@1mcp/agent 0.39.0-beta.2 → 0.39.0-beta.4

package/build/auth/storage/nativeCredentialStore.js

@@ -0,0 +1,177 @@
+import { spawnSync } from 'node:child_process';
+import { z } from 'zod';
+export const NATIVE_CREDENTIAL_MAX_SECRET_BYTES = 1800;
+const HELPER_TIMEOUT_MS = 10_000;
+const HELPER_MAX_OUTPUT_BYTES = 16_384;
+const CREDENTIALS_NOT_FOUND = 'credentials not found in native keychain';
+const ERROR_MESSAGES = {
+    unsupported_platform: 'Native OAuth storage requires macOS, Windows, or Linux. Select file storage explicitly if needed.',
+    invalid_key: 'Native OAuth storage received an invalid credential key. Check the credential storage configuration.',
+    invalid_secret: 'Native OAuth storage requires a nonempty UTF-8 secret without NUL characters. Reauthorize the connection.',
+    secret_too_large: 'Native OAuth storage received a secret exceeding its per-entry limit. Check credential chunking.',
+    helper_unavailable: 'Native OAuth storage could not start its platform Docker credential helper. Install the helper on PATH and allow it to execute.',
+    helper_timeout: 'Native OAuth storage timed out. Unlock the OS credential store, allow access, and check the user-session credential service.',
+    helper_failed: 'Native OAuth storage failed. Unlock the OS credential store, allow access, and check the platform Docker credential helper and user-session service.',
+    invalid_response: 'Native OAuth storage returned an invalid credential response. Check the platform Docker credential helper and reauthorize if necessary.',
+};
+/** Contains no raw helper output, input, key, secret, or original error cause. */
+export class NativeCredentialStoreError extends Error {
+    code;
+    constructor(code) {
+        super(ERROR_MESSAGES[code]);
+        this.code = code;
+        this.name = 'NativeCredentialStoreError';
+    }
+}
+const HelperCredentialSchema = z.object({
+    Username: z.literal('1mcp'),
+    Secret: z.string(),
+    ServerURL: z.string().optional(),
+});
+/**
+ * Uses Docker's native helpers directly; the helper executable must be installed
+ * on PATH. Linux also requires a working, unlocked user-session Secret Service.
+ * Secrets travel only through stdin/stdout, never command arguments or files.
+ *
+ * Protocol and canonical missing response:
+ * https://github.com/docker/docker-credential-helpers/blob/master/credentials/credentials.go
+ * https://github.com/docker/docker-credential-helpers/blob/master/credentials/error.go
+ */
+export class DockerNativeCredentialStore {
+    command;
+    runner;
+    constructor(options = {}) {
+        this.command = helperForPlatform(options.platform ?? process.platform);
+        this.runner = options.runner ?? spawnSync;
+    }
+    read(key) {
+        validateKey(key);
+        const output = this.run('get', key);
+        if (output === null)
+            return null;
+        let decoded;
+        try {
+            decoded = JSON.parse(output);
+        }
+        catch {
+            throw new NativeCredentialStoreError('invalid_response');
+        }
+        const response = HelperCredentialSchema.safeParse(decoded);
+        if (!response.success)
+            throw new NativeCredentialStoreError('invalid_response');
+        if (response.data.ServerURL !== undefined && response.data.ServerURL !== key) {
+            throw new NativeCredentialStoreError('invalid_response');
+        }
+        if (!isPortableSecret(response.data.Secret))
+            throw new NativeCredentialStoreError('invalid_response');
+        if (Buffer.byteLength(response.data.Secret, 'utf8') > NATIVE_CREDENTIAL_MAX_SECRET_BYTES) {
+            throw new NativeCredentialStoreError('invalid_response');
+        }
+        return response.data.Secret;
+    }
+    write(key, value) {
+        validateKey(key);
+        if (!isPortableSecret(value))
+            throw new NativeCredentialStoreError('invalid_secret');
+        if (Buffer.byteLength(value, 'utf8') > NATIVE_CREDENTIAL_MAX_SECRET_BYTES) {
+            throw new NativeCredentialStoreError('secret_too_large');
+        }
+        this.run('store', JSON.stringify({ ServerURL: key, Username: '1mcp', Secret: value }));
+    }
+    delete(key) {
+        validateKey(key);
+        this.run('erase', key);
+    }
+    run(action, input) {
+        let result;
+        try {
+            result = this.runner(this.command, [action], {
+                input,
+                encoding: 'utf8',
+                shell: false,
+                windowsHide: true,
+                timeout: HELPER_TIMEOUT_MS,
+                killSignal: 'SIGKILL',
+                maxBuffer: HELPER_MAX_OUTPUT_BYTES,
+                stdio: ['pipe', 'pipe', 'pipe'],
+            });
+        }
+        catch (error) {
+            throw sanitizedHelperError(error);
+        }
+        if (result.error)
+            throw sanitizedHelperError(result.error);
+        if (result.signal)
+            throw new NativeCredentialStoreError('helper_failed');
+        if (typeof result.stdout !== 'string' || typeof result.stderr !== 'string') {
+            throw new NativeCredentialStoreError('invalid_response');
+        }
+        if (Buffer.byteLength(result.stdout, 'utf8') > HELPER_MAX_OUTPUT_BYTES) {
+            throw new NativeCredentialStoreError('invalid_response');
+        }
+        if (Buffer.byteLength(result.stderr, 'utf8') > HELPER_MAX_OUTPUT_BYTES) {
+            throw new NativeCredentialStoreError('invalid_response');
+        }
+        // Serve prints canonical errors on stdout and exits 1. Never classify a
+        // denied/locked/unavailable store from fuzzy matches or stderr content.
