@jini-ai/mcp 0.1.0

package/dist/core/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/core/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,2DAA2D;AAC3D,EAAE;AACF,wEAAwE;AACxE,yEAAyE;AACzE,uEAAuE;AACvE,oEAAoE;AACpE,EAAE;AACF,yBAAyB;AACzB,uDAAuD;AACvD,qEAAqE;AACrE,0EAA0E;AAC1E,sFAAsF;AACtF,6CAA6C;AAC7C,iEAAiE;AACjE,sEAAsE;AACtE,yEAAyE;AACzE,qEAAqE;AACrE,yBAAyB;AACzB,EAAE;AACF,oEAAoE;AACpE,yCAAyC;AAEzC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAC/B,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAChF,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AA2D1D,0EAA0E;AAC1E,+CAA+C;AAC/C,0EAA0E;AAC1E,EAAE;AACF,yEAAyE;AACzE,0EAA0E;AAC1E,qEAAqE;AACrE,qEAAqE;AACrE,2EAA2E;AAC3E,oEAAoE;AACpE,yEAAyE;AACzE,wEAAwE;AACxE,wBAAwB;AACxB,2CAA2C;AAC3C,gFAAgF;AAChF,6EAA6E;AAC7E,qEAAqE;AACrE,gEAAgE;AAChE,yEAAyE;AACzE,wDAAwD;AACxD,yEAAyE;AACzE,qCAAqC;AACrC,kEAAkE;AAClE,mEAAmE;AACnE,uDAAuD;AACvD,oEAAoE;AACpE,sDAAsD;AACtD,MAAM,sBAAsB,GAAG,MAAM,CAAC;AACtC,MAAM,qBAAqB,GAAG,SAAS,CAAC,CAAC,gDAAgD;AAOzF,SAAS,kBAAkB,CAAC,GAAW;IACrC,MAAM,GAAG,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9B,yEAAyE;QACzE,wEAAwE;QACxE,2EAA2E;QAC3E,MAAM,IAAI,KAAK,CAAC,kCAAkC,GAAG,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,0EAA0E;AAC1E,yEAAyE;AACzE,2EAA2E;AAC3E,qEAAqE;AACrE,uBAAuB;AACvB,IAAI,sBAAsB,GAAiB,IAAI,CAAC;AAChD,SAAS,sBAAsB,CAAC,UAAwB;IACtD,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,IAAI,KAAK,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,sBAAsB,CAAC,UAAU,CAA8B,EAAE,EAAE,CAAC,CAAC;IAC7G,CAAC;IACD,sBAAsB,KAAK,IAAI,KAAK,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAA+B,EAAE,EAAE,CAAC,CAAC;IACrH,OAAO,sBAAsB,CAAC;AAChC,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAa;IACvC,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,CAAC;AAClF,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAa,EACb,QAAgB,EAChB,UAA4B;IAE5B,MAAM,IAAI,GAAI,GAAoD,CAAC,IAAI,CAAC;IACxE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QAClD,IAAI,CAAC;YACH,OAAO,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAChC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;YAC1B,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACrB,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,wCAAwC;gBAC7D,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,aAAa,CAAC,CAAC;YAClE,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,qDAAqD;QACvD,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC;AAED;yDACyD;AACzD,KAAK,UAAU,aAAa,CAAC,GAAa;IACxC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;QAC9D,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAWD;;;;;GAKG;AACH,KAAK,UAAU,cAAc,CAC3B,MAAc,EACd,IAAwB,EACxB,SAAuB,EACvB,UAAwB;IAExB,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,sBAAsB,CAAC,CAAC;IAC3E,IAAI,CAAC;QACH,MAAM,OAAO,GAAgB;YAC3B,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK;YAC5B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC;QACF,mEAAmE;QACnE,yEAAyE;QACzE,gEAAgE;QAChE,yDAAyD;QACxD,OAAoC,CAAC,UAAU,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACtF,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,OAAO,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,cAAc,GAAG,CAAC,MAAM,YAAY,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1G,CAAC;QACD,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,mEAAmE;YACnE,gEAAgE;YAChE,mEAAmE;YACnE,iEAAiE;YACjE,iEAAiE;YACjE,2BAA2B;YAC3B,MAAM,IAAI,KAAK,CAAC,+CAA+C,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,wBAAwB;AACxB,0EAA0E;AAE1E,MAAM,YAAY,GAAG,EAAE,CAAC,CAAC,8BAA8B;AAEvD,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,GAAG;SACP,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,SAAS,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,OAAO,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AACnE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,0EAA0E;AAC1E,aAAa;AACb,0EAA0E;AAE1E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,WAAmB,EACnB,YAA0B,KAAK,EAC/B,UAAwB;IAExB,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,UAAU,GAAG;QACjB,IAAI,GAAG,CACL,wCAAwC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,EAC9E,GAAG,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,IAAI,EAAE,CACrC,CAAC,QAAQ,EAAE;QACZ,IAAI,GAAG,CAAC,uCAAuC,EAAE,GAAG,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE;KAClG,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,SAAS,CAA4B,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QACpF,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;IACxB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc,EACd,YAA0B,KAAK,EAC/B,UAAwB;IAExB,IAAI,YAAiB,CAAC;IACtB,IAAI,CAAC;QACH,YAAY,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,GAAG,YAAY,CAAC,QAAQ,KAAK,YAAY,CAAC,IAAI,EAAE,CAAC;IAC9D,MAAM,UAAU,GAAG;QACjB,GAAG,IAAI,0CAA0C,OAAO,EAAE;QAC1D,GAAG,IAAI,oCAAoC,OAAO,EAAE;QACpD,GAAG,IAAI,yCAAyC;QAChD,GAAG,IAAI,mCAAmC;KAC3C,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,SAAS,CAA8B,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QACtF,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,sBAAsB,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;YACvG,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM;gBAAE,SAAS,CAAC,gCAAgC;YACzG,IAAI,CAAC,0BAA0B,CAAC,YAAY,EAAE,IAAI,CAAC;gBAAE,SAAS;YAC9D,oEAAoE;YACpE,0DAA0D;YAC1D,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,MAAM,EAAE,CAAC;QACpD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,0BAA0B,CAAC,SAAc,EAAE,IAAiC;IACnF,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,sBAAsB,EAAE,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,qBAAqB,CAAC,CAAC,MAAM,CACrG,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAC1C,CAAC;IACF,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;IACvF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,GAAW,EACX,SAAuB,EACvB,UAAwB;IAExB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QAC1G,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;QAC9D,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAUD,SAAS,WAAW,CAAC,OAAe;IAClC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;AACtD,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,OAAe;IAC5C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACtE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAAE,CAAC;IAChE,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,GAAwB,CAAC;QACnC,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAChD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAU;IACpC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,OAAO,CACL,OAAO,CAAC,CAAC,gBAAgB,KAAK,QAAQ;QACtC,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ;QACjC,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAC/B,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,gBAAgB,CAC7B,OAAe,EACf,IAAqB;IAErB,MAAM,qBAAqB,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AACnF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,oBAA4B,EAC5B,WAAmB,EACnB,YAA0B,KAAK,EAC/B,UAAwB;IAExB,MAAM,IAAI,GAAG;QACX,aAAa,EAAE,CAAC,WAAW,CAAC;QAC5B,0BAA0B,EAAE,MAAM;QAClC,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QACpD,cAAc,EAAE,CAAC,MAAM,CAAC;QACxB,WAAW,EAAE,MAAM;QACnB,gBAAgB,EAAE,KAAK;KACxB,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,cAAc,CAC9B,oBAAoB,