@automattic/mcp-wordpress-remote 0.5.0 → 0.5.2

package/dist/proxy.js

@@ -4939,7 +4939,7 @@ async function toFormData(Body2, ct) {
   let headerValue2;
   let entryValue;
   let entryName;
-  let contentType;
+  let contentType2;
   let filename;
   const entryChunks = [];
   const formData = new FormData();
@@ -4950,7 +4950,7 @@ async function toFormData(Body2, ct) {
     entryChunks.push(ui8a);
   };
   const appendFileToFormData = () => {
-    const file2 = new file_default(entryChunks, filename, { type: contentType });
+    const file2 = new file_default(entryChunks, filename, { type: contentType2 });
     formData.append(entryName, file2);
   };
   const appendEntryToFormData = () => {
@@ -4965,7 +4965,7 @@ async function toFormData(Body2, ct) {
     headerValue2 = "";
     entryValue = "";
     entryName = "";
-    contentType = "";
+    contentType2 = "";
     filename = null;
     entryChunks.length = 0;
   };
@@ -4989,7 +4989,7 @@ async function toFormData(Body2, ct) {
         parser.onPartEnd = appendFileToFormData;
       }
     } else if (headerField === "content-type") {
-      contentType = headerValue2;
+      contentType2 = headerValue2;
     }
     headerValue2 = "";
     headerField = "";
@@ -5749,9 +5749,9 @@ var init_response = __esm({
         const status = options.status != null ? options.status : 200;
         const headers = new Headers2(options.headers);
         if (body !== null && !headers.has("Content-Type")) {
-          const contentType = extractContentType(body, this);
-          if (contentType) {
-            headers.append("Content-Type", contentType);
+          const contentType2 = extractContentType(body, this);
+          if (contentType2) {
+            headers.append("Content-Type", contentType2);
           }
         }
         this[INTERNALS2] = {
@@ -6073,9 +6073,9 @@ var init_request = __esm({
         });
         const headers = new Headers2(init.headers || input.headers || {});
         if (inputBody !== null && !headers.has("Content-Type")) {
-          const contentType = extractContentType(inputBody, this);
-          if (contentType) {
-            headers.set("Content-Type", contentType);
+          const contentType2 = extractContentType(inputBody, this);
+          if (contentType2) {
+            headers.set("Content-Type", contentType2);
           }
         }
         let signal = isRequest(input) ? input.signal : null;
@@ -6547,6 +6547,110 @@ var init_src = __esm({
   }
 });
 
+// node_modules/content-type/index.js
+var require_content_type = __commonJS({
+  "node_modules/content-type/index.js"(exports) {
+    "use strict";
+    var PARAM_REGEXP = /; *([!#$%&'*+.^_`|~0-9A-Za-z-]+) *= *("(?:[\u000b\u0020\u0021\u0023-\u005b\u005d-\u007e\u0080-\u00ff]|\\[\u000b\u0020-\u00ff])*"|[!#$%&'*+.^_`|~0-9A-Za-z-]+) */g;
+    var TEXT_REGEXP = /^[\u000b\u0020-\u007e\u0080-\u00ff]+$/;
+    var TOKEN_REGEXP = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+    var QESC_REGEXP = /\\([\u000b\u0020-\u00ff])/g;
+    var QUOTE_REGEXP = /([\\"])/g;
+    var TYPE_REGEXP = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+\/[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+    exports.format = format;
+    exports.parse = parse3;
+    function format(obj) {
+      if (!obj || typeof obj !== "object") {
+        throw new TypeError("argument obj is required");
+      }
+      var parameters = obj.parameters;
+      var type = obj.type;
+      if (!type || !TYPE_REGEXP.test(type)) {
+        throw new TypeError("invalid type");
+      }
+      var string4 = type;
+      if (parameters && typeof parameters === "object") {
+        var param;
+        var params = Object.keys(parameters).sort();
+        for (var i2 = 0; i2 < params.length; i2++) {
+          param = params[i2];
+          if (!TOKEN_REGEXP.test(param)) {
+            throw new TypeError("invalid parameter name");
+          }
+          string4 += "; " + param + "=" + qstring(parameters[param]);
+        }
+      }
+      return string4;
+    }
+    function parse3(string4) {
+      if (!string4) {
+        throw new TypeError("argument string is required");
+      }
+      var header = typeof string4 === "object" ? getcontenttype(string4) : string4;
+      if (typeof header !== "string") {
+        throw new TypeError("argument string is required to be a string");
+      }
+      var index = header.indexOf(";");
+      var type = index !== -1 ? header.slice(0, index).trim() : header.trim();
+      if (!TYPE_REGEXP.test(type)) {
+        throw new TypeError("invalid media type");
+      }
+      var obj = new ContentType(type.toLowerCase());
+      if (index !== -1) {
+        var key;
+        var match;
+        var value;
+        PARAM_REGEXP.lastIndex = index;
+        while (match = PARAM_REGEXP.exec(header)) {
+          if (match.index !== index) {
+            throw new TypeError("invalid parameter format");
+          }
+          index += match[0].length;
+          key = match[1].toLowerCase();
+          value = match[2];
+          if (value.charCodeAt(0) === 34) {
+            value = value.slice(1, -1);
+            if (value.indexOf("\\") !== -1) {
+              value = value.replace(QESC_REGEXP, "$1");
+            }
+          }
+          obj.parameters[key] = value;
+        }
+        if (index !== header.length) {
+          throw new TypeError("invalid parameter format");
+        }
+      }
+      return obj;
+    }
+    function getcontenttype(obj) {
+      var header;
+      if (typeof obj.getHeader === "function") {
+        header = obj.getHeader("content-type");
+      } else if (typeof obj.headers === "object") {
+        header = obj.headers && obj.headers["content-type"];
+      }
+      if (typeof header !== "string") {
+        throw new TypeError("content-type header is missing from object");
+      }
+      return header;
+    }
+    function qstring(val) {
+      var str = String(val);
+      if (TOKEN_REGEXP.test(str)) {
+        return str;
+      }
+      if (str.length > 0 && !TEXT_REGEXP.test(str)) {
