@codemem/mcp 0.33.0-alpha.3 → 0.34.0

package/dist/http.js

@@ -10,8 +10,12 @@ import { StreamableHTTPServerTransport as d } from "@modelcontextprotocol/sdk/se
 import f from "express";
 import { Buffer as p } from "node:buffer";
 import { createHash as m, createHmac as h, createPublicKey as g, randomBytes as _, randomUUID as v, timingSafeEqual as y, verify as b } from "node:crypto";
-import { AccessDeniedError as x, InvalidClientError as S, InvalidClientMetadataError as C, InvalidGrantError as w, InvalidRequestError as T, InvalidTokenError as E, ServerError as D, TemporarilyUnavailableError as O, UnsupportedResponseTypeError as k } from "@modelcontextprotocol/sdk/server/auth/errors.js";
-import { OAuthProtectedResourceMetadataSchema as ee, OAuthTokensSchema as A } from "@modelcontextprotocol/sdk/shared/auth.js";
+import { existsSync as ee, mkdirSync as x, readFileSync as S, renameSync as te, writeFileSync as C } from "node:fs";
+import { chmod as w } from "node:fs/promises";
+import { homedir as T } from "node:os";
+import { dirname as E, join as D } from "node:path";
+import { AccessDeniedError as ne, InvalidClientError as re, InvalidClientMetadataError as O, InvalidGrantError as k, InvalidRequestError as ie, InvalidTokenError as ae, ServerError as oe, TemporarilyUnavailableError as A, UnsupportedResponseTypeError as se } from "@modelcontextprotocol/sdk/server/auth/errors.js";
+import { OAuthProtectedResourceMetadataSchema as ce, OAuthTokensSchema as le } from "@modelcontextprotocol/sdk/shared/auth.js";
 //#region \0rolldown/runtime.js
 var j = (e, t) => () => (t || (e((t = { exports: {} }).exports, t), e = null), t.exports), M = /* @__PURE__ */ j(((e) => {
 	Object.defineProperty(e, "__esModule", { value: !0 }), e.isInSubnet = t, e.isCorrect = n, e.numberToPaddedHex = r, e.stringToPaddedHex = i, e.testBit = a;
@@ -35,7 +39,7 @@ var j = (e, t) => () => (t || (e((t = { exports: {} }).exports, t), e = null), t
 		let r = n - t;
 		return e.substring(r, r + 1) === "1";
 	}
-})), te = /* @__PURE__ */ j(((e) => {
+})), ue = /* @__PURE__ */ j(((e) => {
 	Object.defineProperty(e, "__esModule", { value: !0 }), e.RE_SUBNET_STRING = e.RE_ADDRESS = e.GROUPS = e.BITS = void 0, e.BITS = 32, e.GROUPS = 4, e.RE_ADDRESS = /^(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$/g, e.RE_SUBNET_STRING = /\/\d{1,2}$/;
 })), N = /* @__PURE__ */ j(((e) => {
 	Object.defineProperty(e, "__esModule", { value: !0 }), e.AddressError = void 0, e.AddressError = class extends Error {
@@ -43,7 +47,7 @@ var j = (e, t) => () => (t || (e((t = { exports: {} }).exports, t), e = null), t
 			super(e), this.name = "AddressError", this.parseMessage = t;
 		}
 	};
-})), ne = /* @__PURE__ */ j(((e) => {
+})), de = /* @__PURE__ */ j(((e) => {
 	var t = e && e.__createBinding || (Object.create ? (function(e, t, n, r) {
 		r === void 0 && (r = n);
 		var i = Object.getOwnPropertyDescriptor(t, n);
@@ -69,7 +73,7 @@ var j = (e, t) => () => (t || (e((t = { exports: {} }).exports, t), e = null), t
 		return n(r, e), r;
 	};
 	Object.defineProperty(e, "__esModule", { value: !0 }), e.Address4 = void 0;
-	var i = r(M()), a = r(te()), o = N();
+	var i = r(M()), a = r(ue()), o = N();
 	e.Address4 = class e {
 		constructor(e) {
 			this.groups = a.GROUPS, this.parsedAddress = [], this.parsedSubnet = "", this.subnet = "/32", this.subnetMask = 32, this.v4 = !0, this.isCorrect = i.isCorrect(a.BITS), this.isInSubnet = i.isInSubnet, this.address = e;
@@ -177,7 +181,7 @@ var j = (e, t) => () => (t || (e((t = { exports: {} }).exports, t), e = null), t
 			return this.address.replace(a.RE_ADDRESS, `<span class="hover-group group-v4 group-6">${e.slice(0, 2).join(".")}</span>.<span class="hover-group group-v4 group-7">${e.slice(2, 4).join(".")}</span>`);
 		}
 	};
-})), re = /* @__PURE__ */ j(((e) => {
+})), fe = /* @__PURE__ */ j(((e) => {
 	Object.defineProperty(e, "__esModule", { value: !0 }), e.RE_URL_WITH_PORT = e.RE_URL = e.RE_ZONE_STRING = e.RE_SUBNET_STRING = e.RE_BAD_ADDRESS = e.RE_BAD_CHARACTERS = e.TYPES = e.SCOPES = e.GROUPS = e.BITS = void 0, e.BITS = 128, e.GROUPS = 8, e.SCOPES = {
 		0: "Reserved",
 		1: "Interface local",
@@ -211,7 +215,7 @@ var j = (e, t) => () => (t || (e((t = { exports: {} }).exports, t), e = null), t
 		"ff00::/8": "Multicast",
 		"fe80::/10": "Link-local unicast"
 	}, e.RE_BAD_CHARACTERS = /([^0-9a-f:/%])/gi, e.RE_BAD_ADDRESS = /([0-9a-f]{5,}|:{3,}|[^:]:$|^:[^:]|\/$)/gi, e.RE_SUBNET_STRING = /\/\d{1,3}(?=%|$)/, e.RE_ZONE_STRING = /%.*$/, e.RE_URL = /^\[{0,1}([0-9a-f:]+)\]{0,1}/, e.RE_URL_WITH_PORT = /\[([0-9a-f:]+)\]:([0-9]{1,5})/;
-})), ie = /* @__PURE__ */ j(((e) => {
+})), pe = /* @__PURE__ */ j(((e) => {
 	Object.defineProperty(e, "__esModule", { value: !0 }), e.escapeHtml = t, e.spanAllZeroes = n, e.spanAll = r, e.spanLeadingZeroes = a, e.simpleGroup = o;
 	function t(e) {
 		return e.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
@@ -231,7 +235,7 @@ var j = (e, t) => () => (t || (e((t = { exports: {} }).exports, t), e = null), t
 	function o(e, t = 0) {
 		return e.split(":").map((e, n) => /group-v4/.test(e) ? e : `<span class="hover-group group-${n + t}">${i(e)}</span>`);
 	}
-})), ae = /* @__PURE__ */ j(((e) => {
+})), me = /* @__PURE__ */ j(((e) => {
 	var t = e && e.__createBinding || (Object.create ? (function(e, t, n, r) {
 		r === void 0 && (r = n);
 		var i = Object.getOwnPropertyDescriptor(t, n);
@@ -257,7 +261,7 @@ var j = (e, t) => () => (t || (e((t = { exports: {} }).exports, t), e = null), t
 		return n(r, e), r;
 	};
 	Object.defineProperty(e, "__esModule", { value: !0 }), e.ADDRESS_BOUNDARY = void 0, e.groupPossibilities = a, e.padGroup = o, e.simpleRegularExpression = s, e.possibleElisions = c;
-	var i = r(re());
+	var i = r(fe());
 	function a(e) {
 		return `(${e.join("|")})`;
 	}
@@ -285,7 +289,7 @@ var j = (e, t) => () => (t || (e((t = { exports: {} }).exports, t), e = null), t
 		for (let t = 1; t < e - 1; t++) for (let n = 1; n < e - t; n++) o.push(`(0{1,4}:){${n}}:(0{1,4}:){${e - n - t - 1}}0{1,4}`);
 		return a(o);
 	}
-})), oe = /* @__PURE__ */ j(((e) => {
+})), he = /* @__PURE__ */ j(((e) => {
 	var t = e && e.__createBinding || (Object.create ? (function(e, t, n, r) {
 		r === void 0 && (r = n);
 		var i = Object.getOwnPropertyDescriptor(t, n);
@@ -311,7 +315,7 @@ var j = (e, t) => () => (t || (e((t = { exports: {} }).exports, t), e = null), t
 		return n(r, e), r;
 	};
 	Object.defineProperty(e, "__esModule", { value: !0 }), e.Address6 = void 0;
-	var i = r(M()), a = r(te()), o = r(re()), s = r(ie()), c = ne(), l = ae(), u = N(), d = M();
+	var i = r(M()), a = r(ue()), o = r(fe()), s = r(pe()), c = de(), l = me(), u = N(), d = M();
 	function f(e) {
 		if (!e) throw Error("Assertion failed.");
 	}
@@ -629,7 +633,7 @@ var j = (e, t) => () => (t || (e((t = { exports: {} }).exports, t), e = null), t
 			return new RegExp(this.regularExpressionString(e), "i");
 		}
 	};
-})), se = (/* @__PURE__ */ j(((e) => {
+})), ge = (/* @__PURE__ */ j(((e) => {
 	var t = e && e.__createBinding || (Object.create ? (function(e, t, n, r) {
 		r === void 0 && (r = n);
 		var i = Object.getOwnPropertyDescriptor(t, n);
@@ -655,14 +659,14 @@ var j = (e, t) => () => (t || (e((t = { exports: {} }).exports, t), e = null), t
 		return n(r, e), r;
 	};
 	Object.defineProperty(e, "__esModule", { value: !0 }), e.v6 = e.AddressError = e.Address6 = e.Address4 = void 0;
-	var i = ne();
+	var i = de();
 	Object.defineProperty(e, "Address4", {
 		enumerable: !0,
 		get: function() {
 			return i.Address4;
 		}
 	});
-	var a = oe();
+	var a = he();
 	Object.defineProperty(e, "Address6", {
 		enumerable: !0,
 		get: function() {
@@ -675,17 +679,17 @@ var j = (e, t) => () => (t || (e((t = { exports: {} }).exports, t), e = null), t
 		get: function() {
 			return o.AddressError;
 		}
-	}), e.v6 = { helpers: r(ie()) };
+	}), e.v6 = { helpers: r(pe()) };
 })))();
-function ce(e, t = 56) {
+function _e(e, t = 56) {
 	if (r(e)) {
-		let n = new se.Address6(e);
+		let n = new ge.Address6(e);
 		if (n.is4()) return n.to4().correctForm();
-		if (t) return new se.Address6(`${e}/${t}`).networkForm();
+		if (t) return new ge.Address6(`${e}/${t}`).networkForm();
 	}
 	return e;
 }
-var le = class {
+var ve = class {
 	constructor(e) {
 		this.validations = e, this.previous = /* @__PURE__ */ new Map(), this.current = /* @__PURE__ */ new Map(), this.localKeys = !0;
 	}
@@ -728,14 +732,14 @@ var le = class {
 	clearExpired() {
 		this.previous = this.current, this.current = /* @__PURE__ */ new Map();
 	}
-}, ue = {
+}, ye = {
 	warn(...e) {
 		console.warn(...e.reverse());
 	},
 	error(...e) {
 		console.error(...e.reverse());
 	}
-}, de = [
+}, be = [
 	"draft-6",
 	"draft-7",
 	"draft-8"
@@ -746,30 +750,30 @@ var le = class {
 		n = Math.max(0, e);
 	} else n = Math.ceil(e / 1e3);
 	return n;
-}, fe = (e) => {
+}, xe = (e) => {
 	let t = m("sha256");
 	t.update(e);
 	let n = t.digest("hex").slice(0, 12);
 	return p.from(n).toString("base64");
-}, pe = (e, t) => {
+}, Se = (e, t) => {
