@fruggr/zendesk-mcp-server 2.24.0 → 3.0.1

package/dist/index.js

@@ -22,7 +22,6 @@ import remarkRehype from "remark-rehype";
 import remarkStringify from "remark-stringify";
 import { unified } from "unified";
 import { StdioServerTransport } from "@modelcontextprotocol/server/stdio";
-import { NodeStreamableHTTPServerTransport } from "@modelcontextprotocol/node";
 //#region src/utils/logger.ts
 const SEVERITY = {
 	debug: 0,
@@ -119,53 +118,16 @@ const createLogger = (level) => {
 };
 //#endregion
 //#region src/utils/env.ts
-const LEGACY_NAMES = /* @__PURE__ */ new Map([
-	["OAUTH_TOKEN_FILE", "ZENDESK_TOKEN_FILE"],
-	["OAUTH_CALLBACK_PORT", "ZENDESK_OAUTH_CALLBACK_PORT"],
-	["LISTEN_HOST", "HOST"],
-	["RESPONSE_CHARACTER_LIMIT", "ZENDESK_CHARACTER_LIMIT"],
-	["RESPONSE_MAX_BYTES", "ZENDESK_MAX_RESPONSE_BYTES"],
-	["ATTACHMENT_MAX_BYTES", "ZENDESK_MAX_ATTACHMENT_BYTES"],
-	["EMBEDDED_IMAGES_MAX", "ZENDESK_MAX_EMBEDDED_IMAGES"],
-	["COMMENT_MAX_PAGES", "ZENDESK_MAX_COMMENT_PAGES"],
-	["TICKET_FIELD_SCAN_MAX_PAGES", "ZENDESK_TICKET_FIELD_SCAN_MAX_PAGES"],
-	["ARTICLE_RESOURCES_SCAN_MAX_PAGES", "ZENDESK_ARTICLE_RESOURCES_SCAN_MAX_PAGES"],
-	["REORDER_CONFIRM_THRESHOLD", "ZENDESK_REORDER_CONFIRM_THRESHOLD"]
-]);
-const warned = /* @__PURE__ */ new Set();
-const warnDeprecated = (legacy, current) => {
-	if (warned.has(legacy)) return;
-	warned.add(legacy);
-	try {
-		console.error(`[zendesk-mcp] [warn] deprecated_env_var name=${legacy} replacement=${current} removal=3.0.0`);
-	} catch {}
-};
 /**
-* Reads `name`, falling back to the legacy name it replaced. `name` in the result
-* is the variable the value came from, so an error about it names what the
-* operator actually set.
+* Reads `name` from the environment. `name` in the result is the variable the
+* value came from, so an error about it names what the operator actually set.
+* Every variable goes through here, so a future rename has a single place to
+* map the old name (AGENTS.md, "Environment variables").
 */
-const readEnv = (name) => {
-	const value = process.env[name];
-	const legacy = LEGACY_NAMES.get(name);
-	if (legacy === void 0) return {
-		name,
-		value
-	};
-	const legacyValue = process.env[legacy];
-	if (legacyValue === void 0) return {
-		name,
-		value
-	};
-	warnDeprecated(legacy, name);
-	return value === void 0 ? {
-		name: legacy,
-		value: legacyValue
-	} : {
-		name,
-		value
-	};
-};
+const readEnv = (name) => ({
+	name,
+	value: process.env[name]
+});
 //#endregion
 //#region src/constants.ts
 const positiveIntEnv = (name, fallback) => {
@@ -193,6 +155,15 @@ const getOAuthUrls = (subdomain) => ({
 	tokenUrl: `https://${subdomain}.zendesk.com/oauth/tokens`
 });
 //#endregion
+//#region src/utils/html.ts
+/**
+* Escape a string for safe interpolation into HTML text/attribute context.
+* Both the stdio callback page and the HTTP consent page echo
+* attacker-controllable values (an OAuth `error_description`, a client name
+* from a fetched metadata document); without escaping these are an XSS sink.
+*/
+const escapeHtml = (value) => value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+//#endregion
 //#region src/auth/oauth-scopes.ts
 /**
 * The OAuth scope the server asks Zendesk for, and the one predicate that
@@ -260,13 +231,6 @@ const callbackPortInUseError = (port, cause) => Object.assign(/* @__PURE__ */ ne
 	code: "EADDRINUSE",
 	cause
 });
-/**
-* Escape a string for safe interpolation into HTML text/attribute context.
-* The local callback server echoes attacker-controllable values (the OAuth
-* `error_description` query param, token-exchange error bodies) back into the
-* browser response; without escaping these are a reflected-XSS sink.
