@frontmcp/plugin-remember 1.10.9-rc.1 → 1.10.9-rc.3

package/esm/index.mjs

@@ -1,1745 +1,5 @@
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __decorateClass = (decorators, target, key, kind) => {
-  var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
-  for (var i = decorators.length - 1, decorator; i >= 0; i--)
-    if (decorator = decorators[i])
-      result = (kind ? decorator(target, key, result) : decorator(result)) || result;
-  if (kind && result) __defProp(target, key, result);
-  return result;
-};
-var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
-
-// plugins/plugin-remember/src/remember.plugin.ts
-import {
-  DynamicPlugin,
-  FRONTMCP_CONTEXT,
-  FrontMcpConfig,
-  FrontMcpLogger,
-  getGlobalStoreConfig,
-  isVercelKvProvider,
-  Plugin,
-  ProviderScope as ProviderScope5
-} from "@frontmcp/sdk";
-
-// plugins/plugin-remember/src/providers/remember-accessor.provider.ts
-import {
-  getRunningTool,
-  isAnonymousSubject,
-  Provider,
-  ProviderScope,
-  STATELESS_SESSION_ID
-} from "@frontmcp/sdk";
-
-// plugins/plugin-remember/src/remember.crypto.ts
-import {
-  base64urlDecode,
-  base64urlEncode as base64urlEncode2,
-  decryptAesGcm,
-  encryptAesGcm,
-  hkdfSha256,
-  randomBytes as randomBytes2
-} from "@frontmcp/utils";
-
-// plugins/plugin-remember/src/remember.secret-persistence.ts
-import * as path from "path";
-import { z } from "@frontmcp/lazy-zod";
-import { base64urlEncode, mkdir, randomBytes, readFile, rename, unlink, writeFile } from "@frontmcp/utils";
-var DEFAULT_SECRET_FILE_PATH = ".frontmcp/remember-secret.json";
-var SECRET_BYTES = 32;
-var rememberSecretDataSchema = z.object({
-  secret: z.string().min(32),
-  // base64url of 32 bytes is ~43 chars
-  createdAt: z.number().positive().int(),
-  version: z.literal(1)
-});
-function validateSecretData(data) {
-  const result = rememberSecretDataSchema.safeParse(data);
-  if (!result.success) {
-    return { valid: false, error: result.error.issues[0]?.message ?? "Invalid secret structure" };
-  }
-  const parsed = result.data;
-  const now = Date.now();
-  if (parsed.createdAt > now + 6e4) {
-    return { valid: false, error: "createdAt is in the future" };
-  }
-  const hundredYearsMs = 100 * 365 * 24 * 60 * 60 * 1e3;
-  if (parsed.createdAt < now - hundredYearsMs) {
-    return { valid: false, error: "createdAt is too old" };
-  }
-  return { valid: true };
-}
-function isSecretPersistenceEnabled(options) {
-  const isProduction = process.env["NODE_ENV"] === "production";
-  if (isProduction) {
-    return options?.forceEnable === true;
-  }
-  return true;
-}
-function resolveSecretPath(options) {
-  const secretPath = options?.secretPath ?? DEFAULT_SECRET_FILE_PATH;
-  if (path.isAbsolute(secretPath)) {
-    return secretPath;
-  }
-  return path.resolve(process.cwd(), secretPath);
-}
-async function loadRememberSecret(options) {
-  if (!isSecretPersistenceEnabled(options)) {
-    return null;
-  }
-  const secretPath = resolveSecretPath(options);
-  try {
-    const content = await readFile(secretPath, "utf8");
-    const data = JSON.parse(content);
-    const validation = validateSecretData(data);
-    if (!validation.valid) {
-      console.warn(
-        `[RememberSecretPersistence] Invalid secret file format at ${secretPath}: ${validation.error}, will regenerate`
-      );
-      return null;
-    }
-    return data;
-  } catch (error) {
-    if (error.code === "ENOENT") {
-      return null;
-    }
-    console.warn(`[RememberSecretPersistence] Failed to load secret from ${secretPath}: ${error.message}`);
-    return null;
-  }
-}
-async function saveRememberSecret(secretData, options) {
-  if (!isSecretPersistenceEnabled(options)) {
-    return true;
-  }
-  const secretPath = resolveSecretPath(options);
-  const dir = path.dirname(secretPath);
-  const tempPath = `${secretPath}.tmp.${Date.now()}.${base64urlEncode(randomBytes(8))}`;
-  try {
-    await mkdir(dir, { recursive: true, mode: 448 });
-    const content = JSON.stringify(secretData, null, 2);
-    await writeFile(tempPath, content, { mode: 384 });
-    await rename(tempPath, secretPath);
-    return true;
-  } catch (error) {
-    console.error(`[RememberSecretPersistence] Failed to save secret to ${secretPath}: ${error.message}`);
-    try {
-      await unlink(tempPath);
-    } catch {
-    }
-    return false;
-  }
-}
-var cachedSecret = null;
-var secretGenerationPromise = null;
-function generateSecret() {
-  return base64urlEncode(randomBytes(SECRET_BYTES));
-}
-async function getOrCreatePersistedSecret(options) {
-  if (cachedSecret) {
-    return cachedSecret;
-  }
-  if (secretGenerationPromise) {
-    return secretGenerationPromise;
-  }
-  secretGenerationPromise = (async () => {
-    try {
-      const loaded = await loadRememberSecret(options);
-      if (loaded) {
-        cachedSecret = loaded.secret;
-        return cachedSecret;
-      }
-      const newSecret = generateSecret();
-      const secretData = {
-        secret: newSecret,
-        createdAt: Date.now(),
-        version: 1
-      };
-      if (isSecretPersistenceEnabled(options)) {
-        await saveRememberSecret(secretData, options);
-      } else {
-        console.warn(
-          "[RememberSecretPersistence] No REMEMBER_SECRET (or MCP_MEMORY_SECRET / MCP_SESSION_SECRET) is set in production, so a random in-memory secret is used. Encrypted memory will be unreadable after a restart and by other instances sharing the store. Set REMEMBER_SECRET to the same value on every instance."
-        );
-      }
-      cachedSecret = newSecret;
-      return cachedSecret;
-    } finally {
-      secretGenerationPromise = null;
-    }
-  })();
-  return secretGenerationPromise;
-}
-
-// plugins/plugin-remember/src/remember.crypto.ts
-async function getBaseSecret() {
-  const envSecret = process.env["REMEMBER_SECRET"] || process.env["MCP_MEMORY_SECRET"] || process.env["MCP_SESSION_SECRET"];
-  if (envSecret) {
-    return envSecret;
-  }
-  return getOrCreatePersistedSecret();
-}
-async function secretFor(source) {
-  return source.secret ? source.secret : getBaseSecret();
-}
-var textEncoder = new TextEncoder();
-async function deriveEncryptionKey(source) {
-  const salt = textEncoder.encode("remember-plugin-v1");
-  let ikm;
-  let context;
-  switch (source.type) {
-    case "session":
-      ikm = await secretFor(source) + source.sessionId;
-      context = `remember:session:${source.sessionId}`;
-      break;
-    case "tool":
-      ikm = await secretFor(source) + source.sessionId;
-      context = `remember:tool:${source.toolName}:${source.sessionId}`;
-      break;
-    case "user":
-      ikm = await secretFor(source) + source.userId;
-      context = `remember:user:${source.userId}`;
-      break;
-    case "global":
-      ikm = await secretFor(source);
-      context = "remember:global";
-      break;
-    case "custom":
-      ikm = source.key;
-      context = `remember:custom:${source.key}`;
-      break;
-  }
-  const ikmBytes = textEncoder.encode(ikm);
-  const info = textEncoder.encode(context);
-  return hkdfSha256(ikmBytes, salt, info, 32);
-}
-function getKeySourceForScope(scope, context, secret) {
-  switch (scope) {
-    case "session":
-      return { type: "session", sessionId: context.sessionId, secret };
-    case "user":
-      return { type: "user", userId: context.userId ?? "anonymous", secret };
-    case "tool":
-      return {
-        type: "tool",
-        toolName: context.toolName ?? "unknown",
-        sessionId: context.sessionId,
-        secret
-      };
-    case "global":
-      return { type: "global", secret };
-  }
-}
-var textDecoder = new TextDecoder();
-async function encryptValue(data, keySource) {
-  const key = await deriveEncryptionKey(keySource);
-  const plaintext = textEncoder.encode(JSON.stringify(data));
-  const iv = randomBytes2(12);
-  const { ciphertext, tag } = encryptAesGcm(key, plaintext, iv);
-  return {
-    alg: "A256GCM",
-    iv: base64urlEncode2(iv),
-    tag: base64urlEncode2(tag),
-    data: base64urlEncode2(ciphertext)
-  };
-}
-async function decryptValue(blob, keySource) {
-  try {
-    const key = await deriveEncryptionKey(keySource);
-    const iv = base64urlDecode(blob.iv);
-    const tag = base64urlDecode(blob.tag);
-    const ciphertext = base64urlDecode(blob.data);
-    const decrypted = decryptAesGcm(key, ciphertext, iv, tag);
-    return JSON.parse(textDecoder.decode(decrypted));
-  } catch {
-    return null;
-  }
-}
-function serializeBlob(blob) {
-  return JSON.stringify(blob);
-}
-function deserializeBlob(str) {
-  try {
-    const parsed = JSON.parse(str);
-    if (parsed && typeof parsed === "object" && parsed.alg === "A256GCM" && typeof parsed.iv === "string" && typeof parsed.tag === "string" && typeof parsed.data === "string") {
-      return parsed;
-    }
-    return null;
-  } catch {
-    return null;
-  }
-}
-async function encryptAndSerialize(data, keySource) {
-  const blob = await encryptValue(data, keySource);
-  return serializeBlob(blob);
-}
-async function deserializeAndDecrypt(str, keySource) {
-  const blob = deserializeBlob(str);
-  if (!blob) return null;
-  return decryptValue(blob, keySource);
-}
-
-// plugins/plugin-remember/src/remember.errors.ts
-import { InternalMcpError, PublicMcpError } from "@frontmcp/sdk";
-var RememberIdentityError = class extends PublicMcpError {
-  name = "RememberIdentityError";
-  constructor(message) {
-    super(message, "REMEMBER_IDENTITY_REQUIRED", 403);
-  }
-};
-var RememberScopeNotAllowedError = class extends PublicMcpError {
-  name = "RememberScopeNotAllowedError";
-  constructor(scope, allowedScopes) {
-    super(
-      `Scope '${scope}' is not allowed. Allowed scopes: ${allowedScopes.join(", ")}`,
-      "REMEMBER_SCOPE_NOT_ALLOWED",
-      400
-    );
-  }
-};
-var RememberConfigurationError = class extends InternalMcpError {
-  name = "RememberConfigurationError";
-  constructor(message) {
-    super(message, "REMEMBER_CONFIGURATION");
-  }
-};
-
-// plugins/plugin-remember/src/remember.legacy-purge.ts
-var LEGACY_SCOPES = ["session", "tool", "user"];
-var DEFAULT_LEGACY_PURGE_DELAY_MS = 864e5;
-var LAYOUT_MARKER_KEY = "__layout__";
-var LAYOUT_VERSION = 2;
-var MAX_TIMER_MS = 2147483647;
-var scheduled = /* @__PURE__ */ new WeakSet();
-function parseFirstSeenAt(raw) {
-  if (!raw) return void 0;
-  try {
-    const parsed = typeof raw === "string" ? JSON.parse(raw) : raw;
-    const firstSeenAt = parsed?.firstSeenAt;
-    return typeof firstSeenAt === "number" && Number.isFinite(firstSeenAt) ? firstSeenAt : void 0;
-  } catch {
-    return void 0;
-  }
-}
-async function readLayoutFirstSeenAt(store, keyPrefix, logger, markerTtlSeconds) {
-  const key = `${keyPrefix}${LAYOUT_MARKER_KEY}`;
-  const standDown = (reason, extra = {}) => {
-    logger?.debug?.(`remember: ${reason}, legacy purge stood down`, { key, ...extra });
-    return void 0;
-  };
-  try {
-    const existing = await store.getValue(key);
-    if (existing) {
-      return parseFirstSeenAt(existing) ?? standDown("layout marker is unreadable");
-    }
-    const marker = { version: LAYOUT_VERSION, firstSeenAt: Date.now() };
-    const serialized = JSON.stringify(marker);
-    if (!store.setIfAbsent) {
-      await store.setValue(key, serialized, markerTtlSeconds);
-      return marker.firstSeenAt;
-    }
-    if (await store.setIfAbsent(key, serialized, markerTtlSeconds)) {
-      return marker.firstSeenAt;
-    }
-    const winner = await store.getValue(key);
-    return parseFirstSeenAt(winner) ?? standDown("layout marker vanished after a lost race");
-  } catch (error) {
-    return standDown("could not establish the layout marker", {
-      error: error instanceof Error ? error.message : String(error)
-    });
-  }
-}
-async function purgeLegacyRememberEntries(store, keyPrefix, logger) {
-  let deleted = 0;
-  for (const scope of LEGACY_SCOPES) {
-    const pattern = `${keyPrefix}${scope}:*`;
-    let keys;
-    try {
-      keys = await store.keys(pattern);
-    } catch (error) {
-      logger?.debug?.("remember: legacy purge skipped, store could not list keys", {
-        pattern,
-        error: error instanceof Error ? error.message : String(error)
-      });
-      continue;
-    }
-    for (const key of keys) {
-      try {
-        await store.delete(key);
-        deleted += 1;
-      } catch {
-      }
-    }
-  }
-  if (deleted > 0) {
-    logger?.warn?.(
-      `remember: purged ${deleted} entr${deleted === 1 ? "y" : "ies"} left unreadable by the session/tool key-derivation change and the namespace encoding. This is a one-time upgrade step; set skipLegacyPurge to handle the migration yourself.`
-    );
-  }
-  return deleted;
-}
-function scheduleLegacyRememberPurge(store, keyPrefix, options = {}) {
-  if (scheduled.has(store)) return;
-  scheduled.add(store);
-  const delayMs = options.delayMs ?? DEFAULT_LEGACY_PURGE_DELAY_MS;
-  const markerTtlSeconds = options.defaultTTL ? Math.max(options.defaultTTL, Math.ceil(2 * delayMs / 1e3)) : void 0;
-  const arm = (waitMs) => {
-    const timer = setTimeout(
-      () => {
-        void attempt().catch(() => void 0);
-      },
-      Math.min(waitMs, MAX_TIMER_MS)
-    );
-    timer.unref?.();
-  };
-  const attempt = async () => {
-    const firstSeenAt = await readLayoutFirstSeenAt(store, keyPrefix, options.logger, markerTtlSeconds);
-    if (firstSeenAt === void 0) return;
-    const remainingMs = firstSeenAt + delayMs - Date.now();
-    if (remainingMs > 0) {
-      arm(remainingMs);
-      return;
-    }
-    await purgeLegacyRememberEntries(store, keyPrefix, options.logger);
-  };
-  void attempt().catch(() => void 0);
-}
-
-// plugins/plugin-remember/src/providers/remember-accessor.provider.ts
-var STORAGE_LAYOUT_VERSION = "v2";
-function encodeKeyPart(value) {
-  return encodeURIComponent(value);
-}
-function remainingSeconds(expiresAt, now) {
-  return Math.max(1, Math.ceil((expiresAt - now) / 1e3));
-}
-function expiryAfter(ttlSeconds, now) {
-  return ttlSeconds ? now + ttlSeconds * 1e3 : void 0;
-}
-var RememberAccessor = class {
-  store;
-  ctx;
-  config;
-  keyPrefix;
-  encryptionEnabled;
-  constructor(store, ctx, config, logger) {
-    this.store = store;
-    this.ctx = ctx;
-    this.config = config;
-    this.keyPrefix = config.keyPrefix ?? "remember:";
-    this.encryptionEnabled = config.encryption?.enabled !== false;
-    if (!config.skipLegacyPurge) {
-      scheduleLegacyRememberPurge(store, this.keyPrefix, {
-        delayMs: config.legacyPurgeDelayMs,
-        defaultTTL: config.defaultTTL,
-        logger
-      });
-    }
-  }
-  // ─────────────────────────────────────────────────────────────────────────────
-  // Public API
-  // ─────────────────────────────────────────────────────────────────────────────
-  /**
-   * Store a value in memory.
