@frontmcp/plugin-remember 1.7.2 → 1.8.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/plugin-remember",
-  "version": "1.7.2",
+  "version": "1.8.0",
   "description": "Remember plugin for FrontMCP - encrypted session memory with approval system for secure tool authorization",
   "author": "AgentFront <info@agentfront.dev>",
   "license": "Apache-2.0",
@@ -49,12 +49,12 @@
     }
   },
   "dependencies": {
-    "@frontmcp/sdk": "1.7.2",
-    "@frontmcp/utils": "1.7.2",
+    "@frontmcp/sdk": "1.8.0",
+    "@frontmcp/utils": "1.8.0",
     "ioredis": "^5.8.0"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.7.2",
+    "@frontmcp/lazy-zod": "1.8.0",
     "@vercel/kv": "^2.0.0 || ^3.0.0"
   },
   "peerDependenciesMeta": {

package/providers/remember-accessor.provider.d.ts

@@ -1,6 +1,6 @@
-import { FrontMcpContext } from '@frontmcp/sdk';
+import { FrontMcpContext, type FrontMcpLogger } from '@frontmcp/sdk';
+import type { RememberEntry, RememberForgetOptions, RememberGetOptions, RememberKnowsOptions, RememberListOptions, RememberPluginOptions, RememberScope, RememberSetOptions } from '../remember.types';
 import type { RememberStoreInterface } from './remember-store.interface';
-import type { RememberScope, RememberEntry, RememberPluginOptions, RememberSetOptions, RememberGetOptions, RememberForgetOptions, RememberKnowsOptions, RememberListOptions } from '../remember.types';
 /**
  * Context-scoped accessor for remember storage.
  * Provides a human-friendly API for storing and retrieving values.
@@ -31,7 +31,7 @@ export declare class RememberAccessor {
     private readonly config;
     private readonly keyPrefix;
     private readonly encryptionEnabled;
-    constructor(store: RememberStoreInterface, ctx: FrontMcpContext, config: RememberPluginOptions);
+    constructor(store: RememberStoreInterface, ctx: FrontMcpContext, config: RememberPluginOptions, logger?: Pick<FrontMcpLogger, 'warn' | 'debug'>);
     /**
      * Store a value in memory.
      *
@@ -103,8 +103,24 @@ export declare class RememberAccessor {
      * Build the full storage key including scope prefix.
      */
     private buildStorageKey;
+    /**
+     * The identity that namespaces session- and tool-scoped storage
+     * (GHSA-225p-f8jh-f3rh).
+     *
+     * In stateless mode the transport injects the literal session id `__stateless__` into every
+     * request, so using it as a namespace put every client's memory under the same keys. A
+     * stateless request carries no session identity: the authenticated principal is the only
+     * per-client identity available, and where there is none the request has no business
+     * reading or writing per-client memory at all.
+     */
+    private resolveSessionIdentity;
     /**
      * Build the scope-specific prefix.
+     *
+     * Every variable component is encoded, because the separator is also a legal character in
+     * a user id, a tool name and a memory key. Left raw, identity `a` with key `b:c` produces
+     * the same storage key as identity `a:b` with key `c` — one client reading or overwriting
+     * another's value through nothing more exotic than a colon in a name.
      */
     private buildScopePrefix;
     /**
@@ -120,5 +136,5 @@ export declare class RememberAccessor {
  * Factory function for creating RememberAccessor instances.
  * Used by the plugin's dynamicProviders.
  */
-export declare function createRememberAccessor(store: RememberStoreInterface, ctx: FrontMcpContext, config: RememberPluginOptions): RememberAccessor;
+export declare function createRememberAccessor(store: RememberStoreInterface, ctx: FrontMcpContext, config: RememberPluginOptions, logger?: Pick<FrontMcpLogger, 'warn' | 'debug'>): RememberAccessor;
 //# sourceMappingURL=remember-accessor.provider.d.ts.map

