@hibanacloud/core 0.3.15

package/dist/src/mcp/sa-impersonation-provider.js

@@ -0,0 +1,130 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { GoogleAuth } from 'google-auth-library';
+const fiveMinBufferMs = 5 * 60 * 1000;
+function createIamApiUrl(targetSA) {
+    return `https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/${encodeURIComponent(targetSA)}:generateIdToken`;
+}
+export class ServiceAccountImpersonationProvider {
+    config;
+    targetServiceAccount;
+    targetAudience; // OAuth Client Id
+    auth;
+    cachedToken;
+    tokenExpiryTime;
+    // Properties required by OAuthClientProvider, with no-op values
+    redirectUrl = '';
+    clientMetadata = {
+        client_name: 'Gemini CLI (Service Account Impersonation)',
+        redirect_uris: [],
+        grant_types: [],
+        response_types: [],
+        token_endpoint_auth_method: 'none',
+    };
+    _clientInformation;
+    constructor(config) {
+        this.config = config;
+        // This check is done in mcp-client.ts. This is just an additional check.
+        if (!this.config.httpUrl && !this.config.url) {
+            throw new Error('A url or httpUrl must be provided for the Service Account Impersonation provider');
+        }
+        if (!config.targetAudience) {
+            throw new Error('targetAudience must be provided for the Service Account Impersonation provider');
+        }
+        this.targetAudience = config.targetAudience;
+        if (!config.targetServiceAccount) {
+            throw new Error('targetServiceAccount must be provided for the Service Account Impersonation provider');
+        }
+        this.targetServiceAccount = config.targetServiceAccount;
+        this.auth = new GoogleAuth();
+    }
+    clientInformation() {
+        return this._clientInformation;
+    }
+    saveClientInformation(clientInformation) {
+        this._clientInformation = clientInformation;
+    }
+    async tokens() {
+        // 1. Check if we have a valid, non-expired cached token.
+        if (this.cachedToken &&
+            this.tokenExpiryTime &&
+            Date.now() < this.tokenExpiryTime - fiveMinBufferMs) {
+            return this.cachedToken;
+        }
+        // 2. Clear any invalid/expired cache.
+        this.cachedToken = undefined;
+        this.tokenExpiryTime = undefined;
+        // 3. Fetch a new ID token.
+        const client = await this.auth.getClient();
+        const url = createIamApiUrl(this.targetServiceAccount);
+        let idToken;
+        try {
+            const res = await client.request({
+                url,
+                method: 'POST',
+                data: {
+                    audience: this.targetAudience,
+                    includeEmail: true,
+                },
+            });
+            idToken = res.data.token;
+            if (!idToken || idToken.length === 0) {
+                console.error('Failed to get ID token from Google');
+                return undefined;
+            }
+        }
+        catch (e) {
+            console.error('Failed to fetch ID token from Google:', e);
+            return undefined;
+        }
+        const expiryTime = this.parseTokenExpiry(idToken);
+        // Note: We are placing the OIDC ID Token into the `access_token` field.
+        // This is because the CLI uses this field to construct the
+        // `Authorization: Bearer <token>` header, which is the correct way to
+        // present an ID token.
+        const newTokens = {
+            access_token: idToken,
+            token_type: 'Bearer',
+        };
+        if (expiryTime) {
+            this.tokenExpiryTime = expiryTime;
+            this.cachedToken = newTokens;
+        }
+        return newTokens;
+    }
+    saveTokens(_tokens) {
+        // No-op
+    }
+    redirectToAuthorization(_authorizationUrl) {
+        // No-op
+    }
+    saveCodeVerifier(_codeVerifier) {
+        // No-op
+    }
+    codeVerifier() {
+        // No-op
+        return '';
+    }
+    /**
+     * Parses a JWT string to extract its expiry time.
+     * @param idToken The JWT ID token.
+     * @returns The expiry time in **milliseconds**, or undefined if parsing fails.
+     */
+    parseTokenExpiry(idToken) {
+        try {
+            const payload = JSON.parse(Buffer.from(idToken.split('.')[1], 'base64').toString());
+            if (payload && typeof payload.exp === 'number') {
+                return payload.exp * 1000; // Convert seconds to milliseconds
+            }
+        }
+        catch (e) {
+            console.error('Failed to parse ID token for expiry time with error:', e);
+        }
+        // Return undefined if try block fails or 'exp' is missing/invalid
+        return undefined;
+    }
+}
+//# sourceMappingURL=sa-impersonation-provider.js.map