-*/
-const escapeHtml = (value) => value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 const errorPage = (title, detail) => `<html><body><h1>${escapeHtml(title)}</h1>${detail === void 0 ? "" : `<p>${escapeHtml(detail)}</p>`}</body></html>`;
 const SUCCESS_PAGE = "<html><body><h1>Authentication successful!</h1><p>You can close this tab and return to your AI assistant.</p><p>This tab will auto-close in <span id=\"t\">10</span>s.</p><script>let n=10;const el=document.getElementById(\"t\");const i=setInterval(()=>{n--;el.textContent=n;if(n<=0){clearInterval(i);window.close();}},1000);<\/script></body></html>";
 const generateCodeVerifier = () => randomBytes(32).toString("base64url");
@@ -871,7 +835,22 @@ const ConfigSchema = z.object({
 	* because they send no Origin header.
 	*/
 	corsOrigins: z.array(z.string().url().transform((value) => new URL(value).origin).refine((origin) => origin !== "null", { message: "CORS origin must be an http(s) URL with a host" })).default([]),
-	callbackPort: z.number().int().min(1).max(65535).optional()
+	callbackPort: z.number().int().min(1).max(65535).optional(),
+	/**
+	* HTTP only: the authorization server's master secret (`OAUTH_MASTER_SECRET`),
+	* or a file holding it. Both optional: when absent, one is generated and
+	* persisted in the config dir. Belongs to this server, not to Zendesk, hence
+	* no `ZENDESK_` prefix. Validated (length, base64) where it is used, so a
+	* value never reaches a schema error message.
+	*/
+	oauthMasterSecret: z.string().optional(),
+	oauthMasterSecretFile: z.string().min(1).optional(),
+	/** HTTP only: the grant store URI; defaults to a file in the config dir. */
+	oauthStore: z.string().url().optional(),
+	/** HTTP only: CIMD client ids added to the consent-skip allowlist. */
+	oauthTrustedClients: z.array(z.string().url()).default([]),
+	/** HTTP only: whether the built-in allowlist (claude.ai, ChatGPT) applies. */
+	defaultTrustedClients: z.boolean().default(true)
 });
 const DIGITS_ONLY = /^\d+$/;
 const parsePort = (raw, label) => {
@@ -909,6 +888,13 @@ const CLI_OPTIONS = {
 		multiple: true
 	},
 	"callback-port": { type: "string" },
+	"oauth-master-secret-file": { type: "string" },
+	"oauth-store": { type: "string" },
+	"oauth-trusted-client": {
+		type: "string",
+		multiple: true
+	},
+	"no-default-trusted-clients": { type: "boolean" },
 	"read-only": { type: "boolean" },
 	"no-topology": { type: "boolean" },
 	"no-promoted-articles": { type: "boolean" },
@@ -925,14 +911,18 @@ const FIELD_BY_FLAG = /* @__PURE__ */ new Map([
 	["transport", "transport"],
 	["host", "host"],
 	["public-url", "publicUrl"],
-	["cors-origin", "corsOrigins"]
+	["cors-origin", "corsOrigins"],
+	["oauth-master-secret-file", "oauthMasterSecretFile"],
+	["oauth-store", "oauthStore"],
+	["oauth-trusted-client", "oauthTrustedClients"]
 ]);
 const STANDALONE_EFFECTS = /* @__PURE__ */ new Map([
 	["read-only", { readOnly: true }],
 	["no-topology", { topology: false }],
 	["no-promoted-articles", { promotedArticles: false }],
 	["dev", { dev: true }],
-	["print-tools", { printTools: true }]
+	["print-tools", { printTools: true }],
+	["no-default-trusted-clients", { defaultTrustedClients: false }]
 ]);
 const parseCliArgs = (args) => {
 	const { values, positionals } = parseArgs({
@@ -956,8 +946,9 @@ const parseCliArgs = (args) => {
 	if (values["callback-port"] !== void 0) result.callbackPort = parsePort(values["callback-port"], "--callback-port");
 	return result;
 };
+const splitList = (raw) => (raw ?? "").split(",").map((s) => s.trim()).filter((s) => s.length > 0);
 const resolveTransportSettings = (cli) => {
-	const corsFromEnv = (process.env["CORS_ORIGIN"] ?? "").split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+	const corsFromEnv = splitList(process.env["CORS_ORIGIN"]);
 	return {
 		transport: cli.transport ?? requireNonEmptyEnv("TRANSPORT") ?? "stdio",
 		host: cli.host ?? requireNonEmptyEnv("LISTEN_HOST") ?? "0.0.0.0",
@@ -966,6 +957,13 @@ const resolveTransportSettings = (cli) => {
 		corsOrigins: [...cli.corsOrigins ?? [], ...corsFromEnv]
 	};
 };
+const resolveOAuthServerSettings = (cli) => ({
