@akon-labs/nexus-cli 0.1.9 → 0.1.10

package/dist/extensions/mcp/mcp-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-auth.js","sourceRoot":"","sources":["../../../src/extensions/mcp/mcp-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAExD,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAC9C,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AACxD;;;;;;GAMG;AACH,MAAM,sBAAsB,GAAG,IAAI,CAAC;AACpC,6EAA6E;AAC7E,MAAM,uBAAuB,GAAG,IAAI,CAAC;AACrC,MAAM,6BAA6B,GAAG,oCAAoC,CAAC;AAC3E,MAAM,2BAA2B,GAAG,mCAAmC,CAAC;AACxE,MAAM,yBAAyB,GAAG,iCAAiC,CAAC;AACpE,MAAM,2BAA2B,GAAG,mCAAmC,CAAC;AACxE,MAAM,+BAA+B,GAAG,uCAAuC,CAAC;AAChF,MAAM,uBAAuB,GAAG,8BAA8B,CAAC;AAC/D,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAC3C,MAAM,uBAAuB,GAAG,wBAAwB,CAAC;AA6CzD,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAC1C,IAAI,GAAG,oCAAoC,CAAC;IAC5C,SAAS,CAA8B;IAEhD,YAAY,OAAe,EAAE,SAAsC,EAAE,KAAc,EAAE;QACpF,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAAA,CAC3B;CACD;AAOD,SAAS,kBAAkB,CAAC,KAAc,EAAE,OAAe,EAAW;IACrE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAW,CAAC;IAChC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,OAAO,CAAC,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,CAAC,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3F,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,MAAM;QAC7B,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClB,MAAM,SAAS,GAAG,OAAiF,CAAC;QACpG,IACC,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CACvD,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAC3D,EACA,CAAC;YACF,OAAO,IAAI,CAAC;QACb,CAAC;QACD,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC;IAC3B,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,MAAM,UAAU,qCAAqC,CAAC,KAAgC,EAAU;IAC/F,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,kBAAkB,CAAC,KAAK,EAAE,2CAA2C,CAAC,EAAE,CAAC;QAC5G,OAAO,yIAAyI,CAAC;IAClJ,CAAC;IACD,OAAO,4FAA4F,CAAC;AAAA,CACpG;AAwBD,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAEnC,IAAI,iBAAsD,CAAC;AAC3D,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAkB,CAAC;AAEpD,IAAI,4BAA4B,GAAG,CAAC,CAAC;AACrC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAiC,CAAC;AAEhE,SAAS,oBAAoB,CAAC,UAAkB,EAAE,OAA4B,EAAU;IACvF,OAAO,GAAG,UAAU,KAAK,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;AAAA,CACnD;AAED,SAAS,2BAA2B,CAAC,UAAkB,EAAQ;IAC9D,MAAM,MAAM,GAAG,GAAG,UAAU,IAAI,CAAC;IACjC,KAAK,MAAM,GAAG,IAAI,cAAc,CAAC,IAAI,EAAE,EAAE,CAAC;QACzC,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACxD,CAAC;AAAA,CACD;AAED,SAAS,uBAAuB,GAAY;IAC3C,OAAO,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,KAAK,GAAG,CAAC;AAAA,CACpD;AAED,SAAS,cAAc,CAAC,KAA4B,EAAyB;IAC5E,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;AAAA,CAChE;AAED,MAAM,qBAAqB,GAAoB;IAC9C,IAAI,CAAC,OAAO,EAAE;QACb,4BAA4B,EAAE,CAAC;QAC/B,OAAO,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAAA,CACtC;IACD,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE;QACvB,iBAAiB,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAAA,CACxC;IACD,MAAM,CAAC,OAAO,EAAE;QACf,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAAA,CAClC;CACD,CAAC;AAEF,MAAM,sBAAsB,GAAoB;IAC/C,IAAI,CAAC,OAAO,EAAE;QACb,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,IAAI,SAAS,CAAC;IAAA,CAC3D;IACD,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE;QACvB,eAAe,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAAA,CAC9C;IACD,MAAM,CAAC,OAAO,EAAE;QACf,eAAe,CAAC,OAAO,CAAC,CAAC,gBAAgB,EAAE,CAAC;IAAA,CAC5C;CACD,CAAC;AAEF,yEAAyE;AACzE,MAAM,0BAA0B,GAAoB;IACnD,IAAI,CAAC,OAAO,EAAE;QACb,4BAA4B,EAAE,CAAC;QAC/B,OAAO,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAAA,CACtC;IACD,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE;QACvB,IAAI,OAAO,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CACd,8EAA8E,uBAAuB,GAAG,CAAC,QAAQ,CACjH,CAAC;QACH,CAAC;QACD,iBAAiB,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAAA,CACxC;IACD,MAAM,CAAC,OAAO,EAAE;QACf,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAAA,CAClC;CACD,CAAC;AAEF,MAAM,0BAA0B,GAAoB;IACnD,IAAI,GAAG;QACN,4BAA4B,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAAA,CACjE;IACD,KAAK,GAAG;QACP,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAAA,CACjE;IACD,MAAM,GAAG;QACR,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAAA,CACjE;CACD,CAAC;AAEF,SAAS,yBAAyB,GAAU;IAC3C,OAAO,IAAI,KAAK,CAAC,8CAA8C,EAAE,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;AAAA,CACrG;AAED,MAAM,yBAAyB,GAAoB;IAClD,IAAI,GAAG;QACN,4BAA4B,EAAE,CAAC;QAC/B,MAAM,yBAAyB,EAAE,CAAC;IAAA,CAClC;IACD,KAAK,GAAG;QACP,MAAM,yBAAyB,EAAE,CAAC;IAAA,CAClC;IACD,MAAM,GAAG;QACR,MAAM,yBAAyB,EAAE,CAAC;IAAA,CAClC;CACD,CAAC;AAEF,MAAM,UAAU,wBAAwB,GAAS;IAChD,iBAAiB,CAAC,KAAK,EAAE,CAAC;IAC1B,cAAc,CAAC,KAAK,EAAE,CAAC;IACvB,4BAA4B,GAAG,CAAC,CAAC;AAAA,CACjC;AAED,MAAM,UAAU,mBAAmB,GAAS;IAC3C,cAAc,CAAC,KAAK,EAAE,CAAC;AAAA,CACvB;AAED,MAAM,UAAU,+BAA+B,GAAW;IACzD,OAAO,4BAA4B,CAAC;AAAA,CACpC;AAED,MAAM,UAAU,6BAA6B,GAAuB;IACnE,OAAO,CAAC,GAAG,iBAAiB,CAAC,OAAO,EAAE,CAAC,CAAC;AAAA,CACxC;AAED,MAAM,UAAU,2BAA2B,CAAC,OAAe,EAAE,OAAe,EAAQ;IACnF,iBAAiB,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAAA,CACxC;AAED,MAAM,UAAU,8BAA8B,CAAC,OAAe,EAAQ;IACrE,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAAA,CAClC;AAED,SAAS,kBAAkB,GAAoB;IAC9C,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,KAAK,QAAQ;QAAE,OAAO,qBAAqB,CAAC;IAChF,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,KAAK,aAAa;QAAE,OAAO,0BAA0B,CAAC;IAC1F,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,KAAK,aAAa;QAAE,OAAO,0BAA0B,CAAC;IAC1F,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,KAAK,YAAY;QAAE,OAAO,yBAAyB,CAAC;IACxF,OAAO,sBAAsB,CAAC;AAAA,CAC9B;AAED,SAAS,eAAe,CAAC,OAAe,EAAgB;IACvD,IAAI,CAAC;QACJ,iBAAiB,KAAK,qBAAqB,EAAE,CAAC;QAC9C,OAAO,IAAI,iBAAiB,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACd,6GAA6G,EAC7G,EAAE,KAAK,EAAE,KAAK,EAAE,CAChB,CAAC;IACH,CAAC;AAAA,CACD;AAED,SAAS,qBAAqB,CAC7B,cAAc,GAAmB,OAAO,EACxC,QAAQ,GAAoB,OAAO,CAAC,QAAQ,EAC5C,IAAI,GAAwB,OAAO,CAAC,IAAI,EACd;IAC1B,IAAI,CAAC;QACJ,OAAQ,cAAc,CAAC,kBAAkB,CAAmB,CAAC,KAAK,CAAC;IACpE,CAAC;IAAC,OAAO,WAAW,EAAE,CAAC;QACtB,IAAI,CAAC;YACJ,OAAO,gCAAgC,CAAC,cAAc,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC;QAC/E,CAAC;QAAC,OAAO,aAAa,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACd,uFAAuF,kBAAkB,CAAC,aAAa,CAAC,EAAE,EAC1H;gBACC,KAAK,EAAE,WAAW;aAClB,CACD,CAAC;QACH,CAAC;IACF,CAAC;AAAA,CACD;AAED,SAAS,gCAAgC,CACxC,cAA8B,EAC9B,QAAyB,EACzB,IAAyB,EACT;IAChB,MAAM,OAAO,GAAG,8BAA8B,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,uDAAuD,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAC;IAC5F,CAAC;IAED,IAAI,SAAkB,CAAC;IACvB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC;YACJ,MAAM,eAAe,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,WAAW,eAAe,CAAC,CAAC;YACrF,OAAO,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,CAAkB,CAAC;QAC5F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,SAAS,GAAG,KAAK,CAAC;QACnB,CAAC;IACF,CAAC;IAED,MAAM,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;AAAA,CAC5E;AAED,SAAS,8BAA8B,CACtC,QAAyB,EACzB,IAAyB,EACwB;IACjD,OAAO,+BAA+B,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACvE,WAAW,EAAE,oBAAoB,MAAM,EAAE;QACzC,WAAW,EAAE,WAAW,MAAM,OAAO;KACrC,CAAC,CAAC,CAAC;AAAA,CACJ;AAED,SAAS,+BAA+B,CAAC,QAAyB,EAAE,IAAyB,EAAY;IACxG,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC3B,IAAI,IAAI,KAAK,OAAO;YAAE,OAAO,CAAC,cAAc,CAAC,CAAC;QAC9C,IAAI,IAAI,KAAK,KAAK;YAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC1B,IAAI,IAAI,KAAK,OAAO;YAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAClD,IAAI,IAAI,KAAK,KAAK;YAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAC9C,IAAI,IAAI,KAAK,MAAM;YAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC1B,IAAI,IAAI,KAAK,OAAO;YAAE,OAAO,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,CAAC;QACrE,IAAI,IAAI,KAAK,KAAK;YAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC;QACnD,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;QACrD,IAAI,IAAI,KAAK,KAAK;YAAE,OAAO,CAAC,eAAe,EAAE,gBAAgB,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,QAAQ,KAAK,SAAS,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IACrE,OAAO,EAAE,CAAC;AAAA,CACV;AAED,SAAS,kBAAkB,CAAC,KAAc,EAAU;IACnD,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAAA,CAC9D;AAMD,SAAS,6BAA6B,GAAY;IACjD,IAAI,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACrE,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,KAAK,GAAG,CAAC;AAAA,CAC5F;AAED,SAAS,iCAAiC,CAAC,KAAc,EAAW;IACnE,OAAO,6BAA6B,EAAE,IAAI,kBAAkB,CAAC,KAAK,EAAE,2CAA2C,CAAC,CAAC;AAAA,CACjH;AAED,SAAS,gCAAgC,CACxC,SAAmC,EACnC,OAAe,EACf,OAAgB,EACU;IAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC;IAC5E,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC;IACtE,MAAM,MAAM,GACX,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,EAAE,IAAI,EAAE;QAChD,aAAa,CAAC,IAAI,GAAG,CAAC,0BAA0B,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9F,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE;QAChE,KAAK,EAAE,GAAG,OAAO,IAAI;QACrB,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,IAAI,GAAG,IAAI;QACtB,OAAO,EAAE,2BAA2B;QACpC,WAAW,EAAE,IAAI;KACjB,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,kDAAkD,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE;YACzF,KAAK,EAAE,MAAM,CAAC,KAAK;SACnB,CAAC,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,uDAAuD,MAAM,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;IACtG,CAAC;IAED,IAAI,QAAiB,CAAC;IACtB,IAAI,CAAC;QACJ,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAY,CAAC;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,qDAAqD,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAQ,QAA6B,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;QACjH,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,aAAa,GAAG,QAAmC,CAAC;IAC1D,IAAI,aAAa,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,KAAK,IAAI,sCAAsC,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,SAAS,KAAK,MAAM,IAAI,aAAa,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,aAAa,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACrG,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,aAAa,CAAC;AAAA,CACrB;AAED,MAAM,mCAAmC,GAAoB;IAC5D,IAAI,CAAC,OAAO,EAAE;QACb,MAAM,QAAQ,GAAG,gCAAgC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnE,OAAO,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAAA,CAC3E;IACD,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE;QACvB,gCAAgC,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAAA,CAC5D;IACD,MAAM,CAAC,OAAO,EAAE;QACf,gCAAgC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAAA,CACpD;CACD,CAAC;AAEF,MAAM,UAAU,yBAAyB,CACxC,cAA8B,EAC9B,QAAyB,EACzB,IAAyB,EACC;IAC1B,OAAO,qBAAqB,CAAC,cAAc,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;AAAA,CAC7D;AAED,MAAM,UAAU,qBAAqB,CAAC,QAAiB,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,EAAsB;IACjG,MAAM,OAAO,GAAG,yBAAyB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACzD,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAAA,CAClC;AAED,MAAM,UAAU,cAAc,CAAC,OAAO,GAAuB,EAAE,EAAU;IACxE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC;IACnD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,OAAO,OAAO,CAAC,OAAO,IAAI,YAAY,CAAC,WAAW,CAAC,CAAC;AAAA,CACpD;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,UAAkB,EAAE,OAA4B,EAAU;IAC/E,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,UAAU,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC,CAAC;AAAA,CACjD;AAED,SAAS,mBAAmB,CAAC,UAAkB,EAAU;IACxD,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAAA,CACjF;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAkB,EAAE,OAA4B,EAAU;IAC9F,OAAO,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,aAAa,CAAC,CAAC;AAAA,CAC9D;AAED,SAAS,gBAAgB,CAAC,UAAkB,EAAE,OAAe,EAAE,MAAc,EAAW;IACvF,IAAI,CAAC;QACJ,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAY,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,yCAAyC,UAAU,SAAS,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACzG,CAAC;AAAA,CACD;AAED,SAAS,qBAAqB,CAAC,UAAkB,EAAE,OAAe,EAAE,MAAc,EAAa;IAC9F,MAAM,MAAM,GAAG,gBAAgB,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,yCAAyC,UAAU,SAAS,MAAM,4BAA4B,CAAC,CAAC;IACjH,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,SAAS,WAAW,CAAC,KAAc,EAAyB;IAC3D,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAE7B,MAAM,YAAY,GAAG,cAAc,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAClD,IAAI,YAAY,KAAK,IAAI,IAAI,UAAU,KAAK,IAAI,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAEzF,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACrF,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACrG,