@introspection-ai/recipes 0.18.0 → 0.19.0

package/dist/mcp-chunks/{chunk-MZ2NARG7.js → chunk-54EWGONA.js}

@@ -2,15 +2,15 @@ import { createRequire as __createRequire } from "node:module"; const require =
 import {
   buildFallbackLiteral,
   pickExampleLiteral
-} from "./chunk-XANPGTLI.js";
+} from "./chunk-P3RN22HQ.js";
 import {
   cyanText,
   dimText,
   extraDimText,
   yellowText
-} from "./chunk-N46NEFAF.js";
+} from "./chunk-XUF6KARU.js";
 
-// node_modules/.pnpm/mcporter@0.12.3/node_modules/mcporter/dist/cli/list-signature.js
+// node_modules/.pnpm/mcporter@0.13.0/node_modules/mcporter/dist/cli/list-signature.js
 function formatFunctionSignature(name, options, outputSchema, formatOptions) {
   const colorize = formatOptions?.colorize !== false;
   const keyword = colorize ? extraDimText("function") : "function";
@@ -189,7 +189,7 @@ function formatArrayItemType(type) {
   }
 }
 
-// node_modules/.pnpm/mcporter@0.12.3/node_modules/mcporter/dist/cli/list-doc-comments.js
+// node_modules/.pnpm/mcporter@0.13.0/node_modules/mcporter/dist/cli/list-doc-comments.js
 var DEFAULT_WRAP_WIDTH = 100;
 function buildDocComment(description, options, opts) {
   const colorize = opts?.colorize !== false;
@@ -300,7 +300,7 @@ function wrapCommentText(text, width = DEFAULT_WRAP_WIDTH) {
   return lines;
 }
 
-// node_modules/.pnpm/mcporter@0.12.3/node_modules/mcporter/dist/cli/list-detail-helpers.js
+// node_modules/.pnpm/mcporter@0.13.0/node_modules/mcporter/dist/cli/list-detail-helpers.js
 var DEFAULT_MIN_VISIBLE_PARAMS = 5;
 function selectDisplayOptions(options, requiredOnly, minVisible = DEFAULT_MIN_VISIBLE_PARAMS) {
   if (!requiredOnly || options.length <= minVisible) {

package/dist/mcp-chunks/{chunk-LQQEYD76.js → chunk-55JIHDU3.js}

@@ -1,6 +1,6 @@
 import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url);
 
-// node_modules/.pnpm/mcporter@0.12.3/node_modules/mcporter/dist/cli/ephemeral-flags.js
+// node_modules/.pnpm/mcporter@0.13.0/node_modules/mcporter/dist/cli/ephemeral-flags.js
 function extractEphemeralServerFlags(args, options = {}) {
   let spec;
   const ensureSpec = () => {

package/dist/mcp-chunks/chunk-64EP2BVO.js

@@ -0,0 +1,39 @@
+import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url);
+
+// node_modules/.pnpm/mcporter@0.13.0/node_modules/mcporter/dist/network-family-autoselection.js
+import net from "node:net";
+var NODE_DEFAULT_ATTEMPT_TIMEOUT_MS = 250;
+var MCPORTER_ATTEMPT_TIMEOUT_MS = 1500;
+var NODE_OPTION = "--network-family-autoselection-attempt-timeout";
+function configureAutoSelectFamilyAttemptTimeout(defaults = net, nodeOptions = process.env.NODE_OPTIONS) {
+  if (hasExplicitNodeOption(nodeOptions))
+    return false;
+  if (defaults.getDefaultAutoSelectFamilyAttemptTimeout() !== NODE_DEFAULT_ATTEMPT_TIMEOUT_MS)
+    return false;
+  defaults.setDefaultAutoSelectFamilyAttemptTimeout(MCPORTER_ATTEMPT_TIMEOUT_MS);
+  return true;
+}
+function hasExplicitNodeOption(nodeOptions) {
+  if (!nodeOptions)
+    return false;
+  let offset = 0;
+  while (offset < nodeOptions.length) {
+    const index = nodeOptions.indexOf(NODE_OPTION, offset);
+    if (index === -1)
+      return false;
+    const before = nodeOptions[index - 1];
+    const after = nodeOptions[index + NODE_OPTION.length];
+    if (isNodeOptionBoundary(before) && (after === "=" || isNodeOptionBoundary(after))) {
+      return true;
+    }
+    offset = index + NODE_OPTION.length;
+  }
+  return false;
+}
+function isNodeOptionBoundary(character) {
+  return character === void 0 || character === "'" || character === '"' || /\s/u.test(character);
+}
+
+export {
+  configureAutoSelectFamilyAttemptTimeout
+};