+        throw new TypeError("invalid parameter value");
+      }
+      return '"' + str.replace(QUOTE_REGEXP, "\\$1") + '"';
+    }
+    function ContentType(type) {
+      this.parameters = /* @__PURE__ */ Object.create(null);
+      this.type = type;
+    }
+  }
+});
+
 // node_modules/ms/index.js
 var require_ms = __commonJS({
   "node_modules/ms/index.js"(exports, module) {
@@ -21818,7 +21922,7 @@ var require_mime_types = __commonJS({
     var TEXT_TYPE_REGEXP = /^text\//i;
     exports.charset = charset;
     exports.charsets = { lookup: charset };
-    exports.contentType = contentType;
+    exports.contentType = contentType2;
     exports.extension = extension;
     exports.extensions = /* @__PURE__ */ Object.create(null);
     exports.lookup = lookup;
@@ -21839,7 +21943,7 @@ var require_mime_types = __commonJS({
       }
       return false;
     }
-    function contentType(str) {
+    function contentType2(str) {
       if (!str || typeof str !== "string") {
         return false;
       }
@@ -21981,7 +22085,7 @@ var require_media_typer = __commonJS({
 var require_type_is = __commonJS({
   "node_modules/type-is/index.js"(exports, module) {
     "use strict";
-    var contentType = require_dist();
+    var contentType2 = require_dist();
     var mime = require_mime_types();
     var typer = require_media_typer();
     module.exports = typeofrequest;
@@ -22062,7 +22166,7 @@ var require_type_is = __commonJS({
     }
     function normalizeType(value) {
       if (!value) return null;
-      var type = contentType.parse(value, { parameters: false }).type;
+      var type = contentType2.parse(value, { parameters: false }).type;
       return typer.test(type) ? type : null;
     }
   }
@@ -22212,7 +22316,7 @@ var require_utils = __commonJS({
   "node_modules/body-parser/lib/utils.js"(exports, module) {
     "use strict";
     var bytes = require_bytes();
-    var contentType = require_dist2();
+    var contentType2 = require_dist2();
     var typeis = require_type_is();
     module.exports = {
       getCharset,
@@ -22222,7 +22326,7 @@ var require_utils = __commonJS({
     function getCharset(req) {
       const header = req.headers["content-type"];
       if (!header) return void 0;
-      return contentType.parse(header).parameters.charset?.toLowerCase();
+      return contentType2.parse(header).parameters.charset?.toLowerCase();
     }
     function typeChecker(type) {
       return function checkType(req) {
@@ -25646,110 +25750,6 @@ var require_view = __commonJS({
   }
 });
 
-// node_modules/content-type/index.js
-var require_content_type = __commonJS({
-  "node_modules/content-type/index.js"(exports) {
-    "use strict";
-    var PARAM_REGEXP = /; *([!#$%&'*+.^_`|~0-9A-Za-z-]+) *= *("(?:[\u000b\u0020\u0021\u0023-\u005b\u005d-\u007e\u0080-\u00ff]|\\[\u000b\u0020-\u00ff])*"|[!#$%&'*+.^_`|~0-9A-Za-z-]+) */g;
-    var TEXT_REGEXP = /^[\u000b\u0020-\u007e\u0080-\u00ff]+$/;
-    var TOKEN_REGEXP = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
-    var QESC_REGEXP = /\\([\u000b\u0020-\u00ff])/g;
-    var QUOTE_REGEXP = /([\\"])/g;
-    var TYPE_REGEXP = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+\/[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
-    exports.format = format;
-    exports.parse = parse3;
-    function format(obj) {
-      if (!obj || typeof obj !== "object") {
-        throw new TypeError("argument obj is required");
-      }
-      var parameters = obj.parameters;
-      var type = obj.type;
-      if (!type || !TYPE_REGEXP.test(type)) {
-        throw new TypeError("invalid type");
-      }
-      var string4 = type;
-      if (parameters && typeof parameters === "object") {
-        var param;
-        var params = Object.keys(parameters).sort();
-        for (var i2 = 0; i2 < params.length; i2++) {
-          param = params[i2];
-          if (!TOKEN_REGEXP.test(param)) {
-            throw new TypeError("invalid parameter name");
-          }
-          string4 += "; " + param + "=" + qstring(parameters[param]);
-        }
-      }
-      return string4;
-    }
-    function parse3(string4) {
-      if (!string4) {
-        throw new TypeError("argument string is required");
-      }
-      var header = typeof string4 === "object" ? getcontenttype(string4) : string4;
-      if (typeof header !== "string") {
-        throw new TypeError("argument string is required to be a string");
-      }
-      var index = header.indexOf(";");
-      var type = index !== -1 ? header.slice(0, index).trim() : header.trim();
-      if (!TYPE_REGEXP.test(type)) {
-        throw new TypeError("invalid media type");
-      }
-      var obj = new ContentType(type.toLowerCase());
-      if (index !== -1) {
-        var key;
-        var match;
-        var value;
-        PARAM_REGEXP.lastIndex = index;
-        while (match = PARAM_REGEXP.exec(header)) {
-          if (match.index !== index) {
-            throw new TypeError("invalid parameter format");
-          }
-          index += match[0].length;
-          key = match[1].toLowerCase();
-          value = match[2];
-          if (value.charCodeAt(0) === 34) {
-            value = value.slice(1, -1);
-            if (value.indexOf("\\") !== -1) {
-              value = value.replace(QESC_REGEXP, "$1");
-            }
-          }
-          obj.parameters[key] = value;
-        }
-        if (index !== header.length) {
-          throw new TypeError("invalid parameter format");
-        }
-      }
-      return obj;
-    }
-    function getcontenttype(obj) {
-      var header;
-      if (typeof obj.getHeader === "function") {
-        header = obj.getHeader("content-type");
-      } else if (typeof obj.headers === "object") {
-        header = obj.headers && obj.headers["content-type"];
-      }
-      if (typeof header !== "string") {
-        throw new TypeError("content-type header is missing from object");
-      }
-      return header;
-    }
-    function qstring(val) {
-      var str = String(val);
-      if (TOKEN_REGEXP.test(str)) {
-        return str;
-      }
-      if (str.length > 0 && !TEXT_REGEXP.test(str)) {
