@automattic/mcp-wordpress-remote 0.5.1 → 0.5.3

package/dist/proxy.js

@@ -4939,7 +4939,7 @@ async function toFormData(Body2, ct) {
   let headerValue2;
   let entryValue;
   let entryName;
-  let contentType;
+  let contentType2;
   let filename;
   const entryChunks = [];
   const formData = new FormData();
@@ -4950,7 +4950,7 @@ async function toFormData(Body2, ct) {
     entryChunks.push(ui8a);
   };
   const appendFileToFormData = () => {
-    const file2 = new file_default(entryChunks, filename, { type: contentType });
+    const file2 = new file_default(entryChunks, filename, { type: contentType2 });
     formData.append(entryName, file2);
   };
   const appendEntryToFormData = () => {
@@ -4965,7 +4965,7 @@ async function toFormData(Body2, ct) {
     headerValue2 = "";
     entryValue = "";
     entryName = "";
-    contentType = "";
+    contentType2 = "";
     filename = null;
     entryChunks.length = 0;
   };
@@ -4989,7 +4989,7 @@ async function toFormData(Body2, ct) {
         parser.onPartEnd = appendFileToFormData;
       }
     } else if (headerField === "content-type") {
-      contentType = headerValue2;
+      contentType2 = headerValue2;
     }
     headerValue2 = "";
     headerField = "";
@@ -5749,9 +5749,9 @@ var init_response = __esm({
         const status = options.status != null ? options.status : 200;
         const headers = new Headers2(options.headers);
         if (body !== null && !headers.has("Content-Type")) {
-          const contentType = extractContentType(body, this);
-          if (contentType) {
-            headers.append("Content-Type", contentType);
+          const contentType2 = extractContentType(body, this);
+          if (contentType2) {
+            headers.append("Content-Type", contentType2);
           }
         }
         this[INTERNALS2] = {
@@ -6073,9 +6073,9 @@ var init_request = __esm({
         });
         const headers = new Headers2(init.headers || input.headers || {});
         if (inputBody !== null && !headers.has("Content-Type")) {
-          const contentType = extractContentType(inputBody, this);
-          if (contentType) {
-            headers.set("Content-Type", contentType);
+          const contentType2 = extractContentType(inputBody, this);
+          if (contentType2) {
+            headers.set("Content-Type", contentType2);
           }
         }
         let signal = isRequest(input) ? input.signal : null;
@@ -6547,6 +6547,110 @@ var init_src = __esm({
   }
 });
 
+// node_modules/content-type/index.js
+var require_content_type = __commonJS({
+  "node_modules/content-type/index.js"(exports) {
+    "use strict";
+    var PARAM_REGEXP = /; *([!#$%&'*+.^_`|~0-9A-Za-z-]+) *= *("(?:[\u000b\u0020\u0021\u0023-\u005b\u005d-\u007e\u0080-\u00ff]|\\[\u000b\u0020-\u00ff])*"|[!#$%&'*+.^_`|~0-9A-Za-z-]+) */g;
+    var TEXT_REGEXP = /^[\u000b\u0020-\u007e\u0080-\u00ff]+$/;
+    var TOKEN_REGEXP = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+    var QESC_REGEXP = /\\([\u000b\u0020-\u00ff])/g;
+    var QUOTE_REGEXP = /([\\"])/g;
+    var TYPE_REGEXP = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+\/[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+    exports.format = format;
+    exports.parse = parse3;
+    function format(obj) {
+      if (!obj || typeof obj !== "object") {
+        throw new TypeError("argument obj is required");
+      }
+      var parameters = obj.parameters;
+      var type = obj.type;
+      if (!type || !TYPE_REGEXP.test(type)) {
+        throw new TypeError("invalid type");
+      }
+      var string4 = type;
+      if (parameters && typeof parameters === "object") {
+        var param;
+        var params = Object.keys(parameters).sort();
+        for (var i2 = 0; i2 < params.length; i2++) {
+          param = params[i2];
+          if (!TOKEN_REGEXP.test(param)) {
+            throw new TypeError("invalid parameter name");
+          }
+          string4 += "; " + param + "=" + qstring(parameters[param]);
+        }
+      }
+      return string4;
+    }
+    function parse3(string4) {
+      if (!string4) {
+        throw new TypeError("argument string is required");
+      }
+      var header = typeof string4 === "object" ? getcontenttype(string4) : string4;
+      if (typeof header !== "string") {
+        throw new TypeError("argument string is required to be a string");
+      }
+      var index = header.indexOf(";");
+      var type = index !== -1 ? header.slice(0, index).trim() : header.trim();
+      if (!TYPE_REGEXP.test(type)) {
+        throw new TypeError("invalid media type");
+      }
+      var obj = new ContentType(type.toLowerCase());
+      if (index !== -1) {
+        var key;
+        var match;
+        var value;
+        PARAM_REGEXP.lastIndex = index;
+        while (match = PARAM_REGEXP.exec(header)) {
+          if (match.index !== index) {
+            throw new TypeError("invalid parameter format");
+          }
+          index += match[0].length;
+          key = match[1].toLowerCase();
+          value = match[2];
+          if (value.charCodeAt(0) === 34) {
+            value = value.slice(1, -1);
+            if (value.indexOf("\\") !== -1) {
+              value = value.replace(QESC_REGEXP, "$1");
+            }
+          }
+          obj.parameters[key] = value;
+        }
+        if (index !== header.length) {
+          throw new TypeError("invalid parameter format");
+        }
+      }
+      return obj;
+    }
+    function getcontenttype(obj) {
+      var header;
+      if (typeof obj.getHeader === "function") {
+        header = obj.getHeader("content-type");
+      } else if (typeof obj.headers === "object") {
+        header = obj.headers && obj.headers["content-type"];
+      }
+      if (typeof header !== "string") {
+        throw new TypeError("content-type header is missing from object");
+      }
+      return header;
+    }
+    function qstring(val) {
+      var str = String(val);
+      if (TOKEN_REGEXP.test(str)) {
+        return str;
+      }
+      if (str.length > 0 && !TEXT_REGEXP.test(str)) {
+        throw new TypeError("invalid parameter value");
+      }
+      return '"' + str.replace(QUOTE_REGEXP, "\\$1") + '"';
+    }
+    function ContentType(type) {
+      this.parameters = /* @__PURE__ */ Object.create(null);
+      this.type = type;
+    }
+  }
+});
+
 // node_modules/ms/index.js
 var require_ms = __commonJS({
   "node_modules/ms/index.js"(exports, module) {
@@ -21818,7 +21922,7 @@ var require_mime_types = __commonJS({
     var TEXT_TYPE_REGEXP = /^text\//i;
     exports.charset = charset;
     exports.charsets = { lookup: charset };
-    exports.contentType = contentType;
+    exports.contentType = contentType2;
     exports.extension = extension;
     exports.extensions = /* @__PURE__ */ Object.create(null);
     exports.lookup = lookup;
@@ -21839,7 +21943,7 @@ var require_mime_types = __commonJS({
       }
       return false;
     }
-    function contentType(str) {
+    function contentType2(str) {
       if (!str || typeof str !== "string") {
         return false;
       }
@@ -21981,7 +22085,7 @@ var require_media_typer = __commonJS({
 var require_type_is = __commonJS({
   "node_modules/type-is/index.js"(exports, module) {
     "use strict";
-    var contentType = require_dist();
+    var contentType2 = require_dist();
     var mime = require_mime_types();
     var typer = require_media_typer();
     module.exports = typeofrequest;
@@ -22062,7 +22166,7 @@ var require_type_is = __commonJS({
     }
     function normalizeType(value) {
       if (!value) return null;
-      var type = contentType.parse(value, { parameters: false }).type;
+      var type = contentType2.parse(value, { parameters: false }).type;
       return typer.test(type) ? type : null;
     }
   }
@@ -22212,7 +22316,7 @@ var require_utils = __commonJS({
   "node_modules/body-parser/lib/utils.js"(exports, module) {
     "use strict";
     var bytes = require_bytes();
-    var contentType = require_dist2();
+    var contentType2 = require_dist2();
     var typeis = require_type_is();
     module.exports = {
       getCharset,
@@ -22222,7 +22326,7 @@ var require_utils = __commonJS({
     function getCharset(req) {
       const header = req.headers["content-type"];
       if (!header) return void 0;
-      return contentType.parse(header).parameters.charset?.toLowerCase();
+      return contentType2.parse(header).parameters.charset?.toLowerCase();
     }
     function typeChecker(type) {
       return function checkType(req) {
@@ -25646,110 +25750,6 @@ var require_view = __commonJS({
   }
 });
 