package/dist/src/mcp/sa-impersonation-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sa-impersonation-provider.js","sourceRoot":"","sources":["../../../src/mcp/sa-impersonation-provider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAIjD,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEtC,SAAS,eAAe,CAAC,QAAgB;IACvC,OAAO,uEAAuE,kBAAkB,CAAC,QAAQ,CAAC,kBAAkB,CAAC;AAC/H,CAAC;AAED,MAAM,OAAO,mCAAmC;IAoBjB;IAjBZ,oBAAoB,CAAS;IAC7B,cAAc,CAAS,CAAC,kBAAkB;IAC1C,IAAI,CAAa;IAC1B,WAAW,CAAe;IAC1B,eAAe,CAAU;IAEjC,gEAAgE;IACvD,WAAW,GAAG,EAAE,CAAC;IACjB,cAAc,GAAwB;QAC7C,WAAW,EAAE,4CAA4C;QACzD,aAAa,EAAE,EAAE;QACjB,WAAW,EAAE,EAAE;QACf,cAAc,EAAE,EAAE;QAClB,0BAA0B,EAAE,MAAM;KACnC,CAAC;IACM,kBAAkB,CAA8B;IAExD,YAA6B,MAAuB;QAAvB,WAAM,GAAN,MAAM,CAAiB;QAClD,yEAAyE;QACzE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CACb,kFAAkF,CACnF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,gFAAgF,CACjF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QAE5C,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,sFAAsF,CACvF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,oBAAoB,GAAG,MAAM,CAAC,oBAAoB,CAAC;QAExD,IAAI,CAAC,IAAI,GAAG,IAAI,UAAU,EAAE,CAAC;IAC/B,CAAC;IAED,iBAAiB;QACf,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;IAED,qBAAqB,CAAC,iBAA6C;QACjE,IAAI,CAAC,kBAAkB,GAAG,iBAAiB,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,MAAM;QACV,yDAAyD;QACzD,IACE,IAAI,CAAC,WAAW;YAChB,IAAI,CAAC,eAAe;YACpB,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,eAAe,GAAG,eAAe,EACnD,CAAC;YACD,OAAO,IAAI,CAAC,WAAW,CAAC;QAC1B,CAAC;QAED,sCAAsC;QACtC,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;QAC7B,IAAI,CAAC,eAAe,GAAG,SAAS,CAAC;QAEjC,2BAA2B;QAC3B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAEvD,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAoB;gBAClD,GAAG;gBACH,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE;oBACJ,QAAQ,EAAE,IAAI,CAAC,cAAc;oBAC7B,YAAY,EAAE,IAAI;iBACnB;aACF,CAAC,CAAC;YACH,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;YAEzB,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACrC,OAAO,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;gBACpD,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;YAC1D,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAClD,wEAAwE;QACxE,2DAA2D;QAC3D,sEAAsE;QACtE,uBAAuB;QACvB,MAAM,SAAS,GAAgB;YAC7B,YAAY,EAAE,OAAO;YACrB,UAAU,EAAE,QAAQ;SACrB,CAAC;QAEF,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC;YAClC,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;QAC/B,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,UAAU,CAAC,OAAoB;QAC7B,QAAQ;IACV,CAAC;IAED,uBAAuB,CAAC,iBAAsB;QAC5C,QAAQ;IACV,CAAC;IAED,gBAAgB,CAAC,aAAqB;QACpC,QAAQ;IACV,CAAC;IAED,YAAY;QACV,QAAQ;QACR,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;;;OAIG;IACK,gBAAgB,CAAC,OAAe;QACtC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CACxD,CAAC;YAEF,IAAI,OAAO,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC/C,OAAO,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,kCAAkC;YAC/D,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,sDAAsD,EAAE,CAAC,CAAC,CAAC;QAC3E,CAAC;QAED,kEAAkE;QAClE,OAAO,SAAS,CAAC;IACnB,CAAC;CACF"}

