@duckmind/dm-windows-x64 0.63.6 → 0.63.9

package/extensions/dm-mcp-adapter/mcp-bearer-store.js

@@ -0,0 +1,311 @@
+import { createHash } from "node:crypto";
+import { createRequire } from "node:module";
+import { dirname, join } from "node:path";
+const require = createRequire(import.meta.url);
+const BEARER_SECRET_SERVICE = "dm-mcp-adapter.bearer";
+const TEST_AUTH_STORE_ENV = "DM_MCP_ADAPTER_TEST_AUTH_STORE";
+const BEARER_SECRET_CHUNK_SIZE = 1000;
+const BEARER_SECRET_VALUE_LIMIT = 1280;
+let KeyringEntryClass;
+const memoryBearerEntries = new Map;
+let testBearerSecretStoreReadCount = 0;
+
+export class BearerCredentialStoreError extends Error {
+  code = "BEARER_CREDENTIAL_STORE_UNAVAILABLE";
+  operation;
+  constructor(message, operation, cause) {
+    super(message, { cause });
+    this.name = "BearerCredentialStoreError";
+    this.operation = operation;
+  }
+}
+const memoryBearerSecretStore = {
+  read(account) {
+    testBearerSecretStoreReadCount++;
+    return memoryBearerEntries.get(account);
+  },
+  write(account, payload) {
+    memoryBearerEntries.set(account, payload);
+  },
+  remove(account) {
+    memoryBearerEntries.delete(account);
+  }
+};
+const sizeLimitedBearerSecretStore = {
+  read(account) {
+    testBearerSecretStoreReadCount++;
+    return memoryBearerEntries.get(account);
+  },
+  write(account, payload) {
+    if (payload.length > BEARER_SECRET_VALUE_LIMIT) {
+      throw new Error(`Value of 'password encoded as UTF-16' is longer than the platform limit of ${BEARER_SECRET_VALUE_LIMIT * 2} chars`);
+    }
+    memoryBearerEntries.set(account, payload);
+  },
+  remove(account) {
+    memoryBearerEntries.delete(account);
+  }
+};
+const unavailableBearerSecretStore = {
+  read() {
+    testBearerSecretStoreReadCount++;
+    throw new Error("simulated secure credential store unavailable");
+  },
+  write() {
+    throw new Error("simulated secure credential store unavailable");
+  },
+  remove() {
+    throw new Error("simulated secure credential store unavailable");
+  }
+};
+const keyringBearerSecretStore = {
+  read(account) {
+    return getKeyringEntry(account).getPassword() ?? undefined;
+  },
+  write(account, payload) {
+    getKeyringEntry(account).setPassword(payload);
+  },
+  remove(account) {
+    getKeyringEntry(account).deleteCredential();
+  }
+};
+function getBearerSecretStore() {
+  if (process.env[TEST_AUTH_STORE_ENV] === "memory")
+    return memoryBearerSecretStore;
+  if (process.env[TEST_AUTH_STORE_ENV] === "sizelimited")
+    return sizeLimitedBearerSecretStore;
+  if (process.env[TEST_AUTH_STORE_ENV] === "unavailable")
+    return unavailableBearerSecretStore;
+  return keyringBearerSecretStore;
+}
+function getKeyringEntry(account) {
+  try {
+    KeyringEntryClass ??= loadKeyringEntryClass();
+    return new KeyringEntryClass(BEARER_SECRET_SERVICE, account);
+  } catch (error) {
+    throw new Error("Bearer token secure credential storage is unavailable. Configure the OS credential store and retry.", { cause: error });
+  }
+}
+function loadKeyringEntryClass(keyringRequire = require, platform = process.platform, arch = process.arch) {
+  try {
+    return keyringRequire("@napi-rs/keyring").Entry;
+  } catch (loaderError) {
+    try {
+      return loadKeyringNativeBindingFallback(keyringRequire, platform, arch).Entry;
+    } catch (fallbackError) {
+      const message = fallbackError instanceof Error ? fallbackError.message : String(fallbackError);
+      throw new Error(`Failed to load @napi-rs/keyring; absolute-path native binding fallback also failed: ${message}`, { cause: loaderError });
+    }
+  }
+}
+function loadKeyringNativeBindingFallback(keyringRequire, platform, arch) {
