@codemem/mcp 0.37.0 → 0.38.0-alpha.1

package/dist/http.js

@@ -10,10 +10,10 @@ import { StreamableHTTPServerTransport as d } from "@modelcontextprotocol/sdk/se
 import f from "express";
 import { Buffer as p } from "node:buffer";
 import { createHash as m, createHmac as h, createPublicKey as g, randomBytes as _, randomUUID as v, timingSafeEqual as y, verify as b } from "node:crypto";
-import { existsSync as ee, mkdirSync as x, readFileSync as S, renameSync as te, writeFileSync as C } from "node:fs";
-import { chmod as w } from "node:fs/promises";
-import { homedir as T } from "node:os";
-import { dirname as E, join as D } from "node:path";
+import { existsSync as x, mkdirSync as S, readFileSync as C, renameSync as ee, writeFileSync as w } from "node:fs";
+import { chmod as T } from "node:fs/promises";
+import { homedir as E } from "node:os";
+import { dirname as D, join as te } from "node:path";
 import { AccessDeniedError as ne, InvalidClientError as re, InvalidClientMetadataError as O, InvalidGrantError as k, InvalidRequestError as ie, InvalidTokenError as ae, ServerError as oe, TemporarilyUnavailableError as A, UnsupportedResponseTypeError as se } from "@modelcontextprotocol/sdk/server/auth/errors.js";
 import { OAuthProtectedResourceMetadataSchema as ce, OAuthTokensSchema as le } from "@modelcontextprotocol/sdk/shared/auth.js";
 //#region \0rolldown/runtime.js
@@ -1114,21 +1114,21 @@ function We(e = process.env.CODEMEM_MCP_AUDIT) {
 	let t = e?.trim().toLowerCase();
 	return t === "0" || t === "false" || t === "no" ? Ue() : He();
 }
-var Ge = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github.com/kunickiaj/codemem#readme", Ke = "https://claude.ai/api/mcp/auth_callback", qe = new Set([
+var Ge = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github.com/kunickiaj/codemem#readme", Ke = "https://claude.ai/api/mcp/auth_callback", qe = "https://chatgpt.com/connector_platform_oauth_redirect", Je = new Set([
 	"localhost",
 	"127.0.0.1",
 	"::1"
-]), Je = new Set(["authorization_code", "refresh_token"]), Ye = new Set(["code"]), B = 3600, V = 720 * 60 * 60, Xe = 100, Ze = 100, Qe = 100, $e = 32, et = 43, tt = /^[A-Za-z0-9_-]{43}$/, nt = /^[A-Za-z0-9_-]{43}$/, rt = class {
+]), Ye = new Set(["authorization_code", "refresh_token"]), Xe = new Set(["code"]), B = 3600, V = 720 * 60 * 60, Ze = 100, Qe = 100, $e = 100, et = 32, tt = 43, nt = /^[A-Za-z0-9_-]{43}$/, rt = /^[A-Za-z0-9_-]{43}$/, it = /^[A-Za-z0-9_-]{1,128}$/, at = class {
 	#e = /* @__PURE__ */ new Map();
 	getClient(e) {
 		return this.#e.get(e);
 	}
 	registerClient(e) {
-		let t = yt(e.redirect_uris);
+		let t = xt(e.redirect_uris);
 		if (t) throw new O(t);
 		if (e.client_secret || e.token_endpoint_auth_method !== "none") throw new O("Only public clients with token_endpoint_auth_method=none are supported");
-		if (e.grant_types && !H(e.grant_types, Je)) throw new O("Only authorization_code and refresh_token grant_types are supported");
-		if (e.response_types && !H(e.response_types, Ye)) throw new O("Only code response_type is supported");
+		if (e.grant_types && !H(e.grant_types, Ye)) throw new O("Only authorization_code and refresh_token grant_types are supported");
+		if (e.response_types && !H(e.response_types, Xe)) throw new O("Only code response_type is supported");
 		if (this.#e.size >= 100) {
 			let e = this.#e.keys().next().value;
 			e && this.#e.delete(e);
@@ -1143,10 +1143,10 @@ var Ge = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github
 		};
 		return this.#e.set(n.client_id, n), n;
 	}
-}, it = class {
+}, ot = class {
 	#e = /* @__PURE__ */ new Map();
 	issueCode(e, t = Date.now()) {
-		if (this.#t(t), this.#e.size >= Xe) return;
+		if (this.#t(t), this.#e.size >= Ze) return;
 		let n = v();
 		return this.#e.set(n, {
 			...e,
@@ -1164,12 +1164,12 @@ var Ge = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github
 	#t(e) {
 		for (let [t, n] of this.#e) n.expiresAt <= e && this.#e.delete(t);
 	}
-}, at = class {
+}, st = class {
 	#e = /* @__PURE__ */ new Map();
 	#t = _(32);
 	issueToken(e, t = Date.now(), n, r, i = []) {
-		if (this.#n(t), this.#e.size >= Ze) return;
-		let a = _($e), o = Tt(a, this.#t);
+		if (this.#n(t), this.#e.size >= Qe) return;
+		let a = _(et), o = kt(a, this.#t);
 		return this.#e.set(o, {
 			clientId: e,
 			grantId: r,
@@ -1191,7 +1191,7 @@ var Ge = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github
 			ok: !1,
 			reason: "unknown_token"
 		};
-		let r = Tt(n, this.#t), i = this.#e.get(r);
+		let r = kt(n, this.#t), i = this.#e.get(r);
 		return !i || !J(i.tokenHash, r) ? {
 			ok: !1,
 			reason: "unknown_token"
@@ -1209,7 +1209,7 @@ var Ge = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github
 	revokeToken(e, t = Date.now()) {
 		let n = W(e);
 		if (!n) return !1;
-		let r = Tt(n, this.#t), i = this.#e.get(r);
+		let r = kt(n, this.#t), i = this.#e.get(r);
 		return !i || !J(i.tokenHash, r) ? !1 : (i.revokedAt === null && (i.revokedAt = t), !0);
 	}
 	revokeTokensForGrant(e, t = Date.now()) {
@@ -1220,13 +1220,13 @@ var Ge = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github
 	#n(e) {
 		for (let [t, n] of this.#e) (n.expiresAt <= e || n.revokedAt !== null) && this.#e.delete(t);
 	}
-}, ot = class {
+}, ct = class {
 	#e = /* @__PURE__ */ new Map();
 	#t = /* @__PURE__ */ new Map();
 	#n = /* @__PURE__ */ new Map();
 	#r = _(32);
 	issueGrant(e, t = Date.now()) {
-		if (this.#i(t), this.#e.size >= Qe) return;
+		if (this.#i(t), this.#e.size >= $e) return;