-   *
-   * Without a `ttl`, the plugin's `defaultTTL` applies, and the entry records the deadline either one sets.
-   *
-   * @param key - The key to store under
-   * @param value - The value to store (any JSON-serializable data)
-   * @param options - Storage options (scope, ttl, brand, metadata)
-   * @returns The stored entry, with its `expiresAt` deadline
-   */
-  async set(key, value, options = {}) {
-    const scope = options.scope ?? "session";
-    const storageKey = this.buildStorageKey(key, scope);
-    const now = Date.now();
-    const ttlSeconds = options.ttl ?? this.config.defaultTTL;
-    const entry = {
-      value,
-      brand: options.brand,
-      createdAt: now,
-      updatedAt: now,
-      expiresAt: expiryAfter(ttlSeconds, now),
-      metadata: options.metadata
-    };
-    const serialized = this.encryptionEnabled ? await encryptAndSerialize(entry, this.getKeySource(scope)) : JSON.stringify(entry);
-    await this.store.setValue(storageKey, serialized, ttlSeconds);
-    return entry;
-  }
-  /**
-   * Retrieve a value from memory.
-   *
-   * @param key - The key to retrieve
-   * @param options - Retrieval options (scope, defaultValue)
-   * @returns The stored value or defaultValue if not found
-   */
-  async get(key, options = {}) {
-    const scope = options.scope ?? "session";
-    const entry = await this.readEntry(this.buildStorageKey(key, scope), scope);
-    return entry ? entry.value : options.defaultValue;
-  }
-  /**
-   * Get the full entry including metadata.
-   *
-   * @param key - The key to retrieve
-   * @param options - Retrieval options (scope)
-   * @returns The full entry or undefined if not found
-   */
-  async getEntry(key, options = {}) {
-    const scope = options.scope ?? "session";
-    return this.readEntry(this.buildStorageKey(key, scope), scope);
-  }
-  /**
-   * Forget (delete) a value from memory.
-   *
-   * @param key - The key to forget
-   * @param options - Options (scope)
-   */
-  async forget(key, options = {}) {
-    const scope = options.scope ?? "session";
-    const storageKey = this.buildStorageKey(key, scope);
-    await this.store.delete(storageKey);
-  }
-  /**
-   * Check if a key is remembered: true exactly when `get()` would return its value.
-   *
-   * @param key - The key to check
-   * @param options - Options (scope)
-   * @returns true if the key exists and has not expired
-   */
-  async knows(key, options = {}) {
-    const scope = options.scope ?? "session";
-    return await this.readEntry(this.buildStorageKey(key, scope), scope) !== void 0;
-  }
-  /**
-   * List all remembered keys for a scope: the keys `get()` would return a value for.
-   *
-   * @param options - Options (scope, pattern)
-   * @returns Array of keys (without the scope prefix)
-   */
-  async list(options = {}) {
-    const scope = options.scope ?? "session";
-    const scopePrefix = this.buildScopePrefix(scope);
-    const storageKeys = await this.store.keys(scopePrefix + (options.pattern ?? "*"));
-    const entries = await Promise.all(storageKeys.map((storageKey) => this.readEntry(storageKey, scope)));
-    return storageKeys.filter((_storageKey, index) => entries[index] !== void 0).map((storageKey) => storageKey.slice(scopePrefix.length));
-  }
-  /**
-   * Update an existing entry's value while preserving metadata.
-   *
-   * With a `ttl` the entry expires that many seconds from now; without one it keeps its current
-   * expiry, in the store as well, so the store does not keep it past that (rounded up to a second).
-   * An entry with no recorded expiry gets the plugin's `defaultTTL` from now, as the store would give it.
-   *
-   * @param key - The key to update
-   * @param value - The new value
-   * @param options - Options (scope, ttl)
-   */
-  async update(key, value, options = {}) {
-    const scope = options.scope ?? "session";
-    const existing = await this.getEntry(key, { scope });
-    if (!existing) return false;
-    const now = Date.now();
-    const expiresAt = expiryAfter(options.ttl, now) ?? existing.expiresAt ?? expiryAfter(this.config.defaultTTL, now);
-    const entry = {
-      ...existing,
-      value,
-      updatedAt: now,
-      expiresAt
-    };
-    const storageKey = this.buildStorageKey(key, scope);
-    const serialized = this.encryptionEnabled ? await encryptAndSerialize(entry, this.getKeySource(scope)) : JSON.stringify(entry);
-    const writtenAt = Date.now();
-    if (expiresAt !== void 0 && expiresAt <= writtenAt) return false;
-    const storageTtl = expiresAt !== void 0 ? remainingSeconds(expiresAt, writtenAt) : void 0;
-    await this.store.setValue(storageKey, serialized, storageTtl);
-    return true;
-  }
-  // ─────────────────────────────────────────────────────────────────────────────
-  // Convenience Methods
-  // ─────────────────────────────────────────────────────────────────────────────
-  /**
-   * Get the session ID from context.
-   *
-   * This is the id the request carries, which under MCP 2026-07-28 the client chooses; it is not
-   * proof of identity. Session and tool memory are namespaced by the verified session instead.
-   */
-  get sessionId() {
-    return this.ctx.sessionId;
-  }
-  /**
-   * Get the user ID from context (if available).
-   */
-  get userId() {
-    const authInfo = this.ctx.authInfo;
-    return authInfo?.extra?.["userId"] ?? authInfo?.extra?.["sub"] ?? authInfo?.clientId ?? void 0;
-  }
-  // ─────────────────────────────────────────────────────────────────────────────
-  // Private Methods
-  // ─────────────────────────────────────────────────────────────────────────────
-  /**
-   * Build the full storage key including scope prefix.
-   */
-  buildStorageKey(key, scope) {
-    return this.buildScopePrefix(scope) + key;
-  }
-  /**
-   * The session id the server verified for this request, or undefined when there is none.
-   *
-   * Read from the verified auth info (`authInfo.sessionId` from the transport, `extra.sessionId`
-   * from session verification, which records only a session the request presented), the same rule
-   * CONTEXT providers are cached by. Never `FrontMcpContext.sessionId` alone: under MCP 2026-07-28
-   * that is whatever `mcp-session-id` the caller sent, including another caller's. The stateless
-   * transport's shared `__stateless__` id identifies no one.
-   */
-  get verifiedSessionId() {
-    const authInfo = this.ctx.authInfo;
-    return [authInfo?.sessionId, authInfo?.extra?.["sessionId"]].find(
-      (candidate) => typeof candidate === "string" && candidate.length > 0 && candidate !== STATELESS_SESSION_ID
-    );
-  }
-  /**
-   * The identity that namespaces session- and tool-scoped storage.
-   *
-   * Only a session the server verified identifies one client across requests. Keying on the
-   * session id a request merely carries let a caller read or overwrite another caller's memory by
-   * sending that caller's `mcp-session-id` (MCP 2026-07-28), and put every stateless client under
-   * the shared `__stateless__` id (GHSA-225p-f8jh-f3rh). A request without a verified session
-   * (stateless transport, MCP 2026-07-28, or a session id the server did not verify) falls back to
-   * the authenticated principal, the only per-client identity it has; with neither, it has no
-   * business reading or writing per-client memory at all. An anonymous subject (`anon:…`) is no
-   * principal: without a session, the server makes a new one up for each request.
-   */
-  resolveSessionIdentity() {
-    const sessionId = this.verifiedSessionId;
-    if (sessionId) {
-      return sessionId;
-    }
-    const userId = this.userId;
-    if (userId && !isAnonymousSubject(userId)) {
-      return `stateless-user:${userId}`;
-    }
-    throw new RememberIdentityError(
-      `Remember cannot use session or tool scope for an unauthenticated request without a verified session: a stateless request shares the session id "${STATELESS_SESSION_ID}", and an mcp-session-id the server did not verify could belong to any caller, so the data would be shared across clients. Authenticate the request, use a stateful transport, or choose the 'global' scope if the data really is shared.`
-    );
-  }
-  /**
-   * The tool that tool-scoped memory belongs to: the tool whose `execute()` is running (its
-   * owner-qualified name). Read when the memory is used, not when this accessor was built (it can
-   * serve several calls), so a tool that calls other tools still gets its own. Outside a tool,
-   * `'unknown'`.
-   */
-  get toolName() {
-    return getRunningTool()?.fullName ?? "unknown";
-  }
-  /**
-   * Build the scope-specific prefix.
-   *
-   * Every variable component is encoded, because the separator is also a legal character in
-   * a user id, a tool name and a memory key. Left raw, identity `a` with key `b:c` produces
-   * the same storage key as identity `a:b` with key `c` — one client reading or overwriting
-   * another's value through nothing more exotic than a colon in a name.
-   */
-  buildScopePrefix(scope) {
-    switch (scope) {
-      case "session":
-        return `${this.keyPrefix}${STORAGE_LAYOUT_VERSION}:session:${encodeKeyPart(this.resolveSessionIdentity())}:`;
-      case "user": {
-        const userId = this.userId;
-        if (!userId || isAnonymousSubject(userId)) {
-          throw new RememberIdentityError(
-            "Remember cannot use user scope without an authenticated user: all unauthenticated callers would share one namespace. Authenticate the request or use the 'global' scope."
-          );
-        }
-        return `${this.keyPrefix}${STORAGE_LAYOUT_VERSION}:user:${encodeKeyPart(userId)}:`;
-      }
-      case "tool":
-        return `${this.keyPrefix}${STORAGE_LAYOUT_VERSION}:tool:${encodeKeyPart(this.toolName)}:${encodeKeyPart(this.resolveSessionIdentity())}:`;
-      case "global":
-        return `${this.keyPrefix}global:`;
-    }
-  }
-  /**
-   * Get the encryption key source for a scope.
-   */
-  getKeySource(scope) {
-    const needsSessionIdentity = scope === "session" || scope === "tool";
-    return getKeySourceForScope(
-      scope,
-      {
-        sessionId: needsSessionIdentity ? this.resolveSessionIdentity() : this.ctx.sessionId,
-        userId: this.userId,
-        toolName: scope === "tool" ? this.toolName : void 0
-      },
-      this.config.encryption?.customKey
-    );
-  }
-  /** The entry stored under `storageKey`, if readable and unexpired; an expired one is deleted. */
-  async readEntry(storageKey, scope) {
-    const stored = await this.store.getValue(storageKey);
-    if (!stored) return void 0;
-    const raw = typeof stored === "string" ? stored : JSON.stringify(stored);
-    const entry = this.encryptionEnabled ? await deserializeAndDecrypt(raw, this.getKeySource(scope)) : this.parseEntry(raw);
-    if (!entry) return void 0;
-    if (entry.expiresAt && Date.now() > entry.expiresAt) {
-      await this.store.delete(storageKey);
-      return void 0;
-    }
-    return entry;
-  }
-  /**
-   * Parse a JSON entry (when encryption is disabled).
-   */
-  parseEntry(raw) {
-    try {
-      return JSON.parse(raw);
-    } catch {
-      return null;
-    }
-  }
-};
-RememberAccessor = __decorateClass([
-  Provider({
-    name: "provider:remember:accessor",
-    description: "Context-scoped accessor for RememberPlugin storage",
-    scope: ProviderScope.CONTEXT
-  })
-], RememberAccessor);
-function createRememberAccessor(store, ctx, config, logger) {
-  return new RememberAccessor(store, ctx, config, logger);
-}
-
-// plugins/plugin-remember/src/providers/remember-memory.provider.ts
-import { Provider as Provider2, ProviderScope as ProviderScope2 } from "@frontmcp/sdk";
-var MAX_TIMEOUT_MS = 2 ** 31 - 1;
-var RememberMemoryProvider = class {
-  constructor(sweepIntervalSeconds = 60, defaultTTL) {
-    this.defaultTTL = defaultTTL;
-    this.sweeper = setInterval(() => this.sweep(), sweepIntervalSeconds * 1e3);
-    this.sweeper.unref?.();
-  }
-  defaultTTL;
-  memory = /* @__PURE__ */ new Map();
-  sweeper;
-  /**
-   * Store a value with optional TTL.