+	oauthMasterSecret: requireNonEmptyEnv("OAUTH_MASTER_SECRET"),
+	oauthMasterSecretFile: cli.oauthMasterSecretFile ?? requireNonEmptyEnv("OAUTH_MASTER_SECRET_FILE"),
+	oauthStore: cli.oauthStore ?? requireNonEmptyEnv("OAUTH_STORE"),
+	oauthTrustedClients: [...cli.oauthTrustedClients ?? [], ...splitList(readEnv("OAUTH_TRUSTED_CLIENTS").value)],
+	defaultTrustedClients: cli.defaultTrustedClients
+});
 const loadConfig = (argv = process.argv.slice(2)) => {
 	const cli = parseCliArgs(argv);
 	const subdomain = cli.subdomain ?? requireNonEmptyEnv("ZENDESK_SUBDOMAIN") ?? "";
@@ -988,7 +986,8 @@ const loadConfig = (argv = process.argv.slice(2)) => {
 		dev: cli.dev ?? false,
 		printTools: cli.printTools ?? false,
 		callbackPort,
-		...resolveTransportSettings(cli)
+		...resolveTransportSettings(cli),
+		...resolveOAuthServerSettings(cli)
 	});
 };
 //#endregion
@@ -1372,6 +1371,50 @@ const replaceSectionContent = (html, sectionIndex, newHtml) => {
 		return `<${section.headingTag}>${section.heading}</${section.headingTag}>${content}`;
 	}).join("");
 };
+const LEADING_HEADING = /^\s*<(h[1-3])(?:\s[^>]*)?>([\s\S]*?)<\/\1\s*>/i;
+const normalizeText = (text) => text.trim().split(WHITESPACE_RUN).join(" ");
+const stripLeadingDuplicateHeading = (html, target) => {
+	const match = LEADING_HEADING.exec(html);
+	const tag = match?.[1];
+	if (!match || !tag) return {
+		html,
+		stripped: null
+	};
+	const text = normalizeText(textOf(match[2] ?? ""));
+	if (tag.toLowerCase() !== target.headingTag || text !== normalizeText(target.heading)) return {
+		html,
+		stripped: null
+	};
+	return {
+		html: html.slice(match[0].length).trimStart(),
+		stripped: {
+			tag: target.headingTag,
+			text
+		}
+	};
+};
+const introLoss = (target, contentSections) => {
+	if (target?.level !== 0) return null;
+	const first = contentSections[0];
+	if (!first) return "empty";
+	return first.level > 0 ? "heading-led" : null;
+};
+const applySectionUpdate = (html, sectionIndex, newHtml) => {
+	const sections = parseSections(html);
+	const target = sections[sectionIndex];
+	const { html: content, stripped } = target ? stripLeadingDuplicateHeading(newHtml, target) : {
+		html: newHtml,
+		stripped: null
+	};
+	const contentSections = parseSections(content);
+	return {
+		body: replaceSectionContent(html, sectionIndex, content),
+		stripped,
+		contentHeadings: contentSections.filter((s) => s.level > 0).length,
+		introLost: introLoss(target, contentSections),
+		sectionsBefore: sections.length
+	};
+};
 const keepAsHtml = (_state, node) => ({
 	type: "html",
 	value: toHtml(node)
@@ -2362,6 +2405,16 @@ const assertReorderParamsCoherent = (articleId, target, referenceArticleId) => {
 	if (!needsReference && referenceArticleId !== void 0) throw new Error(`reference_article_id must be omitted when target is "${target}" (it only applies to "before"/"after").`);
 	if (referenceArticleId !== void 0 && referenceArticleId === articleId) throw new Error("reference_article_id must differ from article_id.");
 };
+const structureWarning = (r) => {
+	if (r.introLost === "empty") {
+		if (r.sectionsBefore === 1) return ["Warning: content is empty and the intro was the only section, so the article body is now empty."];
+		return [`Warning: content is empty, so the intro no longer exists and every later section index moved down by one (article: ${r.sectionsAfter} sections, was ${r.sectionsBefore}). Call get_article_outline before the next edit.`];
+	}
+	if (r.introLost === "heading-led") return [`Warning: content starts with a heading, so the intro no longer exists and section [${r.sectionIndex}] is now a heading section (article: ${r.sectionsAfter} sections, was ${r.sectionsBefore}). Call get_article_outline before the next edit.`];
+	if (r.contentHeadings > 0) return [`Warning: content contains ${r.contentHeadings} heading(s) (h1-h3), so the article now has ${r.sectionsAfter} sections (was ${r.sectionsBefore}); indexes after [${r.sectionIndex}] shifted. Call get_article_outline before the next edit.`];
+	return [];
+};
+const sectionUpdateNotes = (r) => [...r.stripped ? [`Note: removed a leading <${r.stripped.tag}> "${r.stripped.text}" from content; the section heading is kept automatically and is not part of content.`] : [], ...structureWarning(r)];