package/dist/mcp-chunks/{chunk-LS7PMWSR.js → chunk-6D6KPSXN.js}

@@ -1,6 +1,6 @@
 import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url);
 
-// node_modules/.pnpm/mcporter@0.12.3/node_modules/mcporter/dist/lifecycle.js
+// node_modules/.pnpm/mcporter@0.13.0/node_modules/mcporter/dist/lifecycle.js
 var DEFAULT_KEEP_ALIVE = /* @__PURE__ */ new Set(["chrome-devtools", "mobile-mcp", "playwright", "cloudbase"]);
 var includeOverride = parseList(process.env.MCPORTER_KEEPALIVE);
 var excludeOverride = parseList(process.env.MCPORTER_DISABLE_KEEPALIVE ?? process.env.MCPORTER_NO_KEEPALIVE);

package/dist/mcp-chunks/{chunk-2XL7MG7R.js → chunk-7A63PAGP.js}

@@ -1,6 +1,19 @@
 import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url);
 
-// node_modules/.pnpm/mcporter@0.12.3/node_modules/mcporter/dist/fs-json.js
+// node_modules/.pnpm/mcporter@0.13.0/node_modules/mcporter/dist/process-utils.js
+function isProcessRunning(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) {
+    return false;
+  }
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+}
+
+// node_modules/.pnpm/mcporter@0.13.0/node_modules/mcporter/dist/fs-json.js
 import crypto from "node:crypto";
 import { constants } from "node:fs";
 import fs from "node:fs/promises";
@@ -247,14 +260,6 @@ async function isLockRecoverable(lockPath) {
   }
   return await isMalformedLockStale(lockPath);
 }
-function isProcessRunning(pid) {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (error) {
-    return error.code === "EPERM";
-  }
-}
 async function isMalformedLockStale(lockPath) {
   try {
     const stats = await fs.stat(lockPath);
@@ -265,6 +270,7 @@ async function isMalformedLockStale(lockPath) {
 }
 
 export {
+  isProcessRunning,
   readJsonFile,
   writeTextFileAtomic,
   writeJsonFile,

package/dist/mcp-chunks/chunk-7DH57OKF.js

@@ -0,0 +1,28 @@
+import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url);
+import {
+  analyzeConnectionError
+} from "./chunk-DEUU7WSN.js";
+
+// node_modules/.pnpm/mcporter@0.13.0/node_modules/mcporter/dist/runtime-oauth-support.js
+function maybeEnableOAuth(definition, logger) {
+  if (definition.auth === "oauth" || definition.auth === "refreshable_bearer") {
+    return void 0;
+  }
+  if (definition.command.kind !== "http") {
+    return void 0;
+  }
+  logger.info(`Detected OAuth requirement for '${definition.name}'. Launching browser flow...`);
+  return {
+    ...definition,
+    auth: "oauth"
+  };
+}
+function isUnauthorizedError(error) {
+  const issue = analyzeConnectionError(error);
+  return issue.kind === "auth";
+}
+
+export {
+  maybeEnableOAuth,
+  isUnauthorizedError
+};

package/dist/mcp-chunks/{chunk-BTLAWHTA.js → chunk-7RDLPFIO.js}

@@ -2,9 +2,9 @@ import { createRequire as __createRequire } from "node:module"; const require =
 import {
   logInfo,
   logWarn
-} from "./chunk-UNKB4SBV.js";
+} from "./chunk-RBVYCKCD.js";
 
