@kwonye/mcpx 0.1.94 → 0.1.95

package/dist/cli-mxmgxdm2.js

@@ -1,2257 +0,0 @@
-import {
-  getGatewayUrl,
-  persistSyncState,
-  syncAllClients
-} from "./cli-n8vt375e.js";
-import {
-  loadConfig,
-  loadMergedConfig,
-  saveConfig
-} from "./cli-csfsg1yf.js";
-import {
-  SecretsManager,
-  UpstreamError,
-  classifyUpstreamError,
-  ensureGatewayToken
-} from "./cli-tk8bggg5.js";
-import {
-  ensureDir,
-  ensureParentDir,
-  getLogPath,
-  getPidPath,
-  getStagedVersionPath,
-  getUpdateLockPath,
-  getUpdatesDir
-} from "./cli-zjepj3sj.js";
-import {
-  isServerEnabled
-} from "./cli-s4gspqdf.js";
-
-// src/core/auth-probe.ts
-var JSON_RPC_VERSION = "2.0";
-var DEFAULT_AUTH_PROBE_TIMEOUT_MS = 8000;
-var AUTH_KEYWORDS = [
-  "unauthorized",
-  "unauthenticated",
-  "forbidden",
-  "authentication",
-  "authorization",
-  "api key",
-  "api_key",
-  "apikey",
-  "credentials",
-  "access denied",
-  "auth required",
-  "x-api-key",
-  "invalid key",
-  "missing header",
-  "not authenticated",
-  "auth token"
-];
-function isAuthRelatedMessage(message) {
-  const lower = message.toLowerCase();
-  return AUTH_KEYWORDS.some((kw) => lower.includes(kw));
-}
-function resolveHeaders(spec, secrets) {
-  const headers = {
-    "content-type": "application/json",
-    accept: "application/json, text/event-stream"
-  };
-  for (const [key, value] of Object.entries(spec.headers ?? {})) {
-    headers[key] = secrets.resolveMaybeSecret(value);
-  }
-  return headers;
-}
-function isOAuthLikelyChallenge(wwwAuthenticate) {
-  if (!wwwAuthenticate) {
-    return false;
-  }
-  const lower = wwwAuthenticate.toLowerCase();
-  return lower.includes("bearer") || lower.includes("authorization_uri") || lower.includes("resource_metadata");
-}
-async function probeHttpAuthRequirement(spec, secrets, timeoutMs = DEFAULT_AUTH_PROBE_TIMEOUT_MS) {
-  const timeoutController = new AbortController;
-  const timeoutHandle = setTimeout(() => timeoutController.abort(), timeoutMs);
-  try {
-    const headers = resolveHeaders(spec, secrets);
-    const response = await fetch(spec.url, {
-      method: "POST",
-      headers,
-      body: JSON.stringify({
-        jsonrpc: JSON_RPC_VERSION,
-        id: "mcpx-auth-probe",
-        method: "tools/list",
-        params: {}
-      }),
-      signal: timeoutController.signal
-    });
-    if (response.status === 401 || response.status === 403) {
-      const wwwAuthenticate = response.headers.get("www-authenticate");
-      return {
-        authRequired: true,
-        oauthLikely: isOAuthLikelyChallenge(wwwAuthenticate),
-        status: response.status,
-        wwwAuthenticate: wwwAuthenticate ?? undefined
-      };
-    }
-    if (response.status === 200) {
-      try {
-        const body = await response.json();
-        const err = body?.error;
-        if (err && typeof err === "object" && !("result" in body)) {
-          const message = typeof err.message === "string" ? err.message : "";
-          if (message && isAuthRelatedMessage(message)) {
-            return {
-              authRequired: true,
-              status: response.status,
-              error: `JSON-RPC error: ${message}`
-            };
-          }
-        }
-      } catch {}
-    }
-    return {
-      authRequired: false,
-      status: response.status
-    };
-  } catch (error) {
-    const isAbort = error.name === "AbortError";
-    return {
-      authRequired: false,
-      error: isAbort ? `Auth probe timed out after ${timeoutMs}ms.` : error.message
-    };
-  } finally {
-    clearTimeout(timeoutHandle);
-  }
-}
-
-// src/core/registry-client.ts
-var REGISTRY_BASE = "https://registry.modelcontextprotocol.io";
-async function fetchRegistryServerDetail(name) {
-  const encoded = encodeURIComponent(name);
-  const response = await fetch(`${REGISTRY_BASE}/v0.1/servers/${encoded}/versions/latest`, {
-    headers: { accept: "application/json" }
-  });
-  if (!response.ok) {
-    throw new Error(`Registry API error: ${response.status}`);
-  }
-  const data = await response.json();
-  return data.server;
-}
-var PACKAGE_PRIORITY = {
-  npm: 1,
-  pypi: 2,
-  nuget: 3,
-  oci: 4,
-  mcpb: 5
-};
-var RUNTIME_HINT = {
-  npm: "npx",
-  pypi: "uvx",
-  nuget: "dnx"
-};
-function selectBestPackage(packages = [], remotes = []) {
-  const stdioPkgs = packages.filter((p) => p.transport.type === "stdio").sort((a, b) => (PACKAGE_PRIORITY[a.registryType] ?? 99) - (PACKAGE_PRIORITY[b.registryType] ?? 99));
-  if (stdioPkgs.length > 0) {
-    return { kind: "package", package: stdioPkgs[0] };
-  }
-  const httpRemotes = remotes.filter((r) => r.type === "streamable-http" || r.type === "sse");
-  if (httpRemotes.length > 0) {
-    return { kind: "remote", remote: httpRemotes[0] };
-  }
-  if (packages.length > 0) {
-    return { kind: "package", package: packages[0] };
-  }
-  if (remotes.length > 0) {
-    return { kind: "remote", remote: remotes[0] };
-  }
-  throw new Error("Server has no packages or remotes");
-}
-function extractRequiredInputs(option) {
-  const inputs = [];
-  if (option.kind === "package" && option.package?.environmentVariables) {
-    for (const env of option.package.environmentVariables) {
-      if (env.isRequired && !env.default) {
-        inputs.push({
-          name: env.name,
-          description: env.description,
-          isSecret: env.isSecret ?? false,
-          kind: "env"
-        });
-      }
-    }
-    for (const arg of option.package.packageArguments ?? []) {
-      if (arg.isRequired && !arg.value && !arg.default) {
-        inputs.push({
-          name: arg.name ?? arg.valueHint ?? "arg",
-          description: arg.description,
-          isSecret: false,
-          kind: "arg"
-        });
-      }
-    }
-  }
-  if (option.kind === "remote" && option.remote?.headers) {
-    for (const header of option.remote.headers) {
-      if (header.isRequired && !header.default) {
-        inputs.push({
-          name: header.name,
-          description: header.description,
-          isSecret: header.isSecret ?? false,
-          kind: "header"
-        });
-      }
-    }
-  }
-  return inputs;
-}
-function mapRegistryToSpec(_name, option, resolvedValues) {
-  if (option.kind === "remote") {
-    const headers = {};
-    for (const header of option.remote?.headers ?? []) {
-      const value = resolvedValues[header.name] ?? header.default;
-      if (value)
-        headers[header.name] = value;
-    }
-    return {
-      transport: "http",
-      url: option.remote.url,
-      ...Object.keys(headers).length > 0 ? { headers } : {}
-    };
-  }
-  const pkg = option.package;
-  const runtime = pkg.runtimeHint ?? RUNTIME_HINT[pkg.registryType] ?? "npx";
-  const args = [];
-  const identifier = pkg.version ? `${pkg.identifier}@${pkg.version}` : pkg.identifier;
-  args.push(identifier);
-  for (const arg of pkg.packageArguments ?? []) {
-    const value = arg.value ?? resolvedValues[arg.name ?? arg.valueHint ?? ""] ?? arg.default;
-    if (!value)
-      continue;
-    if (arg.type === "named" && arg.name) {
-      args.push(arg.name, value);
-    } else {
-      args.push(value);
-    }
-  }
-  const env = {};
-  for (const envVar of pkg.environmentVariables ?? []) {
-    const value = resolvedValues[envVar.name] ?? envVar.default;
-    if (value)
-      env[envVar.name] = value;
-  }
-  return {
-    transport: "stdio",
-    command: runtime,
-    args,
-    ...Object.keys(env).length > 0 ? { env } : {}
-  };
-}
-
-// src/core/server-auth.ts
-function normalizeNamePart(value) {
-  return value.trim().toLowerCase().replace(/[^a-z0-9._-]+/g, "_").replace(/^_+|_+$/g, "") || "value";
-}
-function requireNonEmpty(value, label) {
-  const normalized = value?.trim();
-  if (!normalized) {
-    throw new Error(`${label} must be non-empty.`);
-  }
-  return normalized;
-}
-function toSecretRef(secretName) {
-  return `secret://${secretName}`;
-}
-function secretRefName(ref) {
-  if (!ref.startsWith("secret://")) {
-    return null;
-  }
-  const name = ref.slice("secret://".length).trim();
-  return name.length > 0 ? name : null;
-}
-function defaultAuthSecretName(serverName, target) {
-  return `auth_${normalizeNamePart(serverName)}_${target.kind}_${normalizeNamePart(target.key)}`;
-}
-function resolveAuthTarget(spec, header, env) {
-  if (spec.transport === "http") {
-    if (env) {
-      throw new Error("--env is only valid for stdio upstreams.");
-    }
-    return {
-      kind: "header",
-      key: requireNonEmpty(header ?? "Authorization", "Header name")
-    };
-  }
-  if (header) {
-    throw new Error("--header is only valid for HTTP upstreams.");
-  }
-  return {
-    kind: "env",
-    key: requireNonEmpty(env, "Env var name")
-  };
-}
-function applyAuthReference(spec, target, secretRef) {
-  if (target.kind === "header") {
-    if (spec.transport !== "http") {
-      throw new Error(`Cannot set header auth on ${spec.transport} upstream.`);
-    }
-    const headers = { ...spec.headers ?? {} };
-    headers[target.key] = secretRef;
-    spec.headers = headers;
-    return;
-  }
-  if (spec.transport !== "stdio") {
-    throw new Error(`Cannot set env auth on ${spec.transport} upstream.`);
-  }
-  const env = { ...spec.env ?? {} };
-  env[target.key] = secretRef;
-  spec.env = env;
-}
-function removeAuthReference(spec, target) {
-  if (target.kind === "header") {
-    if (spec.transport !== "http") {
-      throw new Error(`Cannot remove header auth from ${spec.transport} upstream.`);
-    }
-    if (!spec.headers || !(target.key in spec.headers)) {
-      return null;
-    }
-    const previous2 = spec.headers[target.key] ?? null;
-    const next2 = { ...spec.headers };
-    delete next2[target.key];
-    spec.headers = Object.keys(next2).length > 0 ? next2 : undefined;
-    return previous2;
-  }
-  if (spec.transport !== "stdio") {
-    throw new Error(`Cannot remove env auth from ${spec.transport} upstream.`);
-  }
-  if (!spec.env || !(target.key in spec.env)) {
-    return null;
-  }
-  const previous = spec.env[target.key] ?? null;
-  const next = { ...spec.env };
-  delete next[target.key];
-  spec.env = Object.keys(next).length > 0 ? next : undefined;
-  return previous;
-}
-function listAuthBindings(spec) {
-  if (spec.transport === "http") {
-    return Object.entries(spec.headers ?? {}).map(([key, value]) => ({
-      kind: "header",
-      key,
-      value
-    }));
-  }
-  return Object.entries(spec.env ?? {}).map(([key, value]) => ({
