@martin4455/redmine-mcp-ro 0.3.0

package/dist/config-file.js

@@ -0,0 +1,192 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { positiveInteger, redmineBaseUrl, requestLimits } from './http-client.js';
+import { validateDownloadDir } from './download-directory.js';
+export const CONFIG_FILENAME = '.redmine-mcp';
+export const CREDENTIAL_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+export class ConfigurationError extends Error {
+}
+export function normalizeRedmineUrl(value) {
+    return redmineBaseUrl(value).href.replace(/\/+$/, '');
+}
+export function validateProfileName(value) {
+    if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,63}$/.test(value) || ['constructor', 'prototype'].includes(value)) {
+        throw new ConfigurationError('Profile names must contain 1-64 letters, numbers, dots, underscores or hyphens, starting with a letter or number.');
+    }
+}
+function record(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function keysAre(value, allowed) {
+    return Object.keys(value).every(key => allowed.includes(key));
+}
+export function parseConfig(raw) {
+    // Parser/validation diagnostics must never quote input: it may contain a legacy token.
+    try {
+        const input = JSON.parse(raw);
+        if (!record(input) || !keysAre(input, ['version', 'defaultProfile', 'profiles', 'settings']) ||
+            typeof input.version !== 'string' || !['1.0', '2.0', '3.0'].includes(input.version) || !record(input.profiles))
+            throw new Error();
+        const profiles = Object.create(null);
+        const legacyProfiles = Object.create(null);
+        const references = Object.create(null);
+        let settings;
+        if (input.settings !== undefined) {
+            if (!record(input.settings) || !keysAre(input.settings, ['requestTimeoutMs', 'maxAttachmentBytes', 'maxContentBytes', 'downloadDir']))
+                throw new Error();
+            for (const [name, value] of Object.entries(input.settings)) {
+                if (name === 'downloadDir') {
+                    if (typeof value !== 'string')
+                        throw new Error();
+                    validateDownloadDir(value);
+                    continue;
+                }
+                if (typeof value !== 'number')
+                    throw new Error();
+                positiveInteger(value, name);
+            }
+            settings = { ...input.settings };
+            requestLimits({ url: '', apiKey: '', ...settings });
+        }
+        const ids = new Set();
+        for (const [index, [name, profile]] of Object.entries(input.profiles).entries()) {
+            if (input.version === '3.0')
+                validateProfileName(name);
+            else if (!name)
+                throw new Error();
+            const legacyUrl = (value) => {
+                try {
+                    return normalizeRedmineUrl(value);
+                }
+                catch {
+                    throw new ConfigurationError(`Legacy profile #${index + 1}: URL must be absolute HTTP(S), without credentials, query or fragment. Configuration was not changed.`);
+                }
+            };
+            if (!record(profile))
+                throw new Error();
+            if (input.version === '3.0' || input.version === '2.0') {
+                const allowed = input.version === '3.0' ? ['credentialId'] : ['url', 'credentialId'];
+                if (!keysAre(profile, allowed) || typeof profile.credentialId !== 'string' ||
+                    !CREDENTIAL_ID.test(profile.credentialId) || ids.has(profile.credentialId))
+                    throw new Error();
+                ids.add(profile.credentialId);
+                if (input.version === '3.0')
+                    profiles[name] = { credentialId: profile.credentialId };
+                else {
+                    if (profile.url !== undefined && typeof profile.url !== 'string')
+                        throw new Error();
+                    references[name] = { credentialId: profile.credentialId,
+                        ...(profile.url !== undefined ? { url: legacyUrl(profile.url) } : {}) };
+                }
+            }
+            else {
+                if (!keysAre(profile, ['url', 'apiKey', 'name', 'isDefault']) ||
+                    typeof profile.url !== 'string' || typeof profile.apiKey !== 'string' ||
+                    !profile.apiKey.trim() || /[\r\n\0]/.test(profile.apiKey))
+                    throw new Error();
