@havesomecode/kibana-mcp-server 1.3.1 → 1.4.0

package/dist/src/setup/bootstrap.d.ts

@@ -0,0 +1,50 @@
+import { sourceCatalogSchema } from "../config/environment.js";
+import { type ProfilePaths } from "../profiles/paths.js";
+import { type SecretStore } from "../profiles/secret_store.js";
+import { ProfileStore } from "../profiles/store.js";
+import type { KibanaConnectionConfig, SourceDefinition, SourceFieldDescriptor } from "../types.js";
+import { type ClientRegistrar } from "./client_registration.js";
+export type BootstrapClient = "codex" | "none";
+export interface BootstrapOptions {
+    profileName: string;
+    baseUrl: string;
+    username: string;
+    password: string;
+    client: BootstrapClient;
+    makeDefault: boolean;
+    timeoutMs?: number;
+    mcpName?: string;
+    packageSpecifier?: string;
+    replaceExisting?: boolean;
+}
+export interface BootstrapResult {
+    profileName: string;
+    profileId: string;
+    sourceCount: number;
+    sourceCatalogPath: string;
+    client: BootstrapClient;
+    registered: boolean;
+    verified: boolean;
+}
+export interface BootstrapVerifier {
+    verify(connection: KibanaConnectionConfig): Promise<void>;
+}
+interface BootstrapDependencies {
+    paths?: ProfilePaths;
+    profileStore?: ProfileStore;
+    secretStore?: SecretStore;
+    verifier?: BootstrapVerifier;
+    clientRegistrar?: ClientRegistrar;
+}
+interface GeneratedSourceFields {
+    timeField: string;
+    defaultTextFields: string[];
+    evidenceFields: string[];
+}
+export declare function buildGeneratedSource(rawIndexes: string[], sourceName?: string, sourceId?: string): SourceDefinition;
+export declare function chooseGeneratedSourceFields(fields: SourceFieldDescriptor[], explicitTimeField?: string): GeneratedSourceFields;
+export declare function runBootstrap(rawOptions: BootstrapOptions, dependencies?: BootstrapDependencies): Promise<BootstrapResult>;
+export declare function resolveCurrentPackageSpecifier(): Promise<string>;
+export declare function createGeneratedCatalog(sourceOrSources: SourceDefinition | SourceDefinition[]): ReturnType<typeof sourceCatalogSchema.parse>;
+export declare function parseGeneratedCatalog(content: string): ReturnType<typeof sourceCatalogSchema.parse> | undefined;
+export {};