+  const targets = getKeyringNativeBindingSuffixes(platform, arch).map((suffix) => ({
+    packageName: `@napi-rs/keyring-${suffix}`,
+    bindingFile: `keyring.${suffix}.node`
+  }));
+  let lastError;
+  for (const target of targets) {
+    try {
+      const packageJsonPath = keyringRequire.resolve(`${target.packageName}/package.json`);
+      return keyringRequire(join(dirname(packageJsonPath), target.bindingFile));
+    } catch (error) {
+      lastError = error;
+    }
+  }
+  throw lastError instanceof Error ? lastError : new Error(String(lastError));
+}
+function getKeyringNativeBindingSuffixes(platform, arch) {
+  if (platform === "darwin") {
+    if (arch === "arm64")
+      return ["darwin-arm64"];
+    if (arch === "x64")
+      return ["darwin-x64"];
+  }
+  if (platform === "win32") {
+    if (arch === "arm64")
+      return ["win32-arm64-msvc"];
+    if (arch === "x64")
+      return ["win32-x64-msvc"];
+    if (arch === "ia32")
+      return ["win32-ia32-msvc"];
+  }
+  if (platform === "linux") {
+    if (arch === "arm64")
+      return ["linux-arm64-gnu", "linux-arm64-musl"];
+    if (arch === "arm")
+      return ["linux-arm-gnueabihf"];
+    if (arch === "riscv64")
+      return ["linux-riscv64-gnu"];
+    if (arch === "x64")
+      return ["linux-x64-gnu", "linux-x64-musl"];
+  }
+  if (platform === "freebsd" && arch === "x64")
+    return ["freebsd-x64"];
+  return [];
+}
+function getBearerAccount(serverName) {
+  if (typeof serverName !== "string") {
+    throw new Error(`Invalid MCP server name: ${JSON.stringify(serverName)}`);
+  }
+  return `sha256-${createHash("sha256").update(serverName, "utf8").digest("hex")}`;
+}
+function parseBearerPayload(serverName, payload) {
+  const parsed = parseStoredBearerJson(serverName, payload);
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new Error(`Stored bearer token record for ${serverName} has invalid shape`);
+  }
+  const record = parsed;
+  if (typeof record.token !== "string" || typeof record.serverUrl !== "string") {
+    throw new Error(`Stored bearer token record for ${serverName} has invalid shape`);
+  }
+  return { token: record.token, serverUrl: record.serverUrl };
+}
+function parseStoredBearerJson(serverName, payload) {
+  try {
+    return JSON.parse(payload);
+  } catch {
+    throw new Error(`Failed to parse stored bearer token record for ${serverName}`);
+  }
+}
+function isBearerChunkManifest(value) {
+  if (typeof value !== "object" || value === null)
+    return false;
+  const manifest = value;
+  return manifest.__piMcpAdapterBearerChunked === 1 && typeof manifest.chunkCount === "number" && Number.isInteger(manifest.chunkCount) && manifest.chunkCount > 0 && typeof manifest.chunkDigest === "string" && /^[a-f0-9]{16}$/.test(manifest.chunkDigest);
+}
+function readManifest(serverName, payload) {
+  const parsed = parseStoredBearerJson(serverName, payload);
+  return isBearerChunkManifest(parsed) ? parsed : undefined;
+}
+function chunkAccount(account, manifest, index) {
+  return `${account}.chunk.${manifest.chunkDigest}.${index}`;
+}
+function chunkAccounts(account, manifest) {
+  return Array.from({ length: manifest.chunkCount }, (_, index) => chunkAccount(account, manifest, index));
+}
+function createManifest(payload) {
+  return {
+    __piMcpAdapterBearerChunked: 1,
+    chunkCount: Math.ceil(payload.length / BEARER_SECRET_CHUNK_SIZE),
+    chunkDigest: createHash("sha256").update(payload, "utf8").digest("hex").slice(0, 16)
+  };
+}
+function readExistingManifest(store, serverName, account) {
+  try {
+    const payload = store.read(account);
+    return payload === undefined ? undefined : readManifest(serverName, payload);
