@duckmind/dm-windows-x64 0.63.4 → 0.63.9

package/extensions/dm-mcp-adapter/mcp-auth.js

@@ -0,0 +1,732 @@
+import { spawnSync } from "child_process";
+import { createHash } from "crypto";
+import { createRequire } from "module";
+import { readFileSync, existsSync, rmSync } from "fs";
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
+import { getAgentPath } from "./agent-dir.js";
+import { resolveConfiguredOAuthDir } from "./config.js";
+const require = createRequire(import.meta.url);
+const AUTH_SECRET_SERVICE = "dm-mcp-adapter.oauth";
+const TEST_AUTH_STORE_ENV = "DM_MCP_ADAPTER_TEST_AUTH_STORE";
+const AUTH_SECRET_CHUNK_SIZE = 1000;
+const AUTH_SECRET_VALUE_LIMIT = 1280;
+const KEYRING_RECOVERY_DISABLED_ENV = "DM_MCP_ADAPTER_DISABLE_KEYRING_RECOVERY";
+const KEYRING_RECOVERY_KEYCTL_ENV = "DM_MCP_ADAPTER_KEYRING_RECOVERY_KEYCTL";
+const KEYRING_RECOVERY_NODE_ENV = "DM_MCP_ADAPTER_KEYRING_RECOVERY_NODE";
+const KEYRING_RECOVERY_HELPER_ENV = "DM_MCP_ADAPTER_KEYRING_RECOVERY_HELPER";
+const TEST_LINUX_KEYRING_RECOVERY_ENV = "DM_MCP_ADAPTER_TEST_LINUX_KEYRING_RECOVERY";
+const AUTH_CACHE_DISABLED_ENV = "DM_MCP_ADAPTER_DISABLE_AUTH_CACHE";
+const KEYRING_RECOVERY_TIMEOUT_MS = 1e4;
+const AUTH_CHUNK_MANIFEST_KEY = "__piMcpAdapterOAuthChunked";
+
+export class OAuthCredentialStoreError extends Error {
+  operation;
+  code = "OAUTH_CREDENTIAL_STORE_UNAVAILABLE";
+  constructor(message, operation, cause) {
+    super(message, { cause });
+    this.operation = operation;
+    this.name = "OAuthCredentialStoreError";
+  }
+}
+function causeChainContains(error, pattern) {
+  const seen = new Set;
+  let current = error;
+  while (typeof current === "object" && current !== null || typeof current === "function") {
+    if (seen.has(current))
+      break;
+    seen.add(current);
+    const candidate = current;
+    if ([candidate.name, candidate.message, candidate.code].some((value) => typeof value === "string" && pattern.test(value))) {
+      return true;
+    }
+    current = candidate.cause;
+  }
+  return false;
+}
+export function formatOAuthCredentialStoreUnavailable(error) {
+  if (process.platform === "linux" && causeChainContains(error, /key\s*(?:has been\s*)?revoked|keyrevoked/i)) {
+    return "OAuth credential store unavailable: the Linux session keyring may be revoked. Start DM from a fresh login/keyring session and retry.";
+  }
+  return "OAuth credential store unavailable. Configure or unlock the OS credential store and retry.";
+}
+let KeyringEntryClass;
+const memoryAuthEntries = new Map;
+let testAuthSecretStoreReadCount = 0;
+const authEntryCache = new Map;
+function isAuthEntryCacheEnabled() {
+  return process.env[AUTH_CACHE_DISABLED_ENV] !== "1";
+}
+function cloneAuthEntry(entry) {
+  return entry === undefined ? undefined : structuredClone(entry);
+}
+const memoryAuthSecretStore = {
+  read(account) {
+    testAuthSecretStoreReadCount++;
+    return memoryAuthEntries.get(account);
+  },
+  write(account, payload) {
+    memoryAuthEntries.set(account, payload);
+  },
+  remove(account) {
+    memoryAuthEntries.delete(account);
+  }
+};
+const keyringAuthSecretStore = {
+  read(account) {
+    return getKeyringEntry(account).getPassword() ?? undefined;
+  },
+  write(account, payload) {
+    getKeyringEntry(account).setPassword(payload);
+  },
+  remove(account) {
+    getKeyringEntry(account).deleteCredential();
+  }
+};
+const sizeLimitedAuthSecretStore = {
+  read(account) {
+    testAuthSecretStoreReadCount++;
+    return memoryAuthEntries.get(account);