package/providers/remember-accessor.provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remember-accessor.provider.d.ts","sourceRoot":"","sources":["../../src/providers/remember-accessor.provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAA6C,MAAM,eAAe,CAAC;AAC3F,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACzE,OAAO,KAAK,EACV,aAAa,EACb,aAAa,EACb,qBAAqB,EACrB,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,EACrB,oBAAoB,EACpB,mBAAmB,EAEpB,MAAM,mBAAmB,CAAC;AAI3B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAKa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAyB;IAC/C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAkB;IACtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;IAC/C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAU;gBAEhC,KAAK,EAAE,sBAAsB,EAAE,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,qBAAqB;IAY9F;;;;;;OAMG;IACG,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,GAAE,kBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBpF;;;;;;OAMG;IACG,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,kBAAkB,CAAC,CAAC,CAAM,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IAsBtF;;;;;;OAMG;IACG,QAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,aAAa,CAAA;KAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC;IAsB9G;;;;;OAKG;IACG,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,GAAG,OAAO,CAAC,IAAI,CAAC;IAM7E;;;;;;OAMG;IACG,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,oBAAyB,GAAG,OAAO,CAAC,OAAO,CAAC;IAM9E;;;;;OAKG;IACG,IAAI,CAAC,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAWhE;;;;;;OAMG;IACG,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,aAAa,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IA0B/G;;OAEG;IACH,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED;;OAEG;IACH,IAAI,MAAM,IAAI,MAAM,GAAG,SAAS,CAS/B;IAMD;;OAEG;IACH,OAAO,CAAC,eAAe;IAIvB;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAgBxB;;OAEG;IACH,OAAO,CAAC,YAAY;IAQpB;;OAEG;IACH,OAAO,CAAC,UAAU;CAOnB;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,sBAAsB,EAC7B,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,qBAAqB,GAC5B,gBAAgB,CAElB"}
+{"version":3,"file":"remember-accessor.provider.d.ts","sourceRoot":"","sources":["../../src/providers/remember-accessor.provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAA2B,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAK9F,OAAO,KAAK,EACV,aAAa,EACb,qBAAqB,EACrB,kBAAkB,EAClB,oBAAoB,EACpB,mBAAmB,EACnB,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAyBzE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAKa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAyB;IAC/C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAkB;IACtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;IAC/C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAU;gBAG1C,KAAK,EAAE,sBAAsB,EAC7B,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,qBAAqB,EAC7B,MAAM,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC;IAoBjD;;;;;;OAMG;IACG,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,GAAE,kBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBpF;;;;;;OAMG;IACG,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,kBAAkB,CAAC,CAAC,CAAM,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IAsBtF;;;;;;OAMG;IACG,QAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,aAAa,CAAA;KAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC;IAsB9G;;;;;OAKG;IACG,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,GAAG,OAAO,CAAC,IAAI,CAAC;IAM7E;;;;;;OAMG;IACG,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,oBAAyB,GAAG,OAAO,CAAC,OAAO,CAAC;IAM9E;;;;;OAKG;IACG,IAAI,CAAC,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAWhE;;;;;;OAMG;IACG,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,aAAa,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IA0B/G;;OAEG;IACH,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED;;OAEG;IACH,IAAI,MAAM,IAAI,MAAM,GAAG,SAAS,CAS/B;IAMD;;OAEG;IACH,OAAO,CAAC,eAAe;IAIvB;;;;;;;;;OASG;IACH,OAAO,CAAC,sBAAsB;IAoB9B;;;;;;;OAOG;IACH,OAAO,CAAC,gBAAgB;IA6BxB;;OAEG;IACH,OAAO,CAAC,YAAY;IAYpB;;OAEG;IACH,OAAO,CAAC,UAAU;CAOnB;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,sBAAsB,EAC7B,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,qBAAqB,EAC7B,MAAM,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,GAC9C,gBAAgB,CAElB"}

package/providers/remember-memory.provider.d.ts

@@ -12,6 +12,13 @@ export default class RememberMemoryProvider implements RememberStoreInterface {
      * Always JSON-serializes the value for consistent storage/retrieval.
      */
     setValue(key: string, value: unknown, ttlSeconds?: number): Promise<void>;
+    /**
+     * Store a value only if the key is absent.
+     *
+     * A single-threaded runtime makes the check-then-set indivisible; an expired entry counts as
+     * absent, matching what `getValue` would report.
+     */
+    setIfAbsent(key: string, value: unknown, ttlSeconds?: number): Promise<boolean>;
     /**
      * Retrieve a value by key.
      * JSON-parses the stored value to match the setValue serialization.

