@introspection-ai/recipes 0.24.0 → 0.25.0

package/dist/mcp-chunks/chunk-53NRFMB3.js

@@ -0,0 +1,990 @@
+import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url);
+import {
+  readJsonFile,
+  withFileLock,
+  writeJsonFile,
+  writeTextFileAtomic
+} from "./chunk-ITR7FQM3.js";
+import {
+  legacyMcporterDir,
+  mcporterDir
+} from "./chunk-FS5JIKT6.js";
+
+// node_modules/.pnpm/mcporter@0.13.8/node_modules/mcporter/dist/oauth-vault.js
+import crypto from "node:crypto";
+import path from "node:path";
+
+// node_modules/.pnpm/mcporter@0.13.8/node_modules/mcporter/dist/oauth-credential-validation.js
+function isRecord(value) {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+function isOptionalString(record, key) {
+  return record[key] === void 0 || typeof record[key] === "string";
+}
+function isOptionalFiniteNumber(record, key) {
+  return record[key] === void 0 || typeof record[key] === "number" && Number.isFinite(record[key]);
+}
+function isStoredOAuthTokens(value) {
+  if (!isRecord(value))
+    return false;
+  return typeof value.access_token === "string" && value.access_token.length > 0 && typeof value.token_type === "string" && value.token_type.length > 0 && isOptionalString(value, "refresh_token") && isOptionalString(value, "scope") && isOptionalString(value, "issuer") && isOptionalFiniteNumber(value, "expires_in") && isOptionalFiniteNumber(value, "expires_at") && isOptionalFiniteNumber(value, "expiresAt");
+}
+function isStoredOAuthClientInformation(value) {
+  if (!isRecord(value))
+    return false;
+  return isOptionalString(value, "issuer");
+}
+
+// node_modules/.pnpm/mcporter@0.13.8/node_modules/mcporter/dist/oauth-token-generation.js
+import { randomUUID } from "node:crypto";
+import { isDeepStrictEqual } from "node:util";
+var TOKEN_GENERATION_FIELD = "__mcporter_generation";
+var CLIENT_GENERATION_FIELD = "__mcporter_client_generation";
+function tokenGenerationOf(tokens) {
+  const generation = tokens[TOKEN_GENERATION_FIELD];
+  return typeof generation === "string" && generation.length > 0 ? generation : void 0;
+}
+function clientGenerationOf(info) {
+  const generation = info[CLIENT_GENERATION_FIELD];
+  return typeof generation === "string" && generation.length > 0 ? generation : void 0;
+}
+function withoutTokenGeneration(tokens) {
+  const copy = { ...tokens };
+  delete copy[TOKEN_GENERATION_FIELD];
+  return copy;
+}
+function withoutClientGeneration(info) {
+  const copy = { ...info };
+  delete copy[CLIENT_GENERATION_FIELD];
+  return copy;
+}
+function withOAuthTokenGeneration(tokens) {
+  const generation = tokenGenerationOf(tokens) ?? randomUUID();
+  return { ...withoutTokenGeneration(tokens), [TOKEN_GENERATION_FIELD]: generation };
+}
+function withHiddenOAuthTokenGeneration(tokens) {
+  const generation = tokenGenerationOf(tokens);
+  if (!generation) {
+    return tokens;
+  }
+  const copy = withoutTokenGeneration(tokens);
+  Object.defineProperty(copy, TOKEN_GENERATION_FIELD, { value: generation, enumerable: false });
+  return copy;
+}
+function withOAuthClientGeneration(info) {
+  const generation = clientGenerationOf(info) ?? randomUUID();
+  const copy = { ...withoutClientGeneration(info) };
+  copy[CLIENT_GENERATION_FIELD] = generation;
+  return copy;
+}
+function withHiddenOAuthClientGeneration(info) {
+  const generation = clientGenerationOf(info);
+  if (!generation) {
+    return info;
+  }
+  const copy = withoutClientGeneration(info);
+  Object.defineProperty(copy, CLIENT_GENERATION_FIELD, { value: generation, enumerable: false });
+  return copy;
+}
+function sameOAuthTokenGeneration(current, expected) {
+  if (!current) {
+    return false;
+  }
+  const currentGeneration = tokenGenerationOf(current);
+  const expectedGeneration = tokenGenerationOf(expected);
+  if (currentGeneration || expectedGeneration) {
+    return currentGeneration !== void 0 && currentGeneration === expectedGeneration && sameOAuthTokenValue(current, expected);
+  }
+  return isDeepStrictEqual(current, expected);
+}
+function sameOAuthTokenValue(left, right) {
+  return isDeepStrictEqual(withoutTokenGeneration(left), withoutTokenGeneration(right));
+}
+function sameOAuthClientGeneration(current, expected) {
+  if (!current) {
+    return false;
+  }
+  const currentGeneration = clientGenerationOf(current);
+  const expectedGeneration = clientGenerationOf(expected);
+  if (currentGeneration || expectedGeneration) {
+    return currentGeneration !== void 0 && currentGeneration === expectedGeneration && sameOAuthClientValue(current, expected);
+  }
+  return isDeepStrictEqual(current, expected);
+}
+function sameOAuthClientValue(left, right) {
+  return isDeepStrictEqual(withoutClientGeneration(left), withoutClientGeneration(right));
+}
+