package/dist/src/mcp/sa-impersonation-provider.test.d.ts

@@ -0,0 +1,6 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export {};

package/dist/src/mcp/sa-impersonation-provider.test.js

@@ -0,0 +1,117 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { ServiceAccountImpersonationProvider } from './sa-impersonation-provider.js';
+const mockRequest = vi.fn();
+const mockGetClient = vi.fn(() => ({
+    request: mockRequest,
+}));
+// Mock the google-auth-library to use a shared mock function
+vi.mock('google-auth-library', async (importOriginal) => {
+    const actual = await importOriginal();
+    return {
+        ...actual,
+        GoogleAuth: vi.fn().mockImplementation(() => ({
+            getClient: mockGetClient,
+        })),
+    };
+});
+const defaultSAConfig = {
+    url: 'https://my-iap-service.run.app',
+    targetAudience: 'my-audience',
+    targetServiceAccount: 'my-sa',
+};
+describe('ServiceAccountImpersonationProvider', () => {
+    beforeEach(() => {
+        // Reset mocks before each test
+        vi.clearAllMocks();
+    });
+    it('should throw an error if no URL is provided', () => {
+        const config = {};
+        expect(() => new ServiceAccountImpersonationProvider(config)).toThrow('A url or httpUrl must be provided for the Service Account Impersonation provider');
+    });
+    it('should throw an error if no targetAudience is provided', () => {
+        const config = {
+            url: 'https://my-iap-service.run.app',
+        };
+        expect(() => new ServiceAccountImpersonationProvider(config)).toThrow('targetAudience must be provided for the Service Account Impersonation provider');
+    });
+    it('should throw an error if no targetSA is provided', () => {
+        const config = {
+            url: 'https://my-iap-service.run.app',
+            targetAudience: 'my-audience',
+        };
+        expect(() => new ServiceAccountImpersonationProvider(config)).toThrow('targetServiceAccount must be provided for the Service Account Impersonation provider');
+    });
+    it('should correctly get tokens for a valid config', async () => {
+        const mockToken = 'mock-id-token-123';
+        mockRequest.mockResolvedValue({ data: { token: mockToken } });
+        const provider = new ServiceAccountImpersonationProvider(defaultSAConfig);
+        const tokens = await provider.tokens();
+        expect(tokens).toBeDefined();
+        expect(tokens?.access_token).toBe(mockToken);
+        expect(tokens?.token_type).toBe('Bearer');
+    });
+    it('should return undefined if token acquisition fails', async () => {
+        mockRequest.mockResolvedValue({ data: { token: null } });
+        const provider = new ServiceAccountImpersonationProvider(defaultSAConfig);
+        const tokens = await provider.tokens();
+        expect(tokens).toBeUndefined();
+    });
+    it('should make a request with the correct parameters', async () => {
+        mockRequest.mockResolvedValue({ data: { token: 'test-token' } });
+        const provider = new ServiceAccountImpersonationProvider(defaultSAConfig);
+        await provider.tokens();
+        expect(mockRequest).toHaveBeenCalledWith({
+            url: 'https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/my-sa:generateIdToken',
+            method: 'POST',
+            data: {
+                audience: 'my-audience',
+                includeEmail: true,
+            },
+        });
+    });
+    it('should return a cached token if it is not expired', async () => {
+        const provider = new ServiceAccountImpersonationProvider(defaultSAConfig);
+        vi.useFakeTimers();
+        // jwt payload with exp set to 1 hour from now
+        const payload = { exp: Math.floor(Date.now() / 1000) + 3600 };
+        const jwt = `header.${Buffer.from(JSON.stringify(payload)).toString('base64')}.signature`;
+        mockRequest.mockResolvedValue({ data: { token: jwt } });
+        const firstTokens = await provider.tokens();
+        expect(firstTokens?.access_token).toBe(jwt);
+        expect(mockRequest).toHaveBeenCalledTimes(1);
+        // Advance time by 30 minutes
+        vi.advanceTimersByTime(1800 * 1000);
+        // Seturn cached token
+        const secondTokens = await provider.tokens();
+        expect(secondTokens).toBe(firstTokens);
+        expect(mockRequest).toHaveBeenCalledTimes(1);
+        vi.useRealTimers();
+    });
+    it('should fetch a new token if the cached token is expired (using fake timers)', async () => {
+        const provider = new ServiceAccountImpersonationProvider(defaultSAConfig);
+        vi.useFakeTimers();
+        // Get and cache a token that expires in 1 second
+        const expiredPayload = { exp: Math.floor(Date.now() / 1000) + 1 };
+        const expiredJwt = `header.${Buffer.from(JSON.stringify(expiredPayload)).toString('base64')}.signature`;
+        mockRequest.mockResolvedValue({ data: { token: expiredJwt } });
+        const firstTokens = await provider.tokens();
+        expect(firstTokens?.access_token).toBe(expiredJwt);
+        expect(mockRequest).toHaveBeenCalledTimes(1);
+        // Prepare the mock for the *next* call
+        const newPayload = { exp: Math.floor(Date.now() / 1000) + 3600 };
+        const newJwt = `header.${Buffer.from(JSON.stringify(newPayload)).toString('base64')}.signature`;
+        mockRequest.mockResolvedValue({ data: { token: newJwt } });
+        vi.advanceTimersByTime(1001);
+        const newTokens = await provider.tokens();
+        expect(newTokens?.access_token).toBe(newJwt);
+        expect(newTokens?.access_token).not.toBe(expiredJwt);
+        expect(mockRequest).toHaveBeenCalledTimes(2); // Confirms a new fetch
+        vi.useRealTimers();
+    });
+});
+//# sourceMappingURL=sa-impersonation-provider.test.js.map

