadata = await response.json();
@@ -937,14 +1073,14 @@ var AuthorizationServerDiscovery = class {
       throw new DbMcpError(
         "Missing required field: issuer",
         "AUTH_DISCOVERY_INVALID",
-        "validation" /* VALIDATION */
+        ErrorCategory.VALIDATION
       );
     }
     if (!metadata.token_endpoint) {
       throw new DbMcpError(
         "Missing required field: token_endpoint",
         "AUTH_DISCOVERY_INVALID",
-        "validation" /* VALIDATION */
+        ErrorCategory.VALIDATION
       );
     }
     try {
@@ -954,7 +1090,7 @@ var AuthorizationServerDiscovery = class {
       throw new DbMcpError(
         "Invalid URL format in metadata fields",
         "AUTH_DISCOVERY_INVALID",
-        "validation" /* VALIDATION */
+        ErrorCategory.VALIDATION
       );
     }
     const expectedIssuer = this.authServerUrl;
@@ -962,7 +1098,7 @@ var AuthorizationServerDiscovery = class {
       throw new DbMcpError(
         `Issuer validation failed. Per RFC 8414 \xA73.3, the issuer MUST be identical to the authorization server URL.`,
         "AUTH_ISSUER_MISMATCH",
-        "validation" /* VALIDATION */
+        ErrorCategory.VALIDATION
       );
     }
   }
@@ -974,7 +1110,7 @@ var AuthorizationServerDiscovery = class {
       throw new DbMcpError(
         "Authorization server metadata not yet discovered. Call discover() first.",
         "AUTH_DISCOVERY_REQUIRED",
-        "internal" /* INTERNAL */
+        ErrorCategory.INTERNAL
       );
     }
     return this.cachedMetadata;
@@ -990,7 +1126,7 @@ var AuthorizationServerDiscovery = class {
       throw new DbMcpError(
         "Authorization server does not provide jwks_uri",
         "AUTH_DISCOVERY_INVALID",
-        "validation" /* VALIDATION */
+        ErrorCategory.VALIDATION
       );
     }
     return metadata.jwks_uri;
@@ -1082,7 +1218,7 @@ var TokenValidator = class _TokenValidator {
       const url = new URL(config.jwksUri);
       const isLocalDev = url.hostname === "localhost" || url.hostname === "127.0.0.1";
       if (!isLocalDev) {
-        throw new Error(
+        throw new ConfigurationError(
           `Security: JWKS URI must use HTTPS in production. Got: ${config.jwksUri}. Set ALLOW_HTTP_JWKS=true to allow HTTP for local testing.`
         );
       }
@@ -1292,7 +1428,7 @@ function applyAuthMiddleware(state) {
   const corsOrigins = state.config.corsOrigins ?? [];
   const isPubliclyExposed = state.config.oauth.enabled || state.config.noAuthEnforcement;
   if (corsOrigins.includes("*") && isPubliclyExposed) {
-    throw new Error(
+    throw new ConfigurationError(
       "Security: CORS wildcard origin ('*') is forbidden when authentication is enabled or enforcement is explicitly disabled. Configure explicit origins via --cors-origins for production deployments."
     );
   }
@@ -1441,7 +1577,7 @@ function applyScopeEnforcementMiddleware(state) {
 async function setupOAuth(state, resourceUri) {
   logger10.info("Setting up OAuth 2.1...", { code: "HTTP_OAUTH_SETUP" });
   if (state.config.oauth.enabled && !state.config.oauth.audience) {
-    throw new Error(
+    throw new ConfigurationError(
       "Security: OAuth audience must be explicitly configured when OAuth is enabled."
     );
   }
@@ -1495,6 +1631,8 @@ var logger11 = createModuleLogger("HTTP");
 var HttpTransport = class {
   /** Internal state shared with session/middleware/oauth modules */
   state;
+  /** Sweep timer for session timeout cleanup */
+  sweepTimer = null;
   constructor(config) {
     this.state = {
       config: {
@@ -1508,6 +1646,9 @@ var HttpTransport = class {
       transports: /* @__PURE__ */ new Map(),
       sseTransports: /* @__PURE__ */ new Map(),
       sessionOwners: /* @__PURE__ */ new Map(),
+      sessionLastActivity: /* @__PURE__ */ new Map(),
+      sessionCreatedAt: /* @__PURE__ */ new Map(),
+      sessionLocks: /* @__PURE__ */ new Map(),
       statelessTransport: null,
       resourceServer: null,
       authServerDiscovery: null,
@@ -1536,7 +1677,7 @@ var HttpTransport = class {
         throw new DbMcpError(
           "trustedProxyIps cannot be an empty array if specified",
           "CONFIG_ERROR",
-          "config" /* CONFIGURATION */
+          ErrorCategory.CONFIGURATION
         );
       }
       this.state.app.set("trust proxy", this.state.config.trustedProxyIps);
@@ -1555,7 +1696,7 @@ var HttpTransport = class {
       throw new DbMcpError(
         "HTTP transport is enabled without authentication. You must configure OAuth (--oauth-enabled) or explicitly bypass this check with --no-auth-enforcement.",
         "AUTH_REQUIRED",
-        "config" /* CONFIGURATION */
+        ErrorCategory.CONFIGURATION
       );
     }
     if (this.state.config.oauth.enabled) {
@@ -1629,7 +1770,7 @@ var HttpTransport = class {
     if (this.state.config.stateless) {
       await setupStatelessEndpoints(this.state);
     } else {
-      setupStatefulEndpoints(this.state);
+      this.sweepTimer = setupStatefulEndpoints(this.state);
     }
     if (!this.state.config.stateless) {
       setupLegacySSEEndpoints(this.state);
@@ -1654,7 +1795,7 @@ var HttpTransport = class {
       throw new DbMcpError(
         "Transport not initialized. Call initialize() first.",
         ERROR_CODES.SERVER.START_FAILED.full,
-        "internal" /* INTERNAL */
+        ErrorCategory.INTERNAL
       );
     }
     return new Promise((resolve, reject) => {
@@ -1694,6 +1835,10 @@ var HttpTransport = class {
    * Stop the server and close all active sessions
    */
   async stop() {
+    if (this.sweepTimer) {
+      clearInterval(this.sweepTimer);
+      this.sweepTimer = null;
+    }
     for (const [sessionId, transport] of this.state.transports) {
       try {
         logger11.debug("Closing transport", {

