@introspection-ai/recipes 0.28.0 → 0.30.0

package/dist/mcp-chunks/{chunk-7PFJCLXL.js → chunk-IWXEOLJL.js}

@@ -1,9 +1,9 @@
 import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url);
 
-// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/package.json
+// node_modules/.pnpm/mcporter@0.14.2/node_modules/mcporter/package.json
 var package_default = {
   name: "mcporter",
-  version: "0.13.13",
+  version: "0.14.2",
   description: "TypeScript runtime and CLI for connecting to configured Model Context Protocol servers.",
   keywords: [
     "cli",
@@ -43,35 +43,38 @@ var package_default = {
   },
   dependencies: {
     "@iarna/toml": "^2.2.5",
-    "@modelcontextprotocol/client": "^2.0.0",
-    "@modelcontextprotocol/server": "^2.0.0",
+    "@modelcontextprotocol/client": "^2.2.0",
+    "@modelcontextprotocol/server": "^2.2.0",
     acorn: "^8.18.0",
     commander: "^15.0.0",
     "es-toolkit": "^1.52.0",
     "jsonc-parser": "^3.3.1",
     ora: "^9.4.1",
-    rolldown: "1.2.8",
-    zod: "^4.6.2"
+    rolldown: "1.2.11",
+    zod: "^4.6.5"
   },
   devDependencies: {
-    "@modelcontextprotocol/sdk": "^1.30.0",
+    "@modelcontextprotocol/sdk": "^1.31.0",
     "@types/estree": "^1.0.9",
     "@types/express": "^5.0.6",
-    "@types/node": "^26.5.1",
+    "@types/node": "^26.6.3",
     "@typescript/native": "npm:typescript@^7.0.2",
-    "@vitest/coverage-v8": "^5.0.0",
+    "@vitest/coverage-v8": "^5.0.2",
     "bun-types": "^1.4.2",
     "cross-env": "^10.1.0",
     express: "^5.2.1",
-    oxfmt: "^0.67.0",
-    oxlint: "^1.82.0",
-    "oxlint-tsgolint": "^7.0.2001",
+    oxfmt: "^0.71.0",
+    oxlint: "^1.86.0",
+    "oxlint-tsgolint": "^7.0.2003",
     rimraf: "^6.1.3",
-    tsx: "^4.23.13",
+    tsx: "^4.23.15",
     typescript: "npm:@typescript/typescript6@^6.0.2",
-    vite: "8.3.0",
-    vitest: "^5.0.0"
+    vite: "8.3.1",
+    vitest: "^5.0.2"
   },
+  bundleDependencies: [
+    "@modelcontextprotocol/client"
+  ],
   devEngines: {
     runtime: [
       {
@@ -97,6 +100,7 @@ var package_default = {
     test: "cross-env MCPORTER_TEST_REPORTER=quiet pnpm test:verbose",
     "test:quiet": "cross-env MCPORTER_TEST_REPORTER=quiet pnpm test:verbose",
     "test:verbose": "pnpm build && node scripts/test-runner.js",
+    "test:package": "pnpm build && bash scripts/test-npm-package.sh",
     "test:live": "MCP_LIVE_TESTS=1 vitest run tests/live",
     "test:coverage": "pnpm build && cross-env MCPORTER_TEST_REPORTER=quiet vitest run --coverage",
     clean: "rimraf dist",
@@ -115,7 +119,7 @@ var package_default = {
   }
 };
 
-// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/version.js
+// node_modules/.pnpm/mcporter@0.14.2/node_modules/mcporter/dist/version.js
 var MCPORTER_VERSION = package_default.version;
 
 export {

package/dist/mcp-chunks/{chunk-D6SVCPN6.js → chunk-JQCSGX6E.js}

@@ -1,6 +1,6 @@
 import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url);
 
-// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/env.js
+// node_modules/.pnpm/mcporter@0.14.2/node_modules/mcporter/dist/env.js
 import os from "node:os";
 import path from "node:path";
 var ENV_DEFAULT_PATTERN = /^\$\{([A-Za-z_][A-Za-z0-9_]*)(?::-|:|-)?([^}]*)\}$/;

package/dist/mcp-chunks/{chunk-P463YBJM.js → chunk-JRU5LZJQ.js}

@@ -1,6 +1,6 @@
 import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url);
 
-// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/logging.js
+// node_modules/.pnpm/mcporter@0.14.2/node_modules/mcporter/dist/logging.js
 var LOG_LEVEL_ORDER = {
   debug: 10,
   info: 20,

package/dist/mcp-chunks/{chunk-XNHGMWN2.js → chunk-M7VINGHY.js}

@@ -4,13 +4,13 @@ import {
   withFileLock,
   writeJsonFile,
   writeTextFileAtomic
-} from "./chunk-H7ARMBV7.js";
+} from "./chunk-7OQUF6V6.js";
 
-// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/oauth-vault.js
+// node_modules/.pnpm/mcporter@0.14.2/node_modules/mcporter/dist/oauth-vault.js
 import crypto from "node:crypto";
 import path2 from "node:path";
 
-// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/oauth-credential-validation.js
+// node_modules/.pnpm/mcporter@0.14.2/node_modules/mcporter/dist/oauth-credential-validation.js
 function isRecord(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
@@ -31,7 +31,7 @@ function isStoredOAuthClientInformation(value) {
   return isOptionalString(value, "issuer");
 }
 
-// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/oauth-token-generation.js
+// node_modules/.pnpm/mcporter@0.14.2/node_modules/mcporter/dist/oauth-token-generation.js
 import { randomUUID } from "node:crypto";
 import { isDeepStrictEqual } from "node:util";
 var TOKEN_GENERATION_FIELD = "__mcporter_generation";
@@ -111,7 +111,7 @@ function sameOAuthClientValue(left, right) {
   return isDeepStrictEqual(withoutClientGeneration(left), withoutClientGeneration(right));
 }
 
-// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/runtime/environment.js
+// node_modules/.pnpm/mcporter@0.14.2/node_modules/mcporter/dist/runtime/environment.js
 import { AsyncLocalStorage } from "node:async_hooks";
 import os from "node:os";
 import path from "node:path";
@@ -134,7 +134,7 @@ function runtimeStateDir(kind) {
   return root && path.isAbsolute(root) ? path.join(root, "mcporter") : path.join(runtimeHome(), ".mcporter");
 }
 
-// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/oauth-vault.js
+// node_modules/.pnpm/mcporter@0.14.2/node_modules/mcporter/dist/oauth-vault.js
 function getOAuthVaultPath() {
   return path2.join(runtimeStateDir("data"), "credentials.json");
 }
@@ -431,7 +431,7 @@ async function clearVaultEntry(definition, scope) {
   });
 }
 
-// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/oauth-persistence-stores.js
+// node_modules/.pnpm/mcporter@0.14.2/node_modules/mcporter/dist/oauth-persistence-stores.js
 import fs from "node:fs/promises";
 import path3 from "node:path";
 function withStoredExpiry(tokens) {
@@ -1000,7 +1000,9 @@ export {
   runtimeEnvironment,
   withRuntimeEnvironment,
   runtimeStateDir,
+  withOAuthClientGeneration,
   sameOAuthTokenGeneration,
+  sameOAuthClientGeneration,
   getOAuthVaultPath,
   vaultCredentialKeys,
   saveVaultEntry,

package/dist/mcp-chunks/{chunk-IF6LRV3J.js → chunk-OURSGEZX.js}

@@ -6,23 +6,23 @@ import {
   runtimeStateDir,
   sameOAuthTokenGeneration,
   vaultCredentialKeys
-} from "./chunk-XNHGMWN2.js";
+} from "./chunk-M7VINGHY.js";
 import {
   canonicalizeFilePath,
   isFileLockTimeoutError,
   withFileLock
-} from "./chunk-H7ARMBV7.js";
+} from "./chunk-7OQUF6V6.js";
 import {
   checkResourceAllowed,
   discoverOAuthServerInfo,
   refreshAuthorization,
   resourceUrlFromServerUrl
-} from "./chunk-S5F3HEZZ.js";
+} from "./chunk-IR5SMKTP.js";
 
-// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/oauth-token-refresh.js
+// node_modules/.pnpm/mcporter@0.14.2/node_modules/mcporter/dist/oauth-token-refresh.js
 import { Buffer } from "node:buffer";
 
-// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/oauth-client-info.js
+// node_modules/.pnpm/mcporter@0.14.2/node_modules/mcporter/dist/oauth-client-info.js
 function buildStaticClientInformation(definition, options = {}) {
   if (!definition.oauthClientId) {
     return void 0;
@@ -48,7 +48,7 @@ function resolveOAuthClientSecret(definition, options = {}) {
   return definition.oauthClientSecret;
 }
 
-// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/oauth-refresh-lock.js
+// node_modules/.pnpm/mcporter@0.14.2/node_modules/mcporter/dist/oauth-refresh-lock.js
 import { AsyncLocalStorage } from "node:async_hooks";
 import crypto from "node:crypto";
 import path from "node:path";
@@ -111,7 +111,7 @@ function filenameSafeLabel(value) {
   return value.replace(/[^A-Za-z0-9._-]+/g, "_").replace(/^[._-]+/, "").slice(0, LOCK_LABEL_MAX);
 }
 
-// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/oauth-token-refresh.js
+// node_modules/.pnpm/mcporter@0.14.2/node_modules/mcporter/dist/oauth-token-refresh.js
 var TOKEN_EXPIRY_SKEW_SECONDS = 60;
 var TOKEN_REQUEST_TIMEOUT_MS = 1e4;
 var OAuthIssuerMismatchError = class extends Error {
@@ -506,7 +506,7 @@ function readClientSecret(definition, refreshClientSecretEnv) {
   return resolveOAuthClientSecret(definition, { rejectBlank: true });
 }
 
-// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/oauth-persistence.js
+// node_modules/.pnpm/mcporter@0.14.2/node_modules/mcporter/dist/oauth-persistence.js
 async function buildOAuthPersistence(definition, logger) {
   return await createOAuthPersistenceStores(definition, logger);
 }

package/dist/mcp-chunks/{chunk-H4KL74PV.js → chunk-P3S4OJPI.js}

@@ -5,9 +5,9 @@ import {
 import {
   resolveEnvPlaceholders,
   resolveEnvValue
-} from "./chunk-D6SVCPN6.js";
+} from "./chunk-JQCSGX6E.js";
 
-// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/chrome-devtools-command.js
+// node_modules/.pnpm/mcporter@0.14.2/node_modules/mcporter/dist/chrome-devtools-command.js
 var AUTO_CONNECT_FLAGS = /* @__PURE__ */ new Set(["--autoConnect", "--auto-connect"]);
 var NEGATED_AUTO_CONNECT_FLAGS = /* @__PURE__ */ new Set(["--no-autoConnect", "--no-auto-connect"]);
 var CONNECTION_VALUE_FLAGS = /* @__PURE__ */ new Set([
@@ -277,7 +277,7 @@ function booleanLiteral(value) {
   return void 0;
 }
 
-// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/runtime/utils.js
+// node_modules/.pnpm/mcporter@0.14.2/node_modules/mcporter/dist/runtime/utils.js
 var ENV_PLACEHOLDER_PATTERN = /\$\{(?:env:[^}]*|[A-Za-z_][A-Za-z0-9_]*(?::-[^}]*)?)\}/;
 var MAX_TIMER_DELAY_MS = 2147483647;
 function resolveCommandArgument(value, env = process.env) {
@@ -358,13 +358,13 @@ function scheduleDeadline(callback, delayMs) {
   };
 }
 
-// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/chrome-devtools-relay.js
+// node_modules/.pnpm/mcporter@0.14.2/node_modules/mcporter/dist/chrome-devtools-relay.js
 import { createHash as createHash3 } from "node:crypto";
 import fs from "node:fs";
 import os from "node:os";
 import path2 from "node:path";
 
-// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/chrome-devtools-relay-proxy.js
+// node_modules/.pnpm/mcporter@0.14.2/node_modules/mcporter/dist/chrome-devtools-relay-proxy.js
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 import http, {} from "node:http";
 var WEBSOCKET_GUID = "258EAFA5-E914-47DA-95CA-C5AB0DC85B11";
@@ -520,7 +520,7 @@ async function closeServer(server, sockets) {
   await new Promise((resolve) => server.close(() => resolve()));
 }
 
-// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/browser-relay-auth-v2.js
+// node_modules/.pnpm/mcporter@0.14.2/node_modules/mcporter/dist/browser-relay-auth-v2.js
 import { createHmac, hash, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
 var BROWSER_RELAY_AUTH_LABEL = "openclaw.browser-relay.auth";
 var BROWSER_RELAY_AUTH_VERSION = 2;
@@ -589,7 +589,7 @@ function isCanonicalBase64Url(value, bytes) {
   return decoded.byteLength === bytes && decoded.toString("base64url") === value;
 }
 
-// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/chrome-devtools-relay-client.js
+// node_modules/.pnpm/mcporter@0.14.2/node_modules/mcporter/dist/chrome-devtools-relay-client.js
 import { createHash as createHash2, randomBytes as randomBytes2 } from "node:crypto";
 import { lookup } from "node:dns/promises";
 import net from "node:net";
@@ -1100,7 +1100,7 @@ function isTimeoutError(error) {
   return Boolean(error && typeof error === "object" && error.reason === "timeout");
 }
 
-// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/chrome-devtools-relay-discovery.js
+// node_modules/.pnpm/mcporter@0.14.2/node_modules/mcporter/dist/chrome-devtools-relay-discovery.js
 import { spawn } from "node:child_process";
 import { statSync } from "node:fs";
 import net2 from "node:net";
@@ -1554,7 +1554,7 @@ function openClawDiscoveryEnvironment(env) {
   return filtered;
 }
 
-// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/chrome-devtools-relay.js
+// node_modules/.pnpm/mcporter@0.14.2/node_modules/mcporter/dist/chrome-devtools-relay.js
 var DEFAULT_RELAY_PROBE_TIMEOUT_MS = 2e4;
 var MIN_RELAY_PROBE_TIMEOUT_MS = 100;
 var MAX_RELAY_PROBE_TIMEOUT_MS = 3e4;

package/dist/mcp-chunks/{chunk-P3UVILEW.js → chunk-POYT6GCW.js}

@@ -1,13 +1,15 @@
 import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url);
 import {
   logWarn
-} from "./chunk-LQIE4PKL.js";
+} from "./chunk-CMDB57MS.js";
 
-// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/cli/output-utils.js
+// node_modules/.pnpm/mcporter@0.14.2/node_modules/mcporter/dist/cli/output-utils.js
 import fs from "node:fs";
 import path from "node:path";
 import { inspect } from "node:util";
 var RAW_INSPECT_DEPTH = 8;
+var TAIL_LOG_LINE_COUNT = 20;
+var TAIL_LOG_MAX_BYTES = 1024 * 1024;
 var PREFERRED_OUTPUT_BY_FORMAT = {
   auto: ["json", "markdown", "text", "raw"],
   text: ["text", "markdown", "json", "raw"],
@@ -44,9 +46,12 @@ function tailLogIfRequested(result, enabled) {
       continue;
     }
     try {
-      const content = fs.readFileSync(candidate, "utf8");
-      const lines = content.trimEnd().split(/\r?\n/);
-      const tail = lines.slice(-20);
+      const stats = fs.statSync(candidate);
+      if (!stats.isFile()) {
+        logWarn(`Refusing to tail non-file log path: ${candidate}`);
+        continue;
+      }
+      const tail = readLastLogLines(candidate, TAIL_LOG_LINE_COUNT);
       console.log(`--- tail ${candidate} ---`);
       for (const line of tail) {
         console.log(line);
@@ -56,6 +61,25 @@ function tailLogIfRequested(result, enabled) {
     }
   }
 }
+function readLastLogLines(filePath, lineCount) {
+  const fd = fs.openSync(filePath, fs.constants.O_RDONLY | fs.constants.O_NONBLOCK);
+  try {
+    const stats = fs.fstatSync(fd);
+    if (!stats.isFile())
+      throw new Error("Refusing to tail non-file log path");
+    const readSize = Math.min(stats.size, TAIL_LOG_MAX_BYTES);
+    const start = stats.size - readSize;
+    const buffer = Buffer.alloc(readSize);
+    const bytesRead = fs.readSync(fd, buffer, 0, readSize, start);
+    if (bytesRead <= 0) {
+      return [];
+    }
+    const lines = buffer.subarray(0, bytesRead).toString("utf8").trimEnd().split(/\r?\n/);
+    return lines.slice(-lineCount);
+  } finally {
+    fs.closeSync(fd);
+  }
+}
 function resolveRenderableOutput(wrapped, raw, preferredKinds) {
   for (const kind of preferredKinds) {
     if (kind === "json") {

package/dist/mcp-chunks/{chunk-5BMCVE2J.js → chunk-R636HUNL.js}

@@ -1,7 +1,7 @@
 import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url);
 import {
   launchDaemonDetached
-} from "./chunk-LXHPDKEF.js";
+} from "./chunk-FQAJT6U2.js";
 import {
   BrokerError,
   DAEMON_PROTOCOL_VERSION,
@@ -19,33 +19,33 @@ import {
   resolveProgressInterval,
   stopVerifiedLegacyDaemons,
   waitForDaemonReady
-} from "./chunk-FBVRU4Y3.js";
+} from "./chunk-VRTH73R5.js";
 import {
   canonicalUserConfiguration,
   getDaemonLogPath,
   secureDaemonDirectory
-} from "./chunk-PJCMJ65D.js";
+} from "./chunk-YGRORKGT.js";
 import {
   ChromeDevtoolsRelayDiscoveryError
-} from "./chunk-H4KL74PV.js";
+} from "./chunk-P3S4OJPI.js";
 import {
   withFileLock,
   writeJsonFile
-} from "./chunk-H7ARMBV7.js";
+} from "./chunk-7OQUF6V6.js";
 import {
   expandHome
-} from "./chunk-D6SVCPN6.js";
+} from "./chunk-JQCSGX6E.js";
 
-// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/cli/daemon-command.js
+// node_modules/.pnpm/mcporter@0.14.2/node_modules/mcporter/dist/cli/daemon-command.js
 import fsPromises from "node:fs/promises";
 import path2 from "node:path";
 
-// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/daemon/host.js
+// node_modules/.pnpm/mcporter@0.14.2/node_modules/mcporter/dist/daemon/host.js
 import fs from "node:fs/promises";
 import net from "node:net";
 import { randomUUID } from "node:crypto";
 
-// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/daemon/log-context.js
+// node_modules/.pnpm/mcporter@0.14.2/node_modules/mcporter/dist/daemon/log-context.js
 import fsSync from "node:fs";
 import path from "node:path";
 function createLogContext(options) {
@@ -97,7 +97,7 @@ async function disposeLogContext(context) {
   });
 }
 
-// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/daemon/host.js
+// node_modules/.pnpm/mcporter@0.14.2/node_modules/mcporter/dist/daemon/host.js
 async function runDaemonHost(options) {
   await secureDaemonDirectory();
   await assertLegacyDrained();
@@ -192,6 +192,8 @@ async function runDaemonHost(options) {
           }, resolveProgressInterval(request.progressIntervalMs));
         let result;
         let notices = [];
+        const activityServer = "server" in request.params ? request.params.server : void 0;
+        const logActivity = log.logAllServers || log.servers.size === 0 || typeof activityServer === "string" && log.servers.has(activityServer);
         switch (request.method) {
           case "status":
             result = status();
@@ -208,9 +210,11 @@ async function runDaemonHost(options) {
             result = true;
             break;
           default:
-            logEvent(log, `${request.method} start`);
+            if (logActivity)
+              logEvent(log, `${request.method} start`);
             ({ result, notices } = await broker.invokeWithNotices(request));
-            logEvent(log, `${request.method} success`);
+            if (logActivity)
+              logEvent(log, `${request.method} success`);
         }
         frames.write({ id, ok: true, result, notices });
         socket.end();
@@ -292,7 +296,7 @@ async function cleanupDaemonArtifactsIfOwned(paths, ownerPid) {
   await fs.unlink(paths.metadataPath);
 }
 
-// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/cli/daemon-command.js
+// node_modules/.pnpm/mcporter@0.14.2/node_modules/mcporter/dist/cli/daemon-command.js
 async function handleDaemonCli(args, options) {
   const subcommand = args.shift();
   if (!subcommand || subcommand === "help" || subcommand === "--help") {

package/dist/mcp-chunks/{chunk-TYYSBILI.js → chunk-SONMFI3S.js}

@@ -7,35 +7,63 @@ import {
   reconcilePersistedTokens,
   withRefreshLock,
   withRefreshRequestTimeout
-} from "./chunk-IF6LRV3J.js";
+} from "./chunk-OURSGEZX.js";
 import {
   runtimeEnvironment,
-  sameOAuthTokenGeneration
-} from "./chunk-XNHGMWN2.js";
+  sameOAuthClientGeneration,
+  sameOAuthTokenGeneration,
+  withOAuthClientGeneration
+} from "./chunk-M7VINGHY.js";
+import {
+  OAuthRequestedScopeSchema
+} from "./chunk-FWWPRZ37.js";
 import {
   isFileLockTimeoutError
-} from "./chunk-H7ARMBV7.js";
+} from "./chunk-7OQUF6V6.js";
 import {
   analyzeConnectionError
-} from "./chunk-O4JIUOWF.js";
+} from "./chunk-35JUFDQI.js";
 import {
   IssuerMismatchError,
   auth,
   validateClientMetadataUrl
-} from "./chunk-S5F3HEZZ.js";
+} from "./chunk-IR5SMKTP.js";
 
-// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/oauth-browser-suppression.js
+// node_modules/.pnpm/mcporter@0.14.2/node_modules/mcporter/dist/oauth-browser-suppression.js
 var TRUE_VALUES = /* @__PURE__ */ new Set(["1", "true", "yes"]);
 function suppressBrowserLaunchFromEnv(env = runtimeEnvironment()) {
   const raw = env.MCPORTER_OAUTH_NO_BROWSER;
   return raw !== void 0 && TRUE_VALUES.has(raw.trim().toLowerCase());
 }
 
-// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/oauth.js
+// node_modules/.pnpm/mcporter@0.14.2/node_modules/mcporter/dist/oauth.js
 import { spawn } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
 import http from "node:http";
-import { URL } from "node:url";
+import { URL as URL2 } from "node:url";
+
+// node_modules/.pnpm/mcporter@0.14.2/node_modules/mcporter/dist/oauth-redirect-uri.js
+function matchesFreshLoopbackRedirect(returned, requested) {
+  let redirect;
+  try {
+    redirect = new URL(returned);
+  } catch {
+    return false;
+  }
+  if (requested.protocol !== "http:" || redirect.protocol !== "http:")
+    return false;
+  if (!["127.0.0.1", "[::1]", "localhost"].includes(requested.hostname))
+    return false;
+  const sameHost = redirect.hostname === requested.hostname;
+  const fastmailShape = requested.hostname === "127.0.0.1" && redirect.hostname === "localhost" && redirect.port === "";
+  if (!sameHost && !fastmailShape)
+    return false;
+  redirect.hostname = requested.hostname;
+  redirect.port = requested.port;
+  return redirect.href === requested.href;
+}
+
+// node_modules/.pnpm/mcporter@0.14.2/node_modules/mcporter/dist/oauth.js
 var CALLBACK_HOST = "127.0.0.1";
 var CALLBACK_PATH = "/callback";
 var INTERACTIVE_AUTHORIZATION_TTL_MS = 3e5;
@@ -110,6 +138,7 @@ var PersistentOAuthClientProvider = class _PersistentOAuthClientProvider {
   // prompt, because only one persisted PKCE verifier can complete (issue #247).
   interactiveAuthorization = null;
   pendingVerifiersByChallenge = /* @__PURE__ */ new Map();
+  freshClientRegistration;
   server;
   constructor(definition, persistence, redirectUrl, logger, usesDynamicPort, options = {}) {
     this.definition = definition;
@@ -134,9 +163,11 @@ var PersistentOAuthClientProvider = class _PersistentOAuthClientProvider {
   }
   static async create(definition, logger, options = {}) {
     validateClientMetadataUrl(definition.oauthClientMetadataUrl);
+    if (definition.oauthRequestedScope !== void 0)
+      OAuthRequestedScopeSchema.parse(definition.oauthRequestedScope);
     const persistence = await buildOAuthPersistence(definition, logger);
     const server = http.createServer();
-    const overrideRedirect = definition.oauthRedirectUrl ? new URL(definition.oauthRedirectUrl) : null;
+    const overrideRedirect = definition.oauthRedirectUrl ? new URL2(definition.oauthRedirectUrl) : null;
     const listenHost = overrideRedirect?.hostname ?? CALLBACK_HOST;
     const overridePort = overrideRedirect?.port ?? "";
     const usesDynamicPort = !overrideRedirect || overridePort === "" || overridePort === "0";
@@ -153,7 +184,7 @@ var PersistentOAuthClientProvider = class _PersistentOAuthClientProvider {
       });
       server.once("error", (error) => reject(error));
     });
-    const redirectUrl = overrideRedirect ? new URL(overrideRedirect.toString()) : new URL(`http://${listenHost}:${port}${callbackPath}`);
+    const redirectUrl = overrideRedirect ? new URL2(overrideRedirect.toString()) : new URL2(`http://${listenHost}:${port}${callbackPath}`);
     if (usesDynamicPort) {
       redirectUrl.port = String(port);
     }
@@ -175,7 +206,7 @@ var PersistentOAuthClientProvider = class _PersistentOAuthClientProvider {
     server.on("request", async (req, res) => {
       try {
         const url = req.url ?? "";
-        const parsed = new URL(url, this.redirectUrlValue);
+        const parsed = new URL2(url, this.redirectUrlValue);
         const expectedPath = this.redirectUrlValue.pathname || "/callback";
         if (parsed.pathname !== expectedPath) {
           res.statusCode = 404;
@@ -264,7 +295,12 @@ var PersistentOAuthClientProvider = class _PersistentOAuthClientProvider {
     return stored;
   }
   async saveClientInformation(clientInformation) {
-    await this.persistence.saveClientInfo(clientInformation);
+    const previous = await this.persistence.readClientInfo();
+    const saved = withOAuthClientGeneration(clientInformation);
+    await this.persistence.saveClientInfo(saved);
+    if (!previous || previous.client_id !== saved.client_id) {
+      this.freshClientRegistration = saved;
+    }
   }
   async tokens(ctx) {
     const stored = await this.persistence.readTokens();
