@codemem/mcp 0.33.0-alpha.2 → 0.33.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/dist/http.d.ts.map +1 -1
  2. package/dist/http.js +1365 -268
  3. package/dist/http.js.map +1 -1
  4. package/package.json +3 -2
package/dist/http.js CHANGED
@@ -1,18 +1,1066 @@
1
1
  #!/usr/bin/env node
2
2
  import { t as e } from "./server-Djvf0Yik.js";
3
3
  import { createServer as t } from "node:http";
4
- import { isIP as n } from "node:net";
5
- import { pathToFileURL as r } from "node:url";
6
- import { MemoryStore as i, resolveDbPath as a } from "@codemem/core";
7
- import { requireBearerAuth as o } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
8
- import { createOAuthMetadata as s, getOAuthProtectedResourceMetadataUrl as c, mcpAuthRouter as l } from "@modelcontextprotocol/sdk/server/auth/router.js";
9
- import { StreamableHTTPServerTransport as u } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
10
- import d from "express";
11
- import { createHmac as f, createPublicKey as p, randomBytes as m, randomUUID as h, timingSafeEqual as g, verify as _ } from "node:crypto";
12
- import { AccessDeniedError as v, InvalidClientError as y, InvalidClientMetadataError as b, InvalidGrantError as x, InvalidRequestError as S, InvalidTokenError as C, ServerError as w, TemporarilyUnavailableError as T, UnsupportedResponseTypeError as E } from "@modelcontextprotocol/sdk/server/auth/errors.js";
13
- import { OAuthProtectedResourceMetadataSchema as D, OAuthTokensSchema as O } from "@modelcontextprotocol/sdk/shared/auth.js";
14
- //#region src/audit.ts
15
- var k = new Set([
4
+ import { isIP as n, isIPv6 as r } from "node:net";
5
+ import { pathToFileURL as i } from "node:url";
6
+ import { MemoryStore as a, resolveDbPath as o } from "@codemem/core";
7
+ import { requireBearerAuth as s } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
8
+ import { createOAuthMetadata as c, getOAuthProtectedResourceMetadataUrl as l, mcpAuthRouter as u } from "@modelcontextprotocol/sdk/server/auth/router.js";
9
+ import { StreamableHTTPServerTransport as d } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
10
+ import f from "express";
11
+ import { Buffer as p } from "node:buffer";
12
+ import { createHash as m, createHmac as h, createPublicKey as g, randomBytes as _, randomUUID as v, timingSafeEqual as y, verify as b } from "node:crypto";
13
+ import { AccessDeniedError as x, InvalidClientError as S, InvalidClientMetadataError as C, InvalidGrantError as w, InvalidRequestError as T, InvalidTokenError as E, ServerError as D, TemporarilyUnavailableError as O, UnsupportedResponseTypeError as k } from "@modelcontextprotocol/sdk/server/auth/errors.js";
14
+ import { OAuthProtectedResourceMetadataSchema as ee, OAuthTokensSchema as A } from "@modelcontextprotocol/sdk/shared/auth.js";
15
+ //#region \0rolldown/runtime.js
16
+ var j = (e, t) => () => (t || (e((t = { exports: {} }).exports, t), e = null), t.exports), M = /* @__PURE__ */ j(((e) => {
17
+ Object.defineProperty(e, "__esModule", { value: !0 }), e.isInSubnet = t, e.isCorrect = n, e.numberToPaddedHex = r, e.stringToPaddedHex = i, e.testBit = a;
18
+ function t(e) {
19
+ return this.subnetMask < e.subnetMask ? !1 : this.mask(e.subnetMask) === e.mask();
20
+ }
21
+ function n(e) {
22
+ return function() {
23
+ return this.addressMinusSuffix === this.correctForm() ? this.subnetMask === e && !this.parsedSubnet ? !0 : this.parsedSubnet === String(this.subnetMask) : !1;
24
+ };
25
+ }
26
+ function r(e) {
27
+ return e.toString(16).padStart(2, "0");
28
+ }
29
+ function i(e) {
30
+ return r(parseInt(e, 10));
31
+ }
32
+ function a(e, t) {
33
+ let { length: n } = e;
34
+ if (t > n) return !1;
35
+ let r = n - t;
36
+ return e.substring(r, r + 1) === "1";
37
+ }
38
+ })), te = /* @__PURE__ */ j(((e) => {
39
+ Object.defineProperty(e, "__esModule", { value: !0 }), e.RE_SUBNET_STRING = e.RE_ADDRESS = e.GROUPS = e.BITS = void 0, e.BITS = 32, e.GROUPS = 4, e.RE_ADDRESS = /^(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$/g, e.RE_SUBNET_STRING = /\/\d{1,2}$/;
40
+ })), N = /* @__PURE__ */ j(((e) => {
41
+ Object.defineProperty(e, "__esModule", { value: !0 }), e.AddressError = void 0, e.AddressError = class extends Error {
42
+ constructor(e, t) {
43
+ super(e), this.name = "AddressError", this.parseMessage = t;
44
+ }
45
+ };
46
+ })), ne = /* @__PURE__ */ j(((e) => {
47
+ var t = e && e.__createBinding || (Object.create ? (function(e, t, n, r) {
48
+ r === void 0 && (r = n);
49
+ var i = Object.getOwnPropertyDescriptor(t, n);
50
+ (!i || ("get" in i ? !t.__esModule : i.writable || i.configurable)) && (i = {
51
+ enumerable: !0,
52
+ get: function() {
53
+ return t[n];
54
+ }
55
+ }), Object.defineProperty(e, r, i);
56
+ }) : (function(e, t, n, r) {
57
+ r === void 0 && (r = n), e[r] = t[n];
58
+ })), n = e && e.__setModuleDefault || (Object.create ? (function(e, t) {
59
+ Object.defineProperty(e, "default", {
60
+ enumerable: !0,
61
+ value: t
62
+ });
63
+ }) : function(e, t) {
64
+ e.default = t;
65
+ }), r = e && e.__importStar || function(e) {
66
+ if (e && e.__esModule) return e;
67
+ var r = {};
68
+ if (e != null) for (var i in e) i !== "default" && Object.prototype.hasOwnProperty.call(e, i) && t(r, e, i);
69
+ return n(r, e), r;
70
+ };
71
+ Object.defineProperty(e, "__esModule", { value: !0 }), e.Address4 = void 0;
72
+ var i = r(M()), a = r(te()), o = N();
73
+ e.Address4 = class e {
74
+ constructor(e) {
75
+ this.groups = a.GROUPS, this.parsedAddress = [], this.parsedSubnet = "", this.subnet = "/32", this.subnetMask = 32, this.v4 = !0, this.isCorrect = i.isCorrect(a.BITS), this.isInSubnet = i.isInSubnet, this.address = e;
76
+ let t = a.RE_SUBNET_STRING.exec(e);
77
+ if (t) {
78
+ if (this.parsedSubnet = t[0].replace("/", ""), this.subnetMask = parseInt(this.parsedSubnet, 10), this.subnet = `/${this.subnetMask}`, this.subnetMask < 0 || this.subnetMask > a.BITS) throw new o.AddressError("Invalid subnet mask.");
79
+ e = e.replace(a.RE_SUBNET_STRING, "");
80
+ }
81
+ this.addressMinusSuffix = e, this.parsedAddress = this.parse(e);
82
+ }
83
+ static isValid(t) {
84
+ try {
85
+ return new e(t), !0;
86
+ } catch {
87
+ return !1;
88
+ }
89
+ }
90
+ parse(e) {
91
+ let t = e.split(".");
92
+ if (!e.match(a.RE_ADDRESS)) throw new o.AddressError("Invalid IPv4 address.");
93
+ return t;
94
+ }
95
+ correctForm() {
96
+ return this.parsedAddress.map((e) => parseInt(e, 10)).join(".");
97
+ }
98
+ static fromHex(t) {
99
+ let n = t.replace(/:/g, "").padStart(8, "0"), r = [], i;
100
+ for (i = 0; i < 8; i += 2) {
101
+ let e = n.slice(i, i + 2);
102
+ r.push(parseInt(e, 16));
103
+ }
104
+ return new e(r.join("."));
105
+ }
106
+ static fromInteger(t) {
107
+ return e.fromHex(t.toString(16));
108
+ }
109
+ static fromArpa(t) {
110
+ return new e(t.replace(/(\.in-addr\.arpa)?\.$/, "").split(".").reverse().join("."));
111
+ }
112
+ toHex() {
113
+ return this.parsedAddress.map((e) => i.stringToPaddedHex(e)).join(":");
114
+ }
115
+ toArray() {
116
+ return this.parsedAddress.map((e) => parseInt(e, 10));
117
+ }
118
+ toGroup6() {
119
+ let e = [], t;
120
+ for (t = 0; t < a.GROUPS; t += 2) e.push(`${i.stringToPaddedHex(this.parsedAddress[t])}${i.stringToPaddedHex(this.parsedAddress[t + 1])}`);
121
+ return e.join(":");
122
+ }
123
+ bigInt() {
124
+ return BigInt(`0x${this.parsedAddress.map((e) => i.stringToPaddedHex(e)).join("")}`);
125
+ }
126
+ _startAddress() {
127
+ return BigInt(`0b${this.mask() + "0".repeat(a.BITS - this.subnetMask)}`);
128
+ }
129
+ startAddress() {
130
+ return e.fromBigInt(this._startAddress());
131
+ }
132
+ startAddressExclusive() {
133
+ let t = BigInt("1");
134
+ return e.fromBigInt(this._startAddress() + t);
135
+ }
136
+ _endAddress() {
137
+ return BigInt(`0b${this.mask() + "1".repeat(a.BITS - this.subnetMask)}`);
138
+ }
139
+ endAddress() {
140
+ return e.fromBigInt(this._endAddress());
141
+ }
142
+ endAddressExclusive() {
143
+ let t = BigInt("1");
144
+ return e.fromBigInt(this._endAddress() - t);
145
+ }
146
+ static fromBigInt(t) {
147
+ return e.fromHex(t.toString(16));
148
+ }
149
+ static fromByteArray(e) {
150
+ if (e.length !== 4) throw new o.AddressError("IPv4 addresses require exactly 4 bytes");
151
+ for (let t = 0; t < e.length; t++) if (!Number.isInteger(e[t]) || e[t] < 0 || e[t] > 255) throw new o.AddressError("All bytes must be integers between 0 and 255");
152
+ return this.fromUnsignedByteArray(e);
153
+ }
154
+ static fromUnsignedByteArray(t) {
155
+ if (t.length !== 4) throw new o.AddressError("IPv4 addresses require exactly 4 bytes");
156
+ return new e(t.join("."));
157
+ }
158
+ mask(e) {
159
+ return e === void 0 && (e = this.subnetMask), this.getBitsBase2(0, e);
160
+ }
161
+ getBitsBase2(e, t) {
162
+ return this.binaryZeroPad().slice(e, t);
163
+ }
164
+ reverseForm(e) {
165
+ e ||= {};
166
+ let t = this.correctForm().split(".").reverse().join(".");
167
+ return e.omitSuffix ? t : `${t}.in-addr.arpa.`;
168
+ }
169
+ isMulticast() {
170
+ return this.isInSubnet(new e("224.0.0.0/4"));
171
+ }
172
+ binaryZeroPad() {
173
+ return this.bigInt().toString(2).padStart(a.BITS, "0");
174
+ }
175
+ groupForV6() {
176
+ let e = this.parsedAddress;
177
+ return this.address.replace(a.RE_ADDRESS, `<span class="hover-group group-v4 group-6">${e.slice(0, 2).join(".")}</span>.<span class="hover-group group-v4 group-7">${e.slice(2, 4).join(".")}</span>`);
178
+ }
179
+ };
180
+ })), re = /* @__PURE__ */ j(((e) => {
181
+ Object.defineProperty(e, "__esModule", { value: !0 }), e.RE_URL_WITH_PORT = e.RE_URL = e.RE_ZONE_STRING = e.RE_SUBNET_STRING = e.RE_BAD_ADDRESS = e.RE_BAD_CHARACTERS = e.TYPES = e.SCOPES = e.GROUPS = e.BITS = void 0, e.BITS = 128, e.GROUPS = 8, e.SCOPES = {
182
+ 0: "Reserved",
183
+ 1: "Interface local",
184
+ 2: "Link local",
185
+ 4: "Admin local",
186
+ 5: "Site local",
187
+ 8: "Organization local",
188
+ 14: "Global",
189
+ 15: "Reserved"
190
+ }, e.TYPES = {
191
+ "ff01::1/128": "Multicast (All nodes on this interface)",
192
+ "ff01::2/128": "Multicast (All routers on this interface)",
193
+ "ff02::1/128": "Multicast (All nodes on this link)",
194
+ "ff02::2/128": "Multicast (All routers on this link)",
195
+ "ff05::2/128": "Multicast (All routers in this site)",
196
+ "ff02::5/128": "Multicast (OSPFv3 AllSPF routers)",
197
+ "ff02::6/128": "Multicast (OSPFv3 AllDR routers)",
198
+ "ff02::9/128": "Multicast (RIP routers)",
199
+ "ff02::a/128": "Multicast (EIGRP routers)",
200
+ "ff02::d/128": "Multicast (PIM routers)",
201
+ "ff02::16/128": "Multicast (MLDv2 reports)",
202
+ "ff01::fb/128": "Multicast (mDNSv6)",
203
+ "ff02::fb/128": "Multicast (mDNSv6)",
204
+ "ff05::fb/128": "Multicast (mDNSv6)",
205
+ "ff02::1:2/128": "Multicast (All DHCP servers and relay agents on this link)",
206
+ "ff05::1:2/128": "Multicast (All DHCP servers and relay agents in this site)",
207
+ "ff02::1:3/128": "Multicast (All DHCP servers on this link)",
208
+ "ff05::1:3/128": "Multicast (All DHCP servers in this site)",
209
+ "::/128": "Unspecified",
210
+ "::1/128": "Loopback",
211
+ "ff00::/8": "Multicast",
212
+ "fe80::/10": "Link-local unicast"
213
+ }, e.RE_BAD_CHARACTERS = /([^0-9a-f:/%])/gi, e.RE_BAD_ADDRESS = /([0-9a-f]{5,}|:{3,}|[^:]:$|^:[^:]|\/$)/gi, e.RE_SUBNET_STRING = /\/\d{1,3}(?=%|$)/, e.RE_ZONE_STRING = /%.*$/, e.RE_URL = /^\[{0,1}([0-9a-f:]+)\]{0,1}/, e.RE_URL_WITH_PORT = /\[([0-9a-f:]+)\]:([0-9]{1,5})/;
214
+ })), ie = /* @__PURE__ */ j(((e) => {
215
+ Object.defineProperty(e, "__esModule", { value: !0 }), e.escapeHtml = t, e.spanAllZeroes = n, e.spanAll = r, e.spanLeadingZeroes = a, e.simpleGroup = o;
216
+ function t(e) {
217
+ return e.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
218
+ }
219
+ function n(e) {
220
+ return t(e).replace(/(0+)/g, "<span class=\"zero\">$1</span>");
221
+ }
222
+ function r(e, r = 0) {
223
+ return e.split("").map((e, i) => `<span class="digit value-${t(e)} position-${i + r}">${n(e)}</span>`).join("");
224
+ }
225
+ function i(e) {
226
+ return t(e).replace(/^(0+)/, "<span class=\"zero\">$1</span>");
227
+ }
228
+ function a(e) {
229
+ return e.split(":").map((e) => i(e)).join(":");
230
+ }
231
+ function o(e, t = 0) {
232
+ return e.split(":").map((e, n) => /group-v4/.test(e) ? e : `<span class="hover-group group-${n + t}">${i(e)}</span>`);
233
+ }
234
+ })), ae = /* @__PURE__ */ j(((e) => {
235
+ var t = e && e.__createBinding || (Object.create ? (function(e, t, n, r) {
236
+ r === void 0 && (r = n);
237
+ var i = Object.getOwnPropertyDescriptor(t, n);
238
+ (!i || ("get" in i ? !t.__esModule : i.writable || i.configurable)) && (i = {
239
