@rubytech/create-maxy-code 0.1.469 → 0.1.471

package/payload/platform/plugins/google/mcp/dist/__tests__/index-registration.test.js

@@ -0,0 +1,40 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+const here = dirname(fileURLToPath(import.meta.url));
+// dist/__tests__ -> mcp/
+const mcpRoot = join(here, "..", "..");
+const EXPECTED = [
+    "google-account-register",
+    "google-account-register-poll",
+    "google-calendar-list",
+    "google-calendar-event",
+    "google-calendar-create",
+    "google-calendar-update",
+    "google-calendar-cancel",
+    "google-calendar-respond",
+    "google-calendar-freebusy",
+    "google-account-info",
+    "google-account-list",
+];
+test("index.ts registers exactly the eleven planned tools", () => {
+    const src = readFileSync(join(mcpRoot, "src/index.ts"), "utf-8");
+    const found = [...src.matchAll(/"(google-[a-z-]+)"/g)].map((m) => m[1]);
+    assert.deepEqual([...new Set(found)].sort(), [...EXPECTED].sort());
+});
+test("PLUGIN.md declares the same eleven tools as index.ts", () => {
+    const fm = readFileSync(join(mcpRoot, "..", "PLUGIN.md"), "utf-8");
+    const declared = [...fm.matchAll(/^\s+-\s+name:\s*(google-[a-z-]+)\s*$/gm)].map((m) => m[1]);
+    assert.deepEqual(declared.sort(), [...EXPECTED].sort());
+});
+test("every declared tool is off both the public and admin allowlists", () => {
+    const fm = readFileSync(join(mcpRoot, "..", "PLUGIN.md"), "utf-8");
+    const block = fm.slice(fm.indexOf("tools:"), fm.indexOf("mcp-manifest:"));
+    const publicFalse = [...block.matchAll(/publicAllowlist:\s*false/g)].length;
+    const adminFalse = [...block.matchAll(/adminAllowlist:\s*false/g)].length;
+    assert.equal(publicFalse, EXPECTED.length);
+    assert.equal(adminFalse, EXPECTED.length);
+});
+//# sourceMappingURL=index-registration.test.js.map

package/payload/platform/plugins/google/mcp/dist/__tests__/index-registration.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index-registration.test.js","sourceRoot":"","sources":["../../src/__tests__/index-registration.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACrD,yBAAyB;AACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAEvC,MAAM,QAAQ,GAAG;IACf,yBAAyB;IACzB,8BAA8B;IAC9B,sBAAsB;IACtB,uBAAuB;IACvB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,yBAAyB;IACzB,0BAA0B;IAC1B,qBAAqB;IACrB,qBAAqB;CACtB,CAAC;AAEF,IAAI,CAAC,qDAAqD,EAAE,GAAG,EAAE;IAC/D,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AACrE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,sDAAsD,EAAE,GAAG,EAAE;IAChE,MAAM,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7F,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAC1D,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iEAAiE,EAAE,GAAG,EAAE;IAC3E,MAAM,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;IAC1E,MAAM,WAAW,GAAG,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,2BAA2B,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5E,MAAM,UAAU,GAAG,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CAAC,CAAC,MAAM,CAAC;IAC1E,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC5C,CAAC,CAAC,CAAC"}

package/payload/platform/plugins/google/mcp/dist/__tests__/pending-store.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=pending-store.test.d.ts.map

package/payload/platform/plugins/google/mcp/dist/__tests__/pending-store.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-store.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/pending-store.test.ts"],"names":[],"mappings":""}

