@automattic/mcp-wordpress-remote 0.2.0 → 0.2.2

package/dist/proxy.js

@@ -4,94 +4,2011 @@
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 
+// src/lib/wordpress-api.ts
+import { EventEmitter as EventEmitter3 } from "node:events";
+
 // src/lib/utils.ts
 import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
+
+// src/lib/config.ts
+import * as os from "os";
+import * as path from "path";
+var CONFIG = {
+  // API Configuration
+  WP_API_URL: process.env.WP_API_URL || "https://example.com",
+  // OAuth Configuration (MCP Authorization specification 2025-06-18 compliant)
+  OAUTH_ENABLED: process.env.OAUTH_ENABLED === "true",
+  // Disabled by default, enable with 'true'
+  OAUTH_CALLBACK_PORT: parseInt(process.env.OAUTH_CALLBACK_PORT || "3000"),
+  OAUTH_HOST: process.env.OAUTH_HOST || "127.0.0.1",
+  WP_OAUTH_CLIENT_ID: process.env.WP_OAUTH_CLIENT_ID || "",
+  // No default - site-specific
+  // MCP OAuth 2.1 specific settings
+  OAUTH_FLOW_TYPE: process.env.OAUTH_FLOW_TYPE || "authorization_code",
+  OAUTH_USE_PKCE: process.env.OAUTH_USE_PKCE !== "false",
+  // PKCE required for OAuth 2.1
+  OAUTH_DYNAMIC_REGISTRATION: process.env.OAUTH_DYNAMIC_REGISTRATION !== "false",
+  // Dynamic client registration
+  // Resource Indicators (RFC 8707)
+  OAUTH_RESOURCE_INDICATOR: process.env.OAUTH_RESOURCE_INDICATOR !== "false",
+  // Resource parameter support
+  // Timeout Configuration (in milliseconds)
+  OAUTH_TIMEOUT: 3e4,
+  // 30 seconds
+  LOCK_TIMEOUT: 3e5,
+  // 5 minutes
+  // Directory Configuration
+  WP_MCP_CONFIG_DIR: process.env.WP_MCP_CONFIG_DIR || path.join(os.homedir(), ".mcp-auth"),
+  // Logging Configuration
+  LOG_FILE: process.env.LOG_FILE || null,
+  // Authentication Configuration (legacy support)
+  WP_API_USERNAME: process.env.WP_API_USERNAME,
+  WP_API_PASSWORD: process.env.WP_API_PASSWORD,
+  JWT_TOKEN: process.env.JWT_TOKEN,
+  WOO_CUSTOMER_KEY: process.env.WOO_CUSTOMER_KEY,
+  WOO_CUSTOMER_SECRET: process.env.WOO_CUSTOMER_SECRET,
+  // Environment
+  NODE_ENV: process.env.NODE_ENV || "development"
+};
+function isWordPressComSite(url) {
+  try {
+    const siteUrl = new URL(url);
+    const hostname2 = siteUrl.hostname.toLowerCase();
+    return hostname2.endsWith(".wordpress.com") || hostname2 === "wordpress.com" || // Jetpack sites often use WordPress.com OAuth
+    hostname2.endsWith(".wpcomstaging.com") || hostname2.endsWith(".wpcomstaging.net");
+  } catch {
+    return false;
+  }
+}
+function getRecommendedOAuthConfig(siteUrl) {
+  if (isWordPressComSite(siteUrl)) {
+    return {
+      flowType: "implicit",
+      usePKCE: false,
+      useResourceIndicator: false,
+      authorizationEndpoint: "https://public-api.wordpress.com/oauth2/authorize",
+      tokenEndpoint: "https://public-api.wordpress.com/oauth2/token",
+      description: "WordPress.com OAuth2 (compatible mode)"
+    };
+  } else {
+    return {
+      flowType: "authorization_code",
+      usePKCE: true,
+      useResourceIndicator: true,
+      authorizationEndpoint: void 0,
+      // Will be discovered
+      tokenEndpoint: void 0,
+      // Will be discovered
+      description: "MCP-compliant OAuth 2.1"
+    };
+  }
+}
+function validateConfig() {
+  const errors = [];
+  const hasJWT = !!CONFIG.JWT_TOKEN;
+  const hasBasicAuth = !!(CONFIG.WP_API_USERNAME && CONFIG.WP_API_PASSWORD);
+  const hasOAuth = CONFIG.OAUTH_ENABLED;
+  if (!hasJWT && !hasBasicAuth && !hasOAuth) {
+    errors.push(
+      "No authentication method configured. Please set one of: JWT_TOKEN, WP_API_USERNAME+WP_API_PASSWORD, or enable OAuth"
+    );
+  }
+  if (!CONFIG.WP_API_URL || CONFIG.WP_API_URL === "https://example.com") {
+    errors.push("WP_API_URL must be set to your WordPress site URL");
+  }
+  if (CONFIG.OAUTH_ENABLED) {
+    if (isNaN(CONFIG.OAUTH_CALLBACK_PORT) || CONFIG.OAUTH_CALLBACK_PORT < 1 || CONFIG.OAUTH_CALLBACK_PORT > 65535) {
+      errors.push("OAUTH_CALLBACK_PORT must be a valid port number (1-65535)");
+    }
+    if (CONFIG.OAUTH_FLOW_TYPE === "implicit") {
+      errors.push(
+        "OAUTH_FLOW_TYPE=implicit is deprecated. MCP Authorization specification 2025-06-18 requires OAuth 2.1 with authorization_code flow"
+      );
+    }
+    if (CONFIG.OAUTH_FLOW_TYPE === "authorization_code" && !CONFIG.OAUTH_USE_PKCE) {
+      errors.push(
+        "PKCE is required for OAuth 2.1 authorization_code flow (MCP Authorization specification 2025-06-18)"
+      );
+    }
+  }
+  return {
+    isValid: errors.length === 0,
+    errors
+  };
+}
+
+// src/lib/utils.ts
 import * as fs from "node:fs";
-import * as path from "node:path";
-var LOG_FILE = process.env.LOG_FILE || null;
-if (LOG_FILE) {
-  const logDir = path.dirname(LOG_FILE);
+import * as path2 from "node:path";
+var LogLevel = /* @__PURE__ */ ((LogLevel4) => {
+  LogLevel4[LogLevel4["ERROR"] = 0] = "ERROR";
+  LogLevel4[LogLevel4["WARN"] = 1] = "WARN";
+  LogLevel4[LogLevel4["INFO"] = 2] = "INFO";
+  LogLevel4[LogLevel4["DEBUG"] = 3] = "DEBUG";
+  return LogLevel4;
+})(LogLevel || {});
+var CURRENT_LOG_LEVEL = process.env.LOG_LEVEL ? parseInt(process.env.LOG_LEVEL) : CONFIG.NODE_ENV === "development" ? 3 /* DEBUG */ : 2 /* INFO */;
+if (CONFIG.LOG_FILE) {
+  const logDir = path2.dirname(CONFIG.LOG_FILE);
   if (!fs.existsSync(logDir)) {
     fs.mkdirSync(logDir, { recursive: true });
   }
 }
-function log(message, ...args) {
+function log(message, level = 2 /* INFO */, category = "GENERAL", ...args) {
+  if (level > CURRENT_LOG_LEVEL) {
+    return;
+  }
   const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-  const formattedArgs = args.length > 0 ? args.map((arg) => typeof arg === "object" ? JSON.stringify(arg) : arg).join(" ") : "";
-  const logMessage = `${timestamp}: ${message}${formattedArgs ? " " + formattedArgs : ""}
+  const levelName = LogLevel[level];
+  const formattedArgs = args.length > 0 ? args.map((arg) => typeof arg === "object" ? JSON.stringify(arg, null, 2) : arg).join(" ") : "";
+  const logMessage = `${timestamp} [${levelName}] [${category}] ${message}${formattedArgs ? "\n" + formattedArgs : ""}
 `;
-  console.error(logMessage.trim());
-  if (LOG_FILE) {
-    fs.appendFileSync(LOG_FILE, logMessage);
+  process.stderr.write(logMessage);
+  if (CONFIG.LOG_FILE) {
+    fs.appendFileSync(CONFIG.LOG_FILE, logMessage);
   }
 }
+var logger = {
+  error: (message, category = "ERROR", ...args) => log(message, 0 /* ERROR */, category, ...args),
+  warn: (message, category = "WARN", ...args) => log(message, 1 /* WARN */, category, ...args),
+  info: (message, category = "INFO", ...args) => log(message, 2 /* INFO */, category, ...args),
+  debug: (message, category = "DEBUG", ...args) => log(message, 3 /* DEBUG */, category, ...args),
+  // Specialized category loggers
+  auth: (message, level = 2 /* INFO */, ...args) => log(message, level, "AUTH", ...args),
+  oauth: (message, level = 2 /* INFO */, ...args) => log(message, level, "OAUTH", ...args),
+  api: (message, level = 2 /* INFO */, ...args) => log(message, level, "API", ...args),
+  config: (message, level = 2 /* INFO */, ...args) => log(message, level, "CONFIG", ...args)
+};
 
-// src/lib/wordpress-api.ts
-function validateEnvironment() {
-  if (process.env.JWT_TOKEN) {
-    const requiredEnvVars = ["WP_API_URL"];
-    const missingVars = requiredEnvVars.filter((varName) => !process.env[varName]);
-    if (missingVars.length > 0) {
-      throw new Error(
-        `Missing required environment variables: ${missingVars.join(
-          ", "
-        )}. Please set these variables before starting the server.`
+// src/lib/oauth-types.ts
+var OAuthError = class _OAuthError extends Error {
+  constructor(message, code = "OAUTH_ERROR", details) {
+    super(message);
+    this.name = "OAuthError";
+    this.code = code;
+    this.details = details;
+    Object.setPrototypeOf(this, _OAuthError.prototype);
+  }
+};
+var AuthError = class _AuthError extends Error {
+  constructor(message, method, statusCode) {
+    super(message);
+    this.name = "AuthError";
+    this.method = method;
+    this.statusCode = statusCode;
+    Object.setPrototypeOf(this, _AuthError.prototype);
+  }
+};
+var APIError = class _APIError extends Error {
+  constructor(message, statusCode, endpoint, response) {
+    super(message);
+    this.name = "APIError";
+    this.statusCode = statusCode;
+    this.endpoint = endpoint;
+    this.response = response;
+    Object.setPrototypeOf(this, _APIError.prototype);
+  }
+};
+
+// src/lib/persistent-auth-config.ts
+import path3 from "path";
+import fs2 from "fs/promises";
+import fsSync from "fs";
+import crypto from "crypto";
+var VERSION = "0.2.1";
+function getConfigDir() {
+  const baseConfigDir = CONFIG.WP_MCP_CONFIG_DIR;
+  return path3.join(baseConfigDir, `wordpress-remote-${VERSION}`);
+}
+async function ensureConfigDir() {
+  try {
+    const configDir = getConfigDir();
+    await fs2.mkdir(configDir, { recursive: true });
+    await fs2.chmod(configDir, 448);
+  } catch (error) {
+    logger.error("Error creating config directory", "AUTH", error);
+    throw error;
+  }
+}
+function getConfigFilePath(serverUrlHash, filename) {
+  const configDir = getConfigDir();
+  return path3.join(configDir, `${serverUrlHash}_${filename}`);
+}
+async function deleteConfigFile(serverUrlHash, filename) {
+  try {
+    const filePath = getConfigFilePath(serverUrlHash, filename);
+    await fs2.unlink(filePath);
+  } catch (error) {
+    if (error.code !== "ENOENT") {
+      logger.error(`Error deleting ${filename}`, "AUTH", error);
+    }
+  }
+}
+async function readJsonFile(serverUrlHash, filename) {
+  try {
+    await ensureConfigDir();
+    const filePath = getConfigFilePath(serverUrlHash, filename);
+    const content = await fs2.readFile(filePath, "utf-8");
+    return JSON.parse(content);
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return void 0;
+    }
+    logger.error(`Error reading ${filename}`, "AUTH", error);
+    return void 0;
+  }
+}
+async function writeJsonFile(serverUrlHash, filename, data) {
+  try {
+    await ensureConfigDir();
+    const filePath = getConfigFilePath(serverUrlHash, filename);