+        if (result.status === 1 && result.stdout.trim() === CREDENTIALS_NOT_FOUND && result.stderr === '') {
+            if (action !== 'store')
+                return null;
+        }
+        if (result.status !== 0)
+            throw new NativeCredentialStoreError('helper_failed');
+        if (result.stderr !== '')
+            throw new NativeCredentialStoreError('helper_failed');
+        if (action !== 'get' && result.stdout.trim() !== '') {
+            throw new NativeCredentialStoreError('invalid_response');
+        }
+        return result.stdout;
+    }
+}
+function helperForPlatform(platform) {
+    switch (platform) {
+        case 'darwin':
+            return 'docker-credential-osxkeychain';
+        case 'win32':
+            return 'docker-credential-wincred.exe';
+        case 'linux':
+            return 'docker-credential-secretservice';
+        default:
+            throw new NativeCredentialStoreError('unsupported_platform');
+    }
+}
+function sanitizedHelperError(error) {
+    const code = error instanceof Error && 'code' in error ? error.code : undefined;
+    if (code === 'ENOENT' || code === 'EACCES' || code === 'EPERM') {
+        return new NativeCredentialStoreError('helper_unavailable');
+    }
+    if (code === 'ETIMEDOUT')
+        return new NativeCredentialStoreError('helper_timeout');
+    return new NativeCredentialStoreError('helper_failed');
+}
+function isPortableSecret(value) {
+    if (typeof value !== 'string' || value.length === 0 || value.includes('\0'))
+        return false;
+    // Reject lone surrogates rather than let UTF-8 encoding change the secret.
+    return Buffer.from(value, 'utf8').toString('utf8') === value;
+}
+function validateKey(key) {
+    // Opaque keys are generated by the storage coordinator. A nonempty path and
+    // no query/fragment avoid platform helper URL normalization collisions.
+    if (typeof key !== 'string' || Buffer.byteLength(key, 'utf8') > 2048) {
+        throw new NativeCredentialStoreError('invalid_key');
+    }
+    if (!/^https:\/\/oauth\.1mcp\.invalid\/[-a-zA-Z0-9/_]+$/.test(key)) {
+        throw new NativeCredentialStoreError('invalid_key');
+    }
+    let parsed;
+    try {
+        parsed = new URL(key);
+    }
+    catch {
+        throw new NativeCredentialStoreError('invalid_key');
+    }
+    if (parsed.href !== key || parsed.pathname === '/')
+        throw new NativeCredentialStoreError('invalid_key');
+}
+//# sourceMappingURL=nativeCredentialStore.js.map

package/build/auth/storage/nativeCredentialStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nativeCredentialStore.js","sourceRoot":"","sources":["../../../src/auth/storage/nativeCredentialStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAA2C,MAAM,oBAAoB,CAAC;AAExF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB,MAAM,CAAC,MAAM,kCAAkC,GAAG,IAAI,CAAC;AACvD,MAAM,iBAAiB,GAAG,MAAM,CAAC;AACjC,MAAM,uBAAuB,GAAG,MAAM,CAAC;AACvC,MAAM,qBAAqB,GAAG,0CAA0C,CAAC;AAYzE,MAAM,cAAc,GAAmD;IACrE,oBAAoB,EAClB,mGAAmG;IACrG,WAAW,EAAE,sGAAsG;IACnH,cAAc,EACZ,2GAA2G;IAC7G,gBAAgB,EAAE,kGAAkG;IACpH,kBAAkB,EAChB,iIAAiI;IACnI,cAAc,EACZ,8HAA8H;IAChI,aAAa,EACX,sJAAsJ;IACxJ,gBAAgB,EACd,yIAAyI;CAC5I,CAAC;AAEF,kFAAkF;AAClF,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IACvB;IAA5B,YAA4B,IAAoC;QAC9D,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;QADF,SAAI,GAAJ,IAAI,CAAgC;QAE9D,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAiBD,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,OAAO,2BAA2B;IACrB,OAAO,CAAS;IAChB,MAAM,CAA+B;IAEtD,YAAY,UAAwE,EAAE;QACpF,IAAI,CAAC,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,SAAS,CAAC;IAC5C,CAAC;IAED,IAAI,CAAC,GAAW;QACd,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACpC,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAEjC,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,0BAA0B,CAAC,kBAAkB,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC3D,IAAI,CAAC,QAAQ,CAAC,OAAO;YAAE,MAAM,IAAI,0BAA0B,CAAC,kBAAkB,CAAC,CAAC;QAChF,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,KAAK,GAAG,EAAE,CAAC;YAC7E,MAAM,IAAI,0BAA0B,CAAC,kBAAkB,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,0BAA0B,CAAC,kBAAkB,CAAC,CAAC;QACtG,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,kCAAkC,EAAE,CAAC;YACzF,MAAM,IAAI,0BAA0B,CAAC,kBAAkB,CAAC,CAAC;QAC3D,CAAC;QACD,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,GAAW,EAAE,KAAa;QAC9B,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,0BAA0B,CAAC,gBAAgB,CAAC,CAAC;QACrF,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,kCAAkC,EAAE,CAAC;YAC1E,MAAM,IAAI,0BAA0B,CAAC,kBAAkB,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,CAAC,GAAW;QAChB,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACzB,CAAC;IAEO,GAAG,CAAC,MAAiC,EAAE,KAAa;QAC1D,IAAI,MAAoC,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE;gBAC3C,KAAK;gBACL,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,KAAK;gBACZ,WAAW,EAAE,IAAI;gBACjB,OAAO,EAAE,iBAAiB;gBAC1B,UAAU,EAAE,SAAS;gBACrB,SAAS,EAAE,uBAAuB;gBAClC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;aAChC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;QACD,IAAI,MAAM,CAAC,KAAK;YAAE,MAAM,oBAAoB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,MAAM,CAAC,MAAM;YAAE,MAAM,IAAI,0BAA0B,CAAC,eAAe,CAAC,CAAC;QACzE,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC3E,MAAM,IAAI,0BAA0B,CAAC,kBAAkB,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,uBAAuB,EAAE,CAAC;YACvE,MAAM,IAAI,0BAA0B,CAAC,kBAAkB,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,uBAAuB,EAAE,CAAC;YACvE,MAAM,IAAI,0BAA0B,CAAC,kBAAkB,CAAC,CAAC;QAC3D,CAAC;QACD,wEAAwE;QACxE,wEAAwE;QACxE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,qBAAqB,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YAClG,IAAI,MAAM,KAAK,OAAO;gBAAE,OAAO,IAAI,CAAC;QACtC,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,0BAA0B,CAAC,eAAe,CAAC,CAAC;QAC/E,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE;YAAE,MAAM,IAAI,0BAA0B,CAAC,eAAe,CAAC,CAAC;QAChF,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACpD,MAAM,IAAI,0BAA0B,CAAC,kBAAkB,CAAC,CAAC;QAC3D,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC;IACvB,CAAC;CACF;AAED,SAAS,iBAAiB,CAAC,QAAgB;IACzC,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,+BAA+B,CAAC;QACzC,KAAK,OAAO;YACV,OAAO,+BAA+B,CAAC;QACzC,KAAK,OAAO;YACV,OAAO,iCAAiC,CAAC;QAC3C;YACE,MAAM,IAAI,0BAA0B,CAAC,sBAAsB,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,MAAM,IAAI,GAAG,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QAC/D,OAAO,IAAI,0BAA0B,CAAC,oBAAoB,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,IAAI,0BAA0B,CAAC,gBAAgB,CAAC,CAAC;IAClF,OAAO,IAAI,0BAA0B,CAAC,eAAe,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1F,2EAA2E;IAC3E,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC;AAC/D,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,4EAA4E;IAC5E,wEAAwE;IACxE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;QACrE,MAAM,IAAI,0BAA0B,CAAC,aAAa,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,CAAC,mDAAmD,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,0BAA0B,CAAC,aAAa,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,0BAA0B,CAAC,aAAa,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,GAAG,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG;QAAE,MAAM,IAAI,0BAA0B,CAAC,aAAa,CAAC,CAAC;AAC1G,CAAC"}

package/build/auth/storage/oauthStorageService.d.ts

@@ -2,6 +2,7 @@ import { AuthCodeRepository } from './authCodeRepository.js';
 import { AuthRequestRepository } from './authRequestRepository.js';
 import { ClientDataRepository } from './clientDataRepository.js';
 import { FileStorageService } from './fileStorageService.js';
+import type { NativeCredentialStore } from './nativeCredentialStore.js';
 import { RefreshTokenFamilyRepository } from './refreshTokenFamilyRepository.js';
 import { SessionRepository } from './sessionRepository.js';
 /**
@@ -19,7 +20,11 @@ export declare class OAuthStorageService {
     private authRequests;
     private clientData;
     private refreshTokenFamilies;
-    constructor(storageDir?: string, runtimeScopeId?: string);
+    constructor(storageDir?: string, runtimeScopeId?: string, options?: {
+        credentialStore?: 'file' | 'native';
+        nativeStore?: NativeCredentialStore;
+        runtimeScope?: string;
+    });
     /**
      * Processes user consent approval
      *
@@ -53,6 +58,8 @@ export declare class OAuthStorageService {
     get authRequestRepository(): AuthRequestRepository;
     get clientDataRepository(): ClientDataRepository;
     get refreshTokenFamilyRepository(): RefreshTokenFamilyRepository;
+    ready(): Promise<void>;
+    isReady(): boolean;
     /**
      * Gets the storage directory path
      */

package/build/auth/storage/oauthStorageService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauthStorageService.d.ts","sourceRoot":"","sources":["../../../src/auth/storage/oauthStorageService.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D;;;;;;;GAOG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,OAAO,CAAqB;IACpC,OAAO,CAAC,QAAQ,CAAoB;IACpC,OAAO,CAAC,SAAS,CAAqB;IACtC,OAAO,CAAC,YAAY,CAAwB;IAC5C,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,oBAAoB,CAA+B;gBAE/C,UAAU,CAAC,EAAE,MAAM,EAAE,cAAc,SAAiE;IAShH;;;;;OAKG;IACG,sBAAsB,CAC1B,aAAa,EAAE,MAAM,EACrB,cAAc,EAAE,MAAM,EAAE,GACvB,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,GAAG,CAAA;KAAE,CAAC;IA2ClD;;;;OAIG;IACG,oBAAoB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IA6B/D;;OAEG;IACH,0BAA0B,CACxB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,aAAa,CAAC,EAAE,MAAM,EACtB,KAAK,CAAC,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,EAAE,GAChB,MAAM;IAIT;;OAEG;IACH,uBAAuB,CAAC,aAAa,EAAE,MAAM;IAK7C,IAAI,iBAAiB,IAAI,iBAAiB,CAEzC;IAED;;OAEG;IACH,IAAI,WAAW,IAAI,kBAAkB,CAEpC;IAED,IAAI,kBAAkB,IAAI,kBAAkB,CAE3C;IAED,IAAI,qBAAqB,IAAI,qBAAqB,CAEjD;IAED,IAAI,oBAAoB,IAAI,oBAAoB,CAE/C;IAED,IAAI,4BAA4B,IAAI,4BAA4B,CAE/D;IAED;;OAEG;IACH,aAAa,IAAI,MAAM;IAIvB;;OAEG;IACH,QAAQ,IAAI,IAAI;CAGjB"}
+{"version":3,"file":"oauthStorageService.d.ts","sourceRoot":"","sources":["../../../src/auth/storage/oauthStorageService.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAE7D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D;;;;;;;GAOG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,OAAO,CAAsB;IACrC,OAAO,CAAC,QAAQ,CAAoB;IACpC,OAAO,CAAC,SAAS,CAAqB;IACtC,OAAO,CAAC,YAAY,CAAwB;IAC5C,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,oBAAoB,CAA+B;gBAGzD,UAAU,CAAC,EAAE,MAAM,EACnB,cAAc,SAAiE,EAC/E,OAAO,GAAE;QAAE,eAAe,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;QAAC,WAAW,CAAC,EAAE,qBAAqB,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAO;IAenH;;;;;OAKG;IACG,sBAAsB,CAC1B,aAAa,EAAE,MAAM,EACrB,cAAc,EAAE,MAAM,EAAE,GACvB,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,GAAG,CAAA;KAAE,CAAC;IAgDlD;;;;OAIG;IACG,oBAAoB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAgC/D;;OAEG;IACH,0BAA0B,CACxB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,aAAa,CAAC,EAAE,MAAM,EACtB,KAAK,CAAC,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,EAAE,GAChB,MAAM;IAIT;;OAEG;IACH,uBAAuB,CAAC,aAAa,EAAE,MAAM;IAK7C,IAAI,iBAAiB,IAAI,iBAAiB,CAEzC;IAED;;OAEG;IACH,IAAI,WAAW,IAAI,kBAAkB,CAEpC;IAED,IAAI,kBAAkB,IAAI,kBAAkB,CAE3C;IAED,IAAI,qBAAqB,IAAI,qBAAqB,CAEjD;IAED,IAAI,oBAAoB,IAAI,oBAAoB,CAE/C;IAED,IAAI,4BAA4B,IAAI,4BAA4B,CAE/D;IAED,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAItB,OAAO,IAAI,OAAO;IAIlB;;OAEG;IACH,aAAa,IAAI,MAAM;IAIvB;;OAEG;IACH,QAAQ,IAAI,IAAI;CAGjB"}