 const createHelpCenterTools = (ctx) => {
 	const { subdomain, getToken } = ctx;
 	const fetchSectionOrder = async (sectionId, locale, token) => {
@@ -3208,7 +3261,7 @@ const createHelpCenterTools = (ctx) => {
 			namespace: "help_center",
 			readOnly: true,
 			title: "Get Article Section",
-			description: "Retrieve the content of a single section of an article in a given locale. Use get_article_outline first to discover section indexes. Default format=\"html\" for round-trip safety. Pass format=\"markdown\" only for human review — the Markdown representation is lossy on some structures (<pre> with <br>, tables with multi-<p> cells are kept as raw HTML to limit the damage, but do not round-trip markdown content back through update_article_section).",
+			description: "Retrieve the content of a single section of an article in a given locale. Use get_article_outline first to discover section indexes. Default format=\"html\" for round-trip safety. Pass format=\"markdown\" only for human review — the Markdown representation is lossy on some structures (<pre> with <br>, tables with multi-<p> cells are kept as raw HTML to limit the damage, but do not round-trip markdown content back through update_article_section). The \"## [n] hN: ...\" line at the top is a label, not part of the content.",
 			inputSchema: z.object({
 				article_id: z.number().int().describe(ARTICLE_ID_DESC),
 				locale: z.string().describe("Locale of the body (e.g., \"en-us\", \"fr\")"),
@@ -3246,12 +3299,12 @@ const createHelpCenterTools = (ctx) => {
 			namespace: "help_center",
 			readOnly: false,
 			title: "Update Article Section",
-			description: "Replace the content of a single section of an article in a given locale, keeping the rest of the body intact. The server fetches the current body, replaces the targeted section, and PUTs the full reconstructed body via the Translations API. Default format=\"html\" for fidelity. Use format=\"markdown\" only when you control the input and know it does not rely on structures that round-trip poorly (code blocks with line breaks, tables with multi-paragraph cells). The section heading is preserved and is NOT part of the replaced content.",
+			description: "Replace the body of one article section, heading excluded (the heading is kept as is), in a given locale, leaving the rest of the article intact. The server fetches the current body, replaces the targeted section, and PUTs the full reconstructed body via the Translations API. A leading heading in content that repeats the section heading is removed; any other h1-h3 in content creates new sections and shifts the later indexes (the response warns). section_index 0 is the heading-less intro, which exists only when the body has text before its first heading. Default format=\"html\" for fidelity. Use format=\"markdown\" only when you control the input and know it does not rely on structures that round-trip poorly (code blocks with line breaks, tables with multi-paragraph cells).",
 			inputSchema: z.object({
 				article_id: z.number().int().describe(ARTICLE_ID_DESC),
 				locale: z.string().describe("Locale of the translation to update"),
-				section_index: z.number().int().min(0).describe("0-based index of the section to replace (see get_article_outline)"),
-				content: z.string().describe("New content for the section (heading excluded). HTML by default, Markdown if format=\"markdown\"."),
+				section_index: z.number().int().min(0).describe("0-based index of the section to replace (see get_article_outline). 0 is the heading-less intro when the body has text before its first heading, otherwise the first heading."),
+				content: z.string().describe("New content for the section (heading excluded: send neither the heading nor the \"## [n] hN: ...\" label line that get_article_section prints). HTML by default, Markdown if format=\"markdown\"."),
 				format: z.enum(["html", "markdown"]).default("html").describe("Input format. \"html\" (default) is the safe path. \"markdown\" is converted to HTML server-side but may introduce artifacts on complex content.")