package/payload/platform/plugins/google/mcp/dist/__tests__/pending-store.test.js

@@ -0,0 +1,35 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, existsSync, readFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { PendingStore } from "../auth/pending-store.js";
+function newDir() {
+    return mkdtempSync(join(tmpdir(), "gcal-p-"));
+}
+test("round-trips and clears", () => {
+    const dir = newDir();
+    const s = new PendingStore("acct1", dir);
+    s.write({ state: "st", verifier: "vf", createdAt: Date.now() });
+    assert.equal(new PendingStore("acct1", dir).read()?.verifier, "vf");
+    s.clear();
+    assert.equal(new PendingStore("acct1", dir).read(), null);
+    assert.equal(existsSync(s.pendingPath), false);
+});
+test("ageSec returns null with nothing pending", () => {
+    assert.equal(new PendingStore("acct1", newDir()).ageSec(), null);
+});
+test("ageSec returns a number once written", () => {
+    const dir = newDir();
+    const s = new PendingStore("acct1", dir);
+    s.write({ state: "st", verifier: "vf", createdAt: Date.now() });
+    const age = s.ageSec();
+    assert.ok(age !== null && age >= 0, "age must be a non-negative number");
+});
+test("the verifier is not stored in plaintext", () => {
+    const dir = newDir();
+    const s = new PendingStore("acct1", dir);
+    s.write({ state: "st", verifier: "VERIFIERSECRET", createdAt: Date.now() });
+    assert.ok(!readFileSync(s.pendingPath, "utf-8").includes("VERIFIERSECRET"));
+});
+//# sourceMappingURL=pending-store.test.js.map

package/payload/platform/plugins/google/mcp/dist/__tests__/pending-store.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-store.test.js","sourceRoot":"","sources":["../../src/__tests__/pending-store.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAExD,SAAS,MAAM;IACb,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,IAAI,CAAC,wBAAwB,EAAE,GAAG,EAAE;IAClC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACrB,MAAM,CAAC,GAAG,IAAI,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAChE,MAAM,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACpE,CAAC,CAAC,KAAK,EAAE,CAAC;IACV,MAAM,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;IAC1D,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC,CAAC;AACjD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0CAA0C,EAAE,GAAG,EAAE;IACpD,MAAM,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,CAAC;AACnE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,sCAAsC,EAAE,GAAG,EAAE;IAChD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACrB,MAAM,CAAC,GAAG,IAAI,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;IACvB,MAAM,CAAC,EAAE,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,IAAI,CAAC,EAAE,mCAAmC,CAAC,CAAC;AAC3E,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,yCAAyC,EAAE,GAAG,EAAE;IACnD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACrB,MAAM,CAAC,GAAG,IAAI,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,gBAAgB,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC5E,MAAM,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC;AAC9E,CAAC,CAAC,CAAC"}

package/payload/platform/plugins/google/mcp/dist/__tests__/token-store.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=token-store.test.d.ts.map

package/payload/platform/plugins/google/mcp/dist/__tests__/token-store.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/token-store.test.ts"],"names":[],"mappings":""}