package/dist/src/mcp/sa-impersonation-provider.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sa-impersonation-provider.test.js","sourceRoot":"","sources":["../../../src/mcp/sa-impersonation-provider.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC9D,OAAO,EAAE,mCAAmC,EAAE,MAAM,gCAAgC,CAAC;AAGrF,MAAM,WAAW,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AAC5B,MAAM,aAAa,GAAG,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;IACjC,OAAO,EAAE,WAAW;CACrB,CAAC,CAAC,CAAC;AAEJ,6DAA6D;AAC7D,EAAE,CAAC,IAAI,CAAC,qBAAqB,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IACtD,MAAM,MAAM,GAAG,MAAM,cAAc,EAAwC,CAAC;IAC5E,OAAO;QACL,GAAG,MAAM;QACT,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC,CAAC;YAC5C,SAAS,EAAE,aAAa;SACzB,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,MAAM,eAAe,GAAoB;IACvC,GAAG,EAAE,gCAAgC;IACrC,cAAc,EAAE,aAAa;IAC7B,oBAAoB,EAAE,OAAO;CAC9B,CAAC;AAEF,QAAQ,CAAC,qCAAqC,EAAE,GAAG,EAAE;IACnD,UAAU,CAAC,GAAG,EAAE;QACd,+BAA+B;QAC/B,EAAE,CAAC,aAAa,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,MAAM,GAAoB,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,mCAAmC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CACnE,kFAAkF,CACnF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,MAAM,GAAoB;YAC9B,GAAG,EAAE,gCAAgC;SACtC,CAAC;QACF,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,mCAAmC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CACnE,gFAAgF,CACjF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,MAAM,GAAoB;YAC9B,GAAG,EAAE,gCAAgC;YACrC,cAAc,EAAE,aAAa;SAC9B,CAAC;QACF,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,mCAAmC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CACnE,sFAAsF,CACvF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,SAAS,GAAG,mBAAmB,CAAC;QACtC,WAAW,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QAE9D,MAAM,QAAQ,GAAG,IAAI,mCAAmC,CAAC,eAAe,CAAC,CAAC;QAC1E,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC;QAEvC,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QAC7B,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,WAAW,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAEzD,MAAM,QAAQ,GAAG,IAAI,mCAAmC,CAAC,eAAe,CAAC,CAAC;QAC1E,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC;QAEvC,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,WAAW,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;QAEjE,MAAM,QAAQ,GAAG,IAAI,mCAAmC,CAAC,eAAe,CAAC,CAAC;QAC1E,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC;QAExB,MAAM,CAAC,WAAW,CAAC,CAAC,oBAAoB,CAAC;YACvC,GAAG,EAAE,2FAA2F;YAChG,MAAM,EAAE,MAAM;YACd,IAAI,EAAE;gBACJ,QAAQ,EAAE,aAAa;gBACvB,YAAY,EAAE,IAAI;aACnB;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,QAAQ,GAAG,IAAI,mCAAmC,CAAC,eAAe,CAAC,CAAC;QAC1E,EAAE,CAAC,aAAa,EAAE,CAAC;QAEnB,8CAA8C;QAC9C,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC;QAC9D,MAAM,GAAG,GAAG,UAAU,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC1F,WAAW,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAExD,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC5C,MAAM,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5C,MAAM,CAAC,WAAW,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAE7C,6BAA6B;QAC7B,EAAE,CAAC,mBAAmB,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;QAEpC,sBAAsB;QACtB,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC7C,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACvC,MAAM,CAAC,WAAW,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAE7C,EAAE,CAAC,aAAa,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,MAAM,QAAQ,GAAG,IAAI,mCAAmC,CAAC,eAAe,CAAC,CAAC;QAC1E,EAAE,CAAC,aAAa,EAAE,CAAC;QAEnB,iDAAiD;QACjD,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,UAAU,GAAG,UAAU,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;QAExG,WAAW,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;QAC/D,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC5C,MAAM,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACnD,MAAM,CAAC,WAAW,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAE7C,uCAAuC;QACvC,MAAM,UAAU,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC;QACjE,MAAM,MAAM,GAAG,UAAU,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;QAChG,WAAW,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAE3D,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAE7B,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC1C,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACrD,MAAM,CAAC,WAAW,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,uBAAuB;QAErE,EAAE,CAAC,aAAa,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/src/mcp/token-storage/base-token-storage.d.ts