-// node_modules/.pnpm/mcporter@0.12.3/node_modules/mcporter/dist/cli/runtime-debug.js
+// node_modules/.pnpm/mcporter@0.13.0/node_modules/mcporter/dist/cli/runtime-debug.js
 var DEBUG_HANG = process.env.MCPORTER_DEBUG_HANG === "1";
 function describeHandle(handle) {
   if (!handle || typeof handle !== "object" && typeof handle !== "function") {

package/dist/mcp-chunks/chunk-C2PQFLWS.js

@@ -0,0 +1,422 @@
+import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url);
+import {
+  readJsonFile,
+  withFileLock,
+  writeJsonFile
+} from "./chunk-7A63PAGP.js";
+import {
+  mcporterDir
+} from "./chunk-FWP4RACK.js";
+
+// node_modules/.pnpm/mcporter@0.13.0/node_modules/mcporter/dist/oauth-vault.js
+import crypto from "node:crypto";
+import path from "node:path";
+
+// node_modules/.pnpm/mcporter@0.13.0/node_modules/mcporter/dist/oauth-credential-validation.js
+function isRecord(value) {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+function isOptionalString(record, key) {
+  return record[key] === void 0 || typeof record[key] === "string";
+}
+function isOptionalFiniteNumber(record, key) {
+  return record[key] === void 0 || typeof record[key] === "number" && Number.isFinite(record[key]);
+}
+function isStoredOAuthTokens(value) {
+  if (!isRecord(value))
+    return false;
+  return typeof value.access_token === "string" && value.access_token.length > 0 && typeof value.token_type === "string" && value.token_type.length > 0 && isOptionalString(value, "refresh_token") && isOptionalString(value, "scope") && isOptionalString(value, "issuer") && isOptionalFiniteNumber(value, "expires_in") && isOptionalFiniteNumber(value, "expires_at") && isOptionalFiniteNumber(value, "expiresAt");
+}
+function isStoredOAuthClientInformation(value) {
+  if (!isRecord(value))
+    return false;
+  return isOptionalString(value, "issuer");
+}
+
+// node_modules/.pnpm/mcporter@0.13.0/node_modules/mcporter/dist/oauth-token-generation.js
+import { randomUUID } from "node:crypto";
+import { isDeepStrictEqual } from "node:util";
+var TOKEN_GENERATION_FIELD = "__mcporter_generation";
+var CLIENT_GENERATION_FIELD = "__mcporter_client_generation";
+function tokenGenerationOf(tokens) {
+  const generation = tokens[TOKEN_GENERATION_FIELD];
+  return typeof generation === "string" && generation.length > 0 ? generation : void 0;
+}
+function clientGenerationOf(info) {
+  const generation = info[CLIENT_GENERATION_FIELD];
+  return typeof generation === "string" && generation.length > 0 ? generation : void 0;
+}
+function withoutTokenGeneration(tokens) {
+  const copy = { ...tokens };
+  delete copy[TOKEN_GENERATION_FIELD];
+  return copy;
+}
+function withoutClientGeneration(info) {
+  const copy = { ...info };
+  delete copy[CLIENT_GENERATION_FIELD];
+  return copy;
+}
+function withOAuthTokenGeneration(tokens) {
+  const generation = tokenGenerationOf(tokens) ?? randomUUID();
+  return { ...withoutTokenGeneration(tokens), [TOKEN_GENERATION_FIELD]: generation };
+}
+function withHiddenOAuthTokenGeneration(tokens) {
+  const generation = tokenGenerationOf(tokens);
+  if (!generation) {
+    return tokens;
+  }
+  const copy = withoutTokenGeneration(tokens);
+  Object.defineProperty(copy, TOKEN_GENERATION_FIELD, { value: generation, enumerable: false });
+  return copy;
+}
+function withOAuthClientGeneration(info) {
+  const generation = clientGenerationOf(info) ?? randomUUID();
+  const copy = { ...withoutClientGeneration(info) };
+  copy[CLIENT_GENERATION_FIELD] = generation;
+  return copy;
+}
+function withHiddenOAuthClientGeneration(info) {
