@kwonye/mcpx 0.1.105 → 0.1.106

package/dist/chunk-8v13hqrp.js

@@ -0,0 +1,825 @@
+import {
+  lockOwnerAlive
+} from "./chunk-chaj8a8b.js";
+import {
+  exports_external
+} from "./chunk-p7yzyt87.js";
+import {
+  ensureParentDir,
+  getConfigPath,
+  getGatewayTokenPath,
+  getSecretsKeyPath,
+  getSecretsStorePath,
+  readJsonFile,
+  writeJsonAtomic
+} from "./chunk-grkz21sq.js";
+import {
+  isServerEnabled,
+  normalizeServerSpecEnabled
+} from "./chunk-bjw71y54.js";
+
+// src/core/registry.ts
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+function validateServerName(name) {
+  if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,62}$/.test(name)) {
+    throw new Error("Invalid server name. Use 1-63 chars: letters, numbers, '.', '-', '_' and start with alphanumeric.");
+  }
+}
+function addServer(config, name, spec, force = false) {
+  validateServerName(name);
+  if (config.servers[name] && !force) {
+    throw new Error(`Server "${name}" already exists. Use --force to overwrite.`);
+  }
+  config.servers[name] = normalizeServerSpecEnabled(spec);
+}
+function removeServer(config, name, force = false) {
+  if (!config.servers[name] && !force) {
+    throw new Error(`Server "${name}" does not exist.`);
+  }
+  delete config.servers[name];
+  if (config.projects) {
+    for (const project of Object.values(config.projects)) {
+      if (project.disabledServers) {
+        project.disabledServers = project.disabledServers.filter((s) => s !== name);
+      }
+    }
+  }
+}
+function updateServer(config, name, spec) {
+  validateServerName(name);
+  const existing = config.servers[name];
+  if (!existing) {
+    throw new Error(`Server "${name}" does not exist.`);
+  }
+  const updated = spec.scope === undefined && existing.scope !== undefined ? { ...spec, scope: existing.scope } : spec;
+  config.servers[name] = normalizeServerSpecEnabled(updated);
+}
+function setServerEnabled(config, name, enabled) {
+  const existing = config.servers[name];
+  if (!existing) {
+    throw new Error(`Server "${name}" does not exist.`);
+  }
+  config.servers[name] = {
+    ...existing,
+    enabled
+  };
+}
+function getGatewayTokenSecretName(config) {
+  if (!/^secret:\/\/[A-Za-z0-9._-]+$/.test(config.gateway.tokenRef))
+    throw new Error("Invalid gateway token reference");
+  return config.gateway.tokenRef.slice("secret://".length) || "local_gateway_token";
+}
+function ensureGatewayToken(config, secrets) {
+  const secretName = getGatewayTokenSecretName(config);
+  const tokenPath = getGatewayTokenPath(secretName);
+  const envValue = process.env[`MCPX_SECRET_${secretName}`];
+  if (envValue && envValue.length > 0) {
+    return envValue;
+  }
+  try {
+    const fileValue = fs.readFileSync(tokenPath, "utf8").trim();
+    if (fileValue) {
+      return fileValue;
+    }
+  } catch {}
+  const storeValue = secrets.getSecret(secretName);
+  if (storeValue) {
+    ensureParentDir(tokenPath);
+    fs.writeFileSync(tokenPath, storeValue, { mode: 384 });
+    return storeValue;
+  }
+  const token = crypto.randomBytes(32).toString("base64url");
+  ensureParentDir(tokenPath);
+  fs.writeFileSync(tokenPath, token, { mode: 384 });
+  return token;
+}
+function rotateGatewayToken(config, secrets) {
+  const secretName = getGatewayTokenSecretName(config);
+  const token = crypto.randomBytes(32).toString("base64url");
+  const tokenPath = getGatewayTokenPath(secretName);
+  ensureParentDir(tokenPath);
+  fs.writeFileSync(tokenPath, token, { mode: 384 });
+  secrets.removeSecret(secretName);
+  return token;
+}
+function registerProject(globalConfig, projectPath, name) {
+  if (!globalConfig.projects) {
+    globalConfig.projects = {};
+  }
+  const resolvedPath = path.resolve(projectPath);
