@obov/mext 0.0.0-stage → 0.1.0

package/dist/remote/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/remote/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAChF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AA8CzC,6FAA6F;AAC7F,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;IACtB,CAAC,CAAC,IAAI,GAAG,EAAE,CAAA;IACX,IAAI,IAAI,GAAG,CAAC,CAAC,IAAI,CAAA;IACjB,IAAI,CAAC,CAAC,QAAQ,KAAK,GAAG,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE;QAAE,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;SACpE,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IACxE,OAAO,IAAI,CAAA;AACb,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,CAAA;AACrD,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,OAAO,CAAC,KAAyB;IAC/C,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,OAAO,CAAA;AAChG,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAA+B;IAC7D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,MAAM,CAAA;IACjC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;IAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,mBAAmB,CAAC,CAAA;IACxD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC,MAAM,CAAC,CAAA;IACnE,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAA;IAC5E,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC,CAAA;IACjE,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,aAAa,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IAC7D,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAA;IACrD,MAAM,QAAQ,GAAG,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACjH,OAAO,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACvD,CAAC;AAED,sBAAsB;AACtB,SAAS,YAAY,CAAC,OAAwB,EAAE,QAAyB;IACvE,IAAI,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;IAC/B,OAAO;QACL,IAAI,QAAQ;YACV,OAAO,QAAQ,CAAA;QACjB,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG;YACX,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBACpC,IAAI,KAAK;oBAAE,OAAO,KAAK,CAAA;YACzB,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;YACD,OAAO,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC1B,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW;YACxB,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,CAAA;gBACnC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;gBAC3B,MAAM,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;YAC5C,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,CAAA;gBACpC,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAA;YAC9B,CAAC;QACH,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,GAAG;YACd,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;YACzC,MAAM,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC5B,CAAC;KACF,CAAA;AACH,CAAC;AASD,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,MAAM,IAAI,GAAG,KAAK,IAA8B,EAAE;QAChD,IAAI,IAAY,CAAA;QAChB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;YAC1F,MAAM,KAAK,CAAA;QACb,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA6B,CAAA;QAC3D,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;IACrH,CAAC,CAAA;IACD,MAAM,KAAK,GAAG,KAAK,EAAE,IAAqB,EAAiB,EAAE;QAC3D,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC5D,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAA;QACxC,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC3E,MAAM,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QACvB,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACzB,CAAC,CAAA;IACD,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,KAAK,CAAC,GAAG,CAAC,GAAG;YACX,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAA;QACxD,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW;YACxB,MAAM,IAAI,GAAG,MAAM,IAAI,EAAE,CAAA;YACzB,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