google-services-mcp 0.1.0-beta.100

package/dist/auth/manager.js

@@ -0,0 +1,141 @@
+import { google } from "googleapis";
+import { getDataDir, hasCredentials, loadConfig, saveClientCredentials, saveConfig, } from "./config.js";
+import { buildAuthUrl, DEFAULT_AUTH_TIMEOUT_MS, exchangeCode, fetchUserInfo, generatePkce, generateState, openBrowser, refreshAccessToken, waitForOAuthCallback, } from "./oauth.js";
+import { deleteAccount, loadAccount, loadAllAccounts, saveAccount, } from "./store.js";
+/**
+ * Coordinates credentials, per-account token storage, the interactive OAuth
+ * flow, and refresh. All service modules resolve auth through here.
+ */
+class AuthManager {
+    async getConfig() {
+        return loadConfig();
+    }
+    async listAccounts() {
+        return loadAllAccounts();
+    }
+    /**
+     * Resolve an account to use for a tool call.
+     * Priority: explicit name -> configured default -> sole account.
+     */
+    async resolveAccount(name) {
+        const accounts = await loadAllAccounts();
+        if (name) {
+            const found = accounts.find((a) => a.name === name);
+            if (!found) {
+                const available = accounts.length ? accounts.map((a) => a.name).join(", ") : "none";
+                throw new Error(`Account "${name}" not found. Available accounts: ${available}`);
+            }
+            return found;
+        }
+        if (accounts.length === 0) {
+            throw new Error("No Google accounts configured. Add one with the account_add tool or run: google-services-mcp add <name>");
+        }
+        const config = await this.getConfig();
+        if (config.defaultAccount) {
+            const found = accounts.find((a) => a.name === config.defaultAccount);
+            if (found)
+                return found;
+        }
+        if (accounts.length === 1)
+            return accounts[0];
+        throw new Error(`Multiple accounts configured but no default set. Pass account="..." or run: google-services-mcp set-default <name>`);
+    }
+    /** Get an authenticated googleapis OAuth2 client, refreshing first if needed. */
+    async getClient(name) {
+        const config = await this.getConfig();
+        let account = await this.resolveAccount(name);
+        if (account.expiryDate && Date.now() > account.expiryDate - 60_000) {
+            const tokens = await refreshAccessToken(config, account.refreshToken);
+            account = {
+                ...account,
+                accessToken: tokens.accessToken,
+                refreshToken: tokens.refreshToken ?? account.refreshToken,
+                expiryDate: tokens.expiryDate,
+            };
+            await saveAccount(account);
+        }
+        const client = new google.auth.OAuth2(config.clientId, config.clientSecret);
+        client.setCredentials({
+            access_token: account.accessToken,
+            refresh_token: account.refreshToken,
+            expiry_date: account.expiryDate,
+        });
+        return client;
+    }
+    /**
+     * Run the interactive OAuth flow to add a new account: opens the consent
+     * screen, waits for the loopback callback, exchanges the code, and persists
+     * the account alongside the signed-in email.
+     */
+    async addAccount(name, options = {}) {
+        const config = await this.getConfig();
+        if (!hasCredentials(config)) {
+            throw new Error("Google OAuth credentials are not configured. Set GOOGLE_MCP_CLIENT_ID and " +
+                "GOOGLE_MCP_CLIENT_SECRET (or add them to config.json) first.");
+        }
+        const state = generateState();
+        const { codeVerifier, codeChallenge } = generatePkce();
+        const authUrl = buildAuthUrl(config, state, codeChallenge);
+        const timeoutMs = options.timeoutMs ?? DEFAULT_AUTH_TIMEOUT_MS;
+        // The callback owns its timeout so an aborted flow always closes the
+        // loopback listener (no stale port left behind).
+        const callbackPromise = waitForOAuthCallback(config, state, { timeoutMs });
+        if (options.openBrowser !== false) {
+            try {
+                await openBrowser(authUrl);
+            }
+            catch {
+                // Browser unavailable (headless server) — the error message carries the URL.
+                throw new Error(`Could not open a browser. Open this URL manually to authorize "${name}": ${authUrl}`);
+            }
+        }
+        const callback = await callbackPromise;
+        const tokens = await exchangeCode(config, callback.code, codeVerifier);
+        const user = await fetchUserInfo(tokens.accessToken);
+        const account = {
+            name,
+            email: user.email,
+            accessToken: tokens.accessToken,
+            refreshToken: tokens.refreshToken ?? "",
+            expiryDate: tokens.expiryDate,
+            scopes: config.scopes ?? [],
+            createdAt: new Date().toISOString(),
+        };
+        await saveAccount(account);
+        return account;
+    }
+    async removeAccount(name) {
+        return deleteAccount(name);
+    }
+    async setDefaultAccount(name) {
+        const config = await this.getConfig();
+        if (name) {
+            const exists = await loadAccount(name);
+            if (!exists)
+                throw new Error(`Cannot set default: account "${name}" does not exist.`);
+        }
+        config.defaultAccount = name || undefined;
+        await saveConfig(config);
+    }
+    async saveCredentials(clientId, clientSecret) {
+        await saveClientCredentials(clientId, clientSecret);
+    }
+    async getStatus() {
+        const config = await this.getConfig();
+        const accounts = await loadAllAccounts();
+        return {
+            credentialsConfigured: hasCredentials(config),
+            dataDir: getDataDir(),
+            defaultAccount: config.defaultAccount,
+            accounts: accounts.map((a) => ({
+                name: a.name,
+                email: a.email,
+                expiresAt: a.expiryDate,
+                tokenHealthy: !a.expiryDate || Date.now() < a.expiryDate,
+                scopes: a.scopes,
+            })),
+        };
+    }
+}
+export const authManager = new AuthManager();
+//# sourceMappingURL=manager.js.map