-// node_modules/content-type/index.js
-var require_content_type = __commonJS({
-  "node_modules/content-type/index.js"(exports) {
-    "use strict";
-    var PARAM_REGEXP = /; *([!#$%&'*+.^_`|~0-9A-Za-z-]+) *= *("(?:[\u000b\u0020\u0021\u0023-\u005b\u005d-\u007e\u0080-\u00ff]|\\[\u000b\u0020-\u00ff])*"|[!#$%&'*+.^_`|~0-9A-Za-z-]+) */g;
-    var TEXT_REGEXP = /^[\u000b\u0020-\u007e\u0080-\u00ff]+$/;
-    var TOKEN_REGEXP = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
-    var QESC_REGEXP = /\\([\u000b\u0020-\u00ff])/g;
-    var QUOTE_REGEXP = /([\\"])/g;
-    var TYPE_REGEXP = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+\/[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
-    exports.format = format;
-    exports.parse = parse3;
-    function format(obj) {
-      if (!obj || typeof obj !== "object") {
-        throw new TypeError("argument obj is required");
-      }
-      var parameters = obj.parameters;
-      var type = obj.type;
-      if (!type || !TYPE_REGEXP.test(type)) {
-        throw new TypeError("invalid type");
-      }
-      var string4 = type;
-      if (parameters && typeof parameters === "object") {
-        var param;
-        var params = Object.keys(parameters).sort();
-        for (var i2 = 0; i2 < params.length; i2++) {
-          param = params[i2];
-          if (!TOKEN_REGEXP.test(param)) {
-            throw new TypeError("invalid parameter name");
-          }
-          string4 += "; " + param + "=" + qstring(parameters[param]);
-        }
-      }
-      return string4;
-    }
-    function parse3(string4) {
-      if (!string4) {
-        throw new TypeError("argument string is required");
-      }
-      var header = typeof string4 === "object" ? getcontenttype(string4) : string4;
-      if (typeof header !== "string") {
-        throw new TypeError("argument string is required to be a string");
-      }
-      var index = header.indexOf(";");
-      var type = index !== -1 ? header.slice(0, index).trim() : header.trim();
-      if (!TYPE_REGEXP.test(type)) {
-        throw new TypeError("invalid media type");
-      }
-      var obj = new ContentType(type.toLowerCase());
-      if (index !== -1) {
-        var key;
-        var match;
-        var value;
-        PARAM_REGEXP.lastIndex = index;
-        while (match = PARAM_REGEXP.exec(header)) {
-          if (match.index !== index) {
-            throw new TypeError("invalid parameter format");
-          }
-          index += match[0].length;
-          key = match[1].toLowerCase();
-          value = match[2];
-          if (value.charCodeAt(0) === 34) {
-            value = value.slice(1, -1);
-            if (value.indexOf("\\") !== -1) {
-              value = value.replace(QESC_REGEXP, "$1");
-            }
-          }
-          obj.parameters[key] = value;
-        }
-        if (index !== header.length) {
-          throw new TypeError("invalid parameter format");
-        }
-      }
-      return obj;
-    }
-    function getcontenttype(obj) {
-      var header;
-      if (typeof obj.getHeader === "function") {
-        header = obj.getHeader("content-type");
-      } else if (typeof obj.headers === "object") {
-        header = obj.headers && obj.headers["content-type"];
-      }
-      if (typeof header !== "string") {
-        throw new TypeError("content-type header is missing from object");
-      }
-      return header;
-    }
-    function qstring(val) {
-      var str = String(val);
-      if (TOKEN_REGEXP.test(str)) {
-        return str;
-      }
-      if (str.length > 0 && !TEXT_REGEXP.test(str)) {
-        throw new TypeError("invalid parameter value");
-      }
-      return '"' + str.replace(QUOTE_REGEXP, "\\$1") + '"';
-    }
-    function ContentType(type) {
-      this.parameters = /* @__PURE__ */ Object.create(null);
-      this.type = type;
-    }
-  }
-});
-
 // node_modules/etag/index.js
 var require_etag = __commonJS({
   "node_modules/etag/index.js"(exports, module) {
@@ -35204,7 +35204,7 @@ var require_mime_types2 = __commonJS({
     var TEXT_TYPE_REGEXP = /^text\//i;
     exports.charset = charset;
     exports.charsets = { lookup: charset };
-    exports.contentType = contentType;
+    exports.contentType = contentType2;
     exports.extension = extension;
     exports.extensions = /* @__PURE__ */ Object.create(null);
     exports.lookup = lookup;
@@ -35225,7 +35225,7 @@ var require_mime_types2 = __commonJS({
       }
       return false;
     }
-    function contentType(str) {
+    function contentType2(str) {
       if (!str || typeof str !== "string") {
         return false;
       }
@@ -36149,7 +36149,7 @@ var require_utils3 = __commonJS({
   "node_modules/express/lib/utils.js"(exports) {
     "use strict";
     var { METHODS } = __require("node:http");
-    var contentType = require_content_type();
+    var contentType2 = require_content_type();
     var etag = require_etag();
     var mime = require_mime_types2();
     var proxyaddr = require_proxy_addr();
@@ -36253,9 +36253,9 @@ var require_utils3 = __commonJS({
       if (!type || !charset) {
         return type;
       }
-      var parsed = contentType.parse(type);
+      var parsed = contentType2.parse(type);
       parsed.parameters.charset = charset;
-      return contentType.format(parsed);
+      return contentType2.format(parsed);
     };
     function createETagGenerator(options) {
       return function generateETag(body, encoding) {
@@ -37800,14 +37800,14 @@ var require_dist4 = __commonJS({
 var require_accept = __commonJS({
   "node_modules/negotiator/lib/accept.js"(exports, module) {
     "use strict";
-    var contentType = require_dist4();
+    var contentType2 = require_dist4();
     module.exports = parseAccept;
     function parseAccept(header) {
       var values = [];
       var index = 0;
       while (index < header.length) {
         var start = skipOptionalWhitespace(header, index);
-        var parsed = contentType.parse(header, { comma: true, start });
+        var parsed = contentType2.parse(header, { comma: true, start });
         parsed.type = header.slice(start, start + parsed.type.length);
         values.push(parsed);
         index = parsed.index + 1;
@@ -38000,7 +38000,7 @@ var require_encoding = __commonJS({
 var require_language = __commonJS({
   "node_modules/negotiator/lib/language.js"(exports, module) {
     "use strict";
-    var contentType = require_dist4();
+    var contentType2 = require_dist4();
     var parseAccept = require_accept();
     module.exports = preferredLanguages;
     module.exports.preferredLanguages = preferredLanguages;
@@ -38037,7 +38037,7 @@ var require_language = __commonJS({
       return priority;
     }
     function specify(language, spec, index) {
-      var p = formatLanguage(contentType.parse(language), 0);
+      var p = formatLanguage(contentType2.parse(language), 0);
       if (!p) return null;
       var s2 = 0;
       if (spec.full.toLowerCase() === p.full.toLowerCase()) {
@@ -38084,7 +38084,7 @@ var require_language = __commonJS({
 var require_mediaType = __commonJS({
   "node_modules/negotiator/lib/mediaType.js"(exports, module) {
     "use strict";
-    var contentType = require_dist4();
+    var contentType2 = require_dist4();
     var parseAcceptHeader = require_accept();
     module.exports = preferredMediaTypes;
     module.exports.preferredMediaTypes = preferredMediaTypes;
@@ -38121,7 +38121,7 @@ var require_mediaType = __commonJS({
       return priority;
     }
     function specify(type, spec, index) {
-      var p = formatMediaType(contentType.parse(type), 0);
+      var p = formatMediaType(contentType2.parse(type), 0);
       var s2 = 0;
       if (!p) {
         return null;
@@ -47645,7 +47645,7 @@ var require_mime_types3 = __commonJS({
     var TEXT_TYPE_REGEXP = /^text\//i;
     exports.charset = charset;
     exports.charsets = { lookup: charset };
-    exports.contentType = contentType;
+    exports.contentType = contentType2;
     exports.extension = extension;
     exports.extensions = /* @__PURE__ */ Object.create(null);
     exports.lookup = lookup;
@@ -47666,7 +47666,7 @@ var require_mime_types3 = __commonJS({
       }
       return false;
     }
-    function contentType(str) {
+    function contentType2(str) {
       if (!str || typeof str !== "string") {
         return false;
       }
@@ -57927,7 +57927,7 @@ var require_mime_types4 = __commonJS({
     var TEXT_TYPE_REGEXP = /^text\//i;
     exports.charset = charset;
     exports.charsets = { lookup: charset };
-    exports.contentType = contentType;
+    exports.contentType = contentType2;
     exports.extension = extension;
     exports.extensions = /* @__PURE__ */ Object.create(null);
     exports.lookup = lookup;
@@ -57948,7 +57948,7 @@ var require_mime_types4 = __commonJS({
       }
       return false;
     }
-    function contentType(str) {
+    function contentType2(str) {
       if (!str || typeof str !== "string") {
         return false;
       }
@@ -58809,7 +58809,7 @@ var require_response = __commonJS({
       var fullPath = !opts.root ? resolve(path7) : path7;
       return this.sendFile(fullPath, opts, done);
     };
-    res.contentType = res.type = function contentType(type) {
+    res.contentType = res.type = function contentType2(type) {
       var ct = type.indexOf("/") === -1 ? mime.contentType(type) || "application/octet-stream" : type;
       return this.set("Content-Type", ct);
     };
@@ -73726,10 +73726,9 @@ var ProgressTokenSchema = union([string2(), number2().int()]);
 var CursorSchema = string2();
 var TaskCreationParamsSchema = looseObject({
   /**
-   * Time in milliseconds to keep task results available after completion.
-   * If null, the task has unlimited lifetime until manually cleaned up.
+   * Requested duration in milliseconds to retain task from creation.
    */
-  ttl: union([number2(), _null3()]).optional(),
+  ttl: number2().optional(),
   /**
    * Time in milliseconds to wait between task status requests.
    */
@@ -74026,7 +74025,11 @@ var ClientCapabilitiesSchema = object({
   /**
    * Present if the client supports task creation.
    */
-  tasks: ClientTasksCapabilitySchema.optional()
+  tasks: ClientTasksCapabilitySchema.optional(),
+  /**
+   * Extensions that the client supports. Keys are extension identifiers (vendor-prefix/extension-name).
+   */
+  extensions: record(string2(), AssertObjectSchema).optional()
 });
 var InitializeRequestParamsSchema = BaseRequestParamsSchema.extend({
   /**
@@ -74087,7 +74090,11 @@ var ServerCapabilitiesSchema = object({
   /**
    * Present if the server supports task creation.
    */
-  tasks: ServerTasksCapabilitySchema.optional()
+  tasks: ServerTasksCapabilitySchema.optional(),
+  /**
+   * Extensions that the server supports. Keys are extension identifiers (vendor-prefix/extension-name).
+   */
+  extensions: record(string2(), AssertObjectSchema).optional()
 });
 var InitializeResultSchema = ResultSchema.extend({
   /**
@@ -74280,6 +74287,12 @@ var ResourceSchema = object({
    * The MIME type of this resource, if known.
    */
   mimeType: optional(string2()),
+  /**
+   * The size of the raw resource content, in bytes (i.e., before base64 encoding or any tokenization), if known.
+   *
+   * This can be used by Hosts to display file sizes and estimate context window usage.
+   */
+  size: optional(number2()),
   /**
    * Optional annotations for the client.
    */
@@ -75221,8 +75234,17 @@ var UrlElicitationRequiredError = class extends McpError {
 };
 
 // node_modules/@modelcontextprotocol/sdk/dist/esm/shared/stdio.js
+var STDIO_DEFAULT_MAX_BUFFER_SIZE = 10 * 1024 * 1024;
 var ReadBuffer = class {
+  constructor(options) {
+    this._maxBufferSize = options?.maxBufferSize ?? STDIO_DEFAULT_MAX_BUFFER_SIZE;
+  }
   append(chunk) {
+    const newSize = (this._buffer?.length ?? 0) + chunk.length;
+    if (newSize > this._maxBufferSize) {
+      this.clear();
+      throw new Error(`ReadBuffer exceeded maximum size of ${this._maxBufferSize} bytes`);
+    }
     this._buffer = this._buffer ? Buffer.concat([this._buffer, chunk]) : chunk;
   }
   readMessage() {
@@ -75250,18 +75272,24 @@ function serializeMessage(message) {
 
