@mcp-z/oauth-google 1.0.0 → 1.0.2

package/dist/esm/providers/loopback-oauth.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/Projects/ai/mcp-z/oauth/oauth-google/src/providers/loopback-oauth.ts"],"sourcesContent":["/**\n * Loopback OAuth Implementation (RFC 8252)\n *\n * Implements OAuth 2.0 Authorization Code Flow with PKCE using loopback interface redirection.\n * Uses ephemeral local server with OS-assigned port (RFC 8252 Section 8.3).\n */\n\nimport { addAccount, generatePKCE, getActiveAccount, getErrorTemplate, getSuccessTemplate, getToken, listAccountIds, type OAuth2TokenStorageProvider, setAccountInfo, setActiveAccount, setToken } from '@mcp-z/oauth';\nimport { OAuth2Client } from 'google-auth-library';\nimport * as http from 'http';\nimport open from 'open';\nimport { type AuthContext, type AuthFlowDescriptor, AuthRequiredError, type CachedToken, type EnrichedExtra, type LoopbackOAuthConfig } from '../types.ts';\n\ninterface TokenResponse {\n  access_token: string;\n  refresh_token?: string;\n  expires_in?: number;\n  scope?: string;\n  token_type?: string;\n}\n\n/**\n * Loopback OAuth Client (RFC 8252 Section 7.3)\n *\n * Implements OAuth 2.0 Authorization Code Flow with PKCE for native applications\n * using loopback interface redirection. Manages ephemeral OAuth flows and token persistence\n * with Keyv for key-based token storage using compound keys.\n *\n * Token key format: {accountId}:{service}:token (e.g., \"user@example.com:gmail:token\")\n */\nexport class LoopbackOAuthProvider implements OAuth2TokenStorageProvider {\n  private config: LoopbackOAuthConfig;\n\n  constructor(config: LoopbackOAuthConfig) {\n    this.config = config;\n  }\n\n  /**\n   * Get access token from Keyv using compound key\n   *\n   * @param accountId - Account identifier (email address). Required for loopback OAuth.\n   * @returns Access token for API requests\n   */\n  async getAccessToken(accountId?: string): Promise<string> {\n    const { logger, service, tokenStore } = this.config;\n\n    // Use active account if no accountId specified\n    const effectiveAccountId = accountId ?? (await getActiveAccount(tokenStore, { service }));\n\n    // If we have an accountId, try to use existing token\n    if (effectiveAccountId) {\n      logger.debug('Getting access token', { service, accountId: effectiveAccountId });\n\n      // Check Keyv for token using new key format\n      const storedToken = await getToken<CachedToken>(tokenStore, { accountId: effectiveAccountId, service });\n\n      if (storedToken && this.isTokenValid(storedToken)) {\n        logger.debug('Using stored access token', { accountId: effectiveAccountId });\n        return storedToken.accessToken;\n      }\n\n      // If stored token expired but has refresh token, try refresh\n      if (storedToken?.refreshToken) {\n        try {\n          logger.info('Refreshing expired access token', { accountId: effectiveAccountId });\n          const refreshedToken = await this.refreshAccessToken(storedToken.refreshToken);\n          await setToken(tokenStore, { accountId: effectiveAccountId, service }, refreshedToken);\n          return refreshedToken.accessToken;\n        } catch (error) {\n          logger.info('Token refresh failed, starting new OAuth flow', {\n            accountId: effectiveAccountId,\n            error: error instanceof Error ? error.message : String(error),\n          });\n          // Fall through to new OAuth flow\n        }\n      }\n    }\n\n    // No valid token or no account - check if we can start OAuth flow\n    const { headless } = this.config;\n    if (headless) {\n      // In headless mode (production), cannot start OAuth flow\n      // Throw AuthRequiredError with auth_url descriptor for MCP tool response\n      const { clientId, scope } = this.config;\n\n      // Incremental OAuth detection: Check if other accounts exist\n      const existingAccounts = await this.getExistingAccounts();\n      const hasOtherAccounts = effectiveAccountId ? existingAccounts.length > 0 && !existingAccounts.includes(effectiveAccountId) : existingAccounts.length > 0;\n\n      // Build informational OAuth URL for headless mode\n      // Note: No redirect_uri included - user must use account-add tool which starts proper ephemeral server\n      const authUrl = new URL('https://accounts.google.com/o/oauth2/v2/auth');\n      authUrl.searchParams.set('client_id', clientId);\n      authUrl.searchParams.set('response_type', 'code');\n      authUrl.searchParams.set('scope', scope);\n      authUrl.searchParams.set('access_type', 'offline');\n      authUrl.searchParams.set('prompt', 'consent');\n\n      let hint: string;\n      if (hasOtherAccounts) {\n        hint = `Existing ${service} accounts found. Use account-list to view, account-switch to change account, or account-add to add new account`;\n      } else if (effectiveAccountId) {\n        hint = `Use account-add to authenticate ${effectiveAccountId}`;\n      } else {\n        hint = 'Use account-add to authenticate interactively';\n      }\n\n      const baseDescriptor = {\n        kind: 'auth_url' as const,\n        provider: 'google',\n        url: authUrl.toString(),\n        hint,\n      };\n\n      const descriptor: AuthFlowDescriptor & { accountId?: string } = effectiveAccountId ? { ...baseDescriptor, accountId: effectiveAccountId } : baseDescriptor;\n\n      throw new AuthRequiredError(descriptor);\n    }\n\n    // Interactive mode - start ephemeral OAuth flow\n    logger.info('Starting ephemeral OAuth flow', { service, headless });\n    const { token, email } = await this.performEphemeralOAuthFlow();\n\n    // Store token with email as accountId\n    await setToken(tokenStore, { accountId: email, service }, token);\n\n    // Register account in account management system\n    await addAccount(tokenStore, { service, accountId: email });\n\n    // Set as active account so subsequent getAccessToken() calls find it\n    await setActiveAccount(tokenStore, { service, accountId: email });\n\n    // Store account metadata (email, added timestamp)\n    await setAccountInfo(\n      tokenStore,\n      { service, accountId: email },\n      {\n        email,\n        addedAt: new Date().toISOString(),\n      }\n    );\n\n    logger.info('OAuth flow completed', { service, accountId: email });\n\n    return token.accessToken;\n  }\n\n  /**\n   * Convert to googleapis-compatible OAuth2Client\n   *\n   * @param accountId - Account identifier for multi-account support (e.g., 'user@example.com')\n   * @returns OAuth2Client configured for the specified account\n   */\n  toAuth(accountId?: string): OAuth2Client {\n    const { clientId, clientSecret } = this.config;\n    const client = new OAuth2Client({\n      clientId,\n      ...(clientSecret && { clientSecret }),\n    });\n\n    // @ts-expect-error - Override protected method to inject fresh token\n    client.getRequestMetadataAsync = async (_url?: string) => {\n      // Get token from FileAuthAdapter (not from client to avoid recursion)\n      const token = await this.getAccessToken(accountId);\n\n      // Update client credentials for googleapis compatibility\n      client.credentials = {\n        access_token: token,\n        token_type: 'Bearer',\n      };\n\n      // Return headers as Map (required by authclient.js addUserProjectAndAuthHeaders)\n      const headers = new Map<string, string>();\n      headers.set('authorization', `Bearer ${token}`);\n      return { headers };\n    };\n\n    return client;\n  }\n\n  /**\n   * Authenticate new account with OAuth flow\n   * Triggers account selection, stores token, registers account\n   *\n   * @returns Email address of newly authenticated account\n   * @throws Error in headless mode (cannot open browser for OAuth)\n   */\n  async authenticateNewAccount(): Promise<string> {\n    const { logger, headless, service, tokenStore } = this.config;\n\n    if (headless) {\n      throw new Error('Cannot authenticate new account in headless mode - interactive OAuth required');\n    }\n\n    logger.info('Starting new account authentication', { service });\n\n    // Trigger OAuth with account selection\n    const { token, email } = await this.performEphemeralOAuthFlow();\n\n    // Store token\n    await setToken(tokenStore, { accountId: email, service }, token);\n\n    // Register account\n    await addAccount(tokenStore, { service, accountId: email });\n\n    // Set as active account\n    await setActiveAccount(tokenStore, { service, accountId: email });\n\n    // Store account metadata\n    await setAccountInfo(\n      tokenStore,\n      { service, accountId: email },\n      {\n        email,\n        addedAt: new Date().toISOString(),\n      }\n    );\n\n    logger.info('New account authenticated', { service, email });\n    return email;\n  }\n\n  /**\n   * Get user email from Google's userinfo endpoint (pure query)\n   * Used to query email for existing authenticated account\n   *\n   * @param accountId - Account identifier to get email for\n   * @returns User's email address\n   */\n  async getUserEmail(accountId?: string): Promise<string> {\n    // Get token for existing account\n    const token = await this.getAccessToken(accountId);\n\n    // Fetch email from Google userinfo\n    const response = await fetch('https://www.googleapis.com/oauth2/v2/userinfo', {\n      headers: {\n        Authorization: `Bearer ${token}`,\n      },\n    });\n\n    if (!response.ok) {\n      throw new Error(`Failed to get user info: ${response.status} ${await response.text()}`);\n    }\n\n    const userInfo = (await response.json()) as { email: string };\n    return userInfo.email;\n  }\n\n  /**\n   * Check for existing accounts in token storage (incremental OAuth detection)\n   *\n   * Uses key-utils helper for forward compatibility with key format changes.\n   *\n   * @returns Array of account IDs that have tokens for this service\n   */\n  private async getExistingAccounts(): Promise<string[]> {\n    const { service, tokenStore } = this.config;\n    return listAccountIds(tokenStore, service);\n  }\n\n  private isTokenValid(token: CachedToken): boolean {\n    if (!token.expiresAt) return true; // No expiry = assume valid\n    return Date.now() < token.expiresAt - 60000; // 1 minute buffer\n  }\n\n  /**\n   * Fetch user email from Google OAuth2 userinfo endpoint\n   * Called during OAuth flow to get email for accountId\n   *\n   * @param accessToken - Fresh access token from OAuth exchange\n   * @returns User's email address\n   */\n  private async fetchUserEmailFromToken(accessToken: string): Promise<string> {\n    const { logger } = this.config;\n\n    const response = await fetch('https://www.googleapis.com/oauth2/v2/userinfo', {\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n      },\n    });\n\n    if (!response.ok) {\n      const errorText = await response.text();\n      throw new Error(`Failed to fetch user email: HTTP ${response.status} - ${errorText}`);\n    }\n\n    const userInfo = (await response.json()) as { email: string };\n    const email = userInfo.email;\n\n    logger.debug('Fetched user email from Google userinfo API', { email });\n    return email;\n  }\n\n  private async performEphemeralOAuthFlow(): Promise<{ token: CachedToken; email: string }> {\n    const { clientId, scope, headless, logger, redirectUri: configRedirectUri } = this.config;\n\n    // Parse redirectUri if provided to extract host, protocol, port, and path\n    let targetHost = 'localhost'; // Default: localhost (match registered redirect URI)\n    let targetPort = 0; // Default: OS-assigned ephemeral port\n    let targetProtocol = 'http:'; // Default: http\n    let callbackPath = '/callback'; // Default callback path\n    let useConfiguredUri = false;\n\n    if (configRedirectUri) {\n      try {\n        const parsed = new URL(configRedirectUri);\n\n        // Use configured redirect URI as-is for production deployments\n        targetHost = parsed.hostname;\n        targetProtocol = parsed.protocol;\n\n        // Extract port from URL (use default ports if not specified)\n        if (parsed.port) {\n          targetPort = Number.parseInt(parsed.port, 10);\n        } else {\n          targetPort = parsed.protocol === 'https:' ? 443 : 80;\n        }\n\n        // Extract path (default to /callback if URL has no path or just '/')\n        if (parsed.pathname && parsed.pathname !== '/') {\n          callbackPath = parsed.pathname;\n        }\n\n        useConfiguredUri = true;\n\n        logger.debug('Using configured redirect URI', {\n          host: targetHost,\n          protocol: targetProtocol,\n          port: targetPort,\n          path: callbackPath,\n          redirectUri: configRedirectUri,\n        });\n      } catch (error) {\n        logger.warn('Failed to parse redirectUri, using ephemeral defaults', {\n          redirectUri: configRedirectUri,\n          error: error instanceof Error ? error.message : String(error),\n        });\n        // Continue with defaults (127.0.0.1, port 0, http, /callback)\n      }\n    }\n\n    return new Promise((resolve, reject) => {\n      // Generate PKCE challenge\n      const { verifier: codeVerifier, challenge: codeChallenge } = generatePKCE();\n\n      let server: http.Server | null = null;\n      let serverPort: number;\n      let finalRedirectUri: string; // Will be set in server.listen callback\n\n      // Create ephemeral server with OS-assigned port (RFC 8252)\n      server = http.createServer(async (req, res) => {\n        if (!req.url) {\n          res.writeHead(400, { 'Content-Type': 'text/html' });\n          res.end(getErrorTemplate('Invalid request'));\n          server?.close();\n          reject(new Error('Invalid request: missing URL'));\n          return;\n        }\n        const url = new URL(req.url, `http://127.0.0.1:${serverPort}`);\n\n        if (url.pathname === callbackPath) {\n          const code = url.searchParams.get('code');\n          const error = url.searchParams.get('error');\n\n          if (error) {\n            res.writeHead(400, { 'Content-Type': 'text/html' });\n            res.end(getErrorTemplate(error));\n            server?.close();\n            reject(new Error(`OAuth error: ${error}`));\n            return;\n          }\n\n          if (!code) {\n            res.writeHead(400, { 'Content-Type': 'text/html' });\n            res.end(getErrorTemplate('No authorization code received'));\n            server?.close();\n            reject(new Error('No authorization code received'));\n            return;\n          }\n\n          try {\n            // Exchange code for token (must use same redirect_uri as in authorization request)\n            const tokenResponse = await this.exchangeCodeForToken(code, codeVerifier, finalRedirectUri);\n\n            // Build cached token\n            const cachedToken: CachedToken = {\n              accessToken: tokenResponse.access_token,\n              ...(tokenResponse.refresh_token !== undefined && { refreshToken: tokenResponse.refresh_token }),\n              ...(tokenResponse.expires_in !== undefined && { expiresAt: Date.now() + tokenResponse.expires_in * 1000 }),\n              ...(tokenResponse.scope !== undefined && { scope: tokenResponse.scope }),\n            };\n\n            // Fetch user email immediately using the new access token\n            const email = await this.fetchUserEmailFromToken(tokenResponse.access_token);\n\n            res.writeHead(200, { 'Content-Type': 'text/html' });\n            res.end(getSuccessTemplate());\n            server?.close();\n            resolve({ token: cachedToken, email });\n          } catch (exchangeError) {\n            logger.error('Token exchange failed', { error: exchangeError instanceof Error ? exchangeError.message : String(exchangeError) });\n            res.writeHead(500, { 'Content-Type': 'text/html' });\n            res.end(getErrorTemplate('Token exchange failed'));\n            server?.close();\n            reject(exchangeError);\n          }\n        } else {\n          res.writeHead(404, { 'Content-Type': 'text/plain' });\n          res.end('Not Found');\n        }\n      });\n\n      // Listen on targetPort (0 for OS assignment, or custom port from redirectUri)\n      server.listen(targetPort, targetHost, () => {\n        const address = server?.address();\n        if (!address || typeof address === 'string') {\n          server?.close();\n          reject(new Error('Failed to start ephemeral server'));\n          return;\n        }\n\n        serverPort = address.port;\n\n        // Construct final redirect URI\n        if (useConfiguredUri && configRedirectUri) {\n          // Use configured redirect URI as-is for production\n          finalRedirectUri = configRedirectUri;\n        } else {\n          // Construct ephemeral redirect URI with actual server port\n          finalRedirectUri = `${targetProtocol}//${targetHost}:${serverPort}${callbackPath}`;\n        }\n\n        // Build auth URL\n        const authUrl = new URL('https://accounts.google.com/o/oauth2/v2/auth');\n        authUrl.searchParams.set('client_id', clientId);\n        authUrl.searchParams.set('redirect_uri', finalRedirectUri);\n        authUrl.searchParams.set('response_type', 'code');\n        authUrl.searchParams.set('scope', scope);\n        authUrl.searchParams.set('access_type', 'offline');\n        authUrl.searchParams.set('prompt', 'consent');\n        authUrl.searchParams.set('code_challenge', codeChallenge);\n        authUrl.searchParams.set('code_challenge_method', 'S256');\n\n        logger.info('Ephemeral OAuth server started', { port: serverPort, headless });\n\n        if (headless) {\n          // Headless mode: Print auth URL to stderr (stdout is MCP protocol)\n          console.error('\\n🔐 OAuth Authorization Required');\n          console.error('📋 Please visit this URL in your browser:\\n');\n          console.error(`   ${authUrl.toString()}\\n`);\n          console.error('⏳ Waiting for authorization...\\n');\n        } else {\n          // Interactive mode: Open browser automatically\n          logger.info('Opening browser for OAuth authorization');\n          open(authUrl.toString()).catch((error: Error) => {\n            logger.info('Failed to open browser automatically', { error: error.message });\n            console.error('\\n🔐 OAuth Authorization Required');\n            console.error(`   ${authUrl.toString()}\\n`);\n          });\n        }\n      });\n\n      // Timeout after 5 minutes\n      setTimeout(\n        () => {\n          if (server) {\n            server.close();\n            reject(new Error('OAuth flow timed out after 5 minutes'));\n          }\n        },\n        5 * 60 * 1000\n      );\n    });\n  }\n\n  private async exchangeCodeForToken(code: string, codeVerifier: string, redirectUri: string): Promise<TokenResponse> {\n    const { clientId, clientSecret } = this.config;\n\n    const tokenUrl = 'https://oauth2.googleapis.com/token';\n    const params: Record<string, string> = {\n      code,\n      client_id: clientId,\n      redirect_uri: redirectUri,\n      grant_type: 'authorization_code',\n      code_verifier: codeVerifier,\n    };\n    if (clientSecret) {\n      params.client_secret = clientSecret;\n    }\n    const body = new URLSearchParams(params);\n\n    const response = await fetch(tokenUrl, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: body.toString(),\n    });\n\n    if (!response.ok) {\n      const errorText = await response.text();\n      throw new Error(`Token exchange failed: ${response.status} ${errorText}`);\n    }\n\n    return (await response.json()) as TokenResponse;\n  }\n\n  private async refreshAccessToken(refreshToken: string): Promise<CachedToken> {\n    const { clientId, clientSecret } = this.config;\n\n    const tokenUrl = 'https://oauth2.googleapis.com/token';\n    const params: Record<string, string> = {\n      refresh_token: refreshToken,\n      client_id: clientId,\n      grant_type: 'refresh_token',\n    };\n    if (clientSecret) {\n      params.client_secret = clientSecret;\n    }\n    const body = new URLSearchParams(params);\n\n    const response = await fetch(tokenUrl, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: body.toString(),\n    });\n\n    if (!response.ok) {\n      const errorText = await response.text();\n      throw new Error(`Token refresh failed: ${response.status} ${errorText}`);\n    }\n\n    const tokenResponse = (await response.json()) as TokenResponse;\n\n    return {\n      accessToken: tokenResponse.access_token,\n      refreshToken: refreshToken, // Keep original refresh token\n      ...(tokenResponse.expires_in !== undefined && { expiresAt: Date.now() + tokenResponse.expires_in * 1000 }),\n      ...(tokenResponse.scope !== undefined && { scope: tokenResponse.scope }),\n    };\n  }\n\n  /**\n   * Create authentication middleware for MCP tools, resources, and prompts\n   *\n   * Returns position-aware middleware wrappers that enrich handlers with authentication context.\n   * The middleware handles token retrieval, refresh, and AuthRequiredError automatically.\n   *\n   * Single-user middleware for desktop/CLI apps where ONE user runs the entire process:\n   * - Desktop applications (Claude Desktop)\n   * - CLI tools (Gmail CLI)\n   * - Personal automation scripts\n   *\n   * All requests use token lookups based on the active account or account override.\n   *\n   * @returns Object with withToolAuth, withResourceAuth, withPromptAuth methods\n   *\n   * @example\n   * ```typescript\n   * const loopback = new LoopbackOAuthProvider({ service: 'gmail', ... });\n   * const authMiddleware = loopback.authMiddleware();\n   * const tools = toolFactories.map(f => f()).map(authMiddleware.withToolAuth);\n   * const resources = resourceFactories.map(f => f()).map(authMiddleware.withResourceAuth);\n   * const prompts = promptFactories.map(f => f()).map(authMiddleware.withPromptAuth);\n   * ```\n   */\n  authMiddleware() {\n    const { service, tokenStore, logger } = this.config;\n\n    // Shared wrapper logic - extracts extra parameter from specified position\n    // Generic T captures the actual module type; handler is cast from unknown to callable\n    const wrapAtPosition = <T extends { name: string; handler: unknown; [key: string]: unknown }>(module: T, extraPosition: number): T => {\n      const operation = module.name;\n      const originalHandler = module.handler as (...args: unknown[]) => Promise<unknown>;\n\n      const wrappedHandler = async (...allArgs: unknown[]) => {\n        // Extract extra from the correct position\n        const extra = allArgs[extraPosition] as EnrichedExtra;\n\n        try {\n          // Check for backchannel override via _meta.accountId\n          let accountId: string | undefined;\n          try {\n            accountId = (extra as { _meta?: { accountId?: string } })._meta?.accountId ?? (await getActiveAccount(tokenStore, { service }));\n          } catch (error) {\n            if (error instanceof Error && ((error as { code?: string }).code === 'REQUIRES_AUTHENTICATION' || error.name === 'AccountManagerError')) {\n              accountId = undefined;\n            } else {\n              throw error;\n            }\n          }\n\n          // Eagerly validate token exists or trigger OAuth flow\n          await this.getAccessToken(accountId);\n\n          // After OAuth flow completes, get the actual accountId (email) that was set\n          const effectiveAccountId = accountId ?? (await getActiveAccount(tokenStore, { service }));\n          if (!effectiveAccountId) {\n            throw new Error(`No account found after OAuth flow for service ${service}`);\n          }\n\n          const auth = this.toAuth(effectiveAccountId);\n\n          // Inject authContext and logger into extra\n          (extra as { authContext?: AuthContext }).authContext = {\n            auth,\n            accountId: effectiveAccountId,\n          };\n          (extra as { logger?: unknown }).logger = logger;\n\n          // Call original handler with all args\n          return await originalHandler(...allArgs);\n        } catch (error) {\n          if (error instanceof AuthRequiredError) {\n            logger.info('Authentication required', {\n              service,\n              tool: operation,\n              descriptor: error.descriptor,\n            });\n            // Return auth_required response wrapped in { result } to match tool outputSchema pattern\n            // Tools define outputSchema: z.object({ result: discriminatedUnion(...) }) where auth_required is a branch\n            const authRequiredResponse = {\n              type: 'auth_required' as const,\n              provider: service,\n              message: `Authentication required for ${operation}. Please authenticate with ${service}.