package/providers/remember-memory.provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remember-memory.provider.d.ts","sourceRoot":"","sources":["../../src/providers/remember-memory.provider.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAgBzE;;;GAGG;AAMH,MAAM,CAAC,OAAO,OAAO,sBAAuB,YAAW,sBAAsB;IAC3E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4B;IACnD,OAAO,CAAC,OAAO,CAAC,CAAiB;gBAErB,oBAAoB,SAAK;IAMrC;;;OAGG;IACG,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA8B/E;;;OAGG;IACG,QAAQ,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IAkBlF;;OAEG;IACG,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMxC;;OAEG;IACG,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAU3C;;;OAGG;IACG,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAiC/C;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAY5B,OAAO,CAAC,SAAS;IAIjB;;OAEG;IACH,OAAO,CAAC,KAAK;IAYb,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAO;IACjD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAM;IAE3C;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;CAkBvB"}
+{"version":3,"file":"remember-memory.provider.d.ts","sourceRoot":"","sources":["../../src/providers/remember-memory.provider.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAgBzE;;;GAGG;AAMH,MAAM,CAAC,OAAO,OAAO,sBAAuB,YAAW,sBAAsB;IAC3E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4B;IACnD,OAAO,CAAC,OAAO,CAAC,CAAiB;gBAErB,oBAAoB,SAAK;IAMrC;;;OAGG;IACG,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA8B/E;;;;;OAKG;IACG,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQrF;;;OAGG;IACG,QAAQ,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IAkBlF;;OAEG;IACG,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMxC;;OAEG;IACG,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAU3C;;;OAGG;IACG,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAiC/C;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAY5B,OAAO,CAAC,SAAS;IAIjB;;OAEG;IACH,OAAO,CAAC,KAAK;IAYb,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAO;IACjD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAM;IAE3C;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;CAkBvB"}

package/providers/remember-redis.provider.d.ts

@@ -1,5 +1,5 @@
+import type { RedisClientRememberPluginOptions, RedisRememberPluginOptions } from '../remember.types';
 import type { RememberStoreInterface } from './remember-store.interface';
-import type { RedisRememberPluginOptions, RedisClientRememberPluginOptions } from '../remember.types';
 /**
  * Combined options type for Redis provider.
  */
@@ -27,6 +27,13 @@ export default class RememberRedisProvider implements RememberStoreInterface {
      * @throws Error if value is undefined or ttlSeconds is invalid
      */
     setValue(key: string, value: unknown, ttlSeconds?: number): Promise<void>;
+    /**
+     * Store a value only if the key is absent, via Redis `SET ... NX`.
+     *
+     * `set` resolves to `'OK'` when it created the key and `null` when the key already existed,
+     * so the whole check-and-write is one round trip and two callers racing cannot both win.
+     */
+    setIfAbsent(key: string, value: unknown, ttlSeconds?: number): Promise<boolean>;
     /**
      * Retrieve a value by key.
      *

package/providers/remember-redis.provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remember-redis.provider.d.ts","sourceRoot":"","sources":["../../src/providers/remember-redis.provider.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACzE,OAAO,KAAK,EAAE,0BAA0B,EAAE,gCAAgC,EAAE,MAAM,mBAAmB,CAAC;AAEtG;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG,0BAA0B,GAAG,gCAAgC,CAAC;AAEjG;;;GAGG;AAMH,MAAM,CAAC,OAAO,OAAO,qBAAsB,YAAW,sBAAsB;IAC1E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;IACrC;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,mGAAmG;IACnG,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAU;gBAEzB,OAAO,EAAE,oBAAoB;IA6BzC;;;;;;;OAOG;IACG,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA6B/E;;;;;;;;;;OAUG;IACG,QAAQ,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IAclF;;OAEG;IACG,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKxC;;OAEG;IACG,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAK3C;;;OAGG;IACG,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAkB/C;;;;OAIG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAK7B"}
+{"version":3,"file":"remember-redis.provider.d.ts","sourceRoot":"","sources":["../../src/providers/remember-redis.provider.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gCAAgC,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AACtG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAEzE;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG,0BAA0B,GAAG,gCAAgC,CAAC;AAEjG;;;GAGG;AAMH,MAAM,CAAC,OAAO,OAAO,qBAAsB,YAAW,sBAAsB;IAC1E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;IACrC;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,mGAAmG;IACnG,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAU;gBAEzB,OAAO,EAAE,oBAAoB;IA6BzC;;;;;;;OAOG;IACG,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA6B/E;;;;;OAKG;IACG,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAYrF;;;;;;;;;;OAUG;IACG,QAAQ,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IAclF;;OAEG;IACG,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKxC;;OAEG;IACG,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAK3C;;;OAGG;IACG,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAkB/C;;;;OAIG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAK7B"}

package/providers/remember-store.interface.d.ts

@@ -17,6 +17,19 @@ export interface RememberStoreInterface {
      * @returns The stored value or defaultValue
      */
     getValue<T = unknown>(key: string, defaultValue?: T): Promise<T | undefined>;
+    /**
+     * Store a value only if the key is absent.
+     *
+     * Optional. A store whose backend has no conditional write simply omits it, and callers that
+     * need the guarantee fall back to read-then-write and say what that costs. Implement it
+     * wherever the backend has a native primitive (Redis `SET ... NX`, Vercel KV `{ nx: true }`).
+     *
+     * @param key - Storage key
+     * @param value - Value to store (will be JSON serialized)
+     * @param ttlSeconds - Optional time-to-live in seconds
+     * @returns true when this caller created the key, false when it already existed
+     */
+    setIfAbsent?(key: string, value: unknown, ttlSeconds?: number): Promise<boolean>;
     /**
      * Delete a value by key.
      * @param key - Storage key to delete