 	e.headersSent || (e.setHeader("X-RateLimit-Limit", t.limit.toString()), e.setHeader("X-RateLimit-Remaining", t.remaining.toString()), t.resetTime instanceof Date && (e.setHeader("Date", (/* @__PURE__ */ new Date()).toUTCString()), e.setHeader("X-RateLimit-Reset", Math.ceil(t.resetTime.getTime() / 1e3).toString())));
-}, me = (e, t, n) => {
+}, Ce = (e, t, n) => {
 	if (e.headersSent) return;
 	let r = Math.ceil(n / 1e3), i = P(n, t.resetTime);
 	e.setHeader("RateLimit-Policy", `${t.limit};w=${r}`), e.setHeader("RateLimit-Limit", t.limit.toString()), e.setHeader("RateLimit-Remaining", t.remaining.toString()), typeof i == "number" && e.setHeader("RateLimit-Reset", i.toString());
-}, he = (e, t, n) => {
+}, we = (e, t, n) => {
 	if (e.headersSent) return;
 	let r = Math.ceil(n / 1e3), i = P(n, t.resetTime);
 	e.setHeader("RateLimit-Policy", `${t.limit};w=${r}`), e.setHeader("RateLimit", `limit=${t.limit}, remaining=${t.remaining}, reset=${i}`);
-}, ge = (e, t, n, r, i) => {
+}, Te = (e, t, n, r, i) => {
 	if (e.headersSent) return;
-	let a = Math.ceil(n / 1e3), o = P(n, t.resetTime), s = fe(i), c = `r=${t.remaining}; t=${o}`, l = `q=${t.limit}; w=${a}; pk=:${s}:`;
+	let a = Math.ceil(n / 1e3), o = P(n, t.resetTime), s = xe(i), c = `r=${t.remaining}; t=${o}`, l = `q=${t.limit}; w=${a}; pk=:${s}:`;
 	e.append("RateLimit", `"${r}"; ${c}`), e.append("RateLimit-Policy", `"${r}"; ${l}`);
-}, _e = (e, t, n) => {
+}, Ee = (e, t, n) => {
 	if (e.headersSent) return;
 	let r = P(n, t.resetTime);
 	e.setHeader("Retry-After", r.toString());
-}, ve = (e) => {
+}, De = (e) => {
 	let t = {};
 	for (let n of Object.keys(e)) {
 		let r = n;
@@ -781,7 +785,7 @@ var le = class {
 		let n = `https://express-rate-limit.github.io/${e}/`;
 		super(`${t} See ${n} for more information.`), this.name = this.constructor.name, this.code = e, this.help = n;
 	}
-}, I = class extends F {}, ye = /* @__PURE__ */ new Set(), be = /* @__PURE__ */ new WeakMap(), xe = {
+}, I = class extends F {}, Oe = /* @__PURE__ */ new Set(), ke = /* @__PURE__ */ new WeakMap(), Ae = {
 	enabled: { default: !0 },
 	disable() {
 		for (let e of Object.keys(this.enabled)) this.enabled[e] = !1;
@@ -803,15 +807,15 @@ var le = class {
 		if (typeof e != "number" || e < 1 || e !== Math.round(e)) throw new F("ERR_ERL_INVALID_HITS", `The totalHits value returned from the store must be a positive integer, got ${e}`);
 	},
 	unsharedStore(e) {
-		if (ye.has(e)) {
+		if (Oe.has(e)) {
 			let t = e?.localKeys ? "" : " (with a unique prefix)";
 			throw new F("ERR_ERL_STORE_REUSE", `A Store instance must not be shared across multiple rate limiters. Create a new instance of ${e.constructor.name}${t} for each limiter instead.`);
 		}
-		ye.add(e);
+		Oe.add(e);
 	},
 	singleCount(e, t, n) {
-		let r = be.get(e);
-		r || (r = /* @__PURE__ */ new Map(), be.set(e, r));
+		let r = ke.get(e);
+		r || (r = /* @__PURE__ */ new Map(), ke.set(e, r));
 		let i = t.localKeys ? t : t.constructor.name, a = r.get(i);
 		a || (a = [], r.set(i, a));
 		let o = `${t.prefix ?? ""}${n}`;
@@ -828,7 +832,7 @@ var le = class {
 		if (e) throw new I("WRN_ERL_DEPRECATED_ON_LIMIT_REACHED", "The onLimitReached configuration option is deprecated and has been removed in express-rate-limit v7.");
 	},
 	headersDraftVersion(e) {
-		if (typeof e != "string" || !de.includes(e)) throw new F("ERR_ERL_HEADERS_UNSUPPORTED_DRAFT_VERSION", `standardHeaders: only the following versions of the IETF draft specification are supported: ${de.join(", ")}.`);
+		if (typeof e != "string" || !be.includes(e)) throw new F("ERR_ERL_HEADERS_UNSUPPORTED_DRAFT_VERSION", `standardHeaders: only the following versions of the IETF draft specification are supported: ${be.join(", ")}.`);
 	},
 	headersResetTime(e) {
 		if (!e) throw new F("ERR_ERL_HEADERS_NO_RESET", "standardHeaders:  'draft-7' requires a 'resetTime', but the store did not provide one. The 'windowMs' value will be used instead, which may cause clients to wait longer than necessary.");
@@ -885,18 +889,18 @@ var le = class {
 		if (typeof e != "number" || Number.isNaN(e) || e < 1 || e > t) throw new F("ERR_ERL_WINDOW_MS", `Invalid windowMs value: ${e}${typeof e == "number" ? "" : ` (${typeof e})`}, must be a number between 1 and ${t} when using the default MemoryStore`);
 	}
 };
-function Se(e) {
+function je(e) {
 	if (typeof e != "object" || typeof e.error != "function" || typeof e.warn != "function") throw TypeError("Provided logger does not implement the Logger interface");
 }
-var Ce = (e, t) => {
-	Se(t);
+var Me = (e, t) => {
+	je(t);
 	let n;
 	n = typeof e == "boolean" ? { default: e } : {
 		default: !0,
 		...e
 	};
 	let r = { enabled: n };
-	for (let [e, i] of Object.entries(xe)) typeof i == "function" && (r[e] = (...a) => {
+	for (let [e, i] of Object.entries(Ae)) typeof i == "function" && (r[e] = (...a) => {
 		if (n[e] ?? n.default) try {
 			i.apply(r, a);
 		} catch (e) {
@@ -904,8 +908,8 @@ var Ce = (e, t) => {
 		}
 	});
 	return r;
-}, we = (e) => typeof e.incr == "function" && typeof e.increment != "function", Te = (e) => {
-	if (!we(e)) return e;
+}, Ne = (e) => typeof e.incr == "function" && typeof e.increment != "function", Pe = (e) => {
+	if (!Ne(e)) return e;
 	let t = e;
 	class n {
 		async increment(e) {
@@ -930,14 +934,14 @@ var Ce = (e, t) => {
 		}
 	}
 	return new n();
-}, Ee = (e) => {
+}, Fe = (e) => {
 	let { validations: t, ...n } = e;
 	return {
 		...n,
 		validate: t.enabled
 	};
-}, De = (e) => {
-	let t = ve(e), n = e.logger ?? ue, i = Ce(t?.validate ?? !0, n);
+}, Ie = (e) => {
+	let t = De(e), n = e.logger ?? ye, i = Me(t?.validate ?? !0, n);
 	i.validationsConfig(), i.knownOptions(e), i.draftPolliHeaders(t.draft_polli_ratelimit_headers), i.onLimitReached(t.onLimitReached), t.ipv6Subnet !== void 0 && typeof t.ipv6Subnet != "function" && i.ipv6Subnet(t.ipv6Subnet), i.keyGeneratorIpFallback(t.keyGenerator), i.ipv6SubnetOrKeyGenerator(t);
 	let a = t.standardHeaders ?? !1;
 	a === !0 && (a = "draft-6");
@@ -959,7 +963,7 @@ var Ce = (e, t) => {
 		async keyGenerator(e, t) {
 			i.ip(e.ip), i.trustProxy(e), i.xForwardedForHeader(e), i.forwardedHeader(e);
 			let n = e.ip, a = 56;
-			return r(n) && (a = typeof o.ipv6Subnet == "function" ? await o.ipv6Subnet(e, t) : o.ipv6Subnet, typeof o.ipv6Subnet == "function" && i.ipv6Subnet(a)), ce(n, a);
+			return r(n) && (a = typeof o.ipv6Subnet == "function" ? await o.ipv6Subnet(e, t) : o.ipv6Subnet, typeof o.ipv6Subnet == "function" && i.ipv6Subnet(a)), _e(n, a);
 		},
 		ipv6Subnet: 56,
 		async handler(e, t, n, r) {
@@ -970,27 +974,27 @@ var Ce = (e, t) => {
 		passOnStoreError: !1,
 		...t,
 		standardHeaders: a,
-		store: Te(t.store ?? new le(i)),
+		store: Pe(t.store ?? new ve(i)),
 		validations: i,
 		logger: n
 	};
 	if (typeof o.store.increment != "function" || typeof o.store.decrement != "function" || typeof o.store.resetKey != "function" || o.store.resetAll !== void 0 && typeof o.store.resetAll != "function" || o.store.init !== void 0 && typeof o.store.init != "function") throw TypeError("An invalid store was passed. Please ensure that the store is a class that implements the `Store` interface.");
 	return o;
-}, Oe = (e) => async (t, n, r) => {
+}, Le = (e) => async (t, n, r) => {
 	try {
 		await Promise.resolve(e(t, n, r)).catch(r);
 	} catch (e) {
 		r(e);
 	}
-}, ke = (e) => {
-	let t = De(e ?? {}), n = Ee(t);
+}, Re = (e) => {
+	let t = Ie(e ?? {}), n = Fe(t);
 	if (t.validations.creationStack(t.store), t.validations.unsharedStore(t.store), typeof t.store.init == "function") try {
 		let e = t.store.init(n);
 		e instanceof Promise && e.catch((e) => t.logger.error(e, "express-rate-limit: async error during store initialization."));
 	} catch (e) {
 		t.logger.error(e, "express-rate-limit: error during store initialization.");
 	}
-	let r = Oe(async (e, r, i) => {
+	let r = Le(async (e, r, i) => {
 		let a = t.skipFailedRequests && new Promise((e) => r.once("close", e)), o = (t.skipFailedRequests || t.skipSuccessfulRequests) && new Promise((e) => r.once("finish", e)), s = t.skipFailedRequests && new Promise((e) => r.once("error", e));
 		if (await t.skip(e, r)) {
 			i();
@@ -1021,16 +1025,16 @@ var Ce = (e, t) => {
 			configurable: !1,
 			enumerable: !1,
 			value: u
-		}), c[t.requestPropertyName] = p, t.legacyHeaders && !r.headersSent && pe(r, p), t.standardHeaders && !r.headersSent) switch (t.standardHeaders) {
+		}), c[t.requestPropertyName] = p, t.legacyHeaders && !r.headersSent && Se(r, p), t.standardHeaders && !r.headersSent) switch (t.standardHeaders) {
 			case "draft-6":
-				me(r, p, t.windowMs);
+				Ce(r, p, t.windowMs);
 				break;
 			case "draft-7":
-				t.validations.headersResetTime(p.resetTime), he(r, p, t.windowMs);
+				t.validations.headersResetTime(p.resetTime), we(r, p, t.windowMs);
 				break;
 			case "draft-8": {
 				let n = await (typeof t.identifier == "function" ? t.identifier(e, r) : t.identifier);
-				t.validations.headersResetTime(p.resetTime), ge(r, p, t.windowMs, n, l);
+				t.validations.headersResetTime(p.resetTime), Te(r, p, t.windowMs, n, l);
 				break;
 			}
 			default:
@@ -1052,7 +1056,7 @@ var Ce = (e, t) => {
 			});
 		}
 		if (t.validations.disable(), u > f) {
