@anthropic-field/core 0.1.0

package/dist/src/mcp/token-storage/file-token-storage.js

@@ -0,0 +1,145 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { promises as fs } from 'node:fs';
+import * as path from 'node:path';
+import * as os from 'node:os';
+import * as crypto from 'node:crypto';
+import { BaseTokenStorage } from './base-token-storage.js';
+import { GEMINI_DIR, homedir } from '../../utils/paths.js';
+export class FileTokenStorage extends BaseTokenStorage {
+    tokenFilePath;
+    encryptionKey;
+    constructor(serviceName) {
+        super(serviceName);
+        const configDir = path.join(homedir(), GEMINI_DIR);
+        this.tokenFilePath = path.join(configDir, 'mcp-oauth-tokens-v2.json');
+        this.encryptionKey = this.deriveEncryptionKey();
+    }
+    deriveEncryptionKey() {
+        const salt = `${os.hostname()}-${os.userInfo().username}-gemini-cli`;
+        return crypto.scryptSync('gemini-cli-oauth', salt, 32);
+    }
+    encrypt(text) {
+        const iv = crypto.randomBytes(16);
+        const cipher = crypto.createCipheriv('aes-256-gcm', this.encryptionKey, iv);
+        let encrypted = cipher.update(text, 'utf8', 'hex');
+        encrypted += cipher.final('hex');
+        const authTag = cipher.getAuthTag();
+        return iv.toString('hex') + ':' + authTag.toString('hex') + ':' + encrypted;
+    }
+    decrypt(encryptedData) {
+        const parts = encryptedData.split(':');
+        if (parts.length !== 3) {
+            throw new Error('Invalid encrypted data format');
+        }
+        const iv = Buffer.from(parts[0], 'hex');
+        const authTag = Buffer.from(parts[1], 'hex');
+        const encrypted = parts[2];
+        const decipher = crypto.createDecipheriv('aes-256-gcm', this.encryptionKey, iv);
+        decipher.setAuthTag(authTag);
+        let decrypted = decipher.update(encrypted, 'hex', 'utf8');
+        decrypted += decipher.final('utf8');
+        return decrypted;
+    }
+    async ensureDirectoryExists() {
+        const dir = path.dirname(this.tokenFilePath);
+        await fs.mkdir(dir, { recursive: true, mode: 0o700 });
+    }
+    async loadTokens() {
+        try {
+            const data = await fs.readFile(this.tokenFilePath, 'utf-8');
+            const decrypted = this.decrypt(data);
+            const tokens = JSON.parse(decrypted);
+            return new Map(Object.entries(tokens));
+        }
+        catch (error) {
+            const err = error;
+            if (err.code === 'ENOENT') {
+                return new Map();
+            }
+            if (err.message?.includes('Invalid encrypted data format') ||
+                err.message?.includes('Unsupported state or unable to authenticate data')) {
+                throw new Error('Token file corrupted');
+            }
+            throw error;
+        }
+    }
+    async saveTokens(tokens) {
+        await this.ensureDirectoryExists();
+        const data = Object.fromEntries(tokens);
+        const json = JSON.stringify(data, null, 2);
+        const encrypted = this.encrypt(json);
+        await fs.writeFile(this.tokenFilePath, encrypted, { mode: 0o600 });
+    }
+    async getCredentials(serverName) {
+        const tokens = await this.loadTokens();
+        const credentials = tokens.get(serverName);
+        if (!credentials) {
+            return null;
+        }
+        if (this.isTokenExpired(credentials)) {
+            return null;
+        }
+        return credentials;
+    }
+    async setCredentials(credentials) {
+        this.validateCredentials(credentials);
+        const tokens = await this.loadTokens();
+        const updatedCredentials = {
+            ...credentials,
+            updatedAt: Date.now(),
+        };
+        tokens.set(credentials.serverName, updatedCredentials);
+        await this.saveTokens(tokens);
+    }
+    async deleteCredentials(serverName) {
+        const tokens = await this.loadTokens();
+        if (!tokens.has(serverName)) {
+            throw new Error(`No credentials found for ${serverName}`);
+        }
+        tokens.delete(serverName);
+        if (tokens.size === 0) {
+            try {
+                await fs.unlink(this.tokenFilePath);
+            }
+            catch (error) {
+                const err = error;
+                if (err.code !== 'ENOENT') {
+                    throw error;
+                }
+            }
+        }
+        else {
+            await this.saveTokens(tokens);
+        }
+    }
+    async listServers() {
+        const tokens = await this.loadTokens();
+        return Array.from(tokens.keys());
+    }
+    async getAllCredentials() {
+        const tokens = await this.loadTokens();
+        const result = new Map();
+        for (const [serverName, credentials] of tokens) {
+            if (!this.isTokenExpired(credentials)) {
+                result.set(serverName, credentials);
+            }
+        }
+        return result;
+    }
+    async clearAll() {
+        try {
+            await fs.unlink(this.tokenFilePath);
+        }
+        catch (error) {
+            const err = error;
+            if (err.code !== 'ENOENT') {
+                throw error;
+            }
+        }
+    }
+}
+//# sourceMappingURL=file-token-storage.js.map