package/dist/auth/manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.js","sourceRoot":"","sources":["../../src/auth/manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,MAAM,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAEL,UAAU,EACV,cAAc,EACd,UAAU,EACV,qBAAqB,EACrB,UAAU,GACX,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,YAAY,EACZ,uBAAuB,EACvB,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,aAAa,EACb,WAAW,EACX,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,aAAa,EACb,WAAW,EACX,eAAe,EAEf,WAAW,GACZ,MAAM,YAAY,CAAC;AAwBpB;;;GAGG;AACH,MAAM,WAAW;IACf,KAAK,CAAC,SAAS;QACb,OAAO,UAAU,EAAE,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,OAAO,eAAe,EAAE,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,cAAc,CAAC,IAAa;QAChC,MAAM,QAAQ,GAAG,MAAM,eAAe,EAAE,CAAC;QACzC,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;YACpD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;gBACpF,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,oCAAoC,SAAS,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,yGAAyG,CAC1G,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACtC,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,cAAc,CAAC,CAAC;YACrE,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;QAC1B,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,oHAAoH,CACrH,CAAC;IACJ,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,SAAS,CAAC,IAAa;QAC3B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACtC,IAAI,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAE9C,IAAI,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,UAAU,GAAG,MAAM,EAAE,CAAC;YACnE,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;YACtE,OAAO,GAAG;gBACR,GAAG,OAAO;gBACV,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY;gBACzD,UAAU,EAAE,MAAM,CAAC,UAAU;aAC9B,CAAC;YACF,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QAC5E,MAAM,CAAC,cAAc,CAAC;YACpB,YAAY,EAAE,OAAO,CAAC,WAAW;YACjC,aAAa,EAAE,OAAO,CAAC,YAAY;YACnC,WAAW,EAAE,OAAO,CAAC,UAAU;SAChC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU,CAAC,IAAY,EAAE,OAAO,GAAsB,EAAE;QAC5D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACtC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,4EAA4E;gBAC1E,8DAA8D,CACjE,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;QAC9B,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,YAAY,EAAE,CAAC;QACvD,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,uBAAuB,CAAC;QAC/D,qEAAqE;QACrE,iDAAiD;QACjD,MAAM,eAAe,GAAG,oBAAoB,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QAE3E,IAAI,OAAO,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;YAC7B,CAAC;YAAC,MAAM,CAAC;gBACP,6EAA6E;gBAC7E,MAAM,IAAI,KAAK,CACb,kEAAkE,IAAI,MAAM,OAAO,EAAE,CACtF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC;QAEvC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QACvE,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAErD,MAAM,OAAO,GAAkB;YAC7B,IAAI;YACJ,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;YACvC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC3B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QACF,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;QAC3B,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,IAAY;QAC9B,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,IAAY;QAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACtC,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,mBAAmB,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,CAAC,cAAc,GAAG,IAAI,IAAI,SAAS,CAAC;QAC1C,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,QAAgB,EAAE,YAAoB;QAC1D,MAAM,qBAAqB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,SAAS;QACb,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAM,eAAe,EAAE,CAAC;QACzC,OAAO;YACL,qBAAqB,EAAE,cAAc,CAAC,MAAM,CAAC;YAC7C,OAAO,EAAE,UAAU,EAAE;YACrB,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC7B,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,SAAS,EAAE,CAAC,CAAC,UAAU;gBACvB,YAAY,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU;gBACxD,MAAM,EAAE,CAAC,CAAC,MAAM;aACjB,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC;CACF;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC"}