@@ -0,0 +1,19 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { TokenStorage, OAuthCredentials } from './types.js';
+export declare abstract class BaseTokenStorage implements TokenStorage {
+    protected readonly serviceName: string;
+    constructor(serviceName: string);
+    abstract getCredentials(serverName: string): Promise<OAuthCredentials | null>;
+    abstract setCredentials(credentials: OAuthCredentials): Promise<void>;
+    abstract deleteCredentials(serverName: string): Promise<void>;
+    abstract listServers(): Promise<string[]>;
+    abstract getAllCredentials(): Promise<Map<string, OAuthCredentials>>;
+    abstract clearAll(): Promise<void>;
+    protected validateCredentials(credentials: OAuthCredentials): void;
+    protected isTokenExpired(credentials: OAuthCredentials): boolean;
+    protected sanitizeServerName(serverName: string): string;
+}

package/dist/src/mcp/token-storage/base-token-storage.js

@@ -0,0 +1,36 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export class BaseTokenStorage {
+    serviceName;
+    constructor(serviceName) {
+        this.serviceName = serviceName;
+    }
+    validateCredentials(credentials) {
+        if (!credentials.serverName) {
+            throw new Error('Server name is required');
+        }
+        if (!credentials.token) {
+            throw new Error('Token is required');
+        }
+        if (!credentials.token.accessToken) {
+            throw new Error('Access token is required');
+        }
+        if (!credentials.token.tokenType) {
+            throw new Error('Token type is required');
+        }
+    }
+    isTokenExpired(credentials) {
+        if (!credentials.token.expiresAt) {
+            return false;
+        }
+        const bufferMs = 5 * 60 * 1000;
+        return Date.now() > credentials.token.expiresAt - bufferMs;
+    }
+    sanitizeServerName(serverName) {
+        return serverName.replace(/[^a-zA-Z0-9-_.]/g, '_');
+    }
+}
+//# sourceMappingURL=base-token-storage.js.map

