@automattic/mcp-wordpress-remote 0.5.1 → 0.5.3

package/dist/lib.js

@@ -73824,10 +73824,9 @@ var ProgressTokenSchema = union([string2(), number2().int()]);
 var CursorSchema = string2();
 var TaskCreationParamsSchema = looseObject({
   /**
-   * Time in milliseconds to keep task results available after completion.
-   * If null, the task has unlimited lifetime until manually cleaned up.
+   * Requested duration in milliseconds to retain task from creation.
    */
-  ttl: union([number2(), _null3()]).optional(),
+  ttl: number2().optional(),
   /**
    * Time in milliseconds to wait between task status requests.
    */
@@ -74122,7 +74121,11 @@ var ClientCapabilitiesSchema = object({
   /**
    * Present if the client supports task creation.
    */
-  tasks: ClientTasksCapabilitySchema.optional()
+  tasks: ClientTasksCapabilitySchema.optional(),
+  /**
+   * Extensions that the client supports. Keys are extension identifiers (vendor-prefix/extension-name).
+   */
+  extensions: record(string2(), AssertObjectSchema).optional()
 });
 var InitializeRequestParamsSchema = BaseRequestParamsSchema.extend({
   /**
@@ -74183,7 +74186,11 @@ var ServerCapabilitiesSchema = object({
   /**
    * Present if the server supports task creation.
    */
-  tasks: ServerTasksCapabilitySchema.optional()
+  tasks: ServerTasksCapabilitySchema.optional(),
+  /**
+   * Extensions that the server supports. Keys are extension identifiers (vendor-prefix/extension-name).
+   */
+  extensions: record(string2(), AssertObjectSchema).optional()
 });
 var InitializeResultSchema = ResultSchema.extend({
   /**
@@ -74375,6 +74382,12 @@ var ResourceSchema = object({
    * The MIME type of this resource, if known.
    */
   mimeType: optional(string2()),
+  /**
+   * The size of the raw resource content, in bytes (i.e., before base64 encoding or any tokenization), if known.
+   *
+   * This can be used by Hosts to display file sizes and estimate context window usage.
+   */
+  size: optional(number2()),
   /**
    * Optional annotations for the client.
    */
@@ -75393,7 +75406,12 @@ var OAuthTokensSchema = object({
   token_type: string2(),
   expires_in: coerce_exports.number().optional(),
   scope: string2().optional(),
-  refresh_token: string2().optional()
+  refresh_token: string2().optional(),
+  /**
+   * Not part of the wire format: the authorization server this value was obtained from, added by
+   * the client's `auth()` before it is stored and compared when it is read back.
+   */
+  issuer: string2().optional().catch(void 0)
 }).strip();
 var OAuthErrorResponseSchema = object({
   error: string2(),
@@ -75423,7 +75441,12 @@ var OAuthClientInformationSchema = object({
   client_id: string2(),
   client_secret: string2().optional(),
   client_id_issued_at: number2().optional(),
-  client_secret_expires_at: number2().optional()
+  client_secret_expires_at: number2().optional(),
+  /**
+   * Not part of the wire format: the authorization server this value was obtained from, added by
+   * the client's `auth()` before it is stored and compared when it is read back.
+   */
+  issuer: string2().optional().catch(void 0)
 }).strip();
 var OAuthClientInformationFullSchema = OAuthClientMetadataSchema.merge(OAuthClientInformationSchema);
 var OAuthClientRegistrationErrorSchema = object({
@@ -75530,6 +75553,154 @@ var OAUTH_ERRORS = {
   [InvalidTargetError.errorCode]: InvalidTargetError
 };
 
+// node_modules/@modelcontextprotocol/sdk/dist/esm/client/auth.js
+function isClientAuthMethod(method) {
+  return ["client_secret_basic", "client_secret_post", "none"].includes(method);
+}
+function selectClientAuthMethod(clientInformation, supportedMethods) {
+  const hasClientSecret = clientInformation.client_secret !== void 0;
+  if ("token_endpoint_auth_method" in clientInformation && clientInformation.token_endpoint_auth_method && isClientAuthMethod(clientInformation.token_endpoint_auth_method) && (supportedMethods.length === 0 || supportedMethods.includes(clientInformation.token_endpoint_auth_method))) {
+    return clientInformation.token_endpoint_auth_method;
+  }
+  if (supportedMethods.length === 0) {
+    return hasClientSecret ? "client_secret_basic" : "none";
+  }
+  if (hasClientSecret && supportedMethods.includes("client_secret_basic")) {
+    return "client_secret_basic";
+  }
+  if (hasClientSecret && supportedMethods.includes("client_secret_post")) {
+    return "client_secret_post";
+  }
+  if (supportedMethods.includes("none")) {
+    return "none";
+  }
+  return hasClientSecret ? "client_secret_post" : "none";
+}
+function applyClientAuthentication(method, clientInformation, headers, params) {
+  const { client_id, client_secret } = clientInformation;
+  switch (method) {
+    case "client_secret_basic":
+      applyBasicAuth(client_id, client_secret, headers);
+      return;
+    case "client_secret_post":
+      applyPostAuth(client_id, client_secret, params);
+      return;
+    case "none":
+      applyPublicAuth(client_id, params);
+      return;
+    default:
+      throw new Error(`Unsupported client authentication method: ${method}`);
+  }
+}
+function applyBasicAuth(clientId, clientSecret, headers) {
+  if (!clientSecret) {
+    throw new Error("client_secret_basic authentication requires a client_secret");
+  }
+  const credentials = btoa(`${clientId}:${clientSecret}`);
+  headers.set("Authorization", `Basic ${credentials}`);
+}
+function applyPostAuth(clientId, clientSecret, params) {
+  params.set("client_id", clientId);
+  if (clientSecret) {
+    params.set("client_secret", clientSecret);
+  }
+}
+function applyPublicAuth(clientId, params) {
+  params.set("client_id", clientId);
+}
+async function parseErrorResponse(input) {
+  const statusCode = input instanceof Response ? input.status : void 0;
+  const body = input instanceof Response ? await input.text() : input;
+  try {
+    const result = OAuthErrorResponseSchema.parse(JSON.parse(body));
+    const { error: error51, error_description, error_uri } = result;
+    const errorClass = OAUTH_ERRORS[error51] || ServerError;
+    return new errorClass(error_description || "", error_uri);
+  } catch (error51) {
+    const errorMessage = `${statusCode ? `HTTP ${statusCode}: ` : ""}Invalid OAuth error response: ${error51}. Raw body: ${body}`;
+    return new ServerError(errorMessage);
+  }
+}
+var TokenResponseSchema = OAuthTokensSchema.omit({ issuer: true });
+var RegistrationResponseSchema = OAuthClientInformationFullSchema.omit({ issuer: true });
+function buildDiscoveryUrls(authorizationServerUrl) {
+  const url2 = typeof authorizationServerUrl === "string" ? new URL(authorizationServerUrl) : authorizationServerUrl;
+  const hasPath = url2.pathname !== "/";
+  const urlsToTry = [];
+  if (!hasPath) {
+    urlsToTry.push({
+      url: new URL("/.well-known/oauth-authorization-server", url2.origin),
+      type: "oauth"
+    });
+    urlsToTry.push({
+      url: new URL(`/.well-known/openid-configuration`, url2.origin),
+      type: "oidc"
+    });
+    return urlsToTry;
+  }
+  let pathname = url2.pathname;
+  if (pathname.endsWith("/")) {
+    pathname = pathname.slice(0, -1);
+  }
+  urlsToTry.push({
+    url: new URL(`/.well-known/oauth-authorization-server${pathname}`, url2.origin),
+    type: "oauth"
+  });
+  urlsToTry.push({
+    url: new URL(`/.well-known/openid-configuration${pathname}`, url2.origin),
+    type: "oidc"
+  });
+  urlsToTry.push({
+    url: new URL(`${pathname}/.well-known/openid-configuration`, url2.origin),
+    type: "oidc"
+  });
+  return urlsToTry;
+}
+function resourceIndicatorToString(resource) {
+  return typeof resource === "string" ? resource : resource.href;
+}
+async function executeTokenRequest(authorizationServerUrl, { metadata, tokenRequestParams, clientInformation, addClientAuthentication, resource, fetchFn }) {