+  const generation = clientGenerationOf(info);
+  if (!generation) {
+    return info;
+  }
+  const copy = withoutClientGeneration(info);
+  Object.defineProperty(copy, CLIENT_GENERATION_FIELD, { value: generation, enumerable: false });
+  return copy;
+}
+function sameOAuthTokenGeneration(current, expected) {
+  if (!current) {
+    return false;
+  }
+  const currentGeneration = tokenGenerationOf(current);
+  const expectedGeneration = tokenGenerationOf(expected);
+  if (currentGeneration || expectedGeneration) {
+    return currentGeneration !== void 0 && currentGeneration === expectedGeneration && sameOAuthTokenValue(current, expected);
+  }
+  return isDeepStrictEqual(current, expected);
+}
+function sameOAuthTokenValue(left, right) {
+  return isDeepStrictEqual(withoutTokenGeneration(left), withoutTokenGeneration(right));
+}
+function sameOAuthClientGeneration(current, expected) {
+  if (!current) {
+    return false;
+  }
+  const currentGeneration = clientGenerationOf(current);
+  const expectedGeneration = clientGenerationOf(expected);
+  if (currentGeneration || expectedGeneration) {
+    return currentGeneration !== void 0 && currentGeneration === expectedGeneration && sameOAuthClientValue(current, expected);
+  }
+  return isDeepStrictEqual(current, expected);
+}
+function sameOAuthClientValue(left, right) {
+  return isDeepStrictEqual(withoutClientGeneration(left), withoutClientGeneration(right));
+}
+
+// node_modules/.pnpm/mcporter@0.13.0/node_modules/mcporter/dist/oauth-vault.js
+function getOAuthVaultPath() {
+  return path.join(mcporterDir("data"), "credentials.json");
+}
+async function readVaultState() {
+  try {
+    const existing = await readJsonFile(getOAuthVaultPath());
+    if (existing && (existing.version === 1 || existing.version === 2) && existing.entries && typeof existing.entries === "object") {
+      return {
+        vault: { ...existing, version: 2 },
+        needsRepair: existing.version !== 2
+      };
+    }
+    if (existing !== void 0) {
+      return { vault: emptyVault(), needsRepair: true };
+    }
+  } catch (error) {
+    if (!(error instanceof SyntaxError)) {
+      throw error;
+    }
+    return { vault: emptyVault(), needsRepair: true };
+  }
+  return { vault: emptyVault(), needsRepair: false };
+}
+async function readVault() {
+  return (await readVaultState()).vault;
+}
+function emptyVault() {
+  return { version: 2, entries: {} };
+}
+async function writeVault(contents) {
+  await writeJsonFile(getOAuthVaultPath(), contents);
+}
+function vaultKeyForDefinition(definition) {
+  const descriptor = {
+    name: definition.name,
+    url: definition.command.kind === "http" ? definition.command.url.toString() : null,
+    command: definition.command.kind === "stdio" ? { command: definition.command.command, args: definition.command.args ?? [] } : null
+  };
+  const hash = crypto.createHash("sha256").update(JSON.stringify(descriptor)).digest("hex").slice(0, 16);
+  return `${definition.name}|${hash}`;
+}
+async function reconcileVaultServerUrl(definition) {
+  if (definition.command.kind !== "http") {
+    return;
+  }
+  const serverUrl = definition.command.url.toString();
+  await withFileLock(getOAuthVaultPath(), async () => {
+    const { vault, needsRepair } = await readVaultState();
+    const serverUrls = stringRecord(vault.serverUrls);
+    const previousUrl = serverUrls[definition.name];
+    const namedEntryUrls = Object.values(vault.entries).filter((entry) => isVaultEntry(entry) && entry.serverName === definition.name).flatMap((entry) => typeof entry.serverUrl === "string" ? [entry.serverUrl] : []);
