@1mcp/agent 0.39.0-beta.3 → 0.39.0-beta.4

package/build/auth/storage/oauthStorageService.js

@@ -1,11 +1,12 @@
 import { AUTH_CONFIG } from '../../constants.js';
 import { RuntimeIdentityService } from '../../core/runtime/runtimeIdentityService.js';
+import { writeLocalDiagnostic } from '../../logger/localDiagnostics.js';
 import logger from '../../logger/logger.js';
 import { auditScopeOperation } from '../../utils/validation/scopeValidation.js';
 import { AuthCodeRepository } from './authCodeRepository.js';
 import { AuthRequestRepository } from './authRequestRepository.js';
 import { ClientDataRepository } from './clientDataRepository.js';
-import { FileStorageService } from './fileStorageService.js';
+import { InboundOAuthStorage } from './inboundOAuthStorage.js';
 import { RefreshTokenFamilyRepository } from './refreshTokenFamilyRepository.js';
 import { SessionRepository } from './sessionRepository.js';
 /**
@@ -23,8 +24,13 @@ export class OAuthStorageService {
     authRequests;
     clientData;
     refreshTokenFamilies;
-    constructor(storageDir, runtimeScopeId = new RuntimeIdentityService({ storageDir }).getRuntimeScopeId()) {
-        this.storage = new FileStorageService(storageDir, AUTH_CONFIG.SERVER.SESSION.SUBDIR);
+    constructor(storageDir, runtimeScopeId = new RuntimeIdentityService({ storageDir }).getRuntimeScopeId(), options = {}) {
+        this.storage = new InboundOAuthStorage({
+            baseDir: storageDir,
+            mode: options.credentialStore ?? 'file',
+            nativeStore: options.nativeStore,
+            runtimeScope: options.runtimeScope,
+        });
         this.sessions = new SessionRepository(this.storage);
         this.authCodes = new AuthCodeRepository(this.storage);
         this.authRequests = new AuthRequestRepository(this.storage);
@@ -38,31 +44,38 @@ export class OAuthStorageService {
      * the redirect URL for the client. Cleans up the temporary auth request.
      */
     async processConsentApproval(authRequestId, selectedScopes) {
-        const authRequest = this.authRequests.get(authRequestId);
-        if (!authRequest) {
-            throw new Error('Invalid or expired authorization request');
-        }
-        // Create authorization code with selected scopes
-        const authCode = this.authCodes.create(authRequest.clientId, authRequest.redirectUri, authRequest.resource || '', selectedScopes, AUTH_CONFIG.SERVER.AUTH_CODE.TTL_MS, authRequest.codeChallenge);
-        // Clean up the temporary auth request
-        this.authRequests.delete(authRequestId);
-        // Build redirect URL
-        const redirectUrl = new URL(authRequest.redirectUri);
-        redirectUrl.searchParams.set('code', authCode);
-        if (authRequest.state) {
-            redirectUrl.searchParams.set('state', authRequest.state);
-        }
-        // Audit the operation
-        auditScopeOperation('authorization_granted', {
-            clientId: authRequest.clientId,
-            requestedScopes: authRequest.scopes || [],
-            grantedScopes: selectedScopes,
-            success: true,
-        });
-        logger.info('oauthStorageService.oauth.authorization.granted.for.client.25a4e31b', {
-            clientId: authRequest.clientId,
+        return this.storage.withExclusiveLock('oauth-consent', () => {
+            const authRequest = this.authRequests.get(authRequestId);
+            if (!authRequest) {
+                throw new Error('Invalid or expired authorization request');
+            }
+            // Create authorization code with selected scopes
+            const authCode = this.authCodes.create(authRequest.clientId, authRequest.redirectUri, authRequest.resource || '', selectedScopes, AUTH_CONFIG.SERVER.AUTH_CODE.TTL_MS, authRequest.codeChallenge);
+            // Clean up the temporary auth request
+            this.authRequests.delete(authRequestId);
+            // Build redirect URL
+            const redirectUrl = new URL(authRequest.redirectUri);
+            redirectUrl.searchParams.set('code', authCode);
+            if (authRequest.state) {
+                redirectUrl.searchParams.set('state', authRequest.state);
+            }
+            // Audit the operation
+            auditScopeOperation('authorization_granted', {
+                clientId: authRequest.clientId,
+                requestedScopes: authRequest.scopes || [],
+                grantedScopes: selectedScopes,
+                success: true,
+            });
+            logger.info('oauthStorageService.oauth.authorization.granted.for.client.25a4e31b', {
+                clientId: authRequest.clientId,
+            });
+            writeLocalDiagnostic('info', 'oauth.consent.completed', {
+                stage: 'authorization_code_created',
+                outcome: 'approved',
+                scopeCount: selectedScopes.length,
+            });
+            return { authCode, redirectUrl };
         });
-        return { authCode, redirectUrl };
     }
     /**
      * Processes user consent denial
@@ -70,27 +83,30 @@ export class OAuthStorageService {
      * Builds an error redirect URL and cleans up the temporary auth request.
