@introspection-ai/recipes 0.18.0 → 0.19.0

package/dist/mcp-chunks/chunk-3IZQW4H4.js

@@ -0,0 +1,929 @@
+import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url);
+import {
+  clearVaultEntry,
+  clearVaultTokensIfMatching,
+  getOAuthVaultPath,
+  isStoredOAuthClientInformation,
+  isStoredOAuthTokens,
+  loadVaultEntryForRecovery,
+  reconcileVaultServerUrl,
+  sameOAuthClientGeneration,
+  sameOAuthClientValue,
+  sameOAuthTokenGeneration,
+  sameOAuthTokenValue,
+  saveVaultEntry,
+  withHiddenOAuthClientGeneration,
+  withHiddenOAuthTokenGeneration,
+  withOAuthClientGeneration,
+  withOAuthTokenGeneration
+} from "./chunk-C2PQFLWS.js";
+import {
+  checkResourceAllowed,
+  discoverOAuthServerInfo,
+  refreshAuthorization,
+  resourceUrlFromServerUrl
+} from "./chunk-YPJ5EHXR.js";
+import {
+  readJsonFile,
+  withFileLock,
+  writeJsonFile,
+  writeTextFileAtomic
+} from "./chunk-7A63PAGP.js";
+import {
+  legacyMcporterDir
+} from "./chunk-FWP4RACK.js";
+
+// node_modules/.pnpm/mcporter@0.13.0/node_modules/mcporter/dist/oauth-persistence.js
+import fs2 from "node:fs/promises";
+
+// node_modules/.pnpm/mcporter@0.13.0/node_modules/mcporter/dist/oauth-persistence-stores.js
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+function withStoredExpiry(tokens) {
+  const stored = tokens;
+  if (typeof stored.expires_at === "number" || typeof stored.expiresAt === "number") {
+    return tokens;
+  }
+  if (typeof tokens.expires_in === "number" && Number.isFinite(tokens.expires_in)) {
+    return {
+      ...tokens,
+      expires_at: Math.floor(Date.now() / 1e3) + tokens.expires_in
+    };
+  }
+  return tokens;
+}
+function prepareStoredTokens(tokens) {
+  return withStoredExpiry(withOAuthTokenGeneration(tokens));
+}
+var DirectoryPersistence = class {
+  root;
+  logger;
+  serverUrl;
+  skipUrlMarkerWhenMissing;
+  tokenPath;
+  clientInfoPath;
+  codeVerifierPath;
+  statePath;
+  serverUrlPath;
+  discoveryStatePath;
+  authorizationServerUrlPath;
+  resourceUrlPath;
+  constructor(root, logger, serverUrl, skipUrlMarkerWhenMissing = false) {
+    this.root = root;
+    this.logger = logger;
+    this.serverUrl = serverUrl;
+    this.skipUrlMarkerWhenMissing = skipUrlMarkerWhenMissing;
+    this.tokenPath = path.join(root, "tokens.json");
+    this.clientInfoPath = path.join(root, "client.json");
+    this.codeVerifierPath = path.join(root, "code_verifier.txt");
+    this.statePath = path.join(root, "state.txt");
+    this.serverUrlPath = path.join(root, "server_url.txt");
+    this.discoveryStatePath = path.join(root, "discovery.json");
+    this.authorizationServerUrlPath = path.join(root, "authorization_server_url.txt");
+    this.resourceUrlPath = path.join(root, "resource_url.txt");
+  }
+  describe() {
+    return this.root;
+  }
+  async ensureDir() {
+    await fs.mkdir(this.root, { recursive: true });
+  }
+  async reconcileServerUrl() {
+    if (!this.serverUrl) {
+      return;
+    }
+    const serverUrl = this.serverUrl;
+    if (this.skipUrlMarkerWhenMissing) {
+      try {
+        await fs.access(this.root);
+      } catch (error) {
+        if (error.code === "ENOENT") {
+          return;
+        }
+        throw error;
+      }
+    }
+    await this.ensureDir();
+    await withFileLock(this.tokenPath, async () => {
+      let previousUrl;
+      try {
+        previousUrl = (await fs.readFile(this.serverUrlPath, "utf8")).trim();
+      } catch (error) {
+        if (error.code !== "ENOENT") {
+          throw error;
+        }
+      }
+      if (previousUrl === serverUrl) {
+        return;
+      }
+      if (previousUrl !== void 0) {
+        await this.clearFiles("all");
+      }
+      await writeTextFileAtomic(this.serverUrlPath, serverUrl);
+    });
+  }
+  async readSnapshot() {
+    await this.reconcileServerUrl();
