memory-journal-mcp 8.0.1 → 9.1.0

package/dist/chunk-Y6MMKR2Z.js

@@ -0,0 +1,3766 @@
+import { DUMMY_GREP_SEARCH_TOOL_NAMES, DUMMY_FILE_VIEW_TOOL_NAMES, DUMMY_DIR_LIST_TOOL_NAMES, TOOL_GROUPS, logger, DatabaseAdapterFactory, runAutoPrune, AuditLogger, createAuditInterceptor, getGitHubIntegration, parseToolFilter, getFilterSummary, getToolFilterFromEnv, getAllToolNames, DEFAULT_BRIEFING_CONFIG, getTools, globalSubscriptionManager, getRequiredScope, getResources, getPrompts, callTool, sendProgress, requestContextStorage, MetricsAccumulator, formatPrometheusMetrics, SUPPORTED_SCOPES, logAgentIssue, validateResourceSubscription, isValidScope, getEnabledGroups, generateCodeModeInstructions, generateStandardInstructions, enforceAccessBoundary, auditOperation, parseScopes, BASE_SCOPES, getPrompt, handlePrompt, handleReadResource, handleListResources, handleListPrompts, handleGetPrompt, DUMMY_SERVER_INFO_TOOL_NAMES, handleServerInfo, handleListAdapters, handleGrepSearch, handleViewFile, handleListDir, DUMMY_RESOURCE_TOOL_NAMES, DUMMY_LIST_RESOURCE_TOOL_NAMES, DUMMY_LIST_PROMPT_TOOL_NAMES, DUMMY_LIST_TOOL_NAMES, DUMMY_GET_PROMPT_TOOL_NAMES, DUMMY_PROJECT_TOOL_NAMES, DUMMY_ADAPTER_TOOL_NAMES, readResource } from './chunk-T7SROBBV.js';
+import { VERSION, applyArgInterceptions } from './chunk-SGJU2DHU.js';
+import { runWithAuthContext, getAuthContext } from './chunk-4FZCHFB5.js';
+import { MemoryJournalMcpError, ConfigurationError } from './chunk-E6IQP6PE.js';
+import { StdioServerTransport } from '@modelcontextprotocol/server/stdio';
+import express from 'express';
+import { createHash, timingSafeEqual, randomUUID } from 'crypto';
+import 'https';
+import * as jose from 'jose';
+import { localhostHostValidation, hostHeaderValidation } from '@modelcontextprotocol/express';
+import { toNodeHandler, NodeStreamableHTTPServerTransport } from '@modelcontextprotocol/node';
+import { McpServer, createMcpHandler, ResourceTemplate } from '@modelcontextprotocol/server';
+import * as fs from 'fs';
+import * as path from 'path';
+import { loadSkills } from '@modelcontextprotocol/server/ext/skills/node';
+import * as dns from 'dns';
+import { EventEmitter } from 'events';
+import { parse, stringify } from 'yaml';
+import { z } from 'zod';
+import * as http from 'http';
+
+// src/transports/http/types.ts
+var HTTP_REQUEST_TIMEOUT_MS = 12e4;
+var HTTP_KEEP_ALIVE_TIMEOUT_MS = 65e3;
+var HTTP_HEADERS_TIMEOUT_MS = 66e3;
+var DEFAULT_RATE_LIMIT_WINDOW_MS = 6e4;
+var DEFAULT_RATE_LIMIT_MAX_REQUESTS = 100;
+var DEFAULT_MAX_BODY_BYTES = 1048576;
+var DEFAULT_HSTS_MAX_AGE = 31536e3;
+var CORS_PREFLIGHT_MAX_AGE_SECONDS = 86400;
+var SESSION_TIMEOUT_MS = 30 * 60 * 1e3;
+var SESSION_SWEEP_INTERVAL_MS = 1 * 60 * 1e3;
+function getClientIp(req) {
+  return req.ip ?? req.socket.remoteAddress ?? "unknown";
+}
+function checkRateLimit(req, config, rateLimitMap) {
+  if (config.enableRateLimit === false) {
+    return { allowed: true };
+  }
+  const authReq = req;
+  const subject = authReq.tokenClaims?.sub ?? authReq.tokenClaims?.client_id ?? authReq.auth?.sub ?? authReq.auth?.subject ?? authReq.auth?.clientId;
+  const ip = getClientIp(req);
+  const rawIdentity = typeof subject === "string" && subject ? subject : ip;
+  const clientIdentity = createHash("sha256").update(rawIdentity).digest("hex");
+  const now = Date.now();
+  const windowMs = config.rateLimitWindowMs ?? DEFAULT_RATE_LIMIT_WINDOW_MS;
+  let envMaxRequests = process.env["MCP_RATE_LIMIT_MAX"] ? parseInt(process.env["MCP_RATE_LIMIT_MAX"], 10) : NaN;
+  if (Number.isNaN(envMaxRequests) || envMaxRequests <= 0) {
+    envMaxRequests = DEFAULT_RATE_LIMIT_MAX_REQUESTS;
+  }
+  const maxRequests = config.rateLimitMaxRequests ?? envMaxRequests;
+  const entry = rateLimitMap.get(clientIdentity);
+  if (!entry || now > entry.resetTime) {
+    if (rateLimitMap.size >= 1e4 && !rateLimitMap.has(clientIdentity)) {
+      for (const [key, val] of rateLimitMap.entries()) {
+        if (now > val.resetTime) {
+          rateLimitMap.delete(key);
+        }
+      }
+      if (rateLimitMap.size >= 1e4) {
+        const firstKey = rateLimitMap.keys().next().value;
+        if (firstKey !== void 0) {
+          rateLimitMap.delete(firstKey);
+        }
+      }
+    }
+    rateLimitMap.set(clientIdentity, { count: 1, resetTime: now + windowMs, lastSeen: now });
+    return { allowed: true };
+  }
+  entry.lastSeen = now;
+  rateLimitMap.delete(clientIdentity);
+  rateLimitMap.set(clientIdentity, entry);
+  if (entry.count >= maxRequests) {
+    const retryAfterSeconds = Math.ceil((entry.resetTime - now) / 1e3);
+    return { allowed: false, retryAfterSeconds };
+  }
+  entry.count++;
+  return { allowed: true };
+}
+function setSecurityHeaders(res, config) {
+  res.setHeader("X-Content-Type-Options", "nosniff");
+  res.setHeader("X-Frame-Options", "DENY");
+  res.setHeader("Cache-Control", "no-store, no-cache, must-revalidate");
+  res.setHeader("Content-Security-Policy", "default-src 'none'; frame-ancestors 'none'");
+  res.setHeader("Permissions-Policy", "camera=(), microphone=(), geolocation=()");
+  res.setHeader("Referrer-Policy", "no-referrer");
+  if (config.enableHSTS) {
+    const maxAge = config.hstsMaxAge ?? DEFAULT_HSTS_MAX_AGE;
+    res.setHeader("Strict-Transport-Security", `max-age=${String(maxAge)}; includeSubDomains`);
+  }
+}
+function setCorsHeaders(req, res, config) {
+  let corsOrigins = config.corsOrigins ?? [];
+  const isLocalhost = config.host === "localhost" || config.host === "127.0.0.1" || config.host === "::1";
+  const hasAuth = Boolean(config.authToken) || config.oauthEnabled === true;
+  if (isLocalhost && !hasAuth && corsOrigins.includes("*")) {
+    corsOrigins = corsOrigins.filter((o) => o !== "*");
+  }
+  const isWildcard = corsOrigins.includes("*");
+  const origin = req.headers.origin;
+  if (isWildcard) {
+    res.setHeader("Access-Control-Allow-Origin", "*");
+  } else if (origin) {
+    const whitelist = /* @__PURE__ */ Object.create(null);
+    for (const allowed of corsOrigins) {
+      whitelist[allowed] = true;
+    }
+    if (origin in whitelist) {
+      res.setHeader("Access-Control-Allow-Origin", origin);
+      res.setHeader("Vary", "Origin");
+      if (config.corsAllowCredentials) {
+        res.setHeader("Access-Control-Allow-Credentials", "true");
+      }
+    }
+  }
+  res.setHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS");
+  res.setHeader(
+    "Access-Control-Allow-Headers",
+    "Content-Type, Accept, Authorization, mcp-session-id, Last-Event-ID, mcp-protocol-version"
+  );
+  res.setHeader("Access-Control-Expose-Headers", "mcp-session-id");
+  res.setHeader("Access-Control-Max-Age", String(CORS_PREFLIGHT_MAX_AGE_SECONDS));
+  if (origin && !isWildcard) {
+    const whitelist = /* @__PURE__ */ Object.create(null);
+    for (const allowed of corsOrigins) whitelist[allowed] = true;
+    if (!(origin in whitelist)) {
+      return false;
+    }
+  }
+  return true;
+}
+function handleHealthCheck(_req, res) {
+  res.status(200).json({
+    status: "healthy",
+    timestamp: (/* @__PURE__ */ new Date()).toISOString()
+  });
+}
+function handlePrometheusMetrics(runtime) {
+  return (_req, res) => {
+    if (runtime?.metrics === void 0) {
+      res.status(503).send("Metrics not available");
+      return;
+    }
+    try {
+      const metricsText = formatPrometheusMetrics(runtime.metrics);
+      res.set("Content-Type", "text/plain; version=0.0.4; charset=utf-8");
+      res.status(200).send(metricsText);
+    } catch (error) {
+      logger.error("Failed to format Prometheus metrics", { module: "HTTP", error });
+      res.status(500).send("Internal Server Error");
+    }
+  };
+}
+function handleRootInfo(_req, res) {
+  res.status(200).json({
+    name: "memory-journal-mcp",
+    version: VERSION,
+    description: "Project context management for AI-assisted development",
+    endpoints: {
+      "POST /mcp": "JSON-RPC requests (Streamable HTTP, MCP 2025-03-26)",
+      "GET /mcp": "SSE stream for server-to-client notifications",
+      "DELETE /mcp": "Session termination",
+      "GET /sse": "Legacy SSE connection (MCP 2024-11-05)",
+      "POST /messages": "Legacy SSE message endpoint",
+      "GET /health": "Health check",
+      "GET /metrics": "Prometheus metrics export (if enabled)"
+    },
+    documentation: "https://github.com/neverinfamous/memory-journal-mcp"
+  });
+}
+function createAuthMiddleware(authToken) {
+  logger.info("Bearer token authentication enabled", { module: "HTTP" });
+  return (req, res, next) => {
+    if (req.path === "/health" || req.path === "/metrics") {
+      next();
+      return;
+    }
+    const header = req.headers.authorization;
+    const expected = Buffer.from(`Bearer ${authToken}`);
+    const received = Buffer.from(header ?? "");
+    if (expected.length !== received.length || !timingSafeEqual(expected, received)) {
+      res.status(401).json({ error: "Unauthorized" });
+      return;
+    }
+    const envScopes = process.env["MCP_AUTH_SCOPES"];
+    let defaultScopes = envScopes ? envScopes.split(",").map((s) => s.trim()) : ["read"];
+    const invalidScopes = defaultScopes.filter((s) => !isValidScope(s));
+    if (invalidScopes.length > 0) {
+      logger.warning(
+        `Invalid MCP_AUTH_SCOPES detected: ${invalidScopes.join(", ")}. Falling back to safe defaults.`,
+        { module: "HTTP" }
+      );
+      defaultScopes = ["read"];
+    }
+    const clientIp = getClientIp(req);
+    const hashInput = `${authToken}:${clientIp}`;
+    const identityHash = createHash("sha256").update(hashInput).digest("hex").substring(0, 12);
+    const identity = `bearer-${identityHash}`;
+    req.auth = {
+      sub: identity,
+      subject: identity,
+      scopes: defaultScopes
+    };
+    next();
+  };
+}
+
+// src/auth/errors.ts
+var AUTH_ERROR_CODES = {
+  TOKEN_MISSING: "AUTH_TOKEN_MISSING",
+  TOKEN_INVALID: "AUTH_TOKEN_INVALID",
+  TOKEN_EXPIRED: "AUTH_TOKEN_EXPIRED",
+  SIGNATURE_INVALID: "AUTH_SIGNATURE_INVALID",
+  JWKS_FETCH_FAILED: "AUTH_JWKS_FETCH_FAILED"};
+var OAuthError = class extends MemoryJournalMcpError {
+  /** HTTP status code for this error */
+  httpStatus;
+  /** WWW-Authenticate header value */
+  wwwAuthenticate;
+  constructor(message, code, httpStatus, details, wwwAuthenticate) {
+    const category = httpStatus === 403 ? "authorization" : "authentication";
+    super(message, code, category, {
+      suggestion: httpStatus === 403 ? "Request a token with the required scopes" : "Provide a valid OAuth 2.0 bearer token",
+      recoverable: httpStatus !== 500,
+      details
+    });
+    this.name = "OAuthError";
+    this.httpStatus = httpStatus;
+    this.wwwAuthenticate = wwwAuthenticate;
+  }
+};
+var TokenMissingError = class extends OAuthError {
+  constructor(realm = "memory-journal-mcp") {
+    super(
+      "No access token provided",
+      AUTH_ERROR_CODES.TOKEN_MISSING,
+      401,
+      void 0,
+      `Bearer realm="${realm}"`
+    );
+    this.name = "TokenMissingError";
+  }
+};
+var InvalidTokenError = class extends OAuthError {
+  constructor(message = "Invalid access token", details) {
+    super(message, AUTH_ERROR_CODES.TOKEN_INVALID, 401, details, 'Bearer error="invalid_token"');
+    this.name = "InvalidTokenError";
+  }
+};
+var TokenExpiredError = class extends OAuthError {
+  constructor(expiredAt) {
+    super(
+      "Access token has expired",
+      AUTH_ERROR_CODES.TOKEN_EXPIRED,
+      401,
+      expiredAt ? { expiredAt: expiredAt.toISOString() } : void 0,
+      'Bearer error="invalid_token", error_description="Token has expired"'
+    );
+    this.name = "TokenExpiredError";
+  }
+};
+var InvalidSignatureError = class extends OAuthError {
+  constructor(message = "Token signature verification failed") {
+    super(
+      message,
+      AUTH_ERROR_CODES.SIGNATURE_INVALID,
+      401,
+      void 0,
+      'Bearer error="invalid_token", error_description="Signature verification failed"'
+    );
+    this.name = "InvalidSignatureError";
+  }
+};
+var JwksFetchError = class extends OAuthError {
+  constructor(jwksUri, cause) {
+    super("Failed to fetch JWKS: " + jwksUri, AUTH_ERROR_CODES.JWKS_FETCH_FAILED, 500, {
+      jwksUri,
+      cause: cause?.message
+    });
+    this.name = "JwksFetchError";
+  }
+};
+function isOAuthError(error) {
+  return error instanceof OAuthError;
+}
+
+// src/auth/oauth-resource-server.ts
+var OAuthResourceServer = class {
+  config;
+  metadata = null;
+  constructor(config) {
+    this.config = {
+      resource: config.resource,
+      authorizationServers: config.authorizationServers,
+      scopesSupported: config.scopesSupported.length > 0 ? config.scopesSupported : [...SUPPORTED_SCOPES],
+      bearerMethodsSupported: config.bearerMethodsSupported ?? ["header"]
+    };
+    logger.info(`OAuth Resource Server initialized for: ${this.config.resource}`, {
+      module: "AUTH",
+      operation: "init"
+    });
+  }
+  /**
+   * Get the Protected Resource Metadata document
+   *
+   * @returns RFC 9728 compliant metadata
+   */
+  getMetadata() {
+    this.metadata ??= this.buildMetadata();
+    return this.metadata;
+  }
+  /**
+   * Build the Protected Resource Metadata document
+   */
+  buildMetadata() {
+    return {
+      resource: this.config.resource,
+      authorization_servers: this.config.authorizationServers,
+      scopes_supported: this.config.scopesSupported,
+      bearer_methods_supported: this.config.bearerMethodsSupported,
+      resource_documentation: `${this.config.resource}/docs`,
+      resource_signing_alg_values_supported: ["RS256", "ES256"]
+    };
+  }
+  /**
+   * Get Express request handler for the metadata endpoint
+   *
+   * Serves: GET /.well-known/oauth-protected-resource
+   */
+  getMetadataHandler() {
+    return (_req, res) => {
+      const metadata = this.getMetadata();
+      res.setHeader("Content-Type", "application/oauth-protected-resource-metadata+json");
+      res.setHeader("Cache-Control", "public, max-age=3600");
+      res.json(metadata);
+      logger.info("Protected Resource Metadata served", {
+        module: "AUTH",
+        operation: "metadata-served"
+      });
+    };
+  }
+  /**
+   * Generate WWW-Authenticate header for 401 responses
+   *
+   * @param error - Error type for the header
+   * @param errorDescription - Human-readable error description
+   * @returns WWW-Authenticate header value
+   */
+  getWWWAuthenticateHeader(error, errorDescription) {
+    const escapeHeaderValue = (str) => str.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/[\r\n]/g, " ");
+    const parts = [`Bearer realm="${escapeHeaderValue(this.config.resource)}"`];
+    if (error) {
+      parts.push(`error="${escapeHeaderValue(error)}"`);
+    }
+    if (errorDescription) {
+      parts.push(`error_description="${escapeHeaderValue(errorDescription)}"`);
+    }
+    return parts.join(", ");
+  }
+  /**
+   * Get the resource URI
+   */
+  getResourceUri() {
+    return this.config.resource;
+  }
+  /**
+   * Get the authorization servers
+   */
+  getAuthorizationServers() {
+    return [...this.config.authorizationServers];
+  }
+  /**
+   * Get supported scopes
+   */
+  getSupportedScopes() {
+    return [...this.config.scopesSupported];
+  }
+  /**
+   * Check if a scope is supported by this resource server.