package/build/auth/storage/oauthStorageService.js

@@ -1,11 +1,12 @@
 import { AUTH_CONFIG } from '../../constants.js';
 import { RuntimeIdentityService } from '../../core/runtime/runtimeIdentityService.js';
+import { writeLocalDiagnostic } from '../../logger/localDiagnostics.js';
 import logger from '../../logger/logger.js';
 import { auditScopeOperation } from '../../utils/validation/scopeValidation.js';
 import { AuthCodeRepository } from './authCodeRepository.js';
 import { AuthRequestRepository } from './authRequestRepository.js';
 import { ClientDataRepository } from './clientDataRepository.js';
-import { FileStorageService } from './fileStorageService.js';
+import { InboundOAuthStorage } from './inboundOAuthStorage.js';
 import { RefreshTokenFamilyRepository } from './refreshTokenFamilyRepository.js';
 import { SessionRepository } from './sessionRepository.js';
 /**
@@ -23,8 +24,13 @@ export class OAuthStorageService {
     authRequests;
     clientData;
     refreshTokenFamilies;
-    constructor(storageDir, runtimeScopeId = new RuntimeIdentityService({ storageDir }).getRuntimeScopeId()) {
-        this.storage = new FileStorageService(storageDir, AUTH_CONFIG.SERVER.SESSION.SUBDIR);
+    constructor(storageDir, runtimeScopeId = new RuntimeIdentityService({ storageDir }).getRuntimeScopeId(), options = {}) {
+        this.storage = new InboundOAuthStorage({
+            baseDir: storageDir,
+            mode: options.credentialStore ?? 'file',
+            nativeStore: options.nativeStore,
+            runtimeScope: options.runtimeScope,
+        });
         this.sessions = new SessionRepository(this.storage);
         this.authCodes = new AuthCodeRepository(this.storage);
         this.authRequests = new AuthRequestRepository(this.storage);
@@ -38,33 +44,38 @@ export class OAuthStorageService {
      * the redirect URL for the client. Cleans up the temporary auth request.
      */
     async processConsentApproval(authRequestId, selectedScopes) {
-        const authRequest = this.authRequests.get(authRequestId);
-        if (!authRequest) {
-            throw new Error('Invalid or expired authorization request');
-        }
-        // Create authorization code with selected scopes
-        const authCode = this.authCodes.create(authRequest.clientId, authRequest.redirectUri, authRequest.resource || '', selectedScopes, AUTH_CONFIG.SERVER.AUTH_CODE.TTL_MS, authRequest.codeChallenge);
-        // Clean up the temporary auth request
-        this.authRequests.delete(authRequestId);
-        // Build redirect URL
-        const redirectUrl = new URL(authRequest.redirectUri);
-        redirectUrl.searchParams.set('code', authCode);
-        if (authRequest.state) {
-            redirectUrl.searchParams.set('state', authRequest.state);
-        }
-        // Audit the operation
-        auditScopeOperation('authorization_granted', {
-            clientId: authRequest.clientId,
-            requestedScopes: authRequest.scopes || [],
-            grantedScopes: selectedScopes,
-            success: true,
-        });
-        logger.info(`OAuth authorization granted for client ${authRequest.clientId}`, {
-            clientId: authRequest.clientId,
-            redirectUri: authRequest.redirectUri,
-            grantedScopes: selectedScopes,
+        return this.storage.withExclusiveLock('oauth-consent', () => {
+            const authRequest = this.authRequests.get(authRequestId);
+            if (!authRequest) {
+                throw new Error('Invalid or expired authorization request');
+            }
+            // Create authorization code with selected scopes
+            const authCode = this.authCodes.create(authRequest.clientId, authRequest.redirectUri, authRequest.resource || '', selectedScopes, AUTH_CONFIG.SERVER.AUTH_CODE.TTL_MS, authRequest.codeChallenge);
+            // Clean up the temporary auth request
+            this.authRequests.delete(authRequestId);
+            // Build redirect URL
+            const redirectUrl = new URL(authRequest.redirectUri);
+            redirectUrl.searchParams.set('code', authCode);
+            if (authRequest.state) {
+                redirectUrl.searchParams.set('state', authRequest.state);
+            }
+            // Audit the operation
+            auditScopeOperation('authorization_granted', {
+                clientId: authRequest.clientId,
+                requestedScopes: authRequest.scopes || [],
+                grantedScopes: selectedScopes,
+                success: true,
+            });
+            logger.info('oauthStorageService.oauth.authorization.granted.for.client.25a4e31b', {
+                clientId: authRequest.clientId,
+            });
+            writeLocalDiagnostic('info', 'oauth.consent.completed', {
+                stage: 'authorization_code_created',
+                outcome: 'approved',
+                scopeCount: selectedScopes.length,
+            });
+            return { authCode, redirectUrl };
         });
-        return { authCode, redirectUrl };
     }
     /**
      * Processes user consent denial
@@ -72,27 +83,30 @@ export class OAuthStorageService {
      * Builds an error redirect URL and cleans up the temporary auth request.