-			(t.legacyHeaders || t.standardHeaders) && _e(r, p, t.windowMs), t.handler(e, r, i, n);
+			(t.legacyHeaders || t.standardHeaders) && Ee(r, p, t.windowMs), t.handler(e, r, i, n);
 			return;
 		}
 		i();
@@ -1060,7 +1064,7 @@ var Ce = (e, t) => {
 	return r.resetKey = t.store.resetKey.bind(t.store), r.getKey = typeof t.store.get == "function" ? t.store.get.bind(t.store) : () => {
 		throw Error("The current store does not support the get/getKey method");
 	}, r;
-}, Ae = new Set([
+}, ze = new Set([
 	"token",
 	"accesstoken",
 	"refreshtoken",
@@ -1073,11 +1077,11 @@ var Ce = (e, t) => {
 	"password",
 	"secret"
 ]);
-function je(e) {
+function Be(e) {
 	return e.toLowerCase().replace(/[^a-z0-9]/g, "");
 }
 function L(e, t) {
-	for (let e of Object.keys(t)) if (Ae.has(je(e))) throw Error(`OAuth audit event must not carry forbidden field: ${e}`);
+	for (let e of Object.keys(t)) if (ze.has(Be(e))) throw Error(`OAuth audit event must not carry forbidden field: ${e}`);
 	let { now: n, ...r } = t;
 	return {
 		kind: e,
@@ -1085,7 +1089,7 @@ function L(e, t) {
 		...r
 	};
 }
-function Me(e) {
+function Ve(e) {
 	let t = !1;
 	return (n) => {
 		try {
@@ -1095,7 +1099,7 @@ function Me(e) {
 		}
 	};
 }
-function Ne(e = process.stderr) {
+function He(e = process.stderr) {
 	return (t) => {
 		e.write(`${JSON.stringify({
 			source: "codemem-mcp-oauth-audit",
@@ -1103,28 +1107,28 @@ function Ne(e = process.stderr) {
 		})}\n`);
 	};
 }
-function Pe() {
+function Ue() {
 	return () => {};
 }
-function Fe(e = process.env.CODEMEM_MCP_AUDIT) {
+function We(e = process.env.CODEMEM_MCP_AUDIT) {
 	let t = e?.trim().toLowerCase();
-	return t === "0" || t === "false" || t === "no" ? Pe() : Ne();
+	return t === "0" || t === "false" || t === "no" ? Ue() : He();
 }
-var Ie = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github.com/kunickiaj/codemem#readme", Le = "https://claude.ai/api/mcp/auth_callback", Re = new Set([
+var Ge = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github.com/kunickiaj/codemem#readme", Ke = "https://claude.ai/api/mcp/auth_callback", qe = new Set([
 	"localhost",
 	"127.0.0.1",
 	"::1"
-]), ze = new Set(["authorization_code", "refresh_token"]), Be = new Set(["code"]), Ve = 3600, He = 720 * 60 * 60, Ue = 100, We = 100, Ge = 100, B = 32, Ke = 43, qe = /^[A-Za-z0-9_-]{43}$/, Je = /^[A-Za-z0-9_-]{43}$/, Ye = class {
+]), Je = new Set(["authorization_code", "refresh_token"]), Ye = new Set(["code"]), B = 3600, V = 720 * 60 * 60, Xe = 100, Ze = 100, Qe = 100, $e = 32, et = 43, tt = /^[A-Za-z0-9_-]{43}$/, nt = /^[A-Za-z0-9_-]{43}$/, rt = class {
 	#e = /* @__PURE__ */ new Map();
 	getClient(e) {
 		return this.#e.get(e);
 	}
 	registerClient(e) {
-		let t = st(e.redirect_uris);
-		if (t) throw new C(t);
-		if (e.client_secret || e.token_endpoint_auth_method !== "none") throw new C("Only public clients with token_endpoint_auth_method=none are supported");
-		if (e.grant_types && !ct(e.grant_types, ze)) throw new C("Only authorization_code and refresh_token grant_types are supported");
-		if (e.response_types && !ct(e.response_types, Be)) throw new C("Only code response_type is supported");
+		let t = yt(e.redirect_uris);
+		if (t) throw new O(t);
+		if (e.client_secret || e.token_endpoint_auth_method !== "none") throw new O("Only public clients with token_endpoint_auth_method=none are supported");
+		if (e.grant_types && !H(e.grant_types, Je)) throw new O("Only authorization_code and refresh_token grant_types are supported");
+		if (e.response_types && !H(e.response_types, Ye)) throw new O("Only code response_type is supported");
 		if (this.#e.size >= 100) {
 			let e = this.#e.keys().next().value;
 			e && this.#e.delete(e);
@@ -1139,10 +1143,10 @@ var Ie = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github
 		};
 		return this.#e.set(n.client_id, n), n;
 	}
-}, Xe = class {
+}, it = class {
 	#e = /* @__PURE__ */ new Map();
 	issueCode(e, t = Date.now()) {
-		if (this.#t(t), this.#e.size >= Ue) return;
+		if (this.#t(t), this.#e.size >= Xe) return;
 		let n = v();
 		return this.#e.set(n, {
 			...e,
@@ -1160,12 +1164,12 @@ var Ie = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github
 	#t(e) {
 		for (let [t, n] of this.#e) n.expiresAt <= e && this.#e.delete(t);
 	}
-}, Ze = class {
+}, at = class {
 	#e = /* @__PURE__ */ new Map();
 	#t = _(32);
 	issueToken(e, t = Date.now(), n, r, i = []) {
-		if (this.#n(t), this.#e.size >= We) return;
-		let a = _(B), o = G(a, this.#t);
+		if (this.#n(t), this.#e.size >= Ze) return;
+		let a = _($e), o = Tt(a, this.#t);
 		return this.#e.set(o, {
 			clientId: e,
 			grantId: r,
@@ -1173,22 +1177,22 @@ var Ie = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github
 			resource: n,
 			tokenHash: o,
 			issuedAt: t,
-			expiresAt: t + Ve * 1e3,
+			expiresAt: t + B * 1e3,
 			lastUsedAt: null,
 			revokedAt: null
 		}), {
 			token: a.toString("base64url"),
-			expiresIn: Ve
+			expiresIn: B
 		};
 	}
 	verifyToken(e, t = Date.now()) {
-		let n = U(e);
+		let n = W(e);
 		if (!n) return {
 			ok: !1,
 			reason: "unknown_token"
 		};
-		let r = G(n, this.#t), i = this.#e.get(r);
-		return !i || !K(i.tokenHash, r) ? {
+		let r = Tt(n, this.#t), i = this.#e.get(r);
+		return !i || !J(i.tokenHash, r) ? {
 			ok: !1,
 			reason: "unknown_token"
 		} : i.revokedAt === null ? i.expiresAt <= t ? {
@@ -1203,10 +1207,10 @@ var Ie = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github
 		};
 	}
 	revokeToken(e, t = Date.now()) {
-		let n = U(e);
+		let n = W(e);
 		if (!n) return !1;
-		let r = G(n, this.#t), i = this.#e.get(r);
-		return !i || !K(i.tokenHash, r) ? !1 : (i.revokedAt === null && (i.revokedAt = t), !0);
+		let r = Tt(n, this.#t), i = this.#e.get(r);
+		return !i || !J(i.tokenHash, r) ? !1 : (i.revokedAt === null && (i.revokedAt = t), !0);
 	}
 	revokeTokensForGrant(e, t = Date.now()) {
 		let n = 0;
@@ -1216,14 +1220,14 @@ var Ie = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github
 	#n(e) {
 		for (let [t, n] of this.#e) (n.expiresAt <= e || n.revokedAt !== null) && this.#e.delete(t);
 	}
-}, Qe = class {
+}, ot = class {
 	#e = /* @__PURE__ */ new Map();
 	#t = /* @__PURE__ */ new Map();
 	#n = /* @__PURE__ */ new Map();
 	#r = _(32);
 	issueGrant(e, t = Date.now()) {
-		if (this.#i(t), this.#e.size >= Ge) return;
-		let n = mt(), r = W(n, this.#r);
+		if (this.#i(t), this.#e.size >= Qe) return;
+		let n = G(), r = K(n, this.#r);
 		if (!r) return;
 		let i = {
 			grantId: v(),
@@ -1233,7 +1237,7 @@ var Ie = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github
 			currentRefreshTokenHash: r,
 			previousRefreshTokenHash: null,
 			issuedAt: t,
-			expiresAt: t + He * 1e3,
+			expiresAt: t + V * 1e3,
 			rotatedAt: null,
 			revokedAt: null
 		};
@@ -1243,11 +1247,11 @@ var Ie = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github
 				scopes: [...i.scopes]
 			},
 			refreshToken: n,
-			expiresIn: He
+			expiresIn: V
 		};
 	}
 	rotateRefreshToken(e, t, n = {}, r = Date.now()) {
-		let i = W(t, this.#r);
+		let i = K(t, this.#r);
 		if (!i) return {
 			ok: !1,
 			reason: "unknown_refresh_token"
@@ -1277,7 +1281,7 @@ var Ie = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github
 			reason: "client_mismatch",
 			grantId: a
 		};
-		if (!gt(n.scopes ?? o.scopes, o.scopes)) return {
+		if (!Dt(n.scopes ?? o.scopes, o.scopes)) return {
 			ok: !1,
 			reason: "scope_mismatch",
 			grantId: a
@@ -1287,13 +1291,13 @@ var Ie = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github
 			reason: "resource_mismatch",
 			grantId: a
 		};
-		let s = K(o.currentRefreshTokenHash, i), c = o.previousRefreshTokenHash !== null && K(o.previousRefreshTokenHash, i);
+		let s = J(o.currentRefreshTokenHash, i), c = o.previousRefreshTokenHash !== null && J(o.previousRefreshTokenHash, i);
 		if (!s && !c) return this.revokeGrant(a, r), {
 			ok: !1,
 			reason: "refresh_token_replay",
 			grantId: a
 		};
-		let l = mt(), u = W(l, this.#r);
+		let l = G(), u = K(l, this.#r);
 		return u ? (o.scopes = [...n.scopes ?? o.scopes], o.previousRefreshTokenHash = s ? o.currentRefreshTokenHash : null, o.currentRefreshTokenHash = u, o.rotatedAt = r, this.#t.set(u, a), this.#n.get(a)?.add(u), {
 			ok: !0,
 			grant: {
@@ -1308,7 +1312,7 @@ var Ie = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github
 		};
 	}
 	revokeRefreshToken(e, t = Date.now()) {
-		let n = W(e, this.#r);
+		let n = K(e, this.#r);
 		if (!n) return;
 		let r = this.#t.get(n);
 		if (r) return this.revokeGrant(r, t), r;
@@ -1329,24 +1333,279 @@ var Ie = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github
 		}
 		this.#t.delete(e.currentRefreshTokenHash), e.previousRefreshTokenHash && this.#t.delete(e.previousRefreshTokenHash);
 	}
+}, st = class {
+	#e;
+	#t = /* @__PURE__ */ new Map();
+	#n = /* @__PURE__ */ new Map();
+	#r = /* @__PURE__ */ new Map();
+	#i = /* @__PURE__ */ new Map();
+	#a = /* @__PURE__ */ new Map();
+	#o = /* @__PURE__ */ new Map();
+	constructor(e = pt()) {
+		this.#e = e, this.#s();
+	}
+	getClient(e) {
+		return this.#n.get(e);
+	}
+	registerClient(e) {
+		let t = yt(e.redirect_uris);