 		let n = G(), r = K(n, this.#r);
 		if (!r) return;
 		let i = {
@@ -1281,7 +1281,7 @@ var Ge = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github
 			reason: "client_mismatch",
 			grantId: a
 		};
-		if (!Dt(n.scopes ?? o.scopes, o.scopes)) return {
+		if (!jt(n.scopes ?? o.scopes, o.scopes)) return {
 			ok: !1,
 			reason: "scope_mismatch",
 			grantId: a
@@ -1333,7 +1333,7 @@ var Ge = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github
 		}
 		this.#t.delete(e.currentRefreshTokenHash), e.previousRefreshTokenHash && this.#t.delete(e.previousRefreshTokenHash);
 	}
-}, st = class {
+}, lt = class {
 	#e;
 	#t = /* @__PURE__ */ new Map();
 	#n = /* @__PURE__ */ new Map();
@@ -1341,18 +1341,18 @@ var Ge = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github
 	#i = /* @__PURE__ */ new Map();
 	#a = /* @__PURE__ */ new Map();
 	#o = /* @__PURE__ */ new Map();
-	constructor(e = pt()) {
+	constructor(e = ht()) {
 		this.#e = e, this.#s();
 	}
 	getClient(e) {
 		return this.#n.get(e);
 	}
 	registerClient(e) {
-		let t = yt(e.redirect_uris);
+		let t = xt(e.redirect_uris);
 		if (t) throw new O(t);
 		if (e.client_secret || e.token_endpoint_auth_method !== "none") throw new O("Only public clients with token_endpoint_auth_method=none are supported");
-		if (e.grant_types && !H(e.grant_types, Je)) throw new O("Only authorization_code and refresh_token grant_types are supported");
-		if (e.response_types && !H(e.response_types, Ye)) throw new O("Only code response_type is supported");
+		if (e.grant_types && !H(e.grant_types, Ye)) throw new O("Only authorization_code and refresh_token grant_types are supported");
+		if (e.response_types && !H(e.response_types, Xe)) throw new O("Only code response_type is supported");
 		if (this.#u(Date.now()), this.#n.size >= 100) {
 			let e = this.#n.keys().next().value;
 			e && this.#n.delete(e);
@@ -1368,7 +1368,7 @@ var Ge = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github
 		return this.#n.set(n.client_id, n), this.#c(), n;
 	}
 	issueCode(e, t = Date.now()) {
-		if (this.#l(t), this.#t.size >= Xe) return;
+		if (this.#l(t), this.#t.size >= Ze) return;
 		let n = v();
 		return this.#t.set(n, {
 			...e,
@@ -1384,7 +1384,7 @@ var Ge = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github
 		if (!(!t || t.used)) return t.used = !0, t;
 	}
 	issueToken(e, t = Date.now(), n, r, i = []) {
-		if (this.#u(t), this.#r.size >= Ze) return;
+		if (this.#u(t), this.#r.size >= Qe) return;
 		let a = G(), o = q(a);
 		if (o) return this.#r.set(o, {
 			clientId: e,
@@ -1437,7 +1437,7 @@ var Ge = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github
 		return n > 0 && this.#c(), n;
 	}
 	issueGrant(e, t = Date.now()) {
-		if (this.#u(t), this.#i.size >= Qe) return;
+		if (this.#u(t), this.#i.size >= $e) return;
 		let n = G(), r = q(n);
 		if (!r) return;
 		let i = {
@@ -1492,7 +1492,7 @@ var Ge = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github
 			reason: "client_mismatch",
 			grantId: a
 		};
-		if (!Dt(n.scopes ?? o.scopes, o.scopes)) return {
+		if (!jt(n.scopes ?? o.scopes, o.scopes)) return {
 			ok: !1,
 			reason: "scope_mismatch",
 			grantId: a
@@ -1533,10 +1533,10 @@ var Ge = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github
 		return n ? n.revokedAt === null ? (n.revokedAt = t, this.#d(n), this.#c(), !0) : !0 : !1;
 	}
 	#s() {
-		if (!ee(this.#e)) return;
+		if (!x(this.#e)) return;
 		let e;
 		try {
-			e = JSON.parse(S(this.#e, "utf8"));
+			e = JSON.parse(C(this.#e, "utf8"));
 		} catch {
 			return;
 		}
@@ -1551,7 +1551,7 @@ var Ge = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github
 		}
 	}
 	#c() {
-		x(E(this.#e), {
+		S(D(this.#e), {
 			recursive: !0,
 			mode: 448
 		});
@@ -1562,7 +1562,7 @@ var Ge = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github
 			refreshGrants: [...this.#i.values()],
 			refreshHashesByGrantId: Object.fromEntries([...this.#o.entries()].map(([e, t]) => [e, [...t]]))
 		}, t = `${this.#e}.${process.pid}.${Date.now()}.tmp`;
-		C(t, `${JSON.stringify(e, null, 2)}\n`, { mode: 384 }), te(t, this.#e), w(this.#e, 384).catch(() => void 0);
+		w(t, `${JSON.stringify(e, null, 2)}\n`, { mode: 384 }), ee(t, this.#e), T(this.#e, 384).catch(() => void 0);
 	}
 	#l(e) {
 		for (let [t, n] of this.#t) n.expiresAt <= e && this.#t.delete(t);
@@ -1583,29 +1583,29 @@ var Ge = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github
 		this.#a.delete(e.currentRefreshTokenHash), e.previousRefreshTokenHash && this.#a.delete(e.previousRefreshTokenHash);
 	}
 };
-function ct() {
-	return new rt();
-}
-function lt() {
-	return new it();
-}
 function ut() {
 	return new at();
 }
 function dt() {
 	return new ot();
 }
-function ft(e) {
-	return new st(e);
+function ft() {
+	return new st();
 }
 function pt() {
-	return D(process.env.HOME?.trim() || T(), ".codemem", "mcp-oauth-state.json");
+	return new ct();
 }
 function mt(e) {
-	let t = vt(_t(e.mcpUrl));
+	return new lt(e);
+}
+function ht() {
+	return te(process.env.HOME?.trim() || E(), ".codemem", "mcp-oauth-state.json");
+}
+function gt(e) {
+	let t = bt(yt(e.mcpUrl));
 	return {
 		...c({
-			provider: Ot(e.clientsStore),
+			provider: Mt(e.clientsStore),
 			issuerUrl: t,
 			baseUrl: t
 		}),
@@ -1618,10 +1618,10 @@ function mt(e) {
 		client_id_metadata_document_supported: !1
 	};
 }
-function ht(e) {
-	let t = _t(e), n = {
+function _t(e) {
+	let t = yt(e), n = {
 		resource: t.href,
-		authorization_servers: [vt(t).href],
