@codemem/mcp 0.43.2 → 0.44.0-alpha.1

package/dist/http.js

@@ -1,53 +1,223 @@
 #!/usr/bin/env node
-import { n as e, t } from "./server-Kv95NnLs.js";
+import { n as e, t } from "./server-C8Yl-9J0.js";
 import { createHash as n, createHmac as r, createPublicKey as i, randomBytes as a, randomUUID as o, timingSafeEqual as s, verify as c } from "node:crypto";
 import { createServer as l } from "node:http";
 import { isIP as u, isIPv6 as d } from "node:net";
 import { pathToFileURL as f } from "node:url";
 import { MemoryStore as p, resolveDbPath as m } from "@codemem/core";
 import { requireBearerAuth as h } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
-import { createOAuthMetadata as g, getOAuthProtectedResourceMetadataUrl as ee, mcpAuthRouter as te } from "@modelcontextprotocol/sdk/server/auth/router.js";
-import { StreamableHTTPServerTransport as ne } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
-import re from "express";
-import { Buffer as _ } from "node:buffer";
-import { existsSync as v, mkdirSync as y, readFileSync as ie, renameSync as b, writeFileSync as x } from "node:fs";
-import { chmod as S } from "node:fs/promises";
-import { homedir as C } from "node:os";
-import { dirname as w, join as T } from "node:path";
-import { AccessDeniedError as E, InvalidClientError as ae, InvalidClientMetadataError as D, InvalidGrantError as O, InvalidRequestError as oe, InvalidTokenError as se, ServerError as ce, TemporarilyUnavailableError as k, UnsupportedResponseTypeError as le } from "@modelcontextprotocol/sdk/server/auth/errors.js";
-import { OAuthProtectedResourceMetadataSchema as ue, OAuthTokensSchema as de } from "@modelcontextprotocol/sdk/shared/auth.js";
+import { createOAuthMetadata as g, getOAuthProtectedResourceMetadataUrl as _, mcpAuthRouter as v } from "@modelcontextprotocol/sdk/server/auth/router.js";
+import { StreamableHTTPServerTransport as y } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import b from "express";
+import { Buffer as x } from "node:buffer";
+import { existsSync as S, mkdirSync as C, readFileSync as ee, renameSync as w, writeFileSync as T } from "node:fs";
+import { chmod as E } from "node:fs/promises";
+import { homedir as D } from "node:os";
+import { dirname as O, join as k } from "node:path";
+import { AccessDeniedError as A, InvalidClientError as te, InvalidClientMetadataError as j, InvalidGrantError as M, InvalidRequestError as ne, InvalidTokenError as re, ServerError as ie, TemporarilyUnavailableError as N, UnsupportedResponseTypeError as ae } from "@modelcontextprotocol/sdk/server/auth/errors.js";
+import { OAuthProtectedResourceMetadataSchema as oe, OAuthTokensSchema as se } from "@modelcontextprotocol/sdk/shared/auth.js";
 //#region \0rolldown/runtime.js
-var A = (e, t) => () => (t || (e((t = { exports: {} }).exports, t), e = null), t.exports), j = /* @__PURE__ */ A(((e) => {
-	Object.defineProperty(e, "__esModule", { value: !0 }), e.isInSubnet = t, e.isCorrect = n, e.numberToPaddedHex = r, e.stringToPaddedHex = i, e.testBit = a;
-	function t(e) {
-		return this.subnetMask < e.subnetMask ? !1 : this.mask(e.subnetMask) === e.mask();
-	}
+var ce = Object.create, le = Object.defineProperty, ue = Object.getOwnPropertyDescriptor, de = Object.getOwnPropertyNames, fe = Object.getPrototypeOf, pe = Object.prototype.hasOwnProperty, P = (e, t) => () => (t || (e((t = { exports: {} }).exports, t), e = null), t.exports), me = (e, t, n, r) => {
+	if (t && typeof t == "object" || typeof t == "function") for (var i = de(t), a = 0, o = i.length, s; a < o; a++) s = i[a], !pe.call(e, s) && s !== n && le(e, s, {
+		get: ((e) => t[e]).bind(null, s),
+		enumerable: !(r = ue(t, s)) || r.enumerable
+	});
+	return e;
+}, he = (e, t, n) => (n = e == null ? {} : ce(fe(e)), me(t || !e || !e.__esModule || !pe.call(e, "default") ? le(n, "default", {
+	value: e,
+	enumerable: !0
+}) : n, e)), F = /* @__PURE__ */ P(((e) => {
+	Object.defineProperty(e, "__esModule", { value: !0 }), e.AddressError = void 0, e.AddressError = class extends Error {
+		constructor(e, t) {
+			super(e), this.name = "AddressError", this.parseMessage = t;
+		}
+	};
+})), ge = /* @__PURE__ */ P(((e) => {
+	Object.defineProperty(e, "__esModule", { value: !0 }), e.isInSubnet = n, e.isHostInSubnet = r, e.isGloballyReachable = i, e.offsetBigInt = a, e.isCorrect = o, e.prefixLengthFromMask = s, e.assertByteArray = c, e.numberToPaddedHex = l, e.stringToPaddedHex = u, e.testBit = d;
+	var t = F();
 	function n(e) {
+		return this.subnetMask < e.subnetMask ? !1 : r.call(this, e);
+	}
+	function r(e) {
+		return this.mask(e.subnetMask) === e.mask();
+	}
+	function i(e) {
+		let t = null;
+		for (let n = 0; n < e.length; n++) {
+			let i = e[n];
+			i.reachable !== null && r.call(this, i.subnet) && (t === null || i.subnet.subnetMask > t.subnet.subnetMask) && (t = i);
+		}
+		return t === null || t.reachable;
+	}
+	function a(e, n, r, i) {
+		if (typeof n == "number" && !Number.isSafeInteger(n) || typeof n != "number" && typeof n != "bigint") throw new t.AddressError(`${i} offset must be an integer`);
+		let a = e + BigInt(n);
+		if (a < BigInt(0) || a > (BigInt(1) << BigInt(r)) - BigInt(1)) throw new t.AddressError(`${i} offset leaves the address space`);
+		return a;
+	}
+	function o(e) {
 		return function() {
-			return this.addressMinusSuffix === this.correctForm() ? this.subnetMask === e && !this.parsedSubnet ? !0 : this.parsedSubnet === String(this.subnetMask) : !1;
+			return this.addressMinusSuffix === this.correctForm() ? this.subnetMask === e && !this.parsedSubnet || this.parsedSubnet === String(this.subnetMask) : !1;
 		};
 	}
-	function r(e) {
+	function s(e, n) {
+		let r = e.toString(2).padStart(n, "0");
+		if (r.length > n) throw new t.AddressError("Invalid subnet mask.");
+		let i = r.indexOf("0");
+		if (i === -1) return n;
+		if (r.slice(i).includes("1")) throw new t.AddressError("Invalid subnet mask.");
+		return i;
+	}
+	function c(e, n, r, i) {
+		if (e.length !== n) throw new t.AddressError(`${r} addresses require exactly ${n} bytes`);
+		for (let n = 0; n < e.length; n++) if (!Number.isInteger(e[n]) || e[n] < i || e[n] > 255) throw new t.AddressError(`All bytes must be integers between ${i} and 255`);
+	}
+	function l(e) {
 		return e.toString(16).padStart(2, "0");
 	}
-	function i(e) {
-		return r(parseInt(e, 10));
+	function u(e) {
+		return l(parseInt(e, 10));
 	}
-	function a(e, t) {
+	function d(e, t) {
 		let { length: n } = e;
 		if (t > n) return !1;
 		let r = n - t;
 		return e.substring(r, r + 1) === "1";
 	}
-})), fe = /* @__PURE__ */ A(((e) => {
-	Object.defineProperty(e, "__esModule", { value: !0 }), e.RE_SUBNET_STRING = e.RE_ADDRESS = e.GROUPS = e.BITS = void 0, e.BITS = 32, e.GROUPS = 4, e.RE_ADDRESS = /^(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$/g, e.RE_SUBNET_STRING = /\/\d{1,2}$/;
-})), pe = /* @__PURE__ */ A(((e) => {
-	Object.defineProperty(e, "__esModule", { value: !0 }), e.AddressError = void 0, e.AddressError = class extends Error {
-		constructor(e, t) {
-			super(e), this.name = "AddressError", this.parseMessage = t;
-		}
-	};
-})), me = /* @__PURE__ */ A(((e) => {
+})), _e = /* @__PURE__ */ P(((e) => {
+	Object.defineProperty(e, "__esModule", { value: !0 }), e.SPECIAL_PURPOSE = e.RE_SUBNET_STRING = e.RE_ADDRESS = e.GROUPS = e.BITS = void 0, e.BITS = 32, e.GROUPS = 4, e.RE_ADDRESS = /^(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])$/g, e.RE_SUBNET_STRING = /\/\d{1,2}$/, e.SPECIAL_PURPOSE = [
+		[
+			"0.0.0.0/8",
+			"This network",
+			!1
+		],
+		[
+			"0.0.0.0/32",
+			"This host on this network",
+			!1
+		],
+		[
+			"10.0.0.0/8",
+			"Private-Use",
+			!1
+		],
+		[
+			"100.64.0.0/10",
+			"Shared Address Space",
+			!1
+		],
+		[
+			"127.0.0.0/8",
+			"Loopback",
+			!1
+		],
+		[
+			"169.254.0.0/16",
+			"Link Local",
+			!1
+		],
+		[
+			"172.16.0.0/12",
+			"Private-Use",
+			!1
+		],
+		[
+			"192.0.0.0/24",
+			"IETF Protocol Assignments",
+			!1
+		],
+		[
+			"192.0.0.0/29",
+			"IPv4 Service Continuity Prefix",
+			!1
+		],
+		[
+			"192.0.0.8/32",
+			"IPv4 dummy address",
+			!1
+		],
+		[
+			"192.0.0.9/32",
+			"Port Control Protocol Anycast",
+			!0
+		],
+		[
+			"192.0.0.10/32",
+			"Traversal Using Relays around NAT Anycast",
+			!0
+		],
+		[
+			"192.0.0.170/32",
+			"NAT64/DNS64 Discovery",
+			!1
+		],
+		[
+			"192.0.0.171/32",
+			"NAT64/DNS64 Discovery",
+			!1
+		],
+		[
+			"192.0.2.0/24",
+			"Documentation (TEST-NET-1)",
+			!1
+		],
+		[
+			"192.31.196.0/24",
+			"AS112-v4",
+			!0
+		],
+		[
+			"192.52.193.0/24",
+			"AMT",
+			!0
+		],
+		[
+			"192.88.99.0/24",
+			"Deprecated (6to4 Relay Anycast)",
+			null
+		],
+		[
+			"192.88.99.2/32",
+			"6a44-relay anycast address",
+			!1
+		],
+		[
+			"192.168.0.0/16",
+			"Private-Use",
+			!1
+		],
+		[
+			"192.175.48.0/24",
+			"Direct Delegation AS112 Service",
+			!0
+		],
+		[
+			"198.18.0.0/15",
+			"Benchmarking",
+			!1
+		],
+		[
+			"198.51.100.0/24",
+			"Documentation (TEST-NET-2)",
+			!1
+		],
+		[
+			"203.0.113.0/24",
+			"Documentation (TEST-NET-3)",
+			!1
+		],
+		[
+			"240.0.0.0/4",
+			"Reserved",
+			!1
+		],
+		[
+			"255.255.255.255/32",
+			"Limited Broadcast",
+			!1
+		]
+	];
+})), ve = /* @__PURE__ */ P(((e) => {
 	var t = e && e.__createBinding || (Object.create ? (function(e, t, n, r) {
 		r === void 0 && (r = n);
 		var i = Object.getOwnPropertyDescriptor(t, n);
@@ -73,10 +243,9 @@ var A = (e, t) => () => (t || (e((t = { exports: {} }).exports, t), e = null), t
 		return n(r, e), r;
 	};
 	Object.defineProperty(e, "__esModule", { value: !0 }), e.Address4 = void 0;
-	var i = r(j()), a = r(fe()), o = pe();
-	e.Address4 = class e {
+	var i = r(ge()), a = r(_e()), o = F(), s = i.isCorrect(a.BITS), c = class e {
 		constructor(e) {
-			this.groups = a.GROUPS, this.parsedAddress = [], this.parsedSubnet = "", this.subnet = "/32", this.subnetMask = 32, this.v4 = !0, this.isCorrect = i.isCorrect(a.BITS), this.isInSubnet = i.isInSubnet, this.address = e;
+			this.addressMinusSuffix = "", this.groups = a.GROUPS, this.parsedAddress = [], this.parsedSubnet = "", this.subnet = "/32", this.subnetMask = 32, this.v4 = !0, this.isCorrect = s, this.isInSubnet = i.isInSubnet, this.isHostInSubnet = i.isHostInSubnet, this.address = e;
 			let t = a.RE_SUBNET_STRING.exec(e);
 			if (t) {
 				if (this.parsedSubnet = t[0].replace("/", ""), this.subnetMask = parseInt(this.parsedSubnet, 10), this.subnet = `/${this.subnetMask}`, this.subnetMask < 0 || this.subnetMask > a.BITS) throw new o.AddressError("Invalid subnet mask.");
@@ -93,25 +262,44 @@ var A = (e, t) => () => (t || (e((t = { exports: {} }).exports, t), e = null), t
 		}
 		parse(e) {
 			let t = e.split(".");
+			if (t.some((e) => /^0\d/.test(e))) throw new o.AddressError("IPv4 addresses can't have leading zeroes.");
 			if (!e.match(a.RE_ADDRESS)) throw new o.AddressError("Invalid IPv4 address.");
 			return t;
 		}
 		correctForm() {
 			return this.parsedAddress.map((e) => parseInt(e, 10)).join(".");
 		}
+		static fromAddressAndMask(t, n) {
+			let r = i.prefixLengthFromMask(new e(n).bigInt(), a.BITS);
+			return new e(`${t}/${r}`);
+		}
+		static fromAddressAndWildcardMask(t, n) {
+			let r = new e(n).bigInt() ^ (BigInt(1) << BigInt(a.BITS)) - BigInt(1), o = i.prefixLengthFromMask(r, a.BITS);
+			return new e(`${t}/${o}`);
+		}
+		static fromWildcard(t) {
+			let n = t.split(".");
+			if (n.length !== a.GROUPS) throw new o.AddressError("Wildcard pattern must have 4 octets");
+			let r = -1;
+			for (let e = 0; e < n.length; e++) if (n[e] === "*") r === -1 && (r = e);
+			else if (r !== -1) throw new o.AddressError("Wildcard `*` must only appear in trailing octets (e.g. `192.168.0.*`)");
+			let i = r === -1 ? 0 : n.length - r, s = n.map((e) => e === "*" ? "0" : e), c = a.BITS - i * 8;
+			return new e(`${s.join(".")}/${c}`);
+		}
 		static fromHex(t) {
-			let n = t.replace(/:/g, "").padStart(8, "0"), r = [], i;
-			for (i = 0; i < 8; i += 2) {
-				let e = n.slice(i, i + 2);
-				r.push(parseInt(e, 16));
-			}
+			let n = t.replace(/:/g, "");
+			if (!/^[0-9a-fA-F]{8}$/.test(n)) throw new o.AddressError("IPv4 hex must be exactly 8 hex digits");
+			let r = [];
+			for (let e = 0; e < 8; e += 2) r.push(parseInt(n.slice(e, e + 2), 16));
 			return new e(r.join("."));
 		}
 		static fromInteger(t) {
-			return e.fromHex(t.toString(16));
+			if (!Number.isInteger(t) || t < 0 || t > 4294967295) throw new o.AddressError("IPv4 integer must be in the range 0 to 2**32 - 1");
+			return e.fromHex(t.toString(16).padStart(8, "0"));
 		}
 		static fromArpa(t) {
-			return new e(t.replace(/(\.in-addr\.arpa)?\.$/, "").split(".").reverse().join("."));
+			let n = t.replace(/(\.in-addr\.arpa)?\.$/, "").split(".").reverse().join(".");
+			return new e(n);
 		}
 		toHex() {
 			return this.parsedAddress.map((e) => i.stringToPaddedHex(e)).join(":");
@@ -137,6 +325,15 @@ var A = (e, t) => () => (t || (e((t = { exports: {} }).exports, t), e = null), t
 			let t = BigInt("1");
 			return e.fromBigInt(this._startAddress() + t);
 		}
+		offset(t) {
+			return e.fromBigInt(i.offsetBigInt(this.bigInt(), t, a.BITS, "IPv4")).withSubnetMask(this.subnetMask);
+		}
+		nextNetwork() {
+			return e.fromBigInt(i.offsetBigInt(this._endAddress(), 1, a.BITS, "IPv4")).withSubnetMask(this.subnetMask);
+		}
+		withSubnetMask(t) {
+			return new e(`${this.correctForm()}/${t}`);
+		}
 		_endAddress() {
 			return BigInt(`0b${this.mask() + "1".repeat(a.BITS - this.subnetMask)}`);
 		}
@@ -147,17 +344,26 @@ var A = (e, t) => () => (t || (e((t = { exports: {} }).exports, t), e = null), t
 			let t = BigInt("1");
 			return e.fromBigInt(this._endAddress() - t);
 		}
+		subnetMaskAddress() {
+			return e.fromBigInt(BigInt(`0b${"1".repeat(this.subnetMask)}${"0".repeat(a.BITS - this.subnetMask)}`));
+		}
+		wildcardMask() {
+			return e.fromBigInt(BigInt(`0b${"0".repeat(this.subnetMask)}${"1".repeat(a.BITS - this.subnetMask)}`));
+		}
+		networkForm() {
+			return `${this.startAddress().correctForm()}/${this.subnetMask}`;
+		}
 		static fromBigInt(t) {
-			return e.fromHex(t.toString(16));
+			if (t < BigInt(0) || t > BigInt(4294967295)) throw new o.AddressError("IPv4 BigInt must be in the range 0 to 2**32 - 1");
+			return e.fromHex(t.toString(16).padStart(8, "0"));
 		}
 		static fromByteArray(e) {
-			if (e.length !== 4) throw new o.AddressError("IPv4 addresses require exactly 4 bytes");
-			for (let t = 0; t < e.length; t++) if (!Number.isInteger(e[t]) || e[t] < 0 || e[t] > 255) throw new o.AddressError("All bytes must be integers between 0 and 255");
-			return this.fromUnsignedByteArray(e);
+			return i.assertByteArray(e, 4, "IPv4", 0), this.fromUnsignedByteArray(e);
 		}
 		static fromUnsignedByteArray(t) {
 			if (t.length !== 4) throw new o.AddressError("IPv4 addresses require exactly 4 bytes");
-			return new e(t.join("."));
+			let n = t.join(".");
+			return new e(n);
 		}
 		mask(e) {
 			return e === void 0 && (e = this.subnetMask), this.getBitsBase2(0, e);
@@ -171,18 +377,61 @@ var A = (e, t) => () => (t || (e((t = { exports: {} }).exports, t), e = null), t
 			return e.omitSuffix ? t : `${t}.in-addr.arpa.`;
 		}
 		isMulticast() {
-			return this.isInSubnet(new e("224.0.0.0/4"));
+			return this.isHostInSubnet(l);
+		}
+		isPrivate() {
+			return u.some((e) => this.isHostInSubnet(e));
+		}
+		isLoopback() {
+			return this.isHostInSubnet(d);
+		}
+		isLinkLocal() {
+			return this.isHostInSubnet(f);
+		}
+		isUnspecified() {
+			return this.isHostInSubnet(p);
+		}
+		isBroadcast() {
+			return this.isHostInSubnet(m);
+		}
+		isCGNAT() {
+			return this.isHostInSubnet(h);
+		}
+		isDocumentation() {
+			return g.some((e) => this.isHostInSubnet(e));
+		}
+		isBenchmarking() {
+			return this.isHostInSubnet(_);
+		}
+		isReserved() {
+			return this.isHostInSubnet(v);
+		}
+		isGlobal() {
+			return !this.isMulticast() && i.isGloballyReachable.call(this, y);
 		}
 		binaryZeroPad() {
-			return this.bigInt().toString(2).padStart(a.BITS, "0");
+			return this._binaryZeroPad === void 0 && (this._binaryZeroPad = this.bigInt().toString(2).padStart(a.BITS, "0")), this._binaryZeroPad;
 		}
 		groupForV6() {
 			let e = this.parsedAddress;
-			return this.address.replace(a.RE_ADDRESS, `<span class="hover-group group-v4 group-6">${e.slice(0, 2).join(".")}</span>.<span class="hover-group group-v4 group-7">${e.slice(2, 4).join(".")}</span>`);
+			return this.correctForm().replace(a.RE_ADDRESS, `<span class="hover-group group-v4 group-6">${e.slice(0, 2).join(".")}</span>.<span class="hover-group group-v4 group-7">${e.slice(2, 4).join(".")}</span>`);
 		}
 	};
-})), he = /* @__PURE__ */ A(((e) => {
-	Object.defineProperty(e, "__esModule", { value: !0 }), e.RE_URL_WITH_PORT = e.RE_URL = e.RE_ZONE_STRING = e.RE_SUBNET_STRING = e.RE_BAD_ADDRESS = e.RE_BAD_CHARACTERS = e.TYPES = e.SCOPES = e.GROUPS = e.BITS = void 0, e.BITS = 128, e.GROUPS = 8, e.SCOPES = {
+	e.Address4 = c;
+	var l = new c("224.0.0.0/4"), u = [
+		new c("10.0.0.0/8"),
+		new c("172.16.0.0/12"),