-   * Always JSON-serializes the value for consistent storage/retrieval.
-   */
-  async setValue(key, value, ttlSeconds) {
-    const strValue = JSON.stringify(value);
-    const existing = this.memory.get(key);
-    if (existing?.timeout) clearTimeout(existing.timeout);
-    const entry = { value: strValue };
-    const ttl = ttlSeconds ?? this.defaultTTL;
-    if (ttl && ttl > 0) {
-      const ttlMs = ttl * 1e3;
-      entry.expiresAt = Date.now() + ttlMs;
-      if (ttlMs <= MAX_TIMEOUT_MS) {
-        entry.timeout = setTimeout(() => {
-          const e = this.memory.get(key);
-          if (e && e.expiresAt && e.expiresAt <= Date.now()) {
-            this.memory.delete(key);
-          }
-        }, ttlMs);
-        entry.timeout.unref?.();
-      }
-    }
-    this.memory.set(key, entry);
-  }
-  /**
-   * Store a value only if the key is absent.
-   *
-   * A single-threaded runtime makes the check-then-set indivisible; an expired entry counts as
-   * absent, matching what `getValue` would report.
-   */
-  async setIfAbsent(key, value, ttlSeconds) {
-    const existing = this.memory.get(key);
-    if (existing && !this.isExpired(existing)) return false;
-    await this.setValue(key, value, ttlSeconds);
-    return true;
-  }
-  /**
-   * Retrieve a value by key.
-   * JSON-parses the stored value to match the setValue serialization.
-   */
-  async getValue(key, defaultValue) {
-    const entry = this.memory.get(key);
-    if (!entry) return defaultValue;
-    if (this.isExpired(entry)) {
-      await this.delete(key);
-      return defaultValue;
-    }
-    try {
-      return JSON.parse(entry.value);
-    } catch {
-      return entry.value;
-    }
-  }
-  /**
-   * Delete a key.
-   */
-  async delete(key) {
-    const entry = this.memory.get(key);
-    if (entry?.timeout) clearTimeout(entry.timeout);
-    this.memory.delete(key);
-  }
-  /**
-   * Check if a key exists (and is not expired).
-   */
-  async exists(key) {
-    const entry = this.memory.get(key);
-    if (!entry) return false;
-    if (this.isExpired(entry)) {
-      await this.delete(key);
-      return false;
-    }
-    return true;
-  }
-  /**
-   * List keys matching a glob-style pattern.
-   * Supports * and ? wildcards.
-   */
-  async keys(pattern) {
-    const result = [];
-    const regex = pattern ? this.patternToRegex(pattern) : null;
-    const expiredKeys = [];
-    for (const [key, entry] of this.memory) {
-      if (this.isExpired(entry)) {
-        expiredKeys.push(key);
-      }
-    }
-    for (const key of expiredKeys) {
-      await this.delete(key);
-    }
-    for (const [key, entry] of this.memory) {
-      if (this.isExpired(entry)) {
-        continue;
-      }
-      if (regex && !regex.test(key)) {
-        continue;
-      }
-      result.push(key);
-    }
-    return result;
-  }
-  /**
-   * Gracefully close the provider.
-   */
-  async close() {
-    if (this.sweeper) clearInterval(this.sweeper);
-    for (const [, entry] of this.memory) {
-      if (entry.timeout) clearTimeout(entry.timeout);
-    }
-    this.memory.clear();
-  }
-  // ─────────────────────────────────────────────────────────────────────────────
-  // Private Methods
-  // ─────────────────────────────────────────────────────────────────────────────
-  isExpired(entry) {
-    return entry.expiresAt !== void 0 && entry.expiresAt <= Date.now();
-  }
-  /**
-   * Periodically remove expired keys to keep memory tidy.
-   */
-  sweep() {
-    const now = Date.now();
-    for (const [key, entry] of this.memory) {
-      if (entry.expiresAt !== void 0 && entry.expiresAt <= now) {
-        if (entry.timeout) clearTimeout(entry.timeout);
-        this.memory.delete(key);
-      }
-    }
-  }
-  /**
-   * Convert a glob-style pattern to a RegExp.
-   * * matches any sequence of characters
-   * ? matches any single character
-   *
-   * Includes ReDoS protection: validates pattern length and wildcard count.
-   */
-  patternToRegex(pattern) {
-    if (pattern.length > RememberMemoryProvider.MAX_PATTERN_LENGTH) {
-      throw new Error(`Pattern too long: ${pattern.length} chars (max ${RememberMemoryProvider.MAX_PATTERN_LENGTH})`);
-    }
-    const wildcardCount = (pattern.match(/[*?]/g) || []).length;
-    if (wildcardCount > RememberMemoryProvider.MAX_WILDCARDS) {
-      throw new Error(`Too many wildcards in pattern: ${wildcardCount} (max ${RememberMemoryProvider.MAX_WILDCARDS})`);
-    }
-    const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".");
-    return new RegExp(`^${escaped}$`);
-  }
-};
-// ReDoS protection constants
-// Pattern length allows for long prefixes (e.g., remember:session:{uuid}:user:*)
-__publicField(RememberMemoryProvider, "MAX_PATTERN_LENGTH", 500);
-__publicField(RememberMemoryProvider, "MAX_WILDCARDS", 20);
-RememberMemoryProvider = __decorateClass([
-  Provider2({
-    name: "provider:remember:memory",
-    description: "In-memory storage provider for RememberPlugin",
-    scope: ProviderScope2.GLOBAL
-  })
-], RememberMemoryProvider);
-
-// plugins/plugin-remember/src/providers/remember-redis.provider.ts
-import Redis from "ioredis";
-import { Provider as Provider3, ProviderScope as ProviderScope3 } from "@frontmcp/sdk";
-
-// plugins/plugin-remember/src/providers/remember-key-prefix.ts
-function prefixedStoreKey(keyPrefix, key) {
-  return keyPrefix && key.startsWith(keyPrefix) ? key : keyPrefix + key;
-}
-function doubledPrefixKey(keyPrefix, key) {
-  return keyPrefix && key.startsWith(keyPrefix) ? keyPrefix + key : void 0;
-}
-function callerKeyOf(keyPrefix, pattern, backendKey) {
-  return keyPrefix && pattern.startsWith(keyPrefix) ? backendKey : backendKey.slice(keyPrefix.length);
-}
-var SET_IF_NEITHER_KEY_EXISTS_SCRIPT = `
+var __defProp=Object.defineProperty;var __getOwnPropDesc=Object.getOwnPropertyDescriptor;var __defNormalProp=(obj,key,value)=>key in obj?__defProp(obj,key,{enumerable:true,configurable:true,writable:true,value}):obj[key]=value;var __decorateClass=(decorators,target,key,kind)=>{var result=kind>1?void 0:kind?__getOwnPropDesc(target,key):target;for(var i=decorators.length-1,decorator;i>=0;i--)if(decorator=decorators[i])result=(kind?decorator(target,key,result):decorator(result))||result;if(kind&&result)__defProp(target,key,result);return result};var __publicField=(obj,key,value)=>__defNormalProp(obj,typeof key!=="symbol"?key+"":key,value);import{DynamicPlugin,FRONTMCP_CONTEXT,FrontMcpConfig,FrontMcpLogger,getGlobalStoreConfig,isVercelKvProvider,Plugin,ProviderScope as ProviderScope5}from"@frontmcp/sdk";import{getRunningTool,isAnonymousSubject,Provider,ProviderScope,STATELESS_SESSION_ID}from"@frontmcp/sdk";import{base64urlDecode,base64urlEncode as base64urlEncode2,decryptAesGcm,encryptAesGcm,hkdfSha256,randomBytes as randomBytes2}from"@frontmcp/utils";import*as path from"path";import{z}from"@frontmcp/lazy-zod";import{base64urlEncode,mkdir,randomBytes,readFile,rename,unlink,writeFile}from"@frontmcp/utils";var DEFAULT_SECRET_FILE_PATH=".frontmcp/remember-secret.json";var SECRET_BYTES=32;var rememberSecretDataSchema=z.object({secret:z.string().min(32),createdAt:z.number().positive().int(),version:z.literal(1)});function validateSecretData(data){const result=rememberSecretDataSchema.safeParse(data);if(!result.success){return{valid:false,error:result.error.issues[0]?.message??"Invalid secret structure"}}const parsed=result.data;const now=Date.now();if(parsed.createdAt>now+6e4){return{valid:false,error:"createdAt is in the future"}}const hundredYearsMs=100*365*24*60*60*1e3;if(parsed.createdAt<now-hundredYearsMs){return{valid:false,error:"createdAt is too old"}}return{valid:true}}function isSecretPersistenceEnabled(options){const isProduction=process.env["NODE_ENV"]==="production";if(isProduction){return options?.forceEnable===true}return true}function resolveSecretPath(options){const secretPath=options?.secretPath??DEFAULT_SECRET_FILE_PATH;if(path.isAbsolute(secretPath)){return secretPath}return path.resolve(process.cwd(),secretPath)}async function loadRememberSecret(options){if(!isSecretPersistenceEnabled(options)){return null}const secretPath=resolveSecretPath(options);try{const content=await readFile(secretPath,"utf8");const data=JSON.parse(content);const validation=validateSecretData(data);if(!validation.valid){console.warn(`[RememberSecretPersistence] Invalid secret file format at ${secretPath}: ${validation.error}, will regenerate`);return null}return data}catch(error){if(error.code==="ENOENT"){return null}console.warn(`[RememberSecretPersistence] Failed to load secret from ${secretPath}: ${error.message}`);return null}}async function saveRememberSecret(secretData,options){if(!isSecretPersistenceEnabled(options)){return true}const secretPath=resolveSecretPath(options);const dir=path.dirname(secretPath);const tempPath=`${secretPath}.tmp.${Date.now()}.${base64urlEncode(randomBytes(8))}`;try{await mkdir(dir,{recursive:true,mode:448});const content=JSON.stringify(secretData,null,2);await writeFile(tempPath,content,{mode:384});await rename(tempPath,secretPath);return true}catch(error){console.error(`[RememberSecretPersistence] Failed to save secret to ${secretPath}: ${error.message}`);try{await unlink(tempPath)}catch{}return false}}var cachedSecret=null;var secretGenerationPromise=null;function generateSecret(){return base64urlEncode(randomBytes(SECRET_BYTES))}async function getOrCreatePersistedSecret(options){if(cachedSecret){return cachedSecret}if(secretGenerationPromise){return secretGenerationPromise}secretGenerationPromise=(async()=>{try{const loaded=await loadRememberSecret(options);if(loaded){cachedSecret=loaded.secret;return cachedSecret}const newSecret=generateSecret();const secretData={secret:newSecret,createdAt:Date.now(),version:1};if(isSecretPersistenceEnabled(options)){await saveRememberSecret(secretData,options)}else{console.warn("[RememberSecretPersistence] No REMEMBER_SECRET (or MCP_MEMORY_SECRET / MCP_SESSION_SECRET) is set in production, so a random in-memory secret is used. Encrypted memory will be unreadable after a restart and by other instances sharing the store. Set REMEMBER_SECRET to the same value on every instance.")}cachedSecret=newSecret;return cachedSecret}finally{secretGenerationPromise=null}})();return secretGenerationPromise}async function getBaseSecret(){const envSecret=process.env["REMEMBER_SECRET"]||process.env["MCP_MEMORY_SECRET"]||process.env["MCP_SESSION_SECRET"];if(envSecret){return envSecret}return getOrCreatePersistedSecret()}async function secretFor(source){return source.secret?source.secret:getBaseSecret()}var textEncoder=new TextEncoder;async function deriveEncryptionKey(source){const salt=textEncoder.encode("remember-plugin-v1");let ikm;let context;switch(source.type){case"session":ikm=await secretFor(source)+source.sessionId;context=`remember:session:${source.sessionId}`;break;case"tool":ikm=await secretFor(source)+source.sessionId;context=`remember:tool:${source.toolName}:${source.sessionId}`;break;case"user":ikm=await secretFor(source)+source.userId;context=`remember:user:${source.userId}`;break;case"global":ikm=await secretFor(source);context="remember:global";break;case"custom":ikm=source.key;context=`remember:custom:${source.key}`;break}const ikmBytes=textEncoder.encode(ikm);const info=textEncoder.encode(context);return hkdfSha256(ikmBytes,salt,info,32)}function getKeySourceForScope(scope,context,secret){switch(scope){case"session":return{type:"session",sessionId:context.sessionId,secret};case"user":return{type:"user",userId:context.userId??"anonymous",secret};case"tool":return{type:"tool",toolName:context.toolName??"unknown",sessionId:context.sessionId,secret};case"global":return{type:"global",secret}}}var textDecoder=new TextDecoder;async function encryptValue(data,keySource){const key=await deriveEncryptionKey(keySource);const plaintext=textEncoder.encode(JSON.stringify(data));const iv=randomBytes2(12);const{ciphertext,tag}=encryptAesGcm(key,plaintext,iv);return{alg:"A256GCM",iv:base64urlEncode2(iv),tag:base64urlEncode2(tag),data:base64urlEncode2(ciphertext)}}async function decryptValue(blob,keySource){try{const key=await deriveEncryptionKey(keySource);const iv=base64urlDecode(blob.iv);const tag=base64urlDecode(blob.tag);const ciphertext=base64urlDecode(blob.data);const decrypted=decryptAesGcm(key,ciphertext,iv,tag);return JSON.parse(textDecoder.decode(decrypted))}catch{return null}}function serializeBlob(blob){return JSON.stringify(blob)}function deserializeBlob(str){try{const parsed=JSON.parse(str);if(parsed&&typeof parsed==="object"&&parsed.alg==="A256GCM"&&typeof parsed.iv==="string"&&typeof parsed.tag==="string"&&typeof parsed.data==="string"){return parsed}return null}catch{return null}}async function encryptAndSerialize(data,keySource){const blob=await encryptValue(data,keySource);return serializeBlob(blob)}async function deserializeAndDecrypt(str,keySource){const blob=deserializeBlob(str);if(!blob)return null;return decryptValue(blob,keySource)}import{InternalMcpError,PublicMcpError}from"@frontmcp/sdk";var RememberIdentityError=class extends PublicMcpError{name="RememberIdentityError";constructor(message){super(message,"REMEMBER_IDENTITY_REQUIRED",403)}};var RememberScopeNotAllowedError=class extends PublicMcpError{name="RememberScopeNotAllowedError";constructor(scope,allowedScopes){super(`Scope '${scope}' is not allowed. Allowed scopes: ${allowedScopes.join(", ")}`,"REMEMBER_SCOPE_NOT_ALLOWED",400)}};var RememberConfigurationError=class extends InternalMcpError{name="RememberConfigurationError";constructor(message){super(message,"REMEMBER_CONFIGURATION")}};var LEGACY_SCOPES=["session","tool","user"];var DEFAULT_LEGACY_PURGE_DELAY_MS=864e5;var LAYOUT_MARKER_KEY="__layout__";var LAYOUT_VERSION=2;var MAX_TIMER_MS=2147483647;var scheduled=new WeakSet;function parseFirstSeenAt(raw){if(!raw)return void 0;try{const parsed=typeof raw==="string"?JSON.parse(raw):raw;const firstSeenAt=parsed?.firstSeenAt;return typeof firstSeenAt==="number"&&Number.isFinite(firstSeenAt)?firstSeenAt:void 0}catch{return void 0}}async function readLayoutFirstSeenAt(store,keyPrefix,logger,markerTtlSeconds){const key=`${keyPrefix}${LAYOUT_MARKER_KEY}`;const standDown=(reason,extra={})=>{logger?.debug?.