+		authorization_servers: [bt(t).href],
 		scopes_supported: R,
 		bearer_methods_supported: ["header"],
 		resource_name: Ge,
@@ -1629,12 +1629,12 @@ function ht(e) {
 	};
 	return ce.parse(n);
 }
-function gt(e, t) {
-	let n = e.get("client_id") ?? "", r = e.get("redirect_uri") ?? "", i = e.get("response_type") ?? "", a = e.get("code_challenge") ?? "", o = e.get("code_challenge_method") ?? "", s = e.get("resource"), c = Ct(e.get("scope")), l = e.get("state");
+function vt(e, t) {
+	let n = e.get("client_id") ?? "", r = e.get("redirect_uri") ?? "", i = e.get("response_type") ?? "", a = e.get("code_challenge") ?? "", o = e.get("code_challenge_method") ?? "", s = e.get("resource"), c = Dt(e.get("scope")), l = e.get("state");
 	if (i !== "code") return U("unsupported_response_type");
 	if (o !== "S256") return U("invalid_request", "PKCE code_challenge_method=S256 is required");
-	if (!nt.test(a)) return U("invalid_request", "Valid PKCE S256 code_challenge is required");
-	let u = wt(t, n);
+	if (!rt.test(a)) return U("invalid_request", "Valid PKCE S256 code_challenge is required");
+	let u = Ot(t, n);
 	return u ? u.redirect_uris.includes(r) ? {
 		clientId: n,
 		redirectUri: r,
@@ -1644,43 +1644,50 @@ function gt(e, t) {
 		state: l
 	} : U("invalid_request", "redirect_uri is not registered for this client") : U("invalid_client", "Unknown OAuth client_id");
 }
-function _t(e) {
+function yt(e) {
 	let t;
 	try {
 		t = new URL(e);
 	} catch {
 		throw Error("Invalid MCP HTTP public URL; expected an HTTPS /mcp URL");
 	}
-	if (t.protocol !== "https:" && !xt(t)) throw Error("Invalid MCP HTTP public URL; use HTTPS for non-loopback URLs");
+	if (t.protocol !== "https:" && !Tt(t)) throw Error("Invalid MCP HTTP public URL; use HTTPS for non-loopback URLs");
 	if (t.username || t.password || t.search || t.hash) throw Error("Invalid MCP HTTP public URL; credentials, query strings, and fragments are not allowed");
 	if (t.pathname === "/" && (t.pathname = "/mcp"), t.pathname !== "/mcp") throw Error("Invalid MCP HTTP public URL; expected /mcp path");
 	return t;
 }
-function vt(e) {
+function bt(e) {
 	return new URL(e.origin);
 }
-function yt(e) {
+function xt(e) {
 	for (let t of e) {
 		let e = new URL(t);
-		if (e.username || e.password || e.hash) return `Invalid redirect URI: ${t}`;
-		if (e.href !== Ke && !bt(e)) return `Unsupported redirect URI: ${t}`;
+		if (e.username || e.password || e.hash) return "Invalid redirect URI";
+		if (!St(e) && !wt(e)) return "Unsupported redirect URI";
 	}
 	return null;
 }
+function St(e) {
+	return e.search === "" ? e.href === Ke || e.href === qe ? !0 : e.protocol === "https:" && e.hostname === "chatgpt.com" && Ct(e) : !1;
+}
+function Ct(e) {
+	let t = e.pathname.split("/").filter(Boolean);
+	return t.length === 3 && t[0] === "connector" && t[1] === "oauth" && it.test(t[2] ?? "");
+}
 function H(e, t) {
 	return e.length > 0 && e.every((e) => t.has(e));
 }
-function bt(e) {
-	return e.protocol === "http:" && qe.has(St(e.hostname)) && e.pathname === "/callback" && e.search === "";
+function wt(e) {
+	return e.protocol === "http:" && Je.has(Et(e.hostname)) && (e.pathname === "/callback" || e.pathname === "/oauth/callback") && e.search === "";
 }
-function xt(e) {
-	let t = St(e.hostname);
-	return e.protocol === "http:" && qe.has(t);
+function Tt(e) {
+	let t = Et(e.hostname);
+	return e.protocol === "http:" && Je.has(t);
 }
-function St(e) {
+function Et(e) {
 	return e.replace(/^\[(.*)]$/, "$1").toLowerCase();
 }
-function Ct(e) {
+function Dt(e) {
 	return e?.split(/\s+/).map((e) => e.trim()).filter(Boolean) ?? [];
 }
 function U(e, t) {
@@ -1692,42 +1699,42 @@ function U(e, t) {
 		} : { error: e }
 	};
 }
-function wt(e, t) {
+function Ot(e, t) {
 	let n = e.getClient(t);
 	if (n instanceof Promise) throw Error("Asynchronous OAuth client stores are not supported by this HTTP bootstrap yet");
 	return n;
 }
 function W(e) {
-	if (typeof e != "string" || e.length !== et || !tt.test(e)) return null;
+	if (typeof e != "string" || e.length !== tt || !nt.test(e)) return null;
 	let t = Buffer.from(e, "base64url");
-	return t.length === $e ? t : null;
+	return t.length === et ? t : null;
 }
 function G() {
-	return _($e).toString("base64url");
+	return _(et).toString("base64url");
 }
 function K(e, t) {
 	let n = W(e);
-	return n ? Et(n, t) : null;
+	return n ? At(n, t) : null;
 }
 function q(e) {
 	let t = W(e);
 	return t ? m("sha256").update(t).digest("base64url") : null;
 }
-function Tt(e, t) {
-	return Et(e, t);
+function kt(e, t) {
+	return At(e, t);
 }
-function Et(e, t) {
+function At(e, t) {
 	return h("sha256", t).update(e).digest("base64url");
 }
 function J(e, t) {
 	let n = Buffer.from(e), r = Buffer.from(t);
 	return n.length === r.length && y(n, r);
 }
-function Dt(e, t) {
+function jt(e, t) {
 	let n = new Set(t);
 	return e.every((e) => n.has(e));
 }
-function Ot(e) {
+function Mt(e) {
 	return {
 		clientsStore: e,
 		async authorize() {
@@ -1749,14 +1756,14 @@ function Ot(e) {
 }
 //#endregion
 //#region src/oidc.ts
-var kt = "CODEMEM_MCP_OIDC_ISSUER_URL", At = "CODEMEM_MCP_OIDC_CLIENT_ID", jt = "CODEMEM_MCP_OIDC_CLIENT_SECRET", Mt = "CODEMEM_MCP_OAUTH_ALLOWED_SUBJECT", Nt = "CODEMEM_MCP_OAUTH_ALLOWED_EMAIL", Pt = 300 * 1e3, Ft = 100, It = 300 * 1e3, Lt = class {
+var Nt = "CODEMEM_MCP_OIDC_ISSUER_URL", Pt = "CODEMEM_MCP_OIDC_CLIENT_ID", Ft = "CODEMEM_MCP_OIDC_CLIENT_SECRET", It = "CODEMEM_MCP_OAUTH_ALLOWED_SUBJECT", Lt = "CODEMEM_MCP_OAUTH_ALLOWED_EMAIL", Rt = 300 * 1e3, zt = 100, Bt = 300 * 1e3, Vt = class {
