@memoraone/mcp 0.1.54 → 0.1.56

package/dist/gateway.cjs

@@ -35,7 +35,7 @@ __export(gateway_exports, {
 module.exports = __toCommonJS(gateway_exports);
 var http = __toESM(require("http"), 1);
 var fs38 = __toESM(require("fs"), 1);
-var path51 = __toESM(require("path"), 1);
+var path52 = __toESM(require("path"), 1);
 
 // src/socketPaths.ts
 var os = __toESM(require("os"), 1);
@@ -245,6 +245,101 @@ function buildGatewayMcpUrl(workspaceRoot, env2 = process.env) {
   return `${getGatewayBaseUrl(env2)}${GATEWAY_MCP_PATH}?${GATEWAY_WS_QUERY}=${encodeURIComponent(root)}`;
 }
 
+// src/config.ts
+var process2 = __toESM(require("process"), 1);
+var fs2 = __toESM(require("fs"), 1);
+var path4 = __toESM(require("path"), 1);
+var dotenv = __toESM(require("dotenv"), 1);
+var import_v4 = require("zod/v4");
+
+// src/configUtils.ts
+var DEFAULT_API_URL = "https://api.memoraone.com";
+var DEV_API_URL = "http://localhost:3001";
+function resolveApiUrl(env2) {
+  const explicitUrl = env2.MEMORAONE_API_URL?.trim();
+  if (explicitUrl) {
+    return explicitUrl;
+  }
+  const aliasUrl = env2.MEMORA_API_URL?.trim();
+  if (aliasUrl) {
+    return aliasUrl;
+  }
+  if (env2.MEMORAONE_DEV_MODE === "1") {
+    return DEV_API_URL;
+  }
+  return DEFAULT_API_URL;
+}
+
+// src/config.ts
+var dotenvPath = path4.resolve(process2.cwd(), ".env");
+if (fs2.existsSync(dotenvPath)) {
+  try {
+    dotenv.config({ path: dotenvPath });
+  } catch (err) {
+    process2.stderr.write("[memoraone-mcp] Failed to load .env: " + String(err) + "\n");
+  }
+}
+var EnvSchema = import_v4.z.object({
+  MEMORAONE_API_URL: import_v4.z.string().url().optional(),
+  MEMORAONE_API_KEY: import_v4.z.string().min(1).optional(),
+  MEMORAONE_DEV_MODE: import_v4.z.string().min(1).optional(),
+  MEMORAONE_AGENT_NAME: import_v4.z.string().min(1).optional(),
+  MEMORAONE_AGENT_TYPE: import_v4.z.string().min(1).optional(),
+  MEMORAONE_SOURCE: import_v4.z.string().min(1).optional(),
+  MEMORAONE_IDE_TYPE: import_v4.z.enum(IDE_TYPES).optional(),
+  MEMORAONE_WORKLOG: import_v4.z.string().min(1).optional(),
+  MEMORAONE_HEARTBEAT: import_v4.z.string().min(1).optional(),
+  MEMORAONE_HEARTBEAT_INTERVAL_MS: import_v4.z.string().min(1).optional()
+});
+var requiredEnvVars = [];
+var missingEnvVars = requiredEnvVars.filter((key) => {
+  const value = process2.env[key];
+  return value === void 0 || value.trim() === "";
+});
+if (missingEnvVars.length > 0) {
+  for (const key of missingEnvVars) {
+    process2.stderr.write(`Missing ${key}
+`);
+  }
+  process2.exit(1);
+}
+var parsed = EnvSchema.safeParse(process2.env);
+var resolvedApiUrl = resolveApiUrl(process2.env);
+if (!parsed.success) {
+  const formatted = parsed.error.format();
+  process2.stderr.write(
+    "[memoraone-mcp] Invalid environment variables " + JSON.stringify(formatted) + "\n"
+  );
+  throw new Error("Config validation failed");
+}
+var parseBooleanFlag = (value, defaultValue) => {
+  if (value === void 0) {
+    return defaultValue;
+  }
+  const normalized = value.trim().toLowerCase();
+  if (["1", "true", "yes", "on"].includes(normalized)) {
+    return true;
+  }
+  if (["0", "false", "no", "off"].includes(normalized)) {
+    return false;
+  }
+  return defaultValue;
+};
+var config2 = {
+  apiUrl: resolvedApiUrl.replace(/\/+$/, ""),
+  apiKey: parsed.data.MEMORAONE_API_KEY,
+  agentName: parsed.data.MEMORAONE_AGENT_NAME ?? "cursor",
+  agentType: parsed.data.MEMORAONE_AGENT_TYPE ?? "agent",
+  source: parsed.data.MEMORAONE_SOURCE ?? "cursor",
+  ideType: parsed.data.MEMORAONE_IDE_TYPE,
+  devMode: parseBooleanFlag(parsed.data.MEMORAONE_DEV_MODE, false),
+  worklogEnabled: parseBooleanFlag(parsed.data.MEMORAONE_WORKLOG, true),
+  heartbeatEnabled: parseBooleanFlag(parsed.data.MEMORAONE_HEARTBEAT, true),
+  // Cadence is owned by LOCAL_MCP_HEARTBEAT_INTERVAL_MS in heartbeat.ts (1_000).
+  // Env override is accepted for forward-compat but the timer path ignores it.
+  heartbeatIntervalMs: Number.parseInt(parsed.data.MEMORAONE_HEARTBEAT_INTERVAL_MS ?? "1000", 10)
+};
+
 // src/gatewayOAuth.ts
 var import_node_crypto28 = require("crypto");
 
@@ -268,14 +363,40 @@ var GATEWAY_OAUTH_ALLOWED_REDIRECT_URIS = [
 function getGatewayIssuerUrl(env2 = process.env) {
   return getGatewayBaseUrl(env2);
 }
+function getGatewayAuthorizationServerIssuerUrl(env2 = process.env) {
+  const raw = env2.MEMORAONE_OAUTH_ISSUER_URL?.trim();
+  if (!raw) {
+    return getGatewayIssuerUrl(env2);
+  }
+  let parsed2;
+  try {
+    parsed2 = new URL(raw);
+  } catch {
+    throw new Error(
+      `[memoraone-mcp] Invalid MEMORAONE_OAUTH_ISSUER_URL=${JSON.stringify(raw)} (expected absolute http: or https: URL)`
+    );
+  }
+  if (parsed2.protocol !== "http:" && parsed2.protocol !== "https:") {
+    throw new Error(
+      `[memoraone-mcp] Invalid MEMORAONE_OAUTH_ISSUER_URL=${JSON.stringify(raw)} (expected absolute http: or https: URL)`
+    );
+  }
+  return raw.replace(/\/+$/, "");
+}
 function getGatewayResourceBaseUrl(env2 = process.env) {
   return `${getGatewayBaseUrl(env2)}${GATEWAY_MCP_PATH}`;
 }
-function getGatewayProtectedResourceMetadataUrl(env2 = process.env) {
-  return `${getGatewayBaseUrl(env2)}${GATEWAY_OAUTH_PRM_PATH}`;
+function getGatewayProtectedResourceMetadataUrl(env2 = process.env, workspaceRoot) {
+  const metadataUrl = `${getGatewayBaseUrl(env2)}${GATEWAY_OAUTH_PRM_PATH}`;
+  if (workspaceRoot === void 0) {
+    return metadataUrl;
+  }
+  const mcpUrl = buildGatewayMcpUrl(workspaceRoot, env2);
+  const queryIndex = mcpUrl.indexOf("?");
+  return queryIndex >= 0 ? `${metadataUrl}${mcpUrl.slice(queryIndex)}` : metadataUrl;
 }
-function buildGatewayMcpWwwAuthenticate(env2 = process.env) {
-  const metadataUrl = getGatewayProtectedResourceMetadataUrl(env2);
+function buildGatewayMcpWwwAuthenticate(env2 = process.env, workspaceRoot) {
+  const metadataUrl = getGatewayProtectedResourceMetadataUrl(env2, workspaceRoot);
   return `Bearer resource_metadata="${metadataUrl}"`;
 }
 function isAllowedOAuthRedirectUri(redirectUri) {
@@ -391,47 +512,47 @@ var GatewayOAuthCodeStore = class {
 };
 
