@office-ai/aioncli-core 0.2.3 → 0.18.4

package/dist/src/mcp/sa-impersonation-provider.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sa-impersonation-provider.test.js","sourceRoot":"","sources":["../../../src/mcp/sa-impersonation-provider.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC9D,OAAO,EAAE,mCAAmC,EAAE,MAAM,gCAAgC,CAAC;AAGrF,MAAM,WAAW,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AAC5B,MAAM,aAAa,GAAG,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;IACjC,OAAO,EAAE,WAAW;CACrB,CAAC,CAAC,CAAC;AAEJ,6DAA6D;AAC7D,EAAE,CAAC,IAAI,CAAC,qBAAqB,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IACtD,MAAM,MAAM,GAAG,MAAM,cAAc,EAAwC,CAAC;IAC5E,OAAO;QACL,GAAG,MAAM;QACT,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC,CAAC;YAC5C,SAAS,EAAE,aAAa;SACzB,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,MAAM,eAAe,GAAoB;IACvC,GAAG,EAAE,gCAAgC;IACrC,cAAc,EAAE,aAAa;IAC7B,oBAAoB,EAAE,OAAO;CAC9B,CAAC;AAEF,QAAQ,CAAC,qCAAqC,EAAE,GAAG,EAAE;IACnD,UAAU,CAAC,GAAG,EAAE;QACd,+BAA+B;QAC/B,EAAE,CAAC,aAAa,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,MAAM,GAAoB,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,mCAAmC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CACnE,kFAAkF,CACnF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,MAAM,GAAoB;YAC9B,GAAG,EAAE,gCAAgC;SACtC,CAAC;QACF,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,mCAAmC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CACnE,gFAAgF,CACjF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,MAAM,GAAoB;YAC9B,GAAG,EAAE,gCAAgC;YACrC,cAAc,EAAE,aAAa;SAC9B,CAAC;QACF,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,mCAAmC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CACnE,sFAAsF,CACvF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,SAAS,GAAG,mBAAmB,CAAC;QACtC,WAAW,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QAE9D,MAAM,QAAQ,GAAG,IAAI,mCAAmC,CAAC,eAAe,CAAC,CAAC;QAC1E,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC;QAEvC,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QAC7B,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,WAAW,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAEzD,MAAM,QAAQ,GAAG,IAAI,mCAAmC,CAAC,eAAe,CAAC,CAAC;QAC1E,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC;QAEvC,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,WAAW,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;QAEjE,MAAM,QAAQ,GAAG,IAAI,mCAAmC,CAAC,eAAe,CAAC,CAAC;QAC1E,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC;QAExB,MAAM,CAAC,WAAW,CAAC,CAAC,oBAAoB,CAAC;YACvC,GAAG,EAAE,2FAA2F;YAChG,MAAM,EAAE,MAAM;YACd,IAAI,EAAE;gBACJ,QAAQ,EAAE,aAAa;gBACvB,YAAY,EAAE,IAAI;aACnB;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,QAAQ,GAAG,IAAI,mCAAmC,CAAC,eAAe,CAAC,CAAC;QAC1E,EAAE,CAAC,aAAa,EAAE,CAAC;QAEnB,8CAA8C;QAC9C,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC;QAC9D,MAAM,GAAG,GAAG,UAAU,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC1F,WAAW,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAExD,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC5C,MAAM,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5C,MAAM,CAAC,WAAW,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAE7C,6BAA6B;QAC7B,EAAE,CAAC,mBAAmB,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;QAEpC,sBAAsB;QACtB,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC7C,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACvC,MAAM,CAAC,WAAW,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAE7C,EAAE,CAAC,aAAa,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,MAAM,QAAQ,GAAG,IAAI,mCAAmC,CAAC,eAAe,CAAC,CAAC;QAC1E,EAAE,CAAC,aAAa,EAAE,CAAC;QAEnB,iDAAiD;QACjD,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,UAAU,GAAG,UAAU,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;QAExG,WAAW,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;QAC/D,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC5C,MAAM,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACnD,MAAM,CAAC,WAAW,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAE7C,uCAAuC;QACvC,MAAM,UAAU,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC;QACjE,MAAM,MAAM,GAAG,UAAU,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;QAChG,WAAW,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAE3D,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAE7B,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC1C,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACrD,MAAM,CAAC,WAAW,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,uBAAuB;QAErE,EAAE,CAAC,aAAa,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/src/mcp/token-storage/base-token-storage.d.ts

