@rubytech/create-maxy-code 0.1.474 → 0.1.475

package/payload/platform/plugins/google/mcp/dist/__tests__/loopback-listener.test.js

@@ -0,0 +1,146 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { createServer } from "node:http";
+import { startLoopbackListener } from "../auth/loopback-listener.js";
+async function get(url) {
+    const res = await fetch(url);
+    return { status: res.status, body: await res.text() };
+}
+/** A port is only proven released by rebinding it. A boolean the code under
+ *  test sets would prove the code ran, not that the socket closed. */
+async function isFree(port) {
+    return await new Promise((resolve) => {
+        const s = createServer();
+        s.once("error", () => resolve(false));
+        s.listen(port, "127.0.0.1", () => s.close(() => resolve(true)));
+    });
+}
+test("a matching state completes and the page names the account", async () => {
+    let seen = "";
+    const l = await startLoopbackListener({
+        accountId: "a",
+        state: "st-1",
+        onCode: async (code) => {
+            seen = code;
+            return { email: "kit@example.com" };
+        },
+    });
+    assert.ok(l);
+    const r = await get(`${l.redirectUri}/?state=st-1&code=xyz`);
+    assert.equal(r.status, 200);
+    assert.equal(seen, "xyz");
+    assert.match(r.body, /kit@example\.com/);
+    await l.close("test");
+});
+test("a mismatched state is refused and onCode never runs", async () => {
+    let ran = false;
+    const l = await startLoopbackListener({
+        accountId: "a",
+        state: "st-2",
+        onCode: async () => {
+            ran = true;
+            return { email: "x@y.z" };
+        },
+    });
+    assert.ok(l);
+    const r = await get(`${l.redirectUri}/?state=WRONG&code=xyz`);
+    assert.equal(r.status, 400);
+    assert.equal(ran, false);
+    await l.close("test");
+});
+test("an onCode failure renders Google's error rather than claiming success", async () => {
+    const l = await startLoopbackListener({
+        accountId: "a",
+        state: "st-3",
+        onCode: async () => {
+            throw new Error("token exchange failed (400): invalid_grant");
+        },
+    });
+    assert.ok(l);
+    const r = await get(`${l.redirectUri}/?state=st-3&code=xyz`);
+    assert.equal(r.status, 400);
+    assert.match(r.body, /invalid_grant/);
+    await l.close("test");
+});
+test("close releases the port", async () => {
+    const l = await startLoopbackListener({
+        accountId: "a",
+        state: "st-4",
+        onCode: async () => ({ email: "x@y.z" }),
+    });
+    assert.ok(l);
+    const port = l.port;
+    await l.close("test");
+    assert.equal(await isFree(port), true);
+});
+test("a completed exchange releases the port without an explicit close", async () => {
+    const l = await startLoopbackListener({
+        accountId: "a",
+        state: "st-5",
+        onCode: async () => ({ email: "x@y.z" }),
+    });
+    assert.ok(l);
+    const port = l.port;
+    await get(`${l.redirectUri}/?state=st-5&code=xyz`);
+    await new Promise((r) => setTimeout(r, 50));
+    assert.equal(await isFree(port), true);
+});
+test("a reload during the exchange does not run onCode twice", async () => {
+    let calls = 0;
+    const l = await startLoopbackListener({
+        accountId: "a",
+        state: "st-7",
+        onCode: async () => {
+            calls += 1;
+            await new Promise((r) => setTimeout(r, 80));
+            return { email: "x@y.z" };
+        },
+    });
+    assert.ok(l);
+    const first = get(`${l.redirectUri}/?state=st-7&code=xyz`);
+    await new Promise((r) => setTimeout(r, 20));
+    const second = await get(`${l.redirectUri}/?state=st-7&code=xyz`);
+    await first;
+    assert.equal(calls, 1, "the second request must not re-exchange the code");
+    assert.equal(second.status, 409);
+});
+test("a denied consent says so rather than blaming the link", async () => {
+    let ran = false;
+    const l = await startLoopbackListener({
+        accountId: "a",
+        state: "st-8",
+        onCode: async () => {
+            ran = true;
+            return { email: "x@y.z" };
+        },
+    });
+    assert.ok(l);
+    const r = await get(`${l.redirectUri}/?state=st-8&error=access_denied`);
+    assert.equal(r.status, 400);
+    assert.match(r.body, /access_denied/);
+    assert.doesNotMatch(r.body, /did not match/);
+    assert.equal(ran, false);
+});
+test("responses keep the code out of caches and referrers", async () => {
+    const l = await startLoopbackListener({
+        accountId: "a",
+        state: "st-9",
+        onCode: async () => ({ email: "x@y.z" }),
+    });
+    assert.ok(l);
+    const res = await fetch(`${l.redirectUri}/?state=st-9&code=xyz`);
+    assert.equal(res.headers.get("cache-control"), "no-store");
+    assert.equal(res.headers.get("referrer-policy"), "no-referrer");
+    await l.close("test");
+});
+test("the listener binds the loopback literal, never localhost", async () => {
+    const l = await startLoopbackListener({
+        accountId: "a",
+        state: "st-6",
+        onCode: async () => ({ email: "x@y.z" }),
+    });
+    assert.ok(l);
+    assert.match(l.redirectUri, /^http:\/\/127\.0\.0\.1:\d+$/);
+    await l.close("test");
+});
+//# sourceMappingURL=loopback-listener.test.js.map