+    const [tokens, clientInfo, codeVerifier, state, discoveryState, authorizationServerUrl, resourceUrl] = await Promise.all([
+      this.readTokensAfterReconcile(),
+      this.readClientInfoAfterReconcile(),
+      this.readCodeVerifierAfterReconcile(),
+      this.readStateAfterReconcile(),
+      this.readDiscoveryStateAfterReconcile(),
+      this.readTextAfterReconcile(this.authorizationServerUrlPath),
+      this.readTextAfterReconcile(this.resourceUrlPath)
+    ]);
+    return { tokens, clientInfo, codeVerifier, state, discoveryState, authorizationServerUrl, resourceUrl };
+  }
+  async readTokens() {
+    await this.reconcileServerUrl();
+    return await this.readTokensAfterReconcile();
+  }
+  async readTokensAfterReconcile() {
+    const tokens = await this.readJsonOrUndefined(this.tokenPath);
+    return isStoredOAuthTokens(tokens) ? withHiddenOAuthTokenGeneration(tokens) : void 0;
+  }
+  async saveTokens(tokens) {
+    await this.reconcileServerUrl();
+    await this.ensureDir();
+    await withFileLock(this.tokenPath, async () => {
+      await writeJsonFile(this.tokenPath, prepareStoredTokens(tokens));
+    });
+    this.logger?.debug?.(`Saved tokens to ${this.tokenPath}`);
+  }
+  async clearRejectedCredentials(expectedTokens, expectedClientInfo) {
+    await this.reconcileServerUrl();
+    await withFileLock(this.tokenPath, async () => {
+      if (expectedTokens) {
+        const current = await this.readJsonOrUndefined(this.tokenPath);
+        if (sameOAuthTokenGeneration(current, expectedTokens)) {
+          await this.unlinkIfPresent(this.tokenPath);
+        }
+      }
+      if (expectedClientInfo) {
+        const currentClientInfo = await this.readJsonOrUndefined(this.clientInfoPath);
+        if (sameOAuthClientGeneration(currentClientInfo, expectedClientInfo)) {
+          await this.unlinkIfPresent(this.clientInfoPath);
+        }
+      }
+    });
+  }
+  async unlinkIfPresent(file) {
+    try {
+      await fs.unlink(file);
+    } catch (error) {
+      if (error.code !== "ENOENT") {
+        throw error;
+      }
+    }
+  }
+  async readClientInfo() {
+    await this.reconcileServerUrl();
+    return await this.readClientInfoAfterReconcile();
+  }
+  async readClientInfoAfterReconcile() {
+    const info = await this.readJsonOrUndefined(this.clientInfoPath);
+    return isStoredOAuthClientInformation(info) ? withHiddenOAuthClientGeneration(info) : void 0;
+  }
+  async saveClientInfo(info) {
+    await this.reconcileServerUrl();
+    await this.ensureDir();
+    await withFileLock(this.tokenPath, async () => {
+      await writeJsonFile(this.clientInfoPath, withOAuthClientGeneration(info));
+    });
+  }
+  async readCodeVerifier() {
+    await this.reconcileServerUrl();
+    return await this.readCodeVerifierAfterReconcile();
+  }
+  async readCodeVerifierAfterReconcile() {
+    try {
+      return (await fs.readFile(this.codeVerifierPath, "utf8")).trim();
+    } catch (error) {
+      if (error.code === "ENOENT") {
+        return void 0;
+      }
+      throw error;
+    }
+  }
+  async saveCodeVerifier(value) {
+    await this.reconcileServerUrl();
+    await this.ensureDir();
+    await writeTextFileAtomic(this.codeVerifierPath, value);
+  }
+  async readState() {
+    await this.reconcileServerUrl();
+    return await this.readStateAfterReconcile();
+  }
+  async readStateAfterReconcile() {
+    return readJsonFile(this.statePath);
+  }
+  // A present-but-corrupt credential cache (tokens/client) means "no usable
+  // credentials": degrade to re-auth instead of crashing the connection,
+  // mirroring VaultPersistence and the daemon/server-proxy readers. Genuine I/O
+  // faults still propagate (readJsonFile re-throws everything except ENOENT).
+  // OAuth state is intentionally excluded so its CSRF check still fails closed.