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,SAAS,CAAC;IAEjH,MAAM,SAAS,GAAc,EAAE,CAAC;IAChC,IAAI,MAAM;QAAE,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC;IACtC,IAAI,UAAU;QAAE,SAAS,CAAC,UAAU,GAAG,UAAU,CAAC;IAClD,IAAI,YAAY,KAAK,SAAS;QAAE,SAAS,CAAC,YAAY,GAAG,YAAY,CAAC;IACtE,IAAI,UAAU,KAAK,SAAS;QAAE,SAAS,CAAC,UAAU,GAAG,UAAU,CAAC;IAChE,IAAI,SAAS,KAAK,SAAS;QAAE,SAAS,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7D,OAAO,SAAS,CAAC;AAAA,CACjB;AAED,SAAS,cAAc,CAAC,KAAc,EAA4B;IACjE,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAExE,MAAM,YAAY,GAAG,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACnD,IAAI,YAAY,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAEvG,MAAM,YAAY,GAAiB,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;IACvE,IAAI,YAAY,KAAK,SAAS;QAAE,YAAY,CAAC,YAAY,GAAG,YAAY,CAAC;IACzE,IAAI,SAAS,KAAK,SAAS;QAAE,YAAY,CAAC,SAAS,GAAG,SAAS,CAAC;IAChE,IAAI,KAAK,KAAK,SAAS;QAAE,YAAY,CAAC,KAAK,GAAG,KAAK,CAAC;IACpD,IAAI,MAAM,KAAK,SAAS;QAAE,YAAY,CAAC,MAAM,GAAG,MAAM,CAAC;IACvD,OAAO,YAAY,CAAC;AAAA,CACpB;AAED,SAAS,kBAAkB,CAAC,KAAc,EAAgC;IACzE,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAE7E,MAAM,YAAY,GAAG,cAAc,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,gBAAgB,GAAG,cAAc,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;IACrE,MAAM,qBAAqB,GAAG,cAAc,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAC/E,MAAM,mBAAmB,GAAG,eAAe,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;IAC5E,IACC,YAAY,KAAK,IAAI;QACrB,MAAM,KAAK,IAAI;QACf,gBAAgB,KAAK,IAAI;QACzB,qBAAqB,KAAK,IAAI;QAC9B,mBAAmB,KAAK,IAAI;QAE5B,OAAO,SAAS,CAAC;IAElB,MAAM,YAAY,GAAqB,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC;IACzE,MAAM,YAAY,GAAG,WAAW,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC1D,IAAI,YAAY,KAAK,SAAS;QAAE,YAAY,CAAC,YAAY,GAAG,YAAY,CAAC;IACzE,IAAI,gBAAgB,KAAK,SAAS;QAAE,YAAY,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;IACrF,IAAI,qBAAqB,KAAK,SAAS;QAAE,YAAY,CAAC,qBAAqB,GAAG,qBAAqB,CAAC;IACpG,IAAI,YAAY,KAAK,SAAS;QAAE,YAAY,CAAC,YAAY,GAAG,YAAY,CAAC;IACzE,IAAI,MAAM,KAAK,SAAS;QAAE,YAAY,CAAC,MAAM,GAAG,MAAM,CAAC;IACvD,IAAI,mBAAmB,KAAK,SAAS;QAAE,YAAY,CAAC,mBAAmB,GAAG,mBAAmB,CAAC;IAC9F,OAAO,YAAY,CAAC;AAAA,CACpB;AAED,SAAS,QAAQ,CAAC,KAAc,EAAuC;IACtE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAC1E,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,SAAS,CAAC;AAAA,CACb;AAED,SAAS,cAAc,CAAC,KAAc,EAA6B;IAClE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAAA,CAChD;AAED,SAAS,cAAc,CAAC,KAAc,EAA6B;IAClE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAAA,CAChD;AAED,SAAS,eAAe,CAAC,KAAc,EAA8B;IACpE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,OAAO,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAAA,CACjD;AAED,SAAS,WAAW,CAAC,KAAc,EAAwB;IAC1D,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAAA,CACjG;AAED,SAAS,wBAAwB,CAAC,KAAc,EAAmC;IAClF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,QAAQ,GAAG,KAAwC,CAAC;IAC1D,OAAO,CACN,QAAQ,CAAC,uBAAuB,CAAC,KAAK,CAAC;QACvC,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ;QACvC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC;QACrC,QAAQ,CAAC,UAAU,GAAG,CAAC;QACvB,QAAQ,CAAC,UAAU,IAAI,sBAAsB;QAC7C,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ;QACxC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAC3C,CAAC;AAAA,CACF;AAED,SAAS,wBAAwB,CAAC,OAAe,EAAE,QAAgC,EAAE,KAAa,EAAU;IAC3G,OAAO,GAAG,OAAO,UAAU,QAAQ,CAAC,WAAW,IAAI,KAAK,EAAE,CAAC;AAAA,CAC3D;AAED,SAAS,yBAAyB,CAAC,OAAe,EAAE,QAAgC,EAAY;IAC/F,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,wBAAwB,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;AAAA,CACrH;AAED,SAAS,4BAA4B,CACpC,UAAkB,EAClB,OAAe,EACf,MAAc,EACuB;IACrC,MAAM,MAAM,GAAG,gBAAgB,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7D,IAAI,wBAAwB,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IACpD,IAAI,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,yBAAyB,CAClC,wCAAwC,UAAU,aAAa,MAAM,EAAE,EACvE,MAAM,EACN,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAC9D,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AAAA,CACjB;AAED,SAAS,yBAAyB,CACjC,KAAsB,EACtB,UAAkB,EAClB,OAAe,EACsB;IACrC,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpC,OAAO,OAAO,KAAK,SAAS;YAC3B,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,4BAA4B,CAAC,UAAU,EAAE,OAAO,EAAE,4BAA4B,CAAC,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AAAA,CACD;AAED,SAAS,mBAAmB,CAAC,KAAsB,EAAE,OAAe,EAAE,QAAgC,EAAQ;IAC7G,KAAK,MAAM,YAAY,IAAI,yBAAyB,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;QACzE,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC5B,CAAC;AAAA,CACD;AAED,SAAS,sBAAsB,CAC9B,KAAsB,EACtB,OAAe,EACf,QAA4C,EACrC;IACP,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,IAAI,CAAC;QACJ,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACR,mEAAmE;IACpE,CAAC;AAAA,CACD;AAED,SAAS,mBAAmB,CAAC,OAAe,EAA0B;IACrE,OAAO;QACN,CAAC,uBAAuB,CAAC,EAAE,CAAC;QAC5B,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,sBAAsB,CAAC;QAC9D,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;KACpF,CAAC;AAAA,CACF;AAED,SAAS,oBAAoB,CAC5B,KAAsB,EACtB,UAAkB,EAClB,OAAe,EACf,QAAgC,EACpB;IACZ,MAAM,MAAM,GAAG,yBAAyB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC;QACjF,IAAI,CAAC;YACJ,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACvC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,kCAAkC,YAAY,QAAQ,UAAU,EAAE,CAAC,CAAC;YACrF,CAAC;YACD,OAAO,KAAK,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,yBAAyB,CAClC,wCAAwC,UAAU,sCAAsC,EACxF,MAAM,EACN,KAAK,CACL,CAAC;QACH,CAAC;IAAA,CACD,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACvF,IAAI,MAAM,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,IAAI,yBAAyB,CAClC,wCAAwC,UAAU,sCAAsC,EACxF,MAAM,EACN,IAAI,KAAK,CAAC,wCAAwC,CAAC,CACnD,CAAC;IACH,CAAC;IACD,OAAO,qBAAqB,CAAC,UAAU,EAAE,OAAO,EAAE,mCAAmC,CAAC,CAAC;AAAA,CACvF;AAED,SAAS,mBAAmB,CAAC,UAAkB,EAAE,OAA4B,EAAyB;IACrG,MAAM,QAAQ,GAAG,oBAAoB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC7C,OAAO,qBAAqB,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;AAAA,CACzD;AAED,SAAS,qBAAqB,CAAC,UAAkB,EAAE,OAA4B,EAAQ;IACtF,MAAM,QAAQ,GAAG,oBAAoB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO;IAClC,IAAI,CAAC;QACJ,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,2DAA2D,UAAU,OAAO,QAAQ,EAAE,EAAE;YACvG,KAAK,EAAE,KAAK;SACZ,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC9C,IAAI,CAAC;QACJ,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACR,4FAA4F;IAC7F,CAAC;AAAA,CACD;AAED,SAAS,2BAA2B,CACnC,KAAsB,EACtB,UAAkB,EAClB,KAAgB,EAChB,OAA4B,EACrB;IACP,MAAM,OAAO,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,gBAAgB,GAAG,yBAAyB,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IAC/E,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,sBAAsB,CAAC,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEpG,IAAI,CAAC;QACJ,IAAI,QAAQ,EAAE,CAAC;YACd,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC,UAAU,EAAE,KAAK,EAAE,EAAE,CAAC;gBAC1D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,sBAAsB,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,sBAAsB,CAAC,CAAC;gBAClG,KAAK,CAAC,KAAK,CAAC,wBAAwB,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;YACxE,CAAC;YACD,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;QAChD,CAAC;aAAM,CAAC;YACP,qFAAqF;YACrF,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC/B,CAAC;QACD,IAAI,gBAAgB,EAAE,WAAW,KAAK,QAAQ,EAAE,WAAW,EAAE,CAAC;YAC7D,sBAAsB,CAAC,KAAK,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC;QAC1D,CAAC;IACF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,sBAAsB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QACjD,MAAM,IAAI,yBAAyB,CAClC,yCAAyC,UAAU,oCAAoC,EACvF,OAAO,EACP,KAAK,CACL,CAAC;IACH,CAAC;IAED,uBAAuB,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAAA,CACtD;AAED,SAAS,uBAAuB,CAAC,UAAkB,EAAE,OAAe,EAAE,OAA4B,EAAQ;IACzG,IAAI,CAAC,uBAAuB,EAAE;QAAE,OAAO;IACvC,2BAA2B,CAAC,UAAU,CAAC,CAAC;IACxC,yEAAyE;IACzE,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAY,CAAC,CAAC;IAC/D,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,OAAO;IACR,CAAC;IACD,cAAc,CAAC,GAAG,CAAC,oBAAoB,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;AAAA,CAC1F;AAED,SAAS,oBAAoB,CAAC,UAAkB,EAAE,KAAgB,EAAE,OAA4B,EAAQ;IACvG,IAAI,CAAC;QACJ,2BAA2B,CAAC,kBAAkB,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAC/E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,CAAC,iCAAiC,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QAC3D,2BAA2B,CAAC,mCAAmC,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAC9F,CAAC;AAAA,CACD;AAED;;;GAGG;AACH,SAAS,sBAAsB,CAC9B,KAAsB,EACtB,UAAkB,EAClB,OAA4B,EAC5B,QAAQ,GAAgC,EAAE,EAClB;IACxB,MAAM,OAAO,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAChD,IAAI,OAA2B,CAAC;IAChC,IAAI,CAAC;QACJ,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,yBAAyB,CAClC,wCAAwC,UAAU,sCAAsC,EACxF,MAAM,EACN,KAAK,CACL,CAAC;IACH,CAAC;IAED,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,4BAA4B,CAAC,UAAU,EAAE,OAAO,EAAE,4BAA4B,CAAC,CAAC;QACjG,MAAM,KAAK,GAAG,QAAQ;YACrB,CAAC,CAAC,oBAAoB,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC;YAC5D,CAAC,CAAC,qBAAqB,CAAC,UAAU,EAAE,OAAO,EAAE,4BAA4B,CAAC,CAAC;QAC5E,qBAAqB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC3C,OAAO,KAAK,CAAC;IACd,CAAC;IAED,MAAM,WAAW,GAAG,mBAAmB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC7D,IAAI,CAAC,WAAW;QAAE,OAAO,SAAS,CAAC;IACnC,IAAI,QAAQ,CAAC,aAAa,KAAK,KAAK;QAAE,OAAO,WAAW,CAAC;IACzD,2BAA2B,CAAC,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IACrE,qBAAqB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC3C,OAAO,WAAW,CAAC;AAAA,CACnB;AAED,SAAS,aAAa,CACrB,UAAkB,EAClB,OAA4B,EAC5B,QAAQ,GAAgC,EAAE,EAClB;IACxB,sEAAsE;IACtE,0BAA0B;IAC1B,MAAM,SAAS,GAAG,QAAQ,CAAC,aAAa,KAAK,KAAK,IAAI,uBAAuB,EAAE,CAAC;IAChF,MAAM,QAAQ,GAAG,oBAAoB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC3D,IAAI,SAAS,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/C,OAAO,cAAc,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,IAAI,KAA4B,CAAC;IACjC,IAAI,CAAC;QACJ,KAAK,GAAG,sBAAsB,CAAC,kBAAkB,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACrF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,CAAC,iCAAiC,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QAC3D,KAAK,GAAG,sBAAsB,CAAC,mCAAmC,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACpG,CAAC;IAED,IAAI,SAAS;QAAE,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;IACnE,OAAO,KAAK,CAAC;AAAA,CACb;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,UAAkB,EAAE,OAA4B,EAAyB;IACrG,OAAO,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;AAAA,CAC1C;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC5B,UAAkB,EAClB,SAAiB,EACjB,OAA4B,EACJ;IACxB,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAE7B,+EAA+E;IAC/E,IAAI,CAAC,KAAK,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IAEvC,8CAA8C;IAC9C,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAEpD,OAAO,KAAK,CAAC;AAAA,CACb;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAChC,UAAkB,EAClB,SAAiB,EACjB,OAA4B,EACJ;IACxB,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,aAAa,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3E,IAAI,CAAC,KAAK,EAAE,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QACpF,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,CAAC,CAAC,KAAK,YAAY,yBAAyB,CAAC;YAAE,MAAM,KAAK,CAAC;QAC/D,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,qCAAqC,CAAC,KAAK,CAAC,EAAE,CAAC;IACzF,CAAC;AAAA,CACD;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAC5B,UAAkB,EAClB,KAAgB,EAChB,SAAkB,EAClB,OAA4B,EACrB;IACP,sCAAsC;IACtC,IAAI,SAAS,EAAE,CAAC;QACf,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IACD,oBAAoB,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACjD,qBAAqB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;AAAA,CAC3C;AAED;;GAEG;AACH,SAAS,wBAAwB,CAAC,KAAsB,EAAE,UAAkB,EAAQ;IACnF,MAAM,OAAO,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAChD,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,QAAQ,GACb,OAAO,KAAK,SAAS;YACpB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,4BAA4B,CAAC,UAAU,EAAE,OAAO,EAAE,4BAA4B,CAAC,CAAC;QACpF,IAAI,QAAQ;YAAE,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC5D,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,yBAAyB,CAClC,0CAA0C,UAAU,sCAAsC,EAC1F,QAAQ,EACR,KAAK,CACL,CAAC;IACH,CAAC;AAAA,CACD;AAED,MAAM,UAAU,eAAe,CAAC,UAAkB,EAAE,OAA4B,EAAQ;IACvF,IAAI,CAAC;QACJ,wBAAwB,CAAC,kBAAkB,EAAE,EAAE,UAAU,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,CAAC,iCAAiC,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QAC3D,wBAAwB,CAAC,mCAAmC,EAAE,UAAU,CAAC,CAAC;IAC3E,CAAC;IACD,2BAA2B,CAAC,UAAU,CAAC,CAAC;IACxC,qBAAqB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