EACpB;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,kBAAkB;SAC3B;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,EACD,SAAS,EACT,UAAU,CACX,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,4CAA4C,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,EAAE,CAClF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,cAAc,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAGvE,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,GAAG,GAAgD,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IACtF,IAAI,IAAI,CAAC,aAAa;QAAE,GAAG,CAAC,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC;IAC9D,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAe,EACf,UAAuC,EACvC,WAAmB,EACnB,YAA0B,KAAK,EAC/B,UAAwB;IAExB,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAC/B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,KAAK,UAAU,CAAC,MAAM,IAAI,CAAC,CAAC,WAAW,KAAK,WAAW,CACjF,CAAC;IACF,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,IAAI,CAAC,UAAU,CAAC,qBAAqB,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,eAAe,UAAU,CAAC,MAAM,6EAA6E,CAC9G,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,cAAc,CAC9B,UAAU,CAAC,qBAAqB,EAChC,WAAW,EACX,SAAS,EACT,UAAU,CACX,CAAC;IACF,MAAM,IAAI,GAAqB;QAC7B,gBAAgB,EAAE,UAAU,CAAC,MAAM;QACnC,WAAW;QACX,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE;KACzB,CAAC;IACF,IAAI,GAAG,CAAC,YAAY;QAAE,IAAI,CAAC,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC;IAC3D,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzB,MAAM,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACvC,OAAO,IAAI,CAAC;AACd,CAAC;AAkBD;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAwB;IACxD,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC;IAC3D,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACtD,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IAC1D,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACpD,IAAI,KAAK,CAAC,KAAK;QAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC1D,oEAAoE;IACpE,kEAAkE;IAClE,qCAAqC;IACrC,IAAI,KAAK,CAAC,QAAQ;QAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACnE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;AACtB,CAAC;AAkBD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAwB,EACxB,YAA0B,KAAK,EAC/B,UAAwB;IAExB,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;IAC7C,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IAC5C,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAC9C,IAAI,KAAK,CAAC,QAAQ;QAAE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACzD,OAAO,YAAY,CAAC,KAAK,CAAC,aAAa,EAAE,IAAI,EAAE,KAAK,CAAC,YAAY,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;AAC5F,CAAC;AAaD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAwB,EACxB,YAA0B,KAAK,EAC/B,UAAwB;IAExB,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IACxC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAC9C,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,KAAK,CAAC,KAAK;QAAE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,QAAQ;QAAE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACzD,OAAO,YAAY,CAAC,KAAK,CAAC,aAAa,EAAE,IAAI,EAAE,KAAK,CAAC,YAAY,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;AAC5F,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,aAAqB,EACrB,IAAqB,EACrB,YAAgC,EAChC,SAAuB,EACvB,UAAwB;IAExB,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,mCAAmC;QACnD,MAAM,EAAE,kBAAkB;KAC3B,CAAC;IACF,IAAI,YAAY,EAAE,CAAC;QACjB,iEAAiE;QACjE,mEAAmE;QACnE,oBAAoB;QACpB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACzF,OAAO,CAAC,eAAe,CAAC,GAAG,SAAS,KAAK,EAAE,CAAC;IAC9C,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,cAAc,CAC9B,aAAa,EACb,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,EAClD,SAAS,EACT,UAAU,CACX,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,yCAAyC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,EAAE,CAC/E,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,cAAc,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAuB,CAAC;IAChG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,0EAA0E;AAC1E,iCAAiC;AACjC,0EAA0E;AAE1E;;;;;;;GAOG;AACH,MAAM,OAAO,gBAAgB;IAIE;IAHrB,KAAK,GAAG,IAAI,GAAG,EAA4B,CAAC;IAC5C,KAAK,GAA0C,IAAI,CAAC;IAE5D,YAA6B,QAAgB,EAAE,GAAG,EAAE,GAAG,IAAI;QAA9B,UAAK,GAAL,KAAK,CAAyB;IAAG,CAAC;IAE/D;;;;;OAKG;IACH,GAAG,CAAC,KAAa,EAAE,KAAuB;QACxC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC7B,IAAI,CAAC,YAAY,EAAE,CAAC;IACtB,CAAC;IAED;gCAC4B;IAC5B,OAAO,CAAC,KAAa;QACnB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACvD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,4EAA4E;IAC5E,IAAI;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;IACzB,CAAC;IAED;6CACyC;IACzC,IAAI;QACF,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QACpB,CAAC;IACH,CAAC;IAEO,YAAY;QAClB,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO;QACvB,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;QAC3E,gEAAgE;QAChE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAEO,KAAK;QACX,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAChC,IAAI,GAAG,GAAG,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACxC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QACpB,CAAC;IACH,CAAC;CACF;AAiCD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,KAAqB;IAErB,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC;IAC3C,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IAEpC,mEAAmE;IACnE,qEAAqE;IACrE,kEAAkE;IAClE,wCAAwC;IACxC,MAAM,GAAG,GAAG,MAAM,yBAAyB,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IACpF,MAAM,UAAU,GAAG,GAAG,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,UAAU,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;IAE7D,wCAAwC;IACxC,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IAC3E,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,yCAAyC,MAAM,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,kEAAkE;IAClE,MAAM,MAAM,GAAG,MAAM,mBAAmB,CACtC,KAAK,CAAC,OAAO,EACb,UAAU,EACV,KAAK,CAAC,WAAW,EACjB,SAAS,EACT,UAAU,CACX,CAAC;IAEF,wBAAwB;IACxB,MAAM,YAAY,GAAG,oBAAoB,EAAE,CAAC;IAC5C,MAAM,aAAa,GAAG,mBAAmB,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAE9B,MAAM,KAAK,GACT,KAAK,CAAC,KAAK;QACX,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,gBAAgB,CAAC,IAAI,GAAI,CAAC,gBAAiB,CAAC,MAAM,GAAG,CAAC;YACxE,CAAC,CAAC,GAAI,CAAC,gBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC;YAClC,CAAC,CAAC,UAAU,CAAC,gBAAgB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAE9C,MAAM,QAAQ,GAAG,GAAG,EAAE,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC;IAClD,MAAM,YAAY,GAAsB;QACtC,UAAU;QACV,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,KAAK;QACL,aAAa;QACb,QAAQ;KACT,CAAC;IACF,IAAI,KAAK;QAAE,YAAY,CAAC,KAAK,GAAG,KAAK,CAAC;IACtC,MAAM,YAAY,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAErD,MAAM,OAAO,GAAqB;QAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,gBAAgB,EAAE,UAAU,CAAC,MAAM;QACnC,aAAa,EAAE,UAAU,CAAC,cAAc;QACxC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,YAAY;QACZ,WAAW,EAAE,QAAQ;QACrB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC;IACF,IAAI,MAAM,CAAC,YAAY;QAAE,OAAO,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;IACpE,IAAI,KAAK;QAAE,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC;IAEjC,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC1C,CAAC"}