package/dist/src/{bootstrap.js → setup/bootstrap.js}

@@ -1,14 +1,15 @@
-import { createHash, randomUUID } from "node:crypto";
-import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { createHash } from "node:crypto";
+import { rm } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
+import { sourceCatalogSchema, sourceDefinitionSchema } from "../config/environment.js";
+import { KibanaClient } from "../kibana/client.js";
+import { resolveProfilePaths } from "../profiles/paths.js";
+import { SecretStoreError, createSecretStore } from "../profiles/secret_store.js";
+import { acquireStateLock } from "../profiles/state_lock.js";
+import { ProfileStore, deriveProfileId } from "../profiles/store.js";
+import { readOptionalFile, writeTextAtomically } from "../utils/fs.js";
 import { CodexClientRegistrar } from "./client_registration.js";
-import { sourceCatalogSchema, sourceDefinitionSchema } from "./config.js";
-import { KibanaClient } from "./kibana_client.js";
-import { resolveProfilePaths } from "./profile_paths.js";
-import { ProfileStore, deriveProfileId } from "./profile_store.js";
-import { SecretStoreError, createSecretStore } from "./secret_store.js";
-import { acquireStateLock } from "./state_lock.js";
 const DEFAULT_TIMEOUT_MS = 10000;
 const DEFAULT_MCP_NAME = "kibana-log-investigation";
 const KNOWN_ENDPOINT_PATHS = [
@@ -244,8 +245,8 @@ function normalizeOptions(options) {
 export async function resolveCurrentPackageSpecifier() {
     const moduleDirectory = dirname(fileURLToPath(import.meta.url));
     const candidates = [
-        join(moduleDirectory, "..", "package.json"),
         join(moduleDirectory, "..", "..", "package.json"),
+        join(moduleDirectory, "..", "..", "..", "package.json"),
     ];
     for (const candidate of candidates) {
         const content = await readOptionalFile(candidate);
@@ -359,33 +360,9 @@ function normalizeBaseUrl(rawValue) {
     }
     return parsed.toString().replace(/\/+$/, "");
 }
-async function readOptionalFile(path) {
-    try {
-        return await readFile(path, "utf8");
-    }
-    catch (error) {
-        if (isMissingFileError(error))
-            return undefined;
-        throw error;
-    }
-}
 async function writeJsonAtomically(path, value) {
     await writeTextAtomically(path, `${JSON.stringify(value, null, 2)}\n`);
 }
-async function writeTextAtomically(path, content) {
-    const temporaryPath = `${path}.${process.pid}.${randomUUID()}.tmp`;
-    await mkdir(dirname(path), { recursive: true });
-    try {
-        await writeFile(temporaryPath, content, {
-            encoding: "utf8",
-            mode: 0o600,
-        });
-        await rename(temporaryPath, path);
-    }
-    finally {
-        await rm(temporaryPath, { force: true }).catch(() => { });
-    }
-}
 async function restoreFile(path, previousContent) {
     if (previousContent === undefined) {
         await rm(path, { force: true });
@@ -400,9 +377,6 @@ async function restoreSecret(secretStore, profileId, previousSecret) {
     }
     await secretStore.delete(profileId);
 }
-function isMissingFileError(error) {
-    return Boolean(error && typeof error === "object" && "code" in error && error.code === "ENOENT");
-}
 function formatIndex(index) {
     if (!index)
         return "unknown";

package/dist/src/setup/client_registration.d.ts

@@ -0,0 +1,38 @@
+export interface CommandResult {
+    stdout: string;
+    stderr: string;
+    exitCode: number;
+}
+export type CommandRunner = (command: string, args: string[]) => Promise<CommandResult>;
+export interface ClientRegistrationPreflight {
+    alreadyRegistered: boolean;
+}
+export interface ClientRegistrationResult {
+    added: boolean;
+}
+export interface ClientRegistrar {
+    preflight(): Promise<ClientRegistrationPreflight>;
+    register(): Promise<ClientRegistrationResult>;
+    rollback(): Promise<void>;
+}
+export interface CodexRegistrationOptions {
+    mcpName: string;
+    profileName: string;
+    packageSpecifier: string;
+}
+export declare function deriveCodexRegistrationName(options: CodexRegistrationOptions): string;
+export declare class CodexClientRegistrar implements ClientRegistrar {
+    private readonly options;
+    private readonly runner;
+    private preflightResult;
+    private rollbackEligible;
+    constructor(options: CodexRegistrationOptions, runner?: CommandRunner);
+    private get registrationName();
+    preflight(): Promise<ClientRegistrationPreflight>;
+    register(): Promise<ClientRegistrationResult>;
+    private reconcileAmbiguousAdd;
+    rollback(): Promise<void>;
+    private expectedCommand;
+    private matchesExpectedTransport;
+    private readRegistration;
+}

package/dist/src/setup/setup_flow.d.ts

@@ -0,0 +1,26 @@
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { type ProfilePaths } from "../profiles/paths.js";
+import { type SecretStore } from "../profiles/secret_store.js";
+import { ProfileStore } from "../profiles/store.js";
+export interface SetupPrompter {
+    info(message: string): void | Promise<void>;
+    prompt(message: string, options?: {
+        defaultValue?: string;
+        secret?: boolean;
+    }): Promise<string>;
+    confirm(message: string, defaultValue?: boolean): Promise<boolean>;
+}
+export interface SetupFlowResult {
+    defaultProfileName: string;
+    profiles: string[];
+    sourceCatalogPaths: string[];
+}
+export declare function runSetupFlow(prompter: SetupPrompter, dependencies?: {
+    profileStore?: ProfileStore;
+    secretStore?: SecretStore;
+    cwd?: string;
+    paths?: ProfilePaths;
+    readFile?: typeof readFile;
+    writeFile?: typeof writeFile;
+    mkdir?: typeof mkdir;
+}): Promise<SetupFlowResult>;