 	#e = /* @__PURE__ */ new Map();
 	issue(e, t = Date.now()) {
-		if (this.#t(t), this.#e.size >= Ft) return;
+		if (this.#t(t), this.#e.size >= zt) return;
 		let n = v();
 		return this.#e.set(n, {
 			...e,
-			expiresAt: t + Pt
+			expiresAt: t + Rt
 		}), n;
 	}
 	consume(e) {
@@ -1767,11 +1774,11 @@ var kt = "CODEMEM_MCP_OIDC_ISSUER_URL", At = "CODEMEM_MCP_OIDC_CLIENT_ID", jt =
 		for (let [t, n] of this.#e) n.expiresAt <= e && this.#e.delete(t);
 	}
 };
-function Rt() {
-	return new Lt();
+function Ht() {
+	return new Vt();
 }
-function zt(e = process.env) {
-	let t = e[kt]?.trim(), n = e[At]?.trim(), r = e[jt]?.trim(), i = e[Mt]?.trim(), a = e[Nt]?.trim().toLowerCase();
+function Ut(e = process.env) {
+	let t = e[Nt]?.trim(), n = e[Pt]?.trim(), r = e[Ft]?.trim(), i = e[It]?.trim(), a = e[Lt]?.trim().toLowerCase();
 	if (!(!t && !n && !r && !i && !a)) {
 		if (!t || !n || !r) throw Error("Incomplete MCP OIDC configuration");
 		if (Y(t, "issuer", { allowLoopbackHttp: !0 }), !i && !a) throw Error("MCP OIDC requires CODEMEM_MCP_OAUTH_ALLOWED_SUBJECT or CODEMEM_MCP_OAUTH_ALLOWED_EMAIL");
@@ -1784,39 +1791,39 @@ function zt(e = process.env) {
 		};
 	}
 }
-async function Bt(e, t, n, r, i, a = Date.now()) {
+async function Wt(e, t, n, r, i, a = Date.now()) {
 	if (!r) return X("temporarily_unavailable", "OIDC is not configured");
-	let o = gt(e, t);
+	let o = vt(e, t);
 	if ("status" in o) return o;
-	let s = await Ut(r.issuerUrl), c = v(), l = n.issue({
+	let s = await qt(r.issuerUrl), c = v(), l = n.issue({
 		oauthParams: e.toString(),
 		nonce: c
 	}, a);
 	if (!l) return X("temporarily_unavailable", "Too many pending OIDC authorizations");
-	let u = Ht(i), d = new URL(s.authorization_endpoint);
+	let u = Kt(i), d = new URL(s.authorization_endpoint);
 	return d.searchParams.set("response_type", "code"), d.searchParams.set("client_id", r.clientId), d.searchParams.set("redirect_uri", u), d.searchParams.set("scope", "openid email"), d.searchParams.set("state", l), d.searchParams.set("nonce", c), {
 		status: 302,
 		location: d.href
 	};
 }
-async function Vt(e, t, n, r, i = Date.now()) {
+async function Gt(e, t, n, r, i = Date.now()) {
 	try {
 		let a = e.get("code") ?? "", o = e.get("state") ?? "";
 		if (!o) return X("invalid_request", "Missing OIDC state");
 		let s = t.consume(o);
 		if (!s || s.expiresAt <= i) return X("invalid_request", "Expired or unknown OIDC state");
 		if (!a) return X("invalid_request", "Missing OIDC code");
-		let c = await Ut(n.issuerUrl), l = await Wt(c.token_endpoint, n, Ht(r), a);
-		return l.id_token ? Yt(await Gt(l.id_token, c, n.clientId, s.nonce, i), n) ? { oauthParams: new URLSearchParams(s.oauthParams) } : X("access_denied", "OIDC identity is not allowed") : X("invalid_request", "OIDC token exchange failed");
+		let c = await qt(n.issuerUrl), l = await Jt(c.token_endpoint, n, Kt(r), a);
+		return l.id_token ? $t(await Yt(l.id_token, c, n.clientId, s.nonce, i), n) ? { oauthParams: new URLSearchParams(s.oauthParams) } : X("access_denied", "OIDC identity is not allowed") : X("invalid_request", "OIDC token exchange failed");
 	} catch {
 		return X("access_denied", "OIDC identity verification failed");
 	}
 }
-function Ht(e) {
+function Kt(e) {
 	let t = new URL(e);
 	return new URL("/oauth/callback", t.origin).href;
 }
-async function Ut(e) {
+async function qt(e) {
 	let t = new URL(e);
 	if (t.search || t.hash) throw Error("OIDC issuer must not include query or fragment");
 	if (t.username || t.password) throw Error("OIDC issuer must not include credentials");
@@ -1825,10 +1832,10 @@ async function Ut(e) {
 	let i = await r.json();
 	if (i.issuer !== t.href && i.issuer !== t.href.replace(/\/$/, "")) throw Error("OIDC discovery issuer mismatch");
 	if (!i.authorization_endpoint || !i.token_endpoint || !i.jwks_uri) throw Error("OIDC discovery metadata is incomplete");
-	let a = t.protocol === "http:" && Xt(t.hostname);
+	let a = t.protocol === "http:" && en(t.hostname);
 	return Y(i.authorization_endpoint, "authorization endpoint", { allowLoopbackHttp: a }), Y(i.token_endpoint, "token endpoint", { allowLoopbackHttp: a }), Y(i.jwks_uri, "JWKS URI", { allowLoopbackHttp: a }), i;
 }
-async function Wt(e, t, n, r) {
+async function Jt(e, t, n, r) {
 	let i = new URLSearchParams({
 		grant_type: "authorization_code",
 		code: r,
@@ -1843,17 +1850,17 @@ async function Wt(e, t, n, r) {
 	if (!a.ok) throw Error("OIDC token request failed");
 	return await a.json();
 }
-async function Gt(e, t, n, r, i) {
+async function Yt(e, t, n, r, i) {
 	let [a, o, s] = e.split(".");
 	if (!a || !o || !s) throw Error("Invalid OIDC id_token");
-	let c = Kt(a), l = Kt(o);
+	let c = Xt(a), l = Xt(o);
 	if (c.alg !== "RS256" || !c.kid) throw Error("Unsupported OIDC id_token signature");
 	if (l.iss !== t.issuer) throw Error("OIDC id_token issuer mismatch");
-	if (!qt(l.aud, n)) throw Error("OIDC id_token audience mismatch");
-	if (!Jt(l.aud, l.azp, n)) throw Error("OIDC id_token authorized party mismatch");
+	if (!Zt(l.aud, n)) throw Error("OIDC id_token audience mismatch");
+	if (!Qt(l.aud, l.azp, n)) throw Error("OIDC id_token authorized party mismatch");
 	if (typeof l.exp != "number" || !Number.isFinite(l.exp) || l.exp * 1e3 <= i) throw Error("OIDC id_token is expired");
 	if (typeof l.iat != "number" || !Number.isFinite(l.iat)) throw Error("OIDC id_token issued-at time is missing");
-	if (l.iat * 1e3 > i + It) throw Error("OIDC id_token issued-at time is in the future");