+		new c("192.168.0.0/16")
+	], d = new c("127.0.0.0/8"), f = new c("169.254.0.0/16"), p = new c("0.0.0.0/32"), m = new c("255.255.255.255/32"), h = new c("100.64.0.0/10"), g = [
+		new c("192.0.2.0/24"),
+		new c("198.51.100.0/24"),
+		new c("203.0.113.0/24")
+	], _ = new c("198.18.0.0/15"), v = new c("240.0.0.0/4"), y = a.SPECIAL_PURPOSE.map(([e, , t]) => ({
+		subnet: new c(e),
+		reachable: t
+	}));
+})), ye = /* @__PURE__ */ P(((e) => {
+	Object.defineProperty(e, "__esModule", { value: !0 }), e.SPECIAL_PURPOSE = e.RE_URL_WITH_PORT = e.RE_URL = e.RE_ZONE_STRING = e.RE_SUBNET_STRING = e.RE_BAD_ADDRESS = e.RE_BAD_CHARACTERS = e.TYPES = e.SCOPES = e.GROUPS = e.BITS = void 0, e.BITS = 128, e.GROUPS = 8, e.SCOPES = {
 		0: "Reserved",
 		1: "Interface local",
 		2: "Link local",
@@ -212,10 +461,148 @@ var A = (e, t) => () => (t || (e((t = { exports: {} }).exports, t), e = null), t
 		"ff05::1:3/128": "Multicast (All DHCP servers in this site)",
 		"::/128": "Unspecified",
 		"::1/128": "Loopback",
+		"::ffff:0:0/96": "IPv4-mapped",
 		"ff00::/8": "Multicast",
-		"fe80::/10": "Link-local unicast"
-	}, e.RE_BAD_CHARACTERS = /([^0-9a-f:/%])/gi, e.RE_BAD_ADDRESS = /([0-9a-f]{5,}|:{3,}|[^:]:$|^:[^:]|\/$)/gi, e.RE_SUBNET_STRING = /\/\d{1,3}(?=%|$)/, e.RE_ZONE_STRING = /%.*$/, e.RE_URL = /^\[{0,1}([0-9a-f:]+)\]{0,1}/, e.RE_URL_WITH_PORT = /\[([0-9a-f:]+)\]:([0-9]{1,5})/;
-})), ge = /* @__PURE__ */ A(((e) => {
+		"fe80::/10": "Link-local unicast",
+		"fc00::/7": "Unique local",
+		"2001::/32": "Teredo",
+		"2001:2::/48": "Benchmarking",
+		"2002::/16": "6to4",
+		"2001:db8::/32": "Documentation",
+		"3fff::/20": "Documentation",
+		"100::/64": "Discard-only",
+		"fec0::/10": "Site-local unicast (deprecated)",
+		"::/96": "IPv4-compatible (deprecated)",
+		"64:ff9b::/96": "NAT64 (well-known)",
+		"64:ff9b:1::/48": "NAT64 (local-use)"
+	}, e.RE_BAD_CHARACTERS = /([^0-9a-f:/%])/gi, e.RE_BAD_ADDRESS = /([0-9a-f]{5,}|:{3,}|[^:]:$|^:[^:]|\/$)/gi, e.RE_SUBNET_STRING = /\/\d{1,3}(?=%|$)/, e.RE_ZONE_STRING = /%.*$/, e.RE_URL = /^(?:\[([0-9a-f:.]+)\]|([0-9a-f:.]+))(?:[/?#].*)?$/i, e.RE_URL_WITH_PORT = /^\[([0-9a-f:.]+)\]:([0-9]{1,5})(?:[/?#].*)?$/i, e.SPECIAL_PURPOSE = [
+		[
+			"::1/128",
+			"Loopback Address",
+			!1
+		],
+		[
+			"::/128",
+			"Unspecified Address",
+			!1
+		],
+		[
+			"::ffff:0:0/96",
+			"IPv4-mapped Address",
+			!1
+		],
+		[
+			"64:ff9b::/96",
+			"IPv4-IPv6 Translat.",
+			!0
+		],
+		[
+			"64:ff9b:1::/48",
+			"IPv4-IPv6 Translat.",
+			!1
+		],
+		[
+			"100::/64",
+			"Discard-Only Address Block",
+			!1
+		],
+		[
+			"100:0:0:1::/64",
+			"Dummy IPv6 Prefix",
+			!1
+		],
+		[
+			"2001::/23",
+			"IETF Protocol Assignments",
+			!1
+		],
+		[
+			"2001::/32",
+			"TEREDO",
+			!1
+		],
+		[
+			"2001:1::1/128",
+			"Port Control Protocol Anycast",
+			!0
+		],
+		[
+			"2001:1::2/128",
+			"Traversal Using Relays around NAT Anycast",
+			!0
+		],
+		[
+			"2001:1::3/128",
+			"DNS-SD Service Registration Protocol Anycast",
+			!0
+		],
+		[
+			"2001:2::/48",
+			"Benchmarking",
+			!1
+		],
+		[
+			"2001:3::/32",
+			"AMT",
+			!0
+		],
+		[
+			"2001:4:112::/48",
+			"AS112-v6",
+			!0
+		],
+		[
+			"2001:10::/28",
+			"Deprecated (previously ORCHID)",
+			null
+		],
+		[
+			"2001:20::/28",
+			"ORCHIDv2",
+			!0
+		],
+		[
+			"2001:30::/28",
+			"Drone Remote ID Protocol Entity Tags (DETs) Prefix",
+			!0
+		],
+		[
+			"2001:db8::/32",
+			"Documentation",
+			!1
+		],
+		[
+			"2002::/16",
+			"6to4",
+			!1
+		],
+		[
+			"2620:4f:8000::/48",
+			"Direct Delegation AS112 Service",
+			!0
+		],
+		[
+			"3fff::/20",
+			"Documentation",
+			!1
+		],
+		[
+			"5f00::/16",
+			"Segment Routing (SRv6) SIDs",
+			!1
+		],
+		[
+			"fc00::/7",
+			"Unique-Local",
+			!1
+		],
+		[
+			"fe80::/10",
+			"Link-Local Unicast",
+			!1
+		]
+	];
+})), be = /* @__PURE__ */ P(((e) => {
 	Object.defineProperty(e, "__esModule", { value: !0 }), e.escapeHtml = t, e.spanAllZeroes = n, e.spanAll = r, e.spanLeadingZeroes = a, e.simpleGroup = o;
 	function t(e) {
 		return e.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
@@ -235,7 +622,7 @@ var A = (e, t) => () => (t || (e((t = { exports: {} }).exports, t), e = null), t
 	function o(e, t = 0) {
 		return e.split(":").map((e, n) => /group-v4/.test(e) ? e : `<span class="hover-group group-${n + t}">${i(e)}</span>`);
 	}
-})), _e = /* @__PURE__ */ A(((e) => {
+})), xe = /* @__PURE__ */ P(((e) => {
 	var t = e && e.__createBinding || (Object.create ? (function(e, t, n, r) {
 		r === void 0 && (r = n);
 		var i = Object.getOwnPropertyDescriptor(t, n);
@@ -261,7 +648,7 @@ var A = (e, t) => () => (t || (e((t = { exports: {} }).exports, t), e = null), t
 		return n(r, e), r;
 	};
 	Object.defineProperty(e, "__esModule", { value: !0 }), e.ADDRESS_BOUNDARY = void 0, e.groupPossibilities = a, e.padGroup = o, e.simpleRegularExpression = s, e.possibleElisions = c;
-	var i = r(he());
+	var i = r(ye());
 	function a(e) {
 		return `(${e.join("|")})`;
 	}
@@ -289,7 +676,7 @@ var A = (e, t) => () => (t || (e((t = { exports: {} }).exports, t), e = null), t
 		for (let t = 1; t < e - 1; t++) for (let n = 1; n < e - t; n++) o.push(`(0{1,4}:){${n}}:(0{1,4}:){${e - n - t - 1}}0{1,4}`);
 		return a(o);
 	}
-})), ve = /* @__PURE__ */ A(((e) => {
+})), Se = /* @__PURE__ */ P(((e) => {
 	var t = e && e.__createBinding || (Object.create ? (function(e, t, n, r) {
 		r === void 0 && (r = n);
 		var i = Object.getOwnPropertyDescriptor(t, n);
@@ -315,37 +702,38 @@ var A = (e, t) => () => (t || (e((t = { exports: {} }).exports, t), e = null), t
 		return n(r, e), r;
 	};
 	Object.defineProperty(e, "__esModule", { value: !0 }), e.Address6 = void 0;
-	var i = r(j()), a = r(fe()), o = r(he()), s = r(ge()), c = me(), l = _e(), u = pe(), d = j();
-	function f(e) {
+	var i = r(ge()), a = r(_e()), o = r(ye()), s = r(be()), c = ve(), l = xe(), u = F(), d = ge(), f = i.isCorrect(o.BITS);
+	function p(e) {
 		if (!e) throw Error("Assertion failed.");
 	}
-	function p(e) {
+	function m(e) {
 		let t = /(\d+)(\d{3})/;
 		for (; t.test(e);) e = e.replace(t, "$1,$2");
 		return e;
 	}
-	function m(e) {
+	function h(e) {
 		return e = e.replace(/^(0{1,})([1-9]+)$/, "<span class=\"parse-error\">$1</span>$2"), e = e.replace(/^(0{1,})(0)$/, "<span class=\"parse-error\">$1</span>$2"), e;
 	}
-	function h(e, t) {
+	function g(e, t) {
 		let n = [], r = [], i;
 		for (i = 0; i < e.length; i++) i < t[0] ? n.push(e[i]) : i > t[1] && r.push(e[i]);
 		return n.concat(["compact"]).concat(r);
 	}
-	function g(e) {
+	function _(e) {
 		return parseInt(e, 16).toString(16).padStart(4, "0");
 	}
-	function ee(e) {
+	function v(e) {
 		return e & 255;
 	}
-	e.Address6 = class e {
+	var y = class e {
 		constructor(e, t) {
-			this.addressMinusSuffix = "", this.parsedSubnet = "", this.subnet = "/128", this.subnetMask = 128, this.v4 = !1, this.zone = "", this.isInSubnet = i.isInSubnet, this.isCorrect = i.isCorrect(o.BITS), t === void 0 ? this.groups = o.GROUPS : this.groups = t, this.address = e;
+			this.addressMinusSuffix = "", this.parsedSubnet = "", this.subnet = "/128", this.subnetMask = 128, this.v4 = !1, this.zone = "", this.isInSubnet = i.isInSubnet, this.isHostInSubnet = i.isHostInSubnet, this.isCorrect = f, this.groups = t === void 0 ? o.GROUPS : t, this.address = e;
 			let n = o.RE_SUBNET_STRING.exec(e);
 			if (n) {
 				if (this.parsedSubnet = n[0].replace("/", ""), this.subnetMask = parseInt(this.parsedSubnet, 10), this.subnet = `/${this.subnetMask}`, Number.isNaN(this.subnetMask) || this.subnetMask < 0 || this.subnetMask > o.BITS) throw new u.AddressError("Invalid subnet mask.");
 				e = e.replace(o.RE_SUBNET_STRING, "");
-			} else if (/\//.test(e)) throw new u.AddressError("Invalid subnet mask.");
+			}
+			if (/\//.test(e)) throw new u.AddressError("Invalid subnet mask.");
 			let r = o.RE_ZONE_STRING.exec(e);
 			r && (this.zone = r[0], e = e.replace(o.RE_ZONE_STRING, "")), this.addressMinusSuffix = e, this.parsedAddress = this.parse(this.addressMinusSuffix);
 		}
@@ -357,45 +745,83 @@ var A = (e, t) => () => (t || (e((t = { exports: {} }).exports, t), e = null), t
 			}
 		}
 		static fromBigInt(t) {
-			let n = t.toString(16).padStart(32, "0"), r = [], i;
-			for (i = 0; i < o.GROUPS; i++) r.push(n.slice(i * 4, (i + 1) * 4));
+			if (t < BigInt(0) || t > (BigInt(1) << BigInt(o.BITS)) - BigInt(1)) throw new u.AddressError("IPv6 BigInt must be in the range 0 to 2**128 - 1");
+			let n = t.toString(16).padStart(32, "0"), r = [];
+			for (let e = 0; e < o.GROUPS; e++) r.push(n.slice(e * 4, (e + 1) * 4));
 			return new e(r.join(":"));
 		}
 		static fromURL(t) {
-			let n, r = null, i;
-			if (t.indexOf("[") !== -1 && t.indexOf("]:") !== -1) {
-				if (i = o.RE_URL_WITH_PORT.exec(t), i === null) return {
-					error: "failed to parse address with port",
+			let n, r = null, i, a, s = t.replace(/^[a-z][a-z0-9+.-]*:\/\//i, "");
+			if (s.indexOf("[") !== -1 && s.indexOf("]:") !== -1) {
+				if (a = "failed to parse address with port", i = o.RE_URL_WITH_PORT.exec(s), i === null) return {
+					error: a,
 					address: null,
 					port: null
 				};
 				n = i[1], r = i[2];
-			} else if (t.indexOf("/") !== -1) {
-				if (t = t.replace(/^[a-z0-9]+:\/\//, ""), i = o.RE_URL.exec(t), i === null) return {
-					error: "failed to parse address from URL",
+			} else {
+				if (a = "failed to parse address from URL", i = o.RE_URL.exec(s), i === null) return {
+					error: a,
+					address: null,
+					port: null
+				};
+				n = i[1] ?? i[2];
+			}
+			r ? (r = parseInt(r, 10), (r < 0 || r > 65535) && (r = null)) : r = null;
+			let c;
+			try {
+				c = new e(n);
+			} catch {
+				return {
+					error: a,
 					address: null,
 					port: null
 				};
-				n = i[1];
-			} else n = t;
-			return r ? (r = parseInt(r, 10), (r < 0 || r > 65536) && (r = null)) : r = null, {
-				address: new e(n),
+			}
+			return {
+				address: c,
 				port: r
 			};
 		}
+		static fromAddressAndMask(t, n) {
+			let r = i.prefixLengthFromMask(new e(n).bigInt(), o.BITS);
+			return new e(`${t}/${r}`);
+		}
+		static fromAddressAndWildcardMask(t, n) {
+			let r = new e(n).bigInt() ^ (BigInt(1) << BigInt(o.BITS)) - BigInt(1), a = i.prefixLengthFromMask(r, o.BITS);
+			return new e(`${t}/${a}`);
+		}
+		static fromWildcard(t) {
+			if (t.includes("%") || t.includes("/")) throw new u.AddressError("Wildcard pattern must not include a zone or CIDR suffix");
+			let n = t.split("::");
+			if (n.length > 2) throw new u.AddressError("Wildcard pattern cannot contain more than one '::'");
+			let r;
+			if (n.length === 2) {
+				let e = n[0] === "" ? [] : n[0].split(":"), t = n[1] === "" ? [] : n[1].split(":"), i = o.GROUPS - e.length - t.length;
+				if (i < 1) throw new u.AddressError("Wildcard pattern with '::' has too many groups");
+				r = [
+					...e,
+					...Array(i).fill("0"),
+					...t
+				];
+			} else r = t.split(":");
+			if (r.length !== o.GROUPS) throw new u.AddressError("Wildcard pattern must have 8 groups");
+			let i = -1;
+			for (let e = 0; e < r.length; e++) if (r[e] === "*") i === -1 && (i = e);
+			else if (i !== -1) throw new u.AddressError("Wildcard `*` must only appear in trailing groups (e.g. `2001:db8:*:*:*:*:*:*`)");
+			let a = i === -1 ? 0 : r.length - i, s = r.map((e) => e === "*" ? "0" : e), c = o.BITS - a * 16;
+			return new e(`${s.join(":")}/${c}`);
+		}
 		static fromAddress4(t) {
 			let n = new c.Address4(t), r = o.BITS - (a.BITS - n.subnetMask);
 			return new e(`::ffff:${n.correctForm()}/${r}`);
 		}
 		static fromArpa(t) {
-			let n = t.replace(/(\.ip6\.arpa)?\.$/, "");
-			if (n.length !== 63) throw new u.AddressError("Invalid 'ip6.arpa' form.");
-			let r = n.split(".").reverse();
-			for (let e = 7; e > 0; e--) {
-				let t = e * 4;
-				r.splice(t, 0, ":");
-			}
-			return n = r.join(""), new e(n);
+			let n = t.replace(/(\.ip6\.arpa)?\.?$/, "");
+			if (!/^[0-9a-f](\.[0-9a-f]){0,31}$/i.test(n)) throw new u.AddressError("Invalid 'ip6.arpa' form.");
+			let r = n.split(".").reverse(), i = r.length * 4, a = r.join("").padEnd(32, "0"), s = [];
+			for (let e = 0; e < o.GROUPS; e++) s.push(a.slice(e * 4, (e + 1) * 4));
+			return new e(`${s.join(":")}/${i}`);
 		}
 		microsoftTranscription() {
 			return `${this.correctForm().replace(/:/g, "-")}.ipv6-literal.net`;
@@ -405,7 +831,7 @@ var A = (e, t) => () => (t || (e((t = { exports: {} }).exports, t), e = null), t
 		}
 		possibleSubnets(e = 128) {
 			let t = o.BITS - this.subnetMask - Math.abs(e - o.BITS);
-			return t < 0 ? "0" : p((BigInt("2") ** BigInt(t)).toString(10));
+			return t < 0 ? "0" : m((BigInt("2") ** BigInt(t)).toString(10));
 		}
 		_startAddress() {
 			return BigInt(`0b${this.mask() + "0".repeat(o.BITS - this.subnetMask)}`);
@@ -427,12 +853,33 @@ var A = (e, t) => () => (t || (e((t = { exports: {} }).exports, t), e = null), t
 			let t = BigInt("1");
 			return e.fromBigInt(this._endAddress() - t);
 		}
+		offset(t) {
+			return e.fromBigInt(i.offsetBigInt(this.bigInt(), t, o.BITS, "IPv6")).withSubnetMask(this.subnetMask);
+		}
+		nextNetwork() {
+			return e.fromBigInt(i.offsetBigInt(this._endAddress(), 1, o.BITS, "IPv6")).withSubnetMask(this.subnetMask);
+		}
+		withSubnetMask(t) {
+			return new e(`${this.correctForm()}/${t}`);
+		}
+		subnetMaskAddress() {
+			return e.fromBigInt(BigInt(`0b${"1".repeat(this.subnetMask)}${"0".repeat(o.BITS - this.subnetMask)}`));
+		}
+		wildcardMask() {
+			return e.fromBigInt(BigInt(`0b${"0".repeat(this.subnetMask)}${"1".repeat(o.BITS - this.subnetMask)}`));
+		}
+		networkForm() {
+			return `${this.startAddress().correctForm()}/${this.subnetMask}`;
+		}
 		getScope() {
-			let e = o.SCOPES[parseInt(this.getBits(12, 16).toString(10), 10)];
-			return this.getType() === "Global unicast" && e !== "Link local" && (e = "Global"), e || "Unknown";
+			let e = this.getType();
+			return e === "Multicast" || e.startsWith("Multicast ") ? o.SCOPES[parseInt(this.getBits(12, 16).toString(10), 10)] || "Unknown" : e === "Link-local unicast" || e === "Loopback" ? "Link local" : e === "Unspecified" ? "Unknown" : "Global";
 		}
 		getType() {
-			for (let t of Object.keys(o.TYPES)) if (this.isInSubnet(new e(t))) return o.TYPES[t];
+			for (let e = 0; e < b.length; e++) {
+				let t = b[e];
+				if (this.isHostInSubnet(t[0])) return t[1];
+			}
 			return "Global unicast";
 		}
 		getBits(e, t) {
@@ -464,24 +911,27 @@ var A = (e, t) => () => (t || (e((t = { exports: {} }).exports, t), e = null), t
 			let i = r.map((e) => e[1] - e[0] + 1);
 			if (r.length > 0) {
 				let e = i.indexOf(Math.max(...i));
-				t = h(this.parsedAddress, r[e]);
+				t = g(this.parsedAddress, r[e]);
 			} else t = this.parsedAddress;
 			for (e = 0; e < t.length; e++) t[e] !== "compact" && (t[e] = parseInt(t[e], 16).toString(16));
 			let a = t.join(":");
 			return a = a.replace(/^compact$/, "::"), a = a.replace(/(^compact)|(compact$)/, ":"), a = a.replace(/compact/, ""), a;
 		}
 		binaryZeroPad() {
-			return this.bigInt().toString(2).padStart(o.BITS, "0");
+			return this._binaryZeroPad === void 0 && (this._binaryZeroPad = this.bigInt().toString(2).padStart(o.BITS, "0")), this._binaryZeroPad;
 		}
 		parse4in6(e) {
-			let t = e.split(":"), n = t.slice(-1)[0].match(a.RE_ADDRESS);
-			if (n) {
-				this.parsedAddress4 = n[0], this.address4 = new c.Address4(this.parsedAddress4);
-				for (let e = 0; e < this.address4.groups; e++) if (/^0[0-9]+/.test(this.address4.parsedAddress[e])) {
-					let e = this.address4.parsedAddress.map(m).join("."), n = t.slice(0, -1).map(s.escapeHtml).join(":"), r = t.length > 1 ? ":" : "";
-					throw new u.AddressError("IPv4 addresses can't have leading zeroes.", `${n}${r}${e}`);
-				}
-				this.v4 = !0, t[t.length - 1] = this.address4.toGroup6(), e = t.join(":");
+			if (e.indexOf(".") === -1) return e;
+			let t = e.split(":"), n = t.slice(-1)[0], r = n.split(".");
+			if (r.length === a.GROUPS && r.every((e) => /^\d{1,3}$/.test(e)) && r.some((e) => /^0\d/.test(e))) {
+				let e = r.map(h).join("."), n = t.slice(0, -1).map(s.escapeHtml).join(":"), i = t.length > 1 ? ":" : "";
+				throw new u.AddressError("IPv4 addresses can't have leading zeroes.", `${n}${i}${e}`);
+			}
+			let i = n.match(a.RE_ADDRESS);
+			if (i) {
+				this.parsedAddress4 = i[0];
+				let n = this.subnetMask >= 96 ? `/${this.subnetMask - 96}` : "";
+				this.address4 = new c.Address4(`${this.parsedAddress4}${n}`), this.v4 = !0, t[t.length - 1] = this.address4.toGroup6(), e = t.join(":");
 			}
 			return e;
 		}
@@ -506,24 +956,29 @@ var A = (e, t) => () => (t || (e((t = { exports: {} }).exports, t), e = null), t
 			return r;
 		}
 		canonicalForm() {
-			return this.parsedAddress.map(g).join(":");
+			return this.parsedAddress.map(_).join(":");
 		}
 		decimal() {
 			return this.parsedAddress.map((e) => parseInt(e, 16).toString(10).padStart(5, "0")).join(":");
 		}
 		bigInt() {
-			return BigInt(`0x${this.parsedAddress.map(g).join("")}`);
+			return BigInt(`0x${this.parsedAddress.map(_).join("")}`);
 		}