+    await fs2.writeFile(filePath, JSON.stringify(data, null, 2), "utf-8");
+    await fs2.chmod(filePath, 384);
+  } catch (error) {
+    logger.error(`Error writing ${filename}`, "AUTH", error);
+    throw error;
+  }
+}
+async function readTextFile(serverUrlHash, filename, errorMessage) {
+  try {
+    await ensureConfigDir();
+    const filePath = getConfigFilePath(serverUrlHash, filename);
+    return await fs2.readFile(filePath, "utf-8");
+  } catch (error) {
+    throw new Error(errorMessage || `Error reading ${filename}`);
+  }
+}
+async function writeTextFile(serverUrlHash, filename, text) {
+  try {
+    await ensureConfigDir();
+    const filePath = getConfigFilePath(serverUrlHash, filename);
+    await fs2.writeFile(filePath, text, "utf-8");
+    await fs2.chmod(filePath, 384);
+  } catch (error) {
+    logger.error(`Error writing ${filename}`, "AUTH", error);
+    throw error;
+  }
+}
+function generateServerUrlHash(serverUrl) {
+  return crypto.createHash("md5").update(serverUrl).digest("hex");
+}
+async function readTokens(serverUrlHash) {
+  try {
+    const tokens = await readJsonFile(serverUrlHash, "tokens.json");
+    if (tokens) {
+      logger.debug(`Loaded tokens for server hash: ${serverUrlHash}`, "AUTH");
+      return tokens;
+    }
+    return null;
+  } catch (error) {
+    logger.error(`Error reading tokens for ${serverUrlHash}`, "AUTH", error);
+    return null;
+  }
+}
+async function writeTokens(serverUrlHash, tokens) {
+  try {
+    const tokensWithTimestamp = {
+      ...tokens,
+      obtained_at: Date.now()
+    };
+    await writeJsonFile(serverUrlHash, "tokens.json", tokensWithTimestamp);
+    logger.info(`Stored tokens for server hash: ${serverUrlHash}`, "AUTH");
+  } catch (error) {
+    logger.error(`Error writing tokens for ${serverUrlHash}`, "AUTH", error);
+    throw error;
+  }
+}
+async function deleteTokens(serverUrlHash) {
+  try {
+    await deleteConfigFile(serverUrlHash, "tokens.json");
+    logger.info(`Deleted tokens for server hash: ${serverUrlHash}`, "AUTH");
+  } catch (error) {
+    logger.error(`Error deleting tokens for ${serverUrlHash}`, "AUTH", error);
+  }
+}
+async function readClientInfo(serverUrlHash) {
+  try {
+    const clientInfo = await readJsonFile(serverUrlHash, "client_info.json");
+    if (clientInfo) {
+      logger.debug(`Loaded client info for server hash: ${serverUrlHash}`, "AUTH");
+      return clientInfo;
+    }
+    return null;
+  } catch (error) {
+    logger.error(`Error reading client info for ${serverUrlHash}`, "AUTH", error);
+    return null;
+  }
+}
+async function writeClientInfo(serverUrlHash, clientInfo) {
+  try {
+    await writeJsonFile(serverUrlHash, "client_info.json", clientInfo);
+    logger.info(`Stored client info for server hash: ${serverUrlHash}`, "AUTH");
+  } catch (error) {
+    logger.error(`Error writing client info for ${serverUrlHash}`, "AUTH", error);
+    throw error;
+  }
+}
+function isTokenValid(tokens) {
+  if (!tokens || !tokens.access_token) {
+    return { isValid: false, error: "No access token" };
+  }
+  if (!tokens.expires_in || !tokens.obtained_at) {
+    return { isValid: true };
+  }
+  const now = Date.now();
+  const expiresAt = tokens.obtained_at + tokens.expires_in * 1e3;
+  const expiresIn = Math.floor((expiresAt - now) / 1e3);
+  const isValid = expiresIn > 60;
+  return {
+    isValid,
+    expiresIn: Math.max(0, expiresIn),
+    error: isValid ? void 0 : "Token expired"
+  };
+}
+async function getValidTokens(serverUrlHash) {
+  const tokens = await readTokens(serverUrlHash);
+  if (!tokens) {
+    return null;
+  }
+  const validation = isTokenValid(tokens);
+  if (!validation.isValid) {
+    logger.warn(`Tokens for ${serverUrlHash} are invalid: ${validation.error}`, "AUTH");
+    return null;
+  }
+  return tokens;
+}
+async function cleanupExpiredTokens() {
+  try {
+    const configDir = getConfigDir();
+    if (!fsSync.existsSync(configDir)) {
+      return;
+    }
+    const files = await fs2.readdir(configDir);
+    const tokenFiles = files.filter((file) => file.endsWith("_tokens.json"));
+    let cleaned = 0;
+    for (const file of tokenFiles) {
+      const serverHash = file.replace("_tokens.json", "");
+      const tokens = await readTokens(serverHash);
+      if (tokens && !isTokenValid(tokens).isValid) {
+        await deleteTokens(serverHash);
+        cleaned++;
+      }
+    }
+    if (cleaned > 0) {
+      logger.info(`Cleaned up ${cleaned} expired token files`, "AUTH");
+    }
+  } catch (error) {
+    logger.error("Error during token cleanup", "AUTH", error);
+  }
+}
+
+// src/lib/mcp-oauth-provider.ts
+import open from "open";
+import { EventEmitter } from "node:events";
+
+// src/lib/mcp-oauth-utils.ts
+import crypto2 from "crypto";
+function generatePKCE() {
+  const codeVerifier = crypto2.randomBytes(64).toString("base64url").substring(0, 128);
+  const codeChallenge = crypto2.createHash("sha256").update(codeVerifier).digest("base64url");
+  return {
+    codeVerifier,
+    codeChallenge,
+    codeChallengeMethod: "S256"
+  };
+}
+function generateCanonicalResourceURI(serverUrl) {
+  try {
+    const url = new URL(serverUrl);
+    url.protocol = url.protocol.toLowerCase();
+    url.hostname = url.hostname.toLowerCase();
+    url.hash = "";
+    if (url.pathname.endsWith("/") && url.pathname !== "/") {
+      url.pathname = url.pathname.slice(0, -1);
+    }
+    return url.toString();
+  } catch (error) {
+    throw new OAuthError(
+      `Invalid server URL for resource indicator: ${serverUrl}`,
+      "INVALID_RESOURCE_URI"
+    );
+  }
+}
+async function discoverAuthorizationServerMetadata(authorizationServerUrl) {
+  try {
+    const metadataUrl = new URL("/.well-known/oauth-authorization-server", authorizationServerUrl);
+    logger.oauth(`Discovering authorization server metadata: ${metadataUrl}`);
+    const response = await fetch(metadataUrl.toString());
+    if (!response.ok) {
+      throw new OAuthError(
+        `Failed to fetch authorization server metadata: ${response.status}`,
+        "METADATA_DISCOVERY_FAILED"
       );
     }
-  } else {
-    const requiredEnvVars = ["WP_API_URL", "WP_API_USERNAME", "WP_API_PASSWORD"];
-    const missingVars = requiredEnvVars.filter((varName) => !process.env[varName]);
-    if (missingVars.length > 0) {
-      throw new Error(
-        `Missing required environment variables: ${missingVars.join(
-          ", "
-        )}. Please set JWT_TOKEN or provide ${missingVars.join(", ")}.`
+    const metadata = await response.json();
+    if (!metadata.authorization_endpoint || !metadata.token_endpoint) {
+      throw new OAuthError(
+        "Authorization server metadata missing required endpoints",
+        "INVALID_METADATA"
+      );
+    }
+    logger.oauth("Authorization server metadata discovered successfully");
+    return metadata;
+  } catch (error) {
+    if (error instanceof OAuthError) {
+      throw error;
+    }
+    throw new OAuthError(
+      `Error discovering authorization server metadata: ${error instanceof Error ? error.message : String(error)}`,
+      "METADATA_DISCOVERY_ERROR"
+    );
+  }
+}
+async function discoverProtectedResourceMetadata(resourceUrl) {
+  try {
+    const url = new URL(resourceUrl);
+    const metadataUrl = new URL("/.well-known/oauth-protected-resource", url.origin);
+    logger.oauth(`Discovering protected resource metadata: ${metadataUrl}`);
+    const response = await fetch(metadataUrl.toString());
+    if (!response.ok) {
+      throw new OAuthError(
+        `Failed to fetch protected resource metadata: ${response.status}`,
+        "RESOURCE_METADATA_DISCOVERY_FAILED"
+      );
+    }
+    const metadata = await response.json();
+    if (!metadata.authorization_servers || metadata.authorization_servers.length === 0) {
+      throw new OAuthError(
+        "Protected resource metadata missing authorization servers",
+        "INVALID_RESOURCE_METADATA"
       );
     }
+    logger.oauth("Protected resource metadata discovered successfully");
+    return metadata;
+  } catch (error) {
+    if (error instanceof OAuthError) {
+      throw error;
+    }
+    throw new OAuthError(
+      `Error discovering protected resource metadata: ${error instanceof Error ? error.message : String(error)}`,
+      "RESOURCE_METADATA_DISCOVERY_ERROR"
+    );
+  }
+}
+function parseWWWAuthenticateHeader(headerValue) {
+  const parts = headerValue.split(/\s+/);
+  const scheme = parts[0];
+  const result = { scheme };
+  const paramString = parts.slice(1).join(" ");
+  const paramMatches = paramString.matchAll(/(\w+)="([^"]+)"/g);
+  for (const match of paramMatches) {
+    const [, key, value] = match;
+    switch (key) {
+      case "realm":
+        result.realm = value;
+        break;
+      case "scope":
+        result.scope = value;
+        break;
+      case "error":
+        result.error = value;
+        break;
+      case "error_description":
+        result.error_description = value;
+        break;
+      case "error_uri":
+        result.error_uri = value;
+        break;
+      case "resource_metadata_url":
+        result.resource_metadata_url = value;
+        break;
+    }
+  }
+  return result;
+}
+async function registerDynamicClient(registrationEndpoint, registrationRequest) {
+  try {
+    logger.oauth(`Attempting dynamic client registration: ${registrationEndpoint}`);
+    const response = await fetch(registrationEndpoint, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify(registrationRequest)
+    });
+    if (!response.ok) {
+      const errorText = await response.text();
+      throw new OAuthError(
+        `Dynamic client registration failed: ${response.status} - ${errorText}`,
+        "CLIENT_REGISTRATION_FAILED"
+      );
+    }
+    const registrationResponse = await response.json();
+    if (!registrationResponse.client_id) {
+      throw new OAuthError(
+        "Dynamic client registration response missing client_id",
+        "INVALID_REGISTRATION_RESPONSE"
+      );
+    }
+    logger.oauth("Dynamic client registration successful");
+    logger.debug("Client ID obtained", "OAUTH", {
