@codemem/mcp 0.39.1 → 0.40.0

package/dist/http.js

@@ -1,23 +1,23 @@
 #!/usr/bin/env node
-import { t as e } from "./server-pfLtHrsT.js";
-import { createServer as t } from "node:http";
-import { isIP as n, isIPv6 as r } from "node:net";
-import { pathToFileURL as i } from "node:url";
-import { MemoryStore as a, resolveDbPath as o } from "@codemem/core";
-import { requireBearerAuth as s } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
-import { createOAuthMetadata as c, getOAuthProtectedResourceMetadataUrl as l, mcpAuthRouter as u } from "@modelcontextprotocol/sdk/server/auth/router.js";
-import { StreamableHTTPServerTransport as d } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
-import f from "express";
-import { Buffer as p } from "node:buffer";
-import { createHash as m, createHmac as h, createPublicKey as g, randomBytes as _, randomUUID as v, timingSafeEqual as y, verify as b } from "node:crypto";
-import { existsSync as x, mkdirSync as S, readFileSync as C, renameSync as ee, writeFileSync as w } from "node:fs";
-import { chmod as T } from "node:fs/promises";
-import { homedir as E } from "node:os";
-import { dirname as D, join as te } from "node:path";
-import { AccessDeniedError as ne, InvalidClientError as re, InvalidClientMetadataError as O, InvalidGrantError as k, InvalidRequestError as ie, InvalidTokenError as ae, ServerError as oe, TemporarilyUnavailableError as A, UnsupportedResponseTypeError as se } from "@modelcontextprotocol/sdk/server/auth/errors.js";
-import { OAuthProtectedResourceMetadataSchema as ce, OAuthTokensSchema as le } from "@modelcontextprotocol/sdk/shared/auth.js";
+import { n as e, t } from "./server-BshtPXit.js";
+import { createHash as n, createHmac as r, createPublicKey as i, randomBytes as a, randomUUID as o, timingSafeEqual as s, verify as c } from "node:crypto";
+import { createServer as l } from "node:http";
+import { isIP as u, isIPv6 as d } from "node:net";
+import { pathToFileURL as f } from "node:url";
+import { MemoryStore as p, resolveDbPath as m } from "@codemem/core";
+import { requireBearerAuth as h } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
+import { createOAuthMetadata as g, getOAuthProtectedResourceMetadataUrl as ee, mcpAuthRouter as te } from "@modelcontextprotocol/sdk/server/auth/router.js";
+import { StreamableHTTPServerTransport as ne } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import re from "express";
+import { Buffer as _ } from "node:buffer";
+import { existsSync as v, mkdirSync as y, readFileSync as ie, renameSync as b, writeFileSync as x } from "node:fs";
+import { chmod as S } from "node:fs/promises";
+import { homedir as C } from "node:os";
+import { dirname as w, join as T } from "node:path";
+import { AccessDeniedError as E, InvalidClientError as ae, InvalidClientMetadataError as D, InvalidGrantError as O, InvalidRequestError as oe, InvalidTokenError as se, ServerError as ce, TemporarilyUnavailableError as k, UnsupportedResponseTypeError as le } from "@modelcontextprotocol/sdk/server/auth/errors.js";
+import { OAuthProtectedResourceMetadataSchema as ue, OAuthTokensSchema as de } from "@modelcontextprotocol/sdk/shared/auth.js";
 //#region \0rolldown/runtime.js
-var j = (e, t) => () => (t || (e((t = { exports: {} }).exports, t), e = null), t.exports), M = /* @__PURE__ */ j(((e) => {
+var A = (e, t) => () => (t || (e((t = { exports: {} }).exports, t), e = null), t.exports), j = /* @__PURE__ */ A(((e) => {
 	Object.defineProperty(e, "__esModule", { value: !0 }), e.isInSubnet = t, e.isCorrect = n, e.numberToPaddedHex = r, e.stringToPaddedHex = i, e.testBit = a;
 	function t(e) {
 		return this.subnetMask < e.subnetMask ? !1 : this.mask(e.subnetMask) === e.mask();
@@ -39,15 +39,15 @@ var j = (e, t) => () => (t || (e((t = { exports: {} }).exports, t), e = null), t
 		let r = n - t;
 		return e.substring(r, r + 1) === "1";
 	}
-})), ue = /* @__PURE__ */ j(((e) => {
+})), fe = /* @__PURE__ */ A(((e) => {
 	Object.defineProperty(e, "__esModule", { value: !0 }), e.RE_SUBNET_STRING = e.RE_ADDRESS = e.GROUPS = e.BITS = void 0, e.BITS = 32, e.GROUPS = 4, e.RE_ADDRESS = /^(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$/g, e.RE_SUBNET_STRING = /\/\d{1,2}$/;
-})), N = /* @__PURE__ */ j(((e) => {
+})), pe = /* @__PURE__ */ A(((e) => {
 	Object.defineProperty(e, "__esModule", { value: !0 }), e.AddressError = void 0, e.AddressError = class extends Error {
 		constructor(e, t) {
 			super(e), this.name = "AddressError", this.parseMessage = t;
 		}
 	};
-})), de = /* @__PURE__ */ j(((e) => {
+})), me = /* @__PURE__ */ A(((e) => {
 	var t = e && e.__createBinding || (Object.create ? (function(e, t, n, r) {
 		r === void 0 && (r = n);
 		var i = Object.getOwnPropertyDescriptor(t, n);
@@ -73,7 +73,7 @@ var j = (e, t) => () => (t || (e((t = { exports: {} }).exports, t), e = null), t
 		return n(r, e), r;
 	};
 	Object.defineProperty(e, "__esModule", { value: !0 }), e.Address4 = void 0;
-	var i = r(M()), a = r(ue()), o = N();
+	var i = r(j()), a = r(fe()), o = pe();
 	e.Address4 = class e {
 		constructor(e) {
 			this.groups = a.GROUPS, this.parsedAddress = [], this.parsedSubnet = "", this.subnet = "/32", this.subnetMask = 32, this.v4 = !0, this.isCorrect = i.isCorrect(a.BITS), this.isInSubnet = i.isInSubnet, this.address = e;
@@ -181,7 +181,7 @@ var j = (e, t) => () => (t || (e((t = { exports: {} }).exports, t), e = null), t
 			return this.address.replace(a.RE_ADDRESS, `<span class="hover-group group-v4 group-6">${e.slice(0, 2).join(".")}</span>.<span class="hover-group group-v4 group-7">${e.slice(2, 4).join(".")}</span>`);
 		}
 	};
-})), fe = /* @__PURE__ */ j(((e) => {
+})), he = /* @__PURE__ */ A(((e) => {
 	Object.defineProperty(e, "__esModule", { value: !0 }), e.RE_URL_WITH_PORT = e.RE_URL = e.RE_ZONE_STRING = e.RE_SUBNET_STRING = e.RE_BAD_ADDRESS = e.RE_BAD_CHARACTERS = e.TYPES = e.SCOPES = e.GROUPS = e.BITS = void 0, e.BITS = 128, e.GROUPS = 8, e.SCOPES = {
 		0: "Reserved",
 		1: "Interface local",
@@ -215,7 +215,7 @@ var j = (e, t) => () => (t || (e((t = { exports: {} }).exports, t), e = null), t
 		"ff00::/8": "Multicast",
 		"fe80::/10": "Link-local unicast"
 	}, e.RE_BAD_CHARACTERS = /([^0-9a-f:/%])/gi, e.RE_BAD_ADDRESS = /([0-9a-f]{5,}|:{3,}|[^:]:$|^:[^:]|\/$)/gi, e.RE_SUBNET_STRING = /\/\d{1,3}(?=%|$)/, e.RE_ZONE_STRING = /%.*$/, e.RE_URL = /^\[{0,1}([0-9a-f:]+)\]{0,1}/, e.RE_URL_WITH_PORT = /\[([0-9a-f:]+)\]:([0-9]{1,5})/;
-})), pe = /* @__PURE__ */ j(((e) => {
+})), ge = /* @__PURE__ */ A(((e) => {
 	Object.defineProperty(e, "__esModule", { value: !0 }), e.escapeHtml = t, e.spanAllZeroes = n, e.spanAll = r, e.spanLeadingZeroes = a, e.simpleGroup = o;
 	function t(e) {
 		return e.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
@@ -235,7 +235,7 @@ var j = (e, t) => () => (t || (e((t = { exports: {} }).exports, t), e = null), t
 	function o(e, t = 0) {
 		return e.split(":").map((e, n) => /group-v4/.test(e) ? e : `<span class="hover-group group-${n + t}">${i(e)}</span>`);
 	}
-})), me = /* @__PURE__ */ j(((e) => {
+})), _e = /* @__PURE__ */ A(((e) => {
 	var t = e && e.__createBinding || (Object.create ? (function(e, t, n, r) {
 		r === void 0 && (r = n);
 		var i = Object.getOwnPropertyDescriptor(t, n);
@@ -261,7 +261,7 @@ var j = (e, t) => () => (t || (e((t = { exports: {} }).exports, t), e = null), t
 		return n(r, e), r;
 	};
 	Object.defineProperty(e, "__esModule", { value: !0 }), e.ADDRESS_BOUNDARY = void 0, e.groupPossibilities = a, e.padGroup = o, e.simpleRegularExpression = s, e.possibleElisions = c;
-	var i = r(fe());
+	var i = r(he());
 	function a(e) {
 		return `(${e.join("|")})`;
 	}
@@ -289,7 +289,7 @@ var j = (e, t) => () => (t || (e((t = { exports: {} }).exports, t), e = null), t
 		for (let t = 1; t < e - 1; t++) for (let n = 1; n < e - t; n++) o.push(`(0{1,4}:){${n}}:(0{1,4}:){${e - n - t - 1}}0{1,4}`);
 		return a(o);
 	}
-})), he = /* @__PURE__ */ j(((e) => {
+})), ve = /* @__PURE__ */ A(((e) => {
 	var t = e && e.__createBinding || (Object.create ? (function(e, t, n, r) {
 		r === void 0 && (r = n);
 		var i = Object.getOwnPropertyDescriptor(t, n);
@@ -315,7 +315,7 @@ var j = (e, t) => () => (t || (e((t = { exports: {} }).exports, t), e = null), t
 		return n(r, e), r;
 	};
 	Object.defineProperty(e, "__esModule", { value: !0 }), e.Address6 = void 0;
-	var i = r(M()), a = r(ue()), o = r(fe()), s = r(pe()), c = de(), l = me(), u = N(), d = M();
+	var i = r(j()), a = r(fe()), o = r(he()), s = r(ge()), c = me(), l = _e(), u = pe(), d = j();
 	function f(e) {
 		if (!e) throw Error("Assertion failed.");
 	}
@@ -335,7 +335,7 @@ var j = (e, t) => () => (t || (e((t = { exports: {} }).exports, t), e = null), t
 	function g(e) {
 		return parseInt(e, 16).toString(16).padStart(4, "0");
 	}
-	function _(e) {
+	function ee(e) {
 		return e & 255;
 	}
 	e.Address6 = class e {
@@ -561,10 +561,10 @@ var j = (e, t) => () => (t || (e((t = { exports: {} }).exports, t), e = null), t
 			return n;
 		}
 		toUnsignedByteArray() {
-			return this.toByteArray().map(_);
+			return this.toByteArray().map(ee);
 		}
 		static fromByteArray(e) {
-			return this.fromUnsignedByteArray(e.map(_));
+			return this.fromUnsignedByteArray(e.map(ee));
 		}
 		static fromUnsignedByteArray(t) {
 			let n = BigInt("256"), r = BigInt("0"), i = BigInt("1");
@@ -633,7 +633,7 @@ var j = (e, t) => () => (t || (e((t = { exports: {} }).exports, t), e = null), t
 			return new RegExp(this.regularExpressionString(e), "i");
 		}
 	};
-})), ge = (/* @__PURE__ */ j(((e) => {
+})), ye = (/* @__PURE__ */ A(((e) => {
 	var t = e && e.__createBinding || (Object.create ? (function(e, t, n, r) {
 		r === void 0 && (r = n);
 		var i = Object.getOwnPropertyDescriptor(t, n);
@@ -659,37 +659,37 @@ var j = (e, t) => () => (t || (e((t = { exports: {} }).exports, t), e = null), t
 		return n(r, e), r;
 	};
 	Object.defineProperty(e, "__esModule", { value: !0 }), e.v6 = e.AddressError = e.Address6 = e.Address4 = void 0;
-	var i = de();
+	var i = me();
 	Object.defineProperty(e, "Address4", {
 		enumerable: !0,
 		get: function() {
 			return i.Address4;
 		}
 	});
-	var a = he();
+	var a = ve();
 	Object.defineProperty(e, "Address6", {
 		enumerable: !0,
 		get: function() {
 			return a.Address6;
 		}
 	});
-	var o = N();
+	var o = pe();
 	Object.defineProperty(e, "AddressError", {
 		enumerable: !0,
 		get: function() {
 			return o.AddressError;
 		}
-	}), e.v6 = { helpers: r(pe()) };
+	}), e.v6 = { helpers: r(ge()) };
 })))();
-function _e(e, t = 56) {
-	if (r(e)) {
-		let n = new ge.Address6(e);
+function be(e, t = 56) {
+	if (d(e)) {
+		let n = new ye.Address6(e);
 		if (n.is4()) return n.to4().correctForm();
-		if (t) return new ge.Address6(`${e}/${t}`).networkForm();
+		if (t) return new ye.Address6(`${e}/${t}`).networkForm();
 	}
 	return e;
 }
-var ve = class {
+var xe = class {
 	constructor(e) {
 		this.validations = e, this.previous = /* @__PURE__ */ new Map(), this.current = /* @__PURE__ */ new Map(), this.localKeys = !0;
 	}
@@ -732,110 +732,110 @@ var ve = class {
 	clearExpired() {
 		this.previous = this.current, this.current = /* @__PURE__ */ new Map();
 	}
-}, ye = {
+}, Se = {
 	warn(...e) {
 		console.warn(...e.reverse());
 	},
 	error(...e) {
 		console.error(...e.reverse());
 	}
-}, be = [
+}, Ce = [
 	"draft-6",
 	"draft-7",
 	"draft-8"
-], P = (e, t) => {
+], M = (e, t) => {
 	let n;
 	if (t) {
 		let e = Math.ceil((t.getTime() - Date.now()) / 1e3);
 		n = Math.max(0, e);
 	} else n = Math.ceil(e / 1e3);
 	return n;
-}, xe = (e) => {
-	let t = m("sha256");
+}, we = (e) => {