package/providers/remember-store.interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remember-store.interface.d.ts","sourceRoot":"","sources":["../../src/providers/remember-store.interface.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE1E;;;;;OAKG;IACH,QAAQ,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;IAE7E;;;OAGG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnC;;;;OAIG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEtC;;;;OAIG;IACH,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE1C;;OAEG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB"}
+{"version":3,"file":"remember-store.interface.d.ts","sourceRoot":"","sources":["../../src/providers/remember-store.interface.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE1E;;;;;OAKG;IACH,QAAQ,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;IAE7E;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEjF;;;OAGG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnC;;;;OAIG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEtC;;;;OAIG;IACH,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE1C;;OAEG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB"}

package/providers/remember-vercel-kv.provider.d.ts

@@ -26,6 +26,13 @@ export default class RememberVercelKvProvider implements RememberStoreInterface
      * Store a value with optional TTL.
      */
     setValue(key: string, value: unknown, ttlSeconds?: number): Promise<void>;
+    /**
+     * Store a value only if the key is absent, via the `nx` option.
+     *
+     * Resolves to `'OK'` when it created the key and `null` when the key already existed, so two
+     * callers racing cannot both win.
+     */
+    setIfAbsent(key: string, value: unknown, ttlSeconds?: number): Promise<boolean>;
     /**
      * Retrieve a value by key.
      */

package/providers/remember-vercel-kv.provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remember-vercel-kv.provider.d.ts","sourceRoot":"","sources":["../../src/providers/remember-vercel-kv.provider.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAezE;;GAEG;AACH,MAAM,WAAW,+BAA+B;IAC9C,0DAA0D;IAC1D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6BAA6B;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AAMH,MAAM,CAAC,OAAO,OAAO,wBAAyB,YAAW,sBAAsB;IAC7E,OAAO,CAAC,EAAE,CAAiB;IAC3B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAS;gBAEzB,OAAO,GAAE,+BAAoC;IA6BzD,OAAO,CAAC,SAAS;IAIjB;;OAEG;IACG,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAY/E;;OAEG;IACG,QAAQ,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IAkBlF;;OAEG;IACG,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKxC;;OAEG;IACG,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAK3C;;;OAGG;IACG,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAmC/C;;;OAGG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7B"}
+{"version":3,"file":"remember-vercel-kv.provider.d.ts","sourceRoot":"","sources":["../../src/providers/remember-vercel-kv.provider.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAezE;;GAEG;AACH,MAAM,WAAW,+BAA+B;IAC9C,0DAA0D;IAC1D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6BAA6B;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AAMH,MAAM,CAAC,OAAO,OAAO,wBAAyB,YAAW,sBAAsB;IAC7E,OAAO,CAAC,EAAE,CAAiB;IAC3B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAS;gBAEzB,OAAO,GAAE,+BAAoC;IA6BzD,OAAO,CAAC,SAAS;IAIjB;;OAEG;IACG,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAY/E;;;;;OAKG;IACG,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAarF;;OAEG;IACG,QAAQ,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IAkBlF;;OAEG;IACG,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKxC;;OAEG;IACG,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAK3C;;;OAGG;IACG,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAmC/C;;;OAGG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7B"}

package/remember.crypto.d.ts

@@ -1,4 +1,4 @@
-import type { EncBlob } from '@frontmcp/utils';
+import { type EncBlob } from '@frontmcp/utils';
 import type { RememberScope } from './remember.types';
 /**
  * Encrypted blob structure for storage.
@@ -28,12 +28,23 @@ export type EncryptionKeySource = {
  * Derive a 256-bit encryption key based on the source.
  * Uses HKDF-SHA256 from @frontmcp/utils.
  *
- * Key derivation strategy (distributed-safe):
- * - session: IKM = sessionId (unique per session, no external dependency)
- * - tool: IKM = sessionId (same as session, tool name in context)
- * - user: IKM = baseSecret + userId (requires persisted/env secret)
- * - global: IKM = baseSecret (requires persisted/env secret)
+ * Key derivation strategy:
+ * - session: IKM = baseSecret + sessionId
+ * - tool: IKM = baseSecret + sessionId (tool name in context)
+ * - user: IKM = baseSecret + userId
+ * - global: IKM = baseSecret
  * - custom: IKM = custom key
+ *
+ * SECURITY (GHSA-h6f4-jg8x-38gj): session and tool scopes used the session id ALONE as input
+ * keying material. A session id is not a secret — the client knows it, it travels in the
+ * `mcp-session-id` header, and in stateless mode it is the fixed public constant
+ * `__stateless__`. Anyone who knew it could recompute the key and decrypt the stored blobs,
+ * so encryption at rest protected nothing. Mixing in the server secret makes the key depend
+ * on something the client does not hold.
+ *
+ * The server secret must be the SAME on every instance that shares a store; set
+ * `REMEMBER_SECRET` (or `MCP_MEMORY_SECRET` / `MCP_SESSION_SECRET`) in any distributed
+ * deployment, otherwise each instance generates its own and cannot read the others' entries.
  */
 export declare function deriveEncryptionKey(source: EncryptionKeySource): Promise<Uint8Array>;
 /**