+ enumerable: !0,
240
+ get: function() {
241
+ return t[n];
242
+ }
243
+ }), Object.defineProperty(e, r, i);
244
+ }) : (function(e, t, n, r) {
245
+ r === void 0 && (r = n), e[r] = t[n];
246
+ })), n = e && e.__setModuleDefault || (Object.create ? (function(e, t) {
247
+ Object.defineProperty(e, "default", {
248
+ enumerable: !0,
249
+ value: t
250
+ });
251
+ }) : function(e, t) {
252
+ e.default = t;
253
+ }), r = e && e.__importStar || function(e) {
254
+ if (e && e.__esModule) return e;
255
+ var r = {};
256
+ if (e != null) for (var i in e) i !== "default" && Object.prototype.hasOwnProperty.call(e, i) && t(r, e, i);
257
+ return n(r, e), r;
258
+ };
259
+ Object.defineProperty(e, "__esModule", { value: !0 }), e.ADDRESS_BOUNDARY = void 0, e.groupPossibilities = a, e.padGroup = o, e.simpleRegularExpression = s, e.possibleElisions = c;
260
+ var i = r(re());
261
+ function a(e) {
262
+ return `(${e.join("|")})`;
263
+ }
264
+ function o(e) {
265
+ return e.length < 4 ? `0{0,${4 - e.length}}${e}` : e;
266
+ }
267
+ e.ADDRESS_BOUNDARY = "[^A-Fa-f0-9:]";
268
+ function s(e) {
269
+ let t = [];
270
+ e.forEach((e, n) => {
271
+ parseInt(e, 16) === 0 && t.push(n);
272
+ });
273
+ let n = t.map((t) => e.map((e, n) => {
274
+ if (n === t) {
275
+ let t = n === 0 || n === i.GROUPS - 1 ? ":" : "";
276
+ return a([o(e), t]);
277
+ }
278
+ return o(e);
279
+ }).join(":"));
280
+ return n.push(e.map(o).join(":")), a(n);
281
+ }
282
+ function c(e, t, n) {
283
+ let r = t ? "" : ":", i = n ? "" : ":", o = [];
284
+ !t && !n && o.push("::"), t && n && o.push(""), (n && !t || !n && t) && o.push(":"), o.push(`${r}(:0{1,4}){1,${e - 1}}`), o.push(`(0{1,4}:){1,${e - 1}}${i}`), o.push(`(0{1,4}:){${e - 1}}0{1,4}`);
285
+ for (let t = 1; t < e - 1; t++) for (let n = 1; n < e - t; n++) o.push(`(0{1,4}:){${n}}:(0{1,4}:){${e - n - t - 1}}0{1,4}`);
286
+ return a(o);
287
+ }
288
+ })), oe = /* @__PURE__ */ j(((e) => {
289
+ var t = e && e.__createBinding || (Object.create ? (function(e, t, n, r) {
290
+ r === void 0 && (r = n);
291
+ var i = Object.getOwnPropertyDescriptor(t, n);
292
+ (!i || ("get" in i ? !t.__esModule : i.writable || i.configurable)) && (i = {
293
+ enumerable: !0,
294
+ get: function() {
295
+ return t[n];
296
+ }
297
+ }), Object.defineProperty(e, r, i);
298
+ }) : (function(e, t, n, r) {
299
+ r === void 0 && (r = n), e[r] = t[n];
300
+ })), n = e && e.__setModuleDefault || (Object.create ? (function(e, t) {
301
+ Object.defineProperty(e, "default", {
302
+ enumerable: !0,
303
+ value: t
304
+ });
305
+ }) : function(e, t) {
306
+ e.default = t;
307
+ }), r = e && e.__importStar || function(e) {
308
+ if (e && e.__esModule) return e;
309
+ var r = {};
310
+ if (e != null) for (var i in e) i !== "default" && Object.prototype.hasOwnProperty.call(e, i) && t(r, e, i);
311
+ return n(r, e), r;
312
+ };
313
+ Object.defineProperty(e, "__esModule", { value: !0 }), e.Address6 = void 0;
314
+ var i = r(M()), a = r(te()), o = r(re()), s = r(ie()), c = ne(), l = ae(), u = N(), d = M();
315
+ function f(e) {
316
+ if (!e) throw Error("Assertion failed.");
317
+ }
318
+ function p(e) {
319
+ let t = /(\d+)(\d{3})/;
320
+ for (; t.test(e);) e = e.replace(t, "$1,$2");
321
+ return e;
322
+ }
323
+ function m(e) {
324
+ return e = e.replace(/^(0{1,})([1-9]+)$/, "<span class=\"parse-error\">$1</span>$2"), e = e.replace(/^(0{1,})(0)$/, "<span class=\"parse-error\">$1</span>$2"), e;
325
+ }
326
+ function h(e, t) {
327
+ let n = [], r = [], i;
328
+ for (i = 0; i < e.length; i++) i < t[0] ? n.push(e[i]) : i > t[1] && r.push(e[i]);
329
+ return n.concat(["compact"]).concat(r);
330
+ }
331
+ function g(e) {
332
+ return parseInt(e, 16).toString(16).padStart(4, "0");
333
+ }
334
+ function _(e) {
335
+ return e & 255;
336
+ }
337
+ e.Address6 = class e {
338
+ constructor(e, t) {
339
+ this.addressMinusSuffix = "", this.parsedSubnet = "", this.subnet = "/128", this.subnetMask = 128, this.v4 = !1, this.zone = "", this.isInSubnet = i.isInSubnet, this.isCorrect = i.isCorrect(o.BITS), t === void 0 ? this.groups = o.GROUPS : this.groups = t, this.address = e;
340
+ let n = o.RE_SUBNET_STRING.exec(e);
341
+ if (n) {
342
+ if (this.parsedSubnet = n[0].replace("/", ""), this.subnetMask = parseInt(this.parsedSubnet, 10), this.subnet = `/${this.subnetMask}`, Number.isNaN(this.subnetMask) || this.subnetMask < 0 || this.subnetMask > o.BITS) throw new u.AddressError("Invalid subnet mask.");
343
+ e = e.replace(o.RE_SUBNET_STRING, "");
344
+ } else if (/\//.test(e)) throw new u.AddressError("Invalid subnet mask.");
345
+ let r = o.RE_ZONE_STRING.exec(e);
346
+ r && (this.zone = r[0], e = e.replace(o.RE_ZONE_STRING, "")), this.addressMinusSuffix = e, this.parsedAddress = this.parse(this.addressMinusSuffix);
347
+ }
348
+ static isValid(t) {
349
+ try {
350
+ return new e(t), !0;
351
+ } catch {
352
+ return !1;
353
+ }
354
+ }
355
+ static fromBigInt(t) {
356
+ let n = t.toString(16).padStart(32, "0"), r = [], i;
357
+ for (i = 0; i < o.GROUPS; i++) r.push(n.slice(i * 4, (i + 1) * 4));
358
+ return new e(r.join(":"));
359
+ }
360
+ static fromURL(t) {
361
+ let n, r = null, i;
362
+ if (t.indexOf("[") !== -1 && t.indexOf("]:") !== -1) {
363
+ if (i = o.RE_URL_WITH_PORT.exec(t), i === null) return {
364
+ error: "failed to parse address with port",
365
+ address: null,
366
+ port: null
367
+ };
368
+ n = i[1], r = i[2];
369
+ } else if (t.indexOf("/") !== -1) {
370
+ if (t = t.replace(/^[a-z0-9]+:\/\//, ""), i = o.RE_URL.exec(t), i === null) return {
371
+ error: "failed to parse address from URL",
372
+ address: null,
373
+ port: null
374
+ };
375
+ n = i[1];
376
+ } else n = t;
377
+ return r ? (r = parseInt(r, 10), (r < 0 || r > 65536) && (r = null)) : r = null, {
378
+ address: new e(n),
379
+ port: r
380
+ };
381
+ }
382
+ static fromAddress4(t) {
383
+ let n = new c.Address4(t), r = o.BITS - (a.BITS - n.subnetMask);
384
+ return new e(`::ffff:${n.correctForm()}/${r}`);
385
+ }
386
+ static fromArpa(t) {
387
+ let n = t.replace(/(\.ip6\.arpa)?\.$/, "");
388
+ if (n.length !== 63) throw new u.AddressError("Invalid 'ip6.arpa' form.");
389
+ let r = n.split(".").reverse();
390
+ for (let e = 7; e > 0; e--) {
391
+ let t = e * 4;
392
+ r.splice(t, 0, ":");
393
+ }
394
+ return n = r.join(""), new e(n);
395
+ }
396
+ microsoftTranscription() {
397
+ return `${this.correctForm().replace(/:/g, "-")}.ipv6-literal.net`;
398
+ }
399
+ mask(e = this.subnetMask) {
400
+ return this.getBitsBase2(0, e);
401
+ }
402
+ possibleSubnets(e = 128) {
403
+ let t = o.BITS - this.subnetMask - Math.abs(e - o.BITS);
404
+ return t < 0 ? "0" : p((BigInt("2") ** BigInt(t)).toString(10));
405
+ }
406
+ _startAddress() {
407
+ return BigInt(`0b${this.mask() + "0".repeat(o.BITS - this.subnetMask)}`);
408
+ }
409
+ startAddress() {
410
+ return e.fromBigInt(this._startAddress());
411
+ }
412
+ startAddressExclusive() {
413
+ let t = BigInt("1");
414
+ return e.fromBigInt(this._startAddress() + t);
415
+ }
416
+ _endAddress() {
417
+ return BigInt(`0b${this.mask() + "1".repeat(o.BITS - this.subnetMask)}`);
418
+ }
419
+ endAddress() {
420
+ return e.fromBigInt(this._endAddress());
421
+ }
422
+ endAddressExclusive() {
423
+ let t = BigInt("1");
424
+ return e.fromBigInt(this._endAddress() - t);
425
+ }
426
+ getScope() {
427
+ let e = o.SCOPES[parseInt(this.getBits(12, 16).toString(10), 10)];
428
+ return this.getType() === "Global unicast" && e !== "Link local" && (e = "Global"), e || "Unknown";
429
+ }
430
+ getType() {
431
+ for (let t of Object.keys(o.TYPES)) if (this.isInSubnet(new e(t))) return o.TYPES[t];
432
+ return "Global unicast";
433
+ }
434
+ getBits(e, t) {
435
+ return BigInt(`0b${this.getBitsBase2(e, t)}`);
436
+ }
437
+ getBitsBase2(e, t) {
438
+ return this.binaryZeroPad().slice(e, t);
439
+ }
440
+ getBitsBase16(e, t) {
441
+ let n = t - e;
442
+ if (n % 4 != 0) throw Error("Length of bits to retrieve must be divisible by four");
443
+ return this.getBits(e, t).toString(16).padStart(n / 4, "0");
444
+ }
445
+ getBitsPastSubnet() {
446
+ return this.getBitsBase2(this.subnetMask, o.BITS);
447
+ }
448
+ reverseForm(e) {
449
+ e ||= {};
450
+ let t = Math.floor(this.subnetMask / 4), n = this.canonicalForm().replace(/:/g, "").split("").slice(0, t).reverse().join(".");
451
+ return t > 0 ? e.omitSuffix ? n : `${n}.ip6.arpa.` : e.omitSuffix ? "" : "ip6.arpa.";
452
+ }
453
+ correctForm() {
454
+ let e, t = [], n = 0, r = [];
455
+ for (e = 0; e < this.parsedAddress.length; e++) {
456
+ let t = parseInt(this.parsedAddress[e], 16);
457
+ t === 0 && n++, t !== 0 && n > 0 && (n > 1 && r.push([e - n, e - 1]), n = 0);
458
+ }
459
+ n > 1 && r.push([this.parsedAddress.length - n, this.parsedAddress.length - 1]);
460
+ let i = r.map((e) => e[1] - e[0] + 1);
461
+ if (r.length > 0) {
462
+ let e = i.indexOf(Math.max(...i));
463
+ t = h(this.parsedAddress, r[e]);
464
+ } else t = this.parsedAddress;
465
+ for (e = 0; e < t.length; e++) t[e] !== "compact" && (t[e] = parseInt(t[e], 16).toString(16));
466
+ let a = t.join(":");
467
+ return a = a.replace(/^compact$/, "::"), a = a.replace(/(^compact)|(compact$)/, ":"), a = a.replace(/compact/, ""), a;
468
+ }
469
+ binaryZeroPad() {
470
+ return this.bigInt().toString(2).padStart(o.BITS, "0");
471
+ }
472
+ parse4in6(e) {
473
+ let t = e.split(":"), n = t.slice(-1)[0].match(a.RE_ADDRESS);
474
+ if (n) {
475
+ this.parsedAddress4 = n[0], this.address4 = new c.Address4(this.parsedAddress4);
476
+ for (let e = 0; e < this.address4.groups; e++) if (/^0[0-9]+/.test(this.address4.parsedAddress[e])) {
477
+ let e = this.address4.parsedAddress.map(m).join("."), n = t.slice(0, -1).map(s.escapeHtml).join(":"), r = t.length > 1 ? ":" : "";
478
+ throw new u.AddressError("IPv4 addresses can't have leading zeroes.", `${n}${r}${e}`);
479
+ }
480
+ this.v4 = !0, t[t.length - 1] = this.address4.toGroup6(), e = t.join(":");
481
+ }
482
+ return e;
483
+ }
484
+ parse(e) {
485
+ e = this.parse4in6(e);
486
+ let t = e.match(o.RE_BAD_CHARACTERS);
487
+ if (t) throw new u.AddressError(`Bad character${t.length > 1 ? "s" : ""} detected in address: ${t.join("")}`, e.replace(o.RE_BAD_CHARACTERS, "<span class=\"parse-error\">$1</span>"));
488
+ let n = e.match(o.RE_BAD_ADDRESS);
489
+ if (n) throw new u.AddressError(`Address failed regex: ${n.join("")}`, e.replace(o.RE_BAD_ADDRESS, "<span class=\"parse-error\">$1</span>"));
490
+ let r = [], i = e.split("::");
491
+ if (i.length === 2) {
492
+ let e = i[0].split(":"), t = i[1].split(":");
493
+ e.length === 1 && e[0] === "" && (e = []), t.length === 1 && t[0] === "" && (t = []);
494
+ let n = this.groups - (e.length + t.length);
495
+ if (!n) throw new u.AddressError("Error parsing groups");
496
+ this.elidedGroups = n, this.elisionBegin = e.length, this.elisionEnd = e.length + this.elidedGroups, r = r.concat(e);
497
+ for (let e = 0; e < n; e++) r.push("0");
498
+ r = r.concat(t);
499
+ } else if (i.length === 1) r = e.split(":"), this.elidedGroups = 0;
500
+ else throw new u.AddressError("Too many :: groups found");
501
+ if (r = r.map((e) => parseInt(e, 16).toString(16)), r.length !== this.groups) throw new u.AddressError("Incorrect number of groups found");
502
+ return r;
503
+ }
504
+ canonicalForm() {
505
+ return this.parsedAddress.map(g).join(":");
506
+ }
507
+ decimal() {
508
+ return this.parsedAddress.map((e) => parseInt(e, 16).toString(10).padStart(5, "0")).join(":");
509
+ }
510
+ bigInt() {
511
+ return BigInt(`0x${this.parsedAddress.map(g).join("")}`);
512
+ }
513
+ to4() {
514
+ let e = this.binaryZeroPad().split("");
515
+ return c.Address4.fromHex(BigInt(`0b${e.slice(96, 128).join("")}`).toString(16));
516
+ }
517
+ to4in6() {
518
+ let t = this.to4(), n = new e(this.parsedAddress.slice(0, 6).join(":"), 6).correctForm(), r = "";
519
+ return /:$/.test(n) || (r = ":"), n + r + t.address;
520
+ }
521
+ inspectTeredo() {
522
+ let e = this.getBitsBase16(0, 32), t = (this.getBits(80, 96) ^ BigInt("0xffff")).toString(), n = c.Address4.fromHex(this.getBitsBase16(32, 64)), r = this.getBits(96, 128), i = c.Address4.fromHex((r ^ BigInt("0xffffffff")).toString(16)), a = this.getBitsBase2(64, 80), o = (0, d.testBit)(a, 15), s = (0, d.testBit)(a, 14), l = (0, d.testBit)(a, 8), u = (0, d.testBit)(a, 9), f = BigInt(`0b${a.slice(2, 6) + a.slice(8, 16)}`).toString(10);
523
+ return {
524
+ prefix: `${e.slice(0, 4)}:${e.slice(4, 8)}`,
525
+ server4: n.address,
526
+ client4: i.address,
527
+ flags: a,
528
+ coneNat: o,
529
+ microsoft: {
530
+ reserved: s,
531
+ universalLocal: u,
532
+ groupIndividual: l,
533
+ nonce: f
534
+ },
535
+ udpPort: t
536
+ };
537
+ }
538
+ inspect6to4() {