+      client_id: registrationResponse.client_id,
+      expires_at: registrationResponse.client_secret_expires_at
+    });
+    return registrationResponse;
+  } catch (error) {
+    if (error instanceof OAuthError) {
+      throw error;
+    }
+    throw new OAuthError(
+      `Error during dynamic client registration: ${error instanceof Error ? error.message : String(error)}`,
+      "CLIENT_REGISTRATION_ERROR"
+    );
+  }
+}
+async function exchangeAuthorizationCode(tokenEndpoint, code, redirectUri, clientId, codeVerifier, resource) {
+  try {
+    logger.oauth("Exchanging authorization code for access token");
+    const params = new URLSearchParams({
+      grant_type: "authorization_code",
+      code,
+      redirect_uri: redirectUri,
+      client_id: clientId,
+      code_verifier: codeVerifier
+    });
+    if (resource) {
+      params.set("resource", resource);
+    }
+    const response = await fetch(tokenEndpoint, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded"
+      },
+      body: params.toString()
+    });
+    if (!response.ok) {
+      const errorText = await response.text();
+      throw new OAuthError(
+        `Token exchange failed: ${response.status} - ${errorText}`,
+        "TOKEN_EXCHANGE_FAILED"
+      );
+    }
+    const tokenResponse = await response.json();
+    if (!tokenResponse.access_token) {
+      throw new OAuthError("Token response missing access_token", "INVALID_TOKEN_RESPONSE");
+    }
+    logger.oauth("Authorization code exchange successful");
+    return {
+      access_token: tokenResponse.access_token,
+      token_type: tokenResponse.token_type || "Bearer",
+      expires_in: tokenResponse.expires_in,
+      scope: tokenResponse.scope,
+      refresh_token: tokenResponse.refresh_token,
+      obtained_at: Date.now()
+    };
+  } catch (error) {
+    if (error instanceof OAuthError) {
+      throw error;
+    }
+    throw new OAuthError(
+      `Error exchanging authorization code: ${error instanceof Error ? error.message : String(error)}`,
+      "TOKEN_EXCHANGE_ERROR"
+    );
+  }
+}
+function buildAuthorizationUrl(authorizationEndpoint, clientId, redirectUri, scopes, state, codeChallenge, resource) {
+  const params = new URLSearchParams({
+    response_type: "code",
+    // OAuth 2.1 uses authorization code flow
+    client_id: clientId,
+    redirect_uri: redirectUri,
+    scope: scopes.join(" "),
+    state,
+    code_challenge: codeChallenge,
+    code_challenge_method: "S256"
+  });
+  if (resource) {
+    params.set("resource", resource);
+  }
+  return `${authorizationEndpoint}?${params.toString()}`;
+}
+function generateSecureState() {
+  return crypto2.randomBytes(32).toString("base64url");
+}
+
+// src/lib/oauth-callback-server.ts
+import express from "express";
+var AUTHORIZATION_CODE_HTML = `
+<!DOCTYPE html>
+<html>
+<head>
+    <title>WordPress MCP OAuth Authorization</title>
+    <style>
+        body {
+            font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
+            margin: 0;
+            padding: 40px;
+            background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
+            min-height: 100vh;
+            display: flex;
+            align-items: center;
+            justify-content: center;
+        }
+        .container {
+            background: white;
+            padding: 40px;
+            border-radius: 12px;
+            box-shadow: 0 20px 40px rgba(0,0,0,0.1);
+            text-align: center;
+            max-width: 500px;
+            width: 100%;
+        }
+        h1 {
+            color: #333;
+            margin-bottom: 20px;
+        }
+        .success { 
+            color: #27ae60; 
+            font-size: 18px;
+            margin: 20px 0;
+        }
+        .error { 
+            color: #e74c3c; 
+            font-size: 18px;
+            margin: 20px 0;
+        }
+        .loading { 
+            color: #3498db; 
+            font-size: 18px;
+            margin: 20px 0;
+        }
+        .details {
+            color: #666;
+            margin-top: 10px;
+            font-size: 14px;
+        }
+        .spinner {
+            border: 3px solid #f3f3f3;
+            border-top: 3px solid #3498db;
+            border-radius: 50%;
+            width: 30px;
+            height: 30px;
+            animation: spin 1s linear infinite;
+            margin: 20px auto;
+        }
+        @keyframes spin {
+            0% { transform: rotate(0deg); }
+            100% { transform: rotate(360deg); }
+        }
+    </style>
+</head>
+<body>
+    <div class="container">
+        <h1>WordPress MCP OAuth Authorization</h1>
+        <div class="spinner" id="spinner"></div>
+        <div id="status" class="loading">Processing authorization code...</div>
+        <div id="details" class="details"></div>
+    </div>
+
+    <script>
+        function displayStatus(message, type = 'loading') {
+            const statusEl = document.getElementById('status');
+            const spinnerEl = document.getElementById('spinner');
+            
+            statusEl.textContent = message;
+            statusEl.className = type;
+            
+            if (type !== 'loading') {
+                spinnerEl.style.display = 'none';
+            }
+        }
+
+        function displayDetails(message) {
+            document.getElementById('details').textContent = message;
+        }
+
+        // Extract authorization code and state from URL query parameters (OAuth 2.1)
+        const urlParams = new URLSearchParams(window.location.search);
+
+        if (urlParams.has('code')) {
+            const authData = {
+                code: urlParams.get('code'),
+                state: urlParams.get('state'),
+                // Additional parameters for validation
+                iss: urlParams.get('iss'),
+            };
+
+            // Send authorization code to server for token exchange
+            fetch('/oauth/callback', {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json'
+                },
+                body: JSON.stringify(authData)
+            })
+            .then(response => {
+                if (response.ok) {
+                    displayStatus('\u2705 Authorization successful!', 'success');
+                    displayDetails('OAuth 2.1 authentication completed. You can now close this window.');
+                    // Auto-close after 3 seconds
+                    setTimeout(() => {
+                        displayDetails('Closing window...');
+                        setTimeout(() => window.close(), 1000);
+                    }, 3000);
+                } else {
+                    return response.json().then(err => {
+                        throw new Error(err.error || 'Failed to exchange authorization code');
+                    });
+                }
+            })
+            .catch(error => {
+                displayStatus('\u274C Error completing authorization', 'error');
+                displayDetails(error.message + '. Please try again.');
+            });
+        } else if (urlParams.has('error')) {
+            const error = urlParams.get('error');
+            const errorDescription = urlParams.get('error_description');
+            displayStatus('\u274C Authorization failed', 'error');
+            displayDetails(\`Error: \${error}\${errorDescription ? ' - ' + errorDescription : ''}\`);
+        } else {
+            displayStatus('\u274C No authorization code received', 'error');
+            displayDetails('Please try the authorization process again.');
+        }
+    </script>
+</body>
+</html>
+`;
+var OAuthCallbackServer = class {
+  constructor(options, events) {
+    this.server = null;
+    this.options = options;
+    this.events = events;
+    this.app = express();
+    this.setupRoutes();
+  }
+  setupRoutes() {
+    this.app.use(express.json());
+    this.app.get("/oauth/callback", (req, res) => {
+      logger.oauth("OAuth 2.1 authorization callback page requested");
+      res.send(AUTHORIZATION_CODE_HTML);
+    });
+    this.app.post("/oauth/callback", async (req, res) => {
+      try {
+        const { code, state, iss } = req.body;
+        if (!code) {
+          throw new OAuthError("No authorization code received");
+        }
+        logger.oauth("OAuth 2.1 authorization code received");
+        logger.debug("Authorization code details", "OAUTH", {
+          codeLength: code.length,
+          state: state || "none",
+          issuer: iss || "none"
+        });
+        this.events.emit("oauth-code-received", { code, state, iss });
+        res.json({ success: true, message: "Authorization code received successfully" });
+      } catch (error) {
+        logger.error("Error processing authorization code", "OAUTH", error);
+        const errorMessage = error instanceof Error ? error.message : "Unknown error";
+        this.events.emit("oauth-error", new OAuthError(errorMessage));
+        res.status(400).json({ error: errorMessage });
+      }
+    });
+    this.app.post("/oauth/tokens", async (req, res) => {
+      try {
+        const tokens = req.body;
+        if (!tokens.access_token) {
+          throw new OAuthError("No access token received");
+        }
+        logger.oauth("Legacy OAuth tokens received (implicit flow)");
+        logger.debug("Token details", "OAUTH", {
+          tokenType: tokens.token_type,
+          expiresIn: tokens.expires_in,
+          scope: tokens.scope,
+          tokenLength: tokens.access_token.length
+        });
+        await writeTokens(this.options.serverUrlHash, tokens);
+        this.events.emit("oauth-success", tokens);
+        res.json({ success: true, message: "Tokens saved successfully" });
+      } catch (error) {
+        logger.error("Error processing OAuth tokens", "OAUTH", error);
+        const errorMessage = error instanceof Error ? error.message : "Unknown error";
+        this.events.emit("oauth-error", new OAuthError(errorMessage));
+        res.status(400).json({ error: errorMessage });
+      }
+    });
+    this.app.get("/oauth/health", (req, res) => {
+      res.json({
+        status: "ok",
+        serverHash: this.options.serverUrlHash,