 // node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
 var StdioServerTransport = class {
-  constructor(_stdin = process3.stdin, _stdout = process3.stdout) {
+  constructor(_stdin = process3.stdin, _stdout = process3.stdout, options) {
     this._stdin = _stdin;
     this._stdout = _stdout;
-    this._readBuffer = new ReadBuffer();
     this._started = false;
     this._ondata = (chunk) => {
-      this._readBuffer.append(chunk);
-      this.processReadBuffer();
+      try {
+        this._readBuffer.append(chunk);
+        this.processReadBuffer();
+      } catch (error51) {
+        this.onerror?.(error51);
+        this.close().catch(() => {
+        });
+      }
     };
     this._onerror = (error51) => {
       this.onerror?.(error51);
     };
+    this._readBuffer = new ReadBuffer({ maxBufferSize: options?.maxBufferSize });
   }
   /**
    * Starts listening for messages on stdin.
@@ -75580,7 +75608,12 @@ var OAuthTokensSchema = object({
   token_type: string2(),
   expires_in: coerce_exports.number().optional(),
   scope: string2().optional(),
-  refresh_token: string2().optional()
+  refresh_token: string2().optional(),
+  /**
+   * Not part of the wire format: the authorization server this value was obtained from, added by
+   * the client's `auth()` before it is stored and compared when it is read back.
+   */
+  issuer: string2().optional().catch(void 0)
 }).strip();
 var OAuthErrorResponseSchema = object({
   error: string2(),
@@ -75610,7 +75643,12 @@ var OAuthClientInformationSchema = object({
   client_id: string2(),
   client_secret: string2().optional(),
   client_id_issued_at: number2().optional(),
-  client_secret_expires_at: number2().optional()
+  client_secret_expires_at: number2().optional(),
+  /**
+   * Not part of the wire format: the authorization server this value was obtained from, added by
+   * the client's `auth()` before it is stored and compared when it is read back.
+   */
+  issuer: string2().optional().catch(void 0)
 }).strip();
 var OAuthClientInformationFullSchema = OAuthClientMetadataSchema.merge(OAuthClientInformationSchema);
 var OAuthClientRegistrationErrorSchema = object({
@@ -75750,12 +75788,12 @@ var AUTHORIZATION_CODE_RESPONSE_TYPE = "code";
 var AUTHORIZATION_CODE_CHALLENGE_METHOD = "S256";
 function selectClientAuthMethod(clientInformation, supportedMethods) {
   const hasClientSecret = clientInformation.client_secret !== void 0;
-  if (supportedMethods.length === 0) {
-    return hasClientSecret ? "client_secret_post" : "none";
-  }
-  if ("token_endpoint_auth_method" in clientInformation && clientInformation.token_endpoint_auth_method && isClientAuthMethod(clientInformation.token_endpoint_auth_method) && supportedMethods.includes(clientInformation.token_endpoint_auth_method)) {
+  if ("token_endpoint_auth_method" in clientInformation && clientInformation.token_endpoint_auth_method && isClientAuthMethod(clientInformation.token_endpoint_auth_method) && (supportedMethods.length === 0 || supportedMethods.includes(clientInformation.token_endpoint_auth_method))) {
     return clientInformation.token_endpoint_auth_method;
   }
+  if (supportedMethods.length === 0) {
+    return hasClientSecret ? "client_secret_basic" : "none";
+  }
   if (hasClientSecret && supportedMethods.includes("client_secret_basic")) {
     return "client_secret_basic";
   }
@@ -75812,6 +75850,26 @@ async function parseErrorResponse(input) {
     return new ServerError(errorMessage);
   }
 }
+function issuersMatch(a, b) {
+  let [x2, y] = [a, b];
+  try {
+    [x2, y] = [new URL(a).href, new URL(b).href];
+  } catch {
+  }
+  return x2 === y || x2.endsWith("/") && x2.slice(0, -1) === y || y.endsWith("/") && y.slice(0, -1) === x2;
+}
+function discardIfIssuerMismatch(stored, issuer) {
+  if (!stored)
+    return void 0;
+  if (typeof stored.issuer !== "string")
+    return stored.issuer == null ? stored : { ...stored, issuer: void 0 };
+  return issuersMatch(stored.issuer, issuer) ? stored : void 0;
+}
+var TokenResponseSchema = OAuthTokensSchema.omit({ issuer: true });
+var RegistrationResponseSchema = OAuthClientInformationFullSchema.omit({ issuer: true });
+function boundElsewhereError(stored, issuer) {
+  return new Error(`OAuth client information is bound to authorization server ${stored.issuer} and is not presented to ${issuer}. Clear the stored client information, or correct \`expectedIssuer\`, if the authorization server has moved.`);
+}
 async function auth(provider, options) {
   try {
     return await authInternal(provider, options);
@@ -75827,23 +75885,62 @@ async function auth(provider, options) {
   }
 }
 async function authInternal(provider, { serverUrl, authorizationCode, scope, resourceMetadataUrl, fetchFn }) {
+  const cachedState = await provider.discoveryState?.();
   let resourceMetadata;
   let authorizationServerUrl;
-  try {
-    resourceMetadata = await discoverOAuthProtectedResourceMetadata(serverUrl, { resourceMetadataUrl }, fetchFn);
-    if (resourceMetadata.authorization_servers && resourceMetadata.authorization_servers.length > 0) {
-      authorizationServerUrl = resourceMetadata.authorization_servers[0];
+  let metadata;
+  let effectiveResourceMetadataUrl = resourceMetadataUrl;
+  if (!effectiveResourceMetadataUrl && cachedState?.resourceMetadataUrl) {
+    effectiveResourceMetadataUrl = new URL(cachedState.resourceMetadataUrl);
+  }
+  if (cachedState?.authorizationServerUrl) {
+    authorizationServerUrl = cachedState.authorizationServerUrl;
+    resourceMetadata = cachedState.resourceMetadata;
+    metadata = cachedState.authorizationServerMetadata ?? await discoverAuthorizationServerMetadata(authorizationServerUrl, { fetchFn });
+    if (!resourceMetadata) {
+      try {
+        resourceMetadata = await discoverOAuthProtectedResourceMetadata(serverUrl, { resourceMetadataUrl: effectiveResourceMetadataUrl }, fetchFn);
+      } catch {
+      }
     }
-  } catch {
-  }
-  if (!authorizationServerUrl) {
-    authorizationServerUrl = new URL("/", serverUrl);
+    if (metadata !== cachedState.authorizationServerMetadata || resourceMetadata !== cachedState.resourceMetadata) {
+      await provider.saveDiscoveryState?.({
+        authorizationServerUrl: String(authorizationServerUrl),
+        resourceMetadataUrl: effectiveResourceMetadataUrl?.toString(),
+        resourceMetadata,
+        authorizationServerMetadata: metadata
+      });
+    }
+  } else {
+    const serverInfo = await discoverOAuthServerInfo(serverUrl, { resourceMetadataUrl: effectiveResourceMetadataUrl, fetchFn });
+    authorizationServerUrl = serverInfo.authorizationServerUrl;
+    metadata = serverInfo.authorizationServerMetadata;
+    resourceMetadata = serverInfo.resourceMetadata;
+    await provider.saveDiscoveryState?.({
+      authorizationServerUrl: String(authorizationServerUrl),
+      resourceMetadataUrl: effectiveResourceMetadataUrl?.toString(),
+      resourceMetadata,
+      authorizationServerMetadata: metadata
+    });
   }
-  const resource = await selectResourceURL(serverUrl, provider, resourceMetadata);
-  const metadata = await discoverAuthorizationServerMetadata(authorizationServerUrl, {
-    fetchFn
-  });
-  let clientInformation = await Promise.resolve(provider.clientInformation());
+  const issuer = String(authorizationServerUrl);
+  const selectedResource = await selectResourceURL(serverUrl, provider, resourceMetadata);
+  const resource = selectedResource && resourceMetadata && !provider.validateResourceURL ? resourceMetadata.resource : selectedResource;
+  const resolvedScope = scope || resourceMetadata?.scopes_supported?.join(" ") || provider.clientMetadata.scope;
+  const storedClientInformation = await Promise.resolve(provider.clientInformation());
+  let clientInformation = discardIfIssuerMismatch(storedClientInformation, issuer);
+  const canRegisterAgain = provider.saveClientInformation !== void 0 && !!provider.redirectUrl;
+  if (storedClientInformation && !clientInformation && !canRegisterAgain) {
+    throw boundElsewhereError(storedClientInformation, issuer);
+  }
+  const unstampedClientInformation = clientInformation?.issuer == null ? clientInformation : void 0;
+  const bindClientInformation = async () => {
+    try {
+      if (unstampedClientInformation)
+        await provider.saveClientInformation?.({ ...unstampedClientInformation, issuer });
+    } catch {
+    }
+  };
   if (!clientInformation) {
     if (authorizationCode !== void 0) {
       throw new Error("Existing OAuth client information is required when exchanging an authorization code");
@@ -75855,9 +75952,7 @@ async function authInternal(provider, { serverUrl, authorizationCode, scope, res
     }
     const shouldUseUrlBasedClientId = supportsUrlBasedClientId && clientMetadataUrl;
     if (shouldUseUrlBasedClientId) {
-      clientInformation = {
-        client_id: clientMetadataUrl
-      };
+      clientInformation = { client_id: clientMetadataUrl, issuer };
       await provider.saveClientInformation?.(clientInformation);
     } else {
       if (!provider.saveClientInformation) {
@@ -75866,10 +75961,11 @@ async function authInternal(provider, { serverUrl, authorizationCode, scope, res
       const fullInformation = await registerClient(authorizationServerUrl, {
         metadata,
         clientMetadata: provider.clientMetadata,
+        scope: resolvedScope,
         fetchFn
       });
-      await provider.saveClientInformation(fullInformation);
-      clientInformation = fullInformation;
+      clientInformation = { ...fullInformation, issuer };
+      await provider.saveClientInformation(clientInformation);
     }
   }
   const nonInteractiveFlow = !provider.redirectUrl;
@@ -75880,10 +75976,14 @@ async function authInternal(provider, { serverUrl, authorizationCode, scope, res
       authorizationCode,
       fetchFn
     });
-    await provider.saveTokens(tokens2);
+    await bindClientInformation();
+    await provider.saveTokens({ ...tokens2, issuer });
     return "AUTHORIZED";
   }
-  const tokens = await provider.tokens();
+  const tokens = discardIfIssuerMismatch(await provider.tokens(), issuer);
+  if (tokens?.refresh_token && tokens.issuer == null) {
+    console.warn("[mcp-sdk] stored OAuth tokens have no 'issuer' property (saved by an earlier version, or by a provider that does not keep it) and are used as-is; make sure your OAuthClientProvider stores what saveTokens() and saveClientInformation() receive unchanged.");
+  }
   if (tokens?.refresh_token) {
     try {
       const newTokens = await refreshAuthorization(authorizationServerUrl, {
@@ -75894,7 +75994,8 @@ async function authInternal(provider, { serverUrl, authorizationCode, scope, res
         addClientAuthentication: provider.addClientAuthentication,
         fetchFn
       });
-      await provider.saveTokens(newTokens);
+      await bindClientInformation();
+      await provider.saveTokens({ ...newTokens, issuer });
       return "AUTHORIZED";
     } catch (error51) {
       if (!(error51 instanceof OAuthError) || error51 instanceof ServerError) {
@@ -75909,7 +76010,7 @@ async function authInternal(provider, { serverUrl, authorizationCode, scope, res
     clientInformation,
     state,
     redirectUrl: provider.redirectUrl,
-    scope: scope || resourceMetadata?.scopes_supported?.join(" ") || provider.clientMetadata.scope,
+    scope: resolvedScope,
     resource
   });
   await provider.saveCodeVerifier(codeVerifier);
@@ -76097,6 +76198,29 @@ async function discoverAuthorizationServerMetadata(authorizationServerUrl, { fet
   }
   return void 0;
 }
+async function discoverOAuthServerInfo(serverUrl, opts) {
+  let resourceMetadata;
+  let authorizationServerUrl;
+  try {
+    resourceMetadata = await discoverOAuthProtectedResourceMetadata(serverUrl, { resourceMetadataUrl: opts?.resourceMetadataUrl }, opts?.fetchFn);
+    if (resourceMetadata.authorization_servers && resourceMetadata.authorization_servers.length > 0) {
+      authorizationServerUrl = resourceMetadata.authorization_servers[0];
+    }
+  } catch {
+  }
+  if (!authorizationServerUrl) {
+    authorizationServerUrl = String(new URL("/", serverUrl));
+  }
+  const authorizationServerMetadata = await discoverAuthorizationServerMetadata(authorizationServerUrl, { fetchFn: opts?.fetchFn });
+  return {
+    authorizationServerUrl,
+    authorizationServerMetadata,
+    resourceMetadata
+  };
+}
+function resourceIndicatorToString(resource) {
+  return typeof resource === "string" ? resource : resource.href;
+}
 async function startAuthorization(authorizationServerUrl, { metadata, clientInformation, redirectUrl, scope, state, resource }) {
   let authorizationUrl;
   if (metadata) {
@@ -76128,7 +76252,7 @@ async function startAuthorization(authorizationServerUrl, { metadata, clientInfo
     authorizationUrl.searchParams.append("prompt", "consent");
   }
   if (resource) {
-    authorizationUrl.searchParams.set("resource", resource.href);
+    authorizationUrl.searchParams.set("resource", resourceIndicatorToString(resource));
   }
   return { authorizationUrl, codeVerifier };
 }
@@ -76147,7 +76271,7 @@ async function executeTokenRequest(authorizationServerUrl, { metadata, tokenRequ
     Accept: "application/json"
   });
   if (resource) {
-    tokenRequestParams.set("resource", resource.href);
+    tokenRequestParams.set("resource", resourceIndicatorToString(resource));
   }
   if (addClientAuthentication) {
     await addClientAuthentication(headers, tokenRequestParams, tokenUrl, metadata);
@@ -76164,7 +76288,7 @@ async function executeTokenRequest(authorizationServerUrl, { metadata, tokenRequ
   if (!response.ok) {
     throw await parseErrorResponse(response);
   }
-  return OAuthTokensSchema.parse(await response.json());
+  return TokenResponseSchema.parse(await response.json());
 }
 async function refreshAuthorization(authorizationServerUrl, { metadata, clientInformation, refreshToken, resource, addClientAuthentication, fetchFn }) {
   const tokenRequestParams = new URLSearchParams({
@@ -76182,6 +76306,15 @@ async function refreshAuthorization(authorizationServerUrl, { metadata, clientIn
   return { refresh_token: refreshToken, ...tokens };
 }
 async function fetchToken(provider, authorizationServerUrl, { metadata, resource, authorizationCode, fetchFn } = {}) {
+  const readClientInformation = async () => {
+    const storedClientInformation = await provider.clientInformation();
+    const checked = discardIfIssuerMismatch(storedClientInformation, String(authorizationServerUrl));
+    if (storedClientInformation && !checked) {
+      throw boundElsewhereError(storedClientInformation, String(authorizationServerUrl));
+    }
+    return checked;
+  };
+  let clientInformation = await readClientInformation();
   const scope = provider.clientMetadata.scope;
   let tokenRequestParams;
   if (provider.prepareTokenRequest) {
@@ -76197,17 +76330,17 @@ async function fetchToken(provider, authorizationServerUrl, { metadata, resource
     const codeVerifier = await provider.codeVerifier();
     tokenRequestParams = prepareAuthorizationCodeRequest(authorizationCode, codeVerifier, provider.redirectUrl);
   }
-  const clientInformation = await provider.clientInformation();
+  clientInformation ?? (clientInformation = await readClientInformation());
   return executeTokenRequest(authorizationServerUrl, {
     metadata,
     tokenRequestParams,
-    clientInformation: clientInformation ?? void 0,
+    clientInformation,
     addClientAuthentication: provider.addClientAuthentication,
     resource,
     fetchFn
   });
 }
-async function registerClient(authorizationServerUrl, { metadata, clientMetadata, fetchFn }) {
+async function registerClient(authorizationServerUrl, { metadata, clientMetadata, scope, fetchFn }) {
   let registrationUrl;
   if (metadata) {
     if (!metadata.registration_endpoint) {
@@ -76222,12 +76355,15 @@ async function registerClient(authorizationServerUrl, { metadata, clientMetadata
     headers: {
       "Content-Type": "application/json"
     },
-    body: JSON.stringify(clientMetadata)
+    body: JSON.stringify({
+      ...clientMetadata,
+      ...scope !== void 0 ? { scope } : {}
+    })
   });
   if (!response.ok) {
     throw await parseErrorResponse(response);
   }
-  return OAuthClientInformationFullSchema.parse(await response.json());
+  return RegistrationResponseSchema.parse(await response.json());
 }
 