+	if (l.iat * 1e3 > i + Bt) throw Error("OIDC id_token issued-at time is in the future");
 	if (l.nonce !== r) throw Error("OIDC id_token nonce mismatch");
 	if (!l.sub) throw Error("OIDC id_token subject is missing");
 	let u = await fetch(t.jwks_uri);
@@ -1867,24 +1874,24 @@ async function Gt(e, t, n, r, i) {
 	if (!b("RSA-SHA256", Buffer.from(p), f, Buffer.from(s, "base64url"))) throw Error("OIDC id_token signature verification failed");
 	return l;
 }
-function Kt(e) {
+function Xt(e) {
 	return JSON.parse(Buffer.from(e, "base64url").toString("utf8"));
 }
-function qt(e, t) {
+function Zt(e, t) {
 	return Array.isArray(e) ? e.includes(t) : e === t;
 }
-function Jt(e, t, n) {
+function Qt(e, t, n) {
 	return t && t !== n ? !1 : !Array.isArray(e) || e.length <= 1 || t === n;
 }
-function Yt(e, t) {
+function $t(e, t) {
 	return t.allowedSubject && e.sub === t.allowedSubject ? !0 : t.allowedEmail ? e.email_verified === !0 && e.email?.toLowerCase() === t.allowedEmail : !1;
 }
 function Y(e, t, n = {}) {
 	let r = new URL(e);
 	if (r.username || r.password) throw Error(`OIDC ${t} must not include credentials`);
-	if (r.protocol !== "https:" && !(n.allowLoopbackHttp && r.protocol === "http:" && Xt(r.hostname))) throw Error(`OIDC ${t} must use HTTPS`);
+	if (r.protocol !== "https:" && !(n.allowLoopbackHttp && r.protocol === "http:" && en(r.hostname))) throw Error(`OIDC ${t} must use HTTPS`);
 }
-function Xt(e) {
+function en(e) {
 	let t = e.replace(/^\[(.*)]$/, "$1").toLowerCase();
 	return t === "localhost" || t === "127.0.0.1" || t === "::1";
 }
@@ -1899,7 +1906,7 @@ function X(e, t) {
 }
 //#endregion
 //#region src/provider.ts
-var Zt = class {
+var tn = class {
 	#e;
 	#t;
 	#n;
@@ -1909,19 +1916,19 @@ var Zt = class {
 	#o;
 	#s;
 	constructor(e) {
-		this.#e = e.clientsStore, this.#t = e.codeStore, this.#n = e.tokenStore, this.#r = e.refreshTokenStore ?? dt(), this.#i = e.publicMcpUrl, this.#a = new URL(e.publicMcpUrl).href, this.#o = e.oidc, this.#s = e.now ?? Date.now;
+		this.#e = e.clientsStore, this.#t = e.codeStore, this.#n = e.tokenStore, this.#r = e.refreshTokenStore ?? pt(), this.#i = e.publicMcpUrl, this.#a = new URL(e.publicMcpUrl).href, this.#o = e.oidc, this.#s = e.now ?? Date.now;
 	}
 	get clientsStore() {
 		return this.#e;
 	}
 	async authorize(e, t, n) {
 		if (!this.#o) throw new A("OIDC is not configured");
-		let r = await Bt(Qt(e, t), this.#e, this.#o.pendingStore, this.#o.config, this.#i, this.#s());
+		let r = await Wt(nn(e, t), this.#e, this.#o.pendingStore, this.#o.config, this.#i, this.#s());
 		if (r.status === 302) {
 			n.redirect(302, r.location);
 			return;
 		}
-		throw $t(r.body);
+		throw rn(r.body);
 	}
 	async challengeForAuthorizationCode(e, t) {
 		let n = this.#t.peekCode(t);
@@ -1937,7 +1944,7 @@ var Zt = class {
 		if (o.clientId !== e.client_id) throw this.#t.consumeCode(t), new k("Code does not match client");
 		if (r === void 0 || o.redirectUri !== r) throw this.#t.consumeCode(t), new k("Code does not match redirect_uri");
 		if ((o.resource ?? null) !== (i?.href ?? null)) throw this.#t.consumeCode(t), new k("Code does not match resource");
-		let s = tn(o.scopes) ?? [], c = this.#r.issueGrant({
+		let s = on(o.scopes) ?? [], c = this.#r.issueGrant({
 			clientId: e.client_id,
 			scopes: s,
 			resource: o.resource
@@ -1955,10 +1962,10 @@ var Zt = class {
 	}
 	async exchangeRefreshToken(e, t, n, r) {
 		let i = this.#s(), a = this.#r.rotateRefreshToken(e.client_id, t, {
-			scopes: tn(n),
+			scopes: on(n),
 			...r ? { resource: r.href } : {}
 		}, i);
-		if (!a.ok) throw a.reason === "refresh_token_replay" && a.grantId && this.#n.revokeTokensForGrant?.(a.grantId, i), new k(en(a.reason));
+		if (!a.ok) throw a.reason === "refresh_token_replay" && a.grantId && this.#n.revokeTokensForGrant?.(a.grantId, i), new k(an(a.reason));
 		let o = this.#n.issueToken(e.client_id, i, a.grant.resource, a.grant.grantId, a.grant.scopes);
 		if (!o) throw new A("Too many active access tokens");
 		return le.parse({
@@ -1990,11 +1997,11 @@ var Zt = class {
 		r && this.#n.revokeTokensForGrant?.(r, n);
 	}
 };
-function Qt(e, t) {
+function nn(e, t) {
 	let n = new URLSearchParams();
 	return n.set("client_id", e.client_id), n.set("redirect_uri", t.redirectUri), n.set("response_type", "code"), n.set("code_challenge", t.codeChallenge), n.set("code_challenge_method", "S256"), t.state && n.set("state", t.state), t.scopes?.length && n.set("scope", t.scopes.join(" ")), t.resource && n.set("resource", t.resource.href), n;
 }
-function $t(e) {
+function rn(e) {
 	let t = e.error_description ?? e.error;
 	switch (e.error) {
 		case "temporarily_unavailable": return new A(t);
@@ -2005,7 +2012,7 @@ function $t(e) {
 		default: return new oe(t);
 	}
 }
-function en(e) {
+function an(e) {
 	switch (e) {
 		case "expired_refresh_token": return "Refresh token has expired";
 		case "revoked_refresh_token": return "Refresh token has been revoked";
@@ -2016,34 +2023,34 @@ function en(e) {
 		default: return "Invalid refresh token";
 	}
 }
-function tn(e) {
+function on(e) {
 	let t = e?.map((e) => e.trim()).filter(Boolean).map((e) => e === "memory:read_access" ? "memory:read" : e === "memory:write_access" ? "memory:write" : e);
 	return t && t.length > 0 ? t : void 0;
 }
 //#endregion
 //#region src/http.ts
-var nn = "127.0.0.1", rn = 38889, an = 80, on = new Set(["https://claude.ai"]), sn = "authorization,content-type,mcp-session-id", cn = "600", ln = 256, un = 900 * 1e3, dn = 600, fn = /^[a-zA-Z0-9.-]+$/, pn = new Set([