package/dist/core/secure-write.d.ts

@@ -0,0 +1,17 @@
+export interface WriteSecretFileOptions {
+    /** Injectable for tests only; defaults to `process.platform`. */
+    platform?: NodeJS.Platform;
+}
+/**
+ * Atomically write `contents` to `finalPath` via a same-directory temp file
+ * created exclusively with mode 0600. On POSIX platforms, verifies no
+ * group/other permission bit made it onto disk before renaming into place;
+ * throws (after removing the temp file) if verification fails or the write
+ * itself fails, so a caller never observes a partially-written or
+ * insufficiently-restricted secret file.
+ * @param finalPath Absolute path the secret file should end up at.
+ * @param contents UTF-8 text to write.
+ * @param options `platform` override for tests; defaults to `process.platform`.
+ */
+export declare function writeSecretFileAtomic(finalPath: string, contents: string, options?: WriteSecretFileOptions): Promise<void>;
+//# sourceMappingURL=secure-write.d.ts.map

package/dist/core/secure-write.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-write.d.ts","sourceRoot":"","sources":["../../src/core/secure-write.ts"],"names":[],"mappings":"AAyCA,MAAM,WAAW,sBAAsB;IACrC,iEAAiE;IACjE,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC5B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,IAAI,CAAC,CAqBf"}

package/dist/core/secure-write.js

@@ -0,0 +1,72 @@
+/**
+ * @module @jini-ai/mcp/core/secure-write
+ * Shared atomic, owner-only-permission (0600) secret-file writer used by
+ * every secret-bearing on-disk store in this package: the server config
+ * store (env vars / `Authorization` headers), the OAuth dynamic-client-
+ * registration cache (`clientSecret`), and the OAuth token store (bearer /
+ * refresh tokens, confidential-client secrets). CR-006 / SEC-RB-002.
+ *
+ * The previous pattern in each of those stores wrote the temp file with
+ * default permissions and either never restricted it (config, OAuth client
+ * cache) or `chmod(0600)`'d it *after* the atomic rename and silently
+ * continued when the chmod failed (tokens) — both leave a window where the
+ * file exists world/group-readable, and the latter makes the "protection"
+ * advisory rather than enforced. This writer instead:
+ *
+ *   1. Creates the temp file *exclusively* (`wx`) with mode 0600 supplied to
+ *      the same `open()`/`writeFile()` call that creates it — POSIX applies
+ *      the requested mode atomically at creation time, so there is no
+ *      window where the file exists with a broader mode. This repo already
+ *      relies on `writeFile`'s `mode` option alone for a secret file with no
+ *      separate chmod step (see `packages/agent-runtime/src/prompt-file.ts`);
+ *      this module follows that same precedent rather than inventing a new one.
+ *   2. On POSIX platforms, verifies the on-disk mode actually landed as
+ *      owner-only before renaming into place, and fails closed — removing
+ *      the temp file and throwing — if it did not (e.g. an unusual umask or
+ *      a filesystem that doesn't honor `mode`).
+ *   3. Skips that verification on `win32`: Windows has no POSIX permission-
+ *      bit model (`mode` there only toggles the read-only attribute), so
+ *      there is nothing meaningful to enforce or fail closed on — matching
+ *      this repo's only other cross-platform file-mode precedent, which
+ *      also does not branch on Windows.
+ *
+ * Part of the MCP `core` kernel; not part of the package's public barrel —
+ * imported directly by sibling `core/*.ts` files.
+ */
+import { mkdir, rename, rm, stat, writeFile } from 'node:fs/promises';
+import { randomBytes } from 'node:crypto';
+import path from 'node:path';
+const SECRET_FILE_MODE = 0o600;
+/**
+ * Atomically write `contents` to `finalPath` via a same-directory temp file
+ * created exclusively with mode 0600. On POSIX platforms, verifies no
+ * group/other permission bit made it onto disk before renaming into place;
+ * throws (after removing the temp file) if verification fails or the write
+ * itself fails, so a caller never observes a partially-written or
+ * insufficiently-restricted secret file.
+ * @param finalPath Absolute path the secret file should end up at.
+ * @param contents UTF-8 text to write.
+ * @param options `platform` override for tests; defaults to `process.platform`.
+ */
+export async function writeSecretFileAtomic(finalPath, contents, options = {}) {
+    const platform = options.platform ?? process.platform;
+    await mkdir(path.dirname(finalPath), { recursive: true });
+    const tmp = `${finalPath}.${randomBytes(4).toString('hex')}.tmp`;
+    try {
+        await writeFile(tmp, contents, { encoding: 'utf8', mode: SECRET_FILE_MODE, flag: 'wx' });
+        if (platform !== 'win32') {
+            const info = await stat(tmp);
+            const bits = info.mode & 0o777;
+            if ((bits & 0o077) !== 0) {
+                throw new Error(`refusing to persist secret-bearing file with non-owner-only permissions ` +
+                    `(mode 0${bits.toString(8)}): ${finalPath}`);
+            }
+        }
+        await rename(tmp, finalPath);
+    }
+    catch (err) {
+        await rm(tmp, { force: true }).catch(() => undefined);
+        throw err;
+    }
+}
+//# sourceMappingURL=secure-write.js.map