+  },
+  write(account, payload) {
+    if (payload.length > AUTH_SECRET_VALUE_LIMIT) {
+      throw new Error(`Value of 'password encoded as UTF-16' is longer than the platform limit of ${AUTH_SECRET_VALUE_LIMIT * 2} chars`);
+    }
+    memoryAuthEntries.set(account, payload);
+  },
+  remove(account) {
+    memoryAuthEntries.delete(account);
+  }
+};
+const unavailableAuthSecretStore = {
+  read() {
+    testAuthSecretStoreReadCount++;
+    throw new Error("simulated secure credential store unavailable");
+  },
+  write() {
+    throw new Error("simulated secure credential store unavailable");
+  },
+  remove() {
+    throw new Error("simulated secure credential store unavailable");
+  }
+};
+function createKeyRevokedTestError() {
+  return new Error("Couldn't access platform storage: KeyRevoked", { cause: new Error("KeyRevoked") });
+}
+const keyRevokedAuthSecretStore = {
+  read() {
+    testAuthSecretStoreReadCount++;
+    throw createKeyRevokedTestError();
+  },
+  write() {
+    throw createKeyRevokedTestError();
+  },
+  remove() {
+    throw createKeyRevokedTestError();
+  }
+};
+export function resetTestAuthSecretStore() {
+  memoryAuthEntries.clear();
+  authEntryCache.clear();
+  testAuthSecretStoreReadCount = 0;
+}
+export function resetAuthEntryCache() {
+  authEntryCache.clear();
+}
+export function getTestAuthSecretStoreReadCount() {
+  return testAuthSecretStoreReadCount;
+}
+export function getTestAuthSecretStoreEntries() {
+  return [...memoryAuthEntries.entries()];
+}
+export function removeTestAuthSecretStoreEntry(account) {
+  memoryAuthEntries.delete(account);
+}
+function getAuthSecretStore() {
+  if (process.env[TEST_AUTH_STORE_ENV] === "memory")
+    return memoryAuthSecretStore;
+  if (process.env[TEST_AUTH_STORE_ENV] === "sizelimited")
+    return sizeLimitedAuthSecretStore;
+  if (process.env[TEST_AUTH_STORE_ENV] === "unavailable")
+    return unavailableAuthSecretStore;
+  if (process.env[TEST_AUTH_STORE_ENV] === "keyrevoked")
+    return keyRevokedAuthSecretStore;
+  return keyringAuthSecretStore;
+}
+function getKeyringEntry(account) {
+  try {
+    KeyringEntryClass ??= loadKeyringEntryClass();
+    return new KeyringEntryClass(AUTH_SECRET_SERVICE, account);
+  } catch (error) {
+    throw new Error("OAuth secure credential storage is unavailable. Configure the OS credential store and retry authentication.", { cause: error });
+  }
+}
+function loadKeyringEntryClass(keyringRequire = require, platform = process.platform, arch = process.arch) {
+  try {
+    return keyringRequire("@napi-rs/keyring").Entry;
+  } catch (loaderError) {
+    try {
+      return loadKeyringNativeBindingFallback(keyringRequire, platform, arch).Entry;
+    } catch (fallbackError) {
+      throw new Error(`Failed to load @napi-rs/keyring; absolute-path native binding fallback also failed: ${formatErrorMessage(fallbackError)}`, {
+        cause: loaderError
+      });
+    }
+  }
+}
+function loadKeyringNativeBindingFallback(keyringRequire, platform, arch) {
+  const targets = getKeyringNativeBindingTargets(platform, arch);
+  if (targets.length === 0) {
+    throw new Error(`Unsupported @napi-rs/keyring native binding target: ${platform}-${arch}`);
+  }
+  let lastError;
+  for (const target of targets) {
+    try {
+      const packageJsonPath = keyringRequire.resolve(`${target.packageName}/package.json`);
+      return keyringRequire(join(dirname(packageJsonPath), target.bindingFile));
+    } catch (error) {
+      lastError = error;
+    }
+  }
