// Force strict mode and setup for ESM
"use strict";
const __papertOriginalEmitWarning = process.emitWarning.bind(process);
process.emitWarning = function patchedEmitWarning(warning, ...args) {
  if (!process.env.PAPERT_SHOW_NODE_DEPRECATIONS) {
    const warningCode =
      (warning && typeof warning === 'object' && 'code' in warning && warning.code) ||
      (args.length > 1 && typeof args[1] === 'string' && args[1]) ||
      (args.length > 0 &&
        args[0] &&
        typeof args[0] === 'object' &&
        'code' in args[0] &&
        args[0].code);
    if (warningCode === 'DEP0040' || warningCode === 'DEP0169') {
      return;
    }
  }
  return __papertOriginalEmitWarning(warning, ...args);
};
import {
  BaseTokenStorage
} from "./chunk-FJQLUUKC.js";
import {
  __name,
  init_esbuild_shims
} from "./chunk-NCFEMX7E.js";

// packages/core/dist/src/mcp/token-storage/keychain-token-storage.js
init_esbuild_shims();
import * as crypto from "node:crypto";
var KEYCHAIN_TEST_PREFIX = "__keychain_test__";
var KeychainTokenStorage = class extends BaseTokenStorage {
  static {
    __name(this, "KeychainTokenStorage");
  }
  keychainAvailable = null;
  keytarModule = null;
  keytarLoadAttempted = false;
  async getKeytar() {
    if (this.keytarLoadAttempted) {
      return this.keytarModule;
    }
    this.keytarLoadAttempted = true;
    try {
      const moduleName = "keytar";
      const module = await import(moduleName);
      this.keytarModule = module.default || module;
    } catch (error) {
      console.error(error);
    }
    return this.keytarModule;
  }
  async getCredentials(serverName) {
    if (!await this.checkKeychainAvailability()) {
      throw new Error("Keychain is not available");
    }
    const keytar = await this.getKeytar();
    if (!keytar) {
      throw new Error("Keytar module not available");
    }
    try {
      const sanitizedName = this.sanitizeServerName(serverName);
      const data = await keytar.getPassword(this.serviceName, sanitizedName);
      if (!data) {
        return null;
      }
      const credentials = JSON.parse(data);
      if (this.isTokenExpired(credentials)) {
        return null;
      }
      return credentials;
    } catch (error) {
      if (error instanceof SyntaxError) {
        throw new Error(`Failed to parse stored credentials for ${serverName}`);
      }
      throw error;
    }
  }
  async setCredentials(credentials) {
    if (!await this.checkKeychainAvailability()) {
      throw new Error("Keychain is not available");
    }
    const keytar = await this.getKeytar();
    if (!keytar) {
      throw new Error("Keytar module not available");
    }
    this.validateCredentials(credentials);
    const sanitizedName = this.sanitizeServerName(credentials.serverName);
    const updatedCredentials = {
      ...credentials,
      updatedAt: Date.now()
    };
    const data = JSON.stringify(updatedCredentials);
    await keytar.setPassword(this.serviceName, sanitizedName, data);
  }
  async deleteCredentials(serverName) {
    if (!await this.checkKeychainAvailability()) {
      throw new Error("Keychain is not available");
    }
    const keytar = await this.getKeytar();
    if (!keytar) {
      throw new Error("Keytar module not available");
    }
    const sanitizedName = this.sanitizeServerName(serverName);
    const deleted = await keytar.deletePassword(this.serviceName, sanitizedName);
    if (!deleted) {
      throw new Error(`No credentials found for ${serverName}`);
    }
  }
  async listServers() {
    if (!await this.checkKeychainAvailability()) {
      throw new Error("Keychain is not available");
    }
    const keytar = await this.getKeytar();
    if (!keytar) {
      throw new Error("Keytar module not available");
    }
    try {
      const credentials = await keytar.findCredentials(this.serviceName);
      return credentials.filter((cred) => !cred.account.startsWith(KEYCHAIN_TEST_PREFIX)).map((cred) => cred.account);
    } catch (error) {
      console.error("Failed to list servers from keychain:", error);
      return [];
    }
  }
  async getAllCredentials() {
    if (!await this.checkKeychainAvailability()) {
      throw new Error("Keychain is not available");
    }
    const keytar = await this.getKeytar();
    if (!keytar) {
      throw new Error("Keytar module not available");
    }
    const result = /* @__PURE__ */ new Map();
    try {
      const credentials = (await keytar.findCredentials(this.serviceName)).filter((c) => !c.account.startsWith(KEYCHAIN_TEST_PREFIX));
      for (const cred of credentials) {
        try {
          const data = JSON.parse(cred.password);
          if (!this.isTokenExpired(data)) {
            result.set(cred.account, data);
          }
        } catch (error) {
          console.error(`Failed to parse credentials for ${cred.account}:`, error);
        }
      }
    } catch (error) {
      console.error("Failed to get all credentials from keychain:", error);
    }
    return result;
  }
  async clearAll() {
    if (!await this.checkKeychainAvailability()) {
      throw new Error("Keychain is not available");
    }
    const servers = this.keytarModule ? await this.keytarModule.findCredentials(this.serviceName).then((creds) => creds.map((c) => c.account)).catch((error) => {
      throw new Error(`Failed to list servers for clearing: ${error.message}`);
    }) : [];
    const errors = [];
    for (const server of servers) {
      try {
        await this.deleteCredentials(server);
      } catch (error) {
        errors.push(error);
      }
    }
    if (errors.length > 0) {
      throw new Error(`Failed to clear some credentials: ${errors.map((e) => e.message).join(", ")}`);
    }
  }
  // Checks whether or not a set-get-delete cycle with the keychain works.
  // Returns false if any operation fails.
  async checkKeychainAvailability() {
    if (this.keychainAvailable !== null) {
      return this.keychainAvailable;
    }
    try {
      const keytar = await this.getKeytar();
      if (!keytar) {
        this.keychainAvailable = false;
        return false;
      }
      const testAccount = `${KEYCHAIN_TEST_PREFIX}${crypto.randomBytes(8).toString("hex")}`;
      const testPassword = "test";
      await keytar.setPassword(this.serviceName, testAccount, testPassword);
      const retrieved = await keytar.getPassword(this.serviceName, testAccount);
      const deleted = await keytar.deletePassword(this.serviceName, testAccount);
      const success = deleted && retrieved === testPassword;
      this.keychainAvailable = success;
      return success;
    } catch (_error) {
      this.keychainAvailable = false;
      return false;
    }
  }
  async isAvailable() {
    return this.checkKeychainAvailability();
  }
};
export {
  KeychainTokenStorage
};
/**
 * @license
 * * Copyright 2026 Papert-code
 * SPDX-License-Identifier: Apache-2.0
 */