@@ -0,0 +1,19 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { TokenStorage, OAuthCredentials } from './types.js';
+export declare abstract class BaseTokenStorage implements TokenStorage {
+    protected readonly serviceName: string;
+    constructor(serviceName: string);
+    abstract getCredentials(serverName: string): Promise<OAuthCredentials | null>;
+    abstract setCredentials(credentials: OAuthCredentials): Promise<void>;
+    abstract deleteCredentials(serverName: string): Promise<void>;
+    abstract listServers(): Promise<string[]>;
+    abstract getAllCredentials(): Promise<Map<string, OAuthCredentials>>;
+    abstract clearAll(): Promise<void>;
+    protected validateCredentials(credentials: OAuthCredentials): void;
+    protected isTokenExpired(credentials: OAuthCredentials): boolean;
+    protected sanitizeServerName(serverName: string): string;
+}

package/dist/src/mcp/token-storage/base-token-storage.js

@@ -0,0 +1,36 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export class BaseTokenStorage {
+    serviceName;
+    constructor(serviceName) {
+        this.serviceName = serviceName;
+    }
+    validateCredentials(credentials) {
+        if (!credentials.serverName) {
+            throw new Error('Server name is required');
+        }
+        if (!credentials.token) {
+            throw new Error('Token is required');
+        }
+        if (!credentials.token.accessToken) {
+            throw new Error('Access token is required');
+        }
+        if (!credentials.token.tokenType) {
+            throw new Error('Token type is required');
+        }
+    }
+    isTokenExpired(credentials) {
+        if (!credentials.token.expiresAt) {
+            return false;
+        }
+        const bufferMs = 5 * 60 * 1000;
+        return Date.now() > credentials.token.expiresAt - bufferMs;
+    }
+    sanitizeServerName(serverName) {
+        return serverName.replace(/[^a-zA-Z0-9-_.]/g, '_');
+    }
+}
+//# sourceMappingURL=base-token-storage.js.map

package/dist/src/mcp/token-storage/base-token-storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base-token-storage.js","sourceRoot":"","sources":["../../../../src/mcp/token-storage/base-token-storage.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,OAAgB,gBAAgB;IACjB,WAAW,CAAS;IAEvC,YAAY,WAAmB;QAC7B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;IASS,mBAAmB,CAAC,WAA6B;QACzD,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAES,cAAc,CAAC,WAA6B;QACpD,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YACjC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,QAAQ,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAC/B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,SAAS,GAAG,QAAQ,CAAC;IAC7D,CAAC;IAES,kBAAkB,CAAC,UAAkB;QAC7C,OAAO,UAAU,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;IACrD,CAAC;CACF"}

package/dist/src/mcp/token-storage/base-token-storage.test.d.ts

@@ -0,0 +1,6 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export {};