+  } catch {
+    return;
+  }
+}
+function removeChunks(store, account, manifest) {
+  if (!manifest)
+    return;
+  for (const accountName of chunkAccounts(account, manifest))
+    store.remove(accountName);
+}
+function tryRemoveChunks(store, account, manifest) {
+  try {
+    removeChunks(store, account, manifest);
+  } catch {}
+}
+function readBearerRecordFromStore(store, serverName) {
+  const account = getBearerAccount(serverName);
+  let payload;
+  try {
+    payload = store.read(account);
+  } catch (error) {
+    throw new BearerCredentialStoreError(`Failed to read bearer token for ${serverName} from the OS secure credential store`, "read", error);
+  }
+  if (payload === undefined)
+    return;
+  try {
+    const manifest = readManifest(serverName, payload);
+    const recordPayload = manifest ? chunkAccounts(account, manifest).map((chunkName) => {
+      const chunk = store.read(chunkName);
+      if (chunk === undefined)
+        throw new Error(`Missing bearer token chunk for ${serverName}`);
+      return chunk;
+    }).join("") : payload;
+    return parseBearerPayload(serverName, recordPayload);
+  } catch (error) {
+    throw new BearerCredentialStoreError(`Failed to read bearer token for ${serverName} from the OS secure credential store`, "read", error);
+  }
+}
+function writeBearerRecordToStore(store, serverName, record) {
+  const account = getBearerAccount(serverName);
+  const payload = JSON.stringify(record);
+  const previousManifest = readExistingManifest(store, serverName, account);
+  const manifest = payload.length > BEARER_SECRET_CHUNK_SIZE ? createManifest(payload) : undefined;
+  try {
+    if (manifest) {
+      for (let index = 0;index < manifest.chunkCount; index++) {
+        store.write(chunkAccount(account, manifest, index), payload.slice(index * BEARER_SECRET_CHUNK_SIZE, (index + 1) * BEARER_SECRET_CHUNK_SIZE));
+      }
+      store.write(account, JSON.stringify(manifest));
+    } else {
+      store.write(account, payload);
+    }
+    if (previousManifest?.chunkDigest !== manifest?.chunkDigest) {
+      tryRemoveChunks(store, account, previousManifest);
+    }
+  } catch (error) {
+    if (previousManifest?.chunkDigest !== manifest?.chunkDigest) {
+      tryRemoveChunks(store, account, manifest);
+    }
+    throw new BearerCredentialStoreError(`Failed to write bearer token for ${serverName} to the OS secure credential store`, "write", error);
+  }
+}
+function removeBearerRecordFromStore(store, serverName) {
+  const account = getBearerAccount(serverName);
+  try {
+    const payload = store.read(account);
+    const manifest = payload === undefined ? undefined : readManifest(serverName, payload);
+    removeChunks(store, account, manifest);
+    store.remove(account);
+  } catch (error) {
+    throw new BearerCredentialStoreError(`Failed to remove bearer token for ${serverName} from the OS secure credential store`, "remove", error);
+  }
+}
+export function getBearerTokenForUrl(serverName, serverUrl) {
+  const record = readBearerRecordFromStore(getBearerSecretStore(), serverName);
+  if (!record)
+    return;
+  return record.serverUrl === serverUrl ? record.token : undefined;
+}
+export function saveBearerTokenForUrl(serverName, token, serverUrl) {
+  writeBearerRecordToStore(getBearerSecretStore(), serverName, { token, serverUrl });
+}
+export function removeBearerToken(serverName) {
+  removeBearerRecordFromStore(getBearerSecretStore(), serverName);
+}
+export function inspectBearerTokenForUrl(serverName, serverUrl) {
+  try {
+    const record = readBearerRecordFromStore(getBearerSecretStore(), serverName);
+    if (!record)
+      return { status: "missing" };