-    kind: "env",
-    key,
-    value
-  }));
-}
-var TOKEN68 = /^[A-Za-z0-9\-._~+/]+=*$/;
-function maybePrefixBearer(target, value, raw = false) {
-  if (raw || target.kind !== "header" || target.key.toLowerCase() !== "authorization") {
-    return value;
-  }
-  if (/^\S+\s+\S+/.test(value)) {
-    return value;
-  }
-  if (TOKEN68.test(value)) {
-    return `Bearer ${value}`;
-  }
-  return value;
-}
-
-// src/core/spawn-env.ts
-import os from "node:os";
-import path from "node:path";
-import fs from "node:fs";
-function existingNvmCurrentBin() {
-  const nvmDir = process.env.NVM_DIR ?? path.join(os.homedir(), ".nvm");
-  const current = path.join(nvmDir, "current", "bin");
-  return fs.existsSync(current) ? current : null;
-}
-function buildEnrichedPath(current = process.env.PATH ?? "") {
-  const candidates = [
-    ...current.split(":"),
-    "/opt/homebrew/bin",
-    "/usr/local/bin",
-    path.join(os.homedir(), ".bun", "bin"),
-    path.join(os.homedir(), ".local", "bin"),
-    existingNvmCurrentBin()
-  ].filter((entry) => Boolean(entry));
-  const seen = new Set;
-  const entries = [];
-  for (const candidate of candidates) {
-    if (!candidate || seen.has(candidate)) {
-      continue;
-    }
-    seen.add(candidate);
-    entries.push(candidate);
-  }
-  return entries.join(":");
-}
-
-// src/core/oauth.ts
-import http from "node:http";
-import crypto from "node:crypto";
-import {
-  auth,
-  discoverOAuthServerInfo,
-  refreshAuthorization
-} from "@modelcontextprotocol/sdk/client/auth.js";
-function oauthSecretName(serverName, suffix) {
-  return `oauth_${serverName.toLowerCase().replace(/[^a-z0-9._-]/g, "_")}_${suffix}`;
-}
-function readJsonSecret(secrets, name) {
-  const raw = secrets.getSecret(name);
-  if (!raw) {
-    return;
-  }
-  try {
-    return JSON.parse(raw);
-  } catch {
-    return;
-  }
-}
-function writeJsonSecret(secrets, name, value) {
-  secrets.setSecret(name, JSON.stringify(value));
-}
-function isOAuthReference(value) {
-  return value.startsWith("oauth://");
-}
-function oauthReferenceServerName(value) {
-  if (!isOAuthReference(value)) {
-    throw new Error(`Not an OAuth reference: ${value}`);
-  }
-  return decodeURIComponent(value.slice("oauth://".length));
-}
-function tokensAreExpiring(tokens) {
-  if (!tokens.tokens.expires_in) {
-    return false;
-  }
-  const expiresAt = tokens.obtainedAt + tokens.tokens.expires_in * 1000;
-  return Date.now() >= expiresAt - 60000;
-}
-
-class McpxOAuthProvider {
-  #serverName;
-  #secrets;
-  #redirectUrlValue;
-  #stateValue;
-  constructor(serverName, secrets, redirectUrl, state = crypto.randomUUID()) {
-    this.#serverName = serverName;
-    this.#secrets = secrets;
-    this.#redirectUrlValue = redirectUrl;
-    this.#stateValue = state;
-  }
-  get redirectUrl() {
-    return this.#redirectUrlValue;
-  }
-  get clientMetadata() {
-    if (!this.#redirectUrlValue) {
-      return {
-        redirect_uris: [],
-        token_endpoint_auth_method: "none",
-        grant_types: ["authorization_code", "refresh_token"],
-        response_types: ["code"],
-        client_name: "mcpx"
-      };
-    }
-    return {
-      redirect_uris: [this.#redirectUrlValue],
-      token_endpoint_auth_method: "none",
-      grant_types: ["authorization_code", "refresh_token"],
-      response_types: ["code"],
-      client_name: "mcpx"
-    };
-  }
-  state() {
-    return this.#stateValue;
-  }
-  clientInformation() {
-    return readJsonSecret(this.#secrets, oauthSecretName(this.#serverName, "client"));
-  }
-  saveClientInformation(clientInformation) {
-    writeJsonSecret(this.#secrets, oauthSecretName(this.#serverName, "client"), clientInformation);
-  }
-  tokens() {
-    return readJsonSecret(this.#secrets, oauthSecretName(this.#serverName, "tokens"))?.tokens;
-  }
-  saveTokens(tokens) {
-    writeJsonSecret(this.#secrets, oauthSecretName(this.#serverName, "tokens"), {
-      tokens,
-      obtainedAt: Date.now()
-    });
-  }
-  redirectToAuthorization(_authorizationUrl) {}
-  saveCodeVerifier(codeVerifier) {
-    this.#secrets.setSecret(oauthSecretName(this.#serverName, "verifier"), codeVerifier);
-  }
-  codeVerifier() {
-    const verifier = this.#secrets.getSecret(oauthSecretName(this.#serverName, "verifier"));
-    if (!verifier) {
-      throw new Error(`Missing OAuth code verifier for "${this.#serverName}".`);
-    }
-    return verifier;
-  }
-  saveDiscoveryState(state) {
-    writeJsonSecret(this.#secrets, oauthSecretName(this.#serverName, "discovery"), state);
-  }
-  discoveryState() {
-    return readJsonSecret(this.#secrets, oauthSecretName(this.#serverName, "discovery"));
-  }
-  invalidateCredentials(scope) {
-    const suffixes = scope === "all" ? ["client", "tokens", "verifier", "discovery"] : [scope];
-    for (const suffix of suffixes) {
-      this.#secrets.removeSecret(oauthSecretName(this.#serverName, suffix));
-    }
-  }
-}
-
-class InteractiveOAuthProvider extends McpxOAuthProvider {
-  #openUrl;
-  #cachedClientInfo;
-  #cachedCodeVerifier;
-  constructor(serverName, secrets, redirectUrl, state, openUrl) {
-    super(serverName, secrets, redirectUrl, state);
-    this.#openUrl = openUrl;
-  }
-  async redirectToAuthorization(authorizationUrl) {
-    await this.#openUrl(authorizationUrl.toString());
-  }
-  clientInformation() {
-    this.#cachedClientInfo ??= super.clientInformation();
-    return this.#cachedClientInfo;
-  }
-  saveClientInformation(clientInformation) {
-    super.saveClientInformation(clientInformation);
-    this.#cachedClientInfo = clientInformation;
-  }
-  codeVerifier() {
-    if (this.#cachedCodeVerifier !== undefined) {
-      return this.#cachedCodeVerifier;
-    }
-    return super.codeVerifier();
-  }
-  saveCodeVerifier(codeVerifier) {
-    super.saveCodeVerifier(codeVerifier);
-    this.#cachedCodeVerifier = codeVerifier;
-  }
-  invalidateCredentials(scope) {
-    super.invalidateCredentials(scope);
-    if (scope === "all" || scope === "client") {
-      this.#cachedClientInfo = undefined;
-    }
-  }
-}
-function listen(server) {
-  return new Promise((resolve, reject) => {
-    server.once("error", reject);
-    server.listen(0, "127.0.0.1", () => {
-      const address = server.address();
-      if (!address || typeof address === "string") {
-        reject(new Error("Failed to start OAuth callback server."));
-        return;
-      }
-      resolve(address.port);
-    });
-  });
-}
-function closeServer(server) {
-  return new Promise((resolve) => {
-    server.close(() => resolve());
-  });
-}
-function waitForAuthorizationCode(server, expectedState, timeoutMs = 120000) {
-  return new Promise((resolve, reject) => {
-    const timeout = setTimeout(() => {
-      reject(new Error(`OAuth login timed out after ${timeoutMs}ms.`));
-    }, timeoutMs);
-    server.on("request", (request, response) => {
-      const url = new URL(request.url ?? "/", "http://127.0.0.1");
-      const code = url.searchParams.get("code");
-      const state = url.searchParams.get("state");
-      const error = url.searchParams.get("error");
-      response.setHeader("content-type", "text/html; charset=utf-8");
-      if (error) {
-        response.statusCode = 400;
-        response.end("<html><body><h1>mcpx OAuth failed</h1><p>You can close this window.</p></body></html>");
-        clearTimeout(timeout);
-        reject(new Error(`OAuth authorization failed: ${error}`));
-        return;
-      }
-      if (!code) {
-        response.statusCode = 400;
-        response.end("<html><body><h1>Missing OAuth code</h1><p>You can close this window.</p></body></html>");
-        return;
-      }
-      if (state !== expectedState) {
-        response.statusCode = 400;
-        response.end("<html><body><h1>OAuth state mismatch</h1><p>You can close this window.</p></body></html>");
-        clearTimeout(timeout);
-        reject(new Error("OAuth state mismatch."));
-        return;
-      }
-      response.end("<html><body><h1>mcpx OAuth complete</h1><p>You can close this window.</p></body></html>");
-      clearTimeout(timeout);
-      resolve(code);
-    });
-  });
-}
-function bindOAuthReference(config, serverName) {
-  const spec = config.servers[serverName];
-  if (!spec) {
-    throw new Error(`Server "${serverName}" not found.`);
-  }
-  if (spec.transport !== "http") {
-    throw new Error(`OAuth login only supports HTTP servers.`);
-  }
-  spec.headers = {
-    ...spec.headers ?? {},
-    Authorization: `oauth://${encodeURIComponent(serverName)}`
-  };
-}
-async function runOAuthLogin(serverName, spec, secrets, openUrl, configPath, codeReceiver) {
-  const oauthName = oauthSecretName(serverName, "tokens");
-  const clientName = oauthSecretName(serverName, "client");
-  const backupTokens = secrets.getSecret(oauthName);
-  const backupClient = secrets.getSecret(clientName);
-  new McpxOAuthProvider(serverName, secrets).invalidateCredentials("verifier");
-  new McpxOAuthProvider(serverName, secrets).invalidateCredentials("discovery");
-  const state = crypto.randomUUID();
-  let callbackServer;
-  let redirectUrl;
-  let codePromise;
-  if (codeReceiver) {
-    redirectUrl = codeReceiver.redirectUrl;
-    codePromise = codeReceiver.waitForCode(state);
-  } else {
-    callbackServer = http.createServer();
-    const port = await listen(callbackServer);
-    redirectUrl = `http://127.0.0.1:${port}/callback`;
-    codePromise = waitForAuthorizationCode(callbackServer, state);
-  }
-  const provider = new InteractiveOAuthProvider(serverName, secrets, redirectUrl, state, openUrl);
-  try {
-    const initial = await auth(provider, {
-      serverUrl: spec.url
-    });
-    if (initial !== "REDIRECT") {
-      throw new Error(`Expected OAuth redirect for "${serverName}", got ${initial}.`);
-    }
-    const authorizationCode = await codePromise;
-    const result = await auth(provider, {
-      serverUrl: spec.url,
-      authorizationCode
-    });
-    if (result !== "AUTHORIZED") {
-      throw new Error(`OAuth login did not authorize "${serverName}".`);
-    }
-    const config = loadConfig(configPath);
-    bindOAuthReference(config, serverName);
-    saveConfig(config, configPath);
-    const summary = syncAllClients(config, secrets);
-    persistSyncState(summary, config);
-    saveConfig(config, configPath);
-    return { serverName, authorized: true };
-  } catch (error) {
-    if (backupTokens)
-      secrets.setSecret(oauthName, backupTokens);
-    if (backupClient)