;AAAA,CAC3C;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CAAC,UAAkB,EAAQ;IAClE,2BAA2B,CAAC,UAAU,CAAC,CAAC;AAAA,CACxC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAC3B,UAAkB,EAClB,MAAoB,EACpB,SAAkB,EAClB,OAA4B,EACrB;IACP,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IACtD,IAAI,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC,UAAU,CAAC;QACxB,OAAO,KAAK,CAAC,YAAY,CAAC;QAC1B,OAAO,KAAK,CAAC,UAAU,CAAC;IACzB,CAAC;IACD,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;IACtB,aAAa,CAAC,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AAAA,CACrD;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAC/B,UAAkB,EAClB,UAA4B,EAC5B,SAAkB,EAClB,OAA4B,EACrB;IACP,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IACtD,IAAI,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC,MAAM,CAAC;QACpB,OAAO,KAAK,CAAC,YAAY,CAAC;QAC1B,OAAO,KAAK,CAAC,UAAU,CAAC;IACzB,CAAC;IACD,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;IAC9B,aAAa,CAAC,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AAAA,CACrD;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CACjC,UAAkB,EAClB,YAAoB,EACpB,SAAkB,EAClB,OAA4B,EACrB;IACP,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IACtD,IAAI,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC,MAAM,CAAC;QACpB,OAAO,KAAK,CAAC,UAAU,CAAC;QACxB,OAAO,KAAK,CAAC,UAAU,CAAC;IACzB,CAAC;IACD,KAAK,CAAC,YAAY,GAAG,YAAY,CAAC;IAClC,aAAa,CAAC,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AAAA,CACrD;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAkB,EAAE,OAA4B,EAAQ;IACzF,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAChD,IAAI,KAAK,EAAE,CAAC;QACX,OAAO,KAAK,CAAC,YAAY,CAAC;QAC1B,aAAa,CAAC,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACtD,CAAC;AAAA,CACD;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAC/B,UAAkB,EAClB,KAAa,EACb,SAAkB,EAClB,OAA4B,EACrB;IACP,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IACtD,IAAI,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC,MAAM,CAAC;QACpB,OAAO,KAAK,CAAC,UAAU,CAAC;QACxB,OAAO,KAAK,CAAC,YAAY,CAAC;IAC3B,CAAC;IACD,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC;IACzB,aAAa,CAAC,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AAAA,CACrD;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,UAAkB,EAAE,OAA4B,EAAsB;IACnG,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAChD,OAAO,KAAK,EAAE,UAAU,CAAC;AAAA,CACzB;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,UAAkB,EAAE,OAA4B,EAAQ;IACvF,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAChD,IAAI,KAAK,EAAE,CAAC;QACX,OAAO,KAAK,CAAC,UAAU,CAAC;QACxB,aAAa,CAAC,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACtD,CAAC;AAAA,CACD;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,UAAkB,EAAE,OAA4B,EAAkB;IAChG,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,EAAE,MAAM;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,KAAK,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACvD,OAAO,KAAK,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAAA,CAClD;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,UAAkB,EAAE,OAA4B,EAAW;IAC1F,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAChD,OAAO,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC;AAAA,CACvB;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAAkB,EAAE,OAA4B,EAAQ;IAC3F,eAAe,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;AAAA,CACrC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,UAAkB,EAAE,OAA4B,EAAQ;IACvF,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAChD,IAAI,KAAK,EAAE,CAAC;QACX,OAAO,KAAK,CAAC,UAAU,CAAC;QACxB,aAAa,CAAC,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACtD,CAAC;AAAA,CACD;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,UAAkB,EAAE,OAA4B,EAAQ;IACnF,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAChD,IAAI,KAAK,EAAE,CAAC;QACX,OAAO,KAAK,CAAC,MAAM,CAAC;QACpB,aAAa,CAAC,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACtD,CAAC;AAAA,CACD","sourcesContent":["/**\n * MCP Auth Storage Module\n *\n * Handles secure storage of OAuth credentials, tokens, client information,\n * and legacy PKCE state for MCP servers.\n *\n * Persistent OAuth entries are stored in the operating system credential store.\n * Legacy plaintext entries are imported from $MCP_OAUTH_DIR/sha256-<server-hash>/tokens.json\n * when set, otherwise <Nexus agent dir>/mcp-oauth/sha256-<server-hash>/tokens.json,\n * then the plaintext file is removed.\n */\n\nimport { spawnSync } from \"child_process\";\nimport { createHash } from \"crypto\";\nimport { existsSync, readFileSync, rmSync } from \"fs\";\nimport { createRequire } from \"module\";\nimport { dirname, join } from \"path\";\nimport { fileURLToPath } from \"url\";\nimport { getAgentPath } from \"./agent-dir.ts\";\nimport { resolveConfiguredOAuthDir } from \"./config.ts\";\n\nconst require = createRequire(import.meta.url);\nconst AUTH_SECRET_SERVICE = \"nexus-mcp.oauth\";\nconst TEST_AUTH_STORE_ENV = \"NEXUS_MCP_TEST_AUTH_STORE\";\n/**\n * Windows Credential Manager caps one value at CRED_MAX_CREDENTIAL_BLOB_SIZE\n * (2560 bytes) and stores it as UTF-16, so the real ceiling is\n * AUTH_SECRET_VALUE_LIMIT characters. Chunks must stay below that, and so must\n * the threshold that decides whether to chunk at all, or oversized records still\n * fail to persist on Windows.\n */\nconst AUTH_SECRET_CHUNK_SIZE = 1000;\n/** Largest single value the strictest supported credential store accepts. */\nconst AUTH_SECRET_VALUE_LIMIT = 1280;\nconst KEYRING_RECOVERY_DISABLED_ENV = \"NEXUS_MCP_DISABLE_KEYRING_RECOVERY\";\nconst KEYRING_RECOVERY_KEYCTL_ENV = \"NEXUS_MCP_KEYRING_RECOVERY_KEYCTL\";\nconst KEYRING_RECOVERY_NODE_ENV = \"NEXUS_MCP_KEYRING_RECOVERY_NODE\";\nconst KEYRING_RECOVERY_HELPER_ENV = \"NEXUS_MCP_KEYRING_RECOVERY_HELPER\";\nconst TEST_LINUX_KEYRING_RECOVERY_ENV = \"NEXUS_MCP_TEST_LINUX_KEYRING_RECOVERY\";\nconst AUTH_CACHE_DISABLED_ENV = \"NEXUS_MCP_DISABLE_AUTH_CACHE\";\nconst KEYRING_RECOVERY_TIMEOUT_MS = 10_000;\nconst AUTH_CHUNK_MANIFEST_KEY = \"__nexusMcpOAuthChunked\";\n\n/** OAuth token storage format */\nexport interface StoredTokens {\n\taccessToken: string;\n\trefreshToken?: string;\n\texpiresAt?: number; // Unix timestamp in seconds\n\tscope?: string;\n\t/** SEP-2352 authorization-server issuer binding */\n\tissuer?: string;\n}\n\n/** OAuth client information from dynamic or static registration */\nexport interface StoredClientInfo {\n\tclientId: string;\n\tclientSecret?: string;\n\tclientIdIssuedAt?: number;\n\tclientSecretExpiresAt?: number;\n\tredirectUris?: string[];\n\t/** SEP-2352 authorization-server issuer binding */\n\tissuer?: string;\n\t/**\n\t * True when this entry is a secretless SEP-2352 issuer stub persisted for a\n\t * config-pre-registered client (written by the config-clientId path of\n\t * saveClientInformation). Such a stub is only usable when paired with the\n\t * config that supplies the client secret; it must never be served as\n\t * standalone client information.\n\t */\n\tconfigPreRegistered?: boolean;\n}\n\n/** Complete auth entry for a server */\nexport interface AuthEntry {\n\ttokens?: StoredTokens;\n\tclientInfo?: StoredClientInfo;\n\tcodeVerifier?: string;\n\toauthState?: string;\n\tserverUrl?: string; // Track the URL these credentials are for\n}\n\nexport interface AuthStorageOptions {\n\t/** Legacy plaintext import directory. Persistent secrets no longer use this as their store. */\n\tbaseDir?: string;\n}\n\nexport class OAuthCredentialStoreError extends Error {\n\treadonly code = \"OAUTH_CREDENTIAL_STORE_UNAVAILABLE\";\n\treadonly operation: \"read\" | \"write\" | \"remove\";\n\n\tconstructor(message: string, operation: \"read\" | \"write\" | \"remove\", cause: unknown) {\n\t\tsuper(message, { cause });\n\t\tthis.name = \"OAuthCredentialStoreError\";\n\t\tthis.operation = operation;\n\t}\n}\n\nexport type OAuthCredentialStatus =\n\t| { status: \"present\"; entry: AuthEntry }\n\t| { status: \"absent\" }\n\t| { status: \"unavailable\"; message: string };\n\nfunction causeChainContains(error: unknown, pattern: RegExp): boolean {\n\tconst seen = new Set<unknown>();\n\tlet current = error;\n\twhile ((typeof current === \"object\" && current !== null) || typeof current === \"function\") {\n\t\tif (seen.has(current)) break;\n\t\tseen.add(current);\n\t\tconst candidate = current as { name?: unknown; message?: unknown; code?: unknown; cause?: unknown };\n\t\tif (\n\t\t\t[candidate.name, candidate.message, candidate.code].some(\n\t\t\t\t(value) => typeof value === \"string\" && pattern.test(value),\n\t\t\t)\n\t\t) {\n\t\t\treturn true;\n\t\t}\n\t\tcurrent = candidate.cause;\n\t}\n\treturn false;\n}\n\nexport function formatOAuthCredentialStoreUnavailable(error: OAuthCredentialStoreError): string {\n\tif (process.platform === \"linux\" && causeChainContains(error, /key\\s*(?:has been\\s*)?revoked|keyrevoked/i)) {\n\t\treturn \"OAuth credential store unavailable: the Linux session keyring may be revoked. Start Nexus from a fresh login/keyring session and retry.\";\n\t}\n\treturn \"OAuth credential store unavailable. Configure or unlock the OS credential store and retry.\";\n}\n\ninterface KeyringEntry {\n\tgetPassword(): string | null;\n\tsetPassword(password: string): void;\n\tdeleteCredential(): boolean;\n}\n\ntype KeyringEntryConstructor = new (service: string, account: string) => KeyringEntry;\ntype KeyringModule = { Entry: KeyringEntryConstructor };\ntype KeyringRequire = ((id: string) => unknown) & { resolve(id: string): string };\n\ninterface AuthSecretStore {\n\tread(account: string): string | undefined;\n\twrite(account: string, payload: string): void;\n\tremove(account: string): void;\n}\n\ninterface AuthEntryChunkManifest {\n\t[AUTH_CHUNK_MANIFEST_KEY]: 1;\n\tchunkCount: number;\n\tchunkDigest: string;\n}\n\nconst MAX_AUTH_SECRET_CHUNKS = 128;\n\nlet KeyringEntryClass: KeyringEntryConstructor | undefined;\nconst memoryAuthEntries = new Map<string, string>();\n\nlet testAuthSecretStoreReadCount = 0;\nconst authEntryCache = new Map<string, AuthEntry | undefined>();\n\nfunction getAuthEntryCacheKey(serverName: string, options?: AuthStorageOptions): string {\n\treturn `${serverName}\\0${getAuthBaseDir(options)}`;\n}\n\nfunction deleteAuthEntryCacheEntries(serverName: string): void {\n\tconst prefix = `${serverName}\\0`;\n\tfor (const key of authEntryCache.keys()) {\n\t\tif (key.startsWith(prefix)) authEntryCache.delete(key);\n\t}\n}\n\nfunction isAuthEntryCacheEnabled(): boolean {\n\treturn process.env[AUTH_CACHE_DISABLED_ENV] !== \"1\";\n}\n\nfunction cloneAuthEntry(entry: AuthEntry | undefined): AuthEntry | undefined {\n\treturn entry === undefined ? undefined : structuredClone(entry);\n}\n\nconst memoryAuthSecretStore: AuthSecretStore = {\n\tread(account) {\n\t\ttestAuthSecretStoreReadCount++;\n\t\treturn memoryAuthEntries.get(account);\n\t},\n\twrite(account, payload) {\n\t\tmemoryAuthEntries.set(account, payload);\n\t},\n\tremove(account) {\n\t\tmemoryAuthEntries.delete(account);\n\t},\n};\n\nconst keyringAuthSecretStore: AuthSecretStore = {\n\tread(account) {\n\t\treturn getKeyringEntry(account).getPassword() ?? undefined;\n\t},\n\twrite(account, payload) {\n\t\tgetKeyringEntry(account).setPassword(payload);\n\t},\n\tremove(account) {\n\t\tgetKeyringEntry(account).deleteCredential();\n\t},\n};\n\n/** Mimics the Windows Credential Manager per-value ceiling for tests. */\nconst sizeLimitedAuthSecretStore: AuthSecretStore = {\n\tread(account) {\n\t\ttestAuthSecretStoreReadCount++;\n\t\treturn memoryAuthEntries.get(account);\n\t},\n\twrite(account, payload) {\n\t\tif (payload.length > AUTH_SECRET_VALUE_LIMIT) {\n\t\t\tthrow new Error(\n\t\t\t\t`Value of 'password encoded as UTF-16' is longer than the platform limit of ${AUTH_SECRET_VALUE_LIMIT * 2} chars`,\n\t\t\t);\n\t\t}\n\t\tmemoryAuthEntries.set(account, payload);\n\t},\n\tremove(account) {\n\t\tmemoryAuthEntries.delete(account);\n\t},\n};\n\nconst unavailableAuthSecretStore: AuthSecretStore = {\n\tread() {\n\t\ttestAuthSecretStoreReadCount++;\n\t\tthrow new Error(\"simulated secure credential store unavailable\");\n\t},\n\twrite() {\n\t\tthrow new Error(\"simulated secure credential store unavailable\");\n\t},\n\tremove() {\n\t\tthrow new Error(\"simulated secure credential store unavailable\");\n\t},\n};\n\nfunction createKeyRevokedTestError(): Error {\n\treturn new Error(\"Couldn't access platform storage: KeyRevoked\", { cause: new Error(\"KeyRevoked\") });\n}\n\nconst keyRevokedAuthSecretStore: AuthSecretStore = {\n\tread() {\n\t\ttestAuthSecretStoreReadCount++;\n\t\tthrow createKeyRevokedTestError();\n\t},\n\twrite() {\n\t\tthrow createKeyRevokedTestError();\n\t},\n\tremove() {\n\t\tthrow createKeyRevokedTestError();\n\t},\n};\n\nexport function resetTestAuthSecretStore(): void {\n\tmemoryAuthEntries.clear();\n\tauthEntryCache.clear();\n\ttestAuthSecretStoreReadCount = 0;\n}\n\nexport function resetAuthEntryCache(): void {\n\tauthEntryCache.clear();\n}\n\nexport function getTestAuthSecretStoreReadCount(): number {\n\treturn testAuthSecretStoreReadCount;\n}\n\nexport function getTestAuthSecretStoreEntries(): [string, string][] {\n\treturn [...memoryAuthEntries.entries()];\n}\n\nexport function setTestAuthSecretStoreEntry(account: string, payload: string): void {\n\tmemoryAuthEntries.set(account, payload);\n}\n\nexport function removeTestAuthSecretStoreEntry(account: string): void {\n\tmemoryAuthEntries.delete(account);\n}\n\nfunction getAuthSecretStore(): AuthSecretStore {\n\tif (process.env[TEST_AUTH_STORE_ENV] === \"memory\") return memoryAuthSecretStore;\n\tif (process.env[TEST_AUTH_STORE_ENV] === \"sizelimited\") return sizeLimitedAuthSecretStore;\n\tif (process.env[TEST_AUTH_STORE_ENV] === \"unavailable\") return unavailableAuthSecretStore;\n\tif (process.env[TEST_AUTH_STORE_ENV] === \"keyrevoked\") return keyRevokedAuthSecretStore;\n\treturn keyringAuthSecretStore;\n}\n\nfunction getKeyringEntry(account: string): KeyringEntry {\n\ttry {\n\t\tKeyringEntryClass ??