package/dist/src/mcp/token-storage/base-token-storage.test.js

@@ -0,0 +1,151 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { describe, it, expect, beforeEach } from 'vitest';
+import { BaseTokenStorage } from './base-token-storage.js';
+class TestTokenStorage extends BaseTokenStorage {
+    storage = new Map();
+    async getCredentials(serverName) {
+        return this.storage.get(serverName) || null;
+    }
+    async setCredentials(credentials) {
+        this.validateCredentials(credentials);
+        this.storage.set(credentials.serverName, credentials);
+    }
+    async deleteCredentials(serverName) {
+        this.storage.delete(serverName);
+    }
+    async listServers() {
+        return Array.from(this.storage.keys());
+    }
+    async getAllCredentials() {
+        return new Map(this.storage);
+    }
+    async clearAll() {
+        this.storage.clear();
+    }
+    validateCredentials(credentials) {
+        super.validateCredentials(credentials);
+    }
+    isTokenExpired(credentials) {
+        return super.isTokenExpired(credentials);
+    }
+    sanitizeServerName(serverName) {
+        return super.sanitizeServerName(serverName);
+    }
+}
+describe('BaseTokenStorage', () => {
+    let storage;
+    beforeEach(() => {
+        storage = new TestTokenStorage('gemini-cli-mcp-oauth');
+    });
+    describe('validateCredentials', () => {
+        it('should validate valid credentials', () => {
+            const credentials = {
+                serverName: 'test-server',
+                token: {
+                    accessToken: 'access-token',
+                    tokenType: 'Bearer',
+                },
+                updatedAt: Date.now(),
+            };
+            expect(() => storage.validateCredentials(credentials)).not.toThrow();
+        });
+        it.each([
+            {
+                desc: 'missing server name',
+                credentials: {
+                    serverName: '',
+                    token: {
+                        accessToken: 'access-token',
+                        tokenType: 'Bearer',
+                    },
+                    updatedAt: Date.now(),
+                },
+                expectedError: 'Server name is required',
+            },
+            {
+                desc: 'missing token',
+                credentials: {
+                    serverName: 'test-server',
+                    token: null,
+                    updatedAt: Date.now(),
+                },
+                expectedError: 'Token is required',
+            },
+            {
+                desc: 'missing access token',
+                credentials: {
+                    serverName: 'test-server',
+                    token: {
+                        accessToken: '',
+                        tokenType: 'Bearer',
+                    },
+                    updatedAt: Date.now(),
+                },
+                expectedError: 'Access token is required',
+            },
+            {
+                desc: 'missing token type',
+                credentials: {
+                    serverName: 'test-server',
+                    token: {
+                        accessToken: 'access-token',
+                        tokenType: '',
+                    },
+                    updatedAt: Date.now(),
+                },
+                expectedError: 'Token type is required',
+            },
+        ])('should throw for $desc', ({ credentials, expectedError }) => {
+            expect(() => storage.validateCredentials(credentials)).toThrow(expectedError);
+        });
+    });
+    describe('isTokenExpired', () => {
+        it.each([
+            ['tokens without expiry', undefined, false],
+            ['valid tokens', Date.now() + 3600000, false],
+            ['expired tokens', Date.now() - 3600000, true],
+            [
+                'tokens within 5-minute buffer (4 minutes from now)',
+                Date.now() + 4 * 60 * 1000,
+                true,
+            ],
+        ])('should return %s for %s', (_, expiresAt, expected) => {
+            const credentials = {
+                serverName: 'test-server',
+                token: {
+                    accessToken: 'access-token',
+                    tokenType: 'Bearer',
+                    ...(expiresAt !== undefined && { expiresAt }),
+                },
+                updatedAt: Date.now(),
+            };
+            expect(storage.isTokenExpired(credentials)).toBe(expected);
+        });
+    });
+    describe('sanitizeServerName', () => {
+        it.each([
+            [
+                'valid characters',
+                'test-server.example_123',
+                'test-server.example_123',
+            ],
+            [
+                'invalid characters with underscore replacement',
+                'test@server#example',
+                'test_server_example',
+            ],
+            [
+                'special characters',
+                'test server/example:123',
+                'test_server_example_123',
+            ],
+        ])('should handle %s', (_, input, expected) => {
+            expect(storage.sanitizeServerName(input)).toBe(expected);
+        });
+    });
+});
+//# sourceMappingURL=base-token-storage.test.js.map