539
+ let e = this.getBitsBase16(0, 16), t = c.Address4.fromHex(this.getBitsBase16(16, 48));
540
+ return {
541
+ prefix: e.slice(0, 4),
542
+ gateway: t.address
543
+ };
544
+ }
545
+ to6to4() {
546
+ return this.is4() ? new e([
547
+ "2002",
548
+ this.getBitsBase16(96, 112),
549
+ this.getBitsBase16(112, 128),
550
+ "",
551
+ "/16"
552
+ ].join(":")) : null;
553
+ }
554
+ toByteArray() {
555
+ let e = this.bigInt().toString(16), t = `${"0".repeat(e.length % 2)}${e}`, n = [];
556
+ for (let e = 0, r = t.length; e < r; e += 2) n.push(parseInt(t.substring(e, e + 2), 16));
557
+ return n;
558
+ }
559
+ toUnsignedByteArray() {
560
+ return this.toByteArray().map(_);
561
+ }
562
+ static fromByteArray(e) {
563
+ return this.fromUnsignedByteArray(e.map(_));
564
+ }
565
+ static fromUnsignedByteArray(t) {
566
+ let n = BigInt("256"), r = BigInt("0"), i = BigInt("1");
567
+ for (let e = t.length - 1; e >= 0; e--) r += i * BigInt(t[e].toString(10)), i *= n;
568
+ return e.fromBigInt(r);
569
+ }
570
+ isCanonical() {
571
+ return this.addressMinusSuffix === this.canonicalForm();
572
+ }
573
+ isLinkLocal() {
574
+ return this.getBitsBase2(0, 64) === "1111111010000000000000000000000000000000000000000000000000000000";
575
+ }
576
+ isMulticast() {
577
+ return this.getType() === "Multicast";
578
+ }
579
+ is4() {
580
+ return this.v4;
581
+ }
582
+ isTeredo() {
583
+ return this.isInSubnet(new e("2001::/32"));
584
+ }
585
+ is6to4() {
586
+ return this.isInSubnet(new e("2002::/16"));
587
+ }
588
+ isLoopback() {
589
+ return this.getType() === "Loopback";
590
+ }
591
+ href(e) {
592
+ return e = e === void 0 ? "" : `:${e}`, `http://[${this.correctForm()}]${e}/`;
593
+ }
594
+ link(e) {
595
+ e ||= {}, e.className === void 0 && (e.className = ""), e.prefix === void 0 && (e.prefix = "/#address="), e.v4 === void 0 && (e.v4 = !1);
596
+ let t = this.correctForm;
597
+ e.v4 && (t = this.to4in6);
598
+ let n = t.call(this), r = s.escapeHtml(`${e.prefix}${n}`), i = s.escapeHtml(n);
599
+ return e.className ? `<a href="${r}" class="${s.escapeHtml(e.className)}">${i}</a>` : `<a href="${r}">${i}</a>`;
600
+ }
601
+ group() {
602
+ if (this.elidedGroups === 0) return s.simpleGroup(this.addressMinusSuffix).join(":");
603
+ f(typeof this.elidedGroups == "number"), f(typeof this.elisionBegin == "number");
604
+ let e = [], [t, n] = this.addressMinusSuffix.split("::");
605
+ t.length ? e.push(...s.simpleGroup(t)) : e.push("");
606
+ let r = ["hover-group"];
607
+ for (let e = this.elisionBegin; e < this.elisionBegin + this.elidedGroups; e++) r.push(`group-${e}`);
608
+ return e.push(`<span class="${r.join(" ")}"></span>`), n.length ? e.push(...s.simpleGroup(n, this.elisionEnd)) : e.push(""), this.is4() && (f(this.address4 instanceof c.Address4), e.pop(), e.push(this.address4.groupForV6())), e.join(":");
609
+ }
610
+ regularExpressionString(t = !1) {
611
+ let n = [], r = new e(this.correctForm());
612
+ if (r.elidedGroups === 0) n.push((0, l.simpleRegularExpression)(r.parsedAddress));
613
+ else if (r.elidedGroups === o.GROUPS) n.push((0, l.possibleElisions)(o.GROUPS));
614
+ else {
615
+ let e = r.address.split("::");
616
+ e[0].length && n.push((0, l.simpleRegularExpression)(e[0].split(":"))), f(typeof r.elidedGroups == "number"), n.push((0, l.possibleElisions)(r.elidedGroups, e[0].length !== 0, e[1].length !== 0)), e[1].length && n.push((0, l.simpleRegularExpression)(e[1].split(":"))), n = [n.join(":")];
617
+ }
618
+ return t || (n = [
619
+ "(?=^|",
620
+ l.ADDRESS_BOUNDARY,
621
+ "|[^\\w\\:])(",
622
+ ...n,
623
+ ")(?=[^\\w\\:]|",
624
+ l.ADDRESS_BOUNDARY,
625
+ "|$)"
626
+ ]), n.join("");
627
+ }
628
+ regularExpression(e = !1) {
629
+ return new RegExp(this.regularExpressionString(e), "i");
630
+ }
631
+ };
632
+ })), se = (/* @__PURE__ */ j(((e) => {
633
+ var t = e && e.__createBinding || (Object.create ? (function(e, t, n, r) {
634
+ r === void 0 && (r = n);
635
+ var i = Object.getOwnPropertyDescriptor(t, n);
636
+ (!i || ("get" in i ? !t.__esModule : i.writable || i.configurable)) && (i = {
637
+ enumerable: !0,
638
+ get: function() {
639
+ return t[n];
640
+ }
641
+ }), Object.defineProperty(e, r, i);
642
+ }) : (function(e, t, n, r) {
643
+ r === void 0 && (r = n), e[r] = t[n];
644
+ })), n = e && e.__setModuleDefault || (Object.create ? (function(e, t) {
645
+ Object.defineProperty(e, "default", {
646
+ enumerable: !0,
647
+ value: t
648
+ });
649
+ }) : function(e, t) {
650
+ e.default = t;
651
+ }), r = e && e.__importStar || function(e) {
652
+ if (e && e.__esModule) return e;
653
+ var r = {};
654
+ if (e != null) for (var i in e) i !== "default" && Object.prototype.hasOwnProperty.call(e, i) && t(r, e, i);
655
+ return n(r, e), r;
656
+ };
657
+ Object.defineProperty(e, "__esModule", { value: !0 }), e.v6 = e.AddressError = e.Address6 = e.Address4 = void 0;
658
+ var i = ne();
659
+ Object.defineProperty(e, "Address4", {
660
+ enumerable: !0,
661
+ get: function() {
662
+ return i.Address4;
663
+ }
664
+ });
665
+ var a = oe();
666
+ Object.defineProperty(e, "Address6", {
667
+ enumerable: !0,
668
+ get: function() {
669
+ return a.Address6;
670
+ }
671
+ });
672
+ var o = N();
673
+ Object.defineProperty(e, "AddressError", {
674
+ enumerable: !0,
675
+ get: function() {
676
+ return o.AddressError;
677
+ }
678
+ }), e.v6 = { helpers: r(ie()) };
679
+ })))();
680
+ function ce(e, t = 56) {
681
+ if (r(e)) {
682
+ let n = new se.Address6(e);
683
+ if (n.is4()) return n.to4().correctForm();
684
+ if (t) return new se.Address6(`${e}/${t}`).networkForm();
685
+ }
686
+ return e;
687
+ }
688
+ var le = class {
689
+ constructor(e) {
690
+ this.validations = e, this.previous = /* @__PURE__ */ new Map(), this.current = /* @__PURE__ */ new Map(), this.localKeys = !0;
691
+ }
692
+ init(e) {
693
+ this.windowMs = e.windowMs, this.validations?.windowMs(this.windowMs), this.interval && clearInterval(this.interval), this.interval = setInterval(() => {
694
+ this.clearExpired();
695
+ }, this.windowMs), this.interval.unref?.();
696
+ }
697
+ async get(e) {
698
+ return this.current.get(e) ?? this.previous.get(e);
699
+ }
700
+ async increment(e) {
701
+ let t = this.getClient(e), n = Date.now();
702
+ return t.resetTime.getTime() <= n && this.resetClient(t, n), t.totalHits++, t;
703
+ }
704
+ async decrement(e) {
705
+ let t = this.getClient(e);
706
+ t.totalHits > 0 && t.totalHits--;
707
+ }
708
+ async resetKey(e) {
709
+ this.current.delete(e), this.previous.delete(e);
710
+ }
711
+ async resetAll() {
712
+ this.current.clear(), this.previous.clear();
713
+ }
714
+ shutdown() {
715
+ clearInterval(this.interval), this.resetAll();
716
+ }
717
+ resetClient(e, t = Date.now()) {
718
+ return e.totalHits = 0, e.resetTime.setTime(t + this.windowMs), e;
719
+ }
720
+ getClient(e) {
721
+ if (this.current.has(e)) return this.current.get(e);
722
+ let t;
723
+ return this.previous.has(e) ? (t = this.previous.get(e), this.previous.delete(e)) : (t = {
724
+ totalHits: 0,
725
+ resetTime: /* @__PURE__ */ new Date()
726
+ }, this.resetClient(t)), this.current.set(e, t), t;
727
+ }
728
+ clearExpired() {
729
+ this.previous = this.current, this.current = /* @__PURE__ */ new Map();
730
+ }
731
+ }, ue = {
732
+ warn(...e) {
733
+ console.warn(...e.reverse());
734
+ },
735
+ error(...e) {
736
+ console.error(...e.reverse());
737
+ }
738
+ }, de = [
739
+ "draft-6",
740
+ "draft-7",
741
+ "draft-8"
742
+ ], P = (e, t) => {
743
+ let n;
744
+ if (t) {
745
+ let e = Math.ceil((t.getTime() - Date.now()) / 1e3);
746
+ n = Math.max(0, e);
747
+ } else n = Math.ceil(e / 1e3);
748
+ return n;
749
+ }, fe = (e) => {
750
+ let t = m("sha256");
751
+ t.update(e);
752
+ let n = t.digest("hex").slice(0, 12);
753
+ return p.from(n).toString("base64");
754
+ }, pe = (e, t) => {
755
+ e.headersSent || (e.setHeader("X-RateLimit-Limit", t.limit.toString()), e.setHeader("X-RateLimit-Remaining", t.remaining.toString()), t.resetTime instanceof Date && (e.setHeader("Date", (/* @__PURE__ */ new Date()).toUTCString()), e.setHeader("X-RateLimit-Reset", Math.ceil(t.resetTime.getTime() / 1e3).toString())));
756
+ }, me = (e, t, n) => {
757
+ if (e.headersSent) return;
758
+ let r = Math.ceil(n / 1e3), i = P(n, t.resetTime);
759
+ e.setHeader("RateLimit-Policy", `${t.limit};w=${r}`), e.setHeader("RateLimit-Limit", t.limit.toString()), e.setHeader("RateLimit-Remaining", t.remaining.toString()), typeof i == "number" && e.setHeader("RateLimit-Reset", i.toString());
760
+ }, he = (e, t, n) => {
761
+ if (e.headersSent) return;
762
+ let r = Math.ceil(n / 1e3), i = P(n, t.resetTime);
763
+ e.setHeader("RateLimit-Policy", `${t.limit};w=${r}`), e.setHeader("RateLimit", `limit=${t.limit}, remaining=${t.remaining}, reset=${i}`);
764
+ }, ge = (e, t, n, r, i) => {
765
+ if (e.headersSent) return;
766
+ let a = Math.ceil(n / 1e3), o = P(n, t.resetTime), s = fe(i), c = `r=${t.remaining}; t=${o}`, l = `q=${t.limit}; w=${a}; pk=:${s}:`;
767
+ e.append("RateLimit", `"${r}"; ${c}`), e.append("RateLimit-Policy", `"${r}"; ${l}`);
768
+ }, _e = (e, t, n) => {
769
+ if (e.headersSent) return;
770
+ let r = P(n, t.resetTime);
771
+ e.setHeader("Retry-After", r.toString());
772
+ }, ve = (e) => {
773
+ let t = {};
774
+ for (let n of Object.keys(e)) {
775
+ let r = n;
776
+ e[r] !== void 0 && (t[r] = e[r]);
777
+ }
778
+ return t;
779
+ }, F = class extends Error {
780
+ constructor(e, t) {
781
+ let n = `https://express-rate-limit.github.io/${e}/`;
782
+ super(`${t} See ${n} for more information.`), this.name = this.constructor.name, this.code = e, this.help = n;
783
+ }
784
+ }, I = class extends F {}, ye = /* @__PURE__ */ new Set(), be = /* @__PURE__ */ new WeakMap(), xe = {
785
+ enabled: { default: !0 },
786
+ disable() {
787
+ for (let e of Object.keys(this.enabled)) this.enabled[e] = !1;
788
+ },
789
+ ip(e) {
790
+ if (e === void 0) throw new F("ERR_ERL_UNDEFINED_IP_ADDRESS", "An undefined 'request.ip' was detected. This might indicate a misconfiguration or the connection being destroyed prematurely.");
791
+ if (!n(e)) throw new F("ERR_ERL_INVALID_IP_ADDRESS", `An invalid 'request.ip' (${e}) was detected. Consider passing a custom 'keyGenerator' function to the rate limiter.`);
792
+ },
793
+ trustProxy(e) {
794
+ if (e.app.get("trust proxy") === !0) throw new F("ERR_ERL_PERMISSIVE_TRUST_PROXY", "The Express 'trust proxy' setting is true, which allows anyone to trivially bypass IP-based rate limiting.");
795
+ },
796
+ xForwardedForHeader(e) {
797
+ if (e.headers["x-forwarded-for"] && e.app.get("trust proxy") === !1) throw new F("ERR_ERL_UNEXPECTED_X_FORWARDED_FOR", "The 'X-Forwarded-For' header is set but the Express 'trust proxy' setting is false (default). This could indicate a misconfiguration which would prevent express-rate-limit from accurately identifying users.");
798
+ },
799
+ forwardedHeader(e) {
800
+ if (e.headers.forwarded && e.ip === e.socket?.remoteAddress) throw new F("ERR_ERL_FORWARDED_HEADER", "The 'Forwarded' header (standardized X-Forwarded-For) is set but currently being ignored. Add a custom keyGenerator to use a value from this header.");
801
+ },
802
+ positiveHits(e) {
803
+ if (typeof e != "number" || e < 1 || e !== Math.round(e)) throw new F("ERR_ERL_INVALID_HITS", `The totalHits value returned from the store must be a positive integer, got ${e}`);
804
+ },
805
+ unsharedStore(e) {
806
+ if (ye.has(e)) {
807
+ let t = e?.localKeys ? "" : " (with a unique prefix)";
808
+ throw new F("ERR_ERL_STORE_REUSE", `A Store instance must not be shared across multiple rate limiters. Create a new instance of ${e.constructor.name}${t} for each limiter instead.`);
809
+ }
810
+ ye.add(e);
811
+ },
812
+ singleCount(e, t, n) {
813
+ let r = be.get(e);
814
+ r || (r = /* @__PURE__ */ new Map(), be.set(e, r));
815
+ let i = t.localKeys ? t : t.constructor.name, a = r.get(i);
816
+ a || (a = [], r.set(i, a));
817
+ let o = `${t.prefix ?? ""}${n}`;
818
+ if (a.includes(o)) throw new F("ERR_ERL_DOUBLE_COUNT", `The hit count for ${n} was incremented more than once for a single request.`);
819
+ a.push(o);
820
+ },
821
+ limit(e) {
822
+ if (e === 0) throw new I("WRN_ERL_MAX_ZERO", "Setting limit or max to 0 disables rate limiting in express-rate-limit v6 and older, but will cause all requests to be blocked in v7");
823
+ },
824
+ draftPolliHeaders(e) {
825
+ if (e) throw new I("WRN_ERL_DEPRECATED_DRAFT_POLLI_HEADERS", "The draft_polli_ratelimit_headers configuration option is deprecated and has been removed in express-rate-limit v7, please set standardHeaders: 'draft-6' instead.");
826
+ },
827
+ onLimitReached(e) {
828