package/remember.crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remember.crypto.d.ts","sourceRoot":"","sources":["../src/remember.crypto.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAOtD;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,OAAO,CAAC;AAEpC;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACrD;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AA4BpC;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,UAAU,CAAC,CA0C1F;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,aAAa,EACpB,OAAO,EAAE;IACP,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GACA,mBAAmB,CAerB;AASD;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,mBAAmB,GAAG,OAAO,CAAC,aAAa,CAAC,CAaxG;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,CAAC,GAAG,OAAO,EAC5C,IAAI,EAAE,aAAa,EACnB,SAAS,EAAE,mBAAmB,GAC7B,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAcnB;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAEzD;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAiBjE;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,CAGxG;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,GAAG,OAAO,EACrD,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,mBAAmB,GAC7B,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAInB"}
+{"version":3,"file":"remember.crypto.d.ts","sourceRoot":"","sources":["../src/remember.crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAOL,KAAK,OAAO,EACb,MAAM,iBAAiB,CAAC;AAGzB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAMtD;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,OAAO,CAAC;AAEpC;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACrD;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AA4BpC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,UAAU,CAAC,CAwC1F;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,aAAa,EACpB,OAAO,EAAE;IACP,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GACA,mBAAmB,CAerB;AASD;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,mBAAmB,GAAG,OAAO,CAAC,aAAa,CAAC,CAaxG;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,CAAC,GAAG,OAAO,EAC5C,IAAI,EAAE,aAAa,EACnB,SAAS,EAAE,mBAAmB,GAC7B,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAmBnB;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAEzD;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAiBjE;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,CAGxG;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,GAAG,OAAO,EACrD,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,mBAAmB,GAC7B,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAInB"}

package/remember.errors.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Raised when Remember has no per-client identity to namespace storage with
+ * (GHSA-225p-f8jh-f3rh).
+ *
+ * Failing the call is the point: the alternative is a namespace shared by every client,
+ * which silently turns one caller's memory into another's.
+ */
+export declare class RememberIdentityError extends Error {
+    readonly name = "RememberIdentityError";
+    constructor(message: string);
+}
+//# sourceMappingURL=remember.errors.d.ts.map

package/remember.errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remember.errors.d.ts","sourceRoot":"","sources":["../src/remember.errors.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,SAAkB,IAAI,2BAA2B;gBAErC,OAAO,EAAE,MAAM;CAG5B"}

package/remember.legacy-purge.d.ts

@@ -0,0 +1,45 @@
+import type { FrontMcpLogger } from '@frontmcp/sdk';
+import type { RememberStoreInterface } from './providers/remember-store.interface';
+/**
+ * When the first instance on this layout reached this store.
+ *
+ * The clock has to live in the store, not in the process. A process-local timer restarts on
+ * every deploy and every crash, so it never converges on "the fleet has been on `v2:` for a
+ * while" — and an instance that booted early would fire on its own schedule no matter when the
+ * last old instance drained.
+ *
+ * The marker is created with a conditional write, so instances booting together settle on one
+ * timestamp rather than each overwriting the last. Where the store cannot express that, the
+ * fallback is read-then-write, and concurrent first boots can move `firstSeenAt` forward by the
+ * width of that race — immaterial against a window measured in hours, but not a guarantee.
+ *
+ * `undefined` means the clock could not be established, and the caller must not delete anything
+ * on it.
+ */
+export declare function readLayoutFirstSeenAt(store: RememberStoreInterface, keyPrefix: string, logger?: Pick<FrontMcpLogger, 'warn' | 'debug'>): Promise<number | undefined>;
+/**
+ * Delete entries that the key-derivation and namespace-encoding changes orphaned.
+ *
+ * Without this, `decryptValue` turns the authentication failure into `null` and a moved key
+ * simply misses — the memory reads as absent with no signal at all. Deleting it makes the
+ * upgrade explicit, and the warning says how much went.
+ */
+export declare function purgeLegacyRememberEntries(store: RememberStoreInterface, keyPrefix: string, logger?: Pick<FrontMcpLogger, 'warn' | 'debug'>): Promise<number>;
+/**
+ * Arm the sweep for a store, at most once.
+ *
+ * `DynamicPlugin` exposes no startup lifecycle hook and providers are not eagerly
+ * instantiated, so this is armed when the accessor is first constructed. Move it to a real
+ * lifecycle hook if the SDK grows one.
+ *
+ * Deliberately fire-and-forget: nothing on the request path waits for three keyspace scans.
+ * The timer only decides — it sweeps when the fleet-wide clock has run out, and otherwise
+ * re-arms for the remainder, so a restart costs time already served rather than resetting it.
+ */
+export declare function scheduleLegacyRememberPurge(store: RememberStoreInterface, keyPrefix: string, options?: {
+    delayMs?: number;
+    logger?: Pick<FrontMcpLogger, 'warn' | 'debug'>;
+}): void;
+/** Test seam: forget which stores have a sweep armed. */
+export declare function resetLegacyPurgeStateForTests(store: RememberStoreInterface): void;
+//# sourceMappingURL=remember.legacy-purge.d.ts.map

