@frontmcp/plugin-remember 1.9.1 → 1.9.3

package/esm/index.mjs

@@ -4,12 +4,6 @@ const require = __frontmcpModule ? __frontmcpModule.createRequire(import.meta.ur
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
-  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
-}) : x)(function(x) {
-  if (typeof require !== "undefined") return require.apply(this, arguments);
-  throw Error('Dynamic require of "' + x + '" is not supported');
-});
 var __decorateClass = (decorators, target, key, kind) => {
   var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
   for (var i = decorators.length - 1, decorator; i >= 0; i--)
@@ -188,6 +182,9 @@ async function getBaseSecret() {
   }
   return getOrCreatePersistedSecret();
 }
+async function secretFor(source) {
+  return source.secret ? source.secret : getBaseSecret();
+}
 var textEncoder = new TextEncoder();
 async function deriveEncryptionKey(source) {
   const salt = textEncoder.encode("remember-plugin-v1");
@@ -195,19 +192,19 @@ async function deriveEncryptionKey(source) {
   let context;
   switch (source.type) {
     case "session":
-      ikm = await getBaseSecret() + source.sessionId;
+      ikm = await secretFor(source) + source.sessionId;
       context = `remember:session:${source.sessionId}`;
       break;
     case "tool":
-      ikm = await getBaseSecret() + source.sessionId;
+      ikm = await secretFor(source) + source.sessionId;
       context = `remember:tool:${source.toolName}:${source.sessionId}`;
       break;
     case "user":
-      ikm = await getBaseSecret() + source.userId;
+      ikm = await secretFor(source) + source.userId;
       context = `remember:user:${source.userId}`;
       break;
     case "global":
-      ikm = await getBaseSecret();
+      ikm = await secretFor(source);
       context = "remember:global";
       break;
     case "custom":
@@ -219,20 +216,21 @@ async function deriveEncryptionKey(source) {
   const info = textEncoder.encode(context);
   return hkdfSha256(ikmBytes, salt, info, 32);
 }
-function getKeySourceForScope(scope, context) {
+function getKeySourceForScope(scope, context, secret) {
   switch (scope) {
     case "session":
-      return { type: "session", sessionId: context.sessionId };
+      return { type: "session", sessionId: context.sessionId, secret };
     case "user":
-      return { type: "user", userId: context.userId ?? "anonymous" };
+      return { type: "user", userId: context.userId ?? "anonymous", secret };
     case "tool":
       return {
         type: "tool",
         toolName: context.toolName ?? "unknown",
-        sessionId: context.sessionId
+        sessionId: context.sessionId,
+        secret
       };
     case "global":
-      return { type: "global" };
+      return { type: "global", secret };
   }
 }
 var textDecoder = new TextDecoder();
@@ -635,7 +633,7 @@ var RememberAccessor = class {
    * `'unknown'`.
    */
   get toolName() {
-    return getRunningTool()?.fullName ?? this.ctx.flow?.name ?? "unknown";
+    return getRunningTool()?.fullName ?? "unknown";
   }
   /**
    * Build the scope-specific prefix.
@@ -669,11 +667,15 @@ var RememberAccessor = class {
    */
   getKeySource(scope) {
     const needsSessionIdentity = scope === "session" || scope === "tool";
-    return getKeySourceForScope(scope, {
-      sessionId: needsSessionIdentity ? this.resolveSessionIdentity() : this.ctx.sessionId,
-      userId: this.userId,
-      toolName: scope === "tool" ? this.toolName : void 0
-    });
+    return getKeySourceForScope(
+      scope,
+      {
+        sessionId: needsSessionIdentity ? this.resolveSessionIdentity() : this.ctx.sessionId,
+        userId: this.userId,
+        toolName: scope === "tool" ? this.toolName : void 0
+      },
+      this.config.encryption?.customKey
+    );
   }
   /** The entry stored under `storageKey`, if readable and unexpired; an expired one is deleted. */
   async readEntry(storageKey, scope) {
@@ -885,10 +887,28 @@ RememberMemoryProvider = __decorateClass([
 // plugins/plugin-remember/src/providers/remember-redis.provider.ts
 import Redis from "ioredis";
 import { Provider as Provider3, ProviderScope as ProviderScope3 } from "@frontmcp/sdk";
+
+// plugins/plugin-remember/src/providers/remember-key-prefix.ts
+function prefixedStoreKey(keyPrefix, key) {
+  return keyPrefix && key.startsWith(keyPrefix) ? key : keyPrefix + key;
+}
+function doubledPrefixKey(keyPrefix, key) {
+  return keyPrefix && key.startsWith(keyPrefix) ? keyPrefix + key : void 0;
+}
+function callerKeyOf(keyPrefix, pattern, backendKey) {
+  return keyPrefix && pattern.startsWith(keyPrefix) ? backendKey : backendKey.slice(keyPrefix.length);
+}
+var SET_IF_NEITHER_KEY_EXISTS_SCRIPT = `
+if redis.call('EXISTS', KEYS[1], KEYS[2]) > 0 then return 0 end
+if ARGV[2] ~= '' then redis.call('SET', KEYS[1], ARGV[1], 'EX', ARGV[2]) else redis.call('SET', KEYS[1], ARGV[1]) end
+return 1
+`;
+
+// plugins/plugin-remember/src/providers/remember-redis.provider.ts
 var RememberRedisProvider = class {
   client;
   /**
-   * Prefix prepended to all Redis keys.
+   * Prefix prepended to Redis keys that don't already start with it.
    * Include any separator (e.g., "myapp:" or "user:123:") as part of the prefix.
    */
   keyPrefix;
@@ -942,7 +962,7 @@ var RememberRedisProvider = class {
         throw new Error(`Invalid TTL: must be an integer, got ${ttlSeconds}`);
       }
     }
-    const fullKey = this.keyPrefix + key;
+    const fullKey = prefixedStoreKey(this.keyPrefix, key);
     const strValue = JSON.stringify(value);
     const ttl = ttlSeconds ?? this.defaultTTL;
     if (ttl !== void 0 && ttl > 0) {
@@ -950,18 +970,35 @@ var RememberRedisProvider = class {
     } else {
       await this.client.set(fullKey, strValue);
     }
+    await this.deleteDoubledPrefixKey(key);
   }
   /**
    * Store a value only if the key is absent, via Redis `SET ... NX`.
    *
    * `set` resolves to `'OK'` when it created the key and `null` when the key already existed,
    * so the whole check-and-write is one round trip and two callers racing cannot both win.
+   * A key that releases up to 1.9.1 may hold under the doubled prefix counts as present too: one
+   * script checks both keys and writes, so an entry still there is never shadowed.
    */
   async setIfAbsent(key, value, ttlSeconds) {
-    const fullKey = this.keyPrefix + key;
+    const fullKey = prefixedStoreKey(this.keyPrefix, key);
     const strValue = JSON.stringify(value);
     const ttl = ttlSeconds ?? this.defaultTTL;
-    const result = ttl !== void 0 && ttl > 0 ? await this.client.set(fullKey, strValue, "EX", ttl, "NX") : await this.client.set(fullKey, strValue, "NX");
+    const hasTtl = ttl !== void 0 && ttl > 0;
+    const doubledKey = doubledPrefixKey(this.keyPrefix, key);
+    if (doubledKey) {
+      const ttlArgument = hasTtl ? String(ttl) : "";
+      const created = await this.client.eval(
+        SET_IF_NEITHER_KEY_EXISTS_SCRIPT,
+        2,
+        fullKey,
+        doubledKey,
+        strValue,
+        ttlArgument
+      );
+      return created === 1;
+    }
+    const result = hasTtl ? await this.client.set(fullKey, strValue, "EX", ttl, "NX") : await this.client.set(fullKey, strValue, "NX");
     return result === "OK";
   }
   /**
@@ -976,8 +1013,7 @@ var RememberRedisProvider = class {
    * @returns The parsed value as T, or defaultValue/undefined
    */
   async getValue(key, defaultValue) {
-    const fullKey = this.keyPrefix + key;
-    const raw = await this.client.get(fullKey);
+    const raw = await this.client.get(prefixedStoreKey(this.keyPrefix, key)) ?? await this.readDoubledPrefixValue(key);
     if (raw === null) return defaultValue;
     try {
       return JSON.parse(raw);
@@ -989,32 +1025,55 @@ var RememberRedisProvider = class {
    * Delete a key.
    */
   async delete(key) {
-    const fullKey = this.keyPrefix + key;
-    await this.client.del(fullKey);
+    await this.client.del(prefixedStoreKey(this.keyPrefix, key));
+    await this.deleteDoubledPrefixKey(key);
   }
   /**
    * Check if a key exists.
    */
   async exists(key) {
-    const fullKey = this.keyPrefix + key;
-    return await this.client.exists(fullKey) === 1;
+    if (await this.client.exists(prefixedStoreKey(this.keyPrefix, key)) === 1) return true;
+    const doubledKey = doubledPrefixKey(this.keyPrefix, key);
+    return doubledKey !== void 0 && await this.client.exists(doubledKey) === 1;
   }
   /**
    * List keys matching a pattern.
    * Uses Redis SCAN for efficient iteration.
    */
-  async keys(pattern) {
-    const searchPattern = this.keyPrefix + (pattern ?? "*");
-    const result = [];
+  async keys(pattern = "*") {
+    const result = /* @__PURE__ */ new Set();
+    for (const key of await this.scan(prefixedStoreKey(this.keyPrefix, pattern))) {
+      result.add(callerKeyOf(this.keyPrefix, pattern, key));
+    }
+    const doubledPattern = doubledPrefixKey(this.keyPrefix, pattern);
+    if (doubledPattern) {
+      for (const key of await this.scan(doubledPattern)) result.add(key.slice(this.keyPrefix.length));
+    }
+    return [...result];
+  }
+  async scan(match) {
+    const found = [];
     let cursor = "0";
     do {
-      const [nextCursor, keys] = await this.client.scan(cursor, "MATCH", searchPattern, "COUNT", 100);
+      const [nextCursor, keys] = await this.client.scan(cursor, "MATCH", match, "COUNT", 100);
       cursor = nextCursor;
-      for (const key of keys) {
-        result.push(key.slice(this.keyPrefix.length));
-      }
+      found.push(...keys);
     } while (cursor !== "0");
-    return result;
+    return found;
+  }
+  /**
+   * The stored text of an entry a release up to 1.9.1 wrote under the doubled key, or null. It is read
+   * in place, not copied: the entry keeps its TTL, a rolled-back release still finds it, and a
+   * concurrent `delete()` cannot be undone by a copy. The next write or delete of the key removes it.
+   */
+  async readDoubledPrefixValue(key) {
+    const doubledKey = doubledPrefixKey(this.keyPrefix, key);
+    return doubledKey ? this.client.get(doubledKey) : null;
+  }
+  /** Drops what releases up to 1.9.1 left under the doubled key, so it cannot come back once this key is gone. */
+  async deleteDoubledPrefixKey(key) {
+    const doubledKey = doubledPrefixKey(this.keyPrefix, key);
+    if (doubledKey) await this.client.del(doubledKey);
   }
   /**
    * Gracefully close the Redis connection.
@@ -1037,15 +1096,13 @@ RememberRedisProvider = __decorateClass([
 