+ if (e) throw new I("WRN_ERL_DEPRECATED_ON_LIMIT_REACHED", "The onLimitReached configuration option is deprecated and has been removed in express-rate-limit v7.");
829
+ },
830
+ headersDraftVersion(e) {
831
+ if (typeof e != "string" || !de.includes(e)) throw new F("ERR_ERL_HEADERS_UNSUPPORTED_DRAFT_VERSION", `standardHeaders: only the following versions of the IETF draft specification are supported: ${de.join(", ")}.`);
832
+ },
833
+ headersResetTime(e) {
834
+ if (!e) throw new F("ERR_ERL_HEADERS_NO_RESET", "standardHeaders: 'draft-7' requires a 'resetTime', but the store did not provide one. The 'windowMs' value will be used instead, which may cause clients to wait longer than necessary.");
835
+ },
836
+ knownOptions(e) {
837
+ if (!e) return;
838
+ let t = Object.keys({
839
+ windowMs: !0,
840
+ limit: !0,
841
+ message: !0,
842
+ statusCode: !0,
843
+ legacyHeaders: !0,
844
+ standardHeaders: !0,
845
+ identifier: !0,
846
+ requestPropertyName: !0,
847
+ skipFailedRequests: !0,
848
+ skipSuccessfulRequests: !0,
849
+ keyGenerator: !0,
850
+ ipv6Subnet: !0,
851
+ handler: !0,
852
+ skip: !0,
853
+ requestWasSuccessful: !0,
854
+ store: !0,
855
+ validate: !0,
856
+ headers: !0,
857
+ max: !0,
858
+ passOnStoreError: !0,
859
+ logger: !0
860
+ }).concat("draft_polli_ratelimit_headers", "delayAfter", "delayMs", "maxDelayMs");
861
+ for (let n of Object.keys(e)) if (!t.includes(n)) throw new F("ERR_ERL_UNKNOWN_OPTION", `Unexpected configuration option: ${n}`);
862
+ },
863
+ validationsConfig() {
864
+ let e = Object.keys(this).filter((e) => !["enabled", "disable"].includes(e));
865
+ e.push("default");
866
+ for (let t of Object.keys(this.enabled)) if (!e.includes(t)) throw new F("ERR_ERL_UNKNOWN_VALIDATION", `options.validate.${t} is not recognized. Supported validate options are: ${e.join(", ")}.`);
867
+ },
868
+ creationStack(e) {
869
+ let { stack: t } = /* @__PURE__ */ Error("express-rate-limit validation check (set options.validate.creationStack=false to disable)");
870
+ if (t?.includes("Layer.handle [as handle_request]") || t?.includes("Layer.handleRequest")) throw e.localKeys ? new F("ERR_ERL_CREATED_IN_REQUEST_HANDLER", "express-rate-limit instance should be created at app initialization, not when responding to a request.") : new F("ERR_ERL_CREATED_IN_REQUEST_HANDLER", "express-rate-limit instance should *usually* be created at app initialization, not when responding to a request.");
871
+ },
872
+ ipv6Subnet(e) {
873
+ if (e !== !1 && (!Number.isInteger(e) || e < 32 || e > 64)) throw new F("ERR_ERL_IPV6_SUBNET", `Unexpected ipv6Subnet value: ${e}. Expected an integer between 32 and 64 (usually 48-64).`);
874
+ },
875
+ ipv6SubnetOrKeyGenerator(e) {
876
+ if (e.ipv6Subnet !== void 0 && e.keyGenerator) throw new F("ERR_ERL_IPV6SUBNET_OR_KEYGENERATOR", "Incompatible options: the 'ipv6Subnet' option is ignored when a custom 'keyGenerator' function is also set.");
877
+ },
878
+ keyGeneratorIpFallback(e) {
879
+ if (!e) return;
880
+ let t = e.toString();
881
+ if ((t.includes("req.ip") || t.includes("request.ip")) && !t.includes("ipKeyGenerator")) throw new F("ERR_ERL_KEY_GEN_IPV6", "Custom keyGenerator appears to use request IP without calling the ipKeyGenerator helper function for IPv6 addresses. This could allow IPv6 users to bypass limits.");
882
+ },
883
+ windowMs(e) {
884
+ let t = 2 ** 31 - 1;
885
+ if (typeof e != "number" || Number.isNaN(e) || e < 1 || e > t) throw new F("ERR_ERL_WINDOW_MS", `Invalid windowMs value: ${e}${typeof e == "number" ? "" : ` (${typeof e})`}, must be a number between 1 and ${t} when using the default MemoryStore`);
886
+ }
887
+ };
888
+ function Se(e) {
889
+ if (typeof e != "object" || typeof e.error != "function" || typeof e.warn != "function") throw TypeError("Provided logger does not implement the Logger interface");
890
+ }
891
+ var Ce = (e, t) => {
892
+ Se(t);
893
+ let n;
894
+ n = typeof e == "boolean" ? { default: e } : {
895
+ default: !0,
896
+ ...e
897
+ };
898
+ let r = { enabled: n };
899
+ for (let [e, i] of Object.entries(xe)) typeof i == "function" && (r[e] = (...a) => {
900
+ if (n[e] ?? n.default) try {
901
+ i.apply(r, a);
902
+ } catch (e) {
903
+ e instanceof I ? t.warn(e) : t.error(e);
904
+ }
905
+ });
906
+ return r;
907
+ }, we = (e) => typeof e.incr == "function" && typeof e.increment != "function", Te = (e) => {
908
+ if (!we(e)) return e;
909
+ let t = e;
910
+ class n {
911
+ async increment(e) {
912
+ return new Promise((n, r) => {
913
+ t.incr(e, (e, t, i) => {
914
+ e && r(e), n({
915
+ totalHits: t,
916
+ resetTime: i
917
+ });
918
+ });
919
+ });
920
+ }
921
+ async decrement(e) {
922
+ return t.decrement(e);
923
+ }
924
+ async resetKey(e) {
925
+ return t.resetKey(e);
926
+ }
927
+ /* istanbul ignore next */
928
+ async resetAll() {
929
+ if (typeof t.resetAll == "function") return t.resetAll();
930
+ }
931
+ }
932
+ return new n();
933
+ }, Ee = (e) => {
934
+ let { validations: t, ...n } = e;
935
+ return {
936
+ ...n,
937
+ validate: t.enabled
938
+ };
939
+ }, De = (e) => {
940
+ let t = ve(e), n = e.logger ?? ue, i = Ce(t?.validate ?? !0, n);
941
+ i.validationsConfig(), i.knownOptions(e), i.draftPolliHeaders(t.draft_polli_ratelimit_headers), i.onLimitReached(t.onLimitReached), t.ipv6Subnet !== void 0 && typeof t.ipv6Subnet != "function" && i.ipv6Subnet(t.ipv6Subnet), i.keyGeneratorIpFallback(t.keyGenerator), i.ipv6SubnetOrKeyGenerator(t);
942
+ let a = t.standardHeaders ?? !1;
943
+ a === !0 && (a = "draft-6");
944
+ let o = {
945
+ windowMs: 60 * 1e3,
946
+ limit: e.max ?? 5,
947
+ message: "Too many requests, please try again later.",
948
+ statusCode: 429,
949
+ legacyHeaders: e.headers ?? !0,
950
+ identifier(e, t) {
951
+ let n = "", { limit: r } = e[o.requestPropertyName], i = o.windowMs / 1e3, a = o.windowMs / (1e3 * 60), s = o.windowMs / (1e3 * 60 * 60), c = o.windowMs / (1e3 * 60 * 60 * 24);
952
+ return n = i < 60 ? `${i}sec` : a < 60 ? `${a}min` : s < 24 ? `${s}hr${s > 1 ? "s" : ""}` : `${c}day${c > 1 ? "s" : ""}`, `${r}-in-${n}`;
953
+ },
954
+ requestPropertyName: "rateLimit",
955
+ skipFailedRequests: !1,
956
+ skipSuccessfulRequests: !1,
957
+ requestWasSuccessful: (e, t) => t.statusCode < 400,
958
+ skip: (e, t) => !1,
959
+ async keyGenerator(e, t) {
960
+ i.ip(e.ip), i.trustProxy(e), i.xForwardedForHeader(e), i.forwardedHeader(e);
961
+ let n = e.ip, a = 56;
962
+ return r(n) && (a = typeof o.ipv6Subnet == "function" ? await o.ipv6Subnet(e, t) : o.ipv6Subnet, typeof o.ipv6Subnet == "function" && i.ipv6Subnet(a)), ce(n, a);
963
+ },
964
+ ipv6Subnet: 56,
965
+ async handler(e, t, n, r) {
966
+ t.status(o.statusCode);
967
+ let i = typeof o.message == "function" ? await o.message(e, t) : o.message;
968
+ t.writableEnded || t.send(i);
969
+ },
970
+ passOnStoreError: !1,
971
+ ...t,
972
+ standardHeaders: a,
973
+ store: Te(t.store ?? new le(i)),
974
+ validations: i,
975
+ logger: n
976
+ };
977
+ if (typeof o.store.increment != "function" || typeof o.store.decrement != "function" || typeof o.store.resetKey != "function" || o.store.resetAll !== void 0 && typeof o.store.resetAll != "function" || o.store.init !== void 0 && typeof o.store.init != "function") throw TypeError("An invalid store was passed. Please ensure that the store is a class that implements the `Store` interface.");
978
+ return o;
979
+ }, Oe = (e) => async (t, n, r) => {
980
+ try {
981
+ await Promise.resolve(e(t, n, r)).catch(r);
982
+ } catch (e) {
983
+ r(e);
984
+ }
985
+ }, ke = (e) => {
986
+ let t = De(e ?? {}), n = Ee(t);
987
+ if (t.validations.creationStack(t.store), t.validations.unsharedStore(t.store), typeof t.store.init == "function") try {
988
+ let e = t.store.init(n);
989
+ e instanceof Promise && e.catch((e) => t.logger.error(e, "express-rate-limit: async error during store initialization."));
990
+ } catch (e) {
991
+ t.logger.error(e, "express-rate-limit: error during store initialization.");
992
+ }
993
+ let r = Oe(async (e, r, i) => {
994
+ let a = t.skipFailedRequests && new Promise((e) => r.once("close", e)), o = (t.skipFailedRequests || t.skipSuccessfulRequests) && new Promise((e) => r.once("finish", e)), s = t.skipFailedRequests && new Promise((e) => r.once("error", e));
995
+ if (await t.skip(e, r)) {
996
+ i();
997
+ return;
998
+ }
999
+ let c = e, l = await t.keyGenerator(e, r), u = 0, d;
1000
+ try {
1001
+ let e = await t.store.increment(l);
1002
+ u = e.totalHits, d = e.resetTime;
1003
+ } catch (e) {
1004
+ if (t.passOnStoreError) {
1005
+ t.logger.error(e, "express-rate-limit: error from store, allowing request without rate-limiting."), i();
1006
+ return;
1007
+ }
1008
+ throw e;
1009
+ }
1010
+ t.validations.positiveHits(u), t.validations.singleCount(e, t.store, l);
1011
+ let f = await (typeof t.limit == "function" ? t.limit(e, r) : t.limit);
1012
+ t.validations.limit(f);
1013
+ let p = {
1014
+ limit: f,
1015
+ used: u,
1016
+ remaining: Math.max(f - u, 0),
1017
+ resetTime: d,
1018
+ key: l
1019
+ };
1020
+ if (Object.defineProperty(p, "current", {
1021
+ configurable: !1,
1022
+ enumerable: !1,
1023
+ value: u
1024
+ }), c[t.requestPropertyName] = p, t.legacyHeaders && !r.headersSent && pe(r, p), t.standardHeaders && !r.headersSent) switch (t.standardHeaders) {
1025
+ case "draft-6":
1026
+ me(r, p, t.windowMs);
1027
+ break;
1028
+ case "draft-7":
1029
+ t.validations.headersResetTime(p.resetTime), he(r, p, t.windowMs);
1030
+ break;
1031
+ case "draft-8": {
1032
+ let n = await (typeof t.identifier == "function" ? t.identifier(e, r) : t.identifier);
1033
+ t.validations.headersResetTime(p.resetTime), ge(r, p, t.windowMs, n, l);
1034
+ break;
1035
+ }
1036
+ default:
1037
+ t.validations.headersDraftVersion(t.standardHeaders);
1038
+ break;
1039
+ }
1040
+ if (t.skipFailedRequests || t.skipSuccessfulRequests) {
1041
+ let n = !1, i = async () => {
1042
+ n ||= (await t.store.decrement(l), !0);
1043
+ };
1044
+ t.skipFailedRequests && (o && o.then(async () => {
1045
+ await t.requestWasSuccessful(e, r) || await i();
1046
+ }), a && a.then(async () => {
1047
+ r.writableEnded || await i();
1048
+ }), s && s.then(async () => {
1049
+ await i();
1050
+ })), t.skipSuccessfulRequests && o && o.then(async () => {
1051
+ await t.requestWasSuccessful(e, r) && await i();
1052
+ });
1053
+ }
1054
+ if (t.validations.disable(), u > f) {
1055
+ (t.legacyHeaders || t.standardHeaders) && _e(r, p, t.windowMs), t.handler(e, r, i, n);
1056
+ return;
1057
+ }
1058
+ i();
1059
+ });
1060
+ return r.resetKey = t.store.resetKey.bind(t.store), r.getKey = typeof t.store.get == "function" ? t.store.get.bind(t.store) : () => {
1061
+ throw Error("The current store does not support the get/getKey method");
1062
+ }, r;
1063
+ }, Ae = new Set([
16
1064
  "token",
17
1065
  "accesstoken",
18
1066
  "refreshtoken",
@@ -25,11 +1073,11 @@ var k = new Set([
25
1073
  "password",
26
1074
  "secret"
27
1075
  ]);
28
- function ee(e) {
1076
+ function je(e) {
29
1077
  return e.toLowerCase().replace(/[^a-z0-9]/g, "");
30
1078
  }
31
- function A(e, t) {
32
- for (let e of Object.keys(t)) if (k.has(ee(e))) throw Error(`OAuth audit event must not carry forbidden field: ${e}`);
1079
+ function L(e, t) {
1080
+ for (let e of Object.keys(t)) if (Ae.has(je(e))) throw Error(`OAuth audit event must not carry forbidden field: ${e}`);
33
1081
  let { now: n, ...r } = t;
34
1082
  return {
35
1083
  kind: e,
@@ -37,7 +1085,7 @@ function A(e, t) {
37
1085
  ...r
38
1086
  };
39
1087
  }
40
- function te(e) {
1088
+ function Me(e) {
41
1089
  let t = !1;
42
1090
  return (n) => {
43
1091
  try {
@@ -47,7 +1095,7 @@ function te(e) {
47
1095
  }
48
1096
  };
49
1097
  }
50
- function ne(e = process.stderr) {
1098
+ function Ne(e = process.stderr) {
51
1099
  return (t) => {
52
1100
  e.write(`${JSON.stringify({
53
1101
  source: "codemem-mcp-oauth-audit",
@@ -55,28 +1103,28 @@ function ne(e = process.stderr) {
55
1103
  })}\n`);
56
1104
  };
57
1105
  }
58
- function re() {
1106
+ function Pe() {
59
1107
  return () => {};
60
1108
  }
61
- function ie(e = process.env.CODEMEM_MCP_AUDIT) {
1109
+ function Fe(e = process.env.CODEMEM_MCP_AUDIT) {
62
1110
  let t = e?.trim().toLowerCase();
63
- return t === "0" || t === "false" || t === "no" ? re() : ne();
1111
+ return t === "0" || t === "false" || t === "no" ? Pe() : Ne();
64
1112
  }
65
- var ae = "codemem MCP", j = ["memory:read", "memory:write"], M = "https://github.com/kunickiaj/codemem#readme", oe = "https://claude.ai/api/mcp/auth_callback", N = new Set([
1113
+ var Ie = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github.com/kunickiaj/codemem#readme", Le = "https://claude.ai/api/mcp/auth_callback", Re = new Set([