package/dist/core/secure-write.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-write.js","sourceRoot":"","sources":["../../src/core/secure-write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAO/B;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,SAAiB,EACjB,QAAgB,EAChB,UAAkC,EAAE;IAEpC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACtD,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,GAAG,SAAS,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;IACjE,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACzF,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;YAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;YAC/B,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CACb,0EAA0E;oBACxE,UAAU,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,SAAS,EAAE,CAC9C,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/core/tokens.d.ts

@@ -0,0 +1,72 @@
+/**
+ * @module @jini-ai/mcp/core/tokens
+ * Persistent, 0600-guarded OAuth-token store for remote MCP servers, keyed by
+ * server id, with expiry checks. The durable counterpart to `oauth`'s live flow.
+ * Part of the MCP `core` kernel; depends on no sibling subdirectory.
+ */
+/**
+ * Stored OAuth token for a single MCP server. Mirrors the relevant subset
+ * of an OAuth 2.0 token-endpoint response (RFC 6749 §5.1), plus the OAuth
+ * client context the original authorization-code exchange used. Refresh
+ * tokens are bound (RFC 6749 §6) to the client that received them, so we
+ * have to refresh against the same `client_id` / `redirect_uri` pair —
+ * persisting the context here is what lets us do that without re-running
+ * authorization.
+ */
+export interface StoredMcpToken {
+    /** The bearer token to send as `Authorization: Bearer …`. */
+    accessToken: string;
+    /** Refresh token (RFC 6749 §6) if the auth server issued one. */
+    refreshToken?: string;
+    /** Absolute epoch ms at which `accessToken` expires. Optional — some
+     * providers never expire. */
+    expiresAt?: number;
+    /** RFC 6749 §5.1 token_type. Almost always `Bearer`. */
+    tokenType: string;
+    /** Space-separated scopes granted (verbatim from the token response). */
+    scope?: string;
+    /** Wall-clock epoch ms when this record was first persisted. */
+    savedAt: number;
+    /** Token endpoint that issued this token; reused verbatim for refresh. */
+    tokenEndpoint?: string;
+    /** Client id that obtained the refresh token. */
+    clientId?: string;
+    /** Confidential-client secret, if the upstream issued one. */
+    clientSecret?: string;
+    /** Authorization-server issuer, used to look the cached client back up. */
+    authServerIssuer?: string;
+    /** Redirect URI registered with the client at authorization time. */
+    redirectUri?: string;
+    /** RFC 8707 resource indicator the original token was scoped to. */
+    resourceUrl?: string;
+}
+export interface McpTokensFile {
+    /** keyed by McpServerConfig.id */
+    servers: Record<string, StoredMcpToken>;
+}
+/** Coerce a freeform JSON blob into the typed shape, dropping anything that
+ * doesn't deserialize cleanly. Used both at read time and as a defensive
+ * pass when third-party tooling has hand-edited the file. */
+export declare function sanitizeTokensFile(raw: unknown): McpTokensFile;
+/**
+ * Read and sanitize the MCP token store from `<dataDir>/mcp-tokens.json`.
+ * Returns an empty store when the file does not exist or contains invalid JSON.
+ * @param dataDir The resolved runtime data directory.
+ * @returns The sanitized token file, never rejects on missing-file or corrupt-JSON.
+ */
+export declare function readTokensFile(dataDir: string): Promise<McpTokensFile>;
+/** Get the current token for a given server, or null when none is stored
+ * (or the persisted entry is malformed). */
+export declare function getToken(dataDir: string, serverId: string): Promise<StoredMcpToken | null>;
+/** Atomically merge a new token for `serverId` into the tokens file. */
+export declare function setToken(dataDir: string, serverId: string, token: StoredMcpToken): Promise<void>;
+/** Atomically delete the stored token for `serverId`. No-op when absent. */
+export declare function clearToken(dataDir: string, serverId: string): Promise<void>;
+/** Bulk read used by the spawn pipeline so we make one disk hit per spawn,
+ * not one per server. */
+export declare function readAllTokens(dataDir: string): Promise<Record<string, StoredMcpToken>>;
+/** True when the stored token is past its `expiresAt` (or within `skew`
+ * milliseconds of expiring). Returns false when no `expiresAt` is recorded
+ * — many providers issue non-expiring tokens. */
+export declare function isTokenExpired(token: StoredMcpToken, now?: number, skew?: number): boolean;
+//# sourceMappingURL=tokens.d.ts.map

package/dist/core/tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/core/tokens.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAwBH;;;;;;;;GAQG;AACH,MAAM,WAAW,cAAc;IAC7B,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB,iEAAiE;IACjE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;iCAC6B;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,yEAAyE;IACzE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,OAAO,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8DAA8D;IAC9D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2EAA2E;IAC3E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qEAAqE;IACrE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,kCAAkC;IAClC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;CACzC;AAYD;;6DAE6D;AAC7D,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,aAAa,CAY9D;AAgED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAa5E;AA4BD;4CAC4C;AAC5C,wBAAsB,QAAQ,CAC5B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAGhC;AAED,wEAAwE;AACxE,wBAAsB,QAAQ,CAC5B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,cAAc,GACpB,OAAO,CAAC,IAAI,CAAC,CAMf;AAED,4EAA4E;AAC5E,wBAAsB,UAAU,CAC9B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAOf;AAED;yBACyB;AACzB,wBAAsB,aAAa,CACjC,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAGzC;AAED;;iDAEiD;AACjD,wBAAgB,cAAc,CAC5B,KAAK,EAAE,cAAc,EACrB,GAAG,GAAE,MAAmB,EACxB,IAAI,GAAE,MAAe,GACpB,OAAO,CAGT"}