-        throw new TypeError("invalid parameter value");
-      }
-      return '"' + str.replace(QUOTE_REGEXP, "\\$1") + '"';
-    }
-    function ContentType(type) {
-      this.parameters = /* @__PURE__ */ Object.create(null);
-      this.type = type;
-    }
-  }
-});
-
 // node_modules/etag/index.js
 var require_etag = __commonJS({
   "node_modules/etag/index.js"(exports, module) {
@@ -35204,7 +35204,7 @@ var require_mime_types2 = __commonJS({
     var TEXT_TYPE_REGEXP = /^text\//i;
     exports.charset = charset;
     exports.charsets = { lookup: charset };
-    exports.contentType = contentType;
+    exports.contentType = contentType2;
     exports.extension = extension;
     exports.extensions = /* @__PURE__ */ Object.create(null);
     exports.lookup = lookup;
@@ -35225,7 +35225,7 @@ var require_mime_types2 = __commonJS({
       }
       return false;
     }
-    function contentType(str) {
+    function contentType2(str) {
       if (!str || typeof str !== "string") {
         return false;
       }
@@ -36149,7 +36149,7 @@ var require_utils3 = __commonJS({
   "node_modules/express/lib/utils.js"(exports) {
     "use strict";
     var { METHODS } = __require("node:http");
-    var contentType = require_content_type();
+    var contentType2 = require_content_type();
     var etag = require_etag();
     var mime = require_mime_types2();
     var proxyaddr = require_proxy_addr();
@@ -36253,9 +36253,9 @@ var require_utils3 = __commonJS({
       if (!type || !charset) {
         return type;
       }
-      var parsed = contentType.parse(type);
+      var parsed = contentType2.parse(type);
       parsed.parameters.charset = charset;
-      return contentType.format(parsed);
+      return contentType2.format(parsed);
     };
     function createETagGenerator(options) {
       return function generateETag(body, encoding) {
@@ -37800,14 +37800,14 @@ var require_dist4 = __commonJS({
 var require_accept = __commonJS({
   "node_modules/negotiator/lib/accept.js"(exports, module) {
     "use strict";
-    var contentType = require_dist4();
+    var contentType2 = require_dist4();
     module.exports = parseAccept;
     function parseAccept(header) {
       var values = [];
       var index = 0;
       while (index < header.length) {
         var start = skipOptionalWhitespace(header, index);
-        var parsed = contentType.parse(header, { comma: true, start });
+        var parsed = contentType2.parse(header, { comma: true, start });
         parsed.type = header.slice(start, start + parsed.type.length);
         values.push(parsed);
         index = parsed.index + 1;
@@ -38000,7 +38000,7 @@ var require_encoding = __commonJS({
 var require_language = __commonJS({
   "node_modules/negotiator/lib/language.js"(exports, module) {
     "use strict";
-    var contentType = require_dist4();
+    var contentType2 = require_dist4();
     var parseAccept = require_accept();
     module.exports = preferredLanguages;
     module.exports.preferredLanguages = preferredLanguages;
@@ -38037,7 +38037,7 @@ var require_language = __commonJS({
       return priority;
     }
     function specify(language, spec, index) {
-      var p = formatLanguage(contentType.parse(language), 0);
+      var p = formatLanguage(contentType2.parse(language), 0);
       if (!p) return null;
       var s2 = 0;
       if (spec.full.toLowerCase() === p.full.toLowerCase()) {
@@ -38084,7 +38084,7 @@ var require_language = __commonJS({
 var require_mediaType = __commonJS({
   "node_modules/negotiator/lib/mediaType.js"(exports, module) {
     "use strict";
-    var contentType = require_dist4();
+    var contentType2 = require_dist4();
     var parseAcceptHeader = require_accept();
     module.exports = preferredMediaTypes;
     module.exports.preferredMediaTypes = preferredMediaTypes;
@@ -38121,7 +38121,7 @@ var require_mediaType = __commonJS({
       return priority;
     }
     function specify(type, spec, index) {
-      var p = formatMediaType(contentType.parse(type), 0);
+      var p = formatMediaType(contentType2.parse(type), 0);
       var s2 = 0;
       if (!p) {
         return null;
@@ -47645,7 +47645,7 @@ var require_mime_types3 = __commonJS({
     var TEXT_TYPE_REGEXP = /^text\//i;
     exports.charset = charset;
     exports.charsets = { lookup: charset };
-    exports.contentType = contentType;
+    exports.contentType = contentType2;
     exports.extension = extension;
     exports.extensions = /* @__PURE__ */ Object.create(null);
     exports.lookup = lookup;
@@ -47666,7 +47666,7 @@ var require_mime_types3 = __commonJS({
       }
       return false;
     }
-    function contentType(str) {
+    function contentType2(str) {
       if (!str || typeof str !== "string") {
         return false;
       }
@@ -57927,7 +57927,7 @@ var require_mime_types4 = __commonJS({
     var TEXT_TYPE_REGEXP = /^text\//i;
     exports.charset = charset;
     exports.charsets = { lookup: charset };
-    exports.contentType = contentType;
+    exports.contentType = contentType2;
     exports.extension = extension;
     exports.extensions = /* @__PURE__ */ Object.create(null);
     exports.lookup = lookup;
@@ -57948,7 +57948,7 @@ var require_mime_types4 = __commonJS({
       }
       return false;
     }
-    function contentType(str) {
+    function contentType2(str) {
       if (!str || typeof str !== "string") {
         return false;
       }
@@ -58809,7 +58809,7 @@ var require_response = __commonJS({
       var fullPath = !opts.root ? resolve(path7) : path7;
       return this.sendFile(fullPath, opts, done);
     };
-    res.contentType = res.type = function contentType(type) {
+    res.contentType = res.type = function contentType2(type) {
       var ct = type.indexOf("/") === -1 ? mime.contentType(type) || "application/octet-stream" : type;
       return this.set("Content-Type", ct);
     };
@@ -73726,10 +73726,9 @@ var ProgressTokenSchema = union([string2(), number2().int()]);
 var CursorSchema = string2();
 var TaskCreationParamsSchema = looseObject({
   /**
-   * Time in milliseconds to keep task results available after completion.