package/remember.legacy-purge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remember.legacy-purge.d.ts","sourceRoot":"","sources":["../src/remember.legacy-purge.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAiEnF;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,sBAAsB,EAC7B,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,GAC9C,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAiC7B;AAED;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE,sBAAsB,EAC7B,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,GAC9C,OAAO,CAAC,MAAM,CAAC,CAqCjB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,sBAAsB,EAC7B,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,CAAA;CAAO,GAClF,IAAI,CAsCN;AAED,yDAAyD;AACzD,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,sBAAsB,GAAG,IAAI,CAEjF"}

package/remember.plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remember.plugin.d.ts","sourceRoot":"","sources":["../src/remember.plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EAEb,YAAY,EAOb,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAO1F;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAsBH,MAAM,CAAC,OAAO,OAAO,cAAe,SAAQ,aAAa,CAAC,qBAAqB,EAAE,0BAA0B,CAAC;IAC1G,MAAM,CAAC,cAAc,EAAE,qBAAqB,CAI1C;IAEF,OAAO,EAAE,qBAAqB,CAAC;gBAEnB,OAAO,GAAE,0BAA+B;IAQpD;;OAEG;IACH,OAAgB,gBAAgB,GAAI,SAAS,0BAA0B,KAAG,YAAY,EAAE,CAyHtF;CACH"}
+{"version":3,"file":"remember.plugin.d.ts","sourceRoot":"","sources":["../src/remember.plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EASb,YAAY,EACb,MAAM,eAAe,CAAC;AAOvB,OAAO,KAAK,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAE1F;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAsBH,MAAM,CAAC,OAAO,OAAO,cAAe,SAAQ,aAAa,CAAC,qBAAqB,EAAE,0BAA0B,CAAC;IAC1G,MAAM,CAAC,cAAc,EAAE,qBAAqB,CAI1C;IAEF,OAAO,EAAE,qBAAqB,CAAC;gBAEnB,OAAO,GAAE,0BAA+B;IAQpD;;OAEG;IACH,OAAgB,gBAAgB,GAAI,SAAS,0BAA0B,KAAG,YAAY,EAAE,CAyHtF;CACH"}

package/remember.types.d.ts

@@ -87,6 +87,31 @@ export interface BaseRememberPluginOptions {
     defaultTTL?: number;
     /** Key prefix for all storage keys */
     keyPrefix?: string;
+    /**
+     * Skip the one-time purge of entries orphaned by the session/tool key-derivation change
+     * (GHSA-h6f4-jg8x-38gj) and the namespace encoding (GHSA-225p-f8jh-f3rh).
+     *
+     * The purge runs automatically, `legacyPurgeDelayMs` after this layout first reached the
+     * store, and deletes the pre-`v2` `session:`, `tool:` and `user:` entries under this
+     * plugin's `keyPrefix` — they can no longer be read and would otherwise silently appear
+     * absent. Set this to `true` only if you are migrating the data yourself.
+     *
+     * @default false
+     */
+    skipLegacyPurge?: boolean;
+    /**
+     * How long the fleet must have been on the `v2:` storage layout before the legacy purge
+     * deletes anything.
+     *
+     * Measured from when the first instance on this layout reached the store, recorded under
+     * `<keyPrefix>__layout__` -- not from this process's start, so a deploy or a crash does not
+     * reset it. An instance that starts mid-rollout shares the store with the instances it is
+     * replacing, and those still read and write the legacy prefixes; the window has to outlast
+     * both the rollout and the window in which a bad deploy gets rolled back.
+     *
+     * @default 86400000 (24 hours)
+     */
+    legacyPurgeDelayMs?: number;
     /** Encryption configuration */
     encryption?: {
         /** Whether encryption is enabled (default: true) */