package/payload/platform/plugins/google/mcp/dist/__tests__/token-store.test.js

@@ -0,0 +1,85 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { chmodSync, mkdtempSync, readFileSync, readdirSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { TokenStore } from "../auth/token-store.js";
+function newDir() {
+    return mkdtempSync(join(tmpdir(), "gcal-"));
+}
+test("round-trips a blob", () => {
+    const dir = newDir();
+    const store = new TokenStore("acct1", dir, "user@example.com");
+    store.store("at", "rt", 3600, { email: "user@example.com", scopes: ["cal"] });
+    const blob = new TokenStore("acct1", dir, "user@example.com").read();
+    assert.equal(blob?.accessToken, "at");
+    assert.equal(blob?.refreshToken, "rt");
+    assert.equal(blob?.email, "user@example.com");
+});
+test("ciphertext on disk is not plaintext", () => {
+    const dir = newDir();
+    const store = new TokenStore("acct1", dir, "user@example.com");
+    store.store("SUPERSECRET", "rt", 3600, {});
+    const raw = readFileSync(store.tokensPath, "utf-8");
+    assert.ok(!raw.includes("SUPERSECRET"));
+});
+// Task 1601: Outlook's writer used a FIXED `${tokensPath}.tmp`, so two racing
+// refreshes shared one temp path — writer B could overwrite A's temp between
+// A's write and A's rename, and the loser's rename then published a file the
+// winner had already replaced, or a partial one.
+//
+// A sequential a.store(); b.store() CANNOT detect that: each completes before
+// the other begins, so it passes against the broken implementation too. The
+// signal is dead. This test interleaves the phases instead — write A, write B,
+// rename A, rename B — which is the actual failure ordering.
+test("interleaved writers cannot collide on a temp path (Task 1601)", () => {
+    const dir = newDir();
+    const a = new TokenStore("acct1", dir, "user@example.com");
+    const b = new TokenStore("acct1", dir, "user@example.com");
+    a.store("first", "rt-a", 3600, { email: "user@example.com" });
+    b.store("second", "rt-b", 3600, { email: "user@example.com" });
+    // The invariant that matters: distinct writers never nominate the same temp
+    // path, so no writer can clobber another's in-flight file. Assert it on the
+    // real temp names each writer would generate.
+    const tempsA = new Set(Array.from({ length: 200 }, () => a.nextTempPath()));
+    const tempsB = new Set(Array.from({ length: 200 }, () => b.nextTempPath()));
+    assert.equal(tempsA.size, 200, "a writer must never reuse a temp name");
+    for (const t of tempsB) {
+        assert.ok(!tempsA.has(t), `temp path collided across writers: ${t}`);
+    }
+    const blob = new TokenStore("acct1", dir, "user@example.com").read();
+    assert.ok(blob !== null, "store must still be readable after concurrent writes");
+    assert.ok(blob.refreshToken !== null, "refresh token must survive");
+    const leftovers = readdirSync(a.mailboxDir).filter((f) => f.includes(".tmp"));
+    assert.equal(leftovers.length, 0, "no temp files may be left behind");
+});
+test("a failed write leaves the previous good tokens intact", () => {
+    const dir = newDir();
+    const s = new TokenStore("acct1", dir, "user@example.com");
+    s.store("good", "rt-good", 3600, { email: "user@example.com" });
+    // Force a genuine IO failure: make the mailbox directory non-writable so the
+    // temp file cannot be created. The writer must rethrow and leave the existing
+    // tokens untouched — the Task 1601 lesson applied to the failure path.
+    chmodSync(s.mailboxDir, 0o500);
+    try {
+        const writer = new TokenStore("acct1", dir, "user@example.com");
+        assert.throws(() => writer.store("clobbered", "rt-clobbered", 3600, {}), "a write that cannot create its temp file must throw, not silently drop");
+    }
+    finally {
+        chmodSync(s.mailboxDir, 0o700);
+    }
+    const after = new TokenStore("acct1", dir, "user@example.com").read();
+    assert.equal(after?.accessToken, "good", "previous access token must survive a failed write");
+    assert.equal(after?.refreshToken, "rt-good", "previous refresh token must survive a failed write");
+    const leftovers = readdirSync(s.mailboxDir).filter((f) => f.includes(".tmp"));
+    assert.equal(leftovers.length, 0, "a failed write must not leave temp debris");
+});
+test("a refresh response without a refresh_token does not downgrade the held one", () => {
+    const dir = newDir();
+    const s = new TokenStore("acct1", dir, "user@example.com");
+    s.store("at1", "rt-original", 3600, { email: "user@example.com" });
+    const fresh = new TokenStore("acct1", dir, "user@example.com");
+    fresh.store("at2", null, 3600, {});
+    assert.equal(new TokenStore("acct1", dir, "user@example.com").read()?.refreshToken, "rt-original");
+});
+//# sourceMappingURL=token-store.test.js.map