-      secrets.setSecret(clientName, backupClient);
-    throw error;
-  } finally {
-    if (callbackServer) {
-      await closeServer(callbackServer);
-    }
-  }
-}
-async function getOAuthAccessToken(serverName, spec, secrets, options = {}) {
-  const stored = readJsonSecret(secrets, oauthSecretName(serverName, "tokens"));
-  if (!stored) {
-    throw new UpstreamError(serverName, "auth_required", `No OAuth tokens stored for "${serverName}".`);
-  }
-  if (options.forceRefresh || tokensAreExpiring(stored)) {
-    if (!stored.tokens.refresh_token) {
-      if (!options.forceRefresh) {
-        return stored.tokens.access_token;
-      }
-      throw new UpstreamError(serverName, "auth_expired", `No refresh token for "${serverName}". Re-authentication required.`);
-    }
-    const provider = new McpxOAuthProvider(serverName, secrets);
-    const clientInformation = provider.clientInformation();
-    if (!clientInformation) {
-      throw new UpstreamError(serverName, "auth_expired", `No OAuth client info for "${serverName}". Re-authentication required.`);
-    }
-    let serverInfo;
-    try {
-      const cachedDiscovery = provider.discoveryState();
-      serverInfo = cachedDiscovery ?? await discoverOAuthServerInfo(spec.url);
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      if (/ECONNREFUSED|ENOTFOUND|EAI_AGAIN|fetch failed/i.test(message)) {
-        throw new UpstreamError(serverName, "unreachable", `OAuth discovery failed: ${message}`);
-      }
-      throw new UpstreamError(serverName, "upstream_error", `OAuth discovery failed: ${message}`);
-    }
-    try {
-      const refreshed = await refreshAuthorization(serverInfo.authorizationServerUrl, {
-        metadata: serverInfo.authorizationServerMetadata,
-        clientInformation,
-        refreshToken: stored.tokens.refresh_token,
-        resource: serverInfo.resourceMetadata?.resource ? new URL(serverInfo.resourceMetadata.resource) : undefined
-      });
-      provider.saveTokens(refreshed);
-      return refreshed.access_token;
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      if (/invalid_grant|invalid_client|4\d{2}/i.test(message)) {
-        throw new UpstreamError(serverName, "auth_expired", `OAuth refresh failed: ${message}`);
-      }
-      if (/ECONNREFUSED|ENOTFOUND|EAI_AGAIN|fetch failed/i.test(message)) {
-        throw new UpstreamError(serverName, "unreachable", `OAuth refresh failed: ${message}`);
-      }
-      throw new UpstreamError(serverName, "upstream_error", `OAuth refresh failed: ${message}`);
-    }
-  }
-  return stored.tokens.access_token;
-}
-
-// src/version.ts
-var APP_VERSION = "0.1.94";
-
-// src/core/update.ts
-import fs2 from "node:fs";
-import path2 from "node:path";
-import { execFileSync } from "node:child_process";
-function compareVersions(a, b) {
-  const partsA = a.split(".").map(Number);
-  const partsB = b.split(".").map(Number);
-  for (let i = 0;i < 3; i += 1) {
-    const numA = partsA[i] ?? 0;
-    const numB = partsB[i] ?? 0;
-    if (numA > numB)
-      return 1;
-    if (numA < numB)
-      return -1;
-  }
-  return 0;
-}
-async function checkForUpdates() {
-  try {
-    const output = execFileSync("npm", ["view", "@kwonye/mcpx", "version"], {
-      encoding: "utf8",
-      stdio: ["pipe", "pipe", "pipe"]
-    }).trim();
-    const latestVersion = output;
-    const updateAvailable = compareVersions(latestVersion, APP_VERSION) > 0;
-    return {
-      currentVersion: APP_VERSION,
-      latestVersion,
-      updateAvailable
-    };
-  } catch (error) {
-    return {
-      currentVersion: APP_VERSION,
-      latestVersion: null,
-      updateAvailable: false,
-      error: error instanceof Error ? error.message : String(error)
-    };
-  }
-}
-function getStagedUpdate() {
-  const stagedPath = getStagedVersionPath();
-  if (!fs2.existsSync(stagedPath)) {
-    return null;
-  }
-  try {
-    const raw = fs2.readFileSync(stagedPath, "utf8");
-    const info = JSON.parse(raw);
-    if (!info.version || !info.cliPath) {
-      return null;
-    }
-    const absoluteCliPath = path2.isAbsolute(info.cliPath) ? info.cliPath : path2.join(getUpdatesDir(), info.cliPath);
-    if (!fs2.existsSync(absoluteCliPath)) {
-      return null;
-    }
-    return {
-      ...info,
-      cliPath: absoluteCliPath
-    };
-  } catch {
-    return null;
-  }
-}
-function stageUpdate(version, cliPath) {
-  const updatesDir = getUpdatesDir();
-  ensureDir(updatesDir);
-  const stagedInfo = {
-    version,
-    cliPath: path2.isAbsolute(cliPath) ? path2.relative(updatesDir, cliPath) : cliPath,
-    stagedAt: new Date().toISOString()
-  };
-  fs2.writeFileSync(getStagedVersionPath(), JSON.stringify(stagedInfo, null, 2), "utf8");
-}
-function shouldUseStagedCli(stagedVersion, currentVersion) {
-  return compareVersions(stagedVersion, currentVersion) > 0;
-}
-function clearStagedUpdate() {
-  const stagedPath = getStagedVersionPath();
-  if (fs2.existsSync(stagedPath)) {
-    fs2.unlinkSync(stagedPath);
-  }
-}
-function getStagedCliPath() {
-  const staged = getStagedUpdate();
-  return staged?.cliPath ?? null;
-}
-function removeOldVersions(keepCount = 2) {
-  const updatesDir = getUpdatesDir();
-  if (!fs2.existsSync(updatesDir)) {
-    return;
-  }
-  const entries = fs2.readdirSync(updatesDir, { withFileTypes: true });
-  const versionDirs = entries.filter((entry) => entry.isDirectory() && entry.name.startsWith("v")).map((entry) => entry.name).sort((a, b) => compareVersions(b.slice(1), a.slice(1)));
-  if (versionDirs.length <= keepCount) {
-    return;
-  }
-  for (const oldVersion of versionDirs.slice(keepCount)) {
-    const oldPath = path2.join(updatesDir, oldVersion);
-    try {
-      fs2.rmSync(oldPath, { recursive: true, force: true });
-    } catch {}
-  }
-}
-
-// src/core/update-manager.ts
-import fs3 from "node:fs";
-import path3 from "node:path";
-import { execSync, spawn } from "node:child_process";
-function acquireLock() {
-  const lockPath = getUpdateLockPath();
-  try {
-    ensureDir(path3.dirname(lockPath));
-    fs3.writeFileSync(lockPath, `${process.pid}
-`, { flag: "wx" });
-    return true;
-  } catch {
-    return false;
-  }
-}
-function releaseLock() {
-  const lockPath = getUpdateLockPath();
-  try {
-    fs3.unlinkSync(lockPath);
-  } catch {}
-}
-function isUpdateInProgress() {
-  const lockPath = getUpdateLockPath();
-  if (!fs3.existsSync(lockPath)) {
-    return false;
-  }
-  try {
-    const raw = fs3.readFileSync(lockPath, "utf8").trim();
-    const pid = Number(raw);
-    if (!Number.isFinite(pid) || pid <= 0) {
-      fs3.unlinkSync(lockPath);
-      return false;
-    }
-    process.kill(pid, 0);
-    return true;
-  } catch {
-    fs3.unlinkSync(lockPath);
-    return false;
-  }
-}
-async function downloadAndStageUpdate() {
-  const updateStatus = await checkForUpdates();
-  if (!updateStatus.latestVersion || !updateStatus.updateAvailable) {
-    return { success: false, error: "No update available" };
-  }
-  const targetVersion = updateStatus.latestVersion;
-  const updatesDir = getUpdatesDir();
-  const versionDir = path3.join(updatesDir, `v${targetVersion}`);
-  if (fs3.existsSync(versionDir)) {
-    const existingStaged = getStagedUpdate();
-    if (existingStaged?.version === targetVersion) {
-      return { success: false, error: `Version ${targetVersion} already staged` };
-    }
-  }
-  try {
-    ensureDir(versionDir);
-    execSync(`npm pack @kwonye/mcpx@${targetVersion} --json`, {
-      cwd: versionDir,
-      stdio: ["pipe", "pipe", "pipe"]
-    });
-    const tarballPath = path3.join(versionDir, `kwonye-mcpx-${targetVersion}.tgz`);
-    if (!fs3.existsSync(tarballPath)) {
-      throw new Error("Downloaded tarball not found");
-    }
-    execSync(`tar -xzf ${tarballPath} --strip-components=1`, {
-      cwd: versionDir,
-      stdio: ["pipe", "pipe", "pipe"]
-    });
-    execSync("npm install --production --ignore-scripts", {
-      cwd: versionDir,
-      stdio: ["pipe", "pipe", "pipe"]
-    });
-    const cliPath = path3.join(versionDir, "dist", "cli.js");
-    if (!fs3.existsSync(cliPath)) {
-      throw new Error("CLI entry point not found in downloaded package");
-    }
-    stageUpdate(targetVersion, cliPath);
-    removeOldVersions(2);
-    return { success: true, version: targetVersion };
-  } catch (error) {
-    try {
-      fs3.rmSync(versionDir, { recursive: true, force: true });
-    } catch {}
-    return {
-      success: false,
-      error: error instanceof Error ? error.message : String(error)
-    };
-  }
-}
-function startBackgroundUpdateCheck() {
-  if (isUpdateInProgress()) {
-    return;
-  }
-  if (!acquireLock()) {
-    return;
-  }
-  const child = spawn(process.execPath, [
-    process.argv[1] ?? "",
-    "update",
-    "--background"
-  ], {
-    detached: true,
-    stdio: ["ignore", "ignore", "ignore"],
-    env: {
-      ...process.env,
-      MCPX_UPDATE_CHILD: "1"
-    }
-  });
-  child.unref();
-  setTimeout(() => {
-    releaseLock();
-  }, 60000);
-}
-async function runBackgroundUpdate() {
-  try {
-    const result = await downloadAndStageUpdate();
-    if (result.success && result.version) {
-      console.error(`[update-manager] Update staged: v${result.version}. Will activate on next run.`);
-    } else if (result.error && result.error !== "No update available") {
-      console.error(`[update-manager] Update check failed: ${result.error}`);
-    }
-  } catch (error) {
-    console.error(`[update-manager] Background update failed: ${error instanceof Error ? error.message : String(error)}`);
-  } finally {
-    releaseLock();
-  }
-}
-async function performUpdate() {
-  if (isUpdateInProgress()) {
-    return { success: false, message: "Another update is already in progress." };
-  }
-  const result = await downloadAndStageUpdate();
-  if (result.success && result.version) {
-    return {
-      success: true,
-      message: `Update to v${result.version} ready! Will activate on next run.`
-    };
-  }
-  if (result.error === "No update available") {
-    return { success: true, message: "Already on latest version." };
-  }
-  return {
-    success: false,
-    message: result.error ?? "Update failed"
-  };
-}
-function performRollback() {
-  const currentStaged = getStagedUpdate();
-  if (!currentStaged) {
-    return { success: false, message: "No staged update to roll back." };
-  }
-  clearStagedUpdate();
-  return {
-    success: true,