package/dist/src/mcp/token-storage/base-token-storage.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base-token-storage.test.js","sourceRoot":"","sources":["../../../../src/mcp/token-storage/base-token-storage.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAG3D,MAAM,gBAAiB,SAAQ,gBAAgB;IACrC,OAAO,GAAG,IAAI,GAAG,EAA4B,CAAC;IAEtD,KAAK,CAAC,cAAc,CAAC,UAAkB;QACrC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,WAA6B;QAChD,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,UAAkB;QACxC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,WAAW;QACf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,iBAAiB;QACrB,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAEQ,mBAAmB,CAAC,WAA6B;QACxD,KAAK,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;IACzC,CAAC;IAEQ,cAAc,CAAC,WAA6B;QACnD,OAAO,KAAK,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;IAC3C,CAAC;IAEQ,kBAAkB,CAAC,UAAkB;QAC5C,OAAO,KAAK,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAC9C,CAAC;CACF;AAED,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,IAAI,OAAyB,CAAC;IAE9B,UAAU,CAAC,GAAG,EAAE;QACd,OAAO,GAAG,IAAI,gBAAgB,CAAC,sBAAsB,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;QACnC,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;YAC3C,MAAM,WAAW,GAAqB;gBACpC,UAAU,EAAE,aAAa;gBACzB,KAAK,EAAE;oBACL,WAAW,EAAE,cAAc;oBAC3B,SAAS,EAAE,QAAQ;iBACpB;gBACD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACtB,CAAC;YAEF,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACvE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,IAAI,CAAC;YACN;gBACE,IAAI,EAAE,qBAAqB;gBAC3B,WAAW,EAAE;oBACX,UAAU,EAAE,EAAE;oBACd,KAAK,EAAE;wBACL,WAAW,EAAE,cAAc;wBAC3B,SAAS,EAAE,QAAQ;qBACpB;oBACD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;iBACtB;gBACD,aAAa,EAAE,yBAAyB;aACzC;YACD;gBACE,IAAI,EAAE,eAAe;gBACrB,WAAW,EAAE;oBACX,UAAU,EAAE,aAAa;oBACzB,KAAK,EAAE,IAA6B;oBACpC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;iBACtB;gBACD,aAAa,EAAE,mBAAmB;aACnC;YACD;gBACE,IAAI,EAAE,sBAAsB;gBAC5B,WAAW,EAAE;oBACX,UAAU,EAAE,aAAa;oBACzB,KAAK,EAAE;wBACL,WAAW,EAAE,EAAE;wBACf,SAAS,EAAE,QAAQ;qBACpB;oBACD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;iBACtB;gBACD,aAAa,EAAE,0BAA0B;aAC1C;YACD;gBACE,IAAI,EAAE,oBAAoB;gBAC1B,WAAW,EAAE;oBACX,UAAU,EAAE,aAAa;oBACzB,KAAK,EAAE;wBACL,WAAW,EAAE,cAAc;wBAC3B,SAAS,EAAE,EAAE;qBACd;oBACD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;iBACtB;gBACD,aAAa,EAAE,wBAAwB;aACxC;SACF,CAAC,CAAC,wBAAwB,EAAE,CAAC,EAAE,WAAW,EAAE,aAAa,EAAE,EAAE,EAAE;YAC9D,MAAM,CAAC,GAAG,EAAE,CACV,OAAO,CAAC,mBAAmB,CAAC,WAA+B,CAAC,CAC7D,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;QAC9B,EAAE,CAAC,IAAI,CAAC;YACN,CAAC,uBAAuB,EAAE,SAAS,EAAE,KAAK,CAAC;YAC3C,CAAC,cAAc,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,KAAK,CAAC;YAC7C,CAAC,gBAAgB,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,IAAI,CAAC;YAC9C;gBACE,oDAAoD;gBACpD,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI;gBAC1B,IAAI;aACL;SACF,CAAC,CAAC,yBAAyB,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE;YACvD,MAAM,WAAW,GAAqB;gBACpC,UAAU,EAAE,aAAa;gBACzB,KAAK,EAAE;oBACL,WAAW,EAAE,cAAc;oBAC3B,SAAS,EAAE,QAAQ;oBACnB,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,CAAC;iBAC9C;gBACD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACtB,CAAC;YAEF,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7D,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;QAClC,EAAE,CAAC,IAAI,CAAC;YACN;gBACE,kBAAkB;gBAClB,yBAAyB;gBACzB,yBAAyB;aAC1B;YACD;gBACE,gDAAgD;gBAChD,qBAAqB;gBACrB,qBAAqB;aACtB;YACD;gBACE,oBAAoB;gBACpB,yBAAyB;gBACzB,yBAAyB;aAC1B;SACF,CAAC,CAAC,kBAAkB,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;YAC5C,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/src/mcp/token-storage/file-token-storage.d.ts

@@ -0,0 +1,24 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { BaseTokenStorage } from './base-token-storage.js';
+import type { OAuthCredentials } from './types.js';
+export declare class FileTokenStorage extends BaseTokenStorage {
+    private readonly tokenFilePath;
+    private readonly encryptionKey;
+    constructor(serviceName: string);
+    private deriveEncryptionKey;
+    private encrypt;
+    private decrypt;
+    private ensureDirectoryExists;
+    private loadTokens;
+    private saveTokens;
+    getCredentials(serverName: string): Promise<OAuthCredentials | null>;
+    setCredentials(credentials: OAuthCredentials): Promise<void>;
+    deleteCredentials(serverName: string): Promise<void>;
+    listServers(): Promise<string[]>;
+    getAllCredentials(): Promise<Map<string, OAuthCredentials>>;
+    clearAll(): Promise<void>;
+}