,GAAG,WAAW,CAAA;YACnD,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;QACnB,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,GAAG;YACd,MAAM,IAAI,GAAG,MAAM,IAAI,EAAE,CAAA;YACzB,MAAM,GAAG,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;YACnC,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAM;YAClC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YACxB,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;;gBACtE,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;QACxB,CAAC;KACF,CAAA;AACH,CAAC;AAED,+EAA+E;AAE/E,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,OAAO,GAAG,GAAG,GAAG,cAAc,CAAA;IACpC,OAAO;QACL,QAAQ,EAAE,gBAAgB;QAC1B,KAAK,CAAC,GAAG,CAAC,GAAG;YACX,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;YACvC,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,UAAU,EAAE,CAAC,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAA;YAC9F,IAAI,CAAC,CAAC,IAAI,KAAK,EAAE;gBAAE,OAAO,SAAS,CAAA,CAAC,qBAAqB;YACzD,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC,IAAI,GAAG,CAAC,CAAA;YACtF,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;QACrE,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW;YACxB,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;YACvC,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;YACvG,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;YAC/E,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,EAAE,+BAA+B,OAAO,SAAS,OAAO,QAAQ,MAAM,IAAI,CAAC,CAAA;YACjH,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAA;QAClH,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,GAAG;YACd,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,UAAU,EAAE,CAAC,yBAAyB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;YAC1G,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC,IAAI,GAAG,CAAC,CAAA;QAC3G,CAAC;KACF,CAAA;AACH,CAAC;AAED,oDAAoD;AAEpD,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,KAAK,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,GAAG,GAAG,cAAc,EAAE,KAAK,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAA;IAChG,OAAO;QACL,QAAQ,EAAE,gBAAgB;QAC1B,KAAK,CAAC,GAAG,CAAC,GAAG;YACX,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;YAC7D,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE;gBAAE,OAAO,SAAS,CAAA;YACxE,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,IAAI,GAAG,CAAC,CAAA;YAC1E,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;QACzB,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW;YACxB,MAAM,KAAK,GAAG,GAAG,GAAG,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAA;YACjD,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAA;YAC3G,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC,IAAI,GAAG,CAAC,CAAA;QAC3E,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,GAAG;YACd,MAAM,GAAG,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QACpD,CAAC;KACF,CAAA;AACH,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAsB,CAAA;IACnD,OAAO,OAAO,KAAK,EAAE,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AACpE,CAAC;AAQD,4CAA4C;AAC5C,SAAS,GAAG,CAAC,OAAe,EAAE,IAAuB,EAAE,KAAc;IACnE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,QAAQ,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;gBACvF,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;oBAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;gBACjE,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAE,KAAK,CAAC,IAAe,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;YACvE,CAAC,CAAC,CAAA;YACF,OAAM;QACR,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAA;QACxF,IAAI,MAAM,GAAG,EAAE,CAAA;QACf,IAAI,MAAM,GAAG,EAAE,CAAA;QACf,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAA;QACzE,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAA;QACzE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACzB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAA;QACzE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IACxB,CAAC,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import { execFile, spawn } from \"node:child_process\"\nimport { chmod, mkdir, readFile, rename, rm, writeFile } from \"node:fs/promises\"\nimport { homedir } from \"node:os\"\nimport { dirname, join } from \"node:path\"\n\n/**\n * 서버 URL 별 토큰 저장 (D6). OS 키체인 = 시스템 CLI (child_process, 네이티브 의존성 없음):\n * macOS `security` (login keychain, generic password) · Linux `secret-tool` (Secret Service).\n * 키체인을 쓸 수 없으면 (그 외 OS · 명령 없음 · 실패) 또는 <BIN>_NO_KEYRING 이면 ~/.config/<bin>/credentials.json (0600).\n * <BIN>_CREDENTIALS_FILE 환경변수 = 그 파일만 사용 (키체인 · 홈 디렉터리 미사용. 테스트 · CI 용).\n */\n\n/**\n * 저장 항목. OAuth (login) = issuer · token_endpoint · client_id · resource 가 있다.\n * API key (login --with-token) = access_token (· token_type) 만.\n */\nexport interface StoredCredentials {\n  access_token: string\n  token_type?: string\n  refresh_token?: string\n  /** epoch ms. 없으면 만료 모름 */\n  expires_at?: number\n  scope?: string\n  /** 토큰을 발급한 인가 서버 (RFC 8414 issuer) */\n  issuer?: string\n  token_endpoint?: string\n  client_id?: string\n  client_secret?: string\n  token_endpoint_auth_method?: string\n  /** RFC 8707 resource (토큰 대상 MCP 서버) */\n  resource?: string\n}\n\nexport interface CredentialStore {\n  /** 표시용: \"macOS keychain\" · \"Secret Service\" · 파일 경로 */\n  readonly location: string\n  get(serverUrl: string): Promise<StoredCredentials | undefined>\n  set(serverUrl: string, credentials: StoredCredentials): Promise<void>\n  delete(serverUrl: string): Promise<void>\n}\n\nexport interface CredentialStoreOptions {\n  env: Record<string, string | undefined>\n  /** 실행 파일 이름. 환경변수 접두 (<BIN>_CREDENTIALS_FILE · <BIN>_NO_KEYRING) · 설정 폴더 · 키체인 service. 기본 mext */\n  bin?: string\n  /** 기본 process.platform */\n  platform?: NodeJS.Platform\n}\n\n/** 서버 URL 정규화 (저장 키 · RFC 8707 resource): scheme · host 소문자 (URL 파서), fragment 제거, 끝 / 제거 */\nexport function canonicalServerUrl(url: string): string {\n  const u = new URL(url)\n  u.hash = \"\"\n  let text = u.href\n  if (u.pathname === \"/\" && u.search === \"\") text = text.replace(/\\/$/, \"\")\n  else if (text.endsWith(\"/\") && u.search === \"\") text = text.slice(0, -1)\n  return text\n}\n\n/** 실행 파일 이름 → 환경변수 접두. mext → MEXT, my-app → MY_APP */\nexport function envPrefix(bin: string): string {\n  return bin.toUpperCase().replace(/[^A-Z0-9]/g, \"_\")\n}\n\n/** 환경변수 플래그: 비어 있지 않고 0 · false 가 아니면 켜짐 */\nexport function envFlag(value: string | undefined): boolean {\n  return value !== undefined && value !== \"\" && value !== \"0\" && value.toLowerCase() !== \"false\"\n}\n\nexport function credentialStore(options: CredentialStoreOptions): CredentialStore {\n  const bin = options.bin ?? \"mext\"\n  const prefix = envPrefix(bin)\n  const forced = options.env[`${prefix}_CREDENTIALS_FILE`]\n  if (forced !== undefined && forced !== \"\") return fileStore(forced)\n  const configHome = options.env.XDG_CONFIG_HOME || join(homedir(), \".config\")\n  const file = fileStore(join(configHome, bin, \"credentials.json\"))\n  if (envFlag(options.env[`${prefix}_NO_KEYRING`])) return file\n  const platform = options.platform ?? process.platform\n  const keychain = platform === \"darwin\" ? macKeychain(bin) : platform === \"linux\" ? secretService(bin) : undefined\n  return keychain ? withFallback(keychain, file) : file\n}\n\n/** 키체인 우선, 실패하면 파일 */\nfunction withFallback(primary: CredentialStore, fallback: CredentialStore): CredentialStore {\n  let location = primary.location\n  return {\n    get location() {\n      return location\n    },\n    async get(url) {\n      try {\n        const found = await primary.get(url)\n        if (found) return found\n      } catch {\n        // 키체인 사용 불가 → 파일\n      }\n      return fallback.get(url)\n    },\n    async set(url, credentials) {\n      try {\n        await primary.set(url, credentials)\n        location = primary.location\n        await fallback.delete(url).catch(() => {})\n      } catch {\n        await fallback.set(url, credentials)\n        location = fallback.location\n      }\n    },\n    async delete(url) {\n      await primary.delete(url).catch(() => {})\n      await fallback.delete(url)\n    },\n  }\n}\n\n/* 파일 */\n\ninterface CredentialsFile {\n  version: 1\n  servers: Record<string, StoredCredentials>\n}\n\nexport function fileStore(path: string): CredentialStore {\n  const read = async (): Promise<CredentialsFile> => {\n    let text: string\n    try {\n      text = await readFile(path, \"utf8\")\n    } catch (error) {\n      if ((error as NodeJS.ErrnoException).code === \"ENOENT\") return { version: 1, servers: {} }\n      throw error\n    }\n    const parsed = JSON.parse(text) as Partial<CredentialsFile>\n    return { version: 1, servers: typeof parsed.servers === \"object\" && parsed.servers !== null ? parsed.servers : {} }\n  }\n  const write = async (data: CredentialsFile): Promise<void> => {\n    await mkdir(dirname(path), { recursive: true, mode: 0o700 })\n    const tmp = `${path}.${process.pid}.tmp`\n    await writeFile(tmp, `${JSON.stringify(data, null, 2)}\\n`, { mode: 0o600 })\n    await chmod(tmp, 0o600)\n    await rename(tmp, path)\n  }\n  return {\n    location: path,\n    async get(url) {\n      return (await read()).servers[canonicalServerUrl(url)]\n    },\n    async set(url, credentials) {\n      const data = await read()\n      data.servers[canonicalServerUrl(url)] = credentials\n      await write(data)\n    },\n    async delete(url) {\n      const data = await read()\n      const key = canonicalServerUrl(url)\n      if (!(key in data.servers)) return\n      delete data.servers[key]\n      if (Object.keys(data.servers).length === 0) await rm(path, { force: true })\n      else await write(data)\n    },\n  }\n}\n\n/* macOS: security (login keychain). 비밀은 argv 가 아닌 security -i 의 stdin 으로 전달 */\n\nfunction macKeychain(bin: string): CredentialStore {\n  const service = `${bin} credentials`\n  return {\n    location: \"macOS keychain\",\n    async get(url) {\n      const account = canonicalServerUrl(url)\n      const r = await run(\"security\", [\"find-generic-password\", \"-s\", service, \"-a\", account, \"-w\"])\n      if (r.code === 44) return undefined // errSecItemNotFound\n      if (r.code !== 0) throw new Error(`security find-generic-password failed (${r.code})`)\n      return decode(Buffer.from(r.stdout.trim(), \"hex\").toString(\"utf8\"))\n    },\n    async set(url, credentials) {\n      const account = canonicalServerUrl(url)\n      if (/[\"\\\\\\n]/.test(account) || /[\"\\\\\\n]/.test(service)) throw new Error(\"unsupported keychain account\")\n      const secret = Buffer.from(JSON.stringify(credentials), \"utf8\").toString(\"hex\")\n      const r = await run(\"security\", [\"-i\"], `add-generic-password -U -s \"${service}\" -a \"${account}\" -w ${secret}\\n`)\n      if (r.code !== 0 || /error/i.test(r.stderr)) throw new Error(`security add-generic-password failed (${r.code})`)\n    },\n    async delete(url) {\n      const r = await run(\"security\", [\"delete-generic-password\", \"-s\", service, \"-a\", canonicalServerUrl(url)])\n      if (r.code !