+  throw lastError instanceof Error ? lastError : new Error(String(lastError));
+}
+function getKeyringNativeBindingTargets(platform, arch) {
+  return getKeyringNativeBindingSuffixes(platform, arch).map((suffix) => ({
+    packageName: `@napi-rs/keyring-${suffix}`,
+    bindingFile: `keyring.${suffix}.node`
+  }));
+}
+function getKeyringNativeBindingSuffixes(platform, arch) {
+  if (platform === "darwin") {
+    if (arch === "arm64")
+      return ["darwin-arm64"];
+    if (arch === "x64")
+      return ["darwin-x64"];
+  }
+  if (platform === "win32") {
+    if (arch === "arm64")
+      return ["win32-arm64-msvc"];
+    if (arch === "x64")
+      return ["win32-x64-msvc"];
+    if (arch === "ia32")
+      return ["win32-ia32-msvc"];
+  }
+  if (platform === "linux") {
+    if (arch === "arm64")
+      return ["linux-arm64-gnu", "linux-arm64-musl"];
+    if (arch === "arm")
+      return ["linux-arm-gnueabihf"];
+    if (arch === "riscv64")
+      return ["linux-riscv64-gnu"];
+    if (arch === "x64")
+      return ["linux-x64-gnu", "linux-x64-musl"];
+  }
+  if (platform === "freebsd" && arch === "x64")
+    return ["freebsd-x64"];
+  return [];
+}
+function formatErrorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function isLinuxKeyringRecoveryEnabled() {
+  if (process.env[KEYRING_RECOVERY_DISABLED_ENV] === "1")
+    return false;
+  return process.platform === "linux" || process.env[TEST_LINUX_KEYRING_RECOVERY_ENV] === "1";
+}
+function shouldAttemptLinuxKeyringRecovery(error) {
+  return isLinuxKeyringRecoveryEnabled() && causeChainContains(error, /key\s*(?:has been\s*)?revoked|keyrevoked/i);
+}
+function runLinuxKeyringRecoveryOperation(operation, account, payload) {
+  const keyctl = process.env[KEYRING_RECOVERY_KEYCTL_ENV]?.trim() || "keyctl";
+  const node = process.env[KEYRING_RECOVERY_NODE_ENV]?.trim() || "node";
+  const helper = process.env[KEYRING_RECOVERY_HELPER_ENV]?.trim() || fileURLToPath(new URL("./mcp-keyring-helper.cjs", import.meta.url));
+  const request = JSON.stringify({ operation, service: AUTH_SECRET_SERVICE, account, payload });
+  const result = spawnSync(keyctl, ["session", "-", node, helper], {
+    input: `${request}
+`,
+    encoding: "utf8",
+    maxBuffer: 1024 * 1024,
+    timeout: KEYRING_RECOVERY_TIMEOUT_MS,
+    windowsHide: true
+  });
+  if (result.error) {
+    throw new Error(`Linux keyring recovery helper could not start: ${result.error.message}`, { cause: result.error });
+  }
+  if (result.status !== 0) {
+    throw new Error(`Linux keyring recovery helper failed with exit code ${result.status ?? "unknown"}`);
+  }
+  let response;
+  try {
+    response = JSON.parse(result.stdout.trim());
+  } catch (error) {
+    throw new Error("Linux keyring recovery helper returned invalid JSON", { cause: error });
+  }
+  if (typeof response !== "object" || response === null || typeof response.ok !== "boolean") {
+    throw new Error("Linux keyring recovery helper returned an invalid response");
+  }
+  const typedResponse = response;
+  if (typedResponse.ok === false) {
+    throw new Error(typedResponse.error || "Linux keyring recovery helper failed");
+  }
+  if (operation === "read" && typedResponse.found === true && typeof typedResponse.value !== "string") {
+    throw new Error("Linux keyring recovery helper returned an invalid read response");
+  }
+  return typedResponse;
+}
+const linuxKeyringRecoveryAuthSecretStore = {
+  read(account) {
+    const response = runLinuxKeyringRecoveryOperation("read", account);