+    if (record.serverUrl !== serverUrl)
+      return { status: "url-mismatch" };
+    return { status: "present" };
+  } catch (error) {
+    if (!(error instanceof BearerCredentialStoreError))
+      throw error;
+    return { status: "unavailable", message: "Bearer token secure credential store unavailable. Configure or unlock the OS credential store and retry." };
+  }
+}
+export function resetTestBearerTokenStore() {
+  memoryBearerEntries.clear();
+  testBearerSecretStoreReadCount = 0;
+}
+export function getTestBearerTokenStoreEntries() {
+  return [...memoryBearerEntries.entries()];
+}
+export function removeTestBearerTokenStoreEntry(account) {
+  memoryBearerEntries.delete(account);
+}
+export function setTestBearerTokenStoreEntry(account, payload) {
+  memoryBearerEntries.set(account, payload);
+}
+export function getTestBearerTokenStoreReadCount() {
+  return testBearerSecretStoreReadCount;
+}

package/extensions/dm-mcp-adapter/mcp-callback-server.js

@@ -0,0 +1,388 @@
+import { createServer } from "http";
+import { getAppName } from "./agent-dir.js";
+import {
+  DEFAULT_OAUTH_CALLBACK_PATH,
+  getConfiguredOAuthCallbackPort,
+  getOAuthCallbackPath,
+  getOAuthCallbackPort,
+  setOAuthCallbackPath,
+  setOAuthCallbackPort
+} from "./mcp-oauth-provider.js";
+const PAGE_STYLE = `
+    :root { color-scheme: light dark; }
+    * { box-sizing: border-box; }
+    body {
+      margin: 0;
+      min-height: 100vh;
+      display: flex;
+      align-items: center;
+      justify-content: center;
+      padding: 24px;
+      font: 15px/1.55 ui-sans-serif, system-ui, -apple-system, "Segoe UI", sans-serif;
+      background: #0f1117;
+      color: #e6e8ee;
+    }
+    .card {
+      width: 100%;
+      max-width: 26rem;
+      padding: 2.5rem 2rem;
+      text-align: center;
+      background: #161922;
+      border: 1px solid #242938;
+      border-radius: 14px;
+      box-shadow: 0 1px 2px rgba(0,0,0,.3), 0 12px 32px rgba(0,0,0,.25);
+    }
+    .badge {
+      width: 3rem; height: 3rem;
+      margin: 0 auto 1.25rem;
+      display: grid; place-items: center;
+      border-radius: 50%;
+    }
+    .badge svg { width: 1.5rem; height: 1.5rem; display: block; }
+    .ok   { background: rgba(74,222,128,.12); color: #4ade80; }
+    .bad  { background: rgba(248,113,113,.12); color: #f87171; }
+    h1 { margin: 0 0 .5rem; font-size: 1.15rem; font-weight: 600; letter-spacing: -0.01em; }
+    p  { margin: 0; color: #9aa1b1; }
+    .app { color: #e6e8ee; font-weight: 500; }
+    .hint { margin-top: 1.25rem; font-size: .8125rem; color: #6b7280; }
+    code {
+      display: block;
+      margin-top: 1.25rem;
+      padding: .75rem .875rem;
+      text-align: left;
+      font: 12px/1.5 ui-monospace, SFMono-Regular, Menlo, monospace;
+      color: #fca5a5;
+      background: rgba(248,113,113,.08);
+      border: 1px solid rgba(248,113,113,.2);
+      border-radius: 8px;
+      overflow-wrap: anywhere;
+    }
+    @media (prefers-color-scheme: light) {
+      body { background: #f6f7f9; color: #121620; }
+      .card { background: #fff; border-color: #e4e7ee; }
+      p { color: #5b6474; }
+      .app { color: #121620; }
+      .hint { color: #8b93a3; }
+    }`;
+const CHECK_ICON = '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M20 6 9 17l-5-5"/></svg>';
+const CROSS_ICON = '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M18 6 6 18M6 6l12 12"/></svg>';
+function page(options) {
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>${options.title}</title>
+  <style>${PAGE_STYLE}
+  </style>
+</head>
+<body>
+  <main class="card">
+    <div class="badge ${options.tone}">${options.icon}</div>
+    <h1>${options.heading}</h1>