package/dist/src/mcp/token-storage/file-token-storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-token-storage.js","sourceRoot":"","sources":["../../../../src/mcp/token-storage/file-token-storage.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAE3D,MAAM,OAAO,gBAAiB,SAAQ,gBAAgB;IACnC,aAAa,CAAS;IACtB,aAAa,CAAS;IAEvC,YAAY,WAAmB;QAC7B,KAAK,CAAC,WAAW,CAAC,CAAC;QACnB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,CAAC;QACnD,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,0BAA0B,CAAC,CAAC;QACtE,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;IAClD,CAAC;IAEO,mBAAmB;QACzB,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,aAAa,CAAC;QACrE,OAAO,MAAM,CAAC,UAAU,CAAC,kBAAkB,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACzD,CAAC;IAEO,OAAO,CAAC,IAAY;QAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QAE5E,IAAI,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QACnD,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEjC,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAEpC,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,SAAS,CAAC;IAC9E,CAAC;IAEO,OAAO,CAAC,aAAqB;QACnC,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAE3B,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CACtC,aAAa,EACb,IAAI,CAAC,aAAa,EAClB,EAAE,CACH,CAAC;QACF,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAE7B,IAAI,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1D,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,KAAK,CAAC,qBAAqB;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC7C,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxD,CAAC;IAEO,KAAK,CAAC,UAAU;QACtB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;YAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACrC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAqC,CAAC;YACzE,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,KAAqD,CAAC;YAClE,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1B,OAAO,IAAI,GAAG,EAAE,CAAC;YACnB,CAAC;YACD,IACE,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,+BAA+B,CAAC;gBACtD,GAAG,CAAC,OAAO,EAAE,QAAQ,CACnB,kDAAkD,CACnD,EACD,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAC1C,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,MAAqC;QAErC,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAEnC,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAErC,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,UAAkB;QACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAE3C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,WAA6B;QAChD,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAEtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,MAAM,kBAAkB,GAAqB;YAC3C,GAAG,WAAW;YACd,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QAEF,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;QACvD,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,UAAkB;QACxC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QAEvC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,4BAA4B,UAAU,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAE1B,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YACtC,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACxB,MAAM,GAAG,GAAG,KAA8B,CAAC;gBAC3C,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC1B,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,iBAAiB;QACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,IAAI,GAAG,EAA4B,CAAC;QAEnD,KAAK,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,IAAI,MAAM,EAAE,CAAC;YAC/C,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;gBACtC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,KAA8B,CAAC;YAC3C,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1B,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/src/mcp/token-storage/hybrid-token-storage.d.ts