== 0 && r.code !== 44) throw new Error(`security delete-generic-password failed (${r.code})`)\n    },\n  }\n}\n\n/* Linux: secret-tool (Secret Service). 비밀은 stdin */\n\nfunction secretService(bin: string): CredentialStore {\n  const attrs = (url: string) => [\"service\", `${bin} credentials`, \"url\", canonicalServerUrl(url)]\n  return {\n    location: \"Secret Service\",\n    async get(url) {\n      const r = await run(\"secret-tool\", [\"lookup\", ...attrs(url)])\n      if (r.code === 1 && r.stdout === \"\" && r.stderr === \"\") return undefined\n      if (r.code !== 0) throw new Error(`secret-tool lookup failed (${r.code})`)\n      return decode(r.stdout)\n    },\n    async set(url, credentials) {\n      const label = `${bin} ${canonicalServerUrl(url)}`\n      const r = await run(\"secret-tool\", [\"store\", \"--label\", label, ...attrs(url)], JSON.stringify(credentials))\n      if (r.code !== 0) throw new Error(`secret-tool store failed (${r.code})`)\n    },\n    async delete(url) {\n      await run(\"secret-tool\", [\"clear\", ...attrs(url)])\n    },\n  }\n}\n\nfunction decode(text: string): StoredCredentials | undefined {\n  const value = JSON.parse(text) as StoredCredentials\n  return typeof value?.access_token === \"string\" ? value : undefined\n}\n\ninterface RunResult {\n  code: number\n  stdout: string\n  stderr: string\n}\n\n/** 명령 실행. 명령 없음 (ENOENT) = throw. 10초 제한 */\nfunction run(command: string, args: readonly string[], input?: string): Promise<RunResult> {\n  return new Promise((resolve, reject) => {\n    if (input === undefined) {\n      execFile(command, args, { timeout: 10_000, encoding: \"utf8\" }, (error, stdout, stderr) => {\n        if (error && typeof error.code !== \"number\") return reject(error)\n        resolve({ code: error ? (error.code as number) : 0, stdout, stderr })\n      })\n      return\n    }\n    const child = spawn(command, args, { stdio: [\"pipe\", \"pipe\", \"pipe\"], timeout: 10_000 })\n    let stdout = \"\"\n    let stderr = \"\"\n    child.stdout.setEncoding(\"utf8\").on(\"data\", (d: string) => (stdout += d))\n    child.stderr.setEncoding(\"utf8\").on(\"data\", (d: string) => (stderr += d))\n    child.on(\"error\", reject)\n    child.on(\"close\", (code) => resolve({ code: code ?? 1, stdout, stderr }))\n    child.stdin.end(input)\n  })\n}\n"]}

package/dist/remote/index.d.ts

@@ -0,0 +1,8 @@
+export { CLIENT_CAPABILITIES, createRemoteClient, MAX_INPUT_ROUNDS, parseBearerChallenge, PROTOCOL_VERSION, RemoteInputRequiredError, RemoteRpcError, RemoteTransportError, RemoteUnauthorizedError, } from "./client.ts";
+export type { BearerChallenge, CallToolOptions, CallToolResult, InputRequestObject, InputRequired, InputResponses, RemoteClient, RemoteClientOptions, RemoteTool, ToolsListResult, RequestOptions, } from "./client.ts";
+export { browserDecision, systemBrowserOpener } from "./browser.ts";
+export type { BrowserDecision, BrowserOpener } from "./browser.ts";
+export { canonicalServerUrl, credentialStore, envFlag, envPrefix, fileStore } from "./credentials.ts";
+export type { CredentialStore, CredentialStoreOptions, StoredCredentials } from "./credentials.ts";
+export { authorizationCodeLogin, authorizationServerMetadataUrls, DEVICE_CODE_GRANT, deviceLogin, discoverAuthorizationServer, discoverLoginTarget, discoverProtectedResource, login, OAuthFlowError, parseRedirectUrl, protectedResourceMetadataUrls, refreshCredentials, revokeCredentials, } from "./oauth.ts";
+export type { AuthorizationCodeLoginOptions, AuthorizationServerMetadata, DeviceAuthorization, DeviceLoginOptions, DiscoverLoginOptions, LoginOptions, LoginTarget, ProtectedResourceMetadata, RevokeResult, } from "./oauth.ts";