+   */
+  isScopeSupported(scope) {
+    if (BASE_SCOPES.includes(scope)) {
+      return true;
+    }
+    if (this.config.scopesSupported.includes(scope)) {
+      return true;
+    }
+    return false;
+  }
+  /**
+   * Get the well-known metadata endpoint path
+   */
+  getWellKnownPath() {
+    return "/.well-known/oauth-protected-resource";
+  }
+  /**
+   * Clear cached metadata (useful when configuration changes)
+   */
+  clearCache() {
+    this.metadata = null;
+  }
+};
+function createOAuthResourceServer(config) {
+  return new OAuthResourceServer(config);
+}
+var TokenValidator = class {
+  /** Resolved configuration with all defaults applied */
+  jwksUri;
+  issuer;
+  audience;
+  clockTolerance;
+  jwksCacheTtl;
+  jwks = null;
+  jwksExpiry = 0;
+  constructor(config) {
+    this.jwksUri = config.jwksUri;
+    this.issuer = config.issuer;
+    this.audience = config.audience;
+    this.clockTolerance = config.clockTolerance ?? 60;
+    this.jwksCacheTtl = config.jwksCacheTtl ?? 3600;
+    const issuerUrl = new URL(this.issuer);
+    const jwksUrl = new URL(this.jwksUri);
+    const isLoopback = (host) => host === "localhost" || host === "127.0.0.1" || host === "[::1]";
+    if (issuerUrl.protocol !== "https:" && !isLoopback(issuerUrl.hostname)) {
+      throw new Error(
+        `Security Violation: Issuer must use HTTPS protocol (got ${this.issuer})`
+      );
+    }
+    if (jwksUrl.protocol !== "https:" && !isLoopback(jwksUrl.hostname)) {
+      throw new Error(
+        `Security Violation: JWKS URI must use HTTPS protocol (got ${this.jwksUri})`
+      );
+    }
+    if (issuerUrl.origin !== jwksUrl.origin) {
+      throw new Error(
+        `Security Violation: JWKS URI origin (${jwksUrl.origin}) does not match Issuer origin (${issuerUrl.origin})`
+      );
+    }
+    const issuerHost = new URL(this.issuer).hostname;
+    logger.info(`Token Validator initialized for issuer: ${issuerHost}`, {
+      module: "AUTH",
+      operation: "init"
+    });
+  }
+  /**
+   * Validate an access token
+   *
+   * @param token - The JWT access token
+   * @returns Validation result with claims or error
+   */
+  async validate(token) {
+    try {
+      const jwks = this.getJwks();
+      const { payload } = await jose.jwtVerify(token, jwks, {
+        issuer: this.issuer,
+        audience: this.audience,
+        clockTolerance: this.clockTolerance,
+        algorithms: ["RS256", "RS384", "RS512", "ES256", "ES384", "ES512", "EdDSA"],
+        // jose only checks `exp` when it is present. Require it so a validly signed token
+        // without an expiry cannot become a permanent credential.
+        requiredClaims: ["exp"]
+      });
+      const claims = this.extractClaims(payload);
+      logger.info(`Token validated for subject: ${claims.sub}`, {
+        module: "AUTH",
+        operation: "validate",
+        entityId: claims.sub
+      });
+      return {
+        valid: true,
+        claims
+      };
+    } catch (error) {
+      return this.handleValidationError(error);
+    }
+  }
+  /**
+   * Get or refresh the JWKS
+   */
+  getJwks() {
+    if (this.jwks && Date.now() < this.jwksExpiry) {
+      return this.jwks;
+    }
+    const jwksHost = (() => {
+      try {
+        return new URL(this.jwksUri).hostname;
+      } catch {
+        return "[configured]";
+      }
+    })();
+    logger.info(`Fetching JWKS from: ${jwksHost}`, {
+      module: "AUTH",
+      operation: "jwks-fetch"
+    });
+    try {
+      this.jwks = jose.createRemoteJWKSet(new URL(this.jwksUri), {
+        cooldownDuration: 3e4,
+        // 30 seconds between retries
+        cacheMaxAge: this.jwksCacheTtl * 1e3,
+        timeoutDuration: 5e3
+        // Explicit 5s timeout to prevent socket hangs
+      });
+      this.jwksExpiry = Date.now() + this.jwksCacheTtl * 1e3;
+      logger.info(`JWKS cached for ${String(this.jwksCacheTtl)}s`, {
+        module: "AUTH",
+        operation: "jwks-cache"
+      });
+      return this.jwks;
+    } catch (error) {
+      const cause = error instanceof Error ? error : new Error(String(error));
+      logger.error("Failed to fetch JWKS", {
+        module: "AUTH",
+        operation: "jwks-fetch",
+        error: cause.message
+      });
+      throw new JwksFetchError(this.jwksUri, cause);
+    }
+  }
+  /**
+   * Extract and normalize token claims
+   */
+  extractClaims(payload) {
+    let scopes = [];
+    if (typeof payload["scope"] === "string") {
+      scopes = parseScopes(payload["scope"]);
+    } else if (Array.isArray(payload["scopes"])) {
+      scopes = payload["scopes"].filter((s) => typeof s === "string");
+    } else if (Array.isArray(payload["scope"])) {
+      scopes = payload["scope"].filter((s) => typeof s === "string");
+    }
+    const { exp } = payload;
+    if (exp === void 0) {
+      throw new jose.errors.JWTClaimValidationFailed(
+        'missing required "exp" claim',
+        payload,
+        "exp",
+        "missing"
+      );
+    }
+    return {
+      sub: payload.sub ?? "unknown",
+      scopes,
+      exp,
+      iat: payload.iat ?? 0,
+      iss: payload.iss,
+      aud: payload.aud,
+      nbf: payload.nbf ?? void 0,
+      jti: payload.jti,
+      client_id: payload["client_id"],
+      // Include all other claims
+      ...payload
+    };
+  }
+  /**
+   * Handle validation errors and convert to TokenValidationResult
+   */
+  handleValidationError(error) {
+    if (error instanceof jose.errors.JWTExpired) {
+      logger.warning("Token has expired", {
+        module: "AUTH",
+        operation: "validate"
+      });
+      return {
+        valid: false,
+        error: "Invalid or expired token",
+        errorCode: AUTH_ERROR_CODES.TOKEN_EXPIRED
+      };
+    }
+    if (error instanceof jose.errors.JWTClaimValidationFailed) {
+      logger.warning(`Token claim validation failed: ${error.message}`, {
+        module: "AUTH",
+        operation: "validate"
+      });
+      return {
+        valid: false,
+        error: "Invalid or expired token",
+        errorCode: AUTH_ERROR_CODES.TOKEN_INVALID
+      };
+    }
+    if (error instanceof jose.errors.JWSSignatureVerificationFailed) {
+      logger.warning("Token signature verification failed", {
+        module: "AUTH",
+        operation: "validate"
+      });
+      return {
+        valid: false,
+        error: "Invalid or expired token",
+        errorCode: AUTH_ERROR_CODES.SIGNATURE_INVALID
+      };
+    }
+    if (error instanceof jose.errors.JWKSNoMatchingKey) {
+      logger.warning("No matching key found in JWKS", {
+        module: "AUTH",
+        operation: "validate"
+      });
+      return {
+        valid: false,
+        error: "Invalid or expired token",
+        errorCode: AUTH_ERROR_CODES.TOKEN_INVALID
+      };
+    }
+    const message = error instanceof Error ? error.message : String(error);
+    logger.error(`Token validation failed: ${message}`, {
+      module: "AUTH",
+      operation: "validate"
+    });
+    return {
+      valid: false,
+      error: "Invalid or expired token",
+      errorCode: AUTH_ERROR_CODES.TOKEN_INVALID
+    };
+  }
+  /**
+   * Refresh the JWKS cache
+   */
+  refreshJwks() {
+    this.jwks = null;
+    this.jwksExpiry = 0;
+    this.getJwks();
+    logger.info("JWKS cache refreshed", { module: "AUTH", operation: "jwks-refresh" });
+  }
+  /**
+   * Clear the JWKS cache
+   */
+  clearCache() {
+    this.jwks = null;
+    this.jwksExpiry = 0;
+    logger.info("Token validator cache cleared", { module: "AUTH", operation: "cache-clear" });
+  }
+  /**
+   * Convert a validation error to the appropriate OAuth error class
+   */
+  static toOAuthError(result) {
+    if (result.errorCode === AUTH_ERROR_CODES.TOKEN_EXPIRED) {
+      return new TokenExpiredError();
+    }
+    if (result.errorCode === AUTH_ERROR_CODES.SIGNATURE_INVALID) {
+      return new InvalidSignatureError();
+    }
+    return new InvalidTokenError(result.error);
+  }
+  /**
+   * Preload JWKS to validate availability at startup
+   */
+  async preload() {
+    const jwksHost = (() => {
+      try {
+        return new URL(this.jwksUri).hostname;
+      } catch {
+        return "[configured]";
+      }
+    })();
+    logger.info(`Pre-fetching JWKS from: ${jwksHost}`, {
+      module: "AUTH",
+      operation: "jwks-preload"
+    });
+    try {
+      const response = await fetch(this.jwksUri, {
+        method: "GET",
+        signal: AbortSignal.timeout(1e4),
+        redirect: "error"
+      });
+      if (!response.ok) {
+        throw new Error(`HTTP error! status: ${response.status}`);
+      }
+    } catch (error) {
+      const cause = error instanceof Error ? error : new Error(String(error));
+      logger.error("Failed to pre-fetch JWKS at startup", {
+        module: "AUTH",
+        operation: "jwks-preload",
+        error: cause.message
+      });
+      throw new JwksFetchError(this.jwksUri, cause);
+    }
+  }
+};
+function createTokenValidator(config) {
+  return new TokenValidator(config);
+}
+
+// src/auth/transport-agnostic.ts
+function extractBearerToken(authHeader) {
+  if (!authHeader) return null;
+  const parts = authHeader.split(" ");
+  const scheme = parts[0];
+  const tokenPart = parts[1];
+  if (parts.length !== 2 || scheme?.toLowerCase() !== "bearer") return null;
+  if (tokenPart === void 0) return null;
+  const token = tokenPart.trim();
+  return token.length > 0 ? token : null;
+}
+
+// src/auth/middleware.ts
+function isPublicPath(path2, publicPaths) {
+  if (path2 === "/.well-known/oauth-authorization-server" || path2 === "/.well-known/jwks.json") {
+    return true;
+  }
+  for (const pattern of publicPaths) {
+    if (pattern === path2) {
+      return true;
+    }
+    if (pattern.endsWith("/*")) {
+      const prefix = pattern.slice(0, -2);
+      if (path2 === prefix || path2.startsWith(prefix + "/")) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+function createAuthMiddleware2(config) {
+  const { tokenValidator, resourceServer, publicPaths = [] } = config;
+  return async (req, res, next) => {
+    const authReq = req;
+    const requestId = crypto.randomUUID();
+    authReq.requestId = requestId;
+    if (isPublicPath(req.path, publicPaths)) {
+      logger.info(`Public path accessed: ${req.path}`, {
+        module: "AUTH",
+        operation: "public-path"
+      });
+      next();
+      return;
+    }
+    const token = extractBearerToken(req.headers.authorization);
+    if (!token) {
+      const error = new TokenMissingError(resourceServer.getResourceUri());
+      logger.warning("No access token provided", {
+        module: "AUTH",
+        operation: "authenticate"
+      });
+      res.status(error.httpStatus);
+      res.setHeader("WWW-Authenticate", error.wwwAuthenticate ?? "");
+      res.json({
+        error: "unauthorized",
+        error_description: error.message
+      });
+      return;
+    }
+    const result = await tokenValidator.validate(token);
+    if (!result.valid) {
+      logger.warning(`Token validation failed: ${result.error ?? "Unknown error"}`, {
+        module: "AUTH",
+        operation: "authenticate"
+      });
+      res.status(401);
+      res.setHeader(
+        "WWW-Authenticate",
+        resourceServer.getWWWAuthenticateHeader("invalid_token", result.error)
+      );
+      res.json({
+        error: "invalid_token",
+        error_description: result.error
+      });
+      return;
+    }
+    const claims = result.claims;
+    if (!claims) {
+      res.status(500).json({ error: "internal_error" });
+      return;
+    }
+    const authInfo = {
+      token,
+      clientId: claims.client_id || claims.sub,
+      scopes: claims.scopes,
+      expiresAt: claims.exp * 1e3
+    };
+    authReq.auth = authInfo;
+    authReq.tokenClaims = claims;
+    authReq.accessToken = token;
+    logger.info(`Request authenticated: ${claims.sub}`, {
+      module: "AUTH",
+      operation: "authenticate",
+      entityId: claims.sub
+    });
+    next();
+  };
+}
+function oauthErrorHandler(error, _req, res, next) {
+  if (isOAuthError(error)) {
+    res.status(error.httpStatus);
+    if (error.wwwAuthenticate) {
+      res.setHeader("WWW-Authenticate", error.wwwAuthenticate);
+    }
+    res.json({
+      error: error.code,
+      error_description: error.message
+    });
+    return;
+  }
+  next(error);
+}
+var LegacySSEServerTransport = class {
+  constructor(messagesEndpoint, sessionId) {
+    this.messagesEndpoint = messagesEndpoint;
+    this.sessionId = sessionId ?? randomUUID();
+  }
+  messagesEndpoint;
+  res = null;
+  sessionId;
+  onclose;
+  onerror;
+  onmessage;
+  async start() {
+  }
+  close() {
+    if (this.res) {
+      this.res.end();
+      this.res = null;
+    }
+    const onclose = this.onclose;
+    this.onclose = void 0;
+    onclose?.();
+    return Promise.resolve();
+  }
+  send(message) {
+    if (!this.res) {
+      return Promise.reject(new Error("Not connected"));
+    }
+    this.res.write(`event: message
+data: ${JSON.stringify(message)}
+
+`);
+    return Promise.resolve();
+  }
+  /**
+   * Handles the initial GET request to establish the SSE stream.
+   */
+  handleSseRequest(req, res) {
+    if (this.res !== null) {
+      res.status(409).json({ error: { message: "SSE stream already connected for this session" } });
+      return;
+    }
+    this.res = res;
+    res.writeHead(200, {
+      "Content-Type": "text/event-stream",
+      "Cache-Control": "no-cache, no-transform",
+      "Connection": "keep-alive",
+      "X-Accel-Buffering": "no",
+      "mcp-session-id": this.sessionId
+    });
+    const endpointUrl = `${this.messagesEndpoint}?sessionId=${this.sessionId}`;
+    res.write(`event: endpoint
+data: ${endpointUrl}
+
+`);
+    req.on("close", () => {
+      this.close().catch((err) => {
+        logger.error("Error closing Legacy SSE transport", { error: String(err) });
+      });
+    });
+  }
+  /**
+   * Handles incoming POST requests containing JSON-RPC messages.