package/dist/auth/oauth.d.ts

@@ -0,0 +1,57 @@
+import { type Config } from "./config.js";
+export interface TokenSet {
+    accessToken: string;
+    refreshToken?: string;
+    /** Epoch milliseconds at which the access token expires. */
+    expiryDate?: number;
+}
+/** How long the loopback callback server waits for Google's redirect. */
+export declare const DEFAULT_AUTH_TIMEOUT_MS: number;
+/**
+ * Resolve the redirect URI this server registers with Google. A full
+ * `redirectUri` override wins; otherwise the URI is derived from the loopback
+ * port. The value must exactly match a redirect URI registered for the OAuth
+ * client in the Google Cloud Console.
+ */
+export declare function resolveRedirectUri(config: Config): string;
+/** Build the Google consent-screen URL. */
+export declare function buildAuthUrl(config: Config, state: string, codeChallenge: string): string;
+/** Open a URL in the default browser on the current platform. */
+export declare function openBrowser(url: string): Promise<void>;
+export interface AuthCallback {
+    code: string;
+    state: string;
+}
+/**
+ * Start a loopback HTTP server on the configured redirect URI and wait for
+ * Google to redirect back with an authorization code. Resolves with the code
+ * and state; rejects on CSRF state mismatch, a missing code, a bind failure,
+ * or when `timeoutMs` elapses.
+ *
+ * The listener is always closed once the promise settles, so an aborted or
+ * timed-out flow never leaves a stale port occupied (which would otherwise
+ * cause EADDRINUSE on the next attempt).
+ */
+export declare function waitForOAuthCallback(config: Config, expectedState: string, options?: {
+    timeoutMs?: number;
+}): Promise<AuthCallback>;
+/** Exchange an authorization code for tokens. */
+export declare function exchangeCode(config: Config, code: string, codeVerifier: string): Promise<TokenSet>;
+/** Refresh an expired access token. Keeps the existing refresh token if the provider does not rotate it. */
+export declare function refreshAccessToken(config: Config, refreshToken: string): Promise<TokenSet>;
+/** Best-effort fetch of the signed-in user's profile (email/name). Never throws. */
+export declare function fetchUserInfo(accessToken: string): Promise<{
+    email?: string;
+    name?: string;
+}>;
+/** Generate a random state value for CSRF protection. */
+export declare function generateState(): string;
+export interface PkcePair {
+    /** High-entropy secret kept client-side; sent at token exchange. */
+    codeVerifier: string;
+    /** S256 hash of the verifier; sent in the authorization URL. */
+    codeChallenge: string;
+}
+/** Generate a PKCE (RFC 7636) verifier/challenge pair with S256. */
+export declare function generatePkce(): PkcePair;
+//# sourceMappingURL=oauth.d.ts.map