 // src/gatewayWorkspace.ts
-var fs6 = __toESM(require("fs/promises"), 1);
-var path11 = __toESM(require("path"), 1);
+var fs7 = __toESM(require("fs/promises"), 1);
+var path12 = __toESM(require("path"), 1);
 
 // src/localState/resolveLocalBinding.ts
-var path10 = __toESM(require("path"), 1);
+var path11 = __toESM(require("path"), 1);
 
 // src/localState/bindingStore.ts
-var fs4 = __toESM(require("fs/promises"), 1);
-var path6 = __toESM(require("path"), 1);
+var fs5 = __toESM(require("fs/promises"), 1);
+var path7 = __toESM(require("path"), 1);
 
 // src/localState/atomicFs.ts
-var fs2 = __toESM(require("fs/promises"), 1);
-var path4 = __toESM(require("path"), 1);
+var fs3 = __toESM(require("fs/promises"), 1);
+var path5 = __toESM(require("path"), 1);
 var import_node_crypto2 = require("crypto");
 var STATE_DIR_MODE = 448;
 var STATE_FILE_MODE = 384;
 async function ensurePrivateDir(dirPath) {
-  await fs2.mkdir(dirPath, { recursive: true, mode: STATE_DIR_MODE });
+  await fs3.mkdir(dirPath, { recursive: true, mode: STATE_DIR_MODE });
   try {
-    await fs2.chmod(dirPath, STATE_DIR_MODE);
+    await fs3.chmod(dirPath, STATE_DIR_MODE);
   } catch {
   }
 }
 async function writeFileAtomic(filePath, content, options = {}) {
   const mode = options.mode ?? STATE_FILE_MODE;
-  const dir = path4.dirname(filePath);
+  const dir = path5.dirname(filePath);
   await ensurePrivateDir(dir);
-  const tmpPath = path4.join(
+  const tmpPath = path5.join(
     dir,
-    `.${path4.basename(filePath)}.${process.pid}.${(0, import_node_crypto2.randomBytes)(8).toString("hex")}.tmp`
+    `.${path5.basename(filePath)}.${process.pid}.${(0, import_node_crypto2.randomBytes)(8).toString("hex")}.tmp`
   );
   try {
-    await fs2.writeFile(tmpPath, content, { encoding: "utf8", mode });
-    await fs2.rename(tmpPath, filePath);
+    await fs3.writeFile(tmpPath, content, { encoding: "utf8", mode });
+    await fs3.rename(tmpPath, filePath);
     try {
-      await fs2.chmod(filePath, mode);
+      await fs3.chmod(filePath, mode);
     } catch {
     }
   } catch (err) {
     try {
-      await fs2.unlink(tmpPath);
+      await fs3.unlink(tmpPath);
     } catch {
     }
     throw err;
@@ -439,7 +560,7 @@ async function writeFileAtomic(filePath, content, options = {}) {
 }
 async function readJsonFile(filePath) {
   try {
-    const raw = await fs2.readFile(filePath, "utf8");
+    const raw = await fs3.readFile(filePath, "utf8");
     return JSON.parse(raw);
   } catch (err) {
     if (err?.code === "ENOENT") {
@@ -566,32 +687,32 @@ function parseBindingRecord(raw) {
 }
 
 // src/localState/localLocks.ts
-var fs3 = __toESM(require("fs/promises"), 1);
+var fs4 = __toESM(require("fs/promises"), 1);
 
 // src/localState/statePaths.ts
 var os2 = __toESM(require("os"), 1);
-var path5 = __toESM(require("path"), 1);
+var path6 = __toESM(require("path"), 1);
 var MEMORAONE_STATE_DIRNAME = ".memoraone";
 function getMemoraoneStateDir(homeDir = os2.homedir()) {
-  return path5.join(homeDir, MEMORAONE_STATE_DIRNAME);
+  return path6.join(homeDir, MEMORAONE_STATE_DIRNAME);
 }
 function getPathIndexPath(homeDir = os2.homedir()) {
-  return path5.join(getMemoraoneStateDir(homeDir), "path-index.json");
+  return path6.join(getMemoraoneStateDir(homeDir), "path-index.json");
 }
 function getBindingsDir(homeDir = os2.homedir()) {
-  return path5.join(getMemoraoneStateDir(homeDir), "bindings");
+  return path6.join(getMemoraoneStateDir(homeDir), "bindings");
 }
 function getBindingFilePath(repositoryBindingId, homeDir = os2.homedir()) {
-  return path5.join(getBindingsDir(homeDir), `${repositoryBindingId}.json`);
+  return path6.join(getBindingsDir(homeDir), `${repositoryBindingId}.json`);
 }
 function getLocksDir(homeDir = os2.homedir()) {
-  return path5.join(getMemoraoneStateDir(homeDir), "locks");
+  return path6.join(getMemoraoneStateDir(homeDir), "locks");
 }
 function getLockPath(lockName, homeDir = os2.homedir()) {
-  return path5.join(getLocksDir(homeDir), `${lockName}.lock`);
+  return path6.join(getLocksDir(homeDir), `${lockName}.lock`);
 }
 function getGatewayTicketsPath(homeDir = os2.homedir()) {
-  return path5.join(getMemoraoneStateDir(homeDir), "gateway-tickets.json");
+  return path6.join(getMemoraoneStateDir(homeDir), "gateway-tickets.json");
 }
 