 // src/lib/utils.ts
@@ -76245,7 +76381,6 @@ import crypto3 from "crypto";
 // src/lib/persistent-auth-config.ts
 import path from "path";
 import fs from "fs/promises";
-import fsSync from "fs";
 import crypto2 from "crypto";
 function getConfigDir() {
   const baseConfigDir = CONFIG.WP_MCP_CONFIG_DIR;
@@ -76342,21 +76477,25 @@ async function writeTokens(serverUrlHash, tokens) {
       ...tokens,
       obtained_at: Date.now()
     };
-    await writeJsonFile(serverUrlHash, "tokens.json", tokensWithTimestamp);
+    await ensureConfigDir();
+    const file2 = getConfigFilePath(serverUrlHash, "tokens.json");
+    const temporary = `${file2}.${crypto2.randomUUID()}.tmp`;
+    try {
+      await fs.writeFile(temporary, JSON.stringify(tokensWithTimestamp, null, 2), {
+        encoding: "utf-8",
+        mode: 384,
+        flag: "wx"
+      });
+      await fs.rename(temporary, file2);
+    } finally {
+      await fs.rm(temporary, { force: true });
+    }
     logger.info(`Stored tokens for server hash: ${serverUrlHash}`, "AUTH");
   } catch (error51) {
     logger.error(`Error writing tokens for ${serverUrlHash}`, "AUTH", error51);
     throw error51;
   }
 }
-async function deleteTokens(serverUrlHash) {
-  try {
-    await deleteConfigFile(serverUrlHash, "tokens.json");
-    logger.info(`Deleted tokens for server hash: ${serverUrlHash}`, "AUTH");
-  } catch (error51) {
-    logger.error(`Error deleting tokens for ${serverUrlHash}`, "AUTH", error51);
-  }
-}
 async function readClientInfo(serverUrlHash) {
   try {
     const clientInfo = await readJsonFile(serverUrlHash, "client_info.json");
@@ -76383,7 +76522,7 @@ function isTokenValid(tokens) {
   if (!tokens?.access_token) {
     return { isValid: false, error: "No access token" };
   }
-  if (!tokens.expires_in || !tokens.obtained_at) {
+  if (tokens.expires_in === void 0 || tokens.obtained_at === void 0) {
     return { isValid: true };
   }
   const now = Date.now();
@@ -76415,30 +76554,6 @@ async function getValidTokens(serverUrlHash) {
   }
   return tokens;
 }
-async function cleanupExpiredTokens() {
-  try {
-    const configDir = getConfigDir();
-    if (!fsSync.existsSync(configDir)) {
-      return;
-    }
-    const files = await fs.readdir(configDir);
-    const tokenFiles = files.filter((file2) => file2.endsWith("_tokens.json"));
-    let cleaned = 0;
-    for (const file2 of tokenFiles) {
-      const serverHash = file2.replace("_tokens.json", "");
-      const tokens = await readTokens(serverHash);
-      if (tokens && !isTokenValid(tokens).isValid) {
-        await deleteTokens(serverHash);
-        cleaned++;
-      }
-    }
-    if (cleaned > 0) {
-      logger.info(`Cleaned up ${cleaned} expired token files`, "AUTH");
-    }
-  } catch (error51) {
-    logger.error("Error during token cleanup", "AUTH", error51);
-  }
-}
 
 // src/lib/port-utils.ts
 var OAuthClientInfoSchema = external_exports.object({
@@ -76446,12 +76561,12 @@ var OAuthClientInfoSchema = external_exports.object({
   client_id: external_exports.string().optional(),
   client_secret: external_exports.string().optional()
 });
-async function findAvailablePort(preferredPort) {
+async function findAvailablePort(preferredPort, host = "127.0.0.1") {
   return new Promise((resolve, reject) => {
     const server = net.createServer();
     server.on("error", (err) => {
       if (err.code === "EADDRINUSE") {
-        server.listen(0);
+        server.listen(0, host);
       } else {
         reject(err);
       }
@@ -76462,7 +76577,7 @@ async function findAvailablePort(preferredPort) {
         resolve(port);
       });
     });
-    server.listen(preferredPort || 0);
+    server.listen(preferredPort || 0, host);
   });
 }
 function calculateDefaultPort(serverUrlHash) {
@@ -76490,24 +76605,17 @@ async function findExistingClientPort(serverUrlHash) {
 function getServerUrlHash(serverUrl) {
   return crypto3.createHash("md5").update(serverUrl).digest("hex");
 }
-async function selectCallbackPort(serverUrl, specifiedPort, _unused) {
+async function selectCallbackPort(serverUrl, specifiedPort, _unused, host = "127.0.0.1") {
   const serverUrlHash = getServerUrlHash(serverUrl);
   if (specifiedPort) {
     return specifiedPort;
   }
-  const defaultPort = calculateDefaultPort(serverUrlHash);
-  const [existingClientPort, availablePort] = await Promise.all([
-    findExistingClientPort(serverUrlHash),
-    findAvailablePort(defaultPort)
-  ]);
-  if (existingClientPort) {
-    return existingClientPort;
-  }
-  return availablePort;
+  const existingClientPort = await findExistingClientPort(serverUrlHash);
+  return findAvailablePort(existingClientPort ?? calculateDefaultPort(serverUrlHash), host);
 }
 
 // src/lib/config.ts
-var MCP_WORDPRESS_REMOTE_VERSION = "0.5.1";
+var MCP_WORDPRESS_REMOTE_VERSION = "0.5.3";
 function parsePositiveIntEnv(value, defaultValue) {
   if (!value) {
     return defaultValue;
@@ -76708,8 +76816,8 @@ async function getOAuthCallbackPort() {
   return selectCallbackPort(
     CONFIG.WP_API_URL,
     CONFIG.OAUTH_CALLBACK_PORT,
-    false
-    // Always treat as self-hosted for port selection
+    false,
+    CONFIG.OAUTH_HOST
   );
 }
 function formatConfigError(error51) {
@@ -77080,6 +77188,23 @@ async function proxyFetch(url2, init) {
 // src/lib/wordpress-transport.ts
 import { Readable } from "node:stream";
 
+// node_modules/@modelcontextprotocol/sdk/dist/esm/shared/mediaType.js
+var import_content_type = __toESM(require_content_type(), 1);
+function mediaTypeEssence(header) {
+  if (!header) {
+    return void 0;
+  }
+  try {
+    return import_content_type.default.parse(header).type;
+  } catch {
+    const essence = (header.split(";", 1)[0] ?? "").trim().toLowerCase();
+    if (essence === "" || header.slice(essence.length).includes(",")) {
+      return void 0;
+    }
+    return essence;
+  }
+}
+
 // node_modules/eventsource-parser/dist/stream.js
 var EventSourceParserStream = class extends TransformStream {
   constructor({ onError, onRetry, onComment } = {}) {
@@ -77227,13 +77352,13 @@ var StreamableHTTPClientTransport = class {
       this.onerror?.(new Error(`Maximum reconnection attempts (${maxRetries}) exceeded.`));
       return;
     }
-    const delay = this._getNextReconnectionDelay(attemptCount);
+    const delay2 = this._getNextReconnectionDelay(attemptCount);
     this._reconnectionTimeout = setTimeout(() => {
       this._startOrAuthSse(options).catch((error51) => {
         this.onerror?.(new Error(`Failed to reconnect SSE stream: ${error51 instanceof Error ? error51.message : String(error51)}`));
         this._scheduleReconnection(options, attemptCount + 1);
       });
-    }, delay);
+    }, delay2);
   }
   _handleSseStream(stream, options, isReconnectable) {
     if (!stream) {
@@ -77420,11 +77545,12 @@ var StreamableHTTPClientTransport = class {
       }
       const messages = Array.isArray(message) ? message : [message];
       const hasRequests = messages.filter((msg) => "method" in msg && "id" in msg && msg.id !== void 0).length > 0;
-      const contentType = response.headers.get("content-type");
+      const contentType2 = response.headers.get("content-type");
+      const responseMediaType = mediaTypeEssence(contentType2);
       if (hasRequests) {
-        if (contentType?.includes("text/event-stream")) {
+        if (responseMediaType === "text/event-stream") {
           this._handleSseStream(response.body, { onresumptiontoken }, false);
-        } else if (contentType?.includes("application/json")) {
+        } else if (responseMediaType === "application/json") {
           const data = await response.json();
           const responseMessages = Array.isArray(data) ? data.map((msg) => JSONRPCMessageSchema.parse(msg)) : [JSONRPCMessageSchema.parse(data)];
           for (const msg of responseMessages) {
@@ -77432,7 +77558,7 @@ var StreamableHTTPClientTransport = class {
           }
         } else {
           await response.body?.cancel();
-          throw new StreamableHTTPError(-1, `Unexpected content type: ${contentType}`);
+          throw new StreamableHTTPError(-1, `Unexpected content type: ${contentType2}`);
         }
       } else {
         await response.body?.cancel();
@@ -78138,10 +78264,48 @@ defineLazyProperty(apps, "browserPrivate", () => "browserPrivate");
 var open_default = open;
 
 // src/lib/mcp-oauth-provider.ts
+import lockfile from "proper-lockfile";
+import { setTimeout as delay } from "node:timers/promises";
 import { EventEmitter } from "node:events";
 