+  async readJsonOrUndefined(filePath) {
+    try {
+      return await readJsonFile(filePath);
+    } catch (error) {
+      if (!(error instanceof SyntaxError)) {
+        throw error;
+      }
+      this.logger?.debug?.(`Ignoring corrupt OAuth cache file ${filePath}: ${error.message}`);
+      return void 0;
+    }
+  }
+  async saveState(value) {
+    await this.reconcileServerUrl();
+    await this.ensureDir();
+    await writeJsonFile(this.statePath, value);
+  }
+  async readDiscoveryState() {
+    await this.reconcileServerUrl();
+    return this.readDiscoveryStateAfterReconcile();
+  }
+  async readDiscoveryStateAfterReconcile() {
+    return readJsonFile(this.discoveryStatePath);
+  }
+  async saveDiscoveryState(value) {
+    await this.reconcileServerUrl();
+    await this.ensureDir();
+    await writeJsonFile(this.discoveryStatePath, value);
+  }
+  async readAuthorizationServerUrl() {
+    await this.reconcileServerUrl();
+    return this.readTextAfterReconcile(this.authorizationServerUrlPath);
+  }
+  async saveAuthorizationServerUrl(value) {
+    await this.reconcileServerUrl();
+    await this.ensureDir();
+    await writeTextFileAtomic(this.authorizationServerUrlPath, value);
+  }
+  async readResourceUrl() {
+    await this.reconcileServerUrl();
+    return this.readTextAfterReconcile(this.resourceUrlPath);
+  }
+  async saveResourceUrl(value) {
+    await this.reconcileServerUrl();
+    await this.ensureDir();
+    await writeTextFileAtomic(this.resourceUrlPath, value);
+  }
+  async readTextAfterReconcile(filePath) {
+    try {
+      return (await fs.readFile(filePath, "utf8")).trim() || void 0;
+    } catch (error) {
+      if (error.code === "ENOENT")
+        return void 0;
+      throw error;
+    }
+  }
+  async clear(scope) {
+    await this.reconcileServerUrl();
+    await this.clearFiles(scope);
+  }
+  async clearFiles(scope) {
+    const files = [];
+    if (scope === "all" || scope === "tokens") {
+      files.push(this.tokenPath);
+    }
+    if (scope === "all" || scope === "client") {
+      files.push(this.clientInfoPath);
+    }
+    if (scope === "all" || scope === "verifier") {
+      files.push(this.codeVerifierPath);
+    }
+    if (scope === "all" || scope === "state") {
+      files.push(this.statePath);
+    }
+    if (scope === "all" || scope === "discovery") {
+      files.push(this.discoveryStatePath, this.authorizationServerUrlPath, this.resourceUrlPath);
+    }
+    await Promise.all(files.map((file) => this.unlinkIfPresent(file)));
+  }
+};
+var VaultPersistence = class {
+  definition;
+  tokenSnapshots;
+  clientSnapshots;
+  constructor(definition) {
+    this.definition = definition;
+  }
+  describe() {
+    return `${getOAuthVaultPath()} (vault)`;
+  }
+  async reconcileServerUrl() {
+    await reconcileVaultServerUrl(this.definition);
+  }
+  async readSnapshot() {
+    await this.reconcileServerUrl();
+    const recovery = await loadVaultEntryForRecovery(this.definition);
+    this.tokenSnapshots = recovery.tokenSnapshots;
+    this.clientSnapshots = recovery.clientSnapshots;
+    return {
+      tokens: recovery.entry?.tokens,
+      clientInfo: recovery.entry?.clientInfo,
+      codeVerifier: recovery.entry?.codeVerifier,
+      state: recovery.entry?.state,
+      discoveryState: recovery.entry?.discoveryState,
+      authorizationServerUrl: recovery.entry?.authorizationServerUrl,
+      resourceUrl: recovery.entry?.resourceUrl
+    };
+  }
+  async readTokens() {
+    const snapshot = await this.readSnapshot();
+    return snapshot.tokens;
+  }
+  async saveTokens(tokens) {
+    await this.reconcileServerUrl();
+    await saveVaultEntry(this.definition, { tokens: prepareStoredTokens(tokens) });
+  }
+  async readClientInfo() {
+    const snapshot = await this.readSnapshot();
+    return snapshot.clientInfo;
+  }
+  async saveClientInfo(info) {
+    await this.reconcileServerUrl();
+    await saveVaultEntry(this.definition, { clientInfo: info });
+  }
+  async readCodeVerifier() {
+    const snapshot = await this.readSnapshot();
+    return snapshot.codeVerifier;
+  }
+  async saveCodeVerifier(value) {
+    await this.reconcileServerUrl();
+    await saveVaultEntry(this.definition, { codeVerifier: value });
+  }
+  async readState() {
+    const snapshot = await this.readSnapshot();
+    return snapshot.state;
+  }
+  async saveState(value) {
+    await this.reconcileServerUrl();
+    await saveVaultEntry(this.definition, { state: value });
+  }
+  async readDiscoveryState() {
+    return (await this.readSnapshot()).discoveryState;
+  }
+  async saveDiscoveryState(value) {
+    await this.reconcileServerUrl();
+    await saveVaultEntry(this.definition, { discoveryState: value });
