@automattic/mcp-wordpress-remote 0.5.2 → 0.5.3

package/dist/proxy.js

@@ -76381,7 +76381,6 @@ import crypto3 from "crypto";
 // src/lib/persistent-auth-config.ts
 import path from "path";
 import fs from "fs/promises";
-import fsSync from "fs";
 import crypto2 from "crypto";
 function getConfigDir() {
   const baseConfigDir = CONFIG.WP_MCP_CONFIG_DIR;
@@ -76478,21 +76477,25 @@ async function writeTokens(serverUrlHash, tokens) {
       ...tokens,
       obtained_at: Date.now()
     };
-    await writeJsonFile(serverUrlHash, "tokens.json", tokensWithTimestamp);
+    await ensureConfigDir();
+    const file2 = getConfigFilePath(serverUrlHash, "tokens.json");
+    const temporary = `${file2}.${crypto2.randomUUID()}.tmp`;
+    try {
+      await fs.writeFile(temporary, JSON.stringify(tokensWithTimestamp, null, 2), {
+        encoding: "utf-8",
+        mode: 384,
+        flag: "wx"
+      });
+      await fs.rename(temporary, file2);
+    } finally {
+      await fs.rm(temporary, { force: true });
+    }
     logger.info(`Stored tokens for server hash: ${serverUrlHash}`, "AUTH");
   } catch (error51) {
     logger.error(`Error writing tokens for ${serverUrlHash}`, "AUTH", error51);
     throw error51;
   }
 }
-async function deleteTokens(serverUrlHash) {
-  try {
-    await deleteConfigFile(serverUrlHash, "tokens.json");
-    logger.info(`Deleted tokens for server hash: ${serverUrlHash}`, "AUTH");
-  } catch (error51) {
-    logger.error(`Error deleting tokens for ${serverUrlHash}`, "AUTH", error51);
-  }
-}
 async function readClientInfo(serverUrlHash) {
   try {
     const clientInfo = await readJsonFile(serverUrlHash, "client_info.json");
@@ -76519,7 +76522,7 @@ function isTokenValid(tokens) {
   if (!tokens?.access_token) {
     return { isValid: false, error: "No access token" };
   }
-  if (!tokens.expires_in || !tokens.obtained_at) {
+  if (tokens.expires_in === void 0 || tokens.obtained_at === void 0) {
     return { isValid: true };
   }
   const now = Date.now();
@@ -76551,30 +76554,6 @@ async function getValidTokens(serverUrlHash) {
   }
   return tokens;
 }
-async function cleanupExpiredTokens() {
-  try {
-    const configDir = getConfigDir();
-    if (!fsSync.existsSync(configDir)) {
-      return;
-    }
-    const files = await fs.readdir(configDir);
-    const tokenFiles = files.filter((file2) => file2.endsWith("_tokens.json"));
-    let cleaned = 0;
-    for (const file2 of tokenFiles) {
-      const serverHash = file2.replace("_tokens.json", "");
-      const tokens = await readTokens(serverHash);
-      if (tokens && !isTokenValid(tokens).isValid) {
-        await deleteTokens(serverHash);
-        cleaned++;
-      }
-    }
-    if (cleaned > 0) {
-      logger.info(`Cleaned up ${cleaned} expired token files`, "AUTH");
-    }
-  } catch (error51) {
-    logger.error("Error during token cleanup", "AUTH", error51);
-  }
-}
 
 // src/lib/port-utils.ts
 var OAuthClientInfoSchema = external_exports.object({
@@ -76582,12 +76561,12 @@ var OAuthClientInfoSchema = external_exports.object({
   client_id: external_exports.string().optional(),
   client_secret: external_exports.string().optional()
 });
-async function findAvailablePort(preferredPort) {
+async function findAvailablePort(preferredPort, host = "127.0.0.1") {
   return new Promise((resolve, reject) => {
     const server = net.createServer();
     server.on("error", (err) => {
       if (err.code === "EADDRINUSE") {
-        server.listen(0);
+        server.listen(0, host);
       } else {
         reject(err);
       }
@@ -76598,7 +76577,7 @@ async function findAvailablePort(preferredPort) {
         resolve(port);
       });
     });
-    server.listen(preferredPort || 0);
+    server.listen(preferredPort || 0, host);
   });
 }
 function calculateDefaultPort(serverUrlHash) {
@@ -76626,24 +76605,17 @@ async function findExistingClientPort(serverUrlHash) {
 function getServerUrlHash(serverUrl) {
   return crypto3.createHash("md5").update(serverUrl).digest("hex");
 }
-async function selectCallbackPort(serverUrl, specifiedPort, _unused) {
+async function selectCallbackPort(serverUrl, specifiedPort, _unused, host = "127.0.0.1") {
   const serverUrlHash = getServerUrlHash(serverUrl);
   if (specifiedPort) {
     return specifiedPort;
   }
-  const defaultPort = calculateDefaultPort(serverUrlHash);
-  const [existingClientPort, availablePort] = await Promise.all([
-    findExistingClientPort(serverUrlHash),
-    findAvailablePort(defaultPort)
-  ]);
-  if (existingClientPort) {
-    return existingClientPort;
-  }
-  return availablePort;
+  const existingClientPort = await findExistingClientPort(serverUrlHash);
+  return findAvailablePort(existingClientPort ?? calculateDefaultPort(serverUrlHash), host);
 }
 
 // src/lib/config.ts
-var MCP_WORDPRESS_REMOTE_VERSION = "0.5.2";
+var MCP_WORDPRESS_REMOTE_VERSION = "0.5.3";
 function parsePositiveIntEnv(value, defaultValue) {
   if (!value) {
     return defaultValue;
@@ -76844,8 +76816,8 @@ async function getOAuthCallbackPort() {
   return selectCallbackPort(
     CONFIG.WP_API_URL,
     CONFIG.OAUTH_CALLBACK_PORT,
-    false
-    // Always treat as self-hosted for port selection
+    false,
+    CONFIG.OAUTH_HOST
   );
 }
 function formatConfigError(error51) {
@@ -77380,13 +77352,13 @@ var StreamableHTTPClientTransport = class {
       this.onerror?.(new Error(`Maximum reconnection attempts (${maxRetries}) exceeded.`));
       return;
     }
-    const delay = this._getNextReconnectionDelay(attemptCount);
+    const delay2 = this._getNextReconnectionDelay(attemptCount);
     this._reconnectionTimeout = setTimeout(() => {
       this._startOrAuthSse(options).catch((error51) => {
         this.onerror?.(new Error(`Failed to reconnect SSE stream: ${error51 instanceof Error ? error51.message : String(error51)}`));
         this._scheduleReconnection(options, attemptCount + 1);
       });
-    }, delay);
+    }, delay2);
   }
   _handleSseStream(stream, options, isReconnectable) {
     if (!stream) {
@@ -78292,10 +78264,48 @@ defineLazyProperty(apps, "browserPrivate", () => "browserPrivate");
 var open_default = open;
 
 // src/lib/mcp-oauth-provider.ts
+import lockfile from "proper-lockfile";
+import { setTimeout as delay } from "node:timers/promises";
 import { EventEmitter } from "node:events";
 
 // src/lib/mcp-oauth-utils.ts
 import crypto4 from "crypto";
+
+// src/lib/oauth-http.ts
+function validateOAuthUrl(value) {
+  let url2;
+  try {
+    url2 = new URL(value);
+  } catch {
+    throw new OAuthError2("Invalid OAuth URL", "INVALID_OAUTH_URL");
+  }
+  const loopback = url2.hostname === "localhost" || url2.hostname === "[::1]" || /^127(?:\.\d{1,3}){3}$/.test(url2.hostname);
+  if (url2.protocol !== "https:" && !(url2.protocol === "http:" && loopback) || url2.username || url2.password || url2.hash) {
+    throw new OAuthError2(
+      "OAuth URLs require HTTPS (HTTP is allowed only on loopback)",
+      "INSECURE_OAUTH_URL"
+    );
+  }
+  return url2;
+}
+async function oauthFetch(value, init = {}) {
+  const url2 = validateOAuthUrl(value);
+  const headers = new Headers(
+    url2.origin === new URL(CONFIG.WP_API_URL).origin ? getCustomHeaders() : {}
+  );
+  new Headers(init.headers).forEach((value2, key) => headers.set(key, value2));
+  const response = await proxyFetch(url2.toString(), {
+    ...init,
+    headers,
+    redirect: "error",
+    signal: init.signal ?? AbortSignal.timeout(CONFIG.OAUTH_TIMEOUT)
+  });
+  if (response.status >= 300 && response.status < 400)
+    throw new OAuthError2("OAuth endpoint redirects are not accepted", "OAUTH_REDIRECT");
+  return response;
+}
+
+// src/lib/mcp-oauth-utils.ts