 // src/localState/localLocks.ts
@@ -606,16 +727,16 @@ async function acquireLocalLock(lockName, options = {}) {
   while (retries <= maxRetries) {
     try {
       try {
-        const stat5 = await fs3.stat(lockPath);
+        const stat5 = await fs4.stat(lockPath);
         if (Date.now() - stat5.mtimeMs > maxLockAgeMs) {
-          await fs3.unlink(lockPath);
+          await fs4.unlink(lockPath);
         }
       } catch (err) {
         if (err?.code !== "ENOENT") {
           throw err;
         }
       }
-      const fd = await fs3.open(lockPath, "wx");
+      const fd = await fs4.open(lockPath, "wx");
       await fd.writeFile(
         JSON.stringify({
           pid: process.pid,
@@ -626,7 +747,7 @@ async function acquireLocalLock(lockName, options = {}) {
       await fd.close();
       return async () => {
         try {
-          await fs3.unlink(lockPath);
+          await fs4.unlink(lockPath);
         } catch (err) {
           if (err?.code !== "ENOENT") {
           }
@@ -640,7 +761,7 @@ async function acquireLocalLock(lockName, options = {}) {
             `[memoraone-mcp] Failed to acquire lock ${lockName} after ${maxRetries} retries`
           );
         }
-        await new Promise((resolve46) => setTimeout(resolve46, retryDelayMs));
+        await new Promise((resolve47) => setTimeout(resolve47, retryDelayMs));
         continue;
       }
       throw err;
@@ -692,7 +813,7 @@ async function listBindingRecords(homeDir) {
   const dir = await ensureBindingsDir(homeDir);
   let names;
   try {
-    names = await fs4.readdir(dir);
+    names = await fs5.readdir(dir);
   } catch (err) {
     if (err?.code === "ENOENT") return [];
     throw err;
@@ -710,9 +831,9 @@ async function listBindingRecords(homeDir) {
   return out;
 }
 async function findBindingRecordByWorkspaceRoot(workspaceRoot, homeDir) {
-  const resolved = path6.resolve(workspaceRoot);
+  const resolved = path7.resolve(workspaceRoot);
   const records = await listBindingRecords(homeDir);
-  return records.find((r) => path6.resolve(r.workspaceRoot) === resolved) ?? null;
+  return records.find((r) => path7.resolve(r.workspaceRoot) === resolved) ?? null;
 }
 
 // src/localState/installationCredentials.ts
@@ -857,6 +978,7 @@ function parsePayload(raw, repositoryBindingId) {
   optionalString("refreshTokenExpiresAt");
   optionalString("clientRedeemKey");
   optionalString("clientRefreshKey");
+  optionalString("supabaseUserId");
   return payload;
 }
 async function readInstallationCredentials(repositoryBindingId, options = {}) {
@@ -939,12 +1061,12 @@ function hasUsableAccessToken(payload) {
 }
 
 // src/localState/pathIndex.ts
-var path8 = __toESM(require("path"), 1);
+var path9 = __toESM(require("path"), 1);
 
 // src/localState/rootFilesystemIdentity.ts
-var fs5 = __toESM(require("fs/promises"), 1);
+var fs6 = __toESM(require("fs/promises"), 1);
 var os3 = __toESM(require("os"), 1);
-var path7 = __toESM(require("path"), 1);
+var path8 = __toESM(require("path"), 1);
 var import_node_child_process = require("child_process");
 var import_node_util = require("util");
 var execFileAsync = (0, import_node_util.promisify)(import_node_child_process.execFile);
@@ -969,13 +1091,13 @@ async function readDarwinDeviceId() {
 }
 async function readLinuxDeviceId() {
   try {
-    const content = await fs5.readFile("/etc/machine-id", "utf8");
+    const content = await fs6.readFile("/etc/machine-id", "utf8");
     const id = content.trim();
     if (id) return id;
   } catch {
   }
   try {
-    const content = await fs5.readFile("/var/lib/dbus/machine-id", "utf8");
+    const content = await fs6.readFile("/var/lib/dbus/machine-id", "utf8");
     const id = content.trim();
     if (id) return id;
   } catch {
@@ -1008,10 +1130,10 @@ async function resolveDeviceId(platform2 = os3.platform()) {
   throw new Error(`[memoraone-mcp] Unsupported platform for device ID: ${platform2}`);
 }
 async function captureRootFilesystemIdentity(rootPath, deps = {}) {
-  const resolved = path7.resolve(rootPath);
+  const resolved = path8.resolve(rootPath);
   const platform2 = deps.platform ?? os3.platform();
   const statRoot = deps.statRoot ?? (async (p) => {
-    const st2 = await fs5.stat(p);
+    const st2 = await fs6.stat(p);
     return {
       ino: st2.ino,
       dev: st2.dev,
@@ -1095,7 +1217,7 @@ async function savePathIndex(index, homeDir) {
   await writeJsonAtomic(getPathIndexPath(homeDir), next);
 }
 function lookupPathIndex(index, workspaceRoot, identity) {
-  const resolved = path8.resolve(workspaceRoot);
+  const resolved = path9.resolve(workspaceRoot);
   const byPathId = index.byPath[resolved];
   if (byPathId) {
     return { kind: "path", repositoryBindingId: assertRepositoryBindingId(byPathId) };
@@ -1121,14 +1243,14 @@ function lookupPathIndex(index, workspaceRoot, identity) {
 }
 async function upsertPathIndexEntry(options) {
   const repositoryBindingId = assertRepositoryBindingId(options.repositoryBindingId);
-  const resolved = path8.resolve(options.workspaceRoot);
+  const resolved = path9.resolve(options.workspaceRoot);
   const identityKey = filesystemIdentityKey(options.identity);
   return withLocalLock(
     "path-index",
     async () => {
       const index = await loadPathIndex(options.homeDir);
-      if (options.previousPath && path8.resolve(options.previousPath) !== resolved) {
-        delete index.byPath[path8.resolve(options.previousPath)];
+      if (options.previousPath && path9.resolve(options.previousPath) !== resolved) {
+        delete index.byPath[path9.resolve(options.previousPath)];
       }
       for (const [p, id] of Object.entries(index.byPath)) {
         if (id === repositoryBindingId && p !== resolved) {
@@ -1153,20 +1275,20 @@ function identityMatchesStored(stored, current) {
 }
 
 // src/localState/localConnectClient.ts
-var path9 = __toESM(require("path"), 1);
+var path10 = __toESM(require("path"), 1);
 
 // src/client/memoraClient.ts
 var crypto2 = __toESM(require("crypto"), 1);
 var PROJECT_ID_HEADER = "x-project-id";
 var uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-var parseBooleanFlag = (value) => {
+var parseBooleanFlag2 = (value) => {
   if (!value) {
     return false;
   }
   const normalized = value.trim().toLowerCase();
   return ["1", "true", "yes", "on"].includes(normalized);
 };
-var debugEnabled = parseBooleanFlag(process.env.MEMORAONE_DEV_MODE);
+var debugEnabled = parseBooleanFlag2(process.env.MEMORAONE_DEV_MODE);
 async function requestJson(url, method, headers, body) {
   const res = await fetch(url, {
     method,
@@ -1264,9 +1386,9 @@ var MemoraClient = class {
       ...options?.headers ?? {}
     };
   }
-  async perform(method, path52, body, options, retried = false) {
+  async perform(method, path53, body, options, retried = false) {
     const nonce = crypto2.randomBytes(8).toString("hex");
-    const url = `${this.baseUrl}${path52.startsWith("/") ? path52 : `/${path52}`}`;
+    const url = `${this.baseUrl}${path53.startsWith("/") ? path53 : `/${path53}`}`;
     this.resolveProjectId();
     console.error(
       `[memoraone-mcp][info] requestJson nonce=${nonce} stage=before_fetch method=${method} url=${url}`
@@ -1293,7 +1415,7 @@ var MemoraClient = class {
       if (res.status === 401 && !options?.skipAuthRefresh && !retried) {
         try {
           await this.refreshAccessToken();
-          return this.perform(method, path52, body, options, true);
+          return this.perform(method, path53, body, options, true);
         } catch (err) {
           if (err instanceof ReconnectRequiredError) {
             await this.markReconnectRequired();
@@ -1313,22 +1435,22 @@ var MemoraClient = class {
     }
     return res.text ? JSON.parse(res.text) : null;
   }
-  async post(path52, body, options) {
-    console.error(`[memoraone-mcp][info] MemoraClient.post ENTER path=${path52}`);
-    const result = await this.perform("POST", path52, body, options);
-    console.error(`[memoraone-mcp][info] MemoraClient.post EXIT path=${path52}`);
+  async post(path53, body, options) {
+    console.error(`[memoraone-mcp][info] MemoraClient.post ENTER path=${path53}`);
+    const result = await this.perform("POST", path53, body, options);
+    console.error(`[memoraone-mcp][info] MemoraClient.post EXIT path=${path53}`);
     return result;
   }
-  async get(path52, options) {
-    return this.perform("GET", path52, void 0, options);
+  async get(path53, options) {
+    return this.perform("GET", path53, void 0, options);
   }
 };
 var memoraClient_default = MemoraClient;
 