 		to4() {
-			let e = this.binaryZeroPad().split("");
-			return c.Address4.fromHex(BigInt(`0b${e.slice(96, 128).join("")}`).toString(16));
+			let e = this.binaryZeroPad().split(""), t = BigInt(`0b${e.slice(96, 128).join("")}`).toString(16).padStart(8, "0");
+			if (this.subnetMask >= 96) {
+				let e = this.subnetMask - 96, n = [];
+				for (let e = 0; e < 8; e += 2) n.push(parseInt(t.slice(e, e + 2), 16));
+				return new c.Address4(`${n.join(".")}/${e}`);
+			}
+			return c.Address4.fromHex(t);
 		}
 		to4in6() {
 			let t = this.to4(), n = new e(this.parsedAddress.slice(0, 6).join(":"), 6).correctForm(), r = "";
-			return /:$/.test(n) || (r = ":"), n + r + t.address;
+			return /:$/.test(n) || (r = ":"), n + r + t.correctForm();
 		}
 		inspectTeredo() {
-			let e = this.getBitsBase16(0, 32), t = (this.getBits(80, 96) ^ BigInt("0xffff")).toString(), n = c.Address4.fromHex(this.getBitsBase16(32, 64)), r = this.getBits(96, 128), i = c.Address4.fromHex((r ^ BigInt("0xffffffff")).toString(16)), a = this.getBitsBase2(64, 80), o = (0, d.testBit)(a, 15), s = (0, d.testBit)(a, 14), l = (0, d.testBit)(a, 8), u = (0, d.testBit)(a, 9), f = BigInt(`0b${a.slice(2, 6) + a.slice(8, 16)}`).toString(10);
+			let e = this.getBitsBase16(0, 32), t = (this.getBits(80, 96) ^ BigInt("0xffff")).toString(), n = c.Address4.fromHex(this.getBitsBase16(32, 64)), r = this.getBits(96, 128), i = c.Address4.fromHex((r ^ BigInt("0xffffffff")).toString(16).padStart(8, "0")), a = this.getBitsBase2(64, 80), o = (0, d.testBit)(a, 15), s = (0, d.testBit)(a, 14), l = (0, d.testBit)(a, 8), u = (0, d.testBit)(a, 9), f = BigInt(`0b${a.slice(2, 6) + a.slice(8, 16)}`).toString(10);
 			return {
 				prefix: `${e.slice(0, 4)}:${e.slice(4, 8)}`,
 				server4: n.address,
@@ -547,50 +1002,127 @@ var A = (e, t) => () => (t || (e((t = { exports: {} }).exports, t), e = null), t
 			};
 		}
 		to6to4() {
-			return this.is4() ? new e([
+			if (!this.is4()) return null;
+			let t = [
 				"2002",
 				this.getBitsBase16(96, 112),
 				this.getBitsBase16(112, 128),
 				"",
 				"/16"
-			].join(":")) : null;
+			].join(":");
+			return new e(t);
+		}
+		static fromAddress4Nat64(t, n = "64:ff9b::/96") {
+			let r = new c.Address4(t), i = new e(n), a = i.subnetMask;
+			if (a !== 32 && a !== 40 && a !== 48 && a !== 56 && a !== 64 && a !== 96) throw new u.AddressError("NAT64 prefix length must be 32, 40, 48, 56, 64, or 96");
+			let o = i.binaryZeroPad(), s = r.binaryZeroPad(), l;
+			if (a === 96) l = o.slice(0, 96) + s;
+			else {
+				let e = 64 - a;
+				l = [
+					o.slice(0, a),
+					s.slice(0, e),
+					"00000000",
+					s.slice(e),
+					"0".repeat(56 - (32 - e))
+				].join("");
+			}
+			let d = BigInt(`0b${l}`).toString(16).padStart(32, "0"), f = [];
+			for (let e = 0; e < 8; e++) f.push(d.slice(e * 4, (e + 1) * 4));
+			return new e(f.join(":"));
+		}
+		toAddress4Nat64(t = "64:ff9b::/96") {
+			let n = new e(t), r = n.subnetMask;
+			if (r !== 32 && r !== 40 && r !== 48 && r !== 56 && r !== 64 && r !== 96) throw new u.AddressError("NAT64 prefix length must be 32, 40, 48, 56, 64, or 96");
+			if (!this.isHostInSubnet(n)) return null;
+			let i = this.binaryZeroPad(), a;
+			if (r === 96) a = i.slice(96, 128);
+			else {
+				let e = 64 - r;
+				a = i.slice(r, r + e) + i.slice(72, 72 + (32 - e));
+			}
+			let o = [];
+			for (let e = 0; e < 4; e++) o.push(parseInt(a.slice(e * 8, (e + 1) * 8), 2).toString());
+			return new c.Address4(o.join("."));
 		}
 		toByteArray() {
-			let e = this.bigInt().toString(16), t = `${"0".repeat(e.length % 2)}${e}`, n = [];
-			for (let e = 0, r = t.length; e < r; e += 2) n.push(parseInt(t.substring(e, e + 2), 16));
-			return n;
+			let e = this.bigInt().toString(16).padStart(o.BITS / 4, "0"), t = [];
+			for (let n = 0, r = e.length; n < r; n += 2) t.push(parseInt(e.substring(n, n + 2), 16));
+			return t;
 		}
 		toUnsignedByteArray() {
-			return this.toByteArray().map(ee);
+			return this.toByteArray().map(v);
 		}
 		static fromByteArray(e) {
-			return this.fromUnsignedByteArray(e.map(ee));
+			return i.assertByteArray(e, 16, "IPv6", -128), this.fromUnsignedByteArray(e.map(v));
 		}
 		static fromUnsignedByteArray(t) {
-			let n = BigInt("256"), r = BigInt("0"), i = BigInt("1");
-			for (let e = t.length - 1; e >= 0; e--) r += i * BigInt(t[e].toString(10)), i *= n;
+			i.assertByteArray(t, 16, "IPv6", 0);
+			let n = BigInt("256"), r = BigInt("0"), a = BigInt("1");
+			for (let e = t.length - 1; e >= 0; e--) r += a * BigInt(t[e].toString(10)), a *= n;
 			return e.fromBigInt(r);
 		}
 		isCanonical() {
 			return this.addressMinusSuffix === this.canonicalForm();
 		}
 		isLinkLocal() {
-			return this.getBitsBase2(0, 64) === "1111111010000000000000000000000000000000000000000000000000000000";
+			let e = this.embeddedIPv4();
+			return e ? e.isLinkLocal() : this.isHostInSubnet(ee);
 		}
 		isMulticast() {
-			return this.getType() === "Multicast";
+			let e = this.embeddedIPv4();
+			if (e) return e.isMulticast();
+			let t = this.getType();
+			return t === "Multicast" || t.startsWith("Multicast ");
 		}
 		is4() {
 			return this.v4;
 		}
+		isMapped4() {
+			return this.isHostInSubnet(O);
+		}
+		embeddedIPv4() {
+			return this.isMapped4() || this.isHostInSubnet(k) ? this.to4() : null;
+		}
 		isTeredo() {
-			return this.isInSubnet(new e("2001::/32"));
+			return this.isHostInSubnet(x);
 		}
 		is6to4() {
-			return this.isInSubnet(new e("2002::/16"));
+			return this.isHostInSubnet(S);
 		}
 		isLoopback() {
-			return this.getType() === "Loopback";
+			let e = this.embeddedIPv4();
+			return e ? e.isLoopback() : this.getType() === "Loopback";
+		}
+		isULA() {
+			return this.isHostInSubnet(C);
+		}
+		isPrivate() {
+			let e = this.embeddedIPv4();
+			return e ? e.isPrivate() : this.isULA() || this.isHostInSubnet(A);
+		}
+		isCGNAT() {
+			let e = this.embeddedIPv4();
+			return e ? e.isCGNAT() : !1;
+		}
+		isBroadcast() {
+			let e = this.embeddedIPv4();
+			return e ? e.isBroadcast() : !1;
+		}
+		isUnspecified() {
+			let e = this.embeddedIPv4();
+			return e ? e.isUnspecified() : this.getType() === "Unspecified";
+		}
+		isDocumentation() {
+			return w.some((e) => this.isHostInSubnet(e));
+		}
+		isBenchmarking() {
+			let e = this.embeddedIPv4();
+			return e ? e.isBenchmarking() : this.isHostInSubnet(T);
+		}
+		isGlobal() {
+			let e = this.embeddedIPv4();
+			return e ? e.isGlobal() : this.isHostInSubnet(E) && i.isGloballyReachable.call(this, D);
 		}
 		href(e) {
 			return e = e === void 0 ? "" : `:${e}`, `http://[${this.correctForm()}]${e}/`;
@@ -604,12 +1136,12 @@ var A = (e, t) => () => (t || (e((t = { exports: {} }).exports, t), e = null), t
 		}
 		group() {
 			if (this.elidedGroups === 0) return s.simpleGroup(this.addressMinusSuffix).join(":");
-			f(typeof this.elidedGroups == "number"), f(typeof this.elisionBegin == "number");
+			p(typeof this.elidedGroups == "number"), p(typeof this.elisionBegin == "number");
 			let e = [], [t, n] = this.addressMinusSuffix.split("::");
 			t.length ? e.push(...s.simpleGroup(t)) : e.push("");
 			let r = ["hover-group"];
 			for (let e = this.elisionBegin; e < this.elisionBegin + this.elidedGroups; e++) r.push(`group-${e}`);
-			return e.push(`<span class="${r.join(" ")}"></span>`), n.length ? e.push(...s.simpleGroup(n, this.elisionEnd)) : e.push(""), this.is4() && (f(this.address4 instanceof c.Address4), e.pop(), e.push(this.address4.groupForV6())), e.join(":");
+			return e.push(`<span class="${r.join(" ")}"></span>`), n.length ? e.push(...s.simpleGroup(n, this.elisionEnd)) : e.push(""), this.is4() && (p(this.address4 instanceof c.Address4), e.pop(), e.push(this.address4.groupForV6())), e.join(":");
 		}
 		regularExpressionString(t = !1) {
 			let n = [], r = new e(this.correctForm());
@@ -617,7 +1149,7 @@ var A = (e, t) => () => (t || (e((t = { exports: {} }).exports, t), e = null), t
 			else if (r.elidedGroups === o.GROUPS) n.push((0, l.possibleElisions)(o.GROUPS));
 			else {
 				let e = r.address.split("::");
-				e[0].length && n.push((0, l.simpleRegularExpression)(e[0].split(":"))), f(typeof r.elidedGroups == "number"), n.push((0, l.possibleElisions)(r.elidedGroups, e[0].length !== 0, e[1].length !== 0)), e[1].length && n.push((0, l.simpleRegularExpression)(e[1].split(":"))), n = [n.join(":")];
+				e[0].length && n.push((0, l.simpleRegularExpression)(e[0].split(":"))), p(typeof r.elidedGroups == "number"), n.push((0, l.possibleElisions)(r.elidedGroups, e[0].length !== 0, e[1].length !== 0)), e[1].length && n.push((0, l.simpleRegularExpression)(e[1].split(":"))), n = [n.join(":")];
 			}
 			return t || (n = [
 				"(?=^|",
@@ -633,7 +1165,12 @@ var A = (e, t) => () => (t || (e((t = { exports: {} }).exports, t), e = null), t
 			return new RegExp(this.regularExpressionString(e), "i");
 		}
 	};
-})), ye = (/* @__PURE__ */ A(((e) => {
+	e.Address6 = y;
+	var b = Object.keys(o.TYPES).map((e) => [new y(e), o.TYPES[e]]), x = new y("2001::/32"), S = new y("2002::/16"), C = new y("fc00::/7"), ee = new y("fe80::/10"), w = [new y("2001:db8::/32"), new y("3fff::/20")], T = new y("2001:2::/48"), E = new y("2000::/3"), D = o.SPECIAL_PURPOSE.map(([e, , t]) => ({
+		subnet: new y(e),
+		reachable: t
+	})), O = new y("::ffff:0:0/96"), k = new y("64:ff9b::/96"), A = new y("64:ff9b:1::/48");
+})), Ce = /* @__PURE__ */ P(((e) => {
 	var t = e && e.__createBinding || (Object.create ? (function(e, t, n, r) {
 		r === void 0 && (r = n);
 		var i = Object.getOwnPropertyDescriptor(t, n);
@@ -659,37 +1196,222 @@ var A = (e, t) => () => (t || (e((t = { exports: {} }).exports, t), e = null), t
 		return n(r, e), r;
 	};
 	Object.defineProperty(e, "__esModule", { value: !0 }), e.v6 = e.AddressError = e.Address6 = e.Address4 = void 0;
-	var i = me();
+	var i = ve();
 	Object.defineProperty(e, "Address4", {
 		enumerable: !0,
 		get: function() {
 			return i.Address4;
 		}
 	});
-	var a = ve();
+	var a = Se();
 	Object.defineProperty(e, "Address6", {
 		enumerable: !0,
 		get: function() {
 			return a.Address6;
 		}
 	});
-	var o = pe();
+	var o = F();
 	Object.defineProperty(e, "AddressError", {
 		enumerable: !0,
 		get: function() {
 			return o.AddressError;
 		}
-	}), e.v6 = { helpers: r(ge()) };
-})))();
-function be(e, t = 56) {
+	}), e.v6 = { helpers: r(be()) };
+})), we = /* @__PURE__ */ P(((e, t) => {
+	var n = 1e3, r = n * 60, i = r * 60, a = i * 24, o = a * 7, s = a * 365.25;
+	t.exports = function(e, t) {
+		t ||= {};
+		var n = typeof e;
+		if (n === "string" && e.length > 0) return c(e);
+		if (n === "number" && isFinite(e)) return t.long ? u(e) : l(e);
+		throw Error("val is not a non-empty string or a valid number. val=" + JSON.stringify(e));
+	};
+	function c(e) {
+		if (e = String(e), !(e.length > 100)) {
+			var t = /^(-?(?:\d+)?\.?\d+) *(milliseconds?|msecs?|ms|seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)?$/i.exec(e);
+			if (t) {
+				var c = parseFloat(t[1]);
+				switch ((t[2] || "ms").toLowerCase()) {
+					case "years":
+					case "year":
+					case "yrs":
+					case "yr":
+					case "y": return c * s;
+					case "weeks":
+					case "week":
+					case "w": return c * o;
+					case "days":
+					case "day":
+					case "d": return c * a;
+					case "hours":
+					case "hour":
+					case "hrs":
+					case "hr":
+					case "h": return c * i;
+					case "minutes":
+					case "minute":
+					case "mins":
+					case "min":
+					case "m": return c * r;
+					case "seconds":
+					case "second":
+					case "secs":
+					case "sec":
+					case "s": return c * n;
+					case "milliseconds":
+					case "millisecond":
+					case "msecs":
+					case "msec":
+					case "ms": return c;
+					default: return;
+				}
+			}
+		}
+	}
+	function l(e) {
+		var t = Math.abs(e);
+		return t >= a ? Math.round(e / a) + "d" : t >= i ? Math.round(e / i) + "h" : t >= r ? Math.round(e / r) + "m" : t >= n ? Math.round(e / n) + "s" : e + "ms";
+	}
+	function u(e) {
+		var t = Math.abs(e);
+		return t >= a ? d(e, t, a, "day") : t >= i ? d(e, t, i, "hour") : t >= r ? d(e, t, r, "minute") : t >= n ? d(e, t, n, "second") : e + " ms";
+	}
+	function d(e, t, n, r) {
+		var i = t >= n * 1.5;
+		return Math.round(e / n) + " " + r + (i ? "s" : "");
+	}
+})), Te = /* @__PURE__ */ P(((e, t) => {
+	function n(e) {
+		n.debug = n, n.default = n, n.coerce = c, n.disable = o, n.enable = i, n.enabled = s, n.humanize = we(), n.destroy = l, Object.keys(e).forEach((t) => {
+			n[t] = e[t];
+		}), n.names = [], n.skips = [], n.formatters = {};
+		function t(e) {
+			let t = 0;
+			for (let n = 0; n < e.length; n++) t = (t << 5) - t + e.charCodeAt(n), t |= 0;
+			return n.colors[Math.abs(t) % n.colors.length];
+		}
+		n.selectColor = t;
+		function n(e) {
+			let t, i = null, a, o;
+			function s(...e) {
+				if (!s.enabled) return;
+				let r = s, i = Number(/* @__PURE__ */ new Date());
+				r.diff = i - (t || i), r.prev = t, r.curr = i, t = i, e[0] = n.coerce(e[0]), typeof e[0] != "string" && e.unshift("%O");
+				let a = 0;
+				e[0] = e[0].replace(/%([a-zA-Z%])/g, (t, i) => {
+					if (t === "%%") return "%";
+					a++;
+					let o = n.formatters[i];
+					if (typeof o == "function") {
+						let n = e[a];
+						t = o.call(r, n), e.splice(a, 1), a--;
+					}
+					return t;
+				}), n.formatArgs.call(r, e), (r.log || n.log).apply(r, e);
+			}
+			return s.namespace = e, s.useColors = n.useColors(), s.color = n.selectColor(e), s.extend = r, s.destroy = n.destroy, Object.defineProperty(s, "enabled", {
+				enumerable: !0,
+				configurable: !1,
+				get: () => i === null ? (a !== n.namespaces && (a = n.namespaces, o = n.enabled(e)), o) : i,
+				set: (e) => {
+					i = e;
+				}
+			}), typeof n.init == "function" && n.init(s), s;
+		}
+		function r(e, t) {
+			let r = n(this.namespace + (t === void 0 ? ":" : t) + e);
+			return r.log = this.log, r;
+		}
+		function i(e) {
+			n.save(e), n.namespaces = e, n.names = [], n.skips = [];
+			let t = (typeof e == "string" ? e : "").trim().replace(/\s+/g, ",").split(",").filter(Boolean);
+			for (let e of t) e[0] === "-" ? n.skips.push(e.slice(1)) : n.names.push(e);
+		}
+		function a(e, t) {
+			let n = 0, r = 0, i = -1, a = 0;
+			for (; n < e.length;) if (r < t.length && (t[r] === e[n] || t[r] === "*")) t[r] === "*" ? (i = r, a = n, r++) : (n++, r++);
+			else if (i !== -1) r = i + 1, a++, n = a;
+			else return !1;
+			for (; r < t.length && t[r] === "*";) r++;
+			return r === t.length;
+		}
+		function o() {
+			let e = [...n.names, ...n.skips.map((e) => "-" + e)].join(",");
+			return n.enable(""), e;
+		}
+		function s(e) {
+			for (let t of n.skips) if (a(e, t)) return !1;
+			for (let t of n.names) if (a(e, t)) return !0;
+			return !1;
+		}
+		function c(e) {
+			return e instanceof Error ? e.stack || e.message : e;
+		}
+		function l() {
+			console.warn("Instance method `debug.destroy()` is deprecated and no longer does anything. It will be removed in the next major version of `debug`.");
+		}
+		return n.enable(n.load()), n;
+	}
+	t.exports = n;
+})), Ee = /* @__PURE__ */ P(((e, t) => {
+	e.formatArgs = r, e.save = i, e.load = a, e.useColors = n, e.storage = o(), e.destroy = (() => {
+		let e = !1;
+		return () => {
+			e || (e = !0, console.warn("Instance method `debug.destroy()` is deprecated and no longer does anything. It will be removed in the next major version of `debug`."));
+		};
+	})(), e.colors = /* @__PURE__ */ "#0000CC.#0000FF.#0033CC.#0033FF.#0066CC.#0066FF.#0099CC.#0099FF.#00CC00.#00CC33.#00CC66.#00CC99.#00CCCC.#00CCFF.#3300CC.#3300FF.#3333CC.#3333FF.#3366CC.#3366FF.#3399CC.#3399FF.#33CC00.#33CC33.#33CC66.#33CC99.#33CCCC.#33CCFF.#6600CC.#6600FF.#6633CC.#6633FF.#66CC00.#66CC33.#9900CC.#9900FF.#9933CC.#9933FF.#99CC00.#99CC33.#CC0000.#CC0033.#CC0066.#CC0099.#CC00CC.#CC00FF.#CC3300.#CC3333.#CC3366.#CC3399.#CC33CC.#CC33FF.#CC6600.#CC6633.#CC9900.#CC9933.#CCCC00.#CCCC33.#FF0000.#FF0033.#FF0066.#FF0099.#FF00CC.#FF00FF.#FF3300.#FF3333.#FF3366.#FF3399.#FF33CC.#FF33FF.#FF6600.#FF6633.#FF9900.#FF9933.#FFCC00.#FFCC33".split(".");
+	function n() {
+		if (typeof window < "u" && window.process && (window.process.type === "renderer" || window.process.__nwjs)) return !0;
+		if (typeof navigator < "u" && navigator.userAgent && navigator.userAgent.toLowerCase().match(/(edge|trident)\/(\d+)/)) return !1;
+		let e;
+		return typeof document < "u" && document.documentElement && document.documentElement.style && document.documentElement.style.WebkitAppearance || typeof window < "u" && window.console && (window.console.firebug || window.console.exception && window.console.table) || typeof navigator < "u" && navigator.userAgent && (e = navigator.userAgent.toLowerCase().match(/firefox\/(\d+)/)) && parseInt(e[1], 10) >= 31 || typeof navigator < "u" && navigator.userAgent && navigator.userAgent.toLowerCase().match(/applewebkit\/(\d+)/);
+	}
+	function r(e) {
+		if (e[0] = (this.useColors ? "%c" : "") + this.namespace + (this.useColors ? " %c" : " ") + e[0] + (this.useColors ? "%c " : " ") + "+" + t.exports.humanize(this.diff), !this.useColors) return;