 // plugins/plugin-remember/src/providers/remember-vercel-kv.provider.ts
 import { Provider as Provider4, ProviderScope as ProviderScope4 } from "@frontmcp/sdk";
-import { getEnv } from "@frontmcp/utils";
+import { createVercelKvClient } from "@frontmcp/utils";
 var RememberVercelKvProvider = class {
-  createClient;
   connection;
   client;
   keyPrefix;
   defaultTTL;
   constructor(options = {}) {
-    const vercelKv = __require("@vercel/kv");
     const hasUrl = options.url !== void 0;
     const hasToken = options.token !== void 0;
     if (hasUrl !== hasToken) {
@@ -1053,25 +1110,24 @@ var RememberVercelKvProvider = class {
         `RememberVercelKvProvider: Both 'url' and 'token' must be provided together, or neither. Received: url=${hasUrl ? "provided" : "missing"}, token=${hasToken ? "provided" : "missing"}`
       );
     }
-    this.createClient = vercelKv.createClient;
     this.connection = { url: options.url, token: options.token };
     this.keyPrefix = options.keyPrefix ?? "remember:";
     this.defaultTTL = options.defaultTTL;
   }
-  /** Built on first use, like the module's `kv` singleton, which would JSON-parse what it reads. */
-  get kv() {
-    if (!this.client) {
-      const url = this.connection.url ?? getEnv("KV_REST_API_URL");
-      const token = this.connection.token ?? getEnv("KV_REST_API_TOKEN");
-      if (!url || !token) {
-        throw new Error("RememberVercelKvProvider: pass url and token, or set KV_REST_API_URL and KV_REST_API_TOKEN.");
-      }
-      this.client = this.createClient({ url, token, automaticDeserialization: false });
-    }
+  /**
+   * The client, built on first use from the url and token (or KV_REST_API_URL / KV_REST_API_TOKEN)
+   * by the shared loader, which a Cloudflare Worker can bundle (#711). Values are read back as
+   * stored. A failed attempt is retried.
+   */
+  kv() {
+    this.client ??= createVercelKvClient(this.connection).catch((error) => {
+      this.client = void 0;
+      throw error;
+    });
     return this.client;
   }
   prefixKey(key) {
-    return `${this.keyPrefix}${key}`;
+    return prefixedStoreKey(this.keyPrefix, key);
   }
   /**
    * Store a value with optional TTL.
@@ -1080,31 +1136,42 @@ var RememberVercelKvProvider = class {
     const fullKey = this.prefixKey(key);
     const strValue = JSON.stringify(value);
     const ttl = ttlSeconds ?? this.defaultTTL;
+    const kv = await this.kv();
     if (ttl && ttl > 0) {
-      await this.kv.set(fullKey, strValue, { ex: ttl });
+      await kv.set(fullKey, strValue, { ex: ttl });
     } else {
-      await this.kv.set(fullKey, strValue);
+      await kv.set(fullKey, strValue);
     }
+    await this.deleteDoubledPrefixKey(key);
   }
   /**
    * Store a value only if the key is absent, via the `nx` option.
    *
    * Resolves to `'OK'` when it created the key and `null` when the key already existed, so two
-   * callers racing cannot both win.
+   * callers racing cannot both win. A key that releases up to 1.9.1 may hold under the doubled
+   * prefix counts as present too: one script checks both keys and writes, so an entry still there
+   * is never shadowed.
    */
   async setIfAbsent(key, value, ttlSeconds) {
     const fullKey = this.prefixKey(key);
     const strValue = JSON.stringify(value);
     const ttl = ttlSeconds ?? this.defaultTTL;
-    const result = ttl && ttl > 0 ? await this.kv.set(fullKey, strValue, { nx: true, ex: ttl }) : await this.kv.set(fullKey, strValue, { nx: true });
+    const doubledKey = doubledPrefixKey(this.keyPrefix, key);
+    const kv = await this.kv();
+    if (doubledKey) {
+      const ttlArgument = ttl && ttl > 0 ? String(ttl) : "";
+      const created = await kv.eval(SET_IF_NEITHER_KEY_EXISTS_SCRIPT, [fullKey, doubledKey], [strValue, ttlArgument]);
+      return Number(created) === 1;
+    }
+    const result = ttl && ttl > 0 ? await kv.set(fullKey, strValue, { nx: true, ex: ttl }) : await kv.set(fullKey, strValue, { nx: true });
     return result === "OK";
   }
   /**
    * Retrieve a value by key.
    */
   async getValue(key, defaultValue) {
-    const fullKey = this.prefixKey(key);
-    const raw = await this.kv.get(fullKey);
+    const kv = await this.kv();
+    const raw = await kv.get(this.prefixKey(key)) ?? await this.readDoubledPrefixValue(key);
     if (raw === null) return defaultValue;
     try {
       return JSON.parse(raw);
@@ -1116,46 +1183,70 @@ var RememberVercelKvProvider = class {
    * Delete a key.
    */
   async delete(key) {
-    const fullKey = this.prefixKey(key);
-    await this.kv.del(fullKey);
+    const kv = await this.kv();
+    await kv.del(this.prefixKey(key));
+    await this.deleteDoubledPrefixKey(key);
   }
   /**
    * Check if a key exists.
    */
   async exists(key) {
-    const fullKey = this.prefixKey(key);
-    return await this.kv.exists(fullKey) === 1;
+    const kv = await this.kv();
+    if (await kv.exists(this.prefixKey(key)) === 1) return true;
+    const doubledKey = doubledPrefixKey(this.keyPrefix, key);
+    return doubledKey !== void 0 && await kv.exists(doubledKey) === 1;
   }
   /**
    * List keys matching a pattern.
    * Uses SCAN for efficient iteration.
    */
-  async keys(pattern) {
-    const searchPattern = this.prefixKey(pattern ?? "*");
-    const result = [];
+  async keys(pattern = "*") {
+    const result = /* @__PURE__ */ new Set();
+    for (const key of await this.scan(this.prefixKey(pattern))) {
+      result.add(callerKeyOf(this.keyPrefix, pattern, key));
+    }
+    const doubledPattern = doubledPrefixKey(this.keyPrefix, pattern);
+    if (doubledPattern) {
+      for (const key of await this.scan(doubledPattern)) result.add(key.slice(this.keyPrefix.length));
+    }
+    return [...result];
+  }
+  async scan(match) {
+    const found = [];
+    const kv = await this.kv();
     try {
       let cursor = 0;
       do {
-        const [nextCursor, keys] = await this.kv.scan(cursor, {
-          match: searchPattern,
-          count: 100
-        });
+        const [nextCursor, keys] = await kv.scan(cursor, { match, count: 100 });
         cursor = nextCursor;
-        for (const key of keys) {
-          result.push(key.slice(this.keyPrefix.length));
-        }
+        found.push(...keys);
       } while (String(cursor) !== "0");
     } catch {
       try {
-        const keys = await this.kv.keys(searchPattern);
-        for (const key of keys) {
-          result.push(key.slice(this.keyPrefix.length));
-        }
+        found.push(...await kv.keys(match));
       } catch {
         console.warn("[RememberPlugin:VercelKV] keys() operation not supported");
       }
     }
-    return result;
+    return found;
+  }
+  /**
+   * The stored text of an entry a release up to 1.9.1 wrote under the doubled key, or null. It is read
+   * in place, not copied: the entry keeps its TTL, a rolled-back release still finds it, and a
+   * concurrent `delete()` cannot be undone by a copy. The next write or delete of the key removes it.
+   */
+  async readDoubledPrefixValue(key) {
+    const doubledKey = doubledPrefixKey(this.keyPrefix, key);
+    if (!doubledKey) return null;
+    const kv = await this.kv();
+    return kv.get(doubledKey);
+  }
+  /** Drops what releases up to 1.9.1 left under the doubled key, so it cannot come back once this key is gone. */
+  async deleteDoubledPrefixKey(key) {
+    const doubledKey = doubledPrefixKey(this.keyPrefix, key);
+    if (!doubledKey) return;
+    const kv = await this.kv();
+    await kv.del(doubledKey);
   }
   /**
    * Gracefully close the provider.
@@ -1442,7 +1533,13 @@ function createRememberTools(prefix = "") {
 }
 