 // src/localState/localConnectClient.ts
-async function requestJson2(baseUrl, method, path52, options = {}) {
+async function requestJson2(baseUrl, method, path53, options = {}) {
   const fetchImpl = options.fetchImpl ?? fetch;
-  const url = `${baseUrl.replace(/\/+$/, "")}${path52.startsWith("/") ? path52 : `/${path52}`}`;
+  const url = `${baseUrl.replace(/\/+$/, "")}${path53.startsWith("/") ? path53 : `/${path53}`}`;
   const res = await fetchImpl(url, {
     method,
     headers: {
@@ -1365,7 +1487,7 @@ function normalizePluginPairingSource(source) {
   return source;
 }
 function pairingRepositoryName(workspaceRoot) {
-  const repositoryName = path9.basename(path9.resolve(workspaceRoot)).trim();
+  const repositoryName = path10.basename(path10.resolve(workspaceRoot)).trim();
   if (repositoryName.length === 0 || repositoryName.length > 256 || repositoryName.includes("/") || repositoryName.includes("\\")) {
     throw new Error("[memoraone-mcp] Workspace basename is not safe pairing metadata");
   }
@@ -1460,7 +1582,8 @@ async function redeemLocalConnectCode(apiUrl, body, options = {}) {
   const installationPublicId = data?.installation_public_id;
   const projectId = data?.project_id;
   const repositoryBindingId = data?.repository_binding_id;
-  if (typeof accessToken !== "string" || typeof refreshToken !== "string" || typeof installationPublicId !== "string" || typeof projectId !== "string" || typeof repositoryBindingId !== "string") {
+  const supabaseUserId = data?.supabase_user_id;
+  if (typeof accessToken !== "string" || typeof refreshToken !== "string" || typeof installationPublicId !== "string" || typeof projectId !== "string" || typeof repositoryBindingId !== "string" || typeof supabaseUserId !== "string" || supabaseUserId.length === 0) {
     throw new Error("[memoraone-mcp] Invalid redeem response");
   }
   let sourceId = null;
@@ -1478,7 +1601,8 @@ async function redeemLocalConnectCode(apiUrl, body, options = {}) {
     project_id: projectId,
     repository_binding_id: repositoryBindingId,
     source_id: sourceId,
-    recovered: Boolean(data.recovered)
+    recovered: Boolean(data.recovered),
+    supabase_user_id: supabaseUserId
   };
 }
 async function refreshLocalMcpToken(apiUrl, body, options = {}) {
@@ -1500,6 +1624,33 @@ async function refreshLocalMcpToken(apiUrl, body, options = {}) {
     repository_binding_id: typeof data.repository_binding_id === "string" ? data.repository_binding_id : void 0
   };
 }
+var AUTH_IDENTITY_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+async function fetchAuthIdentity(apiUrl, bearerToken, options = {}) {
+  const res = await requestJson2(apiUrl, "GET", "/auth/identity", {
+    headers: { Authorization: `Bearer ${bearerToken}` },
+    fetchImpl: options.fetchImpl
+  });
+  if (res.status !== 200) {
+    throw new Error("[memoraone-mcp] Invalid auth identity response");
+  }
+  const data = res.json;
+  if (!data || typeof data !== "object" || Array.isArray(data)) {
+    throw new Error("[memoraone-mcp] Invalid auth identity response");
+  }
+  const obj = data;
+  const supabaseUserIdRaw = obj.supabase_user_id;
+  if (obj.authenticated !== true || typeof supabaseUserIdRaw !== "string") {
+    throw new Error("[memoraone-mcp] Invalid auth identity response");
+  }
+  const supabaseUserId = supabaseUserIdRaw.trim();
+  if (!AUTH_IDENTITY_UUID_RE.test(supabaseUserId)) {
+    throw new Error("[memoraone-mcp] Invalid auth identity response");
+  }
+  return {
+    authenticated: true,
+    supabase_user_id: supabaseUserId
+  };
+}
 
 // src/localState/tokenRefreshCoordinator.ts
 var ReconnectRequiredError = class extends Error {
@@ -1564,14 +1715,14 @@ async function refreshInstallationAccessToken(options) {
 
 // src/localState/resolveLocalBinding.ts
 async function ensureRepositoryBindingForRoot(workspaceRoot, options = {}) {
-  const resolved = path10.resolve(workspaceRoot);
+  const resolved = path11.resolve(workspaceRoot);
   const identity = await captureRootFilesystemIdentity(resolved, options.identityDeps);
   const index = await loadPathIndex(options.homeDir);
   const lookup = lookupPathIndex(index, resolved, identity);
   if (lookup.kind === "path") {
     const record = await readBindingRecord(lookup.repositoryBindingId, options.homeDir);
     if (record && identityMatchesStored(record.filesystemIdentity, identity)) {
-      if (path10.resolve(record.workspaceRoot) !== resolved) {
+      if (path11.resolve(record.workspaceRoot) !== resolved) {
         const updated = {
           ...record,
           workspaceRoot: resolved,
@@ -1630,7 +1781,7 @@ async function ensureRepositoryBindingForRoot(workspaceRoot, options = {}) {
   };
 }
 async function lookupLocalBindingIdentity(workspaceRoot, options = {}) {
-  const resolved = path10.resolve(workspaceRoot);
+  const resolved = path11.resolve(workspaceRoot);
   const identity = await captureRootFilesystemIdentity(resolved, options.identityDeps);
   const index = await loadPathIndex(options.homeDir);
   const lookup = lookupPathIndex(index, resolved, identity);
@@ -1641,7 +1792,7 @@ async function lookupLocalBindingIdentity(workspaceRoot, options = {}) {
   if (!record) {
     return { status: "unbound", workspaceRoot: resolved };
   }
-  if (path10.resolve(record.workspaceRoot) !== resolved) {
+  if (path11.resolve(record.workspaceRoot) !== resolved) {
     return { status: "unbound", workspaceRoot: resolved };
   }
   if (!identityMatchesStored(record.filesystemIdentity, identity)) {
@@ -1654,7 +1805,7 @@ async function lookupLocalBindingIdentity(workspaceRoot, options = {}) {
   };
 }
 async function resolveLocalBinding(workspaceRoot, options = {}) {
-  const resolved = path10.resolve(workspaceRoot);
+  const resolved = path11.resolve(workspaceRoot);
   const { repositoryBindingId } = await ensureRepositoryBindingForRoot(
     resolved,
     { ...options, createIfMissing: false }
@@ -1740,12 +1891,12 @@ async function parseGatewayWorkspaceRoot(wsRaw) {
   if (/^[a-zA-Z][a-zA-Z0-9+.-]*:/.test(trimmed)) {
     return fail("malformed_ws", "ws must be an absolute filesystem path");
   }
-  if (!path11.isAbsolute(trimmed)) {
+  if (!path12.isAbsolute(trimmed)) {
     return fail("non_absolute", "ws must be an absolute workspace root");
   }
-  const workspaceRoot = path11.resolve(trimmed);
+  const workspaceRoot = path12.resolve(trimmed);
   try {
-    const st = await fs6.stat(workspaceRoot);
+    const st = await fs7.stat(workspaceRoot);
     if (!st.isDirectory()) {
       return fail("not_directory", "ws must point to an existing directory");
     }
@@ -1768,7 +1919,7 @@ async function parseGatewayWorkspaceUrl(input2) {
 