66
1114
  "localhost",
67
1115
  "127.0.0.1",
68
1116
  "::1"
69
- ]), se = new Set(["authorization_code", "refresh_token"]), ce = new Set(["code"]), P = 3600, F = 720 * 60 * 60, le = 100, ue = 100, de = 100, I = 32, fe = 43, pe = /^[A-Za-z0-9_-]{43}$/, me = /^[A-Za-z0-9_-]{43}$/, he = class {
1117
+ ]), ze = new Set(["authorization_code", "refresh_token"]), Be = new Set(["code"]), Ve = 3600, He = 720 * 60 * 60, Ue = 100, We = 100, Ge = 100, B = 32, Ke = 43, qe = /^[A-Za-z0-9_-]{43}$/, Je = /^[A-Za-z0-9_-]{43}$/, Ye = class {
70
1118
  #e = /* @__PURE__ */ new Map();
71
1119
  getClient(e) {
72
1120
  return this.#e.get(e);
73
1121
  }
74
1122
  registerClient(e) {
75
- let t = De(e.redirect_uris);
76
- if (t) throw new b(t);
77
- if (e.client_secret || e.token_endpoint_auth_method !== "none") throw new b("Only public clients with token_endpoint_auth_method=none are supported");
78
- if (e.grant_types && !Oe(e.grant_types, se)) throw new b("Only authorization_code and refresh_token grant_types are supported");
79
- if (e.response_types && !Oe(e.response_types, ce)) throw new b("Only code response_type is supported");
1123
+ let t = st(e.redirect_uris);
1124
+ if (t) throw new C(t);
1125
+ if (e.client_secret || e.token_endpoint_auth_method !== "none") throw new C("Only public clients with token_endpoint_auth_method=none are supported");
1126
+ if (e.grant_types && !ct(e.grant_types, ze)) throw new C("Only authorization_code and refresh_token grant_types are supported");
1127
+ if (e.response_types && !ct(e.response_types, Be)) throw new C("Only code response_type is supported");
80
1128
  if (this.#e.size >= 100) {
81
1129
  let e = this.#e.keys().next().value;
82
1130
  e && this.#e.delete(e);
@@ -86,16 +1134,16 @@ var ae = "codemem MCP", j = ["memory:read", "memory:write"], M = "https://github
86
1134
  token_endpoint_auth_method: "none",
87
1135
  grant_types: e.grant_types ?? ["authorization_code", "refresh_token"],
88
1136
  response_types: e.response_types ?? ["code"],
89
- client_id: h(),
1137
+ client_id: v(),
90
1138
  client_id_issued_at: Math.floor(Date.now() / 1e3)
91
1139
  };
92
1140
  return this.#e.set(n.client_id, n), n;
93
1141
  }
94
- }, ge = class {
1142
+ }, Xe = class {
95
1143
  #e = /* @__PURE__ */ new Map();
96
1144
  issueCode(e, t = Date.now()) {
97
- if (this.#t(t), this.#e.size >= le) return;
98
- let n = h();
1145
+ if (this.#t(t), this.#e.size >= Ue) return;
1146
+ let n = v();
99
1147
  return this.#e.set(n, {
100
1148
  ...e,
101
1149
  used: !1
@@ -112,12 +1160,12 @@ var ae = "codemem MCP", j = ["memory:read", "memory:write"], M = "https://github
112
1160
  #t(e) {
113
1161
  for (let [t, n] of this.#e) n.expiresAt <= e && this.#e.delete(t);
114
1162
  }
115
- }, _e = class {
1163
+ }, Ze = class {
116
1164
  #e = /* @__PURE__ */ new Map();
117
- #t = m(32);
1165
+ #t = _(32);
118
1166
  issueToken(e, t = Date.now(), n, r, i = []) {
119
- if (this.#n(t), this.#e.size >= ue) return;
120
- let a = m(I), o = V(a, this.#t);
1167
+ if (this.#n(t), this.#e.size >= We) return;
1168
+ let a = _(B), o = G(a, this.#t);
121
1169
  return this.#e.set(o, {
122
1170
  clientId: e,
123
1171
  grantId: r,
@@ -125,22 +1173,22 @@ var ae = "codemem MCP", j = ["memory:read", "memory:write"], M = "https://github
125
1173
  resource: n,
126
1174
  tokenHash: o,
127
1175
  issuedAt: t,
128
- expiresAt: t + P * 1e3,
1176
+ expiresAt: t + Ve * 1e3,
129
1177
  lastUsedAt: null,
130
1178
  revokedAt: null
131
1179
  }), {
132
1180
  token: a.toString("base64url"),
133
- expiresIn: P
1181
+ expiresIn: Ve
134
1182
  };
135
1183
  }
136
1184
  verifyToken(e, t = Date.now()) {
137
- let n = z(e);
1185
+ let n = U(e);
138
1186
  if (!n) return {
139
1187
  ok: !1,
140
1188
  reason: "unknown_token"
141
1189
  };
142
- let r = V(n, this.#t), i = this.#e.get(r);
143
- return !i || !U(i.tokenHash, r) ? {
1190
+ let r = G(n, this.#t), i = this.#e.get(r);
1191
+ return !i || !K(i.tokenHash, r) ? {
144
1192
  ok: !1,
145
1193
  reason: "unknown_token"
146
1194
  } : i.revokedAt === null ? i.expiresAt <= t ? {
@@ -155,10 +1203,10 @@ var ae = "codemem MCP", j = ["memory:read", "memory:write"], M = "https://github
155
1203
  };
156
1204
  }
157
1205
  revokeToken(e, t = Date.now()) {
158
- let n = z(e);
1206
+ let n = U(e);
159
1207
  if (!n) return !1;
160
- let r = V(n, this.#t), i = this.#e.get(r);
161
- return !i || !U(i.tokenHash, r) ? !1 : (i.revokedAt === null && (i.revokedAt = t), !0);
1208
+ let r = G(n, this.#t), i = this.#e.get(r);
1209
+ return !i || !K(i.tokenHash, r) ? !1 : (i.revokedAt === null && (i.revokedAt = t), !0);
162
1210
  }
163
1211
  revokeTokensForGrant(e, t = Date.now()) {
164
1212
  let n = 0;
@@ -168,24 +1216,24 @@ var ae = "codemem MCP", j = ["memory:read", "memory:write"], M = "https://github
168
1216
  #n(e) {
169
1217
  for (let [t, n] of this.#e) (n.expiresAt <= e || n.revokedAt !== null) && this.#e.delete(t);
170
1218
  }
171
- }, ve = class {
1219
+ }, Qe = class {
172
1220
  #e = /* @__PURE__ */ new Map();
173
1221
  #t = /* @__PURE__ */ new Map();
174
1222
  #n = /* @__PURE__ */ new Map();
175
- #r = m(32);
1223
+ #r = _(32);
176
1224
  issueGrant(e, t = Date.now()) {
177
- if (this.#i(t), this.#e.size >= de) return;
178
- let n = Pe(), r = B(n, this.#r);
1225
+ if (this.#i(t), this.#e.size >= Ge) return;
1226
+ let n = mt(), r = W(n, this.#r);
179
1227
  if (!r) return;
180
1228
  let i = {
181
- grantId: h(),
1229
+ grantId: v(),
182
1230
  clientId: e.clientId,
183
1231
  scopes: [...e.scopes ?? []],
184
1232
  resource: e.resource,
185
1233
  currentRefreshTokenHash: r,
186
1234
  previousRefreshTokenHash: null,
187
1235
  issuedAt: t,
188
- expiresAt: t + F * 1e3,
1236
+ expiresAt: t + He * 1e3,
189
1237
  rotatedAt: null,
190
1238
  revokedAt: null
191
1239
  };
@@ -195,11 +1243,11 @@ var ae = "codemem MCP", j = ["memory:read", "memory:write"], M = "https://github
195
1243
  scopes: [...i.scopes]
196
1244
  },
197
1245
  refreshToken: n,
198
- expiresIn: F
1246
+ expiresIn: He
199
1247
  };
200
1248
  }
201
1249
  rotateRefreshToken(e, t, n = {}, r = Date.now()) {
202
- let i = B(t, this.#r);
1250
+ let i = W(t, this.#r);
203
1251
  if (!i) return {
204
1252
  ok: !1,
205
1253
  reason: "unknown_refresh_token"
@@ -229,7 +1277,7 @@ var ae = "codemem MCP", j = ["memory:read", "memory:write"], M = "https://github
229
1277
  reason: "client_mismatch",
230
1278
  grantId: a
231
1279
  };
232
- if (!Fe(n.scopes ?? o.scopes, o.scopes)) return {
1280
+ if (!gt(n.scopes ?? o.scopes, o.scopes)) return {
233
1281
  ok: !1,
234
1282
  reason: "scope_mismatch",
235
1283
  grantId: a
@@ -239,13 +1287,13 @@ var ae = "codemem MCP", j = ["memory:read", "memory:write"], M = "https://github
239
1287
  reason: "resource_mismatch",
240
1288
  grantId: a
241
1289
  };
242
- let s = U(o.currentRefreshTokenHash, i), c = o.previousRefreshTokenHash !== null && U(o.previousRefreshTokenHash, i);
1290
+ let s = K(o.currentRefreshTokenHash, i), c = o.previousRefreshTokenHash !== null && K(o.previousRefreshTokenHash, i);
243
1291
  if (!s && !c) return this.revokeGrant(a, r), {
244
1292
  ok: !1,
245
1293
  reason: "refresh_token_replay",
246
1294
  grantId: a
247
1295
  };
248
- let l = Pe(), u = B(l, this.#r);
1296
+ let l = mt(), u = W(l, this.#r);
249
1297
  return u ? (o.scopes = [...n.scopes ?? o.scopes], o.previousRefreshTokenHash = s ? o.currentRefreshTokenHash : null, o.currentRefreshTokenHash = u, o.rotatedAt = r, this.#t.set(u, a), this.#n.get(a)?.add(u), {
250
1298
  ok: !0,
251
1299
  grant: {
@@ -260,7 +1308,7 @@ var ae = "codemem MCP", j = ["memory:read", "memory:write"], M = "https://github
260
1308
  };
261
1309
  }
262
1310
  revokeRefreshToken(e, t = Date.now()) {
263
- let n = B(e, this.#r);
1311
+ let n = W(e, this.#r);
264
1312
  if (!n) return;
265
1313
  let r = this.#t.get(n);
266
1314
  if (r) return this.revokeGrant(r, t), r;
@@ -282,52 +1330,52 @@ var ae = "codemem MCP", j = ["memory:read", "memory:write"], M = "https://github
282
1330
  this.#t.delete(e.currentRefreshTokenHash), e.previousRefreshTokenHash && this.#t.delete(e.previousRefreshTokenHash);
283
1331
  }
284
1332
  };
285
- function ye() {
286
- return new he();
1333
+ function $e() {
1334
+ return new Ye();
287
1335
  }
288
- function be() {
289
- return new ge();
1336
+ function et() {
1337
+ return new Xe();
290
1338
  }
291
- function xe() {
292
- return new _e();
1339
+ function tt() {
1340
+ return new Ze();
293
1341
  }
294
- function Se() {
295
- return new ve();
1342
+ function nt() {
1343
+ return new Qe();
296
1344
  }
297
- function Ce(e) {
298
- let t = Ee(L(e.mcpUrl));
1345
+ function rt(e) {
1346
+ let t = ot(V(e.mcpUrl));
299
1347
  return {
300
- ...s({
301
- provider: Ie(e.clientsStore),
1348
+ ...c({
1349
+ provider: _t(e.clientsStore),
302
1350
  issuerUrl: t,
303
1351
  baseUrl: t
304
1352
  }),
305
1353
  grant_types_supported: ["authorization_code", "refresh_token"],
306
1354
  token_endpoint_auth_methods_supported: ["none"],
307
- scopes_supported: j,
308
- service_documentation: M,
1355
+ scopes_supported: R,
1356
+ service_documentation: z,
309
1357
  revocation_endpoint: new URL("/revoke", t).href,
310
1358
  revocation_endpoint_auth_methods_supported: ["none"],
311
1359
  client_id_metadata_document_supported: !1
312
1360
  };
313
1361
  }
314
- function we(e) {
315
- let t = L(e), n = {
1362
+ function it(e) {
1363
+ let t = V(e), n = {
316
1364
  resource: t.href,
317
- authorization_servers: [Ee(t).href],
318
- scopes_supported: j,
1365
+ authorization_servers: [ot(t).href],
1366
+ scopes_supported: R,
319
1367
  bearer_methods_supported: ["header"],
320
- resource_name: ae,
321
- resource_documentation: M
1368
+ resource_name: Ie,
1369
+ resource_documentation: z
322
1370
  };
323
- return D.parse(n);
324
- }
325
- function Te(e, t) {
326
- let n = e.get("client_id") ?? "", r = e.get("redirect_uri") ?? "", i = e.get("response_type") ?? "", a = e.get("code_challenge") ?? "", o = e.get("code_challenge_method") ?? "", s = e.get("resource"), c = Me(e.get("scope")), l = e.get("state");
327
- if (i !== "code") return R("unsupported_response_type");
328
- if (o !== "S256") return R("invalid_request", "PKCE code_challenge_method=S256 is required");
329
- if (!me.test(a)) return R("invalid_request", "Valid PKCE S256 code_challenge is required");
330
- let u = Ne(t, n);
1371
+ return ee.parse(n);
1372
+ }
1373
+ function at(e, t) {
1374
+ let n = e.get("client_id") ?? "", r = e.get("redirect_uri") ?? "", i = e.get("response_type") ?? "", a = e.get("code_challenge") ?? "", o = e.get("code_challenge_method") ?? "", s = e.get("resource"), c = ft(e.get("scope")), l = e.get("state");
1375
+ if (i !== "code") return H("unsupported_response_type");
1376
+ if (o !== "S256") return H("invalid_request", "PKCE code_challenge_method=S256 is required");
1377
+ if (!Je.test(a)) return H("invalid_request", "Valid PKCE S256 code_challenge is required");
1378
+ let u = pt(t, n);
331
1379
  return u ? u.redirect_uris.includes(r) ? {
332
1380
  clientId: n,
333
1381
  redirectUri: r,
@@ -335,48 +1383,48 @@ function Te(e, t) {
335
1383
  scopes: c,
336
1384
  resource: s,
337
1385
  state: l
338
- } : R("invalid_request", "redirect_uri is not registered for this client") : R("invalid_client", "Unknown OAuth client_id");
1386
+ } : H("invalid_request", "redirect_uri is not registered for this client") : H("invalid_client", "Unknown OAuth client_id");
339
1387
  }
340
- function L(e) {
1388
+ function V(e) {
341
1389
  let t;
342
1390
  try {
343
1391
  t = new URL(e);
344
1392
  } catch {
345
1393
  throw Error("Invalid MCP HTTP public URL; expected an HTTPS /mcp URL");
346
1394
  }
347
- if (t.protocol !== "https:" && !Ae(t)) throw Error("Invalid MCP HTTP public URL; use HTTPS for non-loopback URLs");
1395
+ if (t.protocol !== "https:" && !ut(t)) throw Error("Invalid MCP HTTP public URL; use HTTPS for non-loopback URLs");
348
1396
  if (t.username || t.password || t.search || t.hash) throw Error("Invalid MCP HTTP public URL; credentials, query strings, and fragments are not allowed");
349
1397
  if (t.pathname === "/" && (t.pathname = "/mcp"), t.pathname !== "/mcp") throw Error("Invalid MCP HTTP public URL; expected /mcp path");
350
1398
  return t;
351
1399
  }
352
- function Ee(e) {
1400
+ function ot(e) {
353
1401
  return new URL(e.origin);
354
1402
  }
355
- function De(e) {
1403
+ function st(e) {
356
1404
  for (let t of e) {
357
1405
  let e = new URL(t);
358
1406
  if (e.username || e.password || e.hash) return `Invalid redirect URI: ${t}`;