+	let t = n("sha256");
 	t.update(e);
-	let n = t.digest("hex").slice(0, 12);
-	return p.from(n).toString("base64");
-}, Se = (e, t) => {
+	let r = t.digest("hex").slice(0, 12);
+	return _.from(r).toString("base64");
+}, Te = (e, t) => {
 	e.headersSent || (e.setHeader("X-RateLimit-Limit", t.limit.toString()), e.setHeader("X-RateLimit-Remaining", t.remaining.toString()), t.resetTime instanceof Date && (e.setHeader("Date", (/* @__PURE__ */ new Date()).toUTCString()), e.setHeader("X-RateLimit-Reset", Math.ceil(t.resetTime.getTime() / 1e3).toString())));
-}, Ce = (e, t, n) => {
+}, Ee = (e, t, n) => {
 	if (e.headersSent) return;
-	let r = Math.ceil(n / 1e3), i = P(n, t.resetTime);
+	let r = Math.ceil(n / 1e3), i = M(n, t.resetTime);
 	e.setHeader("RateLimit-Policy", `${t.limit};w=${r}`), e.setHeader("RateLimit-Limit", t.limit.toString()), e.setHeader("RateLimit-Remaining", t.remaining.toString()), typeof i == "number" && e.setHeader("RateLimit-Reset", i.toString());
-}, we = (e, t, n) => {
+}, De = (e, t, n) => {
 	if (e.headersSent) return;
-	let r = Math.ceil(n / 1e3), i = P(n, t.resetTime);
+	let r = Math.ceil(n / 1e3), i = M(n, t.resetTime);
 	e.setHeader("RateLimit-Policy", `${t.limit};w=${r}`), e.setHeader("RateLimit", `limit=${t.limit}, remaining=${t.remaining}, reset=${i}`);
-}, Te = (e, t, n, r, i) => {
+}, Oe = (e, t, n, r, i) => {
 	if (e.headersSent) return;
-	let a = Math.ceil(n / 1e3), o = P(n, t.resetTime), s = xe(i), c = `r=${t.remaining}; t=${o}`, l = `q=${t.limit}; w=${a}; pk=:${s}:`;
+	let a = Math.ceil(n / 1e3), o = M(n, t.resetTime), s = we(i), c = `r=${t.remaining}; t=${o}`, l = `q=${t.limit}; w=${a}; pk=:${s}:`;
 	e.append("RateLimit", `"${r}"; ${c}`), e.append("RateLimit-Policy", `"${r}"; ${l}`);
-}, Ee = (e, t, n) => {
+}, ke = (e, t, n) => {
 	if (e.headersSent) return;
-	let r = P(n, t.resetTime);
+	let r = M(n, t.resetTime);
 	e.setHeader("Retry-After", r.toString());
-}, De = (e) => {
+}, Ae = (e) => {
 	let t = {};
 	for (let n of Object.keys(e)) {
 		let r = n;
 		e[r] !== void 0 && (t[r] = e[r]);
 	}
 	return t;
-}, F = class extends Error {
+}, N = class extends Error {
 	constructor(e, t) {
 		let n = `https://express-rate-limit.github.io/${e}/`;
 		super(`${t} See ${n} for more information.`), this.name = this.constructor.name, this.code = e, this.help = n;
 	}
-}, I = class extends F {}, Oe = /* @__PURE__ */ new Set(), ke = /* @__PURE__ */ new WeakMap(), Ae = {
+}, P = class extends N {}, je = /* @__PURE__ */ new Set(), Me = /* @__PURE__ */ new WeakMap(), Ne = {
 	enabled: { default: !0 },
 	disable() {
 		for (let e of Object.keys(this.enabled)) this.enabled[e] = !1;
 	},
 	ip(e) {
-		if (e === void 0) throw new F("ERR_ERL_UNDEFINED_IP_ADDRESS", "An undefined 'request.ip' was detected. This might indicate a misconfiguration or the connection being destroyed prematurely.");
-		if (!n(e)) throw new F("ERR_ERL_INVALID_IP_ADDRESS", `An invalid 'request.ip' (${e}) was detected. Consider passing a custom 'keyGenerator' function to the rate limiter.`);
+		if (e === void 0) throw new N("ERR_ERL_UNDEFINED_IP_ADDRESS", "An undefined 'request.ip' was detected. This might indicate a misconfiguration or the connection being destroyed prematurely.");
+		if (!u(e)) throw new N("ERR_ERL_INVALID_IP_ADDRESS", `An invalid 'request.ip' (${e}) was detected. Consider passing a custom 'keyGenerator' function to the rate limiter.`);
 	},
 	trustProxy(e) {
-		if (e.app.get("trust proxy") === !0) throw new F("ERR_ERL_PERMISSIVE_TRUST_PROXY", "The Express 'trust proxy' setting is true, which allows anyone to trivially bypass IP-based rate limiting.");
+		if (e.app.get("trust proxy") === !0) throw new N("ERR_ERL_PERMISSIVE_TRUST_PROXY", "The Express 'trust proxy' setting is true, which allows anyone to trivially bypass IP-based rate limiting.");
 	},
 	xForwardedForHeader(e) {
-		if (e.headers["x-forwarded-for"] && e.app.get("trust proxy") === !1) throw new F("ERR_ERL_UNEXPECTED_X_FORWARDED_FOR", "The 'X-Forwarded-For' header is set but the Express 'trust proxy' setting is false (default). This could indicate a misconfiguration which would prevent express-rate-limit from accurately identifying users.");
+		if (e.headers["x-forwarded-for"] && e.app.get("trust proxy") === !1) throw new N("ERR_ERL_UNEXPECTED_X_FORWARDED_FOR", "The 'X-Forwarded-For' header is set but the Express 'trust proxy' setting is false (default). This could indicate a misconfiguration which would prevent express-rate-limit from accurately identifying users.");
 	},
 	forwardedHeader(e) {
-		if (e.headers.forwarded && e.ip === e.socket?.remoteAddress) throw new F("ERR_ERL_FORWARDED_HEADER", "The 'Forwarded' header (standardized X-Forwarded-For) is set but currently being ignored. Add a custom keyGenerator to use a value from this header.");
+		if (e.headers.forwarded && e.ip === e.socket?.remoteAddress) throw new N("ERR_ERL_FORWARDED_HEADER", "The 'Forwarded' header (standardized X-Forwarded-For) is set but currently being ignored. Add a custom keyGenerator to use a value from this header.");
 	},
 	positiveHits(e) {
-		if (typeof e != "number" || e < 1 || e !== Math.round(e)) throw new F("ERR_ERL_INVALID_HITS", `The totalHits value returned from the store must be a positive integer, got ${e}`);
+		if (typeof e != "number" || e < 1 || e !== Math.round(e)) throw new N("ERR_ERL_INVALID_HITS", `The totalHits value returned from the store must be a positive integer, got ${e}`);
 	},
 	unsharedStore(e) {
-		if (Oe.has(e)) {
+		if (je.has(e)) {
 			let t = e?.localKeys ? "" : " (with a unique prefix)";
-			throw new F("ERR_ERL_STORE_REUSE", `A Store instance must not be shared across multiple rate limiters. Create a new instance of ${e.constructor.name}${t} for each limiter instead.`);
+			throw new N("ERR_ERL_STORE_REUSE", `A Store instance must not be shared across multiple rate limiters. Create a new instance of ${e.constructor.name}${t} for each limiter instead.`);
 		}
-		Oe.add(e);
+		je.add(e);
 	},
 	singleCount(e, t, n) {
-		let r = ke.get(e);
-		r || (r = /* @__PURE__ */ new Map(), ke.set(e, r));
+		let r = Me.get(e);
+		r || (r = /* @__PURE__ */ new Map(), Me.set(e, r));
 		let i = t.localKeys ? t : t.constructor.name, a = r.get(i);
 		a || (a = [], r.set(i, a));
 		let o = `${t.prefix ?? ""}${n}`;
-		if (a.includes(o)) throw new F("ERR_ERL_DOUBLE_COUNT", `The hit count for ${n} was incremented more than once for a single request.`);
+		if (a.includes(o)) throw new N("ERR_ERL_DOUBLE_COUNT", `The hit count for ${n} was incremented more than once for a single request.`);
 		a.push(o);
 	},
 	limit(e) {
-		if (e === 0) throw new I("WRN_ERL_MAX_ZERO", "Setting limit or max to 0 disables rate limiting in express-rate-limit v6 and older, but will cause all requests to be blocked in v7");
+		if (e === 0) throw new P("WRN_ERL_MAX_ZERO", "Setting limit or max to 0 disables rate limiting in express-rate-limit v6 and older, but will cause all requests to be blocked in v7");
 	},
 	draftPolliHeaders(e) {
-		if (e) throw new I("WRN_ERL_DEPRECATED_DRAFT_POLLI_HEADERS", "The draft_polli_ratelimit_headers configuration option is deprecated and has been removed in express-rate-limit v7, please set standardHeaders: 'draft-6' instead.");
+		if (e) throw new P("WRN_ERL_DEPRECATED_DRAFT_POLLI_HEADERS", "The draft_polli_ratelimit_headers configuration option is deprecated and has been removed in express-rate-limit v7, please set standardHeaders: 'draft-6' instead.");
 	},
 	onLimitReached(e) {
-		if (e) throw new I("WRN_ERL_DEPRECATED_ON_LIMIT_REACHED", "The onLimitReached configuration option is deprecated and has been removed in express-rate-limit v7.");
+		if (e) throw new P("WRN_ERL_DEPRECATED_ON_LIMIT_REACHED", "The onLimitReached configuration option is deprecated and has been removed in express-rate-limit v7.");
 	},
 	headersDraftVersion(e) {
-		if (typeof e != "string" || !be.includes(e)) throw new F("ERR_ERL_HEADERS_UNSUPPORTED_DRAFT_VERSION", `standardHeaders: only the following versions of the IETF draft specification are supported: ${be.join(", ")}.`);
+		if (typeof e != "string" || !Ce.includes(e)) throw new N("ERR_ERL_HEADERS_UNSUPPORTED_DRAFT_VERSION", `standardHeaders: only the following versions of the IETF draft specification are supported: ${Ce.join(", ")}.`);
 	},
 	headersResetTime(e) {
-		if (!e) throw new F("ERR_ERL_HEADERS_NO_RESET", "standardHeaders:  'draft-7' requires a 'resetTime', but the store did not provide one. The 'windowMs' value will be used instead, which may cause clients to wait longer than necessary.");
+		if (!e) throw new N("ERR_ERL_HEADERS_NO_RESET", "standardHeaders:  'draft-7' requires a 'resetTime', but the store did not provide one. The 'windowMs' value will be used instead, which may cause clients to wait longer than necessary.");
 	},
 	knownOptions(e) {
 		if (!e) return;
@@ -862,54 +862,54 @@ var ve = class {
 			passOnStoreError: !0,
 			logger: !0
 		}).concat("draft_polli_ratelimit_headers", "delayAfter", "delayMs", "maxDelayMs");
-		for (let n of Object.keys(e)) if (!t.includes(n)) throw new F("ERR_ERL_UNKNOWN_OPTION", `Unexpected configuration option: ${n}`);
+		for (let n of Object.keys(e)) if (!t.includes(n)) throw new N("ERR_ERL_UNKNOWN_OPTION", `Unexpected configuration option: ${n}`);
 	},
 	validationsConfig() {
 		let e = Object.keys(this).filter((e) => !["enabled", "disable"].includes(e));
 		e.push("default");
-		for (let t of Object.keys(this.enabled)) if (!e.includes(t)) throw new F("ERR_ERL_UNKNOWN_VALIDATION", `options.validate.${t} is not recognized. Supported validate options are: ${e.join(", ")}.`);
+		for (let t of Object.keys(this.enabled)) if (!e.includes(t)) throw new N("ERR_ERL_UNKNOWN_VALIDATION", `options.validate.${t} is not recognized. Supported validate options are: ${e.join(", ")}.`);
 	},
 	creationStack(e) {
 		let { stack: t } = /* @__PURE__ */ Error("express-rate-limit validation check (set options.validate.creationStack=false to disable)");
-		if (t?.includes("Layer.handle [as handle_request]") || t?.includes("Layer.handleRequest")) throw e.localKeys ? new F("ERR_ERL_CREATED_IN_REQUEST_HANDLER", "express-rate-limit instance should be created at app initialization, not when responding to a request.") : new F("ERR_ERL_CREATED_IN_REQUEST_HANDLER", "express-rate-limit instance should *usually* be created at app initialization, not when responding to a request.");
+		if (t?.includes("Layer.handle [as handle_request]") || t?.includes("Layer.handleRequest")) throw e.localKeys ? new N("ERR_ERL_CREATED_IN_REQUEST_HANDLER", "express-rate-limit instance should be created at app initialization, not when responding to a request.") : new N("ERR_ERL_CREATED_IN_REQUEST_HANDLER", "express-rate-limit instance should *usually* be created at app initialization, not when responding to a request.");
 	},
 	ipv6Subnet(e) {
-		if (e !== !1 && (!Number.isInteger(e) || e < 32 || e > 64)) throw new F("ERR_ERL_IPV6_SUBNET", `Unexpected ipv6Subnet value: ${e}. Expected an integer between 32 and 64 (usually 48-64).`);
+		if (e !== !1 && (!Number.isInteger(e) || e < 32 || e > 64)) throw new N("ERR_ERL_IPV6_SUBNET", `Unexpected ipv6Subnet value: ${e}. Expected an integer between 32 and 64 (usually 48-64).`);
 	},
 	ipv6SubnetOrKeyGenerator(e) {
-		if (e.ipv6Subnet !== void 0 && e.keyGenerator) throw new F("ERR_ERL_IPV6SUBNET_OR_KEYGENERATOR", "Incompatible options: the 'ipv6Subnet' option is ignored when a custom 'keyGenerator' function is also set.");
+		if (e.ipv6Subnet !== void 0 && e.keyGenerator) throw new N("ERR_ERL_IPV6SUBNET_OR_KEYGENERATOR", "Incompatible options: the 'ipv6Subnet' option is ignored when a custom 'keyGenerator' function is also set.");