      */
     async processConsentDenial(authRequestId) {
-        const authRequest = this.authRequests.get(authRequestId);
-        if (!authRequest) {
-            throw new Error('Invalid or expired authorization request');
-        }
-        // Clean up the auth request
-        this.authRequests.delete(authRequestId);
-        // Build error redirect URL
-        const redirectUrl = new URL(authRequest.redirectUri);
-        redirectUrl.searchParams.set('error', 'access_denied');
-        redirectUrl.searchParams.set('error_description', 'User denied the request');
-        if (authRequest.state) {
-            redirectUrl.searchParams.set('state', authRequest.state);
-        }
-        // Audit the operation
-        auditScopeOperation('authorization_denied', {
-            clientId: authRequest.clientId,
-            success: false,
-            error: 'User denied authorization',
+        return this.storage.withExclusiveLock('oauth-consent', () => {
+            const authRequest = this.authRequests.get(authRequestId);
+            if (!authRequest) {
+                throw new Error('Invalid or expired authorization request');
+            }
+            // Clean up the auth request
+            this.authRequests.delete(authRequestId);
+            // Build error redirect URL
+            const redirectUrl = new URL(authRequest.redirectUri);
+            redirectUrl.searchParams.set('error', 'access_denied');
+            redirectUrl.searchParams.set('error_description', 'User denied the request');
+            if (authRequest.state) {
+                redirectUrl.searchParams.set('state', authRequest.state);
+            }
+            // Audit the operation
+            auditScopeOperation('authorization_denied', {
+                clientId: authRequest.clientId,
+                success: false,
+                error: 'User denied authorization',
+            });
+            logger.info('oauthStorageService.oauth.authorization.denied.by.user.for.client.29791f5d');
+            writeLocalDiagnostic('info', 'oauth.consent.completed', { stage: 'consent', outcome: 'denied' });
+            return redirectUrl;
         });
-        logger.info('oauthStorageService.oauth.authorization.denied.by.user.for.client.29791f5d');
-        return redirectUrl;
     }
     /**
      * Creates a temporary authorization request for the consent flow
@@ -126,6 +142,12 @@ export class OAuthStorageService {
     get refreshTokenFamilyRepository() {
         return this.refreshTokenFamilies;
     }
+    ready() {
+        return this.storage.ready();
+    }
+    isReady() {
+        return this.storage.isReady();
+    }
     /**
      * Gets the storage directory path
      */

package/build/auth/storage/oauthStorageService.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauthStorageService.js","sourceRoot":"","sources":["../../../src/auth/storage/oauthStorageService.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AACrF,OAAO,MAAM,MAAM,uBAAuB,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AAE/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D;;;;;;;GAOG;AACH,MAAM,OAAO,mBAAmB;IACtB,OAAO,CAAqB;IAC5B,QAAQ,CAAoB;IAC5B,SAAS,CAAqB;IAC9B,YAAY,CAAwB;IACpC,UAAU,CAAuB;IACjC,oBAAoB,CAA+B;IAE3D,YAAY,UAAmB,EAAE,cAAc,GAAG,IAAI,sBAAsB,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,iBAAiB,EAAE;QAC9G,IAAI,CAAC,OAAO,GAAG,IAAI,kBAAkB,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrF,IAAI,CAAC,QAAQ,GAAG,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,SAAS,GAAG,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtD,IAAI,CAAC,YAAY,GAAG,IAAI,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,UAAU,GAAG,IAAI,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzD,IAAI,CAAC,oBAAoB,GAAG,IAAI,4BAA4B,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAC7F,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,sBAAsB,CAC1B,aAAqB,EACrB,cAAwB;QAExB,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACzD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QAED,iDAAiD;QACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CACpC,WAAW,CAAC,QAAQ,EACpB,WAAW,CAAC,WAAW,EACvB,WAAW,CAAC,QAAQ,IAAI,EAAE,EAC1B,cAAc,EACd,