+   */
+  handlePostMessage(req, res) {
+    const body = req.body;
+    if (body === void 0 || body === null || typeof body !== "object") {
+      res.status(400).json({ error: "Invalid JSON body" });
+      return;
+    }
+    if (this.onmessage) {
+      this.onmessage(req.body);
+    }
+    res.status(202).end();
+  }
+};
+
+// src/transports/http/server/protocol-handlers.ts
+var MAX_ACTIVE_SESSIONS = 100;
+function resolveRequestSubject() {
+  const claims = getAuthContext()?.claims;
+  const sub = claims?.sub ?? claims?.email ?? claims?.client_id ?? claims?.subject ?? claims?.clientId;
+  return typeof sub === "string" && sub.length > 0 ? sub : void 0;
+}
+function registerMcpProtocolRoutes(app, config, serverFactory, activeServers, sseTransports) {
+  const statelessMcpHandler = toNodeHandler(
+    createMcpHandler(
+      () => {
+        const server = serverFactory();
+        activeServers.add(server);
+        const originalClose = server.close.bind(server);
+        server.close = async () => {
+          activeServers.delete(server);
+          return originalClose();
+        };
+        return server;
+      },
+      { legacy: "reject" }
+    )
+  );
+  const sessionOwners = /* @__PURE__ */ new Map();
+  const sessionLastActivity = /* @__PURE__ */ new Map();
+  const sweepTimer = setInterval(() => {
+    const now = Date.now();
+    for (const [sid, lastActive] of sessionLastActivity.entries()) {
+      if (now - lastActive > SESSION_TIMEOUT_MS) {
+        const transport = sseTransports.get(sid);
+        if (transport !== void 0) {
+          void transport.close();
+          sseTransports.delete(sid);
+        }
+        sessionOwners.delete(sid);
+        sessionLastActivity.delete(sid);
+        globalSubscriptionManager.unregisterServer(sid);
+      }
+    }
+  }, SESSION_SWEEP_INTERVAL_MS);
+  sweepTimer.unref();
+  const verifySessionOwner = (res, sid) => {
+    const expectedOwner = sessionOwners.get(sid);
+    const callerSubject = resolveRequestSubject();
+    if (expectedOwner !== void 0 && expectedOwner !== callerSubject) {
+      res.status(403).json({ error: { message: "Forbidden: Session belongs to another principal" } });
+      return false;
+    }
+    sessionLastActivity.set(sid, Date.now());
+    return true;
+  };
+  const createSessionAndHandle = (req, res, next, _sid, isLegacySse = false) => {
+    if (sseTransports.size >= MAX_ACTIVE_SESSIONS) {
+      res.status(503).json({
+        error: { message: "Service Unavailable: Maximum active stateful sessions reached" }
+      });
+      return;
+    }
+    const sid = _sid ?? randomUUID();
+    const transport = isLegacySse ? new LegacySSEServerTransport("/messages", sid) : new NodeStreamableHTTPServerTransport({
+      sessionIdGenerator: () => sid
+    });
+    const sessionId = sid;
+    const server = serverFactory();
+    const callerSubject = resolveRequestSubject();
+    if (callerSubject !== void 0) {
+      sessionOwners.set(sessionId, callerSubject);
+    }
+    sessionLastActivity.set(sessionId, Date.now());
+    const authLog = callerSubject !== void 0 ? ` as ${callerSubject}` : "";
+    logger.info(`New MCP stateful session initialized${authLog}`, {
+      module: "HTTP",
+      sessionId,
+      ...callerSubject !== void 0 ? { subject: callerSubject } : {}
+    });
+    activeServers.add(server);
+    globalSubscriptionManager.registerServer(sessionId, server);
+    const originalClose = server.close.bind(server);
+    server.close = async () => {
+      activeServers.delete(server);
+      sseTransports.delete(sessionId);
+      sessionOwners.delete(sessionId);
+      sessionLastActivity.delete(sessionId);
+      globalSubscriptionManager.unregisterServer(sessionId);
+      return originalClose();
+    };
+    sseTransports.set(sessionId, transport);
+    transport.onclose = () => {
+      server.close().catch(
+        (err) => logger.error("Error closing server on transport close", {
+          error: String(err)
+        })
+      );
+    };
+    server.connect(transport).catch(
+      (err) => logger.error("Error connecting server to transport", {
+        error: String(err)
+      })
+    );
+    if (transport instanceof LegacySSEServerTransport) {
+      transport.handleSseRequest(req, res);
+    } else {
+      transport.handleRequest(req, res, req.body).catch((err) => {
+        logger.error("Error handling transport request", {
+          error: String(err),
+          ...err instanceof Error && err.stack !== void 0 ? { stack: err.stack } : {}
+        });
+        next(err);
+      });
+    }
+  };
+  const handleStatefulGet = (req, res, next) => {
+    if (config.stateless) {
+      if (req.path === "/sse" || req.path === "/sse/") {
+        next();
+        return;
+      }
+      res.status(405).json({
+        error: { message: "SSE streaming not available in stateless mode" }
+      });
+      return;
+    }
+    const sid = req.query?.["sessionId"] ?? req.headers?.["mcp-session-id"];
+    if (sid !== void 0 && sid !== "") {
+      const transport = sseTransports.get(sid);
+      if (transport === void 0) {
+        res.status(400).json({ error: { message: "Session not found" } });
+        return;
+      }
+      if (!verifySessionOwner(res, sid)) return;
+      if (transport instanceof LegacySSEServerTransport) {
+        transport.handleSseRequest(req, res);
+      } else {
+        transport.handleRequest(req, res).catch((err) => {
+          next(err);
+        });
+      }
+    } else {
+      if (req.path === "/sse" || req.path === "/sse/") {
+        createSessionAndHandle(req, res, next, randomUUID(), true);
+        return;
+      }
+      res.status(405).json({
+        error: "Method Not Allowed (Streamable HTTP requires POST initialization)"
+      });
+      return;
+    }
+  };
+  app.get("/mcp", handleStatefulGet);
+  app.get("/sse", handleStatefulGet);
+  const handlePost = (req, res, next) => {
+    const sid = req.query?.["sessionId"] ?? req.headers?.["mcp-session-id"];
+    if (sid !== void 0 && sid !== "") {
+      const transport = sseTransports.get(sid);
+      if (transport === void 0) {
+        res.status(400).json({ error: { message: "Session not found" } });
+        return;
+      }
+      if (!verifySessionOwner(res, sid)) return;
+      if (transport instanceof LegacySSEServerTransport) {
+        transport.handlePostMessage(req, res);
+      } else {
+        transport.handleRequest(req, res, req.body).catch((err) => {
+          next(err);
+        });
+      }
+    } else {
+      const acceptsSse = req.headers.accept?.includes("text/event-stream") ?? false;
+      const isLegacyMessages = req.path === "/messages" || req.path === "/messages/";
+      if (isLegacyMessages) {
+        res.status(400).json({ error: { message: "Missing sessionId parameter" } });
+      } else if (acceptsSse && !config.stateless) {
+        createSessionAndHandle(req, res, next, randomUUID(), false);
+      } else {
+        logger.debug("Routing to statelessMcpHandler", {
+          method: req.method,
+          path: req.path
+        });
+        statelessMcpHandler(req, res, req.body).catch((err) => {
+          next(err);
+        });
+      }
+    }
+  };
+  app.post("/mcp", handlePost);
+  app.post("/sse", handlePost);
+  app.post("/messages", handlePost);
+  app.delete("/mcp", (req, res) => {
+    if (config.stateless) {
+      res.status(204).end();
+      return;
+    }
+    const sid = req.query?.["sessionId"] ?? req.headers?.["mcp-session-id"];
+    if (sid === void 0 || sid === "") {
+      res.status(400).json({ error: { message: "Missing sessionId parameter" } });
+      return;
+    }
+    const transport = sseTransports.get(sid);
+    if (transport !== void 0) {
+      if (!verifySessionOwner(res, sid)) return;
+      void transport.close();
+      sseTransports.delete(sid);
+      sessionOwners.delete(sid);
+      sessionLastActivity.delete(sid);
+      globalSubscriptionManager.unregisterServer(sid);
+    }
+    res.status(204).end();
+  });
+}
+
+// src/transports/http/server/http-transport.ts
+var HttpTransport = class {
+  app;
+  config;
+  activeServers = /* @__PURE__ */ new Set();
+  httpServer = null;
+  sseTransports = /* @__PURE__ */ new Map();
+  rateLimitMap = /* @__PURE__ */ new Map();
+  rateLimitCleanupTimer = null;
+  constructor(config) {
+    this.config = {
+      ...config,
+      enableRateLimit: config.enableRateLimit ?? true
+    };
+    this.app = express();
+    if (this.config.trustProxy === true) {
+      this.app.set("trust proxy", "loopback");
+    }
+  }
+  async start(serverFactory, scheduler, runtime) {
+    const { port, host, authToken, corsOrigins } = this.config;
+    const isLocalhost = host === "localhost" || host === "127.0.0.1" || host === "::1";
+    const hasCorsOpen = corsOrigins?.includes("*") ?? false;
+    const hasAuth = Boolean(authToken) || this.config.oauthEnabled === true;
+    if (!hasAuth && hasCorsOpen) {
+      const errorMsg = `FATAL: Refusing to bind HTTP with open wildcard CORS ('*') without explicit authentication. You MUST specify --auth-token (or OAuth) or restrict --cors-origin to specific trusted origins.`;
+      logger.error(errorMsg, { module: "HTTP" });
+      throw new Error(errorMsg);
+    }
+    if (authToken === "change_this_to_a_secure_token_for_production") {
+      const errorMsg = `FATAL: Default auth token detected. You MUST change MCP_AUTH_TOKEN to a secure, cryptographically random value for production.`;
+      logger.error(errorMsg, { module: "HTTP" });
+      throw new Error(errorMsg);
+    }
+    if (!isLocalhost && !hasAuth) {
+      const errorMsg = `FATAL: Refusing to bind public HTTP on '${host}' without explicit authentication. You MUST specify --auth-token (or OAuth).`;
+      logger.error(errorMsg, { module: "HTTP" });
+      throw new Error(errorMsg);
+    }
+    if (hasCorsOpen) {
+      logger.warning(
+        'CORS origin is set to "*" (all origins). Set --cors-origin or MCP_CORS_ORIGIN for production deployments.',
+        { module: "HTTP" }
+      );
+    }
+    if (!hasAuth) {
+      logger.warning(
+        "No authentication configured for HTTP transport. Set --auth-token or MCP_AUTH_TOKEN for production deployments.",
+        { module: "HTTP" }
+      );
+    }
+    const isLocalHostHeader = host === "localhost" || host === "127.0.0.1" || host === "::1";
+    this.app.use(
+      isLocalHostHeader ? localhostHostValidation() : hostHeaderValidation([host, "localhost", "127.0.0.1", "[::1]"])
+    );
+    logger.info("DNS rebinding protection enabled (host header validation)", {
+      module: "HTTP",
+      allowedHosts: isLocalHostHeader ? ["localhost", "127.0.0.1", "[::1]"] : [host]
+    });
+    this.app.use((req, res, next) => {
+      setSecurityHeaders(res, this.config);
+      const allowed = setCorsHeaders(req, res, this.config);
+      if (!allowed) {
+        res.status(403).json({ error: "CORS policy violation" });
+        return;
+      }
+      next();
+    });
+    this.app.use((req, res, next) => {
+      if (req.method === "OPTIONS") {
+        res.status(204).end();
+        return;
+      }
+      next();
+    });
+    const maxBody = this.config.maxBodySize ?? DEFAULT_MAX_BODY_BYTES;
+    const jsonParser = express.json({ limit: maxBody });
+    this.app.use((req, res, next) => {
+      const contentLength = parseInt(req.headers["content-length"] ?? "0", 10);
+      if (contentLength > maxBody) {
+        res.status(413).json({
+          jsonrpc: "2.0",
+          error: {
+            code: -32e3,
+            message: "Payload Too Large: Maximum request body size exceeded"
+          },
+          id: null
+        });
+        return;
+      }
+      jsonParser(req, res, next);
+    });
+    this.app.use((err, _req, res, next) => {
+      if (err !== null && typeof err === "object" && "type" in err) {
+        const errRecord = err;
+        if (typeof errRecord["type"] === "string") {
+          const errType = errRecord["type"];
+          if (errType === "entity.too.large") {
+            res.status(413).json({
+              jsonrpc: "2.0",
+              error: {
+                code: -32e3,
+                message: "Payload Too Large: Maximum request body size exceeded"
+              },
+              id: null
+            });
+            return;
+          }
+          if (errType === "entity.parse.failed") {
+            res.status(400).json({
+              jsonrpc: "2.0",
+              error: {
+                code: -32700,
+                message: "Parse error: Invalid JSON"
+              },
+              id: null
+            });
+            return;
+          }
+        }
+      }
+      next(err);
+    });
+    if (this.config.enableRateLimit !== false) {
+      this.app.use((req, res, next) => {
+        const result = checkRateLimit(req, this.config, this.rateLimitMap);
+        if (!result.allowed) {
+          if (result.retryAfterSeconds !== void 0) {
+            res.setHeader("Retry-After", String(result.retryAfterSeconds));
+          }
+          res.status(429).json({
+            error: "Too Many Requests",
+            retryAfter: result.retryAfterSeconds
+          });
+          return;
+        }
+        next();
+      });
+      this.rateLimitCleanupTimer = setInterval(() => {
+        const now = Date.now();
+        for (const [key, entry] of this.rateLimitMap) {
+          if (now > entry.resetTime) {
+            this.rateLimitMap.delete(key);
+          }
+        }
+      }, 6e4);
+      this.rateLimitCleanupTimer.unref();
+      logger.info("Rate limiting enabled (using IP)", { module: "HTTP" });
+    }
+    if (this.config.oauthEnabled === true && this.config.oauthIssuer !== void 0 && this.config.oauthAudience !== void 0) {
+      if (this.config.oauthIssuer.startsWith("http://")) {
+        if (this.config.allowPlaintextLoopbackOAuth !== true) {
+          const errorMsg = `FATAL: OAuth issuer targets a plaintext protocol. You MUST deliberately set 'allowPlaintextLoopbackOAuth: true' in config to bypass strict discovery bound.`;
+          logger.error(errorMsg, { module: "HTTP", operation: "oauth-config" });
+          throw new Error(errorMsg);
+        }
+        try {
+          const url = new URL(this.config.oauthIssuer);
+          if (url.hostname !== "localhost" && url.hostname !== "127.0.0.1" && url.hostname !== "[::1]") {
+            throw new Error();
+          }
+        } catch {
+          const errorMsg = `FATAL: Plaintext OAuth bypass is ONLY permitted for loopback hosts (localhost, 127.0.0.1, [::1]). The configured issuer is not allowed.`;
+          logger.error(errorMsg, { module: "HTTP", operation: "oauth-config" });
+          throw new Error(errorMsg);
+        }
+      }
+      if (!isLocalhost && (this.config.publicOrigin === void 0 || this.config.publicOrigin === "")) {
+        const errorMsg = `FATAL: OAuth is enabled on a non-loopback interface ('${host}'), but no 'publicOrigin' was provided. You MUST specify an explicit public origin (e.g. 'https://api.example.com') for secure OAuth token audience binding.`;
+        logger.error(errorMsg, { module: "HTTP" });
+        throw new Error(errorMsg);
+      }
+      const jwksUri = this.config.oauthJwksUri ?? `${this.config.oauthIssuer}/.well-known/jwks.json`;
+      const tokenValidator = createTokenValidator({
+        jwksUri,
+        issuer: this.config.oauthIssuer,
+        audience: this.config.oauthAudience,
+        clockTolerance: this.config.oauthClockTolerance ?? 60
+      });
+      await tokenValidator.preload();
+      const resourceServer = createOAuthResourceServer({
+        resource: this.config.publicOrigin ?? `http://${host}:${String(port)}`,
+        authorizationServers: [this.config.oauthIssuer],
+        scopesSupported: [...SUPPORTED_SCOPES]
+      });
+      this.app.get(resourceServer.getWellKnownPath(), resourceServer.getMetadataHandler());
+      this.app.use(
+        createAuthMiddleware2({
+          tokenValidator,
+          resourceServer,
+          publicPaths: ["/health", "/", "/.well-known/*"]
+        })
+      );
+      this.app.use(oauthErrorHandler);
+      logger.info("OAuth 2.1 authentication enabled", {
+        module: "HTTP",
+        resource: resourceServer.getResourceUri(),
+        audience: this.config.oauthAudience
+      });
+    } else if (authToken !== void 0 && authToken !== "") {
+      this.app.use(createAuthMiddleware(authToken));
+    }
+    const propagateContextMiddleware = (req, _res, next) => {
+      const reqRecord = req;
+      const tokenClaims = reqRecord["tokenClaims"];
+      const authInfo = reqRecord["auth"];
+      if (tokenClaims !== void 0 && tokenClaims !== null) {
+        runWithAuthContext(
+          { authenticated: true, claims: tokenClaims, scopes: tokenClaims.scopes },
+          next
+        );
+      } else if (authInfo !== void 0 && authInfo !== null) {
+        const sub = authInfo.sub ?? (typeof authInfo["subject"] === "string" ? authInfo["subject"] : void 0) ?? authInfo.clientId ?? "unknown";
+        const normalizedClaims = {
+          ...authInfo,
+          sub,
+          scopes: Array.isArray(authInfo.scopes) ? authInfo.scopes : []
+        };
+        runWithAuthContext(
+          { authenticated: true, claims: normalizedClaims, scopes: normalizedClaims.scopes },
+          next
+        );
+      } else {
+        next();
+      }
+    };
+    this.app.use(propagateContextMiddleware);
+    this.app.get("/health", handleHealthCheck);
+    if (this.config.metricsExport === "prometheus") {
+      this.app.get("/metrics", handlePrometheusMetrics(runtime));
+      logger.info("Prometheus metrics export enabled on /metrics", { module: "HTTP" });
+    }
+    this.app.get("/", handleRootInfo);
+    registerMcpProtocolRoutes(
+      this.app,
+      this.config,
+      serverFactory,
+      this.activeServers,
+      this.sseTransports
+    );
+    this.app.use((req, res) => {
+      logger.debug("404 Not Found", {
+        method: req.method,
+        path: req.path
+      });
+      res.status(404).json({ error: "Not found" });
+    });
+    this.httpServer = this.app.listen(port, host, () => {
+      if (this.httpServer !== null) {
+        this.httpServer.setTimeout(HTTP_REQUEST_TIMEOUT_MS);
+        this.httpServer.keepAliveTimeout = HTTP_KEEP_ALIVE_TIMEOUT_MS;
+        this.httpServer.headersTimeout = HTTP_HEADERS_TIMEOUT_MS;
+      }
+      logger.info(
+        `MCP server started on HTTP (${this.config.stateless ? "stateless" : "stateful"})`,
+        {
+          module: "HTTP",
+          port,
+          host,
+          endpoint: `http://${host}:${String(port)}/mcp`
+        }
+      );
+    });
+    scheduler?.start();
+    this.httpServer.on("close", () => {
+      logger.info("HTTP server closed", { module: "HTTP" });
+    });
+  }
+  async stop(scheduler) {
+    logger.info("Shutting down HTTP server...", { module: "HTTP" });
+    scheduler?.stop();
+    if (this.rateLimitCleanupTimer !== null) {
+      clearInterval(this.rateLimitCleanupTimer);
+      this.rateLimitCleanupTimer = null;
+    }
+    for (const server of this.activeServers) {
+      try {
+        await server.close();
+      } catch (error) {
+        logger.error("Error closing active server", {
+          module: "HTTP",
+          error: error instanceof Error ? error.message : String(error)
+        });
+      }
+    }
+    this.activeServers.clear();
+    if (this.httpServer !== null) {
+      this.httpServer.close();
+    }
+    logger.info("Shutdown complete", { module: "HTTP" });
+  }
+};
+
+// src/database/core/DatabaseAdapterProxy.ts
+var DatabaseAdapterProxy = {
+  create(primary, testDb) {
+    return new Proxy(primary, {
+      get(target, prop, _receiver) {
+        const context = requestContextStorage.getStore();
+        const activeTarget = context?.useTestDb && testDb ? testDb : target;
+        const value = Reflect.get(activeTarget, prop, activeTarget);
+        if (typeof value === "function") {
+          return value.bind(activeTarget);
+        }
+        return value;
+      }
+    });
+  }
+};
+
+// src/vector/vector-search-manager/types.ts
+var DEFAULT_MODEL = "Xenova/all-MiniLM-L6-v2";
+var REBUILD_BATCH_SIZE = 50;
+var REBUILD_PAGE_SIZE = 200;
+
+// src/vector/vector-search-manager/rebuild.ts
+var setTimeoutFn = globalThis.setTimeout;
+async function rebuildIndex(manager, dbAdapter, progress, options) {
+  const force = options?.force ?? false;
+  const batchSize = options?.batchSize ?? REBUILD_BATCH_SIZE;
+  const pageSize = options?.pageSize ?? REBUILD_PAGE_SIZE;
+  let indexed = 0;
+  let skipped = 0;
+  let errorsCount = 0;
+  let firstError = null;
+  let totalEntries;
+  try {
+    totalEntries = dbAdapter.getActiveEntryCount();
+  } catch (err) {
+    const errorMessage = err instanceof Error ? err.message : String(err);
+    logger.error("Failed to count entries for vector indexing", { error: err });
+    return { success: false, indexed: 0, failed: 1, firstError: errorMessage };
+  }
+  if (totalEntries === 0) {
+    return { success: true, indexed: 0, failed: 0, firstError: null };
+  }
+  await sendProgress(progress, 0, totalEntries, "Starting vector index rebuild");
+  let offset = 0;
+  while (offset < totalEntries) {
+    const result = dbAdapter.getEntriesPage(offset, pageSize);
+    const entries = result.entries;
+    if (entries.length === 0) break;
+    for (let i = 0; i < entries.length; i += batchSize) {
+      const batch = entries.slice(i, i + batchSize);
+      const vectorsToUpsert = [];
+      for (const entry of batch) {
+        if (!force) {
+          try {
+            const exists = dbAdapter.getVector(entry.id);
+            if (exists) {
+              skipped++;
+              continue;
+            }
+          } catch {
+          }
+        }
+        try {
+          const tagsText = entry.tags !== void 0 && entry.tags !== null && entry.tags.length > 0 ? ` [Tags: ${entry.tags.join(", ")}]` : "";
+          const text = `[${entry.entryType}]${tagsText} ${entry.content}`;
+          const embedding = await manager.generateEmbedding(text);
+          vectorsToUpsert.push({ entryId: entry.id, embedding });
+        } catch (err) {
+          errorsCount++;
+          const errorMessage = err instanceof Error ? err.message : String(err);
+          firstError ??= errorMessage;
+          logger.error(`Failed to generate embedding for entry ${entry.id}`, {
+            error: errorMessage
+          });
+        }
+      }
+      if (vectorsToUpsert.length > 0) {
+        try {
+          dbAdapter.upsertVectors(vectorsToUpsert);
+          indexed += vectorsToUpsert.length;
+        } catch (err) {
+          errorsCount += vectorsToUpsert.length;
+          const errorMessage = err instanceof Error ? err.message : String(err);
+          firstError ??= errorMessage;
+          logger.error("Failed to upsert vector batch", {
+            error: errorMessage,
+            batchSize: vectorsToUpsert.length
+          });
+        }
+      }
+      await new Promise((resolve) => setTimeoutFn(resolve, 0));
+      await sendProgress(
+        progress,
+        offset + i + batch.length,
+        totalEntries,
+        `Indexing... (${indexed} indexed, ${skipped} skipped)`
+      );
+    }
+    offset += pageSize;
+  }
+  if (errorsCount === 0) {
+    try {
+      dbAdapter.cleanupStaleVectors();
+    } catch (err) {
+      logger.warning("Failed to cleanup stale vectors after rebuild", { error: err });
+    }
+  }
+  return {
+    success: errorsCount === 0,
+    indexed,
+    failed: errorsCount,
+    firstError
+  };
+}
+
+// src/vector/vector-search-manager/manager.ts
+var VectorSearchManager = class _VectorSearchManager {
+  dbAdapter;
+  modelName;
+  dimensions = null;
+  // Lazy-loaded dependencies
+  pipeline = null;
+  transformers = null;
+  initializationPromise = null;
+  constructor(dbAdapter, options) {
+    this.dbAdapter = dbAdapter;
+    this.modelName = options?.modelName || DEFAULT_MODEL;
+  }
+  /**
+   * Get the active model name
+   */
+  getModelName() {
+    return this.modelName;
+  }
+  /**
+   * Get the detected dimensions for the current model
+   */
+  getDimensions() {
+    return this.dimensions;
+  }
+  /**
+   * Check if the vector search manager is initialized
+   */
+  isInitialized() {
+    return this.initializationPromise !== null && (this.pipeline !== null || this.dimensions !== null);
+  }
+  /**
+   * Initialize the vector search manager.