-   * If null, the task has unlimited lifetime until manually cleaned up.
+   * Requested duration in milliseconds to retain task from creation.
    */
-  ttl: union([number2(), _null3()]).optional(),
+  ttl: number2().optional(),
   /**
    * Time in milliseconds to wait between task status requests.
    */
@@ -74026,7 +74025,11 @@ var ClientCapabilitiesSchema = object({
   /**
    * Present if the client supports task creation.
    */
-  tasks: ClientTasksCapabilitySchema.optional()
+  tasks: ClientTasksCapabilitySchema.optional(),
+  /**
+   * Extensions that the client supports. Keys are extension identifiers (vendor-prefix/extension-name).
+   */
+  extensions: record(string2(), AssertObjectSchema).optional()
 });
 var InitializeRequestParamsSchema = BaseRequestParamsSchema.extend({
   /**
@@ -74087,7 +74090,11 @@ var ServerCapabilitiesSchema = object({
   /**
    * Present if the server supports task creation.
    */
-  tasks: ServerTasksCapabilitySchema.optional()
+  tasks: ServerTasksCapabilitySchema.optional(),
+  /**
+   * Extensions that the server supports. Keys are extension identifiers (vendor-prefix/extension-name).
+   */
+  extensions: record(string2(), AssertObjectSchema).optional()
 });
 var InitializeResultSchema = ResultSchema.extend({
   /**
@@ -74280,6 +74287,12 @@ var ResourceSchema = object({
    * The MIME type of this resource, if known.
    */
   mimeType: optional(string2()),
+  /**
+   * The size of the raw resource content, in bytes (i.e., before base64 encoding or any tokenization), if known.
+   *
+   * This can be used by Hosts to display file sizes and estimate context window usage.
+   */
+  size: optional(number2()),
   /**
    * Optional annotations for the client.
    */
@@ -75221,8 +75234,17 @@ var UrlElicitationRequiredError = class extends McpError {
 };
 
 // node_modules/@modelcontextprotocol/sdk/dist/esm/shared/stdio.js
+var STDIO_DEFAULT_MAX_BUFFER_SIZE = 10 * 1024 * 1024;
 var ReadBuffer = class {
+  constructor(options) {
+    this._maxBufferSize = options?.maxBufferSize ?? STDIO_DEFAULT_MAX_BUFFER_SIZE;
+  }
   append(chunk) {
+    const newSize = (this._buffer?.length ?? 0) + chunk.length;
+    if (newSize > this._maxBufferSize) {
+      this.clear();
+      throw new Error(`ReadBuffer exceeded maximum size of ${this._maxBufferSize} bytes`);
+    }
     this._buffer = this._buffer ? Buffer.concat([this._buffer, chunk]) : chunk;
   }
   readMessage() {
@@ -75250,18 +75272,24 @@ function serializeMessage(message) {
 
 // node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
 var StdioServerTransport = class {
-  constructor(_stdin = process3.stdin, _stdout = process3.stdout) {
+  constructor(_stdin = process3.stdin, _stdout = process3.stdout, options) {
     this._stdin = _stdin;
     this._stdout = _stdout;
-    this._readBuffer = new ReadBuffer();
     this._started = false;
     this._ondata = (chunk) => {
-      this._readBuffer.append(chunk);
-      this.processReadBuffer();
+      try {
+        this._readBuffer.append(chunk);
+        this.processReadBuffer();
+      } catch (error51) {
+        this.onerror?.(error51);
+        this.close().catch(() => {
+        });
+      }
     };
     this._onerror = (error51) => {
       this.onerror?.(error51);
     };
+    this._readBuffer = new ReadBuffer({ maxBufferSize: options?.maxBufferSize });
   }
   /**
    * Starts listening for messages on stdin.
@@ -75580,7 +75608,12 @@ var OAuthTokensSchema = object({
   token_type: string2(),
   expires_in: coerce_exports.number().optional(),
   scope: string2().optional(),
-  refresh_token: string2().optional()
+  refresh_token: string2().optional(),
+  /**
+   * Not part of the wire format: the authorization server this value was obtained from, added by
+   * the client's `auth()` before it is stored and compared when it is read back.
+   */
+  issuer: string2().optional().catch(void 0)
 }).strip();
 var OAuthErrorResponseSchema = object({
   error: string2(),
@@ -75610,7 +75643,12 @@ var OAuthClientInformationSchema = object({
   client_id: string2(),
   client_secret: string2().optional(),
   client_id_issued_at: number2().optional(),
-  client_secret_expires_at: number2().optional()
+  client_secret_expires_at: number2().optional(),
+  /**
+   * Not part of the wire format: the authorization server this value was obtained from, added by
+   * the client's `auth()` before it is stored and compared when it is read back.