 	},
 	keyGeneratorIpFallback(e) {
 		if (!e) return;
 		let t = e.toString();
-		if ((t.includes("req.ip") || t.includes("request.ip")) && !t.includes("ipKeyGenerator")) throw new F("ERR_ERL_KEY_GEN_IPV6", "Custom keyGenerator appears to use request IP without calling the ipKeyGenerator helper function for IPv6 addresses. This could allow IPv6 users to bypass limits.");
+		if ((t.includes("req.ip") || t.includes("request.ip")) && !t.includes("ipKeyGenerator")) throw new N("ERR_ERL_KEY_GEN_IPV6", "Custom keyGenerator appears to use request IP without calling the ipKeyGenerator helper function for IPv6 addresses. This could allow IPv6 users to bypass limits.");
 	},
 	windowMs(e) {
 		let t = 2 ** 31 - 1;
-		if (typeof e != "number" || Number.isNaN(e) || e < 1 || e > t) throw new F("ERR_ERL_WINDOW_MS", `Invalid windowMs value: ${e}${typeof e == "number" ? "" : ` (${typeof e})`}, must be a number between 1 and ${t} when using the default MemoryStore`);
+		if (typeof e != "number" || Number.isNaN(e) || e < 1 || e > t) throw new N("ERR_ERL_WINDOW_MS", `Invalid windowMs value: ${e}${typeof e == "number" ? "" : ` (${typeof e})`}, must be a number between 1 and ${t} when using the default MemoryStore`);
 	}
 };
-function je(e) {
+function Pe(e) {
 	if (typeof e != "object" || typeof e.error != "function" || typeof e.warn != "function") throw TypeError("Provided logger does not implement the Logger interface");
 }
-var Me = (e, t) => {
-	je(t);
+var Fe = (e, t) => {
+	Pe(t);
 	let n;
 	n = typeof e == "boolean" ? { default: e } : {
 		default: !0,
 		...e
 	};
 	let r = { enabled: n };
-	for (let [e, i] of Object.entries(Ae)) typeof i == "function" && (r[e] = (...a) => {
+	for (let [e, i] of Object.entries(Ne)) typeof i == "function" && (r[e] = (...a) => {
 		if (n[e] ?? n.default) try {
 			i.apply(r, a);
 		} catch (e) {
-			e instanceof I ? t.warn(e) : t.error(e);
+			e instanceof P ? t.warn(e) : t.error(e);
 		}
 	});
 	return r;
-}, Ne = (e) => typeof e.incr == "function" && typeof e.increment != "function", Pe = (e) => {
-	if (!Ne(e)) return e;
+}, Ie = (e) => typeof e.incr == "function" && typeof e.increment != "function", Le = (e) => {
+	if (!Ie(e)) return e;
 	let t = e;
 	class n {
 		async increment(e) {
@@ -934,26 +934,26 @@ var Me = (e, t) => {
 		}
 	}
 	return new n();
-}, Fe = (e) => {
+}, Re = (e) => {
 	let { validations: t, ...n } = e;
 	return {
 		...n,
 		validate: t.enabled
 	};
-}, Ie = (e) => {
-	let t = De(e), n = e.logger ?? ye, i = Me(t?.validate ?? !0, n);
-	i.validationsConfig(), i.knownOptions(e), i.draftPolliHeaders(t.draft_polli_ratelimit_headers), i.onLimitReached(t.onLimitReached), t.ipv6Subnet !== void 0 && typeof t.ipv6Subnet != "function" && i.ipv6Subnet(t.ipv6Subnet), i.keyGeneratorIpFallback(t.keyGenerator), i.ipv6SubnetOrKeyGenerator(t);
-	let a = t.standardHeaders ?? !1;
-	a === !0 && (a = "draft-6");
-	let o = {
+}, ze = (e) => {
+	let t = Ae(e), n = e.logger ?? Se, r = Fe(t?.validate ?? !0, n);
+	r.validationsConfig(), r.knownOptions(e), r.draftPolliHeaders(t.draft_polli_ratelimit_headers), r.onLimitReached(t.onLimitReached), t.ipv6Subnet !== void 0 && typeof t.ipv6Subnet != "function" && r.ipv6Subnet(t.ipv6Subnet), r.keyGeneratorIpFallback(t.keyGenerator), r.ipv6SubnetOrKeyGenerator(t);
+	let i = t.standardHeaders ?? !1;
+	i === !0 && (i = "draft-6");
+	let a = {
 		windowMs: 60 * 1e3,
 		limit: e.max ?? 5,
 		message: "Too many requests, please try again later.",
 		statusCode: 429,
 		legacyHeaders: e.headers ?? !0,
 		identifier(e, t) {
-			let n = "", { limit: r } = e[o.requestPropertyName], i = o.windowMs / 1e3, a = o.windowMs / (1e3 * 60), s = o.windowMs / (1e3 * 60 * 60), c = o.windowMs / (1e3 * 60 * 60 * 24);
-			return n = i < 60 ? `${i}sec` : a < 60 ? `${a}min` : s < 24 ? `${s}hr${s > 1 ? "s" : ""}` : `${c}day${c > 1 ? "s" : ""}`, `${r}-in-${n}`;
+			let n = "", { limit: r } = e[a.requestPropertyName], i = a.windowMs / 1e3, o = a.windowMs / (1e3 * 60), s = a.windowMs / (1e3 * 60 * 60), c = a.windowMs / (1e3 * 60 * 60 * 24);
+			return n = i < 60 ? `${i}sec` : o < 60 ? `${o}min` : s < 24 ? `${s}hr${s > 1 ? "s" : ""}` : `${c}day${c > 1 ? "s" : ""}`, `${r}-in-${n}`;
 		},
 		requestPropertyName: "rateLimit",
 		skipFailedRequests: !1,
@@ -961,40 +961,40 @@ var Me = (e, t) => {
 		requestWasSuccessful: (e, t) => t.statusCode < 400,
 		skip: (e, t) => !1,
 		async keyGenerator(e, t) {
-			i.ip(e.ip), i.trustProxy(e), i.xForwardedForHeader(e), i.forwardedHeader(e);
-			let n = e.ip, a = 56;
-			return r(n) && (a = typeof o.ipv6Subnet == "function" ? await o.ipv6Subnet(e, t) : o.ipv6Subnet, typeof o.ipv6Subnet == "function" && i.ipv6Subnet(a)), _e(n, a);
+			r.ip(e.ip), r.trustProxy(e), r.xForwardedForHeader(e), r.forwardedHeader(e);
+			let n = e.ip, i = 56;
+			return d(n) && (i = typeof a.ipv6Subnet == "function" ? await a.ipv6Subnet(e, t) : a.ipv6Subnet, typeof a.ipv6Subnet == "function" && r.ipv6Subnet(i)), be(n, i);
 		},
 		ipv6Subnet: 56,
 		async handler(e, t, n, r) {
-			t.status(o.statusCode);
-			let i = typeof o.message == "function" ? await o.message(e, t) : o.message;
+			t.status(a.statusCode);
+			let i = typeof a.message == "function" ? await a.message(e, t) : a.message;
 			t.writableEnded || t.send(i);
 		},
 		passOnStoreError: !1,
 		...t,
-		standardHeaders: a,
-		store: Pe(t.store ?? new ve(i)),
-		validations: i,
+		standardHeaders: i,
+		store: Le(t.store ?? new xe(r)),
+		validations: r,
 		logger: n
 	};
-	if (typeof o.store.increment != "function" || typeof o.store.decrement != "function" || typeof o.store.resetKey != "function" || o.store.resetAll !== void 0 && typeof o.store.resetAll != "function" || o.store.init !== void 0 && typeof o.store.init != "function") throw TypeError("An invalid store was passed. Please ensure that the store is a class that implements the `Store` interface.");
-	return o;
-}, Le = (e) => async (t, n, r) => {
+	if (typeof a.store.increment != "function" || typeof a.store.decrement != "function" || typeof a.store.resetKey != "function" || a.store.resetAll !== void 0 && typeof a.store.resetAll != "function" || a.store.init !== void 0 && typeof a.store.init != "function") throw TypeError("An invalid store was passed. Please ensure that the store is a class that implements the `Store` interface.");
+	return a;
+}, Be = (e) => async (t, n, r) => {
 	try {
 		await Promise.resolve(e(t, n, r)).catch(r);
 	} catch (e) {
 		r(e);
 	}
-}, Re = (e) => {
-	let t = Ie(e ?? {}), n = Fe(t);
+}, Ve = (e) => {
+	let t = ze(e ?? {}), n = Re(t);
 	if (t.validations.creationStack(t.store), t.validations.unsharedStore(t.store), typeof t.store.init == "function") try {
 		let e = t.store.init(n);
 		e instanceof Promise && e.catch((e) => t.logger.error(e, "express-rate-limit: async error during store initialization."));
 	} catch (e) {
 		t.logger.error(e, "express-rate-limit: error during store initialization.");
 	}
-	let r = Le(async (e, r, i) => {
+	let r = Be(async (e, r, i) => {
 		let a = t.skipFailedRequests && new Promise((e) => r.once("close", e)), o = (t.skipFailedRequests || t.skipSuccessfulRequests) && new Promise((e) => r.once("finish", e)), s = t.skipFailedRequests && new Promise((e) => r.once("error", e));
 		if (await t.skip(e, r)) {
 			i();
@@ -1025,16 +1025,16 @@ var Me = (e, t) => {
 			configurable: !1,
 			enumerable: !1,
 			value: u
-		}), c[t.requestPropertyName] = p, t.legacyHeaders && !r.headersSent && Se(r, p), t.standardHeaders && !r.headersSent) switch (t.standardHeaders) {
+		}), c[t.requestPropertyName] = p, t.legacyHeaders && !r.headersSent && Te(r, p), t.standardHeaders && !r.headersSent) switch (t.standardHeaders) {
 			case "draft-6":
-				Ce(r, p, t.windowMs);
+				Ee(r, p, t.windowMs);
 				break;
 			case "draft-7":
-				t.validations.headersResetTime(p.resetTime), we(r, p, t.windowMs);
+				t.validations.headersResetTime(p.resetTime), De(r, p, t.windowMs);
 				break;
 			case "draft-8": {
 				let n = await (typeof t.identifier == "function" ? t.identifier(e, r) : t.identifier);
-				t.validations.headersResetTime(p.resetTime), Te(r, p, t.windowMs, n, l);
+				t.validations.headersResetTime(p.resetTime), Oe(r, p, t.windowMs, n, l);
 				break;
 			}
 			default:
@@ -1056,7 +1056,7 @@ var Me = (e, t) => {
 			});
 		}
 		if (t.validations.disable(), u > f) {
-			(t.legacyHeaders || t.standardHeaders) && Ee(r, p, t.windowMs), t.handler(e, r, i, n);
+			(t.legacyHeaders || t.standardHeaders) && ke(r, p, t.windowMs), t.handler(e, r, i, n);
 			return;
 		}
 		i();
@@ -1064,7 +1064,7 @@ var Me = (e, t) => {
 	return r.resetKey = t.store.resetKey.bind(t.store), r.getKey = typeof t.store.get == "function" ? t.store.get.bind(t.store) : () => {
 		throw Error("The current store does not support the get/getKey method");
 	}, r;
-}, ze = new Set([
+}, He = new Set([
 	"token",
 	"accesstoken",
 	"refreshtoken",
@@ -1077,11 +1077,11 @@ var Me = (e, t) => {
 	"password",
 	"secret"
 ]);
-function Be(e) {
+function Ue(e) {
 	return e.toLowerCase().replace(/[^a-z0-9]/g, "");
 }
-function L(e, t) {
-	for (let e of Object.keys(t)) if (ze.has(Be(e))) throw Error(`OAuth audit event must not carry forbidden field: ${e}`);
+function F(e, t) {
+	for (let e of Object.keys(t)) if (He.has(Ue(e))) throw Error(`OAuth audit event must not carry forbidden field: ${e}`);
 	let { now: n, ...r } = t;
 	return {
 		kind: e,
@@ -1089,7 +1089,7 @@ function L(e, t) {
 		...r
 	};
 }
-function Ve(e) {
+function We(e) {
 	let t = !1;
 	return (n) => {
 		try {
@@ -1099,7 +1099,7 @@ function Ve(e) {
 		}
 	};
 }
-function He(e = process.stderr) {
+function Ge(e = process.stderr) {
 	return (t) => {
 		e.write(`${JSON.stringify({
 			source: "codemem-mcp-oauth-audit",
@@ -1107,28 +1107,28 @@ function He(e = process.stderr) {
 		})}\n`);
 	};
 }
-function Ue() {
+function Ke() {
 	return () => {};
 }
-function We(e = process.env.CODEMEM_MCP_AUDIT) {
+function qe(e = process.env.CODEMEM_MCP_AUDIT) {
 	let t = e?.trim().toLowerCase();
-	return t === "0" || t === "false" || t === "no" ? Ue() : He();
+	return t === "0" || t === "false" || t === "no" ? Ke() : Ge();
 }
-var Ge = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github.com/kunickiaj/codemem#readme", Ke = "https://claude.ai/api/mcp/auth_callback", qe = "https://chatgpt.com/connector_platform_oauth_redirect", Je = new Set([
+var Je = "codemem MCP", I = ["memory:read", "memory:write"], L = "https://github.com/kunickiaj/codemem#readme", Ye = "https://claude.ai/api/mcp/auth_callback", Xe = "https://chatgpt.com/connector_platform_oauth_redirect", Ze = new Set([
 	"localhost",
 	"127.0.0.1",
 	"::1"
-]), Ye = new Set(["authorization_code", "refresh_token"]), Xe = new Set(["code"]), B = 3600, V = 720 * 60 * 60, Ze = 100, Qe = 100, $e = 100, et = 32, tt = 43, nt = /^[A-Za-z0-9_-]{43}$/, rt = /^[A-Za-z0-9_-]{43}$/, it = /^[A-Za-z0-9_-]{1,128}$/, at = class {
+]), Qe = new Set(["authorization_code", "refresh_token"]), $e = new Set(["code"]), R = 3600, z = 720 * 60 * 60, et = 100, tt = 100, nt = 100, rt = 32, it = 43, at = /^[A-Za-z0-9_-]{43}$/, ot = /^[A-Za-z0-9_-]{43}$/, st = /^[A-Za-z0-9_-]{1,128}$/, ct = class {
 	#e = /* @__PURE__ */ new Map();
 	getClient(e) {
 		return this.#e.get(e);
 	}
 	registerClient(e) {
-		let t = xt(e.redirect_uris);
-		if (t) throw new O(t);
-		if (e.client_secret || e.token_endpoint_auth_method !== "none") throw new O("Only public clients with token_endpoint_auth_method=none are supported");