= loadKeyringEntryClass();\n\t\treturn new KeyringEntryClass(AUTH_SECRET_SERVICE, account);\n\t} catch (error) {\n\t\tthrow new Error(\n\t\t\t\"OAuth secure credential storage is unavailable. Configure the OS credential store and retry authentication.\",\n\t\t\t{ cause: error },\n\t\t);\n\t}\n}\n\nfunction loadKeyringEntryClass(\n\tkeyringRequire: KeyringRequire = require,\n\tplatform: NodeJS.Platform = process.platform,\n\tarch: NodeJS.Architecture = process.arch,\n): KeyringEntryConstructor {\n\ttry {\n\t\treturn (keyringRequire(\"@napi-rs/keyring\") as KeyringModule).Entry;\n\t} catch (loaderError) {\n\t\ttry {\n\t\t\treturn loadKeyringNativeBindingFallback(keyringRequire, platform, arch).Entry;\n\t\t} catch (fallbackError) {\n\t\t\tthrow new Error(\n\t\t\t\t`Failed to load @napi-rs/keyring; absolute-path native binding fallback also failed: ${formatErrorMessage(fallbackError)}`,\n\t\t\t\t{\n\t\t\t\t\tcause: loaderError,\n\t\t\t\t},\n\t\t\t);\n\t\t}\n\t}\n}\n\nfunction loadKeyringNativeBindingFallback(\n\tkeyringRequire: KeyringRequire,\n\tplatform: NodeJS.Platform,\n\tarch: NodeJS.Architecture,\n): KeyringModule {\n\tconst targets = getKeyringNativeBindingTargets(platform, arch);\n\tif (targets.length === 0) {\n\t\tthrow new Error(`Unsupported @napi-rs/keyring native binding target: ${platform}-${arch}`);\n\t}\n\n\tlet lastError: unknown;\n\tfor (const target of targets) {\n\t\ttry {\n\t\t\tconst packageJsonPath = keyringRequire.resolve(`${target.packageName}/package.json`);\n\t\t\treturn keyringRequire(join(dirname(packageJsonPath), target.bindingFile)) as KeyringModule;\n\t\t} catch (error) {\n\t\t\tlastError = error;\n\t\t}\n\t}\n\n\tthrow lastError instanceof Error ? lastError : new Error(String(lastError));\n}\n\nfunction getKeyringNativeBindingTargets(\n\tplatform: NodeJS.Platform,\n\tarch: NodeJS.Architecture,\n): { packageName: string; bindingFile: string }[] {\n\treturn getKeyringNativeBindingSuffixes(platform, arch).map((suffix) => ({\n\t\tpackageName: `@napi-rs/keyring-${suffix}`,\n\t\tbindingFile: `keyring.${suffix}.node`,\n\t}));\n}\n\nfunction getKeyringNativeBindingSuffixes(platform: NodeJS.Platform, arch: NodeJS.Architecture): string[] {\n\tif (platform === \"darwin\") {\n\t\tif (arch === \"arm64\") return [\"darwin-arm64\"];\n\t\tif (arch === \"x64\") return [\"darwin-x64\"];\n\t}\n\tif (platform === \"win32\") {\n\t\tif (arch === \"arm64\") return [\"win32-arm64-msvc\"];\n\t\tif (arch === \"x64\") return [\"win32-x64-msvc\"];\n\t\tif (arch === \"ia32\") return [\"win32-ia32-msvc\"];\n\t}\n\tif (platform === \"linux\") {\n\t\tif (arch === \"arm64\") return [\"linux-arm64-gnu\", \"linux-arm64-musl\"];\n\t\tif (arch === \"arm\") return [\"linux-arm-gnueabihf\"];\n\t\tif (arch === \"riscv64\") return [\"linux-riscv64-gnu\"];\n\t\tif (arch === \"x64\") return [\"linux-x64-gnu\", \"linux-x64-musl\"];\n\t}\n\tif (platform === \"freebsd\" && arch === \"x64\") return [\"freebsd-x64\"];\n\treturn [];\n}\n\nfunction formatErrorMessage(error: unknown): string {\n\treturn error instanceof Error ? error.message : String(error);\n}\n\ntype KeyringRecoveryOperation = \"read\" | \"write\" | \"remove\";\n\ntype KeyringRecoveryResponse = { ok: true; found?: boolean; value?: string } | { ok: false; error?: string };\n\nfunction isLinuxKeyringRecoveryEnabled(): boolean {\n\tif (process.env[KEYRING_RECOVERY_DISABLED_ENV] === \"1\") return false;\n\treturn process.platform === \"linux\" || process.env[TEST_LINUX_KEYRING_RECOVERY_ENV] === \"1\";\n}\n\nfunction shouldAttemptLinuxKeyringRecovery(error: unknown): boolean {\n\treturn isLinuxKeyringRecoveryEnabled() && causeChainContains(error, /key\\s*(?:has been\\s*)?revoked|keyrevoked/i);\n}\n\nfunction runLinuxKeyringRecoveryOperation(\n\toperation: KeyringRecoveryOperation,\n\taccount: string,\n\tpayload?: string,\n): KeyringRecoveryResponse {\n\tconst keyctl = process.env[KEYRING_RECOVERY_KEYCTL_ENV]?.trim() || \"keyctl\";\n\tconst node = process.env[KEYRING_RECOVERY_NODE_ENV]?.trim() || \"node\";\n\tconst helper =\n\t\tprocess.env[KEYRING_RECOVERY_HELPER_ENV]?.trim() ||\n\t\tfileURLToPath(new URL(\"./mcp-keyring-helper.cjs\", import.meta.url));\n\tconst request = JSON.stringify({ operation, service: AUTH_SECRET_SERVICE, account, payload });\n\tconst result = spawnSync(keyctl, [\"session\", \"-\", node, helper], {\n\t\tinput: `${request}\\n`,\n\t\tencoding: \"utf8\",\n\t\tmaxBuffer: 1024 * 1024,\n\t\ttimeout: KEYRING_RECOVERY_TIMEOUT_MS,\n\t\twindowsHide: true,\n\t});\n\n\tif (result.error) {\n\t\tthrow new Error(`Linux keyring recovery helper could not start: ${result.error.message}`, {\n\t\t\tcause: result.error,\n\t\t});\n\t}\n\tif (result.status !== 0) {\n\t\tthrow new Error(`Linux keyring recovery helper failed with exit code ${result.status ?? \"unknown\"}`);\n\t}\n\n\tlet response: unknown;\n\ttry {\n\t\tresponse = JSON.parse(result.stdout.trim()) as unknown;\n\t} catch (error) {\n\t\tthrow new Error(\"Linux keyring recovery helper returned invalid JSON\", { cause: error });\n\t}\n\tif (typeof response !== \"object\" || response === null || typeof (response as { ok?: unknown }).ok !== \"boolean\") {\n\t\tthrow new Error(\"Linux keyring recovery helper returned an invalid response\");\n\t}\n\tconst typedResponse = response as KeyringRecoveryResponse;\n\tif (typedResponse.ok === false) {\n\t\tthrow new Error(typedResponse.error || \"Linux keyring recovery helper failed\");\n\t}\n\tif (operation === \"read\" && typedResponse.found === true && typeof typedResponse.value !== \"string\") {\n\t\tthrow new Error(\"Linux keyring recovery helper returned an invalid read response\");\n\t}\n\treturn typedResponse;\n}\n\nconst linuxKeyringRecoveryAuthSecretStore: AuthSecretStore = {\n\tread(account) {\n\t\tconst response = runLinuxKeyringRecoveryOperation(\"read\", account);\n\t\treturn response.ok && response.found === true ? response.value : undefined;\n\t},\n\twrite(account, payload) {\n\t\trunLinuxKeyringRecoveryOperation(\"write\", account, payload);\n\t},\n\tremove(account) {\n\t\trunLinuxKeyringRecoveryOperation(\"remove\", account);\n\t},\n};\n\nexport function loadTestKeyringEntryClass(\n\tkeyringRequire: KeyringRequire,\n\tplatform: NodeJS.Platform,\n\tarch: NodeJS.Architecture,\n): KeyringEntryConstructor {\n\treturn loadKeyringEntryClass(keyringRequire, platform, arch);\n}\n\nexport function getAuthStorageOptions(oauthDir: unknown, cwd = process.cwd()): AuthStorageOptions {\n\tconst baseDir = resolveConfiguredOAuthDir(oauthDir, cwd);\n\treturn baseDir ? { baseDir } : {};\n}\n\nexport function getAuthBaseDir(options: AuthStorageOptions = {}): string {\n\tconst override = process.env.MCP_OAUTH_DIR?.trim();\n\tif (override) return override;\n\treturn options.baseDir ?? getAgentPath(\"mcp-oauth\");\n}\n\n/**\n * Get the legacy server-specific directory path.\n */\nfunction getServerDir(serverName: string, options?: AuthStorageOptions): string {\n\tif (typeof serverName !== \"string\") {\n\t\tthrow new Error(`Invalid MCP server name: ${JSON.stringify(serverName)}`);\n\t}\n\tconst storageKey = getAuthEntryAccount(serverName);\n\treturn join(getAuthBaseDir(options), storageKey);\n}\n\nfunction getAuthEntryAccount(serverName: string): string {\n\tif (typeof serverName !== \"string\") {\n\t\tthrow new Error(`Invalid MCP server name: ${JSON.stringify(serverName)}`);\n\t}\n\treturn `sha256-${createHash(\"sha256\").update(serverName, \"utf8\").digest(\"hex\")}`;\n}\n\n/**\n * Get the legacy plaintext tokens file path for a server.\n */\nexport function getAuthEntryFilePath(serverName: string, options?: AuthStorageOptions): string {\n\treturn join(getServerDir(serverName, options), \"tokens.json\");\n}\n\nfunction parseJsonPayload(serverName: string, payload: string, source: string): unknown {\n\ttry {\n\t\treturn JSON.parse(payload) as unknown;\n\t} catch (error) {\n\t\tthrow new Error(`Failed to parse OAuth credentials for ${serverName} from ${source}`, { cause: error });\n\t}\n}\n\nfunction parseAuthEntryPayload(serverName: string, payload: string, source: string): AuthEntry {\n\tconst parsed = parseJsonPayload(serverName, payload, source);\n\tconst entry = toAuthEntry(parsed);\n\tif (!entry) {\n\t\tthrow new Error(`Failed to parse OAuth credentials for ${serverName} from ${source}: invalid credential shape`);\n\t}\n\treturn entry;\n}\n\nfunction toAuthEntry(value: unknown): AuthEntry | undefined {\n\tconst entry = toRecord(value);\n\tif (!entry) return undefined;\n\n\tconst codeVerifier = optionalString(entry.codeVerifier);\n\tconst oauthState = optionalString(entry.oauthState);\n\tconst serverUrl = optionalString(entry.serverUrl);\n\tif (codeVerifier === null || oauthState === null || serverUrl === null) return undefined;\n\n\tconst tokens = entry.tokens === undefined ? undefined : toStoredTokens(entry.tokens);\n\tconst clientInfo = entry.clientInfo === undefined ? undefined : toStoredClientInfo(entry.clientInfo);\n\tif ((entry.tokens !== undefined && !tokens) || (entry.clientInfo !== undefined && !clientInfo)) return undefined;\n\n\tconst authEntry: AuthEntry = {};\n\tif (tokens) authEntry.tokens = tokens;\n\tif (clientInfo) authEntry.clientInfo = clientInfo;\n\tif (codeVerifier !== undefined) authEntry.codeVerifier = codeVerifier;\n\tif (oauthState !== undefined) authEntry.oauthState = oauthState;\n\tif (serverUrl !== undefined) authEntry.serverUrl = serverUrl;\n\treturn authEntry;\n}\n\nfunction toStoredTokens(value: unknown): StoredTokens | undefined {\n\tconst tokens = toRecord(value);\n\tif (!tokens || typeof tokens.accessToken !== \"string\") return undefined;\n\n\tconst refreshToken = optionalString(tokens.refreshToken);\n\tconst scope = optionalString(tokens.scope);\n\tconst issuer = optionalString(tokens.issuer);\n\tconst expiresAt = optionalNumber(tokens.expiresAt);\n\tif (refreshToken === null || scope === null || issuer === null || expiresAt === null) return undefined;\n\n\tconst storedTokens: StoredTokens = { accessToken: tokens.accessToken };\n\tif (refreshToken !== undefined) storedTokens.refreshToken = refreshToken;\n\tif (expiresAt !== undefined) storedTokens.expiresAt = expiresAt;\n\tif (scope !== undefined) storedTokens.scope = scope;\n\tif (issuer !== undefined) storedTokens.issuer = issuer;\n\treturn storedTokens;\n}\n\nfunction toStoredClientInfo(value: unknown): StoredClientInfo | undefined {\n\tconst clientInfo = toRecord(value);\n\tif (!clientInfo || typeof clientInfo.clientId !== \"string\") return undefined;\n\n\tconst clientSecret = optionalString(clientInfo.clientSecret);\n\tconst issuer = optionalString(clientInfo.issuer);\n\tconst clientIdIssuedAt = optionalNumber(clientInfo.clientIdIssuedAt);\n\tconst clientSecretExpiresAt = optionalNumber(clientInfo.clientSecretExpiresAt);\n\tconst configPreRegistered = optionalBoolean(clientInfo.configPreRegistered);\n\tif (\n\t\tclientSecret === null ||\n\t\tissuer === null ||\n\t\tclientIdIssuedAt === null ||\n\t\tclientSecretExpiresAt === null ||\n\t\tconfigPreRegistered === null\n\t)\n\t\treturn undefined;\n\n\tconst storedClient: StoredClientInfo = { clientId: clientInfo.clientId };\n\tconst redirectUris = stringArray(clientInfo.redirectUris);\n\tif (clientSecret !