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,EACnC,WAAW,CAAC,aAAa,CAC1B,CAAC;QAEF,sCAAsC;QACtC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAExC,qBAAqB;QACrB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QACrD,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC/C,IAAI,WAAW,CAAC,KAAK,EAAE,CAAC;YACtB,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;QAC3D,CAAC;QAED,sBAAsB;QACtB,mBAAmB,CAAC,uBAAuB,EAAE;YAC3C,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,eAAe,EAAE,WAAW,CAAC,MAAM,IAAI,EAAE;YACzC,aAAa,EAAE,cAAc;YAC7B,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QAEH,MAAM,CAAC,IAAI,CAAC,qEAAqE,EAAE;YACjF,QAAQ,EAAE,WAAW,CAAC,QAAQ;SAC/B,CAAC,CAAC;QAEH,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;IACnC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,oBAAoB,CAAC,aAAqB;QAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACzD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QAED,4BAA4B;QAC5B,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAExC,2BAA2B;QAC3B,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QACrD,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QACvD,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,yBAAyB,CAAC,CAAC;QAC7E,IAAI,WAAW,CAAC,KAAK,EAAE,CAAC;YACtB,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;QAC3D,CAAC;QAED,sBAAsB;QACtB,mBAAmB,CAAC,sBAAsB,EAAE;YAC1C,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,2BAA2B;SACnC,CAAC,CAAC;QAEH,MAAM,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC;QAE1F,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,0BAA0B,CACxB,QAAgB,EAChB,WAAmB,EACnB,aAAsB,EACtB,KAAc,EACd,QAAiB,EACjB,MAAiB;QAEjB,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjG,CAAC;IAED;;OAEG;IACH,uBAAuB,CAAC,aAAqB;QAC3C,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC9C,CAAC;IAED,qFAAqF;IACrF,IAAI,iBAAiB;QACnB,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,IAAI,kBAAkB;QACpB,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,IAAI,qBAAqB;QACvB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,IAAI,oBAAoB;QACtB,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,IAAI,4BAA4B;QAC9B,OAAO,IAAI,CAAC,oBAAoB,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,aAAa;QACX,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;IAC1B,CAAC;CACF"}
+{"version":3,"file":"oauthStorageService.js","sourceRoot":"","sources":["../../../src/auth/storage/oauthStorageService.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,MAAM,MAAM,uBAAuB,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AAE/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D;;;;;;;GAOG;AACH,MAAM,OAAO,mBAAmB;IACtB,OAAO,CAAsB;IAC7B,QAAQ,CAAoB;IAC5B,SAAS,CAAqB;IAC9B,YAAY,CAAwB;IACpC,UAAU,CAAuB;IACjC,oBAAoB,CAA+B;IAE3D,YACE,UAAmB,EACnB,cAAc,GAAG,IAAI,sBAAsB,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,iBAAiB,EAAE,EAC/E,UAA+G,EAAE;QAEjH,IAAI,CAAC,OAAO,GAAG,IAAI,mBAAmB,CAAC;YACrC,OAAO,EAAE,UAAU;YACnB,IAAI,EAAE,OAAO,CAAC,eAAe,IAAI,MAAM;YACvC,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,GAAG,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,SAAS,GAAG,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtD,IAAI,CAAC,YAAY,GAAG,IAAI,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,UAAU,GAAG,IAAI,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzD,IAAI,CAAC,oBAAoB,GAAG,IAAI,4BAA4B,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAC7F,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,sBAAsB,CAC1B,aAAqB,EACrB,cAAwB;QAExB,OAAO,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,eAAe,EAAE,GAAG,EAAE;YAC1D,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACzD,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;YAC9D,CAAC;YAED,iDAAiD;YACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CACpC,WAAW,CAAC,QAAQ,EACpB,WAAW,CAAC,WAAW,EACvB,WAAW,CAAC,QAAQ,IAAI,EAAE,EAC1B,cAAc,EACd,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,EACnC,WAAW,CAAC,aAAa,CAC1B,CAAC;YAEF,sCAAsC;YACtC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YAExC,qBAAqB;YACrB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;YACrD,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC/C,IAAI,WAAW,CAAC,KAAK,EAAE,CAAC;gBACtB,