+                legacyProfiles[name] = { url: legacyUrl(profile.url), apiKey: profile.apiKey.trim() };
+            }
+        }
+        const defaultProfile = input.defaultProfile;
+        const selectedProfiles = input.version === '3.0' ? profiles : input.version === '2.0' ? references : legacyProfiles;
+        if (defaultProfile !== undefined && (typeof defaultProfile !== 'string' || !Object.hasOwn(selectedProfiles, defaultProfile)))
+            throw new Error();
+        const common = { defaultProfile: defaultProfile, ...(settings ? { settings } : {}) };
+        if (input.version === '3.0')
+            return { version: '3.0', ...common, profiles };
+        if (input.version === '2.0')
+            return { version: '2.0', ...common, profiles: references };
+        return { version: '1.0', ...common, profiles: legacyProfiles };
+    }
+    catch (error) {
+        if (error instanceof ConfigurationError)
+            throw error;
+        throw new ConfigurationError('Invalid configuration. Expected version 3.0 with credentialId-only profiles, or a valid version 1.0/2.0 file for migration.');
+    }
+}
+export function readConfig(configPath) {
+    let descriptor;
+    try {
+        let info;
+        try {
+            info = fs.lstatSync(configPath);
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return { raw: null, config: null };
+            throw error;
+        }
+        if (!info.isFile() || info.isSymbolicLink() || info.size > 1024 * 1024)
+            throw new Error();
+        descriptor = fs.openSync(configPath, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0));
+        const opened = fs.fstatSync(descriptor);
+        if (!opened.isFile() || opened.size > 1024 * 1024 || opened.ino !== info.ino || opened.dev !== info.dev)
+            throw new Error();
+        const raw = fs.readFileSync(descriptor, 'utf8');
+        return { raw, config: parseConfig(raw) };
+    }
+    catch (error) {
+        if (error instanceof ConfigurationError)
+            throw error;
+        throw new ConfigurationError('Cannot read configuration. Use a regular file of at most 1 MiB; symlinks are not accepted.');
+    }
+    finally {
+        if (descriptor !== undefined)
+            fs.closeSync(descriptor);
+    }
+}
+export function requireModern(config) {
+    if (config && config.version !== '3.0') {
+        throw new ConfigurationError('This file uses a legacy configuration format. Run redmine-mcp migrate --config-dir <directory> first.');
+    }
+    return config || { version: '3.0', profiles: Object.create(null) };
+}
+/** Atomic replacement; temporary files contain validated, secret-free metadata only. */
+export function writeConfig(configPath, config, expectedRaw) {
+    const validated = parseConfig(JSON.stringify(config));
+    if (validated.version !== '3.0')
+        throw new ConfigurationError('Refusing to write connection data to the configuration file.');
+    const temporary = `${configPath}.tmp-${randomUUID()}`;
+    let descriptor;
+    try {
+        descriptor = fs.openSync(temporary, 'wx', 0o600);
+        fs.writeFileSync(descriptor, `${JSON.stringify(validated, null, 2)}\n`);
+        fs.fsyncSync(descriptor);
+        fs.closeSync(descriptor);
+        descriptor = undefined;
+        if (readConfig(configPath).raw !== expectedRaw) {
+            throw new ConfigurationError('Configuration changed during the operation. Retry using the current file.');
+        }
+        fs.renameSync(temporary, configPath);
+    }
+    catch (error) {
+        if (error instanceof ConfigurationError)
+            throw error;
+        throw new ConfigurationError('Cannot save configuration. Check directory permissions and retry.');
+    }
+    finally {
+        if (descriptor !== undefined)
+            fs.closeSync(descriptor);
+        fs.rmSync(temporary, { force: true });
+    }
+}
+export async function withConfigLock(configPath, action) {
+    let descriptor;
+    try {
+        descriptor = fs.openSync(`${configPath}.lock`, 'wx', 0o600);
+    }
+    catch {
+        throw new ConfigurationError('Cannot lock configuration. Check directory permissions; if no configurator is running, remove the stale .redmine-mcp.lock file.');
+    }
+    try {
+        return await action();
+    }
+    finally {
+        fs.closeSync(descriptor);
+        fs.unlinkSync(`${configPath}.lock`);
+    }
+}
+export function localConfigPath(directory) {
+    return path.join(path.resolve(directory ?? process.env.REDMINE_CONFIG_DIR ?? process.cwd()), CONFIG_FILENAME);
+}