== undefined) storedClient.clientSecret = clientSecret;\n\tif (clientIdIssuedAt !== undefined) storedClient.clientIdIssuedAt = clientIdIssuedAt;\n\tif (clientSecretExpiresAt !== undefined) storedClient.clientSecretExpiresAt = clientSecretExpiresAt;\n\tif (redirectUris !== undefined) storedClient.redirectUris = redirectUris;\n\tif (issuer !== undefined) storedClient.issuer = issuer;\n\tif (configPreRegistered !== undefined) storedClient.configPreRegistered = configPreRegistered;\n\treturn storedClient;\n}\n\nfunction toRecord(value: unknown): Record<string, unknown> | undefined {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value)\n\t\t? (value as Record<string, unknown>)\n\t\t: undefined;\n}\n\nfunction optionalString(value: unknown): string | null | undefined {\n\tif (value === undefined) return undefined;\n\treturn typeof value === \"string\" ? value : null;\n}\n\nfunction optionalNumber(value: unknown): number | null | undefined {\n\tif (value === undefined) return undefined;\n\treturn typeof value === \"number\" ? value : null;\n}\n\nfunction optionalBoolean(value: unknown): boolean | null | undefined {\n\tif (value === undefined) return undefined;\n\treturn typeof value === \"boolean\" ? value : null;\n}\n\nfunction stringArray(value: unknown): string[] | undefined {\n\treturn Array.isArray(value) && value.every((uri) => typeof uri === \"string\") ? value : undefined;\n}\n\nfunction isAuthEntryChunkManifest(value: unknown): value is AuthEntryChunkManifest {\n\tif (typeof value !== \"object\" || value === null) return false;\n\tconst manifest = value as Partial<AuthEntryChunkManifest>;\n\treturn (\n\t\tmanifest[AUTH_CHUNK_MANIFEST_KEY] === 1 &&\n\t\ttypeof manifest.chunkCount === \"number\" &&\n\t\tNumber.isInteger(manifest.chunkCount) &&\n\t\tmanifest.chunkCount > 0 &&\n\t\tmanifest.chunkCount <= MAX_AUTH_SECRET_CHUNKS &&\n\t\ttypeof manifest.chunkDigest === \"string\" &&\n\t\t/^[a-f0-9]{16}$/.test(manifest.chunkDigest)\n\t);\n}\n\nfunction getAuthEntryChunkAccount(account: string, manifest: AuthEntryChunkManifest, index: number): string {\n\treturn `${account}.chunk.${manifest.chunkDigest}.${index}`;\n}\n\nfunction getAuthEntryChunkAccounts(account: string, manifest: AuthEntryChunkManifest): string[] {\n\treturn Array.from({ length: manifest.chunkCount }, (_, index) => getAuthEntryChunkAccount(account, manifest, index));\n}\n\nfunction readChunkManifestFromPayload(\n\tserverName: string,\n\tpayload: string,\n\tsource: string,\n): AuthEntryChunkManifest | undefined {\n\tconst parsed = parseJsonPayload(serverName, payload, source);\n\tif (isAuthEntryChunkManifest(parsed)) return parsed;\n\tif (toRecord(parsed)?.[AUTH_CHUNK_MANIFEST_KEY] === 1) {\n\t\tthrow new OAuthCredentialStoreError(\n\t\t\t`Failed to read OAuth credentials for ${serverName} from the ${source}`,\n\t\t\t\"read\",\n\t\t\tnew Error(\"OAuth credential chunk manifest has invalid shape\"),\n\t\t);\n\t}\n\treturn undefined;\n}\n\nfunction readExistingChunkManifest(\n\tstore: AuthSecretStore,\n\tserverName: string,\n\taccount: string,\n): AuthEntryChunkManifest | undefined {\n\ttry {\n\t\tconst payload = store.read(account);\n\t\treturn payload === undefined\n\t\t\t? undefined\n\t\t\t: readChunkManifestFromPayload(serverName, payload, \"OS secure credential store\");\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\nfunction removeChunkPayloads(store: AuthSecretStore, account: string, manifest: AuthEntryChunkManifest): void {\n\tfor (const chunkAccount of getAuthEntryChunkAccounts(account, manifest)) {\n\t\tstore.remove(chunkAccount);\n\t}\n}\n\nfunction tryRemoveChunkPayloads(\n\tstore: AuthSecretStore,\n\taccount: string,\n\tmanifest: AuthEntryChunkManifest | undefined,\n): void {\n\tif (!manifest) return;\n\ttry {\n\t\tremoveChunkPayloads(store, account, manifest);\n\t} catch {\n\t\t// Stale chunk cleanup must not hide a successful credential write.\n\t}\n}\n\nfunction createChunkManifest(payload: string): AuthEntryChunkManifest {\n\treturn {\n\t\t[AUTH_CHUNK_MANIFEST_KEY]: 1,\n\t\tchunkCount: Math.ceil(payload.length / AUTH_SECRET_CHUNK_SIZE),\n\t\tchunkDigest: createHash(\"sha256\").update(payload, \"utf8\").digest(\"hex\").slice(0, 16),\n\t};\n}\n\nfunction readChunkedAuthEntry(\n\tstore: AuthSecretStore,\n\tserverName: string,\n\taccount: string,\n\tmanifest: AuthEntryChunkManifest,\n): AuthEntry {\n\tconst chunks = getAuthEntryChunkAccounts(account, manifest).map((chunkAccount) => {\n\t\ttry {\n\t\t\tconst chunk = store.read(chunkAccount);\n\t\t\tif (chunk === undefined) {\n\t\t\t\tthrow new Error(`Missing OAuth credential chunk ${chunkAccount} for ${serverName}`);\n\t\t\t}\n\t\t\treturn chunk;\n\t\t} catch (error) {\n\t\t\tthrow new OAuthCredentialStoreError(\n\t\t\t\t`Failed to read OAuth credentials for ${serverName} from the OS secure credential store`,\n\t\t\t\t\"read\",\n\t\t\t\terror,\n\t\t\t);\n\t\t}\n\t});\n\tconst payload = chunks.join(\"\");\n\tconst digest = createHash(\"sha256\").update(payload, \"utf8\").digest(\"hex\").slice(0, 16);\n\tif (digest !== manifest.chunkDigest) {\n\t\tthrow new OAuthCredentialStoreError(\n\t\t\t`Failed to read OAuth credentials for ${serverName} from the OS secure credential store`,\n\t\t\t\"read\",\n\t\t\tnew Error(\"OAuth credential chunk digest mismatch\"),\n\t\t);\n\t}\n\treturn parseAuthEntryPayload(serverName, payload, \"OS secure credential store chunks\");\n}\n\nfunction readLegacyAuthEntry(serverName: string, options?: AuthStorageOptions): AuthEntry | undefined {\n\tconst filePath = getAuthEntryFilePath(serverName, options);\n\tif (!existsSync(filePath)) return undefined;\n\tconst data = readFileSync(filePath, \"utf-8\");\n\treturn parseAuthEntryPayload(serverName, data, filePath);\n}\n\nfunction removeLegacyAuthEntry(serverName: string, options?: AuthStorageOptions): void {\n\tconst filePath = getAuthEntryFilePath(serverName, options);\n\tif (!existsSync(filePath)) return;\n\ttry {\n\t\trmSync(filePath, { force: true });\n\t} catch (error) {\n\t\tthrow new Error(`Failed to remove legacy plaintext OAuth credentials for ${serverName} at ${filePath}`, {\n\t\t\tcause: error,\n\t\t});\n\t}\n\n\tconst dir = getServerDir(serverName, options);\n\ttry {\n\t\trmSync(dir, { recursive: true });\n\t} catch {\n\t\t// Directory may contain future non-secret metadata; the plaintext file was already removed.\n\t}\n}\n\nfunction writeSecureAuthEntryToStore(\n\tstore: AuthSecretStore,\n\tserverName: string,\n\tentry: AuthEntry,\n\toptions?: AuthStorageOptions,\n): void {\n\tconst account = getAuthEntryAccount(serverName);\n\tconst payload = JSON.stringify(entry);\n\tconst previousManifest = readExistingChunkManifest(store, serverName, account);\n\tconst manifest = payload.length > AUTH_SECRET_CHUNK_SIZE ? createChunkManifest(payload) : undefined;\n\n\ttry {\n\t\tif (manifest) {\n\t\t\tfor (let index = 0; index < manifest.chunkCount; index++) {\n\t\t\t\tconst chunk = payload.slice(index * AUTH_SECRET_CHUNK_SIZE, (index + 1) * AUTH_SECRET_CHUNK_SIZE);\n\t\t\t\tstore.write(getAuthEntryChunkAccount(account, manifest, index), chunk);\n\t\t\t}\n\t\t\tstore.write(account, JSON.stringify(manifest));\n\t\t} else {\n\t\t\t// Compact: multiline secrets corrupt gnome-keyring plaintext (GKeyFile) collections.\n\t\t\tstore.write(account, payload);\n\t\t}\n\t\tif (previousManifest?.chunkDigest !== manifest?.chunkDigest) {\n\t\t\ttryRemoveChunkPayloads(store, account, previousManifest);\n\t\t}\n\t} catch (error) {\n\t\ttryRemoveChunkPayloads(store, account, manifest);\n\t\tthrow new OAuthCredentialStoreError(\n\t\t\t`Failed to write OAuth credentials for ${serverName} to the OS secure credential store`,\n\t\t\t\"write\",\n\t\t\terror,\n\t\t);\n\t}\n\n\tpublishAuthEntryToCache(serverName, payload, options);\n}\n\nfunction publishAuthEntryToCache(serverName: string, payload: string, options?: AuthStorageOptions): void {\n\tif (!isAuthEntryCacheEnabled()) return;\n\tdeleteAuthEntryCacheEntries(serverName);\n\t// Cache the same normalized shape a fresh persistent-store read returns.\n\tconst normalized = toAuthEntry(JSON.parse(payload) as unknown);\n\tif (!normalized) {\n\t\treturn;\n\t}\n\tauthEntryCache.set(getAuthEntryCacheKey(serverName, options), cloneAuthEntry(normalized));\n}\n\nfunction writeSecureAuthEntry(serverName: string, entry: AuthEntry, options?: AuthStorageOptions): void {\n\ttry {\n\t\twriteSecureAuthEntryToStore(getAuthSecretStore(), serverName, entry, options);\n\t} catch (error) {\n\t\tif (!shouldAttemptLinuxKeyringRecovery(error)) throw error;\n\t\twriteSecureAuthEntryToStore(linuxKeyringRecoveryAuthSecretStore, serverName, entry, options);\n\t}\n}\n\n/**\n * Read the auth entry for a server from the OS secure store, importing and\n * deleting a legacy plaintext entry when present.\n */\nfunction readAuthEntryFromStore(\n\tstore: AuthSecretStore,\n\tserverName: string,\n\toptions?: AuthStorageOptions,\n\tbehavior: { migrateLegacy?: boolean } = {},\n): AuthEntry | undefined {\n\tconst account = getAuthEntryAccount(serverName);\n\tlet payload: string | undefined;\n\ttry {\n\t\tpayload = store.read(account);\n\t} catch (error) {\n\t\tthrow new OAuthCredentialStoreError(\n\t\t\t`Failed to read OAuth credentials for ${serverName} from the OS secure credential store`,\n\t\t\t\"read\",\n\t\t\terror,\n\t\t);\n\t}\n\n\tif (payload !== undefined) {\n\t\tconst manifest = readChunkManifestFromPayload(serverName, payload, \"OS secure credential store\");\n\t\tconst entry = manifest\n\t\t\t? readChunkedAuthEntry(store, serverName, account, manifest)\n\t\t\t: parseAuthEntryPayload(serverName, payload, \"OS secure credential store\");\n\t\tremoveLegacyAuthEntry(serverName, options);\n\t\treturn entry;\n\t}\n\n\tconst legacyEntry = readLegacyAuthEntry(serverName, options);\n\tif (!legacyEntry) return undefined;\n\tif (behavior.migrateLegacy === false) return legacyEntry;\n\twriteSecureAuthEntryToStore(store, serverName, legacyEntry, options);\n\tremoveLegacyAuthEntry(serverName, options);\n\treturn legacyEntry;\n}\n\nfunction readAuthEntry(\n\tserverName: string,\n\toptions?: AuthStorageOptions,\n\tbehavior: { migrateLegacy?: boolean } = {},\n): AuthEntry | undefined {\n\t// Status-only reads deliberately bypass the cache because they do not\n\t// migrate legacy entries.\n\tconst cacheable = behavior.migrateLegacy !== false && isAuthEntryCacheEnabled();\n\tconst cacheKey = getAuthEntryCacheKey(serverName, options);\n\tif (cacheable && authEntryCache.has(cacheKey)) {\n\t\treturn cloneAuthEntry(authEntryCache.get(cacheKey));\n\t}\n\n\tlet entry: AuthEntry | undefined;\n\ttry {\n\t\tentry = readAuthEntryFromStore(getAuthSecretStore(), serverName, options, behavior);\n\t} catch (error) {\n\t\tif (!shouldAttemptLinuxKeyringRecovery(error)) throw error;\n\t\tentry = readAuthEntryFromStore(linuxKeyringRecoveryAuthSecretStore, serverName, options, behavior);\n\t}\n\n\tif (cacheable) authEntryCache.set(cacheKey, cloneAuthEntry(entry));\n\treturn entry;\n}\n\n/**\n * Get auth entry for a server.\n */\nexport function getAuthEntry(serverName: string, options?: AuthStorageOptions): AuthEntry | undefined {\n\treturn readAuthEntry(serverName, options);\n}\n\n/**\n * Get auth entry and validate it's for the correct URL.\n * Returns undefined if URL has changed (credentials are invalid).\n */\nexport function getAuthForUrl(\n\tserverName: string,\n\tserverUrl: string,\n\toptions?: AuthStorageOptions,\n): AuthEntry | undefined {\n\tconst entry = getAuthEntry(serverName, options);\n\tif (!entry) return undefined;\n\n\t// If no serverUrl is stored, this is from an old version - consider it invalid\n\tif (!entry.serverUrl) return undefined;\n\n\t// If URL has changed, credentials are invalid\n\tif (entry.serverUrl !== serverUrl) return undefined;\n\n\treturn entry;\n}\n\n/**\n * Inspect credentials for status-only UI paths without treating an unavailable\n * secure store as missing credentials. Authentication operations continue to\n * use getAuthForUrl() directly and therefore remain fail-closed.\n */\nexport function inspectAuthForUrl(\n\tserverName: string,\n\tserverUrl: string,\n\toptions?: AuthStorageOptions,\n): OAuthCredentialStatus {\n\ttry {\n\t\tconst entry = readAuthEntry(serverName, options, { migrateLegacy: false });\n\t\tif (!entry?.serverUrl || entry.serverUrl !== serverUrl) return { status: \"absent\" };\n\t\treturn { status: \"present\", entry };\n\t} catch (error) {\n\t\tif (!