-		if (e.grant_types && !H(e.grant_types, Ye)) throw new O("Only authorization_code and refresh_token grant_types are supported");
-		if (e.response_types && !H(e.response_types, Xe)) throw new O("Only code response_type is supported");
+		let t = wt(e.redirect_uris);
+		if (t) throw new D(t);
+		if (e.client_secret || e.token_endpoint_auth_method !== "none") throw new D("Only public clients with token_endpoint_auth_method=none are supported");
+		if (e.grant_types && !B(e.grant_types, Qe)) throw new D("Only authorization_code and refresh_token grant_types are supported");
+		if (e.response_types && !B(e.response_types, $e)) throw new D("Only code response_type is supported");
 		if (this.#e.size >= 100) {
 			let e = this.#e.keys().next().value;
 			e && this.#e.delete(e);
@@ -1138,16 +1138,16 @@ var Ge = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github
 			token_endpoint_auth_method: "none",
 			grant_types: e.grant_types ?? ["authorization_code", "refresh_token"],
 			response_types: e.response_types ?? ["code"],
-			client_id: v(),
+			client_id: o(),
 			client_id_issued_at: Math.floor(Date.now() / 1e3)
 		};
 		return this.#e.set(n.client_id, n), n;
 	}
-}, ot = class {
+}, lt = class {
 	#e = /* @__PURE__ */ new Map();
 	issueCode(e, t = Date.now()) {
-		if (this.#t(t), this.#e.size >= Ze) return;
-		let n = v();
+		if (this.#t(t), this.#e.size >= et) return;
+		let n = o();
 		return this.#e.set(n, {
 			...e,
 			used: !1
@@ -1164,35 +1164,35 @@ var Ge = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github
 	#t(e) {
 		for (let [t, n] of this.#e) n.expiresAt <= e && this.#e.delete(t);
 	}
-}, st = class {
+}, ut = class {
 	#e = /* @__PURE__ */ new Map();
-	#t = _(32);
+	#t = a(32);
 	issueToken(e, t = Date.now(), n, r, i = []) {
-		if (this.#n(t), this.#e.size >= Qe) return;
-		let a = _(et), o = kt(a, this.#t);
-		return this.#e.set(o, {
+		if (this.#n(t), this.#e.size >= tt) return;
+		let o = a(rt), s = K(o, this.#t);
+		return this.#e.set(s, {
 			clientId: e,
 			grantId: r,
 			scopes: [...i],
 			resource: n,
-			tokenHash: o,
+			tokenHash: s,
 			issuedAt: t,
-			expiresAt: t + B * 1e3,
+			expiresAt: t + R * 1e3,
 			lastUsedAt: null,
 			revokedAt: null
 		}), {
-			token: a.toString("base64url"),
-			expiresIn: B
+			token: o.toString("base64url"),
+			expiresIn: R
 		};
 	}
 	verifyToken(e, t = Date.now()) {
-		let n = W(e);
+		let n = H(e);
 		if (!n) return {
 			ok: !1,
 			reason: "unknown_token"
 		};
-		let r = kt(n, this.#t), i = this.#e.get(r);
-		return !i || !J(i.tokenHash, r) ? {
+		let r = K(n, this.#t), i = this.#e.get(r);
+		return !i || !q(i.tokenHash, r) ? {
 			ok: !1,
 			reason: "unknown_token"
 		} : i.revokedAt === null ? i.expiresAt <= t ? {
@@ -1207,10 +1207,10 @@ var Ge = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github
 		};
 	}
 	revokeToken(e, t = Date.now()) {
-		let n = W(e);
+		let n = H(e);
 		if (!n) return !1;
-		let r = kt(n, this.#t), i = this.#e.get(r);
-		return !i || !J(i.tokenHash, r) ? !1 : (i.revokedAt === null && (i.revokedAt = t), !0);
+		let r = K(n, this.#t), i = this.#e.get(r);
+		return !i || !q(i.tokenHash, r) ? !1 : (i.revokedAt === null && (i.revokedAt = t), !0);
 	}
 	revokeTokensForGrant(e, t = Date.now()) {
 		let n = 0;
@@ -1220,24 +1220,24 @@ var Ge = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github
 	#n(e) {
 		for (let [t, n] of this.#e) (n.expiresAt <= e || n.revokedAt !== null) && this.#e.delete(t);
 	}
-}, ct = class {
+}, dt = class {
 	#e = /* @__PURE__ */ new Map();
 	#t = /* @__PURE__ */ new Map();
 	#n = /* @__PURE__ */ new Map();
-	#r = _(32);
+	#r = a(32);
 	issueGrant(e, t = Date.now()) {
-		if (this.#i(t), this.#e.size >= $e) return;
-		let n = G(), r = K(n, this.#r);
+		if (this.#i(t), this.#e.size >= nt) return;
+		let n = U(), r = W(n, this.#r);
 		if (!r) return;
 		let i = {
-			grantId: v(),
+			grantId: o(),
 			clientId: e.clientId,
 			scopes: [...e.scopes ?? []],
 			resource: e.resource,
 			currentRefreshTokenHash: r,
 			previousRefreshTokenHash: null,
 			issuedAt: t,
-			expiresAt: t + V * 1e3,
+			expiresAt: t + z * 1e3,
 			rotatedAt: null,
 			revokedAt: null
 		};
@@ -1247,11 +1247,11 @@ var Ge = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github
 				scopes: [...i.scopes]
 			},
 			refreshToken: n,
-			expiresIn: V
+			expiresIn: z
 		};
 	}
 	rotateRefreshToken(e, t, n = {}, r = Date.now()) {
-		let i = K(t, this.#r);
+		let i = W(t, this.#r);
 		if (!i) return {
 			ok: !1,
 			reason: "unknown_refresh_token"
@@ -1281,7 +1281,7 @@ var Ge = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github
 			reason: "client_mismatch",
 			grantId: a
 		};
-		if (!jt(n.scopes ?? o.scopes, o.scopes)) return {
+		if (!Nt(n.scopes ?? o.scopes, o.scopes)) return {
 			ok: !1,
 			reason: "scope_mismatch",
 			grantId: a
@@ -1291,13 +1291,13 @@ var Ge = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github
 			reason: "resource_mismatch",
 			grantId: a
 		};
-		let s = J(o.currentRefreshTokenHash, i), c = o.previousRefreshTokenHash !== null && J(o.previousRefreshTokenHash, i);
+		let s = q(o.currentRefreshTokenHash, i), c = o.previousRefreshTokenHash !== null && q(o.previousRefreshTokenHash, i);
 		if (!s && !c) return this.revokeGrant(a, r), {
 			ok: !1,
 			reason: "refresh_token_replay",
 			grantId: a
 		};
-		let l = G(), u = K(l, this.#r);
+		let l = U(), u = W(l, this.#r);
 		return u ? (o.scopes = [...n.scopes ?? o.scopes], o.previousRefreshTokenHash = s ? o.currentRefreshTokenHash : null, o.currentRefreshTokenHash = u, o.rotatedAt = r, this.#t.set(u, a), this.#n.get(a)?.add(u), {
 			ok: !0,
 			grant: {
@@ -1312,7 +1312,7 @@ var Ge = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github
 		};
 	}
 	revokeRefreshToken(e, t = Date.now()) {
-		let n = K(e, this.#r);
+		let n = W(e, this.#r);
 		if (!n) return;
 		let r = this.#t.get(n);
 		if (r) return this.revokeGrant(r, t), r;
@@ -1333,7 +1333,7 @@ var Ge = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github
 		}
 		this.#t.delete(e.currentRefreshTokenHash), e.previousRefreshTokenHash && this.#t.delete(e.previousRefreshTokenHash);
 	}
-}, lt = class {
+}, ft = class {
 	#e;
 	#t = /* @__PURE__ */ new Map();
 	#n = /* @__PURE__ */ new Map();
@@ -1341,18 +1341,18 @@ var Ge = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github
 	#i = /* @__PURE__ */ new Map();
 	#a = /* @__PURE__ */ new Map();
 	#o = /* @__PURE__ */ new Map();
-	constructor(e = ht()) {
+	constructor(e = vt()) {
 		this.#e = e, this.#s();
 	}
 	getClient(e) {
 		return this.#n.get(e);
 	}
 	registerClient(e) {
-		let t = xt(e.redirect_uris);
-		if (t) throw new O(t);
-		if (e.client_secret || e.token_endpoint_auth_method !== "none") throw new O("Only public clients with token_endpoint_auth_method=none are supported");
-		if (e.grant_types && !H(e.grant_types, Ye)) throw new O("Only authorization_code and refresh_token grant_types are supported");
-		if (e.response_types && !H(e.response_types, Xe)) throw new O("Only code response_type is supported");
+		let t = wt(e.redirect_uris);
+		if (t) throw new D(t);
+		if (e.client_secret || e.token_endpoint_auth_method !== "none") throw new D("Only public clients with token_endpoint_auth_method=none are supported");
+		if (e.grant_types && !B(e.grant_types, Qe)) throw new D("Only authorization_code and refresh_token grant_types are supported");
+		if (e.response_types && !B(e.response_types, $e)) throw new D("Only code response_type is supported");
 		if (this.#u(Date.now()), this.#n.size >= 100) {
 			let e = this.#n.keys().next().value;
 			e && this.#n.delete(e);
@@ -1362,14 +1362,14 @@ var Ge = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github
 			token_endpoint_auth_method: "none",
 			grant_types: e.grant_types ?? ["authorization_code", "refresh_token"],
 			response_types: e.response_types ?? ["code"],
-			client_id: v(),
+			client_id: o(),
 			client_id_issued_at: Math.floor(Date.now() / 1e3)
 		};
 		return this.#n.set(n.client_id, n), this.#c(), n;
 	}
 	issueCode(e, t = Date.now()) {
-		if (this.#l(t), this.#t.size >= Ze) return;
-		let n = v();
+		if (this.#l(t), this.#t.size >= et) return;
+		let n = o();
 		return this.#t.set(n, {
 			...e,
 			used: !1
@@ -1384,8 +1384,8 @@ var Ge = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github
 		if (!(!t || t.used)) return t.used = !0, t;
 	}
 	issueToken(e, t = Date.now(), n, r, i = []) {
-		if (this.#u(t), this.#r.size >= Qe) return;
-		let a = G(), o = q(a);
+		if (this.#u(t), this.#r.size >= tt) return;
+		let a = U(), o = G(a);
 		if (o) return this.#r.set(o, {
 			clientId: e,
 			grantId: r,
@@ -1393,22 +1393,22 @@ var Ge = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github
 			resource: n,
 			tokenHash: o,
 			issuedAt: t,
-			expiresAt: t + B * 1e3,
+			expiresAt: t + R * 1e3,
 			lastUsedAt: null,
 			revokedAt: null
 		}), this.#c(), {
 			token: a,
-			expiresIn: B
+			expiresIn: R
 		};
 	}
 	verifyToken(e, t = Date.now()) {
-		let n = q(e);
+		let n = G(e);
 		if (!n) return {
 			ok: !1,
 			reason: "unknown_token"
 		};
 		let r = this.#r.get(n);
-		return !r || !J(r.tokenHash, n) ? {
+		return !r || !q(r.tokenHash, n) ? {
 			ok: !1,
 			reason: "unknown_token"
 		} : r.revokedAt === null ? r.expiresAt <= t ? {
@@ -1426,10 +1426,10 @@ var Ge = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github
 		};
 	}
 	revokeToken(e, t = Date.now()) {
-		let n = q(e);
+		let n = G(e);
 		if (!n) return !1;
 		let r = this.#r.get(n);
-		return !r || !J(r.tokenHash, n) ? !1 : r.revokedAt === null ? (r.revokedAt = t, this.#c(), !0) : !0;
+		return !r || !q(r.tokenHash, n) ? !1 : r.revokedAt === null ? (r.revokedAt = t, this.#c(), !0) : !0;
 	}
 	revokeTokensForGrant(e, t = Date.now()) {
 		let n = 0;
@@ -1437,18 +1437,18 @@ var Ge = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github
 		return n > 0 && this.#c(), n;
 	}
 	issueGrant(e, t = Date.now()) {
-		if (this.#u(t), this.#i.size >= $e) return;
-		let n = G(), r = q(n);
+		if (this.#u(t), this.#i.size >= nt) return;
+		let n = U(), r = G(n);
 		if (!r) return;
 		let i = {
-			grantId: v(),
+			grantId: o(),
 			clientId: e.clientId,
 			scopes: [...e.scopes ?? []],
 			resource: e.resource,
 			currentRefreshTokenHash: r,
 			previousRefreshTokenHash: null,
 			issuedAt: t,
-			expiresAt: t + V * 1e3,
+			expiresAt: t + z * 1e3,
 			rotatedAt: null,
 			revokedAt: null
 		};
@@ -1458,11 +1458,11 @@ var Ge = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github
 				scopes: [...i.scopes]
 			},
 			refreshToken: n,
-			expiresIn: V
+			expiresIn: z
 		};
 	}
 	rotateRefreshToken(e, t, n = {}, r = Date.now()) {
-		let i = q(t);
+		let i = G(t);
 		if (!i) return {
 			ok: !1,
 			reason: "unknown_refresh_token"
@@ -1492,7 +1492,7 @@ var Ge = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github
 			reason: "client_mismatch",
 			grantId: a
 		};
-		if (!jt(n.scopes ?? o.scopes, o.scopes)) return {
+		if (!Nt(n.scopes ?? o.scopes, o.scopes)) return {
 			ok: !1,
 			reason: "scope_mismatch",
 			grantId: a
@@ -1502,13 +1502,13 @@ var Ge = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github
 			reason: "resource_mismatch",
 			grantId: a
 		};
-		let s = J(o.currentRefreshTokenHash, i), c = o.previousRefreshTokenHash !== null && J(o.previousRefreshTokenHash, i);
+		let s = q(o.currentRefreshTokenHash, i), c = o.previousRefreshTokenHash !== null && q(o.previousRefreshTokenHash, i);
 		if (!s && !c) return this.revokeGrant(a, r), {
 			ok: !1,
 			reason: "refresh_token_replay",
 			grantId: a