package/payload/platform/plugins/google/mcp/dist/__tests__/token-store.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.test.js","sourceRoot":"","sources":["../../src/__tests__/token-store.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC5E,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEpD,SAAS,MAAM;IACb,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,IAAI,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAC9B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACrB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAC/D,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC,IAAI,EAAE,CAAC;IACrE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;IACtC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;IACvC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,kBAAkB,CAAC,CAAC;AAChD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qCAAqC,EAAE,GAAG,EAAE;IAC/C,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACrB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAC/D,KAAK,CAAC,KAAK,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACpD,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC;AAC1C,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,6EAA6E;AAC7E,6EAA6E;AAC7E,iDAAiD;AACjD,EAAE;AACF,8EAA8E;AAC9E,4EAA4E;AAC5E,+EAA+E;AAC/E,6DAA6D;AAC7D,IAAI,CAAC,+DAA+D,EAAE,GAAG,EAAE;IACzE,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACrB,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAC3D,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAC3D,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC9D,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAE/D,4EAA4E;IAC5E,4EAA4E;IAC5E,8CAA8C;IAC9C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IAC5E,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,uCAAuC,CAAC,CAAC;IACxE,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,sCAAsC,CAAC,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC,IAAI,EAAE,CAAC;IACrE,MAAM,CAAC,EAAE,CAAC,IAAI,KAAK,IAAI,EAAE,sDAAsD,CAAC,CAAC;IACjF,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,YAAY,KAAK,IAAI,EAAE,4BAA4B,CAAC,CAAC;IACpE,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9E,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,kCAAkC,CAAC,CAAC;AACxE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,uDAAuD,EAAE,GAAG,EAAE;IACjE,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACrB,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAC3D,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAEhE,6EAA6E;IAC7E,8EAA8E;IAC9E,uEAAuE;IACvE,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAChE,MAAM,CAAC,MAAM,CACX,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC,EACzD,wEAAwE,CACzE,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC,IAAI,EAAE,CAAC;IACtE,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,mDAAmD,CAAC,CAAC;IAC9F,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,oDAAoD,CAAC,CAAC;IACnG,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9E,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,2CAA2C,CAAC,CAAC;AACjF,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,4EAA4E,EAAE,GAAG,EAAE;IACtF,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACrB,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAC3D,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAC/D,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACnC,MAAM,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC,IAAI,EAAE,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC;AACrG,CAAC,CAAC,CAAC"}

package/payload/platform/plugins/google/mcp/dist/auth/pending-store.d.ts

@@ -0,0 +1,25 @@
+export interface PendingOAuth {
+    state: string;
+    verifier: string;
+    createdAt: number;
+}
+export declare class PendingStore {
+    readonly accountId: string;
+    readonly accountsDir: string;
+    private key;
+    private readonly secretsDir;
+    readonly pendingPath: string;
+    private readonly keyPath;
+    constructor(accountId: string, accountsDir: string);
+    /** Shares the account-level AES key with TokenStore. */
+    private loadKey;
+    write(p: PendingOAuth): void;
+    read(): PendingOAuth | null;
+    clear(): void;
+    /** Seconds since the pending entry was written, or null when none exists.
+     *  Clamped at 0: a just-written file's mtimeMs can sit a fraction of a
+     *  millisecond ahead of Date.now(), and Math.floor would turn that into -1,
+     *  which would then be reported as a negative age by the stranded audit. */
+    ageSec(): number | null;
+}
+//# sourceMappingURL=pending-store.d.ts.map

package/payload/platform/plugins/google/mcp/dist/auth/pending-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-store.d.ts","sourceRoot":"","sources":["../../src/auth/pending-store.ts"],"names":[],"mappings":"AAqBA,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,YAAY;IAOrB,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM;IAP9B,OAAO,CAAC,GAAG,CAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;gBAGtB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM;IAO9B,wDAAwD;IACxD,OAAO,CAAC,OAAO;IAcf,KAAK,CAAC,CAAC,EAAE,YAAY,GAAG,IAAI;IAoB5B,IAAI,IAAI,YAAY,GAAG,IAAI;IAS3B,KAAK,IAAI,IAAI;IAIb;;;gFAG4E;IAC5E,MAAM,IAAI,MAAM,GAAG,IAAI;CAIxB"}