359
- if (e.href !== oe && !ke(e)) return `Unsupported redirect URI: ${t}`;
1407
+ if (e.href !== Le && !lt(e)) return `Unsupported redirect URI: ${t}`;
360
1408
  }
361
1409
  return null;
362
1410
  }
363
- function Oe(e, t) {
1411
+ function ct(e, t) {
364
1412
  return e.length > 0 && e.every((e) => t.has(e));
365
1413
  }
366
- function ke(e) {
367
- return e.protocol === "http:" && N.has(je(e.hostname)) && e.pathname === "/callback" && e.search === "";
1414
+ function lt(e) {
1415
+ return e.protocol === "http:" && Re.has(dt(e.hostname)) && e.pathname === "/callback" && e.search === "";
368
1416
  }
369
- function Ae(e) {
370
- let t = je(e.hostname);
371
- return e.protocol === "http:" && N.has(t);
1417
+ function ut(e) {
1418
+ let t = dt(e.hostname);
1419
+ return e.protocol === "http:" && Re.has(t);
372
1420
  }
373
- function je(e) {
1421
+ function dt(e) {
374
1422
  return e.replace(/^\[(.*)]$/, "$1").toLowerCase();
375
1423
  }
376
- function Me(e) {
1424
+ function ft(e) {
377
1425
  return e?.split(/\s+/).map((e) => e.trim()).filter(Boolean) ?? [];
378
1426
  }
379
- function R(e, t) {
1427
+ function H(e, t) {
380
1428
  return {
381
1429
  status: 400,
382
1430
  body: t ? {
@@ -385,38 +1433,38 @@ function R(e, t) {
385
1433
  } : { error: e }
386
1434
  };
387
1435
  }
388
- function Ne(e, t) {
1436
+ function pt(e, t) {
389
1437
  let n = e.getClient(t);
390
1438
  if (n instanceof Promise) throw Error("Asynchronous OAuth client stores are not supported by this HTTP bootstrap yet");
391
1439
  return n;
392
1440
  }
393
- function z(e) {
394
- if (typeof e != "string" || e.length !== fe || !pe.test(e)) return null;
1441
+ function U(e) {
1442
+ if (typeof e != "string" || e.length !== Ke || !qe.test(e)) return null;
395
1443
  let t = Buffer.from(e, "base64url");
396
- return t.length === I ? t : null;
1444
+ return t.length === B ? t : null;
397
1445
  }
398
- function Pe() {
399
- return m(I).toString("base64url");
1446
+ function mt() {
1447
+ return _(B).toString("base64url");
400
1448
  }
401
- function B(e, t) {
402
- let n = z(e);
403
- return n ? H(n, t) : null;
1449
+ function W(e, t) {
1450
+ let n = U(e);
1451
+ return n ? ht(n, t) : null;
404
1452
  }
405
- function V(e, t) {
406
- return H(e, t);
1453
+ function G(e, t) {
1454
+ return ht(e, t);
407
1455
  }
408
- function H(e, t) {
409
- return f("sha256", t).update(e).digest("base64url");
1456
+ function ht(e, t) {
1457
+ return h("sha256", t).update(e).digest("base64url");
410
1458
  }
411
- function U(e, t) {
1459
+ function K(e, t) {
412
1460
  let n = Buffer.from(e), r = Buffer.from(t);
413
- return n.length === r.length && g(n, r);
1461
+ return n.length === r.length && y(n, r);
414
1462
  }
415
- function Fe(e, t) {
1463
+ function gt(e, t) {
416
1464
  let n = new Set(t);
417
1465
  return e.every((e) => n.has(e));
418
1466
  }
419
- function Ie(e) {
1467
+ function _t(e) {
420
1468
  return {
421
1469
  clientsStore: e,
422
1470
  async authorize() {
@@ -438,14 +1486,14 @@ function Ie(e) {
438
1486
  }
439
1487
  //#endregion
440
1488
  //#region src/oidc.ts
441
- var Le = "CODEMEM_MCP_OIDC_ISSUER_URL", Re = "CODEMEM_MCP_OIDC_CLIENT_ID", ze = "CODEMEM_MCP_OIDC_CLIENT_SECRET", Be = "CODEMEM_MCP_OAUTH_ALLOWED_SUBJECT", Ve = "CODEMEM_MCP_OAUTH_ALLOWED_EMAIL", He = 300 * 1e3, Ue = 100, We = 300 * 1e3, Ge = class {
1489
+ var vt = "CODEMEM_MCP_OIDC_ISSUER_URL", yt = "CODEMEM_MCP_OIDC_CLIENT_ID", bt = "CODEMEM_MCP_OIDC_CLIENT_SECRET", xt = "CODEMEM_MCP_OAUTH_ALLOWED_SUBJECT", St = "CODEMEM_MCP_OAUTH_ALLOWED_EMAIL", Ct = 300 * 1e3, wt = 100, Tt = 300 * 1e3, Et = class {
442
1490
  #e = /* @__PURE__ */ new Map();
443
1491
  issue(e, t = Date.now()) {
444
- if (this.#t(t), this.#e.size >= Ue) return;
445
- let n = h();
1492
+ if (this.#t(t), this.#e.size >= wt) return;
1493
+ let n = v();
446
1494
  return this.#e.set(n, {
447
1495
  ...e,
448
- expiresAt: t + He
1496
+ expiresAt: t + Ct
449
1497
  }), n;
450
1498
  }
451
1499
  consume(e) {
@@ -456,11 +1504,11 @@ var Le = "CODEMEM_MCP_OIDC_ISSUER_URL", Re = "CODEMEM_MCP_OIDC_CLIENT_ID", ze =
456
1504
  for (let [t, n] of this.#e) n.expiresAt <= e && this.#e.delete(t);
457
1505
  }
458
1506
  };
459
- function Ke() {
460
- return new Ge();
1507
+ function Dt() {
1508
+ return new Et();
461
1509
  }
462
- function qe(e = process.env) {
463
- let t = e[Le]?.trim(), n = e[Re]?.trim(), r = e[ze]?.trim(), i = e[Be]?.trim(), a = e[Ve]?.trim().toLowerCase();
1510
+ function Ot(e = process.env) {
1511
+ let t = e[vt]?.trim(), n = e[yt]?.trim(), r = e[bt]?.trim(), i = e[xt]?.trim(), a = e[St]?.trim().toLowerCase();
464
1512
  if (!(!t && !n && !r && !i && !a)) {
465
1513
  if (!t || !n || !r) throw Error("Incomplete MCP OIDC configuration");
466
1514
  if (q(t, "issuer", { allowLoopbackHttp: !0 }), !i && !a) throw Error("MCP OIDC requires CODEMEM_MCP_OAUTH_ALLOWED_SUBJECT or CODEMEM_MCP_OAUTH_ALLOWED_EMAIL");
@@ -473,39 +1521,39 @@ function qe(e = process.env) {
473
1521
  };
474
1522
  }
475
1523
  }
476
- async function Je(e, t, n, r, i, a = Date.now()) {
1524
+ async function kt(e, t, n, r, i, a = Date.now()) {
477
1525
  if (!r) return J("temporarily_unavailable", "OIDC is not configured");
478
- let o = Te(e, t);
1526
+ let o = at(e, t);
479
1527
  if ("status" in o) return o;
480
- let s = await G(r.issuerUrl), c = h(), l = n.issue({
1528
+ let s = await Mt(r.issuerUrl), c = v(), l = n.issue({
481
1529
  oauthParams: e.toString(),
482
1530
  nonce: c
483
1531
  }, a);
484
1532
  if (!l) return J("temporarily_unavailable", "Too many pending OIDC authorizations");
485
- let u = W(i), d = new URL(s.authorization_endpoint);
1533
+ let u = jt(i), d = new URL(s.authorization_endpoint);
486
1534
  return d.searchParams.set("response_type", "code"), d.searchParams.set("client_id", r.clientId), d.searchParams.set("redirect_uri", u), d.searchParams.set("scope", "openid email"), d.searchParams.set("state", l), d.searchParams.set("nonce", c), {
487
1535
  status: 302,
488
1536
  location: d.href
489
1537
  };
490
1538
  }
491
- async function Ye(e, t, n, r, i = Date.now()) {
1539
+ async function At(e, t, n, r, i = Date.now()) {
492
1540
  try {
493
1541
  let a = e.get("code") ?? "", o = e.get("state") ?? "";
494
1542
  if (!o) return J("invalid_request", "Missing OIDC state");
495
1543
  let s = t.consume(o);
496
1544
  if (!s || s.expiresAt <= i) return J("invalid_request", "Expired or unknown OIDC state");
497
1545
  if (!a) return J("invalid_request", "Missing OIDC code");
498
- let c = await G(n.issuerUrl), l = await Xe(c.token_endpoint, n, W(r), a);
499
- return l.id_token ? et(await Ze(l.id_token, c, n.clientId, s.nonce, i), n) ? { oauthParams: new URLSearchParams(s.oauthParams) } : J("access_denied", "OIDC identity is not allowed") : J("invalid_request", "OIDC token exchange failed");
1546
+ let c = await Mt(n.issuerUrl), l = await Nt(c.token_endpoint, n, jt(r), a);
1547
+ return l.id_token ? Rt(await Pt(l.id_token, c, n.clientId, s.nonce, i), n) ? { oauthParams: new URLSearchParams(s.oauthParams) } : J("access_denied", "OIDC identity is not allowed") : J("invalid_request", "OIDC token exchange failed");
500
1548
  } catch {
501
1549
  return J("access_denied", "OIDC identity verification failed");
502
1550
  }
503
1551
  }
504
- function W(e) {
1552
+ function jt(e) {
505
1553
  let t = new URL(e);
506
1554
  return new URL("/oauth/callback", t.origin).href;
507
1555
  }
508
- async function G(e) {
1556
+ async function Mt(e) {
509
1557
  let t = new URL(e);
510
1558
  if (t.search || t.hash) throw Error("OIDC issuer must not include query or fragment");
511
1559
  if (t.username || t.password) throw Error("OIDC issuer must not include credentials");
@@ -514,10 +1562,10 @@ async function G(e) {
514
1562
  let i = await r.json();
515
1563
  if (i.issuer !== t.href && i.issuer !== t.href.replace(/\/$/, "")) throw Error("OIDC discovery issuer mismatch");
516
1564
  if (!i.authorization_endpoint || !i.token_endpoint || !i.jwks_uri) throw Error("OIDC discovery metadata is incomplete");
517
- let a = t.protocol === "http:" && tt(t.hostname);
1565
+ let a = t.protocol === "http:" && zt(t.hostname);
518
1566
  return q(i.authorization_endpoint, "authorization endpoint", { allowLoopbackHttp: a }), q(i.token_endpoint, "token endpoint", { allowLoopbackHttp: a }), q(i.jwks_uri, "JWKS URI", { allowLoopbackHttp: a }), i;
519
1567
  }
520
- async function Xe(e, t, n, r) {
1568
+ async function Nt(e, t, n, r) {
521
1569
  let i = new URLSearchParams({
522
1570
  grant_type: "authorization_code",
523
1571
  code: r,
@@ -532,48 +1580,48 @@ async function Xe(e, t, n, r) {
532
1580
  if (!a.ok) throw Error("OIDC token request failed");
533
1581
  return await a.json();
534
1582
  }
535
- async function Ze(e, t, n, r, i) {
1583
+ async function Pt(e, t, n, r, i) {
536
1584
  let [a, o, s] = e.split(".");
537
1585
  if (!a || !o || !s) throw Error("Invalid OIDC id_token");
538
- let c = K(a), l = K(o);
1586
+ let c = Ft(a), l = Ft(o);
539
1587
  if (c.alg !== "RS256" || !c.kid) throw Error("Unsupported OIDC id_token signature");
540
1588
  if (l.iss !== t.issuer) throw Error("OIDC id_token issuer mismatch");
541
- if (!Qe(l.aud, n)) throw Error("OIDC id_token audience mismatch");
542
- if (!$e(l.aud, l.azp, n)) throw Error("OIDC id_token authorized party mismatch");
1589
+ if (!It(l.aud, n)) throw Error("OIDC id_token audience mismatch");
1590
+ if (!Lt(l.aud, l.azp, n)) throw Error("OIDC id_token authorized party mismatch");
543
1591
  if (typeof l.exp != "number" || !Number.isFinite(l.exp) || l.exp * 1e3 <= i) throw Error("OIDC id_token is expired");
544
1592
  if (typeof l.iat != "number" || !Number.isFinite(l.iat)) throw Error("OIDC id_token issued-at time is missing");
545
- if (l.iat * 1e3 > i + We) throw Error("OIDC id_token issued-at time is in the future");
1593
+ if (l.iat * 1e3 > i + Tt) throw Error("OIDC id_token issued-at time is in the future");
546
1594
  if (l.nonce !== r) throw Error("OIDC id_token nonce mismatch");
547
1595
  if (!l.sub) throw Error("OIDC id_token subject is missing");
548
1596
  let u = await fetch(t.jwks_uri);
549
1597
  if (!u.ok) throw Error("OIDC JWKS request failed");
550
1598
  let d = (await u.json()).keys?.find((e) => e.kid === c.kid && e.kty === "RSA");
551
1599
  if (!d) throw Error("OIDC signing key not found");
552
- let f = p({
1600
+ let f = g({
553
1601
  key: d,
554
1602
  format: "jwk"
555
- }), m = `${a}.${o}`;
556
- if (!_("RSA-SHA256", Buffer.from(m), f, Buffer.from(s, "base64url"))) throw Error("OIDC id_token signature verification failed");
1603
+ }), p = `${a}.${o}`;
1604
+ if (!b("RSA-SHA256", Buffer.from(p), f, Buffer.from(s, "base64url"))) throw Error("OIDC id_token signature verification failed");
557
1605
  return l;
558
1606
  }
559
- function K(e) {
1607
+ function Ft(e) {
560
1608
  return JSON.parse(Buffer.from(e, "base64url").toString("utf8"));
561
1609
  }
562
- function Qe(e, t) {
1610
+ function It(e, t) {
563
1611
  return Array.isArray(e) ? e.includes(t) : e === t;
564
1612
  }
565
- function $e(e, t, n) {
1613
+ function Lt(e, t, n) {
566
1614
  return t && t !== n ? !1 : !Array.isArray(e) || e.length <= 1 || t === n;
567
1615
  }
568
- function et(e, t) {
1616
+ function Rt(e, t) {
569
1617
  return t.allowedSubject && e.sub === t.allowedSubject ? !0 : t.allowedEmail ? e.email_verified === !0 && e.email?.toLowerCase() === t.allowedEmail : !1;
570
1618
  }
571
1619
  function q(e, t, n = {}) {
572
1620
  let r = new URL(e);
573
1621
  if (r.username || r.password) throw Error(`OIDC ${t} must not include credentials`);
574
- if (r.protocol !== "https:" && !(n.allowLoopbackHttp && r.protocol === "http:" && tt(r.hostname))) throw Error(`OIDC ${t} must use HTTPS`);
1622
+ if (r.protocol !== "https:" && !(n.allowLoopbackHttp && r.protocol === "http:" && zt(r.hostname))) throw Error(`OIDC ${t} must use HTTPS`);
575
1623
  }
576
- function tt(e) {
1624
+ function zt(e) {
577
1625
  let t = e.replace(/^\[(.*)]$/, "$1").toLowerCase();
578
1626
  return t === "localhost" || t === "127.0.0.1" || t === "::1";
579
1627
  }
@@ -588,7 +1636,7 @@ function J(e, t) {
588
1636
  }
589
1637
  //#endregion
590
1638
  //#region src/provider.ts
591
- var nt = class {
1639
+ var Bt = class {
592
1640
  #e;
593
1641
  #t;
594
1642
  #n;
@@ -598,44 +1646,44 @@ var nt = class {
598
1646
  #o;
599
1647
  #s;
600
1648
  constructor(e) {
601
- this.#e = e.clientsStore, this.#t = e.codeStore, this.#n = e.tokenStore, this.#r = e.refreshTokenStore ?? Se(), this.#i = e.publicMcpUrl, this.#a = new URL(e.publicMcpUrl).href, this.#o = e.oidc, this.#s = e.now ?? Date.now;