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;YAC3D,CAAC;YAED,sBAAsB;YACtB,mBAAmB,CAAC,uBAAuB,EAAE;gBAC3C,QAAQ,EAAE,WAAW,CAAC,QAAQ;gBAC9B,eAAe,EAAE,WAAW,CAAC,MAAM,IAAI,EAAE;gBACzC,aAAa,EAAE,cAAc;gBAC7B,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;YAEH,MAAM,CAAC,IAAI,CAAC,qEAAqE,EAAE;gBACjF,QAAQ,EAAE,WAAW,CAAC,QAAQ;aAC/B,CAAC,CAAC;YACH,oBAAoB,CAAC,MAAM,EAAE,yBAAyB,EAAE;gBACtD,KAAK,EAAE,4BAA4B;gBACnC,OAAO,EAAE,UAAU;gBACnB,UAAU,EAAE,cAAc,CAAC,MAAM;aAClC,CAAC,CAAC;YAEH,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,oBAAoB,CAAC,aAAqB;QAC9C,OAAO,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,eAAe,EAAE,GAAG,EAAE;YAC1D,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACzD,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;YAC9D,CAAC;YAED,4BAA4B;YAC5B,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YAExC,2BAA2B;YAC3B,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;YACrD,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YACvD,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,yBAAyB,CAAC,CAAC;YAC7E,IAAI,WAAW,CAAC,KAAK,EAAE,CAAC;gBACtB,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;YAC3D,CAAC;YAED,sBAAsB;YACtB,mBAAmB,CAAC,sBAAsB,EAAE;gBAC1C,QAAQ,EAAE,WAAW,CAAC,QAAQ;gBAC9B,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,2BAA2B;aACnC,CAAC,CAAC;YAEH,MAAM,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC;YAC1F,oBAAoB,CAAC,MAAM,EAAE,yBAAyB,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;YAEjG,OAAO,WAAW,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,0BAA0B,CACxB,QAAgB,EAChB,WAAmB,EACnB,aAAsB,EACtB,KAAc,EACd,QAAiB,EACjB,MAAiB;QAEjB,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjG,CAAC;IAED;;OAEG;IACH,uBAAuB,CAAC,aAAqB;QAC3C,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC9C,CAAC;IAED,qFAAqF;IACrF,IAAI,iBAAiB;QACnB,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,IAAI,kBAAkB;QACpB,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,IAAI,qBAAqB;QACvB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,IAAI,oBAAoB;QACtB,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,IAAI,4BAA4B;QAC9B,OAAO,IAAI,CAAC,oBAAoB,CAAC;IACnC,CAAC;IAED,KAAK;QACH,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IAC9B,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,aAAa;QACX,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;IAC1B,CAAC;CACF"}

package/build/auth/storage/protectedRecordStorage.d.ts

@@ -0,0 +1,129 @@
+import type { ExpirableData } from '../sessionTypes.js';
+import { type ZodType } from 'zod';
+import { FileStorageService } from './fileStorageService.js';
+import { type NativeCredentialStore } from './nativeCredentialStore.js';
+export type ProtectedRecordStoreMode = 'file' | 'native';
+export interface ProtectedRecordStorageOptions {
+    baseDir?: string;
+    mode: ProtectedRecordStoreMode;
+    nativeStore?: NativeCredentialStore;
+    runtimeScope?: string;
+    layout: ProtectedRecordLayout;
+}
+/** Domain-specific inventory and identity; platform storage remains shared. */
+export interface ProtectedRecordLayout {
+    domain: string;
+    subDir: string;
+    legacySubDir: string;
+    prefixes: readonly string[];
+    opaqueFileNames?: boolean;
+    synchronousWrites?: boolean;
+    manageExpiration?: boolean;
+}
+/** Deliberately contains neither helper output nor credential-bearing file contents. */
+export declare class ProtectedRecordStorageError extends Error {
+    constructor(detail?: string);
+}
+/** Startup calls this once after acquiring Runtime Scope ownership. Failure blocks OAuth, not unrelated servers. */
+export declare function activateProtectedRecordStore(options: ProtectedRecordStorageOptions): Promise<void>;
+export declare function createProtectedRecordStorage(options: ProtectedRecordStorageOptions): ProtectedRecordStorage;
+/** Cached readiness only: health requests never query helpers or expose failure payloads. */
+export declare function getProtectedRecordStoreReadiness(options: ProtectedRecordStorageOptions): {
+    mode: ProtectedRecordStoreMode;
+    ready: boolean;
+};
+/**
+ * Domain-neutral protected record storage. Entire records are secrets (including arbitrary registration/discovery fields).