 // src/lib/mcp-oauth-utils.ts
 import crypto4 from "crypto";
+
+// src/lib/oauth-http.ts
+function validateOAuthUrl(value) {
+  let url2;
+  try {
+    url2 = new URL(value);
+  } catch {
+    throw new OAuthError2("Invalid OAuth URL", "INVALID_OAUTH_URL");
+  }
+  const loopback = url2.hostname === "localhost" || url2.hostname === "[::1]" || /^127(?:\.\d{1,3}){3}$/.test(url2.hostname);
+  if (url2.protocol !== "https:" && !(url2.protocol === "http:" && loopback) || url2.username || url2.password || url2.hash) {
+    throw new OAuthError2(
+      "OAuth URLs require HTTPS (HTTP is allowed only on loopback)",
+      "INSECURE_OAUTH_URL"
+    );
+  }
+  return url2;
+}
+async function oauthFetch(value, init = {}) {
+  const url2 = validateOAuthUrl(value);
+  const headers = new Headers(
+    url2.origin === new URL(CONFIG.WP_API_URL).origin ? getCustomHeaders() : {}
+  );
+  new Headers(init.headers).forEach((value2, key) => headers.set(key, value2));
+  const response = await proxyFetch(url2.toString(), {
+    ...init,
+    headers,
+    redirect: "error",
+    signal: init.signal ?? AbortSignal.timeout(CONFIG.OAUTH_TIMEOUT)
+  });
+  if (response.status >= 300 && response.status < 400)
+    throw new OAuthError2("OAuth endpoint redirects are not accepted", "OAUTH_REDIRECT");
+  return response;
+}
+
+// src/lib/mcp-oauth-utils.ts
 function generatePKCE() {
   const codeVerifier = crypto4.randomBytes(64).toString("base64url").substring(0, 128);
   const codeChallenge = crypto4.createHash("sha256").update(codeVerifier).digest("base64url");
@@ -78169,118 +78333,99 @@ function generateCanonicalResourceURI(serverUrl) {
   }
 }
 async function discoverAuthorizationServerMetadata2(authorizationServerUrl) {
-  try {
-    const metadataUrl = new URL("/.well-known/oauth-authorization-server", authorizationServerUrl);
-    logger.oauth(`Discovering authorization server metadata: ${metadataUrl}`);
-    const customHeaders = getCustomHeaders();
-    const response = await proxyFetch(metadataUrl.toString(), {
-      headers: {
-        Accept: "application/json",
-        ...customHeaders
-      }
-    });
-    if (!response.ok) {
+  const issuer = validateOAuthUrl(authorizationServerUrl);
+  if (issuer.search) throw new OAuthError2("Issuer must not contain a query", "INVALID_METADATA");
+  for (const { url: url2 } of buildDiscoveryUrls(issuer)) {
+    const response = await oauthFetch(url2.toString(), { headers: { Accept: "application/json" } });
+    if ([404, 405].includes(response.status)) continue;
+    if (!response.ok)
       throw new OAuthError2(
-        `Failed to fetch authorization server metadata: ${response.status}`,
+        `Metadata request failed (${response.status})`,
         "METADATA_DISCOVERY_FAILED"
       );
-    }
-    const metadata = await response.json();
-    if (!metadata.authorization_endpoint || !metadata.token_endpoint) {
+    const parsed = OAuthMetadataSchema.safeParse(await response.json());
+    if (!parsed.success || parsed.data.issuer !== authorizationServerUrl) {
       throw new OAuthError2(
-        "Authorization server metadata missing required endpoints",
+        "Authorization metadata has an invalid or mismatched issuer",
         "INVALID_METADATA"
       );
     }
-    logger.oauth("Authorization server metadata discovered successfully");
+    const metadata = parsed.data;
+    validateOAuthUrl(metadata.issuer);
+    validateOAuthUrl(metadata.authorization_endpoint);
+    validateOAuthUrl(metadata.token_endpoint);
+    if (metadata.registration_endpoint) validateOAuthUrl(metadata.registration_endpoint);
     return metadata;
-  } catch (error51) {
-    if (error51 instanceof OAuthError2) {
-      throw error51;
-    }
-    throw new OAuthError2(
-      `Error discovering authorization server metadata: ${error51 instanceof Error ? error51.message : String(error51)}`,
-      "METADATA_DISCOVERY_ERROR"
-    );
   }
+  throw new OAuthError2("No authorization server metadata found", "METADATA_DISCOVERY_FAILED");
 }
-async function discoverProtectedResourceMetadata(resourceUrl) {
-  try {
-    const url2 = new URL(resourceUrl);
-    const metadataUrl = new URL("/.well-known/oauth-protected-resource", url2.origin);
-    logger.oauth(`Discovering protected resource metadata: ${metadataUrl}`);
-    const customHeaders = getCustomHeaders();
-    const response = await proxyFetch(metadataUrl.toString(), {
-      headers: {
-        Accept: "application/json",
-        ...customHeaders
+async function discoverProtectedResourceMetadata(resourceUrl, resourceMetadataUrl) {
+  const resource = validateOAuthUrl(resourceUrl);
+  const candidates = resourceMetadataUrl ? [{ url: resourceMetadataUrl, expected: resourceUrl }] : [
+    ...resource.pathname !== "/" ? [
+      {
+        url: `${resource.origin}/.well-known/oauth-protected-resource${resource.pathname}`,
+        expected: resourceUrl
       }
-    });
-    if (!response.ok) {
+    ] : [],
+    {
+      url: `${resource.origin}/.well-known/oauth-protected-resource`,
+      expected: resource.pathname === "/" ? resourceUrl : resource.origin
+    }
+  ];
+  for (const candidate of candidates) {
+    const response = await oauthFetch(candidate.url, { headers: { Accept: "application/json" } });
+    if (!resourceMetadataUrl && [404, 405].includes(response.status)) continue;
+    if (!response.ok)
       throw new OAuthError2(
-        `Failed to fetch protected resource metadata: ${response.status}`,
+        `Resource metadata request failed (${response.status})`,
         "RESOURCE_METADATA_DISCOVERY_FAILED"
       );
-    }
-    const metadata = await response.json();
-    if (!metadata.authorization_servers || metadata.authorization_servers.length === 0) {
+    const parsed = OAuthProtectedResourceMetadataSchema.safeParse(await response.json());
+    if (!parsed.success || parsed.data.resource !== candidate.expected || !parsed.data.authorization_servers?.length) {
       throw new OAuthError2(
-        "Protected resource metadata missing authorization servers",
+        "Protected resource metadata has an invalid or mismatched resource",
         "INVALID_RESOURCE_METADATA"
       );
     }
-    logger.oauth("Protected resource metadata discovered successfully");
-    return metadata;
-  } catch (error51) {
-    if (error51 instanceof OAuthError2) {
-      throw error51;
-    }
-    throw new OAuthError2(
-      `Error discovering protected resource metadata: ${error51 instanceof Error ? error51.message : String(error51)}`,
-      "RESOURCE_METADATA_DISCOVERY_ERROR"
-    );
+    for (const issuer of parsed.data.authorization_servers) validateOAuthUrl(issuer);
+    return parsed.data;
   }
+  throw new OAuthError2(
+    "No protected resource metadata found",
+    "RESOURCE_METADATA_DISCOVERY_FAILED"
+  );
 }
 function parseWWWAuthenticateHeader(headerValue2) {
-  const parts = headerValue2.split(/\s+/);
-  const scheme = parts[0];
-  const result = { scheme };
-  const paramString = parts.slice(1).join(" ");
-  const paramMatches = paramString.matchAll(/(\w+)="([^"]+)"/g);
-  for (const match of paramMatches) {
-    const [, key, value] = match;
-    switch (key) {
-      case "realm":
-        result.realm = value;
-        break;
-      case "scope":
-        result.scope = value;
-        break;
-      case "error":
-        result.error = value;
-        break;
-      case "error_description":
-        result.error_description = value;
-        break;
-      case "error_uri":
-        result.error_uri = value;
-        break;
-      case "resource_metadata_url":
-        result.resource_metadata_url = value;
-        break;
-    }
+  const bearer = /(?:^|,)\s*Bearer(?:\s+|$)/i.exec(headerValue2);
+  const result = { scheme: bearer ? "Bearer" : headerValue2.split(/\s+/)[0] };
+  if (!bearer) return result;
+  const parameters = headerValue2.slice(bearer.index + bearer[0].length).split(/,\s*(?=[A-Za-z][\w-]*\s+(?![=]))/)[0];
+  const known = /* @__PURE__ */ new Set([
+    "realm",
+    "scope",
+    "error",
+    "error_description",
+    "error_uri",
+    "resource_metadata"
+  ]);
+  for (const match of parameters.matchAll(/([\w-]+)\s*=\s*(?:"((?:[^"\\]|\\.)*)"|([^,\s]+))/g)) {
+    const key = match[1].toLowerCase();
+    if (known.has(key))
+      result[key] = (match[2] ?? match[3]).replace(
+        /\\(.)/g,
+        "$1"
+      );
   }
   return result;
 }
 async function registerDynamicClient(registrationEndpoint, registrationRequest) {
   try {
     logger.oauth(`Attempting dynamic client registration: ${registrationEndpoint}`);
-    const customHeaders = getCustomHeaders();
-    const response = await proxyFetch(registrationEndpoint, {
+    const response = await oauthFetch(registrationEndpoint, {
       method: "POST",
       headers: {
-        "Content-Type": "application/json",
-        ...customHeaders
+        "Content-Type": "application/json"
       },
       body: JSON.stringify(registrationRequest)
     });
@@ -78292,12 +78437,26 @@ async function registerDynamicClient(registrationEndpoint, registrationRequest)
       );
     }
     const registrationResponse = await response.json();
-    if (!registrationResponse.client_id) {
+    if (typeof registrationResponse.client_id !== "string" || !registrationResponse.client_id) {
       throw new OAuthError2(
         "Dynamic client registration response missing client_id",
         "INVALID_REGISTRATION_RESPONSE"
       );
     }
+    if (registrationResponse.token_endpoint_auth_method && registrationResponse.token_endpoint_auth_method !== registrationRequest.token_endpoint_auth_method) {
+      throw new OAuthError2(
+        "Authorization server changed the requested client authentication method",
+        "INVALID_REGISTRATION_RESPONSE"
+      );
+    }
+    if (registrationResponse.redirect_uris && (!Array.isArray(registrationResponse.redirect_uris) || !registrationRequest.redirect_uris.every(
+      (uri) => registrationResponse.redirect_uris.includes(uri)
+    ))) {
+      throw new OAuthError2(
+        "Authorization server changed the registered callback URI",
+        "INVALID_REGISTRATION_RESPONSE"
+      );
+    }
     logger.oauth("Dynamic client registration successful");
     logger.debug("Client ID obtained", "OAUTH", {
       client_id: registrationResponse.client_id,
@@ -78327,12 +78486,10 @@ async function exchangeAuthorizationCode(tokenEndpoint, code, redirectUri, clien
     if (resource) {
       params.set("resource", resource);
     }
-    const customHeaders = getCustomHeaders();
-    const response = await proxyFetch(tokenEndpoint, {
+    const response = await oauthFetch(tokenEndpoint, {
       method: "POST",
       headers: {
-        "Content-Type": "application/x-www-form-urlencoded",
-        ...customHeaders
+        "Content-Type": "application/x-www-form-urlencoded"
       },
       body: params.toString()
     });
@@ -78343,7 +78500,9 @@ async function exchangeAuthorizationCode(tokenEndpoint, code, redirectUri, clien
         "TOKEN_EXCHANGE_FAILED"
       );
     }
-    const tokenResponse = await response.json();
+    const tokenResponse = OAuthTokensSchema.parse(await response.json());
+    if (tokenResponse.token_type.toLowerCase() !== "bearer")
+      throw new OAuthError2("Unsupported token type", "INVALID_TOKEN_RESPONSE");
     if (!tokenResponse.access_token) {
       throw new OAuthError2("Token response missing access_token", "INVALID_TOKEN_RESPONSE");
     }
@@ -78372,15 +78531,18 @@ function buildAuthorizationUrl(authorizationEndpoint, clientId, redirectUri, sco
     // OAuth 2.1 uses authorization code flow
     client_id: clientId,
     redirect_uri: redirectUri,
-    scope: scopes.join(" "),
     state,
     code_challenge: codeChallenge,
     code_challenge_method: "S256"
   });
+  if (scopes.length) params.set("scope", scopes.join(" "));
   if (resource) {
     params.set("resource", resource);
   }
-  return `${authorizationEndpoint}?${params.toString()}`;
+  validateOAuthUrl(authorizationEndpoint);
+  const url2 = new URL(authorizationEndpoint);
+  params.forEach((value, key) => url2.searchParams.set(key, value));
+  return url2.toString();
 }
 function generateSecureState() {
   return crypto4.randomBytes(32).toString("base64url");
@@ -78461,110 +78623,26 @@ var AUTHORIZATION_CODE_HTML = `
     </div>
 