 function generatePKCE() {
   const codeVerifier = crypto4.randomBytes(64).toString("base64url").substring(0, 128);
   const codeChallenge = crypto4.createHash("sha256").update(codeVerifier).digest("base64url");
@@ -78323,118 +78333,99 @@ function generateCanonicalResourceURI(serverUrl) {
   }
 }
 async function discoverAuthorizationServerMetadata2(authorizationServerUrl) {
-  try {
-    const metadataUrl = new URL("/.well-known/oauth-authorization-server", authorizationServerUrl);
-    logger.oauth(`Discovering authorization server metadata: ${metadataUrl}`);
-    const customHeaders = getCustomHeaders();
-    const response = await proxyFetch(metadataUrl.toString(), {
-      headers: {
-        Accept: "application/json",
-        ...customHeaders
-      }
-    });
-    if (!response.ok) {
+  const issuer = validateOAuthUrl(authorizationServerUrl);
+  if (issuer.search) throw new OAuthError2("Issuer must not contain a query", "INVALID_METADATA");
+  for (const { url: url2 } of buildDiscoveryUrls(issuer)) {
+    const response = await oauthFetch(url2.toString(), { headers: { Accept: "application/json" } });
+    if ([404, 405].includes(response.status)) continue;
+    if (!response.ok)
       throw new OAuthError2(
-        `Failed to fetch authorization server metadata: ${response.status}`,
+        `Metadata request failed (${response.status})`,
         "METADATA_DISCOVERY_FAILED"
       );
-    }
-    const metadata = await response.json();
-    if (!metadata.authorization_endpoint || !metadata.token_endpoint) {
+    const parsed = OAuthMetadataSchema.safeParse(await response.json());
+    if (!parsed.success || parsed.data.issuer !== authorizationServerUrl) {
       throw new OAuthError2(
-        "Authorization server metadata missing required endpoints",
+        "Authorization metadata has an invalid or mismatched issuer",
         "INVALID_METADATA"
       );
     }
-    logger.oauth("Authorization server metadata discovered successfully");
+    const metadata = parsed.data;
+    validateOAuthUrl(metadata.issuer);
+    validateOAuthUrl(metadata.authorization_endpoint);
+    validateOAuthUrl(metadata.token_endpoint);
+    if (metadata.registration_endpoint) validateOAuthUrl(metadata.registration_endpoint);
     return metadata;
-  } catch (error51) {
-    if (error51 instanceof OAuthError2) {
-      throw error51;
-    }
-    throw new OAuthError2(
-      `Error discovering authorization server metadata: ${error51 instanceof Error ? error51.message : String(error51)}`,
-      "METADATA_DISCOVERY_ERROR"
-    );
   }
+  throw new OAuthError2("No authorization server metadata found", "METADATA_DISCOVERY_FAILED");
 }
-async function discoverProtectedResourceMetadata(resourceUrl) {
-  try {
-    const url2 = new URL(resourceUrl);
-    const metadataUrl = new URL("/.well-known/oauth-protected-resource", url2.origin);
-    logger.oauth(`Discovering protected resource metadata: ${metadataUrl}`);
-    const customHeaders = getCustomHeaders();
-    const response = await proxyFetch(metadataUrl.toString(), {
-      headers: {
-        Accept: "application/json",
-        ...customHeaders
+async function discoverProtectedResourceMetadata(resourceUrl, resourceMetadataUrl) {
+  const resource = validateOAuthUrl(resourceUrl);
+  const candidates = resourceMetadataUrl ? [{ url: resourceMetadataUrl, expected: resourceUrl }] : [
+    ...resource.pathname !== "/" ? [
+      {
+        url: `${resource.origin}/.well-known/oauth-protected-resource${resource.pathname}`,
+        expected: resourceUrl
       }
-    });
-    if (!response.ok) {
+    ] : [],
+    {
+      url: `${resource.origin}/.well-known/oauth-protected-resource`,
+      expected: resource.pathname === "/" ? resourceUrl : resource.origin
+    }
+  ];
+  for (const candidate of candidates) {
+    const response = await oauthFetch(candidate.url, { headers: { Accept: "application/json" } });
+    if (!resourceMetadataUrl && [404, 405].includes(response.status)) continue;
+    if (!response.ok)
       throw new OAuthError2(
-        `Failed to fetch protected resource metadata: ${response.status}`,
+        `Resource metadata request failed (${response.status})`,
         "RESOURCE_METADATA_DISCOVERY_FAILED"
       );
-    }
-    const metadata = await response.json();
-    if (!metadata.authorization_servers || metadata.authorization_servers.length === 0) {
+    const parsed = OAuthProtectedResourceMetadataSchema.safeParse(await response.json());
+    if (!parsed.success || parsed.data.resource !== candidate.expected || !parsed.data.authorization_servers?.length) {
       throw new OAuthError2(
-        "Protected resource metadata missing authorization servers",
+        "Protected resource metadata has an invalid or mismatched resource",
         "INVALID_RESOURCE_METADATA"
       );
     }
-    logger.oauth("Protected resource metadata discovered successfully");
-    return metadata;
-  } catch (error51) {
-    if (error51 instanceof OAuthError2) {
-      throw error51;
-    }
-    throw new OAuthError2(
-      `Error discovering protected resource metadata: ${error51 instanceof Error ? error51.message : String(error51)}`,
-      "RESOURCE_METADATA_DISCOVERY_ERROR"
-    );
+    for (const issuer of parsed.data.authorization_servers) validateOAuthUrl(issuer);
+    return parsed.data;
   }
+  throw new OAuthError2(
+    "No protected resource metadata found",
+    "RESOURCE_METADATA_DISCOVERY_FAILED"
+  );
 }
 function parseWWWAuthenticateHeader(headerValue2) {
-  const parts = headerValue2.split(/\s+/);
-  const scheme = parts[0];
-  const result = { scheme };
-  const paramString = parts.slice(1).join(" ");
-  const paramMatches = paramString.matchAll(/(\w+)="([^"]+)"/g);
-  for (const match of paramMatches) {
-    const [, key, value] = match;
-    switch (key) {
-      case "realm":
-        result.realm = value;
-        break;
-      case "scope":
-        result.scope = value;
-        break;
-      case "error":
-        result.error = value;
-        break;
-      case "error_description":
-        result.error_description = value;
-        break;
-      case "error_uri":
-        result.error_uri = value;
-        break;
-      case "resource_metadata_url":
-        result.resource_metadata_url = value;
-        break;
-    }
+  const bearer = /(?:^|,)\s*Bearer(?:\s+|$)/i.exec(headerValue2);
+  const result = { scheme: bearer ? "Bearer" : headerValue2.split(/\s+/)[0] };
+  if (!bearer) return result;
+  const parameters = headerValue2.slice(bearer.index + bearer[0].length).split(/,\s*(?=[A-Za-z][\w-]*\s+(?![=]))/)[0];
+  const known = /* @__PURE__ */ new Set([
+    "realm",
+    "scope",
+    "error",
+    "error_description",
+    "error_uri",
+    "resource_metadata"
+  ]);
+  for (const match of parameters.matchAll(/([\w-]+)\s*=\s*(?:"((?:[^"\\]|\\.)*)"|([^,\s]+))/g)) {
+    const key = match[1].toLowerCase();
+    if (known.has(key))
+      result[key] = (match[2] ?? match[3]).replace(
+        /\\(.)/g,
+        "$1"
+      );
   }
   return result;
 }
 async function registerDynamicClient(registrationEndpoint, registrationRequest) {
   try {
     logger.oauth(`Attempting dynamic client registration: ${registrationEndpoint}`);
-    const customHeaders = getCustomHeaders();
-    const response = await proxyFetch(registrationEndpoint, {
+    const response = await oauthFetch(registrationEndpoint, {
       method: "POST",
       headers: {
-        "Content-Type": "application/json",
-        ...customHeaders
+        "Content-Type": "application/json"
       },
       body: JSON.stringify(registrationRequest)
     });
@@ -78446,12 +78437,26 @@ async function registerDynamicClient(registrationEndpoint, registrationRequest)