+ * References and intents are nonexpiring and outside generic JSON/temporary-file cleanup.
+ * Every repository transaction uses one scope lock; reads are synchronous and never mutate storage.
+ */
+export declare class ProtectedRecordStorage extends FileStorageService {
+    readonly mode: ProtectedRecordStoreMode;
+    private nativeStore?;
+    private readonly metadataDir;
+    private readonly legacyDir;
+    private readonly scope;
+    private readonly runtimeScope;
+    private epoch?;
+    private initialized;
+    private activation?;
+    private busy;
+    private failed;
+    private readonly layout;
+    private constructionFailed;
+    private expirationTimer?;
+    private verifiedCategories;
+    constructor(options: ProtectedRecordStorageOptions);
+    getActivationKey(): string;
+    isReady(): boolean;
+    private get native();
+    ready(): Promise<void>;
+    /** File callers historically write synchronously; native readiness remains explicit. */
+    initializeFileMode(): void;
+    getExportDestinations(): string[];
+    /** Explicit startup boundary fences previous runtime writers. */
+    activate(): Promise<void>;
+    private prepareDirectory;
+    private initialize;
+    shutdown(): void;
+    withExclusiveLock<T>(_name: string, operation: () => Promise<T> | T): Promise<T>;
+    private runTransaction;
+    private mutate;
+    private commitTransaction;
+    private commitFileTransaction;
+    private finishFileTransaction;
+    private recoverTransaction;
+    private finishTransaction;
+    private writeFileRecord;
+    readData<T extends ExpirableData>(prefix: string, id: string, schema?: ZodType<T>): T | null;
+    writeData<T extends ExpirableData>(prefix: string, id: string, data: T): void;
+    writeDataDurable<T extends ExpirableData>(prefix: string, id: string, data: T): void;
+    deleteData(prefix: string, id: string): boolean;
+    private fileReference;
+    listFiles(prefix?: string): string[];
+    cleanupExpiredData(): number;
+    private logSafeError;
+    /** Caller owns explicit plaintext confirmation and exclusive stopped-runtime policy. */
+    exportToFile(): Promise<{
+        records: number;
+    }>;
+    private recoverExports;
+    private finishExport;
+    private migrateInventory;
+    private migrateLegacyFiles;
+    private managedFile;
+    private prepareNative;
+    private storeNative;
+    private finishDeletion;
+    private recoverIntents;
+    private finishIntent;
+    private nativeEnvelope;
+    private readNative;
+    private logicalFile;
+    private fileCategory;
+    private matchesCategory;
+    private backfillReferenceCategories;
+    private deleteChunks;
+    private chunkKey;
+    private recordKey;
+    private sourcePath;
+    private sourceFile;
+    private readSource;
+    private writeSource;
+    private validateReference;
+    private reference;
+    private references;
+    private writeReference;
+    private meta;
+    private state;
+    private assertOwner;
+    private assertEpoch;
+    private readJson;
+    private readText;
+    private atomic;
+    private atomicBytes;
+    private remove;
+    private flush;
+    private safe;
+}
+//# sourceMappingURL=protectedRecordStorage.d.ts.map