 // plugins/plugin-remember/src/remember.plugin.ts
-function withCheckedDefaultTTL(options) {
+function withCheckedOptions(options) {
+  const customKey = options.encryption?.customKey;
+  if (customKey !== void 0 && customKey.trim() === "") {
+    throw new RememberConfigurationError(
+      "RememberPlugin encryption.customKey must not be empty; omit it to derive keys from the server secret"
+    );
+  }
   const { defaultTTL } = options;
   if (defaultTTL === void 0) return options;
   if (defaultTTL === 0) return { ...options, defaultTTL: void 0 };
@@ -1459,7 +1556,7 @@ var RememberPlugin = class extends DynamicPlugin {
     super();
     this.options = {
       ...RememberPlugin.defaultOptions,
-      ...withCheckedDefaultTTL(options)
+      ...withCheckedOptions(options)
     };
   }
 };
@@ -1480,7 +1577,7 @@ __publicField(RememberPlugin, "dynamicProviders", (options) => {
   const providers = [];
   const config = {
     ...RememberPlugin.defaultOptions,
-    ...withCheckedDefaultTTL(options)
+    ...withCheckedOptions(options)
   };
   switch (config.type) {
     case "global-store":

package/esm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/plugin-remember",
-  "version": "1.9.1",
+  "version": "1.9.3",
   "description": "Remember plugin for FrontMCP - encrypted session memory with approval system for secure tool authorization",
   "author": "AgentFront <info@agentfront.dev>",
   "license": "Apache-2.0",
@@ -49,12 +49,12 @@
     }
   },
   "dependencies": {
-    "@frontmcp/sdk": "1.9.1",
-    "@frontmcp/utils": "1.9.1",
+    "@frontmcp/sdk": "1.9.3",
+    "@frontmcp/utils": "1.9.3",
     "ioredis": "^5.8.0"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.9.1",
+    "@frontmcp/lazy-zod": "1.9.3",
     "@vercel/kv": "^2.0.0 || ^3.0.0"
   },
   "peerDependenciesMeta": {