+    const urlChanged = previousUrl !== void 0 && previousUrl !== serverUrl || namedEntryUrls.some((url) => url !== serverUrl);
+    if (urlChanged) {
+      const invalidatedUrls = new Set([serverUrl, previousUrl, ...namedEntryUrls].filter((url) => url !== void 0));
+      for (const [key, entry] of Object.entries(vault.entries)) {
+        if (isVaultEntry(entry) && (entry.serverName === definition.name || isLegacyOAuthRenameCandidate(definition, entry) && entry.serverUrl !== void 0 && invalidatedUrls.has(entry.serverUrl))) {
+          delete vault.entries[key];
+        }
+      }
+    }
+    if (previousUrl === serverUrl && !urlChanged && !needsRepair) {
+      return;
+    }
+    vault.serverUrls = { ...serverUrls, [definition.name]: serverUrl };
+    await writeVault(vault);
+  });
+}
+function stringRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return {};
+  }
+  return Object.fromEntries(Object.entries(value).filter((entry) => typeof entry[1] === "string"));
+}
+async function loadVaultEntryForRecovery(definition) {
+  const vault = await readVault();
+  const key = vaultKeyForDefinition(definition);
+  const resolved = resolveVaultEntry(vault, definition);
+  const tokenSnapshots = /* @__PURE__ */ new Map();
+  const clientSnapshots = /* @__PURE__ */ new Map();
+  for (const targetKey of [key, ...legacyOAuthRenameKeys(vault, definition, key)]) {
+    const candidate = isVaultEntry(vault.entries[targetKey]) ? vault.entries[targetKey] : void 0;
+    if (candidate?.tokens && resolved?.tokens && sameOAuthTokenValue(candidate.tokens, resolved.tokens)) {
+      tokenSnapshots.set(targetKey, candidate.tokens);
+    }
+    if (candidate?.clientInfo && resolved?.clientInfo && sameOAuthClientValue(candidate.clientInfo, resolved.clientInfo)) {
+      clientSnapshots.set(targetKey, candidate.clientInfo);
+    }
+  }
+  return {
+    entry: externalVaultEntry(resolved),
+    tokenSnapshots,
+    clientSnapshots
+  };
+}
+function resolveVaultEntry(vault, definition) {
+  const key = vaultKeyForDefinition(definition);
+  const exact = isVaultEntry(vault.entries[key]) ? vault.entries[key] : void 0;
+  const fallback = findSameUrlCredentials(vault, definition, key, exact);
+  if (!fallback.tokens && !fallback.clientInfo) {
+    return exact;
+  }
+  if (!exact) {
+    return {
+      serverName: definition.name,
+      serverUrl: definition.command.kind === "http" ? definition.command.url.toString() : void 0,
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      tokens: fallback.tokens,
+      clientInfo: fallback.clientInfo
+    };
+  }
+  return {
+    ...exact,
+    tokens: exact.tokens ?? fallback.tokens,
+    clientInfo: exact.clientInfo ?? (exact.tokens ? void 0 : fallback.clientInfo)
+  };
+}
+function externalVaultEntry(entry) {
+  if (!entry) {
+    return entry;
+  }
+  const { tokens, clientInfo, ...metadata } = entry;
+  return {
+    ...metadata,
+    ...isStoredOAuthTokens(tokens) ? { tokens: withHiddenOAuthTokenGeneration(tokens) } : {},
+    ...isStoredOAuthClientInformation(clientInfo) ? { clientInfo: withHiddenOAuthClientGeneration(clientInfo) } : {}
+  };
+}
+function findSameUrlCredentials(vault, definition, exactKey, exact) {
+  if (definition.command.kind !== "http") {
+    return { sourceKeys: [] };
+  }
+  const serverUrl = definition.command.url.toString();