+   */
+  issuer: string2().optional().catch(void 0)
 }).strip();
 var OAuthClientInformationFullSchema = OAuthClientMetadataSchema.merge(OAuthClientInformationSchema);
 var OAuthClientRegistrationErrorSchema = object({
@@ -75750,12 +75788,12 @@ var AUTHORIZATION_CODE_RESPONSE_TYPE = "code";
 var AUTHORIZATION_CODE_CHALLENGE_METHOD = "S256";
 function selectClientAuthMethod(clientInformation, supportedMethods) {
   const hasClientSecret = clientInformation.client_secret !== void 0;
-  if (supportedMethods.length === 0) {
-    return hasClientSecret ? "client_secret_post" : "none";
-  }
-  if ("token_endpoint_auth_method" in clientInformation && clientInformation.token_endpoint_auth_method && isClientAuthMethod(clientInformation.token_endpoint_auth_method) && supportedMethods.includes(clientInformation.token_endpoint_auth_method)) {
+  if ("token_endpoint_auth_method" in clientInformation && clientInformation.token_endpoint_auth_method && isClientAuthMethod(clientInformation.token_endpoint_auth_method) && (supportedMethods.length === 0 || supportedMethods.includes(clientInformation.token_endpoint_auth_method))) {
     return clientInformation.token_endpoint_auth_method;
   }
+  if (supportedMethods.length === 0) {
+    return hasClientSecret ? "client_secret_basic" : "none";
+  }
   if (hasClientSecret && supportedMethods.includes("client_secret_basic")) {
     return "client_secret_basic";
   }
@@ -75812,6 +75850,26 @@ async function parseErrorResponse(input) {
     return new ServerError(errorMessage);
   }
 }
+function issuersMatch(a, b) {
+  let [x2, y] = [a, b];
+  try {
+    [x2, y] = [new URL(a).href, new URL(b).href];
+  } catch {
+  }
+  return x2 === y || x2.endsWith("/") && x2.slice(0, -1) === y || y.endsWith("/") && y.slice(0, -1) === x2;
+}
+function discardIfIssuerMismatch(stored, issuer) {
+  if (!stored)
+    return void 0;
+  if (typeof stored.issuer !== "string")
+    return stored.issuer == null ? stored : { ...stored, issuer: void 0 };
+  return issuersMatch(stored.issuer, issuer) ? stored : void 0;
+}
+var TokenResponseSchema = OAuthTokensSchema.omit({ issuer: true });
+var RegistrationResponseSchema = OAuthClientInformationFullSchema.omit({ issuer: true });
+function boundElsewhereError(stored, issuer) {
+  return new Error(`OAuth client information is bound to authorization server ${stored.issuer} and is not presented to ${issuer}. Clear the stored client information, or correct \`expectedIssuer\`, if the authorization server has moved.`);
+}
 async function auth(provider, options) {
   try {
     return await authInternal(provider, options);
@@ -75827,23 +75885,62 @@ async function auth(provider, options) {
   }
 }
 async function authInternal(provider, { serverUrl, authorizationCode, scope, resourceMetadataUrl, fetchFn }) {
+  const cachedState = await provider.discoveryState?.();
   let resourceMetadata;
   let authorizationServerUrl;
-  try {
-    resourceMetadata = await discoverOAuthProtectedResourceMetadata(serverUrl, { resourceMetadataUrl }, fetchFn);
-    if (resourceMetadata.authorization_servers && resourceMetadata.authorization_servers.length > 0) {
-      authorizationServerUrl = resourceMetadata.authorization_servers[0];
+  let metadata;
+  let effectiveResourceMetadataUrl = resourceMetadataUrl;
+  if (!effectiveResourceMetadataUrl && cachedState?.resourceMetadataUrl) {
+    effectiveResourceMetadataUrl = new URL(cachedState.resourceMetadataUrl);
+  }
+  if (cachedState?.authorizationServerUrl) {
+    authorizationServerUrl = cachedState.authorizationServerUrl;
+    resourceMetadata = cachedState.resourceMetadata;
+    metadata = cachedState.authorizationServerMetadata ?? await discoverAuthorizationServerMetadata(authorizationServerUrl, { fetchFn });
+    if (!resourceMetadata) {
+      try {
+        resourceMetadata = await discoverOAuthProtectedResourceMetadata(serverUrl, { resourceMetadataUrl: effectiveResourceMetadataUrl }, fetchFn);
+      } catch {
+      }
     }
-  } catch {
-  }
-  if (!authorizationServerUrl) {
-    authorizationServerUrl = new URL("/", serverUrl);
+    if (metadata !== cachedState.authorizationServerMetadata || resourceMetadata !== cachedState.resourceMetadata) {
+      await provider.saveDiscoveryState?.({
+        authorizationServerUrl: String(authorizationServerUrl),
+        resourceMetadataUrl: effectiveResourceMetadataUrl?.toString(),
+        resourceMetadata,
+        authorizationServerMetadata: metadata
+      });
+    }
+  } else {
+    const serverInfo = await discoverOAuthServerInfo(serverUrl, { resourceMetadataUrl: effectiveResourceMetadataUrl, fetchFn });
+    authorizationServerUrl = serverInfo.authorizationServerUrl;
+    metadata = serverInfo.authorizationServerMetadata;
+    resourceMetadata = serverInfo.resourceMetadata;
+    await provider.saveDiscoveryState?.({
+      authorizationServerUrl: String(authorizationServerUrl),
+      resourceMetadataUrl: effectiveResourceMetadataUrl?.toString(),
+      resourceMetadata,
+      authorizationServerMetadata: metadata
+    });
   }
-  const resource = await selectResourceURL(serverUrl, provider, resourceMetadata);
-  const metadata = await discoverAuthorizationServerMetadata(authorizationServerUrl, {
-    fetchFn
-  });
-  let clientInformation = await Promise.resolve(provider.clientInformation());
+  const issuer = String(authorizationServerUrl);
+  const selectedResource = await selectResourceURL(serverUrl, provider, resourceMetadata);
+  const resource = selectedResource && resourceMetadata && !provider.validateResourceURL ? resourceMetadata.resource : selectedResource;
+  const resolvedScope = scope || resourceMetadata?.scopes_supported?.join(" ") || provider.clientMetadata.scope;
+  const storedClientInformation = await Promise.resolve(provider.clientInformation());
+  let clientInformation = discardIfIssuerMismatch(storedClientInformation, issuer);
+  const canRegisterAgain = provider.saveClientInformation !== void 0 && !!provider.redirectUrl;
+  if (storedClientInformation && !clientInformation && !canRegisterAgain) {