      */
     async processConsentDenial(authRequestId) {
-        const authRequest = this.authRequests.get(authRequestId);
-        if (!authRequest) {
-            throw new Error('Invalid or expired authorization request');
-        }
-        // Clean up the auth request
-        this.authRequests.delete(authRequestId);
-        // Build error redirect URL
-        const redirectUrl = new URL(authRequest.redirectUri);
-        redirectUrl.searchParams.set('error', 'access_denied');
-        redirectUrl.searchParams.set('error_description', 'User denied the request');
-        if (authRequest.state) {
-            redirectUrl.searchParams.set('state', authRequest.state);
-        }
-        // Audit the operation
-        auditScopeOperation('authorization_denied', {
-            clientId: authRequest.clientId,
-            success: false,
-            error: 'User denied authorization',
+        return this.storage.withExclusiveLock('oauth-consent', () => {
+            const authRequest = this.authRequests.get(authRequestId);
+            if (!authRequest) {
+                throw new Error('Invalid or expired authorization request');
+            }
+            // Clean up the auth request
+            this.authRequests.delete(authRequestId);
+            // Build error redirect URL
+            const redirectUrl = new URL(authRequest.redirectUri);
+            redirectUrl.searchParams.set('error', 'access_denied');
+            redirectUrl.searchParams.set('error_description', 'User denied the request');
+            if (authRequest.state) {
+                redirectUrl.searchParams.set('state', authRequest.state);
+            }
+            // Audit the operation
+            auditScopeOperation('authorization_denied', {
+                clientId: authRequest.clientId,
+                success: false,
+                error: 'User denied authorization',
+            });
+            logger.info('oauthStorageService.oauth.authorization.denied.by.user.for.client.29791f5d');
+            writeLocalDiagnostic('info', 'oauth.consent.completed', { stage: 'consent', outcome: 'denied' });
+            return redirectUrl;
         });
-        logger.info(`OAuth authorization denied by user for client ${authRequest.clientId}`);
-        return redirectUrl;
     }
     /**
      * Creates a temporary authorization request for the consent flow
@@ -128,6 +142,12 @@ export class OAuthStorageService {
     get refreshTokenFamilyRepository() {
         return this.refreshTokenFamilies;
     }
+    ready() {
+        return this.storage.ready();
+    }
+    isReady() {
+        return this.storage.isReady();
+    }
     /**
      * Gets the storage directory path
      */

package/build/auth/storage/oauthStorageService.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauthStorageService.js","sourceRoot":"","sources":["../../../src/auth/storage/oauthStorageService.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AACrF,OAAO,MAAM,MAAM,uBAAuB,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AAE/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D;;;;;;;GAOG;AACH,MAAM,OAAO,mBAAmB;IACtB,OAAO,CAAqB;IAC5B,QAAQ,CAAoB;IAC5B,SAAS,CAAqB;IAC9B,YAAY,CAAwB;IACpC,UAAU,CAAuB;IACjC,oBAAoB,CAA+B;IAE3D,YAAY,UAAmB,EAAE,cAAc,GAAG,IAAI,sBAAsB,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,iBAAiB,EAAE;QAC9G,IAAI,CAAC,OAAO,GAAG,IAAI,kBAAkB,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrF,IAAI,CAAC,QAAQ,GAAG,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,SAAS,GAAG,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtD,IAAI,CAAC,YAAY,GAAG,IAAI,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,UAAU,GAAG,IAAI,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzD,IAAI,CAAC,oBAAoB,GAAG,IAAI,4BAA4B,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAC7F,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,sBAAsB,CAC1B,aAAqB,EACrB,cAAwB;QAExB,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACzD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QAED,iDAAiD;QACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CACpC,WAAW,CAAC,QAAQ,EACpB,WAAW,CAAC,WAAW,EACvB,WAAW,CAAC,QAAQ,IAAI,EAAE,EAC1B,cAAc,EACd,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,EACnC,WAAW,CAAC,aAAa,CAC1B,CAAC;QAEF,sCAAsC;QACtC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAExC,qBAAqB;QACrB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QACrD,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC/C,IAAI,WAAW,CAAC,KAAK,EAAE,CAAC;YACtB,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;QAC3D,CAAC;QAED,sBAAsB;QACtB,mBAAmB,CAAC,uBAAuB,EAAE;YAC3C,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,eAAe,EAAE,WAAW,CAAC,MAAM,IAAI,EAAE;YACzC,aAAa,EAAE,cAAc;YAC7B,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QAEH,MAAM,CAAC,IAAI,CAAC,0CAA0C,WAAW,CAAC,QAAQ,EAAE,EAAE;YAC5E,