     <script>
-        function displayStatus(message, type = 'loading') {
-            const statusEl = document.getElementById('status');
-            const spinnerEl = document.getElementById('spinner');
-            
-            statusEl.textContent = message;
-            statusEl.className = type;
-            
-            if (type !== 'loading') {
-                spinnerEl.style.display = 'none';
-            }
-        }
-
-        function displayDetails(message) {
-            document.getElementById('details').textContent = message;
-        }
-
-        // Handle both OAuth 2.1 authorization code flow and implicit flow
-        const urlParams = new URLSearchParams(window.location.search);
-        const hashParams = new URLSearchParams(window.location.hash.substring(1));
-
-        // Check for authorization code first (OAuth 2.1 flow)
-        if (urlParams.has('code')) {
-            const authData = {
-                code: urlParams.get('code'),
-                state: urlParams.get('state'),
-                // Additional parameters for validation
-                iss: urlParams.get('iss'),
-            };
-
-            // Send authorization code to server for token exchange
-            fetch('/oauth/callback', {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/json'
-                },
-                body: JSON.stringify(authData)
-            })
-            .then(response => {
-                if (response.ok) {
-                    displayStatus('\u2705 Authorization successful!', 'success');
-                    displayDetails('You can safely close this window.');
-                } else {
-                    return response.json().then(err => {
-                        throw new Error(err.error || 'Failed to exchange authorization code');
-                    });
-                }
-            })
-            .catch(error => {
-                displayStatus('\u274C Error completing authorization', 'error');
-                displayDetails(error.message + '. Please try again.');
-            });
-        } 
-        // Check for access token in URL fragment (implicit flow)
-        else if (hashParams.has('access_token')) {
-            const tokens = {
-                access_token: hashParams.get('access_token'),
-                token_type: hashParams.get('token_type') || 'Bearer',
-                expires_in: hashParams.get('expires_in') ? parseInt(hashParams.get('expires_in')) : 3600,
-                scope: hashParams.get('scope'),
-                state: hashParams.get('state'),
-                obtained_at: Date.now()
-            };
-
-            // Send tokens to server for storage
-            fetch('/oauth/tokens', {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/json'
-                },
-                body: JSON.stringify(tokens)
-            })
-            .then(response => {
-                if (response.ok) {
-                    displayStatus('\u2705 Authorization successful!', 'success');
-                    displayDetails('You can safely close this window.');
-                } else {
-                    return response.json().then(err => {
-                        throw new Error(err.error || 'Failed to store access token');
-                    });
-                }
-            })
-            .catch(error => {
-                displayStatus('\u274C Error completing authorization', 'error');
-                displayDetails(error.message + '. Please try again.');
-            });
-        } 
-        // Check for errors in query parameters
-        else if (urlParams.has('error')) {
-            const error = urlParams.get('error');
-            const errorDescription = urlParams.get('error_description');
-            displayStatus('\u274C Authorization failed', 'error');
-            displayDetails(\`Error: \${error}\${errorDescription ? ' - ' + errorDescription : ''}\`);
-        } 
-        // Check for errors in URL fragment (implicit flow errors)
-        else if (hashParams.has('error')) {
-            const error = hashParams.get('error');
-            const errorDescription = hashParams.get('error_description');
-            displayStatus('\u274C Authorization failed', 'error');
-            displayDetails(\`Error: \${error}\${errorDescription ? ' - ' + errorDescription : ''}\`);
-        } 
-        // No authorization code or access token found
-        else {
-            displayStatus('\u274C No authorization code or access token received', 'error');
-            displayDetails('Please try the authorization process again.');
+        const query = new URLSearchParams(window.location.search);
+        const fragment = new URLSearchParams(window.location.hash.substring(1));
+        const status = document.getElementById('status');
+        const details = document.getElementById('details');
+        const data = Object.fromEntries(query.has('code') || query.has('error') ? query : fragment);
+        const endpoint = data.access_token ? '/oauth/tokens' : '/oauth/callback';
+        if (data.code || data.error || data.access_token) {
+            fetch(endpoint, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(data) })
+                .then(async response => {
+                    const result = await response.json();
+                    if (!response.ok) throw new Error(result.error || 'Authorization response was rejected');
+                    status.textContent = data.access_token ? 'Authorization successful' : 'Authorization code received';
+                    status.className = 'success';
+                    details.textContent = data.access_token ? 'You can close this window.' : 'Return to your app to check the connection. Token exchange may still fail.';
+                })
+                .catch(error => { status.textContent = 'Authorization failed'; status.className = 'error'; details.textContent = error.message; })
+                .finally(() => { document.getElementById('spinner').style.display = 'none'; });
+        } else {
+            status.textContent = 'No authorization response received';
+            document.getElementById('spinner').style.display = 'none';
         }
     </script>
 </body>
@@ -78579,6 +78657,17 @@ var OAuthCallbackServer = class {
     this.setupRoutes();
   }
   setupRoutes() {
+    this.app.use((req, res, next) => {
+      const host = this.options.host === "::1" ? "[::1]" : this.options.host;
+      const origin = req.headers.origin;
+      const port = this.server?.address();
+      const expectedOrigin = `http://${host}:${port && typeof port !== "string" ? port.port : this.options.port}`;
+      if (req.hostname !== host || origin && origin !== expectedOrigin) {
+        res.status(403).json({ error: "Untrusted callback origin" });
+        return;
+      }
+      next();
+    });
     this.app.use(import_express.default.json());
     this.app.get("/oauth/callback", (req, res) => {
       logger.oauth("OAuth 2.1 authorization callback page requested");
@@ -78586,46 +78675,47 @@ var OAuthCallbackServer = class {
     });
     this.app.post("/oauth/callback", async (req, res) => {
       try {
-        const { code, state, iss } = req.body;
-        if (!code) {
-          throw new OAuthError2("No authorization code received");
-        }
-        logger.oauth("OAuth 2.1 authorization code received");
-        logger.debug("Authorization code details", "OAUTH", {
-          codeLength: code.length,
-          state: state || "none",
-          issuer: iss || "none"
-        });
+        const { code, state, iss, error: error51 } = req.body;
+        this.validateResponse(state, iss);
+        if (error51) throw new OAuthError2("Authorization denied or failed", "AUTH_DENIED");
+        if (this.options.flow === "implicit")
+          throw new OAuthError2("Authorization-code callback is disabled", "WRONG_FLOW");
+        if (typeof code !== "string" || !code)
+          throw new OAuthError2("No authorization code received", "INVALID_CODE");
         this.events.emit("oauth-code-received", { code, state, iss });
-        res.json({ success: true, message: "Authorization code received successfully" });
+        res.json({
+          success: true,
+          message: "Authorization code received; check connection status in the app"
+        });
       } catch (error51) {
-        logger.error("Error processing authorization code", "OAUTH", error51);
-        const errorMessage = error51 instanceof Error ? error51.message : "Unknown error";
-        this.events.emit("oauth-error", new OAuthError2(errorMessage));
-        res.status(400).json({ error: errorMessage });
+        const failure = error51 instanceof OAuthError2 ? error51 : new OAuthError2("Invalid authorization response");
+        if (failure.code !== "INVALID_STATE") this.events.emit("oauth-error", failure);
+        res.status(400).json({ error: failure.message });
       }
     });
     this.app.post("/oauth/tokens", async (req, res) => {
+      if (this.options.flow !== "implicit") {
+        res.status(404).json({ error: "Implicit token callback is disabled" });
+        return;
+      }
       try {
-        const tokens = req.body;
-        if (!tokens.access_token) {
-          throw new OAuthError2("No access token received");
-        }
-        logger.oauth("Legacy OAuth tokens received (implicit flow)");
-        logger.debug("Token details", "OAUTH", {
-          tokenType: tokens.token_type,
-          expiresIn: tokens.expires_in,
-          scope: tokens.scope,
-          tokenLength: tokens.access_token.length
-        });
+        this.validateResponse(req.body.state, req.body.iss);
+        if (typeof req.body.access_token !== "string" || !req.body.access_token || req.body.token_type && req.body.token_type.toLowerCase() !== "bearer")
+          throw new OAuthError2("Invalid implicit token response");
+        const tokens = {
+          access_token: req.body.access_token,
+          token_type: "Bearer",
+          expires_in: req.body.expires_in === void 0 ? void 0 : Number(req.body.expires_in),
+          scope: req.body.scope,
+          obtained_at: Date.now()
+        };
         await writeTokens(this.options.serverUrlHash, tokens);
         this.events.emit("oauth-success", tokens);
-        res.json({ success: true, message: "Tokens saved successfully" });
+        res.json({ success: true });
       } catch (error51) {
-        logger.error("Error processing OAuth tokens", "OAUTH", error51);
-        const errorMessage = error51 instanceof Error ? error51.message : "Unknown error";
-        this.events.emit("oauth-error", new OAuthError2(errorMessage));
-        res.status(400).json({ error: errorMessage });
+        const failure = error51 instanceof OAuthError2 ? error51 : new OAuthError2("Invalid implicit response");
+        if (failure.code !== "INVALID_STATE") this.events.emit("oauth-error", failure);
+        res.status(400).json({ error: failure.message });
       }
     });
     this.app.get("/oauth/health", (req, res) => {
@@ -78642,21 +78732,33 @@ var OAuthCallbackServer = class {
       }
     );
   }
+  validateResponse(state, issuer) {
+    if (!this.options.state || state !== this.options.state)
+      throw new OAuthError2("Invalid callback state", "INVALID_STATE");
+    if ((issuer !== void 0 || this.options.requireIssuer) && issuer !== this.options.issuer)
+      throw new OAuthError2("Invalid callback issuer", "INVALID_ISSUER");
+  }
   async start() {
     return new Promise((resolve, reject) => {
       try {
-        this.server = this.app.listen(this.options.port, this.options.host, () => {
+        this.server = this.app.listen(this.options.port, this.options.host, (error51) => {
+          clearTimeout(this.startupTimer);
+          if (error51) {
+            reject(error51);
+            return;
+          }
           logger.oauth(
             `OAuth callback server listening on http://${this.options.host}:${this.options.port}`
           );
           resolve();
         });
         this.server.on("error", (error51) => {
+          clearTimeout(this.startupTimer);
           logger.error("OAuth callback server error", "OAUTH", error51);
           reject(error51);
         });
         if (this.options.timeout) {
-          setTimeout(() => {
+          this.startupTimer = setTimeout(() => {
             if (!this.server?.listening) {
               reject(new OAuthError2("OAuth callback server startup timeout", "TIMEOUT"));
             }
@@ -78668,6 +78770,7 @@ var OAuthCallbackServer = class {
     });
   }
   async stop() {
+    clearTimeout(this.startupTimer);
     if (!this.server) return;
     const server = this.server;
     this.server = null;
@@ -78699,7 +78802,9 @@ var MCPOAuthProvider = class {
     this.authServerMetadata = null;
     this.resourceMetadata = null;
     const serverUrl = options.serverUrl || CONFIG.WP_API_URL;
-    const defaultScopes = getDefaultOAuthScopes();
+    const defaultScopes = CONFIG.OAUTH_SCOPES ? getDefaultOAuthScopes() : [];
+    this.explicitScopes = options.scopes ?? defaultScopes;
+    this.configuredClientId = options.clientId || CONFIG.WP_OAUTH_CLIENT_ID || void 0;
     this.config = {
       serverUrl,
       resource: generateCanonicalResourceURI(serverUrl),
@@ -78758,187 +78863,217 @@ var MCPOAuthProvider = class {
   /**
    * Discover OAuth 2.1 server endpoints using MCP-compliant discovery
    */
-  async discoverOAuthEndpoints() {
-    try {
-      logger.oauth("Starting MCP-compliant OAuth endpoint discovery");
-      try {
-        this.resourceMetadata = await discoverProtectedResourceMetadata(this.config.resource);
-        logger.oauth("Protected resource metadata discovered");
-      } catch (error51) {
-        logger.warn(
-          "Protected resource metadata discovery failed, trying 401 response method",
-          "OAUTH"
-        );
-        await this.discoverVia401Response();
-      }
-      const authServerUrl = this.getAuthorizationServerUrl();
-      if (authServerUrl) {
-        this.authServerMetadata = await discoverAuthorizationServerMetadata2(authServerUrl);
-        logger.oauth("Authorization server metadata discovered");
-        this.config.authorizationEndpoint = this.authServerMetadata.authorization_endpoint;
-        this.config.tokenEndpoint = this.authServerMetadata.token_endpoint;
-        this.config.registrationEndpoint = this.authServerMetadata.registration_endpoint;
-      } else {
-        throw new OAuthError2("Could not determine authorization server URL", "DISCOVERY_FAILED");
-      }
-    } catch (error51) {
-      logger.error("OAuth endpoint discovery failed", "OAUTH", error51);
-      throw error51;
-    }
-  }
-  /**
-   * Discover endpoints via 401 Unauthorized response (RFC 9728 Section 5.1)
-   */
-  async discoverVia401Response() {
-    try {
-      logger.oauth("Attempting discovery via 401 response method");
-      const customHeaders = getCustomHeaders();
-      const response = await proxyFetch(this.config.serverUrl, {
-        headers: {
-          Accept: "application/json",
-          ...customHeaders
-        }
-      });
-      if (response.status === 401) {
-        const wwwAuthHeader = response.headers.get("WWW-Authenticate");
-        if (wwwAuthHeader) {
-          const authInfo = parseWWWAuthenticateHeader(wwwAuthHeader);
-          logger.oauth("WWW-Authenticate header parsed successfully");
-          if (authInfo.resource_metadata_url) {
-            const metadataResponse = await proxyFetch(authInfo.resource_metadata_url, {
-              headers: {
-                Accept: "application/json",
-                ...customHeaders
-              }
-            });
-            if (metadataResponse.ok) {
-              this.resourceMetadata = await metadataResponse.json();