+  const tokenUrl = metadata?.token_endpoint ? new URL(metadata.token_endpoint) : new URL("/token", authorizationServerUrl);
+  const headers = new Headers({
+    "Content-Type": "application/x-www-form-urlencoded",
+    Accept: "application/json"
+  });
+  if (resource) {
+    tokenRequestParams.set("resource", resourceIndicatorToString(resource));
+  }
+  if (addClientAuthentication) {
+    await addClientAuthentication(headers, tokenRequestParams, tokenUrl, metadata);
+  } else if (clientInformation) {
+    const supportedMethods = metadata?.token_endpoint_auth_methods_supported ?? [];
+    const authMethod = selectClientAuthMethod(clientInformation, supportedMethods);
+    applyClientAuthentication(authMethod, clientInformation, headers, tokenRequestParams);
+  }
+  const response = await (fetchFn ?? fetch)(tokenUrl, {
+    method: "POST",
+    headers,
+    body: tokenRequestParams
+  });
+  if (!response.ok) {
+    throw await parseErrorResponse(response);
+  }
+  return TokenResponseSchema.parse(await response.json());
+}
+async function refreshAuthorization(authorizationServerUrl, { metadata, clientInformation, refreshToken, resource, addClientAuthentication, fetchFn }) {
+  const tokenRequestParams = new URLSearchParams({
+    grant_type: "refresh_token",
+    refresh_token: refreshToken
+  });
+  const tokens = await executeTokenRequest(authorizationServerUrl, {
+    metadata,
+    tokenRequestParams,
+    clientInformation,
+    addClientAuthentication,
+    resource,
+    fetchFn
+  });
+  return { refresh_token: refreshToken, ...tokens };
+}
+
 // src/lib/utils.ts
 import * as fs2 from "node:fs";
 import * as path3 from "node:path";
@@ -75641,7 +75812,19 @@ async function writeTokens(serverUrlHash, tokens) {
       ...tokens,
       obtained_at: Date.now()
     };
-    await writeJsonFile(serverUrlHash, "tokens.json", tokensWithTimestamp);
+    await ensureConfigDir();
+    const file2 = getConfigFilePath(serverUrlHash, "tokens.json");
+    const temporary = `${file2}.${crypto2.randomUUID()}.tmp`;
+    try {
+      await fs.writeFile(temporary, JSON.stringify(tokensWithTimestamp, null, 2), {
+        encoding: "utf-8",
+        mode: 384,
+        flag: "wx"
+      });
+      await fs.rename(temporary, file2);
+    } finally {
+      await fs.rm(temporary, { force: true });
+    }
     logger.info(`Stored tokens for server hash: ${serverUrlHash}`, "AUTH");
   } catch (error51) {
     logger.error(`Error writing tokens for ${serverUrlHash}`, "AUTH", error51);
@@ -75674,7 +75857,7 @@ function isTokenValid(tokens) {
   if (!tokens?.access_token) {
     return { isValid: false, error: "No access token" };
   }
-  if (!tokens.expires_in || !tokens.obtained_at) {
+  if (tokens.expires_in === void 0 || tokens.obtained_at === void 0) {
     return { isValid: true };
   }
   const now = Date.now();
@@ -75713,12 +75896,12 @@ var OAuthClientInfoSchema = external_exports.object({
   client_id: external_exports.string().optional(),
   client_secret: external_exports.string().optional()
 });
-async function findAvailablePort(preferredPort) {
+async function findAvailablePort(preferredPort, host = "127.0.0.1") {
   return new Promise((resolve, reject) => {
     const server = net.createServer();
     server.on("error", (err) => {
       if (err.code === "EADDRINUSE") {
-        server.listen(0);
+        server.listen(0, host);
       } else {
         reject(err);
       }
@@ -75729,7 +75912,7 @@ async function findAvailablePort(preferredPort) {
         resolve(port);
       });
     });
-    server.listen(preferredPort || 0);
+    server.listen(preferredPort || 0, host);
   });
 }
 function calculateDefaultPort(serverUrlHash) {
@@ -75757,24 +75940,17 @@ async function findExistingClientPort(serverUrlHash) {
 function getServerUrlHash(serverUrl) {
   return crypto3.createHash("md5").update(serverUrl).digest("hex");
 }
-async function selectCallbackPort(serverUrl, specifiedPort, _unused) {
+async function selectCallbackPort(serverUrl, specifiedPort, _unused, host = "127.0.0.1") {
   const serverUrlHash = getServerUrlHash(serverUrl);
   if (specifiedPort) {
     return specifiedPort;
   }
-  const defaultPort = calculateDefaultPort(serverUrlHash);
-  const [existingClientPort, availablePort] = await Promise.all([
-    findExistingClientPort(serverUrlHash),
-    findAvailablePort(defaultPort)
-  ]);
-  if (existingClientPort) {
-    return existingClientPort;
-  }
-  return availablePort;
+  const existingClientPort = await findExistingClientPort(serverUrlHash);
+  return findAvailablePort(existingClientPort ?? calculateDefaultPort(serverUrlHash), host);
 }
 
 // src/lib/config.ts
-var MCP_WORDPRESS_REMOTE_VERSION = "0.5.1";
+var MCP_WORDPRESS_REMOTE_VERSION = "0.5.3";
 function parsePositiveIntEnv(value, defaultValue) {
   if (!value) {
     return defaultValue;
@@ -75975,8 +76151,8 @@ async function getOAuthCallbackPort() {
   return selectCallbackPort(
     CONFIG.WP_API_URL,
     CONFIG.OAUTH_CALLBACK_PORT,
-    false
-    // Always treat as self-hosted for port selection
+    false,
+    CONFIG.OAUTH_HOST
   );
 }
 function formatConfigError(error51) {
@@ -76896,10 +77072,48 @@ defineLazyProperty(apps, "browserPrivate", () => "browserPrivate");
 var open_default = open;
 
 // src/lib/mcp-oauth-provider.ts
+import lockfile from "proper-lockfile";
+import { setTimeout as delay } from "node:timers/promises";
 import { EventEmitter } from "node:events";
 
 // src/lib/mcp-oauth-utils.ts
 import crypto4 from "crypto";
+
+// src/lib/oauth-http.ts
+function validateOAuthUrl(value) {
+  let url2;
+  try {
+    url2 = new URL(value);
+  } catch {
+    throw new OAuthError2("Invalid OAuth URL", "INVALID_OAUTH_URL");
+  }
+  const loopback = url2.hostname === "localhost" || url2.hostname === "[::1]" || /^127(?:\.\d{1,3}){3}$/.test(url2.hostname);
+  if (url2.protocol !== "https:" && !(url2.protocol === "http:" && loopback) || url2.username || url2.password || url2.hash) {
+    throw new OAuthError2(
+      "OAuth URLs require HTTPS (HTTP is allowed only on loopback)",
+      "INSECURE_OAUTH_URL"
+    );
+  }
+  return url2;
+}
+async function oauthFetch(value, init = {}) {
+  const url2 = validateOAuthUrl(value);
+  const headers = new Headers(
+    url2.origin === new URL(CONFIG.WP_API_URL).origin ? getCustomHeaders() : {}
+  );
+  new Headers(init.headers).forEach((value2, key) => headers.set(key, value2));
+  const response = await proxyFetch(url2.toString(), {
+    ...init,
+    headers,
+    redirect: "error",
+    signal: init.signal ?? AbortSignal.timeout(CONFIG.OAUTH_TIMEOUT)
+  });
+  if (response.status >= 300 && response.status < 400)
+    throw new OAuthError2("OAuth endpoint redirects are not accepted", "OAUTH_REDIRECT");
+  return response;
+}
+
+// src/lib/mcp-oauth-utils.ts
 function generatePKCE() {
   const codeVerifier = crypto4.randomBytes(64).toString("base64url").substring(0, 128);
   const codeChallenge = crypto4.createHash("sha256").update(codeVerifier).digest("base64url");
@@ -76927,118 +77141,76 @@ function generateCanonicalResourceURI(serverUrl) {
   }
 }
 async function discoverAuthorizationServerMetadata(authorizationServerUrl) {
-  try {
-    const metadataUrl = new URL("/.well-known/oauth-authorization-server", authorizationServerUrl);
-    logger.oauth(`Discovering authorization server metadata: ${metadataUrl}`);
-    const customHeaders = getCustomHeaders();
-    const response = await proxyFetch(metadataUrl.toString(), {
-      headers: {
-        Accept: "application/json",
-        ...customHeaders
-      }
-    });
-    if (!response.ok) {
+  const issuer = validateOAuthUrl(authorizationServerUrl);
+  if (issuer.search) throw new OAuthError2("Issuer must not contain a query", "INVALID_METADATA");