package/dist/index.js

@@ -1,4 +1,4 @@
-export { DEFAULT_CONFIG, DbMcpServer, createServer } from './chunk-NIC5Z2CA.js';
-export { DatabaseAdapter } from './chunk-EQF3WZHX.js';
-export { NAME, VERSION } from './chunk-R5M4WKDM.js';
-export { ALL_TOOL_GROUPS, AuthenticationError, AuthorizationError, ConnectionError, DbMcpError, META_GROUPS, QueryError, TOOL_GROUPS, ValidationError, filterTools, getFilterSummary, getToolFilterFromEnv, isToolEnabled, parseToolFilter } from './chunk-Y57WFKAP.js';
+export { DEFAULT_CONFIG, DbMcpServer, createServer } from './chunk-WYBUO4FL.js';
+export { DatabaseAdapter } from './chunk-27C5EE6U.js';
+export { NAME, VERSION } from './chunk-2TYICG7B.js';
+export { ALL_TOOL_GROUPS, AuthenticationError, AuthorizationError, ConnectionError, DbMcpError, META_GROUPS, QueryError, TOOL_GROUPS, ValidationError, filterTools, getFilterSummary, getToolFilterFromEnv, isToolEnabled, parseToolFilter } from './chunk-XLIYO3YA.js';

package/dist/observability/system-db.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"system-db.d.ts","sourceRoot":"","sources":["../../src/observability/system-db.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAK/C,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,QAAQ;IACnB,OAAO,CAAC,EAAE,CAAyB;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiB;gBAE5B,MAAM,EAAE,cAAc;IAI5B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAmF3B,KAAK,IAAI,QAAQ;IAOjB,KAAK,IAAI,IAAI;CAMd"}
+{"version":3,"file":"system-db.d.ts","sourceRoot":"","sources":["../../src/observability/system-db.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAM/C,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,QAAQ;IACnB,OAAO,CAAC,EAAE,CAAyB;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiB;gBAE5B,MAAM,EAAE,cAAc;IAI5B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAmF3B,KAAK,IAAI,QAAQ;IAOjB,KAAK,IAAI,IAAI;CAMd"}