package/dist/remote/index.js

@@ -0,0 +1,5 @@
+export { CLIENT_CAPABILITIES, createRemoteClient, MAX_INPUT_ROUNDS, parseBearerChallenge, PROTOCOL_VERSION, RemoteInputRequiredError, RemoteRpcError, RemoteTransportError, RemoteUnauthorizedError, } from "./client.js";
+export { browserDecision, systemBrowserOpener } from "./browser.js";
+export { canonicalServerUrl, credentialStore, envFlag, envPrefix, fileStore } from "./credentials.js";
+export { authorizationCodeLogin, authorizationServerMetadataUrls, DEVICE_CODE_GRANT, deviceLogin, discoverAuthorizationServer, discoverLoginTarget, discoverProtectedResource, login, OAuthFlowError, parseRedirectUrl, protectedResourceMetadataUrls, refreshCredentials, revokeCredentials, } from "./oauth.js";
+//# sourceMappingURL=index.js.map

package/dist/remote/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/remote/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,cAAc,EACd,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,aAAa,CAAA;AAcpB,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAEnE,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAErG,OAAO,EACL,sBAAsB,EACtB,+BAA+B,EAC/B,iBAAiB,EACjB,WAAW,EACX,2BAA2B,EAC3B,mBAAmB,EACnB,yBAAyB,EACzB,KAAK,EACL,cAAc,EACd,gBAAgB,EAChB,6BAA6B,EAC7B,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,YAAY,CAAA","sourcesContent":["export {\n  CLIENT_CAPABILITIES,\n  createRemoteClient,\n  MAX_INPUT_ROUNDS,\n  parseBearerChallenge,\n  PROTOCOL_VERSION,\n  RemoteInputRequiredError,\n  RemoteRpcError,\n  RemoteTransportError,\n  RemoteUnauthorizedError,\n} from \"./client.ts\"\nexport type {\n  BearerChallenge,\n  CallToolOptions,\n  CallToolResult,\n  InputRequestObject,\n  InputRequired,\n  InputResponses,\n  RemoteClient,\n  RemoteClientOptions,\n  RemoteTool,\n  ToolsListResult,\n  RequestOptions,\n} from \"./client.ts\"\nexport { browserDecision, systemBrowserOpener } from \"./browser.ts\"\nexport type { BrowserDecision, BrowserOpener } from \"./browser.ts\"\nexport { canonicalServerUrl, credentialStore, envFlag, envPrefix, fileStore } from \"./credentials.ts\"\nexport type { CredentialStore, CredentialStoreOptions, StoredCredentials } from \"./credentials.ts\"\nexport {\n  authorizationCodeLogin,\n  authorizationServerMetadataUrls,\n  DEVICE_CODE_GRANT,\n  deviceLogin,\n  discoverAuthorizationServer,\n  discoverLoginTarget,\n  discoverProtectedResource,\n  login,\n  OAuthFlowError,\n  parseRedirectUrl,\n  protectedResourceMetadataUrls,\n  refreshCredentials,\n  revokeCredentials,\n} from \"./oauth.ts\"\nexport type {\n  AuthorizationCodeLoginOptions,\n  AuthorizationServerMetadata,\n  DeviceAuthorization,\n  DeviceLoginOptions,\n  DiscoverLoginOptions,\n  LoginOptions,\n  LoginTarget,\n  ProtectedResourceMetadata,\n  RevokeResult,\n} from \"./oauth.ts\"\n"]}

package/dist/remote/oauth.d.ts

@@ -0,0 +1,186 @@
+import type { BearerChallenge } from "./client.ts";
+import { type StoredCredentials } from "./credentials.ts";
+/**
+ * MCP authorization (2026-07-28) 클라이언트 쪽: OAuth 2.1 authorization code + PKCE (S256) + loopback redirect.
+ * 보호 자원 메타데이터 (RFC 9728: WWW-Authenticate resource_metadata → 경로 삽입 well-known → 루트) →
+ * 인가 서버 메타데이터 (RFC 8414 · OIDC Discovery, issuer 일치 검증) → 클라이언트 등록 (사전 등록 client_id ·
+ * Client ID Metadata Document URL · RFC 7591 동적 등록) → 인가 요청 (resource = RFC 8707) → iss 검증 (RFC 9207) →
+ * 토큰 교환. refresh_token 갱신.
+ * headless: redirect URL 붙여넣기 (loopback 과 먼저 온 쪽) · device authorization grant (RFC 8628, 인가 서버 메타데이터에
+ * device_authorization_endpoint 가 있을 때만. MCP 사양 밖). logout = token revocation (RFC 7009).