package/payload/platform/plugins/google/mcp/dist/__tests__/loopback-listener.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loopback-listener.test.js","sourceRoot":"","sources":["../../src/__tests__/loopback-listener.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAErE,KAAK,UAAU,GAAG,CAAC,GAAW;IAC5B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;AACxD,CAAC;AAED;sEACsE;AACtE,KAAK,UAAU,MAAM,CAAC,IAAY;IAChC,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACnC,MAAM,CAAC,GAAG,YAAY,EAAE,CAAC;QACzB,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QACtC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,IAAI,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;IAC3E,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,MAAM,CAAC,GAAG,MAAM,qBAAqB,CAAC;QACpC,SAAS,EAAE,GAAG;QACd,KAAK,EAAE,MAAM;QACb,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YACrB,IAAI,GAAG,IAAI,CAAC;YACZ,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;QACtC,CAAC;KACF,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACb,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,uBAAuB,CAAC,CAAC;IAC7D,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC5B,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC1B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IACzC,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AACxB,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;IACrE,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,MAAM,CAAC,GAAG,MAAM,qBAAqB,CAAC;QACpC,SAAS,EAAE,GAAG;QACd,KAAK,EAAE,MAAM;QACb,MAAM,EAAE,KAAK,IAAI,EAAE;YACjB,GAAG,GAAG,IAAI,CAAC;YACX,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAC5B,CAAC;KACF,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACb,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,wBAAwB,CAAC,CAAC;IAC9D,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC5B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACzB,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AACxB,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;IACvF,MAAM,CAAC,GAAG,MAAM,qBAAqB,CAAC;QACpC,SAAS,EAAE,GAAG;QACd,KAAK,EAAE,MAAM;QACb,MAAM,EAAE,KAAK,IAAI,EAAE;YACjB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;KACF,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACb,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,uBAAuB,CAAC,CAAC;IAC7D,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC5B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IACtC,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AACxB,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,yBAAyB,EAAE,KAAK,IAAI,EAAE;IACzC,MAAM,CAAC,GAAG,MAAM,qBAAqB,CAAC;QACpC,SAAS,EAAE,GAAG;QACd,KAAK,EAAE,MAAM;QACb,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;KACzC,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACb,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;IACpB,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB,MAAM,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;AACzC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;IAClF,MAAM,CAAC,GAAG,MAAM,qBAAqB,CAAC;QACpC,SAAS,EAAE,GAAG;QACd,KAAK,EAAE,MAAM;QACb,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;KACzC,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACb,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;IACpB,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,uBAAuB,CAAC,CAAC;IACnD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC5C,MAAM,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;AACzC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;IACxE,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,CAAC,GAAG,MAAM,qBAAqB,CAAC;QACpC,SAAS,EAAE,GAAG;QACd,KAAK,EAAE,MAAM;QACb,MAAM,EAAE,KAAK,IAAI,EAAE;YACjB,KAAK,IAAI,CAAC,CAAC;YACX,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAC5C,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAC5B,CAAC;KACF,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACb,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,uBAAuB,CAAC,CAAC;IAC3D,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,uBAAuB,CAAC,CAAC;IAClE,MAAM,KAAK,CAAC;IACZ,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,kDAAkD,CAAC,CAAC;IAC3E,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AACnC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;IACvE,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,MAAM,CAAC,GAAG,MAAM,qBAAqB,CAAC;QACpC,SAAS,EAAE,GAAG;QACd,KAAK,EAAE,MAAM;QACb,MAAM,EAAE,KAAK,IAAI,EAAE;YACjB,GAAG,GAAG,IAAI,CAAC;YACX,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAC5B,CAAC;KACF,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACb,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,kCAAkC,CAAC,CAAC;IACxE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC5B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IACtC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IAC7C,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAC3B,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;IACrE,MAAM,CAAC,GAAG,MAAM,qBAAqB,CAAC;QACpC,SAAS,EAAE,GAAG;QACd,KAAK,EAAE,MAAM;QACb,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;KACzC,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACb,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,uBAAuB,CAAC,CAAC;IACjE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,CAAC,CAAC;IAC3D,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,aAAa,CAAC,CAAC;IAChE,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AACxB,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;IAC1E,MAAM,CAAC,GAAG,MAAM,qBAAqB,CAAC;QACpC,SAAS,EAAE,GAAG;QACd,KAAK,EAAE,MAAM;QACb,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;KACzC,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACb,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,EAAE,6BAA6B,CAAC,CAAC;IAC3D,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AACxB,CAAC,CAAC,CAAC"}

package/payload/platform/plugins/google/mcp/dist/__tests__/pending-redirect.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=pending-redirect.test.d.ts.map

package/payload/platform/plugins/google/mcp/dist/__tests__/pending-redirect.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-redirect.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/pending-redirect.test.ts"],"names":[],"mappings":""}

package/payload/platform/plugins/google/mcp/dist/__tests__/pending-redirect.test.js