+    throw boundElsewhereError(storedClientInformation, issuer);
+  }
+  const unstampedClientInformation = clientInformation?.issuer == null ? clientInformation : void 0;
+  const bindClientInformation = async () => {
+    try {
+      if (unstampedClientInformation)
+        await provider.saveClientInformation?.({ ...unstampedClientInformation, issuer });
+    } catch {
+    }
+  };
   if (!clientInformation) {
     if (authorizationCode !== void 0) {
       throw new Error("Existing OAuth client information is required when exchanging an authorization code");
@@ -75855,9 +75952,7 @@ async function authInternal(provider, { serverUrl, authorizationCode, scope, res
     }
     const shouldUseUrlBasedClientId = supportsUrlBasedClientId && clientMetadataUrl;
     if (shouldUseUrlBasedClientId) {
-      clientInformation = {
-        client_id: clientMetadataUrl
-      };
+      clientInformation = { client_id: clientMetadataUrl, issuer };
       await provider.saveClientInformation?.(clientInformation);
     } else {
       if (!provider.saveClientInformation) {
@@ -75866,10 +75961,11 @@ async function authInternal(provider, { serverUrl, authorizationCode, scope, res
       const fullInformation = await registerClient(authorizationServerUrl, {
         metadata,
         clientMetadata: provider.clientMetadata,
+        scope: resolvedScope,
         fetchFn
       });
-      await provider.saveClientInformation(fullInformation);
-      clientInformation = fullInformation;
+      clientInformation = { ...fullInformation, issuer };
+      await provider.saveClientInformation(clientInformation);
     }
   }
   const nonInteractiveFlow = !provider.redirectUrl;
@@ -75880,10 +75976,14 @@ async function authInternal(provider, { serverUrl, authorizationCode, scope, res
       authorizationCode,
       fetchFn
     });
-    await provider.saveTokens(tokens2);
+    await bindClientInformation();
+    await provider.saveTokens({ ...tokens2, issuer });
     return "AUTHORIZED";
   }
-  const tokens = await provider.tokens();
+  const tokens = discardIfIssuerMismatch(await provider.tokens(), issuer);
+  if (tokens?.refresh_token && tokens.issuer == null) {
+    console.warn("[mcp-sdk] stored OAuth tokens have no 'issuer' property (saved by an earlier version, or by a provider that does not keep it) and are used as-is; make sure your OAuthClientProvider stores what saveTokens() and saveClientInformation() receive unchanged.");
+  }
   if (tokens?.refresh_token) {
     try {
       const newTokens = await refreshAuthorization(authorizationServerUrl, {
@@ -75894,7 +75994,8 @@ async function authInternal(provider, { serverUrl, authorizationCode, scope, res
         addClientAuthentication: provider.addClientAuthentication,
         fetchFn
       });
-      await provider.saveTokens(newTokens);
+      await bindClientInformation();
+      await provider.saveTokens({ ...newTokens, issuer });
       return "AUTHORIZED";
     } catch (error51) {
       if (!(error51 instanceof OAuthError) || error51 instanceof ServerError) {
@@ -75909,7 +76010,7 @@ async function authInternal(provider, { serverUrl, authorizationCode, scope, res
     clientInformation,
     state,
     redirectUrl: provider.redirectUrl,
-    scope: scope || resourceMetadata?.scopes_supported?.join(" ") || provider.clientMetadata.scope,
+    scope: resolvedScope,
     resource
   });
   await provider.saveCodeVerifier(codeVerifier);
@@ -76097,6 +76198,29 @@ async function discoverAuthorizationServerMetadata(authorizationServerUrl, { fet
   }
   return void 0;
 }
+async function discoverOAuthServerInfo(serverUrl, opts) {
+  let resourceMetadata;
+  let authorizationServerUrl;
+  try {
+    resourceMetadata = await discoverOAuthProtectedResourceMetadata(serverUrl, { resourceMetadataUrl: opts?.resourceMetadataUrl }, opts?.fetchFn);
+    if (resourceMetadata.authorization_servers && resourceMetadata.authorization_servers.length > 0) {
+      authorizationServerUrl = resourceMetadata.authorization_servers[0];
+    }
+  } catch {
+  }
+  if (!authorizationServerUrl) {
+    authorizationServerUrl = String(new URL("/", serverUrl));
+  }
+  const authorizationServerMetadata = await discoverAuthorizationServerMetadata(authorizationServerUrl, { fetchFn: opts?.fetchFn });
+  return {
+    authorizationServerUrl,
+    authorizationServerMetadata,
+    resourceMetadata
+  };
+}
+function resourceIndicatorToString(resource) {
+  return typeof resource === "string" ? resource : resource.href;
+}
 async function startAuthorization(authorizationServerUrl, { metadata, clientInformation, redirectUrl, scope, state, resource }) {
   let authorizationUrl;
   if (metadata) {
@@ -76128,7 +76252,7 @@ async function startAuthorization(authorizationServerUrl, { metadata, clientInfo
     authorizationUrl.searchParams.append("prompt", "consent");
   }
   if (resource) {
-    authorizationUrl.searchParams.set("resource", resource.href);
+    authorizationUrl.searchParams.set("resource", resourceIndicatorToString(resource));
   }
   return { authorizationUrl, codeVerifier };
 }
@@ -76147,7 +76271,7 @@ async function executeTokenRequest(authorizationServerUrl, { metadata, tokenRequ
     Accept: "application/json"
   });
   if (resource) {
-    tokenRequestParams.set("resource", resource.href);
+    tokenRequestParams.set("resource", resourceIndicatorToString(resource));
   }
   if (addClientAuthentication) {
     await addClientAuthentication(headers, tokenRequestParams, tokenUrl, metadata);
@@ -76164,7 +76288,7 @@ async function executeTokenRequest(authorizationServerUrl, { metadata, tokenRequ
   if (!response.ok) {
     throw await parseErrorResponse(response);
   }
-  return OAuthTokensSchema.parse(await response.json());
+  return TokenResponseSchema.parse(await response.json());
 }
 async function refreshAuthorization(authorizationServerUrl, { metadata, clientInformation, refreshToken, resource, addClientAuthentication, fetchFn }) {
   const tokenRequestParams = new URLSearchParams({