package/dist/config-loader.d.ts

@@ -0,0 +1,14 @@
+import { type ConfigurationOptions } from './local-configuration.js';
+import type { RedmineConfig } from './types.js';
+export interface EffectiveConfig extends RedmineConfig {
+    source: string;
+    profile: string;
+}
+export declare class ConfigLoader {
+    private readonly options;
+    private readonly local;
+    constructor(options?: ConfigurationOptions);
+    /** Exactly one local file; no home-directory, .env or environment-credential fallback. */
+    getConfig(): Promise<EffectiveConfig | null>;
+    private optionalLimit;
+}

package/dist/config-loader.js

@@ -0,0 +1,58 @@
+import { ConfigurationError } from './config-file.js';
+import { LocalConfiguration, readConnection } from './local-configuration.js';
+import { requestLimits } from './http-client.js';
+import { validateDownloadDir } from './download-directory.js';
+export class ConfigLoader {
+    options;
+    local;
+    constructor(options = {}) {
+        this.options = options;
+        this.local = new LocalConfiguration(options);
+    }
+    /** Exactly one local file; no home-directory, .env or environment-credential fallback. */
+    async getConfig() {
+        const limits = {
+            requestTimeoutMs: this.optionalLimit('REDMINE_REQUEST_TIMEOUT_MS'),
+            maxAttachmentBytes: this.optionalLimit('REDMINE_MAX_ATTACHMENT_BYTES'),
+            maxContentBytes: this.optionalLimit('REDMINE_MAX_CONTENT_BYTES'),
+        };
+        try {
+            requestLimits({ url: '', apiKey: '', ...limits });
+        }
+        catch {
+            throw new ConfigurationError('Request limits must be positive safe integers; REDMINE_REQUEST_TIMEOUT_MS must not exceed 2147483647.');
+        }
+        const config = this.local.read();
+        if (!config)
+            return null;
+        const name = this.options.profile ?? process.env.REDMINE_PROFILE ?? config.defaultProfile ?? Object.keys(config.profiles)[0];
+        if (!name || !Object.hasOwn(config.profiles, name)) {
+            throw new ConfigurationError('Selected profile was not found in this local configuration.');
+        }
+        const profile = config.profiles[name];
+        const downloadDir = process.env.REDMINE_DOWNLOAD_DIR ?? config.settings?.downloadDir;
+        if (downloadDir !== undefined) {
+            try {
+                validateDownloadDir(downloadDir);
+            }
+            catch {
+                throw new ConfigurationError('REDMINE_DOWNLOAD_DIR or settings.downloadDir must be an absolute path to a dedicated download directory.');
+            }
+        }
+        const connection = await readConnection(this.local.store, profile);
+        const selectedLimits = {
+            requestTimeoutMs: limits.requestTimeoutMs ?? config.settings?.requestTimeoutMs,
+            maxAttachmentBytes: limits.maxAttachmentBytes ?? config.settings?.maxAttachmentBytes,
+            maxContentBytes: limits.maxContentBytes ?? config.settings?.maxContentBytes,
+        };
+        return { ...selectedLimits, downloadDir, ...connection, source: this.local.configPath, profile: name };
+    }
+    optionalLimit(name) {
+        const value = process.env[name];
+        if (value === undefined)
+            return undefined;
+        if (!/^\d+$/.test(value))
+            throw new ConfigurationError(`${name} must be a positive integer`);
+        return Number(value);
+    }
+}

package/dist/credential-store.d.ts

@@ -0,0 +1,17 @@
+import { ConfigurationError } from './config-file.js';
+import type { CredentialStore } from './types.js';
+export declare const KEYRING_SERVICE = "@martin4455/redmine-mcp-ro";
+export declare const LEGACY_KEYRING_SERVICE = "redmine-mcp-ro";
+export declare class CredentialStoreUnavailableError extends ConfigurationError {
+}
+export declare function validateCredentialSize(value: string, platform?: NodeJS.Platform): void;
+/** Native APIs only: no shell arguments, files, keyutils or plaintext fallback. */
+export declare class SystemCredentialStore implements CredentialStore {
+    private readonly namespace;
+    constructor(namespace?: 'current' | 'legacy');
+    private entry;
+    private unavailable;
+    get(id: string): Promise<string | null>;
+    set(id: string, value: string): Promise<void>;
+    delete(id: string): Promise<void>;
+}