package/dist/src/mcp/token-storage/file-token-storage.js

@@ -0,0 +1,145 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { promises as fs } from 'node:fs';
+import * as path from 'node:path';
+import * as os from 'node:os';
+import * as crypto from 'node:crypto';
+import { BaseTokenStorage } from './base-token-storage.js';
+import { GEMINI_DIR } from '../../utils/paths.js';
+export class FileTokenStorage extends BaseTokenStorage {
+    tokenFilePath;
+    encryptionKey;
+    constructor(serviceName) {
+        super(serviceName);
+        const configDir = path.join(os.homedir(), GEMINI_DIR);
+        this.tokenFilePath = path.join(configDir, 'mcp-oauth-tokens-v2.json');
+        this.encryptionKey = this.deriveEncryptionKey();
+    }
+    deriveEncryptionKey() {
+        const salt = `${os.hostname()}-${os.userInfo().username}-gemini-cli`;
+        return crypto.scryptSync('gemini-cli-oauth', salt, 32);
+    }
+    encrypt(text) {
+        const iv = crypto.randomBytes(16);
+        const cipher = crypto.createCipheriv('aes-256-gcm', this.encryptionKey, iv);
+        let encrypted = cipher.update(text, 'utf8', 'hex');
+        encrypted += cipher.final('hex');
+        const authTag = cipher.getAuthTag();
+        return iv.toString('hex') + ':' + authTag.toString('hex') + ':' + encrypted;
+    }
+    decrypt(encryptedData) {
+        const parts = encryptedData.split(':');
+        if (parts.length !== 3) {
+            throw new Error('Invalid encrypted data format');
+        }
+        const iv = Buffer.from(parts[0], 'hex');
+        const authTag = Buffer.from(parts[1], 'hex');
+        const encrypted = parts[2];
+        const decipher = crypto.createDecipheriv('aes-256-gcm', this.encryptionKey, iv);
+        decipher.setAuthTag(authTag);
+        let decrypted = decipher.update(encrypted, 'hex', 'utf8');
+        decrypted += decipher.final('utf8');
+        return decrypted;
+    }
+    async ensureDirectoryExists() {
+        const dir = path.dirname(this.tokenFilePath);
+        await fs.mkdir(dir, { recursive: true, mode: 0o700 });
+    }
+    async loadTokens() {
+        try {
+            const data = await fs.readFile(this.tokenFilePath, 'utf-8');
+            const decrypted = this.decrypt(data);
+            const tokens = JSON.parse(decrypted);
+            return new Map(Object.entries(tokens));
+        }
+        catch (error) {
+            const err = error;
+            if (err.code === 'ENOENT') {
+                return new Map();
+            }
+            if (err.message?.includes('Invalid encrypted data format') ||
+                err.message?.includes('Unsupported state or unable to authenticate data')) {
+                throw new Error('Token file corrupted');
+            }
+            throw error;
+        }
+    }
+    async saveTokens(tokens) {
+        await this.ensureDirectoryExists();
+        const data = Object.fromEntries(tokens);
+        const json = JSON.stringify(data, null, 2);
+        const encrypted = this.encrypt(json);
+        await fs.writeFile(this.tokenFilePath, encrypted, { mode: 0o600 });
+    }
+    async getCredentials(serverName) {
+        const tokens = await this.loadTokens();
+        const credentials = tokens.get(serverName);
+        if (!credentials) {
+            return null;
+        }
+        if (this.isTokenExpired(credentials)) {
+            return null;
+        }
+        return credentials;
+    }
+    async setCredentials(credentials) {
+        this.validateCredentials(credentials);
+        const tokens = await this.loadTokens();
+        const updatedCredentials = {
+            ...credentials,
+            updatedAt: Date.now(),
+        };
+        tokens.set(credentials.serverName, updatedCredentials);
+        await this.saveTokens(tokens);
+    }
+    async deleteCredentials(serverName) {
+        const tokens = await this.loadTokens();
+        if (!tokens.has(serverName)) {
+            throw new Error(`No credentials found for ${serverName}`);
+        }
+        tokens.delete(serverName);
+        if (tokens.size === 0) {
+            try {
+                await fs.unlink(this.tokenFilePath);
+            }
+            catch (error) {
+                const err = error;
+                if (err.code !== 'ENOENT') {
+                    throw error;
+                }
+            }
+        }
+        else {
+            await this.saveTokens(tokens);
+        }
+    }
+    async listServers() {
+        const tokens = await this.loadTokens();
+        return Array.from(tokens.keys());
+    }
+    async getAllCredentials() {
+        const tokens = await this.loadTokens();
+        const result = new Map();
+        for (const [serverName, credentials] of tokens) {
+            if (!this.isTokenExpired(credentials)) {
+                result.set(serverName, credentials);
+            }
+        }
+        return result;
+    }
+    async clearAll() {
+        try {
+            await fs.unlink(this.tokenFilePath);
+        }
+        catch (error) {
+            const err = error;
+            if (err.code !== 'ENOENT') {
+                throw error;
+            }
+        }
+    }
+}
+//# sourceMappingURL=file-token-storage.js.map