@@ -0,0 +1,23 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { BaseTokenStorage } from './base-token-storage.js';
+import type { OAuthCredentials } from './types.js';
+import { TokenStorageType } from './types.js';
+export declare class HybridTokenStorage extends BaseTokenStorage {
+    private storage;
+    private storageType;
+    private storageInitPromise;
+    constructor(serviceName: string);
+    private initializeStorage;
+    private getStorage;
+    getCredentials(serverName: string): Promise<OAuthCredentials | null>;
+    setCredentials(credentials: OAuthCredentials): Promise<void>;
+    deleteCredentials(serverName: string): Promise<void>;
+    listServers(): Promise<string[]>;
+    getAllCredentials(): Promise<Map<string, OAuthCredentials>>;
+    clearAll(): Promise<void>;
+    getStorageType(): Promise<TokenStorageType>;
+}

package/dist/src/mcp/token-storage/hybrid-token-storage.js

@@ -0,0 +1,78 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { BaseTokenStorage } from './base-token-storage.js';
+import { FileTokenStorage } from './file-token-storage.js';
+import { TokenStorageType } from './types.js';
+const FORCE_FILE_STORAGE_ENV_VAR = 'GEMINI_FORCE_FILE_STORAGE';
+export class HybridTokenStorage extends BaseTokenStorage {
+    storage = null;
+    storageType = null;
+    storageInitPromise = null;
+    constructor(serviceName) {
+        super(serviceName);
+    }
+    async initializeStorage() {
+        const forceFileStorage = process.env[FORCE_FILE_STORAGE_ENV_VAR] === 'true';
+        if (!forceFileStorage) {
+            try {
+                const { KeychainTokenStorage } = await import('./keychain-token-storage.js');
+                const keychainStorage = new KeychainTokenStorage(this.serviceName);
+                const isAvailable = await keychainStorage.isAvailable();
+                if (isAvailable) {
+                    this.storage = keychainStorage;
+                    this.storageType = TokenStorageType.KEYCHAIN;
+                    return this.storage;
+                }
+            }
+            catch (_e) {
+                // Fallback to file storage if keychain fails to initialize
+            }
+        }
+        this.storage = new FileTokenStorage(this.serviceName);
+        this.storageType = TokenStorageType.ENCRYPTED_FILE;
+        return this.storage;
+    }
+    async getStorage() {
+        if (this.storage !== null) {
+            return this.storage;
+        }
+        // Use a single initialization promise to avoid race conditions
+        if (!this.storageInitPromise) {
+            this.storageInitPromise = this.initializeStorage();
+        }
+        // Wait for initialization to complete
+        return this.storageInitPromise;
+    }
+    async getCredentials(serverName) {
+        const storage = await this.getStorage();
+        return storage.getCredentials(serverName);
+    }
+    async setCredentials(credentials) {
+        const storage = await this.getStorage();
+        await storage.setCredentials(credentials);
+    }
+    async deleteCredentials(serverName) {
+        const storage = await this.getStorage();
+        await storage.deleteCredentials(serverName);
+    }
+    async listServers() {
+        const storage = await this.getStorage();
+        return storage.listServers();
+    }
+    async getAllCredentials() {
+        const storage = await this.getStorage();
+        return storage.getAllCredentials();
+    }
+    async clearAll() {
+        const storage = await this.getStorage();
+        await storage.clearAll();
+    }
+    async getStorageType() {
+        await this.getStorage();
+        return this.storageType;
+    }
+}
+//# sourceMappingURL=hybrid-token-storage.js.map