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      });
+    });
+    this.app.use(
+      (error, req, res, next) => {
+        logger.error("Express server error", "OAUTH", error);
+        res.status(500).json({ error: "Internal server error" });
+      }
+    );
+  }
+  async start() {
+    return new Promise((resolve, reject) => {
+      try {
+        this.server = this.app.listen(this.options.port, this.options.host, () => {
+          logger.oauth(
+            `OAuth callback server listening on http://${this.options.host}:${this.options.port}`
+          );
+          resolve();
+        });
+        this.server.on("error", (error) => {
+          logger.error("OAuth callback server error", "OAUTH", error);
+          reject(error);
+        });
+        if (this.options.timeout) {
+          setTimeout(() => {
+            if (!this.server?.listening) {
+              reject(new OAuthError("OAuth callback server startup timeout", "TIMEOUT"));
+            }
+          }, this.options.timeout);
+        }
+      } catch (error) {
+        reject(error);
+      }
+    });
+  }
+  async stop() {
+    return new Promise((resolve) => {
+      if (this.server) {
+        this.server.close(() => {
+          logger.oauth("OAuth callback server stopped");
+          this.server = null;
+          resolve();
+        });
+      } else {
+        resolve();
+      }
+    });
+  }
+  getCallbackUrl() {
+    return `http://${this.options.host}:${this.options.port}/oauth/callback`;
+  }
+  isRunning() {
+    return this.server?.listening ?? false;
+  }
+};
+function setupWPOAuthCallbackServer(options, events) {
+  return new OAuthCallbackServer(options, events);
+}
+
+// src/lib/mcp-oauth-provider.ts
+var MCPOAuthProvider = class {
+  constructor(options) {
+    this.authPromise = null;
+    // OAuth 2.1 flow state
+    this.currentState = null;
+    this.currentPKCE = null;
+    // Discovered metadata
+    this.authServerMetadata = null;
+    this.resourceMetadata = null;
+    this.config = {
+      serverUrl: options.serverUrl || CONFIG.WP_API_URL,
+      resource: generateCanonicalResourceURI(options.serverUrl || CONFIG.WP_API_URL),
+      responseType: "code",
+      // OAuth 2.1 uses authorization code flow
+      usePKCE: true,
+      // PKCE is required for OAuth 2.1
+      redirectUri: `http://${CONFIG.OAUTH_HOST}:${CONFIG.OAUTH_CALLBACK_PORT}/oauth/callback`,
+      scopes: options.scopes || ["read", "write"],
+      clientId: options.clientId || CONFIG.WP_OAUTH_CLIENT_ID,
+      callbackPort: CONFIG.OAUTH_CALLBACK_PORT,
+      host: CONFIG.OAUTH_HOST,
+      timeout: CONFIG.OAUTH_TIMEOUT,
+      ...options
+    };
+    this.serverUrlHash = generateServerUrlHash(this.config.serverUrl);
+    this.events = new EventEmitter();
+    this.events.setMaxListeners(10);
+    logger.oauth("Initialized MCP-compliant OAuth 2.1 provider");
+    logger.debug("OAuth configuration", "OAUTH", {
+      serverUrl: this.config.serverUrl,
+      resource: this.config.resource,
+      serverHash: this.serverUrlHash,
+      flowType: this.config.responseType,
+      usePKCE: this.config.usePKCE,
+      callbackPort: this.config.callbackPort
+    });
+  }
+  /**
+   * Get current tokens if available and valid from persistent storage
+   */
+  async tokens() {
+    try {
+      const tokens = await readTokens(this.serverUrlHash);
+      if (tokens) {
+        const validation = isTokenValid(tokens);
+        if (validation.isValid) {
+          logger.oauth("Found valid tokens in persistent storage");
+          if (validation.expiresIn) {
+            logger.debug(`Tokens expire in ${validation.expiresIn} seconds`, "OAUTH");
+          }
+          return tokens;
+        } else {
+          logger.warn(`Tokens in persistent storage are invalid: ${validation.error}`, "OAUTH");
+          return null;
+        }
+      }
+      logger.debug("No tokens found in persistent storage", "OAUTH");
+      return null;
+    } catch (error) {
+      logger.error("Error retrieving tokens from persistent storage", "OAUTH", error);
+      return null;
+    }
+  }
+  /**
+   * Discover OAuth 2.1 server endpoints using MCP-compliant discovery
+   */
+  async discoverOAuthEndpoints() {
+    try {
+      logger.oauth("Starting MCP-compliant OAuth endpoint discovery");
+      try {
+        this.resourceMetadata = await discoverProtectedResourceMetadata(this.config.resource);
+        logger.oauth("Protected resource metadata discovered");
+      } catch (error) {
+        logger.warn(
+          "Protected resource metadata discovery failed, trying 401 response method",
+          "OAUTH"
+        );
+        await this.discoverVia401Response();
+      }
+      const authServerUrl = this.getAuthorizationServerUrl();
+      if (authServerUrl) {
+        this.authServerMetadata = await discoverAuthorizationServerMetadata(authServerUrl);
+        logger.oauth("Authorization server metadata discovered");
+        this.config.authorizationEndpoint = this.authServerMetadata.authorization_endpoint;
+        this.config.tokenEndpoint = this.authServerMetadata.token_endpoint;
+        this.config.registrationEndpoint = this.authServerMetadata.registration_endpoint;
+      } else {
+        throw new OAuthError("Could not determine authorization server URL", "DISCOVERY_FAILED");
+      }
+    } catch (error) {
+      logger.error("OAuth endpoint discovery failed", "OAUTH", error);
+      throw error;
+    }
+  }
+  /**
+   * Discover endpoints via 401 Unauthorized response (RFC 9728 Section 5.1)
+   */
+  async discoverVia401Response() {
+    try {
+      logger.oauth("Attempting discovery via 401 response method");
+      const response = await fetch(this.config.serverUrl, {
+        headers: {
+          Accept: "application/json"
+        }
+      });
+      if (response.status === 401) {
+        const wwwAuthHeader = response.headers.get("WWW-Authenticate");
+        if (wwwAuthHeader) {
+          const authInfo = parseWWWAuthenticateHeader(wwwAuthHeader);
+          logger.oauth("WWW-Authenticate header parsed successfully");
+          if (authInfo.resource_metadata_url) {
+            const metadataResponse = await fetch(authInfo.resource_metadata_url);
+            if (metadataResponse.ok) {
+              this.resourceMetadata = await metadataResponse.json();
+              logger.oauth("Protected resource metadata obtained via 401 response");
+            }
+          }
+        }
+      }
+    } catch (error) {
+      logger.warn("401 response discovery method failed", "OAUTH", error);
+    }
+  }
+  /**
+   * Get authorization server URL from discovered metadata
+   */
+  getAuthorizationServerUrl() {
+    if (this.resourceMetadata?.authorization_servers?.length) {
+      return this.resourceMetadata.authorization_servers[0];
+    }
+    try {
+      const url = new URL(this.config.serverUrl);
+      return url.origin;
+    } catch {
+      return null;
+    }
+  }
+  /**
+   * Perform dynamic client registration if needed and supported
+   */
+  async ensureClientRegistration() {
+    if (this.config.clientId) {
+      logger.oauth("Using provided client ID, skipping dynamic registration");
+      return;
+    }
+    if (!CONFIG.OAUTH_DYNAMIC_REGISTRATION) {
+      throw new OAuthError(
+        "No client ID provided and dynamic registration is disabled",
+        "NO_CLIENT_ID"
+      );
+    }
+    if (!this.authServerMetadata?.registration_endpoint) {
+      throw new OAuthError(
+        "Dynamic client registration not supported by authorization server",
+        "NO_DYNAMIC_REGISTRATION"
+      );
+    }
+    try {
+      logger.oauth("Performing dynamic client registration");
+      const registrationRequest = {
+        redirect_uris: [this.config.redirectUri],
+        token_endpoint_auth_method: "none",
+        // Public client
+        grant_types: ["authorization_code"],
+        response_types: ["code"],
+        client_name: "WordPress MCP Remote",
+        scope: this.config.scopes.join(" ")
+      };
+      const registrationResponse = await registerDynamicClient(
+        this.authServerMetadata.registration_endpoint,
+        registrationRequest
+      );
+      const clientInfo = {
+        client_id: registrationResponse.client_id,
+        client_secret: registrationResponse.client_secret
+      };
+      await writeClientInfo(this.serverUrlHash, clientInfo);
+      this.config.clientId = registrationResponse.client_id;
+      logger.oauth("Dynamic client registration completed successfully");
+    } catch (error) {
+      logger.error("Dynamic client registration failed", "OAUTH", error);
+      throw error;
+    }
+  }
+  /**
+   * Initiate MCP-compliant OAuth 2.1 authorization flow
+   */
+  async authorize() {
+    if (this.authPromise) {
+      logger.oauth("Authorization already in progress, waiting...");
+      await this.authPromise;
+      return;
+    }
+    const existingTokens = await this.tokens();
+    if (existingTokens) {
+      logger.oauth("Already have valid tokens, skipping authorization");
+      return;
+    }
+    logger.oauth("Starting MCP-compliant OAuth 2.1 authorization flow");
+    this.authPromise = this.performAuthorization();
+    try {
+      await this.authPromise;
+      logger.oauth("OAuth 2.1 authorization completed successfully");
+    } catch (error) {
+      logger.error("OAuth 2.1 authorization failed", "OAUTH", error);
+      throw error;
+    } finally {
+      this.authPromise = null;
+    }
+  }
+  /**
+   * Perform the complete OAuth 2.1 authorization flow
+   */
+  async performAuthorization() {
+    try {
+      await this.discoverOAuthEndpoints();
+      await this.ensureClientRegistration();
+      this.currentPKCE = generatePKCE();
+      this.currentState = generateSecureState();
+      await writeTextFile(this.serverUrlHash, "pkce_verifier.txt", this.currentPKCE.codeVerifier);
+      await writeTextFile(this.serverUrlHash, "oauth_state.txt", this.currentState);
+      const callbackServer = setupWPOAuthCallbackServer(
+        {
+          port: this.config.callbackPort,