       );
     }
     const registrationResponse = await response.json();
-    if (!registrationResponse.client_id) {
+    if (typeof registrationResponse.client_id !== "string" || !registrationResponse.client_id) {
       throw new OAuthError2(
         "Dynamic client registration response missing client_id",
         "INVALID_REGISTRATION_RESPONSE"
       );
     }
+    if (registrationResponse.token_endpoint_auth_method && registrationResponse.token_endpoint_auth_method !== registrationRequest.token_endpoint_auth_method) {
+      throw new OAuthError2(
+        "Authorization server changed the requested client authentication method",
+        "INVALID_REGISTRATION_RESPONSE"
+      );
+    }
+    if (registrationResponse.redirect_uris && (!Array.isArray(registrationResponse.redirect_uris) || !registrationRequest.redirect_uris.every(
+      (uri) => registrationResponse.redirect_uris.includes(uri)
+    ))) {
+      throw new OAuthError2(
+        "Authorization server changed the registered callback URI",
+        "INVALID_REGISTRATION_RESPONSE"
+      );
+    }
     logger.oauth("Dynamic client registration successful");
     logger.debug("Client ID obtained", "OAUTH", {
       client_id: registrationResponse.client_id,
@@ -78481,12 +78486,10 @@ async function exchangeAuthorizationCode(tokenEndpoint, code, redirectUri, clien
     if (resource) {
       params.set("resource", resource);
     }
-    const customHeaders = getCustomHeaders();
-    const response = await proxyFetch(tokenEndpoint, {
+    const response = await oauthFetch(tokenEndpoint, {
       method: "POST",
       headers: {
-        "Content-Type": "application/x-www-form-urlencoded",
-        ...customHeaders
+        "Content-Type": "application/x-www-form-urlencoded"
       },
       body: params.toString()
     });
@@ -78497,7 +78500,9 @@ async function exchangeAuthorizationCode(tokenEndpoint, code, redirectUri, clien
         "TOKEN_EXCHANGE_FAILED"
       );
     }
-    const tokenResponse = await response.json();
+    const tokenResponse = OAuthTokensSchema.parse(await response.json());
+    if (tokenResponse.token_type.toLowerCase() !== "bearer")
+      throw new OAuthError2("Unsupported token type", "INVALID_TOKEN_RESPONSE");
     if (!tokenResponse.access_token) {
       throw new OAuthError2("Token response missing access_token", "INVALID_TOKEN_RESPONSE");
     }
@@ -78526,15 +78531,18 @@ function buildAuthorizationUrl(authorizationEndpoint, clientId, redirectUri, sco
     // OAuth 2.1 uses authorization code flow
     client_id: clientId,
     redirect_uri: redirectUri,
-    scope: scopes.join(" "),
     state,
     code_challenge: codeChallenge,
     code_challenge_method: "S256"
   });
+  if (scopes.length) params.set("scope", scopes.join(" "));
   if (resource) {
     params.set("resource", resource);
   }
-  return `${authorizationEndpoint}?${params.toString()}`;
+  validateOAuthUrl(authorizationEndpoint);
+  const url2 = new URL(authorizationEndpoint);
+  params.forEach((value, key) => url2.searchParams.set(key, value));
+  return url2.toString();
 }
 function generateSecureState() {
   return crypto4.randomBytes(32).toString("base64url");
@@ -78615,110 +78623,26 @@ var AUTHORIZATION_CODE_HTML = `
     </div>
 
     <script>
-        function displayStatus(message, type = 'loading') {
-            const statusEl = document.getElementById('status');
-            const spinnerEl = document.getElementById('spinner');
-            
-            statusEl.textContent = message;
-            statusEl.className = type;
-            
-            if (type !== 'loading') {
-                spinnerEl.style.display = 'none';
-            }
-        }
-
-        function displayDetails(message) {
-            document.getElementById('details').textContent = message;
-        }
-
-        // Handle both OAuth 2.1 authorization code flow and implicit flow
-        const urlParams = new URLSearchParams(window.location.search);
-        const hashParams = new URLSearchParams(window.location.hash.substring(1));
-
-        // Check for authorization code first (OAuth 2.1 flow)
-        if (urlParams.has('code')) {
-            const authData = {
-                code: urlParams.get('code'),
-                state: urlParams.get('state'),
-                // Additional parameters for validation
-                iss: urlParams.get('iss'),
-            };
-
-            // Send authorization code to server for token exchange
-            fetch('/oauth/callback', {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/json'
-                },
-                body: JSON.stringify(authData)
-            })
-            .then(response => {
-                if (response.ok) {
-                    displayStatus('\u2705 Authorization successful!', 'success');
-                    displayDetails('You can safely close this window.');
-                } else {
-                    return response.json().then(err => {
-                        throw new Error(err.error || 'Failed to exchange authorization code');
-                    });
-                }
-            })
-            .catch(error => {
-                displayStatus('\u274C Error completing authorization', 'error');
-                displayDetails(error.message + '. Please try again.');
-            });
-        } 
-        // Check for access token in URL fragment (implicit flow)
-        else if (hashParams.has('access_token')) {
-            const tokens = {
-                access_token: hashParams.get('access_token'),
-                token_type: hashParams.get('token_type') || 'Bearer',
-                expires_in: hashParams.get('expires_in') ? parseInt(hashParams.get('expires_in')) : 3600,
-                scope: hashParams.get('scope'),
-                state: hashParams.get('state'),
-                obtained_at: Date.now()
-            };
-
-            // Send tokens to server for storage
-            fetch('/oauth/tokens', {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/json'
-                },
-                body: JSON.stringify(tokens)
-            })
-            .then(response => {
-                if (response.ok) {
-                    displayStatus('\u2705 Authorization successful!', 'success');
-                    displayDetails('You can safely close this window.');
-                } else {
-                    return response.json().then(err => {
-                        throw new Error(err.error || 'Failed to store access token');
-                    });
-                }
-            })
-            .catch(error => {
-                displayStatus('\u274C Error completing authorization', 'error');
-                displayDetails(error.message + '. Please try again.');
-            });
-        } 
-        // Check for errors in query parameters
-        else if (urlParams.has('error')) {
-            const error = urlParams.get('error');
-            const errorDescription = urlParams.get('error_description');
-            displayStatus('\u274C Authorization failed', 'error');
-            displayDetails(\`Error: \${error}\${errorDescription ? ' - ' + errorDescription : ''}\`);
-        } 
-        // Check for errors in URL fragment (implicit flow errors)
-        else if (hashParams.has('error')) {
-            const error = hashParams.get('error');
-            const errorDescription = hashParams.get('error_description');
-            displayStatus('\u274C Authorization failed', 'error');
-            displayDetails(\`Error: \${error}\${errorDescription ? ' - ' + errorDescription : ''}\`);
-        } 
-        // No authorization code or access token found