+		if (t) throw new O(t);
+		if (e.client_secret || e.token_endpoint_auth_method !== "none") throw new O("Only public clients with token_endpoint_auth_method=none are supported");
+		if (e.grant_types && !H(e.grant_types, Je)) throw new O("Only authorization_code and refresh_token grant_types are supported");
+		if (e.response_types && !H(e.response_types, Ye)) throw new O("Only code response_type is supported");
+		if (this.#u(Date.now()), this.#n.size >= 100) {
+			let e = this.#n.keys().next().value;
+			e && this.#n.delete(e);
+		}
+		let n = {
+			...e,
+			token_endpoint_auth_method: "none",
+			grant_types: e.grant_types ?? ["authorization_code", "refresh_token"],
+			response_types: e.response_types ?? ["code"],
+			client_id: v(),
+			client_id_issued_at: Math.floor(Date.now() / 1e3)
+		};
+		return this.#n.set(n.client_id, n), this.#c(), n;
+	}
+	issueCode(e, t = Date.now()) {
+		if (this.#l(t), this.#t.size >= Xe) return;
+		let n = v();
+		return this.#t.set(n, {
+			...e,
+			used: !1
+		}), n;
+	}
+	peekCode(e) {
+		let t = this.#t.get(e);
+		if (!(!t || t.used)) return t;
+	}
+	consumeCode(e) {
+		let t = this.#t.get(e);
+		if (!(!t || t.used)) return t.used = !0, t;
+	}
+	issueToken(e, t = Date.now(), n, r, i = []) {
+		if (this.#u(t), this.#r.size >= Ze) return;
+		let a = G(), o = q(a);
+		if (o) return this.#r.set(o, {
+			clientId: e,
+			grantId: r,
+			scopes: [...i],
+			resource: n,
+			tokenHash: o,
+			issuedAt: t,
+			expiresAt: t + B * 1e3,
+			lastUsedAt: null,
+			revokedAt: null
+		}), this.#c(), {
+			token: a,
+			expiresIn: B
+		};
+	}
+	verifyToken(e, t = Date.now()) {
+		let n = q(e);
+		if (!n) return {
+			ok: !1,
+			reason: "unknown_token"
+		};
+		let r = this.#r.get(n);
+		return !r || !J(r.tokenHash, n) ? {
+			ok: !1,
+			reason: "unknown_token"
+		} : r.revokedAt === null ? r.expiresAt <= t ? {
+			ok: !1,
+			reason: "expired_token"
+		} : (r.lastUsedAt = t, {
+			ok: !0,
+			record: {
+				...r,
+				scopes: [...r.scopes]
+			}
+		}) : {
+			ok: !1,
+			reason: "revoked_token"
+		};
+	}
+	revokeToken(e, t = Date.now()) {
+		let n = q(e);
+		if (!n) return !1;
+		let r = this.#r.get(n);
+		return !r || !J(r.tokenHash, n) ? !1 : r.revokedAt === null ? (r.revokedAt = t, this.#c(), !0) : !0;
+	}
+	revokeTokensForGrant(e, t = Date.now()) {
+		let n = 0;
+		for (let r of this.#r.values()) r.grantId !== e || r.revokedAt !== null || (r.revokedAt = t, n += 1);
+		return n > 0 && this.#c(), n;
+	}
+	issueGrant(e, t = Date.now()) {
+		if (this.#u(t), this.#i.size >= Qe) return;
+		let n = G(), r = q(n);
+		if (!r) return;
+		let i = {
+			grantId: v(),
+			clientId: e.clientId,
+			scopes: [...e.scopes ?? []],
+			resource: e.resource,
+			currentRefreshTokenHash: r,
+			previousRefreshTokenHash: null,
+			issuedAt: t,
+			expiresAt: t + V * 1e3,
+			rotatedAt: null,
+			revokedAt: null
+		};
+		return this.#i.set(i.grantId, i), this.#a.set(r, i.grantId), this.#o.set(i.grantId, new Set([r])), this.#c(), {
+			grant: {
+				...i,
+				scopes: [...i.scopes]
+			},
+			refreshToken: n,
+			expiresIn: V
+		};
+	}
+	rotateRefreshToken(e, t, n = {}, r = Date.now()) {
+		let i = q(t);
+		if (!i) return {
+			ok: !1,
+			reason: "unknown_refresh_token"
+		};
+		let a = this.#a.get(i);
+		if (!a) return {
+			ok: !1,
+			reason: "unknown_refresh_token"
+		};
+		let o = this.#i.get(a);
+		if (!o) return {
+			ok: !1,
+			reason: "unknown_refresh_token"
+		};
+		if (o.revokedAt !== null) return {
+			ok: !1,
+			reason: "revoked_refresh_token",
+			grantId: a
+		};
+		if (o.expiresAt <= r) return this.revokeGrant(a, r), {
+			ok: !1,
+			reason: "expired_refresh_token",
+			grantId: a
+		};
+		if (o.clientId !== e) return {
+			ok: !1,
+			reason: "client_mismatch",
+			grantId: a
+		};
+		if (!Dt(n.scopes ?? o.scopes, o.scopes)) return {
+			ok: !1,
+			reason: "scope_mismatch",
+			grantId: a
+		};
+		if ((o.resource ?? null) !== (n.resource ?? o.resource ?? null)) return {
+			ok: !1,
+			reason: "resource_mismatch",
+			grantId: a
+		};
+		let s = J(o.currentRefreshTokenHash, i), c = o.previousRefreshTokenHash !== null && J(o.previousRefreshTokenHash, i);
+		if (!s && !c) return this.revokeGrant(a, r), {
+			ok: !1,
+			reason: "refresh_token_replay",
+			grantId: a
+		};
+		let l = G(), u = q(l);
+		return u ? (o.scopes = [...n.scopes ?? o.scopes], o.previousRefreshTokenHash = s ? o.currentRefreshTokenHash : null, o.currentRefreshTokenHash = u, o.rotatedAt = r, this.#a.set(u, a), this.#o.get(a)?.add(u), this.#c(), {
+			ok: !0,
+			grant: {
+				...o,
+				scopes: [...o.scopes]
+			},
+			refreshToken: l,
+			expiresIn: Math.max(0, Math.floor((o.expiresAt - r) / 1e3))
+		}) : {
+			ok: !1,
+			reason: "unknown_refresh_token"
+		};
+	}
+	revokeRefreshToken(e, t = Date.now()) {
+		let n = q(e);
+		if (!n) return;
+		let r = this.#a.get(n);
+		if (r) return this.revokeGrant(r, t), r;
+	}
+	revokeGrant(e, t = Date.now()) {
+		let n = this.#i.get(e);
+		return n ? n.revokedAt === null ? (n.revokedAt = t, this.#d(n), this.#c(), !0) : !0 : !1;
+	}
+	#s() {
+		if (!ee(this.#e)) return;
+		let e;
+		try {
+			e = JSON.parse(S(this.#e, "utf8"));
+		} catch {
+			return;
+		}
+		if (e.version === 1) {
+			this.#n = new Map(e.clients.map((e) => [e.client_id, e])), this.#r = new Map(e.accessTokens.map((e) => [e.tokenHash, e])), this.#i = new Map(e.refreshGrants.map((e) => [e.grantId, e])), this.#a = /* @__PURE__ */ new Map(), this.#o = /* @__PURE__ */ new Map();
+			for (let t of this.#i.values()) {
+				let n = new Set(e.refreshHashesByGrantId[t.grantId] ?? []);
+				n.add(t.currentRefreshTokenHash), t.previousRefreshTokenHash && n.add(t.previousRefreshTokenHash), this.#o.set(t.grantId, n);
+				for (let e of n) this.#a.set(e, t.grantId);
+			}
+			this.#u(Date.now());
+		}
+	}
+	#c() {
+		x(E(this.#e), {
+			recursive: !0,
+			mode: 448
+		});
+		let e = {
+			version: 1,
+			clients: [...this.#n.values()],
+			accessTokens: [...this.#r.values()],
+			refreshGrants: [...this.#i.values()],
+			refreshHashesByGrantId: Object.fromEntries([...this.#o.entries()].map(([e, t]) => [e, [...t]]))
+		}, t = `${this.#e}.${process.pid}.${Date.now()}.tmp`;
+		C(t, `${JSON.stringify(e, null, 2)}\n`, { mode: 384 }), te(t, this.#e), w(this.#e, 384).catch(() => void 0);
+	}
+	#l(e) {
+		for (let [t, n] of this.#t) n.expiresAt <= e && this.#t.delete(t);
+	}
+	#u(e) {
+		let t = !1;
+		for (let [n, r] of this.#r) r.expiresAt > e && r.revokedAt === null || (this.#r.delete(n), t = !0);
+		for (let [n, r] of this.#i) r.expiresAt > e && r.revokedAt === null || (this.#i.delete(n), this.#d(r), t = !0);
+		t && this.#c();
+	}
+	#d(e) {
+		let t = this.#o.get(e.grantId);
+		if (t) {
+			for (let e of t) this.#a.delete(e);
+			this.#o.delete(e.grantId);
+			return;
+		}
+		this.#a.delete(e.currentRefreshTokenHash), e.previousRefreshTokenHash && this.#a.delete(e.previousRefreshTokenHash);
+	}
 };
-function $e() {
-	return new Ye();
+function ct() {
+	return new rt();
 }
-function et() {
-	return new Xe();
+function lt() {
+	return new it();
 }
-function tt() {
-	return new Ze();
+function ut() {
+	return new at();
+}
+function dt() {
+	return new ot();
+}
+function ft(e) {
+	return new st(e);
 }
-function nt() {
-	return new Qe();
+function pt() {
+	return D(process.env.HOME?.trim() || T(), ".codemem", "mcp-oauth-state.json");
 }
-function rt(e) {
-	let t = ot(V(e.mcpUrl));
+function mt(e) {
+	let t = vt(_t(e.mcpUrl));
 	return {
 		...c({
-			provider: _t(e.clientsStore),
+			provider: Ot(e.clientsStore),
 			issuerUrl: t,
 			baseUrl: t
 		}),
@@ -1359,23 +1618,23 @@ function rt(e) {
 		client_id_metadata_document_supported: !1
 	};
 }
-function it(e) {
-	let t = V(e), n = {
+function ht(e) {
+	let t = _t(e), n = {
 		resource: t.href,
-		authorization_servers: [ot(t).href],
+		authorization_servers: [vt(t).href],
 		scopes_supported: R,
 		bearer_methods_supported: ["header"],
-		resource_name: Ie,
+		resource_name: Ge,
 		resource_documentation: z
 	};
-	return ee.parse(n);
-}
-function at(e, t) {
-	let n = e.get("client_id") ?? "", r = e.get("redirect_uri") ?? "", i = e.get("response_type") ?? "", a = e.get("code_challenge") ?? "", o = e.get("code_challenge_method") ?? "", s = e.get("resource"), c = ft(e.get("scope")), l = e.get("state");
-	if (i !== "code") return H("unsupported_response_type");
-	if (o !== "S256") return H("invalid_request", "PKCE code_challenge_method=S256 is required");
-	if (!Je.test(a)) return H("invalid_request", "Valid PKCE S256 code_challenge is required");
-	let u = pt(t, n);
+	return ce.parse(n);
+}
+function gt(e, t) {
+	let n = e.get("client_id") ?? "", r = e.get("redirect_uri") ?? "", i = e.get("response_type") ?? "", a = e.get("code_challenge") ?? "", o = e.get("code_challenge_method") ?? "", s = e.get("resource"), c = Ct(e.get("scope")), l = e.get("state");
+	if (i !== "code") return U("unsupported_response_type");
+	if (o !== "S256") return U("invalid_request", "PKCE code_challenge_method=S256 is required");
+	if (!nt.test(a)) return U("invalid_request", "Valid PKCE S256 code_challenge is required");
+	let u = wt(t, n);