+ */
+export declare class OAuthFlowError extends Error {
+    constructor(message: string);
+}
+export interface ProtectedResourceMetadata {
+    resource?: string;
+    authorization_servers: string[];
+    scopes_supported?: string[];
+    [key: string]: unknown;
+}
+export interface AuthorizationServerMetadata {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    registration_endpoint?: string;
+    code_challenge_methods_supported?: string[];
+    scopes_supported?: string[];
+    authorization_response_iss_parameter_supported?: boolean;
+    client_id_metadata_document_supported?: boolean;
+    /** RFC 8628 */
+    device_authorization_endpoint?: string;
+    /** RFC 7009 */
+    revocation_endpoint?: string;
+    [key: string]: unknown;
+}
+type Fetch = typeof fetch;
+/** 보호 자원 메타데이터 후보 URL: challenge 의 resource_metadata, 없으면 경로 삽입 well-known → 루트 well-known */
+export declare function protectedResourceMetadataUrls(serverUrl: string, challenge?: BearerChallenge): string[];
+export declare function discoverProtectedResource(serverUrl: string, challenge: BearerChallenge | undefined, doFetch?: Fetch): Promise<ProtectedResourceMetadata>;
+/** issuer → 메타데이터 후보 URL (MCP authorization-server-discovery 순서) */
+export declare function authorizationServerMetadataUrls(issuer: string): string[];
+export declare function discoverAuthorizationServer(issuer: string, doFetch?: Fetch): Promise<AuthorizationServerMetadata>;
+export interface OAuthClient {
+    client_id: string;
+    client_secret?: string;
+    token_endpoint_auth_method?: string;
+}
+export interface RegisterOptions {
+    /** 사전 등록 client_id 또는 Client ID Metadata Document URL (https) */
+    clientId?: string;
+    clientName?: string;
+    /** 없으면 redirect 없는 등록 (device flow) */
+    redirectUri?: string;
+    scope?: string;
+}
+export declare const DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+/**
+ * 등록 순서: 사전 등록 client_id (https URL 이면 Client ID Metadata Document) → 동적 등록 (registration_endpoint).
+ * 둘 다 없으면 오류 (--client-id 안내).
+ */
+export declare function registerClient(as: AuthorizationServerMetadata, options: RegisterOptions, doFetch?: Fetch): Promise<OAuthClient>;
+export interface Pkce {
+    verifier: string;
+    challenge: string;
+}
+export declare function createPkce(): Pkce;
+export interface Loopback {
+    redirectUri: string;
+    port: number;
+    /** 첫 callback 요청의 query. signal abort · 시간 초과 = reject */
+    callback: Promise<URLSearchParams>;
+    close(): Promise<void>;
+}
+export declare const CALLBACK_PATH = "/callback";
+/** 127.0.0.1 의 임의 포트 (port 지정 가능) 에 callback 수신 서버 */
+export declare function startLoopback(options?: {
+    port?: number;
+    signal?: AbortSignal;
+    timeoutMs?: number;
+}): Promise<Loopback>;
+export interface AuthorizationRequest {
+    url: string;
+    state: string;
+    pkce: Pkce;
+}
+export declare function authorizationRequest(as: AuthorizationServerMetadata, client: OAuthClient, options: {
+    redirectUri: string;
+    resource: string;
+    scope?: string;
+}): AuthorizationRequest;
+/** callback query → code. state · iss (RFC 9207) 검증 후 error 를 본다 (iss 불일치면 error 내용도 쓰지 않음) */
+export declare function authorizationCode(query: URLSearchParams, as: AuthorizationServerMetadata, expectedState: string): string;
+interface TokenContext {
+    issuer: string;
+    token_endpoint: string;
+    client: OAuthClient;
+    resource?: string;
+}
+export declare function exchangeCode(context: TokenContext, options: {
+    code: string;
+    redirectUri: string;