-    message: `Rolled back from v${currentStaged.version}. Using installed version.`
-  };
-}
-
-// src/core/daemon.ts
-import fs4 from "node:fs";
-import net from "node:net";
-import { spawn as spawn2, execFileSync as execFileSync2 } from "node:child_process";
-
-// src/gateway/server.ts
-import http2 from "node:http";
-import { URL as URL2 } from "node:url";
-import crypto2 from "node:crypto";
-import { Client } from "@modelcontextprotocol/sdk/client/index.js";
-import {
-  StdioClientTransport,
-  getDefaultEnvironment
-} from "@modelcontextprotocol/sdk/client/stdio.js";
-import { StreamableHTTPClientTransport, StreamableHTTPError } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
-var SERVER_VERSION = APP_VERSION;
-var DEFAULT_UPSTREAM_TIMEOUT_MS = 60000;
-var DEFAULT_CONNECT_TIMEOUT_MS = 1e4;
-var OAUTH_WELL_KNOWN_PREFIXES = [
-  "/.well-known/oauth-protected-resource",
-  "/.well-known/oauth-authorization-server",
-  "/.well-known/openid-configuration"
-];
-function makeError(id, code, message, data) {
-  return {
-    jsonrpc: "2.0",
-    id,
-    error: {
-      code,
-      message,
-      data
-    }
-  };
-}
-function makeResult(id, result) {
-  return {
-    jsonrpc: "2.0",
-    id,
-    result
-  };
-}
-function listUpstreams(config, upstreamFilter) {
-  const all = Object.entries(config.servers).filter(([, spec]) => isServerEnabled(spec)).map(([name, spec]) => ({ name, spec }));
-  if (!upstreamFilter) {
-    return all;
-  }
-  return all.filter((upstream) => upstream.name === upstreamFilter);
-}
-function getSingleUpstream(config) {
-  const upstreams = listUpstreams(config);
-  if (upstreams.length !== 1) {
-    return null;
-  }
-  return upstreams[0] ?? null;
-}
-function getSingleHttpUpstream(config) {
-  const upstream = getSingleUpstream(config);
-  if (!upstream || upstream.spec.transport !== "http") {
-    return null;
-  }
-  return upstream;
-}
-function getScopedHttpUpstream(config, upstreamFilter) {
-  if (upstreamFilter) {
-    const selected = config.servers[upstreamFilter];
-    if (!selected || !isServerEnabled(selected) || selected.transport !== "http") {
-      return null;
-    }
-    return {
-      name: upstreamFilter,
-      spec: selected
-    };
-  }
-  return getSingleHttpUpstream(config);
-}
-function getWellKnownPrefix(pathname) {
-  for (const prefix of OAUTH_WELL_KNOWN_PREFIXES) {
-    if (pathname === prefix || pathname.startsWith(`${prefix}/`)) {
-      return prefix;
-    }
-  }
-  return null;
-}
-function getUpstreamPathSuffixForWellKnown(upstream) {
-  const upstreamUrl = new URL2(upstream.spec.url);
-  if (upstreamUrl.pathname === "/") {
-    return "";
-  }
-  return upstreamUrl.pathname.endsWith("/") ? upstreamUrl.pathname.slice(0, -1) : upstreamUrl.pathname;
-}
-function buildWellKnownUpstreamUrl(upstream, prefix) {
-  const upstreamUrl = new URL2(upstream.spec.url);
-  const suffix = getUpstreamPathSuffixForWellKnown(upstream);
-  return new URL2(`${prefix}${suffix}`, upstreamUrl.origin);
-}
-function getLocalOriginFromRequest(request) {
-  return `http://${request.headers.host ?? "127.0.0.1"}`;
-}
-function getRequestedUpstream(requestUrl) {
-  const value = requestUrl.searchParams.get("upstream");
-  if (!value) {
-    return;
-  }
-  return value.trim() || undefined;
-}
-function appendUpstreamQuery(url, upstream) {
-  if (!upstream) {
-    return url;
-  }
-  const parsed = new URL2(url);
-  parsed.searchParams.set("upstream", upstream);
-  return parsed.toString();
-}
-function rewriteWwwAuthenticateResourceMetadata(headerValue, localResourceMetadataUrl) {
-  if (headerValue.includes("resource_metadata=")) {
-    return headerValue.replace(/resource_metadata="[^"]*"/, `resource_metadata="${localResourceMetadataUrl}"`);
-  }
-  return `${headerValue}, resource_metadata="${localResourceMetadataUrl}"`;
-}
-function isOAuthCapableServer(spec) {
-  if (spec.transport !== "http") {
-    return false;
-  }
-  const headers = spec.headers ?? {};
-  for (const headerName of Object.keys(headers)) {
-    if (headerName.toLowerCase() === "authorization") {
-      return true;
-    }
-  }
-  return false;
-}
-function splitNamespacedName(value) {
-  const split = value.indexOf(".");
-  if (split <= 0 || split >= value.length - 1) {
-    return null;
-  }
-  return {
-    serverName: value.slice(0, split),
-    upstreamName: value.slice(split + 1)
-  };
-}
-function parseNamespacedUri(uri) {
-  if (uri.startsWith("mcpx://")) {
-    const rest = uri.slice("mcpx://".length);
-    const slashIndex = rest.indexOf("/");
-    if (slashIndex <= 0 || slashIndex >= rest.length - 1) {
-      return null;
-    }
-    const serverName = rest.slice(0, slashIndex);
-    const encoded = rest.slice(slashIndex + 1);
-    try {
-      return {
-        serverName,
-        upstreamUri: decodeURIComponent(encoded)
-      };
-    } catch {
-      return null;
-    }
-  }
-  const nameSplit = splitNamespacedName(uri);
-  if (!nameSplit) {
-    return null;
-  }
-  return {
-    serverName: nameSplit.serverName,
-    upstreamUri: nameSplit.upstreamName
-  };
-}
-async function callUpstream(upstream, method, params, id, secrets, runtime, passthroughAuthorizationHeader) {
-  return callUpstreamOnce(upstream, method, params, secrets, runtime, passthroughAuthorizationHeader, false);
-}
-async function getUpstreamTokenCounts(config, secrets, runtime) {
-  if (!runtime.tokenCache) {
-    runtime.tokenCache = new Map;
-  }
-  const results = {};
-  const upstreams = listUpstreams(config);
-  for (const upstream of upstreams) {
-    const fingerprint = specFingerprint(upstream.spec);
-    const cached = runtime.tokenCache.get(upstream.name);
-    if (cached?.fingerprint === fingerprint) {
-      const runtimeErr2 = runtime.upstreamErrors?.get(upstream.name);
-      results[upstream.name] = runtimeErr2 ? { ...cached.count, runtimeError: runtimeErr2.message, runtimeErrorCode: runtimeErr2.code } : cached.count;
-      continue;
-    }
-    let toolsCount = 0;
-    let resourcesCount = 0;
-    let promptsCount = 0;
-    const errors = [];
-    try {
-      const toolsResult = await callUpstream(upstream, "tools/list", {}, "token-tools", secrets, runtime);
-      if (toolsResult && toolsResult.tools) {
-        toolsCount = Math.ceil(JSON.stringify(toolsResult.tools).length / 4);
-      }
-    } catch (error) {
-      errors.push(`tools/list: ${error instanceof Error ? error.message : String(error)}`);
-    }
-    try {
-      const resourcesResult = await callUpstream(upstream, "resources/list", {}, "token-resources", secrets, runtime);
-      if (resourcesResult && resourcesResult.resources) {
-        resourcesCount = Math.ceil(JSON.stringify(resourcesResult.resources).length / 4);
-      }
-    } catch (error) {
-      errors.push(`resources/list: ${error instanceof Error ? error.message : String(error)}`);
-    }
-    try {
-      const promptsResult = await callUpstream(upstream, "prompts/list", {}, "token-prompts", secrets, runtime);
-      if (promptsResult && promptsResult.prompts) {
-        promptsCount = Math.ceil(JSON.stringify(promptsResult.prompts).length / 4);
-      }
-    } catch (error) {
-      errors.push(`prompts/list: ${error instanceof Error ? error.message : String(error)}`);
-    }
-    const total = toolsCount + resourcesCount + promptsCount;
-    const countObj = {
-      tools: toolsCount,
-      resources: resourcesCount,
-      prompts: promptsCount,
-      total,
-      error: errors.length > 0 ? errors.join("; ") : undefined
-    };
-    if (errors.length === 0) {
-      runtime.tokenCache.set(upstream.name, { fingerprint, count: countObj });
-    }
-    const runtimeErr = runtime.upstreamErrors?.get(upstream.name);
-    results[upstream.name] = runtimeErr ? { ...countObj, runtimeError: runtimeErr.message, runtimeErrorCode: runtimeErr.code } : countObj;
-  }
-  return results;
-}
-function getConfiguredTimeoutMs() {
-  const configuredTimeout = Number(process.env.MCPX_UPSTREAM_TIMEOUT_MS ?? DEFAULT_UPSTREAM_TIMEOUT_MS);
-  return Number.isFinite(configuredTimeout) && configuredTimeout > 0 ? configuredTimeout : DEFAULT_UPSTREAM_TIMEOUT_MS;
-}
-function withTimeout(work, timeoutMs, timeoutMessage) {
-  return new Promise((resolve, reject) => {
-    const timer = setTimeout(() => reject(new Error(timeoutMessage)), timeoutMs);
-    work.then((value) => {
-      clearTimeout(timer);
-      resolve(value);
-    }, (error) => {
-      clearTimeout(timer);
-      reject(error);
-    });
-  });
-}
-function specFingerprint(spec) {
-  return JSON.stringify(spec);
-}
-function resolveStdioEnv(spec, secrets) {
-  const env = getDefaultEnvironment();
-  env.PATH = buildEnrichedPath(env.PATH);
-  for (const [key, value] of Object.entries(spec.env ?? {})) {
-    env[key] = secrets.resolveMaybeSecret(value);
-  }
-  return env;
-}
-function buildStdioServerParameters(spec, secrets) {
-  return {
-    command: spec.command,
-    args: spec.args ?? [],
-    cwd: spec.cwd,
-    env: resolveStdioEnv(spec, secrets)
-  };
-}
-async function buildHttpHeaders(upstream, secrets, options) {
-  const headers = {};
-  for (const [key, value] of Object.entries(upstream.spec.headers ?? {})) {
-    if (key.toLowerCase() === "authorization" && isOAuthReference(value)) {
-      const oauthServerName = oauthReferenceServerName(value);
-      const accessToken = await getOAuthAccessToken(oauthServerName, upstream.spec, secrets, {
-        forceRefresh: options.forceOAuthRefresh
-      });
-      headers[key] = `Bearer ${accessToken}`;
-    } else {
-      headers[key] = secrets.resolveMaybeSecret(value);
-    }
-  }
-  if (options.passthroughAuthorizationHeader) {
-    headers.Authorization = options.passthroughAuthorizationHeader;
-  }
-  return headers;
-}
-async function closeUpstreamConnection(entry) {
-  try {
-    const connection = await entry.promise;
-    await connection.transport.close();
-  } catch {}
-}
-async function reconcileUpstreamConnections(config, runtime) {
-  const activeSpecs = new Map(Object.entries(config.servers).filter(([, spec]) => isServerEnabled(spec)).map(([name, spec]) => [name, specFingerprint(spec)]));
-  const staleKeys = [];
-  for (const [key, entry] of runtime.upstreamConnections.entries()) {
-    const upstreamName = key.includes(":") ? key.slice(0, key.indexOf(":")) : key;
-    const expectedFingerprint = activeSpecs.get(upstreamName);
-    if (!expectedFingerprint || expectedFingerprint !== entry.fingerprint) {
-      staleKeys.push(key);
-    }
-  }
-  for (const key of staleKeys) {