+    <p>${options.body}</p>
+    ${options.extra ?? ""}
+  </main>
+${options.autoClose ? `  <script>setTimeout(() => window.close(), 2000);</script>
+` : ""}</body>
+</html>`;
+}
+function escapeHtml(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+function htmlSuccess() {
+  const app = escapeHtml(getAppName());
+  return page({
+    title: `${app} — Authorization Successful`,
+    heading: "Authorization Successful",
+    body: `You can close this window and return to <span class="app">${app}</span>.`,
+    icon: CHECK_ICON,
+    tone: "ok",
+    autoClose: true
+  });
+}
+function htmlManualSuccess() {
+  const app = escapeHtml(getAppName());
+  return page({
+    title: `${app} — Authorization Received`,
+    heading: "Authorization Received",
+    body: `Copy the full callback URL from your browser address bar and paste it back into <span class="app">${app}</span> with auth-complete.`,
+    icon: CHECK_ICON,
+    tone: "ok"
+  });
+}
+function htmlError(error) {
+  const app = escapeHtml(getAppName());
+  return page({
+    title: `${app} — Authorization Failed`,
+    heading: "Authorization Failed",
+    body: `Something went wrong during authorization. You can close this window and try again from <span class="app">${app}</span>.`,
+    icon: CROSS_ICON,
+    tone: "bad",
+    extra: `<code>${escapeHtml(error)}</code>`
+  });
+}
+let server;
+let bindingPromise;
+let stoppingPromise;
+let restartableStoppingPromise;
+let callbackGeneration = 0;
+const pendingAuths = new Map;
+const reservedAuthStates = new Set;
+const CALLBACK_TIMEOUT_MS = 5 * 60 * 1000;
+const DEFAULT_OAUTH_CALLBACK_HOST = "localhost";
+let callbackServerHost = DEFAULT_OAUTH_CALLBACK_HOST;
+function handleRequest(req, res) {
+  const url = new URL(req.url || "/", `http://${req.headers.host}`);
+  if (url.pathname !== getOAuthCallbackPath()) {
+    res.writeHead(404, { "Content-Type": "text/plain" });
+    res.end("Not found");
+    return;
+  }
+  const code = url.searchParams.get("code");
+  const iss = url.searchParams.get("iss");
+  const state = url.searchParams.get("state");
+  const error = url.searchParams.get("error");
+  const errorDescription = url.searchParams.get("error_description");
+  if (!state) {
+    const errorMsg = "Missing required state parameter - potential CSRF attack";
+    res.writeHead(400, { "Content-Type": "text/html" });
+    res.end(htmlError(errorMsg));
+    return;
+  }
+  const pending = pendingAuths.get(state);
+  const isReserved = reservedAuthStates.has(state);
+  if (error) {
+    if (!pending && !isReserved) {
+      const errorMsg = "Invalid or expired state parameter - potential CSRF attack";
+      res.writeHead(400, { "Content-Type": "text/html" });
+      res.end(htmlError(errorMsg));
+      return;
+    }
+    const errorMsg = errorDescription || error;
+    res.writeHead(200, { "Content-Type": "text/html" });
+    res.end(htmlError(errorMsg));
+    if (pending) {
+      reservedAuthStates.delete(state);
+      clearTimeout(pending.timeout);
+      pendingAuths.delete(state);
+      setTimeout(() => pending.reject(new Error(errorMsg)), 0);
+    }
+    return;
+  }
+  if (!pending && !isReserved) {
+    const errorMsg = "Invalid or expired state parameter - potential CSRF attack";
+    res.writeHead(400, { "Content-Type": "text/html" });
+    res.end(htmlError(errorMsg));
+    return;
+  }
+  if (!code) {
+    res.writeHead(400, { "Content-Type": "text/html" });
+    res.end(htmlError("No authorization code provided"));
+    return;
+  }
+  if (!pending) {
+    res.writeHead(200, { "Content-Type": "text/html" });
+    res.end(htmlManualSuccess());
+    return;
+  }
+  clearTimeout(pending.timeout);
+  pendingAuths.delete(state);