`,\n              url: error.descriptor.kind === 'auth_url' ? error.descriptor.url : undefined,\n            };\n\n            return {\n              content: [\n                {\n                  type: 'text' as const,\n                  text: JSON.stringify({ result: authRequiredResponse }),\n                },\n              ],\n              structuredContent: { result: authRequiredResponse },\n            };\n          }\n          throw error;\n        }\n      };\n\n      return {\n        ...module,\n        handler: wrappedHandler,\n      } as T;\n    };\n\n    return {\n      withToolAuth: <T extends { name: string; config: unknown; handler: unknown }>(module: T) => wrapAtPosition(module, 1),\n      withResourceAuth: <T extends { name: string; template?: unknown; config?: unknown; handler: unknown }>(module: T) => wrapAtPosition(module, 2),\n      withPromptAuth: <T extends { name: string; config: unknown; handler: unknown }>(module: T) => wrapAtPosition(module, 0),\n    };\n  }\n}\n\n/**\n * Create a loopback OAuth client for Google services\n * Works for both stdio and HTTP transports\n */\nexport function createGoogleFileAuth(config: LoopbackOAuthConfig): OAuth2TokenStorageProvider {\n  return new LoopbackOAuthProvider(config);\n}\n"],"names":["addAccount","generatePKCE","getActiveAccount","getErrorTemplate","getSuccessTemplate","getToken","listAccountIds","setAccountInfo","setActiveAccount","setToken","OAuth2Client","http","open","AuthRequiredError","LoopbackOAuthProvider","getAccessToken","accountId","logger","service","tokenStore","config","effectiveAccountId","debug","storedToken","isTokenValid","accessToken","refreshToken","info","refreshedToken","refreshAccessToken","error","Error","message","String","headless","clientId","scope","existingAccounts","getExistingAccounts","hasOtherAccounts","length","includes","authUrl","URL","searchParams","set","hint","baseDescriptor","kind","provider","url","toString","descriptor","token","email","performEphemeralOAuthFlow","addedAt","Date","toISOString","toAuth","clientSecret","client","getRequestMetadataAsync","_url","credentials","access_token","token_type","headers","Map","authenticateNewAccount","getUserEmail","response","fetch","Authorization","ok","status","text","userInfo","json","expiresAt","now","fetchUserEmailFromToken","errorText","redirectUri","configRedirectUri","targetHost","targetPort","targetProtocol","callbackPath","useConfiguredUri","parsed","hostname","protocol","port","Number","parseInt","pathname","host","path","warn","Promise","resolve","reject","verifier","codeVerifier","challenge","codeChallenge","server","serverPort","finalRedirectUri","createServer","req","res","writeHead","end","close","code","get","tokenResponse","exchangeCodeForToken","cachedToken","refresh_token","undefined","expires_in","exchangeError","listen","address","console","catch","setTimeout","tokenUrl","params","client_id","redirect_uri","grant_type","code_verifier","client_secret","body","URLSearchParams","method","authMiddleware","wrapAtPosition","module","extraPosition","operation","name","originalHandler","handler","wrappedHandler","allArgs","extra","_meta","auth","authContext","tool","authRequiredResponse","type","content","JSON","stringify","result","structuredContent","withToolAuth","withResourceAuth","withPromptAuth","createGoogleFileAuth"],"mappings":"AAAA;;;;;CAKC,GAED,SAASA,UAAU,EAAEC,YAAY,EAAEC,gBAAgB,EAAEC,gBAAgB,EAAEC,kBAAkB,EAAEC,QAAQ,EAAEC,cAAc,EAAmCC,cAAc,EAAEC,gBAAgB,EAAEC,QAAQ,QAAQ,eAAe;AACvN,SAASC,YAAY,QAAQ,sBAAsB;AACnD,YAAYC,UAAU,OAAO;AAC7B,OAAOC,UAAU,OAAO;AACxB,SAAoDC,iBAAiB,QAAwE,cAAc;AAU3J;;;;;;;;CAQC,GACD,OAAO,MAAMC;IAOX;;;;;GAKC,GACD,MAAMC,eAAeC,SAAkB,EAAmB;QACxD,MAAM,EAAEC,MAAM,EAAEC,OAAO,EAAEC,UAAU,EAAE,GAAG,IAAI,CAACC,MAAM;QAEnD,+CAA+C;QAC/C,MAAMC,qBAAqBL,sBAAAA,uBAAAA,YAAc,MAAMd,iBAAiBiB,YAAY;YAAED;QAAQ;QAEtF,qDAAqD;QACrD,IAAIG,oBAAoB;YACtBJ,OAAOK,KAAK,CAAC,wBAAwB;gBAAEJ;gBAASF,WAAWK;YAAmB;YAE9E,4CAA4C;YAC5C,MAAME,cAAc,MAAMlB,SAAsBc,YAAY;gBAAEH,WAAWK;gBAAoBH;YAAQ;YAErG,IAAIK,eAAe,IAAI,CAACC,YAAY,CAACD,cAAc;gBACjDN,OAAOK,KAAK,CAAC,6BAA6B;oBAAEN,WAAWK;gBAAmB;gBAC1E,OAAOE,YAAYE,WAAW;YAChC;YAEA,6DAA6D;YAC7D,IAAIF,wBAAAA,kCAAAA,YAAaG,YAAY,EAAE;gBAC7B,IAAI;oBACFT,OAAOU,IAAI,CAAC,mCAAmC;wBAAEX,WAAWK;oBAAmB;oBAC/E,MAAMO,iBAAiB,MAAM,IAAI,CAACC,kBAAkB,CAACN,YAAYG,YAAY;oBAC7E,MAAMjB,SAASU,YAAY;wBAAEH,WAAWK;wBAAoBH;oBAAQ,GAAGU;oBACvE,OAAOA,eAAeH,WAAW;gBACnC,EAAE,OAAOK,OAAO;oBACdb,OAAOU,IAAI,CAAC,iDAAiD;wBAC3DX,WAAWK;wBACXS,OAAOA,iBAAiBC,QAAQD,MAAME,OAAO,GAAGC,OAAOH;oBACzD;gBACA,iCAAiC;gBACnC;YACF;QACF;QAEA,kEAAkE;QAClE,MAAM,EAAEI,QAAQ,EAAE,GAAG,IAAI,CAACd,MAAM;QAChC,IAAIc,UAAU;YACZ,yDAAyD;YACzD,yEAAyE;YACzE,MAAM,EAAEC,QAAQ,EAAEC,KAAK,EAAE,GAAG,IAAI,CAAChB,MAAM;YAEvC,6DAA6D;YAC7D,MAAMiB,mBAAmB,MAAM,IAAI,CAACC,mBAAmB;YACvD,MAAMC,mBAAmBlB,qBAAqBgB,iBAAiBG,MAAM,GAAG,KAAK,CAACH,iBAAiBI,QAAQ,CAACpB,sBAAsBgB,iBAAiBG,MAAM,GAAG;YAExJ,kDAAkD;YAClD,uGAAuG;YACvG,MAAME,UAAU,IAAIC,IAAI;YACxBD,QAAQE,YAAY,CAACC,GAAG,CAAC,aAAaV;YACtCO,QAAQE,YAAY,CAACC,GAAG,CAAC,iBAAiB;YAC1CH,QAAQE,YAAY,CAACC,GAAG,CAAC,SAAST;YAClCM,QAAQE,YAAY,CAACC,GAAG,CAAC,eAAe;YACxCH,QAAQE,YAAY,CAACC,GAAG,CAAC,UAAU;YAEnC,IAAIC;YACJ,IAAIP,kBAAkB;gBACpBO,OAAO,CAAC,SAAS,EAAE5B,QAAQ,8GAA8G,CAAC;YAC5I,OAAO,IAAIG,oBAAoB;gBAC7ByB,OAAO,CAAC,gCAAgC,EAAEzB,oBAAoB;YAChE,OAAO;gBACLyB,OAAO;YACT;YAEA,MAAMC,iBAAiB;gBACrBC,MAAM;gBACNC,UAAU;gBACVC,KAAKR,QAAQS,QAAQ;gBACrBL;YACF;YAEA,MAAMM,aAA0D/B,qBAAqB;gBAAE,GAAG0B,cAAc;gBAAE/B,WAAWK;YAAmB,IAAI0B;YAE5I,MAAM,IAAIlC,kBAAkBuC;QAC9B;QAEA,gDAAgD;QAChDnC,OAAOU,IAAI,CAAC,iCAAiC;YAAET;YAASgB;QAAS;QACjE,MAAM,EAAEmB,KAAK,EAAEC,KAAK,EAAE,GAAG,MAAM,IAAI,CAACC,yBAAyB;QAE7D,sCAAsC;QACtC,MAAM9C,SAASU,YAAY;YAAEH,WAAWsC;YAAOpC;QAAQ,GAAGmC;QAE1D,gDAAgD;QAChD,MAAMrD,WAAWmB,YAAY;YAAED;YAASF,WAAWsC;QAAM;QAEzD,qEAAqE;QACrE,MAAM9C,iBAAiBW,YAAY;YAAED;YAASF,WAAWsC;QAAM;QAE/D,kDAAkD;QAClD,MAAM/C,eACJY,YACA;YAAED;YAASF,WAAWsC;QAAM,GAC5B;YACEA;YACAE,SAAS,IAAIC,OAAOC,WAAW;QACjC;QAGFzC,OAAOU,IAAI,CAAC,wBAAwB;YAAET;YAASF,WAAWsC;QAAM;QAEhE,OAAOD,MAAM5B,WAAW;IAC1B;IAEA;;;;;GAKC,GACDkC,OAAO3C,SAAkB,EAAgB;QACvC,MAAM,EAAEmB,QAAQ,EAAEyB,YAAY,EAAE,GAAG,IAAI,CAACxC,MAAM;QAC9C,MAAMyC,SAAS,IAAInD,aAAa;YAC9ByB;YACA,GAAIyB,gBAAgB;gBAAEA;YAAa,CAAC;QACtC;QAEA,qEAAqE;QACrEC,OAAOC,uBAAuB,GAAG,OAAOC;YACtC,sEAAsE;YACtE,MAAMV,QAAQ,MAAM,IAAI,CAACtC,cAAc,CAACC;YAExC,yDAAyD;YACzD6C,OAAOG,WAAW,GAAG;gBACnBC,cAAcZ;gBACda,YAAY;YACd;YAEA,iFAAiF;YACjF,MAAMC,UAAU,IAAIC;YACpBD,QAAQtB,GAAG,CAAC,iBAAiB,CAAC,OAAO,EAAEQ,OAAO;YAC9C,OAAO;gBAAEc;YAAQ;QACnB;QAEA,OAAON;IACT;IAEA;;;;;;GAMC,GACD,MAAMQ,yBAA0C;QAC9C,MAAM,EAAEpD,MAAM,EAAEiB,QAAQ,EAAEhB,OAAO,EAAEC,UAAU,EAAE,GAAG,IAAI,CAACC,MAAM;QAE7D,IAAIc,UAAU;YACZ,MAAM,IAAIH,MAAM;QAClB;QAEAd,OAAOU,IAAI,CAAC,uCAAuC;YAAET;QAAQ;QAE7D,uCAAuC;QACvC,MAAM,EAAEmC,KAAK,EAAEC,KAAK,EAAE,GAAG,MAAM,IAAI,CAACC,yBAAyB;QAE7D,cAAc;QACd,MAAM9C,SAASU,YAAY;YAAEH,WAAWsC;YAAOpC;QAAQ,GAAGmC;QAE1D,mBAAmB;QACnB,MAAMrD,WAAWmB,YAAY;YAAED;YAASF,WAAWsC;QAAM;QAEzD,wBAAwB;QACxB,MAAM9C,iBAAiBW,YAAY;YAAED;YAASF,WAAWsC;QAAM;QAE/D,yBAAyB;QACzB,MAAM/C,eACJY,YACA;YAAED;YAASF,WAAWsC;QAAM,GAC5B;YACEA;YACAE,SAAS,IAAIC,OAAOC,WAAW;QACjC;QAGFzC,OAAOU,IAAI,CAAC,6BAA6B;YAAET;YAASoC;QAAM;QAC1D,OAAOA;IACT;IAEA;;;;;;GAMC,GACD,MAAMgB,aAAatD,SAAkB,EAAmB;QACtD,iCAAiC;QACjC,MAAMqC,QAAQ,MAAM,IAAI,CAACtC,cAAc,CAACC;QAExC,mCAAmC;QACnC,MAAMuD,WAAW,MAAMC,MAAM,iDAAiD;YAC5EL,SAAS;gBACPM,eAAe,CAAC,OAAO,EAAEpB,OAAO;YAClC;QACF;QAEA,IAAI,CAACkB,SAASG,EAAE,EAAE;YAChB,MAAM,IAAI3C,MAAM,CAAC,yBAAyB,EAAEwC,SAASI,MAAM,CAAC,CAAC,EAAE,MAAMJ,SAASK,IAAI,IAAI;QACxF;QAEA,MAAMC,WAAY,MAAMN,SAASO,IAAI;QACrC,OAAOD,SAASvB,KAAK;IACvB;IAEA;;;;;;GAMC,GACD,MAAchB,sBAAyC;QACrD,MAAM,EAAEpB,OAAO,EAAEC,UAAU,EAAE,GAAG,IAAI,CAACC,MAAM;QAC3C,OAAOd,eAAea,YAAYD;IACpC;IAEQM,aAAa6B,KAAkB,EAAW;QAChD,IAAI,CAACA,MAAM0B,SAAS,EAAE,OAAO,MAAM,2BAA2B;QAC9D,OAAOtB,KAAKuB,GAAG,KAAK3B,MAAM0B,SAAS,GAAG,OAAO,kBAAkB;IACjE;IAEA;;;;;;GAMC,GACD,MAAcE,wBAAwBxD,WAAmB,EAAmB;QAC1E,MAAM,EAAER,MAAM,EAAE,GAAG,IAAI,CAACG,MAAM;QAE9B,MAAMmD,WAAW,MAAMC,MAAM,iDAAiD;YAC5EL,SAAS;gBACPM,eAAe,CAAC,OAAO,EAAEhD,aAAa;YACxC;QACF;QAEA,IAAI,CAAC8C,SAASG,EAAE,EAAE;YAChB,MAAMQ,YAAY,MAAMX,SAASK,IAAI;YACrC,MAAM,IAAI7C,MAAM,CAAC,iCAAiC,EAAEwC,SAASI,MAAM,CAAC,GAAG,EAAEO,WAAW;QACtF;QAEA,MAAML,WAAY,MAAMN,SAASO,IAAI;QACrC,MAAMxB,QAAQuB,SAASvB,KAAK;QAE5BrC,OAAOK,KAAK,CAAC,+CAA+C;YAAEgC;QAAM;QACpE,OAAOA;IACT;IAEA,MAAcC,4BAA4E;QACxF,MAAM,EAAEpB,QAAQ,EAAEC,KAAK,EAAEF,QAAQ,EAAEjB,MAAM,EAAEkE,aAAaC,iBAAiB,EAAE,GAAG,IAAI,CAAChE,MAAM;QAEzF,0EAA0E;QAC1E,IAAIiE,aAAa,aAAa,qDAAqD;QACnF,IAAIC,aAAa,GAAG,sCAAsC;QAC1D,IAAIC,iBAAiB,SAAS,gBAAgB;QAC9C,IAAIC,eAAe,aAAa,wBAAwB;QACxD,IAAIC,mBAAmB;QAEvB,IAAIL,mBAAmB;YACrB,IAAI;gBACF,MAAMM,SAAS,IAAI/C,IAAIyC;gBAEvB,+DAA+D;gBAC/DC,aAAaK,OAAOC,QAAQ;gBAC5BJ,iBAAiBG,OAAOE,QAAQ;gBAEhC,6DAA6D;gBAC7D,IAAIF,OAAOG,IAAI,EAAE;oBACfP,aAAaQ,OAAOC,QAAQ,CAACL,OAAOG,IAAI,EAAE;gBAC5C,OAAO;oBACLP,aAAaI,OAAOE,QAAQ,KAAK,WAAW,MAAM;gBACpD;gBAEA,qEAAqE;gBACrE,IAAIF,OAAOM,QAAQ,IAAIN,OAAOM,QAAQ,KAAK,KAAK;oBAC9CR,eAAeE,OAAOM,QAAQ;gBAChC;gBAEAP,mBAAmB;gBAEnBxE,OAAOK,KAAK,CAAC,iCAAiC;oBAC5C2E,MAAMZ;oBACNO,UAAUL;oBACVM,MAAMP;oBACNY,MAAMV;oBACNL,aAAaC;gBACf;YACF,EAAE,OAAOtD,OAAO;gBACdb,OAAOkF,IAAI,CAAC,yDAAyD;oBACnEhB,aAAaC;oBACbtD,OAAOA,iBAAiBC,QAAQD,MAAME,OAAO,GAAGC,OAAOH;gBACzD;YACA,8DAA8D;YAChE;QACF;QAEA,OAAO,IAAIsE,QAAQ,CAACC,SAASC;YAC3B,0BAA0B;YAC1B,MAAM,EAAEC,UAAUC,YAAY,EAAEC,WAAWC,aAAa,EAAE,GAAGzG;YAE7D,IAAI0G,SAA6B;YACjC,IAAIC;YACJ,IAAIC,kBAA0B,wCAAwC;YAEtE,2DAA2D;YAC3DF,SAAShG,KAAKmG,YAAY,CAAC,OAAOC,KAAKC;gBACrC,IAAI,CAACD,IAAI7D,GAAG,EAAE;oBACZ8D,IAAIC,SAAS,CAAC,KAAK;wBAAE,gBAAgB;oBAAY;oBACjDD,IAAIE,GAAG,CAAC/G,iBAAiB;oBACzBwG,mBAAAA,6BAAAA,OAAQQ,KAAK;oBACbb,OAAO,IAAIvE,MAAM;oBACjB;gBACF;gBACA,MAAMmB,MAAM,IAAIP,IAAIoE,IAAI7D,GAAG,EAAE,CAAC,iBAAiB,EAAE0D,YAAY;gBAE7D,IAAI1D,IAAI8C,QAAQ,KAAKR,cAAc;oBACjC,MAAM4B,OAAOlE,IAAIN,YAAY,CAACyE,GAAG,CAAC;oBAClC,MAAMvF,QAAQoB,IAAIN,YAAY,CAACyE,GAAG,CAAC;oBAEnC,IAAIvF,OAAO;wBACTkF,IAAIC,SAAS,CAAC,KAAK;4BAAE,gBAAgB;wBAAY;wBACjDD,IAAIE,GAAG,CAAC/G,iBAAiB2B;wBACzB6E,mBAAAA,6BAAAA,OAAQQ,KAAK;wBACbb,OAAO,IAAIvE,MAAM,CAAC,aAAa,EAAED,OAAO;wBACxC;oBACF;oBAEA,IAAI,CAACsF,MAAM;wBACTJ,IAAIC,SAAS,CAAC,KAAK;4BAAE,gBAAgB;wBAAY;wBACjDD,IAAIE,GAAG,CAAC/G,iBAAiB;wBACzBwG,mBAAAA,6BAAAA,OAAQQ,KAAK;wBACbb,OAAO,IAAIvE,MAAM;wBACjB;oBACF;oBAEA,IAAI;wBACF,mFAAmF;wBACnF,MAAMuF,gBAAgB,MAAM,IAAI,CAACC,oBAAoB,CAACH,MAAMZ,cAAcK;wBAE1E,qBAAqB;wBACrB,MAAMW,cAA2B;4BAC/B/F,aAAa6F,cAAcrD,YAAY;4BACvC,GAAIqD,cAAcG,aAAa,KAAKC,aAAa;gCAAEhG,cAAc4F,cAAcG,aAAa;4BAAC,CAAC;4BAC9F,GAAIH,cAAcK,UAAU,KAAKD,aAAa;gCAAE3C,WAAWtB,KAAKuB,GAAG,KAAKsC,cAAcK,UAAU,GAAG;4BAAK,CAAC;4BACzG,GAAIL,cAAclF,KAAK,KAAKsF,aAAa;gCAAEtF,OAAOkF,cAAclF,KAAK;4BAAC,CAAC;wBACzE;wBAEA,0DAA0D;wBAC1D,MAAMkB,QAAQ,MAAM,IAAI,CAAC2B,uBAAuB,CAACqC,cAAcrD,YAAY;wBAE3E+C,IAAIC,SAAS,CAAC,KAAK;4BAAE,gBAAgB;wBAAY;wBACjDD,IAAIE,GAAG,CAAC9G;wBACRuG,mBAAAA,6BAAAA,OAAQQ,KAAK;wBACbd,QAAQ;4BAAEhD,OAAOmE;4BAAalE;wBAAM;oBACtC,EAAE,OAAOsE,eAAe;wBACtB3G,OAAOa,KAAK,CAAC,yBAAyB;4BAAEA,OAAO8F,yBAAyB7F,QAAQ6F,cAAc5F,OAAO,GAAGC,OAAO2F;wBAAe;wBAC9HZ,IAAIC,SAAS,CAAC,KAAK;4BAAE,gBAAgB;wBAAY;wBACjDD,IAAIE,GAAG,CAAC/G,iBAAiB;wBACzBwG,mBAAAA,6BAAAA,OAAQQ,KAAK;wBACbb,OAAOsB;oBACT;gBACF,OAAO;oBACLZ,IAAIC,SAAS,CAAC,KAAK;wBAAE,gBAAgB;oBAAa;oBAClDD,IAAIE,GAAG,CAAC;gBACV;YACF;YAEA,8EAA8E;YAC9EP,OAAOkB,MAAM,CAACvC,YAAYD,YAAY;gBACpC,MAAMyC,UAAUnB,mBAAAA,6BAAAA,OAAQmB,OAAO;gBAC/B,IAAI,CAACA,WAAW,OAAOA,YAAY,UAAU;oBAC3CnB,mBAAAA,6BAAAA,OAAQQ,KAAK;oBACbb,OAAO,IAAIvE,MAAM;oBACjB;gBACF;gBAEA6E,aAAakB,QAAQjC,IAAI;gBAEzB,+BAA+B;gBAC/B,IAAIJ,oBAAoBL,mBAAmB;oBACzC,mDAAmD;oBACnDyB,mBAAmBzB;gBACrB,OAAO;oBACL,2DAA2D;oBAC3DyB,mBAAmB,GAAGtB,eAAe,EAAE,EAAEF,WAAW,CAAC,EAAEuB,aAAapB,cAAc;gBACpF;gBAEA,iBAAiB;gBACjB,MAAM9C,UAAU,IAAIC,IAAI;gBACxBD,QAAQE,YAAY,CAACC,GAAG,CAAC,aAAaV;gBACtCO,QAAQE,YAAY,CAACC,GAAG,CAAC,gBAAgBgE;gBACzCnE,QAAQE,YAAY,CAACC,GAAG,CAAC,iBAAiB;gBAC1CH,QAAQE,YAAY,CAACC,GAAG,CAAC,SAAST;gBAClCM,QAAQE,YAAY,CAACC,GAAG,CAAC,eAAe;gBACxCH,QAAQE,YAAY,CAACC,GAAG,CAAC,UAAU;gBACnCH,QAAQE,YAAY,CAACC,GAAG,CAAC,kBAAkB6D;gBAC3ChE,QAAQE,YAAY,CAACC,GAAG,CAAC,yBAAyB;gBAElD5B,OAAOU,IAAI,CAAC,kCAAkC;oBAAEkE,MAAMe;oBAAY1E;gBAAS;gBAE3E,IAAIA,UAAU;oBACZ,mEAAmE;oBACnE6F,QAAQjG,KAAK,CAAC;oBACdiG,QAAQjG,KAAK,CAAC;oBACdiG,QAAQjG,KAAK,CAAC,CAAC,GAAG,EAAEY,QAAQS,QAAQ,GAAG,EAAE,CAAC;oBAC1C4E,QAAQjG,KAAK,CAAC;gBAChB,OAAO;oBACL,+CAA+C;oBAC/Cb,OAAOU,IAAI,CAAC;oBACZf,KAAK8B,QAAQS,QAAQ,IAAI6E,KAAK,CAAC,CAAClG;wBAC9Bb,OAAOU,IAAI,CAAC,wCAAwC;4BAAEG,OAAOA,MAAME,OAAO;wBAAC;wBAC3E+F,QAAQjG,KAAK,CAAC;wBACdiG,QAAQjG,KAAK,CAAC,CAAC,GAAG,EAAEY,QAAQS,QAAQ,GAAG,EAAE,CAAC;oBAC5C;gBACF;YACF;YAEA,0BAA0B;YAC1B8E,WACE;gBACE,IAAItB,QAAQ;oBACVA,OAAOQ,KAAK;oBACZb,OAAO,IAAIvE,MAAM;gBACnB;YACF,GACA,IAAI,KAAK;QAEb;IACF;IAEA,MAAcwF,qBAAqBH,IAAY,EAAEZ,YAAoB,EAAErB,WAAmB,EAA0B;QAClH,MAAM,EAAEhD,QAAQ,EAAEyB,YAAY,EAAE,GAAG,IAAI,CAACxC,MAAM;QAE9C,MAAM8G,WAAW;QACjB,MAAMC,SAAiC;YACrCf;YACAgB,WAAWjG;YACXkG,cAAclD;YACdmD,YAAY;YACZC,eAAe/B;QACjB;QACA,IAAI5C,cAAc;YAChBuE,OAAOK,aAAa,GAAG5E;QACzB;QACA,MAAM6E,OAAO,IAAIC,gBAAgBP;QAEjC,MAAM5D,WAAW,MAAMC,MAAM0D,UAAU;YACrCS,QAAQ;YACRxE,SAAS;gBACP,gBAAgB;YAClB;YACAsE,MAAMA,KAAKtF,QAAQ;QACrB;QAEA,IAAI,CAACoB,SAASG,EAAE,EAAE;YAChB,MAAMQ,YAAY,MAAMX,SAASK,IAAI;YACrC,MAAM,IAAI7C,MAAM,CAAC,uBAAuB,EAAEwC,SAASI,MAAM,CAAC,CAAC,EAAEO,WAAW;QAC1E;QAEA,OAAQ,MAAMX,SAASO,IAAI;IAC7B;IAEA,MAAcjD,mBAAmBH,YAAoB,EAAwB;QAC3E,MAAM,EAAES,QAAQ,EAAEyB,YAAY,EAAE,GAAG,IAAI,CAACxC,MAAM;QAE9C,MAAM8G,WAAW;QACjB,MAAMC,SAAiC;YACrCV,eAAe/F;YACf0G,WAAWjG;YACXmG,YAAY;QACd;QACA,IAAI1E,cAAc;YAChBuE,OAAOK,aAAa,GAAG5E;QACzB;QACA,MAAM6E,OAAO,IAAIC,gBAAgBP;QAEjC,MAAM5D,WAAW,MAAMC,MAAM0D,UAAU;YACrCS,QAAQ;YACRxE,SAAS;gBACP,gBAAgB;YAClB;YACAsE,MAAMA,KAAKtF,QAAQ;QACrB;QAEA,IAAI,CAACoB,SAASG,EAAE,EAAE;YAChB,MAAMQ,YAAY,MAAMX,SAASK,IAAI;YACrC,MAAM,IAAI7C,MAAM,CAAC,sBAAsB,EAAEwC,SAASI,MAAM,CAAC,CAAC,EAAEO,WAAW;QACzE;QAEA,MAAMoC,gBAAiB,MAAM/C,SAASO,IAAI;QAE1C,OAAO;YACLrD,aAAa6F,cAAcrD,YAAY;YACvCvC,cAAcA;YACd,GAAI4F,cAAcK,UAAU,KAAKD,aAAa;gBAAE3C,WAAWtB,KAAKuB,GAAG,KAAKsC,cAAcK,UAAU,GAAG;YAAK,CAAC;YACzG,GAAIL,cAAclF,KAAK,KAAKsF,aAAa;gBAAEtF,OAAOkF,cAAclF,KAAK;YAAC,CAAC;QACzE;IACF;IAEA;;;;;;;;;;;;;;;;;;;;;;;GAuBC,GACDwG,iBAAiB;QACf,MAAM,EAAE1H,OAAO,EAAEC,UAAU,EAAEF,MAAM,EAAE,GAAG,IAAI,CAACG,MAAM;QAEnD,0EAA0E;QAC1E,sFAAsF;QACtF,MAAMyH,iBAAiB,CAAuEC,QAAWC;YACvG,MAAMC,YAAYF,OAAOG,IAAI;YAC7B,MAAMC,kBAAkBJ,OAAOK,OAAO;YAEtC,MAAMC,iBAAiB,OAAO,GAAGC;gBAC/B,0CAA0C;gBAC1C,MAAMC,QAAQD,OAAO,CAACN,cAAc;gBAEpC,IAAI;oBACF,qDAAqD;oBACrD,IAAI/H;oBACJ,IAAI;;4BACU;wBAAZA,qBAAY,eAAA,AAACsI,MAA6CC,KAAK,cAAnD,mCAAA,aAAqDvI,SAAS,uCAAK,MAAMd,iBAAiBiB,YAAY;4BAAED;wBAAQ;oBAC9H,EAAE,OAAOY,OAAO;wBACd,IAAIA,iBAAiBC,SAAU,CAAA,AAACD,MAA4BsF,IAAI,KAAK,6BAA6BtF,MAAMmH,IAAI,KAAK,qBAAoB,GAAI;4BACvIjI,YAAY0G;wBACd,OAAO;4BACL,MAAM5F;wBACR;oBACF;oBAEA,sDAAsD;oBACtD,MAAM,IAAI,CAACf,cAAc,CAACC;oBAE1B,4EAA4E;oBAC5E,MAAMK,qBAAqBL,sBAAAA,uBAAAA,YAAc,MAAMd,iBAAiBiB,YAAY;wBAAED;oBAAQ;oBACtF,IAAI,CAACG,oBAAoB;wBACvB,MAAM,IAAIU,MAAM,CAAC,8CAA8C,EAAEb,SAAS;oBAC5E;oBAEA,MAAMsI,OAAO,IAAI,CAAC7F,MAAM,CAACtC;oBAEzB,2CAA2C;oBAC1CiI,MAAwCG,WAAW,GAAG;wBACrDD;wBACAxI,WAAWK;oBACb;oBACCiI,MAA+BrI,MAAM,GAAGA;oBAEzC,sCAAsC;oBACtC,OAAO,MAAMiI,mBAAmBG;gBAClC,EAAE,OAAOvH,OAAO;oBACd,IAAIA,iBAAiBjB,mBAAmB;wBACtCI,OAAOU,IAAI,CAAC,2BAA2B;4BACrCT;4BACAwI,MAAMV;4BACN5F,YAAYtB,MAAMsB,UAAU;wBAC9B;wBACA,yFAAyF;wBACzF,2GAA2G;wBAC3G,MAAMuG,uBAAuB;4BAC3BC,MAAM;4BACN3G,UAAU/B;4BACVc,SAAS,CAAC,4BAA4B,EAAEgH,UAAU,2BAA2B,EAAE9H,QAAQ,CAAC,CAAC;4BACzFgC,KAAKpB,MAAMsB,UAAU,CAACJ,IAAI,KAAK,aAAalB,MAAMsB,UAAU,CAACF,GAAG,GAAGwE;wBACrE;wBAEA,OAAO;4BACLmC,SAAS;gCACP;oCACED,MAAM;oCACNhF,MAAMkF,KAAKC,SAAS,CAAC;wCAAEC,QAAQL;oCAAqB;gCACtD;6BACD;4BACDM,mBAAmB;gCAAED,QAAQL;4BAAqB;wBACpD;oBACF;oBACA,MAAM7H;gBACR;YACF;YAEA,OAAO;gBACL,GAAGgH,MAAM;gBACTK,SAASC;YACX;QACF;QAEA,OAAO;YACLc,cAAc,CAAgEpB,SAAcD,eAAeC,QAAQ;YACnHqB,kBAAkB,CAAqFrB,SAAcD,eAAeC,QAAQ;YAC5IsB,gBAAgB,CAAgEtB,SAAcD,eAAeC,QAAQ;QACvH;IACF;IA9mBA,YAAY1H,MAA2B,CAAE;QACvC,IAAI,CAACA,MAAM,GAAGA;IAChB;AA6mBF;AAEA;;;CAGC,GACD,OAAO,SAASiJ,qBAAqBjJ,MAA2B;IAC9D,OAAO,IAAIN,sBAAsBM;AACnC"}
+{"version":3,"sources":["/Users/kevin/Dev/Projects/mcp-z/oauth-google/src/providers/loopback-oauth.ts"],"sourcesContent":["/**\n * Loopback OAuth Implementation (RFC 8252)\n *\n * Implements OAuth 2.0 Authorization Code Flow with PKCE using loopback interface redirection.\n * Uses ephemeral local server with OS-assigned port (RFC 8252 Section 8.3).\n *\n * CHANGE (2026-01-03):\n * - Non-headless mode now opens the auth URL AND blocks (polls) until tokens are available,\n *   for BOTH redirectUri (persistent) and ephemeral (loopback) modes.\n * - Ephemeral flow no longer calls `open()` itself. Instead it:\n *   1) starts the loopback callback server\n *   2) throws AuthRequiredError(auth_url)\n * - Middleware catches AuthRequiredError(auth_url):\n *   - if not headless: open(url) once + poll pending state until callback completes (or timeout)\n *   - then retries token acquisition and injects authContext in the SAME tool call.\n */\n\nimport { addAccount, generatePKCE, getActiveAccount, getErrorTemplate, getSuccessTemplate, getToken, type OAuth2TokenStorageProvider, setAccountInfo, setActiveAccount, setToken } from '@mcp-z/oauth';\nimport { randomUUID } from 'crypto';\nimport { OAuth2Client } from 'google-auth-library';\nimport * as http from 'http';\nimport open from 'open';\nimport { type AuthContext, type AuthFlowDescriptor, AuthRequiredError, type CachedToken, type EnrichedExtra, type LoopbackOAuthConfig } from '../types.ts';\n\ninterface TokenResponse {\n  access_token: string;\n  refresh_token?: string;\n  expires_in?: number;\n  scope?: string;\n  token_type?: string;\n}\n\ntype PendingAuth = {\n  codeVerifier: string;\n  createdAt: number;\n  // populated when callback completes successfully\n  completedAt?: number;\n  email?: string;\n};\n\nconst OAUTH_TIMEOUT_MS = 5 * 60 * 1000;\nconst OAUTH_POLL_MS = 500;\n\n/**\n * Loopback OAuth Client (RFC 8252 Section 7.3)\n *\n * Implements OAuth 2.0 Authorization Code Flow with PKCE for native applications\n * using loopback interface redirection. Manages ephemeral OAuth flows and token persistence\n * with Keyv for key-based token storage using compound keys.\n *\n * Token key format: {accountId}:{service}:token (e.g., \"user@example.com:gmail:token\")\n */\nexport class LoopbackOAuthProvider implements OAuth2TokenStorageProvider {\n  private config: LoopbackOAuthConfig;\n\n  // Track URLs we've already opened for a given state within this process (prevents tab spam).\n  private openedStates = new Set<string>();\n\n  constructor(config: LoopbackOAuthConfig) {\n    this.config = config;\n  }\n\n  /**\n   * Get access token from Keyv using compound key\n   *\n   * @param accountId - Account identifier (email address). Required for loopback OAuth.\n   * @returns Access token for API requests\n   */\n  async getAccessToken(accountId?: string): Promise<string> {\n    const { logger, service, tokenStore } = this.config;\n\n    // Use active account if no accountId specified\n    const effectiveAccountId = accountId ?? (await getActiveAccount(tokenStore, { service }));\n\n    // If we have an accountId, try to use existing token\n    if (effectiveAccountId) {\n      logger.debug('Getting access token', { service, accountId: effectiveAccountId });\n\n      // Check Keyv for token using new key format\n      const storedToken = await getToken<CachedToken>(tokenStore, { accountId: effectiveAccountId, service });\n\n      if (storedToken && this.isTokenValid(storedToken)) {\n        logger.debug('Using stored access token', { accountId: effectiveAccountId });\n        return storedToken.accessToken;\n      }\n\n      // If stored token expired but has refresh token, try refresh\n      if (storedToken?.refreshToken) {\n        try {\n          logger.info('Refreshing expired access token', { accountId: effectiveAccountId });\n          const refreshedToken = await this.refreshAccessToken(storedToken.refreshToken);\n          await setToken(tokenStore, { accountId: effectiveAccountId, service }, refreshedToken);\n          return refreshedToken.accessToken;\n        } catch (error) {\n          logger.info('Token refresh failed, starting new OAuth flow', {\n            accountId: effectiveAccountId,\n            error: error instanceof Error ? error.message : String(error),\n          });\n          // Fall through to new OAuth flow\n        }\n      }\n    }\n\n    // No valid token or no account - need OAuth authentication\n    const { clientId, scope, redirectUri } = this.config;\n\n    if (redirectUri) {\n      // Persistent callback mode (cloud deployment with configured redirect_uri)\n      const { verifier: codeVerifier, challenge: codeChallenge } = generatePKCE();\n      const stateId = randomUUID();\n\n      // Store PKCE verifier for callback (5 minute TTL)\n      await this.createPendingAuth({ state: stateId, codeVerifier });\n\n      // Build auth URL with configured redirect_uri\n      const authUrl = this.buildAuthUrl({\n        redirectUri,\n        codeChallenge,\n        state: stateId,\n      });\n\n      logger.info('OAuth required - persistent callback mode', { service, redirectUri, clientId, scope });\n      throw new AuthRequiredError({\n        kind: 'auth_url',\n        provider: service,\n        url: authUrl,\n      });\n    }\n\n    // Ephemeral callback mode (local development)\n    // IMPORTANT: do NOT open here anymore; we throw auth_url and the middleware will open+poll.\n    logger.info('Starting ephemeral OAuth flow', { service, headless: this.config.headless });\n    const descriptor = await this.startEphemeralOAuthFlow();\n    throw new AuthRequiredError(descriptor);\n  }\n\n  /**\n   * Convert to googleapis-compatible OAuth2Client\n   *\n   * @param accountId - Account identifier for multi-account support (e.g., 'user@example.com')\n   * @returns OAuth2Client configured for the specified account\n   */\n  toAuth(accountId?: string): OAuth2Client {\n    const { clientId, clientSecret } = this.config;\n    const client = new OAuth2Client({\n      clientId,\n      ...(clientSecret && { clientSecret }),\n    });\n\n    // @ts-expect-error - Override protected method to inject fresh token\n    client.getRequestMetadataAsync = async (_url?: string) => {\n      // Get token from FileAuthAdapter (not from client to avoid recursion)\n      const token = await this.getAccessToken(accountId);\n\n      // Update client credentials for googleapis compatibility\n      client.credentials = {\n        access_token: token,\n        token_type: 'Bearer',\n      };\n\n      // Return headers as Map (required by authclient.js addUserProjectAndAuthHeaders)\n      const headers = new Map<string, string>();\n      headers.set('authorization', `Bearer ${token}`);\n      return { headers };\n    };\n\n    return client;\n  }\n\n  /**\n   * Get user email from Google's userinfo endpoint (pure query)\n   * Used to query email for existing authenticated account\n   *\n   * @param accountId - Account identifier to get email for\n   * @returns User's email address\n   */\n  async getUserEmail(accountId?: string): Promise<string> {\n    // Get token for existing account\n    const token = await this.getAccessToken(accountId);\n\n    // Fetch email from Google userinfo\n    const response = await fetch('https://www.googleapis.com/oauth2/v2/userinfo', {\n      headers: {\n        Authorization: `Bearer ${token}`,\n      },\n    });\n\n    if (!response.ok) {\n      throw new Error(`Failed to get user info: ${response.status} ${await response.text()}`);\n    }\n\n    const userInfo = (await response.json()) as { email: string };\n    return userInfo.email;\n  }\n\n  private isTokenValid(token: CachedToken): boolean {\n    if (!token.expiresAt) return true; // No expiry = assume valid\n    return Date.now() < token.expiresAt - 60000; // 1 minute buffer\n  }\n\n  /**\n   * Fetch user email from Google OAuth2 userinfo endpoint\n   * Called during OAuth flow to get email for accountId\n   *\n   * @param accessToken - Fresh access token from OAuth exchange\n   * @returns User's email address\n   */\n  private async fetchUserEmailFromToken(accessToken: string): Promise<string> {\n    const { logger } = this.config;\n\n    const response = await fetch('https://www.googleapis.com/oauth2/v2/userinfo', {\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n      },\n    });\n\n    if (!response.ok) {\n      const errorText = await response.text();\n      throw new Error(`Failed to fetch user email: HTTP ${response.status} - ${errorText}`);\n    }\n\n    const userInfo = (await response.json()) as { email: string };\n    const email = userInfo.email;\n\n    logger.debug('Fetched user email from Google userinfo API', { email });\n    return email;\n  }\n\n  // ---------------------------------------------------------------------------\n  // Shared OAuth helpers\n  // ---------------------------------------------------------------------------\n\n  /**\n   * Build OAuth authorization URL with the \"most parameters\" baseline.