+  }
+  async readAuthorizationServerUrl() {
+    return (await this.readSnapshot()).authorizationServerUrl;
+  }
+  async saveAuthorizationServerUrl(value) {
+    await this.reconcileServerUrl();
+    await saveVaultEntry(this.definition, { authorizationServerUrl: value });
+  }
+  async readResourceUrl() {
+    return (await this.readSnapshot()).resourceUrl;
+  }
+  async saveResourceUrl(value) {
+    await this.reconcileServerUrl();
+    await saveVaultEntry(this.definition, { resourceUrl: value });
+  }
+  async clear(scope) {
+    await this.reconcileServerUrl();
+    await clearVaultEntry(this.definition, scope);
+  }
+  async clearRejectedCredentials(expectedTokens, expectedClientInfo) {
+    await this.reconcileServerUrl();
+    await clearVaultTokensIfMatching(this.definition, expectedTokens, expectedClientInfo, expectedTokens ? this.tokenSnapshots : void 0, expectedClientInfo ? this.clientSnapshots : void 0);
+  }
+};
+var CompositePersistence = class {
+  stores;
+  recoveryTokenSnapshots = /* @__PURE__ */ new Map();
+  recoveryClientSnapshots = /* @__PURE__ */ new Map();
+  recoveryTokenSource;
+  recoveryClientSource;
+  constructor(stores) {
+    this.stores = stores;
+  }
+  describe() {
+    return this.stores.map((store) => store.describe()).join(" + ");
+  }
+  async readSnapshot() {
+    const snapshots = await Promise.all(this.stores.map((store) => store.readSnapshot()));
+    const tokens = this.firstSnapshotValue(snapshots, "tokens");
+    const clientInfo = this.firstSnapshotValue(snapshots, "clientInfo");
+    this.recoveryTokenSnapshots.clear();
+    this.recoveryClientSnapshots.clear();
+    for (const [index, snapshot] of snapshots.entries()) {
+      const store = this.stores[index];
+      this.recoveryTokenSnapshots.set(store, snapshot.tokens);
+      this.recoveryClientSnapshots.set(store, snapshot.clientInfo);
+    }
+    this.recoveryTokenSource = tokens.source;
+    this.recoveryClientSource = clientInfo.source;
+    return {
+      tokens: tokens.value,
+      clientInfo: clientInfo.value,
+      codeVerifier: this.firstSnapshotValue(snapshots, "codeVerifier").value,
+      state: this.firstSnapshotValue(snapshots, "state").value,
+      discoveryState: this.firstSnapshotValue(snapshots, "discoveryState").value,
+      authorizationServerUrl: this.firstSnapshotValue(snapshots, "authorizationServerUrl").value,
+      resourceUrl: this.firstSnapshotValue(snapshots, "resourceUrl").value
+    };
+  }
+  firstSnapshotValue(snapshots, field) {
+    for (const [index, snapshot] of snapshots.entries()) {
+      if (snapshot[field] !== void 0) {
+        return { value: snapshot[field], source: this.stores[index] };
+      }
+    }
+    return { value: void 0, source: void 0 };
+  }
+  async readTokens() {
+    const result = await this.readRecoveryValues((store) => store.readTokens(), this.recoveryTokenSnapshots);
+    this.recoveryTokenSource = result.source;
+    return result.value;
+  }
+  async saveTokens(tokens) {
+    const stored = prepareStoredTokens(tokens);
+    await Promise.all(this.stores.map((store) => store.saveTokens(stored)));
+  }
+  async clearRejectedCredentials(expectedTokens, expectedClientInfo) {
+    await Promise.all(this.stores.map((store) => {
+      const storedTokenSnapshot = expectedTokens ? this.recoveryTokenSnapshots.get(store) : void 0;
+      const tokenSnapshot = expectedTokens && storedTokenSnapshot && (store === this.recoveryTokenSource || sameOAuthTokenValue(storedTokenSnapshot, expectedTokens)) ? storedTokenSnapshot : void 0;
+      const storedClientSnapshot = expectedClientInfo ? this.recoveryClientSnapshots.get(store) : void 0;
+      const clientSnapshot = expectedClientInfo && storedClientSnapshot && (store === this.recoveryClientSource || sameOAuthClientValue(storedClientSnapshot, expectedClientInfo)) ? storedClientSnapshot : void 0;
+      return tokenSnapshot || clientSnapshot ? store.clearRejectedCredentials(tokenSnapshot, clientSnapshot) : Promise.resolve();
+    }));
+  }
+  async readClientInfo() {
+    const result = await this.readRecoveryValues((store) => store.readClientInfo(), this.recoveryClientSnapshots);
+    this.recoveryClientSource = result.source;
+    return result.value;
+  }
+  async readRecoveryValues(read, snapshots) {
+    const results = await Promise.allSettled(this.stores.map((store) => read(store)));
+    snapshots.clear();
+    let value;
+    let source;
+    for (const [index, result] of results.entries()) {
+      const store = this.stores[index];
+      if (result.status === "rejected") {
+        if (!source) {
+          throw result.reason;
+        }
+        continue;
+      }
+      snapshots.set(store, result.value);