+   * This loads the huggingface transformer model and creates the virtual table.
+   */
+  async initialize() {
+    if (this.dbAdapter == null) {
+      throw new Error("Vector database not available");
+    }
+    if (this.initializationPromise) {
+      return this.initializationPromise;
+    }
+    this.initializationPromise = this._initialize().catch((error) => {
+      this.initializationPromise = null;
+      throw error;
+    });
+    return this.initializationPromise;
+  }
+  async _initialize() {
+    try {
+      logger.info("Initializing vector search...");
+      const hasCustomEmbeddingFn = this.generateEmbedding !== _VectorSearchManager.prototype.generateEmbedding;
+      if (hasCustomEmbeddingFn) {
+        logger.info("Detecting embedding dimensions via custom embedding generator...");
+        const testEmbedding = await this.generateEmbedding("test");
+        this.dimensions = testEmbedding.length;
+        this.pipeline = true;
+        logger.info(`Detected ${this.dimensions} dimensions for ${this.modelName}`);
+      } else {
+        if (this.transformers === null) {
+          const transformersModule2 = await import('@huggingface/transformers');
+          this.transformers = transformersModule2;
+          transformersModule2.env.allowRemoteModels = true;
+          transformersModule2.env.localModelPath = ".cache/huggingface";
+        }
+        logger.info(`Loading embedding model: ${this.modelName}`);
+        const transformersModule = this.transformers;
+        this.pipeline = await transformersModule.pipeline(
+          "feature-extraction",
+          this.modelName,
+          {
+            dtype: "fp32"
+          }
+        );
+        logger.info("Embedding model loaded");
+        logger.info("Detecting embedding dimensions...");
+        const pipelineFunc = this.pipeline;
+        const testResult = await pipelineFunc("test", { pooling: "mean", normalize: true });
+        this.dimensions = testResult.data.length;
+        logger.info(`Detected ${this.dimensions} dimensions for ${this.modelName}`);
+      }
+      this.verifyAndCreateVecTable();
+      logger.info("Vector search initialized successfully");
+    } catch (error) {
+      logger.error("Failed to initialize vector search", {
+        error: error instanceof Error ? error.message : String(error)
+      });
+      throw error;
+    }
+  }
+  /**
+   * Verify the vec_journal_entries table exists and has the correct dimensions.
+   * If the model or dimensions changed, drops the old table and creates a new one.
+   */
+  verifyAndCreateVecTable() {
+    const dimensions = this.dimensions;
+    if (dimensions === null) {
+      throw new Error("Dimensions not detected. Cannot create vector table.");
+    }
+    let needsRecreation = false;
+    try {
+      const existingDimStr = this.dbAdapter.getVectorMetadata("dimensions");
+      if (existingDimStr) {
+        const existingDim = parseInt(existingDimStr, 10);
+        if (existingDim !== this.dimensions) {
+          needsRecreation = true;
+          logger.info(`Vector model or dimensions changed, dropping old index`, {
+            oldModel: this.dbAdapter.getVectorMetadata("model_name") || "unknown",
+            newModel: this.modelName,
+            oldDimensions: existingDim,
+            newDimensions: this.dimensions
+          });
+        }
+      } else {
+        needsRecreation = true;
+      }
+    } catch (err) {
+      needsRecreation = true;
+      logger.warning("Failed to verify vector table dimensions, recreating", { error: err });
+    }
+    if (needsRecreation) {
+      try {
+        this.dbAdapter.executeInTransaction(() => {
+          this.dbAdapter.dropVecTable();
+          this.dbAdapter.createVecTable(dimensions);
+          this.dbAdapter.setVectorMetadata("model_name", this.modelName);
+          this.dbAdapter.setVectorMetadata("dimensions", dimensions.toString());
+        });
+        logger.info(`Created new vec_journal_entries table with ${this.dimensions} dimensions`);
+      } catch (err) {
+        logger.error("Failed to recreate vector table", { error: err });
+        throw err;
+      }
+    }
+  }
+  /**
+   * Generate an embedding for text
+   */
+  async generateEmbedding(text) {
+    await this.initialize();
+    if (this.getDimensions() === null) {
+      throw new Error("Vector search not initialized properly. Cannot rebuild index.");
+    }
+    const pipelineFunc = this.pipeline;
+    const result = await pipelineFunc(text, { pooling: "mean", normalize: true });
+    return new Float32Array(result.data);
+  }
+  async addEntry(entry) {
+    await this.initialize();
+    try {
+      const tagsText = entry.tags !== void 0 && entry.tags !== null && entry.tags.length > 0 ? ` [Tags: ${entry.tags.join(", ")}]` : "";
+      const text = `[${entry.entryType}]${tagsText} ${entry.content}`;
+      const embedding = await this.generateEmbedding(text);
+      this.dbAdapter.upsertVector(entry.id, embedding);
+    } catch (error) {
+      logger.error(`Failed to add entry ${entry.id} to vector index`, {
+        error: error instanceof Error ? error.message : String(error)
+      });
+      throw error;
+    }
+  }
+  /**
+   * Remove an entry from the vector index
+   */
+  removeEntry(entryId) {
+    if (this.dbAdapter == null) return false;
+    try {
+      this.dbAdapter.deleteVector(entryId);
+      return true;
+    } catch (error) {
+      logger.warning(`Failed to remove entry ${entryId} from vector index`, { error });
+      return false;
+    }
+  }
+  /**
+   * Search for similar entries by text query
+   */
+  async search(query, limit = 10, threshold = 0, workspaceId) {
+    await this.initialize();
+    try {
+      const queryEmbedding = await this.generateEmbedding(query);
+      const results = this.dbAdapter.searchVectors(queryEmbedding, limit);
+      const candidates = [];
+      for (const result of results) {
+        const similarityScore = Math.max(-1, 1 - result.distance * result.distance / 2);
+        if (similarityScore >= threshold) {
+          candidates.push({
+            entryId: result.entry_id,
+            distance: result.distance,
+            similarityScore
+          });
+        }
+      }
+      if (candidates.length === 0) {
+        return [];
+      }
+      const targetWs = workspaceId ?? "*";
+      const entriesMap = typeof this.dbAdapter.getEntriesByIds === "function" ? this.dbAdapter.getEntriesByIds(candidates.map((c) => c.entryId)) : null;
+      const searchResults = [];
+      for (const candidate of candidates) {
+        const entry = entriesMap ? entriesMap.get(candidate.entryId) ?? null : this.dbAdapter.getEntryById(candidate.entryId, targetWs);
+        if (entry && (targetWs === "*" || entry.workspaceId === void 0 || entry.workspaceId === targetWs)) {
+          searchResults.push({
+            entryId: candidate.entryId,
+            entry,
+            distance: candidate.distance,
+            score: candidate.similarityScore,
+            similarityScore: candidate.similarityScore
+          });
+        }
+        if (searchResults.length >= limit) break;
+      }
+      return searchResults;
+    } catch (error) {
+      logger.error("Semantic search failed", {
+        error: error instanceof Error ? error.message : String(error),
+        query
+      });
+      throw error;
+    }
+  }
+  /**
+   * Search for similar entries using an existing entry as the query
+   */
+  async searchByEntryId(entryId, limit = 10, threshold = 0, workspaceId) {
+    await this.initialize();
+    try {
+      const sourceEntry = this.dbAdapter.getEntryById(entryId, workspaceId ?? "*");
+      if (!sourceEntry) {
+        throw new Error(`Entry ${entryId} not found`);
+      }
+      let queryEmbedding = this.dbAdapter.getVector(entryId);
+      if (!queryEmbedding) {
+        const tagsText = sourceEntry.tags !== void 0 && sourceEntry.tags !== null && sourceEntry.tags.length > 0 ? ` [Tags: ${sourceEntry.tags.join(", ")}]` : "";
+        const text = `[${sourceEntry.entryType}]${tagsText} ${sourceEntry.content}`;
+        queryEmbedding = await this.generateEmbedding(text);
+        this.dbAdapter.upsertVector(entryId, queryEmbedding);
+      }
+      const results = this.dbAdapter.searchVectors(queryEmbedding, limit + 1);
+      const candidates = [];
+      for (const result of results) {
+        const candidateId = result.entry_id;
+        if (candidateId === entryId) continue;
+        const similarityScore = Math.max(-1, 1 - result.distance * result.distance / 2);
+        if (similarityScore >= threshold) {
+          candidates.push({
+            entryId: candidateId,
+            distance: result.distance,
+            similarityScore
+          });
+        }
+      }
+      if (candidates.length === 0) {
+        return [];
+      }
+      const targetWs = workspaceId ?? "*";
+      const entriesMap = typeof this.dbAdapter.getEntriesByIds === "function" ? this.dbAdapter.getEntriesByIds(candidates.map((c) => c.entryId)) : null;
+      const searchResults = [];
+      for (const candidate of candidates) {
+        const entry = entriesMap ? entriesMap.get(candidate.entryId) ?? null : this.dbAdapter.getEntryById(candidate.entryId, targetWs);
+        if (entry && (targetWs === "*" || entry.workspaceId === void 0 || entry.workspaceId === targetWs)) {
+          searchResults.push({
+            entryId: candidate.entryId,
+            entry,
+            distance: candidate.distance,
+            score: candidate.similarityScore,
+            similarityScore: candidate.similarityScore
+          });
+        }
+        if (searchResults.length >= limit) break;
+      }
+      return searchResults;
+    } catch (error) {
+      logger.error(`Semantic search by entry ID ${entryId} failed`, {
+        error: error instanceof Error ? error.message : String(error)
+      });
+      throw error;
+    }
+  }
+  /**
+   * Helper to get vector search statistics
+   */
+  getStats() {
+    let itemCount = 0;
+    let isReady = false;
+    try {
+      itemCount = this.dbAdapter.getVectorCount();
+      isReady = this.pipeline !== null;
+    } catch (error) {
+      logger.warning("Failed to get vector search stats", { error });
+    }
+    return {
+      itemCount,
+      dimensions: this.dimensions ?? 0,
+      modelName: this.modelName,
+      isReady
+    };
+  }
+  async rebuildIndex(progress, options) {
+    await this.initialize();
+    return rebuildIndex(this, this.dbAdapter, progress, options);
+  }
+};
+
+// src/vector/vector-search-manager/VectorSearchManagerProxy.ts
+var VectorSearchManagerProxy = {
+  create(primary, testManager) {
+    return new Proxy(primary, {
+      get(target, prop, _receiver) {
+        const context = requestContextStorage.getStore();
+        const activeTarget = context?.useTestDb && testManager ? testManager : target;
+        const value = Reflect.get(activeTarget, prop, activeTarget);
+        if (typeof value === "function") {
+          return value.bind(activeTarget);
+        }
+        return value;
+      }
+    });
+  }
+};
+function isBlockedWebhookIp(ip) {
+  const normalized = ip.toLowerCase();
+  if (normalized === "localhost" || normalized === "::1" || normalized === "0.0.0.0" || normalized === "::" || normalized.startsWith("127.") || normalized.startsWith("10.") || normalized.startsWith("192.168.") || normalized.startsWith("169.254.") || normalized.startsWith("fe80:") || normalized.startsWith("fc00:") || normalized.startsWith("fd00:") || normalized.startsWith("::ffff:")) {
+    return true;
+  }
+  const octets = normalized.split(".");
+  if (octets.length === 4 && octets[0] === "172") {
+    const second = Number(octets[1]);
+    if (second >= 16 && second <= 31) {
+      return true;
+    }
+  }
+  return false;
+}
+async function validateWebhookUrl(webhookUrl) {
+  let parsed;
+  try {
+    parsed = new URL(webhookUrl);
+  } catch {
+    throw new Error("Invalid webhook URL format");
+  }
+  const allowInsecureHttp = process.env["ALLOW_INSECURE_WEBHOOK_HTTP"] === "true";
+  if (parsed.protocol !== "https:" && !(allowInsecureHttp && parsed.protocol === "http:")) {
+    throw new Error(`Disallowed webhook protocol: ${parsed.protocol} (https: required)`);
+  }
+  const hostname = parsed.hostname.replace(/^\[|\]$/g, "").toLowerCase();
+  if (hostname === "localhost" || hostname.endsWith(".localhost") || hostname.endsWith(".local") || hostname.endsWith(".internal") || isBlockedWebhookIp(hostname)) {
+    throw new Error(`Webhook hostname resolves to restricted network address: ${hostname}`);
+  }
+  if (!process.env["VITEST"]) {
+    const records = await dns.promises.lookup(hostname, { all: true });
+    for (const rec of records) {
+      if (isBlockedWebhookIp(rec.address)) {
+        throw new Error(`Webhook DNS resolved to private/loopback IP: ${rec.address}`);
+      }
+    }
+  }
+}
+function formatDigestReport(snapshot, serverVersion) {
+  const lines = [];
+  lines.push(`# Memory Journal Digest`);
+  lines.push(`_Computed at: ${snapshot.computedAt} (v${serverVersion})_`);
+  lines.push("");
+  lines.push(`## Activity Trend`);
+  const currentActivity = snapshot.currentPeriodEntries;
+  const growth = snapshot.activityGrowthPercent;
+  const growthStr = growth !== null ? `(${growth >= 0 ? "+" : ""}${String(growth)}% vs last period)` : "(baseline period)";
+  lines.push(`- **Entries this period**: ${String(currentActivity)} ${growthStr}`);
+  lines.push("");
+  if (snapshot.currentPeriodSignificant > 0) {
+    lines.push(`## Significance Highlights`);
+    const mult = snapshot.significanceMultiplier;
+    const multStr = mult !== null ? `(${String(mult)}\xD7 historical average)` : "";
+    lines.push(`- **Significant entries**: ${String(snapshot.currentPeriodSignificant)} ${multStr}`);
+    lines.push("");
+  }
+  if (snapshot.staleProjects.length > 0) {
+    lines.push(`## \u26A0 Stale Projects`);
+    for (const stale of snapshot.staleProjects) {
+      lines.push(`- Project P${String(stale.projectNumber)}: ${String(stale.daysSilent)} days silent (Last entry: ${stale.lastEntryDate.split("T")[0]})`);
+    }
+    lines.push("");
+  }
+  if (snapshot.topImportanceEntries.length > 0) {
+    lines.push(`## Top Importance Entries`);
+    for (const entry of snapshot.topImportanceEntries) {
+      const preview = entry.preview.replace(/\n/g, " ").trim();
+      lines.push(`- **#${String(entry.id)}** [Score: ${String(entry.score)}]: ${preview}...`);
+    }
+  }
+  return lines.join("\n");
+}
+async function deliverReport(report, snapshot, options) {
+  const { webhookUrl, webhookAuth, contentType = "slack" } = options;
+  try {
+    await validateWebhookUrl(webhookUrl);
+  } catch (err) {
+    logger.error("Refusing to deliver digest report to unsafe webhook URL", {
+      module: "DigestReporter",
+      error: err instanceof Error ? err.message : String(err)
+    });
+    return false;
+  }
+  let bodyPayload;
+  if (contentType === "discord") {
+    bodyPayload = JSON.stringify({ content: report });
+  } else if (contentType === "json") {
+    bodyPayload = JSON.stringify(snapshot);
+  } else {
+    bodyPayload = JSON.stringify({ text: report });
+  }
+  const headers = {
+    "Content-Type": "application/json"
+  };
+  if (webhookAuth) {
+    headers["Authorization"] = webhookAuth;
+  }
+  const MAX_RETRIES = 1;
+  const RETRY_DELAY_MS = 3e3;
+  const TIMEOUT_MS = 1e4;
+  for (let attempt = 1; attempt <= MAX_RETRIES + 1; attempt++) {
+    try {
+      const controller = new AbortController();
+      const timeoutId = setTimeout(() => {
+        controller.abort();
+      }, TIMEOUT_MS);
+      const response = await fetch(webhookUrl, {
+        method: "POST",
+        headers,
+        body: bodyPayload,
+        signal: controller.signal,
+        redirect: "error"
+      });
+      clearTimeout(timeoutId);
+      if (response.ok) {
+        logger.info("Digest report delivered successfully", {
+          module: "DigestReporter",
+          attempt,
+          contentType
+        });
+        return true;
+      }
+      if (response.status >= 400 && response.status < 500) {
+        logger.error("Failed to deliver digest report (client error)", {
+          module: "DigestReporter",
+          status: response.status,
+          statusText: response.statusText,
+          contentType
+        });
+        return false;
+      }
+      throw new Error(`HTTP ${String(response.status)}: ${response.statusText}`);
+    } catch (error) {
+      const errorMessage = error instanceof Error ? error.message : String(error);
+      const isAbortError = error instanceof Error && error.name === "AbortError";
+      if (attempt <= MAX_RETRIES) {
+        logger.warning("Failed to deliver digest report, retrying...", {
+          module: "DigestReporter",
+          attempt,
+          error: isAbortError ? "Timeout" : errorMessage
+        });
+        await new Promise((resolve) => setTimeout(resolve, RETRY_DELAY_MS));
+      } else {
+        logger.error("Failed to deliver digest report after all attempts", {
+          module: "DigestReporter",
+          error: isAbortError ? "Timeout" : errorMessage
+        });
+        return false;
+      }
+    }
+  }
+  return false;
+}
+
+// src/server/scheduler.ts
+var Scheduler = class {
+  options;
+  db;
+  vectorManager;
+  timers = [];
+  started = false;
+  sigtermHandler = null;
+  runtime;
+  constructor(options, db, vectorManager, runtime) {
+    this.options = options;
+    this.db = db;
+    this.vectorManager = vectorManager ?? null;
+    this.runtime = runtime;
+  }
+  /**
+   * Start all enabled scheduled jobs.