\n   * This is shared by BOTH persistent (redirectUri) and ephemeral (loopback) modes.\n   */\n  private buildAuthUrl(args: { redirectUri: string; codeChallenge: string; state: string }): string {\n    const { clientId, scope } = this.config;\n\n    const authUrl = new URL('https://accounts.google.com/o/oauth2/v2/auth');\n    authUrl.searchParams.set('client_id', clientId);\n    authUrl.searchParams.set('redirect_uri', args.redirectUri);\n    authUrl.searchParams.set('response_type', 'code');\n    authUrl.searchParams.set('scope', scope);\n    authUrl.searchParams.set('access_type', 'offline'); // always\n    authUrl.searchParams.set('prompt', 'consent'); // always\n    authUrl.searchParams.set('code_challenge', args.codeChallenge);\n    authUrl.searchParams.set('code_challenge_method', 'S256');\n    authUrl.searchParams.set('state', args.state);\n\n    return authUrl.toString();\n  }\n\n  /**\n   * Create a cached token + email from an authorization code.\n   * This is the shared callback handler for BOTH persistent and ephemeral modes.\n   */\n  private async handleAuthorizationCode(args: { code: string; codeVerifier: string; redirectUri: string }): Promise<{ email: string; token: CachedToken }> {\n    // Exchange code for token (must use same redirect_uri as in authorization request)\n    const tokenResponse = await this.exchangeCodeForToken(args.code, args.codeVerifier, args.redirectUri);\n\n    // Build cached token\n    const cachedToken: CachedToken = {\n      accessToken: tokenResponse.access_token,\n      ...(tokenResponse.refresh_token !== undefined && { refreshToken: tokenResponse.refresh_token }),\n      ...(tokenResponse.expires_in !== undefined && { expiresAt: Date.now() + tokenResponse.expires_in * 1000 }),\n      ...(tokenResponse.scope !== undefined && { scope: tokenResponse.scope }),\n    };\n\n    // Fetch user email immediately using the new access token\n    const email = await this.fetchUserEmailFromToken(tokenResponse.access_token);\n\n    return { email, token: cachedToken };\n  }\n\n  /**\n   * Store token + account metadata. Shared by BOTH persistent and ephemeral modes.\n   */\n  private async persistAuthResult(args: { email: string; token: CachedToken }): Promise<void> {\n    const { tokenStore, service } = this.config;\n\n    await setToken(tokenStore, { accountId: args.email, service }, args.token);\n    await addAccount(tokenStore, { service, accountId: args.email });\n    await setActiveAccount(tokenStore, { service, accountId: args.email });\n    await setAccountInfo(tokenStore, { service, accountId: args.email }, { email: args.email, addedAt: new Date().toISOString() });\n  }\n\n  /**\n   * Pending auth (PKCE verifier) key format.\n   * Keep as-is (confirmed), even though it's not a public contract.\n   */\n  private pendingKey(state: string): string {\n    return `${this.config.service}:pending:${state}`;\n  }\n\n  /**\n   * Store PKCE verifier for callback (5 minute TTL).\n   * Shared by BOTH persistent and ephemeral modes.\n   */\n  private async createPendingAuth(args: { state: string; codeVerifier: string }): Promise<void> {\n    const { tokenStore } = this.config;\n    const record: PendingAuth = { codeVerifier: args.codeVerifier, createdAt: Date.now() };\n    await tokenStore.set(this.pendingKey(args.state), record, OAUTH_TIMEOUT_MS);\n  }\n\n  /**\n   * Load and validate pending auth state (5 minute TTL).\n   * Shared by BOTH persistent and ephemeral modes.\n   */\n  private async readAndValidatePendingAuth(state: string): Promise<PendingAuth> {\n    const { tokenStore } = this.config;\n\n    const pendingAuth = await tokenStore.get<PendingAuth>(this.pendingKey(state));\n    if (!pendingAuth) {\n      throw new Error('Invalid or expired OAuth state. Please try again.');\n    }\n\n    // Check TTL (5 minutes)\n    if (Date.now() - pendingAuth.createdAt > OAUTH_TIMEOUT_MS) {\n      await tokenStore.delete(this.pendingKey(state));\n      throw new Error('OAuth state expired. Please try again.');\n    }\n\n    return pendingAuth;\n  }\n\n  /**\n   * Mark pending auth as completed (used by middleware polling).\n   */\n  private async markPendingComplete(args: { state: string; email: string; pending: PendingAuth }): Promise<void> {\n    const { tokenStore } = this.config;\n    const updated: PendingAuth = {\n      ...args.pending,\n      completedAt: Date.now(),\n      email: args.email,\n    };\n    await tokenStore.set(this.pendingKey(args.state), updated, OAUTH_TIMEOUT_MS);\n  }\n\n  /**\n   * Clean up pending auth state.\n   */\n  private async deletePendingAuth(state: string): Promise<void> {\n    const { tokenStore } = this.config;\n    await tokenStore.delete(this.pendingKey(state));\n  }\n\n  /**\n   * Wait until pending auth is marked completed (or timeout).\n   * Used by middleware after opening auth URL in non-headless mode.\n   */\n  private async waitForOAuthCompletion(state: string): Promise<{ email?: string }> {\n    const { tokenStore } = this.config;\n    const key = this.pendingKey(state);\n    const start = Date.now();\n\n    while (Date.now() - start < OAUTH_TIMEOUT_MS) {\n      const pending = await tokenStore.get<PendingAuth>(key);\n      if (pending?.completedAt) {\n        return { email: pending.email };\n      }\n      await new Promise((r) => setTimeout(r, OAUTH_POLL_MS));\n    }\n\n    throw new Error('OAuth flow timed out after 5 minutes');\n  }\n\n  /**\n   * Process an OAuth callback using shared state validation + token exchange + persistence.\n   * Used by BOTH:\n   * - ephemeral loopback server callback handler\n   * - persistent redirectUri callback handler\n   *\n   * IMPORTANT CHANGE:\n   * - We do NOT delete pending state here anymore.\n   * - We mark it completed so middleware can poll and then clean it up.\n   */\n  private async processOAuthCallback(args: { code: string; state: string; redirectUri: string }): Promise<{ email: string; token: CachedToken }> {\n    const { logger, service } = this.config;\n\n    const pending = await this.readAndValidatePendingAuth(args.state);\n\n    logger.info('Processing OAuth callback', { service, state: args.state });\n\n    const result = await this.handleAuthorizationCode({\n      code: args.code,\n      codeVerifier: pending.codeVerifier,\n      redirectUri: args.redirectUri,\n    });\n\n    await this.persistAuthResult(result);\n    await this.markPendingComplete({ state: args.state, email: result.email, pending });\n\n    logger.info('OAuth callback completed', { service, email: result.email });\n    return result;\n  }\n\n  // ---------------------------------------------------------------------------\n  // Ephemeral loopback server + flow\n  // ---------------------------------------------------------------------------\n\n  /**\n   * Loopback OAuth server helper (RFC 8252 Section 7.3)\n   *\n   * Implements ephemeral local server with OS-assigned port (RFC 8252 Section 8.3).\n   * Shared callback handling uses:\n   * - the same authUrl builder as redirectUri mode\n   * - the same pending PKCE verifier storage as redirectUri mode\n   * - the same callback processor as redirectUri mode\n   */\n  private createOAuthCallbackServer(args: {\n    callbackPath: string;\n    finalRedirectUri: () => string; // resolved after listen\n    onDone: () => void;\n    onError: (err: unknown) => void;\n  }): http.Server {\n    const { logger } = this.config;\n\n    // Create ephemeral server with OS-assigned port (RFC 8252)\n    return http.createServer(async (req, res) => {\n      try {\n        if (!req.url) {\n          res.writeHead(400, { 'Content-Type': 'text/html' });\n          res.end(getErrorTemplate('Invalid request'));\n          args.onError(new Error('Invalid request: missing URL'));\n          return;\n        }\n\n        // Use loopback base for URL parsing (port is not important for parsing path/query)\n        const url = new URL(req.url, 'http://127.0.0.1');\n\n        if (url.pathname !== args.callbackPath) {\n          res.writeHead(404, { 'Content-Type': 'text/plain' });\n          res.end('Not Found');\n          return;\n        }\n\n        const code = url.searchParams.get('code');\n        const error = url.searchParams.get('error');\n        const state = url.searchParams.get('state');\n\n        if (error) {\n          res.writeHead(400, { 'Content-Type': 'text/html' });\n          res.end(getErrorTemplate(error));\n          args.onError(new Error(`OAuth error: ${error}`));\n          return;\n        }\n\n        if (!code) {\n          res.writeHead(400, { 'Content-Type': 'text/html' });\n          res.end(getErrorTemplate('No authorization code received'));\n          args.onError(new Error('No authorization code received'));\n          return;\n        }\n\n        if (!state) {\n          res.writeHead(400, { 'Content-Type': 'text/html' });\n          res.end(getErrorTemplate('Missing state parameter in OAuth callback'));\n          args.onError(new Error('Missing state parameter in OAuth callback'));\n          return;\n        }\n\n        try {\n          await this.processOAuthCallback({\n            code,\n            state,\n            redirectUri: args.finalRedirectUri(),\n          });\n\n          res.writeHead(200, { 'Content-Type': 'text/html' });\n          res.end(getSuccessTemplate());\n\n          args.onDone();\n        } catch (exchangeError) {\n          logger.error('Token exchange failed', { error: exchangeError instanceof Error ? exchangeError.message : String(exchangeError) });\n          res.writeHead(500, { 'Content-Type': 'text/html' });\n          res.end(getErrorTemplate('Token exchange failed'));\n          args.onError(exchangeError);\n        }\n      } catch (outerError) {\n        logger.error('OAuth callback server error', { error: outerError instanceof Error ? outerError.message : String(outerError) });\n        res.writeHead(500, { 'Content-Type': 'text/html' });\n        res.end(getErrorTemplate('Internal server error'));\n        args.onError(outerError);\n      }\n    });\n  }\n\n  /**\n   * Starts the ephemeral loopback server and returns an AuthRequiredError(auth_url).\n   * Middleware will open+poll and then retry in the same call.\n   */\n  private async startEphemeralOAuthFlow(): Promise<AuthFlowDescriptor> {\n    const { headless, logger, redirectUri: configRedirectUri, service, tokenStore } = this.config;\n\n    // Server listen configuration (where ephemeral server binds)\n    let listenHost = 'localhost'; // Default: localhost for ephemeral loopback\n    let listenPort = 0; // Default: OS-assigned ephemeral port\n\n    // Redirect URI configuration (what goes in auth URL and token exchange)\n    let callbackPath = '/callback'; // Default callback path\n    let useConfiguredUri = false;\n\n    if (configRedirectUri) {\n      try {\n        const parsed = new URL(configRedirectUri);\n        const isLoopback = parsed.hostname === 'localhost' || parsed.hostname === '127.0.0.1';\n\n        if (isLoopback) {\n          // Local development: Listen on specific loopback address/port\n          listenHost = parsed.hostname;\n          listenPort = parsed.port ? Number.parseInt(parsed.port, 10) : 0;\n        } else {\n          // Cloud deployment: Listen on 0.0.0.0 with PORT from environment\n          // The redirectUri is the PUBLIC URL (e.g., https://example.com/oauth/callback)\n          // The server listens on 0.0.0.0:PORT and the load balancer routes to it\n          listenHost = '0.0.0.0';\n          const envPort = process.env.PORT ? Number.parseInt(process.env.PORT, 10) : undefined;\n          listenPort = envPort && Number.isFinite(envPort) ? envPort : 8080;\n        }\n\n        // Extract callback path from URL\n        if (parsed.pathname && parsed.pathname !== '/') {\n          callbackPath = parsed.pathname;\n        }\n\n        useConfiguredUri = true;\n\n        logger.debug('Using configured redirect URI', {\n          listenHost,\n          listenPort,\n          callbackPath,\n          redirectUri: configRedirectUri,\n          isLoopback,\n        });\n      } catch (error) {\n        logger.warn('Failed to parse redirectUri, using ephemeral defaults', {\n          redirectUri: configRedirectUri,\n          error: error instanceof Error ? error.message : String(error),\n        });\n        // Continue with defaults (localhost, port 0, http, /callback)\n      }\n    }\n\n    // Generate PKCE challenge + state\n    const { verifier: codeVerifier, challenge: codeChallenge } = generatePKCE();\n    const stateId = randomUUID();\n\n    // Store PKCE verifier for callback (5 minute TTL)\n    await this.createPendingAuth({ state: stateId, codeVerifier });\n\n    let server: http.Server | null = null;\n    let serverPort: number;\n    let finalRedirectUri: string; // set after listen\n\n    // Create ephemeral server with OS-assigned port (RFC 8252)\n    server = this.createOAuthCallbackServer({\n      callbackPath,\n      finalRedirectUri: () => finalRedirectUri,\n      onDone: () => {\n        server?.close();\n      },\n      onError: (err) => {\n        logger.error('Ephemeral OAuth server error', { error: err instanceof Error ? err.message : String(err) });\n        server?.close();\n      },\n    });\n\n    // Start listening\n    await new Promise<void>((resolve, reject) => {\n      server?.listen(listenPort, listenHost, () => {\n        const address = server?.address();\n        if (!address || typeof address === 'string') {\n          server?.close();\n          reject(new Error('Failed to start ephemeral server'));\n          return;\n        }\n\n        serverPort = address.port;\n\n        // Construct final redirect URI\n        if (useConfiguredUri && configRedirectUri) {\n          finalRedirectUri = configRedirectUri;\n        } else {\n          finalRedirectUri = `http://localhost:${serverPort}${callbackPath}`;\n        }\n\n        logger.info('Ephemeral OAuth server started', { port: serverPort, headless, service });\n\n        resolve();\n      });\n    });\n\n    // Timeout after 5 minutes (match middleware polling timeout)\n    setTimeout(() => {\n      if (server) {\n        server.close();\n        // Best-effort cleanup if user never completes flow:\n        // delete pending so a future attempt can restart cleanly.\n        void tokenStore.delete(this.pendingKey(stateId));\n      }\n    }, OAUTH_TIMEOUT_MS);\n\n    // Build auth URL - SAME helper as persistent mode\n    const authUrl = this.buildAuthUrl({\n      redirectUri: finalRedirectUri,\n      codeChallenge,\n      state: stateId,\n    });\n\n    return {\n      kind: 'auth_url',\n      provider: service,\n      url: authUrl,\n    };\n  }\n\n  private async exchangeCodeForToken(code: string, codeVerifier: string, redirectUri: string): Promise<TokenResponse> {\n    const { clientId, clientSecret } = this.config;\n\n    const tokenUrl = 'https://oauth2.googleapis.com/token';\n    const params: Record<string, string> = {\n      code,\n      client_id: clientId,\n      redirect_uri: redirectUri,\n      grant_type: 'authorization_code',\n      code_verifier: codeVerifier,\n    };\n    if (clientSecret) {\n      params.client_secret = clientSecret;\n    }\n    const body = new URLSearchParams(params);\n\n    const response = await fetch(tokenUrl, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: body.toString(),\n    });\n\n    if (!response.ok) {\n      const errorText = await response.text();\n      throw new Error(`Token exchange failed: ${response.status} ${errorText}`);\n    }\n\n    return (await response.json()) as TokenResponse;\n  }\n\n  private async refreshAccessToken(refreshToken: string): Promise<CachedToken> {\n    const { clientId, clientSecret } = this.config;\n\n    const tokenUrl = 'https://oauth2.googleapis.com/token';\n    const params: Record<string, string> = {\n      refresh_token: refreshToken,\n      client_id: clientId,\n      grant_type: 'refresh_token',\n    };\n    if (clientSecret) {\n      params.client_secret = clientSecret;\n    }\n    const body = new URLSearchParams(params);\n\n    const response = await fetch(tokenUrl, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: body.toString(),\n    });\n\n    if (!response.ok) {\n      const errorText = await response.text();\n      throw new Error(`Token refresh failed: ${response.status} ${errorText}`);\n    }\n\n    const tokenResponse = (await response.json()) as TokenResponse;\n\n    return {\n      accessToken: tokenResponse.access_token,\n      refreshToken: refreshToken, // Keep original refresh token\n      ...(tokenResponse.expires_in !== undefined && { expiresAt: Date.now() + tokenResponse.expires_in * 1000 }),\n      ...(tokenResponse.scope !== undefined && { scope: tokenResponse.scope }),\n    };\n  }\n\n  /**\n   * Handle OAuth callback from persistent endpoint.\n   * Used by HTTP servers with configured redirectUri.\n   *\n   * @param params - OAuth callback parameters\n   * @returns Email and cached token\n   */\n  async handleOAuthCallback(params: { code: string; state?: string }): Promise<{ email: string; token: CachedToken }> {\n    const { code, state } = params;\n    const { redirectUri } = this.config;\n\n    if (!state) {\n      throw new Error('Missing state parameter in OAuth callback');\n    }\n\n    if (!redirectUri) {\n      throw new Error('handleOAuthCallback requires configured redirectUri');\n    }\n\n    // Shared callback processor (same code path as ephemeral)\n    return await this.processOAuthCallback({ code, state, redirectUri });\n  }\n\n  /**\n   * Create authentication middleware for MCP tools, resources, and prompts\n   *\n   * Returns position-aware middleware wrappers that enrich handlers with authentication context.\n   * The middleware handles token retrieval, refresh, and AuthRequiredError automatically.\n   *\n   * Single-user middleware for desktop/CLI apps where ONE user runs the entire process:\n   * - Desktop applications (Claude Desktop)\n   * - CLI tools (Gmail CLI)\n   * - Personal automation scripts\n   *\n   * All requests use token lookups based on the active account or account override.\n   *\n   * @returns Object with withToolAuth, withResourceAuth, withPromptAuth methods\n   */\n  authMiddleware() {\n    const { service, tokenStore, logger } = this.config;\n\n    // Shared wrapper logic - extracts extra parameter from specified position\n    // Generic T captures the actual module type; handler is cast from unknown to callable\n    const wrapAtPosition = <T extends { name: string; handler: unknown; [key: string]: unknown }>(module: T, extraPosition: number): T => {\n      const operation = module.name;\n      const originalHandler = module.handler as (...args: unknown[]) => Promise<unknown>;\n\n      const wrappedHandler = async (...allArgs: unknown[]) => {\n        // Extract extra from the correct position\n        const extra = allArgs[extraPosition] as EnrichedExtra;\n\n        // Helper: retry once after open+poll completes\n        const ensureAuthenticatedOrThrow = async () => {\n          try {\n            // Check for backchannel override via _meta.accountId\n            let accountId: string | undefined;\n            try {\n              accountId = (extra as { _meta?: { accountId?: string } })._meta?.accountId ?? (await getActiveAccount(tokenStore, { service }));\n            } catch (error) {\n              if (error instanceof Error && (((error as { code?: string }).code === 'REQUIRES_AUTHENTICATION' || error.name === 'AccountManagerError') as boolean)) {\n                accountId = undefined;\n              } else {\n                throw error;\n              }\n            }\n\n            await this.getAccessToken(accountId);\n\n            const effectiveAccountId = accountId ?? (await getActiveAccount(tokenStore, { service }));\n            if (!effectiveAccountId) {\n              throw new Error(`No account found after OAuth flow for service ${service}`);\n            }\n\n            return effectiveAccountId;\n          } catch (error) {\n            if (error instanceof AuthRequiredError && error.descriptor.kind === 'auth_url') {\n              // Headless: don't open/poll; just propagate to outer handler to return auth_required.\n              if (this.config.headless) throw error;\n\n              // Non-headless: open once + poll until callback completes, then retry token acquisition.\n              const authUrl = new URL(error.descriptor.url);\n              const state = authUrl.searchParams.get('state');\n              if (!state) throw new Error('Auth URL missing state parameter');\n\n              if (!this.openedStates.has(state)) {\n                this.openedStates.add(state);\n                open(error.descriptor.url).catch((e: unknown) => {\n                  logger.info('Failed to open browser automatically', { error: e instanceof Error ? e.message : String(e) });\n                });\n              }\n\n              // Block until callback completes (or timeout)\n              await this.waitForOAuthCompletion(state);\n\n              // Cleanup pending state after we observe completion\n              await this.deletePendingAuth(state);\n\n              // Retry after completion\n              return await ensureAuthenticatedOrThrow();\n            }\n\n            throw error;\n          }\n        };\n\n        try {\n          const effectiveAccountId = await ensureAuthenticatedOrThrow();\n          const auth = this.toAuth(effectiveAccountId);\n\n          // Inject authContext and logger into extra\n          (extra as { authContext?: AuthContext }).authContext = {\n            auth,\n            accountId: effectiveAccountId,\n          };\n          (extra as { logger?: unknown }).logger = logger;\n\n          // Call original handler with all args\n          return await originalHandler(...allArgs);\n        } catch (error) {\n          if (error instanceof AuthRequiredError) {\n            logger.info('Authentication required', {\n              service,\n              tool: operation,\n              descriptor: error.descriptor,\n            });\n\n            const authRequiredResponse = {\n              type: 'auth_required' as const,\n              provider: service,\n              message: `Authentication required for ${operation}. Please authenticate with ${service}.