package/dist/core/tokens.js

@@ -0,0 +1,197 @@
+/**
+ * @module @jini-ai/mcp/core/tokens
+ * Persistent, 0600-guarded OAuth-token store for remote MCP servers, keyed by
+ * server id, with expiry checks. The durable counterpart to `oauth`'s live flow.
+ * Part of the MCP `core` kernel; depends on no sibling subdirectory.
+ */
+// Persistent OAuth-token storage for external HTTP / SSE MCP servers.
+//
+// The daemon owns the OAuth flow end-to-end so the user never needs a
+// transient `localhost:<port>` listener (the killer of cloud deployments)
+// and so a token survives across agent turns. Tokens are written to
+// `<dataDir>/mcp-tokens.json` keyed by McpServerConfig.id, with the same
+// atomic write + per-dataDir mutex pattern the rest of the runtime uses.
+//
+// File mode: owner-only (0600) from the very first byte, via
+// `writeSecretFileAtomic` (CR-006 / SEC-RB-002) — NOT a post-rename chmod.
+// The previous chmod-after-rename approach left a window where the file
+// briefly existed with default (potentially world/group-readable)
+// permissions, and silently continued persisting the token when chmod
+// failed for any reason other than ENOTSUP/EPERM, which is not a
+// fail-closed guarantee. `writeSecretFileAtomic` creates the file with mode
+// 0600 atomically at creation and fails closed (removing the temp file and
+// throwing) if a POSIX platform did not honor that mode; it skips
+// verification on `win32`, which has no POSIX permission-bit model.
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
+import { writeSecretFileAtomic } from './secure-write.js';
+const EMPTY = { servers: {} };
+function tokensFile(dataDir) {
+    return path.join(dataDir, 'mcp-tokens.json');
+}
+function isPlainObject(v) {
+    return Boolean(v) && typeof v === 'object' && !Array.isArray(v);
+}
+/** Coerce a freeform JSON blob into the typed shape, dropping anything that
+ * doesn't deserialize cleanly. Used both at read time and as a defensive
+ * pass when third-party tooling has hand-edited the file. */
+export function sanitizeTokensFile(raw) {
+    if (!isPlainObject(raw))
+        return { servers: {} };
+    const servers = raw.servers;
+    if (!isPlainObject(servers))
+        return { servers: {} };
+    const out = {};
+    for (const [id, value] of Object.entries(servers)) {
+        if (id === '__proto__' || id === 'constructor')
+            continue;
+        const tok = sanitizeToken(value);
+        if (!tok)
+            continue;
+        out[id] = tok;
+    }
+    return { servers: out };
+}
+function sanitizeToken(raw) {
+    if (!isPlainObject(raw))
+        return null;
+    const accessToken = typeof raw.accessToken === 'string' ? raw.accessToken.trim() : '';
+    if (!accessToken)
+        return null;
+    const tokenType = typeof raw.tokenType === 'string' && raw.tokenType.trim()
+        ? raw.tokenType.trim()
+        : 'Bearer';
+    const refreshToken = typeof raw.refreshToken === 'string' && raw.refreshToken.trim()
+        ? raw.refreshToken.trim()
+        : undefined;
+    const scope = typeof raw.scope === 'string' && raw.scope.trim()
+        ? raw.scope.trim()
+        : undefined;
+    const expiresAt = typeof raw.expiresAt === 'number' && Number.isFinite(raw.expiresAt)
+        ? raw.expiresAt
+        : undefined;
+    const savedAt = typeof raw.savedAt === 'number' && Number.isFinite(raw.savedAt)
+        ? raw.savedAt
+        : Date.now();
+    const tokenEndpoint = typeof raw.tokenEndpoint === 'string' && raw.tokenEndpoint.trim()
+        ? raw.tokenEndpoint.trim()
+        : undefined;
+    const clientId = typeof raw.clientId === 'string' && raw.clientId.trim()
+        ? raw.clientId.trim()
+        : undefined;
+    const clientSecret = typeof raw.clientSecret === 'string' && raw.clientSecret.trim()
+        ? raw.clientSecret.trim()
+        : undefined;
+    const authServerIssuer = typeof raw.authServerIssuer === 'string' && raw.authServerIssuer.trim()
+        ? raw.authServerIssuer.trim()
+        : undefined;
+    const redirectUri = typeof raw.redirectUri === 'string' && raw.redirectUri.trim()
+        ? raw.redirectUri.trim()
+        : undefined;
+    const resourceUrl = typeof raw.resourceUrl === 'string' && raw.resourceUrl.trim()
+        ? raw.resourceUrl.trim()
+        : undefined;
+    const out = { accessToken, tokenType, savedAt };
+    if (refreshToken)
+        out.refreshToken = refreshToken;
+    if (scope)
+        out.scope = scope;
+    if (expiresAt !== undefined)
+        out.expiresAt = expiresAt;
+    if (tokenEndpoint)
+        out.tokenEndpoint = tokenEndpoint;
+    if (clientId)
+        out.clientId = clientId;
+    if (clientSecret)
+        out.clientSecret = clientSecret;
+    if (authServerIssuer)
+        out.authServerIssuer = authServerIssuer;
+    if (redirectUri)
+        out.redirectUri = redirectUri;
+    if (resourceUrl)
+        out.resourceUrl = resourceUrl;
+    return out;
+}
+/**
+ * Read and sanitize the MCP token store from `<dataDir>/mcp-tokens.json`.
+ * Returns an empty store when the file does not exist or contains invalid JSON.
+ * @param dataDir The resolved runtime data directory.
+ * @returns The sanitized token file, never rejects on missing-file or corrupt-JSON.
+ */
+export async function readTokensFile(dataDir) {
+    try {
+        const raw = await readFile(tokensFile(dataDir), 'utf8');
+        return sanitizeTokensFile(JSON.parse(raw));
+    }
+    catch (err) {
+        const e = err;
+        if (e.code === 'ENOENT')
+            return { ...EMPTY, servers: { ...EMPTY.servers } };
+        if (e.name === 'SyntaxError') {
+            console.error('[mcp-tokens] Corrupted JSON, returning empty:', e.message);
+            return { ...EMPTY, servers: { ...EMPTY.servers } };
+        }
+        throw err;
+    }
+}
+const writeLocks = new Map();
+async function withLock(dataDir, fn) {
+    const prev = writeLocks.get(dataDir) ?? Promise.resolve();
+    const task = prev.catch(() => { }).then(fn);
+    writeLocks.set(dataDir, task);
+    try {
+        return await task;
+    }
+    finally {
+        if (writeLocks.get(dataDir) === task)
+            writeLocks.delete(dataDir);
+    }
+}
+async function writeTokensFile(dataDir, next) {
+    const file = tokensFile(dataDir);
+    // Bearer tokens can hand someone posting-as-you against the upstream MCP,
+    // so the file is created with owner-only (0600) permissions from the
+    // first byte and the write fails closed if that can't be guaranteed on a
+    // POSIX platform — see `writeSecretFileAtomic`.
+    await writeSecretFileAtomic(file, JSON.stringify(next, null, 2));
+    return next;
+}
+/** Get the current token for a given server, or null when none is stored
+ * (or the persisted entry is malformed). */
+export async function getToken(dataDir, serverId) {
+    const file = await readTokensFile(dataDir);
+    return file.servers[serverId] ?? null;
+}
+/** Atomically merge a new token for `serverId` into the tokens file. */
+export async function setToken(dataDir, serverId, token) {
+    await withLock(dataDir, async () => {
+        const file = await readTokensFile(dataDir);
+        file.servers[serverId] = token;
+        await writeTokensFile(dataDir, file);
+    });
+}
+/** Atomically delete the stored token for `serverId`. No-op when absent. */
+export async function clearToken(dataDir, serverId) {
+    await withLock(dataDir, async () => {
+        const file = await readTokensFile(dataDir);
+        if (!(serverId in file.servers))
+            return;
+        delete file.servers[serverId];
+        await writeTokensFile(dataDir, file);
+    });
+}
+/** Bulk read used by the spawn pipeline so we make one disk hit per spawn,
+ * not one per server. */
+export async function readAllTokens(dataDir) {
+    const file = await readTokensFile(dataDir);
+    return file.servers;
+}
+/** True when the stored token is past its `expiresAt` (or within `skew`
+ * milliseconds of expiring). Returns false when no `expiresAt` is recorded
+ * — many providers issue non-expiring tokens. */
+export function isTokenExpired(token, now = Date.now(), skew = 30_000) {
+    if (typeof token.expiresAt !== 'number')
+        return false;
+    return token.expiresAt - skew <= now;
+}
+//# sourceMappingURL=tokens.js.map