+  for (const { url: url2 } of buildDiscoveryUrls(issuer)) {
+    const response = await oauthFetch(url2.toString(), { headers: { Accept: "application/json" } });
+    if ([404, 405].includes(response.status)) continue;
+    if (!response.ok)
       throw new OAuthError2(
-        `Failed to fetch authorization server metadata: ${response.status}`,
+        `Metadata request failed (${response.status})`,
         "METADATA_DISCOVERY_FAILED"
       );
-    }
-    const metadata = await response.json();
-    if (!metadata.authorization_endpoint || !metadata.token_endpoint) {
+    const parsed = OAuthMetadataSchema.safeParse(await response.json());
+    if (!parsed.success || parsed.data.issuer !== authorizationServerUrl) {
       throw new OAuthError2(
-        "Authorization server metadata missing required endpoints",
+        "Authorization metadata has an invalid or mismatched issuer",
         "INVALID_METADATA"
       );
     }
-    logger.oauth("Authorization server metadata discovered successfully");
+    const metadata = parsed.data;
+    validateOAuthUrl(metadata.issuer);
+    validateOAuthUrl(metadata.authorization_endpoint);
+    validateOAuthUrl(metadata.token_endpoint);
+    if (metadata.registration_endpoint) validateOAuthUrl(metadata.registration_endpoint);
     return metadata;
-  } catch (error51) {
-    if (error51 instanceof OAuthError2) {
-      throw error51;
-    }
-    throw new OAuthError2(
-      `Error discovering authorization server metadata: ${error51 instanceof Error ? error51.message : String(error51)}`,
-      "METADATA_DISCOVERY_ERROR"
-    );
   }
+  throw new OAuthError2("No authorization server metadata found", "METADATA_DISCOVERY_FAILED");
 }
-async function discoverProtectedResourceMetadata(resourceUrl) {
-  try {
-    const url2 = new URL(resourceUrl);
-    const metadataUrl = new URL("/.well-known/oauth-protected-resource", url2.origin);
-    logger.oauth(`Discovering protected resource metadata: ${metadataUrl}`);
-    const customHeaders = getCustomHeaders();
-    const response = await proxyFetch(metadataUrl.toString(), {
-      headers: {
-        Accept: "application/json",
-        ...customHeaders
-      }
-    });
-    if (!response.ok) {
+async function discoverProtectedResourceMetadata(resourceUrl, resourceMetadataUrl) {
+  const resource = validateOAuthUrl(resourceUrl);
+  const candidates = resourceMetadataUrl ? [{ url: resourceMetadataUrl, expected: resourceUrl }] : [
+    ...resource.pathname !== "/" ? [
+      {
+        url: `${resource.origin}/.well-known/oauth-protected-resource${resource.pathname}`,
+        expected: resourceUrl
+      }
+    ] : [],
+    {
+      url: `${resource.origin}/.well-known/oauth-protected-resource`,
+      expected: resource.pathname === "/" ? resourceUrl : resource.origin
+    }
+  ];
+  for (const candidate of candidates) {
+    const response = await oauthFetch(candidate.url, { headers: { Accept: "application/json" } });
+    if (!resourceMetadataUrl && [404, 405].includes(response.status)) continue;
+    if (!response.ok)
       throw new OAuthError2(
-        `Failed to fetch protected resource metadata: ${response.status}`,
+        `Resource metadata request failed (${response.status})`,
         "RESOURCE_METADATA_DISCOVERY_FAILED"
       );
-    }
-    const metadata = await response.json();
-    if (!metadata.authorization_servers || metadata.authorization_servers.length === 0) {
+    const parsed = OAuthProtectedResourceMetadataSchema.safeParse(await response.json());
+    if (!parsed.success || parsed.data.resource !== candidate.expected || !parsed.data.authorization_servers?.length) {
       throw new OAuthError2(
-        "Protected resource metadata missing authorization servers",
+        "Protected resource metadata has an invalid or mismatched resource",
         "INVALID_RESOURCE_METADATA"
       );
     }
-    logger.oauth("Protected resource metadata discovered successfully");
-    return metadata;
-  } catch (error51) {
-    if (error51 instanceof OAuthError2) {
-      throw error51;
-    }
-    throw new OAuthError2(
-      `Error discovering protected resource metadata: ${error51 instanceof Error ? error51.message : String(error51)}`,
-      "RESOURCE_METADATA_DISCOVERY_ERROR"
-    );
+    for (const issuer of parsed.data.authorization_servers) validateOAuthUrl(issuer);
+    return parsed.data;
   }
-}
-function parseWWWAuthenticateHeader(headerValue) {
-  const parts = headerValue.split(/\s+/);
-  const scheme = parts[0];
-  const result = { scheme };
-  const paramString = parts.slice(1).join(" ");
-  const paramMatches = paramString.matchAll(/(\w+)="([^"]+)"/g);
-  for (const match of paramMatches) {
-    const [, key, value] = match;
-    switch (key) {
-      case "realm":
-        result.realm = value;
-        break;
-      case "scope":
-        result.scope = value;
-        break;
-      case "error":
-        result.error = value;
-        break;
-      case "error_description":
-        result.error_description = value;
-        break;
-      case "error_uri":
-        result.error_uri = value;
-        break;
-      case "resource_metadata_url":
-        result.resource_metadata_url = value;
-        break;
-    }
-  }
-  return result;
+  throw new OAuthError2(
+    "No protected resource metadata found",
+    "RESOURCE_METADATA_DISCOVERY_FAILED"
+  );
 }
 async function registerDynamicClient(registrationEndpoint, registrationRequest) {
   try {
     logger.oauth(`Attempting dynamic client registration: ${registrationEndpoint}`);
-    const customHeaders = getCustomHeaders();
-    const response = await proxyFetch(registrationEndpoint, {
+    const response = await oauthFetch(registrationEndpoint, {
       method: "POST",
       headers: {
-        "Content-Type": "application/json",
-        ...customHeaders
+        "Content-Type": "application/json"
       },
       body: JSON.stringify(registrationRequest)
     });
@@ -77050,12 +77222,26 @@ async function registerDynamicClient(registrationEndpoint, registrationRequest)
       );
     }
     const registrationResponse = await response.json();
-    if (!registrationResponse.client_id) {
+    if (typeof registrationResponse.client_id !== "string" || !registrationResponse.client_id) {
       throw new OAuthError2(
         "Dynamic client registration response missing client_id",
         "INVALID_REGISTRATION_RESPONSE"
       );
     }
+    if (registrationResponse.token_endpoint_auth_method && registrationResponse.token_endpoint_auth_method !== registrationRequest.token_endpoint_auth_method) {
+      throw new OAuthError2(
+        "Authorization server changed the requested client authentication method",
+        "INVALID_REGISTRATION_RESPONSE"
+      );
+    }
+    if (registrationResponse.redirect_uris && (!Array.isArray(registrationResponse.redirect_uris) || !registrationRequest.redirect_uris.every(
+      (uri) => registrationResponse.redirect_uris.includes(uri)
+    ))) {
+      throw new OAuthError2(
+        "Authorization server changed the registered callback URI",
+        "INVALID_REGISTRATION_RESPONSE"
+      );
+    }
     logger.oauth("Dynamic client registration successful");
     logger.debug("Client ID obtained", "OAUTH", {
       client_id: registrationResponse.client_id,
@@ -77085,12 +77271,10 @@ async function exchangeAuthorizationCode(tokenEndpoint, code, redirectUri, clien
     if (resource) {
       params.set("resource", resource);
     }
-    const customHeaders = getCustomHeaders();
-    const response = await proxyFetch(tokenEndpoint, {
+    const response = await oauthFetch(tokenEndpoint, {
       method: "POST",
       headers: {
-        "Content-Type": "application/x-www-form-urlencoded",
-        ...customHeaders