@@ -0,0 +1,19 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { PendingStore } from "../auth/pending-store.js";
+test("a pending entry round-trips its redirectUri", () => {
+    const dir = mkdtempSync(join(tmpdir(), "g-"));
+    const p = new PendingStore("acct-1", dir);
+    p.write({ state: "s1", verifier: "v1", createdAt: Date.now(), redirectUri: "http://127.0.0.1:54321" });
+    assert.equal(p.read()?.redirectUri, "http://127.0.0.1:54321");
+});
+test("a legacy pending entry with no redirectUri still reads", () => {
+    const dir = mkdtempSync(join(tmpdir(), "g-"));
+    const p = new PendingStore("acct-2", dir);
+    p.write({ state: "s2", verifier: "v2", createdAt: Date.now() });
+    assert.equal(p.read()?.redirectUri, undefined);
+});
+//# sourceMappingURL=pending-redirect.test.js.map

package/payload/platform/plugins/google/mcp/dist/__tests__/pending-redirect.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-redirect.test.js","sourceRoot":"","sources":["../../src/__tests__/pending-redirect.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAExD,IAAI,CAAC,6CAA6C,EAAE,GAAG,EAAE;IACvD,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9C,MAAM,CAAC,GAAG,IAAI,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,wBAAwB,EAAE,CAAC,CAAC;IACvG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,wBAAwB,CAAC,CAAC;AAChE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,wDAAwD,EAAE,GAAG,EAAE;IAClE,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9C,MAAM,CAAC,GAAG,IAAI,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAChE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;AACjD,CAAC,CAAC,CAAC"}

package/payload/platform/plugins/google/mcp/dist/__tests__/register-redirect-chain.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=register-redirect-chain.test.d.ts.map

package/payload/platform/plugins/google/mcp/dist/__tests__/register-redirect-chain.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"register-redirect-chain.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/register-redirect-chain.test.ts"],"names":[],"mappings":""}

package/payload/platform/plugins/google/mcp/dist/__tests__/register-redirect-chain.test.js

@@ -0,0 +1,41 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { newState, runAccountRegisterStart } from "../tools/account-register.js";
+import { PendingStore } from "../auth/pending-store.js";
+/** The consent URL, the pending entry and therefore the exchange must all
+ *  carry one redirect. Google compares the exchange's value byte-for-byte
+ *  against the one that issued the code, so a divergence here is the
+ *  redirect_uri_mismatch that reads like a wrong client type. */
+test("the consent URL and the pending entry carry the same redirect", async () => {
+    const dir = mkdtempSync(join(tmpdir(), "g-"));
+    const r = await runAccountRegisterStart({
+        accountId: "acct",
+        accountsDir: dir,
+        clientId: "cid",
+        state: newState(),
+        redirectUri: "http://127.0.0.1:54321",
+    });
+    assert.equal(r.status, "pending");
+    const inUrl = new URL(r.consentUrl).searchParams.get("redirect_uri");
+    const inPending = new PendingStore("acct", dir).read()?.redirectUri;
+    assert.equal(inUrl, "http://127.0.0.1:54321");
+    assert.equal(inPending, "http://127.0.0.1:54321");
+    assert.equal(inUrl, inPending);
+});
+test("the state minted by the caller is the state persisted and sent", async () => {
+    const dir = mkdtempSync(join(tmpdir(), "g-"));
+    const state = newState();
+    const r = await runAccountRegisterStart({
+        accountId: "acct",
+        accountsDir: dir,
+        clientId: "cid",
+        state,
+        redirectUri: "http://127.0.0.1:1234",
+    });
+    assert.equal(new URL(r.consentUrl).searchParams.get("state"), state);
+    assert.equal(new PendingStore("acct", dir).read()?.state, state);
+});
+//# sourceMappingURL=register-redirect-chain.test.js.map

package/payload/platform/plugins/google/mcp/dist/__tests__/register-redirect-chain.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register-redirect-chain.test.js","sourceRoot":"","sources":["../../src/__tests__/register-redirect-chain.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACjF,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAExD;;;iEAGiE;AACjE,IAAI,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;IAC/E,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9C,MAAM,CAAC,GAAG,MAAM,uBAAuB,CAAC;QACtC,SAAS,EAAE,MAAM;QACjB,WAAW,EAAE,GAAG;QAChB,QAAQ,EAAE,KAAK;QACf,KAAK,EAAE,QAAQ,EAAE;QACjB,WAAW,EAAE,wBAAwB;KACtC,CAAC,CAAC;IACH,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,UAAW,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,IAAI,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC;IACpE,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,wBAAwB,CAAC,CAAC;IAC9C,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,wBAAwB,CAAC,CAAC;IAClD,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;AACjC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;IAChF,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;IACzB,MAAM,CAAC,GAAG,MAAM,uBAAuB,CAAC;QACtC,SAAS,EAAE,MAAM;QACjB,WAAW,EAAE,GAAG;QAChB,QAAQ,EAAE,KAAK;QACf,KAAK;QACL,WAAW,EAAE,uBAAuB;KACrC,CAAC,CAAC;IACH,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,UAAW,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;IACtE,MAAM,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;AACnE,CAAC,CAAC,CAAC"}