(error instanceof OAuthCredentialStoreError)) throw error;\n\t\treturn { status: \"unavailable\", message: formatOAuthCredentialStoreUnavailable(error) };\n\t}\n}\n\n/**\n * Save auth entry for a server.\n */\nexport function saveAuthEntry(\n\tserverName: string,\n\tentry: AuthEntry,\n\tserverUrl?: string,\n\toptions?: AuthStorageOptions,\n): void {\n\t// Always update serverUrl if provided\n\tif (serverUrl) {\n\t\tentry.serverUrl = serverUrl;\n\t}\n\twriteSecureAuthEntry(serverName, entry, options);\n\tremoveLegacyAuthEntry(serverName, options);\n}\n\n/**\n * Remove auth entry for a server.\n */\nfunction removeAuthEntryFromStore(store: AuthSecretStore, serverName: string): void {\n\tconst account = getAuthEntryAccount(serverName);\n\ttry {\n\t\tconst payload = store.read(account);\n\t\tconst manifest =\n\t\t\tpayload === undefined\n\t\t\t\t? undefined\n\t\t\t\t: readChunkManifestFromPayload(serverName, payload, \"OS secure credential store\");\n\t\tif (manifest) removeChunkPayloads(store, account, manifest);\n\t\tstore.remove(account);\n\t} catch (error) {\n\t\tthrow new OAuthCredentialStoreError(\n\t\t\t`Failed to remove OAuth credentials for ${serverName} from the OS secure credential store`,\n\t\t\t\"remove\",\n\t\t\terror,\n\t\t);\n\t}\n}\n\nexport function removeAuthEntry(serverName: string, options?: AuthStorageOptions): void {\n\ttry {\n\t\tremoveAuthEntryFromStore(getAuthSecretStore(), serverName);\n\t} catch (error) {\n\t\tif (!shouldAttemptLinuxKeyringRecovery(error)) throw error;\n\t\tremoveAuthEntryFromStore(linuxKeyringRecoveryAuthSecretStore, serverName);\n\t}\n\tdeleteAuthEntryCacheEntries(serverName);\n\tremoveLegacyAuthEntry(serverName, options);\n}\n\n/**\n * Forget a cached entry so the next ordinary read reloads secure storage.\n */\nexport function invalidateAuthEntryCache(serverName: string): void {\n\tdeleteAuthEntryCacheEntries(serverName);\n}\n\n/**\n * Update tokens for a server.\n */\nexport function updateTokens(\n\tserverName: string,\n\ttokens: StoredTokens,\n\tserverUrl?: string,\n\toptions?: AuthStorageOptions,\n): void {\n\tconst entry = getAuthEntry(serverName, options) ?? {};\n\tif (serverUrl && entry.serverUrl !== serverUrl) {\n\t\tdelete entry.clientInfo;\n\t\tdelete entry.codeVerifier;\n\t\tdelete entry.oauthState;\n\t}\n\tentry.tokens = tokens;\n\tsaveAuthEntry(serverName, entry, serverUrl, options);\n}\n\n/**\n * Update client info for a server.\n */\nexport function updateClientInfo(\n\tserverName: string,\n\tclientInfo: StoredClientInfo,\n\tserverUrl?: string,\n\toptions?: AuthStorageOptions,\n): void {\n\tconst entry = getAuthEntry(serverName, options) ?? {};\n\tif (serverUrl && entry.serverUrl !== serverUrl) {\n\t\tdelete entry.tokens;\n\t\tdelete entry.codeVerifier;\n\t\tdelete entry.oauthState;\n\t}\n\tentry.clientInfo = clientInfo;\n\tsaveAuthEntry(serverName, entry, serverUrl, options);\n}\n\n/**\n * Update code verifier for a server.\n */\nexport function updateCodeVerifier(\n\tserverName: string,\n\tcodeVerifier: string,\n\tserverUrl?: string,\n\toptions?: AuthStorageOptions,\n): void {\n\tconst entry = getAuthEntry(serverName, options) ?? {};\n\tif (serverUrl && entry.serverUrl !== serverUrl) {\n\t\tdelete entry.tokens;\n\t\tdelete entry.clientInfo;\n\t\tdelete entry.oauthState;\n\t}\n\tentry.codeVerifier = codeVerifier;\n\tsaveAuthEntry(serverName, entry, serverUrl, options);\n}\n\n/**\n * Clear code verifier for a server.\n */\nexport function clearCodeVerifier(serverName: string, options?: AuthStorageOptions): void {\n\tconst entry = getAuthEntry(serverName, options);\n\tif (entry) {\n\t\tdelete entry.codeVerifier;\n\t\tsaveAuthEntry(serverName, entry, undefined, options);\n\t}\n}\n\n/**\n * Update OAuth state for a server.\n */\nexport function updateOAuthState(\n\tserverName: string,\n\tstate: string,\n\tserverUrl?: string,\n\toptions?: AuthStorageOptions,\n): void {\n\tconst entry = getAuthEntry(serverName, options) ?? {};\n\tif (serverUrl && entry.serverUrl !== serverUrl) {\n\t\tdelete entry.tokens;\n\t\tdelete entry.clientInfo;\n\t\tdelete entry.codeVerifier;\n\t}\n\tentry.oauthState = state;\n\tsaveAuthEntry(serverName, entry, serverUrl, options);\n}\n\n/**\n * Get OAuth state for a server.\n */\nexport function getOAuthState(serverName: string, options?: AuthStorageOptions): string | undefined {\n\tconst entry = getAuthEntry(serverName, options);\n\treturn entry?.oauthState;\n}\n\n/**\n * Clear OAuth state for a server.\n */\nexport function clearOAuthState(serverName: string, options?: AuthStorageOptions): void {\n\tconst entry = getAuthEntry(serverName, options);\n\tif (entry) {\n\t\tdelete entry.oauthState;\n\t\tsaveAuthEntry(serverName, entry, undefined, options);\n\t}\n}\n\n/**\n * Check if stored tokens are expired.\n * Returns null if no tokens exist, false if no expiry or not expired, true if expired.\n */\nexport function isTokenExpired(serverName: string, options?: AuthStorageOptions): boolean | null {\n\tconst entry = getAuthEntry(serverName, options);\n\tif (!entry?.tokens) return null;\n\tif (entry.tokens.expiresAt === undefined) return false;\n\treturn entry.tokens.expiresAt < Date.now() / 1000;\n}\n\n/**\n * Check if a server has stored tokens.\n */\nexport function hasStoredTokens(serverName: string, options?: AuthStorageOptions): boolean {\n\tconst entry = getAuthEntry(serverName, options);\n\treturn !!entry?.tokens;\n}\n\n/**\n * Clear all credentials for a server.\n */\nexport function clearAllCredentials(serverName: string, options?: AuthStorageOptions): void {\n\tremoveAuthEntry(serverName, options);\n}\n\n/**\n * Clear only client info for a server.\n */\nexport function clearClientInfo(serverName: string, options?: AuthStorageOptions): void {\n\tconst entry = getAuthEntry(serverName, options);\n\tif (entry) {\n\t\tdelete entry.clientInfo;\n\t\tsaveAuthEntry(serverName, entry, undefined, options);\n\t}\n}\n\n/**\n * Clear only tokens for a server.\n */\nexport function clearTokens(serverName: string, options?: AuthStorageOptions): void {\n\tconst entry = getAuthEntry(serverName, options);\n\tif (entry) {\n\t\tdelete entry.tokens;\n\t\tsaveAuthEntry(serverName, entry, undefined, options);\n\t}\n}\n"]}

package/dist/extensions/mcp/mcp-bearer-store.d.ts

@@ -0,0 +1,25 @@
+export declare class BearerCredentialStoreError extends Error {
+    readonly code = "BEARER_CREDENTIAL_STORE_UNAVAILABLE";
+    readonly operation: "read" | "write" | "remove";
+    constructor(message: string, operation: "read" | "write" | "remove", cause: unknown);
+}
+export type BearerCredentialStatus = {
+    status: "present";
+} | {
+    status: "missing";
+} | {
+    status: "url-mismatch";
+} | {
+    status: "unavailable";
+    message: string;
+};
+export declare function getBearerTokenForUrl(serverName: string, serverUrl: string): string | undefined;
+export declare function saveBearerTokenForUrl(serverName: string, token: string, serverUrl: string): void;
+export declare function removeBearerToken(serverName: string): void;
+export declare function inspectBearerTokenForUrl(serverName: string, serverUrl: string): BearerCredentialStatus;
+export declare function resetTestBearerTokenStore(): void;
+export declare function getTestBearerTokenStoreEntries(): [string, string][];
+export declare function removeTestBearerTokenStoreEntry(account: string): void;
+export declare function setTestBearerTokenStoreEntry(account: string, payload: string): void;
+export declare function getTestBearerTokenStoreReadCount(): number;
+//# sourceMappingURL=mcp-bearer-store.d.ts.map

package/dist/extensions/mcp/mcp-bearer-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-bearer-store.d.ts","sourceRoot":"","sources":["../../../src/extensions/mcp/mcp-bearer-store.ts"],"names":[],"mappings":"AA0CA,qBAAa,0BAA2B,SAAQ,KAAK;IACpD,QAAQ,CAAC,IAAI,yCAAyC;IACtD,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;IAIhD,YAAY,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,EAAE,KAAK,EAAE,OAAO,EAIlF;CACD;AAED,MAAM,MAAM,sBAAsB,GAC/B;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB;IAAE,MAAM,EAAE,cAAc,CAAA;CAAE,GAC1B;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AA2T9C,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAI9F;AAED,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAEhG;AAED,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAE1D;AAED,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,sBAAsB,CActG;AAED,wBAAgB,yBAAyB,IAAI,IAAI,CAGhD;AAED,wBAAgB,8BAA8B,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAEnE;AAED,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAErE;AAED,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAEnF;AAED,wBAAgB,gCAAgC,IAAI,MAAM,CAEzD","sourcesContent":["import { createHash } from \"node:crypto\";\nimport { createRequire } from \"node:module\";\nimport { dirname, join } from \"node:path\";\n\ntype KeyringEntry = {\n\tgetPassword(): string | null;\n\tsetPassword(password: string): void;\n\tdeleteCredential(): boolean;\n};\n\ntype KeyringEntryConstructor = new (service: string, account: string) => KeyringEntry;\ntype KeyringModule = { Entry: KeyringEntryConstructor };\ntype KeyringRequire = ((id: string) => unknown) & { resolve(id: string): string };\n\ntype BearerSecretStore = {\n\tread(account: string): string | undefined;\n\twrite(account: string, payload: string): void;\n\tremove(account: string): void;\n};\n\ninterface StoredBearerTokenRecord {\n\ttoken: string;\n\tserverUrl: string;\n}\n\ninterface BearerChunkManifest {\n\t__nexusMcpBearerChunked: 1;\n\tchunkCount: number;\n\tchunkDigest: string;\n}\n\nconst require = createRequire(import.meta.url);\nconst BEARER_SECRET_SERVICE = \"nexus-mcp.bearer\";\nconst TEST_AUTH_STORE_ENV = \"NEXUS_MCP_TEST_AUTH_STORE\";\nconst BEARER_SECRET_CHUNK_SIZE = 1000;\nconst BEARER_SECRET_VALUE_LIMIT = 1280;\nconst MAX_BEARER_SECRET_CHUNKS = 128;\n\nlet KeyringEntryClass: KeyringEntryConstructor | undefined;\nconst memoryBearerEntries = new Map<string, string>();\nlet testBearerSecretStoreReadCount = 0;\n\nexport class BearerCredentialStoreError extends Error {\n\treadonly code = \"BEARER_CREDENTIAL_STORE_UNAVAILABLE\";\n\treadonly operation: \"read\" | \"write\" | \"remove\";\n\n\t// No parameter properties: cli.js loads this module under plain Node\n\t// type stripping, which rejects non-erasable TypeScript syntax.\n\tconstructor(message: string, operation: \"read\" | \"write\" | \"remove\", cause: unknown) {\n\t\tsuper(message, { cause });\n\t\tthis.name = \"BearerCredentialStoreError\";\n\t\tthis.operation = operation;\n\t}\n}\n\nexport type BearerCredentialStatus =\n\t| { status: \"present\" }\n\t| { status: \"missing\" }\n\t| { status: \"url-mismatch\" }\n\t| { status: \"unavailable\"; message: string };\n\nconst memoryBearerSecretStore: BearerSecretStore = {\n\tread(account) {\n\t\ttestBearerSecretStoreReadCount++;\n\t\treturn memoryBearerEntries.get(account);\n\t},\n\twrite(account, payload) {\n\t\tmemoryBearerEntries.set(account, payload);\n\t},\n\tremove(account) {\n\t\tmemoryBearerEntries.delete(account);\n\t},\n};\n\nconst sizeLimitedBearerSecretStore: BearerSecretStore = {\n\tread(account) {\n\t\ttestBearerSecretStoreReadCount++;\n\t\treturn memoryBearerEntries.get(account);\n\t},\n\twrite(account, payload) {\n\t\tif (payload.length > BEARER_SECRET_VALUE_LIMIT) {\n\t\t\tthrow new Error(\n\t\t\t\t`Value of 'password encoded as UTF-16' is longer than the platform limit of ${BEARER_SECRET_VALUE_LIMIT * 2} chars`,\n\t\t\t);\n\t\t}\n\t\tmemoryBearerEntries.set(account, payload);\n\t},\n\tremove(account) {\n\t\tmemoryBearerEntries.delete(account);\n\t},\n};\n\nconst unavailableBearerSecretStore: BearerSecretStore = {\n\tread() {\n\t\ttestBearerSecretStoreReadCount++;\n\t\tthrow new Error(\"simulated secure credential store unavailable\");\n\t},\n\twrite() {\n\t\tthrow new Error(\"simulated secure credential store unavailable\");\n\t},\n\tremove() {\n\t\tthrow new Error(\"simulated secure credential store unavailable\");\n\t},\n};\n\nconst keyringBearerSecretStore: BearerSecretStore = {\n\tread(account) {\n\t\treturn getKeyringEntry(account).getPassword() ?? undefined;\n\t},\n\twrite(account, payload) {\n\t\tgetKeyringEntry(account).setPassword(payload);\n\t},\n\tremove(account) {\n\t\tgetKeyringEntry(account).deleteCredential();\n\t},\n};\n\nfunction getBearerSecretStore(): BearerSecretStore {\n\tif (process.env[TEST_AUTH_STORE_ENV] === \"memory\") return memoryBearerSecretStore;\n\tif (process.env[TEST_AUTH_STORE_ENV] === \"sizelimited\") return sizeLimitedBearerSecretStore;\n\tif (process.env[TEST_AUTH_STORE_ENV] === \"unavailable\") return unavailableBearerSecretStore;\n\treturn keyringBearerSecretStore;\n}\n\nfunction getKeyringEntry(account: string): KeyringEntry {\n\ttry {\n\t\tKeyringEntryClass ??