+// node_modules/.pnpm/mcporter@0.13.8/node_modules/mcporter/dist/oauth-vault.js
+function getOAuthVaultPath() {
+  return path.join(mcporterDir("data"), "credentials.json");
+}
+async function readVaultState() {
+  try {
+    const existing = await readJsonFile(getOAuthVaultPath());
+    if (existing && (existing.version === 1 || existing.version === 2) && existing.entries && typeof existing.entries === "object") {
+      return {
+        vault: { ...existing, version: 2 },
+        needsRepair: existing.version !== 2
+      };
+    }
+    if (existing !== void 0) {
+      return { vault: emptyVault(), needsRepair: true };
+    }
+  } catch (error) {
+    if (!(error instanceof SyntaxError)) {
+      throw error;
+    }
+    return { vault: emptyVault(), needsRepair: true };
+  }
+  return { vault: emptyVault(), needsRepair: false };
+}
+async function readVault() {
+  return (await readVaultState()).vault;
+}
+function emptyVault() {
+  return { version: 2, entries: {} };
+}
+async function writeVault(contents) {
+  await writeJsonFile(getOAuthVaultPath(), contents);
+}
+function vaultKeyForDefinition(definition) {
+  const descriptor = {
+    name: definition.name,
+    url: definition.command.kind === "http" ? definition.command.url.toString() : null,
+    command: definition.command.kind === "stdio" ? { command: definition.command.command, args: definition.command.args ?? [] } : null
+  };
+  const digest = crypto.hash("sha256", JSON.stringify(descriptor), "hex").slice(0, 16);
+  return `${definition.name}|${digest}`;
+}
+async function reconcileVaultServerUrl(definition) {
+  if (definition.command.kind !== "http") {
+    return;
+  }
+  const serverUrl = definition.command.url.toString();
+  await withFileLock(getOAuthVaultPath(), async () => {
+    const { vault, needsRepair } = await readVaultState();
+    const serverUrls = stringRecord(vault.serverUrls);
+    const previousUrl = serverUrls[definition.name];
+    const namedEntryUrls = Object.values(vault.entries).filter((entry) => isVaultEntry(entry) && entry.serverName === definition.name).flatMap((entry) => typeof entry.serverUrl === "string" ? [entry.serverUrl] : []);
+    const urlChanged = previousUrl !== void 0 && previousUrl !== serverUrl || namedEntryUrls.some((url) => url !== serverUrl);
+    if (urlChanged) {
+      const invalidatedUrls = new Set([serverUrl, previousUrl, ...namedEntryUrls].filter((url) => url !== void 0));
+      for (const [key, entry] of Object.entries(vault.entries)) {
+        if (isVaultEntry(entry) && (entry.serverName === definition.name || isLegacyOAuthRenameCandidate(definition, entry) && entry.serverUrl !== void 0 && invalidatedUrls.has(entry.serverUrl))) {
+          delete vault.entries[key];
+        }
+      }
+    }
+    if (previousUrl === serverUrl && !urlChanged && !needsRepair) {
+      return;
+    }
+    vault.serverUrls = { ...serverUrls, [definition.name]: serverUrl };
+    await writeVault(vault);
+  });
+}
+function stringRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return {};
+  }
+  return Object.fromEntries(Object.entries(value).filter((entry) => typeof entry[1] === "string"));
+}
+async function vaultCredentialKeys(definition) {
+  const key = vaultKeyForDefinition(definition);
+  if (definition.command.kind !== "http") {
+    return [key];
+  }
+  const vault = await readVault();
+  return [.../* @__PURE__ */ new Set([key, ...legacyOAuthRenameKeys(vault, definition, key)])];
+}
+async function loadVaultEntryForRecovery(definition) {
+  const vault = await readVault();
+  const key = vaultKeyForDefinition(definition);
+  const resolved = resolveVaultEntry(vault, definition);
+  const tokenSnapshots = /* @__PURE__ */ new Map();
+  const clientSnapshots = /* @__PURE__ */ new Map();
+  for (const targetKey of [key, ...legacyOAuthRenameKeys(vault, definition, key)]) {
+    const candidate = isVaultEntry(vault.entries[targetKey]) ? vault.entries[targetKey] : void 0;
+    if (candidate?.tokens && resolved?.tokens && sameOAuthTokenValue(candidate.tokens, resolved.tokens)) {
+      tokenSnapshots.set(targetKey, candidate.tokens);
+    }
+    if (candidate?.clientInfo && resolved?.clientInfo && sameOAuthClientValue(candidate.clientInfo, resolved.clientInfo)) {
+      clientSnapshots.set(targetKey, candidate.clientInfo);
+    }
+  }
+  return {
+    entry: externalVaultEntry(resolved),
+    tokenSnapshots,
+    clientSnapshots
+  };
+}
+function resolveVaultEntry(vault, definition) {
+  const key = vaultKeyForDefinition(definition);
+  const exact = isVaultEntry(vault.entries[key]) ? vault.entries[key] : void 0;
+  const fallback = findSameUrlCredentials(vault, definition, key, exact);
+  if (!fallback.tokens && !fallback.clientInfo) {
+    return exact;
+  }
+  if (!exact) {
+    return {
+      serverName: definition.name,