(`remember: ${reason}, legacy purge stood down`,{key,...extra});return void 0};try{const existing=await store.getValue(key);if(existing){return parseFirstSeenAt(existing)??standDown("layout marker is unreadable")}const marker={version:LAYOUT_VERSION,firstSeenAt:Date.now()};const serialized=JSON.stringify(marker);if(!store.setIfAbsent){await store.setValue(key,serialized,markerTtlSeconds);return marker.firstSeenAt}if(await store.setIfAbsent(key,serialized,markerTtlSeconds)){return marker.firstSeenAt}const winner=await store.getValue(key);return parseFirstSeenAt(winner)??standDown("layout marker vanished after a lost race")}catch(error){return standDown("could not establish the layout marker",{error:error instanceof Error?error.message:String(error)})}}async function purgeLegacyRememberEntries(store,keyPrefix,logger){let deleted=0;for(const scope of LEGACY_SCOPES){const pattern=`${keyPrefix}${scope}:*`;let keys;try{keys=await store.keys(pattern)}catch(error){logger?.debug?.("remember: legacy purge skipped, store could not list keys",{pattern,error:error instanceof Error?error.message:String(error)});continue}for(const key of keys){try{await store.delete(key);deleted+=1}catch{}}}if(deleted>0){logger?.warn?.(`remember: purged ${deleted} entr${deleted===1?"y":"ies"} left unreadable by the session/tool key-derivation change and the namespace encoding. This is a one-time upgrade step; set skipLegacyPurge to handle the migration yourself.`)}return deleted}function scheduleLegacyRememberPurge(store,keyPrefix,options={}){if(scheduled.has(store))return;scheduled.add(store);const delayMs=options.delayMs??DEFAULT_LEGACY_PURGE_DELAY_MS;const markerTtlSeconds=options.defaultTTL?Math.max(options.defaultTTL,Math.ceil(2*delayMs/1e3)):void 0;const arm=waitMs=>{const timer=setTimeout(()=>{void attempt().catch(()=>void 0)},Math.min(waitMs,MAX_TIMER_MS));timer.unref?.()};const attempt=async()=>{const firstSeenAt=await readLayoutFirstSeenAt(store,keyPrefix,options.logger,markerTtlSeconds);if(firstSeenAt===void 0)return;const remainingMs=firstSeenAt+delayMs-Date.now();if(remainingMs>0){arm(remainingMs);return}await purgeLegacyRememberEntries(store,keyPrefix,options.logger)};void attempt().catch(()=>void 0)}var STORAGE_LAYOUT_VERSION="v2";function encodeKeyPart(value){return encodeURIComponent(value)}function remainingSeconds(expiresAt,now){return Math.max(1,Math.ceil((expiresAt-now)/1e3))}function expiryAfter(ttlSeconds,now){return ttlSeconds?now+ttlSeconds*1e3:void 0}var RememberAccessor=class{store;ctx;config;keyPrefix;encryptionEnabled;constructor(store,ctx,config,logger){this.store=store;this.ctx=ctx;this.config=config;this.keyPrefix=config.keyPrefix??"remember:";this.encryptionEnabled=config.encryption?.enabled!==false;if(!config.skipLegacyPurge){scheduleLegacyRememberPurge(store,this.keyPrefix,{delayMs:config.legacyPurgeDelayMs,defaultTTL:config.defaultTTL,logger})}}async set(key,value,options={}){const scope=options.scope??"session";const storageKey=this.buildStorageKey(key,scope);const now=Date.now();const ttlSeconds=options.ttl??this.config.defaultTTL;const entry={value,brand:options.brand,createdAt:now,updatedAt:now,expiresAt:expiryAfter(ttlSeconds,now),metadata:options.metadata};const serialized=this.encryptionEnabled?await encryptAndSerialize(entry,this.getKeySource(scope)):JSON.stringify(entry);await this.store.setValue(storageKey,serialized,ttlSeconds);return entry}async get(key,options={}){const scope=options.scope??"session";const entry=await this.readEntry(this.buildStorageKey(key,scope),scope);return entry?entry.value:options.defaultValue}async getEntry(key,options={}){const scope=options.scope??"session";return this.readEntry(this.buildStorageKey(key,scope),scope)}async forget(key,options={}){const scope=options.scope??"session";const storageKey=this.buildStorageKey(key,scope);await this.store.delete(storageKey)}async knows(key,options={}){const scope=options.scope??"session";return await this.readEntry(this.buildStorageKey(key,scope),scope)!==void 0}async list(options={}){const scope=options.scope??"session";const scopePrefix=this.buildScopePrefix(scope);const storageKeys=await this.store.keys(scopePrefix+(options.pattern??"*"));const entries=await Promise.all(storageKeys.map(storageKey=>this.readEntry(storageKey,scope)));return storageKeys.filter((_storageKey,index)=>entries[index]!==void 0).map(storageKey=>storageKey.slice(scopePrefix.length))}async update(key,value,options={}){const scope=options.scope??"session";const existing=await this.getEntry(key,{scope});if(!existing)return false;const now=Date.now();const expiresAt=expiryAfter(options.ttl,now)??existing.expiresAt??expiryAfter(this.config.defaultTTL,now);const entry={...existing,value,updatedAt:now,expiresAt};const storageKey=this.buildStorageKey(key,scope);const serialized=this.encryptionEnabled?await encryptAndSerialize(entry,this.getKeySource(scope)):JSON.stringify(entry);const writtenAt=Date.now();if(expiresAt!==void 0&&expiresAt<=writtenAt)return false;const storageTtl=expiresAt!==void 0?remainingSeconds(expiresAt,writtenAt):void 0;await this.store.setValue(storageKey,serialized,storageTtl);return true}get sessionId(){return this.ctx.sessionId}get userId(){const authInfo=this.ctx.authInfo;return authInfo?.extra?.["userId"]??authInfo?.extra?.["sub"]??authInfo?.clientId??void 0}buildStorageKey(key,scope){return this.buildScopePrefix(scope)+key}get verifiedSessionId(){const authInfo=this.ctx.authInfo;return[authInfo?.sessionId,authInfo?.extra?.["sessionId"]].find(candidate=>typeof candidate==="string"&&candidate.length>0&&candidate!==STATELESS_SESSION_ID)}resolveSessionIdentity(){const sessionId=this.verifiedSessionId;if(sessionId){return sessionId}const userId=this.userId;if(userId&&!isAnonymousSubject(userId)){return`stateless-user:${userId}`}throw new RememberIdentityError(`Remember cannot use session or tool scope for an unauthenticated request without a verified session: a stateless request shares the session id "${STATELESS_SESSION_ID}", and an mcp-session-id the server did not verify could belong to any caller, so the data would be shared across clients. Authenticate the request, use a stateful transport, or choose the 'global' scope if the data really is shared.`)}get toolName(){return getRunningTool()?.fullName??"unknown"}buildScopePrefix(scope){switch(scope){case"session":return`${this.keyPrefix}${STORAGE_LAYOUT_VERSION}:session:${encodeKeyPart(this.resolveSessionIdentity())}:`;case"user":{const userId=this.userId;if(!userId||isAnonymousSubject(userId)){throw new RememberIdentityError("Remember cannot use user scope without an authenticated user: all unauthenticated callers would share one namespace. Authenticate the request or use the 'global' scope.")}return`${this.keyPrefix}${STORAGE_LAYOUT_VERSION}:user:${encodeKeyPart(userId)}:`}case"tool":return`${this.keyPrefix}${STORAGE_LAYOUT_VERSION}:tool:${encodeKeyPart(this.toolName)}:${encodeKeyPart(this.resolveSessionIdentity())}:`;case"global":return`${this.keyPrefix}global:`}}getKeySource(scope){const needsSessionIdentity=scope==="session"||scope==="tool";return getKeySourceForScope(scope,{sessionId:needsSessionIdentity?this.resolveSessionIdentity():this.ctx.sessionId,userId:this.userId,toolName:scope==="tool"?this.toolName:void 0},this.config.encryption?.customKey)}async readEntry(storageKey,scope){const stored=await this.store.getValue(storageKey);if(!stored)return void 0;const raw=typeof stored==="string"?stored:JSON.stringify(stored);const entry=this.encryptionEnabled?await deserializeAndDecrypt(raw,this.getKeySource(scope)):this.parseEntry(raw);if(!entry)return void 0;if(entry.expiresAt&&Date.now()>entry.expiresAt){await this.store.delete(storageKey);return void 0}return entry}parseEntry(raw){try{return JSON.parse(raw)}catch{return null}}};RememberAccessor=__decorateClass([Provider({name:"provider:remember:accessor",description:"Context-scoped accessor for RememberPlugin storage",scope:ProviderScope.CONTEXT})],RememberAccessor);function createRememberAccessor(store,ctx,config,logger){return new RememberAccessor(store,ctx,config,logger)}import{Provider as Provider2,ProviderScope as ProviderScope2}from"@frontmcp/sdk";var MAX_TIMEOUT_MS=2**31-1;var RememberMemoryProvider=class{constructor(sweepIntervalSeconds=60,defaultTTL){this.defaultTTL=defaultTTL;this.sweeper=setInterval(()=>this.sweep(),sweepIntervalSeconds*1e3);this.sweeper.unref?.()}defaultTTL;memory=new Map;sweeper;async setValue(key,value,ttlSeconds){const strValue=JSON.stringify(value);const existing=this.memory.get(key);if(existing?.timeout)clearTimeout(existing.timeout);const entry={value:strValue};const ttl=ttlSeconds??this.defaultTTL;if(ttl&&ttl>0){const ttlMs=ttl*1e3;entry.expiresAt=Date.now()+ttlMs;if(ttlMs<=MAX_TIMEOUT_MS){entry.timeout=setTimeout(()=>{const e=this.memory.get(key);if(e&&e.expiresAt&&e.expiresAt<=Date.now()){this.memory.delete(key)}},ttlMs);entry.timeout.unref?.()}}this.memory.set(key,entry)}async setIfAbsent(key,value,ttlSeconds){const existing=this.memory.get(key);if(existing&&!this.isExpired(existing))return false;await this.setValue(key,value,ttlSeconds);return true}async getValue(key,defaultValue){const entry=this.memory.get(key);if(!entry)return defaultValue;if(this.isExpired(entry)){await this.delete(key);return defaultValue}try{return JSON.parse(entry.value)}catch{return entry.value}}async delete(key){const entry=this.memory.get(key);if(entry?.timeout)clearTimeout(entry.timeout);this.memory.delete(key)}async exists(key){const entry=this.memory.get(key);if(!entry)return false;if(this.isExpired(entry)){await this.delete(key);return false}return true}async keys(pattern){const result=[];const regex=pattern?this.patternToRegex(pattern):null;const expiredKeys=[];for(const[key,entry]of this.memory){if(this.isExpired(entry)){expiredKeys.push(key)}}for(const key of expiredKeys){await this.delete(key)}for(const[key,entry]of this.memory){if(this.isExpired(entry)){continue}if(regex&&!regex.test(key)){continue}result.push(key)}return result}async close(){if(this.sweeper)clearInterval(this.sweeper);for(const[,entry]of this.memory){if(entry.timeout)clearTimeout(entry.timeout)}this.memory.clear()}isExpired(entry){return entry.expiresAt!==void 0&&entry.expiresAt<=Date.now()}sweep(){const now=Date.now();for(const[key,entry]of this.memory){if(entry.expiresAt!==void 0&&entry.expiresAt<=now){if(entry.timeout)clearTimeout(entry.timeout);this.memory.delete(key)}}}patternToRegex(pattern){if(pattern.length>RememberMemoryProvider.MAX_PATTERN_LENGTH){throw new Error(`Pattern too long: ${pattern.length} chars (max ${RememberMemoryProvider.MAX_PATTERN_LENGTH})`)}const wildcardCount=(pattern.match(/[*?]/g)||[]).length;if(wildcardCount>RememberMemoryProvider.MAX_WILDCARDS){throw new Error(`Too many wildcards in pattern: ${wildcardCount} (max ${RememberMemoryProvider.MAX_WILDCARDS})`)}const escaped=pattern.replace(/[.+^${}()|[\]\\]/g,"\\$&").replace(/\*/g,".*").replace(/\?/g,".");return new RegExp(`^${escaped}$`)}};__publicField(RememberMemoryProvider,"MAX_PATTERN_LENGTH",500);__publicField(RememberMemoryProvider,"MAX_WILDCARDS",20);RememberMemoryProvider=__decorateClass([Provider2({name:"provider:remember:memory",description:"In-memory storage provider for RememberPlugin",scope:ProviderScope2.GLOBAL})],RememberMemoryProvider);import Redis from"ioredis";import{Provider as Provider3,ProviderScope as ProviderScope3}from"@frontmcp/sdk";function prefixedStoreKey(keyPrefix,key){return keyPrefix&&key.startsWith(keyPrefix)?key:keyPrefix+key}function doubledPrefixKey(keyPrefix,key){return keyPrefix&&key.startsWith(keyPrefix)?keyPrefix+key:void 0}function callerKeyOf(keyPrefix,pattern,backendKey){return keyPrefix&&pattern.startsWith(keyPrefix)?backendKey:backendKey.slice(keyPrefix.length)}var SET_IF_NEITHER_KEY_EXISTS_SCRIPT=`
 if redis.call('EXISTS', KEYS[1], KEYS[2]) > 0 then return 0 end
 if ARGV[2] ~= '' then redis.call('SET', KEYS[1], ARGV[1], 'EX', ARGV[2]) else redis.call('SET', KEYS[1], ARGV[1]) end
 return 1
-`;
-
-// plugins/plugin-remember/src/providers/remember-redis.provider.ts
-var RememberRedisProvider = class {
-  client;
-  /**
-   * Prefix prepended to Redis keys that don't already start with it.