-              logger.oauth("Protected resource metadata obtained via 401 response");
-            }
-          }
-        }
-      }
-    } catch (error51) {
-      logger.warn("401 response discovery method failed", "OAUTH", error51);
-    }
+  async discoverOAuthEndpoints(challenge) {
+    this.resourceMetadata = await discoverProtectedResourceMetadata(
+      this.config.serverUrl,
+      challenge?.resource_metadata
+    );
+    this.authServerMetadata = await discoverAuthorizationServerMetadata2(
+      this.resourceMetadata.authorization_servers[0]
+    );
+    this.config.resource = this.resourceMetadata.resource;
+    this.config.authorizationEndpoint = this.authServerMetadata.authorization_endpoint;
+    this.config.tokenEndpoint = this.authServerMetadata.token_endpoint;
+    this.config.registrationEndpoint = this.authServerMetadata.registration_endpoint;
+    this.config.clientId = this.configuredClientId;
+    const challenged = challenge?.scope?.split(/\s+/).filter(Boolean);
+    this.config.scopes = [
+      ...new Set(
+        challenged ?? (this.explicitScopes.length ? this.explicitScopes : this.resourceMetadata.scopes_supported ?? [])
+      )
+    ];
   }
-  /**
-   * Get authorization server URL from discovered metadata
-   */
   getAuthorizationServerUrl() {
-    if (this.resourceMetadata?.authorization_servers?.length) {
-      return this.resourceMetadata.authorization_servers[0];
-    }
-    try {
-      const url2 = new URL(this.config.serverUrl);
-      return url2.origin;
-    } catch {
-      return null;
-    }
+    return this.authServerMetadata?.issuer ?? this.resourceMetadata?.authorization_servers[0] ?? new URL(this.config.serverUrl).origin;
   }
   /**
    * Perform dynamic client registration if needed and supported
    */
   async ensureClientRegistration() {
+    const issuer = this.getAuthorizationServerUrl();
+    const stored = await readClientInfo(this.serverUrlHash);
     if (this.config.clientId) {
-      logger.oauth("Using provided client ID, skipping dynamic registration");
+      if (stored?.issuer && stored.issuer !== issuer && stored.client_id === this.config.clientId) {
+        throw new OAuthError2(
+          "Configured client belongs to another authorization server; update its registration",
+          "CLIENT_ISSUER_MISMATCH"
+        );
+      }
+      await writeClientInfo(this.serverUrlHash, { client_id: this.config.clientId, issuer });
       return;
     }
-    const storedClientInfo = await readClientInfo(this.serverUrlHash);
-    if (typeof storedClientInfo?.client_id === "string" && storedClientInfo.client_id.length > 0) {
-      this.config.clientId = storedClientInfo.client_id;
-      logger.oauth("Reusing persisted client registration, skipping dynamic registration");
+    if (stored?.issuer === issuer && typeof stored.client_id === "string" && stored.client_id.length > 0) {
+      this.config.clientId = stored.client_id;
       return;
     }
-    if (!CONFIG.OAUTH_DYNAMIC_REGISTRATION) {
+    if (!CONFIG.OAUTH_DYNAMIC_REGISTRATION)
       throw new OAuthError2(
-        "No client ID provided and dynamic registration is disabled",
+        "No issuer-bound client registration; configure a client ID or enable registration",
         "NO_CLIENT_ID"
       );
-    }
-    if (!this.authServerMetadata?.registration_endpoint) {
+    if (!this.authServerMetadata?.registration_endpoint)
       throw new OAuthError2(
-        "Dynamic client registration not supported by authorization server",
+        "Authorization server does not support dynamic registration; configure its client ID",
         "NO_DYNAMIC_REGISTRATION"
       );
-    }
-    try {
-      logger.oauth("Performing dynamic client registration");
-      const registrationRequest = {
-        redirect_uris: [this.config.redirectUri],
-        token_endpoint_auth_method: "none",
-        // Public client
-        grant_types: ["authorization_code"],
-        response_types: ["code"],
-        client_name: "WordPress MCP Remote",
-        scope: this.config.scopes.join(" ")
-      };
-      const registrationResponse = await registerDynamicClient(
-        this.authServerMetadata.registration_endpoint,
-        registrationRequest
-      );
-      const clientInfo = {
-        client_id: registrationResponse.client_id,
-        client_secret: registrationResponse.client_secret
-      };
-      await writeClientInfo(this.serverUrlHash, clientInfo);
-      this.config.clientId = registrationResponse.client_id;
-      logger.oauth("Dynamic client registration completed successfully");
-    } catch (error51) {
-      logger.error("Dynamic client registration failed", "OAUTH", error51);
-      throw error51;
-    }
+    const request = {
+      redirect_uris: [this.config.redirectUri],
+      application_type: "native",
+      token_endpoint_auth_method: "none",
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"],
+      client_name: "WordPress MCP Remote",
+      ...this.config.scopes.length ? { scope: this.config.scopes.join(" ") } : {}
+    };
+    const registered = await registerDynamicClient(
+      this.authServerMetadata.registration_endpoint,
+      request
+    );
+    await writeClientInfo(this.serverUrlHash, {
+      ...request,
+      client_id: registered.client_id,
+      issuer
+    });
+    this.config.clientId = registered.client_id;
   }
   /**
    * Initiate MCP-compliant OAuth 2.1 authorization flow
    */
-  async authorize() {
-    if (this.authPromise) {
-      logger.oauth("Authorization already in progress, waiting...");
-      await this.authPromise;
-      return;
-    }
-    const existingTokens = await this.tokens();
-    if (existingTokens) {
-      logger.oauth("Already have valid tokens, skipping authorization");
-      return;
+  satisfies(tokens, request) {
+    return !!tokens && tokens.access_token !== request.rejectedToken && (!request.scopes?.length || request.scopes.every((scope) => tokens.scope?.split(" ").includes(scope)));
+  }
+  async authorize(request = {}) {
+    if (this.authPromise) await this.authPromise;
+    if (!this.authPromise) this.authPromise = this.authorizeWithLock(request);
+    const pending = this.authPromise;
+    try {
+      await pending;
+    } finally {
+      if (this.authPromise === pending) this.authPromise = null;
     }
-    logger.oauth("Starting MCP-compliant OAuth 2.1 authorization flow");
-    this.authPromise = this.performAuthorization();
+  }
+  async authorizeWithLock(request) {
+    const valid = await this.tokens();
+    if (this.satisfies(valid, request)) return valid;
+    await ensureConfigDir();
+    const file2 = getConfigFilePath(this.serverUrlHash, "oauth");
+    let release;
     try {
-      await this.authPromise;
-      logger.oauth("OAuth 2.1 authorization completed successfully");
+      release = await lockfile.lock(file2, { realpath: false });
     } catch (error51) {
-      logger.error("OAuth 2.1 authorization failed", "OAUTH", error51);
-      throw error51;
+      if (error51.code !== "ELOCKED") throw error51;
+      const deadline = Date.now() + this.config.timeout;
+      while (Date.now() < deadline) {
+        const tokens = await this.tokens();
+        if (this.satisfies(tokens, request)) return tokens;
+        if (!await lockfile.check(file2, { realpath: false })) {
+          const completed = await this.tokens();
+          if (this.satisfies(completed, request)) return completed;
+          throw new OAuthError2("Authentication in another process did not complete", "AUTH_FAILED");
+        }
+        await delay(Math.min(100, Math.max(0, deadline - Date.now())));
+      }
+      throw new OAuthError2("Timeout waiting for authentication in another process", "LOCK_TIMEOUT");
+    }
+    try {
+      const completed = await this.tokens();
+      if (this.satisfies(completed, request)) return completed;
+      await this.discoverOAuthEndpoints(request.challenge);
+      const issuer = this.getAuthorizationServerUrl();
+      const stored = await readTokens(this.serverUrlHash);
+      const client = await readClientInfo(this.serverUrlHash);
+      if (this.configuredClientId && client?.issuer && client.issuer !== issuer && client.client_id === this.configuredClientId) {
+        throw new OAuthError2(
+          "Configured client belongs to another authorization server",
+          "CLIENT_ISSUER_MISMATCH"
+        );
+      }
+      this.config.scopes = [
+        .../* @__PURE__ */ new Set([
+          ...stored?.issuer === issuer ? stored.scope?.split(" ").filter(Boolean) ?? [] : [],
+          ...this.config.scopes,
+          ...request.scopes ?? []
+        ])
+      ];
+      const needsScope = !!request.scopes?.some(
+        (scope) => !stored?.scope?.split(" ").includes(scope)
+      );
+      const clientId = this.configuredClientId || client?.client_id;
+      if (stored?.issuer === issuer && client?.issuer === issuer && stored.refresh_token && clientId && (!this.configuredClientId || this.configuredClientId === client.client_id) && !needsScope) {
+        try {
+          const renewed = await refreshAuthorization(issuer, {
+            metadata: { ...this.authServerMetadata },
+            clientInformation: { client_id: clientId },
+            refreshToken: stored.refresh_token,
+            resource: this.resourceIndicator(),
+            fetchFn: (url2, init) => oauthFetch(String(url2), init)
+          });
+          if (renewed.token_type.toLowerCase() !== "bearer")
+            throw new OAuthError2("Unsupported token type", "INVALID_TOKEN_RESPONSE");
+          const tokens = {
+            ...renewed,
+            issuer,
+            scope: renewed.scope ?? stored.scope,
+            obtained_at: Date.now()
+          };
+          await writeTokens(this.serverUrlHash, tokens);
+          return tokens;
+        } catch (error51) {
+          if (!(error51 instanceof InvalidGrantError)) throw error51;
+          await deleteConfigFile(this.serverUrlHash, "tokens.json");
+        }
+      }
+      return await this.performAuthorization();
     } finally {
-      this.authPromise = null;
+      await release();
     }
   }
+  resourceIndicator() {
+    if (!CONFIG.OAUTH_RESOURCE_INDICATOR)
+      throw new OAuthError2(
+        "MCP OAuth requires resource indicators; remove OAUTH_RESOURCE_INDICATOR=false",
+        "RESOURCE_REQUIRED"
+      );
+    return this.config.resource;
+  }
   /**
    * Perform the complete OAuth 2.1 authorization flow
    */
   async performAuthorization() {
     try {
-      await this.discoverOAuthEndpoints();
-      const callbackPort = this.config.callbackPort === 0 ? await getOAuthCallbackPort() : this.config.callbackPort;
+      if (!this.authServerMetadata) await this.discoverOAuthEndpoints();
+      if (!this.authServerMetadata?.code_challenge_methods_supported?.includes("S256"))
+        throw new OAuthError2(
+          "Authorization server must advertise PKCE S256 support",
+          "PKCE_REQUIRED"
+        );
+      this.resourceIndicator();
+      if (!["127.0.0.1", "localhost", "::1"].includes(this.config.host))
+        throw new OAuthError2(
+          "Native OAuth callback must bind to loopback",
+          "INVALID_CALLBACK_HOST"
+        );
+      this.currentPKCE = generatePKCE();
+      this.currentState = generateSecureState();
+      const callbackPort = this.config.callbackPort === 0 ? await selectCallbackPort(this.config.serverUrl, void 0, false, this.config.host) : this.config.callbackPort;
       const callbackServer = setupWPOAuthCallbackServer(
         {
           port: callbackPort,
           host: this.config.host,
           serverUrlHash: this.serverUrlHash,
-          timeout: this.config.timeout
+          timeout: this.config.timeout,
+          state: this.currentState,
+          issuer: this.authServerMetadata.issuer,
+          requireIssuer: this.authServerMetadata.authorization_response_iss_parameter_supported
         },
         this.events
       );
       await callbackServer.start();
       logger.oauth("OAuth callback server started");
       try {
-        const actualRedirectUri = `http://${this.config.host}:${callbackPort}/oauth/callback`;
+        const actualRedirectUri = `http://${this.config.host === "::1" ? "[::1]" : this.config.host}:${callbackPort}/oauth/callback`;
         this.config.redirectUri = actualRedirectUri;
         await this.ensureClientRegistration();
-        this.currentPKCE = generatePKCE();
-        this.currentState = generateSecureState();
         await writeTextFile(this.serverUrlHash, "pkce_verifier.txt", this.currentPKCE.codeVerifier);
         await writeTextFile(this.serverUrlHash, "oauth_state.txt", this.currentState);
         const authUrl = buildAuthorizationUrl(
@@ -78948,10 +79083,13 @@ var MCPOAuthProvider = class {
           this.config.scopes,
           this.currentState,
           this.currentPKCE.codeChallenge,
-          CONFIG.OAUTH_RESOURCE_INDICATOR ? this.config.resource : void 0
+          this.resourceIndicator()
         );
         logger.oauth("Built OAuth 2.1 authorization URL");
         logger.debug("Authorization URL", "OAUTH", { url: authUrl });
+        const authorizationCode = this.waitForAuthorizationCode();
+        void authorizationCode.catch(() => {
+        });
         try {
           await open_default(authUrl);
           logger.oauth("Browser opened successfully");
@@ -78962,13 +79100,20 @@ var MCPOAuthProvider = class {
           logger.info(`${authUrl}`);
           logger.info("===============================\n");
         }
-        const authCode = await this.waitForAuthorizationCode();
-        const tokens = await this.exchangeCodeForTokens(authCode, actualRedirectUri);
+        const authCode = await authorizationCode;
+        const response = await this.exchangeCodeForTokens(authCode, actualRedirectUri);
+        const tokens = {
+          ...response,
+          issuer: this.getAuthorizationServerUrl(),
+          scope: response.scope ?? this.config.scopes.join(" ")
+        };
         await writeTokens(this.serverUrlHash, tokens);
         logger.oauth("OAuth 2.1 tokens stored successfully");
         return tokens;
       } finally {
         await callbackServer.stop();
+        await deleteConfigFile(this.serverUrlHash, "pkce_verifier.txt");
+        await deleteConfigFile(this.serverUrlHash, "oauth_state.txt");
       }
     } catch (error51) {
       logger.error("Error during OAuth 2.1 authorization flow", "OAUTH", error51);
@@ -78989,12 +79134,16 @@ var MCPOAuthProvider = class {
         this.events.removeAllListeners("oauth-error");
         clearTimeout(timeout);
       };
-      this.events.once("oauth-code-received", async ({ code, state }) => {
+      this.events.once("oauth-code-received", async ({ code, state, iss }) => {
         cleanup();
         if (state !== this.currentState) {
           reject(new OAuthError2("State parameter mismatch", "INVALID_STATE"));
           return;
         }
+        if ((iss !== void 0 || this.authServerMetadata?.authorization_response_iss_parameter_supported) && iss !== this.authServerMetadata?.issuer) {
+          reject(new OAuthError2("Authorization response issuer mismatch", "INVALID_ISSUER"));
+          return;
+        }
         logger.oauth("Valid authorization code received");
         resolve(code);
       });
@@ -79020,7 +79169,7 @@ var MCPOAuthProvider = class {
         redirectUri,
         this.config.clientId,
         codeVerifier,
-        CONFIG.OAUTH_RESOURCE_INDICATOR ? this.config.resource : void 0
+        this.resourceIndicator()
       );
       await deleteConfigFile(this.serverUrlHash, "pkce_verifier.txt");
       await deleteConfigFile(this.serverUrlHash, "oauth_state.txt");
@@ -79086,6 +79235,7 @@ import * as path5 from "node:path";
 import * as os3 from "node:os";
 
