@mokoconsulting/mokomysql-mcp 2.5.4 → 2.6.0

package/dist/migrate.js

@@ -0,0 +1,224 @@
+/* Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+ *
+ * This file is part of a Moko Consulting project.
+ *
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ *
+ * FILE INFORMATION
+ * DEFGROUP: mokomysql-mcp.Migrate
+ * INGROUP: mokomysql-mcp
+ * REPO: https://git.mokoconsulting.tech/MokoConsulting/mokomysql-mcp
+ * PATH: /source/migrate.ts
+ * BRIEF: Self-heal inline secrets in the MySQL MCP config into file-backed refs.
+ *
+ * No-inline-secrets policy (MokoCLI #1043). Any secret found INLINE in the
+ * on-disk `~/.mcp_mokomysql.json` is migrated to `~/.ssh/tokens/<slug>.token`
+ * and the config is rewritten so the field becomes `file:<path>`.
+ *
+ * mysql-specific: secret files are written as RAW values (NOT JSON). A MySQL
+ * password is an opaque string; `resolveRef()` reads the file verbatim, so a
+ * JSON wrapper would be read back literally and corrupt the credential. This
+ * intentionally diverges from the GitHub/OAuth JSON token-file shape used by
+ * token-based MCPs.
+ */
+import { constants as FS } from 'node:fs';
+import { access, chmod, mkdir, readFile, rename, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { resolve } from 'node:path';
+/** Directory that holds file-backed secrets. */
+function tokensDir() {
+    return resolve(homedir(), '.ssh', 'tokens');
+}
+/** True when the value is already a `file:<path>` reference (nothing to migrate). */
+function isFileRef(value) {
+    return typeof value === 'string' && /^file:/.test(value.trim());
+}
+/** True when the value is a non-empty inline literal that must be migrated. */
+function isInlineSecret(value) {
+    return typeof value === 'string' && value.trim() !== '' && !isFileRef(value);
+}
+/** Sanitize a slug component to the `[A-Za-z0-9._-]` alphabet. */
+function sanitize(part) {
+    return part.replace(/[^A-Za-z0-9._-]+/g, '-').replace(/^-+|-+$/g, '');
+}
+/** stderr only — stdout is the MCP stdio channel and must never carry logs. */
+function warn(message) {
+    process.stderr.write(`[mokomysql] WARNING: ${message}\n`);
+}
+/**
+ * Enumerate every inline secret across all connections. The ONLY top-level
+ * connection secret in this config shape is `password`; an inline PEM private
+ * key under `ssl.key` is also a secret value (a key *value*, not a path) and is
+ * migrated too. A `file:` ref or empty value is skipped.
+ */
+function findInlineSecrets(connections) {
+    const out = [];
+    for (const [key, raw] of Object.entries(connections)) {
+        if (!raw || typeof raw !== 'object')
+            continue;
+        const conn = raw;
+        const connSlug = sanitize(key) || 'connection';
+        if (isInlineSecret(conn.password)) {
+            out.push({
+                connectionKey: key,
+                label: `${key}.password`,
+                slug: `mysql-${connSlug}-password`,
+                value: conn.password,
+                apply: (ref) => {
+                    conn.password = ref;
+                },
+            });
+        }
+        const ssl = conn.ssl;
+        if (ssl && typeof ssl === 'object') {
+            const sslRec = ssl;
+            // An inline PEM private-key *value* (begins with a PEM header) is a
+            // secret; a short reference/path is left alone.
+            if (isInlineSecret(sslRec.key) && /BEGIN[^\n]*PRIVATE KEY/.test(sslRec.key)) {
+                out.push({
+                    connectionKey: key,
+                    label: `${key}.ssl.key`,
+                    slug: `mysql-${connSlug}-ssl-key`,
+                    value: sslRec.key,
+                    apply: (ref) => {
+                        sslRec.key = ref;
+                    },
+                });
+            }
+        }
+    }
+    return out;
+}
+/** True if the path exists. */
+async function exists(path) {
+    try {
+        await access(path, FS.F_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Write the raw secret to `~/.ssh/tokens/<slug>.token` (mode 0600). If the file
+ * already exists it is NOT overwritten — the existing file is reused. Returns
+ * the absolute token path. mysql reads this file RAW, so the content is the
+ * verbatim secret with no trailing newline and no JSON wrapper.
+ */
+async function writeTokenFile(slug, secret) {
+    const dir = tokensDir();
+    await mkdir(dir, { recursive: true, mode: 0o700 });
+    // Best-effort tighten perms if the dir pre-existed with looser bits.
+    await chmod(dir, 0o700).catch(() => { });
+    const tokenPath = resolve(dir, `${slug}.token`);
+    if (await exists(tokenPath)) {
+        warn(`secret file already exists, reusing without overwrite: ${tokenPath}`);
+        return tokenPath;
+    }
+    // Atomic: write temp in the same dir, chmod, rename into place.
+    const tmp = `${tokenPath}.tmp-${process.pid}`;