+        "Content-Type": "application/x-www-form-urlencoded"
       },
       body: params.toString()
     });
@@ -77101,7 +77285,9 @@ async function exchangeAuthorizationCode(tokenEndpoint, code, redirectUri, clien
         "TOKEN_EXCHANGE_FAILED"
       );
     }
-    const tokenResponse = await response.json();
+    const tokenResponse = OAuthTokensSchema.parse(await response.json());
+    if (tokenResponse.token_type.toLowerCase() !== "bearer")
+      throw new OAuthError2("Unsupported token type", "INVALID_TOKEN_RESPONSE");
     if (!tokenResponse.access_token) {
       throw new OAuthError2("Token response missing access_token", "INVALID_TOKEN_RESPONSE");
     }
@@ -77130,15 +77316,18 @@ function buildAuthorizationUrl(authorizationEndpoint, clientId, redirectUri, sco
     // OAuth 2.1 uses authorization code flow
     client_id: clientId,
     redirect_uri: redirectUri,
-    scope: scopes.join(" "),
     state,
     code_challenge: codeChallenge,
     code_challenge_method: "S256"
   });
+  if (scopes.length) params.set("scope", scopes.join(" "));
   if (resource) {
     params.set("resource", resource);
   }
-  return `${authorizationEndpoint}?${params.toString()}`;
+  validateOAuthUrl(authorizationEndpoint);
+  const url2 = new URL(authorizationEndpoint);
+  params.forEach((value, key) => url2.searchParams.set(key, value));
+  return url2.toString();
 }
 function generateSecureState() {
   return crypto4.randomBytes(32).toString("base64url");
@@ -77219,110 +77408,26 @@ var AUTHORIZATION_CODE_HTML = `
     </div>
 
     <script>
-        function displayStatus(message, type = 'loading') {
-            const statusEl = document.getElementById('status');
-            const spinnerEl = document.getElementById('spinner');
-            
-            statusEl.textContent = message;
-            statusEl.className = type;
-            
-            if (type !== 'loading') {
-                spinnerEl.style.display = 'none';
-            }
-        }
-
-        function displayDetails(message) {
-            document.getElementById('details').textContent = message;
-        }
-
-        // Handle both OAuth 2.1 authorization code flow and implicit flow
-        const urlParams = new URLSearchParams(window.location.search);
-        const hashParams = new URLSearchParams(window.location.hash.substring(1));
-
-        // Check for authorization code first (OAuth 2.1 flow)
-        if (urlParams.has('code')) {
-            const authData = {
-                code: urlParams.get('code'),
-                state: urlParams.get('state'),
-                // Additional parameters for validation
-                iss: urlParams.get('iss'),
-            };
-
-            // Send authorization code to server for token exchange
-            fetch('/oauth/callback', {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/json'
-                },
-                body: JSON.stringify(authData)
-            })
-            .then(response => {
-                if (response.ok) {
-                    displayStatus('\u2705 Authorization successful!', 'success');
-                    displayDetails('You can safely close this window.');
-                } else {
-                    return response.json().then(err => {
-                        throw new Error(err.error || 'Failed to exchange authorization code');
-                    });
-                }
-            })
-            .catch(error => {
-                displayStatus('\u274C Error completing authorization', 'error');
-                displayDetails(error.message + '. Please try again.');
-            });
-        } 
-        // Check for access token in URL fragment (implicit flow)
-        else if (hashParams.has('access_token')) {
-            const tokens = {
-                access_token: hashParams.get('access_token'),
-                token_type: hashParams.get('token_type') || 'Bearer',
-                expires_in: hashParams.get('expires_in') ? parseInt(hashParams.get('expires_in')) : 3600,
-                scope: hashParams.get('scope'),
-                state: hashParams.get('state'),
-                obtained_at: Date.now()
-            };
-
-            // Send tokens to server for storage
-            fetch('/oauth/tokens', {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/json'
-                },
-                body: JSON.stringify(tokens)
-            })
-            .then(response => {
-                if (response.ok) {
-                    displayStatus('\u2705 Authorization successful!', 'success');
-                    displayDetails('You can safely close this window.');
-                } else {
-                    return response.json().then(err => {
-                        throw new Error(err.error || 'Failed to store access token');
-                    });
-                }
-            })
-            .catch(error => {
-                displayStatus('\u274C Error completing authorization', 'error');
-                displayDetails(error.message + '. Please try again.');
-            });
-        } 
-        // Check for errors in query parameters
-        else if (urlParams.has('error')) {
-            const error = urlParams.get('error');
-            const errorDescription = urlParams.get('error_description');
-            displayStatus('\u274C Authorization failed', 'error');
-            displayDetails(\`Error: \${error}\${errorDescription ? ' - ' + errorDescription : ''}\`);
-        } 
-        // Check for errors in URL fragment (implicit flow errors)
-        else if (hashParams.has('error')) {
-            const error = hashParams.get('error');
-            const errorDescription = hashParams.get('error_description');
-            displayStatus('\u274C Authorization failed', 'error');
-            displayDetails(\`Error: \${error}\${errorDescription ? ' - ' + errorDescription : ''}\`);
-        } 
-        // No authorization code or access token found
-        else {
-            displayStatus('\u274C No authorization code or access token received', 'error');
-            displayDetails('Please try the authorization process again.');
+        const query = new URLSearchParams(window.location.search);
+        const fragment = new URLSearchParams(window.location.hash.substring(1));
+        const status = document.getElementById('status');
+        const details = document.getElementById('details');
+        const data = Object.fromEntries(query.has('code') || query.has('error') ? query : fragment);
+        const endpoint = data.access_token ? '/oauth/tokens' : '/oauth/callback';
+        if (data.code || data.error || data.access_token) {
+            fetch(endpoint, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(data) })
+                .then(async response => {
+                    const result = await response.json();
+                    if (!response.ok) throw new Error(result.error || 'Authorization response was rejected');
+                    status.textContent = data.access_token ? 'Authorization successful' : 'Authorization code received';
+                    status.className = 'success';
+                    details.textContent = data.access_token ? 'You can close this window.' : 'Return to your app to check the connection. Token exchange may still fail.';
+                })
+                .catch(error => { status.textContent = 'Authorization failed'; status.className = 'error'; details.textContent = error.message; })
+                .finally(() => { document.getElementById('spinner').style.display = 'none'; });
+        } else {
+            status.textContent = 'No authorization response received';
+            document.getElementById('spinner').style.display = 'none';
         }
     </script>
 </body>
@@ -77337,6 +77442,17 @@ var OAuthCallbackServer = class {