+      serverUrl: definition.command.kind === "http" ? definition.command.url.toString() : void 0,
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      tokens: fallback.tokens,
+      clientInfo: fallback.clientInfo
+    };
+  }
+  return {
+    ...exact,
+    tokens: exact.tokens ?? fallback.tokens,
+    clientInfo: exact.clientInfo ?? (exact.tokens ? void 0 : fallback.clientInfo)
+  };
+}
+function externalVaultEntry(entry) {
+  if (!entry) {
+    return entry;
+  }
+  const { tokens, clientInfo, ...metadata } = entry;
+  return {
+    ...metadata,
+    ...isStoredOAuthTokens(tokens) ? { tokens: withHiddenOAuthTokenGeneration(tokens) } : {},
+    ...isStoredOAuthClientInformation(clientInfo) ? { clientInfo: withHiddenOAuthClientGeneration(clientInfo) } : {}
+  };
+}
+function findSameUrlCredentials(vault, definition, exactKey, exact) {
+  if (definition.command.kind !== "http") {
+    return { sourceKeys: [] };
+  }
+  const serverUrl = definition.command.url.toString();
+  const candidates = Object.entries(vault.entries).filter(([key, entry]) => key !== exactKey && isVaultEntry(entry) && entry.serverUrl === serverUrl && isLegacyOAuthRenameCandidate(definition, entry) && (entry.tokens || entry.clientInfo)).map(([key, entry]) => ({ key, entry })).toSorted((a, b) => Date.parse(b.entry.updatedAt) - Date.parse(a.entry.updatedAt));
+  const requiredClientId = definition.oauthClientId ?? clientIdFromEntry(exact);
+  if (requiredClientId) {
+    const tokenSource = candidates.find(({ entry }) => (entry.tokens || entry.clientInfo) && clientIdFromEntry(entry) === requiredClientId);
+    return {
+      tokens: tokenSource?.entry.tokens,
+      clientInfo: exact?.clientInfo ? void 0 : tokenSource?.entry.clientInfo,
+      sourceKeys: tokenSource ? [tokenSource.key] : []
+    };
+  }
+  const source = candidates.find(({ entry }) => entry.clientInfo && clientIdFromEntry(entry));
+  return {
+    tokens: source?.entry.tokens,
+    clientInfo: source?.entry.clientInfo,
+    sourceKeys: source ? [source.key] : []
+  };
+}
+function isLegacyOAuthRenameCandidate(definition, entry) {
+  return entry.serverName === `${definition.name}-oauth`;
+}
+function legacyOAuthRenameKeys(vault, definition, exactKey) {
+  if (definition.command.kind !== "http") {
+    return [];
+  }
+  const serverUrl = definition.command.url.toString();
+  return Object.entries(vault.entries).filter(([key, entry]) => key !== exactKey && isVaultEntry(entry) && entry.serverUrl === serverUrl && isLegacyOAuthRenameCandidate(definition, entry)).map(([key]) => key);
+}
+function isVaultEntry(entry) {
+  return Boolean(entry && typeof entry === "object" && typeof entry.serverName === "string" && typeof entry.updatedAt === "string");
+}
+function clientIdFromEntry(entry) {
+  const clientId = entry?.clientInfo?.client_id;
+  return typeof clientId === "string" && clientId.length > 0 ? clientId : void 0;
+}
+async function saveVaultEntry(definition, patch) {
+  await withFileLock(getOAuthVaultPath(), async () => {
+    const vault = await readVault();
+    const key = vaultKeyForDefinition(definition);
+    const existing = isVaultEntry(vault.entries[key]) ? vault.entries[key] : void 0;
+    const fallback = findSameUrlCredentials(vault, definition, key, existing);
+    const current = existing ?? {
+      serverName: definition.name,
+      serverUrl: definition.command.kind === "http" ? definition.command.url.toString() : void 0,
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    vault.entries[key] = {
+      ...current,
+      ...patch,
+      ...patch.tokens ? { tokens: withOAuthTokenGeneration(patch.tokens) } : {},
+      clientInfo: (patch.clientInfo ? withOAuthClientGeneration(patch.clientInfo) : void 0) ?? current.clientInfo ?? (patch.tokens && !current.tokens ? fallback.clientInfo : void 0),
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    await writeVault(vault);
+  });
+}
+function tokensMatch(tokens, expected) {
+  return expected !== void 0 && sameOAuthTokenGeneration(tokens, expected);
+}
+async function clearVaultTokensIfMatching(definition, expectedTokens, expectedClientInfo, tokenSnapshots, clientSnapshots) {
+  const key = vaultKeyForDefinition(definition);
+  await withFileLock(getOAuthVaultPath(), async () => {
+    const { vault, needsRepair } = await readVaultState();
+    const exact = isVaultEntry(vault.entries[key]) ? vault.entries[key] : void 0;
+    const fallbackKeys = findSameUrlCredentials(vault, definition, key, exact).sourceKeys;
+    const targetKeys = tokenSnapshots || clientSnapshots ? [.../* @__PURE__ */ new Set([...tokenSnapshots?.keys() ?? [], ...clientSnapshots?.keys() ?? []])] : [key, ...fallbackKeys];
+    let mutated = false;
+    for (const targetKey of targetKeys) {