+   * Each job runs on its own interval and failures are isolated.
+   */
+  start() {
+    if (this.started) {
+      logger.warning("Scheduler already started, ignoring duplicate start()", {
+        module: "Scheduler"
+      });
+      return;
+    }
+    this.started = true;
+    this.sigtermHandler = () => {
+      this.stop();
+    };
+    process.on("SIGTERM", this.sigtermHandler);
+    const { backupIntervalMinutes, vacuumIntervalMinutes, rebuildIndexIntervalMinutes } = this.options;
+    if (backupIntervalMinutes > 0) {
+      this.scheduleJob("backup", backupIntervalMinutes, () => this.runBackup());
+    }
+    if (vacuumIntervalMinutes > 0) {
+      this.scheduleJob("vacuum", vacuumIntervalMinutes, () => {
+        this.runVacuumOptimize();
+        return Promise.resolve();
+      });
+    }
+    if (this.options.pruneIntervalMinutes > 0) {
+      this.scheduleJob("prune", this.options.pruneIntervalMinutes, () => this.runPrune());
+    }
+    if (rebuildIndexIntervalMinutes > 0) {
+      if (this.vectorManager) {
+        this.scheduleJob(
+          "rebuild-index",
+          rebuildIndexIntervalMinutes,
+          () => this.runRebuildIndex()
+        );
+      } else {
+        logger.warning(
+          "rebuild-index-interval specified but vector manager not available, skipping",
+          { module: "Scheduler" }
+        );
+      }
+    }
+    if (this.options.digestIntervalMinutes > 0) {
+      this.scheduleJob("digest", this.options.digestIntervalMinutes, () => {
+        this.runDigest();
+        return Promise.resolve();
+      });
+    }
+    if (this.options.reportIntervalMinutes > 0) {
+      this.scheduleJob("report", this.options.reportIntervalMinutes, () => {
+        this.runReport();
+        return Promise.resolve();
+      });
+    }
+    if (this.timers.length > 0) {
+      const summary = this.timers.map(
+        (t) => `${t.name} (${String(t.intervalMinutes)}min)`
+      );
+      logger.info(`Scheduler started: ${summary.join(", ")}`, { module: "Scheduler" });
+    } else {
+      logger.info("Scheduler started with no jobs enabled", { module: "Scheduler" });
+    }
+  }
+  /**
+   * Stop all scheduled jobs and clear timers.
+   * Safe to call multiple times.
+   */
+  stop() {
+    for (const job of this.timers) {
+      clearInterval(job.timer);
+    }
+    if (this.timers.length > 0) {
+      logger.info(`Scheduler stopped, cleared ${String(this.timers.length)} job(s)`, {
+        module: "Scheduler"
+      });
+    }
+    if (this.sigtermHandler !== null) {
+      process.off("SIGTERM", this.sigtermHandler);
+      this.sigtermHandler = null;
+    }
+    this.timers.length = 0;
+    this.started = false;
+  }
+  /**
+   * Get the current status of all scheduled jobs.
+   */
+  getStatus() {
+    return {
+      active: this.started,
+      jobs: this.timers.map((t) => ({
+        name: t.name,
+        enabled: true,
+        intervalMinutes: t.intervalMinutes,
+        lastRun: t.lastRun?.toISOString() ?? null,
+        lastResult: t.lastResult,
+        lastError: t.lastError,
+        nextRun: t.lastRun ? new Date(t.lastRun.getTime() + t.intervalMinutes * 6e4).toISOString() : new Date(Date.now() + t.intervalMinutes * 6e4).toISOString(),
+        runCount: t.runCount
+      }))
+    };
+  }
+  // ========================================================================
+  // Private — Job scheduling
+  // ========================================================================
+  /**
+   * Schedule a recurring job.
+   */
+  scheduleJob(name, intervalMinutes, fn) {
+    const intervalMs = intervalMinutes * 6e4;
+    const jobTimer = {
+      name,
+      intervalMinutes,
+      timer: setInterval(() => {
+        void this.executeJob(jobTimer, fn);
+      }, intervalMs),
+      lastRun: null,
+      lastResult: null,
+      lastError: null,
+      runCount: 0
+    };
+    jobTimer.timer.unref();
+    this.timers.push(jobTimer);
+  }
+  /**
+   * Execute a job with error isolation and status tracking.
+   */
+  async executeJob(job, fn) {
+    if (job.isRunning) {
+      return;
+    }
+    let inMaintenance = false;
+    if (!this.runtime) {
+      logger.error(
+        "ServerRuntime is required to schedule jobs safely. Bypassing maintenance check.",
+        { module: "Scheduler" }
+      );
+    } else {
+      inMaintenance = this.runtime.maintenanceManager.isMaintenanceModeActive();
+    }
+    if (inMaintenance) {
+      logger.info(`Skipping scheduled job '${job.name}' due to active maintenance mode`, {
+        module: "Scheduler",
+        operation: job.name
+      });
+      return;
+    }
+    job.isRunning = true;
+    const startTime = Date.now();
+    try {
+      if (this.runtime) {
+        await this.runtime.maintenanceManager.withActiveJob(fn);
+      } else {
+        await fn();
+      }
+      job.lastRun = new Date(startTime);
+      job.lastResult = "success";
+      job.lastError = null;
+      job.runCount++;
+    } catch (error) {
+      job.lastRun = new Date(startTime);
+      job.lastResult = "error";
+      job.lastError = error instanceof Error ? error.message : String(error);
+      job.runCount++;
+      logger.error(`Scheduled job '${job.name}' failed`, {
+        module: "Scheduler",
+        operation: job.name,
+        error: job.lastError
+      });
+    } finally {
+      job.isRunning = false;
+    }
+  }
+  // ========================================================================
+  // Private — Job implementations
+  // ========================================================================
+  /**
+   * Backup job: export database to file, then cleanup old backups.
+   */
+  async runBackup() {
+    const result = await this.db.exportToFile();
+    logger.info("Scheduled backup created", {
+      module: "Scheduler",
+      operation: "backup",
+      context: { filename: result.filename, sizeBytes: result.sizeBytes }
+    });
+    const cleanup = this.db.deleteOldBackups(this.options.keepBackups);
+    if (cleanup.deleted.length > 0) {
+      logger.info(
+        `Backup cleanup: deleted ${String(cleanup.deleted.length)}, kept ${String(cleanup.kept)}`,
+        {
+          module: "Scheduler",
+          operation: "backup-cleanup"
+        }
+      );
+    }
+  }
+  /**
+   * Vacuum/optimize job: run PRAGMA optimize and flush to disk.
+   *
+   * PRAGMA optimize updates internal query planner statistics based on
+   * recent query patterns. For the native better-sqlite3 driver, disk
+   * writes happen automatically via WAL mode.
+   */
+  runVacuumOptimize() {
+    this.db.pragma("optimize");
+    this.db.flushSave();
+    logger.info("Scheduled database optimize completed", {
+      module: "Scheduler",
+      operation: "vacuum"
+    });
+  }
+  /**
+   * Rebuild index job: full vector index rebuild from database entries.
+   */
+  async runRebuildIndex() {
+    if (!this.vectorManager) {
+      return;
+    }
+    const { indexed: count } = await this.vectorManager.rebuildIndex();
+    logger.info(`Scheduled vector index rebuild: ${String(count)} entries indexed`, {
+      module: "Scheduler",
+      operation: "rebuild-index",
+      context: { entriesIndexed: count }
+    });
+  }
+  // ========================================================================
+  // Private — Prune job
+  // ========================================================================
+  /**
+   * Prune job: auto-prune low-importance old entries.
+   */
+  async runPrune() {
+    const pruneResult = await runAutoPrune(this.db, {
+      archiveOlderThanDays: this.options.archiveOlderThanDays ?? 0,
+      pruneOlderThanDays: this.options.pruneOlderThanDays ?? 0,
+      hardDeleteOlderThanDays: this.options.hardDeleteOlderThanDays ?? 0,
+      importanceThreshold: this.options.pruneImportanceThreshold ?? 0.15,
+      dryRun: this.options.pruneDryRun,
+      excludeTags: this.options.pruneExcludeTags
+    });
+    logger.info("Scheduled auto-prune completed", {
+      module: "Scheduler",
+      operation: "prune",
+      archivedCount: pruneResult.archivedCount,
+      prunedCount: pruneResult.prunedCount,
+      hardDeletedCount: pruneResult.hardDeletedCount
+    });
+  }
+  // ========================================================================
+  // Private — Digest job
+  // ========================================================================
+  /**
+   * Digest job: compute analytics snapshot and persist to database.
+   */
+  runDigest() {
+    const snapshot = this.db.computeDigest();
+    this.db.saveAnalyticsSnapshot("digest", snapshot);
+    logger.info("Scheduled analytics digest computed", {
+      module: "Scheduler",
+      operation: "digest",
+      context: {
+        currentPeriodEntries: snapshot.currentPeriodEntries,
+        activityGrowthPercent: snapshot.activityGrowthPercent,
+        topImportanceCount: snapshot.topImportanceEntries.length
+      }
+    });
+  }
+  // ========================================================================
+  // Private — Report job
+  // ========================================================================
+  /**
+   * Report job: compute analytics snapshot, persist, and deliver via webhook.
+   */
+  runReport() {
+    const snapshot = this.db.computeDigest();
+    this.db.saveAnalyticsSnapshot("report", snapshot);
+    logger.info("Scheduled analytics report computed", {
+      module: "Scheduler",
+      operation: "report",
+      context: {
+        currentPeriodEntries: snapshot.currentPeriodEntries
+      }
+    });
+    if (this.options.reportDeliveryOptions?.webhookUrl) {
+      const report = formatDigestReport(snapshot, VERSION);
+      void deliverReport(report, snapshot, this.options.reportDeliveryOptions);
+    }
+  }
+  // ========================================================================
+  // Public — Digest accessor
+  // ========================================================================
+  /**
+   * Get the latest digest snapshot from the database.
+   * Returns null if no digest has been computed yet.
+   */
+  getLatestDigest() {
+    const snapshot = this.db.getLatestAnalyticsSnapshot("digest");
+    if (!snapshot) return null;
+    return snapshot.data;
+  }
+};
+
+// src/utils/maintenance-lock.ts
+var MaintenanceManager = class {
+  activeJobs = 0;
+  maintenanceWaitPromise = null;
+  inMaintenanceMode = false;
+  async withActiveJob(fn, bypass = false) {
+    if (this.inMaintenanceMode && !bypass) {
+      throw new MemoryJournalMcpError(
+        "Maintenance Mode: The server is experiencing downtime for an internal maintenance operation. Please try again later.",
+        "MAINTENANCE_MODE",
+        "resource",
+        { recoverable: true }
+      );
+    }
+    this.activeJobs++;
+    try {
+      return await fn();
+    } finally {
+      this.activeJobs--;
+      if (this.maintenanceWaitPromise !== null && this.activeJobs <= (this.inMaintenanceMode ? 1 : 0)) {
+        this.maintenanceWaitPromise.resolve();
+        this.maintenanceWaitPromise = null;
+      }
+    }
+  }
+  yieldJob() {
+    this.activeJobs--;
+    if (this.maintenanceWaitPromise !== null && this.activeJobs <= (this.inMaintenanceMode ? 1 : 0)) {
+      this.maintenanceWaitPromise.resolve();
+      this.maintenanceWaitPromise = null;
+    }
+  }
+  resumeJob() {
+    this.activeJobs++;
+  }
+  async acquireMaintenanceLock() {
+    if (this.inMaintenanceMode) {
+      throw new MemoryJournalMcpError("Maintenance lock is already acquired.", "LOCK_ACQUIRED", "internal");
+    }
+    this.inMaintenanceMode = true;
+    if (this.activeJobs > 1) {
+      if (this.maintenanceWaitPromise === null) {
+        let resolver;
+        const promise = new Promise((resolve) => {
+          resolver = resolve;
+        });
+        if (resolver) {
+          this.maintenanceWaitPromise = { promise, resolve: resolver };
+        }
+      }
+      if (this.maintenanceWaitPromise !== null) {
+        await this.maintenanceWaitPromise.promise;
+      }
+    }
+  }
+  releaseMaintenanceLock() {
+    this.inMaintenanceMode = false;
+    if (this.maintenanceWaitPromise !== null) {
+      this.maintenanceWaitPromise.resolve();
+      this.maintenanceWaitPromise = null;
+    }
+  }
+  assertNotInMaintenanceMode() {
+    if (this.inMaintenanceMode) {
+      throw new MemoryJournalMcpError(
+        "Maintenance Mode: The server is experiencing downtime for an internal maintenance operation. Please try again later.",
+        "MAINTENANCE_MODE",
+        "resource",
+        { recoverable: true }
+      );
+    }
+  }
+  isMaintenanceModeActive() {
+    return this.inMaintenanceMode;
+  }
+};
+var ServerRuntime = class {
+  maintenanceManager = new MaintenanceManager();
+  metrics = new MetricsAccumulator();
+  auditLogger = null;
+  auditInterceptor = null;
+  toolMapCache = null;
+  mappedToolsCache = null;
+  cachedContextRefs = null;
+  githubClientPool = null;
+  configManager = null;
+};
+var ConfigManager = class extends EventEmitter {
+  config;
+  initialCodemodeFullAccess;
+  configFilePath;
+  watcher;
+  isWriting = false;
+  constructor(initialConfig, configFilePath) {
+    super();
+    this.config = { ...initialConfig };
+    this.initialCodemodeFullAccess = Boolean(initialConfig.codemodeInternalFullAccess);
+    this.configFilePath = configFilePath;
+    if (this.configFilePath && fs.existsSync(this.configFilePath)) {
+      this.watchFile();
+    }
+  }
+  getConfig() {
+    return this.config;
+  }
+  updateConfig(newConfig, persist = false) {
+    this.config = { ...this.config, ...newConfig };
+    if (newConfig.rawToolFilter !== void 0) {
+      this.config.toolFilterConfig = newConfig.rawToolFilter ? parseToolFilter(newConfig.rawToolFilter) : null;
+    }
+    if (persist && this.configFilePath) {
+      this.persistToFile();
+    }
+    this.emit("changed", this.config);
+  }
+  close() {
+    this.watcher?.close();
+  }
+  persistToFile() {
+    if (!this.configFilePath) return;
+    this.isWriting = true;
+    try {
+      const content = fs.readFileSync(this.configFilePath, "utf-8");
+      let parsed = {};
+      if (this.configFilePath.endsWith(".json")) {
+        parsed = JSON.parse(content);
+      } else {
+        parsed = parse(content) ?? {};
+      }
+      if (this.config.rawToolFilter !== void 0) {
+        parsed["toolFilter"] = this.config.rawToolFilter;
+      }
+      if (this.config.codemodeInternalFullAccess !== void 0) {
+        parsed["codemodeInternalFullAccess"] = this.config.codemodeInternalFullAccess;
+      }
+      if (this.config.briefingConfig.entryCount !== void 0) parsed["briefingEntries"] = this.config.briefingConfig.entryCount;
+      if (this.config.briefingConfig.summaryCount !== void 0) parsed["briefingSummaries"] = this.config.briefingConfig.summaryCount;
+      if (this.config.briefingConfig.includeTeam !== void 0) parsed["briefingIncludeTeam"] = this.config.briefingConfig.includeTeam;
+      if (this.config.briefingConfig.issueCount !== void 0) parsed["briefingIssues"] = this.config.briefingConfig.issueCount;
+      if (this.config.briefingConfig.prCount !== void 0) parsed["briefingPrs"] = this.config.briefingConfig.prCount;
+      if (this.config.briefingConfig.prStatusBreakdown !== void 0) parsed["briefingPrStatus"] = this.config.briefingConfig.prStatusBreakdown;
+      if (this.config.briefingConfig.milestoneCount !== void 0) parsed["briefingMilestones"] = this.config.briefingConfig.milestoneCount;
+      if (this.config.briefingConfig.workflowCount !== void 0) parsed["briefingWorkflows"] = this.config.briefingConfig.workflowCount;
+      if (this.config.briefingConfig.workflowStatusBreakdown !== void 0) parsed["briefingWorkflowStatus"] = this.config.briefingConfig.workflowStatusBreakdown;
+      if (this.config.briefingConfig.copilotReviews !== void 0) parsed["briefingCopilot"] = this.config.briefingConfig.copilotReviews;
+      if (this.configFilePath.endsWith(".json")) {
+        fs.writeFileSync(this.configFilePath, JSON.stringify(parsed, null, 2), "utf-8");
+      } else {
+        logger.warning("YAML file updates from update_configuration tool will drop comments.", { module: "ConfigManager" });
+        const yamlStr = stringify(parsed);
+        fs.writeFileSync(this.configFilePath, yamlStr, "utf-8");
+      }
+    } catch (e) {
+      logger.error("Failed to persist configuration to file", { module: "ConfigManager", error: e instanceof Error ? e.message : String(e) });
+    } finally {
+      this.isWriting = false;
+    }
+  }
+  watchFile() {
+    if (!this.configFilePath) return;
+    let debounceTimer;
+    try {
+      this.watcher = fs.watch(this.configFilePath, (eventType) => {
+        if (eventType === "change" && !this.isWriting) {
+          clearTimeout(debounceTimer);
+          debounceTimer = setTimeout(() => {
+            try {
+              this.reloadFromFile();
+            } catch (err) {
+              logger.error("Failed to reload config file", { module: "ConfigManager", error: err instanceof Error ? err.message : String(err) });
+            }
+          }, 500);
+        }
+      });
+      this.watcher.on("error", (err) => {
+        logger.warning("Config file watcher error", {
+          module: "ConfigManager",
+          path: this.configFilePath,
+          error: err instanceof Error ? err.message : String(err)
+        });
+      });
+      logger.info("Watching configuration file for changes", { module: "ConfigManager", path: this.configFilePath });
+    } catch (error) {