+  const candidates = Object.entries(vault.entries).filter(([key, entry]) => key !== exactKey && isVaultEntry(entry) && entry.serverUrl === serverUrl && isLegacyOAuthRenameCandidate(definition, entry) && (entry.tokens || entry.clientInfo)).map(([key, entry]) => ({ key, entry })).toSorted((a, b) => Date.parse(b.entry.updatedAt) - Date.parse(a.entry.updatedAt));
+  const requiredClientId = definition.oauthClientId ?? clientIdFromEntry(exact);
+  if (requiredClientId) {
+    const tokenSource = candidates.find(({ entry }) => (entry.tokens || entry.clientInfo) && clientIdFromEntry(entry) === requiredClientId);
+    return {
+      tokens: tokenSource?.entry.tokens,
+      clientInfo: exact?.clientInfo ? void 0 : tokenSource?.entry.clientInfo,
+      sourceKeys: tokenSource ? [tokenSource.key] : []
+    };
+  }
+  const source = candidates.find(({ entry }) => entry.clientInfo && clientIdFromEntry(entry));
+  return {
+    tokens: source?.entry.tokens,
+    clientInfo: source?.entry.clientInfo,
+    sourceKeys: source ? [source.key] : []
+  };
+}
+function isLegacyOAuthRenameCandidate(definition, entry) {
+  return entry.serverName === `${definition.name}-oauth`;
+}
+function legacyOAuthRenameKeys(vault, definition, exactKey) {
+  if (definition.command.kind !== "http") {
+    return [];
+  }
+  const serverUrl = definition.command.url.toString();
+  return Object.entries(vault.entries).filter(([key, entry]) => key !== exactKey && isVaultEntry(entry) && entry.serverUrl === serverUrl && isLegacyOAuthRenameCandidate(definition, entry)).map(([key]) => key);
+}
+function isVaultEntry(entry) {
+  return Boolean(entry && typeof entry === "object" && typeof entry.serverName === "string" && typeof entry.updatedAt === "string");
+}
+function clientIdFromEntry(entry) {
+  const clientId = entry?.clientInfo?.client_id;
+  return typeof clientId === "string" && clientId.length > 0 ? clientId : void 0;
+}
+async function saveVaultEntry(definition, patch) {
+  await withFileLock(getOAuthVaultPath(), async () => {
+    const vault = await readVault();
+    const key = vaultKeyForDefinition(definition);
+    const existing = isVaultEntry(vault.entries[key]) ? vault.entries[key] : void 0;
+    const fallback = findSameUrlCredentials(vault, definition, key, existing);
+    const current = existing ?? {
+      serverName: definition.name,
+      serverUrl: definition.command.kind === "http" ? definition.command.url.toString() : void 0,
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    vault.entries[key] = {
+      ...current,
+      ...patch,
+      ...patch.tokens ? { tokens: withOAuthTokenGeneration(patch.tokens) } : {},
+      clientInfo: (patch.clientInfo ? withOAuthClientGeneration(patch.clientInfo) : void 0) ?? current.clientInfo ?? (patch.tokens && !current.tokens ? fallback.clientInfo : void 0),
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    await writeVault(vault);
+  });
+}
+function tokensMatch(tokens, expected) {
+  return expected !== void 0 && sameOAuthTokenGeneration(tokens, expected);
+}
+async function clearVaultTokensIfMatching(definition, expectedTokens, expectedClientInfo, tokenSnapshots, clientSnapshots) {
+  const key = vaultKeyForDefinition(definition);
+  await withFileLock(getOAuthVaultPath(), async () => {
+    const { vault, needsRepair } = await readVaultState();
+    const exact = isVaultEntry(vault.entries[key]) ? vault.entries[key] : void 0;
+    const fallbackKeys = findSameUrlCredentials(vault, definition, key, exact).sourceKeys;
+    const targetKeys = tokenSnapshots || clientSnapshots ? [.../* @__PURE__ */ new Set([...tokenSnapshots?.keys() ?? [], ...clientSnapshots?.keys() ?? []])] : [key, ...fallbackKeys];