+var sn = "127.0.0.1", cn = 38889, ln = 80, un = new Set(["https://chatgpt.com", "https://claude.ai"]), dn = "authorization,content-type,mcp-session-id", fn = "600", pn = 256, mn = 900 * 1e3, hn = 600, gn = /^[a-zA-Z0-9.-]+$/, _n = new Set([
 	"127.0.0.1",
 	"::1",
 	"localhost"
 ]);
-function mn(e, t = !1) {
+function vn(e, t = !1) {
 	let r = e?.trim() || "127.0.0.1";
-	if (r.includes("://") || r.includes("/") || r.includes("\\") || !(n(r) || r === "localhost" || fn.test(r))) throw Error(`Invalid MCP HTTP host: ${e}`);
+	if (r.includes("://") || r.includes("/") || r.includes("\\") || !(n(r) || r === "localhost" || gn.test(r))) throw Error(`Invalid MCP HTTP host: ${e}`);
 	if (!t && !Z(r)) throw Error(`Refusing unsafe MCP HTTP host ${r}; set CODEMEM_MCP_HTTP_UNSAFE_PUBLIC=1 to allow non-loopback binding`);
 	return r;
 }
 function Z(e) {
-	return pn.has(Q(e));
+	return _n.has(Q(e));
 }
-function hn(e = process.env.CODEMEM_MCP_HTTP_UNSAFE_PUBLIC) {
+function yn(e = process.env.CODEMEM_MCP_HTTP_UNSAFE_PUBLIC) {
 	return e === "1" || e?.toLowerCase() === "true" || e?.toLowerCase() === "yes";
 }
-function gn(e, t) {
-	let n = yn(e);
-	return !n || !Z(n.host) ? !1 : n.port === null ? t === an : n.port === t;
+function bn(e, t) {
+	let n = Cn(e);
+	return !n || !Z(n.host) ? !1 : n.port === null ? t === ln : n.port === t;
 }
-function _n(e, t) {
+function xn(e, t) {
 	if (!e) return !0;
 	try {
 		let n = new URL(e), r = n.port ? Number(n.port) : n.protocol === "https:" ? 443 : 80;
@@ -2052,13 +2059,13 @@ function _n(e, t) {
 		return !1;
 	}
 }
-function vn(e) {
+function Sn(e) {
 	return e ? Z(e.replace(/^::ffff:/, "")) : !1;
 }
 function Q(e) {
 	return e.replace(/^\[(.*)]$/, "$1").toLowerCase();
 }
-function yn(e) {
+function Cn(e) {
 	if (!e) return null;
 	if (e.startsWith("[")) {
 		let t = /^\[([^\]]+)]:(\d+)$/.exec(e);
@@ -2083,70 +2090,70 @@ function yn(e) {
 		port: r
 	} : null;
 }
-function bn(e) {
-	if (e === void 0 || e === "") return rn;
+function wn(e) {
+	if (e === void 0 || e === "") return cn;
 	let t = typeof e == "number" ? e : Number(e);
 	if (!Number.isInteger(t) || t < 0 || t > 65535) throw Error(`Invalid MCP HTTP port: ${e}`);
 	return t;
 }
-async function xn(n = {}) {
-	let r = mn(n.host ?? process.env.CODEMEM_MCP_HTTP_HOST, n.allowUnsafePublic ?? hn()), i = bn(n.port ?? process.env.CODEMEM_MCP_HTTP_PORT), c = n.publicUrl ?? process.env.CODEMEM_MCP_HTTP_PUBLIC_URL, p = c ? _t(c) : void 0, m = new a(n.dbPath ?? o()), h = n.oauthAccessTokenStore ? void 0 : ft(n.oauthStatePath), g = h ?? ct(), _ = h ?? lt(), v = n.oauthAccessTokenStore ?? h ?? ut(), y = zt(), b = Rt(), ee = p !== void 0 || y !== void 0, x = Ve(n.auditEmitter ?? We()), S = /* @__PURE__ */ new Set(), te = null, C = f();
-	C.disable("x-powered-by"), C.set("trust proxy", "loopback");
-	let w = t(C);
+async function Tn(n = {}) {
+	let r = vn(n.host ?? process.env.CODEMEM_MCP_HTTP_HOST, n.allowUnsafePublic ?? yn()), i = wn(n.port ?? process.env.CODEMEM_MCP_HTTP_PORT), c = n.publicUrl ?? process.env.CODEMEM_MCP_HTTP_PUBLIC_URL, p = c ? yt(c) : void 0, m = new a(n.dbPath ?? o()), h = n.oauthAccessTokenStore ? void 0 : mt(n.oauthStatePath), g = h ?? ut(), _ = h ?? dt(), v = n.oauthAccessTokenStore ?? h ?? ft(), y = Ut(), b = Ht(), x = p !== void 0 || y !== void 0, S = Ve(n.auditEmitter ?? We()), C = /* @__PURE__ */ new Set(), ee = null, w = f();
+	w.disable("x-powered-by"), w.set("trust proxy", "loopback");
+	let T = t(w);
 	await new Promise((e, t) => {
-		w.once("error", t), w.listen({
+		T.once("error", t), T.listen({
 			host: r,
 			port: i
 		}, () => {
-			w.off("error", t), e();
+			T.off("error", t), e();
 		});
 	});
-	let T = p?.href ?? Mn(w, r), E = new URL(T), D = Nn(E, $(w)), ne = new Zt({
+	let E = p?.href ?? In(T, r), D = new URL(E), te = Ln(D, $(T)), ne = new tn({
 		clientsStore: g,
 		codeStore: _,
 		tokenStore: v,
-		publicMcpUrl: T,
+		publicMcpUrl: E,
 		...h ? { refreshTokenStore: h } : {},
 		...y ? { oidc: {
 			config: y,
 			pendingStore: b
 		} } : {}
-	}), re = l(E);
-	C.use(Re({
-		windowMs: un,
-		limit: dn,
+	}), re = l(D);
+	w.use(Re({
+		windowMs: mn,
+		limit: hn,
 		standardHeaders: "draft-8",
 		legacyHeaders: !1,
 		ipv6Subnet: !1
-	})), C.use((e, t, n) => {
-		let r = $(w), i = Fn(e.path);
+	})), w.use((e, t, n) => {
+		let r = $(T), i = zn(e.path);
 		if (i === "/mcp") {
-			if (Sn(e, r, p)) {
-				if (En(e, t, p), e.method === "OPTIONS") {
+			if (En(e, r, p)) {
+				if (An(e, t, p), e.method === "OPTIONS") {
 					t.status(204).send("");
 					return;
 				}
 				return n();
 			}
-			On(e, i, p), t.status(403).type("text/plain").send("Forbidden");
+			Mn(e, i, p), t.status(403).type("text/plain").send("Forbidden");
 			return;
 		}
-		if (Pn(i)) {
-			if (wn(e, r, p)) {
-				if (En(e, t, p), e.method === "OPTIONS") {
+		if (Rn(i)) {
+			if (On(e, r, p)) {
+				if (An(e, t, p), e.method === "OPTIONS") {
 					t.status(204).send("");
 					return;
 				}
 				return n();
 			}
-			On(e, i, p), t.status(403).type("text/plain").send("Forbidden");
+			Mn(e, i, p), t.status(403).type("text/plain").send("Forbidden");
 			return;
 		}
 		n();
-	}), C.use(In(x)), C.get("/oauth/callback", async (e, t) => {
+	}), w.use(Bn(S)), w.get("/oauth/callback", async (e, t) => {
 		let n = e.socket.remoteAddress ?? void 0;
 		if (!y) {
-			x(L("oidc_callback", {
+			S(L("oidc_callback", {
 				outcome: "denied",
 				reason: "oidc_not_configured",
 				remoteAddress: n
@@ -2156,9 +2163,9 @@ async function xn(n = {}) {