package/dist/src/mcp/token-storage/hybrid-token-storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hybrid-token-storage.js","sourceRoot":"","sources":["../../../../src/mcp/token-storage/hybrid-token-storage.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C,MAAM,0BAA0B,GAAG,2BAA2B,CAAC;AAE/D,MAAM,OAAO,kBAAmB,SAAQ,gBAAgB;IAC9C,OAAO,GAAwB,IAAI,CAAC;IACpC,WAAW,GAA4B,IAAI,CAAC;IAC5C,kBAAkB,GAAiC,IAAI,CAAC;IAEhE,YAAY,WAAmB;QAC7B,KAAK,CAAC,WAAW,CAAC,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,iBAAiB;QAC7B,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,KAAK,MAAM,CAAC;QAE5E,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,IAAI,CAAC;gBACH,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAC3C,6BAA6B,CAC9B,CAAC;gBACF,MAAM,eAAe,GAAG,IAAI,oBAAoB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBAEnE,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,CAAC;gBACxD,IAAI,WAAW,EAAE,CAAC;oBAChB,IAAI,CAAC,OAAO,GAAG,eAAe,CAAC;oBAC/B,IAAI,CAAC,WAAW,GAAG,gBAAgB,CAAC,QAAQ,CAAC;oBAC7C,OAAO,IAAI,CAAC,OAAO,CAAC;gBACtB,CAAC;YACH,CAAC;YAAC,OAAO,EAAE,EAAE,CAAC;gBACZ,2DAA2D;YAC7D,CAAC;QACH,CAAC;QAED,IAAI,CAAC,OAAO,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACtD,IAAI,CAAC,WAAW,GAAG,gBAAgB,CAAC,cAAc,CAAC;QACnD,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAEO,KAAK,CAAC,UAAU;QACtB,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,OAAO,CAAC;QACtB,CAAC;QAED,+DAA+D;QAC/D,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC7B,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACrD,CAAC;QAED,sCAAsC;QACtC,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,UAAkB;QACrC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxC,OAAO,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,WAA6B;QAChD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxC,MAAM,OAAO,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,UAAkB;QACxC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxC,MAAM,OAAO,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxC,OAAO,OAAO,CAAC,WAAW,EAAE,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,iBAAiB;QACrB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxC,OAAO,OAAO,CAAC,iBAAiB,EAAE,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxC,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,WAAY,CAAC;IAC3B,CAAC;CACF"}

package/dist/src/mcp/token-storage/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export * from './types.js';
+export * from './base-token-storage.js';
+export * from './file-token-storage.js';
+export * from './hybrid-token-storage.js';
+export declare const DEFAULT_SERVICE_NAME = "gemini-cli-oauth";
+export declare const FORCE_ENCRYPTED_FILE_ENV_VAR = "GEMINI_FORCE_ENCRYPTED_FILE_STORAGE";

package/dist/src/mcp/token-storage/index.js

@@ -0,0 +1,12 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export * from './types.js';
+export * from './base-token-storage.js';
+export * from './file-token-storage.js';
+export * from './hybrid-token-storage.js';
+export const DEFAULT_SERVICE_NAME = 'gemini-cli-oauth';
+export const FORCE_ENCRYPTED_FILE_ENV_VAR = 'GEMINI_FORCE_ENCRYPTED_FILE_STORAGE';
+//# sourceMappingURL=index.js.map

package/dist/src/mcp/token-storage/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/mcp/token-storage/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,YAAY,CAAC;AAC3B,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC;AACxC,cAAc,2BAA2B,CAAC;AAE1C,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AACvD,MAAM,CAAC,MAAM,4BAA4B,GACvC,qCAAqC,CAAC"}

package/dist/src/mcp/token-storage/keychain-token-storage.d.ts

@@ -0,0 +1,35 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { BaseTokenStorage } from './base-token-storage.js';
+import type { OAuthCredentials, SecretStorage } from './types.js';
+interface Keytar {
+    getPassword(service: string, account: string): Promise<string | null>;
+    setPassword(service: string, account: string, password: string): Promise<void>;
+    deletePassword(service: string, account: string): Promise<boolean>;
+    findCredentials(service: string): Promise<Array<{
+        account: string;
+        password: string;
+    }>>;
+}
+export declare class KeychainTokenStorage extends BaseTokenStorage implements SecretStorage {
+    private keychainAvailable;
+    private keytarModule;
+    private keytarLoadAttempted;
+    getKeytar(): Promise<Keytar | null>;
+    getCredentials(serverName: string): Promise<OAuthCredentials | null>;
+    setCredentials(credentials: OAuthCredentials): Promise<void>;
+    deleteCredentials(serverName: string): Promise<void>;
+    listServers(): Promise<string[]>;
+    getAllCredentials(): Promise<Map<string, OAuthCredentials>>;
+    clearAll(): Promise<void>;
+    checkKeychainAvailability(): Promise<boolean>;
+    isAvailable(): Promise<boolean>;
+    setSecret(key: string, value: string): Promise<void>;
+    getSecret(key: string): Promise<string | null>;
+    deleteSecret(key: string): Promise<void>;
+    listSecrets(): Promise<string[]>;
+}
+export {};