@@ -76182,6 +76306,15 @@ async function refreshAuthorization(authorizationServerUrl, { metadata, clientIn
   return { refresh_token: refreshToken, ...tokens };
 }
 async function fetchToken(provider, authorizationServerUrl, { metadata, resource, authorizationCode, fetchFn } = {}) {
+  const readClientInformation = async () => {
+    const storedClientInformation = await provider.clientInformation();
+    const checked = discardIfIssuerMismatch(storedClientInformation, String(authorizationServerUrl));
+    if (storedClientInformation && !checked) {
+      throw boundElsewhereError(storedClientInformation, String(authorizationServerUrl));
+    }
+    return checked;
+  };
+  let clientInformation = await readClientInformation();
   const scope = provider.clientMetadata.scope;
   let tokenRequestParams;
   if (provider.prepareTokenRequest) {
@@ -76197,17 +76330,17 @@ async function fetchToken(provider, authorizationServerUrl, { metadata, resource
     const codeVerifier = await provider.codeVerifier();
     tokenRequestParams = prepareAuthorizationCodeRequest(authorizationCode, codeVerifier, provider.redirectUrl);
   }
-  const clientInformation = await provider.clientInformation();
+  clientInformation ?? (clientInformation = await readClientInformation());
   return executeTokenRequest(authorizationServerUrl, {
     metadata,
     tokenRequestParams,
-    clientInformation: clientInformation ?? void 0,
+    clientInformation,
     addClientAuthentication: provider.addClientAuthentication,
     resource,
     fetchFn
   });
 }
-async function registerClient(authorizationServerUrl, { metadata, clientMetadata, fetchFn }) {
+async function registerClient(authorizationServerUrl, { metadata, clientMetadata, scope, fetchFn }) {
   let registrationUrl;
   if (metadata) {
     if (!metadata.registration_endpoint) {
@@ -76222,12 +76355,15 @@ async function registerClient(authorizationServerUrl, { metadata, clientMetadata
     headers: {
       "Content-Type": "application/json"
     },
-    body: JSON.stringify(clientMetadata)
+    body: JSON.stringify({
+      ...clientMetadata,
+      ...scope !== void 0 ? { scope } : {}
+    })
   });
   if (!response.ok) {
     throw await parseErrorResponse(response);
   }
-  return OAuthClientInformationFullSchema.parse(await response.json());
+  return RegistrationResponseSchema.parse(await response.json());
 }
 
 // src/lib/utils.ts
@@ -76507,7 +76643,7 @@ async function selectCallbackPort(serverUrl, specifiedPort, _unused) {
 }
 
 // src/lib/config.ts
-var MCP_WORDPRESS_REMOTE_VERSION = "0.5.0";
+var MCP_WORDPRESS_REMOTE_VERSION = "0.5.2";
 function parsePositiveIntEnv(value, defaultValue) {
   if (!value) {
     return defaultValue;
@@ -76577,7 +76713,7 @@ var CONFIG = {
   NODE_ENV: process.env.NODE_ENV || "development",
   // Proxy Configuration
   USE_SYSTEM_PROXY: process.env.USE_SYSTEM_PROXY === "true"
-  // Enable system proxy detection (PAC files, env vars)
+  // Enable macOS system proxy detection (PAC file, system SOCKS)
 };
 var getConfig = () => ({
   /** WordPress site API endpoint */
@@ -76944,6 +77080,11 @@ async function doInitializeProxy(detectMacOs) {
     logger.info(`Proxy configured from environment: ${sanitizeProxyUrl(envProxy.url)}`, "PROXY");
     return;
   }
+  if (!getConfig().useSystemProxy) {
+    logger.debug("No proxy configured (system proxy detection disabled)", "PROXY");
+    proxyConfig = { type: "none" };
+    return;
+  }
   const macProxy = detectMacOs();
   if (macProxy?.pacUrl) {
     try {
@@ -77056,11 +77197,7 @@ async function setupFetchPolyfill() {
   } else {
     logger.info("Using native fetch API", "SYSTEM");
   }
-  if (getConfig().useSystemProxy) {
-    await initializeProxy();
-  } else {
-    logger.debug("System proxy support disabled (USE_SYSTEM_PROXY=false)", "PROXY");
-  }
+  await initializeProxy();
 }
 async function proxyFetch(url2, init) {
   const headers = new Headers(init?.headers);
@@ -77068,9 +77205,6 @@ async function proxyFetch(url2, init) {
     headers.set("User-Agent", clientProduct ? `${clientProduct} ${PROXY_PRODUCT}` : PROXY_PRODUCT);
   }
   init = { ...init, headers };
-  if (!getConfig().useSystemProxy) {
-    return fetch(url2, init);
-  }
   const agent = await getAgentForUrl(url2);
   if (agent) {
     const nodeFetch = (await Promise.resolve().then(() => (init_src(), src_exports))).default;
@@ -77082,6 +77216,23 @@ async function proxyFetch(url2, init) {
 // src/lib/wordpress-transport.ts
 import { Readable } from "node:stream";
 
+// node_modules/@modelcontextprotocol/sdk/dist/esm/shared/mediaType.js
+var import_content_type = __toESM(require_content_type(), 1);
+function mediaTypeEssence(header) {
+  if (!header) {
+    return void 0;
+  }
+  try {
+    return import_content_type.default.parse(header).type;
+  } catch {
+    const essence = (header.split(";", 1)[0] ?? "").trim().toLowerCase();
+    if (essence === "" || header.slice(essence.length).includes(",")) {
+      return void 0;
+    }
+    return essence;
+  }
+}
+
 // node_modules/eventsource-parser/dist/stream.js
 var EventSourceParserStream = class extends TransformStream {
   constructor({ onError, onRetry, onComment } = {}) {
@@ -77422,11 +77573,12 @@ var StreamableHTTPClientTransport = class {
       }
       const messages = Array.isArray(message) ? message : [message];
       const hasRequests = messages.filter((msg) => "method" in msg && "id" in msg && msg.id !== void 0).length > 0;
-      const contentType = response.headers.get("content-type");
+      const contentType2 = response.headers.get("content-type");
+      const responseMediaType = mediaTypeEssence(contentType2);
       if (hasRequests) {
-        if (contentType?.includes("text/event-stream")) {
+        if (responseMediaType === "text/event-stream") {
           this._handleSseStream(response.body, { onresumptiontoken }, false);
-        } else if (contentType?.includes("application/json")) {
+        } else if (responseMediaType === "application/json") {
           const data = await response.json();