package/dist/src/mcp/token-storage/base-token-storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base-token-storage.js","sourceRoot":"","sources":["../../../../src/mcp/token-storage/base-token-storage.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,OAAgB,gBAAgB;IACjB,WAAW,CAAS;IAEvC,YAAY,WAAmB;QAC7B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;IASS,mBAAmB,CAAC,WAA6B;QACzD,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAES,cAAc,CAAC,WAA6B;QACpD,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YACjC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,QAAQ,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAC/B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,SAAS,GAAG,QAAQ,CAAC;IAC7D,CAAC;IAES,kBAAkB,CAAC,UAAkB;QAC7C,OAAO,UAAU,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;IACrD,CAAC;CACF"}

package/dist/src/mcp/token-storage/base-token-storage.test.d.ts

@@ -0,0 +1,6 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export {};

package/dist/src/mcp/token-storage/base-token-storage.test.js

@@ -0,0 +1,160 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { describe, it, expect, beforeEach } from 'vitest';
+import { BaseTokenStorage } from './base-token-storage.js';
+class TestTokenStorage extends BaseTokenStorage {
+    storage = new Map();
+    async getCredentials(serverName) {
+        return this.storage.get(serverName) || null;
+    }
+    async setCredentials(credentials) {
+        this.validateCredentials(credentials);
+        this.storage.set(credentials.serverName, credentials);
+    }
+    async deleteCredentials(serverName) {
+        this.storage.delete(serverName);
+    }
+    async listServers() {
+        return Array.from(this.storage.keys());
+    }
+    async getAllCredentials() {
+        return new Map(this.storage);
+    }
+    async clearAll() {
+        this.storage.clear();
+    }
+    validateCredentials(credentials) {
+        super.validateCredentials(credentials);
+    }
+    isTokenExpired(credentials) {
+        return super.isTokenExpired(credentials);
+    }
+    sanitizeServerName(serverName) {
+        return super.sanitizeServerName(serverName);
+    }
+}
+describe('BaseTokenStorage', () => {
+    let storage;
+    beforeEach(() => {
+        storage = new TestTokenStorage('gemini-cli-mcp-oauth');
+    });
+    describe('validateCredentials', () => {
+        it('should validate valid credentials', () => {
+            const credentials = {
+                serverName: 'test-server',
+                token: {
+                    accessToken: 'access-token',
+                    tokenType: 'Bearer',
+                },
+                updatedAt: Date.now(),
+            };
+            expect(() => storage.validateCredentials(credentials)).not.toThrow();
+        });
+        it('should throw for missing server name', () => {
+            const credentials = {
+                serverName: '',
+                token: {
+                    accessToken: 'access-token',
+                    tokenType: 'Bearer',
+                },
+                updatedAt: Date.now(),
+            };
+            expect(() => storage.validateCredentials(credentials)).toThrow('Server name is required');
+        });
+        it('should throw for missing token', () => {
+            const credentials = {
+                serverName: 'test-server',
+                token: null,
+                updatedAt: Date.now(),
+            };
+            expect(() => storage.validateCredentials(credentials)).toThrow('Token is required');