-        else {
-            displayStatus('\u274C No authorization code or access token received', 'error');
-            displayDetails('Please try the authorization process again.');
+        const query = new URLSearchParams(window.location.search);
+        const fragment = new URLSearchParams(window.location.hash.substring(1));
+        const status = document.getElementById('status');
+        const details = document.getElementById('details');
+        const data = Object.fromEntries(query.has('code') || query.has('error') ? query : fragment);
+        const endpoint = data.access_token ? '/oauth/tokens' : '/oauth/callback';
+        if (data.code || data.error || data.access_token) {
+            fetch(endpoint, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(data) })
+                .then(async response => {
+                    const result = await response.json();
+                    if (!response.ok) throw new Error(result.error || 'Authorization response was rejected');
+                    status.textContent = data.access_token ? 'Authorization successful' : 'Authorization code received';
+                    status.className = 'success';
+                    details.textContent = data.access_token ? 'You can close this window.' : 'Return to your app to check the connection. Token exchange may still fail.';
+                })
+                .catch(error => { status.textContent = 'Authorization failed'; status.className = 'error'; details.textContent = error.message; })
+                .finally(() => { document.getElementById('spinner').style.display = 'none'; });
+        } else {
+            status.textContent = 'No authorization response received';
+            document.getElementById('spinner').style.display = 'none';
         }
     </script>
 </body>
@@ -78733,6 +78657,17 @@ var OAuthCallbackServer = class {
     this.setupRoutes();
   }
   setupRoutes() {
+    this.app.use((req, res, next) => {
+      const host = this.options.host === "::1" ? "[::1]" : this.options.host;
+      const origin = req.headers.origin;
+      const port = this.server?.address();
+      const expectedOrigin = `http://${host}:${port && typeof port !== "string" ? port.port : this.options.port}`;
+      if (req.hostname !== host || origin && origin !== expectedOrigin) {
+        res.status(403).json({ error: "Untrusted callback origin" });
+        return;
+      }
+      next();
+    });
     this.app.use(import_express.default.json());
     this.app.get("/oauth/callback", (req, res) => {
       logger.oauth("OAuth 2.1 authorization callback page requested");
@@ -78740,46 +78675,47 @@ var OAuthCallbackServer = class {
     });
     this.app.post("/oauth/callback", async (req, res) => {
       try {
-        const { code, state, iss } = req.body;
-        if (!code) {
-          throw new OAuthError2("No authorization code received");
-        }
-        logger.oauth("OAuth 2.1 authorization code received");
-        logger.debug("Authorization code details", "OAUTH", {
-          codeLength: code.length,
-          state: state || "none",
-          issuer: iss || "none"
-        });
+        const { code, state, iss, error: error51 } = req.body;
+        this.validateResponse(state, iss);
+        if (error51) throw new OAuthError2("Authorization denied or failed", "AUTH_DENIED");
+        if (this.options.flow === "implicit")
+          throw new OAuthError2("Authorization-code callback is disabled", "WRONG_FLOW");
+        if (typeof code !== "string" || !code)
+          throw new OAuthError2("No authorization code received", "INVALID_CODE");
         this.events.emit("oauth-code-received", { code, state, iss });
-        res.json({ success: true, message: "Authorization code received successfully" });
+        res.json({
+          success: true,
+          message: "Authorization code received; check connection status in the app"
+        });
       } catch (error51) {
-        logger.error("Error processing authorization code", "OAUTH", error51);
-        const errorMessage = error51 instanceof Error ? error51.message : "Unknown error";
-        this.events.emit("oauth-error", new OAuthError2(errorMessage));
-        res.status(400).json({ error: errorMessage });
+        const failure = error51 instanceof OAuthError2 ? error51 : new OAuthError2("Invalid authorization response");
+        if (failure.code !== "INVALID_STATE") this.events.emit("oauth-error", failure);
+        res.status(400).json({ error: failure.message });
       }
     });
     this.app.post("/oauth/tokens", async (req, res) => {
+      if (this.options.flow !== "implicit") {
+        res.status(404).json({ error: "Implicit token callback is disabled" });
+        return;
+      }
       try {
-        const tokens = req.body;
-        if (!tokens.access_token) {
-          throw new OAuthError2("No access token received");
-        }
-        logger.oauth("Legacy OAuth tokens received (implicit flow)");
-        logger.debug("Token details", "OAUTH", {
-          tokenType: tokens.token_type,
-          expiresIn: tokens.expires_in,
-          scope: tokens.scope,
-          tokenLength: tokens.access_token.length
-        });
+        this.validateResponse(req.body.state, req.body.iss);
+        if (typeof req.body.access_token !== "string" || !req.body.access_token || req.body.token_type && req.body.token_type.toLowerCase() !== "bearer")
+          throw new OAuthError2("Invalid implicit token response");
+        const tokens = {
+          access_token: req.body.access_token,
+          token_type: "Bearer",
+          expires_in: req.body.expires_in === void 0 ? void 0 : Number(req.body.expires_in),
+          scope: req.body.scope,
+          obtained_at: Date.now()
+        };
         await writeTokens(this.options.serverUrlHash, tokens);
         this.events.emit("oauth-success", tokens);
-        res.json({ success: true, message: "Tokens saved successfully" });
+        res.json({ success: true });
       } catch (error51) {
-        logger.error("Error processing OAuth tokens", "OAUTH", error51);
-        const errorMessage = error51 instanceof Error ? error51.message : "Unknown error";
-        this.events.emit("oauth-error", new OAuthError2(errorMessage));
-        res.status(400).json({ error: errorMessage });
+        const failure = error51 instanceof OAuthError2 ? error51 : new OAuthError2("Invalid implicit response");
+        if (failure.code !== "INVALID_STATE") this.events.emit("oauth-error", failure);
+        res.status(400).json({ error: failure.message });
       }
     });
     this.app.get("/oauth/health", (req, res) => {
@@ -78796,10 +78732,17 @@ var OAuthCallbackServer = class {
       }
     );
   }
+  validateResponse(state, issuer) {
+    if (!this.options.state || state !== this.options.state)
+      throw new OAuthError2("Invalid callback state", "INVALID_STATE");
+    if ((issuer !== void 0 || this.options.requireIssuer) && issuer !== this.options.issuer)
+      throw new OAuthError2("Invalid callback issuer", "INVALID_ISSUER");
+  }
   async start() {
     return new Promise((resolve, reject) => {
       try {
         this.server = this.app.listen(this.options.port, this.options.host, (error51) => {
+          clearTimeout(this.startupTimer);
           if (error51) {
             reject(error51);
             return;
@@ -78810,11 +78753,12 @@ var OAuthCallbackServer = class {
           resolve();
         });
         this.server.on("error", (error51) => {
+          clearTimeout(this.startupTimer);
           logger.error("OAuth callback server error", "OAUTH", error51);
           reject(error51);