 	return u ? u.redirect_uris.includes(r) ? {
 		clientId: n,
 		redirectUri: r,
@@ -1383,48 +1642,48 @@ function at(e, t) {
 		scopes: c,
 		resource: s,
 		state: l
-	} : H("invalid_request", "redirect_uri is not registered for this client") : H("invalid_client", "Unknown OAuth client_id");
+	} : U("invalid_request", "redirect_uri is not registered for this client") : U("invalid_client", "Unknown OAuth client_id");
 }
-function V(e) {
+function _t(e) {
 	let t;
 	try {
 		t = new URL(e);
 	} catch {
 		throw Error("Invalid MCP HTTP public URL; expected an HTTPS /mcp URL");
 	}
-	if (t.protocol !== "https:" && !ut(t)) throw Error("Invalid MCP HTTP public URL; use HTTPS for non-loopback URLs");
+	if (t.protocol !== "https:" && !xt(t)) throw Error("Invalid MCP HTTP public URL; use HTTPS for non-loopback URLs");
 	if (t.username || t.password || t.search || t.hash) throw Error("Invalid MCP HTTP public URL; credentials, query strings, and fragments are not allowed");
 	if (t.pathname === "/" && (t.pathname = "/mcp"), t.pathname !== "/mcp") throw Error("Invalid MCP HTTP public URL; expected /mcp path");
 	return t;
 }
-function ot(e) {
+function vt(e) {
 	return new URL(e.origin);
 }
-function st(e) {
+function yt(e) {
 	for (let t of e) {
 		let e = new URL(t);
 		if (e.username || e.password || e.hash) return `Invalid redirect URI: ${t}`;
-		if (e.href !== Le && !lt(e)) return `Unsupported redirect URI: ${t}`;
+		if (e.href !== Ke && !bt(e)) return `Unsupported redirect URI: ${t}`;
 	}
 	return null;
 }
-function ct(e, t) {
+function H(e, t) {
 	return e.length > 0 && e.every((e) => t.has(e));
 }
-function lt(e) {
-	return e.protocol === "http:" && Re.has(dt(e.hostname)) && e.pathname === "/callback" && e.search === "";
+function bt(e) {
+	return e.protocol === "http:" && qe.has(St(e.hostname)) && e.pathname === "/callback" && e.search === "";
 }
-function ut(e) {
-	let t = dt(e.hostname);
-	return e.protocol === "http:" && Re.has(t);
+function xt(e) {
+	let t = St(e.hostname);
+	return e.protocol === "http:" && qe.has(t);
 }
-function dt(e) {
+function St(e) {
 	return e.replace(/^\[(.*)]$/, "$1").toLowerCase();
 }
-function ft(e) {
+function Ct(e) {
 	return e?.split(/\s+/).map((e) => e.trim()).filter(Boolean) ?? [];
 }
-function H(e, t) {
+function U(e, t) {
 	return {
 		status: 400,
 		body: t ? {
@@ -1433,38 +1692,42 @@ function H(e, t) {
 		} : { error: e }
 	};
 }
-function pt(e, t) {
+function wt(e, t) {
 	let n = e.getClient(t);
 	if (n instanceof Promise) throw Error("Asynchronous OAuth client stores are not supported by this HTTP bootstrap yet");
 	return n;
 }
-function U(e) {
-	if (typeof e != "string" || e.length !== Ke || !qe.test(e)) return null;
+function W(e) {
+	if (typeof e != "string" || e.length !== et || !tt.test(e)) return null;
 	let t = Buffer.from(e, "base64url");
-	return t.length === B ? t : null;
+	return t.length === $e ? t : null;
 }
-function mt() {
-	return _(B).toString("base64url");
+function G() {
+	return _($e).toString("base64url");
 }
-function W(e, t) {
-	let n = U(e);
-	return n ? ht(n, t) : null;
+function K(e, t) {
+	let n = W(e);
+	return n ? Et(n, t) : null;
+}
+function q(e) {
+	let t = W(e);
+	return t ? m("sha256").update(t).digest("base64url") : null;
 }
-function G(e, t) {
-	return ht(e, t);
+function Tt(e, t) {
+	return Et(e, t);
 }
-function ht(e, t) {
+function Et(e, t) {
 	return h("sha256", t).update(e).digest("base64url");
 }
-function K(e, t) {
+function J(e, t) {
 	let n = Buffer.from(e), r = Buffer.from(t);
 	return n.length === r.length && y(n, r);
 }
-function gt(e, t) {
+function Dt(e, t) {
 	let n = new Set(t);
 	return e.every((e) => n.has(e));
 }
-function _t(e) {
+function Ot(e) {
 	return {
 		clientsStore: e,
 		async authorize() {
@@ -1486,14 +1749,14 @@ function _t(e) {
 }
 //#endregion
 //#region src/oidc.ts
-var vt = "CODEMEM_MCP_OIDC_ISSUER_URL", yt = "CODEMEM_MCP_OIDC_CLIENT_ID", bt = "CODEMEM_MCP_OIDC_CLIENT_SECRET", xt = "CODEMEM_MCP_OAUTH_ALLOWED_SUBJECT", St = "CODEMEM_MCP_OAUTH_ALLOWED_EMAIL", Ct = 300 * 1e3, wt = 100, Tt = 300 * 1e3, Et = class {
+var kt = "CODEMEM_MCP_OIDC_ISSUER_URL", At = "CODEMEM_MCP_OIDC_CLIENT_ID", jt = "CODEMEM_MCP_OIDC_CLIENT_SECRET", Mt = "CODEMEM_MCP_OAUTH_ALLOWED_SUBJECT", Nt = "CODEMEM_MCP_OAUTH_ALLOWED_EMAIL", Pt = 300 * 1e3, Ft = 100, It = 300 * 1e3, Lt = class {
 	#e = /* @__PURE__ */ new Map();
 	issue(e, t = Date.now()) {
-		if (this.#t(t), this.#e.size >= wt) return;
+		if (this.#t(t), this.#e.size >= Ft) return;
 		let n = v();
 		return this.#e.set(n, {
 			...e,
-			expiresAt: t + Ct
+			expiresAt: t + Pt
 		}), n;
 	}
 	consume(e) {
@@ -1504,14 +1767,14 @@ var vt = "CODEMEM_MCP_OIDC_ISSUER_URL", yt = "CODEMEM_MCP_OIDC_CLIENT_ID", bt =
 		for (let [t, n] of this.#e) n.expiresAt <= e && this.#e.delete(t);
 	}
 };
-function Dt() {
-	return new Et();
+function Rt() {
+	return new Lt();
 }
-function Ot(e = process.env) {
-	let t = e[vt]?.trim(), n = e[yt]?.trim(), r = e[bt]?.trim(), i = e[xt]?.trim(), a = e[St]?.trim().toLowerCase();
+function zt(e = process.env) {
+	let t = e[kt]?.trim(), n = e[At]?.trim(), r = e[jt]?.trim(), i = e[Mt]?.trim(), a = e[Nt]?.trim().toLowerCase();
 	if (!(!t && !n && !r && !i && !a)) {
 		if (!t || !n || !r) throw Error("Incomplete MCP OIDC configuration");
-		if (q(t, "issuer", { allowLoopbackHttp: !0 }), !i && !a) throw Error("MCP OIDC requires CODEMEM_MCP_OAUTH_ALLOWED_SUBJECT or CODEMEM_MCP_OAUTH_ALLOWED_EMAIL");
+		if (Y(t, "issuer", { allowLoopbackHttp: !0 }), !i && !a) throw Error("MCP OIDC requires CODEMEM_MCP_OAUTH_ALLOWED_SUBJECT or CODEMEM_MCP_OAUTH_ALLOWED_EMAIL");
 		return {
 			issuerUrl: t,
 			clientId: n,
@@ -1521,39 +1784,39 @@ function Ot(e = process.env) {
 		};
 	}
 }
-async function kt(e, t, n, r, i, a = Date.now()) {
-	if (!r) return J("temporarily_unavailable", "OIDC is not configured");
-	let o = at(e, t);
+async function Bt(e, t, n, r, i, a = Date.now()) {
+	if (!r) return X("temporarily_unavailable", "OIDC is not configured");
+	let o = gt(e, t);
 	if ("status" in o) return o;
-	let s = await Mt(r.issuerUrl), c = v(), l = n.issue({
+	let s = await Ut(r.issuerUrl), c = v(), l = n.issue({
 		oauthParams: e.toString(),
 		nonce: c
 	}, a);
-	if (!l) return J("temporarily_unavailable", "Too many pending OIDC authorizations");
-	let u = jt(i), d = new URL(s.authorization_endpoint);
+	if (!l) return X("temporarily_unavailable", "Too many pending OIDC authorizations");
+	let u = Ht(i), d = new URL(s.authorization_endpoint);
 	return d.searchParams.set("response_type", "code"), d.searchParams.set("client_id", r.clientId), d.searchParams.set("redirect_uri", u), d.searchParams.set("scope", "openid email"), d.searchParams.set("state", l), d.searchParams.set("nonce", c), {
 		status: 302,
 		location: d.href
 	};
 }
-async function At(e, t, n, r, i = Date.now()) {
+async function Vt(e, t, n, r, i = Date.now()) {
 	try {
 		let a = e.get("code") ?? "", o = e.get("state") ?? "";
-		if (!o) return J("invalid_request", "Missing OIDC state");
+		if (!o) return X("invalid_request", "Missing OIDC state");
 		let s = t.consume(o);
-		if (!s || s.expiresAt <= i) return J("invalid_request", "Expired or unknown OIDC state");
-		if (!a) return J("invalid_request", "Missing OIDC code");
-		let c = await Mt(n.issuerUrl), l = await Nt(c.token_endpoint, n, jt(r), a);
-		return l.id_token ? Rt(await Pt(l.id_token, c, n.clientId, s.nonce, i), n) ? { oauthParams: new URLSearchParams(s.oauthParams) } : J("access_denied", "OIDC identity is not allowed") : J("invalid_request", "OIDC token exchange failed");
+		if (!s || s.expiresAt <= i) return X("invalid_request", "Expired or unknown OIDC state");
+		if (!a) return X("invalid_request", "Missing OIDC code");
+		let c = await Ut(n.issuerUrl), l = await Wt(c.token_endpoint, n, Ht(r), a);
+		return l.id_token ? Yt(await Gt(l.id_token, c, n.clientId, s.nonce, i), n) ? { oauthParams: new URLSearchParams(s.oauthParams) } : X("access_denied", "OIDC identity is not allowed") : X("invalid_request", "OIDC token exchange failed");
 	} catch {
-		return J("access_denied", "OIDC identity verification failed");
+		return X("access_denied", "OIDC identity verification failed");
 	}
 }
-function jt(e) {
+function Ht(e) {
 	let t = new URL(e);
 	return new URL("/oauth/callback", t.origin).href;
 }
-async function Mt(e) {
+async function Ut(e) {
 	let t = new URL(e);
 	if (t.search || t.hash) throw Error("OIDC issuer must not include query or fragment");
 	if (t.username || t.password) throw Error("OIDC issuer must not include credentials");
@@ -1562,10 +1825,10 @@ async function Mt(e) {
 	let i = await r.json();
 	if (i.issuer !== t.href && i.issuer !== t.href.replace(/\/$/, "")) throw Error("OIDC discovery issuer mismatch");
 	if (!i.authorization_endpoint || !i.token_endpoint || !i.jwks_uri) throw Error("OIDC discovery metadata is incomplete");
-	let a = t.protocol === "http:" && zt(t.hostname);
-	return q(i.authorization_endpoint, "authorization endpoint", { allowLoopbackHttp: a }), q(i.token_endpoint, "token endpoint", { allowLoopbackHttp: a }), q(i.jwks_uri, "JWKS URI", { allowLoopbackHttp: a }), i;