package/payload/platform/plugins/google/mcp/dist/auth/account-audit.d.ts

@@ -0,0 +1,44 @@
+import { type TokenBlob } from "./token-store.js";
+/** Google revokes a refresh token after six months without use. */
+export declare const REFRESH_INACTIVITY_LIMIT_DAYS = 180;
+/** How much of the inactivity clock must remain before an account is merely
+ *  `ok`. Thirty days is the window in which an operator can still act. */
+export declare const REFRESH_EXPIRING_THRESHOLD_DAYS = 30;
+export type RefreshStatus = "ok" | "expiring" | "expired";
+export interface AccountAuditRow {
+    accountId: string;
+    email: string;
+    refreshTtlDays: number;
+    status: RefreshStatus;
+}
+/**
+ * Classify one token blob against the inactivity clock.
+ *
+ * A blob holding NO refresh token is `expired` with zero days regardless of how
+ * recently it was written: it works until the access token lapses, about an hour
+ * out, and then dies. Reporting it as `ok` because `lastRefresh` is recent would
+ * be precisely the false all-clear this audit exists to prevent.
+ */
+export declare function classifyRefresh(blob: TokenBlob, nowMs: number): {
+    refreshTtlDays: number;
+    status: RefreshStatus;
+};
+/**
+ * Every connected Google account under every account, classified.
+ *
+ * An unreadable blob is skipped rather than thrown: one corrupt store must never
+ * blind the audit to every other account. It is not reported as a row because it
+ * has no TTL to report — `google-account-list` is the surface that already
+ * distinguishes `unreadable` from healthy.
+ */
+export declare function auditConnectedAccounts(accountsDir: string, nowMs: number): AccountAuditRow[];
+/**
+ * One audit cycle: a line per connected account, then a heartbeat.
+ *
+ * The heartbeat fires on EVERY cycle, including cycles that find nothing. An
+ * audit that has stopped running would otherwise be indistinguishable from an
+ * audit reporting all-clear, and the standing absence of this line over more
+ * than one interval is the documented signal that the audit is not running.
+ */
+export declare function runAccountAudit(accountsDir: string, nowMs: number, emit: (line: string) => void): AccountAuditRow[];
+//# sourceMappingURL=account-audit.d.ts.map

package/payload/platform/plugins/google/mcp/dist/auth/account-audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-audit.d.ts","sourceRoot":"","sources":["../../src/auth/account-audit.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE9D,mEAAmE;AACnE,eAAO,MAAM,6BAA6B,MAAM,CAAC;AAEjD;0EAC0E;AAC1E,eAAO,MAAM,+BAA+B,KAAK,CAAC;AAMlD,MAAM,MAAM,aAAa,GAAG,IAAI,GAAG,UAAU,GAAG,SAAS,CAAC;AAW1D,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,aAAa,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,SAAS,EACf,KAAK,EAAE,MAAM,GACZ;IAAE,cAAc,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,CAWnD;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,eAAe,EAAE,CAkB5F;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAC3B,eAAe,EAAE,CAYnB"}

package/payload/platform/plugins/google/mcp/dist/auth/account-audit.js

@@ -0,0 +1,112 @@
+/**
+ * Standing refresh-token audit (Task 1773).
+ *
+ * A connected account's refresh token expiring emits no event and does not
+ * reproduce on demand: nothing touches the account, it simply stops working at
+ * some future date. Without a periodic reconciliation, "which connected accounts
+ * are close to falling off?" is unanswerable without reading every token store by
+ * hand. This module is that reconciliation.
+ *
+ * WHAT `refreshTtlDays` MEANS. Google issues no expiry for a refresh token and
+ * the stored blob holds none — `TokenBlob` carries `accessTokenExpiry` and
+ * `lastRefresh`, nothing more. The one bounded, locally-computable clock is
+ * Google's six-month INACTIVITY revocation: a refresh token unused for 180 days
+ * is revoked. So `refreshTtlDays` is days remaining on that inactivity clock,
+ * measured from `lastRefresh`. It is NOT a expiry Google published, and it does
+ * not predict the other revocation causes (the user revoking access, a password
+ * change, or the app being unpublished), none of which are locally observable.
+ *
+ * Runs against local stores only — no network. It reads what is on disk and
+ * classifies it, so it cannot itself break a working connection.
+ */
+import { existsSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+import { TokenStore } from "./token-store.js";
+/** Google revokes a refresh token after six months without use. */
+export const REFRESH_INACTIVITY_LIMIT_DAYS = 180;
+/** How much of the inactivity clock must remain before an account is merely
+ *  `ok`. Thirty days is the window in which an operator can still act. */
+export const REFRESH_EXPIRING_THRESHOLD_DAYS = 30;
+const DAY_MS = 86_400_000;
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** The audit line is space-delimited `k=v`, so a value carrying whitespace would
+ *  split into bogus fields and a reader would mis-parse the record for exactly
+ *  the account most likely to need attention. The directory name is already
+ *  folded by `sanitizeAccountKey`, but `blob.email` comes from Google's
+ *  primary-calendar id and is never sanitized on the way in. */
+function logSafe(value) {
+    return value.replace(/\s+/g, "_");
+}
+/**
+ * Classify one token blob against the inactivity clock.
+ *
+ * A blob holding NO refresh token is `expired` with zero days regardless of how
+ * recently it was written: it works until the access token lapses, about an hour
+ * out, and then dies. Reporting it as `ok` because `lastRefresh` is recent would
+ * be precisely the false all-clear this audit exists to prevent.
+ */
+export function classifyRefresh(blob, nowMs) {
+    if (blob.refreshToken === null)
+        return { refreshTtlDays: 0, status: "expired" };
+    // Clamp idleDays at 0 so a lastRefresh in the future — a device whose clock ran
+    // ahead, or a blob restored from a host whose clock did — cannot report more
+    // days remaining than the limit this module documents as the maximum.
+    // `PendingStore.ageSec` clamps its analogous value for the same reason.
+    const idleDays = Math.max(0, Math.floor((nowMs - blob.lastRefresh) / DAY_MS));
+    const refreshTtlDays = REFRESH_INACTIVITY_LIMIT_DAYS - idleDays;
+    if (refreshTtlDays <= 0)
+        return { refreshTtlDays, status: "expired" };
+    if (refreshTtlDays <= REFRESH_EXPIRING_THRESHOLD_DAYS)
+        return { refreshTtlDays, status: "expiring" };
+    return { refreshTtlDays, status: "ok" };
+}
+/**
+ * Every connected Google account under every account, classified.
+ *
+ * An unreadable blob is skipped rather than thrown: one corrupt store must never
+ * blind the audit to every other account. It is not reported as a row because it
+ * has no TTL to report — `google-account-list` is the surface that already
+ * distinguishes `unreadable` from healthy.
+ */
+export function auditConnectedAccounts(accountsDir, nowMs) {
+    if (!existsSync(accountsDir))
+        return [];
+    const rows = [];
+    for (const accountId of readdirSync(accountsDir)) {
+        if (!UUID_RE.test(accountId))
+            continue;
+        const connectedDir = join(accountsDir, accountId, "secrets", "google", "accounts");
+        if (!existsSync(connectedDir))
+            continue;
+        for (const key of readdirSync(connectedDir)) {
+            try {
+                const blob = new TokenStore(accountId, accountsDir, key).read();
+                if (!blob)
+                    continue;
+                rows.push({ accountId, email: logSafe(blob.email ?? key), ...classifyRefresh(blob, nowMs) });
+            }
+            catch {
+                /* unreadable store — skip, never blind the whole scan */
+            }
+        }
+    }
+    return rows;
+}
+/**
+ * One audit cycle: a line per connected account, then a heartbeat.
+ *
+ * The heartbeat fires on EVERY cycle, including cycles that find nothing. An
+ * audit that has stopped running would otherwise be indistinguishable from an
+ * audit reporting all-clear, and the standing absence of this line over more
+ * than one interval is the documented signal that the audit is not running.
+ */
+export function runAccountAudit(accountsDir, nowMs, emit) {
+    const rows = auditConnectedAccounts(accountsDir, nowMs);
+    for (const r of rows) {
+        emit(`[google-account-audit] account=${r.accountId} email=${r.email} refreshTtlDays=${r.refreshTtlDays} status=${r.status}`);
+    }
+    const count = (s) => rows.filter((r) => r.status === s).length;
+    emit(`[google-account-audit] op=heartbeat accounts=${rows.length} ok=${count("ok")} expiring=${count("expiring")} expired=${count("expired")}`);
+    return rows;
+}
+//# sourceMappingURL=account-audit.js.map