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,WAAW,EAAE,WAAW,CAAC,WAAW;YACpC,aAAa,EAAE,cAAc;SAC9B,CAAC,CAAC;QAEH,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;IACnC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,oBAAoB,CAAC,aAAqB;QAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACzD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QAED,4BAA4B;QAC5B,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAExC,2BAA2B;QAC3B,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QACrD,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QACvD,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,yBAAyB,CAAC,CAAC;QAC7E,IAAI,WAAW,CAAC,KAAK,EAAE,CAAC;YACtB,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;QAC3D,CAAC;QAED,sBAAsB;QACtB,mBAAmB,CAAC,sBAAsB,EAAE;YAC1C,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,2BAA2B;SACnC,CAAC,CAAC;QAEH,MAAM,CAAC,IAAI,CAAC,iDAAiD,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;QAErF,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,0BAA0B,CACxB,QAAgB,EAChB,WAAmB,EACnB,aAAsB,EACtB,KAAc,EACd,QAAiB,EACjB,MAAiB;QAEjB,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjG,CAAC;IAED;;OAEG;IACH,uBAAuB,CAAC,aAAqB;QAC3C,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC9C,CAAC;IAED,qFAAqF;IACrF,IAAI,iBAAiB;QACnB,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,IAAI,kBAAkB;QACpB,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,IAAI,qBAAqB;QACvB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,IAAI,oBAAoB;QACtB,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,IAAI,4BAA4B;QAC9B,OAAO,IAAI,CAAC,oBAAoB,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,aAAa;QACX,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;IAC1B,CAAC;CACF"}
+{"version":3,"file":"oauthStorageService.js","sourceRoot":"","sources":["../../../src/auth/storage/oauthStorageService.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,MAAM,MAAM,uBAAuB,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AAE/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D;;;;;;;GAOG;AACH,MAAM,OAAO,mBAAmB;IACtB,OAAO,CAAsB;IAC7B,QAAQ,CAAoB;IAC5B,SAAS,CAAqB;IAC9B,YAAY,CAAwB;IACpC,UAAU,CAAuB;IACjC,oBAAoB,CAA+B;IAE3D,YACE,UAAmB,EACnB,cAAc,GAAG,IAAI,sBAAsB,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,iBAAiB,EAAE,EAC/E,UAA+G,EAAE;QAEjH,IAAI,CAAC,OAAO,GAAG,IAAI,mBAAmB,CAAC;YACrC,OAAO,EAAE,UAAU;YACnB,IAAI,EAAE,OAAO,CAAC,eAAe,IAAI,MAAM;YACvC,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,GAAG,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,SAAS,GAAG,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtD,IAAI,CAAC,YAAY,GAAG,IAAI,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,UAAU,GAAG,IAAI,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzD,IAAI,CAAC,oBAAoB,GAAG,IAAI,4BAA4B,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAC7F,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,sBAAsB,CAC1B,aAAqB,EACrB,cAAwB;QAExB,OAAO,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,eAAe,EAAE,GAAG,EAAE;YAC1D,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACzD,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;YAC9D,CAAC;YAED,iDAAiD;YACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CACpC,WAAW,CAAC,QAAQ,EACpB,WAAW,CAAC,WAAW,EACvB,WAAW,CAAC,QAAQ,IAAI,EAAE,EAC1B,cAAc,EACd,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,EACnC,WAAW,CAAC,aAAa,CAC1B,CAAC;YAEF,sCAAsC;YACtC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YAExC,qBAAqB;YACrB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;YACrD,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC/C,IAAI,WAAW,CAAC,KAAK,EAAE,CAAC;gBACtB,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;YAC3D,CAAC;YAED,sBAAsB;YACtB,mBAAmB,CAAC,uBAAuB,EAAE;gBAC3C,QAAQ,EAAE,WAAW,CAAC,QAAQ;gBAC9B,eAAe,EAAE,WAAW,CAAC,MAAM,IAAI,EAAE;gBACzC,aAAa,EAAE,cAAc;gBAC7B,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;YAEH,MAAM,CAAC,IAAI,CAAC,qEAAqE,EAAE;gBACjF,QAAQ,EAAE,WAAW,CAAC,QAAQ;aAC/B,CAAC,CAAC;YACH,oBAAoB,CAAC,MAAM,EAAE,yBAAyB,EAAE;gBACtD,KAAK,EAAE,4BAA4B;gBACnC,OAAO,EAAE,UAAU;gBACnB,UAAU,EAAE,cAAc,CAAC,MAAM;aAClC,CAAC,CAAC;YAEH,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,oBAAoB,CAAC,aAAqB;QAC9C,OAAO,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,eAAe,EAAE,GAAG,EAAE;YAC1D,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACzD,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;YAC9D,CAAC;YAED,4BAA4B;YAC5B,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YAExC,2BAA2B;YAC3B,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;YACrD,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YACvD,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,yBAAyB,CAAC,CAAC;YAC7E,IAAI,WAAW,CAAC,KAAK,EAAE,CAAC;gBACtB,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;YAC3D,CAAC;YAED,sBAAsB;YACtB,mBAAmB,CAAC,sBAAsB,EAAE;gBAC1C,QAAQ,EAAE,WAAW,CAAC,QAAQ;gBAC9B,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,2BAA2B;aACnC,CAAC,CAAC;YAEH,MAAM,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC;YAC1F,oBAAoB,CAAC,MAAM,EAAE,yBAAyB,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;YAEjG,OAAO,WAAW,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,0BAA0B,CACxB,QAAgB,EAChB,WAAmB,EACnB,aAAsB,EACtB,KAAc,EACd,QAAiB,EACjB,MAAiB;QAEjB,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjG,CAAC;IAED;;OAEG;IACH,uBAAuB,CAAC,aAAqB;QAC3C,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC9C,CAAC;IAED,qFAAqF;IACrF,IAAI,iBAAiB;QACnB,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,IAAI,kBAAkB;QACpB,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,IAAI,qBAAqB;QACvB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,IAAI,oBAAoB;QACtB,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,IAAI,4BAA4B;QAC9B,OAAO,IAAI,CAAC,oBAAoB,CAAC;IACnC,CAAC;IAED,KAAK;QACH,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IAC9B,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,aAAa;QACX,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;IAC1B,CAAC;CACF"}

package/build/auth/storage/protectedRecordStorage.d.ts

@@ -0,0 +1,129 @@
+import type { ExpirableData } from '../sessionTypes.js';
+import { type ZodType } from 'zod';
+import { FileStorageService } from './fileStorageService.js';
+import { type NativeCredentialStore } from './nativeCredentialStore.js';
+export type ProtectedRecordStoreMode = 'file' | 'native';
+export interface ProtectedRecordStorageOptions {
+    baseDir?: string;
+    mode: ProtectedRecordStoreMode;
+    nativeStore?: NativeCredentialStore;
+    runtimeScope?: string;
+    layout: ProtectedRecordLayout;
+}
+/** Domain-specific inventory and identity; platform storage remains shared. */
+export interface ProtectedRecordLayout {
+    domain: string;
+    subDir: string;
+    legacySubDir: string;
+    prefixes: readonly string[];
+    opaqueFileNames?: boolean;
+    synchronousWrites?: boolean;
+    manageExpiration?: boolean;
+}
+/** Deliberately contains neither helper output nor credential-bearing file contents. */
+export declare class ProtectedRecordStorageError extends Error {
+    constructor(detail?: string);
+}
+/** Startup calls this once after acquiring Runtime Scope ownership. Failure blocks OAuth, not unrelated servers. */
+export declare function activateProtectedRecordStore(options: ProtectedRecordStorageOptions): Promise<void>;
+export declare function createProtectedRecordStorage(options: ProtectedRecordStorageOptions): ProtectedRecordStorage;
+/** Cached readiness only: health requests never query helpers or expose failure payloads. */
+export declare function getProtectedRecordStoreReadiness(options: ProtectedRecordStorageOptions): {
+    mode: ProtectedRecordStoreMode;
+    ready: boolean;
+};
+/**
+ * Domain-neutral protected record storage. Entire records are secrets (including arbitrary registration/discovery fields).
+ * References and intents are nonexpiring and outside generic JSON/temporary-file cleanup.
+ * Every repository transaction uses one scope lock; reads are synchronous and never mutate storage.
+ */
+export declare class ProtectedRecordStorage extends FileStorageService {
+    readonly mode: ProtectedRecordStoreMode;
+    private nativeStore?;
+    private readonly metadataDir;
+    private readonly legacyDir;
+    private readonly scope;
+    private readonly runtimeScope;
+    private epoch?;
+    private initialized;
+    private activation?;
+    private busy;
+    private failed;
+    private readonly layout;
+    private constructionFailed;
+    private expirationTimer?;
+    private verifiedCategories;
+    constructor(options: ProtectedRecordStorageOptions);
+    getActivationKey(): string;
+    isReady(): boolean;
+    private get native();
+    ready(): Promise<void>;
+    /** File callers historically write synchronously; native readiness remains explicit. */
+    initializeFileMode(): void;
+    getExportDestinations(): string[];
+    /** Explicit startup boundary fences previous runtime writers. */
+    activate(): Promise<void>;
+    private prepareDirectory;
+    private initialize;
+    shutdown(): void;
+    withExclusiveLock<T>(_name: string, operation: () => Promise<T> | T): Promise<T>;
+    private runTransaction;
+    private mutate;
+    private commitTransaction;
+    private commitFileTransaction;
+    private finishFileTransaction;
+    private recoverTransaction;
+    private finishTransaction;
+    private writeFileRecord;
+    readData<T extends ExpirableData>(prefix: string, id: string, schema?: ZodType<T>): T | null;
+    writeData<T extends ExpirableData>(prefix: string, id: string, data: T): void;
+    writeDataDurable<T extends ExpirableData>(prefix: string, id: string, data: T): void;
+    deleteData(prefix: string, id: string): boolean;