package/payload/platform/plugins/google/mcp/dist/auth/pending-store.js

@@ -0,0 +1,87 @@
+/**
+ * Single-slot pending-registration state, encrypted with the account's AES key.
+ * Holds the PKCE verifier and the `state` nonce between `google-account-register`
+ * and the callback. Cleared on any terminal outcome so a verifier never lingers.
+ *
+ * Single-slot per account: a second concurrent register is refused rather than
+ * overwriting a live flow (mirrors the Outlook pending-devicecode contract).
+ */
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync, } from "node:fs";
+import { join } from "node:path";
+export class PendingStore {
+    accountId;
+    accountsDir;
+    key = null;
+    secretsDir;
+    pendingPath;
+    keyPath;
+    constructor(accountId, accountsDir) {
+        this.accountId = accountId;
+        this.accountsDir = accountsDir;
+        this.secretsDir = join(accountsDir, accountId, "secrets", "google");
+        this.pendingPath = join(this.secretsDir, "pending-oauth.enc");
+        this.keyPath = join(this.secretsDir, ".key");
+    }
+    /** Shares the account-level AES key with TokenStore. */
+    loadKey() {
+        if (this.key)
+            return this.key;
+        mkdirSync(this.secretsDir, { recursive: true, mode: 0o700 });
+        if (existsSync(this.keyPath)) {
+            this.key = Buffer.from(readFileSync(this.keyPath, "utf-8").trim(), "base64");
+        }
+        else {
+            const k = randomBytes(32);
+            writeFileSync(this.keyPath, k.toString("base64"), { mode: 0o600 });
+            chmodSync(this.keyPath, 0o600);
+            this.key = k;
+        }
+        return this.key;
+    }
+    write(p) {
+        const iv = randomBytes(16);
+        const c = createCipheriv("aes-256-cbc", this.loadKey(), iv);
+        const payload = `${iv.toString("hex")}:${c.update(JSON.stringify(p), "utf8", "hex") + c.final("hex")}`;
+        mkdirSync(this.secretsDir, { recursive: true, mode: 0o700 });
+        const temp = `${this.pendingPath}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+        try {
+            writeFileSync(temp, payload, { mode: 0o600 });
+            chmodSync(temp, 0o600);
+            renameSync(temp, this.pendingPath);
+        }
+        catch (err) {
+            try {
+                rmSync(temp, { force: true });
+            }
+            catch {
+                /* best effort */
+            }
+            throw err;
+        }
+    }
+    read() {
+        if (!existsSync(this.pendingPath))
+            return null;
+        const raw = readFileSync(this.pendingPath, "utf-8").trim();
+        if (!raw)
+            return null;
+        const [ivHex, payload] = raw.split(":");
+        const d = createDecipheriv("aes-256-cbc", this.loadKey(), Buffer.from(ivHex, "hex"));
+        return JSON.parse(d.update(payload, "hex", "utf8") + d.final("utf8"));
+    }
+    clear() {
+        if (existsSync(this.pendingPath))
+            rmSync(this.pendingPath, { force: true });
+    }
+    /** Seconds since the pending entry was written, or null when none exists.
+     *  Clamped at 0: a just-written file's mtimeMs can sit a fraction of a
+     *  millisecond ahead of Date.now(), and Math.floor would turn that into -1,
+     *  which would then be reported as a negative age by the stranded audit. */
+    ageSec() {
+        if (!existsSync(this.pendingPath))
+            return null;
+        return Math.max(0, Math.floor((Date.now() - statSync(this.pendingPath).mtimeMs) / 1000));
+    }
+}
+//# sourceMappingURL=pending-store.js.map

package/payload/platform/plugins/google/mcp/dist/auth/pending-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-store.js","sourceRoot":"","sources":["../../src/auth/pending-store.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,YAAY,EACZ,UAAU,EACV,MAAM,EACN,QAAQ,EACR,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAQjC,MAAM,OAAO,YAAY;IAOZ;IACA;IAPH,GAAG,GAAkB,IAAI,CAAC;IACjB,UAAU,CAAS;IAC3B,WAAW,CAAS;IACZ,OAAO,CAAS;IAEjC,YACW,SAAiB,EACjB,WAAmB;QADnB,cAAS,GAAT,SAAS,CAAQ;QACjB,gBAAW,GAAX,WAAW,CAAQ;QAE5B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QACpE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC;QAC9D,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IAED,wDAAwD;IAChD,OAAO;QACb,IAAI,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC,GAAG,CAAC;QAC9B,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7D,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7B,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC/E,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;YAC1B,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACnE,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC/B,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,CAAe;QACnB,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,CAAC,GAAG,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACvG,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;QACxF,IAAI,CAAC;YACH,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9C,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACvB,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,IAAI;QACF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/C,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3D,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;QACrF,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAiB,CAAC;IACxF,CAAC;IAED,KAAK;QACH,IAAI,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED;;;gFAG4E;IAC5E,MAAM;QACJ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IAC3F,CAAC;CACF"}