@@ -324,12 +360,14 @@ var PersistentOAuthClientProvider = class _PersistentOAuthClientProvider {
    */
   async onOAuthUnauthorized(context, continueDefault) {
     const rejected = context.presentedTokens;
-    if (!rejected) {
-      throw new OAuthRefreshUnavailableError(this.definition.name);
-    }
     try {
       await withRefreshLock(this.definition, async () => {
         const latest = await reconcilePersistedTokens(this.definition, this.persistence);
+        if (!rejected) {
+          if (!latest)
+            await continueDefault({ fetchFn: withRefreshRequestTimeout(oauthJsonFetch) });
+          return;
+        }
         if (!latest) {
           throw new OAuthRefreshUnavailableError(this.definition.name);
         }
@@ -347,6 +385,10 @@ var PersistentOAuthClientProvider = class _PersistentOAuthClientProvider {
   }
   async redirectToAuthorization(authorizationUrl) {
     await this.invalidateObsoleteDynamicRegistration();
+    if (this.definition.oauthRequestedScope !== void 0) {
+      authorizationUrl = new URL2(authorizationUrl);
+      authorizationUrl.searchParams.set("scope", this.definition.oauthRequestedScope);
+    }
     this.authorizationRedirectStarted = true;
     this.ensureAuthorizationDeferred();
     const challenge = authorizationUrl.searchParams.get("code_challenge");
@@ -486,11 +528,12 @@ var PersistentOAuthClientProvider = class _PersistentOAuthClientProvider {
     if (cachedClient?.client_id === this.definition.oauthClientMetadataUrl) {
       return;
     }
-    const cachedRedirect = firstRedirectUri(cachedClient);
-    if (!cachedClient || !cachedRedirect || cachedRedirect === this.redirectUrlValue.toString()) {
+    const redirects = redirectUris(cachedClient);
+    const fresh = this.freshClientRegistration && sameOAuthClientGeneration(cachedClient, this.freshClientRegistration);
+    if (!cachedClient || redirects.length === 0 || redirects.some((redirect) => redirect === this.redirectUrlValue.toString() || fresh && matchesFreshLoopbackRedirect(redirect, this.redirectUrlValue))) {
       return;
     }
-    this.logger.info(`Redirect URI changed (${cachedRedirect} \u2192 ${this.redirectUrlValue.toString()}); replacing obsolete client registration before interactive authorization.`);
+    this.logger.info(`Redirect URI changed (${redirects.join(", ")} \u2192 ${this.redirectUrlValue.toString()}); replacing obsolete client registration before interactive authorization.`);
     try {
       await this.persistence.clearRejectedCredentials(snapshot.tokens, cachedClient);
     } catch (error) {
@@ -516,16 +559,15 @@ async function createOAuthSession(definition, logger, options = {}) {
 function challengeForVerifier(verifier) {
   return createHash("sha256").update(verifier).digest("base64url");
 }
-function firstRedirectUri(client) {
+function redirectUris(client) {
   if (!client || typeof client !== "object") {
-    return void 0;
+    return [];
   }
-  const redirectUris = client.redirect_uris;
-  if (!Array.isArray(redirectUris)) {
-    return void 0;
+  const uris = client.redirect_uris;
+  if (!Array.isArray(uris)) {
+    return [];
   }
-  const [first] = redirectUris;
-  return typeof first === "string" ? first : void 0;
+  return uris.filter((uri) => typeof uri === "string");
 }
 function issuersMatch(first, second) {
   return first === second || first.endsWith("/") && first.slice(0, -1) === second || second.endsWith("/") && second.slice(0, -1) === first;
@@ -534,7 +576,7 @@ var __oauthInternals = {
   openExternal
 };
 
-// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/runtime-oauth-support.js
+// node_modules/.pnpm/mcporter@0.14.2/node_modules/mcporter/dist/runtime-oauth-support.js
 function maybeEnableOAuth(definition, logger) {
   if (definition.auth === "oauth" || definition.auth === "refreshable_bearer") {
     return void 0;
@@ -553,7 +595,7 @@ function isUnauthorizedError(error) {
   return issue.kind === "auth";
 }
 
-// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/runtime/oauth.js
+// node_modules/.pnpm/mcporter@0.14.2/node_modules/mcporter/dist/runtime/oauth.js
 var DEFAULT_OAUTH_CODE_TIMEOUT_MS = 3e5;
 var OAUTH_FLOW_ERROR = /* @__PURE__ */ Symbol("oauth-flow-error");
 var POST_AUTH_CONNECT_ERROR = /* @__PURE__ */ Symbol("post-auth-connect-error");