package/index.js

@@ -208,6 +208,9 @@ async function getBaseSecret() {
   }
   return getOrCreatePersistedSecret();
 }
+async function secretFor(source) {
+  return source.secret ? source.secret : getBaseSecret();
+}
 var textEncoder = new TextEncoder();
 async function deriveEncryptionKey(source) {
   const salt = textEncoder.encode("remember-plugin-v1");
@@ -215,19 +218,19 @@ async function deriveEncryptionKey(source) {
   let context;
   switch (source.type) {
     case "session":
-      ikm = await getBaseSecret() + source.sessionId;
+      ikm = await secretFor(source) + source.sessionId;
       context = `remember:session:${source.sessionId}`;
       break;
     case "tool":
-      ikm = await getBaseSecret() + source.sessionId;
+      ikm = await secretFor(source) + source.sessionId;
       context = `remember:tool:${source.toolName}:${source.sessionId}`;
       break;
     case "user":
-      ikm = await getBaseSecret() + source.userId;
+      ikm = await secretFor(source) + source.userId;
       context = `remember:user:${source.userId}`;
       break;
     case "global":
-      ikm = await getBaseSecret();
+      ikm = await secretFor(source);
       context = "remember:global";
       break;
     case "custom":
@@ -239,20 +242,21 @@ async function deriveEncryptionKey(source) {
   const info = textEncoder.encode(context);
   return (0, import_utils2.hkdfSha256)(ikmBytes, salt, info, 32);
 }
-function getKeySourceForScope(scope, context) {
+function getKeySourceForScope(scope, context, secret) {
   switch (scope) {
     case "session":
-      return { type: "session", sessionId: context.sessionId };
+      return { type: "session", sessionId: context.sessionId, secret };
     case "user":
-      return { type: "user", userId: context.userId ?? "anonymous" };
+      return { type: "user", userId: context.userId ?? "anonymous", secret };
     case "tool":
       return {
         type: "tool",
         toolName: context.toolName ?? "unknown",
-        sessionId: context.sessionId
+        sessionId: context.sessionId,
+        secret
       };
     case "global":
-      return { type: "global" };
+      return { type: "global", secret };
   }
 }
 var textDecoder = new TextDecoder();
@@ -655,7 +659,7 @@ var RememberAccessor = class {
    * `'unknown'`.
    */
   get toolName() {
-    return (0, import_sdk2.getRunningTool)()?.fullName ?? this.ctx.flow?.name ?? "unknown";
+    return (0, import_sdk2.getRunningTool)()?.fullName ?? "unknown";
   }
   /**
    * Build the scope-specific prefix.
@@ -689,11 +693,15 @@ var RememberAccessor = class {
    */
   getKeySource(scope) {
     const needsSessionIdentity = scope === "session" || scope === "tool";
-    return getKeySourceForScope(scope, {
-      sessionId: needsSessionIdentity ? this.resolveSessionIdentity() : this.ctx.sessionId,
-      userId: this.userId,
-      toolName: scope === "tool" ? this.toolName : void 0
-    });
+    return getKeySourceForScope(
+      scope,
+      {
+        sessionId: needsSessionIdentity ? this.resolveSessionIdentity() : this.ctx.sessionId,
+        userId: this.userId,
+        toolName: scope === "tool" ? this.toolName : void 0
+      },
+      this.config.encryption?.customKey
+    );
   }
   /** The entry stored under `storageKey`, if readable and unexpired; an expired one is deleted. */
   async readEntry(storageKey, scope) {
@@ -905,10 +913,28 @@ RememberMemoryProvider = __decorateClass([
 // plugins/plugin-remember/src/providers/remember-redis.provider.ts
 var import_ioredis = __toESM(require("ioredis"));
 var import_sdk4 = require("@frontmcp/sdk");
+
+// plugins/plugin-remember/src/providers/remember-key-prefix.ts
+function prefixedStoreKey(keyPrefix, key) {
+  return keyPrefix && key.startsWith(keyPrefix) ? key : keyPrefix + key;
+}
+function doubledPrefixKey(keyPrefix, key) {
+  return keyPrefix && key.startsWith(keyPrefix) ? keyPrefix + key : void 0;
+}
+function callerKeyOf(keyPrefix, pattern, backendKey) {
+  return keyPrefix && pattern.startsWith(keyPrefix) ? backendKey : backendKey.slice(keyPrefix.length);
+}
+var SET_IF_NEITHER_KEY_EXISTS_SCRIPT = `
+if redis.call('EXISTS', KEYS[1], KEYS[2]) > 0 then return 0 end
+if ARGV[2] ~= '' then redis.call('SET', KEYS[1], ARGV[1], 'EX', ARGV[2]) else redis.call('SET', KEYS[1], ARGV[1]) end
+return 1
+`;
+
+// plugins/plugin-remember/src/providers/remember-redis.provider.ts
 var RememberRedisProvider = class {
   client;
   /**
-   * Prefix prepended to all Redis keys.
+   * Prefix prepended to Redis keys that don't already start with it.
    * Include any separator (e.g., "myapp:" or "user:123:") as part of the prefix.
    */
   keyPrefix;
@@ -962,7 +988,7 @@ var RememberRedisProvider = class {
         throw new Error(`Invalid TTL: must be an integer, got ${ttlSeconds}`);
       }
     }
-    const fullKey = this.keyPrefix + key;
+    const fullKey = prefixedStoreKey(this.keyPrefix, key);
     const strValue = JSON.stringify(value);
     const ttl = ttlSeconds ?? this.defaultTTL;
     if (ttl !== void 0 && ttl > 0) {
@@ -970,18 +996,35 @@ var RememberRedisProvider = class {
     } else {
       await this.client.set(fullKey, strValue);
     }
+    await this.deleteDoubledPrefixKey(key);
   }
   /**
    * Store a value only if the key is absent, via Redis `SET ... NX`.
    *
    * `set` resolves to `'OK'` when it created the key and `null` when the key already existed,
    * so the whole check-and-write is one round trip and two callers racing cannot both win.
+   * A key that releases up to 1.9.1 may hold under the doubled prefix counts as present too: one
+   * script checks both keys and writes, so an entry still there is never shadowed.
    */
   async setIfAbsent(key, value, ttlSeconds) {
-    const fullKey = this.keyPrefix + key;
+    const fullKey = prefixedStoreKey(this.keyPrefix, key);
     const strValue = JSON.stringify(value);
     const ttl = ttlSeconds ?? this.defaultTTL;
-    const result = ttl !== void 0 && ttl > 0 ? await this.client.set(fullKey, strValue, "EX", ttl, "NX") : await this.client.set(fullKey, strValue, "NX");
+    const hasTtl = ttl !== void 0 && ttl > 0;
+    const doubledKey = doubledPrefixKey(this.keyPrefix, key);
+    if (doubledKey) {
+      const ttlArgument = hasTtl ? String(ttl) : "";
+      const created = await this.client.eval(
+        SET_IF_NEITHER_KEY_EXISTS_SCRIPT,
+        2,
+        fullKey,
+        doubledKey,
+        strValue,
+        ttlArgument
+      );
+      return created === 1;
+    }
+    const result = hasTtl ? await this.client.set(fullKey, strValue, "EX", ttl, "NX") : await this.client.set(fullKey, strValue, "NX");
     return result === "OK";
   }
   /**
@@ -996,8 +1039,7 @@ var RememberRedisProvider = class {
    * @returns The parsed value as T, or defaultValue/undefined
    */
   async getValue(key, defaultValue) {
-    const fullKey = this.keyPrefix + key;
-    const raw = await this.client.get(fullKey);
+    const raw = await this.client.get(prefixedStoreKey(this.keyPrefix, key)) ?? await this.readDoubledPrefixValue(key);
     if (raw === null) return defaultValue;
     try {
       return JSON.parse(raw);
@@ -1009,32 +1051,55 @@ var RememberRedisProvider = class {
    * Delete a key.
    */
   async delete(key) {
-    const fullKey = this.keyPrefix + key;
-    await this.client.del(fullKey);
+    await this.client.del(prefixedStoreKey(this.keyPrefix, key));
+    await this.deleteDoubledPrefixKey(key);
   }
   /**
    * Check if a key exists.
    */
   async exists(key) {
-    const fullKey = this.keyPrefix + key;
-    return await this.client.exists(fullKey) === 1;
+    if (await this.client.exists(prefixedStoreKey(this.keyPrefix, key)) === 1) return true;
+    const doubledKey = doubledPrefixKey(this.keyPrefix, key);
+    return doubledKey !== void 0 && await this.client.exists(doubledKey) === 1;
   }
   /**
    * List keys matching a pattern.
    * Uses Redis SCAN for efficient iteration.
    */
-  async keys(pattern) {
-    const searchPattern = this.keyPrefix + (pattern ?? "*");
-    const result = [];
+  async keys(pattern = "*") {
+    const result = /* @__PURE__ */ new Set();
+    for (const key of await this.scan(prefixedStoreKey(this.keyPrefix, pattern))) {
+      result.add(callerKeyOf(this.keyPrefix, pattern, key));
+    }
+    const doubledPattern = doubledPrefixKey(this.keyPrefix, pattern);
+    if (doubledPattern) {
+      for (const key of await this.scan(doubledPattern)) result.add(key.slice(this.keyPrefix.length));
+    }
+    return [...result];
+  }
+  async scan(match) {
+    const found = [];
     let cursor = "0";
     do {
-      const [nextCursor, keys] = await this.client.scan(cursor, "MATCH", searchPattern, "COUNT", 100);
+      const [nextCursor, keys] = await this.client.scan(cursor, "MATCH", match, "COUNT", 100);
       cursor = nextCursor;
-      for (const key of keys) {
-        result.push(key.slice(this.keyPrefix.length));
-      }
+      found.push(...keys);
     } while (cursor !== "0");
-    return result;
+    return found;
+  }
+  /**
+   * The stored text of an entry a release up to 1.9.1 wrote under the doubled key, or null. It is read
+   * in place, not copied: the entry keeps its TTL, a rolled-back release still finds it, and a
+   * concurrent `delete()` cannot be undone by a copy. The next write or delete of the key removes it.
+   */
+  async readDoubledPrefixValue(key) {
+    const doubledKey = doubledPrefixKey(this.keyPrefix, key);
+    return doubledKey ? this.client.get(doubledKey) : null;
+  }
+  /** Drops what releases up to 1.9.1 left under the doubled key, so it cannot come back once this key is gone. */
+  async deleteDoubledPrefixKey(key) {
+    const doubledKey = doubledPrefixKey(this.keyPrefix, key);
+    if (doubledKey) await this.client.del(doubledKey);
   }
   /**
    * Gracefully close the Redis connection.
@@ -1059,13 +1124,11 @@ RememberRedisProvider = __decorateClass([
 var import_sdk5 = require("@frontmcp/sdk");
 var import_utils3 = require("@frontmcp/utils");
 var RememberVercelKvProvider = class {
-  createClient;
   connection;
   client;
   keyPrefix;
   defaultTTL;
   constructor(options = {}) {
-    const vercelKv = require("@vercel/kv");
     const hasUrl = options.url !== void 0;
     const hasToken = options.token !== void 0;
     if (hasUrl !== hasToken) {
@@ -1073,25 +1136,24 @@ var RememberVercelKvProvider = class {
         `RememberVercelKvProvider: Both 'url' and 'token' must be provided together, or neither. Received: url=${hasUrl ? "provided" : "missing"}, token=${hasToken ? "provided" : "missing"}`
       );
     }
-    this.createClient = vercelKv.createClient;
     this.connection = { url: options.url, token: options.token };
     this.keyPrefix = options.keyPrefix ?? "remember:";
     this.defaultTTL = options.defaultTTL;
   }
-  /** Built on first use, like the module's `kv` singleton, which would JSON-parse what it reads. */
-  get kv() {
-    if (!this.client) {
-      const url = this.connection.url ?? (0, import_utils3.getEnv)("KV_REST_API_URL");
-      const token = this.connection.token ?? (0, import_utils3.getEnv)("KV_REST_API_TOKEN");
-      if (!url || !token) {
-        throw new Error("RememberVercelKvProvider: pass url and token, or set KV_REST_API_URL and KV_REST_API_TOKEN.");
-      }
-      this.client = this.createClient({ url, token, automaticDeserialization: false });
-    }
+  /**
+   * The client, built on first use from the url and token (or KV_REST_API_URL / KV_REST_API_TOKEN)
+   * by the shared loader, which a Cloudflare Worker can bundle (#711). Values are read back as
+   * stored. A failed attempt is retried.
+   */
+  kv() {
+    this.client ??= (0, import_utils3.createVercelKvClient)(this.connection).catch((error) => {
+      this.client = void 0;
+      throw error;
+    });
     return this.client;
   }
   prefixKey(key) {
-    return `${this.keyPrefix}${key}`;
+    return prefixedStoreKey(this.keyPrefix, key);
   }
   /**
    * Store a value with optional TTL.
@@ -1100,31 +1162,42 @@ var RememberVercelKvProvider = class {
     const fullKey = this.prefixKey(key);
     const strValue = JSON.stringify(value);
     const ttl = ttlSeconds ?? this.defaultTTL;
+    const kv = await this.kv();
     if (ttl && ttl > 0) {
-      await this.kv.set(fullKey, strValue, { ex: ttl });
+      await kv.set(fullKey, strValue, { ex: ttl });
     } else {
-      await this.kv.set(fullKey, strValue);
+      await kv.set(fullKey, strValue);
     }
+    await this.deleteDoubledPrefixKey(key);
   }
   /**
    * Store a value only if the key is absent, via the `nx` option.
    *
    * Resolves to `'OK'` when it created the key and `null` when the key already existed, so two
-   * callers racing cannot both win.
+   * callers racing cannot both win. A key that releases up to 1.9.1 may hold under the doubled
+   * prefix counts as present too: one script checks both keys and writes, so an entry still there
+   * is never shadowed.
    */
   async setIfAbsent(key, value, ttlSeconds) {
     const fullKey = this.prefixKey(key);
     const strValue = JSON.stringify(value);
     const ttl = ttlSeconds ?? this.defaultTTL;
-    const result = ttl && ttl > 0 ? await this.kv.set(fullKey, strValue, { nx: true, ex: ttl }) : await this.kv.set(fullKey, strValue, { nx: true });
+    const doubledKey = doubledPrefixKey(this.keyPrefix, key);
+    const kv = await this.kv();
+    if (doubledKey) {
+      const ttlArgument = ttl && ttl > 0 ? String(ttl) : "";
+      const created = await kv.eval(SET_IF_NEITHER_KEY_EXISTS_SCRIPT, [fullKey, doubledKey], [strValue, ttlArgument]);
+      return Number(created) === 1;
+    }
+    const result = ttl && ttl > 0 ? await kv.set(fullKey, strValue, { nx: true, ex: ttl }) : await kv.set(fullKey, strValue, { nx: true });
     return result === "OK";
   }
   /**
    * Retrieve a value by key.
    */
   async getValue(key, defaultValue) {
-    const fullKey = this.prefixKey(key);
-    const raw = await this.kv.get(fullKey);
+    const kv = await this.kv();
+    const raw = await kv.get(this.prefixKey(key)) ?? await this.readDoubledPrefixValue(key);
     if (raw === null) return defaultValue;
     try {
       return JSON.parse(raw);
@@ -1136,46 +1209,70 @@ var RememberVercelKvProvider = class {
    * Delete a key.
    */
   async delete(key) {
-    const fullKey = this.prefixKey(key);
-    await this.kv.del(fullKey);
+    const kv = await this.kv();
+    await kv.del(this.prefixKey(key));
+    await this.deleteDoubledPrefixKey(key);
   }
   /**
    * Check if a key exists.
    */
   async exists(key) {
-    const fullKey = this.prefixKey(key);
-    return await this.kv.exists(fullKey) === 1;
+    const kv = await this.kv();
+    if (await kv.exists(this.prefixKey(key)) === 1) return true;
+    const doubledKey = doubledPrefixKey(this.keyPrefix, key);
+    return doubledKey !== void 0 && await kv.exists(doubledKey) === 1;
   }
   /**
    * List keys matching a pattern.
    * Uses SCAN for efficient iteration.
    */
-  async keys(pattern) {
-    const searchPattern = this.prefixKey(pattern ?? "*");
-    const result = [];
+  async keys(pattern = "*") {
+    const result = /* @__PURE__ */ new Set();
+    for (const key of await this.scan(this.prefixKey(pattern))) {
+      result.add(callerKeyOf(this.keyPrefix, pattern, key));
+    }
+    const doubledPattern = doubledPrefixKey(this.keyPrefix, pattern);
+    if (doubledPattern) {
+      for (const key of await this.scan(doubledPattern)) result.add(key.slice(this.keyPrefix.length));
+    }
+    return [...result];
+  }
+  async scan(match) {
+    const found = [];
+    const kv = await this.kv();
     try {
       let cursor = 0;
       do {
-        const [nextCursor, keys] = await this.kv.scan(cursor, {
-          match: searchPattern,
-          count: 100
-        });
+        const [nextCursor, keys] = await kv.scan(cursor, { match, count: 100 });
         cursor = nextCursor;
-        for (const key of keys) {
-          result.push(key.slice(this.keyPrefix.length));
-        }
+        found.push(...keys);
       } while (String(cursor) !== "0");
     } catch {
       try {
-        const keys = await this.kv.keys(searchPattern);
-        for (const key of keys) {
-          result.push(key.slice(this.keyPrefix.length));
-        }
+        found.push(...await kv.keys(match));
       } catch {
         console.warn("[RememberPlugin:VercelKV] keys() operation not supported");
       }
     }
-    return result;
+    return found;
+  }
+  /**
+   * The stored text of an entry a release up to 1.9.1 wrote under the doubled key, or null. It is read
+   * in place, not copied: the entry keeps its TTL, a rolled-back release still finds it, and a
+   * concurrent `delete()` cannot be undone by a copy. The next write or delete of the key removes it.
+   */
+  async readDoubledPrefixValue(key) {
+    const doubledKey = doubledPrefixKey(this.keyPrefix, key);
+    if (!doubledKey) return null;
+    const kv = await this.kv();
+    return kv.get(doubledKey);
+  }
+  /** Drops what releases up to 1.9.1 left under the doubled key, so it cannot come back once this key is gone. */
+  async deleteDoubledPrefixKey(key) {
+    const doubledKey = doubledPrefixKey(this.keyPrefix, key);
+    if (!doubledKey) return;
+    const kv = await this.kv();
+    await kv.del(doubledKey);
   }
   /**
    * Gracefully close the provider.
@@ -1462,7 +1559,13 @@ function createRememberTools(prefix = "") {
 }
 