-   * Include any separator (e.g., "myapp:" or "user:123:") as part of the prefix.
-   */
-  keyPrefix;
-  /** TTL in seconds for values stored without one. */
-  defaultTTL;
-  /** True if this provider created the client (and should close it), false if externally provided */
-  ownsClient;
-  constructor(options) {
-    this.keyPrefix = options.keyPrefix ?? "";
-    this.defaultTTL = options.defaultTTL;
-    if (options.type === "redis-client") {
-      this.client = options.client;
-      this.ownsClient = false;
-      return;
-    }
-    this.ownsClient = true;
-    this.client = new Redis({
-      lazyConnect: false,
-      maxRetriesPerRequest: 3,
-      ...options.config
-    });
-    this.client.on("connect", () => {
-      if (process.env["DEBUG"] === "true") {
-        console.log("[RememberPlugin:Redis] Connected");
-      }
-    });
-    this.client.on("error", (err) => {
-      console.error("[RememberPlugin:Redis] Error:", err.message);
-    });
-  }
-  /**
-   * Store a value with optional TTL.
-   *
-   * @param key - The key to store under
-   * @param value - The value to store (must not be undefined)
-   * @param ttlSeconds - Optional TTL in seconds (must be positive integer if provided)
-   * @throws Error if value is undefined or ttlSeconds is invalid
-   */
-  async setValue(key, value, ttlSeconds) {
-    if (value === void 0) {
-      throw new Error("Cannot store undefined value. Use null or delete the key instead.");
-    }
-    if (ttlSeconds !== void 0) {
-      if (typeof ttlSeconds !== "number" || !Number.isFinite(ttlSeconds)) {
-        throw new Error(`Invalid TTL: expected a number, got ${typeof ttlSeconds}`);
-      }
-      if (ttlSeconds <= 0) {
-        throw new Error(`Invalid TTL: must be positive, got ${ttlSeconds}`);
-      }
-      if (!Number.isInteger(ttlSeconds)) {
-        throw new Error(`Invalid TTL: must be an integer, got ${ttlSeconds}`);
-      }
-    }
-    const fullKey = prefixedStoreKey(this.keyPrefix, key);
-    const strValue = JSON.stringify(value);
-    const ttl = ttlSeconds ?? this.defaultTTL;
-    if (ttl !== void 0 && ttl > 0) {
-      await this.client.set(fullKey, strValue, "EX", ttl);
-    } else {
-      await this.client.set(fullKey, strValue);
-    }
-    await this.deleteDoubledPrefixKey(key);
-  }
-  /**
-   * Store a value only if the key is absent, via Redis `SET ... NX`.
-   *
-   * `set` resolves to `'OK'` when it created the key and `null` when the key already existed,
-   * so the whole check-and-write is one round trip and two callers racing cannot both win.
-   * A key that releases up to 1.9.1 may hold under the doubled prefix counts as present too: one
-   * script checks both keys and writes, so an entry still there is never shadowed.
-   */
-  async setIfAbsent(key, value, ttlSeconds) {
-    const fullKey = prefixedStoreKey(this.keyPrefix, key);
-    const strValue = JSON.stringify(value);
-    const ttl = ttlSeconds ?? this.defaultTTL;
-    const hasTtl = ttl !== void 0 && ttl > 0;
-    const doubledKey = doubledPrefixKey(this.keyPrefix, key);
-    if (doubledKey) {
-      const ttlArgument = hasTtl ? String(ttl) : "";
-      const created = await this.client.eval(
-        SET_IF_NEITHER_KEY_EXISTS_SCRIPT,
-        2,
-        fullKey,
-        doubledKey,
-        strValue,
-        ttlArgument
-      );
-      return created === 1;
-    }
-    const result = hasTtl ? await this.client.set(fullKey, strValue, "EX", ttl, "NX") : await this.client.set(fullKey, strValue, "NX");
-    return result === "OK";
-  }
-  /**
-   * Retrieve a value by key.
-   *
-   * Returns the parsed JSON value if successful, or `defaultValue` if:
-   * - The key does not exist
-   * - The stored value is not valid JSON (malformed or legacy data)
-   *
-   * @param key - The key to retrieve
-   * @param defaultValue - Value to return if key doesn't exist or parsing fails
-   * @returns The parsed value as T, or defaultValue/undefined
-   */
-  async getValue(key, defaultValue) {
-    const raw = await this.client.get(prefixedStoreKey(this.keyPrefix, key)) ?? await this.readDoubledPrefixValue(key);
-    if (raw === null) return defaultValue;
-    try {
-      return JSON.parse(raw);
-    } catch {
-      return defaultValue;
-    }
-  }
-  /**
-   * Delete a key.
-   */
-  async delete(key) {
-    await this.client.del(prefixedStoreKey(this.keyPrefix, key));
-    await this.deleteDoubledPrefixKey(key);
-  }
-  /**
-   * Check if a key exists.
-   */
-  async exists(key) {
-    if (await this.client.exists(prefixedStoreKey(this.keyPrefix, key)) === 1) return true;
-    const doubledKey = doubledPrefixKey(this.keyPrefix, key);
-    return doubledKey !== void 0 && await this.client.exists(doubledKey) === 1;
-  }
-  /**
-   * List keys matching a pattern.
-   * Uses Redis SCAN for efficient iteration.
-   */
-  async keys(pattern = "*") {
-    const result = /* @__PURE__ */ new Set();
-    for (const key of await this.scan(prefixedStoreKey(this.keyPrefix, pattern))) {
-      result.add(callerKeyOf(this.keyPrefix, pattern, key));
-    }
-    const doubledPattern = doubledPrefixKey(this.keyPrefix, pattern);
-    if (doubledPattern) {
-      for (const key of await this.scan(doubledPattern)) result.add(key.slice(this.keyPrefix.length));
-    }
-    return [...result];
-  }
-  async scan(match) {
-    const found = [];
-    let cursor = "0";
-    do {
-      const [nextCursor, keys] = await this.client.scan(cursor, "MATCH", match, "COUNT", 100);
-      cursor = nextCursor;
-      found.push(...keys);
-    } while (cursor !== "0");
-    return found;
-  }
-  /**
-   * The stored text of an entry a release up to 1.9.1 wrote under the doubled key, or null. It is read
-   * in place, not copied: the entry keeps its TTL, a rolled-back release still finds it, and a
-   * concurrent `delete()` cannot be undone by a copy. The next write or delete of the key removes it.
-   */
-  async readDoubledPrefixValue(key) {
-    const doubledKey = doubledPrefixKey(this.keyPrefix, key);
-    return doubledKey ? this.client.get(doubledKey) : null;
-  }
-  /** Drops what releases up to 1.9.1 left under the doubled key, so it cannot come back once this key is gone. */
-  async deleteDoubledPrefixKey(key) {
-    const doubledKey = doubledPrefixKey(this.keyPrefix, key);
-    if (doubledKey) await this.client.del(doubledKey);
-  }
-  /**
-   * Gracefully close the Redis connection.
-   * Only closes if this provider owns the client (created it internally).
-   * Externally-provided clients are left open for the caller to manage.
-   */
-  async close() {
-    if (this.ownsClient) {
-      await this.client.quit();
-    }
-  }
-};
-RememberRedisProvider = __decorateClass([
-  Provider3({
-    name: "provider:remember:redis",
-    description: "Redis-based storage provider for RememberPlugin",
-    scope: ProviderScope3.GLOBAL
-  })
-], RememberRedisProvider);
-
-// plugins/plugin-remember/src/providers/remember-vercel-kv.provider.ts
-import { Provider as Provider4, ProviderScope as ProviderScope4 } from "@frontmcp/sdk";
-import { createVercelKvClient } from "@frontmcp/utils";
-var RememberVercelKvProvider = class {
-  connection;
-  client;
-  keyPrefix;
-  defaultTTL;
-  constructor(options = {}) {
-    const hasUrl = options.url !== void 0;
-    const hasToken = options.token !== void 0;
-    if (hasUrl !== hasToken) {
-      throw new Error(
-        `RememberVercelKvProvider: Both 'url' and 'token' must be provided together, or neither. Received: url=${hasUrl ? "provided" : "missing"}, token=${hasToken ? "provided" : "missing"}`
-      );
-    }
-    this.connection = { url: options.url, token: options.token };
-    this.keyPrefix = options.keyPrefix ?? "remember:";
-    this.defaultTTL = options.defaultTTL;
-  }
-  /**
-   * The client, built on first use from the url and token (or KV_REST_API_URL / KV_REST_API_TOKEN)
-   * by the shared loader, which a Cloudflare Worker can bundle (#711). Values are read back as
-   * stored. A failed attempt is retried.
-   */
-  kv() {
-    this.client ??= createVercelKvClient(this.connection).catch((error) => {
-      this.client = void 0;
-      throw error;
-    });
-    return this.client;
-  }
-  prefixKey(key) {
-    return prefixedStoreKey(this.keyPrefix, key);
-  }
-  /**
-   * Store a value with optional TTL.
-   */
-  async setValue(key, value, ttlSeconds) {
-    const fullKey = this.prefixKey(key);
-    const strValue = JSON.stringify(value);
-    const ttl = ttlSeconds ?? this.defaultTTL;
-    const kv = await this.kv();
-    if (ttl && ttl > 0) {
-      await kv.set(fullKey, strValue, { ex: ttl });
-    } else {
-      await kv.set(fullKey, strValue);
-    }
-    await this.deleteDoubledPrefixKey(key);
-  }
-  /**
-   * Store a value only if the key is absent, via the `nx` option.
-   *
-   * Resolves to `'OK'` when it created the key and `null` when the key already existed, so two
-   * callers racing cannot both win. A key that releases up to 1.9.1 may hold under the doubled
-   * prefix counts as present too: one script checks both keys and writes, so an entry still there
-   * is never shadowed.
-   */
-  async setIfAbsent(key, value, ttlSeconds) {
-    const fullKey = this.prefixKey(key);
-    const strValue = JSON.stringify(value);
-    const ttl = ttlSeconds ?? this.defaultTTL;
-    const doubledKey = doubledPrefixKey(this.keyPrefix, key);
-    const kv = await this.kv();
-    if (doubledKey) {
-      const ttlArgument = ttl && ttl > 0 ? String(ttl) : "";
-      const created = await kv.eval(SET_IF_NEITHER_KEY_EXISTS_SCRIPT, [fullKey, doubledKey], [strValue, ttlArgument]);
-      return Number(created) === 1;
-    }
-    const result = ttl && ttl > 0 ? await kv.set(fullKey, strValue, { nx: true, ex: ttl }) : await kv.set(fullKey, strValue, { nx: true });
-    return result === "OK";
-  }
-  /**
-   * Retrieve a value by key.
-   */
-  async getValue(key, defaultValue) {
-    const kv = await this.kv();
-    const raw = await kv.get(this.prefixKey(key)) ?? await this.readDoubledPrefixValue(key);
-    if (raw === null) return defaultValue;
-    try {
-      return JSON.parse(raw);
-    } catch {
-      return raw;
-    }
-  }
-  /**
-   * Delete a key.
-   */
-  async delete(key) {
-    const kv = await this.kv();
-    await kv.del(this.prefixKey(key));
-    await this.deleteDoubledPrefixKey(key);
-  }
-  /**
-   * Check if a key exists.
-   */
-  async exists(key) {
-    const kv = await this.kv();
-    if (await kv.exists(this.prefixKey(key)) === 1) return true;
-    const doubledKey = doubledPrefixKey(this.keyPrefix, key);
-    return doubledKey !== void 0 && await kv.exists(doubledKey) === 1;
-  }
-  /**
-   * List keys matching a pattern.
-   * Uses SCAN for efficient iteration.