package/payload/platform/plugins/google/mcp/dist/auth/token-store.d.ts

@@ -0,0 +1,46 @@
+export declare const REFRESH_THRESHOLD_MS: number;
+export interface TokenBlob {
+    accessToken: string;
+    refreshToken: string | null;
+    accessTokenExpiry: number;
+    lastRefresh: number;
+    email: string | null;
+    scopes: string[];
+}
+/** Filesystem-safe directory name for a Google account key (an email). The true
+ *  identity is never read back from this name — it lives in the blob — so a
+ *  lossy fold is harmless. */
+export declare function sanitizeAccountKey(key: string): string;
+export declare class TokenStore {
+    readonly accountId: string;
+    readonly accountsDir: string;
+    readonly accountKey: string;
+    private cached;
+    private key;
+    readonly secretsDir: string;
+    readonly mailboxDir: string;
+    readonly tokensPath: string;
+    private readonly keyPath;
+    constructor(accountId: string, accountsDir: string, accountKey: string);
+    private loadKey;
+    private encrypt;
+    private decrypt;
+    /** The temp path a write would use. Exposed so a test can assert the
+     *  Task-1601 invariant directly: distinct writers, and successive writes by
+     *  one writer, never nominate the same path. */
+    nextTempPath(): string;
+    /** Test seam for the failure path — a write that throws must leave the
+     *  previous good file untouched. */
+    writeBlobForTest(blob: TokenBlob): void;
+    /** Atomic write with a UNIQUE temp name — see the class comment (Task 1601).
+     *  A failed write removes its own temp and rethrows, never leaving debris and
+     *  never clearing the previous good file. */
+    private writeBlob;
+    read(): TokenBlob | null;
+    store(accessToken: string, refreshToken: string | null, expiresInSeconds: number, extras?: {
+        email?: string | null;
+        scopes?: string[];
+    }): TokenBlob;
+    clear(): void;
+}
+//# sourceMappingURL=token-store.d.ts.map

package/payload/platform/plugins/google/mcp/dist/auth/token-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../../src/auth/token-store.ts"],"names":[],"mappings":"AA2BA,eAAO,MAAM,oBAAoB,QAAgB,CAAC;AAElD,MAAM,WAAW,SAAS;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;8BAE8B;AAC9B,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,qBAAa,UAAU;IASnB,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM;IAV7B,OAAO,CAAC,MAAM,CAA0B;IACxC,OAAO,CAAC,GAAG,CAAuB;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;gBAGtB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM;IAQ7B,OAAO,CAAC,OAAO;IAcf,OAAO,CAAC,OAAO;IAMf,OAAO,CAAC,OAAO;IAMf;;oDAEgD;IAChD,YAAY,IAAI,MAAM;IAItB;wCACoC;IACpC,gBAAgB,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI;IAIvC;;iDAE6C;IAC7C,OAAO,CAAC,SAAS;IAmBjB,IAAI,IAAI,SAAS,GAAG,IAAI;IAUxB,KAAK,CACH,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GAAG,IAAI,EAC3B,gBAAgB,EAAE,MAAM,EACxB,MAAM,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;KAAO,GACxD,SAAS;IAiBZ,KAAK,IAAI,IAAI;CAId"}