`,\n              url: error.descriptor.kind === 'auth_url' ? error.descriptor.url : undefined,\n            };\n\n            return {\n              content: [\n                {\n                  type: 'text' as const,\n                  text: JSON.stringify({ result: authRequiredResponse }),\n                },\n              ],\n              structuredContent: { result: authRequiredResponse },\n            };\n          }\n          throw error;\n        }\n      };\n\n      return {\n        ...module,\n        handler: wrappedHandler,\n      } as T;\n    };\n\n    return {\n      withToolAuth: <T extends { name: string; config: unknown; handler: unknown }>(module: T) => wrapAtPosition(module, 1),\n      withResourceAuth: <T extends { name: string; template?: unknown; config?: unknown; handler: unknown }>(module: T) => wrapAtPosition(module, 2),\n      withPromptAuth: <T extends { name: string; config: unknown; handler: unknown }>(module: T) => wrapAtPosition(module, 0),\n    };\n  }\n}\n\n/**\n * Create a loopback OAuth client for Google services\n * Works for both stdio and HTTP transports\n */\nexport function createGoogleFileAuth(config: LoopbackOAuthConfig): OAuth2TokenStorageProvider {\n  return new LoopbackOAuthProvider(config);\n}\n"],"names":["addAccount","generatePKCE","getActiveAccount","getErrorTemplate","getSuccessTemplate","getToken","setAccountInfo","setActiveAccount","setToken","randomUUID","OAuth2Client","http","open","AuthRequiredError","OAUTH_TIMEOUT_MS","OAUTH_POLL_MS","LoopbackOAuthProvider","getAccessToken","accountId","logger","service","tokenStore","config","effectiveAccountId","debug","storedToken","isTokenValid","accessToken","refreshToken","info","refreshedToken","refreshAccessToken","error","Error","message","String","clientId","scope","redirectUri","verifier","codeVerifier","challenge","codeChallenge","stateId","createPendingAuth","state","authUrl","buildAuthUrl","kind","provider","url","headless","descriptor","startEphemeralOAuthFlow","toAuth","clientSecret","client","getRequestMetadataAsync","_url","token","credentials","access_token","token_type","headers","Map","set","getUserEmail","response","fetch","Authorization","ok","status","text","userInfo","json","email","expiresAt","Date","now","fetchUserEmailFromToken","errorText","args","URL","searchParams","toString","handleAuthorizationCode","tokenResponse","exchangeCodeForToken","code","cachedToken","refresh_token","undefined","expires_in","persistAuthResult","addedAt","toISOString","pendingKey","record","createdAt","readAndValidatePendingAuth","pendingAuth","get","delete","markPendingComplete","updated","pending","completedAt","deletePendingAuth","waitForOAuthCompletion","key","start","Promise","r","setTimeout","processOAuthCallback","result","createOAuthCallbackServer","createServer","req","res","writeHead","end","onError","pathname","callbackPath","finalRedirectUri","onDone","exchangeError","outerError","configRedirectUri","listenHost","listenPort","useConfiguredUri","parsed","isLoopback","hostname","port","Number","parseInt","envPort","process","env","PORT","isFinite","warn","server","serverPort","close","err","resolve","reject","listen","address","tokenUrl","params","client_id","redirect_uri","grant_type","code_verifier","client_secret","body","URLSearchParams","method","handleOAuthCallback","authMiddleware","wrapAtPosition","module","extraPosition","operation","name","originalHandler","handler","wrappedHandler","allArgs","extra","ensureAuthenticatedOrThrow","_meta","openedStates","has","add","catch","e","auth","authContext","tool","authRequiredResponse","type","content","JSON","stringify","structuredContent","withToolAuth","withResourceAuth","withPromptAuth","Set","createGoogleFileAuth"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,UAAU,EAAEC,YAAY,EAAEC,gBAAgB,EAAEC,gBAAgB,EAAEC,kBAAkB,EAAEC,QAAQ,EAAmCC,cAAc,EAAEC,gBAAgB,EAAEC,QAAQ,QAAQ,eAAe;AACvM,SAASC,UAAU,QAAQ,SAAS;AACpC,SAASC,YAAY,QAAQ,sBAAsB;AACnD,YAAYC,UAAU,OAAO;AAC7B,OAAOC,UAAU,OAAO;AACxB,SAAoDC,iBAAiB,QAAwE,cAAc;AAkB3J,MAAMC,mBAAmB,IAAI,KAAK;AAClC,MAAMC,gBAAgB;AAEtB;;;;;;;;CAQC,GACD,OAAO,MAAMC;IAUX;;;;;GAKC,GACD,MAAMC,eAAeC,SAAkB,EAAmB;QACxD,MAAM,EAAEC,MAAM,EAAEC,OAAO,EAAEC,UAAU,EAAE,GAAG,IAAI,CAACC,MAAM;QAEnD,+CAA+C;QAC/C,MAAMC,qBAAqBL,sBAAAA,uBAAAA,YAAc,MAAMhB,iBAAiBmB,YAAY;YAAED;QAAQ;QAEtF,qDAAqD;QACrD,IAAIG,oBAAoB;YACtBJ,OAAOK,KAAK,CAAC,wBAAwB;gBAAEJ;gBAASF,WAAWK;YAAmB;YAE9E,4CAA4C;YAC5C,MAAME,cAAc,MAAMpB,SAAsBgB,YAAY;gBAAEH,WAAWK;gBAAoBH;YAAQ;YAErG,IAAIK,eAAe,IAAI,CAACC,YAAY,CAACD,cAAc;gBACjDN,OAAOK,KAAK,CAAC,6BAA6B;oBAAEN,WAAWK;gBAAmB;gBAC1E,OAAOE,YAAYE,WAAW;YAChC;YAEA,6DAA6D;YAC7D,IAAIF,wBAAAA,kCAAAA,YAAaG,YAAY,EAAE;gBAC7B,IAAI;oBACFT,OAAOU,IAAI,CAAC,mCAAmC;wBAAEX,WAAWK;oBAAmB;oBAC/E,MAAMO,iBAAiB,MAAM,IAAI,CAACC,kBAAkB,CAACN,YAAYG,YAAY;oBAC7E,MAAMpB,SAASa,YAAY;wBAAEH,WAAWK;wBAAoBH;oBAAQ,GAAGU;oBACvE,OAAOA,eAAeH,WAAW;gBACnC,EAAE,OAAOK,OAAO;oBACdb,OAAOU,IAAI,CAAC,iDAAiD;wBAC3DX,WAAWK;wBACXS,OAAOA,iBAAiBC,QAAQD,MAAME,OAAO,GAAGC,OAAOH;oBACzD;gBACA,iCAAiC;gBACnC;YACF;QACF;QAEA,2DAA2D;QAC3D,MAAM,EAAEI,QAAQ,EAAEC,KAAK,EAAEC,WAAW,EAAE,GAAG,IAAI,CAAChB,MAAM;QAEpD,IAAIgB,aAAa;YACf,2EAA2E;YAC3E,MAAM,EAAEC,UAAUC,YAAY,EAAEC,WAAWC,aAAa,EAAE,GAAGzC;YAC7D,MAAM0C,UAAUlC;YAEhB,kDAAkD;YAClD,MAAM,IAAI,CAACmC,iBAAiB,CAAC;gBAAEC,OAAOF;gBAASH;YAAa;YAE5D,8CAA8C;YAC9C,MAAMM,UAAU,IAAI,CAACC,YAAY,CAAC;gBAChCT;gBACAI;gBACAG,OAAOF;YACT;YAEAxB,OAAOU,IAAI,CAAC,6CAA6C;gBAAET;gBAASkB;gBAAaF;gBAAUC;YAAM;YACjG,MAAM,IAAIxB,kBAAkB;gBAC1BmC,MAAM;gBACNC,UAAU7B;gBACV8B,KAAKJ;YACP;QACF;QAEA,8CAA8C;QAC9C,4FAA4F;QAC5F3B,OAAOU,IAAI,CAAC,iCAAiC;YAAET;YAAS+B,UAAU,IAAI,CAAC7B,MAAM,CAAC6B,QAAQ;QAAC;QACvF,MAAMC,aAAa,MAAM,IAAI,CAACC,uBAAuB;QACrD,MAAM,IAAIxC,kBAAkBuC;IAC9B;IAEA;;;;;GAKC,GACDE,OAAOpC,SAAkB,EAAgB;QACvC,MAAM,EAAEkB,QAAQ,EAAEmB,YAAY,EAAE,GAAG,IAAI,CAACjC,MAAM;QAC9C,MAAMkC,SAAS,IAAI9C,aAAa;YAC9B0B;YACA,GAAImB,gBAAgB;gBAAEA;YAAa,CAAC;QACtC;QAEA,qEAAqE;QACrEC,OAAOC,uBAAuB,GAAG,OAAOC;YACtC,sEAAsE;YACtE,MAAMC,QAAQ,MAAM,IAAI,CAAC1C,cAAc,CAACC;YAExC,yDAAyD;YACzDsC,OAAOI,WAAW,GAAG;gBACnBC,cAAcF;gBACdG,YAAY;YACd;YAEA,iFAAiF;YACjF,MAAMC,UAAU,IAAIC;YACpBD,QAAQE,GAAG,CAAC,iBAAiB,CAAC,OAAO,EAAEN,OAAO;YAC9C,OAAO;gBAAEI;YAAQ;QACnB;QAEA,OAAOP;IACT;IAEA;;;;;;GAMC,GACD,MAAMU,aAAahD,SAAkB,EAAmB;QACtD,iCAAiC;QACjC,MAAMyC,QAAQ,MAAM,IAAI,CAAC1C,cAAc,CAACC;QAExC,mCAAmC;QACnC,MAAMiD,WAAW,MAAMC,MAAM,iDAAiD;YAC5EL,SAAS;gBACPM,eAAe,CAAC,OAAO,EAAEV,OAAO;YAClC;QACF;QAEA,IAAI,CAACQ,SAASG,EAAE,EAAE;YAChB,MAAM,IAAIrC,MAAM,CAAC,yBAAyB,EAAEkC,SAASI,MAAM,CAAC,CAAC,EAAE,MAAMJ,SAASK,IAAI,IAAI;QACxF;QAEA,MAAMC,WAAY,MAAMN,SAASO,IAAI;QACrC,OAAOD,SAASE,KAAK;IACvB;IAEQjD,aAAaiC,KAAkB,EAAW;QAChD,IAAI,CAACA,MAAMiB,SAAS,EAAE,OAAO,MAAM,2BAA2B;QAC9D,OAAOC,KAAKC,GAAG,KAAKnB,MAAMiB,SAAS,GAAG,OAAO,kBAAkB;IACjE;IAEA;;;;;;GAMC,GACD,MAAcG,wBAAwBpD,WAAmB,EAAmB;QAC1E,MAAM,EAAER,MAAM,EAAE,GAAG,IAAI,CAACG,MAAM;QAE9B,MAAM6C,WAAW,MAAMC,MAAM,iDAAiD;YAC5EL,SAAS;gBACPM,eAAe,CAAC,OAAO,EAAE1C,aAAa;YACxC;QACF;QAEA,IAAI,CAACwC,SAASG,EAAE,EAAE;YAChB,MAAMU,YAAY,MAAMb,SAASK,IAAI;YACrC,MAAM,IAAIvC,MAAM,CAAC,iCAAiC,EAAEkC,SAASI,MAAM,CAAC,GAAG,EAAES,WAAW;QACtF;QAEA,MAAMP,WAAY,MAAMN,SAASO,IAAI;QACrC,MAAMC,QAAQF,SAASE,KAAK;QAE5BxD,OAAOK,KAAK,CAAC,+CAA+C;YAAEmD;QAAM;QACpE,OAAOA;IACT;IAEA,8EAA8E;IAC9E,uBAAuB;IACvB,8EAA8E;IAE9E;;;GAGC,GACD,AAAQ5B,aAAakC,IAAmE,EAAU;QAChG,MAAM,EAAE7C,QAAQ,EAAEC,KAAK,EAAE,GAAG,IAAI,CAACf,MAAM;QAEvC,MAAMwB,UAAU,IAAIoC,IAAI;QACxBpC,QAAQqC,YAAY,CAAClB,GAAG,CAAC,aAAa7B;QACtCU,QAAQqC,YAAY,CAAClB,GAAG,CAAC,gBAAgBgB,KAAK3C,WAAW;QACzDQ,QAAQqC,YAAY,CAAClB,GAAG,CAAC,iBAAiB;QAC1CnB,QAAQqC,YAAY,CAAClB,GAAG,CAAC,SAAS5B;QAClCS,QAAQqC,YAAY,CAAClB,GAAG,CAAC,eAAe,YAAY,SAAS;QAC7DnB,QAAQqC,YAAY,CAAClB,GAAG,CAAC,UAAU,YAAY,SAAS;QACxDnB,QAAQqC,YAAY,CAAClB,GAAG,CAAC,kBAAkBgB,KAAKvC,aAAa;QAC7DI,QAAQqC,YAAY,CAAClB,GAAG,CAAC,yBAAyB;QAClDnB,QAAQqC,YAAY,CAAClB,GAAG,CAAC,SAASgB,KAAKpC,KAAK;QAE5C,OAAOC,QAAQsC,QAAQ;IACzB;IAEA;;;GAGC,GACD,MAAcC,wBAAwBJ,IAAiE,EAAkD;QACvJ,mFAAmF;QACnF,MAAMK,gBAAgB,MAAM,IAAI,CAACC,oBAAoB,CAACN,KAAKO,IAAI,EAAEP,KAAKzC,YAAY,EAAEyC,KAAK3C,WAAW;QAEpG,qBAAqB;QACrB,MAAMmD,cAA2B;YAC/B9D,aAAa2D,cAAczB,YAAY;YACvC,GAAIyB,cAAcI,aAAa,KAAKC,aAAa;gBAAE/D,cAAc0D,cAAcI,aAAa;YAAC,CAAC;YAC9F,GAAIJ,cAAcM,UAAU,KAAKD,aAAa;gBAAEf,WAAWC,KAAKC,GAAG,KAAKQ,cAAcM,UAAU,GAAG;YAAK,CAAC;YACzG,GAAIN,cAAcjD,KAAK,KAAKsD,aAAa;gBAAEtD,OAAOiD,cAAcjD,KAAK;YAAC,CAAC;QACzE;QAEA,0DAA0D;QAC1D,MAAMsC,QAAQ,MAAM,IAAI,CAACI,uBAAuB,CAACO,cAAczB,YAAY;QAE3E,OAAO;YAAEc;YAAOhB,OAAO8B;QAAY;IACrC;IAEA;;GAEC,GACD,MAAcI,kBAAkBZ,IAA2C,EAAiB;QAC1F,MAAM,EAAE5D,UAAU,EAAED,OAAO,EAAE,GAAG,IAAI,CAACE,MAAM;QAE3C,MAAMd,SAASa,YAAY;YAAEH,WAAW+D,KAAKN,KAAK;YAAEvD;QAAQ,GAAG6D,KAAKtB,KAAK;QACzE,MAAM3D,WAAWqB,YAAY;YAAED;YAASF,WAAW+D,KAAKN,KAAK;QAAC;QAC9D,MAAMpE,iBAAiBc,YAAY;YAAED;YAASF,WAAW+D,KAAKN,KAAK;QAAC;QACpE,MAAMrE,eAAee,YAAY;YAAED;YAASF,WAAW+D,KAAKN,KAAK;QAAC,GAAG;YAAEA,OAAOM,KAAKN,KAAK;YAAEmB,SAAS,IAAIjB,OAAOkB,WAAW;QAAG;IAC9H;IAEA;;;GAGC,GACD,AAAQC,WAAWnD,KAAa,EAAU;QACxC,OAAO,GAAG,IAAI,CAACvB,MAAM,CAACF,OAAO,CAAC,SAAS,EAAEyB,OAAO;IAClD;IAEA;;;GAGC,GACD,MAAcD,kBAAkBqC,IAA6C,EAAiB;QAC5F,MAAM,EAAE5D,UAAU,EAAE,GAAG,IAAI,CAACC,MAAM;QAClC,MAAM2E,SAAsB;YAAEzD,cAAcyC,KAAKzC,YAAY;YAAE0D,WAAWrB,KAAKC,GAAG;QAAG;QACrF,MAAMzD,WAAW4C,GAAG,CAAC,IAAI,CAAC+B,UAAU,CAACf,KAAKpC,KAAK,GAAGoD,QAAQnF;IAC5D;IAEA;;;GAGC,GACD,MAAcqF,2BAA2BtD,KAAa,EAAwB;QAC5E,MAAM,EAAExB,UAAU,EAAE,GAAG,IAAI,CAACC,MAAM;QAElC,MAAM8E,cAAc,MAAM/E,WAAWgF,GAAG,CAAc,IAAI,CAACL,UAAU,CAACnD;QACtE,IAAI,CAACuD,aAAa;YAChB,MAAM,IAAInE,MAAM;QAClB;QAEA,wBAAwB;QACxB,IAAI4C,KAAKC,GAAG,KAAKsB,YAAYF,SAAS,GAAGpF,kBAAkB;YACzD,MAAMO,WAAWiF,MAAM,CAAC,IAAI,CAACN,UAAU,CAACnD;YACxC,MAAM,IAAIZ,MAAM;QAClB;QAEA,OAAOmE;IACT;IAEA;;GAEC,GACD,MAAcG,oBAAoBtB,IAA4D,EAAiB;QAC7G,MAAM,EAAE5D,UAAU,EAAE,GAAG,IAAI,CAACC,MAAM;QAClC,MAAMkF,UAAuB;YAC3B,GAAGvB,KAAKwB,OAAO;YACfC,aAAa7B,KAAKC,GAAG;YACrBH,OAAOM,KAAKN,KAAK;QACnB;QACA,MAAMtD,WAAW4C,GAAG,CAAC,IAAI,CAAC+B,UAAU,CAACf,KAAKpC,KAAK,GAAG2D,SAAS1F;IAC7D;IAEA;;GAEC,GACD,MAAc6F,kBAAkB9D,KAAa,EAAiB;QAC5D,MAAM,EAAExB,UAAU,EAAE,GAAG,IAAI,CAACC,MAAM;QAClC,MAAMD,WAAWiF,MAAM,CAAC,IAAI,CAACN,UAAU,CAACnD;IAC1C;IAEA;;;GAGC,GACD,MAAc+D,uBAAuB/D,KAAa,EAA+B;QAC/E,MAAM,EAAExB,UAAU,EAAE,GAAG,IAAI,CAACC,MAAM;QAClC,MAAMuF,MAAM,IAAI,CAACb,UAAU,CAACnD;QAC5B,MAAMiE,QAAQjC,KAAKC,GAAG;QAEtB,MAAOD,KAAKC,GAAG,KAAKgC,QAAQhG,iBAAkB;YAC5C,MAAM2F,UAAU,MAAMpF,WAAWgF,GAAG,CAAcQ;YAClD,IAAIJ,oBAAAA,8BAAAA,QAASC,WAAW,EAAE;gBACxB,OAAO;oBAAE/B,OAAO8B,QAAQ9B,KAAK;gBAAC;YAChC;YACA,MAAM,IAAIoC,QAAQ,CAACC,IAAMC,WAAWD,GAAGjG;QACzC;QAEA,MAAM,IAAIkB,MAAM;IAClB;IAEA;;;;;;;;;GASC,GACD,MAAciF,qBAAqBjC,IAA0D,EAAkD;QAC7I,MAAM,EAAE9D,MAAM,EAAEC,OAAO,EAAE,GAAG,IAAI,CAACE,MAAM;QAEvC,MAAMmF,UAAU,MAAM,IAAI,CAACN,0BAA0B,CAAClB,KAAKpC,KAAK;QAEhE1B,OAAOU,IAAI,CAAC,6BAA6B;YAAET;YAASyB,OAAOoC,KAAKpC,KAAK;QAAC;QAEtE,MAAMsE,SAAS,MAAM,IAAI,CAAC9B,uBAAuB,CAAC;YAChDG,MAAMP,KAAKO,IAAI;YACfhD,cAAciE,QAAQjE,YAAY;YAClCF,aAAa2C,KAAK3C,WAAW;QAC/B;QAEA,MAAM,IAAI,CAACuD,iBAAiB,CAACsB;QAC7B,MAAM,IAAI,CAACZ,mBAAmB,CAAC;YAAE1D,OAAOoC,KAAKpC,KAAK;YAAE8B,OAAOwC,OAAOxC,KAAK;YAAE8B;QAAQ;QAEjFtF,OAAOU,IAAI,CAAC,4BAA4B;YAAET;YAASuD,OAAOwC,OAAOxC,KAAK;QAAC;QACvE,OAAOwC;IACT;IAEA,8EAA8E;IAC9E,mCAAmC;IACnC,8EAA8E;IAE9E;;;;;;;;GAQC,GACD,AAAQC,0BAA0BnC,IAKjC,EAAe;QACd,MAAM,EAAE9D,MAAM,EAAE,GAAG,IAAI,CAACG,MAAM;QAE9B,2DAA2D;QAC3D,OAAOX,KAAK0G,YAAY,CAAC,OAAOC,KAAKC;YACnC,IAAI;gBACF,IAAI,CAACD,IAAIpE,GAAG,EAAE;oBACZqE,IAAIC,SAAS,CAAC,KAAK;wBAAE,gBAAgB;oBAAY;oBACjDD,IAAIE,GAAG,CAACtH,iBAAiB;oBACzB8E,KAAKyC,OAAO,CAAC,IAAIzF,MAAM;oBACvB;gBACF;gBAEA,mFAAmF;gBACnF,MAAMiB,MAAM,IAAIgC,IAAIoC,IAAIpE,GAAG,EAAE;gBAE7B,IAAIA,IAAIyE,QAAQ,KAAK1C,KAAK2C,YAAY,EAAE;oBACtCL,IAAIC,SAAS,CAAC,KAAK;wBAAE,gBAAgB;oBAAa;oBAClDD,IAAIE,GAAG,CAAC;oBACR;gBACF;gBAEA,MAAMjC,OAAOtC,IAAIiC,YAAY,CAACkB,GAAG,CAAC;gBAClC,MAAMrE,QAAQkB,IAAIiC,YAAY,CAACkB,GAAG,CAAC;gBACnC,MAAMxD,QAAQK,IAAIiC,YAAY,CAACkB,GAAG,CAAC;gBAEnC,IAAIrE,OAAO;oBACTuF,IAAIC,SAAS,CAAC,KAAK;wBAAE,gBAAgB;oBAAY;oBACjDD,IAAIE,GAAG,CAACtH,iBAAiB6B;oBACzBiD,KAAKyC,OAAO,CAAC,IAAIzF,MAAM,CAAC,aAAa,EAAED,OAAO;oBAC9C;gBACF;gBAEA,IAAI,CAACwD,MAAM;oBACT+B,IAAIC,SAAS,CAAC,KAAK;wBAAE,gBAAgB;oBAAY;oBACjDD,IAAIE,GAAG,CAACtH,iBAAiB;oBACzB8E,KAAKyC,OAAO,CAAC,IAAIzF,MAAM;oBACvB;gBACF;gBAEA,IAAI,CAACY,OAAO;oBACV0E,IAAIC,SAAS,CAAC,KAAK;wBAAE,gBAAgB;oBAAY;oBACjDD,IAAIE,GAAG,CAACtH,iBAAiB;oBACzB8E,KAAKyC,OAAO,CAAC,IAAIzF,MAAM;oBACvB;gBACF;gBAEA,IAAI;oBACF,MAAM,IAAI,CAACiF,oBAAoB,CAAC;wBAC9B1B;wBACA3C;wBACAP,aAAa2C,KAAK4C,gBAAgB;oBACpC;oBAEAN,IAAIC,SAAS,CAAC,KAAK;wBAAE,gBAAgB;oBAAY;oBACjDD,IAAIE,GAAG,CAACrH;oBAER6E,KAAK6C,MAAM;gBACb,EAAE,OAAOC,eAAe;oBACtB5G,OAAOa,KAAK,CAAC,yBAAyB;wBAAEA,OAAO+F,yBAAyB9F,QAAQ8F,cAAc7F,OAAO,GAAGC,OAAO4F;oBAAe;oBAC9HR,IAAIC,SAAS,CAAC,KAAK;wBAAE,gBAAgB;oBAAY;oBACjDD,IAAIE,GAAG,CAACtH,iBAAiB;oBACzB8E,KAAKyC,OAAO,CAACK;gBACf;YACF,EAAE,OAAOC,YAAY;gBACnB7G,OAAOa,KAAK,CAAC,+BAA+B;oBAAEA,OAAOgG,sBAAsB/F,QAAQ+F,WAAW9F,OAAO,GAAGC,OAAO6F;gBAAY;gBAC3HT,IAAIC,SAAS,CAAC,KAAK;oBAAE,gBAAgB;gBAAY;gBACjDD,IAAIE,GAAG,CAACtH,iBAAiB;gBACzB8E,KAAKyC,OAAO,CAACM;YACf;QACF;IACF;IAEA;;;GAGC,GACD,MAAc3E,0BAAuD;QACnE,MAAM,EAAEF,QAAQ,EAAEhC,MAAM,EAAEmB,aAAa2F,iBAAiB,EAAE7G,OAAO,EAAEC,UAAU,EAAE,GAAG,IAAI,CAACC,MAAM;QAE7F,6DAA6D;QAC7D,IAAI4G,aAAa,aAAa,4CAA4C;QAC1E,IAAIC,aAAa,GAAG,sCAAsC;QAE1D,wEAAwE;QACxE,IAAIP,eAAe,aAAa,wBAAwB;QACxD,IAAIQ,mBAAmB;QAEvB,IAAIH,mBAAmB;YACrB,IAAI;gBACF,MAAMI,SAAS,IAAInD,IAAI+C;gBACvB,MAAMK,aAAaD,OAAOE,QAAQ,KAAK,eAAeF,OAAOE,QAAQ,KAAK;gBAE1E,IAAID,YAAY;oBACd,8DAA8D;oBAC9DJ,aAAaG,OAAOE,QAAQ;oBAC5BJ,aAAaE,OAAOG,IAAI,GAAGC,OAAOC,QAAQ,CAACL,OAAOG,IAAI,EAAE,MAAM;gBAChE,OAAO;oBACL,iEAAiE;oBACjE,+EAA+E;oBAC/E,wEAAwE;oBACxEN,aAAa;oBACb,MAAMS,UAAUC,QAAQC,GAAG,CAACC,IAAI,GAAGL,OAAOC,QAAQ,CAACE,QAAQC,GAAG,CAACC,IAAI,EAAE,MAAMnD;oBAC3EwC,aAAaQ,WAAWF,OAAOM,QAAQ,CAACJ,WAAWA,UAAU;gBAC/D;gBAEA,iCAAiC;gBACjC,IAAIN,OAAOV,QAAQ,IAAIU,OAAOV,QAAQ,KAAK,KAAK;oBAC9CC,eAAeS,OAAOV,QAAQ;gBAChC;gBAEAS,mBAAmB;gBAEnBjH,OAAOK,KAAK,CAAC,iCAAiC;oBAC5C0G;oBACAC;oBACAP;oBACAtF,aAAa2F;oBACbK;gBACF;YACF,EAAE,OAAOtG,OAAO;gBACdb,OAAO6H,IAAI,CAAC,yDAAyD;oBACnE1G,aAAa2F;oBACbjG,OAAOA,iBAAiBC,QAAQD,MAAME,OAAO,GAAGC,OAAOH;gBACzD;YACA,8DAA8D;YAChE;QACF;QAEA,kCAAkC;QAClC,MAAM,EAAEO,UAAUC,YAAY,EAAEC,WAAWC,aAAa,EAAE,GAAGzC;QAC7D,MAAM0C,UAAUlC;QAEhB,kDAAkD;QAClD,MAAM,IAAI,CAACmC,iBAAiB,CAAC;YAAEC,OAAOF;YAASH;QAAa;QAE5D,IAAIyG,SAA6B;QACjC,IAAIC;QACJ,IAAIrB,kBAA0B,mBAAmB;QAEjD,2DAA2D;QAC3DoB,SAAS,IAAI,CAAC7B,yBAAyB,CAAC;YACtCQ;YACAC,kBAAkB,IAAMA;YACxBC,QAAQ;gBACNmB,mBAAAA,6BAAAA,OAAQE,KAAK;YACf;YACAzB,SAAS,CAAC0B;gBACRjI,OAAOa,KAAK,CAAC,gCAAgC;oBAAEA,OAAOoH,eAAenH,QAAQmH,IAAIlH,OAAO,GAAGC,OAAOiH;gBAAK;gBACvGH,mBAAAA,6BAAAA,OAAQE,KAAK;YACf;QACF;QAEA,kBAAkB;QAClB,MAAM,IAAIpC,QAAc,CAACsC,SAASC;YAChCL,mBAAAA,6BAAAA,OAAQM,MAAM,CAACpB,YAAYD,YAAY;gBACrC,MAAMsB,UAAUP,mBAAAA,6BAAAA,OAAQO,OAAO;gBAC/B,IAAI,CAACA,WAAW,OAAOA,YAAY,UAAU;oBAC3CP,mBAAAA,6BAAAA,OAAQE,KAAK;oBACbG,OAAO,IAAIrH,MAAM;oBACjB;gBACF;gBAEAiH,aAAaM,QAAQhB,IAAI;gBAEzB,+BAA+B;gBAC/B,IAAIJ,oBAAoBH,mBAAmB;oBACzCJ,mBAAmBI;gBACrB,OAAO;oBACLJ,mBAAmB,CAAC,iBAAiB,EAAEqB,aAAatB,cAAc;gBACpE;gBAEAzG,OAAOU,IAAI,CAAC,kCAAkC;oBAAE2G,MAAMU;oBAAY/F;oBAAU/B;gBAAQ;gBAEpFiI;YACF;QACF;QAEA,6DAA6D;QAC7DpC,WAAW;YACT,IAAIgC,QAAQ;gBACVA,OAAOE,KAAK;gBACZ,oDAAoD;gBACpD,0DAA0D;gBAC1D,KAAK9H,WAAWiF,MAAM,CAAC,IAAI,CAACN,UAAU,CAACrD;YACzC;QACF,GAAG7B;QAEH,kDAAkD;QAClD,MAAMgC,UAAU,IAAI,CAACC,YAAY,CAAC;YAChCT,aAAauF;YACbnF;YACAG,OAAOF;QACT;QAEA,OAAO;YACLK,MAAM;YACNC,UAAU7B;YACV8B,KAAKJ;QACP;IACF;IAEA,MAAcyC,qBAAqBC,IAAY,EAAEhD,YAAoB,EAAEF,WAAmB,EAA0B;QAClH,MAAM,EAAEF,QAAQ,EAAEmB,YAAY,EAAE,GAAG,IAAI,CAACjC,MAAM;QAE9C,MAAMmI,WAAW;QACjB,MAAMC,SAAiC;YACrClE;YACAmE,WAAWvH;YACXwH,cAActH;YACduH,YAAY;YACZC,eAAetH;QACjB;QACA,IAAIe,cAAc;YAChBmG,OAAOK,aAAa,GAAGxG;QACzB;QACA,MAAMyG,OAAO,IAAIC,gBAAgBP;QAEjC,MAAMvF,WAAW,MAAMC,MAAMqF,UAAU;YACrCS,QAAQ;YACRnG,SAAS;gBACP,gBAAgB;YAClB;YACAiG,MAAMA,KAAK5E,QAAQ;QACrB;QAEA,IAAI,CAACjB,SAASG,EAAE,EAAE;YAChB,MAAMU,YAAY,MAAMb,SAASK,IAAI;YACrC,MAAM,IAAIvC,MAAM,CAAC,uBAAuB,EAAEkC,SAASI,MAAM,CAAC,CAAC,EAAES,WAAW;QAC1E;QAEA,OAAQ,MAAMb,SAASO,IAAI;IAC7B;IAEA,MAAc3C,mBAAmBH,YAAoB,EAAwB;QAC3E,MAAM,EAAEQ,QAAQ,EAAEmB,YAAY,EAAE,GAAG,IAAI,CAACjC,MAAM;QAE9C,MAAMmI,WAAW;QACjB,MAAMC,SAAiC;YACrChE,eAAe9D;YACf+H,WAAWvH;YACXyH,YAAY;QACd;QACA,IAAItG,cAAc;YAChBmG,OAAOK,aAAa,GAAGxG;QACzB;QACA,MAAMyG,OAAO,IAAIC,gBAAgBP;QAEjC,MAAMvF,WAAW,MAAMC,MAAMqF,UAAU;YACrCS,QAAQ;YACRnG,SAAS;gBACP,gBAAgB;YAClB;YACAiG,MAAMA,KAAK5E,QAAQ;QACrB;QAEA,IAAI,CAACjB,SAASG,EAAE,EAAE;YAChB,MAAMU,YAAY,MAAMb,SAASK,IAAI;YACrC,MAAM,IAAIvC,MAAM,CAAC,sBAAsB,EAAEkC,SAASI,MAAM,CAAC,CAAC,EAAES,WAAW;QACzE;QAEA,MAAMM,gBAAiB,MAAMnB,SAASO,IAAI;QAE1C,OAAO;YACL/C,aAAa2D,cAAczB,YAAY;YACvCjC,cAAcA;YACd,GAAI0D,cAAcM,UAAU,KAAKD,aAAa;gBAAEf,WAAWC,KAAKC,GAAG,KAAKQ,cAAcM,UAAU,GAAG;YAAK,CAAC;YACzG,GAAIN,cAAcjD,KAAK,KAAKsD,aAAa;gBAAEtD,OAAOiD,cAAcjD,KAAK;YAAC,CAAC;QACzE;IACF;IAEA;;;;;;GAMC,GACD,MAAM8H,oBAAoBT,MAAwC,EAAkD;QAClH,MAAM,EAAElE,IAAI,EAAE3C,KAAK,EAAE,GAAG6G;QACxB,MAAM,EAAEpH,WAAW,EAAE,GAAG,IAAI,CAAChB,MAAM;QAEnC,IAAI,CAACuB,OAAO;YACV,MAAM,IAAIZ,MAAM;QAClB;QAEA,IAAI,CAACK,aAAa;YAChB,MAAM,IAAIL,MAAM;QAClB;QAEA,0DAA0D;QAC1D,OAAO,MAAM,IAAI,CAACiF,oBAAoB,CAAC;YAAE1B;YAAM3C;YAAOP;QAAY;IACpE;IAEA;;;;;;;;;;;;;;GAcC,GACD8H,iBAAiB;QACf,MAAM,EAAEhJ,OAAO,EAAEC,UAAU,EAAEF,MAAM,EAAE,GAAG,IAAI,CAACG,MAAM;QAEnD,0EAA0E;QAC1E,sFAAsF;QACtF,MAAM+I,iBAAiB,CAAuEC,QAAWC;YACvG,MAAMC,YAAYF,OAAOG,IAAI;YAC7B,MAAMC,kBAAkBJ,OAAOK,OAAO;YAEtC,MAAMC,iBAAiB,OAAO,GAAGC;gBAC/B,0CAA0C;gBAC1C,MAAMC,QAAQD,OAAO,CAACN,cAAc;gBAEpC,+CAA+C;gBAC/C,MAAMQ,6BAA6B;oBACjC,IAAI;wBACF,qDAAqD;wBACrD,IAAI7J;wBACJ,IAAI;;gCACU;4BAAZA,qBAAY,eAAA,AAAC4J,MAA6CE,KAAK,cAAnD,mCAAA,aAAqD9J,SAAS,uCAAK,MAAMhB,iBAAiBmB,YAAY;gCAAED;4BAAQ;wBAC9H,EAAE,OAAOY,OAAO;4BACd,IAAIA,iBAAiBC,SAAW,CAAA,AAACD,MAA4BwD,IAAI,KAAK,6BAA6BxD,MAAMyI,IAAI,KAAK,qBAAoB,GAAgB;gCACpJvJ,YAAYyE;4BACd,OAAO;gCACL,MAAM3D;4BACR;wBACF;wBAEA,MAAM,IAAI,CAACf,cAAc,CAACC;wBAE1B,MAAMK,qBAAqBL,sBAAAA,uBAAAA,YAAc,MAAMhB,iBAAiBmB,YAAY;4BAAED;wBAAQ;wBACtF,IAAI,CAACG,oBAAoB;4BACvB,MAAM,IAAIU,MAAM,CAAC,8CAA8C,EAAEb,SAAS;wBAC5E;wBAEA,OAAOG;oBACT,EAAE,OAAOS,OAAO;wBACd,IAAIA,iBAAiBnB,qBAAqBmB,MAAMoB,UAAU,CAACJ,IAAI,KAAK,YAAY;4BAC9E,sFAAsF;4BACtF,IAAI,IAAI,CAAC1B,MAAM,CAAC6B,QAAQ,EAAE,MAAMnB;4BAEhC,yFAAyF;4BACzF,MAAMc,UAAU,IAAIoC,IAAIlD,MAAMoB,UAAU,CAACF,GAAG;4BAC5C,MAAML,QAAQC,QAAQqC,YAAY,CAACkB,GAAG,CAAC;4BACvC,IAAI,CAACxD,OAAO,MAAM,IAAIZ,MAAM;4BAE5B,IAAI,CAAC,IAAI,CAACgJ,YAAY,CAACC,GAAG,CAACrI,QAAQ;gCACjC,IAAI,CAACoI,YAAY,CAACE,GAAG,CAACtI;gCACtBjC,KAAKoB,MAAMoB,UAAU,CAACF,GAAG,EAAEkI,KAAK,CAAC,CAACC;oCAChClK,OAAOU,IAAI,CAAC,wCAAwC;wCAAEG,OAAOqJ,aAAapJ,QAAQoJ,EAAEnJ,OAAO,GAAGC,OAAOkJ;oCAAG;gCAC1G;4BACF;4BAEA,8CAA8C;4BAC9C,MAAM,IAAI,CAACzE,sBAAsB,CAAC/D;4BAElC,oDAAoD;4BACpD,MAAM,IAAI,CAAC8D,iBAAiB,CAAC9D;4BAE7B,yBAAyB;4BACzB,OAAO,MAAMkI;wBACf;wBAEA,MAAM/I;oBACR;gBACF;gBAEA,IAAI;oBACF,MAAMT,qBAAqB,MAAMwJ;oBACjC,MAAMO,OAAO,IAAI,CAAChI,MAAM,CAAC/B;oBAEzB,2CAA2C;oBAC1CuJ,MAAwCS,WAAW,GAAG;wBACrDD;wBACApK,WAAWK;oBACb;oBACCuJ,MAA+B3J,MAAM,GAAGA;oBAEzC,sCAAsC;oBACtC,OAAO,MAAMuJ,mBAAmBG;gBAClC,EAAE,OAAO7I,OAAO;oBACd,IAAIA,iBAAiBnB,mBAAmB;wBACtCM,OAAOU,IAAI,CAAC,2BAA2B;4BACrCT;4BACAoK,MAAMhB;4BACNpH,YAAYpB,MAAMoB,UAAU;wBAC9B;wBAEA,MAAMqI,uBAAuB;4BAC3BC,MAAM;4BACNzI,UAAU7B;4BACVc,SAAS,CAAC,4BAA4B,EAAEsI,UAAU,2BAA2B,EAAEpJ,QAAQ,CAAC,CAAC;4BACzF8B,KAAKlB,MAAMoB,UAAU,CAACJ,IAAI,KAAK,aAAahB,MAAMoB,UAAU,CAACF,GAAG,GAAGyC;wBACrE;wBAEA,OAAO;4BACLgG,SAAS;gCACP;oCACED,MAAM;oCACNlH,MAAMoH,KAAKC,SAAS,CAAC;wCAAE1E,QAAQsE;oCAAqB;gCACtD;6BACD;4BACDK,mBAAmB;gCAAE3E,QAAQsE;4BAAqB;wBACpD;oBACF;oBACA,MAAMzJ;gBACR;YACF;YAEA,OAAO;gBACL,GAAGsI,MAAM;gBACTK,SAASC;YACX;QACF;QAEA,OAAO;YACLmB,cAAc,CAAgEzB,SAAcD,eAAeC,QAAQ;YACnH0B,kBAAkB,CAAqF1B,SAAcD,eAAeC,QAAQ;YAC5I2B,gBAAgB,CAAgE3B,SAAcD,eAAeC,QAAQ;QACvH;IACF;IAlxBA,YAAYhJ,MAA2B,CAAE;QAHzC,6FAA6F;aACrF2J,eAAe,IAAIiB;QAGzB,IAAI,CAAC5K,MAAM,GAAGA;IAChB;AAixBF;AAEA;;;CAGC,GACD,OAAO,SAAS6K,qBAAqB7K,MAA2B;IAC9D,OAAO,IAAIN,sBAAsBM;AACnC"}

package/dist/esm/providers/service-account.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/Projects/ai/mcp-z/oauth/oauth-google/src/providers/service-account.ts"],"sourcesContent":["import { promises as fs } from 'fs';\nimport { OAuth2Client } from 'google-auth-library';\nimport { importPKCS8, SignJWT } from 'jose';\nimport type { AuthContext, EnrichedExtra, Logger, OAuth2TokenStorageProvider } from '../types.ts';\n\n/**\n * Service Account Key File Structure\n * Standard Google Cloud service account JSON key format\n */\ninterface ServiceAccountKey {\n  type: 'service_account';\n  project_id: string;\n  private_key_id: string;\n  private_key: string;\n  client_email: string;\n  client_id: string;\n  auth_uri: string;\n  token_uri: string;\n  auth_provider_x509_cert_url?: string;\n  client_x509_cert_url?: string;\n}\n\n/**\n * Service Account Provider Configuration\n */\nexport interface ServiceAccountConfig {\n  /** Path to Google Cloud service account JSON key file */\n  keyFilePath: string;\n  /** OAuth scopes to request (e.g., ['https://www.googleapis.com/auth/gmail.readonly']) */\n  scopes: string[];\n  /** Logger for auth operations */\n  logger: Logger;\n}\n\n/**\n * Token Exchange Response from Google OAuth endpoint\n */\ninterface TokenResponse {\n  access_token: string;\n  expires_in: number;\n  token_type: string;\n}\n\n/**\n * ServiceAccountProvider implements OAuth2TokenStorageProvider using Google Service Accounts\n * with JWT-based (2-legged OAuth) authentication.\n *\n * This provider:\n * - Loads service account key file from disk\n * - Generates self-signed JWTs using RS256 algorithm\n * - Exchanges JWTs for access tokens at Google's token endpoint\n * - Does NOT store tokens (regenerates on each request)\n * - Provides single static identity (no account management)\n *\n * @example\n * ```typescript\n * const provider = new ServiceAccountProvider({\n *   keyFilePath: '/path/to/service-account-key.json',\n *   scopes: ['https://www.googleapis.com/auth/drive.readonly'],\n * });\n *\n * // Get authenticated OAuth2Client for googleapis\n * const auth = provider.toAuth('default');\n * const drive = google.drive({ version: 'v3', auth });\n * ```\n */\nexport class ServiceAccountProvider implements OAuth2TokenStorageProvider {\n  private config: ServiceAccountConfig;\n  private keyFilePath: string;\n  private scopes: string[];\n  private keyData?: ServiceAccountKey;\n  private cachedToken?: { token: string; expiry: number };\n\n  constructor(config: ServiceAccountConfig) {\n    this.config = config;\n    this.keyFilePath = config.keyFilePath;\n    this.scopes = config.scopes;\n  }\n\n  /**\n   * Load and parse service account key file from disk\n   * Validates structure and caches for subsequent calls\n   */\n  private async loadKeyFile(): Promise<ServiceAccountKey> {\n    // Return cached key data if already loaded\n    if (this.keyData) {\n      return this.keyData;\n    }\n\n    try {\n      // Read key file from disk\n      const fileContent = await fs.readFile(this.keyFilePath, 'utf-8');\n\n      // Parse JSON\n      let keyData: unknown;\n      try {\n        keyData = JSON.parse(fileContent);\n      } catch (parseError) {\n        throw new Error(`Failed to parse service account key file as JSON: ${this.keyFilePath}\\n` + `Error: ${parseError instanceof Error ? parseError.message : String(parseError)}`);\n      }\n\n      // Validate structure\n      this.keyData = this.validateKeyFile(keyData);\n      return this.keyData;\n    } catch (error) {\n      // Handle file not found\n      if ((error as NodeJS.ErrnoException).code === 'ENOENT') {\n        throw new Error(`Service account key file not found: ${this.keyFilePath}\\nMake sure GOOGLE_SERVICE_ACCOUNT_KEY_FILE points to a valid file path.`);\n      }\n\n      // Handle permission errors\n      if ((error as NodeJS.ErrnoException).code === 'EACCES') {\n        throw new Error(`Permission denied reading service account key file: ${this.keyFilePath}\\nCheck file permissions (should be readable by current user).`);\n      }\n\n      // Re-throw other errors\n      throw error;\n    }\n  }\n\n  /**\n   * Validate service account key file structure\n   * Ensures all required fields are present and correctly typed\n   */\n  private validateKeyFile(data: unknown): ServiceAccountKey {\n    if (!data || typeof data !== 'object') {\n      throw new Error('Service account key file must contain a JSON object');\n    }\n\n    const obj = data as Record<string, unknown>;\n\n    // Validate type field\n    if (obj.type !== 'service_account') {\n      throw new Error(`Invalid service account key file: Expected type \"service_account\", got \"${obj.type}\"\\nMake sure you downloaded a service account key, not an OAuth client credential.`);\n    }\n\n    // Validate required string fields\n    const requiredFields: Array<keyof ServiceAccountKey> = ['project_id', 'private_key_id', 'private_key', 'client_email', 'client_id', 'auth_uri', 'token_uri'];\n\n    const missingFields = requiredFields.filter((field) => typeof obj[field] !== 'string' || !obj[field]);\n\n    if (missingFields.length > 0) {\n      throw new Error(`Service account key file is missing required fields: ${missingFields.join(', ')}\\nMake sure you downloaded a complete service account key file from Google Cloud Console.`);\n    }\n\n    // Validate private key format\n    const privateKey = obj.private_key as string;\n    if (!privateKey.includes('BEGIN PRIVATE KEY') || !privateKey.includes('END PRIVATE KEY')) {\n      throw new Error('Service account private_key field does not contain a valid PEM-formatted key.\\n' + 'Expected format: -----BEGIN PRIVATE KEY-----...-----END PRIVATE KEY-----');\n    }\n\n    return obj as unknown as ServiceAccountKey;\n  }\n\n  /**\n   * Generate signed JWT (JSON Web Token) for service account authentication\n   * Uses RS256 algorithm with private key from key file\n   */\n  private async generateJWT(): Promise<string> {\n    const keyData = await this.loadKeyFile();\n\n    // Import private key using jose\n    const privateKey = await importPKCS8(keyData.private_key, 'RS256');\n\n    // Current time\n    const now = Math.floor(Date.now() / 1000);\n\n    // Create JWT with required claims for Google OAuth\n    const jwt = await new SignJWT({\n      iss: keyData.client_email, // Issuer: service account email\n      scope: this.scopes.join(' '), // Scopes: space-separated\n      aud: 'https://oauth2.googleapis.com/token', // Audience: token endpoint\n      exp: now + 3600, // Expiration: 1 hour from now\n      iat: now, // Issued at: current time\n    })\n      .setProtectedHeader({ alg: 'RS256', typ: 'JWT' })\n      .sign(privateKey);\n\n    return jwt;\n  }\n\n  /**\n   * Exchange signed JWT for access token at Google OAuth endpoint\n   * POST to https://oauth2.googleapis.com/token with grant_type=jwt-bearer\n   */\n  private async exchangeJWT(jwt: string): Promise<{ token: string; expiry: number }> {\n    const tokenEndpoint = 'https://oauth2.googleapis.com/token';\n\n    try {\n      const response = await fetch(tokenEndpoint, {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/x-www-form-urlencoded',\n        },\n        body: new URLSearchParams({\n          grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer',\n          assertion: jwt,\n        }),\n      });\n\n      // Handle non-2xx responses\n      if (!response.ok) {\n        const errorText = await response.text();\n        let errorMessage: string;\n\n        try {\n          const errorJson = JSON.parse(errorText);\n          errorMessage = errorJson.error_description || errorJson.error || errorText;\n        } catch {\n          errorMessage = errorText;\n        }\n\n        // 400: Invalid JWT (malformed claims, expired, etc.)