 // src/localState/gatewayTicketStore.ts
 var import_node_crypto5 = require("crypto");
-var path12 = __toESM(require("path"), 1);
+var path13 = __toESM(require("path"), 1);
 var GATEWAY_TICKETS_VERSION = 1;
 var GATEWAY_TICKETS_LOCK_NAME = "gateway-tickets";
 var MGT_PREFIX = "mgt_";
@@ -1862,7 +2013,7 @@ async function resolveGatewayTicketScope(input2, options = {}) {
   if (!("workspaceRoot" in input2) || input2.workspaceRoot == null) {
     return fail2("invalid_workspace", "workspaceRoot or canonicalUrl is required");
   }
-  const parsed2 = await parseGatewayWorkspaceRoot(path12.resolve(input2.workspaceRoot));
+  const parsed2 = await parseGatewayWorkspaceRoot(path13.resolve(input2.workspaceRoot));
   if (!parsed2.ok) {
     return fail2("invalid_workspace", parsed2.error);
   }
@@ -1959,101 +2110,6 @@ async function revokeGatewaySetupTicket(ticket, options = {}) {
 // src/pluginPairing.ts
 var path47 = __toESM(require("path"), 1);
 
-// src/config.ts
-var process2 = __toESM(require("process"), 1);
-var fs7 = __toESM(require("fs"), 1);
-var path13 = __toESM(require("path"), 1);
-var dotenv = __toESM(require("dotenv"), 1);
-var import_v4 = require("zod/v4");
-
-// src/configUtils.ts
-var DEFAULT_API_URL = "https://api.memoraone.com";
-var DEV_API_URL = "http://localhost:3001";
-function resolveApiUrl(env2) {
-  const explicitUrl = env2.MEMORAONE_API_URL?.trim();
-  if (explicitUrl) {
-    return explicitUrl;
-  }
-  const aliasUrl = env2.MEMORA_API_URL?.trim();
-  if (aliasUrl) {
-    return aliasUrl;
-  }
-  if (env2.MEMORAONE_DEV_MODE === "1") {
-    return DEV_API_URL;
-  }
-  return DEFAULT_API_URL;
-}
-
-// src/config.ts
-var dotenvPath = path13.resolve(process2.cwd(), ".env");
-if (fs7.existsSync(dotenvPath)) {
-  try {
-    dotenv.config({ path: dotenvPath });
-  } catch (err) {
-    process2.stderr.write("[memoraone-mcp] Failed to load .env: " + String(err) + "\n");
-  }
-}
-var EnvSchema = import_v4.z.object({
-  MEMORAONE_API_URL: import_v4.z.string().url().optional(),
-  MEMORAONE_API_KEY: import_v4.z.string().min(1).optional(),
-  MEMORAONE_DEV_MODE: import_v4.z.string().min(1).optional(),
-  MEMORAONE_AGENT_NAME: import_v4.z.string().min(1).optional(),
-  MEMORAONE_AGENT_TYPE: import_v4.z.string().min(1).optional(),
-  MEMORAONE_SOURCE: import_v4.z.string().min(1).optional(),
-  MEMORAONE_IDE_TYPE: import_v4.z.enum(IDE_TYPES).optional(),
-  MEMORAONE_WORKLOG: import_v4.z.string().min(1).optional(),
-  MEMORAONE_HEARTBEAT: import_v4.z.string().min(1).optional(),
-  MEMORAONE_HEARTBEAT_INTERVAL_MS: import_v4.z.string().min(1).optional()
-});
-var requiredEnvVars = [];
-var missingEnvVars = requiredEnvVars.filter((key) => {
-  const value = process2.env[key];
-  return value === void 0 || value.trim() === "";
-});
-if (missingEnvVars.length > 0) {
-  for (const key of missingEnvVars) {
-    process2.stderr.write(`Missing ${key}
-`);
-  }
-  process2.exit(1);
-}
-var parsed = EnvSchema.safeParse(process2.env);
-var resolvedApiUrl = resolveApiUrl(process2.env);
-if (!parsed.success) {
-  const formatted = parsed.error.format();
-  process2.stderr.write(
-    "[memoraone-mcp] Invalid environment variables " + JSON.stringify(formatted) + "\n"
-  );
-  throw new Error("Config validation failed");
-}
-var parseBooleanFlag2 = (value, defaultValue) => {
-  if (value === void 0) {
-    return defaultValue;
-  }
-  const normalized = value.trim().toLowerCase();
-  if (["1", "true", "yes", "on"].includes(normalized)) {
-    return true;
-  }
-  if (["0", "false", "no", "off"].includes(normalized)) {
-    return false;
-  }
-  return defaultValue;
-};
-var config2 = {
-  apiUrl: resolvedApiUrl.replace(/\/+$/, ""),
-  apiKey: parsed.data.MEMORAONE_API_KEY,
-  agentName: parsed.data.MEMORAONE_AGENT_NAME ?? "cursor",
-  agentType: parsed.data.MEMORAONE_AGENT_TYPE ?? "agent",
-  source: parsed.data.MEMORAONE_SOURCE ?? "cursor",
-  ideType: parsed.data.MEMORAONE_IDE_TYPE,
-  devMode: parseBooleanFlag2(parsed.data.MEMORAONE_DEV_MODE, false),
-  worklogEnabled: parseBooleanFlag2(parsed.data.MEMORAONE_WORKLOG, true),
-  heartbeatEnabled: parseBooleanFlag2(parsed.data.MEMORAONE_HEARTBEAT, true),
-  // Cadence is owned by LOCAL_MCP_HEARTBEAT_INTERVAL_MS in heartbeat.ts (1_000).
-  // Env override is accepted for forward-compat but the timer path ignores it.
-  heartbeatIntervalMs: Number.parseInt(parsed.data.MEMORAONE_HEARTBEAT_INTERVAL_MS ?? "1000", 10)
-};
-
 // src/localState/connectCommand.ts
 var fs36 = __toESM(require("fs/promises"), 1);
 var path46 = __toESM(require("path"), 1);
@@ -4109,7 +4165,7 @@ function formatOptionalJetBrainsHandshakeUnavailableDetail(detail) {
 async function verifyJetBrainsMcpHandshake(options) {
   const timeoutMs = options.timeoutMs ?? 15e3;
   const { server } = options;
-  return new Promise((resolve46) => {
+  return new Promise((resolve47) => {
     let settled = false;
     const finish = (ok, detail, optionalUnavailable) => {
       if (settled) return;
@@ -4119,7 +4175,7 @@ async function verifyJetBrainsMcpHandshake(options) {
         child.kill();
       } catch {
       }
-      resolve46({ ok, detail, optionalUnavailable });
+      resolve47({ ok, detail, optionalUnavailable });
     };
     const child = (0, import_node_child_process4.spawn)(server.command, [...server.args], {
       env: { ...process.env, ...server.env },
@@ -10663,7 +10719,8 @@ async function runConnectCommand(options) {
         accessTokenExpiresAt: redeemed.access_token_expires_at ?? void 0,
         refreshTokenExpiresAt: redeemed.refresh_token_expires_at ?? void 0,
         installationPublicId: redeemed.installation_public_id,
-        projectId: redeemed.project_id
+        projectId: redeemed.project_id,
+        supabaseUserId: redeemed.supabase_user_id
       },
       { ...options.credentialOptions, clearKeys: ["clientRedeemKey"] }
     );
@@ -11108,7 +11165,7 @@ function html(res, status, body) {
   res.end(body);
 }
 function readUrlEncodedBody(req) {
-  return new Promise((resolve46, reject) => {
+  return new Promise((resolve47, reject) => {
     const chunks = [];
     let size = 0;
     req.on("data", (chunk) => {
@@ -11121,13 +11178,13 @@ function readUrlEncodedBody(req) {
       chunks.push(chunk);
     });
     req.on("end", () => {
-      resolve46(new URLSearchParams(Buffer.concat(chunks).toString("utf8")));
+      resolve47(new URLSearchParams(Buffer.concat(chunks).toString("utf8")));
     });
     req.on("error", reject);
   });
 }
 function readJsonBody(req) {
-  return new Promise((resolve46, reject) => {
+  return new Promise((resolve47, reject) => {
     const chunks = [];
     let size = 0;
     req.on("data", (chunk) => {
@@ -11142,11 +11199,11 @@ function readJsonBody(req) {
     req.on("end", () => {
       const raw = Buffer.concat(chunks).toString("utf8");
       if (!raw.trim()) {
-        resolve46({});
+        resolve47({});
         return;
       }
       try {
-        resolve46(JSON.parse(raw));
+        resolve47(JSON.parse(raw));
       } catch {
         reject(new Error("invalid json"));
       }
@@ -11158,12 +11215,12 @@ function opaqueId(prefix) {
   return `${prefix}${(0, import_node_crypto28.randomBytes)(24).toString("base64url")}`;
 }
 function delay(ms) {
-  return new Promise((resolve46) => setTimeout(resolve46, ms));
+  return new Promise((resolve47) => setTimeout(resolve47, ms));
 }
-function buildProtectedResourceMetadata(env2 = process.env) {
+function buildProtectedResourceMetadata(env2 = process.env, workspaceRoot) {
   return {
-    resource: getGatewayResourceBaseUrl(env2),