= loadKeyringEntryClass();\n\t\treturn new KeyringEntryClass(BEARER_SECRET_SERVICE, account);\n\t} catch (error) {\n\t\tthrow new Error(\n\t\t\t\"Bearer token secure credential storage is unavailable. Configure the OS credential store and retry.\",\n\t\t\t{ cause: error },\n\t\t);\n\t}\n}\n\nfunction loadKeyringEntryClass(\n\tkeyringRequire: KeyringRequire = require,\n\tplatform: NodeJS.Platform = process.platform,\n\tarch: NodeJS.Architecture = process.arch,\n): KeyringEntryConstructor {\n\ttry {\n\t\treturn (keyringRequire(\"@napi-rs/keyring\") as KeyringModule).Entry;\n\t} catch (loaderError) {\n\t\ttry {\n\t\t\treturn loadKeyringNativeBindingFallback(keyringRequire, platform, arch).Entry;\n\t\t} catch (fallbackError) {\n\t\t\tconst message = fallbackError instanceof Error ? fallbackError.message : String(fallbackError);\n\t\t\tthrow new Error(\n\t\t\t\t`Failed to load @napi-rs/keyring; absolute-path native binding fallback also failed: ${message}`,\n\t\t\t\t{ cause: loaderError },\n\t\t\t);\n\t\t}\n\t}\n}\n\nfunction loadKeyringNativeBindingFallback(\n\tkeyringRequire: KeyringRequire,\n\tplatform: NodeJS.Platform,\n\tarch: NodeJS.Architecture,\n): KeyringModule {\n\tconst targets = getKeyringNativeBindingSuffixes(platform, arch).map((suffix) => ({\n\t\tpackageName: `@napi-rs/keyring-${suffix}`,\n\t\tbindingFile: `keyring.${suffix}.node`,\n\t}));\n\tlet lastError: unknown;\n\tfor (const target of targets) {\n\t\ttry {\n\t\t\tconst packageJsonPath = keyringRequire.resolve(`${target.packageName}/package.json`);\n\t\t\treturn keyringRequire(join(dirname(packageJsonPath), target.bindingFile)) as KeyringModule;\n\t\t} catch (error) {\n\t\t\tlastError = error;\n\t\t}\n\t}\n\tthrow lastError instanceof Error ? lastError : new Error(String(lastError));\n}\n\nfunction getKeyringNativeBindingSuffixes(platform: NodeJS.Platform, arch: NodeJS.Architecture): string[] {\n\tif (platform === \"darwin\") {\n\t\tif (arch === \"arm64\") return [\"darwin-arm64\"];\n\t\tif (arch === \"x64\") return [\"darwin-x64\"];\n\t}\n\tif (platform === \"win32\") {\n\t\tif (arch === \"arm64\") return [\"win32-arm64-msvc\"];\n\t\tif (arch === \"x64\") return [\"win32-x64-msvc\"];\n\t\tif (arch === \"ia32\") return [\"win32-ia32-msvc\"];\n\t}\n\tif (platform === \"linux\") {\n\t\tif (arch === \"arm64\") return [\"linux-arm64-gnu\", \"linux-arm64-musl\"];\n\t\tif (arch === \"arm\") return [\"linux-arm-gnueabihf\"];\n\t\tif (arch === \"riscv64\") return [\"linux-riscv64-gnu\"];\n\t\tif (arch === \"x64\") return [\"linux-x64-gnu\", \"linux-x64-musl\"];\n\t}\n\tif (platform === \"freebsd\" && arch === \"x64\") return [\"freebsd-x64\"];\n\treturn [];\n}\n\nfunction getBearerAccount(serverName: string): string {\n\tif (typeof serverName !== \"string\") {\n\t\tthrow new Error(`Invalid MCP server name: ${JSON.stringify(serverName)}`);\n\t}\n\treturn `sha256-${createHash(\"sha256\").update(serverName, \"utf8\").digest(\"hex\")}`;\n}\n\nfunction parseBearerPayload(serverName: string, payload: string): StoredBearerTokenRecord {\n\tconst parsed = parseStoredBearerJson(serverName, payload);\n\tif (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) {\n\t\tthrow new Error(`Stored bearer token record for ${serverName} has invalid shape`);\n\t}\n\tconst record = parsed as Partial<StoredBearerTokenRecord>;\n\tif (typeof record.token !== \"string\" || typeof record.serverUrl !== \"string\") {\n\t\tthrow new Error(`Stored bearer token record for ${serverName} has invalid shape`);\n\t}\n\treturn { token: record.token, serverUrl: record.serverUrl };\n}\n\nfunction parseStoredBearerJson(serverName: string, payload: string): unknown {\n\ttry {\n\t\treturn JSON.parse(payload) as unknown;\n\t} catch {\n\t\tthrow new Error(`Failed to parse stored bearer token record for ${serverName}`);\n\t}\n}\n\nfunction isBearerChunkManifest(value: unknown): value is BearerChunkManifest {\n\tif (typeof value !== \"object\" || value === null) return false;\n\tconst manifest = value as Partial<BearerChunkManifest>;\n\treturn (\n\t\tmanifest.__nexusMcpBearerChunked === 1 &&\n\t\ttypeof manifest.chunkCount === \"number\" &&\n\t\tNumber.isInteger(manifest.chunkCount) &&\n\t\tmanifest.chunkCount > 0 &&\n\t\tmanifest.chunkCount <= MAX_BEARER_SECRET_CHUNKS &&\n\t\ttypeof manifest.chunkDigest === \"string\" &&\n\t\t/^[a-f0-9]{16}$/.test(manifest.chunkDigest)\n\t);\n}\n\nfunction readManifest(serverName: string, payload: string): BearerChunkManifest | undefined {\n\tconst parsed = parseStoredBearerJson(serverName, payload);\n\treturn isBearerChunkManifest(parsed) ? parsed : undefined;\n}\n\nfunction chunkAccount(account: string, manifest: BearerChunkManifest, index: number): string {\n\treturn `${account}.chunk.${manifest.chunkDigest}.${index}`;\n}\n\nfunction chunkAccounts(account: string, manifest: BearerChunkManifest): string[] {\n\treturn Array.from({ length: manifest.chunkCount }, (_, index) => chunkAccount(account, manifest, index));\n}\n\nfunction createManifest(payload: string): BearerChunkManifest {\n\treturn {\n\t\t__nexusMcpBearerChunked: 1,\n\t\tchunkCount: Math.ceil(payload.length / BEARER_SECRET_CHUNK_SIZE),\n\t\tchunkDigest: createHash(\"sha256\").update(payload, \"utf8\").digest(\"hex\").slice(0, 16),\n\t};\n}\n\nfunction readExistingManifest(\n\tstore: BearerSecretStore,\n\tserverName: string,\n\taccount: string,\n): BearerChunkManifest | undefined {\n\ttry {\n\t\tconst payload = store.read(account);\n\t\treturn payload === undefined ? undefined : readManifest(serverName, payload);\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\nfunction removeChunks(store: BearerSecretStore, account: string, manifest: BearerChunkManifest | undefined): void {\n\tif (!manifest) return;\n\tfor (const accountName of chunkAccounts(account, manifest)) store.remove(accountName);\n}\n\nfunction tryRemoveChunks(store: BearerSecretStore, account: string, manifest: BearerChunkManifest | undefined): void {\n\ttry {\n\t\tremoveChunks(store, account, manifest);\n\t} catch {\n\t\t// Stale chunk cleanup must not hide a successful credential write.\n\t}\n}\n\nfunction readBearerRecordFromStore(store: BearerSecretStore, serverName: string): StoredBearerTokenRecord | undefined {\n\tconst account = getBearerAccount(serverName);\n\tlet payload: string | undefined;\n\ttry {\n\t\tpayload = store.read(account);\n\t} catch (error) {\n\t\tthrow new BearerCredentialStoreError(\n\t\t\t`Failed to read bearer token for ${serverName} from the OS secure credential store`,\n\t\t\t\"read\",\n\t\t\terror,\n\t\t);\n\t}\n\tif (payload === undefined) return undefined;\n\ttry {\n\t\tconst manifest = readManifest(serverName, payload);\n\t\tconst recordPayload = manifest\n\t\t\t? chunkAccounts(account, manifest)\n\t\t\t\t\t.map((chunkName) => {\n\t\t\t\t\t\tconst chunk = store.read(chunkName);\n\t\t\t\t\t\tif (chunk === undefined) throw new Error(`Missing bearer token chunk for ${serverName}`);\n\t\t\t\t\t\treturn chunk;\n\t\t\t\t\t})\n\t\t\t\t\t.join(\"\")\n\t\t\t: payload;\n\t\tif (manifest) {\n\t\t\tconst digest = createHash(\"sha256\").update(recordPayload, \"utf8\").digest(\"hex\").slice(0, 16);\n\t\t\tif (digest !== manifest.chunkDigest) throw new Error(`Bearer token chunk digest mismatch for ${serverName}`);\n\t\t}\n\t\treturn parseBearerPayload(serverName, recordPayload);\n\t} catch (error) {\n\t\tthrow new BearerCredentialStoreError(\n\t\t\t`Failed to read bearer token for ${serverName} from the OS secure credential store`,\n\t\t\t\"read\",\n\t\t\terror,\n\t\t);\n\t}\n}\n\nfunction writeBearerRecordToStore(store: BearerSecretStore, serverName: string, record: StoredBearerTokenRecord): void {\n\tconst account = getBearerAccount(serverName);\n\tconst payload = JSON.stringify(record);\n\tconst previousManifest = readExistingManifest(store, serverName, account);\n\tconst manifest = payload.length > BEARER_SECRET_CHUNK_SIZE ? createManifest(payload) : undefined;\n\ttry {\n\t\tif (manifest) {\n\t\t\tfor (let index = 0; index < manifest.chunkCount; index++) {\n\t\t\t\tstore.write(\n\t\t\t\t\tchunkAccount(account, manifest, index),\n\t\t\t\t\tpayload.slice(index * BEARER_SECRET_CHUNK_SIZE, (index + 1) * BEARER_SECRET_CHUNK_SIZE),\n\t\t\t\t);\n\t\t\t}\n\t\t\tstore.write(account, JSON.stringify(manifest));\n\t\t} else {\n\t\t\tstore.write(account, payload);\n\t\t}\n\t\tif (previousManifest?.chunkDigest !== manifest?.chunkDigest) {\n\t\t\ttryRemoveChunks(store, account, previousManifest);\n\t\t}\n\t} catch (error) {\n\t\t// An identical payload reuses the previous manifest's digest-keyed chunk\n\t\t// accounts. Removing them on a failed rewrite would destroy the still\n\t\t// installed previous credential, so clean up only digest-distinct chunks.\n\t\tif (previousManifest?.chunkDigest !== manifest?.chunkDigest) {\n\t\t\ttryRemoveChunks(store, account, manifest);\n\t\t}\n\t\tthrow new BearerCredentialStoreError(\n\t\t\t`Failed to write bearer token for ${serverName} to the OS secure credential store`,\n\t\t\t\"write\",\n\t\t\terror,\n\t\t);\n\t}\n}\n\nfunction removeBearerRecordFromStore(store: BearerSecretStore, serverName: string): void {\n\tconst account = getBearerAccount(serverName);\n\ttry {\n\t\tconst payload = store.read(account);\n\t\tconst manifest = payload === undefined ? undefined : readManifest(serverName, payload);\n\t\tremoveChunks(store, account, manifest);\n\t\tstore.remove(account);\n\t} catch (error) {\n\t\tthrow new BearerCredentialStoreError(\n\t\t\t`Failed to remove bearer token for ${serverName} from the OS secure credential store`,\n\t\t\t\"remove\",\n\t\t\terror,\n\t\t);\n\t}\n}\n\nexport function getBearerTokenForUrl(serverName: string, serverUrl: string): string | undefined {\n\tconst record = readBearerRecordFromStore(getBearerSecretStore(), serverName);\n\tif (!record) return undefined;\n\treturn record.serverUrl === serverUrl ? record.token : undefined;\n}\n\nexport function saveBearerTokenForUrl(serverName: string, token: string, serverUrl: string): void {\n\twriteBearerRecordToStore(getBearerSecretStore(), serverName, { token, serverUrl });\n}\n\nexport function removeBearerToken(serverName: string): void {\n\tremoveBearerRecordFromStore(getBearerSecretStore(), serverName);\n}\n\nexport function inspectBearerTokenForUrl(serverName: string, serverUrl: string): BearerCredentialStatus {\n\ttry {\n\t\tconst record = readBearerRecordFromStore(getBearerSecretStore(), serverName);\n\t\tif (!record) return { status: \"missing\" };\n\t\tif (record.serverUrl !== serverUrl) return { status: \"url-mismatch\" };\n\t\treturn { status: \"present\" };\n\t} catch (error) {\n\t\tif (!(error instanceof BearerCredentialStoreError)) throw error;\n\t\treturn {\n\t\t\tstatus: \"unavailable\",\n\t\t\tmessage:\n\t\t\t\t\"Bearer token secure credential store unavailable. Configure or unlock the OS credential store and retry.\",\n\t\t};\n\t}\n}\n\nexport function resetTestBearerTokenStore(): void {\n\tmemoryBearerEntries.clear();\n\ttestBearerSecretStoreReadCount = 0;\n}\n\nexport function getTestBearerTokenStoreEntries(): [string, string][] {\n\treturn [...memoryBearerEntries.entries()];\n}\n\nexport function removeTestBearerTokenStoreEntry(account: string): void {\n\tmemoryBearerEntries.delete(account);\n}\n\nexport function setTestBearerTokenStoreEntry(account: string, payload: string): void {\n\tmemoryBearerEntries.set(account, payload);\n}\n\nexport function getTestBearerTokenStoreReadCount(): number {\n\treturn testBearerSecretStoreReadCount;\n}\n"]}

package/dist/extensions/mcp/mcp-bearer-store.js

@@ -0,0 +1,350 @@
+import { createHash } from "node:crypto";
+import { createRequire } from "node:module";
+import { dirname, join } from "node:path";
+const require = createRequire(import.meta.url);
+const BEARER_SECRET_SERVICE = "nexus-mcp.bearer";
+const TEST_AUTH_STORE_ENV = "NEXUS_MCP_TEST_AUTH_STORE";
+const BEARER_SECRET_CHUNK_SIZE = 1000;
+const BEARER_SECRET_VALUE_LIMIT = 1280;
+const MAX_BEARER_SECRET_CHUNKS = 128;
+let KeyringEntryClass;
+const memoryBearerEntries = new Map();
+let testBearerSecretStoreReadCount = 0;
+export class BearerCredentialStoreError extends Error {
+    code = "BEARER_CREDENTIAL_STORE_UNAVAILABLE";
+    operation;
+    // No parameter properties: cli.js loads this module under plain Node
+    // type stripping, which rejects non-erasable TypeScript syntax.