-    const entry = runtime.upstreamConnections.get(key);
-    if (!entry) {
-      continue;
-    }
-    runtime.upstreamConnections.delete(key);
-    await closeUpstreamConnection(entry);
-  }
-}
-function invalidateUpstreamConnection(upstreamName, passthroughAuthorizationHeader, runtime) {
-  const key = passthroughAuthorizationHeader ? `${upstreamName}:passthrough` : upstreamName;
-  const existing = runtime.upstreamConnections.get(key);
-  if (!existing) {
-    return;
-  }
-  runtime.upstreamConnections.delete(key);
-  closeUpstreamConnection(existing);
-}
-async function getUpstreamConnection(upstream, secrets, runtime, options = {}) {
-  const { forceOAuthRefresh = false, passthroughAuthorizationHeader } = options;
-  const cacheKey = passthroughAuthorizationHeader ? `${upstream.name}:passthrough` : upstream.name;
-  const fingerprint = specFingerprint(upstream.spec);
-  if (!forceOAuthRefresh) {
-    const existing = runtime.upstreamConnections.get(cacheKey);
-    if (existing) {
-      if (existing.fingerprint === fingerprint) {
-        return existing.promise;
-      }
-      runtime.upstreamConnections.delete(cacheKey);
-      closeUpstreamConnection(existing);
-    }
-  }
-  const promise = (async () => {
-    let transport;
-    if (upstream.spec.transport === "stdio") {
-      transport = new StdioClientTransport(buildStdioServerParameters(upstream.spec, secrets));
-    } else {
-      const headers = await buildHttpHeaders(upstream, secrets, { forceOAuthRefresh, passthroughAuthorizationHeader });
-      const capturingFetch = async (url, init) => {
-        const response = await fetch(url, init);
-        const wwwAuth = response.headers.get("www-authenticate");
-        if (wwwAuth) {
-          if (!runtime.lastWwwAuthenticate) {
-            runtime.lastWwwAuthenticate = new Map;
-          }
-          runtime.lastWwwAuthenticate.set(upstream.name, wwwAuth);
-        }
-        return response;
-      };
-      transport = new StreamableHTTPClientTransport(new URL2(upstream.spec.url), { requestInit: { headers }, fetch: capturingFetch });
-    }
-    const client = new Client({ name: "mcpx", version: SERVER_VERSION });
-    await withTimeout(client.connect(transport), DEFAULT_CONNECT_TIMEOUT_MS, `Upstream ${upstream.name} failed to connect within ${DEFAULT_CONNECT_TIMEOUT_MS}ms.`);
-    return { fingerprint, client, transport };
-  })();
-  runtime.upstreamConnections.set(cacheKey, { fingerprint, promise });
-  try {
-    return await promise;
-  } catch (error) {
-    runtime.upstreamConnections.delete(cacheKey);
-    throw error;
-  }
-}
-async function callUpstreamOnce(upstream, method, params, secrets, runtime, passthroughAuthorizationHeader, forceOAuthRefresh) {
-  const hasOAuth = upstream.spec.transport === "http" && Object.values(upstream.spec.headers ?? {}).some(isOAuthReference);
-  try {
-    const connection = await getUpstreamConnection(upstream, secrets, runtime, {
-      forceOAuthRefresh,
-      passthroughAuthorizationHeader
-    });
-    const timeoutMs = getConfiguredTimeoutMs();
-    const timeoutMessage = `Upstream ${upstream.name} timed out after ${timeoutMs}ms for method ${method}.`;
-    if (method === "tools/list") {
-      return withTimeout(connection.client.listTools(params), timeoutMs, timeoutMessage);
-    }
-    if (method === "resources/list") {
-      return withTimeout(connection.client.listResources(params), timeoutMs, timeoutMessage);
-    }
-    if (method === "prompts/list") {
-      return withTimeout(connection.client.listPrompts(params), timeoutMs, timeoutMessage);
-    }
-    if (method === "tools/call") {
-      return withTimeout(connection.client.callTool(params), timeoutMs, timeoutMessage);
-    }
-    if (method === "resources/read") {
-      return withTimeout(connection.client.readResource(params), timeoutMs, timeoutMessage);
-    }
-    if (method === "prompts/get") {
-      return withTimeout(connection.client.getPrompt(params), timeoutMs, timeoutMessage);
-    }
-    throw new Error(`Unsupported method: ${method}`);
-  } catch (error) {
-    invalidateUpstreamConnection(upstream.name, passthroughAuthorizationHeader, runtime);
-    if (!forceOAuthRefresh && hasOAuth && error instanceof StreamableHTTPError && (error.code === 401 || error.code === 403)) {
-      return callUpstreamOnce(upstream, method, params, secrets, runtime, passthroughAuthorizationHeader, true);
-    }
-    const wwwAuthenticate = runtime.lastWwwAuthenticate?.get(upstream.name);
-    throw classifyUpstreamError(upstream.name, error, wwwAuthenticate);
-  }
-}
-function authHeaderIsValid(request, expectedToken) {
-  const localTokenHeader = request.headers["x-mcpx-local-token"];
-  if (typeof localTokenHeader === "string" && localTokenHeader === expectedToken) {
-    return true;
-  }
-  if (Array.isArray(localTokenHeader) && localTokenHeader.includes(expectedToken)) {
-    return true;
-  }
-  const authHeader = request.headers.authorization;
-  if (!authHeader) {
-    return false;
-  }
-  const [scheme, token] = authHeader.split(" ");
-  return scheme === "Bearer" && token === expectedToken;
-}
-function isAuthChallenge(error) {
-  return error instanceof UpstreamError && (error.code === "auth_required" || error.code === "auth_expired");
-}
-function getClientAuthorizationForUpstream(request, expectedToken) {
-  const authHeader = request.headers.authorization;
-  if (!authHeader) {
-    return;
-  }
-  const [scheme, token] = authHeader.split(" ");
-  if (scheme === "Bearer" && token === expectedToken) {
-    return;
-  }
-  return authHeader;
-}
-async function handleListTools(config, secrets, runtime, upstreamFilter, clientAuthorizationHeader) {
-  const tools = [];
-  const flattenedUpstream = listUpstreams(config, upstreamFilter).length === 1;
-  const flattenNames = Boolean(flattenedUpstream);
-  const upstreams = listUpstreams(config, upstreamFilter);
-  for (const upstream of upstreams) {
-    try {
-      const result = await callUpstream(upstream, "tools/list", {}, `list-tools-${upstream.name}`, secrets, runtime, clientAuthorizationHeader);
-      if (!runtime.tokenCache) {
-        runtime.tokenCache = new Map;
-      }
-      const cached = runtime.tokenCache.get(upstream.name);
-      const existing = cached?.fingerprint === specFingerprint(upstream.spec) ? cached.count : { tools: 0, resources: 0, prompts: 0, total: 0 };
-      existing.tools = Math.ceil(JSON.stringify(result.tools ?? []).length / 4);
-      existing.total = existing.tools + existing.resources + existing.prompts;
-      delete existing.error;
-      runtime.tokenCache.set(upstream.name, { fingerprint: specFingerprint(upstream.spec), count: existing });
-      for (const tool of result.tools ?? []) {
-        const name = typeof tool.name === "string" ? tool.name : "tool";
-        tools.push({
-          ...tool,
-          name: flattenNames ? name : `${upstream.name}.${name}`
-        });
-      }
-    } catch (error) {
-      if (upstreams.length === 1) {
-        throw error;
-      }
-      const code = error instanceof UpstreamError ? error.code : "upstream_error";
-      runtime.upstreamErrors?.set(upstream.name, { code, message: error instanceof Error ? error.message : String(error) });
-    }
-  }
-  return { tools };
-}
-async function handleListResources(config, secrets, runtime, upstreamFilter, clientAuthorizationHeader) {
-  const resources = [];
-  const flattenedUpstream = listUpstreams(config, upstreamFilter).length === 1;
-  const flattenNames = Boolean(flattenedUpstream);
-  const upstreams = listUpstreams(config, upstreamFilter);
-  for (const upstream of upstreams) {
-    try {
-      const result = await callUpstream(upstream, "resources/list", {}, `list-resources-${upstream.name}`, secrets, runtime, clientAuthorizationHeader);
-      if (!runtime.tokenCache) {
-        runtime.tokenCache = new Map;
-      }
-      const cached = runtime.tokenCache.get(upstream.name);
-      const existing = cached?.fingerprint === specFingerprint(upstream.spec) ? cached.count : { tools: 0, resources: 0, prompts: 0, total: 0 };
-      existing.resources = Math.ceil(JSON.stringify(result.resources ?? []).length / 4);
-      existing.total = existing.tools + existing.resources + existing.prompts;
-      delete existing.error;
-      runtime.tokenCache.set(upstream.name, { fingerprint: specFingerprint(upstream.spec), count: existing });
-      for (const resource of result.resources ?? []) {
-        const originalUri = typeof resource.uri === "string" ? resource.uri : "";
-        const originalName = typeof resource.name === "string" ? resource.name : originalUri;
-        resources.push({
-          ...resource,
-          name: flattenNames ? originalName : `${upstream.name}.${originalName}`,
-          uri: flattenNames ? originalUri : `mcpx://${upstream.name}/${encodeURIComponent(originalUri)}`
-        });
-      }
-    } catch (error) {
-      if (upstreams.length === 1) {
-        throw error;
-      }
-      const code = error instanceof UpstreamError ? error.code : "upstream_error";
-      runtime.upstreamErrors?.set(upstream.name, { code, message: error instanceof Error ? error.message : String(error) });
-    }
-  }
-  return { resources };
-}
-async function handleListPrompts(config, secrets, runtime, upstreamFilter, clientAuthorizationHeader) {
-  const prompts = [];
-  const flattenedUpstream = listUpstreams(config, upstreamFilter).length === 1;
-  const flattenNames = Boolean(flattenedUpstream);
-  const upstreams = listUpstreams(config, upstreamFilter);
-  for (const upstream of upstreams) {
-    try {
-      const result = await callUpstream(upstream, "prompts/list", {}, `list-prompts-${upstream.name}`, secrets, runtime, clientAuthorizationHeader);
-      if (!runtime.tokenCache) {
-        runtime.tokenCache = new Map;
-      }
-      const cached = runtime.tokenCache.get(upstream.name);
-      const existing = cached?.fingerprint === specFingerprint(upstream.spec) ? cached.count : { tools: 0, resources: 0, prompts: 0, total: 0 };
-      existing.prompts = Math.ceil(JSON.stringify(result.prompts ?? []).length / 4);
-      existing.total = existing.tools + existing.resources + existing.prompts;
-      delete existing.error;
-      runtime.tokenCache.set(upstream.name, { fingerprint: specFingerprint(upstream.spec), count: existing });
-      for (const prompt of result.prompts ?? []) {
-        const name = typeof prompt.name === "string" ? prompt.name : "prompt";