package/dist/src/{setup_flow.js → setup/setup_flow.js}

@@ -1,11 +1,11 @@
 import { access, mkdir, readFile, writeFile } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import { sourceCatalogSchema } from "./config.js";
-import { resolveProfilePaths } from "./profile_paths.js";
-import { ProfileStore, deriveProfileId } from "./profile_store.js";
-import { SecretStoreError, createSecretStore } from "./secret_store.js";
-import { acquireStateLock } from "./state_lock.js";
+import { sourceCatalogSchema } from "../config/environment.js";
+import { resolveProfilePaths } from "../profiles/paths.js";
+import { SecretStoreError, createSecretStore } from "../profiles/secret_store.js";
+import { acquireStateLock } from "../profiles/state_lock.js";
+import { ProfileStore, deriveProfileId } from "../profiles/store.js";
 const DEFAULT_TIMEOUT_MS = 10000;
 const KNOWN_ENDPOINT_PATHS = [
     "/internal/search/es",
@@ -158,8 +158,8 @@ async function copyValidatedSourceCatalog(importPath, destinationPath, io) {
 }
 async function resolveBundledSourceCatalogPath() {
     const candidates = [
-        new URL("../config/sources.example.json", import.meta.url),
         new URL("../../config/sources.example.json", import.meta.url),
+        new URL("../../../config/sources.example.json", import.meta.url),
     ].map((candidate) => fileURLToPath(candidate));
     for (const candidate of candidates) {
         try {

package/dist/src/stores/catalog_store.d.ts

@@ -0,0 +1,38 @@
+export declare class CatalogConflictError extends Error {
+    constructor(location: string);
+}
+/**
+ * Storage of the serialized source catalogs, one per profile. Implement it to keep catalogs
+ * anywhere (a database, a key-value store, an object bucket) and register it in the configuration
+ * file.
+ *
+ * `profileKey` is a filesystem-safe identifier derived from the profile name: lowercase letters,
+ * digits and dashes only.
+ */
+export interface CatalogStore {
+    /** Returns the serialized catalog of the profile, or `undefined` when it has none yet. */
+    read(profileKey: string): Promise<string | undefined>;
+    /**
+     * Replaces the catalog of the profile. `expected` is the content the caller read before
+     * computing `next` (`undefined` when there was none): a store shared by several processes should
+     * write only if it still holds `expected`, and throw {@link CatalogConflictError} otherwise.
+     * When supplied, `signal` must be checked after any wait and before issuing the write.
+     * Cancellation after the write starts does not roll back a committed catalog.
+     */
+    replace(profileKey: string, expected: string | undefined, next: string, signal?: AbortSignal): Promise<void>;
+    /** Human-readable location of a catalog, reported by tools. Must not expose credentials. */
+    describe?(profileKey: string): string;
+    /** Releases the resources held by the store when the server stops. */
+    close?(): Promise<void>;
+}
+/** A {@link CatalogStore} bound to one profile. */
+export interface CatalogHandle {
+    location: string;
+    read(): Promise<string | undefined>;
+    replace(expected: string | undefined, next: string, signal?: AbortSignal): Promise<void>;
+}
+/**
+ * Binds a store to one profile. The key handed to the store is derived here, so that no caller
+ * can reach a store with a name that is unsafe as a path or key.
+ */
+export declare function bindCatalogStore(store: CatalogStore, profileName: string): CatalogHandle;

package/dist/src/stores/catalog_store.js

@@ -0,0 +1,22 @@
+import { toProfileKey } from "../profiles/names.js";
+export class CatalogConflictError extends Error {
+    constructor(location) {
+        super(`Source catalog '${location}' changed concurrently. Retry the operation.`);
+        this.name = "CatalogConflictError";
+    }
+}
+/**
+ * Binds a store to one profile. The key handed to the store is derived here, so that no caller
+ * can reach a store with a name that is unsafe as a path or key.
+ */
+export function bindCatalogStore(store, profileName) {
+    const profileKey = toProfileKey(profileName);
+    return {
+        location: store.describe?.(profileKey) ?? profileKey,
+        read: () => store.read(profileKey),
+        replace: async (expected, next, signal) => {
+            signal?.throwIfAborted();
+            await store.replace(profileKey, expected, next, signal);
+        },
+    };
+}