+      logger.warning("Failed to start configuration file watcher", { module: "ConfigManager", error: error instanceof Error ? error.message : String(error) });
+    }
+  }
+  reloadFromFile() {
+    if (!this.configFilePath || !fs.existsSync(this.configFilePath)) return;
+    try {
+      const content = fs.readFileSync(this.configFilePath, "utf-8");
+      let parsed = {};
+      if (this.configFilePath.endsWith(".json")) {
+        parsed = JSON.parse(content);
+      } else {
+        parsed = parse(content) ?? {};
+      }
+      const updates = {};
+      if ("toolFilter" in parsed) {
+        updates.rawToolFilter = typeof parsed["toolFilter"] === "string" ? parsed["toolFilter"] : void 0;
+      }
+      if ("codemodeInternalFullAccess" in parsed) {
+        const requested = typeof parsed["codemodeInternalFullAccess"] === "boolean" ? parsed["codemodeInternalFullAccess"] : void 0;
+        if (requested === false || requested === true && this.initialCodemodeFullAccess) {
+          updates.codemodeInternalFullAccess = requested;
+        }
+      }
+      const bc = { ...this.config.briefingConfig };
+      let bcChanged = false;
+      const bcKeys = ["briefingEntries", "briefingSummaries", "briefingIncludeTeam", "briefingIssues", "briefingPrs", "briefingPrStatus", "briefingMilestones", "briefingWorkflows", "briefingWorkflowStatus", "briefingCopilot"];
+      for (const key of bcKeys) {
+        if (key in parsed) {
+          const mappedKey = key === "briefingEntries" ? "entryCount" : key === "briefingSummaries" ? "summaryCount" : key === "briefingIncludeTeam" ? "includeTeam" : key === "briefingIssues" ? "issueCount" : key === "briefingPrs" ? "prCount" : key === "briefingPrStatus" ? "prStatusBreakdown" : key === "briefingMilestones" ? "milestoneCount" : key === "briefingWorkflows" ? "workflowCount" : key === "briefingWorkflowStatus" ? "workflowStatusBreakdown" : key === "briefingCopilot" ? "copilotReviews" : void 0;
+          if (mappedKey) {
+            bc[mappedKey] = parsed[key];
+            bcChanged = true;
+          }
+        }
+      }
+      if (bcChanged) {
+        updates.briefingConfig = bc;
+      }
+      if (Object.keys(updates).length > 0) {
+        this.updateConfig(updates, false);
+        logger.info("Hot-reloaded dynamic configuration from file", { module: "ConfigManager" });
+      }
+    } catch (e) {
+      logger.error("Error hot-reloading config file", { module: "ConfigManager", error: e instanceof Error ? e.message : String(e) });
+    }
+  }
+};
+
+// src/server/mcp-server/initialization.ts
+function resolveBundledSkillsDir() {
+  let dir = import.meta.dirname;
+  for (let i = 0; i < 5; i++) {
+    const candidate = path.join(dir, "skills");
+    if (fs.existsSync(path.join(candidate, "memory-journal-mcp", "SKILL.md"))) {
+      return candidate;
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return void 0;
+}
+async function loadBundledSkillCatalog(skillsDirOverride) {
+  const skillsDir = resolveBundledSkillsDir();
+  if (!skillsDir) {
+    return void 0;
+  }
+  try {
+    return await loadSkills(skillsDir, {
+      onWarning: (warning) => {
+        logger.warning(`Bundled skill catalog warning (${warning.path}): ${warning.message}`, {
+          module: "McpServer"
+        });
+      }
+    });
+  } catch (error) {
+    logger.warning("Failed to load bundled skill catalog", {
+      module: "McpServer",
+      path: skillsDir,
+      error: error instanceof Error ? error.message : String(error)
+    });
+    return void 0;
+  }
+}
+async function initializeDependencies(options) {
+  const { transport, dbPath, teamDbPath, testDbPath, testTeamDbPath } = options;
+  const primaryDb = await DatabaseAdapterFactory.create(dbPath, options);
+  await primaryDb.initialize();
+  logger.info("Database initialized", { module: "McpServer", dbPath });
+  let testDb;
+  if (testDbPath) {
+    testDb = await DatabaseAdapterFactory.create(testDbPath, options);
+    await testDb.initialize();
+    logger.info("Test database initialized", { module: "McpServer", testDbPath });
+  }
+  const db = DatabaseAdapterProxy.create(primaryDb, testDb);
+  const hasAutoPrune = (options.archiveOlderThanDays ?? 0) > 0 || (options.pruneOlderThanDays ?? 0) > 0 || (options.hardDeleteOlderThanDays ?? 0) > 0;
+  if (hasAutoPrune) {
+    const pruneResult = await runAutoPrune(db, {
+      archiveOlderThanDays: options.archiveOlderThanDays ?? 0,
+      pruneOlderThanDays: options.pruneOlderThanDays ?? 0,
+      hardDeleteOlderThanDays: options.hardDeleteOlderThanDays ?? 0,
+      importanceThreshold: options.pruneImportanceThreshold ?? 0.15,
+      dryRun: options.pruneDryRun,
+      excludeTags: options.pruneExcludeTags
+    });
+    logger.info("Auto-prune completed", {
+      module: "McpServer",
+      archivedCount: pruneResult.archivedCount,
+      prunedCount: pruneResult.prunedCount,
+      hardDeletedCount: pruneResult.hardDeletedCount,
+      backupFile: pruneResult.backupFile
+    });
+  }
+  const runtime = new ServerRuntime();
+  if (options.auditConfig?.enabled) {
+    runtime.auditLogger = new AuditLogger(options.auditConfig);
+    runtime.auditInterceptor = createAuditInterceptor(runtime.auditLogger);
+    logger.info("Audit logging enabled", {
+      module: "McpServer",
+      path: options.auditConfig.logPath,
+      redact: options.auditConfig.redact,
+      auditReads: options.auditConfig.auditReads
+    });
+  }
+  let activeMetricsPath;
+  if (options.persistMetrics) {
+    const configuredPath = options.metricsPath ?? dbPath.replace(/\.db$/, "") + "_metrics.json";
+    activeMetricsPath = configuredPath;
+    await runtime.metrics.loadFromFile(configuredPath);
+    setInterval(() => {
+      void runtime.metrics.saveToFile(configuredPath);
+    }, 5 * 60 * 1e3).unref();
+  }
+  let primaryTeamDb;
+  let testTeamDb;
+  let teamDb;
+  if (teamDbPath) {
+    primaryTeamDb = await DatabaseAdapterFactory.create(teamDbPath, options);
+    await primaryTeamDb.initialize();
+    primaryTeamDb.applyTeamSchema();
+    logger.info("Team database initialized", { module: "McpServer", teamDbPath });
+    if (testTeamDbPath) {
+      testTeamDb = await DatabaseAdapterFactory.create(testTeamDbPath, options);
+      await testTeamDb.initialize();
+      testTeamDb.applyTeamSchema();
+      logger.info("Test team database initialized", { module: "McpServer", testTeamDbPath });
+    }
+    teamDb = DatabaseAdapterProxy.create(primaryTeamDb, testTeamDb);
+    if (options.teamAdmin && teamDb.getTeamMemberCount !== void 0 && teamDb.addTeamMember !== void 0) {
+      if (!teamDb.isTeamRbacActive?.()) {
+        teamDb.addTeamMember(options.teamAdmin, "admin", "system", "Bootstrap Admin");
+        logger.info("Bootstrapped initial team admin", { module: "McpServer", admin: options.teamAdmin });
+      }
+    }
+  }
+  const primaryVectorManager = new VectorSearchManager(primaryDb, { modelName: options.embeddingModel });
+  let testVectorManager;
+  if (testDb) {
+    testVectorManager = new VectorSearchManager(testDb, { modelName: options.embeddingModel });
+  }
+  const vectorManager = VectorSearchManagerProxy.create(primaryVectorManager, testVectorManager);
+  let primaryTeamVectorManager;
+  let testTeamVectorManager;
+  let teamVectorManager;
+  if (primaryTeamDb) {
+    primaryTeamVectorManager = new VectorSearchManager(primaryTeamDb, { modelName: options.embeddingModel });
+    if (testTeamDb) {
+      testTeamVectorManager = new VectorSearchManager(testTeamDb, { modelName: options.embeddingModel });
+    }
+    teamVectorManager = VectorSearchManagerProxy.create(primaryTeamVectorManager, testTeamVectorManager);
+    logger.info("Team vector search manager created", { module: "McpServer" });
+  }
+  if (options.autoRebuildIndex) {
+    logger.info("Auto-rebuilding vector index in background...", { module: "McpServer" });
+    primaryVectorManager.initialize().then(async () => {
+      const { indexed: count } = await primaryVectorManager.rebuildIndex();
+      logger.info("Vector index rebuilt in background", {
+        module: "McpServer",
+        entriesIndexed: count
+      });
+    }).catch((err) => {
+      logger.error("Background vector init/rebuild failed", {
+        module: "McpServer",
+        error: err
+      });
+    });
+    if (testVectorManager) {
+      testVectorManager.initialize().catch((err) => {
+        logger.error("Background test vector init failed", { module: "McpServer", error: err });
+      });
+    }
+    if (primaryTeamVectorManager) {
+      primaryTeamVectorManager.initialize().catch((err) => {
+        logger.error("Background team vector init failed", {
+          module: "McpServer",
+          error: err
+        });
+      });
+      if (testTeamVectorManager) {
+        testTeamVectorManager.initialize().catch((err) => {
+          logger.error("Background test team vector init failed", { module: "McpServer", error: err });
+        });
+      }
+      logger.info("Team vector search manager eager initialization started in background", {
+        module: "McpServer"
+      });
+    }
+  } else {
+    logger.info("Vector search manager eager initialization started in background", {
+      module: "McpServer"
+    });
+    primaryVectorManager.initialize().then(async () => {
+      if (testVectorManager) await testVectorManager.initialize();
+      if (primaryTeamVectorManager) {
+        logger.info(
+          "Team vector search manager eager initialization started in background",
+          { module: "McpServer" }
+        );
+        await primaryTeamVectorManager.initialize();
+        if (testTeamVectorManager) await testTeamVectorManager.initialize();
+      }
+    }).catch((err) => {
+      logger.error("Background vector init failed", { module: "McpServer", error: err });
+    });
+  }
+  let githubPath = ".";
+  if (options.projectRegistry && Object.keys(options.projectRegistry).length > 0) {
+    if (options.defaultProjectNumber !== void 0) {
+      const defaultEntry = Object.values(options.projectRegistry).find(
+        (r) => r.project_number === options.defaultProjectNumber
+      );
+      if (defaultEntry?.path) {
+        githubPath = defaultEntry.path;
+      }
+    }
+  }
+  const github = getGitHubIntegration(githubPath, runtime);
+  try {
+    await github.getRepoInfo();
+  } catch (error) {
+    logger.warning("Failed to pre-populate GitHub repository cache", {
+      module: "McpServer",
+      path: githubPath,
+      error: error instanceof Error ? error.message : "Unknown error"
+    });
+  }
+  logger.info("GitHub integration initialized", {
+    module: "McpServer",
+    hasToken: github.isApiAvailable()
+  });
+  let filterConfig;
+  if (options.toolFilter) {
+    filterConfig = parseToolFilter(options.toolFilter);
+    logger.info("Tool filter applied", {
+      module: "McpServer",
+      summary: getFilterSummary(filterConfig)
+    });
+  } else {
+    filterConfig = getToolFilterFromEnv();
+    if (filterConfig) {
+      logger.info("Tool filter from env", {
+        module: "McpServer",
+        summary: getFilterSummary(filterConfig)
+      });
+    }
+  }
+  if (!filterConfig) {
+    const totalTools = getAllToolNames().length;
+    if (totalTools > 50) {
+      logger.warning(`CONTEXT BLOAT WARNING: ${totalTools} tools are being registered without a tool filter.`);
+      logger.warning(`  This may consume excessive context window in the LLM. Consider using '--tool-filter codemode' or '--tool-filter starter' to save tokens.`);
+    }
+  }
+  const rawToolFilter = options.toolFilter ?? process.env["MEMORY_JOURNAL_MCP_TOOL_FILTER"] ?? process.env["TOOL_FILTER"];
+  const configManager = new ConfigManager({
+    rawToolFilter,
+    toolFilterConfig: filterConfig,
+    briefingConfig: options.briefingConfig ?? DEFAULT_BRIEFING_CONFIG,
+    codemodeInternalFullAccess: options.codemodeInternalFullAccess
+  }, options.configFilePath);
+  runtime.configManager = configManager;
+  let scheduler = null;
+  if (options.scheduler) {
+    const hasAnyJob = options.scheduler.backupIntervalMinutes > 0 || options.scheduler.vacuumIntervalMinutes > 0 || options.scheduler.rebuildIndexIntervalMinutes > 0 || options.scheduler.digestIntervalMinutes > 0 || options.scheduler.pruneIntervalMinutes > 0 || options.scheduler.reportIntervalMinutes > 0;
+    if (hasAnyJob && transport === "stdio") {
+      logger.warning(
+        "Scheduler options ignored for stdio transport (session is ephemeral). Use HTTP/SSE transport for automated scheduling.",
+        { module: "Scheduler" }
+      );
+    } else if (hasAnyJob) {
+      options.scheduler.archiveOlderThanDays = options.archiveOlderThanDays;
+      options.scheduler.pruneOlderThanDays = options.pruneOlderThanDays;
+      options.scheduler.hardDeleteOlderThanDays = options.hardDeleteOlderThanDays;
+      options.scheduler.pruneImportanceThreshold = options.pruneImportanceThreshold;
+      options.scheduler.pruneDryRun = options.pruneDryRun;
+      options.scheduler.pruneExcludeTags = options.pruneExcludeTags;
+      scheduler = new Scheduler(options.scheduler, db, vectorManager, runtime);
+    }
+  }
+  try {
+    const existingSnapshot = db.getLatestAnalyticsSnapshot("digest");
+    if (!existingSnapshot) {
+      const digest = db.computeDigest();
+      db.saveAnalyticsSnapshot("digest", digest);
+      logger.info("Initial analytics digest seeded", { module: "McpServer" });
+    }
+  } catch (error) {
+    logger.debug("Failed to seed initial digest (non-critical)", {
+      module: "McpServer",
+      error: error instanceof Error ? error.message : String(error)
+    });
+  }
+  let finalAllowedIoRoots = options.allowedIoRoots;
+  if (!finalAllowedIoRoots) {
+    if (options.transport === "http") {
+      const errorMsg = `FATAL: Refusing to bind HTTP transport without explicit ALLOWED_IO_ROOTS. You MUST specify --allowed-io-roots (or ALLOWED_IO_ROOTS env var) to prevent ambient filesystem authority.`;
+      logger.error(errorMsg, { module: "HTTP" });
+      throw new Error(errorMsg);
+    }
+    finalAllowedIoRoots = [];
+    logger.warning(
+      "\u26A0\uFE0F SECURITY WARNING: ALLOWED_IO_ROOTS not explicitly provided. Defaulting to empty array (NO filesystem access). You MUST specify --allowed-io-roots (or ALLOWED_IO_ROOTS env var) to enable filesystem tools.",
+      {
+        module: "McpServer"
+      }
+    );
+  }
+  logger.info("IO sandbox configured", {
+    module: "McpServer",
+    allowedRoots: finalAllowedIoRoots
+  });
+  const skillCatalog = await loadBundledSkillCatalog();
+  return {
+    db,
+    testDb,
+    teamDb,
+    testTeamDb,
+    runtime,
+    vectorManager,
+    teamVectorManager,
+    github,
+    configManager,
+    scheduler,
+    allowedIoRoots: finalAllowedIoRoots,
+    activeMetricsPath,
+    ...skillCatalog ? { skillCatalog } : {}
+  };
+}
+function registerResources(server, resources, handleResourceRead, runtime) {
+  for (const resDef of resources) {
+    const mimeType = resDef.mimeType ?? "application/json";
+    const meta = {
+      description: resDef.description ?? "",
+      mimeType,
+      ...resDef.icons ? { icons: resDef.icons } : {}
+    };
+    const isTemplate = resDef.uri.includes("{");
+    if (isTemplate) {
+      const template = new ResourceTemplate(resDef.uri, { list: void 0 });
+      server.registerResource(
+        resDef.name,
+        template,
+        meta,
+        async (uri, _variables) => {
+          if (!runtime) {
+            throw new ConfigurationError(
+              "ServerRuntime is logically required for secure resource execution."
+            );
+          }
+          const auditLog = runtime.auditLogger;
+          enforceAccessBoundary(uri.href, "resource", resDef.capabilities, auditLog);
+          return auditOperation(auditLog, "resource", resDef.name, async () => {
+            return runtime.maintenanceManager.withActiveJob(
+              () => handleResourceRead(uri, mimeType)
+            );
+          });
+        }
+      );
+    } else {
+      server.registerResource(resDef.name, resDef.uri, meta, async (uri) => {
+        if (!runtime) {
+          throw new ConfigurationError(
+            "ServerRuntime is logically required for secure resource execution."
+          );
+        }
+        const auditLog = runtime.auditLogger;
+        enforceAccessBoundary(uri.href, "resource", resDef.capabilities, auditLog);
+        return auditOperation(auditLog, "resource", resDef.name, async () => {
+          return runtime.maintenanceManager.withActiveJob(
+            () => handleResourceRead(uri, mimeType)
+          );
+        });
+      });
+    }
+  }
+}
+function registerPrompts(server, prompts, db, teamDb, runtime, github, briefingConfig) {
+  for (const promptDef of prompts) {
+    let argsSchema;
+    if (promptDef.arguments && promptDef.arguments.length > 0) {
+      const hasRequired = promptDef.arguments.some((a) => a.required);
+      if (hasRequired) {
+        argsSchema = {};
+        for (const arg of promptDef.arguments) {
+          argsSchema[arg.name] = arg.required === true ? z.string().describe(arg.description) : z.string().optional().describe(arg.description);
+        }
+      }
+    }
+    server.registerPrompt(
+      promptDef.name,
+      {
+        description: promptDef.description ?? "",
+        ...argsSchema ? { argsSchema: z.object(argsSchema) } : {},
+        ...promptDef.icons ? { icons: promptDef.icons } : {}
+      },
+      (providedArgs) => {
+        if (!runtime) {
+          throw new ConfigurationError(
+            "ServerRuntime is logically required for secure prompt execution."