+        });
+        it('should throw for missing access token', () => {
+            const credentials = {
+                serverName: 'test-server',
+                token: {
+                    accessToken: '',
+                    tokenType: 'Bearer',
+                },
+                updatedAt: Date.now(),
+            };
+            expect(() => storage.validateCredentials(credentials)).toThrow('Access token is required');
+        });
+        it('should throw for missing token type', () => {
+            const credentials = {
+                serverName: 'test-server',
+                token: {
+                    accessToken: 'access-token',
+                    tokenType: '',
+                },
+                updatedAt: Date.now(),
+            };
+            expect(() => storage.validateCredentials(credentials)).toThrow('Token type is required');
+        });
+    });
+    describe('isTokenExpired', () => {
+        it('should return false for tokens without expiry', () => {
+            const credentials = {
+                serverName: 'test-server',
+                token: {
+                    accessToken: 'access-token',
+                    tokenType: 'Bearer',
+                },
+                updatedAt: Date.now(),
+            };
+            expect(storage.isTokenExpired(credentials)).toBe(false);
+        });
+        it('should return false for valid tokens', () => {
+            const credentials = {
+                serverName: 'test-server',
+                token: {
+                    accessToken: 'access-token',
+                    tokenType: 'Bearer',
+                    expiresAt: Date.now() + 3600000,
+                },
+                updatedAt: Date.now(),
+            };
+            expect(storage.isTokenExpired(credentials)).toBe(false);
+        });
+        it('should return true for expired tokens', () => {
+            const credentials = {
+                serverName: 'test-server',
+                token: {
+                    accessToken: 'access-token',
+                    tokenType: 'Bearer',
+                    expiresAt: Date.now() - 3600000,
+                },
+                updatedAt: Date.now(),
+            };
+            expect(storage.isTokenExpired(credentials)).toBe(true);
+        });
+        it('should apply 5-minute buffer for expiry check', () => {
+            const fourMinutesFromNow = Date.now() + 4 * 60 * 1000;
+            const credentials = {
+                serverName: 'test-server',
+                token: {
+                    accessToken: 'access-token',
+                    tokenType: 'Bearer',
+                    expiresAt: fourMinutesFromNow,
+                },
+                updatedAt: Date.now(),
+            };
+            expect(storage.isTokenExpired(credentials)).toBe(true);
+        });
+    });
+    describe('sanitizeServerName', () => {
+        it('should keep valid characters', () => {
+            expect(storage.sanitizeServerName('test-server.example_123')).toBe('test-server.example_123');
+        });
+        it('should replace invalid characters with underscore', () => {
+            expect(storage.sanitizeServerName('test@server#example')).toBe('test_server_example');
+        });
+        it('should handle special characters', () => {
+            expect(storage.sanitizeServerName('test server/example:123')).toBe('test_server_example_123');
+        });
+    });
+});
+//# sourceMappingURL=base-token-storage.test.js.map