+    await writeFile(tmp, secret, { encoding: 'utf-8', mode: 0o600 });
+    await chmod(tmp, 0o600).catch(() => { });
+    await rename(tmp, tokenPath);
+    return tokenPath;
+}
+/** Collapse an absolute path under $HOME back to a portable `~/...` form. */
+function tildeify(absPath) {
+    const home = homedir();
+    if (absPath === home)
+        return '~';
+    const prefix = home.endsWith('/') || home.endsWith('\\') ? home : home + '/';
+    const prefixBack = home.endsWith('/') || home.endsWith('\\') ? home : home + '\\';
+    if (absPath.startsWith(prefix))
+        return '~/' + absPath.slice(prefix.length).replace(/\\/g, '/');
+    if (absPath.startsWith(prefixBack))
+        return '~/' + absPath.slice(prefixBack.length).replace(/\\/g, '/');
+    return absPath;
+}
+/**
+ * Atomically rewrite the config file with the migrated `file:` refs. Backs the
+ * original up to `<config>.bak` once (only if no `.bak` exists yet). The config
+ * is written mode 0600.
+ */
+async function rewriteConfig(configPath, parsed) {
+    const bak = `${configPath}.bak`;
+    if (!(await exists(bak))) {
+        const original = await readFile(configPath, 'utf-8');
+        await writeFile(bak, original, { encoding: 'utf-8', mode: 0o600 });
+        await chmod(bak, 0o600).catch(() => { });
+    }
+    const serialized = JSON.stringify(parsed, null, '\t') + '\n';
+    const tmp = `${configPath}.tmp-${process.pid}`;
+    await writeFile(tmp, serialized, { encoding: 'utf-8', mode: 0o600 });
+    await chmod(tmp, 0o600).catch(() => { });
+    await rename(tmp, configPath);
+    await chmod(configPath, 0o600).catch(() => { });
+}
+/**
+ * Self-heal inline secrets in the parsed config, mutating `parsed` in place so
+ * the subsequent `resolveSecretRefs` pass picks up the new `file:` refs.
+ *
+ * Behavior (no-inline-secrets policy):
+ *  - For each inline secret: warn to stderr (never echo the value), write a RAW
+ *    token file under `~/.ssh/tokens/`, and rewrite the config so the field is a
+ *    `file:` ref with the inline literal removed.
+ *  - Existing token files are reused, never overwritten.
+ *  - Config is backed up once to `<config>.bak`; writes are atomic; mode 0600.
+ *  - On ANY error (read-only FS, perms, unwritable config) → warn only and keep
+ *    the inline value for this run. Never throws, never loses the credential.
+ *
+ * Only runs against the real on-disk config path (the resolved
+ * `~/.mcp_mokomysql.json` or its `MYSQL_MCP_CONFIG` override).
+ */
+export async function migrateInlineSecrets(parsed, configPath) {
+    try {
+        if (!parsed.connections || typeof parsed.connections !== 'object')
+            return;
+        const inline = findInlineSecrets(parsed.connections);
+        if (inline.length === 0)
+            return;
+        // Only touch the config if it is the real on-disk file we can read.
+        if (!(await exists(configPath))) {
+            warn(`${inline.length} inline secret(s) found but config path is not a readable file ` +
+                `(${configPath}); leaving inline for this run.`);
+            return;
+        }
+        let migratedAny = false;
+        for (const field of inline) {
+            try {
+                warn(`inline secret detected at ${field.label}; migrating to a file-backed secret ` +
+                    `(no-inline-secrets policy, MokoCLI #1043). The value is NOT shown.`);
+                const tokenPath = await writeTokenFile(field.slug, field.value);
+                field.apply(`file:${tildeify(tokenPath)}`);
+                migratedAny = true;
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                warn(`failed to migrate ${field.label} to a file (${msg}); ` +
+                    `keeping the inline value for this run.`);
+                // Revert any ref we may have set on this field so resolution uses the literal.
+                field.apply(field.value);
+            }
+        }
+        if (migratedAny) {
+            try {
+                await rewriteConfig(configPath, parsed);
+                warn(`config rewritten with file-backed secret ref(s): ${configPath} ` +
+                    `(backup at ${configPath}.bak).`);
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                warn(`token file(s) written but rewriting the config failed (${msg}); ` +
+                    `the config still references the secret value(s) inline. ` +
+                    `The file-backed ref(s) are used for this run only.`);
+            }
+        }
+    }
+    catch (err) {
+        // Absolute backstop — migration must never crash the server.
+        const msg = err instanceof Error ? err.message : String(err);
+        warn(`secret auto-migration aborted (${msg}); continuing with config as-is.`);
+    }
+}
+export const __test = { sanitize, isInlineSecret, isFileRef, findInlineSecrets, tildeify };
+//# sourceMappingURL=migrate.js.map