package/dist/src/mcp/token-storage/keychain-token-storage.js

@@ -0,0 +1,246 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import * as crypto from 'node:crypto';
+import { BaseTokenStorage } from './base-token-storage.js';
+import { coreEvents } from '../../utils/events.js';
+const KEYCHAIN_TEST_PREFIX = '__keychain_test__';
+const SECRET_PREFIX = '__secret__';
+export class KeychainTokenStorage extends BaseTokenStorage {
+    keychainAvailable = null;
+    keytarModule = null;
+    keytarLoadAttempted = false;
+    async getKeytar() {
+        // If we've already tried loading (successfully or not), return the result
+        if (this.keytarLoadAttempted) {
+            return this.keytarModule;
+        }
+        this.keytarLoadAttempted = true;
+        try {
+            // Try to import keytar without any timeout - let the OS handle it
+            const moduleName = 'keytar';
+            const module = await import(moduleName);
+            this.keytarModule = module.default || module;
+        }
+        catch (_) {
+            //Keytar is optional so we shouldn't raise an error of log anything.
+        }
+        return this.keytarModule;
+    }
+    async getCredentials(serverName) {
+        if (!(await this.checkKeychainAvailability())) {
+            throw new Error('Keychain is not available');
+        }
+        const keytar = await this.getKeytar();
+        if (!keytar) {
+            throw new Error('Keytar module not available');
+        }
+        try {
+            const sanitizedName = this.sanitizeServerName(serverName);
+            const data = await keytar.getPassword(this.serviceName, sanitizedName);
+            if (!data) {
+                return null;
+            }
+            const credentials = JSON.parse(data);
+            if (this.isTokenExpired(credentials)) {
+                return null;
+            }
+            return credentials;
+        }
+        catch (error) {
+            if (error instanceof SyntaxError) {
+                throw new Error(`Failed to parse stored credentials for ${serverName}`);
+            }
+            throw error;
+        }
+    }
+    async setCredentials(credentials) {
+        if (!(await this.checkKeychainAvailability())) {
+            throw new Error('Keychain is not available');
+        }
+        const keytar = await this.getKeytar();
+        if (!keytar) {
+            throw new Error('Keytar module not available');
+        }
+        this.validateCredentials(credentials);
+        const sanitizedName = this.sanitizeServerName(credentials.serverName);
+        const updatedCredentials = {
+            ...credentials,
+            updatedAt: Date.now(),
+        };
+        const data = JSON.stringify(updatedCredentials);
+        await keytar.setPassword(this.serviceName, sanitizedName, data);
+    }
+    async deleteCredentials(serverName) {
+        if (!(await this.checkKeychainAvailability())) {
+            throw new Error('Keychain is not available');
+        }
+        const keytar = await this.getKeytar();
+        if (!keytar) {
+            throw new Error('Keytar module not available');
+        }
+        const sanitizedName = this.sanitizeServerName(serverName);
+        const deleted = await keytar.deletePassword(this.serviceName, sanitizedName);
+        if (!deleted) {
+            throw new Error(`No credentials found for ${serverName}`);
+        }
+    }
+    async listServers() {
+        if (!(await this.checkKeychainAvailability())) {
+            throw new Error('Keychain is not available');
+        }
+        const keytar = await this.getKeytar();
+        if (!keytar) {
+            throw new Error('Keytar module not available');
+        }
+        try {
+            const credentials = await keytar.findCredentials(this.serviceName);
+            return credentials
+                .filter((cred) => !cred.account.startsWith(KEYCHAIN_TEST_PREFIX) &&
+                !cred.account.startsWith(SECRET_PREFIX))
+                .map((cred) => cred.account);
+        }
+        catch (error) {
+            coreEvents.emitFeedback('error', 'Failed to list servers from keychain', error);
+            return [];
+        }
+    }
+    async getAllCredentials() {
+        if (!(await this.checkKeychainAvailability())) {
+            throw new Error('Keychain is not available');
+        }
+        const keytar = await this.getKeytar();
+        if (!keytar) {
+            throw new Error('Keytar module not available');
+        }
+        const result = new Map();
+        try {
+            const credentials = (await keytar.findCredentials(this.serviceName)).filter((c) => !c.account.startsWith(KEYCHAIN_TEST_PREFIX) &&
+                !c.account.startsWith(SECRET_PREFIX));
+            for (const cred of credentials) {