 // src/lib/persistent-oauth-client-provider.ts
+import { randomBytes } from "node:crypto";
 import { EventEmitter as EventEmitter2 } from "node:events";
 var PersistentWPOAuthClientProvider = class {
   constructor(options) {
@@ -79243,7 +79393,10 @@ var PersistentWPOAuthClientProvider = class {
    */
   async performAuthorization() {
     const callbackPort = this.options.callbackPort === 0 ? await getOAuthCallbackPort() : this.options.callbackPort;
+    const state = this.generateState();
     const callbackServerOptions = {
+      flow: "implicit",
+      state,
       port: callbackPort,
       host: this.options.host,
       serverUrlHash: this.serverUrlHash,
@@ -79255,12 +79408,14 @@ var PersistentWPOAuthClientProvider = class {
       logger.oauth("Starting callback server...");
       await callbackServer.start();
       logger.oauth("Callback server started successfully");
-      const state = this.generateState();
       logger.debug(`Generated state parameter: ${state}`, "OAUTH");
       const authUrl = this.buildAuthorizationUrl(callbackServer.getCallbackUrl(), state);
       logger.oauth(`Built authorization URL: ${authUrl}`);
       logger.debug(`Callback URL: ${callbackServer.getCallbackUrl()}`, "OAUTH");
       logger.oauth("Attempting to open browser...");
+      const authorization = this.waitForAuthorizationResult();
+      void authorization.catch(() => {
+      });
       try {
         await open_default(authUrl);
         logger.oauth("Browser opened successfully");
@@ -79272,7 +79427,7 @@ var PersistentWPOAuthClientProvider = class {
         logger.info("===============================\n");
       }
       logger.oauth("Waiting for authorization result...");
-      const tokens = await this.waitForAuthorizationResult();
+      const tokens = await authorization;
       logger.oauth("Authorization result received");
       logger.oauth("Saving tokens to persistent storage...");
       await this.saveTokens(tokens);
@@ -79325,7 +79480,7 @@ var PersistentWPOAuthClientProvider = class {
    * Generate a secure state parameter
    */
   generateState() {
-    return Math.random().toString(36).substring(2, 15) + Math.random().toString(36).substring(2, 15);
+    return randomBytes(32).toString("base64url");
   }
   /**
    * Wait for authorization result from callback server
@@ -79720,6 +79875,12 @@ function constructApiUrl(baseUrl, defaultEndpoint) {
     return new URL(`/?rest_route=${defaultEndpoint}`, cleanUrl).toString();
   }
 }
+function getMCPOAuthProvider() {
+  return mcpOAuthProvider ??= new MCPOAuthProvider({
+    serverUrl: getRequestUrl(),
+    clientId: CONFIG.WP_OAUTH_CLIENT_ID
+  });
+}
 async function getOAuthTokens() {
   try {
     if (!CONFIG.OAUTH_ENABLED) {
@@ -79727,7 +79888,7 @@ async function getOAuthTokens() {
       return null;
     }
     logger.auth("Attempting to get OAuth tokens for WordPress API (MCP-compliant)...");
-    const serverUrl = CONFIG.WP_API_URL;
+    const serverUrl = getRequestUrl();
     const serverUrlHash = generateServerUrlHash(serverUrl);
     const existingTokens = await getValidTokens(serverUrlHash);
     if (existingTokens) {
@@ -79738,16 +79899,10 @@ async function getOAuthTokens() {
     logger.auth("Starting MCP-compliant OAuth 2.1 authentication flow");
     logger.auth("Your browser should open automatically for authentication");
     if (CONFIG.OAUTH_FLOW_TYPE === "authorization_code" && CONFIG.OAUTH_USE_PKCE) {
-      if (!mcpOAuthProvider) {
-        mcpOAuthProvider = new MCPOAuthProvider({
-          serverUrl,
-          clientId: CONFIG.WP_OAUTH_CLIENT_ID,
-          scopes: getDefaultOAuthScopes()
-        });
-      }
       logger.auth("Using MCP-compliant OAuth 2.1 authorization code flow with PKCE");
-      await mcpOAuthProvider.authorize();
-      const tokens = await mcpOAuthProvider.tokens();
+      const provider = getMCPOAuthProvider();
+      await provider.authorize();
+      const tokens = await provider.tokens();
       if (tokens) {
         logger.auth("MCP OAuth 2.1 tokens obtained for WordPress API access");
         return tokens;
@@ -79788,6 +79943,22 @@ async function getOAuthTokens() {
     return null;
   }
 }
+async function recoverOAuthAuthorization(authorization, challenge, status = 401) {
+  if (!CONFIG.OAUTH_ENABLED || CONFIG.JWT_TOKEN || CONFIG.OAUTH_FLOW_TYPE !== "authorization_code" || !CONFIG.OAUTH_USE_PKCE)
+    return false;
+  if (authorization && !/^Bearer /i.test(authorization)) return false;
+  const scopes = status === 401 || challenge?.error === "insufficient_scope" ? challenge?.scope?.split(/\s+/).filter(Boolean) : void 0;
+  if (status === 403 && !scopes?.length) return false;
+  const current = await getValidTokens(generateServerUrlHash(getRequestUrl()));
+  if (status === 403 && scopes?.every((scope) => current?.scope?.split(" ").includes(scope)))
+    return current?.access_token !== authorization?.slice(7);
+  await getMCPOAuthProvider().authorize({
+    rejectedToken: status === 401 ? authorization?.slice(7) : void 0,
+    challenge,
+    scopes
+  });
+  return true;
+}
 function getCurrentApiUrl() {
   return process.env.WP_API_URL || CONFIG.WP_API_URL;
 }
@@ -79806,7 +79977,7 @@ function bindWordPressRequest(request) {
     if (shared[LIVE_REQUEST_KEY] === request) delete shared[LIVE_REQUEST_KEY];
   };
 }
-async function getWordPressHeaders(requestData) {
+async function getWordPressHeaders(requestData, options = {}) {
   validateEnvironment();
   let authHeader = "";
   if (CONFIG.JWT_TOKEN) {
@@ -79815,7 +79986,7 @@ async function getWordPressHeaders(requestData) {
     logger.debug(`Token length: ${CONFIG.JWT_TOKEN.length}`, "AUTH");
   } else if (CONFIG.OAUTH_ENABLED) {
     logger.auth("OAuth is the primary authentication method - attempting to get tokens...");
-    const oauthTokens = await getOAuthTokens();
+    const oauthTokens = options.allowUnauthenticated && !CONFIG.WP_API_USERNAME ? await getValidTokens(generateServerUrlHash(getRequestUrl())) : await getOAuthTokens();
     if (oauthTokens) {
       authHeader = `Bearer ${oauthTokens.access_token}`;
       logger.auth("Using OAuth token authentication for WordPress API");
@@ -79855,7 +80026,7 @@ async function getWordPressHeaders(requestData) {
     if (name.toLowerCase() === "mcp-protocol-version") delete customHeaders[name];
   }
   const hasCustomHeaders = Object.keys(customHeaders).length > 0;
-  if (!authHeader && !hasCustomHeaders) {
+  if (!authHeader && !hasCustomHeaders && !(options.allowUnauthenticated && CONFIG.OAUTH_ENABLED)) {
     throw new AuthError(
       "No authentication method available. Please configure JWT_TOKEN, OAuth, Basic Auth (WP_API_USERNAME+WP_API_PASSWORD), or CUSTOM_HEADERS.",
       "NO_AUTH_METHOD"
@@ -79887,6 +80058,9 @@ function collectHeaderParams(schema, path6 = []) {
     return [...own, ...collectHeaderParams(child, [...path6, key])];
   });
 }
+function isBearerChallenge(challenge) {
+  return challenge === null || parseWWWAuthenticateHeader(challenge).scheme === "Bearer";
+}
 function valueAtPath(value, path6) {
   return path6.reduce(
     (node, key) => node && typeof node === "object" ? node[key] : void 0,
@@ -79896,25 +80070,26 @@ function valueAtPath(value, path6) {
 function createWordPressTransport(onFailure) {
   const inflight = /* @__PURE__ */ new Map();
   const toolHeaders = /* @__PURE__ */ new Map();
-  const fetch3 = async (url2, init) => {
+  const scopeAttempts = /* @__PURE__ */ new Set();
+  const scopeCounts = /* @__PURE__ */ new Map();
+  const send = async (url2, init, retried) => {
     const message = typeof init?.body === "string" ? JSON.parse(init.body) : void 0;
     const request = message && "method" in message && "id" in message ? message : void 0;
     const controller = new AbortController();
-    const abort = () => controller.abort();
     let cancelled = false;
     const cancel = () => {
       cancelled = true;
-      abort();
+      controller.abort();
     };
     if (request) inflight.set(request.id, cancel);
-    init?.signal?.addEventListener("abort", abort, { once: true });
-    if (init?.signal?.aborted) abort();
+    init?.signal?.addEventListener("abort", cancel, { once: true });
+    if (init?.signal?.aborted) cancel();
     const timeoutMs = message && "method" in message && message.method === "initialize" ? CONFIG.WP_API_INIT_TIMEOUT : CONFIG.WP_API_TIMEOUT;
     let timedOut = false;
     let timer;
     const cleanup = () => {
       clearTimeout(timer);
-      init?.signal?.removeEventListener("abort", abort);
+      init?.signal?.removeEventListener("abort", cancel);
       if (request && inflight.get(request.id) === cancel) inflight.delete(request.id);
     };
     const failure = (error51) => {
@@ -79930,7 +80105,9 @@ function createWordPressTransport(onFailure) {
       return apiError;
     };
     try {
-      const headers = new Headers(await getWordPressHeaders(message));
+      const headers = new Headers(
+        await getWordPressHeaders(message, { allowUnauthenticated: !retried })
+      );
       if (init?.method !== "GET" && request?.method !== "subscriptions/listen") {
         timer = setTimeout(() => {
           timedOut = true;
@@ -79963,17 +80140,55 @@ function createWordPressTransport(onFailure) {
         headers,
         signal: controller.signal
       });
+      const challenge = parseWWWAuthenticateHeader(response.headers.get("WWW-Authenticate") ?? "");
+      const operationKey = JSON.stringify([
+        request?.method,
+        request?.params?.name ?? request?.params?.uri
+      ]);
+      const scopeKey = JSON.stringify([
+        request?.method,
+        request?.params?.name,
+        challenge.scope?.split(/\s+/).sort()
+      ]);
+      const canRecover = !retried && (response.status === 401 && isBearerChallenge(response.headers.get("WWW-Authenticate")) || response.status === 403 && challenge.error === "insufficient_scope" && !!challenge.scope && !scopeAttempts.has(scopeKey) && (scopeCounts.get(operationKey) ?? 0) < 2);
+      if (canRecover) {
+        if (response.status === 403) {
+          scopeAttempts.add(scopeKey);
+          scopeCounts.set(operationKey, (scopeCounts.get(operationKey) ?? 0) + 1);
+        }
+        clearTimeout(timer);
+        const recovered = await recoverOAuthAuthorization(
+          headers.get("Authorization"),
+          challenge,
+          response.status
+        );
+        if (recovered) {
+          const unread = response.body;
+          if (typeof unread?.cancel === "function") await unread.cancel();
+          else unread?.destroy?.();
+          cleanup();
+          if (cancelled) return new Response(null, { status: 202 });
+          return send(url2, init, true);
+        }
+        timer = setTimeout(() => {
+          timedOut = true;
+          controller.abort();
+        }, timeoutMs);
+      }
       const body = response.body && typeof response.body.getReader !== "function" ? Readable.toWeb(response.body) : response.body;
       const reader = body?.getReader();
+      let released = false;
       const stream = reader ? new ReadableStream({
         async pull(output) {
           try {
             const { value, done } = await reader.read();
+            if (released) return;
             if (done) {
               cleanup();
               output.close();
             } else output.enqueue(value);
           } catch (error51) {
+            if (released) return;
             if (cancelled) {
               cleanup();
               output.close();
@@ -79981,6 +80196,7 @@ function createWordPressTransport(onFailure) {
           }
         },
         async cancel(reason) {
+          released = true;
           cleanup();
           await reader.cancel(reason);
         }
@@ -80019,6 +80235,7 @@ function createWordPressTransport(onFailure) {
       throw failure(error51);
     }
   };
+  const fetch3 = (url2, init) => send(url2, init, false);
   return Object.assign(new StreamableHTTPClientTransport(new URL(getRequestUrl()), { fetch: fetch3 }), {
     cancelRequest(id) {
       inflight.get(id)?.();
@@ -80246,11 +80463,6 @@ async function startPassThrough(local, remote) {
 validateNodeVersion(18);
 async function WordPressProxy() {
   await setupFetchPolyfill();
-  try {
-    await cleanupExpiredTokens();
-  } catch (error51) {
-    logger.warn("Error cleaning up expired tokens", "PROXY", error51);
-  }
   const local = new StdioServerTransport();
   let bridge;
   const remote = createWordPressTransport((message, error51) => bridge?.fail(message, error51));
@@ -80285,6 +80497,13 @@ formdata-polyfill/esm.min.js:
 node-domexception/index.js:
   (*! node-domexception. MIT License. Jimmy Wärting <https://jimmy.warting.se/opensource> *)
 
+content-type/index.js:
+  (*!
+   * content-type
+   * Copyright(c) 2015 Douglas Christopher Wilson
+   * MIT Licensed
+   *)
+
 depd/index.js:
   (*!
    * depd
@@ -80482,13 +80701,6 @@ express/lib/view.js:
    * MIT Licensed
    *)
 
-content-type/index.js:
-  (*!
-   * content-type
-   * Copyright(c) 2015 Douglas Christopher Wilson
-   * MIT Licensed
-   *)
-
 etag/index.js:
   (*!
    * etag