-    authorization_servers: [getGatewayIssuerUrl(env2)]
+    resource: workspaceRoot === void 0 ? getGatewayResourceBaseUrl(env2) : buildGatewayMcpUrl(workspaceRoot, env2),
+    authorization_servers: [getGatewayAuthorizationServerIssuerUrl(env2)]
   };
 }
 function buildAuthorizationServerMetadata(env2 = process.env) {
@@ -11287,11 +11344,38 @@ var GatewayOAuthSurface = class {
       return;
     }
   }
+  /**
+   * RFC 9728 PRM. Generic probes (no `ws`) advertise the bare /mcp resource.
+   * `?ws=` reuses gateway workspace identity; malformed/nonexistent fail closed.
+   */
+  async handleProtectedResourceMetadata(res, url) {
+    const wsOrError = getGatewayWsQueryParam(url);
+    if (wsOrError !== null && typeof wsOrError === "object" && wsOrError.ok === false) {
+      json(res, 404, {
+        error: "invalid_request",
+        error_description: "resource workspace is invalid"
+      });
+      return;
+    }
+    if (wsOrError === null) {
+      json(res, 200, buildProtectedResourceMetadata(this.env));
+      return;
+    }
+    const parsed2 = await parseGatewayWorkspaceRoot(wsOrError);
+    if (!parsed2.ok) {
+      json(res, 404, {
+        error: "invalid_request",
+        error_description: "resource workspace is invalid"
+      });
+      return;
+    }
+    json(res, 200, buildProtectedResourceMetadata(this.env, parsed2.workspaceRoot));
+  }
   async handleRequest(req, res, url) {
     const { pathname } = url;
     const method = req.method ?? "GET";
     if (method === "GET" && (pathname === GATEWAY_OAUTH_PRM_PATH || pathname === GATEWAY_OAUTH_PRM_ROOT_PATH)) {
-      json(res, 200, buildProtectedResourceMetadata(this.env));
+      await this.handleProtectedResourceMetadata(res, url);
       return true;
     }
     if (method === "GET" && pathname === GATEWAY_OAUTH_AS_METADATA_PATH) {
@@ -11769,11 +11853,11 @@ async function isRetryablePluginStartupBindingError(err, options = {}) {
   return false;
 }
 function defaultSleep(ms) {
-  return new Promise((resolve46) => {
-    setTimeout(resolve46, ms);
+  return new Promise((resolve47) => {
+    setTimeout(resolve47, ms);
   });
 }
-async function waitForPluginStartupBinding(resolve46, options = {}) {
+async function waitForPluginStartupBinding(resolve47, options = {}) {
   const now = options.now ?? Date.now;
   const sleep = options.sleep ?? defaultSleep;
   const timeoutMs = options.timeoutMs ?? PLUGIN_STARTUP_BINDING_WAIT_TIMEOUT_MS;
@@ -11783,7 +11867,7 @@ async function waitForPluginStartupBinding(resolve46, options = {}) {
   let lastError;
   while (true) {
     try {
-      const binding = await resolve46();
+      const binding = await resolve47();
       if (waitingLogged) {
         options.log?.(
           `local MemoraOne binding available after Cursor plugin pairing (${now() - startedAt}ms)`
@@ -12263,9 +12347,9 @@ function buildPersonalContextPath(parsed2) {
 }
 async function handleGetPersonalContext(client, args) {
   const parsed2 = getPersonalContextInputSchema.parse(args ?? {});
-  const path52 = buildPersonalContextPath(parsed2);
+  const path53 = buildPersonalContextPath(parsed2);
   try {
-    const result = await client.get(path52);
+    const result = await client.get(path53);
     return { ok: true, result };
   } catch (err) {
     if (err instanceof MemoraOneHttpError) {
@@ -12737,8 +12821,8 @@ async function handleCreateConceptVersion(client, args) {
   if (input2.tags !== void 0) body.tags = input2.tags;
   if (input2.parent_id !== void 0) body.parent_id = input2.parent_id;
   try {
-    const path52 = `/concepts/${encodeURIComponent(input2.id)}/versions`;
-    return projectCreatedConceptVersionResponse(await client.post(path52, body));
+    const path53 = `/concepts/${encodeURIComponent(input2.id)}/versions`;
+    return projectCreatedConceptVersionResponse(await client.post(path53, body));
   } catch (error) {
     rethrowToolRequestError("memora_create_concept_version", error);
   }
@@ -12773,7 +12857,7 @@ function handleBindingStatus(binding, options = {}) {
 // src/tools/handlers/finishSetup.ts
 var DEFAULT_POLL_INTERVAL_MS = 1e3;
 function delay2(ms) {
-  return new Promise((resolve46) => setTimeout(resolve46, ms));
+  return new Promise((resolve47) => setTimeout(resolve47, ms));
 }
 async function pollPairingSessionInBackground(session, pollIntervalMs, onReady) {
   for (; ; ) {
@@ -13066,8 +13150,8 @@ function registerToolWithWorklog(server, runtime, sessionContext, toolName, desc
 function createMemoraMcpServer(opts = {}) {
   let bindingReadyResolve = null;
   let bindingReadyReject = null;
-  const bindingReady = new Promise((resolve46, reject) => {
-    bindingReadyResolve = resolve46;
+  const bindingReady = new Promise((resolve47, reject) => {
+    bindingReadyResolve = resolve47;
     bindingReadyReject = reject;
   });
   const devMode = Boolean(config2.devMode);
@@ -13582,8 +13666,8 @@ function sendJsonRpcHttpError(res, status, message) {
   });
   res.end(body);
 }
-function sendUnauthorizedChallenge(res, env2) {
-  const challenge = buildGatewayMcpWwwAuthenticate(env2);
+function sendUnauthorizedChallenge(res, env2, workspaceRoot) {
+  const challenge = buildGatewayMcpWwwAuthenticate(env2, workspaceRoot);
   const body = "Unauthorized";
   res.writeHead(401, {
     "www-authenticate": challenge,
@@ -13737,7 +13821,7 @@ async function handleAuthenticatedGatewayMcpRequest(req, res, auth, options = {}
   const binding = await loadGatewayHttpBinding(workspaceRoot, options);
   if (!binding) {
     await closeGatewayMcpSessionsForWorkspace(workspaceRoot);
-    sendUnauthorizedChallenge(res, env2);
+    sendUnauthorizedChallenge(res, env2, workspaceRoot);
     return;
   }
   const sessionHeader = req.headers["mcp-session-id"];
@@ -13753,7 +13837,7 @@ async function handleAuthenticatedGatewayMcpRequest(req, res, auth, options = {}
       return;
     }
     if (!await ensureBindingStillValid(existing, options)) {
-      sendUnauthorizedChallenge(res, env2);
+      sendUnauthorizedChallenge(res, env2, workspaceRoot);
       return;
     }
     if (method === "POST") {
@@ -13810,8 +13894,8 @@ function extractBearerToken(authorizationHeader) {
   const token = match[1];
   return token || null;
 }
-function sendUnauthorized(res, env2) {
-  const challenge = buildGatewayMcpWwwAuthenticate(env2);
+function sendUnauthorized(res, env2, workspaceRoot) {
+  const challenge = buildGatewayMcpWwwAuthenticate(env2, workspaceRoot);
   const body = "Unauthorized";
   res.writeHead(401, {
     "www-authenticate": challenge,
@@ -13821,6 +13905,14 @@ function sendUnauthorized(res, env2) {
   });
   res.end(body);
 }
+function sendPairingGate(res, body) {
+  res.writeHead(403, {
+    "content-type": "text/plain; charset=utf-8",
+    "cache-control": "no-store",
+    "content-length": Buffer.byteLength(body)
+  });
+  res.end(body);
+}
 async function handleGatewayMcpAuthRequest(req, res, url, options = {}) {
   if (url.pathname !== GATEWAY_MCP_PATH) return false;
   const env2 = options.env ?? process.env;
@@ -13830,6 +13922,15 @@ async function handleGatewayMcpAuthRequest(req, res, url, options = {}) {
     env: options.env ?? options.ticketOptions?.env ?? env2,
     ...options.ticketOptions
   };
+  const homeDir = options.homeDir ?? ticketOptions.homeDir;
+  const identityDeps = options.identityDeps ?? ticketOptions.identityDeps;
+  const transportOptions = {
+    env: env2,
+    homeDir,
+    identityDeps,
+    ticketOptions,
+    createMemoraClient: options.createMemoraClient
+  };
   const parsed2 = await parseGatewayWorkspaceUrl(url);