package/dist/server/mcp-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-server.d.ts","sourceRoot":"","sources":["../../src/server/mcp-server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EACV,eAAe,EACf,cAAc,EAEf,MAAM,mBAAmB,CAAC;AAE3B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAqCvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AA+ChE;;;;GAIG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,MAAM,CAAY;IAC1B,OAAO,CAAC,QAAQ,CAAsC;IACtD,OAAO,CAAC,UAAU,CAAmB;IACrC,OAAO,CAAC,MAAM,CAAkB;IAChC,OAAO,CAAC,WAAW,CAA4B;IAC/C,OAAO,CAAC,aAAa,CAA8B;IACnD,OAAO,CAAC,QAAQ,CAAyB;IACzC,OAAO,CAAC,gBAAgB,CAAiC;IACzD,OAAO,CAAC,gBAAgB,CAA8B;IACtD,SAAgB,mBAAmB,EAAE,mBAAmB,CAAC;gBAE7C,MAAM,EAAE,eAAe;IAkKnC;;OAEG;IACG,eAAe,CACnB,OAAO,EAAE,eAAe,EACxB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,IAAI,CAAC;IA0DhB;;OAEG;IACH,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS;IAI1D;;OAEG;IACH,WAAW,IAAI,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC;IAI3C;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAiB5B;;OAEG;YACW,UAAU;IAiBxB;;OAEG;YACW,SAAS;IAyDvB;;OAEG;IACG,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAwC/B;;;OAGG;YACW,eAAe;CA8C9B;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,eAAe,GAAG,WAAW,CAEjE;AAED;;GAEG;AACH,eAAO,MAAM,cAAc,EAAE,OAAO,CAAC,eAAe,CAKnD,CAAC"}
+{"version":3,"file":"mcp-server.d.ts","sourceRoot":"","sources":["../../src/server/mcp-server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EACV,eAAe,EACf,cAAc,EAEf,MAAM,mBAAmB,CAAC;AAE3B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAwCvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AA+ChE;;;;GAIG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,MAAM,CAAY;IAC1B,OAAO,CAAC,QAAQ,CAAsC;IACtD,OAAO,CAAC,UAAU,CAAmB;IACrC,OAAO,CAAC,MAAM,CAAkB;IAChC,OAAO,CAAC,WAAW,CAA4B;IAC/C,OAAO,CAAC,aAAa,CAA8B;IACnD,OAAO,CAAC,QAAQ,CAAyB;IACzC,OAAO,CAAC,gBAAgB,CAAiC;IACzD,OAAO,CAAC,gBAAgB,CAA8B;IACtD,SAAgB,mBAAmB,EAAE,mBAAmB,CAAC;gBAE7C,MAAM,EAAE,eAAe;IAyLnC;;OAEG;IACG,eAAe,CACnB,OAAO,EAAE,eAAe,EACxB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,IAAI,CAAC;IAiEhB;;OAEG;IACH,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS;IAI1D;;OAEG;IACH,WAAW,IAAI,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC;IAI3C;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAiB5B;;OAEG;YACW,UAAU;IAiBxB;;OAEG;YACW,SAAS;IAyDvB;;OAEG;IACG,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAwC/B;;;OAGG;YACW,eAAe;CA8C9B;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,eAAe,GAAG,WAAW,CAEjE;AAED;;GAEG;AACH,eAAO,MAAM,cAAc,EAAE,OAAO,CAAC,eAAe,CAKnD,CAAC"}

package/dist/server/registration/admin-tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin-tools.d.ts","sourceRoot":"","sources":["../../../src/server/registration/admin-tools.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAWzE;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CA+K1D"}
+{"version":3,"file":"admin-tools.d.ts","sourceRoot":"","sources":["../../../src/server/registration/admin-tools.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAazE;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAkL1D"}

package/dist/server/registration/audit-tools/backup.d.ts

@@ -0,0 +1,8 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { DatabaseAdapter } from "../../../adapters/database-adapter.js";
+import type { BackupManager } from "../../../audit/backup-manager.js";
+/**
+ * Register audit backup tools for snapshot management.
+ */
+export declare function registerAuditBackupTools(server: McpServer, backupManager: BackupManager | null, adaptersMap: Map<string, DatabaseAdapter>): void;
+//# sourceMappingURL=backup.d.ts.map

package/dist/server/registration/audit-tools/backup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup.d.ts","sourceRoot":"","sources":["../../../../src/server/registration/audit-tools/backup.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AAqBtE;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,SAAS,EACjB,aAAa,EAAE,aAAa,GAAG,IAAI,EACnC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,GACxC,IAAI,CAkoBN"}

package/dist/server/registration/audit-tools/helpers.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Force redaction of SQL string literals to prevent secret exposure
+ * in audit logs and backups, regardless of operator configuration.
+ */
+export declare function redactSqlLiterals(text: string): string;
+/**
+ * Validate DDL to prevent execution of unauthorized or destructive statements
+ * during restore operations from tampered backups.
+ */
+export declare function validateDdl(sql: string): void;
+//# sourceMappingURL=helpers.d.ts.map

package/dist/server/registration/audit-tools/helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../../src/server/registration/audit-tools/helpers.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAqB7C"}

package/dist/server/registration/audit-tools/index.d.ts

@@ -0,0 +1,4 @@
+export { registerAuditResource } from "./resource.js";
+export { registerAuditBackupTools } from "./backup.js";
+export { registerAuditSearchTool } from "./search.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/server/registration/audit-tools/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/server/registration/audit-tools/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC"}

package/dist/server/registration/audit-tools/resource.d.ts

@@ -0,0 +1,8 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { BackupManager } from "../../../audit/backup-manager.js";
+import type { AuditLogger } from "../../../audit/logger.js";
+/**
+ * Register the sqlite://audit resource for agent access to audit log.
+ */
+export declare function registerAuditResource(server: McpServer, auditLogger: AuditLogger | null, backupManager: BackupManager | null): void;
+//# sourceMappingURL=resource.d.ts.map

package/dist/server/registration/audit-tools/resource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../../../../src/server/registration/audit-tools/resource.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAI5D;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,SAAS,EACjB,WAAW,EAAE,WAAW,GAAG,IAAI,EAC/B,aAAa,EAAE,aAAa,GAAG,IAAI,GAClC,IAAI,CAuCN"}