 		};
-		let l = G(), u = q(l);
+		let l = U(), u = G(l);
 		return u ? (o.scopes = [...n.scopes ?? o.scopes], o.previousRefreshTokenHash = s ? o.currentRefreshTokenHash : null, o.currentRefreshTokenHash = u, o.rotatedAt = r, this.#a.set(u, a), this.#o.get(a)?.add(u), this.#c(), {
 			ok: !0,
 			grant: {
@@ -1523,7 +1523,7 @@ var Ge = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github
 		};
 	}
 	revokeRefreshToken(e, t = Date.now()) {
-		let n = q(e);
+		let n = G(e);
 		if (!n) return;
 		let r = this.#a.get(n);
 		if (r) return this.revokeGrant(r, t), r;
@@ -1533,10 +1533,10 @@ var Ge = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github
 		return n ? n.revokedAt === null ? (n.revokedAt = t, this.#d(n), this.#c(), !0) : !0 : !1;
 	}
 	#s() {
-		if (!x(this.#e)) return;
+		if (!v(this.#e)) return;
 		let e;
 		try {
-			e = JSON.parse(C(this.#e, "utf8"));
+			e = JSON.parse(ie(this.#e, "utf8"));
 		} catch {
 			return;
 		}
@@ -1551,7 +1551,7 @@ var Ge = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github
 		}
 	}
 	#c() {
-		S(D(this.#e), {
+		y(w(this.#e), {
 			recursive: !0,
 			mode: 448
 		});
@@ -1562,7 +1562,7 @@ var Ge = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github
 			refreshGrants: [...this.#i.values()],
 			refreshHashesByGrantId: Object.fromEntries([...this.#o.entries()].map(([e, t]) => [e, [...t]]))
 		}, t = `${this.#e}.${process.pid}.${Date.now()}.tmp`;
-		w(t, `${JSON.stringify(e, null, 2)}\n`, { mode: 384 }), ee(t, this.#e), T(this.#e, 384).catch(() => void 0);
+		x(t, `${JSON.stringify(e, null, 2)}\n`, { mode: 384 }), b(t, this.#e), S(this.#e, 384).catch(() => void 0);
 	}
 	#l(e) {
 		for (let [t, n] of this.#t) n.expiresAt <= e && this.#t.delete(t);
@@ -1583,58 +1583,58 @@ var Ge = "codemem MCP", R = ["memory:read", "memory:write"], z = "https://github
 		this.#a.delete(e.currentRefreshTokenHash), e.previousRefreshTokenHash && this.#a.delete(e.previousRefreshTokenHash);
 	}
 };
-function ut() {
-	return new at();
-}
-function dt() {
-	return new ot();
-}
-function ft() {
-	return new st();
-}
 function pt() {
 	return new ct();
 }
-function mt(e) {
-	return new lt(e);
+function mt() {
+	return new lt();
 }
 function ht() {
-	return te(process.env.HOME?.trim() || E(), ".codemem", "mcp-oauth-state.json");
+	return new ut();
+}
+function gt() {
+	return new dt();
+}
+function _t(e) {
+	return new ft(e);
 }
-function gt(e) {
-	let t = bt(yt(e.mcpUrl));
+function vt() {
+	return T(process.env.HOME?.trim() || C(), ".codemem", "mcp-oauth-state.json");
+}
+function yt(e) {
+	let t = Ct(St(e.mcpUrl));
 	return {
-		...c({
-			provider: Mt(e.clientsStore),
+		...g({
+			provider: Pt(e.clientsStore),
 			issuerUrl: t,
 			baseUrl: t
 		}),
 		grant_types_supported: ["authorization_code", "refresh_token"],
 		token_endpoint_auth_methods_supported: ["none"],
-		scopes_supported: R,
-		service_documentation: z,
+		scopes_supported: I,
+		service_documentation: L,
 		revocation_endpoint: new URL("/revoke", t).href,
 		revocation_endpoint_auth_methods_supported: ["none"],
 		client_id_metadata_document_supported: !1
 	};
 }
-function _t(e) {
-	let t = yt(e), n = {
+function bt(e) {
+	let t = St(e), n = {
 		resource: t.href,
-		authorization_servers: [bt(t).href],
-		scopes_supported: R,
+		authorization_servers: [Ct(t).href],
+		scopes_supported: I,
 		bearer_methods_supported: ["header"],
-		resource_name: Ge,
-		resource_documentation: z
+		resource_name: Je,
+		resource_documentation: L
 	};
-	return ce.parse(n);
-}
-function vt(e, t) {
-	let n = e.get("client_id") ?? "", r = e.get("redirect_uri") ?? "", i = e.get("response_type") ?? "", a = e.get("code_challenge") ?? "", o = e.get("code_challenge_method") ?? "", s = e.get("resource"), c = Dt(e.get("scope")), l = e.get("state");
-	if (i !== "code") return U("unsupported_response_type");
-	if (o !== "S256") return U("invalid_request", "PKCE code_challenge_method=S256 is required");
-	if (!rt.test(a)) return U("invalid_request", "Valid PKCE S256 code_challenge is required");
-	let u = Ot(t, n);
+	return ue.parse(n);
+}
+function xt(e, t) {
+	let n = e.get("client_id") ?? "", r = e.get("redirect_uri") ?? "", i = e.get("response_type") ?? "", a = e.get("code_challenge") ?? "", o = e.get("code_challenge_method") ?? "", s = e.get("resource"), c = At(e.get("scope")), l = e.get("state");
+	if (i !== "code") return V("unsupported_response_type");
+	if (o !== "S256") return V("invalid_request", "PKCE code_challenge_method=S256 is required");
+	if (!ot.test(a)) return V("invalid_request", "Valid PKCE S256 code_challenge is required");
+	let u = jt(t, n);
 	return u ? u.redirect_uris.includes(r) ? {
 		clientId: n,
 		redirectUri: r,
@@ -1642,55 +1642,55 @@ function vt(e, t) {
 		scopes: c,
 		resource: s,
 		state: l
-	} : U("invalid_request", "redirect_uri is not registered for this client") : U("invalid_client", "Unknown OAuth client_id");
+	} : V("invalid_request", "redirect_uri is not registered for this client") : V("invalid_client", "Unknown OAuth client_id");
 }
-function yt(e) {
+function St(e) {
 	let t;
 	try {
 		t = new URL(e);
 	} catch {
 		throw Error("Invalid MCP HTTP public URL; expected an HTTPS /mcp URL");
 	}
-	if (t.protocol !== "https:" && !Tt(t)) throw Error("Invalid MCP HTTP public URL; use HTTPS for non-loopback URLs");
+	if (t.protocol !== "https:" && !Ot(t)) throw Error("Invalid MCP HTTP public URL; use HTTPS for non-loopback URLs");
 	if (t.username || t.password || t.search || t.hash) throw Error("Invalid MCP HTTP public URL; credentials, query strings, and fragments are not allowed");
 	if (t.pathname === "/" && (t.pathname = "/mcp"), t.pathname !== "/mcp") throw Error("Invalid MCP HTTP public URL; expected /mcp path");
 	return t;
 }
-function bt(e) {
+function Ct(e) {
 	return new URL(e.origin);
 }
-function xt(e) {
+function wt(e) {
 	for (let t of e) {
 		let e = new URL(t);
 		if (e.username || e.password || e.hash) return "Invalid redirect URI";
-		if (!St(e) && !wt(e)) return "Unsupported redirect URI";
+		if (!Tt(e) && !Dt(e)) return "Unsupported redirect URI";
 	}
 	return null;
 }
-function St(e) {
-	return e.search === "" ? e.href === Ke || e.href === qe ? !0 : e.protocol === "https:" && e.hostname === "chatgpt.com" && Ct(e) : !1;
+function Tt(e) {
+	return e.search === "" ? e.href === Ye || e.href === Xe ? !0 : e.protocol === "https:" && e.hostname === "chatgpt.com" && Et(e) : !1;
 }
-function Ct(e) {
+function Et(e) {
 	let t = e.pathname.split("/").filter(Boolean);
-	return t.length === 3 && t[0] === "connector" && t[1] === "oauth" && it.test(t[2] ?? "");
+	return t.length === 3 && t[0] === "connector" && t[1] === "oauth" && st.test(t[2] ?? "");
 }
-function H(e, t) {
+function B(e, t) {
 	return e.length > 0 && e.every((e) => t.has(e));
 }
-function wt(e) {
-	return e.protocol === "http:" && Je.has(Et(e.hostname)) && (e.pathname === "/callback" || e.pathname === "/oauth/callback") && e.search === "";
+function Dt(e) {
+	return e.protocol === "http:" && Ze.has(kt(e.hostname)) && (e.pathname === "/callback" || e.pathname === "/oauth/callback") && e.search === "";
 }
-function Tt(e) {
-	let t = Et(e.hostname);
-	return e.protocol === "http:" && Je.has(t);
+function Ot(e) {
+	let t = kt(e.hostname);
+	return e.protocol === "http:" && Ze.has(t);
 }
-function Et(e) {
+function kt(e) {
 	return e.replace(/^\[(.*)]$/, "$1").toLowerCase();
 }
-function Dt(e) {
+function At(e) {
 	return e?.split(/\s+/).map((e) => e.trim()).filter(Boolean) ?? [];
 }
-function U(e, t) {
+function V(e, t) {
 	return {
 		status: 400,
 		body: t ? {
@@ -1699,42 +1699,42 @@ function U(e, t) {
 		} : { error: e }
 	};
 }
-function Ot(e, t) {
+function jt(e, t) {
 	let n = e.getClient(t);
 	if (n instanceof Promise) throw Error("Asynchronous OAuth client stores are not supported by this HTTP bootstrap yet");
 	return n;
 }
-function W(e) {
-	if (typeof e != "string" || e.length !== tt || !nt.test(e)) return null;
+function H(e) {
+	if (typeof e != "string" || e.length !== it || !at.test(e)) return null;
 	let t = Buffer.from(e, "base64url");
-	return t.length === et ? t : null;
+	return t.length === rt ? t : null;
 }
-function G() {
-	return _(et).toString("base64url");
+function U() {
+	return a(rt).toString("base64url");
 }
-function K(e, t) {
-	let n = W(e);
-	return n ? At(n, t) : null;
+function W(e, t) {
+	let n = H(e);
+	return n ? Mt(n, t) : null;
 }
-function q(e) {
-	let t = W(e);
-	return t ? m("sha256").update(t).digest("base64url") : null;
+function G(e) {
+	let t = H(e);
+	return t ? n("sha256").update(t).digest("base64url") : null;
 }
-function kt(e, t) {
-	return At(e, t);
+function K(e, t) {
+	return Mt(e, t);
 }
-function At(e, t) {
-	return h("sha256", t).update(e).digest("base64url");
+function Mt(e, t) {
+	return r("sha256", t).update(e).digest("base64url");
 }
-function J(e, t) {
+function q(e, t) {
 	let n = Buffer.from(e), r = Buffer.from(t);
-	return n.length === r.length && y(n, r);
+	return n.length === r.length && s(n, r);
 }
-function jt(e, t) {
+function Nt(e, t) {
 	let n = new Set(t);
 	return e.every((e) => n.has(e));
 }
-function Mt(e) {
+function Pt(e) {
 	return {
 		clientsStore: e,
 		async authorize() {
@@ -1756,14 +1756,14 @@ function Mt(e) {
 }
 //#endregion
 //#region src/oidc.ts
-var Nt = "CODEMEM_MCP_OIDC_ISSUER_URL", Pt = "CODEMEM_MCP_OIDC_CLIENT_ID", Ft = "CODEMEM_MCP_OIDC_CLIENT_SECRET", It = "CODEMEM_MCP_OAUTH_ALLOWED_SUBJECT", Lt = "CODEMEM_MCP_OAUTH_ALLOWED_EMAIL", Rt = 300 * 1e3, zt = 100, Bt = 300 * 1e3, Vt = class {
+var Ft = "CODEMEM_MCP_OIDC_ISSUER_URL", It = "CODEMEM_MCP_OIDC_CLIENT_ID", Lt = "CODEMEM_MCP_OIDC_CLIENT_SECRET", Rt = "CODEMEM_MCP_OAUTH_ALLOWED_SUBJECT", zt = "CODEMEM_MCP_OAUTH_ALLOWED_EMAIL", Bt = 300 * 1e3, Vt = 100, Ht = 300 * 1e3, Ut = class {
 	#e = /* @__PURE__ */ new Map();
 	issue(e, t = Date.now()) {
-		if (this.#t(t), this.#e.size >= zt) return;
-		let n = v();
+		if (this.#t(t), this.#e.size >= Vt) return;
+		let n = o();
 		return this.#e.set(n, {
 			...e,
-			expiresAt: t + Rt
+			expiresAt: t + Bt
 		}), n;
 	}
 	consume(e) {
@@ -1774,14 +1774,14 @@ var Nt = "CODEMEM_MCP_OIDC_ISSUER_URL", Pt = "CODEMEM_MCP_OIDC_CLIENT_ID", Ft =
 		for (let [t, n] of this.#e) n.expiresAt <= e && this.#e.delete(t);
 	}
 };
-function Ht() {
-	return new Vt();
+function Wt() {
+	return new Ut();
 }
-function Ut(e = process.env) {
-	let t = e[Nt]?.trim(), n = e[Pt]?.trim(), r = e[Ft]?.trim(), i = e[It]?.trim(), a = e[Lt]?.trim().toLowerCase();
+function Gt(e = process.env) {
+	let t = e[Ft]?.trim(), n = e[It]?.trim(), r = e[Lt]?.trim(), i = e[Rt]?.trim(), a = e[zt]?.trim().toLowerCase();
 	if (!(!t && !n && !r && !i && !a)) {
 		if (!t || !n || !r) throw Error("Incomplete MCP OIDC configuration");
-		if (Y(t, "issuer", { allowLoopbackHttp: !0 }), !i && !a) throw Error("MCP OIDC requires CODEMEM_MCP_OAUTH_ALLOWED_SUBJECT or CODEMEM_MCP_OAUTH_ALLOWED_EMAIL");
+		if (J(t, "issuer", { allowLoopbackHttp: !0 }), !i && !a) throw Error("MCP OIDC requires CODEMEM_MCP_OAUTH_ALLOWED_SUBJECT or CODEMEM_MCP_OAUTH_ALLOWED_EMAIL");
 		return {
 			issuerUrl: t,
 			clientId: n,
@@ -1791,39 +1791,39 @@ function Ut(e = process.env) {
 		};
 	}
 }
-async function Wt(e, t, n, r, i, a = Date.now()) {
-	if (!r) return X("temporarily_unavailable", "OIDC is not configured");
-	let o = vt(e, t);
-	if ("status" in o) return o;
-	let s = await qt(r.issuerUrl), c = v(), l = n.issue({
+async function Kt(e, t, n, r, i, a = Date.now()) {
+	if (!r) return Y("temporarily_unavailable", "OIDC is not configured");
+	let s = xt(e, t);