+    verifier: string;
+}, doFetch?: Fetch): Promise<StoredCredentials>;
+/** refresh_token 갱신. 새 refresh_token 이 없으면 기존 값 유지 */
+export declare function refreshCredentials(credentials: StoredCredentials, doFetch?: Fetch): Promise<StoredCredentials>;
+/** 만료 30초 전부터 만료로 본다 */
+export declare function isExpired(credentials: StoredCredentials, now?: number): boolean;
+/** login 대상: 보호 자원 메타데이터 → 인가 서버 메타데이터 · resource · scope */
+export interface LoginTarget {
+    serverUrl: string;
+    as: AuthorizationServerMetadata;
+    /** RFC 8707 resource */
+    resource: string;
+    scope?: string;
+}
+export interface DiscoverLoginOptions {
+    serverUrl: string;
+    /** 서버 401 의 WWW-Authenticate (없으면 well-known 탐색) */
+    challenge?: BearerChallenge;
+    /** 기본: challenge 의 scope → 보호 자원 메타데이터 scopes_supported → 생략 */
+    scope?: string;
+    fetch?: Fetch;
+}
+export declare function discoverLoginTarget(options: DiscoverLoginOptions): Promise<LoginTarget>;
+export interface AuthorizationCodeLoginOptions {
+    clientId?: string;
+    /** 동적 등록 client_name. 기본 mext */
+    clientName?: string;
+    /** loopback 포트. 기본 임의 */
+    port?: number;
+    signal?: AbortSignal;
+    timeoutMs?: number;
+    fetch?: Fetch;
+    /** 인가 URL 준비됨 (브라우저 열기 · 안내 출력) */
+    onAuthorizationUrl(url: string, loopback: {
+        redirectUri: string;
+        port: number;
+    }): void;
+    /**
+     * 붙여넣은 redirect URL 의 query (stdin). loopback callback 과 먼저 온 쪽을 쓰고, 다른 쪽은 signal 로 중단.
+     * undefined = 입력 끝 (loopback 만 대기)
+     */
+    readRedirect?(signal: AbortSignal): Promise<URLSearchParams | undefined>;
+}
+/** authorization code + PKCE. redirect = loopback callback 또는 붙여넣은 URL. 둘 다 state · iss 검증 */
+export declare function authorizationCodeLogin(target: LoginTarget, options: AuthorizationCodeLoginOptions): Promise<StoredCredentials>;
+/** 붙여넣은 redirect URL (또는 query 문자열) → query. code · error 가 없으면 undefined */
+export declare function parseRedirectUrl(text: string): URLSearchParams | undefined;
+export interface DeviceAuthorization {
+    verification_uri: string;
+    verification_uri_complete?: string;
+    user_code: string;
+    /** 초 */
+    expires_in: number;
+    /** polling 간격 (초). 기본 5 */
+    interval: number;
+}
+export interface DeviceLoginOptions {
+    clientId?: string;
+    /** 동적 등록 client_name. 기본 mext */
+    clientName?: string;
+    signal?: AbortSignal;
+    fetch?: Fetch;
+    /** polling 대기 (테스트 주입). 기본 setTimeout */
+    sleep?(ms: number, signal?: AbortSignal): Promise<void>;
+    /** 사용자 코드 준비됨 (안내 출력 · 브라우저 열기) */
+    onDeviceCode(device: DeviceAuthorization): void;
+}
+export declare function deviceLogin(target: LoginTarget, options: DeviceLoginOptions): Promise<StoredCredentials>;
+export interface RevokeResult {
+    /** 인가 서버에 revocation_endpoint 가 있음 */
+    supported: boolean;
+    /** 폐기 요청이 성공한 토큰 종류 (refresh_token → access_token 순서) */
+    revoked: ("refresh_token" | "access_token")[];
+    /** 실패 (메타데이터 조회 · 요청). 실패해도 저장분 삭제는 호출자가 진행 */
+    errors: string[];
+}
+/** 저장된 OAuth 토큰 폐기. refresh token 먼저 (RFC 7009 2.1: 연결된 access token 도 무효화될 수 있음), 그다음 access token */
+export declare function revokeCredentials(credentials: StoredCredentials, options?: {
+    fetch?: Fetch;
+}): Promise<RevokeResult>;
+/** 이전 API: 탐색 + authorization code (loopback) */
+export interface LoginOptions extends DiscoverLoginOptions, Omit<AuthorizationCodeLoginOptions, "fetch"> {
+}
+export declare function login(options: LoginOptions): Promise<StoredCredentials>;
+export {};