package/dist/migrate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate.js","sourceRoot":"","sources":["../source/migrate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,SAAS,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACrF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAW,OAAO,EAAE,MAAM,WAAW,CAAC;AAE7C,gDAAgD;AAChD,SAAS,SAAS;IACjB,OAAO,OAAO,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;AAC7C,CAAC;AAED,qFAAqF;AACrF,SAAS,SAAS,CAAC,KAAc;IAChC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;AACjE,CAAC;AAED,+EAA+E;AAC/E,SAAS,cAAc,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,kEAAkE;AAClE,SAAS,QAAQ,CAAC,IAAY;IAC7B,OAAO,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AACvE,CAAC;AAED,+EAA+E;AAC/E,SAAS,IAAI,CAAC,OAAe;IAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,OAAO,IAAI,CAAC,CAAC;AAC3D,CAAC;AAiBD;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,WAAoC;IAC9D,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACtD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,SAAS;QAC9C,MAAM,IAAI,GAAG,GAA8B,CAAC;QAC5C,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC;QAE/C,IAAI,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnC,GAAG,CAAC,IAAI,CAAC;gBACR,aAAa,EAAE,GAAG;gBAClB,KAAK,EAAE,GAAG,GAAG,WAAW;gBACxB,IAAI,EAAE,SAAS,QAAQ,WAAW;gBAClC,KAAK,EAAE,IAAI,CAAC,QAAQ;gBACpB,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;oBACd,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC;gBACrB,CAAC;aACD,CAAC,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QACrB,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,GAA8B,CAAC;YAC9C,oEAAoE;YACpE,gDAAgD;YAChD,IAAI,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7E,GAAG,CAAC,IAAI,CAAC;oBACR,aAAa,EAAE,GAAG;oBAClB,KAAK,EAAE,GAAG,GAAG,UAAU;oBACvB,IAAI,EAAE,SAAS,QAAQ,UAAU;oBACjC,KAAK,EAAE,MAAM,CAAC,GAAG;oBACjB,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;wBACd,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC;oBAClB,CAAC;iBACD,CAAC,CAAC;YACJ,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,+BAA+B;AAC/B,KAAK,UAAU,MAAM,CAAC,IAAY;IACjC,IAAI,CAAC;QACJ,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,MAAc;IACzD,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,qEAAqE;IACrE,MAAM,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAExC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,QAAQ,CAAC,CAAC;IAChD,IAAI,MAAM,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC,0DAA0D,SAAS,EAAE,CAAC,CAAC;QAC5E,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,gEAAgE;IAChE,MAAM,GAAG,GAAG,GAAG,SAAS,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;IAC9C,MAAM,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjE,MAAM,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACxC,MAAM,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC7B,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,6EAA6E;AAC7E,SAAS,QAAQ,CAAC,OAAe;IAChC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,GAAG,CAAC;IACjC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC;IAC7E,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC;IAClF,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC/F,IAAI,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACvG,OAAO,OAAO,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,aAAa,CAAC,UAAkB,EAAE,MAAe;IAC/D,MAAM,GAAG,GAAG,GAAG,UAAU,MAAM,CAAC;IAChC,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACrD,MAAM,SAAS,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnE,MAAM,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC;IAC7D,MAAM,GAAG,GAAG,GAAG,UAAU,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;IAC/C,MAAM,SAAS,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrE,MAAM,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACxC,MAAM,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC9B,MAAM,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACzC,MAAiD,EACjD,UAAkB;IAElB,IAAI,CAAC;QACJ,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;YAAE,OAAO;QAE1E,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAEhC,oEAAoE;QACpE,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YACjC,IAAI,CACH,GAAG,MAAM,CAAC,MAAM,iEAAiE;gBAChF,IAAI,UAAU,iCAAiC,CAChD,CAAC;YACF,OAAO;QACR,CAAC;QAED,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC5B,IAAI,CAAC;gBACJ,IAAI,CACH,6BAA6B,KAAK,CAAC,KAAK,sCAAsC;oBAC7E,oEAAoE,CACrE,CAAC;gBACF,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;gBAChE,KAAK,CAAC,KAAK,CAAC,QAAQ,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBAC3C,WAAW,GAAG,IAAI,CAAC;YACpB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,IAAI,CACH,qBAAqB,KAAK,CAAC,KAAK,eAAe,GAAG,KAAK;oBACtD,wCAAwC,CACzC,CAAC;gBACF,+EAA+E;gBAC/E,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC1B,CAAC;QACF,CAAC;QAED,IAAI,WAAW,EAAE,CAAC;YACjB,IAAI,CAAC;gBACJ,MAAM,aAAa,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;gBACxC,IAAI,CACH,oDAAoD,UAAU,GAAG;oBAChE,cAAc,UAAU,QAAQ,CACjC,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,IAAI,CACH,0DAA0D,GAAG,KAAK;oBACjE,0DAA0D;oBAC1D,oDAAoD,CACrD,CAAC;YACH,CAAC;QACF,CAAC;IACF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,6DAA6D;QAC7D,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,CAAC,kCAAkC,GAAG,kCAAkC,CAAC,CAAC;IAC/E,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,MAAM,GAAG,EAAE,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC"}