+	if ("status" in s) return s;
+	let c = await Yt(r.issuerUrl), l = o(), u = n.issue({
 		oauthParams: e.toString(),
-		nonce: c
+		nonce: l
 	}, a);
-	if (!l) return X("temporarily_unavailable", "Too many pending OIDC authorizations");
-	let u = Kt(i), d = new URL(s.authorization_endpoint);
-	return d.searchParams.set("response_type", "code"), d.searchParams.set("client_id", r.clientId), d.searchParams.set("redirect_uri", u), d.searchParams.set("scope", "openid email"), d.searchParams.set("state", l), d.searchParams.set("nonce", c), {
+	if (!u) return Y("temporarily_unavailable", "Too many pending OIDC authorizations");
+	let d = Jt(i), f = new URL(c.authorization_endpoint);
+	return f.searchParams.set("response_type", "code"), f.searchParams.set("client_id", r.clientId), f.searchParams.set("redirect_uri", d), f.searchParams.set("scope", "openid email"), f.searchParams.set("state", u), f.searchParams.set("nonce", l), {
 		status: 302,
-		location: d.href
+		location: f.href
 	};
 }
-async function Gt(e, t, n, r, i = Date.now()) {
+async function qt(e, t, n, r, i = Date.now()) {
 	try {
 		let a = e.get("code") ?? "", o = e.get("state") ?? "";
-		if (!o) return X("invalid_request", "Missing OIDC state");
+		if (!o) return Y("invalid_request", "Missing OIDC state");
 		let s = t.consume(o);
-		if (!s || s.expiresAt <= i) return X("invalid_request", "Expired or unknown OIDC state");
-		if (!a) return X("invalid_request", "Missing OIDC code");
-		let c = await qt(n.issuerUrl), l = await Jt(c.token_endpoint, n, Kt(r), a);
-		return l.id_token ? $t(await Yt(l.id_token, c, n.clientId, s.nonce, i), n) ? { oauthParams: new URLSearchParams(s.oauthParams) } : X("access_denied", "OIDC identity is not allowed") : X("invalid_request", "OIDC token exchange failed");
+		if (!s || s.expiresAt <= i) return Y("invalid_request", "Expired or unknown OIDC state");
+		if (!a) return Y("invalid_request", "Missing OIDC code");
+		let c = await Yt(n.issuerUrl), l = await Xt(c.token_endpoint, n, Jt(r), a);
+		return l.id_token ? tn(await Zt(l.id_token, c, n.clientId, s.nonce, i), n) ? { oauthParams: new URLSearchParams(s.oauthParams) } : Y("access_denied", "OIDC identity is not allowed") : Y("invalid_request", "OIDC token exchange failed");
 	} catch {
-		return X("access_denied", "OIDC identity verification failed");
+		return Y("access_denied", "OIDC identity verification failed");
 	}
 }
-function Kt(e) {
+function Jt(e) {
 	let t = new URL(e);
 	return new URL("/oauth/callback", t.origin).href;
 }
-async function qt(e) {
+async function Yt(e) {
 	let t = new URL(e);
 	if (t.search || t.hash) throw Error("OIDC issuer must not include query or fragment");
 	if (t.username || t.password) throw Error("OIDC issuer must not include credentials");
@@ -1832,10 +1832,10 @@ async function qt(e) {
 	let i = await r.json();
 	if (i.issuer !== t.href && i.issuer !== t.href.replace(/\/$/, "")) throw Error("OIDC discovery issuer mismatch");
 	if (!i.authorization_endpoint || !i.token_endpoint || !i.jwks_uri) throw Error("OIDC discovery metadata is incomplete");
-	let a = t.protocol === "http:" && en(t.hostname);
-	return Y(i.authorization_endpoint, "authorization endpoint", { allowLoopbackHttp: a }), Y(i.token_endpoint, "token endpoint", { allowLoopbackHttp: a }), Y(i.jwks_uri, "JWKS URI", { allowLoopbackHttp: a }), i;
+	let a = t.protocol === "http:" && nn(t.hostname);
+	return J(i.authorization_endpoint, "authorization endpoint", { allowLoopbackHttp: a }), J(i.token_endpoint, "token endpoint", { allowLoopbackHttp: a }), J(i.jwks_uri, "JWKS URI", { allowLoopbackHttp: a }), i;
 }
-async function Jt(e, t, n, r) {
+async function Xt(e, t, n, r) {
 	let i = new URLSearchParams({
 		grant_type: "authorization_code",
 		code: r,
@@ -1850,52 +1850,52 @@ async function Jt(e, t, n, r) {
 	if (!a.ok) throw Error("OIDC token request failed");
 	return await a.json();
 }
-async function Yt(e, t, n, r, i) {
-	let [a, o, s] = e.split(".");
-	if (!a || !o || !s) throw Error("Invalid OIDC id_token");
-	let c = Xt(a), l = Xt(o);
-	if (c.alg !== "RS256" || !c.kid) throw Error("Unsupported OIDC id_token signature");
-	if (l.iss !== t.issuer) throw Error("OIDC id_token issuer mismatch");
-	if (!Zt(l.aud, n)) throw Error("OIDC id_token audience mismatch");
-	if (!Qt(l.aud, l.azp, n)) throw Error("OIDC id_token authorized party mismatch");
-	if (typeof l.exp != "number" || !Number.isFinite(l.exp) || l.exp * 1e3 <= i) throw Error("OIDC id_token is expired");
-	if (typeof l.iat != "number" || !Number.isFinite(l.iat)) throw Error("OIDC id_token issued-at time is missing");
-	if (l.iat * 1e3 > i + Bt) throw Error("OIDC id_token issued-at time is in the future");
-	if (l.nonce !== r) throw Error("OIDC id_token nonce mismatch");
-	if (!l.sub) throw Error("OIDC id_token subject is missing");
-	let u = await fetch(t.jwks_uri);
-	if (!u.ok) throw Error("OIDC JWKS request failed");
-	let d = (await u.json()).keys?.find((e) => e.kid === c.kid && e.kty === "RSA");
-	if (!d) throw Error("OIDC signing key not found");
-	let f = g({
-		key: d,
+async function Zt(e, t, n, r, a) {
+	let [o, s, l] = e.split(".");
+	if (!o || !s || !l) throw Error("Invalid OIDC id_token");
+	let u = Qt(o), d = Qt(s);
+	if (u.alg !== "RS256" || !u.kid) throw Error("Unsupported OIDC id_token signature");
+	if (d.iss !== t.issuer) throw Error("OIDC id_token issuer mismatch");
+	if (!$t(d.aud, n)) throw Error("OIDC id_token audience mismatch");
+	if (!en(d.aud, d.azp, n)) throw Error("OIDC id_token authorized party mismatch");
+	if (typeof d.exp != "number" || !Number.isFinite(d.exp) || d.exp * 1e3 <= a) throw Error("OIDC id_token is expired");
+	if (typeof d.iat != "number" || !Number.isFinite(d.iat)) throw Error("OIDC id_token issued-at time is missing");
+	if (d.iat * 1e3 > a + Ht) throw Error("OIDC id_token issued-at time is in the future");
+	if (d.nonce !== r) throw Error("OIDC id_token nonce mismatch");
+	if (!d.sub) throw Error("OIDC id_token subject is missing");
+	let f = await fetch(t.jwks_uri);
+	if (!f.ok) throw Error("OIDC JWKS request failed");
+	let p = (await f.json()).keys?.find((e) => e.kid === u.kid && e.kty === "RSA");
+	if (!p) throw Error("OIDC signing key not found");
+	let m = i({
+		key: p,
 		format: "jwk"
-	}), p = `${a}.${o}`;
-	if (!b("RSA-SHA256", Buffer.from(p), f, Buffer.from(s, "base64url"))) throw Error("OIDC id_token signature verification failed");
-	return l;
+	}), h = `${o}.${s}`;
+	if (!c("RSA-SHA256", Buffer.from(h), m, Buffer.from(l, "base64url"))) throw Error("OIDC id_token signature verification failed");
+	return d;
 }
-function Xt(e) {
+function Qt(e) {
 	return JSON.parse(Buffer.from(e, "base64url").toString("utf8"));
 }
-function Zt(e, t) {
+function $t(e, t) {
 	return Array.isArray(e) ? e.includes(t) : e === t;
 }
-function Qt(e, t, n) {
+function en(e, t, n) {
 	return t && t !== n ? !1 : !Array.isArray(e) || e.length <= 1 || t === n;
 }
-function $t(e, t) {
+function tn(e, t) {
 	return t.allowedSubject && e.sub === t.allowedSubject ? !0 : t.allowedEmail ? e.email_verified === !0 && e.email?.toLowerCase() === t.allowedEmail : !1;
 }
-function Y(e, t, n = {}) {
+function J(e, t, n = {}) {
 	let r = new URL(e);
 	if (r.username || r.password) throw Error(`OIDC ${t} must not include credentials`);
-	if (r.protocol !== "https:" && !(n.allowLoopbackHttp && r.protocol === "http:" && en(r.hostname))) throw Error(`OIDC ${t} must use HTTPS`);
+	if (r.protocol !== "https:" && !(n.allowLoopbackHttp && r.protocol === "http:" && nn(r.hostname))) throw Error(`OIDC ${t} must use HTTPS`);
 }
-function en(e) {
+function nn(e) {
 	let t = e.replace(/^\[(.*)]$/, "$1").toLowerCase();
 	return t === "localhost" || t === "127.0.0.1" || t === "::1";
 }
-function X(e, t) {
+function Y(e, t) {
 	return {
 		status: 400,
 		body: t ? {
@@ -1906,7 +1906,7 @@ function X(e, t) {
 }
 //#endregion
 //#region src/provider.ts
-var tn = class {
+var rn = class {
 	#e;
 	#t;
 	#n;
@@ -1916,44 +1916,44 @@ var tn = class {
 	#o;
 	#s;
 	constructor(e) {
-		this.#e = e.clientsStore, this.#t = e.codeStore, this.#n = e.tokenStore, this.#r = e.refreshTokenStore ?? pt(), this.#i = e.publicMcpUrl, this.#a = new URL(e.publicMcpUrl).href, this.#o = e.oidc, this.#s = e.now ?? Date.now;
+		this.#e = e.clientsStore, this.#t = e.codeStore, this.#n = e.tokenStore, this.#r = e.refreshTokenStore ?? gt(), this.#i = e.publicMcpUrl, this.#a = new URL(e.publicMcpUrl).href, this.#o = e.oidc, this.#s = e.now ?? Date.now;
 	}
 	get clientsStore() {
 		return this.#e;
 	}
 	async authorize(e, t, n) {
-		if (!this.#o) throw new A("OIDC is not configured");
-		let r = await Wt(nn(e, t), this.#e, this.#o.pendingStore, this.#o.config, this.#i, this.#s());
+		if (!this.#o) throw new k("OIDC is not configured");
+		let r = await Kt(an(e, t), this.#e, this.#o.pendingStore, this.#o.config, this.#i, this.#s());
 		if (r.status === 302) {
 			n.redirect(302, r.location);
 			return;
 		}
-		throw rn(r.body);
+		throw on(r.body);
 	}
 	async challengeForAuthorizationCode(e, t) {
 		let n = this.#t.peekCode(t);
-		if (!n) throw new k("Invalid or already used code");
-		if (n.clientId !== e.client_id) throw new k("Code does not match client");
-		if (n.expiresAt <= this.#s()) throw this.#t.consumeCode(t), new k("Expired code");
+		if (!n) throw new O("Invalid or already used code");
+		if (n.clientId !== e.client_id) throw new O("Code does not match client");
+		if (n.expiresAt <= this.#s()) throw this.#t.consumeCode(t), new O("Expired code");
 		return n.codeChallenge;
 	}
 	async exchangeAuthorizationCode(e, t, n, r, i) {
 		let a = this.#s(), o = this.#t.peekCode(t);
-		if (!o) throw new k("Invalid or already used code");
-		if (o.expiresAt <= a) throw this.#t.consumeCode(t), new k("Expired code");
-		if (o.clientId !== e.client_id) throw this.#t.consumeCode(t), new k("Code does not match client");
-		if (r === void 0 || o.redirectUri !== r) throw this.#t.consumeCode(t), new k("Code does not match redirect_uri");
-		if ((o.resource ?? null) !== (i?.href ?? null)) throw this.#t.consumeCode(t), new k("Code does not match resource");
-		let s = on(o.scopes) ?? [], c = this.#r.issueGrant({
+		if (!o) throw new O("Invalid or already used code");
+		if (o.expiresAt <= a) throw this.#t.consumeCode(t), new O("Expired code");
+		if (o.clientId !== e.client_id) throw this.#t.consumeCode(t), new O("Code does not match client");
+		if (r === void 0 || o.redirectUri !== r) throw this.#t.consumeCode(t), new O("Code does not match redirect_uri");
+		if ((o.resource ?? null) !== (i?.href ?? null)) throw this.#t.consumeCode(t), new O("Code does not match resource");
+		let s = cn(o.scopes) ?? [], c = this.#r.issueGrant({
 			clientId: e.client_id,
 			scopes: s,
 			resource: o.resource
 		}, a);
-		if (!c) throw new A("Too many active refresh grants");
+		if (!c) throw new k("Too many active refresh grants");
 		let l = this.#n.issueToken(e.client_id, a, o.resource, c.grant.grantId, s);
-		if (!l) throw this.#r.revokeGrant(c.grant.grantId, a), new A("Too many active access tokens");
-		if (!this.#t.consumeCode(t)) throw this.#n.revokeToken(l.token, a), this.#r.revokeGrant(c.grant.grantId, a), new k("Authorization code already used");
-		return le.parse({
+		if (!l) throw this.#r.revokeGrant(c.grant.grantId, a), new k("Too many active access tokens");
+		if (!this.#t.consumeCode(t)) throw this.#n.revokeToken(l.token, a), this.#r.revokeGrant(c.grant.grantId, a), new O("Authorization code already used");
+		return de.parse({
 			access_token: l.token,
 			token_type: "Bearer",
 			expires_in: l.expiresIn,