package/payload/platform/plugins/google/mcp/dist/auth/account-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-audit.js","sourceRoot":"","sources":["../../src/auth/account-audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAkB,MAAM,kBAAkB,CAAC;AAE9D,mEAAmE;AACnE,MAAM,CAAC,MAAM,6BAA6B,GAAG,GAAG,CAAC;AAEjD;0EAC0E;AAC1E,MAAM,CAAC,MAAM,+BAA+B,GAAG,EAAE,CAAC;AAElD,MAAM,MAAM,GAAG,UAAU,CAAC;AAE1B,MAAM,OAAO,GAAG,iEAAiE,CAAC;AAIlF;;;;gEAIgE;AAChE,SAAS,OAAO,CAAC,KAAa;IAC5B,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AACpC,CAAC;AASD;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAe,EACf,KAAa;IAEb,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI;QAAE,OAAO,EAAE,cAAc,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAChF,gFAAgF;IAChF,6EAA6E;IAC7E,sEAAsE;IACtE,wEAAwE;IACxE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC;IAC9E,MAAM,cAAc,GAAG,6BAA6B,GAAG,QAAQ,CAAC;IAChE,IAAI,cAAc,IAAI,CAAC;QAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACtE,IAAI,cAAc,IAAI,+BAA+B;QAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACrG,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,WAAmB,EAAE,KAAa;IACvE,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,CAAC;IACxC,MAAM,IAAI,GAAsB,EAAE,CAAC;IACnC,KAAK,MAAM,SAAS,IAAI,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,SAAS;QACvC,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QACnF,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;YAAE,SAAS;QACxC,KAAK,MAAM,GAAG,IAAI,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC;YAC5C,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;gBAChE,IAAI,CAAC,IAAI;oBAAE,SAAS;gBACpB,IAAI,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,EAAE,GAAG,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;YAC/F,CAAC;YAAC,MAAM,CAAC;gBACP,yDAAyD;YAC3D,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAC7B,WAAmB,EACnB,KAAa,EACb,IAA4B;IAE5B,MAAM,IAAI,GAAG,sBAAsB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IACxD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CACF,kCAAkC,CAAC,CAAC,SAAS,UAAU,CAAC,CAAC,KAAK,mBAAmB,CAAC,CAAC,cAAc,WAAW,CAAC,CAAC,MAAM,EAAE,CACvH,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,CAAgB,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IAC9E,IAAI,CACF,gDAAgD,IAAI,CAAC,MAAM,OAAO,KAAK,CAAC,IAAI,CAAC,aAAa,KAAK,CAAC,UAAU,CAAC,YAAY,KAAK,CAAC,SAAS,CAAC,EAAE,CAC1I,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC"}