package/dist/src/mcp/token-storage/file-token-storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-token-storage.js","sourceRoot":"","sources":["../../../../src/mcp/token-storage/file-token-storage.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAElD,MAAM,OAAO,gBAAiB,SAAQ,gBAAgB;IACnC,aAAa,CAAS;IACtB,aAAa,CAAS;IAEvC,YAAY,WAAmB;QAC7B,KAAK,CAAC,WAAW,CAAC,CAAC;QACnB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,CAAC;QACtD,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,0BAA0B,CAAC,CAAC;QACtE,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;IAClD,CAAC;IAEO,mBAAmB;QACzB,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,aAAa,CAAC;QACrE,OAAO,MAAM,CAAC,UAAU,CAAC,kBAAkB,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACzD,CAAC;IAEO,OAAO,CAAC,IAAY;QAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QAE5E,IAAI,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QACnD,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEjC,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAEpC,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,SAAS,CAAC;IAC9E,CAAC;IAEO,OAAO,CAAC,aAAqB;QACnC,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAE3B,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CACtC,aAAa,EACb,IAAI,CAAC,aAAa,EAClB,EAAE,CACH,CAAC;QACF,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAE7B,IAAI,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1D,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,KAAK,CAAC,qBAAqB;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC7C,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxD,CAAC;IAEO,KAAK,CAAC,UAAU;QACtB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;YAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACrC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAqC,CAAC;YACzE,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,KAAqD,CAAC;YAClE,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1B,OAAO,IAAI,GAAG,EAAE,CAAC;YACnB,CAAC;YACD,IACE,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,+BAA+B,CAAC;gBACtD,GAAG,CAAC,OAAO,EAAE,QAAQ,CACnB,kDAAkD,CACnD,EACD,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAC1C,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,MAAqC;QAErC,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAEnC,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAErC,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,UAAkB;QACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAE3C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,WAA6B;QAChD,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAEtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,MAAM,kBAAkB,GAAqB;YAC3C,GAAG,WAAW;YACd,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QAEF,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;QACvD,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,UAAkB;QACxC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QAEvC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,4BAA4B,UAAU,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAE1B,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YACtC,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACxB,MAAM,GAAG,GAAG,KAA8B,CAAC;gBAC3C,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC1B,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,iBAAiB;QACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,IAAI,GAAG,EAA4B,CAAC;QAEnD,KAAK,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,IAAI,MAAM,EAAE,CAAC;YAC/C,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;gBACtC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,KAA8B,CAAC;YAC3C,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1B,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/src/mcp/token-storage/file-token-storage.test.d.ts

@@ -0,0 +1,6 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export {};