package/dist/core/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/core/tokens.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,sEAAsE;AACtE,EAAE;AACF,sEAAsE;AACtE,0EAA0E;AAC1E,oEAAoE;AACpE,yEAAyE;AACzE,yEAAyE;AACzE,EAAE;AACF,6DAA6D;AAC7D,2EAA2E;AAC3E,wEAAwE;AACxE,kEAAkE;AAClE,sEAAsE;AACtE,iEAAiE;AACjE,4EAA4E;AAC5E,2EAA2E;AAC3E,kEAAkE;AAClE,oEAAoE;AAEpE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AA4C1D,MAAM,KAAK,GAAkB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AAE7C,SAAS,UAAU,CAAC,OAAe;IACjC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,aAAa,CAAC,CAAU;IAC/B,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;6DAE6D;AAC7D,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAChD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAC5B,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACpD,MAAM,GAAG,GAAmC,EAAE,CAAC;IAC/C,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAClD,IAAI,EAAE,KAAK,WAAW,IAAI,EAAE,KAAK,aAAa;YAAE,SAAS;QACzD,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC;IAChB,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,aAAa,CAAC,GAAY;IACjC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,WAAW,GACf,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,SAAS,GACb,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE;QACvD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE;QACtB,CAAC,CAAC,QAAQ,CAAC;IACf,MAAM,YAAY,GAChB,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ,IAAI,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE;QAC7D,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE;QACzB,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,KAAK,GACT,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE;QAC/C,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE;QAClB,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,SAAS,GACb,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;QACjE,CAAC,CAAC,GAAG,CAAC,SAAS;QACf,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,OAAO,GACX,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;QAC7D,CAAC,CAAC,GAAG,CAAC,OAAO;QACb,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;IACjB,MAAM,aAAa,GACjB,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,IAAI,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE;QAC/D,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE;QAC1B,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,QAAQ,GACZ,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE;QACrD,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE;QACrB,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,YAAY,GAChB,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ,IAAI,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE;QAC7D,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE;QACzB,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,gBAAgB,GACpB,OAAO,GAAG,CAAC,gBAAgB,KAAK,QAAQ,IAAI,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE;QACrE,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE;QAC7B,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,WAAW,GACf,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE;QAC3D,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE;QACxB,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,WAAW,GACf,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE;QAC3D,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE;QACxB,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,GAAG,GAAmB,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;IAChE,IAAI,YAAY;QAAE,GAAG,CAAC,YAAY,GAAG,YAAY,CAAC;IAClD,IAAI,KAAK;QAAE,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC;IAC7B,IAAI,SAAS,KAAK,SAAS;QAAE,GAAG,CAAC,SAAS,GAAG,SAAS,CAAC;IACvD,IAAI,aAAa;QAAE,GAAG,CAAC,aAAa,GAAG,aAAa,CAAC;IACrD,IAAI,QAAQ;QAAE,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAC;IACtC,IAAI,YAAY;QAAE,GAAG,CAAC,YAAY,GAAG,YAAY,CAAC;IAClD,IAAI,gBAAgB;QAAE,GAAG,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;IAC9D,IAAI,WAAW;QAAE,GAAG,CAAC,WAAW,GAAG,WAAW,CAAC;IAC/C,IAAI,WAAW;QAAE,GAAG,CAAC,WAAW,GAAG,WAAW,CAAC;IAC/C,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAe;IAClD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;QACxD,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,GAAyD,CAAC;QACpE,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5E,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YAC7B,OAAO,CAAC,KAAK,CAAC,+CAA+C,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;YAC1E,OAAO,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QACrD,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,GAAG,IAAI,GAAG,EAA4B,CAAC;AAEvD,KAAK,UAAU,QAAQ,CAAI,OAAe,EAAE,EAAoB;IAC9D,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3C,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC;IACpB,CAAC;YAAS,CAAC;QACT,IAAI,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI;YAAE,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,OAAe,EACf,IAAmB;IAEnB,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACjC,0EAA0E;IAC1E,qEAAqE;IACrE,yEAAyE;IACzE,gDAAgD;IAChD,MAAM,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACjE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;4CAC4C;AAC5C,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,OAAe,EACf,QAAgB;IAEhB,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;IAC3C,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;AACxC,