package/remember.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remember.types.d.ts","sourceRoot":"","sources":["../src/remember.types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,KAAK,IAAI,WAAW,EAAE,MAAM,SAAS,CAAC;AAQpD;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEnE;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;;EAAgD,CAAC;AAMjF;;GAEG;AACH,OAAO,CAAC,MAAM,YAAY,EAAE,OAAO,MAAM,CAAC;AAE1C;;;GAGG;AACH,MAAM,MAAM,cAAc,CAAC,CAAC,EAAE,KAAK,SAAS,MAAM,IAAI,CAAC,GAAG;IACxD,QAAQ,CAAC,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC;CAChC,CAAC;AAEF,6CAA6C;AAC7C,MAAM,MAAM,eAAe,CAAC,CAAC,GAAG,OAAO,IAAI,cAAc,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;AAEzE,4CAA4C;AAC5C,MAAM,MAAM,iBAAiB,CAAC,CAAC,GAAG,OAAO,IAAI,cAAc,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;AAE7E,kCAAkC;AAClC,MAAM,MAAM,YAAY,CAAC,CAAC,GAAG,OAAO,IAAI,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;AAEnE,wCAAwC;AACxC,MAAM,MAAM,YAAY,CAAC,CAAC,GAAG,OAAO,IAAI,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;AAEnE,0DAA0D;AAC1D,MAAM,MAAM,mBAAmB,CAAC,CAAC,GAAG,OAAO,IAAI,cAAc,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;AAEjF,8CAA8C;AAC9C,MAAM,MAAM,aAAa,CAAC,CAAC,GAAG,OAAO,IAAI,cAAc,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAErE;;;GAGG;AACH,wBAAgB,KAAK,CAAC,CAAC,EAAE,CAAC,SAAS,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,CAEnF;AAED;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,YAAY,GAAG,OAAO,GAAG,OAAO,GAAG,cAAc,GAAG,QAAQ,CAAC;AAMzG;;GAEG;AACH,MAAM,WAAW,aAAa,CAAC,CAAC,GAAG,OAAO;IACxC,uBAAuB;IACvB,KAAK,EAAE,CAAC,CAAC;IAET,4CAA4C;IAC5C,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAEzB,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;IAElB,sCAAsC;IACtC,SAAS,EAAE,MAAM,CAAC;IAElB,yCAAyC;IACzC,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,0BAA0B;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;gCAO9B,CAAC;AAMH;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,8DAA8D;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,sCAAsC;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,+BAA+B;IAC/B,UAAU,CAAC,EAAE;QACX,oDAAoD;QACpD,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,qDAAqD;QACrD,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;IAEF,8BAA8B;IAC9B,KAAK,CAAC,EAAE;QACN,sDAAsD;QACtD,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,6CAA6C;QAC7C,aAAa,CAAC,EAAE,aAAa,EAAE,CAAC;QAChC,uCAAuC;QACvC,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,2BAA4B,SAAQ,yBAAyB;IAC5E,IAAI,EAAE,QAAQ,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,0BAA2B,SAAQ,yBAAyB;IAC3E,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,EAAE,CAAC,EAAE,MAAM,CAAC;KACb,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,gCAAiC,SAAQ,yBAAyB;IACjF,IAAI,EAAE,cAAc,CAAC;IACrB,MAAM,EAAE,WAAW,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,6BAA8B,SAAQ,yBAAyB;IAC9E,IAAI,EAAE,WAAW,CAAC;IAClB,0DAA0D;IAC1D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,MAAM,WAAW,gCAAiC,SAAQ,yBAAyB;IACjF,IAAI,EAAE,cAAc,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAC7B,2BAA2B,GAC3B,0BAA0B,GAC1B,gCAAgC,GAChC,6BAA6B,GAC7B,gCAAgC,CAAC;AAErC;;GAEG;AACH,MAAM,MAAM,0BAA0B,GAAG,OAAO,CAAC,qBAAqB,CAAC,GAAG;IACxE,IAAI,CAAC,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC;CACtC,CAAC;AAMF;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,wCAAwC;IACxC,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,8BAA8B;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB,0BAA0B;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB,CAAC,CAAC,GAAG,OAAO;IAC7C,wCAAwC;IACxC,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,yCAAyC;IACzC,YAAY,CAAC,EAAE,CAAC,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,wCAAwC;IACxC,KAAK,CAAC,EAAE,aAAa,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,wCAAwC;IACxC,KAAK,CAAC,EAAE,aAAa,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,wCAAwC;IACxC,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB"}