+    return response.ok && response.found === true ? response.value : undefined;
+  },
+  write(account, payload) {
+    runLinuxKeyringRecoveryOperation("write", account, payload);
+  },
+  remove(account) {
+    runLinuxKeyringRecoveryOperation("remove", account);
+  }
+};
+export function loadTestKeyringEntryClass(keyringRequire, platform, arch) {
+  return loadKeyringEntryClass(keyringRequire, platform, arch);
+}
+export function getAuthStorageOptions(oauthDir, cwd = process.cwd()) {
+  const baseDir = resolveConfiguredOAuthDir(oauthDir, cwd);
+  return baseDir ? { baseDir } : {};
+}
+export function getAuthBaseDir(options = {}) {
+  const override = process.env.MCP_OAUTH_DIR?.trim();
+  if (override)
+    return override;
+  return options.baseDir ?? getAgentPath("mcp-oauth");
+}
+function getServerDir(serverName, options) {
+  if (typeof serverName !== "string") {
+    throw new Error(`Invalid MCP server name: ${JSON.stringify(serverName)}`);
+  }
+  const storageKey = getAuthEntryAccount(serverName);
+  return join(getAuthBaseDir(options), storageKey);
+}
+function getAuthEntryAccount(serverName) {
+  if (typeof serverName !== "string") {
+    throw new Error(`Invalid MCP server name: ${JSON.stringify(serverName)}`);
+  }
+  return `sha256-${createHash("sha256").update(serverName, "utf8").digest("hex")}`;
+}
+export function getAuthEntryFilePath(serverName, options) {
+  return join(getServerDir(serverName, options), "tokens.json");
+}
+function parseJsonPayload(serverName, payload, source) {
+  try {
+    return JSON.parse(payload);
+  } catch (error) {
+    throw new Error(`Failed to parse OAuth credentials for ${serverName} from ${source}`, { cause: error });
+  }
+}
+function parseAuthEntryPayload(serverName, payload, source) {
+  const parsed = parseJsonPayload(serverName, payload, source);
+  const entry = toAuthEntry(parsed);
+  if (!entry) {
+    throw new Error(`Failed to parse OAuth credentials for ${serverName} from ${source}: invalid credential shape`);
+  }
+  return entry;
+}
+function toAuthEntry(value) {
+  const entry = toRecord(value);
+  if (!entry)
+    return;
+  const codeVerifier = optionalString(entry.codeVerifier);
+  const oauthState = optionalString(entry.oauthState);
+  const serverUrl = optionalString(entry.serverUrl);
+  if (codeVerifier === null || oauthState === null || serverUrl === null)
+    return;
+  const tokens = entry.tokens === undefined ? undefined : toStoredTokens(entry.tokens);
+  const clientInfo = entry.clientInfo === undefined ? undefined : toStoredClientInfo(entry.clientInfo);
+  if (entry.tokens !== undefined && !tokens || entry.clientInfo !== undefined && !clientInfo)
+    return;
+  const authEntry = {};
+  if (tokens)
+    authEntry.tokens = tokens;
+  if (clientInfo)
+    authEntry.clientInfo = clientInfo;
+  if (codeVerifier !== undefined)
+    authEntry.codeVerifier = codeVerifier;
+  if (oauthState !== undefined)
+    authEntry.oauthState = oauthState;
+  if (serverUrl !== undefined)
+    authEntry.serverUrl = serverUrl;
+  return authEntry;
+}
+function toStoredTokens(value) {
+  const tokens = toRecord(value);
+  if (!tokens || typeof tokens.accessToken !== "string")
+    return;
+  const refreshToken = optionalString(tokens.refreshToken);
+  const scope = optionalString(tokens.scope);
+  const issuer = optionalString(tokens.issuer);
+  const expiresAt = optionalNumber(tokens.expiresAt);
+  if (refreshToken === null || scope === null || issuer === null || expiresAt === null)
+    return;
+  const storedTokens = { accessToken: tokens.accessToken };