           const responseMessages = Array.isArray(data) ? data.map((msg) => JSONRPCMessageSchema.parse(msg)) : [JSONRPCMessageSchema.parse(data)];
           for (const msg of responseMessages) {
@@ -77434,7 +77586,7 @@ var StreamableHTTPClientTransport = class {
           }
         } else {
           await response.body?.cancel();
-          throw new StreamableHTTPError(-1, `Unexpected content type: ${contentType}`);
+          throw new StreamableHTTPError(-1, `Unexpected content type: ${contentType2}`);
         }
       } else {
         await response.body?.cancel();
@@ -78647,7 +78799,11 @@ var OAuthCallbackServer = class {
   async start() {
     return new Promise((resolve, reject) => {
       try {
-        this.server = this.app.listen(this.options.port, this.options.host, () => {
+        this.server = this.app.listen(this.options.port, this.options.host, (error51) => {
+          if (error51) {
+            reject(error51);
+            return;
+          }
           logger.oauth(
             `OAuth callback server listening on http://${this.options.host}:${this.options.port}`
           );
@@ -79790,6 +79946,19 @@ async function getOAuthTokens() {
     return null;
   }
 }
+async function discardRejectedOAuthToken(authorization) {
+  if (!CONFIG.OAUTH_ENABLED || CONFIG.JWT_TOKEN) {
+    return false;
+  }
+  const serverUrlHash = generateServerUrlHash(CONFIG.WP_API_URL);
+  const tokens = await readTokens(serverUrlHash);
+  if (!tokens || authorization !== `Bearer ${tokens.access_token}`) {
+    return false;
+  }
+  logger.warn("WordPress rejected the stored OAuth token; signing in again", "AUTH");
+  await deleteTokens(serverUrlHash);
+  return true;
+}
 function getCurrentApiUrl() {
   return process.env.WP_API_URL || CONFIG.WP_API_URL;
 }
@@ -79889,6 +80058,9 @@ function collectHeaderParams(schema, path6 = []) {
     return [...own, ...collectHeaderParams(child, [...path6, key])];
   });
 }
+function isBearerChallenge(challenge) {
+  return challenge === null || /^Bearer\b/i.test(challenge);
+}
 function valueAtPath(value, path6) {
   return path6.reduce(
     (node, key) => node && typeof node === "object" ? node[key] : void 0,
@@ -79898,25 +80070,24 @@ function valueAtPath(value, path6) {
 function createWordPressTransport(onFailure) {
   const inflight = /* @__PURE__ */ new Map();
   const toolHeaders = /* @__PURE__ */ new Map();
-  const fetch3 = async (url2, init) => {
+  const send = async (url2, init, retried) => {
     const message = typeof init?.body === "string" ? JSON.parse(init.body) : void 0;
     const request = message && "method" in message && "id" in message ? message : void 0;
     const controller = new AbortController();
-    const abort = () => controller.abort();
     let cancelled = false;
     const cancel = () => {
       cancelled = true;
-      abort();
+      controller.abort();
     };
     if (request) inflight.set(request.id, cancel);
-    init?.signal?.addEventListener("abort", abort, { once: true });
-    if (init?.signal?.aborted) abort();
+    init?.signal?.addEventListener("abort", cancel, { once: true });
+    if (init?.signal?.aborted) cancel();
     const timeoutMs = message && "method" in message && message.method === "initialize" ? CONFIG.WP_API_INIT_TIMEOUT : CONFIG.WP_API_TIMEOUT;
     let timedOut = false;
     let timer;
     const cleanup = () => {
       clearTimeout(timer);
-      init?.signal?.removeEventListener("abort", abort);
+      init?.signal?.removeEventListener("abort", cancel);
       if (request && inflight.get(request.id) === cancel) inflight.delete(request.id);
     };
     const failure = (error51) => {
@@ -79965,17 +80136,28 @@ function createWordPressTransport(onFailure) {
         headers,
         signal: controller.signal
       });
+      if (response.status === 401 && !retried && isBearerChallenge(response.headers.get("WWW-Authenticate")) && await discardRejectedOAuthToken(headers.get("Authorization"))) {
+        const unread = response.body;
+        if (typeof unread?.cancel === "function") await unread.cancel();
+        else unread?.destroy?.();
+        cleanup();
+        if (cancelled) return new Response(null, { status: 202 });
+        return send(url2, init, true);
+      }
       const body = response.body && typeof response.body.getReader !== "function" ? Readable.toWeb(response.body) : response.body;
       const reader = body?.getReader();
+      let released = false;
       const stream = reader ? new ReadableStream({
         async pull(output) {
           try {
             const { value, done } = await reader.read();
+            if (released) return;
             if (done) {
               cleanup();
               output.close();
             } else output.enqueue(value);
           } catch (error51) {
+            if (released) return;
             if (cancelled) {
               cleanup();
               output.close();
@@ -79983,6 +80165,7 @@ function createWordPressTransport(onFailure) {
           }
         },
         async cancel(reason) {
+          released = true;
           cleanup();
           await reader.cancel(reason);
         }
@@ -80021,6 +80204,7 @@ function createWordPressTransport(onFailure) {
       throw failure(error51);
     }
   };
+  const fetch3 = (url2, init) => send(url2, init, false);
   return Object.assign(new StreamableHTTPClientTransport(new URL(getRequestUrl()), { fetch: fetch3 }), {
     cancelRequest(id) {
       inflight.get(id)?.();
@@ -80287,6 +80471,13 @@ formdata-polyfill/esm.min.js:
 node-domexception/index.js:
   (*! node-domexception. MIT License. Jimmy Wärting <https://jimmy.warting.se/opensource> *)
 
+content-type/index.js:
+  (*!
+   * content-type
+   * Copyright(c) 2015 Douglas Christopher Wilson
+   * MIT Licensed
+   *)
+
 depd/index.js:
   (*!
    * depd
@@ -80484,13 +80675,6 @@ express/lib/view.js:
    * MIT Licensed
    *)
 
-content-type/index.js:
-  (*!
-   * content-type
-   * Copyright(c) 2015 Douglas Christopher Wilson
-   * MIT Licensed
-   *)
-
 etag/index.js:
   (*!
    * etag