+		let n = "color: " + this.color;
+		e.splice(1, 0, n, "color: inherit");
+		let r = 0, i = 0;
+		e[0].replace(/%[a-zA-Z%]/g, (e) => {
+			e !== "%%" && (r++, e === "%c" && (i = r));
+		}), e.splice(i, 0, n);
+	}
+	e.log = console.debug || console.log || (() => {});
+	function i(t) {
+		try {
+			t ? e.storage.setItem("debug", t) : e.storage.removeItem("debug");
+		} catch {}
+	}
+	function a() {
+		let t;
+		try {
+			t = e.storage.getItem("debug") || e.storage.getItem("DEBUG");
+		} catch {}
+		return !t && typeof process < "u" && "env" in process && (t = process.env.DEBUG), t;
+	}
+	function o() {
+		try {
+			return localStorage;
+		} catch {}
+	}
+	t.exports = Te()(e);
+	var { formatters: s } = t.exports;
+	s.j = function(e) {
+		try {
+			return JSON.stringify(e);
+		} catch (e) {
+			return "[UnexpectedJSONParseError]: " + e.message;
+		}
+	};
+})), De = Ce(), Oe = /* @__PURE__ */ he(Ee(), 1), ke = new De.Address6("::/96");
+function Ae(e, t = 56) {
 	if (d(e)) {
-		let n = new ye.Address6(e);
-		if (n.is4()) return n.to4().correctForm();
-		if (t) return new ye.Address6(`${e}/${t}`).networkForm();
+		let n = new De.Address6(e);
+		if (n.isMapped4() || n.is4() && n.isInSubnet(ke)) return n.to4().correctForm();
+		if (t) return new De.Address6(`${e}/${t}`).networkForm();
 	}
 	return e;
 }
-var xe = class {
+var je = class {
 	constructor(e) {
 		this.validations = e, this.previous = /* @__PURE__ */ new Map(), this.current = /* @__PURE__ */ new Map(), this.localKeys = !0;
 	}
@@ -732,110 +1454,110 @@ var xe = class {
 	clearExpired() {
 		this.previous = this.current, this.current = /* @__PURE__ */ new Map();
 	}
-}, Se = {
+}, Me = {
 	warn(...e) {
 		console.warn(...e.reverse());
 	},
 	error(...e) {
 		console.error(...e.reverse());
 	}
-}, Ce = [
+}, Ne = [
 	"draft-6",
 	"draft-7",
 	"draft-8"
-], M = (e, t) => {
+], I = (e, t) => {
 	let n;
 	if (t) {
 		let e = Math.ceil((t.getTime() - Date.now()) / 1e3);
 		n = Math.max(0, e);
 	} else n = Math.ceil(e / 1e3);
 	return n;
-}, we = (e) => {
+}, Pe = (e) => {
 	let t = n("sha256");
 	t.update(e);
 	let r = t.digest("hex").slice(0, 12);
-	return _.from(r).toString("base64");
-}, Te = (e, t) => {
+	return x.from(r).toString("base64");
+}, Fe = (e, t) => {
 	e.headersSent || (e.setHeader("X-RateLimit-Limit", t.limit.toString()), e.setHeader("X-RateLimit-Remaining", t.remaining.toString()), t.resetTime instanceof Date && (e.setHeader("Date", (/* @__PURE__ */ new Date()).toUTCString()), e.setHeader("X-RateLimit-Reset", Math.ceil(t.resetTime.getTime() / 1e3).toString())));
-}, Ee = (e, t, n) => {
+}, Ie = (e, t, n) => {
 	if (e.headersSent) return;
-	let r = Math.ceil(n / 1e3), i = M(n, t.resetTime);
+	let r = Math.ceil(n / 1e3), i = I(n, t.resetTime);
 	e.setHeader("RateLimit-Policy", `${t.limit};w=${r}`), e.setHeader("RateLimit-Limit", t.limit.toString()), e.setHeader("RateLimit-Remaining", t.remaining.toString()), typeof i == "number" && e.setHeader("RateLimit-Reset", i.toString());
-}, De = (e, t, n) => {
+}, Le = (e, t, n) => {
 	if (e.headersSent) return;
-	let r = Math.ceil(n / 1e3), i = M(n, t.resetTime);
+	let r = Math.ceil(n / 1e3), i = I(n, t.resetTime);
 	e.setHeader("RateLimit-Policy", `${t.limit};w=${r}`), e.setHeader("RateLimit", `limit=${t.limit}, remaining=${t.remaining}, reset=${i}`);
-}, Oe = (e, t, n, r, i) => {
+}, Re = (e, t, n, r, i) => {
 	if (e.headersSent) return;
-	let a = Math.ceil(n / 1e3), o = M(n, t.resetTime), s = we(i), c = `r=${t.remaining}; t=${o}`, l = `q=${t.limit}; w=${a}; pk=:${s}:`;
+	let a = Math.ceil(n / 1e3), o = I(n, t.resetTime), s = Pe(i), c = `r=${t.remaining}; t=${o}`, l = `q=${t.limit}; w=${a}; pk=:${s}:`;
 	e.append("RateLimit", `"${r}"; ${c}`), e.append("RateLimit-Policy", `"${r}"; ${l}`);
-}, ke = (e, t, n) => {
+}, ze = (e, t, n, r) => {
 	if (e.headersSent) return;
-	let r = M(n, t.resetTime);
-	e.setHeader("Retry-After", r.toString());
-}, Ae = (e) => {
+	let i = r ?? I(n, t.resetTime);
+	e.setHeader("Retry-After", i.toString());
+}, Be = (e) => {
 	let t = {};
 	for (let n of Object.keys(e)) {
 		let r = n;
 		e[r] !== void 0 && (t[r] = e[r]);
 	}
 	return t;
-}, N = class extends Error {
+}, L = class extends Error {
 	constructor(e, t) {
 		let n = `https://express-rate-limit.github.io/${e}/`;
 		super(`${t} See ${n} for more information.`), this.name = this.constructor.name, this.code = e, this.help = n;
 	}
-}, P = class extends N {}, je = /* @__PURE__ */ new Set(), Me = /* @__PURE__ */ new WeakMap(), Ne = {
+}, R = class extends L {}, Ve = /* @__PURE__ */ new Set(), He = /* @__PURE__ */ new WeakMap(), Ue = {
 	enabled: { default: !0 },
 	disable() {
 		for (let e of Object.keys(this.enabled)) this.enabled[e] = !1;
 	},
 	ip(e) {
-		if (e === void 0) throw new N("ERR_ERL_UNDEFINED_IP_ADDRESS", "An undefined 'request.ip' was detected. This might indicate a misconfiguration or the connection being destroyed prematurely.");
-		if (!u(e)) throw new N("ERR_ERL_INVALID_IP_ADDRESS", `An invalid 'request.ip' (${e}) was detected. Consider passing a custom 'keyGenerator' function to the rate limiter.`);
+		if (e === void 0) throw new L("ERR_ERL_UNDEFINED_IP_ADDRESS", "An undefined 'request.ip' was detected. This might indicate a misconfiguration or the connection being destroyed prematurely.");
+		if (!u(e)) throw new L("ERR_ERL_INVALID_IP_ADDRESS", `An invalid 'request.ip' (${e}) was detected. Consider passing a custom 'keyGenerator' function to the rate limiter.`);
 	},
 	trustProxy(e) {
-		if (e.app.get("trust proxy") === !0) throw new N("ERR_ERL_PERMISSIVE_TRUST_PROXY", "The Express 'trust proxy' setting is true, which allows anyone to trivially bypass IP-based rate limiting.");
+		if (e.app.get("trust proxy") === !0) throw new L("ERR_ERL_PERMISSIVE_TRUST_PROXY", "The Express 'trust proxy' setting is true, which allows anyone to trivially bypass IP-based rate limiting.");
 	},
 	xForwardedForHeader(e) {
-		if (e.headers["x-forwarded-for"] && e.app.get("trust proxy") === !1) throw new N("ERR_ERL_UNEXPECTED_X_FORWARDED_FOR", "The 'X-Forwarded-For' header is set but the Express 'trust proxy' setting is false (default). This could indicate a misconfiguration which would prevent express-rate-limit from accurately identifying users.");
+		if (e.headers["x-forwarded-for"] && e.app.get("trust proxy") === !1) throw new L("ERR_ERL_UNEXPECTED_X_FORWARDED_FOR", "The 'X-Forwarded-For' header is set but the Express 'trust proxy' setting is false (default). This could indicate a misconfiguration which would prevent express-rate-limit from accurately identifying users.");
 	},
 	forwardedHeader(e) {
-		if (e.headers.forwarded && e.ip === e.socket?.remoteAddress) throw new N("ERR_ERL_FORWARDED_HEADER", "The 'Forwarded' header (standardized X-Forwarded-For) is set but currently being ignored. Add a custom keyGenerator to use a value from this header.");
+		if (e.headers.forwarded && e.ip === e.socket?.remoteAddress) throw new L("ERR_ERL_FORWARDED_HEADER", "The 'Forwarded' header (standardized X-Forwarded-For) is set but currently being ignored. Add a custom keyGenerator to use a value from this header.");
 	},
 	positiveHits(e) {
-		if (typeof e != "number" || e < 1 || e !== Math.round(e)) throw new N("ERR_ERL_INVALID_HITS", `The totalHits value returned from the store must be a positive integer, got ${e}`);
+		if (typeof e != "number" || e < 1 || e !== Math.round(e)) throw new L("ERR_ERL_INVALID_HITS", `The totalHits value returned from the store must be a positive integer, got ${e}`);
 	},
 	unsharedStore(e) {
-		if (je.has(e)) {
+		if (Ve.has(e)) {
 			let t = e?.localKeys ? "" : " (with a unique prefix)";
-			throw new N("ERR_ERL_STORE_REUSE", `A Store instance must not be shared across multiple rate limiters. Create a new instance of ${e.constructor.name}${t} for each limiter instead.`);
+			throw new L("ERR_ERL_STORE_REUSE", `A Store instance must not be shared across multiple rate limiters. Create a new instance of ${e.constructor.name}${t} for each limiter instead.`);
 		}
-		je.add(e);
+		Ve.add(e);
 	},
 	singleCount(e, t, n) {
-		let r = Me.get(e);
-		r || (r = /* @__PURE__ */ new Map(), Me.set(e, r));
+		let r = He.get(e);
+		r || (r = /* @__PURE__ */ new Map(), He.set(e, r));
 		let i = t.localKeys ? t : t.constructor.name, a = r.get(i);
 		a || (a = [], r.set(i, a));
 		let o = `${t.prefix ?? ""}${n}`;
-		if (a.includes(o)) throw new N("ERR_ERL_DOUBLE_COUNT", `The hit count for ${n} was incremented more than once for a single request.`);
+		if (a.includes(o)) throw new L("ERR_ERL_DOUBLE_COUNT", `The hit count for ${n} was incremented more than once for a single request.`);
 		a.push(o);
 	},
 	limit(e) {
-		if (e === 0) throw new P("WRN_ERL_MAX_ZERO", "Setting limit or max to 0 disables rate limiting in express-rate-limit v6 and older, but will cause all requests to be blocked in v7");
+		if (e === 0) throw new R("WRN_ERL_MAX_ZERO", "Setting limit or max to 0 disables rate limiting in express-rate-limit v6 and older, but will cause all requests to be blocked in v7");
 	},
 	draftPolliHeaders(e) {
-		if (e) throw new P("WRN_ERL_DEPRECATED_DRAFT_POLLI_HEADERS", "The draft_polli_ratelimit_headers configuration option is deprecated and has been removed in express-rate-limit v7, please set standardHeaders: 'draft-6' instead.");
+		if (e) throw new R("WRN_ERL_DEPRECATED_DRAFT_POLLI_HEADERS", "The draft_polli_ratelimit_headers configuration option is deprecated and has been removed in express-rate-limit v7, please set standardHeaders: 'draft-6' instead.");
 	},
 	onLimitReached(e) {
-		if (e) throw new P("WRN_ERL_DEPRECATED_ON_LIMIT_REACHED", "The onLimitReached configuration option is deprecated and has been removed in express-rate-limit v7.");
+		if (e) throw new R("WRN_ERL_DEPRECATED_ON_LIMIT_REACHED", "The onLimitReached configuration option is deprecated and has been removed in express-rate-limit v7.");
 	},
 	headersDraftVersion(e) {
-		if (typeof e != "string" || !Ce.includes(e)) throw new N("ERR_ERL_HEADERS_UNSUPPORTED_DRAFT_VERSION", `standardHeaders: only the following versions of the IETF draft specification are supported: ${Ce.join(", ")}.`);
+		if (typeof e != "string" || !Ne.includes(e)) throw new L("ERR_ERL_HEADERS_UNSUPPORTED_DRAFT_VERSION", `standardHeaders: only the following versions of the IETF draft specification are supported: ${Ne.join(", ")}.`);
 	},
 	headersResetTime(e) {
-		if (!e) throw new N("ERR_ERL_HEADERS_NO_RESET", "standardHeaders:  'draft-7' requires a 'resetTime', but the store did not provide one. The 'windowMs' value will be used instead, which may cause clients to wait longer than necessary.");
+		if (!e) throw new L("ERR_ERL_HEADERS_NO_RESET", "standardHeaders:  'draft-7' requires a 'resetTime', but the store did not provide one. The 'windowMs' value will be used instead, which may cause clients to wait longer than necessary.");
 	},
 	knownOptions(e) {
 		if (!e) return;
@@ -847,6 +1569,7 @@ var xe = class {
 			legacyHeaders: !0,
 			standardHeaders: !0,
 			identifier: !0,
+			retryAfter: !0,
 			requestPropertyName: !0,
 			skipFailedRequests: !0,
 			skipSuccessfulRequests: !0,
@@ -862,54 +1585,58 @@ var xe = class {
 			passOnStoreError: !0,
 			logger: !0
 		}).concat("draft_polli_ratelimit_headers", "delayAfter", "delayMs", "maxDelayMs");
-		for (let n of Object.keys(e)) if (!t.includes(n)) throw new N("ERR_ERL_UNKNOWN_OPTION", `Unexpected configuration option: ${n}`);
+		for (let n of Object.keys(e)) if (!t.includes(n)) throw new L("ERR_ERL_UNKNOWN_OPTION", `Unexpected configuration option: ${n}`);
 	},
 	validationsConfig() {
 		let e = Object.keys(this).filter((e) => !["enabled", "disable"].includes(e));
 		e.push("default");
-		for (let t of Object.keys(this.enabled)) if (!e.includes(t)) throw new N("ERR_ERL_UNKNOWN_VALIDATION", `options.validate.${t} is not recognized. Supported validate options are: ${e.join(", ")}.`);
+		for (let t of Object.keys(this.enabled)) if (!e.includes(t)) throw new L("ERR_ERL_UNKNOWN_VALIDATION", `options.validate.${t} is not recognized. Supported validate options are: ${e.join(", ")}.`);
 	},
 	creationStack(e) {
 		let { stack: t } = /* @__PURE__ */ Error("express-rate-limit validation check (set options.validate.creationStack=false to disable)");
-		if (t?.includes("Layer.handle [as handle_request]") || t?.includes("Layer.handleRequest")) throw e.localKeys ? new N("ERR_ERL_CREATED_IN_REQUEST_HANDLER", "express-rate-limit instance should be created at app initialization, not when responding to a request.") : new N("ERR_ERL_CREATED_IN_REQUEST_HANDLER", "express-rate-limit instance should *usually* be created at app initialization, not when responding to a request.");
+		if (t?.includes("Layer.handle [as handle_request]") || t?.includes("Layer.handleRequest")) throw e.localKeys ? new L("ERR_ERL_CREATED_IN_REQUEST_HANDLER", "express-rate-limit instance should be created at app initialization, not when responding to a request.") : new L("ERR_ERL_CREATED_IN_REQUEST_HANDLER", "express-rate-limit instance should *usually* be created at app initialization, not when responding to a request.");
 	},
 	ipv6Subnet(e) {
-		if (e !== !1 && (!Number.isInteger(e) || e < 32 || e > 64)) throw new N("ERR_ERL_IPV6_SUBNET", `Unexpected ipv6Subnet value: ${e}. Expected an integer between 32 and 64 (usually 48-64).`);
+		if (e !== !1 && (!Number.isInteger(e) || e < 32 || e > 64)) throw new L("ERR_ERL_IPV6_SUBNET", `Unexpected ipv6Subnet value: ${e}. Expected an integer between 32 and 64 (usually 48-64).`);
 	},
 	ipv6SubnetOrKeyGenerator(e) {
-		if (e.ipv6Subnet !== void 0 && e.keyGenerator) throw new N("ERR_ERL_IPV6SUBNET_OR_KEYGENERATOR", "Incompatible options: the 'ipv6Subnet' option is ignored when a custom 'keyGenerator' function is also set.");
+		if (e.ipv6Subnet !== void 0 && e.keyGenerator) throw new L("ERR_ERL_IPV6SUBNET_OR_KEYGENERATOR", "Incompatible options: the 'ipv6Subnet' option is ignored when a custom 'keyGenerator' function is also set.");
 	},
 	keyGeneratorIpFallback(e) {
 		if (!e) return;
 		let t = e.toString();
-		if ((t.includes("req.ip") || t.includes("request.ip")) && !t.includes("ipKeyGenerator")) throw new N("ERR_ERL_KEY_GEN_IPV6", "Custom keyGenerator appears to use request IP without calling the ipKeyGenerator helper function for IPv6 addresses. This could allow IPv6 users to bypass limits.");
+		if ((t.includes("req.ip") || t.includes("request.ip")) && !t.includes("ipKeyGenerator")) throw new L("ERR_ERL_KEY_GEN_IPV6", "Custom keyGenerator appears to use request IP without calling the ipKeyGenerator helper function for IPv6 addresses. This could allow IPv6 users to bypass limits.");
 	},
 	windowMs(e) {
 		let t = 2 ** 31 - 1;
-		if (typeof e != "number" || Number.isNaN(e) || e < 1 || e > t) throw new N("ERR_ERL_WINDOW_MS", `Invalid windowMs value: ${e}${typeof e == "number" ? "" : ` (${typeof e})`}, must be a number between 1 and ${t} when using the default MemoryStore`);
+		if (typeof e != "number" || Number.isNaN(e) || e < 1 || e > t) throw new L("ERR_ERL_WINDOW_MS", `Invalid windowMs value: ${e}${typeof e == "number" ? "" : ` (${typeof e})`}, must be a number between 1 and ${t} when using the default MemoryStore`);
 	}
 };
-function Pe(e) {
+function We(e) {
 	if (typeof e != "object" || typeof e.error != "function" || typeof e.warn != "function") throw TypeError("Provided logger does not implement the Logger interface");
 }
-var Fe = (e, t) => {
-	Pe(t);
+var Ge = (e, t) => {
+	We(t);
 	let n;
 	n = typeof e == "boolean" ? { default: e } : {
 		default: !0,
 		...e
 	};
 	let r = { enabled: n };
-	for (let [e, i] of Object.entries(Ne)) typeof i == "function" && (r[e] = (...a) => {
-		if (n[e] ?? n.default) try {
-			i.apply(r, a);
-		} catch (e) {
-			e instanceof P ? t.warn(e) : t.error(e);
+	for (let [e, i] of Object.entries(Ue)) typeof i == "function" && (r[e] = (...a) => {
+		if (n[e] ?? n.default) {
+			n[e] = !1;
+			try {
+				i.apply(r, a);
+			} catch (e) {
+				e instanceof R ? t.warn(e) : t.error(e);
+			}
 		}
 	});
-	return r;
-}, Ie = (e) => typeof e.incr == "function" && typeof e.increment != "function", Le = (e) => {
-	if (!Ie(e)) return e;
+	let i = /* @__PURE__ */ Symbol.for("nodejs.util.inspect.custom");
+	return i && (r[i] = () => r.enabled), r;
+}, Ke = (e) => typeof e.incr == "function" && typeof e.increment != "function", qe = (e) => {
+	if (!Ke(e)) return e;
 	let t = e;
 	class n {
 		async increment(e) {
@@ -934,25 +1661,25 @@ var Fe = (e, t) => {
 		}
 	}
 	return new n();
-}, Re = (e) => {
+}, Je = (e) => {
 	let { validations: t, ...n } = e;
 	return {
 		...n,
 		validate: t.enabled
 	};
-}, ze = (e) => {
-	let t = Ae(e), n = e.logger ?? Se, r = Fe(t?.validate ?? !0, n);
+}, Ye = (e) => {
+	let t = Be(e), n = e.logger ?? Me, r = Ge(t?.validate ?? !0, n);
 	r.validationsConfig(), r.knownOptions(e), r.draftPolliHeaders(t.draft_polli_ratelimit_headers), r.onLimitReached(t.onLimitReached), t.ipv6Subnet !== void 0 && typeof t.ipv6Subnet != "function" && r.ipv6Subnet(t.ipv6Subnet), r.keyGeneratorIpFallback(t.keyGenerator), r.ipv6SubnetOrKeyGenerator(t);