     this.setupRoutes();
   }
   setupRoutes() {
+    this.app.use((req, res, next) => {
+      const host = this.options.host === "::1" ? "[::1]" : this.options.host;
+      const origin = req.headers.origin;
+      const port = this.server?.address();
+      const expectedOrigin = `http://${host}:${port && typeof port !== "string" ? port.port : this.options.port}`;
+      if (req.hostname !== host || origin && origin !== expectedOrigin) {
+        res.status(403).json({ error: "Untrusted callback origin" });
+        return;
+      }
+      next();
+    });
     this.app.use(import_express.default.json());
     this.app.get("/oauth/callback", (req, res) => {
       logger.oauth("OAuth 2.1 authorization callback page requested");
@@ -77344,46 +77460,47 @@ var OAuthCallbackServer = class {
     });
     this.app.post("/oauth/callback", async (req, res) => {
       try {
-        const { code, state, iss } = req.body;
-        if (!code) {
-          throw new OAuthError2("No authorization code received");
-        }
-        logger.oauth("OAuth 2.1 authorization code received");
-        logger.debug("Authorization code details", "OAUTH", {
-          codeLength: code.length,
-          state: state || "none",
-          issuer: iss || "none"
-        });
+        const { code, state, iss, error: error51 } = req.body;
+        this.validateResponse(state, iss);
+        if (error51) throw new OAuthError2("Authorization denied or failed", "AUTH_DENIED");
+        if (this.options.flow === "implicit")
+          throw new OAuthError2("Authorization-code callback is disabled", "WRONG_FLOW");
+        if (typeof code !== "string" || !code)
+          throw new OAuthError2("No authorization code received", "INVALID_CODE");
         this.events.emit("oauth-code-received", { code, state, iss });
-        res.json({ success: true, message: "Authorization code received successfully" });
+        res.json({
+          success: true,
+          message: "Authorization code received; check connection status in the app"
+        });
       } catch (error51) {
-        logger.error("Error processing authorization code", "OAUTH", error51);
-        const errorMessage = error51 instanceof Error ? error51.message : "Unknown error";
-        this.events.emit("oauth-error", new OAuthError2(errorMessage));
-        res.status(400).json({ error: errorMessage });
+        const failure = error51 instanceof OAuthError2 ? error51 : new OAuthError2("Invalid authorization response");
+        if (failure.code !== "INVALID_STATE") this.events.emit("oauth-error", failure);
+        res.status(400).json({ error: failure.message });
       }
     });
     this.app.post("/oauth/tokens", async (req, res) => {
+      if (this.options.flow !== "implicit") {
+        res.status(404).json({ error: "Implicit token callback is disabled" });
+        return;
+      }
       try {
-        const tokens = req.body;
-        if (!tokens.access_token) {
-          throw new OAuthError2("No access token received");
-        }
-        logger.oauth("Legacy OAuth tokens received (implicit flow)");
-        logger.debug("Token details", "OAUTH", {
-          tokenType: tokens.token_type,
-          expiresIn: tokens.expires_in,
-          scope: tokens.scope,
-          tokenLength: tokens.access_token.length
-        });
+        this.validateResponse(req.body.state, req.body.iss);
+        if (typeof req.body.access_token !== "string" || !req.body.access_token || req.body.token_type && req.body.token_type.toLowerCase() !== "bearer")
+          throw new OAuthError2("Invalid implicit token response");
+        const tokens = {
+          access_token: req.body.access_token,
+          token_type: "Bearer",
+          expires_in: req.body.expires_in === void 0 ? void 0 : Number(req.body.expires_in),
+          scope: req.body.scope,
+          obtained_at: Date.now()
+        };
         await writeTokens(this.options.serverUrlHash, tokens);
         this.events.emit("oauth-success", tokens);
-        res.json({ success: true, message: "Tokens saved successfully" });
+        res.json({ success: true });
       } catch (error51) {
-        logger.error("Error processing OAuth tokens", "OAUTH", error51);
-        const errorMessage = error51 instanceof Error ? error51.message : "Unknown error";
-        this.events.emit("oauth-error", new OAuthError2(errorMessage));
-        res.status(400).json({ error: errorMessage });
+        const failure = error51 instanceof OAuthError2 ? error51 : new OAuthError2("Invalid implicit response");
+        if (failure.code !== "INVALID_STATE") this.events.emit("oauth-error", failure);
+        res.status(400).json({ error: failure.message });
       }
     });
     this.app.get("/oauth/health", (req, res) => {
@@ -77400,21 +77517,33 @@ var OAuthCallbackServer = class {
       }
     );
   }
+  validateResponse(state, issuer) {
+    if (!this.options.state || state !== this.options.state)
+      throw new OAuthError2("Invalid callback state", "INVALID_STATE");
+    if ((issuer !== void 0 || this.options.requireIssuer) && issuer !== this.options.issuer)
+      throw new OAuthError2("Invalid callback issuer", "INVALID_ISSUER");
+  }
   async start() {
     return new Promise((resolve, reject) => {
       try {
-        this.server = this.app.listen(this.options.port, this.options.host, () => {
+        this.server = this.app.listen(this.options.port, this.options.host, (error51) => {
+          clearTimeout(this.startupTimer);
+          if (error51) {
+            reject(error51);
+            return;
+          }
           logger.oauth(
             `OAuth callback server listening on http://${this.options.host}:${this.options.port}`
           );
           resolve();
         });
         this.server.on("error", (error51) => {
+          clearTimeout(this.startupTimer);
           logger.error("OAuth callback server error", "OAUTH", error51);
           reject(error51);
         });
         if (this.options.timeout) {
-          setTimeout(() => {
+          this.startupTimer = setTimeout(() => {
             if (!this.server?.listening) {
               reject(new OAuthError2("OAuth callback server startup timeout", "TIMEOUT"));
             }
@@ -77426,6 +77555,7 @@ var OAuthCallbackServer = class {
     });
   }
   async stop() {
+    clearTimeout(this.startupTimer);
     if (!this.server) return;
     const server = this.server;
     this.server = null;
@@ -77457,7 +77587,9 @@ var MCPOAuthProvider = class {
     this.authServerMetadata = null;
     this.resourceMetadata = null;
     const serverUrl = options.serverUrl || CONFIG.WP_API_URL;
-    const defaultScopes = getDefaultOAuthScopes();
+    const defaultScopes = CONFIG.OAUTH_SCOPES ? getDefaultOAuthScopes() : [];
+    this.explicitScopes = options.scopes ?? defaultScopes;
+    this.configuredClientId = options.clientId || CONFIG.WP_OAUTH_CLIENT_ID || void 0;
     this.config = {
       serverUrl,
       resource: generateCanonicalResourceURI(serverUrl),
@@ -77516,187 +77648,217 @@ var MCPOAuthProvider = class {
   /**
    * Discover OAuth 2.1 server endpoints using MCP-compliant discovery
    */
-  async discoverOAuthEndpoints() {
-    try {
-      logger.oauth("Starting MCP-compliant OAuth endpoint discovery");
-      try {
-        this.resourceMetadata = await discoverProtectedResourceMetadata(this.config.resource);
-        logger.oauth("Protected resource metadata discovered");
-      } catch (error51) {
-        logger.warn(
-          "Protected resource metadata discovery failed, trying 401 response method",
-          "OAUTH"
-        );
-        await this.discoverVia401Response();
-      }
-      const authServerUrl = this.getAuthorizationServerUrl();