+	let a = t.protocol === "http:" && Xt(t.hostname);
+	return Y(i.authorization_endpoint, "authorization endpoint", { allowLoopbackHttp: a }), Y(i.token_endpoint, "token endpoint", { allowLoopbackHttp: a }), Y(i.jwks_uri, "JWKS URI", { allowLoopbackHttp: a }), i;
 }
-async function Nt(e, t, n, r) {
+async function Wt(e, t, n, r) {
 	let i = new URLSearchParams({
 		grant_type: "authorization_code",
 		code: r,
@@ -1580,17 +1843,17 @@ async function Nt(e, t, n, r) {
 	if (!a.ok) throw Error("OIDC token request failed");
 	return await a.json();
 }
-async function Pt(e, t, n, r, i) {
+async function Gt(e, t, n, r, i) {
 	let [a, o, s] = e.split(".");
 	if (!a || !o || !s) throw Error("Invalid OIDC id_token");
-	let c = Ft(a), l = Ft(o);
+	let c = Kt(a), l = Kt(o);
 	if (c.alg !== "RS256" || !c.kid) throw Error("Unsupported OIDC id_token signature");
 	if (l.iss !== t.issuer) throw Error("OIDC id_token issuer mismatch");
-	if (!It(l.aud, n)) throw Error("OIDC id_token audience mismatch");
-	if (!Lt(l.aud, l.azp, n)) throw Error("OIDC id_token authorized party mismatch");
+	if (!qt(l.aud, n)) throw Error("OIDC id_token audience mismatch");
+	if (!Jt(l.aud, l.azp, n)) throw Error("OIDC id_token authorized party mismatch");
 	if (typeof l.exp != "number" || !Number.isFinite(l.exp) || l.exp * 1e3 <= i) throw Error("OIDC id_token is expired");
 	if (typeof l.iat != "number" || !Number.isFinite(l.iat)) throw Error("OIDC id_token issued-at time is missing");
-	if (l.iat * 1e3 > i + Tt) throw Error("OIDC id_token issued-at time is in the future");
+	if (l.iat * 1e3 > i + It) throw Error("OIDC id_token issued-at time is in the future");
 	if (l.nonce !== r) throw Error("OIDC id_token nonce mismatch");
 	if (!l.sub) throw Error("OIDC id_token subject is missing");
 	let u = await fetch(t.jwks_uri);
@@ -1604,28 +1867,28 @@ async function Pt(e, t, n, r, i) {
 	if (!b("RSA-SHA256", Buffer.from(p), f, Buffer.from(s, "base64url"))) throw Error("OIDC id_token signature verification failed");
 	return l;
 }
-function Ft(e) {
+function Kt(e) {
 	return JSON.parse(Buffer.from(e, "base64url").toString("utf8"));
 }
-function It(e, t) {
+function qt(e, t) {
 	return Array.isArray(e) ? e.includes(t) : e === t;
 }
-function Lt(e, t, n) {
+function Jt(e, t, n) {
 	return t && t !== n ? !1 : !Array.isArray(e) || e.length <= 1 || t === n;
 }
-function Rt(e, t) {
+function Yt(e, t) {
 	return t.allowedSubject && e.sub === t.allowedSubject ? !0 : t.allowedEmail ? e.email_verified === !0 && e.email?.toLowerCase() === t.allowedEmail : !1;
 }
-function q(e, t, n = {}) {
+function Y(e, t, n = {}) {
 	let r = new URL(e);
 	if (r.username || r.password) throw Error(`OIDC ${t} must not include credentials`);
-	if (r.protocol !== "https:" && !(n.allowLoopbackHttp && r.protocol === "http:" && zt(r.hostname))) throw Error(`OIDC ${t} must use HTTPS`);
+	if (r.protocol !== "https:" && !(n.allowLoopbackHttp && r.protocol === "http:" && Xt(r.hostname))) throw Error(`OIDC ${t} must use HTTPS`);
 }
-function zt(e) {
+function Xt(e) {
 	let t = e.replace(/^\[(.*)]$/, "$1").toLowerCase();
 	return t === "localhost" || t === "127.0.0.1" || t === "::1";
 }
-function J(e, t) {
+function X(e, t) {
 	return {
 		status: 400,
 		body: t ? {
@@ -1636,7 +1899,7 @@ function J(e, t) {
 }
 //#endregion
 //#region src/provider.ts
-var Bt = class {
+var Zt = class {
 	#e;
 	#t;
 	#n;
@@ -1646,44 +1909,44 @@ var Bt = class {
 	#o;
 	#s;
 	constructor(e) {
-		this.#e = e.clientsStore, this.#t = e.codeStore, this.#n = e.tokenStore, this.#r = e.refreshTokenStore ?? nt(), this.#i = e.publicMcpUrl, this.#a = new URL(e.publicMcpUrl).href, this.#o = e.oidc, this.#s = e.now ?? Date.now;
+		this.#e = e.clientsStore, this.#t = e.codeStore, this.#n = e.tokenStore, this.#r = e.refreshTokenStore ?? dt(), this.#i = e.publicMcpUrl, this.#a = new URL(e.publicMcpUrl).href, this.#o = e.oidc, this.#s = e.now ?? Date.now;
 	}
 	get clientsStore() {
 		return this.#e;
 	}
 	async authorize(e, t, n) {
-		if (!this.#o) throw new O("OIDC is not configured");
-		let r = await kt(Vt(e, t), this.#e, this.#o.pendingStore, this.#o.config, this.#i, this.#s());
+		if (!this.#o) throw new A("OIDC is not configured");
+		let r = await Bt(Qt(e, t), this.#e, this.#o.pendingStore, this.#o.config, this.#i, this.#s());
 		if (r.status === 302) {
 			n.redirect(302, r.location);
 			return;
 		}
-		throw Ht(r.body);
+		throw $t(r.body);
 	}
 	async challengeForAuthorizationCode(e, t) {
 		let n = this.#t.peekCode(t);
-		if (!n) throw new w("Invalid or already used code");
-		if (n.clientId !== e.client_id) throw new w("Code does not match client");
-		if (n.expiresAt <= this.#s()) throw this.#t.consumeCode(t), new w("Expired code");
+		if (!n) throw new k("Invalid or already used code");
+		if (n.clientId !== e.client_id) throw new k("Code does not match client");
+		if (n.expiresAt <= this.#s()) throw this.#t.consumeCode(t), new k("Expired code");
 		return n.codeChallenge;
 	}
 	async exchangeAuthorizationCode(e, t, n, r, i) {
 		let a = this.#s(), o = this.#t.peekCode(t);
-		if (!o) throw new w("Invalid or already used code");
-		if (o.expiresAt <= a) throw this.#t.consumeCode(t), new w("Expired code");
-		if (o.clientId !== e.client_id) throw this.#t.consumeCode(t), new w("Code does not match client");
-		if (r === void 0 || o.redirectUri !== r) throw this.#t.consumeCode(t), new w("Code does not match redirect_uri");
-		if ((o.resource ?? null) !== (i?.href ?? null)) throw this.#t.consumeCode(t), new w("Code does not match resource");
-		let s = Wt(o.scopes) ?? [], c = this.#r.issueGrant({
+		if (!o) throw new k("Invalid or already used code");
+		if (o.expiresAt <= a) throw this.#t.consumeCode(t), new k("Expired code");
+		if (o.clientId !== e.client_id) throw this.#t.consumeCode(t), new k("Code does not match client");
+		if (r === void 0 || o.redirectUri !== r) throw this.#t.consumeCode(t), new k("Code does not match redirect_uri");
+		if ((o.resource ?? null) !== (i?.href ?? null)) throw this.#t.consumeCode(t), new k("Code does not match resource");
+		let s = tn(o.scopes) ?? [], c = this.#r.issueGrant({
 			clientId: e.client_id,
 			scopes: s,
 			resource: o.resource
 		}, a);
-		if (!c) throw new O("Too many active refresh grants");
+		if (!c) throw new A("Too many active refresh grants");
 		let l = this.#n.issueToken(e.client_id, a, o.resource, c.grant.grantId, s);
-		if (!l) throw this.#r.revokeGrant(c.grant.grantId, a), new O("Too many active access tokens");
-		if (!this.#t.consumeCode(t)) throw this.#n.revokeToken(l.token, a), this.#r.revokeGrant(c.grant.grantId, a), new w("Authorization code already used");
-		return A.parse({
+		if (!l) throw this.#r.revokeGrant(c.grant.grantId, a), new A("Too many active access tokens");
+		if (!this.#t.consumeCode(t)) throw this.#n.revokeToken(l.token, a), this.#r.revokeGrant(c.grant.grantId, a), new k("Authorization code already used");
+		return le.parse({
 			access_token: l.token,
 			token_type: "Bearer",
 			expires_in: l.expiresIn,
@@ -1692,13 +1955,13 @@ var Bt = class {
 	}
 	async exchangeRefreshToken(e, t, n, r) {
 		let i = this.#s(), a = this.#r.rotateRefreshToken(e.client_id, t, {
-			scopes: Wt(n),
+			scopes: tn(n),
 			...r ? { resource: r.href } : {}
 		}, i);
-		if (!a.ok) throw a.reason === "refresh_token_replay" && a.grantId && this.#n.revokeTokensForGrant?.(a.grantId, i), new w(Ut(a.reason));
+		if (!a.ok) throw a.reason === "refresh_token_replay" && a.grantId && this.#n.revokeTokensForGrant?.(a.grantId, i), new k(en(a.reason));
 		let o = this.#n.issueToken(e.client_id, i, a.grant.resource, a.grant.grantId, a.grant.scopes);
-		if (!o) throw new O("Too many active access tokens");
-		return A.parse({
+		if (!o) throw new A("Too many active access tokens");
+		return le.parse({
 			access_token: o.token,
 			token_type: "Bearer",
 			expires_in: o.expiresIn,
@@ -1707,7 +1970,7 @@ var Bt = class {
 	}
 	async verifyAccessToken(e) {
 		let t = this.#n.verifyToken(e, this.#s());
-		if (!t.ok) throw new E(t.reason === "expired_token" ? "Token has expired" : t.reason === "revoked_token" ? "Token has been revoked" : "Token is invalid");
+		if (!t.ok) throw new ae(t.reason === "expired_token" ? "Token has expired" : t.reason === "revoked_token" ? "Token has been revoked" : "Token is invalid");
 		let n = {
 			token: e,
 			clientId: t.record.clientId,
@@ -1715,7 +1978,7 @@ var Bt = class {
 			expiresAt: Math.floor(t.record.expiresAt / 1e3)
 		};
 		if (t.record.resource) {
-			if (new URL(t.record.resource).href !== this.#a) throw new E("Token audience does not match this resource server");
+			if (new URL(t.record.resource).href !== this.#a) throw new ae("Token audience does not match this resource server");
 			n.resource = new URL(t.record.resource);
 		}
 		return n;
@@ -1727,22 +1990,22 @@ var Bt = class {
 		r && this.#n.revokeTokensForGrant?.(r, n);
 	}
 };
-function Vt(e, t) {
+function Qt(e, t) {
 	let n = new URLSearchParams();