1649
+ this.#e = e.clientsStore, this.#t = e.codeStore, this.#n = e.tokenStore, this.#r = e.refreshTokenStore ?? nt(), this.#i = e.publicMcpUrl, this.#a = new URL(e.publicMcpUrl).href, this.#o = e.oidc, this.#s = e.now ?? Date.now;
602
1650
  }
603
1651
  get clientsStore() {
604
1652
  return this.#e;
605
1653
  }
606
1654
  async authorize(e, t, n) {
607
- if (!this.#o) throw new T("OIDC is not configured");
608
- let r = await Je(rt(e, t), this.#e, this.#o.pendingStore, this.#o.config, this.#i, this.#s());
1655
+ if (!this.#o) throw new O("OIDC is not configured");
1656
+ let r = await kt(Vt(e, t), this.#e, this.#o.pendingStore, this.#o.config, this.#i, this.#s());
609
1657
  if (r.status === 302) {
610
1658
  n.redirect(302, r.location);
611
1659
  return;
612
1660
  }
613
- throw it(r.body);
1661
+ throw Ht(r.body);
614
1662
  }
615
1663
  async challengeForAuthorizationCode(e, t) {
616
1664
  let n = this.#t.peekCode(t);
617
- if (!n) throw new x("Invalid or already used code");
618
- if (n.clientId !== e.client_id) throw new x("Code does not match client");
619
- if (n.expiresAt <= this.#s()) throw this.#t.consumeCode(t), new x("Expired code");
1665
+ if (!n) throw new w("Invalid or already used code");
1666
+ if (n.clientId !== e.client_id) throw new w("Code does not match client");
1667
+ if (n.expiresAt <= this.#s()) throw this.#t.consumeCode(t), new w("Expired code");
620
1668
  return n.codeChallenge;
621
1669
  }
622
1670
  async exchangeAuthorizationCode(e, t, n, r, i) {
623
1671
  let a = this.#s(), o = this.#t.peekCode(t);
624
- if (!o) throw new x("Invalid or already used code");
625
- if (o.expiresAt <= a) throw this.#t.consumeCode(t), new x("Expired code");
626
- if (o.clientId !== e.client_id) throw this.#t.consumeCode(t), new x("Code does not match client");
627
- if (r === void 0 || o.redirectUri !== r) throw this.#t.consumeCode(t), new x("Code does not match redirect_uri");
628
- if ((o.resource ?? null) !== (i?.href ?? null)) throw this.#t.consumeCode(t), new x("Code does not match resource");
629
- let s = ot(o.scopes) ?? [], c = this.#r.issueGrant({
1672
+ if (!o) throw new w("Invalid or already used code");
1673
+ if (o.expiresAt <= a) throw this.#t.consumeCode(t), new w("Expired code");
1674
+ if (o.clientId !== e.client_id) throw this.#t.consumeCode(t), new w("Code does not match client");
1675
+ if (r === void 0 || o.redirectUri !== r) throw this.#t.consumeCode(t), new w("Code does not match redirect_uri");
1676
+ if ((o.resource ?? null) !== (i?.href ?? null)) throw this.#t.consumeCode(t), new w("Code does not match resource");
1677
+ let s = Wt(o.scopes) ?? [], c = this.#r.issueGrant({
630
1678
  clientId: e.client_id,
631
1679
  scopes: s,
632
1680
  resource: o.resource
633
1681
  }, a);
634
- if (!c) throw new T("Too many active refresh grants");
1682
+ if (!c) throw new O("Too many active refresh grants");
635
1683
  let l = this.#n.issueToken(e.client_id, a, o.resource, c.grant.grantId, s);
636
- if (!l) throw this.#r.revokeGrant(c.grant.grantId, a), new T("Too many active access tokens");
637
- if (!this.#t.consumeCode(t)) throw this.#n.revokeToken(l.token, a), this.#r.revokeGrant(c.grant.grantId, a), new x("Authorization code already used");
638
- return O.parse({
1684
+ if (!l) throw this.#r.revokeGrant(c.grant.grantId, a), new O("Too many active access tokens");
1685
+ if (!this.#t.consumeCode(t)) throw this.#n.revokeToken(l.token, a), this.#r.revokeGrant(c.grant.grantId, a), new w("Authorization code already used");
1686
+ return A.parse({
639
1687
  access_token: l.token,
640
1688
  token_type: "Bearer",
641
1689
  expires_in: l.expiresIn,
@@ -644,13 +1692,13 @@ var nt = class {
644
1692
  }
645
1693
  async exchangeRefreshToken(e, t, n, r) {
646
1694
  let i = this.#s(), a = this.#r.rotateRefreshToken(e.client_id, t, {
647
- scopes: ot(n),
1695
+ scopes: Wt(n),
648
1696
  ...r ? { resource: r.href } : {}
649
1697
  }, i);
650
- if (!a.ok) throw a.reason === "refresh_token_replay" && a.grantId && this.#n.revokeTokensForGrant?.(a.grantId, i), new x(at(a.reason));
1698
+ if (!a.ok) throw a.reason === "refresh_token_replay" && a.grantId && this.#n.revokeTokensForGrant?.(a.grantId, i), new w(Ut(a.reason));
651
1699
  let o = this.#n.issueToken(e.client_id, i, a.grant.resource, a.grant.grantId, a.grant.scopes);
652
- if (!o) throw new T("Too many active access tokens");
653
- return O.parse({
1700
+ if (!o) throw new O("Too many active access tokens");
1701
+ return A.parse({
654
1702
  access_token: o.token,
655
1703
  token_type: "Bearer",
656
1704
  expires_in: o.expiresIn,
@@ -659,7 +1707,7 @@ var nt = class {
659
1707
  }
660
1708
  async verifyAccessToken(e) {
661
1709
  let t = this.#n.verifyToken(e, this.#s());
662
- if (!t.ok) throw new C(t.reason === "expired_token" ? "Token has expired" : t.reason === "revoked_token" ? "Token has been revoked" : "Token is invalid");
1710
+ if (!t.ok) throw new E(t.reason === "expired_token" ? "Token has expired" : t.reason === "revoked_token" ? "Token has been revoked" : "Token is invalid");
663
1711
  let n = {
664
1712
  token: e,
665
1713
  clientId: t.record.clientId,
@@ -667,7 +1715,7 @@ var nt = class {
667
1715
  expiresAt: Math.floor(t.record.expiresAt / 1e3)
668
1716
  };
669
1717
  if (t.record.resource) {
670
- if (new URL(t.record.resource).href !== this.#a) throw new C("Token audience does not match this resource server");
1718
+ if (new URL(t.record.resource).href !== this.#a) throw new E("Token audience does not match this resource server");
671
1719
  n.resource = new URL(t.record.resource);
672
1720
  }
673
1721
  return n;
@@ -679,22 +1727,22 @@ var nt = class {
679
1727
  r && this.#n.revokeTokensForGrant?.(r, n);
680
1728
  }
681
1729
  };
682
- function rt(e, t) {
1730
+ function Vt(e, t) {
683
1731
  let n = new URLSearchParams();
684
1732
  return n.set("client_id", e.client_id), n.set("redirect_uri", t.redirectUri), n.set("response_type", "code"), n.set("code_challenge", t.codeChallenge), n.set("code_challenge_method", "S256"), t.state && n.set("state", t.state), t.scopes?.length && n.set("scope", t.scopes.join(" ")), t.resource && n.set("resource", t.resource.href), n;
685
1733
  }
686
- function it(e) {
1734
+ function Ht(e) {
687
1735
  let t = e.error_description ?? e.error;
688
1736
  switch (e.error) {
689
- case "temporarily_unavailable": return new T(t);
690
- case "invalid_request": return new S(t);
691
- case "invalid_client": return new y(t);
692
- case "access_denied": return new v(t);
693
- case "unsupported_response_type": return new E(t);
694
- default: return new w(t);
1737
+ case "temporarily_unavailable": return new O(t);
1738
+ case "invalid_request": return new T(t);
1739
+ case "invalid_client": return new S(t);
1740
+ case "access_denied": return new x(t);
1741
+ case "unsupported_response_type": return new k(t);
1742
+ default: return new D(t);
695
1743
  }
696
1744
  }
697
- function at(e) {
1745
+ function Ut(e) {
698
1746
  switch (e) {
699
1747
  case "expired_refresh_token": return "Refresh token has expired";
700
1748
  case "revoked_refresh_token": return "Refresh token has been revoked";
@@ -705,34 +1753,34 @@ function at(e) {
705
1753
  default: return "Invalid refresh token";
706
1754
  }
707
1755
  }
708
- function ot(e) {
1756
+ function Wt(e) {
709
1757
  let t = e?.map((e) => e.trim()).filter(Boolean).map((e) => e === "memory:read_access" ? "memory:read" : e === "memory:write_access" ? "memory:write" : e);
710
1758
  return t && t.length > 0 ? t : void 0;
711
1759
  }
712
1760
  //#endregion
713
1761
  //#region src/http.ts
714
- var st = "127.0.0.1", Y = 38889, ct = 80, lt = /^[a-zA-Z0-9.-]+$/, ut = new Set([
1762
+ var Gt = "127.0.0.1", Y = 38889, Kt = 80, qt = new Set(["https://claude.ai"]), Jt = "authorization,content-type,mcp-session-id", Yt = "600", Xt = 256, Zt = 900 * 1e3, Qt = 600, $t = /^[a-zA-Z0-9.-]+$/, en = new Set([
715
1763
  "127.0.0.1",
716
1764
  "::1",
717
1765
  "localhost"
718
1766
  ]);
719
- function dt(e, t = !1) {
1767
+ function tn(e, t = !1) {
720
1768
  let r = e?.trim() || "127.0.0.1";
721
- if (r.includes("://") || r.includes("/") || r.includes("\\") || !(n(r) || r === "localhost" || lt.test(r))) throw Error(`Invalid MCP HTTP host: ${e}`);
1769
+ if (r.includes("://") || r.includes("/") || r.includes("\\") || !(n(r) || r === "localhost" || $t.test(r))) throw Error(`Invalid MCP HTTP host: ${e}`);
722
1770
  if (!t && !X(r)) throw Error(`Refusing unsafe MCP HTTP host ${r}; set CODEMEM_MCP_HTTP_UNSAFE_PUBLIC=1 to allow non-loopback binding`);
723
1771
  return r;
724
1772
  }
725
1773
  function X(e) {
726
- return ut.has(Z(e));
1774
+ return en.has(Z(e));
727
1775
  }
728
- function ft(e = process.env.CODEMEM_MCP_HTTP_UNSAFE_PUBLIC) {
1776
+ function nn(e = process.env.CODEMEM_MCP_HTTP_UNSAFE_PUBLIC) {
729
1777
  return e === "1" || e?.toLowerCase() === "true" || e?.toLowerCase() === "yes";
730
1778
  }
731
- function pt(e, t) {
732
- let n = gt(e);
733
- return !n || !X(n.host) ? !1 : n.port === null ? t === ct : n.port === t;
1779
+ function rn(e, t) {
1780
+ let n = Q(e);
1781
+ return !n || !X(n.host) ? !1 : n.port === null ? t === Kt : n.port === t;
734
1782
  }
735
- function mt(e, t) {
1783
+ function an(e, t) {
736
1784
  if (!e) return !0;
737
1785
  try {
738
1786
  let n = new URL(e), r = n.port ? Number(n.port) : n.protocol === "https:" ? 443 : 80;
@@ -741,13 +1789,13 @@ function mt(e, t) {
741
1789
  return !1;
742
1790
  }
743
1791
  }
744
- function ht(e) {
1792
+ function on(e) {
745
1793
  return e ? X(e.replace(/^::ffff:/, "")) : !1;
746
1794
  }
747
1795
  function Z(e) {
748
1796
  return e.replace(/^\[(.*)]$/, "$1").toLowerCase();
749
1797
  }
750
- function gt(e) {
1798
+ function Q(e) {
751
1799
  if (!e) return null;
752
1800
  if (e.startsWith("[")) {
753
1801
  let t = /^\[([^\]]+)]:(\d+)$/.exec(e);
@@ -772,25 +1820,25 @@ function gt(e) {
772
1820
  port: r
773
1821
  } : null;
774
1822
  }
775
- function Q(e) {
1823
+ function sn(e) {
776
1824
  if (e === void 0 || e === "") return Y;
777
1825
  let t = typeof e == "number" ? e : Number(e);
778
1826
  if (!Number.isInteger(t) || t < 0 || t > 65535) throw Error(`Invalid MCP HTTP port: ${e}`);
779
1827
  return t;
780
1828
  }
781
- async function _t(n = {}) {
782
- let r = dt(n.host ?? process.env.CODEMEM_MCP_HTTP_HOST, n.allowUnsafePublic ?? ft()), s = Q(n.port ?? process.env.CODEMEM_MCP_HTTP_PORT), f = n.publicUrl ?? process.env.CODEMEM_MCP_HTTP_PUBLIC_URL, p = f ? L(f) : void 0, m = new i(n.dbPath ?? a()), h = ye(), g = be(), _ = n.oauthAccessTokenStore ?? xe(), v = qe(), y = Ke(), b = p !== void 0 || v !== void 0, x = te(n.auditEmitter ?? ie()), S = /* @__PURE__ */ new Set(), C = null, w = d();
1829
+ async function cn(n = {}) {
1830
+ let r = tn(n.host ?? process.env.CODEMEM_MCP_HTTP_HOST, n.allowUnsafePublic ?? nn()), i = sn(n.port ?? process.env.CODEMEM_MCP_HTTP_PORT), c = n.publicUrl ?? process.env.CODEMEM_MCP_HTTP_PUBLIC_URL, p = c ? V(c) : void 0, m = new a(n.dbPath ?? o()), h = $e(), g = et(), _ = n.oauthAccessTokenStore ?? tt(), v = Ot(), y = Dt(), b = p !== void 0 || v !== void 0, x = Me(n.auditEmitter ?? Fe()), S = /* @__PURE__ */ new Set(), C = null, w = f();
783
1831
  w.disable("x-powered-by"), w.set("trust proxy", "loopback");
784
1832
  let T = t(w);
785
1833
  await new Promise((e, t) => {
786
1834
  T.once("error", t), T.listen({
787
1835
  host: r,
788
- port: s
1836
+ port: i
789
1837
  }, () => {
790
1838
  T.off("error", t), e();
791
1839
  });
792
1840
  });
793
- let E = p?.href ?? wt(T, r), D = new URL(E), O = Tt(D, $(T)), k = new nt({
1841
+ let E = p?.href ?? yn(T, r), D = new URL(E), O = bn(D, $(T)), k = new Bt({
794
1842
  clientsStore: h,
795
1843
  codeStore: g,
796
1844
  tokenStore: _,
@@ -799,24 +1847,42 @@ async function _t(n = {}) {
799
1847
  config: v,
800
1848
  pendingStore: y
801
1849
  } } : {}
802
- }), ee = c(D);
803
- w.use((e, t, n) => {
804
- let r = $(T), i = Dt(e.path);
1850
+ }), ee = l(D);
1851
+ w.use(ke({
1852
+ windowMs: Zt,
1853
+ limit: Qt,
1854
+ standardHeaders: "draft-8",
1855
+ legacyHeaders: !1,
1856
+ ipv6Subnet: !1
1857
+ })), w.use((e, t, n) => {
1858
+ let r = $(T), i = Sn(e.path);
805
1859
  if (i === "/mcp") {
806
- if (vt(e, r, p)) return n();
807
- t.status(403).type("text/plain").send("Forbidden");
1860
+ if (ln(e, r, p)) {
1861
+ if (pn(e, t, p), e.method === "OPTIONS") {
1862
+ t.status(204).send("");
1863
+ return;
1864
+ }
1865
+ return n();
1866
+ }
1867
+ hn(e, i, p), t.status(403).type("text/plain").send("Forbidden");