-      if (authServerUrl) {
-        this.authServerMetadata = await discoverAuthorizationServerMetadata(authServerUrl);
-        logger.oauth("Authorization server metadata discovered");
-        this.config.authorizationEndpoint = this.authServerMetadata.authorization_endpoint;
-        this.config.tokenEndpoint = this.authServerMetadata.token_endpoint;
-        this.config.registrationEndpoint = this.authServerMetadata.registration_endpoint;
-      } else {
-        throw new OAuthError2("Could not determine authorization server URL", "DISCOVERY_FAILED");
-      }
-    } catch (error51) {
-      logger.error("OAuth endpoint discovery failed", "OAUTH", error51);
-      throw error51;
-    }
-  }
-  /**
-   * Discover endpoints via 401 Unauthorized response (RFC 9728 Section 5.1)
-   */
-  async discoverVia401Response() {
-    try {
-      logger.oauth("Attempting discovery via 401 response method");
-      const customHeaders = getCustomHeaders();
-      const response = await proxyFetch(this.config.serverUrl, {
-        headers: {
-          Accept: "application/json",
-          ...customHeaders
-        }
-      });
-      if (response.status === 401) {
-        const wwwAuthHeader = response.headers.get("WWW-Authenticate");
-        if (wwwAuthHeader) {
-          const authInfo = parseWWWAuthenticateHeader(wwwAuthHeader);
-          logger.oauth("WWW-Authenticate header parsed successfully");
-          if (authInfo.resource_metadata_url) {
-            const metadataResponse = await proxyFetch(authInfo.resource_metadata_url, {
-              headers: {
-                Accept: "application/json",
-                ...customHeaders
-              }
-            });
-            if (metadataResponse.ok) {
-              this.resourceMetadata = await metadataResponse.json();
-              logger.oauth("Protected resource metadata obtained via 401 response");
-            }
-          }
-        }
-      }
-    } catch (error51) {
-      logger.warn("401 response discovery method failed", "OAUTH", error51);
-    }
+  async discoverOAuthEndpoints(challenge) {
+    this.resourceMetadata = await discoverProtectedResourceMetadata(
+      this.config.serverUrl,
+      challenge?.resource_metadata
+    );
+    this.authServerMetadata = await discoverAuthorizationServerMetadata(
+      this.resourceMetadata.authorization_servers[0]
+    );
+    this.config.resource = this.resourceMetadata.resource;
+    this.config.authorizationEndpoint = this.authServerMetadata.authorization_endpoint;
+    this.config.tokenEndpoint = this.authServerMetadata.token_endpoint;
+    this.config.registrationEndpoint = this.authServerMetadata.registration_endpoint;
+    this.config.clientId = this.configuredClientId;
+    const challenged = challenge?.scope?.split(/\s+/).filter(Boolean);
+    this.config.scopes = [
+      ...new Set(
+        challenged ?? (this.explicitScopes.length ? this.explicitScopes : this.resourceMetadata.scopes_supported ?? [])
+      )
+    ];
   }
-  /**
-   * Get authorization server URL from discovered metadata
-   */
   getAuthorizationServerUrl() {
-    if (this.resourceMetadata?.authorization_servers?.length) {
-      return this.resourceMetadata.authorization_servers[0];
-    }
-    try {
-      const url2 = new URL(this.config.serverUrl);
-      return url2.origin;
-    } catch {
-      return null;
-    }
+    return this.authServerMetadata?.issuer ?? this.resourceMetadata?.authorization_servers[0] ?? new URL(this.config.serverUrl).origin;
   }
   /**
    * Perform dynamic client registration if needed and supported
    */
   async ensureClientRegistration() {
+    const issuer = this.getAuthorizationServerUrl();
+    const stored = await readClientInfo(this.serverUrlHash);
     if (this.config.clientId) {
-      logger.oauth("Using provided client ID, skipping dynamic registration");
+      if (stored?.issuer && stored.issuer !== issuer && stored.client_id === this.config.clientId) {
+        throw new OAuthError2(
+          "Configured client belongs to another authorization server; update its registration",
+          "CLIENT_ISSUER_MISMATCH"
+        );
+      }
+      await writeClientInfo(this.serverUrlHash, { client_id: this.config.clientId, issuer });
       return;
     }
-    const storedClientInfo = await readClientInfo(this.serverUrlHash);
-    if (typeof storedClientInfo?.client_id === "string" && storedClientInfo.client_id.length > 0) {
-      this.config.clientId = storedClientInfo.client_id;
-      logger.oauth("Reusing persisted client registration, skipping dynamic registration");
+    if (stored?.issuer === issuer && typeof stored.client_id === "string" && stored.client_id.length > 0) {
+      this.config.clientId = stored.client_id;
       return;
     }
-    if (!CONFIG.OAUTH_DYNAMIC_REGISTRATION) {
+    if (!CONFIG.OAUTH_DYNAMIC_REGISTRATION)
       throw new OAuthError2(
-        "No client ID provided and dynamic registration is disabled",
+        "No issuer-bound client registration; configure a client ID or enable registration",
         "NO_CLIENT_ID"
       );
-    }
-    if (!this.authServerMetadata?.registration_endpoint) {
+    if (!this.authServerMetadata?.registration_endpoint)
       throw new OAuthError2(
-        "Dynamic client registration not supported by authorization server",
+        "Authorization server does not support dynamic registration; configure its client ID",
         "NO_DYNAMIC_REGISTRATION"
       );
-    }
-    try {
-      logger.oauth("Performing dynamic client registration");
-      const registrationRequest = {
-        redirect_uris: [this.config.redirectUri],
-        token_endpoint_auth_method: "none",
-        // Public client
-        grant_types: ["authorization_code"],
-        response_types: ["code"],
-        client_name: "WordPress MCP Remote",
-        scope: this.config.scopes.join(" ")
-      };
-      const registrationResponse = await registerDynamicClient(
-        this.authServerMetadata.registration_endpoint,
-        registrationRequest
-      );
-      const clientInfo = {
-        client_id: registrationResponse.client_id,
-        client_secret: registrationResponse.client_secret
-      };
-      await writeClientInfo(this.serverUrlHash, clientInfo);
-      this.config.clientId = registrationResponse.client_id;
-      logger.oauth("Dynamic client registration completed successfully");
-    } catch (error51) {
-      logger.error("Dynamic client registration failed", "OAUTH", error51);
-      throw error51;
-    }
+    const request = {
+      redirect_uris: [this.config.redirectUri],
+      application_type: "native",
+      token_endpoint_auth_method: "none",
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"],
+      client_name: "WordPress MCP Remote",
+      ...this.config.scopes.length ? { scope: this.config.scopes.join(" ") } : {}
+    };
+    const registered = await registerDynamicClient(
+      this.authServerMetadata.registration_endpoint,
+      request
+    );
+    await writeClientInfo(this.serverUrlHash, {
+      ...request,
+      client_id: registered.client_id,
+      issuer
+    });
+    this.config.clientId = registered.client_id;
   }
   /**
    * Initiate MCP-compliant OAuth 2.1 authorization flow
    */
-  async authorize() {
-    if (this.authPromise) {
-      logger.oauth("Authorization already in progress, waiting...");
-      await this.authPromise;
-      return;
-    }
-    const existingTokens = await this.tokens();
-    if (existingTokens) {
-      logger.oauth("Already have valid tokens, skipping authorization");
-      return;
+  satisfies(tokens, request) {
+    return !!tokens && tokens.access_token !== request.rejectedToken && (!request.scopes?.length || request.scopes.every((scope) => tokens.scope?.split(" ").includes(scope)));