\n        if (response.status === 400) {\n          throw new Error(`Invalid service account JWT: ${errorMessage}\\nThis usually means the JWT claims are malformed or the key file is invalid.`);\n        }\n\n        // 401: Unauthorized (revoked service account, wrong scopes, etc.)\n        if (response.status === 401) {\n          throw new Error(`Service account authentication failed: ${errorMessage}\\nThe service account may have been disabled or deleted. Check Google Cloud Console.`);\n        }\n\n        // Other errors\n        throw new Error(`Token exchange failed (HTTP ${response.status}): ${errorMessage}`);\n      }\n\n      // Parse successful response\n      const tokenData = (await response.json()) as TokenResponse;\n\n      // Calculate expiry timestamp (token expires in ~1 hour)\n      const expiry = Date.now() + (tokenData.expires_in - 60) * 1000; // Subtract 60s for safety margin\n\n      return {\n        token: tokenData.access_token,\n        expiry,\n      };\n    } catch (error) {\n      // Network errors\n      if (error instanceof TypeError && error.message.includes('fetch')) {\n        throw new Error('Network error connecting to Google OAuth endpoint. Check internet connection.');\n      }\n\n      // Re-throw other errors\n      throw error;\n    }\n  }\n\n  /**\n   * Get access token for Google APIs\n   * Generates fresh JWT and exchanges for access token on each call\n   *\n   * Note: accountId parameter is ignored for service accounts (service account is single static identity)\n   */\n  async getAccessToken(_accountId?: string): Promise<string> {\n    // Check if we have a valid cached token (optional optimization)\n    if (this.cachedToken && this.cachedToken.expiry > Date.now()) {\n      return this.cachedToken.token;\n    }\n\n    try {\n      // Generate JWT\n      const jwt = await this.generateJWT();\n\n      // Exchange for access token\n      const { token, expiry } = await this.exchangeJWT(jwt);\n\n      // Cache token for subsequent calls (optional optimization)\n      this.cachedToken = { token, expiry };\n\n      return token;\n    } catch (error) {\n      // Add context to errors\n      throw new Error(`Failed to get service account access token: ${error instanceof Error ? error.message : String(error)}`);\n    }\n  }\n\n  /**\n   * Get OAuth2Client with service account credentials for googleapis\n   * This is the CRITICAL method that servers use to get authenticated API clients\n   *\n   * Service account ONLY works with accountId='service-account' (single static identity)\n   *\n    @param accountId - Account identifier (must be 'service-account' or undefined)\n   * @returns OAuth2Client instance with access token credentials set\n   */\n  toAuth(accountId?: string): OAuth2Client {\n    // Service account ONLY works with 'service-account' account ID\n    if (accountId !== undefined && accountId !== 'service-account') {\n      throw new Error(`ServiceAccountProvider only supports accountId='service-account', got '${accountId}'. Service account uses a single static identity pattern.`);\n    }\n\n    // Create OAuth2Client instance (no client ID/secret needed for service accounts)\n    const client = new OAuth2Client();\n\n    // Override getRequestMetadataAsync to provide authentication headers for each request\n    // This is the method googleapis calls to get auth headers - can be async and fetch tokens on-demand\n    (\n      client as OAuth2Client & {\n        getRequestMetadataAsync: (url?: string) => Promise<{ headers: Headers | Map<string, string> }>;\n      }\n    ).getRequestMetadataAsync = async (_url?: string) => {\n      try {\n        // Get fresh access token (can be async, will trigger JWT generation if needed)\n        const token = await this.getAccessToken();\n\n        // Update client credentials for consistency (other googleapis methods might check these)\n        client.credentials = {\n          access_token: token,\n          token_type: 'Bearer',\n        };\n\n        // Return headers as Headers instance for proper TypeScript types\n        const headers = new Headers();\n        headers.set('authorization', `Bearer ${token}`);\n        return { headers };\n      } catch (error) {\n        this.config.logger?.error('Failed to get service account access token for API request', { error });\n        throw error;\n      }\n    };\n\n    // Override getAccessToken to support googleapis client API and direct token access\n    client.getAccessToken = async () => {\n      try {\n        const token = await this.getAccessToken();\n        return { token };\n      } catch (error) {\n        this.config.logger?.error('Failed to get service account access token', { error });\n        throw error;\n      }\n    };\n\n    this.config.logger?.debug(`ServiceAccountProvider: OAuth2Client created for ${accountId}`);\n    return client;\n  }\n\n  /**\n   * Get service account email address\n   * Used for account registration and display\n   *\n   * Note: accountId parameter is ignored for service accounts\n   * @returns Service account email from key file (e.g., \"service-account@project.iam.gserviceaccount.com\")\n   */\n  async getUserEmail(_accountId?: string): Promise<string> {\n    const keyData = await this.loadKeyFile();\n    return keyData.client_email;\n  }\n\n  /**\n   * Create middleware wrapper for single-user authentication\n   * This is the CRITICAL method that integrates service account auth into MCP servers\n   *\n   * Middleware wraps tool, resource, and prompt handlers and injects authContext into extra parameter.\n   * Handlers receive OAuth2Client via extra.authContext.auth for API calls.\n   *\n   * @returns Object with withToolAuth, withResourceAuth, withPromptAuth methods\n   *\n   * @example\n   * ```typescript\n   * // Server registration\n   * const authMiddleware = provider.authMiddleware();\n   * const tools = toolFactories.map(f => f()).map(authMiddleware.withToolAuth);\n   * const resources = resourceFactories.map(f => f()).map(authMiddleware.withResourceAuth);\n   * const prompts = promptFactories.map(f => f()).map(authMiddleware.withPromptAuth);\n   *\n   * // Tool handler receives auth\n   * async function handler({ id }: In, extra: EnrichedExtra) {\n   *   // extra.authContext.auth is OAuth2Client (from middleware)\n   *   const gmail = google.gmail({ version: 'v1', auth: extra.authContext.auth });\n   * }\n   * ```\n   */\n  authMiddleware() {\n    // Shared wrapper logic - extracts extra parameter from specified position\n    // Generic T captures the actual module type; handler is cast from unknown to callable\n    const wrapAtPosition = <T extends { name: string; handler: unknown; [key: string]: unknown }>(module: T, extraPosition: number): T => {\n      const originalHandler = module.handler as (...args: unknown[]) => Promise<unknown>;\n\n      const wrappedHandler = async (...allArgs: unknown[]) => {\n        // Extract extra from the correct position\n        const extra = allArgs[extraPosition] as EnrichedExtra;\n\n        try {\n          // Use fixed accountId for storage isolation (like device-code pattern)\n          const accountId = 'service-account';\n\n          // Get service account email for logging/display\n          const serviceEmail = await this.getUserEmail();\n\n          // Get access token (generates JWT and exchanges if needed)\n          await this.getAccessToken();\n\n          // Create OAuth2Client with service account credentials\n          const auth = this.toAuth(accountId);\n\n          // Inject authContext and logger into extra parameter\n          (extra as { authContext?: AuthContext }).authContext = {\n            auth, // OAuth2Client for googleapis\n            accountId, // 'service-account' (fixed, not service email)\n            metadata: { serviceEmail }, // Keep email for logging/reference\n          };\n          (extra as { logger?: unknown }).logger = this.config.logger;\n\n          // Call original handler with all args\n          return await originalHandler(...allArgs);\n        } catch (error) {\n          const message = error instanceof Error ? error.message : String(error);\n\n          // Provide specific, actionable error messages based on error type\n          if (message.includes('key file not found')) {\n            throw new Error(`Service account setup error: Key file '${this.keyFilePath}' not found.\\n• Set GOOGLE_SERVICE_ACCOUNT_KEY_FILE environment variable\\n• Or ensure the file path exists and is accessible`);\n          }\n          if (message.includes('Forbidden') || message.includes('access_denied')) {\n            throw new Error(\n              'Service account permission error: The service account does not have required permissions.\\n' + '• Ensure the service account has been granted the necessary roles\\n' + '• Check that required API scopes are enabled in Google Cloud Console\\n' + '• Verify the service account is active (not disabled)'\n            );\n          }\n          if (message.includes('invalid_grant') || message.includes('JWT')) {\n            throw new Error('Service account authentication error: Invalid credentials or expired tokens.\\n' + '• Verify your service account key file is valid and not expired\\n' + '• Check that the service account email and project match your GCP setup\\n' + '• Try regenerating the key file in Google Cloud Console');\n          }\n          if (message.includes('Network error') || message.includes('fetch')) {\n            throw new Error('Service account connection error: Unable to reach Google authentication services.\\n' + '• Check your internet connection\\n' + '• Verify firewall/proxy settings allow HTTPS to oauth2.googleapis.com\\n' + '• Try again in a few moments (may be temporary service issue)');\n          }\n          // Generic fallback with original error\n          throw new Error(`Service account authentication failed: ${message}`);\n        }\n      };\n\n      return {\n        ...module,\n        handler: wrappedHandler,\n      } as T;\n    };\n\n    return {\n      // Use structural constraints to avoid contravariance check on handler type.\n      // wrapAtPosition is now generic and returns T directly.\n      withToolAuth: <T extends { name: string; config: unknown; handler: unknown }>(module: T) => wrapAtPosition(module, 1),\n      withResourceAuth: <T extends { name: string; template?: unknown; config?: unknown; handler: unknown }>(module: T) => wrapAtPosition(module, 2),\n      withPromptAuth: <T extends { name: string; config: unknown; handler: unknown }>(module: T) => wrapAtPosition(module, 0),\n    };\n  }\n}\n"],"names":["promises","fs","OAuth2Client","importPKCS8","SignJWT","ServiceAccountProvider","loadKeyFile","keyData","fileContent","readFile","keyFilePath","JSON","parse","parseError","Error","message","String","validateKeyFile","error","code","data","obj","type","requiredFields","missingFields","filter","field","length","join","privateKey","private_key","includes","generateJWT","now","Math","floor","Date","jwt","iss","client_email","scope","scopes","aud","exp","iat","setProtectedHeader","alg","typ","sign","exchangeJWT","tokenEndpoint","response","fetch","method","headers","body","URLSearchParams","grant_type","assertion","ok","errorText","text","errorMessage","errorJson","error_description","status","tokenData","json","expiry","expires_in","token","access_token","TypeError","getAccessToken","_accountId","cachedToken","toAuth","accountId","undefined","client","getRequestMetadataAsync","_url","credentials","token_type","Headers","set","config","logger","debug","getUserEmail","authMiddleware","wrapAtPosition","module","extraPosition","originalHandler","handler","wrappedHandler","allArgs","extra","serviceEmail","auth","authContext","metadata","withToolAuth","withResourceAuth","withPromptAuth"],"mappings":"AAAA,SAASA,YAAYC,EAAE,QAAQ,KAAK;AACpC,SAASC,YAAY,QAAQ,sBAAsB;AACnD,SAASC,WAAW,EAAEC,OAAO,QAAQ,OAAO;AAyC5C;;;;;;;;;;;;;;;;;;;;;;CAsBC,GACD,OAAO,MAAMC;IAaX;;;GAGC,GACD,MAAcC,cAA0C;QACtD,2CAA2C;QAC3C,IAAI,IAAI,CAACC,OAAO,EAAE;YAChB,OAAO,IAAI,CAACA,OAAO;QACrB;QAEA,IAAI;YACF,0BAA0B;YAC1B,MAAMC,cAAc,MAAMP,GAAGQ,QAAQ,CAAC,IAAI,CAACC,WAAW,EAAE;YAExD,aAAa;YACb,IAAIH;YACJ,IAAI;gBACFA,UAAUI,KAAKC,KAAK,CAACJ;YACvB,EAAE,OAAOK,YAAY;gBACnB,MAAM,IAAIC,MAAM,CAAC,kDAAkD,EAAE,IAAI,CAACJ,WAAW,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,EAAEG,sBAAsBC,QAAQD,WAAWE,OAAO,GAAGC,OAAOH,aAAa;YAC/K;YAEA,qBAAqB;YACrB,IAAI,CAACN,OAAO,GAAG,IAAI,CAACU,eAAe,CAACV;YACpC,OAAO,IAAI,CAACA,OAAO;QACrB,EAAE,OAAOW,OAAO;YACd,wBAAwB;YACxB,IAAI,AAACA,MAAgCC,IAAI,KAAK,UAAU;gBACtD,MAAM,IAAIL,MAAM,CAAC,oCAAoC,EAAE,IAAI,CAACJ,WAAW,CAAC,wEAAwE,CAAC;YACnJ;YAEA,2BAA2B;YAC3B,IAAI,AAACQ,MAAgCC,IAAI,KAAK,UAAU;gBACtD,MAAM,IAAIL,MAAM,CAAC,oDAAoD,EAAE,IAAI,CAACJ,WAAW,CAAC,8DAA8D,CAAC;YACzJ;YAEA,wBAAwB;YACxB,MAAMQ;QACR;IACF;IAEA;;;GAGC,GACD,AAAQD,gBAAgBG,IAAa,EAAqB;QACxD,IAAI,CAACA,QAAQ,OAAOA,SAAS,UAAU;YACrC,MAAM,IAAIN,MAAM;QAClB;QAEA,MAAMO,MAAMD;QAEZ,sBAAsB;QACtB,IAAIC,IAAIC,IAAI,KAAK,mBAAmB;YAClC,MAAM,IAAIR,MAAM,CAAC,wEAAwE,EAAEO,IAAIC,IAAI,CAAC,kFAAkF,CAAC;QACzL;QAEA,kCAAkC;QAClC,MAAMC,iBAAiD;YAAC;YAAc;YAAkB;YAAe;YAAgB;YAAa;YAAY;SAAY;QAE5J,MAAMC,gBAAgBD,eAAeE,MAAM,CAAC,CAACC,QAAU,OAAOL,GAAG,CAACK,MAAM,KAAK,YAAY,CAACL,GAAG,CAACK,MAAM;QAEpG,IAAIF,cAAcG,MAAM,GAAG,GAAG;YAC5B,MAAM,IAAIb,MAAM,CAAC,qDAAqD,EAAEU,cAAcI,IAAI,CAAC,MAAM,yFAAyF,CAAC;QAC7L;QAEA,8BAA8B;QAC9B,MAAMC,aAAaR,IAAIS,WAAW;QAClC,IAAI,CAACD,WAAWE,QAAQ,CAAC,wBAAwB,CAACF,WAAWE,QAAQ,CAAC,oBAAoB;YACxF,MAAM,IAAIjB,MAAM,oFAAoF;QACtG;QAEA,OAAOO;IACT;IAEA;;;GAGC,GACD,MAAcW,cAA+B;QAC3C,MAAMzB,UAAU,MAAM,IAAI,CAACD,WAAW;QAEtC,gCAAgC;QAChC,MAAMuB,aAAa,MAAM1B,YAAYI,QAAQuB,WAAW,EAAE;QAE1D,eAAe;QACf,MAAMG,MAAMC,KAAKC,KAAK,CAACC,KAAKH,GAAG,KAAK;QAEpC,mDAAmD;QACnD,MAAMI,MAAM,MAAM,IAAIjC,QAAQ;YAC5BkC,KAAK/B,QAAQgC,YAAY;YACzBC,OAAO,IAAI,CAACC,MAAM,CAACb,IAAI,CAAC;YACxBc,KAAK;YACLC,KAAKV,MAAM;YACXW,KAAKX;QACP,GACGY,kBAAkB,CAAC;YAAEC,KAAK;YAASC,KAAK;QAAM,GAC9CC,IAAI,CAACnB;QAER,OAAOQ;IACT;IAEA;;;GAGC,GACD,MAAcY,YAAYZ,GAAW,EAA8C;QACjF,MAAMa,gBAAgB;QAEtB,IAAI;YACF,MAAMC,WAAW,MAAMC,MAAMF,eAAe;gBAC1CG,QAAQ;gBACRC,SAAS;oBACP,gBAAgB;gBAClB;gBACAC,MAAM,IAAIC,gBAAgB;oBACxBC,YAAY;oBACZC,WAAWrB;gBACb;YACF;YAEA,2BAA2B;YAC3B,IAAI,CAACc,SAASQ,EAAE,EAAE;gBAChB,MAAMC,YAAY,MAAMT,SAASU,IAAI;gBACrC,IAAIC;gBAEJ,IAAI;oBACF,MAAMC,YAAYpD,KAAKC,KAAK,CAACgD;oBAC7BE,eAAeC,UAAUC,iBAAiB,IAAID,UAAU7C,KAAK,IAAI0C;gBACnE,EAAE,OAAM;oBACNE,eAAeF;gBACjB;gBAEA,qDAAqD;gBACrD,IAAIT,SAASc,MAAM,KAAK,KAAK;oBAC3B,MAAM,IAAInD,MAAM,CAAC,6BAA6B,EAAEgD,aAAa,6EAA6E,CAAC;gBAC7I;gBAEA,kEAAkE;gBAClE,IAAIX,SAASc,MAAM,KAAK,KAAK;oBAC3B,MAAM,IAAInD,MAAM,CAAC,uCAAuC,EAAEgD,aAAa,oFAAoF,CAAC;gBAC9J;gBAEA,eAAe;gBACf,MAAM,IAAIhD,MAAM,CAAC,4BAA4B,EAAEqC,SAASc,MAAM,CAAC,GAAG,EAAEH,cAAc;YACpF;YAEA,4BAA4B;YAC5B,MAAMI,YAAa,MAAMf,SAASgB,IAAI;YAEtC,wDAAwD;YACxD,MAAMC,SAAShC,KAAKH,GAAG,KAAK,AAACiC,CAAAA,UAAUG,UAAU,GAAG,EAAC,IAAK,MAAM,iCAAiC;YAEjG,OAAO;gBACLC,OAAOJ,UAAUK,YAAY;gBAC7BH;YACF;QACF,EAAE,OAAOlD,OAAO;YACd,iBAAiB;YACjB,IAAIA,iBAAiBsD,aAAatD,MAAMH,OAAO,CAACgB,QAAQ,CAAC,UAAU;gBACjE,MAAM,IAAIjB,MAAM;YAClB;YAEA,wBAAwB;YACxB,MAAMI;QACR;IACF;IAEA;;;;;GAKC,GACD,MAAMuD,eAAeC,UAAmB,EAAmB;QACzD,gEAAgE;QAChE,IAAI,IAAI,CAACC,WAAW,IAAI,IAAI,CAACA,WAAW,CAACP,MAAM,GAAGhC,KAAKH,GAAG,IAAI;YAC5D,OAAO,IAAI,CAAC0C,WAAW,CAACL,KAAK;QAC/B;QAEA,IAAI;YACF,eAAe;YACf,MAAMjC,MAAM,MAAM,IAAI,CAACL,WAAW;YAElC,4BAA4B;YAC5B,MAAM,EAAEsC,KAAK,EAAEF,MAAM,EAAE,GAAG,MAAM,IAAI,CAACnB,WAAW,CAACZ;YAEjD,2DAA2D;YAC3D,IAAI,CAACsC,WAAW,GAAG;gBAAEL;gBAAOF;YAAO;YAEnC,OAAOE;QACT,EAAE,OAAOpD,OAAO;YACd,wBAAwB;YACxB,MAAM,IAAIJ,MAAM,CAAC,4CAA4C,EAAEI,iBAAiBJ,QAAQI,MAAMH,OAAO,GAAGC,OAAOE,QAAQ;QACzH;IACF;IAEA;;;;;;;;GAQC,GACD0D,OAAOC,SAAkB,EAAgB;YA+CvC;QA9CA,+DAA+D;QAC/D,IAAIA,cAAcC,aAAaD,cAAc,mBAAmB;YAC9D,MAAM,IAAI/D,MAAM,CAAC,uEAAuE,EAAE+D,UAAU,yDAAyD,CAAC;QAChK;QAEA,iFAAiF;QACjF,MAAME,SAAS,IAAI7E;QAEnB,sFAAsF;QACtF,oGAAoG;QAElG6E,OAGAC,uBAAuB,GAAG,OAAOC;YACjC,IAAI;gBACF,+EAA+E;gBAC/E,MAAMX,QAAQ,MAAM,IAAI,CAACG,cAAc;gBAEvC,yFAAyF;gBACzFM,OAAOG,WAAW,GAAG;oBACnBX,cAAcD;oBACda,YAAY;gBACd;gBAEA,iEAAiE;gBACjE,MAAM7B,UAAU,IAAI8B;gBACpB9B,QAAQ+B,GAAG,CAAC,iBAAiB,CAAC,OAAO,EAAEf,OAAO;gBAC9C,OAAO;oBAAEhB;gBAAQ;YACnB,EAAE,OAAOpC,OAAO;oBACd;iBAAA,sBAAA,IAAI,CAACoE,MAAM,CAACC,MAAM,cAAlB,0CAAA,oBAAoBrE,KAAK,CAAC,8DAA8D;oBAAEA;gBAAM;gBAChG,MAAMA;YACR;QACF;QAEA,mFAAmF;QACnF6D,OAAON,cAAc,GAAG;YACtB,IAAI;gBACF,MAAMH,QAAQ,MAAM,IAAI,CAACG,cAAc;gBACvC,OAAO;oBAAEH;gBAAM;YACjB,EAAE,OAAOpD,OAAO;oBACd;iBAAA,sBAAA,IAAI,CAACoE,MAAM,CAACC,MAAM,cAAlB,0CAAA,oBAAoBrE,KAAK,CAAC,8CAA8C;oBAAEA;gBAAM;gBAChF,MAAMA;YACR;QACF;SAEA,sBAAA,IAAI,CAACoE,MAAM,CAACC,MAAM,cAAlB,0CAAA,oBAAoBC,KAAK,CAAC,CAAC,iDAAiD,EAAEX,WAAW;QACzF,OAAOE;IACT;IAEA;;;;;;GAMC,GACD,MAAMU,aAAaf,UAAmB,EAAmB;QACvD,MAAMnE,UAAU,MAAM,IAAI,CAACD,WAAW;QACtC,OAAOC,QAAQgC,YAAY;IAC7B;IAEA;;;;;;;;;;;;;;;;;;;;;;;GAuBC,GACDmD,iBAAiB;QACf,0EAA0E;QAC1E,sFAAsF;QACtF,MAAMC,iBAAiB,CAAuEC,QAAWC;YACvG,MAAMC,kBAAkBF,OAAOG,OAAO;YAEtC,MAAMC,iBAAiB,OAAO,GAAGC;gBAC/B,0CAA0C;gBAC1C,MAAMC,QAAQD,OAAO,CAACJ,cAAc;gBAEpC,IAAI;oBACF,uEAAuE;oBACvE,MAAMhB,YAAY;oBAElB,gDAAgD;oBAChD,MAAMsB,eAAe,MAAM,IAAI,CAACV,YAAY;oBAE5C,2DAA2D;oBAC3D,MAAM,IAAI,CAAChB,cAAc;oBAEzB,uDAAuD;oBACvD,MAAM2B,OAAO,IAAI,CAACxB,MAAM,CAACC;oBAEzB,qDAAqD;oBACpDqB,MAAwCG,WAAW,GAAG;wBACrDD;wBACAvB;wBACAyB,UAAU;4BAAEH;wBAAa;oBAC3B;oBACCD,MAA+BX,MAAM,GAAG,IAAI,CAACD,MAAM,CAACC,MAAM;oBAE3D,sCAAsC;oBACtC,OAAO,MAAMO,mBAAmBG;gBAClC,EAAE,OAAO/E,OAAO;oBACd,MAAMH,UAAUG,iBAAiBJ,QAAQI,MAAMH,OAAO,GAAGC,OAAOE;oBAEhE,kEAAkE;oBAClE,IAAIH,QAAQgB,QAAQ,CAAC,uBAAuB;wBAC1C,MAAM,IAAIjB,MAAM,CAAC,uCAAuC,EAAE,IAAI,CAACJ,WAAW,CAAC,4HAA4H,CAAC;oBAC1M;oBACA,IAAIK,QAAQgB,QAAQ,CAAC,gBAAgBhB,QAAQgB,QAAQ,CAAC,kBAAkB;wBACtE,MAAM,IAAIjB,MACR,gGAAgG,wEAAwE,2EAA2E;oBAEvP;oBACA,IAAIC,QAAQgB,QAAQ,CAAC,oBAAoBhB,QAAQgB,QAAQ,CAAC,QAAQ;wBAChE,MAAM,IAAIjB,MAAM,mFAAmF,sEAAsE,8EAA8E;oBACzP;oBACA,IAAIC,QAAQgB,QAAQ,CAAC,oBAAoBhB,QAAQgB,QAAQ,CAAC,UAAU;wBAClE,MAAM,IAAIjB,MAAM,wFAAwF,uCAAuC,4EAA4E;oBAC7N;oBACA,uCAAuC;oBACvC,MAAM,IAAIA,MAAM,CAAC,uCAAuC,EAAEC,SAAS;gBACrE;YACF;YAEA,OAAO;gBACL,GAAG6E,MAAM;gBACTG,SAASC;YACX;QACF;QAEA,OAAO;YACL,4EAA4E;YAC5E,wDAAwD;YACxDO,cAAc,CAAgEX,SAAcD,eAAeC,QAAQ;YACnHY,kBAAkB,CAAqFZ,SAAcD,eAAeC,QAAQ;YAC5Ia,gBAAgB,CAAgEb,SAAcD,eAAeC,QAAQ;QACvH;IACF;IAhXA,YAAYN,MAA4B,CAAE;QACxC,IAAI,CAACA,MAAM,GAAGA;QACd,IAAI,CAAC5E,WAAW,GAAG4E,OAAO5E,WAAW;QACrC,IAAI,CAAC+B,MAAM,GAAG6C,OAAO7C,MAAM;IAC7B;AA6WF"}
+{"version":3,"sources":["/Users/kevin/Dev/Projects/mcp-z/oauth-google/src/providers/service-account.ts"],"sourcesContent":["import { promises as fs } from 'fs';\nimport { OAuth2Client } from 'google-auth-library';\nimport { importPKCS8, SignJWT } from 'jose';\nimport type { AuthContext, EnrichedExtra, Logger, OAuth2TokenStorageProvider } from '../types.ts';\n\n/**\n * Service Account Key File Structure\n * Standard Google Cloud service account JSON key format\n */\ninterface ServiceAccountKey {\n  type: 'service_account';\n  project_id: string;\n  private_key_id: string;\n  private_key: string;\n  client_email: string;\n  client_id: string;\n  auth_uri: string;\n  token_uri: string;\n  auth_provider_x509_cert_url?: string;\n  client_x509_cert_url?: string;\n}\n\n/**\n * Service Account Provider Configuration\n */\nexport interface ServiceAccountConfig {\n  /** Path to Google Cloud service account JSON key file */\n  keyFilePath: string;\n  /** OAuth scopes to request (e.g., ['https://www.googleapis.com/auth/gmail.readonly']) */\n  scopes: string[];\n  /** Logger for auth operations */\n  logger: Logger;\n}\n\n/**\n * Token Exchange Response from Google OAuth endpoint\n */\ninterface TokenResponse {\n  access_token: string;\n  expires_in: number;\n  token_type: string;\n}\n\n/**\n * ServiceAccountProvider implements OAuth2TokenStorageProvider using Google Service Accounts\n * with JWT-based (2-legged OAuth) authentication.\n *\n * This provider:\n * - Loads service account key file from disk\n * - Generates self-signed JWTs using RS256 algorithm\n * - Exchanges JWTs for access tokens at Google's token endpoint\n * - Does NOT store tokens (regenerates on each request)\n * - Provides single static identity (no account management)\n *\n * @example\n * ```typescript\n * const provider = new ServiceAccountProvider({\n *   keyFilePath: '/path/to/service-account-key.json',\n *   scopes: ['https://www.googleapis.com/auth/drive.readonly'],\n * });\n *\n * // Get authenticated OAuth2Client for googleapis\n * const auth = provider.toAuth('default');\n * const drive = google.drive({ version: 'v3', auth });\n * ```\n */\nexport class ServiceAccountProvider implements OAuth2TokenStorageProvider {\n  private config: ServiceAccountConfig;\n  private keyFilePath: string;\n  private scopes: string[];\n  private keyData?: ServiceAccountKey;\n  private cachedToken?: { token: string; expiry: number };\n\n  constructor(config: ServiceAccountConfig) {\n    this.config = config;\n    this.keyFilePath = config.keyFilePath;\n    this.scopes = config.scopes;\n  }\n\n  /**\n   * Load and parse service account key file from disk\n   * Validates structure and caches for subsequent calls\n   */\n  private async loadKeyFile(): Promise<ServiceAccountKey> {\n    // Return cached key data if already loaded\n    if (this.keyData) {\n      return this.keyData;\n    }\n\n    try {\n      // Read key file from disk\n      const fileContent = await fs.readFile(this.keyFilePath, 'utf-8');\n\n      // Parse JSON\n      let keyData: unknown;\n      try {\n        keyData = JSON.parse(fileContent);\n      } catch (parseError) {\n        throw new Error(`Failed to parse service account key file as JSON: ${this.keyFilePath}\\n` + `Error: ${parseError instanceof Error ? parseError.message : String(parseError)}`);\n      }\n\n      // Validate structure\n      this.keyData = this.validateKeyFile(keyData);\n      return this.keyData;\n    } catch (error) {\n      // Handle file not found\n      if ((error as NodeJS.ErrnoException).code === 'ENOENT') {\n        throw new Error(`Service account key file not found: ${this.keyFilePath}\\nMake sure GOOGLE_SERVICE_ACCOUNT_KEY_FILE points to a valid file path.`);\n      }\n\n      // Handle permission errors\n      if ((error as NodeJS.ErrnoException).code === 'EACCES') {\n        throw new Error(`Permission denied reading service account key file: ${this.keyFilePath}\\nCheck file permissions (should be readable by current user).`);\n      }\n\n      // Re-throw other errors\n      throw error;\n    }\n  }\n\n  /**\n   * Validate service account key file structure\n   * Ensures all required fields are present and correctly typed\n   */\n  private validateKeyFile(data: unknown): ServiceAccountKey {\n    if (!data || typeof data !== 'object') {\n      throw new Error('Service account key file must contain a JSON object');\n    }\n\n    const obj = data as Record<string, unknown>;\n\n    // Validate type field\n    if (obj.type !== 'service_account') {\n      throw new Error(`Invalid service account key file: Expected type \"service_account\", got \"${obj.type}\"\\nMake sure you downloaded a service account key, not an OAuth client credential.`);\n    }\n\n    // Validate required string fields\n    const requiredFields: Array<keyof ServiceAccountKey> = ['project_id', 'private_key_id', 'private_key', 'client_email', 'client_id', 'auth_uri', 'token_uri'];\n\n    const missingFields = requiredFields.filter((field) => typeof obj[field] !== 'string' || !obj[field]);\n\n    if (missingFields.length > 0) {\n      throw new Error(`Service account key file is missing required fields: ${missingFields.join(', ')}\\nMake sure you downloaded a complete service account key file from Google Cloud Console.`);\n    }\n\n    // Validate private key format\n    const privateKey = obj.private_key as string;\n    if (!privateKey.includes('BEGIN PRIVATE KEY') || !privateKey.includes('END PRIVATE KEY')) {\n      throw new Error('Service account private_key field does not contain a valid PEM-formatted key.\\n' + 'Expected format: -----BEGIN PRIVATE KEY-----...