 			}),
 			annotations: {
@@ -3265,13 +3318,26 @@ const createHelpCenterTools = (ctx) => {
 				const token = await getToken();
 				const { translation } = await helpCenterGet(subdomain, token, `/articles/${article_id}/translations/${locale}`);
 				const newSectionHtml = format === "markdown" ? markdownToHtml(content) : content;
-				const newBody = replaceSectionContent(translation.body, section_index, newSectionHtml);
+				const { body: newBody, stripped, contentHeadings, introLost, sectionsBefore } = applySectionUpdate(translation.body, section_index, newSectionHtml);
 				const { translation: updated } = await helpCenterPut(subdomain, token, `/articles/${article_id}/translations/${locale}`, { translation: { body: newBody } });
-				const updatedSection = parseSections(updated.body)[section_index];
-				const newWordCount = updatedSection?.wordCount ?? 0;
+				const updatedSections = parseSections(updated.body);
+				const updatedSection = updatedSections[section_index];
+				const emptied = introLost === "empty";
+				const newWordCount = emptied ? 0 : updatedSection?.wordCount ?? 0;
 				return { content: [{
 					type: "text",
-					text: [`Section [${section_index}] "${updatedSection?.heading ?? "(intro)"}" updated for article #${article_id} (${locale}).`, `New word count: ${newWordCount}.`].join("\n")
+					text: [
+						`Section [${section_index}] "${emptied ? "(intro)" : updatedSection?.heading ?? "(intro)"}" updated for article #${article_id} (${locale}).`,
+						`New word count: ${newWordCount}.`,
+						...sectionUpdateNotes({
+							stripped,
+							contentHeadings,
+							introLost,
+							sectionIndex: section_index,
+							sectionsBefore,
+							sectionsAfter: updatedSections.length
+						})
+					].join("\n")
 				}] };
 			}
 		},
@@ -5537,358 +5603,34 @@ const renderToolSurface = (config, tools) => {
 	].join("\n");
 };
 //#endregion
-//#region src/transports/http.ts
-const WILDCARD_HOSTS = /* @__PURE__ */ new Set([
-	"0.0.0.0",
-	"::",
-	"*"
-]);
-const TRAILING_SLASHES = /\/+$/;
-const DEFAULT_BROWSER_MCP_CLIENT_ORIGINS = [
-	"https://chatgpt.com",
-	"https://chat.openai.com",
-	"https://claude.ai",
-	"https://gemini.google.com",
-	"https://copilot.microsoft.com",
-	"https://www.perplexity.ai",
-	"https://chat.mistral.ai",
-	"https://grok.com"
-];
-const CORS_ALLOWED_METHODS = "GET, POST, DELETE, OPTIONS";
-const CORS_ALLOWED_HEADERS = "Authorization, Content-Type, Accept, mcp-session-id, mcp-protocol-version, last-event-id";
-const CORS_EXPOSE_HEADERS = "mcp-session-id";
-const CORS_MAX_AGE = "600";
-const LOCALHOST_HOSTNAMES = /* @__PURE__ */ new Set([
-	"localhost",
-	"127.0.0.1",
-	"[::1]"
-]);
-const ALLOWED_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:"]);
+//#region src/transports/http-peers.ts
 /**
-* Returns the origin string to reflect in `Access-Control-Allow-Origin`, or
-* `undefined` if the origin is not allowed.
-*
-* The returned value is **never the raw `Origin` request header**. It comes
-* from one of three sanitization points:
-*
-*   1. An entry of the hardcoded `DEFAULT_BROWSER_MCP_CLIENT_ORIGINS` array.
-*   2. An entry of the operator-configured `extraOrigins` array.
-*   3. A loopback origin rebuilt from validated URL components after the
-*      hostname has been allowlisted against `LOCALHOST_HOSTNAMES`.
-*
-* This shape keeps the dataflow from request header to response header
-* gated by a constant allowlist, which is the pattern CodeQL's
-* `js/cors-misconfiguration-for-credentials` rule recognises as safe when
-* combined with `Access-Control-Allow-Credentials: true`.
+* Packages only the HTTP transport uses, shipped as optional peer dependencies so
+* a stdio install (npx, bunx) never downloads them. Inlined from `package.json` at
+* build time, so a version bump there is the only edit. Rationale:
+* docs/decisions/oauth-authorization-server.md (Packaging).