 // plugins/plugin-remember/src/remember.plugin.ts
-function withCheckedDefaultTTL(options) {
+function withCheckedOptions(options) {
+  const customKey = options.encryption?.customKey;
+  if (customKey !== void 0 && customKey.trim() === "") {
+    throw new RememberConfigurationError(
+      "RememberPlugin encryption.customKey must not be empty; omit it to derive keys from the server secret"
+    );
+  }
   const { defaultTTL } = options;
   if (defaultTTL === void 0) return options;
   if (defaultTTL === 0) return { ...options, defaultTTL: void 0 };
@@ -1479,7 +1582,7 @@ var RememberPlugin = class extends import_sdk11.DynamicPlugin {
     super();
     this.options = {
       ...RememberPlugin.defaultOptions,
-      ...withCheckedDefaultTTL(options)
+      ...withCheckedOptions(options)
     };
   }
 };
@@ -1500,7 +1603,7 @@ __publicField(RememberPlugin, "dynamicProviders", (options) => {
   const providers = [];
   const config = {
     ...RememberPlugin.defaultOptions,
-    ...withCheckedDefaultTTL(options)
+    ...withCheckedOptions(options)
   };
   switch (config.type) {
     case "global-store":

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/plugin-remember",
-  "version": "1.9.1",
+  "version": "1.9.3",
   "description": "Remember plugin for FrontMCP - encrypted session memory with approval system for secure tool authorization",
   "author": "AgentFront <info@agentfront.dev>",
   "license": "Apache-2.0",
@@ -49,12 +49,12 @@
     }
   },
   "dependencies": {
-    "@frontmcp/sdk": "1.9.1",
-    "@frontmcp/utils": "1.9.1",
+    "@frontmcp/sdk": "1.9.3",
+    "@frontmcp/utils": "1.9.3",
     "ioredis": "^5.8.0"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.9.1",
+    "@frontmcp/lazy-zod": "1.9.3",
     "@vercel/kv": "^2.0.0 || ^3.0.0"
   },
   "peerDependenciesMeta": {

package/providers/remember-accessor.provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remember-accessor.provider.d.ts","sourceRoot":"","sources":["../../src/providers/remember-accessor.provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,KAAK,eAAe,EACpB,KAAK,cAAc,EACpB,MAAM,eAAe,CAAC;AAKvB,OAAO,KAAK,EACV,aAAa,EACb,qBAAqB,EACrB,kBAAkB,EAClB,oBAAoB,EACpB,mBAAmB,EACnB,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAmCzE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAKa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAyB;IAC/C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAkB;IACtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;IAC/C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAU;gBAG1C,KAAK,EAAE,sBAAsB,EAC7B,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,qBAAqB,EAC7B,MAAM,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC;IAwBjD;;;;;;;;;OASG;IACG,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,GAAE,kBAAuB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IAuBhG;;;;;;OAMG;IACG,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,kBAAkB,CAAC,CAAC,CAAM,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IAMtF;;;;;;OAMG;IACG,QAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,aAAa,CAAA;KAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC;IAK9G;;;;;OAKG;IACG,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,GAAG,OAAO,CAAC,IAAI,CAAC;IAM7E;;;;;;OAMG;IACG,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,oBAAyB,GAAG,OAAO,CAAC,OAAO,CAAC;IAK9E;;;;;OAKG;IACG,IAAI,CAAC,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAWhE;;;;;;;;;;OAUG;IACG,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,aAAa,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAiC/G;;;;;OAKG;IACH,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED;;OAEG;IACH,IAAI,MAAM,IAAI,MAAM,GAAG,SAAS,CAS/B;IAMD;;OAEG;IACH,OAAO,CAAC,eAAe;IAIvB;;;;;;;;OAQG;IACH,OAAO,KAAK,iBAAiB,GAQ5B;IAED;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,sBAAsB;IAmB9B;;;;;OAKG;IACH,OAAO,KAAK,QAAQ,GAEnB;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,gBAAgB;IA4BxB;;OAEG;IACH,OAAO,CAAC,YAAY;IAYpB,iGAAiG;YACnF,SAAS;IAkBvB;;OAEG;IACH,OAAO,CAAC,UAAU;CAOnB;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,sBAAsB,EAC7B,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,qBAAqB,EAC7B,MAAM,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,GAC9C,gBAAgB,CAElB"}
+{"version":3,"file":"remember-accessor.provider.d.ts","sourceRoot":"","sources":["../../src/providers/remember-accessor.provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,KAAK,eAAe,EACpB,KAAK,cAAc,EACpB,MAAM,eAAe,CAAC;AAKvB,OAAO,KAAK,EACV,aAAa,EACb,qBAAqB,EACrB,kBAAkB,EAClB,oBAAoB,EACpB,mBAAmB,EACnB,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAmCzE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAKa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAyB;IAC/C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAkB;IACtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;IAC/C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAU;gBAG1C,KAAK,EAAE,sBAAsB,EAC7B,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,qBAAqB,EAC7B,MAAM,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC;IAwBjD;;;;;;;;;OASG;IACG,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,GAAE,kBAAuB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IAuBhG;;;;;;OAMG;IACG,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,kBAAkB,CAAC,CAAC,CAAM,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IAMtF;;;;;;OAMG;IACG,QAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,aAAa,CAAA;KAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC;IAK9G;;;;;OAKG;IACG,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,GAAG,OAAO,CAAC,IAAI,CAAC;IAM7E;;;;;;OAMG;IACG,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,oBAAyB,GAAG,OAAO,CAAC,OAAO,CAAC;IAK9E;;;;;OAKG;IACG,IAAI,CAAC,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAWhE;;;;;;;;;;OAUG;IACG,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,aAAa,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAiC/G;;;;;OAKG;IACH,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED;;OAEG;IACH,IAAI,MAAM,IAAI,MAAM,GAAG,SAAS,CAS/B;IAMD;;OAEG;IACH,OAAO,CAAC,eAAe;IAIvB;;;;;;;;OAQG;IACH,OAAO,KAAK,iBAAiB,GAQ5B;IAED;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,sBAAsB;IAmB9B;;;;;OAKG;IACH,OAAO,KAAK,QAAQ,GAEnB;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,gBAAgB;IA4BxB;;OAEG;IACH,OAAO,CAAC,YAAY;IAgBpB,iGAAiG;YACnF,SAAS;IAkBvB;;OAEG;IACH,OAAO,CAAC,UAAU;CAOnB;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,sBAAsB,EAC7B,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,qBAAqB,EAC7B,MAAM,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,GAC9C,gBAAgB,CAElB"}