 	return n.set("client_id", e.client_id), n.set("redirect_uri", t.redirectUri), n.set("response_type", "code"), n.set("code_challenge", t.codeChallenge), n.set("code_challenge_method", "S256"), t.state && n.set("state", t.state), t.scopes?.length && n.set("scope", t.scopes.join(" ")), t.resource && n.set("resource", t.resource.href), n;
 }
-function Ht(e) {
+function $t(e) {
 	let t = e.error_description ?? e.error;
 	switch (e.error) {
-		case "temporarily_unavailable": return new O(t);
-		case "invalid_request": return new T(t);
-		case "invalid_client": return new S(t);
-		case "access_denied": return new x(t);
-		case "unsupported_response_type": return new k(t);
-		default: return new D(t);
+		case "temporarily_unavailable": return new A(t);
+		case "invalid_request": return new ie(t);
+		case "invalid_client": return new re(t);
+		case "access_denied": return new ne(t);
+		case "unsupported_response_type": return new se(t);
+		default: return new oe(t);
 	}
 }
-function Ut(e) {
+function en(e) {
 	switch (e) {
 		case "expired_refresh_token": return "Refresh token has expired";
 		case "revoked_refresh_token": return "Refresh token has been revoked";
@@ -1753,49 +2016,49 @@ function Ut(e) {
 		default: return "Invalid refresh token";
 	}
 }
-function Wt(e) {
+function tn(e) {
 	let t = e?.map((e) => e.trim()).filter(Boolean).map((e) => e === "memory:read_access" ? "memory:read" : e === "memory:write_access" ? "memory:write" : e);
 	return t && t.length > 0 ? t : void 0;
 }
 //#endregion
 //#region src/http.ts
-var Gt = "127.0.0.1", Y = 38889, Kt = 80, qt = new Set(["https://claude.ai"]), Jt = "authorization,content-type,mcp-session-id", Yt = "600", Xt = 256, Zt = 900 * 1e3, Qt = 600, $t = /^[a-zA-Z0-9.-]+$/, en = new Set([
+var nn = "127.0.0.1", rn = 38889, an = 80, on = new Set(["https://claude.ai"]), sn = "authorization,content-type,mcp-session-id", cn = "600", ln = 256, un = 900 * 1e3, dn = 600, fn = /^[a-zA-Z0-9.-]+$/, pn = new Set([
 	"127.0.0.1",
 	"::1",
 	"localhost"
 ]);
-function tn(e, t = !1) {
+function mn(e, t = !1) {
 	let r = e?.trim() || "127.0.0.1";
-	if (r.includes("://") || r.includes("/") || r.includes("\\") || !(n(r) || r === "localhost" || $t.test(r))) throw Error(`Invalid MCP HTTP host: ${e}`);
-	if (!t && !X(r)) throw Error(`Refusing unsafe MCP HTTP host ${r}; set CODEMEM_MCP_HTTP_UNSAFE_PUBLIC=1 to allow non-loopback binding`);
+	if (r.includes("://") || r.includes("/") || r.includes("\\") || !(n(r) || r === "localhost" || fn.test(r))) throw Error(`Invalid MCP HTTP host: ${e}`);
+	if (!t && !Z(r)) throw Error(`Refusing unsafe MCP HTTP host ${r}; set CODEMEM_MCP_HTTP_UNSAFE_PUBLIC=1 to allow non-loopback binding`);
 	return r;
 }
-function X(e) {
-	return en.has(Z(e));
+function Z(e) {
+	return pn.has(Q(e));
 }
-function nn(e = process.env.CODEMEM_MCP_HTTP_UNSAFE_PUBLIC) {
+function hn(e = process.env.CODEMEM_MCP_HTTP_UNSAFE_PUBLIC) {
 	return e === "1" || e?.toLowerCase() === "true" || e?.toLowerCase() === "yes";
 }
-function rn(e, t) {
-	let n = Q(e);
-	return !n || !X(n.host) ? !1 : n.port === null ? t === Kt : n.port === t;
+function gn(e, t) {
+	let n = yn(e);
+	return !n || !Z(n.host) ? !1 : n.port === null ? t === an : n.port === t;
 }
-function an(e, t) {
+function _n(e, t) {
 	if (!e) return !0;
 	try {
 		let n = new URL(e), r = n.port ? Number(n.port) : n.protocol === "https:" ? 443 : 80;
-		return (n.protocol === "http:" || n.protocol === "https:") && n.username === "" && n.password === "" && n.pathname === "/" && n.search === "" && n.hash === "" && X(n.hostname) && r === t;
+		return (n.protocol === "http:" || n.protocol === "https:") && n.username === "" && n.password === "" && n.pathname === "/" && n.search === "" && n.hash === "" && Z(n.hostname) && r === t;
 	} catch {
 		return !1;
 	}
 }
-function on(e) {
-	return e ? X(e.replace(/^::ffff:/, "")) : !1;
+function vn(e) {
+	return e ? Z(e.replace(/^::ffff:/, "")) : !1;
 }
-function Z(e) {
+function Q(e) {
 	return e.replace(/^\[(.*)]$/, "$1").toLowerCase();
 }
-function Q(e) {
+function yn(e) {
 	if (!e) return null;
 	if (e.startsWith("[")) {
 		let t = /^\[([^\]]+)]:(\d+)$/.exec(e);
@@ -1820,68 +2083,69 @@ function Q(e) {
 		port: r
 	} : null;
 }
-function sn(e) {
-	if (e === void 0 || e === "") return Y;
+function bn(e) {
+	if (e === void 0 || e === "") return rn;
 	let t = typeof e == "number" ? e : Number(e);
 	if (!Number.isInteger(t) || t < 0 || t > 65535) throw Error(`Invalid MCP HTTP port: ${e}`);
 	return t;
 }
-async function cn(n = {}) {
-	let r = tn(n.host ?? process.env.CODEMEM_MCP_HTTP_HOST, n.allowUnsafePublic ?? nn()), i = sn(n.port ?? process.env.CODEMEM_MCP_HTTP_PORT), c = n.publicUrl ?? process.env.CODEMEM_MCP_HTTP_PUBLIC_URL, p = c ? V(c) : void 0, m = new a(n.dbPath ?? o()), h = $e(), g = et(), _ = n.oauthAccessTokenStore ?? tt(), v = Ot(), y = Dt(), b = p !== void 0 || v !== void 0, x = Me(n.auditEmitter ?? Fe()), S = /* @__PURE__ */ new Set(), C = null, w = f();
-	w.disable("x-powered-by"), w.set("trust proxy", "loopback");
-	let T = t(w);
+async function xn(n = {}) {
+	let r = mn(n.host ?? process.env.CODEMEM_MCP_HTTP_HOST, n.allowUnsafePublic ?? hn()), i = bn(n.port ?? process.env.CODEMEM_MCP_HTTP_PORT), c = n.publicUrl ?? process.env.CODEMEM_MCP_HTTP_PUBLIC_URL, p = c ? _t(c) : void 0, m = new a(n.dbPath ?? o()), h = n.oauthAccessTokenStore ? void 0 : ft(n.oauthStatePath), g = h ?? ct(), _ = h ?? lt(), v = n.oauthAccessTokenStore ?? h ?? ut(), y = zt(), b = Rt(), ee = p !== void 0 || y !== void 0, x = Ve(n.auditEmitter ?? We()), S = /* @__PURE__ */ new Set(), te = null, C = f();
+	C.disable("x-powered-by"), C.set("trust proxy", "loopback");
+	let w = t(C);
 	await new Promise((e, t) => {
-		T.once("error", t), T.listen({
+		w.once("error", t), w.listen({
 			host: r,
 			port: i
 		}, () => {
-			T.off("error", t), e();
+			w.off("error", t), e();
 		});
 	});
-	let E = p?.href ?? yn(T, r), D = new URL(E), O = bn(D, $(T)), k = new Bt({
-		clientsStore: h,
-		codeStore: g,
-		tokenStore: _,
-		publicMcpUrl: E,
-		...v ? { oidc: {
-			config: v,
-			pendingStore: y
+	let T = p?.href ?? Mn(w, r), E = new URL(T), D = Nn(E, $(w)), ne = new Zt({
+		clientsStore: g,
+		codeStore: _,
+		tokenStore: v,
+		publicMcpUrl: T,
+		...h ? { refreshTokenStore: h } : {},
+		...y ? { oidc: {
+			config: y,
+			pendingStore: b
 		} } : {}
-	}), ee = l(D);
-	w.use(ke({
-		windowMs: Zt,
-		limit: Qt,
+	}), re = l(E);
+	C.use(Re({
+		windowMs: un,
+		limit: dn,
 		standardHeaders: "draft-8",
 		legacyHeaders: !1,
 		ipv6Subnet: !1
-	})), w.use((e, t, n) => {
-		let r = $(T), i = Sn(e.path);
+	})), C.use((e, t, n) => {
+		let r = $(w), i = Fn(e.path);
 		if (i === "/mcp") {
-			if (ln(e, r, p)) {
-				if (pn(e, t, p), e.method === "OPTIONS") {
+			if (Sn(e, r, p)) {
+				if (En(e, t, p), e.method === "OPTIONS") {
 					t.status(204).send("");
 					return;
 				}
 				return n();
 			}
-			hn(e, i, p), t.status(403).type("text/plain").send("Forbidden");
+			On(e, i, p), t.status(403).type("text/plain").send("Forbidden");
 			return;
 		}
-		if (xn(i)) {
-			if (dn(e, r, p)) {
-				if (pn(e, t, p), e.method === "OPTIONS") {
+		if (Pn(i)) {
+			if (wn(e, r, p)) {
+				if (En(e, t, p), e.method === "OPTIONS") {
 					t.status(204).send("");
 					return;
 				}
 				return n();
 			}
-			hn(e, i, p), t.status(403).type("text/plain").send("Forbidden");
+			On(e, i, p), t.status(403).type("text/plain").send("Forbidden");
 			return;
 		}
 		n();
-	}), w.use(Cn(x)), w.get("/oauth/callback", async (e, t) => {
+	}), C.use(In(x)), C.get("/oauth/callback", async (e, t) => {
 		let n = e.socket.remoteAddress ?? void 0;
-		if (!v) {
+		if (!y) {
 			x(L("oidc_callback", {
 				outcome: "denied",
 				reason: "oidc_not_configured",
@@ -1892,7 +2156,7 @@ async function cn(n = {}) {
 			});
 			return;
 		}
-		let r = await At(new URLSearchParams(e.query), y, v, E);
+		let r = await Vt(new URLSearchParams(e.query), b, y, T);
 		if ("status" in r) {
 			x(L("oidc_callback", {
 				outcome: "denied",
@@ -1901,11 +2165,11 @@ async function cn(n = {}) {
 			})), t.status(r.status).json(r.body);
 			return;
 		}
-		let i = r.oauthParams.get("client_id") ?? void 0, a = g.issueCode({
+		let i = r.oauthParams.get("client_id") ?? void 0, a = _.issueCode({
 			clientId: r.oauthParams.get("client_id") ?? "",
 			redirectUri: r.oauthParams.get("redirect_uri") ?? "",
 			codeChallenge: r.oauthParams.get("code_challenge") ?? "",
-			scopes: Mn(r.oauthParams.get("scope")),
+			scopes: Gn(r.oauthParams.get("scope")),
 			...r.oauthParams.get("resource") ? { resource: r.oauthParams.get("resource") ?? void 0 } : {},
 			expiresAt: Date.now() + 300 * 1e3
 		});
@@ -1930,28 +2194,28 @@ async function cn(n = {}) {
 			clientId: i,
 			remoteAddress: n
 		})), t.redirect(302, o.href);
-	}), w.get("/.well-known/oauth-authorization-server", (e, t) => {
-		t.status(200).json(rt({
-			mcpUrl: E,
-			clientsStore: h
+	}), C.get("/.well-known/oauth-authorization-server", (e, t) => {
+		t.status(200).json(mt({
+			mcpUrl: T,
+			clientsStore: g
 		}));
-	}), w.get("/.well-known/oauth-protected-resource/mcp", (e, t) => {
-		t.status(200).json(it(E));
-	}), w.use(u({
-		provider: k,
-		issuerUrl: O,
-		baseUrl: O,
-		resourceServerUrl: D,
-		resourceName: Ie,