+  }
+  async authorize(request = {}) {
+    if (this.authPromise) await this.authPromise;
+    if (!this.authPromise) this.authPromise = this.authorizeWithLock(request);
+    const pending = this.authPromise;
+    try {
+      await pending;
+    } finally {
+      if (this.authPromise === pending) this.authPromise = null;
     }
-    logger.oauth("Starting MCP-compliant OAuth 2.1 authorization flow");
-    this.authPromise = this.performAuthorization();
+  }
+  async authorizeWithLock(request) {
+    const valid = await this.tokens();
+    if (this.satisfies(valid, request)) return valid;
+    await ensureConfigDir();
+    const file2 = getConfigFilePath(this.serverUrlHash, "oauth");
+    let release;
     try {
-      await this.authPromise;
-      logger.oauth("OAuth 2.1 authorization completed successfully");
+      release = await lockfile.lock(file2, { realpath: false });
     } catch (error51) {
-      logger.error("OAuth 2.1 authorization failed", "OAUTH", error51);
-      throw error51;
+      if (error51.code !== "ELOCKED") throw error51;
+      const deadline = Date.now() + this.config.timeout;
+      while (Date.now() < deadline) {
+        const tokens = await this.tokens();
+        if (this.satisfies(tokens, request)) return tokens;
+        if (!await lockfile.check(file2, { realpath: false })) {
+          const completed = await this.tokens();
+          if (this.satisfies(completed, request)) return completed;
+          throw new OAuthError2("Authentication in another process did not complete", "AUTH_FAILED");
+        }
+        await delay(Math.min(100, Math.max(0, deadline - Date.now())));
+      }
+      throw new OAuthError2("Timeout waiting for authentication in another process", "LOCK_TIMEOUT");
+    }
+    try {
+      const completed = await this.tokens();
+      if (this.satisfies(completed, request)) return completed;
+      await this.discoverOAuthEndpoints(request.challenge);
+      const issuer = this.getAuthorizationServerUrl();
+      const stored = await readTokens(this.serverUrlHash);
+      const client = await readClientInfo(this.serverUrlHash);
+      if (this.configuredClientId && client?.issuer && client.issuer !== issuer && client.client_id === this.configuredClientId) {
+        throw new OAuthError2(
+          "Configured client belongs to another authorization server",
+          "CLIENT_ISSUER_MISMATCH"
+        );
+      }
+      this.config.scopes = [
+        .../* @__PURE__ */ new Set([
+          ...stored?.issuer === issuer ? stored.scope?.split(" ").filter(Boolean) ?? [] : [],
+          ...this.config.scopes,
+          ...request.scopes ?? []
+        ])
+      ];
+      const needsScope = !!request.scopes?.some(
+        (scope) => !stored?.scope?.split(" ").includes(scope)
+      );
+      const clientId = this.configuredClientId || client?.client_id;
+      if (stored?.issuer === issuer && client?.issuer === issuer && stored.refresh_token && clientId && (!this.configuredClientId || this.configuredClientId === client.client_id) && !needsScope) {
+        try {
+          const renewed = await refreshAuthorization(issuer, {
+            metadata: { ...this.authServerMetadata },
+            clientInformation: { client_id: clientId },
+            refreshToken: stored.refresh_token,
+            resource: this.resourceIndicator(),
+            fetchFn: (url2, init) => oauthFetch(String(url2), init)
+          });
+          if (renewed.token_type.toLowerCase() !== "bearer")
+            throw new OAuthError2("Unsupported token type", "INVALID_TOKEN_RESPONSE");
+          const tokens = {
+            ...renewed,
+            issuer,
+            scope: renewed.scope ?? stored.scope,
+            obtained_at: Date.now()
+          };
+          await writeTokens(this.serverUrlHash, tokens);
+          return tokens;
+        } catch (error51) {
+          if (!(error51 instanceof InvalidGrantError)) throw error51;
+          await deleteConfigFile(this.serverUrlHash, "tokens.json");
+        }
+      }
+      return await this.performAuthorization();
     } finally {
-      this.authPromise = null;
+      await release();
     }
   }
+  resourceIndicator() {
+    if (!CONFIG.OAUTH_RESOURCE_INDICATOR)
+      throw new OAuthError2(
+        "MCP OAuth requires resource indicators; remove OAUTH_RESOURCE_INDICATOR=false",
+        "RESOURCE_REQUIRED"
+      );
+    return this.config.resource;
+  }
   /**
    * Perform the complete OAuth 2.1 authorization flow
    */
   async performAuthorization() {
     try {
-      await this.discoverOAuthEndpoints();
-      const callbackPort = this.config.callbackPort === 0 ? await getOAuthCallbackPort() : this.config.callbackPort;
+      if (!this.authServerMetadata) await this.discoverOAuthEndpoints();
+      if (!this.authServerMetadata?.code_challenge_methods_supported?.includes("S256"))
+        throw new OAuthError2(
+          "Authorization server must advertise PKCE S256 support",
+          "PKCE_REQUIRED"
+        );
+      this.resourceIndicator();
+      if (!["127.0.0.1", "localhost", "::1"].includes(this.config.host))
+        throw new OAuthError2(
+          "Native OAuth callback must bind to loopback",
+          "INVALID_CALLBACK_HOST"
+        );
+      this.currentPKCE = generatePKCE();
+      this.currentState = generateSecureState();
+      const callbackPort = this.config.callbackPort === 0 ? await selectCallbackPort(this.config.serverUrl, void 0, false, this.config.host) : this.config.callbackPort;
       const callbackServer = setupWPOAuthCallbackServer(
         {
           port: callbackPort,
           host: this.config.host,
           serverUrlHash: this.serverUrlHash,
-          timeout: this.config.timeout
+          timeout: this.config.timeout,
+          state: this.currentState,
+          issuer: this.authServerMetadata.issuer,
+          requireIssuer: this.authServerMetadata.authorization_response_iss_parameter_supported
         },
         this.events
       );
       await callbackServer.start();
       logger.oauth("OAuth callback server started");
       try {
-        const actualRedirectUri = `http://${this.config.host}:${callbackPort}/oauth/callback`;
+        const actualRedirectUri = `http://${this.config.host === "::1" ? "[::1]" : this.config.host}:${callbackPort}/oauth/callback`;
         this.config.redirectUri = actualRedirectUri;
         await this.ensureClientRegistration();
-        this.currentPKCE = generatePKCE();
-        this.currentState = generateSecureState();
         await writeTextFile(this.serverUrlHash, "pkce_verifier.txt", this.currentPKCE.codeVerifier);
         await writeTextFile(this.serverUrlHash, "oauth_state.txt", this.currentState);
         const authUrl = buildAuthorizationUrl(
@@ -77706,10 +77868,13 @@ var MCPOAuthProvider = class {
           this.config.scopes,
           this.currentState,
           this.currentPKCE.codeChallenge,
-          CONFIG.OAUTH_RESOURCE_INDICATOR ? this.config.resource : void 0
+          this.resourceIndicator()
         );
         logger.oauth("Built OAuth 2.1 authorization URL");
         logger.debug("Authorization URL", "OAUTH", { url: authUrl });
+        const authorizationCode = this.waitForAuthorizationCode();
+        void authorizationCode.catch(() => {
+        });
         try {
           await open_default(authUrl);
           logger.oauth("Browser opened successfully");
@@ -77720,13 +77885,20 @@ var MCPOAuthProvider = class {
           logger.info(`${authUrl}`);
           logger.info("===============================\n");
         }
-        const authCode = await this.waitForAuthorizationCode();
-        const tokens = await this.exchangeCodeForTokens(authCode, actualRedirectUri);
+        const authCode = await authorizationCode;