-        prompts.push({
-          ...prompt,
-          name: flattenNames ? name : `${upstream.name}.${name}`
-        });
-      }
-    } catch (error) {
-      if (upstreams.length === 1) {
-        throw error;
-      }
-      const code = error instanceof UpstreamError ? error.code : "upstream_error";
-      runtime.upstreamErrors?.set(upstream.name, { code, message: error instanceof Error ? error.message : String(error) });
-    }
-  }
-  return { prompts };
-}
-async function routeNamespacedCall(config, method, params, id, secrets, runtime, upstreamFilter, clientAuthorizationHeader) {
-  if (!params || typeof params !== "object") {
-    return makeError(id, -32602, "Missing params object.");
-  }
-  const upstreamEntries = listUpstreams(config, upstreamFilter);
-  const upstreams = new Map(upstreamEntries.map((entry) => [entry.name, entry]));
-  const flattenedUpstream = upstreamEntries.length === 1 ? upstreamEntries[0] : null;
-  if (method === "tools/call") {
-    const toolName = typeof params.name === "string" ? params.name : "";
-    const split = splitNamespacedName(toolName);
-    if (split && upstreamFilter && split.serverName !== upstreamFilter) {
-      return makeError(id, -32602, `Tool belongs to upstream ${split.serverName}, but request is scoped to ${upstreamFilter}.`);
-    }
-    let upstream2;
-    let upstreamToolName = toolName;
-    if (split && upstreams.has(split.serverName)) {
-      upstream2 = upstreams.get(split.serverName);
-      upstreamToolName = split.upstreamName;
-    } else if (flattenedUpstream) {
-      upstream2 = flattenedUpstream;
-    }
-    if (!upstream2) {
-      return makeError(id, -32602, "Tool name must be namespaced as <server>.<tool>.");
-    }
-    const upstreamParams2 = {
-      ...params,
-      name: upstreamToolName
-    };
-    try {
-      const result = await callUpstream(upstream2, method, upstreamParams2, id, secrets, runtime, clientAuthorizationHeader);
-      runtime.upstreamErrors?.delete(upstream2.name);
-      return makeResult(id, result);
-    } catch (error) {
-      if (isAuthChallenge(error)) {
-        throw error;
-      }
-      const errCode = error instanceof UpstreamError ? error.code : "upstream_error";
-      runtime.upstreamErrors?.set(upstream2.name, { code: errCode, message: error.message });
-      return makeError(id, -32000, error.message, { mcpxCode: errCode, upstream: upstream2.name });
-    }
-  }
-  if (method === "prompts/get") {
-    const promptName = typeof params.name === "string" ? params.name : "";
-    const split = splitNamespacedName(promptName);
-    if (split && upstreamFilter && split.serverName !== upstreamFilter) {
-      return makeError(id, -32602, `Prompt belongs to upstream ${split.serverName}, but request is scoped to ${upstreamFilter}.`);
-    }
-    let upstream2;
-    let upstreamPromptName = promptName;
-    if (split && upstreams.has(split.serverName)) {
-      upstream2 = upstreams.get(split.serverName);
-      upstreamPromptName = split.upstreamName;
-    } else if (flattenedUpstream) {
-      upstream2 = flattenedUpstream;
-    }
-    if (!upstream2) {
-      return makeError(id, -32602, "Prompt name must be namespaced as <server>.<prompt>.");
-    }
-    const upstreamParams2 = {
-      ...params,
-      name: upstreamPromptName
-    };
-    try {
-      const result = await callUpstream(upstream2, method, upstreamParams2, id, secrets, runtime, clientAuthorizationHeader);
-      runtime.upstreamErrors?.delete(upstream2.name);
-      return makeResult(id, result);
-    } catch (error) {
-      if (isAuthChallenge(error)) {
-        throw error;
-      }
-      const errCode = error instanceof UpstreamError ? error.code : "upstream_error";
-      runtime.upstreamErrors?.set(upstream2.name, { code: errCode, message: error.message });
-      return makeError(id, -32000, error.message, { mcpxCode: errCode, upstream: upstream2.name });
-    }
-  }
-  const uri = typeof params.uri === "string" ? params.uri : "";
-  const parsed = parseNamespacedUri(uri);
-  if (parsed && upstreamFilter && parsed.serverName !== upstreamFilter) {
-    return makeError(id, -32602, `Resource belongs to upstream ${parsed.serverName}, but request is scoped to ${upstreamFilter}.`);
-  }
-  let upstream;
-  let upstreamUri = uri;
-  if (parsed && upstreams.has(parsed.serverName)) {
-    upstream = upstreams.get(parsed.serverName);
-    upstreamUri = parsed.upstreamUri;
-  } else if (flattenedUpstream) {
-    upstream = flattenedUpstream;
-  }
-  if (!upstream) {
-    return makeError(id, -32602, "Resource URI must be namespaced (mcpx://<server>/<encoded-uri>).", { uri });
-  }
-  const upstreamParams = {
-    ...params,
-    uri: upstreamUri
-  };
-  try {
-    const result = await callUpstream(upstream, method, upstreamParams, id, secrets, runtime, clientAuthorizationHeader);
-    runtime.upstreamErrors?.delete(upstream.name);
-    return makeResult(id, result);
-  } catch (error) {
-    if (isAuthChallenge(error)) {
-      throw error;
-    }
-    const errCode = error instanceof UpstreamError ? error.code : "upstream_error";
-    runtime.upstreamErrors?.set(upstream.name, { code: errCode, message: error.message });
-    return makeError(id, -32000, error.message, { mcpxCode: errCode, upstream: upstream.name });
-  }
-}
-async function handleRequestObject(request, secrets, runtime, upstreamFilter, clientAuthorizationHeader) {
-  const id = request.id ?? null;
-  if (!request.method || typeof request.method !== "string") {
-    return makeError(id, -32600, "Invalid JSON-RPC request: missing method.");
-  }
-  if (request.method === "initialize") {
-    const requestedProtocol = request.params?.protocolVersion;
-    const protocolVersion = typeof requestedProtocol === "string" && requestedProtocol.length > 0 ? requestedProtocol : "2025-11-25";
-    return makeResult(id, {
-      protocolVersion,
-      capabilities: {
-        tools: {},
-        resources: {},
-        prompts: {}
-      },
-      serverInfo: {
-        name: "mcpx",
-        version: SERVER_VERSION
-      }
-    });
-  }
-  if (request.method === "notifications/initialized") {
-    return null;
-  }
-  if (request.method === "ping") {
-    return makeResult(id, { ok: true });
-  }
-  const config = loadMergedConfig();
-  if (upstreamFilter && listUpstreams(config, upstreamFilter).length === 0) {
-    return makeError(id, -32602, `Unknown upstream: ${upstreamFilter}`);
-  }
-  await reconcileUpstreamConnections(config, runtime);
-  if (request.method === "custom/tokenCounts") {
-    const result = await getUpstreamTokenCounts(config, secrets, runtime);
-    return makeResult(id, result);
-  }
-  if (request.method === "custom/refreshTokenCounts") {
-    runtime.tokenCache?.clear();
-    const result = await getUpstreamTokenCounts(config, secrets, runtime);
-    return makeResult(id, result);
-  }
-  if (request.method === "tools/list") {
-    const result = await handleListTools(config, secrets, runtime, upstreamFilter, clientAuthorizationHeader);
-    return makeResult(id, result);
-  }
-  if (request.method === "resources/list") {
-    const result = await handleListResources(config, secrets, runtime, upstreamFilter, clientAuthorizationHeader);
-    return makeResult(id, result);
-  }
-  if (request.method === "prompts/list") {
-    const result = await handleListPrompts(config, secrets, runtime, upstreamFilter, clientAuthorizationHeader);
-    return makeResult(id, result);
-  }
-  if (request.method === "tools/call" || request.method === "resources/read" || request.method === "prompts/get") {
-    return routeNamespacedCall(config, request.method, request.params, id, secrets, runtime, upstreamFilter, clientAuthorizationHeader);
-  }
-  return makeError(id, -32601, `Unsupported method: ${request.method}`);
-}
-async function maybeHandleWellKnownOAuthRequest(request, response, requestUrl, secrets) {
-  const pathname = requestUrl.pathname;
-  const wellKnownPrefix = getWellKnownPrefix(pathname);
-  if (!wellKnownPrefix) {
-    return false;
-  }
-  if (request.method !== "GET") {
-    response.statusCode = 405;
-    response.setHeader("content-type", "application/json");
-    response.end(JSON.stringify({ error: "method_not_allowed" }));
-    return true;
-  }
-  const config = loadMergedConfig();
-  const requestedUpstream = getRequestedUpstream(requestUrl);
-  const upstream = getScopedHttpUpstream(config, requestedUpstream);
-  if (!upstream) {
-    response.statusCode = 404;
-    response.setHeader("content-type", "application/json");
-    response.end(JSON.stringify({ error: "not_found" }));
-    return true;
-  }
-  if (!isOAuthCapableServer(upstream.spec)) {
-    response.statusCode = 404;
-    response.setHeader("content-type", "application/json");
-    response.end(JSON.stringify({ error: "not_found" }));
-    return true;
-  }
-  const upstreamWellKnownUrl = buildWellKnownUpstreamUrl(upstream, wellKnownPrefix);
-  const headers = {
-    accept: "application/json"
-  };
-  const protocolVersion = request.headers["mcp-protocol-version"];
-  if (typeof protocolVersion === "string" && protocolVersion.length > 0) {
-    headers["mcp-protocol-version"] = protocolVersion;
-  }
-  for (const [key, value] of Object.entries(upstream.spec.headers ?? {})) {
-    headers[key] = secrets.resolveMaybeSecret(value);
-  }
-  const upstreamResponse = await fetch(upstreamWellKnownUrl, {
-    method: "GET",
-    headers
-  });
-  let bodyText = await upstreamResponse.text();
-  response.statusCode = upstreamResponse.status;
-  const contentType = upstreamResponse.headers.get("content-type");
-  if (contentType) {
-    response.setHeader("content-type", contentType);
-  }
-  const cacheControl = upstreamResponse.headers.get("cache-control");
-  if (cacheControl) {
-    response.setHeader("cache-control", cacheControl);
-  }
-  const wwwAuthenticate = upstreamResponse.headers.get("www-authenticate");
-  if (wwwAuthenticate) {
-    response.setHeader("www-authenticate", wwwAuthenticate);
-  }
-  if (wellKnownPrefix === "/.well-known/oauth-protected-resource" && contentType?.includes("application/json") && upstreamResponse.ok) {
-    try {
-      const parsed = JSON.parse(bodyText);
-      parsed.resource = appendUpstreamQuery(`${getLocalOriginFromRequest(request)}/mcp`, requestedUpstream);
-      bodyText = JSON.stringify(parsed);
-    } catch {}
-  }
-  response.end(bodyText);
-  return true;
-}