+{"version":3,"file":"remember.types.d.ts","sourceRoot":"","sources":["../src/remember.types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,KAAK,IAAI,WAAW,EAAE,MAAM,SAAS,CAAC;AAQpD;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEnE;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;;EAAgD,CAAC;AAMjF;;GAEG;AACH,OAAO,CAAC,MAAM,YAAY,EAAE,OAAO,MAAM,CAAC;AAE1C;;;GAGG;AACH,MAAM,MAAM,cAAc,CAAC,CAAC,EAAE,KAAK,SAAS,MAAM,IAAI,CAAC,GAAG;IACxD,QAAQ,CAAC,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC;CAChC,CAAC;AAEF,6CAA6C;AAC7C,MAAM,MAAM,eAAe,CAAC,CAAC,GAAG,OAAO,IAAI,cAAc,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;AAEzE,4CAA4C;AAC5C,MAAM,MAAM,iBAAiB,CAAC,CAAC,GAAG,OAAO,IAAI,cAAc,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;AAE7E,kCAAkC;AAClC,MAAM,MAAM,YAAY,CAAC,CAAC,GAAG,OAAO,IAAI,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;AAEnE,wCAAwC;AACxC,MAAM,MAAM,YAAY,CAAC,CAAC,GAAG,OAAO,IAAI,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;AAEnE,0DAA0D;AAC1D,MAAM,MAAM,mBAAmB,CAAC,CAAC,GAAG,OAAO,IAAI,cAAc,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;AAEjF,8CAA8C;AAC9C,MAAM,MAAM,aAAa,CAAC,CAAC,GAAG,OAAO,IAAI,cAAc,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAErE;;;GAGG;AACH,wBAAgB,KAAK,CAAC,CAAC,EAAE,CAAC,SAAS,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,CAEnF;AAED;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,YAAY,GAAG,OAAO,GAAG,OAAO,GAAG,cAAc,GAAG,QAAQ,CAAC;AAMzG;;GAEG;AACH,MAAM,WAAW,aAAa,CAAC,CAAC,GAAG,OAAO;IACxC,uBAAuB;IACvB,KAAK,EAAE,CAAC,CAAC;IAET,4CAA4C;IAC5C,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAEzB,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;IAElB,sCAAsC;IACtC,SAAS,EAAE,MAAM,CAAC;IAElB,yCAAyC;IACzC,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,0BAA0B;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;gCAO9B,CAAC;AAMH;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,8DAA8D;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,sCAAsC;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;;;;;;;;OAUG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAE1B;;;;;;;;;;;OAWG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAE5B,+BAA+B;IAC/B,UAAU,CAAC,EAAE;QACX,oDAAoD;QACpD,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,qDAAqD;QACrD,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;IAEF,8BAA8B;IAC9B,KAAK,CAAC,EAAE;QACN,sDAAsD;QACtD,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,6CAA6C;QAC7C,aAAa,CAAC,EAAE,aAAa,EAAE,CAAC;QAChC,uCAAuC;QACvC,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,2BAA4B,SAAQ,yBAAyB;IAC5E,IAAI,EAAE,QAAQ,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,0BAA2B,SAAQ,yBAAyB;IAC3E,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,EAAE,CAAC,EAAE,MAAM,CAAC;KACb,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,gCAAiC,SAAQ,yBAAyB;IACjF,IAAI,EAAE,cAAc,CAAC;IACrB,MAAM,EAAE,WAAW,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,6BAA8B,SAAQ,yBAAyB;IAC9E,IAAI,EAAE,WAAW,CAAC;IAClB,0DAA0D;IAC1D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,MAAM,WAAW,gCAAiC,SAAQ,yBAAyB;IACjF,IAAI,EAAE,cAAc,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAC7B,2BAA2B,GAC3B,0BAA0B,GAC1B,gCAAgC,GAChC,6BAA6B,GAC7B,gCAAgC,CAAC;AAErC;;GAEG;AACH,MAAM,MAAM,0BAA0B,GAAG,OAAO,CAAC,qBAAqB,CAAC,GAAG;IACxE,IAAI,CAAC,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC;CACtC,CAAC;AAMF;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,wCAAwC;IACxC,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,8BAA8B;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB,0BAA0B;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB,CAAC,CAAC,GAAG,OAAO;IAC7C,wCAAwC;IACxC,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,yCAAyC;IACzC,YAAY,CAAC,EAAE,CAAC,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,wCAAwC;IACxC,KAAK,CAAC,EAAE,aAAa,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,wCAAwC;IACxC,KAAK,CAAC,EAAE,aAAa,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,wCAAwC;IACxC,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB"}