+        const response = await this.exchangeCodeForTokens(authCode, actualRedirectUri);
+        const tokens = {
+          ...response,
+          issuer: this.getAuthorizationServerUrl(),
+          scope: response.scope ?? this.config.scopes.join(" ")
+        };
         await writeTokens(this.serverUrlHash, tokens);
         logger.oauth("OAuth 2.1 tokens stored successfully");
         return tokens;
       } finally {
         await callbackServer.stop();
+        await deleteConfigFile(this.serverUrlHash, "pkce_verifier.txt");
+        await deleteConfigFile(this.serverUrlHash, "oauth_state.txt");
       }
     } catch (error51) {
       logger.error("Error during OAuth 2.1 authorization flow", "OAUTH", error51);
@@ -77747,12 +77919,16 @@ var MCPOAuthProvider = class {
         this.events.removeAllListeners("oauth-error");
         clearTimeout(timeout);
       };
-      this.events.once("oauth-code-received", async ({ code, state }) => {
+      this.events.once("oauth-code-received", async ({ code, state, iss }) => {
         cleanup();
         if (state !== this.currentState) {
           reject(new OAuthError2("State parameter mismatch", "INVALID_STATE"));
           return;
         }
+        if ((iss !== void 0 || this.authServerMetadata?.authorization_response_iss_parameter_supported) && iss !== this.authServerMetadata?.issuer) {
+          reject(new OAuthError2("Authorization response issuer mismatch", "INVALID_ISSUER"));
+          return;
+        }
         logger.oauth("Valid authorization code received");
         resolve(code);
       });
@@ -77778,7 +77954,7 @@ var MCPOAuthProvider = class {
         redirectUri,
         this.config.clientId,
         codeVerifier,
-        CONFIG.OAUTH_RESOURCE_INDICATOR ? this.config.resource : void 0
+        this.resourceIndicator()
       );
       await deleteConfigFile(this.serverUrlHash, "pkce_verifier.txt");
       await deleteConfigFile(this.serverUrlHash, "oauth_state.txt");
@@ -77844,6 +78020,7 @@ import * as path5 from "node:path";
 import * as os3 from "node:os";
 
 // src/lib/persistent-oauth-client-provider.ts
+import { randomBytes } from "node:crypto";
 import { EventEmitter as EventEmitter2 } from "node:events";
 var PersistentWPOAuthClientProvider = class {
   constructor(options) {
@@ -78001,7 +78178,10 @@ var PersistentWPOAuthClientProvider = class {
    */
   async performAuthorization() {
     const callbackPort = this.options.callbackPort === 0 ? await getOAuthCallbackPort() : this.options.callbackPort;
+    const state = this.generateState();
     const callbackServerOptions = {
+      flow: "implicit",
+      state,
       port: callbackPort,
       host: this.options.host,
       serverUrlHash: this.serverUrlHash,
@@ -78013,12 +78193,14 @@ var PersistentWPOAuthClientProvider = class {
       logger.oauth("Starting callback server...");
       await callbackServer.start();
       logger.oauth("Callback server started successfully");
-      const state = this.generateState();
       logger.debug(`Generated state parameter: ${state}`, "OAUTH");
       const authUrl = this.buildAuthorizationUrl(callbackServer.getCallbackUrl(), state);
       logger.oauth(`Built authorization URL: ${authUrl}`);
       logger.debug(`Callback URL: ${callbackServer.getCallbackUrl()}`, "OAUTH");
       logger.oauth("Attempting to open browser...");
+      const authorization = this.waitForAuthorizationResult();
+      void authorization.catch(() => {
+      });
       try {
         await open_default(authUrl);
         logger.oauth("Browser opened successfully");
@@ -78030,7 +78212,7 @@ var PersistentWPOAuthClientProvider = class {
         logger.info("===============================\n");
       }
       logger.oauth("Waiting for authorization result...");
-      const tokens = await this.waitForAuthorizationResult();
+      const tokens = await authorization;
       logger.oauth("Authorization result received");
       logger.oauth("Saving tokens to persistent storage...");
       await this.saveTokens(tokens);
@@ -78083,7 +78265,7 @@ var PersistentWPOAuthClientProvider = class {
    * Generate a secure state parameter
    */
   generateState() {
-    return Math.random().toString(36).substring(2, 15) + Math.random().toString(36).substring(2, 15);
+    return randomBytes(32).toString("base64url");
   }
   /**
    * Wait for authorization result from callback server
@@ -78506,6 +78688,12 @@ function constructApiUrl(baseUrl, defaultEndpoint) {
     return new URL(`/?rest_route=${defaultEndpoint}`, cleanUrl).toString();
   }
 }
+function getMCPOAuthProvider() {
+  return mcpOAuthProvider ??= new MCPOAuthProvider({
+    serverUrl: getRequestUrl(),
+    clientId: CONFIG.WP_OAUTH_CLIENT_ID
+  });
+}
 async function getOAuthTokens() {
   try {
     if (!CONFIG.OAUTH_ENABLED) {
@@ -78513,7 +78701,7 @@ async function getOAuthTokens() {
       return null;
     }
     logger.auth("Attempting to get OAuth tokens for WordPress API (MCP-compliant)...");
-    const serverUrl = CONFIG.WP_API_URL;
+    const serverUrl = getRequestUrl();
     const serverUrlHash = generateServerUrlHash(serverUrl);
     const existingTokens = await getValidTokens(serverUrlHash);
     if (existingTokens) {
@@ -78524,16 +78712,10 @@ async function getOAuthTokens() {
     logger.auth("Starting MCP-compliant OAuth 2.1 authentication flow");
     logger.auth("Your browser should open automatically for authentication");
     if (CONFIG.OAUTH_FLOW_TYPE === "authorization_code" && CONFIG.OAUTH_USE_PKCE) {
-      if (!mcpOAuthProvider) {
-        mcpOAuthProvider = new MCPOAuthProvider({
-          serverUrl,
-          clientId: CONFIG.WP_OAUTH_CLIENT_ID,
-          scopes: getDefaultOAuthScopes()
-        });
-      }
       logger.auth("Using MCP-compliant OAuth 2.1 authorization code flow with PKCE");
-      await mcpOAuthProvider.authorize();
-      const tokens = await mcpOAuthProvider.tokens();
+      const provider = getMCPOAuthProvider();
+      await provider.authorize();
+      const tokens = await provider.tokens();
       if (tokens) {
         logger.auth("MCP OAuth 2.1 tokens obtained for WordPress API access");
         return tokens;
@@ -78630,7 +78812,7 @@ function updateSessionId(sessionId) {
   globalSessionId = sessionId;
   logger.info(`Session ID received from WordPress: ${globalSessionId}`, "SESSION");
 }
-async function getWordPressHeaders(requestData) {
+async function getWordPressHeaders(requestData, options = {}) {
   validateEnvironment();
   let authHeader = "";
   if (CONFIG.JWT_TOKEN) {
@@ -78639,7 +78821,7 @@ async function getWordPressHeaders(requestData) {
     logger.debug(`Token length: ${CONFIG.JWT_TOKEN.length}`, "AUTH");
   } else if (CONFIG.OAUTH_ENABLED) {
     logger.auth("OAuth is the primary authentication method - attempting to get tokens...");
-    const oauthTokens = await getOAuthTokens();
+    const oauthTokens = options.allowUnauthenticated && !CONFIG.WP_API_USERNAME ? await getValidTokens(generateServerUrlHash(getRequestUrl())) : await getOAuthTokens();
     if (oauthTokens) {
       authHeader = `Bearer ${oauthTokens.access_token}`;
       logger.auth("Using OAuth token authentication for WordPress API");
@@ -78679,7 +78861,7 @@ async function getWordPressHeaders(requestData) {
     if (name.toLowerCase() === "mcp-protocol-version") delete customHeaders[name];
   }
   const hasCustomHeaders = Object.keys(customHeaders).length > 0;
-  if (!authHeader && !hasCustomHeaders) {
+  if (!authHeader && !hasCustomHeaders && !(options.allowUnauthenticated && CONFIG.OAUTH_ENABLED)) {
     throw new AuthError(
       "No authentication method available. Please configure JWT_TOKEN, OAuth, Basic Auth (WP_API_USERNAME+WP_API_PASSWORD), or CUSTOM_HEADERS.",
       "NO_AUTH_METHOD"