+  if (refreshToken !== undefined)
+    storedTokens.refreshToken = refreshToken;
+  if (expiresAt !== undefined)
+    storedTokens.expiresAt = expiresAt;
+  if (scope !== undefined)
+    storedTokens.scope = scope;
+  if (issuer !== undefined)
+    storedTokens.issuer = issuer;
+  return storedTokens;
+}
+function toStoredClientInfo(value) {
+  const clientInfo = toRecord(value);
+  if (!clientInfo || typeof clientInfo.clientId !== "string")
+    return;
+  const clientSecret = optionalString(clientInfo.clientSecret);
+  const issuer = optionalString(clientInfo.issuer);
+  const clientIdIssuedAt = optionalNumber(clientInfo.clientIdIssuedAt);
+  const clientSecretExpiresAt = optionalNumber(clientInfo.clientSecretExpiresAt);
+  const configPreRegistered = optionalBoolean(clientInfo.configPreRegistered);
+  if (clientSecret === null || issuer === null || clientIdIssuedAt === null || clientSecretExpiresAt === null || configPreRegistered === null)
+    return;
+  const storedClient = { clientId: clientInfo.clientId };
+  const redirectUris = stringArray(clientInfo.redirectUris);
+  if (clientSecret !== undefined)
+    storedClient.clientSecret = clientSecret;
+  if (clientIdIssuedAt !== undefined)
+    storedClient.clientIdIssuedAt = clientIdIssuedAt;
+  if (clientSecretExpiresAt !== undefined)
+    storedClient.clientSecretExpiresAt = clientSecretExpiresAt;
+  if (redirectUris !== undefined)
+    storedClient.redirectUris = redirectUris;
+  if (issuer !== undefined)
+    storedClient.issuer = issuer;
+  if (configPreRegistered !== undefined)
+    storedClient.configPreRegistered = configPreRegistered;
+  return storedClient;
+}
+function toRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : undefined;
+}
+function optionalString(value) {
+  if (value === undefined)
+    return;
+  return typeof value === "string" ? value : null;
+}
+function optionalNumber(value) {
+  if (value === undefined)
+    return;
+  return typeof value === "number" ? value : null;
+}
+function optionalBoolean(value) {
+  if (value === undefined)
+    return;
+  return typeof value === "boolean" ? value : null;
+}
+function stringArray(value) {
+  return Array.isArray(value) && value.every((uri) => typeof uri === "string") ? value : undefined;
+}
+function isAuthEntryChunkManifest(value) {
+  if (typeof value !== "object" || value === null)
+    return false;
+  const manifest = value;
+  return manifest[AUTH_CHUNK_MANIFEST_KEY] === 1 && typeof manifest.chunkCount === "number" && Number.isInteger(manifest.chunkCount) && manifest.chunkCount > 0 && typeof manifest.chunkDigest === "string" && /^[a-f0-9]{16}$/.test(manifest.chunkDigest);
+}
+function getAuthEntryChunkAccount(account, manifest, index) {
+  return `${account}.chunk.${manifest.chunkDigest}.${index}`;
+}
+function getAuthEntryChunkAccounts(account, manifest) {
+  return Array.from({ length: manifest.chunkCount }, (_, index) => getAuthEntryChunkAccount(account, manifest, index));
+}
+function readChunkManifestFromPayload(serverName, payload, source) {
+  const parsed = parseJsonPayload(serverName, payload, source);
+  return isAuthEntryChunkManifest(parsed) ? parsed : undefined;
+}
+function readExistingChunkManifest(store, serverName, account) {
+  try {
+    const payload = store.read(account);
+    return payload === undefined ? undefined : readChunkManifestFromPayload(serverName, payload, "OS secure credential store");
+  } catch {
+    return;
+  }
+}
+function removeChunkPayloads(store, account, manifest) {