package/payload/platform/plugins/google/mcp/dist/auth/loopback-listener.d.ts

@@ -0,0 +1,17 @@
+export interface LoopbackListener {
+    readonly redirectUri: string;
+    readonly port: number;
+    close(reason: string): Promise<void>;
+}
+/** Resolves null when the bind fails, so the caller falls back to the fixed
+ *  redirect and the paste path still completes the registration. A refusal
+ *  here would turn an optimisation into a regression on any install that
+ *  cannot bind. */
+export declare function startLoopbackListener(args: {
+    accountId: string;
+    state: string;
+    onCode: (code: string) => Promise<{
+        email: string;
+    }>;
+}): Promise<LoopbackListener | null>;
+//# sourceMappingURL=loopback-listener.d.ts.map

package/payload/platform/plugins/google/mcp/dist/auth/loopback-listener.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loopback-listener.d.ts","sourceRoot":"","sources":["../../src/auth/loopback-listener.ts"],"names":[],"mappings":"AAoBA,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtC;AA0BD;;;mBAGmB;AACnB,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACtD,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CA6HnC"}

package/payload/platform/plugins/google/mcp/dist/auth/loopback-listener.js

@@ -0,0 +1,143 @@
+/**
+ * Single-shot loopback listener for the Desktop-client consent redirect.
+ *
+ * Bound to 127.0.0.1 on an OS-assigned port. RFC 8252 §7.3 makes the port
+ * irrelevant when Google matches a loopback redirect, so binding :0 costs
+ * nothing and avoids the contention two co-resident brands would have on a
+ * fixed port. The IP literal is mandatory — that port-agnostic matching does
+ * NOT extend to the hostname `localhost`.
+ *
+ * This is reached only when consent happens on the install's own host. When
+ * the user consents on a phone, nothing reaches it and the paste path
+ * completes the registration instead. That is the designed cross-device route,
+ * not a failure of this listener.
+ *
+ * The module knows nothing about Google or tokens: it captures a code,
+ * verifies `state`, hands off, renders, and closes.
+ */
+import { createServer } from "node:http";
+import { log } from "../lib/log.js";
+function escapeHtml(s) {
+    return s
+        .replace(/&/g, "&")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;");
+}
+/** The URL of these responses carries an authorization code. RFC 8252 §8.1
+ *  wants it kept out of caches and out of any Referer. The page is
+ *  self-contained today so no request can carry one, but a later edit adding a
+ *  link or an image would turn that into a code leak. */
+const HEADERS = {
+    "content-type": "text/html",
+    "cache-control": "no-store",
+    "referrer-policy": "no-referrer",
+};
+function page(title, body) {
+    return `<!doctype html><html><head><meta charset="utf-8"><title>${title}</title>
+<style>body{font-family:system-ui,sans-serif;max-width:34rem;margin:4rem auto;padding:0 1rem;line-height:1.5}
+h1{font-size:1.3rem}</style></head><body><h1>${title}</h1>${body}</body></html>`;
+}
+/** Resolves null when the bind fails, so the caller falls back to the fixed
+ *  redirect and the paste path still completes the registration. A refusal
+ *  here would turn an optimisation into a regression on any install that
+ *  cannot bind. */
+export async function startLoopbackListener(args) {
+    const server = createServer();
+    const port = await new Promise((resolve) => {
+        server.once("error", (err) => {
+            log({
+                tag: "[google-oauth]",
+                op: "listen-failed",
+                account: args.accountId,
+                reg: args.state,
+                reason: err.code ?? err.message,
+            });
+            resolve(null);
+        });
+        server.listen(0, "127.0.0.1", () => {
+            const addr = server.address();
+            resolve(typeof addr === "object" && addr !== null ? addr.port : null);
+        });
+    });
+    if (port === null)
+        return null;
+    const redirectUri = `http://127.0.0.1:${port}`;
+    let closed = false;
+    const close = (reason) => new Promise((resolve) => {
+        if (closed)
+            return resolve();
+        closed = true;
+        server.close(() => {
+            log({ tag: "[google-oauth]", op: "close", reg: args.state, account: args.accountId, reason });
+            resolve();
+        });
+    });
+    /** Single-shot is enforced at accept time, not by closing after the
+     *  exchange. `server.close()` stops new connections but the socket keeps
+     *  accepting until the in-flight response ends, so a browser reload during
+     *  the ~1s exchange would otherwise call `onCode` twice with the same code
+     *  and paint `invalid_grant` over a connection that had just succeeded. */
+    let consumed = false;
+    server.on("request", (req, res) => {
+        const url = new URL(req.url ?? "/", redirectUri);
+        const state = url.searchParams.get("state");
+        const code = url.searchParams.get("code");
+        const denied = url.searchParams.get("error");
+        const matched = state === args.state;
+        log({
+            tag: "[google-oauth]",
+            op: "callback",
+            reg: args.state,
+            account: args.accountId,
+            "state-match": matched ? "true" : "false",
+            ...(denied ? { error: denied } : {}),
+        });
+        if (consumed) {
+            res.writeHead(409, HEADERS);
+            res.end(page("Already handled", "<p>This link has already been used. Check the chat for the result.</p>"));
+            return;
+        }
+        // A cancelled consent arrives with `error=access_denied` and no code, and
+        // its state matches. Reporting that as a mismatched link would contradict
+        // the log line and misdescribe what the user did.
+        if (matched && denied) {
+            consumed = true;
+            res.writeHead(400, HEADERS);
+            res.end(page("Consent was not granted", `<p>Google reported <code>${escapeHtml(denied)}</code>. Nothing was connected. Start again from the chat if that was not deliberate.</p>`));
+            void close("denied");
+            return;
+        }
+        if (!matched || !code) {
+            res.writeHead(400, HEADERS);
+            res.end(page("That link did not match", "<p>This page was opened with a link that does not match the connection in progress. Start again from the chat.</p>"));
+            return;
+        }
+        consumed = true;
+        void args
+            .onCode(code)
+            .then(({ email }) => {
+            res.writeHead(200, HEADERS);
+            res.end(page(`Connected ${escapeHtml(email)}`, "<p>Your calendar is connected. Return to the chat and say you're done.</p>"));
+        })
+            .catch((err) => {
+            // Never claim success on a failed exchange, and never swallow Google's
+            // own words: invalid_grant means expired or reused, and the operator
+            // needs to read that rather than a generic apology.
+            res.writeHead(400, HEADERS);
+            res.end(page("Could not finish connecting", `<p>${escapeHtml(err.message)}</p><p>Return to the chat and try again.</p>`));
+        })
+            // Writing the response can itself throw — a socket Node destroyed at
+            // requestTimeout makes the catch branch's writeHead raise
+            // ERR_HTTP_HEADERS_SENT. Without this the rejection is unhandled, which
+            // under Node's default takes the whole MCP server down.
+            .catch(() => {
+            if (!res.writableEnded)
+                res.destroy();
+        })
+            .finally(() => void close("exchanged"));
+    });
+    log({ tag: "[google-oauth]", op: "listen", account: args.accountId, reg: args.state, port });
+    return { redirectUri, port, close };
+}
+//# sourceMappingURL=loopback-listener.js.map