package/dist/src/mcp/token-storage/file-token-storage.test.js

@@ -0,0 +1,238 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { promises as fs } from 'node:fs';
+import * as path from 'node:path';
+import { FileTokenStorage } from './file-token-storage.js';
+import { GEMINI_DIR } from '../../utils/paths.js';
+vi.mock('node:fs', () => ({
+    promises: {
+        readFile: vi.fn(),
+        writeFile: vi.fn(),
+        unlink: vi.fn(),
+        mkdir: vi.fn(),
+    },
+}));
+vi.mock('node:os', () => ({
+    default: {
+        homedir: vi.fn(() => '/home/test'),
+        hostname: vi.fn(() => 'test-host'),
+        userInfo: vi.fn(() => ({ username: 'test-user' })),
+    },
+    homedir: vi.fn(() => '/home/test'),
+    hostname: vi.fn(() => 'test-host'),
+    userInfo: vi.fn(() => ({ username: 'test-user' })),
+}));
+describe('FileTokenStorage', () => {
+    let storage;
+    const mockFs = fs;
+    const existingCredentials = {
+        serverName: 'existing-server',
+        token: {
+            accessToken: 'existing-token',
+            tokenType: 'Bearer',
+        },
+        updatedAt: Date.now() - 10000,
+    };
+    beforeEach(() => {
+        vi.clearAllMocks();
+        storage = new FileTokenStorage('test-storage');
+    });
+    afterEach(() => {
+        vi.clearAllMocks();
+    });
+    describe('getCredentials', () => {
+        it('should return null when file does not exist', async () => {
+            mockFs.readFile.mockRejectedValue({ code: 'ENOENT' });
+            const result = await storage.getCredentials('test-server');
+            expect(result).toBeNull();
+        });
+        it('should return null for expired tokens', async () => {
+            const credentials = {
+                serverName: 'test-server',
+                token: {
+                    accessToken: 'access-token',
+                    tokenType: 'Bearer',
+                    expiresAt: Date.now() - 3600000,
+                },
+                updatedAt: Date.now(),
+            };
+            const encryptedData = storage['encrypt'](JSON.stringify({ 'test-server': credentials }));
+            mockFs.readFile.mockResolvedValue(encryptedData);
+            const result = await storage.getCredentials('test-server');
+            expect(result).toBeNull();
+        });
+        it('should return credentials for valid tokens', async () => {
+            const credentials = {
+                serverName: 'test-server',
+                token: {
+                    accessToken: 'access-token',
+                    tokenType: 'Bearer',
+                    expiresAt: Date.now() + 3600000,
+                },
+                updatedAt: Date.now(),
+            };
+            const encryptedData = storage['encrypt'](JSON.stringify({ 'test-server': credentials }));
+            mockFs.readFile.mockResolvedValue(encryptedData);
+            const result = await storage.getCredentials('test-server');
+            expect(result).toEqual(credentials);
+        });
+        it('should throw error for corrupted files', async () => {
+            mockFs.readFile.mockResolvedValue('corrupted-data');
+            await expect(storage.getCredentials('test-server')).rejects.toThrow('Token file corrupted');
+        });
+    });
+    describe('setCredentials', () => {
+        it('should save credentials with encryption', async () => {
+            const encryptedData = storage['encrypt'](JSON.stringify({ 'existing-server': existingCredentials }));
+            mockFs.readFile.mockResolvedValue(encryptedData);
+            mockFs.mkdir.mockResolvedValue(undefined);
+            mockFs.writeFile.mockResolvedValue(undefined);
+            const credentials = {
+                serverName: 'test-server',
+                token: {
+                    accessToken: 'access-token',
+                    tokenType: 'Bearer',
+                },
+                updatedAt: Date.now(),
+            };
+            await storage.setCredentials(credentials);
+            expect(mockFs.mkdir).toHaveBeenCalledWith(path.join('/home/test', GEMINI_DIR), { recursive: true, mode: 0o700 });
+            expect(mockFs.writeFile).toHaveBeenCalled();
+            const writeCall = mockFs.writeFile.mock.calls[0];
+            expect(writeCall[1]).toMatch(/^[0-9a-f]+:[0-9a-f]+:[0-9a-f]+$/);
+            expect(writeCall[2]).toEqual({ mode: 0o600 });
+        });
+        it('should update existing credentials', async () => {
+            const encryptedData = storage['encrypt'](JSON.stringify({ 'existing-server': existingCredentials }));
+            mockFs.readFile.mockResolvedValue(encryptedData);
+            mockFs.writeFile.mockResolvedValue(undefined);
+            const newCredentials = {
+                serverName: 'test-server',
+                token: {
+                    accessToken: 'new-token',
+                    tokenType: 'Bearer',
+                },
+                updatedAt: Date.now(),
+            };
+            await storage.setCredentials(newCredentials);
+            expect(mockFs.writeFile).toHaveBeenCalled();
+            const writeCall = mockFs.writeFile.mock.calls[0];
+            const decrypted = storage['decrypt'](writeCall[1]);
+            const saved = JSON.parse(decrypted);
+            expect(saved['existing-server']).toEqual(existingCredentials);