+          host: this.config.host,
+          serverUrlHash: this.serverUrlHash,
+          timeout: this.config.timeout
+        },
+        this.events
+      );
+      await callbackServer.start();
+      logger.oauth("OAuth callback server started");
+      const authUrl = buildAuthorizationUrl(
+        this.config.authorizationEndpoint,
+        this.config.clientId,
+        this.config.redirectUri,
+        this.config.scopes,
+        this.currentState,
+        this.currentPKCE.codeChallenge,
+        CONFIG.OAUTH_RESOURCE_INDICATOR ? this.config.resource : void 0
+      );
+      logger.oauth("Built OAuth 2.1 authorization URL");
+      logger.debug("Authorization URL", "OAUTH", { url: authUrl });
+      try {
+        await open(authUrl);
+        logger.oauth("Browser opened successfully");
+      } catch (browserError) {
+        logger.error("Failed to open browser automatically", "OAUTH", browserError);
+        logger.info("\n=== MANUAL ACTION REQUIRED ===");
+        logger.info("Please manually open the following URL in your browser:");
+        logger.info(`${authUrl}`);
+        logger.info("===============================\n");
+      }
+      const authCode = await this.waitForAuthorizationCode();
+      const tokens = await this.exchangeCodeForTokens(authCode);
+      await writeTokens(this.serverUrlHash, tokens);
+      logger.oauth("OAuth 2.1 tokens stored successfully");
+      await callbackServer.stop();
+      return tokens;
+    } catch (error) {
+      logger.error("Error during OAuth 2.1 authorization flow", "OAUTH", error);
+      throw error;
+    }
+  }
+  /**
+   * Wait for authorization code from callback
+   */
+  async waitForAuthorizationCode() {
+    return new Promise((resolve, reject) => {
+      const timeout = setTimeout(() => {
+        cleanup();
+        reject(new OAuthError("Authorization timeout", "TIMEOUT"));
+      }, this.config.timeout);
+      const cleanup = () => {
+        this.events.removeAllListeners("oauth-code-received");
+        this.events.removeAllListeners("oauth-error");
+        clearTimeout(timeout);
+      };
+      this.events.once("oauth-code-received", async ({ code, state }) => {
+        cleanup();
+        if (state !== this.currentState) {
+          reject(new OAuthError("State parameter mismatch", "INVALID_STATE"));
+          return;
+        }
+        logger.oauth("Valid authorization code received");
+        resolve(code);
+      });
+      this.events.once("oauth-error", (error) => {
+        cleanup();
+        reject(error);
+      });
+    });
+  }
+  /**
+   * Exchange authorization code for access tokens
+   */
+  async exchangeCodeForTokens(code) {
+    try {
+      const codeVerifier = await readTextFile(
+        this.serverUrlHash,
+        "pkce_verifier.txt",
+        "PKCE code verifier not found"
+      );
+      const tokenResponse = await exchangeAuthorizationCode(
+        this.config.tokenEndpoint,
+        code,
+        this.config.redirectUri,
+        this.config.clientId,
+        codeVerifier,
+        CONFIG.OAUTH_RESOURCE_INDICATOR ? this.config.resource : void 0
+      );
+      await deleteConfigFile(this.serverUrlHash, "pkce_verifier.txt");
+      await deleteConfigFile(this.serverUrlHash, "oauth_state.txt");
+      return tokenResponse;
+    } catch (error) {
+      logger.error("Token exchange failed", "OAUTH", error);
+      throw error;
+    }
+  }
+  /**
+   * Clear stored credentials and state
+   */
+  async invalidateCredentials(scope) {
+    logger.oauth(`Invalidating credentials: ${scope}`);
+    switch (scope) {
+      case "all":
+        await Promise.all([
+          deleteConfigFile(this.serverUrlHash, "client_info.json"),
+          deleteConfigFile(this.serverUrlHash, "tokens.json"),
+          deleteConfigFile(this.serverUrlHash, "pkce_verifier.txt"),
+          deleteConfigFile(this.serverUrlHash, "oauth_state.txt")
+        ]);
+        break;
+      case "client":
+        await deleteConfigFile(this.serverUrlHash, "client_info.json");
+        break;
+      case "tokens":
+        await deleteConfigFile(this.serverUrlHash, "tokens.json");
+        break;
+      case "state":
+        await Promise.all([
+          deleteConfigFile(this.serverUrlHash, "pkce_verifier.txt"),
+          deleteConfigFile(this.serverUrlHash, "oauth_state.txt")
+        ]);
+        break;
+    }
+    logger.oauth(`Credentials invalidated: ${scope}`);
+  }
+  /**
+   * Check if currently authorized
+   */
+  async isAuthorized() {
+    const tokens = await this.tokens();
+    return tokens !== null;
+  }
+  /**
+   * Get server URL hash
+   */
+  getServerUrlHash() {
+    return this.serverUrlHash;
+  }
+  /**
+   * Get OAuth configuration
+   */
+  getConfig() {
+    return { ...this.config };
+  }
+};
+
+// src/lib/coordination.ts
+import * as fs3 from "node:fs";
+import * as path4 from "node:path";
+import * as os2 from "node:os";
+
+// src/lib/persistent-oauth-client-provider.ts
+import open2 from "open";
+import { EventEmitter as EventEmitter2 } from "node:events";
+var WP_PERSISTENT_CONFIG = {
+  authorizeEndpoint: "/wp-admin/admin.php?page=mcp-oauth-authorize",
+  scopes: ["read", "write"],
+  callbackPort: CONFIG.OAUTH_CALLBACK_PORT,
+  host: CONFIG.OAUTH_HOST
+};
+var PersistentWPOAuthClientProvider = class {
+  constructor(options) {
+    this.authPromise = null;
+    this.options = {
+      ...WP_PERSISTENT_CONFIG,
+      ...options
+    };
+    this.serverUrlHash = generateServerUrlHash(this.options.serverUrl);
+    this.events = new EventEmitter2();
+    this.events.setMaxListeners(10);
+    logger.oauth("Initialized Persistent WordPress OAuth provider");
+    logger.debug("OAuth provider options", "OAUTH", {
+      serverUrl: this.options.serverUrl,
+      serverHash: this.serverUrlHash,
+      clientId: this.options.clientId || "auto-generated",
+      callbackPort: this.options.callbackPort
+    });
+  }
+  /**
+   * Get current tokens if available and valid from persistent storage
+   */
+  async tokens() {
+    try {
+      const tokens = await readTokens(this.serverUrlHash);
+      if (tokens) {
+        const validation = isTokenValid(tokens);
+        if (validation.isValid) {
+          logger.oauth("Found valid tokens in persistent storage");
+          if (validation.expiresIn) {
+            logger.debug(`Tokens expire in ${validation.expiresIn} seconds`, "OAUTH");
+          }
+          return tokens;
+        } else {
+          logger.warn(`Tokens in persistent storage are invalid: ${validation.error}`, "OAUTH");
+          return null;
+        }
+      }
+      logger.debug("No tokens found in persistent storage", "OAUTH");
+      return null;
+    } catch (error) {
+      logger.error("Error retrieving tokens from persistent storage", "OAUTH", error);
+      return null;
+    }
+  }
+  /**
+   * Save tokens to persistent storage
+   */
+  async saveTokens(tokens) {
+    try {
+      await writeTokens(this.serverUrlHash, tokens);
+      logger.oauth("Tokens saved to persistent storage");
+    } catch (error) {
+      logger.error("Error saving tokens to persistent storage", "OAUTH", error);
+      throw error;
+    }
+  }
+  /**
+   * Get client information from persistent storage
+   */
+  async clientInformation() {
+    try {
+      const clientInfo = await readClientInfo(this.serverUrlHash);
+      if (clientInfo) {
+        logger.debug("Found client information in persistent storage", "OAUTH");
+        return clientInfo;
+      }
+      logger.debug("No client information found in persistent storage", "OAUTH");
+      return null;
+    } catch (error) {
+      logger.error("Error retrieving client information", "OAUTH", error);
+      return null;
+    }
+  }
+  /**
+   * Save client information to persistent storage
+   */
+  async saveClientInformation(clientInfo) {
+    try {
+      await writeClientInfo(this.serverUrlHash, clientInfo);
+      logger.oauth("Client information saved to persistent storage");
+    } catch (error) {
+      logger.error("Error saving client information", "OAUTH", error);
+      throw error;
+    }
+  }
+  /**
+   * Save PKCE code verifier
+   */
+  async saveCodeVerifier(codeVerifier) {
+    try {
+      await writeTextFile(this.serverUrlHash, "code_verifier.txt", codeVerifier);
+      logger.debug("Code verifier saved", "OAUTH");
+    } catch (error) {
+      logger.error("Error saving code verifier", "OAUTH", error);
+      throw error;
+    }
+  }
+  /**
+   * Get PKCE code verifier
+   */
+  async codeVerifier() {
+    try {
+      const verifier = await readTextFile(
+        this.serverUrlHash,
+        "code_verifier.txt",
+        "No code verifier saved for session"
+      );
+      logger.debug("Code verifier retrieved", "OAUTH");
+      return verifier;
+    } catch (error) {
+      logger.error("Error retrieving code verifier", "OAUTH", error);
+      throw error;
+    }
+  }
+  /**
+   * Initiate OAuth authorization flow
+   */
+  async authorize() {
+    if (this.authPromise) {
+      logger.oauth("Authorization already in progress, waiting...");
+      await this.authPromise;
+      return;
+    }
+    const existingTokens = await this.tokens();
+    if (existingTokens) {
+      logger.oauth("Already have valid tokens in persistent storage, skipping authorization");
+      return;
+    }
+    logger.oauth("Starting OAuth authorization flow for WordPress (persistent storage)");
+    this.authPromise = this.performAuthorization();
+    try {
+      await this.authPromise;
+      logger.oauth("OAuth authorization completed successfully");
+    } catch (error) {
+      logger.error("OAuth authorization failed", "OAUTH", error);
+      throw error;
+    } finally {
+      this.authPromise = null;
+    }
+  }
+  /**
+   * Perform the actual OAuth authorization
+   */
+  async performAuthorization() {
+    const callbackServerOptions = {
+      port: this.options.callbackPort,
+      host: this.options.host,
+      serverUrlHash: this.serverUrlHash,
+      timeout: CONFIG.OAUTH_TIMEOUT
+    };
+    logger.oauth(`Setting up callback server on ${this.options.host}:${this.options.callbackPort}`);