+    private fileReference;
+    listFiles(prefix?: string): string[];
+    cleanupExpiredData(): number;
+    private logSafeError;
+    /** Caller owns explicit plaintext confirmation and exclusive stopped-runtime policy. */
+    exportToFile(): Promise<{
+        records: number;
+    }>;
+    private recoverExports;
+    private finishExport;
+    private migrateInventory;
+    private migrateLegacyFiles;
+    private managedFile;
+    private prepareNative;
+    private storeNative;
+    private finishDeletion;
+    private recoverIntents;
+    private finishIntent;
+    private nativeEnvelope;
+    private readNative;
+    private logicalFile;
+    private fileCategory;
+    private matchesCategory;
+    private backfillReferenceCategories;
+    private deleteChunks;
+    private chunkKey;
+    private recordKey;
+    private sourcePath;
+    private sourceFile;
+    private readSource;
+    private writeSource;
+    private validateReference;
+    private reference;
+    private references;
+    private writeReference;
+    private meta;
+    private state;
+    private assertOwner;
+    private assertEpoch;
+    private readJson;
+    private readText;
+    private atomic;
+    private atomicBytes;
+    private remove;
+    private flush;
+    private safe;
+}
+//# sourceMappingURL=protectedRecordStorage.d.ts.map

package/build/auth/storage/protectedRecordStorage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protectedRecordStorage.d.ts","sourceRoot":"","sources":["../../../src/auth/storage/protectedRecordStorage.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAU/D,OAAO,EAAK,KAAK,OAAO,EAAE,MAAM,KAAK,CAAC;AAEtC,OAAO,EAAE,kBAAkB,EAAwB,MAAM,yBAAyB,CAAC;AACnF,OAAO,EAEL,KAAK,qBAAqB,EAE3B,MAAM,4BAA4B,CAAC;AAEpC,MAAM,MAAM,wBAAwB,GAAG,MAAM,GAAG,QAAQ,CAAC;AACzD,MAAM,WAAW,6BAA6B;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,wBAAwB,CAAC;IAC/B,WAAW,CAAC,EAAE,qBAAqB,CAAC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,qBAAqB,CAAC;CAC/B;AACD,+EAA+E;AAC/E,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AA6CD,wFAAwF;AACxF,qBAAa,2BAA4B,SAAQ,KAAK;gBAElD,MAAM,SAAmK;CAK5K;AAgCD,oHAAoH;AACpH,wBAAsB,4BAA4B,CAAC,OAAO,EAAE,6BAA6B,GAAG,OAAO,CAAC,IAAI,CAAC,CAKxG;AAED,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,6BAA6B,GAAG,sBAAsB,CAE3G;AAED,6FAA6F;AAC7F,wBAAgB,gCAAgC,CAAC,OAAO,EAAE,6BAA6B,GAAG;IACxF,IAAI,EAAE,wBAAwB,CAAC;IAC/B,KAAK,EAAE,OAAO,CAAC;CAChB,CAcA;AAED;;;;GAIG;AACH,qBAAa,sBAAuB,SAAQ,kBAAkB;IAC5D,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC;IACxC,OAAO,CAAC,WAAW,CAAC,CAAwB;IAC5C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,KAAK,CAAC,CAAS;IACvB,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,UAAU,CAAC,CAAgB;IACnC,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;IAC/C,OAAO,CAAC,kBAAkB,CAAS;IACnC,OAAO,CAAC,eAAe,CAAC,CAAiC;IACzD,OAAO,CAAC,kBAAkB,CAA6D;gBAE3E,OAAO,EAAE,6BAA6B;IAyClD,gBAAgB,IAAI,MAAM;IAI1B,OAAO,IAAI,OAAO;IAIlB,OAAO,KAAK,MAAM,GAGjB;IAED,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAoBtB,wFAAwF;IACxF,kBAAkB,IAAI,IAAI;IAe1B,qBAAqB,IAAI,MAAM,EAAE;IAIjC,iEAAiE;IACjE,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAezB,OAAO,CAAC,gBAAgB;IAQxB,OAAO,CAAC,UAAU;IAgCT,QAAQ,IAAI,IAAI;IAMV,iBAAiB,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;YAcjF,cAAc;IAe5B,OAAO,CAAC,MAAM;IA0Bd,OAAO,CAAC,iBAAiB;IA6BzB,OAAO,CAAC,qBAAqB;IAmB7B,OAAO,CAAC,qBAAqB;IAqB7B,OAAO,CAAC,kBAAkB;IAO1B,OAAO,CAAC,iBAAiB;IAezB,OAAO,CAAC,eAAe;IAad,QAAQ,CAAC,CAAC,SAAS,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI;IAgD5F,SAAS,CAAC,CAAC,SAAS,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI;IAI7E,gBAAgB,CAAC,CAAC,SAAS,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI;IAYpF,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO;IAwBxD,OAAO,CAAC,aAAa;IAeZ,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE;IAcpC,kBAAkB,IAAI,MAAM;IA0CrC,OAAO,CAAC,YAAY;IAKpB,wFAAwF;IAClF,YAAY,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAkClD,OAAO,CAAC,cAAc;IAUtB,OAAO,CAAC,YAAY;IAepB,OAAO,CAAC,gBAAgB;IAmDxB,OAAO,CAAC,kBAAkB;IAgC1B,OAAO,CAAC,WAAW;IAMnB,OAAO,CAAC,aAAa;IA4CrB,OAAO,CAAC,WAAW;IAYnB,OAAO,CAAC,cAAc;IAOtB,OAAO,CAAC,cAAc;IAoBtB,OAAO,CAAC,YAAY;IAgBpB,OAAO,CAAC,cAAc;IA6BtB,OAAO,CAAC,UAAU;IAGlB,OAAO,CAAC,WAAW;IAInB,OAAO,CAAC,YAAY;IAQpB,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,2BAA2B;IAWnC,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,QAAQ;IAGhB,OAAO,CAAC,SAAS;IAGjB,OAAO,CAAC,UAAU;IASlB,OAAO,CAAC,UAAU;IAWlB,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,WAAW;IASnB,OAAO,CAAC,iBAAiB;IAoBzB,OAAO,CAAC,SAAS;IAWjB,OAAO,CAAC,UAAU;IAMlB,OAAO,CAAC,cAAc;IAMtB,OAAO,CAAC,IAAI;IAGZ,OAAO,CAAC,KAAK;IAIb,OAAO,CAAC,WAAW;IAenB,OAAO,CAAC,WAAW;IAanB,OAAO,CAAC,QAAQ;IAIhB,OAAO,CAAC,QAAQ;IAyBhB,OAAO,CAAC,MAAM;IAGd,OAAO,CAAC,WAAW;IAcnB,OAAO,CAAC,MAAM;IAYd,OAAO,CAAC,KAAK;IASb,OAAO,CAAC,IAAI;CAeb"}