         });
         if (this.options.timeout) {
-          setTimeout(() => {
+          this.startupTimer = setTimeout(() => {
             if (!this.server?.listening) {
               reject(new OAuthError2("OAuth callback server startup timeout", "TIMEOUT"));
             }
@@ -78826,6 +78770,7 @@ var OAuthCallbackServer = class {
     });
   }
   async stop() {
+    clearTimeout(this.startupTimer);
     if (!this.server) return;
     const server = this.server;
     this.server = null;
@@ -78857,7 +78802,9 @@ var MCPOAuthProvider = class {
     this.authServerMetadata = null;
     this.resourceMetadata = null;
     const serverUrl = options.serverUrl || CONFIG.WP_API_URL;
-    const defaultScopes = getDefaultOAuthScopes();
+    const defaultScopes = CONFIG.OAUTH_SCOPES ? getDefaultOAuthScopes() : [];
+    this.explicitScopes = options.scopes ?? defaultScopes;
+    this.configuredClientId = options.clientId || CONFIG.WP_OAUTH_CLIENT_ID || void 0;
     this.config = {
       serverUrl,
       resource: generateCanonicalResourceURI(serverUrl),
@@ -78916,187 +78863,217 @@ var MCPOAuthProvider = class {
   /**
    * Discover OAuth 2.1 server endpoints using MCP-compliant discovery
    */
-  async discoverOAuthEndpoints() {
-    try {
-      logger.oauth("Starting MCP-compliant OAuth endpoint discovery");
-      try {
-        this.resourceMetadata = await discoverProtectedResourceMetadata(this.config.resource);
-        logger.oauth("Protected resource metadata discovered");
-      } catch (error51) {
-        logger.warn(
-          "Protected resource metadata discovery failed, trying 401 response method",
-          "OAUTH"
-        );
-        await this.discoverVia401Response();
-      }
-      const authServerUrl = this.getAuthorizationServerUrl();
-      if (authServerUrl) {
-        this.authServerMetadata = await discoverAuthorizationServerMetadata2(authServerUrl);
-        logger.oauth("Authorization server metadata discovered");
-        this.config.authorizationEndpoint = this.authServerMetadata.authorization_endpoint;
-        this.config.tokenEndpoint = this.authServerMetadata.token_endpoint;
-        this.config.registrationEndpoint = this.authServerMetadata.registration_endpoint;
-      } else {
-        throw new OAuthError2("Could not determine authorization server URL", "DISCOVERY_FAILED");
-      }
-    } catch (error51) {
-      logger.error("OAuth endpoint discovery failed", "OAUTH", error51);
-      throw error51;
-    }
-  }
-  /**
-   * Discover endpoints via 401 Unauthorized response (RFC 9728 Section 5.1)
-   */
-  async discoverVia401Response() {
-    try {
-      logger.oauth("Attempting discovery via 401 response method");
-      const customHeaders = getCustomHeaders();
-      const response = await proxyFetch(this.config.serverUrl, {
-        headers: {
-          Accept: "application/json",
-          ...customHeaders
-        }
-      });
-      if (response.status === 401) {
-        const wwwAuthHeader = response.headers.get("WWW-Authenticate");
-        if (wwwAuthHeader) {
-          const authInfo = parseWWWAuthenticateHeader(wwwAuthHeader);
-          logger.oauth("WWW-Authenticate header parsed successfully");
-          if (authInfo.resource_metadata_url) {
-            const metadataResponse = await proxyFetch(authInfo.resource_metadata_url, {
-              headers: {
-                Accept: "application/json",
-                ...customHeaders
-              }
-            });
-            if (metadataResponse.ok) {
-              this.resourceMetadata = await metadataResponse.json();
-              logger.oauth("Protected resource metadata obtained via 401 response");
-            }
-          }
-        }
-      }
-    } catch (error51) {
-      logger.warn("401 response discovery method failed", "OAUTH", error51);
-    }
+  async discoverOAuthEndpoints(challenge) {
+    this.resourceMetadata = await discoverProtectedResourceMetadata(
+      this.config.serverUrl,
+      challenge?.resource_metadata
+    );
+    this.authServerMetadata = await discoverAuthorizationServerMetadata2(
+      this.resourceMetadata.authorization_servers[0]
+    );
+    this.config.resource = this.resourceMetadata.resource;
+    this.config.authorizationEndpoint = this.authServerMetadata.authorization_endpoint;
+    this.config.tokenEndpoint = this.authServerMetadata.token_endpoint;
+    this.config.registrationEndpoint = this.authServerMetadata.registration_endpoint;
+    this.config.clientId = this.configuredClientId;
+    const challenged = challenge?.scope?.split(/\s+/).filter(Boolean);
+    this.config.scopes = [
+      ...new Set(
+        challenged ?? (this.explicitScopes.length ? this.explicitScopes : this.resourceMetadata.scopes_supported ?? [])
+      )
+    ];
   }
-  /**
-   * Get authorization server URL from discovered metadata
-   */
   getAuthorizationServerUrl() {
-    if (this.resourceMetadata?.authorization_servers?.length) {
-      return this.resourceMetadata.authorization_servers[0];
-    }
-    try {
-      const url2 = new URL(this.config.serverUrl);
-      return url2.origin;
-    } catch {
-      return null;
-    }
+    return this.authServerMetadata?.issuer ?? this.resourceMetadata?.authorization_servers[0] ?? new URL(this.config.serverUrl).origin;
   }
   /**
    * Perform dynamic client registration if needed and supported
    */
   async ensureClientRegistration() {
+    const issuer = this.getAuthorizationServerUrl();
+    const stored = await readClientInfo(this.serverUrlHash);
     if (this.config.clientId) {
-      logger.oauth("Using provided client ID, skipping dynamic registration");
+      if (stored?.issuer && stored.issuer !== issuer && stored.client_id === this.config.clientId) {
+        throw new OAuthError2(
+          "Configured client belongs to another authorization server; update its registration",
+          "CLIENT_ISSUER_MISMATCH"
+        );
+      }
+      await writeClientInfo(this.serverUrlHash, { client_id: this.config.clientId, issuer });
       return;
     }
-    const storedClientInfo = await readClientInfo(this.serverUrlHash);
-    if (typeof storedClientInfo?.client_id === "string" && storedClientInfo.client_id.length > 0) {
-      this.config.clientId = storedClientInfo.client_id;
-      logger.oauth("Reusing persisted client registration, skipping dynamic registration");
+    if (stored?.issuer === issuer && typeof stored.client_id === "string" && stored.client_id.length > 0) {
+      this.config.clientId = stored.client_id;
       return;
     }
-    if (!CONFIG.OAUTH_DYNAMIC_REGISTRATION) {
+    if (!CONFIG.OAUTH_DYNAMIC_REGISTRATION)
       throw new OAuthError2(
-        "No client ID provided and dynamic registration is disabled",
+        "No issuer-bound client registration; configure a client ID or enable registration",
         "NO_CLIENT_ID"
       );
-    }
-    if (!this.authServerMetadata?.registration_endpoint) {
+    if (!this.authServerMetadata?.registration_endpoint)
       throw new OAuthError2(
-        "Dynamic client registration not supported by authorization server",
+        "Authorization server does not support dynamic registration; configure its client ID",
         "NO_DYNAMIC_REGISTRATION"
       );
-    }
-    try {
-      logger.oauth("Performing dynamic client registration");
-      const registrationRequest = {
-        redirect_uris: [this.config.redirectUri],
-        token_endpoint_auth_method: "none",
-        // Public client
-        grant_types: ["authorization_code"],
-        response_types: ["code"],
-        client_name: "WordPress MCP Remote",
-        scope: this.config.scopes.join(" ")
-      };