+      const entry = isVaultEntry(vault.entries[targetKey]) ? vault.entries[targetKey] : void 0;
+      if (!entry) {
+        continue;
+      }
+      const updated = { ...entry };
+      let entryMutated = false;
+      const tokenSnapshot = tokenSnapshots ? tokenSnapshots.get(targetKey) : expectedTokens;
+      const clientSnapshot = clientSnapshots ? clientSnapshots.get(targetKey) : expectedClientInfo;
+      const ownTokensRejected = tokensMatch(entry.tokens, tokenSnapshot);
+      if (ownTokensRejected) {
+        delete updated.tokens;
+        entryMutated = true;
+      }
+      if (clientSnapshot && sameOAuthClientGeneration(updated.clientInfo, clientSnapshot)) {
+        delete updated.clientInfo;
+        entryMutated = true;
+      }
+      if (!entryMutated) {
+        continue;
+      }
+      updated.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+      vault.entries[targetKey] = updated;
+      mutated = true;
+    }
+    if (mutated || needsRepair) {
+      await writeVault(vault);
+    }
+  });
+}
+async function clearVaultEntry(definition, scope) {
+  const key = vaultKeyForDefinition(definition);
+  await withFileLock(getOAuthVaultPath(), async () => {
+    const { vault, needsRepair } = await readVaultState();
+    const existing = isVaultEntry(vault.entries[key]) ? vault.entries[key] : void 0;
+    const fallback = findSameUrlCredentials(vault, definition, key, existing);
+    const inheritedKeys = scope === "all" ? legacyOAuthRenameKeys(vault, definition, key) : fallback.sourceKeys;
+    if (!existing && inheritedKeys.length === 0) {
+      if (needsRepair) {
+        await writeVault(vault);
+      }
+      return;
+    }
+    if (scope === "all") {
+      delete vault.entries[key];
+    } else if (existing) {
+      const updated = { ...existing };
+      if (scope === "tokens") {
+        delete updated.tokens;
+      }
+      if (scope === "client") {
+        delete updated.clientInfo;
+      }
+      if (scope === "verifier") {
+        delete updated.codeVerifier;
+      }
+      if (scope === "state") {
+        delete updated.state;
+      }
+      if (scope === "discovery") {
+        delete updated.discoveryState;
+        delete updated.authorizationServerUrl;
+        delete updated.resourceUrl;
+      }
+      updated.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+      vault.entries[key] = updated;
+    }
+    for (const fallbackKey of inheritedKeys) {
+      const inherited = vault.entries[fallbackKey];
+      if (!inherited) {
+        continue;
+      }
+      if (scope === "all") {
+        delete vault.entries[fallbackKey];
+        continue;
+      }
+      const updated = { ...inherited };
+      if (scope === "tokens") {
+        delete updated.tokens;
+      }
+      if (scope === "client") {
+        delete updated.clientInfo;
+      }
+      updated.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+      vault.entries[fallbackKey] = updated;
+    }
+    await writeVault(vault);
+  });
+}
+
+// node_modules/.pnpm/mcporter@0.13.8/node_modules/mcporter/dist/oauth-persistence-stores.js
+import fs from "node:fs/promises";
+import os from "node:os";
+import path2 from "node:path";
+function withStoredExpiry(tokens) {
+  const stored = tokens;
+  if (typeof stored.expires_at === "number" || typeof stored.expiresAt === "number") {
+    return tokens;
+  }
+  if (typeof tokens.expires_in === "number" && Number.isFinite(tokens.expires_in)) {
+    return {
+      ...tokens,
+      expires_at: Math.floor(Date.now() / 1e3) + tokens.expires_in
+    };
+  }
+  return tokens;
+}
+function prepareStoredTokens(tokens) {
+  return withStoredExpiry(withOAuthTokenGeneration(tokens));
+}
+var DirectoryPersistence = class {
+  root;
+  logger;
+  serverUrl;
+  skipUrlMarkerWhenMissing;
+  tokenPath;
+  clientInfoPath;
+  codeVerifierPath;
+  statePath;
+  serverUrlPath;
+  discoveryStatePath;
+  authorizationServerUrlPath;
+  resourceUrlPath;
+  constructor(root, logger, serverUrl, skipUrlMarkerWhenMissing = false) {
+    this.root = root;
+    this.logger = logger;
+    this.serverUrl = serverUrl;
+    this.skipUrlMarkerWhenMissing = skipUrlMarkerWhenMissing;
+    this.tokenPath = path2.join(root, "tokens.json");
+    this.clientInfoPath = path2.join(root, "client.json");
+    this.codeVerifierPath = path2.join(root, "code_verifier.txt");
+    this.statePath = path2.join(root, "state.txt");
+    this.serverUrlPath = path2.join(root, "server_url.txt");
+    this.discoveryStatePath = path2.join(root, "discovery.json");
+    this.authorizationServerUrlPath = path2.join(root, "authorization_server_url.txt");
+    this.resourceUrlPath = path2.join(root, "resource_url.txt");
+  }
+  describe() {
+    return this.root;
+  }
+  async ensureDir() {
+    await fs.mkdir(this.root, { recursive: true });