+  const projectName = name?.trim() || path.basename(resolvedPath);
+  const existing = globalConfig.projects[resolvedPath];
+  globalConfig.projects[resolvedPath] = {
+    name: projectName,
+    path: resolvedPath,
+    disabledServers: existing?.disabledServers ?? []
+  };
+}
+function unregisterProject(globalConfig, projectPath) {
+  if (globalConfig.projects) {
+    delete globalConfig.projects[path.resolve(projectPath)];
+  }
+}
+function setProjectServerEnabled(globalConfig, projectPath, serverName, enabled) {
+  if (!globalConfig.projects)
+    globalConfig.projects = {};
+  const resolvedPath = path.resolve(projectPath);
+  const project = globalConfig.projects[resolvedPath];
+  if (!project) {
+    throw new Error(`Project "${resolvedPath}" is not registered.`);
+  }
+  const serverSpec = globalConfig.servers[serverName];
+  if (!serverSpec) {
+    throw new Error(`Server "${serverName}" does not exist.`);
+  }
+  if (!project.disabledServers) {
+    project.disabledServers = [];
+  }
+  if (enabled) {
+    project.disabledServers = project.disabledServers.filter((s) => s !== serverName);
+    if (!isServerEnabled(serverSpec)) {
+      return { effective: false, reason: "globally_disabled" };
+    }
+  } else {
+    if (!project.disabledServers.includes(serverName)) {
+      project.disabledServers.push(serverName);
+    }
+  }
+  return { effective: true };
+}
+
+// src/core/managed-index-lock.ts
+import fs2 from "node:fs";
+import path2 from "node:path";
+function withManagedIndexLock(lockPath, fn, timeoutMs = 5000) {
+  fs2.mkdirSync(path2.dirname(lockPath), { recursive: true });
+  const deadline = Date.now() + timeoutMs;
+  while (true) {
+    try {
+      fs2.writeFileSync(lockPath, `${process.pid}
+`, { flag: "wx" });
+      break;
+    } catch {
+      if (!lockOwnerAlive(lockPath)) {
+        try {
+          fs2.unlinkSync(lockPath);
+        } catch {}
+        continue;
+      }
+      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 20);
+      if (Date.now() > deadline) {
+        throw new Error(`Timed out waiting for managed-index lock: ${lockPath}`);
+      }
+    }
+  }
+  try {
+    return fn();
+  } finally {
+    try {
+      fs2.unlinkSync(lockPath);
+    } catch {}
+  }
+}
+
+// src/core/errors.ts
+class UpstreamError extends Error {
+  code;
+  upstream;
+  status;
+  wwwAuthenticate;
+  constructor(upstream, code, message, options) {
+    super(message);
+    this.name = "UpstreamError";
+    this.code = code;
+    this.upstream = upstream;
+    this.status = options?.status;
+    this.wwwAuthenticate = options?.wwwAuthenticate;
+  }
+}
+
+class SecretNotFoundError extends Error {
+  code = "secret_missing";
+  secretName;
+  constructor(secretName) {
+    super(`Secret not found: ${secretName}. Run: mcpx secret set ${secretName}`);
+    this.name = "SecretNotFoundError";
+    this.secretName = secretName;
+  }
+}
+var TIMEOUT_RE = /timed out after \d+ms/;
+var UNREACHABLE_PATTERNS = [
+  /fetch failed/i,
+  /ECONNREFUSED/,
+  /ENOTFOUND/,
+  /EAI_AGAIN/,
+  /socket hang up/,
+  /ENOENT/,
+  /connect econnrefused/i,
+  /unable to connect/i
+];
+var UNREACHABLE_ERROR_CODES = new Set(["ConnectionRefused"]);
+function classifyUpstreamError(upstream, error, wwwAuthenticate) {
+  if (error instanceof UpstreamError)
+    return error;
+  if (error instanceof SecretNotFoundError) {
+    return new UpstreamError(upstream, "secret_missing", error.message);
+  }
+  const message = error instanceof Error ? error.message : String(error);
+  const maybeHttpError = error;
+  const httpStatus = maybeHttpError?.status ?? (typeof maybeHttpError?.code === "number" ? maybeHttpError.code : undefined);
+  if (httpStatus === 401 || httpStatus === 403) {