package/build/auth/storage/protectedRecordStorage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protectedRecordStorage.d.ts","sourceRoot":"","sources":["../../../src/auth/storage/protectedRecordStorage.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAU/D,OAAO,EAAK,KAAK,OAAO,EAAE,MAAM,KAAK,CAAC;AAEtC,OAAO,EAAE,kBAAkB,EAAwB,MAAM,yBAAyB,CAAC;AACnF,OAAO,EAEL,KAAK,qBAAqB,EAE3B,MAAM,4BAA4B,CAAC;AAEpC,MAAM,MAAM,wBAAwB,GAAG,MAAM,GAAG,QAAQ,CAAC;AACzD,MAAM,WAAW,6BAA6B;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,wBAAwB,CAAC;IAC/B,WAAW,CAAC,EAAE,qBAAqB,CAAC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,qBAAqB,CAAC;CAC/B;AACD,+EAA+E;AAC/E,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AA6CD,wFAAwF;AACxF,qBAAa,2BAA4B,SAAQ,KAAK;gBAElD,MAAM,SAAmK;CAK5K;AAgCD,oHAAoH;AACpH,wBAAsB,4BAA4B,CAAC,OAAO,EAAE,6BAA6B,GAAG,OAAO,CAAC,IAAI,CAAC,CAKxG;AAED,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,6BAA6B,GAAG,sBAAsB,CAE3G;AAED,6FAA6F;AAC7F,wBAAgB,gCAAgC,CAAC,OAAO,EAAE,6BAA6B,GAAG;IACxF,IAAI,EAAE,wBAAwB,CAAC;IAC/B,KAAK,EAAE,OAAO,CAAC;CAChB,CAcA;AAED;;;;GAIG;AACH,qBAAa,sBAAuB,SAAQ,kBAAkB;IAC5D,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC;IACxC,OAAO,CAAC,WAAW,CAAC,CAAwB;IAC5C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,KAAK,CAAC,CAAS;IACvB,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,UAAU,CAAC,CAAgB;IACnC,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;IAC/C,OAAO,CAAC,kBAAkB,CAAS;IACnC,OAAO,CAAC,eAAe,CAAC,CAAiC;IACzD,OAAO,CAAC,kBAAkB,CAA6D;gBAE3E,OAAO,EAAE,6BAA6B;IAyClD,gBAAgB,IAAI,MAAM;IAI1B,OAAO,IAAI,OAAO;IAIlB,OAAO,KAAK,MAAM,GAGjB;IAED,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAoBtB,wFAAwF;IACxF,kBAAkB,IAAI,IAAI;IAe1B,qBAAqB,IAAI,MAAM,EAAE;IAIjC,iEAAiE;IACjE,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAezB,OAAO,CAAC,gBAAgB;IAQxB,OAAO,CAAC,UAAU;IAgCT,QAAQ,IAAI,IAAI;IAMV,iBAAiB,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;YAcjF,cAAc;IAe5B,OAAO,CAAC,MAAM;IA0Bd,OAAO,CAAC,iBAAiB;IA6BzB,OAAO,CAAC,qBAAqB;IAmB7B,OAAO,CAAC,qBAAqB;IAqB7B,OAAO,CAAC,kBAAkB;IAO1B,OAAO,CAAC,iBAAiB;IAezB,OAAO,CAAC,eAAe;IAad,QAAQ,CAAC,CAAC,SAAS,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI;IAgD5F,SAAS,CAAC,CAAC,SAAS,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI;IAI7E,gBAAgB,CAAC,CAAC,SAAS,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI;IAYpF,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO;IAwBxD,OAAO,CAAC,aAAa;IAeZ,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE;IAcpC,kBAAkB,IAAI,MAAM;IA0CrC,OAAO,CAAC,YAAY;IAKpB,wFAAwF;IAClF,YAAY,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAkClD,OAAO,CAAC,cAAc;IAUtB,OAAO,CAAC,YAAY;IAepB,OAAO,CAAC,gBAAgB;IAmDxB,OAAO,CAAC,kBAAkB;IAgC1B,OAAO,CAAC,WAAW;IAMnB,OAAO,CAAC,aAAa;IA4CrB,OAAO,CAAC,WAAW;IAYnB,OAAO,CAAC,cAAc;IAOtB,OAAO,CAAC,cAAc;IAoBtB,OAAO,CAAC,YAAY;IAgBpB,OAAO,CAAC,cAAc;IA6BtB,OAAO,CAAC,UAAU;IAGlB,OAAO,CAAC,WAAW;IAInB,OAAO,CAAC,YAAY;IAQpB,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,2BAA2B;IAWnC,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,QAAQ;IAGhB,OAAO,CAAC,SAAS;IAGjB,OAAO,CAAC,UAAU;IASlB,OAAO,CAAC,UAAU;IAWlB,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,WAAW;IASnB,OAAO,CAAC,iBAAiB;IAoBzB,OAAO,CAAC,SAAS;IAWjB,OAAO,CAAC,UAAU;IAMlB,OAAO,CAAC,cAAc;IAMtB,OAAO,CAAC,IAAI;IAGZ,OAAO,CAAC,KAAK;IAIb,OAAO,CAAC,WAAW;IAenB,OAAO,CAAC,WAAW;IAanB,OAAO,CAAC,QAAQ;IAIhB,OAAO,CAAC,QAAQ;IAyBhB,OAAO,CAAC,MAAM;IAGd,OAAO,CAAC,WAAW;IAcnB,OAAO,CAAC,MAAM;IAYd,OAAO,CAAC,KAAK;IASb,OAAO,CAAC,IAAI;CAeb"}