-      const registrationResponse = await registerDynamicClient(
-        this.authServerMetadata.registration_endpoint,
-        registrationRequest
-      );
-      const clientInfo = {
-        client_id: registrationResponse.client_id,
-        client_secret: registrationResponse.client_secret
-      };
-      await writeClientInfo(this.serverUrlHash, clientInfo);
-      this.config.clientId = registrationResponse.client_id;
-      logger.oauth("Dynamic client registration completed successfully");
-    } catch (error51) {
-      logger.error("Dynamic client registration failed", "OAUTH", error51);
-      throw error51;
-    }
+    const request = {
+      redirect_uris: [this.config.redirectUri],
+      application_type: "native",
+      token_endpoint_auth_method: "none",
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"],
+      client_name: "WordPress MCP Remote",
+      ...this.config.scopes.length ? { scope: this.config.scopes.join(" ") } : {}
+    };
+    const registered = await registerDynamicClient(
+      this.authServerMetadata.registration_endpoint,
+      request
+    );
+    await writeClientInfo(this.serverUrlHash, {
+      ...request,
+      client_id: registered.client_id,
+      issuer
+    });
+    this.config.clientId = registered.client_id;
   }
   /**
    * Initiate MCP-compliant OAuth 2.1 authorization flow
    */
-  async authorize() {
-    if (this.authPromise) {
-      logger.oauth("Authorization already in progress, waiting...");
-      await this.authPromise;
-      return;
-    }
-    const existingTokens = await this.tokens();
-    if (existingTokens) {
-      logger.oauth("Already have valid tokens, skipping authorization");
-      return;
+  satisfies(tokens, request) {
+    return !!tokens && tokens.access_token !== request.rejectedToken && (!request.scopes?.length || request.scopes.every((scope) => tokens.scope?.split(" ").includes(scope)));
+  }
+  async authorize(request = {}) {
+    if (this.authPromise) await this.authPromise;
+    if (!this.authPromise) this.authPromise = this.authorizeWithLock(request);
+    const pending = this.authPromise;
+    try {
+      await pending;
+    } finally {
+      if (this.authPromise === pending) this.authPromise = null;
     }
-    logger.oauth("Starting MCP-compliant OAuth 2.1 authorization flow");
-    this.authPromise = this.performAuthorization();
+  }
+  async authorizeWithLock(request) {
+    const valid = await this.tokens();
+    if (this.satisfies(valid, request)) return valid;
+    await ensureConfigDir();
+    const file2 = getConfigFilePath(this.serverUrlHash, "oauth");
+    let release;
     try {
-      await this.authPromise;
-      logger.oauth("OAuth 2.1 authorization completed successfully");
+      release = await lockfile.lock(file2, { realpath: false });
     } catch (error51) {
-      logger.error("OAuth 2.1 authorization failed", "OAUTH", error51);
-      throw error51;
+      if (error51.code !== "ELOCKED") throw error51;
+      const deadline = Date.now() + this.config.timeout;
+      while (Date.now() < deadline) {
+        const tokens = await this.tokens();
+        if (this.satisfies(tokens, request)) return tokens;
+        if (!await lockfile.check(file2, { realpath: false })) {
+          const completed = await this.tokens();
+          if (this.satisfies(completed, request)) return completed;
+          throw new OAuthError2("Authentication in another process did not complete", "AUTH_FAILED");
+        }
+        await delay(Math.min(100, Math.max(0, deadline - Date.now())));
+      }
+      throw new OAuthError2("Timeout waiting for authentication in another process", "LOCK_TIMEOUT");
+    }
+    try {
+      const completed = await this.tokens();
+      if (this.satisfies(completed, request)) return completed;
+      await this.discoverOAuthEndpoints(request.challenge);
+      const issuer = this.getAuthorizationServerUrl();
+      const stored = await readTokens(this.serverUrlHash);
+      const client = await readClientInfo(this.serverUrlHash);
+      if (this.configuredClientId && client?.issuer && client.issuer !== issuer && client.client_id === this.configuredClientId) {
+        throw new OAuthError2(
+          "Configured client belongs to another authorization server",
+          "CLIENT_ISSUER_MISMATCH"
+        );
+      }
+      this.config.scopes = [
+        .../* @__PURE__ */ new Set([
+          ...stored?.issuer === issuer ? stored.scope?.split(" ").filter(Boolean) ?? [] : [],
+          ...this.config.scopes,
+          ...request.scopes ?? []
+        ])
+      ];
+      const needsScope = !!request.scopes?.some(
+        (scope) => !stored?.scope?.split(" ").includes(scope)
+      );
+      const clientId = this.configuredClientId || client?.client_id;
+      if (stored?.issuer === issuer && client?.issuer === issuer && stored.refresh_token && clientId && (!this.configuredClientId || this.configuredClientId === client.client_id) && !needsScope) {
+        try {
+          const renewed = await refreshAuthorization(issuer, {
+            metadata: { ...this.authServerMetadata },
+            clientInformation: { client_id: clientId },
+            refreshToken: stored.refresh_token,
+            resource: this.resourceIndicator(),
+            fetchFn: (url2, init) => oauthFetch(String(url2), init)
+          });
+          if (renewed.token_type.toLowerCase() !== "bearer")
+            throw new OAuthError2("Unsupported token type", "INVALID_TOKEN_RESPONSE");
+          const tokens = {
+            ...renewed,
+            issuer,
+            scope: renewed.scope ?? stored.scope,
+            obtained_at: Date.now()
+          };
+          await writeTokens(this.serverUrlHash, tokens);
+          return tokens;
+        } catch (error51) {
+          if (!(error51 instanceof InvalidGrantError)) throw error51;
+          await deleteConfigFile(this.serverUrlHash, "tokens.json");
+        }
+      }
+      return await this.performAuthorization();
     } finally {
-      this.authPromise = null;
+      await release();
     }
   }
+  resourceIndicator() {
+    if (!CONFIG.OAUTH_RESOURCE_INDICATOR)
+      throw new OAuthError2(
+        "MCP OAuth requires resource indicators; remove OAUTH_RESOURCE_INDICATOR=false",
+        "RESOURCE_REQUIRED"
+      );
+    return this.config.resource;
+  }
   /**
    * Perform the complete OAuth 2.1 authorization flow
    */
   async performAuthorization() {
     try {
-      await this.discoverOAuthEndpoints();
-      const callbackPort = this.config.callbackPort === 0 ? await getOAuthCallbackPort() : this.config.callbackPort;
+      if (!this.authServerMetadata) await this.discoverOAuthEndpoints();
+      if (!this.authServerMetadata?.code_challenge_methods_supported?.includes("S256"))
+        throw new OAuthError2(
+          "Authorization server must advertise PKCE S256 support",
+          "PKCE_REQUIRED"
+        );
+      this.resourceIndicator();
+      if (!["127.0.0.1", "localhost", "::1"].includes(this.config.host))
+        throw new OAuthError2(
+          "Native OAuth callback must bind to loopback",
+          "INVALID_CALLBACK_HOST"
+        );
+      this.currentPKCE = generatePKCE();
+      this.currentState = generateSecureState();
+      const callbackPort = this.config.callbackPort === 0 ? await selectCallbackPort(this.config.serverUrl, void 0, false, this.config.host) : this.config.callbackPort;
       const callbackServer = setupWPOAuthCallbackServer(
         {
           port: callbackPort,
           host: this.config.host,
           serverUrlHash: this.serverUrlHash,
-          timeout: this.config.timeout
+          timeout: this.config.timeout,