-   */
-  async keys(pattern = "*") {
-    const result = /* @__PURE__ */ new Set();
-    for (const key of await this.scan(this.prefixKey(pattern))) {
-      result.add(callerKeyOf(this.keyPrefix, pattern, key));
-    }
-    const doubledPattern = doubledPrefixKey(this.keyPrefix, pattern);
-    if (doubledPattern) {
-      for (const key of await this.scan(doubledPattern)) result.add(key.slice(this.keyPrefix.length));
-    }
-    return [...result];
-  }
-  async scan(match) {
-    const found = [];
-    const kv = await this.kv();
-    try {
-      let cursor = 0;
-      do {
-        const [nextCursor, keys] = await kv.scan(cursor, { match, count: 100 });
-        cursor = nextCursor;
-        found.push(...keys);
-      } while (String(cursor) !== "0");
-    } catch {
-      try {
-        found.push(...await kv.keys(match));
-      } catch {
-        console.warn("[RememberPlugin:VercelKV] keys() operation not supported");
-      }
-    }
-    return found;
-  }
-  /**
-   * The stored text of an entry a release up to 1.9.1 wrote under the doubled key, or null. It is read
-   * in place, not copied: the entry keeps its TTL, a rolled-back release still finds it, and a
-   * concurrent `delete()` cannot be undone by a copy. The next write or delete of the key removes it.
-   */
-  async readDoubledPrefixValue(key) {
-    const doubledKey = doubledPrefixKey(this.keyPrefix, key);
-    if (!doubledKey) return null;
-    const kv = await this.kv();
-    return kv.get(doubledKey);
-  }
-  /** Drops what releases up to 1.9.1 left under the doubled key, so it cannot come back once this key is gone. */
-  async deleteDoubledPrefixKey(key) {
-    const doubledKey = doubledPrefixKey(this.keyPrefix, key);
-    if (!doubledKey) return;
-    const kv = await this.kv();
-    await kv.del(doubledKey);
-  }
-  /**
-   * Gracefully close the provider.
-   * No-op for Vercel KV as it uses stateless REST API.
-   */
-  async close() {
-  }
-};
-RememberVercelKvProvider = __decorateClass([
-  Provider4({
-    name: "provider:remember:vercel-kv",
-    description: "Vercel KV-based storage provider for RememberPlugin",
-    scope: ProviderScope4.GLOBAL
-  })
-], RememberVercelKvProvider);
-
-// plugins/plugin-remember/src/remember.symbols.ts
-var RememberStoreToken = /* @__PURE__ */ Symbol(
-  "plugin:remember:store"
-);
-var RememberConfigToken = /* @__PURE__ */ Symbol(
-  "plugin:remember:config"
-);
-var RememberAccessorToken = /* @__PURE__ */ Symbol(
-  "plugin:remember:accessor"
-);
-
-// plugins/plugin-remember/src/tools/remember-tools.factory.ts
-import { Tool as Tool5 } from "@frontmcp/sdk";
-
-// plugins/plugin-remember/src/tools/forget.tool.ts
-import { z as z2 } from "@frontmcp/lazy-zod";
-import { Tool, ToolContext } from "@frontmcp/sdk";
-
-// plugins/plugin-remember/src/tools/remember-scope.description.ts
-var REMEMBER_SCOPE_DESCRIPTION = "Whose memory to use (default: session). session: this session; without one (stateless HTTP, MCP 2026-07-28), the signed-in caller across its requests. user: the signed-in caller, across all of its sessions. tool: the tool running the call, for the same caller as session; each memory tool has its own, so the other memory tools do not see what one of them stores in tool scope. global: shared by every caller. An anonymous caller cannot use user scope, nor session or tool scope without a session.";
-
-// plugins/plugin-remember/src/tools/remember-tool-names.ts
-function rememberToolNames(prefix = "") {
-  return {
-    rememberThis: `${prefix}remember_this`,
-    recall: `${prefix}recall`,
-    forget: `${prefix}forget`,
-    listMemories: `${prefix}list_memories`
-  };
-}
-
-// plugins/plugin-remember/src/tools/forget.tool.ts
-var forgetInputSchema = {
-  key: z2.string().min(1).describe("What memory to forget"),
-  scope: z2.enum(["session", "user", "tool", "global"]).optional().describe(REMEMBER_SCOPE_DESCRIPTION)
-};
-var forgetOutputSchema = z2.object({
-  success: z2.boolean(),
-  key: z2.string(),
-  scope: z2.string(),
-  existed: z2.boolean()
-});
-function forgetDescription() {
-  return "Forget a previously remembered value. Use this when the user wants to delete stored preferences or information.";
-}
-function forgetToolMetadata(names = rememberToolNames()) {
-  return {
-    name: names.forget,
-    description: forgetDescription(),
-    inputSchema: forgetInputSchema,
-    outputSchema: forgetOutputSchema,
-    annotations: { readOnlyHint: false }
-  };
-}
-var ForgetTool = class extends ToolContext {
-  async execute(input) {
-    const remember = this.get(RememberAccessorToken);
-    const config = this.get(RememberConfigToken);
-    const scope = input.scope ?? "session";
-    const allowedScopes = config.tools?.allowedScopes ?? ["session", "user", "tool", "global"];
-    if (!allowedScopes.includes(scope)) {
-      throw this.fail(new RememberScopeNotAllowedError(scope, allowedScopes));
-    }
-    const existed = await remember.knows(input.key, { scope });
-    await remember.forget(input.key, { scope });
-    return {
-      success: true,
-      key: input.key,
-      scope,
-      existed
-    };
-  }
-};
-ForgetTool = __decorateClass([
-  Tool(forgetToolMetadata())
-], ForgetTool);
-
-// plugins/plugin-remember/src/tools/list-memories.tool.ts
-import { z as z3 } from "@frontmcp/lazy-zod";
-import { Tool as Tool2, ToolContext as ToolContext2 } from "@frontmcp/sdk";
-var listMemoriesInputSchema = {
-  scope: z3.enum(["session", "user", "tool", "global"]).optional().describe(REMEMBER_SCOPE_DESCRIPTION),
-  pattern: z3.string().optional().describe('Pattern to filter keys (e.g., "user_*")'),
-  limit: z3.number().positive().max(100).optional().describe("Maximum number of keys to return (default: 50)")
-};
-var listMemoriesOutputSchema = z3.object({
-  keys: z3.array(z3.string()),
-  scope: z3.string(),
-  count: z3.number(),
-  truncated: z3.boolean()
-});
-function listMemoriesDescription(names = rememberToolNames()) {
-  return `List the remembered keys in one scope (default: session). Use this to see what memories are stored before you ${names.recall} or ${names.forget} one.`;
-}
-function listMemoriesToolMetadata(names = rememberToolNames()) {
-  return {
-    name: names.listMemories,
-    description: listMemoriesDescription(names),
-    inputSchema: listMemoriesInputSchema,
-    outputSchema: listMemoriesOutputSchema,
-    annotations: { readOnlyHint: true }
-  };
-}
-var ListMemoriesTool = class extends ToolContext2 {
-  async execute(input) {
-    const remember = this.get(RememberAccessorToken);
-    const config = this.get(RememberConfigToken);
-    const scope = input.scope ?? "session";
-    const allowedScopes = config.tools?.allowedScopes ?? ["session", "user", "tool", "global"];
-    if (!allowedScopes.includes(scope)) {
-      throw this.fail(new RememberScopeNotAllowedError(scope, allowedScopes));
-    }
-    const limit = input.limit ?? 50;
-    let keys = await remember.list({ scope, pattern: input.pattern });
-    const truncated = keys.length > limit;
-    if (truncated) {
-      keys = keys.slice(0, limit);
-    }
-    return {
-      keys,
-      scope,
-      count: keys.length,
-      truncated
-    };
-  }
-};
-ListMemoriesTool = __decorateClass([
-  Tool2(listMemoriesToolMetadata())
-], ListMemoriesTool);
-
-// plugins/plugin-remember/src/tools/recall.tool.ts
-import { z as z4 } from "@frontmcp/lazy-zod";
-import { Tool as Tool3, ToolContext as ToolContext3 } from "@frontmcp/sdk";
-var recallInputSchema = {
-  key: z4.string().min(1).describe("What memory to recall"),
-  scope: z4.enum(["session", "user", "tool", "global"]).optional().describe(REMEMBER_SCOPE_DESCRIPTION)
-};
-var recallOutputSchema = z4.object({
-  found: z4.boolean(),
-  key: z4.string(),
-  value: z4.unknown().optional(),
-  scope: z4.string(),
-  createdAt: z4.number().optional(),
-  expiresAt: z4.number().optional()
-});
-function recallDescription(names = rememberToolNames()) {
-  return `Recall something that was previously remembered. Use this to retrieve stored preferences, settings, or any information that was saved with ${names.rememberThis}.`;
-}
-function recallToolMetadata(names = rememberToolNames()) {
-  return {
-    name: names.recall,
-    description: recallDescription(names),
-    inputSchema: recallInputSchema,
-    outputSchema: recallOutputSchema,
-    annotations: { readOnlyHint: true }
-  };
-}
-var RecallTool = class extends ToolContext3 {
-  async execute(input) {
-    const remember = this.get(RememberAccessorToken);
-    const config = this.get(RememberConfigToken);
-    const scope = input.scope ?? "session";
-    const allowedScopes = config.tools?.allowedScopes ?? ["session", "user", "tool", "global"];
-    if (!allowedScopes.includes(scope)) {
-      throw this.fail(new RememberScopeNotAllowedError(scope, allowedScopes));
-    }
-    const entry = await remember.getEntry(input.key, { scope });
-    if (!entry) {
-      return {
-        found: false,
-        key: input.key,
-        scope
-      };
-    }
-    return {
-      found: true,
-      key: input.key,
-      value: entry.value,
-      scope,
-      createdAt: entry.createdAt,
-      expiresAt: entry.expiresAt
-    };
-  }
-};
-RecallTool = __decorateClass([
-  Tool3(recallToolMetadata())
-], RecallTool);
-
-// plugins/plugin-remember/src/tools/remember-this.tool.ts
-import { z as z5 } from "@frontmcp/lazy-zod";
-import { Tool as Tool4, ToolContext as ToolContext4 } from "@frontmcp/sdk";
-var rememberThisInputSchema = {
-  key: z5.string().min(1).describe('What to call this memory (e.g., "user_preference", "last_action")'),
-  value: z5.unknown().describe("The value to remember (any JSON-serializable data)"),
-  scope: z5.enum(["session", "user", "tool", "global"]).optional().describe(REMEMBER_SCOPE_DESCRIPTION),
-  ttl: z5.number().int().positive().optional().describe("Forget after this many whole seconds"),
-  brand: z5.enum(["preference", "cache", "state", "conversation", "custom"]).optional().describe("Type hint for the stored value")
-};
-var rememberThisOutputSchema = z5.object({
-  success: z5.boolean(),
-  key: z5.string(),
-  scope: z5.string(),
-  expiresAt: z5.number().optional()
-});
-function rememberThisDescription(names = rememberToolNames()) {
-  return `Remember something for later: store a value under a key that ${names.recall} can read back, in the scope you choose (this session by default; user scope for the signed-in user across sessions). It lasts until it is forgotten or its ttl runs out. Use this when the user asks you to remember preferences, settings, or any information they want to persist.`;
-}
-function rememberThisToolMetadata(names = rememberToolNames()) {
-  return {
-    name: names.rememberThis,
-    description: rememberThisDescription(names),
-    inputSchema: rememberThisInputSchema,
-    outputSchema: rememberThisOutputSchema,
-    annotations: { readOnlyHint: false }
-  };
-}
-var RememberThisTool = class extends ToolContext4 {
-  async execute(input) {
-    const remember = this.get(RememberAccessorToken);
-    const config = this.get(RememberConfigToken);
-    const scope = input.scope ?? "session";
-    const allowedScopes = config.tools?.allowedScopes ?? ["session", "user", "tool", "global"];
-    if (!allowedScopes.includes(scope)) {
-      throw this.fail(new RememberScopeNotAllowedError(scope, allowedScopes));
-    }
-    const entry = await remember.set(input.key, input.value, {
-      scope,
-      ttl: input.ttl,
-      brand: input.brand
-    });
-    return {
-      success: true,
-      key: input.key,
-      scope,
-      expiresAt: entry.expiresAt
-    };
-  }
-};
-RememberThisTool = __decorateClass([
-  Tool4(rememberThisToolMetadata())
-], RememberThisTool);
-
-// plugins/plugin-remember/src/tools/remember-tools.factory.ts
-function createRememberTools(prefix = "") {
-  if (!prefix) return [RememberThisTool, RecallTool, ForgetTool, ListMemoriesTool];
-  const names = rememberToolNames(prefix);
-  let PrefixedRememberThisTool = class extends RememberThisTool {
-  };
-  PrefixedRememberThisTool = __decorateClass([
-    Tool5(rememberThisToolMetadata(names))
-  ], PrefixedRememberThisTool);
-  let PrefixedRecallTool = class extends RecallTool {
-  };
-  PrefixedRecallTool = __decorateClass([
-    Tool5(recallToolMetadata(names))
-  ], PrefixedRecallTool);
-  let PrefixedForgetTool = class extends ForgetTool {
-  };
-  PrefixedForgetTool = __decorateClass([
-    Tool5(forgetToolMetadata(names))
-  ], PrefixedForgetTool);
-  let PrefixedListMemoriesTool = class extends ListMemoriesTool {
-  };
-  PrefixedListMemoriesTool = __decorateClass([
-    Tool5(listMemoriesToolMetadata(names))
-  ], PrefixedListMemoriesTool);
-  return [PrefixedRememberThisTool, PrefixedRecallTool, PrefixedForgetTool, PrefixedListMemoriesTool];
-}
-
-// plugins/plugin-remember/src/remember.plugin.ts
-function withCheckedOptions(options) {
-  const customKey = options.encryption?.customKey;
-  if (customKey !== void 0 && customKey.trim() === "") {
-    throw new RememberConfigurationError(
-      "RememberPlugin encryption.customKey must not be empty; omit it to derive keys from the server secret"
-    );
-  }
-  const { defaultTTL } = options;
-  if (defaultTTL === void 0) return options;
-  if (defaultTTL === 0) return { ...options, defaultTTL: void 0 };
-  if (!Number.isInteger(defaultTTL) || defaultTTL < 0) {
-    throw new RememberConfigurationError(
-      `RememberPlugin defaultTTL must be a whole number of seconds (0 for no default expiry), got ${defaultTTL}`
-    );
-  }
-  return options;
-}
-var RememberPlugin = class extends DynamicPlugin {
-  options;
-  constructor(options = {}) {
-    super();
-    this.options = {
-      ...RememberPlugin.defaultOptions,
-      ...withCheckedOptions(options)
-    };
-  }
-};
-__publicField(RememberPlugin, "defaultOptions", {
-  type: "memory",
-  keyPrefix: "remember:",
-  encryption: { enabled: true }
-});
-/**
- * The memory tools, when `tools.enabled` is set: `remember_this`, `recall`, `forget` and
- * `list_memories`, under `tools.prefix`.