+  }
+  async reconcileServerUrl() {
+    if (!this.serverUrl) {
+      return;
+    }
+    const serverUrl = this.serverUrl;
+    if (this.skipUrlMarkerWhenMissing) {
+      try {
+        await fs.access(this.root);
+      } catch (error) {
+        if (error.code === "ENOENT") {
+          return;
+        }
+        throw error;
+      }
+    }
+    await this.ensureDir();
+    await withFileLock(this.tokenPath, async () => {
+      let previousUrl;
+      try {
+        previousUrl = (await fs.readFile(this.serverUrlPath, "utf8")).trim();
+      } catch (error) {
+        if (error.code !== "ENOENT") {
+          throw error;
+        }
+      }
+      if (previousUrl === serverUrl) {
+        return;
+      }
+      if (previousUrl !== void 0) {
+        await this.clearFiles("all");
+      }
+      await writeTextFileAtomic(this.serverUrlPath, serverUrl);
+    });
+  }
+  async readSnapshot() {
+    await this.reconcileServerUrl();
+    const [tokens, clientInfo, codeVerifier, state, discoveryState, authorizationServerUrl, resourceUrl] = await Promise.all([
+      this.readTokensAfterReconcile(),
+      this.readClientInfoAfterReconcile(),
+      this.readCodeVerifierAfterReconcile(),
+      this.readStateAfterReconcile(),
+      this.readDiscoveryStateAfterReconcile(),
+      this.readTextAfterReconcile(this.authorizationServerUrlPath),
+      this.readTextAfterReconcile(this.resourceUrlPath)
+    ]);
+    return { tokens, clientInfo, codeVerifier, state, discoveryState, authorizationServerUrl, resourceUrl };
+  }
+  async readTokens() {
+    await this.reconcileServerUrl();
+    return await this.readTokensAfterReconcile();
+  }
+  async readTokensAfterReconcile() {
+    const tokens = await this.readJsonOrUndefined(this.tokenPath);
+    return isStoredOAuthTokens(tokens) ? withHiddenOAuthTokenGeneration(tokens) : void 0;
+  }
+  async saveTokens(tokens) {
+    await this.reconcileServerUrl();
+    await this.ensureDir();
+    await withFileLock(this.tokenPath, async () => {
+      await writeJsonFile(this.tokenPath, prepareStoredTokens(tokens));
+    });
+    this.logger?.debug?.(`Saved tokens to ${this.tokenPath}`);
+  }
+  async clearRejectedCredentials(expectedTokens, expectedClientInfo) {
+    await this.reconcileServerUrl();
+    await withFileLock(this.tokenPath, async () => {
+      if (expectedTokens) {
+        const current = await this.readJsonOrUndefined(this.tokenPath);
+        if (sameOAuthTokenGeneration(current, expectedTokens)) {
+          await this.unlinkIfPresent(this.tokenPath);
+        }
+      }
+      if (expectedClientInfo) {
+        const currentClientInfo = await this.readJsonOrUndefined(this.clientInfoPath);
+        if (sameOAuthClientGeneration(currentClientInfo, expectedClientInfo)) {
+          await this.unlinkIfPresent(this.clientInfoPath);
+        }
+      }
+    });
+  }
+  async unlinkIfPresent(file) {
+    try {
+      await fs.unlink(file);
+    } catch (error) {
+      if (error.code !== "ENOENT") {
+        throw error;
+      }
+    }
+  }
+  async readClientInfo() {
+    await this.reconcileServerUrl();
+    return await this.readClientInfoAfterReconcile();
+  }
+  async readClientInfoAfterReconcile() {
+    const info = await this.readJsonOrUndefined(this.clientInfoPath);
+    return isStoredOAuthClientInformation(info) ? withHiddenOAuthClientGeneration(info) : void 0;
+  }
+  async saveClientInfo(info) {
+    await this.reconcileServerUrl();
+    await this.ensureDir();
+    await withFileLock(this.tokenPath, async () => {
+      await writeJsonFile(this.clientInfoPath, withOAuthClientGeneration(info));
+    });
+  }
+  async readCodeVerifier() {
+    await this.reconcileServerUrl();
+    return await this.readCodeVerifierAfterReconcile();
+  }
+  async readCodeVerifierAfterReconcile() {
+    try {
+      return (await fs.readFile(this.codeVerifierPath, "utf8")).trim();
+    } catch (error) {
+      if (error.code === "ENOENT") {
+        return void 0;
+      }
+      throw error;
+    }
+  }
+  async saveCodeVerifier(value) {
+    await this.reconcileServerUrl();
+    await this.ensureDir();
+    await writeTextFileAtomic(this.codeVerifierPath, value);
+  }
+  async readState() {
+    await this.reconcileServerUrl();
+    return await this.readStateAfterReconcile();
+  }
+  async readStateAfterReconcile() {
+    return readJsonFile(this.statePath);
+  }
+  // A present-but-corrupt credential cache (tokens/client) means "no usable
+  // credentials": degrade to re-auth instead of crashing the connection,
+  // mirroring VaultPersistence and the daemon/server-proxy readers. Genuine I/O
+  // faults still propagate (readJsonFile re-throws everything except ENOENT).
+  // OAuth state is intentionally excluded so its CSRF check still fails closed.