+  for (const chunkAccount of getAuthEntryChunkAccounts(account, manifest)) {
+    store.remove(chunkAccount);
+  }
+}
+function tryRemoveChunkPayloads(store, account, manifest) {
+  if (!manifest)
+    return;
+  try {
+    removeChunkPayloads(store, account, manifest);
+  } catch {}
+}
+function createChunkManifest(payload) {
+  return {
+    [AUTH_CHUNK_MANIFEST_KEY]: 1,
+    chunkCount: Math.ceil(payload.length / AUTH_SECRET_CHUNK_SIZE),
+    chunkDigest: createHash("sha256").update(payload, "utf8").digest("hex").slice(0, 16)
+  };
+}
+function readChunkedAuthEntry(store, serverName, account, manifest) {
+  const chunks = getAuthEntryChunkAccounts(account, manifest).map((chunkAccount) => {
+    try {
+      const chunk = store.read(chunkAccount);
+      if (chunk === undefined) {
+        throw new Error(`Missing OAuth credential chunk ${chunkAccount} for ${serverName}`);
+      }
+      return chunk;
+    } catch (error) {
+      throw new OAuthCredentialStoreError(`Failed to read OAuth credentials for ${serverName} from the OS secure credential store`, "read", error);
+    }
+  });
+  return parseAuthEntryPayload(serverName, chunks.join(""), "OS secure credential store chunks");
+}
+function readLegacyAuthEntry(serverName, options) {
+  const filePath = getAuthEntryFilePath(serverName, options);
+  if (!existsSync(filePath))
+    return;
+  const data = readFileSync(filePath, "utf-8");
+  return parseAuthEntryPayload(serverName, data, filePath);
+}
+function removeLegacyAuthEntry(serverName, options) {
+  const filePath = getAuthEntryFilePath(serverName, options);
+  if (!existsSync(filePath))
+    return;
+  try {
+    rmSync(filePath, { force: true });
+  } catch (error) {
+    throw new Error(`Failed to remove legacy plaintext OAuth credentials for ${serverName} at ${filePath}`, { cause: error });
+  }
+  const dir = getServerDir(serverName, options);
+  try {
+    rmSync(dir, { recursive: true });
+  } catch {}
+}
+function writeSecureAuthEntryToStore(store, serverName, entry) {
+  const account = getAuthEntryAccount(serverName);
+  const payload = JSON.stringify(entry);
+  const previousManifest = readExistingChunkManifest(store, serverName, account);
+  const manifest = payload.length > AUTH_SECRET_CHUNK_SIZE ? createChunkManifest(payload) : undefined;
+  try {
+    if (manifest) {
+      for (let index = 0;index < manifest.chunkCount; index++) {
+        const chunk = payload.slice(index * AUTH_SECRET_CHUNK_SIZE, (index + 1) * AUTH_SECRET_CHUNK_SIZE);
+        store.write(getAuthEntryChunkAccount(account, manifest, index), chunk);
+      }
+      store.write(account, JSON.stringify(manifest));
+    } else {
+      store.write(account, payload);
+    }
+    if (previousManifest?.chunkDigest !== manifest?.chunkDigest) {
+      tryRemoveChunkPayloads(store, account, previousManifest);
+    }
+  } catch (error) {
+    tryRemoveChunkPayloads(store, account, manifest);
+    throw new OAuthCredentialStoreError(`Failed to write OAuth credentials for ${serverName} to the OS secure credential store`, "write", error);
+  }
+  publishAuthEntryToCache(serverName, payload);
+}
+function publishAuthEntryToCache(serverName, payload) {
+  if (!isAuthEntryCacheEnabled())
+    return;
+  const normalized = toAuthEntry(JSON.parse(payload));
+  if (!normalized) {
+    authEntryCache.delete(serverName);
+    return;
+  }
+  authEntryCache.set(serverName, cloneAuthEntry(normalized));
+}
+function writeSecureAuthEntry(serverName, entry) {
+  try {
+    writeSecureAuthEntryToStore(getAuthSecretStore(), serverName, entry);