package/dist/auth/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../src/auth/oauth.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,KAAK,MAAM,EAAyC,MAAM,aAAa,CAAC;AAIjF,MAAM,WAAW,QAAQ;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAMD,yEAAyE;AACzE,eAAO,MAAM,uBAAuB,QAAgB,CAAC;AAErD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAIzD;AAoBD,2CAA2C;AAC3C,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAczF;AAED,iEAAiE;AACjE,wBAAsB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ5D;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EACrB,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GACnC,OAAO,CAAC,YAAY,CAAC,CA0FvB;AA+BD,iDAAiD;AACjD,wBAAsB,YAAY,CAChC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,QAAQ,CAAC,CAOnB;AAED,4GAA4G;AAC5G,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAKhG;AAED,oFAAoF;AACpF,wBAAsB,aAAa,CACjC,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAa5C;AAED,yDAAyD;AACzD,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED,MAAM,WAAW,QAAQ;IACvB,oEAAoE;IACpE,YAAY,EAAE,MAAM,CAAC;IACrB,gEAAgE;IAChE,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,oEAAoE;AACpE,wBAAgB,YAAY,IAAI,QAAQ,CAOvC"}

package/dist/auth/oauth.js

@@ -0,0 +1,223 @@
+import { execFile } from "node:child_process";
+import { createHash, randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+import { promisify } from "node:util";
+import { DEFAULT_REDIRECT_PORT, DEFAULT_SCOPES } from "./config.js";
+const execFileAsync = promisify(execFile);
+const TOKEN_ENDPOINT = "https://oauth2.googleapis.com/token";
+const AUTH_ENDPOINT = "https://accounts.google.com/o/oauth2/v2/auth";
+const USERINFO_ENDPOINT = "https://www.googleapis.com/oauth2/v2/userinfo";
+/** How long the loopback callback server waits for Google's redirect. */
+export const DEFAULT_AUTH_TIMEOUT_MS = 5 * 60 * 1000;
+/**
+ * Resolve the redirect URI this server registers with Google. A full
+ * `redirectUri` override wins; otherwise the URI is derived from the loopback
+ * port. The value must exactly match a redirect URI registered for the OAuth
+ * client in the Google Cloud Console.
+ */
+export function resolveRedirectUri(config) {
+    if (config.redirectUri)
+        return config.redirectUri;
+    const port = config.redirectPort ?? DEFAULT_REDIRECT_PORT;
+    return `http://127.0.0.1:${port}`;
+}
+/** Parse the resolved redirect URI into bind host/port and accepted paths. */
+function parseCallbackTarget(config) {
+    const uri = new URL(resolveRedirectUri(config));
+    const hostname = uri.hostname || "127.0.0.1";
+    const host = hostname === "localhost" ? "127.0.0.1" : hostname;
+    const port = uri.port ? Number(uri.port) : DEFAULT_REDIRECT_PORT;
+    const configuredPath = uri.pathname && uri.pathname !== "/" ? uri.pathname : "/";
+    return { host, port, paths: new Set([configuredPath, "/", "/oauth2callback"]) };
+}
+/** Build the Google consent-screen URL. */
+export function buildAuthUrl(config, state, codeChallenge) {
+    const scopes = config.scopes?.length ? config.scopes : DEFAULT_SCOPES;
+    const url = new URL(AUTH_ENDPOINT);
+    url.searchParams.set("client_id", config.clientId);
+    url.searchParams.set("redirect_uri", resolveRedirectUri(config));
+    url.searchParams.set("response_type", "code");
+    url.searchParams.set("scope", scopes.join(" "));
+    url.searchParams.set("access_type", "offline");
+    url.searchParams.set("prompt", "consent");
+    url.searchParams.set("state", state);
+    url.searchParams.set("code_challenge", codeChallenge);
+    url.searchParams.set("code_challenge_method", "S256");