- */
-__publicField(RememberPlugin, "dynamicTools", (options) => options.tools?.enabled ? createRememberTools(options.tools.prefix) : []);
-/**
- * Dynamic providers based on plugin options.
- */
-__publicField(RememberPlugin, "dynamicProviders", (options) => {
-  const providers = [];
-  const config = {
-    ...RememberPlugin.defaultOptions,
-    ...withCheckedOptions(options)
-  };
-  switch (config.type) {
-    case "global-store":
-      providers.push({
-        name: "remember:store:global",
-        provide: RememberStoreToken,
-        inject: () => [FrontMcpConfig],
-        useFactory: (frontmcpConfig) => {
-          const storeConfig = getGlobalStoreConfig("RememberPlugin", frontmcpConfig);
-          if (isVercelKvProvider(storeConfig)) {
-            return new RememberVercelKvProvider({
-              url: storeConfig.url,
-              token: storeConfig.token,
-              keyPrefix: config.keyPrefix,
-              defaultTTL: config.defaultTTL
-            });
-          }
-          return new RememberRedisProvider({
-            type: "redis",
-            config: {
-              host: storeConfig.host ?? "localhost",
-              port: storeConfig.port ?? 6379,
-              password: storeConfig.password,
-              db: storeConfig.db
-            },
-            keyPrefix: config.keyPrefix,
-            defaultTTL: config.defaultTTL
-          });
-        }
-      });
-      break;
-    case "redis":
-      if ("config" in config && config.config) {
-        providers.push({
-          name: "remember:store:redis",
-          provide: RememberStoreToken,
-          useValue: new RememberRedisProvider({
-            type: "redis",
-            config: config.config,
-            keyPrefix: config.keyPrefix,
-            defaultTTL: config.defaultTTL
-          })
-        });
-      }
-      break;
-    case "redis-client":
-      if ("client" in config && config.client) {
-        providers.push({
-          name: "remember:store:redis-client",
-          provide: RememberStoreToken,
-          useValue: new RememberRedisProvider({
-            type: "redis-client",
-            client: config.client,
-            keyPrefix: config.keyPrefix,
-            defaultTTL: config.defaultTTL
-          })
-        });
-      }
-      break;
-    case "vercel-kv":
-      providers.push({
-        name: "remember:store:vercel-kv",
-        provide: RememberStoreToken,
-        useValue: new RememberVercelKvProvider({
-          url: "url" in config ? config.url : void 0,
-          token: "token" in config ? config.token : void 0,
-          keyPrefix: config.keyPrefix,
-          defaultTTL: config.defaultTTL
-        })
-      });
-      break;
-    case "memory":
-    default:
-      providers.push({
-        name: "remember:store:memory",
-        provide: RememberStoreToken,
-        // Built per server: `init()` runs once, so a value here would be shared by every server using it.
-        inject: () => [],
-        useFactory: () => new RememberMemoryProvider(void 0, config.defaultTTL)
-      });
-      break;
-  }
-  providers.push({
-    name: "remember:config",
-    provide: RememberConfigToken,
-    useValue: config
-  });
-  providers.push({
-    name: "remember:accessor",
-    provide: RememberAccessorToken,
-    scope: ProviderScope5.CONTEXT,
-    inject: () => [RememberStoreToken, FRONTMCP_CONTEXT, RememberConfigToken, FrontMcpLogger],
-    useFactory: (store, ctx, cfg, logger) => createRememberAccessor(store, ctx, cfg, logger)
-  });
-  return providers;
-});
-RememberPlugin = __decorateClass([
-  Plugin({
-    name: "remember",
-    description: "Help your LLM remember things across sessions",
-    providers: [
-      // Default in-memory provider (overridden by dynamicProviders if configured). A factory, so each
-      // server gets its own store: a value built here is one store for every server in the process.
-      {
-        name: "remember:store:memory",
-        provide: RememberStoreToken,
-        inject: () => [],
-        useFactory: () => new RememberMemoryProvider()
-      }
-    ],
-    // Context extensions - SDK handles runtime installation
-    // TypeScript types are declared in remember.context-extension.ts
-    contextExtensions: [
-      {
-        property: "remember",
-        token: RememberAccessorToken,
-        errorMessage: "RememberPlugin is not installed. Add RememberPlugin.init() to your plugins array."
-      }
-    ]
-  })
-], RememberPlugin);
-
-// plugins/plugin-remember/src/remember.types.ts
-import { z as z6 } from "@frontmcp/lazy-zod";
-var rememberScopeSchema = z6.enum(["session", "user", "tool", "global"]);
-function brand(data, _brand) {
-  return data;
-}
-var rememberEntrySchema = z6.object({
-  value: z6.unknown(),
-  brand: z6.enum(["approval", "preference", "cache", "state", "conversation", "custom"]).optional(),
-  createdAt: z6.number(),
-  updatedAt: z6.number(),
-  expiresAt: z6.number().optional(),
-  metadata: z6.record(z6.string(), z6.unknown()).optional()
-});
-
-// plugins/plugin-remember/src/remember.context-extension.ts
-function getRemember(ctx) {
-  return ctx.get(RememberAccessorToken);
-}
-function tryGetRemember(ctx) {
-  if (typeof ctx.tryGet === "function") {
-    return ctx.tryGet(RememberAccessorToken);
-  }
-  return void 0;
-}
-export {
-  ForgetTool,
-  ListMemoriesTool,
-  RecallTool,
-  RememberAccessor,
-  RememberAccessorToken,
-  RememberConfigToken,
-  RememberConfigurationError,
-  RememberIdentityError,
-  RememberMemoryProvider,
-  RememberPlugin,
-  RememberRedisProvider,
-  RememberScopeNotAllowedError,
-  RememberStoreToken,
-  RememberThisTool,
-  RememberVercelKvProvider,
-  brand,
-  RememberPlugin as default,
-  getRemember,
-  tryGetRemember
-};
+`;var RememberRedisProvider=class{client;keyPrefix;defaultTTL;ownsClient;constructor(options){this.keyPrefix=options.keyPrefix??"";this.defaultTTL=options.defaultTTL;if(options.type==="redis-client"){this.client=options.client;this.ownsClient=false;return}this.ownsClient=true;this.client=new Redis({lazyConnect:false,maxRetriesPerRequest:3,...options.config});this.client.on("connect",()=>{if(process.env["DEBUG"]==="true"){console.log("[RememberPlugin:Redis] Connected")}});this.client.on("error",err=>{console.error("[RememberPlugin:Redis] Error:",err.message)})}async setValue(key,value,ttlSeconds){if(value===void 0){throw new Error("Cannot store undefined value. Use null or delete the key instead.")}if(ttlSeconds!==void 0){if(typeof ttlSeconds!=="number"||!Number.isFinite(ttlSeconds)){throw new Error(`Invalid TTL: expected a number, got ${typeof ttlSeconds}`)}if(ttlSeconds<=0){throw new Error(`Invalid TTL: must be positive, got ${ttlSeconds}`)}if(!Number.isInteger(ttlSeconds)){throw new Error(`Invalid TTL: must be an integer, got ${ttlSeconds}`)}}const fullKey=prefixedStoreKey(this.keyPrefix,key);const strValue=JSON.stringify(value);const ttl=ttlSeconds??this.defaultTTL;if(ttl!==void 0&&ttl>0){await this.client.set(fullKey,strValue,"EX",ttl)}else{await this.client.set(fullKey,strValue)}await this.deleteDoubledPrefixKey(key)}async setIfAbsent(key,value,ttlSeconds){const fullKey=prefixedStoreKey(this.keyPrefix,key);const strValue=JSON.stringify(value);const ttl=ttlSeconds??this.defaultTTL;const hasTtl=ttl!==void 0&&ttl>0;const doubledKey=doubledPrefixKey(this.keyPrefix,key);if(doubledKey){const ttlArgument=hasTtl?String(ttl):"";const created=await this.client.eval(SET_IF_NEITHER_KEY_EXISTS_SCRIPT,2,fullKey,doubledKey,strValue,ttlArgument);return created===1}const result=hasTtl?await this.client.set(fullKey,strValue,"EX",ttl,"NX"):await this.client.set(fullKey,strValue,"NX");return result==="OK"}async getValue(key,defaultValue){const raw=await this.client.get(prefixedStoreKey(this.keyPrefix,key))??await this.readDoubledPrefixValue(key);if(raw===null)return defaultValue;try{return JSON.parse(raw)}catch{return defaultValue}}async delete(key){await this.client.del(prefixedStoreKey(this.keyPrefix,key));await this.deleteDoubledPrefixKey(key)}async exists(key){if(await this.client.exists(prefixedStoreKey(this.keyPrefix,key))===1)return true;const doubledKey=doubledPrefixKey(this.keyPrefix,key);return doubledKey!==void 0&&await this.client.exists(doubledKey)===1}async keys(pattern="*"){const result=new Set;for(const key of await this.scan(prefixedStoreKey(this.keyPrefix,pattern))){result.add(callerKeyOf(this.keyPrefix,pattern,key))}const doubledPattern=doubledPrefixKey(this.keyPrefix,pattern);if(doubledPattern){for(const key of await this.scan(doubledPattern))result.add(key.slice(this.keyPrefix.length))}return[...result]}async scan(match){const found=[];let cursor="0";do{const[nextCursor,keys]=await this.client.scan(cursor,"MATCH",match,"COUNT",100);cursor=nextCursor;found.push(...keys)}while(cursor!=="0");return found}async readDoubledPrefixValue(key){const doubledKey=doubledPrefixKey(this.keyPrefix,key);return doubledKey?this.client.get(doubledKey):null}async deleteDoubledPrefixKey(key){const doubledKey=doubledPrefixKey(this.keyPrefix,key);if(doubledKey)await this.client.del(doubledKey)}async close(){if(this.ownsClient){await this.client.quit()}}};RememberRedisProvider=__decorateClass([Provider3({name:"provider:remember:redis",description:"Redis-based storage provider for RememberPlugin",scope:ProviderScope3.GLOBAL})],RememberRedisProvider);import{Provider as Provider4,ProviderScope as ProviderScope4}from"@frontmcp/sdk";import{createVercelKvClient}from"@frontmcp/utils";var RememberVercelKvProvider=class{connection;client;keyPrefix;defaultTTL;constructor(options={}){const hasUrl=options.url!==void 0;const hasToken=options.token!==void 0;if(hasUrl!==hasToken){throw new Error(`RememberVercelKvProvider: Both 'url' and 'token' must be provided together, or neither. Received: url=${hasUrl?"provided":"missing"}, token=${hasToken?"provided":"missing"}`)}this.connection={url:options.url,token:options.token};this.keyPrefix=options.keyPrefix??"remember:";this.defaultTTL=options.defaultTTL}kv(){this.client??=createVercelKvClient(this.connection).catch(error=>{this.client=void 0;throw error});return this.client}prefixKey(key){return prefixedStoreKey(this.keyPrefix,key)}async setValue(key,value,ttlSeconds){const fullKey=this.prefixKey(key);const strValue=JSON.stringify(value);const ttl=ttlSeconds??this.defaultTTL;const kv=await this.kv();if(ttl&&ttl>0){await kv.set(fullKey,strValue,{ex:ttl})}else{await kv.set(fullKey,strValue)}await this.deleteDoubledPrefixKey(key)}async setIfAbsent(key,value,ttlSeconds){const fullKey=this.prefixKey(key);const strValue=JSON.stringify(value);const ttl=ttlSeconds??this.defaultTTL;const doubledKey=doubledPrefixKey(this.keyPrefix,key);const kv=await this.kv();if(doubledKey){const ttlArgument=ttl&&ttl>0?String(ttl):"";const created=await kv.eval(SET_IF_NEITHER_KEY_EXISTS_SCRIPT,[fullKey,doubledKey],[strValue,ttlArgument]);return Number(created)===1}const result=ttl&&ttl>0?await kv.set(fullKey,strValue,{nx:true,ex:ttl}):await kv.set(fullKey,strValue,{nx:true});return result==="OK"}async getValue(key,defaultValue){const kv=await this.kv();const raw=await kv.get(this.prefixKey(key))??await this.readDoubledPrefixValue(key);if(raw===null)return defaultValue;try{return JSON.parse(raw)}catch{return raw}}async delete(key){const kv=await this.kv();await kv.del(this.prefixKey(key));await this.deleteDoubledPrefixKey(key)}async exists(key){const kv=await this.kv();if(await kv.exists(this.prefixKey(key))===1)return true;const doubledKey=doubledPrefixKey(this.keyPrefix,key);return doubledKey!==void 0&&await kv.exists(doubledKey)===1}async keys(pattern="*"){const result=new Set;for(const key of await this.scan(this.prefixKey(pattern))){result.add(callerKeyOf(this.keyPrefix,pattern,key))}const doubledPattern=doubledPrefixKey(this.keyPrefix,pattern);if(doubledPattern){for(const key of await this.scan(doubledPattern))result.add(key.slice(this.keyPrefix.length))}return[...result]}async scan(match){const found=[];const kv=await this.kv();try{let cursor=0;do{const[nextCursor,keys]=await kv.scan(cursor,{match,count:100});cursor=nextCursor;found.push(...keys)}while(String(cursor)!