+      if (!source && result.value !== void 0) {
+        source = store;
+        value = result.value;
+      }
+    }
+    return { value, source };
+  }
+  async saveClientInfo(info) {
+    const stored = withOAuthClientGeneration(info);
+    await Promise.all(this.stores.map((store) => store.saveClientInfo(stored)));
+  }
+  async readCodeVerifier() {
+    for (const store of this.stores) {
+      const result = await store.readCodeVerifier();
+      if (result) {
+        return result;
+      }
+    }
+    return void 0;
+  }
+  async saveCodeVerifier(value) {
+    await Promise.all(this.stores.map((store) => store.saveCodeVerifier(value)));
+  }
+  async readState() {
+    for (const store of this.stores) {
+      const result = await store.readState();
+      if (result) {
+        return result;
+      }
+    }
+    return void 0;
+  }
+  async saveState(value) {
+    await Promise.all(this.stores.map((store) => store.saveState(value)));
+  }
+  async readDiscoveryState() {
+    return this.readFirst((store) => store.readDiscoveryState());
+  }
+  async saveDiscoveryState(value) {
+    await Promise.all(this.stores.map((store) => store.saveDiscoveryState(value)));
+  }
+  async readAuthorizationServerUrl() {
+    return this.readFirst((store) => store.readAuthorizationServerUrl());
+  }
+  async saveAuthorizationServerUrl(value) {
+    await Promise.all(this.stores.map((store) => store.saveAuthorizationServerUrl(value)));
+  }
+  async readResourceUrl() {
+    return this.readFirst((store) => store.readResourceUrl());
+  }
+  async saveResourceUrl(value) {
+    await Promise.all(this.stores.map((store) => store.saveResourceUrl(value)));
+  }
+  async readFirst(read) {
+    for (const store of this.stores) {
+      const value = await read(store);
+      if (value !== void 0)
+        return value;
+    }
+    return void 0;
+  }
+  async clear(scope) {
+    await Promise.all(this.stores.map((store) => store.clear(scope)));
+  }
+};
+async function createOAuthPersistenceStores(definition, logger) {
+  const vault = new VaultPersistence(definition);
+  const stores = [vault];
+  const serverUrl = definition.command.kind === "http" ? definition.command.url.toString() : void 0;
+  if (definition.tokenCacheDir) {
+    stores.unshift(new DirectoryPersistence(definition.tokenCacheDir, logger, serverUrl));
+  }
+  const legacyDir = path.join(legacyMcporterDir(), definition.name);
+  if (!definition.tokenCacheDir) {
+    const legacy = new DirectoryPersistence(legacyDir, logger, serverUrl, true);
+    const snapshot = await legacy.readSnapshot();
+    if (snapshot.tokens || snapshot.clientInfo || snapshot.codeVerifier || snapshot.state || snapshot.discoveryState || snapshot.authorizationServerUrl || snapshot.resourceUrl) {
+      if (snapshot.tokens) {
+        await vault.saveTokens(snapshot.tokens);
+      }
+      if (snapshot.clientInfo) {
+        await vault.saveClientInfo(snapshot.clientInfo);
+      }
+      if (snapshot.codeVerifier) {
+        await vault.saveCodeVerifier(snapshot.codeVerifier);
+      }
+      if (snapshot.state) {
+        await vault.saveState(snapshot.state);
+      }
+      if (snapshot.discoveryState) {
+        await vault.saveDiscoveryState(snapshot.discoveryState);
+      }
+      if (snapshot.authorizationServerUrl) {
+        await vault.saveAuthorizationServerUrl(snapshot.authorizationServerUrl);
+      }
+      if (snapshot.resourceUrl) {
+        await vault.saveResourceUrl(snapshot.resourceUrl);
+      }
+      logger?.info?.(`Migrated legacy OAuth cache for '${definition.name}' into vault.`);
+    }
+  }
+  return stores.length === 1 ? vault : new CompositePersistence(stores);
+}
+async function clearLegacyOAuthArtifacts(definition, logger, scope) {
+  const legacyDir = path.join(legacyMcporterDir(), definition.name);
+  if (!definition.tokenCacheDir || legacyDir !== definition.tokenCacheDir) {
+    const legacy = new DirectoryPersistence(legacyDir, logger);
+    await legacy.clear(scope);
+  }
+  const legacyFiles = [];
+  if (definition.name.toLowerCase() === "gmail") {
+    legacyFiles.push(path.join(os.homedir(), ".gmail-mcp", "credentials.json"));
+  }
+  await Promise.all(legacyFiles.map(async (file) => {
+    try {
+      await fs.unlink(file);
+      logger?.info?.(`Cleared legacy OAuth cache file ${file}`);
+    } catch (error) {
+      if (error.code !== "ENOENT") {
+        throw error;
+      }
+    }
+  }));
+}
+
+// node_modules/.pnpm/mcporter@0.13.0/node_modules/mcporter/dist/oauth-token-refresh.js
+import { Buffer } from "node:buffer";
+
+// node_modules/.pnpm/mcporter@0.13.0/node_modules/mcporter/dist/oauth-client-info.js
+function buildStaticClientInformation(definition, options = {}) {