+                try {
+                    const data = JSON.parse(cred.password);
+                    if (!this.isTokenExpired(data)) {
+                        result.set(cred.account, data);
+                    }
+                }
+                catch (error) {
+                    coreEvents.emitFeedback('error', `Failed to parse credentials for ${cred.account}`, error);
+                }
+            }
+        }
+        catch (error) {
+            coreEvents.emitFeedback('error', 'Failed to get all credentials from keychain', error);
+        }
+        return result;
+    }
+    async clearAll() {
+        if (!(await this.checkKeychainAvailability())) {
+            throw new Error('Keychain is not available');
+        }
+        const servers = this.keytarModule
+            ? await this.keytarModule
+                .findCredentials(this.serviceName)
+                .then((creds) => creds.map((c) => c.account))
+                .catch((error) => {
+                throw new Error(`Failed to list servers for clearing: ${error.message}`);
+            })
+            : [];
+        const errors = [];
+        for (const server of servers) {
+            try {
+                await this.deleteCredentials(server);
+            }
+            catch (error) {
+                errors.push(error);
+            }
+        }
+        if (errors.length > 0) {
+            throw new Error(`Failed to clear some credentials: ${errors.map((e) => e.message).join(', ')}`);
+        }
+    }
+    // Checks whether or not a set-get-delete cycle with the keychain works.
+    // Returns false if any operation fails.
+    async checkKeychainAvailability() {
+        if (this.keychainAvailable !== null) {
+            return this.keychainAvailable;
+        }
+        try {
+            const keytar = await this.getKeytar();
+            if (!keytar) {
+                this.keychainAvailable = false;
+                return false;
+            }
+            const testAccount = `${KEYCHAIN_TEST_PREFIX}${crypto.randomBytes(8).toString('hex')}`;
+            const testPassword = 'test';
+            await keytar.setPassword(this.serviceName, testAccount, testPassword);
+            const retrieved = await keytar.getPassword(this.serviceName, testAccount);
+            const deleted = await keytar.deletePassword(this.serviceName, testAccount);
+            const success = deleted && retrieved === testPassword;
+            this.keychainAvailable = success;
+            return success;
+        }
+        catch (_error) {
+            this.keychainAvailable = false;
+            return false;
+        }
+    }
+    async isAvailable() {
+        return this.checkKeychainAvailability();
+    }
+    async setSecret(key, value) {
+        if (!(await this.checkKeychainAvailability())) {
+            throw new Error('Keychain is not available');
+        }
+        const keytar = await this.getKeytar();
+        if (!keytar) {
+            throw new Error('Keytar module not available');
+        }
+        await keytar.setPassword(this.serviceName, `${SECRET_PREFIX}${key}`, value);
+    }
+    async getSecret(key) {
+        if (!(await this.checkKeychainAvailability())) {
+            throw new Error('Keychain is not available');
+        }
+        const keytar = await this.getKeytar();
+        if (!keytar) {
+            throw new Error('Keytar module not available');
+        }
+        return keytar.getPassword(this.serviceName, `${SECRET_PREFIX}${key}`);
+    }
+    async deleteSecret(key) {
+        if (!(await this.checkKeychainAvailability())) {
+            throw new Error('Keychain is not available');
+        }
+        const keytar = await this.getKeytar();
+        if (!keytar) {
+            throw new Error('Keytar module not available');
+        }
+        const deleted = await keytar.deletePassword(this.serviceName, `${SECRET_PREFIX}${key}`);
+        if (!deleted) {
+            throw new Error(`No secret found for key: ${key}`);
+        }
+    }
+    async listSecrets() {
+        if (!(await this.checkKeychainAvailability())) {
+            throw new Error('Keychain is not available');
+        }
+        const keytar = await this.getKeytar();
+        if (!keytar) {
+            throw new Error('Keytar module not available');
+        }
+        try {
+            const credentials = await keytar.findCredentials(this.serviceName);
+            return credentials
+                .filter((cred) => cred.account.startsWith(SECRET_PREFIX))
+                .map((cred) => cred.account.substring(SECRET_PREFIX.length));
+        }
+        catch (error) {
+            coreEvents.emitFeedback('error', 'Failed to list secrets from keychain', error);
+            return [];
+        }
+    }
+}
+//# sourceMappingURL=keychain-token-storage.js.map