package/dist/src/stores/file.d.ts

@@ -0,0 +1,5 @@
+import { type CatalogStore } from "./catalog_store.js";
+/**
+ * Catalog store keeping one file per profile, at the path `resolvePath` gives for its key.
+ */
+export declare function createFileCatalogStore(resolvePath: (profileKey: string) => string, stateRoot?: string): CatalogStore;

package/dist/src/stores/file.js

@@ -0,0 +1,48 @@
+import { createHash } from "node:crypto";
+import { mkdir, realpath } from "node:fs/promises";
+import { basename, dirname, join } from "node:path";
+import { resolveProfilePaths } from "../profiles/paths.js";
+import { acquireStateLock } from "../profiles/state_lock.js";
+import { isMissingFileError, readOptionalFile, writeTextAtomically } from "../utils/fs.js";
+import { CatalogConflictError } from "./catalog_store.js";
+/**
+ * Catalog store keeping one file per profile, at the path `resolvePath` gives for its key.
+ */
+export function createFileCatalogStore(resolvePath, stateRoot = resolveProfilePaths().stateRoot) {
+    return {
+        read: (profileKey) => readOptionalFile(resolvePath(profileKey)),
+        describe: resolvePath,
+        async replace(profileKey, expected, next, signal) {
+            const path = resolvePath(profileKey);
+            // Keep bootstrap's machine-state coordination, then lock the actual catalog independently
+            // of that root. All file-store writers acquire these locks in the same order.
+            const releaseLock = await acquireStateLock(stateRoot, { signal });
+            try {
+                await mkdir(dirname(path), { recursive: true });
+                const canonicalPath = await realpath(path).catch(async (error) => {
+                    if (!isMissingFileError(error))
+                        throw error;
+                    return join(await realpath(dirname(path)), basename(path));
+                });
+                const digest = createHash("sha256").update(canonicalPath).digest("hex");
+                const releaseCatalogLock = await acquireStateLock(dirname(canonicalPath), {
+                    lockName: `.catalog-${digest}.lock`,
+                    signal,
+                });
+                try {
+                    if ((await readOptionalFile(canonicalPath)) !== expected) {
+                        throw new CatalogConflictError(path);
+                    }
+                    signal?.throwIfAborted();
+                    await writeTextAtomically(canonicalPath, next);
+                }
+                finally {
+                    await releaseCatalogLock();
+                }
+            }
+            finally {
+                await releaseLock();
+            }
+        },
+    };
+}

package/dist/src/stores/ioredis.d.ts

@@ -0,0 +1,21 @@
+import type { CatalogStore } from "./catalog_store.js";
+export interface IoredisCatalogStoreOptions {
+    /** `redis://` or `rediss://` URL. Defaults to `KIBANA_STORE_URL`, then `REDIS_URL`. */
+    url?: string;
+    /** Prefix of the catalog keys. Defaults to `kibana-mcp:catalog:`. */
+    keyPrefix?: string;
+    /** An `ioredis` client (standalone, Sentinel or Cluster) to use instead of `url`. The store never closes it. */
+    client?: IoredisCatalogClient;
+}
+/** The subset of the `ioredis` client this store relies on. */
+export interface IoredisCatalogClient {
+    get(key: string): Promise<string | null>;
+    eval(script: string, numberOfKeys: number, ...keysAndArguments: string[]): Promise<unknown>;
+}
+/**
+ * Catalog store backed by Redis through the `ioredis` package: one key per profile, without
+ * expiry. Use a Redis with persistence and a `noeviction` policy, catalogs are not a cache.
+ *
+ * Usable directly as `store` in the configuration file; its options come from `storeOptions`.
+ */
+export default function ioredisCatalogStore(options?: IoredisCatalogStoreOptions): Promise<CatalogStore>;