+    let mutated = false;
+    for (const targetKey of targetKeys) {
+      const entry = isVaultEntry(vault.entries[targetKey]) ? vault.entries[targetKey] : void 0;
+      if (!entry) {
+        continue;
+      }
+      const updated = { ...entry };
+      let entryMutated = false;
+      const tokenSnapshot = tokenSnapshots ? tokenSnapshots.get(targetKey) : expectedTokens;
+      const clientSnapshot = clientSnapshots ? clientSnapshots.get(targetKey) : expectedClientInfo;
+      const ownTokensRejected = tokensMatch(entry.tokens, tokenSnapshot);
+      if (ownTokensRejected) {
+        delete updated.tokens;
+        entryMutated = true;
+      }
+      if (clientSnapshot && sameOAuthClientGeneration(updated.clientInfo, clientSnapshot)) {
+        delete updated.clientInfo;
+        entryMutated = true;
+      }
+      if (!entryMutated) {
+        continue;
+      }
+      updated.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+      vault.entries[targetKey] = updated;
+      mutated = true;
+    }
+    if (mutated || needsRepair) {
+      await writeVault(vault);
+    }
+  });
+}
+async function clearVaultEntry(definition, scope) {
+  const key = vaultKeyForDefinition(definition);
+  await withFileLock(getOAuthVaultPath(), async () => {
+    const { vault, needsRepair } = await readVaultState();
+    const existing = isVaultEntry(vault.entries[key]) ? vault.entries[key] : void 0;
+    const fallback = findSameUrlCredentials(vault, definition, key, existing);
+    const inheritedKeys = scope === "all" ? legacyOAuthRenameKeys(vault, definition, key) : fallback.sourceKeys;
+    if (!existing && inheritedKeys.length === 0) {
+      if (needsRepair) {
+        await writeVault(vault);
+      }
+      return;
+    }
+    if (scope === "all") {
+      delete vault.entries[key];
+    } else if (existing) {
+      const updated = { ...existing };
+      if (scope === "tokens") {
+        delete updated.tokens;
+      }
+      if (scope === "client") {
+        delete updated.clientInfo;
+      }
+      if (scope === "verifier") {
+        delete updated.codeVerifier;
+      }
+      if (scope === "state") {
+        delete updated.state;
+      }
+      if (scope === "discovery") {
+        delete updated.discoveryState;
+        delete updated.authorizationServerUrl;
+        delete updated.resourceUrl;
+      }
+      updated.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+      vault.entries[key] = updated;
+    }
+    for (const fallbackKey of inheritedKeys) {
+      const inherited = vault.entries[fallbackKey];
+      if (!inherited) {
+        continue;
+      }
+      if (scope === "all") {
+        delete vault.entries[fallbackKey];
+        continue;
+      }
+      const updated = { ...inherited };
+      if (scope === "tokens") {
+        delete updated.tokens;
+      }
+      if (scope === "client") {
+        delete updated.clientInfo;
+      }
+      updated.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+      vault.entries[fallbackKey] = updated;
+    }
+    await writeVault(vault);
+  });
+}
+
+export {
+  isStoredOAuthTokens,
+  isStoredOAuthClientInformation,
+  withOAuthTokenGeneration,
+  withHiddenOAuthTokenGeneration,
+  withOAuthClientGeneration,
+  withHiddenOAuthClientGeneration,
+  sameOAuthTokenGeneration,
+  sameOAuthTokenValue,
+  sameOAuthClientGeneration,
+  sameOAuthClientValue,
+  getOAuthVaultPath,
+  reconcileVaultServerUrl,
+  loadVaultEntryForRecovery,
+  saveVaultEntry,
+  clearVaultTokensIfMatching,
+  clearVaultEntry
+};