+    url.searchParams.set("include_granted_scopes", "true");
+    return url.toString();
+}
+/** Open a URL in the default browser on the current platform. */
+export async function openBrowser(url) {
+    if (process.platform === "darwin") {
+        await execFileAsync("open", [url]);
+    }
+    else if (process.platform === "win32") {
+        await execFileAsync("cmd", ["/c", "start", "", url]);
+    }
+    else {
+        await execFileAsync("xdg-open", [url]);
+    }
+}
+/**
+ * Start a loopback HTTP server on the configured redirect URI and wait for
+ * Google to redirect back with an authorization code. Resolves with the code
+ * and state; rejects on CSRF state mismatch, a missing code, a bind failure,
+ * or when `timeoutMs` elapses.
+ *
+ * The listener is always closed once the promise settles, so an aborted or
+ * timed-out flow never leaves a stale port occupied (which would otherwise
+ * cause EADDRINUSE on the next attempt).
+ */
+export function waitForOAuthCallback(config, expectedState, options = {}) {
+    return new Promise((resolve, reject) => {
+        const target = parseCallbackTarget(config);
+        const timeoutMs = options.timeoutMs ?? DEFAULT_AUTH_TIMEOUT_MS;
+        let timer;
+        let server;
+        let closed = false;
+        /** Close the listener (optionally force-dropping active connections) and stop the timer. */
+        const finish = (force) => {
+            if (closed)
+                return;
+            closed = true;
+            if (timer)
+                clearTimeout(timer);
+            timer = undefined;
+            if (server) {
+                if (force)
+                    server.closeAllConnections?.();
+                server.close();
+            }
+        };
+        const callbackHtml = "<html><body><h3>Google Service MCP: authorization received.</h3>" +
+            "<p>You can close this window and return to your terminal.</p></body></html>";
+        server = createServer((req, res) => {
+            let url;
+            try {
+                url = new URL(req.url ?? "/", resolveRedirectUri(config));
+            }
+            catch {
+                res.writeHead(400).end();
+                return;
+            }
+            // Accept the configured redirect path plus the legacy root paths
+            // (`/` for `http://127.0.0.1:<port>`, `/oauth2callback` for older configs).
+            if (!target.paths.has(url.pathname)) {
+                res.writeHead(404);
+                res.end("Not found");
+                return;
+            }
+            const code = url.searchParams.get("code") ?? "";
+            const state = url.searchParams.get("state") ?? "";
+            if (state !== expectedState) {
+                res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+                res.end(callbackHtml);
+                finish(false);
+                reject(new Error("OAuth state mismatch — possible CSRF attack. Aborting authorization."));
+                return;
+            }
+            if (!code) {
+                res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+                res.end(callbackHtml);
+                finish(false);
+                reject(new Error("No authorization code in callback URL."));
+                return;
+            }
+            res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+            res.end(callbackHtml);
+            finish(false);
+            resolve({ code, state });
+        });
+        server.on("error", (e) => {
+            finish(true);