 	let i = t.standardHeaders ?? !1;
 	i === !0 && (i = "draft-6");
 	let a = {
-		windowMs: 60 * 1e3,
+		windowMs: 6e4,
 		limit: e.max ?? 5,
 		message: "Too many requests, please try again later.",
 		statusCode: 429,
 		legacyHeaders: e.headers ?? !0,
 		identifier(e, t) {
-			let n = "", { limit: r } = e[a.requestPropertyName], i = a.windowMs / 1e3, o = a.windowMs / (1e3 * 60), s = a.windowMs / (1e3 * 60 * 60), c = a.windowMs / (1e3 * 60 * 60 * 24);
+			let n = "", { limit: r } = e[a.requestPropertyName], i = a.windowMs / 1e3, o = a.windowMs / 6e4, s = a.windowMs / 36e5, c = a.windowMs / 864e5;
 			return n = i < 60 ? `${i}sec` : o < 60 ? `${o}min` : s < 24 ? `${s}hr${s > 1 ? "s" : ""}` : `${c}day${c > 1 ? "s" : ""}`, `${r}-in-${n}`;
 		},
 		requestPropertyName: "rateLimit",
@@ -963,7 +1690,7 @@ var Fe = (e, t) => {
 		async keyGenerator(e, t) {
 			r.ip(e.ip), r.trustProxy(e), r.xForwardedForHeader(e), r.forwardedHeader(e);
 			let n = e.ip, i = 56;
-			return d(n) && (i = typeof a.ipv6Subnet == "function" ? await a.ipv6Subnet(e, t) : a.ipv6Subnet, typeof a.ipv6Subnet == "function" && r.ipv6Subnet(i)), be(n, i);
+			return d(n) && (i = typeof a.ipv6Subnet == "function" ? await a.ipv6Subnet(e, t) : a.ipv6Subnet, typeof a.ipv6Subnet == "function" && r.ipv6Subnet(i)), Ae(n, i);
 		},
 		ipv6Subnet: 56,
 		async handler(e, t, n, r) {
@@ -974,97 +1701,113 @@ var Fe = (e, t) => {
 		passOnStoreError: !1,
 		...t,
 		standardHeaders: i,
-		store: Le(t.store ?? new xe(r)),
+		store: qe(t.store ?? new je(r)),
 		validations: r,
 		logger: n
 	};
 	if (typeof a.store.increment != "function" || typeof a.store.decrement != "function" || typeof a.store.resetKey != "function" || a.store.resetAll !== void 0 && typeof a.store.resetAll != "function" || a.store.init !== void 0 && typeof a.store.init != "function") throw TypeError("An invalid store was passed. Please ensure that the store is a class that implements the `Store` interface.");
 	return a;
-}, Be = (e) => async (t, n, r) => {
+}, Xe = (e) => async (t, n, r) => {
 	try {
 		await Promise.resolve(e(t, n, r)).catch(r);
 	} catch (e) {
 		r(e);
 	}
-}, Ve = (e) => {
-	let t = ze(e ?? {}), n = Re(t);
-	if (t.validations.creationStack(t.store), t.validations.unsharedStore(t.store), typeof t.store.init == "function") try {
-		let e = t.store.init(n);
-		e instanceof Promise && e.catch((e) => t.logger.error(e, "express-rate-limit: async error during store initialization."));
-	} catch (e) {
-		t.logger.error(e, "express-rate-limit: error during store initialization.");
+}, Ze = (e) => {
+	let t = Ye(e ?? {}), n = Je(t), r = (0, Oe.default)("express-rate-limit");
+	r("creating new rate limiter with %o", t.store.constructor.name);
+	for (let [e, n] of Object.entries(t)) r("set %s to %o", e, n);
+	if (t.validations.creationStack(t.store), t.validations.unsharedStore(t.store), typeof t.store.init == "function") {
+		r("executing init for store");
+		try {
+			let e = t.store.init(n);
+			e instanceof Promise && e.catch((e) => t.logger.error(e, "express-rate-limit: async error during store initialization."));
+		} catch (e) {
+			t.logger.error(e, "express-rate-limit: error during store initialization.");
+		}
 	}
-	let r = Be(async (e, r, i) => {
-		let a = t.skipFailedRequests && new Promise((e) => r.once("close", e)), o = (t.skipFailedRequests || t.skipSuccessfulRequests) && new Promise((e) => r.once("finish", e)), s = t.skipFailedRequests && new Promise((e) => r.once("error", e));
-		if (await t.skip(e, r)) {
-			i();
+	let i = Xe(async (e, i, a) => {
+		let o = t.skipFailedRequests && new Promise((e) => i.once("close", e)), s = (t.skipFailedRequests || t.skipSuccessfulRequests) && new Promise((e) => i.once("finish", e)), c = t.skipFailedRequests && new Promise((e) => i.once("error", e));
+		if (r("requested %o", e.originalUrl), r("request from ip %o", e.ip), await t.skip(e, i)) {
+			r("skipping request"), a();
 			return;
 		}
-		let c = e, l = await t.keyGenerator(e, r), u = 0, d;
+		let l = e, u = await t.keyGenerator(e, i);
+		r("computed key %o", u), r("incrementing count");
+		let d = 0, f;
 		try {
-			let e = await t.store.increment(l);
-			u = e.totalHits, d = e.resetTime;
+			let e = await t.store.increment(u);
+			d = e.totalHits, f = e.resetTime;
 		} catch (e) {
 			if (t.passOnStoreError) {
-				t.logger.error(e, "express-rate-limit: error from store, allowing request without rate-limiting."), i();
+				t.logger.error(e, "express-rate-limit: error from store, allowing request without rate-limiting."), a();
 				return;
 			}
 			throw e;
 		}
-		t.validations.positiveHits(u), t.validations.singleCount(e, t.store, l);
-		let f = await (typeof t.limit == "function" ? t.limit(e, r) : t.limit);
-		t.validations.limit(f);
-		let p = {
-			limit: f,
-			used: u,
-			remaining: Math.max(f - u, 0),
-			resetTime: d,
-			key: l
+		t.validations.positiveHits(d), t.validations.singleCount(e, t.store, u);
+		let p = await (typeof t.limit == "function" ? t.limit(e, i) : t.limit);
+		t.validations.limit(p);
+		let m = {
+			limit: p,
+			used: d,
+			remaining: Math.max(p - d, 0),
+			resetTime: f,
+			key: u
 		};
-		if (Object.defineProperty(p, "current", {
+		for (let [e, n] of Object.entries(m)) r("set request.%s.%s to be %o", t.requestPropertyName, e, n);
+		if (Object.defineProperty(m, "current", {
 			configurable: !1,
 			enumerable: !1,
-			value: u
-		}), c[t.requestPropertyName] = p, t.legacyHeaders && !r.headersSent && Te(r, p), t.standardHeaders && !r.headersSent) switch (t.standardHeaders) {
+			value: d
+		}), l[t.requestPropertyName] = m, t.legacyHeaders && !i.headersSent && (r("set legacy headers"), Fe(i, m)), t.standardHeaders && !i.headersSent) switch (t.standardHeaders) {
 			case "draft-6":
-				Ee(r, p, t.windowMs);
+				r("set ietf draft 6 headers"), Ie(i, m, t.windowMs);
 				break;
 			case "draft-7":
-				t.validations.headersResetTime(p.resetTime), De(r, p, t.windowMs);
+				r("set ietf draft 7 headers"), t.validations.headersResetTime(m.resetTime), Le(i, m, t.windowMs);
 				break;
 			case "draft-8": {
-				let n = await (typeof t.identifier == "function" ? t.identifier(e, r) : t.identifier);
-				t.validations.headersResetTime(p.resetTime), Oe(r, p, t.windowMs, n, l);
+				let n = await (typeof t.identifier == "function" ? t.identifier(e, i) : t.identifier);
+				r("set ietf draft 8 headers"), r("set name to %o", n), t.validations.headersResetTime(m.resetTime), Re(i, m, t.windowMs, n, u);
 				break;
 			}
-			default:
-				t.validations.headersDraftVersion(t.standardHeaders);
-				break;
+			default: t.validations.headersDraftVersion(t.standardHeaders);
 		}
 		if (t.skipFailedRequests || t.skipSuccessfulRequests) {
-			let n = !1, i = async () => {
-				n ||= (await t.store.decrement(l), !0);
+			let n = !1, a = async () => {
+				if (!n) {
+					if (f && Date.now() >= f.getTime()) return;
+					r("decrementing count"), await t.store.decrement(u), n = !0;
+				}
 			};
-			t.skipFailedRequests && (o && o.then(async () => {
-				await t.requestWasSuccessful(e, r) || await i();
-			}), a && a.then(async () => {
-				r.writableEnded || await i();
-			}), s && s.then(async () => {
-				await i();
-			})), t.skipSuccessfulRequests && o && o.then(async () => {
-				await t.requestWasSuccessful(e, r) && await i();
+			t.skipFailedRequests && (s && s.then(async () => {
+				let n = await t.requestWasSuccessful(e, i);
+				r("computed requestWasSuccessful as %o", n), n || await a();
+			}), o && o.then(async () => {
+				i.writableEnded || await a();
+			}), c && c.then(async () => {
+				await a();
+			})), t.skipSuccessfulRequests && s && s.then(async () => {
+				let n = await t.requestWasSuccessful(e, i);
+				r("computed requestWasSuccessful as %o", n), n && await a();
 			});
 		}
-		if (t.validations.disable(), u > f) {
-			(t.legacyHeaders || t.standardHeaders) && ke(r, p, t.windowMs), t.handler(e, r, i, n);
+		if (d > p) {
+			if (r("limit exceeded"), t.legacyHeaders || t.standardHeaders) {
+				r("set retry-after header");
+				let n = await (typeof t.retryAfter == "function" ? t.retryAfter(e, i) : t.retryAfter);
+				ze(i, m, t.windowMs, n);
+			}
+			t.handler(e, i, a, n);
 			return;
 		}
-		i();
+		a();
 	});
-	return r.resetKey = t.store.resetKey.bind(t.store), r.getKey = typeof t.store.get == "function" ? t.store.get.bind(t.store) : () => {
+	return i.resetKey = t.store.resetKey.bind(t.store), i.getKey = typeof t.store.get == "function" ? t.store.get.bind(t.store) : () => {
 		throw Error("The current store does not support the get/getKey method");
-	}, r;
-}, He = new Set([
+	}, i;
+}, Qe = /* @__PURE__ */ new Set([
 	"token",
 	"accesstoken",
 	"refreshtoken",
@@ -1077,11 +1820,11 @@ var Fe = (e, t) => {
 	"password",
 	"secret"
 ]);
-function Ue(e) {
+function $e(e) {
 	return e.toLowerCase().replace(/[^a-z0-9]/g, "");
 }
-function F(e, t) {
-	for (let e of Object.keys(t)) if (He.has(Ue(e))) throw Error(`OAuth audit event must not carry forbidden field: ${e}`);
+function z(e, t) {
+	for (let e of Object.keys(t)) if (Qe.has($e(e))) throw Error(`OAuth audit event must not carry forbidden field: ${e}`);
 	let { now: n, ...r } = t;
 	return {
 		kind: e,
@@ -1089,7 +1832,7 @@ function F(e, t) {
 		...r
 	};
 }
-function We(e) {
+function et(e) {
 	let t = !1;
 	return (n) => {
 		try {
@@ -1099,7 +1842,7 @@ function We(e) {
 		}
 	};
 }
-function Ge(e = process.stderr) {
+function tt(e = process.stderr) {
 	return (t) => {
 		e.write(`${JSON.stringify({
 			source: "codemem-mcp-oauth-audit",
@@ -1107,28 +1850,28 @@ function Ge(e = process.stderr) {
 		})}\n`);
 	};
 }
-function Ke() {
+function nt() {
 	return () => {};
 }
-function qe(e = process.env.CODEMEM_MCP_AUDIT) {
+function rt(e = process.env.CODEMEM_MCP_AUDIT) {
 	let t = e?.trim().toLowerCase();
-	return t === "0" || t === "false" || t === "no" ? Ke() : Ge();
+	return t === "0" || t === "false" || t === "no" ? nt() : tt();
 }
-var Je = "codemem MCP", I = ["memory:read", "memory:write"], L = "https://github.com/kunickiaj/codemem#readme", Ye = "https://claude.ai/api/mcp/auth_callback", Xe = "https://chatgpt.com/connector_platform_oauth_redirect", Ze = new Set([
+var it = "codemem MCP", at = ["memory:read", "memory:write"], ot = "https://github.com/kunickiaj/codemem#readme", st = "https://claude.ai/api/mcp/auth_callback", ct = "https://chatgpt.com/connector_platform_oauth_redirect", lt = /* @__PURE__ */ new Set([
 	"localhost",
 	"127.0.0.1",
 	"::1"
-]), Qe = new Set(["authorization_code", "refresh_token"]), $e = new Set(["code"]), R = 3600, z = 720 * 60 * 60, et = 100, tt = 100, nt = 100, rt = 32, it = 43, at = /^[A-Za-z0-9_-]{43}$/, ot = /^[A-Za-z0-9_-]{43}$/, st = /^[A-Za-z0-9_-]{1,128}$/, ct = class {
+]), ut = /* @__PURE__ */ new Set(["authorization_code", "refresh_token"]), dt = /* @__PURE__ */ new Set(["code"]), B = 3600, V = 2592e3, ft = 100, pt = 100, mt = 100, ht = 32, gt = 43, _t = /^[A-Za-z0-9_-]{43}$/, vt = /^[A-Za-z0-9_-]{43}$/, yt = /^[A-Za-z0-9_-]{1,128}$/, bt = class {
 	#e = /* @__PURE__ */ new Map();
 	getClient(e) {
 		return this.#e.get(e);
 	}
 	registerClient(e) {
-		let t = wt(e.redirect_uris);
-		if (t) throw new D(t);
-		if (e.client_secret || e.token_endpoint_auth_method !== "none") throw new D("Only public clients with token_endpoint_auth_method=none are supported");
-		if (e.grant_types && !B(e.grant_types, Qe)) throw new D("Only authorization_code and refresh_token grant_types are supported");
-		if (e.response_types && !B(e.response_types, $e)) throw new D("Only code response_type is supported");
+		let t = It(e.redirect_uris);
+		if (t) throw new j(t);
+		if (e.client_secret || e.token_endpoint_auth_method !== "none") throw new j("Only public clients with token_endpoint_auth_method=none are supported");
+		if (e.grant_types && !H(e.grant_types, ut)) throw new j("Only authorization_code and refresh_token grant_types are supported");
+		if (e.response_types && !H(e.response_types, dt)) throw new j("Only code response_type is supported");
 		if (this.#e.size >= 100) {
 			let e = this.#e.keys().next().value;
 			e && this.#e.delete(e);
@@ -1143,10 +1886,10 @@ var Je = "codemem MCP", I = ["memory:read", "memory:write"], L = "https://github
 		};
 		return this.#e.set(n.client_id, n), n;
 	}
-}, lt = class {
+}, xt = class {
 	#e = /* @__PURE__ */ new Map();
 	issueCode(e, t = Date.now()) {
-		if (this.#t(t), this.#e.size >= et) return;
+		if (this.#t(t), this.#e.size >= ft) return;
 		let n = o();
 		return this.#e.set(n, {
 			...e,
@@ -1164,12 +1907,12 @@ var Je = "codemem MCP", I = ["memory:read", "memory:write"], L = "https://github
 	#t(e) {
 		for (let [t, n] of this.#e) n.expiresAt <= e && this.#e.delete(t);
 	}
-}, ut = class {
+}, St = class {
 	#e = /* @__PURE__ */ new Map();
 	#t = a(32);
 	issueToken(e, t = Date.now(), n, r, i = []) {
-		if (this.#n(t), this.#e.size >= tt) return;
-		let o = a(rt), s = K(o, this.#t);
+		if (this.#n(t), this.#e.size >= pt) return;
+		let o = a(ht), s = Wt(o, this.#t);
 		return this.#e.set(s, {
 			clientId: e,
 			grantId: r,
@@ -1177,22 +1920,22 @@ var Je = "codemem MCP", I = ["memory:read", "memory:write"], L = "https://github
 			resource: n,
 			tokenHash: s,
 			issuedAt: t,
-			expiresAt: t + R * 1e3,
+			expiresAt: t + B * 1e3,
 			lastUsedAt: null,
 			revokedAt: null
 		}), {
 			token: o.toString("base64url"),
-			expiresIn: R
+			expiresIn: B
 		};
 	}
 	verifyToken(e, t = Date.now()) {
-		let n = H(e);
+		let n = W(e);
 		if (!n) return {
 			ok: !1,
 			reason: "unknown_token"
 		};
-		let r = K(n, this.#t), i = this.#e.get(r);
-		return !i || !q(i.tokenHash, r) ? {
+		let r = Wt(n, this.#t), i = this.#e.get(r);
+		return !i || !J(i.tokenHash, r) ? {
 			ok: !1,
 			reason: "unknown_token"
 		} : i.revokedAt === null ? i.expiresAt <= t ? {
@@ -1207,27 +1950,27 @@ var Je = "codemem MCP", I = ["memory:read", "memory:write"], L = "https://github
 		};
 	}
 	revokeToken(e, t = Date.now()) {
-		let n = H(e);
+		let n = W(e);
 		if (!n) return !1;
-		let r = K(n, this.#t), i = this.#e.get(r);
-		return !i || !q(i.tokenHash, r) ? !1 : (i.revokedAt === null && (i.revokedAt = t), !0);
+		let r = Wt(n, this.#t), i = this.#e.get(r);
+		return !i || !J(i.tokenHash, r) ? !1 : (i.revokedAt === null && (i.revokedAt = t), !0);
 	}
 	revokeTokensForGrant(e, t = Date.now()) {
 		let n = 0;
-		for (let r of this.#e.values()) r.grantId !== e || r.revokedAt !== null || (r.revokedAt = t, n += 1);
+		for (let r of this.#e.values()) r.grantId === e && r.revokedAt === null && (r.revokedAt = t, n += 1);
 		return n;
 	}
 	#n(e) {
 		for (let [t, n] of this.#e) (n.expiresAt <= e || n.revokedAt !== null) && this.#e.delete(t);
 	}
-}, dt = class {
+}, Ct = class {
 	#e = /* @__PURE__ */ new Map();
 	#t = /* @__PURE__ */ new Map();
 	#n = /* @__PURE__ */ new Map();
 	#r = a(32);
 	issueGrant(e, t = Date.now()) {
-		if (this.#i(t), this.#e.size >= nt) return;
-		let n = U(), r = W(n, this.#r);
+		if (this.#i(t), this.#e.size >= mt) return;
+		let n = G(), r = K(n, this.#r);
 		if (!r) return;
 		let i = {
 			grantId: o(),
@@ -1237,21 +1980,21 @@ var Je = "codemem MCP", I = ["memory:read", "memory:write"], L = "https://github
 			currentRefreshTokenHash: r,
 			previousRefreshTokenHash: null,
 			issuedAt: t,
-			expiresAt: t + z * 1e3,
+			expiresAt: t + V * 1e3,
 			rotatedAt: null,
 			revokedAt: null
 		};
-		return this.#e.set(i.grantId, i), this.#t.set(r, i.grantId), this.#n.set(i.grantId, new Set([r])), {
+		return this.#e.set(i.grantId, i), this.#t.set(r, i.grantId), this.#n.set(i.grantId, /* @__PURE__ */ new Set([r])), {
 			grant: {
 				...i,
 				scopes: [...i.scopes]
 			},
 			refreshToken: n,
-			expiresIn: z
+			expiresIn: V
 		};
 	}
 	rotateRefreshToken(e, t, n = {}, r = Date.now()) {
-		let i = W(t, this.#r);
+		let i = K(t, this.#r);
 		if (!i) return {
 			ok: !1,
 			reason: "unknown_refresh_token"
@@ -1281,7 +2024,7 @@ var Je = "codemem MCP", I = ["memory:read", "memory:write"], L = "https://github
 			reason: "client_mismatch",
 			grantId: a
 		};
-		if (!Nt(n.scopes ?? o.scopes, o.scopes)) return {
+		if (!Kt(n.scopes ?? o.scopes, o.scopes)) return {
 			ok: !1,
 			reason: "scope_mismatch",
 			grantId: a
@@ -1291,13 +2034,13 @@ var Je = "codemem MCP", I = ["memory:read", "memory:write"], L = "https://github
 			reason: "resource_mismatch",
 			grantId: a
 		};
-		let s = q(o.currentRefreshTokenHash, i), c = o.previousRefreshTokenHash !== null && q(o.previousRefreshTokenHash, i);
+		let s = J(o.currentRefreshTokenHash, i), c = o.previousRefreshTokenHash !== null && J(o.previousRefreshTokenHash, i);
 		if (!s && !c) return this.revokeGrant(a, r), {
 			ok: !1,
 			reason: "refresh_token_replay",
 			grantId: a
 		};
-		let l = U(), u = W(l, this.#r);
+		let l = G(), u = K(l, this.#r);
 		return u ? (o.scopes = [...n.scopes ?? o.scopes], o.previousRefreshTokenHash = s ? o.currentRefreshTokenHash : null, o.currentRefreshTokenHash = u, o.rotatedAt = r, this.#t.set(u, a), this.#n.get(a)?.add(u), {