package/dist/credential-store.js

@@ -0,0 +1,71 @@
+import { ConfigurationError, CREDENTIAL_ID } from './config-file.js';
+export const KEYRING_SERVICE = '@martin4455/redmine-mcp-ro';
+export const LEGACY_KEYRING_SERVICE = 'redmine-mcp-ro';
+export class CredentialStoreUnavailableError extends ConfigurationError {
+}
+export function validateCredentialSize(value, platform = process.platform) {
+    if (!value)
+        throw new ConfigurationError('A nonempty credential value is required.');
+    if (platform === 'win32' && Buffer.byteLength(value, 'utf16le') > 2560) {
+        throw new ConfigurationError('Connection JSON exceeds the Windows credential store limit of 2560 UTF-16 bytes.');
+    }
+}
+/** Native APIs only: no shell arguments, files, keyutils or plaintext fallback. */
+export class SystemCredentialStore {
+    namespace;
+    constructor(namespace = 'current') {
+        this.namespace = namespace;
+    }
+    async entry(id) {
+        if (!CREDENTIAL_ID.test(id))
+            throw new ConfigurationError('Invalid credential identifier.');
+        if (!['darwin', 'linux', 'win32'].includes(process.platform)) {
+            throw new ConfigurationError('System credential storage is supported on macOS, Linux and Windows.');
+        }
+        try {
+            const { AsyncEntry } = await import('@napi-rs/keyring');
+            const service = this.namespace === 'legacy' ? LEGACY_KEYRING_SERVICE : KEYRING_SERVICE;
+            return new AsyncEntry(service, id, { linux: { store: 'secret-service' } });
+        }
+        catch {
+            throw this.unavailable();
+        }
+    }
+    unavailable() {
+        const hint = process.platform === 'linux'
+            ? 'Start and unlock a Secret Service provider (such as GNOME Keyring) in the same user D-Bus session.'
+            : process.platform === 'darwin'
+                ? 'Unlock the login Keychain and allow access for this Node.js installation.'
+                : 'Check Windows Credential Manager availability for the account running MCP.';
+        return new CredentialStoreUnavailableError(`System credential store is unavailable or access was denied. ${hint} Native platform dependencies must be installed. No plaintext fallback is used.`);
+    }
+    async get(id) {
+        const entry = await this.entry(id);
+        try {
+            return (await entry.getPassword(AbortSignal.timeout(30_000))) ?? null;
+        }
+        catch {
+            // Native errors may contain secret data. Never propagate them to logs.
+            throw this.unavailable();
+        }
+    }
+    async set(id, value) {
+        validateCredentialSize(value);
+        const entry = await this.entry(id);
+        try {
+            await entry.setPassword(value, AbortSignal.timeout(30_000));
+        }
+        catch {
+            throw this.unavailable();
+        }
+    }
+    async delete(id) {
+        const entry = await this.entry(id);
+        try {
+            await entry.deleteCredential(AbortSignal.timeout(30_000));
+        }
+        catch {
+            throw this.unavailable();
+        }
+    }
+}

package/dist/download-directory.d.ts

@@ -0,0 +1,3 @@
+export declare function validateDownloadDir(value: string): string;
+/** The operator chooses the root; tool callers can only choose relative subdirectories. */
+export declare function downloadDirectory(root: string | undefined, outputDir?: string, create?: boolean): Promise<string>;

package/dist/download-directory.js

@@ -0,0 +1,51 @@
+import { lstat, mkdir, realpath } from 'node:fs/promises';
+import path from 'node:path';
+export function validateDownloadDir(value) {
+    if (typeof value !== 'string' || !path.isAbsolute(value) || /[\x00-\x1f\x7f]/.test(value)) {
+        throw new Error('downloadDir must be an absolute path to a dedicated download directory');
+    }
+    return value;
+}
+/** The operator chooses the root; tool callers can only choose relative subdirectories. */
+export async function downloadDirectory(root, outputDir, create = false) {
+    if (root === undefined) {
+        throw new Error('Local downloads are disabled. Configure REDMINE_DOWNLOAD_DIR or settings.downloadDir first.');
+    }
+    validateDownloadDir(root);
+    const relative = outputDir ?? '';
+    if (typeof relative !== 'string' || path.isAbsolute(relative) || path.win32.isAbsolute(relative) ||
+        /[\\:\x00-\x1f\x7f]/.test(relative) || relative.split('/').some(part => part === '..' || part.startsWith('~'))) {
+        throw new Error('output_dir must be a relative subdirectory of the configured download directory');
+    }
+    // The configured root must already exist. Its canonical location is trusted by the operator.
+    const canonicalRoot = await realpath(root);
+    if (!(await lstat(canonicalRoot)).isDirectory())
+        throw new Error('Configured download directory is not a directory');
+    let directory = canonicalRoot;
+    for (const component of relative.split('/').filter(part => part && part !== '.')) {
+        directory = path.join(directory, component);
+        let info;
+        try {
+            info = await lstat(directory);
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+            if (!create)
+                continue;
+            try {
+                await mkdir(directory, { mode: 0o700 });
+            }
+            catch (error) {
+                if (error.code !== 'EEXIST')
+                    throw error;
+            }
+            info = await lstat(directory);
+        }
+        if (info.isSymbolicLink() || !info.isDirectory())
+            throw new Error('Download subdirectories must be directories without symlinks');
+        if (await realpath(directory) !== directory)
+            throw new Error('Download directory changed during the operation');
+    }
+    return directory;
+}