+            if (e.code === "EADDRINUSE") {
+                reject(new Error(`Could not start the OAuth callback server: port ${target.port} (host ${target.host}) is already in use. ` +
+                    `Set GOOGLE_MCP_REDIRECT_URI (or redirectUri in config.json, GOOGLE_MCP_REDIRECT_PORT, ` +
+                    `or redirectPort) to a free loopback endpoint and retry.`));
+            }
+            else {
+                reject(new Error(`OAuth callback server failed: ${e.message}`));
+            }
+        });
+        timer = setTimeout(() => {
+            finish(true);
+            reject(new Error(`Timed out waiting for the OAuth callback after ${Math.round(timeoutMs / 1000)}s. ` +
+                `Open the authorization URL in a browser and approve the prompt.`));
+        }, timeoutMs);
+        timer.unref?.();
+        server.listen(target.port, target.host);
+    });
+}
+async function postTokenRequest(config, body) {
+    const params = new URLSearchParams({
+        client_id: config.clientId,
+    });
+    params.set("client_secret", config.clientSecret);
+    for (const [key, value] of Object.entries(body)) {
+        params.set(key, value);
+    }
+    const response = await fetch(TOKEN_ENDPOINT, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: params,
+    });
+    const data = await response.json().catch(() => ({}));
+    if (!response.ok || typeof data.access_token !== "string") {
+        throw new Error(`Token request failed: ${JSON.stringify(data)}`);
+    }
+    const expiresIn = typeof data.expires_in === "number" ? data.expires_in : 3600;
+    const refresh = typeof data.refresh_token === "string" && data.refresh_token
+        ? data.refresh_token
+        : (body.refresh_token ?? undefined);
+    return {
+        accessToken: data.access_token,
+        refreshToken: refresh,
+        expiryDate: Date.now() + expiresIn * 1000,
+    };
+}
+/** Exchange an authorization code for tokens. */
+export async function exchangeCode(config, code, codeVerifier) {
+    return postTokenRequest(config, {
+        code,
+        code_verifier: codeVerifier,
+        redirect_uri: resolveRedirectUri(config),
+        grant_type: "authorization_code",
+    });
+}
+/** Refresh an expired access token. Keeps the existing refresh token if the provider does not rotate it. */
+export async function refreshAccessToken(config, refreshToken) {
+    return postTokenRequest(config, {
+        refresh_token: refreshToken,
+        grant_type: "refresh_token",
+    });
+}
+/** Best-effort fetch of the signed-in user's profile (email/name). Never throws. */
+export async function fetchUserInfo(accessToken) {
+    try {
+        const response = await fetch(USERINFO_ENDPOINT, {
+            headers: { Authorization: `Bearer ${accessToken}` },
+        });
+        if (response.ok) {
+            const data = await response.json();
+            return { email: data.email, name: data.name };
+        }
+    }
+    catch {
+        // ignore network failures
+    }
+    return {};
+}
+/** Generate a random state value for CSRF protection. */
+export function generateState() {
+    return randomBytes(16).toString("hex");
+}
+/** Generate a PKCE (RFC 7636) verifier/challenge pair with S256. */
+export function generatePkce() {
+    const codeVerifier = randomBytes(32)
+        .toString("base64url")
+        .replace(/[^A-Za-z0-9\-._~]/g, "")
+        .slice(0, 128);
+    const codeChallenge = createHash("sha256").update(codeVerifier).digest("base64url");
+    return { codeVerifier, codeChallenge };
+}
+//# sourceMappingURL=oauth.js.map