+    const callbackServer = setupWPOAuthCallbackServer(callbackServerOptions, this.events);
+    try {
+      logger.oauth("Starting callback server...");
+      await callbackServer.start();
+      logger.oauth("Callback server started successfully");
+      const state = this.generateState();
+      logger.debug(`Generated state parameter: ${state}`, "OAUTH");
+      const authUrl = this.buildAuthorizationUrl(callbackServer.getCallbackUrl(), state);
+      logger.oauth(`Built authorization URL: ${authUrl}`);
+      logger.debug(`Callback URL: ${callbackServer.getCallbackUrl()}`, "OAUTH");
+      logger.oauth("Attempting to open browser...");
+      try {
+        await open2(authUrl);
+        logger.oauth("Browser opened successfully");
+      } catch (browserError) {
+        logger.error("Failed to open browser automatically", "OAUTH", browserError);
+        logger.info("\n=== MANUAL ACTION REQUIRED ===");
+        logger.info("Please manually open the following URL in your browser:");
+        logger.info(`${authUrl}`);
+        logger.info("===============================\n");
+      }
+      logger.oauth("Waiting for authorization result...");
+      const tokens = await this.waitForAuthorizationResult();
+      logger.oauth("Authorization result received");
+      logger.oauth("Saving tokens to persistent storage...");
+      await this.saveTokens(tokens);
+      logger.oauth("Tokens saved successfully");
+      return tokens;
+    } catch (error) {
+      logger.error("Error during authorization flow", "OAUTH", error);
+      if (error instanceof Error && error.stack) {
+        logger.debug("Stack trace", "OAUTH", error.stack);
+      }
+      throw error;
+    } finally {
+      logger.oauth("Stopping callback server...");
+      try {
+        await callbackServer.stop();
+        logger.oauth("Callback server stopped");
+      } catch (stopError) {
+        logger.error("Error stopping callback server", "OAUTH", stopError);
+      }
+    }
+  }
+  /**
+   * Build the WordPress authorization URL
+   */
+  buildAuthorizationUrl(callbackUrl, state) {
+    const baseUrl = this.options.serverUrl.replace(/\/+$/, "");
+    const authEndpoint = this.options.authorizeEndpoint || WP_PERSISTENT_CONFIG.authorizeEndpoint;
+    const params = new URLSearchParams({
+      response_type: "token",
+      // Implicit flow
+      redirect_uri: callbackUrl,
+      scope: this.options.scopes?.join(" ") || WP_PERSISTENT_CONFIG.scopes.join(" "),
+      state
+    });
+    if (this.options.clientId) {
+      params.set("client_id", this.options.clientId);
+    }
+    return `${baseUrl}${authEndpoint}?${params.toString()}`;
+  }
+  /**
+   * Generate a secure state parameter
+   */
+  generateState() {
+    return Math.random().toString(36).substring(2, 15) + Math.random().toString(36).substring(2, 15);
+  }
+  /**
+   * Wait for authorization result from callback server
+   */
+  async waitForAuthorizationResult() {
+    return new Promise((resolve, reject) => {
+      const timeout = setTimeout(() => {
+        cleanup();
+        reject(new OAuthError("Authorization timeout", "TIMEOUT"));
+      }, CONFIG.LOCK_TIMEOUT);
+      const cleanup = () => {
+        this.events.removeAllListeners("oauth-success");
+        this.events.removeAllListeners("oauth-error");
+        clearTimeout(timeout);
+      };
+      this.events.once("oauth-success", (tokens) => {
+        cleanup();
+        logger.oauth("OAuth authorization successful for WordPress (persistent storage)");
+        resolve(tokens);
+      });
+      this.events.once("oauth-error", (error) => {
+        cleanup();
+        logger.error("OAuth authorization error", "OAUTH", error.message);
+        reject(error);
+      });
+    });
+  }
+  /**
+   * Clear stored tokens and credentials
+   */
+  async invalidateCredentials(scope) {
+    logger.oauth(`Invalidating credentials: ${scope}`);
+    switch (scope) {
+      case "all":
+        await Promise.all([
+          deleteConfigFile(this.serverUrlHash, "client_info.json"),
+          deleteConfigFile(this.serverUrlHash, "tokens.json"),
+          deleteConfigFile(this.serverUrlHash, "code_verifier.txt")
+        ]);
+        logger.oauth("All credentials invalidated");
+        break;
+      case "client":
+        await deleteConfigFile(this.serverUrlHash, "client_info.json");
+        logger.oauth("Client information invalidated");
+        break;
+      case "tokens":
+        await deleteConfigFile(this.serverUrlHash, "tokens.json");
+        logger.oauth("OAuth tokens invalidated");
+        break;
+      case "verifier":
+        await deleteConfigFile(this.serverUrlHash, "code_verifier.txt");
+        logger.oauth("Code verifier invalidated");
+        break;
+      default:
+        throw new Error(`Unknown credential scope: ${scope}`);
+    }
+  }
+  /**
+   * Get authorization status
+   */
+  async isAuthorized() {
+    const tokens = await this.tokens();
+    return tokens !== null;
+  }
+  /**
+   * Get the server URL hash
+   */
+  getServerUrlHash() {
+    return this.serverUrlHash;
+  }
+  /**
+   * Get OAuth options
+   */
+  getOptions() {
+    return { ...this.options };
+  }
+  /**
+   * Redirect to authorization URL (for browser opening)
+   */
+  async redirectToAuthorization(authorizationUrl) {
+    logger.oauth(`
+Please authorize this client by visiting:
+${authorizationUrl.toString()}
+`);
+    try {
+      await open2(authorizationUrl.toString());
+      logger.oauth("Browser opened automatically.");
+    } catch (error) {
+      logger.warn(
+        "Could not open browser automatically. Please copy and paste the URL above into your browser.",
+        "OAUTH"
+      );
+    }
+  }
+};
+
+// src/lib/coordination.ts
+var LockfileManager = class {
+  constructor(serverUrlHash) {
+    this.isOwner = false;
+    this.checkInterval = null;
+    const authDir = getConfigDir();
+    this.lockfilePath = path4.join(authDir, `${serverUrlHash}_auth.lock`);
+  }
+  /**
+   * Try to acquire the lock
+   */
+  tryAcquire() {
+    try {
+      if (fs3.existsSync(this.lockfilePath)) {
+        const lockData2 = this.readLockfile();
+        if (lockData2 && this.isLockValid(lockData2)) {
+          logger.debug(`Lock is held by PID ${lockData2.pid}`, "COORDINATION");
+          return false;
+        }
+        this.release();
+      }
+      const lockData = {
+        pid: process.pid,
+        port: CONFIG.OAUTH_CALLBACK_PORT,
+        timestamp: Date.now(),
+        hostname: os2.hostname()
+      };
+      fs3.writeFileSync(this.lockfilePath, JSON.stringify(lockData), { mode: 384 });
+      this.isOwner = true;
+      this.startMonitoring();
+      logger.debug(`Acquired auth lock: ${this.lockfilePath}`, "COORDINATION");
+      return true;
+    } catch (error) {
+      logger.error("Error acquiring lock", "COORDINATION", error);
+      return false;
+    }
+  }
+  /**
+   * Release the lock
+   */
+  release() {
+    try {
+      if (this.checkInterval) {
+        clearInterval(this.checkInterval);
+        this.checkInterval = null;
+      }
+      if (this.isOwner && fs3.existsSync(this.lockfilePath)) {
+        fs3.unlinkSync(this.lockfilePath);
+        logger.debug(`Released auth lock: ${this.lockfilePath}`, "COORDINATION");
+      }
+      this.isOwner = false;
+    } catch (error) {
+      logger.error("Error releasing lock", "COORDINATION", error);
+    }
+  }
+  /**
+   * Check if we own the lock
+   */
+  isLockOwner() {
+    return this.isOwner;
+  }
+  /**
+   * Wait for lock to be released
+   */
+  async waitForRelease(timeout = CONFIG.LOCK_TIMEOUT) {
+    const startTime = Date.now();
+    return new Promise((resolve, reject) => {
+      const checkLock = () => {
+        if (!fs3.existsSync(this.lockfilePath)) {
+          logger.debug("Lock file no longer exists", "COORDINATION");
+          resolve();
+          return;
+        }
+        const lockData = this.readLockfile();
+        if (!lockData || !this.isLockValid(lockData)) {
+          logger.debug("Lock is stale, cleaning up", "COORDINATION");
+          this.release();
+          resolve();
+          return;
+        }
+        if (Date.now() - startTime > timeout) {
+          reject(new OAuthError("Timeout waiting for auth lock", "LOCK_TIMEOUT"));
+          return;
+        }
+        setTimeout(checkLock, 1e3);
+      };
+      logger.info("Waiting for other instance to complete authentication...", "COORDINATION");
+      checkLock();
+    });
+  }
+  /**
+   * Read lockfile data
+   */
+  readLockfile() {
+    try {
+      const data = fs3.readFileSync(this.lockfilePath, "utf8");
+      return JSON.parse(data);
+    } catch {
+      return null;
+    }
+  }
+  /**
+   * Check if lock is still valid (process is running)
+   */
+  isLockValid(lockData) {
+    try {
+      process.kill(lockData.pid, 0);
+      const age = Date.now() - lockData.timestamp;
+      const maxAge = 6e5;
+      if (age > maxAge) {
+        logger.debug(
+          `Lock is too old (${Math.round(age / 1e3)}s), considering invalid`,
+          "COORDINATION"
+        );
+        return false;
+      }
+      return true;
+    } catch {
+      logger.debug(`Process ${lockData.pid} is not running`, "COORDINATION");
+      return false;
+    }
+  }
+  /**
+   * Monitor lock validity
+   */
+  startMonitoring() {
+    this.checkInterval = setInterval(() => {
+      if (this.isOwner && !fs3.existsSync(this.lockfilePath)) {
+        logger.warn("Lock file was removed externally", "COORDINATION");
+        this.isOwner = false;
+        if (this.checkInterval) {
+          clearInterval(this.checkInterval);
+          this.checkInterval = null;
+        }
+      }
+    }, 5e3);
+  }
+};
+var WPAuthCoordinator = class {
+  constructor(serverUrlHash, serverUrl, callbackPort, events) {
+    this.oauthProvider = null;
+    this.isStarted = false;
+    this.serverUrlHash = serverUrlHash;
+    this.serverUrl = serverUrl;
+    this.callbackPort = callbackPort;
+    this.events = events;
+    this.lockManager = new LockfileManager(serverUrlHash);
+  }
+  async start() {
+    if (this.isStarted) {