package/dist/secrets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../source/secrets.ts"],"names":[],"mappings":"AAgDA;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAenE"}
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../source/secrets.ts"],"names":[],"mappings":"AAwDA;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAenE"}

package/dist/secrets.js

@@ -29,21 +29,27 @@ function expandHome(p) {
  * - anything else  -> returned unchanged, so inline literals keep working.
  *
  * A missing/unreadable file throws (fail loud) — a secret must never silently
- * degrade to the literal "file:..." string.
+ * degrade to the literal "file:..." string. An empty or whitespace-only file
+ * also throws, so a blank secret file never goes out as an empty value.
  */
 async function resolveRef(value) {
     const m = /^file:(.+)$/s.exec(value.trim());
     if (!m)
         return value;
     const path = expandHome(m[1].trim());
+    let trimmed;
     try {
         const raw = await readFile(path, 'utf-8');
-        return raw.replace(/\r?\n+$/, '');
+        trimmed = raw.replace(/\r?\n+$/, '');
     }
     catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
         throw new Error(`Failed to read secret file "${path}" (referenced as "${value}"): ${msg}`);
     }
+    if (trimmed.trim() === '') {
+        throw new Error(`Secret file "${path}" (referenced as "${value}") is empty or whitespace-only; refusing to use an empty secret value.`);
+    }
+    return trimmed;
 }
 /**
  * Recursively resolve every "file:" secret reference in a parsed config object,

package/dist/secrets.js.map

@@ -1 +1 @@
-{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../source/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,mFAAmF;AACnF,SAAS,UAAU,CAAC,CAAS;IAC5B,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,OAAO,EAAE,CAAC;IAChC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,OAAO,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,UAAU,CAAC,KAAa;IACtC,MAAM,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5C,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACrC,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC1C,OAAO,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,qBAAqB,KAAK,OAAO,GAAG,EAAE,CAAC,CAAC;IAC5F,CAAC;AACF,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAY;IACnD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;YACjB,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,UAAU,CAAC,CAAC,CAAC,CAAC;iBACnD,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,MAAM,iBAAiB,CAAC,CAAC,CAAC,CAAC;QACjE,CAAC;IACF,CAAC;SAAM,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,GAA8B,CAAC;QAC3C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;YACjB,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,UAAU,CAAC,CAAC,CAAC,CAAC;iBACnD,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,MAAM,iBAAiB,CAAC,CAAC,CAAC,CAAC;QACjE,CAAC;IACF,CAAC;AACF,CAAC"}
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../source/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,mFAAmF;AACnF,SAAS,UAAU,CAAC,CAAS;IAC5B,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,OAAO,EAAE,CAAC;IAChC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,OAAO,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,UAAU,CAAC,KAAa;IACtC,MAAM,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5C,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACrC,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC1C,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,qBAAqB,KAAK,OAAO,GAAG,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACd,gBAAgB,IAAI,qBAAqB,KAAK,wEAAwE,CACtH,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAY;IACnD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;YACjB,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,UAAU,CAAC,CAAC,CAAC,CAAC;iBACnD,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,MAAM,iBAAiB,CAAC,CAAC,CAAC,CAAC;QACjE,CAAC;IACF,CAAC;SAAM,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,GAA8B,CAAC;QAC3C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;YACjB,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,UAAU,CAAC,CAAC,CAAC,CAAC;iBACnD,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,MAAM,iBAAiB,CAAC,CAAC,CAAC,CAAC;QACjE,CAAC;IACF,CAAC;AACF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mokoconsulting/mokomysql-mcp",
-  "version": "2.5.4",
+  "version": "2.6.0",
   "description": "MCP server for MySQL database management — queries, schema, users, maintenance, and Joomla helpers",
   "type": "module",
   "main": "dist/index.js",