-function createGatewayServer(options) {
-  const debug = process.env.MCPX_GATEWAY_DEBUG === "1";
-  const runtime = {
-    upstreamConnections: new Map,
-    upstreamErrors: new Map
-  };
-  const server = http2.createServer(async (request, response) => {
-    let requestUrl = new URL2(request.url ?? "/", `http://${request.headers.host ?? "127.0.0.1"}`);
-    try {
-      requestUrl = new URL2(request.url ?? "/", `http://${request.headers.host ?? "127.0.0.1"}`);
-      const upstreamFilter = getRequestedUpstream(requestUrl);
-      if (debug) {
-        console.error(`[mcpx gateway] ${request.method ?? "?"} ${requestUrl.pathname} auth=${request.headers.authorization ? "yes" : "no"} accept=${request.headers.accept ?? ""}`);
-        console.error(`[mcpx gateway] headers=${JSON.stringify(request.headers)}`);
-      }
-      if (await maybeHandleWellKnownOAuthRequest(request, response, requestUrl, options.secrets)) {
-        if (debug) {
-          console.error(`[mcpx gateway] -> ${response.statusCode} (well-known oauth)`);
-        }
-        return;
-      }
-      if (requestUrl.pathname !== "/mcp") {
-        response.statusCode = 404;
-        response.setHeader("content-type", "application/json");
-        response.end(JSON.stringify({ error: "not_found" }));
-        if (debug) {
-          console.error(`[mcpx gateway] -> 404`);
-        }
-        return;
-      }
-      if (request.method === "GET") {
-        if (!authHeaderIsValid(request, options.expectedToken)) {
-          response.statusCode = 401;
-          response.setHeader("content-type", "application/json");
-          response.end(JSON.stringify(makeError(null, -32001, "Unauthorized")));
-          if (debug) {
-            console.error(`[mcpx gateway] -> 401 (GET unauthorized)`);
-          }
-          return;
-        }
-        response.statusCode = 200;
-        response.setHeader("content-type", "application/json");
-        response.end(JSON.stringify({ ok: true, server: "mcpx" }));
-        if (debug) {
-          console.error(`[mcpx gateway] -> 200 (GET ok)`);
-        }
-        return;
-      }
-      if (request.method !== "POST") {
-        response.statusCode = 405;
-        response.end("Method Not Allowed");
-        if (debug) {
-          console.error(`[mcpx gateway] -> 405`);
-        }
-        return;
-      }
-      if (!authHeaderIsValid(request, options.expectedToken)) {
-        response.statusCode = 401;
-        response.setHeader("content-type", "application/json");
-        response.end(JSON.stringify(makeError(null, -32001, "Unauthorized")));
-        if (debug) {
-          console.error(`[mcpx gateway] -> 401 (POST unauthorized)`);
-        }
-        return;
-      }
-      let body = "";
-      request.setEncoding("utf8");
-      for await (const chunk of request) {
-        body += chunk;
-        if (body.length > 1e7) {
-          response.statusCode = 413;
-          response.end("Payload Too Large");
-          if (debug) {
-            console.error(`[mcpx gateway] -> 413`);
-          }
-          return;
-        }
-      }
-      const parsed = JSON.parse(body);
-      const hasInitialize = Array.isArray(parsed) ? parsed.some((item) => item.method === "initialize") : parsed.method === "initialize";
-      const responses = [];
-      const clientAuthorizationHeader = getClientAuthorizationForUpstream(request, options.expectedToken);
-      if (Array.isArray(parsed)) {
-        for (const item of parsed) {
-          if (debug) {
-            console.error(`[mcpx gateway] rpc method=${item.method} id=${item.id ?? "null"}`);
-          }
-          const rpcResponse = await handleRequestObject(item, options.secrets, runtime, upstreamFilter, clientAuthorizationHeader);
-          if (debug && rpcResponse?.error) {
-            console.error(`[mcpx gateway] rpc error code=${rpcResponse.error.code} message=${rpcResponse.error.message}`);
-          }
-          if (rpcResponse) {
-            responses.push(rpcResponse);
-          }
-        }
-      } else {
-        if (debug) {
-          console.error(`[mcpx gateway] rpc method=${parsed.method} id=${parsed.id ?? "null"}`);
-          if (parsed.method === "initialize") {
-            console.error(`[mcpx gateway] rpc initialize params=${JSON.stringify(parsed.params ?? {})}`);
-          }
-        }
-        const rpcResponse = await handleRequestObject(parsed, options.secrets, runtime, upstreamFilter, clientAuthorizationHeader);
-        if (debug && rpcResponse?.error) {
-          console.error(`[mcpx gateway] rpc error code=${rpcResponse.error.code} message=${rpcResponse.error.message}`);
-        }
-        if (rpcResponse) {
-          responses.push(rpcResponse);
-        }
-      }
-      response.statusCode = 200;
-      const acceptsSse = (request.headers.accept ?? "").includes("text/event-stream");
-      if (acceptsSse) {
-        response.setHeader("content-type", "text/event-stream");
-        response.setHeader("cache-control", "no-cache");
-        response.setHeader("connection", "keep-alive");
-      } else {
-        response.setHeader("content-type", "application/json");
-      }
-      if (hasInitialize) {
-        const sessionId = crypto2.randomUUID();
-        response.setHeader("mcp-session-id", sessionId);
-        response.setHeader("MCP-Session-Id", sessionId);
-      }
-      if (debug) {
-        console.error(`[mcpx gateway] -> 200 (rpc)`);
-      }
-      if (acceptsSse) {
-        const payloads = responses.length > 0 ? responses : [];
-        for (const payload of payloads) {
-          response.write(`event: message
-`);
-          response.write(`data: ${JSON.stringify(payload)}
-
-`);
-        }
-        response.end();
-      } else if (responses.length === 1) {
-        response.end(JSON.stringify(responses[0]));
-      } else {
-        response.end(JSON.stringify(responses));
-      }
-    } catch (error) {
-      if (isAuthChallenge(error)) {
-        response.statusCode = error.status ?? 401;
-        response.setHeader("content-type", "application/json");
-        if (error.wwwAuthenticate) {
-          const localResourceMetadataUrl = appendUpstreamQuery(`${getLocalOriginFromRequest(request)}/.well-known/oauth-protected-resource`, getRequestedUpstream(requestUrl));
-          response.setHeader("www-authenticate", rewriteWwwAuthenticateResourceMetadata(error.wwwAuthenticate, localResourceMetadataUrl));
-        }
-        response.end(JSON.stringify(makeError(null, -32001, "Upstream authentication required.", {
-          mcpxCode: error.code,
-          status: error.status,
-          upstream: error.upstream
-        })));
-        if (debug) {
-          console.error(`[mcpx gateway] -> ${error.status} upstream auth challenge`);
-        }
-        return;
-      }
-      response.statusCode = 500;
-      response.setHeader("content-type", "application/json");
-      response.end(JSON.stringify(makeError(null, -32000, error.message)));
-      if (debug) {
-        console.error(`[mcpx gateway] -> 500 ${error.message}`);
-      }
-    }
-  });
-  server.on("close", () => {
-    for (const entry of runtime.upstreamConnections.values()) {
-      closeUpstreamConnection(entry);
-    }
-    runtime.upstreamConnections.clear();
-  });
-  server.listen(options.port, "127.0.0.1");
-  return server;
-}
-
-// src/core/daemon.ts
-function readPidFromFile(pidPath = getPidPath()) {
-  if (!fs4.existsSync(pidPath)) {
-    return null;
-  }
-  const raw = fs4.readFileSync(pidPath, "utf8").trim();
-  if (!raw) {
-    return null;
-  }
-  const pid = Number(raw);
-  if (!Number.isFinite(pid) || pid <= 0) {
-    return null;
-  }
-  return pid;
-}
-function processExists(pid) {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function isPortAvailable(port) {
-  return new Promise((resolve) => {
-    const tester = net.createServer();
-    tester.once("error", () => {
-      resolve(false);
-    });
-    tester.once("listening", () => {
-      tester.close(() => resolve(true));
-    });
-    tester.listen(port, "127.0.0.1");
-  });
-}
-async function resolveGatewayPort(config, secrets) {
-  if (await isPortAvailable(config.gateway.port)) {
-    return config.gateway.port;
-  }
-  for (let offset = 1;offset <= 20; offset += 1) {
-    const candidate = config.gateway.port + offset;
-    if (candidate > 65535) {
-      break;
-    }
-    if (await isPortAvailable(candidate)) {
-      const oldPort = config.gateway.port;
-      config.gateway.port = candidate;
-      saveConfig(config);
-      if (secrets) {
-        try {
-          const summary = syncAllClients(config, secrets);
-          persistSyncState(summary, config);
-          saveConfig(config);
-        } catch {}
-      }
-      return candidate;
-    }
-  }
-  throw new Error(`No available local port found near ${config.gateway.port}.`);
-}
-async function waitForGatewayReady(port, token, timeoutMs = 5000) {
-  const deadline = Date.now() + timeoutMs;
-  let lastError;
-  while (Date.now() < deadline) {
-    try {
-      const response = await fetch(`http://127.0.0.1:${port}/mcp`, {
-        method: "GET",
-        headers: {
-          Authorization: `Bearer ${token}`
-        },
-        signal: AbortSignal.timeout(500)
-      });
-      if (response.ok) {
-        return;
-      }
-      lastError = new Error(`Gateway returned HTTP ${response.status}.`);
-    } catch (error) {
-      lastError = error;
-    }
-    await new Promise((resolve) => setTimeout(resolve, 100));
-  }
-  throw new Error(`Gateway did not become ready within ${timeoutMs}ms: ${lastError instanceof Error ? lastError.message : String(lastError)}`);
-}
-function getDaemonStatus(config) {
-  const pidPath = getPidPath();
-  const pid = readPidFromFile(pidPath);
-  if (!pid) {
-    return {
-      running: false,
-      pidFile: pidPath,
-      logFile: getLogPath(),
-      port: config.gateway.port
-    };
-  }
-  return {
-    running: processExists(pid),
-    pid,
-    pidFile: pidPath,
-    logFile: getLogPath(),
-    port: config.gateway.port
-  };
-}
-async function startDaemon(config, cliPath, secrets) {
-  const existingStatus = getDaemonStatus(config);
-  if (existingStatus.running && existingStatus.pid) {
-    const portAvailable = await isPortAvailable(config.gateway.port);
-    if (!portAvailable) {
-      return {
-        started: false,
-        pid: existingStatus.pid,
-        port: config.gateway.port,
-        message: "mcpx daemon already running."