 */
-const resolveAllowedOrigin = (origin, extraOrigins) => {
-	const defaultMatch = DEFAULT_BROWSER_MCP_CLIENT_ORIGINS.find((entry) => entry === origin);
-	if (defaultMatch) return defaultMatch;
-	const extraMatch = extraOrigins?.find((entry) => entry === origin);
-	if (extraMatch) return extraMatch;
+const HTTP_PEERS = {
+	"@modelcontextprotocol/node": "^2.0.0",
+	"jose": "^6.2.12",
+	"oidc-provider": "~9.12.2"
+};
+const installCommand = () => ["npm install @fruggr/zendesk-mcp-server", ...Object.entries(HTTP_PEERS).map(([name, range]) => `${name}@${range}`)].join(" ");
+const missingPeers = (err) => {
+	if (err?.code !== "ERR_MODULE_NOT_FOUND") return [];
+	const message = String(err.message);
+	return Object.keys(HTTP_PEERS).filter((name) => message.includes(`'${name}'`));
+};
+/** Import the HTTP transport, turning a missing optional peer into an actionable error. */
+const loadHttpTransport = async (importer = () => import("./http-BXXDmcaZ.js")) => {
 	try {
-		const url = new URL(origin);
-		if (!ALLOWED_PROTOCOLS.has(url.protocol)) return void 0;
-		if (!LOCALHOST_HOSTNAMES.has(url.hostname)) return void 0;
-		const port = url.port || (url.protocol === "https:" ? "443" : "80");
-		return `${url.protocol}//${url.hostname}:${port}`;
-	} catch {
-		return;
-	}
-};
-const applyCorsHeaders = (req, res, extraOrigins) => {
-	const requestOrigin = req.headers["origin"];
-	if (typeof requestOrigin !== "string" || requestOrigin.length === 0) return;
-	const allowedOrigin = resolveAllowedOrigin(requestOrigin, extraOrigins);
-	if (!allowedOrigin) return;
-	res.setHeader("Access-Control-Allow-Origin", allowedOrigin);
-	res.setHeader("Vary", "Origin");
-	res.setHeader("Access-Control-Allow-Credentials", "true");
-	res.setHeader("Access-Control-Expose-Headers", CORS_EXPOSE_HEADERS);
-};
-const handleCorsPreflight = (req, res, extraOrigins) => {
-	if (req.method !== "OPTIONS") return false;
-	applyCorsHeaders(req, res, extraOrigins);
-	if (res.getHeader("Access-Control-Allow-Origin")) {
-		res.setHeader("Access-Control-Allow-Methods", CORS_ALLOWED_METHODS);
-		res.setHeader("Access-Control-Allow-Headers", CORS_ALLOWED_HEADERS);
-		res.setHeader("Access-Control-Max-Age", CORS_MAX_AGE);
-	}
-	res.writeHead(204);
-	res.end();
-	return true;
-};
-const resolveResourceUrl = (config, logger = silentLogger) => {
-	if (config.publicUrl) return config.publicUrl.replace(TRAILING_SLASHES, "");
-	if (!WILDCARD_HOSTS.has(config.host)) return `http://${config.host}:${config.port}`;
-	logger.warn("public_url_unset", {
-		host: config.host,
-		advertised: `http://${config.host}:${config.port}`,
-		hint: "OAuth discovery will advertise a non-routable resource identifier and spec-compliant MCP clients may refuse the connection. Set PUBLIC_URL (or --public-url) to the URL clients use to reach this server (e.g. https://your-host.example.com)."
-	});
-	return `http://${config.host}:${config.port}`;
-};
-const MISSING_BEARER_MESSAGE = "Missing Authorization: Bearer <zendesk-oauth-token> header. HTTP mode requires per-user OAuth 2.1 PKCE - obtain a token from Zendesk via your MCP client.";
-const extractBearer = (request) => {
-	const header = request.headers["authorization"];
-	if (typeof header !== "string") return void 0;
-	if (!header.toLowerCase().startsWith("bearer ")) return void 0;
-	return header.slice(7).trim();
-};
-const buildOAuthMetadata = (config, logger = silentLogger) => {
-	const { authorizeUrl, tokenUrl } = getOAuthUrls(config.subdomain);
-	const issuer = `https://${config.subdomain}.zendesk.com`;
-	const resource = resolveResourceUrl(config, logger);
-	const scopes = () => supportedScopes(config.readOnly);
-	return {
-		protectedResource: {
-			authorization_servers: [issuer],
-			resource,
-			bearer_methods_supported: ["header"],
-			scopes_supported: scopes()
-		},
-		authorizationServer: {
-			issuer,
-			authorization_endpoint: authorizeUrl,
-			token_endpoint: tokenUrl,
-			response_types_supported: ["code"],
-			grant_types_supported: ["authorization_code", "refresh_token"],
-			code_challenge_methods_supported: ["S256"],