+      return;
+    }
+    logger.debug("Starting WordPress auth coordinator", "COORDINATION");
+    this.isStarted = true;
+    process.on("exit", () => this.cleanup());
+    process.on("SIGINT", () => this.cleanup());
+    process.on("SIGTERM", () => this.cleanup());
+    process.on("uncaughtException", () => this.cleanup());
+    process.on("unhandledRejection", () => this.cleanup());
+  }
+  async stop() {
+    logger.debug("Stopping WordPress auth coordinator", "COORDINATION");
+    this.cleanup();
+    this.isStarted = false;
+  }
+  async waitForAuth() {
+    if (!this.isStarted) {
+      throw new OAuthError("Auth coordinator not started");
+    }
+    const existingTokens = await getValidTokens(this.serverUrlHash);
+    if (existingTokens) {
+      logger.debug("Found existing valid tokens", "COORDINATION");
+      return existingTokens;
+    }
+    if (this.lockManager.tryAcquire()) {
+      return await this.performAuthentication();
+    } else {
+      return await this.waitForOtherInstanceAuth();
+    }
+  }
+  async performAuthentication() {
+    try {
+      logger.info("Performing OAuth authentication as lock owner", "COORDINATION");
+      if (!this.oauthProvider) {
+        this.oauthProvider = new PersistentWPOAuthClientProvider({
+          serverUrl: this.serverUrl,
+          callbackPort: this.callbackPort,
+          host: CONFIG.OAUTH_HOST,
+          clientId: CONFIG.WP_OAUTH_CLIENT_ID
+        });
+      }
+      await this.oauthProvider.authorize();
+      const tokens = await this.oauthProvider.tokens();
+      if (!tokens) {
+        throw new OAuthError("Authentication completed but no tokens available");
+      }
+      logger.info("Authentication successful, tokens obtained", "COORDINATION");
+      return tokens;
+    } finally {
+      this.lockManager.release();
+    }
+  }
+  async waitForOtherInstanceAuth() {
+    logger.info("Waiting for another instance to complete authentication", "COORDINATION");
+    try {
+      await this.lockManager.waitForRelease();
+      const tokens = await getValidTokens(this.serverUrlHash);
+      if (tokens) {
+        logger.info("Tokens are now available from other instance", "COORDINATION");
+        return tokens;
+      }
+      logger.debug(
+        "No tokens found after waiting, trying to authenticate ourselves",
+        "COORDINATION"
+      );
+      return await this.waitForAuth();
+    } catch (error) {
+      logger.error("Error waiting for other instance auth", "COORDINATION", error);
+      throw error;
+    }
+  }
+  cleanup() {
+    this.lockManager.release();
+  }
+};
+var LazyWPAuthCoordinator = class {
+  constructor(serverUrlHash, serverUrl, callbackPort, events) {
+    this.coordinator = null;
+    this.serverUrlHash = serverUrlHash;
+    this.serverUrl = serverUrl;
+    this.callbackPort = callbackPort;
+    this.events = events;
+  }
+  async start() {
+  }
+  async stop() {
+    if (this.coordinator) {
+      await this.coordinator.stop();
+      this.coordinator = null;
+    }
+  }
+  async waitForAuth() {
+    const existingTokens = await getValidTokens(this.serverUrlHash);
+    if (existingTokens) {
+      return existingTokens;
+    }
+    if (!this.coordinator) {
+      this.coordinator = new WPAuthCoordinator(
+        this.serverUrlHash,
+        this.serverUrl,
+        this.callbackPort,
+        this.events
+      );
+      await this.coordinator.start();
+    }
+    return await this.coordinator.waitForAuth();
+  }
+};
+function createLazyWPAuthCoordinator(serverUrlHash, serverUrl, callbackPort, events) {
+  return new LazyWPAuthCoordinator(serverUrlHash, serverUrl, callbackPort, events);
+}
+
+// src/lib/wordpress-api.ts
+var mcpOAuthProvider = null;
+var authCoordinator = null;
+var globalEvents = null;
+function validateEnvironment() {
+  const validation = validateConfig();
+  if (!validation.isValid) {
+    throw new AuthError(
+      `Configuration validation failed: ${validation.errors.join(", ")}`,
+      "CONFIG_VALIDATION"
+    );
   }
 }
 function removeTrailingSlash(url) {
   return url.replace(/\/+$/, "");
 }
+function constructApiUrl(baseUrl, defaultEndpoint) {
+  const cleanUrl = removeTrailingSlash(baseUrl);
+  try {
+    const urlObj = new URL(cleanUrl);
+    const hasCustomPath = urlObj.pathname && urlObj.pathname !== "/" && urlObj.pathname.length > 0;
+    if (hasCustomPath) {
+      return cleanUrl;
+    } else {
+      return new URL(`/?rest_route=${defaultEndpoint}`, cleanUrl).toString();
+    }
+  } catch (error) {
+    return new URL(`/?rest_route=${defaultEndpoint}`, cleanUrl).toString();
+  }
+}
+async function getOAuthTokens() {
+  try {
+    if (!CONFIG.OAUTH_ENABLED) {
+      logger.debug("OAuth is disabled via configuration", "AUTH");
+      return null;
+    }
+    logger.auth("Attempting to get OAuth tokens for WordPress API (MCP-compliant)...");
+    const serverUrl = CONFIG.WP_API_URL;
+    const serverUrlHash = generateServerUrlHash(serverUrl);
+    const existingTokens = await getValidTokens(serverUrlHash);
+    if (existingTokens) {
+      logger.auth("Using existing valid tokens from persistent storage");
+      return existingTokens;
+    }
+    logger.auth("No existing valid tokens found in persistent storage");
+    const isWPCom = isWordPressComSite(serverUrl);
+    const recommendedConfig = getRecommendedOAuthConfig(serverUrl);
+    if (isWPCom) {
+      logger.auth(`Detected WordPress.com site - using ${recommendedConfig.description}`);
+      logger.auth("This will use WordPress.com OAuth2 endpoints for compatibility");
+    } else {
+      logger.auth(`Detected self-hosted WordPress site - using ${recommendedConfig.description}`);
+      logger.auth("This will trigger the MCP-compliant OAuth 2.1 authentication flow");
+    }
+    logger.auth("Your browser should open automatically for authentication");
+    const shouldUseMCPFlow = !isWPCom && CONFIG.OAUTH_FLOW_TYPE === "authorization_code" && CONFIG.OAUTH_USE_PKCE;
+    if (shouldUseMCPFlow) {
+      if (!mcpOAuthProvider) {
+        mcpOAuthProvider = new MCPOAuthProvider({
+          serverUrl,
+          clientId: CONFIG.WP_OAUTH_CLIENT_ID,
+          scopes: ["read", "write"]
+        });
+      }
+      logger.auth("Using MCP-compliant OAuth 2.1 authorization code flow with PKCE");
+      await mcpOAuthProvider.authorize();
+      const tokens = await mcpOAuthProvider.tokens();
+      if (tokens) {
+        logger.auth("MCP OAuth 2.1 tokens obtained for WordPress API access");
+        return tokens;
+      } else {
+        logger.warn("No tokens available after MCP OAuth 2.1 authentication", "AUTH");
+        return null;
+      }
+    } else {
+      if (isWPCom) {
+        logger.auth("Using WordPress.com OAuth2 provider for full compatibility");
+      } else {
+        logger.warn(
+          "Using legacy OAuth provider. Consider upgrading to OAuth 2.1 for MCP compliance",
+          "AUTH"
+        );
+      }
+      if (!authCoordinator) {
+        if (!globalEvents) {
+          globalEvents = new EventEmitter3();
+        }
+        authCoordinator = createLazyWPAuthCoordinator(
+          serverUrlHash,
+          serverUrl,
+          CONFIG.OAUTH_CALLBACK_PORT,
+          globalEvents
+        );
+      }
+      logger.auth("Starting legacy authentication via coordinator...");
+      try {
+        const tokens = await authCoordinator.waitForAuth();
+        if (tokens) {
+          logger.auth("Legacy tokens obtained for WordPress API access");
+          return tokens;
+        } else {
+          logger.warn("No tokens available after legacy authentication", "AUTH");
+          return null;
+        }
+      } catch (authError) {
+        logger.error("Legacy authentication via coordinator failed", "AUTH", authError);
+        throw authError;
+      }
+    }
+  } catch (error) {
+    logger.error("Error getting OAuth tokens", "AUTH", error);
+    return null;
+  }
+}
 async function wpRequest(params = { method: "init" }) {
   validateEnvironment();
   const endpoint = "/wp/v2/wpmcp";
   const method = "POST";
-  const baseUrl = removeTrailingSlash(process.env.WP_API_URL);
-  log(`Request method: ${params.method || "init"}`);
-  log(`Request args: ${JSON.stringify(params.args || {})}`);
-  let authHeader;
-  if (process.env.JWT_TOKEN) {
-    authHeader = `Bearer ${process.env.JWT_TOKEN}`;
-    log(`Using JWT token authentication`);
-    log(`Token length: ${process.env.JWT_TOKEN.length}`);
-  } else {
+  logger.api(`Request method: ${params.method || "init"}`);
+  logger.debug(`Request args: ${JSON.stringify(params.args || {})}`, "API");
+  let authHeader = "";
+  if (CONFIG.JWT_TOKEN) {
+    authHeader = `Bearer ${CONFIG.JWT_TOKEN}`;
+    logger.auth("Using JWT token authentication");
+    logger.debug(`Token length: ${CONFIG.JWT_TOKEN.length}`, "AUTH");
+  } else if (CONFIG.OAUTH_ENABLED) {
+    logger.auth("OAuth is the primary authentication method - attempting to get tokens...");
+    const oauthTokens = await getOAuthTokens();
+    if (oauthTokens) {
+      authHeader = `Bearer ${oauthTokens.access_token}`;
+      logger.auth("Using OAuth token authentication for WordPress API");
+      logger.debug(`Token length: ${oauthTokens.access_token.length}`, "AUTH");
+    } else {
+      logger.warn("OAuth authentication failed, trying Basic Auth fallback", "AUTH");
+    }
+  }
+  if (!authHeader && CONFIG.WP_API_USERNAME && CONFIG.WP_API_PASSWORD) {
     let username;
     let password;
     if (params.method === "tools/call" && params.args && params.args.tool && params.args.tool.startsWith("wc_reports_")) {
-      username = process.env.WOO_CUSTOMER_KEY;
-      password = process.env.WOO_CUSTOMER_SECRET;
-      log(`Using WooCommerce credentials for tool: ${params.args.tool}`);
+      username = CONFIG.WOO_CUSTOMER_KEY;
+      password = CONFIG.WOO_CUSTOMER_SECRET;
+      logger.auth(`Using WooCommerce credentials for tool: ${params.args.tool}`);
       if (!username || !password) {
-        throw new Error(
-          "Missing WooCommerce credentials. Please set WOO_CUSTOMER_KEY and WOO_CUSTOMER_SECRET environment variables."