package/dist/src/mcp/token-storage/keychain-token-storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain-token-storage.js","sourceRoot":"","sources":["../../../../src/mcp/token-storage/keychain-token-storage.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAenD,MAAM,oBAAoB,GAAG,mBAAmB,CAAC;AACjD,MAAM,aAAa,GAAG,YAAY,CAAC;AAEnC,MAAM,OAAO,oBACX,SAAQ,gBAAgB;IAGhB,iBAAiB,GAAmB,IAAI,CAAC;IACzC,YAAY,GAAkB,IAAI,CAAC;IACnC,mBAAmB,GAAG,KAAK,CAAC;IAEpC,KAAK,CAAC,SAAS;QACb,0EAA0E;QAC1E,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,YAAY,CAAC;QAC3B,CAAC;QAED,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;QAEhC,IAAI,CAAC;YACH,kEAAkE;YAClE,MAAM,UAAU,GAAG,QAAQ,CAAC;YAC5B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;YACxC,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC;QAC/C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,oEAAoE;QACtE,CAAC;QACD,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,UAAkB;QACrC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,yBAAyB,EAAE,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QAED,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;YAC1D,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;YAEvE,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqB,CAAC;YAEzD,IAAI,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;gBACrC,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,WAAW,CAAC;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CAAC,0CAA0C,UAAU,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,WAA6B;QAChD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,yBAAyB,EAAE,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QAED,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAEtC,MAAM,aAAa,GAAG,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QACtE,MAAM,kBAAkB,GAAqB;YAC3C,GAAG,WAAW;YACd,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QAEF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAChD,MAAM,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,UAAkB;QACxC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,yBAAyB,EAAE,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,cAAc,CACzC,IAAI,CAAC,WAAW,EAChB,aAAa,CACd,CAAC;QAEF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,4BAA4B,UAAU,EAAE,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW;QACf,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,yBAAyB,EAAE,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QAED,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACnE,OAAO,WAAW;iBACf,MAAM,CACL,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC;gBAC9C,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAC1C;iBACA,GAAG,CAAC,CAAC,IAAyB,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,UAAU,CAAC,YAAY,CACrB,OAAO,EACP,sCAAsC,EACtC,KAAK,CACN,CAAC;YACF,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,iBAAiB;QACrB,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,yBAAyB,EAAE,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,GAAG,EAA4B,CAAC;QACnD,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,CAClB,MAAM,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,CAC/C,CAAC,MAAM,CACN,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC;gBAC3C,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CACvC,CAAC;YAEF,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;gBAC/B,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAqB,CAAC;oBAC3D,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC/B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;oBACjC,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,UAAU,CAAC,YAAY,CACrB,OAAO,EACP,mCAAmC,IAAI,CAAC,OAAO,EAAE,EACjD,KAAK,CACN,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,UAAU,CAAC,YAAY,CACrB,OAAO,EACP,6CAA6C,EAC7C,KAAK,CACN,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,yBAAyB,EAAE,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY;YAC/B,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY;iBACpB,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC;iBACjC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;iBAC5C,KAAK,CAAC,CAAC,KAAY,EAAE,EAAE;gBACtB,MAAM,IAAI,KAAK,CACb,wCAAwC,KAAK,CAAC,OAAO,EAAE,CACxD,CAAC;YACJ,CAAC,CAAC;YACN,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,MAAM,GAAY,EAAE,CAAC;QAE3B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;YACvC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,KAAc,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,qCAAqC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC/E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,wCAAwC;IACxC,KAAK,CAAC,yBAAyB;QAC7B,IAAI,IAAI,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC,iBAAiB,CAAC;QAChC,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC;gBAC/B,OAAO,KAAK,CAAC;YACf,CAAC;YAED,MAAM,WAAW,GAAG,GAAG,oBAAoB,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACtF,MAAM,YAAY,GAAG,MAAM,CAAC;YAE5B,MAAM,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;YACtE,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;YAC1E,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,cAAc,CACzC,IAAI,CAAC,WAAW,EAChB,WAAW,CACZ,CAAC;YAEF,MAAM,OAAO,GAAG,OAAO,IAAI,SAAS,KAAK,YAAY,CAAC;YACtD,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC;YACjC,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,MAAM,EAAE,CAAC;YAChB,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC;YAC/B,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW;QACf,OAAO,IAAI,CAAC,yBAAyB,EAAE,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAW,EAAE,KAAa;QACxC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,yBAAyB,EAAE,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,aAAa,GAAG,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC;IAC9E,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAW;QACzB,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,yBAAyB,EAAE,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,aAAa,GAAG,GAAG,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAW;QAC5B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,yBAAyB,EAAE,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,cAAc,CACzC,IAAI,CAAC,WAAW,EAChB,GAAG,aAAa,GAAG,GAAG,EAAE,CACzB,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,4BAA4B,GAAG,EAAE,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW;QACf,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,yBAAyB,EAAE,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACnE,OAAO,WAAW;iBACf,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;iBACxD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,UAAU,CAAC,YAAY,CACrB,OAAO,EACP,sCAAsC,EACtC,KAAK,CACN,CAAC;YACF,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;CACF"}