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,OAAe,EACf,QAAgB,EAChB,KAAqB;IAErB,MAAM,QAAQ,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;QACjC,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC;QAC/B,MAAM,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAe,EACf,QAAgB;IAEhB,MAAM,QAAQ,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;QACjC,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO;QACxC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC9B,MAAM,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;yBACyB;AACzB,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAe;IAEf,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;IAC3C,OAAO,IAAI,CAAC,OAAO,CAAC;AACtB,CAAC;AAED;;iDAEiD;AACjD,MAAM,UAAU,cAAc,CAC5B,KAAqB,EACrB,MAAc,IAAI,CAAC,GAAG,EAAE,EACxB,OAAe,MAAM;IAErB,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,OAAO,KAAK,CAAC,SAAS,GAAG,IAAI,IAAI,GAAG,CAAC;AACvC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,28 @@
+/**
+ * @module @jini-ai/mcp
+ * Public barrel for the MCP (Model Context Protocol) domain. External code
+ * imports MCP capabilities only from here — never from a subdirectory — so the
+ * internal split (`core` kernel + `client` / `agent-install` concerns) can move
+ * without touching consumers.
+ *
+ * Re-exports are explicit and named (no `export *`) so the public surface is
+ * visible here and name collisions surface at build time.
+ */
+export { inferMcpAuthModeForUrl, sanitizeMcpServer, sanitizeMcpConfig, readMcpConfig, writeMcpConfig, isManagedProjectCwd, buildClaudeMcpJson, buildAcpMcpServers, buildOpenCodeMcpConfigContent, } from './core/index.js';
+export type { McpTransport, McpAuthMode, McpServerConfig, McpConfig, AcpMcpServer, OpenCodeConfigBuildOptions, } from './core/index.js';
+export { generateCodeVerifier, deriveCodeChallenge, generateState, discoverProtectedResource, discoverAuthServer, registerClient, getOrRegisterClient, buildAuthorizeUrl, exchangeCodeForToken, refreshAccessToken, PendingAuthCache, beginAuth, } from './core/index.js';
+export type { ProtectedResourceMetadata, AuthorizationServerMetadata, RegisteredClient, OAuthTokenResponse, PendingAuthState, AuthorizeUrlInput, ExchangeCodeInput, RefreshTokenInput, BeginAuthInput, BeginAuthResult, } from './core/index.js';
+export { sanitizeTokensFile, readTokensFile, getToken, setToken, clearToken, readAllTokens, isTokenExpired, } from './core/index.js';
+export type { StoredMcpToken, McpTokensFile } from './core/index.js';
+export { buildMcpInstallPayload } from './core/index.js';
+export type { BuildMcpInstallPayloadInputs, McpInstallPayload } from './core/index.js';
+export { createMcpIdleExitController, extractRelativeRefs, isTextualMime, } from './client/index.js';
+export { cancelRunTool, createMcpToolServer, errorResult, getActiveContextTool, getDaemonJson, getRunTool, listAgentsTool, okResult, postDaemonJson, requireString, RUN_TOOLS, startRunTool, toolsToList, buildToolIndex, handleToolCall, DaemonResponseTooLargeError, } from './server/index.js';
+export type { DaemonRequestOptions, McpServerLike, McpToolContext, McpToolDef, McpToolServerHandle, McpToolServerOptions, McpTransportLike, } from './server/index.js';
+export { activeContextResource, buildResourceIndex, handleResourceRead, KERNEL_RESOURCES, resourcesToList, } from './server/index.js';
+export type { McpResourceDef, McpResourceReadResult } from './server/index.js';
+export { createExecuteDelegatedToolTool } from './server/index.js';
+export type { CreateExecuteDelegatedToolToolOptions } from './server/index.js';
+export { AGENT_SLUGS, isAgentSlug, planAgentInstall, applyJsonInstall, removeJsonInstall, } from './agent-install/index.js';
+export type { AgentSlug, McpLaunchSpec, PlanContext, CliInstallPlan, JsonInstallPlan, ManualInstallPlan, InstallPlan, } from './agent-install/index.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,6BAA6B,GAC9B,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,YAAY,EACZ,WAAW,EACX,eAAe,EACf,SAAS,EACT,YAAY,EACZ,0BAA0B,GAC3B,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,aAAa,EACb,yBAAyB,EACzB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EAChB,SAAS,GACV,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,yBAAyB,EACzB,2BAA2B,EAC3B,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,eAAe,GAChB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,QAAQ,EACR,QAAQ,EACR,UAAU,EACV,aAAa,EACb,cAAc,GACf,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAGrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACzD,YAAY,EAAE,4BAA4B,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAGvF,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,aAAa,GACd,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,WAAW,EACX,oBAAoB,EACpB,aAAa,EACb,UAAU,EACV,cAAc,EACd,QAAQ,EACR,cAAc,EACd,aAAa,EACb,SAAS,EACT,YAAY,EACZ,WAAW,EACX,cAAc,EACd,cAAc,EACd,2BAA2B,GAC5B,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,oBAAoB,EACpB,aAAa,EACb,cAAc,EACd,UAAU,EACV,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAG/E,OAAO,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AACnE,YAAY,EAAE,qCAAqC,EAAE,MAAM,mBAAmB,CAAC;AAG/E,OAAO,EACL,WAAW,EACX,WAAW,EACX,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,SAAS,EACT,aAAa,EACb,WAAW,EACX,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,WAAW,GACZ,MAAM,0BAA0B,CAAC"}