+  async readJsonOrUndefined(filePath) {
+    try {
+      return await readJsonFile(filePath);
+    } catch (error) {
+      if (!(error instanceof SyntaxError)) {
+        throw error;
+      }
+      this.logger?.debug?.(`Ignoring corrupt OAuth cache file ${filePath}: ${error.message}`);
+      return void 0;
+    }
+  }
+  async saveState(value) {
+    await this.reconcileServerUrl();
+    await this.ensureDir();
+    await writeJsonFile(this.statePath, value);
+  }
+  async readDiscoveryState() {
+    await this.reconcileServerUrl();
+    return this.readDiscoveryStateAfterReconcile();
+  }
+  async readDiscoveryStateAfterReconcile() {
+    return readJsonFile(this.discoveryStatePath);
+  }
+  async saveDiscoveryState(value) {
+    await this.reconcileServerUrl();
+    await this.ensureDir();
+    await writeJsonFile(this.discoveryStatePath, value);
+  }
+  async readAuthorizationServerUrl() {
+    await this.reconcileServerUrl();
+    return this.readTextAfterReconcile(this.authorizationServerUrlPath);
+  }
+  async saveAuthorizationServerUrl(value) {
+    await this.reconcileServerUrl();
+    await this.ensureDir();
+    await writeTextFileAtomic(this.authorizationServerUrlPath, value);
+  }
+  async readResourceUrl() {
+    await this.reconcileServerUrl();
+    return this.readTextAfterReconcile(this.resourceUrlPath);
+  }
+  async saveResourceUrl(value) {
+    await this.reconcileServerUrl();
+    await this.ensureDir();
+    await writeTextFileAtomic(this.resourceUrlPath, value);
+  }
+  async readTextAfterReconcile(filePath) {
+    try {
+      return (await fs.readFile(filePath, "utf8")).trim() || void 0;
+    } catch (error) {
+      if (error.code === "ENOENT")
+        return void 0;
+      throw error;
+    }
+  }
+  async clear(scope) {
+    await this.reconcileServerUrl();
+    await this.clearFiles(scope);
+  }
+  async clearFiles(scope) {
+    const files = [];
+    if (scope === "all" || scope === "tokens") {
+      files.push(this.tokenPath);
+    }
+    if (scope === "all" || scope === "client") {
+      files.push(this.clientInfoPath);
+    }
+    if (scope === "all" || scope === "verifier") {
+      files.push(this.codeVerifierPath);
+    }
+    if (scope === "all" || scope === "state") {
+      files.push(this.statePath);
+    }
+    if (scope === "all" || scope === "discovery") {
+      files.push(this.discoveryStatePath, this.authorizationServerUrlPath, this.resourceUrlPath);
+    }
+    await Promise.all(files.map((file) => this.unlinkIfPresent(file)));
+  }
+};
+var VaultPersistence = class {
+  definition;
+  tokenSnapshots;
+  clientSnapshots;
+  constructor(definition) {
+    this.definition = definition;
+  }
+  describe() {
+    return `${getOAuthVaultPath()} (vault)`;
+  }
+  async reconcileServerUrl() {
+    await reconcileVaultServerUrl(this.definition);
+  }
+  async readSnapshot() {
+    await this.reconcileServerUrl();
+    const recovery = await loadVaultEntryForRecovery(this.definition);
+    this.tokenSnapshots = recovery.tokenSnapshots;
+    this.clientSnapshots = recovery.clientSnapshots;
+    return {
+      tokens: recovery.entry?.tokens,
+      clientInfo: recovery.entry?.clientInfo,
+      codeVerifier: recovery.entry?.codeVerifier,
+      state: recovery.entry?.state,
+      discoveryState: recovery.entry?.discoveryState,
+      authorizationServerUrl: recovery.entry?.authorizationServerUrl,
+      resourceUrl: recovery.entry?.resourceUrl
+    };
+  }
+  async readTokens() {
+    const snapshot = await this.readSnapshot();
+    return snapshot.tokens;
+  }
+  async saveTokens(tokens) {
+    await this.reconcileServerUrl();
+    await saveVaultEntry(this.definition, { tokens: prepareStoredTokens(tokens) });
+  }
+  async readClientInfo() {
+    const snapshot = await this.readSnapshot();
+    return snapshot.clientInfo;
+  }
+  async saveClientInfo(info) {
+    await this.reconcileServerUrl();
+    await saveVaultEntry(this.definition, { clientInfo: info });
+  }
+  async readCodeVerifier() {
+    const snapshot = await this.readSnapshot();
+    return snapshot.codeVerifier;
+  }
+  async saveCodeVerifier(value) {
+    await this.reconcileServerUrl();
+    await saveVaultEntry(this.definition, { codeVerifier: value });
+  }
+  async readState() {
+    const snapshot = await this.readSnapshot();
+    return snapshot.state;
+  }
+  async saveState(value) {
+    await this.reconcileServerUrl();
+    await saveVaultEntry(this.definition, { state: value });
+  }
+  async readDiscoveryState() {
+    return (await this.readSnapshot()).discoveryState;
+  }
+  async saveDiscoveryState(value) {
+    await this.reconcileServerUrl();
+    await saveVaultEntry(this.definition, { discoveryState: value });
+  }
+  async readAuthorizationServerUrl() {