+	}), C.get("/.well-known/oauth-protected-resource/mcp", (e, t) => {
+		t.status(200).json(ht(T));
+	}), C.use(u({
+		provider: ne,
+		issuerUrl: D,
+		baseUrl: D,
+		resourceServerUrl: E,
+		resourceName: Ge,
 		scopesSupported: R,
 		serviceDocumentationUrl: new URL(z),
 		clientRegistrationOptions: { clientSecretExpirySeconds: 0 }
 	}));
-	let A = b ? s({
-		verifier: k,
-		resourceMetadataUrl: ee
-	}) : (e, t, n) => n(), j = b ? An(x, _) : (e, t, n) => n();
-	return w.post("/mcp", j, A, async (t, n) => {
+	let O = ee ? s({
+		verifier: ne,
+		resourceMetadataUrl: re
+	}) : (e, t, n) => n(), k = ee ? Un(x, v) : (e, t, n) => n();
+	return C.post("/mcp", k, O, async (t, n) => {
 		t.auth && x(L("bearer", {
 			outcome: "success",
 			clientId: t.auth.clientId,
@@ -1964,59 +2228,59 @@ async function cn(n = {}) {
 		} finally {
 			S.delete(a), await r.close();
 		}
-	}), w.all("/mcp", (e, t) => {
+	}), C.all("/mcp", (e, t) => {
 		t.setHeader("Allow", "POST"), t.status(405).type("text/plain").send("Method not allowed");
-	}), w.use((e, t) => {
+	}), C.use((e, t) => {
 		t.status(404).type("text/plain").send("Not found");
 	}), {
-		server: T,
+		server: w,
 		store: m,
-		url: `http://${vn(r)}:${$(T)}/mcp`,
-		close: () => (C ??= (async () => {
+		url: `http://${jn(r)}:${$(w)}/mcp`,
+		close: () => (te ??= (async () => {
 			await Promise.allSettled([...S].map(({ mcpServer: e }) => e.close())), await new Promise((e, t) => {
-				T.close((n) => {
+				w.close((n) => {
 					if (!n || n.code === "ERR_SERVER_NOT_RUNNING") {
 						e();
 						return;
 					}
 					t(n);
-				}), T.closeAllConnections();
+				}), w.closeAllConnections();
 			}), m.close();
-		})(), C)
+		})(), te)
 	};
 }
-function ln(e, t, n) {
-	return un(e, t) ? !0 : n ? _n(e.headers.host, n) && fn(e.headers.origin, n) : !1;
+function Sn(e, t, n) {
+	return Cn(e, t) ? !0 : n ? An(e.headers.host, n) && Tn(e.headers.origin, n) : !1;
 }
-function un(e, t) {
-	return on(e.socket.remoteAddress) && rn(e.headers.host, t) && an(e.headers.origin, t);
+function Cn(e, t) {
+	return vn(e.socket.remoteAddress) && gn(e.headers.host, t) && _n(e.headers.origin, t);
 }
-function dn(e, t, n) {
-	return un(e, t) ? !0 : n ? _n(e.headers.host, n) && fn(e.headers.origin, n) : !1;
+function wn(e, t, n) {
+	return Cn(e, t) ? !0 : n ? An(e.headers.host, n) && Tn(e.headers.origin, n) : !1;
 }
-function fn(e, t) {
+function Tn(e, t) {
 	if (!e) return !0;
 	try {
 		let n = new URL(e);
-		return n.origin === t.origin || qt.has(n.origin);
+		return n.origin === t.origin || on.has(n.origin);
 	} catch {
 		return !1;
 	}
 }
-function pn(e, t, n) {
+function En(e, t, n) {
 	if (!n) return;
-	let r = mn(e.headers.origin, n);
-	r && (t.setHeader("Access-Control-Allow-Origin", r), t.setHeader("Access-Control-Allow-Methods", "GET,POST,OPTIONS"), t.setHeader("Access-Control-Allow-Headers", e.headers["access-control-request-headers"] ?? Jt), t.setHeader("Access-Control-Max-Age", Yt), t.setHeader("Vary", "Origin"));
+	let r = Dn(e.headers.origin, n);
+	r && (t.setHeader("Access-Control-Allow-Origin", r), t.setHeader("Access-Control-Allow-Methods", "GET,POST,OPTIONS"), t.setHeader("Access-Control-Allow-Headers", e.headers["access-control-request-headers"] ?? sn), t.setHeader("Access-Control-Max-Age", cn), t.setHeader("Vary", "Origin"));
 }
-function mn(e, t) {
+function Dn(e, t) {
 	if (e) try {
 		let n = new URL(e).origin;
-		if (n === t.origin || qt.has(n)) return n;
+		if (n === t.origin || on.has(n)) return n;
 	} catch {
 		return;
 	}
 }
-function hn(e, t, n) {
+function On(e, t, n) {
 	console.warn(JSON.stringify({
 		source: "codemem-mcp-http-guard",
 		timestamp: (/* @__PURE__ */ new Date()).toISOString(),
@@ -2024,50 +2288,50 @@ function hn(e, t, n) {
 		reason: "host_or_origin_mismatch",
 		method: e.method,
 		path: t,
-		host: gn(e.headers.host),
-		origin: gn(e.headers.origin),
+		host: kn(e.headers.host),
+		origin: kn(e.headers.origin),
 		expectedOrigin: n?.origin,
 		remoteAddress: e.socket.remoteAddress ?? void 0
 	}));
 }
-function gn(e) {
-	return !e || e.length <= Xt ? e : `${e.slice(0, Xt)}…`;
+function kn(e) {
+	return !e || e.length <= ln ? e : `${e.slice(0, ln)}…`;
 }
-function _n(e, t) {
-	let n = Q(e);
+function An(e, t) {
+	let n = yn(e);
 	if (!n) return !1;
 	let r = t.port ? Number(t.port) : t.protocol === "https:" ? 443 : 80, i = t.protocol === "https:" ? 443 : 80, a = n.port ?? i;
-	return Z(n.host) === Z(t.hostname) && a === r;
+	return Q(n.host) === Q(t.hostname) && a === r;
 }
 function $(e) {
 	let t = e.address();
-	return !t || typeof t == "string" ? Y : t.port;
+	return !t || typeof t == "string" ? rn : t.port;
 }
-function vn(e) {
+function jn(e) {
 	return n(e) === 6 ? `[${e}]` : e;
 }
-function yn(e, t) {
-	return `http://${vn(t)}:${$(e)}/mcp`;
+function Mn(e, t) {
+	return `http://${jn(t)}:${$(e)}/mcp`;
 }
-function bn(e, t) {
-	return e.protocol === "https:" || X(e.hostname) && Z(e.hostname) !== "::1" ? new URL(e.origin) : new URL(`http://localhost:${t}/`);
+function Nn(e, t) {
+	return e.protocol === "https:" || Z(e.hostname) && Q(e.hostname) !== "::1" ? new URL(e.origin) : new URL(`http://localhost:${t}/`);
 }
-function xn(e) {
+function Pn(e) {
 	return e === "/register" || e === "/authorize" || e === "/token" || e === "/revoke" || e === "/oauth/callback" || e === "/.well-known/oauth-authorization-server" || e === "/.well-known/oauth-protected-resource/mcp";
 }
-function Sn(e) {
+function Fn(e) {
 	return e.length > 1 ? e.replace(/\/+$/, "") : e;
 }
-function Cn(e) {
+function In(e) {
 	return (t, n, r) => {
 		let i = t.path;
-		if (!wn(i)) return r();
+		if (!Ln(i)) return r();
 		let a, o = n.json.bind(n);
 		n.json = ((e) => (a = e, o(e))), n.on("finish", () => {
 			if (i === "/oauth/callback") return;
-			let r = Tn(i, t);
+			let r = Rn(i, t);
 			if (!r) return;
-			let o = Dn(n, a), s = kn(t, a);
+			let o = Bn(n, a), s = Hn(t, a);
 			e(L(r, {
 				outcome: o ? "denied" : "success",
 				...o ? { reason: o } : {},
@@ -2077,17 +2341,17 @@ function Cn(e) {
 		}), r();
 	};
 }
-function wn(e) {
-	return En(e) !== null;
+function Ln(e) {
+	return zn(e) !== null;
 }
-function Tn(e, t) {
-	return e === "/token" && t.body?.grant_type === "refresh_token" ? "refresh" : En(e);
+function Rn(e, t) {
+	return e === "/token" && t.body?.grant_type === "refresh_token" ? "refresh" : zn(e);
 }
-function En(e) {
+function zn(e) {
 	return e === "/register" ? "registration" : e === "/authorize" ? "authorize" : e === "/token" ? "token" : e === "/revoke" ? "revocation" : null;
 }
-function Dn(e, t) {
-	let n = On(t);
+function Bn(e, t) {
+	let n = Vn(t);
 	if (n) return n;
 	let r = e.getHeader("location");
 	if (typeof r == "string") try {
@@ -2096,15 +2360,15 @@ function Dn(e, t) {
 		return;
 	}
 }
-function On(e) {
+function Vn(e) {
 	if (typeof e == "object" && e && "error" in e && typeof e.error == "string") return e.error;
 }
-function kn(e, t) {
+function Hn(e, t) {
 	return typeof t == "object" && t && "client_id" in t && typeof t.client_id == "string" ? t.client_id : (typeof e.body?.client_id == "string" ? e.body.client_id : void 0) || (typeof e.query.client_id == "string" ? e.query.client_id : void 0);
 }
-function An(e, t) {
+function Un(e, t) {
 	return (n, r, i) => {
-		let a = jn(n.headers.authorization, t);
+		let a = Wn(n.headers.authorization, t);
 		a && e(L("bearer", {
 			outcome: "denied",
 			reason: a,
@@ -2112,22 +2376,22 @@ function An(e, t) {
 		})), i();
 	};
 }
-function jn(e, t) {
+function Wn(e, t) {
 	if (!e) return "missing_authorization_header";
 	let [n, r, i] = e.trim().split(/\s+/);
 	if (!n || !r || i || n.toLowerCase() !== "bearer") return "malformed_authorization_header";
 	let a = t.verifyToken(r);
 	return a.ok ? null : a.reason;
 }
-function Mn(e) {
+function Gn(e) {
 	return e?.split(/\s+/).map((e) => e.trim()).filter(Boolean) ?? [];
 }
-function Nn() {
+function Kn() {
 	let e = process.argv[1];
 	return e ? import.meta.url === i(e).href : !1;
 }
-async function Pn() {
-	let e = await cn();
+async function qn() {
+	let e = await xn();
 	console.error(`codemem MCP HTTP server listening at ${e.url}`);
 	let t = async () => {
 		try {
@@ -2137,10 +2401,10 @@ async function Pn() {
 	};
 	process.on("SIGINT", t), process.on("SIGTERM", t);
 }
-Nn() && Pn().catch((e) => {
+Kn() && qn().catch((e) => {
 	console.error("codemem MCP HTTP server failed to start:", e), process.exit(1);
 });
 //#endregion
-export { Gt as DEFAULT_MCP_HTTP_HOST, Y as DEFAULT_MCP_HTTP_PORT, rn as isAllowedMcpHttpRequestHost, an as isAllowedMcpHttpRequestOrigin, on as isAllowedMcpHttpRequestRemoteAddress, X as isLoopbackHost, nn as isUnsafePublicBindAllowed, sn as parseMcpHttpPort, cn as startCodememMcpHttpServer, tn as validateMcpHttpHost };
+export { nn as DEFAULT_MCP_HTTP_HOST, rn as DEFAULT_MCP_HTTP_PORT, gn as isAllowedMcpHttpRequestHost, _n as isAllowedMcpHttpRequestOrigin, vn as isAllowedMcpHttpRequestRemoteAddress, Z as isLoopbackHost, hn as isUnsafePublicBindAllowed, bn as parseMcpHttpPort, xn as startCodememMcpHttpServer, mn as validateMcpHttpHost };
 
 //# sourceMappingURL=http.js.map