+    return new UpstreamError(upstream, "auth_required", message, {
+      status: httpStatus,
+      wwwAuthenticate
+    });
+  }
+  if (TIMEOUT_RE.test(message)) {
+    return new UpstreamError(upstream, "timeout", message);
+  }
+  if (typeof maybeHttpError?.code === "string" && UNREACHABLE_ERROR_CODES.has(maybeHttpError.code) || UNREACHABLE_PATTERNS.some((p) => p.test(message))) {
+    return new UpstreamError(upstream, "unreachable", message);
+  }
+  return new UpstreamError(upstream, "upstream_error", message);
+}
+
+// src/core/secrets.ts
+import crypto2 from "node:crypto";
+import fs3 from "node:fs";
+
+// src/core/secret-keychain.ts
+import { spawnSync } from "node:child_process";
+var KEYCHAIN_SERVICE = "com.kwonye.mcpx";
+var KEYCHAIN_ACCOUNT = "secrets";
+var KEYCHAIN_LABEL = "mcpx secrets";
+var SECURITY_INTERACTIVE_MAX_LINE = 4094;
+var MAX_KEYCHAIN_CHUNKS = 256;
+var CHUNK_MANIFEST_PREFIX = "mcpx-keychain-chunks:";
+var keychainPayloadSchema = exports_external.object({
+  v: exports_external.literal(1),
+  secrets: exports_external.record(exports_external.string(), exports_external.string())
+});
+var commandRunner = defaultSecretCommandRunner;
+var platformOverride = null;
+function currentPlatform() {
+  return platformOverride ?? process.platform;
+}
+function defaultSecretCommandRunner(request) {
+  const result = spawnSync(request.command, request.args, {
+    encoding: "utf8",
+    windowsHide: true,
+    ...request.input !== undefined ? { input: request.input } : {}
+  });
+  if (result.error) {
+    const code = result.error.code;
+    if (code === "ENOENT") {
+      return { status: 127, stdout: "", stderr: `${request.command}: not found` };
+    }
+    throw result.error;
+  }
+  return {
+    status: result.status ?? 1,
+    stdout: result.stdout ?? "",
+    stderr: result.stderr ?? ""
+  };
+}
+function keychainUnsupportedReason(platform = currentPlatform()) {
+  if (platform === "darwin" || platform === "linux")
+    return null;
+  return `The keychain backend is not supported on ${platform}. It is available on macOS (Keychain, via the security command) and Linux (libsecret, via secret-tool).`;
+}
+function assertKeychainSupported(platform) {
+  const reason = keychainUnsupportedReason(platform);
+  if (reason)
+    throw new Error(reason);
+}
+function missingToolMessage(command) {
+  if (command === "secret-tool") {
+    return "The keychain backend needs secret-tool from libsecret. Install libsecret-tools (Debian/Ubuntu) or libsecret (Fedora), or run `mcpx secret backend file`.";
+  }
+  if (command === "security") {
+    return "The keychain backend needs the macOS security command, but it was not found on PATH.";
+  }
+  return `The keychain backend could not run "${command}".`;
+}
+function throwIfFailed(result, command) {
+  if (result.status === 0)
+    return;
+  if (result.status === 127)
+    throw new Error(missingToolMessage(command));
+  const detail = result.stderr.trim() || `exited ${result.status}`;
+  throw new Error(`Keychain command failed (${command}): ${detail}`);
+}
+function isNotFound(result, platform) {
+  if (result.status === 0 || result.status === 127)
+    return false;
+  if (platform === "darwin" && result.status === 44)
+    return true;
+  const stderr = result.stderr.toLowerCase();
+  return stderr.includes("could not be found") || stderr.includes("item not found");
+}
+function chunkAccount(index) {
+  return `${KEYCHAIN_ACCOUNT}.${index}`;
+}
+function shellQuote(value) {
+  if (value.length === 0 || /['\\\r\n]/.test(value)) {
+    throw new Error("The keychain secret payload could not be encoded for the security command.");
+  }
+  return `'${value}'`;
+}
+function assertAccountName(account) {
+  if (!/^[A-Za-z0-9.]+$/.test(account)) {