+    return (await this.readSnapshot()).authorizationServerUrl;
+  }
+  async saveAuthorizationServerUrl(value) {
+    await this.reconcileServerUrl();
+    await saveVaultEntry(this.definition, { authorizationServerUrl: value });
+  }
+  async readResourceUrl() {
+    return (await this.readSnapshot()).resourceUrl;
+  }
+  async saveResourceUrl(value) {
+    await this.reconcileServerUrl();
+    await saveVaultEntry(this.definition, { resourceUrl: value });
+  }
+  async clear(scope) {
+    await this.reconcileServerUrl();
+    await clearVaultEntry(this.definition, scope);
+  }
+  async clearRejectedCredentials(expectedTokens, expectedClientInfo) {
+    await this.reconcileServerUrl();
+    await clearVaultTokensIfMatching(this.definition, expectedTokens, expectedClientInfo, expectedTokens ? this.tokenSnapshots : void 0, expectedClientInfo ? this.clientSnapshots : void 0);
+  }
+};
+var CompositePersistence = class {
+  stores;
+  recoveryTokenSnapshots = /* @__PURE__ */ new Map();
+  recoveryClientSnapshots = /* @__PURE__ */ new Map();
+  recoveryTokenSource;
+  recoveryClientSource;
+  constructor(stores) {
+    this.stores = stores;
+  }
+  describe() {
+    return this.stores.map((store) => store.describe()).join(" + ");
+  }
+  async readSnapshot() {
+    const snapshots = await Promise.all(this.stores.map((store) => store.readSnapshot()));
+    const tokens = this.firstSnapshotValue(snapshots, "tokens");
+    const clientInfo = this.firstSnapshotValue(snapshots, "clientInfo");
+    this.recoveryTokenSnapshots.clear();
+    this.recoveryClientSnapshots.clear();
+    for (const [index, snapshot] of snapshots.entries()) {
+      const store = this.stores[index];
+      this.recoveryTokenSnapshots.set(store, snapshot.tokens);
+      this.recoveryClientSnapshots.set(store, snapshot.clientInfo);
+    }
+    this.recoveryTokenSource = tokens.source;
+    this.recoveryClientSource = clientInfo.source;
+    return {
+      tokens: tokens.value,
+      clientInfo: clientInfo.value,
+      codeVerifier: this.firstSnapshotValue(snapshots, "codeVerifier").value,
+      state: this.firstSnapshotValue(snapshots, "state").value,
+      discoveryState: this.firstSnapshotValue(snapshots, "discoveryState").value,
+      authorizationServerUrl: this.firstSnapshotValue(snapshots, "authorizationServerUrl").value,
+      resourceUrl: this.firstSnapshotValue(snapshots, "resourceUrl").value
+    };
+  }
+  firstSnapshotValue(snapshots, field) {
+    for (const [index, snapshot] of snapshots.entries()) {
+      if (snapshot[field] !== void 0) {
+        return { value: snapshot[field], source: this.stores[index] };
+      }
+    }
+    return { value: void 0, source: void 0 };
+  }
+  async readTokens() {
+    const result = await this.readRecoveryValues((store) => store.readTokens(), this.recoveryTokenSnapshots);
+    this.recoveryTokenSource = result.source;
+    return result.value;
+  }
+  async readTokensPerStore() {
+    const perStore = await Promise.all(this.stores.map((store) => store.readTokens()));
+    return perStore.filter((tokens) => tokens !== void 0);
+  }
+  async saveTokens(tokens) {
+    const stored = prepareStoredTokens(tokens);
+    await Promise.all(this.stores.map((store) => store.saveTokens(stored)));
+  }
+  async clearRejectedCredentials(expectedTokens, expectedClientInfo) {
+    await Promise.all(this.stores.map((store) => {
+      const storedTokenSnapshot = expectedTokens ? this.recoveryTokenSnapshots.get(store) : void 0;
+      const tokenSnapshot = expectedTokens && storedTokenSnapshot && (store === this.recoveryTokenSource || sameOAuthTokenValue(storedTokenSnapshot, expectedTokens)) ? storedTokenSnapshot : void 0;
+      const storedClientSnapshot = expectedClientInfo ? this.recoveryClientSnapshots.get(store) : void 0;
+      const clientSnapshot = expectedClientInfo && storedClientSnapshot && (store === this.recoveryClientSource || sameOAuthClientValue(storedClientSnapshot, expectedClientInfo)) ? storedClientSnapshot : void 0;
+      return tokenSnapshot || clientSnapshot ? store.clearRejectedCredentials(tokenSnapshot, clientSnapshot) : Promise.resolve();
+    }));
+  }
+  async readClientInfo() {
+    const result = await this.readRecoveryValues((store) => store.readClientInfo(), this.recoveryClientSnapshots);
+    this.recoveryClientSource = result.source;
+    return result.value;
+  }
+  async readRecoveryValues(read, snapshots) {
+    const results = await Promise.allSettled(this.stores.map((store) => read(store)));
+    snapshots.clear();
+    let value;
+    let source;
+    for (const [index, result] of results.entries()) {
+      const store = this.stores[index];
+      if (result.status === "rejected") {
+        if (!source) {