-			token_endpoint_auth_methods_supported: ["none"],
-			scopes_supported: scopes()
-		}
-	};
-};
-const sendJson = (res, status, body) => {
-	res.writeHead(status, { "Content-Type": "application/json" });
-	res.end(JSON.stringify(body));
-};
-const sendJsonRpcError = (res, status, code, message, headers = {}) => {
-	res.writeHead(status, {
-		"Content-Type": "application/json",
-		...headers
-	});
-	res.end(JSON.stringify({
-		error: {
-			code,
-			message
-		},
-		id: null,
-		jsonrpc: "2.0"
-	}));
-};
-const failRequest = (res, err) => {
-	const message = err instanceof Error ? err.message : "Internal Server Error";
-	if (!res.headersSent) {
-		sendJsonRpcError(res, 500, -32603, message);
-		return;
-	}
-	if (!res.writableEnded) res.end();
-};
-const sendUnauthorized = (res, resource) => {
-	const wwwAuthenticate = `Bearer resource_metadata="${resource}/.well-known/oauth-protected-resource", error="invalid_token", error_description="${MISSING_BEARER_MESSAGE}"`;
-	sendJsonRpcError(res, 401, -32e3, MISSING_BEARER_MESSAGE, { "WWW-Authenticate": wwwAuthenticate });
-};
-const readJsonBody = (req, maxBodyBytes) => new Promise((resolve) => {
-	const chunks = [];
-	let total = 0;
-	let settled = false;
-	const settle = (result) => {
-		if (settled) return;
-		settled = true;
-		resolve(result);
-	};
-	req.on("data", (chunk) => {
-		total += chunk.length;
-		if (total > maxBodyBytes) {
-			req.removeAllListeners("data");
-			settle({
-				ok: false,
-				status: 413,
-				rpcCode: -32600,
-				message: `Request body exceeds ${maxBodyBytes} bytes.`
-			});
-			return;
-		}
-		chunks.push(chunk);
-	});
-	req.on("end", () => {
-		const raw = Buffer.concat(chunks).toString("utf8");
-		if (!raw) {
-			settle({
-				ok: true,
-				value: void 0
-			});
-			return;
-		}
-		try {
-			settle({
-				ok: true,
-				value: JSON.parse(raw)
-			});
-		} catch {
-			settle({
-				ok: false,
-				status: 400,
-				rpcCode: -32700,
-				message: "Parse error: request body is not valid JSON."
-			});
-		}
-	});
-	req.on("error", () => settle({
-		ok: false,
-		status: 400,
-		rpcCode: -32600,
-		message: "Request body could not be read."
-	}));
-});
-const respondBodyError = (req, res, failure) => {
-	const headers = failure.status === 413 ? { Connection: "close" } : {};
-	sendJsonRpcError(res, failure.status, failure.rpcCode, failure.message, headers);
-	if (failure.status === 413) {
-		if (res.writableFinished) req.destroy();
-		else res.once("finish", () => req.destroy());
+		return await importer();
+	} catch (err) {
+		const missing = missingPeers(err);
+		if (missing.length === 0) throw err;
+		throw new Error(`The HTTP transport needs optional packages that are not installed (missing: ${missing.join(", ")}). Install them next to the server:\n  ${installCommand()}\nstdio does not need them. See docs/http-deployment.md.`, { cause: err });
 	}
 };
-const SESSION_IDLE_TIMEOUT_MS = 18e5;
-const SESSION_SWEEP_INTERVAL_MS = 6e4;
-const startHttpTransport = async (config, logger = silentLogger, options = {}) => {
-	const metadata = buildOAuthMetadata(config, logger);
-	const sessions = /* @__PURE__ */ new Map();
-	const idleTimeoutMs = options.sessionIdleTimeoutMs ?? SESSION_IDLE_TIMEOUT_MS;
-	const maxBodyBytes = options.maxBodyBytes ?? 4194304;
-	const dispatchToSession = async (req, res, sessionId, bearer) => {
-		const session = sessions.get(sessionId);
-		if (!session) return false;
-		session.auth.bearer = bearer;
-		session.lastActivityAt = Date.now();
-		const body = req.method === "POST" ? await readJsonBody(req, maxBodyBytes) : {
-			ok: true,
-			value: void 0
-		};
-		if (!body.ok) {
-			respondBodyError(req, res, body);
-			return true;
-		}
-		await session.transport.handleRequest(req, res, body.value);
-		return true;
-	};
-	const handleMcpRequest = async (req, res) => {
-		const bearer = extractBearer(req);
-		if (!bearer) {
-			sendUnauthorized(res, metadata.protectedResource.resource);
-			return;
-		}
-		const sessionId = typeof req.headers["mcp-session-id"] === "string" ? req.headers["mcp-session-id"] : void 0;