+  pending.resolve({ code, ...iss !== null ? { iss } : {} });
+  res.writeHead(200, { "Content-Type": "text/html" });
+  res.end(htmlSuccess());
+}
+export async function ensureCallbackServer(options = {}) {
+  const generation = callbackGeneration;
+  if (stoppingPromise) {
+    if (!restartableStoppingPromise) {
+      throw new Error("OAuth callback server stopped");
+    }
+    await restartableStoppingPromise;
+    if (generation !== callbackGeneration) {
+      throw new Error("OAuth callback server stopped");
+    }
+  }
+  while (bindingPromise) {
+    await bindingPromise;
+    if (generation !== callbackGeneration) {
+      throw new Error("OAuth callback server stopped");
+    }
+  }
+  if (generation !== callbackGeneration) {
+    throw new Error("OAuth callback server stopped");
+  }
+  const operation = ensureCallbackServerLocked(options);
+  bindingPromise = operation;
+  try {
+    await operation;
+  } finally {
+    if (bindingPromise === operation) {
+      bindingPromise = undefined;
+    }
+  }
+}
+async function ensureCallbackServerLocked(options = {}) {
+  const requiredPort = options.port ?? getConfiguredOAuthCallbackPort();
+  const strictPort = options.strictPort === true;
+  const requestedHost = options.callbackHost ?? DEFAULT_OAUTH_CALLBACK_HOST;
+  const rawRequestedPath = options.callbackPath ?? DEFAULT_OAUTH_CALLBACK_PATH;
+  const requestedPath = rawRequestedPath.startsWith("/") ? rawRequestedPath : `/${rawRequestedPath}`;
+  if (options.reserveState && !options.oauthState) {
+    throw new Error("OAuth callback reservation requires an oauthState");
+  }
+  let reservedState;
+  const previousServer = server;
+  const needsStrictRebind = Boolean(previousServer && strictPort && getOAuthCallbackPort() !== requiredPort);
+  const needsHostSwitch = Boolean(previousServer && callbackServerHost !== requestedHost);
+  const needsPathSwitch = Boolean(previousServer && getOAuthCallbackPath() !== requestedPath);
+  if (previousServer) {
+    if (!needsStrictRebind && !needsHostSwitch) {
+      if (needsPathSwitch) {
+        if (pendingAuths.size > 0 || reservedAuthStates.size > 0) {
+          throw new Error(`OAuth callback server is using path ${getOAuthCallbackPath()}, but callback path ${requestedPath} is required and cannot be switched while authorizations are pending`);
+        }
+        setOAuthCallbackPath(requestedPath);
+      }
+      if (options.reserveState && options.oauthState) {
+        reservedAuthStates.add(options.oauthState);
+        reservedState = options.oauthState;
+      }
+      return;
+    }
+    if (pendingAuths.size > 0 || reservedAuthStates.size > 0) {
+      throw new Error(`OAuth callback server is running on ${callbackServerHost}:${getOAuthCallbackPort()}, but strict callback endpoint ${requestedHost}:${requiredPort} is required and cannot be switched while authorizations are pending`);
+    }
+  }
+  const candidateServer = createServer(handleRequest);
+  const listenPort = strictPort ? requiredPort : 0;
+  try {
+    await new Promise((resolve, reject) => {
+      candidateServer.once("error", (err) => {
+        reject(err);
+      });
+      candidateServer.listen(listenPort, requestedHost, () => {
+        resolve();
+      });
+    });
+    if (strictPort) {
+      setOAuthCallbackPort(requiredPort);
+    } else {
+      const address = candidateServer.address();
+      if (!address || typeof address === "string" || typeof address.port !== "number") {
+        throw new Error("OAuth callback server did not report an assigned port");
+      }
+      setOAuthCallbackPort(address.port);
+    }
+    if (previousServer && (needsStrictRebind || needsHostSwitch)) {