package/payload/platform/plugins/google/mcp/dist/auth/loopback-listener.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loopback-listener.js","sourceRoot":"","sources":["../../src/auth/loopback-listener.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,YAAY,EAAe,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AAQpC,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC;SACL,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC7B,CAAC;AAED;;;yDAGyD;AACzD,MAAM,OAAO,GAAG;IACd,cAAc,EAAE,WAAW;IAC3B,eAAe,EAAE,UAAU;IAC3B,iBAAiB,EAAE,aAAa;CACxB,CAAC;AAEX,SAAS,IAAI,CAAC,KAAa,EAAE,IAAY;IACvC,OAAO,2DAA2D,KAAK;;+CAE1B,KAAK,QAAQ,IAAI,gBAAgB,CAAC;AACjF,CAAC;AAED;;;mBAGmB;AACnB,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAI3C;IACC,MAAM,MAAM,GAAW,YAAY,EAAE,CAAC;IAEtC,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,EAAE;QACxD,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;YAClD,GAAG,CAAC;gBACF,GAAG,EAAE,gBAAgB;gBACrB,EAAE,EAAE,eAAe;gBACnB,OAAO,EAAE,IAAI,CAAC,SAAS;gBACvB,GAAG,EAAE,IAAI,CAAC,KAAK;gBACf,MAAM,EAAE,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO;aAChC,CAAC,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,OAAO,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAE/B,MAAM,WAAW,GAAG,oBAAoB,IAAI,EAAE,CAAC;IAC/C,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,MAAM,KAAK,GAAG,CAAC,MAAc,EAAiB,EAAE,CAC9C,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACtB,IAAI,MAAM;YAAE,OAAO,OAAO,EAAE,CAAC;QAC7B,MAAM,GAAG,IAAI,CAAC;QACd,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;YAChB,GAAG,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;YAC9F,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEL;;;;+EAI2E;IAC3E,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAChC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,WAAW,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC;QACrC,GAAG,CAAC;YACF,GAAG,EAAE,gBAAgB;YACrB,EAAE,EAAE,UAAU;YACd,GAAG,EAAE,IAAI,CAAC,KAAK;YACf,OAAO,EAAE,IAAI,CAAC,SAAS;YACvB,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;YACzC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrC,CAAC,CAAC;QACH,IAAI,QAAQ,EAAE,CAAC;YACb,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC5B,GAAG,CAAC,GAAG,CACL,IAAI,CACF,iBAAiB,EACjB,wEAAwE,CACzE,CACF,CAAC;YACF,OAAO;QACT,CAAC;QACD,0EAA0E;QAC1E,0EAA0E;QAC1E,kDAAkD;QAClD,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;YACtB,QAAQ,GAAG,IAAI,CAAC;YAChB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC5B,GAAG,CAAC,GAAG,CACL,IAAI,CACF,yBAAyB,EACzB,4BAA4B,UAAU,CAAC,MAAM,CAAC,2FAA2F,CAC1I,CACF,CAAC;YACF,KAAK,KAAK,CAAC,QAAQ,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;YACtB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC5B,GAAG,CAAC,GAAG,CACL,IAAI,CACF,yBAAyB,EACzB,oHAAoH,CACrH,CACF,CAAC;YACF,OAAO;QACT,CAAC;QACD,QAAQ,GAAG,IAAI,CAAC;QAChB,KAAK,IAAI;aACN,MAAM,CAAC,IAAI,CAAC;aACZ,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC5B,GAAG,CAAC,GAAG,CACL,IAAI,CACF,aAAa,UAAU,CAAC,KAAK,CAAC,EAAE,EAChC,4EAA4E,CAC7E,CACF,CAAC;QACJ,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,GAAU,EAAE,EAAE;YACpB,uEAAuE;YACvE,qEAAqE;YACrE,oDAAoD;YACpD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC5B,GAAG,CAAC,GAAG,CACL,IAAI,CACF,6BAA6B,EAC7B,MAAM,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,8CAA8C,CAC5E,CACF,CAAC;QACJ,CAAC,CAAC;YACF,qEAAqE;YACrE,0DAA0D;YAC1D,wEAAwE;YACxE,wDAAwD;aACvD,KAAK,CAAC,GAAG,EAAE;YACV,IAAI,CAAC,GAAG,CAAC,aAAa;gBAAE,GAAG,CAAC,OAAO,EAAE,CAAC;QACxC,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE,CAAC,KAAK,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7F,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACtC,CAAC"}