package/dist/src/mcp/token-storage/types.d.ts

@@ -0,0 +1,44 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * Interface for OAuth tokens.
+ */
+export interface OAuthToken {
+    accessToken: string;
+    refreshToken?: string;
+    expiresAt?: number;
+    tokenType: string;
+    scope?: string;
+}
+/**
+ * Interface for stored OAuth credentials.
+ */
+export interface OAuthCredentials {
+    serverName: string;
+    token: OAuthToken;
+    clientId?: string;
+    tokenUrl?: string;
+    mcpServerUrl?: string;
+    updatedAt: number;
+}
+export interface TokenStorage {
+    getCredentials(serverName: string): Promise<OAuthCredentials | null>;
+    setCredentials(credentials: OAuthCredentials): Promise<void>;
+    deleteCredentials(serverName: string): Promise<void>;
+    listServers(): Promise<string[]>;
+    getAllCredentials(): Promise<Map<string, OAuthCredentials>>;
+    clearAll(): Promise<void>;
+}
+export interface SecretStorage {
+    setSecret(key: string, value: string): Promise<void>;
+    getSecret(key: string): Promise<string | null>;
+    deleteSecret(key: string): Promise<void>;
+    listSecrets(): Promise<string[]>;
+}
+export declare enum TokenStorageType {
+    KEYCHAIN = "keychain",
+    ENCRYPTED_FILE = "encrypted_file"
+}

package/dist/src/mcp/token-storage/types.js

@@ -0,0 +1,11 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export var TokenStorageType;
+(function (TokenStorageType) {
+    TokenStorageType["KEYCHAIN"] = "keychain";
+    TokenStorageType["ENCRYPTED_FILE"] = "encrypted_file";
+})(TokenStorageType || (TokenStorageType = {}));
+//# sourceMappingURL=types.js.map

package/dist/src/mcp/token-storage/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/mcp/token-storage/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAyCH,MAAM,CAAN,IAAY,gBAGX;AAHD,WAAY,gBAAgB;IAC1B,yCAAqB,CAAA;IACrB,qDAAiC,CAAA;AACnC,CAAC,EAHW,gBAAgB,KAAhB,gBAAgB,QAG3B"}

package/dist/src/mocks/msw.d.ts

@@ -0,0 +1,6 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export declare const server: import("msw/node").SetupServerApi;