-----END PRIVATE KEY-----');\n    }\n\n    return obj as unknown as ServiceAccountKey;\n  }\n\n  /**\n   * Generate signed JWT (JSON Web Token) for service account authentication\n   * Uses RS256 algorithm with private key from key file\n   */\n  private async generateJWT(): Promise<string> {\n    const keyData = await this.loadKeyFile();\n\n    // Import private key using jose\n    const privateKey = await importPKCS8(keyData.private_key, 'RS256');\n\n    // Current time\n    const now = Math.floor(Date.now() / 1000);\n\n    // Create JWT with required claims for Google OAuth\n    const jwt = await new SignJWT({\n      iss: keyData.client_email, // Issuer: service account email\n      scope: this.scopes.join(' '), // Scopes: space-separated\n      aud: 'https://oauth2.googleapis.com/token', // Audience: token endpoint\n      exp: now + 3600, // Expiration: 1 hour from now\n      iat: now, // Issued at: current time\n    })\n      .setProtectedHeader({ alg: 'RS256', typ: 'JWT' })\n      .sign(privateKey);\n\n    return jwt;\n  }\n\n  /**\n   * Exchange signed JWT for access token at Google OAuth endpoint\n   * POST to https://oauth2.googleapis.com/token with grant_type=jwt-bearer\n   */\n  private async exchangeJWT(jwt: string): Promise<{ token: string; expiry: number }> {\n    const tokenEndpoint = 'https://oauth2.googleapis.com/token';\n\n    try {\n      const response = await fetch(tokenEndpoint, {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/x-www-form-urlencoded',\n        },\n        body: new URLSearchParams({\n          grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer',\n          assertion: jwt,\n        }),\n      });\n\n      // Handle non-2xx responses\n      if (!response.ok) {\n        const errorText = await response.text();\n        let errorMessage: string;\n\n        try {\n          const errorJson = JSON.parse(errorText);\n          errorMessage = errorJson.error_description || errorJson.error || errorText;\n        } catch {\n          errorMessage = errorText;\n        }\n\n        // 400: Invalid JWT (malformed claims, expired, etc.)\n        if (response.status === 400) {\n          throw new Error(`Invalid service account JWT: ${errorMessage}\\nThis usually means the JWT claims are malformed or the key file is invalid.`);\n        }\n\n        // 401: Unauthorized (revoked service account, wrong scopes, etc.)\n        if (response.status === 401) {\n          throw new Error(`Service account authentication failed: ${errorMessage}\\nThe service account may have been disabled or deleted. Check Google Cloud Console.`);\n        }\n\n        // Other errors\n        throw new Error(`Token exchange failed (HTTP ${response.status}): ${errorMessage}`);\n      }\n\n      // Parse successful response\n      const tokenData = (await response.json()) as TokenResponse;\n\n      // Calculate expiry timestamp (token expires in ~1 hour)\n      const expiry = Date.now() + (tokenData.expires_in - 60) * 1000; // Subtract 60s for safety margin\n\n      return {\n        token: tokenData.access_token,\n        expiry,\n      };\n    } catch (error) {\n      // Network errors\n      if (error instanceof TypeError && error.message.includes('fetch')) {\n        throw new Error('Network error connecting to Google OAuth endpoint. Check internet connection.');\n      }\n\n      // Re-throw other errors\n      throw error;\n    }\n  }\n\n  /**\n   * Get access token for Google APIs\n   * Generates fresh JWT and exchanges for access token on each call\n   *\n   * Note: accountId parameter is ignored for service accounts (service account is single static identity)\n   */\n  async getAccessToken(_accountId?: string): Promise<string> {\n    // Check if we have a valid cached token (optional optimization)\n    if (this.cachedToken && this.cachedToken.expiry > Date.now()) {\n      return this.cachedToken.token;\n    }\n\n    try {\n      // Generate JWT\n      const jwt = await this.generateJWT();\n\n      // Exchange for access token\n      const { token, expiry } = await this.exchangeJWT(jwt);\n\n      // Cache token for subsequent calls (optional optimization)\n      this.cachedToken = { token, expiry };\n\n      return token;\n    } catch (error) {\n      // Add context to errors\n      throw new Error(`Failed to get service account access token: ${error instanceof Error ? error.message : String(error)}`);\n    }\n  }\n\n  /**\n   * Get OAuth2Client with service account credentials for googleapis\n   * This is the CRITICAL method that servers use to get authenticated API clients\n   *\n   * Service account ONLY works with accountId='service-account' (single static identity)\n   *\n    @param accountId - Account identifier (must be 'service-account' or undefined)\n   * @returns OAuth2Client instance with access token credentials set\n   */\n  toAuth(accountId?: string): OAuth2Client {\n    // Service account ONLY works with 'service-account' account ID\n    if (accountId !== undefined && accountId !== 'service-account') {\n      throw new Error(`ServiceAccountProvider only supports accountId='service-account', got '${accountId}'. Service account uses a single static identity pattern.`);\n    }\n\n    // Create OAuth2Client instance (no client ID/secret needed for service accounts)\n    const client = new OAuth2Client();\n\n    // Override getRequestMetadataAsync to provide authentication headers for each request\n    // This is the method googleapis calls to get auth headers - can be async and fetch tokens on-demand\n    (\n      client as OAuth2Client & {\n        getRequestMetadataAsync: (url?: string) => Promise<{ headers: Headers | Map<string, string> }>;\n      }\n    ).getRequestMetadataAsync = async (_url?: string) => {\n      try {\n        // Get fresh access token (can be async, will trigger JWT generation if needed)\n        const token = await this.getAccessToken();\n\n        // Update client credentials for consistency (other googleapis methods might check these)\n        client.credentials = {\n          access_token: token,\n          token_type: 'Bearer',\n        };\n\n        // Return headers as Headers instance for proper TypeScript types\n        const headers = new Headers();\n        headers.set('authorization', `Bearer ${token}`);\n        return { headers };\n      } catch (error) {\n        this.config.logger?.error('Failed to get service account access token for API request', { error });\n        throw error;\n      }\n    };\n\n    // Override getAccessToken to support googleapis client API and direct token access\n    client.getAccessToken = async () => {\n      try {\n        const token = await this.getAccessToken();\n        return { token };\n      } catch (error) {\n        this.config.logger?.error('Failed to get service account access token', { error });\n        throw error;\n      }\n    };\n\n    this.config.logger?.debug(`ServiceAccountProvider: OAuth2Client created for ${accountId}`);\n    return client;\n  }\n\n  /**\n   * Get service account email address\n   * Used for account registration and display\n   *\n   * Note: accountId parameter is ignored for service accounts\n   * @returns Service account email from key file (e.g., \"service-account@project.iam.gserviceaccount.com\")\n   */\n  async getUserEmail(_accountId?: string): Promise<string> {\n    const keyData = await this.loadKeyFile();\n    return keyData.client_email;\n  }\n\n  /**\n   * Create middleware wrapper for single-user authentication\n   * This is the CRITICAL method that integrates service account auth into MCP servers\n   *\n   * Middleware wraps tool, resource, and prompt handlers and injects authContext into extra parameter.\n   * Handlers receive OAuth2Client via extra.authContext.auth for API calls.\n   *\n   * @returns Object with withToolAuth, withResourceAuth, withPromptAuth methods\n   *\n   * @example\n   * ```typescript\n   * // Server registration\n   * const authMiddleware = provider.authMiddleware();\n   * const tools = toolFactories.map(f => f()).map(authMiddleware.withToolAuth);\n   * const resources = resourceFactories.map(f => f()).map(authMiddleware.withResourceAuth);\n   * const prompts = promptFactories.map(f => f()).map(authMiddleware.withPromptAuth);\n   *\n   * // Tool handler receives auth\n   * async function handler({ id }: In, extra: EnrichedExtra) {\n   *   // extra.authContext.auth is OAuth2Client (from middleware)\n   *   const gmail = google.gmail({ version: 'v1', auth: extra.authContext.auth });\n   * }\n   * ```\n   */\n  authMiddleware() {\n    // Shared wrapper logic - extracts extra parameter from specified position\n    // Generic T captures the actual module type; handler is cast from unknown to callable\n    const wrapAtPosition = <T extends { name: string; handler: unknown; [key: string]: unknown }>(module: T, extraPosition: number): T => {\n      const originalHandler = module.handler as (...args: unknown[]) => Promise<unknown>;\n\n      const wrappedHandler = async (...allArgs: unknown[]) => {\n        // Extract extra from the correct position\n        const extra = allArgs[extraPosition] as EnrichedExtra;\n\n        try {\n          // Use fixed accountId for storage isolation (like device-code pattern)\n          const accountId = 'service-account';\n\n          // Get service account email for logging/display\n          const serviceEmail = await this.getUserEmail();\n\n          // Get access token (generates JWT and exchanges if needed)\n          await this.getAccessToken();\n\n          // Create OAuth2Client with service account credentials\n          const auth = this.toAuth(accountId);\n\n          // Inject authContext and logger into extra parameter\n          (extra as { authContext?: AuthContext }).authContext = {\n            auth, // OAuth2Client for googleapis\n            accountId, // 'service-account' (fixed, not service email)\n            metadata: { serviceEmail }, // Keep email for logging/reference\n          };\n          (extra as { logger?: unknown }).logger = this.config.logger;\n\n          // Call original handler with all args\n          return await originalHandler(...allArgs);\n        } catch (error) {\n          const message = error instanceof Error ? error.message : String(error);\n\n          // Provide specific, actionable error messages based on error type\n          if (message.includes('key file not found')) {\n            throw new Error(`Service account setup error: Key file '${this.keyFilePath}' not found.\\n• Set GOOGLE_SERVICE_ACCOUNT_KEY_FILE environment variable\\n• Or ensure the file path exists and is accessible`);\n          }\n          if (message.includes('Forbidden') || message.includes('access_denied')) {\n            throw new Error(\n              'Service account permission error: The service account does not have required permissions.\\n' + '• Ensure the service account has been granted the necessary roles\\n' + '• Check that required API scopes are enabled in Google Cloud Console\\n' + '• Verify the service account is active (not disabled)'\n            );\n          }\n          if (message.includes('invalid_grant') || message.includes('JWT')) {\n            throw new Error('Service account authentication error: Invalid credentials or expired tokens.\\n' + '• Verify your service account key file is valid and not expired\\n' + '• Check that the service account email and project match your GCP setup\\n' + '• Try regenerating the key file in Google Cloud Console');\n          }\n          if (message.includes('Network error') || message.includes('fetch')) {\n            throw new Error('Service account connection error: Unable to reach Google authentication services.\\n' + '• Check your internet connection\\n' + '• Verify firewall/proxy settings allow HTTPS to oauth2.googleapis.com\\n' + '• Try again in a few moments (may be temporary service issue)');\n          }\n          // Generic fallback with original error\n          throw new Error(`Service account authentication failed: ${message}`);\n        }\n      };\n\n      return {\n        ...module,\n        handler: wrappedHandler,\n      } as T;\n    };\n\n    return {\n      // Use structural constraints to avoid contravariance check on handler type.\n      // wrapAtPosition is now generic and returns T directly.\n      withToolAuth: <T extends { name: string; config: unknown; handler: unknown }>(module: T) => wrapAtPosition(module, 1),\n      withResourceAuth: <T extends { name: string; template?: unknown; config?: unknown; handler: unknown }>(module: T) => wrapAtPosition(module, 2),\n      withPromptAuth: <T extends { name: string; config: unknown; handler: unknown }>(module: T) => wrapAtPosition(module, 0),\n    };\n  }\n}\n"],"names":["promises","fs","OAuth2Client","importPKCS8","SignJWT","ServiceAccountProvider","loadKeyFile","keyData","fileContent","readFile","keyFilePath","JSON","parse","parseError","Error","message","String","validateKeyFile","error","code","data","obj","type","requiredFields","missingFields","filter","field","length","join","privateKey","private_key","includes","generateJWT","now","Math","floor","Date","jwt","iss","client_email","scope","scopes","aud","exp","iat","setProtectedHeader","alg","typ","sign","exchangeJWT","tokenEndpoint","response","fetch","method","headers","body","URLSearchParams","grant_type","assertion","ok","errorText","text","errorMessage","errorJson","error_description","status","tokenData","json","expiry","expires_in","token","access_token","TypeError","getAccessToken","_accountId","cachedToken","toAuth","accountId","undefined","client","getRequestMetadataAsync","_url","credentials","token_type","Headers","set","config","logger","debug","getUserEmail","authMiddleware","wrapAtPosition","module","extraPosition","originalHandler","handler","wrappedHandler","allArgs","extra","serviceEmail","auth","authContext","metadata","withToolAuth","withResourceAuth","withPromptAuth"],"mappings":"AAAA,SAASA,YAAYC,EAAE,QAAQ,KAAK;AACpC,SAASC,YAAY,QAAQ,sBAAsB;AACnD,SAASC,WAAW,EAAEC,OAAO,QAAQ,OAAO;AAyC5C;;;;;;;;;;;;;;;;;;;;;;CAsBC,GACD,OAAO,MAAMC;IAaX;;;GAGC,GACD,MAAcC,cAA0C;QACtD,2CAA2C;QAC3C,IAAI,IAAI,CAACC,OAAO,EAAE;YAChB,OAAO,IAAI,CAACA,OAAO;QACrB;QAEA,IAAI;YACF,0BAA0B;YAC1B,MAAMC,cAAc,MAAMP,GAAGQ,QAAQ,CAAC,IAAI,CAACC,WAAW,EAAE;YAExD,aAAa;YACb,IAAIH;YACJ,IAAI;gBACFA,UAAUI,KAAKC,KAAK,CAACJ;YACvB,EAAE,OAAOK,YAAY;gBACnB,MAAM,IAAIC,MAAM,CAAC,kDAAkD,EAAE,IAAI,CAACJ,WAAW,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,EAAEG,sBAAsBC,QAAQD,WAAWE,OAAO,GAAGC,OAAOH,aAAa;YAC/K;YAEA,qBAAqB;YACrB,IAAI,CAACN,OAAO,GAAG,IAAI,CAACU,eAAe,CAACV;YACpC,OAAO,IAAI,CAACA,OAAO;QACrB,EAAE,OAAOW,OAAO;YACd,wBAAwB;YACxB,IAAI,AAACA,MAAgCC,IAAI,KAAK,UAAU;gBACtD,MAAM,IAAIL,MAAM,CAAC,oCAAoC,EAAE,IAAI,CAACJ,WAAW,CAAC,wEAAwE,CAAC;YACnJ;YAEA,2BAA2B;YAC3B,IAAI,AAACQ,MAAgCC,IAAI,KAAK,UAAU;gBACtD,MAAM,IAAIL,MAAM,CAAC,oDAAoD,EAAE,IAAI,CAACJ,WAAW,CAAC,8DAA8D,CAAC;YACzJ;YAEA,wBAAwB;YACxB,MAAMQ;QACR;IACF;IAEA;;;GAGC,GACD,AAAQD,gBAAgBG,IAAa,EAAqB;QACxD,IAAI,CAACA,QAAQ,OAAOA,SAAS,UAAU;YACrC,MAAM,IAAIN,MAAM;QAClB;QAEA,MAAMO,MAAMD;QAEZ,sBAAsB;QACtB,IAAIC,IAAIC,IAAI,KAAK,mBAAmB;YAClC,MAAM,IAAIR,MAAM,CAAC,wEAAwE,EAAEO,IAAIC,IAAI,CAAC,kFAAkF,CAAC;QACzL;QAEA,kCAAkC;QAClC,MAAMC,iBAAiD;YAAC;YAAc;YAAkB;YAAe;YAAgB;YAAa;YAAY;SAAY;QAE5J,MAAMC,gBAAgBD,eAAeE,MAAM,CAAC,CAACC,QAAU,OAAOL,GAAG,CAACK,MAAM,KAAK,YAAY,CAACL,GAAG,CAACK,MAAM;QAEpG,IAAIF,cAAcG,MAAM,GAAG,GAAG;YAC5B,MAAM,IAAIb,MAAM,CAAC,qDAAqD,EAAEU,cAAcI,IAAI,CAAC,MAAM,yFAAyF,CAAC;QAC7L;QAEA,8BAA8B;QAC9B,MAAMC,aAAaR,IAAIS,WAAW;QAClC,IAAI,CAACD,WAAWE,QAAQ,CAAC,wBAAwB,CAACF,WAAWE,QAAQ,CAAC,oBAAoB;YACxF,MAAM,IAAIjB,MAAM,oFAAoF;QACtG;QAEA,OAAOO;IACT;IAEA;;;GAGC,GACD,MAAcW,cAA+B;QAC3C,MAAMzB,UAAU,MAAM,IAAI,CAACD,WAAW;QAEtC,gCAAgC;QAChC,MAAMuB,aAAa,MAAM1B,YAAYI,QAAQuB,WAAW,EAAE;QAE1D,eAAe;QACf,MAAMG,MAAMC,KAAKC,KAAK,CAACC,KAAKH,GAAG,KAAK;QAEpC,mDAAmD;QACnD,MAAMI,MAAM,MAAM,IAAIjC,QAAQ;YAC5BkC,KAAK/B,QAAQgC,YAAY;YACzBC,OAAO,IAAI,CAACC,MAAM,CAACb,IAAI,CAAC;YACxBc,KAAK;YACLC,KAAKV,MAAM;YACXW,KAAKX;QACP,GACGY,kBAAkB,CAAC;YAAEC,KAAK;YAASC,KAAK;QAAM,GAC9CC,IAAI,CAACnB;QAER,OAAOQ;IACT;IAEA;;;GAGC,GACD,MAAcY,YAAYZ,GAAW,EAA8C;QACjF,MAAMa,gBAAgB;QAEtB,IAAI;YACF,MAAMC,WAAW,MAAMC,MAAMF,eAAe;gBAC1CG,QAAQ;gBACRC,SAAS;oBACP,gBAAgB;gBAClB;gBACAC,MAAM,IAAIC,gBAAgB;oBACxBC,YAAY;oBACZC,WAAWrB;gBACb;YACF;YAEA,2BAA2B;YAC3B,IAAI,CAACc,SAASQ,EAAE,EAAE;gBAChB,MAAMC,YAAY,MAAMT,SAASU,IAAI;gBACrC,IAAIC;gBAEJ,IAAI;oBACF,MAAMC,YAAYpD,KAAKC,KAAK,CAACgD;oBAC7BE,eAAeC,UAAUC,iBAAiB,IAAID,UAAU7C,KAAK,IAAI0C;gBACnE,EAAE,OAAM;oBACNE,eAAeF;gBACjB;gBAEA,qDAAqD;gBACrD,IAAIT,SAASc,MAAM,KAAK,KAAK;oBAC3B,MAAM,IAAInD,MAAM,CAAC,6BAA6B,EAAEgD,aAAa,6EAA6E,CAAC;gBAC7I;gBAEA,kEAAkE;gBAClE,IAAIX,SAASc,MAAM,KAAK,KAAK;oBAC3B,MAAM,IAAInD,MAAM,CAAC,uCAAuC,EAAEgD,aAAa,oFAAoF,CAAC;gBAC9J;gBAEA,eAAe;gBACf,MAAM,IAAIhD,MAAM,CAAC,4BAA4B,EAAEqC,SAASc,MAAM,CAAC,GAAG,EAAEH,cAAc;YACpF;YAEA,4BAA4B;YAC5B,MAAMI,YAAa,MAAMf,SAASgB,IAAI;YAEtC,wDAAwD;YACxD,MAAMC,SAAShC,KAAKH,GAAG,KAAK,AAACiC,CAAAA,UAAUG,UAAU,GAAG,EAAC,IAAK,MAAM,iCAAiC;YAEjG,OAAO;gBACLC,OAAOJ,UAAUK,YAAY;gBAC7BH;YACF;QACF,EAAE,OAAOlD,OAAO;YACd,iBAAiB;YACjB,IAAIA,iBAAiBsD,aAAatD,MAAMH,OAAO,CAACgB,QAAQ,CAAC,UAAU;gBACjE,MAAM,IAAIjB,MAAM;YAClB;YAEA,wBAAwB;YACxB,MAAMI;QACR;IACF;IAEA;;;;;GAKC,GACD,MAAMuD,eAAeC,UAAmB,EAAmB;QACzD,gEAAgE;QAChE,IAAI,IAAI,CAACC,WAAW,IAAI,IAAI,CAACA,WAAW,CAACP,MAAM,GAAGhC,KAAKH,GAAG,IAAI;YAC5D,OAAO,IAAI,CAAC0C,WAAW,CAACL,KAAK;QAC/B;QAEA,IAAI;YACF,eAAe;YACf,MAAMjC,MAAM,MAAM,IAAI,CAACL,WAAW;YAElC,4BAA4B;YAC5B,MAAM,EAAEsC,KAAK,EAAEF,MAAM,EAAE,GAAG,MAAM,IAAI,CAACnB,WAAW,CAACZ;YAEjD,2DAA2D;YAC3D,IAAI,CAACsC,WAAW,GAAG;gBAAEL;gBAAOF;YAAO;YAEnC,OAAOE;QACT,EAAE,OAAOpD,OAAO;YACd,wBAAwB;YACxB,MAAM,IAAIJ,MAAM,CAAC,4CAA4C,EAAEI,iBAAiBJ,QAAQI,MAAMH,OAAO,GAAGC,OAAOE,QAAQ;QACzH;IACF;IAEA;;;;;;;;GAQC,GACD0D,OAAOC,SAAkB,EAAgB;YA+CvC;QA9CA,+DAA+D;QAC/D,IAAIA,cAAcC,aAAaD,cAAc,mBAAmB;YAC9D,MAAM,IAAI/D,MAAM,CAAC,uEAAuE,EAAE+D,UAAU,yDAAyD,CAAC;QAChK;QAEA,iFAAiF;QACjF,MAAME,SAAS,IAAI7E;QAEnB,sFAAsF;QACtF,oGAAoG;QAElG6E,OAGAC,uBAAuB,GAAG,OAAOC;YACjC,IAAI;gBACF,+EAA+E;gBAC/E,MAAMX,QAAQ,MAAM,IAAI,CAACG,cAAc;gBAEvC,yFAAyF;gBACzFM,OAAOG,WAAW,GAAG;oBACnBX,cAAcD;oBACda,YAAY;gBACd;gBAEA,iEAAiE;gBACjE,MAAM7B,UAAU,IAAI8B;gBACpB9B,QAAQ+B,GAAG,CAAC,iBAAiB,CAAC,OAAO,EAAEf,OAAO;gBAC9C,OAAO;oBAAEhB;gBAAQ;YACnB,EAAE,OAAOpC,OAAO;oBACd;iBAAA,sBAAA,IAAI,CAACoE,MAAM,CAACC,MAAM,cAAlB,0CAAA,oBAAoBrE,KAAK,CAAC,8DAA8D;oBAAEA;gBAAM;gBAChG,MAAMA;YACR;QACF;QAEA,mFAAmF;QACnF6D,OAAON,cAAc,GAAG;YACtB,IAAI;gBACF,MAAMH,QAAQ,MAAM,IAAI,CAACG,cAAc;gBACvC,OAAO;oBAAEH;gBAAM;YACjB,EAAE,OAAOpD,OAAO;oBACd;iBAAA,sBAAA,IAAI,CAACoE,MAAM,CAACC,MAAM,cAAlB,0CAAA,oBAAoBrE,KAAK,CAAC,8CAA8C;oBAAEA;gBAAM;gBAChF,MAAMA;YACR;QACF;SAEA,sBAAA,IAAI,CAACoE,MAAM,CAACC,MAAM,cAAlB,0CAAA,oBAAoBC,KAAK,CAAC,CAAC,iDAAiD,EAAEX,WAAW;QACzF,OAAOE;IACT;IAEA;;;;;;GAMC,GACD,MAAMU,aAAaf,UAAmB,EAAmB;QACvD,MAAMnE,UAAU,MAAM,IAAI,CAACD,WAAW;QACtC,OAAOC,QAAQgC,YAAY;IAC7B;IAEA;;;;;;;;;;;;;;;;;;;;;;;GAuBC,GACDmD,iBAAiB;QACf,0EAA0E;QAC1E,sFAAsF;QACtF,MAAMC,iBAAiB,CAAuEC,QAAWC;YACvG,MAAMC,kBAAkBF,OAAOG,OAAO;YAEtC,MAAMC,iBAAiB,OAAO,GAAGC;gBAC/B,0CAA0C;gBAC1C,MAAMC,QAAQD,OAAO,CAACJ,cAAc;gBAEpC,IAAI;oBACF,uEAAuE;oBACvE,MAAMhB,YAAY;oBAElB,gDAAgD;oBAChD,MAAMsB,eAAe,MAAM,IAAI,CAACV,YAAY;oBAE5C,2DAA2D;oBAC3D,MAAM,IAAI,CAAChB,cAAc;oBAEzB,uDAAuD;oBACvD,MAAM2B,OAAO,IAAI,CAACxB,MAAM,CAACC;oBAEzB,qDAAqD;oBACpDqB,MAAwCG,WAAW,GAAG;wBACrDD;wBACAvB;wBACAyB,UAAU;4BAAEH;wBAAa;oBAC3B;oBACCD,MAA+BX,MAAM,GAAG,IAAI,CAACD,MAAM,CAACC,MAAM;oBAE3D,sCAAsC;oBACtC,OAAO,MAAMO,mBAAmBG;gBAClC,EAAE,OAAO/E,OAAO;oBACd,MAAMH,UAAUG,iBAAiBJ,QAAQI,MAAMH,OAAO,GAAGC,OAAOE;oBAEhE,kEAAkE;oBAClE,IAAIH,QAAQgB,QAAQ,CAAC,uBAAuB;wBAC1C,MAAM,IAAIjB,MAAM,CAAC,uCAAuC,EAAE,IAAI,CAACJ,WAAW,CAAC,4HAA4H,CAAC;oBAC1M;oBACA,IAAIK,QAAQgB,QAAQ,CAAC,gBAAgBhB,QAAQgB,QAAQ,CAAC,kBAAkB;wBACtE,MAAM,IAAIjB,MACR,gGAAgG,wEAAwE,2EAA2E;oBAEvP;oBACA,IAAIC,QAAQgB,QAAQ,CAAC,oBAAoBhB,QAAQgB,QAAQ,CAAC,QAAQ;wBAChE,MAAM,IAAIjB,MAAM,mFAAmF,sEAAsE,8EAA8E;oBACzP;oBACA,IAAIC,QAAQgB,QAAQ,CAAC,oBAAoBhB,QAAQgB,QAAQ,CAAC,UAAU;wBAClE,MAAM,IAAIjB,MAAM,wFAAwF,uCAAuC,4EAA4E;oBAC7N;oBACA,uCAAuC;oBACvC,MAAM,IAAIA,MAAM,CAAC,uCAAuC,EAAEC,SAAS;gBACrE;YACF;YAEA,OAAO;gBACL,GAAG6E,MAAM;gBACTG,SAASC;YACX;QACF;QAEA,OAAO;YACL,4EAA4E;YAC5E,wDAAwD;YACxDO,cAAc,CAAgEX,SAAcD,eAAeC,QAAQ;YACnHY,kBAAkB,CAAqFZ,SAAcD,eAAeC,QAAQ;YAC5Ia,gBAAgB,CAAgEb,SAAcD,eAAeC,QAAQ;QACvH;IACF;IAhXA,YAAYN,MAA4B,CAAE;QACxC,IAAI,CAACA,MAAM,GAAGA;QACd,IAAI,CAAC5E,WAAW,GAAG4E,OAAO5E,WAAW;QACrC,IAAI,CAAC+B,MAAM,GAAG6C,OAAO7C,MAAM;IAC7B;AA6WF"}

package/dist/esm/schemas/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/Projects/ai/mcp-z/oauth/oauth-google/src/schemas/index.ts"],"sourcesContent":["import { z } from 'zod';\n\nexport const AuthRequiredBranchSchema = z.object({\n  type: z.literal('auth_required'),\n  provider: z.string(),\n  message: z.string(),\n  url: z.string().optional(),\n});\nexport type AuthRequiredBranch = z.infer<typeof AuthRequiredBranchSchema>;\n\nexport const AuthRequiredSchema = z\n  .object({\n    type: z.literal('auth_required'),\n    provider: z.string().describe('OAuth provider name (e.g., \"google\")'),\n    message: z.string().describe('Human-readable message explaining why auth is needed'),\n    url: z.string().url().describe('Authentication URL to open in browser'),\n    flow: z.string().optional().describe('Authentication flow type (e.g., \"auth_url\", \"device_code\")'),\n    instructions: z.string().describe('Clear instructions for the user'),\n    user_code: z.string().optional().describe('Code user must enter at verification URL (device flows only)'),\n    expires_in: z.number().optional().describe('Seconds until code expires (device flows only)'),\n    accountId: z.string().optional().describe('Account identifier (email) that requires authentication'),\n  })\n  .describe('Authentication required with clear actionable instructions for user');\n\nexport type AuthRequired = z.infer<typeof AuthRequiredSchema>;\n"],"names":["z","AuthRequiredBranchSchema","object","type","literal","provider","string","message","url","optional","AuthRequiredSchema","describe","flow","instructions","user_code","expires_in","number","accountId"],"mappings":"AAAA,SAASA,CAAC,QAAQ,MAAM;AAExB,OAAO,MAAMC,2BAA2BD,EAAEE,MAAM,CAAC;IAC/CC,MAAMH,EAAEI,OAAO,CAAC;IAChBC,UAAUL,EAAEM,MAAM;IAClBC,SAASP,EAAEM,MAAM;IACjBE,KAAKR,EAAEM,MAAM,GAAGG,QAAQ;AAC1B,GAAG;AAGH,OAAO,MAAMC,qBAAqBV,EAC/BE,MAAM,CAAC;IACNC,MAAMH,EAAEI,OAAO,CAAC;IAChBC,UAAUL,EAAEM,MAAM,GAAGK,QAAQ,CAAC;IAC9BJ,SAASP,EAAEM,MAAM,GAAGK,QAAQ,CAAC;IAC7BH,KAAKR,EAAEM,MAAM,GAAGE,GAAG,GAAGG,QAAQ,CAAC;IAC/BC,MAAMZ,EAAEM,MAAM,GAAGG,QAAQ,GAAGE,QAAQ,CAAC;IACrCE,cAAcb,EAAEM,MAAM,GAAGK,QAAQ,CAAC;IAClCG,WAAWd,EAAEM,MAAM,GAAGG,QAAQ,GAAGE,QAAQ,CAAC;IAC1CI,YAAYf,EAAEgB,MAAM,GAAGP,QAAQ,GAAGE,QAAQ,CAAC;IAC3CM,WAAWjB,EAAEM,MAAM,GAAGG,QAAQ,GAAGE,QAAQ,CAAC;AAC5C,GACCA,QAAQ,CAAC,uEAAuE"}
+{"version":3,"sources":["/Users/kevin/Dev/Projects/mcp-z/oauth-google/src/schemas/index.ts"],"sourcesContent":["import { z } from 'zod';\n\nexport const AuthRequiredBranchSchema = z.object({\n  type: z.literal('auth_required'),\n  provider: z.string(),\n  message: z.string(),\n  url: z.string().optional(),\n});\nexport type AuthRequiredBranch = z.infer<typeof AuthRequiredBranchSchema>;\n\nexport const AuthRequiredSchema = z\n  .object({\n    type: z.literal('auth_required'),\n    provider: z.string().describe('OAuth provider name (e.g., \"google\")'),\n    message: z.string().describe('Human-readable message explaining why auth is needed'),\n    url: z.string().url().describe('Authentication URL to open in browser'),\n    flow: z.string().optional().describe('Authentication flow type (e.g., \"auth_url\", \"device_code\")'),\n    instructions: z.string().describe('Clear instructions for the user'),\n    user_code: z.string().optional().describe('Code user must enter at verification URL (device flows only)'),\n    expires_in: z.number().optional().describe('Seconds until code expires (device flows only)'),\n    accountId: z.string().optional().describe('Account identifier (email) that requires authentication'),\n  })\n  .describe('Authentication required with clear actionable instructions for user');\n\nexport type AuthRequired = z.infer<typeof AuthRequiredSchema>;\n"],"names":["z","AuthRequiredBranchSchema","object","type","literal","provider","string","message","url","optional","AuthRequiredSchema","describe","flow","instructions","user_code","expires_in","number","accountId"],"mappings":"AAAA,SAASA,CAAC,QAAQ,MAAM;AAExB,OAAO,MAAMC,2BAA2BD,EAAEE,MAAM,CAAC;IAC/CC,MAAMH,EAAEI,OAAO,CAAC;IAChBC,UAAUL,EAAEM,MAAM;IAClBC,SAASP,EAAEM,MAAM;IACjBE,KAAKR,EAAEM,MAAM,GAAGG,QAAQ;AAC1B,GAAG;AAGH,OAAO,MAAMC,qBAAqBV,EAC/BE,MAAM,CAAC;IACNC,MAAMH,EAAEI,OAAO,CAAC;IAChBC,UAAUL,EAAEM,MAAM,GAAGK,QAAQ,CAAC;IAC9BJ,SAASP,EAAEM,MAAM,GAAGK,QAAQ,CAAC;IAC7BH,KAAKR,EAAEM,MAAM,GAAGE,GAAG,GAAGG,QAAQ,CAAC;IAC/BC,MAAMZ,EAAEM,MAAM,GAAGG,QAAQ,GAAGE,QAAQ,CAAC;IACrCE,cAAcb,EAAEM,MAAM,GAAGK,QAAQ,CAAC;IAClCG,WAAWd,EAAEM,MAAM,GAAGG,QAAQ,GAAGE,QAAQ,CAAC;IAC1CI,YAAYf,EAAEgB,MAAM,GAAGP,QAAQ,GAAGE,QAAQ,CAAC;IAC3CM,WAAWjB,EAAEM,MAAM,GAAGG,QAAQ,GAAGE,QAAQ,CAAC;AAC5C,GACCA,QAAQ,CAAC,uEAAuE"}

package/dist/esm/setup/config.d.ts

@@ -9,8 +9,12 @@ import type { DcrConfig, OAuthConfig } from '../types.js';
 export type { DcrConfig, OAuthConfig };
 /**
  * Transport type for MCP servers
+ *
+ * @typedef {('stdio' | 'http')} TransportType
+ * @property {'stdio'} stdio - Standard input/output transport for CLI applications
+ * @property {'http'} http - HTTP transport for web-based applications
  */
-type TransportType = 'stdio' | 'http';
+export type TransportType = 'stdio' | 'http';
 /**
  * Parse Google OAuth configuration from CLI arguments and environment variables.