package/providers/remember-key-prefix.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Key prefixing for the stores that take a `keyPrefix` (Redis, Vercel KV).
+ *
+ * The Remember accessor hands a store keys that already start with the plugin's `keyPrefix`
+ * (`remember:v2:user:…`), and the plugin gives the store the same prefix. Up to 1.9.1 the store
+ * added it again, so entries lived under `remember:remember:v2:user:…` (#767). A key that already
+ * carries the prefix is now stored as is, and the doubled key is where such an entry may still be.
+ */
+/** The backend key for a store key. */
+export declare function prefixedStoreKey(keyPrefix: string, key: string): string;
+/** Where releases up to 1.9.1 stored a key that carries the prefix: with the prefix twice. */
+export declare function doubledPrefixKey(keyPrefix: string, key: string): string | undefined;
+/** A backend key found by `keys(pattern)`, as the caller names it. */
+export declare function callerKeyOf(keyPrefix: string, pattern: string, backendKey: string): string;
+/**
+ * Sets KEYS[1] to ARGV[1], with ARGV[2] seconds of TTL when it is not empty, unless KEYS[1] or KEYS[2]
+ * exists. Run as one script, a value still under the doubled key keeps a conditional write out.
+ */
+export declare const SET_IF_NEITHER_KEY_EXISTS_SCRIPT = "\nif redis.call('EXISTS', KEYS[1], KEYS[2]) > 0 then return 0 end\nif ARGV[2] ~= '' then redis.call('SET', KEYS[1], ARGV[1], 'EX', ARGV[2]) else redis.call('SET', KEYS[1], ARGV[1]) end\nreturn 1\n";
+//# sourceMappingURL=remember-key-prefix.d.ts.map

package/providers/remember-key-prefix.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remember-key-prefix.d.ts","sourceRoot":"","sources":["../../src/providers/remember-key-prefix.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,uCAAuC;AACvC,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEvE;AAED,8FAA8F;AAC9F,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEnF;AAED,sEAAsE;AACtE,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAE1F;AAED;;;GAGG;AACH,eAAO,MAAM,gCAAgC,yMAI5C,CAAC"}

package/providers/remember-redis.provider.d.ts

@@ -11,7 +11,7 @@ export type RedisRememberOptions = RedisRememberPluginOptions | RedisClientRemem
 export default class RememberRedisProvider implements RememberStoreInterface {
     private readonly client;
     /**
-     * Prefix prepended to all Redis keys.
+     * Prefix prepended to Redis keys that don't already start with it.
      * Include any separator (e.g., "myapp:" or "user:123:") as part of the prefix.
      */
     private readonly keyPrefix;
@@ -34,6 +34,8 @@ export default class RememberRedisProvider implements RememberStoreInterface {
      *
      * `set` resolves to `'OK'` when it created the key and `null` when the key already existed,
      * so the whole check-and-write is one round trip and two callers racing cannot both win.
+     * A key that releases up to 1.9.1 may hold under the doubled prefix counts as present too: one
+     * script checks both keys and writes, so an entry still there is never shadowed.
      */
     setIfAbsent(key: string, value: unknown, ttlSeconds?: number): Promise<boolean>;
     /**
@@ -61,6 +63,15 @@ export default class RememberRedisProvider implements RememberStoreInterface {
      * Uses Redis SCAN for efficient iteration.
      */
     keys(pattern?: string): Promise<string[]>;
+    private scan;
+    /**
+     * The stored text of an entry a release up to 1.9.1 wrote under the doubled key, or null. It is read
+     * in place, not copied: the entry keeps its TTL, a rolled-back release still finds it, and a
+     * concurrent `delete()` cannot be undone by a copy. The next write or delete of the key removes it.
+     */
+    private readDoubledPrefixValue;
+    /** Drops what releases up to 1.9.1 left under the doubled key, so it cannot come back once this key is gone. */
+    private deleteDoubledPrefixKey;
     /**
      * Gracefully close the Redis connection.
      * Only closes if this provider owns the client (created it internally).

package/providers/remember-redis.provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remember-redis.provider.d.ts","sourceRoot":"","sources":["../../src/providers/remember-redis.provider.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gCAAgC,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AACtG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAEzE;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG,0BAA0B,GAAG,gCAAgC,CAAC;AAEjG;;;GAGG;AAMH,MAAM,CAAC,OAAO,OAAO,qBAAsB,YAAW,sBAAsB;IAC1E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;IACrC;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,oDAAoD;IACpD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAS;IACrC,mGAAmG;IACnG,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAU;gBAEzB,OAAO,EAAE,oBAAoB;IA8BzC;;;;;;;OAOG;IACG,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA8B/E;;;;;OAKG;IACG,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAarF;;;;;;;;;;OAUG;IACG,QAAQ,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IAclF;;OAEG;IACG,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKxC;;OAEG;IACG,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAK3C;;;OAGG;IACG,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAkB/C;;;;OAIG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAK7B"}
+{"version":3,"file":"remember-redis.provider.d.ts","sourceRoot":"","sources":["../../src/providers/remember-redis.provider.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gCAAgC,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAOtG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAEzE;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG,0BAA0B,GAAG,gCAAgC,CAAC;AAEjG;;;GAGG;AAMH,MAAM,CAAC,OAAO,OAAO,qBAAsB,YAAW,sBAAsB;IAC1E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;IACrC;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,oDAAoD;IACpD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAS;IACrC,mGAAmG;IACnG,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAU;gBAEzB,OAAO,EAAE,oBAAoB;IA8BzC;;;;;;;OAOG;IACG,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA+B/E;;;;;;;OAOG;IACG,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA2BrF;;;;;;;;;;OAUG;IACG,QAAQ,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IAclF;;OAEG;IACG,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKxC;;OAEG;IACG,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAM3C;;;OAGG;IACG,IAAI,CAAC,OAAO,SAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YAY9B,IAAI;IAWlB;;;;OAIG;YACW,sBAAsB;IAKpC,gHAAgH;YAClG,sBAAsB;IAKpC;;;;OAIG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAK7B"}

package/providers/remember-vercel-kv.provider.d.ts

@@ -17,14 +17,17 @@ export interface RememberVercelKvProviderOptions {
  * Provides serverless-compatible, edge-ready storage.
  */
 export default class RememberVercelKvProvider implements RememberStoreInterface {
-    private readonly createClient;
     private readonly connection;
     private client?;
     private readonly keyPrefix;
     private readonly defaultTTL?;
     constructor(options?: RememberVercelKvProviderOptions);
-    /** Built on first use, like the module's `kv` singleton, which would JSON-parse what it reads. */
-    private get kv();
+    /**
+     * The client, built on first use from the url and token (or KV_REST_API_URL / KV_REST_API_TOKEN)
+     * by the shared loader, which a Cloudflare Worker can bundle (#711). Values are read back as
+     * stored. A failed attempt is retried.
+     */
+    private kv;
     private prefixKey;
     /**
      * Store a value with optional TTL.
@@ -34,7 +37,9 @@ export default class RememberVercelKvProvider implements RememberStoreInterface
      * Store a value only if the key is absent, via the `nx` option.
      *
      * Resolves to `'OK'` when it created the key and `null` when the key already existed, so two
-     * callers racing cannot both win.
+     * callers racing cannot both win. A key that releases up to 1.9.1 may hold under the doubled
+     * prefix counts as present too: one script checks both keys and writes, so an entry still there
+     * is never shadowed.
      */
     setIfAbsent(key: string, value: unknown, ttlSeconds?: number): Promise<boolean>;
     /**
@@ -54,6 +59,15 @@ export default class RememberVercelKvProvider implements RememberStoreInterface
      * Uses SCAN for efficient iteration.
      */
     keys(pattern?: string): Promise<string[]>;
+    private scan;
+    /**
+     * The stored text of an entry a release up to 1.9.1 wrote under the doubled key, or null. It is read
+     * in place, not copied: the entry keeps its TTL, a rolled-back release still finds it, and a
+     * concurrent `delete()` cannot be undone by a copy. The next write or delete of the key removes it.
+     */
+    private readDoubledPrefixValue;
+    /** Drops what releases up to 1.9.1 left under the doubled key, so it cannot come back once this key is gone. */
+    private deleteDoubledPrefixKey;
     /**
      * Gracefully close the provider.
      * No-op for Vercel KV as it uses stateless REST API.