package/dist/src/stores/ioredis.js

@@ -0,0 +1,33 @@
+import { DEFAULT_KEY_PREFIX, REDIS_COMPARE_AND_SET_SCRIPT, createKeyValueCatalogStore, describeStoreUrl, importDriver, resolveStoreUrl, } from "./shared.js";
+/**
+ * Catalog store backed by Redis through the `ioredis` package: one key per profile, without
+ * expiry. Use a Redis with persistence and a `noeviction` policy, catalogs are not a cache.
+ *
+ * Usable directly as `store` in the configuration file; its options come from `storeOptions`.
+ */
+export default async function ioredisCatalogStore(options = {}) {
+    let client = options.client;
+    let label = "redis:";
+    let close;
+    if (!client) {
+        const url = resolveStoreUrl("ioredis", options.url, ["REDIS_URL"], ["redis:", "rediss:"]);
+        const { Redis } = await importDriver("ioredis", "ioredis");
+        const owned = new Redis(url.href, { lazyConnect: true });
+        // Without a listener, a connection error would be reported as an unhandled error event.
+        owned.on("error", () => { });
+        await owned.connect();
+        client = owned;
+        label = describeStoreUrl(url);
+        close = async () => {
+            await owned.quit();
+        };
+    }
+    const connected = client;
+    return createKeyValueCatalogStore({
+        label,
+        keyPrefix: options.keyPrefix ?? DEFAULT_KEY_PREFIX,
+        get: (key) => connected.get(key),
+        compareAndSet: (key, values) => connected.eval(REDIS_COMPARE_AND_SET_SCRIPT, 1, key, ...values),
+        close,
+    });
+}

package/dist/src/stores/mongodb.d.ts

@@ -0,0 +1,42 @@
+import { type CatalogStore } from "./catalog_store.js";
+export interface MongodbCatalogStoreOptions {
+    /** `mongodb://` or `mongodb+srv://` URL. Defaults to `KIBANA_STORE_URL`, then `MONGODB_URI`, then `MONGO_URL`. */
+    url?: string;
+    /** Database name. Defaults to the database of the URL. */
+    database?: string;
+    /** Collection name. Defaults to `kibana_mcp_catalogs`. */
+    collectionName?: string;
+    /** A `mongodb` collection to use instead of `url`. The store never closes its client. */
+    collection?: MongodbCatalogCollection;
+}
+export interface MongodbCatalogDocument {
+    _id: string;
+    content: string;
+    updatedAt: Date;
+}
+/** The subset of a `mongodb` collection this store relies on. */
+export interface MongodbCatalogCollection {
+    findOne(filter: {
+        _id: string;
+    }): Promise<{
+        content?: unknown;
+    } | null>;
+    insertOne(document: MongodbCatalogDocument): Promise<unknown>;
+    updateOne(filter: {
+        _id: string;
+        content: string;
+    }, update: {
+        $set: {
+            content: string;
+            updatedAt: Date;
+        };
+    }): Promise<{
+        matchedCount: number;
+    }>;
+}
+/**
+ * Catalog store backed by MongoDB through the `mongodb` package: one document per profile.
+ *
+ * Usable directly as `store` in the configuration file; its options come from `storeOptions`.
+ */
+export default function mongodbCatalogStore(options?: MongodbCatalogStoreOptions): Promise<CatalogStore>;