-		if (sessionId && await dispatchToSession(req, res, sessionId, bearer)) return;
-		if (req.method !== "POST") {
-			sendJsonRpcError(res, 400, -32e3, "No active session; initialize via POST first.");
-			return;
-		}
-		const body = await readJsonBody(req, maxBodyBytes);
-		if (!body.ok) {
-			respondBodyError(req, res, body);
-			return;
-		}
-		const auth = { bearer };
-		const server = createMcpServer(config, () => auth.bearer, logger);
-		const transport = new NodeStreamableHTTPServerTransport({
-			sessionIdGenerator: () => randomUUID(),
-			onsessioninitialized: (newId) => {
-				sessions.set(newId, {
-					transport,
-					auth,
-					lastActivityAt: Date.now(),
-					close: async () => {
-						await transport.close();
-						await server.close();
-					}
-				});
-			}
-		});
-		transport.onclose = () => {
-			if (transport.sessionId) sessions.delete(transport.sessionId);
-		};
-		await server.connect(transport);
-		await transport.handleRequest(req, res, body.value);
-	};
-	const staticGetRoutes = {
-		"/.well-known/oauth-protected-resource": metadata.protectedResource,
-		"/.well-known/oauth-authorization-server": metadata.authorizationServer,
-		"/healthz": {
-			status: "ok",
-			subdomain: config.subdomain
-		}
-	};
-	const requestListener = async (req, res) => {
-		try {
-			if (handleCorsPreflight(req, res, config.corsOrigins)) return;
-			applyCorsHeaders(req, res, config.corsOrigins);
-			const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
-			const staticRoute = req.method === "GET" ? staticGetRoutes[url.pathname] : void 0;
-			if (staticRoute) {
-				sendJson(res, 200, staticRoute);
-				return;
-			}
-			if (url.pathname === "/mcp") {
-				await handleMcpRequest(req, res);
-				return;
-			}
-			res.writeHead(404, { "Content-Type": "application/json" });
-			res.end(JSON.stringify({
-				error: "Not found",
-				path: url.pathname
-			}));
-		} catch (err) {
-			failRequest(res, err);
-		}
-	};
-	const httpServer = createServer((req, res) => {
-		requestListener(req, res);
-	});
-	await new Promise((resolve, reject) => {
-		httpServer.once("error", reject);
-		httpServer.listen(config.port, config.host, () => {
-			httpServer.off("error", reject);
-			resolve();
-		});
-	});
-	const addr = httpServer.address();
-	const boundPort = typeof addr === "object" && addr !== null ? addr.port : config.port;
-	logger.info("http_transport_ready", {
-		host: config.host,
-		port: boundPort
-	});
-	const sweepIdleSessions = async () => {
-		const cutoff = Date.now() - idleTimeoutMs;
-		for (const [id, session] of sessions) {
-			if (session.lastActivityAt > cutoff) continue;
-			sessions.delete(id);
-			try {
-				await session.close();
-			} catch (err) {
-				logger.warn("session_close_failed", {
-					sessionId: id,
-					error: err instanceof Error ? err.message : String(err)
-				});
-			}
-		}
-	};
-	const sweeper = setInterval(() => void sweepIdleSessions(), options.sweepIntervalMs ?? SESSION_SWEEP_INTERVAL_MS);
-	sweeper.unref();
-	return {
-		port: boundPort,
-		close: async () => {
-			clearInterval(sweeper);
-			await Promise.all([...sessions.values()].map((session) => session.close()));
-			sessions.clear();
-			httpServer.closeAllConnections();
-			await new Promise((resolve, reject) => {
-				httpServer.close((err) => err ? reject(err) : resolve());
-			});
-		}
-	};
-};
 //#endregion
 //#region src/utils/shutdown.ts
 /**
@@ -6011,6 +5753,7 @@ const main = async () => {
 		return;
 	}
 	if (config.dev) logger.warn("dev_mode_ignored_http");
+	const { startHttpTransport } = await loadHttpTransport();
 	const http = await startHttpTransport(config, logger);
 	installShutdown({
 		watchStdin: false,
@@ -6023,4 +5766,4 @@ main().catch((error) => {
 	process.exit(1);
 });
 //#endregion
-export {};
+export { configDir as a, requestedScope as c, getOAuthUrls as d, silentLogger as f, deadlineSignal as i, supportedScopes as l, zendeskGet as n, generateCodeChallenge as o, REQUEST_TIMEOUT_MS as r, generateCodeVerifier as s, createMcpServer as t, escapeHtml as u };