+        throw new AuthError(
+          "Missing WooCommerce credentials. Please set WOO_CUSTOMER_KEY and WOO_CUSTOMER_SECRET environment variables.",
+          "WOOCOMMERCE_CREDENTIALS"
         );
       }
     } else {
-      username = process.env.WP_API_USERNAME;
-      password = process.env.WP_API_PASSWORD;
-      log(`Using WordPress credentials for method: ${params.method || "init"}`);
+      username = CONFIG.WP_API_USERNAME;
+      password = CONFIG.WP_API_PASSWORD;
+      logger.auth(`Using WordPress Basic Auth for method: ${params.method || "init"}`);
     }
-    log(`Username length: ${username ? username.length : 0}`);
-    log(`Password length: ${password ? password.length : 0}`);
+    logger.debug(`Username length: ${username ? username.length : 0}`, "AUTH");
+    logger.debug(`Password length: ${password ? password.length : 0}`, "AUTH");
     const auth = Buffer.from(`${username}:${password}`).toString("base64");
     authHeader = `Basic ${auth}`;
-    log(`Auth header length: ${auth.length}`);
+    logger.debug(`Auth header length: ${auth.length}`, "AUTH");
   }
-  log(`Environment: ${process.env.NODE_ENV || "development"}`);
-  log(`API URL: ${baseUrl}`);
-  const url = new URL(`/?rest_route=${endpoint}`, baseUrl).toString();
-  log(`Requesting URL: ${url}`);
+  if (!authHeader) {
+    throw new AuthError(
+      "No authentication method available. Please configure JWT_TOKEN, OAuth, or Basic Auth (WP_API_USERNAME+WP_API_PASSWORD).",
+      "NO_AUTH_METHOD"
+    );
+  }
+  logger.debug(`Environment: ${CONFIG.NODE_ENV}`, "API");
+  logger.debug(`Base API URL: ${CONFIG.WP_API_URL}`, "API");
+  const url = constructApiUrl(CONFIG.WP_API_URL, endpoint);
+  logger.debug(`Final requesting URL: ${url}`, "API");
   const headers = {
     Authorization: authHeader,
     "Content-Type": "application/json"
@@ -102,20 +2019,29 @@ async function wpRequest(params = { method: "init" }) {
     body: JSON.stringify(params)
   };
   try {
-    log(`Sending request to WordPress API...`);
+    logger.api("Sending request to WordPress API...");
     const response = await fetch(url, fetchOptions);
-    log(`Response status: ${response.status}`);
+    logger.debug(`Response status: ${response.status}`, "API");
     if (!response.ok) {
       const errorText = await response.text();
-      log(`Error response: ${errorText}`);
-      throw new Error(`WordPress API error (${response.status}): ${errorText}`);
+      logger.error(`API error response: ${errorText}`, "API");
+      throw new APIError(
+        `WordPress API error (${response.status}): ${errorText}`,
+        response.status,
+        url,
+        errorText
+      );
     }
     const responseData = await response.json();
-    log(`Response received successfully`);
+    logger.api("Response received successfully");
     return responseData;
   } catch (error) {
-    log(`Error in wpRequest: ${error instanceof Error ? error.message : String(error)}`);
-    throw error;
+    if (error instanceof APIError) {
+      throw error;
+    }
+    const errorMessage = error instanceof Error ? error.message : String(error);
+    logger.error(`Error in wpRequest: ${errorMessage}`, "API");
+    throw new APIError(errorMessage, 0, url);
   }
 }
 
@@ -137,18 +2063,29 @@ import {
 var requiredNodeVersion = 22;
 var currentNodeVersion = parseInt(process.version.slice(1).split(".")[0]);
 if (currentNodeVersion < requiredNodeVersion) {
-  log(`Error: This application requires Node.js version ${requiredNodeVersion} or higher.`);
-  log(`Current version: ${process.version}`);
+  logger.error(
+    `This application requires Node.js version ${requiredNodeVersion} or higher.`,
+    "SYSTEM"
+  );
+  logger.error(`Current version: ${process.version}`, "SYSTEM");
   process.exit(1);
 }
 if (typeof globalThis.fetch !== "function") {
-  log(
-    "Error: This application requires the fetch API, which is not available in your Node.js environment."
+  logger.error(
+    "This application requires the fetch API, which is not available in your Node.js environment.",
+    "SYSTEM"
   );
-  log("Please ensure you are using Node.js 22 or later, or install node-fetch.");
+  logger.error("Please ensure you are using Node.js 22 or later, or install node-fetch.", "SYSTEM");
   process.exit(1);
 }
 async function WordPressProxy() {
+  logger.info("Starting WordPress MCP Proxy with enhanced authentication", "PROXY");
+  try {
+    await cleanupExpiredTokens();
+  } catch (error) {
+    logger.warn("Error cleaning up expired tokens", "PROXY", error);
+  }
+  logger.info("Initializing connection to WordPress API...", "PROXY");
   const init = await wpRequest({ method: "initialize" });
   const server = new Server(
     {
@@ -161,16 +2098,20 @@ async function WordPressProxy() {
     }
   );
   const withLogging = (schema, handler) => async (request) => {
-    log(`Received ${schema} request:`, JSON.stringify(request));
-    const response = await handler(request);
-    log(`${schema} response:`, JSON.stringify(response));
-    return response;
+    logger.debug(`Received ${schema} request`, "MCP", request);
+    try {
+      const response = await handler(request);
+      logger.debug(`${schema} response sent`, "MCP");
+      return response;
+    } catch (error) {
+      logger.error(`Error handling ${schema} request`, "MCP", error);
+      throw error;
+    }
   };
   server.setRequestHandler(
     ListToolsRequestSchema,
     withLogging("ListTools", async (request) => {
-      log("Processing ListToolsRequest");
-      log(JSON.stringify(request));
+      logger.debug("Processing ListToolsRequest", "MCP");
       const response = await wpRequest({
         method: "tools/list",
         cursor: request.params?.cursor
@@ -181,8 +2122,7 @@ async function WordPressProxy() {
   server.setRequestHandler(
     CallToolRequestSchema,
     withLogging("CallTool", async (request) => {
-      log("Processing CallToolRequest");
-      log(JSON.stringify(request));
+      logger.debug("Processing CallToolRequest", "MCP");
       const response = await wpRequest({
         method: "tools/call",
         name: request.params.name,
@@ -194,8 +2134,7 @@ async function WordPressProxy() {
   server.setRequestHandler(
     ListResourcesRequestSchema,
     withLogging("ListResources", async (request) => {
-      log("Processing ListResourcesRequest");
-      log(JSON.stringify(request));
+      logger.debug("Processing ListResourcesRequest", "MCP");
       const response = await wpRequest({
         method: "resources/list",
         cursor: request.params?.cursor
@@ -206,8 +2145,7 @@ async function WordPressProxy() {
   server.setRequestHandler(
     ListResourceTemplatesRequestSchema,
     withLogging("ListResourceTemplates", async (request) => {
-      log("Processing ListResourceTemplatesRequest");
-      log(JSON.stringify(request));
+      logger.debug("Processing ListResourceTemplatesRequest", "MCP");
       const response = await wpRequest({
         method: "resources/templates/list",
         cursor: request.params?.cursor
@@ -218,8 +2156,7 @@ async function WordPressProxy() {
   server.setRequestHandler(
     ReadResourceRequestSchema,
     withLogging("ReadResource", async (request) => {
-      log("Processing ReadResourceRequest");
-      log(JSON.stringify(request));
+      logger.debug("Processing ReadResourceRequest", "MCP");
       const response = await wpRequest({
         method: "resources/read",
         uri: request.params.uri
@@ -230,8 +2167,7 @@ async function WordPressProxy() {
   server.setRequestHandler(
     SubscribeRequestSchema,
     withLogging("Subscribe", async (request) => {
-      log("Processing SubscribeRequest");
-      log(JSON.stringify(request));
+      logger.debug("Processing SubscribeRequest", "MCP");
       const response = await wpRequest({
         method: "resources/subscribe",
         uri: request.params.uri
@@ -242,8 +2178,7 @@ async function WordPressProxy() {
   server.setRequestHandler(
     UnsubscribeRequestSchema,
     withLogging("Unsubscribe", async (request) => {
-      log("Processing UnsubscribeRequest");
-      log(JSON.stringify(request));
+      logger.debug("Processing UnsubscribeRequest", "MCP");
       const response = await wpRequest({
         method: "resources/unsubscribe",
         uri: request.params.uri
@@ -254,8 +2189,7 @@ async function WordPressProxy() {
   server.setRequestHandler(
     ListPromptsRequestSchema,
     withLogging("ListPrompts", async (request) => {
-      log("Processing ListPromptsRequest");
-      log(JSON.stringify(request));
+      logger.debug("Processing ListPromptsRequest", "MCP");
       const response = await wpRequest({
         method: "prompts/list",
         cursor: request.params?.cursor
@@ -266,8 +2200,7 @@ async function WordPressProxy() {
   server.setRequestHandler(
     GetPromptRequestSchema,
     withLogging("GetPrompt", async (request) => {
-      log("Processing GetPromptRequest");
-      log(JSON.stringify(request));
+      logger.debug("Processing GetPromptRequest", "MCP");
       const response = await wpRequest({
         method: "prompts/get",
         name: request.params.name,
@@ -279,8 +2212,7 @@ async function WordPressProxy() {
   server.setRequestHandler(
     SetLevelRequestSchema,
     withLogging("SetLevel", async (request) => {
-      log("Processing SetLevelRequest");
-      log(JSON.stringify(request));
+      logger.debug("Processing SetLevelRequest", "MCP");
       const response = await wpRequest({
         method: "logging/setLevel",
         level: request.params.level
@@ -291,8 +2223,7 @@ async function WordPressProxy() {
   server.setRequestHandler(
     CompleteRequestSchema,
     withLogging("Complete", async (request) => {
-      log("Processing CompleteRequest");
-      log(JSON.stringify(request));
+      logger.debug("Processing CompleteRequest", "MCP");
       const response = await wpRequest({
         method: "completion/complete",
         ref: request.params.ref,
@@ -304,8 +2235,7 @@ async function WordPressProxy() {
   server.setRequestHandler(
     ListRootsRequestSchema,
     withLogging("ListRoots", async (request) => {
-      log("Processing ListRootsRequest");
-      log(JSON.stringify(request));
+      logger.debug("Processing ListRootsRequest", "MCP");
       const response = await wpRequest({
         method: "roots/list"
       });
@@ -314,9 +2244,9 @@ async function WordPressProxy() {
   );
   const transport = new StdioServerTransport();
   server.connect(transport).then(() => {
-    log("MCP server connected to transport successfully");
+    logger.info("MCP server connected to transport successfully", "PROXY");
   }).catch((error) => {
-    log(`Error starting MCP server:`, error);
+    logger.error("Error starting MCP server", "PROXY", error);
     process.exit(1);
   });
 }