   if (!parsed2.ok) {
     sendUnauthorized(res, env2);
@@ -13838,34 +13939,224 @@ async function handleGatewayMcpAuthRequest(req, res, url, options = {}) {
   const canonicalUrl = buildGatewayMcpUrl(parsed2.workspaceRoot, env2);
   const token = extractBearerToken(req.headers.authorization);
   if (!token) {
-    sendUnauthorized(res, env2);
+    sendUnauthorized(res, env2, parsed2.workspaceRoot);
     return true;
   }
-  const verified = await verifyGatewaySetupTicket(
-    token,
-    { canonicalUrl },
-    ticketOptions
-  );
-  if (!verified.ok) {
-    sendUnauthorized(res, env2);
+  if (token.startsWith("mgt_")) {
+    const verified = await verifyGatewaySetupTicket(
+      token,
+      { canonicalUrl },
+      ticketOptions
+    );
+    if (!verified.ok) {
+      sendUnauthorized(res, env2, parsed2.workspaceRoot);
+      return true;
+    }
+    await handleAuthenticatedGatewayMcpRequest(
+      req,
+      res,
+      {
+        workspaceRoot: verified.workspaceRoot,
+        canonicalUrl: verified.canonicalUrl
+      },
+      transportOptions
+    );
     return true;
   }
-  await handleAuthenticatedGatewayMcpRequest(
-    req,
-    res,
-    {
-      workspaceRoot: verified.workspaceRoot,
-      canonicalUrl: verified.canonicalUrl
-    },
-    {
-      env: env2,
-      homeDir: options.homeDir ?? ticketOptions.homeDir,
-      identityDeps: options.identityDeps ?? ticketOptions.identityDeps,
-      ticketOptions,
-      createMemoraClient: options.createMemoraClient
+  try {
+    const rawApiUrl = options.apiUrl;
+    if (typeof rawApiUrl !== "string" || rawApiUrl.trim().length === 0) {
+      sendUnauthorized(res, env2, parsed2.workspaceRoot);
+      return true;
     }
-  );
-  return true;
+    const apiUrl = rawApiUrl.replace(/\/+$/, "");
+    let binding = await lookupLocalBindingIdentity(parsed2.workspaceRoot, {
+      homeDir,
+      identityDeps
+    });
+    if (binding.status !== "resolved") {
+      await fetchAuthIdentity(apiUrl, token, {
+        fetchImpl: options.fetchImpl
+      });
+      const coordinator = options.unboundPairing;
+      if (!coordinator) {
+        sendUnauthorized(res, env2, parsed2.workspaceRoot);
+        return true;
+      }
+      const pairing = await coordinator.ensure(parsed2.workspaceRoot);
+      if (pairing.status === "pending") {
+        sendPairingGate(res, "Pairing pending");
+        return true;
+      }
+      if (pairing.status === "failed") {
+        sendPairingGate(res, "Setup required");
+        return true;
+      }
+      binding = await lookupLocalBindingIdentity(parsed2.workspaceRoot, {
+        homeDir,
+        identityDeps
+      });
+      if (binding.status !== "resolved") {
+        sendPairingGate(res, "Setup required");
+        return true;
+      }
+    }
+    const creds = await readInstallationCredentials(binding.repositoryBindingId);
+    const localOwnerId = creds?.supabaseUserId;
+    if (typeof localOwnerId !== "string" || localOwnerId.length === 0) {
+      sendUnauthorized(res, env2, parsed2.workspaceRoot);
+      return true;
+    }
+    const identity = await fetchAuthIdentity(apiUrl, token, {
+      fetchImpl: options.fetchImpl
+    });
+    if (identity.supabase_user_id !== localOwnerId) {
+      sendUnauthorized(res, env2, parsed2.workspaceRoot);
+      return true;
+    }
+    await handleAuthenticatedGatewayMcpRequest(
+      req,
+      res,
+      {
+        workspaceRoot: parsed2.workspaceRoot,
+        canonicalUrl
+      },
+      transportOptions
+    );
+    return true;
+  } catch {
+    sendUnauthorized(res, env2, parsed2.workspaceRoot);
+    return true;
+  }
+}
+
+// src/gatewayUnboundPairing.ts
+var path51 = __toESM(require("path"), 1);
+
+// src/openUrlInBrowser.ts
+var import_node_child_process7 = require("child_process");
+var import_node_util6 = require("util");
+var execFileAsync6 = (0, import_node_util6.promisify)(import_node_child_process7.execFile);
+function assertHttpOrHttpsUrl(url) {
+  let parsed2;
+  try {
+    parsed2 = new URL(url);
+  } catch {
+    throw new Error("URL must be an absolute http: or https: URL");
+  }
+  if (parsed2.protocol !== "http:" && parsed2.protocol !== "https:") {
+    throw new Error("URL must be an absolute http: or https: URL");
+  }
+}
+async function openUrlInBrowser(url, deps = {}) {
+  assertHttpOrHttpsUrl(url);
+  const platform2 = deps.platform ?? process.platform;
+  const execFileImpl = deps.execFile ?? execFileAsync6;
+  if (platform2 === "darwin") {
+    await execFileImpl("open", [url]);
+    return;
+  }
+  if (platform2 === "win32") {
+    await execFileImpl("cmd", ["/c", "start", "", url]);
+    return;
+  }
+  await execFileImpl("xdg-open", [url]);
+}
+
+// src/gatewayUnboundPairing.ts
+var DEFAULT_POLL_INTERVAL_MS2 = 1e3;
+function delay3(ms) {
+  return new Promise((resolve47) => {
+    const timer = setTimeout(resolve47, ms);
+    if (typeof timer.unref === "function") timer.unref();
+  });
+}
+function createGatewayUnboundPairingCoordinator(options = {}) {
+  const latches = /* @__PURE__ */ new Map();
+  const beginPairing = options.beginPairing ?? beginPluginRepositoryPairing;
+  const openUrl = options.openUrl ?? ((url) => openUrlInBrowser(url));
+  const pollIntervalMs = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS2;
+  const apiUrl = (options.apiUrl ?? config2.apiUrl).replace(/\/+$/, "");
+  async function pollInBackground(key, session, entry) {
+    for (; ; ) {
+      let result;
+      try {
+        result = await session.poll();
+      } catch {
+        entry.status = "failed";
+        return;
+      }
+      if (result.status === "pending") {
+        await delay3(pollIntervalMs);
+        continue;
+      }
+      if (result.status === "ready") {
+        entry.status = "ready";
+        latches.delete(key);
+        return;
+      }
+      if (result.status === "backend_failure" && result.operation === "poll") {
+        await delay3(pollIntervalMs);
+        continue;
+      }
+      entry.status = "failed";
+      return;
+    }
+  }
+  async function startPairing(key, entry) {
+    try {
+      const session = await beginPairing({
+        workspaceRoot: key,
+        source: "cursor",
+        apiUrl,
+        fetchImpl: options.fetchImpl,
+        connectOptions: {
+          homeDir: options.homeDir,
+          identityDeps: options.identityDeps,
+          fetchImpl: options.fetchImpl
+        }
+      });
+      const authorizationUrl = session.authorizationUrl;
+      if (typeof authorizationUrl === "string" && authorizationUrl.length > 0) {
+        try {
+          await openUrl(authorizationUrl);
+        } catch {
+          entry.status = "failed";
+          return;
+        }
+      } else {
+        entry.status = "failed";
+        return;
+      }
+      setImmediate(() => {
+        void pollInBackground(key, session, entry);
+      });
+    } catch {
+      entry.status = "failed";
+    }
+  }
+  return {
+    async ensure(workspaceRoot) {
+      const key = path51.resolve(workspaceRoot);
+      const existing = latches.get(key);
+      if (existing) {
+        await existing.startPromise;
+        return { status: existing.status };
+      }
+      let resolveStart;
+      const startPromise = new Promise((resolve47) => {
+        resolveStart = resolve47;
+      });
+      const entry = { status: "pending", startPromise };
+      latches.set(key, entry);
+      try {
+        await startPairing(key, entry);
+      } finally {
+        resolveStart();
+      }
+      return { status: entry.status };
+    }
+  };
 }
 