 			ok: !0,
 			grant: {
@@ -1312,14 +2055,14 @@ var Je = "codemem MCP", I = ["memory:read", "memory:write"], L = "https://github
 		};
 	}
 	revokeRefreshToken(e, t = Date.now()) {
-		let n = W(e, this.#r);
+		let n = K(e, this.#r);
 		if (!n) return;
 		let r = this.#t.get(n);
 		if (r) return this.revokeGrant(r, t), r;
 	}
 	revokeGrant(e, t = Date.now()) {
 		let n = this.#e.get(e);
-		return n ? n.revokedAt === null ? (n.revokedAt = t, this.#a(n), !0) : !0 : !1;
+		return n ? n.revokedAt !== null || (n.revokedAt = t, this.#a(n), !0) : !1;
 	}
 	#i(e) {
 		for (let [t, n] of this.#e) n.expiresAt > e && n.revokedAt === null || (this.#e.delete(t), this.#a(n));
@@ -1333,7 +2076,7 @@ var Je = "codemem MCP", I = ["memory:read", "memory:write"], L = "https://github
 		}
 		this.#t.delete(e.currentRefreshTokenHash), e.previousRefreshTokenHash && this.#t.delete(e.previousRefreshTokenHash);
 	}
-}, ft = class {
+}, wt = class {
 	#e;
 	#t = /* @__PURE__ */ new Map();
 	#n = /* @__PURE__ */ new Map();
@@ -1341,18 +2084,18 @@ var Je = "codemem MCP", I = ["memory:read", "memory:write"], L = "https://github
 	#i = /* @__PURE__ */ new Map();
 	#a = /* @__PURE__ */ new Map();
 	#o = /* @__PURE__ */ new Map();
-	constructor(e = vt()) {
+	constructor(e = At()) {
 		this.#e = e, this.#s();
 	}
 	getClient(e) {
 		return this.#n.get(e);
 	}
 	registerClient(e) {
-		let t = wt(e.redirect_uris);
-		if (t) throw new D(t);
-		if (e.client_secret || e.token_endpoint_auth_method !== "none") throw new D("Only public clients with token_endpoint_auth_method=none are supported");
-		if (e.grant_types && !B(e.grant_types, Qe)) throw new D("Only authorization_code and refresh_token grant_types are supported");
-		if (e.response_types && !B(e.response_types, $e)) throw new D("Only code response_type is supported");
+		let t = It(e.redirect_uris);
+		if (t) throw new j(t);
+		if (e.client_secret || e.token_endpoint_auth_method !== "none") throw new j("Only public clients with token_endpoint_auth_method=none are supported");
+		if (e.grant_types && !H(e.grant_types, ut)) throw new j("Only authorization_code and refresh_token grant_types are supported");
+		if (e.response_types && !H(e.response_types, dt)) throw new j("Only code response_type is supported");
 		if (this.#u(Date.now()), this.#n.size >= 100) {
 			let e = this.#n.keys().next().value;
 			e && this.#n.delete(e);
@@ -1368,7 +2111,7 @@ var Je = "codemem MCP", I = ["memory:read", "memory:write"], L = "https://github
 		return this.#n.set(n.client_id, n), this.#c(), n;
 	}
 	issueCode(e, t = Date.now()) {
-		if (this.#l(t), this.#t.size >= et) return;
+		if (this.#l(t), this.#t.size >= ft) return;
 		let n = o();
 		return this.#t.set(n, {
 			...e,
@@ -1384,8 +2127,8 @@ var Je = "codemem MCP", I = ["memory:read", "memory:write"], L = "https://github
 		if (!(!t || t.used)) return t.used = !0, t;
 	}
 	issueToken(e, t = Date.now(), n, r, i = []) {
-		if (this.#u(t), this.#r.size >= tt) return;
-		let a = U(), o = G(a);
+		if (this.#u(t), this.#r.size >= pt) return;
+		let a = G(), o = q(a);
 		if (o) return this.#r.set(o, {
 			clientId: e,
 			grantId: r,
@@ -1393,22 +2136,22 @@ var Je = "codemem MCP", I = ["memory:read", "memory:write"], L = "https://github
 			resource: n,
 			tokenHash: o,
 			issuedAt: t,
-			expiresAt: t + R * 1e3,
+			expiresAt: t + B * 1e3,
 			lastUsedAt: null,
 			revokedAt: null
 		}), this.#c(), {
 			token: a,
-			expiresIn: R
+			expiresIn: B
 		};
 	}
 	verifyToken(e, t = Date.now()) {
-		let n = G(e);
+		let n = q(e);
 		if (!n) return {
 			ok: !1,
 			reason: "unknown_token"
 		};
 		let r = this.#r.get(n);
-		return !r || !q(r.tokenHash, n) ? {
+		return !r || !J(r.tokenHash, n) ? {
 			ok: !1,
 			reason: "unknown_token"
 		} : r.revokedAt === null ? r.expiresAt <= t ? {
@@ -1426,19 +2169,19 @@ var Je = "codemem MCP", I = ["memory:read", "memory:write"], L = "https://github
 		};
 	}
 	revokeToken(e, t = Date.now()) {
-		let n = G(e);
+		let n = q(e);
 		if (!n) return !1;
 		let r = this.#r.get(n);
-		return !r || !q(r.tokenHash, n) ? !1 : r.revokedAt === null ? (r.revokedAt = t, this.#c(), !0) : !0;
+		return !r || !J(r.tokenHash, n) ? !1 : r.revokedAt !== null || (r.revokedAt = t, this.#c(), !0);
 	}
 	revokeTokensForGrant(e, t = Date.now()) {
 		let n = 0;
-		for (let r of this.#r.values()) r.grantId !== e || r.revokedAt !== null || (r.revokedAt = t, n += 1);
+		for (let r of this.#r.values()) r.grantId === e && r.revokedAt === null && (r.revokedAt = t, n += 1);
 		return n > 0 && this.#c(), n;
 	}
 	issueGrant(e, t = Date.now()) {
-		if (this.#u(t), this.#i.size >= nt) return;
-		let n = U(), r = G(n);
+		if (this.#u(t), this.#i.size >= mt) return;
+		let n = G(), r = q(n);
 		if (!r) return;
 		let i = {
 			grantId: o(),
@@ -1448,21 +2191,21 @@ var Je = "codemem MCP", I = ["memory:read", "memory:write"], L = "https://github
 			currentRefreshTokenHash: r,
 			previousRefreshTokenHash: null,
 			issuedAt: t,
-			expiresAt: t + z * 1e3,
+			expiresAt: t + V * 1e3,
 			rotatedAt: null,
 			revokedAt: null
 		};
-		return this.#i.set(i.grantId, i), this.#a.set(r, i.grantId), this.#o.set(i.grantId, new Set([r])), this.#c(), {
+		return this.#i.set(i.grantId, i), this.#a.set(r, i.grantId), this.#o.set(i.grantId, /* @__PURE__ */ new Set([r])), this.#c(), {
 			grant: {
 				...i,
 				scopes: [...i.scopes]
 			},
 			refreshToken: n,
-			expiresIn: z
+			expiresIn: V
 		};
 	}
 	rotateRefreshToken(e, t, n = {}, r = Date.now()) {
-		let i = G(t);
+		let i = q(t);
 		if (!i) return {
 			ok: !1,
 			reason: "unknown_refresh_token"
@@ -1492,7 +2235,7 @@ var Je = "codemem MCP", I = ["memory:read", "memory:write"], L = "https://github
 			reason: "client_mismatch",
 			grantId: a
 		};
-		if (!Nt(n.scopes ?? o.scopes, o.scopes)) return {
+		if (!Kt(n.scopes ?? o.scopes, o.scopes)) return {
 			ok: !1,
 			reason: "scope_mismatch",
 			grantId: a
@@ -1502,13 +2245,13 @@ var Je = "codemem MCP", I = ["memory:read", "memory:write"], L = "https://github
 			reason: "resource_mismatch",
 			grantId: a
 		};
-		let s = q(o.currentRefreshTokenHash, i), c = o.previousRefreshTokenHash !== null && q(o.previousRefreshTokenHash, i);
+		let s = J(o.currentRefreshTokenHash, i), c = o.previousRefreshTokenHash !== null && J(o.previousRefreshTokenHash, i);
 		if (!s && !c) return this.revokeGrant(a, r), {
 			ok: !1,
 			reason: "refresh_token_replay",
 			grantId: a
 		};
-		let l = U(), u = G(l);
+		let l = G(), u = q(l);
 		return u ? (o.scopes = [...n.scopes ?? o.scopes], o.previousRefreshTokenHash = s ? o.currentRefreshTokenHash : null, o.currentRefreshTokenHash = u, o.rotatedAt = r, this.#a.set(u, a), this.#o.get(a)?.add(u), this.#c(), {
 			ok: !0,
 			grant: {
@@ -1523,20 +2266,20 @@ var Je = "codemem MCP", I = ["memory:read", "memory:write"], L = "https://github
 		};
 	}
 	revokeRefreshToken(e, t = Date.now()) {
-		let n = G(e);
+		let n = q(e);
 		if (!n) return;
 		let r = this.#a.get(n);
 		if (r) return this.revokeGrant(r, t), r;
 	}
 	revokeGrant(e, t = Date.now()) {
 		let n = this.#i.get(e);
-		return n ? n.revokedAt === null ? (n.revokedAt = t, this.#d(n), this.#c(), !0) : !0 : !1;
+		return n ? n.revokedAt !== null || (n.revokedAt = t, this.#d(n), this.#c(), !0) : !1;
 	}
 	#s() {
-		if (!v(this.#e)) return;
+		if (!S(this.#e)) return;
 		let e;
 		try {
-			e = JSON.parse(ie(this.#e, "utf8"));
+			e = JSON.parse(ee(this.#e, "utf8"));
 		} catch {
 			return;
 		}
@@ -1551,7 +2294,7 @@ var Je = "codemem MCP", I = ["memory:read", "memory:write"], L = "https://github
 		}
 	}
 	#c() {
-		y(w(this.#e), {
+		C(O(this.#e), {
 			recursive: !0,
 			mode: 448
 		});
@@ -1562,7 +2305,7 @@ var Je = "codemem MCP", I = ["memory:read", "memory:write"], L = "https://github
 			refreshGrants: [...this.#i.values()],
 			refreshHashesByGrantId: Object.fromEntries([...this.#o.entries()].map(([e, t]) => [e, [...t]]))
 		}, t = `${this.#e}.${process.pid}.${Date.now()}.tmp`;
-		x(t, `${JSON.stringify(e, null, 2)}\n`, { mode: 384 }), b(t, this.#e), S(this.#e, 384).catch(() => void 0);
+		T(t, `${JSON.stringify(e, null, 2)}\n`, { mode: 384 }), w(t, this.#e), E(this.#e, 384).catch(() => void 0);
 	}
 	#l(e) {
 		for (let [t, n] of this.#t) n.expiresAt <= e && this.#t.delete(t);
@@ -1583,58 +2326,58 @@ var Je = "codemem MCP", I = ["memory:read", "memory:write"], L = "https://github
 		this.#a.delete(e.currentRefreshTokenHash), e.previousRefreshTokenHash && this.#a.delete(e.previousRefreshTokenHash);
 	}
 };
-function pt() {
-	return new ct();
+function Tt() {
+	return new bt();
 }
-function mt() {
-	return new lt();
+function Et() {
+	return new xt();
 }
-function ht() {
-	return new ut();
+function Dt() {
+	return new St();
 }
-function gt() {
-	return new dt();
+function Ot() {
+	return new Ct();
 }
-function _t(e) {
-	return new ft(e);
+function kt(e) {
+	return new wt(e);
 }
-function vt() {
-	return T(process.env.HOME?.trim() || C(), ".codemem", "mcp-oauth-state.json");
+function At() {
+	return k(process.env.HOME?.trim() || D(), ".codemem", "mcp-oauth-state.json");
 }
-function yt(e) {
-	let t = Ct(St(e.mcpUrl));
+function jt(e) {
+	let t = Ft(Pt(e.mcpUrl)), n = qt(e.clientsStore);
 	return {
 		...g({
-			provider: Pt(e.clientsStore),
+			provider: n,
 			issuerUrl: t,
 			baseUrl: t
 		}),
 		grant_types_supported: ["authorization_code", "refresh_token"],
 		token_endpoint_auth_methods_supported: ["none"],
-		scopes_supported: I,
-		service_documentation: L,
+		scopes_supported: at,
+		service_documentation: ot,
 		revocation_endpoint: new URL("/revoke", t).href,
 		revocation_endpoint_auth_methods_supported: ["none"],
 		client_id_metadata_document_supported: !1
 	};
 }
-function bt(e) {
-	let t = St(e), n = {
+function Mt(e) {
+	let t = Pt(e), n = {
 		resource: t.href,
-		authorization_servers: [Ct(t).href],
-		scopes_supported: I,
+		authorization_servers: [Ft(t).href],
+		scopes_supported: at,
 		bearer_methods_supported: ["header"],
-		resource_name: Je,
-		resource_documentation: L
+		resource_name: it,
+		resource_documentation: ot
 	};
-	return ue.parse(n);
-}
-function xt(e, t) {
-	let n = e.get("client_id") ?? "", r = e.get("redirect_uri") ?? "", i = e.get("response_type") ?? "", a = e.get("code_challenge") ?? "", o = e.get("code_challenge_method") ?? "", s = e.get("resource"), c = At(e.get("scope")), l = e.get("state");
-	if (i !== "code") return V("unsupported_response_type");
-	if (o !== "S256") return V("invalid_request", "PKCE code_challenge_method=S256 is required");
-	if (!ot.test(a)) return V("invalid_request", "Valid PKCE S256 code_challenge is required");
-	let u = jt(t, n);
+	return oe.parse(n);
+}
+function Nt(e, t) {
+	let n = e.get("client_id") ?? "", r = e.get("redirect_uri") ?? "", i = e.get("response_type") ?? "", a = e.get("code_challenge") ?? "", o = e.get("code_challenge_method") ?? "", s = e.get("resource"), c = Ht(e.get("scope")), l = e.get("state");
+	if (i !== "code") return U("unsupported_response_type");
+	if (o !== "S256") return U("invalid_request", "PKCE code_challenge_method=S256 is required");
+	if (!vt.test(a)) return U("invalid_request", "Valid PKCE S256 code_challenge is required");
+	let u = Ut(t, n);
 	return u ? u.redirect_uris.includes(r) ? {
 		clientId: n,
 		redirectUri: r,
@@ -1642,55 +2385,55 @@ function xt(e, t) {
 		scopes: c,
 		resource: s,
 		state: l
-	} : V("invalid_request", "redirect_uri is not registered for this client") : V("invalid_client", "Unknown OAuth client_id");
+	} : U("invalid_request", "redirect_uri is not registered for this client") : U("invalid_client", "Unknown OAuth client_id");
 }
-function St(e) {
+function Pt(e) {
 	let t;
 	try {
 		t = new URL(e);
 	} catch {
 		throw Error("Invalid MCP HTTP public URL; expected an HTTPS /mcp URL");
 	}
-	if (t.protocol !== "https:" && !Ot(t)) throw Error("Invalid MCP HTTP public URL; use HTTPS for non-loopback URLs");
+	if (t.protocol !== "https:" && !Bt(t)) throw Error("Invalid MCP HTTP public URL; use HTTPS for non-loopback URLs");
 	if (t.username || t.password || t.search || t.hash) throw Error("Invalid MCP HTTP public URL; credentials, query strings, and fragments are not allowed");
 	if (t.pathname === "/" && (t.pathname = "/mcp"), t.pathname !== "/mcp") throw Error("Invalid MCP HTTP public URL; expected /mcp path");
 	return t;
 }
-function Ct(e) {
+function Ft(e) {
 	return new URL(e.origin);
 }
-function wt(e) {
+function It(e) {
 	for (let t of e) {
 		let e = new URL(t);
 		if (e.username || e.password || e.hash) return "Invalid redirect URI";
-		if (!Tt(e) && !Dt(e)) return "Unsupported redirect URI";
+		if (!Lt(e) && !zt(e)) return "Unsupported redirect URI";
 	}
 	return null;
 }
-function Tt(e) {
-	return e.search === "" ? e.href === Ye || e.href === Xe ? !0 : e.protocol === "https:" && e.hostname === "chatgpt.com" && Et(e) : !1;
+function Lt(e) {
+	return e.search === "" ? e.href === st || e.href === ct || e.protocol === "https:" && e.hostname === "chatgpt.com" && Rt(e) : !1;
 }
-function Et(e) {
+function Rt(e) {
 	let t = e.pathname.split("/").filter(Boolean);
-	return t.length === 3 && t[0] === "connector" && t[1] === "oauth" && st.test(t[2] ?? "");
+	return t.length === 3 && t[0] === "connector" && t[1] === "oauth" && yt.test(t[2] ?? "");
 }
-function B(e, t) {
+function H(e, t) {
 	return e.length > 0 && e.every((e) => t.has(e));
 }
-function Dt(e) {
-	return e.protocol === "http:" && Ze.has(kt(e.hostname)) && (e.pathname === "/callback" || e.pathname === "/oauth/callback") && e.search === "";
+function zt(e) {
+	return e.protocol === "http:" && lt.has(Vt(e.hostname)) && (e.pathname === "/callback" || e.pathname === "/oauth/callback") && e.search === "";
 }
-function Ot(e) {
-	let t = kt(e.hostname);
-	return e.protocol === "http:" && Ze.has(t);
+function Bt(e) {
+	let t = Vt(e.hostname);
+	return e.protocol === "http:" && lt.has(t);
 }
-function kt(e) {
+function Vt(e) {
 	return e.replace(/^\[(.*)]$/, "$1").toLowerCase();
 }
-function At(e) {
+function Ht(e) {
 	return e?.split(/\s+/).map((e) => e.trim()).filter(Boolean) ?? [];
 }
-function V(e, t) {
+function U(e, t) {
 	return {
 		status: 400,
 		body: t ? {
@@ -1699,42 +2442,42 @@ function V(e, t) {
 		} : { error: e }
 	};
 }
-function jt(e, t) {
+function Ut(e, t) {
 	let n = e.getClient(t);
 	if (n instanceof Promise) throw Error("Asynchronous OAuth client stores are not supported by this HTTP bootstrap yet");
 	return n;
 }
-function H(e) {
-	if (typeof e != "string" || e.length !== it || !at.test(e)) return null;
+function W(e) {
+	if (typeof e != "string" || e.length !== gt || !_t.test(e)) return null;
 	let t = Buffer.from(e, "base64url");
-	return t.length === rt ? t : null;
+	return t.length === ht ? t : null;
 }
-function U() {
-	return a(rt).toString("base64url");
+function G() {
+	return a(ht).toString("base64url");
 }
-function W(e, t) {
-	let n = H(e);
-	return n ? Mt(n, t) : null;
+function K(e, t) {
+	let n = W(e);
+	return n ? Gt(n, t) : null;
 }
-function G(e) {
-	let t = H(e);
+function q(e) {
+	let t = W(e);
 	return t ? n("sha256").update(t).digest("base64url") : null;
 }
-function K(e, t) {
-	return Mt(e, t);
+function Wt(e, t) {
+	return Gt(e, t);
 }
-function Mt(e, t) {
+function Gt(e, t) {
 	return r("sha256", t).update(e).digest("base64url");
 }
-function q(e, t) {
+function J(e, t) {
 	let n = Buffer.from(e), r = Buffer.from(t);
 	return n.length === r.length && s(n, r);
 }
-function Nt(e, t) {
+function Kt(e, t) {
 	let n = new Set(t);
 	return e.every((e) => n.has(e));
 }
-function Pt(e) {
+function qt(e) {
 	return {
 		clientsStore: e,
 		async authorize() {
@@ -1756,14 +2499,14 @@ function Pt(e) {
 }
 //#endregion
 //#region src/oidc.ts
-var Ft = "CODEMEM_MCP_OIDC_ISSUER_URL", It = "CODEMEM_MCP_OIDC_CLIENT_ID", Lt = "CODEMEM_MCP_OIDC_CLIENT_SECRET", Rt = "CODEMEM_MCP_OAUTH_ALLOWED_SUBJECT", zt = "CODEMEM_MCP_OAUTH_ALLOWED_EMAIL", Bt = 300 * 1e3, Vt = 100, Ht = 300 * 1e3, Ut = class {
+var Jt = "CODEMEM_MCP_OIDC_ISSUER_URL", Yt = "CODEMEM_MCP_OIDC_CLIENT_ID", Xt = "CODEMEM_MCP_OIDC_CLIENT_SECRET", Zt = "CODEMEM_MCP_OAUTH_ALLOWED_SUBJECT", Qt = "CODEMEM_MCP_OAUTH_ALLOWED_EMAIL", $t = 3e5, en = 100, tn = 3e5, nn = class {
 	#e = /* @__PURE__ */ new Map();
 	issue(e, t = Date.now()) {
-		if (this.#t(t), this.#e.size >= Vt) return;
+		if (this.#t(t), this.#e.size >= en) return;
 		let n = o();
 		return this.#e.set(n, {
 			...e,
-			expiresAt: t + Bt
+			expiresAt: t + $t
 		}), n;
 	}
 	consume(e) {
@@ -1774,14 +2517,14 @@ var Ft = "CODEMEM_MCP_OIDC_ISSUER_URL", It = "CODEMEM_MCP_OIDC_CLIENT_ID", Lt =
 		for (let [t, n] of this.#e) n.expiresAt <= e && this.#e.delete(t);
 	}
 };
-function Wt() {
-	return new Ut();
+function rn() {
+	return new nn();
 }
-function Gt(e = process.env) {
-	let t = e[Ft]?.trim(), n = e[It]?.trim(), r = e[Lt]?.trim(), i = e[Rt]?.trim(), a = e[zt]?.trim().toLowerCase();
+function an(e = process.env) {