+  if (!definition.oauthClientId) {
+    return void 0;
+  }
+  const clientSecret = resolveOAuthClientSecret(definition);
+  return {
+    client_id: definition.oauthClientId,
+    ...clientSecret ? { client_secret: clientSecret } : {},
+    ...options.redirectUrl ? { redirect_uris: [options.redirectUrl.toString()] } : {},
+    grant_types: ["authorization_code", "refresh_token"],
+    response_types: ["code"],
+    ...definition.oauthTokenEndpointAuthMethod ? { token_endpoint_auth_method: definition.oauthTokenEndpointAuthMethod } : {}
+  };
+}
+function resolveOAuthClientSecret(definition, options = {}) {
+  if (definition.oauthClientSecretEnv) {
+    const value = process.env[definition.oauthClientSecretEnv];
+    if (!value || options.rejectBlank && value.trim().length === 0) {
+      throw new Error(`Environment variable '${definition.oauthClientSecretEnv}' is required for OAuth client secret.`);
+    }
+    return value;
+  }
+  return definition.oauthClientSecret;
+}
+
+// node_modules/.pnpm/mcporter@0.13.0/node_modules/mcporter/dist/oauth-token-refresh.js
+var TOKEN_EXPIRY_SKEW_SECONDS = 60;
+var OAuthIssuerMismatchError = class extends Error {
+};
+function tokenExpirySeconds(tokens) {
+  const stored = tokens;
+  for (const candidate of [stored.expires_at, stored.expiresAt]) {
+    if (typeof candidate === "number" && Number.isFinite(candidate)) {
+      return candidate;
+    }
+  }
+  return void 0;
+}
+function cachedTokensChanged(original, current) {
+  if (!current || typeof current.access_token !== "string" || current.access_token.trim().length === 0) {
+    return false;
+  }
+  return !sameOAuthTokenGeneration(current, original);
+}
+function shouldRefreshCachedToken(tokens, skewSeconds = TOKEN_EXPIRY_SKEW_SECONDS) {
+  const expiresAt = tokenExpirySeconds(tokens);
+  if (expiresAt !== void 0) {
+    return expiresAt <= Math.floor(Date.now() / 1e3) + skewSeconds;
+  }
+  return typeof tokens.expires_in === "number" && typeof tokens.refresh_token === "string";
+}
+function resourceForRefresh(serverUrl, resourceMetadata) {
+  if (!resourceMetadata) {
+    return void 0;
+  }
+  const defaultResource = resourceUrlFromServerUrl(serverUrl);
+  if (!checkResourceAllowed({ requestedResource: defaultResource, configuredResource: resourceMetadata.resource })) {
+    throw new Error(`Protected resource ${resourceMetadata.resource} does not match expected ${defaultResource} (or origin)`);
+  }
+  return new URL(resourceMetadata.resource);
+}
+function normalizedIssuer(value) {
+  if (typeof value !== "string" || value.length === 0) {
+    return void 0;
+  }
+  return value.endsWith("/") ? value.slice(0, -1) : value;
+}
+async function assertRefreshIssuerBinding(definition, persistence, tokens, clientInformation, receivedIssuer) {
+  const expectedIssuer = normalizedIssuer(tokens.issuer) ?? normalizedIssuer(clientInformation.issuer);
+  if (!expectedIssuer || expectedIssuer === normalizedIssuer(receivedIssuer)) {
+    return;
+  }
+  await Promise.all([persistence.clear("tokens"), persistence.clear("client")]);
+  throw new OAuthIssuerMismatchError(`OAuth issuer changed for '${definition.name}': expected ${expectedIssuer}, received ${receivedIssuer}. Discarded cached credentials; run 'mcporter auth ${definition.name}' to reauthorize.`);
+}
+function unrecoverableOAuthRefreshCode(error) {
+  const errorCode = oauthErrorCode(error);
+  if (errorCode && ["invalid_client", "invalid_grant", "unauthorized_client"].includes(errorCode)) {
+    return errorCode;
+  }
+  return void 0;
+}
+async function oauthErrorCodeFromResponse(response) {
+  try {
+    const payload = await response.json();
+    if (payload && typeof payload.error === "string" && payload.error.length > 0) {
+      return payload.error.toLowerCase();
+    }
+  } catch {
+  }
+  return void 0;
+}
+function oauthErrorCode(error) {
+  if (!error || typeof error !== "object") {
+    return void 0;
+  }
+  const { errorCode, name } = error;
+  if (typeof errorCode === "string" && errorCode.length > 0) {
+    return errorCode.toLowerCase();
+  }
+  if (typeof name === "string") {
+    const normalized = name.toLowerCase();
+    if (normalized === "invalidclienterror") {
+      return "invalid_client";
+    }
+    if (normalized === "invalidgranterror") {
+      return "invalid_grant";
+    }
+    if (normalized === "unauthorizedclienterror") {
+      return "unauthorized_client";
+    }
+  }
+  return void 0;
+}
+async function readCachedAccessTokenWithPersistence(definition, persistence, logger) {
+  const tokens = await persistence.readTokens();
+  if (!tokens || typeof tokens.access_token !== "string" || tokens.access_token.trim().length === 0) {
+    return void 0;
+  }