  *
@@ -34,6 +38,7 @@ type TransportType = 'stdio' | 'http';
  * @param args - CLI arguments array (typically process.argv)
  * @param env - Environment variables object (typically process.env)
  * @param transport - Optional transport type. If 'stdio' and auth mode is 'dcr', throws an error.
+ *                   See {@link TransportType} for valid values.
  * @returns Parsed Google OAuth configuration
  * @throws Error if required environment variables are missing, values are invalid, or DCR is used with stdio transport
  *

package/dist/esm/setup/config.js

@@ -50,6 +50,7 @@ import { parseArgs } from 'util';
  * @param args - CLI arguments array (typically process.argv)
  * @param env - Environment variables object (typically process.env)
  * @param transport - Optional transport type. If 'stdio' and auth mode is 'dcr', throws an error.
+ *                   See {@link TransportType} for valid values.
  * @returns Parsed Google OAuth configuration
  * @throws Error if required environment variables are missing, values are invalid, or DCR is used with stdio transport
  *
@@ -120,12 +121,15 @@ import { parseArgs } from 'util';
     if (auth === 'dcr' && transport === 'stdio') {
         throw new Error('DCR authentication mode requires HTTP transport. DCR is not supported with stdio transport.');
     }
-    const cliHeadless = typeof values.headless === 'boolean' ? values.headless : undefined;
-    const envHeadless = env.HEADLESS === 'true' ? true : env.HEADLESS === 'false' ? false : undefined;
-    const headless = (_ref = cliHeadless !== null && cliHeadless !== void 0 ? cliHeadless : envHeadless) !== null && _ref !== void 0 ? _ref : false;
     const cliRedirectUri = typeof values['redirect-uri'] === 'string' ? values['redirect-uri'] : undefined;
     const envRedirectUri = env.REDIRECT_URI;
     const redirectUri = cliRedirectUri !== null && cliRedirectUri !== void 0 ? cliRedirectUri : envRedirectUri;
+    if (redirectUri && transport === 'stdio') {
+        throw new Error('REDIRECT_URI requires HTTP transport. The OAuth callback must be served over HTTP.');
+    }
+    const cliHeadless = typeof values.headless === 'boolean' ? values.headless : undefined;
+    const envHeadless = env.HEADLESS === 'true' ? true : env.HEADLESS === 'false' ? false : undefined;
+    const headless = (_ref = cliHeadless !== null && cliHeadless !== void 0 ? cliHeadless : envHeadless) !== null && _ref !== void 0 ? _ref : redirectUri !== undefined; // default for redirectUri is headless (assume server http deployment); otherwise assume local and non-headless
     const clientId = requiredEnv('GOOGLE_CLIENT_ID');
     const clientSecret = env.GOOGLE_CLIENT_SECRET;
     let serviceAccountKeyFile;

package/dist/esm/setup/config.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/Projects/ai/mcp-z/oauth/oauth-google/src/setup/config.ts"],"sourcesContent":["/**\n * Google OAuth configuration parsing from CLI arguments and environment variables.\n *\n * This module provides utilities to parse Google OAuth configuration from\n * CLI arguments and environment variables, following the same pattern as @mcp-z/server's\n * parseConfig().\n */\n\nimport { resolve } from 'path';\nimport { parseArgs } from 'util';\nimport type { DcrConfig, OAuthConfig } from '../types.ts';\n\n// Re-export for direct imports from config.ts\nexport type { DcrConfig, OAuthConfig };\n\n/**\n * auth mode type (from OAuthConfig)\n */\ntype AuthMode = 'loopback-oauth' | 'service-account' | 'dcr';\n\n/**\n * Parse auth mode string into auth mode.\n *\n * @param value - Auth mode string ('loopback-oauth', 'service-account', or 'dcr')\n * @returns Parsed auth mode\n * @throws Error if value is invalid\n *\n * @example Valid formats\n * ```typescript\n * parseAuthMode('loopback-oauth')   // { auth: 'loopback-oauth' }\n * parseAuthMode('service-account')  // { auth: 'service-account' }\n * parseAuthMode('dcr')              // { auth: 'dcr' }\n * ```\n */\nfunction parseAuthMode(value: string): {\n  auth: AuthMode;\n} {\n  if (value !== 'loopback-oauth' && value !== 'service-account' && value !== 'dcr') {\n    throw new Error(`Invalid --auth value: \"${value}\". Valid values: loopback-oauth, service-account, dcr`);\n  }\n\n  return {\n    auth: value as AuthMode,\n  };\n}\n\n/**\n * Transport type for MCP servers\n */\ntype TransportType = 'stdio' | 'http';\n\n/**\n * Parse Google OAuth configuration from CLI arguments and environment variables.\n *\n * CLI Arguments:\n * - --auth: Auth mode ('loopback-oauth' | 'service-account' | 'dcr')\n *   - Default: 'loopback-oauth' (if flag is omitted)\n * - --headless: Disable browser opening for OAuth flow (default: false, true in test env)\n * - --redirect-uri: Override OAuth redirect URI (default: ephemeral loopback)\n * - --service-account-key-file: Service account key file path (required for service-account mode)\n *\n * Required environment variables:\n * - GOOGLE_CLIENT_ID: OAuth 2.0 client ID from Google Cloud Console\n *\n * Optional environment variables:\n * - GOOGLE_CLIENT_SECRET: OAuth 2.0 client secret (optional for public clients)\n * - AUTH_MODE: Auth mode (same format as --auth flag)\n * - HEADLESS: Headless mode flag ('true' to enable)\n * - REDIRECT_URI: OAuth redirect URI (overridden by --redirect-uri CLI flag)\n * - GOOGLE_SERVICE_ACCOUNT_KEY_FILE: Service account key file (for service-account mode)\n *\n * @param args - CLI arguments array (typically process.argv)\n * @param env - Environment variables object (typically process.env)\n * @param transport - Optional transport type. If 'stdio' and auth mode is 'dcr', throws an error.\n * @returns Parsed Google OAuth configuration\n * @throws Error if required environment variables are missing, values are invalid, or DCR is used with stdio transport\n *\n * @example Default mode (no flags)\n * ```typescript\n * const config = parseConfig(process.argv, process.env);\n * // { auth: 'loopback-oauth' }\n * ```\n *\n * @example Override auth mode\n * ```typescript\n * parseConfig(['--auth=loopback-oauth'], process.env);\n * parseConfig(['--auth=service-account'], process.env);\n * parseConfig(['--auth=dcr'], process.env);\n * ```\n *\n * @example With transport validation\n * ```typescript\n * parseConfig(['--auth=dcr'], process.env, 'http'); // OK\n * parseConfig(['--auth=dcr'], process.env, 'stdio'); // Throws error\n * ```\n *\n * Valid auth modes:\n * - loopback-oauth (default)\n * - service-account\n * - dcr (HTTP transport only)\n */\nexport function parseConfig(args: string[], env: Record<string, string | undefined>, transport?: TransportType): OAuthConfig {\n  function requiredEnv(key: string): string {\n    const value = env[key];\n    if (!value) {\n      throw new Error(`Environment variable ${key} is required for Google OAuth`);\n    }\n    return value;\n  }\n\n  // Parse CLI arguments\n  const { values } = parseArgs({\n    args,\n    options: {\n      auth: { type: 'string' },\n      headless: { type: 'boolean' },\n      'redirect-uri': { type: 'string' },\n      'service-account-key-file': { type: 'string' },\n    },\n    strict: false, // Allow other arguments\n    allowPositionals: true,\n  });\n\n  const authArg = typeof values.auth === 'string' ? values.auth : undefined;\n  const envAuthMode = env.AUTH_MODE;\n  const mode = authArg || envAuthMode;\n\n  let auth: AuthMode;\n\n  if (mode) {\n    const parsed = parseAuthMode(mode);\n    auth = parsed.auth;\n  } else {\n    // DEFAULT: No flags provided, use loopback-oauth\n    auth = 'loopback-oauth';\n  }\n\n  // Validate: DCR only works with HTTP transport\n  if (auth === 'dcr' && transport === 'stdio') {\n    throw new Error('DCR authentication mode requires HTTP transport. DCR is not supported with stdio transport.');\n  }\n\n  const cliHeadless = typeof values.headless === 'boolean' ? values.headless : undefined;\n  const envHeadless = env.HEADLESS === 'true' ? true : env.HEADLESS === 'false' ? false : undefined;\n  const headless = cliHeadless ?? envHeadless ?? false;\n\n  const cliRedirectUri = typeof values['redirect-uri'] === 'string' ? values['redirect-uri'] : undefined;\n  const envRedirectUri = env.REDIRECT_URI;\n  const redirectUri = cliRedirectUri ?? envRedirectUri;\n\n  const clientId = requiredEnv('GOOGLE_CLIENT_ID');\n  const clientSecret = env.GOOGLE_CLIENT_SECRET;\n\n  let serviceAccountKeyFile: string | undefined;\n  if (auth === 'service-account') {\n    const cliKeyFile = typeof values['service-account-key-file'] === 'string' ? values['service-account-key-file'] : undefined;\n    serviceAccountKeyFile = cliKeyFile ?? env.GOOGLE_SERVICE_ACCOUNT_KEY_FILE;\n\n    if (!serviceAccountKeyFile) {\n      throw new Error('GOOGLE_SERVICE_ACCOUNT_KEY_FILE environment variable is required when using service account authentication. ' + 'Example: export GOOGLE_SERVICE_ACCOUNT_KEY_FILE=./service-account.json');\n    }\n\n    // Resolve relative paths now since cwd can change during execution\n    serviceAccountKeyFile = resolve(serviceAccountKeyFile);\n  }\n\n  return {\n    clientId,\n    ...(clientSecret && { clientSecret }),\n    auth,\n    headless,\n    ...(redirectUri && { redirectUri }),\n    ...(serviceAccountKeyFile && { serviceAccountKeyFile }),\n  };\n}\n\n/**\n * Build production configuration from process globals.\n * Entry point for production server.\n */\nexport function createConfig(): OAuthConfig {\n  return parseConfig(process.argv, process.env);\n}\n\n/**\n * Parse DCR configuration from CLI arguments and environment variables.\n *\n * CLI Arguments:\n * - --dcr-mode: DCR mode ('self-hosted' | 'external')\n *   - Default: 'self-hosted' (if flag is omitted)\n * - --dcr-verify-url: External verification endpoint URL (required for external mode)\n * - --dcr-store-uri: DCR client storage URI (required for self-hosted mode)\n *\n * Required environment variables:\n * - GOOGLE_CLIENT_ID: OAuth 2.0 client ID from Google Cloud Console\n *\n * Optional environment variables:\n * - GOOGLE_CLIENT_SECRET: OAuth 2.0 client secret (optional for public clients)\n * - DCR_MODE: DCR mode (same format as --dcr-mode flag)\n * - DCR_VERIFY_URL: External verification URL (same as --dcr-verify-url flag)\n * - DCR_STORE_URI: DCR storage URI (same as --dcr-store-uri flag)\n *\n * @param args - CLI arguments array (typically process.argv)\n * @param env - Environment variables object (typically process.env)\n * @param scope - OAuth scopes to request (space-separated)\n * @returns Parsed DCR configuration\n * @throws Error if required environment variables are missing or validation fails\n *\n * @example Self-hosted mode\n * ```typescript\n * const config = parseDcrConfig(\n *   ['--dcr-mode=self-hosted', '--dcr-store-uri=file:///path/to/store.json'],\n *   process.env,\n *   'https://www.googleapis.com/auth/drive.readonly'\n * );\n * ```\n *\n * @example External mode\n * ```typescript\n * const config = parseDcrConfig(\n *   ['--dcr-mode=external', '--dcr-verify-url=https://auth0.example.com/verify'],\n *   process.env,\n *   'https://www.googleapis.com/auth/drive.readonly'\n * );\n * ```\n */\nexport function parseDcrConfig(args: string[], env: Record<string, string | undefined>, scope: string): DcrConfig {\n  function requiredEnv(key: string): string {\n    const value = env[key];\n    if (!value) {\n      throw new Error(`Environment variable ${key} is required for DCR configuration`);\n    }\n    return value;\n  }\n\n  const { values } = parseArgs({\n    args,\n    options: {\n      'dcr-mode': { type: 'string' },\n      'dcr-verify-url': { type: 'string' },\n      'dcr-store-uri': { type: 'string' },\n    },\n    strict: false,\n    allowPositionals: true,\n  });\n\n  const cliMode = typeof values['dcr-mode'] === 'string' ? values['dcr-mode'] : undefined;\n  const envMode = env.DCR_MODE;\n  const mode = cliMode || envMode || 'self-hosted';\n\n  if (mode !== 'self-hosted' && mode !== 'external') {\n    throw new Error(`Invalid --dcr-mode value: \"${mode}\". Valid values: self-hosted, external`);\n  }\n\n  const cliVerifyUrl = typeof values['dcr-verify-url'] === 'string' ? values['dcr-verify-url'] : undefined;\n  const envVerifyUrl = env.DCR_VERIFY_URL;\n  const verifyUrl = cliVerifyUrl || envVerifyUrl;\n\n  const cliStoreUri = typeof values['dcr-store-uri'] === 'string' ? values['dcr-store-uri'] : undefined;\n  const envStoreUri = env.DCR_STORE_URI;\n  const storeUri = cliStoreUri || envStoreUri;\n\n  if (mode === 'external' && !verifyUrl) {\n    throw new Error('DCR external mode requires --dcr-verify-url or DCR_VERIFY_URL environment variable');\n  }\n\n  const clientId = requiredEnv('GOOGLE_CLIENT_ID');\n  const clientSecret = env.GOOGLE_CLIENT_SECRET;\n\n  return {\n    mode,\n    ...(verifyUrl && { verifyUrl }),\n    ...(storeUri && { storeUri }),\n    clientId,\n    ...(clientSecret && { clientSecret }),\n    scope,\n  };\n}\n"],"names":["resolve","parseArgs","parseAuthMode","value","Error","auth","parseConfig","args","env","transport","cliHeadless","requiredEnv","key","values","options","type","headless","strict","allowPositionals","authArg","undefined","envAuthMode","AUTH_MODE","mode","parsed","envHeadless","HEADLESS","cliRedirectUri","envRedirectUri","REDIRECT_URI","redirectUri","clientId","clientSecret","GOOGLE_CLIENT_SECRET","serviceAccountKeyFile","cliKeyFile","GOOGLE_SERVICE_ACCOUNT_KEY_FILE","createConfig","process","argv","parseDcrConfig","scope","cliMode","envMode","DCR_MODE","cliVerifyUrl","envVerifyUrl","DCR_VERIFY_URL","verifyUrl","cliStoreUri","envStoreUri","DCR_STORE_URI","storeUri"],"mappings":"AAAA;;;;;;CAMC,GAED,SAASA,OAAO,QAAQ,OAAO;AAC/B,SAASC,SAAS,QAAQ,OAAO;AAWjC;;;;;;;;;;;;;CAaC,GACD,SAASC,cAAcC,KAAa;IAGlC,IAAIA,UAAU,oBAAoBA,UAAU,qBAAqBA,UAAU,OAAO;QAChF,MAAM,IAAIC,MAAM,CAAC,uBAAuB,EAAED,MAAM,qDAAqD,CAAC;IACxG;IAEA,OAAO;QACLE,MAAMF;IACR;AACF;AAOA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiDC,GACD,OAAO,SAASG,YAAYC,IAAc,EAAEC,GAAuC,EAAEC,SAAyB;QA2C3FC;IA1CjB,SAASC,YAAYC,GAAW;QAC9B,MAAMT,QAAQK,GAAG,CAACI,IAAI;QACtB,IAAI,CAACT,OAAO;YACV,MAAM,IAAIC,MAAM,CAAC,qBAAqB,EAAEQ,IAAI,6BAA6B,CAAC;QAC5E;QACA,OAAOT;IACT;IAEA,sBAAsB;IACtB,MAAM,EAAEU,MAAM,EAAE,GAAGZ,UAAU;QAC3BM;QACAO,SAAS;YACPT,MAAM;gBAAEU,MAAM;YAAS;YACvBC,UAAU;gBAAED,MAAM;YAAU;YAC5B,gBAAgB;gBAAEA,MAAM;YAAS;YACjC,4BAA4B;gBAAEA,MAAM;YAAS;QAC/C;QACAE,QAAQ;QACRC,kBAAkB;IACpB;IAEA,MAAMC,UAAU,OAAON,OAAOR,IAAI,KAAK,WAAWQ,OAAOR,IAAI,GAAGe;IAChE,MAAMC,cAAcb,IAAIc,SAAS;IACjC,MAAMC,OAAOJ,WAAWE;IAExB,IAAIhB;IAEJ,IAAIkB,MAAM;QACR,MAAMC,SAAStB,cAAcqB;QAC7BlB,OAAOmB,OAAOnB,IAAI;IACpB,OAAO;QACL,iDAAiD;QACjDA,OAAO;IACT;IAEA,+CAA+C;IAC/C,IAAIA,SAAS,SAASI,cAAc,SAAS;QAC3C,MAAM,IAAIL,MAAM;IAClB;IAEA,MAAMM,cAAc,OAAOG,OAAOG,QAAQ,KAAK,YAAYH,OAAOG,QAAQ,GAAGI;IAC7E,MAAMK,cAAcjB,IAAIkB,QAAQ,KAAK,SAAS,OAAOlB,IAAIkB,QAAQ,KAAK,UAAU,QAAQN;IACxF,MAAMJ,YAAWN,OAAAA,wBAAAA,yBAAAA,cAAee,yBAAff,kBAAAA,OAA8B;IAE/C,MAAMiB,iBAAiB,OAAOd,MAAM,CAAC,eAAe,KAAK,WAAWA,MAAM,CAAC,eAAe,GAAGO;IAC7F,MAAMQ,iBAAiBpB,IAAIqB,YAAY;IACvC,MAAMC,cAAcH,2BAAAA,4BAAAA,iBAAkBC;IAEtC,MAAMG,WAAWpB,YAAY;IAC7B,MAAMqB,eAAexB,IAAIyB,oBAAoB;IAE7C,IAAIC;IACJ,IAAI7B,SAAS,mBAAmB;QAC9B,MAAM8B,aAAa,OAAOtB,MAAM,CAAC,2BAA2B,KAAK,WAAWA,MAAM,CAAC,2BAA2B,GAAGO;QACjHc,wBAAwBC,uBAAAA,wBAAAA,aAAc3B,IAAI4B,+BAA+B;QAEzE,IAAI,CAACF,uBAAuB;YAC1B,MAAM,IAAI9B,MAAM,iHAAiH;QACnI;QAEA,mEAAmE;QACnE8B,wBAAwBlC,QAAQkC;IAClC;IAEA,OAAO;QACLH;QACA,GAAIC,gBAAgB;YAAEA;QAAa,CAAC;QACpC3B;QACAW;QACA,GAAIc,eAAe;YAAEA;QAAY,CAAC;QAClC,GAAII,yBAAyB;YAAEA;QAAsB,CAAC;IACxD;AACF;AAEA;;;CAGC,GACD,OAAO,SAASG;IACd,OAAO/B,YAAYgC,QAAQC,IAAI,EAAED,QAAQ9B,GAAG;AAC9C;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyCC,GACD,OAAO,SAASgC,eAAejC,IAAc,EAAEC,GAAuC,EAAEiC,KAAa;IACnG,SAAS9B,YAAYC,GAAW;QAC9B,MAAMT,QAAQK,GAAG,CAACI,IAAI;QACtB,IAAI,CAACT,OAAO;YACV,MAAM,IAAIC,MAAM,CAAC,qBAAqB,EAAEQ,IAAI,kCAAkC,CAAC;QACjF;QACA,OAAOT;IACT;IAEA,MAAM,EAAEU,MAAM,EAAE,GAAGZ,UAAU;QAC3BM;QACAO,SAAS;YACP,YAAY;gBAAEC,MAAM;YAAS;YAC7B,kBAAkB;gBAAEA,MAAM;YAAS;YACnC,iBAAiB;gBAAEA,MAAM;YAAS;QACpC;QACAE,QAAQ;QACRC,kBAAkB;IACpB;IAEA,MAAMwB,UAAU,OAAO7B,MAAM,CAAC,WAAW,KAAK,WAAWA,MAAM,CAAC,WAAW,GAAGO;IAC9E,MAAMuB,UAAUnC,IAAIoC,QAAQ;IAC5B,MAAMrB,OAAOmB,WAAWC,WAAW;IAEnC,IAAIpB,SAAS,iBAAiBA,SAAS,YAAY;QACjD,MAAM,IAAInB,MAAM,CAAC,2BAA2B,EAAEmB,KAAK,sCAAsC,CAAC;IAC5F;IAEA,MAAMsB,eAAe,OAAOhC,MAAM,CAAC,iBAAiB,KAAK,WAAWA,MAAM,CAAC,iBAAiB,GAAGO;IAC/F,MAAM0B,eAAetC,IAAIuC,cAAc;IACvC,MAAMC,YAAYH,gBAAgBC;IAElC,MAAMG,cAAc,OAAOpC,MAAM,CAAC,gBAAgB,KAAK,WAAWA,MAAM,CAAC,gBAAgB,GAAGO;IAC5F,MAAM8B,cAAc1C,IAAI2C,aAAa;IACrC,MAAMC,WAAWH,eAAeC;IAEhC,IAAI3B,SAAS,cAAc,CAACyB,WAAW;QACrC,MAAM,IAAI5C,MAAM;IAClB;IAEA,MAAM2B,WAAWpB,YAAY;IAC7B,MAAMqB,eAAexB,IAAIyB,oBAAoB;IAE7C,OAAO;QACLV;QACA,GAAIyB,aAAa;YAAEA;QAAU,CAAC;QAC9B,GAAII,YAAY;YAAEA;QAAS,CAAC;QAC5BrB;QACA,GAAIC,gBAAgB;YAAEA;QAAa,CAAC;QACpCS;IACF;AACF"}
+{"version":3,"sources":["/Users/kevin/Dev/Projects/mcp-z/oauth-google/src/setup/config.ts"],"sourcesContent":["/**\n * Google OAuth configuration parsing from CLI arguments and environment variables.\n *\n * This module provides utilities to parse Google OAuth configuration from\n * CLI arguments and environment variables, following the same pattern as @mcp-z/server's\n * parseConfig().\n */\n\nimport { resolve } from 'path';\nimport { parseArgs } from 'util';\nimport type { DcrConfig, OAuthConfig } from '../types.ts';\n\n// Re-export for direct imports from config.ts\nexport type { DcrConfig, OAuthConfig };\n\n/**\n * auth mode type (from OAuthConfig)\n */\ntype AuthMode = 'loopback-oauth' | 'service-account' | 'dcr';\n\n/**\n * Parse auth mode string into auth mode.\n *\n * @param value - Auth mode string ('loopback-oauth', 'service-account', or 'dcr')\n * @returns Parsed auth mode\n * @throws Error if value is invalid\n *\n * @example Valid formats\n * ```typescript\n * parseAuthMode('loopback-oauth')   // { auth: 'loopback-oauth' }\n * parseAuthMode('service-account')  // { auth: 'service-account' }\n * parseAuthMode('dcr')              // { auth: 'dcr' }\n * ```\n */\nfunction parseAuthMode(value: string): {\n  auth: AuthMode;\n} {\n  if (value !== 'loopback-oauth' && value !== 'service-account' && value !== 'dcr') {\n    throw new Error(`Invalid --auth value: \"${value}\". Valid values: loopback-oauth, service-account, dcr`);\n  }\n\n  return {\n    auth: value as AuthMode,\n  };\n}\n\n/**\n * Transport type for MCP servers\n *\n * @typedef {('stdio' | 'http')} TransportType\n * @property {'stdio'} stdio - Standard input/output transport for CLI applications\n * @property {'http'} http - HTTP transport for web-based applications\n */\nexport type TransportType = 'stdio' | 'http';\n\n/**\n * Parse Google OAuth configuration from CLI arguments and environment variables.\n *\n * CLI Arguments:\n * - --auth: Auth mode ('loopback-oauth' | 'service-account' | 'dcr')\n *   - Default: 'loopback-oauth' (if flag is omitted)\n * - --headless: Disable browser opening for OAuth flow (default: false, true in test env)\n * - --redirect-uri: Override OAuth redirect URI (default: ephemeral loopback)\n * - --service-account-key-file: Service account key file path (required for service-account mode)\n *\n * Required environment variables:\n * - GOOGLE_CLIENT_ID: OAuth 2.0 client ID from Google Cloud Console\n *\n * Optional environment variables:\n * - GOOGLE_CLIENT_SECRET: OAuth 2.0 client secret (optional for public clients)\n * - AUTH_MODE: Auth mode (same format as --auth flag)\n * - HEADLESS: Headless mode flag ('true' to enable)\n * - REDIRECT_URI: OAuth redirect URI (overridden by --redirect-uri CLI flag)\n * - GOOGLE_SERVICE_ACCOUNT_KEY_FILE: Service account key file (for service-account mode)\n *\n * @param args - CLI arguments array (typically process.argv)\n * @param env - Environment variables object (typically process.env)\n * @param transport - Optional transport type. If 'stdio' and auth mode is 'dcr', throws an error.\n *                   See {@link TransportType} for valid values.\n * @returns Parsed Google OAuth configuration\n * @throws Error if required environment variables are missing, values are invalid, or DCR is used with stdio transport\n *\n * @example Default mode (no flags)\n * ```typescript\n * const config = parseConfig(process.argv, process.env);\n * // { auth: 'loopback-oauth' }\n * ```\n *\n * @example Override auth mode\n * ```typescript\n * parseConfig(['--auth=loopback-oauth'], process.env);\n * parseConfig(['--auth=service-account'], process.env);\n * parseConfig(['--auth=dcr'], process.env);\n * ```\n *\n * @example With transport validation\n * ```typescript\n * parseConfig(['--auth=dcr'], process.env, 'http'); // OK\n * parseConfig(['--auth=dcr'], process.env, 'stdio'); // Throws error\n * ```\n *\n * Valid auth modes:\n * - loopback-oauth (default)\n * - service-account\n * - dcr (HTTP transport only)\n */\nexport function parseConfig(args: string[], env: Record<string, string | undefined>, transport?: TransportType): OAuthConfig {\n  function requiredEnv(key: string): string {\n    const value = env[key];\n    if (!value) {\n      throw new Error(`Environment variable ${key} is required for Google OAuth`);\n    }\n    return value;\n  }\n\n  // Parse CLI arguments\n  const { values } = parseArgs({\n    args,\n    options: {\n      auth: { type: 'string' },\n      headless: { type: 'boolean' },\n      'redirect-uri': { type: 'string' },\n      'service-account-key-file': { type: 'string' },\n    },\n    strict: false, // Allow other arguments\n    allowPositionals: true,\n  });\n\n  const authArg = typeof values.auth === 'string' ? values.auth : undefined;\n  const envAuthMode = env.AUTH_MODE;\n  const mode = authArg || envAuthMode;\n\n  let auth: AuthMode;\n\n  if (mode) {\n    const parsed = parseAuthMode(mode);\n    auth = parsed.auth;\n  } else {\n    // DEFAULT: No flags provided, use loopback-oauth\n    auth = 'loopback-oauth';\n  }\n\n  // Validate: DCR only works with HTTP transport\n  if (auth === 'dcr' && transport === 'stdio') {\n    throw new Error('DCR authentication mode requires HTTP transport. DCR is not supported with stdio transport.');\n  }\n\n  const cliRedirectUri = typeof values['redirect-uri'] === 'string' ? values['redirect-uri'] : undefined;\n  const envRedirectUri = env.REDIRECT_URI;\n  const redirectUri = cliRedirectUri ?? envRedirectUri;\n  if (redirectUri && transport === 'stdio') {\n    throw new Error('REDIRECT_URI requires HTTP transport. The OAuth callback must be served over HTTP.');\n  }\n\n  const cliHeadless = typeof values.headless === 'boolean' ? values.headless : undefined;\n  const envHeadless = env.HEADLESS === 'true' ? true : env.HEADLESS === 'false' ? false : undefined;\n  const headless = cliHeadless ?? envHeadless ?? redirectUri !