+    throw new Error("Invalid keychain account name.");
+  }
+}
+function darwinAddLine(account, password) {
+  assertAccountName(account);
+  return `add-generic-password -s ${KEYCHAIN_SERVICE} -a ${account} -l ${shellQuote(KEYCHAIN_LABEL)} -U -w ${shellQuote(password)}`;
+}
+function maxDarwinPasswordLength(account) {
+  const overhead = darwinAddLine(account, "x").length - 1;
+  return SECURITY_INTERACTIVE_MAX_LINE - overhead;
+}
+var CHUNK_PASSWORD_LIMIT = maxDarwinPasswordLength(chunkAccount(MAX_KEYCHAIN_CHUNKS));
+function chunkCount(stored) {
+  if (!stored.startsWith(CHUNK_MANIFEST_PREFIX))
+    return null;
+  const raw = stored.slice(CHUNK_MANIFEST_PREFIX.length);
+  if (!/^[1-9]\d*$/.test(raw))
+    return null;
+  const count = Number(raw);
+  if (!Number.isInteger(count) || count < 1 || count > MAX_KEYCHAIN_CHUNKS)
+    return null;
+  return count;
+}
+function splitPayload(payload) {
+  const primaryLimit = maxDarwinPasswordLength(KEYCHAIN_ACCOUNT);
+  if (payload.length <= primaryLimit)
+    return [payload];
+  if (CHUNK_PASSWORD_LIMIT < 1) {
+    throw new Error("The macOS security command cannot accept a keychain password on standard input.");
+  }
+  const chunks = [];
+  for (let offset = 0;offset < payload.length; offset += CHUNK_PASSWORD_LIMIT) {
+    chunks.push(payload.slice(offset, offset + CHUNK_PASSWORD_LIMIT));
+  }
+  if (chunks.length > MAX_KEYCHAIN_CHUNKS) {
+    throw new Error(`The keychain secret payload is too large (${payload.length} characters) to store with the macOS security command.`);
+  }
+  return chunks;
+}
+function encodePayload(secrets) {
+  return Buffer.from(JSON.stringify({ v: 1, secrets }), "utf8").toString("base64");
+}
+function decodePayload(stored) {
+  const trimmed = stored.trim();
+  const unreadable = "The keychain secret payload could not be read. Refusing to change it.";
+  if (!trimmed)
+    throw new Error(unreadable);
+  try {
+    const parsed = JSON.parse(Buffer.from(trimmed, "base64").toString("utf8"));
+    const result = keychainPayloadSchema.safeParse(parsed);
+    if (!result.success)
+      throw new Error(unreadable);
+    return result.data.secrets;
+  } catch (err) {
+    if (err instanceof Error && err.message === unreadable)
+      throw err;
+    throw new Error(unreadable);
+  }
+}
+function run(request) {
+  return commandRunner(request);
+}
+function readDarwinItem(account) {
+  const result = run({
+    command: "security",
+    args: ["find-generic-password", "-s", KEYCHAIN_SERVICE, "-a", account, "-w"]
+  });
+  if (isNotFound(result, "darwin"))
+    return null;
+  throwIfFailed(result, "security");
+  return result.stdout.trim();
+}
+function readDarwinPayload() {
+  const primary = readDarwinItem(KEYCHAIN_ACCOUNT);
+  if (primary === null)
+    return null;
+  const count = chunkCount(primary);
+  if (count === null)
+    return primary;
+  let payload = "";
+  for (let index = 1;index <= count; index++) {
+    const part = readDarwinItem(chunkAccount(index));
+    if (!part)
+      throw new Error("The keychain secret payload could not be read. Refusing to change it.");
+    payload += part;
+  }
+  return payload;
+}
+function runSecurityLine(line) {
+  if (line.includes(`
+`) || line.length > SECURITY_INTERACTIVE_MAX_LINE) {
+    throw new Error("Refusing to send a keychain command that the macOS security tool would truncate.");
+  }
+  const result = run({ command: "security", args: ["-i"], input: `${line}
+` });
+  throwIfFailed(result, "security");
+}
+function deleteDarwinAccount(account) {
+  const result = run({
+    command: "security",
+    args: ["delete-generic-password", "-s", KEYCHAIN_SERVICE, "-a", account]
+  });
+  if (isNotFound(result, "darwin"))
+    return "missing";
+  throwIfFailed(result, "security");