package/payload/platform/plugins/google/mcp/dist/auth/token-store.js

@@ -0,0 +1,138 @@
+/**
+ * Per-account encrypted token store for Google OAuth credentials.
+ *
+ *   {ACCOUNTS_DIR}/{accountId}/secrets/google/.key                       AES-256-CBC key, 32 random bytes base64, mode 0600
+ *   {ACCOUNTS_DIR}/{accountId}/secrets/google/accounts/{key}/tokens.enc  "<iv-hex>:<cipher-hex>" of the JSON blob
+ *
+ * The AES key is per-account and shared by every Google account connected
+ * under it; account isolation is unchanged — account A's key cannot decrypt
+ * account B's tokens.
+ *
+ * Divergence from the Outlook store this mirrors: the atomic write uses a
+ * UNIQUE temp name. Outlook used a fixed `${tokensPath}.tmp`, so two racing
+ * refreshes could rename each other's partial file and wipe valid tokens
+ * (Task 1601).
+ */
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync, } from "node:fs";
+import { join } from "node:path";
+export const REFRESH_THRESHOLD_MS = 5 * 60 * 1000;
+/** Filesystem-safe directory name for a Google account key (an email). The true
+ *  identity is never read back from this name — it lives in the blob — so a
+ *  lossy fold is harmless. */
+export function sanitizeAccountKey(key) {
+    return key.replace(/[^A-Za-z0-9._-]/g, "_");
+}
+export class TokenStore {
+    accountId;
+    accountsDir;
+    accountKey;
+    cached = null;
+    key = null;
+    secretsDir;
+    mailboxDir;
+    tokensPath;
+    keyPath;
+    constructor(accountId, accountsDir, accountKey) {
+        this.accountId = accountId;
+        this.accountsDir = accountsDir;
+        this.accountKey = accountKey;
+        this.secretsDir = join(accountsDir, accountId, "secrets", "google");
+        this.mailboxDir = join(this.secretsDir, "accounts", sanitizeAccountKey(accountKey));
+        this.tokensPath = join(this.mailboxDir, "tokens.enc");
+        this.keyPath = join(this.secretsDir, ".key");
+    }
+    loadKey() {
+        if (this.key)
+            return this.key;
+        mkdirSync(this.secretsDir, { recursive: true, mode: 0o700 });
+        if (existsSync(this.keyPath)) {
+            this.key = Buffer.from(readFileSync(this.keyPath, "utf-8").trim(), "base64");
+        }
+        else {
+            const k = randomBytes(32);
+            writeFileSync(this.keyPath, k.toString("base64"), { mode: 0o600 });
+            chmodSync(this.keyPath, 0o600);
+            this.key = k;
+        }
+        return this.key;
+    }
+    encrypt(plain) {
+        const iv = randomBytes(16);
+        const c = createCipheriv("aes-256-cbc", this.loadKey(), iv);
+        return `${iv.toString("hex")}:${c.update(plain, "utf8", "hex") + c.final("hex")}`;
+    }
+    decrypt(raw) {
+        const [ivHex, payload] = raw.split(":");
+        const d = createDecipheriv("aes-256-cbc", this.loadKey(), Buffer.from(ivHex, "hex"));
+        return d.update(payload, "hex", "utf8") + d.final("utf8");
+    }
+    /** The temp path a write would use. Exposed so a test can assert the
+     *  Task-1601 invariant directly: distinct writers, and successive writes by
+     *  one writer, never nominate the same path. */
+    nextTempPath() {
+        return `${this.tokensPath}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+    }
+    /** Test seam for the failure path — a write that throws must leave the
+     *  previous good file untouched. */
+    writeBlobForTest(blob) {
+        this.writeBlob(blob);
+    }
+    /** Atomic write with a UNIQUE temp name — see the class comment (Task 1601).
+     *  A failed write removes its own temp and rethrows, never leaving debris and
+     *  never clearing the previous good file. */
+    writeBlob(blob) {
+        const ciphertext = this.encrypt(JSON.stringify(blob));
+        mkdirSync(this.mailboxDir, { recursive: true, mode: 0o700 });
+        const temp = this.nextTempPath();
+        try {
+            writeFileSync(temp, ciphertext, { mode: 0o600 });
+            chmodSync(temp, 0o600);
+            renameSync(temp, this.tokensPath);
+        }
+        catch (err) {
+            try {
+                rmSync(temp, { force: true });
+            }
+            catch {
+                /* best effort */
+            }
+            throw err;
+        }
+        this.cached = blob;
+    }
+    read() {
+        if (this.cached)
+            return this.cached;
+        if (!existsSync(this.tokensPath))
+            return null;
+        const raw = readFileSync(this.tokensPath, "utf-8").trim();
+        if (!raw)
+            return null;
+        const blob = JSON.parse(this.decrypt(raw));
+        this.cached = blob;
+        return blob;
+    }
+    store(accessToken, refreshToken, expiresInSeconds, extras = {}) {
+        const now = Date.now();
+        const prev = this.read();
+        const blob = {
+            accessToken,
+            // Google omits refresh_token on refresh responses; never downgrade a
+            // held refresh token to null because this response lacked one.
+            refreshToken: refreshToken ?? prev?.refreshToken ?? null,
+            accessTokenExpiry: now + expiresInSeconds * 1000,
+            lastRefresh: now,
+            email: extras.email ?? prev?.email ?? null,
+            scopes: extras.scopes ?? prev?.scopes ?? [],
+        };
+        this.writeBlob(blob);
+        return blob;
+    }
+    clear() {
+        this.cached = null;
+        if (existsSync(this.tokensPath))
+            rmSync(this.tokensPath, { force: true });
+    }
+}
+//# sourceMappingURL=token-store.js.map