+          );
+        }
+        const auditLog = runtime.auditLogger;
+        enforceAccessBoundary(promptDef.name, "prompt", promptDef.capabilities, auditLog);
+        return auditOperation(auditLog, "prompt", promptDef.name, async () => {
+          const executePrompt = async () => {
+            const args = providedArgs;
+            const promptResult = await getPrompt(promptDef.name, args, db, teamDb, github, briefingConfig);
+            return {
+              messages: promptResult.messages.map((m) => ({
+                role: m.role,
+                content: m.content
+              }))
+            };
+          };
+          return await runtime.maintenanceManager.withActiveJob(executePrompt);
+        });
+      }
+    );
+  }
+}
+
+// src/server/mcp-server/tool-registration/list-interceptor.ts
+function attachListToolsInterceptor(requestHandlers, configManager, allToolNames) {
+  const listToolsHandler = requestHandlers?.get("tools/list");
+  if (listToolsHandler === void 0 || requestHandlers === void 0) {
+    return;
+  }
+  requestHandlers.set("tools/list", async (request2, extra) => {
+    const currentConfig = configManager.getConfig();
+    const enabledSet = currentConfig.toolFilterConfig?.enabledTools ?? allToolNames;
+    const result = await listToolsHandler(request2, extra);
+    const res = result;
+    if (Array.isArray(res?.tools)) {
+      res.tools = res.tools.filter((t) => enabledSet.has(t.name));
+    }
+    return result;
+  });
+}
+
+// src/server/mcp-server/tool-registration/call-interceptor.ts
+var ALIASED_EXECUTE_CODE_NAMES = /* @__PURE__ */ new Set([
+  "mysql_execute_code",
+  "mysqlExecuteCode",
+  "execute_code",
+  "executeCode",
+  "mjExecuteCode",
+  "mj_eval",
+  "eval_code",
+  "run_code",
+  "exec_code",
+  "code_execute"
+]);
+var ALIASED_LIST_PROJECTS_NAMES = /* @__PURE__ */ new Set([
+  "listProjects",
+  "list-projects",
+  "get_projects",
+  "getProjects",
+  "get-projects",
+  "mj_list_projects",
+  "mjListProjects",
+  "mj_get_projects",
+  "mjGetProjects",
+  "mj_admin_list_projects",
+  "mj_admin_get_projects"
+]);
+var ALIASED_GET_PROJECT_NAMES = /* @__PURE__ */ new Set([
+  "getProject",
+  "get-project",
+  "mj_get_project",
+  "mjGetProject",
+  "mj_admin_get_project"
+]);
+var ALIASED_GREP_SEARCH_NAMES = new Set(DUMMY_GREP_SEARCH_TOOL_NAMES);
+var ALIASED_VIEW_FILE_NAMES = new Set(
+  DUMMY_FILE_VIEW_TOOL_NAMES.filter((name) => name !== "cat")
+);
+var ALIASED_LIST_DIR_NAMES = new Set(
+  DUMMY_DIR_LIST_TOOL_NAMES.filter((name) => name !== "ls" && name !== "dir")
+);
+var FORBIDDEN_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+var ALL_KNOWN_GROUP_TOOLS = new Set(Object.values(TOOL_GROUPS).flat());
+var UPPERCASE_RE = /[A-Z]/;
+function deepCamelToSnake(obj, depth = 0) {
+  if (depth > 12) return obj;
+  if (Array.isArray(obj)) return obj.map((item) => deepCamelToSnake(item, depth + 1));
+  if (obj !== null && typeof obj === "object") {
+    const newObj = {};
+    for (const [k, v] of Object.entries(obj)) {
+      if (FORBIDDEN_KEYS.has(k)) continue;
+      const snakeKey = UPPERCASE_RE.test(k) ? k.replace(/^[A-Z]/, (letter) => letter.toLowerCase()).replace(/[A-Z]/g, (letter) => `_${letter.toLowerCase()}`) : k;
+      if (FORBIDDEN_KEYS.has(snakeKey)) continue;
+      newObj[snakeKey] = deepCamelToSnake(v, depth + 1);
+    }
+    return newObj;
+  }
+  return obj;
+}
+function formatSuccessPayload(payload) {
+  const enriched = JSON.stringify(payload, null, 2);
+  return {
+    content: [{ type: "text", text: enriched }],
+    structuredContent: payload
+  };
+}
+function formatTokenEstimatedError(errorResult, isError) {
+  const enriched = JSON.stringify({ ...errorResult, _meta: { tokenEstimate: 0 } });
+  const tokenEstimate = Math.ceil(Buffer.byteLength(enriched, "utf8") / 4);
+  const finalText = enriched.replace('"tokenEstimate":0', `"tokenEstimate":${tokenEstimate}`);
+  return {
+    content: [{ type: "text", text: finalText }],
+    structuredContent: errorResult,
+    ...isError ? { isError: true } : {}
+  };
+}
+function parseZodErrorsFromMessage(rawText, prefixToRemove) {
+  let errorMessage = prefixToRemove !== void 0 ? rawText.replace(prefixToRemove, "") : rawText;
+  try {
+    const parts = rawText.split(": [");
+    if (parts.length > 1) {
+      const zodErrors = JSON.parse("[" + parts[1]);
+      errorMessage = zodErrors.map((e) => `${e.path && e.path.length > 0 ? e.path.join(".") : "unknown"}: ${e.message ?? "invalid"}`).join("; ");
+    }
+  } catch {
+  }
+  return errorMessage;
+}
+function isSuccessObject(res) {
+  return typeof res === "object" && res !== null && res["success"] === true;
+}
+function matchesSuffixes(name, list, suffixes) {
+  return list.includes(name) || suffixes.some((s) => name.endsWith(s));
+}
+async function tryAutonomousUnknownToolFallback(requestedTool, toolArgs, matchingPrompt, context, allTools, allToolNames, customToolHandlerConfig) {
+  const { configManager, db, teamDb, vectorManager, teamVectorManager, github, runtime } = context;
+  const currentConfig = configManager.getConfig();
+  const toolContext = {
+    db,
+    ...teamDb !== void 0 ? { teamDb } : {},
+    vectorManager,
+    ...teamVectorManager !== void 0 ? { teamVectorManager } : {},
+    github,
+    config: {
+      ...customToolHandlerConfig,
+      filterConfig: currentConfig.toolFilterConfig,
+      briefingConfig: currentConfig.briefingConfig,
+      runtime
+    }
+  };
+  if (matchingPrompt !== void 0) {
+    enforceAccessBoundary(matchingPrompt.name, "prompt", void 0, runtime.auditLogger);
+    const res = await handlePrompt(toolArgs, requestedTool, toolContext);
+    if (isSuccessObject(res)) return formatSuccessPayload(res);
+  }
+  if (matchesSuffixes(requestedTool, DUMMY_RESOURCE_TOOL_NAMES, ["_read_resource", "ReadResource"]) || requestedTool === "mjReadResource" || requestedTool.startsWith("memory://")) {
+    enforceAccessBoundary("read_resource", "tool", void 0, runtime.auditLogger);
+    const res = await handleReadResource(toolArgs, requestedTool, toolContext);
+    if (isSuccessObject(res)) return formatSuccessPayload(res);
+  }
+  if (matchesSuffixes(requestedTool, DUMMY_LIST_RESOURCE_TOOL_NAMES, ["_list_resources", "ListResources"])) {
+    enforceAccessBoundary("list_resources", "tool", void 0, runtime.auditLogger);
+    return formatSuccessPayload(handleListResources(requestedTool));
+  }
+  if (matchesSuffixes(requestedTool, DUMMY_LIST_PROMPT_TOOL_NAMES, ["_list_prompts", "ListPrompts"])) {
+    enforceAccessBoundary("list_prompts", "tool", void 0, runtime.auditLogger);
+    return formatSuccessPayload(handleListPrompts(requestedTool));
+  }
+  if (matchesSuffixes(requestedTool, DUMMY_LIST_TOOL_NAMES, ["_list_tools", "ListTools"])) {
+    enforceAccessBoundary("list_tools", "tool", void 0, runtime.auditLogger);
+    const enabledSet = currentConfig.toolFilterConfig?.enabledTools ?? allToolNames;
+    const toolsList = allTools.filter((t) => enabledSet.has(t.name)).map((t) => ({ name: t.name, title: t.title, description: t.description, annotations: t.annotations }));
+    return formatSuccessPayload({
+      success: true,
+      tools: toolsList,
+      _healing_note: `\u{1F6E0}\uFE0F AUTONOMOUS HEALING: '${requestedTool}' was called as an MCP tool instead of an MCP protocol request (tools/list). The available tools were returned successfully.`
+    });
+  }
+  if (matchesSuffixes(requestedTool, DUMMY_GET_PROMPT_TOOL_NAMES, ["_get_prompt", "GetPrompt"])) {
+    enforceAccessBoundary("get_prompt", "tool", void 0, runtime.auditLogger);
+    const res = await handleGetPrompt(toolArgs, requestedTool, toolContext);
+    if (isSuccessObject(res)) return formatSuccessPayload(res);
+  }
+  if (DUMMY_SERVER_INFO_TOOL_NAMES.includes(requestedTool)) {
+    enforceAccessBoundary("server_info", "tool", void 0, runtime.auditLogger);
+    return formatSuccessPayload(await handleServerInfo(toolArgs, requestedTool, toolContext));
+  }
+  if (matchesSuffixes(requestedTool, DUMMY_PROJECT_TOOL_NAMES, ["list_projects", "listProjects", "ListProjects"]) || requestedTool === "projects") {
+    enforceAccessBoundary("list_projects", "tool", void 0, runtime.auditLogger);
+    const cfg = currentConfig;
+    return formatSuccessPayload({
+      success: true,
+      projects: cfg.projectRegistry ?? {},
+      _healing_note: `\u{1F6E0}\uFE0F AUTONOMOUS HEALING: '${requestedTool}' was called as an MCP tool. Returned registered projects from projectRegistry successfully.`
+    });
+  }
+  if (matchesSuffixes(requestedTool, DUMMY_ADAPTER_TOOL_NAMES, ["list_adapters", "listAdapters", "ListAdapters"])) {
+    enforceAccessBoundary("list_adapters", "tool", void 0, runtime.auditLogger);
+    return formatSuccessPayload(handleListAdapters(requestedTool, toolContext));
+  }
+  if (matchesSuffixes(requestedTool, DUMMY_GREP_SEARCH_TOOL_NAMES, ["grep_search", "grepSearch"])) {
+    enforceAccessBoundary("grep_search", "tool", void 0, runtime.auditLogger);
+    return formatSuccessPayload(await handleGrepSearch(toolArgs, requestedTool, toolContext));
+  }
+  if (DUMMY_FILE_VIEW_TOOL_NAMES.includes(requestedTool)) {
+    enforceAccessBoundary("view_file", "tool", void 0, runtime.auditLogger);
+    return formatSuccessPayload(await handleViewFile(toolArgs, requestedTool, toolContext));
+  }
+  if (DUMMY_DIR_LIST_TOOL_NAMES.includes(requestedTool)) {
+    enforceAccessBoundary("list_dir", "tool", void 0, runtime.auditLogger);
+    return formatSuccessPayload(await handleListDir(toolArgs, requestedTool, toolContext));
+  }
+  return void 0;
+}
+function normalizeAndAliasToolCall(reqParams, options) {
+  reqParams.arguments = deepCamelToSnake(reqParams.arguments);
+  const toolArgs = reqParams.arguments;
+  if (toolArgs["project_number"] === void 0) {
+    const repoStr = typeof toolArgs["repo"] === "string" ? toolArgs["repo"] : typeof toolArgs["project"] === "string" ? toolArgs["project"] : void 0;
+    if (repoStr !== void 0 && repoStr !== "") toolArgs["project_number"] = repoStr;
+  }
+  if (typeof toolArgs["project_number"] === "string") {
+    const strVal = toolArgs["project_number"];
+    const parsed = Number(strVal);
+    if (!Number.isNaN(parsed)) {
+      toolArgs["project_number"] = parsed;
+    } else if (options.projectRegistry !== void 0) {
+      let entry = options.projectRegistry[strVal];
+      if (entry === void 0 && strVal.includes("/")) {
+        const repoName = strVal.split("/").pop();
+        if (repoName !== void 0 && repoName !== "") entry = options.projectRegistry[repoName];
+      }
+      if (entry?.project_number !== void 0) toolArgs["project_number"] = entry.project_number;
+    }
+  }
+  const currentName = reqParams.name;
+  if (currentName !== void 0 && currentName !== "") {
+    if (ALIASED_EXECUTE_CODE_NAMES.has(currentName)) {
+      reqParams.name = "mj_execute_code";
+    } else if (currentName === "create_entry_minimal") {
+      reqParams.name = "create_entry";
+      if (toolArgs["entry_type"] === void 0) toolArgs["entry_type"] = "personal_reflection";
+    } else if (ALIASED_LIST_PROJECTS_NAMES.has(currentName)) {
+      reqParams.name = "list_projects";
+    } else if (ALIASED_GET_PROJECT_NAMES.has(currentName)) {
+      reqParams.name = "get_project";
+    } else if (ALIASED_GREP_SEARCH_NAMES.has(currentName)) {
+      reqParams.name = "grep_search";
+    } else if (ALIASED_VIEW_FILE_NAMES.has(currentName)) {
+      reqParams.name = "view_file";
+    } else if (ALIASED_LIST_DIR_NAMES.has(currentName)) {
+      reqParams.name = "list_dir";
+    }
+  }
+}
+function attachCallToolInterceptor(requestHandlers, context, options, prompts, allTools, allToolNames, customToolHandlerConfig) {
+  const originalHandler = requestHandlers?.get("tools/call");
+  if (originalHandler === void 0 || requestHandlers === void 0) return;
+  requestHandlers.set("tools/call", async (request2, extra) => {
+    try {
+      const req = request2;
+      const healingEnabled = options.agentHealing !== false && customToolHandlerConfig.agentHealing !== false;
+      if (req.params?.arguments !== void 0 && healingEnabled) {
+        normalizeAndAliasToolCall(req.params, options);
+        const toolArgs = req.params.arguments;
+        if (req.params.name !== void 0 && req.params.name !== "") {
+          const intercept = applyArgInterceptions(req.params.name, [toolArgs]);
+          if ("error" in intercept) {
+            const errorResult = intercept.error;
+            logAgentIssue({
+              source: "MCP",
+              action: req.params.name,
+              input: toolArgs,
+              error: errorResult["error"] ?? "Validation Error"
+            });
+            return formatTokenEstimatedError(errorResult, false);
+          }
+          const normalizedArgs = intercept.args?.[0];
+          if (normalizedArgs !== null && normalizedArgs !== void 0 && typeof normalizedArgs === "object" && !Array.isArray(normalizedArgs)) {
+            req.params.arguments = normalizedArgs;
+          }
+        }
+      }
+      if (req.params?.name !== void 0 && req.params.name !== "" && !allToolNames.has(req.params.name)) {
+        const requestedTool = req.params.name;
+        const toolArgs = req.params.arguments ?? {};
+        const normalized = requestedTool.replace(/^mj_/, "").replace(/_/g, "-");
+        const matchingPrompt = prompts.find(
+          (p) => p.name === normalized || p.name === requestedTool || p.name === requestedTool.replace(/^mj_/, "")
+        );
+        if (healingEnabled) {
+          const fallbackResponse = await tryAutonomousUnknownToolFallback(
+            requestedTool,
+            toolArgs,
+            matchingPrompt,
+            context,
+            allTools,
+            allToolNames,
+            customToolHandlerConfig
+          );
+          if (fallbackResponse !== void 0) return fallbackResponse;
+        }
+        let suggestion = `Tool '${requestedTool}' does not exist. Use tools/list to see available tools.`;
+        const isFilteredTool = ALL_KNOWN_GROUP_TOOLS.has(requestedTool);
+        if (isFilteredTool) {
+          suggestion = `'${requestedTool}' is a valid tool but it is not currently exposed because of your active --tool-filter or codemode restrictions. If you are in Code Mode, invoke it via 'mj_execute_code' (e.g. 'await mj.core.${requestedTool}(...)').`;
+        } else if (matchingPrompt !== void 0) {
+          suggestion = `'${requestedTool}' is an MCP Prompt, not an MCP Tool. Please use the 'get_prompt' tool (or your native MCP Prompts integration) to evaluate it, then use 'create_entry' to save the result.`;
+        } else if (requestedTool.startsWith("mj_")) {
+          suggestion = `'${requestedTool}' is not a valid root tool. If you are trying to use Code Mode, you must invoke the 'mj_execute_code' tool and write javascript (e.g. 'await mj.core.searchEntries(...)').`;
+        }
+        const errorResult = {
+          success: false,
+          error: `MCP error -32602: Tool ${requestedTool} not found`,
+          code: "TOOL_NOT_FOUND",
+          category: "hallucination",
+          suggestion,
+          recoverable: false
+        };
+        if (healingEnabled) {
+          logAgentIssue({
+            source: "MCP",
+            action: requestedTool,
+            input: toolArgs,
+            error: errorResult.error
+          });
+        }
+        return formatTokenEstimatedError(errorResult, true);
+      }
+      const result = await originalHandler(request2, extra);
+      if (result !== null && result !== void 0 && typeof result === "object" && "isError" in result && result.isError === true) {
+        const resObj = result;
+        if (Array.isArray(resObj.content) && resObj.content.length > 0) {
+          const text = resObj.content[0]?.text;
+          if (typeof text === "string" && text.includes("MCP error -32602")) {
+            const errorMessage = parseZodErrorsFromMessage(
+              text,
+              "MCP error -32602: Input validation error: "
+            );
+            const errorResult = {
+              success: false,
+              error: errorMessage,
+              code: "VALIDATION_ERROR",
+              category: "validation",
+              suggestion: "Check input parameters against the tool schema",
+              recoverable: false
+            };
+            logAgentIssue({
+              source: "MCP",
+              action: req.params?.name ?? "unknown",
+              input: req.params?.arguments ?? {},
+              error: errorMessage
+            });
+            return formatTokenEstimatedError(errorResult, false);
+          }
+        }
+      }
+      return result;
+    } catch (error) {
+      const err = error;
+      if (err.code === -32602) {
+        let errorMessage = err.message ?? "Validation Error";
+        if (typeof errorMessage === "string" && errorMessage.includes("Invalid arguments for tool")) {
+          errorMessage = parseZodErrorsFromMessage(errorMessage);
+        }
+        const errorResult = {
+          success: false,
+          error: errorMessage,
+          code: "VALIDATION_ERROR",
+          category: "validation",
+          suggestion: "Check input parameters against the tool schema",
+          recoverable: false
+        };
+        const fallbackReq = request2;
+        logAgentIssue({
+          source: "MCP",
+          action: fallbackReq.params?.name ?? "unknown",
+          input: fallbackReq.params?.arguments ?? {},
+          error: errorMessage
+        });
+        return formatTokenEstimatedError(errorResult, true);
+      }
+      throw error;
+    }
+  });
+}
+
+// src/server/mcp-server/tool-registration/register-tools.ts
+var DEFAULT_MAX_TOOL_INPUT_ELEMENTS = 25e3;
+function resolveEffectiveMaxToolInputElements(configured) {
+  if (configured === void 0) return DEFAULT_MAX_TOOL_INPUT_ELEMENTS;
+  return configured === 0 || configured === Infinity ? Infinity : configured;
+}
+var MUTATING_TOOLS = /* @__PURE__ */ new Set([
+  "create_entry",
+  "update_entry",
+  "delete_entry",
+  "restore_entry",
+  "batch_create_entries",
+  "batch_update_entries",
+  "batch_delete_entries",
+  "team_add_member",
+  "team_update_member_role",
+  "team_remove_member"
+]);
+var toolRegistrationOptionsCache = /* @__PURE__ */ new WeakMap();
+function buildToolRegistrationOptions(tool) {