+  return "deleted";
+}
+function deleteExtraChunks(firstIndex) {
+  for (let index = firstIndex;index <= MAX_KEYCHAIN_CHUNKS; index++) {
+    if (deleteDarwinAccount(chunkAccount(index)) === "missing")
+      return;
+  }
+}
+function clearDarwinItems() {
+  deleteDarwinAccount(KEYCHAIN_ACCOUNT);
+  deleteExtraChunks(1);
+}
+function writeDarwinPayload(payload) {
+  const chunks = splitPayload(payload);
+  if (chunks.length === 1) {
+    const only = chunks[0];
+    if (only === undefined)
+      throw new Error("The keychain secret payload could not be encoded for the security command.");
+    runSecurityLine(darwinAddLine(KEYCHAIN_ACCOUNT, only));
+    deleteExtraChunks(1);
+    return;
+  }
+  for (let index = 0;index < chunks.length; index++) {
+    const chunk = chunks[index];
+    if (chunk === undefined)
+      throw new Error("The keychain secret payload could not be encoded for the security command.");
+    runSecurityLine(darwinAddLine(chunkAccount(index + 1), chunk));
+  }
+  runSecurityLine(darwinAddLine(KEYCHAIN_ACCOUNT, `${CHUNK_MANIFEST_PREFIX}${chunks.length}`));
+  deleteExtraChunks(chunks.length + 1);
+}
+function writeDarwinSecrets(payload) {
+  if (payload.length <= maxDarwinPasswordLength(KEYCHAIN_ACCOUNT)) {
+    writeDarwinPayload(payload);
+    return;
+  }
+  const backup = readDarwinPayload();
+  try {
+    writeDarwinPayload(payload);
+  } catch (err) {
+    try {
+      if (backup === null)
+        clearDarwinItems();
+      else
+        writeDarwinPayload(backup);
+    } catch (restoreErr) {
+      const detail = restoreErr instanceof Error ? restoreErr.message : String(restoreErr);
+      throw new Error(`Keychain write failed and the previous keychain copy could not be restored: ${detail}`);
+    }
+    throw err;
+  }
+}
+function readKeychainSecrets() {
+  const platform = currentPlatform();
+  assertKeychainSupported(platform);
+  if (platform === "darwin") {
+    const payload = readDarwinPayload();
+    if (payload === null)
+      return {};
+    return decodePayload(payload);
+  }
+  const result = run({ command: "secret-tool", args: ["lookup", "service", KEYCHAIN_SERVICE, "account", KEYCHAIN_ACCOUNT] });
+  if (isNotFound(result, platform))
+    return {};
+  throwIfFailed(result, "secret-tool");
+  return decodePayload(result.stdout);
+}
+function writeKeychainSecrets(secrets) {
+  if (Object.keys(secrets).length === 0) {
+    clearKeychainSecrets();
+    return;
+  }
+  const platform = currentPlatform();
+  assertKeychainSupported(platform);
+  const payload = encodePayload(secrets);
+  if (platform === "darwin") {
+    writeDarwinSecrets(payload);
+    return;
+  }
+  const result = run({
+    command: "secret-tool",
+    args: ["store", "--label", KEYCHAIN_LABEL, "service", KEYCHAIN_SERVICE, "account", KEYCHAIN_ACCOUNT],
+    input: payload
+  });
+  throwIfFailed(result, "secret-tool");
+}
+function clearKeychainSecrets() {
+  const platform = currentPlatform();
+  assertKeychainSupported(platform);
+  if (platform === "darwin") {
+    clearDarwinItems();
+    return;
+  }
+  const result = run({ command: "secret-tool", args: ["clear", "service", KEYCHAIN_SERVICE, "account", KEYCHAIN_ACCOUNT] });
+  if (result.status === 0 || isNotFound(result, platform))
+    return;
+  throwIfFailed(result, "secret-tool");
+}
+
+// src/core/secrets.ts
+var ALGORITHM = "aes-256-gcm";
+var UNREADABLE_FILE_STORE = "The encrypted credentials store could not be read. Restore its original key or backup before changing credentials. Existing files have been preserved.";
+var SECRET_LOCK_TIMEOUT_MS = 120000;
+var secretsDataSchema = exports_external.object({ secrets: exports_external.record(exports_external.string(), exports_external.string()) });