== undefined; // default for redirectUri is headless (assume server http deployment); otherwise assume local and non-headless\n\n  const clientId = requiredEnv('GOOGLE_CLIENT_ID');\n  const clientSecret = env.GOOGLE_CLIENT_SECRET;\n\n  let serviceAccountKeyFile: string | undefined;\n  if (auth === 'service-account') {\n    const cliKeyFile = typeof values['service-account-key-file'] === 'string' ? values['service-account-key-file'] : undefined;\n    serviceAccountKeyFile = cliKeyFile ?? env.GOOGLE_SERVICE_ACCOUNT_KEY_FILE;\n\n    if (!serviceAccountKeyFile) {\n      throw new Error('GOOGLE_SERVICE_ACCOUNT_KEY_FILE environment variable is required when using service account authentication. ' + 'Example: export GOOGLE_SERVICE_ACCOUNT_KEY_FILE=./service-account.json');\n    }\n\n    // Resolve relative paths now since cwd can change during execution\n    serviceAccountKeyFile = resolve(serviceAccountKeyFile);\n  }\n\n  return {\n    clientId,\n    ...(clientSecret && { clientSecret }),\n    auth,\n    headless,\n    ...(redirectUri && { redirectUri }),\n    ...(serviceAccountKeyFile && { serviceAccountKeyFile }),\n  };\n}\n\n/**\n * Build production configuration from process globals.\n * Entry point for production server.\n */\nexport function createConfig(): OAuthConfig {\n  return parseConfig(process.argv, process.env);\n}\n\n/**\n * Parse DCR configuration from CLI arguments and environment variables.\n *\n * CLI Arguments:\n * - --dcr-mode: DCR mode ('self-hosted' | 'external')\n *   - Default: 'self-hosted' (if flag is omitted)\n * - --dcr-verify-url: External verification endpoint URL (required for external mode)\n * - --dcr-store-uri: DCR client storage URI (required for self-hosted mode)\n *\n * Required environment variables:\n * - GOOGLE_CLIENT_ID: OAuth 2.0 client ID from Google Cloud Console\n *\n * Optional environment variables:\n * - GOOGLE_CLIENT_SECRET: OAuth 2.0 client secret (optional for public clients)\n * - DCR_MODE: DCR mode (same format as --dcr-mode flag)\n * - DCR_VERIFY_URL: External verification URL (same as --dcr-verify-url flag)\n * - DCR_STORE_URI: DCR storage URI (same as --dcr-store-uri flag)\n *\n * @param args - CLI arguments array (typically process.argv)\n * @param env - Environment variables object (typically process.env)\n * @param scope - OAuth scopes to request (space-separated)\n * @returns Parsed DCR configuration\n * @throws Error if required environment variables are missing or validation fails\n *\n * @example Self-hosted mode\n * ```typescript\n * const config = parseDcrConfig(\n *   ['--dcr-mode=self-hosted', '--dcr-store-uri=file:///path/to/store.json'],\n *   process.env,\n *   'https://www.googleapis.com/auth/drive.readonly'\n * );\n * ```\n *\n * @example External mode\n * ```typescript\n * const config = parseDcrConfig(\n *   ['--dcr-mode=external', '--dcr-verify-url=https://auth0.example.com/verify'],\n *   process.env,\n *   'https://www.googleapis.com/auth/drive.readonly'\n * );\n * ```\n */\nexport function parseDcrConfig(args: string[], env: Record<string, string | undefined>, scope: string): DcrConfig {\n  function requiredEnv(key: string): string {\n    const value = env[key];\n    if (!value) {\n      throw new Error(`Environment variable ${key} is required for DCR configuration`);\n    }\n    return value;\n  }\n\n  const { values } = parseArgs({\n    args,\n    options: {\n      'dcr-mode': { type: 'string' },\n      'dcr-verify-url': { type: 'string' },\n      'dcr-store-uri': { type: 'string' },\n    },\n    strict: false,\n    allowPositionals: true,\n  });\n\n  const cliMode = typeof values['dcr-mode'] === 'string' ? values['dcr-mode'] : undefined;\n  const envMode = env.DCR_MODE;\n  const mode = cliMode || envMode || 'self-hosted';\n\n  if (mode !== 'self-hosted' && mode !== 'external') {\n    throw new Error(`Invalid --dcr-mode value: \"${mode}\". Valid values: self-hosted, external`);\n  }\n\n  const cliVerifyUrl = typeof values['dcr-verify-url'] === 'string' ? values['dcr-verify-url'] : undefined;\n  const envVerifyUrl = env.DCR_VERIFY_URL;\n  const verifyUrl = cliVerifyUrl || envVerifyUrl;\n\n  const cliStoreUri = typeof values['dcr-store-uri'] === 'string' ? values['dcr-store-uri'] : undefined;\n  const envStoreUri = env.DCR_STORE_URI;\n  const storeUri = cliStoreUri || envStoreUri;\n\n  if (mode === 'external' && !verifyUrl) {\n    throw new Error('DCR external mode requires --dcr-verify-url or DCR_VERIFY_URL environment variable');\n  }\n\n  const clientId = requiredEnv('GOOGLE_CLIENT_ID');\n  const clientSecret = env.GOOGLE_CLIENT_SECRET;\n\n  return {\n    mode,\n    ...(verifyUrl && { verifyUrl }),\n    ...(storeUri && { storeUri }),\n    clientId,\n    ...(clientSecret && { clientSecret }),\n    scope,\n  };\n}\n"],"names":["resolve","parseArgs","parseAuthMode","value","Error","auth","parseConfig","args","env","transport","cliHeadless","requiredEnv","key","values","options","type","headless","strict","allowPositionals","authArg","undefined","envAuthMode","AUTH_MODE","mode","parsed","cliRedirectUri","envRedirectUri","REDIRECT_URI","redirectUri","envHeadless","HEADLESS","clientId","clientSecret","GOOGLE_CLIENT_SECRET","serviceAccountKeyFile","cliKeyFile","GOOGLE_SERVICE_ACCOUNT_KEY_FILE","createConfig","process","argv","parseDcrConfig","scope","cliMode","envMode","DCR_MODE","cliVerifyUrl","envVerifyUrl","DCR_VERIFY_URL","verifyUrl","cliStoreUri","envStoreUri","DCR_STORE_URI","storeUri"],"mappings":"AAAA;;;;;;CAMC,GAED,SAASA,OAAO,QAAQ,OAAO;AAC/B,SAASC,SAAS,QAAQ,OAAO;AAWjC;;;;;;;;;;;;;CAaC,GACD,SAASC,cAAcC,KAAa;IAGlC,IAAIA,UAAU,oBAAoBA,UAAU,qBAAqBA,UAAU,OAAO;QAChF,MAAM,IAAIC,MAAM,CAAC,uBAAuB,EAAED,MAAM,qDAAqD,CAAC;IACxG;IAEA,OAAO;QACLE,MAAMF;IACR;AACF;AAWA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkDC,GACD,OAAO,SAASG,YAAYC,IAAc,EAAEC,GAAuC,EAAEC,SAAyB;QAkD3FC;IAjDjB,SAASC,YAAYC,GAAW;QAC9B,MAAMT,QAAQK,GAAG,CAACI,IAAI;QACtB,IAAI,CAACT,OAAO;YACV,MAAM,IAAIC,MAAM,CAAC,qBAAqB,EAAEQ,IAAI,6BAA6B,CAAC;QAC5E;QACA,OAAOT;IACT;IAEA,sBAAsB;IACtB,MAAM,EAAEU,MAAM,EAAE,GAAGZ,UAAU;QAC3BM;QACAO,SAAS;YACPT,MAAM;gBAAEU,MAAM;YAAS;YACvBC,UAAU;gBAAED,MAAM;YAAU;YAC5B,gBAAgB;gBAAEA,MAAM;YAAS;YACjC,4BAA4B;gBAAEA,MAAM;YAAS;QAC/C;QACAE,QAAQ;QACRC,kBAAkB;IACpB;IAEA,MAAMC,UAAU,OAAON,OAAOR,IAAI,KAAK,WAAWQ,OAAOR,IAAI,GAAGe;IAChE,MAAMC,cAAcb,IAAIc,SAAS;IACjC,MAAMC,OAAOJ,WAAWE;IAExB,IAAIhB;IAEJ,IAAIkB,MAAM;QACR,MAAMC,SAAStB,cAAcqB;QAC7BlB,OAAOmB,OAAOnB,IAAI;IACpB,OAAO;QACL,iDAAiD;QACjDA,OAAO;IACT;IAEA,+CAA+C;IAC/C,IAAIA,SAAS,SAASI,cAAc,SAAS;QAC3C,MAAM,IAAIL,MAAM;IAClB;IAEA,MAAMqB,iBAAiB,OAAOZ,MAAM,CAAC,eAAe,KAAK,WAAWA,MAAM,CAAC,eAAe,GAAGO;IAC7F,MAAMM,iBAAiBlB,IAAImB,YAAY;IACvC,MAAMC,cAAcH,2BAAAA,4BAAAA,iBAAkBC;IACtC,IAAIE,eAAenB,cAAc,SAAS;QACxC,MAAM,IAAIL,MAAM;IAClB;IAEA,MAAMM,cAAc,OAAOG,OAAOG,QAAQ,KAAK,YAAYH,OAAOG,QAAQ,GAAGI;IAC7E,MAAMS,cAAcrB,IAAIsB,QAAQ,KAAK,SAAS,OAAOtB,IAAIsB,QAAQ,KAAK,UAAU,QAAQV;IACxF,MAAMJ,YAAWN,OAAAA,wBAAAA,yBAAAA,cAAemB,yBAAfnB,kBAAAA,OAA8BkB,gBAAgBR,WAAW,+GAA+G;IAEzL,MAAMW,WAAWpB,YAAY;IAC7B,MAAMqB,eAAexB,IAAIyB,oBAAoB;IAE7C,IAAIC;IACJ,IAAI7B,SAAS,mBAAmB;QAC9B,MAAM8B,aAAa,OAAOtB,MAAM,CAAC,2BAA2B,KAAK,WAAWA,MAAM,CAAC,2BAA2B,GAAGO;QACjHc,wBAAwBC,uBAAAA,wBAAAA,aAAc3B,IAAI4B,+BAA+B;QAEzE,IAAI,CAACF,uBAAuB;YAC1B,MAAM,IAAI9B,MAAM,iHAAiH;QACnI;QAEA,mEAAmE;QACnE8B,wBAAwBlC,QAAQkC;IAClC;IAEA,OAAO;QACLH;QACA,GAAIC,gBAAgB;YAAEA;QAAa,CAAC;QACpC3B;QACAW;QACA,GAAIY,eAAe;YAAEA;QAAY,CAAC;QAClC,GAAIM,yBAAyB;YAAEA;QAAsB,CAAC;IACxD;AACF;AAEA;;;CAGC,GACD,OAAO,SAASG;IACd,OAAO/B,YAAYgC,QAAQC,IAAI,EAAED,QAAQ9B,GAAG;AAC9C;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyCC,GACD,OAAO,SAASgC,eAAejC,IAAc,EAAEC,GAAuC,EAAEiC,KAAa;IACnG,SAAS9B,YAAYC,GAAW;QAC9B,MAAMT,QAAQK,GAAG,CAACI,IAAI;QACtB,IAAI,CAACT,OAAO;YACV,MAAM,IAAIC,MAAM,CAAC,qBAAqB,EAAEQ,IAAI,kCAAkC,CAAC;QACjF;QACA,OAAOT;IACT;IAEA,MAAM,EAAEU,MAAM,EAAE,GAAGZ,UAAU;QAC3BM;QACAO,SAAS;YACP,YAAY;gBAAEC,MAAM;YAAS;YAC7B,kBAAkB;gBAAEA,MAAM;YAAS;YACnC,iBAAiB;gBAAEA,MAAM;YAAS;QACpC;QACAE,QAAQ;QACRC,kBAAkB;IACpB;IAEA,MAAMwB,UAAU,OAAO7B,MAAM,CAAC,WAAW,KAAK,WAAWA,MAAM,CAAC,WAAW,GAAGO;IAC9E,MAAMuB,UAAUnC,IAAIoC,QAAQ;IAC5B,MAAMrB,OAAOmB,WAAWC,WAAW;IAEnC,IAAIpB,SAAS,iBAAiBA,SAAS,YAAY;QACjD,MAAM,IAAInB,MAAM,CAAC,2BAA2B,EAAEmB,KAAK,sCAAsC,CAAC;IAC5F;IAEA,MAAMsB,eAAe,OAAOhC,MAAM,CAAC,iBAAiB,KAAK,WAAWA,MAAM,CAAC,iBAAiB,GAAGO;IAC/F,MAAM0B,eAAetC,IAAIuC,cAAc;IACvC,MAAMC,YAAYH,gBAAgBC;IAElC,MAAMG,cAAc,OAAOpC,MAAM,CAAC,gBAAgB,KAAK,WAAWA,MAAM,CAAC,gBAAgB,GAAGO;IAC5F,MAAM8B,cAAc1C,IAAI2C,aAAa;IACrC,MAAMC,WAAWH,eAAeC;IAEhC,IAAI3B,SAAS,cAAc,CAACyB,WAAW;QACrC,MAAM,IAAI5C,MAAM;IAClB;IAEA,MAAM2B,WAAWpB,YAAY;IAC7B,MAAMqB,eAAexB,IAAIyB,oBAAoB;IAE7C,OAAO;QACLV;QACA,GAAIyB,aAAa;YAAEA;QAAU,CAAC;QAC9B,GAAII,YAAY;YAAEA;QAAS,CAAC;QAC5BrB;QACA,GAAIC,gBAAgB;YAAEA;QAAa,CAAC;QACpCS;IACF;AACF"}

package/dist/esm/types.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/Projects/ai/mcp-z/oauth/oauth-google/src/types.ts"],"sourcesContent":["/**\n * Standalone types for Google OAuth\n * No dependencies on other @mcp-z packages except @mcp-z/oauth\n */\n\n// Shared types from base @mcp-z/oauth package\nimport type { AuthFlowDescriptor, CachedToken, DcrClientInformation, DcrClientMetadata, Logger, OAuth2TokenStorageProvider, ProviderTokens, ToolHandler, ToolModule, UserAuthProvider } from '@mcp-z/oauth';\nimport type { RequestHandlerExtra } from '@modelcontextprotocol/sdk/shared/protocol.js';\nimport type { ServerNotification, ServerRequest } from '@modelcontextprotocol/sdk/types.js';\nimport type { OAuth2Client } from 'google-auth-library';\nimport type { Keyv } from 'keyv';\n\n// Re-export only essential shared types for public API\nexport type { Logger, CachedToken, ToolModule, ProviderTokens, DcrClientMetadata, DcrClientInformation };\n\n// Re-export error class\nexport { AuthRequiredError } from '@mcp-z/oauth';\n\n// Re-export additional types for internal package use\nexport type { ToolHandler, AuthFlowDescriptor, OAuth2TokenStorageProvider, UserAuthProvider, RequestHandlerExtra, ServerRequest, ServerNotification };\n\n/**\n * Google service types that support OAuth\n * OAuth clients support all Google services provided by googleapis\n * @public\n */\nexport type GoogleService = string;\n\n// =============================================================================\n// Configuration Types\n// =============================================================================\n\n/**\n * OAuth client configuration for upstream provider\n * @public\n */\nexport interface OAuthClientConfig {\n  /** OAuth client ID for upstream provider */\n  clientId: string;\n  /** OAuth client secret (optional for some flows) */\n  clientSecret?: string;\n}\n\n/**\n * Google OAuth configuration interface.\n * @public\n */\nexport interface OAuthConfig {\n  clientId: string;\n  /** Optional for public clients */\n  clientSecret?: string;\n  auth: 'loopback-oauth' | 'service-account' | 'dcr';\n  /** No browser interaction when true */\n  headless: boolean;\n  /** Defaults to ephemeral loopback */\n  redirectUri?: string;\n  /** Required when auth === 'service-account' */\n  serviceAccountKeyFile?: string;\n}\n\n/**\n * DCR configuration for dynamic client registration\n * @public\n */\nexport interface DcrConfig {\n  /** DCR mode: self-hosted (runs own OAuth server) or external (uses Auth0/Stitch) */\n  mode: 'self-hosted' | 'external';\n  /** External verification endpoint URL (required for external mode) */\n  verifyUrl?: string;\n  /** DCR client storage URI (required for self-hosted mode) */\n  storeUri?: string;\n  /** OAuth client ID for Google APIs */\n  clientId: string;\n  /** OAuth client secret (optional for public clients) */\n  clientSecret?: string;\n  /** OAuth scopes to request */\n  scope: string;\n  /** Logger instance */\n  logger?: Logger;\n}\n\n/**\n * Configuration for loopback OAuth client\n * @public\n */\nexport interface LoopbackOAuthConfig {\n  service: GoogleService;\n  clientId: string;\n  /** Optional for public clients */\n  clientSecret?: string | undefined;\n  scope: string;\n  /** No browser interaction when true */\n  headless: boolean;\n  logger: Logger;\n  tokenStore: Keyv<unknown>;\n  /** Defaults to ephemeral loopback */\n  redirectUri?: string;\n}\n\n// =============================================================================\n// Middleware Types\n// =============================================================================\n\n/**\n * Auth context injected into extra by middleware\n * @public\n */\nexport interface AuthContext {\n  /**\n   * OAuth2Client ready for googleapis\n   * GUARANTEED to exist when handler runs\n   */\n  auth: OAuth2Client;\n\n  /**\n   * Account being used (for logging, debugging)\n   */\n  accountId: string;\n\n  /**\n   * User ID (multi-tenant only)\n   */\n\n  /**\n   * Additional metadata (e.g., service account email)\n   */\n  metadata?: {\n    serviceEmail?: string;\n    [key: string]: unknown;\n  };\n}\n\n/**\n * Enriched extra with guaranteed auth context and logger\n * Handlers receive this type - never plain RequestHandlerExtra\n * @public\n */\nexport interface EnrichedExtra extends RequestHandlerExtra<ServerRequest, ServerNotification> {\n  /**\n   * Auth context injected by middleware\n   * GUARANTEED to exist (middleware catches auth failures)\n   */\n  authContext: AuthContext;\n\n  /**\n   * Logger injected by middleware\n   * GUARANTEED to exist\n   */\n  logger: Logger;\n\n  // Preserve backchannel support\n  _meta?: {\n    accountId?: string;\n    [key: string]: unknown;\n  };\n}\n\n// =============================================================================\n// DCR Internal Types\n// =============================================================================\n\n/**\n * Registered client with full metadata\n * Extends DcrClientInformation with internal timestamps\n * @internal\n */\nexport interface RegisteredClient extends DcrClientInformation {\n  /** Creation timestamp (milliseconds since epoch) */\n  created_at: number;\n}\n\n/**\n * Authorization code data structure\n * @public\n */\nexport interface AuthorizationCode {\n  code: string;\n  client_id: string;\n  redirect_uri: string;\n  scope: string;\n  code_challenge?: string;\n  code_challenge_method?: string;\n  /** Google provider tokens obtained during authorization */\n  providerTokens: ProviderTokens;\n  created_at: number;\n  expires_at: number;\n}\n\n/**\n * Access token data structure\n * @public\n */\nexport interface AccessToken {\n  access_token: string;\n  token_type: 'Bearer';\n  expires_in: number;\n  refresh_token?: string;\n  scope: string;\n  client_id: string;\n  /** Google provider tokens */\n  providerTokens: ProviderTokens;\n  created_at: number;\n}\n\n// =============================================================================\n// Schema Types\n// =============================================================================\n\n/**\n * Authentication required response type\n * Re-exported from @mcp-z/oauth for consistency\n * @public\n */\nexport type { AuthRequired, AuthRequiredBranch } from './schemas/index.ts';\n"],"names":["AuthRequiredError"],"mappings":"AAAA;;;CAGC,GAED,8CAA8C;AAU9C,wBAAwB;AACxB,SAASA,iBAAiB,QAAQ,eAAe"}
+{"version":3,"sources":["/Users/kevin/Dev/Projects/mcp-z/oauth-google/src/types.ts"],"sourcesContent":["/**\n * Standalone types for Google OAuth\n * No dependencies on other @mcp-z packages except @mcp-z/oauth\n */\n\n// Shared types from base @mcp-z/oauth package\nimport type { AuthFlowDescriptor, CachedToken, DcrClientInformation, DcrClientMetadata, Logger, OAuth2TokenStorageProvider, ProviderTokens, ToolHandler, ToolModule, UserAuthProvider } from '@mcp-z/oauth';\nimport type { RequestHandlerExtra } from '@modelcontextprotocol/sdk/shared/protocol.js';\nimport type { ServerNotification, ServerRequest } from '@modelcontextprotocol/sdk/types.js';\nimport type { OAuth2Client } from 'google-auth-library';\nimport type { Keyv } from 'keyv';\n\n// Re-export only essential shared types for public API\nexport type { Logger, CachedToken, ToolModule, ProviderTokens, DcrClientMetadata, DcrClientInformation };\n\n// Re-export error class\nexport { AuthRequiredError } from '@mcp-z/oauth';\n\n// Re-export additional types for internal package use\nexport type { ToolHandler, AuthFlowDescriptor, OAuth2TokenStorageProvider, UserAuthProvider, RequestHandlerExtra, ServerRequest, ServerNotification };\n\n/**\n * Google service types that support OAuth\n * OAuth clients support all Google services provided by googleapis\n * @public\n */\nexport type GoogleService = string;\n\n// =============================================================================\n// Configuration Types\n// =============================================================================\n\n/**\n * OAuth client configuration for upstream provider\n * @public\n */\nexport interface OAuthClientConfig {\n  /** OAuth client ID for upstream provider */\n  clientId: string;\n  /** OAuth client secret (optional for some flows) */\n  clientSecret?: string;\n}\n\n/**\n * Google OAuth configuration interface.\n * @public\n */\nexport interface OAuthConfig {\n  clientId: string;\n  /** Optional for public clients */\n  clientSecret?: string;\n  auth: 'loopback-oauth' | 'service-account' | 'dcr';\n  /** No browser interaction when true */\n  headless: boolean;\n  /** Defaults to ephemeral loopback */\n  redirectUri?: string;\n  /** Required when auth === 'service-account' */\n  serviceAccountKeyFile?: string;\n}\n\n/**\n * DCR configuration for dynamic client registration\n * @public\n */\nexport interface DcrConfig {\n  /** DCR mode: self-hosted (runs own OAuth server) or external (uses Auth0/Stitch) */\n  mode: 'self-hosted' | 'external';\n  /** External verification endpoint URL (required for external mode) */\n  verifyUrl?: string;\n  /** DCR client storage URI (required for self-hosted mode) */\n  storeUri?: string;\n  /** OAuth client ID for Google APIs */\n  clientId: string;\n  /** OAuth client secret (optional for public clients) */\n  clientSecret?: string;\n  /** OAuth scopes to request */\n  scope: string;\n  /** Logger instance */\n  logger?: Logger;\n}\n\n/**\n * Configuration for loopback OAuth client\n * @public\n */\nexport interface LoopbackOAuthConfig {\n  service: GoogleService;\n  clientId: string;\n  /** Optional for public clients */\n  clientSecret?: string | undefined;\n  scope: string;\n  /** No browser interaction when true */\n  headless: boolean;\n  logger: Logger;\n  tokenStore: Keyv<unknown>;\n  /** Defaults to ephemeral loopback */\n  redirectUri?: string;\n}\n\n// =============================================================================\n// Middleware Types\n// =============================================================================\n\n/**\n * Auth context injected into extra by middleware\n * @public\n */\nexport interface AuthContext {\n  /**\n   * OAuth2Client ready for googleapis\n   * GUARANTEED to exist when handler runs\n   */\n  auth: OAuth2Client;\n\n  /**\n   * Account being used (for logging, debugging)\n   */\n  accountId: string;\n\n  /**\n   * User ID (multi-tenant only)\n   */\n\n  /**\n   * Additional metadata (e.g., service account email)\n   */\n  metadata?: {\n    serviceEmail?: string;\n    [key: string]: unknown;\n  };\n}\n\n/**\n * Enriched extra with guaranteed auth context and logger\n * Handlers receive this type - never plain RequestHandlerExtra\n * @public\n */\nexport interface EnrichedExtra extends RequestHandlerExtra<ServerRequest, ServerNotification> {\n  /**\n   * Auth context injected by middleware\n   * GUARANTEED to exist (middleware catches auth failures)\n   */\n  authContext: AuthContext;\n\n  /**\n   * Logger injected by middleware\n   * GUARANTEED to exist\n   */\n  logger: Logger;\n\n  // Preserve backchannel support\n  _meta?: {\n    accountId?: string;\n    [key: string]: unknown;\n  };\n}\n\n// =============================================================================\n// DCR Internal Types\n// =============================================================================\n\n/**\n * Registered client with full metadata\n * Extends DcrClientInformation with internal timestamps\n * @internal\n */\nexport interface RegisteredClient extends DcrClientInformation {\n  /** Creation timestamp (milliseconds since epoch) */\n  created_at: number;\n}\n\n/**\n * Authorization code data structure\n * @public\n */\nexport interface AuthorizationCode {\n  code: string;\n  client_id: string;\n  redirect_uri: string;\n  scope: string;\n  code_challenge?: string;\n  code_challenge_method?: string;\n  /** Google provider tokens obtained during authorization */\n  providerTokens: ProviderTokens;\n  created_at: number;\n  expires_at: number;\n}\n\n/**\n * Access token data structure\n * @public\n */\nexport interface AccessToken {\n  access_token: string;\n  token_type: 'Bearer';\n  expires_in: number;\n  refresh_token?: string;\n  scope: string;\n  client_id: string;\n  /** Google provider tokens */\n  providerTokens: ProviderTokens;\n  created_at: number;\n}\n\n// =============================================================================\n// Schema Types\n// =============================================================================\n\n/**\n * Authentication required response type\n * Re-exported from @mcp-z/oauth for consistency\n * @public\n */\nexport type { AuthRequired, AuthRequiredBranch } from './schemas/index.ts';\n"],"names":["AuthRequiredError"],"mappings":"AAAA;;;CAGC,GAED,8CAA8C;AAU9C,wBAAwB;AACxB,SAASA,iBAAiB,QAAQ,eAAe"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcp-z/oauth-google",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "OAuth 2.0 client for Google APIs with multi-account support, PKCE security, and swappable storage backends",
   "keywords": [
     "oauth2",