+          throw result.reason;
+        }
+        continue;
+      }
+      snapshots.set(store, result.value);
+      if (!source && result.value !== void 0) {
+        source = store;
+        value = result.value;
+      }
+    }
+    return { value, source };
+  }
+  async saveClientInfo(info) {
+    const stored = withOAuthClientGeneration(info);
+    await Promise.all(this.stores.map((store) => store.saveClientInfo(stored)));
+  }
+  async readCodeVerifier() {
+    for (const store of this.stores) {
+      const result = await store.readCodeVerifier();
+      if (result) {
+        return result;
+      }
+    }
+    return void 0;
+  }
+  async saveCodeVerifier(value) {
+    await Promise.all(this.stores.map((store) => store.saveCodeVerifier(value)));
+  }
+  async readState() {
+    for (const store of this.stores) {
+      const result = await store.readState();
+      if (result) {
+        return result;
+      }
+    }
+    return void 0;
+  }
+  async saveState(value) {
+    await Promise.all(this.stores.map((store) => store.saveState(value)));
+  }
+  async readDiscoveryState() {
+    return this.readFirst((store) => store.readDiscoveryState());
+  }
+  async saveDiscoveryState(value) {
+    await Promise.all(this.stores.map((store) => store.saveDiscoveryState(value)));
+  }
+  async readAuthorizationServerUrl() {
+    return this.readFirst((store) => store.readAuthorizationServerUrl());
+  }
+  async saveAuthorizationServerUrl(value) {
+    await Promise.all(this.stores.map((store) => store.saveAuthorizationServerUrl(value)));
+  }
+  async readResourceUrl() {
+    return this.readFirst((store) => store.readResourceUrl());
+  }
+  async saveResourceUrl(value) {
+    await Promise.all(this.stores.map((store) => store.saveResourceUrl(value)));
+  }
+  async readFirst(read) {
+    for (const store of this.stores) {
+      const value = await read(store);
+      if (value !== void 0)
+        return value;
+    }
+    return void 0;
+  }
+  async clear(scope) {
+    await Promise.all(this.stores.map((store) => store.clear(scope)));
+  }
+};
+async function createOAuthPersistenceStores(definition, logger) {
+  const vault = new VaultPersistence(definition);
+  const stores = [vault];
+  const serverUrl = definition.command.kind === "http" ? definition.command.url.toString() : void 0;
+  if (definition.tokenCacheDir) {
+    stores.unshift(new DirectoryPersistence(definition.tokenCacheDir, logger, serverUrl));
+  }
+  const legacyDir = path2.join(legacyMcporterDir(), definition.name);
+  if (!definition.tokenCacheDir) {
+    const legacy = new DirectoryPersistence(legacyDir, logger, serverUrl, true);
+    const snapshot = await legacy.readSnapshot();
+    if (snapshot.tokens || snapshot.clientInfo || snapshot.codeVerifier || snapshot.state || snapshot.discoveryState || snapshot.authorizationServerUrl || snapshot.resourceUrl) {
+      if (snapshot.tokens) {
+        await vault.saveTokens(snapshot.tokens);
+      }
+      if (snapshot.clientInfo) {
+        await vault.saveClientInfo(snapshot.clientInfo);
+      }
+      if (snapshot.codeVerifier) {
+        await vault.saveCodeVerifier(snapshot.codeVerifier);
+      }
+      if (snapshot.state) {
+        await vault.saveState(snapshot.state);
+      }
+      if (snapshot.discoveryState) {
+        await vault.saveDiscoveryState(snapshot.discoveryState);
+      }
+      if (snapshot.authorizationServerUrl) {
+        await vault.saveAuthorizationServerUrl(snapshot.authorizationServerUrl);
+      }
+      if (snapshot.resourceUrl) {
+        await vault.saveResourceUrl(snapshot.resourceUrl);
+      }
+      logger?.info?.(`Migrated legacy OAuth cache for '${definition.name}' into vault.`);
+    }
+  }
+  return stores.length === 1 ? vault : new CompositePersistence(stores);
+}
+async function clearLegacyOAuthArtifacts(definition, logger, scope) {
+  const legacyDir = path2.join(legacyMcporterDir(), definition.name);
+  if (!definition.tokenCacheDir || legacyDir !== definition.tokenCacheDir) {
+    const legacy = new DirectoryPersistence(legacyDir, logger);
+    await legacy.clear(scope);
+  }
+  const legacyFiles = [];
+  if (definition.name.toLowerCase() === "gmail") {
+    legacyFiles.push(path2.join(os.homedir(), ".gmail-mcp", "credentials.json"));
+  }
+  await Promise.all(legacyFiles.map(async (file) => {
+    try {
+      await fs.unlink(file);
+      logger?.info?.(`Cleared legacy OAuth cache file ${file}`);
+    } catch (error) {
+      if (error.code !== "ENOENT") {
+        throw error;
+      }
+    }
+  }));
+}
+
+export {
+  sameOAuthTokenGeneration,
+  getOAuthVaultPath,
+  vaultCredentialKeys,
+  saveVaultEntry,
+  clearVaultEntry,
+  prepareStoredTokens,
+  createOAuthPersistenceStores,
+  clearLegacyOAuthArtifacts
+};