package/dist/auth/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/auth/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,YAAY,EAAe,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAe,qBAAqB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAEjF,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAS1C,MAAM,cAAc,GAAG,qCAAqC,CAAC;AAC7D,MAAM,aAAa,GAAG,8CAA8C,CAAC;AACrE,MAAM,iBAAiB,GAAG,+CAA+C,CAAC;AAE1E,yEAAyE;AACzE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAErD;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,IAAI,MAAM,CAAC,WAAW;QAAE,OAAO,MAAM,CAAC,WAAW,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,IAAI,qBAAqB,CAAC;IAC1D,OAAO,oBAAoB,IAAI,EAAE,CAAC;AACpC,CAAC;AAUD,8EAA8E;AAC9E,SAAS,mBAAmB,CAAC,MAAc;IACzC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,IAAI,WAAW,CAAC;IAC7C,MAAM,IAAI,GAAG,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC/D,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC;IACjE,MAAM,cAAc,GAAG,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC;IACjF,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC,EAAE,CAAC;AAClF,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,KAAa,EAAE,aAAqB;IAC/E,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC;IACtE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;IACnC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;IACjE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;IAC/C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC1C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;IACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC;IACvD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,iEAAiE;AACjE,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAW;IAC3C,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,MAAM,aAAa,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,CAAC;SAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACxC,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;IACvD,CAAC;SAAM,CAAC;QACN,MAAM,aAAa,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAOD;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAc,EACd,aAAqB,EACrB,OAAO,GAA2B,EAAE;IAEpC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,uBAAuB,CAAC;QAE/D,IAAI,KAAgD,CAAC;QACrD,IAAI,MAA0B,CAAC;QAC/B,IAAI,MAAM,GAAG,KAAK,CAAC;QAEnB,4FAA4F;QAC5F,MAAM,MAAM,GAAG,CAAC,KAAc,EAAE,EAAE;YAChC,IAAI,MAAM;gBAAE,OAAO;YACnB,MAAM,GAAG,IAAI,CAAC;YACd,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;YAC/B,KAAK,GAAG,SAAS,CAAC;YAClB,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,KAAK;oBAAE,MAAM,CAAC,mBAAmB,EAAE,EAAE,CAAC;gBAC1C,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,YAAY,GAChB,kEAAkE;YAClE,6EAA6E,CAAC;QAEhF,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACjC,IAAI,GAAQ,CAAC;YACb,IAAI,CAAC;gBACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5D,CAAC;YAAC,MAAM,CAAC;gBACP,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;gBACzB,OAAO;YACT,CAAC;YACD,iEAAiE;YACjE,4EAA4E;YAC5E,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACpC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACrB,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAChD,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClD,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;gBAC5B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;gBACnE,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBACtB,MAAM,CAAC,KAAK,CAAC,CAAC;gBACd,MAAM,CAAC,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC,CAAC;gBAC1F,OAAO;YACT,CAAC;YACD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;gBACnE,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBACtB,MAAM,CAAC,KAAK,CAAC,CAAC;gBACd,MAAM,CAAC,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC,CAAC;gBAC5D,OAAO;YACT,CAAC;YACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;YACnE,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACtB,MAAM,CAAC,KAAK,CAAC,CAAC;YACd,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAwB,EAAE,EAAE;YAC9C,MAAM,CAAC,IAAI,CAAC,CAAC;YACb,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC5B,MAAM,CACJ,IAAI,KAAK,CACP,mDAAmD,MAAM,CAAC,IAAI,UAAU,MAAM,CAAC,IAAI,uBAAuB;oBACxG,wFAAwF;oBACxF,yDAAyD,CAC5D,CACF,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAClE,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACtB,MAAM,CAAC,IAAI,CAAC,CAAC;YACb,MAAM,CACJ,IAAI,KAAK,CACP,kDAAkD,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK;gBACjF,iEAAiE,CACpE,CACF,CAAC;QACJ,CAAC,EAAE,SAAS,CAAC,CAAC;QACd,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAEhB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,MAAc,EAAE,IAA4B;IAC1E,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,SAAS,EAAE,MAAM,CAAC,QAAQ;KAC3B,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IACjD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,cAAc,EAAE;QAC3C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,MAAM;KACb,CAAC,CAAC;IACH,MAAM,IAAI,GAA4B,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9E,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/E,MAAM,OAAO,GACX,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,IAAI,IAAI,CAAC,aAAa;QAC1D,CAAC,CAAC,IAAI,CAAC,aAAa;QACpB,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,IAAI,SAAS,CAAC,CAAC;IACxC,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,YAAY;QAC9B,YAAY,EAAE,OAAO;QACrB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI;KAC1C,CAAC;AACJ,CAAC;AAED,iDAAiD;AACjD,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAc,EACd,IAAY,EACZ,YAAoB;IAEpB,OAAO,gBAAgB,CAAC,MAAM,EAAE;QAC9B,IAAI;QACJ,aAAa,EAAE,YAAY;QAC3B,YAAY,EAAE,kBAAkB,CAAC,MAAM,CAAC;QACxC,UAAU,EAAE,oBAAoB;KACjC,CAAC,CAAC;AACL,CAAC;AAED,4GAA4G;AAC5G,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAAc,EAAE,YAAoB;IAC3E,OAAO,gBAAgB,CAAC,MAAM,EAAE;QAC9B,aAAa,EAAE,YAAY;QAC3B,UAAU,EAAE,eAAe;KAC5B,CAAC,CAAC;AACL,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,WAAmB;IAEnB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,iBAAiB,EAAE;YAC9C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;SACpD,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,GAAsC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACtE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;QAChD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0BAA0B;IAC5B,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,aAAa;IAC3B,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AASD,oEAAoE;AACpE,MAAM,UAAU,YAAY;IAC1B,MAAM,YAAY,GAAG,WAAW,CAAC,EAAE,CAAC;SACjC,QAAQ,CAAC,WAAW,CAAC;SACrB,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC;SACjC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACjB,MAAM,aAAa,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACpF,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC;AACzC,CAAC"}