+  } catch (error) {
+    if (!shouldAttemptLinuxKeyringRecovery(error))
+      throw error;
+    writeSecureAuthEntryToStore(linuxKeyringRecoveryAuthSecretStore, serverName, entry);
+  }
+}
+function readAuthEntryFromStore(store, serverName, options, behavior = {}) {
+  const account = getAuthEntryAccount(serverName);
+  let payload;
+  try {
+    payload = store.read(account);
+  } catch (error) {
+    throw new OAuthCredentialStoreError(`Failed to read OAuth credentials for ${serverName} from the OS secure credential store`, "read", error);
+  }
+  if (payload !== undefined) {
+    const manifest = readChunkManifestFromPayload(serverName, payload, "OS secure credential store");
+    const entry = manifest ? readChunkedAuthEntry(store, serverName, account, manifest) : parseAuthEntryPayload(serverName, payload, "OS secure credential store");
+    removeLegacyAuthEntry(serverName, options);
+    return entry;
+  }
+  const legacyEntry = readLegacyAuthEntry(serverName, options);
+  if (!legacyEntry)
+    return;
+  if (behavior.migrateLegacy === false)
+    return legacyEntry;
+  writeSecureAuthEntryToStore(store, serverName, legacyEntry);
+  removeLegacyAuthEntry(serverName, options);
+  return legacyEntry;
+}
+function readAuthEntry(serverName, options, behavior = {}) {
+  const cacheable = behavior.migrateLegacy !== false && isAuthEntryCacheEnabled();
+  if (cacheable && authEntryCache.has(serverName)) {
+    return cloneAuthEntry(authEntryCache.get(serverName));
+  }
+  let entry;
+  try {
+    entry = readAuthEntryFromStore(getAuthSecretStore(), serverName, options, behavior);
+  } catch (error) {
+    if (!shouldAttemptLinuxKeyringRecovery(error))
+      throw error;
+    entry = readAuthEntryFromStore(linuxKeyringRecoveryAuthSecretStore, serverName, options, behavior);
+  }
+  if (cacheable)
+    authEntryCache.set(serverName, cloneAuthEntry(entry));
+  return entry;
+}
+export function getAuthEntry(serverName, options) {
+  return readAuthEntry(serverName, options);
+}
+export function getAuthForUrl(serverName, serverUrl, options) {
+  const entry = getAuthEntry(serverName, options);
+  if (!entry)
+    return;
+  if (!entry.serverUrl)
+    return;
+  if (entry.serverUrl !== serverUrl)
+    return;
+  return entry;
+}
+export function inspectAuthForUrl(serverName, serverUrl, options) {
+  try {
+    const entry = readAuthEntry(serverName, options, { migrateLegacy: false });
+    if (!entry?.serverUrl || entry.serverUrl !== serverUrl)
+      return { status: "absent" };
+    return { status: "present", entry };
+  } catch (error) {
+    if (!(error instanceof OAuthCredentialStoreError))
+      throw error;
+    return { status: "unavailable", message: formatOAuthCredentialStoreUnavailable(error) };
+  }
+}
+export function saveAuthEntry(serverName, entry, serverUrl, options) {
+  if (serverUrl) {
+    entry.serverUrl = serverUrl;
+  }
+  writeSecureAuthEntry(serverName, entry);
+  removeLegacyAuthEntry(serverName, options);
+}
+function removeAuthEntryFromStore(store, serverName) {
+  const account = getAuthEntryAccount(serverName);
+  try {
+    const payload = store.read(account);
+    const manifest = payload === undefined ? undefined : readChunkManifestFromPayload(serverName, payload, "OS secure credential store");
+    if (manifest)
+      removeChunkPayloads(store, account, manifest);
+    store.remove(account);
+  } catch (error) {
+    throw new OAuthCredentialStoreError(`Failed to remove OAuth credentials for ${serverName} from the OS secure credential store`, "remove", error);