package/dist/src/stores/mongodb.js

@@ -0,0 +1,57 @@
+import { CatalogConflictError } from "./catalog_store.js";
+import { DEFAULT_TABLE_NAME, importDriver, resolveStoreConnectionString } from "./shared.js";
+const DUPLICATE_KEY_ERROR_CODE = 11000;
+/**
+ * Catalog store backed by MongoDB through the `mongodb` package: one document per profile.
+ *
+ * Usable directly as `store` in the configuration file; its options come from `storeOptions`.
+ */
+export default async function mongodbCatalogStore(options = {}) {
+    const collectionName = options.collectionName ?? DEFAULT_TABLE_NAME;
+    let collection = options.collection;
+    let label = "mongodb:";
+    let close;
+    if (!collection) {
+        const url = resolveStoreConnectionString("MongoDB", options.url, ["MONGODB_URI", "MONGO_URL"], ["mongodb:", "mongodb+srv:"]);
+        const { MongoClient } = await importDriver("MongoDB", "mongodb");
+        // MongoDB's driver accepts seed lists and SRV URIs that WHATWG URL cannot parse.
+        const client = new MongoClient(url);
+        await client.connect();
+        collection = client.db(options.database).collection(collectionName);
+        label = url
+            .split(/[?#]/, 1)[0]
+            .replace(/(\/\/)[^/]*@/, "$1")
+            .replace(/\/$/, "");
+        close = () => client.close();
+    }
+    const catalogs = collection;
+    const describe = (profileKey) => `${label}/${collectionName}/${profileKey}`;
+    return {
+        describe,
+        async read(profileKey) {
+            const document = await catalogs.findOne({ _id: profileKey });
+            return typeof document?.content === "string" ? document.content : undefined;
+        },
+        async replace(profileKey, expected, next, signal) {
+            signal?.throwIfAborted();
+            const updatedAt = new Date();
+            if (expected === undefined) {
+                try {
+                    await catalogs.insertOne({ _id: profileKey, content: next, updatedAt });
+                }
+                catch (error) {
+                    if (error?.code === DUPLICATE_KEY_ERROR_CODE) {
+                        throw new CatalogConflictError(describe(profileKey));
+                    }
+                    throw error;
+                }
+                return;
+            }
+            const { matchedCount } = await catalogs.updateOne({ _id: profileKey, content: expected }, { $set: { content: next, updatedAt } });
+            if (matchedCount !== 1) {
+                throw new CatalogConflictError(describe(profileKey));
+            }
+        },
+        close,
+    };
+}

package/dist/src/stores/postgres.d.ts

@@ -0,0 +1,24 @@
+import { type CatalogStore } from "./catalog_store.js";
+export interface PostgresCatalogStoreOptions {
+    /** `postgres://` or `postgresql://` URL. Defaults to `KIBANA_STORE_URL`, then `DATABASE_URL`. */
+    url?: string;
+    /** Catalog table, optionally schema-qualified. Defaults to `kibana_mcp_catalogs`. */
+    table?: string;
+    /** Set to `false` when the table is created by your own migrations. */
+    createTable?: boolean;
+    /** A `pg` Pool or Client to use instead of `url`. The store never closes it. */
+    client?: PostgresCatalogClient;
+}
+/** The subset of a `pg` Pool or Client this store relies on. */
+export interface PostgresCatalogClient {
+    query(text: string, values?: unknown[]): Promise<{
+        rows: Array<Record<string, unknown>>;
+        rowCount?: number | null;
+    }>;
+}
+/**
+ * Catalog store backed by PostgreSQL through the `pg` package: one row per profile.
+ *
+ * Usable directly as `store` in the configuration file; its options come from `storeOptions`.
+ */
+export default function postgresCatalogStore(options?: PostgresCatalogStoreOptions): Promise<CatalogStore>;

package/dist/src/stores/postgres.js

@@ -0,0 +1,65 @@
+import { CatalogConflictError } from "./catalog_store.js";
+import { DEFAULT_TABLE_NAME, describeStoreUrl, importDriver, quoteSqlIdentifier, resolveStoreUrl, } from "./shared.js";
+/**
+ * Catalog store backed by PostgreSQL through the `pg` package: one row per profile.
+ *
+ * Usable directly as `store` in the configuration file; its options come from `storeOptions`.
+ */
+export default async function postgresCatalogStore(options = {}) {
+    const tableName = options.table ?? DEFAULT_TABLE_NAME;
+    const table = quoteSqlIdentifier(tableName);
+    let client = options.client;
+    let label = "postgres:";
+    let close;
+    if (!client) {
+        const url = resolveStoreUrl("PostgreSQL", options.url, ["DATABASE_URL"], ["postgres:", "postgresql:"]);
+        const pg = await importDriver("PostgreSQL", "pg");
+        const Pool = pg.Pool ?? pg.default?.Pool;
+        if (!Pool) {
+            throw new Error("The installed 'pg' package does not expose Pool.");
+        }
+        const pool = new Pool({ connectionString: url.href });
+        // Without a listener, an error on an idle connection would crash the process.
+        pool.on("error", () => { });
+        client = pool;
+        label = describeStoreUrl(url);
+        close = () => pool.end();
+    }
+    const database = client;
+    try {
+        if (options.createTable ?? true) {
+            await database.query(`CREATE TABLE IF NOT EXISTS ${table} (
+          profile_key TEXT PRIMARY KEY,
+          content TEXT NOT NULL,
+          updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+        )`);
+        }
+    }
+    catch (error) {
+        await close?.().catch(() => { });
+        throw error;
+    }
+    const describe = (profileKey) => `${label}/${tableName}/${profileKey}`;
+    return {
+        describe,
+        async read(profileKey) {
+            const { rows } = await database.query(`SELECT content FROM ${table} WHERE profile_key = $1`, [
+                profileKey,
+            ]);
+            const content = rows[0]?.content;
+            return typeof content === "string" ? content : undefined;
+        },
+        async replace(profileKey, expected, next, signal) {
+            signal?.throwIfAborted();
+            const { rowCount } = expected === undefined
+                ? await database.query(`INSERT INTO ${table} (profile_key, content) VALUES ($1, $2)
+               ON CONFLICT (profile_key) DO NOTHING`, [profileKey, next])
+                : await database.query(`UPDATE ${table} SET content = $3, updated_at = now()
+               WHERE profile_key = $1 AND content = $2`, [profileKey, expected, next]);
+            if (rowCount !== 1) {
+                throw new CatalogConflictError(describe(profileKey));
+            }
+        },
+        close,
+    };
+}