+  if (definition.auth === "refreshable_bearer") {
+    return await readExplicitRefreshableBearerToken(definition, persistence, tokens, logger);
+  }
+  if (!shouldRefreshCachedToken(tokens)) {
+    return tokens.access_token;
+  }
+  if (typeof tokens.refresh_token !== "string" || tokens.refresh_token.trim().length === 0) {
+    return tokens.access_token;
+  }
+  let persistedClientInformation;
+  try {
+    const staticClientInformation = buildStaticClientInformation(definition);
+    persistedClientInformation = staticClientInformation ? void 0 : await persistence.readClientInfo();
+    const clientInformation = staticClientInformation ?? persistedClientInformation;
+    if (!clientInformation) {
+      logger?.debug?.(`Cached OAuth token for '${definition.name}' is expired, but no client information is available.`);
+      return tokens.access_token;
+    }
+    if (definition.command.kind !== "http") {
+      return tokens.access_token;
+    }
+    const serverInfo = await discoverOAuthServerInfo(definition.command.url);
+    await assertRefreshIssuerBinding(definition, persistence, tokens, clientInformation, serverInfo.authorizationServerUrl);
+    const resource = resourceForRefresh(definition.command.url, serverInfo.resourceMetadata);
+    const refreshed = await refreshAuthorization(serverInfo.authorizationServerUrl, {
+      metadata: serverInfo.authorizationServerMetadata,
+      clientInformation,
+      refreshToken: tokens.refresh_token,
+      ...resource ? { resource } : {}
+    });
+    await persistence.saveTokens({ ...refreshed, issuer: serverInfo.authorizationServerUrl });
+    logger?.debug?.(`Refreshed cached OAuth access token for '${definition.name}' (non-interactive).`);
+    return refreshed.access_token;
+  } catch (error) {
+    logger?.debug?.(`Failed to refresh cached OAuth token for '${definition.name}' non-interactively: ${error instanceof Error ? error.message : String(error)}`);
+    if (error instanceof OAuthIssuerMismatchError) {
+      throw error;
+    }
+    const unrecoverableCode = unrecoverableOAuthRefreshCode(error);
+    if (unrecoverableCode) {
+      return await recoverFromUnrecoverableRefresh(definition, persistence, tokens, unrecoverableCode, "OAuth", logger, persistedClientInformation);
+    }
+    return tokens.access_token;
+  }
+}
+async function recoverFromUnrecoverableRefresh(definition, persistence, tokens, unrecoverableCode, tokenKind, logger, rejectedClientInformation) {
+  const clientToClear = unrecoverableCode === "invalid_grant" ? void 0 : rejectedClientInformation;
+  await persistence.clearRejectedCredentials(tokens, clientToClear);
+  await clearLegacyOAuthArtifacts(definition, logger, unrecoverableCode === "invalid_grant" ? "tokens" : "all");
+  const latestTokens = await persistence.readTokens();
+  if (latestTokens && cachedTokensChanged(tokens, latestTokens)) {
+    logger?.debug?.(`Kept cached ${tokenKind} token for '${definition.name}' because another refresh updated it first.`);
+    return latestTokens.access_token;
+  }
+  logger?.debug?.(`Cleared cached ${tokenKind} ${unrecoverableCode === "invalid_grant" ? "token" : "credentials"} for '${definition.name}' after unrecoverable refresh failure.`);
+  return void 0;
+}
+async function readExplicitRefreshableBearerToken(definition, persistence, tokens, logger) {
+  const refresh = definition.refresh;
+  const skewSeconds = refresh?.refreshSkewSeconds ?? TOKEN_EXPIRY_SKEW_SECONDS;
+  if (!shouldRefreshCachedToken(tokens, skewSeconds)) {
+    return tokens.access_token;
+  }
+  if (!refresh) {
+    throw new Error(`Cached bearer token for '${definition.name}' is expired, but refresh is not configured.`);
+  }
+  if (typeof tokens.refresh_token !== "string" || tokens.refresh_token.trim().length === 0) {
+    throw new Error(`Cached bearer token for '${definition.name}' is expired, but no refresh_token is available.`);
+  }
+  try {
+    const refreshed = await refreshBearerToken(definition, tokens.refresh_token);
+    await persistence.saveTokens(refreshed);
+    logger?.debug?.(`Refreshed bearer access token for '${definition.name}' (non-interactive).`);
+    return refreshed.access_token;
+  } catch (error) {
+    logger?.debug?.(`Failed to refresh bearer token for '${definition.name}' non-interactively: ${error instanceof Error ? error.message : String(error)}`);
+    const unrecoverableCode = unrecoverableOAuthRefreshCode(error);
+    if (unrecoverableCode) {
+      const winnerToken = await recoverFromUnrecoverableRefresh(definition, persistence, tokens, unrecoverableCode, "bearer", logger);
+      if (winnerToken) {
+        return winnerToken;
+      }
+    }