package/dist/http-client.d.ts

@@ -0,0 +1,14 @@
+import { type AxiosInstance } from 'axios';
+import type { RedmineConfig } from './types.js';
+export declare const DEFAULT_REQUEST_TIMEOUT_MS = 30000;
+export declare const DEFAULT_MAX_ATTACHMENT_BYTES: number;
+export declare const DEFAULT_MAX_CONTENT_BYTES: number;
+export declare function positiveInteger(value: number, name: string): number;
+export declare function requestLimits(config: RedmineConfig): {
+    requestTimeoutMs: number;
+    maxAttachmentBytes: number;
+    maxContentBytes: number;
+};
+export declare function redmineBaseUrl(value: string): URL;
+/** Apply the same origin and deadline policy to API calls, attachments and CLI checks. */
+export declare function createRedmineHttpClient(config: RedmineConfig): AxiosInstance;

package/dist/http-client.js

@@ -0,0 +1,99 @@
+import axios, { AxiosError } from 'axios';
+export const DEFAULT_REQUEST_TIMEOUT_MS = 30_000;
+export const DEFAULT_MAX_ATTACHMENT_BYTES = 50 * 1024 * 1024;
+export const DEFAULT_MAX_CONTENT_BYTES = 5 * 1024 * 1024;
+const MAX_API_RESPONSE_BYTES = 10 * 1024 * 1024;
+export function positiveInteger(value, name) {
+    if (!Number.isSafeInteger(value) || value <= 0) {
+        throw new Error(`${name} must be a positive safe integer`);
+    }
+    return value;
+}
+export function requestLimits(config) {
+    const requestTimeoutMs = positiveInteger(config.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS, 'requestTimeoutMs');
+    if (requestTimeoutMs > 2_147_483_647) {
+        throw new Error('requestTimeoutMs must not exceed 2147483647');
+    }
+    return {
+        requestTimeoutMs,
+        maxAttachmentBytes: positiveInteger(config.maxAttachmentBytes ?? DEFAULT_MAX_ATTACHMENT_BYTES, 'maxAttachmentBytes'),
+        maxContentBytes: positiveInteger(config.maxContentBytes ?? DEFAULT_MAX_CONTENT_BYTES, 'maxContentBytes'),
+    };
+}
+export function redmineBaseUrl(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new Error('Redmine URL must be an absolute HTTP or HTTPS URL');
+    }
+    if (!['https:', 'http:'].includes(url.protocol) || url.username || url.password || url.search || url.hash) {
+        throw new Error('Redmine URL must use HTTP or HTTPS without credentials, a query or a fragment');
+    }
+    return url;
+}
+/** Apply the same origin and deadline policy to API calls, attachments and CLI checks. */
+export function createRedmineHttpClient(config) {
+    const base = redmineBaseUrl(config.url);
+    const { requestTimeoutMs } = requestLimits(config);
+    const assertOrigin = (url) => {
+        if (url.origin !== base.origin || url.username || url.password || !['http:', 'https:'].includes(url.protocol)) {
+            throw new Error('Blocked request outside the configured Redmine origin');
+        }
+    };
+    const nativeAdapter = axios.getAdapter('http');
+    const adapter = async (request) => {
+        let url = new URL(axios.getUri(request));
+        for (let redirects = 0;; redirects++) {
+            assertOrigin(url);
+            // maxRedirects: 0 uses Node's native transport. follow-redirects logs headers
+            // (including the API key) when DEBUG=* or DEBUG=follow-redirects is enabled.
+            // A single signal from the interceptor bounds the entire redirect chain.
+            const response = await nativeAdapter({
+                ...request, url: url.href, baseURL: undefined, params: undefined,
+                maxRedirects: 0, validateStatus: () => true,
+            });
+            if (request.responseType === 'stream') {
+                // Axios can wrap an unread body in a lazy size-limiting stream. Closing
+                // that wrapper alone does not necessarily close the underlying socket.
+                response.data.once('close', () => response.request?.destroy?.());
+            }
+            const location = response.headers.location;
+            if ([301, 302, 303, 307, 308].includes(response.status) && location) {
+                response.data?.destroy?.();
+                if (redirects >= 5) {
+                    throw new AxiosError('Maximum number of redirects exceeded', AxiosError.ERR_FR_TOO_MANY_REDIRECTS, request);
+                }
+                url = new URL(String(location), url);
+                continue;
+            }
+            if (request.validateStatus && !request.validateStatus(response.status)) {
+                response.data?.destroy?.();
+                throw new AxiosError(`Request failed with status code ${response.status}`, response.status >= 500 ? AxiosError.ERR_BAD_RESPONSE : AxiosError.ERR_BAD_REQUEST, request, response.request, response);
+            }
+            return response;
+        }
+    };
+    const client = axios.create({
+        baseURL: base.href.replace(/\/+$/, ''),
+        timeout: requestTimeoutMs,
+        maxContentLength: MAX_API_RESPONSE_BYTES,
+        headers: { 'X-Redmine-API-Key': config.apiKey },
+        adapter,
+        maxRedirects: 0,
+    });
+    client.interceptors.request.use((request) => {
+        if (request.url && /^[a-z][a-z0-9+.-]*:/i.test(request.url)) {
+            assertOrigin(new URL(request.url));
+        }
+        assertOrigin(new URL(client.getUri(request)));
+        // Unlike socket timeouts, this deadline also bounds a continuously trickling response.
+        const deadline = AbortSignal.timeout(requestTimeoutMs);
+        request.signal = request.signal
+            ? AbortSignal.any([request.signal, deadline])
+            : deadline;
+        return request;
+    });
+    return client;
+}