+	let t = e[Jt]?.trim(), n = e[Yt]?.trim(), r = e[Xt]?.trim(), i = e[Zt]?.trim(), a = e[Qt]?.trim().toLowerCase();
 	if (!(!t && !n && !r && !i && !a)) {
 		if (!t || !n || !r) throw Error("Incomplete MCP OIDC configuration");
-		if (J(t, "issuer", { allowLoopbackHttp: !0 }), !i && !a) throw Error("MCP OIDC requires CODEMEM_MCP_OAUTH_ALLOWED_SUBJECT or CODEMEM_MCP_OAUTH_ALLOWED_EMAIL");
+		if (Y(t, "issuer", { allowLoopbackHttp: !0 }), !i && !a) throw Error("MCP OIDC requires CODEMEM_MCP_OAUTH_ALLOWED_SUBJECT or CODEMEM_MCP_OAUTH_ALLOWED_EMAIL");
 		return {
 			issuerUrl: t,
 			clientId: n,
@@ -1791,39 +2534,39 @@ function Gt(e = process.env) {
 		};
 	}
 }
-async function Kt(e, t, n, r, i, a = Date.now()) {
-	if (!r) return Y("temporarily_unavailable", "OIDC is not configured");
-	let s = xt(e, t);
+async function on(e, t, n, r, i, a = Date.now()) {
+	if (!r) return X("temporarily_unavailable", "OIDC is not configured");
+	let s = Nt(e, t);
 	if ("status" in s) return s;
-	let c = await Yt(r.issuerUrl), l = o(), u = n.issue({
+	let c = await ln(r.issuerUrl), l = o(), u = n.issue({
 		oauthParams: e.toString(),
 		nonce: l
 	}, a);
-	if (!u) return Y("temporarily_unavailable", "Too many pending OIDC authorizations");
-	let d = Jt(i), f = new URL(c.authorization_endpoint);
+	if (!u) return X("temporarily_unavailable", "Too many pending OIDC authorizations");
+	let d = cn(i), f = new URL(c.authorization_endpoint);
 	return f.searchParams.set("response_type", "code"), f.searchParams.set("client_id", r.clientId), f.searchParams.set("redirect_uri", d), f.searchParams.set("scope", "openid email"), f.searchParams.set("state", u), f.searchParams.set("nonce", l), {
 		status: 302,
 		location: f.href
 	};
 }
-async function qt(e, t, n, r, i = Date.now()) {
+async function sn(e, t, n, r, i = Date.now()) {
 	try {
 		let a = e.get("code") ?? "", o = e.get("state") ?? "";
-		if (!o) return Y("invalid_request", "Missing OIDC state");
+		if (!o) return X("invalid_request", "Missing OIDC state");
 		let s = t.consume(o);
-		if (!s || s.expiresAt <= i) return Y("invalid_request", "Expired or unknown OIDC state");
-		if (!a) return Y("invalid_request", "Missing OIDC code");
-		let c = await Yt(n.issuerUrl), l = await Xt(c.token_endpoint, n, Jt(r), a);
-		return l.id_token ? tn(await Zt(l.id_token, c, n.clientId, s.nonce, i), n) ? { oauthParams: new URLSearchParams(s.oauthParams) } : Y("access_denied", "OIDC identity is not allowed") : Y("invalid_request", "OIDC token exchange failed");
+		if (!s || s.expiresAt <= i) return X("invalid_request", "Expired or unknown OIDC state");
+		if (!a) return X("invalid_request", "Missing OIDC code");
+		let c = await ln(n.issuerUrl), l = await un(c.token_endpoint, n, cn(r), a);
+		return l.id_token ? hn(await dn(l.id_token, c, n.clientId, s.nonce, i), n) ? { oauthParams: new URLSearchParams(s.oauthParams) } : X("access_denied", "OIDC identity is not allowed") : X("invalid_request", "OIDC token exchange failed");
 	} catch {
-		return Y("access_denied", "OIDC identity verification failed");
+		return X("access_denied", "OIDC identity verification failed");
 	}
 }
-function Jt(e) {
+function cn(e) {
 	let t = new URL(e);
 	return new URL("/oauth/callback", t.origin).href;
 }
-async function Yt(e) {
+async function ln(e) {
 	let t = new URL(e);
 	if (t.search || t.hash) throw Error("OIDC issuer must not include query or fragment");
 	if (t.username || t.password) throw Error("OIDC issuer must not include credentials");
@@ -1832,10 +2575,10 @@ async function Yt(e) {
 	let i = await r.json();
 	if (i.issuer !== t.href && i.issuer !== t.href.replace(/\/$/, "")) throw Error("OIDC discovery issuer mismatch");
 	if (!i.authorization_endpoint || !i.token_endpoint || !i.jwks_uri) throw Error("OIDC discovery metadata is incomplete");
-	let a = t.protocol === "http:" && nn(t.hostname);
-	return J(i.authorization_endpoint, "authorization endpoint", { allowLoopbackHttp: a }), J(i.token_endpoint, "token endpoint", { allowLoopbackHttp: a }), J(i.jwks_uri, "JWKS URI", { allowLoopbackHttp: a }), i;
+	let a = t.protocol === "http:" && gn(t.hostname);
+	return Y(i.authorization_endpoint, "authorization endpoint", { allowLoopbackHttp: a }), Y(i.token_endpoint, "token endpoint", { allowLoopbackHttp: a }), Y(i.jwks_uri, "JWKS URI", { allowLoopbackHttp: a }), i;
 }
-async function Xt(e, t, n, r) {
+async function un(e, t, n, r) {
 	let i = new URLSearchParams({
 		grant_type: "authorization_code",
 		code: r,
@@ -1850,17 +2593,17 @@ async function Xt(e, t, n, r) {
 	if (!a.ok) throw Error("OIDC token request failed");
 	return await a.json();
 }
-async function Zt(e, t, n, r, a) {
+async function dn(e, t, n, r, a) {
 	let [o, s, l] = e.split(".");
 	if (!o || !s || !l) throw Error("Invalid OIDC id_token");
-	let u = Qt(o), d = Qt(s);
+	let u = fn(o), d = fn(s);
 	if (u.alg !== "RS256" || !u.kid) throw Error("Unsupported OIDC id_token signature");
 	if (d.iss !== t.issuer) throw Error("OIDC id_token issuer mismatch");
-	if (!$t(d.aud, n)) throw Error("OIDC id_token audience mismatch");
-	if (!en(d.aud, d.azp, n)) throw Error("OIDC id_token authorized party mismatch");
+	if (!pn(d.aud, n)) throw Error("OIDC id_token audience mismatch");
+	if (!mn(d.aud, d.azp, n)) throw Error("OIDC id_token authorized party mismatch");
 	if (typeof d.exp != "number" || !Number.isFinite(d.exp) || d.exp * 1e3 <= a) throw Error("OIDC id_token is expired");
 	if (typeof d.iat != "number" || !Number.isFinite(d.iat)) throw Error("OIDC id_token issued-at time is missing");
-	if (d.iat * 1e3 > a + Ht) throw Error("OIDC id_token issued-at time is in the future");
+	if (d.iat * 1e3 > a + tn) throw Error("OIDC id_token issued-at time is in the future");
 	if (d.nonce !== r) throw Error("OIDC id_token nonce mismatch");
 	if (!d.sub) throw Error("OIDC id_token subject is missing");
 	let f = await fetch(t.jwks_uri);
@@ -1874,28 +2617,28 @@ async function Zt(e, t, n, r, a) {
 	if (!c("RSA-SHA256", Buffer.from(h), m, Buffer.from(l, "base64url"))) throw Error("OIDC id_token signature verification failed");
 	return d;
 }
-function Qt(e) {
+function fn(e) {
 	return JSON.parse(Buffer.from(e, "base64url").toString("utf8"));
 }
-function $t(e, t) {
+function pn(e, t) {
 	return Array.isArray(e) ? e.includes(t) : e === t;
 }
-function en(e, t, n) {
+function mn(e, t, n) {
 	return t && t !== n ? !1 : !Array.isArray(e) || e.length <= 1 || t === n;
 }
-function tn(e, t) {
+function hn(e, t) {
 	return t.allowedSubject && e.sub === t.allowedSubject ? !0 : t.allowedEmail ? e.email_verified === !0 && e.email?.toLowerCase() === t.allowedEmail : !1;
 }
-function J(e, t, n = {}) {
+function Y(e, t, n = {}) {
 	let r = new URL(e);
 	if (r.username || r.password) throw Error(`OIDC ${t} must not include credentials`);
-	if (r.protocol !== "https:" && !(n.allowLoopbackHttp && r.protocol === "http:" && nn(r.hostname))) throw Error(`OIDC ${t} must use HTTPS`);
+	if (r.protocol !== "https:" && !(n.allowLoopbackHttp && r.protocol === "http:" && gn(r.hostname))) throw Error(`OIDC ${t} must use HTTPS`);
 }
-function nn(e) {
+function gn(e) {
 	let t = e.replace(/^\[(.*)]$/, "$1").toLowerCase();
 	return t === "localhost" || t === "127.0.0.1" || t === "::1";
 }
-function Y(e, t) {
+function X(e, t) {
 	return {
 		status: 400,
 		body: t ? {
@@ -1906,7 +2649,7 @@ function Y(e, t) {
 }
 //#endregion
 //#region src/provider.ts
-var rn = class {
+var _n = class {
 	#e;
 	#t;
 	#n;
@@ -1916,44 +2659,44 @@ var rn = class {
 	#o;
 	#s;
 	constructor(e) {
-		this.#e = e.clientsStore, this.#t = e.codeStore, this.#n = e.tokenStore, this.#r = e.refreshTokenStore ?? gt(), this.#i = e.publicMcpUrl, this.#a = new URL(e.publicMcpUrl).href, this.#o = e.oidc, this.#s = e.now ?? Date.now;
+		this.#e = e.clientsStore, this.#t = e.codeStore, this.#n = e.tokenStore, this.#r = e.refreshTokenStore ?? Ot(), this.#i = e.publicMcpUrl, this.#a = new URL(e.publicMcpUrl).href, this.#o = e.oidc, this.#s = e.now ?? Date.now;
 	}
 	get clientsStore() {
 		return this.#e;
 	}
 	async authorize(e, t, n) {
-		if (!this.#o) throw new k("OIDC is not configured");
-		let r = await Kt(an(e, t), this.#e, this.#o.pendingStore, this.#o.config, this.#i, this.#s());
+		if (!this.#o) throw new N("OIDC is not configured");
+		let r = await on(vn(e, t), this.#e, this.#o.pendingStore, this.#o.config, this.#i, this.#s());
 		if (r.status === 302) {
 			n.redirect(302, r.location);
 			return;
 		}
-		throw on(r.body);
+		throw yn(r.body);
 	}
 	async challengeForAuthorizationCode(e, t) {
 		let n = this.#t.peekCode(t);
-		if (!n) throw new O("Invalid or already used code");
-		if (n.clientId !== e.client_id) throw new O("Code does not match client");
-		if (n.expiresAt <= this.#s()) throw this.#t.consumeCode(t), new O("Expired code");
+		if (!n) throw new M("Invalid or already used code");
+		if (n.clientId !== e.client_id) throw new M("Code does not match client");
+		if (n.expiresAt <= this.#s()) throw this.#t.consumeCode(t), new M("Expired code");
 		return n.codeChallenge;
 	}
 	async exchangeAuthorizationCode(e, t, n, r, i) {
 		let a = this.#s(), o = this.#t.peekCode(t);
-		if (!o) throw new O("Invalid or already used code");
-		if (o.expiresAt <= a) throw this.#t.consumeCode(t), new O("Expired code");
-		if (o.clientId !== e.client_id) throw this.#t.consumeCode(t), new O("Code does not match client");
-		if (r === void 0 || o.redirectUri !== r) throw this.#t.consumeCode(t), new O("Code does not match redirect_uri");
-		if ((o.resource ?? null) !== (i?.href ?? null)) throw this.#t.consumeCode(t), new O("Code does not match resource");
-		let s = cn(o.scopes) ?? [], c = this.#r.issueGrant({
+		if (!o) throw new M("Invalid or already used code");
+		if (o.expiresAt <= a) throw this.#t.consumeCode(t), new M("Expired code");
+		if (o.clientId !== e.client_id) throw this.#t.consumeCode(t), new M("Code does not match client");
+		if (r === void 0 || o.redirectUri !== r) throw this.#t.consumeCode(t), new M("Code does not match redirect_uri");
+		if ((o.resource ?? null) !== (i?.href ?? null)) throw this.#t.consumeCode(t), new M("Code does not match resource");
+		let s = xn(o.scopes) ?? [], c = this.#r.issueGrant({
 			clientId: e.client_id,
 			scopes: s,
 			resource: o.resource
 		}, a);
-		if (!c) throw new k("Too many active refresh grants");
+		if (!c) throw new N("Too many active refresh grants");
 		let l = this.#n.issueToken(e.client_id, a, o.resource, c.grant.grantId, s);
-		if (!l) throw this.#r.revokeGrant(c.grant.grantId, a), new k("Too many active access tokens");
-		if (!this.#t.consumeCode(t)) throw this.#n.revokeToken(l.token, a), this.#r.revokeGrant(c.grant.grantId, a), new O("Authorization code already used");
-		return de.parse({
+		if (!l) throw this.#r.revokeGrant(c.grant.grantId, a), new N("Too many active access tokens");
+		if (!this.#t.consumeCode(t)) throw this.#n.revokeToken(l.token, a), this.#r.revokeGrant(c.grant.grantId, a), new M("Authorization code already used");
+		return se.parse({
 			access_token: l.token,
 			token_type: "Bearer",
 			expires_in: l.expiresIn,
@@ -1962,13 +2705,13 @@ var rn = class {
 	}
 	async exchangeRefreshToken(e, t, n, r) {
 		let i = this.#s(), a = this.#r.rotateRefreshToken(e.client_id, t, {
-			scopes: cn(n),
+			scopes: xn(n),
 			...r ? { resource: r.href } : {}
 		}, i);
-		if (!a.ok) throw a.reason === "refresh_token_replay" && a.grantId && this.#n.revokeTokensForGrant?.(a.grantId, i), new O(sn(a.reason));
+		if (!a.ok) throw a.reason === "refresh_token_replay" && a.grantId && this.#n.revokeTokensForGrant?.(a.grantId, i), new M(bn(a.reason));
 		let o = this.#n.issueToken(e.client_id, i, a.grant.resource, a.grant.grantId, a.grant.scopes);
-		if (!o) throw new k("Too many active access tokens");
-		return de.parse({
+		if (!o) throw new N("Too many active access tokens");
+		return se.parse({
 			access_token: o.token,
 			token_type: "Bearer",
 			expires_in: o.expiresIn,
@@ -1977,7 +2720,10 @@ var rn = class {
 	}
 	async verifyAccessToken(e) {
 		let t = this.#n.verifyToken(e, this.#s());
-		if (!t.ok) throw new se(t.reason === "expired_token" ? "Token has expired" : t.reason === "revoked_token" ? "Token has been revoked" : "Token is invalid");
+		if (!t.ok) {
+			let e = t.reason === "expired_token" ? "Token has expired" : t.reason === "revoked_token" ? "Token has been revoked" : "Token is invalid";
+			throw new re(e);
+		}
 		let n = {
 			token: e,
 			clientId: t.record.clientId,
@@ -1985,7 +2731,7 @@ var rn = class {
 			expiresAt: Math.floor(t.record.expiresAt / 1e3)
 		};
 		if (t.record.resource) {
-			if (new URL(t.record.resource).href !== this.#a) throw new se("Token audience does not match this resource server");
+			if (new URL(t.record.resource).href !== this.#a) throw new re("Token audience does not match this resource server");
 			n.resource = new URL(t.record.resource);
 		}
 		return n;
@@ -1997,22 +2743,22 @@ var rn = class {
 		r && this.#n.revokeTokensForGrant?.(r, n);
 	}
 };
-function an(e, t) {
+function vn(e, t) {
 	let n = new URLSearchParams();
 	return n.set("client_id", e.client_id), n.set("redirect_uri", t.redirectUri), n.set("response_type", "code"), n.set("code_challenge", t.codeChallenge), n.set("code_challenge_method", "S256"), t.state && n.set("state", t.state), t.scopes?.length && n.set("scope", t.scopes.join(" ")), t.resource && n.set("resource", t.resource.href), n;
 }
-function on(e) {
+function yn(e) {
 	let t = e.error_description ?? e.error;
 	switch (e.error) {
-		case "temporarily_unavailable": return new k(t);
-		case "invalid_request": return new oe(t);
-		case "invalid_client": return new ae(t);
-		case "access_denied": return new E(t);
-		case "unsupported_response_type": return new le(t);
-		default: return new ce(t);
+		case "temporarily_unavailable": return new N(t);
+		case "invalid_request": return new ne(t);
+		case "invalid_client": return new te(t);
+		case "access_denied": return new A(t);
+		case "unsupported_response_type": return new ae(t);
+		default: return new ie(t);
 	}
 }
-function sn(e) {
+function bn(e) {
 	switch (e) {
 		case "expired_refresh_token": return "Refresh token has expired";
 		case "revoked_refresh_token": return "Refresh token has been revoked";
@@ -2023,18 +2769,18 @@ function sn(e) {
 		default: return "Invalid refresh token";
 	}
 }
-function cn(e) {
+function xn(e) {
 	let t = e?.map((e) => e.trim()).filter(Boolean).map((e) => e === "memory:read_access" ? "memory:read" : e === "memory:write_access" ? "memory:write" : e);
 	return t && t.length > 0 ? t : void 0;
 }
 //#endregion
 //#region src/http.ts
-var ln = "127.0.0.1", X = 38889, un = 80, dn = new Set(["https://chatgpt.com", "https://claude.ai"]), fn = "authorization,content-type,mcp-session-id", pn = "600", mn = 256, hn = 900 * 1e3, gn = 600, _n = 4 * 1024 * 1024, vn = 300 * 1e3, yn = 2e3, bn = /^[a-zA-Z0-9.-]+$/, xn = new Set([
+var Sn = "127.0.0.1", Cn = 38889, wn = 80, Tn = /* @__PURE__ */ new Set(["https://chatgpt.com", "https://claude.ai"]), En = "authorization,content-type,mcp-session-id", Dn = "600", On = 256, kn = 9e5, An = 600, jn = 4194304, Mn = 3e5, Nn = 2e3, Pn = /^[a-zA-Z0-9.-]+$/, Fn = /* @__PURE__ */ new Set([
 	"127.0.0.1",
 	"::1",
 	"localhost"
 ]);
-function Sn(t) {
+function In(t) {
 	let n = t?.extra?.sub;
 	if (typeof n == "string" && n.trim().length > 0) {
 		let r = n.trim(), i = t?.clientId?.trim();
@@ -2042,23 +2788,23 @@ function Sn(t) {
 	}
 	return t?.token ? `token:${t.token}` : void 0;
 }
-function Cn(e, t = !1) {
+function Ln(e, t = !1) {
 	let n = e?.trim() || "127.0.0.1";
-	if (n.includes("://") || n.includes("/") || n.includes("\\") || !(u(n) || n === "localhost" || bn.test(n))) throw Error(`Invalid MCP HTTP host: ${e}`);
+	if (n.includes("://") || n.includes("/") || n.includes("\\") || !(u(n) || n === "localhost" || Pn.test(n))) throw Error(`Invalid MCP HTTP host: ${e}`);
 	if (!t && !Z(n)) throw Error(`Refusing unsafe MCP HTTP host ${n}; set CODEMEM_MCP_HTTP_UNSAFE_PUBLIC=1 to allow non-loopback binding`);
 	return n;
 }
 function Z(e) {
-	return xn.has(Q(e));
+	return Fn.has(Q(e));
 }
-function wn(e = process.env.CODEMEM_MCP_HTTP_UNSAFE_PUBLIC) {
+function Rn(e = process.env.CODEMEM_MCP_HTTP_UNSAFE_PUBLIC) {
 	return e === "1" || e?.toLowerCase() === "true" || e?.toLowerCase() === "yes";
 }
-function Tn(e, t) {
-	let n = On(e);
-	return !n || !Z(n.host) ? !1 : n.port === null ? t === un : n.port === t;
+function zn(e, t) {
+	let n = Hn(e);
+	return !n || !Z(n.host) ? !1 : n.port === null ? t === wn : n.port === t;
 }
-function En(e, t) {
+function Bn(e, t) {
 	if (!e) return !0;
 	try {
 		let n = new URL(e), r = n.port ? Number(n.port) : n.protocol === "https:" ? 443 : 80;
@@ -2067,13 +2813,13 @@ function En(e, t) {
 		return !1;
 	}
 }
-function Dn(e) {
+function Vn(e) {
 	return e ? Z(e.replace(/^::ffff:/, "")) : !1;
 }
 function Q(e) {
 	return e.replace(/^\[(.*)]$/, "$1").toLowerCase();
 }
-function On(e) {
+function Hn(e) {
 	if (!e) return null;
 	if (e.startsWith("[")) {
 		let t = /^\[([^\]]+)]:(\d+)$/.exec(e);