808
1868
  return;
809
1869
  }
810
- if (Et(i)) {
811
- if (bt(e, r, p)) return n();
812
- t.status(403).type("text/plain").send("Forbidden");
1870
+ if (xn(i)) {
1871
+ if (dn(e, r, p)) {
1872
+ if (pn(e, t, p), e.method === "OPTIONS") {
1873
+ t.status(204).send("");
1874
+ return;
1875
+ }
1876
+ return n();
1877
+ }
1878
+ hn(e, i, p), t.status(403).type("text/plain").send("Forbidden");
813
1879
  return;
814
1880
  }
815
1881
  n();
816
- }), w.use(Ot(x)), w.get("/oauth/callback", async (e, t) => {
1882
+ }), w.use(Cn(x)), w.get("/oauth/callback", async (e, t) => {
817
1883
  let n = e.socket.remoteAddress ?? void 0;
818
1884
  if (!v) {
819
- x(A("oidc_callback", {
1885
+ x(L("oidc_callback", {
820
1886
  outcome: "denied",
821
1887
  reason: "oidc_not_configured",
822
1888
  remoteAddress: n
@@ -826,9 +1892,9 @@ async function _t(n = {}) {
826
1892
  });
827
1893
  return;
828
1894
  }
829
- let r = await Ye(new URLSearchParams(e.query), y, v, E);
1895
+ let r = await At(new URLSearchParams(e.query), y, v, E);
830
1896
  if ("status" in r) {
831
- x(A("oidc_callback", {
1897
+ x(L("oidc_callback", {
832
1898
  outcome: "denied",
833
1899
  reason: r.body.error,
834
1900
  remoteAddress: n
@@ -839,12 +1905,12 @@ async function _t(n = {}) {
839
1905
  clientId: r.oauthParams.get("client_id") ?? "",
840
1906
  redirectUri: r.oauthParams.get("redirect_uri") ?? "",
841
1907
  codeChallenge: r.oauthParams.get("code_challenge") ?? "",
842
- scopes: Lt(r.oauthParams.get("scope")),
1908
+ scopes: Mn(r.oauthParams.get("scope")),
843
1909
  ...r.oauthParams.get("resource") ? { resource: r.oauthParams.get("resource") ?? void 0 } : {},
844
1910
  expiresAt: Date.now() + 300 * 1e3
845
1911
  });
846
1912
  if (!a) {
847
- x(A("oidc_callback", {
1913
+ x(L("oidc_callback", {
848
1914
  outcome: "denied",
849
1915
  reason: "temporarily_unavailable",
850
1916
  clientId: i,
@@ -858,40 +1924,40 @@ async function _t(n = {}) {
858
1924
  let o = new URL(r.oauthParams.get("redirect_uri") ?? "");
859
1925
  o.searchParams.set("code", a);
860
1926
  let s = r.oauthParams.get("state");
861
- s && o.searchParams.set("state", s), x(A("oidc_callback", {
1927
+ s && o.searchParams.set("state", s), x(L("oidc_callback", {
862
1928
  outcome: "success",
863
1929
  reason: "code_issued",
864
1930
  clientId: i,
865
1931
  remoteAddress: n
866
1932
  })), t.redirect(302, o.href);
867
1933
  }), w.get("/.well-known/oauth-authorization-server", (e, t) => {
868
- t.status(200).json(Ce({
1934
+ t.status(200).json(rt({
869
1935
  mcpUrl: E,
870
1936
  clientsStore: h
871
1937
  }));
872
1938
  }), w.get("/.well-known/oauth-protected-resource/mcp", (e, t) => {
873
- t.status(200).json(we(E));
874
- }), w.use(l({
1939
+ t.status(200).json(it(E));
1940
+ }), w.use(u({
875
1941
  provider: k,
876
1942
  issuerUrl: O,
877
1943
  baseUrl: O,
878
1944
  resourceServerUrl: D,
879
- resourceName: ae,
880
- scopesSupported: j,
881
- serviceDocumentationUrl: new URL(M),
1945
+ resourceName: Ie,
1946
+ scopesSupported: R,
1947
+ serviceDocumentationUrl: new URL(z),
882
1948
  clientRegistrationOptions: { clientSecretExpirySeconds: 0 }
883
1949
  }));
884
- let ne = b ? o({
1950
+ let A = b ? s({
885
1951
  verifier: k,
886
1952
  resourceMetadataUrl: ee
887
- }) : (e, t, n) => n(), re = b ? Ft(x, _) : (e, t, n) => n();
888
- return w.post("/mcp", re, ne, async (t, n) => {
889
- t.auth && x(A("bearer", {
1953
+ }) : (e, t, n) => n(), j = b ? An(x, _) : (e, t, n) => n();
1954
+ return w.post("/mcp", j, A, async (t, n) => {
1955
+ t.auth && x(L("bearer", {
890
1956
  outcome: "success",
891
1957
  clientId: t.auth.clientId,
892
1958
  remoteAddress: t.socket.remoteAddress ?? void 0
893
1959
  }));
894
- let r = e(m), i = new u({ sessionIdGenerator: void 0 }), a = { mcpServer: r };
1960
+ let r = e(m), i = new d({ sessionIdGenerator: void 0 }), a = { mcpServer: r };
895
1961
  S.add(a);
896
1962
  try {
897
1963
  await r.connect(i), await i.handleRequest(t, n);
@@ -905,7 +1971,7 @@ async function _t(n = {}) {
905
1971
  }), {
906
1972
  server: T,
907
1973
  store: m,
908
- url: `http://${Ct(r)}:${$(T)}/mcp`,
1974
+ url: `http://${vn(r)}:${$(T)}/mcp`,
909
1975
  close: () => (C ??= (async () => {
910
1976
  await Promise.allSettled([...S].map(({ mcpServer: e }) => e.close())), await new Promise((e, t) => {
911
1977
  T.close((n) => {
@@ -919,59 +1985,90 @@ async function _t(n = {}) {
919
1985
  })(), C)
920
1986
  };
921
1987
  }
922
- function vt(e, t, n) {
923
- return yt(e, t) ? !0 : n ? St(e.headers.host, n) && xt(e.headers.origin, n) : !1;
1988
+ function ln(e, t, n) {
1989
+ return un(e, t) ? !0 : n ? _n(e.headers.host, n) && fn(e.headers.origin, n) : !1;
924
1990
  }
925
- function yt(e, t) {
926
- return ht(e.socket.remoteAddress) && pt(e.headers.host, t) && mt(e.headers.origin, t);
1991
+ function un(e, t) {
1992
+ return on(e.socket.remoteAddress) && rn(e.headers.host, t) && an(e.headers.origin, t);
927
1993
  }
928
- function bt(e, t, n) {
929
- return yt(e, t) ? !0 : n ? St(e.headers.host, n) && xt(e.headers.origin, n) : !1;
1994
+ function dn(e, t, n) {
1995
+ return un(e, t) ? !0 : n ? _n(e.headers.host, n) && fn(e.headers.origin, n) : !1;
930
1996
  }
931
- function xt(e, t) {
1997
+ function fn(e, t) {
932
1998
  if (!e) return !0;
933
1999
  try {
934
- return new URL(e).origin === t.origin;
2000
+ let n = new URL(e);
2001
+ return n.origin === t.origin || qt.has(n.origin);
935
2002
  } catch {
936
2003
  return !1;
937
2004
  }
938
2005
  }
939
- function St(e, t) {
940
- let n = gt(e);
2006
+ function pn(e, t, n) {
2007
+ if (!n) return;
2008
+ let r = mn(e.headers.origin, n);
2009
+ r && (t.setHeader("Access-Control-Allow-Origin", r), t.setHeader("Access-Control-Allow-Methods", "GET,POST,OPTIONS"), t.setHeader("Access-Control-Allow-Headers", e.headers["access-control-request-headers"] ?? Jt), t.setHeader("Access-Control-Max-Age", Yt), t.setHeader("Vary", "Origin"));
2010
+ }
2011
+ function mn(e, t) {
2012
+ if (e) try {
2013
+ let n = new URL(e).origin;
2014
+ if (n === t.origin || qt.has(n)) return n;
2015
+ } catch {
2016
+ return;
2017
+ }
2018
+ }
2019
+ function hn(e, t, n) {
2020
+ console.warn(JSON.stringify({
2021
+ source: "codemem-mcp-http-guard",
2022
+ timestamp: (/* @__PURE__ */ new Date()).toISOString(),
2023
+ outcome: "denied",
2024
+ reason: "host_or_origin_mismatch",
2025
+ method: e.method,
2026
+ path: t,
2027
+ host: gn(e.headers.host),
2028
+ origin: gn(e.headers.origin),
2029
+ expectedOrigin: n?.origin,
2030
+ remoteAddress: e.socket.remoteAddress ?? void 0
2031
+ }));
2032
+ }
2033
+ function gn(e) {
2034
+ return !e || e.length <= Xt ? e : `${e.slice(0, Xt)}…`;
2035
+ }
2036
+ function _n(e, t) {
2037
+ let n = Q(e);
941
2038
  if (!n) return !1;
942
- let r = t.port ? Number(t.port) : t.protocol === "https:" ? 443 : 80, i = n.port ?? r;
943
- return Z(n.host) === Z(t.hostname) && i === r;
2039
+ let r = t.port ? Number(t.port) : t.protocol === "https:" ? 443 : 80, i = t.protocol === "https:" ? 443 : 80, a = n.port ?? i;
2040
+ return Z(n.host) === Z(t.hostname) && a === r;
944
2041
  }
945
2042
  function $(e) {
946
2043
  let t = e.address();
947
2044
  return !t || typeof t == "string" ? Y : t.port;
948
2045
  }
949
- function Ct(e) {
2046
+ function vn(e) {
950
2047
  return n(e) === 6 ? `[${e}]` : e;
951
2048
  }
952
- function wt(e, t) {
953
- return `http://${Ct(t)}:${$(e)}/mcp`;
2049
+ function yn(e, t) {
2050
+ return `http://${vn(t)}:${$(e)}/mcp`;
954
2051
  }
955
- function Tt(e, t) {
2052
+ function bn(e, t) {
956
2053
  return e.protocol === "https:" || X(e.hostname) && Z(e.hostname) !== "::1" ? new URL(e.origin) : new URL(`http://localhost:${t}/`);
957
2054
  }
958
- function Et(e) {
2055
+ function xn(e) {
959
2056
  return e === "/register" || e === "/authorize" || e === "/token" || e === "/revoke" || e === "/oauth/callback" || e === "/.well-known/oauth-authorization-server" || e === "/.well-known/oauth-protected-resource/mcp";
960
2057
  }
961
- function Dt(e) {
2058
+ function Sn(e) {
962
2059
  return e.length > 1 ? e.replace(/\/+$/, "") : e;
963
2060
  }
964
- function Ot(e) {
2061
+ function Cn(e) {
965
2062
  return (t, n, r) => {
966
2063
  let i = t.path;
967
- if (!kt(i)) return r();
2064
+ if (!wn(i)) return r();
968
2065
  let a, o = n.json.bind(n);
969
2066
  n.json = ((e) => (a = e, o(e))), n.on("finish", () => {
970
2067
  if (i === "/oauth/callback") return;
971
- let r = At(i, t);
2068
+ let r = Tn(i, t);
972
2069
  if (!r) return;
973
- let o = Mt(n, a), s = Pt(t, a);
974
- e(A(r, {
2070
+ let o = Dn(n, a), s = kn(t, a);
2071
+ e(L(r, {
975
2072
  outcome: o ? "denied" : "success",
976
2073
  ...o ? { reason: o } : {},
977
2074
  ...s ? { clientId: s } : {},
@@ -980,17 +2077,17 @@ function Ot(e) {
980
2077
  }), r();
981
2078
  };
982
2079
  }
983
- function kt(e) {
984
- return jt(e) !== null;
2080
+ function wn(e) {
2081
+ return En(e) !== null;
985
2082
  }
986
- function At(e, t) {
987
- return e === "/token" && t.body?.grant_type === "refresh_token" ? "refresh" : jt(e);
2083
+ function Tn(e, t) {
2084
+ return e === "/token" && t.body?.grant_type === "refresh_token" ? "refresh" : En(e);
988
2085
  }
989
- function jt(e) {
2086
+ function En(e) {
990
2087
  return e === "/register" ? "registration" : e === "/authorize" ? "authorize" : e === "/token" ? "token" : e === "/revoke" ? "revocation" : null;
991
2088
  }
992
- function Mt(e, t) {
993
- let n = Nt(t);
2089
+ function Dn(e, t) {
2090
+ let n = On(t);
994
2091
  if (n) return n;
995
2092
  let r = e.getHeader("location");
996
2093
  if (typeof r == "string") try {
@@ -999,38 +2096,38 @@ function Mt(e, t) {
999
2096
  return;
1000
2097
  }
1001
2098
  }
1002
- function Nt(e) {
2099
+ function On(e) {
1003
2100
  if (typeof e == "object" && e && "error" in e && typeof e.error == "string") return e.error;
1004
2101
  }
1005
- function Pt(e, t) {
2102
+ function kn(e, t) {
1006
2103
  return typeof t == "object" && t && "client_id" in t && typeof t.client_id == "string" ? t.client_id : (typeof e.body?.client_id == "string" ? e.body.client_id : void 0) || (typeof e.query.client_id == "string" ? e.query.client_id : void 0);
1007
2104
  }
1008
- function Ft(e, t) {
2105
+ function An(e, t) {
1009
2106
  return (n, r, i) => {
1010
- let a = It(n.headers.authorization, t);
1011
- a && e(A("bearer", {
2107
+ let a = jn(n.headers.authorization, t);
2108
+ a && e(L("bearer", {
1012
2109
  outcome: "denied",
1013
2110
  reason: a,
1014
2111
  remoteAddress: n.socket.remoteAddress ?? void 0
1015
2112
  })), i();
1016
2113
  };
1017
2114
  }
1018
- function It(e, t) {
2115
+ function jn(e, t) {
1019
2116
  if (!e) return "missing_authorization_header";
1020
2117
  let [n, r, i] = e.trim().split(/\s+/);
1021
2118
  if (!n || !r || i || n.toLowerCase() !== "bearer") return "malformed_authorization_header";
1022
2119
  let a = t.verifyToken(r);
1023
2120
  return a.ok ? null : a.reason;
1024
2121
  }
1025
- function Lt(e) {
2122
+ function Mn(e) {
1026
2123
  return e?.split(/\s+/).map((e) => e.trim()).filter(Boolean) ?? [];
1027
2124
  }
1028
- function Rt() {
2125
+ function Nn() {
1029
2126
  let e = process.argv[1];
1030
- return e ? import.meta.url === r(e).href : !1;
2127
+ return e ? import.meta.url === i(e).href : !1;
1031
2128
  }
1032
- async function zt() {
1033
- let e = await _t();
2129
+ async function Pn() {
2130
+ let e = await cn();
1034
2131
  console.error(`codemem MCP HTTP server listening at ${e.url}`);
1035
2132
  let t = async () => {
1036
2133
  try {
@@ -1040,10 +2137,10 @@ async function zt() {
1040
2137
  };
1041
2138
  process.on("SIGINT", t), process.on("SIGTERM", t);
1042
2139
  }
1043
- Rt() && zt().catch((e) => {
2140
+ Nn() && Pn().catch((e) => {
1044
2141
  console.error("codemem MCP HTTP server failed to start:", e), process.exit(1);
1045
2142
  });
1046
2143
  //#endregion
1047
- export { st as DEFAULT_MCP_HTTP_HOST, Y as DEFAULT_MCP_HTTP_PORT, pt as isAllowedMcpHttpRequestHost, mt as isAllowedMcpHttpRequestOrigin, ht as isAllowedMcpHttpRequestRemoteAddress, X as isLoopbackHost, ft as isUnsafePublicBindAllowed, Q as parseMcpHttpPort, _t as startCodememMcpHttpServer, dt as validateMcpHttpHost };
2144
+ export { Gt as DEFAULT_MCP_HTTP_HOST, Y as DEFAULT_MCP_HTTP_PORT, rn as isAllowedMcpHttpRequestHost, an as isAllowedMcpHttpRequestOrigin, on as isAllowedMcpHttpRequestRemoteAddress, X as isLoopbackHost, nn as isUnsafePublicBindAllowed, sn as parseMcpHttpPort, cn as startCodememMcpHttpServer, tn as validateMcpHttpHost };
1048
2145
 
1049
2146
  //# sourceMappingURL=http.js.map