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/index.js

@@ -0,0 +1,25 @@
+#!/usr/bin/env node
+import { Command } from 'commander';
+import { ConfigLoader } from './config-loader.js';
+import { ConfigurationError } from './config-file.js';
+import { startServer } from './server.js';
+const program = new Command()
+    .name('redmine-mcp-ro')
+    .description('Read-only Redmine MCP server using a local configuration and system credential store')
+    .version('0.3.0')
+    .option('-d, --config-dir <directory>', 'Directory containing .redmine-mcp (default: REDMINE_CONFIG_DIR or current directory)')
+    .option('-p, --profile <name>', 'Local profile (default: REDMINE_PROFILE or configured default)')
+    .parse();
+try {
+    const options = program.opts();
+    const config = await new ConfigLoader({ directory: options.configDir, profile: options.profile }).getConfig();
+    if (!config)
+        throw new ConfigurationError('No local configuration. Run redmine-mcp configure --config-dir <directory>, then pass the same directory to redmine-mcp-ro.');
+    console.error(`Using Redmine configuration from: ${config.source}`);
+    console.error(`Profile: ${config.profile}`);
+    await startServer(config);
+}
+catch (error) {
+    console.error(error instanceof ConfigurationError ? error.message : 'MCP startup failed. Check configuration, request limits and system credential store access.');
+    process.exitCode = 1;
+}

package/dist/local-configuration.d.ts

@@ -0,0 +1,35 @@
+import type { ConfigFile, CredentialStore, RedmineProfile } from './types.js';
+export interface ConfigurationOptions {
+    directory?: string;
+    profile?: string;
+    store?: CredentialStore;
+    legacyStore?: CredentialStore;
+}
+export interface ConfigChange {
+    config: ConfigFile;
+    warnings: string[];
+    profileRenames?: Array<{
+        from: string;
+        to: string;
+    }>;
+}
+export declare function validateApiKey(value: string): void;
+export interface Connection {
+    url: string;
+    apiKey: string;
+}
+export declare function parseConnection(raw: string | null): Connection;
+export declare function readConnection(store: CredentialStore, profile: RedmineProfile): Promise<Connection>;
+export declare class LocalConfiguration {
+    readonly configPath: string;
+    readonly store: CredentialStore;
+    private readonly legacyStore?;
+    constructor(options?: ConfigurationOptions);
+    read(): ConfigFile | null;
+    private cleanup;
+    private createCredential;
+    configure(name: string, url: string, apiKey: string): Promise<ConfigChange>;
+    migrate(): Promise<ConfigChange>;
+    useProfile(name: string): Promise<void>;
+    remove(name: string): Promise<ConfigChange>;
+}