+      await new Promise((resolve) => {
+        previousServer.close(() => resolve());
+      });
+    }
+    callbackServerHost = requestedHost;
+    setOAuthCallbackPath(requestedPath);
+    server = candidateServer;
+    if (options.reserveState && options.oauthState) {
+      reservedAuthStates.add(options.oauthState);
+      reservedState = options.oauthState;
+    }
+    server.unref();
+  } catch (error) {
+    if (reservedState) {
+      reservedAuthStates.delete(reservedState);
+    }
+    const nodeError = error;
+    await new Promise((resolve) => {
+      candidateServer.close(() => resolve());
+    });
+    if (strictPort && nodeError.code === "EADDRINUSE") {
+      throw new Error(`OAuth callback port ${requiredPort} is already in use. Pre-registered OAuth clients require an exact redirect URI; set MCP_OAUTH_CALLBACK_PORT to your registered port or free port ${requiredPort}`, { cause: error });
+    }
+    throw error;
+  }
+}
+export function reserveCallbackServer(oauthState) {
+  reservedAuthStates.add(oauthState);
+}
+export function releaseCallbackServer(oauthState) {
+  reservedAuthStates.delete(oauthState);
+}
+export function waitForCallback(oauthState) {
+  reservedAuthStates.delete(oauthState);
+  return new Promise((resolve, reject) => {
+    const timeout = setTimeout(() => {
+      if (pendingAuths.has(oauthState)) {
+        pendingAuths.delete(oauthState);
+        reject(new Error("OAuth callback timeout - authorization took too long"));
+      }
+    }, CALLBACK_TIMEOUT_MS);
+    pendingAuths.set(oauthState, { resolve, reject, timeout });
+  });
+}
+export function cancelPendingCallback(oauthState) {
+  reservedAuthStates.delete(oauthState);
+  const pending = pendingAuths.get(oauthState);
+  if (pending) {
+    clearTimeout(pending.timeout);
+    pendingAuths.delete(oauthState);
+    pending.reject(new Error("Authorization cancelled"));
+  }
+}
+export function stopCallbackServer() {
+  if (stoppingPromise) {
+    restartableStoppingPromise = undefined;
+    callbackGeneration += 1;
+    return stoppingPromise;
+  }
+  callbackGeneration += 1;
+  const cleanup = (async () => {
+    while (bindingPromise) {
+      await bindingPromise.catch(() => {});
+    }
+    if (server) {
+      await new Promise((resolve) => {
+        server.close(() => {
+          resolve();
+        });
+      });
+      server = undefined;
+    }
+    setOAuthCallbackPort(getConfiguredOAuthCallbackPort());
+    callbackServerHost = DEFAULT_OAUTH_CALLBACK_HOST;
+    setOAuthCallbackPath(DEFAULT_OAUTH_CALLBACK_PATH);
+    const pendingList = Array.from(pendingAuths.entries());
+    pendingAuths.clear();
+    reservedAuthStates.clear();
+    setTimeout(() => {
+      for (const [, pending] of pendingList) {
+        clearTimeout(pending.timeout);
+        pending.reject(new Error("OAuth callback server stopped"));
+      }
+    }, 0);
+  })();
+  const operation = cleanup.finally(() => {
+    if (stoppingPromise === operation)
+      stoppingPromise = undefined;
+  });
+  stoppingPromise = operation;
+  return operation;
+}
+export function stopCallbackServerIfIdle() {
+  if (stoppingPromise)
+    return stoppingPromise;
+  if (bindingPromise || !server || pendingAuths.size > 0 || reservedAuthStates.size > 0) {
+    return Promise.resolve();
+  }
+  const operation = stopCallbackServer().finally(() => {
+    if (restartableStoppingPromise === operation)
+      restartableStoppingPromise = undefined;
+  });
+  restartableStoppingPromise = operation;
+  return operation;
+}
+export function isCallbackServerRunning() {
+  return server !== undefined;
+}
+export function getPendingAuthCount() {
+  return pendingAuths.size;
+}