package/dist/src/mcp/token-storage/base-token-storage.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base-token-storage.test.js","sourceRoot":"","sources":["../../../../src/mcp/token-storage/base-token-storage.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAG3D,MAAM,gBAAiB,SAAQ,gBAAgB;IACrC,OAAO,GAAG,IAAI,GAAG,EAA4B,CAAC;IAEtD,KAAK,CAAC,cAAc,CAAC,UAAkB;QACrC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,WAA6B;QAChD,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,UAAkB;QACxC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,WAAW;QACf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,iBAAiB;QACrB,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAEQ,mBAAmB,CAAC,WAA6B;QACxD,KAAK,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;IACzC,CAAC;IAEQ,cAAc,CAAC,WAA6B;QACnD,OAAO,KAAK,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;IAC3C,CAAC;IAEQ,kBAAkB,CAAC,UAAkB;QAC5C,OAAO,KAAK,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAC9C,CAAC;CACF;AAED,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,IAAI,OAAyB,CAAC;IAE9B,UAAU,CAAC,GAAG,EAAE;QACd,OAAO,GAAG,IAAI,gBAAgB,CAAC,sBAAsB,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;QACnC,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;YAC3C,MAAM,WAAW,GAAqB;gBACpC,UAAU,EAAE,aAAa;gBACzB,KAAK,EAAE;oBACL,WAAW,EAAE,cAAc;oBAC3B,SAAS,EAAE,QAAQ;iBACpB;gBACD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACtB,CAAC;YAEF,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACvE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;YAC9C,MAAM,WAAW,GAAG;gBAClB,UAAU,EAAE,EAAE;gBACd,KAAK,EAAE;oBACL,WAAW,EAAE,cAAc;oBAC3B,SAAS,EAAE,QAAQ;iBACpB;gBACD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACF,CAAC;YAEtB,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAC5D,yBAAyB,CAC1B,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;YACxC,MAAM,WAAW,GAAG;gBAClB,UAAU,EAAE,aAAa;gBACzB,KAAK,EAAE,IAA6B;gBACpC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACF,CAAC;YAEtB,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAC5D,mBAAmB,CACpB,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;YAC/C,MAAM,WAAW,GAAG;gBAClB,UAAU,EAAE,aAAa;gBACzB,KAAK,EAAE;oBACL,WAAW,EAAE,EAAE;oBACf,SAAS,EAAE,QAAQ;iBACpB;gBACD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACF,CAAC;YAEtB,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAC5D,0BAA0B,CAC3B,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;YAC7C,MAAM,WAAW,GAAG;gBAClB,UAAU,EAAE,aAAa;gBACzB,KAAK,EAAE;oBACL,WAAW,EAAE,cAAc;oBAC3B,SAAS,EAAE,EAAE;iBACd;gBACD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACF,CAAC;YAEtB,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAC5D,wBAAwB,CACzB,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;QAC9B,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;YACvD,MAAM,WAAW,GAAqB;gBACpC,UAAU,EAAE,aAAa;gBACzB,KAAK,EAAE;oBACL,WAAW,EAAE,cAAc;oBAC3B,SAAS,EAAE,QAAQ;iBACpB;gBACD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACtB,CAAC;YAEF,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;YAC9C,MAAM,WAAW,GAAqB;gBACpC,UAAU,EAAE,aAAa;gBACzB,KAAK,EAAE;oBACL,WAAW,EAAE,cAAc;oBAC3B,SAAS,EAAE,QAAQ;oBACnB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;iBAChC;gBACD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACtB,CAAC;YAEF,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;YAC/C,MAAM,WAAW,GAAqB;gBACpC,UAAU,EAAE,aAAa;gBACzB,KAAK,EAAE;oBACL,WAAW,EAAE,cAAc;oBAC3B,SAAS,EAAE,QAAQ;oBACnB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;iBAChC;gBACD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACtB,CAAC;YAEF,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;YACvD,MAAM,kBAAkB,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YACtD,MAAM,WAAW,GAAqB;gBACpC,UAAU,EAAE,aAAa;gBACzB,KAAK,EAAE;oBACL,WAAW,EAAE,cAAc;oBAC3B,SAAS,EAAE,QAAQ;oBACnB,SAAS,EAAE,kBAAkB;iBAC9B;gBACD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACtB,CAAC;YAEF,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;QAClC,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;YACtC,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAChE,yBAAyB,CAC1B,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;YAC3D,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAC5D,qBAAqB,CACtB,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;YAC1C,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAChE,yBAAyB,CAC1B,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/src/mcp/token-storage/file-token-storage.d.ts

@@ -0,0 +1,24 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { BaseTokenStorage } from './base-token-storage.js';
+import type { OAuthCredentials } from './types.js';
+export declare class FileTokenStorage extends BaseTokenStorage {
+    private readonly tokenFilePath;
+    private readonly encryptionKey;
+    constructor(serviceName: string);
+    private deriveEncryptionKey;
+    private encrypt;
+    private decrypt;
+    private ensureDirectoryExists;
+    private loadTokens;
+    private saveTokens;
+    getCredentials(serverName: string): Promise<OAuthCredentials | null>;
+    setCredentials(credentials: OAuthCredentials): Promise<void>;
+    deleteCredentials(serverName: string): Promise<void>;
+    listServers(): Promise<string[]>;
+    getAllCredentials(): Promise<Map<string, OAuthCredentials>>;
+    clearAll(): Promise<void>;
+}