+  const cached = toolRegistrationOptionsCache.get(tool);
+  if (cached !== void 0) return cached;
+  const toolOptions = { description: tool.description };
+  if (tool.title !== void 0 && tool.title !== "") toolOptions.title = tool.title;
+  if (tool.inputSchema !== void 0) {
+    const schema = tool.inputSchema;
+    const fallbackInputSchema = schema;
+    if (typeof schema === "object" && schema !== null && "partial" in schema && typeof schema.partial === "function") {
+      try {
+        const relaxed = schema.partial();
+        toolOptions.inputSchema = typeof relaxed.passthrough === "function" ? relaxed.passthrough() : fallbackInputSchema;
+      } catch {
+        toolOptions.inputSchema = fallbackInputSchema;
+      }
+    } else {
+      toolOptions.inputSchema = fallbackInputSchema;
+    }
+  }
+  if (tool.outputSchema !== void 0) {
+    const outSchema = tool.outputSchema;
+    const fallbackOutputSchema = outSchema;
+    if (typeof outSchema === "object" && outSchema !== null && "passthrough" in outSchema && typeof outSchema.passthrough === "function") {
+      try {
+        toolOptions.outputSchema = outSchema.passthrough();
+      } catch {
+        toolOptions.outputSchema = fallbackOutputSchema;
+      }
+    } else {
+      toolOptions.outputSchema = fallbackOutputSchema;
+    }
+  }
+  if (tool.annotations !== void 0) toolOptions.annotations = tool.annotations;
+  if (tool.icons !== void 0) toolOptions.icons = [{ src: tool.icons.iconUrl }];
+  toolRegistrationOptionsCache.set(tool, toolOptions);
+  return toolOptions;
+}
+function createServerInstance(context, options, prompts, resources, allTools, allToolNames, customToolHandlerConfig) {
+  const {
+    configManager,
+    db,
+    teamDb,
+    vectorManager,
+    teamVectorManager,
+    github,
+    scheduler,
+    allowedIoRoots,
+    runtime
+  } = context;
+  const { defaultProjectNumber } = options;
+  const getInstructions = () => {
+    const currentConfig = configManager.getConfig();
+    const enabledSet = currentConfig.toolFilterConfig?.enabledTools ?? allToolNames;
+    const groups = currentConfig.toolFilterConfig ? getEnabledGroups(currentConfig.toolFilterConfig.enabledTools) : void 0;
+    const isCodeModeOnly = enabledSet.size === 1 && enabledSet.has("mj_execute_code");
+    const mappedPrompts = prompts.map((p) => {
+      const prompt = p;
+      return {
+        name: prompt.name,
+        ...prompt.description !== void 0 ? { description: prompt.description } : {}
+      };
+    });
+    if (isCodeModeOnly || currentConfig.toolFilterConfig?.raw === "codemode") {
+      const finalGroups = currentConfig.codemodeInternalFullAccess === true ? new Set(Object.keys(TOOL_GROUPS)) : groups;
+      const finalEnabledTools = currentConfig.codemodeInternalFullAccess === true ? allToolNames : enabledSet;
+      return generateCodeModeInstructions(
+        finalEnabledTools,
+        mappedPrompts,
+        void 0,
+        finalGroups,
+        currentConfig.briefingConfig
+      );
+    }
+    return generateStandardInstructions(
+      enabledSet,
+      mappedPrompts,
+      void 0,
+      groups,
+      currentConfig.briefingConfig
+    );
+  };
+  const server = new McpServer(
+    { name: "memory-journal-mcp", version: VERSION },
+    {
+      capabilities: {
+        logging: {},
+        prompts: { listChanged: true },
+        tools: { listChanged: true },
+        resources: { subscribe: true, listChanged: true },
+        experimental: { progress: {} }
+      },
+      instructions: getInstructions(),
+      maxToolInputElements: resolveEffectiveMaxToolInputElements(options.maxToolInputElements)
+    }
+  );
+  if (context.skillCatalog !== void 0 && typeof server.isConnected === "function") {
+    context.skillCatalog.attach(server);
+  }
+  for (const tool of allTools) {
+    const toolOptions = buildToolRegistrationOptions(tool);
+    const hasOutputSchema = Boolean(tool.outputSchema);
+    server.registerTool(
+      tool.name,
+      toolOptions,
+      async (args, extra) => {
+        try {
+          const extraMeta = extra;
+          const progressToken = extraMeta?.mcpReq?._meta?.progressToken;
+          const progressContext = progressToken !== void 0 ? { server: server.server, progressToken } : void 0;
+          const currentConfig = configManager.getConfig();
+          customToolHandlerConfig.filterConfig = currentConfig.toolFilterConfig;
+          customToolHandlerConfig.briefingConfig = currentConfig.briefingConfig;
+          const toolArgs = typeof args === "object" && args !== null ? args : {};
+          const result = await callTool(
+            tool.name,
+            toolArgs,
+            db,
+            vectorManager,
+            github,
+            customToolHandlerConfig,
+            progressContext,
+            teamDb ?? void 0,
+            teamVectorManager ?? void 0
+          );
+          const isSuccess = typeof result === "object" && result !== null && result["success"] === true;
+          if (isSuccess) {
+            const isMutation = MUTATING_TOOLS.has(tool.name) || tool.name.startsWith("team_") && tool.annotations.readOnlyHint !== true;
+            if (isMutation) {
+              void globalSubscriptionManager.notifyResourceUpdated("memory://briefing");
+              void globalSubscriptionManager.notifyResourceUpdated("memory://recent");
+              void globalSubscriptionManager.notifyResourceUpdated(
+                "memory://statistics"
+              );
+              if (tool.name.startsWith("team_")) {
+                void globalSubscriptionManager.notifyResourceUpdated(
+                  "memory://team/recent"
+                );
+                void globalSubscriptionManager.notifyResourceUpdated(
+                  "memory://team/statistics"
+                );
+              }
+            }
+          }
+          const textContent = typeof result === "string" ? result : JSON.stringify(result, null, 2);
+          if (hasOutputSchema) {
+            return {
+              content: [{ type: "text", text: textContent }],
+              structuredContent: result
+            };
+          }
+          return { content: [{ type: "text", text: textContent }] };
+        } catch (error) {
+          let errorResult;
+          if (error instanceof Error && "toResponse" in error && typeof error.toResponse === "function") {
+            errorResult = error.toResponse();
+          } else {
+            const errorMessage = error instanceof Error ? error.message : String(error);
+            errorResult = {
+              success: false,
+              error: errorMessage,
+              code: "INTERNAL_ERROR",
+              category: "internal",
+              recoverable: false
+            };
+          }
+          logAgentIssue({
+            source: "MCP",
+            action: tool.name,
+            input: args,
+            error: errorResult["error"] ?? "Unknown error"
+          });
+          return {
+            content: [
+              {
+                type: "text",
+                text: JSON.stringify(errorResult, null, 2)
+              }
+            ],
+            ...hasOutputSchema ? { structuredContent: errorResult } : {},
+            isError: true
+          };
+        }
+      }
+    );
+  }
+  const handleResourceRead = async (uri, mimeType) => {
+    const currentConfig = configManager.getConfig();
+    const resolvedDefaultProj = currentConfig.briefingConfig.defaultProjectNumber ?? defaultProjectNumber;
+    const activeBriefingConfig = {
+      ...currentConfig.briefingConfig,
+      ...resolvedDefaultProj !== void 0 ? { defaultProjectNumber: resolvedDefaultProj } : {},
+      ...options.projectRegistry !== void 0 ? { projectRegistry: options.projectRegistry } : {},
+      allowedIoRoots
+    };
+    try {
+      const result = await readResource(
+        uri.href,
+        db,
+        vectorManager,
+        currentConfig.toolFilterConfig,
+        github,
+        scheduler,
+        teamDb ?? void 0,
+        activeBriefingConfig,
+        runtime
+      );
+      runtime.metrics.recordResourceRead(uri.href, false);
+      const dataStr = typeof result.data === "string" ? result.data : JSON.stringify(result.data, null, 2);
+      return {
+        contents: [
+          {
+            uri: uri.href,
+            mimeType,
+            text: dataStr,
+            ...result.annotations !== void 0 ? { annotations: result.annotations } : {}
+          }
+        ]
+      };
+    } catch (error) {
+      runtime.metrics.recordResourceRead(uri.href, true);
+      throw error;
+    }
+  };
+  registerResources(server, resources, handleResourceRead, runtime);
+  server.server.setRequestHandler("resources/subscribe", (request2, extra) => {
+    const sessionId = extra?.sessionId;
+    const transportSessionId = sessionId !== void 0 && sessionId !== "" ? sessionId : "stdio";
+    validateResourceSubscription(request2.params.uri, runtime);
+    globalSubscriptionManager.registerServer(transportSessionId, server);
+    globalSubscriptionManager.subscribe(request2.params.uri, transportSessionId);
+    return {};
+  });
+  server.server.setRequestHandler("resources/unsubscribe", (request2, extra) => {
+    const sessionId = extra?.sessionId;
+    const transportSessionId = sessionId !== void 0 && sessionId !== "" ? sessionId : "stdio";
+    globalSubscriptionManager.unsubscribe(request2.params.uri, transportSessionId);
+    return {};
+  });
+  const briefingConfig = configManager.getConfig().briefingConfig;
+  registerPrompts(
+    server,
+    prompts,
+    db,
+    teamDb ?? void 0,
+    runtime,
+    context.github,
+    briefingConfig
+  );
+  const serverObj = server.server;
+  const requestHandlers = serverObj._requestHandlers;
+  attachListToolsInterceptor(requestHandlers, configManager, allToolNames);
+  attachCallToolInterceptor(
+    requestHandlers,
+    context,
+    options,
+    prompts,
+    allTools,
+    allToolNames,
+    customToolHandlerConfig
+  );
+  return server;
+}
+function startMetricsServer(runtime, metricsPort) {
+  const portStr = process.env["MJ_METRICS_PORT"];
+  const port = metricsPort ?? (portStr !== void 0 && portStr !== "" ? parseInt(portStr, 10) : 9465);
+  const server = http.createServer((req, res) => {
+    if (req.url === "/metrics" && req.method === "GET") {
+      try {
+        const metrics = formatPrometheusMetrics(runtime.metrics);
+        res.writeHead(200, { "Content-Type": "text/plain" });
+        res.end(metrics);
+      } catch (error) {
+        logger.error("Failed to generate metrics", { error: error instanceof Error ? error.message : String(error) });
+        res.writeHead(500, { "Content-Type": "text/plain" });
+        res.end("Internal Server Error");
+      }
+    } else if (req.url === "/health" && req.method === "GET") {
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ status: "ok" }));
+    } else {
+      res.writeHead(404, { "Content-Type": "text/plain" });
+      res.end("Not Found");
+    }
+  });
+  server.on("error", (error) => {
+    const err = error;
+    if (typeof err === "object" && err !== null && err.code === "EADDRINUSE") {
+      logger.warning(`Metrics server port ${port} is already in use; standalone metrics server disabled for this instance`, { module: "MetricsServer" });
+    } else {
+      logger.error("Metrics server error", { error: error instanceof Error ? error.message : String(error), module: "MetricsServer" });
+    }
+  });
+  const rawHost = process.env["MJ_METRICS_HOST"]?.trim();
+  const host = rawHost !== void 0 && rawHost !== "" ? rawHost : "127.0.0.1";
+  server.listen(port, host, () => {
+    logger.info(`Standalone metrics server listening on ${host}:${port}`, { module: "MetricsServer" });
+  });
+  return () => {
+    return new Promise((resolve, reject) => {
+      server.close((err) => {
+        if (err) {
+          logger.error("Failed to close metrics server", { error: err.message, module: "MetricsServer" });
+          reject(err);
+        } else {
+          logger.info("Metrics server closed", { module: "MetricsServer" });
+          resolve();
+        }
+      });
+    });
+  };
+}
+
+// src/server/mcp-server/core.ts
+async function createServer2(options) {
+  const context = await initializeDependencies(options);
+  const { db, testDb, teamDb, testTeamDb, runtime, vectorManager, teamVectorManager, github, configManager, scheduler, allowedIoRoots, activeMetricsPath } = context;
+  const { transport, defaultProjectNumber } = options;
+  const filterConfig = configManager.getConfig().toolFilterConfig;
+  const baseConfig = {
+    defaultProjectNumber,
+    defaultWorkspaceId: options.defaultWorkspaceId,
+    projectRegistry: options.projectRegistry,
+    additionalTeamDbs: options.additionalTeamDbs,
+    allowedIoRoots,
+    filterConfig,
+    authEnabled: Boolean(options.authToken ?? process.env["MCP_AUTH_TOKEN"]),
+    oauthEnabled: options.oauthEnabled,
+    codemodeEnabled: true,
+    codemodeInternalFullAccess: options.codemodeInternalFullAccess,
+    agentHealing: options.agentHealing,
+    teamDefaultRole: options.teamDefaultRole,
+    teamAdmin: options.teamAdmin,
+    runtime,
+    subscriptionManager: globalSubscriptionManager,
+    archiveOlderThanDays: options.archiveOlderThanDays,
+    pruneOlderThanDays: options.pruneOlderThanDays,
+    hardDeleteOlderThanDays: options.hardDeleteOlderThanDays,
+    pruneImportanceThreshold: options.pruneImportanceThreshold
+  };
+  const dispatch = (name, args) => callTool(
+    name,
+    args,
+    db,
+    vectorManager,
+    github,
+    baseConfig,
+    void 0,
+    teamDb ?? void 0,
+    teamVectorManager ?? void 0
+  );
+  const customToolHandlerConfig = { ...baseConfig, dispatch };
+  const allTools = getTools(
+    db,
+    filterConfig,
+    vectorManager,
+    github,
+    customToolHandlerConfig,
+    teamDb ?? void 0,
+    teamVectorManager ?? void 0
+  );
+  const allToolNames = new Set(allTools.map((t) => t.name));
+  for (const toolName of allToolNames) {
+    getRequiredScope(toolName);
+  }
+  const resources = getResources();
+  const prompts = getPrompts();
+  configManager.on("changed", (newConfig) => {
+    baseConfig.filterConfig = newConfig.toolFilterConfig;
+    baseConfig.briefingConfig = newConfig.briefingConfig;
+    customToolHandlerConfig.filterConfig = newConfig.toolFilterConfig;
+    customToolHandlerConfig.briefingConfig = newConfig.briefingConfig;
+    void globalSubscriptionManager.notifyResourceUpdated("memory://briefing");
+    try {
+      void globalSubscriptionManager.broadcastNotification("notifications/tools/list_changed");
+      void globalSubscriptionManager.broadcastNotification("notifications/resources/list_changed");
+    } catch (error) {
+      logger.debug("Failed to send list_changed notifications to MCP client", {
+        module: "McpServer",
+        error: error instanceof Error ? error.message : String(error)
+      });
+    }
+  });
+  const getServerInstance = () => createServerInstance(
+    context,
+    options,
+    prompts,
+    resources,
+    allTools,
+    allToolNames,
+    customToolHandlerConfig
+  );
+  let shutdownMetrics;
+  if (options.metricsExport === "prometheus") {
+    shutdownMetrics = startMetricsServer(runtime, options.metricsPort);
+  }
+  if (transport === "stdio") {
+    const stdioTransport = new StdioServerTransport();
+    const server = getServerInstance();
+    await server.connect(stdioTransport);
+    logger.info("MCP server started on stdio", { module: "McpServer" });
+    const handleStdioShutdown = () => {
+      logger.info("Shutting down...", { module: "McpServer" });
+      if (runtime.auditLogger) {
+        void runtime.auditLogger.close();
+      }
+      if (shutdownMetrics) {
+        void shutdownMetrics().catch((err) => {
+          logger.debug("Error shutting down metrics server", { module: "McpServer", error: String(err) });
+        });
+      }
+      if (activeMetricsPath) {
+        void runtime.metrics.saveToFile(activeMetricsPath).then(() => {
+          db.close();
+          testDb?.close();
+          teamDb?.close();
+          testTeamDb?.close();
+          process.exit(0);
+        });
+      } else {
+        db.close();
+        testDb?.close();
+        teamDb?.close();
+        testTeamDb?.close();
+        process.exit(0);
+      }
+    };
+    process.on("SIGINT", handleStdioShutdown);
+    process.on("SIGTERM", handleStdioShutdown);
+  } else {
+    const port = options.port ?? 3e3;
+    const host = options.host ?? "localhost";
+    const corsRaw = process.env["MCP_CORS_ORIGIN"];
+    const corsOrigins = options.corsOrigins ?? (corsRaw ? corsRaw.split(",").map((s) => s.trim()) : []);
+    const authToken = options.authToken ?? process.env["MCP_AUTH_TOKEN"] ?? void 0;
+    const httpTransport = new HttpTransport({
+      port,
+      host,
+      corsOrigins,
+      stateless: options.statelessHttp === true,
+      authToken,
+      enableHSTS: options.enableHSTS,
+      oauthEnabled: options.oauthEnabled,
+      oauthIssuer: options.oauthIssuer,
+      oauthAudience: options.oauthAudience,
+      oauthJwksUri: options.oauthJwksUri,
+      oauthClockTolerance: options.oauthClockTolerance,
+      allowPlaintextLoopbackOAuth: options.allowPlaintextLoopbackOAuth,
+      trustProxy: options.trustProxy,
+      publicOrigin: options.publicOrigin,
+      metricsExport: options.metricsExport
+    });
+    await httpTransport.start(getServerInstance, scheduler, runtime);
+    const handleHttpShutdown = () => {
+      void (async () => {
+        if (shutdownMetrics) {
+          await shutdownMetrics().catch((err) => {
+            logger.debug("Error shutting down metrics server", { module: "McpServer", error: String(err) });
+          });
+        }
+        await httpTransport.stop(scheduler);
+        if (runtime.auditLogger) {
+          await runtime.auditLogger.close();
+        }
+        if (activeMetricsPath) {
+          await runtime.metrics.saveToFile(activeMetricsPath);
+        }
+        db.close();
+        testDb?.close();
+        teamDb?.close();
+        testTeamDb?.close();
+        process.exit(0);
+      })();
+    };
+    process.on("SIGINT", handleHttpShutdown);
+    process.on("SIGTERM", handleHttpShutdown);
+  }
+}
+
+export { VectorSearchManager, createServer2 as createServer, initializeDependencies };