+    throw new Error(`Failed to refresh cached bearer token for '${definition.name}': ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+  }
+}
+async function refreshBearerToken(definition, refreshToken) {
+  const refresh = definition.refresh;
+  if (!refresh) {
+    throw new Error("Missing refresh configuration.");
+  }
+  const clientId = readEnvOrConfig(refresh.clientIdEnv, definition.oauthClientId);
+  const method = refresh.clientAuthMethod ?? definition.oauthTokenEndpointAuthMethod ?? "client_secret_basic";
+  const clientSecret = method === "none" ? void 0 : readClientSecret(definition, refresh.clientSecretEnv);
+  const body = new URLSearchParams({
+    grant_type: "refresh_token",
+    refresh_token: refreshToken
+  });
+  const headers = {
+    accept: "application/json",
+    "content-type": "application/x-www-form-urlencoded"
+  };
+  if (method === "client_secret_post") {
+    if (clientId) {
+      body.set("client_id", clientId);
+    }
+    if (clientSecret) {
+      body.set("client_secret", clientSecret);
+    }
+  } else if (method === "none") {
+    if (clientId) {
+      body.set("client_id", clientId);
+    }
+  } else {
+    if (!clientId || !clientSecret) {
+      throw new Error(`Refresh client credentials are required for '${method}'.`);
+    }
+    headers.authorization = `Basic ${Buffer.from(`${formEncodeCredential(clientId)}:${formEncodeCredential(clientSecret)}`).toString("base64")}`;
+  }
+  const response = await fetch(refresh.tokenEndpoint, {
+    method: "POST",
+    headers,
+    body
+  });
+  if (!response.ok) {
+    const errorCode = await oauthErrorCodeFromResponse(response);
+    throw Object.assign(new Error(`Token endpoint returned HTTP ${response.status}${errorCode ? ` (${errorCode})` : ""}.`), errorCode ? { errorCode } : {});
+  }
+  const payload = normalizeBearerTokenResponse(await response.json());
+  return {
+    ...payload,
+    ...payload.refresh_token ? {} : { refresh_token: refreshToken }
+  };
+}
+function normalizeBearerTokenResponse(value) {
+  if (!value || typeof value !== "object") {
+    throw new Error("Token endpoint did not return a JSON object.");
+  }
+  const payload = value;
+  if (typeof payload.access_token !== "string" || payload.access_token.trim().length === 0) {
+    throw new Error("Token endpoint did not return an access_token.");
+  }
+  return {
+    access_token: payload.access_token,
+    token_type: typeof payload.token_type === "string" && payload.token_type ? payload.token_type : "Bearer",
+    ...typeof payload.id_token === "string" ? { id_token: payload.id_token } : {},
+    ...typeof payload.scope === "string" ? { scope: payload.scope } : {},
+    ...typeof payload.refresh_token === "string" && payload.refresh_token ? { refresh_token: payload.refresh_token } : {},
+    ...coerceExpiresIn(payload.expires_in)
+  };
+}
+function coerceExpiresIn(value) {
+  if (typeof value === "number" && Number.isFinite(value)) {
+    return { expires_in: value };
+  }
+  if (typeof value === "string" && value.trim().length > 0) {
+    const parsed = Number(value);
+    if (Number.isFinite(parsed)) {
+      return { expires_in: parsed };
+    }
+  }
+  return {};
+}
+function readEnvOrConfig(envName, fallback) {
+  if (!envName) {
+    return fallback;
+  }
+  const value = process.env[envName];
+  if (value === void 0 || value.trim().length === 0) {
+    throw new Error(`Environment variable '${envName}' is required for bearer token refresh.`);
+  }
+  return value;
+}
+function formEncodeCredential(value) {
+  return new URLSearchParams([["", value]]).toString().slice(1);
+}
+function readClientSecret(definition, refreshClientSecretEnv) {
+  if (refreshClientSecretEnv) {
+    return readEnvOrConfig(refreshClientSecretEnv, void 0);
+  }
+  return resolveOAuthClientSecret(definition, { rejectBlank: true });
+}
+
+// node_modules/.pnpm/mcporter@0.13.0/node_modules/mcporter/dist/oauth-persistence.js
+async function buildOAuthPersistence(definition, logger) {
+  return await createOAuthPersistenceStores(definition, logger);
+}
+async function clearOAuthCaches(definition, logger, scope = "all") {
+  const persistence = await buildOAuthPersistence(definition, logger);
+  await persistence.clear(scope);
+  if (definition.tokenCacheDir && scope === "all") {
+    await fs2.rm(definition.tokenCacheDir, { recursive: true, force: true });
+  }
+  await clearLegacyOAuthArtifacts(definition, logger, scope);
+}
+async function readCachedAccessToken(definition, logger) {
+  const persistence = await buildOAuthPersistence(definition, logger);
+  return await readCachedAccessTokenWithPersistence(definition, persistence, logger);
+}
+
+export {
+  buildStaticClientInformation,
+  buildOAuthPersistence,
+  clearOAuthCaches,
+  readCachedAccessToken
+};