+          state: this.currentState,
+          issuer: this.authServerMetadata.issuer,
+          requireIssuer: this.authServerMetadata.authorization_response_iss_parameter_supported
         },
         this.events
       );
       await callbackServer.start();
       logger.oauth("OAuth callback server started");
       try {
-        const actualRedirectUri = `http://${this.config.host}:${callbackPort}/oauth/callback`;
+        const actualRedirectUri = `http://${this.config.host === "::1" ? "[::1]" : this.config.host}:${callbackPort}/oauth/callback`;
         this.config.redirectUri = actualRedirectUri;
         await this.ensureClientRegistration();
-        this.currentPKCE = generatePKCE();
-        this.currentState = generateSecureState();
         await writeTextFile(this.serverUrlHash, "pkce_verifier.txt", this.currentPKCE.codeVerifier);
         await writeTextFile(this.serverUrlHash, "oauth_state.txt", this.currentState);
         const authUrl = buildAuthorizationUrl(
@@ -79106,10 +79083,13 @@ var MCPOAuthProvider = class {
           this.config.scopes,
           this.currentState,
           this.currentPKCE.codeChallenge,
-          CONFIG.OAUTH_RESOURCE_INDICATOR ? this.config.resource : void 0
+          this.resourceIndicator()
         );
         logger.oauth("Built OAuth 2.1 authorization URL");
         logger.debug("Authorization URL", "OAUTH", { url: authUrl });
+        const authorizationCode = this.waitForAuthorizationCode();
+        void authorizationCode.catch(() => {
+        });
         try {
           await open_default(authUrl);
           logger.oauth("Browser opened successfully");
@@ -79120,13 +79100,20 @@ var MCPOAuthProvider = class {
           logger.info(`${authUrl}`);
           logger.info("===============================\n");
         }
-        const authCode = await this.waitForAuthorizationCode();
-        const tokens = await this.exchangeCodeForTokens(authCode, actualRedirectUri);
+        const authCode = await authorizationCode;
+        const response = await this.exchangeCodeForTokens(authCode, actualRedirectUri);
+        const tokens = {
+          ...response,
+          issuer: this.getAuthorizationServerUrl(),
+          scope: response.scope ?? this.config.scopes.join(" ")
+        };
         await writeTokens(this.serverUrlHash, tokens);
         logger.oauth("OAuth 2.1 tokens stored successfully");
         return tokens;
       } finally {
         await callbackServer.stop();
+        await deleteConfigFile(this.serverUrlHash, "pkce_verifier.txt");
+        await deleteConfigFile(this.serverUrlHash, "oauth_state.txt");
       }
     } catch (error51) {
       logger.error("Error during OAuth 2.1 authorization flow", "OAUTH", error51);
@@ -79147,12 +79134,16 @@ var MCPOAuthProvider = class {
         this.events.removeAllListeners("oauth-error");
         clearTimeout(timeout);
       };
-      this.events.once("oauth-code-received", async ({ code, state }) => {
+      this.events.once("oauth-code-received", async ({ code, state, iss }) => {
         cleanup();
         if (state !== this.currentState) {
           reject(new OAuthError2("State parameter mismatch", "INVALID_STATE"));
           return;
         }
+        if ((iss !== void 0 || this.authServerMetadata?.authorization_response_iss_parameter_supported) && iss !== this.authServerMetadata?.issuer) {
+          reject(new OAuthError2("Authorization response issuer mismatch", "INVALID_ISSUER"));
+          return;
+        }
         logger.oauth("Valid authorization code received");
         resolve(code);
       });
@@ -79178,7 +79169,7 @@ var MCPOAuthProvider = class {
         redirectUri,
         this.config.clientId,
         codeVerifier,
-        CONFIG.OAUTH_RESOURCE_INDICATOR ? this.config.resource : void 0
+        this.resourceIndicator()
       );
       await deleteConfigFile(this.serverUrlHash, "pkce_verifier.txt");
       await deleteConfigFile(this.serverUrlHash, "oauth_state.txt");
@@ -79244,6 +79235,7 @@ import * as path5 from "node:path";
 import * as os3 from "node:os";
 
 // src/lib/persistent-oauth-client-provider.ts
+import { randomBytes } from "node:crypto";
 import { EventEmitter as EventEmitter2 } from "node:events";
 var PersistentWPOAuthClientProvider = class {
   constructor(options) {
@@ -79401,7 +79393,10 @@ var PersistentWPOAuthClientProvider = class {
    */
   async performAuthorization() {
     const callbackPort = this.options.callbackPort === 0 ? await getOAuthCallbackPort() : this.options.callbackPort;
+    const state = this.generateState();
     const callbackServerOptions = {
+      flow: "implicit",
+      state,
       port: callbackPort,
       host: this.options.host,
       serverUrlHash: this.serverUrlHash,
@@ -79413,12 +79408,14 @@ var PersistentWPOAuthClientProvider = class {
       logger.oauth("Starting callback server...");
       await callbackServer.start();
       logger.oauth("Callback server started successfully");
-      const state = this.generateState();
       logger.debug(`Generated state parameter: ${state}`, "OAUTH");
       const authUrl = this.buildAuthorizationUrl(callbackServer.getCallbackUrl(), state);
       logger.oauth(`Built authorization URL: ${authUrl}`);
       logger.debug(`Callback URL: ${callbackServer.getCallbackUrl()}`, "OAUTH");
       logger.oauth("Attempting to open browser...");
+      const authorization = this.waitForAuthorizationResult();
+      void authorization.catch(() => {
+      });
       try {
         await open_default(authUrl);
         logger.oauth("Browser opened successfully");
@@ -79430,7 +79427,7 @@ var PersistentWPOAuthClientProvider = class {
         logger.info("===============================\n");
       }
       logger.oauth("Waiting for authorization result...");
-      const tokens = await this.waitForAuthorizationResult();
+      const tokens = await authorization;
       logger.oauth("Authorization result received");
       logger.oauth("Saving tokens to persistent storage...");
       await this.saveTokens(tokens);
@@ -79483,7 +79480,7 @@ var PersistentWPOAuthClientProvider = class {
    * Generate a secure state parameter
    */
   generateState() {
-    return Math.random().toString(36).substring(2, 15) + Math.random().toString(36).substring(2, 15);
+    return randomBytes(32).toString("base64url");
   }
   /**
    * Wait for authorization result from callback server
@@ -79878,6 +79875,12 @@ function constructApiUrl(baseUrl, defaultEndpoint) {
     return new URL(`/?rest_route=${defaultEndpoint}`, cleanUrl).toString();
   }
 }
+function getMCPOAuthProvider() {
+  return mcpOAuthProvider ??= new MCPOAuthProvider({
+    serverUrl: getRequestUrl(),
+    clientId: CONFIG.WP_OAUTH_CLIENT_ID
+  });
+}
 async function getOAuthTokens() {
   try {
     if (!CONFIG.OAUTH_ENABLED) {
@@ -79885,7 +79888,7 @@ async function getOAuthTokens() {
       return null;
     }
     logger.auth("Attempting to get OAuth tokens for WordPress API (MCP-compliant)...");
-    const serverUrl = CONFIG.WP_API_URL;
+    const serverUrl = getRequestUrl();
     const serverUrlHash = generateServerUrlHash(serverUrl);
     const existingTokens = await getValidTokens(serverUrlHash);
     if (existingTokens) {
@@ -79896,16 +79899,10 @@ async function getOAuthTokens() {
     logger.auth("Starting MCP-compliant OAuth 2.1 authentication flow");
     logger.auth("Your browser should open automatically for authentication");
     if (CONFIG.OAUTH_FLOW_TYPE === "authorization_code" && CONFIG.OAUTH_USE_PKCE) {
-      if (!mcpOAuthProvider) {
-        mcpOAuthProvider = new MCPOAuthProvider({
-          serverUrl,