package/providers/remember-vercel-kv.provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remember-vercel-kv.provider.d.ts","sourceRoot":"","sources":["../../src/providers/remember-vercel-kv.provider.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAmBzE;;GAEG;AACH,MAAM,WAAW,+BAA+B;IAC9C,0DAA0D;IAC1D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6BAA6B;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AAMH,MAAM,CAAC,OAAO,OAAO,wBAAyB,YAAW,sBAAsB;IAC7E,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAiC;IAC9D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmC;IAC9D,OAAO,CAAC,MAAM,CAAC,CAAiB;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAS;gBAEzB,OAAO,GAAE,+BAAoC;IAoBzD,kGAAkG;IAClG,OAAO,KAAK,EAAE,GAUb;IAED,OAAO,CAAC,SAAS;IAIjB;;OAEG;IACG,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAY/E;;;;;OAKG;IACG,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAarF;;OAEG;IACG,QAAQ,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IAalF;;OAEG;IACG,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKxC;;OAEG;IACG,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAK3C;;;OAGG;IACG,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAmC/C;;;OAGG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7B"}
+{"version":3,"file":"remember-vercel-kv.provider.d.ts","sourceRoot":"","sources":["../../src/providers/remember-vercel-kv.provider.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAgBzE;;GAEG;AACH,MAAM,WAAW,+BAA+B;IAC9C,0DAA0D;IAC1D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6BAA6B;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AAMH,MAAM,CAAC,OAAO,OAAO,wBAAyB,YAAW,sBAAsB;IAC7E,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAqB;IAChD,OAAO,CAAC,MAAM,CAAC,CAA0B;IACzC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAS;gBAEzB,OAAO,GAAE,+BAAoC;IAgBzD;;;;OAIG;IACH,OAAO,CAAC,EAAE;IAQV,OAAO,CAAC,SAAS;IAIjB;;OAEG;IACG,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAc/E;;;;;;;OAOG;IACG,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAqBrF;;OAEG;IACG,QAAQ,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IAalF;;OAEG;IACG,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMxC;;OAEG;IACG,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAO3C;;;OAGG;IACG,IAAI,CAAC,OAAO,SAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YAY9B,IAAI;IAuBlB;;;;OAIG;YACW,sBAAsB;IAOpC,gHAAgH;YAClG,sBAAsB;IAOpC;;;OAGG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7B"}

package/remember.crypto.d.ts

@@ -8,7 +8,14 @@ export type EncryptedBlob = EncBlob;
 /**
  * Key derivation source configuration.
  */
-export type EncryptionKeySource = {
+export type EncryptionKeySource = (ScopeKeySource & {
+    /** The secret keys are derived from, in place of the server secret (`encryption.customKey`). */
+    secret?: string;
+}) | {
+    type: 'custom';
+    key: string;
+};
+type ScopeKeySource = {
     type: 'session';
     sessionId: string;
 } | {
@@ -20,9 +27,6 @@ export type EncryptionKeySource = {
     sessionId: string;
 } | {
     type: 'global';
-} | {
-    type: 'custom';
-    key: string;
 };
 /**
  * Derive a 256-bit encryption key based on the source.
@@ -54,7 +58,7 @@ export declare function getKeySourceForScope(scope: RememberScope, context: {
     sessionId: string;
     userId?: string;
     toolName?: string;
-}): EncryptionKeySource;
+}, secret?: string): EncryptionKeySource;
 /**
  * Encrypt a value using AES-256-GCM.
  * Uses @frontmcp/utils crypto for cross-platform support.
@@ -89,4 +93,5 @@ export declare function encryptAndSerialize(data: unknown, keySource: Encryption
  * Convenience function to deserialize and decrypt in one step.
  */
 export declare function deserializeAndDecrypt<T = unknown>(str: string, keySource: EncryptionKeySource): Promise<T | null>;
+export {};
 //# sourceMappingURL=remember.crypto.d.ts.map

package/remember.crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remember.crypto.d.ts","sourceRoot":"","sources":["../src/remember.crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAOL,KAAK,OAAO,EACb,MAAM,iBAAiB,CAAC;AAGzB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAMtD;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,OAAO,CAAC;AAEpC;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACrD;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AA4BpC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,UAAU,CAAC,CAwC1F;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,aAAa,EACpB,OAAO,EAAE;IACP,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GACA,mBAAmB,CAerB;AASD;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,mBAAmB,GAAG,OAAO,CAAC,aAAa,CAAC,CAaxG;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,CAAC,GAAG,OAAO,EAC5C,IAAI,EAAE,aAAa,EACnB,SAAS,EAAE,mBAAmB,GAC7B,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAmBnB;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAEzD;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAiBjE;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,CAGxG;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,GAAG,OAAO,EACrD,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,mBAAmB,GAC7B,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAInB"}
+{"version":3,"file":"remember.crypto.d.ts","sourceRoot":"","sources":["../src/remember.crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAOL,KAAK,OAAO,EACb,MAAM,iBAAiB,CAAC;AAGzB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAMtD;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,OAAO,CAAC;AAEpC;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAC3B,CAAC,cAAc,GAAG;IAChB,gGAAgG;IAChG,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC,GACF;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpC,KAAK,cAAc,GACf;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACrD;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC;AAiCvB;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,UAAU,CAAC,CAwC1F;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,aAAa,EACpB,OAAO,EAAE;IACP,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,EACD,MAAM,CAAC,EAAE,MAAM,GACd,mBAAmB,CAgBrB;AASD;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,mBAAmB,GAAG,OAAO,CAAC,aAAa,CAAC,CAaxG;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,CAAC,GAAG,OAAO,EAC5C,IAAI,EAAE,aAAa,EACnB,SAAS,EAAE,mBAAmB,GAC7B,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAmBnB;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAEzD;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAiBjE;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,CAGxG;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,GAAG,OAAO,EACrD,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,mBAAmB,GAC7B,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAInB"}

package/remember.plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remember.plugin.d.ts","sourceRoot":"","sources":["../src/remember.plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EASb,KAAK,YAAY,EACjB,KAAK,QAAQ,EACd,MAAM,eAAe,CAAC;AAQvB,OAAO,KAAK,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAgB1F;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAwBH,MAAM,CAAC,OAAO,OAAO,cAAe,SAAQ,aAAa,CAAC,qBAAqB,EAAE,0BAA0B,CAAC;IAC1G,MAAM,CAAC,cAAc,EAAE,qBAAqB,CAI1C;IAEF,OAAO,EAAE,qBAAqB,CAAC;gBAEnB,OAAO,GAAE,0BAA+B;IAQpD;;;OAGG;IACH,OAAgB,YAAY,GAAI,SAAS,0BAA0B,KAAG,SAAS,QAAQ,EAAE,CACf;IAE1E;;OAEG;IACH,OAAgB,gBAAgB,GAAI,SAAS,0BAA0B,KAAG,YAAY,EAAE,CA2HtF;CACH"}
+{"version":3,"file":"remember.plugin.d.ts","sourceRoot":"","sources":["../src/remember.plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EASb,KAAK,YAAY,EACjB,KAAK,QAAQ,EACd,MAAM,eAAe,CAAC;AAQvB,OAAO,KAAK,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAyB1F;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAwBH,MAAM,CAAC,OAAO,OAAO,cAAe,SAAQ,aAAa,CAAC,qBAAqB,EAAE,0BAA0B,CAAC;IAC1G,MAAM,CAAC,cAAc,EAAE,qBAAqB,CAI1C;IAEF,OAAO,EAAE,qBAAqB,CAAC;gBAEnB,OAAO,GAAE,0BAA+B;IAQpD;;;OAGG;IACH,OAAgB,YAAY,GAAI,SAAS,0BAA0B,KAAG,SAAS,QAAQ,EAAE,CACf;IAE1E;;OAEG;IACH,OAAgB,gBAAgB,GAAI,SAAS,0BAA0B,KAAG,YAAY,EAAE,CA2HtF;CACH"}

package/remember.types.d.ts

@@ -116,7 +116,10 @@ export interface BaseRememberPluginOptions {
     encryption?: {
         /** Whether encryption is enabled (default: true) */
         enabled?: boolean;
-        /** Custom encryption key (overrides derived keys) */
+        /**
+         * Secret every encryption key is derived from, in place of `REMEMBER_SECRET` (or `MCP_MEMORY_SECRET` /
+         * `MCP_SESSION_SECRET`). Each scope, session and user still gets its own key.
+         */
         customKey?: string;
     };
     /** LLM tools configuration */