 			});
 			return;
 		}
-		let r = await Vt(new URLSearchParams(e.query), b, y, T);
+		let r = await Gt(new URLSearchParams(e.query), b, y, E);
 		if ("status" in r) {
-			x(L("oidc_callback", {
+			S(L("oidc_callback", {
 				outcome: "denied",
 				reason: r.body.error,
 				remoteAddress: n
@@ -2169,12 +2176,12 @@ async function xn(n = {}) {
 			clientId: r.oauthParams.get("client_id") ?? "",
 			redirectUri: r.oauthParams.get("redirect_uri") ?? "",
 			codeChallenge: r.oauthParams.get("code_challenge") ?? "",
-			scopes: Gn(r.oauthParams.get("scope")),
+			scopes: Yn(r.oauthParams.get("scope")),
 			...r.oauthParams.get("resource") ? { resource: r.oauthParams.get("resource") ?? void 0 } : {},
 			expiresAt: Date.now() + 300 * 1e3
 		});
 		if (!a) {
-			x(L("oidc_callback", {
+			S(L("oidc_callback", {
 				outcome: "denied",
 				reason: "temporarily_unavailable",
 				clientId: i,
@@ -2188,99 +2195,99 @@ async function xn(n = {}) {
 		let o = new URL(r.oauthParams.get("redirect_uri") ?? "");
 		o.searchParams.set("code", a);
 		let s = r.oauthParams.get("state");
-		s && o.searchParams.set("state", s), x(L("oidc_callback", {
+		s && o.searchParams.set("state", s), S(L("oidc_callback", {
 			outcome: "success",
 			reason: "code_issued",
 			clientId: i,
 			remoteAddress: n
 		})), t.redirect(302, o.href);
-	}), C.get("/.well-known/oauth-authorization-server", (e, t) => {
-		t.status(200).json(mt({
-			mcpUrl: T,
+	}), w.get("/.well-known/oauth-authorization-server", (e, t) => {
+		t.status(200).json(gt({
+			mcpUrl: E,
 			clientsStore: g
 		}));
-	}), C.get("/.well-known/oauth-protected-resource/mcp", (e, t) => {
-		t.status(200).json(ht(T));
-	}), C.use(u({
+	}), w.get("/.well-known/oauth-protected-resource/mcp", (e, t) => {
+		t.status(200).json(_t(E));
+	}), w.use(u({
 		provider: ne,
-		issuerUrl: D,
-		baseUrl: D,
-		resourceServerUrl: E,
+		issuerUrl: te,
+		baseUrl: te,
+		resourceServerUrl: D,
 		resourceName: Ge,
 		scopesSupported: R,
 		serviceDocumentationUrl: new URL(z),
 		clientRegistrationOptions: { clientSecretExpirySeconds: 0 }
 	}));
-	let O = ee ? s({
+	let O = x ? s({
 		verifier: ne,
 		resourceMetadataUrl: re
-	}) : (e, t, n) => n(), k = ee ? Un(x, v) : (e, t, n) => n();
-	return C.post("/mcp", k, O, async (t, n) => {
-		t.auth && x(L("bearer", {
+	}) : (e, t, n) => n(), k = x ? qn(S, v) : (e, t, n) => n();
+	return w.post("/mcp", k, O, async (t, n) => {
+		t.auth && S(L("bearer", {
 			outcome: "success",
 			clientId: t.auth.clientId,
 			remoteAddress: t.socket.remoteAddress ?? void 0
 		}));
 		let r = e(m), i = new d({ sessionIdGenerator: void 0 }), a = { mcpServer: r };
-		S.add(a);
+		C.add(a);
 		try {
 			await r.connect(i), await i.handleRequest(t, n);
 		} finally {
-			S.delete(a), await r.close();
+			C.delete(a), await r.close();
 		}
-	}), C.all("/mcp", (e, t) => {
+	}), w.all("/mcp", (e, t) => {
 		t.setHeader("Allow", "POST"), t.status(405).type("text/plain").send("Method not allowed");
-	}), C.use((e, t) => {
+	}), w.use((e, t) => {
 		t.status(404).type("text/plain").send("Not found");
 	}), {
-		server: w,
+		server: T,
 		store: m,
-		url: `http://${jn(r)}:${$(w)}/mcp`,
-		close: () => (te ??= (async () => {
-			await Promise.allSettled([...S].map(({ mcpServer: e }) => e.close())), await new Promise((e, t) => {
-				w.close((n) => {
+		url: `http://${Fn(r)}:${$(T)}/mcp`,
+		close: () => (ee ??= (async () => {
+			await Promise.allSettled([...C].map(({ mcpServer: e }) => e.close())), await new Promise((e, t) => {
+				T.close((n) => {
 					if (!n || n.code === "ERR_SERVER_NOT_RUNNING") {
 						e();
 						return;
 					}
 					t(n);
-				}), w.closeAllConnections();
+				}), T.closeAllConnections();
 			}), m.close();
-		})(), te)
+		})(), ee)
 	};
 }
-function Sn(e, t, n) {
-	return Cn(e, t) ? !0 : n ? An(e.headers.host, n) && Tn(e.headers.origin, n) : !1;
+function En(e, t, n) {
+	return Dn(e, t) ? !0 : n ? Pn(e.headers.host, n) && kn(e.headers.origin, n) : !1;
 }
-function Cn(e, t) {
-	return vn(e.socket.remoteAddress) && gn(e.headers.host, t) && _n(e.headers.origin, t);
+function Dn(e, t) {
+	return Sn(e.socket.remoteAddress) && bn(e.headers.host, t) && xn(e.headers.origin, t);
 }
-function wn(e, t, n) {
-	return Cn(e, t) ? !0 : n ? An(e.headers.host, n) && Tn(e.headers.origin, n) : !1;
+function On(e, t, n) {
+	return Dn(e, t) ? !0 : n ? Pn(e.headers.host, n) && kn(e.headers.origin, n) : !1;
 }
-function Tn(e, t) {
+function kn(e, t) {
 	if (!e) return !0;
 	try {
 		let n = new URL(e);
-		return n.origin === t.origin || on.has(n.origin);
+		return n.origin === t.origin || un.has(n.origin);
 	} catch {
 		return !1;
 	}
 }
-function En(e, t, n) {
+function An(e, t, n) {
 	if (!n) return;
-	let r = Dn(e.headers.origin, n);
-	r && (t.setHeader("Access-Control-Allow-Origin", r), t.setHeader("Access-Control-Allow-Methods", "GET,POST,OPTIONS"), t.setHeader("Access-Control-Allow-Headers", e.headers["access-control-request-headers"] ?? sn), t.setHeader("Access-Control-Max-Age", cn), t.setHeader("Vary", "Origin"));
+	let r = jn(e.headers.origin, n);
+	r && (t.setHeader("Access-Control-Allow-Origin", r), t.setHeader("Access-Control-Allow-Methods", "GET,POST,OPTIONS"), t.setHeader("Access-Control-Allow-Headers", e.headers["access-control-request-headers"] ?? dn), t.setHeader("Access-Control-Max-Age", fn), t.setHeader("Vary", "Origin"));
 }
-function Dn(e, t) {
+function jn(e, t) {
 	if (e) try {
 		let n = new URL(e).origin;
-		if (n === t.origin || on.has(n)) return n;