+var secretBackendSchema = exports_external.object({
+  backend: exports_external.enum(["file", "keychain"]).default("file")
+});
+function describeSecretBackend(backend) {
+  if (backend === "keychain") {
+    return "OS keychain (macOS Keychain via the security command, or Linux libsecret via secret-tool). Secret values are written on the tool's standard input, not as process arguments. The operating system protects the secrets and may prompt for access. A locked session or a missing secret service cannot unlock them, and the background gateway waits while that prompt is open.";
+  }
+  return "AES-256-GCM encrypted file (secrets.json + secrets.key in the data directory). The encryption key sits next to the ciphertext, so other programs running as your user can read these secrets. No system prompts, and it works in headless sessions.";
+}
+function getSecretBackend(configPath = getConfigPath()) {
+  if (!fs3.existsSync(configPath))
+    return "file";
+  let raw;
+  try {
+    raw = JSON.parse(fs3.readFileSync(configPath, "utf8"));
+  } catch {
+    throw new Error(`Config file at ${configPath} is not valid JSON, so the secret backend could not be determined.`);
+  }
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+    throw new Error(`Config file at ${configPath} is not a JSON object, so the secret backend could not be determined.`);
+  }
+  const secrets = raw.secrets;
+  if (secrets === undefined)
+    return "file";
+  const parsed = secretBackendSchema.safeParse(secrets);
+  if (!parsed.success) {
+    throw new Error(`Invalid secrets.backend in ${configPath}. Expected "file" or "keychain".`);
+  }
+  return parsed.data.backend;
+}
+function loadKey(keyPath) {
+  try {
+    const stored = fs3.readFileSync(keyPath, "utf8").trim();
+    return Buffer.from(stored, "base64");
+  } catch (err) {
+    if (err.code !== "ENOENT")
+      throw err;
+  }
+  ensureParentDir(keyPath);
+  const key = crypto2.randomBytes(32);
+  try {
+    fs3.writeFileSync(keyPath, key.toString("base64") + `
+`, { flag: "wx", mode: 384 });
+  } catch (err) {
+    if (err.code === "EEXIST") {
+      const stored = fs3.readFileSync(keyPath, "utf8").trim();
+      return Buffer.from(stored, "base64");
+    }
+    throw err;
+  }
+  return key;
+}
+function readSecretsData(storePath, keyPath) {
+  const envelope = readJsonFile(storePath, null);
+  if (!envelope || envelope.version !== 1 || envelope.algorithm !== ALGORITHM)
+    return null;
+  try {
+    const key = Buffer.from(fs3.readFileSync(keyPath, "utf8").trim(), "base64");
+    const iv = Buffer.from(envelope.iv, "base64");
+    const authTag = Buffer.from(envelope.authTag, "base64");
+    const ciphertext = Buffer.from(envelope.ciphertext, "base64");
+    const decipher = crypto2.createDecipheriv(ALGORITHM, key, iv);
+    decipher.setAuthTag(authTag);
+    const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+    return secretsDataSchema.parse(JSON.parse(decrypted.toString("utf8")));
+  } catch {
+    return null;
+  }
+}
+function buildEnvelope(keyPath, data) {
+  const key = loadKey(keyPath);
+  const iv = crypto2.randomBytes(12);
+  const cipher = crypto2.createCipheriv(ALGORITHM, key, iv);
+  const plaintext = JSON.stringify(data);
+  const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+  return {
+    version: 1,
+    algorithm: ALGORITHM,
+    iv: iv.toString("base64"),
+    authTag: cipher.getAuthTag().toString("base64"),
+    ciphertext: encrypted.toString("base64")
+  };
+}
+function readFileSecretsLoose(storePath, keyPath) {
+  return readSecretsData(storePath, keyPath)?.secrets ?? null;
+}
+function readFileSecretsStrict(storePath, keyPath) {
+  const map = readFileSecretsLoose(storePath, keyPath);
+  if (map === null && fs3.existsSync(storePath)) {