-          clientId: CONFIG.WP_OAUTH_CLIENT_ID,
-          scopes: getDefaultOAuthScopes()
-        });
-      }
       logger.auth("Using MCP-compliant OAuth 2.1 authorization code flow with PKCE");
-      await mcpOAuthProvider.authorize();
-      const tokens = await mcpOAuthProvider.tokens();
+      const provider = getMCPOAuthProvider();
+      await provider.authorize();
+      const tokens = await provider.tokens();
       if (tokens) {
         logger.auth("MCP OAuth 2.1 tokens obtained for WordPress API access");
         return tokens;
@@ -79946,17 +79943,20 @@ async function getOAuthTokens() {
     return null;
   }
 }
-async function discardRejectedOAuthToken(authorization) {
-  if (!CONFIG.OAUTH_ENABLED || CONFIG.JWT_TOKEN) {
+async function recoverOAuthAuthorization(authorization, challenge, status = 401) {
+  if (!CONFIG.OAUTH_ENABLED || CONFIG.JWT_TOKEN || CONFIG.OAUTH_FLOW_TYPE !== "authorization_code" || !CONFIG.OAUTH_USE_PKCE)
     return false;
-  }
-  const serverUrlHash = generateServerUrlHash(CONFIG.WP_API_URL);
-  const tokens = await readTokens(serverUrlHash);
-  if (!tokens || authorization !== `Bearer ${tokens.access_token}`) {
-    return false;
-  }
-  logger.warn("WordPress rejected the stored OAuth token; signing in again", "AUTH");
-  await deleteTokens(serverUrlHash);
+  if (authorization && !/^Bearer /i.test(authorization)) return false;
+  const scopes = status === 401 || challenge?.error === "insufficient_scope" ? challenge?.scope?.split(/\s+/).filter(Boolean) : void 0;
+  if (status === 403 && !scopes?.length) return false;
+  const current = await getValidTokens(generateServerUrlHash(getRequestUrl()));
+  if (status === 403 && scopes?.every((scope) => current?.scope?.split(" ").includes(scope)))
+    return current?.access_token !== authorization?.slice(7);
+  await getMCPOAuthProvider().authorize({
+    rejectedToken: status === 401 ? authorization?.slice(7) : void 0,
+    challenge,
+    scopes
+  });
   return true;
 }
 function getCurrentApiUrl() {
@@ -79977,7 +79977,7 @@ function bindWordPressRequest(request) {
     if (shared[LIVE_REQUEST_KEY] === request) delete shared[LIVE_REQUEST_KEY];
   };
 }
-async function getWordPressHeaders(requestData) {
+async function getWordPressHeaders(requestData, options = {}) {
   validateEnvironment();
   let authHeader = "";
   if (CONFIG.JWT_TOKEN) {
@@ -79986,7 +79986,7 @@ async function getWordPressHeaders(requestData) {
     logger.debug(`Token length: ${CONFIG.JWT_TOKEN.length}`, "AUTH");
   } else if (CONFIG.OAUTH_ENABLED) {
     logger.auth("OAuth is the primary authentication method - attempting to get tokens...");
-    const oauthTokens = await getOAuthTokens();
+    const oauthTokens = options.allowUnauthenticated && !CONFIG.WP_API_USERNAME ? await getValidTokens(generateServerUrlHash(getRequestUrl())) : await getOAuthTokens();
     if (oauthTokens) {
       authHeader = `Bearer ${oauthTokens.access_token}`;
       logger.auth("Using OAuth token authentication for WordPress API");
@@ -80026,7 +80026,7 @@ async function getWordPressHeaders(requestData) {
     if (name.toLowerCase() === "mcp-protocol-version") delete customHeaders[name];
   }
   const hasCustomHeaders = Object.keys(customHeaders).length > 0;
-  if (!authHeader && !hasCustomHeaders) {
+  if (!authHeader && !hasCustomHeaders && !(options.allowUnauthenticated && CONFIG.OAUTH_ENABLED)) {
     throw new AuthError(
       "No authentication method available. Please configure JWT_TOKEN, OAuth, Basic Auth (WP_API_USERNAME+WP_API_PASSWORD), or CUSTOM_HEADERS.",
       "NO_AUTH_METHOD"
@@ -80059,7 +80059,7 @@ function collectHeaderParams(schema, path6 = []) {
   });
 }
 function isBearerChallenge(challenge) {
-  return challenge === null || /^Bearer\b/i.test(challenge);
+  return challenge === null || parseWWWAuthenticateHeader(challenge).scheme === "Bearer";
 }
 function valueAtPath(value, path6) {
   return path6.reduce(
@@ -80070,6 +80070,8 @@ function valueAtPath(value, path6) {
 function createWordPressTransport(onFailure) {
   const inflight = /* @__PURE__ */ new Map();
   const toolHeaders = /* @__PURE__ */ new Map();
+  const scopeAttempts = /* @__PURE__ */ new Set();
+  const scopeCounts = /* @__PURE__ */ new Map();
   const send = async (url2, init, retried) => {
     const message = typeof init?.body === "string" ? JSON.parse(init.body) : void 0;
     const request = message && "method" in message && "id" in message ? message : void 0;
@@ -80103,7 +80105,9 @@ function createWordPressTransport(onFailure) {
       return apiError;
     };
     try {
-      const headers = new Headers(await getWordPressHeaders(message));
+      const headers = new Headers(
+        await getWordPressHeaders(message, { allowUnauthenticated: !retried })
+      );
       if (init?.method !== "GET" && request?.method !== "subscriptions/listen") {
         timer = setTimeout(() => {
           timedOut = true;
@@ -80136,13 +80140,40 @@ function createWordPressTransport(onFailure) {
         headers,
         signal: controller.signal
       });
-      if (response.status === 401 && !retried && isBearerChallenge(response.headers.get("WWW-Authenticate")) && await discardRejectedOAuthToken(headers.get("Authorization"))) {
-        const unread = response.body;
-        if (typeof unread?.cancel === "function") await unread.cancel();
-        else unread?.destroy?.();
-        cleanup();
-        if (cancelled) return new Response(null, { status: 202 });
-        return send(url2, init, true);
+      const challenge = parseWWWAuthenticateHeader(response.headers.get("WWW-Authenticate") ?? "");
+      const operationKey = JSON.stringify([
+        request?.method,
+        request?.params?.name ?? request?.params?.uri
+      ]);
+      const scopeKey = JSON.stringify([
+        request?.method,
+        request?.params?.name,
+        challenge.scope?.split(/\s+/).sort()
+      ]);
+      const canRecover = !retried && (response.status === 401 && isBearerChallenge(response.headers.get("WWW-Authenticate")) || response.status === 403 && challenge.error === "insufficient_scope" && !!challenge.scope && !scopeAttempts.has(scopeKey) && (scopeCounts.get(operationKey) ?? 0) < 2);
+      if (canRecover) {
+        if (response.status === 403) {
+          scopeAttempts.add(scopeKey);
+          scopeCounts.set(operationKey, (scopeCounts.get(operationKey) ?? 0) + 1);
+        }
+        clearTimeout(timer);
+        const recovered = await recoverOAuthAuthorization(
+          headers.get("Authorization"),
+          challenge,
+          response.status
+        );
+        if (recovered) {
+          const unread = response.body;
+          if (typeof unread?.cancel === "function") await unread.cancel();
+          else unread?.destroy?.();
+          cleanup();
+          if (cancelled) return new Response(null, { status: 202 });
+          return send(url2, init, true);
+        }
+        timer = setTimeout(() => {
+          timedOut = true;
+          controller.abort();
+        }, timeoutMs);
       }
       const body = response.body && typeof response.body.getReader !== "function" ? Readable.toWeb(response.body) : response.body;
       const reader = body?.getReader();
@@ -80432,11 +80463,6 @@ async function startPassThrough(local, remote) {
 validateNodeVersion(18);
 async function WordPressProxy() {
   await setupFetchPolyfill();
-  try {
-    await cleanupExpiredTokens();
-  } catch (error51) {
-    logger.warn("Error cleaning up expired tokens", "PROXY", error51);
-  }
   const local = new StdioServerTransport();
   let bridge;
   const remote = createWordPressTransport((message, error51) => bridge?.fail(message, error51));