 // src/gateway.ts
@@ -13875,13 +14166,13 @@ var log3 = (msg) => {
 };
 function writePidFile(pid) {
   const dir = ensureBaseDir();
-  const pidPath = path51.join(dir, "gateway.pid");
+  const pidPath = path52.join(dir, "gateway.pid");
   fs38.writeFileSync(pidPath, `${pid}
 `, { encoding: "utf8", mode: 384 });
   return pidPath;
 }
 function removePidFile() {
-  const pidPath = path51.join(getMcpBaseDir(), "gateway.pid");
+  const pidPath = path52.join(getMcpBaseDir(), "gateway.pid");
   try {
     if (fs38.existsSync(pidPath)) {
       fs38.unlinkSync(pidPath);
@@ -13902,6 +14193,13 @@ async function probeExistingGatewayHealthy(env2 = process.env) {
 }
 function createGatewayRequestHandler(options = {}) {
   const oauth = options.oauth ?? createGatewayOAuthSurface(options);
+  const apiUrl = options.apiUrl ?? config2.apiUrl;
+  const unboundPairing = options.unboundPairing ?? createGatewayUnboundPairingCoordinator({
+    apiUrl,
+    fetchImpl: options.fetchImpl,
+    homeDir: options.homeDir,
+    identityDeps: options.identityDeps
+  });
   return (req, res) => {
     void (async () => {
       try {
@@ -13926,7 +14224,10 @@ function createGatewayRequestHandler(options = {}) {
           homeDir: options.homeDir,
           identityDeps: options.identityDeps,
           ticketOptions: options.ticketOptions,
-          createMemoraClient: options.createMemoraClient
+          createMemoraClient: options.createMemoraClient,
+          apiUrl,
+          fetchImpl: options.fetchImpl,
+          unboundPairing
         });
         if (mcpHandled) return;
         res.writeHead(404, { "content-type": "text/plain; charset=utf-8" });
@@ -13964,7 +14265,7 @@ async function runGateway(env2 = process.env, options = {}) {
   process.on("SIGINT", () => shutdownNow("SIGINT"));
   process.on("SIGTERM", () => shutdownNow("SIGTERM"));
   process.on("exit", removePidFile);
-  await new Promise((resolve46, reject) => {
+  await new Promise((resolve47, reject) => {
     server.once("error", async (err) => {
       if (err.code === "EADDRINUSE") {
         const healthy = await probeExistingGatewayHealthy(env2);
@@ -13991,7 +14292,7 @@ async function runGateway(env2 = process.env, options = {}) {
       }
       const pidPath = writePidFile(process.pid);
       log3(`gateway started pid=${process.pid} listening on http://${host}:${port} pidFile=${pidPath}`);
-      resolve46();
+      resolve47();
     });
   });
 }