+    throw new Error(UNREADABLE_FILE_STORE);
+  }
+  return map ?? {};
+}
+function writeFileSecrets(storePath, keyPath, secrets) {
+  const envelope = buildEnvelope(keyPath, { secrets });
+  writeJsonAtomic(storePath, envelope);
+}
+function clearFileSecrets(storePath, keyPath) {
+  fs3.rmSync(storePath, { force: true });
+  fs3.rmSync(keyPath, { force: true });
+}
+function readBackendSecrets(backend, storePath, keyPath) {
+  if (backend === "keychain")
+    return readKeychainSecrets();
+  return readFileSecretsStrict(storePath, keyPath);
+}
+function writeBackendSecrets(backend, storePath, keyPath, secrets) {
+  if (backend === "keychain") {
+    writeKeychainSecrets(secrets);
+    return;
+  }
+  writeFileSecrets(storePath, keyPath, secrets);
+}
+function clearBackendSecrets(backend, storePath, keyPath) {
+  if (backend === "keychain") {
+    clearKeychainSecrets();
+    return;
+  }
+  clearFileSecrets(storePath, keyPath);
+}
+function secretsMatch(expected, actual) {
+  const expectedNames = Object.keys(expected);
+  if (expectedNames.length !== Object.keys(actual).length)
+    return false;
+  return expectedNames.every((name) => actual[name] === expected[name]);
+}
+function persistSecretBackend(backend, configPath) {
+  let raw;
+  if (fs3.existsSync(configPath)) {
+    let parsed;
+    try {
+      parsed = JSON.parse(fs3.readFileSync(configPath, "utf8"));
+    } catch {
+      throw new Error(`Config file at ${configPath} is not valid JSON, so the secret backend was not changed.`);
+    }
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+      throw new Error(`Config file at ${configPath} is not a JSON object, so the secret backend was not changed.`);
+    }
+    raw = parsed;
+  } else {
+    raw = {};
+  }
+  const existing = typeof raw.secrets === "object" && raw.secrets !== null && !Array.isArray(raw.secrets) ? raw.secrets : {};
+  raw.secrets = { ...existing, backend };
+  writeJsonAtomic(configPath, raw);
+}
+function switchSecretBackend(target, configPath = getConfigPath()) {
+  if (target !== "file" && target !== "keychain") {
+    throw new Error(`Unknown secret backend "${String(target)}". Use "file" or "keychain".`);
+  }
+  const storePath = getSecretsStorePath();
+  const keyPath = getSecretsKeyPath();
+  return withManagedIndexLock(`${storePath}.lock`, () => {
+    const current = getSecretBackend(configPath);
+    if (current === target) {
+      return { backend: target, changed: false, migrated: [], preserved: [], removedFrom: null };
+    }
+    if (current === "keychain" || target === "keychain") {
+      const reason = keychainUnsupportedReason();
+      if (reason)
+        throw new Error(reason);
+    }
+    const source = readBackendSecrets(current, storePath, keyPath);
+    const destination = readBackendSecrets(target, storePath, keyPath);
+    const merged = { ...destination, ...source };
+    writeBackendSecrets(target, storePath, keyPath, merged);
+    const readBack = readBackendSecrets(target, storePath, keyPath);
+    if (!secretsMatch(merged, readBack)) {
+      try {
+        writeBackendSecrets(target, storePath, keyPath, destination);
+      } catch (restoreErr) {
+        const detail = restoreErr instanceof Error ? restoreErr.message : String(restoreErr);
+        throw new Error(`Migration to ${target} failed verification and the previous ${target} copy could not be restored: ${detail}. The ${current} backend was left unchanged.`);
+      }
+      throw new Error(`Migration to ${target} failed verification. The ${current} backend was left unchanged.`);
+    }
+    persistSecretBackend(target, configPath);
+    try {
+      clearBackendSecrets(current, storePath, keyPath);
+    } catch (err) {
+      const detail = err instanceof Error ? err.message : String(err);