package/payload/platform/plugins/google/mcp/dist/auth/pending-store.d.ts

@@ -2,6 +2,15 @@ export interface PendingOAuth {
     state: string;
     verifier: string;
     createdAt: number;
+    /** The redirect_uri the consent URL carried. Google compares the exchange's
+     *  redirect_uri byte-for-byte against it, and since Task 1799 the port is
+     *  whatever the loopback listener bound, so the constant can no longer be
+     *  assumed.
+     *
+     *  Optional because an entry written before 1799 carries no such field and
+     *  may still be mid-flight across an upgrade; readers fall back to the fixed
+     *  loopback constant for those. */
+    redirectUri?: string;
 }
 export declare class PendingStore {
     readonly accountId: string;

package/payload/platform/plugins/google/mcp/dist/auth/pending-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pending-store.d.ts","sourceRoot":"","sources":["../../src/auth/pending-store.ts"],"names":[],"mappings":"AAqBA,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,YAAY;IAOrB,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM;IAP9B,OAAO,CAAC,GAAG,CAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;gBAGtB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM;IAO9B,wDAAwD;IACxD,OAAO,CAAC,OAAO;IAcf,KAAK,CAAC,CAAC,EAAE,YAAY,GAAG,IAAI;IAoB5B,IAAI,IAAI,YAAY,GAAG,IAAI;IAS3B,KAAK,IAAI,IAAI;IAIb;;;gFAG4E;IAC5E,MAAM,IAAI,MAAM,GAAG,IAAI;CAIxB"}
+{"version":3,"file":"pending-store.d.ts","sourceRoot":"","sources":["../../src/auth/pending-store.ts"],"names":[],"mappings":"AAqBA,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;uCAOmC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,qBAAa,YAAY;IAOrB,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM;IAP9B,OAAO,CAAC,GAAG,CAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;gBAGtB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM;IAO9B,wDAAwD;IACxD,OAAO,CAAC,OAAO;IAcf,KAAK,CAAC,CAAC,EAAE,YAAY,GAAG,IAAI;IAoB5B,IAAI,IAAI,YAAY,GAAG,IAAI;IAS3B,KAAK,IAAI,IAAI;IAIb;;;gFAG4E;IAC5E,MAAM,IAAI,MAAM,GAAG,IAAI;CAIxB"}

package/payload/platform/plugins/google/mcp/dist/auth/pending-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"pending-store.js","sourceRoot":"","sources":["../../src/auth/pending-store.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,YAAY,EACZ,UAAU,EACV,MAAM,EACN,QAAQ,EACR,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAQjC,MAAM,OAAO,YAAY;IAOZ;IACA;IAPH,GAAG,GAAkB,IAAI,CAAC;IACjB,UAAU,CAAS;IAC3B,WAAW,CAAS;IACZ,OAAO,CAAS;IAEjC,YACW,SAAiB,EACjB,WAAmB;QADnB,cAAS,GAAT,SAAS,CAAQ;QACjB,gBAAW,GAAX,WAAW,CAAQ;QAE5B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QACpE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC;QAC9D,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IAED,wDAAwD;IAChD,OAAO;QACb,IAAI,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC,GAAG,CAAC;QAC9B,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7D,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7B,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC/E,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;YAC1B,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACnE,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC/B,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,CAAe;QACnB,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,CAAC,GAAG,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACvG,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;QACxF,IAAI,CAAC;YACH,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9C,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACvB,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,IAAI;QACF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/C,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3D,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;QACrF,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAiB,CAAC;IACxF,CAAC;IAED,KAAK;QACH,IAAI,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED;;;gFAG4E;IAC5E,MAAM;QACJ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IAC3F,CAAC;CACF"}
+{"version":3,"file":"pending-store.js","sourceRoot":"","sources":["../../src/auth/pending-store.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,YAAY,EACZ,UAAU,EACV,MAAM,EACN,QAAQ,EACR,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAiBjC,MAAM,OAAO,YAAY;IAOZ;IACA;IAPH,GAAG,GAAkB,IAAI,CAAC;IACjB,UAAU,CAAS;IAC3B,WAAW,CAAS;IACZ,OAAO,CAAS;IAEjC,YACW,SAAiB,EACjB,WAAmB;QADnB,cAAS,GAAT,SAAS,CAAQ;QACjB,gBAAW,GAAX,WAAW,CAAQ;QAE5B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QACpE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC;QAC9D,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IAED,wDAAwD;IAChD,OAAO;QACb,IAAI,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC,GAAG,CAAC;QAC9B,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7D,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7B,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC/E,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;YAC1B,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACnE,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC/B,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,CAAe;QACnB,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,CAAC,GAAG,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACvG,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;QACxF,IAAI,CAAC;YACH,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9C,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACvB,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,IAAI;QACF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/C,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3D,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;QACrF,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAiB,CAAC;IACxF,CAAC;IAED,KAAK;QACH,IAAI,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED;;;gFAG4E;IAC5E,MAAM;QACJ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IAC3F,CAAC;CACF"}