package/dist/auth/store.d.ts

@@ -0,0 +1,18 @@
+/** A fully-authenticated account record persisted to disk. */
+export interface StoredAccount {
+    /** Sanitized account name (the identifier used in tool calls). */
+    name: string;
+    /** Email address returned by Google at authorization time, if available. */
+    email?: string;
+    accessToken: string;
+    refreshToken: string;
+    /** Epoch milliseconds after which accessToken is no longer valid. */
+    expiryDate?: number;
+    scopes: string[];
+    createdAt: string;
+}
+export declare function saveAccount(account: StoredAccount): Promise<void>;
+export declare function loadAccount(name: string): Promise<StoredAccount | null>;
+export declare function loadAllAccounts(): Promise<StoredAccount[]>;
+export declare function deleteAccount(name: string): Promise<boolean>;
+//# sourceMappingURL=store.d.ts.map

package/dist/auth/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/auth/store.ts"],"names":[],"mappings":"AAIA,8DAA8D;AAC9D,MAAM,WAAW,aAAa;IAC5B,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAsB,WAAW,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAUvE;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAO7E;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,CAchE;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAOlE"}

package/dist/auth/store.js

@@ -0,0 +1,50 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { ensureDirs, getAccountPath, getAccountsDir, sanitizeName } from "./config.js";
+export async function saveAccount(account) {
+    await ensureDirs();
+    const safeName = sanitizeName(account.name);
+    const toWrite = { ...account, name: safeName };
+    await fs.writeFile(getAccountPath(safeName), JSON.stringify(toWrite, null, 2), {
+        encoding: "utf8",
+        mode: 0o600,
+    });
+    // writeFile's mode only applies on create; harden pre-existing files.
+    await fs.chmod(getAccountPath(safeName), 0o600).catch(() => { });
+}
+export async function loadAccount(name) {
+    try {
+        const raw = await fs.readFile(getAccountPath(name), "utf8");
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+export async function loadAllAccounts() {
+    await ensureDirs();
+    const files = await fs.readdir(getAccountsDir());
+    const accounts = [];
+    for (const file of files) {
+        if (!file.endsWith(".json"))
+            continue;
+        try {
+            const raw = await fs.readFile(path.join(getAccountsDir(), file), "utf8");
+            accounts.push(JSON.parse(raw));
+        }
+        catch {
+            // Corrupt or unreadable account file — skip it rather than crash the server.
+        }
+    }
+    return accounts.sort((a, b) => a.name.localeCompare(b.name));
+}
+export async function deleteAccount(name) {
+    try {
+        await fs.unlink(getAccountPath(name));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=store.js.map

package/dist/auth/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/auth/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAgBvF,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAsB;IACtD,MAAM,UAAU,EAAE,CAAC;IACnB,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAkB,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC9D,MAAM,EAAE,CAAC,SAAS,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;QAC7E,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IACH,sEAAsE;IACtE,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAY;IAC5C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkB,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,UAAU,EAAE,CAAC;IACnB,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;YACzE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkB,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,6EAA6E;QAC/E,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAY;IAC9C,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,7 @@
+export interface CliResult {
+    exitCode: number;
+    output: string;
+}
+/** Pure dispatch used by the CLI. Returns exit code + text output. */
+export declare function dispatchCommand(args: string[]): Promise<CliResult>;
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAyCD,sEAAsE;AACtE,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CA0FxE"}