package/payload/platform/plugins/google/mcp/dist/auth/token-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.js","sourceRoot":"","sources":["../../src/auth/token-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,YAAY,EACZ,UAAU,EACV,MAAM,EACN,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAWlD;;8BAE8B;AAC9B,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,OAAO,GAAG,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,OAAO,UAAU;IASV;IACA;IACA;IAVH,MAAM,GAAqB,IAAI,CAAC;IAChC,GAAG,GAAkB,IAAI,CAAC;IACzB,UAAU,CAAS;IACnB,UAAU,CAAS;IACnB,UAAU,CAAS;IACX,OAAO,CAAS;IAEjC,YACW,SAAiB,EACjB,WAAmB,EACnB,UAAkB;QAFlB,cAAS,GAAT,SAAS,CAAQ;QACjB,gBAAW,GAAX,WAAW,CAAQ;QACnB,eAAU,GAAV,UAAU,CAAQ;QAE3B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QACpE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC;QACpF,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QACtD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IAEO,OAAO;QACb,IAAI,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC,GAAG,CAAC;QAC9B,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7D,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7B,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC/E,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;YAC1B,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACnE,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC/B,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;IAEO,OAAO,CAAC,KAAa;QAC3B,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,CAAC,GAAG,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5D,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;IACpF,CAAC;IAEO,OAAO,CAAC,GAAW;QACzB,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;QACrF,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5D,CAAC;IAED;;oDAEgD;IAChD,YAAY;QACV,OAAO,GAAG,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;IACnF,CAAC;IAED;wCACoC;IACpC,gBAAgB,CAAC,IAAe;QAC9B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IAED;;iDAE6C;IACrC,SAAS,CAAC,IAAe;QAC/B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACtD,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACjD,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACvB,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;IACrB,CAAC;IAED,IAAI;QACF,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC;QACpC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9C,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1D,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAc,CAAC;QACxD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CACH,WAAmB,EACnB,YAA2B,EAC3B,gBAAwB,EACxB,SAAuD,EAAE;QAEzD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,IAAI,GAAc;YACtB,WAAW;YACX,qEAAqE;YACrE,+DAA+D;YAC/D,YAAY,EAAE,YAAY,IAAI,IAAI,EAAE,YAAY,IAAI,IAAI;YACxD,iBAAiB,EAAE,GAAG,GAAG,gBAAgB,GAAG,IAAI;YAChD,WAAW,EAAE,GAAG;YAChB,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,IAAI;YAC1C,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI,EAAE,MAAM,IAAI,EAAE;SAC5C,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK;QACH,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5E,CAAC;CACF"}

package/payload/platform/plugins/google/mcp/dist/index.d.ts

@@ -0,0 +1,25 @@
+#!/usr/bin/env node
+/**
+ * @maxy/google MCP server.
+ *
+ * Live Google Calendar for one account: read plus create, update, cancel,
+ * respond and free/busy. Admin agent only; no public surface.
+ *
+ * Auth: per-account OAuth authorization-code + PKCE. The consent URL is minted
+ *   here; the exchange happens in platform/ui, which holds the house-only
+ *   client secret. Tokens persist encrypted to
+ *   {ACCOUNTS_DIR}/{accountId}/secrets/google/accounts/{email}/tokens.enc
+ *
+ * There is deliberately no Gmail surface — mail runs on the `email` plugin's
+ * IMAP/SMTP path, and Gmail's restricted scopes would force Google's annual
+ * security assessment. Calendar is a sensitive scope only.
+ *
+ * Required environment:
+ *   ACCOUNT_ID          — provided by getMcpServers when spawned per account.
+ *   PLATFORM_ROOT       — repo root; used to derive ACCOUNTS_DIR.
+ *   GOOGLE_CLIENT_ID    — brand.json#googleClientId. Operator-set per brand.
+ *   GOOGLE_PUBLIC_BASE  — https origin of this install's public host.
+ *   MAXY_UI_INTERNAL_PORT — loopback port of platform/ui (holds the secret).
+ */
+export {};
+//# sourceMappingURL=index.d.ts.map

package/payload/platform/plugins/google/mcp/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;GAqBG"}