+    constructor(message, operation, cause) {
+        super(message, { cause });
+        this.name = "BearerCredentialStoreError";
+        this.operation = operation;
+    }
+}
+const memoryBearerSecretStore = {
+    read(account) {
+        testBearerSecretStoreReadCount++;
+        return memoryBearerEntries.get(account);
+    },
+    write(account, payload) {
+        memoryBearerEntries.set(account, payload);
+    },
+    remove(account) {
+        memoryBearerEntries.delete(account);
+    },
+};
+const sizeLimitedBearerSecretStore = {
+    read(account) {
+        testBearerSecretStoreReadCount++;
+        return memoryBearerEntries.get(account);
+    },
+    write(account, payload) {
+        if (payload.length > BEARER_SECRET_VALUE_LIMIT) {
+            throw new Error(`Value of 'password encoded as UTF-16' is longer than the platform limit of ${BEARER_SECRET_VALUE_LIMIT * 2} chars`);
+        }
+        memoryBearerEntries.set(account, payload);
+    },
+    remove(account) {
+        memoryBearerEntries.delete(account);
+    },
+};
+const unavailableBearerSecretStore = {
+    read() {
+        testBearerSecretStoreReadCount++;
+        throw new Error("simulated secure credential store unavailable");
+    },
+    write() {
+        throw new Error("simulated secure credential store unavailable");
+    },
+    remove() {
+        throw new Error("simulated secure credential store unavailable");
+    },
+};
+const keyringBearerSecretStore = {
+    read(account) {
+        return getKeyringEntry(account).getPassword() ?? undefined;
+    },
+    write(account, payload) {
+        getKeyringEntry(account).setPassword(payload);
+    },
+    remove(account) {
+        getKeyringEntry(account).deleteCredential();
+    },
+};
+function getBearerSecretStore() {
+    if (process.env[TEST_AUTH_STORE_ENV] === "memory")
+        return memoryBearerSecretStore;
+    if (process.env[TEST_AUTH_STORE_ENV] === "sizelimited")
+        return sizeLimitedBearerSecretStore;
+    if (process.env[TEST_AUTH_STORE_ENV] === "unavailable")
+        return unavailableBearerSecretStore;
+    return keyringBearerSecretStore;
+}
+function getKeyringEntry(account) {
+    try {
+        KeyringEntryClass ??= loadKeyringEntryClass();
+        return new KeyringEntryClass(BEARER_SECRET_SERVICE, account);
+    }
+    catch (error) {
+        throw new Error("Bearer token secure credential storage is unavailable. Configure the OS credential store and retry.", { cause: error });
+    }
+}
+function loadKeyringEntryClass(keyringRequire = require, platform = process.platform, arch = process.arch) {
+    try {
+        return keyringRequire("@napi-rs/keyring").Entry;
+    }
+    catch (loaderError) {
+        try {
+            return loadKeyringNativeBindingFallback(keyringRequire, platform, arch).Entry;
+        }
+        catch (fallbackError) {
+            const message = fallbackError instanceof Error ? fallbackError.message : String(fallbackError);
+            throw new Error(`Failed to load @napi-rs/keyring; absolute-path native binding fallback also failed: ${message}`, { cause: loaderError });
+        }
+    }
+}
+function loadKeyringNativeBindingFallback(keyringRequire, platform, arch) {
+    const targets = getKeyringNativeBindingSuffixes(platform, arch).map((suffix) => ({
+        packageName: `@napi-rs/keyring-${suffix}`,
+        bindingFile: `keyring.${suffix}.node`,
+    }));
+    let lastError;
+    for (const target of targets) {
+        try {
+            const packageJsonPath = keyringRequire.resolve(`${target.packageName}/package.json`);
+            return keyringRequire(join(dirname(packageJsonPath), target.bindingFile));
+        }
+        catch (error) {
+            lastError = error;
+        }
+    }
+    throw lastError instanceof Error ? lastError : new Error(String(lastError));
+}
+function getKeyringNativeBindingSuffixes(platform, arch) {
+    if (platform === "darwin") {
+        if (arch === "arm64")
+            return ["darwin-arm64"];
+        if (arch === "x64")
+            return ["darwin-x64"];
+    }
+    if (platform === "win32") {
+        if (arch === "arm64")
+            return ["win32-arm64-msvc"];
+        if (arch === "x64")
+            return ["win32-x64-msvc"];
+        if (arch === "ia32")
+            return ["win32-ia32-msvc"];
+    }
+    if (platform === "linux") {
+        if (arch === "arm64")
+            return ["linux-arm64-gnu", "linux-arm64-musl"];
+        if (arch === "arm")
+            return ["linux-arm-gnueabihf"];
+        if (arch === "riscv64")
+            return ["linux-riscv64-gnu"];
+        if (arch === "x64")
+            return ["linux-x64-gnu", "linux-x64-musl"];
+    }
+    if (platform === "freebsd" && arch === "x64")
+        return ["freebsd-x64"];
+    return [];
+}
+function getBearerAccount(serverName) {
+    if (typeof serverName !== "string") {
+        throw new Error(`Invalid MCP server name: ${JSON.stringify(serverName)}`);
+    }
+    return `sha256-${createHash("sha256").update(serverName, "utf8").digest("hex")}`;
+}
+function parseBearerPayload(serverName, payload) {
+    const parsed = parseStoredBearerJson(serverName, payload);
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+        throw new Error(`Stored bearer token record for ${serverName} has invalid shape`);
+    }
+    const record = parsed;
+    if (typeof record.token !== "string" || typeof record.serverUrl !== "string") {
+        throw new Error(`Stored bearer token record for ${serverName} has invalid shape`);
+    }
+    return { token: record.token, serverUrl: record.serverUrl };
+}
+function parseStoredBearerJson(serverName, payload) {
+    try {
+        return JSON.parse(payload);
+    }
+    catch {
+        throw new Error(`Failed to parse stored bearer token record for ${serverName}`);
+    }
+}
+function isBearerChunkManifest(value) {
+    if (typeof value !== "object" || value === null)
+        return false;
+    const manifest = value;
+    return (manifest.__nexusMcpBearerChunked === 1 &&
+        typeof manifest.chunkCount === "number" &&
+        Number.isInteger(manifest.chunkCount) &&
+        manifest.chunkCount > 0 &&
+        manifest.chunkCount <= MAX_BEARER_SECRET_CHUNKS &&
+        typeof manifest.chunkDigest === "string" &&
+        /^[a-f0-9]{16}$/.test(manifest.chunkDigest));
+}
+function readManifest(serverName, payload) {
+    const parsed = parseStoredBearerJson(serverName, payload);
+    return isBearerChunkManifest(parsed) ? parsed : undefined;
+}
+function chunkAccount(account, manifest, index) {
+    return `${account}.chunk.${manifest.chunkDigest}.${index}`;
+}
+function chunkAccounts(account, manifest) {
+    return Array.from({ length: manifest.chunkCount }, (_, index) => chunkAccount(account, manifest, index));
+}
+function createManifest(payload) {
+    return {
+        __nexusMcpBearerChunked: 1,
+        chunkCount: Math.ceil(payload.length / BEARER_SECRET_CHUNK_SIZE),
+        chunkDigest: createHash("sha256").update(payload, "utf8").digest("hex").slice(0, 16),
+    };
+}
+function readExistingManifest(store, serverName, account) {
+    try {
+        const payload = store.read(account);
+        return payload === undefined ? undefined : readManifest(serverName, payload);
+    }
+    catch {
+        return undefined;
+    }
+}
+function removeChunks(store, account, manifest) {
+    if (!manifest)
+        return;
+    for (const accountName of chunkAccounts(account, manifest))
+        store.remove(accountName);
+}
+function tryRemoveChunks(store, account, manifest) {
+    try {
+        removeChunks(store, account, manifest);
+    }
+    catch {
+        // Stale chunk cleanup must not hide a successful credential write.
+    }
+}
+function readBearerRecordFromStore(store, serverName) {
+    const account = getBearerAccount(serverName);
+    let payload;
+    try {
+        payload = store.read(account);
+    }
+    catch (error) {
+        throw new BearerCredentialStoreError(`Failed to read bearer token for ${serverName} from the OS secure credential store`, "read", error);
+    }
+    if (payload === undefined)
+        return undefined;
+    try {
+        const manifest = readManifest(serverName, payload);
+        const recordPayload = manifest
+            ? chunkAccounts(account, manifest)
+                .map((chunkName) => {
+                const chunk = store.read(chunkName);
+                if (chunk === undefined)
+                    throw new Error(`Missing bearer token chunk for ${serverName}`);
+                return chunk;
+            })
+                .join("")
+            : payload;
+        if (manifest) {
+            const digest = createHash("sha256").update(recordPayload, "utf8").digest("hex").slice(0, 16);
+            if (digest !== manifest.chunkDigest)
+                throw new Error(`Bearer token chunk digest mismatch for ${serverName}`);
+        }
+        return parseBearerPayload(serverName, recordPayload);
+    }
+    catch (error) {
+        throw new BearerCredentialStoreError(`Failed to read bearer token for ${serverName} from the OS secure credential store`, "read", error);
+    }
+}
+function writeBearerRecordToStore(store, serverName, record) {
+    const account = getBearerAccount(serverName);
+    const payload = JSON.stringify(record);
+    const previousManifest = readExistingManifest(store, serverName, account);
+    const manifest = payload.length > BEARER_SECRET_CHUNK_SIZE ? createManifest(payload) : undefined;
+    try {
+        if (manifest) {
+            for (let index = 0; index < manifest.chunkCount; index++) {
+                store.write(chunkAccount(account, manifest, index), payload.slice(index * BEARER_SECRET_CHUNK_SIZE, (index + 1) * BEARER_SECRET_CHUNK_SIZE));
+            }
+            store.write(account, JSON.stringify(manifest));
+        }
+        else {
+            store.write(account, payload);
+        }
+        if (previousManifest?.chunkDigest !== manifest?.chunkDigest) {
+            tryRemoveChunks(store, account, previousManifest);
+        }
+    }
+    catch (error) {
+        // An identical payload reuses the previous manifest's digest-keyed chunk
+        // accounts. Removing them on a failed rewrite would destroy the still
+        // installed previous credential, so clean up only digest-distinct chunks.
+        if (previousManifest?.chunkDigest !== manifest?.chunkDigest) {
+            tryRemoveChunks(store, account, manifest);
+        }
+        throw new BearerCredentialStoreError(`Failed to write bearer token for ${serverName} to the OS secure credential store`, "write", error);
+    }
+}
+function removeBearerRecordFromStore(store, serverName) {
+    const account = getBearerAccount(serverName);
+    try {
+        const payload = store.read(account);
+        const manifest = payload === undefined ? undefined : readManifest(serverName, payload);
+        removeChunks(store, account, manifest);
+        store.remove(account);
+    }
+    catch (error) {
+        throw new BearerCredentialStoreError(`Failed to remove bearer token for ${serverName} from the OS secure credential store`, "remove", error);
+    }
+}
+export function getBearerTokenForUrl(serverName, serverUrl) {
+    const record = readBearerRecordFromStore(getBearerSecretStore(), serverName);
+    if (!record)
+        return undefined;
+    return record.serverUrl === serverUrl ? record.token : undefined;
+}
+export function saveBearerTokenForUrl(serverName, token, serverUrl) {
+    writeBearerRecordToStore(getBearerSecretStore(), serverName, { token, serverUrl });
+}
+export function removeBearerToken(serverName) {
+    removeBearerRecordFromStore(getBearerSecretStore(), serverName);
+}
+export function inspectBearerTokenForUrl(serverName, serverUrl) {
+    try {
+        const record = readBearerRecordFromStore(getBearerSecretStore(), serverName);
+        if (!record)
+            return { status: "missing" };
+        if (record.serverUrl !== serverUrl)
+            return { status: "url-mismatch" };
+        return { status: "present" };
+    }
+    catch (error) {
+        if (!(error instanceof BearerCredentialStoreError))
+            throw error;
+        return {
+            status: "unavailable",
+            message: "Bearer token secure credential store unavailable. Configure or unlock the OS credential store and retry.",
+        };
+    }
+}
+export function resetTestBearerTokenStore() {
+    memoryBearerEntries.clear();
+    testBearerSecretStoreReadCount = 0;
+}
+export function getTestBearerTokenStoreEntries() {
+    return [...memoryBearerEntries.entries()];
+}
+export function removeTestBearerTokenStoreEntry(account) {
+    memoryBearerEntries.delete(account);
+}
+export function setTestBearerTokenStoreEntry(account, payload) {
+    memoryBearerEntries.set(account, payload);
+}
+export function getTestBearerTokenStoreReadCount() {
+    return testBearerSecretStoreReadCount;
+}
+//# sourceMappingURL=mcp-bearer-store.js.map