package/dist/src/stores/redis.d.ts

@@ -0,0 +1,24 @@
+import type { CatalogStore } from "./catalog_store.js";
+export interface RedisCatalogStoreOptions {
+    /** `redis://` or `rediss://` URL. Defaults to `KIBANA_STORE_URL`, then `REDIS_URL`. */
+    url?: string;
+    /** Prefix of the catalog keys. Defaults to `kibana-mcp:catalog:`. */
+    keyPrefix?: string;
+    /** A connected `redis` client to use instead of `url`. The store never closes it. */
+    client?: RedisCatalogClient;
+}
+/** The subset of the `redis` client this store relies on. */
+export interface RedisCatalogClient {
+    get(key: string): Promise<string | null>;
+    eval(script: string, options: {
+        keys: string[];
+        arguments: string[];
+    }): Promise<unknown>;
+}
+/**
+ * Catalog store backed by Redis through the `redis` package: one key per profile, without expiry.
+ * Use a Redis with persistence and a `noeviction` policy, catalogs are not a cache.
+ *
+ * Usable directly as `store` in the configuration file; its options come from `storeOptions`.
+ */
+export default function redisCatalogStore(options?: RedisCatalogStoreOptions): Promise<CatalogStore>;

package/dist/src/stores/redis.js

@@ -0,0 +1,31 @@
+import { DEFAULT_KEY_PREFIX, REDIS_COMPARE_AND_SET_SCRIPT, createKeyValueCatalogStore, describeStoreUrl, importDriver, resolveStoreUrl, } from "./shared.js";
+/**
+ * Catalog store backed by Redis through the `redis` package: one key per profile, without expiry.
+ * Use a Redis with persistence and a `noeviction` policy, catalogs are not a cache.
+ *
+ * Usable directly as `store` in the configuration file; its options come from `storeOptions`.
+ */
+export default async function redisCatalogStore(options = {}) {
+    let client = options.client;
+    let label = "redis:";
+    let close;
+    if (!client) {
+        const url = resolveStoreUrl("Redis", options.url, ["REDIS_URL"], ["redis:", "rediss:"]);
+        const redis = await importDriver("Redis", "redis");
+        const owned = redis.createClient({ url: url.href });
+        // Without a listener, a connection error would crash the process instead of failing the call.
+        owned.on("error", () => { });
+        await owned.connect();
+        client = owned;
+        label = describeStoreUrl(url);
+        close = () => owned.close();
+    }
+    const connected = client;
+    return createKeyValueCatalogStore({
+        label,
+        keyPrefix: options.keyPrefix ?? DEFAULT_KEY_PREFIX,
+        get: (key) => connected.get(key),
+        compareAndSet: (key, values) => connected.eval(REDIS_COMPARE_AND_SET_SCRIPT, { keys: [key], arguments: values }),
+        close,
+    });
+}