package/remember.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remember.types.d.ts","sourceRoot":"","sources":["../src/remember.types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,KAAK,IAAI,WAAW,EAAE,MAAM,SAAS,CAAC;AAQpD;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEnE;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;;EAAgD,CAAC;AAMjF;;GAEG;AACH,OAAO,CAAC,MAAM,YAAY,EAAE,OAAO,MAAM,CAAC;AAE1C;;;GAGG;AACH,MAAM,MAAM,cAAc,CAAC,CAAC,EAAE,KAAK,SAAS,MAAM,IAAI,CAAC,GAAG;IACxD,QAAQ,CAAC,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC;CAChC,CAAC;AAEF,6CAA6C;AAC7C,MAAM,MAAM,eAAe,CAAC,CAAC,GAAG,OAAO,IAAI,cAAc,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;AAEzE,4CAA4C;AAC5C,MAAM,MAAM,iBAAiB,CAAC,CAAC,GAAG,OAAO,IAAI,cAAc,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;AAE7E,kCAAkC;AAClC,MAAM,MAAM,YAAY,CAAC,CAAC,GAAG,OAAO,IAAI,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;AAEnE,wCAAwC;AACxC,MAAM,MAAM,YAAY,CAAC,CAAC,GAAG,OAAO,IAAI,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;AAEnE,0DAA0D;AAC1D,MAAM,MAAM,mBAAmB,CAAC,CAAC,GAAG,OAAO,IAAI,cAAc,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;AAEjF,8CAA8C;AAC9C,MAAM,MAAM,aAAa,CAAC,CAAC,GAAG,OAAO,IAAI,cAAc,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAErE;;;GAGG;AACH,wBAAgB,KAAK,CAAC,CAAC,EAAE,CAAC,SAAS,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,CAEnF;AAED;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,YAAY,GAAG,OAAO,GAAG,OAAO,GAAG,cAAc,GAAG,QAAQ,CAAC;AAMzG;;GAEG;AACH,MAAM,WAAW,aAAa,CAAC,CAAC,GAAG,OAAO;IACxC,uBAAuB;IACvB,KAAK,EAAE,CAAC,CAAC;IAET,4CAA4C;IAC5C,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAEzB,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;IAElB,sCAAsC;IACtC,SAAS,EAAE,MAAM,CAAC;IAElB,yCAAyC;IACzC,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,0BAA0B;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;gCAO9B,CAAC;AAMH;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,8DAA8D;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,sCAAsC;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;;;;;;;;OAUG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAE1B;;;;;;;;;;;OAWG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAE5B,+BAA+B;IAC/B,UAAU,CAAC,EAAE;QACX,oDAAoD;QACpD,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,qDAAqD;QACrD,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;IAEF,8BAA8B;IAC9B,KAAK,CAAC,EAAE;QACN,sDAAsD;QACtD,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,6CAA6C;QAC7C,aAAa,CAAC,EAAE,aAAa,EAAE,CAAC;QAChC,uCAAuC;QACvC,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,2BAA4B,SAAQ,yBAAyB;IAC5E,IAAI,EAAE,QAAQ,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,0BAA2B,SAAQ,yBAAyB;IAC3E,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,EAAE,CAAC,EAAE,MAAM,CAAC;KACb,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,gCAAiC,SAAQ,yBAAyB;IACjF,IAAI,EAAE,cAAc,CAAC;IACrB,MAAM,EAAE,WAAW,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,6BAA8B,SAAQ,yBAAyB;IAC9E,IAAI,EAAE,WAAW,CAAC;IAClB,0DAA0D;IAC1D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,MAAM,WAAW,gCAAiC,SAAQ,yBAAyB;IACjF,IAAI,EAAE,cAAc,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAC7B,2BAA2B,GAC3B,0BAA0B,GAC1B,gCAAgC,GAChC,6BAA6B,GAC7B,gCAAgC,CAAC;AAErC;;GAEG;AACH,MAAM,MAAM,0BAA0B,GAAG,OAAO,CAAC,qBAAqB,CAAC,GAAG;IACxE,IAAI,CAAC,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC;CACtC,CAAC;AAMF;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,wCAAwC;IACxC,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,8BAA8B;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB,0BAA0B;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB,CAAC,CAAC,GAAG,OAAO;IAC7C,wCAAwC;IACxC,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,yCAAyC;IACzC,YAAY,CAAC,EAAE,CAAC,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,wCAAwC;IACxC,KAAK,CAAC,EAAE,aAAa,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,wCAAwC;IACxC,KAAK,CAAC,EAAE,aAAa,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,wCAAwC;IACxC,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB"}
+{"version":3,"file":"remember.types.d.ts","sourceRoot":"","sources":["../src/remember.types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,KAAK,IAAI,WAAW,EAAE,MAAM,SAAS,CAAC;AAQpD;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEnE;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;;EAAgD,CAAC;AAMjF;;GAEG;AACH,OAAO,CAAC,MAAM,YAAY,EAAE,OAAO,MAAM,CAAC;AAE1C;;;GAGG;AACH,MAAM,MAAM,cAAc,CAAC,CAAC,EAAE,KAAK,SAAS,MAAM,IAAI,CAAC,GAAG;IACxD,QAAQ,CAAC,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC;CAChC,CAAC;AAEF,6CAA6C;AAC7C,MAAM,MAAM,eAAe,CAAC,CAAC,GAAG,OAAO,IAAI,cAAc,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;AAEzE,4CAA4C;AAC5C,MAAM,MAAM,iBAAiB,CAAC,CAAC,GAAG,OAAO,IAAI,cAAc,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;AAE7E,kCAAkC;AAClC,MAAM,MAAM,YAAY,CAAC,CAAC,GAAG,OAAO,IAAI,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;AAEnE,wCAAwC;AACxC,MAAM,MAAM,YAAY,CAAC,CAAC,GAAG,OAAO,IAAI,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;AAEnE,0DAA0D;AAC1D,MAAM,MAAM,mBAAmB,CAAC,CAAC,GAAG,OAAO,IAAI,cAAc,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;AAEjF,8CAA8C;AAC9C,MAAM,MAAM,aAAa,CAAC,CAAC,GAAG,OAAO,IAAI,cAAc,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAErE;;;GAGG;AACH,wBAAgB,KAAK,CAAC,CAAC,EAAE,CAAC,SAAS,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,CAEnF;AAED;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,YAAY,GAAG,OAAO,GAAG,OAAO,GAAG,cAAc,GAAG,QAAQ,CAAC;AAMzG;;GAEG;AACH,MAAM,WAAW,aAAa,CAAC,CAAC,GAAG,OAAO;IACxC,uBAAuB;IACvB,KAAK,EAAE,CAAC,CAAC;IAET,4CAA4C;IAC5C,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAEzB,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;IAElB,sCAAsC;IACtC,SAAS,EAAE,MAAM,CAAC;IAElB,yCAAyC;IACzC,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,0BAA0B;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;gCAO9B,CAAC;AAMH;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,8DAA8D;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,sCAAsC;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;;;;;;;;OAUG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAE1B;;;;;;;;;;;OAWG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAE5B,+BAA+B;IAC/B,UAAU,CAAC,EAAE;QACX,oDAAoD;QACpD,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB;;;WAGG;QACH,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;IAEF,8BAA8B;IAC9B,KAAK,CAAC,EAAE;QACN,sDAAsD;QACtD,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,6CAA6C;QAC7C,aAAa,CAAC,EAAE,aAAa,EAAE,CAAC;QAChC,uCAAuC;QACvC,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,2BAA4B,SAAQ,yBAAyB;IAC5E,IAAI,EAAE,QAAQ,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,0BAA2B,SAAQ,yBAAyB;IAC3E,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,EAAE,CAAC,EAAE,MAAM,CAAC;KACb,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,gCAAiC,SAAQ,yBAAyB;IACjF,IAAI,EAAE,cAAc,CAAC;IACrB,MAAM,EAAE,WAAW,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,6BAA8B,SAAQ,yBAAyB;IAC9E,IAAI,EAAE,WAAW,CAAC;IAClB,0DAA0D;IAC1D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,MAAM,WAAW,gCAAiC,SAAQ,yBAAyB;IACjF,IAAI,EAAE,cAAc,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAC7B,2BAA2B,GAC3B,0BAA0B,GAC1B,gCAAgC,GAChC,6BAA6B,GAC7B,gCAAgC,CAAC;AAErC;;GAEG;AACH,MAAM,MAAM,0BAA0B,GAAG,OAAO,CAAC,qBAAqB,CAAC,GAAG;IACxE,IAAI,CAAC,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC;CACtC,CAAC;AAMF;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,wCAAwC;IACxC,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,8BAA8B;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB,0BAA0B;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB,CAAC,CAAC,GAAG,OAAO;IAC7C,wCAAwC;IACxC,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,yCAAyC;IACzC,YAAY,CAAC,EAAE,CAAC,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,wCAAwC;IACxC,KAAK,CAAC,EAAE,aAAa,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,wCAAwC;IACxC,KAAK,CAAC,EAAE,aAAa,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,wCAAwC;IACxC,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB"}