-      };
-    }
-    try {
-      fs4.unlinkSync(getPidPath());
-    } catch {}
-  }
-  const port = await resolveGatewayPort(config, secrets);
-  const token = ensureGatewayToken(config, secrets);
-  const pidPath = getPidPath();
-  const logPath = getLogPath();
-  ensureParentDir(pidPath);
-  ensureParentDir(logPath);
-  const logFd = fs4.openSync(logPath, "a", 384);
-  const child = spawn2(process.execPath, [cliPath, "daemon", "run", "--port", String(port)], {
-    detached: true,
-    stdio: ["ignore", logFd, logFd],
-    env: {
-      ...process.env,
-      MCPX_DAEMON_CHILD: "1"
-    }
-  });
-  child.unref();
-  fs4.writeFileSync(pidPath, `${child.pid}
-`, { mode: 384 });
-  startBackgroundUpdateCheck();
-  await waitForGatewayReady(port, token);
-  return {
-    started: true,
-    pid: child.pid ?? -1,
-    port,
-    message: "mcpx daemon started."
-  };
-}
-function stopDaemon() {
-  const pidPath = getPidPath();
-  const pid = readPidFromFile(pidPath);
-  if (!pid) {
-    return {
-      stopped: false,
-      message: "mcpx daemon is not running."
-    };
-  }
-  try {
-    const cmd = execFileSync2("ps", ["-p", String(pid), "-o", "command="], { encoding: "utf8", timeout: 2000 }).trim();
-    if (!cmd.includes("mcpx") && !cmd.includes("daemon") && !cmd.includes("cli.js")) {
-      fs4.unlinkSync(pidPath);
-      return {
-        stopped: false,
-        message: `PID ${pid} is not a mcpx daemon (command: ${cmd.slice(0, 80)}). Pidfile cleaned up.`
-      };
-    }
-  } catch {
-    try {
-      fs4.unlinkSync(pidPath);
-    } catch {}
-    return {
-      stopped: false,
-      message: `PID ${pid} not found. Pidfile cleaned up.`
-    };
-  }
-  try {
-    process.kill(pid, "SIGTERM");
-  } catch {}
-  try {
-    fs4.unlinkSync(pidPath);
-  } catch {}
-  return {
-    stopped: true,
-    message: `Stopped mcpx daemon (pid ${pid}).`
-  };
-}
-async function restartDaemon(config, cliPath, secrets) {
-  stopDaemon();
-  return startDaemon(config, cliPath, secrets);
-}
-function readDaemonLogs(maxLines = 200) {
-  const logPath = getLogPath();
-  if (!fs4.existsSync(logPath)) {
-    return "";
-  }
-  const lines = fs4.readFileSync(logPath, "utf8").split(`
-`);
-  return lines.slice(Math.max(lines.length - maxLines, 0)).join(`
-`);
-}
-function runDaemonForeground(config, port, secrets) {
-  return new Promise((resolve, reject) => {
-    const token = ensureGatewayToken(config, secrets);
-    const server = createGatewayServer({
-      port,
-      expectedToken: token,
-      secrets
-    });
-    const cleanup = () => {
-      server.close(() => resolve());
-    };
-    process.on("SIGINT", cleanup);
-    process.on("SIGTERM", cleanup);
-    server.on("error", (error) => {
-      reject(error);
-    });
-  });
-}
-
-// src/core/status.ts
-var STATUS_CLIENTS = ["claude", "claude-desktop", "codex", "cursor", "cline", "opencode", "kiro", "vscode", "qwen"];
-function describeServerTarget(spec) {
-  if (spec.transport === "http") {
-    return spec.url;
-  }
-  const args = (spec.args ?? []).join(" ");
-  const command = `${spec.command}${args ? ` ${args}` : ""}`;
-  return spec.cwd ? `${command} (cwd: ${spec.cwd})` : command;
-}
-function deriveClientStatus(managed, configured) {
-  if (configured) {
-    return configured;
-  }
-  return managed ? "SYNCED" : "SKIPPED";
-}
-function buildClientMappings(config, managedIndex, serverName) {
-  return STATUS_CLIENTS.map((clientId) => {
-    const configState = config.clients[clientId];
-    const managedClient = managedIndex.managed[clientId];
-    const managedEntry = managedClient?.entries?.[`${serverName} (mcpx)`];
-    const managed = Boolean(managedEntry);
-    return {
-      clientId,
-      managed,
-      status: deriveClientStatus(managed, configState?.status),
-      configPath: managedClient?.configPath ?? configState?.configPath,
-      message: configState?.message,
-      lastSyncAt: managedEntry?.lastSyncedAt ?? configState?.lastSyncAt
-    };
-  });
-}
-function buildAuthBindings(spec) {
-  return listAuthBindings(spec).map((binding) => ({
-    kind: binding.kind,
-    key: binding.key,
-    value: binding.value,
-    secretName: secretRefName(binding.value) ?? undefined
-  }));
-}
-async function fetchTokenCounts(gatewayUrl, token) {
-  try {
-    const res = await fetch(gatewayUrl, {
-      method: "POST",
-      headers: {
-        "content-type": "application/json",
-        authorization: `Bearer ${token}`
-      },
-      body: JSON.stringify({
-        jsonrpc: "2.0",
-        id: "status-tokens",
-        method: "custom/tokenCounts",
-        params: {}
-      }),
-      signal: AbortSignal.timeout(4000)
-    });
-    if (!res.ok) {
-      return {};
-    }
-    const data = await res.json();
-    return data?.result ?? {};
-  } catch (error) {
-    return {};
-  }
-}
-async function buildStatusReport(config, managedIndex, daemon = getDaemonStatus(config)) {
-  const secrets = new SecretsManager;
-  const token = ensureGatewayToken(config, secrets);
-  const gatewayUrl = getGatewayUrl(config);
-  let tokenCounts = {};
-  if (daemon.running) {
-    tokenCounts = await fetchTokenCounts(gatewayUrl, token);
-  }
-  const projectEntries = Object.values(config.projects ?? {});
-  let totalGlobalTokens = 0;
-  const totalProjectTokens = {};
-  const serverNames = Object.keys(config.servers).sort((left, right) => left.localeCompare(right));
-  const servers = serverNames.map((name) => {
-    const spec = config.servers[name];
-    let tokenCount = tokenCounts[name];
-    if (tokenCount?.error && buildAuthBindings(spec).length > 0 && tokenCount.total > 0) {
-      tokenCount = { ...tokenCount, error: undefined };
-    }
-    const health = tokenCount ? tokenCount.error || tokenCount.runtimeError ? "error" : "ok" : "unknown";
-    const serverEntry = {
-      name,
-      enabled: isServerEnabled(spec),
-      transport: spec.transport,
-      target: describeServerTarget(spec),
-      authBindings: buildAuthBindings(spec),
-      clients: buildClientMappings(config, managedIndex, name),
-      tokenCount,
-      health
-    };
-    if (serverEntry.enabled && tokenCount) {
-      totalGlobalTokens += tokenCount.total;
-      for (const projectEntry of projectEntries) {
-        if (!(projectEntry.disabledServers ?? []).includes(name)) {
-          totalProjectTokens[projectEntry.path] = (totalProjectTokens[projectEntry.path] ?? 0) + tokenCount.total;
-        }
-      }
-    }
-    return serverEntry;
-  });
-  return {
-    gatewayUrl,
-    daemon,
-    upstreamCount: servers.length,
-    servers,
-    clients: config.clients,
-    projects: config.projects,
-    totalGlobalTokens,
-    totalProjectTokens
-  };
-}
-
-export { probeHttpAuthRequirement, fetchRegistryServerDetail, selectBestPackage, extractRequiredInputs, mapRegistryToSpec, toSecretRef, secretRefName, defaultAuthSecretName, resolveAuthTarget, applyAuthReference, removeAuthReference, listAuthBindings, maybePrefixBearer, buildEnrichedPath, isOAuthReference, oauthReferenceServerName, runOAuthLogin, getOAuthAccessToken, APP_VERSION, compareVersions, checkForUpdates, getStagedUpdate, shouldUseStagedCli, clearStagedUpdate, getStagedCliPath, startBackgroundUpdateCheck, runBackgroundUpdate, performUpdate, performRollback, getDaemonStatus, startDaemon, stopDaemon, restartDaemon, readDaemonLogs, runDaemonForeground, STATUS_CLIENTS, buildStatusReport };