@@ -2098,70 +2844,70 @@ function On(e) {
 		port: r
 	} : null;
 }
-function kn(e) {
-	if (e === void 0 || e === "") return X;
+function Un(e) {
+	if (e === void 0 || e === "") return Cn;
 	let t = typeof e == "number" ? e : Number(e);
 	if (!Number.isInteger(t) || t < 0 || t > 65535) throw Error(`Invalid MCP HTTP port: ${e}`);
 	return t;
 }
-async function An(e = {}) {
-	let n = Cn(e.host ?? process.env.CODEMEM_MCP_HTTP_HOST, e.allowUnsafePublic ?? wn()), r = kn(e.port ?? process.env.CODEMEM_MCP_HTTP_PORT), i = e.publicUrl ?? process.env.CODEMEM_MCP_HTTP_PUBLIC_URL, a = i ? St(i) : void 0, o = new p(e.dbPath ?? m()), s = e.oauthAccessTokenStore ? void 0 : _t(e.oauthStatePath), c = s ?? pt(), u = s ?? mt(), d = e.oauthAccessTokenStore ?? s ?? ht(), f = Gt(), g = Wt(), _ = a !== void 0 || f !== void 0, v = We(e.auditEmitter ?? qe()), y = /* @__PURE__ */ new Set(), ie = Hn(), b = null, x = re();
-	x.disable("x-powered-by"), x.set("trust proxy", "loopback");
-	let S = l(x);
+async function Wn(e = {}) {
+	let n = Ln(e.host ?? process.env.CODEMEM_MCP_HTTP_HOST, e.allowUnsafePublic ?? Rn()), r = Un(e.port ?? process.env.CODEMEM_MCP_HTTP_PORT), i = e.publicUrl ?? process.env.CODEMEM_MCP_HTTP_PUBLIC_URL, a = i ? Pt(i) : void 0, o = new p(e.dbPath ?? m()), s = e.oauthAccessTokenStore ? void 0 : kt(e.oauthStatePath), c = s ?? Tt(), u = s ?? Et(), d = e.oauthAccessTokenStore ?? s ?? Dt(), f = an(), g = rn(), x = a !== void 0 || f !== void 0, S = et(e.auditEmitter ?? rt()), C = /* @__PURE__ */ new Set(), ee = nr(), w = null, T = b();
+	T.disable("x-powered-by"), T.set("trust proxy", "loopback");
+	let E = l(T);
 	await new Promise((e, t) => {
-		S.once("error", t), S.listen({
+		E.once("error", t), E.listen({
 			host: n,
 			port: r
 		}, () => {
-			S.off("error", t), e();
+			E.off("error", t), e();
 		});
 	});
-	let C = a?.href ?? Vn(S, n), w = new URL(C), T = Kn(w, $(S)), E = new rn({
+	let D = a?.href ?? tr(E, n), O = new URL(D), k = or(O, $(E)), A = new _n({
 		clientsStore: c,
 		codeStore: u,
 		tokenStore: d,
-		publicMcpUrl: C,
+		publicMcpUrl: D,
 		...s ? { refreshTokenStore: s } : {},
 		...f ? { oidc: {
 			config: f,
 			pendingStore: g
 		} } : {}
-	}), ae = ee(w);
-	x.use(Ve({
-		windowMs: hn,
-		limit: gn,
+	}), te = _(O);
+	T.use(Ze({
+		windowMs: kn,
+		limit: An,
 		standardHeaders: "draft-8",
 		legacyHeaders: !1,
 		ipv6Subnet: !1
-	})), x.use((e, t, n) => {
-		let r = $(S), i = Jn(e.path);
+	})), T.use((e, t, n) => {
+		let r = $(E), i = cr(e.path);
 		if (i === "/mcp") {
-			if (jn(e, r, a)) {
-				if (Fn(e, t, a), e.method === "OPTIONS") {
+			if (Gn(e, r, a)) {
+				if (Yn(e, t, a), e.method === "OPTIONS") {
 					t.status(204).send("");
 					return;
 				}
 				return n();
 			}
-			Ln(e, i, a), t.status(403).type("text/plain").send("Forbidden");
+			Zn(e, i, a), t.status(403).type("text/plain").send("Forbidden");
 			return;
 		}
-		if (qn(i)) {
-			if (Nn(e, r, a)) {
-				if (Fn(e, t, a), e.method === "OPTIONS") {
+		if (sr(i)) {
+			if (qn(e, r, a)) {
+				if (Yn(e, t, a), e.method === "OPTIONS") {
 					t.status(204).send("");
 					return;
 				}
 				return n();
 			}
-			Ln(e, i, a), t.status(403).type("text/plain").send("Forbidden");
+			Zn(e, i, a), t.status(403).type("text/plain").send("Forbidden");
 			return;
 		}
 		n();
-	}), x.use(Yn(v)), x.get("/oauth/callback", async (e, t) => {
+	}), T.use(lr(S)), T.get("/oauth/callback", async (e, t) => {
 		let n = e.socket.remoteAddress ?? void 0;
 		if (!f) {
-			v(F("oidc_callback", {
+			S(z("oidc_callback", {
 				outcome: "denied",
 				reason: "oidc_not_configured",
 				remoteAddress: n
@@ -2171,9 +2917,9 @@ async function An(e = {}) {
 			});
 			return;
 		}
-		let r = await qt(new URLSearchParams(e.query), g, f, C);
+		let r = await sn(new URLSearchParams(e.query), g, f, D);
 		if ("status" in r) {
-			v(F("oidc_callback", {
+			S(z("oidc_callback", {
 				outcome: "denied",
 				reason: r.body.error,
 				remoteAddress: n
@@ -2184,12 +2930,12 @@ async function An(e = {}) {
 			clientId: r.oauthParams.get("client_id") ?? "",
 			redirectUri: r.oauthParams.get("redirect_uri") ?? "",
 			codeChallenge: r.oauthParams.get("code_challenge") ?? "",
-			scopes: ir(r.oauthParams.get("scope")),
+			scopes: vr(r.oauthParams.get("scope")),
 			...r.oauthParams.get("resource") ? { resource: r.oauthParams.get("resource") ?? void 0 } : {},
-			expiresAt: Date.now() + 300 * 1e3
+			expiresAt: Date.now() + 3e5
 		});
 		if (!a) {
-			v(F("oidc_callback", {
+			S(z("oidc_callback", {
 				outcome: "denied",
 				reason: "temporarily_unavailable",
 				clientId: i,
@@ -2203,107 +2949,107 @@ async function An(e = {}) {
 		let o = new URL(r.oauthParams.get("redirect_uri") ?? "");
 		o.searchParams.set("code", a);
 		let s = r.oauthParams.get("state");
-		s && o.searchParams.set("state", s), v(F("oidc_callback", {
+		s && o.searchParams.set("state", s), S(z("oidc_callback", {
 			outcome: "success",
 			reason: "code_issued",
 			clientId: i,
 			remoteAddress: n
 		})), t.redirect(302, o.href);
-	}), x.get("/.well-known/oauth-authorization-server", (e, t) => {
-		t.status(200).json(yt({
-			mcpUrl: C,
+	}), T.get("/.well-known/oauth-authorization-server", (e, t) => {
+		t.status(200).json(jt({
+			mcpUrl: D,
 			clientsStore: c
 		}));
-	}), x.get("/.well-known/oauth-protected-resource/mcp", (e, t) => {
-		t.status(200).json(bt(C));
-	}), x.use(te({
-		provider: E,
-		issuerUrl: T,
-		baseUrl: T,
-		resourceServerUrl: w,
-		resourceName: Je,
-		scopesSupported: I,
-		serviceDocumentationUrl: new URL(L),
+	}), T.get("/.well-known/oauth-protected-resource/mcp", (e, t) => {
+		t.status(200).json(Mt(D));
+	}), T.use(v({
+		provider: A,
+		issuerUrl: k,
+		baseUrl: k,
+		resourceServerUrl: O,
+		resourceName: it,
+		scopesSupported: at,
+		serviceDocumentationUrl: new URL(ot),
 		clientRegistrationOptions: { clientSecretExpirySeconds: 0 }
 	}));
-	let D = _ ? h({
-		verifier: E,
-		resourceMetadataUrl: ae
-	}) : (e, t, n) => n(), O = _ ? nr(v, d) : (e, t, n) => n();
-	return x.post("/mcp", O, D, re.json({ limit: _n }), async (n, r) => {
-		n.auth && v(F("bearer", {
+	let j = x ? h({
+		verifier: A,
+		resourceMetadataUrl: te
+	}) : (e, t, n) => n(), M = x ? gr(S, d) : (e, t, n) => n();
+	return T.post("/mcp", M, j, b.json({ limit: jn }), async (n, r) => {
+		n.auth && S(z("bearer", {
 			outcome: "success",
 			clientId: n.auth.clientId,
 			remoteAddress: n.socket.remoteAddress ?? void 0
 		}));
-		let i = t(o, {
-			retrievalLedgerScopeId: ie({
-				endpoint: w,
-				principal: Sn(n.auth),
-				requestBody: n.body,
-				now: e.retrievalLedgerNow?.() ?? Date.now()
-			}),
+		let i = In(n.auth), a = ee({
+			endpoint: O,
+			principal: i,
+			requestBody: n.body,
+			now: e.retrievalLedgerNow?.() ?? Date.now()
+		}), s = t(o, {
+			retrievalLedgerScopeId: a,
 			retrievalLedgerIdentityMode: "stateless"
-		}), a = new ne({ sessionIdGenerator: void 0 }), s = { mcpServer: i };
-		y.add(s);
+		}), c = new y({ sessionIdGenerator: void 0 }), l = { mcpServer: s };
+		C.add(l);
 		try {
-			await i.connect(a), await a.handleRequest(n, r, n.body);
+			await s.connect(c), await c.handleRequest(n, r, n.body);
 		} finally {
-			y.delete(s), await i.close();
+			C.delete(l), await s.close();
 		}
-	}, Wn), x.all("/mcp", (e, t) => {
+	}, ir), T.all("/mcp", (e, t) => {
 		t.setHeader("Allow", "POST"), t.status(405).type("text/plain").send("Method not allowed");
-	}), x.use((e, t) => {
+	}), T.use((e, t) => {
 		t.status(404).type("text/plain").send("Not found");
 	}), {
-		server: S,
+		server: E,
 		store: o,
-		url: `http://${Bn(n)}:${$(S)}/mcp`,
-		close: () => (b ??= (async () => {
-			await Promise.allSettled([...y].map(({ mcpServer: e }) => e.close())), await new Promise((e, t) => {
-				S.close((n) => {
+		url: `http://${er(n)}:${$(E)}/mcp`,
+		close: () => (w ??= (async () => {
+			await Promise.allSettled([...C].map(({ mcpServer: e }) => e.close())), await new Promise((e, t) => {
+				E.close((n) => {
 					if (!n || n.code === "ERR_SERVER_NOT_RUNNING") {
 						e();
 						return;
 					}
 					t(n);
-				}), S.closeAllConnections();
+				}), E.closeAllConnections();
 			}), o.close();
-		})(), b)
+		})(), w)
 	};
 }
-function jn(e, t, n) {
-	return Mn(e, t) ? !0 : n ? zn(e.headers.host, n) && Pn(e.headers.origin, n) : !1;
+function Gn(e, t, n) {
+	return Kn(e, t) ? !0 : n ? $n(e.headers.host, n) && Jn(e.headers.origin, n) : !1;
 }
-function Mn(e, t) {
-	return Dn(e.socket.remoteAddress) && Tn(e.headers.host, t) && En(e.headers.origin, t);
+function Kn(e, t) {
+	return Vn(e.socket.remoteAddress) && zn(e.headers.host, t) && Bn(e.headers.origin, t);
 }
-function Nn(e, t, n) {
-	return Mn(e, t) ? !0 : n ? zn(e.headers.host, n) && Pn(e.headers.origin, n) : !1;
+function qn(e, t, n) {
+	return Kn(e, t) ? !0 : n ? $n(e.headers.host, n) && Jn(e.headers.origin, n) : !1;
 }
-function Pn(e, t) {
+function Jn(e, t) {
 	if (!e) return !0;
 	try {
 		let n = new URL(e);
-		return n.origin === t.origin || dn.has(n.origin);
+		return n.origin === t.origin || Tn.has(n.origin);
 	} catch {
 		return !1;
 	}
 }
-function Fn(e, t, n) {
+function Yn(e, t, n) {
 	if (!n) return;
-	let r = In(e.headers.origin, n);
-	r && (t.setHeader("Access-Control-Allow-Origin", r), t.setHeader("Access-Control-Allow-Methods", "GET,POST,OPTIONS"), t.setHeader("Access-Control-Allow-Headers", e.headers["access-control-request-headers"] ?? fn), t.setHeader("Access-Control-Max-Age", pn), t.setHeader("Vary", "Origin"));
+	let r = Xn(e.headers.origin, n);
+	r && (t.setHeader("Access-Control-Allow-Origin", r), t.setHeader("Access-Control-Allow-Methods", "GET,POST,OPTIONS"), t.setHeader("Access-Control-Allow-Headers", e.headers["access-control-request-headers"] ?? En), t.setHeader("Access-Control-Max-Age", Dn), t.setHeader("Vary", "Origin"));
 }
-function In(e, t) {
+function Xn(e, t) {
 	if (e) try {
 		let n = new URL(e).origin;
-		if (n === t.origin || dn.has(n)) return n;
+		if (n === t.origin || Tn.has(n)) return n;
 	} catch {
 		return;
 	}
 }
-function Ln(e, t, n) {
+function Zn(e, t, n) {
 	console.warn(JSON.stringify({
 		source: "codemem-mcp-http-guard",
 		timestamp: (/* @__PURE__ */ new Date()).toISOString(),
@@ -2311,35 +3057,35 @@ function Ln(e, t, n) {
 		reason: "host_or_origin_mismatch",
 		method: e.method,
 		path: t,
-		host: Rn(e.headers.host),
-		origin: Rn(e.headers.origin),
+		host: Qn(e.headers.host),
+		origin: Qn(e.headers.origin),
 		expectedOrigin: n?.origin,
 		remoteAddress: e.socket.remoteAddress ?? void 0
 	}));
 }
-function Rn(e) {
-	return !e || e.length <= mn ? e : `${e.slice(0, mn)}…`;
+function Qn(e) {
+	return !e || e.length <= On ? e : `${e.slice(0, On)}…`;
 }
-function zn(e, t) {
-	let n = On(e);
+function $n(e, t) {
+	let n = Hn(e);
 	if (!n) return !1;
 	let r = t.port ? Number(t.port) : t.protocol === "https:" ? 443 : 80, i = t.protocol === "https:" ? 443 : 80, a = n.port ?? i;
 	return Q(n.host) === Q(t.hostname) && a === r;
 }
 function $(e) {
 	let t = e.address();
-	return !t || typeof t == "string" ? X : t.port;
+	return !t || typeof t == "string" ? Cn : t.port;
 }
-function Bn(e) {
+function er(e) {
 	return u(e) === 6 ? `[${e}]` : e;
 }
-function Vn(e, t) {
-	return `http://${Bn(t)}:${$(e)}/mcp`;
+function tr(e, t) {
+	return `http://${er(t)}:${$(e)}/mcp`;
 }
-function Hn() {
+function nr() {
 	let t = /* @__PURE__ */ new Map();
 	return (r) => {
-		if (!r.principal) return Un(o());
+		if (!r.principal) return rr(o());
 		for (let [e, n] of t) n.expiresAt <= r.now && t.delete(e);
 		let i = n("sha256").update(JSON.stringify([
 			r.endpoint.href,
@@ -2347,11 +3093,11 @@ function Hn() {
 			e(r.requestBody)
 		])).digest("hex"), a = t.get(i);
 		if (a) return a.scopeId;
-		let s = Un(JSON.stringify([i, r.now]));
+		let s = rr(JSON.stringify([i, r.now]));
 		for (t.set(i, {
 			scopeId: s,
-			expiresAt: r.now + vn
-		}); t.size > yn;) {
+			expiresAt: r.now + Mn
+		}); t.size > Nn;) {
 			let e = t.keys().next().value;
 			if (e === void 0) break;
 			t.delete(e);
@@ -2359,11 +3105,11 @@ function Hn() {
 		return s;
 	};
 }
-function Un(e) {
+function rr(e) {
 	return `mcp-http:${n("sha256").update(e).digest("hex")}`;
 }
-function Wn(e, t, n, r) {
-	let i = Gn(e);
+function ir(e, t, n, r) {
+	let i = ar(e);
 	if (i === null) {
 		r(e);
 		return;
@@ -2377,31 +3123,31 @@ function Wn(e, t, n, r) {
 		id: null
 	});
 }
-function Gn(e) {
+function ar(e) {
 	if (typeof e != "object" || !e) return null;
 	let t = e;
 	return t.type === "entity.too.large" ? 413 : t.type === "entity.parse.failed" ? 400 : null;
 }
-function Kn(e, t) {
+function or(e, t) {
 	return e.protocol === "https:" || Z(e.hostname) && Q(e.hostname) !== "::1" ? new URL(e.origin) : new URL(`http://localhost:${t}/`);
 }
-function qn(e) {
+function sr(e) {
 	return e === "/register" || e === "/authorize" || e === "/token" || e === "/revoke" || e === "/oauth/callback" || e === "/.well-known/oauth-authorization-server" || e === "/.well-known/oauth-protected-resource/mcp";
 }
-function Jn(e) {
+function cr(e) {
 	return e.length > 1 ? e.replace(/\/+$/, "") : e;
 }
-function Yn(e) {
+function lr(e) {
 	return (t, n, r) => {
 		let i = t.path;
-		if (!Xn(i)) return r();
+		if (!ur(i)) return r();
 		let a, o = n.json.bind(n);
 		n.json = ((e) => (a = e, o(e))), n.on("finish", () => {
 			if (i === "/oauth/callback") return;
-			let r = Zn(i, t);
+			let r = dr(i, t);
 			if (!r) return;
-			let o = $n(n, a), s = tr(t, a);
-			e(F(r, {
+			let o = pr(n, a), s = hr(t, a);
+			e(z(r, {
 				outcome: o ? "denied" : "success",
 				...o ? { reason: o } : {},
 				...s ? { clientId: s } : {},
@@ -2410,17 +3156,17 @@ function Yn(e) {
 		}), r();
 	};
 }
-function Xn(e) {
-	return Qn(e) !== null;
+function ur(e) {
+	return fr(e) !== null;
 }
-function Zn(e, t) {
-	return e === "/token" && t.body?.grant_type === "refresh_token" ? "refresh" : Qn(e);
+function dr(e, t) {
+	return e === "/token" && t.body?.grant_type === "refresh_token" ? "refresh" : fr(e);
 }
-function Qn(e) {
+function fr(e) {
 	return e === "/register" ? "registration" : e === "/authorize" ? "authorize" : e === "/token" ? "token" : e === "/revoke" ? "revocation" : null;
 }
-function $n(e, t) {
-	let n = er(t);
+function pr(e, t) {
+	let n = mr(t);
 	if (n) return n;
 	let r = e.getHeader("location");
 	if (typeof r == "string") try {
@@ -2429,38 +3175,38 @@ function $n(e, t) {
 		return;
 	}
 }
-function er(e) {
+function mr(e) {
 	if (typeof e == "object" && e && "error" in e && typeof e.error == "string") return e.error;
 }
-function tr(e, t) {
+function hr(e, t) {
 	return typeof t == "object" && t && "client_id" in t && typeof t.client_id == "string" ? t.client_id : (typeof e.body?.client_id == "string" ? e.body.client_id : void 0) || (typeof e.query.client_id == "string" ? e.query.client_id : void 0);
 }
-function nr(e, t) {
+function gr(e, t) {
 	return (n, r, i) => {
-		let a = rr(n.headers.authorization, t);
-		a && e(F("bearer", {
+		let a = _r(n.headers.authorization, t);
+		a && e(z("bearer", {
 			outcome: "denied",
 			reason: a,
 			remoteAddress: n.socket.remoteAddress ?? void 0
 		})), i();
 	};
 }
-function rr(e, t) {
+function _r(e, t) {
 	if (!e) return "missing_authorization_header";
 	let [n, r, i] = e.trim().split(/\s+/);
 	if (!n || !r || i || n.toLowerCase() !== "bearer") return "malformed_authorization_header";
 	let a = t.verifyToken(r);
 	return a.ok ? null : a.reason;
 }
-function ir(e) {
+function vr(e) {
 	return e?.split(/\s+/).map((e) => e.trim()).filter(Boolean) ?? [];
 }
-function ar() {
+function yr() {
 	let e = process.argv[1];
 	return e ? import.meta.url === f(e).href : !1;
 }
-async function or() {
-	let e = await An();
+async function br() {
+	let e = await Wn();
 	console.error(`codemem MCP HTTP server listening at ${e.url}`);
 	let t = async () => {
 		try {
@@ -2470,10 +3216,10 @@ async function or() {
 	};
 	process.on("SIGINT", t), process.on("SIGTERM", t);
 }
-ar() && or().catch((e) => {
+yr() && br().catch((e) => {
 	console.error("codemem MCP HTTP server failed to start:", e), process.exit(1);
 });
 //#endregion
-export { ln as DEFAULT_MCP_HTTP_HOST, X as DEFAULT_MCP_HTTP_PORT, _n as MCP_HTTP_MAX_JSON_BODY_BYTES, vn as MCP_HTTP_RETRIEVAL_RETRY_WINDOW_MS, Sn as authenticatedRetrievalPrincipal, Tn as isAllowedMcpHttpRequestHost, En as isAllowedMcpHttpRequestOrigin, Dn as isAllowedMcpHttpRequestRemoteAddress, Z as isLoopbackHost, wn as isUnsafePublicBindAllowed, kn as parseMcpHttpPort, An as startCodememMcpHttpServer, Cn as validateMcpHttpHost };
+export { Sn as DEFAULT_MCP_HTTP_HOST, Cn as DEFAULT_MCP_HTTP_PORT, jn as MCP_HTTP_MAX_JSON_BODY_BYTES, Mn as MCP_HTTP_RETRIEVAL_RETRY_WINDOW_MS, In as authenticatedRetrievalPrincipal, zn as isAllowedMcpHttpRequestHost, Bn as isAllowedMcpHttpRequestOrigin, Vn as isAllowedMcpHttpRequestRemoteAddress, Z as isLoopbackHost, Rn as isUnsafePublicBindAllowed, Un as parseMcpHttpPort, Wn as startCodememMcpHttpServer, Ln as validateMcpHttpHost };
 
 //# sourceMappingURL=http.js.map