+      throw new Error(`Secret backend is now ${target}, but secrets could not be removed from the ${current} store: ${detail}`);
+    }
+    const preserved = Object.keys(destination).filter((name) => !Object.prototype.hasOwnProperty.call(source, name)).sort();
+    return {
+      backend: target,
+      changed: true,
+      migrated: Object.keys(source).sort(),
+      preserved,
+      removedFrom: current
+    };
+  }, SECRET_LOCK_TIMEOUT_MS);
+}
+function parseSecretRef(ref) {
+  if (!ref.startsWith("secret://"))
+    return null;
+  const name = ref.slice("secret://".length);
+  return name.length > 0 ? name : null;
+}
+
+class SecretsManager {
+  storePath;
+  keyPath;
+  constructor(storePath = getSecretsStorePath(), keyPath = getSecretsKeyPath()) {
+    this.storePath = storePath;
+    this.keyPath = keyPath;
+  }
+  get backend() {
+    return getSecretBackend();
+  }
+  listSecretNames() {
+    if (this.backend === "keychain") {
+      return Object.keys(readKeychainSecrets()).sort();
+    }
+    return Object.keys(readFileSecretsLoose(this.storePath, this.keyPath) ?? {}).sort();
+  }
+  setSecret(name, value) {
+    return withManagedIndexLock(`${this.storePath}.lock`, () => {
+      if (this.backend === "keychain") {
+        const map2 = readKeychainSecrets();
+        map2[name] = value;
+        writeKeychainSecrets(map2);
+        return;
+      }
+      const map = readFileSecretsStrict(this.storePath, this.keyPath);
+      map[name] = value;
+      writeFileSecrets(this.storePath, this.keyPath, map);
+    }, SECRET_LOCK_TIMEOUT_MS);
+  }
+  removeSecret(name) {
+    return withManagedIndexLock(`${this.storePath}.lock`, () => {
+      if (this.backend === "keychain") {
+        const map2 = readKeychainSecrets();
+        if (!(name in map2))
+          return;
+        delete map2[name];
+        writeKeychainSecrets(map2);
+        return;
+      }
+      const map = readFileSecretsStrict(this.storePath, this.keyPath);
+      if (!(name in map))
+        return;
+      delete map[name];
+      writeFileSecrets(this.storePath, this.keyPath, map);
+    }, SECRET_LOCK_TIMEOUT_MS);
+  }
+  getSecret(name) {
+    const envOverride = process.env[`MCPX_SECRET_${name}`];
+    if (envOverride && envOverride.length > 0)
+      return envOverride;
+    if (this.backend === "keychain") {
+      return readKeychainSecrets()[name] ?? null;
+    }
+    return (readFileSecretsLoose(this.storePath, this.keyPath) ?? {})[name] ?? null;
+  }
+  resolveMaybeSecret(value) {
+    const secretName = parseSecretRef(value);
+    if (!secretName)
+      return value;
+    const secret = this.getSecret(secretName);
+    if (!secret)
+      throw new SecretNotFoundError(secretName);
+    return secret;
+  }
+  rotateLocalToken(secretName = "local_gateway_token") {
+    const token = crypto2.randomBytes(32).toString("base64url");
+    this.setSecret(secretName, token);
+    return token;
+  }
+}
+function readSecretValueFromStdin() {
+  if (process.stdin.isTTY) {
+    throw new Error("No value provided. Use --value or pipe a value via stdin.");
+  }
+  const content = fs3.readFileSync(process.stdin.fd, "utf8").trim();
+  if (content.length === 0) {
+    throw new Error("Empty secret value provided.");
+  }
+  return content;
+}
+
+export { withManagedIndexLock, UpstreamError, SecretNotFoundError, classifyUpstreamError, describeSecretBackend, getSecretBackend, switchSecretBackend, SecretsManager, readSecretValueFromStdin, validateServerName, addServer, removeServer, updateServer, setServerEnabled, getGatewayTokenSecretName, ensureGatewayToken, rotateGatewayToken, registerProject, unregisterProject, setProjectServerEnabled };
+
+//# debugId=E4DB165C713155C264756E2164756E21