+  }
+}
+export function removeAuthEntry(serverName, options) {
+  try {
+    removeAuthEntryFromStore(getAuthSecretStore(), serverName);
+  } catch (error) {
+    if (!shouldAttemptLinuxKeyringRecovery(error))
+      throw error;
+    removeAuthEntryFromStore(linuxKeyringRecoveryAuthSecretStore, serverName);
+  }
+  authEntryCache.delete(serverName);
+  removeLegacyAuthEntry(serverName, options);
+}
+export function invalidateAuthEntryCache(serverName) {
+  authEntryCache.delete(serverName);
+}
+export function updateTokens(serverName, tokens, serverUrl, options) {
+  const entry = getAuthEntry(serverName, options) ?? {};
+  if (serverUrl && entry.serverUrl !== serverUrl) {
+    delete entry.clientInfo;
+    delete entry.codeVerifier;
+    delete entry.oauthState;
+  }
+  entry.tokens = tokens;
+  saveAuthEntry(serverName, entry, serverUrl, options);
+}
+export function updateClientInfo(serverName, clientInfo, serverUrl, options) {
+  const entry = getAuthEntry(serverName, options) ?? {};
+  if (serverUrl && entry.serverUrl !== serverUrl) {
+    delete entry.tokens;
+    delete entry.codeVerifier;
+    delete entry.oauthState;
+  }
+  entry.clientInfo = clientInfo;
+  saveAuthEntry(serverName, entry, serverUrl, options);
+}
+export function updateCodeVerifier(serverName, codeVerifier, serverUrl, options) {
+  const entry = getAuthEntry(serverName, options) ?? {};
+  if (serverUrl && entry.serverUrl !== serverUrl) {
+    delete entry.tokens;
+    delete entry.clientInfo;
+    delete entry.oauthState;
+  }
+  entry.codeVerifier = codeVerifier;
+  saveAuthEntry(serverName, entry, serverUrl, options);
+}
+export function clearCodeVerifier(serverName, options) {
+  const entry = getAuthEntry(serverName, options);
+  if (entry) {
+    delete entry.codeVerifier;
+    saveAuthEntry(serverName, entry, undefined, options);
+  }
+}
+export function updateOAuthState(serverName, state, serverUrl, options) {
+  const entry = getAuthEntry(serverName, options) ?? {};
+  if (serverUrl && entry.serverUrl !== serverUrl) {
+    delete entry.tokens;
+    delete entry.clientInfo;
+    delete entry.codeVerifier;
+  }
+  entry.oauthState = state;
+  saveAuthEntry(serverName, entry, serverUrl, options);
+}
+export function getOAuthState(serverName, options) {
+  const entry = getAuthEntry(serverName, options);
+  return entry?.oauthState;
+}
+export function clearOAuthState(serverName, options) {
+  const entry = getAuthEntry(serverName, options);
+  if (entry) {
+    delete entry.oauthState;
+    saveAuthEntry(serverName, entry, undefined, options);
+  }
+}
+export function isTokenExpired(serverName, options) {
+  const entry = getAuthEntry(serverName, options);
+  if (!entry?.tokens)
+    return null;
+  if (!entry.tokens.expiresAt)
+    return false;
+  return entry.tokens.expiresAt < Date.now() / 1000;
+}
+export function hasStoredTokens(serverName, options) {
+  const entry = getAuthEntry(serverName, options);
+  return !!entry?.tokens;
+}
+export function clearAllCredentials(serverName, options) {
+  removeAuthEntry(serverName, options);
+}
+export function clearClientInfo(serverName, options) {
+  const entry = getAuthEntry(serverName, options);
+  if (entry) {
+    delete entry.clientInfo;
+    saveAuthEntry(serverName, entry, undefined, options);
+  }
+}
+export function clearTokens(serverName, options) {
+  const entry = getAuthEntry(serverName, options);
+  if (entry) {
+    delete entry.tokens;
+    saveAuthEntry(serverName, entry, undefined, options);
+  }
+}