@@ -1962,13 +1962,13 @@ var tn = class {
 	}
 	async exchangeRefreshToken(e, t, n, r) {
 		let i = this.#s(), a = this.#r.rotateRefreshToken(e.client_id, t, {
-			scopes: on(n),
+			scopes: cn(n),
 			...r ? { resource: r.href } : {}
 		}, i);
-		if (!a.ok) throw a.reason === "refresh_token_replay" && a.grantId && this.#n.revokeTokensForGrant?.(a.grantId, i), new k(an(a.reason));
+		if (!a.ok) throw a.reason === "refresh_token_replay" && a.grantId && this.#n.revokeTokensForGrant?.(a.grantId, i), new O(sn(a.reason));
 		let o = this.#n.issueToken(e.client_id, i, a.grant.resource, a.grant.grantId, a.grant.scopes);
-		if (!o) throw new A("Too many active access tokens");
-		return le.parse({
+		if (!o) throw new k("Too many active access tokens");
+		return de.parse({
 			access_token: o.token,
 			token_type: "Bearer",
 			expires_in: o.expiresIn,
@@ -1977,7 +1977,7 @@ var tn = class {
 	}
 	async verifyAccessToken(e) {
 		let t = this.#n.verifyToken(e, this.#s());
-		if (!t.ok) throw new ae(t.reason === "expired_token" ? "Token has expired" : t.reason === "revoked_token" ? "Token has been revoked" : "Token is invalid");
+		if (!t.ok) throw new se(t.reason === "expired_token" ? "Token has expired" : t.reason === "revoked_token" ? "Token has been revoked" : "Token is invalid");
 		let n = {
 			token: e,
 			clientId: t.record.clientId,
@@ -1985,7 +1985,7 @@ var tn = class {
 			expiresAt: Math.floor(t.record.expiresAt / 1e3)
 		};
 		if (t.record.resource) {
-			if (new URL(t.record.resource).href !== this.#a) throw new ae("Token audience does not match this resource server");
+			if (new URL(t.record.resource).href !== this.#a) throw new se("Token audience does not match this resource server");
 			n.resource = new URL(t.record.resource);
 		}
 		return n;
@@ -1997,22 +1997,22 @@ var tn = class {
 		r && this.#n.revokeTokensForGrant?.(r, n);
 	}
 };
-function nn(e, t) {
+function an(e, t) {
 	let n = new URLSearchParams();
 	return n.set("client_id", e.client_id), n.set("redirect_uri", t.redirectUri), n.set("response_type", "code"), n.set("code_challenge", t.codeChallenge), n.set("code_challenge_method", "S256"), t.state && n.set("state", t.state), t.scopes?.length && n.set("scope", t.scopes.join(" ")), t.resource && n.set("resource", t.resource.href), n;
 }
-function rn(e) {
+function on(e) {
 	let t = e.error_description ?? e.error;
 	switch (e.error) {
-		case "temporarily_unavailable": return new A(t);
-		case "invalid_request": return new ie(t);
-		case "invalid_client": return new re(t);
-		case "access_denied": return new ne(t);
-		case "unsupported_response_type": return new se(t);
-		default: return new oe(t);
+		case "temporarily_unavailable": return new k(t);
+		case "invalid_request": return new oe(t);
+		case "invalid_client": return new ae(t);
+		case "access_denied": return new E(t);
+		case "unsupported_response_type": return new le(t);
+		default: return new ce(t);
 	}
 }
-function an(e) {
+function sn(e) {
 	switch (e) {
 		case "expired_refresh_token": return "Refresh token has expired";
 		case "revoked_refresh_token": return "Refresh token has been revoked";
@@ -2023,34 +2023,42 @@ function an(e) {
 		default: return "Invalid refresh token";
 	}
 }
-function on(e) {
+function cn(e) {
 	let t = e?.map((e) => e.trim()).filter(Boolean).map((e) => e === "memory:read_access" ? "memory:read" : e === "memory:write_access" ? "memory:write" : e);
 	return t && t.length > 0 ? t : void 0;
 }
 //#endregion
 //#region src/http.ts
-var sn = "127.0.0.1", cn = 38889, ln = 80, un = new Set(["https://chatgpt.com", "https://claude.ai"]), dn = "authorization,content-type,mcp-session-id", fn = "600", pn = 256, mn = 900 * 1e3, hn = 600, gn = /^[a-zA-Z0-9.-]+$/, _n = new Set([
+var ln = "127.0.0.1", X = 38889, un = 80, dn = new Set(["https://chatgpt.com", "https://claude.ai"]), fn = "authorization,content-type,mcp-session-id", pn = "600", mn = 256, hn = 900 * 1e3, gn = 600, _n = 4 * 1024 * 1024, vn = 300 * 1e3, yn = 2e3, bn = /^[a-zA-Z0-9.-]+$/, xn = new Set([
 	"127.0.0.1",
 	"::1",
 	"localhost"
 ]);
-function vn(e, t = !1) {
-	let r = e?.trim() || "127.0.0.1";
-	if (r.includes("://") || r.includes("/") || r.includes("\\") || !(n(r) || r === "localhost" || gn.test(r))) throw Error(`Invalid MCP HTTP host: ${e}`);
-	if (!t && !Z(r)) throw Error(`Refusing unsafe MCP HTTP host ${r}; set CODEMEM_MCP_HTTP_UNSAFE_PUBLIC=1 to allow non-loopback binding`);
-	return r;
+function Sn(t) {
+	let n = t?.extra?.sub;
+	if (typeof n == "string" && n.trim().length > 0) {
+		let r = n.trim(), i = t?.clientId?.trim();
+		return i ? `subject-client:${e([r, i])}` : `subject:${r}`;
+	}
+	return t?.token ? `token:${t.token}` : void 0;
+}
+function Cn(e, t = !1) {
+	let n = e?.trim() || "127.0.0.1";
+	if (n.includes("://") || n.includes("/") || n.includes("\\") || !(u(n) || n === "localhost" || bn.test(n))) throw Error(`Invalid MCP HTTP host: ${e}`);
+	if (!t && !Z(n)) throw Error(`Refusing unsafe MCP HTTP host ${n}; set CODEMEM_MCP_HTTP_UNSAFE_PUBLIC=1 to allow non-loopback binding`);
+	return n;
 }
 function Z(e) {
-	return _n.has(Q(e));
+	return xn.has(Q(e));
 }
-function yn(e = process.env.CODEMEM_MCP_HTTP_UNSAFE_PUBLIC) {
+function wn(e = process.env.CODEMEM_MCP_HTTP_UNSAFE_PUBLIC) {
 	return e === "1" || e?.toLowerCase() === "true" || e?.toLowerCase() === "yes";
 }
-function bn(e, t) {
-	let n = Cn(e);
-	return !n || !Z(n.host) ? !1 : n.port === null ? t === ln : n.port === t;
+function Tn(e, t) {
+	let n = On(e);
+	return !n || !Z(n.host) ? !1 : n.port === null ? t === un : n.port === t;
 }
-function xn(e, t) {
+function En(e, t) {
 	if (!e) return !0;
 	try {
 		let n = new URL(e), r = n.port ? Number(n.port) : n.protocol === "https:" ? 443 : 80;
@@ -2059,13 +2067,13 @@ function xn(e, t) {
 		return !1;
 	}
 }
-function Sn(e) {
+function Dn(e) {
 	return e ? Z(e.replace(/^::ffff:/, "")) : !1;
 }
 function Q(e) {
 	return e.replace(/^\[(.*)]$/, "$1").toLowerCase();
 }
-function Cn(e) {
+function On(e) {
 	if (!e) return null;
 	if (e.startsWith("[")) {
 		let t = /^\[([^\]]+)]:(\d+)$/.exec(e);
@@ -2090,70 +2098,70 @@ function Cn(e) {
 		port: r
 	} : null;
 }
-function wn(e) {
-	if (e === void 0 || e === "") return cn;
+function kn(e) {
+	if (e === void 0 || e === "") return X;
 	let t = typeof e == "number" ? e : Number(e);
 	if (!Number.isInteger(t) || t < 0 || t > 65535) throw Error(`Invalid MCP HTTP port: ${e}`);
 	return t;
 }
-async function Tn(n = {}) {
-	let r = vn(n.host ?? process.env.CODEMEM_MCP_HTTP_HOST, n.allowUnsafePublic ?? yn()), i = wn(n.port ?? process.env.CODEMEM_MCP_HTTP_PORT), c = n.publicUrl ?? process.env.CODEMEM_MCP_HTTP_PUBLIC_URL, p = c ? yt(c) : void 0, m = new a(n.dbPath ?? o()), h = n.oauthAccessTokenStore ? void 0 : mt(n.oauthStatePath), g = h ?? ut(), _ = h ?? dt(), v = n.oauthAccessTokenStore ?? h ?? ft(), y = Ut(), b = Ht(), x = p !== void 0 || y !== void 0, S = Ve(n.auditEmitter ?? We()), C = /* @__PURE__ */ new Set(), ee = null, w = f();
-	w.disable("x-powered-by"), w.set("trust proxy", "loopback");
-	let T = t(w);
+async function An(e = {}) {
+	let n = Cn(e.host ?? process.env.CODEMEM_MCP_HTTP_HOST, e.allowUnsafePublic ?? wn()), r = kn(e.port ?? process.env.CODEMEM_MCP_HTTP_PORT), i = e.publicUrl ?? process.env.CODEMEM_MCP_HTTP_PUBLIC_URL, a = i ? St(i) : void 0, o = new p(e.dbPath ?? m()), s = e.oauthAccessTokenStore ? void 0 : _t(e.oauthStatePath), c = s ?? pt(), u = s ?? mt(), d = e.oauthAccessTokenStore ?? s ?? ht(), f = Gt(), g = Wt(), _ = a !== void 0 || f !== void 0, v = We(e.auditEmitter ?? qe()), y = /* @__PURE__ */ new Set(), ie = Hn(), b = null, x = re();
+	x.disable("x-powered-by"), x.set("trust proxy", "loopback");
+	let S = l(x);
 	await new Promise((e, t) => {
-		T.once("error", t), T.listen({
-			host: r,
-			port: i
+		S.once("error", t), S.listen({
+			host: n,
+			port: r
 		}, () => {
-			T.off("error", t), e();
+			S.off("error", t), e();
 		});
 	});
-	let E = p?.href ?? In(T, r), D = new URL(E), te = Ln(D, $(T)), ne = new tn({
-		clientsStore: g,
-		codeStore: _,
-		tokenStore: v,
-		publicMcpUrl: E,
-		...h ? { refreshTokenStore: h } : {},
-		...y ? { oidc: {
-			config: y,
-			pendingStore: b
+	let C = a?.href ?? Vn(S, n), w = new URL(C), T = Kn(w, $(S)), E = new rn({
+		clientsStore: c,
+		codeStore: u,
+		tokenStore: d,
+		publicMcpUrl: C,
+		...s ? { refreshTokenStore: s } : {},
+		...f ? { oidc: {
+			config: f,
+			pendingStore: g
 		} } : {}
-	}), re = l(D);
-	w.use(Re({
-		windowMs: mn,
-		limit: hn,
+	}), ae = ee(w);
+	x.use(Ve({
+		windowMs: hn,
+		limit: gn,
 		standardHeaders: "draft-8",
 		legacyHeaders: !1,
 		ipv6Subnet: !1
-	})), w.use((e, t, n) => {
-		let r = $(T), i = zn(e.path);
+	})), x.use((e, t, n) => {
+		let r = $(S), i = Jn(e.path);
 		if (i === "/mcp") {
-			if (En(e, r, p)) {
-				if (An(e, t, p), e.method === "OPTIONS") {
+			if (jn(e, r, a)) {
+				if (Fn(e, t, a), e.method === "OPTIONS") {
 					t.status(204).send("");
 					return;
 				}
 				return n();
 			}
-			Mn(e, i, p), t.status(403).type("text/plain").send("Forbidden");
+			Ln(e, i, a), t.status(403).type("text/plain").send("Forbidden");
 			return;
 		}
-		if (Rn(i)) {
-			if (On(e, r, p)) {
-				if (An(e, t, p), e.method === "OPTIONS") {
+		if (qn(i)) {
+			if (Nn(e, r, a)) {
+				if (Fn(e, t, a), e.method === "OPTIONS") {
 					t.status(204).send("");
 					return;
 				}
 				return n();
 			}
-			Mn(e, i, p), t.status(403).type("text/plain").send("Forbidden");
+			Ln(e, i, a), t.status(403).type("text/plain").send("Forbidden");
 			return;
 		}
 		n();
-	}), w.use(Bn(S)), w.get("/oauth/callback", async (e, t) => {
+	}), x.use(Yn(v)), x.get("/oauth/callback", async (e, t) => {
 		let n = e.socket.remoteAddress ?? void 0;
-		if (!y) {
-			S(L("oidc_callback", {
+		if (!f) {
+			v(F("oidc_callback", {
 				outcome: "denied",
 				reason: "oidc_not_configured",
 				remoteAddress: n
@@ -2163,25 +2171,25 @@ async function Tn(n = {}) {
 			});
 			return;
 		}
-		let r = await Gt(new URLSearchParams(e.query), b, y, E);
+		let r = await qt(new URLSearchParams(e.query), g, f, C);
 		if ("status" in r) {
-			S(L("oidc_callback", {
+			v(F("oidc_callback", {
 				outcome: "denied",
 				reason: r.body.error,
 				remoteAddress: n
 			})), t.status(r.status).json(r.body);
 			return;
 		}
-		let i = r.oauthParams.get("client_id") ?? void 0, a = _.issueCode({
+		let i = r.oauthParams.get("client_id") ?? void 0, a = u.issueCode({
 			clientId: r.oauthParams.get("client_id") ?? "",
 			redirectUri: r.oauthParams.get("redirect_uri") ?? "",
 			codeChallenge: r.oauthParams.get("code_challenge") ?? "",
-			scopes: Yn(r.oauthParams.get("scope")),
+			scopes: ir(r.oauthParams.get("scope")),
 			...r.oauthParams.get("resource") ? { resource: r.oauthParams.get("resource") ?? void 0 } : {},
 			expiresAt: Date.now() + 300 * 1e3
 		});
 		if (!a) {
-			S(L("oidc_callback", {
+			v(F("oidc_callback", {
 				outcome: "denied",
 				reason: "temporarily_unavailable",
 				clientId: i,
@@ -2195,99 +2203,107 @@ async function Tn(n = {}) {
 		let o = new URL(r.oauthParams.get("redirect_uri") ?? "");
 		o.searchParams.set("code", a);
 		let s = r.oauthParams.get("state");
-		s && o.searchParams.set("state", s), S(L("oidc_callback", {
+		s && o.searchParams.set("state", s), v(F("oidc_callback", {
 			outcome: "success",
 			reason: "code_issued",
 			clientId: i,
 			remoteAddress: n
 		})), t.redirect(302, o.href);
-	}), w.get("/.well-known/oauth-authorization-server", (e, t) => {
-		t.status(200).json(gt({
-			mcpUrl: E,
-			clientsStore: g