package/dist/index.js

@@ -0,0 +1,29 @@
+/**
+ * @module @jini-ai/mcp
+ * Public barrel for the MCP (Model Context Protocol) domain. External code
+ * imports MCP capabilities only from here — never from a subdirectory — so the
+ * internal split (`core` kernel + `client` / `agent-install` concerns) can move
+ * without touching consumers.
+ *
+ * Re-exports are explicit and named (no `export *`) so the public surface is
+ * visible here and name collisions surface at build time.
+ */
+// ── core: config schema + IO ────────────────────────────────────────────────
+export { inferMcpAuthModeForUrl, sanitizeMcpServer, sanitizeMcpConfig, readMcpConfig, writeMcpConfig, isManagedProjectCwd, buildClaudeMcpJson, buildAcpMcpServers, buildOpenCodeMcpConfigContent, } from './core/index.js';
+// ── core: OAuth 2.1 / PKCE flow ─────────────────────────────────────────────
+export { generateCodeVerifier, deriveCodeChallenge, generateState, discoverProtectedResource, discoverAuthServer, registerClient, getOrRegisterClient, buildAuthorizeUrl, exchangeCodeForToken, refreshAccessToken, PendingAuthCache, beginAuth, } from './core/index.js';
+// ── core: token store ───────────────────────────────────────────────────────
+export { sanitizeTokensFile, readTokensFile, getToken, setToken, clearToken, readAllTokens, isTokenExpired, } from './core/index.js';
+// ── core: install-info payload ──────────────────────────────────────────────
+export { buildMcpInstallPayload } from './core/index.js';
+// ── client: product-neutral stdio-server runtime primitives ─────────────────
+export { createMcpIdleExitController, extractRelativeRefs, isTextualMime, } from './client/index.js';
+// ── server: the generic MCP tool-hosting mechanism + kernel-run tool defs ───
+export { cancelRunTool, createMcpToolServer, errorResult, getActiveContextTool, getDaemonJson, getRunTool, listAgentsTool, okResult, postDaemonJson, requireString, RUN_TOOLS, startRunTool, toolsToList, buildToolIndex, handleToolCall, DaemonResponseTooLargeError, } from './server/index.js';
+// ── server: the generic MCP resource surface + kernel resource defs ────────
+export { activeContextResource, buildResourceIndex, handleResourceRead, KERNEL_RESOURCES, resourcesToList, } from './server/index.js';
+// ── server: gap 3's MCP-callback delegated-tool-execution def ──────────────
+export { createExecuteDelegatedToolTool } from './server/index.js';
+// ── agent-install: register an MCP server into external agents ──────────────
+export { AGENT_SLUGS, isAgentSlug, planAgentInstall, applyJsonInstall, removeJsonInstall, } from './agent-install/index.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,+EAA+E;AAC/E,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,6BAA6B,GAC9B,MAAM,iBAAiB,CAAC;AAUzB,+EAA+E;AAC/E,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,aAAa,EACb,yBAAyB,EACzB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EAChB,SAAS,GACV,MAAM,iBAAiB,CAAC;AAczB,+EAA+E;AAC/E,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,QAAQ,EACR,QAAQ,EACR,UAAU,EACV,aAAa,EACb,cAAc,GACf,MAAM,iBAAiB,CAAC;AAGzB,+EAA+E;AAC/E,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAGzD,+EAA+E;AAC/E,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,aAAa,GACd,MAAM,mBAAmB,CAAC;AAE3B,+EAA+E;AAC/E,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,WAAW,EACX,oBAAoB,EACpB,aAAa,EACb,UAAU,EACV,cAAc,EACd,QAAQ,EACR,cAAc,EACd,aAAa,EACb,SAAS,EACT,YAAY,EACZ,WAAW,EACX,cAAc,EACd,cAAc,EACd,2BAA2B,GAC5B,MAAM,mBAAmB,CAAC;AAW3B,8EAA8E;AAC9E,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAG3B,8EAA8E;AAC9E,OAAO,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAGnE,+EAA+E;AAC/E,OAAO,EACL,WAAW,EACX,WAAW,EACX,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,0BAA0B,CAAC"}

package/dist/server/daemon-client.d.ts

@@ -0,0 +1,21 @@
+/** Thrown internally when a response exceeds its byte cap; always translated to a plain `Error` before it crosses this module's public functions. */
+export declare class DaemonResponseTooLargeError extends Error {
+    readonly limitBytes: number;
+    constructor(limitBytes: number);
+}
+export interface DaemonRequestOptions {
+    /** Defaults to the global `fetch`; inject for tests. */
+    fetchImpl?: typeof fetch;
+    headers?: Record<string, string>;
+    /** Request deadline in ms. Defaults to {@link DEFAULT_TIMEOUT_MS}. */
+    timeoutMs?: number;
+    /** Maximum daemon response size in bytes before the read is aborted. Defaults to {@link DEFAULT_MAX_RESPONSE_BYTES}. */
+    maxResponseBytes?: number;
+    /** Caller-supplied cancellation signal; combined with the internal timeout signal, so either one aborts the request. */
+    signal?: AbortSignal;
+}
+/** `GET <baseUrl><route>` and return the parsed JSON response, throwing on network failure or a non-2xx status. */
+export declare function getDaemonJson<T = unknown>(baseUrl: string, route: string, options?: DaemonRequestOptions): Promise<T>;
+/** `POST body` (JSON-serialized) to `<baseUrl><route>` and return the parsed JSON response, throwing on network failure or a non-2xx status. */
+export declare function postDaemonJson<T = unknown>(baseUrl: string, route: string, body: unknown, options?: DaemonRequestOptions): Promise<T>;
+//# sourceMappingURL=daemon-client.d.ts.map

package/dist/server/daemon-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-client.d.ts","sourceRoot":"","sources":["../../src/server/daemon-client.ts"],"names":[],"mappings":"AAmCA,qJAAqJ;AACrJ,qBAAa,2BAA4B,SAAQ,KAAK;aACxB,UAAU,EAAE,MAAM;gBAAlB,UAAU,EAAE,MAAM;CAI/C;AAED,MAAM,WAAW,oBAAoB;IACnC,wDAAwD;IACxD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wHAAwH;IACxH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wHAAwH;IACxH,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AA+ID,mHAAmH;AACnH,wBAAsB,aAAa,CAAC,CAAC,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,CAAC,CAAC,CAE3H;AAED,gJAAgJ;AAChJ,wBAAsB,cAAc,CAAC,CAAC,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,CAAC,CAAC,CAE3I"}