=="0")}catch{try{found.push(...await kv.keys(match))}catch{console.warn("[RememberPlugin:VercelKV] keys() operation not supported")}}return found}async readDoubledPrefixValue(key){const doubledKey=doubledPrefixKey(this.keyPrefix,key);if(!doubledKey)return null;const kv=await this.kv();return kv.get(doubledKey)}async deleteDoubledPrefixKey(key){const doubledKey=doubledPrefixKey(this.keyPrefix,key);if(!doubledKey)return;const kv=await this.kv();await kv.del(doubledKey)}async close(){}};RememberVercelKvProvider=__decorateClass([Provider4({name:"provider:remember:vercel-kv",description:"Vercel KV-based storage provider for RememberPlugin",scope:ProviderScope4.GLOBAL})],RememberVercelKvProvider);var RememberStoreToken=Symbol("plugin:remember:store");var RememberConfigToken=Symbol("plugin:remember:config");var RememberAccessorToken=Symbol("plugin:remember:accessor");import{Tool as Tool5}from"@frontmcp/sdk";import{z as z2}from"@frontmcp/lazy-zod";import{Tool,ToolContext}from"@frontmcp/sdk";var REMEMBER_SCOPE_DESCRIPTION="Whose memory to use (default: session). session: this session; without one (stateless HTTP, MCP 2026-07-28), the signed-in caller across its requests. user: the signed-in caller, across all of its sessions. tool: the tool running the call, for the same caller as session; each memory tool has its own, so the other memory tools do not see what one of them stores in tool scope. global: shared by every caller. An anonymous caller cannot use user scope, nor session or tool scope without a session.";function rememberToolNames(prefix=""){return{rememberThis:`${prefix}remember_this`,recall:`${prefix}recall`,forget:`${prefix}forget`,listMemories:`${prefix}list_memories`}}var forgetInputSchema={key:z2.string().min(1).describe("What memory to forget"),scope:z2.enum(["session","user","tool","global"]).optional().describe(REMEMBER_SCOPE_DESCRIPTION)};var forgetOutputSchema=z2.object({success:z2.boolean(),key:z2.string(),scope:z2.string(),existed:z2.boolean()});function forgetDescription(){return"Forget a previously remembered value. Use this when the user wants to delete stored preferences or information."}function forgetToolMetadata(names=rememberToolNames()){return{name:names.forget,description:forgetDescription(),inputSchema:forgetInputSchema,outputSchema:forgetOutputSchema,annotations:{readOnlyHint:false}}}var ForgetTool=class extends ToolContext{async execute(input){const remember=this.get(RememberAccessorToken);const config=this.get(RememberConfigToken);const scope=input.scope??"session";const allowedScopes=config.tools?.allowedScopes??["session","user","tool","global"];if(!allowedScopes.includes(scope)){throw this.fail(new RememberScopeNotAllowedError(scope,allowedScopes))}const existed=await remember.knows(input.key,{scope});await remember.forget(input.key,{scope});return{success:true,key:input.key,scope,existed}}};ForgetTool=__decorateClass([Tool(forgetToolMetadata())],ForgetTool);import{z as z3}from"@frontmcp/lazy-zod";import{Tool as Tool2,ToolContext as ToolContext2}from"@frontmcp/sdk";var listMemoriesInputSchema={scope:z3.enum(["session","user","tool","global"]).optional().describe(REMEMBER_SCOPE_DESCRIPTION),pattern:z3.string().optional().describe('Pattern to filter keys (e.g., "user_*")'),limit:z3.number().positive().max(100).optional().describe("Maximum number of keys to return (default: 50)")};var listMemoriesOutputSchema=z3.object({keys:z3.array(z3.string()),scope:z3.string(),count:z3.number(),truncated:z3.boolean()});function listMemoriesDescription(names=rememberToolNames()){return`List the remembered keys in one scope (default: session). Use this to see what memories are stored before you ${names.recall} or ${names.forget} one.`}function listMemoriesToolMetadata(names=rememberToolNames()){return{name:names.listMemories,description:listMemoriesDescription(names),inputSchema:listMemoriesInputSchema,outputSchema:listMemoriesOutputSchema,annotations:{readOnlyHint:true}}}var ListMemoriesTool=class extends ToolContext2{async execute(input){const remember=this.get(RememberAccessorToken);const config=this.get(RememberConfigToken);const scope=input.scope??"session";const allowedScopes=config.tools?.allowedScopes??["session","user","tool","global"];if(!allowedScopes.includes(scope)){throw this.fail(new RememberScopeNotAllowedError(scope,allowedScopes))}const limit=input.limit??50;let keys=await remember.list({scope,pattern:input.pattern});const truncated=keys.length>limit;if(truncated){keys=keys.slice(0,limit)}return{keys,scope,count:keys.length,truncated}}};ListMemoriesTool=__decorateClass([Tool2(listMemoriesToolMetadata())],ListMemoriesTool);import{z as z4}from"@frontmcp/lazy-zod";import{Tool as Tool3,ToolContext as ToolContext3}from"@frontmcp/sdk";var recallInputSchema={key:z4.string().min(1).describe("What memory to recall"),scope:z4.enum(["session","user","tool","global"]).optional().describe(REMEMBER_SCOPE_DESCRIPTION)};var recallOutputSchema=z4.object({found:z4.boolean(),key:z4.string(),value:z4.unknown().optional(),scope:z4.string(),createdAt:z4.number().optional(),expiresAt:z4.number().optional()});function recallDescription(names=rememberToolNames()){return`Recall something that was previously remembered. Use this to retrieve stored preferences, settings, or any information that was saved with ${names.rememberThis}.`}function recallToolMetadata(names=rememberToolNames()){return{name:names.recall,description:recallDescription(names),inputSchema:recallInputSchema,outputSchema:recallOutputSchema,annotations:{readOnlyHint:true}}}var RecallTool=class extends ToolContext3{async execute(input){const remember=this.get(RememberAccessorToken);const config=this.get(RememberConfigToken);const scope=input.scope??"session";const allowedScopes=config.tools?.allowedScopes??["session","user","tool","global"];if(!allowedScopes.includes(scope)){throw this.fail(new RememberScopeNotAllowedError(scope,allowedScopes))}const entry=await remember.getEntry(input.key,{scope});if(!entry){return{found:false,key:input.key,scope}}return{found:true,key:input.key,value:entry.value,scope,createdAt:entry.createdAt,expiresAt:entry.expiresAt}}};RecallTool=__decorateClass([Tool3(recallToolMetadata())],RecallTool);import{z as z5}from"@frontmcp/lazy-zod";import{Tool as Tool4,ToolContext as ToolContext4}from"@frontmcp/sdk";var rememberThisInputSchema={key:z5.string().min(1).describe('What to call this memory (e.g., "user_preference", "last_action")'),value:z5.unknown().describe("The value to remember (any JSON-serializable data)"),scope:z5.enum(["session","user","tool","global"]).optional().describe(REMEMBER_SCOPE_DESCRIPTION),ttl:z5.number().int().positive().optional().describe("Forget after this many whole seconds"),brand:z5.enum(["preference","cache","state","conversation","custom"]).optional().describe("Type hint for the stored value")};var rememberThisOutputSchema=z5.object({success:z5.boolean(),key:z5.string(),scope:z5.string(),expiresAt:z5.number().optional()});function rememberThisDescription(names=rememberToolNames()){return`Remember something for later: store a value under a key that ${names.recall} can read back, in the scope you choose (this session by default; user scope for the signed-in user across sessions). It lasts until it is forgotten or its ttl runs out. Use this when the user asks you to remember preferences, settings, or any information they want to persist.`}function rememberThisToolMetadata(names=rememberToolNames()){return{name:names.rememberThis,description:rememberThisDescription(names),inputSchema:rememberThisInputSchema,outputSchema:rememberThisOutputSchema,annotations:{readOnlyHint:false}}}var RememberThisTool=class extends ToolContext4{async execute(input){const remember=this.get(RememberAccessorToken);const config=this.get(RememberConfigToken);const scope=input.scope??"session";const allowedScopes=config.tools?.allowedScopes??["session","user","tool","global"];if(!allowedScopes.includes(scope)){throw this.fail(new RememberScopeNotAllowedError(scope,allowedScopes))}const entry=await remember.set(input.key,input.value,{scope,ttl:input.ttl,brand:input.brand});return{success:true,key:input.key,scope,expiresAt:entry.expiresAt}}};RememberThisTool=__decorateClass([Tool4(rememberThisToolMetadata())],RememberThisTool);function createRememberTools(prefix=""){if(!prefix)return[RememberThisTool,RecallTool,ForgetTool,ListMemoriesTool];const names=rememberToolNames(prefix);let PrefixedRememberThisTool=class extends RememberThisTool{};PrefixedRememberThisTool=__decorateClass([Tool5(rememberThisToolMetadata(names))],PrefixedRememberThisTool);let PrefixedRecallTool=class extends RecallTool{};PrefixedRecallTool=__decorateClass([Tool5(recallToolMetadata(names))],PrefixedRecallTool);let PrefixedForgetTool=class extends ForgetTool{};PrefixedForgetTool=__decorateClass([Tool5(forgetToolMetadata(names))],PrefixedForgetTool);let PrefixedListMemoriesTool=class extends ListMemoriesTool{};PrefixedListMemoriesTool=__decorateClass([Tool5(listMemoriesToolMetadata(names))],PrefixedListMemoriesTool);return[PrefixedRememberThisTool,PrefixedRecallTool,PrefixedForgetTool,PrefixedListMemoriesTool]}function withCheckedOptions(options){const customKey=options.encryption?.customKey;if(customKey!==void 0&&customKey.trim()===""){throw new RememberConfigurationError("RememberPlugin encryption.customKey must not be empty; omit it to derive keys from the server secret")}const{defaultTTL}=options;if(defaultTTL===void 0)return options;if(defaultTTL===0)return{...options,defaultTTL:void 0};if(!Number.isInteger(defaultTTL)||defaultTTL<0){throw new RememberConfigurationError(`RememberPlugin defaultTTL must be a whole number of seconds (0 for no default expiry), got ${defaultTTL}`)}return options}var RememberPlugin=class extends DynamicPlugin{options;constructor(options={}){super();this.options={...RememberPlugin.defaultOptions,...withCheckedOptions(options)}}};__publicField(RememberPlugin,"defaultOptions",{type:"memory",keyPrefix:"remember:",encryption:{enabled:true}});__publicField(RememberPlugin,"dynamicTools",options=>options.tools?.enabled?createRememberTools(options.tools.prefix):[]);__publicField(RememberPlugin,"dynamicProviders",options=>{const providers=[];const config={...RememberPlugin.defaultOptions,...withCheckedOptions(options)};switch(config.type){case"global-store":providers.push({name:"remember:store:global",provide:RememberStoreToken,inject:()=>[FrontMcpConfig],useFactory:frontmcpConfig=>{const storeConfig=getGlobalStoreConfig("RememberPlugin",frontmcpConfig);if(isVercelKvProvider(storeConfig)){return new RememberVercelKvProvider({url:storeConfig.url,token:storeConfig.token,keyPrefix:config.keyPrefix,defaultTTL:config.defaultTTL})}return new RememberRedisProvider({type:"redis",config:{host:storeConfig.host??"localhost",port:storeConfig.port??6379,password:storeConfig.password,db:storeConfig.db},keyPrefix:config.keyPrefix,defaultTTL:config.defaultTTL})}});break;case"redis":if("config"in config&&config.config){providers.push({name:"remember:store:redis",provide:RememberStoreToken,useValue:new RememberRedisProvider({type:"redis",config:config.config,keyPrefix:config.keyPrefix,defaultTTL:config.defaultTTL})})}break;case"redis-client":if("client"in config&&config.client){providers.push({name:"remember:store:redis-client",provide:RememberStoreToken,useValue:new RememberRedisProvider({type:"redis-client",client:config.client,keyPrefix:config.keyPrefix,defaultTTL:config.defaultTTL})})}break;case"vercel-kv":providers.push({name:"remember:store:vercel-kv",provide:RememberStoreToken,useValue:new RememberVercelKvProvider({url:"url"in config?config.url:void 0,token:"token"in config?config.token:void 0,keyPrefix:config.keyPrefix,defaultTTL:config.defaultTTL})});break;case"memory":default:providers.push({name:"remember:store:memory",provide:RememberStoreToken,inject:()=>[],useFactory:()=>new RememberMemoryProvider(void 0,config.defaultTTL)});break}providers.push({name:"remember:config",provide:RememberConfigToken,useValue:config});providers.push({name:"remember:accessor",provide:RememberAccessorToken,scope:ProviderScope5.CONTEXT,inject:()=>[RememberStoreToken,FRONTMCP_CONTEXT,RememberConfigToken,FrontMcpLogger],useFactory:(store,ctx,cfg,logger)=>createRememberAccessor(store,ctx,cfg,logger)});return providers});RememberPlugin=__decorateClass([Plugin({name:"remember",description:"Help your LLM remember things across sessions",providers:[{name:"remember:store:memory",provide:RememberStoreToken,inject:()=>[],useFactory:()=>new RememberMemoryProvider}],contextExtensions:[{property:"remember",token:RememberAccessorToken,errorMessage:"RememberPlugin is not installed. Add RememberPlugin.init() to your plugins array."}]})],RememberPlugin);import{z as z6}from"@frontmcp/lazy-zod";var rememberScopeSchema=z6.enum(["session","user","tool","global"]);function brand(data,_brand){return data}var rememberEntrySchema=z6.object({value:z6.unknown(),brand:z6.enum(["approval","preference","cache","state","conversation","custom"]).optional(),createdAt:z6.number(),updatedAt:z6.number(),expiresAt:z6.number().optional(),metadata:z6.record(z6.string(),z6.unknown()).optional()});function getRemember(ctx){return ctx.get(RememberAccessorToken)}function tryGetRemember(ctx){if(typeof ctx.tryGet==="function"){return ctx.tryGet(RememberAccessorToken)}return void 0}export{ForgetTool,ListMemoriesTool,RecallTool,RememberAccessor,RememberAccessorToken,RememberConfigToken,RememberConfigurationError,RememberIdentityError,RememberMemoryProvider,RememberPlugin,RememberRedisProvider,RememberScopeNotAllowedError,RememberStoreToken,RememberThisTool,RememberVercelKvProvider,brand,RememberPlugin as default,getRemember,tryGetRemember};