+	}), x.get("/.well-known/oauth-authorization-server", (e, t) => {
+		t.status(200).json(yt({
+			mcpUrl: C,
+			clientsStore: c
 		}));
-	}), w.get("/.well-known/oauth-protected-resource/mcp", (e, t) => {
-		t.status(200).json(_t(E));
-	}), w.use(u({
-		provider: ne,
-		issuerUrl: te,
-		baseUrl: te,
-		resourceServerUrl: D,
-		resourceName: Ge,
-		scopesSupported: R,
-		serviceDocumentationUrl: new URL(z),
+	}), x.get("/.well-known/oauth-protected-resource/mcp", (e, t) => {
+		t.status(200).json(bt(C));
+	}), x.use(te({
+		provider: E,
+		issuerUrl: T,
+		baseUrl: T,
+		resourceServerUrl: w,
+		resourceName: Je,
+		scopesSupported: I,
+		serviceDocumentationUrl: new URL(L),
 		clientRegistrationOptions: { clientSecretExpirySeconds: 0 }
 	}));
-	let O = x ? s({
-		verifier: ne,
-		resourceMetadataUrl: re
-	}) : (e, t, n) => n(), k = x ? qn(S, v) : (e, t, n) => n();
-	return w.post("/mcp", k, O, async (t, n) => {
-		t.auth && S(L("bearer", {
+	let D = _ ? h({
+		verifier: E,
+		resourceMetadataUrl: ae
+	}) : (e, t, n) => n(), O = _ ? nr(v, d) : (e, t, n) => n();
+	return x.post("/mcp", O, D, re.json({ limit: _n }), async (n, r) => {
+		n.auth && v(F("bearer", {
 			outcome: "success",
-			clientId: t.auth.clientId,
-			remoteAddress: t.socket.remoteAddress ?? void 0
+			clientId: n.auth.clientId,
+			remoteAddress: n.socket.remoteAddress ?? void 0
 		}));
-		let r = e(m), i = new d({ sessionIdGenerator: void 0 }), a = { mcpServer: r };
-		C.add(a);
+		let i = t(o, {
+			retrievalLedgerScopeId: ie({
+				endpoint: w,
+				principal: Sn(n.auth),
+				requestBody: n.body,
+				now: e.retrievalLedgerNow?.() ?? Date.now()
+			}),
+			retrievalLedgerIdentityMode: "stateless"
+		}), a = new ne({ sessionIdGenerator: void 0 }), s = { mcpServer: i };
+		y.add(s);
 		try {
-			await r.connect(i), await i.handleRequest(t, n);
+			await i.connect(a), await a.handleRequest(n, r, n.body);
 		} finally {
-			C.delete(a), await r.close();
+			y.delete(s), await i.close();
 		}
-	}), w.all("/mcp", (e, t) => {
+	}, Wn), x.all("/mcp", (e, t) => {
 		t.setHeader("Allow", "POST"), t.status(405).type("text/plain").send("Method not allowed");
-	}), w.use((e, t) => {
+	}), x.use((e, t) => {
 		t.status(404).type("text/plain").send("Not found");
 	}), {
-		server: T,
-		store: m,
-		url: `http://${Fn(r)}:${$(T)}/mcp`,
-		close: () => (ee ??= (async () => {
-			await Promise.allSettled([...C].map(({ mcpServer: e }) => e.close())), await new Promise((e, t) => {
-				T.close((n) => {
+		server: S,
+		store: o,
+		url: `http://${Bn(n)}:${$(S)}/mcp`,
+		close: () => (b ??= (async () => {
+			await Promise.allSettled([...y].map(({ mcpServer: e }) => e.close())), await new Promise((e, t) => {
+				S.close((n) => {
 					if (!n || n.code === "ERR_SERVER_NOT_RUNNING") {
 						e();
 						return;
 					}
 					t(n);
-				}), T.closeAllConnections();
-			}), m.close();
-		})(), ee)
+				}), S.closeAllConnections();
+			}), o.close();
+		})(), b)
 	};
 }
-function En(e, t, n) {
-	return Dn(e, t) ? !0 : n ? Pn(e.headers.host, n) && kn(e.headers.origin, n) : !1;
+function jn(e, t, n) {
+	return Mn(e, t) ? !0 : n ? zn(e.headers.host, n) && Pn(e.headers.origin, n) : !1;
 }
-function Dn(e, t) {
-	return Sn(e.socket.remoteAddress) && bn(e.headers.host, t) && xn(e.headers.origin, t);
+function Mn(e, t) {
+	return Dn(e.socket.remoteAddress) && Tn(e.headers.host, t) && En(e.headers.origin, t);
 }
-function On(e, t, n) {
-	return Dn(e, t) ? !0 : n ? Pn(e.headers.host, n) && kn(e.headers.origin, n) : !1;
+function Nn(e, t, n) {
+	return Mn(e, t) ? !0 : n ? zn(e.headers.host, n) && Pn(e.headers.origin, n) : !1;
 }
-function kn(e, t) {
+function Pn(e, t) {
 	if (!e) return !0;
 	try {
 		let n = new URL(e);
-		return n.origin === t.origin || un.has(n.origin);
+		return n.origin === t.origin || dn.has(n.origin);
 	} catch {
 		return !1;
 	}
 }
-function An(e, t, n) {
+function Fn(e, t, n) {
 	if (!n) return;
-	let r = jn(e.headers.origin, n);
-	r && (t.setHeader("Access-Control-Allow-Origin", r), t.setHeader("Access-Control-Allow-Methods", "GET,POST,OPTIONS"), t.setHeader("Access-Control-Allow-Headers", e.headers["access-control-request-headers"] ?? dn), t.setHeader("Access-Control-Max-Age", fn), t.setHeader("Vary", "Origin"));
+	let r = In(e.headers.origin, n);
+	r && (t.setHeader("Access-Control-Allow-Origin", r), t.setHeader("Access-Control-Allow-Methods", "GET,POST,OPTIONS"), t.setHeader("Access-Control-Allow-Headers", e.headers["access-control-request-headers"] ?? fn), t.setHeader("Access-Control-Max-Age", pn), t.setHeader("Vary", "Origin"));
 }
-function jn(e, t) {
+function In(e, t) {
 	if (e) try {
 		let n = new URL(e).origin;
-		if (n === t.origin || un.has(n)) return n;
+		if (n === t.origin || dn.has(n)) return n;
 	} catch {
 		return;
 	}
 }
-function Mn(e, t, n) {
+function Ln(e, t, n) {
 	console.warn(JSON.stringify({
 		source: "codemem-mcp-http-guard",
 		timestamp: (/* @__PURE__ */ new Date()).toISOString(),
@@ -2295,51 +2311,97 @@ function Mn(e, t, n) {
 		reason: "host_or_origin_mismatch",
 		method: e.method,
 		path: t,
-		host: Nn(e.headers.host),
-		origin: Nn(e.headers.origin),
+		host: Rn(e.headers.host),
+		origin: Rn(e.headers.origin),
 		expectedOrigin: n?.origin,
 		remoteAddress: e.socket.remoteAddress ?? void 0
 	}));
 }
-function Nn(e) {
-	return !e || e.length <= pn ? e : `${e.slice(0, pn)}…`;
+function Rn(e) {
+	return !e || e.length <= mn ? e : `${e.slice(0, mn)}…`;
 }
-function Pn(e, t) {
-	let n = Cn(e);
+function zn(e, t) {
+	let n = On(e);
 	if (!n) return !1;
 	let r = t.port ? Number(t.port) : t.protocol === "https:" ? 443 : 80, i = t.protocol === "https:" ? 443 : 80, a = n.port ?? i;
 	return Q(n.host) === Q(t.hostname) && a === r;
 }
 function $(e) {
 	let t = e.address();
-	return !t || typeof t == "string" ? cn : t.port;
+	return !t || typeof t == "string" ? X : t.port;
 }
-function Fn(e) {
-	return n(e) === 6 ? `[${e}]` : e;
+function Bn(e) {
+	return u(e) === 6 ? `[${e}]` : e;
+}
+function Vn(e, t) {
+	return `http://${Bn(t)}:${$(e)}/mcp`;
+}
+function Hn() {
+	let t = /* @__PURE__ */ new Map();
+	return (r) => {
+		if (!r.principal) return Un(o());
+		for (let [e, n] of t) n.expiresAt <= r.now && t.delete(e);
+		let i = n("sha256").update(JSON.stringify([
+			r.endpoint.href,
+			r.principal,
+			e(r.requestBody)
+		])).digest("hex"), a = t.get(i);
+		if (a) return a.scopeId;
+		let s = Un(JSON.stringify([i, r.now]));
+		for (t.set(i, {
+			scopeId: s,
+			expiresAt: r.now + vn
+		}); t.size > yn;) {
+			let e = t.keys().next().value;
+			if (e === void 0) break;
+			t.delete(e);
+		}
+		return s;
+	};
 }
-function In(e, t) {
-	return `http://${Fn(t)}:${$(e)}/mcp`;
+function Un(e) {
+	return `mcp-http:${n("sha256").update(e).digest("hex")}`;
 }
-function Ln(e, t) {
+function Wn(e, t, n, r) {
+	let i = Gn(e);
+	if (i === null) {
+		r(e);
+		return;
+	}
+	n.status(i).json({
+		jsonrpc: "2.0",
+		error: {
+			code: i === 413 ? -32e3 : -32700,
+			message: i === 413 ? "Request body too large" : "Parse error"
+		},
+		id: null
+	});
+}
+function Gn(e) {
+	if (typeof e != "object" || !e) return null;
+	let t = e;
+	return t.type === "entity.too.large" ? 413 : t.type === "entity.parse.failed" ? 400 : null;
+}
+function Kn(e, t) {
 	return e.protocol === "https:" || Z(e.hostname) && Q(e.hostname) !== "::1" ? new URL(e.origin) : new URL(`http://localhost:${t}/`);
 }
-function Rn(e) {
+function qn(e) {
 	return e === "/register" || e === "/authorize" || e === "/token" || e === "/revoke" || e === "/oauth/callback" || e === "/.well-known/oauth-authorization-server" || e === "/.well-known/oauth-protected-resource/mcp";
 }
-function zn(e) {
+function Jn(e) {
 	return e.length > 1 ? e.replace(/\/+$/, "") : e;
 }
-function Bn(e) {
+function Yn(e) {
 	return (t, n, r) => {
 		let i = t.path;
-		if (!Vn(i)) return r();
+		if (!Xn(i)) return r();
 		let a, o = n.json.bind(n);
 		n.json = ((e) => (a = e, o(e))), n.on("finish", () => {
 			if (i === "/oauth/callback") return;
-			let r = Hn(i, t);
+			let r = Zn(i, t);
 			if (!r) return;
-			let o = Wn(n, a), s = Kn(t, a);
-			e(L(r, {
+			let o = $n(n, a), s = tr(t, a);
+			e(F(r, {
 				outcome: o ? "denied" : "success",
 				...o ? { reason: o } : {},
 				...s ? { clientId: s } : {},
@@ -2348,17 +2410,17 @@ function Bn(e) {
 		}), r();
 	};
 }
-function Vn(e) {
-	return Un(e) !== null;
+function Xn(e) {
+	return Qn(e) !== null;
 }
-function Hn(e, t) {
-	return e === "/token" && t.body?.grant_type === "refresh_token" ? "refresh" : Un(e);
+function Zn(e, t) {
+	return e === "/token" && t.body?.grant_type === "refresh_token" ? "refresh" : Qn(e);
 }
-function Un(e) {
+function Qn(e) {
 	return e === "/register" ? "registration" : e === "/authorize" ? "authorize" : e === "/token" ? "token" : e === "/revoke" ? "revocation" : null;
 }
-function Wn(e, t) {
-	let n = Gn(t);
+function $n(e, t) {
+	let n = er(t);
 	if (n) return n;
 	let r = e.getHeader("location");
 	if (typeof r == "string") try {
@@ -2367,38 +2429,38 @@ function Wn(e, t) {
 		return;
 	}
 }
-function Gn(e) {
+function er(e) {
 	if (typeof e == "object" && e && "error" in e && typeof e.error == "string") return e.error;
 }
-function Kn(e, t) {
+function tr(e, t) {
 	return typeof t == "object" && t && "client_id" in t && typeof t.client_id == "string" ? t.client_id : (typeof e.body?.client_id == "string" ? e.body.client_id : void 0) || (typeof e.query.client_id == "string" ? e.query.client_id : void 0);
 }
-function qn(e, t) {
+function nr(e, t) {
 	return (n, r, i) => {
-		let a = Jn(n.headers.authorization, t);
-		a && e(L("bearer", {
+		let a = rr(n.headers.authorization, t);
+		a && e(F("bearer", {
 			outcome: "denied",
 			reason: a,
 			remoteAddress: n.socket.remoteAddress ?? void 0
 		})), i();
 	};
 }
-function Jn(e, t) {
+function rr(e, t) {
 	if (!e) return "missing_authorization_header";
 	let [n, r, i] = e.trim().split(/\s+/);
 	if (!n || !r || i || n.toLowerCase() !== "bearer") return "malformed_authorization_header";
 	let a = t.verifyToken(r);
 	return a.ok ? null : a.reason;
 }
-function Yn(e) {
+function ir(e) {
 	return e?.split(/\s+/).map((e) => e.trim()).filter(Boolean) ?? [];
 }
-function Xn() {
+function ar() {
 	let e = process.argv[1];
-	return e ? import.meta.url === i(e).href : !1;
+	return e ? import.meta.url === f(e).href : !1;
 }
-async function Zn() {
-	let e = await Tn();
+async function or() {
+	let e = await An();
 	console.error(`codemem MCP HTTP server listening at ${e.url}`);
 	let t = async () => {
 		try {
@@ -2408,10 +2470,10 @@ async function Zn() {
 	};
 	process.on("SIGINT", t), process.on("SIGTERM", t);
 }
-Xn() && Zn().catch((e) => {
+ar() && or().catch((e) => {
 	console.error("codemem MCP HTTP server failed to start:", e), process.exit(1);
 });
 //#endregion
-export { sn as DEFAULT_MCP_HTTP_HOST, cn as DEFAULT_MCP_HTTP_PORT, bn as isAllowedMcpHttpRequestHost, xn as isAllowedMcpHttpRequestOrigin, Sn as isAllowedMcpHttpRequestRemoteAddress, Z as isLoopbackHost, yn as isUnsafePublicBindAllowed, wn as parseMcpHttpPort, Tn as startCodememMcpHttpServer, vn as validateMcpHttpHost };
+export { ln as DEFAULT_MCP_HTTP_HOST, X as DEFAULT_MCP_HTTP_PORT, _n as MCP_HTTP_MAX_JSON_BODY_BYTES, vn as MCP_HTTP_RETRIEVAL_RETRY_WINDOW_MS, Sn as authenticatedRetrievalPrincipal, Tn as isAllowedMcpHttpRequestHost, En as isAllowedMcpHttpRequestOrigin, Dn as isAllowedMcpHttpRequestRemoteAddress, Z as isLoopbackHost, wn as isUnsafePublicBindAllowed, kn as parseMcpHttpPort, An as startCodememMcpHttpServer, Cn as validateMcpHttpHost };
 
 //# sourceMappingURL=http.js.map