+            expect(saved['test-server'].token.accessToken).toBe('new-token');
+        });
+    });
+    describe('deleteCredentials', () => {
+        it('should throw when credentials do not exist', async () => {
+            mockFs.readFile.mockRejectedValue({ code: 'ENOENT' });
+            await expect(storage.deleteCredentials('test-server')).rejects.toThrow('No credentials found for test-server');
+        });
+        it('should delete file when last credential is removed', async () => {
+            const credentials = {
+                serverName: 'test-server',
+                token: {
+                    accessToken: 'access-token',
+                    tokenType: 'Bearer',
+                },
+                updatedAt: Date.now(),
+            };
+            const encryptedData = storage['encrypt'](JSON.stringify({ 'test-server': credentials }));
+            mockFs.readFile.mockResolvedValue(encryptedData);
+            mockFs.unlink.mockResolvedValue(undefined);
+            await storage.deleteCredentials('test-server');
+            expect(mockFs.unlink).toHaveBeenCalledWith(path.join('/home/test', GEMINI_DIR, 'mcp-oauth-tokens-v2.json'));
+        });
+        it('should update file when other credentials remain', async () => {
+            const credentials1 = {
+                serverName: 'server1',
+                token: {
+                    accessToken: 'token1',
+                    tokenType: 'Bearer',
+                },
+                updatedAt: Date.now(),
+            };
+            const credentials2 = {
+                serverName: 'server2',
+                token: {
+                    accessToken: 'token2',
+                    tokenType: 'Bearer',
+                },
+                updatedAt: Date.now(),
+            };
+            const encryptedData = storage['encrypt'](JSON.stringify({ server1: credentials1, server2: credentials2 }));
+            mockFs.readFile.mockResolvedValue(encryptedData);
+            mockFs.writeFile.mockResolvedValue(undefined);
+            await storage.deleteCredentials('server1');
+            expect(mockFs.writeFile).toHaveBeenCalled();
+            expect(mockFs.unlink).not.toHaveBeenCalled();
+            const writeCall = mockFs.writeFile.mock.calls[0];
+            const decrypted = storage['decrypt'](writeCall[1]);
+            const saved = JSON.parse(decrypted);
+            expect(saved['server1']).toBeUndefined();
+            expect(saved['server2']).toEqual(credentials2);
+        });
+    });
+    describe('listServers', () => {
+        it('should return empty list when file does not exist', async () => {
+            mockFs.readFile.mockRejectedValue({ code: 'ENOENT' });
+            const result = await storage.listServers();
+            expect(result).toEqual([]);
+        });
+        it('should return list of server names', async () => {
+            const credentials = {
+                server1: {
+                    serverName: 'server1',
+                    token: { accessToken: 'token1', tokenType: 'Bearer' },
+                    updatedAt: Date.now(),
+                },
+                server2: {
+                    serverName: 'server2',
+                    token: { accessToken: 'token2', tokenType: 'Bearer' },
+                    updatedAt: Date.now(),
+                },
+            };
+            const encryptedData = storage['encrypt'](JSON.stringify(credentials));
+            mockFs.readFile.mockResolvedValue(encryptedData);
+            const result = await storage.listServers();
+            expect(result).toEqual(['server1', 'server2']);
+        });
+    });
+    describe('clearAll', () => {
+        it('should delete the token file', async () => {
+            mockFs.unlink.mockResolvedValue(undefined);
+            await storage.clearAll();
+            expect(mockFs.unlink).toHaveBeenCalledWith(path.join('/home/test', GEMINI_DIR, 'mcp-oauth-tokens-v2.json'));
+        });
+        it('should not throw when file does not exist', async () => {
+            mockFs.unlink.mockRejectedValue({ code: 'ENOENT' });
+            await expect(storage.clearAll()).resolves.not.toThrow();
+        });
+    });
+    describe('encryption', () => {
+        it('should encrypt and decrypt data correctly', () => {
+            const original = 'test-data-123';
+            const encrypted = storage['encrypt'](original);
+            const decrypted = storage['decrypt'](encrypted);
+            expect(decrypted).toBe(original);
+            expect(encrypted).not.toBe(original);
+            expect(encrypted).toMatch(/^[0-9a-f]+:[0-9a-f]+:[0-9a-f]+$/);
+        });
+        it('should produce different encrypted output each time', () => {
+            const original = 'test-data';
+            const encrypted1 = storage['encrypt'](original);
+            const encrypted2 = storage['encrypt'](original);
+            expect(encrypted1).not.toBe(encrypted2);
+            expect(storage['decrypt'](encrypted1)).toBe(original);
+            expect(storage['decrypt'](encrypted2)).toBe(original);
+        });
+        it('should throw on invalid encrypted data format', () => {
+            expect(() => storage['decrypt']('invalid-data')).toThrow('Invalid encrypted data format');
+        });
+    });
+});
+//# sourceMappingURL=file-token-storage.test.js.map