+		if (n === t.origin || un.has(n)) return n;
 	} catch {
 		return;
 	}
 }
-function On(e, t, n) {
+function Mn(e, t, n) {
 	console.warn(JSON.stringify({
 		source: "codemem-mcp-http-guard",
 		timestamp: (/* @__PURE__ */ new Date()).toISOString(),
@@ -2288,50 +2295,50 @@ function On(e, t, n) {
 		reason: "host_or_origin_mismatch",
 		method: e.method,
 		path: t,
-		host: kn(e.headers.host),
-		origin: kn(e.headers.origin),
+		host: Nn(e.headers.host),
+		origin: Nn(e.headers.origin),
 		expectedOrigin: n?.origin,
 		remoteAddress: e.socket.remoteAddress ?? void 0
 	}));
 }
-function kn(e) {
-	return !e || e.length <= ln ? e : `${e.slice(0, ln)}…`;
+function Nn(e) {
+	return !e || e.length <= pn ? e : `${e.slice(0, pn)}…`;
 }
-function An(e, t) {
-	let n = yn(e);
+function Pn(e, t) {
+	let n = Cn(e);
 	if (!n) return !1;
 	let r = t.port ? Number(t.port) : t.protocol === "https:" ? 443 : 80, i = t.protocol === "https:" ? 443 : 80, a = n.port ?? i;
 	return Q(n.host) === Q(t.hostname) && a === r;
 }
 function $(e) {
 	let t = e.address();
-	return !t || typeof t == "string" ? rn : t.port;
+	return !t || typeof t == "string" ? cn : t.port;
 }
-function jn(e) {
+function Fn(e) {
 	return n(e) === 6 ? `[${e}]` : e;
 }
-function Mn(e, t) {
-	return `http://${jn(t)}:${$(e)}/mcp`;
+function In(e, t) {
+	return `http://${Fn(t)}:${$(e)}/mcp`;
 }
-function Nn(e, t) {
+function Ln(e, t) {
 	return e.protocol === "https:" || Z(e.hostname) && Q(e.hostname) !== "::1" ? new URL(e.origin) : new URL(`http://localhost:${t}/`);
 }
-function Pn(e) {
+function Rn(e) {
 	return e === "/register" || e === "/authorize" || e === "/token" || e === "/revoke" || e === "/oauth/callback" || e === "/.well-known/oauth-authorization-server" || e === "/.well-known/oauth-protected-resource/mcp";
 }
-function Fn(e) {
+function zn(e) {
 	return e.length > 1 ? e.replace(/\/+$/, "") : e;
 }
-function In(e) {
+function Bn(e) {
 	return (t, n, r) => {
 		let i = t.path;
-		if (!Ln(i)) return r();
+		if (!Vn(i)) return r();
 		let a, o = n.json.bind(n);
 		n.json = ((e) => (a = e, o(e))), n.on("finish", () => {
 			if (i === "/oauth/callback") return;
-			let r = Rn(i, t);
+			let r = Hn(i, t);
 			if (!r) return;
-			let o = Bn(n, a), s = Hn(t, a);
+			let o = Wn(n, a), s = Kn(t, a);
 			e(L(r, {
 				outcome: o ? "denied" : "success",
 				...o ? { reason: o } : {},
@@ -2341,17 +2348,17 @@ function In(e) {
 		}), r();
 	};
 }
-function Ln(e) {
-	return zn(e) !== null;
+function Vn(e) {
+	return Un(e) !== null;
 }
-function Rn(e, t) {
-	return e === "/token" && t.body?.grant_type === "refresh_token" ? "refresh" : zn(e);
+function Hn(e, t) {
+	return e === "/token" && t.body?.grant_type === "refresh_token" ? "refresh" : Un(e);
 }
-function zn(e) {
+function Un(e) {
 	return e === "/register" ? "registration" : e === "/authorize" ? "authorize" : e === "/token" ? "token" : e === "/revoke" ? "revocation" : null;
 }
-function Bn(e, t) {
-	let n = Vn(t);
+function Wn(e, t) {
+	let n = Gn(t);
 	if (n) return n;
 	let r = e.getHeader("location");
 	if (typeof r == "string") try {
@@ -2360,15 +2367,15 @@ function Bn(e, t) {
 		return;
 	}
 }
-function Vn(e) {
+function Gn(e) {
 	if (typeof e == "object" && e && "error" in e && typeof e.error == "string") return e.error;
 }
-function Hn(e, t) {
+function Kn(e, t) {
 	return typeof t == "object" && t && "client_id" in t && typeof t.client_id == "string" ? t.client_id : (typeof e.body?.client_id == "string" ? e.body.client_id : void 0) || (typeof e.query.client_id == "string" ? e.query.client_id : void 0);
 }
-function Un(e, t) {
+function qn(e, t) {
 	return (n, r, i) => {
-		let a = Wn(n.headers.authorization, t);
+		let a = Jn(n.headers.authorization, t);
 		a && e(L("bearer", {
 			outcome: "denied",
 			reason: a,
@@ -2376,22 +2383,22 @@ function Un(e, t) {
 		})), i();
 	};
 }
-function Wn(e, t) {
+function Jn(e, t) {
 	if (!e) return "missing_authorization_header";
 	let [n, r, i] = e.trim().split(/\s+/);
 	if (!n || !r || i || n.toLowerCase() !== "bearer") return "malformed_authorization_header";
 	let a = t.verifyToken(r);
 	return a.ok ? null : a.reason;
 }
-function Gn(e) {
+function Yn(e) {
 	return e?.split(/\s+/).map((e) => e.trim()).filter(Boolean) ?? [];
 }
-function Kn() {
+function Xn() {
 	let e = process.argv[1];
 	return e ? import.meta.url === i(e).href : !1;
 }
-async function qn() {
-	let e = await xn();
+async function Zn() {
+	let e = await Tn();
 	console.error(`codemem MCP HTTP server listening at ${e.url}`);
 	let t = async () => {
 		try {
@@ -2401,10 +2408,10 @@ async function qn() {
 	};
 	process.on("SIGINT", t), process.on("SIGTERM", t);
 }
-Kn() && qn().catch((e) => {
+Xn() && Zn().catch((e) => {
 	console.error("codemem MCP HTTP server failed to start:", e), process.exit(1);
 });
 //#endregion
-export { nn as DEFAULT_MCP_HTTP_HOST, rn as DEFAULT_MCP_HTTP_PORT, gn as isAllowedMcpHttpRequestHost, _n as isAllowedMcpHttpRequestOrigin, vn as isAllowedMcpHttpRequestRemoteAddress, Z as isLoopbackHost, hn as isUnsafePublicBindAllowed, bn as parseMcpHttpPort, xn as startCodememMcpHttpServer, mn as validateMcpHttpHost };
+export { sn as DEFAULT_MCP_HTTP_HOST, cn as DEFAULT_MCP_HTTP_PORT, bn as isAllowedMcpHttpRequestHost, xn as isAllowedMcpHttpRequestOrigin, Sn as isAllowedMcpHttpRequestRemoteAddress, Z as isLoopbackHost, yn as isUnsafePublicBindAllowed, wn as parseMcpHttpPort, Tn as startCodememMcpHttpServer, vn as validateMcpHttpHost };
 
 //# sourceMappingURL=http.js.map